Merge 3e78aad351 into haskell-updates

.editorconfig

@@ -107,6 +107,11 @@ trim_trailing_whitespace = unset
 [pkgs/tools/misc/timidity/timidity.cfg]
 trim_trailing_whitespace = unset
 
+[pkgs/tools/security/qdigidoc/vendor/*]
+end_of_line = unset
+insert_final_newline = unset
+trim_trailing_whitespace = unset
+
 [pkgs/tools/virtualization/ovftool/*.ova]
 end_of_line = unset
 insert_final_newline = unset

.github/workflows/keep-sorted.yml

@@ -33,8 +33,8 @@ jobs:
           nix_path: nixpkgs=${{ env.url }}
 
       - name: Install keep-sorted
-        run: "nix-env -f '<nixpkgs>' -iAP keep-sorted"
+        run: "nix-env -f '<nixpkgs>' -iAP keep-sorted jq"
 
       - name: Check that Nix files are sorted
         run: |
-          git ls-files | xargs keep-sorted --mode lint
+          git ls-files | xargs keep-sorted --mode lint | jq --raw-output '.[] | "Please make sure any new entries in \(.path) are sorted alphabetically."'

maintainers/maintainer-list.nix

@@ -10302,6 +10302,12 @@
     githubId = 26341736;
     name = "Vishal Das";
   };
+  imsuck = {
+    email = "imsuck12@gmail.com";
+    github = "imsuck";
+    githubId = 49095435;
+    name = "imsuck";
+  };
   imuli = {
     email = "i@imu.li";
     github = "imuli";

nixos/doc/manual/release-notes/rl-2505.section.md

@@ -26,7 +26,7 @@
   NEWS can been viewed from Emacs by typing `C-h n`, or by clicking `Help->Emacs News` from the menu bar.
   It can also be browsed [online](https://git.savannah.gnu.org/cgit/emacs.git/tree/etc/NEWS?h=emacs-30).
 
-- The default PHP version has been updated to 8.3.
+- The default PHP version has been updated to 8.4.
 
 - The default Erlang OTP version has been updated to 27.
 
@@ -448,6 +448,10 @@
   For those unable to upgrade yet, there is a [v0 compatibility mode](https://www.openpolicyagent.org/docs/v1.0.1/v0-compatibility/)
   available too.
 
+- Wordpress with the Caddy webserver (`services.wordpress.webserver = "caddy"`) now sets up sites with Caddy's automatic HTTPS instead of HTTP-only.
+  Given a site example.com, http://example.com now 301 redirects to https://example.com.
+  To keep the old behavior for a site `example.com`, set `services.caddy.virtualHosts."example.com".hostName = "http://example.com"`.
+
 - `vscode-utils.buildVscodeExtension` now requires pname as an argument
 
 - The behavior of `services.hostapd.radios.<name>.networks.<name>.authentication.enableRecommendedPairwiseCiphers` was changed to not include `CCMP-256` anymore.

nixos/modules/module-list.nix

@@ -1783,6 +1783,7 @@
   ./tasks/filesystems.nix
   ./tasks/filesystems/apfs.nix
   ./tasks/filesystems/bcachefs.nix
+  ./tasks/filesystems/bindfs.nix
   ./tasks/filesystems/btrfs.nix
   ./tasks/filesystems/cifs.nix
   ./tasks/filesystems/ecryptfs.nix

nixos/modules/programs/wayland/wayland-session.nix

@@ -14,12 +14,12 @@
 
   programs = {
     dconf.enable = lib.mkDefault true;
-    xwayland.enable = lib.mkDefault enableXWayland;
+    xwayland.enable = lib.mkIf enableXWayland (lib.mkDefault true);
   };
 
   services.graphical-desktop.enable = true;
 
-  xdg.portal.wlr.enable = enableWlrPortal;
+  xdg.portal.wlr.enable = lib.mkIf enableWlrPortal true;
   xdg.portal.extraPortals = lib.mkIf enableGtkPortal [
     pkgs.xdg-desktop-portal-gtk
   ];

nixos/modules/services/monitoring/prometheus/exporters.nix

@@ -29,6 +29,7 @@ let
     "blackbox"
     "borgmatic"
     "buildkite-agent"
+    "chrony"
     "collectd"
     "deluge"
     "dmarc"

nixos/modules/services/monitoring/prometheus/exporters/chrony.nix

@@ -0,0 +1,97 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+let
+  cfg = config.services.prometheus.exporters.chrony;
+  inherit (lib)
+    mkOption
+    types
+    concatStringsSep
+    concatMapStringsSep
+    ;
+in
+{
+  port = 9123;
+  extraOpts = {
+    chronyServerAddress = mkOption {
+      type = types.str;
+      default = "unix:///run/chrony/chronyd.sock";
+      example = [ "192.82.0.1:323" ];
+      description = ''
+        ChronyServerAddress of the chrony server side command port. (Not enabled by default.)
+        Defaults to the local unix socket.
+      '';
+    };
+    user = mkOption {
+      type = types.str;
+      default = "chrony";
+      description = ''
+        User name under which the chrony exporter shall be run.
+        This allows the exporter to talk to chrony using a unix socket, which is owned by chrony.
+        The exporter startup with the default user chrony will fail without local chrony instance.
+      '';
+    };
+    group = mkOption {
+      type = types.str;
+      default = "chrony";
+      description = ''
+        Group under which the chrony exporter shall be run.
+        This allows the exporter to talk to chrony using a unix socket, which is owned by chrony group.
+        The service startup with the default group chrony will fail without local chrony instance.
+      '';
+    };
+    enabledCollectors = mkOption {
+      type = types.listOf types.str;
+      default = [
+        "tracking"
+        "sources"
+        "sources.with-ntpdata"
+        "serverstats"
+        "dns-lookups"
+      ];
+      example = [ "dns-lookups" ];
+      description = ''
+        Collectors to enable.
+        Currently all collectors are enabled by default.
+      '';
+    };
+    disabledCollectors = mkOption {
+      type = types.listOf types.str;
+      default = [ ];
+      example = [ "sources.with-ntpdata" ];
+      description = ''
+        Collectors to disable which are enabled by default.
+        Disable sources.with-ntpdata for network scraper. Option requires unix socket.
+      '';
+    };
+  };
+  serviceOpts = {
+    serviceConfig = {
+      AmbientCapabilities = [ "CAP_NET_BIND_SERVICE" ];
+      CapabilityBoundingSet = [ "CAP_NET_BIND_SERVICE" ];
+      MemoryDenyWriteExecute = true;
+      NoNewPrivileges = true;
+      ProtectClock = true;
+      ProtectSystem = "strict";
+      Restart = "on-failure";
+      RestrictAddressFamilies = [
+        "AF_INET"
+        "AF_INET6"
+        "AF_UNIX"
+      ];
+      RestrictNamespaces = true;
+      RestrictRealtime = true;
+      ExecStart = ''
+        ${lib.getExe pkgs.prometheus-chrony-exporter} \
+          ${concatMapStringsSep " " (x: "--collector." + x) cfg.enabledCollectors} \
+          ${concatMapStringsSep " " (x: "--no-collector." + x) cfg.disabledCollectors} \
+          --chrony.address ${cfg.chronyServerAddress} \
+          --web.listen-address ${cfg.listenAddress}:${toString cfg.port} \
+          ${concatStringsSep " " cfg.extraFlags}
+      '';
+    };
+  };
+}

nixos/modules/services/web-apps/selfoss.nix

@@ -158,7 +158,7 @@ in
 
     systemd.services.selfoss-update = {
       serviceConfig = {
-        ExecStart = "${pkgs.php}/bin/php ${dataDir}/cliupdate.php";
+        ExecStart = "${pkgs.php83}/bin/php ${dataDir}/cliupdate.php";
         User = "${cfg.user}";
       };
       startAt = "hourly";

nixos/modules/services/web-apps/wordpress.nix

@@ -545,7 +545,7 @@ in
     services.caddy = {
       enable = true;
       virtualHosts = mapAttrs' (hostName: cfg: (
-        nameValuePair "http://${hostName}" {
+        nameValuePair hostName {
           extraConfig = ''
             root    * /${pkg hostName cfg}/share/wordpress
             file_server

nixos/modules/tasks/filesystems/bindfs.nix

@@ -0,0 +1,15 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+{
+  config = lib.mkIf (config.boot.supportedFilesystems."fuse.bindfs" or false) {
+    system.fsPackages = [ pkgs.bindfs ];
+  };
+
+  meta = {
+    maintainers = with lib.maintainers; [ Luflosi ];
+  };
+}

nixos/tests/all-tests.nix

@@ -314,7 +314,7 @@ in {
   darling = handleTest ./darling.nix {};
   darling-dmg = runTest ./darling-dmg.nix;
   dae = handleTest ./dae.nix {};
-  davis = handleTest ./davis.nix {};
+  davis = runTest ./davis.nix;
   db-rest = handleTest ./db-rest.nix {};
   dconf = handleTest ./dconf.nix {};
   ddns-updater = handleTest ./ddns-updater.nix {};
@@ -578,7 +578,7 @@ in {
   installer = handleTest ./installer.nix {};
   installer-systemd-stage-1 = handleTest ./installer-systemd-stage-1.nix {};
   intune = handleTest ./intune.nix {};
-  invoiceplane = handleTest ./invoiceplane.nix {};
+  invoiceplane = runTest ./invoiceplane.nix;
   iodine = handleTest ./iodine.nix {};
   ipv6 = handleTest ./ipv6.nix {};
   iscsi-multipath-root = handleTest ./iscsi-multipath-root.nix {};
@@ -678,7 +678,7 @@ in {
   maestral = handleTest ./maestral.nix {};
   magic-wormhole-mailbox-server = handleTest ./magic-wormhole-mailbox-server.nix {};
   magnetico = handleTest ./magnetico.nix {};
-  mailcatcher = handleTest ./mailcatcher.nix {};
+  mailcatcher = runTest ./mailcatcher.nix;
   mailhog = handleTest ./mailhog.nix {};
   mailpit = handleTest ./mailpit.nix {};
   mailman = handleTest ./mailman.nix {};
@@ -802,20 +802,20 @@ in {
   nginx-etag = runTest ./nginx-etag.nix;
   nginx-etag-compression = runTest ./nginx-etag-compression.nix;
   nginx-globalredirect = runTest ./nginx-globalredirect.nix;
-  nginx-http3 = handleTest ./nginx-http3.nix {};
+  nginx-http3 = import ./nginx-http3.nix { inherit pkgs runTest; };
   nginx-mime = runTest ./nginx-mime.nix;
   nginx-modsecurity = runTest ./nginx-modsecurity.nix;
   nginx-moreheaders = runTest ./nginx-moreheaders.nix;
   nginx-njs = handleTest ./nginx-njs.nix {};
-  nginx-proxyprotocol = handleTest ./nginx-proxyprotocol {};
-  nginx-pubhtml = handleTest ./nginx-pubhtml.nix {};
-  nginx-redirectcode = handleTest ./nginx-redirectcode.nix {};
-  nginx-sso = handleTest ./nginx-sso.nix {};
-  nginx-status-page = handleTest ./nginx-status-page.nix {};
-  nginx-tmpdir = handleTest ./nginx-tmpdir.nix {};
-  nginx-unix-socket = handleTest ./nginx-unix-socket.nix {};
-  nginx-variants = handleTest ./nginx-variants.nix {};
-  nifi = handleTestOn ["x86_64-linux"] ./web-apps/nifi.nix {};
+  nginx-proxyprotocol = runTest ./nginx-proxyprotocol/default.nix;
+  nginx-pubhtml = runTest ./nginx-pubhtml.nix;
+  nginx-redirectcode = runTest ./nginx-redirectcode.nix;
+  nginx-sso = runTest ./nginx-sso.nix;
+  nginx-status-page = runTest ./nginx-status-page.nix;
+  nginx-tmpdir = runTest ./nginx-tmpdir.nix;
+  nginx-unix-socket = runTest ./nginx-unix-socket.nix;
+  nginx-variants = import ./nginx-variants.nix { inherit pkgs runTest; };
+  nifi = runTestOn ["x86_64-linux"] ./web-apps/nifi.nix;
   nitter = handleTest ./nitter.nix {};
   nix-config = handleTest ./nix-config.nix {};
   nix-ld = handleTest ./nix-ld.nix {};
@@ -846,7 +846,7 @@ in {
   };
   nixpkgs = pkgs.callPackage ../modules/misc/nixpkgs/test.nix { inherit evalMinimalConfig; };
   nixseparatedebuginfod = handleTest ./nixseparatedebuginfod.nix {};
-  node-red = handleTest ./node-red.nix {};
+  node-red = runTest ./node-red.nix;
   nomad = runTest ./nomad.nix;
   non-default-filesystems = handleTest ./non-default-filesystems.nix {};
   non-switchable-system = runTest ./non-switchable-system.nix;
@@ -1231,7 +1231,7 @@ in {
   tomcat = handleTest ./tomcat.nix {};
   tor = handleTest ./tor.nix {};
   tpm-ek = handleTest ./tpm-ek {};
-  traefik = handleTestOn ["aarch64-linux" "x86_64-linux"] ./traefik.nix {};
+  traefik = runTestOn ["aarch64-linux" "x86_64-linux"] ./traefik.nix;
   trafficserver = handleTest ./trafficserver.nix {};
   transfer-sh = handleTest ./transfer-sh.nix {};
   transmission_3 = handleTest ./transmission.nix { transmission = pkgs.transmission_3; };
@@ -1277,9 +1277,18 @@ in {
   ustreamer = handleTest ./ustreamer.nix {};
   uwsgi = handleTest ./uwsgi.nix {};
   v2ray = handleTest ./v2ray.nix {};
-  varnish60 = handleTest ./varnish.nix { package = pkgs.varnish60; };
-  varnish75 = handleTest ./varnish.nix { package = pkgs.varnish75; };
-  varnish76 = handleTest ./varnish.nix { package = pkgs.varnish76; };
+  varnish60 = runTest {
+    imports = [ ./varnish.nix ];
+    _module.args.package = pkgs.varnish60;
+  };
+  varnish75 = runTest {
+    imports = [ ./varnish.nix ];
+    _module.args.package = pkgs.varnish75;
+  };
+  varnish76 = runTest {
+    imports = [ ./varnish.nix ];
+    _module.args.package = pkgs.varnish76;
+  };
   vault = handleTest ./vault.nix {};
   vault-agent = handleTest ./vault-agent.nix {};
   vault-dev = handleTest ./vault-dev.nix {};

nixos/tests/davis.nix

@@ -1,59 +1,56 @@
-import ./make-test-python.nix (
-  { lib, pkgs, ... }:
+{ pkgs, ... }:
+{
+  name = "davis";
 
-  {
-    name = "davis";
+  meta.maintainers = pkgs.davis.meta.maintainers;
 
-    meta.maintainers = pkgs.davis.meta.maintainers;
-
-    nodes.machine =
-      { config, ... }:
-      {
-        virtualisation = {
-          memorySize = 512;
-        };
-
-        services.davis = {
-          enable = true;
-          hostname = "davis.example.com";
-          database = {
-            driver = "postgresql";
-          };
-          mail = {
-            dsnFile = "${pkgs.writeText "davisMailDns" "smtp://username:password@example.com:25"}";
-            inviteFromAddress = "dav@example.com";
-          };
-          adminLogin = "admin";
-          appSecretFile = "${pkgs.writeText "davisAppSecret" "52882ef142066e09ab99ce816ba72522e789505caba224"}";
-          adminPasswordFile = "${pkgs.writeText "davisAdminPass" "nixos"}";
-          nginx = { };
-        };
+  nodes.machine =
+    { config, ... }:
+    {
+      virtualisation = {
+        memorySize = 512;
       };
 
-    testScript = ''
-      start_all()
-      machine.wait_for_unit("postgresql.service")
-      machine.wait_for_unit("davis-env-setup.service")
-      machine.wait_for_unit("davis-db-migrate.service")
-      machine.wait_for_unit("nginx.service")
-      machine.wait_for_unit("phpfpm-davis.service")
+      services.davis = {
+        enable = true;
+        hostname = "davis.example.com";
+        database = {
+          driver = "postgresql";
+        };
+        mail = {
+          dsnFile = "${pkgs.writeText "davisMailDns" "smtp://username:password@example.com:25"}";
+          inviteFromAddress = "dav@example.com";
+        };
+        adminLogin = "admin";
+        appSecretFile = "${pkgs.writeText "davisAppSecret" "52882ef142066e09ab99ce816ba72522e789505caba224"}";
+        adminPasswordFile = "${pkgs.writeText "davisAdminPass" "nixos"}";
+        nginx = { };
+      };
+    };
 
-      with subtest("welcome screen loads"):
-          machine.succeed(
-              "curl -sSfL --resolve davis.example.com:80:127.0.0.1 http://davis.example.com/ | grep '<title>Davis</title>'"
-          )
+  testScript = ''
+    start_all()
+    machine.wait_for_unit("postgresql.service")
+    machine.wait_for_unit("davis-env-setup.service")
+    machine.wait_for_unit("davis-db-migrate.service")
+    machine.wait_for_unit("nginx.service")
+    machine.wait_for_unit("phpfpm-davis.service")
 
-      with subtest("login works"):
-          csrf_token = machine.succeed(
-              "curl -c /tmp/cookies -sSfL --resolve davis.example.com:80:127.0.0.1 http://davis.example.com/login | grep '_csrf_token' | sed -E 's,.*value=\"(.*)\".*,\\1,g'"
-          )
-          r = machine.succeed(
-              f"curl -b /tmp/cookies --resolve davis.example.com:80:127.0.0.1 http://davis.example.com/login -X POST -F _username=admin -F _password=nixos -F _csrf_token={csrf_token.strip()} -D headers"
-          )
-          print(r)
-          machine.succeed(
-            "[[ $(grep -i 'location: ' headers | cut -d: -f2- | xargs echo) == /dashboard* ]]"
-          )
-    '';
-  }
-)
+    with subtest("welcome screen loads"):
+        machine.succeed(
+            "curl -sSfL --resolve davis.example.com:80:127.0.0.1 http://davis.example.com/ | grep '<title>Davis</title>'"
+        )
+
+    with subtest("login works"):
+        csrf_token = machine.succeed(
+            "curl -c /tmp/cookies -sSfL --resolve davis.example.com:80:127.0.0.1 http://davis.example.com/login | grep '_csrf_token' | sed -E 's,.*value=\"(.*)\".*,\\1,g'"
+        )
+        r = machine.succeed(
+            f"curl -b /tmp/cookies --resolve davis.example.com:80:127.0.0.1 http://davis.example.com/login -X POST -F _username=admin -F _password=nixos -F _csrf_token={csrf_token.strip()} -D headers"
+        )
+        print(r)
+        machine.succeed(
+          "[[ $(grep -i 'location: ' headers | cut -d: -f2- | xargs echo) == /dashboard* ]]"
+        )
+  '';
+}

nixos/tests/invoiceplane.nix

@@ -1,118 +1,116 @@
-import ./make-test-python.nix (
-  { pkgs, ... }:
+{ pkgs, ... }:
 
-  {
-    name = "invoiceplane";
-    meta = with pkgs.lib.maintainers; {
-      maintainers = [
-        onny
-      ];
-    };
+{
+  name = "invoiceplane";
+  meta = with pkgs.lib.maintainers; {
+    maintainers = [
+      onny
+    ];
+  };
 
-    nodes = {
-      invoiceplane_caddy =
-        { ... }:
-        {
-          services.invoiceplane.webserver = "caddy";
-          services.invoiceplane.sites = {
-            "site1.local" = {
-              database.name = "invoiceplane1";
-              database.createLocally = true;
-              enable = true;
-            };
-            "site2.local" = {
-              database.name = "invoiceplane2";
-              database.createLocally = true;
-              enable = true;
-            };
+  nodes = {
+    invoiceplane_caddy =
+      { ... }:
+      {
+        services.invoiceplane.webserver = "caddy";
+        services.invoiceplane.sites = {
+          "site1.local" = {
+            database.name = "invoiceplane1";
+            database.createLocally = true;
+            enable = true;
+          };
+          "site2.local" = {
+            database.name = "invoiceplane2";
+            database.createLocally = true;
+            enable = true;
           };
-
-          networking.firewall.allowedTCPPorts = [ 80 ];
-          networking.hosts."127.0.0.1" = [
-            "site1.local"
-            "site2.local"
-          ];
         };
 
-      invoiceplane_nginx =
-        { ... }:
-        {
-          services.invoiceplane.webserver = "nginx";
-          services.invoiceplane.sites = {
-            "site1.local" = {
-              database.name = "invoiceplane1";
-              database.createLocally = true;
-              enable = true;
-            };
-            "site2.local" = {
-              database.name = "invoiceplane2";
-              database.createLocally = true;
-              enable = true;
-            };
+        networking.firewall.allowedTCPPorts = [ 80 ];
+        networking.hosts."127.0.0.1" = [
+          "site1.local"
+          "site2.local"
+        ];
+      };
+
+    invoiceplane_nginx =
+      { ... }:
+      {
+        services.invoiceplane.webserver = "nginx";
+        services.invoiceplane.sites = {
+          "site1.local" = {
+            database.name = "invoiceplane1";
+            database.createLocally = true;
+            enable = true;
+          };
+          "site2.local" = {
+            database.name = "invoiceplane2";
+            database.createLocally = true;
+            enable = true;
           };
-
-          networking.firewall.allowedTCPPorts = [ 80 ];
-          networking.hosts."127.0.0.1" = [
-            "site1.local"
-            "site2.local"
-          ];
         };
-    };
 
-    testScript = ''
-      start_all()
+        networking.firewall.allowedTCPPorts = [ 80 ];
+        networking.hosts."127.0.0.1" = [
+          "site1.local"
+          "site2.local"
+        ];
+      };
+  };
 
-      invoiceplane_caddy.wait_for_unit("caddy")
-      invoiceplane_nginx.wait_for_unit("nginx")
+  testScript = ''
+    start_all()
 
-      site_names = ["site1.local", "site2.local"]
+    invoiceplane_caddy.wait_for_unit("caddy")
+    invoiceplane_nginx.wait_for_unit("nginx")
 
-      machines = [invoiceplane_caddy, invoiceplane_nginx]
+    site_names = ["site1.local", "site2.local"]
 
-      for machine in machines:
-        machine.wait_for_open_port(80)
-        machine.wait_for_open_port(3306)
+    machines = [invoiceplane_caddy, invoiceplane_nginx]
 
-        for site_name in site_names:
-            machine.wait_for_unit(f"phpfpm-invoiceplane-{site_name}")
+    for machine in machines:
+      machine.wait_for_open_port(80)
+      machine.wait_for_open_port(3306)
 
-            with subtest("Website returns welcome screen"):
-                assert "Please install InvoicePlane" in machine.succeed(f"curl -L {site_name}")
+      for site_name in site_names:
+          machine.wait_for_unit(f"phpfpm-invoiceplane-{site_name}")
 
-            with subtest("Finish InvoicePlane setup"):
-              machine.succeed(
-                f"curl -sSfL --cookie-jar cjar {site_name}/setup/language"
-              )
-              csrf_token = machine.succeed(
-                "grep ip_csrf_cookie cjar | cut -f 7 | tr -d '\n'"
-              )
-              machine.succeed(
-                f"curl -sSfL --cookie cjar --cookie-jar cjar -d '_ip_csrf={csrf_token}&ip_lang=english&btn_continue=Continue' {site_name}/setup/language"
-              )
-              csrf_token = machine.succeed(
-                "grep ip_csrf_cookie cjar | cut -f 7 | tr -d '\n'"
-              )
-              machine.succeed(
-                f"curl -sSfL --cookie cjar --cookie-jar cjar -d '_ip_csrf={csrf_token}&btn_continue=Continue' {site_name}/setup/prerequisites"
-              )
-              csrf_token = machine.succeed(
-                "grep ip_csrf_cookie cjar | cut -f 7 | tr -d '\n'"
-              )
-              machine.succeed(
-                f"curl -sSfL --cookie cjar --cookie-jar cjar -d '_ip_csrf={csrf_token}&btn_continue=Continue' {site_name}/setup/configure_database"
-              )
-              csrf_token = machine.succeed(
-                "grep ip_csrf_cookie cjar | cut -f 7 | tr -d '\n'"
-              )
-              machine.succeed(
-                f"curl -sSfl --cookie cjar --cookie-jar cjar -d '_ip_csrf={csrf_token}&btn_continue=Continue' {site_name}/setup/install_tables"
-              )
-              csrf_token = machine.succeed(
-                "grep ip_csrf_cookie cjar | cut -f 7 | tr -d '\n'"
-              )
-              machine.succeed(
-                f"curl -sSfl --cookie cjar --cookie-jar cjar -d '_ip_csrf={csrf_token}&btn_continue=Continue' {site_name}/setup/upgrade_tables"
-              )
-    '';
-  }
-)
+          with subtest("Website returns welcome screen"):
+              assert "Please install InvoicePlane" in machine.succeed(f"curl -L {site_name}")
+
+          with subtest("Finish InvoicePlane setup"):
+            machine.succeed(
+              f"curl -sSfL --cookie-jar cjar {site_name}/setup/language"
+            )
+            csrf_token = machine.succeed(
+              "grep ip_csrf_cookie cjar | cut -f 7 | tr -d '\n'"
+            )
+            machine.succeed(
+              f"curl -sSfL --cookie cjar --cookie-jar cjar -d '_ip_csrf={csrf_token}&ip_lang=english&btn_continue=Continue' {site_name}/setup/language"
+            )
+            csrf_token = machine.succeed(
+              "grep ip_csrf_cookie cjar | cut -f 7 | tr -d '\n'"
+            )
+            machine.succeed(
+              f"curl -sSfL --cookie cjar --cookie-jar cjar -d '_ip_csrf={csrf_token}&btn_continue=Continue' {site_name}/setup/prerequisites"
+            )
+            csrf_token = machine.succeed(
+              "grep ip_csrf_cookie cjar | cut -f 7 | tr -d '\n'"
+            )
+            machine.succeed(
+              f"curl -sSfL --cookie cjar --cookie-jar cjar -d '_ip_csrf={csrf_token}&btn_continue=Continue' {site_name}/setup/configure_database"
+            )
+            csrf_token = machine.succeed(
+              "grep ip_csrf_cookie cjar | cut -f 7 | tr -d '\n'"
+            )
+            machine.succeed(
+              f"curl -sSfl --cookie cjar --cookie-jar cjar -d '_ip_csrf={csrf_token}&btn_continue=Continue' {site_name}/setup/install_tables"
+            )
+            csrf_token = machine.succeed(
+              "grep ip_csrf_cookie cjar | cut -f 7 | tr -d '\n'"
+            )
+            machine.succeed(
+              f"curl -sSfl --cookie cjar --cookie-jar cjar -d '_ip_csrf={csrf_token}&btn_continue=Continue' {site_name}/setup/upgrade_tables"
+            )
+  '';
+}

nixos/tests/mailcatcher.nix

@@ -1,37 +1,35 @@
-import ./make-test-python.nix (
-  { lib, ... }:
+{ lib, ... }:
 
-  {
-    name = "mailcatcher";
-    meta.maintainers = [ lib.maintainers.aanderse ];
+{
+  name = "mailcatcher";
+  meta.maintainers = [ lib.maintainers.aanderse ];
 
-    nodes.machine =
-      { pkgs, ... }:
-      {
-        services.mailcatcher.enable = true;
+  nodes.machine =
+    { pkgs, ... }:
+    {
+      services.mailcatcher.enable = true;
 
-        programs.msmtp = {
-          enable = true;
-          accounts.default = {
-            host = "localhost";
-            port = 1025;
-          };
+      programs.msmtp = {
+        enable = true;
+        accounts.default = {
+          host = "localhost";
+          port = 1025;
         };
-
-        environment.systemPackages = [ pkgs.mailutils ];
       };
 
-    testScript = ''
-      start_all()
+      environment.systemPackages = [ pkgs.mailutils ];
+    };
 
-      machine.wait_for_unit("mailcatcher.service")
-      machine.wait_for_open_port(1025)
-      machine.succeed(
-          'echo "this is the body of the email" | mail -s "subject" root@example.org'
-      )
-      assert "this is the body of the email" in machine.succeed(
-          "curl -f http://localhost:1080/messages/1.source"
-      )
-    '';
-  }
-)
+  testScript = ''
+    start_all()
+
+    machine.wait_for_unit("mailcatcher.service")
+    machine.wait_for_open_port(1025)
+    machine.succeed(
+        'echo "this is the body of the email" | mail -s "subject" root@example.org'
+    )
+    assert "this is the body of the email" in machine.succeed(
+        "curl -f http://localhost:1080/messages/1.source"
+    )
+  '';
+}

nixos/tests/nginx-http3.nix

@@ -1,23 +1,15 @@
-{
-  system ? builtins.currentSystem,
-  config ? { },
-  pkgs ? import ../.. { inherit system config; },
-}:
-
-with import ../lib/testing-python.nix { inherit system pkgs; };
-
+{ pkgs, runTest, ... }:
 let
   hosts = ''
     192.168.2.101 acme.test
   '';
 
 in
-
 builtins.listToAttrs (
   builtins.map
     (nginxPackage: {
       name = pkgs.lib.getName nginxPackage;
-      value = makeTest {
+      value = runTest {
         name = "nginx-http3-${pkgs.lib.getName nginxPackage}";
         meta.maintainers = with pkgs.lib.maintainers; [ izorkin ];
 

nixos/tests/nginx-proxyprotocol/default.nix

@@ -1,164 +1,162 @@
 let
   certs = import ./snakeoil-certs.nix;
 in
-import ../make-test-python.nix (
-  { pkgs, ... }:
-  {
-    name = "nginx-proxyprotocol";
+{ pkgs, ... }:
+{
+  name = "nginx-proxyprotocol";
 
-    meta = {
-      maintainers = with pkgs.lib.maintainers; [ raitobezarius ];
-    };
+  meta = {
+    maintainers = with pkgs.lib.maintainers; [ raitobezarius ];
+  };
 
-    nodes = {
-      webserver =
-        { pkgs, lib, ... }:
-        {
-          environment.systemPackages = [ pkgs.netcat ];
-          security.pki.certificateFiles = [
-            certs.ca.cert
+  nodes = {
+    webserver =
+      { pkgs, lib, ... }:
+      {
+        environment.systemPackages = [ pkgs.netcat ];
+        security.pki.certificateFiles = [
+          certs.ca.cert
+        ];
+
+        networking.extraHosts = ''
+          127.0.0.5 proxy.test.nix
+          127.0.0.5 noproxy.test.nix
+          127.0.0.3 direct-nossl.test.nix
+          127.0.0.4 unsecure-nossl.test.nix
+          127.0.0.2 direct-noproxy.test.nix
+          127.0.0.1 direct-proxy.test.nix
+        '';
+        services.nginx = {
+          enable = true;
+          defaultListen = [
+            {
+              addr = "127.0.0.1";
+              proxyProtocol = true;
+              ssl = true;
+            }
+            { addr = "127.0.0.2"; }
+            {
+              addr = "127.0.0.3";
+              ssl = false;
+            }
+            {
+              addr = "127.0.0.4";
+              ssl = false;
+              proxyProtocol = true;
+            }
           ];
-
-          networking.extraHosts = ''
-            127.0.0.5 proxy.test.nix
-            127.0.0.5 noproxy.test.nix
-            127.0.0.3 direct-nossl.test.nix
-            127.0.0.4 unsecure-nossl.test.nix
-            127.0.0.2 direct-noproxy.test.nix
-            127.0.0.1 direct-proxy.test.nix
+          commonHttpConfig = ''
+            log_format pcombined '(proxy_protocol=$proxy_protocol_addr) - (remote_addr=$remote_addr) - (realip=$realip_remote_addr) - (upstream=) - (remote_user=$remote_user) [$time_local] '
+                          '"$request" $status $body_bytes_sent '
+                          '"$http_referer" "$http_user_agent"';
+            access_log /var/log/nginx/access.log pcombined;
+            error_log /var/log/nginx/error.log;
           '';
-          services.nginx = {
-            enable = true;
-            defaultListen = [
-              {
-                addr = "127.0.0.1";
-                proxyProtocol = true;
-                ssl = true;
-              }
-              { addr = "127.0.0.2"; }
-              {
-                addr = "127.0.0.3";
-                ssl = false;
-              }
-              {
-                addr = "127.0.0.4";
-                ssl = false;
-                proxyProtocol = true;
-              }
-            ];
-            commonHttpConfig = ''
-              log_format pcombined '(proxy_protocol=$proxy_protocol_addr) - (remote_addr=$remote_addr) - (realip=$realip_remote_addr) - (upstream=) - (remote_user=$remote_user) [$time_local] '
-                            '"$request" $status $body_bytes_sent '
-                            '"$http_referer" "$http_user_agent"';
-              access_log /var/log/nginx/access.log pcombined;
-              error_log /var/log/nginx/error.log;
-            '';
-            virtualHosts =
-              let
-                commonConfig = {
-                  locations."/".return = "200 '$remote_addr'";
-                  extraConfig = ''
-                    set_real_ip_from 127.0.0.5/32;
-                    real_ip_header proxy_protocol;
-                  '';
-                };
-              in
-              {
-                "*.test.nix" = commonConfig // {
-                  sslCertificate = certs."*.test.nix".cert;
-                  sslCertificateKey = certs."*.test.nix".key;
-                  forceSSL = true;
-                };
-                "direct-nossl.test.nix" = commonConfig;
-                "unsecure-nossl.test.nix" = commonConfig // {
-                  extraConfig = ''
-                    real_ip_header proxy_protocol;
-                  '';
-                };
+          virtualHosts =
+            let
+              commonConfig = {
+                locations."/".return = "200 '$remote_addr'";
+                extraConfig = ''
+                  set_real_ip_from 127.0.0.5/32;
+                  real_ip_header proxy_protocol;
+                '';
               };
-          };
-
-          services.sniproxy = {
-            enable = true;
-            config = ''
-              error_log {
-                syslog daemon
-              }
-              access_log {
-                syslog daemon
-              }
-              listener 127.0.0.5:443 {
-                protocol tls
-                source 127.0.0.5
-              }
-              table {
-                ^proxy\.test\.nix$   127.0.0.1 proxy_protocol
-                ^noproxy\.test\.nix$ 127.0.0.2
-              }
-            '';
-          };
+            in
+            {
+              "*.test.nix" = commonConfig // {
+                sslCertificate = certs."*.test.nix".cert;
+                sslCertificateKey = certs."*.test.nix".key;
+                forceSSL = true;
+              };
+              "direct-nossl.test.nix" = commonConfig;
+              "unsecure-nossl.test.nix" = commonConfig // {
+                extraConfig = ''
+                  real_ip_header proxy_protocol;
+                '';
+              };
+            };
         };
-    };
 
-    testScript = ''
-      def check_origin_ip(src_ip: str, dst_url: str, failure: bool = False, proxy_protocol: bool = False, expected_ip: str | None = None):
-        check = webserver.fail if failure else webserver.succeed
-        if expected_ip is None:
-          expected_ip = src_ip
+        services.sniproxy = {
+          enable = true;
+          config = ''
+            error_log {
+              syslog daemon
+            }
+            access_log {
+              syslog daemon
+            }
+            listener 127.0.0.5:443 {
+              protocol tls
+              source 127.0.0.5
+            }
+            table {
+              ^proxy\.test\.nix$   127.0.0.1 proxy_protocol
+              ^noproxy\.test\.nix$ 127.0.0.2
+            }
+          '';
+        };
+      };
+  };
 
-        return check(f"curl {'--haproxy-protocol' if proxy_protocol else '''} --interface {src_ip} --fail -L {dst_url} | grep '{expected_ip}'")
+  testScript = ''
+    def check_origin_ip(src_ip: str, dst_url: str, failure: bool = False, proxy_protocol: bool = False, expected_ip: str | None = None):
+      check = webserver.fail if failure else webserver.succeed
+      if expected_ip is None:
+        expected_ip = src_ip
 
-      webserver.wait_for_unit("nginx")
-      webserver.wait_for_unit("sniproxy")
-      # This should be closed by virtue of ssl = true;
-      webserver.wait_for_closed_port(80, "127.0.0.1")
-      # This should be open by virtue of no explicit ssl
-      webserver.wait_for_open_port(80, "127.0.0.2")
-      # This should be open by virtue of ssl = true;
-      webserver.wait_for_open_port(443, "127.0.0.1")
-      # This should be open by virtue of no explicit ssl
-      webserver.wait_for_open_port(443, "127.0.0.2")
-      # This should be open by sniproxy
-      webserver.wait_for_open_port(443, "127.0.0.5")
-      # This should be closed by sniproxy
-      webserver.wait_for_closed_port(80, "127.0.0.5")
+      return check(f"curl {'--haproxy-protocol' if proxy_protocol else '''} --interface {src_ip} --fail -L {dst_url} | grep '{expected_ip}'")
 
-      # Sanity checks for the NGINX module
-      # direct-HTTP connection to NGINX without TLS, this checks that ssl = false; works well.
-      check_origin_ip("127.0.0.10", "http://direct-nossl.test.nix/")
-      # webserver.execute("openssl s_client -showcerts -connect direct-noproxy.test.nix:443")
-      # direct-HTTP connection to NGINX with TLS
-      check_origin_ip("127.0.0.10", "http://direct-noproxy.test.nix/")
-      check_origin_ip("127.0.0.10", "https://direct-noproxy.test.nix/")
-      # Well, sniproxy is not listening on 80 and cannot redirect
-      check_origin_ip("127.0.0.10", "http://proxy.test.nix/", failure=True)
-      check_origin_ip("127.0.0.10", "http://noproxy.test.nix/", failure=True)
+    webserver.wait_for_unit("nginx")
+    webserver.wait_for_unit("sniproxy")
+    # This should be closed by virtue of ssl = true;
+    webserver.wait_for_closed_port(80, "127.0.0.1")
+    # This should be open by virtue of no explicit ssl
+    webserver.wait_for_open_port(80, "127.0.0.2")
+    # This should be open by virtue of ssl = true;
+    webserver.wait_for_open_port(443, "127.0.0.1")
+    # This should be open by virtue of no explicit ssl
+    webserver.wait_for_open_port(443, "127.0.0.2")
+    # This should be open by sniproxy
+    webserver.wait_for_open_port(443, "127.0.0.5")
+    # This should be closed by sniproxy
+    webserver.wait_for_closed_port(80, "127.0.0.5")
 
-      # Actual PROXY protocol related tests
-      # Connecting through sniproxy should passthrough the originating IP address.
-      check_origin_ip("127.0.0.10", "https://proxy.test.nix/")
-      # Connecting through sniproxy to a non-PROXY protocol enabled listener should not pass the originating IP address.
-      check_origin_ip("127.0.0.10", "https://noproxy.test.nix/", expected_ip="127.0.0.5")
+    # Sanity checks for the NGINX module
+    # direct-HTTP connection to NGINX without TLS, this checks that ssl = false; works well.
+    check_origin_ip("127.0.0.10", "http://direct-nossl.test.nix/")
+    # webserver.execute("openssl s_client -showcerts -connect direct-noproxy.test.nix:443")
+    # direct-HTTP connection to NGINX with TLS
+    check_origin_ip("127.0.0.10", "http://direct-noproxy.test.nix/")
+    check_origin_ip("127.0.0.10", "https://direct-noproxy.test.nix/")
+    # Well, sniproxy is not listening on 80 and cannot redirect
+    check_origin_ip("127.0.0.10", "http://proxy.test.nix/", failure=True)
+    check_origin_ip("127.0.0.10", "http://noproxy.test.nix/", failure=True)
 
-      # Attack tests against spoofing
-      # Let's try to spoof our IP address by connecting direct-y to the PROXY protocol listener.
-      # FIXME(RaitoBezarius): rewrite it using Python + (Scapy|something else) as this is too much broken unfortunately.
-      # Or wait for upstream curl patch.
-      # def generate_attacker_request(original_ip: str, target_ip: str, dst_url: str):
-      #     return f"""PROXY TCP4 {original_ip} {target_ip} 80 80
-      #     GET / HTTP/1.1
-      #     Host: {dst_url}
+    # Actual PROXY protocol related tests
+    # Connecting through sniproxy should passthrough the originating IP address.
+    check_origin_ip("127.0.0.10", "https://proxy.test.nix/")
+    # Connecting through sniproxy to a non-PROXY protocol enabled listener should not pass the originating IP address.
+    check_origin_ip("127.0.0.10", "https://noproxy.test.nix/", expected_ip="127.0.0.5")
 
-      #     """
-      # def spoof(original_ip: str, target_ip: str, dst_url: str, tls: bool = False, expect_failure: bool = True):
-      #   method = webserver.fail if expect_failure else webserver.succeed
-      #   port = 443 if tls else 80
-      #   print(webserver.execute(f"cat <<EOF | nc {target_ip} {port}\n{generate_attacker_request(original_ip, target_ip, dst_url)}\nEOF"))
-      #   return method(f"cat <<EOF | nc {target_ip} {port} | grep {original_ip}\n{generate_attacker_request(original_ip, target_ip, dst_url)}\nEOF")
+    # Attack tests against spoofing
+    # Let's try to spoof our IP address by connecting direct-y to the PROXY protocol listener.
+    # FIXME(RaitoBezarius): rewrite it using Python + (Scapy|something else) as this is too much broken unfortunately.
+    # Or wait for upstream curl patch.
+    # def generate_attacker_request(original_ip: str, target_ip: str, dst_url: str):
+    #     return f"""PROXY TCP4 {original_ip} {target_ip} 80 80
+    #     GET / HTTP/1.1
+    #     Host: {dst_url}
 
-      # check_origin_ip("127.0.0.10", "http://unsecure-nossl.test.nix", proxy_protocol=True)
-      # spoof("1.1.1.1", "127.0.0.4", "direct-nossl.test.nix")
-      # spoof("1.1.1.1", "127.0.0.4", "unsecure-nossl.test.nix", expect_failure=False)
-    '';
-  }
-)
+    #     """
+    # def spoof(original_ip: str, target_ip: str, dst_url: str, tls: bool = False, expect_failure: bool = True):
+    #   method = webserver.fail if expect_failure else webserver.succeed
+    #   port = 443 if tls else 80
+    #   print(webserver.execute(f"cat <<EOF | nc {target_ip} {port}\n{generate_attacker_request(original_ip, target_ip, dst_url)}\nEOF"))
+    #   return method(f"cat <<EOF | nc {target_ip} {port} | grep {original_ip}\n{generate_attacker_request(original_ip, target_ip, dst_url)}\nEOF")
+
+    # check_origin_ip("127.0.0.10", "http://unsecure-nossl.test.nix", proxy_protocol=True)
+    # spoof("1.1.1.1", "127.0.0.4", "direct-nossl.test.nix")
+    # spoof("1.1.1.1", "127.0.0.4", "unsecure-nossl.test.nix", expect_failure=False)
+  '';
+}

nixos/tests/nginx-pubhtml.nix

@@ -1,4 +1,5 @@
-import ./make-test-python.nix {
+{ ... }:
+{
   name = "nginx-pubhtml";
 
   nodes.machine =

nixos/tests/nginx-redirectcode.nix

@@ -1,30 +1,28 @@
-import ./make-test-python.nix (
-  { pkgs, lib, ... }:
-  {
-    name = "nginx-redirectcode";
-    meta.maintainers = with lib.maintainers; [ misterio77 ];
+{ lib, ... }:
+{
+  name = "nginx-redirectcode";
+  meta.maintainers = with lib.maintainers; [ misterio77 ];
 
-    nodes = {
-      webserver =
-        { pkgs, lib, ... }:
-        {
-          services.nginx = {
-            enable = true;
-            virtualHosts.localhost = {
-              globalRedirect = "example.com/foo";
-              # With 308 (and 307), the method and body are to be kept when following it
-              redirectCode = 308;
-            };
+  nodes = {
+    webserver =
+      { pkgs, lib, ... }:
+      {
+        services.nginx = {
+          enable = true;
+          virtualHosts.localhost = {
+            globalRedirect = "example.com/foo";
+            # With 308 (and 307), the method and body are to be kept when following it
+            redirectCode = 308;
           };
         };
-    };
+      };
+  };
 
-    testScript = ''
-      webserver.wait_for_unit("nginx")
-      webserver.wait_for_open_port(80)
+  testScript = ''
+    webserver.wait_for_unit("nginx")
+    webserver.wait_for_open_port(80)
 
-      # Check the status code
-      webserver.succeed("curl -si http://localhost | grep '^HTTP/[0-9.]\+ 308 Permanent Redirect'")
-    '';
-  }
-)
+    # Check the status code
+    webserver.succeed("curl -si http://localhost | grep '^HTTP/[0-9.]\+ 308 Permanent Redirect'")
+  '';
+}

nixos/tests/nginx-sso.nix

@@ -1,4 +1,5 @@
-import ./make-test-python.nix ({ pkgs, ... }: {
+{ pkgs, ... }:
+{
   name = "nginx-sso";
   meta = {
     maintainers = with pkgs.lib.maintainers; [ ambroisie ];
@@ -8,7 +9,10 @@ import ./make-test-python.nix ({ pkgs, ... }: {
     services.nginx.sso = {
       enable = true;
       configuration = {
-        listen = { addr = "127.0.0.1"; port = 8080; };
+        listen = {
+          addr = "127.0.0.1";
+          port = 8080;
+        };
 
         providers.token.tokens = {
           myuser = {
@@ -19,7 +23,12 @@ import ./make-test-python.nix ({ pkgs, ... }: {
         acl = {
           rule_sets = [
             {
-              rules = [ { field = "x-application"; equals = "MyApp"; } ];
+              rules = [
+                {
+                  field = "x-application";
+                  equals = "MyApp";
+                }
+              ];
               allow = [ "myuser" ];
             }
           ];
@@ -47,4 +56,4 @@ import ./make-test-python.nix ({ pkgs, ... }: {
             "curl -sSf -H 'Authorization: Token MyToken' -H 'X-Application: MyApp' http://localhost:8080/auth"
         )
   '';
-})
+}

nixos/tests/nginx-status-page.nix

@@ -1,81 +1,79 @@
-import ./make-test-python.nix (
-  { pkgs, ... }:
-  {
-    name = "nginx-status-page";
-    meta = with pkgs.lib.maintainers; {
-      maintainers = [ h7x4 ];
-    };
+{ pkgs, ... }:
+{
+  name = "nginx-status-page";
+  meta = with pkgs.lib.maintainers; {
+    maintainers = [ h7x4 ];
+  };
 
-    nodes = {
-      webserver =
-        { ... }:
-        {
-          virtualisation.vlans = [ 1 ];
+  nodes = {
+    webserver =
+      { ... }:
+      {
+        virtualisation.vlans = [ 1 ];
 
-          networking = {
-            useNetworkd = true;
-            useDHCP = false;
-            firewall.enable = false;
-          };
-
-          systemd.network.networks."01-eth1" = {
-            name = "eth1";
-            networkConfig.Address = "10.0.0.1/24";
-          };
-
-          services.nginx = {
-            enable = true;
-            statusPage = true;
-            virtualHosts."localhost".locations."/index.html".return = "200 'hello world\n'";
-          };
-
-          environment.systemPackages = with pkgs; [ curl ];
+        networking = {
+          useNetworkd = true;
+          useDHCP = false;
+          firewall.enable = false;
         };
 
-      client =
-        { ... }:
-        {
-          virtualisation.vlans = [ 1 ];
-
-          networking = {
-            useNetworkd = true;
-            useDHCP = false;
-            firewall.enable = false;
-          };
-
-          systemd.network.networks."01-eth1" = {
-            name = "eth1";
-            networkConfig.Address = "10.0.0.2/24";
-          };
-
-          environment.systemPackages = with pkgs; [ curl ];
+        systemd.network.networks."01-eth1" = {
+          name = "eth1";
+          networkConfig.Address = "10.0.0.1/24";
         };
-    };
 
-    testScript =
-      { nodes, ... }:
-      ''
-        start_all()
+        services.nginx = {
+          enable = true;
+          statusPage = true;
+          virtualHosts."localhost".locations."/index.html".return = "200 'hello world\n'";
+        };
 
-        webserver.wait_for_unit("nginx")
-        webserver.wait_for_open_port(80)
+        environment.systemPackages = with pkgs; [ curl ];
+      };
 
-        def expect_http_code(node, code, url):
-            http_code = node.succeed(f"curl -w '%{{http_code}}' '{url}'")
-            assert http_code.split("\n")[-1].strip() == code, \
-              f"expected {code} but got following response:\n{http_code}"
+    client =
+      { ... }:
+      {
+        virtualisation.vlans = [ 1 ];
 
-        with subtest("localhost can access status page"):
-            expect_http_code(webserver, "200", "http://localhost/nginx_status")
+        networking = {
+          useNetworkd = true;
+          useDHCP = false;
+          firewall.enable = false;
+        };
 
-        with subtest("localhost can access other page"):
-            expect_http_code(webserver, "200", "http://localhost/index.html")
+        systemd.network.networks."01-eth1" = {
+          name = "eth1";
+          networkConfig.Address = "10.0.0.2/24";
+        };
 
-        with subtest("client can not access status page"):
-            expect_http_code(client, "403", "http://10.0.0.1/nginx_status")
+        environment.systemPackages = with pkgs; [ curl ];
+      };
+  };
 
-        with subtest("client can access other page"):
-            expect_http_code(client, "200", "http://10.0.0.1/index.html")
-      '';
-  }
-)
+  testScript =
+    { nodes, ... }:
+    ''
+      start_all()
+
+      webserver.wait_for_unit("nginx")
+      webserver.wait_for_open_port(80)
+
+      def expect_http_code(node, code, url):
+          http_code = node.succeed(f"curl -w '%{{http_code}}' '{url}'")
+          assert http_code.split("\n")[-1].strip() == code, \
+            f"expected {code} but got following response:\n{http_code}"
+
+      with subtest("localhost can access status page"):
+          expect_http_code(webserver, "200", "http://localhost/nginx_status")
+
+      with subtest("localhost can access other page"):
+          expect_http_code(webserver, "200", "http://localhost/index.html")
+
+      with subtest("client can not access status page"):
+          expect_http_code(client, "403", "http://10.0.0.1/nginx_status")
+
+      with subtest("client can access other page"):
+          expect_http_code(client, "200", "http://10.0.0.1/index.html")
+    '';
+}

nixos/tests/nginx-tmpdir.nix

@@ -1,7 +1,8 @@
 let
   dst-dir = "/run/nginx-test-tmpdir-uploads";
 in
-import ./make-test-python.nix {
+{ ... }:
+{
   name = "nginx-tmpdir";
 
   nodes.machine =

nixos/tests/nginx-unix-socket.nix

@@ -1,31 +1,29 @@
-import ./make-test-python.nix (
-  { pkgs, ... }:
-  let
-    nginxSocketPath = "/var/run/nginx/test.sock";
-  in
-  {
-    name = "nginx-unix-socket";
+{ ... }:
+let
+  nginxSocketPath = "/var/run/nginx/test.sock";
+in
+{
+  name = "nginx-unix-socket";
 
-    nodes = {
-      webserver =
-        { pkgs, lib, ... }:
-        {
-          services.nginx = {
-            enable = true;
-            virtualHosts.localhost = {
-              serverName = "localhost";
-              listen = [ { addr = "unix:${nginxSocketPath}"; } ];
-              locations."/test".return = "200 'foo'";
-            };
+  nodes = {
+    webserver =
+      { pkgs, lib, ... }:
+      {
+        services.nginx = {
+          enable = true;
+          virtualHosts.localhost = {
+            serverName = "localhost";
+            listen = [ { addr = "unix:${nginxSocketPath}"; } ];
+            locations."/test".return = "200 'foo'";
           };
         };
-    };
+      };
+  };
 
-    testScript = ''
-      webserver.wait_for_unit("nginx")
-      webserver.wait_for_open_unix_socket("${nginxSocketPath}")
+  testScript = ''
+    webserver.wait_for_unit("nginx")
+    webserver.wait_for_open_unix_socket("${nginxSocketPath}")
 
-      webserver.succeed("curl --fail --silent --unix-socket '${nginxSocketPath}' http://localhost/test | grep '^foo$'")
-    '';
-  }
-)
+    webserver.succeed("curl --fail --silent --unix-socket '${nginxSocketPath}' http://localhost/test | grep '^foo$'")
+  '';
+}

nixos/tests/nginx-variants.nix

@@ -1,16 +1,9 @@
-{
-  system ? builtins.currentSystem,
-  config ? { },
-  pkgs ? import ../.. { inherit system config; },
-}:
-
-with import ../lib/testing-python.nix { inherit system pkgs; };
-
+{ pkgs, runTest, ... }:
 builtins.listToAttrs (
   builtins.map
     (nginxPackage: {
       name = pkgs.lib.getName nginxPackage;
-      value = makeTest {
+      value = runTest {
         name = "nginx-variant-${pkgs.lib.getName nginxPackage}";
 
         nodes.machine =

nixos/tests/node-red.nix

@@ -1,38 +1,36 @@
-import ./make-test-python.nix (
-  { pkgs, ... }:
-  {
-    name = "nodered";
-    meta = with pkgs.lib.maintainers; {
-      maintainers = [ matthewcroughan ];
-    };
+{ pkgs, ... }:
+{
+  name = "nodered";
+  meta = with pkgs.lib.maintainers; {
+    maintainers = [ matthewcroughan ];
+  };
 
-    nodes = {
-      client =
-        { config, pkgs, ... }:
-        {
-          environment.systemPackages = [ pkgs.curl ];
+  nodes = {
+    client =
+      { config, pkgs, ... }:
+      {
+        environment.systemPackages = [ pkgs.curl ];
+      };
+    nodered =
+      { config, pkgs, ... }:
+      {
+        services.node-red = {
+          enable = true;
+          openFirewall = true;
         };
-      nodered =
-        { config, pkgs, ... }:
-        {
-          services.node-red = {
-            enable = true;
-            openFirewall = true;
-          };
-        };
-    };
+      };
+  };
 
-    testScript = ''
-      start_all()
-      nodered.wait_for_unit("node-red.service")
-      nodered.wait_for_open_port(1880)
+  testScript = ''
+    start_all()
+    nodered.wait_for_unit("node-red.service")
+    nodered.wait_for_open_port(1880)
 
-      client.wait_for_unit("multi-user.target")
+    client.wait_for_unit("multi-user.target")
 
-      with subtest("Check that the Node-RED webserver can be reached."):
-          assert "<title>Node-RED</title>" in client.succeed(
-              "curl -sSf http:/nodered:1880/ | grep title"
-          )
-    '';
-  }
-)
+    with subtest("Check that the Node-RED webserver can be reached."):
+        assert "<title>Node-RED</title>" in client.succeed(
+            "curl -sSf http:/nodered:1880/ | grep title"
+        )
+  '';
+}

nixos/tests/syncthing-many-devices.nix

@@ -149,7 +149,7 @@ import ./make-test-python.nix (
     '';
   in
   {
-    name = "syncthing-init";
+    name = "syncthing-many-devices";
     meta.maintainers = with lib.maintainers; [ doronbehar ];
 
     nodes.machine = {

nixos/tests/traefik.nix

@@ -1,109 +1,107 @@
 # Test Traefik as a reverse proxy of a local web service
 # and a Docker container.
-import ./make-test-python.nix (
-  { pkgs, ... }:
-  {
-    name = "traefik";
-    meta = with pkgs.lib.maintainers; {
-      maintainers = [ joko ];
-    };
+{ pkgs, ... }:
+{
+  name = "traefik";
+  meta = with pkgs.lib.maintainers; {
+    maintainers = [ joko ];
+  };
 
-    nodes = {
-      client =
-        { config, pkgs, ... }:
-        {
-          environment.systemPackages = [ pkgs.curl ];
-        };
-      traefik =
-        { config, pkgs, ... }:
-        {
-          virtualisation.oci-containers = {
-            backend = "docker";
-            containers.nginx = {
-              extraOptions = [
-                "-l"
-                "traefik.enable=true"
-                "-l"
-                "traefik.http.routers.nginx.entrypoints=web"
-                "-l"
-                "traefik.http.routers.nginx.rule=Host(`nginx.traefik.test`)"
-              ];
-              image = "nginx-container";
-              imageStream = pkgs.dockerTools.examples.nginxStream;
-            };
-          };
-
-          networking.firewall.allowedTCPPorts = [ 80 ];
-
-          services.traefik = {
-            enable = true;
-
-            dynamicConfigOptions = {
-              http.routers.simplehttp = {
-                rule = "Host(`simplehttp.traefik.test`)";
-                entryPoints = [ "web" ];
-                service = "simplehttp";
-              };
-
-              http.services.simplehttp = {
-                loadBalancer.servers = [
-                  {
-                    url = "http://127.0.0.1:8000";
-                  }
-                ];
-              };
-            };
-
-            staticConfigOptions = {
-              global = {
-                checkNewVersion = false;
-                sendAnonymousUsage = false;
-              };
-
-              entryPoints.web.address = ":\${HTTP_PORT}";
-
-              providers.docker.exposedByDefault = false;
-            };
-            environmentFiles = [
-              (pkgs.writeText "traefik.env" ''
-                HTTP_PORT=80
-              '')
+  nodes = {
+    client =
+      { config, pkgs, ... }:
+      {
+        environment.systemPackages = [ pkgs.curl ];
+      };
+    traefik =
+      { config, pkgs, ... }:
+      {
+        virtualisation.oci-containers = {
+          backend = "docker";
+          containers.nginx = {
+            extraOptions = [
+              "-l"
+              "traefik.enable=true"
+              "-l"
+              "traefik.http.routers.nginx.entrypoints=web"
+              "-l"
+              "traefik.http.routers.nginx.rule=Host(`nginx.traefik.test`)"
             ];
+            image = "nginx-container";
+            imageStream = pkgs.dockerTools.examples.nginxStream;
           };
-
-          systemd.services.simplehttp = {
-            script = "${pkgs.python3}/bin/python -m http.server 8000";
-            serviceConfig.Type = "simple";
-            wantedBy = [ "multi-user.target" ];
-          };
-
-          users.users.traefik.extraGroups = [ "docker" ];
         };
-    };
 
-    testScript = ''
-      start_all()
+        networking.firewall.allowedTCPPorts = [ 80 ];
 
-      traefik.wait_for_unit("docker-nginx.service")
-      traefik.wait_until_succeeds("docker ps | grep nginx-container")
-      traefik.wait_for_unit("simplehttp.service")
-      traefik.wait_for_unit("traefik.service")
-      traefik.wait_for_open_port(80)
-      traefik.wait_for_unit("multi-user.target")
+        services.traefik = {
+          enable = true;
 
-      client.wait_for_unit("multi-user.target")
+          dynamicConfigOptions = {
+            http.routers.simplehttp = {
+              rule = "Host(`simplehttp.traefik.test`)";
+              entryPoints = [ "web" ];
+              service = "simplehttp";
+            };
 
-      client.wait_until_succeeds("curl -sSf -H Host:nginx.traefik.test http://traefik/")
+            http.services.simplehttp = {
+              loadBalancer.servers = [
+                {
+                  url = "http://127.0.0.1:8000";
+                }
+              ];
+            };
+          };
 
-      with subtest("Check that a container can be reached via Traefik"):
-          assert "Hello from NGINX" in client.succeed(
-              "curl -sSf -H Host:nginx.traefik.test http://traefik/"
-          )
+          staticConfigOptions = {
+            global = {
+              checkNewVersion = false;
+              sendAnonymousUsage = false;
+            };
 
-      with subtest("Check that dynamic configuration works"):
-          assert "Directory listing for " in client.succeed(
-              "curl -sSf -H Host:simplehttp.traefik.test http://traefik/"
-          )
-    '';
-  }
-)
+            entryPoints.web.address = ":\${HTTP_PORT}";
+
+            providers.docker.exposedByDefault = false;
+          };
+          environmentFiles = [
+            (pkgs.writeText "traefik.env" ''
+              HTTP_PORT=80
+            '')
+          ];
+        };
+
+        systemd.services.simplehttp = {
+          script = "${pkgs.python3}/bin/python -m http.server 8000";
+          serviceConfig.Type = "simple";
+          wantedBy = [ "multi-user.target" ];
+        };
+
+        users.users.traefik.extraGroups = [ "docker" ];
+      };
+  };
+
+  testScript = ''
+    start_all()
+
+    traefik.wait_for_unit("docker-nginx.service")
+    traefik.wait_until_succeeds("docker ps | grep nginx-container")
+    traefik.wait_for_unit("simplehttp.service")
+    traefik.wait_for_unit("traefik.service")
+    traefik.wait_for_open_port(80)
+    traefik.wait_for_unit("multi-user.target")
+
+    client.wait_for_unit("multi-user.target")
+
+    client.wait_until_succeeds("curl -sSf -H Host:nginx.traefik.test http://traefik/")
+
+    with subtest("Check that a container can be reached via Traefik"):
+        assert "Hello from NGINX" in client.succeed(
+            "curl -sSf -H Host:nginx.traefik.test http://traefik/"
+        )
+
+    with subtest("Check that dynamic configuration works"):
+        assert "Directory listing for " in client.succeed(
+            "curl -sSf -H Host:simplehttp.traefik.test http://traefik/"
+        )
+  '';
+}

nixos/tests/varnish.nix

@@ -1,67 +1,60 @@
+{ pkgs, package, ... }:
+let
+  testPath = pkgs.hello;
+in
 {
-  system ? builtins.currentSystem,
-  pkgs ? import ../.. { inherit system; },
-  package,
-}:
-import ./make-test-python.nix (
-  { pkgs, lib, ... }:
-  let
-    testPath = pkgs.hello;
-  in
-  {
-    name = "varnish";
-    meta = {
-      maintainers = [ ];
-    };
+  name = "varnish";
+  meta = {
+    maintainers = [ ];
+  };
 
-    nodes = {
-      varnish =
-        { config, pkgs, ... }:
-        {
-          services.nix-serve = {
-            enable = true;
-          };
-
-          services.varnish = {
-            inherit package;
-            enable = true;
-            http_address = "0.0.0.0:80";
-            config = ''
-              vcl 4.0;
-
-              backend nix-serve {
-                .host = "127.0.0.1";
-                .port = "${toString config.services.nix-serve.port}";
-              }
-            '';
-          };
-
-          networking.firewall.allowedTCPPorts = [ 80 ];
-          system.extraDependencies = [ testPath ];
+  nodes = {
+    varnish =
+      { config, pkgs, ... }:
+      {
+        services.nix-serve = {
+          enable = true;
         };
 
-      client =
-        { lib, ... }:
-        {
-          nix.settings = {
-            require-sigs = false;
-            substituters = lib.mkForce [ "http://varnish" ];
-          };
+        services.varnish = {
+          inherit package;
+          enable = true;
+          http_address = "0.0.0.0:80";
+          config = ''
+            vcl 4.0;
+
+            backend nix-serve {
+              .host = "127.0.0.1";
+              .port = "${toString config.services.nix-serve.port}";
+            }
+          '';
         };
-    };
 
-    testScript = ''
-      start_all()
-      varnish.wait_for_open_port(80)
+        networking.firewall.allowedTCPPorts = [ 80 ];
+        system.extraDependencies = [ testPath ];
+      };
 
-      client.wait_until_succeeds("curl -f http://varnish/nix-cache-info");
+    client =
+      { lib, ... }:
+      {
+        nix.settings = {
+          require-sigs = false;
+          substituters = lib.mkForce [ "http://varnish" ];
+        };
+      };
+  };
 
-      client.wait_until_succeeds("nix-store -r ${testPath}")
-      client.succeed("${testPath}/bin/hello")
+  testScript = ''
+    start_all()
+    varnish.wait_for_open_port(80)
 
-      output = varnish.succeed("varnishadm status")
-      print(output)
-      assert "Child in state running" in output, "Unexpected varnishadm response"
-    '';
-  }
-)
+    client.wait_until_succeeds("curl -f http://varnish/nix-cache-info");
+
+    client.wait_until_succeeds("nix-store -r ${testPath}")
+    client.succeed("${testPath}/bin/hello")
+
+    output = varnish.succeed("varnishadm status")
+    print(output)
+    assert "Child in state running" in output, "Unexpected varnishadm response"
+  '';
+}

nixos/tests/web-apps/nifi.nix

@@ -1,34 +1,32 @@
-import ../make-test-python.nix (
-  { pkgs, ... }:
-  {
-    name = "nifi";
-    meta.maintainers = with pkgs.lib.maintainers; [ izorkin ];
+{ pkgs, ... }:
+{
+  name = "nifi";
+  meta.maintainers = with pkgs.lib.maintainers; [ izorkin ];
 
-    nodes = {
-      nifi =
-        { pkgs, ... }:
-        {
-          virtualisation = {
-            memorySize = 2048;
-            diskSize = 4096;
-          };
-          services.nifi = {
-            enable = true;
-            enableHTTPS = false;
-          };
+  nodes = {
+    nifi =
+      { pkgs, ... }:
+      {
+        virtualisation = {
+          memorySize = 2048;
+          diskSize = 4096;
         };
-    };
+        services.nifi = {
+          enable = true;
+          enableHTTPS = false;
+        };
+      };
+  };
 
-    testScript = ''
-      nifi.start()
+  testScript = ''
+    nifi.start()
 
-      nifi.wait_for_unit("nifi.service")
-      nifi.wait_for_open_port(8080)
+    nifi.wait_for_unit("nifi.service")
+    nifi.wait_for_open_port(8080)
 
-      # Check if NiFi is running
-      nifi.succeed("curl --fail http://127.0.0.1:8080/nifi/login 2> /dev/null | grep 'NiFi Login'")
+    # Check if NiFi is running
+    nifi.succeed("curl --fail http://127.0.0.1:8080/nifi/login 2> /dev/null | grep 'NiFi Login'")
 
-      nifi.shutdown()
-    '';
-  }
-)
+    nifi.shutdown()
+  '';
+}

nixos/tests/wordpress.nix

@@ -75,7 +75,7 @@ rec {
               };
             };
 
-            networking.firewall.allowedTCPPorts = [ 80 ];
+            networking.firewall.allowedTCPPorts = [ 80 443 ];
             networking.hosts."127.0.0.1" = [
               "site1.local"
               "site2.local"
@@ -106,7 +106,7 @@ rec {
             machine.wait_for_unit(f"phpfpm-wordpress-{site_name}")
 
             with subtest("website returns welcome screen"):
-                assert "Welcome to the famous" in machine.succeed(f"curl -L {site_name}")
+                assert "Welcome to the famous" in machine.succeed(f"curl -k -L {site_name}")
 
             with subtest("wordpress-init went through"):
                 info = machine.get_unit_info(f"wordpress-init-{site_name}")

pkgs/applications/audio/clementine/default.nix

@@ -49,13 +49,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "clementine";
-  version = "1.4.1-36-geea564c94";
+  version = "1.4.1-37-g3369f3085";
 
   src = fetchFromGitHub {
     owner = "clementine-player";
     repo = "Clementine";
     tag = finalAttrs.version;
-    hash = "sha256-suxYhKE8VZtEtzjzG4HgbZ4KSwYjGKMoCtXNPUFcLgk=";
+    hash = "sha256-zwt4PkCXVYJn8IsZL0JEJLX1LiAvDrNdhh0s2oDxGgY=";
   };
 
   nativeBuildInputs = [

pkgs/applications/editors/emacs/build-support/elpa2nix.el

@@ -1,6 +1,16 @@
 (require 'package)
 (package-initialize)
 
+;; TODO remove this patch when Emacs bug#77143 is fixed
+;; see that bug for more info
+(defun package--description-file (dir)
+  "Return package description file name for package DIR."
+  (concat (let ((subdir (file-name-nondirectory
+                         (directory-file-name dir))))
+            (if (string-match "\\([^.].*?\\)-\\([0-9]+\\(?:[.][0-9]+\\|\\(?:pre\\|beta\\|alpha\\|snapshot\\)[0-9]+\\)*\\)\\'" subdir)
+                (match-string 1 subdir) subdir))
+          "-pkg.el"))
+
 (defun elpa2nix-install-package ()
   (if (not noninteractive)
       (error "`elpa2nix-install-package' is to be used only with -batch"))

pkgs/applications/editors/emacs/build-support/melpa.nix

@@ -24,11 +24,14 @@ let
     src = fetchFromGitHub {
       owner = "melpa";
       repo = "package-build";
-      rev = "d5661f1f1996a893fbcbacb4d290c57acab4fb0e";
-      hash = "sha256-zVhFR2kLLkCKC+esPBbIk3qOa033YND1HF9GiNI4JM8=";
+      rev = "d1722503145facf96631ac118ec0213a73082b76";
+      hash = "sha256-utsZLm9IF9UkTwxFWvJmwA3Ox4tlMeNNTo+f/CqYJGA=";
     };
 
-    patches = [ ./package-build-dont-use-mtime.patch ];
+    prePatch = ''
+      substituteInPlace package-build.el \
+        --replace-fail '(format "--mtime=@%d" time)' '"--mtime=@0"'
+    '';
 
     dontConfigure = true;
     dontBuild = true;

pkgs/applications/editors/emacs/build-support/melpa2nix.el

@@ -12,11 +12,9 @@
   (let* ((default-directory (package-recipe--working-tree rcp)))
     (unwind-protect
         (let ((files (package-build-expand-files-spec rcp t)))
-          (unless files
-            (error "Unable to find files matching recipe patterns"))
-          (if (> (length files) 1)
-              (package-build--build-multi-file-package rcp files)
-            (package-build--build-single-file-package rcp files))))))
+          (if files
+              (funcall package-build-build-function rcp files)
+            (error "Unable to find files matching recipe patterns"))))))
 
 (defun melpa2nix-build-package ()
   (unless noninteractive

pkgs/applications/editors/emacs/build-support/package-build-dont-use-mtime.patch

@@ -1,21 +0,0 @@
-diff --git a/package-build.el b/package-build.el
-index 29cdb61..c19be1b 100644
---- a/package-build.el
-+++ b/package-build.el
-@@ -923,7 +923,6 @@ DIRECTORY is a temporary directory that contains the directory
- that is put in the tarball."
-   (let* ((name (oref rcp name))
-          (version (oref rcp version))
--         (time (oref rcp time))
-          (tar (expand-file-name (concat name "-" version ".tar")
-                                 package-build-archive-dir))
-          (dir (concat name "-" version)))
-@@ -939,7 +938,7 @@ that is put in the tarball."
-        ;; prevent a reproducible tarball as described at
-        ;; https://reproducible-builds.org/docs/archives.
-        "--sort=name"
--       (format "--mtime=@%d" time)
-+       "--mtime=@0"
-        "--owner=0" "--group=0" "--numeric-owner"
-        "--pax-option=exthdr.name=%d/PaxHeaders/%f,delete=atime,delete=ctime"))
-     (when (and package-build-verbose noninteractive)

pkgs/applications/editors/emacs/elisp-packages/manual-packages/color-theme-solarized/package.nix

@@ -6,6 +6,7 @@
 
 melpaBuild {
   pname = "color-theme-solarized";
+  ename = "solarized-theme";
   version = "0-unstable-2023-02-09";
 
   src = fetchFromGitHub {
@@ -15,6 +16,8 @@ melpaBuild {
     hash = "sha256-7E8r56dzfD06tsQEnqU5mWSbwz9x9QPbzken2J/fhlg=";
   };
 
+  files = ''(:defaults (:exclude "color-theme-solarized-pkg.el"))'';
+
   # https://github.com/NixOS/nixpkgs/issues/335408
   ignoreCompilationError = true;
 

pkgs/applications/editors/emacs/elisp-packages/manual-packages/pod-mode/package.nix

@@ -15,6 +15,7 @@ let
 in
 melpaBuild {
   inherit pname version src;
+  melpaVersion = "1.4"; # upstream versions such as 1.04 are not supported
 
   outputs = [
     "out"

pkgs/applications/editors/emacs/elisp-packages/manual-packages/session-management-for-emacs/package.nix

@@ -8,6 +8,7 @@ melpaBuild rec {
   pname = "session-management-for-emacs";
   ename = "session";
   version = "2.2a";
+  melpaVersion = "2.2"; # default value derived from version is not valid for Emacs
 
   src = fetchzip {
     url = "mirror://sourceforge/emacs-session/session-${version}.tar.gz";

pkgs/applications/editors/vim/plugins/generated.nix

@@ -11697,6 +11697,19 @@ final: prev:
     meta.hydraPlatforms = [ ];
   };
 
+  pckr-nvim = buildVimPlugin {
+    pname = "pckr.nvim";
+    version = "2025-03-30";
+    src = fetchFromGitHub {
+      owner = "lewis6991";
+      repo = "pckr.nvim";
+      rev = "d299abb91f2cf1aa0e4733dfd76ed2f98b915e55";
+      sha256 = "17n71x66vpixialjpx8hayknn3f6h2crbcpmn3chxfczsjvqkhhz";
+    };
+    meta.homepage = "https://github.com/lewis6991/pckr.nvim/";
+    meta.hydraPlatforms = [ ];
+  };
+
   pear-tree = buildVimPlugin {
     pname = "pear-tree";
     version = "2024-11-29";

pkgs/applications/editors/vim/plugins/non-generated/cord-nvim/default.nix

@@ -1,58 +1,57 @@
 {
   lib,
-  stdenv,
   fetchFromGitHub,
-  nix-update-script,
   rustPlatform,
+  versionCheckHook,
+  nix-update-script,
   vimUtils,
 }:
 let
-  version = "1.0.0";
+  version = "2.2.3";
   src = fetchFromGitHub {
     owner = "vyfor";
     repo = "cord.nvim";
     tag = "v${version}";
-    hash = "sha256-rA3R9SO3QRLGBVHlT5NZLtQw+EmkkmSDO/K6DdNtfBI=";
+    hash = "sha256-MhUjQxwATAGxIC8ACNDFDm249GzX4Npq3S+sHoUMuos=";
   };
-  extension = if stdenv.hostPlatform.isDarwin then "dylib" else "so";
-  cord-nvim-rust = rustPlatform.buildRustPackage {
-    pname = "cord.nvim-rust";
-    inherit version src;
+  cord-server = rustPlatform.buildRustPackage {
+    pname = "cord";
+    version = "2.2.3";
+    inherit src;
+
+    # The version in .github/server-version.txt differs from the one in Cargo.toml
+    postPatch = ''
+      substituteInPlace .github/server-version.txt \
+        --replace-fail "2.0.0-beta.30" "${version}"
+    '';
 
     useFetchCargoVendor = true;
-    cargoHash = "sha256-UJdSQNaYaZxvmfuHwePzGhQ3Pv+Cm7YaRK1L0CJhtEc=";
+    cargoHash = "sha256-hKt9d2u/tlD7bgo49O8oHDLljRvad9dEpGdFt+LH6Ec=";
 
-    installPhase =
-      let
-        cargoTarget = stdenv.hostPlatform.rust.cargoShortTarget;
-      in
-      ''
-        install -D target/${cargoTarget}/release/libcord.${extension} $out/lib/cord.${extension}
-      '';
+    # cord depends on nightly features
+    RUSTC_BOOTSTRAP = 1;
+
+    nativeInstallCheckInputs = [
+      versionCheckHook
+    ];
+    versionCheckProgramArg = "--version";
+    doInstallCheck = false;
+
+    meta.mainProgram = "cord";
   };
 in
 vimUtils.buildVimPlugin {
   pname = "cord.nvim";
   inherit version src;
 
-  nativeBuildInputs = [
-    cord-nvim-rust
-  ];
-
-  buildPhase = ''
-    runHook preBuild
-
-    install -D ${cord-nvim-rust}/lib/cord.${extension} cord.${extension}
-
-    runHook postBuild
-  '';
-
-  installPhase = ''
-    runHook preInstall
-
-    install -D cord $out/lua/cord.${extension}
-
-    runHook postInstall
+  # Patch the logic used to find the path to the cord server
+  # This still lets the user set config.advanced.server.executable_path
+  # https://github.com/vyfor/cord.nvim/blob/v2.2.3/lua/cord/server/fs/init.lua#L10-L15
+  postPatch = ''
+    substituteInPlace lua/cord/server/fs/init.lua \
+      --replace-fail \
+        "or M.get_data_path()" \
+        "'${cord-server}'"
   '';
 
   passthru = {
@@ -61,11 +60,13 @@ vimUtils.buildVimPlugin {
     };
 
     # needed for the update script
-    inherit cord-nvim-rust;
+    inherit cord-server;
   };
 
   meta = {
     homepage = "https://github.com/vyfor/cord.nvim";
     license = lib.licenses.asl20;
+    changelog = "https://github.com/vyfor/cord.nvim/releases/tag/v${version}";
+    maintainers = with lib.maintainers; [ GaetanLepage ];
   };
 }

pkgs/applications/editors/vim/plugins/nvim-treesitter/generated.nix

@@ -2021,12 +2021,12 @@
   };
   ocamllex = buildGrammar {
     language = "ocamllex";
-    version = "0.0.0+rev=c5cf996";
+    version = "0.0.0+rev=5da5bb7";
     src = fetchFromGitHub {
       owner = "atom-ocaml";
       repo = "tree-sitter-ocamllex";
-      rev = "c5cf996c23e38a1537069fbe2d4bb83a75fc7b2f";
-      hash = "sha256-eDJRTLYKHcL7yAgFL8vZQh9zp5fBxcZRsWChp8y3Am0=";
+      rev = "5da5bb7508ac9fd3317561670ef18c126a0fe2aa";
+      hash = "sha256-qfmIfcZ3zktYzuNNYP7Z6u6c7XoKsKD86MRMxe/qkpY=";
     };
     generate = true;
     meta.homepage = "https://github.com/atom-ocaml/tree-sitter-ocamllex";

pkgs/applications/editors/vim/plugins/vim-plugin-names

@@ -897,6 +897,7 @@ https://github.com/roobert/palette.nvim/,HEAD,
 https://github.com/NLKNguyen/papercolor-theme/,,
 https://github.com/pappasam/papercolor-theme-slim/,HEAD,
 https://github.com/dundalek/parpar.nvim/,,
+https://github.com/lewis6991/pckr.nvim/,HEAD,
 https://github.com/tmsvg/pear-tree/,,
 https://github.com/steelsojka/pears.nvim/,,
 https://github.com/olimorris/persisted.nvim/,HEAD,

pkgs/applications/editors/vscode/extensions/default.nix

@@ -257,8 +257,8 @@ let
         mktplcRef = {
           name = "ng-template";
           publisher = "Angular";
-          version = "19.2.1";
-          hash = "sha256-X4ZDKgUyoBU8LIh+aM3JyvqGE9LnXVhvOXtAdX6gUv4=";
+          version = "19.2.2";
+          hash = "sha256-WoNrKcK9Gr9gVWH/pwKyEUHuzcVNKh6zQwwpG4BuVCg=";
         };
         meta = {
           changelog = "https://marketplace.visualstudio.com/items/Angular.ng-template/changelog";
@@ -524,8 +524,8 @@ let
         mktplcRef = {
           name = "vscode-bazel";
           publisher = "bazelbuild";
-          version = "0.10.0";
-          sha256 = "sha256-8SUOzsUmfgt9fAy037qLVNrGJPvTnIeMNz2tbN5psbs=";
+          version = "0.11.0";
+          sha256 = "sha256-c1Uvu9qBsQabdfhNxG0tCmCq3ub3wfgdoGor0cATo0c=";
         };
         meta = {
           description = "Bazel support for Visual Studio Code";
@@ -720,8 +720,8 @@ let
         mktplcRef = {
           publisher = "bmalehorn";
           name = "vscode-fish";
-          version = "1.0.38";
-          hash = "sha256-QEifCTlzYMX+5H6+k2o1lsQrhW3vxVpn+KFg/3WVVFo=";
+          version = "1.0.39";
+          hash = "sha256-T5wD4btQ2HSq3vB1m/qHM7VcvHfZmMD9OV93ZwxXcQg=";
         };
         meta = {
           changelog = "https://marketplace.visualstudio.com/items/bmalehorn.vscode-fish/changelog";
@@ -781,8 +781,8 @@ let
         mktplcRef = {
           name = "vscode-tailwindcss";
           publisher = "bradlc";
-          version = "0.14.11";
-          hash = "sha256-sZcbUIAs4m96rBfYJbyZegqAqL71+OjVykqna+QMdu0=";
+          version = "0.14.12";
+          hash = "sha256-Dn+Z5uZYoWSriNnkYK1rRoHv8sjr7ui70UeTA3e0wIs=";
         };
         meta = {
           changelog = "https://marketplace.visualstudio.com/items/bradlc.vscode-tailwindcss/changelog";
@@ -877,8 +877,8 @@ let
           mktplcRef = {
             name = "catppuccin-vsc";
             publisher = "catppuccin";
-            version = "3.16.1";
-            hash = "sha256-qEwQ583DW17dlJbODN8SNUMbDMCR1gUH4REaFkQT65I=";
+            version = "3.17.0";
+            hash = "sha256-udDbsXAEsJUt3WUU8aBvCi8Pu+8gu+xQkimlmvRZ9pg=";
           };
           meta = {
             changelog = "https://marketplace.visualstudio.com/items/Catppuccin.catppuccin-vsc/changelog";
@@ -1424,8 +1424,8 @@ let
         mktplcRef = {
           name = "profiler-php-vscode";
           publisher = "devsense";
-          version = "1.41.14332";
-          hash = "sha256-u2lNqG6FUhWnnNGtv+sjTbP/hbu4Da/8xjLzmPZkZOA=";
+          version = "1.57.17031";
+          hash = "sha256-fC+8trGmvgYjsnJA6+L6sxFoE6Cr91Q7xdparE9JKyg=";
         };
         meta = {
           changelog = "https://marketplace.visualstudio.com/items/DEVSENSE.profiler-php-vscode/changelog";
@@ -1725,8 +1725,8 @@ let
         mktplcRef = {
           name = "elm-ls-vscode";
           publisher = "Elmtooling";
-          version = "2.6.0";
-          hash = "sha256-iNFc7YJFl3d4/BJE9TPJfL0iqEkUtyEyVt4v1J2bXts=";
+          version = "2.8.0";
+          hash = "sha256-81tHgNjYc0LJjsgsQfo5xyh20k/i3PKcgYp9GZTvwfs=";
         };
         meta = {
           changelog = "https://marketplace.visualstudio.com/items/Elmtooling.elm-ls-vscode/changelog";
@@ -1830,8 +1830,8 @@ let
         mktplcRef = {
           name = "vscode-open-in-github";
           publisher = "fabiospampinato";
-          version = "2.3.0";
-          hash = "sha256-vrW6uZyeEJipGtfz7BEeeAwiwtBlfQLjC7jAP1v5GoE=";
+          version = "2.3.1";
+          hash = "sha256-wqY8AArlTpQzoZ9OfV9MzlHIr9M/Ac4QUZL99n327EI=";
         };
         meta = {
           changelog = "https://marketplace.visualstudio.com/items/fabiospampinato.vscode-open-in-github/changelog";
@@ -1914,8 +1914,8 @@ let
         mktplcRef = {
           name = "foam-vscode";
           publisher = "foam";
-          version = "0.26.8";
-          hash = "sha256-DI0iPx/Wan3cgUCWgRvXt0uESCIJBR6lF3y/TRgYFnc=";
+          version = "0.26.10";
+          hash = "sha256-vhQtdc0553TyPkQnTHwg7Nr+UbDMf9yR+2jj40ANPdQ=";
         };
         meta = {
           changelog = "https://marketplace.visualstudio.com/items/foam.foam-vscode/changelog";
@@ -2038,8 +2038,8 @@ let
         mktplcRef = {
           name = "godot-tools";
           publisher = "geequlim";
-          version = "2.3.0";
-          hash = "sha256-iuSec4PoVxyu1KB2jfCYOd98UrqQjH3q24zOR4VCPgs=";
+          version = "2.5.1";
+          hash = "sha256-kAzRSNZw1zaECblJv7NzXnE2JXSy9hzdT2cGX+uwleY=";
         };
         meta = {
           description = "VS Code extension for game development with Godot Engine and GDScript";
@@ -2078,8 +2078,8 @@ let
         mktplcRef = {
           name = "chatgpt-vscode";
           publisher = "genieai";
-          version = "0.0.8";
-          sha256 = "RKvmZkegFs4y+sEVaamPRO1F1E+k4jJyI0Q9XqKowrQ=";
+          version = "0.0.13";
+          sha256 = "sha256-aoVICzU5sfA96FCU4ysUGmULruGWLaVo2lFpiPhdtGA=";
         };
       };
 
@@ -2105,8 +2105,8 @@ let
           publisher = "github";
           name = "copilot";
           # Verify which version is available with nix run nixpkgs#vsce -- show github.copilot --json
-          version = "1.292.0";
-          hash = "sha256-bgyDMEbIceTGtZ6CqUehkJLMAL8Osega6kMwb+buTAU=";
+          version = "1.293.0";
+          hash = "sha256-LwgINocPHA9jL6pMw40BgaZ3lOUwWPoOJWTDr+27h5Q=";
         };
 
         meta = {
@@ -2199,8 +2199,8 @@ let
         mktplcRef = {
           name = "gleam";
           publisher = "gleam";
-          version = "2.3.0";
-          hash = "sha256-dhRS8fLKY0plRwnrAUWT4g/LfH6IpODTNhT79g4Nm+0=";
+          version = "2.11.1";
+          hash = "sha256-tySY6vPg71QQKeKivCoJzcAH73nML/NWhtr+TgaSKRg=";
         };
         meta = {
           description = "Support for the Gleam programming language";
@@ -2263,8 +2263,8 @@ let
         mktplcRef = {
           name = "vscode-graphql-syntax";
           publisher = "GraphQL";
-          version = "1.3.6";
-          hash = "sha256-74Y/LpOhAj3TSplohhJqBwJDT87nCAiKrWsF90bc8jU=";
+          version = "1.3.8";
+          hash = "sha256-10x2kX9Gc7O/tGRDPZfy1cKdCIvGTCXcD2bDokIz7TU=";
         };
         meta = {
           description = "Adds full GraphQL syntax highlighting and language support such as bracket matching";
@@ -2622,8 +2622,8 @@ let
         mktplcRef = {
           name = "latex-workshop";
           publisher = "James-Yu";
-          version = "10.8.0";
-          sha256 = "sha256-tdQ3Z/OfNH0UgpHcn8Zq5rQxoetD61dossEh8hRygew=";
+          version = "10.9.0";
+          sha256 = "sha256-hexky9ZZt+u0H8HVcNiI2Jmx9HL5+uKHLVBNqEbgqLo=";
         };
         meta = {
           changelog = "https://marketplace.visualstudio.com/items/James-Yu.latex-workshop/changelog";
@@ -3283,8 +3283,8 @@ let
         mktplcRef = {
           name = "goto-next-previous-member";
           publisher = "mishkinf";
-          version = "0.0.6";
-          sha256 = "07rpnbkb51835gflf4fpr0v7fhj8hgbhsgcz2wpag8wdzdxc3025";
+          version = "0.0.10";
+          sha256 = "sha256-mRPWEU/M5uhiDUl9KwQi6w5hfzIZxKMhO48ssVfICoQ=";
         };
         meta = {
           license = lib.licenses.mit;
@@ -3512,8 +3512,8 @@ let
         mktplcRef = {
           name = "anycode";
           publisher = "ms-vscode";
-          version = "0.0.73";
-          hash = "sha256-83qz4wYnRK/KtrQMHwMAFhOnVyLXG1/EwUvVW2v30ho=";
+          version = "0.0.74";
+          hash = "sha256-rTWAOvIsrl0DSqxoQy5eU6EREJovU1oRMC8/2Q6x4Hk=";
         };
         meta = {
           license = lib.licenses.mit;
@@ -3756,8 +3756,8 @@ let
         mktplcRef = {
           name = "color-highlight";
           publisher = "naumovs";
-          version = "2.6.0";
-          hash = "sha256-TcPQOAHCYeFHPdR85GIXsy3fx70p8cLdO2UNO0krUOs=";
+          version = "2.8.0";
+          hash = "sha256-mT2P1lEdW66YkDRN6fi0rmmvvyBfXiJjAUHns8a8ipE=";
         };
         meta = {
           changelog = "https://marketplace.visualstudio.com/items/naumovs.color-highlight/changelog";
@@ -4433,8 +4433,8 @@ let
         mktplcRef = {
           publisher = "shopify";
           name = "ruby-lsp";
-          version = "0.9.12";
-          hash = "sha256-ahfVRbTAKmmqOWV7vHK0+KLwYSUVgKqlIG1+lV3E5c4=";
+          version = "0.9.13";
+          hash = "sha256-Lde17QPuaubrvomwZjWA9f34/Dn0qyG5MQxMLJFWBQ8=";
         };
         meta = {
           description = "VS Code plugin for connecting with the Ruby LSP";
@@ -4678,8 +4678,8 @@ let
         mktplcRef = {
           name = "vscode-stylelint";
           publisher = "stylelint";
-          version = "1.4.0";
-          hash = "sha256-CsQBRoVDtNLlkHa6NLmOspkswB/JUMfMuU2dMYDlDnc=";
+          version = "1.5.0";
+          hash = "sha256-SHUb7+eL0PWlw/KUidXPvE5+MFsJz1Fi7Csptiw8j4M=";
         };
         meta = {
           description = "Official Stylelint extension for Visual Studio Code";
@@ -4751,8 +4751,8 @@ let
         mktplcRef = {
           name = "tabnine-vscode";
           publisher = "tabnine";
-          version = "3.247.0";
-          hash = "sha256-TOpdiqkOUmC+CXJn0H3+NYqTHkeuNf2Y37F0OgN6YzM=";
+          version = "3.249.0";
+          hash = "sha256-Pp1LlVAkozh2kIEvmPxg4LuuT08MeGbMN77M5Mx81qI=";
         };
         meta = {
           license = lib.licenses.mit;
@@ -5201,8 +5201,8 @@ let
         mktplcRef = {
           name = "vstuc";
           publisher = "VisualStudioToolsForUnity";
-          version = "1.1.0";
-          hash = "sha256-86KDksbTKlPgKC1joUc7uQTsDe2w9AIL0fekZP0z6gE=";
+          version = "1.1.1";
+          hash = "sha256-iE/o6hkDwT7jLTVvJbviQZgV+KnhSAGEZ2mf3gsua38=";
         };
         meta = {
           description = "Integrates Visual Studio Code for Unity";
@@ -5344,8 +5344,8 @@ let
         mktplcRef = {
           name = "vscode-icons";
           publisher = "vscode-icons-team";
-          version = "12.11.0";
-          hash = "sha256-RpuCHJBLqhAXAdvC0qGDUJIy5ww1yqlSb7hKwCALidM=";
+          version = "12.12.0";
+          hash = "sha256-C73ZpmVJ9ltzbfV3LmawV2X/2e+e1F3dxaYZzKMBZdQ=";
         };
         meta = {
           description = "Bring real icons to your Visual Studio Code";
@@ -5681,8 +5681,8 @@ let
         mktplcRef = {
           name = "vscode-zig";
           publisher = "ziglang";
-          version = "0.6.6";
-          hash = "sha256-UxbCRsTp7Fz6iAeC3lwojWrLPMJx5b7cNXxOFY7k0pk=";
+          version = "0.6.7";
+          hash = "sha256-l8pu348v2JUg/7+Qy5B41eyraPUj9WQ1WuW1aumgM9w=";
         };
         meta = {
           changelog = "https://marketplace.visualstudio.com/items/ziglang.vscode-zig/changelog";

pkgs/applications/editors/vscode/extensions/language-packs.nix

@@ -1,4 +1,10 @@
-{ lib, vscode-utils }:
+{
+  lib,
+  vscode-utils,
+  writeShellScript,
+  nix-update,
+  vscode-extensions-update,
+}:
 
 with vscode-utils;
 
@@ -7,15 +13,23 @@ let
   buildVscodeLanguagePack =
     {
       language,
-      version ? "1.76.2023030809",
-      sha256,
+      version ? "1.98.2025031209",
+      hash,
     }:
     buildVscodeMarketplaceExtension {
       mktplcRef = {
         name = "vscode-language-pack-${language}";
         publisher = "MS-CEINTL";
-        inherit version sha256;
+        inherit version hash;
       };
+      passthru.updateScript = lib.optionalAttrs (language == "fr") (
+        writeShellScript "vscode-language-packs-update-script" ''
+          ${lib.getExe vscode-extensions-update} vscode-extensions.ms-ceintl.vscode-language-pack-fr --override-filename "pkgs/applications/editors/vscode/extensions/language-packs.nix"
+          for lang in cs de es it ja ko pt-br qps-ploc ru tr zh-hans zh-hant; do
+            ${lib.getExe nix-update} --version "skip" "vscode-extensions.ms-ceintl.vscode-language-pack-$lang" --override-filename "pkgs/applications/editors/vscode/extensions/language-packs.nix"
+          done
+        ''
+      );
       meta = {
         license = lib.licenses.mit;
       };
@@ -27,66 +41,66 @@ in
   # French
   vscode-language-pack-fr = buildVscodeLanguagePack {
     language = "fr";
-    sha256 = "19brasjwwgdskgwayclmsywf007i2d47vx7dwq6hq2bhx4rd6xfy";
+    hash = "sha256-ulFnHulIa1T+WdlXa000cYDY/SWGcA9W/uLZrP5l40Q=";
   };
   # Italian
   vscode-language-pack-it = buildVscodeLanguagePack {
     language = "it";
-    sha256 = "1s5x3w125fliimr0i218mars4xjl70hsz0ihxrjk97c66yzg3gw7";
+    hash = "sha256-o9EwOKuFVqB1gJvCh4S5ArwQDN21a3zhLBsCpeztUhU=";
   };
   # German
   vscode-language-pack-de = buildVscodeLanguagePack {
     language = "de";
-    sha256 = "0ih8h3n5mcadclxxlrgajq7kprgj9fbklccc00r0z8vqnmlc0dw0";
+    hash = "sha256-x20EJ6YfMT59bk8o8LYDqQgyOmI1NH/Jq2zjtrUHOt8=";
   };
   # Spanish
   vscode-language-pack-es = buildVscodeLanguagePack {
     language = "es";
-    sha256 = "077n4mlx9qxqlp018wfi6hm3syhxsp2xzyih42kpsp71xi8j113r";
+    hash = "sha256-MerP4/WBKj/TauDnQcWv0YCFh9JA1ce0jHiFAvt5NdI=";
   };
   # Russian
   vscode-language-pack-ru = buildVscodeLanguagePack {
     language = "ru";
-    sha256 = "04mdxspm8i1dra0qmim4n4qin050adm2zk9pcnn3z4qbf3yvvnf4";
+    hash = "sha256-0Z4jSiP16EDFyHwQAgvFpMh5F8tCu74hUojXH5EK66o=";
   };
   # Chinese (Simplified)
   vscode-language-pack-zh-hans = buildVscodeLanguagePack {
     language = "zh-hans";
-    sha256 = "0f2bg5nm4sybwf84afvhc22yjp66rzdz4s1iaa31yxb4c1ij2vsr";
+    hash = "sha256-CQtb7FJGR2JVznbEYVN76IywQopwZ6TzWjxE1as7WWE=";
   };
   # Chinese (Traditional)
   vscode-language-pack-zh-hant = buildVscodeLanguagePack {
     language = "zh-hant";
-    sha256 = "1dspg6x7n9b89cirf63m2y0p6r2m197qzgvvavqfm7bv6cpskha0";
+    hash = "sha256-LmBcWZlyAVvXoa5sZ4gpWBkBZD+5AKkFZqSs4zXkCwc=";
   };
   # Japanese
   vscode-language-pack-ja = buildVscodeLanguagePack {
     language = "ja";
-    sha256 = "1idiv9xqfqhz1y3pd4h3ayy3svccr4jhrm23nf9h80g38k74qayi";
+    hash = "sha256-4tj4wTCOnC2KpHWN86EZl5KmNl2QLXb7Co1aYwRZ7uY=";
   };
   # Korean
   vscode-language-pack-ko = buildVscodeLanguagePack {
     language = "ko";
-    sha256 = "0g980sfa386by741sxxlapc2cjsbkfvldcc5kylxvf2drigyvka7";
+    hash = "sha256-NmSSijvWckFiyyQBo+2Lv70YsqOYR/5kHP4iiqaQUZU=";
   };
   # Czech
   vscode-language-pack-cs = buildVscodeLanguagePack {
     language = "cs";
-    sha256 = "0sm3xxiv8lrln051yjq6s5jmpvkbphv1i90lrx472pwknmiwx74a";
+    hash = "sha256-Q8jSCYzl/DXasi0n228Kd7Ru0z1Bb/ovTySAYCV42pg=";
   };
   # Portuguese (Brazil)
   vscode-language-pack-pt-br = buildVscodeLanguagePack {
     language = "pt-BR";
-    sha256 = "1k4y528im6sr8n4blh6k4xng4d534siaaflvnarizs3py9wa61d1";
+    hash = "sha256-PJPeTn+0g1s+L7t9d6A/hyrBEF0EE/QKshHa3vuQZxU=";
   };
   # Turkish
   vscode-language-pack-tr = buildVscodeLanguagePack {
     language = "tr";
-    sha256 = "1yf59idj6g77sqkm46bdadklvbvb3ncxzd9mfm9y32h54fxffh6a";
+    hash = "sha256-+M43EdHHsmw1pJopLi0nMIGwcxk6+LeVvZjkxnxUatI=";
   };
   # Pseudo Language
   vscode-language-pack-qps-ploc = buildVscodeLanguagePack {
     language = "qps-ploc";
-    sha256 = "1dmn58fx8mpbn84zqyy09a1j67b5988gn7xjmfdk73bbd7hzbmji";
+    hash = "sha256-2ERwup1z7wGVwoGfakV0oCADxXWfWbYxlkQ6iJYgXkc=";
   };
 }

pkgs/applications/editors/vscode/extensions/ms-pyright.pyright/default.nix

@@ -7,8 +7,8 @@ vscode-utils.buildVscodeMarketplaceExtension {
   mktplcRef = {
     publisher = "ms-pyright";
     name = "pyright";
-    version = "1.1.397";
-    hash = "sha256-Z6iKOgAglxDdPz9D4pL1STj3+uy8S89oOalqfdV1reI=";
+    version = "1.1.398";
+    hash = "sha256-fSBn4c1e1e4atJUV6STmEYB/++WXZFsN2v5+zyfYnZA=";
   };
 
   meta = {

pkgs/applications/editors/vscode/extensions/saoudrizwan.claude-dev/default.nix

@@ -7,8 +7,8 @@ vscode-utils.buildVscodeMarketplaceExtension {
   mktplcRef = {
     name = "claude-dev";
     publisher = "saoudrizwan";
-    version = "3.8.3";
-    hash = "sha256-0FAxQ67AKcSbCp8vQr2KUOIRw8LEQ3TQyJkfJwtmdoY=";
+    version = "3.8.4";
+    hash = "sha256-Ona7JntYaHbh7/1Q3Y+7UxmI+X0H93Y/cIW73DXxA1M=";
   };
 
   meta = {

pkgs/applications/emulators/cdemu/libmirage.nix

@@ -20,9 +20,9 @@
 let
   inherit
     (callPackage ./common-drv-attrs.nix {
-      version = "3.2.9";
+      version = "3.2.10";
       pname = "libmirage";
-      hash = "sha256-JBd+wHSZRyRW1SZsaAaRO2dNUFkpwRCr3s1f39KyWIs=";
+      hash = "sha256-+T5Gu3VcprCkSJcq/kTySRnNI7nc+GbRtctLkzPhgK4=";
     })
     pname
     version

pkgs/applications/emulators/cdemu/vhba.nix

@@ -8,11 +8,11 @@
 
 stdenv.mkDerivation rec {
   pname = "vhba";
-  version = "20240917";
+  version = "20250329";
 
   src = fetchurl {
     url = "mirror://sourceforge/cdemu/vhba-module-${version}.tar.xz";
-    hash = "sha256-zjTLriw2zvjX0Jxfa9QtaHG5tTC7cLTKEA+WSCP+Dpg=";
+    hash = "sha256-piog1yDd8M/lpTIo9FE9SY2JwurZ6a8LG2lZ/4EmB14=";
   };
 
   makeFlags = kernelModuleMakeFlags ++ [

pkgs/applications/emulators/wine/sources.nix

@@ -69,9 +69,9 @@ in rec {
 
   unstable = fetchurl rec {
     # NOTE: Don't forget to change the hash for staging as well.
-    version = "10.3";
+    version = "10.4";
     url = "https://dl.winehq.org/wine/source/10.x/wine-${version}.tar.xz";
-    hash = "sha256-3j2I/wBWuC/9/KhC8RGVkuSRT0jE6gI3aOBBnDZGfD4=";
+    hash = "sha256-oJAZzlxCuga6kexCPUnY8qmo6sTBqSMMc+HRGWOdXpI=";
     inherit (stable) patches;
 
     ## see http://wiki.winehq.org/Gecko
@@ -88,9 +88,9 @@ in rec {
 
     ## see http://wiki.winehq.org/Mono
     mono = fetchurl rec {
-      version = "9.4.0";
+      version = "10.0.0";
       url = "https://dl.winehq.org/wine/wine-mono/${version}/wine-mono-${version}-x86.msi";
-      hash = "sha256-z2FzrpS3np3hPZp0zbJWCohvw9Jx+Uiayxz9vZYcrLI=";
+      hash = "sha256-26ynPl0J96OnwVetBCia+cpHw87XAS1GVEpgcEaQK4c=";
     };
 
     updateScript = writeShellScript "update-wine-unstable" ''
@@ -117,7 +117,7 @@ in rec {
   staging = fetchFromGitLab rec {
     # https://gitlab.winehq.org/wine/wine-staging
     inherit (unstable) version;
-    hash = "sha256-H52ZM+eA0bZPHFlP+uXew7JtOH29BZcXr8hvsqPDtig=";
+    hash = "sha256-LteUANxr+w1N9r6LNztjRfr3yXtJnUMi0uayTRtFoSU=";
     domain = "gitlab.winehq.org";
     owner = "wine";
     repo = "wine-staging";

pkgs/applications/misc/blender/draco.patch

@@ -1,33 +0,0 @@
-diff --git a/CMakeLists.txt b/CMakeLists.txt
-index 97596dbee8d..d1ad6ac5de0 100644
---- a/CMakeLists.txt
-+++ b/CMakeLists.txt
-@@ -1237,13 +1237,6 @@ set_and_warn_dependency(WITH_PYTHON WITH_CYCLES        OFF)
- set_and_warn_dependency(WITH_PYTHON WITH_DRACO         OFF)
- set_and_warn_dependency(WITH_PYTHON WITH_MOD_FLUID     OFF)
- 
--if(NOT WITH_PYTHON_MODULE)
--  if(WITH_DRACO AND NOT WITH_PYTHON_INSTALL)
--    message(STATUS "WITH_DRACO requires WITH_PYTHON_INSTALL to be ON, disabling WITH_DRACO for now")
--    set(WITH_DRACO OFF)
--  endif()
--endif()
--
- # enable boost for cycles, audaspace or i18n
- # otherwise if the user disabled
- 
-diff --git a/scripts/addons_core/io_scene_gltf2/io/com/draco.py b/scripts/addons_core/io_scene_gltf2/io/com/draco.py
-index 75e23162c67..875596c3d2f 100644
---- a/scripts/addons_core/io_scene_gltf2/io/com/draco.py
-+++ b/scripts/addons_core/io_scene_gltf2/io/com/draco.py
-@@ -31,8 +31,8 @@ def dll_path() -> Path:
-     :return: DLL path.
-     """
-     lib_name = 'extern_draco'
--    blender_root = Path(bpy.app.binary_path).parent
--    python_lib = Path('{v[0]}.{v[1]}/python/lib'.format(v=bpy.app.version))
-+    blender_root = Path(bpy.app.binary_path).parent.parent
-+    python_lib = Path('share/blender/{v[0]}.{v[1]}/python/lib'.format(v=bpy.app.version))
-     python_version = 'python{v[0]}.{v[1]}'.format(v=sys.version_info)
- 
-     path = os.environ.get('BLENDER_EXTERN_DRACO_LIBRARY_PATH')

pkgs/applications/misc/klayout/default.nix

@@ -5,13 +5,13 @@
 
 mkDerivation rec {
   pname = "klayout";
-  version = "0.29.12";
+  version = "0.30.0";
 
   src = fetchFromGitHub {
     owner = "KLayout";
     repo = "klayout";
     rev = "v${version}";
-    hash = "sha256-TLLAIlZYKGeQENtzfc9ilWwl4yu2ln7yBy+VW7Zwexc=";
+    hash = "sha256-i7MQqkVf+NZkmcf589BpLofwqc5KGxRNqdr1Go84M9A=";
   };
 
   postPatch = ''

pkgs/applications/networking/cluster/terraform-providers/providers.json

@@ -45,11 +45,11 @@
     "vendorHash": "sha256-NO7e8S+UhbbGWeBm4+bzm6HqqA3G3WZwj3wJmug0aSA="
   },
   "alicloud": {
-    "hash": "sha256-cZUOABxdartcPnDSXR7K+tbQtum89Uk/r4kG0jVlgAM=",
+    "hash": "sha256-Jn4VzU6aPhMv6eMmXQ5gD5SA9IZfpmkRKpTrjRGrNF8=",
     "homepage": "https://registry.terraform.io/providers/aliyun/alicloud",
     "owner": "aliyun",
     "repo": "terraform-provider-alicloud",
-    "rev": "v1.245.0",
+    "rev": "v1.246.2",
     "spdx": "MPL-2.0",
     "vendorHash": null
   },
@@ -354,11 +354,11 @@
     "vendorHash": "sha256-quoFrJbB1vjz+MdV+jnr7FPACHuUe5Gx9POLubD2IaM="
   },
   "digitalocean": {
-    "hash": "sha256-smGK6ZRcKMf5Wcxd7Sv6LQkbT6swVNOK0o0JbeNacY0=",
+    "hash": "sha256-jReUOuoRybh8g4smxy7QCkJEgUzDnaKhj7VO5ShSGsc=",
     "homepage": "https://registry.terraform.io/providers/digitalocean/digitalocean",
     "owner": "digitalocean",
     "repo": "terraform-provider-digitalocean",
-    "rev": "v2.49.1",
+    "rev": "v2.50.0",
     "spdx": "MPL-2.0",
     "vendorHash": null
   },
@@ -426,11 +426,11 @@
     "vendorHash": "sha256-aTQreRL0UTMYWLs25qsdwdN+PaJcOHwLRA8CjIAsYi0="
   },
   "exoscale": {
-    "hash": "sha256-fD2PQ/WNmifAlY27V0y47wDWEfhCXql0b1y8J5uSkNk=",
+    "hash": "sha256-SL0O4hRVeLqxDEsh/BUZLUsypLPlvD7Z0ozr+RPuuv4=",
     "homepage": "https://registry.terraform.io/providers/exoscale/exoscale",
     "owner": "exoscale",
     "repo": "terraform-provider-exoscale",
-    "rev": "v0.63.0",
+    "rev": "v0.64.0",
     "spdx": "MPL-2.0",
     "vendorHash": null
   },
@@ -507,13 +507,13 @@
     "vendorHash": "sha256-1KTU8nMYUfC+LJHFeIpK6m4RUPWvSHNSXGVJgcnsVl8="
   },
   "google": {
-    "hash": "sha256-9xieQT5yY1h52/tksEmX9iYXtDjYxkSL/pvC2XPXN/4=",
+    "hash": "sha256-yiTTC9URf0A3AHHv7jUc9Y6cgxFkFspvx2NYB1HPKS4=",
     "homepage": "https://registry.terraform.io/providers/hashicorp/google",
     "owner": "hashicorp",
     "repo": "terraform-provider-google",
-    "rev": "v6.25.0",
+    "rev": "v6.27.0",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-kzugr8EaPROHy/3IVOsGkitpTixuiOw8R6kYedIrIuw="
+    "vendorHash": "sha256-oGO+++WMiXUTCLFdBH2/uAzdN3RtrSNDSUBVMIYmI14="
   },
   "google-beta": {
     "hash": "sha256-FybWpnUBQCxY1XQNSCk4slUg6vF8XDW1uQwgF0a2PgQ=",
@@ -1129,13 +1129,13 @@
     "vendorHash": "sha256-Ry791h5AuYP03nex9nM8X5Mk6PeL7hNDbFyVRvVPJNE="
   },
   "scaleway": {
-    "hash": "sha256-5sLi0W5SKgaY8y85aFcVE/TE87SxpkGfhwYRF9fPf94=",
+    "hash": "sha256-9ZdQi1Z1IfidVrqD8vQqmV7lyGalghls4/KJSoX3Kzw=",
     "homepage": "https://registry.terraform.io/providers/scaleway/scaleway",
     "owner": "scaleway",
     "repo": "terraform-provider-scaleway",
-    "rev": "v2.51.0",
+    "rev": "v2.52.0",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-qIBSCRvKSfSjxM+PtcS815g0WOKHZzSK9yikXbYUWaw="
+    "vendorHash": "sha256-hXvpCjWwlk4UuvtxWznP8t3qlvzBvWlrui2VdP0Hruo="
   },
   "secret": {
     "hash": "sha256-MmAnA/4SAPqLY/gYcJSTnEttQTsDd2kEdkQjQj6Bb+A=",
@@ -1201,13 +1201,13 @@
     "vendorHash": "sha256-F1AuO/dkldEDRvkwrbq2EjByxjg3K2rohZAM4DzKPUw="
   },
   "snowflake": {
-    "hash": "sha256-enDKtqIulPbDSftkDFH783CJlTK5VyImvVpKePuZXh8=",
+    "hash": "sha256-5vhCej98gkq8rQqAfNt04fWKvjFCuNp2lUmlXJrBXCY=",
     "homepage": "https://registry.terraform.io/providers/Snowflake-Labs/snowflake",
     "owner": "Snowflake-Labs",
     "repo": "terraform-provider-snowflake",
-    "rev": "v1.0.4",
+    "rev": "v1.0.5",
     "spdx": "MIT",
-    "vendorHash": "sha256-9tHeFnNa5tnmB74p3VJtkw+ldhnDXsP5p3oTOAri1tY="
+    "vendorHash": "sha256-skswuFKhN4FFpIunbom9rM/FVRJVOFb1WwHeAIaEjn8="
   },
   "sops": {
     "hash": "sha256-MdsWKV98kWpZpTK5qC7x6vN6cODxeeiVVc+gtlh1s88=",
@@ -1309,11 +1309,11 @@
     "vendorHash": "sha256-0B2XRpvUk0mgDu3inz37LLJijwH3aQyoSb8IaHr6was="
   },
   "tencentcloud": {
-    "hash": "sha256-vWMEaA64/h1dhXJDw2kqoWgpp79ZuWP25rvfd6GiReg=",
+    "hash": "sha256-DkktMcHU0T9H/jGOq66N7n1bfBF7aDEWGYmQrzWsqr8=",
     "homepage": "https://registry.terraform.io/providers/tencentcloudstack/tencentcloud",
     "owner": "tencentcloudstack",
     "repo": "terraform-provider-tencentcloud",
-    "rev": "v1.81.174",
+    "rev": "v1.81.178",
     "spdx": "MPL-2.0",
     "vendorHash": null
   },

pkgs/applications/networking/syncthing/default.nix

@@ -59,7 +59,7 @@ let
 
       passthru = {
         tests = {
-          inherit (nixosTests) syncthing syncthing-init syncthing-relay;
+          inherit (nixosTests) syncthing syncthing-init syncthing-many-devices syncthing-no-settings syncthing-relay;
         };
         updateScript = nix-update-script { };
       };

pkgs/applications/science/electronics/kicad/versions.nix

@@ -3,23 +3,23 @@
 {
   "kicad" = {
     kicadVersion = {
-      version =			"9.0.0";
+      version =			"9.0.1";
       src = {
-        rev =			"ccafeabf1503a778a283eabe40fa0760aa5bc83c";
-        sha256 =		"0rr4k5hx4kjbfi4q3jdhamv1gjb0b1nwmmrrdg7ig18335bpw14s";
+        rev =			"eb0a9f7b5b8f26024310bd02367f8414d6c80734";
+        sha256 =		"14g4ns2fxigzz1z4chcnaz2b8f4jkdmd56mnlpdq8nld8q84hywk";
       };
     };
     libVersion = {
-      version =			"9.0.0";
+      version =			"9.0.1";
       libSources = {
-        symbols.rev =		"e1c3371228f97b36c6fd61b66d056184930f078e";
-        symbols.sha256 =	"0l8da2ix917jlsj6v5zclc1cb5pvjaxwmys0gjdv55ic31hhfyyw";
-        templates.rev =		"3ed4538b0f965d821df63a5fffc4441e723cfe7f";
+        symbols.rev =		"f8789bb729b5ed7ddc6a45b68563157e3a070944";
+        symbols.sha256 =	"1q8vq4dwnhryizidx0s3x8p4yjhj3hbjhd40zy1pynkf1p174d7n";
+        templates.rev =		"793b29a36c6b11a11d3bb417cf508a48b8c6ebb8";
         templates.sha256 =	"0zs29zn8qjgxv0w1vyr8yxmj02m8752zagn4vcraqgik46dwg2id";
-        footprints.rev =	"ef91963f57028aa095f2d0c4239ba994ea822f73";
-        footprints.sha256 =	"16zslgvjg4swgkkvnd9fmiks3wzg63364d03hixiyzcpjlgk2bbk";
-        packages3d.rev =	"b40831fd7ea2ca8f9c7282143dbb7d2f5015cd69";
-        packages3d.sha256 =	"0bg54lg1iw01gw06ajg34y7x4y36wm6ls3jnpjy13i18d4ik77g4";
+        footprints.rev =	"b5974927427a886128e5ba7a8adc285a751261d1";
+        footprints.sha256 =	"0xqjnvbf032l191spfdh6g579jfhlpyr7pg53pkqdhzz053j3rlz";
+        packages3d.rev =	"b1fd04f841f0d88b025be7357482cf7f48de4dae";
+        packages3d.sha256 =	"1xgwd9srp93pj4pnskk3cnkbx57n6kvmlk7qwi3fl6wim3kxfcj2";
       };
     };
   };

pkgs/applications/version-management/git-machete/default.nix

@@ -11,13 +11,13 @@
 
 buildPythonApplication rec {
   pname = "git-machete";
-  version = "3.33.0";
+  version = "3.34.0";
 
   src = fetchFromGitHub {
     owner = "virtuslab";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-kzMjMyqaf4F/cRJ6+r9Ne+NUlG98iubKYqAm+NpmRtM=";
+    hash = "sha256-2Or4L3wrvqW7bvrJcgvK7rGqjqiob6k8CZc/XauguLo=";
   };
 
   nativeBuildInputs = [ installShellFiles ];

pkgs/applications/video/obs-studio/plugins/obs-livesplit-one/default.nix

@@ -19,12 +19,8 @@ rustPlatform.buildRustPackage rec {
     sha256 = "sha256-3B3P1PlzIlpVqHJMKWpEnWXGgD/IaiWM1FVKn0BtRj0=";
   };
 
-  cargoLock = {
-    lockFile = ./Cargo.lock;
-    outputHashes = {
-      "livesplit-auto-splitting-0.1.0" = "sha256-/xQEVJH6m6nH5Z1kuOPEElOcOqJmiG9Q8cOx0e6p3Wc=";
-    };
-  };
+  useFetchCargoVendor = true;
+  cargoHash = "sha256-JHocpqDeF24Qn9lUr+YCnZqgckLhGRpWQD7WGCxVmd8=";
 
   nativeBuildInputs = [
     cmake

pkgs/applications/window-managers/hyprwm/hyprland-plugins/hyprsplit.nix

@@ -9,13 +9,13 @@
 }:
 mkHyprlandPlugin hyprland rec {
   pluginName = "hyprsplit";
-  version = "0.47.2";
+  version = "0.48.0";
 
   src = fetchFromGitHub {
     owner = "shezdy";
     repo = "hyprsplit";
     rev = "refs/tags/v${version}";
-    hash = "sha256-g3yq1TNLc3HIMXqs2wY9kUgDYsN8GHhc77wIOXjyn6E=";
+    hash = "sha256-FTp5mkrrgo/plCFHuFnx+EtDnQQoChq0mdKpb2a4LrQ=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/ad/ada/package.nix

@@ -7,13 +7,13 @@
 
 stdenv.mkDerivation rec {
   pname = "ada";
-  version = "3.2.1";
+  version = "3.2.2";
 
   src = fetchFromGitHub {
     owner = "ada-url";
     repo = "ada";
     tag = "v${version}";
-    hash = "sha256-x58zGkuKEUqlJEdIvLFzwHZHJAzCsFV9EQCpi+zmV1o=";
+    hash = "sha256-Qag6cWybRxbQC7LvQmxLVcCw4RtMJ5TOSDwCmNs2XFA=";
   };
 
   nativeBuildInputs = [ cmake ];

pkgs/by-name/ag/agate/package.nix

@@ -11,17 +11,17 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "agate";
-  version = "3.3.13";
+  version = "3.3.14";
 
   src = fetchFromGitHub {
     owner = "mbrubeck";
     repo = "agate";
     rev = "v${version}";
-    hash = "sha256-VbGndkR7AdSDF9yWVUQToxlkpTPN8KljrxtJauHEqQ4=";
+    hash = "sha256-3IVl11eG9gSriOddgzgF0FecdldBxEOE/UXlFDKGyic=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-zM1ih6J0wi5+UXiy7LnJuPbh33NcfulZNr7BBm5+cfs=";
+  cargoHash = "sha256-pVxXUFuHyQ7YBJ6cBv3wPK5aZOs2QIhKf9awwY/y1hw=";
 
   nativeBuildInputs = [ pkg-config ];
 

pkgs/by-name/al/aliyun-cli/package.nix

@@ -8,13 +8,13 @@
 
 buildGoModule rec {
   pname = "aliyun-cli";
-  version = "3.0.259";
+  version = "3.0.264";
 
   src = fetchFromGitHub {
     owner = "aliyun";
     repo = "aliyun-cli";
     tag = "v${version}";
-    hash = "sha256-HF8vGEIIHIlHET4buHPTijPeomv0YNwX0bOSQrnyITw=";
+    hash = "sha256-dTGpg2cIcAHsaF6AHfP3rqLHLSIflrkZrjlbnFEW5Pk=";
     fetchSubmodules = true;
   };
 

pkgs/by-name/an/antic/package.nix

@@ -1,47 +0,0 @@
-{
-  lib,
-  stdenv,
-  fetchFromGitHub,
-  mpir,
-  gmp,
-  mpfr,
-  flint,
-}:
-
-stdenv.mkDerivation rec {
-  pname = "antic";
-  version = "0.2.5";
-
-  src = fetchFromGitHub {
-    owner = "flintlib";
-    repo = "antic";
-    rev = "v${version}";
-    sha256 = "sha256-bQ2VvCS+lGro5qxs+qBz3RpUenxQTmTr+lm9BFZWYts=";
-  };
-
-  buildInputs = [
-    mpir
-    gmp
-    mpfr
-    flint
-  ];
-
-  configureFlags = [
-    "--with-gmp=${gmp}"
-    "--with-mpir=${mpir}"
-    "--with-mpfr=${mpfr}"
-    "--with-flint=${flint}"
-  ];
-
-  enableParallelBuilding = true;
-
-  doCheck = true;
-
-  meta = with lib; {
-    description = "Algebraic number theory library";
-    homepage = "https://github.com/flintlib/antic";
-    license = licenses.lgpl21Plus;
-    maintainers = with maintainers; [ smasher164 ];
-    platforms = platforms.unix;
-  };
-}

pkgs/by-name/ar/arb/package.nix

@@ -1,47 +0,0 @@
-{
-  lib,
-  stdenv,
-  fetchFromGitHub,
-  mpir,
-  gmp,
-  mpfr,
-  flint,
-}:
-
-stdenv.mkDerivation rec {
-  pname = "arb";
-  version = "2.23.0";
-
-  src = fetchFromGitHub {
-    owner = "fredrik-johansson";
-    repo = "arb";
-    rev = version;
-    sha256 = "sha256-dt9PZ3Xfn60rhmnxYo7CEzNTEUN/wMVAXe8U5PzUO9U=";
-  };
-
-  buildInputs = [
-    mpir
-    gmp
-    mpfr
-    flint
-  ];
-
-  configureFlags = [
-    "--with-gmp=${gmp}"
-    "--with-mpir=${mpir}"
-    "--with-mpfr=${mpfr}"
-    "--with-flint=${flint}"
-  ];
-
-  enableParallelBuilding = true;
-
-  doCheck = true;
-
-  meta = with lib; {
-    description = "Library for arbitrary-precision interval arithmetic";
-    homepage = "https://arblib.org/";
-    license = licenses.lgpl21Plus;
-    maintainers = teams.sage.members;
-    platforms = platforms.unix;
-  };
-}

pkgs/by-name/as/ast-grep/package.nix

@@ -12,13 +12,13 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "ast-grep";
-  version = "0.36.1";
+  version = "0.36.2";
 
   src = fetchFromGitHub {
     owner = "ast-grep";
     repo = "ast-grep";
     tag = finalAttrs.version;
-    hash = "sha256-u2eRdOreThaTAe3Uo4C6K3u3qtfW+sow9w+Q3uqtPGs=";
+    hash = "sha256-Ma4HwjbKujPEqJVXwNVV8HgszLlqDw3ogVoHwdKfwpU=";
   };
 
   # error: linker `aarch64-linux-gnu-gcc` not found
@@ -27,7 +27,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
   '';
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-Nmmka1AxWhY3InOSmxiL9gg6sznrP8yQuC0EgAywATA=";
+  cargoHash = "sha256-+qOrRGao2szGHvLE5DGccKMwKApYoAyK+moPtMMKhdE=";
 
   nativeBuildInputs = [ installShellFiles ];
 

pkgs/by-name/at/atop/package.nix

@@ -16,11 +16,11 @@
 
 stdenv.mkDerivation rec {
   pname = "atop";
-  version = "2.11.0";
+  version = "2.11.1";
 
   src = fetchurl {
     url = "https://www.atoptool.nl/download/atop-${version}.tar.gz";
-    hash = "sha256-m5TGZmAu//e/QC7M5wbDR/OMOctjSY+dOWJoYeVkbiA=";
+    hash = "sha256-d2UPefnjiLb1Zm3BE4SYlFdaKbtN4huM1Ydnv4qQUVQ=";
   };
 
   nativeBuildInputs =

pkgs/by-name/au/authenticator/package.nix

@@ -1,55 +1,48 @@
-{ lib
-, stdenv
-, fetchFromGitLab
-, appstream-glib
-, cargo
-, desktop-file-utils
-, meson
-, ninja
-, pkg-config
-, rustPlatform
-, rustc
-, wrapGAppsHook4
-, gdk-pixbuf
-, glib
-, gst_all_1
-, gtk4
-, libadwaita
-, openssl
-, pipewire
-, sqlite
-, wayland
-, zbar
-, glycin-loaders
-, nix-update-script
+{
+  lib,
+  stdenv,
+  fetchFromGitLab,
+  appstream-glib,
+  cargo,
+  desktop-file-utils,
+  meson,
+  ninja,
+  pkg-config,
+  rustPlatform,
+  rustc,
+  wrapGAppsHook4,
+  gdk-pixbuf,
+  glib,
+  gst_all_1,
+  gtk4,
+  libadwaita,
+  openssl,
+  pipewire,
+  sqlite,
+  wayland,
+  zbar,
+  glycin-loaders,
+  nix-update-script,
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "authenticator";
-  version = "4.6.0";
+  version = "4.6.2";
 
   src = fetchFromGitLab {
     domain = "gitlab.gnome.org";
     owner = "World";
     repo = "Authenticator";
-    rev = version;
-    hash = "sha256-Kq/J/1+ROibR6NjfH/g760/CT4DZg1hIcsXQ4MHzrDc=";
+    tag = finalAttrs.version;
+    hash = "sha256-UvHIVUed4rxmjliaZ7jnwCjiHyvUDihoJyG3G+fYtow=";
   };
 
   cargoDeps = rustPlatform.fetchCargoVendor {
-    inherit src;
-    name = "${pname}-${version}";
-    hash = "sha256-SQDr4jdCZzuizYWwJ5crrunqN8O2bCUv5gIslBduAZY=";
+    inherit (finalAttrs) pname version src;
+    hash = "sha256-iOIGm3egVtVM6Eb3W5/ys9nQV5so0dnv2ZODjQwrVyw=";
   };
 
-  preFixup = ''
-    gappsWrapperArgs+=(
-      # vp8enc preset
-      --prefix GST_PRESET_PATH : "${gst_all_1.gst-plugins-good}/share/gstreamer-1.0/presets"
-      # See https://gitlab.gnome.org/sophie-h/glycin/-/blob/0.1.beta.2/glycin/src/config.rs#L44
-      --prefix XDG_DATA_DIRS : "${glycin-loaders}/share"
-    )
-  '';
+  strictDeps = true;
 
   nativeBuildInputs = [
     appstream-glib
@@ -81,6 +74,15 @@ stdenv.mkDerivation rec {
     zbar
   ];
 
+  preFixup = ''
+    gappsWrapperArgs+=(
+      # vp8enc preset
+      --prefix GST_PRESET_PATH : "${gst_all_1.gst-plugins-good}/share/gstreamer-1.0/presets"
+      # See https://gitlab.gnome.org/sophie-h/glycin/-/blob/0.1.beta.2/glycin/src/config.rs#L44
+      --prefix XDG_DATA_DIRS : "${glycin-loaders}/share"
+    )
+  '';
+
   passthru = {
     updateScript = nix-update-script { };
   };
@@ -93,4 +95,4 @@ stdenv.mkDerivation rec {
     maintainers = with lib.maintainers; [ austinbutler ] ++ lib.teams.gnome-circle.members;
     platforms = lib.platforms.linux;
   };
-}
+})

pkgs/by-name/av/avfs/package.nix

@@ -9,10 +9,10 @@
 
 stdenv.mkDerivation rec {
   pname = "avfs";
-  version = "1.1.5";
+  version = "1.2.0";
   src = fetchurl {
     url = "mirror://sourceforge/avf/${version}/${pname}-${version}.tar.bz2";
-    sha256 = "sha256-rZ87ZBBNYAmgWMcPZwiPeZMJv4UZsUsVSvrSJqRScs8=";
+    sha256 = "sha256-olqOxDwe4XJiThpMec5mobkwhBzbVFtyXx7GS8q+iJw=";
   };
 
   nativeBuildInputs = [ pkg-config ];

pkgs/by-name/az/azahar/package.nix

@@ -53,13 +53,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "azahar";
-  version = "2120.1";
+  version = "2120.2";
 
   src = fetchzip {
     # TODO: use this when https://github.com/azahar-emu/azahar/issues/779 is resolved
     # url = "https://github.com/azahar-emu/azahar/releases/download/${finalAttrs.version}/lime3ds-unified-source-${finalAttrs.version}.tar.xz";
-    url = "https://github.com/azahar-emu/azahar/releases/download/${finalAttrs.version}/azahar-unified-source-20250322-6ecee96.tar.xz";
-    hash = "sha256-d4JHp/BZEQTKErh476NZoizQjgAldR19Waq9GQg2Ebk=";
+    url = "https://github.com/azahar-emu/azahar/releases/download/${finalAttrs.version}/azahar-unified-source-20250329-32bb14f.tar.xz";
+    hash = "sha256-OyAc4nePQDuuwb+/ABnNe5ihPqMEoAqNeCYvME7SIio=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/be/benthos/package.nix

@@ -7,13 +7,13 @@
 
 buildGoModule rec {
   pname = "benthos";
-  version = "4.45.1";
+  version = "4.46.0";
 
   src = fetchFromGitHub {
     owner = "redpanda-data";
     repo = "benthos";
     tag = "v${version}";
-    hash = "sha256-pbbeVNpGCjLxhesq88aoeTnaawMgDTCx0wDA6Y2sXsM=";
+    hash = "sha256-txIzW6qU4XZyvt5ndIjmYwo4D2gWlD4CjEI591k3b8s=";
   };
 
   proxyVendor = true;

pkgs/by-name/bi/bililiverecorder/package.nix

@@ -16,11 +16,11 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "bililiverecorder";
-  version = "2.15.1";
+  version = "2.15.2";
 
   src = fetchzip {
     url = "https://github.com/BililiveRecorder/BililiveRecorder/releases/download/v${version}/BililiveRecorder-CLI-any.zip";
-    hash = "sha256-ugzFiuLe+Al3aRvEM3D4kqnaFrFR4Pr95UlEg0VGvvU=";
+    hash = "sha256-cbyeMpbPKr9m8o6EaioNIkEleGTQ9ZkYkRyJiX079BA=";
     stripRoot = false;
   };
 

pkgs/by-name/bl/blender/package.nix

@@ -18,8 +18,6 @@
   cudaSupport ? config.cudaSupport,
   dbus,
   embree,
-  fetchgit,
-  fetchpatch2,
   fetchzip,
   ffmpeg,
   fftw,
@@ -56,7 +54,7 @@
   makeWrapper,
   mesa,
   openal,
-  opencollada,
+  opencollada-blender,
   opencolorio,
   openexr,
   openimagedenoise,
@@ -114,42 +112,15 @@ in
 
 stdenv'.mkDerivation (finalAttrs: {
   pname = "blender";
-  version = "4.3.2";
+  version = "4.4.0";
 
-  srcs = [
-    (fetchzip {
-      name = "source";
-      url = "https://download.blender.org/source/blender-${finalAttrs.version}.tar.xz";
-      hash = "sha256-LCU2JpQbvQ+W/jC+H8J2suh+X5sTLOG9TcE2EeHqVh4=";
-    })
-    (fetchgit {
-      name = "assets";
-      url = "https://projects.blender.org/blender/blender-assets.git";
-      rev = "v${finalAttrs.version}";
-      fetchLFS = true;
-      hash = "sha256-B/UibETNBEUAO1pLCY6wR/Mmdk2o9YyNs6z6pV8dBJI=";
-    })
-  ];
+  srcs = fetchzip {
+    name = "source";
+    url = "https://download.blender.org/source/blender-${finalAttrs.version}.tar.xz";
+    hash = "sha256-pAzOayAPyRYgTixAyg2prkUtI70uFulRuBYhgU9ZNw4=";
+  };
 
-  postUnpack = ''
-    chmod -R u+w *
-    rm -r assets/working
-    mv assets --target-directory source/release/datafiles/
-  '';
-
-  sourceRoot = "source";
-
-  patches = [
-    ./draco.patch
-    (fetchpatch2 {
-      url = "https://gitlab.archlinux.org/archlinux/packaging/packages/blender/-/raw/4b6214600e11851d7793256e2f6846a594e6f223/ffmpeg-7-1.patch";
-      hash = "sha256-YXXqP/+79y3f41n3cJ3A1RBzgdoYqfKZD/REqmWYdgQ=";
-    })
-    (fetchpatch2 {
-      url = "https://gitlab.archlinux.org/archlinux/packaging/packages/blender/-/raw/4b6214600e11851d7793256e2f6846a594e6f223/ffmpeg-7-2.patch";
-      hash = "sha256-mF6IA/dbHdNEkBN5XXCRcLIZ/8kXoirNwq7RDuLRAjw=";
-    })
-  ] ++ lib.optional stdenv.hostPlatform.isDarwin ./darwin.patch;
+  patches = [ ] ++ lib.optional stdenv.hostPlatform.isDarwin ./darwin.patch;
 
   postPatch =
     (lib.optionalString stdenv.hostPlatform.isDarwin ''
@@ -201,6 +172,7 @@ stdenv'.mkDerivation (finalAttrs: {
       "-DWITH_OPENIMAGEDENOISE=${if openImageDenoiseSupport then "ON" else "OFF"}"
       "-DWITH_OPENSUBDIV=ON"
       "-DWITH_OPENVDB=ON"
+      "-DWITH_PIPEWIRE=OFF"
       "-DWITH_PULSEAUDIO=OFF"
       "-DWITH_PYTHON_INSTALL=OFF"
       "-DWITH_PYTHON_INSTALL_NUMPY=OFF"
@@ -330,7 +302,7 @@ stdenv'.mkDerivation (finalAttrs: {
       wayland
       wayland-protocols
     ]
-    ++ lib.optional colladaSupport opencollada
+    ++ lib.optional colladaSupport opencollada-blender
     ++ lib.optional jackaudioSupport libjack2
     ++ lib.optional spaceNavSupport libspnav
     ++ lib.optionals vulkanSupport [
@@ -365,9 +337,6 @@ stdenv'.mkDerivation (finalAttrs: {
       mkdir $out/Applications
       mv $out/Blender.app $out/Applications
     ''
-    + lib.optionalString stdenv.hostPlatform.isLinux ''
-      mv $out/share/blender/${lib.versions.majorMinor finalAttrs.version}/python{,-ext}
-    ''
     + ''
       buildPythonPath "$pythonPath"
       wrapProgram $blenderExecutable \

pkgs/by-name/bt/btrfs-progs/package.nix

@@ -20,11 +20,11 @@
 
 stdenv.mkDerivation rec {
   pname = "btrfs-progs";
-  version = "6.13";
+  version = "6.14";
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/people/kdave/btrfs-progs/btrfs-progs-v${version}.tar.xz";
-    hash = "sha256-ZbPyERellPgAE7QyYg7sxqfisMBeq5cTb/UGx01z7po=";
+    hash = "sha256-31q4BPyzbikcQq2DYfgBrR4QJBtDvTBP5Qzj355+PaE=";
   };
 
   nativeBuildInputs =

pkgs/by-name/bu/buf/package.nix

@@ -10,16 +10,16 @@
 
 buildGoModule rec {
   pname = "buf";
-  version = "1.50.1";
+  version = "1.51.0";
 
   src = fetchFromGitHub {
     owner = "bufbuild";
     repo = "buf";
     rev = "v${version}";
-    hash = "sha256-n4X8Wgi/5z6fteR+uxr68R3kD7eorMzlAW8jacTZGHg=";
+    hash = "sha256-/6SDsIVyorDWjOkdUB1t0vAA2VLy6MiGyiFo+2rUfEU=";
   };
 
-  vendorHash = "sha256-HU4Di8ri2d93EUscCx8/gRiEJdLTcnKUaQ4kesKfZ+w=";
+  vendorHash = "sha256-4GD2yNfYTQobPeJ+zPQ+ECDTeNUi4PK8oXSxpBF/4Wk=";
 
   patches = [
     # Skip a test that requires networking to be available to work.

pkgs/by-name/ca/calcium/package.nix

@@ -1,51 +0,0 @@
-{
-  lib,
-  stdenv,
-  fetchFromGitHub,
-  mpir,
-  gmp,
-  mpfr,
-  flint,
-  arb,
-  antic,
-}:
-
-stdenv.mkDerivation rec {
-  pname = "calcium";
-  version = "0.4.1";
-
-  src = fetchFromGitHub {
-    owner = "fredrik-johansson";
-    repo = "calcium";
-    rev = version;
-    sha256 = "sha256-Ony2FGMnWyNqD7adGeiDtysHNZ4ClMvQ1ijVPSHJmyc=";
-  };
-
-  buildInputs = [
-    mpir
-    gmp
-    mpfr
-    flint
-    arb
-    antic
-  ];
-
-  configureFlags = [
-    "--with-gmp=${gmp}"
-    "--with-mpir=${mpir}"
-    "--with-mpfr=${mpfr}"
-    "--with-flint=${flint}"
-    "--with-arb=${arb}"
-    "--with-antic=${antic}"
-  ];
-
-  enableParallelBuilding = true;
-
-  meta = with lib; {
-    description = "C library for exact computation with real and complex numbers";
-    homepage = "https://fredrikj.net/calcium/";
-    license = licenses.lgpl21Plus;
-    maintainers = with maintainers; [ smasher164 ];
-    platforms = platforms.unix;
-  };
-}

pkgs/by-name/ca/cargo-bolero/package.nix

@@ -10,15 +10,15 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "cargo-bolero";
-  version = "0.13.0";
+  version = "0.13.1";
 
   src = fetchCrate {
     inherit pname version;
-    hash = "sha256-xmSPIHD9wZoABv+6LZK3SCdakavGchjcRxhZPmSNAaE=";
+    hash = "sha256-73TjQYkSng93tryaZpBtwq3MdVYZC8enEibx6yTdEKw=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-vh/EIMrpolwd/o0ihcjVlJy2XTp7JzlUkoZj0sCnQKg=";
+  cargoHash = "sha256-0T7KyTQ5kJ4mv5lLxYeo7hxLjSkrmjfenrNV+7GL1hM=";
 
   buildInputs = [
     libbfd

pkgs/by-name/ci/cinny-desktop/package.nix

@@ -14,6 +14,8 @@
   glib,
   glib-networking,
   webkitgtk_4_0,
+  jq,
+  moreutils,
 }:
 
 rustPlatform.buildRustPackage rec {
@@ -46,10 +48,9 @@ rustPlatform.buildRustPackage rec {
         };
     in
     ''
-      substituteInPlace tauri.conf.json \
-        --replace-warn '"distDir": "../cinny/dist",' '"distDir": "${cinny'}",'
-      substituteInPlace tauri.conf.json \
-        --replace-warn '"cd cinny && npm run build"' '""'
+      ${lib.getExe jq} \
+        'del(.tauri.updater) | .build.distDir = "${cinny'}" | del(.build.beforeBuildCommand)' tauri.conf.json \
+        | ${lib.getExe' moreutils "sponge"} tauri.conf.json
     '';
 
   postInstall =

pkgs/by-name/ci/circt/package.nix

@@ -19,12 +19,12 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "circt";
-  version = "1.110.0";
+  version = "1.111.0";
   src = fetchFromGitHub {
     owner = "llvm";
     repo = "circt";
     rev = "firtool-${version}";
-    hash = "sha256-v5yiUFfCFj4UkcbHXwtVYZPLCp/NFmXrA9e6YkCf6jY=";
+    hash = "sha256-ztPRPO8I7K1dBYD/puLvnYd6JkXf/rpdEe3AOUAmsCM=";
     fetchSubmodules = true;
   };
 

pkgs/by-name/cl/cliflux/package.nix

@@ -0,0 +1,43 @@
+{
+  lib,
+  rustPlatform,
+  fetchFromGitHub,
+  pkg-config,
+  openssl,
+  nix-update-script,
+}:
+
+rustPlatform.buildRustPackage (finalAttrs: {
+  pname = "cliflux";
+  version = "1.8.0";
+
+  src = fetchFromGitHub {
+    owner = "spencerwi";
+    repo = "cliflux";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-AGkinlN5Ng0LXau6U9Ft+yMIFMpbrbup3R3c3UlglEM=";
+  };
+
+  useFetchCargoVendor = true;
+
+  cargoHash = "sha256-3nNvPQMnYRZlhUab0MSf39vMNidpMLJh56JSjlsrYAg=";
+
+  nativeBuildInputs = [
+    pkg-config
+  ];
+
+  buildInputs = [
+    openssl
+  ];
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "Terminal client for Miniflux RSS reader";
+    homepage = "https://github.com/spencerwi/cliflux";
+    changelog = "https://github.com/spencerwi/cliflux/blob/v${finalAttrs.version}/CHANGELOG.md";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ arthsmn ];
+    mainProgram = "cliflux";
+  };
+})

pkgs/by-name/cl/cloud-nuke/package.nix

@@ -7,13 +7,13 @@
 
 buildGoModule rec {
   pname = "cloud-nuke";
-  version = "0.39.0";
+  version = "0.40.0";
 
   src = fetchFromGitHub {
     owner = "gruntwork-io";
     repo = pname;
     tag = "v${version}";
-    hash = "sha256-r9/5A1f6GSDgF5/GM4UKxoCYUsc5xsZpTwDGDUySDfQ=";
+    hash = "sha256-zf/aHRZ1WhHwXn+1OJEiTNlOLedP7zXQLuFF2C4D0mw=";
   };
 
   vendorHash = "sha256-AiPy/lmqrNeDWM7/pXmzHCbSWZdqdXnZNATlyi6oAGc=";

pkgs/by-name/co/colorized-logs/package.nix

@@ -7,13 +7,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "colorized-logs";
-  version = "2.6";
+  version = "2.7";
 
   src = fetchFromGitHub {
     owner = "kilobyte";
     repo = "colorized-logs";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-QiZeIYeIWA3C7wYi2G2EItdW+jLjVrCbIYllur/RtY8=";
+    hash = "sha256-m7M/1OuWDUflxTA4E6cSeg7BqkEW8eB/wIgq+z97K/g=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/co/coroot-node-agent/package.nix

@@ -7,13 +7,13 @@
 
 buildGoModule rec {
   pname = "coroot-node-agent";
-  version = "1.23.14";
+  version = "1.23.15";
 
   src = fetchFromGitHub {
     owner = "coroot";
     repo = "coroot-node-agent";
     rev = "v${version}";
-    hash = "sha256-3GnKcoEAJVRywtXSXGcP/odmXa4/tD8Y4nZqUTh701w=";
+    hash = "sha256-3rr8LWaEhhAvzJisVj2uLK3O5us5/XEOpl7RFL2GBxw=";
   };
 
   vendorHash = "sha256-SxyIlyDHuu8Ls1+/rujWE9elZiTfSYWIrV8vP5xsqTU=";

pkgs/by-name/cr/crossplane-cli/package.nix

@@ -9,16 +9,16 @@
 
 buildGoModule rec {
   pname = "crossplane-cli";
-  version = "1.19.0";
+  version = "1.19.1";
 
   src = fetchFromGitHub {
     owner = "crossplane";
     repo = "crossplane";
     rev = "v${version}";
-    hash = "sha256-HSTECDo6jPa9yXziWxPnOvtCC0Xai6yG2orAn1AfAGw=";
+    hash = "sha256-pQIiVdDWy3+PrqhvVHDwgGHHCQCYWtWt9ympc8QbBcE=";
   };
 
-  vendorHash = "sha256-0Oefkc/T8ukPvbVgnvI+2rUAectTxawm/XR1KG04LpM=";
+  vendorHash = "sha256-adf1CyrADCa4Uc4e4yWv47S/TIl5YUPJUox+/VlaMRA=";
 
   ldflags = [
     "-s"

pkgs/by-name/da/davinci-resolve/package.nix

@@ -35,7 +35,7 @@ let
   davinci = (
     stdenv.mkDerivation rec {
       pname = "davinci-resolve${lib.optionalString studioVariant "-studio"}";
-      version = "19.1.3";
+      version = "19.1.4";
 
       nativeBuildInputs = [
         (appimage-run.override { buildFHSEnv = buildFHSEnvChroot; })
@@ -57,9 +57,9 @@ let
             outputHashAlgo = "sha256";
             outputHash =
               if studioVariant then
-                "sha256-aAKE+AY/a2XjVzdU0VXT3ekFrTp3rO6zUd7pRTTDc9E="
+                "sha256-OTL83suZXt7DxDz+89zIRJD8R25/HZUQMMGlfS+Ow4I="
               else
-                "sha256-CCr4/h0W1fhzUT4o6WyX2hBodzy9iqVLZwzdplzq9SI=";
+                "sha256-2u1gkaL3vdI+4RnPl5bEXE+zeRhg2BzPWjni015ISWI=";
 
             impureEnvVars = lib.fetchers.proxyImpureEnvVars;
 

pkgs/by-name/de/deno/librusty_v8.nix

@@ -2,11 +2,11 @@
 { fetchLibrustyV8 }:
 
 fetchLibrustyV8 {
-  version = "134.5.0";
+  version = "135.0.0";
   shas = {
-    x86_64-linux = "sha256-Mo7PJoU/GuEIPCIDeLshfwNoYpkpD5NilOljFRgjLgw=";
-    aarch64-linux = "sha256-h51n1SosveRhKlq47pnOMUMi5Avg23GLdMW24mj//PU=";
-    x86_64-darwin = "sha256-76AP6aLuPmf6wC3yrfI/dkomOAjqVJjJPkUQxjAgDhI=";
-    aarch64-darwin = "sha256-IpiLBL51Q06t402bwE8bFQew5dPuHBNvkFC8gsWXvsY=";
+    x86_64-linux = "sha256-jA/cUjzT3KhpBGFyxZSp61X05PhD6XKAGtZyKdnts7U=";
+    aarch64-linux = "sha256-+jqLUIv96994e1fFJcYCQNJJ8smF18sU76lq0sirszo=";
+    x86_64-darwin = "sha256-atemob6PgxMncD4F+b5mfleTHSTMdKvJAwFD9ul/eJ4=";
+    aarch64-darwin = "sha256-0fDaHgvUTDFKEhQp7WaNe+54e3+GScGO5+8+Qa89nLQ=";
   };
 }

pkgs/by-name/de/deno/package.nix

@@ -20,17 +20,17 @@ let
 in
 rustPlatform.buildRustPackage rec {
   pname = "deno";
-  version = "2.2.4";
+  version = "2.2.6";
 
   src = fetchFromGitHub {
     owner = "denoland";
     repo = "deno";
     tag = "v${version}";
-    hash = "sha256-gcUd4N2rTVYprBxx5T2RjG+0uZ090KjXPswYzGU5+14=";
+    hash = "sha256-Ner3178YukKKqMVQAGpU3bE+fxo9UXrRPp7iqCFSUjs=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-V2dKiiTYAsUhq6Pr+z/ga3qtKI43mfzqgBDSAhcBVKo=";
+  cargoHash = "sha256-dakHDPGv7trd2Kib9Hk5jHZHR3pzk1YIyJW/0uY6WSg=";
 
   postPatch = ''
     # Use patched nixpkgs libffi in order to fix https://github.com/libffi/libffi/pull/857

pkgs/by-name/dg/dgraph/package.nix

@@ -9,16 +9,16 @@
 
 buildGoModule rec {
   pname = "dgraph";
-  version = "24.1.0";
+  version = "24.1.1";
 
   src = fetchFromGitHub {
     owner = "dgraph-io";
     repo = "dgraph";
     rev = "v${version}";
-    sha256 = "sha256-Cev0jaFxOu+SoFnBnb2Zlb+z0Su7erluLjizyYmkBLg=";
+    sha256 = "sha256-WAjoAbd8tGpianZXfrvRbRCdbkVP/gO/ekotT5KyrG8=";
   };
 
-  vendorHash = "sha256-l+9A///gk1xNAW3xQ974LQnQ4M+Zf4RJCL7QmnuWiMg=";
+  vendorHash = "sha256-eOo2ihaabdhDRATIc5C4YEMBcA0Xl5xzBKW5GJhrTOA=";
 
   doCheck = false;
 

pkgs/by-name/di/diffoscope/package.nix

@@ -106,11 +106,11 @@ in
 # Note: when upgrading this package, please run the list-missing-tools.sh script as described below!
 python.pkgs.buildPythonApplication rec {
   pname = "diffoscope";
-  version = "289";
+  version = "293";
 
   src = fetchurl {
     url = "https://diffoscope.org/archive/diffoscope-${version}.tar.bz2";
-    hash = "sha256-EvIUBGXuZjzZHjNAwLWNhLrqAM73DDKr/py2mX6vt3M=";
+    hash = "sha256-DZLeZhhWHcBGbO0lCucs5+6kXfwKk71Iwxhjej0ClLE=";
   };
 
   outputs = [

pkgs/by-name/do/docker-credential-gcr/package.nix

@@ -9,20 +9,20 @@
 
 buildGoModule rec {
   pname = "docker-credential-gcr";
-  version = "2.1.26";
+  version = "2.1.27";
 
   src = fetchFromGitHub {
     owner = "GoogleCloudPlatform";
     repo = "docker-credential-gcr";
     tag = "v${version}";
-    hash = "sha256-4sgUeEXBfP0qaR92ZulqAf1ObQBDbSjEHqhAqa0EV2Q=";
+    hash = "sha256-WoTbqqbFoIS525uytYAYmzrFbRYBi1C65Z5EDwzu6GI=";
   };
 
   postPatch = ''
     rm -rf ./test
   '';
 
-  vendorHash = "sha256-YcBDurQjGhjds3CB63gTjsPbsvlHJnGxWbsFrx3vCy4=";
+  vendorHash = "sha256-n6QnVPBCGJpaHxywYjk+qCN0FXmQAvkQPu6vHPv5QJA=";
 
   env.CGO_ENABLED = 0;
 

pkgs/by-name/dr/dracula-theme/package.nix

@@ -8,7 +8,7 @@
 
 let
   themeName = "Dracula";
-  version = "4.0.0-unstable-2025-03-13";
+  version = "4.0.0-unstable-2025-03-22";
 in
 stdenvNoCC.mkDerivation {
   pname = "dracula-theme";
@@ -17,8 +17,8 @@ stdenvNoCC.mkDerivation {
   src = fetchFromGitHub {
     owner = "dracula";
     repo = "gtk";
-    rev = "fc59294cf67110f6487f5fd06d3c845ffffdf1a9";
-    hash = "sha256-hFiYb1KqYvH66OIhmIUP3DfkSkuYgE78ihjkEaAY7LM=";
+    rev = "e7f118ac0434988800453bc30671b55ccfe02bd9";
+    hash = "sha256-f7bYYkAm4f0kSaDY1X2ZLLxlXwzUdFtjHkIeX0QmX9w=";
   };
 
   propagatedUserEnvPkgs = [

pkgs/by-name/e-/e-imzo/package.nix

@@ -20,11 +20,11 @@ let
 in
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "e-imzo";
-  version = "4.64";
+  version = "4.71";
 
   src = fetchurl {
     url = "https://dls.yt.uz/E-IMZO-v${finalAttrs.version}.tar.gz";
-    hash = "sha256-ej99PJrO9ufJ8+VlC/HpfvS/bGBtKqUWcsRyiZRlU4c=";
+    hash = "sha256-sV/xcUaBSqJw0QHkXcbkn5nsm2iL3zTt0Uoa2O/H64A=";
   };
 
   installPhase = ''

pkgs/by-name/el/element-desktop/element-desktop-pin.nix

@@ -1,7 +1,7 @@
 {
-  "version" = "1.11.95";
+  "version" = "1.11.96";
   "hashes" = {
-    "desktopSrcHash" = "sha256-0OCL1m+/FOdmp7npavnAygpuEryBypie+yR1eQK1eLM=";
-    "desktopYarnHash" = "sha256-h5ZjpInF/qh/Cm46uzi1tTEUIbmHC/muV6X/FxGyFms=";
+    "desktopSrcHash" = "sha256-oTU/Pvl4gBp69OrUrXEYXupl0WphsEWt32sB4v6T+gA=";
+    "desktopYarnHash" = "sha256-zMdSA/CkMDXirWZ2uCPTgZ5iErV7rGyR+xcLh9sPDA8=";
   };
 }

pkgs/by-name/el/element-web-unwrapped/element-web-pin.nix

@@ -1,7 +1,7 @@
 {
-  "version" = "1.11.95";
+  "version" = "1.11.96";
   "hashes" = {
-    "webSrcHash" = "sha256-JS+lwPRj4Fb+UZNATS7IFMfytqRou+aIpjDVjI+iqao=";
-    "webYarnHash" = "sha256-Aw0wDGE0WbI975y+J2FVxlDrHcPeBDkHiD/7W8eTf1E=";
+    "webSrcHash" = "sha256-EfSQEyMG9v5Boev98FyfzLA3hZLzxSGxAnZFfbc2aVA=";
+    "webYarnHash" = "sha256-Dp7WXEjWSDQjpmnJUrloIQau6is8YxTYzJmnQBIk+Ys=";
   };
 }

pkgs/by-name/fe/feroxbuster/package.nix

@@ -5,52 +5,48 @@
   openssl,
   pkg-config,
   rustPlatform,
-  Security,
-  SystemConfiguration,
+  nix-update-script,
+  versionCheckHook,
 }:
 
 rustPlatform.buildRustPackage rec {
   pname = "feroxbuster";
-  version = "2.10.3";
+  version = "2.11.0";
 
   src = fetchFromGitHub {
     owner = "epi052";
-    repo = pname;
+    repo = "feroxbuster";
     tag = "v${version}";
-    hash = "sha256-3cznGVpZISLD2TbsHYyYYUTD55NmgBdNJ44V4XfZ40k=";
+    hash = "sha256-/NgGlXYMxGxpX93SJ6gWgZW21cSSZsgo/WMvRuLw+Bw=";
   };
 
-  # disable linker overrides on aarch64-linux
-  postPatch = ''
-    rm .cargo/config
-  '';
-
   useFetchCargoVendor = true;
-  cargoHash = "sha256-DjmMoATagWGK2DHMc6YB0u2X5x5hnqgCwIGe3+Wmdic=";
+
+  cargoHash = "sha256-L5s+P9eerv+O2vBUczGmn0rUMbHQtnF8hVa22wOrTGo=";
 
   OPENSSL_NO_VENDOR = true;
 
   nativeBuildInputs = [
     pkg-config
+    versionCheckHook
   ];
 
-  buildInputs =
-    [
-      openssl
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      Security
-      SystemConfiguration
-    ];
+  buildInputs = [ openssl ];
 
   # Tests require network access
   doCheck = false;
 
+  doInstallCheck = true;
+
+  versionCheckProgramArg = [ "--version" ];
+
+  passthru.updateScript = nix-update-script { };
+
   meta = with lib; {
-    description = "Fast, simple, recursive content discovery tool";
+    description = "Recursive content discovery tool";
     homepage = "https://github.com/epi052/feroxbuster";
-    changelog = "https://github.com/epi052/feroxbuster/releases/tag/v${version}";
-    license = with licenses; [ mit ];
+    changelog = "https://github.com/epi052/feroxbuster/releases/tag/v${src.tag}";
+    license = licenses.mit;
     maintainers = with maintainers; [ fab ];
     platforms = platforms.unix;
     mainProgram = "feroxbuster";

pkgs/by-name/fi/fiddler-everywhere/package.nix

@@ -8,11 +8,11 @@
 
 let
   pname = "fiddler-everywhere";
-  version = "6.2.0";
+  version = "6.3.0";
 
   src = fetchurl {
     url = "https://downloads.getfiddler.com/linux/fiddler-everywhere-${version}.AppImage";
-    hash = "sha256-bUFogQkMOr0n95wYd/M9eq9Y6xxVFJTaznBnmFMvjC4=";
+    hash = "sha256-AqwIzjnSq579cSgBbslPXINhXAtGvl8Z7nOWdHzCmro=";
   };
 
   appimageContents = appimageTools.extract {

pkgs/by-name/fi/fittrackee/package.nix

@@ -8,14 +8,14 @@
 }:
 python3Packages.buildPythonApplication rec {
   pname = "fittrackee";
-  version = "0.9.2";
+  version = "0.9.3";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "SamR1";
     repo = "FitTrackee";
     tag = "v${version}";
-    hash = "sha256-O5dtices32EV/G9cefhewvr+OGnvq598YmwtwWaI3FI=";
+    hash = "sha256-ofFQJqBKGavXatlpm1bsM2+A1My/9dSzl9X/o9lVDb8=";
   };
 
   build-system = [

pkgs/by-name/fl/flatter/package.nix

@@ -14,13 +14,13 @@
 
 stdenv.mkDerivation {
   pname = "flatter";
-  version = "0-unstable-2025-02-03";
+  version = "0-unstable-2025-03-28";
 
   src = fetchFromGitHub {
     owner = "keeganryan";
     repo = "flatter";
-    rev = "96993e47874c302395721d76d06f7ab4fee09839";
-    hash = "sha256-eMZZsgLeTzMAHohmvR13KQERtYQpB2nj/v5MCKtGFaI=";
+    rev = "13c4ef0f0abe7ad5db88b19a9196c00aa5cf067c";
+    hash = "sha256-k0FcIJARaXi602eqMSum+q1IaCs30Xi0hB/ZNNkXruw=";
   };
 
   strictDeps = true;