Merge master into haskell-updates

2024-10-13 00:17:40 +00:00
parent fe6bacc1e3 ac8b46d1c2
commit 5d9355ca91
271 changed files with 4486 additions and 3271 deletions
@@ -25,6 +25,13 @@ jobs:
    steps:
    - uses: cachix/install-nix-action@08dcb3a5e62fa31e2da3d490afc4176ef55ecd72 # v30

+    - uses: cachix/cachix-action@ad2ddac53f961de1989924296a1f236fcfbaa4fc # v15
+      if: github.repository_owner == 'NixOS'
+      with:
+        # This cache is for the nixpkgs repo checks and should not be trusted or used elsewhere.
+        name: nixpkgs-ci
+        authToken: '${{ secrets.CACHIX_AUTH_TOKEN }}'
+
    # Important: Because we use pull_request_target, this checks out the base branch of the PR, not the PR itself.
    # We later build and run code from the base branch with access to secrets,
    # so it's important this is not the PRs code.
@@ -26,52 +26,22 @@ jobs:
    # This should take 1 minute at most, but let's be generous. The default of 6 hours is definitely too long.
    timeout-minutes: 10
    steps:
-      # This step has to be in this file, because it's needed to determine which revision of the repository to fetch, and we can only use other files from the repository once it's fetched.
+      # This checks out the base branch because of pull_request_target
+      - uses: actions/checkout@d632683dd7b4114ad314bca15554477dd762a938 # v4.2.0
+        with:
+          path: base
+          sparse-checkout: ci
      - name: Resolving the merge commit
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
-          # This checks for mergeability of a pull request as recommended in
-          # https://docs.github.com/en/rest/guides/using-the-rest-api-to-interact-with-your-git-database?apiVersion=2022-11-28#checking-mergeability-of-pull-requests
-
-          # Retry the API query this many times
-          retryCount=5
-          # Start with 5 seconds, but double every retry
-          retryInterval=5
-          while true; do
-            echo "Checking whether the pull request can be merged"
-            prInfo=$(gh api \
-              -H "Accept: application/vnd.github+json" \
-              -H "X-GitHub-Api-Version: 2022-11-28" \
-              /repos/"$GITHUB_REPOSITORY"/pulls/${{ github.event.pull_request.number }})
-            mergeable=$(jq -r .mergeable <<< "$prInfo")
-            mergedSha=$(jq -r .merge_commit_sha <<< "$prInfo")
-
-            if [[ "$mergeable" == "null" ]]; then
-              if (( retryCount == 0 )); then
-                echo "Not retrying anymore. It's likely that GitHub is having internal issues: check https://www.githubstatus.com/"
-                exit 1
-              else
-                (( retryCount -= 1 )) || true
-
-                # null indicates that GitHub is still computing whether it's mergeable
-                # Wait a couple seconds before trying again
-                echo "GitHub is still computing whether this PR can be merged, waiting $retryInterval seconds before trying again ($retryCount retries left)"
-                sleep "$retryInterval"
-
-                (( retryInterval *= 2 )) || true
-              fi
-            else
-              break
-            fi
-          done
-
-          if [[ "$mergeable" == "true" ]]; then
-            echo "The PR can be merged, checking the merge commit $mergedSha"
+          if mergedSha=$(base/ci/get-merge-commit.sh ${{ github.repository }} ${{ github.event.number }}); then
+            echo "Checking the merge commit $mergedSha"
            echo "mergedSha=$mergedSha" >> "$GITHUB_ENV"
          else
-            echo "The PR cannot be merged, it has a merge conflict, skipping the rest.."
+            echo "Skipping the rest..."
          fi
+          rm -rf base
      - uses: actions/checkout@d632683dd7b4114ad314bca15554477dd762a938 # v4.2.0
        if: env.mergedSha
        with:
@@ -267,9 +267,11 @@ pkgs/development/python-modules/buildcatrust/ @ajs124 @lukegb @mweinelt
 /nixos/modules/services/mail/rspamd.nix     @peti

 # Emacs
-/pkgs/applications/editors/emacs/elisp-packages @adisbladis
-/pkgs/applications/editors/emacs                @adisbladis
-/pkgs/top-level/emacs-packages.nix              @adisbladis
+/pkgs/applications/editors/emacs/elisp-packages @NixOS/emacs
+/pkgs/applications/editors/emacs                @NixOS/emacs
+/pkgs/top-level/emacs-packages.nix              @NixOS/emacs
+/doc/packages/emacs.section.md                  @NixOS/emacs
+/nixos/modules/services/editors/emacs.md        @NixOS/emacs

 # Kakoune
 /pkgs/applications/editors/kakoune     @philiptaron
@@ -41,3 +41,58 @@ Why not just build the tooling right from the PRs Nixpkgs version?
 - Because it improves security, since we don't have to build potentially untrusted code from PRs.
  The tool only needs a very minimal Nix evaluation at runtime, which can work with [readonly-mode](https://nixos.org/manual/nix/stable/command-ref/opt-common.html#opt-readonly-mode) and [restrict-eval](https://nixos.org/manual/nix/stable/command-ref/conf-file.html#conf-restrict-eval).

+## `get-merge-commit.sh GITHUB_REPO PR_NUMBER`
+
+Check whether a PR is mergeable and return the test merge commit as
+[computed by GitHub](https://docs.github.com/en/rest/guides/using-the-rest-api-to-interact-with-your-git-database?apiVersion=2022-11-28#checking-mergeability-of-pull-requests).
+
+Arguments:
+- `GITHUB_REPO`: The repository of the PR, e.g. `NixOS/nixpkgs`
+- `PR_NUMBER`: The PR number, e.g. `1234`
+
+Exit codes:
+- 0: The PR can be merged, the test merge commit hash is returned on stdout
+- 1: The PR cannot be merged because it's not open anymore
+- 2: The PR cannot be merged because it has a merge conflict
+- 3: The merge commit isn't being computed, GitHub is likely having internal issues, unknown if the PR is mergeable
+
+### Usage
+
+This script can be used in GitHub Actions workflows as follows:
+
+```yaml
+on: pull_request_target
+
+# We need a token to query the API, but it doesn't need any special permissions
+permissions: {}
+
+jobs:
+  build:
+    name: Build
+    runs-on: ubuntu-latest
+    steps:
+      # Important: Because of `pull_request_target`, this doesn't check out the PR,
+      # but rather the base branch of the PR, which is needed so we don't run untrusted code
+      - uses: actions/checkout@<VERSION>
+        with:
+          path: base
+          sparse-checkout: ci
+      - name: Resolving the merge commit
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          if mergedSha=$(base/ci/get-merge-commit.sh ${{ github.repository }} ${{ github.event.number }}); then
+            echo "Checking the merge commit $mergedSha"
+            echo "mergedSha=$mergedSha" >> "$GITHUB_ENV"
+          else
+            # Skipping so that no notifications are sent
+            echo "Skipping the rest..."
+          fi
+          rm -rf base
+      - uses: actions/checkout@<VERSION>
+        # Add this to _all_ subsequent steps to skip them
+        if: env.mergedSha
+        with:
+          ref: ${{ env.mergedSha }}
+      - ...
+```
@@ -0,0 +1,62 @@
+#!/usr/bin/env bash
+# See ./README.md for docs
+
+set -euo pipefail
+
+log() {
+    echo "$@" >&2
+}
+
+if (( $# < 2 )); then
+    log "Usage: $0 GITHUB_REPO PR_NUMBER"
+    exit 99
+fi
+repo=$1
+prNumber=$2
+
+# Retry the API query this many times
+retryCount=5
+# Start with 5 seconds, but double every retry
+retryInterval=5
+
+while true; do
+    log "Checking whether the pull request can be merged"
+    prInfo=$(gh api \
+        -H "Accept: application/vnd.github+json" \
+        -H "X-GitHub-Api-Version: 2022-11-28" \
+        "/repos/$repo/pulls/$prNumber")
+
+    # Non-open PRs won't have their mergeability computed no matter what
+    state=$(jq -r .state <<< "$prInfo")
+    if [[ "$state" != open ]]; then
+        log "PR is not open anymore"
+        exit 1
+    fi
+
+    mergeable=$(jq -r .mergeable <<< "$prInfo")
+    if [[ "$mergeable" == "null" ]]; then
+        if (( retryCount == 0 )); then
+            log "Not retrying anymore. It's likely that GitHub is having internal issues: check https://www.githubstatus.com/"
+            exit 3
+        else
+            (( retryCount -= 1 )) || true
+
+            # null indicates that GitHub is still computing whether it's mergeable
+            # Wait a couple seconds before trying again
+            log "GitHub is still computing whether this PR can be merged, waiting $retryInterval seconds before trying again ($retryCount retries left)"
+            sleep "$retryInterval"
+
+            (( retryInterval *= 2 )) || true
+        fi
+    else
+        break
+    fi
+done
+
+if [[ "$mergeable" == "true" ]]; then
+    log "The PR can be merged"
+    jq -r .merge_commit_sha <<< "$prInfo"
+else
+    log "The PR has a merge conflict"
+    exit 2
+fi
@@ -35,6 +35,7 @@ log "This PR touches ${#touchedFiles[@]} files"
 git -C "$gitRepo" show "$baseRef":"$ownersFile" > "$tmp"/codeowners

 # Associative array with the user as the key for easy de-duplication
+# Make sure to always lowercase keys to avoid duplicates with different casings
 declare -A users=()

 for file in "${touchedFiles[@]}"; do
@@ -87,20 +88,20 @@ for file in "${touchedFiles[@]}"; do
            log "Team $entry has these members: ${members[*]}"

            for user in "${members[@]}"; do
-                users[$user]=
+                users[${user,,}]=
            done
        else
            # Everything else is a user
-            users[$entry]=
+            users[${entry,,}]=
        fi
    done

 done

 # Cannot request a review from the author
-if [[ -v users[$prAuthor] ]]; then
+if [[ -v users[${prAuthor,,}] ]]; then
    log "One or more files are owned by the PR author, ignoring"
-    unset 'users[$prAuthor]'
+    unset 'users[${prAuthor,,}]'
 fi

 gh api \
@@ -111,9 +112,9 @@ gh api \

 # And we don't want to rerequest reviews from people who already reviewed
 while read -r user; do
-    if [[ -v users[$user] ]]; then
+    if [[ -v users[${user,,}] ]]; then
        log "User $user is a code owner but has already left a review, ignoring"
-        unset 'users[$user]'
+        unset 'users[${user,,}]'
    fi
 done < "$tmp/already-reviewed-by"

@@ -960,6 +960,12 @@
    githubId = 49609151;
    name = "Popa Ioan Alexandru";
  };
+  alexandru0-dev = {
+    email = "alexandru.italia32+nixpkgs@gmail.com";
+    github = "alexandru0-dev";
+    githubId = 45104896;
+    name = "Alexandru Nechita";
+  };
  alexarice = {
    email = "alexrice999@hotmail.co.uk";
    github = "alexarice";
@@ -7669,6 +7675,12 @@
    githubId = 111183546;
    keys = [ { fingerprint = "58CE D4BE 6B10 149E DA80  A990 2F48 6356 A4CB 30F3"; } ];
  };
+  genga898 = {
+    email = "genga898@gmail.com";
+    github = "genga898";
+    githubId = 84174227;
+    name = "Emmanuel Genga";
+  };
  genofire = {
    name = "genofire";
    email = "geno+dev@fireorbit.de";
@@ -18391,6 +18403,18 @@
    githubId = 1217934;
    name = "José Romildo Malaquias";
  };
+  romner-set = {
+    email = "admin@cynosure.red";
+    github = "romner-set";
+    githubId = 41077433;
+    name = "romner-set";
+    keys = [
+      {
+        # uploaded to https://keys.openpgp.org
+        fingerprint = "4B75 244B 0279 9598 FF3B  C21F 95FC 58F1 8CFD FAB0";
+      }
+    ];
+  };
  ronanmacf = {
    email = "macfhlar@tcd.ie";
    github = "RonanMacF";
@@ -278,7 +278,11 @@ with lib.maintainers;
  };

  emacs = {
-    members = [ adisbladis ];
+    members = [
+      AndersonTorres
+      adisbladis
+      linj
+    ];
    scope = "Maintain the Emacs editor and packages.";
    shortName = "Emacs";
  };
@@ -207,6 +207,10 @@

 - `deno` has been updated to v2 which has breaking changes. Upstream will be abandoning v1 soon but for now you can use `deno_1` if you are yet to migrate (will be removed prior to cutting a final 24.11 release).

+- `gogs` has been removed. Upstream development has stalled and it has several
+  [critical vulnerabilities](https://github.com/gogs/gogs/issues/7777) that weren't addressed
+  within a year. Consider migrating to `forgejo` or `gitea`.
+
 - `knot-dns` has been updated to version 3.4.x. Check the [migration guide](https://www.knot-dns.cz/docs/latest/html/migration.html#upgrade-3-3-x-to-3-4-x) for breaking changes.

 - `services.kubernetes.kubelet.clusterDns` now accepts a list of DNS resolvers rather than a single string, bringing the module more in line with the upstream Kubelet configuration schema.
@@ -685,6 +689,9 @@

 - ZFS now imports its pools in `postResumeCommands` rather than `postDeviceCommands`. If you had `postDeviceCommands` scripts that depended on ZFS pools being imported, those now need to be in `postResumeCommands`.

+- `services.automatic-timezoned.enable = true` will now set `time.timeZone = null`.
+  This is to avoid silently shadowing a user's explicitly defined timezone without recognition on the user's part.
+
 - `services.localtimed.enable = true` will now set `time.timeZone = null`.
  This is to avoid silently shadowing a user's explicitly defined timezone without recognition on the user's part.

@@ -26,9 +26,9 @@ in

  config = mkIf cfg.enable {

-    # Module is upstream as of 6.10
-    boot.extraModulePackages = with config.boot.kernelPackages;
-      optional (kernelOlder "6.10") ipu6-drivers;
+    # Module is upstream as of 6.10,
+    # but still needs various out-of-tree i2c and the `intel-ipu6-psys` kernel driver
+    boot.extraModulePackages = with config.boot.kernelPackages; [ ipu6-drivers ];

    hardware.firmware = with pkgs; [
      ipu6-camera-bins
@@ -296,7 +296,7 @@ in
      sickbeard = 265;
      headphones = 266;
      # couchpotato = 267; # unused, removed 2022-01-01
-      gogs = 268;
+      # gogs = 268; # unused, removed in 2024-10-12
      #pdns-recursor = 269; # dynamically allocated as of 2020-20-18
      #kresd = 270; # switched to "knot-resolver" with dynamic ID
      rpc = 271;
@@ -607,7 +607,7 @@ in
      sickbeard = 265;
      headphones = 266;
      # couchpotato = 267; # unused, removed 2022-01-01
-      gogs = 268;
+      # gogs = 268; # unused, removed in 2024-10-12
      #kresd = 270; # switched to "knot-resolver" with dynamic ID
      #rpc = 271; # unused
      #geoip = 272; # unused
@@ -759,7 +759,6 @@
  ./services/misc/gitlab.nix
  ./services/misc/gitolite.nix
  ./services/misc/gitweb.nix
-  ./services/misc/gogs.nix
  ./services/misc/gollum.nix
  ./services/misc/gotenberg.nix
  ./services/misc/gpsd.nix
@@ -16,7 +16,6 @@ in {
        libayatana-common
        ubports-click
      ]) ++ (with pkgs.lomiri; [
-        content-hub
        hfd-service
        history-service
        libusermetrics
@@ -24,6 +23,7 @@ in {
        lomiri-calculator-app
        lomiri-camera-app
        lomiri-clock-app
+        lomiri-content-hub
        lomiri-docviewer-app
        lomiri-download-manager
        lomiri-filemanager-app
@@ -129,7 +129,7 @@ in {

    environment.pathsToLink = [
      # Configs for inter-app data exchange system
-      "/share/content-hub/peers"
+      "/share/lomiri-content-hub/peers"
      # Configs for inter-app URL requests
      "/share/lomiri-url-dispatcher/urls"
      # Splash screens & other images for desktop apps launched via lomiri-app-launch
@@ -194,10 +194,6 @@ in {
    };

    users.groups.usermetrics = { };
-
-    # TODO content-hub cannot pass files between applications without asking AA for permissions. And alot of the Lomiri stack is designed with AA availability in mind. This might be a requirement to be closer to upstream?
-    # But content-hub currently fails to pass files between applications even with AA enabled, and we can get away without AA in many places. Let's see how this develops before requiring this for good.
-    # security.apparmor.enable = true;
  };

  meta.maintainers = lib.teams.lomiri.members;
@@ -1,271 +0,0 @@
-{ config, lib, options, pkgs, ... }:
-let
-  cfg = config.services.gogs;
-  opt = options.services.gogs;
-  configFile = pkgs.writeText "app.ini" ''
-    BRAND_NAME = ${cfg.appName}
-    RUN_USER = ${cfg.user}
-    RUN_MODE = prod
-
-    [database]
-    TYPE = ${cfg.database.type}
-    HOST = ${cfg.database.host}:${toString cfg.database.port}
-    NAME = ${cfg.database.name}
-    USER = ${cfg.database.user}
-    PASSWORD = #dbpass#
-    PATH = ${cfg.database.path}
-
-    [repository]
-    ROOT = ${cfg.repositoryRoot}
-
-    [server]
-    DOMAIN = ${cfg.domain}
-    HTTP_ADDR = ${cfg.httpAddress}
-    HTTP_PORT = ${toString cfg.httpPort}
-    EXTERNAL_URL = ${cfg.rootUrl}
-
-    [session]
-    COOKIE_NAME = session
-    COOKIE_SECURE = ${lib.boolToString cfg.cookieSecure}
-
-    [security]
-    SECRET_KEY = #secretkey#
-    INSTALL_LOCK = true
-
-    [log]
-    ROOT_PATH = ${cfg.stateDir}/log
-
-    ${cfg.extraConfig}
-  '';
-in
-
-{
-  options = {
-    services.gogs = {
-      enable = lib.mkOption {
-        default = false;
-        type = lib.types.bool;
-        description = "Enable Go Git Service.";
-      };
-
-      useWizard = lib.mkOption {
-        default = false;
-        type = lib.types.bool;
-        description = "Do not generate a configuration and use Gogs' installation wizard instead. The first registered user will be administrator.";
-      };
-
-      stateDir = lib.mkOption {
-        default = "/var/lib/gogs";
-        type = lib.types.str;
-        description = "Gogs data directory.";
-      };
-
-      user = lib.mkOption {
-        type = lib.types.str;
-        default = "gogs";
-        description = "User account under which Gogs runs.";
-      };
-
-      group = lib.mkOption {
-        type = lib.types.str;
-        default = "gogs";
-        description = "Group account under which Gogs runs.";
-      };
-
-      database = {
-        type = lib.mkOption {
-          type = lib.types.enum [ "sqlite3" "mysql" "postgres" ];
-          example = "mysql";
-          default = "sqlite3";
-          description = "Database engine to use.";
-        };
-
-        host = lib.mkOption {
-          type = lib.types.str;
-          default = "127.0.0.1";
-          description = "Database host address.";
-        };
-
-        port = lib.mkOption {
-          type = lib.types.port;
-          default = 3306;
-          description = "Database host port.";
-        };
-
-        name = lib.mkOption {
-          type = lib.types.str;
-          default = "gogs";
-          description = "Database name.";
-        };
-
-        user = lib.mkOption {
-          type = lib.types.str;
-          default = "gogs";
-          description = "Database user.";
-        };
-
-        password = lib.mkOption {
-          type = lib.types.str;
-          default = "";
-          description = ''
-            The password corresponding to {option}`database.user`.
-            Warning: this is stored in cleartext in the Nix store!
-            Use {option}`database.passwordFile` instead.
-          '';
-        };
-
-        passwordFile = lib.mkOption {
-          type = lib.types.nullOr lib.types.path;
-          default = null;
-          example = "/run/keys/gogs-dbpassword";
-          description = ''
-            A file containing the password corresponding to
-            {option}`database.user`.
-          '';
-        };
-
-        path = lib.mkOption {
-          type = lib.types.str;
-          default = "${cfg.stateDir}/data/gogs.db";
-          defaultText = lib.literalExpression ''"''${config.${opt.stateDir}}/data/gogs.db"'';
-          description = "Path to the sqlite3 database file.";
-        };
-      };
-
-      appName = lib.mkOption {
-        type = lib.types.str;
-        default = "Gogs: Go Git Service";
-        description = "Application name.";
-      };
-
-      repositoryRoot = lib.mkOption {
-        type = lib.types.str;
-        default = "${cfg.stateDir}/repositories";
-        defaultText = lib.literalExpression ''"''${config.${opt.stateDir}}/repositories"'';
-        description = "Path to the git repositories.";
-      };
-
-      domain = lib.mkOption {
-        type = lib.types.str;
-        default = "localhost";
-        description = "Domain name of your server.";
-      };
-
-      rootUrl = lib.mkOption {
-        type = lib.types.str;
-        default = "http://localhost:3000/";
-        description = "Full public URL of Gogs server.";
-      };
-
-      httpAddress = lib.mkOption {
-        type = lib.types.str;
-        default = "0.0.0.0";
-        description = "HTTP listen address.";
-      };
-
-      httpPort = lib.mkOption {
-        type = lib.types.port;
-        default = 3000;
-        description = "HTTP listen port.";
-      };
-
-      cookieSecure = lib.mkOption {
-        type = lib.types.bool;
-        default = false;
-        description = ''
-          Marks session cookies as "secure" as a hint for browsers to only send
-          them via HTTPS. This option is recommend, if Gogs is being served over HTTPS.
-        '';
-      };
-
-      extraConfig = lib.mkOption {
-        type = lib.types.str;
-        default = "";
-        description = "Configuration lines appended to the generated Gogs configuration file.";
-      };
-    };
-  };
-
-  config = lib.mkIf cfg.enable {
-
-    systemd.services.gogs = {
-      description = "Gogs (Go Git Service)";
-      after = [ "network.target" ];
-      wantedBy = [ "multi-user.target" ];
-      path = [ pkgs.gogs ];
-
-      preStart = let
-        runConfig = "${cfg.stateDir}/custom/conf/app.ini";
-        secretKey = "${cfg.stateDir}/custom/conf/secret_key";
-      in ''
-        mkdir -p ${cfg.stateDir}
-
-        # copy custom configuration and generate a random secret key if needed
-        ${lib.optionalString (cfg.useWizard == false) ''
-          mkdir -p ${cfg.stateDir}/custom/conf
-          cp -f ${configFile} ${runConfig}
-
-          if [ ! -e ${secretKey} ]; then
-              head -c 16 /dev/urandom | base64 > ${secretKey}
-          fi
-
-          KEY=$(head -n1 ${secretKey})
-          DBPASS=$(head -n1 ${cfg.database.passwordFile})
-          sed -e "s,#secretkey#,$KEY,g" \
-              -e "s,#dbpass#,$DBPASS,g" \
-              -i ${runConfig}
-        ''}
-
-        mkdir -p ${cfg.repositoryRoot}
-        # update all hooks' binary paths
-        HOOKS=$(find ${cfg.repositoryRoot} -mindepth 4 -maxdepth 4 -type f -wholename "*git/hooks/*")
-        if [ "$HOOKS" ]
-        then
-          sed -ri 's,/nix/store/[a-z0-9.-]+/bin/gogs,${pkgs.gogs}/bin/gogs,g' $HOOKS
-          sed -ri 's,/nix/store/[a-z0-9.-]+/bin/env,${pkgs.coreutils}/bin/env,g' $HOOKS
-          sed -ri 's,/nix/store/[a-z0-9.-]+/bin/bash,${pkgs.bash}/bin/bash,g' $HOOKS
-          sed -ri 's,/nix/store/[a-z0-9.-]+/bin/perl,${pkgs.perl}/bin/perl,g' $HOOKS
-        fi
-      '';
-
-      serviceConfig = {
-        Type = "simple";
-        User = cfg.user;
-        Group = cfg.group;
-        WorkingDirectory = cfg.stateDir;
-        ExecStart = "${pkgs.gogs}/bin/gogs web";
-        Restart = "always";
-        UMask = "0027";
-      };
-
-      environment = {
-        USER = cfg.user;
-        HOME = cfg.stateDir;
-        GOGS_WORK_DIR = cfg.stateDir;
-      };
-    };
-
-    users = lib.mkIf (cfg.user == "gogs") {
-      users.gogs = {
-        description = "Go Git Service";
-        uid = config.ids.uids.gogs;
-        group = "gogs";
-        home = cfg.stateDir;
-        createHome = true;
-        shell = pkgs.bash;
-      };
-      groups.gogs.gid = config.ids.gids.gogs;
-    };
-
-    warnings = lib.optional (cfg.database.password != "")
-      ''config.services.gogs.database.password will be stored as plaintext
-        in the Nix store. Use database.passwordFile instead.'';
-
-    # Create database passwordFile default when password is configured.
-    services.gogs.database.passwordFile =
-      (lib.mkDefault (toString (pkgs.writeTextFile {
-        name = "gogs-database-password";
-        text = cfg.database.password;
-      })));
-  };
-}
@@ -16,6 +16,11 @@ in
          timezone up-to-date based on the current location. It uses geoclue2 to
          determine the current location and systemd-timedated to actually set
          the timezone.
+
+          To avoid silent overriding by the service, if you have explicitly set a
+          timezone, either remove it or ensure that it is set with a lower priority
+          than the default value using `lib.mkDefault` or `lib.mkOverride`. This is
+          to make the choice deliberate. An error will be presented otherwise.
        '';
      };
      package = mkPackageOption pkgs "automatic-timezoned" { };
@@ -23,6 +28,10 @@ in
  };

  config = mkIf cfg.enable {
+    # This will give users an error if they have set an explicit time
+    # zone, rather than having the service silently override it.
+    time.timeZone = null;
+
    security.polkit.extraConfig = ''
      polkit.addRule(function(action, subject) {
        if (action.id == "org.freedesktop.timedate1.set-timezone"
@@ -12,9 +12,12 @@ let
    RAILS_ENV = "production";
    NODE_ENV = "production";

+    BOOTSNAP_CACHE_DIR="/var/cache/mastodon/precompile";
    LD_PRELOAD = "${pkgs.jemalloc}/lib/libjemalloc.so";

-    # mastodon-web concurrency.
+    MASTODON_USE_LIBVIPS = "true";
+
+    # Concurrency mastodon-web
    WEB_CONCURRENCY = toString cfg.webProcesses;
    MAX_THREADS = toString cfg.webThreads;

@@ -24,7 +27,7 @@ let
    DB_NAME = cfg.database.name;
    LOCAL_DOMAIN = cfg.localDomain;
    SMTP_SERVER = cfg.smtp.host;
-    SMTP_PORT = toString(cfg.smtp.port);
+    SMTP_PORT = toString cfg.smtp.port;
    SMTP_FROM_ADDRESS = cfg.smtp.fromAddress;
    PAPERCLIP_ROOT_PATH = "/var/lib/mastodon/public-system";
    PAPERCLIP_ROOT_URL = "/system";
@@ -33,12 +36,12 @@ let
    TRUSTED_PROXY_IP = cfg.trustedProxy;
  }
  // lib.optionalAttrs (cfg.redis.host != null) { REDIS_HOST = cfg.redis.host; }
-  // lib.optionalAttrs (cfg.redis.port != null) { REDIS_PORT = toString(cfg.redis.port); }
+  // lib.optionalAttrs (cfg.redis.port != null) { REDIS_PORT = toString cfg.redis.port; }
  // lib.optionalAttrs (cfg.redis.createLocally && cfg.redis.enableUnixSocket) { REDIS_URL = "unix://${config.services.redis.servers.mastodon.unixSocket}"; }
  // lib.optionalAttrs (cfg.database.host != "/run/postgresql" && cfg.database.port != null) { DB_PORT = toString cfg.database.port; }
  // lib.optionalAttrs cfg.smtp.authenticate { SMTP_LOGIN  = cfg.smtp.user; }
  // lib.optionalAttrs (cfg.elasticsearch.host != null) { ES_HOST = cfg.elasticsearch.host; }
-  // lib.optionalAttrs (cfg.elasticsearch.host != null) { ES_PORT = toString(cfg.elasticsearch.port); }
+  // lib.optionalAttrs (cfg.elasticsearch.host != null) { ES_PORT = toString cfg.elasticsearch.port; }
  // lib.optionalAttrs (cfg.elasticsearch.host != null) { ES_PRESET = cfg.elasticsearch.preset; }
  // lib.optionalAttrs (cfg.elasticsearch.user != null) { ES_USER = cfg.elasticsearch.user; }
  // cfg.extraConfig;
@@ -51,6 +54,9 @@ let
    Group = cfg.group;
    # Working directory
    WorkingDirectory = cfg.package;
+    # Cache directory and mode
+    CacheDirectory = "mastodon";
+    CacheDirectoryMode = "0750";
    # State directory and mode
    StateDirectory = "mastodon";
    StateDirectoryMode = "0750";
@@ -127,7 +133,7 @@ let
      description = "Mastodon sidekiq${jobClassLabel}";
      wantedBy = [ "mastodon.target" ];
      environment = env // {
-        PORT = toString(cfg.sidekiqPort);
+        PORT = toString cfg.sidekiqPort;
        DB_POOL = threads;
      };
      serviceConfig = {
@@ -309,7 +315,7 @@ in {
          Voluntary Application Server Identification.  A new keypair can
          be generated by running:

-          `nix build -f '<nixpkgs>' mastodon; cd result; bin/rake webpush:generate_keys`
+          `nix build -f '<nixpkgs>' mastodon; cd result; RAILS_ENV=production bin/rake webpush:generate_keys`

          If {option}`mastodon.vapidPrivateKeyFile`does not
          exist, it and this file will be created with a new keypair.
@@ -324,12 +330,57 @@ in {
        type = lib.types.str;
      };

+      activeRecordEncryptionDeterministicKeyFile = lib.mkOption {
+        description = ''
+          This key must be set to enable the Active Record Encryption feature within
+          Rails that Mastodon uses to encrypt and decrypt some database attributes.
+          A new Active Record keys can be generated by running:
+
+          `nix build -f '<nixpkgs>' mastodon; cd result; RAILS_ENV=production ./bin/rails db:encryption:init`
+
+          If this file does not exist, it will be created with a new Active Record
+          keys.
+        '';
+        default = "/var/lib/mastodon/secrets/active-record-encryption-deterministic-key";
+        type = lib.types.str;
+      };
+
+      activeRecordEncryptionKeyDerivationSaltFile = lib.mkOption {
+        description = ''
+          This key must be set to enable the Active Record Encryption feature within
+          Rails that Mastodon uses to encrypt and decrypt some database attributes.
+          A new Active Record keys can be generated by running:
+
+          `nix build -f '<nixpkgs>' mastodon; cd result; RAILS_ENV=production ./bin/rails db:encryption:init`
+
+          If this file does not exist, it will be created with a new Active Record
+          keys.
+        '';
+        default = "/var/lib/mastodon/secrets/active-record-encryption-key-derivation-salt";
+        type = lib.types.str;
+      };
+
+      activeRecordEncryptionPrimaryKeyFile = lib.mkOption {
+        description = ''
+          This key must be set to enable the Active Record Encryption feature within
+          Rails that Mastodon uses to encrypt and decrypt some database attributes.
+          A new Active Record keys can be generated by running:
+
+          `nix build -f '<nixpkgs>' mastodon; cd result; RAILS_ENV=production ./bin/rails db:encryption:init`
+
+          If this file does not exist, it will be created with a new Active Record
+          keys.
+        '';
+        default = "/var/lib/mastodon/secrets/active-record-encryption-primary-key";
+        type = lib.types.str;
+      };
+
      secretKeyBaseFile = lib.mkOption {
        description = ''
          Path to file containing the secret key base.
          A new secret key base can be generated by running:

-          `nix build -f '<nixpkgs>' mastodon; cd result; bin/rake secret`
+          `nix build -f '<nixpkgs>' mastodon; cd result; bin/bundle exec rails secret`

          If this file does not exist, it will be created with a new secret key base.
        '';
@@ -342,7 +393,7 @@ in {
          Path to file containing the OTP secret.
          A new OTP secret can be generated by running:

-          `nix build -f '<nixpkgs>' mastodon; cd result; bin/rake secret`
+          `nix build -f '<nixpkgs>' mastodon; cd result; bin/bundle exec rails secret`

          If this file does not exist, it will be created with a new OTP secret.
        '';
@@ -708,13 +759,28 @@ in {
      script = ''
        umask 077

+        if ! test -d /var/cache/mastodon/precompile; then
+          ${cfg.package}/bin/bundle exec bootsnap precompile --gemfile ${cfg.package}/app ${cfg.package}/lib
+        fi
+        if ! test -f ${cfg.activeRecordEncryptionDeterministicKeyFile}; then
+          mkdir -p $(dirname ${cfg.activeRecordEncryptionDeterministicKeyFile})
+          bin/rails db:encryption:init | grep --only-matching "ACTIVE_RECORD_ENCRYPTION_DETERMINISTIC_KEY=[^ ]\+" | sed 's/^ACTIVE_RECORD_ENCRYPTION_DETERMINISTIC_KEY=//' > ${cfg.activeRecordEncryptionDeterministicKeyFile}
+        fi
+        if ! test -f ${cfg.activeRecordEncryptionKeyDerivationSaltFile}; then
+          mkdir -p $(dirname ${cfg.activeRecordEncryptionKeyDerivationSaltFile})
+          bin/rails db:encryption:init | grep --only-matching "ACTIVE_RECORD_ENCRYPTION_KEY_DERIVATION_SALT=[^ ]\+" | sed 's/^ACTIVE_RECORD_ENCRYPTION_KEY_DERIVATION_SALT=//' > ${cfg.activeRecordEncryptionKeyDerivationSaltFile}
+        fi
+        if ! test -f ${cfg.activeRecordEncryptionPrimaryKeyFile}; then
+          mkdir -p $(dirname ${cfg.activeRecordEncryptionPrimaryKeyFile})
+          bin/rails db:encryption:init | grep --only-matching "ACTIVE_RECORD_ENCRYPTION_PRIMARY_KEY=[^ ]\+" | sed 's/^ACTIVE_RECORD_ENCRYPTION_PRIMARY_KEY=//' > ${cfg.activeRecordEncryptionPrimaryKeyFile}
+        fi
        if ! test -f ${cfg.secretKeyBaseFile}; then
          mkdir -p $(dirname ${cfg.secretKeyBaseFile})
-          bin/rake secret > ${cfg.secretKeyBaseFile}
+          bin/bundle exec rails secret > ${cfg.secretKeyBaseFile}
        fi
        if ! test -f ${cfg.otpSecretFile}; then
          mkdir -p $(dirname ${cfg.otpSecretFile})
-          bin/rake secret > ${cfg.otpSecretFile}
+          bin/bundle exec rails secret > ${cfg.otpSecretFile}
        fi
        if ! test -f ${cfg.vapidPrivateKeyFile}; then
          mkdir -p $(dirname ${cfg.vapidPrivateKeyFile}) $(dirname ${cfg.vapidPublicKeyFile})
@@ -724,6 +790,9 @@ in {
        fi

        cat > /var/lib/mastodon/.secrets_env <<EOF
+        ACTIVE_RECORD_ENCRYPTION_DETERMINISTIC_KEY="$(cat ${cfg.activeRecordEncryptionDeterministicKeyFile})"
+        ACTIVE_RECORD_ENCRYPTION_KEY_DERIVATION_SALT="$(cat ${cfg.activeRecordEncryptionKeyDerivationSaltFile})"
+        ACTIVE_RECORD_ENCRYPTION_PRIMARY_KEY="$(cat ${cfg.activeRecordEncryptionPrimaryKeyFile})"
        SECRET_KEY_BASE="$(cat ${cfg.secretKeyBaseFile})"
        OTP_SECRET="$(cat ${cfg.otpSecretFile})"
        VAPID_PRIVATE_KEY="$(cat ${cfg.vapidPrivateKeyFile})"
@@ -802,7 +871,7 @@ in {
      description = "Mastodon web";
      environment = env // (if cfg.enableUnixSocket
        then { SOCKET = "/run/mastodon-web/web.socket"; }
-        else { PORT = toString(cfg.webPort); }
+        else { PORT = toString cfg.webPort; }
      );
      serviceConfig = {
        ExecStart = "${cfg.package}/bin/puma -C config/puma.rb";
@@ -816,7 +885,7 @@ in {
        # System Call Filtering
        SystemCallFilter = [ ("~" + lib.concatStringsSep " " systemCallsList) "@chown" "pipe" "pipe2" ];
      } // cfgService;
-      path = with pkgs; [ ffmpeg-headless file imagemagick ];
+      path = with pkgs; [ ffmpeg-headless file ];
    };

    systemd.services.mastodon-media-auto-remove = lib.mkIf cfg.mediaAutoRemove.enable {
@@ -851,7 +920,7 @@ in {
        };

        locations."@proxy" = {
-          proxyPass = (if cfg.enableUnixSocket then "http://unix:/run/mastodon-web/web.socket" else "http://127.0.0.1:${toString(cfg.webPort)}");
+          proxyPass = (if cfg.enableUnixSocket then "http://unix:/run/mastodon-web/web.socket" else "http://127.0.0.1:${toString cfg.webPort}");
          proxyWebsockets = true;
        };

@@ -903,7 +972,7 @@ in {
          inherit (cfg) group;
        };
      })
-      (lib.attrsets.setAttrByPath [ cfg.user "packages" ] [ cfg.package pkgs.imagemagick ])
+      (lib.attrsets.setAttrByPath [ cfg.user "packages" ] [ cfg.package ])
      (lib.mkIf (cfg.redis.createLocally && cfg.redis.enableUnixSocket) {${config.services.mastodon.user}.extraGroups = [ "redis-mastodon" ];})
    ];

@@ -52,7 +52,7 @@ in

      ollamaUrl = lib.mkOption {
        type = lib.types.str;
-        default = "127.0.0.1:11434";
+        default = "http://127.0.0.1:11434";
        example = "https://ollama.example.org";
        description = ''
          The address (including host and port) under which we can access the Ollama backend server.
@@ -79,6 +79,7 @@ in
        serviceConfig = {
          ExecStart = "${lib.getExe nextjs-ollama-llm-ui}";
          DynamicUser = true;
+          CacheDirectory = "nextjs-ollama-llm-ui";
        };
      };
    };
@@ -853,9 +853,12 @@ in
        type = types.bool;
        default = false;
        description = ''
-          Resolves domains of proxyPass targets at runtime
-          and not only at start, you have to set
-          services.nginx.resolver, too.
+          Resolves domains of proxyPass targets at runtime and not only at startup.
+          This can be used as a workaround if nginx fails to start because of not-yet-working DNS.
+
+          :::{.warn}
+          `services.nginx.resolver` must be set for this option to work.
+          :::
        '';
      };

@@ -141,6 +141,7 @@ let
          --absolute-names \
          --verbatim-files-from \
          --transform 'flags=rSh;s|/nix/store/||' \
+          --transform 'flags=rSh;s|~nix~case~hack~[[:digit:]]\+||g' \
          --files-from ${hostPkgs.closureInfo { rootPaths = [ config.system.build.toplevel regInfo ]; }}/store-paths \
          | ${hostPkgs.erofs-utils}/bin/mkfs.erofs \
            --quiet \
@@ -4,6 +4,52 @@ let
  user = "alice";
  description = "Alice Foobar";
  password = "foobar";
+
+  # tmpfiles setup to make OCRing on terminal output more reliable
+  terminalOcrTmpfilesSetup =
+    {
+      pkgs,
+      lib,
+      config,
+    }:
+    let
+      white = "255, 255, 255";
+      black = "0, 0, 0";
+      colorSection = color: {
+        Color = color;
+        Bold = true;
+        Transparency = false;
+      };
+      terminalColors = pkgs.writeText "customized.colorscheme" (
+        lib.generators.toINI { } {
+          Background = colorSection white;
+          Foreground = colorSection black;
+          Color2 = colorSection black;
+          Color2Intense = colorSection black;
+        }
+      );
+      terminalConfig = pkgs.writeText "terminal.ubports.conf" (
+        lib.generators.toINI { } {
+          General = {
+            colorScheme = "customized";
+            fontSize = "16";
+            fontStyle = "Inconsolata";
+          };
+        }
+      );
+      confBase = "${config.users.users.${user}.home}/.config";
+      userDirArgs = {
+        mode = "0700";
+        user = user;
+        group = "users";
+      };
+    in
+    {
+      "${confBase}".d = userDirArgs;
+      "${confBase}/terminal.ubports".d = userDirArgs;
+      "${confBase}/terminal.ubports/customized.colorscheme".L.argument = "${terminalColors}";
+      "${confBase}/terminal.ubports/terminal.ubports.conf".L.argument = "${terminalConfig}";
+    };
 in
 {
  greeter = makeTest (
@@ -154,47 +200,9 @@ in
          };

          # Help with OCR
-          systemd.tmpfiles.settings =
-            let
-              white = "255, 255, 255";
-              black = "0, 0, 0";
-              colorSection = color: {
-                Color = color;
-                Bold = true;
-                Transparency = false;
-              };
-              terminalColors = pkgs.writeText "customized.colorscheme" (
-                lib.generators.toINI { } {
-                  Background = colorSection white;
-                  Foreground = colorSection black;
-                  Color2 = colorSection black;
-                  Color2Intense = colorSection black;
-                }
-              );
-              terminalConfig = pkgs.writeText "terminal.ubports.conf" (
-                lib.generators.toINI { } {
-                  General = {
-                    colorScheme = "customized";
-                    fontSize = "16";
-                    fontStyle = "Inconsolata";
-                  };
-                }
-              );
-              confBase = "${config.users.users.${user}.home}/.config";
-              userDirArgs = {
-                mode = "0700";
-                user = user;
-                group = "users";
-              };
-            in
-            {
-              "10-lomiri-test-setup" = {
-                "${confBase}".d = userDirArgs;
-                "${confBase}/terminal.ubports".d = userDirArgs;
-                "${confBase}/terminal.ubports/customized.colorscheme".L.argument = "${terminalColors}";
-                "${confBase}/terminal.ubports/terminal.ubports.conf".L.argument = "${terminalConfig}";
-              };
-            };
+          systemd.tmpfiles.settings = {
+            "10-lomiri-test-setup" = terminalOcrTmpfilesSetup { inherit pkgs lib config; };
+          };
        };

      enableOCR = true;
@@ -360,58 +368,20 @@ in
            };

            variables = {
-              # So we can test what content-hub is working behind the scenes
-              CONTENT_HUB_LOGGING_LEVEL = "2";
+              # So we can test what lomiri-content-hub is working behind the scenes
+              LOMIRI_CONTENT_HUB_LOGGING_LEVEL = "2";
            };

            systemPackages = with pkgs; [
-              # For a convenient way of kicking off content-hub peer collection
-              lomiri.content-hub.examples
+              # For a convenient way of kicking off lomiri-content-hub peer collection
+              lomiri.lomiri-content-hub.examples
            ];
          };

          # Help with OCR
-          systemd.tmpfiles.settings =
-            let
-              white = "255, 255, 255";
-              black = "0, 0, 0";
-              colorSection = color: {
-                Color = color;
-                Bold = true;
-                Transparency = false;
-              };
-              terminalColors = pkgs.writeText "customized.colorscheme" (
-                lib.generators.toINI { } {
-                  Background = colorSection white;
-                  Foreground = colorSection black;
-                  Color2 = colorSection black;
-                  Color2Intense = colorSection black;
-                }
-              );
-              terminalConfig = pkgs.writeText "terminal.ubports.conf" (
-                lib.generators.toINI { } {
-                  General = {
-                    colorScheme = "customized";
-                    fontSize = "16";
-                    fontStyle = "Inconsolata";
-                  };
-                }
-              );
-              confBase = "${config.users.users.${user}.home}/.config";
-              userDirArgs = {
-                mode = "0700";
-                user = user;
-                group = "users";
-              };
-            in
-            {
-              "10-lomiri-test-setup" = {
-                "${confBase}".d = userDirArgs;
-                "${confBase}/terminal.ubports".d = userDirArgs;
-                "${confBase}/terminal.ubports/customized.colorscheme".L.argument = "${terminalColors}";
-                "${confBase}/terminal.ubports/terminal.ubports.conf".L.argument = "${terminalConfig}";
-              };
-            };
+          systemd.tmpfiles.settings = {
+            "10-lomiri-test-setup" = terminalOcrTmpfilesSetup { inherit pkgs lib config; };
+          };
        };

      enableOCR = true;
@@ -484,9 +454,9 @@ in

              # lomiri-terminal-app has a separate VM test to test its basic functionality

-              # for the LSS content-hub test to work reliably, we need to kick off peer collecting
-              machine.send_chars("content-hub-test-importer\n")
-              wait_for_text(r"(/build/source|hub.cpp|handler.cpp|void|virtual|const)") # awaiting log messages from content-hub
+              # for the LSS lomiri-content-hub test to work reliably, we need to kick off peer collecting
+              machine.send_chars("lomiri-content-hub-test-importer\n")
+              wait_for_text(r"(/build/source|hub.cpp|handler.cpp|void|virtual|const)") # awaiting log messages from lomiri-content-hub
              machine.send_key("ctrl-c")

              # Doing this here, since we need an in-session shell & separately starting a terminal again wastes time
@@ -510,7 +480,7 @@ in
              wait_for_text("Rotation Lock")
              machine.screenshot("settings_open")

-              # lomiri-system-settings has a separate VM test, only test Lomiri-specific content-hub functionalities here
+              # lomiri-system-settings has a separate VM test, only test Lomiri-specific lomiri-content-hub functionalities here

              # Make fullscreen, can't navigate to Background plugin via keyboard unless window has non-phone-like aspect ratio
              toggle_maximise()
@@ -536,7 +506,7 @@ in

              # Peers should be loaded
              wait_for_text("Morph") # or Gallery, but Morph is already packaged
-              machine.screenshot("settings_content-hub_peers")
+              machine.screenshot("settings_lomiri-content-hub_peers")

              # Select Morph as content source
              mouse_click(370, 100)
@@ -544,11 +514,11 @@ in
              # Expect Morph to be brought into the foreground, with its Downloads page open
              wait_for_text("No downloads")

-              # If content-hub encounters a problem, it may have crashed the original application issuing the request.
+              # If lomiri-content-hub encounters a problem, it may have crashed the original application issuing the request.
              # Check that it's still alive
              machine.succeed("pgrep -u ${user} -f lomiri-system-settings")

-              machine.screenshot("content-hub_exchange")
+              machine.screenshot("lomiri-content-hub_exchange")

              # Testing any more would require more applications & setup, the fact that it's already being attempted is a good sign
              machine.send_key("esc")
@@ -732,8 +702,17 @@ in
            # Help with OCR
            fonts.packages = [ pkgs.inconsolata ];

-            # Non-QWERTY keymap to test keymap patch
-            services.xserver.xkb.layout = "de";
+            services.xserver.xkb.layout = lib.strings.concatStringsSep "," [
+              # Start with a non-QWERTY keymap to test keymap patch
+              "de"
+              # Then a QWERTY one to test switching
+              "us"
+            ];
+
+            # Help with OCR
+            systemd.tmpfiles.settings = {
+              "10-lomiri-test-setup" = terminalOcrTmpfilesSetup { inherit pkgs lib config; };
+            };
          };

        enableOCR = true;
@@ -784,6 +763,30 @@ in
                machine.send_chars("touch ${pwInput}\n")
                machine.wait_for_file("/home/alice/${pwOutput}", 10)

+                # Issues with this keybind: input leaks to focused surface, may open launcher
+                # Don't have the keyboard indicator to handle this better
+                machine.send_key("meta_l-spc")
+                machine.wait_for_console_text('SET KEYMAP "us"')
+
+                # Handle keybind fallout
+                machine.sleep(10) # wait for everything to settle
+                machine.send_key("esc") # close launcher in case it was opened
+                machine.sleep(2) # wait for animation to finish
+                # Make sure input leaks are gone
+                machine.send_key("backspace")
+                machine.send_key("backspace")
+                machine.send_key("backspace")
+                machine.send_key("backspace")
+                machine.send_key("backspace")
+                machine.send_key("backspace")
+                machine.send_key("backspace")
+                machine.send_key("backspace")
+                machine.send_key("backspace")
+                machine.send_key("backspace")
+
+                machine.send_chars("touch ${pwInput}\n")
+                machine.wait_for_file("/home/alice/${pwInput}", 10)
+
                machine.send_key("alt-f4")
          '';
      }
@@ -24,6 +24,8 @@ import ./make-test-python.nix ({ pkgs, ... }: {

      system.build.privateKey = snakeOilPrivateKey;
      system.build.publicKey = snakeOilPublicKey;
+      # needed to provide STC implementation for target
+      system.switch.enable = true;
    };

    target = { nodes, lib, ... }: let
@@ -24,7 +24,7 @@
 , xcbutilkeysyms
 , xcb-util-cursor
 , gtk3
-, webkitgtk
+, webkitgtk_4_0
 , python3
 , curl
 , pcre
@@ -85,7 +85,7 @@ stdenv.mkDerivation rec {
    libXScrnSaver
    curl
    gtk3
-    webkitgtk
+    webkitgtk_4_0
    freetype
    libGL
    libusb1
@@ -1,7 +1,7 @@
 { stdenv, lib, fetchFromGitHub
 , gobject-introspection, makeWrapper, wrapGAppsHook3
 , gtk3, gst_all_1, python3
-, gettext, adwaita-icon-theme, help2man, keybinder3, libnotify, librsvg, streamripper, udisks, webkitgtk
+, gettext, adwaita-icon-theme, help2man, keybinder3, libnotify, librsvg, streamripper, udisks, webkitgtk_4_0
 , iconTheme ? adwaita-icon-theme
 , deviceDetectionSupport ? true
 , documentationSupport ? true
@@ -67,7 +67,7 @@ stdenv.mkDerivation rec {
  ++ lib.optional multimediaKeySupport keybinder3
  ++ lib.optional (musicBrainzSupport || cdMetadataSupport) python3.pkgs.musicbrainzngs
  ++ lib.optional podcastSupport python3.pkgs.feedparser
-  ++ lib.optional wikipediaSupport webkitgtk;
+  ++ lib.optional wikipediaSupport webkitgtk_4_0;

  nativeCheckInputs = with python3.pkgs; [
    pytest
@@ -8,7 +8,7 @@
 , pkg-config
 , alsa-lib
 , freetype
-, webkitgtk
+, webkitgtk_4_0
 , zenity
 , curl
 , xorg
@@ -52,7 +52,7 @@ stdenv.mkDerivation (finalAttrs: {
    alsa-lib
    curl
    freetype
-    webkitgtk
+    webkitgtk_4_0
    xorg.libX11
    xorg.libXcursor
    xorg.libXext
@@ -21,7 +21,7 @@
  libmodplug,
  librsvg,
  libsoup,
-  webkitgtk,
+  webkitgtk_4_0,

  # optional features
  withDbusPython ? false,
@@ -90,7 +90,7 @@ python3.pkgs.buildPythonApplication {
      libappindicator-gtk3
      libmodplug
      libsoup
-      webkitgtk
+      webkitgtk_4_0
    ]
    ++ lib.optionals (withXineBackend) [ xine-lib ]
    ++ lib.optionals (withGstreamerBackend) (
@@ -1,5 +1,5 @@
 { lib, stdenv, fetchzip, autoPatchelfHook, makeWrapper
-, alsa-lib, curl, gtk3, webkitgtk, zenity }:
+, alsa-lib, curl, gtk3, webkitgtk_4_0, zenity }:

 stdenv.mkDerivation rec {
  pname = "rymcast";
@@ -13,7 +13,7 @@ stdenv.mkDerivation rec {

  nativeBuildInputs = [ autoPatchelfHook makeWrapper ];

-  buildInputs = [ alsa-lib curl gtk3 stdenv.cc.cc.lib webkitgtk zenity ];
+  buildInputs = [ alsa-lib curl gtk3 stdenv.cc.cc.lib webkitgtk_4_0 zenity ];

  installPhase = ''
    mkdir -p "$out/bin"
@@ -16,7 +16,7 @@
 , libopus
 , curl
 , gtk3
-, webkitgtk
+, webkitgtk_4_0
 }:

 stdenv.mkDerivation (finalAttrs: {
@@ -44,7 +44,7 @@ stdenv.mkDerivation (finalAttrs: {
    libopus
    curl
    gtk3
-    webkitgtk
+    webkitgtk_4_0
  ];

  runtimeDependencies = [
@@ -12,7 +12,7 @@
 , libXrandr
 , libXrender
 , libjack2
-, webkitgtk
+, webkitgtk_4_0
 }:

 stdenv.mkDerivation rec {
@@ -34,7 +34,7 @@ stdenv.mkDerivation rec {
    alsa-lib
    freetype
    libglvnd
-    webkitgtk
+    webkitgtk_4_0
  ] ++ runtimeDependencies;

  runtimeDependencies = map lib.getLib [
@@ -1,5 +1,5 @@
 { lib, stdenv, fetchFromGitHub, pkg-config, python3
-, alsa-lib, curl, freetype, gtk3, libGL, libX11, libXext, libXinerama, webkitgtk
+, alsa-lib, curl, freetype, gtk3, libGL, libX11, libXext, libXinerama, webkitgtk_4_0
 }:

 stdenv.mkDerivation {
@@ -15,7 +15,7 @@ stdenv.mkDerivation {
  };

  nativeBuildInputs = [ pkg-config python3 ];
-  buildInputs = [ alsa-lib curl freetype gtk3 libGL libX11 libXext libXinerama webkitgtk ];
+  buildInputs = [ alsa-lib curl freetype gtk3 libGL libX11 libXext libXinerama webkitgtk_4_0 ];

  postPatch = ''
    patchShebangs src/tunefish4/generate-lv2-ttl.py
@@ -12,7 +12,7 @@
 , glib
 , glib-networking
 , libxml2
-, webkitgtk
+, webkitgtk_4_0
 , clutter-gtk
 , clutter-gst
 , libunity
@@ -58,7 +58,7 @@ stdenv.mkDerivation rec {
    libunity
    pantheon.granite
    sqlite
-    webkitgtk
+    webkitgtk_4_0
    glib-networking
  ];

@@ -5,7 +5,7 @@
  fetchFromGitHub,
  pkg-config,
  makeWrapper,
-  webkitgtk,
+  webkitgtk_4_0,
  zenity,
  Cocoa,
  Security,
@@ -39,7 +39,7 @@ rustPlatform.buildRustPackage rec {
  ];
  buildInputs =
    lib.optional stdenv.hostPlatform.isDarwin Security
-    ++ lib.optional (withGui && stdenv.hostPlatform.isLinux) webkitgtk
+    ++ lib.optional (withGui && stdenv.hostPlatform.isLinux) webkitgtk_4_0
    ++ lib.optionals (withGui && stdenv.hostPlatform.isDarwin) [
      Cocoa
      WebKit
@@ -1,5 +1,5 @@
 { lib, stdenv, makeDesktopItem, freetype, fontconfig, libX11, libXrender
-, zlib, jdk, glib, glib-networking, gtk, libXtst, libsecret, gsettings-desktop-schemas, webkitgtk
+, zlib, jdk, glib, glib-networking, gtk, libXtst, libsecret, gsettings-desktop-schemas, webkitgtk_4_0
 , makeWrapper, perl, ... }:

 { name, src ? builtins.getAttr stdenv.hostPlatform.system sources, sources ? null, description, productVersion }:
@@ -21,7 +21,7 @@ stdenv.mkDerivation rec {
  buildInputs = [
    fontconfig freetype glib gsettings-desktop-schemas gtk jdk libX11
    libXrender libXtst libsecret zlib
-  ] ++ lib.optional (webkitgtk != null) webkitgtk;
+  ] ++ lib.optional (webkitgtk_4_0 != null) webkitgtk_4_0;

  buildCommand = ''
    # Unpack tarball.
@@ -41,7 +41,7 @@ stdenv.mkDerivation rec {

    makeWrapper $out/eclipse/eclipse $out/bin/eclipse \
      --prefix PATH : ${jdk}/bin \
-      --prefix LD_LIBRARY_PATH : ${lib.makeLibraryPath ([ glib gtk libXtst libsecret ] ++ lib.optional (webkitgtk != null) webkitgtk)} \
+      --prefix LD_LIBRARY_PATH : ${lib.makeLibraryPath ([ glib gtk libXtst libsecret ] ++ lib.optional (webkitgtk_4_0 != null) webkitgtk_4_0)} \
      --prefix GIO_EXTRA_MODULES : "${glib-networking}/lib/gio/modules" \
      --prefix XDG_DATA_DIRS : "$GSETTINGS_SCHEMAS_PATH" \
      --add-flags "-configuration \$HOME/.eclipse/''${productId}_${productVersion}/configuration"
@@ -1,7 +1,7 @@
 { lib, stdenv, fetchurl, makeDesktopItem, makeWrapper
 , freetype, fontconfig, libX11, libXrender, zlib
 , glib, gtk3, gtk2, libXtst, jdk, jdk8, gsettings-desktop-schemas
-, webkitgtk ? null  # for internal web browser
+, webkitgtk_4_0 ? null  # for internal web browser
 , buildEnv, runCommand
 , callPackage
 }:
@@ -29,7 +29,7 @@ in rec {
  # work around https://bugs.eclipse.org/bugs/show_bug.cgi?id=476075#c3
  buildEclipseUnversioned = callPackage ./build-eclipse.nix {
    inherit stdenv makeDesktopItem freetype fontconfig libX11 libXrender zlib
-            jdk glib gtk libXtst gsettings-desktop-schemas webkitgtk
+            jdk glib gtk libXtst gsettings-desktop-schemas webkitgtk_4_0
            makeWrapper;
  };
  buildEclipse = eclipseData: buildEclipseUnversioned (eclipseData // { productVersion = "${platform_major}.${platform_minor}"; });
@@ -55,7 +55,7 @@
 , systemd
 , tree-sitter
 , texinfo
-, webkitgtk
+, webkitgtk_4_0
 , wrapGAppsHook3
 , zlib

@@ -274,7 +274,7 @@ mkDerivation (finalAttrs: {
  ] ++ lib.optionals withXinput2 [
    libXi
  ] ++ lib.optionals withXwidgets [
-    webkitgtk
+    webkitgtk_4_0
  ] ++ lib.optionals stdenv.hostPlatform.isDarwin [
    sigtool
  ] ++ lib.optionals withNS [
@@ -9,7 +9,7 @@
 , gtkspell3
 , librsvg
 , pygobject3
-, webkitgtk
+, webkitgtk_4_0
 }:

 buildPythonApplication rec {
@@ -36,7 +36,7 @@ buildPythonApplication rec {
    gtkspell3
    librsvg
    pygobject3
-    webkitgtk
+    webkitgtk_4_0
  ];

  # Needs a display
@@ -1,7 +1,7 @@
 { lib, stdenv, fetchFromGitHub, meson, ninja, pkg-config, python3, perl, bison
 , texinfo, desktop-file-utils, wrapGAppsHook3, docbook2x, docbook-xsl-nons
 , inform7, gettext, libossp_uuid, gtk3, gobject-introspection, vala, gtk-doc
-, webkitgtk, gtksourceview3, gspell, libxml2, goocanvas2, libplist, glib
+, webkitgtk_4_0, gtksourceview3, gspell, libxml2, goocanvas2, libplist, glib
 , gst_all_1 }:

 # Neither gnome-inform7 nor its dependencies ratify and chimara have tagged releases in the GTK3 branch yet.
@@ -92,7 +92,7 @@ in stdenv.mkDerivation {
    gtk3
    gtksourceview3
    gspell
-    webkitgtk
+    webkitgtk_4_0
    libxml2
    goocanvas2
    libplist
@@ -1,5 +1,5 @@
 { lib, buildPythonApplication, fetchFromGitHub
-, gdk-pixbuf, glib, gobject-introspection, gtk3, gtksourceview, pango, webkitgtk
+, gdk-pixbuf, glib, gobject-introspection, gtk3, gtksourceview, pango, webkitgtk_4_0
 , pygobject3, pyyaml, setuptools
 }:

@@ -23,7 +23,7 @@ buildPythonApplication rec {
  build-system = [ setuptools ];

  propagatedBuildInputs = [
-    gdk-pixbuf glib gtk3 gtksourceview pango webkitgtk
+    gdk-pixbuf glib gtk3 gtksourceview pango webkitgtk_4_0
    pygobject3 pyyaml
  ];

@@ -5534,6 +5534,18 @@ final: prev:
    meta.homepage = "https://github.com/qnighy/lalrpop.vim/";
  };

+  langmapper-nvim = buildVimPlugin {
+    pname = "langmapper.nvim";
+    version = "2024-09-19";
+    src = fetchFromGitHub {
+      owner = "Wansmer";
+      repo = "langmapper.nvim";
+      rev = "ac74a80cb86e8b51e4a13ccb2ee540d544fe1c62";
+      sha256 = "1b2sjsi81r7m1pxxkisl4b2w2cag3v2i4andhn89gv6afzakvzka";
+    };
+    meta.homepage = "https://github.com/Wansmer/langmapper.nvim/";
+  };
+
  last256 = buildVimPlugin {
    pname = "last256";
    version = "2020-12-09";
@@ -12954,6 +12966,18 @@ final: prev:
    meta.homepage = "https://github.com/junegunn/vim-after-object/";
  };

+  vim-afterglow = buildVimPlugin {
+    pname = "vim-afterglow";
+    version = "2024-03-31";
+    src = fetchFromGitHub {
+      owner = "danilo-augusto";
+      repo = "vim-afterglow";
+      rev = "fe3a0c4d2acf13ed6f7f0f1fede0a2570f13b06e";
+      sha256 = "0z61jfdhhajw5k7y8msk8nj5nljwygmw3s6vsqq9qgczaixqh968";
+    };
+    meta.homepage = "https://github.com/danilo-augusto/vim-afterglow/";
+  };
+
  vim-agda = buildVimPlugin {
    pname = "vim-agda";
    version = "2024-05-17";
@@ -463,6 +463,7 @@ https://github.com/b3nj5m1n/kommentary/,,
 https://github.com/udalov/kotlin-vim/,,
 https://github.com/mistweaverco/kulala.nvim/,HEAD,
 https://github.com/qnighy/lalrpop.vim/,,
+https://github.com/Wansmer/langmapper.nvim/,HEAD,
 https://github.com/sk1418/last256/,,
 https://github.com/latex-box-team/latex-box/,,
 https://github.com/dundalek/lazy-lsp.nvim/,HEAD,
@@ -1092,6 +1093,7 @@ https://github.com/MarcWeber/vim-addon-syntax-checker/,,
 https://github.com/MarcWeber/vim-addon-toggle-buffer/,,
 https://github.com/MarcWeber/vim-addon-xdebug/,,
 https://github.com/junegunn/vim-after-object/,,
+https://github.com/danilo-augusto/vim-afterglow/,HEAD,
 https://github.com/msuperdock/vim-agda/,HEAD,
 https://github.com/vim-airline/vim-airline/,,
 https://github.com/enricobacis/vim-airline-clock/,,
@@ -13,7 +13,7 @@
 , openssl
 , pkg-config
 , rustPlatform
-, webkitgtk
+, webkitgtk_4_0
 }:

 let
@@ -74,7 +74,7 @@ rustPlatform.buildRustPackage {
  '';

  nativeBuildInputs = [ cmake pkg-config ];
-  buildInputs = [ dbus openssl freetype libsoup gtk3 webkitgtk ];
+  buildInputs = [ dbus openssl freetype libsoup gtk3 webkitgtk_4_0 ];

  checkFlags = [
    # tries to mutate the parent directory
@@ -31,7 +31,7 @@
 , python3
 , desktop-file-utils
 , itstool
-, withWebservices ? true, webkitgtk
+, withWebservices ? true, webkitgtk_4_0
 }:

 stdenv.mkDerivation rec {
@@ -79,7 +79,7 @@ stdenv.mkDerivation rec {
    libtiff
    libwebp
    libX11
-  ] ++ lib.optional withWebservices webkitgtk;
+  ] ++ lib.optional withWebservices webkitgtk_4_0;

  mesonFlags = [
    "-Dlibchamplain=true"
@@ -7,7 +7,7 @@
 , glib
 , gtk3
 , libgee
-, webkitgtk
+, webkitgtk_4_0
 , clutter-gtk
 , clutter-gst
 , ninja
@@ -38,7 +38,7 @@ stdenv.mkDerivation (finalAttrs: {
    glib
    gtk3
    libgee
-    webkitgtk
+    webkitgtk_4_0
    clutter-gtk
    clutter-gst
  ];
@@ -39,7 +39,7 @@
  pcre,
  systemd,
  tbb_2021_11,
-  webkitgtk,
+  webkitgtk_4_0,
  wxGTK31,
  xorg,
  withSystemd ? stdenv.hostPlatform.isLinux,
@@ -110,7 +110,7 @@ stdenv.mkDerivation rec {
    openvdb_tbb_2021_8
    pcre
    tbb_2021_11
-    webkitgtk
+    webkitgtk_4_0
    wxGTK31'
    xorg.libX11
  ] ++ lib.optionals withSystemd [ systemd ] ++ checkInputs;
@@ -16,6 +16,21 @@ buildGoModule rec {

  nativeBuildInputs = [ installShellFiles ];

+  patches = [
+    (builtins.toFile "fix-zsh-completion.patch" ''
+      diff --git a/scripts/cheat.zsh b/scripts/cheat.zsh
+      index befe1b2..675c9f8 100755
+      --- a/scripts/cheat.zsh
+      +++ b/scripts/cheat.zsh
+      @@ -62,4 +62,4 @@ _cheat() {
+         esac
+       }
+
+      -compdef _cheat cheat
+      +_cheat "$@"
+    '')
+  ];
+
  postInstall = ''
    installManPage doc/cheat.1
    installShellCompletion scripts/cheat.{bash,fish,zsh}
@@ -35,9 +35,12 @@ python3Packages.buildPythonApplication rec {
    pygobject3
    pycairo
    pyxdg
+    setuptools
    dbus-python
  ];

+  PYTHONDIR = "${placeholder "out"}/${python3Packages.python.sitePackages}";
+
  dontWrapGApps = true;

  # Arguments to be passed to `makeWrapper`, only used by buildPython*
@@ -4,7 +4,7 @@
 , autoPatchelfHook
 , dpkg
 , openssl
-, webkitgtk
+, webkitgtk_4_0
 , libappindicator
 , wrapGAppsHook3
 , shared-mime-info
@@ -29,7 +29,7 @@ stdenv.mkDerivation rec {

  buildInputs = [
    openssl
-    webkitgtk
+    webkitgtk_4_0
    libappindicator

    glib-networking
@@ -7,7 +7,7 @@
 , freetype
 , libsoup
 , gtk3
-, webkitgtk
+, webkitgtk_4_0
 , perl
 , cyrus_sasl
 , stdenv
@@ -77,7 +77,7 @@ stdenv.mkDerivation rec {
    freetype
    libsoup
    gtk3
-    webkitgtk
+    webkitgtk_4_0
  ];

  meta = with lib; {
@@ -13,7 +13,7 @@
 , gtk3
 , libnotify
 , pango
-, webkitgtk
+, webkitgtk_4_0
 , wrapGAppsHook3

  # check inputs
@@ -93,7 +93,7 @@ buildPythonApplication rec {
    gtk3
    libnotify
    pango
-    webkitgtk
+    webkitgtk_4_0
  ] ++ (with gst_all_1; [
    gst-libav
    gst-plugins-bad
@@ -7,7 +7,7 @@
 let

  qt5Deps = pkgs: with pkgs.qt5; [ qtbase qtmultimedia ];
-  gnomeDeps = pkgs: with pkgs; [ zenity gtksourceview gnome-desktop libgnome-keyring webkitgtk ];
+  gnomeDeps = pkgs: with pkgs; [ zenity gtksourceview gnome-desktop libgnome-keyring webkitgtk_4_0 ];
  xorgDeps = pkgs: with pkgs.xorg; [
    libX11 libXrender libXrandr libxcb libXmu libpthreadstubs libXext libXdmcp
    libXxf86vm libXinerama libSM libXv libXaw libXi libXcursor libXcomposite
@@ -9,7 +9,7 @@
 , steam-run
 , substituteAll
 , unzip
-, webkitgtk
+, webkitgtk_4_0
 , wrapGAppsHook3
 }:

@@ -61,7 +61,7 @@ python3Packages.buildPythonApplication rec {
  pythonPath = [
    python3Packages.pygobject3
    python3Packages.requests
-    webkitgtk
+    webkitgtk_4_0
  ];

  dontWrapGApps = true;
@@ -1,6 +1,6 @@
 { lib, stdenv, fetchFromGitHub, cmake, pkg-config, vala, gtk3, libgee
 , poppler, libpthreadstubs, gstreamer, gst-plugins-base, gst-plugins-good, gst-libav, gobject-introspection, wrapGAppsHook3
-, qrencode, webkitgtk, discount, json-glib, fetchpatch }:
+, qrencode, webkitgtk_4_0, discount, json-glib, fetchpatch }:

 stdenv.mkDerivation rec {
  pname = "pdfpc";
@@ -28,7 +28,7 @@ stdenv.mkDerivation rec {
    (gst-plugins-good.override { gtkSupport = true; })
    gst-libav
    qrencode
-    webkitgtk
+    webkitgtk_4_0
    discount
    json-glib
  ];
@@ -11,7 +11,7 @@
 , perl
 , sqlite
 , tzdata
-, webkitgtk
+, webkitgtk_4_0
 , wrapGAppsHook3
 , xvfb-run
 }:
@@ -54,7 +54,7 @@ in python.pkgs.buildPythonApplication rec {
  buildInputs = [
    sqlite
    gtk3
-    webkitgtk
+    webkitgtk_4_0
    glib-networking
    adwaita-icon-theme
    gdk-pixbuf
@@ -3,7 +3,7 @@
 , gobject-introspection
 , gtk3
 , gtksourceview4
-, webkitgtk
+, webkitgtk_4_0
 , wrapGAppsHook3
 , python3Packages
 }:
@@ -28,7 +28,7 @@ python3Packages.buildPythonApplication rec {
    # webkitgtk is used for rendering interactive statistics graph which
    # can be seen by opening a ROM, entering Pokemon section, selecting
    # any Pokemon, and clicking Stats and Moves tab.
-    webkitgtk
+    webkitgtk_4_0
  ];

  nativeBuildInputs = [
@@ -8,7 +8,7 @@
 , gobject-introspection
 , gtk3
 , wrapGAppsHook3
-, webkitgtk
+, webkitgtk_4_0
 , libnotify
 , keybinder3
 , libappindicator
@@ -44,7 +44,7 @@ python3Packages.buildPythonApplication rec {
    libappindicator
    libnotify
    librsvg
-    webkitgtk
+    webkitgtk_4_0
    wmctrl
  ];

@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchurl, jdk, makeWrapper, autoPatchelfHook, makeDesktopItem, glib, libsecret, webkitgtk }:
+{ lib, stdenv, fetchurl, jdk, makeWrapper, autoPatchelfHook, makeDesktopItem, glib, libsecret, webkitgtk_4_0 }:

 stdenv.mkDerivation rec {
  pname = "apache-directory-studio";
@@ -38,7 +38,7 @@ stdenv.mkDerivation rec {
    makeWrapper "$dest/ApacheDirectoryStudio" \
        "$out/bin/ApacheDirectoryStudio" \
        --prefix PATH : "${jdk}/bin" \
-        --prefix LD_LIBRARY_PATH : ${lib.makeLibraryPath ([ webkitgtk ])}
+        --prefix LD_LIBRARY_PATH : ${lib.makeLibraryPath ([ webkitgtk_4_0 ])}
    install -D icon.xpm "$out/share/pixmaps/apache-directory-studio.xpm"
    install -D -t "$out/share/applications" ${desktopItem}/share/applications/*
  '';
@@ -5,7 +5,7 @@
 , pkg-config
 , ed
 , wrapGAppsHook3
-, webkitgtk
+, webkitgtk_4_0
 , libxml2
 , glib-networking
 , gettext
@@ -32,7 +32,7 @@ stdenv.mkDerivation rec {
  ];

  buildInputs = [
-    webkitgtk
+    webkitgtk_4_0
    libxml2
    gettext
    glib-networking
@@ -1,5 +1,5 @@
 { lib, fetchgit, meson, ninja, pkg-config, nix-update-script
-, python3, gtk3, libsecret, gst_all_1, webkitgtk, glib
+, python3, gtk3, libsecret, gst_all_1, webkitgtk_4_0, glib
 , glib-networking, gtkspell3, hunspell, desktop-file-utils
 , gobject-introspection, wrapGAppsHook3, gnome-settings-daemon }:

@@ -37,7 +37,7 @@ python3.pkgs.buildPythonApplication rec {
    gtkspell3
    hunspell
    libsecret
-    webkitgtk
+    webkitgtk_4_0
    glib
  ];

@@ -13,7 +13,7 @@
 , pantheon
 , pkg-config
 , python3
-, webkitgtk
+, webkitgtk_4_0
 , wrapGAppsHook3
 , glib-networking
 }:
@@ -47,7 +47,7 @@ stdenv.mkDerivation rec {
    libdazzle
    libgee
    pantheon.granite
-    webkitgtk
+    webkitgtk_4_0
  ];

  postPatch = ''
@@ -10,7 +10,7 @@
 , luafilesystem
 , luajit
 , sqlite
-, webkitgtk
+, webkitgtk_4_0
 }:

 stdenv.mkDerivation rec {
@@ -35,7 +35,7 @@ stdenv.mkDerivation rec {
    luafilesystem
    luajit
    sqlite
-    webkitgtk
+    webkitgtk_4_0
  ] ++ ( with gst_all_1; [
    gstreamer
    gst-plugins-base
@@ -9,7 +9,7 @@
 , gcr
 , libpeas
 , gtk3
-, webkitgtk
+, webkitgtk_4_0
 , sqlite
 , gsettings-desktop-schemas
 , libsoup
@@ -44,7 +44,7 @@ stdenv.mkDerivation rec {
    gtk3
    libpeas
    sqlite
-    webkitgtk
+    webkitgtk_4_0
    json-glib
    libarchive
  ];
@@ -15,7 +15,7 @@
 , gdk-pixbuf
 , cairo
 , pango
-, webkitgtk
+, webkitgtk_4_0
 , openssl
 , gstreamer
 , gst-libav
@@ -74,7 +74,7 @@ stdenv.mkDerivation (finalAttrs: {
    cairo
    pango
    gtk3
-    webkitgtk
+    webkitgtk_4_0
    openssl
    libfixposix
  ];
@@ -1,6 +1,6 @@
 { lib, stdenv, fetchgit
 , pkg-config, wrapGAppsHook3
-, glib, gcr, glib-networking, gsettings-desktop-schemas, gtk, libsoup, webkitgtk
+, glib, gcr, glib-networking, gsettings-desktop-schemas, gtk, libsoup, webkitgtk_4_0
 , xorg, dmenu, findutils, gnused, coreutils, gst_all_1
 , patches ? null
 }:
@@ -24,7 +24,7 @@ stdenv.mkDerivation rec {
    gsettings-desktop-schemas
    gtk
    libsoup
-    webkitgtk
+    webkitgtk_4_0
  ] ++ (with gst_all_1; [
    # Audio & video support for webkitgtk WebView
    gstreamer
@@ -58,7 +58,7 @@ stdenv.mkDerivation rec {
    '';
    homepage = "https://surf.suckless.org";
    license = licenses.mit;
-    platforms = webkitgtk.meta.platforms;
+    platforms = webkitgtk_4_0.meta.platforms;
    maintainers = with maintainers; [ joachifm ];
  };
 }
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchFromGitHub, pkg-config, libsoup, webkitgtk, gtk3, glib-networking
+{ lib, stdenv, fetchFromGitHub, pkg-config, libsoup, webkitgtk_4_0, gtk3, glib-networking
 , gsettings-desktop-schemas, wrapGAppsHook3
 }:

@@ -14,7 +14,7 @@ stdenv.mkDerivation rec {
  };

  nativeBuildInputs = [ wrapGAppsHook3 pkg-config ];
-  buildInputs = [ gtk3 libsoup webkitgtk glib-networking gsettings-desktop-schemas ];
+  buildInputs = [ gtk3 libsoup webkitgtk_4_0 glib-networking gsettings-desktop-schemas ];

  passthru = {
    inherit gtk3;
@@ -307,6 +307,15 @@
    "spdx": "MPL-2.0",
    "vendorHash": "sha256-ZmOuk2uNnFQzXSfRp6Lz/1bplEm0AuB/M94+dRnqhHU="
  },
+  "deno": {
+    "hash": "sha256-7IvJrhXMeAmf8e21QBdYNSJyVMEzLpat4Tm4zHWglW8=",
+    "homepage": "https://registry.terraform.io/providers/denoland/deno",
+    "owner": "denoland",
+    "repo": "terraform-provider-deno",
+    "rev": "v0.1.0",
+    "spdx": "MPL-2.0",
+    "vendorHash": "sha256-mJXQVfCmW7ssFCrrRSiNb5Vg2QnS9NoBCgZlDDPMoEU="
+  },
  "dexidp": {
    "hash": "sha256-ommpazPlY4dMAOB1pgI7942aGH6YYPn6WtaowucQpZY=",
    "homepage": "https://registry.terraform.io/providers/marcofranssen/dexidp",
@@ -18,7 +18,7 @@
  libxml2,
  openssl,
  sqlite,
-  webkitgtk,
+  webkitgtk_6_0,
  glib-networking,
  librsvg,
  gst_all_1,
@@ -77,7 +77,7 @@ stdenv.mkDerivation (finalAttrs: {
      libxml2
      openssl
      sqlite
-      webkitgtk
+      webkitgtk_6_0

      # TLS support for loading external content in webkitgtk WebView
      glib-networking
@@ -11,7 +11,7 @@
  perl,
  pkg-config,
  glib,
-  webkitgtk,
+  webkitgtk_4_0,
  libayatana-appindicator,
  cairo,
  openssl,
@@ -88,7 +88,7 @@ in

      buildInputs = [
        glib
-        webkitgtk
+        webkitgtk_4_0
        libayatana-appindicator
        cairo
        openssl
@@ -8,7 +8,7 @@
 , wrapGAppsHook4
 , gtk4
 , gdk-pixbuf
-, webkitgtk
+, webkitgtk_4_0
 , gtksourceview5
 , glib-networking
 , libadwaita
@@ -42,7 +42,7 @@ python3.pkgs.buildPythonApplication rec {
  buildInputs = [
    gtk4
    gdk-pixbuf
-    webkitgtk
+    webkitgtk_4_0
    gtksourceview5
    glib-networking
    libadwaita
@@ -54,11 +54,8 @@ stdenv.mkDerivation {
      #!nix-shell -i bash -p curl gnugrep common-updater-scripts
      set -x
      set -eou pipefail;
-      url=$(curl -sI "https://discordapp.com/api/download/${
-        builtins.replaceStrings [ "discord-" "discord" ] [ "" "stable" ] pname
-      }?platform=osx&format=dmg" | grep -oP 'location: \K\S+')
-      version=''${url##https://dl*.discordapp.net/apps/osx/}
-      version=''${version%%/*.dmg}
+      url=$(curl -sI -o /dev/null -w '%header{location}' "https://discord.com/api/download/${branch}?platform=osx&format=dmg")
+      version=$(echo $url | grep -oP '/\K(\d+\.){2}\d+')
      update-source-version ${lib.optionalString (!stdenv.buildPlatform.isDarwin) "pkgsCross.aarch64-darwin."}${pname} "$version" --file=./pkgs/applications/networking/instant-messengers/discord/default.nix --version-key=${branch}
    '';
  };
@@ -2,52 +2,52 @@
 let
  versions =
    if stdenv.hostPlatform.isLinux then {
-      stable = "0.0.70";
-      ptb = "0.0.105";
-      canary = "0.0.492";
-      development = "0.0.28";
+      stable = "0.0.71";
+      ptb = "0.0.110";
+      canary = "0.0.502";
+      development = "0.0.30";
    } else {
-      stable = "0.0.318";
-      ptb = "0.0.133";
-      canary = "0.0.591";
-      development = "0.0.49";
+      stable = "0.0.322";
+      ptb = "0.0.140";
+      canary = "0.0.611";
+      development = "0.0.53";
    };
  version = versions.${branch};
  srcs = rec {
    x86_64-linux = {
      stable = fetchurl {
-        url = "https://dl.discordapp.net/apps/linux/${version}/discord-${version}.tar.gz";
-        hash = "sha256-Ujlewrhbqal97hCG6+Iu+OqntWZJ/oY6ZHeL+HmoU38=";
+        url = "https://stable.dl2.discordapp.net/apps/linux/${version}/discord-${version}.tar.gz";
+        hash = "sha256-PMcavgUhL8c1YFaWsooZObDa7APMqCD1IaysED5fWac=";
      };
      ptb = fetchurl {
-        url = "https://dl-ptb.discordapp.net/apps/linux/${version}/discord-ptb-${version}.tar.gz";
-        hash = "sha256-u/4wWssZxKlHrRW/Vd9pqUfqN2VQGYv1SDktpRsOayM=";
+        url = "https://ptb.dl2.discordapp.net/apps/linux/${version}/discord-ptb-${version}.tar.gz";
+        hash = "sha256-NV/0YKn1rG54Zkc9qAmpeb+4YbKjxhjTCdPOd84Lcc8=";
      };
      canary = fetchurl {
-        url = "https://dl-canary.discordapp.net/apps/linux/${version}/discord-canary-${version}.tar.gz";
-        hash = "sha256-NjcNgKYm1Twm8nN3sFlZCG/3x5fcSmX7X2On7CeZm0M=";
+        url = "https://canary.dl2.discordapp.net/apps/linux/${version}/discord-canary-${version}.tar.gz";
+        hash = "sha256-2DE7p3eT/mVGC+ejnTcTEhF7sEWyhfUfzj0gYTh+6Dw=";
      };
      development = fetchurl {
-        url = "https://dl-development.discordapp.net/apps/linux/${version}/discord-development-${version}.tar.gz";
-        hash = "sha256-326KAuqt3VQSgyJAdsdc7YgrdF3vCVoJoKUCVC2UdaU=";
+        url = "https://development.dl2.discordapp.net/apps/linux/${version}/discord-development-${version}.tar.gz";
+        hash = "sha256-HxMJQd5fM1VNfrBey4SbnnBkFQYZgbxg4YTy6FIC9Ps=";
      };
    };
    x86_64-darwin = {
      stable = fetchurl {
-        url = "https://dl.discordapp.net/apps/osx/${version}/Discord.dmg";
-        hash = "sha256-Ot6IM6EAg4MQPp0JqvUOZNAor6Nr6luc6pGY+722GMo=";
+        url = "https://stable.dl2.discordapp.net/apps/osx/${version}/Discord.dmg";
+        hash = "sha256-RLAdcCcRrUtDSdaj/RdVLJGvufpIjZoMAKxp0Jyu17A=";
      };
      ptb = fetchurl {
-        url = "https://dl-ptb.discordapp.net/apps/osx/${version}/DiscordPTB.dmg";
-        hash = "sha256-FFp6CRgD/kpCVxJ4+es0DaOGaW5v2Aa+lzJdG2Zu8eY=";
+        url = "https://ptb.dl2.discordapp.net/apps/osx/${version}/DiscordPTB.dmg";
+        hash = "sha256-VGhvykujfzI7jwXE+lHTzqT0t08GaON6gCuf13po7wY=";
      };
      canary = fetchurl {
-        url = "https://dl-canary.discordapp.net/apps/osx/${version}/DiscordCanary.dmg";
-        hash = "sha256-TIXe8cy6feME0900R5aWyItZfUrUA8zXo0pqwQ79yAM=";
+        url = "https://canary.dl2.discordapp.net/apps/osx/${version}/DiscordCanary.dmg";
+        hash = "sha256-QC8RANqoyMAGKjTF0NNhz7wMt65D5LI1xYtd++dHXC4=";
      };
      development = fetchurl {
-        url = "https://dl-development.discordapp.net/apps/osx/${version}/DiscordDevelopment.dmg";
-        hash = "sha256-kfHnS1NHuPD7UR7XvMdtY2LPsDRJVQHk7/Nm+cR/KGc=";
+        url = "https://development.dl2.discordapp.net/apps/osx/${version}/DiscordDevelopment.dmg";
+        hash = "sha256-DhY8s7Mhzos0ygB/WuoE07WK6hoIh/FcETeIsffw+e0=";
      };
    };
    aarch64-darwin = x86_64-darwin;
@@ -78,7 +78,7 @@ let
          meta = meta // { mainProgram = value.binaryName; };
        }))
      {
-        stable = rec {
+        stable = {
          pname = "discord";
          binaryName = "Discord";
          desktopName = "Discord";
@@ -151,11 +151,8 @@ stdenv.mkDerivation rec {
      #!/usr/bin/env nix-shell
      #!nix-shell -i bash -p curl gnugrep common-updater-scripts
      set -eou pipefail;
-      url=$(curl -sI "https://discordapp.com/api/download/${
-        builtins.replaceStrings [ "discord-" "discord" ] [ "" "stable" ] pname
-      }?platform=linux&format=tar.gz" | grep -oP 'location: \K\S+')
-      version=''${url##https://dl*.discordapp.net/apps/linux/}
-      version=''${version%%/*.tar.gz}
+      url=$(curl -sI -o /dev/null -w '%header{location}' "https://discord.com/api/download/${branch}?platform=linux&format=tar.gz")
+      version=$(echo $url | grep -oP '/\K(\d+\.){2}\d+')
      update-source-version ${pname} "$version" --file=./pkgs/applications/networking/instant-messengers/discord/default.nix --version-key=${branch}
    '';
  };
@@ -16,7 +16,7 @@
 , librsvg
 , libzip
 , openssl
-, webkitgtk
+, webkitgtk_4_0
 , libappindicator-gtk3
 }:

@@ -48,7 +48,7 @@ stdenv.mkDerivation rec {
    librsvg
    libzip
    openssl
-    webkitgtk
+    webkitgtk_4_0
    libappindicator-gtk3
  ];

@@ -20,7 +20,7 @@
 , pcre
 , pcre2
 , pkg-config
-, webkitgtk
+, webkitgtk_4_0
 , wrapGAppsHook3
 , xorg
 }:
@@ -63,7 +63,7 @@ stdenv.mkDerivation (finalAttrs: {
    pcre
    pcre2
    sqlite
-    webkitgtk
+    webkitgtk_4_0
    xorg.libXdmcp
    xorg.libXtst
  ];
@@ -2,22 +2,16 @@

 stdenv.mkDerivation rec {
  pname = "wee-slack";
-  version = "2.10.2";
+  version = "2.11.0";

  src = fetchFromGitHub {
    repo = "wee-slack";
    owner = "wee-slack";
    rev = "v${version}";
-    sha256 = "sha256-EtPhaNFYDxxSrSLXHHnY4ARpRycNNxbg5QPKtnPem04=";
+    sha256 = "sha256-xQO/yi4pJSnO/ldzVQkC7UhAfpy57xzO58NV7KZm4E8=";
  };

  patches = [
-    # Fix for https://github.com/wee-slack/wee-slack/issues/930
-    (fetchpatch {
-      url = "https://github.com/wee-slack/wee-slack/commit/e610b39aee2d9a49d080924d47d96c5d140f66ac.patch";
-      hash = "sha256-+yBZSx0LsoXmTmdN9d3VV2KNzpXfgfNVp4ZqfS4oKzg=";
-    })
-
    (substituteAll {
      src = ./libpath.patch;
      env = "${buildEnv {
@@ -5,21 +5,24 @@
 }:
 rustPlatform.buildRustPackage rec {
  pname = "lls";
-  version = "0.2.0";
+  version = "0.3.0";

  src = fetchFromGitHub {
    owner = "jcaesar";
    repo = "lls";
    rev = "v${version}";
-    hash = "sha256-FtRPRR+/R3JTEI90mAEHFyhqloAbNEdR3jkquKa9Ahw=";
+    hash = "sha256-f2f09ptMBZfBY1jjOEc8ElAoEj4LKXXSdXLlYLf8Z3M=";
  };

-  cargoHash = "sha256-yjRbg/GzCs5d3zXL22j5U9c4BlOcRHyggHCovj4fMIs=";
+  cargoHash = "sha256-LS0azaKBFWW86R4XO5BkCHMEG2UwgkVQIwLELxewiu0=";

  meta = with lib; {
    description = "Tool to list listening sockets";
    license = licenses.mit;
-    maintainers = [ maintainers.k900 ];
+    maintainers = [
+      maintainers.k900
+      maintainers.jcaesar
+    ];
    platforms = platforms.linux;
    homepage = "https://github.com/jcaesar/lls";
    mainProgram = "lls";
@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchFromGitHub, fetchpatch, cmake, pkg-config, adwaita-icon-theme, gmime3, webkitgtk, ronn
+{ lib, stdenv, fetchFromGitHub, fetchpatch, cmake, pkg-config, adwaita-icon-theme, gmime3, webkitgtk_4_0, ronn
 , libsass, notmuch, boost, wrapGAppsHook3, glib-networking, protobuf
 , gtkmm3, libpeas, gsettings-desktop-schemas, gobject-introspection, python3

@@ -35,7 +35,7 @@ stdenv.mkDerivation rec {
  ];

  buildInputs = [
-    gtkmm3 gmime3 webkitgtk libsass libpeas
+    gtkmm3 gmime3 webkitgtk_4_0 libsass libpeas
    python3
    notmuch boost gsettings-desktop-schemas adwaita-icon-theme
    glib-networking protobuf
@@ -18,7 +18,7 @@
 , openssl
 , pkg-config
 , sqlite
-, webkitgtk
+, webkitgtk_4_0
 , wrapGAppsHook3
 }:

@@ -53,7 +53,7 @@ stdenv.mkDerivation rec {
    libsecret
    openssl
    sqlite
-    webkitgtk
+    webkitgtk_4_0
  ];

  configureFlags = [
@@ -31,7 +31,7 @@
 , enablePluginBsfilter ? true
 , enablePluginClamd ? true
 , enablePluginDillo ? true
-, enablePluginFancy ? true, webkitgtk
+, enablePluginFancy ? true, webkitgtk_4_0
 , enablePluginFetchInfo ? true
 , enablePluginKeywordWarner ? true
 , enablePluginLibravatar ? enablePluginRavatar
@@ -67,7 +67,7 @@ let
    { flags = [ "dbus" ]; enabled = enableDbus; deps = [ dbus dbus-glib ]; }
    { flags = [ "dillo-plugin" ]; enabled = enablePluginDillo; }
    { flags = [ "enchant" ]; enabled = enableEnchant; deps = [ enchant ]; }
-    { flags = [ "fancy-plugin" ]; enabled = enablePluginFancy; deps = [ webkitgtk ]; }
+    { flags = [ "fancy-plugin" ]; enabled = enablePluginFancy; deps = [ webkitgtk_4_0 ]; }
    { flags = [ "fetchinfo-plugin" ]; enabled = enablePluginFetchInfo; }
    { flags = [ "keyword_warner-plugin" ]; enabled = enablePluginKeywordWarner; }
    { flags = [ "gnutls" ]; enabled = enableGnuTLS; deps = [ gnutls ]; }
@@ -8,8 +8,8 @@
 , libxml2
 , libxslt
 , sqlite
-, libsoup
-, webkitgtk
+, libsoup_3
+, webkitgtk_4_1
 , json-glib
 , gst_all_1
 , libnotify
@@ -42,11 +42,11 @@ stdenv.mkDerivation rec {
  buildInputs = [
    glib
    gtk3
-    webkitgtk
+    webkitgtk_4_1
    libxml2
    libxslt
    sqlite
-    libsoup
+    libsoup_3
    libpeas
    gsettings-desktop-schemas
    json-glib
@@ -1,5 +1,5 @@
 { lib, stdenv, requireFile, makeWrapper, autoPatchelfHook, wrapGAppsHook3, which, more
-, file, atk, alsa-lib, cairo, fontconfig, gdk-pixbuf, glib, webkitgtk, gtk2-x11, gtk3
+, file, atk, alsa-lib, cairo, fontconfig, gdk-pixbuf, glib, webkitgtk_4_0, gtk2-x11, gtk3
 , heimdal, krb5, libsoup, libvorbis, speex, openssl, zlib, xorg, pango, gtk2
 , gnome2, mesa, nss, nspr, gtk_engines, freetype, dconf, libpng12, libxml2
 , libjpeg, libredirect, tzdata, cacert, systemd, libcxx, symlinkJoin
@@ -86,7 +86,7 @@ stdenv.mkDerivation rec {
    gdk-pixbuf
    gnome2.gtkglext
    glib-networking
-    webkitgtk
+    webkitgtk_4_0
    gtk2
    gtk2-x11
    gtk3
@@ -16,7 +16,7 @@
 , json-glib
 , libappindicator
 , libsoup
-, webkitgtk
+, webkitgtk_4_0
 }:

 stdenv.mkDerivation rec {
@@ -48,7 +48,7 @@ stdenv.mkDerivation rec {
    json-glib
    libappindicator
    libsoup
-    webkitgtk
+    webkitgtk_4_0
  ];

  postPatch = ''
@@ -23,7 +23,7 @@
 , unar
 , unzip
 , vala
-, webkitgtk
+, webkitgtk_4_0
 , wrapGAppsHook3
 }:

@@ -59,7 +59,7 @@ stdenv.mkDerivation rec {
    poppler
    python3
    sqlite
-    webkitgtk
+    webkitgtk_4_0
  ];

  postPatch = ''
@@ -17,7 +17,7 @@
 , libgee
 , pantheon
 , sqlite
-, webkitgtk
+, webkitgtk_4_0
 }:

 stdenv.mkDerivation rec {
@@ -50,7 +50,7 @@ stdenv.mkDerivation rec {
    libgee
    pantheon.granite
    sqlite
-    webkitgtk
+    webkitgtk_4_0
  ];

  postPatch = ''
@@ -1,5 +1,5 @@
 { lib, stdenv, fetchurl, pkg-config, gtk3, libxml2, gettext, libical, libnotify
-, libarchive, gspell, webkitgtk, libgringotts, wrapGAppsHook3 }:
+, libarchive, gspell, webkitgtk_4_0, libgringotts, wrapGAppsHook3 }:

 stdenv.mkDerivation rec {
  pname = "osmo";
@@ -12,7 +12,7 @@ stdenv.mkDerivation rec {

  nativeBuildInputs = [ pkg-config gettext wrapGAppsHook3 ];
  buildInputs = [ gtk3 libxml2 libical libnotify libarchive
-    gspell webkitgtk libgringotts ];
+    gspell webkitgtk_4_0 libgringotts ];

  meta = with lib; {
    description = "Handy personal organizer";
@@ -1,20 +1,40 @@
-{ mkDerivation, lib, fetchFromGitHub, cmake, pkg-config
-, qtbase, qtcharts, qtmultimedia, qtquickcontrols, qtquickcontrols2, qtgraphicaleffects
-, faad2, rtl-sdr, soapysdr-with-plugins, libusb-compat-0_1, fftwSinglePrec, lame, mpg123
-} :
+{
+  stdenv,
+  lib,
+  fetchFromGitHub,
+  cmake,
+  pkg-config,
+  wrapQtAppsHook,
+  qtbase,
+  qtcharts,
+  qtmultimedia,
+  qtdeclarative,
+  qt5compat,
+  faad2,
+  rtl-sdr,
+  soapysdr-with-plugins,
+  libusb-compat-0_1,
+  fftwSinglePrec,
+  lame,
+  mpg123,
+}:

-mkDerivation rec {
+stdenv.mkDerivation rec {
  pname = "welle-io";
-  version = "2.4";
+  version = "2.5";

  src = fetchFromGitHub {
    owner = "AlbrechtL";
    repo = "welle.io";
    rev = "v${version}";
-    sha256 = "sha256-xXiCL/A2SwCSr5SA4AQQEdieRzBksXx9Z78bHtlFiW4=";
+    hash = "sha256-sSknzZiD9/MLyO+gAYopogOQu5HRcqaRcfqwq4Rld7A=";
  };

-  nativeBuildInputs = [ cmake pkg-config ];
+  nativeBuildInputs = [
+    cmake
+    pkg-config
+    wrapQtAppsHook
+  ];

  buildInputs = [
    faad2
@@ -25,22 +45,27 @@ mkDerivation rec {
    qtbase
    qtcharts
    qtmultimedia
-    qtquickcontrols
-    qtquickcontrols2
-    qtgraphicaleffects
+    qt5compat
    rtl-sdr
    soapysdr-with-plugins
  ];

  cmakeFlags = [
-    "-DRTLSDR=true" "-DSOAPYSDR=true"
+    "-DRTLSDR=true"
+    "-DSOAPYSDR=true"
  ];

-  meta = with lib; {
+  meta = {
    description = "DAB/DAB+ Software Radio";
    homepage = "https://www.welle.io/";
-    maintainers = with maintainers; [ ck3d markuskowa ];
-    license = licenses.gpl2Only;
-    platforms = [ "x86_64-linux" "i686-linux" ] ++ platforms.darwin;
+    maintainers = with lib.maintainers; [
+      ck3d
+      markuskowa
+    ];
+    license = lib.licenses.gpl2Only;
+    platforms = [
+      "x86_64-linux"
+      "i686-linux"
+    ] ++ lib.platforms.darwin;
  };
 }
@@ -11,7 +11,7 @@
 , gtksourceview
 , libgee
 , nix-update-script
-, webkitgtk
+, webkitgtk_4_0
 , libqalculate
 , intltool
 , gnuplot
@@ -48,7 +48,7 @@ stdenv.mkDerivation rec {
    gtksourceview
    libgee
    pantheon.granite
-    webkitgtk
+    webkitgtk_4_0
    # We add libqalculate's runtime dependencies because nasc has it as a modified subproject.
  ] ++ libqalculate.buildInputs ++ libqalculate.propagatedBuildInputs;

@@ -1,54 +0,0 @@
-{ lib, buildGoModule, fetchFromGitHub, makeWrapper
-, git, bash, gzip, openssh, pam
-, sqliteSupport ? true
-, pamSupport ? true
-}:
-
-buildGoModule rec {
-  pname = "gogs";
-  version = "0.13.0";
-
-  src = fetchFromGitHub {
-    owner = "gogs";
-    repo = "gogs";
-    rev = "v${version}";
-    sha256 = "sha256-UfxE+NaqDr3XUXpvlV989Iwjq/lsAwpMTDAPkcOmma8=";
-  };
-
-  vendorHash = "sha256-ISJOEJ1DWO4nnMpDuZ36Nq528LhgekDh3XUF8adlj2w=";
-
-  subPackages = [ "." ];
-
-  postPatch = ''
-    patchShebangs .
-  '';
-
-  nativeBuildInputs = [ makeWrapper openssh ];
-
-  buildInputs = lib.optional pamSupport pam;
-
-  tags =
-    (  lib.optional sqliteSupport "sqlite"
-    ++ lib.optional pamSupport "pam");
-
-  postInstall = ''
-
-    wrapProgram $out/bin/gogs \
-      --prefix PATH : ${lib.makeBinPath [ bash git gzip openssh ]}
-  '';
-
-  meta = with lib; {
-    description = "Painless self-hosted Git service";
-    homepage = "https://gogs.io";
-    license = licenses.mit;
-    maintainers = [ maintainers.schneefux ];
-    mainProgram = "gogs";
-    knownVulnerabilities = [ ''
-      Gogs has known unpatched vulnerabilities and upstream maintainers appears to be unresponsive.
-
-      More information can be found in forgejo's blogpost: https://forgejo.org/2023-11-release-v1-20-5-1/
-
-      You might want to consider migrating to Gitea or forgejo.
-    '' ];
-  };
-}
@@ -2,7 +2,7 @@
 , stdenv
 , fetchFromGitHub
 , obs-studio
-, webkitgtk
+, webkitgtk_4_0
 , glib-networking
 , meson
 , cmake
@@ -24,7 +24,7 @@ stdenv.mkDerivation rec {

  buildInputs = [
    obs-studio
-    webkitgtk
+    webkitgtk_4_0
    glib-networking
  ];

@@ -60,7 +60,25 @@ let
  generators = callPackage ./generators.nix { inherit dart; } { buildDrvArgs = args; };

  pubspecLockFile = builtins.toJSON pubspecLock;
-  pubspecLockData = pub2nix.readPubspecLock { inherit src packageRoot pubspecLock gitHashes sdkSourceBuilders customSourceBuilders; };
+  pubspecLockData = pub2nix.readPubspecLock {
+    inherit src packageRoot pubspecLock gitHashes customSourceBuilders;
+    sdkSourceBuilders  = {
+      # https://github.com/dart-lang/pub/blob/e1fbda73d1ac597474b82882ee0bf6ecea5df108/lib/src/sdk/dart.dart#L80
+      "dart" = name: runCommand "dart-sdk-${name}" { passthru.packageRoot = "."; } ''
+        for path in '${dart}/pkg/${name}'; do
+          if [ -d "$path" ]; then
+            ln -s "$path" "$out"
+            break
+          fi
+        done
+
+        if [ ! -e "$out" ]; then
+          echo 1>&2 'The Dart SDK does not contain the requested package: ${name}!'
+          exit 1
+        fi
+      '';
+    } // sdkSourceBuilders;
+  };
  packageConfig = generators.linkPackageConfig {
    packageConfig = pub2nix.generatePackageConfig {
      pname = if args.pname != null then "${args.pname}-${args.version}" else null;
@@ -0,0 +1,58 @@
+{
+  fetchzip,
+  gitUpdater,
+  installShellFiles,
+  lib,
+  stdenv,
+  versionCheckHook,
+}:
+
+let
+  appName = "AeroSpace.app";
+  version = "0.14.2-Beta";
+in
+stdenv.mkDerivation {
+  pname = "aerospace";
+
+  inherit version;
+
+  src = fetchzip {
+    url = "https://github.com/nikitabobko/AeroSpace/releases/download/v${version}/AeroSpace-v${version}.zip";
+    hash = "sha256-v2D/IV9Va0zbGHEwSGt6jvDqQYqha290Lm6u+nZTS3A=";
+  };
+
+  nativeBuildInputs = [ installShellFiles ];
+
+  installPhase = ''
+    runHook preInstall
+    mkdir -p $out/Applications
+    mv ${appName} $out/Applications
+    cp -R bin $out
+    mkdir -p $out/share
+    runHook postInstall
+  '';
+
+  postInstall = ''
+    installManPage manpage/*
+    installShellCompletion --bash shell-completion/bash/aerospace
+    installShellCompletion --fish shell-completion/fish/aerospace.fish
+    installShellCompletion --zsh  shell-completion/zsh/_aerospace
+  '';
+
+  passthru.tests.can-print-version = [ versionCheckHook ];
+
+  passthru.updateScript = gitUpdater {
+    url = "https://github.com/nikitabobko/AeroSpace.git";
+    rev-prefix = "v";
+  };
+
+  meta = {
+    license = lib.licenses.mit;
+    mainProgram = "aerospace";
+    homepage = "https://github.com/nikitabobko/AeroSpace";
+    description = "i3-like tiling window manager for macOS";
+    platforms = lib.platforms.darwin;
+    maintainers = with lib.maintainers; [ alexandru0-dev ];
+    sourceProvenance = [ lib.sourceTypes.binaryNativeCode ];
+  };
+}
@@ -12,7 +12,7 @@ let
    self = python3;
    packageOverrides = _: super: { tree-sitter = super.tree-sitter_0_21; };
  };
-  version = "0.57.0";
+  version = "0.59.0";
 in
 python3.pkgs.buildPythonApplication {
  pname = "aider-chat";
@@ -23,7 +23,7 @@ python3.pkgs.buildPythonApplication {
    owner = "paul-gauthier";
    repo = "aider";
    rev = "refs/tags/v${version}";
-    hash = "sha256-ErDepSju8B4GochHKxL03aUfOLAiNfTaXBAllAZ144M=";
+    hash = "sha256-20LicYj1j5gGzhF+SxPUKu858nHZgwDF1JxXeHRtYe0=";
  };

  pythonRelaxDeps = true;
@@ -68,6 +68,7 @@ python3.pkgs.buildPythonApplication {
      streamlit
      tokenizers
      watchdog
+      pydub
    ]
    ++ lib.optionals (!tensorflow.meta.broken) [
      llama-index-core
@@ -13,18 +13,19 @@
  gtksourceview5,
  xdg-utils,
  ollama,
+  vte-gtk4,
 }:

 python3Packages.buildPythonApplication rec {
  pname = "alpaca";
-  version = "2.0.6";
+  version = "2.6.0";
  pyproject = false; # Built with meson

  src = fetchFromGitHub {
    owner = "Jeffser";
    repo = "Alpaca";
    rev = "refs/tags/${version}";
-    hash = "sha256-4c6pisd3o7mycivHd1QZ2N7s8pYzrQXiZMbVvl5ciPA=";
+    hash = "sha256-XXxfbchQ1l6L8KflqjlGIiyRbG/dI5ok0ExlROavXYg=";
  };

  nativeBuildInputs = [
@@ -40,6 +41,7 @@ python3Packages.buildPythonApplication rec {
  buildInputs = [
    libadwaita
    gtksourceview5
+    vte-gtk4
  ];

  dependencies = with python3Packages; [
@@ -4,7 +4,7 @@
 , glibc
 , gtk3
 , libappindicator
-, webkitgtk
+, webkitgtk_4_0
 , e2fsprogs
 , libnotify
 , libgit2
@@ -63,7 +63,7 @@ buildDotnetModule {
    glibc
    gtk3
    libappindicator
-    webkitgtk
+    webkitgtk_4_0
    e2fsprogs
    libnotify
    libgit2
@@ -20,7 +20,7 @@
  poppler,
  stdenv,
  testers,
-  webkitgtk,
+  webkitgtk_4_0,
  wrapGAppsHook3,
 }:

@@ -61,7 +61,7 @@ stdenv.mkDerivation (finalAttrs: {
    libxshmfence # otherwise warnings in compilation
    pcre
    poppler
-    webkitgtk
+    webkitgtk_4_0
  ];

  installPhase = ''
@@ -11,7 +11,7 @@

 rustPlatform.buildRustPackage rec {
  pname = "arti";
-  version = "1.2.7";
+  version = "1.2.8";

  src = fetchFromGitLab {
    domain = "gitlab.torproject.org";
@@ -19,10 +19,10 @@ rustPlatform.buildRustPackage rec {
    owner = "core";
    repo = "arti";
    rev = "arti-v${version}";
-    hash = "sha256-lyko4xwTn03/Es8icOx8GIrjC4XDXvZPDYHYILw8Opo=";
+    hash = "sha256-vw/hebZ23Pk+hQx3YN9iXsKWq20fqpwp91E2tul8zmA=";
  };

-  cargoHash = "sha256-I45SaawWAK7iTZDFhJT4YVO439D/3NmWLp3FtFmhLC0=";
+  cargoHash = "sha256-4F+0KEVoeppNQ26QQ+a2CSIbrklE8NY3+OK11I5JstA=";

  nativeBuildInputs = lib.optionals stdenv.hostPlatform.isLinux [ pkg-config ];

@@ -47,8 +47,7 @@ rustPlatform.buildRustPackage rec {
  ];

  checkFlags = [
-    # problematic tests that were fixed after the release
-    "--skip=reload_cfg::test::watch_single_file"
+    # problematic test that hangs the build
    "--skip=reload_cfg::test::watch_multiple"
  ];

@@ -1,9 +1,9 @@
 {
  "owner": "advplyr",
  "repo": "audiobookshelf",
-  "rev": "ce213c3d89458baeb77324ce59a5f2137740564e",
-  "hash": "sha256-7vPhvsjGJQvus5Mmx8543OuBeuPWC/4cLfHHYmN2lnk=",
-  "version": "2.13.4",
-  "depsHash": "sha256-1CmtuzE8R6zkb0DT7gt9MrxErAw0mqY2AkJZh3PjuBQ=",
-  "clientDepsHash": "sha256-BfrVN70i1e4JWELxLS0jliHLfG4/kN8tj8aQOjsnZ/M="
+  "rev": "cf5598aeb9b086a28e853d6a89b82a7467fd6969",
+  "hash": "sha256-tObC7QbdwpAlt97eXB9QzZEaQcquuST+8nC6lYEXTUM=",
+  "version": "2.14.0",
+  "depsHash": "sha256-nVsmV3Vms2S9oM7duFfgt+go1+wM2JniI8B3UFmv/TE=",
+  "clientDepsHash": "sha256-oaoGxcMs8XQVaRx8UO9NSThqbHuZsA4fm8OGlSiaKO0="
 }
@@ -11,7 +11,7 @@
 , gtk3
 , openssl_1_1
 , icu70
-, webkitgtk
+, webkitgtk_4_0
 , librsvg
 , gdk-pixbuf
 , libsoup
@@ -54,7 +54,7 @@ stdenv.mkDerivation (finalAttrs: {
    gtk3
    openssl_1_1.out
    icu70
-    webkitgtk
+    webkitgtk_4_0
    librsvg
    gdk-pixbuf
    libsoup
@@ -119,6 +119,17 @@ let
        overrideAzureMgmtPackage super.azure-mgmt-batchai "7.0.0b1" "zip"
          "sha256-mT6vvjWbq0RWQidugR229E8JeVEiobPD3XA/nDM3I6Y=";

+      azure-mgmt-billing =
+        (overrideAzureMgmtPackage super.azure-mgmt-billing "6.0.0" "zip"
+          "sha256-1PXFpBiKRW/h6zK2xF9VyiBpx0vkHrdpIYQLOfL1wH8="
+        ).overridePythonAttrs
+          (attrs: {
+            propagatedBuildInputs = attrs.propagatedBuildInputs or [ ] ++ [
+              self.msrest
+              self.msrestazure
+            ];
+          });
+
      # AttributeError: type object 'CustomDomainsOperations' has no attribute 'disable_custom_https'
      azure-mgmt-cdn =
        overrideAzureMgmtPackage super.azure-mgmt-cdn "12.0.0" "zip"
@@ -9,16 +9,16 @@

 rustPlatform.buildRustPackage rec {
  pname = "boxbuddy";
-  version = "2.2.12";
+  version = "2.2.13";

  src = fetchFromGitHub {
    owner = "Dvlv";
    repo = "BoxBuddyRS";
    rev = version;
-    hash = "sha256-PoPIIwe2SlK/iQTyqIhMG0dRobU98L5hnOciMmi9coo=";
+    hash = "sha256-47LOwBm7ql3Nvx6PZ2+x5aR9LSpzc8xuixdvKGdNS94=";
  };

-  cargoHash = "sha256-En5TVCW/URJEry4sTd+vdi8K1YO2L0X5pYu/TGsrx6U=";
+  cargoHash = "sha256-W4W2tnnNgBcGD0/t5pobj4ca/YrRkHE1l5dIVe21KPU=";

  # The software assumes it is installed either in flatpak or in the home directory
  # so the xdg data path needs to be patched here
@@ -9,7 +9,7 @@
  libsoup,
  openssl,
  pkg-config,
-  webkitgtk,
+  webkitgtk_4_0,
 }:

 rustPlatform.buildRustPackage rec {
@@ -36,7 +36,7 @@ rustPlatform.buildRustPackage rec {
    ++ lib.optionals stdenv.hostPlatform.isLinux [
      gtk3
      libsoup
-      webkitgtk
+      webkitgtk_4_0
    ]
    ++ lib.optionals stdenv.hostPlatform.isDarwin (
      with darwin.apple_sdk.frameworks;
@@ -8,7 +8,7 @@
  libsoup,
  openssl,
  pkg-config,
-  webkitgtk,
+  webkitgtk_4_0,
  wrapGAppsHook3,
 }:

@@ -38,7 +38,7 @@ rustPlatform.buildRustPackage rec {
    ++ lib.optionals stdenv.isLinux [
      glib-networking
      libsoup
-      webkitgtk
+      webkitgtk_4_0
    ]
    ++ lib.optionals stdenv.isDarwin (
      with darwin.apple_sdk.frameworks;
--- a/Show More
+++ b/Show More