Merge 015baae019 into haskell-updates

doc/languages-frameworks/android.section.md

@@ -27,7 +27,7 @@ buildInputs = [
 ];
 ```
 
-These will export ANDROID_SDK_ROOT and ANDROID_NDK_ROOT to the SDK and NDK directories
+These will export `ANDROID_SDK_ROOT` and `ANDROID_NDK_ROOT` to the SDK and NDK directories
 in the specified Android build environment.
 
 ## Deploying an Android SDK installation with plugins {#deploying-an-android-sdk-installation-with-plugins}
@@ -39,24 +39,12 @@ with import <nixpkgs> {};
 
 let
   androidComposition = androidenv.composeAndroidPackages {
-    cmdLineToolsVersion = "8.0";
-    toolsVersion = "26.1.1";
-    platformToolsVersion = "30.0.5";
-    buildToolsVersions = [ "30.0.3" ];
-    includeEmulator = false;
-    emulatorVersion = "30.3.4";
-    platformVersions = [ "28" "29" "30" ];
-    includeSources = false;
-    includeSystemImages = false;
+    platformVersions = [ "34" "35" ];
     systemImageTypes = [ "google_apis_playstore" ];
     abiVersions = [ "armeabi-v7a" "arm64-v8a" ];
-    cmakeVersions = [ "3.10.2" ];
     includeNDK = true;
-    ndkVersions = ["22.0.7026061"];
-    useGoogleAPIs = false;
-    useGoogleTVAddOns = false;
     includeExtras = [
-      "extras;google;gcm"
+      "extras;google;auto"
     ];
   };
 in
@@ -69,27 +57,44 @@ exceptions are the tools, platform-tools and build-tools sub packages.
 
 The following parameters are supported:
 
-* `cmdLineToolsVersion `, specifies the version of the `cmdline-tools` package to use
+* `cmdLineToolsVersion` specifies the version of the `cmdline-tools` package to use.
+  It defaults to the latest.
 * `toolsVersion`, specifies the version of the `tools` package. Notice `tools` is
   obsolete, and currently only `26.1.1` is available, so there's not a lot of
-  options here, however, you can set it as `null` if you don't want it.
-* `platformsToolsVersion` specifies the version of the `platform-tools` plugin
+  options here, however, you can set it as `null` if you don't want it. It defaults
+  to the latest.
+* `platformToolsVersion` specifies the version of the `platform-tools` plugin.
+  It defaults to the latest.
 * `buildToolsVersions` specifies the versions of the `build-tools` plugins to
-  use.
+  use. It defaults to the latest.
 * `includeEmulator` specifies whether to deploy the emulator package (`false`
   by default). When enabled, the version of the emulator to deploy can be
-  specified by setting the `emulatorVersion` parameter.
+  specified by setting the `emulatorVersion` parameter. If set to
+  `"if-supported"`, it will deploy the emulator if it's supported by the system.
+* `includeCmake` specifies whether CMake should be included. It defaults to true
+  on x86-64 and Darwin platforms, and also supports `"if-supported"`.
 * `cmakeVersions` specifies which CMake versions should be deployed.
+  It defaults to the latest.
 * `includeNDK` specifies that the Android NDK bundle should be included.
-  Defaults to: `false`.
+  Defaults to `false` though can be set to `true` or `"if-supported"`.
 * `ndkVersions` specifies the NDK versions that we want to use. These are linked
   under the `ndk` directory of the SDK root, and the first is linked under the
-  `ndk-bundle` directory.
+  `ndk-bundle` directory. It defaults to the latest.
 * `ndkVersion` is equivalent to specifying one entry in `ndkVersions`, and
   `ndkVersions` overrides this parameter if provided.
 * `includeExtras` is an array of identifier strings referring to arbitrary
-  add-on packages that should be installed.
+  add-on packages that should be installed. Note that extras may not be compatible
+  with all platforms (for example, the Google TV head unit, which does not
+  have an aarch64-linux compile).
 * `platformVersions` specifies which platform SDK versions should be included.
+  It defaults to including only the latest API level, though you can add more.
+* `numLatestPlatformVersions` specifies how many of the latest API levels to include,
+  if you are using the default for `platformVersions`. It defaults to 1, though you can
+  increase this to, for example, 5 to get the last 5 years of Android API packages.
+* `minPlatformVersion` and `maxPlatformVersion` take priority over `platformVersions`
+  if both are provided. Note that `maxPlatformVersion` always defaults to the latest
+  Android SDK platform version, allowing you to specify `minPlatformVersion` to describe
+  the minimum SDK version your Android composition supports.
 
 For each platform version that has been specified, we can apply the following
 options:
@@ -108,9 +113,10 @@ For each requested system image we can specify the following options:
 * `systemImageTypes` specifies what kind of system images should be included.
   Defaults to: `default`.
 * `abiVersions` specifies what kind of ABI version of each system image should
-  be included. Defaults to: `armeabi-v7a`.
+  be included. Defaults to `armeabi-v7a` and `arm64-v8a`.
 
-Most of the function arguments have reasonable default settings.
+Most of the function arguments have reasonable default settings, preferring the latest
+versions of tools when possible.
 
 You can specify license names:
 
@@ -127,7 +133,8 @@ pull from:
   by running `generate.sh`, which in turn will call into `mkrepo.rb`.
 * `repoXmls` is an attribute set containing paths to repo XML files. If specified,
   it takes priority over `repoJson`, and will trigger a local build writing out a
-  repo.json to the Nix store based on the given repository XMLs.
+  repo.json to the Nix store based on the given repository XMLs. Note that this uses
+  import-from-derivation.
 
 ```nix
 {
@@ -312,27 +319,23 @@ android {
 
 ## Querying the available versions of each plugin {#querying-the-available-versions-of-each-plugin}
 
-repo.json provides all the options in one file now.
-
-A shell script in the `pkgs/development/mobile/androidenv/` subdirectory can be used to retrieve all
-possible options:
-
-```bash
-./querypackages.sh packages
-```
-
-The above command-line instruction queries all package versions in repo.json.
+All androidenv packages are available on [search.nixos.org](https://search.nixos.org).
+Note that `aarch64-linux` compatibility is currently spotty, though `x86_64-linux` and `aarch64-darwin`
+are well supported. This is because Google's repository definitions mark some packages for "all" architectures
+that are really only for `x86_64` or `aarch64`.
 
 ## Updating the generated expressions {#updating-the-generated-expressions}
 
 repo.json is generated from XML files that the Android Studio package manager uses.
-To update the expressions run the `generate.sh` script that is stored in the
+To update the expressions run the `update.sh` script that is stored in the
 `pkgs/development/mobile/androidenv/` subdirectory:
 
 ```bash
-./generate.sh
+./update.sh
 ```
 
+This is run automatically by the nixpkgs update script.
+
 ## Building an Android application with Ant {#building-an-android-application-with-ant}
 
 In addition to the SDK, it is also possible to build an Ant-based Android

maintainers/maintainer-list.nix

@@ -3639,6 +3639,11 @@
     githubId = 200617;
     name = "Ben Sima";
   };
+  bstanderline = {
+    name = "bstanderline";
+    github = "bstanderline";
+    githubId = 153822813;
+  };
   btlvr = {
     email = "btlvr@protonmail.com";
     github = "btlvr";
@@ -7851,6 +7856,12 @@
     githubId = 11705326;
     name = "Max Kochurov";
   };
+  fettgoenner = {
+    email = "paulmatti@protonmail.com";
+    github = "fettgoenner";
+    githubId = 92429150;
+    name = "Paul Meinhold";
+  };
   ffinkdevs = {
     email = "fink@h0st.space";
     github = "ffinkdevs";
@@ -17372,6 +17383,12 @@
     githubId = 7191115;
     name = "Nova Leary";
   };
+  novmar = {
+    email = "novotny@marnov.cz";
+    github = "novmar";
+    githubId = 26750149;
+    name = "Marcel Novotny";
+  };
   novoxd = {
     email = "radnovox@gmail.com";
     github = "novoxd";
@@ -19576,6 +19593,13 @@
     github = "qdlmcfresh";
     githubId = 10837173;
   };
+  qf0xb = {
+    name = "Quirin Brändli";
+    email = "development@qf0xb.de";
+    github = "QF0xB";
+    githubId = 37348361;
+    keys = [ { fingerprint = "9036 0B7D B6B7 8B75 E901  3D11 3FF8 C23C 46F2 CC90"; } ];
+  };
   qjoly = {
     email = "github@une-pause-cafe.fr";
     github = "qjoly";

maintainers/team-list.nix

@@ -597,6 +597,7 @@ with lib.maintainers;
   jitsi = {
     members = [
       cleeyv
+      novmar
       ryantm
       lassulus
       yayayayaka

nixos/doc/manual/release-notes/rl-2205.section.md

@@ -101,7 +101,7 @@ In addition to numerous new and upgraded packages, this release has the followin
 
 - [InvoicePlane](https://invoiceplane.com), web application for managing and creating invoices. Available at [services.invoiceplane](#opt-services.invoiceplane.sites._name_.enable).
 
-- [k3b](https://userbase.kde.org/K3b), the KDE disk burning application. Available as [programs.k3b](#opt-programs.k3b.enable).
+- [k3b](https://userbase.kde.org/K3b), the KDE disk burning application. Available as programs.k3b.
 
 - [K40-Whisperer](https://www.scorchworks.com/K40whisperer/k40whisperer.html), a program to control cheap Chinese laser cutters. Available as [programs.k40-whisperer.enable](#opt-programs.k40-whisperer.enable). Users must add themselves to the `k40` group to be able to access the device.
 

nixos/doc/manual/release-notes/rl-2505.section.md

@@ -61,6 +61,11 @@
   - A new `pkgs.mattermost.buildPlugin` function has been added, which allows plugins to be built from source, including webapp frontends with a supported package-lock.json. See the Mattermost NixOS test and [manual](https://nixos.org/manual/nixpkgs/unstable/#sec-mattermost-plugins-build) for an example.
   - Note that the Mattermost module will create an account _without_ a well-known UID if the username differs from the default (`mattermost`). If you used Mattermost with a nonstandard username, you may want to review the module changes before upgrading.
 
+- androidenv has been updated:
+  - All versions specified in composeAndroidPackages now track latest. Android packages are automatically updated on unstable, and run the androidenv test suite on every update.
+  - Some androidenv packages are now searchable on [search.nixos.org](https://search.nixos.org).
+  - We now use the latest Google repositories, which should improve aarch64-darwin compatibility. The SDK now additionally evaluates on aarch64-linux, though not all packages are functional.
+
 <!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->
 
 ## New Modules {#sec-release-25.05-new-modules}

nixos/modules/programs/k3b.nix

@@ -1,50 +1,8 @@
-{ config, pkgs, lib, ... }:
+{ lib, ... }:
 
 {
-  # interface
-  options.programs.k3b = {
-    enable = lib.mkOption {
-      type = lib.types.bool;
-      default = false;
-      description = ''
-        Whether to enable k3b, the KDE disk burning application.
-
-        Additionally to installing `k3b` enabling this will
-        add `setuid` wrappers in `/run/wrappers/bin`
-        for both `cdrdao` and `cdrecord`. On first
-        run you must manually configure the path of `cdrdae` and
-        `cdrecord` to correspond to the appropriate paths under
-        `/run/wrappers/bin` in the "Setup External Programs" menu.
-      '';
-    };
-  };
-
-  # implementation
-  config = lib.mkIf config.programs.k3b.enable {
-
-    environment.systemPackages = with pkgs; [
-      k3b
-      dvdplusrwtools
-      cdrdao
-      cdrtools
-    ];
-
-    security.wrappers = {
-      cdrdao = {
-        setuid = true;
-        owner = "root";
-        group = "cdrom";
-        permissions = "u+wrx,g+x";
-        source = "${pkgs.cdrdao}/bin/cdrdao";
-      };
-      cdrecord = {
-        setuid = true;
-        owner = "root";
-        group = "cdrom";
-        permissions = "u+wrx,g+x";
-        source = "${pkgs.cdrtools}/bin/cdrecord";
-      };
-    };
-
-  };
+  imports = [
+    (lib.mkRemovedOptionModule [ "programs" "k3b" "enable" ]
+      "Please add kdePackages.k3b to environment.systemPackages instead")
+  ];
 }

nixos/modules/services/web-apps/agorakit.nix

@@ -13,6 +13,7 @@ let
 
   user = cfg.user;
   group = cfg.group;
+  php = lib.getExe pkgs.php82;
 
   # shell script for local administration
   artisan = pkgs.writeScriptBin "agorakit" ''
@@ -25,7 +26,7 @@ let
         exec "$@"
       fi
     }
-    sudo ${lib.getExe pkgs.php} artisan "$@"
+    sudo ${php} artisan "$@"
   '';
 
   tlsEnabled = cfg.nginx.addSSL || cfg.nginx.forceSSL || cfg.nginx.onlySSL || cfg.nginx.enableACME;
@@ -447,9 +448,9 @@ in
           fi
 
           # migrate & seed db
-          ${pkgs.php}/bin/php artisan key:generate --force
-          ${pkgs.php}/bin/php artisan migrate --force
-          ${pkgs.php}/bin/php artisan config:cache
+          ${php} artisan key:generate --force
+          ${php} artisan migrate --force
+          ${php} artisan config:cache
         '';
     };
 

nixos/modules/services/web-apps/calibre-web.nix

@@ -4,7 +4,7 @@ let
   cfg = config.services.calibre-web;
   dataDir = if lib.hasPrefix "/" cfg.dataDir then cfg.dataDir else "/var/lib/${cfg.dataDir}";
 
-  inherit (lib) concatStringsSep mkEnableOption mkIf mkOption optional optionalString types;
+  inherit (lib) concatStringsSep mkEnableOption mkIf mkOption optional optionals optionalString types;
 in
 {
   options = {
@@ -129,7 +129,10 @@ in
           "config_reverse_proxy_login_header_name = '${cfg.options.reverseProxyAuth.header}'"
         ]
         ++ optional (cfg.options.calibreLibrary != null) "config_calibre_dir = '${cfg.options.calibreLibrary}'"
-        ++ optional cfg.options.enableBookConversion "config_converterpath = '${pkgs.calibre}/bin/ebook-convert'"
+        ++ optionals cfg.options.enableBookConversion [
+          "config_converterpath = '${pkgs.calibre}/bin/ebook-convert'"
+          "config_binariesdir = '${pkgs.calibre}/bin/'"
+        ]
         ++ optional cfg.options.enableKepubify "config_kepubifypath = '${pkgs.kepubify}/bin/kepubify'"
       );
     in

nixos/modules/services/web-apps/dolibarr.nix

@@ -312,7 +312,7 @@ in
       systemd.services."phpfpm-dolibarr".after = mkIf cfg.database.createLocally [ "mysql.service" ];
       services.phpfpm.pools.dolibarr = {
         inherit (cfg) user group;
-        phpPackage = pkgs.php.buildEnv {
+        phpPackage = pkgs.php83.buildEnv {
           extensions = { enabled, all }: enabled ++ [ all.calendar ];
           # recommended by dolibarr web application
           extraConfig = ''
@@ -339,13 +339,17 @@ in
         description = "dolibarr configuration file management via NixOS";
         wantedBy = [ "multi-user.target" ];
 
-        script = ''
-          # extract the 'main instance unique id' secret that the dolibarr installer generated for us, store it in a file for use by our own NixOS generated configuration file
-          ${pkgs.php}/bin/php -r "include '${cfg.stateDir}/conf.php'; file_put_contents('${cfg.stateDir}/dolibarr_main_instance_unique_id', \$dolibarr_main_instance_unique_id);"
+        script =
+          let
+            php = lib.getExe config.services.phpfpm.pools.dolibarr.phpPackage;
+          in
+          ''
+            # extract the 'main instance unique id' secret that the dolibarr installer generated for us, store it in a file for use by our own NixOS generated configuration file
+            ${php} -r "include '${cfg.stateDir}/conf.php'; file_put_contents('${cfg.stateDir}/dolibarr_main_instance_unique_id', \$dolibarr_main_instance_unique_id);"
 
-          # replace configuration file generated by installer with the NixOS generated configuration file
-          install -m 440 ${mkConfigFile "conf.php" cfg.settings} '${cfg.stateDir}/conf.php'
-        '';
+            # replace configuration file generated by installer with the NixOS generated configuration file
+            install -m 440 ${mkConfigFile "conf.php" cfg.settings} '${cfg.stateDir}/conf.php'
+          '';
 
         serviceConfig = {
           Type = "oneshot";

nixos/modules/services/web-apps/icingaweb2/icingaweb2.nix

@@ -192,7 +192,7 @@ in
             )
           );
         };
-        phpPackage = pkgs.php.withExtensions ({ enabled, all }: [ all.imagick ] ++ enabled);
+        phpPackage = pkgs.php83.withExtensions ({ enabled, all }: [ all.imagick ] ++ enabled);
         phpOptions = ''
           date.timezone = "${cfg.timezone}"
         '';

nixos/modules/services/web-apps/monica.nix

@@ -15,6 +15,8 @@ with lib; let
   user = cfg.user;
   group = cfg.group;
 
+  php = lib.getExe pkgs.php83;
+
   # shell script for local administration
   artisan = pkgs.writeScriptBin "monica" ''
     #! ${pkgs.runtimeShell}
@@ -26,7 +28,7 @@ with lib; let
         exec "$@"
       fi
     }
-    sudo ${pkgs.php}/bin/php artisan "$@"
+    sudo ${php} artisan "$@"
   '';
 
   tlsEnabled = cfg.nginx.addSSL || cfg.nginx.forceSSL || cfg.nginx.onlySSL || cfg.nginx.enableACME;
@@ -419,8 +421,8 @@ in {
         fi
 
         # migrate & seed db
-        ${pkgs.php}/bin/php artisan key:generate --force
-        ${pkgs.php}/bin/php artisan setup:production -v --force
+        ${php} artisan key:generate --force
+        ${php} artisan setup:production -v --force
       '';
     };
 
@@ -432,7 +434,7 @@ in {
         Type = "oneshot";
         User = user;
         WorkingDirectory = "${monica}";
-        ExecStart = "${pkgs.php}/bin/php ${monica}/artisan schedule:run -v";
+        ExecStart = "${php} ${monica}/artisan schedule:run -v";
       };
     };
 
@@ -465,4 +467,3 @@ in {
     };
   };
 }
-

nixos/modules/services/web-apps/nextcloud.nix

@@ -130,10 +130,17 @@ let
           --quiet \
           ${command}
       elif [[ "$USER" != nextcloud ]]; then
-        exec /run/wrappers/bin/sudo \
-          --preserve-env=CREDENTIALS_DIRECTORY \
-          --user=nextcloud \
-          ${command}
+        if [[ -x /run/wrappers/bin/sudo ]]; then
+          exec /run/wrappers/bin/sudo \
+            --preserve-env=CREDENTIALS_DIRECTORY \
+            --user=nextcloud \
+            ${command}
+        else
+          exec ${lib.getExe' pkgs.util-linux "runuser"} \
+            --whitelist-environment=CREDENTIALS_DIRECTORY \
+            --user=nextcloud \
+            ${command}
+        fi
       else
         exec ${command}
       fi

nixos/modules/services/web-apps/rutorrent.nix

@@ -211,7 +211,7 @@ in
                   $throttleMaxSpeed = 327625*1024;
 
                   $pathToExternals = array(
-                    "php" 	=> "${pkgs.php}/bin/php",			// Something like /usr/bin/php. If empty, will be found in PATH.
+                    "php" 	=> "${pkgs.php82}/bin/php",			// Something like /usr/bin/php. If empty, will be found in PATH.
                     "curl"	=> "${pkgs.curl}/bin/curl",			// Something like /usr/bin/curl. If empty, will be found in PATH.
                     "gzip"	=> "${pkgs.gzip}/bin/gzip",			// Something like /usr/bin/gzip. If empty, will be found in PATH.
                     "id"	=> "${pkgs.coreutils}/bin/id",			// Something like /usr/bin/id. If empty, will be found in PATH.

nixos/tests/all-tests.nix

@@ -341,8 +341,8 @@ in {
   documize = handleTest ./documize.nix {};
   documentation = pkgs.callPackage ../modules/misc/documentation/test.nix { inherit nixosLib; };
   doh-proxy-rust = handleTest ./doh-proxy-rust.nix {};
-  dokuwiki = handleTest ./dokuwiki.nix {};
-  dolibarr = handleTest ./dolibarr.nix {};
+  dokuwiki = runTest ./dokuwiki.nix;
+  dolibarr = runTest ./dolibarr.nix;
   domination = handleTest ./domination.nix {};
   dovecot = handleTest ./dovecot.nix {};
   drawterm = discoverTests (import ./drawterm.nix);
@@ -557,7 +557,7 @@ in {
   hub = handleTest ./git/hub.nix {};
   hydra = handleTest ./hydra {};
   i3wm = handleTest ./i3wm.nix {};
-  icingaweb2 = handleTest ./icingaweb2.nix {};
+  icingaweb2 = runTest ./icingaweb2.nix;
   ifm = handleTest ./ifm.nix {};
   iftop = handleTest ./iftop.nix {};
   immich = handleTest ./web-apps/immich.nix {};
@@ -725,7 +725,7 @@ in {
   mollysocket = handleTest ./mollysocket.nix { };
   monado = handleTest ./monado.nix {};
   monetdb = handleTest ./monetdb.nix {};
-  monica = handleTest ./web-apps/monica.nix {};
+  monica = runTest ./web-apps/monica.nix;
   mongodb = runTest ./mongodb.nix;
   mongodb-ce = runTest ({ config, ... }: {
     imports = [ ./mongodb.nix ];
@@ -797,15 +797,15 @@ in {
   nfs3 = handleTest ./nfs { version = 3; };
   nfs4 = handleTest ./nfs { version = 4; };
   nghttpx = handleTest ./nghttpx.nix {};
-  nginx = handleTest ./nginx.nix {};
-  nginx-auth = handleTest ./nginx-auth.nix {};
-  nginx-etag = handleTest ./nginx-etag.nix {};
-  nginx-etag-compression = handleTest ./nginx-etag-compression.nix {};
-  nginx-globalredirect = handleTest ./nginx-globalredirect.nix {};
+  nginx = runTest ./nginx.nix;
+  nginx-auth = runTest ./nginx-auth.nix;
+  nginx-etag = runTest ./nginx-etag.nix;
+  nginx-etag-compression = runTest ./nginx-etag-compression.nix;
+  nginx-globalredirect = runTest ./nginx-globalredirect.nix;
   nginx-http3 = handleTest ./nginx-http3.nix {};
-  nginx-mime = handleTest ./nginx-mime.nix {};
-  nginx-modsecurity = handleTest ./nginx-modsecurity.nix {};
-  nginx-moreheaders = handleTest ./nginx-moreheaders.nix {};
+  nginx-mime = runTest ./nginx-mime.nix;
+  nginx-modsecurity = runTest ./nginx-modsecurity.nix;
+  nginx-moreheaders = runTest ./nginx-moreheaders.nix;
   nginx-njs = handleTest ./nginx-njs.nix {};
   nginx-proxyprotocol = handleTest ./nginx-proxyprotocol {};
   nginx-pubhtml = handleTest ./nginx-pubhtml.nix {};
@@ -1257,7 +1257,7 @@ in {
   umurmur = handleTest ./umurmur.nix {};
   unbound = handleTest ./unbound.nix {};
   unifi = handleTest ./unifi.nix {};
-  unit-php = handleTest ./web-servers/unit-php.nix {};
+  unit-php = runTest ./web-servers/unit-php.nix;
   unit-perl = handleTest ./web-servers/unit-perl.nix {};
   upnp.iptables = handleTest ./upnp.nix { useNftables = false; };
   upnp.nftables = handleTest ./upnp.nix { useNftables = true; };
@@ -1306,7 +1306,7 @@ in {
   weblate = handleTest ./web-apps/weblate.nix {};
   whisparr = handleTest ./whisparr.nix {};
   whoogle-search = handleTest ./whoogle-search.nix {};
-  wiki-js = handleTest ./wiki-js.nix {};
+  wiki-js = runTest ./wiki-js.nix;
   wine = handleTest ./wine.nix {};
   wireguard = handleTest ./wireguard {};
   wg-access-server = handleTest ./wg-access-server.nix {};
@@ -1314,7 +1314,7 @@ in {
   wmderland = handleTest ./wmderland.nix {};
   workout-tracker = handleTest ./workout-tracker.nix {};
   wpa_supplicant = import ./wpa_supplicant.nix { inherit pkgs runTest; };
-  wordpress = handleTest ./wordpress.nix {};
+  wordpress = runTest ./wordpress.nix;
   wrappers = handleTest ./wrappers.nix {};
   writefreely = handleTest ./web-apps/writefreely.nix {};
   wstunnel = runTest ./wstunnel.nix;

nixos/tests/dokuwiki.nix

@@ -1,6 +1,8 @@
-import ./make-test-python.nix ({ pkgs, ... }:
+{ config, ... }:
 
 let
+  pkgs = config.node.pkgs;
+
   template-bootstrap3 = pkgs.stdenv.mkDerivation rec {
     name = "bootstrap3";
     version = "2022-07-27";
@@ -163,4 +165,4 @@ in {
             "curl -sSfL http://site1.local/rewrite-test | grep 'Hello, NixOS!'",
           )
   '';
-})
+}

nixos/tests/dolibarr.nix

@@ -1,62 +1,60 @@
-import ./make-test-python.nix (
-  { pkgs, lib, ... }:
-  {
-    name = "dolibarr";
-    meta.maintainers = [ ];
+{ ... }:
+{
+  name = "dolibarr";
+  meta.maintainers = [ ];
 
-    nodes.machine =
-      { ... }:
-      {
-        services.dolibarr = {
-          enable = true;
-          domain = "localhost";
-          nginx = {
-            forceSSL = false;
-            enableACME = false;
-          };
+  nodes.machine =
+    { ... }:
+    {
+      services.dolibarr = {
+        enable = true;
+        domain = "localhost";
+        nginx = {
+          forceSSL = false;
+          enableACME = false;
         };
-
-        networking.firewall.allowedTCPPorts = [ 80 ];
       };
 
-    testScript = ''
-      from html.parser import HTMLParser
-      start_all()
+      networking.firewall.allowedTCPPorts = [ 80 ];
+    };
 
-      csrf_token = None
-      class TokenParser(HTMLParser):
-        def handle_starttag(self, tag, attrs):
-          attrs = dict(attrs) # attrs is an assoc list originally
-          if tag == 'input' and attrs.get('name') == 'token':
-              csrf_token = attrs.get('value')
-              print(f'[+] Caught CSRF token: {csrf_token}')
-        def handle_endtag(self, tag): pass
-        def handle_data(self, data): pass
+  testScript = ''
+    from html.parser import HTMLParser
+    start_all()
 
-      machine.wait_for_unit("phpfpm-dolibarr.service")
-      machine.wait_for_unit("nginx.service")
-      machine.wait_for_open_port(80)
-      # Sanity checks on URLs.
-      # machine.succeed("curl -fL http://localhost/index.php")
-      # machine.succeed("curl -fL http://localhost/")
-      # Perform installation.
-      machine.succeed('curl -fL -X POST http://localhost/install/check.php -F selectlang=auto')
-      machine.succeed('curl -fL -X POST http://localhost/install/fileconf.php -F selectlang=auto')
-      # First time is to write the configuration file correctly.
-      machine.succeed('curl -fL -X POST http://localhost/install/step1.php -F "testpost=ok" -F "action=set" -F "selectlang=auto"')
-      # Now, we have a proper conf.php in $stateDir.
-      assert 'nixos' in machine.succeed("cat /var/lib/dolibarr/conf.php")
-      machine.succeed('curl -fL -X POST http://localhost/install/step2.php --data "testpost=ok&action=set&dolibarr_main_db_character_set=utf8&dolibarr_main_db_collation=utf8_unicode_ci&selectlang=auto"')
-      machine.succeed('curl -fL -X POST http://localhost/install/step4.php --data "testpost=ok&action=set&selectlang=auto"')
-      machine.succeed('curl -fL -X POST http://localhost/install/step5.php --data "testpost=ok&action=set&login=root&pass=hunter2&pass_verif=hunter2&selectlang=auto"')
-      # Now, we have installed the machine, let's verify we still have the right configuration.
-      assert 'nixos' in machine.succeed("cat /var/lib/dolibarr/conf.php")
-      # We do not want any redirect now as we have installed the machine.
-      machine.succeed('curl -f -X GET http://localhost')
-      # Test authentication to the webservice.
-      parser = TokenParser()
-      parser.feed(machine.succeed('curl -f -X GET http://localhost/index.php?mainmenu=login&username=root'))
-      machine.succeed(f'curl -f -X POST http://localhost/index.php?mainmenu=login&token={csrf_token}&username=root&password=hunter2')
-    '';
-  }
-)
+    csrf_token = None
+    class TokenParser(HTMLParser):
+      def handle_starttag(self, tag, attrs):
+        attrs = dict(attrs) # attrs is an assoc list originally
+        if tag == 'input' and attrs.get('name') == 'token':
+            csrf_token = attrs.get('value')
+            print(f'[+] Caught CSRF token: {csrf_token}')
+      def handle_endtag(self, tag): pass
+      def handle_data(self, data): pass
+
+    machine.wait_for_unit("phpfpm-dolibarr.service")
+    machine.wait_for_unit("nginx.service")
+    machine.wait_for_open_port(80)
+    # Sanity checks on URLs.
+    # machine.succeed("curl -fL http://localhost/index.php")
+    # machine.succeed("curl -fL http://localhost/")
+    # Perform installation.
+    machine.succeed('curl -fL -X POST http://localhost/install/check.php -F selectlang=auto')
+    machine.succeed('curl -fL -X POST http://localhost/install/fileconf.php -F selectlang=auto')
+    # First time is to write the configuration file correctly.
+    machine.succeed('curl -fL -X POST http://localhost/install/step1.php -F "testpost=ok" -F "action=set" -F "selectlang=auto"')
+    # Now, we have a proper conf.php in $stateDir.
+    assert 'nixos' in machine.succeed("cat /var/lib/dolibarr/conf.php")
+    machine.succeed('curl -fL -X POST http://localhost/install/step2.php --data "testpost=ok&action=set&dolibarr_main_db_character_set=utf8&dolibarr_main_db_collation=utf8_unicode_ci&selectlang=auto"')
+    machine.succeed('curl -fL -X POST http://localhost/install/step4.php --data "testpost=ok&action=set&selectlang=auto"')
+    machine.succeed('curl -fL -X POST http://localhost/install/step5.php --data "testpost=ok&action=set&login=root&pass=hunter2&pass_verif=hunter2&selectlang=auto"')
+    # Now, we have installed the machine, let's verify we still have the right configuration.
+    assert 'nixos' in machine.succeed("cat /var/lib/dolibarr/conf.php")
+    # We do not want any redirect now as we have installed the machine.
+    machine.succeed('curl -f -X GET http://localhost')
+    # Test authentication to the webservice.
+    parser = TokenParser()
+    parser.feed(machine.succeed('curl -f -X GET http://localhost/index.php?mainmenu=login&username=root'))
+    machine.succeed(f'curl -f -X POST http://localhost/index.php?mainmenu=login&token={csrf_token}&username=root&password=hunter2')
+  '';
+}

nixos/tests/icingaweb2.nix

@@ -1,76 +1,74 @@
-import ./make-test-python.nix (
-  { pkgs, ... }:
-  {
-    name = "icingaweb2";
-    meta = {
-      maintainers = pkgs.lib.teams.helsinki-systems.members;
-    };
+{ pkgs, ... }:
+{
+  name = "icingaweb2";
+  meta = {
+    maintainers = pkgs.lib.teams.helsinki-systems.members;
+  };
 
-    nodes = {
-      icingaweb2 =
-        { config, pkgs, ... }:
-        {
-          services.icingaweb2 = {
-            enable = true;
+  nodes = {
+    icingaweb2 =
+      { config, pkgs, ... }:
+      {
+        services.icingaweb2 = {
+          enable = true;
 
-            modulePackages = with pkgs.icingaweb2Modules; {
-              particles = theme-particles;
-              spring = theme-spring;
+          modulePackages = with pkgs.icingaweb2Modules; {
+            particles = theme-particles;
+            spring = theme-spring;
+          };
+
+          modules = {
+            doc.enable = true;
+            migrate.enable = true;
+            setup.enable = true;
+            test.enable = true;
+            translation.enable = true;
+          };
+
+          generalConfig = {
+            global = {
+              module_path = "${pkgs.icingaweb2}/modules";
             };
+          };
 
-            modules = {
-              doc.enable = true;
-              migrate.enable = true;
-              setup.enable = true;
-              test.enable = true;
-              translation.enable = true;
+          authentications = {
+            icingaweb = {
+              backend = "external";
             };
+          };
 
-            generalConfig = {
-              global = {
-                module_path = "${pkgs.icingaweb2}/modules";
-              };
+          groupBackends = {
+            icingaweb = {
+              backend = "db";
+              resource = "icingaweb_db";
             };
+          };
 
-            authentications = {
-              icingaweb = {
-                backend = "external";
-              };
+          resources = {
+            # Not used, so no DB server needed
+            icingaweb_db = {
+              type = "db";
+              db = "mysql";
+              host = "localhost";
+              username = "icingaweb2";
+              password = "icingaweb2";
+              dbname = "icingaweb2";
             };
+          };
 
-            groupBackends = {
-              icingaweb = {
-                backend = "db";
-                resource = "icingaweb_db";
-              };
-            };
-
-            resources = {
-              # Not used, so no DB server needed
-              icingaweb_db = {
-                type = "db";
-                db = "mysql";
-                host = "localhost";
-                username = "icingaweb2";
-                password = "icingaweb2";
-                dbname = "icingaweb2";
-              };
-            };
-
-            roles = {
-              Administrators = {
-                users = "*";
-                permissions = "*";
-              };
+          roles = {
+            Administrators = {
+              users = "*";
+              permissions = "*";
             };
           };
         };
-    };
+      };
+  };
 
-    testScript = ''
-      start_all()
-      icingaweb2.wait_for_unit("multi-user.target")
-      icingaweb2.succeed("curl -sSf http://icingaweb2/authentication/login")
-    '';
-  }
-)
+  testScript = ''
+    start_all()
+    icingaweb2.wait_for_unit("multi-user.target")
+    icingaweb2.succeed("curl -sSf http://icingaweb2/authentication/login")
+  '';
+}

nixos/tests/nginx-auth.nix

@@ -1,54 +1,52 @@
-import ./make-test-python.nix (
-  { pkgs, ... }:
-  {
-    name = "nginx-auth";
+{ pkgs, ... }:
+{
+  name = "nginx-auth";
 
-    nodes = {
-      webserver =
-        { pkgs, lib, ... }:
-        {
-          services.nginx =
-            let
-              root = pkgs.runCommand "testdir" { } ''
-                mkdir "$out"
-                echo hello world > "$out/index.html"
-              '';
-            in
-            {
-              enable = true;
+  nodes = {
+    webserver =
+      { pkgs, lib, ... }:
+      {
+        services.nginx =
+          let
+            root = pkgs.runCommand "testdir" { } ''
+              mkdir "$out"
+              echo hello world > "$out/index.html"
+            '';
+          in
+          {
+            enable = true;
 
-              virtualHosts.lockedroot = {
-                inherit root;
-                basicAuth.alice = "pwofa";
-              };
+            virtualHosts.lockedroot = {
+              inherit root;
+              basicAuth.alice = "pwofa";
+            };
 
-              virtualHosts.lockedsubdir = {
-                inherit root;
-                locations."/sublocation/" = {
-                  alias = "${root}/";
-                  basicAuth.bob = "pwofb";
-                };
+            virtualHosts.lockedsubdir = {
+              inherit root;
+              locations."/sublocation/" = {
+                alias = "${root}/";
+                basicAuth.bob = "pwofb";
               };
             };
-        };
-    };
+          };
+      };
+  };
 
-    testScript = ''
-      webserver.wait_for_unit("nginx")
-      webserver.wait_for_open_port(80)
+  testScript = ''
+    webserver.wait_for_unit("nginx")
+    webserver.wait_for_open_port(80)
 
-      webserver.fail("curl --fail --resolve lockedroot:80:127.0.0.1 http://lockedroot")
-      webserver.succeed(
-          "curl --fail --resolve lockedroot:80:127.0.0.1 http://alice:pwofa@lockedroot"
-      )
+    webserver.fail("curl --fail --resolve lockedroot:80:127.0.0.1 http://lockedroot")
+    webserver.succeed(
+        "curl --fail --resolve lockedroot:80:127.0.0.1 http://alice:pwofa@lockedroot"
+    )
 
-      webserver.succeed("curl --fail --resolve lockedsubdir:80:127.0.0.1 http://lockedsubdir")
-      webserver.fail(
-          "curl --fail --resolve lockedsubdir:80:127.0.0.1 http://lockedsubdir/sublocation/index.html"
-      )
-      webserver.succeed(
-          "curl --fail --resolve lockedsubdir:80:127.0.0.1 http://bob:pwofb@lockedsubdir/sublocation/index.html"
-      )
-    '';
-  }
-)
+    webserver.succeed("curl --fail --resolve lockedsubdir:80:127.0.0.1 http://lockedsubdir")
+    webserver.fail(
+        "curl --fail --resolve lockedsubdir:80:127.0.0.1 http://lockedsubdir/sublocation/index.html"
+    )
+    webserver.succeed(
+        "curl --fail --resolve lockedsubdir:80:127.0.0.1 http://bob:pwofb@lockedsubdir/sublocation/index.html"
+    )
+  '';
+}

nixos/tests/nginx-etag-compression.nix

@@ -1,4 +1,5 @@
-import ./make-test-python.nix {
+{ ... }:
+{
   name = "nginx-etag-compression";
 
   nodes.machine =

nixos/tests/nginx-etag.nix

@@ -1,4 +1,5 @@
-import ./make-test-python.nix {
+{ ... }:
+{
   name = "nginx-etag";
 
   nodes = {
@@ -85,7 +86,7 @@ import ./make-test-python.nix {
   testScript =
     { nodes, ... }:
     let
-      inherit (nodes.server.config.system.build) toplevel;
+      inherit (nodes.server.system.build) toplevel;
       newSystem = "${toplevel}/specialisation/pass-checks";
     in
     ''

nixos/tests/nginx-globalredirect.nix

@@ -1,29 +1,27 @@
-import ./make-test-python.nix (
-  { pkgs, ... }:
-  {
-    name = "nginx-globalredirect";
+{ ... }:
+{
+  name = "nginx-globalredirect";
 
-    nodes = {
-      webserver =
-        { pkgs, lib, ... }:
-        {
-          services.nginx = {
-            enable = true;
-            virtualHosts.localhost = {
-              globalRedirect = "other.example.com";
-              # Add an exception
-              locations."/noredirect".return = "200 'foo'";
-            };
+  nodes = {
+    webserver =
+      { pkgs, lib, ... }:
+      {
+        services.nginx = {
+          enable = true;
+          virtualHosts.localhost = {
+            globalRedirect = "other.example.com";
+            # Add an exception
+            locations."/noredirect".return = "200 'foo'";
           };
         };
-    };
+      };
+  };
 
-    testScript = ''
-      webserver.wait_for_unit("nginx")
-      webserver.wait_for_open_port(80)
+  testScript = ''
+    webserver.wait_for_unit("nginx")
+    webserver.wait_for_open_port(80)
 
-      webserver.succeed("curl --fail -si http://localhost/alf | grep '^Location:.*/alf'")
-      webserver.fail("curl --fail -si http://localhost/noredirect | grep '^Location:'")
-    '';
-  }
-)
+    webserver.succeed("curl --fail -si http://localhost/alf | grep '^Location:.*/alf'")
+    webserver.fail("curl --fail -si http://localhost/noredirect | grep '^Location:'")
+  '';
+}

nixos/tests/nginx-mime.nix

@@ -1,26 +1,24 @@
-import ./make-test-python.nix (
-  { lib, pkgs, ... }:
-  {
-    name = "nginx-mime";
-    meta.maintainers = with pkgs.lib.maintainers; [ izorkin ];
+{ lib, pkgs, ... }:
+{
+  name = "nginx-mime";
+  meta.maintainers = with pkgs.lib.maintainers; [ izorkin ];
 
-    nodes = {
-      server =
-        { pkgs, ... }:
-        {
-          services.nginx = {
-            enable = true;
-            virtualHosts."localhost" = { };
-          };
+  nodes = {
+    server =
+      { pkgs, ... }:
+      {
+        services.nginx = {
+          enable = true;
+          virtualHosts."localhost" = { };
         };
-    };
+      };
+  };
 
-    testScript = ''
-      server.start()
-      server.wait_for_unit("nginx")
-      # Check optimal size of types_hash
-      server.fail("journalctl --unit nginx --grep 'could not build optimal types_hash'")
-      server.shutdown()
-    '';
-  }
-)
+  testScript = ''
+    server.start()
+    server.wait_for_unit("nginx")
+    # Check optimal size of types_hash
+    server.fail("journalctl --unit nginx --grep 'could not build optimal types_hash'")
+    server.shutdown()
+  '';
+}

nixos/tests/nginx-modsecurity.nix

@@ -1,51 +1,49 @@
-import ./make-test-python.nix (
-  { pkgs, lib, ... }:
-  {
-    name = "nginx-modsecurity";
+{ ... }:
+{
+  name = "nginx-modsecurity";
 
-    nodes.machine =
-      {
-        config,
-        lib,
-        pkgs,
-        ...
-      }:
-      {
-        services.nginx = {
-          enable = true;
-          additionalModules = [ pkgs.nginxModules.modsecurity ];
-          virtualHosts.localhost =
-            let
-              modsecurity_conf = pkgs.writeText "modsecurity.conf" ''
-                SecRuleEngine On
-                SecDefaultAction "phase:1,log,auditlog,deny,status:403"
-                SecDefaultAction "phase:2,log,auditlog,deny,status:403"
-                SecRule REQUEST_METHOD   "HEAD"        "id:100, phase:1, block"
-                SecRule REQUEST_FILENAME "secret.html" "id:101, phase:2, block"
-              '';
-              testroot = pkgs.runCommand "testroot" { } ''
-                mkdir -p $out
-                echo "<html><body>Hello World!</body></html>" > $out/index.html
-                echo "s3cret" > $out/secret.html
-              '';
-            in
-            {
-              root = testroot;
-              extraConfig = ''
-                modsecurity on;
-                modsecurity_rules_file ${modsecurity_conf};
-              '';
-            };
-        };
+  nodes.machine =
+    {
+      config,
+      lib,
+      pkgs,
+      ...
+    }:
+    {
+      services.nginx = {
+        enable = true;
+        additionalModules = [ pkgs.nginxModules.modsecurity ];
+        virtualHosts.localhost =
+          let
+            modsecurity_conf = pkgs.writeText "modsecurity.conf" ''
+              SecRuleEngine On
+              SecDefaultAction "phase:1,log,auditlog,deny,status:403"
+              SecDefaultAction "phase:2,log,auditlog,deny,status:403"
+              SecRule REQUEST_METHOD   "HEAD"        "id:100, phase:1, block"
+              SecRule REQUEST_FILENAME "secret.html" "id:101, phase:2, block"
+            '';
+            testroot = pkgs.runCommand "testroot" { } ''
+              mkdir -p $out
+              echo "<html><body>Hello World!</body></html>" > $out/index.html
+              echo "s3cret" > $out/secret.html
+            '';
+          in
+          {
+            root = testroot;
+            extraConfig = ''
+              modsecurity on;
+              modsecurity_rules_file ${modsecurity_conf};
+            '';
+          };
       };
-    testScript = ''
-      machine.wait_for_unit("nginx")
+    };
+  testScript = ''
+    machine.wait_for_unit("nginx")
 
-      response = machine.wait_until_succeeds("curl -fvvv -s http://127.0.0.1/")
-      assert "Hello World!" in response
+    response = machine.wait_until_succeeds("curl -fvvv -s http://127.0.0.1/")
+    assert "Hello World!" in response
 
-      machine.fail("curl -fvvv -X HEAD -s http://127.0.0.1/")
-      machine.fail("curl -fvvv -s http://127.0.0.1/secret.html")
-    '';
-  }
-)
+    machine.fail("curl -fvvv -X HEAD -s http://127.0.0.1/")
+    machine.fail("curl -fvvv -s http://127.0.0.1/secret.html")
+  '';
+}

nixos/tests/nginx-moreheaders.nix

@@ -1,4 +1,5 @@
-import ./make-test-python.nix {
+{ ... }:
+{
   name = "nginx-more-headers";
 
   nodes = {

nixos/tests/nginx.nix

@@ -4,134 +4,150 @@
 #   2. whether the ETag header is properly generated whenever we're serving
 #      files in Nix store paths
 #   3. nginx doesn't restart on configuration changes (only reloads)
-import ./make-test-python.nix ({ pkgs, ... }: {
+{ pkgs, ... }:
+{
   name = "nginx";
   meta = with pkgs.lib.maintainers; {
-    maintainers = [ mbbx6spp danbst ];
+    maintainers = [
+      mbbx6spp
+      danbst
+    ];
   };
 
   nodes = {
-    webserver = { pkgs, lib, ... }: {
-      services.nginx.enable = true;
-      services.nginx.commonHttpConfig = ''
-        log_format ceeformat '@cee: {"status":"$status",'
-          '"request_time":$request_time,'
-          '"upstream_response_time":$upstream_response_time,'
-          '"pipe":"$pipe","bytes_sent":$bytes_sent,'
-          '"connection":"$connection",'
-          '"remote_addr":"$remote_addr",'
-          '"host":"$host",'
-          '"timestamp":"$time_iso8601",'
-          '"request":"$request",'
-          '"http_referer":"$http_referer",'
-          '"upstream_addr":"$upstream_addr"}';
-      '';
-      services.nginx.virtualHosts."0.my.test" = {
-        extraConfig = ''
-          access_log syslog:server=unix:/dev/log,facility=user,tag=mytag,severity=info ceeformat;
-          location /favicon.ico { allow all; access_log off; log_not_found off; }
+    webserver =
+      { pkgs, lib, ... }:
+      {
+        services.nginx.enable = true;
+        services.nginx.commonHttpConfig = ''
+          log_format ceeformat '@cee: {"status":"$status",'
+            '"request_time":$request_time,'
+            '"upstream_response_time":$upstream_response_time,'
+            '"pipe":"$pipe","bytes_sent":$bytes_sent,'
+            '"connection":"$connection",'
+            '"remote_addr":"$remote_addr",'
+            '"host":"$host",'
+            '"timestamp":"$time_iso8601",'
+            '"request":"$request",'
+            '"http_referer":"$http_referer",'
+            '"upstream_addr":"$upstream_addr"}';
         '';
-      };
+        services.nginx.virtualHosts."0.my.test" = {
+          extraConfig = ''
+            access_log syslog:server=unix:/dev/log,facility=user,tag=mytag,severity=info ceeformat;
+            location /favicon.ico { allow all; access_log off; log_not_found off; }
+          '';
+        };
 
-      services.nginx.virtualHosts.localhost = {
-        root = pkgs.runCommand "testdir" {} ''
-          mkdir "$out"
-          echo hello world > "$out/index.html"
-        '';
-      };
-
-      services.nginx.enableReload = true;
-
-      specialisation.etagSystem.configuration = {
         services.nginx.virtualHosts.localhost = {
-          root = lib.mkForce (pkgs.runCommand "testdir2" {} ''
+          root = pkgs.runCommand "testdir" { } ''
             mkdir "$out"
-            echo content changed > "$out/index.html"
-          '');
+            echo hello world > "$out/index.html"
+          '';
+        };
+
+        services.nginx.enableReload = true;
+
+        specialisation.etagSystem.configuration = {
+          services.nginx.virtualHosts.localhost = {
+            root = lib.mkForce (
+              pkgs.runCommand "testdir2" { } ''
+                mkdir "$out"
+                echo content changed > "$out/index.html"
+              ''
+            );
+          };
+        };
+
+        specialisation.justReloadSystem.configuration = {
+          services.nginx.virtualHosts."1.my.test".listen = [
+            {
+              addr = "127.0.0.1";
+              port = 8080;
+            }
+          ];
+        };
+
+        specialisation.reloadRestartSystem.configuration = {
+          services.nginx.package = pkgs.nginxMainline;
+        };
+
+        specialisation.reloadWithErrorsSystem.configuration = {
+          services.nginx.package = pkgs.nginxMainline;
+          services.nginx.virtualHosts."!@$$(#*%".locations."~@#*$*!)".proxyPass = ";;;";
         };
       };
-
-      specialisation.justReloadSystem.configuration = {
-        services.nginx.virtualHosts."1.my.test".listen = [ { addr = "127.0.0.1"; port = 8080; }];
-      };
-
-      specialisation.reloadRestartSystem.configuration = {
-        services.nginx.package = pkgs.nginxMainline;
-      };
-
-      specialisation.reloadWithErrorsSystem.configuration = {
-        services.nginx.package = pkgs.nginxMainline;
-        services.nginx.virtualHosts."!@$$(#*%".locations."~@#*$*!)".proxyPass = ";;;";
-      };
-    };
   };
 
-  testScript = { nodes, ... }: let
-    etagSystem = "${nodes.webserver.system.build.toplevel}/specialisation/etagSystem";
-    justReloadSystem = "${nodes.webserver.system.build.toplevel}/specialisation/justReloadSystem";
-    reloadRestartSystem = "${nodes.webserver.system.build.toplevel}/specialisation/reloadRestartSystem";
-    reloadWithErrorsSystem = "${nodes.webserver.system.build.toplevel}/specialisation/reloadWithErrorsSystem";
-  in ''
-    url = "http://localhost/index.html"
+  testScript =
+    { nodes, ... }:
+    let
+      etagSystem = "${nodes.webserver.system.build.toplevel}/specialisation/etagSystem";
+      justReloadSystem = "${nodes.webserver.system.build.toplevel}/specialisation/justReloadSystem";
+      reloadRestartSystem = "${nodes.webserver.system.build.toplevel}/specialisation/reloadRestartSystem";
+      reloadWithErrorsSystem = "${nodes.webserver.system.build.toplevel}/specialisation/reloadWithErrorsSystem";
+    in
+    ''
+      url = "http://localhost/index.html"
 
 
-    def check_etag():
-        etag = webserver.succeed(
-            f'curl -v {url} 2>&1 | sed -n -e "s/^< etag: *//ip"'
-        ).rstrip()
-        http_code = webserver.succeed(
-            f"curl -w '%{{http_code}}' --head --fail -H 'If-None-Match: {etag}' {url}"
-        )
-        assert http_code.split("\n")[-1] == "304"
+      def check_etag():
+          etag = webserver.succeed(
+              f'curl -v {url} 2>&1 | sed -n -e "s/^< etag: *//ip"'
+          ).rstrip()
+          http_code = webserver.succeed(
+              f"curl -w '%{{http_code}}' --head --fail -H 'If-None-Match: {etag}' {url}"
+          )
+          assert http_code.split("\n")[-1] == "304"
 
-        return etag
+          return etag
 
 
-    def wait_for_nginx_on_port(port):
-        webserver.wait_for_unit("nginx")
-        webserver.wait_for_open_port(port)
+      def wait_for_nginx_on_port(port):
+          webserver.wait_for_unit("nginx")
+          webserver.wait_for_open_port(port)
 
 
-    # nginx can be ready before multi-user.target, in which case switching to
-    # a different configuration might not realize it needs to restart nginx.
-    webserver.wait_for_unit("multi-user.target")
+      # nginx can be ready before multi-user.target, in which case switching to
+      # a different configuration might not realize it needs to restart nginx.
+      webserver.wait_for_unit("multi-user.target")
 
-    wait_for_nginx_on_port(80)
+      wait_for_nginx_on_port(80)
 
-    with subtest("check ETag if serving Nix store paths"):
-        old_etag = check_etag()
-        webserver.succeed(
-            "${etagSystem}/bin/switch-to-configuration test >&2"
-        )
-        wait_for_nginx_on_port(80)
-        new_etag = check_etag()
-        assert old_etag != new_etag
+      with subtest("check ETag if serving Nix store paths"):
+          old_etag = check_etag()
+          webserver.succeed(
+              "${etagSystem}/bin/switch-to-configuration test >&2"
+          )
+          wait_for_nginx_on_port(80)
+          new_etag = check_etag()
+          assert old_etag != new_etag
 
-    with subtest("config is reloaded on nixos-rebuild switch"):
-        webserver.succeed(
-            "${justReloadSystem}/bin/switch-to-configuration test >&2"
-        )
-        wait_for_nginx_on_port(8080)
-        webserver.fail("journalctl -u nginx | grep -q -i stopped")
-        webserver.succeed("journalctl -u nginx | grep -q -i reloaded")
+      with subtest("config is reloaded on nixos-rebuild switch"):
+          webserver.succeed(
+              "${justReloadSystem}/bin/switch-to-configuration test >&2"
+          )
+          wait_for_nginx_on_port(8080)
+          webserver.fail("journalctl -u nginx | grep -q -i stopped")
+          webserver.succeed("journalctl -u nginx | grep -q -i reloaded")
 
-    with subtest("restart when nginx package changes"):
-        webserver.succeed(
-            "${reloadRestartSystem}/bin/switch-to-configuration test >&2"
-        )
-        wait_for_nginx_on_port(80)
-        webserver.succeed("journalctl -u nginx | grep -q -i stopped")
+      with subtest("restart when nginx package changes"):
+          webserver.succeed(
+              "${reloadRestartSystem}/bin/switch-to-configuration test >&2"
+          )
+          wait_for_nginx_on_port(80)
+          webserver.succeed("journalctl -u nginx | grep -q -i stopped")
 
-    with subtest("nixos-rebuild --switch should fail when there are configuration errors"):
-        webserver.fail(
-            "${reloadWithErrorsSystem}/bin/switch-to-configuration test >&2"
-        )
-        webserver.succeed("[[ $(systemctl is-failed nginx-config-reload) == failed ]]")
-        webserver.succeed("[[ $(systemctl is-failed nginx) == active ]]")
-        # just to make sure operation is idempotent. During development I had a situation
-        # when first time it shows error, but stops showing it on subsequent rebuilds
-        webserver.fail(
-            "${reloadWithErrorsSystem}/bin/switch-to-configuration test >&2"
-        )
-  '';
-})
+      with subtest("nixos-rebuild --switch should fail when there are configuration errors"):
+          webserver.fail(
+              "${reloadWithErrorsSystem}/bin/switch-to-configuration test >&2"
+          )
+          webserver.succeed("[[ $(systemctl is-failed nginx-config-reload) == failed ]]")
+          webserver.succeed("[[ $(systemctl is-failed nginx) == active ]]")
+          # just to make sure operation is idempotent. During development I had a situation
+          # when first time it shows error, but stops showing it on subsequent rebuilds
+          webserver.fail(
+              "${reloadWithErrorsSystem}/bin/switch-to-configuration test >&2"
+          )
+    '';
+}

nixos/tests/web-apps/monica.nix

@@ -1,37 +1,35 @@
-import ../make-test-python.nix (
-  { pkgs, ... }:
-  let
-    cert = pkgs.runCommand "selfSignedCerts" { nativeBuildInputs = [ pkgs.openssl ]; } ''
-      openssl req -x509 -newkey rsa:4096 -keyout key.pem -out cert.pem -nodes -subj '/CN=localhost' -days 36500
-      mkdir -p $out
-      cp key.pem cert.pem $out
-    '';
-  in
-  {
-    name = "monica";
+{ pkgs, ... }:
+let
+  cert = pkgs.runCommand "selfSignedCerts" { nativeBuildInputs = [ pkgs.openssl ]; } ''
+    openssl req -x509 -newkey rsa:4096 -keyout key.pem -out cert.pem -nodes -subj '/CN=localhost' -days 36500
+    mkdir -p $out
+    cp key.pem cert.pem $out
+  '';
+in
+{
+  name = "monica";
 
-    nodes = {
-      machine =
-        { pkgs, ... }:
-        {
-          services.monica = {
-            enable = true;
-            hostname = "localhost";
-            appKeyFile = "${pkgs.writeText "keyfile" "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"}";
-            nginx = {
-              forceSSL = true;
-              sslCertificate = "${cert}/cert.pem";
-              sslCertificateKey = "${cert}/key.pem";
-            };
+  nodes = {
+    machine =
+      { pkgs, ... }:
+      {
+        services.monica = {
+          enable = true;
+          hostname = "localhost";
+          appKeyFile = "${pkgs.writeText "keyfile" "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"}";
+          nginx = {
+            forceSSL = true;
+            sslCertificate = "${cert}/cert.pem";
+            sslCertificateKey = "${cert}/key.pem";
           };
         };
-    };
+      };
+  };
 
-    testScript = ''
-      start_all()
-      machine.wait_for_unit("monica-setup.service")
-      machine.wait_for_open_port(443)
-      machine.succeed("curl -k --fail https://localhost", timeout=10)
-    '';
-  }
-)
+  testScript = ''
+    start_all()
+    machine.wait_for_unit("monica-setup.service")
+    machine.wait_for_open_port(443)
+    machine.succeed("curl -k --fail https://localhost", timeout=10)
+  '';
+}

nixos/tests/web-servers/unit-php.nix

@@ -1,62 +1,60 @@
-import ../make-test-python.nix (
-  { pkgs, ... }:
-  let
-    testdir = pkgs.writeTextDir "www/info.php" "<?php phpinfo();";
+{ pkgs, ... }:
+let
+  testdir = pkgs.writeTextDir "www/info.php" "<?php phpinfo();";
 
-  in
-  {
-    name = "unit-php-test";
-    meta.maintainers = with pkgs.lib.maintainers; [ izorkin ];
+in
+{
+  name = "unit-php-test";
+  meta.maintainers = with pkgs.lib.maintainers; [ izorkin ];
 
-    nodes.machine =
-      {
-        config,
-        lib,
-        pkgs,
-        ...
-      }:
-      {
-        services.unit = {
-          enable = true;
-          config = pkgs.lib.strings.toJSON {
-            listeners."*:9081".application = "php_81";
-            applications.php_81 = {
-              type = "php 8.1";
-              processes = 1;
-              user = "testuser";
-              group = "testgroup";
-              root = "${testdir}/www";
-              index = "info.php";
-              options.file = "${pkgs.unit.usedPhp81}/lib/php.ini";
-            };
-          };
-        };
-        users = {
-          users.testuser = {
-            isSystemUser = true;
-            uid = 1080;
+  nodes.machine =
+    {
+      config,
+      lib,
+      pkgs,
+      ...
+    }:
+    {
+      services.unit = {
+        enable = true;
+        config = pkgs.lib.strings.toJSON {
+          listeners."*:9081".application = "php_81";
+          applications.php_81 = {
+            type = "php 8.1";
+            processes = 1;
+            user = "testuser";
             group = "testgroup";
-          };
-          groups.testgroup = {
-            gid = 1080;
+            root = "${testdir}/www";
+            index = "info.php";
+            options.file = "${pkgs.unit.usedPhp81}/lib/php.ini";
           };
         };
       };
-    testScript = ''
-      machine.start()
+      users = {
+        users.testuser = {
+          isSystemUser = true;
+          uid = 1080;
+          group = "testgroup";
+        };
+        groups.testgroup = {
+          gid = 1080;
+        };
+      };
+    };
+  testScript = ''
+    machine.start()
 
-      machine.wait_for_unit("unit.service")
-      machine.wait_for_open_port(9081)
+    machine.wait_for_unit("unit.service")
+    machine.wait_for_open_port(9081)
 
-      # Check so we get an evaluated PHP back
-      response = machine.succeed("curl -f -vvv -s http://127.0.0.1:9081/")
-      assert "PHP Version ${pkgs.unit.usedPhp81.version}" in response, "PHP version not detected"
+    # Check so we get an evaluated PHP back
+    response = machine.succeed("curl -f -vvv -s http://127.0.0.1:9081/")
+    assert "PHP Version ${pkgs.unit.usedPhp81.version}" in response, "PHP version not detected"
 
-      # Check so we have database and some other extensions loaded
-      for ext in ["json", "opcache", "pdo_mysql", "pdo_pgsql", "pdo_sqlite"]:
-          assert ext in response, f"Missing {ext} extension"
+    # Check so we have database and some other extensions loaded
+    for ext in ["json", "opcache", "pdo_mysql", "pdo_pgsql", "pdo_sqlite"]:
+        assert ext in response, f"Missing {ext} extension"
 
-      machine.shutdown()
-    '';
-  }
-)
+    machine.shutdown()
+  '';
+}

nixos/tests/wiki-js.nix

@@ -1,171 +1,169 @@
-import ./make-test-python.nix (
-  { pkgs, lib, ... }:
-  {
-    name = "wiki-js";
-    meta = with pkgs.lib.maintainers; {
-      maintainers = [ ma27 ];
+{ pkgs, ... }:
+{
+  name = "wiki-js";
+  meta = with pkgs.lib.maintainers; {
+    maintainers = [ ma27 ];
+  };
+
+  nodes.machine =
+    { pkgs, ... }:
+    {
+      virtualisation.memorySize = 2047;
+      services.wiki-js = {
+        enable = true;
+        settings.db.host = "/run/postgresql";
+        settings.db.user = "wiki-js";
+        settings.db.db = "wiki-js";
+        settings.logLevel = "debug";
+      };
+      services.postgresql = {
+        enable = true;
+        ensureDatabases = [ "wiki-js" ];
+        ensureUsers = [
+          {
+            name = "wiki-js";
+            ensureDBOwnership = true;
+          }
+        ];
+      };
+      systemd.services.wiki-js = {
+        requires = [ "postgresql.service" ];
+        after = [ "postgresql.service" ];
+      };
+      environment.systemPackages = with pkgs; [ jq ];
     };
 
-    nodes.machine =
-      { pkgs, ... }:
-      {
-        virtualisation.memorySize = 2047;
-        services.wiki-js = {
-          enable = true;
-          settings.db.host = "/run/postgresql";
-          settings.db.user = "wiki-js";
-          settings.db.db = "wiki-js";
-          settings.logLevel = "debug";
-        };
-        services.postgresql = {
-          enable = true;
-          ensureDatabases = [ "wiki-js" ];
-          ensureUsers = [
-            {
-              name = "wiki-js";
-              ensureDBOwnership = true;
-            }
-          ];
-        };
-        systemd.services.wiki-js = {
-          requires = [ "postgresql.service" ];
-          after = [ "postgresql.service" ];
-        };
-        environment.systemPackages = with pkgs; [ jq ];
-      };
-
-    testScript =
-      let
-        payloads.finalize = pkgs.writeText "finalize.json" (
-          builtins.toJSON {
-            adminEmail = "webmaster@example.com";
-            adminPassword = "notapassword";
-            adminPasswordConfirm = "notapassword";
-            siteUrl = "http://localhost:3000";
-            telemetry = false;
+  testScript =
+    let
+      payloads.finalize = pkgs.writeText "finalize.json" (
+        builtins.toJSON {
+          adminEmail = "webmaster@example.com";
+          adminPassword = "notapassword";
+          adminPasswordConfirm = "notapassword";
+          siteUrl = "http://localhost:3000";
+          telemetry = false;
+        }
+      );
+      payloads.login = pkgs.writeText "login.json" (
+        builtins.toJSON [
+          {
+            operationName = null;
+            extensions = { };
+            query = ''
+              mutation ($username: String!, $password: String!, $strategy: String!) {
+                authentication {
+                  login(username: $username, password: $password, strategy: $strategy) {
+                    responseResult {
+                      succeeded
+                      errorCode
+                      slug
+                      message
+                      __typename
+                    }
+                    jwt
+                    mustChangePwd
+                    mustProvideTFA
+                    mustSetupTFA
+                    continuationToken
+                    redirect
+                    tfaQRImage
+                    __typename
+                  }
+                  __typename
+                }
+              }
+            '';
+            variables = {
+              password = "notapassword";
+              strategy = "local";
+              username = "webmaster@example.com";
+            };
           }
-        );
-        payloads.login = pkgs.writeText "login.json" (
-          builtins.toJSON [
-            {
-              operationName = null;
-              extensions = { };
-              query = ''
-                mutation ($username: String!, $password: String!, $strategy: String!) {
-                  authentication {
-                    login(username: $username, password: $password, strategy: $strategy) {
-                      responseResult {
-                        succeeded
-                        errorCode
-                        slug
-                        message
-                        __typename
-                      }
-                      jwt
-                      mustChangePwd
-                      mustProvideTFA
-                      mustSetupTFA
-                      continuationToken
-                      redirect
-                      tfaQRImage
+        ]
+      );
+      payloads.content = pkgs.writeText "content.json" (
+        builtins.toJSON [
+          {
+            extensions = { };
+            operationName = null;
+            query = ''
+              mutation ($content: String!, $description: String!, $editor: String!, $isPrivate: Boolean!, $isPublished: Boolean!, $locale: String!, $path: String!, $publishEndDate: Date, $publishStartDate: Date, $scriptCss: String, $scriptJs: String, $tags: [String]!, $title: String!) {
+                pages {
+                  create(content: $content, description: $description, editor: $editor, isPrivate: $isPrivate, isPublished: $isPublished, locale: $locale, path: $path, publishEndDate: $publishEndDate, publishStartDate: $publishStartDate, scriptCss: $scriptCss, scriptJs: $scriptJs, tags: $tags, title: $title) {
+                    responseResult {
+                      succeeded
+                      errorCode
+                      slug
+                      message
+                      __typename
+                    }
+                    page {
+                      id
+                      updatedAt
                       __typename
                     }
                     __typename
                   }
+                  __typename
                 }
-              '';
-              variables = {
-                password = "notapassword";
-                strategy = "local";
-                username = "webmaster@example.com";
-              };
-            }
-          ]
-        );
-        payloads.content = pkgs.writeText "content.json" (
-          builtins.toJSON [
-            {
-              extensions = { };
-              operationName = null;
-              query = ''
-                mutation ($content: String!, $description: String!, $editor: String!, $isPrivate: Boolean!, $isPublished: Boolean!, $locale: String!, $path: String!, $publishEndDate: Date, $publishStartDate: Date, $scriptCss: String, $scriptJs: String, $tags: [String]!, $title: String!) {
-                  pages {
-                    create(content: $content, description: $description, editor: $editor, isPrivate: $isPrivate, isPublished: $isPublished, locale: $locale, path: $path, publishEndDate: $publishEndDate, publishStartDate: $publishStartDate, scriptCss: $scriptCss, scriptJs: $scriptJs, tags: $tags, title: $title) {
-                      responseResult {
-                        succeeded
-                        errorCode
-                        slug
-                        message
-                        __typename
-                      }
-                      page {
-                        id
-                        updatedAt
-                        __typename
-                      }
-                      __typename
-                    }
-                    __typename
-                  }
-                }
-              '';
-              variables = {
-                content = "# Header\n\nHello world!";
-                description = "";
-                editor = "markdown";
-                isPrivate = false;
-                isPublished = true;
-                locale = "en";
-                path = "home";
-                publishEndDate = "";
-                publishStartDate = "";
-                scriptCss = "";
-                scriptJs = "";
-                tags = [ ];
-                title = "Hello world";
-              };
-            }
-          ]
-        );
-      in
-      ''
-        machine.start()
-        machine.wait_for_unit("multi-user.target")
-        machine.wait_for_open_port(3000)
+              }
+            '';
+            variables = {
+              content = "# Header\n\nHello world!";
+              description = "";
+              editor = "markdown";
+              isPrivate = false;
+              isPublished = true;
+              locale = "en";
+              path = "home";
+              publishEndDate = "";
+              publishStartDate = "";
+              scriptCss = "";
+              scriptJs = "";
+              tags = [ ];
+              title = "Hello world";
+            };
+          }
+        ]
+      );
+    in
+    ''
+      machine.start()
+      machine.wait_for_unit("multi-user.target")
+      machine.wait_for_open_port(3000)
 
-        machine.succeed("curl -sSf localhost:3000")
+      machine.succeed("curl -sSf localhost:3000")
 
-        with subtest("Setup"):
-            result = machine.succeed(
-                "curl -sSf localhost:3000/finalize -X POST -d "
-                + "@${payloads.finalize} -H 'Content-Type: application/json' "
-                + "| jq .ok | xargs echo"
-            )
-            assert result.strip() == "true", f"Expected true, got {result}"
+      with subtest("Setup"):
+          result = machine.succeed(
+              "curl -sSf localhost:3000/finalize -X POST -d "
+              + "@${payloads.finalize} -H 'Content-Type: application/json' "
+              + "| jq .ok | xargs echo"
+          )
+          assert result.strip() == "true", f"Expected true, got {result}"
 
-            # During the setup the service gets restarted, so we use this
-            # to check if the setup is done.
-            machine.wait_until_fails("curl -sSf localhost:3000")
-            machine.wait_until_succeeds("curl -sSf localhost:3000")
+          # During the setup the service gets restarted, so we use this
+          # to check if the setup is done.
+          machine.wait_until_fails("curl -sSf localhost:3000")
+          machine.wait_until_succeeds("curl -sSf localhost:3000")
 
-        with subtest("Base functionality"):
-            auth = machine.succeed(
-                "curl -sSf localhost:3000/graphql -X POST "
-                + "-d @${payloads.login} -H 'Content-Type: application/json' "
-                + "| jq '.[0].data.authentication.login.jwt' | xargs echo"
-            ).strip()
+      with subtest("Base functionality"):
+          auth = machine.succeed(
+              "curl -sSf localhost:3000/graphql -X POST "
+              + "-d @${payloads.login} -H 'Content-Type: application/json' "
+              + "| jq '.[0].data.authentication.login.jwt' | xargs echo"
+          ).strip()
 
-            assert auth
+          assert auth
 
-            create = machine.succeed(
-                "curl -sSf localhost:3000/graphql -X POST "
-                + "-d @${payloads.content} -H 'Content-Type: application/json' "
-                + f"-H 'Authorization: Bearer {auth}' "
-                + "| jq '.[0].data.pages.create.responseResult.succeeded'|xargs echo"
-            )
-            assert create.strip() == "true", f"Expected true, got {create}"
+          create = machine.succeed(
+              "curl -sSf localhost:3000/graphql -X POST "
+              + "-d @${payloads.content} -H 'Content-Type: application/json' "
+              + f"-H 'Authorization: Bearer {auth}' "
+              + "| jq '.[0].data.pages.create.responseResult.succeeded'|xargs echo"
+          )
+          assert create.strip() == "true", f"Expected true, got {create}"
 
-        machine.shutdown()
-      '';
-  }
-)
+      machine.shutdown()
+    '';
+}

nixos/tests/wordpress.nix

@@ -1,123 +1,121 @@
-import ./make-test-python.nix (
-  { lib, pkgs, ... }:
+{ lib, config, ... }:
 
-  rec {
-    name = "wordpress";
-    meta = with pkgs.lib.maintainers; {
-      maintainers = [
-        flokli
-        grahamc # under duress!
-        mmilata
+rec {
+  name = "wordpress";
+  meta = with lib.maintainers; {
+    maintainers = [
+      flokli
+      grahamc # under duress!
+      mmilata
+    ];
+  };
+
+  nodes =
+    lib.foldl
+      (
+        a: version:
+        let
+          package = config.node.pkgs."wordpress_${version}";
+        in
+        a
+        // {
+          "wp${version}_httpd" = _: {
+            services.httpd.adminAddr = "webmaster@site.local";
+            services.httpd.logPerVirtualHost = true;
+
+            services.wordpress.webserver = "httpd";
+            services.wordpress.sites = {
+              "site1.local" = {
+                database.tablePrefix = "site1_";
+                inherit package;
+              };
+              "site2.local" = {
+                database.tablePrefix = "site2_";
+                inherit package;
+              };
+            };
+
+            networking.firewall.allowedTCPPorts = [ 80 ];
+            networking.hosts."127.0.0.1" = [
+              "site1.local"
+              "site2.local"
+            ];
+          };
+
+          "wp${version}_nginx" = _: {
+            services.wordpress.webserver = "nginx";
+            services.wordpress.sites = {
+              "site1.local" = {
+                database.tablePrefix = "site1_";
+                inherit package;
+              };
+              "site2.local" = {
+                database.tablePrefix = "site2_";
+                inherit package;
+              };
+            };
+
+            networking.firewall.allowedTCPPorts = [ 80 ];
+            networking.hosts."127.0.0.1" = [
+              "site1.local"
+              "site2.local"
+            ];
+          };
+
+          "wp${version}_caddy" = _: {
+            services.wordpress.webserver = "caddy";
+            services.wordpress.sites = {
+              "site1.local" = {
+                database.tablePrefix = "site1_";
+                inherit package;
+              };
+              "site2.local" = {
+                database.tablePrefix = "site2_";
+                inherit package;
+              };
+            };
+
+            networking.firewall.allowedTCPPorts = [ 80 ];
+            networking.hosts."127.0.0.1" = [
+              "site1.local"
+              "site2.local"
+            ];
+          };
+        }
+      )
+      { }
+      [
+        "6_7"
       ];
-    };
 
-    nodes =
-      lib.foldl
-        (
-          a: version:
-          let
-            package = pkgs."wordpress_${version}";
-          in
-          a
-          // {
-            "wp${version}_httpd" = _: {
-              services.httpd.adminAddr = "webmaster@site.local";
-              services.httpd.logPerVirtualHost = true;
+  testScript = ''
+    import re
 
-              services.wordpress.webserver = "httpd";
-              services.wordpress.sites = {
-                "site1.local" = {
-                  database.tablePrefix = "site1_";
-                  inherit package;
-                };
-                "site2.local" = {
-                  database.tablePrefix = "site2_";
-                  inherit package;
-                };
-              };
+    start_all()
 
-              networking.firewall.allowedTCPPorts = [ 80 ];
-              networking.hosts."127.0.0.1" = [
-                "site1.local"
-                "site2.local"
-              ];
-            };
+    ${lib.concatStrings (
+      lib.mapAttrsToList (name: value: ''
+        ${name}.wait_for_unit("${(value null).services.wordpress.webserver}")
+      '') nodes
+    )}
 
-            "wp${version}_nginx" = _: {
-              services.wordpress.webserver = "nginx";
-              services.wordpress.sites = {
-                "site1.local" = {
-                  database.tablePrefix = "site1_";
-                  inherit package;
-                };
-                "site2.local" = {
-                  database.tablePrefix = "site2_";
-                  inherit package;
-                };
-              };
+    site_names = ["site1.local", "site2.local"]
 
-              networking.firewall.allowedTCPPorts = [ 80 ];
-              networking.hosts."127.0.0.1" = [
-                "site1.local"
-                "site2.local"
-              ];
-            };
+    for machine in (${lib.concatStringsSep ", " (builtins.attrNames nodes)}):
+        for site_name in site_names:
+            machine.wait_for_unit(f"phpfpm-wordpress-{site_name}")
 
-            "wp${version}_caddy" = _: {
-              services.wordpress.webserver = "caddy";
-              services.wordpress.sites = {
-                "site1.local" = {
-                  database.tablePrefix = "site1_";
-                  inherit package;
-                };
-                "site2.local" = {
-                  database.tablePrefix = "site2_";
-                  inherit package;
-                };
-              };
+            with subtest("website returns welcome screen"):
+                assert "Welcome to the famous" in machine.succeed(f"curl -L {site_name}")
 
-              networking.firewall.allowedTCPPorts = [ 80 ];
-              networking.hosts."127.0.0.1" = [
-                "site1.local"
-                "site2.local"
-              ];
-            };
-          }
-        )
-        { }
-        [
-          "6_7"
-        ];
+            with subtest("wordpress-init went through"):
+                info = machine.get_unit_info(f"wordpress-init-{site_name}")
+                assert info["Result"] == "success"
 
-    testScript = ''
-      import re
-
-      start_all()
-
-      ${lib.concatStrings (
-        lib.mapAttrsToList (name: value: ''
-          ${name}.wait_for_unit("${(value null).services.wordpress.webserver}")
-        '') nodes
-      )}
-
-      site_names = ["site1.local", "site2.local"]
-
-      for machine in (${lib.concatStringsSep ", " (builtins.attrNames nodes)}):
-          for site_name in site_names:
-              machine.wait_for_unit(f"phpfpm-wordpress-{site_name}")
-
-              with subtest("website returns welcome screen"):
-                  assert "Welcome to the famous" in machine.succeed(f"curl -L {site_name}")
-
-              with subtest("wordpress-init went through"):
-                  info = machine.get_unit_info(f"wordpress-init-{site_name}")
-                  assert info["Result"] == "success"
-
-              with subtest("secret keys are set"):
-                  pattern = re.compile(r"^define.*NONCE_SALT.{64,};$", re.MULTILINE)
-                  assert pattern.search(
-                      machine.succeed(f"cat /var/lib/wordpress/{site_name}/secret-keys.php")
-                  )
-    '';
-  }
-)
+            with subtest("secret keys are set"):
+                pattern = re.compile(r"^define.*NONCE_SALT.{64,};$", re.MULTILINE)
+                assert pattern.search(
+                    machine.succeed(f"cat /var/lib/wordpress/{site_name}/secret-keys.php")
+                )
+  '';
+}

pkgs/applications/audio/schismtracker/default.nix

@@ -15,13 +15,13 @@
 
 stdenv.mkDerivation rec {
   pname = "schismtracker";
-  version = "20250208";
+  version = "20250313";
 
   src = fetchFromGitHub {
     owner = "schismtracker";
     repo = "schismtracker";
     tag = version;
-    hash = "sha256-nL2zvlu/xPW4CmwqWP2V9KOPdUJ/vCBtlG7rKDiwtgg=";
+    hash = "sha256-AiQ5+HTosVOR+Z5+uT6COMLvkGS3zvXtkCkg16MhVf4=";
   };
 
   # If we let it try to get the version from git, it will fail and fall back

pkgs/applications/editors/vim/plugins/nvim-treesitter/generated.nix

@@ -1,4 +1,4 @@
-# generated by pkgs/applications/editors/vim/plugins/nvim-treesitter/update.py
+# generated by pkgs/applications/editors/vim/plugins/utils/nvim-treesitter/update.py
 
 { buildGrammar, fetchCrate, fetchFromBitbucket, fetchFromGitHub, fetchFromGitLab, fetchFromGitea, fetchFromGitiles, fetchFromRepoOrCz, fetchFromSourcehut, fetchHex, fetchPypi, fetchgit, fetchhg, fetchsvn }:
 
@@ -27,12 +27,12 @@
   };
   angular = buildGrammar {
     language = "angular";
-    version = "0.0.0+rev=be53f25";
+    version = "0.0.0+rev=8435251";
     src = fetchFromGitHub {
       owner = "dlvandenberg";
       repo = "tree-sitter-angular";
-      rev = "be53f2597dded40c90b5f53ed9f4521422f6b6b3";
-      hash = "sha256-gs28MvuPz9hYUSeyObj1QE7n5CDa1+T1+CsDdE8xZLM=";
+      rev = "843525141575e397541e119698f0532755e959f6";
+      hash = "sha256-SPBtbwEMGPrEUCbxSlQl44+hK4Yphngp8QsLkmMsDBk=";
     };
     meta.homepage = "https://github.com/dlvandenberg/tree-sitter-angular";
   };
@@ -1187,12 +1187,12 @@
   };
   hcl = buildGrammar {
     language = "hcl";
-    version = "0.0.0+rev=9e3ec98";
+    version = "0.0.0+rev=de10d49";
     src = fetchFromGitHub {
       owner = "MichaHoffmann";
       repo = "tree-sitter-hcl";
-      rev = "9e3ec9848f28d26845ba300fd73c740459b83e9b";
-      hash = "sha256-HM77BXavgP+H3XwHSqRdLlylmkH+idtuZqLeOV2VUiM=";
+      rev = "de10d494dbd6b71cdf07a678fecbf404dbfe4398";
+      hash = "sha256-oRNNxE5AnI0TyJl92pk0E9xGj5xom/+0kpPMUE/O/TY=";
     };
     meta.homepage = "https://github.com/MichaHoffmann/tree-sitter-hcl";
   };
@@ -1597,12 +1597,12 @@
   };
   koto = buildGrammar {
     language = "koto";
-    version = "0.0.0+rev=6735114";
+    version = "0.0.0+rev=46770ab";
     src = fetchFromGitHub {
       owner = "koto-lang";
       repo = "tree-sitter-koto";
-      rev = "673511402dfef07b25cfa43991693b8442695fc7";
-      hash = "sha256-PKaG5VKMP+O0QC5Wp2hxA6Q/YEbYzfw2a2L7s37yKuY=";
+      rev = "46770abba021e2ddd2c51d9fa3087fd1ab6b2aea";
+      hash = "sha256-BMBwkWVvW4qBX6DqM29Ne17K116yUiH2njdKkzeXmTY=";
     };
     meta.homepage = "https://github.com/koto-lang/tree-sitter-koto";
   };
@@ -1831,12 +1831,12 @@
   };
   meson = buildGrammar {
     language = "meson";
-    version = "0.0.0+rev=9c74e8e";
+    version = "0.0.0+rev=a56af66";
     src = fetchFromGitHub {
       owner = "Decodetalkers";
       repo = "tree-sitter-meson";
-      rev = "9c74e8e8917b83d90e38ac040949079437ec0043";
-      hash = "sha256-uxJfDIsqTROc5YSZkVwr2zZEcpqt3IEdGVkzwp59gnI=";
+      rev = "a56af662e8540412fed5e40cc20435b2b9a20502";
+      hash = "sha256-RT/CXsbo+TZeG+6m9kwSoS5RImchTe5P/7tRlgTnPJo=";
     };
     meta.homepage = "https://github.com/Decodetalkers/tree-sitter-meson";
   };
@@ -2021,12 +2021,12 @@
   };
   ocamllex = buildGrammar {
     language = "ocamllex";
-    version = "0.0.0+rev=5da5bb7";
+    version = "0.0.0+rev=c5cf996";
     src = fetchFromGitHub {
       owner = "atom-ocaml";
       repo = "tree-sitter-ocamllex";
-      rev = "5da5bb7508ac9fd3317561670ef18c126a0fe2aa";
-      hash = "sha256-qfmIfcZ3zktYzuNNYP7Z6u6c7XoKsKD86MRMxe/qkpY=";
+      rev = "c5cf996c23e38a1537069fbe2d4bb83a75fc7b2f";
+      hash = "sha256-eDJRTLYKHcL7yAgFL8vZQh9zp5fBxcZRsWChp8y3Am0=";
     };
     generate = true;
     meta.homepage = "https://github.com/atom-ocaml/tree-sitter-ocamllex";
@@ -2077,12 +2077,12 @@
   };
   perl = buildGrammar {
     language = "perl";
-    version = "0.0.0+rev=bb53f20";
+    version = "0.0.0+rev=ecd90bd";
     src = fetchFromGitHub {
       owner = "tree-sitter-perl";
       repo = "tree-sitter-perl";
-      rev = "bb53f204aa3e7507960014642965c9f9a9e84b1d";
-      hash = "sha256-Kshs1auxxhEjU/XF3LmTzJ2CCMkZL/tVirEHsM0Jelk=";
+      rev = "ecd90bd8b381bcc7219fed4fe351903630e761c6";
+      hash = "sha256-iIa0FJ4kCgfOM/jKwSpaGyOlNwUtczhqoO5gKW7PAHI=";
     };
     meta.homepage = "https://github.com/tree-sitter-perl/tree-sitter-perl";
   };
@@ -2621,12 +2621,12 @@
   };
   scala = buildGrammar {
     language = "scala";
-    version = "0.0.0+rev=42a1542";
+    version = "0.0.0+rev=160e355";
     src = fetchFromGitHub {
       owner = "tree-sitter";
       repo = "tree-sitter-scala";
-      rev = "42a1542248ff611ba2091fe76c6dbf42551ebef8";
-      hash = "sha256-FRX8uaSB408fOWaQSLjOqurVaWQYysoSQCI3vI4d63E=";
+      rev = "160e35520577d91576b08fb677aaee840c591dc2";
+      hash = "sha256-lcrS0FHFGnjT54ePM3BsHMdg5mbc65bsW4T0XpqC3XQ=";
     };
     meta.homepage = "https://github.com/tree-sitter/tree-sitter-scala";
   };
@@ -2878,12 +2878,12 @@
   };
   superhtml = buildGrammar {
     language = "superhtml";
-    version = "0.0.0+rev=fc7c594";
+    version = "0.0.0+rev=28dcf0e";
     src = fetchFromGitHub {
       owner = "kristoff-it";
       repo = "superhtml";
-      rev = "fc7c594f52528e4a4a08671137850143d55a5bf2";
-      hash = "sha256-SEaefbbQFd+Viks55eijUT3YHaEZJMvmZcXm3V6R05I=";
+      rev = "28dcf0edf98d491d47bacb65dc49b6fb979b444c";
+      hash = "sha256-tKeYqRjysv/RVKdegWSMkcJv3y9xrP8lNEqLEoHw2DI=";
     };
     location = "tree-sitter-superhtml";
     meta.homepage = "https://github.com/kristoff-it/superhtml";
@@ -2979,12 +2979,12 @@
   };
   tact = buildGrammar {
     language = "tact";
-    version = "0.0.0+rev=a19be2d";
+    version = "0.0.0+rev=47af202";
     src = fetchFromGitHub {
       owner = "tact-lang";
       repo = "tree-sitter-tact";
-      rev = "a19be2d4c1956e12facfc717e28f13a6ad0860e0";
-      hash = "sha256-TBleyQmrHbKQJKftg2VcLstYIteuPbKuCct4ImmMtcU=";
+      rev = "47af20264abbd24ea282ded0f8ee9cad3cf3bf2f";
+      hash = "sha256-Zrnkvm1WjAlxuk2dEojIx0ldWqdv6gxMl/f9w6TsqBE=";
     };
     meta.homepage = "https://github.com/tact-lang/tree-sitter-tact";
   };
@@ -3035,12 +3035,12 @@
   };
   terraform = buildGrammar {
     language = "terraform";
-    version = "0.0.0+rev=9e3ec98";
+    version = "0.0.0+rev=de10d49";
     src = fetchFromGitHub {
       owner = "MichaHoffmann";
       repo = "tree-sitter-hcl";
-      rev = "9e3ec9848f28d26845ba300fd73c740459b83e9b";
-      hash = "sha256-HM77BXavgP+H3XwHSqRdLlylmkH+idtuZqLeOV2VUiM=";
+      rev = "de10d494dbd6b71cdf07a678fecbf404dbfe4398";
+      hash = "sha256-oRNNxE5AnI0TyJl92pk0E9xGj5xom/+0kpPMUE/O/TY=";
     };
     location = "dialects/terraform";
     meta.homepage = "https://github.com/MichaHoffmann/tree-sitter-hcl";
@@ -3327,12 +3327,12 @@
   };
   vhs = buildGrammar {
     language = "vhs";
-    version = "0.0.0+rev=3f20232";
+    version = "0.0.0+rev=0c6fae9";
     src = fetchFromGitHub {
       owner = "charmbracelet";
       repo = "tree-sitter-vhs";
-      rev = "3f202326c06f1c4d47aa82b9013a6b71aea70611";
-      hash = "sha256-JpldlE+buaakzmItiGWBs8OCgA9A8x8meI37BQNyN5U=";
+      rev = "0c6fae9d2cfc5b217bfd1fe84a7678f5917116db";
+      hash = "sha256-o7Q/3wwiCjxO6hBfj1Wxoz2y6+wxLH+oCLiapox7+Hk=";
     };
     meta.homepage = "https://github.com/charmbracelet/tree-sitter-vhs";
   };

pkgs/applications/editors/vim/plugins/overrides.nix

@@ -1560,6 +1560,10 @@ in
     ];
   };
 
+  lf-nvim = super.lf-nvim.overrideAttrs {
+    dependencies = [ self.toggleterm-nvim ];
+  };
+
   lf-vim = super.lf-vim.overrideAttrs {
     dependencies = [ self.vim-floaterm ];
   };
@@ -2287,6 +2291,7 @@ in
   nvim-highlight-colors = super.nvim-highlight-colors.overrideAttrs {
     # Test module
     nvimSkipModules = [
+      "nvim-highlight-colors.utils_spec"
       "nvim-highlight-colors.buffer_utils_spec"
       "nvim-highlight-colors.color.converters_spec"
       "nvim-highlight-colors.color.patterns_spec"
@@ -3614,6 +3619,9 @@ in
   };
 
   vim-isort = super.vim-isort.overrideAttrs {
+    # Code updated to find relative path at runtime
+    # https://github.com/fisadev/vim-isort/pull/41
+    dontCheckForBrokenSymlinks = true;
     postPatch = ''
       substituteInPlace ftplugin/python_vimisort.vim \
         --replace-fail 'import vim' 'import vim; import sys; sys.path.append("${python3.pkgs.isort}/${python3.sitePackages}")'

pkgs/applications/editors/vim/plugins/vim-plugin-names

@@ -521,6 +521,7 @@ https://github.com/mrjones2014/legendary.nvim/,HEAD,
 https://github.com/camspiers/lens.vim/,,
 https://github.com/thirtythreeforty/lessspace.vim/,,
 https://github.com/cohama/lexima.vim/,,
+https://github.com/lmburns/lf.nvim/,HEAD,
 https://github.com/ptzz/lf.vim/,,
 https://github.com/LucHermitte/lh-brackets/,,
 https://github.com/LucHermitte/lh-vim-lib/,,

pkgs/applications/graphics/seamly2d/default.nix

@@ -24,13 +24,13 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "seamly2d";
-  version = "2025.3.3.205";
+  version = "2025.3.17.207";
 
   src = fetchFromGitHub {
     owner = "FashionFreedom";
     repo = "Seamly2D";
     tag = "v${version}";
-    hash = "sha256-gn2qkozRlv16UdOG7k6qoF/HOT3pgJzmjAmvYm5dn+o=";
+    hash = "sha256-5Bi+SycUZFOxmP0bWbqSnKRZ+UW6b48Cn4YUVfHi4Js=";
   };
 
   buildInputs = [

pkgs/applications/kde/default.nix

@@ -26,7 +26,7 @@ still shows most of the available features is in `./gwenview`.
 */
 
 {
-  lib, libsForQt5, fetchurl,
+  lib, config, libsForQt5, fetchurl,
 }:
 
 let
@@ -96,7 +96,6 @@ let
       incidenceeditor = callPackage ./incidenceeditor.nix {};
       itinerary = callPackage ./itinerary.nix {};
       juk = callPackage ./juk.nix {};
-      k3b = callPackage ./k3b.nix {};
       kaccounts-integration = callPackage ./kaccounts-integration.nix {};
       kaccounts-providers = callPackage ./kaccounts-providers.nix {};
       kaddressbook = callPackage ./kaddressbook.nix {};
@@ -264,6 +263,8 @@ let
       qmlkonsole = callPackage ./qmlkonsole.nix {};
       telly-skout = callPackage ./telly-skout.nix {};
       tokodon = callPackage ./tokodon.nix {};
+    } // lib.optionalAttrs config.allowAliases {
+      k3b = throw "libsForQt5.k3b has been dropped in favor of kdePackages.k3b";
     };
 
 in lib.makeScope libsForQt5.newScope packages

pkgs/applications/kde/k3b.nix

@@ -1,48 +0,0 @@
-{ mkDerivation, lib
-, extra-cmake-modules, kdoctools, makeWrapper, shared-mime-info
-, libkcddb, karchive, kcmutils, kfilemetadata, knewstuff, knotifyconfig, solid, kxmlgui
-, flac, lame, libmad, libmpcdec, libvorbis
-, libsamplerate, libsndfile, taglib
-, cdparanoia, cdrdao, cdrtools, dvdplusrwtools, libburn, libdvdcss, libdvdread, vcdimager
-, ffmpeg, libmusicbrainz3, normalize, sox, transcode, kinit
-}:
-
-mkDerivation {
-  pname = "k3b";
-  meta = with lib; {
-    homepage = "https://apps.kde.org/k3b/";
-    description = "Disk burning application";
-    mainProgram = "k3b";
-    license = with licenses; [ gpl2Plus ];
-    maintainers = with maintainers; [ sander ];
-    platforms = platforms.linux;
-  };
-  nativeBuildInputs = [ extra-cmake-modules kdoctools makeWrapper ];
-  buildInputs = [
-    # kde
-    libkcddb karchive kcmutils kfilemetadata knewstuff knotifyconfig solid kxmlgui
-    # formats
-    flac lame libmad libmpcdec libvorbis
-    # sound utilities
-    libsamplerate libsndfile taglib
-    # cd/dvd
-    cdparanoia libdvdcss libdvdread
-    # others
-    ffmpeg libmusicbrainz3 shared-mime-info
-  ];
-  propagatedUserEnvPkgs = [ (lib.getBin kinit) ];
-  postFixup =
-    let
-      binPath = lib.makeBinPath [
-        cdrdao cdrtools dvdplusrwtools libburn normalize sox transcode
-        vcdimager flac
-      ];
-      libraryPath = lib.makeLibraryPath [
-        cdparanoia
-      ];
-    in ''
-      wrapProgram "$out/bin/k3b"     \
-        --prefix PATH : "${binPath}" \
-        --prefix LD_LIBRARY_PATH : ${libraryPath}
-    '';
-}

pkgs/applications/networking/firehol/default.nix

@@ -23,13 +23,13 @@
 
 stdenv.mkDerivation rec {
   pname = "firehol";
-  version = "3.1.7";
+  version = "3.1.8";
 
   src = fetchFromGitHub {
     owner = "firehol";
     repo = "firehol";
     rev = "v${version}";
-    sha256 = "sha256-gq7l7QoUsK+j5DUn84kD9hlUTC4hz3ds3gNJc1tRygs=";
+    sha256 = "sha256-6O3AoQs7Qzcin8VXQgJfCVsNOI74H6fE1DgqdY+e4bA=";
   };
 
   patches = [

pkgs/applications/networking/p2p/gnunet/default.nix

@@ -1,26 +1,81 @@
-{ lib, stdenv, fetchurl, adns, curl, gettext, gmp, gnutls, libextractor
-, libgcrypt, libgnurl, libidn, libmicrohttpd, libtool, libunistring
-, makeWrapper, ncurses, pkg-config, libxml2, sqlite, zlib
-, libpulseaudio, libopus, libogg, jansson, libsodium
+{
+  lib,
+  stdenv,
+  fetchurl,
 
-, postgresqlSupport ? true, libpq }:
+  # build-time deps
+  libtool,
+  makeWrapper,
+  meson,
+  ninja,
+  pkg-config,
 
-stdenv.mkDerivation rec {
+  # runtime deps
+  adns,
+  curl,
+  gettext,
+  gmp,
+  gnutls,
+  jansson,
+  libextractor,
+  libgcrypt,
+  libgnurl,
+  libidn,
+  libmicrohttpd,
+  libogg,
+  libopus,
+  libpulseaudio,
+  libsodium,
+  libunistring,
+  libxml2,
+  ncurses,
+  sqlite,
+  zlib,
+
+  postgresqlSupport ? true,
+  libpq,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
   pname = "gnunet";
-  version = "0.23.1";
+  version = "0.24.0";
 
   src = fetchurl {
-    url = "mirror://gnu/gnunet/gnunet-${version}.tar.gz";
-    hash = "sha256-b9BbaQdrOxqOfiCyVOBE/dTG2lMTGWMX894Ij30CXPI=";
+    url = "mirror://gnu/gnunet/gnunet-${finalAttrs.version}.tar.gz";
+    hash = "sha256-BoUvn0gz5ssGvu3fhyerlMQ4U69yOnY4etdxYS4WPFc=";
   };
 
   enableParallelBuilding = true;
 
-  nativeBuildInputs = [ pkg-config libtool makeWrapper ];
+  nativeBuildInputs = [
+    libtool
+    makeWrapper
+    meson
+    ninja
+    pkg-config
+  ];
+
   buildInputs = [
-    adns curl gmp gnutls libextractor libgcrypt libgnurl libidn
-    libmicrohttpd libunistring libxml2 ncurses gettext libsodium
-    sqlite zlib libpulseaudio libopus libogg jansson
+    adns
+    curl
+    gettext
+    gmp
+    gnutls
+    jansson
+    libextractor
+    libgcrypt
+    libgnurl
+    libidn
+    libmicrohttpd
+    libogg
+    libopus
+    libpulseaudio
+    libsodium
+    libunistring
+    libxml2
+    ncurses
+    sqlite
+    zlib
   ] ++ lib.optional postgresqlSupport libpq;
 
   preConfigure = ''
@@ -44,7 +99,7 @@ stdenv.mkDerivation rec {
     make -k check
   '';
 
-  meta = with lib; {
+  meta = {
     description = "GNU's decentralized anonymous and censorship-resistant P2P framework";
 
     longDescription = ''
@@ -63,9 +118,9 @@ stdenv.mkDerivation rec {
     '';
 
     homepage = "https://gnunet.org/";
-    license = licenses.agpl3Plus;
-    maintainers = with maintainers; [ pstn ];
-    platforms = platforms.unix;
-    changelog = "https://git.gnunet.org/gnunet.git/tree/ChangeLog?h=v${version}";
+    license = lib.licenses.agpl3Plus;
+    maintainers = with lib.maintainers; [ pstn ];
+    platforms = lib.platforms.unix;
+    changelog = "https://git.gnunet.org/gnunet.git/tree/ChangeLog?h=v${finalAttrs.version}";
   };
-}
+})

pkgs/applications/networking/p2p/gnunet/gtk.nix

@@ -13,13 +13,13 @@
   wrapGAppsHook3,
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "gnunet-gtk";
-  version = "0.23.1";
+  version = "0.24.0";
 
   src = fetchurl {
-    url = "mirror://gnu/gnunet/gnunet-gtk-${version}.tar.gz";
-    hash = "sha256-bmU3799pZVUyrsJ92MKgn5NIqCW76ml4N42Ewi+VWvI=";
+    url = "mirror://gnu/gnunet/gnunet-gtk-${finalAttrs.version}.tar.gz";
+    hash = "sha256-rsQzMvOoQEuushd0jBGQt9j6zXj2G1SMax8d4QoDV6s=";
   };
 
   nativeBuildInputs = [
@@ -50,4 +50,4 @@ stdenv.mkDerivation rec {
     description = "GNUnet GTK User Interface";
     homepage = "https://git.gnunet.org/gnunet-gtk.git";
   };
-}
+})

pkgs/applications/science/chemistry/siesta/default.nix

@@ -8,48 +8,56 @@
   useMpi ? false,
   mpi,
   fetchFromGitLab,
+  cmake,
+  pkg-config,
+  readline,
+  ninja,
+  elpa,
 }:
 
-stdenv.mkDerivation rec {
-  version = "4.1.5";
+stdenv.mkDerivation (finalAttrs: {
   pname = "siesta";
+  version = "5.2.2";
 
   src = fetchFromGitLab {
     owner = "siesta-project";
     repo = "siesta";
-    rev = "v${version}";
-    sha256 = "0lz8rfl5xwdj17zn7a30ipi7cgjwqki21a7wg9rdg7iwx27bpnmg";
+    tag = finalAttrs.version;
+    hash = "sha256-pud8RlJAT+0TwyPRsbf5D/8FfLjZvPYPf84Xb7UH6os=";
+    fetchSubmodules = true;
   };
 
-  postPatch = ''
-    substituteInPlace Src/siesta_init.F --replace '/bin/rm' 'rm'
-  '';
-
   passthru = {
     inherit mpi;
   };
 
-  nativeBuildInputs = [ gfortran ];
+  nativeBuildInputs = [
+    ninja
+    gfortran
+    cmake
+    pkg-config
+  ];
 
   buildInputs =
     [
       blas
       lapack
+      readline
+      elpa
     ]
     ++ lib.optionals useMpi [
       mpi
       scalapack
     ];
 
-  enableParallelBuilding = false; # Started making trouble with gcc-11
+  NIX_LDFLAGS = "-lm";
 
-  # Must do manually because siesta does not do the regular
-  # ./configure; make; make install
-  configurePhase = ''
-    cd Obj
-    sh ../Src/obj_setup.sh
-    cp gfortran.make arch.make
-  '';
+  cmakeFlags = [
+    "-DCMAKE_INSTALL_INCLUDEDIR=include"
+    "-DCMAKE_INSTALL_LIBDIR=lib"
+  ];
+
+  enableParallelBuilding = false; # Started making trouble with gcc-11
 
   preBuild =
     ''
@@ -76,12 +84,7 @@ stdenv.mkDerivation rec {
         ''
     );
 
-  installPhase = ''
-    mkdir -p $out/bin
-    cp -a siesta $out/bin
-  '';
-
-  meta = with lib; {
+  meta = {
     description = "First-principles materials simulation code using DFT";
     mainProgram = "siesta";
     longDescription = ''
@@ -98,8 +101,8 @@ stdenv.mkDerivation rec {
       and all-electron methods.
     '';
     homepage = "https://siesta-project.org/siesta/";
-    license = licenses.gpl2;
+    license = lib.licenses.gpl2;
     platforms = [ "x86_64-linux" ];
-    maintainers = [ maintainers.costrouc ];
+    maintainers = [ lib.maintainers.costrouc ];
   };
-}
+})

pkgs/applications/science/programming/fdr/default.nix

@@ -1,80 +0,0 @@
-{
-  lib,
-  stdenv,
-  fetchurl,
-  qtbase,
-  qtx11extras,
-  ncurses5,
-  xorg,
-  zlib,
-  python27Packages,
-}:
-stdenv.mkDerivation {
-  pname = "fdr";
-  version = "4.2.7";
-  src = fetchurl {
-    url = "https://dl.cocotec.io/fdr/fdr-3814-linux-x86_64.tar.gz";
-    sha256 = "0cajz1gz4slq9nfhm8dqdgxl0kc950838n0lrf8jw4vl54gv6chh";
-  };
-
-  libPath = lib.makeLibraryPath [
-    stdenv.cc.cc
-    python27Packages.python
-    qtbase
-    qtx11extras
-    ncurses5
-    xorg.libX11
-    xorg.libXft
-    zlib
-  ];
-
-  dontConfigure = true;
-  installPhase = ''
-    mkdir -p "$out"
-
-    # shipped Qt is buggy
-    rm lib/libQt*
-    rm -r lib/qt_plugins
-
-    cp -r * "$out"
-    ln -s ${ncurses5.out}/lib/libtinfo.so.5 $out/lib/libtinfo.so.5
-    ln -s ${qtbase.bin}/${qtbase.qtPluginPrefix} $out/lib/qt_plugins
-    ln -s ${zlib.out}/lib/libz.so.1 $out/lib/libz.so.1
-
-    for b in fdr4 _fdr4 refines _refines cspmprofiler cspmexplorerprof
-    do
-      patchelf --set-interpreter $(cat $NIX_CC/nix-support/dynamic-linker) \
-        --set-rpath "$libPath:$out/lib" \
-        "$out/bin/$b"
-    done
-
-    for l in corei7/librefines.so \
-      libcspm_process_compiler.so \
-      libcsp_operators.so \
-      _fdr.so \
-      libfdr.so \
-      libfdr_java.so \
-      libprocess_compiler.so \
-      librefines_gui.so \
-      librefines_licensing.so  \
-      libboost_date_time.so.1.60.0 \
-      libboost_filesystem.so.1.60.0 \
-      libboost_iostreams.so.1.60.0 \
-      libboost_program_options.so.1.60.0 \
-      libboost_serialization.so.1.60.0 \
-      libboost_system.so.1.60.0
-    do
-      patchelf --set-rpath "$libPath:$out/lib" \
-        "$out/lib/$l"
-    done
-  '';
-
-  meta = with lib; {
-    homepage = "https://cocotec.io/fdr/";
-    description = "CSP refinement checker";
-    license = licenses.unfreeRedistributable;
-    sourceProvenance = with sourceTypes; [ binaryNativeCode ];
-    platforms = platforms.linux;
-    maintainers = with maintainers; [ nickhu ];
-  };
-}

pkgs/applications/video/bino3d/default.nix

@@ -14,12 +14,12 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "bino";
-  version = "2.4";
+  version = "2.5";
 
   src = fetchgit {
     url = "https://git.marlam.de/git/bino.git";
     rev = "bino-${finalAttrs.version}";
-    hash = "sha256-h7sS+5he8dKl9ipdM1Vs1WC6U+Pi/QMVSdTbT9E59lU=";
+    hash = "sha256-vGPbSYTfRy414xVcLIvOnN4Te36HWVz7DQegNhYb3u4=";
   };
 
   nativeBuildInputs = [

pkgs/applications/video/obs-studio/plugins/obs-tuna/default.nix

@@ -14,7 +14,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "obs-tuna";
-  version = "1.9.9";
+  version = "1.9.10";
 
   nativeBuildInputs = [
     cmake
@@ -33,7 +33,7 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "univrsal";
     repo = "tuna";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-qwOAidnCGZSwTahgbyf1K0KgoDvYpqDAQXM3l1lfZXg=";
+    hash = "sha256-Y4ny8XJIk4KtmRTWdO6tHevT4Ivr1TqkNMNhua499sY=";
     fetchSubmodules = true;
   };
 

pkgs/applications/video/vdr/softhddevice/default.nix

@@ -15,12 +15,12 @@
 }:
 stdenv.mkDerivation rec {
   pname = "vdr-softhddevice";
-  version = "2.4.4";
+  version = "2.4.5";
 
   src = fetchFromGitHub {
     owner = "ua0lnj";
     repo = "vdr-plugin-softhddevice";
-    sha256 = "sha256-RaPzflLz712+UU4dD7p3waMD6dg5SHfT9SfmON4jVk4=";
+    sha256 = "sha256-G5pOSlO1FU7kvHwH1yw8UBEeDwQ5aIxubdyFcWQ2Z/8=";
     rev = "v${version}";
   };
 

pkgs/by-name/ag/agorakit/package.nix

@@ -1,11 +1,11 @@
 {
   lib,
   fetchFromGitHub,
-  php,
+  php82,
   dataDir ? "/var/lib/agorakit",
 }:
 
-php.buildComposerProject2 (finalAttrs: {
+php82.buildComposerProject2 (finalAttrs: {
   pname = "agorakit";
   version = "1.9.3";
 

pkgs/by-name/ai/airwindows/package.nix

@@ -8,13 +8,13 @@
 }:
 stdenv.mkDerivation {
   pname = "airwindows";
-  version = "0-unstable-2025-03-02";
+  version = "0-unstable-2025-03-23";
 
   src = fetchFromGitHub {
     owner = "airwindows";
     repo = "airwindows";
-    rev = "f172389273a0ab35f703a6ab267c737d28ab7ec5";
-    hash = "sha256-YmtH5KtPeTDR8imQkTriJx5sD9cS5Tqp6Yjri/I+q3Y=";
+    rev = "9de336a436cb5ea1e47a319947acb1ea44cede6e";
+    hash = "sha256-gI5dmI5ysoCmUBTL6CgUw+F/K8D4RbXlXNTpIJMbotk=";
   };
 
   # we patch helpers because honestly im spooked out by where those variables

pkgs/by-name/al/alsa-scarlett-gui/package.nix

@@ -13,13 +13,13 @@
 
 stdenv.mkDerivation rec {
   pname = "alsa-scarlett-gui";
-  version = "0.5.0";
+  version = "0.5.1";
 
   src = fetchFromGitHub {
     owner = "geoffreybennett";
     repo = "alsa-scarlett-gui";
     rev = version;
-    hash = "sha256-Kc8KKFLMf4NZK8Bdnuttt8VOrYUpo0M9m3iJ+8z0hZE=";
+    hash = "sha256-DkfpMK0T67B4mnriignf4hx6Ifddls0rN0SxyfEsPZg=";
   };
 
   NIX_CFLAGS_COMPILE = [ "-Wno-error=deprecated-declarations" ];

pkgs/by-name/an/android-udev-rules/package.nix

@@ -10,13 +10,13 @@
 
 stdenv.mkDerivation rec {
   pname = "android-udev-rules";
-  version = "20241109";
+  version = "20250314";
 
   src = fetchFromGitHub {
     owner = "M0Rf30";
     repo = "android-udev-rules";
     rev = version;
-    hash = "sha256-WHAm9hDpXsn+Isrc5nNgw7G5DKBJb7X0ILx6lG5Y7YQ=";
+    hash = "sha256-QADyZ3FHVuxX/PfsRt2ijwJRCksQb1Hz5lSgYJlyb1Q=";
   };
 
   installPhase = ''

pkgs/by-name/an/anubis/package.nix

@@ -7,16 +7,16 @@
 }:
 buildGoModule (finalAttrs: {
   pname = "anubis";
-  version = "1.14.2";
+  version = "1.15.0";
 
   src = fetchFromGitHub {
     owner = "TecharoHQ";
     repo = "anubis";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-K4VXTO8F3GTOA9jOrI0OF6CYTRaDUlUT9/HujYmnHpM=";
+    hash = "sha256-n70H2FBvp7hxvRqU1+bvef9UrOzkSpg9QtFoqGyXiaM=";
   };
 
-  vendorHash = "sha256-t+E3sILEwXGkTaBtKLO2kFEntivY9fVK8o86arvMaOU=";
+  vendorHash = "sha256-Rcra5cu7zxGm2LhL2x9Kd3j/uQaEb8OOh/j5Rhh8S1k=";
 
   subPackages = [
     "cmd/anubis"
@@ -43,7 +43,10 @@ buildGoModule (finalAttrs: {
     homepage = "https://github.com/TecharoHQ/anubis/";
     changelog = "https://github.com/TecharoHQ/anubis/releases/tag/v${finalAttrs.version}";
     license = lib.licenses.mit;
-    maintainers = with lib.maintainers; [ knightpp ];
+    maintainers = with lib.maintainers; [
+      knightpp
+      soopyc
+    ];
     mainProgram = "anubis";
   };
 })

pkgs/by-name/ap/apx/package.nix

@@ -10,16 +10,16 @@
 
 buildGoModule rec {
   pname = "apx";
-  version = "2.4.4";
+  version = "2.4.5";
 
   src = fetchFromGitHub {
     owner = "Vanilla-OS";
     repo = "apx";
     tag = "v${version}";
-    hash = "sha256-60z6wbbXQp7MA5l7LP/mToZftX+nbcs2Mewg5jCFwFk=";
+    hash = "sha256-0Rfj7hrH26R9GHOPPVdCaeb1bfAw9KnPpJYXyiei90U=";
   };
 
-  vendorHash = "sha256-YHnPLjZWUYoARHF4V1Pm1LYdCJGubPCve0wQ5FpeXUg=";
+  vendorHash = "sha256-RoZ6sXbvIHfQcup9Ba/PpzS0eytKdX4WjDUlgB3UjfE=";
 
   # podman needed for apx to not error when building shell completions
   nativeBuildInputs = [

pkgs/by-name/ar/arduino-language-server/package.nix

@@ -7,18 +7,18 @@
 
 buildGoModule rec {
   pname = "arduino-language-server";
-  version = "0.7.6";
+  version = "0.7.7";
 
   src = fetchFromGitHub {
     owner = "arduino";
     repo = "arduino-language-server";
     tag = version;
-    hash = "sha256-PmPGhbB1HqxZRK+f28SdZNh4HhE0oseYsdJuEAAk90I=";
+    hash = "sha256-twTbJ5SFbL4AIX+ffB0LdOYXUxh4SzmZguJSRdEo1lQ=";
   };
 
   subPackages = [ "." ];
 
-  vendorHash = "sha256-tS6OmH757VDdViPHJAJAftQu+Y1YozE7gXkt5anDlT0=";
+  vendorHash = "sha256-wXArVPzYmuiivx+8M86rrvfKsvCMtkN3WgXQByr5fC4=";
 
   doCheck = false;
 

pkgs/by-name/au/ausweiskopie/package.nix

@@ -0,0 +1,76 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  python3Packages,
+  makeDesktopItem,
+  copyDesktopItems,
+  desktopToDarwinBundle,
+  enableModern ? true,
+}:
+
+python3Packages.buildPythonApplication rec {
+  pname = "ausweiskopie";
+  version = "0.1.4";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "Varbin";
+    repo = pname;
+    tag = "v${version}";
+    hash = "sha256-axy/cI5n2uvMKZ2Fkb0seFMRBKv6rpU01kgKSiQ10jE=";
+  };
+
+  nativeBuildInputs = [
+    copyDesktopItems
+  ] ++ lib.optional stdenv.hostPlatform.isDarwin desktopToDarwinBundle;
+
+  build-system = with python3Packages; [
+    setuptools
+    setuptools-scm
+  ];
+
+  desktopItems = [
+    (makeDesktopItem {
+      name = "Meine Ausweiskopie";
+      exec = "ausweiskopie";
+      icon = "ausweiskopie";
+      desktopName = "Meine Ausweiskopie";
+      comment = "Create redacted copies of German identity cards";
+      categories = [
+        "Office"
+        "Viewer"
+      ];
+    })
+  ];
+
+  dependencies =
+    with python3Packages;
+    (
+      [
+        pillow
+        tkinter
+        importlib-resources
+      ]
+      ++ lib.optionals enableModern optional-dependencies.modern
+      ++ lib.optionals stdenv.hostPlatform.isLinux [
+        dbus-next
+        pygobject3
+      ]
+    );
+
+  optional-dependencies.modern = [ python3Packages.ttkbootstrap ];
+
+  postInstall = ''
+    install -Dm644 ./src/ausweiskopie/resources/icon_colored.png $out/share/icons/hicolor/256x256/apps/ausweiskopie.png
+  '';
+
+  meta = {
+    description = "Create privacy friendly and legal copies of your Ausweisdokument";
+    homepage = "https://github.com/Varbin/ausweiskopie";
+    license = lib.licenses.mpl20;
+    maintainers = with lib.maintainers; [ e1mo ];
+    platforms = lib.platforms.unix;
+    mainProgram = "ausweiskopie";
+  };
+}

pkgs/by-name/aw/aws-sam-cli/package.nix

@@ -11,14 +11,14 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "aws-sam-cli";
-  version = "1.134.0";
+  version = "1.135.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "aws";
     repo = "aws-sam-cli";
     tag = "v${version}";
-    hash = "sha256-CuXJHKHFE1HOs3fQPofWPJI1/+mtkXBGEmO7bIQD5lA=";
+    hash = "sha256-ccYpEznuU6d7gDyrDiuUmvdCJutXI7SAH2PH9Vdq8Fs=";
   };
 
   build-system = with python3.pkgs; [ setuptools ];

pkgs/by-name/az/azure-cli/extensions-manual.nix

@@ -16,9 +16,9 @@
 {
   application-insights = mkAzExtension rec {
     pname = "application-insights";
-    version = "1.2.2";
+    version = "1.2.3";
     url = "https://azcliprod.blob.core.windows.net/cli-extensions/application_insights-${version}-py2.py3-none-any.whl";
-    hash = "sha256-ijmPj8jG+s+855jly3m5wEz5myS8pxU/Scf7lRP2VvI=";
+    hash = "sha256-yUHCMtBDZmNuE1TP4AcIUhAT+IpbHnR0DYBH7EbZBZk=";
     description = "Support for managing Application Insights components and querying metrics, events, and logs from such components";
     propagatedBuildInputs = with python3Packages; [ isodate ];
     meta.maintainers = with lib.maintainers; [ andreasvoss ];
@@ -140,9 +140,9 @@
 
   vm-repair = mkAzExtension rec {
     pname = "vm-repair";
-    version = "2.0.3";
+    version = "2.1.1";
     url = "https://azcliprod.blob.core.windows.net/cli-extensions/vm_repair-${version}-py2.py3-none-any.whl";
-    hash = "sha256-ynbq8XyoC6LR7N/x6Ztl74Gu4otTN+QiWLmvy7OfGA0=";
+    hash = "sha256-3Pgwppp4IssNYhJ+USQNwMEp91XdZDwNlnNWzVWrHFM=";
     description = "Support for repairing Azure Virtual Machines";
     propagatedBuildInputs = with python3Packages; [ opencensus ];
     meta.maintainers = with lib.maintainers; [ ];

pkgs/by-name/bi/bicep/package.nix

@@ -10,13 +10,13 @@
 
 buildDotnetModule rec {
   pname = "bicep";
-  version = "0.34.1";
+  version = "0.34.44";
 
   src = fetchFromGitHub {
     owner = "Azure";
     repo = "bicep";
     rev = "v${version}";
-    hash = "sha256-8ob4UISiqyhgBeQxRb6iLporsIVCq5c/7Yb2wvUW1ZQ=";
+    hash = "sha256-vyPRLPTvQkwN7unlIHs6DvpjXnXyW1PDtH9hhIOgN1A=";
   };
 
   patches = [

pkgs/by-name/br/brillo/package.nix

@@ -9,13 +9,13 @@
 
 stdenv.mkDerivation rec {
   pname = "brillo";
-  version = "1.4.12";
+  version = "1.4.13";
 
   src = fetchFromGitLab {
     owner = "cameronnemo";
     repo = "brillo";
     rev = "v${version}";
-    hash = "sha256-dKGNioWGVAFuB4kySO+QGTnstyAD0bt4/6FBVwuRxJo=";
+    hash = "sha256-+BUyM3FFnsk87NFaD9FBwdLqf6wsNhX+FDB7nqhgAmM=";
   };
 
   patches = [
@@ -40,7 +40,7 @@ stdenv.mkDerivation rec {
     homepage = "https://gitlab.com/cameronnemo/brillo";
     mainProgram = "brillo";
     license = [
-      licenses.gpl3
+      licenses.gpl3Only
       licenses.bsd0
     ];
     platforms = platforms.linux;

pkgs/by-name/br/bruno/package.nix

@@ -17,13 +17,13 @@
 
 buildNpmPackage rec {
   pname = "bruno";
-  version = "1.40.0";
+  version = "1.40.1";
 
   src = fetchFromGitHub {
     owner = "usebruno";
     repo = "bruno";
     tag = "v${version}";
-    hash = "sha256-8Uo3eGF555yoBQxpq1cF9JLK9jkYVMHG+6eFFX1NO3U=";
+    hash = "sha256-1QJjdvH3cjZJKDWnua7EeqVEXaMEqYcv44jqG/O0+a4=";
 
     postFetch = ''
       ${lib.getExe npm-lockfile-fix} $out/package-lock.json

pkgs/by-name/ca/cargo-public-api/package.nix

@@ -11,15 +11,15 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "cargo-public-api";
-  version = "0.44.2";
+  version = "0.47.0";
 
   src = fetchCrate {
     inherit pname version;
-    hash = "sha256-Rdwn3izKSy5733KJw3OyGsBJ55xdxg9+MuI8ZNdei3s=";
+    hash = "sha256-g0kaJ3HPFeS5PvWQfUTanxCgm9sduW9nBx/N61kt3ZI=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-11Y9BTtprv7EmBx7hsV8UnGDWmogj9azHOCAc/JdY7o=";
+  cargoHash = "sha256-jQx4VCarfbdTXOE/GAAzxeXf7xVwEaXDPhw6ywBR3wA=";
 
   nativeBuildInputs = [ pkg-config ];
 

pkgs/by-name/cc/ccid/package.nix

@@ -15,11 +15,11 @@
 
 stdenv.mkDerivation rec {
   pname = "ccid";
-  version = "1.6.1";
+  version = "1.6.2";
 
   src = fetchurl {
     url = "https://ccid.apdu.fr/files/${pname}-${version}.tar.xz";
-    hash = "sha256-LsqPsH6P58DTna6sp7l81zxA7Ztyc4okrT3L38kY4eo=";
+    hash = "sha256-QZWEEJUBV+Yi+dkcnnjHtwjbdOIvcRkMWB0k0gVk1Ek=";
   };
 
   postPatch = ''

pkgs/by-name/ch/checkpolicy/package.nix

@@ -9,12 +9,12 @@
 
 stdenv.mkDerivation rec {
   pname = "checkpolicy";
-  version = "3.8";
+  version = "3.8.1";
   inherit (libsepol) se_url;
 
   src = fetchurl {
     url = "${se_url}/${version}/checkpolicy-${version}.tar.gz";
-    sha256 = "sha256-ZforqKJR1tQvAwZGcU5eLegHrhbgIx3isDuUCq2636U=";
+    sha256 = "sha256-e0d8UW4mk9i2xRE4YyMXfx19tRwuBOttDejKKzYSDl0=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/ch/chirp/package.nix

@@ -11,14 +11,14 @@
 
 python3Packages.buildPythonApplication {
   pname = "chirp";
-  version = "0.4.0-unstable-2025-03-17";
+  version = "0.4.0-unstable-2025-03-27";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "kk7ds";
     repo = "chirp";
-    rev = "7d0a609a24efa7861a9cedd0abe057a250857d97";
-    hash = "sha256-BL5+z3CFInCEXgwyx4sHaHbUXLWwe/JWevD1ZDxQStQ=";
+    rev = "906aa9704dfd131fabbcb3ae2dbba33b7cc2a5da";
+    hash = "sha256-oRo26GB28wQ5gx+EgN/xyvOyA4IaObG0np05bFlJsF8=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/cl/clash-verge-rev/package.nix

@@ -14,25 +14,25 @@
 }:
 let
   pname = "clash-verge-rev";
-  version = "2.1.2";
+  version = "2.2.2";
 
   src = fetchFromGitHub {
     owner = "clash-verge-rev";
     repo = "clash-verge-rev";
     tag = "v${version}";
-    hash = "sha256-rsl3hBywToemthNrG80Mv+JagA4g4S7HukOaRpMKJi8=";
+    hash = "sha256-CiVwFSCbCxFm8naogpL73gUp8HNHwcIiygSVon4WNZk=";
   };
 
   src-service = fetchFromGitHub {
     owner = "clash-verge-rev";
     repo = "clash-verge-service";
-    rev = "bfd7d597b13d49cf49b64676c2719f1ed9599d22"; # no meaningful tags in this repo. The only way is updating manully every time.
-    hash = "sha256-LdM0VIVsDPGnHEGwbRFh4/ACTdpVyDnu6dYLLvVbwpc=";
+    rev = "ffcccc6095e052534980230f9e0ca97db2675062"; # no meaningful tags in this repo. The only way is updating manully every time.
+    hash = "sha256-AbUflPcuSuUigRQB0i52mfVu5sIep1vMZGVMZyznwXY=";
   };
 
-  service-cargo-hash = "sha256-mJEk4OAEcuTk5NCzPcWwSlvysqR/9s8p9OGiXWBZvdg=";
-  npm-hash = "sha256-1OT9Iv9AF4svaOnWNQfOUdo8EUkG0+PU+y8nprc6YjU=";
-  vendor-hash = "sha256-myvFXaS+QdBRHPpcLEmhg1wgheWb4uXv+QXQf5HA51M=";
+  service-cargo-hash = "sha256-lMOQznPlkHIMSm5nOLuGP9qJXt3CXnd+q8nCu+Xbbt8=";
+  npm-hash = "sha256-v9+1NjXo/1ogmep+4IP+9qoUR1GJz87VGeOoMzQ1Rfw=";
+  vendor-hash = "sha256-nU3bIxD5zggTScNGH3HmnnXUGkLMwnQbIBVI1DmIpFs=";
 
   service = callPackage ./service.nix {
     inherit

pkgs/by-name/cl/clash-verge-rev/unwrapped.nix

@@ -4,6 +4,7 @@
   src,
   libayatana-appindicator,
   vendor-hash,
+  fetchpatch,
   glib,
   webui,
   pkg-config,
@@ -29,7 +30,20 @@ rustPlatform.buildRustPackage {
     OPENSSL_NO_VENDOR = 1;
   };
 
+  patches = [
+    (fetchpatch {
+      name = "fix-service-mode-mihomo-check.patch";
+      url = "https://github.com/clash-verge-rev/clash-verge-rev/commit/16d4f9fe7ee95b7312a10bf216c818c3e144dea7.patch";
+      hash = "sha256-FQHm1jjo0W1IokMDJGWVMVV9DWItG1prX+TIysL12DA=";
+    })
+  ];
+
+  prePatch = ''
+    cd ..
+  '';
+
   postPatch = ''
+    cd src-tauri
     substituteInPlace $cargoDepsCopy/libappindicator-sys-*/src/lib.rs \
       --replace-fail "libayatana-appindicator3.so.1" "${libayatana-appindicator}/lib/libayatana-appindicator3.so.1"
 

pkgs/by-name/co/cocogitto/package.nix

@@ -9,17 +9,17 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "cocogitto";
-  version = "6.2.0";
+  version = "6.3.0";
 
   src = fetchFromGitHub {
     owner = "oknozor";
     repo = "cocogitto";
     rev = version;
-    hash = "sha256-VorWk7E+I1hU8Hc+WF47+V483E/xPjf7Glqp7iA1t5g=";
+    hash = "sha256-ij5vpIpqCYGNPNWPY47rWmMLEgBh+wtVmLRt11S14rE=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-h6XX25uN9wBCdOYc1Bl6VWi3htopcXb7VhjNIDkmEJY=";
+  cargoHash = "sha256-wfq1W9zjC0phPUr6SaLv8Ia5aQk/+1ujOTo0241X7AY=";
 
   # Test depend on git configuration that would likely exist in a normal user environment
   # and might be failing to create the test repository it works in.

pkgs/by-name/co/codeql/package.nix

@@ -11,7 +11,7 @@
 
 stdenv.mkDerivation rec {
   pname = "codeql";
-  version = "2.20.6";
+  version = "2.20.7";
 
   dontConfigure = true;
   dontBuild = true;
@@ -19,7 +19,7 @@ stdenv.mkDerivation rec {
 
   src = fetchzip {
     url = "https://github.com/github/codeql-cli-binaries/releases/download/v${version}/codeql.zip";
-    hash = "sha256-f3CigPHi3z2Sd4CwsITPDPMqKEZimbjuIPByd4+oeK8=";
+    hash = "sha256-PYTKW+zfmOuJr5BClB3JQKeuZH986uct0m4WyDTxxnQ=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/co/coroot/package.nix

@@ -11,13 +11,13 @@
 
 buildGoModule rec {
   pname = "coroot";
-  version = "1.8.11";
+  version = "1.9.0";
 
   src = fetchFromGitHub {
     owner = "coroot";
     repo = "coroot";
     rev = "v${version}";
-    hash = "sha256-DUagBuGHght6kt63V+o1Rr51KN/yUK7qCfBgbqnAiAU=";
+    hash = "sha256-qhKpB1Gp2GPtWCjlkEjVAx9oB2y8FYfZIMMlnpJLduI=";
   };
 
   vendorHash = "sha256-wyxNT8g5TUCjlxauL7NmCf4HZ91V2nD64L1L/rYH864=";

pkgs/by-name/co/cozette/package.nix

@@ -6,13 +6,13 @@
 
 stdenvNoCC.mkDerivation rec {
   pname = "cozette";
-  version = "1.26.0";
+  version = "1.27.0";
 
   src = fetchzip {
     url = "https://github.com/slavfox/Cozette/releases/download/v.${version}/CozetteFonts-v-${
       builtins.replaceStrings [ "." ] [ "-" ] version
     }.zip";
-    hash = "sha256-FOgRz9amVmJSBYPa0HEwzXWsdcc53td9g3tY3sQbs9c=";
+    hash = "sha256-L/C1fohaLSVbrxAr4v3R83x1/Yt8fI3Lo+c84cZvEHY=";
   };
 
   installPhase = ''

pkgs/by-name/cr/cromite/package.nix

@@ -0,0 +1,266 @@
+{
+  fetchurl,
+  lib,
+  makeBinaryWrapper,
+  patchelf,
+  stdenv,
+  copyDesktopItems,
+  makeDesktopItem,
+
+  # Linked dynamic libraries.
+  alsa-lib,
+  at-spi2-atk,
+  at-spi2-core,
+  atk,
+  cairo,
+  cups,
+  dbus,
+  expat,
+  fontconfig,
+  freetype,
+  gcc-unwrapped,
+  gdk-pixbuf,
+  glib,
+  gtk3,
+  gtk4,
+  libdrm,
+  libglvnd,
+  libkrb5,
+  libX11,
+  libxcb,
+  libXcomposite,
+  libXcursor,
+  libXdamage,
+  libXext,
+  libXfixes,
+  libXi,
+  libxkbcommon,
+  libXrandr,
+  libXrender,
+  libXScrnSaver,
+  libxshmfence,
+  libXtst,
+  libgbm,
+  nspr,
+  nss,
+  pango,
+  pipewire,
+  vulkan-loader,
+  wayland, # ozone/wayland
+
+  # Command line programs
+  coreutils,
+
+  # command line arguments which are always set e.g "--disable-gpu"
+  commandLineArgs ? "",
+
+  # Will crash without.
+  systemd,
+
+  # Loaded at runtime.
+  libexif,
+  pciutils,
+
+  # Additional dependencies according to other distros.
+  ## Ubuntu
+  curl,
+  liberation_ttf,
+  util-linux,
+  wget,
+  xdg-utils,
+  ## Arch Linux.
+  flac,
+  harfbuzz,
+  icu,
+  libopus,
+  libpng,
+  snappy,
+  speechd-minimal,
+  ## Gentoo
+  bzip2,
+  libcap,
+
+  # Necessary for USB audio devices.
+  libpulseaudio,
+  pulseSupport ? true,
+
+  adwaita-icon-theme,
+  gsettings-desktop-schemas,
+
+  # For video acceleration via VA-API (--enable-features=VaapiVideoDecoder)
+  libva,
+  libvaSupport ? true,
+
+  # For Vulkan support (--enable-features=Vulkan)
+  addDriverRunpath,
+
+  # For QT support
+  qt6,
+}:
+
+let
+  opusWithCustomModes = libopus.override { withCustomModes = true; };
+
+  deps =
+    [
+      alsa-lib
+      at-spi2-atk
+      at-spi2-core
+      atk
+      bzip2
+      cairo
+      coreutils
+      cups
+      curl
+      dbus
+      expat
+      flac
+      fontconfig
+      freetype
+      gcc-unwrapped.lib
+      gdk-pixbuf
+      glib
+      harfbuzz
+      icu
+      libcap
+      libdrm
+      liberation_ttf
+      libexif
+      libglvnd
+      libkrb5
+      libpng
+      libX11
+      libxcb
+      libXcomposite
+      libXcursor
+      libXdamage
+      libXext
+      libXfixes
+      libXi
+      libxkbcommon
+      libXrandr
+      libXrender
+      libXScrnSaver
+      libxshmfence
+      libXtst
+      libgbm
+      nspr
+      nss
+      opusWithCustomModes
+      pango
+      pciutils
+      pipewire
+      snappy
+      speechd-minimal
+      systemd
+      util-linux
+      vulkan-loader
+      wayland
+      wget
+    ]
+    ++ lib.optionals pulseSupport [ libpulseaudio ]
+    ++ lib.optionals libvaSupport [ libva ]
+    ++ [
+      gtk3
+      gtk4
+      qt6.qtbase
+      qt6.qtwayland
+    ];
+  commit = "ee9852e97e8e1d0ec5edf1c1b35fd1f8b57f2929";
+in
+stdenv.mkDerivation (finalAttrs: {
+  pname = "cromite";
+  version = "134.0.6998.108";
+
+  src = fetchurl {
+    url = "https://github.com/uazo/cromite/releases/download/v${finalAttrs.version}-${commit}/chrome-lin64.tar.gz";
+    hash = "sha256-P1dLdpFYQlnJYT2o02PietgL2VW0cTGqYLtbkBJyPl0=";
+  };
+
+  # With strictDeps on, some shebangs were not being patched correctly
+  # ie, $out/share/cromite/chrome
+  strictDeps = false;
+
+  nativeBuildInputs = [
+    makeBinaryWrapper
+    patchelf
+    copyDesktopItems
+  ];
+
+  buildInputs = [
+    # needed for XDG_ICON_DIRS
+    adwaita-icon-theme
+    glib
+    gtk3
+    gtk4
+    # needed for GSETTINGS_SCHEMAS_PATH
+    gsettings-desktop-schemas
+  ];
+
+  rpath = lib.makeLibraryPath deps + ":" + lib.makeSearchPathOutput "lib" "lib64" deps;
+
+  binpath = lib.makeBinPath deps;
+
+  desktopItems = [
+    (makeDesktopItem {
+      name = "cromite";
+      exec = "cromite %U";
+      icon = "cromite";
+      genericName = "Cromite";
+      desktopName = "Cromite";
+      categories = [
+        "Application"
+        "Network"
+        "WebBrowser"
+      ];
+    })
+  ];
+
+  installPhase = ''
+    runHook preInstall
+
+    install -Dm644 product_logo_48.png $out/share/pixmaps/cromite.png
+    cp -v -a . $out/share/cromite
+    # replace bundled vulkan-loader
+    rm -v $out/share/cromite/libvulkan.so.1
+    ln -v -s -t "$out/share/cromite" "${lib.getLib vulkan-loader}/lib/libvulkan.so.1"
+    # "--simulate-outdated-no-au" disables auto updates and browser outdated popup
+    mkdir $out/bin
+    makeWrapper $out/share/cromite/chrome $out/bin/cromite \
+      --prefix QT_PLUGIN_PATH  : "${qt6.qtbase}/lib/qt-6/plugins" \
+      --prefix QT_PLUGIN_PATH  : "${qt6.qtwayland}/lib/qt-6/plugins" \
+      --prefix NIXPKGS_QT6_QML_IMPORT_PATH : "${qt6.qtwayland}/lib/qt-6/qml" \
+      --prefix LD_LIBRARY_PATH : "$rpath" \
+      --prefix PATH            : "$binpath" \
+      --suffix PATH            : "${lib.makeBinPath [ xdg-utils ]}" \
+      --prefix XDG_DATA_DIRS   : "$XDG_ICON_DIRS:$GSETTINGS_SCHEMAS_PATH:${addDriverRunpath.driverLink}/share" \
+      --set CHROME_WRAPPER  "cromite" \
+      --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--ozone-platform-hint=auto --enable-features=WaylandWindowDecorations --enable-wayland-ime=true}}" \
+      --add-flags "--simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT'" \
+      --add-flags ${lib.escapeShellArg commandLineArgs}
+
+    # Make sure that libGL and libvulkan are found by ANGLE libGLESv2.so
+    patchelf --set-rpath $rpath $out/share/cromite/lib*GL*
+
+    for elf in $out/share/cromite/{chrome,chrome_sandbox,chrome_crashpad_handler}; do
+      patchelf --set-rpath $rpath $elf
+      patchelf --set-interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" $elf
+    done
+
+    runHook postInstall
+  '';
+
+  meta = {
+    changelog = "https://github.com/uazo/cromite/releases";
+    description = "Bromite fork with ad blocking and privacy enhancements";
+    homepage = "https://github.com/uazo/cromite";
+    license = with lib.licenses; [
+      bsd3
+      gpl3Plus
+    ];
+    maintainers = with lib.maintainers; [ emaryn ];
+    mainProgram = "cromite";
+    platforms = [ "x86_64-linux" ];
+    sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
+  };
+})

pkgs/by-name/cr/crowdsec/package.nix

@@ -7,16 +7,16 @@
 
 buildGoModule rec {
   pname = "crowdsec";
-  version = "1.6.5";
+  version = "1.6.6";
 
   src = fetchFromGitHub {
     owner = "crowdsecurity";
     repo = pname;
     tag = "v${version}";
-    hash = "sha256-Jt5qFY41TnkvDw2BPd+vfyskhLpnJnsiUmUJcADQ0so=";
+    hash = "sha256-yregZUHdwfg/MJ9ndeHzpo4md9Qq+BAF0gHGC80+Mp0=";
   };
 
-  vendorHash = "sha256-I9h63iePhEMCy8IQNTomhgduGOyC3aoxz/0L4JQhhF8=";
+  vendorHash = "sha256-XTKOApMagrcHlgdGascIJzRZxjd+IBVhEyF+FiszOkQ=";
 
   nativeBuildInputs = [ installShellFiles ];
 

pkgs/by-name/dd/ddrescue/package.nix

@@ -7,11 +7,11 @@
 
 stdenv.mkDerivation rec {
   pname = "ddrescue";
-  version = "1.29";
+  version = "1.29.1";
 
   src = fetchurl {
     url = "mirror://gnu/ddrescue/ddrescue-${version}.tar.lz";
-    sha256 = "sha256-AaQUMnhTs5+6L9Ds4w977i6djI6OsxQxhSSt9aYAOaM=";
+    sha256 = "sha256-3dfUXfAmgHg1ouxqucNl3y7xno3hpQ/+aIbNOR4E3XU=";
   };
 
   nativeBuildInputs = [ lzip ];

pkgs/by-name/de/decker/package.nix

@@ -9,13 +9,13 @@
 
 stdenv.mkDerivation rec {
   pname = "decker";
-  version = "1.53";
+  version = "1.54";
 
   src = fetchFromGitHub {
     owner = "JohnEarnest";
     repo = "Decker";
     rev = "v${version}";
-    hash = "sha256-TsEGErzekSmAEJLKao74FxdfMq3yTuFrru6HncEvQ38=";
+    hash = "sha256-6rKfIMEWMig1LAaLk1eSUHnc2104FuN5wTVpf1SgCtg=";
   };
 
   buildInputs = [

pkgs/by-name/de/denemo/package.nix

@@ -1,8 +1,7 @@
 {
   lib,
   stdenv,
-  fetchurl,
-  fetchpatch,
+  fetchgit,
   pkg-config,
   libjack2,
   gettext,
@@ -29,26 +28,14 @@
 
 stdenv.mkDerivation rec {
   pname = "denemo";
-  version = "2.6.0";
+  version = "2.6.43";
 
-  src = fetchurl {
-    url = "https://ftp.gnu.org/gnu/denemo/denemo-${version}.tar.gz";
-    sha256 = "sha256-S+WXDGmEf5fx+HYnXJdE5QNOfJg7EqEEX7IMI2SUtV0=";
+  src = fetchgit {
+    url = "https://git.savannah.gnu.org/git/denemo.git";
+    rev = "b04ead1d3efeee036357cf36898b838a96ec5332";
+    hash = "sha256-XMFbPk70JqUHWBPEK8rjr70iMs49RNyaaCUGnYlLf2E=";
   };
 
-  patches = [
-    (fetchpatch {
-      name = "allow-guile-3.patch";
-      url = "https://git.savannah.gnu.org/cgit/denemo.git/patch/?id=9de1c65e56a021925af532bb55336b0ce86d3084";
-      postFetch = ''
-        substituteInPlace $out \
-          --replace "2.6.8" "2.6.0" \
-          --replace "2.6.9" "2.6.0"
-      '';
-      hash = "sha256-Jj33k/KgvZgKG43MuLgjb4A2KNkm/z9ytzGKcXMAOI4=";
-    })
-  ];
-
   buildInputs = [
     libjack2
     guile
@@ -68,6 +55,9 @@ stdenv.mkDerivation rec {
     portmidi
   ];
 
+  # error by default in GCC 14
+  NIX_CFLAGS_COMPILE = "-Wno-error=incompatible-pointer-types";
+
   preFixup = ''
     gappsWrapperArgs+=(
       --prefix PATH : "${lilypond}/bin"
@@ -89,8 +79,5 @@ stdenv.mkDerivation rec {
     license = lib.licenses.gpl3;
     platforms = lib.platforms.linux;
     maintainers = [ lib.maintainers.olynch ];
-    # sffile.c:38:10: error: implicit declaration of function 'isprint' [-Wimplicit-function-declaration]
-    # sffile.c:54:10: error: type defaults to 'int' in declaration of 'initialized' [-Wimplicit-int]
-    broken = true;
   };
 }

pkgs/by-name/do/doublecmd/package.nix

@@ -14,13 +14,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "doublecmd";
-  version = "1.1.22";
+  version = "1.1.23";
 
   src = fetchFromGitHub {
     owner = "doublecmd";
     repo = "doublecmd";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-PyAmGYWA7QZcD7SN2utHacwqm8PQy8VxuVxAXlR7tj4=";
+    hash = "sha256-nvLVJAB751dY28jG1WjguuEVkCUb4Iy7V8cJjw3y8GI=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/dv/dvd-slideshow/package.nix

@@ -10,7 +10,6 @@
   lame,
   mjpegtools,
   sox,
-  transcode,
   vorbis-tools,
   runtimeShell,
 }:
@@ -24,7 +23,6 @@ let
     lame
     mjpegtools
     sox
-    transcode
     vorbis-tools
   ];
 

pkgs/by-name/ec/ecapture/package.nix

@@ -22,13 +22,13 @@
 
 buildGoModule rec {
   pname = "ecapture";
-  version = "0.9.5";
+  version = "1.0.0";
 
   src = fetchFromGitHub {
     owner = "gojue";
     repo = "ecapture";
     tag = "v${version}";
-    hash = "sha256-aubGM7kJMtfCRBeFgISuyXS9CkDwBC9hB3d6VA9mG2E=";
+    hash = "sha256-z2cl3yUNUQhLT9bPWApABUIRNdbYqG/7QDwRTvCWvjY=";
     fetchSubmodules = true;
   };
 
@@ -113,7 +113,7 @@ buildGoModule rec {
     in
     [ "-skip=^${builtins.concatStringsSep "$|^" skippedTests}$" ];
 
-  vendorHash = "sha256-8ilfqPt5Phuj5Uaf90+Ir/DFN27oW5Fd+Wsp34/EU9M=";
+  vendorHash = "sha256-3ry4eLe6W9YFFH7TdQm87CPvj8X/63XNC48A6EXqoDs=";
 
   passthru.updateScript = nix-update-script { };
 

pkgs/by-name/ec/ecs-agent/package.nix

@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "amazon-ecs-agent";
-  version = "1.91.0";
+  version = "1.91.1";
 
   src = fetchFromGitHub {
     rev = "v${version}";
     owner = "aws";
     repo = pname;
-    hash = "sha256-JRrDxJzbV1a3Ppo4fw9bREjJMRcV2Yj1gxflkE5WJfU=";
+    hash = "sha256-BIfyuZ7bf1P/8JfavIJNi06k8zEcCL1jwxAEnknpqq4=";
   };
 
   vendorHash = null;

pkgs/by-name/ei/eigenmath/package.nix

@@ -8,13 +8,13 @@
 
 stdenv.mkDerivation rec {
   pname = "eigenmath";
-  version = "337-unstable-2025-03-16";
+  version = "338-unstable-2025-03-27";
 
   src = fetchFromGitHub {
     owner = "georgeweigt";
     repo = pname;
-    rev = "622740aa22d11d08016d0ac962aa920f5e38f223";
-    hash = "sha256-sFiCYvp+SC8CnkMfoUXpAPFySd5nxiqLRVGiWsZ4FcY=";
+    rev = "2e4f6f099e7a9984e3d34430f63bc0606f364dd9";
+    hash = "sha256-Bp7+0ykgUqELF3KE678pkGneZCDcIfqlZo2g12Nb+Qc=";
   };
 
   checkPhase =

pkgs/by-name/el/elasticsearch-curator/package.nix

@@ -9,14 +9,14 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "elasticsearch-curator";
-  version = "8.0.18";
+  version = "8.0.20";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "elastic";
     repo = "curator";
     tag = "v${version}";
-    hash = "sha256-J0RHCWr0l1Vm/rcmcH3w0E0U+S9AvM0XMO89rnG38mY=";
+    hash = "sha256-oeQ36CvR/v0Mvo+aGL+dYHTgEsq9TesZoBMdoePmgnI=";
   };
 
   pythonRelaxDeps = [ "es-client" ];

pkgs/by-name/en/enzyme/package.nix

@@ -7,13 +7,13 @@
 }:
 llvmPackages.stdenv.mkDerivation rec {
   pname = "enzyme";
-  version = "0.0.172";
+  version = "0.0.173";
 
   src = fetchFromGitHub {
     owner = "EnzymeAD";
     repo = "Enzyme";
     rev = "v${version}";
-    hash = "sha256-/FxjXCML7hBNYOVf1PLG+VwCdaNGYwwirRJSQxIvLcg=";
+    hash = "sha256-Yyn0yWcOWb379rzaA+KW0KiLVg0nbIwJJQ8NhQAsuN8=";
   };
 
   postPatch = ''

pkgs/by-name/ex/exploitdb/package.nix

@@ -7,13 +7,13 @@
 
 stdenv.mkDerivation rec {
   pname = "exploitdb";
-  version = "2025-03-27";
+  version = "2025-03-29";
 
   src = fetchFromGitLab {
     owner = "exploit-database";
     repo = "exploitdb";
     rev = "refs/tags/${version}";
-    hash = "sha256-az5BZEWiDknvf0p1/5cbr9sDOVv2SDsXhdzlqtBYaO0=";
+    hash = "sha256-JSaOwl2JggWLAywxNTIpGB2KCp3qhepIeRjK5KWPX2I=";
   };
 
   nativeBuildInputs = [ makeWrapper ];

pkgs/by-name/ex/exportarr/package.nix

@@ -7,16 +7,16 @@
 
 buildGoModule rec {
   pname = "exportarr";
-  version = "2.0.1";
+  version = "2.1.0";
 
   src = fetchFromGitHub {
     owner = "onedr0p";
     repo = "exportarr";
     rev = "v${version}";
-    hash = "sha256-A6G1b9hTGp35ZHsDaMAZdH0LkkEyXCWoV6e5Bo3UqI4=";
+    hash = "sha256-iNcdD2zigBZ2phtCkHRV0GZPrEjopV0K+vin1Zkb3Oo=";
   };
 
-  vendorHash = "sha256-8MrS/BMSjyWbBM8jVQYDsvLLaolgbP22Vp2PRX33Kfw=";
+  vendorHash = "sha256-F5WOSsjeOzMaj4Yze11OnqpgL1l87wpgl3OQEGya//M=";
 
   subPackages = [ "cmd/exportarr" ];
 

pkgs/by-name/fi/filesender/package.nix

@@ -6,13 +6,13 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "filesender";
-  version = "2.53";
+  version = "2.54";
 
   src = fetchFromGitHub {
     owner = "filesender";
     repo = "filesender";
     tag = "filesender-${finalAttrs.version}";
-    hash = "sha256-a9hA1aHuuSbFHggeKlh374/rEVszDdRToKLSiuVb66Q=";
+    hash = "sha256-FmTjnOlst3KfKTHKw2KqkLNhK0IhfYVAbVv7tMSg6e8=";
   };
 
   patches = [

pkgs/by-name/fi/fire/package.nix

@@ -17,14 +17,14 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "fire";
-  version = "1.0.1-unstable-2024-10-22";
+  version = "1.0.1-unstable-2025-03-12";
 
   src = fetchFromGitHub {
     owner = "jerryuhoo";
     repo = "Fire";
-    rev = "4c3275caa0dbd9e65c6c3d574cc5ac1c828e529a";
+    rev = "b7ded116ce7ab78a57bb9b6b61796cb2cf3a6e8b";
     fetchSubmodules = true;
-    hash = "sha256-DyYP/uDawa+m2FtNvEvu36iRl6zfMyGNMMad5f/rX4k=";
+    hash = "sha256-d8w+b4OpU2/kQdcAimR4ihDEgVTM1V7J0hj7saDrQpY=";
   };
 
   postPatch =

pkgs/by-name/fl/flashmq/package.nix

@@ -9,13 +9,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "flashmq";
-  version = "1.21.0";
+  version = "1.21.1";
 
   src = fetchFromGitHub {
     owner = "halfgaar";
     repo = "FlashMQ";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-/nSNWmSR16V1+nXOMIx+TtxtNS9Xk3BJSY4ps+6TwG8=";
+    hash = "sha256-ccTarrInS9Af9fT43dgRTuHVuHbWlYzDAEh31myHUvY=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/fl/fluidd/package.nix

@@ -8,13 +8,13 @@
 
 buildNpmPackage rec {
   pname = "fluidd";
-  version = "1.32.4";
+  version = "1.33.0";
 
   src = fetchFromGitHub {
     owner = "fluidd-core";
     repo = "fluidd";
     tag = "v${version}";
-    hash = "sha256-5siU1BunQ1tcF8pg0trKkynJXmLdCS1rFo7J0WX8V30=";
+    hash = "sha256-z1qb3n+BlvQhw6fKvfZ6s/uSdWbXAJ8xqvQRdLPnD+M=";
   };
 
   patches = [
@@ -23,7 +23,7 @@ buildNpmPackage rec {
     })
   ];
 
-  npmDepsHash = "sha256-+MfqmMZ2fiijr4X2S2TQfo25mVGpnZtZYOxCfPH4gFY=";
+  npmDepsHash = "sha256-RpnZLJzxMmwo/XsXOWshw8xCpXG6GuhsaTb4rnXt/D0=";
 
   installPhase = ''
     mkdir -p $out/share/fluidd

pkgs/by-name/fl/flutter_rust_bridge_codegen/package.nix

@@ -6,18 +6,18 @@
 }:
 rustPlatform.buildRustPackage rec {
   pname = "flutter_rust_bridge_codegen";
-  version = "2.8.0";
+  version = "2.9.0";
 
   src = fetchFromGitHub {
     owner = "fzyzcjy";
     repo = "flutter_rust_bridge";
     rev = "v${version}";
-    hash = "sha256-amjfreJq/GC/Xou39i2IIIGI1ukpiWRx3bddxVQB6dk=";
+    hash = "sha256-pvKCiv7hUgetTXXp+NCs04Qo9xWaLUE2T1yHENhTGl4=";
     fetchSubmodules = true;
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-zRiyLFDRqhi6TUt/UfWvgJ2hqWdUz8jxUCvN5RDp1Bk=";
+  cargoHash = "sha256-efMA8VJaQlqClAmjJ3zIYLUfnuj62vEIBKsz0l3CWxA=";
   cargoBuildFlags = "--package flutter_rust_bridge_codegen";
   cargoTestFlags = "--package flutter_rust_bridge_codegen";
 

pkgs/by-name/fr/freetube/package.nix

@@ -20,13 +20,13 @@ let
 in
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "freetube";
-  version = "0.23.2";
+  version = "0.23.3";
 
   src = fetchFromGitHub {
     owner = "FreeTubeApp";
     repo = "FreeTube";
     tag = "v${finalAttrs.version}-beta";
-    hash = "sha256-P0ENx8PDWbqfiBEsWv11R3Q/FE+rAFhhk49VyQgXIz4=";
+    hash = "sha256-EpcYNUtGbEFvetroo1zAyfKxW70vD1Lk0aJKWcaV39I=";
   };
 
   # Darwin requires writable Electron dist
@@ -49,7 +49,7 @@ stdenvNoCC.mkDerivation (finalAttrs: {
 
   yarnOfflineCache = fetchYarnDeps {
     yarnLock = "${finalAttrs.src}/yarn.lock";
-    hash = "sha256-U6H4TMKR+khs5fQtMtIBnHpAzJvHcvMeSD1XUqaov/M=";
+    hash = "sha256-xiJGzvmfrvvB6/rdwALOxhWSWAZ31cbySYygtG8+QpQ=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/fr/frr/package.nix

@@ -82,23 +82,15 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "frr";
-  version = "10.2.1";
+  version = "10.3";
 
   src = fetchFromGitHub {
     owner = "FRRouting";
     repo = "frr";
     rev = "frr-${finalAttrs.version}";
-    hash = "sha256-TWqW6kI5dDl6IW2Ql6eeySDSyxp0fPgcJOOX1JxjAxs=";
+    hash = "sha256-o/BG12FVypIaInXDeOj2Ymdgv1mxof9Sl0ZQA8o3YLs=";
   };
 
-  patches = [
-    (fetchpatch {
-      name = "CVE-2024-44070.patch";
-      url = "https://github.com/FRRouting/frr/commit/fea4ed5043b4a523921f970a39a565d2c1ca381f.patch";
-      hash = "sha256-X9FjQeOvo92+mL1z3u5W0LBhhePDAyhFAqh8sAtNNm8=";
-    })
-  ];
-
   # Without the std explicitly set, we may run into abseil-cpp
   # compilation errors.
   CXXFLAGS = "-std=gnu++23";

pkgs/by-name/ga/gallery-dl/package.nix

@@ -8,7 +8,7 @@
 
 let
   pname = "gallery-dl";
-  version = "1.29.2";
+  version = "1.29.3";
 in
 python3Packages.buildPythonApplication {
   inherit pname version;
@@ -18,7 +18,7 @@ python3Packages.buildPythonApplication {
     owner = "mikf";
     repo = "gallery-dl";
     tag = "v${version}";
-    hash = "sha256-vr+qvztNtFMnDzi0GGX10eZCj5EqXj03OnIXudvrumU=";
+    hash = "sha256-LzMiJxMl6IWtUloWxBAMLvkhnTQpHkz/gjWl5gW2sZ0=";
   };
 
   build-system = [ python3Packages.setuptools ];

pkgs/by-name/gc/gcfflasher/package.nix

@@ -2,6 +2,7 @@
   lib,
   stdenv,
   fetchFromGitHub,
+  fetchpatch,
   pkg-config,
   libgpiod,
   cmake,
@@ -9,15 +10,22 @@
 
 stdenv.mkDerivation rec {
   pname = "gcfflasher";
-  version = "4.6.0";
+  version = "4.8.0";
 
   src = fetchFromGitHub {
     owner = "dresden-elektronik";
     repo = "gcfflasher";
     tag = "v${version}";
-    hash = "sha256-z7FsxTAsAmjz76NxbqZuecN1ywAZYHhgcPfOe6y5QNQ=";
+    hash = "sha256-W1sL3RyauEYAC/Fj0JhNnk0k5DT6Q8qIEuZNke3xNAE=";
   };
 
+  patches = [
+    (fetchpatch {
+      url = "https://github.com/dresden-elektronik/gcfflasher/commit/c1019d7ef2ab55a598ddd938db1b08169b05fc37.patch";
+      hash = "sha256-Frd3Xerkv3QolGCOrTE4AqBPqPHTKjjhk+DzhHABTqo=";
+    })
+  ];
+
   nativeBuildInputs = [
     pkg-config
     cmake

pkgs/by-name/gi/gir-rs/package.nix

@@ -5,7 +5,7 @@
 }:
 
 let
-  version = "0.17.1";
+  version = "0.19.0";
 in
 rustPlatform.buildRustPackage {
   pname = "gir";
@@ -15,11 +15,11 @@ rustPlatform.buildRustPackage {
     owner = "gtk-rs";
     repo = "gir";
     rev = version;
-    sha256 = "sha256-WpTyT62bykq/uwzBFQXeJ1HxR1a2vKmtid8YAzk7J+Q=";
+    sha256 = "sha256-GAAK4ej16e5/sjnPOVWs4ul1H9sqa+tDE8ky9tbB9No=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-bytICp0+1/suM+kf4VX9z/mpnsdXi3I3dPUlK3A9+V4=";
+  cargoHash = "sha256-ObEXOaEdwJpaLJDkcSmAK86P7E6y0eUQQHFpX4hsuog=";
 
   postPatch = ''
     rm build.rs

pkgs/by-name/gi/git-gamble/package.nix

@@ -9,13 +9,13 @@
 }:
 
 let
-  version = "2.9.0";
+  version = "2.10.0";
 
   src = fetchFromGitLab {
     owner = "pinage404";
     repo = "git-gamble";
     rev = "version/${version}";
-    hash = "sha256-hMP5mBKXcO+Ws04G3OxdYuB5JoaSjlYtlkerRQ6+bXw=";
+    hash = "sha256-oWbV3KhDcb/LlDkaGqkrYU/b2LEijUTX0RaHi0yS5cw=";
   };
 in
 rustPlatform.buildRustPackage {
@@ -23,12 +23,16 @@ rustPlatform.buildRustPackage {
   inherit version src;
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-t58vf/xhJi5HV9lBWvXzKMZ8I2stjTAmCOrdLWPerGI=";
+  cargoHash = "sha256-v8sQuFmHHWuLUhRND1CzI5VkybgHRETVyNNabw1Uhyg=";
 
   nativeCheckInputs = [ gitMinimal ];
   preCheck = ''
     patchShebangs tests/editor/fake_editor.sh
   '';
+  checkFlags = [
+    # this test can be flaky ; help is needed to stabilize it in upstream
+    "--skip=git_time_keeper::white_box::lock_file::create_as_many_as_lock_files_when_starting_several_times"
+  ];
 
   nativeBuildInputs = [
     installShellFiles

pkgs/by-name/gi/gitea/package.nix

@@ -35,18 +35,18 @@ let
 in
 buildGoModule rec {
   pname = "gitea";
-  version = "1.23.5";
+  version = "1.23.6";
 
   src = fetchFromGitHub {
     owner = "go-gitea";
     repo = "gitea";
     tag = "v${gitea.version}";
-    hash = "sha256-SWLkrZTZXXy7x3kszagR0hjrmLhtYvGRf05YU5Mtbl4=";
+    hash = "sha256-psVny0qmx2wPiNK1qIXQiW0gdRsZs16MEfIgBXTWgFI=";
   };
 
   proxyVendor = true;
 
-  vendorHash = "sha256-Iiw302HDGf6ECw2cGqwZCwAqQ21eQVaEab/cuhD1dJ4=";
+  vendorHash = "sha256-h9RnHv4weGfHwpmuEhQbsYDd5fKc439m0gF/BgDVIdA=";
 
   outputs = [
     "out"

pkgs/by-name/go/goimports-reviser/package.nix

@@ -5,15 +5,15 @@
 
 buildGoModule rec {
   pname = "goimports-reviser";
-  version = "3.8.2";
+  version = "3.9.1";
 
   src = fetchFromGitHub {
     owner = "incu6us";
     repo = "goimports-reviser";
     rev = "v${version}";
-    hash = "sha256-73EU2LaOq5AfMssYJShhQLbZjrK4qbERn9SRomMMsHA=";
+    hash = "sha256-MMF5gzUbL8j9NTGKT1Xz177Z0SqdeKObBa6TEguK5aI=";
   };
-  vendorHash = "sha256-z+FeAXPXKi653im2X2WOP1R9gRl/x7UBnndoEXoxdwA=";
+  vendorHash = "sha256-BAV7vMWRgBZaL2Pya4QiVcY54VIiHT++Dz4ZZ92FGgM=";
 
   env.CGO_ENABLED = 0;
 

pkgs/by-name/gr/greenmask/package.nix

@@ -7,13 +7,13 @@
 
 buildGoModule rec {
   pname = "greenmask";
-  version = "0.2.8";
+  version = "0.2.9";
 
   src = fetchFromGitHub {
     owner = "GreenmaskIO";
     repo = "greenmask";
     tag = "v${version}";
-    hash = "sha256-Upgf/VmWHtvldIx3n6e3NTHDzs7XoZUBVcEVC+ix9cQ=";
+    hash = "sha256-ORyczdynAAr2hYzXove/IXRngkRIhKgXLQg5VbvvGS8=";
   };
 
   vendorHash = "sha256-UY79Fex8hwaXtFLefBUeyO7PxJevWWaQU5MEOAMLPkA=";

pkgs/by-name/ha/hashrat/package.nix

@@ -8,13 +8,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "hashrat";
-  version = "1.23";
+  version = "1.25";
 
   src = fetchFromGitHub {
     owner = "ColumPaget";
     repo = "Hashrat";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-dDtn01eoODgRtsbEdtuXhib3fZLosP8ajJBGaG8Skss=";
+    hash = "sha256-nGaOVvy8caySohCGyGdnxXsv2DuqFPRi4JJLlZy+q8o=";
   };
 
   configureFlags = [ "--enable-xattr" ];

pkgs/by-name/ht/htgettoken/package.nix

@@ -7,13 +7,13 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "htgettoken";
-  version = "2.1";
+  version = "2.2";
 
   src = fetchFromGitHub {
     owner = "fermitools";
     repo = pname;
     tag = "v${version}";
-    hash = "sha256-cp/Y4l59MscQIrHjVdMUQEqgFZTPTEfVdRoH/pOG5uQ=";
+    hash = "sha256-O0OHnYaoTkqUqD4s+wEAzN3Paq9qsjBZdZ0QUXdFefE=";
   };
 
   nativeBuildInputs = with python3.pkgs; [

pkgs/by-name/hw/hwatch/package.nix

@@ -2,17 +2,17 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "hwatch";
-  version = "0.3.18";
+  version = "0.3.19";
 
   src = fetchFromGitHub {
     owner = "blacknon";
     repo = "hwatch";
     tag = version;
-    sha256 = "sha256-E1IxeraZTHY+FDnOhyjygFyqOIwVEvnKuPuuNZvvL7o=";
+    sha256 = "sha256-lMsBzMDMgpHxcQFtfZ4K7r2WRUaVR8Ry/kPvwfzPObI=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-gM9KLf2kEY48M8nQrSdBoqdU9ssQj4sH/hma3/+3JTw=";
+  cargoHash = "sha256-UnaZZEmX5XoTVFLEFj5JkJXJkjoUBwzJokfffJTPP4M=";
 
   nativeBuildInputs = [ installShellFiles ];
 

pkgs/by-name/in/infrastructure-agent/package.nix

@@ -6,13 +6,13 @@
 }:
 buildGoModule rec {
   pname = "infrastructure-agent";
-  version = "1.62.0";
+  version = "1.63.0";
 
   src = fetchFromGitHub {
     owner = "newrelic";
     repo = "infrastructure-agent";
     rev = version;
-    hash = "sha256-qwbYDPj47Tya1De+4hawgkz+StZ5seR+UNPc2vhl+pk=";
+    hash = "sha256-odB40XRZyFuHX82RzxIvW3SAwglOyYRiApWUfRhOEmk=";
   };
 
   vendorHash = "sha256-Oxhraf5xsnowNWZznB6JE+nCnGc3D5dOi/EWIvyv81M=";