Merge 4d59810dd0 into haskell-updates

.github/workflows/test.yml

@@ -55,10 +55,14 @@ jobs:
             })).map(file => file.filename)
 
             if (files.some(file => [
+              '.github/workflows/build.yml',
+              '.github/workflows/check.yml',
               '.github/workflows/eval.yml',
               '.github/workflows/lint.yml',
               '.github/workflows/merge-group.yml',
               '.github/workflows/test.yml',
+              'ci/github-script/supportedSystems.js',
+              'ci/supportedBranches.js',
             ].includes(file))) core.setOutput('merge-group', true)
 
             if (files.some(file => [
@@ -71,8 +75,16 @@ jobs:
               '.github/workflows/pull-request-target.yml',
               '.github/workflows/test.yml',
               'ci/github-script/bot.js',
+              'ci/github-script/check-target-branch.js',
+              'ci/github-script/commits.js',
+              'ci/github-script/lint-commits.js',
               'ci/github-script/merge.js',
+              'ci/github-script/prepare.js',
+              'ci/github-script/reviewers.js',
+              'ci/github-script/reviews.js',
+              'ci/github-script/supportedSystems.js',
               'ci/github-script/withRateLimit.js',
+              'ci/supportedBranches.js',
             ].includes(file))) core.setOutput('pr', true)
 
   merge-group:

doc/release-notes/rl-2605.section.md

@@ -203,8 +203,6 @@
 
 - `services.openssh.settings.AcceptEnv` now explicitly defined as an option that takes a list of strings, to facilitate option merging. Setting it to a string value is no longer supported.
 
-- `nodejs-slim` has a `npm` and a `corepack` outputs, and `nodejs` no longer has a `libv8` output.
-
 - All Xfce packages have been moved to top level (e.g. if you previously added `pkgs.xfce.xfce4-whiskermenu-plugin` to `environment.systemPackages`, you will need to change it to `pkgs.xfce4-whiskermenu-plugin`). The `xfce` scope will be removed in NixOS 26.11.
 
 - `spacefm` was removed because it appeared to be unmaintained upstream.
@@ -264,6 +262,10 @@ gnuradioMinimal.override {
 
 - The `nodejs_latest` alias now points to `nodejs_25` instead of `nodejs_24`.
 
+- `nodejs-slim` no longer exposes a `corepack` executable, it has been moved to an ad-hoc output; to restore the previous behavior, `nodejs-slim.corepack` must be explicitely included.
+
+- `nodejs` is now a simple wrapper for `nodejs-slim`+`nodejs-slim.npm`+`nodejs-slim.corepack`, meaning it is no longer possible to reference or override its attributes or outputs (e.g. `nodejs.libv8` must be replaced with `nodejs-slim.libv8`, `nodejs.nativeBuildInputs` with `nodejs-slim.nativeBuildInputs`, etc.).
+
 - `mold` is now wrapped by default.
 
 - `neovim` now disables by default the `python3` and `ruby` providers, unused by most users and reducing closure size from 365MiB to 240MiB.

lib/systems/parse.nix

@@ -975,6 +975,41 @@ rec {
     in
     "${cpuName}-${vendor.name}-${kernelName kernel}${optExecFormat}${optAbi}";
 
+  # This is a function from parsed platforms (like stdenv.hostPlatform.parsed)
+  # to parsed platforms.
+  makeMuslParsedPlatform =
+    parsed:
+    # The following line guarantees that the output of this function
+    # is a well-formed platform with no missing fields.
+    (
+      x:
+      lib.trivial.pipe x [
+        (x: removeAttrs x [ "_type" ])
+        mkSystem
+      ]
+    )
+      (
+        parsed
+        // {
+          abi =
+            {
+              gnu = abis.musl;
+              gnueabi = abis.musleabi;
+              gnueabihf = abis.musleabihf;
+              gnuabin32 = abis.muslabin32;
+              gnuabi64 = abis.muslabi64;
+              gnuabielfv2 = abis.musl;
+              gnuabielfv1 = abis.musl;
+              # The following entries ensure that this function is idempotent.
+              musleabi = abis.musleabi;
+              musleabihf = abis.musleabihf;
+              muslabin32 = abis.muslabin32;
+              muslabi64 = abis.muslabi64;
+            }
+            .${parsed.abi.name} or abis.musl;
+        }
+      );
+
   ################################################################################
 
 }

maintainers/maintainer-list.nix

@@ -703,13 +703,6 @@
     githubId = 315003;
     name = "Adam Saponara";
   };
-  adtya = {
-    email = "adtya@adtya.xyz";
-    github = "adtya";
-    githubId = 22346805;
-    name = "Adithya Nair";
-    keys = [ { fingerprint = "51E4 F5AB 1B82 BE45 B422  9CC2 43A5 E25A A5A2 7849"; } ];
-  };
   aduh95 = {
     email = "duhamelantoine1995@gmail.com";
     github = "aduh95";
@@ -10089,6 +10082,12 @@
     githubId = 1949438;
     name = "Guillaume Matheron";
   };
+  guilvareux = {
+    email = "paul@alcock.dev";
+    github = "guilvareux";
+    githubId = 25768075;
+    name = "Paul Alcock";
+  };
   guitargeek = {
     email = "jonas.rembser@cern.ch";
     github = "guitargeek";
@@ -14519,6 +14518,12 @@
     github = "kulczwoj";
     githubId = 58049191;
   };
+  kumpelinus = {
+    name = "Kumpelinus";
+    email = "linus@kump.dev";
+    github = "kumpelinus";
+    githubId = 174106140;
+  };
   KunyaKud = {
     name = "KunyaKud";
     email = "wafuu@posteo.net";
@@ -15109,6 +15114,12 @@
     github = "Liamolucko";
     githubId = 43807659;
   };
+  liamthexpl0rer = {
+    name = "Liam";
+    matrix = "@liamthexpl0rer:matrix.org";
+    github = "liamthexpl0rer";
+    githubId = 119797945;
+  };
   liarokapisv = {
     email = "liarokapis.v@gmail.com";
     github = "liarokapisv";
@@ -16242,6 +16253,12 @@
     githubId = 115060;
     name = "Marek Maksimczyk";
   };
+  manfredmacx = {
+    email = "mfmacx@proton.me";
+    github = "manfredmacx";
+    githubId = 222261305;
+    name = "Manfred Macx";
+  };
   Mange = {
     name = "Magnus Bergmark";
     email = "me@mange.dev";
@@ -20329,13 +20346,6 @@
     githubId = 645664;
     name = "Philippe Hürlimann";
   };
-  p-rintz = {
-    email = "nix@rintz.net";
-    github = "p-rintz";
-    githubId = 13933258;
-    name = "Philipp Rintz";
-    matrix = "@philipp:srv.icu";
-  };
   p0lyw0lf = {
     email = "p0lyw0lf@protonmail.com";
     name = "PolyWolf";
@@ -30096,6 +30106,12 @@
     githubId = 873857;
     name = "Zack Newman";
   };
+  zodman = {
+    github = "zodman";
+    githubId = 44167;
+    name = "Andres Vargas";
+    email = "zodman@gmail.com";
+  };
   zoedsoupe = {
     github = "zoedsoupe";
     githubId = 44469426;

nixos/doc/manual/release-notes/rl-2605.section.md

@@ -30,6 +30,8 @@
 
 - [qui](https://github.com/autobrr/qui), a modern alternative webUI for qBittorrent, with multi-instance support. Written in Go/React. Available as [services.qui](#opt-services.qui.enable).
 
+- [kiwix-serve](https://wiki.kiwix.org/wiki/Kiwix-serve), a service that serves ZIM files (such as Wikipedia archives) over HTTP. Available as [services.kiwix-serve](#opt-services.kiwix-serve.enable).
+
 - [Remark42](https://remark42.com/), a self-hosted comment engine. Available as [services.remark42](#opt-services.remark42.enable).
 
 - [LibreChat](https://www.librechat.ai/), open-source self-hostable ChatGPT clone with Agents and RAG APIs. Available as [services.librechat](#opt-services.librechat.enable).
@@ -195,6 +197,8 @@ See <https://github.com/NixOS/nixpkgs/issues/481673>.
   - SQLite paths are now relative to `service.rootpath` unless absolute. Startup now validates file
     storage and OAuth providers.
 
+- `lunarvim` package has been removed, as it was abandoned upstream and relied on an old version of `neovim` to work properly.
+
 ## Other Notable Changes {#sec-release-26.05-notable-changes}
 
 <!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->

nixos/modules/module-list.nix

@@ -604,6 +604,7 @@
   ./services/development/hoogle.nix
   ./services/development/jupyter/default.nix
   ./services/development/jupyterhub/default.nix
+  ./services/development/labgrid/coordinator.nix
   ./services/development/livebook.nix
   ./services/development/lorri.nix
   ./services/development/nixseparatedebuginfod2.nix
@@ -881,6 +882,7 @@
   ./services/misc/jackett.nix
   ./services/misc/jellyfin.nix
   ./services/misc/jellyseerr.nix
+  ./services/misc/kiwix-serve.nix
   ./services/misc/klipper.nix
   ./services/misc/languagetool.nix
   ./services/misc/leaps.nix
@@ -1758,6 +1760,7 @@
   ./services/web-apps/snipe-it.nix
   ./services/web-apps/snips-sh.nix
   ./services/web-apps/sogo.nix
+  ./services/web-apps/speedtest-tracker.nix
   ./services/web-apps/sshwifty.nix
   ./services/web-apps/stash.nix
   ./services/web-apps/stirling-pdf.nix

nixos/modules/programs/ccache.nix

@@ -23,7 +23,7 @@ in
       description = "Nix top-level packages to be compiled using CCache";
       default = [ ];
       example = [
-        "wxGTK32"
+        "wxwidgets_3_2"
         "ffmpeg"
         "libav_all"
       ];

nixos/modules/services/databases/redis.nix

@@ -335,7 +335,23 @@ in
                       If the master is password protected (using the requirePass configuration)
                       it is possible to tell the slave to authenticate before starting the replication synchronization
                       process, otherwise the master will refuse the slave request.
-                      (STORED PLAIN TEXT, WORLD-READABLE IN NIX STORE)'';
+                      (STORED PLAIN TEXT, WORLD-READABLE IN NIX STORE)
+                    '';
+                  };
+
+                  masterAuthFile = lib.mkOption {
+                    type = with types; nullOr path;
+                    default = null;
+                    description = "File with password for the master user.";
+                    example = "/run/keys/redis-master-password";
+                  };
+
+                  masterUser = lib.mkOption {
+                    type = with types; nullOr str;
+                    default = null;
+                    description = ''
+                      If the master is password protected via ACLs this option can be used to specify
+                      the Redis user that is used by replicas.'';
                   };
 
                   requirePass = lib.mkOption {
@@ -355,6 +371,43 @@ in
                     example = "/run/keys/redis-password";
                   };
 
+                  sentinelAuthPassFile = lib.mkOption {
+                    type = with types; nullOr path;
+                    default = null;
+                    description = "File with password for connecting to other Sentinel instances.";
+                    example = "/run/keys/sentinel-password";
+                  };
+
+                  sentinelAuthUser = lib.mkOption {
+                    type = with types; nullOr str;
+                    default = null;
+                    description = "The username to use to monitor a master from Sentinel.";
+                  };
+
+                  sentinelMasterHost = lib.mkOption {
+                    type = with types; nullOr str;
+                    default = null;
+                    description = "The IP address (recommended) or hostname of the Redis master that Sentinel will monitor.";
+                  };
+
+                  sentinelMasterName = lib.mkOption {
+                    type = with types; nullOr str;
+                    default = null;
+                    description = "The master name of the Redis master that Sentinel will monitor.";
+                  };
+
+                  sentinelMasterPort = lib.mkOption {
+                    type = with types; nullOr int;
+                    default = null;
+                    description = "The TCP port of the Redis master that Sentinel will monitor.";
+                  };
+
+                  sentinelMasterQuorum = lib.mkOption {
+                    type = with types; nullOr int;
+                    default = null;
+                    description = "The Sentinel quorum (minimum number of Sentinel nodes online for failover)";
+                  };
+
                   appendOnly = lib.mkOption {
                     type = types.bool;
                     default = false;
@@ -452,14 +505,55 @@ in
 
   config = lib.mkIf (enabledServers != { }) {
 
-    assertions = lib.attrValues (
-      lib.mapAttrs (name: conf: {
-        assertion = conf.requirePass != null -> conf.requirePassFile == null;
-        message = ''
-          You can only set one services.redis.servers.${name}.requirePass
-          or services.redis.servers.${name}.requirePassFile
-        '';
-      }) enabledServers
+    assertions = lib.concatLists (
+      lib.mapAttrsToList (name: conf: [
+        {
+          assertion = conf.requirePass != null -> conf.requirePassFile == null;
+          message = ''
+            You can only set one of services.redis.servers.${name}.requirePass
+            or services.redis.servers.${name}.requirePassFile
+          '';
+        }
+        {
+          assertion = conf.masterAuth != null -> conf.masterAuthFile == null;
+          message = ''
+            You can only set one of services.redis.servers.${name}.masterAuth
+            or services.redis.servers.${name}.masterAuthFile
+          '';
+        }
+        {
+          assertion = conf.masterUser != null -> (conf.masterAuth != null || conf.masterAuthFile != null);
+          message = ''
+            If using services.redis.servers.${name}.masterUser, either
+            services.redis.servers.${name}.masterAuthFile or
+            services.redis.servers.${name}.masterAuth must be provided
+          '';
+        }
+        {
+          assertion =
+            conf.sentinelMasterName != null
+            -> (
+              conf.sentinelMasterHost != null
+              && conf.sentinelMasterPort != null
+              && conf.sentinelMasterQuorum != null
+            );
+          message = ''
+            For Sentinel,
+            services.redis.servers.${name}.sentinelMasterName,
+            services.redis.servers.${name}.sentinelMasterHost,
+            services.redis.servers.${name}.sentinelMasterPort,
+            and services.redis.servers.${name}.sentinelMasterQuorum
+            must all be provided
+          '';
+        }
+        {
+          assertion = conf.sentinelAuthPassFile != null -> conf.sentinelMasterName != null;
+          message = ''
+            For Sentinel authentication, services.redis.servers.${name}.sentinelMasterName,
+            must be provided
+          '';
+        }
+      ]) enabledServers
     );
 
     boot.kernel.sysctl = lib.mkIf cfg.vmOverCommit {
@@ -498,6 +592,17 @@ in
           ExecStart = "${cfg.package}/bin/${
             cfg.package.serverBin or "redis-server"
           } /var/lib/${redisName name}/redis.conf ${lib.escapeShellArgs conf.extraParams}";
+
+          # NOTE: Redis/Valkey Sentinel persists dynamic cluster state by rewriting its
+          # configuration file at runtime (redis.conf). This includes monitors,
+          # authentication credentials, and failover metadata, and this behaviour
+          # cannot be disabled.
+          # As a result, a fully declarative configuration is not possible for
+          # Sentinel-managed options. The preStart logic below appends sentinel
+          # configuration only if it is not already present, in order to avoid
+          # overwriting state that is owned and maintained by Sentinel itself.
+          # This is an intentional deviation from strict declarative semantics and
+          # is required for correct Sentinel operation.
           ExecStartPre =
             "+"
             + pkgs.writeShellScript "${redisName name}-prep-conf" (
@@ -515,10 +620,40 @@ in
                 fi
                 echo 'include "${redisConfStore}"' > "${redisConfRun}"
                 ${lib.optionalString (conf.requirePassFile != null) ''
-                  {
-                    echo -n "requirepass "
-                    cat ${lib.escapeShellArg conf.requirePassFile}
-                  } >> "${redisConfRun}"
+                  echo "requirepass $(cat ${lib.escapeShellArg conf.requirePassFile})" >> "${redisConfRun}"
+                ''}
+                ${lib.optionalString (conf.masterUser != null) ''
+                  echo "masteruser ${conf.masterUser}" >> "${redisConfRun}"
+                ''}
+                ${lib.optionalString (conf.masterAuthFile != null) ''
+                  echo "masterauth $(cat ${lib.escapeShellArg conf.masterAuthFile})" >> "${redisConfRun}"
+                ''}
+                ${lib.optionalString (conf.sentinelMasterHost != null) ''
+                  sentinel_monitor_line="sentinel monitor ${conf.sentinelMasterName} ${conf.sentinelMasterHost} ${toString conf.sentinelMasterPort} ${toString conf.sentinelMasterQuorum}"
+                  if grep -qE "^sentinel monitor ${conf.sentinelMasterName}\b" "${redisConfVar}"; then
+                    sed -i \
+                      "s|^sentinel monitor ${conf.sentinelMasterName}\b.*|$sentinel_monitor_line|" "${redisConfVar}"
+                  else
+                    echo "$sentinel_monitor_line" >> "${redisConfVar}"
+                  fi
+                ''}
+                ${lib.optionalString (conf.sentinelAuthUser != null) ''
+                  sentinel_auth_user_line="sentinel auth-user ${conf.sentinelMasterName} ${conf.sentinelAuthUser}"
+                  if grep -qE "^sentinel auth-user ${conf.sentinelMasterName}\b" "${redisConfVar}"; then
+                    sed -i \
+                      "s|^sentinel auth-user ${conf.sentinelMasterName}\b.*|$sentinel_auth_user_line|" "${redisConfVar}"
+                  else
+                    echo "$sentinel_auth_user_line" >> "${redisConfVar}"
+                  fi
+                ''}
+                ${lib.optionalString (conf.sentinelAuthPassFile != null) ''
+                  sentinel_auth_pass_line="sentinel auth-pass ${conf.sentinelMasterName} $(cat ${lib.escapeShellArg conf.sentinelAuthPassFile})"
+                  if grep -qE "^sentinel auth-pass ${conf.sentinelMasterName}\b" "${redisConfVar}"; then
+                    sed -i \
+                      "s|^sentinel auth-pass ${conf.sentinelMasterName}\b.*|$sentinel_auth_pass_line|" "${redisConfVar}"
+                  else
+                    echo "$sentinel_auth_pass_line" >> "${redisConfVar}"
+                  fi
                 ''}
               ''
             );

nixos/modules/services/development/labgrid/coordinator.nix

@@ -0,0 +1,96 @@
+{
+  config,
+  pkgs,
+  lib,
+  ...
+}:
+
+let
+  cfg = config.services.labgrid.coordinator;
+in
+{
+  meta = {
+    maintainers = with lib.maintainers; [
+      aiyion
+      emantor
+    ];
+  };
+
+  options = {
+    services.labgrid.coordinator = {
+      bindAddress = lib.mkOption {
+        default = "0.0.0.0";
+        type = lib.types.str;
+        description = "Bind address for the labgrid coordinator.";
+      };
+
+      debug = lib.mkOption {
+        default = false;
+        type = with lib.types; bool;
+        description = ''
+          Whether to enable debug mode.
+        '';
+      };
+
+      enable = lib.mkEnableOption "Labgrid Coordinator";
+
+      openFirewall = lib.mkOption {
+        default = false;
+        type = with lib.types; bool;
+        description = ''
+          Whether to automatically open the coordinator listen port in the firewall.
+        '';
+      };
+
+      package = lib.mkPackageOption pkgs [ "python3Packages" "labgrid" ] { };
+
+      port = lib.mkOption {
+        default = 20408;
+        type = lib.types.port;
+        description = "Coordinator port to bind to.";
+      };
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    networking.firewall.allowedTCPPorts = lib.mkIf cfg.openFirewall [ cfg.port ];
+
+    systemd.services.labgrid-coordinator = {
+      after = [ "network-online.target" ];
+      description = "Labgrid Coordinator";
+      serviceConfig = {
+        Environment = ''"PYTHONUNBUFFERED=1"'';
+        ExecStart = "${lib.getBin cfg.package}/bin/labgrid-coordinator ${lib.optionalString cfg.debug "--debug"} --listen ${cfg.bindAddress}:${toString cfg.port}";
+        Restart = "on-failure";
+        DynamicUser = "yes";
+        StateDirectory = "labgrid-coordinator";
+        WorkingDirectory = "/var/lib/labgrid-coordinator";
+        CapabilityBoundingSet = "";
+        LockPersonality = true;
+        MemoryDenyWriteExecute = true;
+        PrivateDevices = true;
+        PrivateUsers = true;
+        ProcSubset = "pid";
+        ProtectClock = true;
+        ProtectControlGroups = true;
+        ProtectHome = true;
+        ProtectHostname = true;
+        ProtectKernelLogs = true;
+        ProtectKernelModules = true;
+        ProtectKernelTunables = true;
+        ProtectProc = "invisible";
+        RestrictRealtime = true;
+        RestrictAddressFamilies = "AF_INET AF_INET6";
+        RestrictNamespaces = true;
+        SystemCallArchitectures = "native";
+        SystemCallFilter = [
+          "@system-service"
+          "~@privileged"
+          "~@resources"
+        ];
+      };
+      wantedBy = [ "multi-user.target" ];
+      wants = [ "network-online.target" ];
+    };
+  };
+}

nixos/modules/services/misc/kiwix-serve.nix

@@ -0,0 +1,187 @@
+{
+  config,
+  lib,
+  pkgs,
+  utils,
+  ...
+}:
+let
+  inherit (lib) types;
+  cfg = config.services.kiwix-serve;
+  # Create a directory containing symlinks to ZIM files
+  mkLibrary =
+    library:
+    let
+      libraryEntries = lib.mapAttrsToList (name: path: {
+        name = "${name}.zim";
+        inherit path;
+      }) library;
+
+      zimsDrv = pkgs.linkFarm "zims" libraryEntries;
+
+      files = map (entry: "${zimsDrv}/${entry.name}") libraryEntries;
+    in
+    {
+      derivation = zimsDrv;
+      inherit files;
+    };
+in
+{
+  options = {
+    services.kiwix-serve = {
+      enable = lib.mkEnableOption "the kiwix-serve server";
+
+      package = lib.mkPackageOption pkgs "kiwix-tools" { };
+
+      address = lib.mkOption {
+        type = types.str;
+        default = "all";
+        example = "ipv4";
+        description = ''
+          Listen only on the specified IP address.
+          Specify "ipv4", "ipv6" or "all" to listen on all IPv4, IPv6, or both types of addresses, respectively.
+        '';
+      };
+
+      port = lib.mkOption {
+        type = types.port;
+        default = 8080;
+        description = "The port on which to run kiwix-serve.";
+      };
+
+      openFirewall = lib.mkOption {
+        type = types.bool;
+        default = false;
+        description = "Whether to open the firewall for the configured port.";
+      };
+
+      library = lib.mkOption {
+        type = types.attrsOf types.path;
+        default = { };
+        example = lib.literalExpression (
+          lib.removeSuffix "\n" ''
+            {
+              wikipedia = "/data/wikipedia_en_all_maxi_2026-02.zim";
+              nix = pkgs.fetchurl {
+                url = "https://download.kiwix.org/zim/devdocs/devdocs_en_nix_2026-01.zim";
+                hash = "sha256-QxB9qDKSzzEU8t4droI08BXdYn+HMVkgiJMO3SoGTqM=";
+              };
+            }
+          ''
+        );
+        description = ''
+          A set of ZIM files to serve. The key is used as the name for the ZIM files
+          (e.g. in the example, the files will be served as `wikipedia.zim` and `nix.zim`).
+
+          Exclusive with [services.kiwix-serve.libraryPath](#opt-services.kiwix-serve.libraryPath).
+        '';
+      };
+
+      libraryPath = lib.mkOption {
+        type = types.nullOr types.path;
+        default = null;
+        example = "/data/library.xml";
+        description = ''
+          An XML library file listing ZIM files to serve.
+          For more information, see <https://wiki.kiwix.org/wiki/Kiwix-manage>.
+
+          Exclusive with [services.kiwix-serve.library](#opt-services.kiwix-serve.library).
+        '';
+      };
+
+      extraArgs = lib.mkOption {
+        type = types.listOf types.str;
+        default = [ ];
+        example = [
+          "--verbose"
+          "--skipInvalid"
+        ];
+        description = "Extra arguments to pass to kiwix-serve.";
+      };
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    assertions = [
+      {
+        assertion = (cfg.library == { }) != (cfg.libraryPath == null);
+        message = "Exactly one of services.kiwix-serve.library or services.kiwix-serve.libraryPath must be provided.";
+      }
+    ];
+
+    systemd.services.kiwix-serve =
+      let
+        library = mkLibrary cfg.library;
+      in
+      {
+        description = "ZIM file HTTP server";
+        documentation = [ "https://kiwix-tools.readthedocs.io/en/latest/kiwix-serve.html" ];
+        after = [ "network.target" ];
+        wantedBy = [ "multi-user.target" ];
+
+        serviceConfig = {
+          Type = "exec";
+          DynamicUser = true;
+          Restart = "on-failure";
+          ExecStart = utils.escapeSystemdExecArgs (
+            [
+              (lib.getExe' cfg.package "kiwix-serve")
+              "--address"
+              cfg.address
+              "--port"
+              cfg.port
+            ]
+            ++ lib.optionals (cfg.libraryPath != null) [
+              "--library"
+              cfg.libraryPath
+            ]
+            ++ lib.optionals (cfg.library != { }) library.files
+            ++ cfg.extraArgs
+          );
+
+          CapabilityBoundingSet = "";
+          DeviceAllow = "";
+          LockPersonality = true;
+          MemoryDenyWriteExecute = true;
+          NoNewPrivileges = true;
+          PrivateDevices = true;
+          PrivateUsers = true;
+          PrivateTmp = true;
+          ProcSubset = "pid";
+          ProtectClock = true;
+          ProtectControlGroups = true;
+          ProtectHome = true;
+          ProtectHostname = true;
+          ProtectKernelLogs = true;
+          ProtectKernelModules = true;
+          ProtectKernelTunables = true;
+          ProtectProc = "invisible";
+          ProtectSystem = "strict";
+          RemoveIPC = true;
+          RestrictAddressFamilies = [
+            "AF_INET"
+            "AF_INET6"
+            "AF_NETLINK"
+          ];
+          RestrictNamespaces = true;
+          RestrictRealtime = true;
+          RestrictSUIDSGID = true;
+          SystemCallArchitectures = "native";
+          SystemCallFilter = [
+            "@system-service"
+            "~@privileged"
+            "~@resources"
+          ];
+          UMask = "0077";
+        };
+      };
+
+    networking.firewall = lib.mkIf cfg.openFirewall {
+      allowedTCPPorts = [ cfg.port ];
+    };
+  };
+
+  meta = {
+    maintainers = with lib.maintainers; [ MysteryBlokHed ];
+  };
+}

nixos/modules/services/networking/ncps.nix

@@ -580,7 +580,7 @@ in
         signNarinfo = lib.mkOption {
           type = lib.types.bool;
           default = true;
-          example = "false";
+          example = false;
           description = ''
             Whether to sign narInfo files or passthru as-is from upstream
           '';

nixos/modules/services/networking/shadowsocks.nix

@@ -29,8 +29,15 @@ let
 
   configFile = pkgs.writeText "shadowsocks.json" (builtins.toJSON opts);
 
+  executablesMap = {
+    "${getName pkgs.shadowsocks-libev}" = {
+      server = "ss-server";
+    };
+    "${getName pkgs.shadowsocks-rust}" = {
+      server = "ssserver";
+    };
+  };
 in
-
 {
 
   ###### interface
@@ -47,14 +54,25 @@ in
         '';
       };
 
+      package = mkPackageOption pkgs "Shadowsocks" {
+        default = "shadowsocks-libev";
+      };
+
       localAddress = mkOption {
-        type = types.coercedTo types.str singleton (types.listOf types.str);
+        type =
+          with types;
+          oneOf [
+            str
+            (listOf str)
+          ];
+        # Keeped for compatibility
         default = [
           "[::0]"
           "0.0.0.0"
         ];
         description = ''
           Local addresses to which the server binds.
+          Note: shadowsocks-rust accepts only string parameter.
         '';
       };
 
@@ -163,14 +181,19 @@ in
           (noPasswd && !noPasswdFile) || (!noPasswd && noPasswdFile);
         message = "Option `password` or `passwordFile` must be set and cannot be set simultaneously";
       }
+      {
+        # Ensure localAddress is a string if package is shadowsocks-rust
+        assertion = !(getName cfg.package == "shadowsocks-rust" && !lib.strings.isString cfg.localAddress);
+        message = "Option `localAddress` must be a string when using shadowsocks-rust.";
+      }
     ];
 
-    systemd.services.shadowsocks-libev = {
-      description = "shadowsocks-libev Daemon";
+    systemd.services.${getName cfg.package} = {
+      description = "${getName cfg.package} Daemon";
       after = [ "network.target" ];
       wantedBy = [ "multi-user.target" ];
       path = [
-        pkgs.shadowsocks-libev
+        cfg.package
       ]
       ++ optional (cfg.plugin != null) cfg.plugin
       ++ optional (cfg.passwordFile != null) pkgs.jq;
@@ -179,7 +202,9 @@ in
         ${optionalString (cfg.passwordFile != null) ''
           cat ${configFile} | jq --arg password "$(cat "${cfg.passwordFile}")" '. + { password: $password }' > /tmp/shadowsocks.json
         ''}
-        exec ss-server -c ${if cfg.passwordFile != null then "/tmp/shadowsocks.json" else configFile}
+        exec ${(executablesMap.${getName cfg.package}).server} -c ${
+          if cfg.passwordFile != null then "/tmp/shadowsocks.json" else configFile
+        }
       '';
     };
   };

nixos/modules/services/search/meilisearch.nix

@@ -121,6 +121,9 @@ in
         Path to file which contains the master key.
         By doing so, all routes will be protected and will require a key to be accessed.
         If no master key is provided, all routes can be accessed without requiring any key.
+
+        You can generate a master key by running `openssl rand -base64 36`.
+        Alternatively, you can start Meilisearch without a master key and use the pre-generated key from the service's logs that can be obtained by `journalctl -u meilisearch | grep -- --master-key`.
       '';
       default = null;
       type = lib.types.nullOr lib.types.path;

nixos/modules/services/web-apps/librechat.nix

@@ -6,6 +6,7 @@
 }:
 let
   cfg = config.services.librechat;
+  meiliCfg = config.services.meilisearch;
   format = pkgs.formats.yaml { };
   configFile = format.generate "librechat.yaml" cfg.settings;
   exportCredentials = n: _: ''export ${n}="$(${pkgs.systemd}/bin/systemd-creds cat ${n}_FILE)"'';
@@ -155,6 +156,26 @@ in
     };
 
     enableLocalDB = lib.mkEnableOption "a local mongodb instance";
+
+    meilisearch = lib.mkOption {
+      type = lib.types.submodule {
+        options = {
+          enable = lib.mkOption {
+            type = lib.types.bool;
+            default = false;
+            example = true;
+            description = ''
+              Whether to enable and configure Meilisearch locally for Librechat.
+              You will manually need to set `services.meilisearch.masterKeyFile`.
+            '';
+          };
+        };
+      };
+      default = { };
+      description = ''
+        See [LibreChat search feature](https://www.librechat.ai/docs/features/search).
+      '';
+    };
   };
 
   config = lib.mkIf cfg.enable {
@@ -178,6 +199,12 @@ in
           You can use https://www.librechat.ai/toolkit/creds_generator to generate these.
         '';
       }
+      {
+        assertion = cfg.meilisearch.enable -> meiliCfg.masterKeyFile != null;
+        message = ''
+          LibreChat's Meilisearch integration requires `services.meilisearch.masterKeyFile` to be set.
+        '';
+      }
     ];
 
     networking.firewall.allowedTCPPorts = lib.optional cfg.openFirewall cfg.port;
@@ -192,7 +219,8 @@ in
       after = [
         "tmpfiles.target"
       ]
-      ++ lib.optional cfg.enableLocalDB "mongodb.service";
+      ++ lib.optional cfg.meilisearch.enable "meilisearch.service";
+      wants = lib.optional cfg.meilisearch.enable "meilisearch.service";
       description = "Open-source app for all your AI conversations, fully customizable and compatible with any AI provider";
       environment = cfg.env;
       script = # sh
@@ -249,6 +277,11 @@ in
 
     services.librechat.env.MONGO_URI = lib.mkIf cfg.enableLocalDB "mongodb://localhost:27017";
     services.mongodb.enable = lib.mkIf cfg.enableLocalDB true;
+
+    services.meilisearch.enable = lib.mkIf cfg.meilisearch.enable true;
+    services.librechat.env.SEARCH = lib.mkIf cfg.meilisearch.enable true;
+    services.librechat.env.MEILI_HOST = lib.mkIf cfg.meilisearch.enable "http://${meiliCfg.settings.http_addr}";
+    services.librechat.credentials.MEILI_MASTER_KEY = lib.mkIf cfg.meilisearch.enable meiliCfg.masterKeyFile;
   };
 
   meta.maintainers = with lib.maintainers; [

nixos/modules/services/web-apps/speedtest-tracker.nix

@@ -0,0 +1,429 @@
+{
+  pkgs,
+  config,
+  lib,
+  ...
+}:
+
+let
+  cfg = config.services.speedtest-tracker;
+
+  user = cfg.user;
+  group = cfg.group;
+
+  defaultUser = "speedtest-tracker";
+  defaultGroup = "speedtest-tracker";
+
+  artisan = "${cfg.package}/artisan";
+
+  env-file-values = lib.mapAttrs' (n: v: {
+    name = lib.removeSuffix "_FILE" n;
+    value = v;
+  }) (lib.filterAttrs (n: v: v != null && lib.match ".+_FILE" n != null) cfg.settings);
+
+  env-nonfile-values = lib.filterAttrs (n: v: lib.match ".+_FILE" n == null) cfg.settings;
+
+  speedtest-tracker-maintenance = pkgs.writeShellScript "speedtest-tracker-maintenance.sh" ''
+    set -a
+    ${lib.toShellVars env-nonfile-values}
+    ${lib.concatLines (lib.mapAttrsToList (n: v: "${n}=\"$(< ${v})\"") env-file-values)}
+    set +a
+    ${lib.optionalString (
+      cfg.settings.DB_CONNECTION == "sqlite"
+    ) "touch ${cfg.dataDir}/storage/database/database.sqlite"}
+    rm -f ${cfg.dataDir}/cache/*.php
+    ${artisan} package:discover
+    ${artisan} migrate --force
+    ${artisan} optimize:clear
+    ${artisan} view:cache
+    ${artisan} config:cache
+  '';
+
+  speedtest-tracker-env-script =
+    command:
+    pkgs.writeShellScript "speedtest-tracker-${builtins.replaceStrings [ ":" " " ] [ "-" "-" ] command}.sh" ''
+      set -a
+      ${lib.toShellVars env-nonfile-values}
+      ${lib.concatLines (lib.mapAttrsToList (n: v: "${n}=\"$(< ${v})\"") env-file-values)}
+      set +a
+      exec ${artisan} ${command}
+    '';
+
+  commonServiceConfig = {
+    Type = "oneshot";
+    User = user;
+    Group = group;
+    StateDirectory = "speedtest-tracker";
+    ReadWritePaths = [ cfg.dataDir ];
+    WorkingDirectory = cfg.package;
+    PrivateTmp = true;
+    PrivateDevices = true;
+    CapabilityBoundingSet = "";
+    AmbientCapabilities = "";
+    ProtectSystem = "strict";
+    ProtectKernelTunables = true;
+    ProtectKernelModules = true;
+    ProtectControlGroups = true;
+    ProtectClock = true;
+    ProtectHostname = true;
+    ProtectHome = "tmpfs";
+    ProtectKernelLogs = true;
+    ProtectProc = "invisible";
+    ProcSubset = "pid";
+    PrivateNetwork = false;
+    RestrictAddressFamilies = "AF_INET AF_INET6 AF_UNIX";
+    SystemCallArchitectures = "native";
+    SystemCallFilter = [
+      "@system-service @resources"
+      "~@obsolete @privileged"
+    ];
+    RestrictSUIDSGID = true;
+    RemoveIPC = true;
+    NoNewPrivileges = true;
+    RestrictRealtime = true;
+    RestrictNamespaces = true;
+    LockPersonality = true;
+    PrivateUsers = true;
+  };
+
+in
+{
+  options.services.speedtest-tracker = {
+
+    enable = lib.mkEnableOption "Speedtest Tracker: A self-hosted internet performance tracking application";
+
+    package =
+      lib.mkPackageOption pkgs "speedtest-tracker" { }
+      // lib.mkOption {
+        apply =
+          speedtest-tracker:
+          speedtest-tracker.override (prev: {
+            dataDir = cfg.dataDir;
+          });
+      };
+
+    user = lib.mkOption {
+      type = lib.types.str;
+      default = defaultUser;
+      description = "User account under which Speedtest Tracker runs.";
+    };
+
+    group = lib.mkOption {
+      type = lib.types.str;
+      default = if cfg.enableNginx then "nginx" else defaultGroup;
+      defaultText = "If `services.speedtest-tracker.enableNginx` is true then `nginx` else ${defaultGroup}";
+      description = ''
+        Group under which Speedtest Tracker runs. It is best to set this to the group
+        of whatever webserver is being used as the frontend.
+      '';
+    };
+
+    dataDir = lib.mkOption {
+      type = lib.types.path;
+      default = "/var/lib/speedtest-tracker";
+      description = ''
+        The place where Speedtest Tracker stores its state.
+      '';
+    };
+
+    enableNginx = lib.mkOption {
+      type = lib.types.bool;
+      default = false;
+      description = ''
+        Whether to enable nginx or not. If enabled, an nginx virtual host will
+        be created for access to Speedtest Tracker. If not enabled, then you may use
+        `''${config.services.speedtest-tracker.package}` as your document root in
+        whichever webserver you wish to setup.
+      '';
+    };
+
+    virtualHost = lib.mkOption {
+      type = lib.types.str;
+      default = "localhost";
+      description = ''
+        The hostname at which you wish Speedtest Tracker to be served. If you have
+        enabled nginx using `services.speedtest-tracker.enableNginx` then this will
+        be used.
+      '';
+    };
+
+    poolConfig = lib.mkOption {
+      type = lib.types.attrsOf (
+        lib.types.oneOf [
+          lib.types.str
+          lib.types.int
+          lib.types.bool
+        ]
+      );
+      default = { };
+      defaultText = ''
+        {
+          "pm" = "dynamic";
+          "pm.max_children" = 32;
+          "pm.start_servers" = 2;
+          "pm.min_spare_servers" = 2;
+          "pm.max_spare_servers" = 4;
+          "pm.max_requests" = 500;
+        }
+      '';
+      description = ''
+        Options for the Speedtest Tracker PHP pool. See the documentation on `php-fpm.conf`
+        for details on configuration directives.
+      '';
+    };
+
+    settings = lib.mkOption {
+      default = { };
+      description = ''
+        Options for Speedtest Tracker configuration. Refer to
+        <https://github.com/alexjustesen/speedtest-tracker> for
+        details on supported values. All `_FILE` values are supported:
+        append `_FILE` to the setting name to provide a path to a file
+        containing the secret value.
+      '';
+      example = lib.literalExpression ''
+        {
+          APP_KEY_FILE = "/var/secrets/speedtest-tracker-app-key.txt";
+          DB_CONNECTION = "mysql";
+          DB_HOST = "db";
+          DB_PORT = 3306;
+          DB_DATABASE = "speedtest-tracker";
+          DB_USERNAME = "speedtest-tracker";
+          DB_PASSWORD_FILE = "/var/secrets/speedtest-tracker-mysql-password.txt";
+        }
+      '';
+      type = lib.types.submodule {
+        freeformType = lib.types.attrsOf (
+          lib.types.oneOf [
+            lib.types.str
+            lib.types.int
+            lib.types.bool
+          ]
+        );
+        options = {
+          APP_KEY_FILE = lib.mkOption {
+            type = lib.types.path;
+            description = ''
+              The path to your appkey. The file should contain a 32 character
+              random app key. This may be set using `echo "base64:$(head -c 32
+              /dev/urandom | base64)" > /path/to/key-file`.
+            '';
+          };
+          APP_URL = lib.mkOption {
+            type = lib.types.str;
+            default =
+              if cfg.virtualHost == "localhost" then
+                "http://${cfg.virtualHost}"
+              else
+                "https://${cfg.virtualHost}";
+            defaultText = ''
+              http(s)://''${config.services.speedtest-tracker.virtualHost}
+            '';
+            description = ''
+              The APP_URL used by Speedtest Tracker internally. Please make sure this
+              URL matches the external URL of your installation. It is used to
+              validate specific requests and to generate URLs in notifications.
+            '';
+          };
+          DB_CONNECTION = lib.mkOption {
+            type = lib.types.enum [
+              "sqlite"
+              "mysql"
+              "mariadb"
+              "pgsql"
+            ];
+            default = "sqlite";
+            example = "pgsql";
+            description = ''
+              The type of database you wish to use. Can be one of "sqlite",
+              "mysql", "mariadb" or "pgsql".
+            '';
+          };
+          DB_HOST = lib.mkOption {
+            type = lib.types.str;
+            default = "localhost";
+            description = ''
+              The IP or hostname which hosts your database.
+            '';
+          };
+          DB_PORT = lib.mkOption {
+            type = lib.types.nullOr lib.types.int;
+            default =
+              if cfg.settings.DB_CONNECTION == "pgsql" then
+                5432
+              else if cfg.settings.DB_CONNECTION == "mysql" || cfg.settings.DB_CONNECTION == "mariadb" then
+                3306
+              else
+                null;
+            defaultText = ''
+              `null` if DB_CONNECTION is "sqlite", `3306` if "mysql" or "mariadb", `5432` if "pgsql"
+            '';
+            description = ''
+              The port your database is listening at. sqlite does not require
+              this value to be filled.
+            '';
+          };
+          DB_DATABASE = lib.mkOption {
+            type = lib.types.str;
+            default =
+              if cfg.settings.DB_CONNECTION == "sqlite" then
+                "${cfg.dataDir}/storage/database/database.sqlite"
+              else
+                "speedtest-tracker";
+            defaultText = ''
+              "''${config.services.speedtest-tracker.dataDir}/storage/database/database.sqlite" if DB_CONNECTION is "sqlite", "speedtest-tracker" otherwise
+            '';
+            description = ''
+              The name of the database, or path to the sqlite file.
+            '';
+          };
+        };
+      };
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+
+    services.phpfpm.pools.speedtest-tracker = {
+      inherit user group;
+      phpPackage = cfg.package.phpPackage;
+      phpOptions = ''
+        log_errors = on
+      '';
+      settings = {
+        "listen.mode" = lib.mkDefault "0660";
+        "listen.owner" = lib.mkDefault user;
+        "listen.group" = lib.mkDefault group;
+        "pm" = lib.mkDefault "dynamic";
+        "pm.max_children" = lib.mkDefault 32;
+        "pm.start_servers" = lib.mkDefault 2;
+        "pm.min_spare_servers" = lib.mkDefault 2;
+        "pm.max_spare_servers" = lib.mkDefault 4;
+        "pm.max_requests" = lib.mkDefault 500;
+      }
+      // cfg.poolConfig;
+    };
+
+    systemd.services.speedtest-tracker-setup = {
+      after = [
+        "postgresql.target"
+        "mysql.service"
+      ];
+      requiredBy = [ "phpfpm-speedtest-tracker.service" ];
+      before = [ "phpfpm-speedtest-tracker.service" ];
+      serviceConfig = {
+        ExecStart = speedtest-tracker-maintenance;
+        RemainAfterExit = true;
+      }
+      // commonServiceConfig;
+      unitConfig.JoinsNamespaceOf = "phpfpm-speedtest-tracker.service";
+      restartTriggers = [ cfg.package ];
+      partOf = [ "phpfpm-speedtest-tracker.service" ];
+    };
+
+    systemd.services.speedtest-tracker-scheduler = {
+      after = [ "speedtest-tracker-setup.service" ];
+      wants = [ "speedtest-tracker-setup.service" ];
+      description = "Speedtest Tracker scheduler";
+      path = [ pkgs.ookla-speedtest ];
+      serviceConfig = {
+        ExecStart = speedtest-tracker-env-script "schedule:run";
+      }
+      // commonServiceConfig;
+    };
+
+    systemd.timers.speedtest-tracker-scheduler = {
+      description = "Speedtest Tracker scheduler timer";
+      timerConfig = {
+        OnCalendar = "minutely";
+        Persistent = true;
+      };
+      wantedBy = [ "timers.target" ];
+      restartTriggers = [ cfg.package ];
+    };
+
+    systemd.services.speedtest-tracker-queue-worker = {
+      after = [ "speedtest-tracker-setup.service" ];
+      wants = [ "speedtest-tracker-setup.service" ];
+      wantedBy = [ "multi-user.target" ];
+      description = "Speedtest Tracker queue worker";
+      path = [ pkgs.ookla-speedtest ];
+      serviceConfig = commonServiceConfig // {
+        Type = "simple";
+        Restart = "always";
+        ExecStart = speedtest-tracker-env-script "queue:work --sleep=3 --tries=3";
+      };
+    };
+
+    services.nginx = lib.mkIf cfg.enableNginx {
+      enable = true;
+      recommendedTlsSettings = lib.mkDefault true;
+      recommendedOptimisation = lib.mkDefault true;
+      recommendedGzipSettings = lib.mkDefault true;
+      virtualHosts.${cfg.virtualHost} = {
+        root = "${cfg.package}/public";
+        locations = {
+          "/" = {
+            tryFiles = "$uri $uri/ /index.php?$query_string";
+            index = "index.php";
+            extraConfig = ''
+              sendfile off;
+            '';
+          };
+          "~ \\.php$" = {
+            extraConfig = ''
+              include ${config.services.nginx.package}/conf/fastcgi_params;
+              fastcgi_param SCRIPT_FILENAME $request_filename;
+              fastcgi_param modHeadersAvailable true;
+              fastcgi_pass unix:${config.services.phpfpm.pools.speedtest-tracker.socket};
+            '';
+          };
+          "~ \\.(js|css|gif|png|ico|jpg|jpeg)$" = {
+            extraConfig = "expires 365d;";
+          };
+        };
+      };
+    };
+
+    systemd.tmpfiles.settings."10-speedtest-tracker" =
+      lib.genAttrs
+        [
+          "${cfg.dataDir}/storage"
+          "${cfg.dataDir}/storage/app"
+          "${cfg.dataDir}/storage/database"
+          "${cfg.dataDir}/storage/framework"
+          "${cfg.dataDir}/storage/framework/cache"
+          "${cfg.dataDir}/storage/framework/sessions"
+          "${cfg.dataDir}/storage/framework/views"
+          "${cfg.dataDir}/storage/logs"
+          "${cfg.dataDir}/cache"
+        ]
+        (n: {
+          d = {
+            inherit group;
+            mode = "0700";
+            inherit user;
+          };
+        })
+      // {
+        "${cfg.dataDir}".d = {
+          inherit group;
+          mode = "0710";
+          inherit user;
+        };
+      };
+
+    users = {
+      users = lib.mkIf (user == defaultUser) {
+        ${defaultUser} = {
+          inherit group;
+          isSystemUser = true;
+          home = cfg.dataDir;
+        };
+      };
+      groups = lib.mkIf (group == defaultGroup) { ${defaultGroup} = { }; };
+    };
+  };
+
+  meta.maintainers = pkgs.speedtest-tracker.meta.maintainers;
+}

nixos/modules/virtualisation/libvirtd.nix

@@ -530,7 +530,10 @@ in
           "nix-helpers"
           "nix-ovmf"
         ];
-        StateDirectory = subDirs [ "dnsmasq" ];
+        StateDirectory = subDirs [
+          "dnsmasq"
+          "secrets"
+        ];
       };
     };
 

nixos/tests/all-tests.nix

@@ -840,6 +840,7 @@ in
   keymap = handleTest ./keymap.nix { };
   kimai = runTest ./kimai.nix;
   kismet = runTest ./kismet.nix;
+  kiwix-serve = runTest ./kiwix-serve;
   kmonad = runTest ./kmonad.nix;
   kmscon = runTest ./kmscon.nix;
   knot = runTest ./knot.nix;
@@ -853,6 +854,7 @@ in
     inherit runTest;
     inherit (pkgs) lib;
   };
+  labgrid = runTest ./labgrid.nix;
   lact = runTest ./lact.nix;
   ladybird = runTest ./ladybird.nix;
   languagetool = runTest ./languagetool.nix;
@@ -1493,6 +1495,7 @@ in
   sonic-server = runTest ./sonic-server.nix;
   spacecookie = runTest ./spacecookie.nix;
   spark = handleTestOn [ "x86_64-linux" "aarch64-linux" ] ./spark { };
+  speedtest-tracker = runTest ./speedtest-tracker.nix;
   spiped = runTest ./spiped.nix;
   spire = runTest ./spire.nix;
   sqlite3-to-mysql = runTest ./sqlite3-to-mysql.nix;

nixos/tests/caddy.nix

@@ -73,7 +73,7 @@
           services.caddy = {
             package = pkgs.caddy.withPlugins {
               plugins = [ "github.com/caddyserver/replace-response@v0.0.0-20241211194404-3865845790a7" ];
-              hash = "sha256-P6rYPJeJcKZgH/d29YQrPf68uWWuav2tQq/2+sVT3tg=";
+              hash = "sha256-Quib7+jFf2ElS4yvrJhuLiedX3lBNwxpEDskxxyVu+8=";
             };
             configFile = pkgs.writeText "Caddyfile" ''
               {

nixos/tests/kiwix-serve/default.nix

@@ -0,0 +1,75 @@
+{ lib, pkgs, ... }:
+let
+  mkTestZim =
+    name:
+    pkgs.runCommandLocal "${name}.zim"
+      {
+        nativeBuildInputs = [ pkgs.zim-tools ];
+      }
+      ''
+        ${lib.getExe' pkgs.zim-tools "zimwriterfs"} \
+          --name "${name}" \
+          --title 'NixOS kiwix-serve Test' \
+          --description 'NixOS test of kiwix-serve' \
+          --creator Nixpkgs \
+          --publisher Nixpkgs \
+          --language eng \
+          --welcome index.html \
+          --illustration icon.png \
+          ${./html} \
+          $out
+      '';
+
+  # Test files must have different names or kiwix-serve will only serve one of them
+  testZimStore = mkTestZim "test-store";
+  testZimOutside = mkTestZim "test-outside";
+in
+{
+  name = "kiwix-serve";
+  meta.maintainers = with lib.maintainers; [ MysteryBlokHed ];
+
+  nodes = {
+    machine = {
+      systemd.services.copy-zim-file = {
+        description = "Copy test ZIM file to host system to test paths outside of store";
+        wantedBy = [ "multi-user.target" ];
+        before = [ "kiwix-serve.service" ];
+        requiredBy = [ "kiwix-serve.service" ];
+
+        serviceConfig = {
+          Type = "oneshot";
+        };
+
+        script = ''
+          mkdir -p /var/lib/kiwix-serve
+          cp ${testZimOutside} /var/lib/kiwix-serve/test-outside.zim
+        '';
+      };
+
+      services.kiwix-serve = {
+        enable = true;
+        port = 8080;
+        library = {
+          test-store = testZimStore;
+          test-outside = "/var/lib/kiwix-serve/test-outside.zim";
+        };
+      };
+    };
+  };
+
+  testScript = ''
+    machine.wait_for_unit("kiwix-serve.service")
+    machine.wait_for_open_port(8080)
+    machine.wait_until_succeeds("curl --fail --silent --head http://localhost:8080")
+
+    # ZIM file in store
+    test_content = machine.succeed("curl --fail --silent --location http://localhost:8080/content/test-store")
+    print(test_content)
+    assert "NixOS test of kiwix-serve" in test_content, "kiwix-serve did not provide the expected page for the store ZIM file"
+
+    # ZIM file outside of store
+    test_content = machine.succeed("curl --fail --silent --location http://localhost:8080/content/test-outside")
+    print(test_content)
+    assert "NixOS test of kiwix-serve" in test_content, "kiwix-serve did not provide the expected page for the out-of-store ZIM file"
+  '';
+}

nixos/tests/kiwix-serve/html/index.html

@@ -0,0 +1,11 @@
+<!DOCTYPE html>
+<html lang="en">
+  <head>
+    <meta charset="UTF-8">
+    <meta name="viewport" content="width=device-width, initial-scale=1">
+    <title>NixOS kiwix-serve Test</title>
+  </head>
+  <body>
+    <h1>NixOS test of kiwix-serve</h1>
+  </body>
+</html>

nixos/tests/labgrid.nix

@@ -0,0 +1,66 @@
+{ pkgs, ... }:
+{
+  name = "Labgrid";
+  meta.maintainers = with pkgs.lib.maintainers; [
+    aiyion
+    emantor
+  ];
+
+  nodes.coordinator =
+    { pkgs, ... }:
+    {
+      services.labgrid.coordinator.enable = true;
+      services.labgrid.coordinator.openFirewall = true;
+    };
+
+  nodes.client =
+    { pkgs, ... }:
+    {
+      environment.variables = {
+        LG_COORDINATOR = "coordinator:20408";
+      };
+      environment.systemPackages = [ pkgs.python3Packages.labgrid ];
+    };
+
+  testScript =
+    { nodes, ... }:
+    #python
+    ''
+      def assert_contains(haystack, needle):
+          if needle not in haystack:
+              print("The haystack that will cause the following exception is:")
+              print("---")
+              print(haystack)
+              print("---")
+              raise Exception(f"Expected string '{needle}' was not found")
+
+      with subtest("Wait for coordinator startup"):
+          coordinator.start()
+          coordinator.wait_for_unit("labgrid-coordinator.service")
+          coordinator.wait_for_open_port(20408)
+
+      with subtest("Connect from client"):
+          client.start()
+          out = client.succeed("labgrid-client resources")
+
+      with subtest("Create place"):
+          client.succeed("labgrid-client -p testplace create")
+          out = client.succeed("labgrid-client places")
+          assert_contains(out, "testplace")
+          # Give the coordinator enough time to persist place creation
+          coordinator.wait_until_succeeds("grep -q testplace /var/lib/labgrid-coordinator/places.yaml")
+
+      with subtest("Test coordinator persistence"):
+          coordinator.shutdown()
+          coordinator.start()
+          coordinator.wait_for_unit("labgrid-coordinator.service")
+          coordinator.wait_for_open_port(20408)
+          out = client.succeed("labgrid-client places")
+          assert_contains(out, "testplace")
+
+      with subtest("Check systemd hardening does not degrade unnoticed"):
+          exact_threshold = 11
+          out = coordinator.fail(f"systemd-analyze security labgrid-coordinator.service --threshold={exact_threshold-1}")
+          out = coordinator.succeed(f"systemd-analyze security labgrid-coordinator.service --threshold={exact_threshold}")
+    '';
+}

nixos/tests/librechat.nix

@@ -17,6 +17,7 @@
       credsIvFile = pkgs.writeText "librechat-creds-iv" "7c09a571f65ac793611685cc9ab1dbe7";
       jwtSecret = pkgs.writeText "librechat-jwt-secret" "29c4dc7f7de15306accf5eddb4cb8a70eb233d9fba4301f8f47f14c8c047ac81";
       jwtRefreshSecret = pkgs.writeText "librechat-jwt-refresh-secret" "f2c1685561f2f570b3e7955df267b5c602ee099f14dc5caa0dacc320580ea180";
+      meilisearchMasterKeyFile = pkgs.writeText "meilisearch-master-key" "xHkP3Bzcf98fw7FiSCR82g5ULLGrXc4frK1qkEfN8St/3kJZ";
     in
     {
       services.librechat = {
@@ -32,13 +33,19 @@
           JWT_REFRESH_SECRET = jwtRefreshSecret;
         };
         enableLocalDB = true;
+        meilisearch.enable = true;
       };
+
+      services.meilisearch.masterKeyFile = meilisearchMasterKeyFile;
     };
 
   testScript = ''
     machine.start()
 
     machine.succeed("grep -qF 'ALLOW_REGISTRATION=true' /etc/systemd/system/librechat.service")
+    machine.succeed("grep -qF 'SEARCH=true' /etc/systemd/system/librechat.service")
+    machine.succeed("grep -qF 'MEILI_HOST=http://localhost:7700' /etc/systemd/system/librechat.service")
+    machine.succeed("grep -qG 'MEILI_MASTER_KEY_FILE:/nix/store/.*meilisearch-master-key' /etc/systemd/system/librechat.service")
 
     machine.wait_for_unit("librechat.service")
     machine.wait_for_open_port(3080)

nixos/tests/shadowsocks/common.nix

@@ -1,11 +1,13 @@
 {
   name,
+  package,
   plugin ? null,
   pluginOpts ? "",
 }:
 
 import ../make-test-python.nix (
   { pkgs, lib, ... }:
+
   {
     inherit name;
     meta = {
@@ -27,9 +29,10 @@ import ../make-test-python.nix (
         networking.firewall.allowedUDPPorts = [ 8488 ];
         services.shadowsocks = {
           enable = true;
+          package = package;
           encryptionMethod = "chacha20-ietf-poly1305";
           password = "pa$$w0rd";
-          localAddress = [ "0.0.0.0" ];
+          localAddress = "0.0.0.0";
           port = 8488;
           fastOpen = false;
           mode = "tcp_and_udp";
@@ -78,7 +81,7 @@ import ../make-test-python.nix (
     testScript = ''
       start_all()
 
-      server.wait_for_unit("shadowsocks-libev.service")
+      server.wait_for_unit("${lib.getName package}.service")
       server.wait_for_unit("nginx.service")
       client.wait_for_unit("shadowsocks-client.service")
 

nixos/tests/shadowsocks/default.nix

@@ -5,12 +5,26 @@
 }:
 
 {
-  "basic" = import ./common.nix {
-    name = "basic";
+  "basic-libev" = import ./common.nix {
+    name = "basic-libev";
+    package = pkgs.shadowsocks-libev;
   };
 
-  "v2ray-plugin" = import ./common.nix {
-    name = "v2ray-plugin";
+  "basic-rust" = import ./common.nix {
+    name = "basic-rust";
+    package = pkgs.shadowsocks-rust;
+  };
+
+  "v2ray-plugin-libev" = import ./common.nix {
+    name = "v2ray-plugin-libev";
+    package = pkgs.shadowsocks-libev;
+    plugin = "${pkgs.shadowsocks-v2ray-plugin}/bin/v2ray-plugin";
+    pluginOpts = "host=nixos.org";
+  };
+
+  "v2ray-plugin-rust" = import ./common.nix {
+    name = "v2ray-plugin-rust";
+    package = pkgs.shadowsocks-rust;
     plugin = "${pkgs.shadowsocks-v2ray-plugin}/bin/v2ray-plugin";
     pluginOpts = "host=nixos.org";
   };

nixos/tests/speedtest-tracker.nix

@@ -0,0 +1,33 @@
+{ lib, pkgs, ... }:
+
+let
+  app-key = "base64:VGVzdFRlc3RUZXN0VGVzdFRlc3RUZXN0VGVzdFRlc3Q=";
+in
+{
+  name = "speedtest-tracker";
+  meta = {
+    maintainers = pkgs.speedtest-tracker.meta.maintainers;
+    platforms = lib.platforms.linux;
+  };
+
+  nodes.sqlite = {
+    environment.etc."speedtest-tracker-appkey".text = app-key;
+    services.speedtest-tracker = {
+      enable = true;
+      enableNginx = true;
+      settings = {
+        APP_KEY_FILE = "/etc/speedtest-tracker-appkey";
+      };
+    };
+  };
+
+  testScript = ''
+    sqlite.wait_for_unit("phpfpm-speedtest-tracker.service")
+    sqlite.wait_for_unit("nginx.service")
+    sqlite.wait_for_unit("speedtest-tracker-queue-worker.service")
+
+    sqlite.succeed("curl -Ls -o /dev/null -w '%{http_code}' http://localhost/admin/login | grep '200'")
+    sqlite.succeed("curl -Ls http://localhost/admin/login | grep -i 'login'")
+    sqlite.succeed("systemctl start speedtest-tracker-scheduler.service")
+  '';
+}

pkgs/applications/audio/espeak/edit.nix

@@ -5,7 +5,7 @@
   pkg-config,
   unzip,
   portaudio,
-  wxGTK32,
+  wxwidgets_3_2,
   sox,
 }:
 
@@ -24,7 +24,7 @@ stdenv.mkDerivation (finalAttrs: {
   ];
   buildInputs = [
     portaudio
-    wxGTK32
+    wxwidgets_3_2
   ];
 
   # TODO:

pkgs/applications/audio/reaper/default.nix

@@ -17,6 +17,7 @@
   xdg-utils,
   xdotool,
   which,
+  openssl,
 
   jackSupport ? stdenv.hostPlatform.isLinux,
   jackLibrary,
@@ -59,7 +60,7 @@ stdenv.mkDerivation (finalAttrs: {
   ++ lib.optionals stdenv.hostPlatform.isLinux [
     which
     autoPatchelfHook
-    xdg-utils # Required for desktop integration
+    xdg-utils # Required for install script
   ]
   ++ lib.optionals stdenv.hostPlatform.isDarwin [
     undmg
@@ -112,6 +113,7 @@ stdenv.mkDerivation (finalAttrs: {
         # We opt for wrapping the executable with LD_LIBRARY_PATH prefix.
         # Note that libcurl and libxml2_13 are needed for ReaPack to run.
         wrapProgram $out/opt/REAPER/reaper \
+          --prefix PATH : "${lib.makeBinPath [ xdg-utils ]}" \
           --prefix LD_LIBRARY_PATH : "${
             lib.makeLibraryPath [
               curl
@@ -121,6 +123,7 @@ stdenv.mkDerivation (finalAttrs: {
               vlc
               xdotool
               stdenv.cc.cc
+              openssl
             ]
           }"
 

pkgs/applications/blockchains/gridcoin-research/default.nix

@@ -16,6 +16,7 @@
   libtool,
   miniupnpc,
   hexdump,
+  fetchpatch2,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
@@ -29,6 +30,13 @@ stdenv.mkDerivation (finalAttrs: {
     hash = "sha256-nupZB4nNbitpf5EBCNy0e+ovjayAszup/r7qxbxA5jI=";
   };
 
+  patches = [
+    (fetchpatch2 {
+      url = "https://github.com/gridcoin-community/Gridcoin-Research/commit/bab91e95ca8c83f06dcc505e6b3f8b44dc6d50d4.patch";
+      sha256 = "sha256-GzurVlR7Tk3pmQfgO9WtHXjX6xHqNzdYqOdbJND7MpA=";
+    })
+  ];
+
   nativeBuildInputs = [
     pkg-config
     wrapQtAppsHook

pkgs/applications/editors/vim/common.nix

@@ -1,6 +1,6 @@
 { lib, fetchFromGitHub }:
 rec {
-  version = "9.1.2148";
+  version = "9.2.0106";
 
   outputs = [
     "out"
@@ -11,7 +11,7 @@ rec {
     owner = "vim";
     repo = "vim";
     rev = "v${version}";
-    hash = "sha256-4ZEbfpffPp6kqSQRp7NFioWGRdG+JsVf7unU0Hqn/Xk=";
+    hash = "sha256-byOf2Gr1vA7xQw3YHV454te1QrVxRy3sXrLdFUp2XRg=";
   };
 
   enableParallelBuilding = true;

pkgs/applications/editors/vscode/extensions/amazonwebservices.amazon-q-vscode/default.nix

@@ -7,8 +7,8 @@ vscode-utils.buildVscodeMarketplaceExtension (finalAttrs: {
   mktplcRef = {
     name = "amazon-q-vscode";
     publisher = "AmazonWebServices";
-    version = "1.109.0";
-    hash = "sha256-y7iUWFKYTLZVS9Zjoy9NtqtgfQTJLWij9JD20pjyTXY=";
+    version = "1.111.0";
+    hash = "sha256-f4GVY3vL7ienn/pWzcbXcDHNHCrPPmFWeVpVDVVNF5c=";
   };
 
   meta = {

pkgs/applications/editors/vscode/extensions/anthropic.claude-code/default.nix

@@ -8,8 +8,8 @@ vscode-utils.buildVscodeMarketplaceExtension {
   mktplcRef = {
     name = "claude-code";
     publisher = "anthropic";
-    version = "2.1.66";
-    hash = "sha256-+vn4qbv3SCsq8PPv3uBsDx+XfmpbfO3HYgA8f0V1FLU=";
+    version = "2.1.70";
+    hash = "sha256-m9xKwS2g2jwekmoIZl3asrZq+xAZUtw/ThWXLdleWrM=";
   };
 
   postInstall = ''

pkgs/applications/editors/vscode/extensions/default.nix

@@ -1143,8 +1143,8 @@ let
         mktplcRef = {
           publisher = "DanielGavin";
           name = "ols";
-          version = "0.1.45";
-          hash = "sha256-YfaP9QCLW4vZKfMyE/MEqEyiA9M5xlnS5Uxph+RT89s=";
+          version = "0.1.46";
+          hash = "sha256-X2Tp0rsPp0UoKW4Yz7Ht/7b1zO0bL92u6CtyKRy+hDY=";
         };
         meta = {
           description = "Visual Studio Code extension for Odin language";
@@ -1188,8 +1188,8 @@ let
         mktplcRef = {
           name = "dart-code";
           publisher = "dart-code";
-          version = "3.128.0";
-          hash = "sha256-wOK+oQf/GovH9+0rHt67jTtiMPGdmaBxazr1JUnDTD0=";
+          version = "3.130.1";
+          hash = "sha256-qBCE1ior+xNKSAVWGbPGKK6pul22DUZ/movaHx0s/8c=";
         };
 
         meta.license = lib.licenses.mit;
@@ -1330,8 +1330,8 @@ let
         mktplcRef = {
           publisher = "discloud";
           name = "discloud";
-          version = "2.27.15";
-          hash = "sha256-LFZR0AxMC0TKUOKU/Ftz1AkLRazqUptkZQ11NIvv7Hs=";
+          version = "2.28.2";
+          hash = "sha256-zRptDItJuLcHTkKUarpsXlRBa4R84cupKXKtBt5Stmw=";
         };
         meta = {
           changelog = "https://marketplace.visualstudio.com/items/discloud.discloud/changelog";
@@ -1955,8 +1955,8 @@ let
         mktplcRef = {
           publisher = "github";
           name = "vscode-pull-request-github";
-          version = "0.126.0";
-          hash = "sha256-ii29H3IKuJVIB394aup9G82xQ1J7YJzhs8mQH6+rbgI=";
+          version = "0.128.0";
+          hash = "sha256-ujDnHmhMorewvIH+zJXSnUpnMfQNE5XqHA1lnsq22Qk=";
         };
         meta = {
           license = lib.licenses.mit;
@@ -2310,8 +2310,8 @@ let
         mktplcRef = {
           publisher = "intellsmi";
           name = "comment-translate";
-          version = "3.0.0";
-          hash = "sha256-AtM56NkivTK4cGyKBsaZTHYvDwiJb4CrEuiJiw5hTcI=";
+          version = "3.1.0";
+          hash = "sha256-hn3G2arNr3LWMOeMLkRdR/GTWobeczaIzGI59x9/oK8=";
         };
         meta = {
           description = "Visual Studio Code extension to translate the comments for computer language";
@@ -3289,8 +3289,8 @@ let
         mktplcRef = {
           publisher = "ms-vscode";
           name = "cmake-tools";
-          version = "1.21.36";
-          hash = "sha256-IqgYnesIz46WmJ7kR8LYnr2kkD33oiupi7CrcV6rGRg=";
+          version = "1.22.28";
+          hash = "sha256-ZVtVZ53wvFBchXd9wRCxm1NQkkoTn9Yn4vcbY46GQmY=";
         };
         meta.license = lib.licenses.mit;
       };
@@ -4770,8 +4770,8 @@ let
         mktplcRef = {
           name = "emacs-mcx";
           publisher = "tuttieee";
-          version = "0.107.2";
-          hash = "sha256-Id8pKACGLtRXas1Tb2dZrw+ZrZvAQLbWcI3Q1gYpXos=";
+          version = "0.107.5";
+          hash = "sha256-8rsj1a/Tj4QpvGN83F3aMHNQVC/9TE61AFS5KhiIpy8=";
         };
         meta = {
           changelog = "https://github.com/whitphx/vscode-emacs-mcx/blob/main/CHANGELOG.md";

pkgs/applications/editors/vscode/extensions/github.copilot-chat/default.nix

@@ -7,8 +7,8 @@ vscode-utils.buildVscodeMarketplaceExtension {
   mktplcRef = {
     publisher = "github";
     name = "copilot-chat";
-    version = "0.37.6";
-    hash = "sha256-tCrrF2Emr/rNJola58ExWKfLuAyOvPqszPLd5SRVcac=";
+    version = "0.37.9";
+    hash = "sha256-AGfjenshM1yQ/rHDpCbCU2HDSS4cPGIPxe8MQ7O0/Dc=";
   };
 
   meta = {

pkgs/applications/editors/vscode/extensions/leanprover.lean4/default.nix

@@ -7,8 +7,8 @@ vscode-utils.buildVscodeMarketplaceExtension {
   mktplcRef = {
     name = "lean4";
     publisher = "leanprover";
-    version = "0.0.223";
-    hash = "sha256-afdbAEQSWt4WeCISdtsuGN8GMjSSSpCuED6L/Oluso0=";
+    version = "0.0.225";
+    hash = "sha256-JVsOHO2r7YHC4QxvpjoIgT5rZhW2SS24xu3TMnoRQi8=";
   };
 
   meta = {

pkgs/applications/editors/vscode/extensions/pkief.material-icon-theme/default.nix

@@ -6,8 +6,8 @@ vscode-utils.buildVscodeMarketplaceExtension {
   mktplcRef = {
     name = "material-icon-theme";
     publisher = "PKief";
-    version = "5.31.0";
-    hash = "sha256-B2+yaKX/nhBLdeFDffwt4CmeWo+Jr4oMxcWBEaAhRtg=";
+    version = "5.32.0";
+    hash = "sha256-0YR3IeVxD7OuYfybDHBdgjQXH0bxz3U9Q8/gQZZB7sM=";
   };
   meta = {
     description = "Material Design Icons for Visual Studio Code";

pkgs/applications/misc/opencpn/default.nix

@@ -42,7 +42,7 @@
   sqlite,
   tinyxml,
   util-linux,
-  wxGTK32,
+  wxwidgets_3_2,
   libxtst,
   libxdmcp,
   xz,
@@ -112,7 +112,7 @@ stdenv.mkDerivation (finalAttrs: {
     rapidjson
     sqlite
     tinyxml
-    wxGTK32
+    wxwidgets_3_2
     xz
   ]
   ++ lib.optionals stdenv.hostPlatform.isLinux [

pkgs/applications/networking/cluster/terraform-providers/providers.json

@@ -27,13 +27,13 @@
     "vendorHash": null
   },
   "aiven_aiven": {
-    "hash": "sha256-lNDorhkIngyZ8S51lyuI3LRtnFtzVG01Nzo1vRPytbQ=",
+    "hash": "sha256-2kv5cBEogQXmWcN/fzg0Rxf/SuqLpeOr8O2NoOg57+c=",
     "homepage": "https://registry.terraform.io/providers/aiven/aiven",
     "owner": "aiven",
     "repo": "terraform-provider-aiven",
-    "rev": "v4.51.0",
+    "rev": "v4.52.0",
     "spdx": "MIT",
-    "vendorHash": "sha256-c4eCY/iQ8v/gBX55j22TRxWIeoevi5EJs4TtN9xXfKA="
+    "vendorHash": "sha256-mUBHjGpDE7aFiyUovi7/doOrrZelmNJC+QYF5+2dxt0="
   },
   "akamai_akamai": {
     "hash": "sha256-vC7hVV/p28y7cv9PONEfRVj5uKgumtbq4HpbOYq9vBQ=",
@@ -63,14 +63,14 @@
     "vendorHash": "sha256-AO6reoqxDcPAMXKlqjJLGmhsgFrekaQXjMPm9fxhpFA="
   },
   "argoproj-labs_argocd": {
-    "hash": "sha256-2QatWxaR5lO4+0RxUMOQjyLp8XG6O0vwCYc8jHKL+48=",
+    "hash": "sha256-OhuU3XGFRRn6oBiGaT4eRUB3+Lew1PonsshBXMcMA5k=",
     "homepage": "https://registry.terraform.io/providers/argoproj-labs/argocd",
     "owner": "argoproj-labs",
     "proxyVendor": true,
     "repo": "terraform-provider-argocd",
-    "rev": "v7.13.0",
+    "rev": "v7.15.0",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-OBXAl3MRAtnYYATHD0UWEuB1dJozG7al9csGYLClaYw="
+    "vendorHash": "sha256-CO09y7rdbY27VFX85pV2ocnO0rvhGJg3hXfLWaF+HTI="
   },
   "auth0_auth0": {
     "hash": "sha256-7xAQGsDkw0JYP1Q+cEMHezNmQzccRyiwtUXKgJfnI6k=",
@@ -391,11 +391,11 @@
     "vendorHash": null
   },
   "f5networks_bigip": {
-    "hash": "sha256-V+CA+8nICGzj0etByXZzaO/GMIFGA0fzG0PW1FH7Qxw=",
+    "hash": "sha256-aUf9eRpfxzdpz6Lv36xWxSW++tSMxYvqy9xtkko/bfc=",
     "homepage": "https://registry.terraform.io/providers/F5Networks/bigip",
     "owner": "F5Networks",
     "repo": "terraform-provider-bigip",
-    "rev": "v1.24.2",
+    "rev": "v1.25.0",
     "spdx": "MPL-2.0",
     "vendorHash": null
   },
@@ -580,13 +580,13 @@
     "vendorHash": "sha256-v/XHGUEpAIpGHErv7GPqfosVLL3xaqBwZHbJKS8fkn4="
   },
   "hashicorp_google-beta": {
-    "hash": "sha256-ypC8av5GnFBlUp2eVDZWqnPGrZT8QihYnxsIHw8g+oA=",
+    "hash": "sha256-wIAgFDHBVErm2NMiQszhnwJ6nWJA4qqDY/a6JdUrmyA=",
     "homepage": "https://registry.terraform.io/providers/hashicorp/google-beta",
     "owner": "hashicorp",
     "repo": "terraform-provider-google-beta",
-    "rev": "v7.21.0",
+    "rev": "v7.22.0",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-KnB6R5yrEeaf4Z+LzQjCeQJjAgHK0kJEJzT1rb3pimY="
+    "vendorHash": "sha256-YZQMUGScsYjBkhAQ4DXYlBpAw805iKgX/iXDMTpRr6c="
   },
   "hashicorp_helm": {
     "hash": "sha256-S4Fe65f+gEWWxRMC+/i93dwwe7QigPccx4wiqNBpcL8=",
@@ -652,11 +652,11 @@
     "vendorHash": "sha256-GlkqFg9Bgs+Hi59PYAxqq3YW9ji1qeuX4vz59wQ4pRw="
   },
   "hashicorp_tfe": {
-    "hash": "sha256-+FIiatVTff/MNk1Ik0vZDii7yjeWQLO5BLqSrs2bGME=",
+    "hash": "sha256-dak9/lYjL+2gbXyjxRqS61wr4YJRHFzHNJdCPJqiaW4=",
     "homepage": "https://registry.terraform.io/providers/hashicorp/tfe",
     "owner": "hashicorp",
     "repo": "terraform-provider-tfe",
-    "rev": "v0.74.0",
+    "rev": "v0.74.1",
     "spdx": "MPL-2.0",
     "vendorHash": "sha256-GAwAGw8N4B/jCtcR2ok3g/0j//CHK9yPaBj+otJLjKc="
   },
@@ -1247,11 +1247,11 @@
     "vendorHash": "sha256-EOr4Ps0IYYOtRq19tt87NFfCEvJTaFBGb5B4mKMll7c="
   },
   "spotinst_spotinst": {
-    "hash": "sha256-yDwEtptwNXu/IpoKUK98UkpivTgJaY1FfsshsVpaaOk=",
+    "hash": "sha256-dZStuj7YjSF9X5/AEkrZyqDT2l2orpV4jY6CJrXjOgA=",
     "homepage": "https://registry.terraform.io/providers/spotinst/spotinst",
     "owner": "spotinst",
     "repo": "terraform-provider-spotinst",
-    "rev": "v1.232.4",
+    "rev": "v1.232.5",
     "spdx": "MPL-2.0",
     "vendorHash": "sha256-Cj7RVITkFxIjAZAqHFhnoTa4lTZFXG22ny801g0Y+NE="
   },
@@ -1400,13 +1400,13 @@
     "vendorHash": null
   },
   "ubiquiti-community_unifi": {
-    "hash": "sha256-8mbQpDqs+2vvzmapJmusipo3IbUwyFlLPY3GkwORXpI=",
+    "hash": "sha256-2IYiy/DLCj+bcEkU+nwLg7Wt2j7bh29cScPcSTGsU5A=",
     "homepage": "https://registry.terraform.io/providers/ubiquiti-community/unifi",
     "owner": "ubiquiti-community",
     "repo": "terraform-provider-unifi",
-    "rev": "v0.41.13",
+    "rev": "v0.41.17",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-kEUmuXSNFFBUlFp7tqa00H+M/NTDSd6j6liFTH6PUVw="
+    "vendorHash": "sha256-rixXMK+M6/8g4cw/f+zNzY9x3GkA3nqmkQTPrONoueY="
   },
   "ucloud_ucloud": {
     "hash": "sha256-UOVnfWYhntmRHMApQgemjUBsyUIz0bexsc1gwDGGee4=",
@@ -1418,13 +1418,13 @@
     "vendorHash": null
   },
   "vancluever_acme": {
-    "hash": "sha256-uRIOLFIzT4hIXMtoyHk0UB5R5xGr0DELF5hd+E5Xx1k=",
+    "hash": "sha256-R0tbT4DBzRkXiJdvGL3AOY9ALXwWIH90WaWbqe8xtkk=",
     "homepage": "https://registry.terraform.io/providers/vancluever/acme",
     "owner": "vancluever",
     "repo": "terraform-provider-acme",
-    "rev": "v2.45.0",
+    "rev": "v2.45.1",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-S8eG43mHNyPOm2Iuww9DjU7o/x2MMSJExpmBAQ8QDGY="
+    "vendorHash": "sha256-PN9r9rTJChmhZd/l5BrsEMGfhzHNbcRhjtEoYJ+Vzuc="
   },
   "venafi_venafi": {
     "hash": "sha256-wpAckNRqZjSDt7KpCRpLSYkn6Gm+QPzn5sIJ90wRXjI=",

pkgs/applications/radio/limesuite/default.nix

@@ -5,7 +5,7 @@
   fetchpatch,
   cmake,
   sqlite,
-  wxGTK32,
+  wxwidgets_3_2,
   libusb1,
   soapysdr,
   mesa_glu,
@@ -57,7 +57,7 @@ stdenv.mkDerivation rec {
     fltk
     libx11
     mesa_glu
-    wxGTK32
+    wxwidgets_3_2
   ];
 
   doInstallCheck = true;

pkgs/build-support/testers/lychee.nix

@@ -1,4 +1,5 @@
 deps@{
+  cacert,
   formats,
   lib,
   lychee,
@@ -40,7 +41,10 @@ let
     stdenv.mkDerivation (finalAttrs: {
       name = "lychee-link-check";
       inherit site;
-      nativeBuildInputs = [ finalAttrs.passthru.lychee ];
+      nativeBuildInputs = [
+        finalAttrs.passthru.lychee
+        cacert
+      ];
       configFile = (formats.toml { }).generate "lychee.toml" finalAttrs.passthru.config;
 
       # These can be overridden with overrideAttrs if needed.

pkgs/build-support/trivial-builders/default.nix

@@ -935,67 +935,93 @@ rec {
 
   # Docs in doc/build-helpers/fetchers.chapter.md
   # See https://nixos.org/manual/nixpkgs/unstable/#requirefile
-  requireFile =
-    {
-      name ? null,
-      sha256 ? null,
-      sha1 ? null,
-      hash ? null,
-      url ? null,
-      message ? null,
-      hashMode ? "flat",
-    }:
-    assert (message != null) || (url != null);
-    assert (sha256 != null) || (sha1 != null) || (hash != null);
-    assert (name != null) || (url != null);
-    let
-      msg =
-        if message != null then
-          message
-        else
-          ''
-            Unfortunately, we cannot download file ${name_} automatically.
-            Please go to ${url} to download it yourself, and add it to the Nix store
-            using either
-              nix-store --add-fixed ${hashAlgo} ${name_}
-            or
-              nix-prefetch-url --type ${hashAlgo} file:///path/to/${name_}
-          '';
-      hashAlgo =
-        if hash != null then
-          (builtins.head (lib.strings.splitString "-" hash))
-        else if sha256 != null then
-          "sha256"
-        else
-          "sha1";
-      hashAlgo_ = if hash != null then "" else hashAlgo;
-      hash_ =
-        if hash != null then
-          hash
-        else if sha256 != null then
-          sha256
-        else
-          sha1;
-      name_ = if name == null then baseNameOf (toString url) else name;
-    in
-    stdenvNoCC.mkDerivation {
-      name = name_;
-      outputHashMode = hashMode;
-      outputHashAlgo = hashAlgo_;
-      outputHash = hash_;
-      preferLocalBuild = true;
-      builder = writeScript "restrict-message" ''
-        source ${stdenvNoCC}/setup
-        cat <<_EOF_
+  requireFile = lib.extendMkDerivation {
+    constructDrv = stdenv.mkDerivation;
 
-        ***
-        ${msg}
-        ***
+    excludeDrvArgNames = [
+      "hash"
+      "hashMode"
+      "message"
+      "sha1"
+      "sha256"
+      "url"
+    ];
 
-        _EOF_
-        exit 1
-      '';
-    };
+    extendDrvArgs =
+      finalAttrs:
+      {
+        name ? null,
+        sha256 ? null,
+        sha1 ? null,
+        hash ? null,
+        url ? null,
+        message ? null,
+        hashMode ? "flat",
+      }@args:
+      assert (message != null) || (url != null);
+      assert (sha256 != null) || (sha1 != null) || (hash != null);
+      assert (name != null) || (url != null);
+      let
+        msg =
+          if message != null then
+            message
+          else
+            ''
+              Unfortunately, we cannot download file ${name_} automatically.
+              Please go to ${url} to download it yourself, and add it to the Nix store
+              using either
+                nix-store --add-fixed ${hashAlgo} ${name_}
+              or
+                nix-prefetch-url --type ${hashAlgo} file:///path/to/${name_}
+            '';
+        hashAlgo =
+          if hash != null then
+            (builtins.head (lib.strings.splitString "-" hash))
+          else if sha256 != null then
+            "sha256"
+          else
+            "sha1";
+        hashAlgo_ = if hash != null then "" else hashAlgo;
+        hash_ =
+          if hash != null then
+            hash
+          else if sha256 != null then
+            sha256
+          else
+            sha1;
+        name_ = if name == null then baseNameOf (toString url) else name;
+      in
+      {
+        outputHashMode = hashMode;
+        outputHashAlgo = hashAlgo_;
+        outputHash = hash_;
+        preferLocalBuild = true;
+        builder = writeScript "restrict-message" ''
+          source ${stdenvNoCC}/setup
+          cat <<_EOF_
+
+          ***
+          ${msg}
+          ***
+
+          _EOF_
+          exit 1
+        '';
+      }
+      // (lib.optionalAttrs (name == null) {
+        # The case of providing `url`, but not `name`. This has
+        # weird interactions with the positioning system
+
+        # When we set `name` explicitly here, we override where the
+        # position is read from. So we must fix it here.
+        pos = lib.unsafeGetAttrPos "url" args;
+
+        # If a name is not provided, use the basename of the url
+        name = builtins.warn "providing a URL without a name is deprecated" baseNameOf (toString url);
+      });
+
+    inheritFunctionArgs = false;
+  };
 
   # TODO: move copyPathToStore docs to the Nixpkgs manual
   /*

pkgs/by-name/ae/aegisub/package.nix

@@ -28,7 +28,7 @@
   python3,
   stdenv,
   wrapGAppsHook3,
-  wxGTK32,
+  wxwidgets_3_2,
   zlib,
   # Boolean guard flags
   alsaSupport ? stdenv.hostPlatform.isLinux,
@@ -60,7 +60,7 @@ stdenv.mkDerivation (finalAttrs: {
     ninja
     pkg-config
     python3
-    wxGTK32
+    wxwidgets_3_2
     wrapGAppsHook3
   ];
 
@@ -78,7 +78,7 @@ stdenv.mkDerivation (finalAttrs: {
     libGL
     libass
     libuchardet
-    wxGTK32
+    wxwidgets_3_2
     zlib
   ]
   ++ lib.optionals alsaSupport [ alsa-lib ]

pkgs/by-name/am/amdgpu_top/package.nix

@@ -14,14 +14,14 @@
   nix-update-script,
 }:
 
-rustPlatform.buildRustPackage rec {
+rustPlatform.buildRustPackage (finalAttrs: {
   pname = "amdgpu_top";
   version = "0.11.2";
 
   src = fetchFromGitHub {
     owner = "Umio-Yasuno";
     repo = "amdgpu_top";
-    tag = "v${version}";
+    tag = "v${finalAttrs.version}";
     hash = "sha256-yw73bKO91O05WBQNwjcQ+AqxYgGXXC7XJzUnMx5/IWc=";
   };
 
@@ -45,7 +45,7 @@ rustPlatform.buildRustPackage rec {
   '';
 
   postFixup = ''
-    patchelf --set-rpath "${lib.makeLibraryPath buildInputs}" $out/bin/${pname}
+    patchelf --set-rpath "${lib.makeLibraryPath finalAttrs.buildInputs}" $out/bin/${finalAttrs.meta.mainProgram}
   '';
 
   passthru.updateScript = nix-update-script { };
@@ -62,4 +62,4 @@ rustPlatform.buildRustPackage rec {
     platforms = lib.platforms.linux;
     mainProgram = "amdgpu_top";
   };
-}
+})

pkgs/by-name/am/amule/package.nix

@@ -10,7 +10,7 @@
   lib,
   cmake,
   zlib,
-  wxGTK32,
+  wxwidgets_3_2,
   perl,
   cryptopp,
   libupnp,
@@ -56,7 +56,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   buildInputs = [
     zlib
-    wxGTK32
+    wxwidgets_3_2
     perl
     cryptopp.dev
     libupnp

pkgs/by-name/an/andcli/package.nix

@@ -8,7 +8,7 @@
 
 buildGoModule (finalAttrs: {
   pname = "andcli";
-  version = "2.5.0";
+  version = "2.6.0";
 
   subPackages = [ "cmd/andcli" ];
 
@@ -16,10 +16,10 @@ buildGoModule (finalAttrs: {
     owner = "tjblackheart";
     repo = "andcli";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-TrcLw5pUMzyXUuMyQljVXbprS2voqvmVk6Ktj6Zi7Xk=";
+    hash = "sha256-iJSeUMELbyuL8h/8dfWVA5jDW3XpXG6y1mCkWRF1Kpo=";
   };
 
-  vendorHash = "sha256-jtyxzmDGm/JHTJAkCHfSfECNB5XkwEyTBWnMCbCOAvE=";
+  vendorHash = "sha256-ZfU8Sf9M2dz9aIhwiK58zGIrcpmaw8wMAdcpxxvkUsQ=";
 
   ldflags = [
     "-s"

pkgs/by-name/an/ansi/package.nix

@@ -4,12 +4,12 @@
   rustPlatform,
 }:
 
-rustPlatform.buildRustPackage rec {
+rustPlatform.buildRustPackage (finalAttrs: {
   pname = "ansi-escape-sequences-cli";
   version = "0.2.2";
 
   src = fetchCrate {
-    inherit pname version;
+    inherit (finalAttrs) pname version;
     hash = "sha256-55CdEw1bVgabWRbZIRe9jytwDf70Y92nITwDRQaTXaQ=";
   };
 
@@ -26,4 +26,4 @@ rustPlatform.buildRustPackage rec {
     maintainers = with lib.maintainers; [ phip1611 ];
     mainProgram = "ansi";
   };
-}
+})

pkgs/by-name/ap/apk-tools/package.nix

@@ -3,6 +3,10 @@
   stdenv,
   fetchFromGitLab,
   pkg-config,
+  meson,
+  ninja,
+  python3,
+  cmocka,
   scdoc,
   openssl,
   zlib,
@@ -11,49 +15,43 @@
   lua5_3,
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "apk-tools";
-  version = "3.0.3";
+  version = "3.0.4";
 
   src = fetchFromGitLab {
     domain = "gitlab.alpinelinux.org";
     owner = "alpine";
     repo = "apk-tools";
-    rev = "v${version}";
-    sha256 = "sha256-ydqJiLkz80TQGyf9m/l8HSXfoTAvi0av7LHETk1c0GI=";
+    rev = "v${finalAttrs.version}";
+    sha256 = "sha256-51lBWcUSILCJZNP6LaOGyERCosNWTuEne/+xX8xHLf0=";
   };
 
   nativeBuildInputs = [
+    meson
+    ninja
     pkg-config
-    scdoc
+    python3
   ]
   ++ lib.optionals luaSupport [
     lua5_3
     lua5_3.pkgs.lua-zlib
   ];
+
   buildInputs = [
     openssl
     zlib
     zstd
+    scdoc
+    cmocka
   ]
   ++ lib.optional luaSupport lua5_3;
+
   strictDeps = true;
 
-  makeFlags = [
-    "CROSS_COMPILE=${stdenv.cc.targetPrefix}"
-    "SBINDIR=$(out)/bin"
-    "LIBDIR=$(out)/lib"
-    "LUA=${if luaSupport then "lua" else "no"}"
-    "LUA_LIBDIR=$(out)/lib/lua/${lib.versions.majorMinor lua5_3.version}"
-    "MANDIR=$(out)/share/man"
-    "DOCDIR=$(out)/share/doc/apk"
-    "INCLUDEDIR=$(out)/include"
-    "PKGCONFIGDIR=$(out)/lib/pkgconfig"
-  ];
-
-  env.NIX_CFLAGS_COMPILE = toString [
-    "-Wno-error=unused-result"
-    "-Wno-error=deprecated-declarations"
+  mesonFlags = [
+    (lib.mesonEnable "lua" luaSupport)
+    (lib.mesonOption "lua_bin" "lua")
   ];
 
   enableParallelBuilding = true;
@@ -63,7 +61,6 @@ stdenv.mkDerivation rec {
     description = "Alpine Package Keeper";
     maintainers = [ ];
     license = lib.licenses.gpl2Only;
-    platforms = lib.platforms.linux;
     mainProgram = "apk";
   };
-}
+})

pkgs/by-name/ap/apkeep/package.nix

@@ -6,12 +6,12 @@
   pkg-config,
 }:
 
-rustPlatform.buildRustPackage rec {
+rustPlatform.buildRustPackage (finalAttrs: {
   pname = "apkeep";
   version = "0.18.0";
 
   src = fetchCrate {
-    inherit pname version;
+    inherit (finalAttrs) pname version;
     hash = "sha256-Sk8CQaMXtPPJh2nGgGthyzuvkVViQ0jtqPjAqo2dtpg=";
   };
 
@@ -32,9 +32,9 @@ rustPlatform.buildRustPackage rec {
   meta = {
     description = "Command-line tool for downloading APK files from various sources";
     homepage = "https://github.com/EFForg/apkeep";
-    changelog = "https://github.com/EFForg/apkeep/blob/${version}/CHANGELOG.md";
+    changelog = "https://github.com/EFForg/apkeep/blob/${finalAttrs.version}/CHANGELOG.md";
     license = lib.licenses.mit;
     maintainers = [ ];
     mainProgram = "apkeep";
   };
-}
+})

pkgs/by-name/ap/app2unit/package.nix

@@ -2,10 +2,12 @@
   lib,
   stdenvNoCC,
   dash,
+  xdg-terminal-exec,
   scdoc,
   fetchFromGitHub,
   nix-update-script,
   installShellFiles,
+  withTerminalSupport ? true,
 }:
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "app2unit";
@@ -49,6 +51,11 @@ stdenvNoCC.mkDerivation (finalAttrs: {
   postFixup = ''
     substituteInPlace $out/bin/app2unit \
       --replace-fail '#!/bin/sh' '#!${lib.getExe dash}'
+  ''
+  + lib.optionalString withTerminalSupport ''
+    substituteInPlace $out/bin/app2unit \
+      --replace-fail 'A2U__TERMINAL_HANDLER=xdg-terminal-exec' \
+                     'A2U__TERMINAL_HANDLER=${lib.getExe xdg-terminal-exec}'
   '';
 
   meta = {

pkgs/by-name/ar/argon/package.nix

@@ -9,16 +9,16 @@
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "argon";
-  version = "2.0.27";
+  version = "2.0.28";
 
   src = fetchFromGitHub {
     owner = "argon-rbx";
     repo = "argon";
     tag = finalAttrs.version;
-    hash = "sha256-AcgaY7XmecqvWan81tVxV6UJ+A38tAYDlvUSLLKlYuU=";
+    hash = "sha256-QXGiDcn5BM1psCZf88gEyKqoK9EDFquLgyzJeZOhwMU=";
   };
 
-  cargoHash = "sha256-0VIPAcCK7+te7TgH/+x0Y7pP0fYWuRT58/h9OIva0mQ=";
+  cargoHash = "sha256-okfQn/dgBN6s1aO1cnU/bY7BIqwM9iq1iPZ321ez4C4=";
 
   nativeBuildInputs = [ pkg-config ];
 

pkgs/by-name/as/asahi-bless/package.nix

@@ -4,17 +4,17 @@
   rustPlatform,
 }:
 
-rustPlatform.buildRustPackage rec {
+rustPlatform.buildRustPackage (finalAttrs: {
   pname = "asahi-bless";
   version = "0.4.1";
 
   src = fetchCrate {
-    inherit pname version;
+    inherit (finalAttrs) pname version;
     hash = "sha256-SNaA+CEuCBwo4c54qWGs5AdkBYb9IWY1cQ0dRd/noe8=";
   };
 
   cargoHash = "sha256-nfSJ9RkzFAWlxlfoUKk8ZmIXDJXoSyHCGgRgMy9FDkw=";
-  cargoDepsName = pname;
+  cargoDepsName = finalAttrs.pname;
 
   meta = {
     description = "Tool to select active boot partition on ARM Macs";
@@ -24,4 +24,4 @@ rustPlatform.buildRustPackage rec {
     mainProgram = "asahi-bless";
     platforms = lib.platforms.linux;
   };
-}
+})

pkgs/by-name/as/asahi-btsync/package.nix

@@ -4,17 +4,17 @@
   rustPlatform,
 }:
 
-rustPlatform.buildRustPackage rec {
+rustPlatform.buildRustPackage (finalAttrs: {
   pname = "asahi-btsync";
   version = "0.2.0";
 
   src = fetchCrate {
-    inherit pname version;
+    inherit (finalAttrs) pname version;
     hash = "sha256-jp05WcwY1cWh4mBQj+3jRCZoG32OhDvTB84hOAGemX8=";
   };
 
   cargoHash = "sha256-gGWhi0T7xDIsbzfw/KL3TSneLvQaiz/2xbpHeZt1i3I=";
-  cargoDepsName = pname;
+  cargoDepsName = finalAttrs.pname;
 
   meta = {
     description = "Tool to sync Bluetooth pairing keys with macos on ARM Macs";
@@ -24,4 +24,4 @@ rustPlatform.buildRustPackage rec {
     mainProgram = "asahi-btsync";
     platforms = lib.platforms.linux;
   };
-}
+})

pkgs/by-name/as/asahi-nvram/package.nix

@@ -4,17 +4,17 @@
   rustPlatform,
 }:
 
-rustPlatform.buildRustPackage rec {
+rustPlatform.buildRustPackage (finalAttrs: {
   pname = "asahi-nvram";
   version = "0.2.3";
 
   src = fetchCrate {
-    inherit pname version;
+    inherit (finalAttrs) pname version;
     hash = "sha256-zfUvPHAPrYhzgeiirGuqZaWnLBH0PHsqOUy2e972bWM=";
   };
 
   cargoHash = "sha256-NW/puo/Xoum7DjSQjBgilQcKbY3mAfVgXxUK6+1H1JI=";
-  cargoDepsName = pname;
+  cargoDepsName = finalAttrs.pname;
 
   meta = {
     description = "Tool to read and write nvram variables on ARM Macs";
@@ -24,4 +24,4 @@ rustPlatform.buildRustPackage rec {
     mainProgram = "asahi-nvram";
     platforms = lib.platforms.linux;
   };
-}
+})

pkgs/by-name/as/asahi-wifisync/package.nix

@@ -4,17 +4,17 @@
   rustPlatform,
 }:
 
-rustPlatform.buildRustPackage rec {
+rustPlatform.buildRustPackage (finalAttrs: {
   pname = "asahi-wifisync";
   version = "0.2.0";
 
   src = fetchCrate {
-    inherit pname version;
+    inherit (finalAttrs) pname version;
     hash = "sha256-wKd6rUUnegvl6cHODVQlllaOXuAGlmwx9gr73I/2l/c=";
   };
 
   cargoHash = "sha256-ZxgRxQyDID3mBpr8dhHScctk14Pm9V51Gn24d24JyVk=";
-  cargoDepsName = pname;
+  cargoDepsName = finalAttrs.pname;
 
   meta = {
     description = "Tool to sync Wifi passwords with macos on ARM Macs";
@@ -24,4 +24,4 @@ rustPlatform.buildRustPackage rec {
     mainProgram = "asahi-wifisync";
     platforms = lib.platforms.linux;
   };
-}
+})

pkgs/by-name/as/asc/package.nix

@@ -12,7 +12,7 @@
   expat,
   freetype,
   libjpeg,
-  wxGTK32,
+  wxwidgets_3_2,
   lua,
   perl,
   pkg-config,
@@ -51,7 +51,7 @@ stdenv.mkDerivation {
     expat
     freetype
     libjpeg
-    wxGTK32
+    wxwidgets_3_2
     lua
     perl
     zlib

pkgs/by-name/as/asciinema-scenario/package.nix

@@ -4,12 +4,12 @@
   fetchCrate,
 }:
 
-rustPlatform.buildRustPackage rec {
+rustPlatform.buildRustPackage (finalAttrs: {
   pname = "asciinema-scenario";
   version = "0.3.0";
 
   src = fetchCrate {
-    inherit pname version;
+    inherit (finalAttrs) pname version;
     hash = "sha256-fnX5CIYLdFqi04PQPVIAYDGn+xXi016l8pPcIrYIhmQ=";
   };
 
@@ -21,4 +21,4 @@ rustPlatform.buildRustPackage rec {
     license = with lib.licenses; [ mit ];
     mainProgram = "asciinema-scenario";
   };
-}
+})

pkgs/by-name/as/ast-grep/package.nix

@@ -11,13 +11,13 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "ast-grep";
-  version = "0.40.5";
+  version = "0.41.0";
 
   src = fetchFromGitHub {
     owner = "ast-grep";
     repo = "ast-grep";
     tag = finalAttrs.version;
-    hash = "sha256-O4f9PjGtwK6poFIbtz26q8q4fiYjfQEtobXmghQZAfw=";
+    hash = "sha256-cL7RtGFhIKTlfP7wEjdjT8uTxB/tG2joob+HN5NG1G8=";
   };
 
   # error: linker `aarch64-linux-gnu-gcc` not found
@@ -25,7 +25,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
     rm .cargo/config.toml
   '';
 
-  cargoHash = "sha256-N5WrItW/yeZ+GDTw5yFy4eB11BzOlcuePGAefhJaG6I=";
+  cargoHash = "sha256-zPl9fUG+RdddB7r4nWHETHsULf/hDDFpTf8h3xe7UiI=";
 
   nativeBuildInputs = [ installShellFiles ];
 

pkgs/by-name/as/asusctl/package.nix

@@ -18,16 +18,16 @@
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "asusctl";
-  version = "6.3.3";
+  version = "6.3.4";
 
   src = fetchFromGitLab {
     owner = "asus-linux";
     repo = "asusctl";
     tag = finalAttrs.version;
-    hash = "sha256-nc6pGxLutxKyd4LiI23e7UfWK45aQiLQRKL6zX7rVO0=";
+    hash = "sha256-1B4uKX8Aqorxh+QMsUEmSnO56zqYhUb6wLMXPAR5HQo=";
   };
 
-  cargoHash = "sha256-LZsSnIGTemu+SvJxszPWkA5EIdu8XzruZXaYIibV31Q=";
+  cargoHash = "sha256-aRsrA1j4nYp2rbQM2FbTfWVDkVfKFFa6L+DtW8mKcmk=";
 
   postPatch = ''
     files="

pkgs/by-name/at/atinout/package.nix

@@ -10,8 +10,13 @@ stdenv.mkDerivation {
   pname = "atinout";
   version = "0.9.2-alpha";
 
-  env.NIX_CFLAGS_COMPILE = lib.optionalString (!stdenv.cc.isClang) "-Werror=implicit-fallthrough=0";
-  LANG = if stdenv.hostPlatform.isDarwin then "en_US.UTF-8" else "C.UTF-8";
+  env = {
+    LANG = if stdenv.hostPlatform.isDarwin then "en_US.UTF-8" else "C.UTF-8";
+  }
+  // lib.optionalAttrs (!stdenv.cc.isClang) {
+    NIX_CFLAGS_COMPILE = "-Werror=implicit-fallthrough=0";
+  };
+
   nativeBuildInputs = [
     ronn
     mount

pkgs/by-name/at/atlauncher/package.nix

@@ -27,13 +27,13 @@ let
 in
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "atlauncher";
-  version = "3.4.40.2";
+  version = "3.4.40.3";
 
   src = fetchFromGitHub {
     owner = "ATLauncher";
     repo = "ATLauncher";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-sV6eWIgx/0e+uUCbbRwAPPqNcFWUQWyuHnzrwcYJkqA=";
+    hash = "sha256-QFPdEH3V9Krwy/cWCbY+IMtW0ydVCqKr/OZfttZGCss=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/au/audacity/package.nix

@@ -49,7 +49,7 @@
   libxkbcommon,
   util-linux,
   wavpack,
-  wxGTK32,
+  wxwidgets_3_2,
   gtk3,
   libpng,
   libjpeg,
@@ -129,7 +129,7 @@ stdenv.mkDerivation (finalAttrs: {
     twolame
     portaudio
     wavpack
-    wxGTK32
+    wxwidgets_3_2
   ]
   ++ lib.optionals stdenv.hostPlatform.isLinux [
     alsa-lib # for portaudio

pkgs/by-name/au/authoscope/package.nix

@@ -10,14 +10,14 @@
   zlib,
 }:
 
-rustPlatform.buildRustPackage rec {
+rustPlatform.buildRustPackage (finalAttrs: {
   pname = "authoscope";
   version = "0.8.1";
 
   src = fetchFromGitHub {
     owner = "kpcyrd";
     repo = "authoscope";
-    tag = "v${version}";
+    tag = "v${finalAttrs.version}";
     hash = "sha256-SKgb/N249s0+Rb59moBT/MeFb4zAAElCMQJto0diyUk=";
   };
 
@@ -35,7 +35,7 @@ rustPlatform.buildRustPackage rec {
   ];
 
   postInstall = ''
-    installManPage docs/${pname}.1
+    installManPage docs/authoscope.1
   '';
 
   # Tests requires access to httpin.org
@@ -46,8 +46,8 @@ rustPlatform.buildRustPackage rec {
   meta = {
     description = "Scriptable network authentication cracker";
     homepage = "https://github.com/kpcyrd/authoscope";
-    changelog = "https://github.com/kpcyrd/authoscope/releases/tag/v${version}";
+    changelog = "https://github.com/kpcyrd/authoscope/releases/tag/v${finalAttrs.version}";
     license = lib.licenses.gpl3Plus;
     maintainers = with lib.maintainers; [ fab ];
   };
-}
+})

pkgs/by-name/aw/aws-vault/package.nix

@@ -10,17 +10,17 @@
 }:
 buildGoModule (finalAttrs: {
   pname = "aws-vault";
-  version = "7.9.8";
+  version = "7.9.9";
 
   src = fetchFromGitHub {
     owner = "ByteNess";
     repo = "aws-vault";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-qbz6iWU6aZ8ehckJqBUy5ovcuHVBU0XqonQxH7m44Zo=";
+    hash = "sha256-Ennf8V1WorldzFfXUrRKmJomG4yrP19qBg0okEX+NWQ=";
   };
 
   proxyVendor = true;
-  vendorHash = "sha256-K6uW+0yoKBDtBtAZIcVcbqnqD6tQJbSvGGs0wL0R+Wg=";
+  vendorHash = "sha256-mqw0Hp14wz2FOg7deXC3iiHu55W+yKwf4+JUK+x9nKA=";
 
   nativeBuildInputs = [
     installShellFiles

pkgs/by-name/ax/ax25-apps/glibc-2.42.patch

@@ -0,0 +1,26 @@
+--- a/ax25ipd/io.c
++++ b/ax25ipd/io.c
+@@ -19,20 +19,21 @@
+ #include <stdlib.h>
+ #include <string.h>
+ #include <syslog.h>
+-#include <termio.h>
++#include <termios.h>
+ #include <time.h>
+ #include <unistd.h>
+ #include <arpa/inet.h>
+ #include <netinet/in.h>
+ #include <netinet/in_systm.h>
+ #include <netinet/ip.h>
++#include <sys/ioctl.h>
+ #include <sys/types.h>
+ #include <sys/time.h>
+ #include <sys/socket.h>
+ 
+ #include "ax25ipd.h"
+ 
+-static struct termio nterm;
++static struct termios nterm;
+ 
+ int ttyfd = -1;
+ static int udpsock = -1;

pkgs/by-name/ax/ax25-apps/package.nix

@@ -29,6 +29,11 @@ stdenv.mkDerivation {
     hash = "sha256-RLeFndis2OhIkJPLD+YfEUrJdZL33huVzlHq+kGq7dA=";
   };
 
+  patches = [
+    # Fix build against glibc-2.42
+    ./glibc-2.42.patch
+  ];
+
   configureFlags = [
     "--sysconfdir=/etc"
     "--localstatedir=/var/lib"

pkgs/by-name/az/azure-cli/extensions-manual.nix

@@ -10,7 +10,7 @@
   python3Packages,
   autoPatchelfHook,
   python3,
-  openssl_1_1,
+  openssl,
 }:
 
 {
@@ -173,16 +173,18 @@
 
   confcom = mkAzExtension rec {
     pname = "confcom";
-    version = "1.2.6";
+    version = "1.8.0";
     url = "https://azcliprod.blob.core.windows.net/cli-extensions/confcom-${version}-py3-none-any.whl";
-    hash = "sha256-kyJ4AkPcpP/10nf4whJiuraC7hn0E6iBkhRIn43E9J0=";
+    hash = "sha256-rKEECrGR4VIKTgPzInGhFrbrXDtYqayAzYWLKclE1tg=";
     description = "Microsoft Azure Command-Line Tools Confidential Container Security Policy Generator Extension";
     nativeBuildInputs = [ autoPatchelfHook ];
-    buildInputs = [ openssl_1_1 ];
+    buildInputs = [ openssl ];
+    pythonRelaxDeps = [ "tqdm" ];
     propagatedBuildInputs = with python3Packages; [
-      pyyaml
       deepdiff
       docker
+      pydantic
+      pyyaml
       tqdm
     ];
     postInstall = ''

pkgs/by-name/az/azure-functions-core-tools/package.nix

@@ -1,46 +1,48 @@
 {
   lib,
   stdenv,
+  fetchurl,
   fetchFromGitHub,
   buildDotnetModule,
-  buildGoModule,
   dotnetCorePackages,
-  versionCheckHook,
+  go,
 }:
 let
-  version = "4.0.7030";
+  version = "4.7.0";
+  templatesVersion = "3.1.1648";
+
   src = fetchFromGitHub {
     owner = "Azure";
     repo = "azure-functions-core-tools";
     tag = version;
-    hash = "sha256-ibbXUg2VHN2yJk6qwLwDbxcO0XArFFb7XMUCfKH0Tkw=";
+    hash = "sha256-2Bs1jxJmZzzShSrUK3XP+cNdXlczPEr6UCnh4oQRaoA=";
   };
-  gozip = buildGoModule {
-    pname = "gozip";
-    inherit version;
-    src = src + "/tools/go/gozip";
-    vendorHash = null;
+
+  templates = fetchurl {
+    url = "https://cdn.functions.azure.com/public/TemplatesApi/${templatesVersion}.zip";
+    hash = "sha256-YYKBwd69TIHQKF1r8BzlzIyDLJBcCqtAbK3FhNvA+5s=";
   };
 in
 buildDotnetModule {
   pname = "azure-functions-core-tools";
   inherit src version;
-
-  dotnet-sdk = dotnetCorePackages.sdk_8_0;
-  dotnet-runtime = dotnetCorePackages.sdk_8_0;
-  dotnetFlags = [ "-p:TargetFramework=net8.0" ];
-  nugetDeps = ./deps.json;
-  useDotnetFromEnv = true;
+  projectFile = "src/Cli/func/Azure.Functions.Cli.csproj";
   executables = [ "func" ];
 
-  postPatch = ''
-    substituteInPlace src/Azure.Functions.Cli/Common/CommandChecker.cs \
-      --replace-fail "CheckExitCode(\"/bin/bash" "CheckExitCode(\"${stdenv.shell}"
-  '';
+  nugetDeps = ./deps.json;
+  dotnet-sdk = dotnetCorePackages.sdk_10_0;
+  nativeBuildInputs = [ go ];
 
-  postInstall = ''
-    mkdir -p $out/bin
-    ln -s ${gozip}/bin/gozip $out/bin/gozip
+  linkNuGetPackagesAndSources = true;
+  useDotnetFromEnv = true;
+
+  postPatch = ''
+    templates_path="./out/obj/Azure.Functions.Cli/templates-staging"
+    mkdir -p "$templates_path"
+    cp "${templates}" "$templates_path/templates.zip"
+
+    substituteInPlace src/Cli/func/Common/CommandChecker.cs \
+      --replace-fail "CheckExitCode(\"/bin/bash" "CheckExitCode(\"${stdenv.shell}"
   '';
 
   meta = {

pkgs/by-name/ba/bagels/package.nix

@@ -7,14 +7,14 @@
 
 python3Packages.buildPythonApplication (finalAttrs: {
   pname = "bagels";
-  version = "0.3.9";
+  version = "0.3.12";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "EnhancedJax";
     repo = "bagels";
     tag = finalAttrs.version;
-    hash = "sha256-LlEQ0by6Si37e8FvC4agjLy8eanizSA1iq44BaQ8D5o=";
+    hash = "sha256-w7Q7yCKffya2SyuHUaTWOugkeyTZbL9JNj/Ir3tnafE=";
   };
 
   build-system = with python3Packages; [
@@ -80,13 +80,23 @@ python3Packages.buildPythonApplication (finalAttrs: {
     # AttributeError: 'NoneType' object has no attribute 'defaults'
     "test_basic_balance_calculation"
     "test_combined_balance_calculation"
+    "test_create_template"
+    "test_create_multiple_templates"
+    "test_delete_template"
+    "test_get_adjacent_template"
+    "test_get_all_templates"
     "test_get_days_in_period"
     "test_get_period_average"
     "test_get_period_figures"
     "test_get_start_end_of_period"
     "test_get_start_end_of_week"
+    "test_get_template_by_id"
     "test_split_balance_calculation"
+    "test_swap_template_order"
+    "test_swap_template_order_edge_cases"
+    "test_template_validation"
     "test_transfer_balance_calculation"
+    "test_update_template"
   ];
 
   meta = {

pkgs/by-name/ba/bambu-studio/package.nix

@@ -36,13 +36,13 @@
   systemd,
   onetbb,
   webkitgtk_4_1,
-  wxGTK31,
+  wxwidgets_3_1,
   libx11,
   withSystemd ? stdenv.hostPlatform.isLinux,
 }:
 let
   wxGTK' =
-    (wxGTK31.override {
+    (wxwidgets_3_1.override {
       withCurl = true;
       withPrivateFonts = true;
       withWebKit = true;

pkgs/by-name/ba/bao/package.nix

@@ -4,13 +4,13 @@
   fetchCrate,
 }:
 
-rustPlatform.buildRustPackage rec {
+rustPlatform.buildRustPackage (finalAttrs: {
   pname = "bao";
   version = "0.13.1";
 
   src = fetchCrate {
-    inherit version;
-    pname = "${pname}_bin";
+    inherit (finalAttrs) version;
+    pname = "${finalAttrs.pname}_bin";
     hash = "sha256-8h5otpu3z2Hgy0jMCITJNr8Q4iVdlR5Lea2X+WuenWs=";
   };
 
@@ -26,4 +26,4 @@ rustPlatform.buildRustPackage rec {
     ];
     mainProgram = "bao";
   };
-}
+})

pkgs/by-name/ba/baresip/package.nix

@@ -31,14 +31,14 @@
 }:
 
 stdenv.mkDerivation (finalAttrs: {
-  version = "4.5.0";
+  version = "4.6.0";
   pname = "baresip";
 
   src = fetchFromGitHub {
     owner = "baresip";
     repo = "baresip";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-tut6HC4wn749BqIoRMhk/O2iN4y2hr6MVEnOICroKEM=";
+    hash = "sha256-ikfSr9chbkv+5XPlDZKH/80N98tBzHvyNf29kENXOFI=";
   };
 
   patches = [

pkgs/by-name/ba/bazel_8/examples.nix

@@ -108,10 +108,10 @@ in
     bazelVendorDepsFOD = {
       outputHash =
         {
-          aarch64-darwin = "sha256-0QtaPtcBljyhiJGwA8ctSpi+UQp/9q/ZoHUHORizmlY=";
-          aarch64-linux = "sha256-zpiwQ8OB8KhY+kxSXlSOd/zmoH1VGYDGgojf4Or04pQ=";
-          x86_64-darwin = "sha256-+tCDSuYkon1DEARwWTYABJbmysSNAK9vy0tCm8YsGjQ=";
-          x86_64-linux = "sha256-wCWSRc20Yr/hdXn8szbhLAX7Oy3G5keyHTTdO0msnks=";
+          aarch64-darwin = "sha256-wjVwHQEtIoApY01s9AEVExmRhy+LLQv0/B2vAxmXz+o=";
+          aarch64-linux = "sha256-Z7Y8bBEaPgp9y6RZoC5Ewqvzi//vnamkpeHXGpoBFAQ=";
+          x86_64-darwin = "sha256-aUTfOrsa59zUE0Wb+u5TORQR0nAGQ/7MWSRHc2hcXoo=";
+          x86_64-linux = "sha256-yrXIJocCGq4NYW0jg5s2cMDEvknrtjtBQo6cZFbz8CE=";
         }
         .${stdenv.hostPlatform.system};
       outputHashAlgo = "sha256";

pkgs/by-name/ba/bazel_8/package.nix

@@ -31,7 +31,7 @@
   cctools,
   # Allow to independently override the jdks used to build and run respectively
   jdk_headless,
-  version ? "8.5.0",
+  version ? "8.6.0",
 }:
 
 let
@@ -45,7 +45,7 @@ let
 
   src = fetchzip {
     url = "https://github.com/bazelbuild/bazel/releases/download/${version}/bazel-${version}-dist.zip";
-    hash = "sha256-L8gnWpQAeHMUbydrrEtZ6WGIzhunDBWCNWMA+3dAKT0=";
+    hash = "sha256-W22eB0IzHNZe3xaF8AZOkUTDCic3NXkypdqSDY61Su0=";
     stripRoot = false;
   };
 

pkgs/by-name/be/beszel/package.nix

@@ -1,24 +1,24 @@
 {
-  buildGoModule,
+  buildGo126Module,
   lib,
   fetchFromGitHub,
   nix-update-script,
   buildNpmPackage,
   nixosTests,
 }:
-buildGoModule rec {
+buildGo126Module (finalAttrs: {
   pname = "beszel";
-  version = "0.18.3";
+  version = "0.18.4";
 
   src = fetchFromGitHub {
     owner = "henrygd";
     repo = "beszel";
-    tag = "v${version}";
-    hash = "sha256-/rFVH3kWf9OB3/iJNOARG85y1WH03hW8LvsIRzq1vnU=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-Ugxy23bLrKIDclrYRFJc6Nq4Ak2S3OLeyMaxuRkS/tY=";
   };
 
   webui = buildNpmPackage {
-    inherit
+    inherit (finalAttrs)
       pname
       version
       src
@@ -46,16 +46,16 @@ buildGoModule rec {
       runHook postInstall
     '';
 
-    sourceRoot = "${src.name}/internal/site";
+    sourceRoot = "${finalAttrs.src.name}/internal/site";
 
     npmDepsHash = "sha256-509/n5OH4z6LZH+jlmDLl2DlqKrD7M5ajtalmF/4n1o=";
   };
 
-  vendorHash = "sha256-O5gFpQ90AQFSAidPTWPrODZ4LWuwrOMpzEH/8HrjBig=";
+  vendorHash = "sha256-V9P3VP4CsboaWPIt/MhtxYDsYH3pwKL4xK5YcLKgbI8=";
 
   preBuild = ''
     mkdir -p internal/site/dist
-    cp -r ${webui}/* internal/site/dist
+    cp -r ${finalAttrs.webui}/* internal/site/dist
   '';
 
   postInstall = ''
@@ -75,7 +75,7 @@ buildGoModule rec {
 
   meta = {
     homepage = "https://github.com/henrygd/beszel";
-    changelog = "https://github.com/henrygd/beszel/releases/tag/v${version}";
+    changelog = "https://github.com/henrygd/beszel/releases/tag/v${finalAttrs.version}";
     description = "Lightweight server monitoring hub with historical data, docker stats, and alerts";
     maintainers = with lib.maintainers; [
       bot-wxt1221
@@ -84,4 +84,4 @@ buildGoModule rec {
     ];
     license = lib.licenses.mit;
   };
-}
+})

pkgs/by-name/bk/bk/package.nix

@@ -6,12 +6,12 @@
   rustPlatform,
 }:
 
-rustPlatform.buildRustPackage rec {
+rustPlatform.buildRustPackage (finalAttrs: {
   pname = "bk";
   version = "0.6.0";
 
   src = fetchCrate {
-    inherit pname version;
+    inherit (finalAttrs) pname version;
     hash = "sha256-rSMvx/zUZqRRgj48TVVG7RwQT8e70m0kertRJysDY4Y=";
   };
 
@@ -39,4 +39,4 @@ rustPlatform.buildRustPackage rec {
     maintainers = with lib.maintainers; [ vuimuich ];
     mainProgram = "bk";
   };
-}
+})

pkgs/by-name/bo/bochs/package.nix

@@ -16,7 +16,7 @@
   readline,
   stdenv,
   wget,
-  wxGTK32,
+  wxwidgets_3_2,
   # Boolean flags
   enableSDL2 ? true,
   enableTerm ? true,
@@ -56,7 +56,7 @@ stdenv.mkDerivation (finalAttrs: {
   ]
   ++ lib.optionals enableWx [
     gtk3
-    wxGTK32
+    wxwidgets_3_2
   ]
   ++ lib.optionals enableX11 [
     libGL

pkgs/by-name/bo/boinc/package.nix

@@ -14,7 +14,7 @@
   libglut,
   libjpeg,
   libtool,
-  wxGTK32,
+  wxwidgets_3_2,
   libxcb-util,
   sqlite,
   gtk3,
@@ -58,7 +58,7 @@ stdenv.mkDerivation rec {
     libxi
     libglut
     libjpeg
-    wxGTK32
+    wxwidgets_3_2
     gtk3
     libxscrnsaver
     libnotify

pkgs/by-name/bo/book-summary/package.nix

@@ -4,12 +4,12 @@
   fetchCrate,
 }:
 
-rustPlatform.buildRustPackage rec {
+rustPlatform.buildRustPackage (finalAttrs: {
   pname = "book-summary";
   version = "0.2.1";
 
   src = fetchCrate {
-    inherit pname version;
+    inherit (finalAttrs) pname version;
     hash = "sha256-dxM6bqgHp4IaG03NriHvoT3al2u5Sz/I5ajlgzpjG1c=";
   };
 
@@ -21,4 +21,4 @@ rustPlatform.buildRustPackage rec {
     homepage = "https://github.com/dvogt23/book-summary";
     license = lib.licenses.mit;
   };
-}
+})

pkgs/by-name/bo/bossa/package.nix

@@ -2,7 +2,7 @@
   lib,
   stdenv,
   fetchFromGitHub,
-  wxGTK32,
+  wxwidgets_3_2,
   libx11,
   readline,
   fetchpatch,
@@ -48,7 +48,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   nativeBuildInputs = [ bin2c ];
   buildInputs = [
-    wxGTK32
+    wxwidgets_3_2
     libx11
     readline
   ];

pkgs/by-name/br/brainflow/package.nix

@@ -17,13 +17,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "brainflow";
-  version = "5.20.1";
+  version = "5.21.0";
 
   src = fetchFromGitHub {
     owner = "brainflow-dev";
     repo = "brainflow";
     tag = finalAttrs.version;
-    hash = "sha256-eQgjEFYEuJXLNB+qeWLeN3ZRmq1lR5qpcFcPgHn8Az8=";
+    hash = "sha256-AE8c2ArkNipoAJSCj3NHEM91rulfbWGyANunPESKc/E=";
   };
 
   patches = [ ];

pkgs/by-name/br/brave/package.nix

@@ -3,24 +3,24 @@
 
 let
   pname = "brave";
-  version = "1.87.191";
+  version = "1.87.192";
 
   allArchives = {
     aarch64-linux = {
       url = "https://github.com/brave/brave-browser/releases/download/v${version}/brave-browser_${version}_arm64.deb";
-      hash = "sha256-mwczK2IYt+88VfSyNLwSWRxBuGS+AzMcAGE2C8Bafno=";
+      hash = "sha256-h5V+f/o0QFQG9PbwNUM0Kdnf5wMrdBQbhDErBv1vghk=";
     };
     x86_64-linux = {
       url = "https://github.com/brave/brave-browser/releases/download/v${version}/brave-browser_${version}_amd64.deb";
-      hash = "sha256-p2gdKzk0YTZYciSvlpO0Q31w8/eNOE1WmhvWm0pop1I=";
+      hash = "sha256-HSHHITkgDWzjeVotqJ1fNBjohC6CWNHlT32Vg7ZlRNQ=";
     };
     aarch64-darwin = {
       url = "https://github.com/brave/brave-browser/releases/download/v${version}/brave-v${version}-darwin-arm64.zip";
-      hash = "sha256-ZXjEPtb6WV+izKbyaaR4MtcI0dS+tOlYQ/B8ngKt0GY=";
+      hash = "sha256-IQIOJH6m6iX2a/7VC2Eh/HUiGuco19aIBqANbKNLfa8=";
     };
     x86_64-darwin = {
       url = "https://github.com/brave/brave-browser/releases/download/v${version}/brave-v${version}-darwin-x64.zip";
-      hash = "sha256-yDyzzTVlB2hHFzECe3C4Lv5RZTSqgyBOdN1HBdmI2aA=";
+      hash = "sha256-Lir4ZaZoawWm0vbCDPPW+1dKvGKhWnP3lAqAcS4ImFs=";
     };
   };
 

pkgs/by-name/br/browsers/package.nix

@@ -46,7 +46,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
     mv $out/share/applications/software.Browsers.template.desktop $out/share/applications/software.Browsers.desktop
     substituteInPlace \
         $out/share/applications/software.Browsers.desktop \
-        --replace-fail 'Exec=€ExecCommand€' 'Exec=${finalAttrs.pname} %u'
+        --replace-fail 'Exec=€ExecCommand€' 'Exec=${finalAttrs.meta.mainProgram} %u'
     cp -r resources $out
     for size in 16 32 128 256 512; do
       install -m 444 \

pkgs/by-name/bu/buildstream/package.nix

@@ -2,7 +2,7 @@
   lib,
   python3Packages,
   fetchFromGitHub,
-  nix-update-script,
+  gitUpdater,
 
   # buildInputs
   buildbox,
@@ -119,7 +119,9 @@ python3Packages.buildPythonApplication (finalAttrs: {
 
   versionCheckProgram = "${placeholder "out"}/bin/bst";
 
-  passthru.updateScript = nix-update-script { };
+  passthru.updateScript = gitUpdater {
+    ignoredVersions = "dev";
+  };
 
   meta = {
     description = "Powerful software integration tool";

pkgs/by-name/c2/c2patool/package.nix

@@ -10,16 +10,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "c2patool";
-  version = "0.26.29";
+  version = "0.26.33";
 
   src = fetchFromGitHub {
     owner = "contentauth";
     repo = "c2pa-rs";
     tag = "c2patool-v${finalAttrs.version}";
-    hash = "sha256-NaTLMko3JcjAGe4ow66jjJwWOP4+P2G1SnpgCPcQNBc=";
+    hash = "sha256-e016wNfAVhDFwCYvBb/I+nci1FVSG/knsPZFhsR4074=";
   };
 
-  cargoHash = "sha256-AHgqmc5rAiUBScJ6eBSV6xHG2HJWspEwI5Ka/iyACqY=";
+  cargoHash = "sha256-KCL3GhNb1ilKXXjj6DSnLTbSNfevAYDUuJt01y4bDVE=";
 
   # use the non-vendored openssl
   env.OPENSSL_NO_VENDOR = 1;

pkgs/by-name/ca/caddy/package.nix

@@ -11,7 +11,7 @@
   versionCheckHook,
 }:
 let
-  version = "2.11.1";
+  version = "2.11.2";
   dist = fetchFromGitHub {
     owner = "caddyserver";
     repo = "dist";
@@ -27,10 +27,10 @@ buildGo125Module (finalAttrs: {
     owner = "caddyserver";
     repo = "caddy";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-8NvRodMtq9Yrock7QRvF6ZOjuqpiK0KS3UeJzYcIbsg=";
+    hash = "sha256-QoGq8+lhaSQuC1VwIYE8h8N/ZC1ozfmIwmsIPk29Jos=";
   };
 
-  vendorHash = "sha256-jZ/oxAVBedbFEnqXrQnya2vLQZjXubAc1vUKwpUL66M=";
+  vendorHash = "sha256-zlwVgSEr01bbgV7N9szwqa9cPjBU34Cu7vqj4/MoSuU=";
 
   ldflags = [
     "-s"

pkgs/by-name/ca/cargo-all-features/package.nix

@@ -4,12 +4,12 @@
   fetchCrate,
 }:
 
-rustPlatform.buildRustPackage rec {
+rustPlatform.buildRustPackage (finalAttrs: {
   pname = "cargo-all-features";
   version = "1.12.0";
 
   src = fetchCrate {
-    inherit pname version;
+    inherit (finalAttrs) pname version;
     hash = "sha256-pD0lyI2zSOeEDk1Lch4Qf5mo8Z8Peiy2XF5iQ62vsaI=";
   };
 
@@ -31,4 +31,4 @@ rustPlatform.buildRustPackage rec {
       matthiasbeyer
     ];
   };
-}
+})

pkgs/by-name/ca/cargo-apk/package.nix

@@ -4,12 +4,12 @@
   fetchCrate,
 }:
 
-rustPlatform.buildRustPackage rec {
+rustPlatform.buildRustPackage (finalAttrs: {
   pname = "cargo-apk";
   version = "0.9.6";
 
   src = fetchCrate {
-    inherit pname version;
+    inherit (finalAttrs) pname version;
     hash = "sha256-1vCrM+0SNefd7FrRXnSjLhM3/MSVJfcL4k1qAstX+/A=";
   };
 
@@ -25,4 +25,4 @@ rustPlatform.buildRustPackage rec {
     ];
     maintainers = with lib.maintainers; [ nickcao ];
   };
-}
+})

pkgs/by-name/ca/cargo-audit/package.nix

@@ -7,12 +7,12 @@
   zlib,
 }:
 
-rustPlatform.buildRustPackage rec {
+rustPlatform.buildRustPackage (finalAttrs: {
   pname = "cargo-audit";
   version = "0.22.0";
 
   src = fetchCrate {
-    inherit pname version;
+    inherit (finalAttrs) pname version;
     hash = "sha256-Ha2yVyu9331NaqiW91NEwCTIeW+3XPiqZzmatN5KOws=";
   };
 
@@ -36,7 +36,7 @@ rustPlatform.buildRustPackage rec {
     description = "Audit Cargo.lock files for crates with security vulnerabilities";
     mainProgram = "cargo-audit";
     homepage = "https://rustsec.org";
-    changelog = "https://github.com/rustsec/rustsec/blob/cargo-audit/v${version}/cargo-audit/CHANGELOG.md";
+    changelog = "https://github.com/rustsec/rustsec/blob/cargo-audit/v${finalAttrs.version}/cargo-audit/CHANGELOG.md";
     license = with lib.licenses; [
       mit # or
       asl20
@@ -46,4 +46,4 @@ rustPlatform.buildRustPackage rec {
       jk
     ];
   };
-}
+})

pkgs/by-name/ca/cargo-bazel/package.nix

@@ -6,12 +6,12 @@
   libz,
 }:
 
-rustPlatform.buildRustPackage rec {
+rustPlatform.buildRustPackage (finalAttrs: {
   pname = "cargo-bazel";
   version = "0.17.0";
 
   src = fetchCrate {
-    inherit pname version;
+    inherit (finalAttrs) pname version;
     hash = "sha256-KWcxZxzDbiBfBpr37M6HoqHMCYXq6sTVxU9KR3PIiJc=";
   };
 
@@ -29,4 +29,4 @@ rustPlatform.buildRustPackage rec {
     license = lib.licenses.asl20;
     maintainers = with lib.maintainers; [ rickvanprim ];
   };
-}
+})

pkgs/by-name/ca/cargo-binutils/package.nix

@@ -4,12 +4,12 @@
   fetchCrate,
 }:
 
-rustPlatform.buildRustPackage rec {
+rustPlatform.buildRustPackage (finalAttrs: {
   pname = "cargo-binutils";
   version = "0.4.0";
 
   src = fetchCrate {
-    inherit pname version;
+    inherit (finalAttrs) pname version;
     hash = "sha256-AF1MRBH8ULnHNHT2FS/LxMH+b06QMTIZMIR8mmkn17c=";
   };
 
@@ -21,7 +21,7 @@ rustPlatform.buildRustPackage rec {
       In order for this to work, you either need to run `rustup component add llvm-tools` or install the `llvm-tools` component using your Nix library (e.g. fenix or rust-overlay)
     '';
     homepage = "https://github.com/rust-embedded/cargo-binutils";
-    changelog = "https://github.com/rust-embedded/cargo-binutils/blob/v${version}/CHANGELOG.md";
+    changelog = "https://github.com/rust-embedded/cargo-binutils/blob/v${finalAttrs.version}/CHANGELOG.md";
     license = with lib.licenses; [
       asl20
       mit
@@ -32,4 +32,4 @@ rustPlatform.buildRustPackage rec {
       newam
     ];
   };
-}
+})

pkgs/by-name/ca/cargo-bolero/package.nix

@@ -8,12 +8,12 @@
   nix-update-script,
 }:
 
-rustPlatform.buildRustPackage rec {
+rustPlatform.buildRustPackage (finalAttrs: {
   pname = "cargo-bolero";
   version = "0.13.4";
 
   src = fetchCrate {
-    inherit pname version;
+    inherit (finalAttrs) pname version;
     hash = "sha256-lfBpHaY2UCBMg45S4IW8fcpkGkKJoT4qqR2yq5KiXuE=";
   };
 
@@ -36,4 +36,4 @@ rustPlatform.buildRustPackage rec {
     license = with lib.licenses; [ mit ];
     maintainers = with lib.maintainers; [ ekleog ];
   };
-}
+})

pkgs/by-name/ca/cargo-c/package.nix

@@ -14,13 +14,13 @@ let
   # this version may need to be updated along with package version
   cargoVersion = "0.93.0";
 in
-rustPlatform.buildRustPackage rec {
+rustPlatform.buildRustPackage (finalAttrs: {
   pname = "cargo-c";
   version = "0.10.19";
 
   src = fetchCrate {
-    inherit pname;
-    version = "${version}+cargo-${cargoVersion}";
+    inherit (finalAttrs) pname;
+    version = "${finalAttrs.version}+cargo-${cargoVersion}";
     hash = "sha256-PrBmB+0tmU2MAUnRr+wx4g9hu0Y9i6WfR8U89bwiLVY=";
   };
 
@@ -63,11 +63,11 @@ rustPlatform.buildRustPackage rec {
       to be used by any C (and C-compatible) software.
     '';
     homepage = "https://github.com/lu-zero/cargo-c";
-    changelog = "https://github.com/lu-zero/cargo-c/releases/tag/v${version}";
+    changelog = "https://github.com/lu-zero/cargo-c/releases/tag/v${finalAttrs.version}";
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [
       cpu
       matthiasbeyer
     ];
   };
-}
+})

pkgs/by-name/ca/cargo-chef/package.nix

@@ -4,12 +4,12 @@
   fetchCrate,
 }:
 
-rustPlatform.buildRustPackage rec {
+rustPlatform.buildRustPackage (finalAttrs: {
   pname = "cargo-chef";
   version = "0.1.75";
 
   src = fetchCrate {
-    inherit pname version;
+    inherit (finalAttrs) pname version;
     hash = "sha256-FETYJrx5+yNOzMVIgJQ0yNLi2PB7cA128n8hAXIhx3E=";
   };
 
@@ -22,4 +22,4 @@ rustPlatform.buildRustPackage rec {
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [ kkharji ];
   };
-}
+})

pkgs/by-name/ca/cargo-cyclonedx/package.nix

@@ -8,14 +8,14 @@
   curl,
 }:
 
-rustPlatform.buildRustPackage rec {
+rustPlatform.buildRustPackage (finalAttrs: {
   pname = "cargo-cyclonedx";
   version = "0.5.7";
 
   src = fetchFromGitHub {
     owner = "CycloneDX";
     repo = "cyclonedx-rust-cargo";
-    rev = "${pname}-${version}";
+    rev = "cargo-cyclonedx-${finalAttrs.version}";
     hash = "sha256-T/9eHI2P8eCZAqMTeZz1yEi5nljQWfHrdNiU3h3h74U=";
   };
 
@@ -49,4 +49,4 @@ rustPlatform.buildRustPackage rec {
     license = lib.licenses.asl20;
     maintainers = with lib.maintainers; [ nikstur ];
   };
-}
+})

pkgs/by-name/ca/cargo-gra/package.nix

@@ -4,12 +4,12 @@
   lib,
 }:
 
-rustPlatform.buildRustPackage rec {
+rustPlatform.buildRustPackage (finalAttrs: {
   pname = "cargo-gra";
   version = "0.6.2";
 
   src = fetchCrate {
-    inherit pname version;
+    inherit (finalAttrs) pname version;
     hash = "sha256-JbBcpp/E3WlQrwdxMsbSdmIEnDTQj/1XDwAWJsniRu0=";
   };
 
@@ -22,4 +22,4 @@ rustPlatform.buildRustPackage rec {
     maintainers = with lib.maintainers; [ bot-wxt1221 ];
     platforms = lib.platforms.unix;
   };
-}
+})

pkgs/by-name/ca/cargo-hf2/package.nix

@@ -6,12 +6,12 @@
   libusb1,
 }:
 
-rustPlatform.buildRustPackage rec {
+rustPlatform.buildRustPackage (finalAttrs: {
   pname = "cargo-hf2";
   version = "0.3.3";
 
   src = fetchCrate {
-    inherit pname version;
+    inherit (finalAttrs) pname version;
     hash = "sha256-0o3j7YfgNNnfbrv9Gppo24DqYlDCxhtsJHIhAV214DU=";
   };
 
@@ -28,4 +28,4 @@ rustPlatform.buildRustPackage rec {
     license = with lib.licenses; [ mit ];
     maintainers = with lib.maintainers; [ astrobeastie ];
   };
-}
+})

pkgs/by-name/ca/cargo-license/package.nix

@@ -4,12 +4,12 @@
   fetchCrate,
 }:
 
-rustPlatform.buildRustPackage rec {
+rustPlatform.buildRustPackage (finalAttrs: {
   pname = "cargo-license";
   version = "0.7.0";
 
   src = fetchCrate {
-    inherit pname version;
+    inherit (finalAttrs) pname version;
     hash = "sha256-bOBrjChkQM6POZZn53JmJcIn1x+ygF5mthZihMskxIk=";
   };
 
@@ -25,4 +25,4 @@ rustPlatform.buildRustPackage rec {
       matthiasbeyer
     ];
   };
-}
+})

pkgs/by-name/ca/cargo-lock/package.nix

@@ -4,12 +4,12 @@
   fetchCrate,
 }:
 
-rustPlatform.buildRustPackage rec {
+rustPlatform.buildRustPackage (finalAttrs: {
   pname = "cargo-lock";
   version = "11.0.0";
 
   src = fetchCrate {
-    inherit pname version;
+    inherit (finalAttrs) pname version;
     hash = "sha256-Gz459c2IWD19RGBg2TyHbI/VNCelha+R0FeNkAaHksU=";
   };
 
@@ -21,7 +21,7 @@ rustPlatform.buildRustPackage rec {
     description = "Self-contained Cargo.lock parser with graph analysis";
     mainProgram = "cargo-lock";
     homepage = "https://github.com/rustsec/rustsec/tree/main/cargo-lock";
-    changelog = "https://github.com/rustsec/rustsec/blob/cargo-lock/v${version}/cargo-lock/CHANGELOG.md";
+    changelog = "https://github.com/rustsec/rustsec/blob/cargo-lock/v${finalAttrs.version}/cargo-lock/CHANGELOG.md";
     license = with lib.licenses; [
       asl20 # or
       mit
@@ -30,4 +30,4 @@ rustPlatform.buildRustPackage rec {
       matthiasbeyer
     ];
   };
-}
+})

pkgs/by-name/ca/cargo-mommy/package.nix

@@ -4,12 +4,12 @@
   fetchCrate,
 }:
 
-rustPlatform.buildRustPackage rec {
+rustPlatform.buildRustPackage (finalAttrs: {
   pname = "cargo-mommy";
   version = "0.3.1";
 
   src = fetchCrate {
-    inherit pname version;
+    inherit (finalAttrs) pname version;
     hash = "sha256-2WR6xUYL/bLgZlI4ADbPAtdLq0y4MoVP8Loxdu/58Wc=";
   };
 
@@ -25,4 +25,4 @@ rustPlatform.buildRustPackage rec {
     ];
     maintainers = with lib.maintainers; [ GoldsteinE ];
   };
-}
+})