Merge 4585b48c6f into haskell-updates

.github/workflows/labels.yml

@@ -194,19 +194,15 @@ jobs:
                     expectedHash: artifact.digest
                   })
 
-                  // Get all currently set labels that we manage
-                  const before =
+                  // Create a map (Label -> Boolean) of all currently set labels.
+                  // Each label is set to True and can be disabled later.
+                  const before = Object.fromEntries(
                     (await github.paginate(github.rest.issues.listLabelsOnIssue, {
                       ...context.repo,
                       issue_number: pull_request.number
                     }))
-                    .map(({ name }) => name)
-                    .filter(name =>
-                      name.startsWith('10.rebuild') ||
-                      name == '11.by: package-maintainer' ||
-                      name.startsWith('12.approvals:') ||
-                      name == '12.approved-by: package-maintainer'
-                    )
+                    .map(({ name }) => [name, true])
+                  )
 
                   const approvals = new Set(
                     (await github.paginate(github.rest.pulls.listReviews, {
@@ -221,35 +217,43 @@ jobs:
                     JSON.parse(await readFile(`${pull_request.number}/maintainers.json`, 'utf-8'))
                   ).map(m => Number.parseInt(m, 10)))
 
-                  // And the labels that should be there
-                  const after = JSON.parse(await readFile(`${pull_request.number}/changed-paths.json`, 'utf-8')).labels
-                  if (approvals.size > 0) after.push(`12.approvals: ${approvals.size > 2 ? '3+' : approvals.size}`)
-                  if (Array.from(maintainers).some(m => approvals.has(m))) after.push('12.approved-by: package-maintainer')
+                  const evalLabels = JSON.parse(await readFile(`${pull_request.number}/changed-paths.json`, 'utf-8')).labels
 
-                  if (context.eventName == 'pull_request') {
-                    core.info('Skipping labeling on a pull_request event (no privileges).')
-                    return
-                  }
-
-                  // Remove the ones not needed anymore
-                  await Promise.all(
-                    before.filter(name => !after.includes(name))
-                    .map(name => github.rest.issues.removeLabel({
-                      ...context.repo,
-                      issue_number: pull_request.number,
-                      name
-                    }))
+                  // Manage the labels
+                  const after = Object.assign(
+                    {},
+                    before,
+                    // Ignore `evalLabels` if it's an array.
+                    // This can happen for older eval runs, before we switched to objects.
+                    // The old eval labels would have been set by the eval run,
+                    // so now they'll be present in `before`.
+                    // TODO: Simplify once old eval results have expired (~2025-10)
+                    (Array.isArray(evalLabels) ? undefined : evalLabels),
+                    {
+                      '12.approvals: 1': approvals.size == 1,
+                      '12.approvals: 2': approvals.size == 2,
+                      '12.approvals: 3+': approvals.size >= 3,
+                      '12.approved-by: package-maintainer': Array.from(maintainers).some(m => approvals.has(m)),
+                      '12.first-time contribution':
+                        [ 'NONE', 'FIRST_TIMER', 'FIRST_TIME_CONTRIBUTOR' ].includes(pull_request.author_association),
+                    }
                   )
 
-                  // And add the ones that aren't set already
-                  const added = after.filter(name => !before.includes(name))
-                  if (added.length > 0) {
-                    await github.rest.issues.addLabels({
-                      ...context.repo,
-                      issue_number: pull_request.number,
-                      labels: added
-                    })
-                  }
+                  // No need for an API request, if all labels are the same.
+                  const hasChanges = Object.keys(after).some(name => (before[name] ?? false) != after[name])
+                  if (log('Has changes', hasChanges, !hasChanges))
+                    return;
+
+                  // Skipping labeling on a pull_request event, because we have no privileges.
+                  const labels = Object.entries(after).filter(([,value]) => value).map(([name]) => name)
+                  if (log('Set labels', labels, context.eventName == 'pull_request'))
+                    return;
+
+                  await github.rest.issues.setLabels({
+                    ...context.repo,
+                    issue_number: pull_request.number,
+                    labels
+                  })
                 } catch (cause) {
                   throw new Error(`Labeling PR #${pull_request.number} failed.`, { cause })
                 }

ci/eval/compare/default.nix

@@ -31,10 +31,10 @@ let
             changed: ["package2", "package3"],
             removed: ["package4"],
           },
-          labels: [
-            "10.rebuild-darwin: 1-10",
-            "10.rebuild-linux: 1-10"
-          ],
+          labels: {
+            "10.rebuild-darwin: 1-10": true,
+            "10.rebuild-linux: 1-10": true
+          },
           rebuildsByKernel: {
             darwin: ["package1", "package2"],
             linux: ["package1", "package2", "package3"]
@@ -97,19 +97,21 @@ let
           rebuildCountByKernel
           ;
         labels =
-          (getLabels rebuildCountByKernel)
-          # Adds "10.rebuild-*-stdenv" label if the "stdenv" attribute was changed
-          ++ lib.mapAttrsToList (kernel: _: "10.rebuild-${kernel}-stdenv") (
-            lib.filterAttrs (_: lib.elem "stdenv") rebuildsByKernel
-          )
-          # Adds the "11.by: package-maintainer" label if all of the packages directly
-          # changed are maintained by the PR's author. (https://github.com/NixOS/ofborg/blob/df400f44502d4a4a80fa283d33f2e55a4e43ee90/ofborg/src/tagger.rs#L83-L88)
-          ++ lib.optional (
-            maintainers ? ${githubAuthorId}
-            && lib.all (lib.flip lib.elem maintainers.${githubAuthorId}) (
-              lib.flatten (lib.attrValues maintainers)
-            )
-          ) "11.by: package-maintainer";
+          getLabels rebuildCountByKernel
+          # Sets "10.rebuild-*-stdenv" label to whether the "stdenv" attribute was changed.
+          // lib.mapAttrs' (
+            kernel: rebuilds: lib.nameValuePair "10.rebuild-${kernel}-stdenv" (lib.elem "stdenv" rebuilds)
+          ) rebuildsByKernel
+          # Set the "11.by: package-maintainer" label to whether all packages directly
+          # changed are maintained by the PR's author.
+          # (https://github.com/NixOS/ofborg/blob/df400f44502d4a4a80fa283d33f2e55a4e43ee90/ofborg/src/tagger.rs#L83-L88)
+          // {
+            "11.by: package-maintainer" =
+              maintainers ? ${githubAuthorId}
+              && lib.all (lib.flip lib.elem maintainers.${githubAuthorId}) (
+                lib.flatten (lib.attrValues maintainers)
+              );
+          };
       }
     );
 

ci/eval/compare/utils.nix

@@ -151,7 +151,7 @@ rec {
     lib.genAttrs [ "linux" "darwin" ] filterKernel;
 
   /*
-    Maps an attrs of `kernel - rebuild counts` mappings to a list of labels
+    Maps an attrs of `kernel - rebuild counts` mappings to an attrs of labels
 
     Turns
       {
@@ -159,54 +159,37 @@ rec {
         darwin = 1;
       }
     into
-      [
-        "10.rebuild-darwin: 1"
-        "10.rebuild-darwin: 1-10"
-        "10.rebuild-linux: 11-100"
-      ]
+      {
+        "10.rebuild-darwin: 1" = true;
+        "10.rebuild-darwin: 1-10" = true;
+        "10.rebuild-darwin: 11-100" = false;
+        # [...]
+        "10.rebuild-darwin: 1" = false;
+        "10.rebuild-darwin: 1-10" = false;
+        "10.rebuild-linux: 11-100" = true;
+        # [...]
+      }
   */
   getLabels =
     rebuildCountByKernel:
-    lib.concatLists (
+    lib.mergeAttrsList (
       lib.mapAttrsToList (
         kernel: rebuildCount:
         let
-          numbers =
-            if rebuildCount == 0 then
-              [ "0" ]
-            else if rebuildCount == 1 then
-              [
-                "1"
-                "1-10"
-              ]
-            else if rebuildCount <= 10 then
-              [ "1-10" ]
-            else if rebuildCount <= 100 then
-              [ "11-100" ]
-            else if rebuildCount <= 500 then
-              [ "101-500" ]
-            else if rebuildCount <= 1000 then
-              [
-                "501-1000"
-                "501+"
-              ]
-            else if rebuildCount <= 2500 then
-              [
-                "1001-2500"
-                "501+"
-              ]
-            else if rebuildCount <= 5000 then
-              [
-                "2501-5000"
-                "501+"
-              ]
-            else
-              [
-                "5001+"
-                "501+"
-              ];
+          range = from: to: from <= rebuildCount && (to == null || rebuildCount <= to);
         in
-        lib.forEach numbers (number: "10.rebuild-${kernel}: ${number}")
+        lib.mapAttrs' (number: lib.nameValuePair "10.rebuild-${kernel}: ${number}") {
+          "0" = range 0 0;
+          "1" = range 1 1;
+          "1-10" = range 1 10;
+          "11-100" = range 11 100;
+          "101-500" = range 101 500;
+          "501-1000" = range 501 1000;
+          "501+" = range 501 null;
+          "1001-2500" = range 1001 2500;
+          "2501-5000" = range 2501 5000;
+          "5001+" = range 5001 null;
+        }
       ) rebuildCountByKernel
     );
 }

doc/release-notes/rl-2511.section.md

@@ -26,6 +26,9 @@
 
 - `telegram-desktop` packages now uses `Telegram` for its binary. The previous name was `telegram-desktop`. This is due to [an upstream decision](https://github.com/telegramdesktop/tdesktop/commit/56ff5808a3d766f892bc3c3305afb106b629ef6f) to make the name consistent with other platforms.
 
+- `podofo` has been updated from `0.9.8` to `1.0.0`. These releases are by nature very incompatable due to major api changes. The legacy versions can be found under `podofo_0_10` and `podofo_0_9`.
+  Changelog: https://github.com/podofo/podofo/blob/1.0.0/CHANGELOG.md, API-Migration-Guide: https://github.com/podofo/podofo/blob/1.0.0/API-MIGRATION.md.
+
 ## Other Notable Changes {#sec-nixpkgs-release-25.11-notable-changes}
 
 <!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->
@@ -43,7 +46,8 @@
 
 ### Breaking changes {#sec-nixpkgs-release-25.11-lib-breaking}
 
-- Create the first release note entry in this section!
+- `reaction` has been updated to version 2, which includes some breaking changes.
+  For more information, [check the release article](https://blog.ppom.me/en-reaction-v2).
 
 
 ### Deprecations {#sec-nixpkgs-release-25.11-lib-deprecations}

maintainers/maintainer-list.nix

@@ -1606,6 +1606,12 @@
     githubId = 7644264;
     name = "Andrew Gazelka";
   };
+  andrewgigena = {
+    email = "work@andrewgigena.dev";
+    github = "andrewgigena";
+    githubId = 37125554;
+    name = "Andrew Gigena";
+  };
   AndrewKvalheim = {
     email = "andrew@kvalhe.im";
     github = "AndrewKvalheim";
@@ -4622,6 +4628,13 @@
     githubId = 2245737;
     name = "Christopher Mark Poole";
   };
+  chrjabs = {
+    email = "contact@christophjabs.info";
+    github = "chrjabs";
+    githubId = 98587286;
+    name = "Christoph Jabs";
+    keys = [ { fingerprint = "47D6 1FEB CD86 F3EC D2E3  D68A 83D0 74F3 48B2 FD9D"; } ];
+  };
   chrpinedo = {
     github = "chrpinedo";
     githubId = 2324630;
@@ -5702,6 +5715,12 @@
     github = "DarkOnion0";
     githubId = 68606322;
   };
+  darkyzhou = {
+    name = "darkyzhou";
+    email = "me@zqy.io";
+    github = "darkyzhou";
+    githubId = 7220778;
+  };
   daru-san = {
     name = "Daru";
     email = "zadarumaka@proton.me";
@@ -5974,6 +5993,13 @@
     githubId = 30749142;
     keys = [ { fingerprint = "4E35 F2E5 2132 D654 E815  A672 DB2C BC24 2868 6000"; } ];
   };
+  debling = {
+    name = "Denilson S. Ebling";
+    email = "d.ebling8@gmail.com";
+    github = "debling";
+    githubId = 32403873;
+    keys = [ { fingerprint = "3EDD 9C88 B0F2 58F8 C25F  5D2C CCBC 8AA1 AF06 2142"; } ];
+  };
   declan = {
     name = "Declan Rixon";
     email = "declan.fraser.rixon@gmail.com";

nixos/doc/manual/release-notes/rl-2511.section.md

@@ -48,6 +48,8 @@
 
 [dwl](https://codeberg.org/dwl/dwl), a compact, hackable compositor for Wayland based on wlroots. Available as [programs.dwl](#opt-programs.dwl.enable).
 
+- [mautrix-discord](https://github.com/mautrix/discord), a Matrix-Discord puppeting/relay bridge. Available as [services.mautrix-discord](#opt-services.mautrix-discord.enable).
+
 ## Backward Incompatibilities {#sec-release-25.11-incompatibilities}
 
 <!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->

nixos/modules/module-list.nix

@@ -767,6 +767,7 @@
   ./services/matrix/lk-jwt-service.nix
   ./services/matrix/matrix-alertmanager.nix
   ./services/matrix/maubot.nix
+  ./services/matrix/mautrix-discord.nix
   ./services/matrix/mautrix-meta.nix
   ./services/matrix/mautrix-signal.nix
   ./services/matrix/mautrix-telegram.nix

nixos/modules/programs/yazi.nix

@@ -118,6 +118,9 @@ in
   };
 
   meta = {
-    maintainers = with lib.maintainers; [ linsui ];
+    maintainers = with lib.maintainers; [
+      linsui
+      ryan4yin
+    ];
   };
 }

nixos/modules/services/finance/libeufin/common.nix

@@ -96,7 +96,9 @@ libeufinComponent:
             };
           in
           {
-            path = [ config.services.postgresql.package ];
+            path = [
+              (if cfg.createLocalDatabase then config.services.postgresql.package else pkgs.postgresql)
+            ];
             serviceConfig = {
               Type = "oneshot";
               DynamicUser = true;

nixos/modules/services/mail/roundcube.nix

@@ -272,7 +272,7 @@ in
     ];
 
     systemd.services.roundcube-setup = lib.mkMerge [
-      (lib.mkIf (cfg.database.host == "localhost") {
+      (lib.mkIf localDB {
         requires = [ "postgresql.service" ];
         after = [ "postgresql.service" ];
       })
@@ -281,7 +281,9 @@ in
         after = [ "network-online.target" ];
         wantedBy = [ "multi-user.target" ];
 
-        path = [ config.services.postgresql.package ];
+        path = [
+          (if localDB then config.services.postgresql.package else pkgs.postgresql)
+        ];
         script =
           let
             psql = "${lib.optionalString (!localDB) "PGPASSFILE=${cfg.database.passwordFile}"} psql ${

nixos/modules/services/matrix/mautrix-discord.nix

@@ -0,0 +1,538 @@
+{
+  lib,
+  config,
+  pkgs,
+  ...
+}:
+let
+  cfg = config.services.mautrix-discord;
+  dataDir = cfg.dataDir;
+  format = pkgs.formats.yaml { };
+
+  registrationFile = "${dataDir}/discord-registration.yaml";
+
+  settingsFile = "${dataDir}/config.yaml";
+  settingsFileUnformatted = format.generate "discord-config-unsubstituted.yaml" cfg.settings;
+in
+{
+  options = {
+    services.mautrix-discord = {
+      enable = lib.mkEnableOption "Mautrix-Discord, a Matrix-Discord puppeting/relay-bot bridge";
+
+      package = lib.mkOption {
+        type = lib.types.package;
+        default = pkgs.mautrix-discord;
+        defaultText = lib.literalExpression "pkgs.mautrix-discord";
+        description = ''
+          The mautrix-discord package to use.
+        '';
+      };
+
+      settings = lib.mkOption {
+        type = lib.types.submodule {
+          freeformType = format.type;
+
+          config = {
+            _module.args = { inherit cfg lib; };
+          };
+
+          options = {
+            homeserver = lib.mkOption {
+              type = lib.types.attrs;
+              default = {
+                software = "standard";
+                status_endpoint = null;
+                message_send_checkpoint_endpoint = null;
+                async_media = false;
+                websocket = false;
+                ping_interval_seconds = 0;
+              };
+              description = ''
+                fullDataDiration.
+                                See [example-config.yaml](https://github.com/mautrix/discord/blob/main/example-config.yaml)
+                                for more information.
+              '';
+            };
+
+            appservice = lib.mkOption {
+              type = lib.types.attrs;
+              default = {
+                address = "http://localhost:8009";
+                port = 8009;
+                id = "discord";
+                bot = {
+                  username = "discordbot";
+                  displayname = "Discord bridge bot";
+                  avatar = "mxc://maunium.net/nIdEykemnwdisvHbpxflpDlC";
+                };
+                as_token = "generate";
+                hs_token = "generate";
+                database = {
+                  type = "sqlite3";
+                  uri = "file:/var/lib/mautrix-discord/mautrix-discord.db?_txlock=immediate";
+                };
+              };
+              defaultText = lib.literalExpression ''
+                {
+                  address = "http://localhost:8009";
+                  port = 8009;
+                  id = "discord";
+                  bot = {
+                    username = "discordbot";
+                    displayname = "Discord bridge bot";
+                    avatar = "mxc://maunium.net/nIdEykemnwdisvHbpxflpDlC";
+                  };
+                  as_token = "generate";
+                  hs_token = "generate";
+                  database = {
+                    type = "sqlite3";
+                    uri = "file:''${config.services.mautrix-discord.dataDir}/mautrix-discord.db?_txlock=immediate";
+                  };
+                }
+              '';
+              description = ''
+                Appservice configuration.
+                See [example-config.yaml](https://github.com/mautrix/discord/blob/main/example-config.yaml)
+                for more information.
+              '';
+            };
+
+            bridge = lib.mkOption {
+              type = lib.types.attrs;
+              default = {
+                username_template = "discord_{{.}}";
+                displayname_template = "{{or .GlobalName .Username}}{{if .Bot}} (bot){{end}}";
+                channel_name_template = "{{if or (eq .Type 3) (eq .Type 4)}}{{.Name}}{{else}}#{{.Name}}{{end}}";
+                guild_name_template = "{{.Name}}";
+                private_chat_portal_meta = "default";
+                public_address = null;
+                avatar_proxy_key = "generate";
+                portal_message_buffer = 128;
+                startup_private_channel_create_limit = 5;
+                delivery_receipts = false;
+                message_status_events = false;
+                message_error_notices = true;
+                restricted_rooms = true;
+                autojoin_thread_on_open = true;
+                embed_fields_as_tables = true;
+                mute_channels_on_create = false;
+                sync_direct_chat_list = false;
+                resend_bridge_info = false;
+                custom_emoji_reactions = true;
+                delete_portal_on_channel_delete = false;
+                delete_guild_on_leave = true;
+                federate_rooms = true;
+                prefix_webhook_messages = false;
+                enable_webhook_avatars = true;
+                use_discord_cdn_upload = true;
+                cache_media = "unencrypted";
+                direct_media = {
+                  enabled = false;
+                  server_name = "discord-media.example.com";
+                  allow_proxy = true;
+                  server_key = "generate";
+                };
+                animated_sticker = {
+                  target = "webp";
+                  args = {
+                    width = 320;
+                    height = 320;
+                    fps = 25;
+                  };
+                };
+                command_prefix = "!discord";
+                management_room_text = {
+                  welcome = "Hello, I'm a Discord bridge bot.";
+                  welcome_connected = "Use `help` for help.";
+                  welcome_unconnected = "Use `help` for help or `login` to log in.";
+                  additional_help = "";
+                };
+                backfill = {
+                  forward_limits = {
+                    initial = {
+                      dm = 0;
+                      channel = 0;
+                      thread = 0;
+                    };
+                    missed = {
+                      dm = 0;
+                      channel = 0;
+                      thread = 0;
+                    };
+                    max_guild_members = -1;
+                  };
+                };
+                encryption = {
+                  allow = false;
+                  default = false;
+                  appservice = false;
+                  msc4190 = false;
+                  require = false;
+                  allow_key_sharing = false;
+                  plaintext_mentions = false;
+                  delete_keys = {
+                    delete_outbound_on_ack = false;
+                    dont_store_outbound = false;
+                    ratchet_on_decrypt = false;
+                    delete_fully_used_on_decrypt = false;
+                    delete_prev_on_new_session = false;
+                    delete_on_device_delete = false;
+                    periodically_delete_expired = false;
+                    delete_outdated_inbound = false;
+                  };
+                  verification_levels = {
+                    receive = "unverified";
+                    send = "unverified";
+                    share = "cross-signed-tofu";
+                  };
+                  rotation = {
+                    enable_custom = false;
+                    milliseconds = 604800000;
+                    messages = 100;
+                    disable_device_change_key_rotation = false;
+                  };
+                };
+                provisioning = {
+                  prefix = "/_matrix/provision";
+                  shared_secret = "generate";
+                  debug_endpoints = false;
+                };
+                permissions = {
+                  "*" = "relay";
+                  # "example.com" = "user";
+                  # "@admin:example.com": "admin";
+                };
+              };
+              description = ''
+                Bridge configuration.
+                See [example-config.yaml](https://github.com/mautrix/discord/blob/main/example-config.yaml)
+                for more information.
+              '';
+            };
+          };
+        };
+        default = { };
+        example = lib.literalExpression ''
+          {
+            homeserver = {
+              address = "http://localhost:8008";
+              domain = "public-domain.tld";
+            };
+
+            appservice.public = {
+              prefix = "/public";
+              external = "https://public-appservice-address/public";
+            };
+
+            bridge.permissions = {
+              "example.com" = "full";
+              "@admin:example.com" = "admin";
+            };
+          }
+        '';
+        description = ''
+          {file}`config.yaml` configuration as a Nix attribute set.
+          Configuration options should match those described in
+          [example-config.yaml](https://github.com/mautrix/discord/blob/main/example-config.yaml).
+        '';
+      };
+
+      registerToSynapse = lib.mkOption {
+        type = lib.types.bool;
+        default = config.services.matrix-synapse.enable;
+        defaultText = lib.literalExpression "config.services.matrix-synapse.enable";
+        description = ''
+          Whether to add the bridge's app service registration file to
+          `services.matrix-synapse.settings.app_service_config_files`.
+        '';
+      };
+
+      dataDir = lib.mkOption {
+        type = lib.types.path;
+        default = "/var/lib/mautrix-discord";
+        defaultText = "/var/lib/mautrix-discord";
+        description = ''
+          Directory to store the bridge's configuration and database files.
+          This directory will be created if it does not exist.
+        '';
+      };
+
+      # TODO: Get upstream to add an environment File option. Refer to https://github.com/NixOS/nixpkgs/pull/404871#issuecomment-2895663652 and https://github.com/mautrix/discord/issues/187
+      environmentFile = lib.mkOption {
+        type = lib.types.nullOr lib.types.path;
+        default = null;
+        description = ''
+          File containing environment variables to substitute when copying the configuration
+          out of Nix store to the `services.mautrix-discord.dataDir`.
+          Can be used for storing the secrets without making them available in the Nix store.
+          For example, you can set `services.mautrix-discord.settings.appservice.as_token = "$MAUTRIX_DISCORD_APPSERVICE_AS_TOKEN"`
+          and then specify `MAUTRIX_DISCORD_APPSERVICE_AS_TOKEN="{token}"` in the environment file.
+          This value will get substituted into the configuration file as a token.
+        '';
+      };
+
+      serviceUnit = lib.mkOption {
+        type = lib.types.str;
+        readOnly = true;
+        default = "mautrix-discord.service";
+        description = ''
+          The systemd unit (a service or a target) for other services to depend on if they
+          need to be started after matrix-synapse.
+          This option is useful as the actual parent unit for all matrix-synapse processes
+          changes when configuring workers.
+        '';
+      };
+
+      registrationServiceUnit = lib.mkOption {
+        type = lib.types.str;
+        readOnly = true;
+        default = "mautrix-discord-registration.service";
+        description = ''
+          The registration service that generates the registration file.
+          Systemd unit (a service or a target) for other services to depend on if they
+          need to be started after mautrix-discord registration service.
+          This option is useful as the actual parent unit for all matrix-synapse processes
+          changes when configuring workers.
+        '';
+      };
+
+      serviceDependencies = lib.mkOption {
+        type = lib.types.listOf lib.types.str;
+        default =
+          [ cfg.registrationServiceUnit ]
+          ++ (lib.lists.optional config.services.matrix-synapse.enable config.services.matrix-synapse.serviceUnit)
+          ++ (lib.lists.optional config.services.matrix-conduit.enable "matrix-conduit.service")
+          ++ (lib.lists.optional config.services.dendrite.enable "dendrite.service");
+
+        defaultText = ''
+          [ cfg.registrationServiceUnit ] ++
+          (lib.lists.optional config.services.matrix-synapse.enable config.services.matrix-synapse.serviceUnit) ++
+          (lib.lists.optional config.services.matrix-conduit.enable "matrix-conduit.service") ++
+          (lib.lists.optional config.services.dendrite.enable "dendrite.service");
+        '';
+        description = ''
+          List of Systemd services to require and wait for when starting the application service.
+        '';
+      };
+    };
+  };
+  config = lib.mkIf cfg.enable {
+    assertions = [
+      {
+        assertion =
+          cfg.settings.homeserver.domain or "" != "" && cfg.settings.homeserver.address or "" != "";
+        message = ''
+          The options with information about the homeserver:
+          `services.mautrix-discord.settings.homeserver.domain` and
+          `services.mautrix-discord.settings.homeserver.address` have to be set.
+        '';
+      }
+      {
+        assertion = cfg.settings.bridge.permissions or { } != { };
+        message = ''
+          The option `services.mautrix-discord.settings.bridge.permissions` has to be set.
+        '';
+      }
+      {
+        assertion = cfg.settings.appservice.id != "";
+        message = ''
+          The option `services.mautrix-discord.settings.appservice.id` has to be set.
+        '';
+      }
+      {
+        assertion = cfg.settings.appservice.bot.username != "";
+        message = ''
+          The option `services.mautrix-discord.settings.appservice.bot.username` has to be set.
+        '';
+      }
+    ];
+
+    users.users.mautrix-discord = {
+      isSystemUser = true;
+      group = "mautrix-discord";
+      extraGroups = [ "mautrix-discord-registration" ];
+      home = dataDir;
+      description = "Mautrix-Discord bridge user";
+    };
+
+    users.groups.mautrix-discord = { };
+    users.groups.mautrix-discord-registration = {
+      members = lib.lists.optional config.services.matrix-synapse.enable "matrix-synapse";
+    };
+
+    services.matrix-synapse = lib.mkIf cfg.registerToSynapse {
+      settings.app_service_config_files = [ registrationFile ];
+    };
+
+    systemd.tmpfiles.rules = [
+      "d ${cfg.dataDir} 770 mautrix-discord mautrix-discord -"
+    ];
+
+    systemd.services = {
+      matrix-synapse = lib.mkIf cfg.registerToSynapse {
+        serviceConfig.SupplementaryGroups = [ "mautrix-discord-registration" ];
+        # Make synapse depend on the registration service when auto-registering
+        wants = [ "mautrix-discord-registration.service" ];
+        after = [ "mautrix-discord-registration.service" ];
+      };
+
+      mautrix-discord-registration = {
+        description = "Mautrix-Discord registration generation service";
+
+        wantedBy = lib.mkIf cfg.registerToSynapse [ "multi-user.target" ];
+        before = lib.mkIf cfg.registerToSynapse [ "matrix-synapse.service" ];
+
+        path = [
+          pkgs.yq
+          pkgs.envsubst
+          cfg.package
+        ];
+
+        script = ''
+          # substitute the settings file by environment variables
+          # in this case read from EnvironmentFile
+          rm -f '${settingsFile}'
+          old_umask=$(umask)
+          umask 0177
+          envsubst \
+            -o '${settingsFile}' \
+            -i '${settingsFileUnformatted}'
+          config_has_tokens=$(yq '.appservice | has("as_token") and has("hs_token")' '${settingsFile}')
+          registration_already_exists=$([[ -f '${registrationFile}' ]] && echo "true" || echo "false")
+          echo "There are tokens in the config: $config_has_tokens"
+          echo "Registration already existed: $registration_already_exists"
+          # tokens not configured from config/environment file, and registration file
+          # is already generated, override tokens in config to make sure they are not lost
+          if [[ $config_has_tokens == "false" && $registration_already_exists == "true" ]]; then
+            echo "Copying as_token, hs_token from registration into configuration"
+            yq -sY '.[0].appservice.as_token = .[1].as_token
+              | .[0].appservice.hs_token = .[1].hs_token
+              | .[0]' '${settingsFile}' '${registrationFile}' \
+              > '${settingsFile}.tmp'
+            mv '${settingsFile}.tmp' '${settingsFile}'
+          fi
+          # make sure --generate-registration does not affect config.yaml
+          cp '${settingsFile}' '${settingsFile}.tmp'
+          echo "Generating registration file"
+          mautrix-discord \
+            --generate-registration \
+            --config='${settingsFile}.tmp' \
+            --registration='${registrationFile}'
+          rm '${settingsFile}.tmp'
+          # no tokens configured, and new were just generated by generate registration for first time
+          if [[ $config_has_tokens == "false" && $registration_already_exists == "false" ]]; then
+            echo "Copying newly generated as_token, hs_token from registration into configuration"
+            yq -sY '.[0].appservice.as_token = .[1].as_token
+              | .[0].appservice.hs_token = .[1].hs_token
+              | .[0]' '${settingsFile}' '${registrationFile}' \
+              > '${settingsFile}.tmp'
+            mv '${settingsFile}.tmp' '${settingsFile}'
+          fi
+          # make sure --generate-registration does not affect config.yaml
+          cp '${settingsFile}' '${settingsFile}.tmp'
+          echo "Generating registration file"
+          mautrix-discord \
+            --generate-registration \
+            --config='${settingsFile}.tmp' \
+            --registration='${registrationFile}'
+          rm '${settingsFile}.tmp'
+          # no tokens configured, and new were just generated by generate registration for first time
+          if [[ $config_has_tokens == "false" && $registration_already_exists == "false" ]]; then
+            echo "Copying newly generated as_token, hs_token from registration into configuration"
+            yq -sY '.[0].appservice.as_token = .[1].as_token
+              | .[0].appservice.hs_token = .[1].hs_token
+              | .[0]' '${settingsFile}' '${registrationFile}' \
+              > '${settingsFile}.tmp'
+            mv '${settingsFile}.tmp' '${settingsFile}'
+          fi
+          # Make sure correct tokens are in the registration file
+          if [[ $config_has_tokens == "true" || $registration_already_exists == "true" ]]; then
+            echo "Copying as_token, hs_token from configuration to the registration file"
+            yq -sY '.[1].as_token = .[0].appservice.as_token
+              | .[1].hs_token = .[0].appservice.hs_token
+              | .[1]' '${settingsFile}' '${registrationFile}' \
+              > '${registrationFile}.tmp'
+            mv '${registrationFile}.tmp' '${registrationFile}'
+          fi
+          umask $old_umask
+          chown :mautrix-discord-registration '${registrationFile}'
+          chmod 640 '${registrationFile}'
+        '';
+
+        serviceConfig = {
+          Type = "oneshot";
+          RemainAfterExit = true;
+          UMask = 27;
+
+          User = "mautrix-discord";
+          Group = "mautrix-discord";
+
+          SystemCallFilter = [ "@system-service" ];
+
+          ProtectSystem = "strict";
+          ProtectHome = true;
+
+          ReadWritePaths = [ dataDir ];
+          StateDirectory = "mautrix-discord";
+          EnvironmentFile = cfg.environmentFile;
+        };
+
+        restartTriggers = [ settingsFileUnformatted ];
+      };
+
+      mautrix-discord = {
+        description = "Mautrix-Discord, a Matrix-Discord puppeting/relaybot bridge";
+
+        wantedBy = [ "multi-user.target" ];
+        wants = [ "network-online.target" ] ++ cfg.serviceDependencies;
+        after = [ "network-online.target" ] ++ cfg.serviceDependencies;
+        path = [
+          pkgs.lottieconverter
+          pkgs.ffmpeg-headless
+        ];
+
+        serviceConfig = {
+          Type = "simple";
+          User = "mautrix-discord";
+          Group = "mautrix-discord";
+          PrivateUsers = true;
+          Restart = "on-failure";
+          RestartSec = 30;
+          WorkingDirectory = dataDir;
+          ExecStart = ''
+            ${lib.getExe cfg.package} \
+              --config='${settingsFile}'
+          '';
+          EnvironmentFile = cfg.environmentFile;
+
+          ProtectSystem = "strict";
+          ProtectHome = true;
+          ProtectKernelTunables = true;
+          ProtectKernelModules = true;
+          ProtectControlGroups = true;
+          PrivateDevices = true;
+          PrivateTmp = true;
+          RestrictSUIDSGID = true;
+          RestrictRealtime = true;
+          LockPersonality = true;
+          ProtectKernelLogs = true;
+          ProtectHostname = true;
+          ProtectClock = true;
+
+          SystemCallArchitectures = "native";
+          SystemCallErrorNumber = "EPERM";
+          SystemCallFilter = "@system-service";
+          ReadWritePaths = [ cfg.dataDir ];
+        };
+
+        restartTriggers = [ settingsFileUnformatted ];
+      };
+    };
+
+    meta = {
+      maintainers = with lib.maintainers; [
+        mistyttm
+      ];
+    };
+  };
+}

nixos/modules/services/networking/seafile.nix

@@ -84,7 +84,7 @@ in
       default = { };
       description = ''
         Configuration for ccnet, see
-        <https://manual.seafile.com/config/ccnet-conf/>
+        <https://manual.seafile.com/11.0/config/ccnet-conf/>
         for supported values.
       '';
     };
@@ -122,7 +122,7 @@ in
       default = { };
       description = ''
         Configuration for seafile-server, see
-        <https://manual.seafile.com/config/seafile-conf/>
+        <https://manual.seafile.com/11.0/config/seafile-conf/>
         for supported values.
       '';
     };
@@ -235,7 +235,7 @@ in
       type = types.lines;
       description = ''
         Extra config to append to `seahub_settings.py` file.
-        Refer to <https://manual.seafile.com/config/seahub_settings_py/>
+        Refer to <https://manual.seafile.com/11.0/config/seahub_settings_py/>
         for all available options.
       '';
     };

nixos/modules/services/security/opensnitch.nix

@@ -13,12 +13,12 @@ let
       file = pkgs.writeText "rule" (builtins.toJSON cfg);
     }
   );
-
 in
 {
   options = {
     services.opensnitch = {
       enable = lib.mkEnableOption "Opensnitch application firewall";
+      package = lib.mkPackageOption pkgs "opensnitch" { };
 
       rules = lib.mkOption {
         default = { };
@@ -192,13 +192,13 @@ in
     services.opensnitch.settings = lib.mapAttrs (_: v: lib.mkDefault v) (
       builtins.fromJSON (
         builtins.unsafeDiscardStringContext (
-          builtins.readFile "${pkgs.opensnitch}/etc/opensnitchd/default-config.json"
+          builtins.readFile "${cfg.package}/etc/opensnitchd/default-config.json"
         )
       )
     );
 
     systemd = {
-      packages = [ pkgs.opensnitch ];
+      packages = [ cfg.package ];
       services.opensnitchd = {
         wantedBy = [ "multi-user.target" ];
         serviceConfig = {
@@ -210,7 +210,7 @@ in
             in
             [
               ""
-              "${pkgs.opensnitch}/bin/opensnitchd --config-file ${format.generate "default-config.json" preparedSettings}"
+              "${cfg.package}/bin/opensnitchd --config-file ${format.generate "default-config.json" preparedSettings}"
             ];
         };
         preStart = lib.mkIf (cfg.rules != { }) (
@@ -245,7 +245,7 @@ in
       };
       tmpfiles.rules = [
         "d ${cfg.settings.Rules.Path} 0750 root root - -"
-        "L+ /etc/opensnitchd/system-fw.json - - - - ${pkgs.opensnitch}/etc/opensnitchd/system-fw.json"
+        "L+ /etc/opensnitchd/system-fw.json - - - - ${cfg.package}/etc/opensnitchd/system-fw.json"
       ];
     };
 

nixos/modules/services/system/nix-daemon.nix

@@ -230,6 +230,7 @@ in
         IOSchedulingPriority = cfg.daemonIOSchedPriority;
         LimitNOFILE = 1048576;
         Delegate = "yes";
+        DelegateSubgroup = "supervisor";
       };
 
       restartTriggers = [ config.environment.etc."nix/nix.conf".source ];

nixos/modules/services/web-apps/immich.nix

@@ -46,6 +46,9 @@ let
     mkOption
     mkEnableOption
     ;
+
+  postgresqlPackage =
+    if cfg.database.enable then config.services.postgresql.package else pkgs.postgresql;
 in
 {
   options.services.immich = {
@@ -228,6 +231,11 @@ in
         assertion = !isPostgresUnixSocket -> cfg.secretsFile != null;
         message = "A secrets file containing at least the database password must be provided when unix sockets are not used.";
       }
+      {
+        # When removing this assertion, please adjust the nixosTests accordingly.
+        assertion = cfg.database.enable -> lib.versionOlder config.services.postgresql.package.version "17";
+        message = "Immich doesn't support PostgreSQL 17+, yet.";
+      }
     ];
 
     services.postgresql = mkIf cfg.database.enable {
@@ -265,7 +273,7 @@ in
       in
       [
         ''
-          ${lib.getExe' config.services.postgresql.package "psql"} -d "${cfg.database.name}" -f "${sqlFile}"
+          ${lib.getExe' postgresqlPackage "psql"} -d "${cfg.database.name}" -f "${sqlFile}"
         ''
       ];
 
@@ -333,7 +341,7 @@ in
       path = [
         # gzip and pg_dumpall are used by the backup service
         pkgs.gzip
-        config.services.postgresql.package
+        postgresqlPackage
       ];
 
       serviceConfig = commonServiceConfig // {

nixos/modules/services/web-apps/nextcloud.nix

@@ -95,6 +95,7 @@ let
         ++ optional cfg.caching.apcu apcu
         ++ optional cfg.caching.redis redis
         ++ optional cfg.caching.memcached memcached
+        ++ optional (cfg.settings.log_type == "systemd") systemd
       )
       ++ cfg.phpExtraExtensions all; # Enabled by user
     extraConfig = toKeyValue cfg.phpOptions;
@@ -859,7 +860,7 @@ in
             default = "syslog";
             description = ''
               Logging backend to use.
-              systemd requires the php-systemd package to be added to services.nextcloud.phpExtraExtensions.
+              systemd automatically adds the php-systemd extensions to services.nextcloud.phpExtraExtensions.
               See the [nextcloud documentation](https://docs.nextcloud.com/server/latest/admin_manual/configuration_server/logging_configuration.html) for details.
             '';
           };

nixos/modules/services/web-servers/minio.nix

@@ -18,7 +18,10 @@ let
     '';
 in
 {
-  meta.maintainers = [ maintainers.bachp ];
+  meta.maintainers = with maintainers; [
+    bachp
+    ryan4yin
+  ];
 
   options.services.minio = {
     enable = mkEnableOption "Minio Object Storage";

nixos/tests/all-tests.nix

@@ -543,7 +543,14 @@ in
   mimir = runTest ./mimir.nix;
   galene = discoverTests (import ./galene.nix);
   gancio = runTest ./gancio.nix;
-  garage = handleTest ./garage { };
+  garage_1 = import ./garage {
+    inherit runTest;
+    package = pkgs.garage_1;
+  };
+  garage_2 = import ./garage {
+    inherit runTest;
+    package = pkgs.garage_2;
+  };
   gatus = runTest ./gatus.nix;
   getaddrinfo = runTest ./getaddrinfo.nix;
   gemstash = handleTest ./gemstash.nix { };
@@ -810,6 +817,7 @@ in
   matrix-continuwuity = runTest ./matrix/continuwuity.nix;
   matrix-synapse = runTest ./matrix/synapse.nix;
   matrix-synapse-workers = runTest ./matrix/synapse-workers.nix;
+  mautrix-discord = runTest ./matrix/mautrix-discord.nix;
   mattermost = handleTest ./mattermost { };
   mautrix-meta-postgres = runTest ./matrix/mautrix-meta-postgres.nix;
   mautrix-meta-sqlite = runTest ./matrix/mautrix-meta-sqlite.nix;

nixos/tests/alps.nix

@@ -28,8 +28,10 @@ in
         enableSubmission = true;
         enableSubmissions = true;
         tlsTrustedAuthorities = "${certs.ca.cert}";
-        sslCert = "${certs.${domain}.cert}";
-        sslKey = "${certs.${domain}.key}";
+        config.smtpd_tls_chain_files = [
+          "${certs.${domain}.key}"
+          "${certs.${domain}.cert}"
+        ];
       };
       services.dovecot2 = {
         enable = true;

nixos/tests/croc.nix

@@ -13,6 +13,7 @@ in
     maintainers = [
       equirosa
       SuperSandro2000
+      ryan4yin
     ];
   };
 

nixos/tests/garage/basic.nix

@@ -1,106 +1,40 @@
-args@{ mkNode, ver, ... }:
-(import ../make-test-python.nix (
-  { pkgs, ... }:
-  {
-    name = "garage-basic";
-    meta = {
-      maintainers = with pkgs.lib.maintainers; [ raitobezarius ];
+{
+  lib,
+  mkNode,
+  package,
+  testScriptSetup,
+  ...
+}:
+{
+  name = "garage-basic";
+
+  nodes = {
+    single_node = mkNode {
+      extraSettings =
+        if (lib.versionAtLeast package.version "2") then
+          {
+            replication_factor = 1;
+            consistency_mode = "consistent";
+          }
+        else
+          {
+            replication_mode = "none";
+          };
     };
+  };
 
-    nodes = {
-      single_node = mkNode { replicationMode = "none"; };
-    };
-
-    testScript = ''
-      from typing import List
-      from dataclasses import dataclass
-      import re
-
-      start_all()
-
-      cur_version_regex = re.compile('Current cluster layout version: (?P<ver>\d*)')
-      key_creation_regex = re.compile('Key name: (?P<key_name>.*)\nKey ID: (?P<key_id>.*)\nSecret key: (?P<secret_key>.*)')
-
-      @dataclass
-      class S3Key:
-         key_name: str
-         key_id: str
-         secret_key: str
-
-      @dataclass
-      class GarageNode:
-         node_id: str
-         host: str
-
-      def get_node_fqn(machine: Machine) -> GarageNode:
-        node_id, host = machine.succeed("garage node id").split('@')
-        return GarageNode(node_id=node_id, host=host)
-
-      def get_node_id(machine: Machine) -> str:
-        return get_node_fqn(machine).node_id
-
-      def get_layout_version(machine: Machine) -> int:
-        version_data = machine.succeed("garage layout show")
-        m = cur_version_regex.search(version_data)
-        if m and m.group('ver') is not None:
-          return int(m.group('ver')) + 1
-        else:
-          raise ValueError('Cannot find current layout version')
-
-      def apply_garage_layout(machine: Machine, layouts: List[str]):
-         for layout in layouts:
-            machine.succeed(f"garage layout assign {layout}")
-         version = get_layout_version(machine)
-         machine.succeed(f"garage layout apply --version {version}")
-
-      def create_api_key(machine: Machine, key_name: str) -> S3Key:
-         output = machine.succeed(f"garage key ${
-           if ver == "0_8" then "new --name" else "create"
-         } {key_name}")
-         m = key_creation_regex.match(output)
-         if not m or not m.group('key_id') or not m.group('secret_key'):
-            raise ValueError('Cannot parse API key data')
-         return S3Key(key_name=key_name, key_id=m.group('key_id'), secret_key=m.group('secret_key'))
-
-      def get_api_key(machine: Machine, key_pattern: str) -> S3Key:
-         output = machine.succeed(f"garage key info {key_pattern}")
-         m = key_creation_regex.match(output)
-         if not m or not m.group('key_name') or not m.group('key_id') or not m.group('secret_key'):
-             raise ValueError('Cannot parse API key data')
-         return S3Key(key_name=m.group('key_name'), key_id=m.group('key_id'), secret_key=m.group('secret_key'))
-
-      def test_bucket_writes(node):
-        node.succeed("garage bucket create test-bucket")
-        s3_key = create_api_key(node, "test-api-key")
-        node.succeed("garage bucket allow --read --write test-bucket --key test-api-key")
-        other_s3_key = get_api_key(node, 'test-api-key')
-        assert other_s3_key.secret_key == other_s3_key.secret_key
-        node.succeed(
-          f"mc alias set test-garage http://[::1]:3900 {s3_key.key_id} {s3_key.secret_key} --api S3v4"
-        )
-        node.succeed("echo test | mc pipe test-garage/test-bucket/test.txt")
-        assert node.succeed("mc cat test-garage/test-bucket/test.txt").strip() == "test"
-
-      def test_bucket_over_http(node, bucket='test-bucket', url=None):
-        if url is None:
-           url = f"{bucket}.web.garage"
-
-        node.succeed(f'garage bucket website --allow {bucket}')
-        node.succeed(f'echo hello world | mc pipe test-garage/{bucket}/index.html')
-        assert (node.succeed(f"curl -H 'Host: {url}' http://localhost:3902")).strip() == 'hello world'
+  testScript = # python
+    ''
+      ${testScriptSetup}
 
       with subtest("Garage works as a single-node S3 storage"):
         single_node.wait_for_unit("garage.service")
         single_node.wait_for_open_port(3900)
         # Now Garage is initialized.
         single_node_id = get_node_id(single_node)
-        apply_garage_layout(single_node, [f'-z qemutest -c ${
-          if ver == "0_8" then "1" else "1G"
-        } "{single_node_id}"'])
+        apply_garage_layout(single_node, [f'-z qemutest -c 1G "{single_node_id}"'])
         # Now Garage is operational.
         test_bucket_writes(single_node)
         test_bucket_over_http(single_node)
     '';
-  }
-))
-  args
+}

nixos/tests/garage/common.nix

@@ -0,0 +1,85 @@
+{ ... }:
+{
+  _module.args.testScriptSetup = # python
+    ''
+      from typing import List
+      from dataclasses import dataclass
+      import re
+
+      start_all()
+
+      cur_version_regex = re.compile(r'Current cluster layout version: (?P<ver>\d*)')
+
+      @dataclass
+      class S3Key:
+         key_name: str
+         key_id: str
+         secret_key: str
+
+      @dataclass
+      class GarageNode:
+         node_id: str
+         host: str
+
+      def get_node_fqn(machine: Machine) -> GarageNode:
+        node_id, host = machine.succeed("garage node id").split('@')
+        return GarageNode(node_id=node_id, host=host)
+
+      def get_node_id(machine: Machine) -> str:
+        return get_node_fqn(machine).node_id
+
+      def get_layout_version(machine: Machine) -> int:
+        version_data = machine.succeed("garage layout show")
+        m = cur_version_regex.search(version_data)
+        if m and m.group('ver') is not None:
+          return int(m.group('ver')) + 1
+        else:
+          raise ValueError('Cannot find current layout version')
+
+      def apply_garage_layout(machine: Machine, layouts: List[str]):
+         for layout in layouts:
+            machine.succeed(f"garage layout assign {layout}")
+         version = get_layout_version(machine)
+         machine.succeed(f"garage layout apply --version {version}")
+
+      def create_api_key(machine: Machine, key_name: str) -> S3Key:
+         output = machine.succeed(f"garage key create {key_name}")
+         return parse_api_key_data(output)
+
+      def get_api_key(machine: Machine, key_pattern: str) -> S3Key:
+         output = machine.succeed(f"garage key info {key_pattern}")
+         return parse_api_key_data(output)
+
+      def parse_api_key_data(text) -> S3Key:
+        key_creation_regex = re.compile(r'Key name: \s*(?P<key_name>.*)|' r'Key ID: \s*(?P<key_id>.*)|' r'Secret key: \s*(?P<secret_key>.*)', re.IGNORECASE)
+        fields = {}
+        for match in key_creation_regex.finditer(text):
+          for key, value in match.groupdict().items():
+            if value:
+              fields[key] = value.strip()
+        try:
+          return S3Key(**fields)
+        except TypeError as e:
+          raise ValueError(f"Cannot parse API key data. Missing required field(s): {e}")
+
+      def test_bucket_writes(node):
+        node.succeed("garage bucket create test-bucket")
+        s3_key = create_api_key(node, "test-api-key")
+        node.succeed("garage bucket allow --read --write test-bucket --key test-api-key")
+        other_s3_key = get_api_key(node, 'test-api-key')
+        assert other_s3_key.secret_key == other_s3_key.secret_key
+        node.succeed(
+          f"mc alias set test-garage http://[::1]:3900 {s3_key.key_id} {s3_key.secret_key} --api S3v4"
+        )
+        node.succeed("echo test | mc pipe test-garage/test-bucket/test.txt")
+        assert node.succeed("mc cat test-garage/test-bucket/test.txt").strip() == "test"
+
+      def test_bucket_over_http(node, bucket='test-bucket', url=None):
+        if url is None:
+           url = f"{bucket}.web.garage"
+
+        node.succeed(f'garage bucket website --allow {bucket}')
+        node.succeed(f'echo hello world | mc pipe test-garage/{bucket}/index.html')
+        assert (node.succeed(f"curl -H 'Host: {url}' http://localhost:3902")).strip() == 'hello world'
+    '';
+}

nixos/tests/garage/default.nix

@@ -1,16 +1,12 @@
 {
-  system ? builtins.currentSystem,
-  config ? { },
-  pkgs ? import ../../.. { inherit system config; },
+  runTest,
+  package,
 }:
-with pkgs.lib;
-
 let
   mkNode =
-    package:
     {
-      replicationMode,
       publicV6Address ? "::1",
+      extraSettings ? { },
     }:
     { pkgs, ... }:
     {
@@ -30,8 +26,6 @@ let
         enable = true;
         inherit package;
         settings = {
-          replication_mode = replicationMode;
-
           rpc_bind_addr = "[::]:3901";
           rpc_public_addr = "[${publicV6Address}]:3901";
           rpc_secret = "5c1915fa04d0b6739675c61bf5907eb0fe3d9c69850c83820f51b4d25d13868c";
@@ -47,7 +41,7 @@ let
             root_domain = ".web.garage";
             index = "index.html";
           };
-        };
+        } // extraSettings;
       };
       environment.systemPackages = [ pkgs.minio-client ];
 
@@ -55,24 +49,24 @@ let
       virtualisation.diskSize = 2 * 1024;
     };
 in
-foldl
-  (
-    matrix: ver:
-    matrix
-    // {
-      "basic${toString ver}" = import ./basic.nix {
-        inherit system pkgs ver;
-        mkNode = mkNode pkgs."garage_${ver}";
-      };
-      "with-3node-replication${toString ver}" = import ./with-3node-replication.nix {
-        inherit system pkgs ver;
-        mkNode = mkNode pkgs."garage_${ver}";
-      };
-    }
-  )
-  { }
-  [
-    "0_8"
-    "0_9"
-    "1_x"
-  ]
+{
+  basic = runTest {
+    imports = [
+      ./common.nix
+      ./basic.nix
+    ];
+    _module.args = {
+      inherit mkNode package;
+    };
+  };
+
+  with-3node-replication = runTest {
+    imports = [
+      ./common.nix
+      ./with-3node-replication.nix
+    ];
+    _module.args = {
+      inherit mkNode package;
+    };
+  };
+}

nixos/tests/garage/with-3node-replication.nix

@@ -1,107 +1,47 @@
-args@{ mkNode, ver, ... }:
-(import ../make-test-python.nix (
-  { pkgs, ... }:
-  {
-    name = "garage-3node-replication";
-    meta = {
-      maintainers = with pkgs.lib.maintainers; [ raitobezarius ];
+{
+  lib,
+  mkNode,
+  package,
+  testScriptSetup,
+  ...
+}:
+let
+  extraSettings =
+    if (lib.versionAtLeast package.version "2") then
+      {
+        replication_factor = 3;
+        consistency_mode = "consistent";
+      }
+    else
+      {
+        replication_mode = "3";
+      };
+in
+{
+  name = "garage-3node-replication";
+
+  nodes = {
+    node1 = mkNode {
+      inherit extraSettings;
+      publicV6Address = "fc00:1::1";
     };
-
-    nodes = {
-      node1 = mkNode {
-        replicationMode = "3";
-        publicV6Address = "fc00:1::1";
-      };
-      node2 = mkNode {
-        replicationMode = "3";
-        publicV6Address = "fc00:1::2";
-      };
-      node3 = mkNode {
-        replicationMode = "3";
-        publicV6Address = "fc00:1::3";
-      };
-      node4 = mkNode {
-        replicationMode = "3";
-        publicV6Address = "fc00:1::4";
-      };
+    node2 = mkNode {
+      inherit extraSettings;
+      publicV6Address = "fc00:1::2";
     };
+    node3 = mkNode {
+      inherit extraSettings;
+      publicV6Address = "fc00:1::3";
+    };
+    node4 = mkNode {
+      inherit extraSettings;
+      publicV6Address = "fc00:1::4";
+    };
+  };
 
-    testScript = ''
-      from typing import List
-      from dataclasses import dataclass
-      import re
-      start_all()
-
-      cur_version_regex = re.compile('Current cluster layout version: (?P<ver>\d*)')
-      key_creation_regex = re.compile('Key name: (?P<key_name>.*)\nKey ID: (?P<key_id>.*)\nSecret key: (?P<secret_key>.*)')
-
-      @dataclass
-      class S3Key:
-         key_name: str
-         key_id: str
-         secret_key: str
-
-      @dataclass
-      class GarageNode:
-         node_id: str
-         host: str
-
-      def get_node_fqn(machine: Machine) -> GarageNode:
-        node_id, host = machine.succeed("garage node id").split('@')
-        return GarageNode(node_id=node_id, host=host)
-
-      def get_node_id(machine: Machine) -> str:
-        return get_node_fqn(machine).node_id
-
-      def get_layout_version(machine: Machine) -> int:
-        version_data = machine.succeed("garage layout show")
-        m = cur_version_regex.search(version_data)
-        if m and m.group('ver') is not None:
-          return int(m.group('ver')) + 1
-        else:
-          raise ValueError('Cannot find current layout version')
-
-      def apply_garage_layout(machine: Machine, layouts: List[str]):
-         for layout in layouts:
-            machine.succeed(f"garage layout assign {layout}")
-         version = get_layout_version(machine)
-         machine.succeed(f"garage layout apply --version {version}")
-
-      def create_api_key(machine: Machine, key_name: str) -> S3Key:
-         output = machine.succeed(f"garage key ${
-           if ver == "0_8" then "new --name" else "create"
-         } {key_name}")
-         m = key_creation_regex.match(output)
-         if not m or not m.group('key_id') or not m.group('secret_key'):
-            raise ValueError('Cannot parse API key data')
-         return S3Key(key_name=key_name, key_id=m.group('key_id'), secret_key=m.group('secret_key'))
-
-      def get_api_key(machine: Machine, key_pattern: str) -> S3Key:
-         output = machine.succeed(f"garage key info {key_pattern}")
-         m = key_creation_regex.match(output)
-         if not m or not m.group('key_name') or not m.group('key_id') or not m.group('secret_key'):
-             raise ValueError('Cannot parse API key data')
-         return S3Key(key_name=m.group('key_name'), key_id=m.group('key_id'), secret_key=m.group('secret_key'))
-
-      def test_bucket_writes(node):
-        node.succeed("garage bucket create test-bucket")
-        s3_key = create_api_key(node, "test-api-key")
-        node.succeed("garage bucket allow --read --write test-bucket --key test-api-key")
-        other_s3_key = get_api_key(node, 'test-api-key')
-        assert other_s3_key.secret_key == other_s3_key.secret_key
-        node.succeed(
-          f"mc alias set test-garage http://[::1]:3900 {s3_key.key_id} {s3_key.secret_key} --api S3v4"
-        )
-        node.succeed("echo test | mc pipe test-garage/test-bucket/test.txt")
-        assert node.succeed("mc cat test-garage/test-bucket/test.txt").strip() == "test"
-
-      def test_bucket_over_http(node, bucket='test-bucket', url=None):
-        if url is None:
-           url = f"{bucket}.web.garage"
-
-        node.succeed(f'garage bucket website --allow {bucket}')
-        node.succeed(f'echo hello world | mc pipe test-garage/{bucket}/index.html')
-        assert (node.succeed(f"curl -H 'Host: {url}' http://localhost:3902")).strip() == 'hello world'
+  testScript = # python
+    ''
+      ${testScriptSetup}
 
       with subtest("Garage works as a multi-node S3 storage"):
         nodes = ('node1', 'node2', 'node3', 'node4')
@@ -125,7 +65,7 @@ args@{ mkNode, ver, ... }:
         zones = ["nixcon", "nixcon", "paris_meetup", "fosdem"]
         apply_garage_layout(node1,
         [
-          f'{ndata.node_id} -z {zones[index]} -c ${if ver == "0_8" then "1" else "1G"}'
+          f'{ndata.node_id} -z {zones[index]} -c 1G'
           for index, ndata in enumerate(node_ids.values())
         ])
         # Now Garage is operational.
@@ -133,6 +73,4 @@ args@{ mkNode, ver, ... }:
         for node in nodes:
            test_bucket_over_http(get_machine(node))
     '';
-  }
-))
-  args
+}

nixos/tests/installer.nix

@@ -722,6 +722,10 @@ let
                   libxml2.bin
                   libxslt.bin
                   nixos-artwork.wallpapers.simple-dark-gray-bottom
+                  (nixos-rebuild-ng.override {
+                    withNgSuffix = false;
+                    withReexec = true;
+                  })
                   ntp
                   perlPackages.ConfigIniFiles
                   perlPackages.FileSlurp
@@ -1110,7 +1114,7 @@ in
   simple = makeInstallerTest "simple" (
     simple-test-config
     // {
-      passthru.override = args: makeInstallerTest "simple" simple-test-config // args;
+      passthru.override = args: makeInstallerTest "simple" (simple-test-config // args);
     }
   );
 

nixos/tests/matrix/mautrix-discord.nix

@@ -0,0 +1,168 @@
+{ pkgs, ... }:
+let
+  homeserverUrl = "http://homeserver:8008";
+in
+{
+  name = "mautrix-discord";
+  meta.maintainers = pkgs.mautrix-discord.meta.maintainers;
+
+  nodes = {
+    homeserver =
+      { pkgs, ... }:
+      {
+        services.matrix-synapse = {
+          enable = true;
+          settings = {
+            server_name = "homeserver";
+            database.name = "sqlite3";
+
+            enable_registration = true;
+            # don't use this in production, always use some form of verification
+            enable_registration_without_verification = true;
+
+            listeners = [
+              {
+                bind_addresses = [ "0.0.0.0" ];
+                port = 8008;
+                resources = [
+                  {
+                    "compress" = true;
+                    "names" = [ "client" ];
+                  }
+                  {
+                    "compress" = false;
+                    "names" = [ "federation" ];
+                  }
+                ];
+                tls = false;
+                type = "http";
+              }
+            ];
+          };
+        };
+
+        services.mautrix-discord = {
+          enable = true;
+          registerToSynapse = true; # Enable automatic registration
+
+          settings = {
+            homeserver = {
+              address = homeserverUrl;
+              domain = "homeserver";
+            };
+
+            appservice = {
+              address = "http://homeserver:8009";
+              port = 8009;
+              id = "discord";
+              bot = {
+                username = "discordbot";
+                displayname = "Discord bridge bot";
+                avatar = "mxc://maunium.net/nIdEykemnwdisvHbpxflpDlC";
+              };
+              # These will be generated automatically
+              as_token = "generate";
+              hs_token = "generate";
+
+              database = {
+                type = "sqlite3";
+                uri = "file:/var/lib/mautrix-discord/mautrix-discord.db?_txlock=immediate";
+              };
+            };
+
+            bridge = {
+              permissions = {
+                "@alice:homeserver" = "user";
+                "*" = "relay";
+              };
+            };
+          };
+        };
+
+        networking.firewall.allowedTCPPorts = [
+          8008
+          8009
+        ];
+      };
+
+    client =
+      { pkgs, ... }:
+      {
+        environment.systemPackages = [
+          (pkgs.writers.writePython3Bin "do_test"
+            {
+              libraries = [ pkgs.python3Packages.matrix-nio ];
+              flakeIgnore = [
+                "F401" # imported but unused
+                "E302" # expected 2 blank lines
+              ];
+            }
+            ''
+              import sys
+              import asyncio
+              from nio import AsyncClient, RoomMessageNotice, RoomCreateResponse
+
+
+              async def message_callback(matrix: AsyncClient, msg: str, _r, e):
+                  print(f"Received message: {msg}")
+
+
+              async def run(homeserver: str):
+                  client = AsyncClient(homeserver, "@test:homeserver")
+
+                  # Register a new user
+                  response = await client.register("test", "password123")
+                  if not response.transport_response.ok:
+                      print(f"Failed to register: {response}")
+                      return False
+
+                  # Login
+                  response = await client.login("password123")
+                  if not response.transport_response.ok:
+                      print(f"Failed to login: {response}")
+                      return False
+
+                  print("Successfully logged in and basic functionality works")
+                  await client.close()
+                  return True
+
+
+              if __name__ == "__main__":
+                  if len(sys.argv) != 2:
+                      print("Usage: do_test <homeserver_url>")
+                      sys.exit(1)
+
+                  homeserver_url = sys.argv[1]
+                  success = asyncio.run(run(homeserver_url))
+                  sys.exit(0 if success else 1)
+            ''
+          )
+        ];
+      };
+  };
+
+  testScript = ''
+    start_all()
+
+    with subtest("wait for homeserver and bridge to be ready"):
+        homeserver.wait_for_unit("matrix-synapse.service")
+        homeserver.wait_for_open_port(8008)
+        homeserver.wait_for_unit("mautrix-discord.service")
+        homeserver.wait_for_open_port(8009)
+
+    with subtest("verify registration file was created"):
+        homeserver.wait_until_succeeds("test -f /var/lib/mautrix-discord/discord-registration.yaml")
+        homeserver.succeed("ls -la /var/lib/mautrix-discord/")
+
+    with subtest("verify bridge connects to homeserver"):
+        # Give the bridge a moment to connect
+        homeserver.sleep(5)
+
+        # Check that the bridge is running and listening
+        homeserver.succeed("systemctl is-active mautrix-discord.service")
+        homeserver.succeed("netstat -tlnp | grep :8009")
+
+    with subtest("test basic matrix functionality"):
+        client.succeed("do_test ${homeserverUrl} >&2")
+  '';
+}

nixos/tests/matrix/synapse.nix

@@ -200,13 +200,7 @@ in
 
             # disable obsolete protocols, something old versions of twisted are still using
             smtpd_tls_protocols = "TLSv1.3, TLSv1.2, !TLSv1.1, !TLSv1, !SSLv2, !SSLv3";
-            smtp_tls_protocols = "TLSv1.3, TLSv1.2, !TLSv1.1, !TLSv1, !SSLv2, !SSLv3";
             smtpd_tls_mandatory_protocols = "TLSv1.3, TLSv1.2, !TLSv1.1, !TLSv1, !SSLv2, !SSLv3";
-            smtp_tls_mandatory_protocols = "TLSv1.3, TLSv1.2, !TLSv1.1, !TLSv1, !SSLv2, !SSLv3";
-            smtp_tls_chain_files = [
-              "${mailerCerts.${mailerDomain}.key}"
-              "${mailerCerts.${mailerDomain}.cert}"
-            ];
             smtpd_tls_chain_files = [
               "${mailerCerts.${mailerDomain}.key}"
               "${mailerCerts.${mailerDomain}.cert}"

nixos/tests/minio.nix

@@ -48,7 +48,10 @@ in
 {
   name = "minio";
   meta = with pkgs.lib.maintainers; {
-    maintainers = [ bachp ];
+    maintainers = [
+      bachp
+      ryan4yin
+    ];
   };
 
   nodes = {

nixos/tests/schleuder.nix

@@ -12,8 +12,10 @@ import ./make-test-python.nix {
         enable = true;
         enableSubmission = true;
         tlsTrustedAuthorities = "${certs.ca.cert}";
-        sslCert = "${certs.${domain}.cert}";
-        sslKey = "${certs.${domain}.key}";
+        config.smtpd_tls_chain_files = [
+          "${certs.${domain}.key}"
+          "${certs.${domain}.cert}"
+        ];
         inherit domain;
         destination = [ domain ];
         localRecipients = [

nixos/tests/web-apps/immich-public-proxy.nix

@@ -30,6 +30,9 @@
         port = 8002;
         settings.ipp.responseHeaders."X-NixOS" = "Rules";
       };
+
+      # TODO: Remove when PostgreSQL 17 is supported.
+      services.postgresql.package = pkgs.postgresql_16;
     };
 
   testScript = ''

nixos/tests/web-apps/immich.nix

@@ -18,6 +18,9 @@
         enable = true;
         environment.IMMICH_LOG_LEVEL = "verbose";
       };
+
+      # TODO: Remove when PostgreSQL 17 is supported.
+      services.postgresql.package = pkgs.postgresql_16;
     };
 
   testScript = ''

pkgs/README.md

@@ -521,6 +521,8 @@ When using the `patches` parameter to `mkDerivation`, make sure the patch name c
 >
 > See [Versioning](#versioning) for details on package versioning.
 
+The following describes two ways to include the patch. Regardless of how the patch is included, you _must_ ensure its purpose is clear and obvious. This enables other maintainers to more easily determine when old patches are no longer required. Typically, you can improve clarity with carefully considered filenames, attribute names, and/or comments; these should explain the patch's _intention_. Additionally, it may sometimes be helpful to clarify _how_ it resolves the issue. For example: _"fix gcc14 build by adding missing include"_.
+
 ### Fetching patches
 
 In the interest of keeping our maintenance burden and the size of Nixpkgs to a minimum, patches already merged upstream or published elsewhere _should_ be retrieved using `fetchpatch2`:

pkgs/applications/audio/qpwgraph/default.nix

@@ -14,14 +14,14 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "qpwgraph";
-  version = "0.9.3";
+  version = "0.9.4";
 
   src = fetchFromGitLab {
     domain = "gitlab.freedesktop.org";
     owner = "rncbc";
     repo = "qpwgraph";
     rev = "v${finalAttrs.version}";
-    sha256 = "sha256-6aJymZjuUMezEbOosveXyiY7y+XgGk3E8Dd4tb8UyrU=";
+    sha256 = "sha256-VvOdorj+CpFSI+iyVeMR0enXGO5mLPE8KiaHGuG/KDQ=";
   };
 
   nativeBuildInputs = [

pkgs/applications/editors/vim/plugins/non-generated/avante-nvim/default.nix

@@ -12,12 +12,12 @@
   pkgs,
 }:
 let
-  version = "0.0.25-unstable-2025-06-20";
+  version = "0.0.25-unstable-2025-06-21";
   src = fetchFromGitHub {
     owner = "yetone";
     repo = "avante.nvim";
-    rev = "060c0de2aa2ef7c9e6e100f3bd8ef92c085d0555";
-    hash = "sha256-g5GVTRy1RiNNYrVIQbHxOu1ihxlQk/kww3DEKJ6hF9Q=";
+    rev = "86743a1d7d6232a820709986e971b3c1de62d9a7";
+    hash = "sha256-7lLnC/tcl5yVM6zBIk41oJ3jhRTv8AqXwJdXF2yPjwk=";
   };
   avante-nvim-lib = rustPlatform.buildRustPackage {
     pname = "avante-nvim-lib";

pkgs/applications/editors/vim/plugins/non-generated/blink-cmp/default.nix

@@ -8,19 +8,19 @@
   gitMinimal,
 }:
 let
-  version = "1.3.1";
+  version = "1.4.1";
   src = fetchFromGitHub {
     owner = "Saghen";
     repo = "blink.cmp";
     tag = "v${version}";
-    hash = "sha256-ZMq7zXXP3QL73zNfgDNi7xipmrbNwBoFPzK4K0dr6Zs=";
+    hash = "sha256-0RmX/uANgU/di3Iu0V6Oe3jZj4ikzeegW/XQUZhPgRc=";
   };
   blink-fuzzy-lib = rustPlatform.buildRustPackage {
     inherit version src;
     pname = "blink-fuzzy-lib";
 
     useFetchCargoVendor = true;
-    cargoHash = "sha256-IDoDugtNWQovfSstbVMkKHLBXKa06lxRWmywu4zyS3M=";
+    cargoHash = "sha256-/8eiZyJEwPXAviwVMFTr+NKSwMwxdraKtrlXNU0cBM4=";
 
     nativeBuildInputs = [ gitMinimal ];
 

pkgs/applications/editors/vscode/extensions/default.nix

@@ -2451,8 +2451,8 @@ let
         mktplcRef = {
           name = "vscode-vibrancy-continued";
           publisher = "illixion";
-          version = "1.1.53";
-          hash = "sha256-6yhyGMX1U9clMNkcQRjNfa+HpLvWVI1WvhTUyn4g3ZY=";
+          version = "1.1.54";
+          hash = "sha256-CzhDStBa/LB/bzgzrFCUEcVDeBluWJPblneUbHdIcRE=";
         };
         meta = {
           downloadPage = "https://marketplace.visualstudio.com/items?itemName=illixion.vscode-vibrancy-continued";

pkgs/applications/editors/vscode/extensions/myriad-dreamin.tinymist/default.nix

@@ -11,7 +11,7 @@ vscode-utils.buildVscodeMarketplaceExtension {
     name = "tinymist";
     publisher = "myriad-dreamin";
     inherit (tinymist) version;
-    hash = "sha256-1mBzimFM/ntjL/d0YkoCds5MtXKwB52jzcHEWpx3Ggo=";
+    hash = "sha256-QhME94U4iVUSXGLlGqM+X8WbnnxGIVeKKJYEWWAMztg=";
   };
 
   nativeBuildInputs = [

pkgs/applications/emulators/libretro/cores/flycast.nix

@@ -8,13 +8,13 @@
 }:
 mkLibretroCore {
   core = "flycast";
-  version = "0-unstable-2025-06-06";
+  version = "0-unstable-2025-06-20";
 
   src = fetchFromGitHub {
     owner = "flyinghead";
     repo = "flycast";
-    rev = "8f033723a1b3437c8e3c8b42a92331eebe53ed0b";
-    hash = "sha256-RrWBN8RDAS7RcIOouU3x2Pv/RKrshrmmmCZCeXQ6upk=";
+    rev = "449d256995de36de0629dd1b97f4d67a0e50c92e";
+    hash = "sha256-7+Dn7+AUnd3+eEKRMuahaxiEMWTT1uUEP2y0ZgIs81Q=";
     fetchSubmodules = true;
   };
 

pkgs/applications/emulators/libretro/cores/genesis-plus-gx.nix

@@ -5,13 +5,13 @@
 }:
 mkLibretroCore {
   core = "genesis-plus-gx";
-  version = "0-unstable-2025-06-13";
+  version = "0-unstable-2025-06-22";
 
   src = fetchFromGitHub {
     owner = "libretro";
     repo = "Genesis-Plus-GX";
-    rev = "def3a7c0e413ef35a7d9d4430e5c9c9a5698b4fe";
-    hash = "sha256-MCLPReWzW+NsEVtt4ySplLzGKGAaNXgDtoPYJC2yY3I=";
+    rev = "e1b0d20b66441c0ff220abbb1da8e6a911b9a761";
+    hash = "sha256-pvzLI3G6046W11x8Sfev6W5tGYn8/d2EnmIQc99aHN4=";
   };
 
   meta = {

pkgs/applications/graphics/veusz/default.nix

@@ -2,25 +2,28 @@
   lib,
   python3Packages,
   fetchPypi,
-  libsForQt5,
+  qt6,
 }:
 
 python3Packages.buildPythonApplication rec {
   pname = "veusz";
-  version = "3.6.2";
+  version = "4.1";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "whcaxF5LMEJNj8NSYeLpnb5uJboRl+vCQ1WxBrJjldE=";
+    hash = "sha256-s7TaDnt+nEIAmAqiZf9aYPFWVtSX22Ruz8eMpxMRr0U=";
   };
 
   nativeBuildInputs = [
-    libsForQt5.wrapQtAppsHook
     python3Packages.sip
     python3Packages.tomli
+    qt6.qmake
+    qt6.wrapQtAppsHook
   ];
 
-  buildInputs = [ libsForQt5.qtbase ];
+  dontUseQmakeConfigure = true;
+
+  buildInputs = [ qt6.qtbase ];
 
   # veusz is a script and not an ELF-executable, so wrapQtAppsHook will not wrap
   # it automatically -> we have to do it explicitly
@@ -33,7 +36,7 @@ python3Packages.buildPythonApplication rec {
   # really have a corresponding path, so patching the location of PyQt5 inplace
   postPatch = ''
     substituteInPlace pyqt_setuptools.py \
-      --replace "get_path('platlib')" "'${python3Packages.pyqt5}/${python3Packages.python.sitePackages}'"
+      --replace-fail "get_path('platlib')" "'${python3Packages.pyqt5}/${python3Packages.python.sitePackages}'"
     patchShebangs tests/runselftest.py
   '';
 
@@ -45,9 +48,9 @@ python3Packages.buildPythonApplication rec {
     "--qt-libinfix="
   ];
 
-  propagatedBuildInputs = with python3Packages; [
+  dependencies = with python3Packages; [
     numpy
-    pyqt5
+    pyqt6
     # optional requirements:
     dbus-python
     h5py
@@ -56,16 +59,20 @@ python3Packages.buildPythonApplication rec {
   ];
 
   installCheckPhase = ''
+    runHook preInstallCheck
+
     wrapQtApp "tests/runselftest.py"
     QT_QPA_PLATFORM=minimal tests/runselftest.py
+
+    runHook postInstallCheck
   '';
 
-  meta = with lib; {
+  meta = {
     description = "Scientific plotting and graphing program with a GUI";
     mainProgram = "veusz";
     homepage = "https://veusz.github.io/";
-    license = licenses.gpl2Plus;
-    platforms = platforms.linux;
-    maintainers = with maintainers; [ laikq ];
+    license = lib.licenses.gpl2Plus;
+    platforms = lib.platforms.linux;
+    maintainers = with lib.maintainers; [ laikq ];
   };
 }

pkgs/applications/misc/krename/default.nix

@@ -11,7 +11,7 @@
   kjsembed,
   taglib,
   exiv2,
-  podofo,
+  podofo_0_9,
   kcrash,
 }:
 
@@ -39,7 +39,7 @@ mkDerivation rec {
   buildInputs = [
     taglib
     exiv2
-    podofo
+    podofo_0_9
   ];
 
   nativeBuildInputs = [

pkgs/applications/misc/maliit-framework/default.nix

@@ -26,25 +26,17 @@
   wayland-scanner,
 }:
 
-mkDerivation rec {
+mkDerivation {
   pname = "maliit-framework";
-  version = "2.3.0";
+  version = "2.3.0-unstable-2024-06-24";
 
   src = fetchFromGitHub {
     owner = "maliit";
     repo = "framework";
-    tag = version;
-    sha256 = "sha256-q+hiupwlA0PfG+xtomCUp2zv6HQrGgmOd9CU193ucrY=";
+    rev = "ba6f7eda338a913f2c339eada3f0382e04f7dd67";
+    hash = "sha256-iwWLnstQMG8F6uE5rKF6t2X43sXQuR/rIho2RN/D9jE=";
   };
 
-  patches = [
-    # FIXME: backport GCC 12 build fix, remove for next release
-    (fetchpatch {
-      url = "https://github.com/maliit/framework/commit/86e55980e3025678882cb9c4c78614f86cdc1f04.diff";
-      hash = "sha256-5R+sCI05vJX5epu6hcDSWWzlZ8ns1wKEJ+u8xC6d8Xo=";
-    })
-  ];
-
   buildInputs = [
     at-spi2-atk
     at-spi2-core

pkgs/applications/misc/maliit-keyboard/default.nix

@@ -8,7 +8,6 @@
   libchewing,
   libpinyin,
   maliit-framework,
-  presage,
   qtfeedback,
   qtmultimedia,
   qtquickcontrols2,
@@ -19,15 +18,15 @@
   wrapGAppsHook3,
 }:
 
-mkDerivation rec {
+mkDerivation {
   pname = "maliit-keyboard";
-  version = "2.3.1";
+  version = "2.3.1-unstable-2024-09-04";
 
   src = fetchFromGitHub {
     owner = "maliit";
     repo = "keyboard";
-    rev = version;
-    sha256 = "sha256-XH3sKQuNMLgJi2aV+bnU2cflwkFIw4RYVfxzQiejCT0=";
+    rev = "cbb0bbfa67354df76c25dbc3b1ea99a376fd15bb";
+    sha256 = "sha256-6ITlV/RJkPDrnsFyeWYWaRTYTaY6NAbHDqpUZGGKyi4=";
   };
 
   postPatch = ''
@@ -41,7 +40,6 @@ mkDerivation rec {
     libchewing
     libpinyin
     maliit-framework
-    presage
     qtfeedback
     qtmultimedia
     qtquickcontrols2

pkgs/applications/networking/cluster/terraform-providers/providers.json

@@ -363,11 +363,11 @@
     "vendorHash": "sha256-quoFrJbB1vjz+MdV+jnr7FPACHuUe5Gx9POLubD2IaM="
   },
   "digitalocean": {
-    "hash": "sha256-uAke0Zds4MERYXz+Ie0pefoVY9HDQ1ewOAU/As03V6g=",
+    "hash": "sha256-XUwHBwxkOG4oK0W1IcvIWgov3AShMmeYPoc0gu6YEwY=",
     "homepage": "https://registry.terraform.io/providers/digitalocean/digitalocean",
     "owner": "digitalocean",
     "repo": "terraform-provider-digitalocean",
-    "rev": "v2.55.0",
+    "rev": "v2.57.0",
     "spdx": "MPL-2.0",
     "vendorHash": null
   },
@@ -489,13 +489,13 @@
     "vendorHash": "sha256-EiTWJ4bw8IwsRTD9Lt28Up2DXH0oVneO2IaO8VqWtkw="
   },
   "gitea": {
-    "hash": "sha256-pbh3ADR77iVwHQ3e7krSUU+rNfhdA8zYnxLbTdnRfaU=",
+    "hash": "sha256-A9jwUtLNT5ikB5iR5qaRHBiTXsmwvJXycpFxciZSeZg=",
     "homepage": "https://registry.terraform.io/providers/go-gitea/gitea",
     "owner": "go-gitea",
     "repo": "terraform-provider-gitea",
-    "rev": "v0.6.0",
+    "rev": "v0.7.0",
     "spdx": "MIT",
-    "vendorHash": "sha256-d8XoZzo2XS/wAPvdODAfK31qT1c+EoTbWlzzgYPiwq4="
+    "vendorHash": "sha256-/8h2bmesnFz3tav3+iDelZSjp1Z9lreexwcw0WdYekA="
   },
   "github": {
     "hash": "sha256-rmIoyGlkw2f56UwD0mfI5MiHPDFDuhtsoPmerIrJcGs=",
@@ -516,11 +516,11 @@
     "vendorHash": "sha256-X0vbtUIKYzCeRD/BbMj3VPVAwx6d7gkbHV8j9JXlaFM="
   },
   "google": {
-    "hash": "sha256-HtPhwWobRBB89embUxtUwUabKmtQkeWtR0QEyb4iBYM=",
+    "hash": "sha256-i3gKrK5EcIQbVwJI7sfRam3H0mideGO1VgPuzL4l+Xw=",
     "homepage": "https://registry.terraform.io/providers/hashicorp/google",
     "owner": "hashicorp",
     "repo": "terraform-provider-google",
-    "rev": "v6.39.0",
+    "rev": "v6.40.0",
     "spdx": "MPL-2.0",
     "vendorHash": "sha256-YZI6zhxXU2aABARP6GcTMeU98F4+imbL1vKIEMzsJHM="
   },
@@ -831,13 +831,13 @@
     "vendorHash": "sha256-ryAkyS70J4yZIsTLSXfeIX+bRsh+8XnOUliMJnMhMrU="
   },
   "minio": {
-    "hash": "sha256-loUcdsr5zFoOXIu0CLYKvutIVLYG0+DsuwPCxAeVMF8=",
+    "hash": "sha256-Eo9lps73bvyJIpRWRCQYz+Ck7IMk4nfK2jismILnaKo=",
     "homepage": "https://registry.terraform.io/providers/aminueza/minio",
     "owner": "aminueza",
     "repo": "terraform-provider-minio",
-    "rev": "v3.5.2",
+    "rev": "v3.5.3",
     "spdx": "AGPL-3.0",
-    "vendorHash": "sha256-7AU79r4OQbmrMI385KVIHon/4pWk6J9qnH+zQRrWtJI="
+    "vendorHash": "sha256-QWBzQXx/dzWZr9dn3LHy8RIvZL1EA9xYqi7Ppzvju7g="
   },
   "mongodbatlas": {
     "hash": "sha256-+JYvL6xGA2zIOg2fl8Bl7CYU4x9N4aVJpIl/6PYdyPU=",
@@ -894,13 +894,13 @@
     "vendorHash": "sha256-U8eA/9og4LIedhPSEN9SyInLQuJSzvm0AeFhzC3oqyQ="
   },
   "ns1": {
-    "hash": "sha256-fR64hIM14Bc+7xn7lPfsfZnGew7bd1TAkORwwL6NBsw=",
+    "hash": "sha256-fRF2UsVpIWg0UGPAePEULxAjKi1TioYEeOeSxUuhvIc=",
     "homepage": "https://registry.terraform.io/providers/ns1-terraform/ns1",
     "owner": "ns1-terraform",
     "repo": "terraform-provider-ns1",
-    "rev": "v2.6.4",
+    "rev": "v2.6.5",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-YfbhYhFMdGYQlijaYoAdJFmsjric4Oi4no+sBCq5d6g="
+    "vendorHash": "sha256-9J8RrnF9k503YLmg5rBA8u8SqldhB5AF4+PVtUy8wX8="
   },
   "null": {
     "hash": "sha256-hPAcFWkeK1vjl1Cg/d7FaZpPhyU3pkU6VBIwxX2gEvA=",
@@ -1012,11 +1012,11 @@
     "vendorHash": null
   },
   "pagerduty": {
-    "hash": "sha256-nCd2EQgLR1PNPBnWPSpRGxd3zwQ7dJy8fb3tWgGnbRc=",
+    "hash": "sha256-pU6IUnruM2Pi3nbRJpQ5Y8HuqFixRs8DTmTOxToVgWY=",
     "homepage": "https://registry.terraform.io/providers/PagerDuty/pagerduty",
     "owner": "PagerDuty",
     "repo": "terraform-provider-pagerduty",
-    "rev": "v3.26.0",
+    "rev": "v3.26.2",
     "spdx": "MPL-2.0",
     "vendorHash": null
   },
@@ -1111,11 +1111,11 @@
     "vendorHash": "sha256-xo0alLK3fccbKRG5bN1G7orDsP47I3ySAzpZ9O0f2Fg="
   },
   "rootly": {
-    "hash": "sha256-dnFQVvqvwu2K7Y5NEqwPrGiHKSOKQ4QKW8VSjarbij4=",
+    "hash": "sha256-wJ65YKJnFT1l9DkqtuvA9cwkt06OTCYYu9FolU5UosQ=",
     "homepage": "https://registry.terraform.io/providers/rootlyhq/rootly",
     "owner": "rootlyhq",
     "repo": "terraform-provider-rootly",
-    "rev": "v3.0.0",
+    "rev": "v3.2.0",
     "spdx": "MPL-2.0",
     "vendorHash": "sha256-EZbYkyeQdroVJj3a7T7MICU4MSimB+ZqI2Yg9PNUcV0="
   },
@@ -1336,13 +1336,13 @@
     "vendorHash": null
   },
   "tfe": {
-    "hash": "sha256-w66HR1X/EUloz3W/6aBNvTsC5vWuAZytd2ej7DHVMU0=",
+    "hash": "sha256-8QYTVM9vxWg4jKlm7bUeeD7NjmkZZRu5KxK/7/+wN50=",
     "homepage": "https://registry.terraform.io/providers/hashicorp/tfe",
     "owner": "hashicorp",
     "repo": "terraform-provider-tfe",
-    "rev": "v0.66.0",
+    "rev": "v0.67.0",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-z1gbeYR+UFl+sBgehLgBITc9VwxEV6bRpN9A/4Fp7Oc="
+    "vendorHash": "sha256-fw92xhRF60f3QRLBtSvdSwOtXY4QzgJlwb6zgi0OGjw="
   },
   "thunder": {
     "hash": "sha256-2i1DSOSt/vbFs0QCPogEBvADhLJFKbrQzwZ20ChCQMk=",

pkgs/applications/networking/instant-messengers/discord/default.nix

@@ -9,54 +9,54 @@ let
   versions =
     if stdenv.hostPlatform.isLinux then
       {
-        stable = "0.0.95";
-        ptb = "0.0.146";
-        canary = "0.0.687";
-        development = "0.0.75";
+        stable = "0.0.98";
+        ptb = "0.0.148";
+        canary = "0.0.702";
+        development = "0.0.81";
       }
     else
       {
-        stable = "0.0.347";
-        ptb = "0.0.174";
-        canary = "0.0.793";
-        development = "0.0.88";
+        stable = "0.0.350";
+        ptb = "0.0.179";
+        canary = "0.0.808";
+        development = "0.0.94";
       };
   version = versions.${branch};
   srcs = rec {
     x86_64-linux = {
       stable = fetchurl {
         url = "https://stable.dl2.discordapp.net/apps/linux/${version}/discord-${version}.tar.gz";
-        hash = "sha256-8NpHTG3ojEr8LCRBE/urgH6xdAHLUhqz+A95obB75y4=";
+        hash = "sha256-JT3fIG5zj2tvVPN9hYxCUFInb78fuy8QeWeZClaYou8=";
       };
       ptb = fetchurl {
         url = "https://ptb.dl2.discordapp.net/apps/linux/${version}/discord-ptb-${version}.tar.gz";
-        hash = "sha256-bcQsz6hhgtUD2j0MD3rEdFhsGJMQY1+yo19y/lLX+j8=";
+        hash = "sha256-VRhcnjbC42nFZ3DepKNX75pBl0GeDaSWM1SGXJpuQs0=";
       };
       canary = fetchurl {
         url = "https://canary.dl2.discordapp.net/apps/linux/${version}/discord-canary-${version}.tar.gz";
-        hash = "sha256-OaDN+Qklxieo9xlP8qVeCwWzPBe6bLXoFUkMOFCoqPg=";
+        hash = "sha256-OcRGqwf13yPnbDpYOyXZgEQN/zWshUXfaF5geiLetlc=";
       };
       development = fetchurl {
         url = "https://development.dl2.discordapp.net/apps/linux/${version}/discord-development-${version}.tar.gz";
-        hash = "sha256-wxbmdEzJu66CqJ87cdOKH5fhWKFvD/FBaeJVFxRCvlQ=";
+        hash = "sha256-njkuWtk+359feEYtWJSDukvbD5duXuRIr1m5cJVhNvs=";
       };
     };
     x86_64-darwin = {
       stable = fetchurl {
         url = "https://stable.dl2.discordapp.net/apps/osx/${version}/Discord.dmg";
-        hash = "sha256-X9c5ruehxEd8FIdaQigiz7WGnh851BMqdo7Cz1wEb7Q=";
+        hash = "sha256-Giz0bE16v2Q2jULcnZMI1AY8zyjZ03hw4KVpDPJOmCo=";
       };
       ptb = fetchurl {
         url = "https://ptb.dl2.discordapp.net/apps/osx/${version}/DiscordPTB.dmg";
-        hash = "sha256-/suI1rVJZE1z8wLfiD65p7IdBJsJnz8zX1A2xmMMDnc=";
+        hash = "sha256-tGE7HAcWLpGlv5oXO7NEELdRtNfbhlpQeNc5zB7ba1A=";
       };
       canary = fetchurl {
         url = "https://canary.dl2.discordapp.net/apps/osx/${version}/DiscordCanary.dmg";
-        hash = "sha256-/5jSp6dQiElzofpV7bRNPyUqRgq3Adzb8r40Nd8+Fn0=";
+        hash = "sha256-Cu7U70yzHgOAJjtEx85T3x9f1oquNz7VNsX53ISbzKg=";
       };
       development = fetchurl {
         url = "https://development.dl2.discordapp.net/apps/osx/${version}/DiscordDevelopment.dmg";
-        hash = "sha256-vjpbLg1YIXOSCwnuMwlXo7Sj8B28i812lJ3yV2NLMrE=";
+        hash = "sha256-+bmzdkOSMpKnLGEoeXmAJSv2UHzirOLe1HDHAdHG2U8=";
       };
     };
     aarch64-darwin = x86_64-darwin;

pkgs/applications/networking/remote/x2goclient/default.nix

@@ -1,57 +1,54 @@
 {
-  stdenv,
   lib,
+  stdenv,
   fetchurl,
+  libsForQt5,
+  pkg-config,
+  bash,
   cups,
-  libssh,
   libXpm,
+  libssh,
   nx-libs,
   openldap,
   openssh,
-  qt5,
-  qtbase,
-  qtsvg,
-  qtx11extras,
-  qttools,
-  phonon,
-  pkg-config,
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "x2goclient";
-  version = "4.1.2.2";
+  version = "4.1.2.3";
 
   src = fetchurl {
-    url = "https://code.x2go.org/releases/source/${pname}/${pname}-${version}.tar.gz";
-    sha256 = "yZUyZ8QPpnEZrZanO6yx8mYZbaIFnwzc0bjVGZQh0So=";
+    url = "https://code.x2go.org/releases/source/x2goclient/x2goclient-${finalAttrs.version}.tar.gz";
+    hash = "sha256-q4uzx40xYlx0nkLxX4EP49JCknoVKYMIwT3qO5Fayjw=";
   };
 
   buildInputs = [
     cups
-    libssh
     libXpm
+    libssh
+    libsForQt5.phonon
+    libsForQt5.qtbase
+    libsForQt5.qtsvg
+    libsForQt5.qttools
+    libsForQt5.qtx11extras
     nx-libs
     openldap
     openssh
-    qtbase
-    qtsvg
-    qtx11extras
-    qttools
-    phonon
   ];
 
   nativeBuildInputs = [
     pkg-config
-    qt5.wrapQtAppsHook
+    libsForQt5.wrapQtAppsHook
   ];
 
   postPatch = ''
-    substituteInPlace src/onmainwindow.cpp --replace "/usr/sbin/sshd" "${openssh}/bin/sshd"
+    substituteInPlace src/onmainwindow.cpp \
+      --replace-fail "/usr/sbin/sshd" "${lib.getExe' openssh "sshd"}"
     substituteInPlace Makefile \
-      --replace "SHELL=/bin/bash" "SHELL=$SHELL" \
-      --replace "lrelease-qt4" "${qttools.dev}/bin/lrelease" \
-      --replace "qmake-qt4" "${qtbase.dev}/bin/qmake" \
-      --replace "-o root -g root" ""
+      --replace-fail "SHELL=/bin/bash" "SHELL ?= ${lib.getExe bash}" \
+      --replace-fail "lrelease-qt4" "${lib.getExe' libsForQt5.qttools.dev "lrelease"}" \
+      --replace-fail "qmake-qt4" "${lib.getExe' libsForQt5.qtbase.dev "qmake"}" \
+      --replace-fail "-o root -g root" ""
   '';
 
   makeFlags = [
@@ -59,6 +56,10 @@ stdenv.mkDerivation rec {
     "ETCDIR=$(out)/etc"
     "build_client"
     "build_man"
+    # No rule to make target 'SHELL'
+    "MAKEOVERRIDES="
+    ".MAKEOVERRIDES="
+    ".MAKEFLAGS="
   ];
 
   installTargets = [
@@ -71,12 +72,16 @@ stdenv.mkDerivation rec {
     "--set QT_QPA_PLATFORM xcb"
   ];
 
-  meta = with lib; {
+  meta = {
     description = "Graphical NoMachine NX3 remote desktop client";
     mainProgram = "x2goclient";
     homepage = "http://x2go.org/";
     maintainers = [ ];
-    license = licenses.gpl2;
-    platforms = platforms.linux;
+    license = with lib.licenses; [
+      agpl3Plus
+      mit
+      free
+    ]; # Some X2Go components are licensed under some license (MIT X11, BSD, etc.)
+    platforms = lib.platforms.linux;
   };
-}
+})

pkgs/applications/office/scribus/default.nix

@@ -14,7 +14,7 @@
   libxml2,
   pixman,
   pkg-config,
-  podofo,
+  podofo_0_10,
   poppler,
   poppler_data,
   python3,
@@ -58,7 +58,7 @@ stdenv.mkDerivation (finalAttrs: {
     libtiff
     libxml2
     pixman
-    podofo
+    podofo_0_10
     poppler
     poppler_data
     pythonEnv

pkgs/applications/science/astronomy/calcmysky/default.nix

@@ -12,13 +12,13 @@
 
 stdenv.mkDerivation rec {
   pname = "calcmysky";
-  version = "0.3.4";
+  version = "0.3.5";
 
   src = fetchFromGitHub {
     owner = "10110111";
     repo = "CalcMySky";
     tag = "v${version}";
-    hash = "sha256-r0F70ouRvUGRo7Zc7BOTe9ujRA5FN+1BdFPDtwIPly4=";
+    hash = "sha256-++011c4/IFf/5GKmFostTnxgfEdw3/GJf0e5frscCQ4=";
   };
 
   nativeBuildInputs = [

pkgs/applications/video/anilibria-winmaclinux/default.nix

@@ -21,13 +21,13 @@
 
 mkDerivation rec {
   pname = "anilibria-winmaclinux";
-  version = "2.2.27";
+  version = "2.2.28";
 
   src = fetchFromGitHub {
     owner = "anilibria";
     repo = "anilibria-winmaclinux";
     rev = version;
-    hash = "sha256-wu4kJCs1Bo6yVGLJuzXSCtv2nXhzlwX6jDTa0gTwPsw=";
+    hash = "sha256-dBeIFmlhxfb7wT3zAK7ALYOqs0dFv2xg+455tCqjyEo=";
   };
 
   sourceRoot = "${src.name}/src";

pkgs/applications/video/mpv/scripts/eisa01.nix

@@ -12,13 +12,13 @@ let
     let
       self = {
         inherit pname;
-        version = "0-unstable-2025-05-14";
+        version = "25-09-2023-unstable-2025-06-21";
 
         src = fetchFromGitHub {
           owner = "Eisa01";
           repo = "mpv-scripts";
-          rev = "100fea81ae8560c6fb113b1f6bb20857a41a5705";
-          hash = "sha256-bMEKsHrJ+mgG7Vqpzj4TAr7Hehq2o2RuneowhrDCd5k=";
+          rev = "b9e63743a858766c9cc7a801d77313b0cecdb049";
+          hash = "sha256-ohUZH6m+5Sk3VKi9qqEgwhgn2DMOFIvvC41pMkV6oPw=";
           # avoid downloading screenshots and videos
           sparseCheckout = [
             "scripts/"

pkgs/applications/video/obs-studio/plugins/droidcam-obs/default.nix

@@ -12,13 +12,13 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "droidcam-obs";
-  version = "2.3.4";
+  version = "2.4.0";
 
   src = fetchFromGitHub {
     owner = "dev47apps";
     repo = "droidcam-obs-plugin";
     tag = finalAttrs.version;
-    sha256 = "sha256-KWMLhddK561xA+EjvoG4tXRW4xoLil31JcTTfppblmA=";
+    sha256 = "sha256-rA+EMtAeM2LSUqtiYJt0hHZ85aZ+5bvVUUjIG2LC3pc=";
   };
 
   preBuild = ''

pkgs/by-name/_0/_0verkill/package.nix

@@ -37,11 +37,11 @@ gccStdenv.mkDerivation {
   env.NIX_CFLAGS_COMPILE = "-fcommon";
   hardeningDisable = [ "all" ]; # Someday the upstream will update the code...
 
-  meta = with lib; {
+  meta = {
     homepage = "https://github.com/hackndev/0verkill";
     description = "ASCII-ART bloody 2D action deathmatch-like game";
-    license = with licenses; gpl2Only;
-    maintainers = with maintainers; [ ];
-    platforms = with platforms; unix;
+    license = lib.licenses.gpl2Only;
+    maintainers = with lib.maintainers; [ ];
+    platforms = lib.platforms.unix;
   };
 }

pkgs/by-name/_0/_0xproto/package.nix

@@ -23,11 +23,11 @@ stdenvNoCC.mkDerivation rec {
     runHook postInstall
   '';
 
-  meta = with lib; {
+  meta = {
     description = "Free and Open-source font for programming";
     homepage = "https://github.com/0xType/0xProto";
-    license = licenses.ofl;
-    maintainers = [ maintainers.edswordsmith ];
-    platforms = platforms.all;
+    license = lib.licenses.ofl;
+    maintainers = with lib.maintainers; [ edswordsmith ];
+    platforms = lib.platforms.all;
   };
 }

pkgs/by-name/_1/_1fps/package.nix

@@ -13,7 +13,7 @@ buildGoModule rec {
   src = fetchFromGitHub {
     owner = "1fpsvideo";
     repo = "1fps";
-    rev = "v${version}";
+    tag = "v${version}";
     hash = "sha256-3uPGFxEWmKQxQWPmotZI29GykUGQDjtDjFPps4QMs0M=";
   };
 

pkgs/by-name/_1/_1password-cli/package.nix

@@ -86,16 +86,16 @@ stdenv.mkDerivation {
     updateScript = ./update.sh;
   };
 
-  meta = with lib; {
+  meta = {
     description = "1Password command-line tool";
     homepage = "https://developer.1password.com/docs/cli/";
     downloadPage = "https://app-updates.agilebits.com/product_history/CLI2";
-    maintainers = with maintainers; [
+    maintainers = with lib.maintainers; [
       joelburget
       khaneliman
     ];
-    sourceProvenance = with sourceTypes; [ binaryNativeCode ];
-    license = licenses.unfree;
+    sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
+    license = lib.licenses.unfree;
     inherit mainProgram platforms;
   };
 }

pkgs/by-name/_2/_20kly/package.nix

@@ -13,7 +13,7 @@ python3Packages.buildPythonApplication rec {
   src = fetchFromGitHub {
     owner = "20kly";
     repo = "20kly";
-    rev = "v${version}";
+    tag = "v${version}";
     sha256 = "1zxsxg49a02k7zidx3kgk2maa0vv0n1f9wrl5vch07sq3ghvpphx";
   };
 

pkgs/by-name/_8/_86Box/package.nix

@@ -44,7 +44,7 @@ stdenv.mkDerivation (finalAttrs: {
   src = fetchFromGitHub {
     owner = "86Box";
     repo = "86Box";
-    rev = "v${finalAttrs.version}";
+    tag = "v${finalAttrs.version}";
     hash = "sha256-ue5Coy2MpP7Iwl81KJPQPC7eD53/Db5a0PGIR+DdPYI=";
   };
 

pkgs/by-name/_9/_915resolution/package.nix

@@ -16,7 +16,7 @@ stdenv.mkDerivation rec {
   patchPhase = "rm *.o";
   installPhase = "mkdir -p $out/sbin; cp 915resolution $out/sbin/";
 
-  meta = with lib; {
+  meta = {
     homepage = "http://915resolution.mango-lang.org/";
     description = "Tool to modify Intel 800/900 video BIOS";
     mainProgram = "915resolution";
@@ -24,6 +24,6 @@ stdenv.mkDerivation rec {
       "i686-linux"
       "x86_64-linux"
     ];
-    license = licenses.publicDomain;
+    license = lib.licenses.publicDomain;
   };
 }

pkgs/by-name/_9/_9base/package.nix

@@ -65,7 +65,7 @@ stdenv.mkDerivation {
     "troff"
   ];
 
-  meta = with lib; {
+  meta = {
     homepage = "https://tools.suckless.org/9base/";
     description = "9base is a port of various original Plan 9 tools for Unix, based on plan9port";
     longDescription = ''
@@ -74,12 +74,12 @@ stdenv.mkDerivation {
       The overall SLOC is about 66kSLOC, so this userland + all libs is much smaller than, e.g. bash.
       9base can be used to run werc instead of the full blown plan9port.
     '';
-    license = with licenses; [
+    license = with lib.licenses; [
       mit # and
       lpl-102
     ];
-    maintainers = with maintainers; [ jk ];
-    platforms = platforms.unix;
+    maintainers = with lib.maintainers; [ jk ];
+    platforms = lib.platforms.unix;
     # needs additional work to support aarch64-darwin
     # due to usage of _DARWIN_NO_64_BIT_INODE
     broken = stdenv.hostPlatform.isAarch64 && stdenv.hostPlatform.isDarwin;

pkgs/by-name/aa/aaaaxy/package.nix

@@ -128,12 +128,12 @@ buildGoModule rec {
 
   strictDeps = true;
 
-  meta = with lib; {
+  meta = {
     description = "Nonlinear 2D puzzle platformer taking place in impossible spaces";
     mainProgram = "aaaaxy";
     homepage = "https://divverent.github.io/aaaaxy/";
-    license = licenses.asl20;
-    maintainers = with maintainers; [ Luflosi ];
-    platforms = platforms.linux;
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ Luflosi ];
+    platforms = lib.platforms.linux;
   };
 }

pkgs/by-name/aa/aarch64-esr-decoder/package.nix

@@ -18,12 +18,12 @@ rustPlatform.buildRustPackage rec {
   useFetchCargoVendor = true;
   cargoHash = "sha256-LiNnTNpluQkomQhIOsAnUbbBftTgqgNdpT8heCrBayg=";
 
-  meta = with lib; {
+  meta = {
     description = "Utility for decoding aarch64 ESR register values";
     homepage = "https://github.com/google/aarch64-esr-decoder";
     changelog = "https://github.com/google/aarch64-esr-decoder/blob/${src.rev}/CHANGELOG.md";
-    license = licenses.asl20;
-    maintainers = with maintainers; [ jmbaur ];
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ jmbaur ];
     mainProgram = "aarch64-esr-decoder";
   };
 }

pkgs/by-name/ab/abpoa/package.nix

@@ -90,13 +90,13 @@ stdenv.mkDerivation (finalAttrs: {
     '';
   };
 
-  meta = with lib; {
+  meta = {
     description = "SIMD-based C library for fast partial order alignment using adaptive band";
     homepage = "https://github.com/yangao07/abPOA";
     changelog = "https://github.com/yangao07/abPOA/releases/tag/v${finalAttrs.version}";
-    license = licenses.mit;
-    maintainers = with maintainers; [ natsukium ];
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ natsukium ];
     mainProgram = "abpoa";
-    platforms = platforms.unix;
+    platforms = lib.platforms.unix;
   };
 })

pkgs/by-name/ac/accuraterip-checksum/package.nix

@@ -12,7 +12,7 @@ stdenv.mkDerivation rec {
   src = fetchFromGitHub {
     owner = "leo-bogert";
     repo = "accuraterip-checksum";
-    rev = "version${version}";
+    tag = "version${version}";
     sha256 = "1a6biy78jb094rifazn4a2g1dlhryg5q8p8gwj0a60ipl0vfb9bj";
   };
 

pkgs/by-name/ac/acpi/package.nix

@@ -13,7 +13,7 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-5kxuALU815dCfqMqFgUTQlsD7U8HdzP3Hx8J/zQPIws=";
   };
 
-  meta = with lib; {
+  meta = {
     description = "Show battery status and other ACPI information";
     mainProgram = "acpi";
     longDescription = ''
@@ -24,7 +24,7 @@ stdenv.mkDerivation rec {
     '';
     homepage = "https://sourceforge.net/projects/acpiclient/";
     license = lib.licenses.gpl2Plus;
-    platforms = platforms.linux;
-    maintainers = [ ];
+    platforms = lib.platforms.linux;
+    maintainers = with lib.maintainers; [ ];
   };
 }

pkgs/by-name/ac/acpic/package.nix

@@ -27,11 +27,11 @@ python3Packages.buildPythonApplication rec {
   # no tests
   doCheck = false;
 
-  meta = with lib; {
+  meta = {
     description = "Daemon extending acpid event handling capabilities";
     mainProgram = "acpic";
     homepage = "https://github.com/psliwka/acpic";
-    license = licenses.wtfpl;
-    maintainers = with maintainers; [ aacebedo ];
+    license = lib.licenses.wtfpl;
+    maintainers = with lib.maintainers; [ aacebedo ];
   };
 }

pkgs/by-name/ac/acpid/package.nix

@@ -16,10 +16,10 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ autoreconfHook ];
 
-  meta = with lib; {
+  meta = {
     homepage = "https://sourceforge.net/projects/acpid2/";
     description = "Daemon for delivering ACPI events to userspace programs";
-    license = licenses.gpl2Plus;
-    platforms = platforms.linux;
+    license = lib.licenses.gpl2Plus;
+    platforms = lib.platforms.linux;
   };
 }

pkgs/by-name/ac/acpilight/package.nix

@@ -13,7 +13,7 @@ stdenv.mkDerivation rec {
 
   src = fetchgit {
     url = "https://gitlab.com/wavexx/acpilight.git";
-    rev = "v${version}";
+    tag = "v${version}";
     sha256 = "1r0r3nx6x6vkpal6vci0zaa1n9dfacypldf6k8fxg7919vzxdn1w";
   };
 
@@ -37,12 +37,12 @@ stdenv.mkDerivation rec {
   ];
   doInstallCheck = true;
 
-  meta = with lib; {
+  meta = {
     homepage = "https://gitlab.com/wavexx/acpilight";
     description = "ACPI backlight control";
-    license = licenses.gpl3;
-    maintainers = with maintainers; [ smakarov ];
-    platforms = platforms.linux;
+    license = lib.licenses.gpl3;
+    maintainers = with lib.maintainers; [ smakarov ];
+    platforms = lib.platforms.linux;
     mainProgram = "xbacklight";
   };
 }

pkgs/by-name/ac/acsccid/package.nix

@@ -64,7 +64,7 @@ stdenv.mkDerivation rec {
     autoconf
   '';
 
-  meta = with lib; {
+  meta = {
     description = "PC/SC driver for Linux/Mac OS X and it supports ACS CCID smart card readers";
     longDescription = ''
       acsccid is a PC/SC driver for Linux/Mac OS X and it supports ACS CCID smart card
@@ -80,8 +80,8 @@ stdenv.mkDerivation rec {
         services.pcscd.plugins = [ pkgs.acsccid ];
     '';
     homepage = src.meta.homepage;
-    license = licenses.lgpl2Plus;
-    maintainers = [ ];
-    platforms = with platforms; unix;
+    license = lib.licenses.lgpl2Plus;
+    maintainers = with lib.maintainers; [ ];
+    platforms = lib.platforms.unix;
   };
 }

pkgs/by-name/ac/action-validator/package.nix

@@ -25,11 +25,11 @@ rustPlatform.buildRustPackage {
     branch = "main";
   };
 
-  meta = with lib; {
+  meta = {
     description = "Tool to validate GitHub Action and Workflow YAML files";
     homepage = "https://github.com/mpalmer/action-validator";
-    license = licenses.gpl3Plus;
+    license = lib.licenses.gpl3Plus;
     mainProgram = "action-validator";
-    maintainers = with maintainers; [ thiagokokada ];
+    maintainers = with lib.maintainers; [ thiagokokada ];
   };
 }

pkgs/by-name/ac/activate-linux/package.nix

@@ -61,15 +61,15 @@ stdenv.mkDerivation (finalAttrs: {
     runHook postInstall
   '';
 
-  meta = with lib; {
+  meta = {
     description = "\"Activate Windows\" watermark ported to Linux";
     homepage = "https://github.com/MrGlockenspiel/activate-linux";
-    license = licenses.gpl3;
-    maintainers = with maintainers; [
+    license = lib.licenses.gpl3;
+    maintainers = with lib.maintainers; [
       alexnortung
       donovanglover
     ];
-    platforms = platforms.linux;
+    platforms = lib.platforms.linux;
     mainProgram = "activate-linux";
   };
 })

pkgs/by-name/ad/adbfs-rootless/package.nix

@@ -34,12 +34,12 @@ stdenv.mkDerivation rec {
     runHook postInstall
   '';
 
-  meta = with lib; {
+  meta = {
     description = "Mount Android phones on Linux with adb, no root required";
     mainProgram = "adbfs";
     inherit (src.meta) homepage;
-    license = licenses.bsd3;
-    maintainers = with maintainers; [ aleksana ];
-    platforms = platforms.unix;
+    license = lib.licenses.bsd3;
+    maintainers = with lib.maintainers; [ aleksana ];
+    platforms = lib.platforms.unix;
   };
 }

pkgs/by-name/ad/addlicense/package.nix

@@ -12,7 +12,7 @@ buildGoModule rec {
   src = fetchFromGitHub {
     owner = "google";
     repo = "addlicense";
-    rev = "v${version}";
+    tag = "v${version}";
     sha256 = "sha256-YMMHj6wctKtJi/rrcMIrLmNw/uvO6wCwokgYRQxcsFw=";
   };
 

pkgs/by-name/ad/adi1090x-plymouth-themes/package.nix

@@ -51,7 +51,7 @@ stdenv.mkDerivation {
     find $out/share/plymouth/themes/ -name \*.plymouth -exec sed -i "s@\/usr\/@$out\/@" {} \;
   '';
 
-  meta = with lib; {
+  meta = {
     description = "Plymouth boot themes from adi1090x";
     longDescription = ''
       A variety of plymouth boot screens by adi1090x.  Using the default value
@@ -60,8 +60,8 @@ stdenv.mkDerivation {
       ./shas.nix for available themes.
     '';
     homepage = "https://github.com/adi1090x/plymouth-themes";
-    license = licenses.gpl3;
-    platforms = platforms.linux;
-    maintainers = with maintainers; [ slwst ];
+    license = lib.licenses.gpl3;
+    platforms = lib.platforms.linux;
+    maintainers = with lib.maintainers; [ slwst ];
   };
 }

pkgs/by-name/ad/adrgen/package.nix

@@ -35,11 +35,11 @@ buildGoModule rec {
     version = "v${version}";
   };
 
-  meta = with lib; {
+  meta = {
     homepage = "https://github.com/asiermarques/adrgen";
     description = "Command-line tool for generating and managing Architecture Decision Records";
-    license = licenses.mit;
-    maintainers = [ ];
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ ];
     mainProgram = "adrgen";
   };
 }

pkgs/by-name/ae/aefs/package.nix

@@ -35,12 +35,12 @@ stdenv.mkDerivation {
 
   buildInputs = [ fuse ];
 
-  meta = with lib; {
+  meta = {
     homepage = "https://github.com/edolstra/aefs";
     description = "Cryptographic filesystem implemented in userspace using FUSE";
-    maintainers = [ ];
-    license = licenses.gpl2Plus;
-    platforms = platforms.unix;
+    maintainers = with lib.maintainers; [ ];
+    license = lib.licenses.gpl2Plus;
+    platforms = lib.platforms.unix;
     broken = stdenv.hostPlatform.isDarwin;
   };
 }

pkgs/by-name/ae/aeolus/package.nix

@@ -58,12 +58,12 @@ stdenv.mkDerivation rec {
       echo -n "${cfg}" > $out/etc/aeolus.conf
     '';
 
-  meta = with lib; {
+  meta = {
     description = "Synthetized (not sampled) pipe organ emulator";
     homepage = "http://kokkinizita.linuxaudio.org/linuxaudio/aeolus/index.html";
-    license = licenses.lgpl3;
-    platforms = platforms.linux;
-    maintainers = with maintainers; [
+    license = lib.licenses.lgpl3;
+    platforms = lib.platforms.linux;
+    maintainers = with lib.maintainers; [
       nico202
       orivej
     ];

pkgs/by-name/ae/aerospike/package.nix

@@ -45,12 +45,12 @@ stdenv.mkDerivation rec {
     cp target/Linux-x86_64/bin/asd $out/bin/asd
   '';
 
-  meta = with lib; {
+  meta = {
     description = "Flash-optimized, in-memory, NoSQL database";
     mainProgram = "asd";
     homepage = "https://aerospike.com/";
-    license = licenses.agpl3Only;
+    license = lib.licenses.agpl3Only;
     platforms = [ "x86_64-linux" ];
-    maintainers = with maintainers; [ kalbasit ];
+    maintainers = with lib.maintainers; [ kalbasit ];
   };
 }

pkgs/by-name/ae/aespipe/package.nix

@@ -28,11 +28,11 @@ stdenv.mkDerivation rec {
      --prefix PATH : $out/bin:${lib.makeBinPath [ sharutils ]}
   '';
 
-  meta = with lib; {
+  meta = {
     description = "AES encrypting or decrypting pipe";
     homepage = "https://loop-aes.sourceforge.net/aespipe.README";
-    license = licenses.gpl2Only;
-    maintainers = [ ];
-    platforms = platforms.unix;
+    license = lib.licenses.gpl2Only;
+    maintainers = with lib.maintainers; [ ];
+    platforms = lib.platforms.unix;
   };
 }

pkgs/by-name/af/afetch/package.nix

@@ -19,15 +19,15 @@ stdenv.mkDerivation rec {
     "PREFIX=${placeholder "out"}"
   ];
 
-  meta = with lib; {
+  meta = {
     description = "Fetch program written in C";
     homepage = "https://github.com/13-CF/afetch";
-    license = licenses.gpl3Plus;
-    maintainers = with maintainers; [
+    license = lib.licenses.gpl3Plus;
+    maintainers = with lib.maintainers; [
       dan4ik605743
       jk
     ];
-    platforms = platforms.linux;
+    platforms = lib.platforms.linux;
     mainProgram = "afetch";
   };
 }

pkgs/by-name/af/afew/package.nix

@@ -60,11 +60,11 @@ python3Packages.buildPythonApplication rec {
     };
   };
 
-  meta = with lib; {
+  meta = {
     homepage = "https://github.com/afewmail/afew";
     description = "Initial tagging script for notmuch mail";
     mainProgram = "afew";
-    license = licenses.isc;
-    maintainers = with maintainers; [ flokli ];
+    license = lib.licenses.isc;
+    maintainers = with lib.maintainers; [ flokli ];
   };
 }

pkgs/by-name/af/afsctool/package.nix

@@ -30,11 +30,11 @@ stdenv.mkDerivation rec {
     sparsehash
   ];
 
-  meta = with lib; {
+  meta = {
     description = "Utility that allows end-users to leverage HFS+/APFS compression";
-    license = licenses.unfree;
-    maintainers = [ maintainers.viraptor ];
-    platforms = platforms.darwin;
+    license = lib.licenses.unfree;
+    maintainers = with lib.maintainers; [ viraptor ];
+    platforms = lib.platforms.darwin;
     homepage = "https://github.com/RJVB/afsctool";
   };
 }

pkgs/by-name/af/aften/package.nix

@@ -23,11 +23,11 @@ stdenv.mkDerivation rec {
 
   cmakeFlags = [ "-DSHARED=ON" ];
 
-  meta = with lib; {
+  meta = {
     description = "Audio encoder which generates compressed audio streams based on ATSC A/52 specification";
     homepage = "https://aften.sourceforge.net/";
-    license = licenses.lgpl21Only;
-    platforms = platforms.unix;
-    maintainers = with maintainers; [ emilytrau ];
+    license = lib.licenses.lgpl21Only;
+    platforms = lib.platforms.unix;
+    maintainers = with lib.maintainers; [ emilytrau ];
   };
 }

pkgs/by-name/af/afterburn/package.nix

@@ -13,7 +13,7 @@ rustPlatform.buildRustPackage rec {
   src = fetchFromGitHub {
     owner = "coreos";
     repo = "afterburn";
-    rev = "v${version}";
+    tag = "v${version}";
     sha256 = "sha256-hlcUtEc0uWFolCt+mZd7f68PJPa+i/mv+2aJh4Vhmsw=";
   };
 

pkgs/by-name/ag/agdsn-zsh-config/package.nix

@@ -11,7 +11,7 @@ stdenvNoCC.mkDerivation rec {
   src = fetchFromGitHub {
     owner = "agdsn";
     repo = "agdsn-zsh-config";
-    rev = "v${version}";
+    tag = "v${version}";
     sha256 = "sha256-8POQPk/hsJBMJ/ZJe9XzVj7Rd7C2+QnpzgYbUR0s3Fc=";
   };
 

pkgs/by-name/ag/age/package.nix

@@ -21,7 +21,7 @@ buildGoModule (final: {
   src = fetchFromGitHub {
     owner = "FiloSottile";
     repo = "age";
-    rev = "v${final.version}";
+    tag = "v${final.version}";
     hash = "sha256-9ZJdrmqBj43zSvStt0r25wjSfnvitdx3GYtM3urHcaA=";
   };
 

pkgs/by-name/ag/ags_1/package.nix

@@ -27,7 +27,7 @@ buildNpmPackage (finalAttrs: {
   src = fetchFromGitHub {
     owner = "Aylur";
     repo = "ags";
-    rev = "v${finalAttrs.version}";
+    tag = "v${finalAttrs.version}";
     hash = "sha256-ebnkUaee/pnfmw1KmOZj+MP1g5wA+8BT/TPKmn4Dkwc=";
     fetchSubmodules = true;
   };

pkgs/by-name/ai/airspy/package.nix

@@ -14,7 +14,7 @@ stdenv.mkDerivation rec {
   src = fetchFromGitHub {
     owner = "airspy";
     repo = "airspyone_host";
-    rev = "v${version}";
+    tag = "v${version}";
     sha256 = "1v7sfkkxc6f8ny1p9xrax1agkl6q583mjx8k0lrrwdz31rf9qgw9";
   };
 

pkgs/by-name/al/albatross/package.nix

@@ -11,7 +11,7 @@ stdenv.mkDerivation rec {
   src = fetchFromGitHub {
     repo = "Albatross";
     owner = "shimmerproject";
-    rev = "v${version}";
+    tag = "v${version}";
     sha256 = "0mq87n2hxy44nzr567av24n5nqjaljhi1afxrn3mpjqdbkq7lx88";
   };
 

pkgs/by-name/al/albert/package.nix

@@ -15,13 +15,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "albert";
-  version = "0.28.0";
+  version = "0.28.2";
 
   src = fetchFromGitHub {
     owner = "albertlauncher";
     repo = "albert";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-ciqCNQD5S7qv9Ph6AgUpFB5Sphv6Eb1LR3Ap3bTd1EE=";
+    hash = "sha256-FYl/S7+KoQ3kgUQX0hiv8B+AbTbyfmo1GX130G09bZ8=";
     fetchSubmodules = true;
   };
 

pkgs/by-name/al/alire/package.nix

@@ -13,7 +13,7 @@ stdenv.mkDerivation (finalAttrs: {
   src = fetchFromGitHub {
     owner = "alire-project";
     repo = "alire";
-    rev = "v${finalAttrs.version}";
+    tag = "v${finalAttrs.version}";
     hash = "sha256-DfzCQu9xOe9JgX6RTrYOGTIS6EcPimLnd5pfXMtfRss=";
 
     fetchSubmodules = true;

pkgs/by-name/al/aliyun-cli/package.nix

@@ -41,7 +41,10 @@ buildGoModule rec {
     homepage = "https://github.com/aliyun/aliyun-cli";
     changelog = "https://github.com/aliyun/aliyun-cli/releases/tag/v${version}";
     license = lib.licenses.asl20;
-    maintainers = with lib.maintainers; [ ornxka ];
+    maintainers = with lib.maintainers; [
+      ornxka
+      ryan4yin
+    ];
     mainProgram = "aliyun";
   };
 }

pkgs/by-name/al/alttab/package.nix

@@ -24,7 +24,7 @@ stdenv.mkDerivation rec {
   src = fetchFromGitHub {
     owner = "sagb";
     repo = "alttab";
-    rev = "v${version}";
+    tag = "v${version}";
     sha256 = "sha256-1+hk0OeSriXPyefv3wOgeiW781PL4VP5Luvt+RS5jmg=";
   };
 

pkgs/by-name/am/amdgpu_top/package.nix

@@ -21,7 +21,7 @@ rustPlatform.buildRustPackage rec {
   src = fetchFromGitHub {
     owner = "Umio-Yasuno";
     repo = "amdgpu_top";
-    rev = "v${version}";
+    tag = "v${version}";
     hash = "sha256-BT451a9S3hyugEFH1rHPiJLAb6LzB8rqMAZdWf4UNC8=";
   };
 

pkgs/by-name/am/amoco/package.nix

@@ -12,7 +12,7 @@ python3.pkgs.buildPythonApplication rec {
   src = fetchFromGitHub {
     owner = "bdcht";
     repo = "amoco";
-    rev = "v${version}";
+    tag = "v${version}";
     hash = "sha256-3+1ssFyU7SKFJgDYBQY0kVjmTHOD71D2AjnH+4bfLXo=";
   };
 

pkgs/by-name/an/android-file-transfer/package.nix

@@ -16,7 +16,7 @@ stdenv.mkDerivation rec {
   src = fetchFromGitHub {
     owner = "whoozle";
     repo = "android-file-transfer-linux";
-    rev = "v${version}";
+    tag = "v${version}";
     sha256 = "sha256-G+ErwZ/F8Cl8WLSzC+5LrEWWqNZL3xDMBvx/gjkgAXk=";
   };
 

pkgs/by-name/aw/aws-iam-authenticator/package.nix

@@ -37,6 +37,9 @@ buildGoModule rec {
     mainProgram = "aws-iam-authenticator";
     changelog = "https://github.com/kubernetes-sigs/aws-iam-authenticator/releases/tag/v${version}";
     license = lib.licenses.asl20;
-    maintainers = with lib.maintainers; [ srhb ];
+    maintainers = with lib.maintainers; [
+      srhb
+      ryan4yin
+    ];
   };
 }

pkgs/by-name/aw/awsbck/package.nix

@@ -6,17 +6,17 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "awsbck";
-  version = "0.3.13";
+  version = "0.3.15";
 
   src = fetchFromGitHub {
     owner = "beeb";
     repo = "awsbck";
     rev = "v${version}";
-    hash = "sha256-7ykDkCA6c5MzaMWT+ZjNBhPOZO8UNYIP5sNwoFx1XT8=";
+    hash = "sha256-Sa+CCRfhZyMmbbPggeJ+tXYdrhmDwfiirgLdTEma05M=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-L7iWM5T/FRK+0KQROILg4Mns1+cwPPGKfe0H00FJrSo=";
+  cargoHash = "sha256-kCVMsA2tu8hxoe/JGd+a4Jcok3rM/yb/UWE4xhuPLoo=";
 
   # tests run in CI on the source repo
   doCheck = false;

pkgs/by-name/az/azahar/package.nix

@@ -52,11 +52,11 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "azahar";
-  version = "2122";
+  version = "2122.1";
 
   src = fetchzip {
     url = "https://github.com/azahar-emu/azahar/releases/download/${finalAttrs.version}/azahar-unified-source-${finalAttrs.version}.tar.xz";
-    hash = "sha256-isohwigDgqwPJxinBju1biAXC3CX3JrNJiQ1NY+NjRo=";
+    hash = "sha256-RQ8dgD09cWyVWGSLzHz1oJOKia1OKr2jHqYwKaVGfxE=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/ba/baidupcs-go/package.nix

@@ -32,7 +32,7 @@ buildGoModule rec {
 
   postInstall = ''
     rm -f $out/bin/AndroidNDKBuild
-    ln -s $out/bin/BaiduPCS-Go $out/bin/baidupcs-go
+    ln -s $out/bin/BaiduPCS-Go $out/bin/baidupcs-go || true
   '';
 
   postVersionCheck = ''

pkgs/by-name/ba/balena-cli/package.nix

@@ -22,16 +22,16 @@ let
 in
 buildNpmPackage' rec {
   pname = "balena-cli";
-  version = "22.1.0";
+  version = "22.1.1";
 
   src = fetchFromGitHub {
     owner = "balena-io";
     repo = "balena-cli";
     rev = "v${version}";
-    hash = "sha256-qL+hC3ydKJSzceJVbaLy+a2jpXMLsgGC++PEreZDF0k=";
+    hash = "sha256-KEYzYIrcJdpicu4L09UVAU25fC8bWbIYJOuSpCHU3K4=";
   };
 
-  npmDepsHash = "sha256-bLYKMWiXwvpMhnTHa0RPhzEpvtTFcWnqX8zXDNCY4uk=";
+  npmDepsHash = "sha256-jErFmkOQ3ySdLLXDh0Xl2tcWlfxnL2oob+x7QDuLJ8w=";
 
   postPatch = ''
     ln -s npm-shrinkwrap.json package-lock.json