Merge remote-tracking branch 'origin/master' into staging-next

maintainers/maintainer-list.nix

@@ -18104,6 +18104,13 @@
     githubId = 4579165;
     name = "Danny Bautista";
   };
+  pyrotelekinetic = {
+    name = "Clover";
+    email = "carter@isons.org";
+    github = "pyrotelekinetic";
+    githubId = 29682759;
+    keys = [ { fingerprint = "5963 78DB 25AA 608D 2743  D466 5D6A D9AE 71B3 F983"; } ];
+  };
   pyrox0 = {
     name = "Pyrox";
     email = "pyrox@pyrox.dev";
@@ -22795,7 +22802,7 @@
     githubId = 332418;
   };
   tsandrini = {
-    email = "tomas.sandrini@seznam.cz";
+    email = "t@tsandrini.sh";
     name = "Tomáš Sandrini";
     github = "tsandrini";
     githubId = 21975189;

nixos/doc/manual/configuration/user-mgmt.chapter.md

@@ -122,7 +122,7 @@ The primary benefit of this is to remove a dependency on perl.
 This is experimental.
 :::
 
-Like systemd-sysusers, Userborn adoesn't depend on Perl but offers some more
+Like systemd-sysusers, Userborn doesn't depend on Perl but offers some more
 advantages over systemd-sysusers:
 
 1. It can create "normal" users (with a GID >= 1000).

nixos/doc/manual/release-notes/rl-2505.section.md

@@ -100,6 +100,11 @@
   add `vimPlugins.notmuch-vim` to your (Neo)vim configuration if you want the
   vim plugin.
 
+- `prisma` and `prisma-engines` have been updated to version 6.0.1, which
+  introduces several breaking changes. See the
+  [Prisma ORM upgrade guide](https://www.prisma.io/docs/orm/more/upgrade-guides/upgrading-versions/upgrading-to-prisma-6)
+  for more information.
+
 <!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->
 
 ## Other Notable Changes {#sec-release-25.05-notable-changes}
@@ -108,6 +113,8 @@
 
 - Cinnamon has been updated to 6.4.
 
+- `networking.wireguard` now has an optional networkd backend. It is enabled by default when `networking.useNetworkd` is enabled, and it can be enabled alongside scripted networking with `networking.wireguard.useNetworkd`. Some `networking.wireguard` options have slightly different behavior with the networkd and script-based backends, documented in each option. Before upgrading, make sure the `privateKeyFile` and `presharedKeyFile` paths are readable by the `systemd-network` user if using the networkd backend.
+
 - `services.avahi.ipv6` now defaults to true.
 
 - `bind.cacheNetworks` now only controls access for recursive queries, where it previously controlled access for all queries.

nixos/modules/module-list.nix

@@ -1286,6 +1286,7 @@
   ./services/networking/wg-quick.nix
   ./services/networking/wgautomesh.nix
   ./services/networking/wireguard.nix
+  ./services/networking/wireguard-networkd.nix
   ./services/networking/wpa_supplicant.nix
   ./services/networking/wstunnel.nix
   ./services/networking/x2goserver.nix

nixos/modules/security/apparmor.nix

@@ -210,5 +210,5 @@ in
     };
   };
 
-  meta.maintainers = with lib.maintainers; [ julm ];
+  meta.maintainers = with lib.maintainers; [ julm grimmauld ];
 }

nixos/modules/services/networking/wireguard-networkd.nix

@@ -0,0 +1,207 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+let
+  inherit (lib) types;
+  inherit (lib.attrsets)
+    filterAttrs
+    mapAttrs
+    mapAttrs'
+    mapAttrsToList
+    nameValuePair
+    ;
+  inherit (lib.lists) concatMap concatLists;
+  inherit (lib.modules) mkIf;
+  inherit (lib.options) literalExpression mkOption;
+  inherit (lib.strings) hasInfix;
+  inherit (lib.trivial) flip;
+
+  removeNulls = filterAttrs (_: v: v != null);
+
+  generateNetdev =
+    name: interface:
+    nameValuePair "40-${name}" {
+      netdevConfig = removeNulls {
+        Kind = "wireguard";
+        Name = name;
+        MTUBytes = interface.mtu;
+      };
+      wireguardConfig = removeNulls {
+        PrivateKeyFile = interface.privateKeyFile;
+        ListenPort = interface.listenPort;
+        FirewallMark = interface.fwMark;
+        RouteTable = if interface.allowedIPsAsRoutes then interface.table else null;
+        RouteMetric = interface.metric;
+      };
+      wireguardPeers = map generateWireguardPeer interface.peers;
+    };
+
+  generateWireguardPeer =
+    peer:
+    removeNulls {
+      PublicKey = peer.publicKey;
+      PresharedKeyFile = peer.presharedKeyFile;
+      AllowedIPs = peer.allowedIPs;
+      Endpoint = peer.endpoint;
+      PersistentKeepalive = peer.persistentKeepalive;
+    };
+
+  generateNetwork = name: interface: {
+    matchConfig.Name = name;
+    address = interface.ips;
+  };
+
+  cfg = config.networking.wireguard;
+
+  refreshEnabledInterfaces = filterAttrs (
+    name: interface: interface.dynamicEndpointRefreshSeconds != 0
+  ) cfg.interfaces;
+
+  generateRefreshTimer =
+    name: interface:
+    nameValuePair "wireguard-dynamic-refresh-${name}" {
+      partOf = [ "wireguard-dynamic-refresh-${name}.service" ];
+      wantedBy = [ "timers.target" ];
+      description = "Wireguard dynamic endpoint refresh (${name}) timer";
+      timerConfig.OnBootSec = interface.dynamicEndpointRefreshSeconds;
+      timerConfig.OnUnitInactiveSec = interface.dynamicEndpointRefreshSeconds;
+    };
+
+  generateRefreshService =
+    name: interface:
+    nameValuePair "wireguard-dynamic-refresh-${name}" {
+      description = "Wireguard dynamic endpoint refresh (${name})";
+      after = [ "network-online.target" ];
+      wants = [ "network-online.target" ];
+      path = with pkgs; [
+        iproute2
+        systemd
+      ];
+      # networkd doesn't provide a mechanism for refreshing endpoints.
+      # See: https://github.com/systemd/systemd/issues/9911
+      # This hack does the job but takes down the whole interface to do it.
+      script = ''
+        ip link delete ${name}
+        networkctl reload
+      '';
+    };
+
+in
+{
+  meta.maintainers = [ lib.maintainers.majiir ];
+
+  options.networking.wireguard = {
+    useNetworkd = mkOption {
+      default = config.networking.useNetworkd;
+      defaultText = literalExpression "config.networking.useNetworkd";
+      type = types.bool;
+      description = ''
+        Whether to use networkd as the network configuration backend for
+        Wireguard instead of the legacy script-based system.
+
+        ::: {.warning}
+        Some options have slightly different behavior with the networkd and
+        script-based backends. Check the documentation for each Wireguard
+        option you use before enabling this option.
+        :::
+      '';
+    };
+  };
+
+  config = mkIf (cfg.enable && cfg.useNetworkd) {
+
+    # TODO: Some of these options may be possible to support in networkd.
+    #
+    # privateKey and presharedKey are trivial to support, but we deliberately
+    # don't in order to discourage putting secrets in the /nix store.
+    #
+    # generatePrivateKeyFile can be supported if we can order a service before
+    # networkd configures interfaces. There is also a systemd feature request
+    # for key generation: https://github.com/systemd/systemd/issues/14282
+    #
+    # preSetup, postSetup, preShutdown and postShutdown may be possible, but
+    # networkd is not likely to support script hooks like this directly. See:
+    # https://github.com/systemd/systemd/issues/11629
+    #
+    # socketNamespace and interfaceNamespace can be implemented once networkd
+    # supports setting a netdev's namespace. See:
+    # https://github.com/systemd/systemd/issues/11629
+    # https://github.com/systemd/systemd/pull/14915
+
+    assertions = concatLists (
+      flip mapAttrsToList cfg.interfaces (
+        name: interface:
+        [
+          # Interface assertions
+          {
+            assertion = interface.privateKey == null;
+            message = "networking.wireguard.interfaces.${name}.privateKey cannot be used with networkd. Use privateKeyFile instead.";
+          }
+          {
+            assertion = !interface.generatePrivateKeyFile;
+            message = "networking.wireguard.interfaces.${name}.generatePrivateKeyFile cannot be used with networkd.";
+          }
+          {
+            assertion = interface.preSetup == "";
+            message = "networking.wireguard.interfaces.${name}.preSetup cannot be used with networkd.";
+          }
+          {
+            assertion = interface.postSetup == "";
+            message = "networking.wireguard.interfaces.${name}.postSetup cannot be used with networkd.";
+          }
+          {
+            assertion = interface.preShutdown == "";
+            message = "networking.wireguard.interfaces.${name}.preShutdown cannot be used with networkd.";
+          }
+          {
+            assertion = interface.postShutdown == "";
+            message = "networking.wireguard.interfaces.${name}.postShutdown cannot be used with networkd.";
+          }
+          {
+            assertion = interface.socketNamespace == null;
+            message = "networking.wireguard.interfaces.${name}.socketNamespace cannot be used with networkd.";
+          }
+          {
+            assertion = interface.interfaceNamespace == null;
+            message = "networking.wireguard.interfaces.${name}.interfaceNamespace cannot be used with networkd.";
+          }
+        ]
+        ++ flip concatMap interface.ips (ip: [
+          # IP assertions
+          {
+            assertion = hasInfix "/" ip;
+            message = "networking.wireguard.interfaces.${name}.ips value \"${ip}\" requires a subnet (e.g. 192.0.2.1/32) with networkd.";
+          }
+        ])
+        ++ flip concatMap interface.peers (peer: [
+          # Peer assertions
+          {
+            assertion = peer.presharedKey == null;
+            message = "networking.wireguard.interfaces.${name}.peers[].presharedKey cannot be used with networkd. Use presharedKeyFile instead.";
+          }
+          {
+            assertion = peer.dynamicEndpointRefreshSeconds == null;
+            message = "networking.wireguard.interfaces.${name}.peers[].dynamicEndpointRefreshSeconds cannot be used with networkd. Use networking.wireguard.interfaces.${name}.dynamicEndpointRefreshSeconds instead.";
+          }
+          {
+            assertion = peer.dynamicEndpointRefreshRestartSeconds == null;
+            message = "networking.wireguard.interfaces.${name}.peers[].dynamicEndpointRefreshRestartSeconds cannot be used with networkd.";
+          }
+        ])
+      )
+    );
+
+    systemd.network = {
+      enable = true;
+      netdevs = mapAttrs' generateNetdev cfg.interfaces;
+      networks = mapAttrs generateNetwork cfg.interfaces;
+    };
+
+    systemd.timers = mapAttrs' generateRefreshTimer refreshEnabledInterfaces;
+    systemd.services = mapAttrs' generateRefreshService refreshEnabledInterfaces;
+  };
+}

nixos/modules/services/networking/wireguard.nix

@@ -49,6 +49,9 @@ let
         default = null;
         description = ''
           Private key file as generated by {command}`wg genkey`.
+
+          When {option}`networking.wireguard.useNetworkd` is enabled, this file
+          must be readable by the `systemd-network` user.
         '';
       };
 
@@ -182,6 +185,28 @@ let
           Set the metric of routes related to this Wireguard interface.
         '';
       };
+
+      dynamicEndpointRefreshSeconds = mkOption {
+        default = 0;
+        example = 300;
+        type = with types; int;
+        description = ''
+          Periodically refresh the endpoint hostname or address for all peers.
+          Allows WireGuard to notice DNS and IPv4/IPv6 connectivity changes.
+          This option can be set or overridden for individual peers.
+
+          Setting this to `0` disables periodic refresh.
+
+          ::: {.warning}
+          When {option}`networking.wireguard.useNetworkd` is enabled, this
+          option deletes the Wireguard interface and brings it back up by
+          reconfiguring the network with `networkctl reload` on every refresh.
+          This could have adverse effects on your network and cause brief
+          connectivity blips. See [systemd/systemd#9911](https://github.com/systemd/systemd/issues/9911)
+          for an upstream feature request that can make this less hacky.
+          :::
+        '';
+      };
     };
 
   };
@@ -234,6 +259,9 @@ let
           Optional, and may be omitted. This option adds an additional layer of
           symmetric-key cryptography to be mixed into the already existing
           public-key cryptography, for post-quantum resistance.
+
+          When {option}`networking.wireguard.useNetworkd` is enabled, this file
+          must be readable by the `systemd-network` user.
         '';
       };
 
@@ -269,15 +297,21 @@ let
       };
 
       dynamicEndpointRefreshSeconds = mkOption {
-        default = 0;
+        default = null;
+        defaultText = literalExpression "config.networking.wireguard.interfaces.<name>.dynamicEndpointRefreshSeconds";
         example = 5;
-        type = with types; int;
+        type = with types; nullOr int;
         description = ''
           Periodically re-execute the `wg` utility every
           this many seconds in order to let WireGuard notice DNS / hostname
           changes.
 
           Setting this to `0` disables periodic reexecution.
+
+          ::: {.note}
+          This peer-level setting is not available when {option}`networking.wireguard.useNetworkd`
+          is enabled. The interface-level setting may be used instead.
+          :::
         '';
       };
 
@@ -349,6 +383,11 @@ let
     in
       "wireguard-${interfaceName}-peer-${peerName}${refreshSuffix}";
 
+  dynamicRefreshSeconds = interfaceCfg: peer:
+    if peer.dynamicEndpointRefreshSeconds != null
+    then peer.dynamicEndpointRefreshSeconds
+    else interfaceCfg.dynamicEndpointRefreshSeconds;
+
   generatePeerUnit = { interfaceName, interfaceCfg, peer }:
     let
       psk =
@@ -359,7 +398,8 @@ let
       dst = interfaceCfg.interfaceNamespace;
       ip = nsWrap "ip" src dst;
       wg = nsWrap "wg" src dst;
-      dynamicRefreshEnabled = peer.dynamicEndpointRefreshSeconds != 0;
+      dynamicEndpointRefreshSeconds = dynamicRefreshSeconds interfaceCfg peer;
+      dynamicRefreshEnabled = dynamicEndpointRefreshSeconds != 0;
       # We generate a different name (a `-refresh` suffix) when `dynamicEndpointRefreshSeconds`
       # to avoid that the same service switches `Type` (`oneshot` vs `simple`),
       # with the intent to make scripting more obvious.
@@ -395,7 +435,7 @@ let
                 Restart = "always";
                 RestartSec = if null != peer.dynamicEndpointRefreshRestartSeconds
                              then peer.dynamicEndpointRefreshRestartSeconds
-                             else peer.dynamicEndpointRefreshSeconds;
+                             else dynamicEndpointRefreshSeconds;
               };
         unitConfig = lib.optionalAttrs dynamicRefreshEnabled {
           StartLimitIntervalSec = 0;
@@ -419,13 +459,13 @@ let
           ${wg_setup}
           ${route_setup}
 
-          ${optionalString (peer.dynamicEndpointRefreshSeconds != 0) ''
+          ${optionalString (dynamicEndpointRefreshSeconds != 0) ''
             # Re-execute 'wg' periodically to notice DNS / hostname changes.
             # Note this will not time out on transient DNS failures such as DNS names
             # because we have set 'WG_ENDPOINT_RESOLUTION_RETRIES=infinity'.
             # Also note that 'wg' limits its maximum retry delay to 20 seconds as of writing.
             while ${wg_setup}; do
-              sleep "${toString peer.dynamicEndpointRefreshSeconds}";
+              sleep "${toString dynamicEndpointRefreshSeconds}";
             done
           ''}
         '';
@@ -445,7 +485,7 @@ let
   # the target is required to start new peer units when they are added
   generateInterfaceTarget = name: values:
     let
-      mkPeerUnit = peer: (peerUnitServiceName name peer.name (peer.dynamicEndpointRefreshSeconds != 0)) + ".service";
+      mkPeerUnit = peer: (peerUnitServiceName name peer.name (dynamicRefreshSeconds values peer != 0)) + ".service";
     in
     nameValuePair "wireguard-${name}"
       rec {
@@ -530,9 +570,10 @@ in
         description = ''
           Whether to enable WireGuard.
 
-          Please note that {option}`systemd.network.netdevs` has more features
-          and is better maintained. When building new things, it is advised to
-          use that instead.
+          ::: {.note}
+          By default, this module is powered by a script-based backend. You can
+          enable the networkd backend with {option}`networking.wireguard.useNetworkd`.
+          :::
         '';
         type = types.bool;
         # 2019-05-25: Backwards compatibility.
@@ -544,10 +585,6 @@ in
       interfaces = mkOption {
         description = ''
           WireGuard interfaces.
-
-          Please note that {option}`systemd.network.netdevs` has more features
-          and is better maintained. When building new things, it is advised to
-          use that instead.
         '';
         default = {};
         example = {
@@ -597,13 +634,13 @@ in
     boot.kernelModules = [ "wireguard" ];
     environment.systemPackages = [ pkgs.wireguard-tools ];
 
-    systemd.services =
+    systemd.services = mkIf (!cfg.useNetworkd) (
       (mapAttrs' generateInterfaceUnit cfg.interfaces)
       // (listToAttrs (map generatePeerUnit all_peers))
       // (mapAttrs' generateKeyServiceUnit
-      (filterAttrs (name: value: value.generatePrivateKeyFile) cfg.interfaces));
+      (filterAttrs (name: value: value.generatePrivateKeyFile) cfg.interfaces)));
 
-      systemd.targets = mapAttrs' generateInterfaceTarget cfg.interfaces;
+      systemd.targets = mkIf (!cfg.useNetworkd) (mapAttrs' generateInterfaceTarget cfg.interfaces);
     }
   );
 

nixos/modules/services/x11/desktop-managers/cinnamon.nix

@@ -135,6 +135,17 @@ in
       };
 
       environment.systemPackages = with pkgs; ([
+        # Teach nemo-desktop how to launch file browser.
+        # https://github.com/linuxmint/nemo/blob/6.4.0/src/nemo-desktop-application.c#L398
+        (writeTextFile {
+          name = "x-cinnamon-mimeapps";
+          destination = "/share/applications/x-cinnamon-mimeapps.list";
+          text = ''
+            [Default Applications]
+            inode/directory=nemo.desktop
+          '';
+        })
+
         desktop-file-utils
 
         # common-files

nixos/tests/apparmor.nix

@@ -1,6 +1,6 @@
 import ./make-test-python.nix ({ pkgs, lib, ... } : {
   name = "apparmor";
-  meta.maintainers = with lib.maintainers; [ julm ];
+  meta.maintainers = with lib.maintainers; [ julm grimmauld ];
 
   nodes.machine =
     { lib, pkgs, config, ... }:

nixos/tests/wireguard/default.nix

@@ -11,9 +11,12 @@ let
   tests = let callTest = p: args: import p ({ inherit system pkgs; } // args); in {
     basic = callTest ./basic.nix;
     namespaces = callTest ./namespaces.nix;
+    networkd = callTest ./networkd.nix;
     wg-quick = callTest ./wg-quick.nix;
     wg-quick-nftables = args: callTest ./wg-quick.nix ({ nftables = true; } // args);
     generated = callTest ./generated.nix;
+    dynamic-refresh = callTest ./dynamic-refresh.nix;
+    dynamic-refresh-networkd = args: callTest ./dynamic-refresh.nix ({ useNetworkd = true; } // args);
   };
 in
 

nixos/tests/wireguard/dynamic-refresh.nix

@@ -0,0 +1,102 @@
+import ../make-test-python.nix (
+  {
+    pkgs,
+    lib,
+    kernelPackages ? null,
+    useNetworkd ? false,
+    ...
+  }:
+  let
+    wg-snakeoil-keys = import ./snakeoil-keys.nix;
+  in
+  {
+    name = "wireguard-dynamic-refresh";
+    meta = with lib.maintainers; {
+      maintainers = [ majiir ];
+    };
+
+    nodes = {
+      server = {
+        virtualisation.vlans = [
+          1
+          2
+        ];
+        boot = lib.mkIf (kernelPackages != null) { inherit kernelPackages; };
+        networking.firewall.allowedUDPPorts = [ 23542 ];
+        networking.useDHCP = false;
+        networking.wireguard.useNetworkd = useNetworkd;
+        networking.wireguard.interfaces.wg0 = {
+          ips = [ "10.23.42.1/32" ];
+          listenPort = 23542;
+
+          # !!! Don't do this with real keys. The /nix store is world-readable!
+          privateKeyFile = toString (pkgs.writeText "privateKey" wg-snakeoil-keys.peer0.privateKey);
+
+          peers = lib.singleton {
+            allowedIPs = [ "10.23.42.2/32" ];
+
+            inherit (wg-snakeoil-keys.peer1) publicKey;
+          };
+        };
+      };
+
+      client =
+        { nodes, ... }:
+        {
+          virtualisation.vlans = [
+            1
+            2
+          ];
+          boot = lib.mkIf (kernelPackages != null) { inherit kernelPackages; };
+          networking.useDHCP = false;
+          networking.wireguard.useNetworkd = useNetworkd;
+          networking.wireguard.interfaces.wg0 = {
+            ips = [ "10.23.42.2/32" ];
+
+            # !!! Don't do this with real keys. The /nix store is world-readable!
+            privateKeyFile = toString (pkgs.writeText "privateKey" wg-snakeoil-keys.peer1.privateKey);
+
+            dynamicEndpointRefreshSeconds = 2;
+
+            peers = lib.singleton {
+              allowedIPs = [
+                "0.0.0.0/0"
+                "::/0"
+              ];
+              endpoint = "server:23542";
+
+              inherit (wg-snakeoil-keys.peer0) publicKey;
+            };
+          };
+
+          specialisation.update-hosts.configuration = {
+            networking.extraHosts =
+              let
+                testCfg = nodes.server.virtualisation.test;
+              in
+              lib.mkForce "192.168.2.${toString testCfg.nodeNumber} ${testCfg.nodeName}";
+          };
+        };
+    };
+
+    testScript =
+      { nodes, ... }:
+      ''
+        start_all()
+
+        server.wait_for_unit("network-online.target")
+        client.wait_for_unit("network-online.target")
+
+        client.succeed("ping -n -w 1 -c 1 10.23.42.1")
+
+        client.succeed("ip link set down eth1")
+
+        client.fail("ping -n -w 1 -c 1 10.23.42.1")
+
+        with client.nested("update hosts file"):
+          client.succeed("${nodes.client.system.build.toplevel}/specialisation/update-hosts/bin/switch-to-configuration test")
+
+        client.succeed("sleep 5 && ping -n -w 1 -c 1 10.23.42.1")
+      '';
+  }
+)

nixos/tests/wireguard/networkd.nix

@@ -0,0 +1,89 @@
+import ../make-test-python.nix (
+  {
+    pkgs,
+    lib,
+    kernelPackages ? null,
+    ...
+  }:
+  let
+    wg-snakeoil-keys = import ./snakeoil-keys.nix;
+    peer = (import ./make-peer.nix) { inherit lib; };
+  in
+  {
+    name = "wireguard-networkd";
+    meta = with pkgs.lib.maintainers; {
+      maintainers = [ majiir ];
+    };
+
+    nodes = {
+      peer0 = peer {
+        ip4 = "192.168.0.1";
+        ip6 = "fd00::1";
+        extraConfig = {
+          boot = lib.mkIf (kernelPackages != null) { inherit kernelPackages; };
+          networking.firewall.allowedUDPPorts = [ 23542 ];
+          networking.wireguard.useNetworkd = true;
+          networking.wireguard.interfaces.wg0 = {
+            ips = [
+              "10.23.42.1/32"
+              "fc00::1/128"
+            ];
+            listenPort = 23542;
+
+            # !!! Don't do this with real keys. The /nix store is world-readable!
+            privateKeyFile = toString (pkgs.writeText "privateKey" wg-snakeoil-keys.peer0.privateKey);
+
+            peers = lib.singleton {
+              allowedIPs = [
+                "10.23.42.2/32"
+                "fc00::2/128"
+              ];
+
+              inherit (wg-snakeoil-keys.peer1) publicKey;
+            };
+          };
+        };
+      };
+
+      peer1 = peer {
+        ip4 = "192.168.0.2";
+        ip6 = "fd00::2";
+        extraConfig = {
+          boot = lib.mkIf (kernelPackages != null) { inherit kernelPackages; };
+          networking.wireguard.useNetworkd = true;
+          networking.wireguard.interfaces.wg0 = {
+            ips = [
+              "10.23.42.2/32"
+              "fc00::2/128"
+            ];
+            listenPort = 23542;
+
+            # !!! Don't do this with real keys. The /nix store is world-readable!
+            privateKeyFile = toString (pkgs.writeText "privateKey" wg-snakeoil-keys.peer1.privateKey);
+
+            peers = lib.singleton {
+              allowedIPs = [
+                "0.0.0.0/0"
+                "::/0"
+              ];
+              endpoint = "192.168.0.1:23542";
+              persistentKeepalive = 25;
+
+              inherit (wg-snakeoil-keys.peer0) publicKey;
+            };
+          };
+        };
+      };
+    };
+
+    testScript = ''
+      start_all()
+
+      peer0.wait_for_unit("systemd-networkd-wait-online.service")
+      peer1.wait_for_unit("systemd-networkd-wait-online.service")
+
+      peer1.succeed("ping -c5 fc00::1")
+      peer1.succeed("ping -c5 10.23.42.1")
+    '';
+  }
+)

pkgs/applications/audio/pragha/default.nix

@@ -22,7 +22,7 @@
 , libcdio-paranoia, withCD ? true
 , keybinder3, withKeybinder ? false
 , libnotify, withLibnotify ? false
-, libsoup, withLibsoup ? false
+, libsoup_2_4, withLibsoup ? false
 , libgudev, withGudev ? false # experimental
 , libmtp, withMtp ? false # experimental
 , xfce, withXfce4ui ? false
@@ -73,7 +73,7 @@ mkDerivation rec {
   ++ lib.optional withLibnotify libnotify
   ++ lib.optional withLastfm liblastfmSF
   ++ lib.optional withGlyr glyr
-  ++ lib.optional withLibsoup libsoup
+  ++ lib.optional withLibsoup libsoup_2_4
   ++ lib.optional withMtp libmtp
   ++ lib.optional withXfce4ui xfce.libxfce4ui
   ++ lib.optional withTotemPlParser totem-pl-parser

pkgs/applications/audio/quodlibet/default.nix

@@ -20,8 +20,7 @@
   libappindicator-gtk3,
   libmodplug,
   librsvg,
-  libsoup,
-  webkitgtk_4_0,
+  libsoup_3,
 
   # optional features
   withDbusPython ? false,
@@ -89,8 +88,7 @@ python3.pkgs.buildPythonApplication {
       keybinder3
       libappindicator-gtk3
       libmodplug
-      libsoup
-      webkitgtk_4_0
+      libsoup_3
     ]
     ++ lib.optionals (withXineBackend) [ xine-lib ]
     ++ lib.optionals (withGstreamerBackend) (

pkgs/applications/editors/vim/plugins/generated.nix

@@ -1037,6 +1037,18 @@ final: prev:
     meta.homepage = "https://github.com/yetone/avante.nvim/";
   };
 
+  aw-watcher-vim = buildVimPlugin {
+    pname = "aw-watcher-vim";
+    version = "2023-10-09";
+    src = fetchFromGitHub {
+      owner = "ActivityWatch";
+      repo = "aw-watcher-vim";
+      rev = "4ba86d05a940574000c33f280fd7f6eccc284331";
+      sha256 = "0kzpr2dgn80lcqbbf9ig6vx7azz6vbvadi31mxb0qyd91fyiidi3";
+    };
+    meta.homepage = "https://github.com/ActivityWatch/aw-watcher-vim/";
+  };
+
   awesome-vim-colorschemes = buildVimPlugin {
     pname = "awesome-vim-colorschemes";
     version = "2024-05-18";

pkgs/applications/editors/vim/plugins/overrides.nix

@@ -258,6 +258,15 @@ in
     }
   );
 
+  aw-watcher-vim = super.aw-watcher-vim.overrideAttrs {
+    patches = [
+      (substituteAll {
+        src = ./patches/aw-watcher-vim/program_paths.patch;
+        curl = lib.getExe curl;
+      })
+    ];
+  };
+
   bamboo-nvim = super.bamboo-nvim.overrideAttrs {
     nvimSkipModule = [
       # Requires config table

pkgs/applications/editors/vim/plugins/patches/aw-watcher-vim/program_paths.patch

@@ -0,0 +1,13 @@
+diff --git a/plugin/activitywatch.vim b/plugin/activitywatch.vim
+index 6986553..7462b02 100644
+--- a/plugin/activitywatch.vim
++++ b/plugin/activitywatch.vim
+@@ -29,7 +29,7 @@ let s:heartbeat_apiurl = printf('%s/heartbeat?pulsetime=30', s:bucket_apiurl)
+ let s:http_response_code = {}
+ 
+ function! HTTPPostJson(url, data)
+-    let l:req = ['curl', '-s', a:url,
++    let l:req = ['@curl@', '-s', a:url,
+         \ '-H', 'Content-Type: application/json',
+         \ '-X', 'POST',
+         \ '-d', json_encode(a:data),

pkgs/applications/graphics/eddy/default.nix

@@ -8,13 +8,13 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "eddy";
-  version = "1.2.1";
+  version = "3.6";
 
   src = fetchFromGitHub {
     owner = "obdasystems";
     repo = pname;
-    rev = "v${version}";
-    sha256 = "12j77bbva5py9bd57c80cmjvf8vll40h19n81h16lvv2r2r7jynh";
+    rev = "refs/tags/v${version}";
+    sha256 = "sha256-vRmLUIqU0qfcnKzymBGb9gfM/uQiAcUHUnyz8iH/GrM=";
   };
 
   propagatedBuildInputs = [

pkgs/applications/graphics/inkscape/default.nix

@@ -27,7 +27,7 @@
 , librevenge
 , librsvg
 , libsigcxx
-, libsoup
+, libsoup_2_4
 , libvisio
 , libwpg
 , libXft
@@ -155,7 +155,7 @@ stdenv.mkDerivation rec {
     librevenge
     librsvg # for loading icons
     libsigcxx
-    libsoup
+    libsoup_2_4
     libvisio
     libwpg
     libXft

pkgs/applications/networking/browsers/chromium/info.json

@@ -766,7 +766,7 @@
     }
   },
   "ungoogled-chromium": {
-    "version": "131.0.6778.85",
+    "version": "131.0.6778.108",
     "deps": {
       "depot_tools": {
         "rev": "20b9bdcace7ed561d6a75728c85373503473cb6b",
@@ -777,16 +777,16 @@
         "hash": "sha256-a8yCdBsl0nBMPS+pCLwrkAvQNP/THx/z/GySyOgx4Jk="
       },
       "ungoogled-patches": {
-        "rev": "131.0.6778.85-1",
-        "hash": "sha256-mcSshjdfUEH4ur4z+0P0oWCjlV8EhFMc+7rdfIIPASI="
+        "rev": "131.0.6778.108-1",
+        "hash": "sha256-xFtxgZRbtG8qxvTyt++wa69dQvr61K29mTubkxoI1Y8="
       },
       "npmHash": "sha256-b1l8SwjAfoColoa3zhTMPEF/rRuxzT3ATHE77rWU5EA="
     },
     "DEPS": {
       "src": {
         "url": "https://chromium.googlesource.com/chromium/src.git",
-        "rev": "3d81e41b6f3ac8bcae63b32e8145c9eb0cd60a2d",
-        "hash": "sha256-fREToEHVbTD0IVGx/sn7csSju4BYajWZ+LDCiKWV4cI=",
+        "rev": "3b014839fbc4fb688b2f5af512d6ce312ad208b1",
+        "hash": "sha256-ypzu3LveMFcOFm7+JlaERjzs3SK/n9+sfm5wOKB8/zw=",
         "recompress": true
       },
       "src/third_party/clang-format/script": {
@@ -886,8 +886,8 @@
       },
       "src/third_party/dawn": {
         "url": "https://dawn.googlesource.com/dawn.git",
-        "rev": "7e742cac42c29a14ab7f54b134b2f17592711267",
-        "hash": "sha256-K2gwKNwonzCIu4hnlYuOaYyKaRV11hwDzF4oykiKsl0="
+        "rev": "740d2502dbbd719a76c5a8d3fb4dac1b5363f42e",
+        "hash": "sha256-R41YVv4uWCU6SsACXPRppeCDguTs+/NVJckvMGGTgJE="
       },
       "src/third_party/dawn/third_party/glfw": {
         "url": "https://chromium.googlesource.com/external/github.com/glfw/glfw",
@@ -1366,8 +1366,8 @@
       },
       "src/third_party/skia": {
         "url": "https://skia.googlesource.com/skia.git",
-        "rev": "94631d9b9a10697325589e1642af63a0137cac94",
-        "hash": "sha256-SKKLOxjimQWt8W+Q3wlCJaUC/lxw6EIZDFBuVQKmnVY="
+        "rev": "f14f6b1ab7cf544c0190074488d17821281cfa4d",
+        "hash": "sha256-0p57otDuIShl6MngYs22XA1QYxptDVa3vCwJsH59H34="
       },
       "src/third_party/smhasher/src": {
         "url": "https://chromium.googlesource.com/external/smhasher.git",
@@ -1491,8 +1491,8 @@
       },
       "src/third_party/webrtc": {
         "url": "https://webrtc.googlesource.com/src.git",
-        "rev": "8445abdf8069cadcbd134369b70d0ebd436ef477",
-        "hash": "sha256-EitEjXNtm0gB9wtAwIYHBHkU7paHg5zvsTz171hRmK4="
+        "rev": "79aff54b0fa9238ce3518dd9eaf9610cd6f22e82",
+        "hash": "sha256-xkMnUduSG88EWiwq6PITN0KgAKjFd4QOis3dgxedK30="
       },
       "src/third_party/wuffs/src": {
         "url": "https://skia.googlesource.com/external/github.com/google/wuffs-mirror-release-c.git",
@@ -1526,8 +1526,8 @@
       },
       "src/v8": {
         "url": "https://chromium.googlesource.com/v8/v8.git",
-        "rev": "bd2671b973062afc614b852ec190524b80aaef8a",
-        "hash": "sha256-uq0CE7Chqzy2d+iifC3hV9RTnDVinpwjl1pOzyNGbSo="
+        "rev": "e38771cb283b9689683c5ac0b5831dd89f8ec690",
+        "hash": "sha256-csSDnepYxil0R3PD/LVxW7JBcasOKG4l6q6vj8zHV/I="
       }
     }
   }

pkgs/applications/networking/browsers/chromium/update.mjs

@@ -29,26 +29,31 @@ const flush_to_file_proxy = {
   },
 }
 const lockfile = new Proxy(structuredClone(lockfile_initial), flush_to_file_proxy)
-
+const ungoogled_rev = argv['ungoogled-chromium-rev']
 
 for (const attr_path of Object.keys(lockfile)) {
-  if (!argv[attr_path]) {
+  const ungoogled = attr_path === 'ungoogled-chromium'
+
+  if (!argv[attr_path] && !(ungoogled && ungoogled_rev)) {
     console.log(`[${attr_path}] Skipping ${attr_path}. Pass --${attr_path} as argument to update.`)
     continue
   }
 
-  const ungoogled = attr_path === 'ungoogled-chromium'
   const version_nixpkgs = !ungoogled ? lockfile[attr_path].version : lockfile[attr_path].deps['ungoogled-patches'].rev
-  const version_upstream = !ungoogled ? await get_latest_chromium_release() : await get_latest_ungoogled_release()
+  const version_upstream = !ungoogled ? await get_latest_chromium_release() :
+    ungoogled_rev ?? await get_latest_ungoogled_release()
 
   console.log(`[${attr_path}] ${chalk.red(version_nixpkgs)} (nixpkgs)`)
   console.log(`[${attr_path}] ${chalk.green(version_upstream)} (upstream)`)
 
-  if (version_greater_than(version_upstream, version_nixpkgs)) {
+  if (ungoogled_rev || version_greater_than(version_upstream, version_nixpkgs)) {
     console.log(`[${attr_path}] ${chalk.green(version_upstream)} from upstream is newer than our ${chalk.red(version_nixpkgs)}...`)
 
-    // unconditionally remove ungoogled-chromium's epoch/sub-version (e.g. 130.0.6723.116-1 -> 130.0.6723.116)
-    const version_chromium = version_upstream.split('-')[0]
+    let ungoogled_patches = ungoogled ? await fetch_ungoogled(version_upstream) : undefined
+
+    // For ungoogled-chromium we need to remove the patch revision (e.g. 130.0.6723.116-1 -> 130.0.6723.116)
+    // by just using the chromium_version.txt content from the patches checkout (to also work with commit revs).
+    const version_chromium = ungoogled_patches?.chromium_version ?? version_upstream
 
     const chromium_rev = await chromium_resolve_tag_to_rev(version_chromium)
 
@@ -58,7 +63,10 @@ for (const attr_path of Object.keys(lockfile)) {
       deps: {
         depot_tools: {},
         gn: {},
-        'ungoogled-patches': ungoogled ? await fetch_ungoogled(version_upstream) : undefined,
+        'ungoogled-patches': !ungoogled ? undefined : {
+          rev: ungoogled_patches.rev,
+          hash: ungoogled_patches.hash,
+        },
         npmHash: dummy_hash,
       },
       DEPS: {},
@@ -187,13 +195,19 @@ async function fetch_ungoogled(rev) {
   const expr = (hash) => [`(import ./. {}).fetchFromGitHub { owner = "ungoogled-software"; repo = "ungoogled-chromium"; rev = "${rev}"; hash = "${hash}"; }`]
   const hash = await prefetch_FOD('--expr', expr(''))
 
-  const checkout = await $nixpkgs`nix-build  --expr ${expr(hash)}`
+  const checkout = await $nixpkgs`nix-build --expr ${expr(hash)}`
+  const checkout_path = checkout.stdout.trim()
 
-  await fs.copy(`${checkout.stdout.trim()}/flags.gn`, './ungoogled-flags.toml')
+  await fs.copy(path.join(checkout_path, 'flags.gn'), './ungoogled-flags.toml')
+
+  const chromium_version = (await fs.readFile(path.join(checkout_path, 'chromium_version.txt'))).toString().trim()
+
+  console.log(`[ungoogled-chromium] ${chalk.green(rev)} patch revision resolves to chromium version ${chalk.green(chromium_version)}`)
 
   return {
     rev,
     hash,
+    chromium_version,
   }
 }
 

pkgs/applications/networking/browsers/surf/default.nix

@@ -1,6 +1,6 @@
 { lib, stdenv, fetchgit
 , pkg-config, wrapGAppsHook3
-, glib, gcr, glib-networking, gsettings-desktop-schemas, gtk, libsoup, webkitgtk_4_0
+, glib, gcr, glib-networking, gsettings-desktop-schemas, gtk, libsoup_2_4, webkitgtk_4_0
 , xorg, dmenu, findutils, gnused, coreutils, gst_all_1
 , patches ? null
 }:
@@ -23,7 +23,7 @@ stdenv.mkDerivation rec {
     glib-networking
     gsettings-desktop-schemas
     gtk
-    libsoup
+    libsoup_2_4
     webkitgtk_4_0
   ] ++ (with gst_all_1; [
     # Audio & video support for webkitgtk WebView

pkgs/applications/networking/instant-messengers/dino/default.nix

@@ -3,7 +3,7 @@
 , vala, cmake, ninja, wrapGAppsHook4, pkg-config, gettext
 , gobject-introspection, glib, gdk-pixbuf, gtk4, glib-networking
 , libadwaita
-, libnotify, libsoup, libgee
+, libnotify, libsoup_2_4, libgee
 , libsignal-protocol-c
 , libgcrypt
 , sqlite
@@ -62,7 +62,7 @@ stdenv.mkDerivation (finalAttrs: {
     libnotify
     gpgme
     libgcrypt
-    libsoup
+    libsoup_2_4
     pcre2
     icu
     libsignal-protocol-c
@@ -90,7 +90,7 @@ stdenv.mkDerivation (finalAttrs: {
     "-DXGETTEXT_EXECUTABLE=${lib.getBin buildPackages.gettext}/bin/xgettext"
     "-DMSGFMT_EXECUTABLE=${lib.getBin buildPackages.gettext}/bin/msgfmt"
     "-DGLIB_COMPILE_RESOURCES_EXECUTABLE=${lib.getDev buildPackages.glib}/bin/glib-compile-resources"
-    "-DSOUP_VERSION=${lib.versions.major libsoup.version}"
+    "-DSOUP_VERSION=${lib.versions.major libsoup_2_4.version}"
   ];
 
   # Undefined symbols for architecture arm64: "_gpg_strerror"

pkgs/applications/networking/instant-messengers/discord/default.nix

@@ -10,16 +10,16 @@ let
     if stdenv.hostPlatform.isLinux then
       {
         stable = "0.0.76";
-        ptb = "0.0.118";
-        canary = "0.0.528";
-        development = "0.0.50";
+        ptb = "0.0.121";
+        canary = "0.0.535";
+        development = "0.0.53";
       }
     else
       {
-        stable = "0.0.327";
-        ptb = "0.0.148";
-        canary = "0.0.639";
-        development = "0.0.65";
+        stable = "0.0.328";
+        ptb = "0.0.151";
+        canary = "0.0.647";
+        development = "0.0.67";
       };
   version = versions.${branch};
   srcs = rec {
@@ -30,33 +30,33 @@ let
       };
       ptb = fetchurl {
         url = "https://ptb.dl2.discordapp.net/apps/linux/${version}/discord-ptb-${version}.tar.gz";
-        hash = "sha256-msheT6PXTkIq7EwowYwL7g0kgOdLBZHeI5w2kijJUtw=";
+        hash = "sha256-Zaf6Pg6xeSyiIFJMlT+VkE/sXJULSqGzGHmK5MpBuhg=";
       };
       canary = fetchurl {
         url = "https://canary.dl2.discordapp.net/apps/linux/${version}/discord-canary-${version}.tar.gz";
-        hash = "sha256-ajQHWSpjpuadFlT5WVXsSZf5Ng8ta4SyGbZp7TTb+8Q=";
+        hash = "sha256-YUuqkhb04nTTdL6W6VB0ampp3qEi0Gj5iz3lCt7AfMA=";
       };
       development = fetchurl {
         url = "https://development.dl2.discordapp.net/apps/linux/${version}/discord-development-${version}.tar.gz";
-        hash = "sha256-Ygwneo9GY1iVKBl3y6jSj81sexUsSY2J7i/DKxmJJyA=";
+        hash = "sha256-4FxdZsVTQTr5yzuzV6IZYZ6qk7sa9WZ27zCtVA1/uOg=";
       };
     };
     x86_64-darwin = {
       stable = fetchurl {
         url = "https://stable.dl2.discordapp.net/apps/osx/${version}/Discord.dmg";
-        hash = "sha256-5XzjJv2IebVMVml/e+VTVKrlbHTCj+t0lYsq1CwvLi0=";
+        hash = "sha256-yYQHoBv3Cco07WQhS8+BruV1gjGZti+bTS+jlRg0u14=";
       };
       ptb = fetchurl {
         url = "https://ptb.dl2.discordapp.net/apps/osx/${version}/DiscordPTB.dmg";
-        hash = "sha256-YW6wgiplt+ue59i5+2Ap5tVAEhO1xgeP8jVOffkSWj4=";
+        hash = "sha256-R8R3r2i/+ru+82OBGBmF+Kn502RK/64VwtbdRVSwj0g=";
       };
       canary = fetchurl {
         url = "https://canary.dl2.discordapp.net/apps/osx/${version}/DiscordCanary.dmg";
-        hash = "sha256-C+2Cr8D2ZqfdRp0m996p8HvOjkPzN82ywgbx2KMBqAE=";
+        hash = "sha256-GbR6XLK+2jBHGdvWeZv3HXbCr4mylBrdY/3rCFCkeCY=";
       };
       development = fetchurl {
         url = "https://development.dl2.discordapp.net/apps/osx/${version}/DiscordDevelopment.dmg";
-        hash = "sha256-IckTw2wKTwGMGvQAOYG85yU1w9E6PdWA1G0f2BaXJ1Q=";
+        hash = "sha256-nyOQhSjlARvIjFc3uDi7IFtKxxIpO/V6M1eIg56dMdU=";
       };
     };
     aarch64-darwin = x86_64-darwin;

pkgs/applications/networking/remote/citrix-workspace/generic.nix

@@ -1,6 +1,6 @@
 { lib, stdenv, requireFile, makeWrapper, autoPatchelfHook, wrapGAppsHook3, which, more
 , file, atk, alsa-lib, cairo, fontconfig, gdk-pixbuf, glib, webkitgtk_4_0, gtk2-x11, gtk3
-, heimdal, krb5, libsoup, libvorbis, speex, openssl, zlib, xorg, pango, gtk2
+, heimdal, krb5, libsoup_2_4, libvorbis, speex, openssl, zlib, xorg, pango, gtk2
 , gnome2, libgbm, nss, nspr, gtk_engines, freetype, dconf, libpng12, libxml2
 , libjpeg, libredirect, tzdata, cacert, systemd, libcxx, symlinkJoin
 , libpulseaudio, pcsclite, glib-networking, llvmPackages_12, opencv4
@@ -103,7 +103,7 @@ stdenv.mkDerivation rec {
     libpng12
     libpulseaudio
     libsecret
-    libsoup
+    libsoup_2_4
     libvorbis
     libxml2
     llvmPackages_12.libunwind

pkgs/applications/office/grisbi/default.nix

@@ -6,7 +6,7 @@
 , libofx
 , intltool
 , wrapGAppsHook3
-, libsoup
+, libsoup_2_4
 , adwaita-icon-theme
 }:
 
@@ -24,7 +24,7 @@ stdenv.mkDerivation rec {
     gtk
     libgsf
     libofx
-    libsoup
+    libsoup_2_4
     adwaita-icon-theme
   ];
 

pkgs/build-support/build-fhsenv-bubblewrap/default.nix

@@ -1,32 +1,34 @@
-{ lib
-, stdenv
-, callPackage
-, runCommandLocal
-, writeShellScript
-, glibc
-, pkgsHostTarget
-, runCommandCC
-, coreutils
-, bubblewrap
+{
+  lib,
+  stdenv,
+  callPackage,
+  runCommandLocal,
+  writeShellScript,
+  glibc,
+  pkgsHostTarget,
+  runCommandCC,
+  coreutils,
+  bubblewrap,
 }:
 
-{ runScript ? "bash"
-, nativeBuildInputs ? []
-, extraInstallCommands ? ""
-, meta ? {}
-, passthru ? {}
-, extraPreBwrapCmds ? ""
-, extraBwrapArgs ? []
-, unshareUser ? false
-, unshareIpc ? false
-, unsharePid ? false
-, unshareNet ? false
-, unshareUts ? false
-, unshareCgroup ? false
-, privateTmp ? false
-, dieWithParent ? true
-, ...
-} @ args:
+{
+  runScript ? "bash",
+  nativeBuildInputs ? [ ],
+  extraInstallCommands ? "",
+  meta ? { },
+  passthru ? { },
+  extraPreBwrapCmds ? "",
+  extraBwrapArgs ? [ ],
+  unshareUser ? false,
+  unshareIpc ? false,
+  unsharePid ? false,
+  unshareNet ? false,
+  unshareUts ? false,
+  unshareCgroup ? false,
+  privateTmp ? false,
+  dieWithParent ? true,
+  ...
+}@args:
 
 assert (!args ? pname || !args ? version) -> (args ? name); # You must provide name if pname or version (preferred) is missing.
 
@@ -49,59 +51,82 @@ let
   name = args.name or "${args.pname}-${args.version}";
   executableName = args.pname or args.name;
   # we don't know which have been supplied, and want to avoid defaulting missing attrs to null. Passed into runCommandLocal
-  nameAttrs = lib.filterAttrs (key: value: builtins.elem key [ "name" "pname" "version" ]) args;
+  nameAttrs = lib.filterAttrs (
+    key: value:
+    builtins.elem key [
+      "name"
+      "pname"
+      "version"
+    ]
+  ) args;
 
   buildFHSEnv = callPackage ./buildFHSEnv.nix { };
 
-  fhsenv = buildFHSEnv (removeAttrs args [
-    "runScript" "extraInstallCommands" "meta" "passthru" "extraPreBwrapCmds" "extraBwrapArgs" "dieWithParent"
-    "unshareUser" "unshareCgroup" "unshareUts" "unshareNet" "unsharePid" "unshareIpc" "privateTmp"
-  ]);
+  fhsenv = buildFHSEnv (
+    removeAttrs args [
+      "runScript"
+      "extraInstallCommands"
+      "meta"
+      "passthru"
+      "extraPreBwrapCmds"
+      "extraBwrapArgs"
+      "dieWithParent"
+      "unshareUser"
+      "unshareCgroup"
+      "unshareUts"
+      "unshareNet"
+      "unsharePid"
+      "unshareIpc"
+      "privateTmp"
+    ]
+  );
 
-  etcBindEntries = let
-    files = [
-      # NixOS Compatibility
-      "static"
-      "nix" # mainly for nixUnstable users, but also for access to nix/netrc
-      # Shells
-      "shells"
-      "bashrc"
-      "zshenv"
-      "zshrc"
-      "zinputrc"
-      "zprofile"
-      # Users, Groups, NSS
-      "passwd"
-      "group"
-      "shadow"
-      "hosts"
-      "resolv.conf"
-      "nsswitch.conf"
-      # User profiles
-      "profiles"
-      # Sudo & Su
-      "login.defs"
-      "sudoers"
-      "sudoers.d"
-      # Time
-      "localtime"
-      "zoneinfo"
-      # Other Core Stuff
-      "machine-id"
-      "os-release"
-      # PAM
-      "pam.d"
-      # Fonts
-      "fonts"
-      # ALSA
-      "alsa"
-      "asound.conf"
-      # SSL
-      "ssl/certs"
-      "ca-certificates"
-      "pki"
-    ];
-  in map (path: "/etc/${path}") files;
+  etcBindEntries =
+    let
+      files = [
+        # NixOS Compatibility
+        "static"
+        "nix" # mainly for nixUnstable users, but also for access to nix/netrc
+        # Shells
+        "shells"
+        "bashrc"
+        "zshenv"
+        "zshrc"
+        "zinputrc"
+        "zprofile"
+        # Users, Groups, NSS
+        "passwd"
+        "group"
+        "shadow"
+        "hosts"
+        "resolv.conf"
+        "nsswitch.conf"
+        # User profiles
+        "profiles"
+        # Sudo & Su
+        "login.defs"
+        "sudoers"
+        "sudoers.d"
+        # Time
+        "localtime"
+        "zoneinfo"
+        # Other Core Stuff
+        "machine-id"
+        "os-release"
+        # PAM
+        "pam.d"
+        # Fonts
+        "fonts"
+        # ALSA
+        "alsa"
+        "asound.conf"
+        # SSL
+        "ssl/certs"
+        "ca-certificates"
+        "pki"
+      ];
+    in
+    map (path: "/etc/${path}") files;
 
   # Here's the problem case:
   # - we need to run bash to run the init script
@@ -119,182 +144,208 @@ let
   #
   # Also, the real init is placed strategically at /init, so we don't
   # have to recompile this every time.
-  containerInit = runCommandCC "container-init" {
-    buildInputs = [ stdenv.cc.libc.static or null ];
-  } ''
-    $CXX -static -s -o $out ${./container-init.cc}
-  '';
+  containerInit =
+    runCommandCC "container-init"
+      {
+        buildInputs = [ stdenv.cc.libc.static or null ];
+      }
+      ''
+        $CXX -static -s -o $out ${./container-init.cc}
+      '';
 
-  realInit = run: writeShellScript "${name}-init" ''
-    source /etc/profile
-    exec ${run} "$@"
-  '';
+  realInit =
+    run:
+    writeShellScript "${name}-init" ''
+      source /etc/profile
+      exec ${run} "$@"
+    '';
 
   indentLines = str: concatLines (map (s: "  " + s) (filter (s: s != "") (splitString "\n" str)));
-  bwrapCmd = { initArgs ? "" }: ''
-    ignored=(/nix /dev /proc /etc ${optionalString privateTmp "/tmp"})
-    ro_mounts=()
-    symlinks=()
-    etc_ignored=()
+  bwrapCmd =
+    {
+      initArgs ? "",
+    }:
+    ''
+      ignored=(/nix /dev /proc /etc ${optionalString privateTmp "/tmp"})
+      ro_mounts=()
+      symlinks=()
+      etc_ignored=()
 
-    ${extraPreBwrapCmds}
+      ${extraPreBwrapCmds}
 
-    # loop through all entries of root in the fhs environment, except its /etc.
-    for i in ${fhsenv}/*; do
-      path="/''${i##*/}"
-      if [[ $path == '/etc' ]]; then
-        :
-      elif [[ -L $i ]]; then
-        symlinks+=(--symlink "$(${coreutils}/bin/readlink "$i")" "$path")
-        ignored+=("$path")
-      else
-        ro_mounts+=(--ro-bind "$i" "$path")
-        ignored+=("$path")
-      fi
-    done
-
-    # loop through the entries of /etc in the fhs environment.
-    if [[ -d ${fhsenv}/etc ]]; then
-      for i in ${fhsenv}/etc/*; do
+      # loop through all entries of root in the fhs environment, except its /etc.
+      for i in ${fhsenv}/*; do
         path="/''${i##*/}"
-        # NOTE: we're binding /etc/fonts and /etc/ssl/certs from the host so we
-        # don't want to override it with a path from the FHS environment.
-        if [[ $path == '/fonts' || $path == '/ssl' ]]; then
+        if [[ $path == '/etc' ]]; then
+          :
+        elif [[ -L $i ]]; then
+          symlinks+=(--symlink "$(${coreutils}/bin/readlink "$i")" "$path")
+          ignored+=("$path")
+        else
+          ro_mounts+=(--ro-bind "$i" "$path")
+          ignored+=("$path")
+        fi
+      done
+
+      # loop through the entries of /etc in the fhs environment.
+      if [[ -d ${fhsenv}/etc ]]; then
+        for i in ${fhsenv}/etc/*; do
+          path="/''${i##*/}"
+          # NOTE: we're binding /etc/fonts and /etc/ssl/certs from the host so we
+          # don't want to override it with a path from the FHS environment.
+          if [[ $path == '/fonts' || $path == '/ssl' ]]; then
+            continue
+          fi
+          if [[ -L $i ]]; then
+            symlinks+=(--symlink "$i" "/etc$path")
+          else
+            ro_mounts+=(--ro-bind "$i" "/etc$path")
+          fi
+          etc_ignored+=("/etc$path")
+        done
+      fi
+
+      # propagate /etc from the actual host if nested
+      if [[ -e /.host-etc ]]; then
+        ro_mounts+=(--ro-bind /.host-etc /.host-etc)
+      else
+        ro_mounts+=(--ro-bind /etc /.host-etc)
+      fi
+
+      # link selected etc entries from the actual root
+      for i in ${escapeShellArgs etcBindEntries}; do
+        if [[ "''${etc_ignored[@]}" =~ "$i" ]]; then
           continue
         fi
-        if [[ -L $i ]]; then
-          symlinks+=(--symlink "$i" "/etc$path")
-        else
-          ro_mounts+=(--ro-bind "$i" "/etc$path")
+        if [[ -e $i ]]; then
+          symlinks+=(--symlink "/.host-etc/''${i#/etc/}" "$i")
         fi
-        etc_ignored+=("/etc$path")
       done
-    fi
 
-    # propagate /etc from the actual host if nested
-    if [[ -e /.host-etc ]]; then
-      ro_mounts+=(--ro-bind /.host-etc /.host-etc)
-    else
-      ro_mounts+=(--ro-bind /etc /.host-etc)
-    fi
-
-    # link selected etc entries from the actual root
-    for i in ${escapeShellArgs etcBindEntries}; do
-      if [[ "''${etc_ignored[@]}" =~ "$i" ]]; then
-        continue
-      fi
-      if [[ -e $i ]]; then
-        symlinks+=(--symlink "/.host-etc/''${i#/etc/}" "$i")
-      fi
-    done
-
-    declare -a auto_mounts
-    # loop through all directories in the root
-    for dir in /*; do
-      # if it is a directory and it is not ignored
-      if [[ -d "$dir" ]] && [[ ! "''${ignored[@]}" =~ "$dir" ]]; then
-        # add it to the mount list
-        auto_mounts+=(--bind "$dir" "$dir")
-      fi
-    done
-
-    declare -a x11_args
-    # Always mount a tmpfs on /tmp/.X11-unix
-    # Rationale: https://github.com/flatpak/flatpak/blob/be2de97e862e5ca223da40a895e54e7bf24dbfb9/common/flatpak-run.c#L277
-    x11_args+=(--tmpfs /tmp/.X11-unix)
-
-    # Try to guess X socket path. This doesn't cover _everything_, but it covers some things.
-    if [[ "$DISPLAY" == *:* ]]; then
-      # recover display number from $DISPLAY formatted [host]:num[.screen]
-      display_nr=''${DISPLAY/#*:} # strip host
-      display_nr=''${display_nr/%.*} # strip screen
-      local_socket=/tmp/.X11-unix/X$display_nr
-      x11_args+=(--ro-bind-try "$local_socket" "$local_socket")
-    fi
-
-    ${optionalString privateTmp ''
-    # sddm places XAUTHORITY in /tmp
-    if [[ "$XAUTHORITY" == /tmp/* ]]; then
-      x11_args+=(--ro-bind-try "$XAUTHORITY" "$XAUTHORITY")
-    fi
-
-    # dbus-run-session puts the socket in /tmp
-    IFS=";" read -ra addrs <<<"$DBUS_SESSION_BUS_ADDRESS"
-    for addr in "''${addrs[@]}"; do
-      [[ "$addr" == unix:* ]] || continue
-      IFS="," read -ra parts <<<"''${addr#unix:}"
-      for part in "''${parts[@]}"; do
-        printf -v part '%s' "''${part//\\/\\\\}"
-        printf -v part '%b' "''${part//%/\\x}"
-        [[ "$part" == path=/tmp/* ]] || continue
-        x11_args+=(--ro-bind-try "''${part#path=}" "''${part#path=}")
+      declare -a auto_mounts
+      # loop through all directories in the root
+      for dir in /*; do
+        # if it is a directory and it is not ignored
+        if [[ -d "$dir" ]] && [[ ! "''${ignored[@]}" =~ "$dir" ]]; then
+          # add it to the mount list
+          auto_mounts+=(--bind "$dir" "$dir")
+        fi
       done
-    done
-    ''}
 
-    cmd=(
-      ${bubblewrap}/bin/bwrap
-      --dev-bind /dev /dev
-      --proc /proc
-      --chdir "$(pwd)"
-      ${optionalString unshareUser "--unshare-user"}
-      ${optionalString unshareIpc "--unshare-ipc"}
-      ${optionalString unsharePid "--unshare-pid"}
-      ${optionalString unshareNet "--unshare-net"}
-      ${optionalString unshareUts "--unshare-uts"}
-      ${optionalString unshareCgroup "--unshare-cgroup"}
-      ${optionalString dieWithParent "--die-with-parent"}
-      --ro-bind /nix /nix
-      ${optionalString privateTmp "--tmpfs /tmp"}
-      # Our glibc will look for the cache in its own path in `/nix/store`.
-      # As such, we need a cache to exist there, because pressure-vessel
-      # depends on the existence of an ld cache. However, adding one
-      # globally proved to be a bad idea (see #100655), the solution we
-      # settled on being mounting one via bwrap.
-      # Also, the cache needs to go to both 32 and 64 bit glibcs, for games
-      # of both architectures to work.
-      --tmpfs ${glibc}/etc \
-      --tmpfs /etc \
-      --symlink /etc/ld.so.conf ${glibc}/etc/ld.so.conf \
-      --symlink /etc/ld.so.cache ${glibc}/etc/ld.so.cache \
-      --ro-bind ${glibc}/etc/rpc ${glibc}/etc/rpc \
-      --remount-ro ${glibc}/etc \
-      --symlink ${realInit runScript} /init \
-  '' + optionalString fhsenv.isMultiBuild (indentLines ''
+      declare -a x11_args
+      # Always mount a tmpfs on /tmp/.X11-unix
+      # Rationale: https://github.com/flatpak/flatpak/blob/be2de97e862e5ca223da40a895e54e7bf24dbfb9/common/flatpak-run.c#L277
+      x11_args+=(--tmpfs /tmp/.X11-unix)
+
+      # Try to guess X socket path. This doesn't cover _everything_, but it covers some things.
+      if [[ "$DISPLAY" == *:* ]]; then
+        # recover display number from $DISPLAY formatted [host]:num[.screen]
+        display_nr=''${DISPLAY/#*:} # strip host
+        display_nr=''${display_nr/%.*} # strip screen
+        local_socket=/tmp/.X11-unix/X$display_nr
+        x11_args+=(--ro-bind-try "$local_socket" "$local_socket")
+      fi
+
+      ${optionalString privateTmp ''
+        # sddm places XAUTHORITY in /tmp
+        if [[ "$XAUTHORITY" == /tmp/* ]]; then
+          x11_args+=(--ro-bind-try "$XAUTHORITY" "$XAUTHORITY")
+        fi
+
+        # dbus-run-session puts the socket in /tmp
+        IFS=";" read -ra addrs <<<"$DBUS_SESSION_BUS_ADDRESS"
+        for addr in "''${addrs[@]}"; do
+          [[ "$addr" == unix:* ]] || continue
+          IFS="," read -ra parts <<<"''${addr#unix:}"
+          for part in "''${parts[@]}"; do
+            printf -v part '%s' "''${part//\\/\\\\}"
+            printf -v part '%b' "''${part//%/\\x}"
+            [[ "$part" == path=/tmp/* ]] || continue
+            x11_args+=(--ro-bind-try "''${part#path=}" "''${part#path=}")
+          done
+        done
+      ''}
+
+      cmd=(
+        ${bubblewrap}/bin/bwrap
+        --dev-bind /dev /dev
+        --proc /proc
+        --chdir "$(pwd)"
+        ${optionalString unshareUser "--unshare-user"}
+        ${optionalString unshareIpc "--unshare-ipc"}
+        ${optionalString unsharePid "--unshare-pid"}
+        ${optionalString unshareNet "--unshare-net"}
+        ${optionalString unshareUts "--unshare-uts"}
+        ${optionalString unshareCgroup "--unshare-cgroup"}
+        ${optionalString dieWithParent "--die-with-parent"}
+        --ro-bind /nix /nix
+        ${optionalString privateTmp "--tmpfs /tmp"}
+        # Our glibc will look for the cache in its own path in `/nix/store`.
+        # As such, we need a cache to exist there, because pressure-vessel
+        # depends on the existence of an ld cache. However, adding one
+        # globally proved to be a bad idea (see #100655), the solution we
+        # settled on being mounting one via bwrap.
+        # Also, the cache needs to go to both 32 and 64 bit glibcs, for games
+        # of both architectures to work.
+        --tmpfs ${glibc}/etc \
+        --tmpfs /etc \
+        --symlink /etc/ld.so.conf ${glibc}/etc/ld.so.conf \
+        --symlink /etc/ld.so.cache ${glibc}/etc/ld.so.cache \
+        --ro-bind ${glibc}/etc/rpc ${glibc}/etc/rpc \
+        --remount-ro ${glibc}/etc \
+        --symlink ${realInit runScript} /init \
+    ''
+    + optionalString fhsenv.isMultiBuild (indentLines ''
       --tmpfs ${pkgsi686Linux.glibc}/etc \
       --symlink /etc/ld.so.conf ${pkgsi686Linux.glibc}/etc/ld.so.conf \
       --symlink /etc/ld.so.cache ${pkgsi686Linux.glibc}/etc/ld.so.cache \
       --ro-bind ${pkgsi686Linux.glibc}/etc/rpc ${pkgsi686Linux.glibc}/etc/rpc \
       --remount-ro ${pkgsi686Linux.glibc}/etc \
-  '') + ''
-      "''${ro_mounts[@]}"
-      "''${symlinks[@]}"
-      "''${auto_mounts[@]}"
-      "''${x11_args[@]}"
-      ${concatStringsSep "\n  " extraBwrapArgs}
-      ${containerInit} ${initArgs}
-    )
-    exec "''${cmd[@]}"
-  '';
-
-  bin = writeShellScript "${name}-bwrap" (bwrapCmd { initArgs = ''"$@"''; });
-in runCommandLocal name (nameAttrs // {
-  inherit nativeBuildInputs meta;
-
-  passthru = passthru // {
-    env = runCommandLocal "${name}-shell-env" {
-      shellHook = bwrapCmd {};
-    } ''
-      echo >&2 ""
-      echo >&2 "*** User chroot 'env' attributes are intended for interactive nix-shell sessions, not for building! ***"
-      echo >&2 ""
-      exit 1
+    '')
+    + ''
+        "''${ro_mounts[@]}"
+        "''${symlinks[@]}"
+        "''${auto_mounts[@]}"
+        "''${x11_args[@]}"
+        ${concatStringsSep "\n  " extraBwrapArgs}
+        ${containerInit} ${initArgs}
+      )
+      exec "''${cmd[@]}"
     '';
-    inherit args fhsenv;
-  };
-}) ''
-  mkdir -p $out/bin
-  ln -s ${bin} $out/bin/${executableName}
 
-  ${extraInstallCommands}
-''
+  bin = writeShellScript "${name}-bwrap" (bwrapCmd {
+    initArgs = ''"$@"'';
+  });
+in
+runCommandLocal name
+  (
+    nameAttrs
+    // {
+      inherit nativeBuildInputs;
+
+      passthru = passthru // {
+        env =
+          runCommandLocal "${name}-shell-env"
+            {
+              shellHook = bwrapCmd { };
+            }
+            ''
+              echo >&2 ""
+              echo >&2 "*** User chroot 'env' attributes are intended for interactive nix-shell sessions, not for building! ***"
+              echo >&2 ""
+              exit 1
+            '';
+        inherit args fhsenv;
+      };
+
+      meta = {
+        mainProgram = executableName;
+      } // meta;
+    }
+  )
+  ''
+    mkdir -p $out/bin
+    ln -s ${bin} $out/bin/${executableName}
+
+    ${extraInstallCommands}
+  ''

pkgs/by-name/al/alcom/package.nix

@@ -8,7 +8,7 @@
   glib-networking,
   google-fonts,
   lib,
-  libsoup,
+  libsoup_2_4,
   nodejs,
   npmHooks,
   openssl,
@@ -70,7 +70,7 @@ rustPlatform.buildRustPackage {
     [ openssl ]
     ++ lib.optionals stdenv.hostPlatform.isLinux [
       glib-networking
-      libsoup
+      libsoup_2_4
       webkitgtk_4_0
     ]
     ++ dotnetSdk.packages

pkgs/by-name/an/ankama-launcher/package.nix

@@ -5,15 +5,15 @@
 }:
 let
   pname = "ankama-launcher";
-  version = "3.12.24";
+  version = "3.12.26";
 
   # The original URL for the launcher is:
   # https://launcher.cdn.ankama.com/installers/production/Ankama%20Launcher-Setup-x86_64.AppImage
   # As it does not encode the version, we use the wayback machine (web.archive.org) to get a fixed URL.
   # To update the client, head to web.archive.org and create a new snapshot of the download page.
   src = fetchurl {
-    url = "https://web.archive.org/web/20241202103051/https://launcher.cdn.ankama.com/installers/production/Ankama%20Launcher-Setup-x86_64.AppImage";
-    hash = "sha256-jI/qcIIrNU9ViaZ/LKMkUETXZpintDsofSgiRfe4GOU=";
+    url = "https://web.archive.org/web/20241206172526/https://launcher.cdn.ankama.com/installers/production/Ankama%20Launcher-Setup-x86_64.AppImage";
+    hash = "sha256-K/qe/qxMfcGWU5gyEfPdl0ptjTCWaqIXMCy4O8WEKCQ=";
   };
 
   appimageContents = appimageTools.extract { inherit pname version src; };

pkgs/by-name/an/ansel/package.nix

@@ -44,7 +44,7 @@
 , isocodes
 , libpsl
 , libepoxy
-, libsoup
+, libsoup_2_4
 , exiv2
 , libXtst
 , libthai
@@ -138,7 +138,7 @@ stdenv.mkDerivation {
     libsecret
     libselinux
     libsepol
-    libsoup
+    libsoup_2_4
     libsysprof-capture
     libthai
     libwebp

pkgs/by-name/ap/apache-answer/package.nix

@@ -0,0 +1,79 @@
+{
+  buildGoModule,
+  lib,
+  fetchFromGitHub,
+  pnpm,
+  nodejs,
+  fetchpatch,
+  stdenv,
+}:
+
+buildGoModule rec {
+  pname = "apache-answer";
+  version = "1.4.1";
+
+  src = fetchFromGitHub {
+    owner = "apache";
+    repo = "incubator-answer";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-nS3ZDwY221axzo1HAz369f5jWZ/mpCn4r3OPPqjiohI=";
+  };
+
+  webui = stdenv.mkDerivation {
+    pname = pname + "-webui";
+    inherit version src;
+
+    sourceRoot = "${src.name}/ui";
+
+    pnpmDeps = pnpm.fetchDeps {
+      inherit src version pname;
+      sourceRoot = "${src.name}/ui";
+      hash = "sha256-/se6IWeHdazqS7PzOpgtT4IxCJ1WptqBzZ/BdmGb4BA=";
+    };
+
+    nativeBuildInputs = [
+      pnpm.configHook
+      nodejs
+    ];
+
+    buildPhase = ''
+      runHook preBuild
+
+      pnpm build
+
+      runHook postBuild
+    '';
+
+    installPhase = ''
+      runHook preInstall
+
+      mkdir -p $out
+      cp -r build/* $out
+
+      runHook postInstall
+    '';
+  };
+
+  vendorHash = "sha256-nvXr1YAqVCyhCgPtABTOtzDH+FCQhN9kSEhxKw7ipsE=";
+
+  preBuild = ''
+    cp -r ${webui}/* ui/build/
+  '';
+
+  patches = [
+    (fetchpatch {
+      url = "https://github.com/apache/incubator-answer/commit/57b0d0e84dd0e0bf3c8a05a38a7f55eddc5f0dda.patch";
+      hash = "sha256-TfF+PtrcMYYgNjgU4lGpnshdII8xECTT2L7M26uebn0=";
+    })
+  ];
+
+  meta = {
+    homepage = "https://answer.apache.org/";
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ bot-wxt1221 ];
+    platforms = lib.platforms.unix;
+    mainProgram = "answer";
+    changelog = "https://github.com/apache/incubator-answer/releases/tag/v${version}";
+    description = "Q&A platform software for teams at any scales";
+  };
+}

pkgs/by-name/ar/ario/package.nix

@@ -10,7 +10,7 @@
 , gettext
 , gtk3
 , libmpdclient
-, libsoup
+, libsoup_2_4
 , libxml2
 , taglib
 , wrapGAppsHook3
@@ -39,7 +39,7 @@ stdenv.mkDerivation rec {
     dbus-glib
     gtk3
     libmpdclient
-    libsoup
+    libsoup_2_4
     libxml2
     taglib
   ];

pkgs/by-name/au/audiobookshelf/source.json

@@ -1,9 +1,9 @@
 {
   "owner": "advplyr",
   "repo": "audiobookshelf",
-  "rev": "f850db23fe37dfe5044c2f5f641931528b291bf2",
-  "hash": "sha256-iboQnPmWIk/bYjEF+opjKU+XJVSD5DGCfqp6BJQRW3w=",
-  "version": "2.17.2",
-  "depsHash": "sha256-W56EG5SCiAcjHhR5WR1UBY9Xt0D0p8duEiUzx+luLfc=",
-  "clientDepsHash": "sha256-gEgd2PCFWqNuRXhnFZylGS0GTMJUD0KeHbRgYxMUMPM="
+  "rev": "890b0b949ee758102fd05ba26c5ed5c3ebbd747f",
+  "hash": "sha256-sMtUO2ltlxipjNXqcHLVXlZZ8QOAGND77hItwcxx27Q=",
+  "version": "2.17.4",
+  "depsHash": "sha256-b2mcJ+Qh+VEYaZcy4LGCFPK9dFYsy48wUaEAJGYtBwc=",
+  "clientDepsHash": "sha256-CfRG7GqvtLL675Bkzi/WOERwp0EKzmC3u0ozxHoj9rI="
 }

pkgs/by-name/aw/aws-shell/package.nix

@@ -0,0 +1,55 @@
+{
+  python3Packages,
+  lib,
+  fetchFromGitHub,
+  awscli,
+}:
+
+python3Packages.buildPythonApplication rec {
+  pname = "aws-shell";
+  version = "0.2.2";
+
+  src = fetchFromGitHub {
+    owner = "awslabs";
+    repo = "aws-shell";
+    rev = "refs/tags/${version}";
+    hash = "sha256-m96XaaFDFQaD2YPjw8D1sGJ5lex4Is4LQ5RhGzVPvH4=";
+  };
+
+  build-system = with python3Packages; [
+    setuptools
+  ];
+
+  dependencies = with python3Packages; [
+    botocore
+    pygments
+    mock
+    configobj
+    awscli
+    (prompt-toolkit.overrideAttrs (old: {
+      src = fetchFromGitHub {
+        owner = "prompt-toolkit";
+        repo = "python-prompt-toolkit";
+        rev = "refs/tags/1.0.18"; # Need >=1.0.0,<1.1.0
+        hash = "sha256-mt/fIubkpeVc7vhAaTk0pXZXI8JzB7n2MzXqgqK0wE4=";
+      };
+    }))
+  ];
+
+  nativeCheckInputs = with python3Packages; [
+    pytestCheckHook
+  ];
+
+  preCheck = ''
+    export HOME=$(mktemp -d)
+  '';
+
+  meta = {
+    homepage = "https://github.com/awslabs/aws-shell";
+    description = "Integrated shell for working with the AWS CLI";
+    platforms = lib.platforms.unix;
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ bot-wxt1221 ];
+    mainProgram = "aws-shell";
+  };
+}

pkgs/by-name/aw/aws-workspaces/package.nix

@@ -14,7 +14,7 @@
 , webkitgtk_4_0
 , librsvg
 , gdk-pixbuf
-, libsoup
+, libsoup_2_4
 , glib-networking
 , graphicsmagick_q16
 , libva
@@ -57,7 +57,7 @@ stdenv.mkDerivation (finalAttrs: {
     webkitgtk_4_0
     librsvg
     gdk-pixbuf
-    libsoup
+    libsoup_2_4
     glib-networking
     graphicsmagick_q16
     hiredis

pkgs/by-name/ba/bazecor/package.nix

@@ -6,12 +6,12 @@
 }:
 let
   pname = "bazecor";
-  version = "1.5.4";
+  version = "1.6.1";
   src = appimageTools.extract {
     inherit pname version;
     src = fetchurl {
       url = "https://github.com/Dygmalab/Bazecor/releases/download/v${version}/Bazecor-${version}-x64.AppImage";
-      hash = "sha256-gu3XPl4gKL+k9hX9OVJYGvG3R81c5lZauRJdUFrqtqk=";
+      hash = "sha256-Qf9FqHgTSCD2rYp8PC/gYHyiYcfFTJJmG4oRK/bch8Y=";
     };
 
     # Workaround for https://github.com/Dygmalab/Bazecor/issues/370

pkgs/by-name/ba/bazel-gazelle/package.nix

@@ -5,13 +5,13 @@
 
 buildGoModule rec {
   pname = "bazel-gazelle";
-  version = "0.39.1";
+  version = "0.40.0";
 
   src = fetchFromGitHub {
     owner = "bazelbuild";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-Y+k8ObfMwN6fLR2+Lwn64xHljDf3kxw2xp0YpJKbrDM=";
+    hash = "sha256-cGRE+AX62U6lZbUEid0QWb9zMTiIemop6Gqrqvz5+nk=";
   };
 
   vendorHash = null;

pkgs/by-name/br/broot/package.nix

@@ -7,13 +7,9 @@
 , pkg-config
 , libgit2
 , oniguruma
-, libiconv
-, Foundation
-, Security
-, xorg
 , zlib
 , buildPackages
-, withClipboard ? !stdenv.hostPlatform.isDarwin
+, withClipboard ? true
 , withTrash ? !stdenv.hostPlatform.isDarwin
 }:
 
@@ -36,10 +32,8 @@ rustPlatform.buildRustPackage rec {
     pkg-config
   ];
 
-  buildInputs = [ libgit2 oniguruma xorg.libxcb ] ++ lib.optionals stdenv.hostPlatform.isDarwin [
-    Foundation
-    libiconv
-    Security
+  # TODO: once https://github.com/Canop/broot/issues/956 is released, oniguruma can be removed.
+  buildInputs = [ libgit2 oniguruma ] ++ lib.optionals stdenv.hostPlatform.isDarwin [
     zlib
   ];
 

pkgs/by-name/ca/cargo-tauri_1/package.nix

@@ -6,7 +6,7 @@
   cargo-tauri,
   cargo-tauri_1,
   gtk3,
-  libsoup,
+  libsoup_2_4,
   openssl,
   webkitgtk_4_0,
 }:
@@ -40,7 +40,7 @@ cargo-tauri.overrideAttrs (
       [ openssl ]
       ++ lib.optionals stdenv.hostPlatform.isLinux [
         gtk3
-        libsoup
+        libsoup_2_4
         webkitgtk_4_0
       ];
 

pkgs/by-name/ca/catppuccinifier-gui/package.nix

@@ -8,7 +8,7 @@
   cairo,
   stdenv,
   librsvg,
-  libsoup,
+  libsoup_2_4,
   fetchzip,
   openssl_3,
   webkitgtk_4_0,
@@ -43,7 +43,7 @@ stdenv.mkDerivation {
     gtk3
     cairo
     gdk-pixbuf
-    libsoup
+    libsoup_2_4
     glib
     dbus
     openssl_3

pkgs/by-name/co/code-cursor/package.nix

@@ -8,11 +8,11 @@
 }:
 let
   pname = "cursor";
-  version = "0.43.0";
+  version = "0.43.6";
   appKey = "230313mzl4w4u92";
   src = fetchurl {
-    url = "https://download.todesktop.com/230313mzl4w4u92/cursor-0.43.0-build-24112423a8e6ct7-x86_64.AppImage";
-    hash = "sha256-IcAUXGSMHxGd5Ak4cYA9/2YYg8UA+cRBGgnOupDuRXs=";
+    url = "https://download.todesktop.com/230313mzl4w4u92/cursor-0.43.6-build-241206z7j6me2e2-x86_64.AppImage";
+    hash = "sha256-adEyDExGvxwpvAT0qYiCfvkpINP9BJ6a+LSwQHQ/H/U=";
   };
   appimageContents = appimageTools.extractType2 { inherit version pname src; };
 in

pkgs/by-name/cr/crates-tui/package.nix

@@ -8,7 +8,7 @@
   nix-update-script,
 }:
 let
-  version = "0.1.20";
+  version = "0.1.22";
 in
 rustPlatform.buildRustPackage {
   pname = "crates-tui";
@@ -18,10 +18,10 @@ rustPlatform.buildRustPackage {
     owner = "ratatui";
     repo = "crates-tui";
     rev = "refs/tags/v${version}";
-    hash = "sha256-K3ttXoSS4GZyHnqS95op8kmbAi4/KjKa0P6Nzqqpjyw=";
+    hash = "sha256-+fyCNkSTmWrztEEsQkRoMXikOn1Q+suP2IZuSXb3ELQ=";
   };
 
-  cargoHash = "sha256-ztLBM6CR2WMKR9cfBY95BvSaD05C+AEa6C/nOdDxqf0=";
+  cargoHash = "sha256-RnrPh0DBtX4BKSE8qC8MuyL6VXlH05wXYW/iOAs4SD8=";
 
   nativeBuildInputs = [ pkg-config ];
   buildInputs = [ openssl ];

pkgs/by-name/da/darktable/package.nix

@@ -1,7 +1,7 @@
 { lib
 , stdenv
 , fetchurl
-, libsoup
+, libsoup_2_4
 , graphicsmagick
 , json-glib
 , wrapGAppsHook3
@@ -86,7 +86,7 @@ stdenv.mkDerivation rec {
     openexr_3
     sqlite
     libxslt
-    libsoup
+    libsoup_2_4
     graphicsmagick
     json-glib
     openjpeg

pkgs/by-name/de/desktop-postflop/package.nix

@@ -6,7 +6,7 @@
 , makeDesktopItem
 , pkg-config
 , gtk3
-, libsoup
+, libsoup_2_4
 , webkitgtk_4_0
 }:
 
@@ -57,7 +57,7 @@ rustPlatform.buildRustPackage rec {
 
   buildInputs = [
     gtk3
-    libsoup
+    libsoup_2_4
     webkitgtk_4_0
   ];
 

pkgs/by-name/dl/dleyna-renderer/package.nix

@@ -11,7 +11,7 @@
 , gupnp
 , gupnp-av
 , gupnp-dlna
-, libsoup
+, libsoup_2_4
 , makeWrapper
 , docbook-xsl-nons
 , libxslt
@@ -57,7 +57,7 @@ stdenv.mkDerivation rec {
     gupnp
     gupnp-av
     gupnp-dlna
-    libsoup
+    libsoup_2_4
   ];
 
   preFixup = ''

pkgs/by-name/dl/dleyna-server/package.nix

@@ -12,7 +12,7 @@
 , gupnp
 , gupnp-av
 , gupnp-dlna
-, libsoup
+, libsoup_2_4
 }:
 
 stdenv.mkDerivation rec {
@@ -51,7 +51,7 @@ stdenv.mkDerivation rec {
     gupnp
     gupnp-av
     gupnp-dlna
-    libsoup
+    libsoup_2_4
   ];
 
   preFixup = ''

pkgs/by-name/ec/ecc/package.nix

@@ -53,18 +53,18 @@ let
 in
 rustPlatform.buildRustPackage rec {
   pname = "ecc";
-  version = "1.0.12";
+  version = "1.0.27";
 
   src = fetchFromGitHub {
     owner = "eunomia-bpf";
     repo = "eunomia-bpf";
     rev = "v${version}";
-    hash = "sha256-EK/SZ9LNAk88JpHJEoxw12NHje6QdCqO/vT2TfkWlb0=";
+    hash = "sha256-KfYCC+TJbmjHrV46LoshD+uXcaBVMKk6+cN7TZKKYp4=";
   };
 
   sourceRoot = "${src.name}/compiler/cmd";
 
-  cargoHash = "sha256-ymBEzFsMTxKSdJRYoDY3AC0QpgtcMlU0fQV03emCxQc=";
+  cargoHash = "sha256-t8sPwAha90SMC/SJqZngXD9hpoaWh9e91X/kuHN4G7o=";
 
   nativeBuildInputs = [
     pkg-config

pkgs/by-name/en/en-croissant/package.nix

@@ -12,7 +12,7 @@
   makeBinaryWrapper,
 
   openssl,
-  libsoup,
+  libsoup_2_4,
   webkitgtk_4_0,
   gst_all_1,
   apple-sdk_11,
@@ -54,7 +54,7 @@ rustPlatform.buildRustPackage rec {
   buildInputs =
     lib.optionals stdenv.hostPlatform.isLinux [
       openssl
-      libsoup
+      libsoup_2_4
       webkitgtk_4_0
       gst_all_1.gstreamer
       gst_all_1.gst-plugins-base

pkgs/by-name/fi/firebase-tools/package.nix

@@ -8,19 +8,19 @@
 }:
 
 let
-  version = "13.20.2";
+  version = "13.28.0";
   src = fetchFromGitHub {
     owner = "firebase";
     repo = "firebase-tools";
     rev = "refs/tags/v${version}";
-    hash = "sha256-FIflfCSTXm7J2WectS175vc0ccztWa4tE2E2kcbhwJg=";
+    hash = "sha256-bOuOBzEEfVi+0lGqKgZQVmxKUBWoWWdaQ1jlCR1xBcM=";
   };
 in
 buildNpmPackage {
   pname = "firebase-tools";
   inherit version src;
 
-  npmDepsHash = "sha256-qEerq6rFBN6HmzDS4xQJorzmzapBV/WhzCwG3rHU458=";
+  npmDepsHash = "sha256-3wc1DPZ+yYlBtUTWpa4XFaetS7caNqX5JFSXkmzHyqg=";
 
   postPatch = ''
     ln -s npm-shrinkwrap.json package-lock.json

pkgs/by-name/fo/fondo/package.nix

@@ -13,7 +13,7 @@
 , gtk3
 , libgee
 , libhandy
-, libsoup
+, libsoup_2_4
 , json-glib
 , glib-networking
 , desktop-file-utils
@@ -49,7 +49,7 @@ stdenv.mkDerivation rec {
     json-glib
     libgee
     libhandy
-    libsoup
+    libsoup_2_4
     pantheon.granite
   ];
 

pkgs/by-name/ga/gamehub/package.nix

@@ -10,7 +10,7 @@
 , gtk3
 , glib-networking
 , libgee
-, libsoup
+, libsoup_2_4
 , json-glib
 , sqlite
 , webkitgtk_4_0
@@ -46,7 +46,7 @@ stdenv.mkDerivation rec {
     json-glib
     libgee
     libmanette
-    libsoup
+    libsoup_2_4
     libXtst
     sqlite
     webkitgtk_4_0

pkgs/by-name/ga/gancio/package.nix

@@ -14,18 +14,19 @@
   sqlite,
 
   nixosTests,
+  nix-update-script,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "gancio";
-  version = "1.19.4";
+  version = "1.21.0";
 
   src = fetchFromGitLab {
     domain = "framagit.org";
     owner = "les";
     repo = "gancio";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-x8s7eBVmHCY3kAjHjACotCncvZq6OBiLPJGF6hvfawE=";
+    hash = "sha256-hpOTiGU2DGOeKqggYQhdBZgFBp6S0CAQ2stpr9zzItg=";
   };
 
   offlineCache = fetchYarnDeps {
@@ -69,6 +70,7 @@ stdenv.mkDerivation (finalAttrs: {
     tests = {
       inherit (nixosTests) gancio;
     };
+    updateScript = nix-update-script { };
   };
 
   meta = {

pkgs/by-name/ga/gancio/plugin-telegram-bridge/default.nix

@@ -6,18 +6,19 @@
   yarnConfigHook,
   yarnInstallHook,
   nodejs,
+  nix-update-script,
 }:
 
 stdenv.mkDerivation rec {
   pname = "gancio-plugin-telegram-bridge";
-  version = "1.0.4";
+  version = "1.0.5";
 
   src = fetchFromGitLab {
     domain = "framagit.org";
     owner = "bcn.convocala";
     repo = "gancio-plugin-telegram-bridge";
     rev = "v${version}";
-    hash = "sha256-Da8PxCX1Z1dKJu9AiwdRDfb1r1P2KiZe8BClYB9Rz48=";
+    hash = "sha256-URiyV7bl8t25NlVJM/gEqPB67TZ4vQdfu4mvHITteSQ=";
   };
 
   # upstream doesn't provide a yarn.lock file
@@ -43,6 +44,7 @@ stdenv.mkDerivation rec {
 
   passthru = {
     inherit nodejs;
+    updateScript = nix-update-script { };
   };
 
   meta = {

pkgs/by-name/ge/geesefs/package.nix

@@ -3,7 +3,7 @@
 , fetchFromGitHub
 }:
 
-let version = "0.42.0";
+let version = "0.42.3";
 in buildGoModule {
   pname = "geesefs";
   inherit version;
@@ -12,12 +12,12 @@ in buildGoModule {
     owner = "yandex-cloud";
     repo = "geesefs";
     rev = "v${version}";
-    hash = "sha256-bScx+4g1g4mE2l8nCWVZz/QT8jKOOpksqMmlTDp+DsA=";
+    hash = "sha256-keF6KrkHI5sIm5XCIpWAvKD1qu5XvWx3uR70eKhOZk8=";
   };
 
   # hashes differ per architecture otherwise.
   proxyVendor = true;
-  vendorHash = "sha256-50ND58TuEilORX24qRSfWlO2A1fkCakm16UPOCse11E=";
+  vendorHash = "sha256-SQgYB6nLSnqKUntWGJL+dQD+cAPQ69Rjdq1GXIt21xg=";
 
   subPackages = [ "." ];
 

pkgs/by-name/ge/geocode-glib/package.nix

@@ -10,7 +10,7 @@
 , docbook-xsl-nons
 , gobject-introspection
 , gnome
-, libsoup
+, libsoup_2_4
 , json-glib
 , glib
 , nixosTests
@@ -45,12 +45,12 @@ stdenv.mkDerivation rec {
 
   buildInputs = [
     glib
-    libsoup
+    libsoup_2_4
     json-glib
   ];
 
   mesonFlags = [
-    "-Dsoup2=${lib.boolToString (lib.versionOlder libsoup.version "2.99")}"
+    "-Dsoup2=${lib.boolToString (lib.versionOlder libsoup_2_4.version "2.99")}"
     "-Dinstalled_test_prefix=${placeholder "installedTests"}"
   ];
 

pkgs/by-name/gf/gfbgraph/package.nix

@@ -6,7 +6,7 @@
 , librest
 , gnome-online-accounts
 , gnome
-, libsoup
+, libsoup_2_4
 , json-glib
 , gobject-introspection
 , gtk-doc
@@ -37,7 +37,7 @@ stdenv.mkDerivation rec {
   ];
 
   propagatedBuildInputs = [
-    libsoup
+    libsoup_2_4
     json-glib
     librest
   ];

pkgs/by-name/gh/gh-copilot/package.nix

@@ -9,26 +9,26 @@ let
   systemToPlatform = {
     "x86_64-linux" = {
       name = "linux-amd64";
-      hash = "sha256-uEG9wvoUyX54rcsZI2dgSfEy9d/FMfjf4+kn5wJoojY=";
+      hash = "sha256-QKrDFCVCWYYX2jM8le2X/OLhNcwxR+liUtXHhW7jcSw=";
     };
     "aarch64-linux" = {
       name = "linux-arm64";
-      hash = "sha256-r0Vo9lZygIEQeSqPv1ix/NK347wqoCkaIL635qeP5ok=";
+      hash = "sha256-+l1hBwep/YMP7EOrEIn2xCIiVgWB0JCWz+fj2ZfivNQ=";
     };
     "x86_64-darwin" = {
       name = "darwin-amd64";
-      hash = "sha256-Hu7A/M5JvwFaA5AmO1WO65D7KD3dYTGnNb0A5CqAPH0=";
+      hash = "sha256-YFQh4vDtT+mjAIMt0IEtleOFTlxkHMbJq/SrI+IzNjc=";
     };
     "aarch64-darwin" = {
       name = "darwin-arm64";
-      hash = "sha256-d6db1YOmo7If/2PTkgScsTaMqZZNZl6OL/qpgYfCa3s=";
+      hash = "sha256-qVsItCI3LxPraOLtEvVaoTzhoGEcIySTWooMBSMLvAc=";
     };
   };
   platform = systemToPlatform.${system} or throwSystem;
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "gh-copilot";
-  version = "1.0.1";
+  version = "1.0.5";
 
   src = fetchurl {
     name = "gh-copilot";

pkgs/by-name/gi/gitbutler/package.nix

@@ -15,7 +15,7 @@
   jq,
   nodejs,
   pkg-config,
-  libsoup,
+  libsoup_2_4,
   moreutils,
   openssl,
   rust,
@@ -70,7 +70,7 @@ rustPlatform.buildRustPackage rec {
     [ openssl ]
     ++ lib.optionals stdenv.hostPlatform.isLinux [
       glib-networking
-      libsoup
+      libsoup_2_4
       webkitgtk_4_0
     ]
     ++ lib.optionals stdenv.hostPlatform.isDarwin (

pkgs/by-name/gi/gitsign/package.nix

@@ -2,15 +2,15 @@
 
 buildGoModule rec {
   pname = "gitsign";
-  version = "0.10.2";
+  version = "0.11.0";
 
   src = fetchFromGitHub {
     owner = "sigstore";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-JNCz5MVqn8PeTfYUVowIVZwtpfD+Gx9yBckter6PfXA=";
+    hash = "sha256-103sW7X5Bddvqat9oHfkpG2BReu7g24xGH2ia0JLAjQ=";
   };
-  vendorHash = "sha256-QW+ZWYEXkhSQR4HvmPLENzY/VEfjEX43mBPhmhsEBMI=";
+  vendorHash = "sha256-XzKpzEYAKQUkGT+/XQJPzEp/qYuBOnE7jWHXtmitZDI=";
 
   subPackages = [
     "."
@@ -18,6 +18,7 @@ buildGoModule rec {
   ];
 
   nativeBuildInputs = [ makeWrapper ];
+  nativeCheckInputs = [ gitMinimal ];
 
   ldflags = [ "-s" "-w" "-X github.com/sigstore/gitsign/pkg/version.gitVersion=${version}" ];
 
@@ -40,5 +41,6 @@ buildGoModule rec {
     description = "Keyless Git signing using Sigstore";
     license = lib.licenses.asl20;
     maintainers = with lib.maintainers; [ lesuisse developer-guy ];
+    mainProgram = "gitsign";
   };
 }

pkgs/by-name/gn/gnome-recipes/package.nix

@@ -11,7 +11,7 @@
 , wrapGAppsHook3
 , gtk3
 , glib
-, libsoup
+, libsoup_2_4
 , gnome-online-accounts
 , librest
 , json-glib
@@ -48,7 +48,7 @@ stdenv.mkDerivation rec {
   buildInputs = [
     gtk3
     glib
-    libsoup
+    libsoup_2_4
     gnome-online-accounts
     librest
     json-glib

pkgs/by-name/go/google-cloud-sql-proxy/package.nix

@@ -6,18 +6,18 @@
 
 buildGoModule rec {
   pname = "google-cloud-sql-proxy";
-  version = "2.14.0";
+  version = "2.14.1";
 
   src = fetchFromGitHub {
     owner = "GoogleCloudPlatform";
     repo = "cloud-sql-proxy";
     rev = "v${version}";
-    hash = "sha256-SM74Z9+oo472BIM/moSj9zyZh2HefkAkqoC4L1tu+X8=";
+    hash = "sha256-GS+FILQI6z7bFgngDgnC+H5APILiDpBLkA+EFT4cWMw=";
   };
 
   subPackages = [ "." ];
 
-  vendorHash = "sha256-Ao/kSC4gcsZpRaSu7FhqJs1ulUbfrzOpO4CMropCywo=";
+  vendorHash = "sha256-TbVpYfAEo0WtteeEImcPORxgYhMdgayj+LcpLW3jAMo=";
 
   checkFlags = [
     "-short"

pkgs/by-name/gp/gpauth/package.nix

@@ -2,7 +2,7 @@
   rustPlatform,
   lib,
   fetchFromGitHub,
-  libsoup,
+  libsoup_2_4,
   openssl,
   pkg-config,
   perl,
@@ -28,7 +28,7 @@ rustPlatform.buildRustPackage rec {
     pkg-config
   ];
   buildInputs = [
-    libsoup
+    libsoup_2_4
     openssl
     webkitgtk_4_0
   ];

pkgs/by-name/gr/gruvbox-material-gtk-theme/package.nix

@@ -0,0 +1,38 @@
+{
+  stdenvNoCC,
+  fetchFromGitHub,
+  gtk-engine-murrine,
+  lib,
+}:
+stdenvNoCC.mkDerivation {
+  pname = "gruvbox-material-gtk-theme";
+  version = "0-unstable-2024-08-09";
+
+  src = fetchFromGitHub {
+    owner = "TheGreatMcPain";
+    repo = "gruvbox-material-gtk";
+    rev = "808959bcfe8b9409b49a7f92052198f0882ae8bc";
+    hash = "sha256-NHjE/HI/BJyjrRfoH9gOKIU8HsUIBPV9vyvuW12D01M=";
+  };
+
+  propagatedUserEnvPkgs = [ gtk-engine-murrine ];
+
+  dontBuild = true;
+
+  installPhase = ''
+    runHook preInstall
+    mkdir -p "$out/share/"{themes,icons}
+    for i in "icons" "themes"; do
+      cp -a "$i/"* "$out/share/$i"
+    done
+    runHook postInstall
+  '';
+
+  meta = {
+    description = "GTK Theme based off of the Gruvbox Material colour palette";
+    homepage = "https://github.com/TheGreatMcPain/gruvbox-material-gtk";
+    license = lib.licenses.mit;
+    maintainers = [ lib.maintainers.amadaluzia ];
+    platforms = lib.platforms.unix;
+  };
+}

pkgs/by-name/gt/gthumb/package.nix

@@ -12,7 +12,7 @@
 , libtiff
 , gst_all_1
 , libraw
-, libsoup
+, libsoup_2_4
 , libsecret
 , glib
 , gtk3
@@ -75,7 +75,7 @@ stdenv.mkDerivation rec {
     libraw
     librsvg
     libsecret
-    libsoup
+    libsoup_2_4
     libtiff
     libwebp
     libX11

pkgs/by-name/ha/hardinfo/package.nix

@@ -1,5 +1,5 @@
 { lib, stdenv, fetchurl, which, pkg-config, gtk2, pcre, glib, libxml2
-, libsoup ? null
+, libsoup_2_4 ? null
 }:
 
 stdenv.mkDerivation rec {
@@ -14,7 +14,7 @@ stdenv.mkDerivation rec {
   # Not adding 'hostname' command, the build shouldn't depend on what the build
   # host is called.
   nativeBuildInputs = [ pkg-config ];
-  buildInputs = [ which gtk2 pcre glib libxml2 libsoup ];
+  buildInputs = [ which gtk2 pcre glib libxml2 libsoup_2_4 ];
 
   # Fixes '#error You must compile this program without "-O"'
   hardeningDisable = [ "all" ];

pkgs/by-name/hq/hqplayerd/rygel.nix

@@ -16,7 +16,7 @@
 , gupnp-dlna
 , gst_all_1
 , libgee
-, libsoup
+, libsoup_2_4
 , gtk3
 , libmediaart
 , sqlite
@@ -61,7 +61,7 @@ stdenv.mkDerivation rec {
     gupnp-av
     gupnp-dlna
     libgee
-    libsoup
+    libsoup_2_4
     gtk3
     libmediaart
     sqlite

pkgs/by-name/in/insulator2/package.nix

@@ -6,7 +6,7 @@
 , openssl
 , pkg-config
 , freetype
-, libsoup
+, libsoup_2_4
 , gtk3
 , webkitgtk_4_0
 , perl
@@ -85,7 +85,7 @@ stdenv.mkDerivation rec {
     dbus
     openssl.out
     freetype
-    libsoup
+    libsoup_2_4
     gtk3
     webkitgtk_4_0
   ];

pkgs/by-name/in/intune-portal/package.nix

@@ -8,7 +8,7 @@
 , openssl
 , libsecret
 , webkitgtk_4_0
-, libsoup
+, libsoup_2_4
 , gtk3
 , atk
 , pango
@@ -43,7 +43,7 @@ stdenv.mkDerivation rec {
           openssl
           libsecret
           webkitgtk_4_0
-          libsoup
+          libsoup_2_4
           gtk3
           atk
           glib

pkgs/by-name/jm/jmc2obj/package.nix

@@ -0,0 +1,44 @@
+{
+  lib,
+  fetchFromGitHub,
+  jre,
+  makeWrapper,
+  maven,
+}:
+
+maven.buildMavenPackage rec {
+  pname = "j-mc-2-obj";
+  version = "126";
+
+  src = fetchFromGitHub {
+    owner = "jmc2obj";
+    repo = pname;
+    rev = version;
+    hash = "sha256-c0qLryv9Gx9BlKXmwSKkK5/v3Wypny841htNfsNNxpg=";
+  };
+
+  mvnHash = "sha256-ya8E/6tOxyW+AO7v9p0dg72qFpQjWwvntZOw+TEKq0k=";
+
+  mvnParameters = "-Dmaven.gitcommitid.skip=true";
+
+  nativeBuildInputs = [ makeWrapper ];
+
+  installPhase = ''
+    runHook preInstall
+    mkdir -p $out/bin $out/share/jMc2Obj
+    install -Dm644 JAR/jMc2Obj-${version}.jar $out/share/jMc2Obj
+
+    makeWrapper ${lib.getExe jre} $out/bin/jMc2Obj \
+      --add-flags "-jar $out/share/jMc2Obj/jMc2Obj-${version}.jar"
+    runHook postInstall
+  '';
+
+  meta = {
+    changelog = "https://github.com/jmc2obj/j-mc-2-obj/releases/tag/${version}";
+    description = "Java-based Minecraft-to-OBJ exporter";
+    homepage = "https://github.com/jmc2obj/j-mc-2-obj";
+    license = lib.licenses.gpl2Only;
+    maintainers = with lib.maintainers; [ eymeric ];
+    mainProgram = "jMc2Obj";
+  };
+}

pkgs/by-name/li/libchamplain/package.nix

@@ -14,7 +14,7 @@
 , sqlite
 , gnome
 , clutter-gtk
-, libsoup
+, libsoup_2_4
 , libsoup_3
 , gobject-introspection /*, libmemphis */
 , withLibsoup3 ? false
@@ -46,7 +46,7 @@ stdenv.mkDerivation rec {
 
   buildInputs = [
     sqlite
-    (if withLibsoup3 then libsoup_3 else libsoup)
+    (if withLibsoup3 then libsoup_3 else libsoup_2_4)
   ];
 
   propagatedBuildInputs = [

pkgs/by-name/li/libepc/package.nix

@@ -10,7 +10,7 @@
 , avahi
 , gnutls
 , libuuid
-, libsoup
+, libsoup_2_4
 , gtk3
 , gnome
 }:
@@ -48,7 +48,7 @@ stdenv.mkDerivation (finalAttrs: {
   propagatedBuildInputs = [
     avahi
     gnutls
-    libsoup
+    libsoup_2_4
   ];
 
   enableParallelBuilding = true;

pkgs/by-name/li/libgdata/package.nix

@@ -16,7 +16,7 @@
 , p11-kit
 , openssl
 , uhttpmock
-, libsoup
+, libsoup_2_4
 }:
 
 stdenv.mkDerivation rec {
@@ -52,7 +52,7 @@ stdenv.mkDerivation rec {
 
   propagatedBuildInputs = [
     glib
-    libsoup
+    libsoup_2_4
     libxml2
     gnome-online-accounts
     json-glib

pkgs/by-name/li/libgedit-gfls/package.nix

@@ -14,7 +14,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "libgedit-gfls";
-  version = "0.2.0";
+  version = "0.2.1";
 
   outputs = [ "out" "dev" "devdoc" ];
 
@@ -24,7 +24,7 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "gedit";
     repo = "libgedit-gfls";
     rev = finalAttrs.version;
-    hash = "sha256-oxsqggn4O4SwGEas840qE103hKU4f+GP+ItOtD3M+ac=";
+    hash = "sha256-kMkqEly8RDc5eKqUupQD4tkVIXxL1rt4e/OCAPoutIg=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/li/libhttpseverywhere/package.nix

@@ -1,5 +1,5 @@
 { lib, stdenv, fetchurl, pkg-config, meson, ninja, makeFontsConf, vala, fetchpatch
-, gnome, libgee, glib, json-glib, libarchive, libsoup, gobject-introspection }:
+, gnome, libgee, glib, json-glib, libarchive, libsoup_2_4, gobject-introspection }:
 
 let
   pname = "libhttpseverywhere";
@@ -13,7 +13,7 @@ in stdenv.mkDerivation rec {
   };
 
   nativeBuildInputs = [ vala gobject-introspection meson ninja pkg-config ];
-  buildInputs = [ glib libgee json-glib libsoup libarchive ];
+  buildInputs = [ glib libgee json-glib libsoup_2_4 libarchive ];
 
   patches = [
     # Fixes build with vala >=0.42

pkgs/by-name/li/libxplayer-plparser/package.nix

@@ -6,7 +6,7 @@
 , gobject-introspection
 , gmime3
 , libxml2
-, libsoup
+, libsoup_2_4
 , pkg-config
 }:
 
@@ -31,7 +31,7 @@ stdenv.mkDerivation rec {
   buildInputs = [
     gmime3
     libxml2
-    libsoup
+    libsoup_2_4
   ];
 
   meta = with lib; {

pkgs/by-name/li/libzapojit/package.nix

@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchurl, pkg-config, glib, intltool, json-glib, librest, libsoup, gnome, gnome-online-accounts, gobject-introspection }:
+{ lib, stdenv, fetchurl, pkg-config, glib, intltool, json-glib, librest, libsoup_2_4, gnome, gnome-online-accounts, gobject-introspection }:
 
 stdenv.mkDerivation rec {
   pname = "libzapojit";
@@ -12,7 +12,7 @@ stdenv.mkDerivation rec {
   };
 
   nativeBuildInputs = [ pkg-config intltool gobject-introspection ];
-  propagatedBuildInputs = [ glib json-glib librest libsoup gnome-online-accounts ]; # zapojit-0.0.pc
+  propagatedBuildInputs = [ glib json-glib librest libsoup_2_4 gnome-online-accounts ]; # zapojit-0.0.pc
 
   passthru = {
     updateScript = gnome.updateScript {

pkgs/by-name/ll/lla/package.nix

@@ -7,7 +7,7 @@
   nix-update-script,
 }:
 let
-  version = "0.2.9";
+  version = "0.2.10";
 in
 rustPlatform.buildRustPackage {
   pname = "lla";
@@ -17,12 +17,12 @@ rustPlatform.buildRustPackage {
     owner = "triyanox";
     repo = "lla";
     rev = "refs/tags/v${version}";
-    hash = "sha256-bemu4MuZYmn6LDIGxCAxIuS78alz8UE6qHhLoxtZSUk=";
+    hash = "sha256-zHtHlEAh170t05DO5b/vspODkqx5G9C3nt5G8dtm8wI=";
   };
 
   nativeBuildInputs = [ makeBinaryWrapper ];
 
-  cargoHash = "sha256-sjJUG32jchAG/q4y649PyTJ2kqjT+0COSvO2QM6GnV0=";
+  cargoHash = "sha256-ar7NEQKTdxM96dT9b9BBfYZA3zVlhN6OciKRo4ZhBSU=";
 
   cargoBuildFlags = [ "--workspace" ];
 

pkgs/by-name/lu/lurk/package.nix

@@ -10,8 +10,8 @@ rustPlatform.buildRustPackage rec {
 
   src = fetchFromGitHub {
     owner = "jakwai01";
-    repo = pname;
-    rev = "v${version}";
+    repo = "lurk";
+    tag = "v${version}";
     hash = "sha256-KiM5w0YPxEpJ4cR/8YfhWlTrffqf5Ak1eu0yxgOmqUs=";
   };
 
@@ -22,16 +22,19 @@ rustPlatform.buildRustPackage rec {
       --replace-fail '/usr/bin/ls' 'ls'
   '';
 
-  meta = with lib; {
+  meta = {
+    changelog = "https://github.com/jakwai01/lurk/releases/tag/v${version}";
     description = "Simple and pretty alternative to strace";
-    mainProgram = "lurk";
     homepage = "https://github.com/jakwai01/lurk";
-    changelog = "https://github.com/jakwai01/lurk/releases/tag/${src.rev}";
-    license = licenses.agpl3Only;
-    maintainers = with maintainers; [ figsoda ];
+    license = lib.licenses.agpl3Only;
+    mainProgram = "lurk";
+    maintainers = with lib.maintainers; [
+      figsoda
+    ];
     platforms = [
       "i686-linux"
       "x86_64-linux"
+      "aarch64-linux"
     ];
   };
 }

pkgs/by-name/ma/mangayomi/package.nix

@@ -43,19 +43,19 @@
 }:
 let
   pname = "mangayomi";
-  version = "0.3.75";
+  version = "0.3.8";
   src = fetchFromGitHub {
     owner = "kodjodevf";
     repo = "mangayomi";
     tag = "v${version}";
-    hash = "sha256-kVAtUXEysaCJSLobXlgAgK59pgLq8Ze/XDqQNNdKdzg=";
+    hash = "sha256-TOCDGmJ5tlpcGS8NeVdIdx946rM1/ItQVY9OnDS6uZ0=";
   };
   rustDep = rustPlatform.buildRustPackage {
     inherit pname version src;
 
     sourceRoot = "${src.name}/rust";
 
-    cargoHash = "sha256-b4PRFe8FgP/PXHwSw2qmderPRFCBC1ISQuf8uZcsxpY=";
+    cargoHash = "sha256-6Iraw5gtlVW3iSrT2zQh6JLubVTZy/y8/5quXKee2Ko=";
 
     passthru.libraryPath = "lib/librust_lib_mangayomi.so";
   };
@@ -90,7 +90,7 @@ flutter324.buildFlutterApplication {
   };
 
   gitHashes = {
-    desktop_webview_window = "sha256-Z9ehzDKe1W3wGa2AcZoP73hlSwydggO6DaXd9mop+cM=";
+    desktop_webview_window = "sha256-wRxQPlJZZe4t2C6+G5dMx3+w8scxWENLwII08dlZ4IA=";
     flutter_qjs = "sha256-m+Z0bCswylfd1E2Y6X6bdPivkSlXUxO4J0Icbco+/0A=";
     media_kit_libs_windows_video = "sha256-SYVVOR6vViAsDH5MclInJk8bTt/Um4ccYgYDFrb5LBk=";
     media_kit_native_event_loop = "sha256-SYVVOR6vViAsDH5MclInJk8bTt/Um4ccYgYDFrb5LBk=";

pkgs/by-name/ma/mangayomi/pubspec.lock.json

@@ -399,10 +399,10 @@
     "desktop_webview_window": {
       "dependency": "direct main",
       "description": {
-        "path": ".",
-        "ref": "no_texture",
-        "resolved-ref": "109f1739727a71d8da60696143f5af91061faab2",
-        "url": "https://github.com/Predidit/linux_webview_window.git"
+        "path": "packages/desktop_webview_window",
+        "ref": "main",
+        "resolved-ref": "2aa8d449881974182d033df9635cf7c198d2553a",
+        "url": "https://github.com/kodjodevf/desktop_webview_window.git"
       },
       "source": "git",
       "version": "0.2.4"
@@ -441,11 +441,11 @@
       "dependency": "transitive",
       "description": {
         "name": "equatable",
-        "sha256": "c2b87cb7756efdf69892005af546c56c0b5037f54d2a88269b4f347a505e3ca2",
+        "sha256": "567c64b3cb4cf82397aac55f4f0cbd3ca20d77c6c03bedbc4ceaddc08904aef7",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "2.0.5"
+      "version": "2.0.7"
     },
     "exception_templates": {
       "dependency": "transitive",
@@ -836,11 +836,11 @@
       "dependency": "direct main",
       "description": {
         "name": "go_router",
-        "sha256": "8ae664a70174163b9f65ea68dd8673e29db8f9095de7b5cd00e167c621f4fef5",
+        "sha256": "8660b74171fafae4aa8202100fa2e55349e078281dadc73a241eb8e758534d9d",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "14.6.0"
+      "version": "14.6.1"
     },
     "google_fonts": {
       "dependency": "direct main",
@@ -1379,11 +1379,11 @@
       "dependency": "transitive",
       "description": {
         "name": "path_provider_android",
-        "sha256": "c464428172cb986b758c6d1724c603097febb8fb855aa265aeecc9280c294d4a",
+        "sha256": "8c4967f8b7cb46dc914e178daa29813d83ae502e0529d7b0478330616a691ef7",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "2.2.12"
+      "version": "2.2.14"
     },
     "path_provider_foundation": {
       "dependency": "transitive",
@@ -1788,11 +1788,11 @@
       "dependency": "transitive",
       "description": {
         "name": "shelf_web_socket",
-        "sha256": "073c147238594ecd0d193f3456a5fe91c4b0abbcc68bf5cd95b36c4e194ac611",
+        "sha256": "cc36c297b52866d203dbf9332263c94becc2fe0ceaa9681d07b6ef9807023b67",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "2.0.0"
+      "version": "2.0.1"
     },
     "sky_engine": {
       "dependency": "transitive",

pkgs/by-name/ma/markets/package.nix

@@ -1,7 +1,7 @@
 { lib, stdenv, fetchFromGitHub
 , desktop-file-utils, glib, gtk3, meson, ninja, pkg-config, python3, vala
 , wrapGAppsHook3
-, glib-networking, gobject-introspection, json-glib, libgee, libhandy, libsoup
+, glib-networking, gobject-introspection, json-glib, libgee, libhandy, libsoup_2_4
 }:
 
 stdenv.mkDerivation rec {
@@ -21,7 +21,7 @@ stdenv.mkDerivation rec {
   ];
   buildInputs = [
     glib glib-networking gtk3 json-glib libgee libhandy
-    libsoup
+    libsoup_2_4
   ];
 
   postPatch = ''

pkgs/by-name/me/meteo/package.nix

@@ -15,7 +15,7 @@
 , gtk3
 , json-glib
 , libappindicator
-, libsoup
+, libsoup_2_4
 , webkitgtk_4_0
 }:
 
@@ -47,7 +47,7 @@ stdenv.mkDerivation rec {
     gtk3
     json-glib
     libappindicator
-    libsoup
+    libsoup_2_4
     webkitgtk_4_0
   ];
 

pkgs/by-name/mi/midori-unwrapped/package.nix

@@ -12,7 +12,7 @@
 , webkitgtk_4_0
 , sqlite
 , gsettings-desktop-schemas
-, libsoup
+, libsoup_2_4
 , glib-networking
 , json-glib
 , libarchive
@@ -37,7 +37,7 @@ stdenv.mkDerivation rec {
   ];
 
   buildInputs = [
-    (libsoup.override { gnomeSupport = true; })
+    (libsoup_2_4.override { gnomeSupport = true; })
     gcr
     glib-networking
     gsettings-desktop-schemas

pkgs/by-name/mo/moonraker/package.nix

@@ -20,17 +20,18 @@ let
       apprise
       python-periphery
       ldap3
+      importlib-metadata
     ]
   );
 in stdenvNoCC.mkDerivation rec {
   pname = "moonraker";
-  version = "0.8.0-unstable-2023-12-27";
+  version = "0.9.3-unstable-2024-11-17";
 
   src = fetchFromGitHub {
     owner = "Arksine";
     repo = "moonraker";
-    rev = "c226e9c1e44d65ff6ea400b81e3cedba7f637976";
-    sha256 = "sha256-wdf4uab8pJEWaX6PFN9Y9pykmylmxJ4Oo5pwSQcyjCc=";
+    rev = "ccfe32f2368a5ff6c2497478319909daeeeb8edf";
+    sha256 = "sha256-aCYE3EmflMRIHnGnkZ/0+zScVA5liHSbavScQ7XRf/4=";
   };
 
   nativeBuildInputs = [ makeWrapper ];

pkgs/by-name/mo/mouse-actions-gui/package.nix

@@ -14,7 +14,7 @@
   libXtst,
   libevdev,
   gtk3,
-  libsoup,
+  libsoup_2_4,
   webkitgtk_4_0,
 }:
 
@@ -46,7 +46,7 @@ rustPlatform.buildRustPackage rec {
 
     # Tauri deps
     gtk3
-    libsoup
+    libsoup_2_4
     webkitgtk_4_0
   ];
 

pkgs/by-name/mo/mozillavpn/package.nix

@@ -23,13 +23,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "mozillavpn";
-  version = "2.24.1";
+  version = "2.24.3";
   src = fetchFromGitHub {
     owner = "mozilla-mobile";
     repo = "mozilla-vpn-client";
     rev = "v${finalAttrs.version}";
     fetchSubmodules = true;
-    hash = "sha256-X2rtHAZ9vbWjuOmD3B/uPasUQ1Q+b4SkNqk4MqGMaYo=";
+    hash = "sha256-GRt0diDt8bEeMfDwiEtYyR+20/bJAVcDal9eGfvk340=";
   };
   patches = [
     # Fix build errors from deprecated `QByteArray::count()`, `QVariant::type()`, `QEventPoint::pos()` (#9961)

pkgs/by-name/ng/nghttp2/package.nix

@@ -18,7 +18,7 @@
 
 # downstream dependencies, for testing
 , curl
-, libsoup
+, libsoup_3
 }:
 
 # Note: this package is used for bootstrapping fetchurl, and thus cannot use fetchpatch!
@@ -88,7 +88,7 @@ stdenv.mkDerivation rec {
   '';
 
   passthru.tests = {
-    inherit curl libsoup;
+    inherit curl libsoup_3;
   };
 
   meta = with lib; {

pkgs/by-name/no/novelwriter/package.nix

@@ -7,7 +7,7 @@
   nix-update-script,
 }:
 let
-  version = "2.5.2";
+  version = "2.5.3";
 in
 python3.pkgs.buildPythonApplication {
   pname = "novelwriter";
@@ -18,7 +18,7 @@ python3.pkgs.buildPythonApplication {
     owner = "vkbo";
     repo = "novelWriter";
     rev = "v${version}";
-    hash = "sha256-xRSq6lBZ6jHtNve027uF2uNs3/40s0YdFN9F9O7m5VU=";
+    hash = "sha256-OrsDL5zpMDV2spxC0jtpuhaSWBIS6XBEWZuVxHAS/QM=";
   };
 
   nativeBuildInputs = [ qt5.wrapQtAppsHook ];

pkgs/by-name/op/opnborg/package.nix

@@ -5,13 +5,13 @@
 }:
 buildGoModule rec {
   pname = "opnborg";
-  version = "0.1.24";
+  version = "0.1.44";
 
   src = fetchFromGitHub {
     owner = "paepckehh";
     repo = "opnborg";
     rev = "v${version}";
-    hash = "sha256-lJPu1Ixx1BUWrZ+h6AuxLyVMScKAmcp+sK2duOxC9e0=";
+    hash = "sha256-I8twrDeAEfsUOKE7+Jj5IqVjkIv9oNBDZjvGx5iwHRQ=";
   };
 
   vendorHash = "sha256-REXJryUcu+/AdVx1aK0nJ98Wq/EdhrZqL24kC1wK6mc=";

pkgs/by-name/os/osm-gps-map/package.nix

@@ -1,4 +1,4 @@
-{ cairo, fetchzip, glib, libsoup, gnome-common, gtk3, gobject-introspection, pkg-config, lib, stdenv }:
+{ cairo, fetchzip, glib, libsoup_2_4, gnome-common, gtk3, gobject-introspection, pkg-config, lib, stdenv }:
 
 stdenv.mkDerivation rec {
   pname = "osm-gps-map";
@@ -16,7 +16,7 @@ stdenv.mkDerivation rec {
   buildInputs = [
     cairo glib
     gtk3
-    libsoup
+    libsoup_2_4
   ];
 
   meta = with lib; {

pkgs/by-name/os/ostree/package.nix

@@ -12,7 +12,7 @@
 , systemd
 , xz
 , e2fsprogs
-, libsoup
+, libsoup_2_4
 , glib-networking
 , wrapGAppsNoGuiHook
 , gpgme
@@ -72,7 +72,7 @@ in stdenv.mkDerivation rec {
     glib
     systemd
     e2fsprogs
-    libsoup
+    libsoup_2_4
     glib-networking
     gpgme
     fuse3

pkgs/by-name/ov/overlayed/package.nix

@@ -4,7 +4,7 @@
   callPackage,
   pkg-config,
   openssl,
-  libsoup,
+  libsoup_3,
   webkitgtk_4_1,
   fetchFromGitHub,
   libayatana-appindicator,
@@ -35,7 +35,7 @@ rustPlatform.buildRustPackage rec {
   buildInputs = [
     openssl
     webkitgtk_4_1
-    libsoup
+    libsoup_3
   ];
 
   env = {

pkgs/by-name/po/pot/package.nix

@@ -15,7 +15,7 @@
   libayatana-appindicator,
   gtk3,
   webkitgtk_4_0,
-  libsoup,
+  libsoup_2_4,
   openssl,
   xdotool,
 }:
@@ -69,7 +69,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   buildInputs = [
     gtk3
-    libsoup
+    libsoup_2_4
     libayatana-appindicator
     openssl
     webkitgtk_4_0

pkgs/by-name/pr/prisma/package.nix

@@ -13,13 +13,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "prisma";
-  version = "5.22.0";
+  version = "6.0.1";
 
   src = fetchFromGitHub {
     owner = "prisma";
     repo = "prisma";
     rev = finalAttrs.version;
-    hash = "sha256-Z7zSL2eixoNqWpgzVbiDUG2ViSmJtho7lRmvZ10ft3I=";
+    hash = "sha256-mwGFuJLry2WvwLclRw+ulMVgp8tfZbhzrdgKjQ4D7LE=";
   };
 
   nativeBuildInputs = [
@@ -32,7 +32,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   pnpmDeps = pnpm_8.fetchDeps {
     inherit (finalAttrs) pname version src;
-    hash = "sha256-2o6ClY0zMctLR4nFmApiYnzXlrN1EqbHkAP/FEcXnEQ=";
+    hash = "sha256-fOg32w/fQkyn8HBMffUKob7XzOQLtsB642pDdEz/y2E=";
   };
 
   patchPhase = ''

pkgs/by-name/pu/pulsarctl/package.nix

@@ -10,16 +10,16 @@
 
 buildGoModule rec {
   pname = "pulsarctl";
-  version = "2.11.1.3";
+  version = "4.0.0.4";
 
   src = fetchFromGitHub {
     owner = "streamnative";
     repo = "pulsarctl";
     rev = "v${version}";
-    hash = "sha256-sztjHw3su8KAV/zZcJqPWhjblINa8nYCN5Dzhn6X07w=";
+    hash = "sha256-3uRDfoxj+ra6fEOE317ENKEuv5q+qHcEm6rw2GODK5g=";
   };
 
-  vendorHash = "sha256-NQ8zvrW6lBF1js+WI2PPvXhv4YRS2IBT6S4vDoE1BFc=";
+  vendorHash = "sha256-wNUTJn7Ar+GlePEhdr6xeolAiltJdAoIs5o5uDo8Ibs=";
 
   nativeBuildInputs = [ installShellFiles ];
 

pkgs/by-name/pw/pwsafe/package.nix

@@ -28,13 +28,13 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "pwsafe";
-  version = "1.18.0"; # do NOT update to 3.x Windows releases
+  version = "1.20.0"; # do NOT update to 3.x Windows releases
 
   src = fetchFromGitHub {
     owner = pname;
     repo = pname;
     rev = version;
-    hash = "sha256-2n3JJ/DPhJpNOyviYpqQQl83IAZnmnH5w7b/pOGU8K8=";
+    hash = "sha256-GmM7AXnTjw6kme2mZqmKrirsorosSygJ38H5fnIqTZ4=";
   };
 
   strictDeps = true;

pkgs/by-name/re/remotebox/package.nix

@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "remotebox";
-  version = "2.7";
+  version = "3.4";
 
   src = fetchurl {
     url = "http://remotebox.knobgoblin.org.uk/downloads/RemoteBox-${version}.tar.bz2";
-    sha256 = "0csf6gd7pqq4abia4z0zpzlq865ri1z0821kjy7p3iawqlfn75pb";
+    sha256 = "sha256-oIWSli/pc+kqMkYqkeHr3fZshWUHx6ecqAZXf6fl2ik=";
   };
 
   buildInputs = with perlPackages; [ perl Glib Gtk2 Pango SOAPLite ];

pkgs/by-name/re/reposilite/plugins.nix

@@ -0,0 +1,49 @@
+{
+  generateSplicesForMkScope,
+  makeScopeWithSplicing',
+}:
+makeScopeWithSplicing' {
+  otherSplices = generateSplicesForMkScope;
+  f =
+    self:
+    {
+      fetchPlugin = self.callPackage (
+        {
+          lib,
+          fetchurl,
+          reposilite,
+        }:
+        lib.makeOverridable (
+          { name, hash }:
+          let
+            inherit (reposilite) version;
+
+            fancyName = lib.concatStrings [
+              (lib.toUpper (builtins.substring 0 1 name))
+              (builtins.substring 1 ((builtins.stringLength name) - 1) name)
+            ];
+          in
+          fetchurl {
+            url = "https://maven.reposilite.com/releases/com/reposilite/plugin/${name}-plugin/${version}/${name}-plugin-${version}-all.jar";
+            inherit version hash;
+
+            meta = {
+              description = "${fancyName} plugin for Reposilite.";
+              homepage = "https://github.com/dzikoysk/reposilite";
+              sourceProvenance = with lib.sourceTypes; [ binaryBytecode ];
+              license = lib.licenses.asl20;
+              maintainers = with lib.maintainers; [ uku3lig ];
+              inherit (reposilite.meta) platforms;
+            };
+          }
+        )
+      ) { };
+    }
+    // builtins.mapAttrs (name: hash: self.fetchPlugin { inherit name hash; }) {
+      checksum = "sha256-ocvjjcrZW8I7hMdWiUn36XEbx3TqNYi0okemo9zWelA=";
+      groovy = "sha256-2NSTaivUAUMnAPHNqTNHWGqA8AF8jU9CE2ab9VGIFLo=";
+      migration = "sha256-+BfbLEy2gc81HVCyI2JREIIYMirKwPV48shMBAMbWlU=";
+      prometheus = "sha256-aukYUIS6S37ut9h+gO/JLrBUX/6RND5BhLqsrArxSUo=";
+      swagger = "sha256-zD2ihVEfQeH3S1df3o2gF19kGIODW2yIRWCGbk4npJY=";
+    };
+}

pkgs/by-name/sh/shellhub-agent/package.nix

@@ -11,18 +11,18 @@
 
 buildGoModule rec {
   pname = "shellhub-agent";
-  version = "0.16.4";
+  version = "0.17.2";
 
   src = fetchFromGitHub {
     owner = "shellhub-io";
     repo = "shellhub";
     rev = "v${version}";
-    hash = "sha256-pxV9WLx0trgG0htWuYG/j634iaQRo5/TXOOU8rOmxDw=";
+    hash = "sha256-zMAAimFrOMcBVKuFwl/UpJLEWJHrjH7DNno5KCEvGrM=";
   };
 
   modRoot = "./agent";
 
-  vendorHash = "sha256-qqh9KdhOt6KDgwUhf6lzb6I7YAhocBSZ7UeyBT0e0eM=";
+  vendorHash = "sha256-jQNWuOwaAx//wDUVOrMc+ETWWbTCTp/SLwL2guERJB8=";
 
   ldflags = [ "-s" "-w" "-X main.AgentVersion=v${version}" ];