Merge fd5197d905 into haskell-updates

ci/OWNERS

@@ -395,12 +395,6 @@ pkgs/by-name/fo/forgejo/                @adamcstephens @bendlas @emilylange
 /pkgs/development/compilers/ocaml   @ulrikstrid
 /pkgs/development/ocaml-modules     @ulrikstrid
 
-# ZFS
-pkgs/os-specific/linux/zfs/2_1.nix        @raitobezarius
-pkgs/os-specific/linux/zfs/generic.nix    @raitobezarius
-nixos/modules/tasks/filesystems/zfs.nix   @raitobezarius
-nixos/tests/zfs.nix                       @raitobezarius
-
 # Zig
 /pkgs/development/compilers/zig @figsoda
 /doc/hooks/zig.section.md       @figsoda

doc/build-helpers/special/fhs-environments.section.md

@@ -6,11 +6,13 @@ It uses Linux' namespaces feature to create temporary lightweight environments w
 Accepted arguments are:
 
 - `name`
-        The name of the environment, and the wrapper executable if `pname` is unset.
+        The name of the environment.
 - `pname`
-        The pname of the environment and the wrapper executable.
+        The pname of the environment.
 - `version`
         The version of the environment.
+- `executableName`
+        The name of the wrapper executable. Defaults to `pname` if set, or `name` otherwise.
 - `targetPkgs`
         Packages to be installed for the main host's architecture (i.e. x86_64 on x86_64 installations). Along with libraries binaries are also installed.
 - `multiPkgs`

maintainers/maintainer-list.nix

@@ -19453,6 +19453,12 @@
     githubId = 807447;
     name = "Robert Scott";
   };
+  Rishik-Y = {
+    name = "Rishik Yalamanchili";
+    email = "202301258@daiict.ac.in";
+    github = "Rishik-Y";
+    githubId = 73787402;
+  };
   risson = {
     name = "Marc Schmitt";
     email = "marc.schmitt@risson.space";
@@ -23824,6 +23830,12 @@
     githubId = 2212422;
     name = "uwap";
   };
+  uxodb = {
+    name = "uxodb";
+    matrix = "@uxodb:matrix.org";
+    github = "uxodb";
+    githubId = 20535246;
+  };
   V = {
     name = "V";
     email = "v@anomalous.eu";

nixos/README.md

@@ -84,6 +84,9 @@ Reviewing process:
 - Ensure that the introduced options are correct.
   - Type should be appropriate (string related types differs in their merging capabilities, `loaOf` and `string` types are deprecated).
   - Description, default and example should be provided.
+    - Defaults may only be omitted if both:
+      1. The user is required to set the default in order to properly use the service.
+      2. The lack of a default does not break evaluation when the module is not enabled.
 - Ensure that module `meta` field is present
   - Maintainers should be declared in `meta.maintainers`.
   - Module documentation should be declared with `meta.doc`.

nixos/lib/make-options-doc/default.nix

@@ -1,3 +1,5 @@
+# Tests: ./tests.nix
+
 /**
   Generates documentation for [nix modules](https://nix.dev/tutorials/module-system/index.html).
 
@@ -193,12 +195,16 @@ rec {
   optionsCommonMark =
     pkgs.runCommand "options.md"
       {
+        __structuredAttrs = true;
         nativeBuildInputs = [ pkgs.nixos-render-docs ];
+        # For overriding
+        extraArgs = [ ];
       }
       ''
         nixos-render-docs -j $NIX_BUILD_CORES options commonmark \
           --manpage-urls ${pkgs.path + "/doc/manpage-urls.json"} \
           --revision ${lib.escapeShellArg revision} \
+          ''${extraArgs[@]} \
           ${optionsJSON}/share/doc/nixos/options.json \
           $out
       '';

nixos/lib/make-options-doc/tests.nix

@@ -0,0 +1,59 @@
+# Run tests: nix-build -A tests.nixosOptionsDoc
+
+{
+  lib,
+  nixosOptionsDoc,
+  runCommand,
+}:
+let
+  inherit (lib) mkOption types;
+
+  eval = lib.evalModules {
+    modules = [
+      {
+        options.foo.bar.enable = mkOption {
+          type = types.bool;
+          default = false;
+          description = ''
+            Enable the foo bar feature.
+          '';
+        };
+      }
+    ];
+  };
+
+  doc = nixosOptionsDoc {
+    inherit (eval) options;
+  };
+in
+{
+  /**
+    Test that
+      - the `nixosOptionsDoc` function can be invoked
+      - integration of the module system and `nixosOptionsDoc` (limited coverage)
+
+    The more interesting tests happen in the `nixos-render-docs` package.
+  */
+  commonMark =
+    runCommand "test-nixosOptionsDoc-commonMark"
+      {
+        commonMarkDefault = doc.optionsCommonMark;
+        commonMarkAnchors = doc.optionsCommonMark.overrideAttrs {
+          extraArgs = [
+            "--anchor-prefix"
+            "my-opt-"
+            "--anchor-style"
+            "legacy"
+          ];
+        };
+      }
+      ''
+        env | grep ^commonMark | sed -e 's/=/ = /'
+        (
+          set -x
+          grep -F 'foo\.bar\.enable' $commonMarkDefault >/dev/null
+          grep -F '{#my-opt-foo.bar.enable}' $commonMarkAnchors >/dev/null
+        )
+        touch $out
+      '';
+}

nixos/modules/programs/ssh.nix

@@ -13,7 +13,7 @@ let
 
   askPasswordWrapper = pkgs.writeScript "ssh-askpass-wrapper" ''
     #! ${pkgs.runtimeShell} -e
-    eval export $(systemctl --user show-environment | ${pkgs.coreutils}/bin/grep -E '^(DISPLAY|WAYLAND_DISPLAY|XAUTHORITY)=')
+    eval export $(systemctl --user show-environment | ${lib.getExe pkgs.gnugrep} -E '^(DISPLAY|WAYLAND_DISPLAY|XAUTHORITY)=')
     exec ${cfg.askPassword} "$@"
   '';
 

nixos/tests/zfs.nix

@@ -191,14 +191,13 @@ let
 
 in {
 
-  # maintainer: @raitobezarius
-  series_2_1 = makeZfsTest {
-    zfsPackage = pkgs.zfs_2_1;
+  series_2_2 = makeZfsTest {
+    zfsPackage = pkgs.zfs_2_2;
     kernelPackages = pkgs.linuxPackages;
   };
 
-  series_2_2 = makeZfsTest {
-    zfsPackage = pkgs.zfs_2_2;
+  series_2_3 = makeZfsTest {
+    zfsPackage = pkgs.zfs_2_3;
     kernelPackages = pkgs.linuxPackages;
   };
 

pkgs/applications/audio/ladspa-plugins/default.nix

@@ -22,21 +22,29 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-eOtIhNcuItREUShI8JRlBVKfMfovpdfIYu+m37v4KLE=";
   };
 
+  preBuild = ''
+    shopt -s globstar
+    for f in **/Makefile; do
+      substituteInPlace "$f" \
+        --replace-quiet 'ranlib' '${stdenv.cc.targetPrefix}ranlib'
+    done
+    shopt -u globstar
+  '';
+
   nativeBuildInputs = [
     autoreconfHook
+    perlPackages.perl
+    perlPackages.XMLParser
     pkg-config
   ];
   buildInputs = [
     fftw
     ladspaH
     libxml2
-    perlPackages.perl
-    perlPackages.XMLParser
   ];
 
-  patchPhase = ''
-    patchShebangs .
-    patchShebangs ./metadata/
+  postPatch = ''
+    patchShebangs --build . ./metadata/ makestub.pl
     cp ${automake}/share/automake-*/mkinstalldirs .
   '';
 

pkgs/applications/editors/rstudio/boost-1.86.patch

@@ -0,0 +1,13 @@
+diff --git a/src/cpp/core/json/JsonRpc.cpp b/src/cpp/core/json/JsonRpc.cpp
+index d034ffecd7..4b08486517 100644
+--- a/src/cpp/core/json/JsonRpc.cpp
++++ b/src/cpp/core/json/JsonRpc.cpp
+@@ -193,7 +193,7 @@
+    
+ bool JsonRpcResponse::hasAfterResponse() const
+ {
+-   return afterResponse_;
++   return !afterResponse_.empty();
+ }
+    
+    

pkgs/applications/editors/rstudio/default.nix

@@ -5,7 +5,7 @@
   fetchFromGitHub,
   replaceVars,
   cmake,
-  boost183,
+  boost,
   zlib,
   openssl,
   R,
@@ -85,7 +85,7 @@ stdenv.mkDerivation rec {
 
   buildInputs =
     [
-      boost183
+      boost
       zlib
       openssl
       R
@@ -131,6 +131,7 @@ stdenv.mkDerivation rec {
     ./ignore-etc-os-release.patch
     ./dont-yarn-install.patch
     ./dont-assume-pandoc-in-quarto.patch
+    ./boost-1.86.patch
   ];
 
   postPatch = ''

pkgs/applications/misc/rofi/wayland.nix

@@ -1,7 +1,6 @@
 {
   lib,
   fetchFromGitHub,
-  fetchpatch,
   rofi-unwrapped,
   wayland-scanner,
   pkg-config,
@@ -11,26 +10,16 @@
 
 rofi-unwrapped.overrideAttrs (oldAttrs: rec {
   pname = "rofi-wayland-unwrapped";
-  version = "1.7.5+wayland3";
+  version = "1.7.7+wayland1";
 
   src = fetchFromGitHub {
     owner = "lbonn";
     repo = "rofi";
     rev = version;
     fetchSubmodules = true;
-    hash = "sha256-pKxraG3fhBh53m+bLPzCigRr6dBcH/A9vbdf67CO2d8=";
+    hash = "sha256-wGBB7h2gZRQNmHV0NIbD0vvHtKZqnT5hd2gz5smKGoU=";
   };
 
-  patches = [
-    # Fix use on niri window manager
-    # ref. https://github.com/davatorium/rofi/discussions/2008
-    # this was merged upstream, and can be removed on next release
-    (fetchpatch {
-      url = "https://github.com/lbonn/rofi/commit/55425f72ff913eb72f5ba5f5d422b905d87577d0.patch";
-      hash = "sha256-vTUxtJs4SuyPk0PgnGlDIe/GVm/w1qZirEhKdBp4bHI=";
-    })
-  ];
-
   depsBuildBuild = oldAttrs.depsBuildBuild ++ [ pkg-config ];
   nativeBuildInputs = oldAttrs.nativeBuildInputs ++ [
     wayland-protocols

pkgs/applications/networking/browsers/firefox/packages/firefox-devedition.nix

@@ -9,13 +9,13 @@
 
 buildMozillaMach rec {
   pname = "firefox-devedition";
-  version = "133.0b1";
+  version = "135.0b4";
   applicationName = "Mozilla Firefox Developer Edition";
   requireSigning = false;
   branding = "browser/branding/aurora";
   src = fetchurl {
     url = "mirror://mozilla/devedition/releases/${version}/source/firefox-${version}.source.tar.xz";
-    sha512 = "dced4aba71b07b68ee31c283945e7d62a7032f08f5cf71aa261fc7ba32f58277acbe9fdbdd28777d7f4b824e411815b069cab0ce791438088c9ad19c3d2de62e";
+    sha512 = "d3ee20d264c4c26308b814f4cc997349a6df32da17b9a29514b0504f7548606f4b6793ccd2e7464babf6588f13bfcc0e0641f9ac8d620f7da7d7e45684fdf775";
   };
 
   meta = {

pkgs/applications/networking/sync/rsync/CVE-2024-12084/0001-Some-checksum-buffer-fixes.patch

@@ -0,0 +1,151 @@
+From 0902b52f6687b1f7952422080d50b93108742e53 Mon Sep 17 00:00:00 2001
+From: Wayne Davison <wayne@opencoder.net>
+Date: Tue, 29 Oct 2024 22:55:29 -0700
+Subject: [PATCH 1/2] Some checksum buffer fixes.
+
+- Put sum2_array into sum_struct to hold an array of sum2 checksums
+  that are each xfer_sum_len bytes.
+- Remove sum2 buf from sum_buf.
+- Add macro sum2_at() to access each sum2 array element.
+- Throw an error if a sums header has an s2length larger than
+  xfer_sum_len.
+---
+ io.c     | 3 ++-
+ match.c  | 8 ++++----
+ rsync.c  | 5 ++++-
+ rsync.h  | 4 +++-
+ sender.c | 4 +++-
+ 5 files changed, 16 insertions(+), 8 deletions(-)
+
+diff --git a/io.c b/io.c
+index a99ac0ec..bb60eeca 100644
+--- a/io.c
++++ b/io.c
+@@ -55,6 +55,7 @@ extern int read_batch;
+ extern int compat_flags;
+ extern int protect_args;
+ extern int checksum_seed;
++extern int xfer_sum_len;
+ extern int daemon_connection;
+ extern int protocol_version;
+ extern int remove_source_files;
+@@ -1977,7 +1978,7 @@ void read_sum_head(int f, struct sum_struct *sum)
+ 		exit_cleanup(RERR_PROTOCOL);
+ 	}
+ 	sum->s2length = protocol_version < 27 ? csum_length : (int)read_int(f);
+-	if (sum->s2length < 0 || sum->s2length > MAX_DIGEST_LEN) {
++	if (sum->s2length < 0 || sum->s2length > xfer_sum_len) {
+ 		rprintf(FERROR, "Invalid checksum length %d [%s]\n",
+ 			sum->s2length, who_am_i());
+ 		exit_cleanup(RERR_PROTOCOL);
+diff --git a/match.c b/match.c
+index cdb30a15..36e78ed2 100644
+--- a/match.c
++++ b/match.c
+@@ -232,7 +232,7 @@ static void hash_search(int f,struct sum_struct *s,
+ 				done_csum2 = 1;
+ 			}
+ 
+-			if (memcmp(sum2,s->sums[i].sum2,s->s2length) != 0) {
++			if (memcmp(sum2, sum2_at(s, i), s->s2length) != 0) {
+ 				false_alarms++;
+ 				continue;
+ 			}
+@@ -252,7 +252,7 @@ static void hash_search(int f,struct sum_struct *s,
+ 					if (i != aligned_i) {
+ 						if (sum != s->sums[aligned_i].sum1
+ 						 || l != s->sums[aligned_i].len
+-						 || memcmp(sum2, s->sums[aligned_i].sum2, s->s2length) != 0)
++						 || memcmp(sum2, sum2_at(s, aligned_i), s->s2length) != 0)
+ 							goto check_want_i;
+ 						i = aligned_i;
+ 					}
+@@ -271,7 +271,7 @@ static void hash_search(int f,struct sum_struct *s,
+ 						if (sum != s->sums[i].sum1)
+ 							goto check_want_i;
+ 						get_checksum2((char *)map, l, sum2);
+-						if (memcmp(sum2, s->sums[i].sum2, s->s2length) != 0)
++						if (memcmp(sum2, sum2_at(s, i), s->s2length) != 0)
+ 							goto check_want_i;
+ 						/* OK, we have a re-alignment match.  Bump the offset
+ 						 * forward to the new match point. */
+@@ -290,7 +290,7 @@ static void hash_search(int f,struct sum_struct *s,
+ 			 && (!updating_basis_file || s->sums[want_i].offset >= offset
+ 			  || s->sums[want_i].flags & SUMFLG_SAME_OFFSET)
+ 			 && sum == s->sums[want_i].sum1
+-			 && memcmp(sum2, s->sums[want_i].sum2, s->s2length) == 0) {
++			 && memcmp(sum2, sum2_at(s, want_i), s->s2length) == 0) {
+ 				/* we've found an adjacent match - the RLL coder
+ 				 * will be happy */
+ 				i = want_i;
+diff --git a/rsync.c b/rsync.c
+index cd288f57..b130aba5 100644
+--- a/rsync.c
++++ b/rsync.c
+@@ -437,7 +437,10 @@ int read_ndx_and_attrs(int f_in, int f_out, int *iflag_ptr, uchar *type_ptr, cha
+   */
+ void free_sums(struct sum_struct *s)
+ {
+-	if (s->sums) free(s->sums);
++	if (s->sums) {
++		free(s->sums);
++		free(s->sum2_array);
++	}
+ 	free(s);
+ }
+ 
+diff --git a/rsync.h b/rsync.h
+index d3709fe0..8ddbe702 100644
+--- a/rsync.h
++++ b/rsync.h
+@@ -958,12 +958,12 @@ struct sum_buf {
+ 	uint32 sum1;	        /**< simple checksum */
+ 	int32 chain;		/**< next hash-table collision */
+ 	short flags;		/**< flag bits */
+-	char sum2[SUM_LENGTH];	/**< checksum  */
+ };
+ 
+ struct sum_struct {
+ 	OFF_T flength;		/**< total file length */
+ 	struct sum_buf *sums;	/**< points to info for each chunk */
++	char *sum2_array;	/**< checksums of length xfer_sum_len */
+ 	int32 count;		/**< how many chunks */
+ 	int32 blength;		/**< block_length */
+ 	int32 remainder;	/**< flength % block_length */
+@@ -982,6 +982,8 @@ struct map_struct {
+ 	int status;		/* first errno from read errors		*/
+ };
+ 
++#define sum2_at(s, i)	((s)->sum2_array + ((OFF_T)(i) * xfer_sum_len))
++
+ #define NAME_IS_FILE		(0)    /* filter name as a file */
+ #define NAME_IS_DIR		(1<<0) /* filter name as a dir */
+ #define NAME_IS_XATTR		(1<<2) /* filter name as an xattr */
+diff --git a/sender.c b/sender.c
+index 3d4f052e..ab205341 100644
+--- a/sender.c
++++ b/sender.c
+@@ -31,6 +31,7 @@ extern int log_before_transfer;
+ extern int stdout_format_has_i;
+ extern int logfile_format_has_i;
+ extern int want_xattr_optim;
++extern int xfer_sum_len;
+ extern int csum_length;
+ extern int append_mode;
+ extern int copy_links;
+@@ -94,10 +95,11 @@ static struct sum_struct *receive_sums(int f)
+ 		return(s);
+ 
+ 	s->sums = new_array(struct sum_buf, s->count);
++	s->sum2_array = new_array(char, s->count * xfer_sum_len);
+ 
+ 	for (i = 0; i < s->count; i++) {
+ 		s->sums[i].sum1 = read_int(f);
+-		read_buf(f, s->sums[i].sum2, s->s2length);
++		read_buf(f, sum2_at(s, i), s->s2length);
+ 
+ 		s->sums[i].offset = offset;
+ 		s->sums[i].flags = 0;
+-- 
+2.34.1
+

pkgs/applications/networking/sync/rsync/CVE-2024-12084/0002-Another-cast-when-multiplying-integers.patch

@@ -0,0 +1,39 @@
+From 42e2b56c4ede3ab164f9a5c6dae02aa84606a6c1 Mon Sep 17 00:00:00 2001
+From: Wayne Davison <wayne@opencoder.net>
+Date: Tue, 5 Nov 2024 11:01:03 -0800
+Subject: [PATCH 2/2] Another cast when multiplying integers.
+
+---
+ rsync.h  | 2 +-
+ sender.c | 2 +-
+ 2 files changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/rsync.h b/rsync.h
+index 8ddbe702..0f9e277f 100644
+--- a/rsync.h
++++ b/rsync.h
+@@ -982,7 +982,7 @@ struct map_struct {
+ 	int status;		/* first errno from read errors		*/
+ };
+ 
+-#define sum2_at(s, i)	((s)->sum2_array + ((OFF_T)(i) * xfer_sum_len))
++#define sum2_at(s, i)	((s)->sum2_array + ((size_t)(i) * xfer_sum_len))
+ 
+ #define NAME_IS_FILE		(0)    /* filter name as a file */
+ #define NAME_IS_DIR		(1<<0) /* filter name as a dir */
+diff --git a/sender.c b/sender.c
+index ab205341..2bbff2fa 100644
+--- a/sender.c
++++ b/sender.c
+@@ -95,7 +95,7 @@ static struct sum_struct *receive_sums(int f)
+ 		return(s);
+ 
+ 	s->sums = new_array(struct sum_buf, s->count);
+-	s->sum2_array = new_array(char, s->count * xfer_sum_len);
++	s->sum2_array = new_array(char, (size_t)s->count * xfer_sum_len);
+ 
+ 	for (i = 0; i < s->count; i++) {
+ 		s->sums[i].sum1 = read_int(f);
+-- 
+2.34.1
+

pkgs/applications/networking/sync/rsync/CVE-2024-12085/0001-prevent-information-leak-off-the-stack.patch

@@ -0,0 +1,27 @@
+From cf620065502f065d4ea44f5df4f81295a738aa21 Mon Sep 17 00:00:00 2001
+From: Andrew Tridgell <andrew@tridgell.net>
+Date: Thu, 14 Nov 2024 09:57:08 +1100
+Subject: [PATCH] prevent information leak off the stack
+
+prevent leak of uninitialised stack data in hash_search
+---
+ match.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/match.c b/match.c
+index 36e78ed2..dfd6af2c 100644
+--- a/match.c
++++ b/match.c
+@@ -147,6 +147,9 @@ static void hash_search(int f,struct sum_struct *s,
+ 	int more;
+ 	schar *map;
+ 
++	// prevent possible memory leaks
++	memset(sum2, 0, sizeof sum2);
++
+ 	/* want_i is used to encourage adjacent matches, allowing the RLL
+ 	 * coding of the output to work more efficiently. */
+ 	want_i = 0;
+-- 
+2.34.1
+

pkgs/applications/networking/sync/rsync/CVE-2024-12086/0001-refuse-fuzzy-options-when-fuzzy-not-selected.patch

@@ -0,0 +1,37 @@
+From 3feb8669d875d03c9ceb82e208ef40ddda8eb908 Mon Sep 17 00:00:00 2001
+From: Andrew Tridgell <andrew@tridgell.net>
+Date: Sat, 23 Nov 2024 11:08:03 +1100
+Subject: [PATCH 1/4] refuse fuzzy options when fuzzy not selected
+
+this prevents a malicious server providing a file to compare to when
+the user has not given the fuzzy option
+---
+ receiver.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/receiver.c b/receiver.c
+index 6b4b369e..2d7f6033 100644
+--- a/receiver.c
++++ b/receiver.c
+@@ -66,6 +66,7 @@ extern char sender_file_sum[MAX_DIGEST_LEN];
+ extern struct file_list *cur_flist, *first_flist, *dir_flist;
+ extern filter_rule_list daemon_filter_list;
+ extern OFF_T preallocated_len;
++extern int fuzzy_basis;
+ 
+ extern struct name_num_item *xfer_sum_nni;
+ extern int xfer_sum_len;
+@@ -716,6 +717,10 @@ int recv_files(int f_in, int f_out, char *local_name)
+ 				fnamecmp = get_backup_name(fname);
+ 				break;
+ 			case FNAMECMP_FUZZY:
++				if (fuzzy_basis == 0) {
++					rprintf(FERROR_XFER, "rsync: refusing malicious fuzzy operation for %s\n", xname);
++					exit_cleanup(RERR_PROTOCOL);
++				}
+ 				if (file->dirname) {
+ 					pathjoin(fnamecmpbuf, sizeof fnamecmpbuf, file->dirname, xname);
+ 					fnamecmp = fnamecmpbuf;
+-- 
+2.34.1
+

pkgs/applications/networking/sync/rsync/CVE-2024-12086/0002-added-secure_relative_open.patch

@@ -0,0 +1,103 @@
+From 33385aefe4773e7a3982d41995681eb079c92d12 Mon Sep 17 00:00:00 2001
+From: Andrew Tridgell <andrew@tridgell.net>
+Date: Sat, 23 Nov 2024 12:26:10 +1100
+Subject: [PATCH 2/4] added secure_relative_open()
+
+this is an open that enforces no symlink following for all path
+components in a relative path
+---
+ syscall.c | 74 +++++++++++++++++++++++++++++++++++++++++++++++++++++++
+ 1 file changed, 74 insertions(+)
+
+diff --git a/syscall.c b/syscall.c
+index d92074aa..a4b7f542 100644
+--- a/syscall.c
++++ b/syscall.c
+@@ -33,6 +33,8 @@
+ #include <sys/syscall.h>
+ #endif
+ 
++#include "ifuncs.h"
++
+ extern int dry_run;
+ extern int am_root;
+ extern int am_sender;
+@@ -712,3 +714,75 @@ int do_open_nofollow(const char *pathname, int flags)
+ 
+ 	return fd;
+ }
++
++/*
++  open a file relative to a base directory. The basedir can be NULL,
++  in which case the current working directory is used. The relpath
++  must be a relative path, and the relpath must not contain any
++  elements in the path which follow symlinks (ie. like O_NOFOLLOW, but
++  applies to all path components, not just the last component)
++*/
++int secure_relative_open(const char *basedir, const char *relpath, int flags, mode_t mode)
++{
++	if (!relpath || relpath[0] == '/') {
++		// must be a relative path
++		errno = EINVAL;
++		return -1;
++	}
++
++#if !defined(O_NOFOLLOW) || !defined(O_DIRECTORY)
++	// really old system, all we can do is live with the risks
++	if (!basedir) {
++		return open(relpath, flags, mode);
++	}
++	char fullpath[MAXPATHLEN];
++	pathjoin(fullpath, sizeof fullpath, basedir, relpath);
++	return open(fullpath, flags, mode);
++#else
++	int dirfd = AT_FDCWD;
++	if (basedir != NULL) {
++		dirfd = openat(AT_FDCWD, basedir, O_RDONLY | O_DIRECTORY);
++		if (dirfd == -1) {
++			return -1;
++		}
++	}
++	int retfd = -1;
++
++	char *path_copy = my_strdup(relpath, __FILE__, __LINE__);
++	if (!path_copy) {
++		return -1;
++	}
++	
++	for (const char *part = strtok(path_copy, "/");
++	     part != NULL;
++	     part = strtok(NULL, "/"))
++	{
++		int next_fd = openat(dirfd, part, O_RDONLY | O_DIRECTORY | O_NOFOLLOW);
++		if (next_fd == -1 && errno == ENOTDIR) {
++			if (strtok(NULL, "/") != NULL) {
++				// this is not the last component of the path
++				errno = ELOOP;
++				goto cleanup;
++			}
++			// this could be the last component of the path, try as a file
++			retfd = openat(dirfd, part, flags | O_NOFOLLOW, mode);
++			goto cleanup;
++		}
++		if (next_fd == -1) {
++			goto cleanup;
++		}
++		if (dirfd != AT_FDCWD) close(dirfd);
++		dirfd = next_fd;
++	}
++
++	// the path must be a directory
++	errno = EINVAL;
++
++cleanup:
++	free(path_copy);
++	if (dirfd != AT_FDCWD) {
++		close(dirfd);
++	}
++	return retfd;
++#endif // O_NOFOLLOW, O_DIRECTORY
++}
+-- 
+2.34.1
+

pkgs/applications/networking/sync/rsync/CVE-2024-12086/0003-receiver-use-secure_relative_open-for-basis-file.patch

@@ -0,0 +1,103 @@
+From e59ef9939d3f0ccc8f9bab51442989a81be0c914 Mon Sep 17 00:00:00 2001
+From: Andrew Tridgell <andrew@tridgell.net>
+Date: Sat, 23 Nov 2024 12:28:13 +1100
+Subject: [PATCH 3/4] receiver: use secure_relative_open() for basis file
+
+this prevents attacks where the basis file is manipulated by a
+malicious sender to gain information about files outside the
+destination tree
+---
+ receiver.c | 42 ++++++++++++++++++++++++++----------------
+ 1 file changed, 26 insertions(+), 16 deletions(-)
+
+diff --git a/receiver.c b/receiver.c
+index 2d7f6033..8031b8f4 100644
+--- a/receiver.c
++++ b/receiver.c
+@@ -552,6 +552,8 @@ int recv_files(int f_in, int f_out, char *local_name)
+ 	progress_init();
+ 
+ 	while (1) {
++		const char *basedir = NULL;
++
+ 		cleanup_disable();
+ 
+ 		/* This call also sets cur_flist. */
+@@ -722,27 +724,29 @@ int recv_files(int f_in, int f_out, char *local_name)
+ 					exit_cleanup(RERR_PROTOCOL);
+ 				}
+ 				if (file->dirname) {
+-					pathjoin(fnamecmpbuf, sizeof fnamecmpbuf, file->dirname, xname);
+-					fnamecmp = fnamecmpbuf;
+-				} else
+-					fnamecmp = xname;
++					basedir = file->dirname;
++				}
++				fnamecmp = xname;
+ 				break;
+ 			default:
+ 				if (fnamecmp_type > FNAMECMP_FUZZY && fnamecmp_type-FNAMECMP_FUZZY <= basis_dir_cnt) {
+ 					fnamecmp_type -= FNAMECMP_FUZZY + 1;
+ 					if (file->dirname) {
+-						stringjoin(fnamecmpbuf, sizeof fnamecmpbuf,
+-							   basis_dir[fnamecmp_type], "/", file->dirname, "/", xname, NULL);
+-					} else
+-						pathjoin(fnamecmpbuf, sizeof fnamecmpbuf, basis_dir[fnamecmp_type], xname);
++						pathjoin(fnamecmpbuf, sizeof fnamecmpbuf, basis_dir[fnamecmp_type], file->dirname);
++						basedir = fnamecmpbuf;
++					} else {
++						basedir = basis_dir[fnamecmp_type];
++					}
++					fnamecmp = xname;
+ 				} else if (fnamecmp_type >= basis_dir_cnt) {
+ 					rprintf(FERROR,
+ 						"invalid basis_dir index: %d.\n",
+ 						fnamecmp_type);
+ 					exit_cleanup(RERR_PROTOCOL);
+-				} else
+-					pathjoin(fnamecmpbuf, sizeof fnamecmpbuf, basis_dir[fnamecmp_type], fname);
+-				fnamecmp = fnamecmpbuf;
++				} else {
++					basedir = basis_dir[fnamecmp_type];
++					fnamecmp = fname;
++				}
+ 				break;
+ 			}
+ 			if (!fnamecmp || (daemon_filter_list.head
+@@ -765,7 +769,7 @@ int recv_files(int f_in, int f_out, char *local_name)
+ 		}
+ 
+ 		/* open the file */
+-		fd1 = do_open(fnamecmp, O_RDONLY, 0);
++		fd1 = secure_relative_open(basedir, fnamecmp, O_RDONLY, 0);
+ 
+ 		if (fd1 == -1 && protocol_version < 29) {
+ 			if (fnamecmp != fname) {
+@@ -776,14 +780,20 @@ int recv_files(int f_in, int f_out, char *local_name)
+ 
+ 			if (fd1 == -1 && basis_dir[0]) {
+ 				/* pre-29 allowed only one alternate basis */
+-				pathjoin(fnamecmpbuf, sizeof fnamecmpbuf,
+-					 basis_dir[0], fname);
+-				fnamecmp = fnamecmpbuf;
++				basedir = basis_dir[0];
++				fnamecmp = fname;
+ 				fnamecmp_type = FNAMECMP_BASIS_DIR_LOW;
+-				fd1 = do_open(fnamecmp, O_RDONLY, 0);
++				fd1 = secure_relative_open(basedir, fnamecmp, O_RDONLY, 0);
+ 			}
+ 		}
+ 
++		if (basedir) {
++			// for the following code we need the full
++			// path name as a single string
++			pathjoin(fnamecmpbuf, sizeof fnamecmpbuf, basedir, fnamecmp);
++			fnamecmp = fnamecmpbuf;
++		}
++
+ 		one_inplace = inplace_partial && fnamecmp_type == FNAMECMP_PARTIAL_DIR;
+ 		updating_basis_or_equiv = one_inplace
+ 		    || (inplace && (fnamecmp == fname || fnamecmp_type == FNAMECMP_BACKUP));
+-- 
+2.34.1
+

pkgs/applications/networking/sync/rsync/CVE-2024-12086/0004-disallow-.-elements-in-relpath-for-secure_relative_o.patch

@@ -0,0 +1,37 @@
+From c78e53edb802d04f7e4e070fe8314f2544749e7a Mon Sep 17 00:00:00 2001
+From: Andrew Tridgell <andrew@tridgell.net>
+Date: Tue, 26 Nov 2024 09:16:31 +1100
+Subject: [PATCH 4/4] disallow ../ elements in relpath for secure_relative_open
+
+---
+ syscall.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+diff --git a/syscall.c b/syscall.c
+index a4b7f542..47c5ea57 100644
+--- a/syscall.c
++++ b/syscall.c
+@@ -721,6 +721,8 @@ int do_open_nofollow(const char *pathname, int flags)
+   must be a relative path, and the relpath must not contain any
+   elements in the path which follow symlinks (ie. like O_NOFOLLOW, but
+   applies to all path components, not just the last component)
++
++  The relpath must also not contain any ../ elements in the path
+ */
+ int secure_relative_open(const char *basedir, const char *relpath, int flags, mode_t mode)
+ {
+@@ -729,6 +731,11 @@ int secure_relative_open(const char *basedir, const char *relpath, int flags, mo
+ 		errno = EINVAL;
+ 		return -1;
+ 	}
++	if (strncmp(relpath, "../", 3) == 0 || strstr(relpath, "/../")) {
++		// no ../ elements allowed in the relpath
++		errno = EINVAL;
++		return -1;
++	}
+ 
+ #if !defined(O_NOFOLLOW) || !defined(O_DIRECTORY)
+ 	// really old system, all we can do is live with the risks
+-- 
+2.34.1
+

pkgs/applications/networking/sync/rsync/CVE-2024-12087/0001-Refuse-a-duplicate-dirlist.patch

@@ -0,0 +1,45 @@
+From 0ebc19ee486a8e928a68d8f98d07d40f176770aa Mon Sep 17 00:00:00 2001
+From: Wayne Davison <wayne@opencoder.net>
+Date: Thu, 14 Nov 2024 15:46:50 -0800
+Subject: [PATCH 1/2] Refuse a duplicate dirlist.
+
+---
+ flist.c | 9 +++++++++
+ rsync.h | 1 +
+ 2 files changed, 10 insertions(+)
+
+diff --git a/flist.c b/flist.c
+index 464d556e..847b1054 100644
+--- a/flist.c
++++ b/flist.c
+@@ -2584,6 +2584,15 @@ struct file_list *recv_file_list(int f, int dir_ndx)
+ 		init_hard_links();
+ #endif
+ 
++	if (inc_recurse && dir_ndx >= 0) {
++		struct file_struct *file = dir_flist->files[dir_ndx];
++		if (file->flags & FLAG_GOT_DIR_FLIST) {
++			rprintf(FERROR_XFER, "rsync: refusing malicious duplicate flist for dir %d\n", dir_ndx);
++			exit_cleanup(RERR_PROTOCOL);
++		}
++		file->flags |= FLAG_GOT_DIR_FLIST;
++	}
++
+ 	flist = flist_new(0, "recv_file_list");
+ 	flist_expand(flist, FLIST_START_LARGE);
+ 
+diff --git a/rsync.h b/rsync.h
+index 0f9e277f..b9a7101a 100644
+--- a/rsync.h
++++ b/rsync.h
+@@ -84,6 +84,7 @@
+ #define FLAG_DUPLICATE (1<<4)	/* sender */
+ #define FLAG_MISSING_DIR (1<<4)	/* generator */
+ #define FLAG_HLINKED (1<<5)	/* receiver/generator (checked on all types) */
++#define FLAG_GOT_DIR_FLIST (1<<5)/* sender/receiver/generator - dir_flist only */
+ #define FLAG_HLINK_FIRST (1<<6)	/* receiver/generator (w/FLAG_HLINKED) */
+ #define FLAG_IMPLIED_DIR (1<<6)	/* sender/receiver/generator (dirs only) */
+ #define FLAG_HLINK_LAST (1<<7)	/* receiver/generator */
+-- 
+2.34.1
+

pkgs/applications/networking/sync/rsync/CVE-2024-12087/0002-range-check-dir_ndx-before-use.patch

@@ -0,0 +1,27 @@
+From b3e16be18d582dac1513c0a932d146b36e867b1b Mon Sep 17 00:00:00 2001
+From: Andrew Tridgell <andrew@tridgell.net>
+Date: Tue, 26 Nov 2024 16:12:45 +1100
+Subject: [PATCH 2/2] range check dir_ndx before use
+
+---
+ flist.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/flist.c b/flist.c
+index 847b1054..087f9da6 100644
+--- a/flist.c
++++ b/flist.c
+@@ -2585,6 +2585,10 @@ struct file_list *recv_file_list(int f, int dir_ndx)
+ #endif
+ 
+ 	if (inc_recurse && dir_ndx >= 0) {
++		if (dir_ndx >= dir_flist->used) {
++			rprintf(FERROR_XFER, "rsync: refusing invalid dir_ndx %u >= %u\n", dir_ndx, dir_flist->used);
++			exit_cleanup(RERR_PROTOCOL);
++		}
+ 		struct file_struct *file = dir_flist->files[dir_ndx];
+ 		if (file->flags & FLAG_GOT_DIR_FLIST) {
+ 			rprintf(FERROR_XFER, "rsync: refusing malicious duplicate flist for dir %d\n", dir_ndx);
+-- 
+2.34.1
+

pkgs/applications/networking/sync/rsync/CVE-2024-12088/0001-make-safe-links-stricter.patch

@@ -0,0 +1,136 @@
+From 535f8f816539ba681ef0f12015d2cb587ae61b6d Mon Sep 17 00:00:00 2001
+From: Andrew Tridgell <andrew@tridgell.net>
+Date: Sat, 23 Nov 2024 15:15:53 +1100
+Subject: [PATCH] make --safe-links stricter
+
+when --safe-links is used also reject links where a '../' component is
+included in the destination as other than the leading part of the
+filename
+---
+ testsuite/safe-links.test    | 55 ++++++++++++++++++++++++++++++++++++
+ testsuite/unsafe-byname.test |  2 +-
+ util1.c                      | 26 ++++++++++++++++-
+ 3 files changed, 81 insertions(+), 2 deletions(-)
+ create mode 100644 testsuite/safe-links.test
+
+diff --git a/testsuite/safe-links.test b/testsuite/safe-links.test
+new file mode 100644
+index 00000000..6e95a4b9
+--- /dev/null
++++ b/testsuite/safe-links.test
+@@ -0,0 +1,55 @@
++#!/bin/sh
++
++. "$suitedir/rsync.fns"
++
++test_symlink() {
++	is_a_link "$1" || test_fail "File $1 is not a symlink"
++}
++
++test_regular() {
++	if [ ! -f "$1" ]; then
++		test_fail "File $1 is not regular file or not exists"
++	fi
++}
++
++test_notexist() {
++        if [ -e "$1" ]; then
++                test_fail "File $1 exists"
++	fi
++        if [ -h "$1" ]; then
++                test_fail "File $1 exists as a symlink"
++	fi
++}
++
++cd "$tmpdir"
++
++mkdir from
++
++mkdir "from/safe"
++mkdir "from/unsafe"
++
++mkdir "from/safe/files"
++mkdir "from/safe/links"
++
++touch "from/safe/files/file1"
++touch "from/safe/files/file2"
++touch "from/unsafe/unsafefile"
++
++ln -s ../files/file1 "from/safe/links/"
++ln -s ../files/file2 "from/safe/links/"
++ln -s ../../unsafe/unsafefile "from/safe/links/"
++ln -s a/a/a/../../../unsafe2 "from/safe/links/"
++
++#echo "LISTING FROM"
++#ls -lR from
++
++echo "rsync with relative path and just -a"
++$RSYNC -avv --safe-links from/safe/ to
++
++#echo "LISTING TO"
++#ls -lR to
++
++test_symlink to/links/file1
++test_symlink to/links/file2
++test_notexist to/links/unsafefile
++test_notexist to/links/unsafe2
+diff --git a/testsuite/unsafe-byname.test b/testsuite/unsafe-byname.test
+index 75e72014..d2e318ef 100644
+--- a/testsuite/unsafe-byname.test
++++ b/testsuite/unsafe-byname.test
+@@ -40,7 +40,7 @@ test_unsafe ..//../dest 		from/dir			unsafe
+ test_unsafe ..				from/file			safe
+ test_unsafe ../..			from/file			unsafe
+ test_unsafe ..//..			from//file			unsafe
+-test_unsafe dir/..			from				safe
++test_unsafe dir/..			from				unsafe
+ test_unsafe dir/../..			from				unsafe
+ test_unsafe dir/..//..			from				unsafe
+ 
+diff --git a/util1.c b/util1.c
+index da50ff1e..f260d398 100644
+--- a/util1.c
++++ b/util1.c
+@@ -1318,7 +1318,14 @@ int handle_partial_dir(const char *fname, int create)
+  *
+  * "src" is the top source directory currently applicable at the level
+  * of the referenced symlink.  This is usually the symlink's full path
+- * (including its name), as referenced from the root of the transfer. */
++ * (including its name), as referenced from the root of the transfer.
++ *
++ * NOTE: this also rejects dest names with a .. component in other
++ * than the first component of the name ie. it rejects names such as
++ * a/b/../x/y. This needs to be done as the leading subpaths 'a' or
++ * 'b' could later be replaced with symlinks such as a link to '.'
++ * resulting in the link being transferred now becoming unsafe
++ */
+ int unsafe_symlink(const char *dest, const char *src)
+ {
+ 	const char *name, *slash;
+@@ -1328,6 +1335,23 @@ int unsafe_symlink(const char *dest, const char *src)
+ 	if (!dest || !*dest || *dest == '/')
+ 		return 1;
+ 
++	// reject destinations with /../ in the name other than at the start of the name
++	const char *dest2 = dest;
++	while (strncmp(dest2, "../", 3) == 0) {
++	    dest2 += 3;
++	    while (*dest2 == '/') {
++		// allow for ..//..///../foo
++		dest2++;
++	    }
++	}
++	if (strstr(dest2, "/../"))
++	    return 1;
++
++	// reject if the destination ends in /..
++	const size_t dlen = strlen(dest);
++	if (dlen > 3 && strcmp(&dest[dlen-3], "/..") == 0)
++	    return 1;
++
+ 	/* find out what our safety margin is */
+ 	for (name = src; (slash = strchr(name, '/')) != 0; name = slash+1) {
+ 		/* ".." segment starts the count over.  "." segment is ignored. */
+-- 
+2.34.1
+

pkgs/applications/networking/sync/rsync/CVE-2024-12747/0001-fixed-symlink-race-condition-in-sender.patch

@@ -0,0 +1,187 @@
+From f45f48055e548851bc7230f454dfeba139be6c04 Mon Sep 17 00:00:00 2001
+From: Andrew Tridgell <andrew@tridgell.net>
+Date: Wed, 18 Dec 2024 08:59:42 +1100
+Subject: [PATCH] fixed symlink race condition in sender
+
+when we open a file that we don't expect to be a symlink use
+O_NOFOLLOW to prevent a race condition where an attacker could change
+a file between being a normal file and a symlink
+---
+ checksum.c  |  2 +-
+ flist.c     |  2 +-
+ generator.c |  4 ++--
+ receiver.c  |  2 +-
+ sender.c    |  2 +-
+ syscall.c   | 20 ++++++++++++++++++++
+ t_unsafe.c  |  3 +++
+ tls.c       |  3 +++
+ trimslash.c |  2 ++
+ util1.c     |  2 +-
+ 10 files changed, 35 insertions(+), 7 deletions(-)
+
+diff --git a/checksum.c b/checksum.c
+index cb21882c..66e80896 100644
+--- a/checksum.c
++++ b/checksum.c
+@@ -406,7 +406,7 @@ void file_checksum(const char *fname, const STRUCT_STAT *st_p, char *sum)
+ 	int32 remainder;
+ 	int fd;
+ 
+-	fd = do_open(fname, O_RDONLY, 0);
++	fd = do_open_checklinks(fname);
+ 	if (fd == -1) {
+ 		memset(sum, 0, file_sum_len);
+ 		return;
+diff --git a/flist.c b/flist.c
+index 087f9da6..17832533 100644
+--- a/flist.c
++++ b/flist.c
+@@ -1390,7 +1390,7 @@ struct file_struct *make_file(const char *fname, struct file_list *flist,
+ 
+ 	if (copy_devices && am_sender && IS_DEVICE(st.st_mode)) {
+ 		if (st.st_size == 0) {
+-			int fd = do_open(fname, O_RDONLY, 0);
++			int fd = do_open_checklinks(fname);
+ 			if (fd >= 0) {
+ 				st.st_size = get_device_size(fd, fname);
+ 				close(fd);
+diff --git a/generator.c b/generator.c
+index 110db28f..3f13bb95 100644
+--- a/generator.c
++++ b/generator.c
+@@ -1798,7 +1798,7 @@ static void recv_generator(char *fname, struct file_struct *file, int ndx,
+ 
+ 	if (write_devices && IS_DEVICE(sx.st.st_mode) && sx.st.st_size == 0) {
+ 		/* This early open into fd skips the regular open below. */
+-		if ((fd = do_open(fnamecmp, O_RDONLY, 0)) >= 0)
++		if ((fd = do_open_nofollow(fnamecmp, O_RDONLY)) >= 0)
+ 			real_sx.st.st_size = sx.st.st_size = get_device_size(fd, fnamecmp);
+ 	}
+ 
+@@ -1867,7 +1867,7 @@ static void recv_generator(char *fname, struct file_struct *file, int ndx,
+ 	}
+ 
+ 	/* open the file */
+-	if (fd < 0 && (fd = do_open(fnamecmp, O_RDONLY, 0)) < 0) {
++	if (fd < 0 && (fd = do_open_checklinks(fnamecmp)) < 0) {
+ 		rsyserr(FERROR, errno, "failed to open %s, continuing",
+ 			full_fname(fnamecmp));
+ 	  pretend_missing:
+diff --git a/receiver.c b/receiver.c
+index 8031b8f4..edfbb210 100644
+--- a/receiver.c
++++ b/receiver.c
+@@ -775,7 +775,7 @@ int recv_files(int f_in, int f_out, char *local_name)
+ 			if (fnamecmp != fname) {
+ 				fnamecmp = fname;
+ 				fnamecmp_type = FNAMECMP_FNAME;
+-				fd1 = do_open(fnamecmp, O_RDONLY, 0);
++				fd1 = do_open_nofollow(fnamecmp, O_RDONLY);
+ 			}
+ 
+ 			if (fd1 == -1 && basis_dir[0]) {
+diff --git a/sender.c b/sender.c
+index 2bbff2fa..a4d46c39 100644
+--- a/sender.c
++++ b/sender.c
+@@ -350,7 +350,7 @@ void send_files(int f_in, int f_out)
+ 			exit_cleanup(RERR_PROTOCOL);
+ 		}
+ 
+-		fd = do_open(fname, O_RDONLY, 0);
++		fd = do_open_checklinks(fname);
+ 		if (fd == -1) {
+ 			if (errno == ENOENT) {
+ 				enum logcode c = am_daemon && protocol_version < 28 ? FERROR : FWARNING;
+diff --git a/syscall.c b/syscall.c
+index 081357bb..8cea2900 100644
+--- a/syscall.c
++++ b/syscall.c
+@@ -45,6 +45,8 @@ extern int preallocate_files;
+ extern int preserve_perms;
+ extern int preserve_executability;
+ extern int open_noatime;
++extern int copy_links;
++extern int copy_unsafe_links;
+ 
+ #ifndef S_BLKSIZE
+ # if defined hpux || defined __hpux__ || defined __hpux
+@@ -788,3 +790,21 @@ cleanup:
+ 	return retfd;
+ #endif // O_NOFOLLOW, O_DIRECTORY
+ }
++
++/*
++  varient of do_open/do_open_nofollow which does do_open() if the
++  copy_links or copy_unsafe_links options are set and does
++  do_open_nofollow() otherwise
++
++  This is used to prevent a race condition where an attacker could be
++  switching a file between being a symlink and being a normal file
++
++  The open is always done with O_RDONLY flags
++ */
++int do_open_checklinks(const char *pathname)
++{
++	if (copy_links || copy_unsafe_links) {
++		return do_open(pathname, O_RDONLY, 0);
++	}
++	return do_open_nofollow(pathname, O_RDONLY);
++}
+diff --git a/t_unsafe.c b/t_unsafe.c
+index 010cac50..e10619a2 100644
+--- a/t_unsafe.c
++++ b/t_unsafe.c
+@@ -28,6 +28,9 @@ int am_root = 0;
+ int am_sender = 1;
+ int read_only = 0;
+ int list_only = 0;
++int copy_links = 0;
++int copy_unsafe_links = 0;
++
+ short info_levels[COUNT_INFO], debug_levels[COUNT_DEBUG];
+ 
+ int
+diff --git a/tls.c b/tls.c
+index e6b0708a..858f8f10 100644
+--- a/tls.c
++++ b/tls.c
+@@ -49,6 +49,9 @@ int list_only = 0;
+ int link_times = 0;
+ int link_owner = 0;
+ int nsec_times = 0;
++int safe_symlinks = 0;
++int copy_links = 0;
++int copy_unsafe_links = 0;
+ 
+ #ifdef SUPPORT_XATTRS
+ 
+diff --git a/trimslash.c b/trimslash.c
+index 1ec928ca..f2774cd7 100644
+--- a/trimslash.c
++++ b/trimslash.c
+@@ -26,6 +26,8 @@ int am_root = 0;
+ int am_sender = 1;
+ int read_only = 1;
+ int list_only = 0;
++int copy_links = 0;
++int copy_unsafe_links = 0;
+ 
+ int
+ main(int argc, char **argv)
+diff --git a/util1.c b/util1.c
+index f260d398..d84bc414 100644
+--- a/util1.c
++++ b/util1.c
+@@ -365,7 +365,7 @@ int copy_file(const char *source, const char *dest, int tmpfilefd, mode_t mode)
+ 	int len;   /* Number of bytes read into `buf'. */
+ 	OFF_T prealloc_len = 0, offset = 0;
+ 
+-	if ((ifd = do_open(source, O_RDONLY, 0)) < 0) {
++	if ((ifd = do_open_nofollow(source, O_RDONLY)) < 0) {
+ 		int save_errno = errno;
+ 		rsyserr(FERROR_XFER, errno, "open %s", full_fname(source));
+ 		errno = save_errno;
+-- 
+2.34.1
+

pkgs/applications/networking/sync/rsync/default.nix

@@ -38,6 +38,18 @@ stdenv.mkDerivation rec {
   patches = [
     # https://github.com/WayneD/rsync/pull/558
     ./configure.ac-fix-failing-IPv6-check.patch
+    ./CVE-2024-12084/0001-Some-checksum-buffer-fixes.patch
+    ./CVE-2024-12084/0002-Another-cast-when-multiplying-integers.patch
+    ./CVE-2024-12085/0001-prevent-information-leak-off-the-stack.patch
+    ./CVE-2024-12086/0001-refuse-fuzzy-options-when-fuzzy-not-selected.patch
+    ./CVE-2024-12086/0002-added-secure_relative_open.patch
+    ./CVE-2024-12086/0003-receiver-use-secure_relative_open-for-basis-file.patch
+    ./CVE-2024-12086/0004-disallow-.-elements-in-relpath-for-secure_relative_o.patch
+    ./CVE-2024-12087/0001-Refuse-a-duplicate-dirlist.patch
+    ./CVE-2024-12087/0002-range-check-dir_ndx-before-use.patch
+    ./CVE-2024-12088/0001-make-safe-links-stricter.patch
+    ./CVE-2024-12747/0001-fixed-symlink-race-condition-in-sender.patch
+    ./raise-protocol-version-to-32.patch
   ];
 
   buildInputs =

pkgs/applications/networking/sync/rsync/raise-protocol-version-to-32.patch

@@ -0,0 +1,26 @@
+From 163e05b1680c4a3b448fa68d03c3fca9589f3bc4 Mon Sep 17 00:00:00 2001
+From: Andrew Tridgell <andrew@tridgell.net>
+Date: Tue, 10 Dec 2024 13:34:01 +1100
+Subject: [PATCH 1/3] raise protocol version to 32
+
+make it easier to spot unpatched servers
+---
+ rsync.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/rsync.h b/rsync.h
+index b9a7101a..9be1297b 100644
+--- a/rsync.h
++++ b/rsync.h
+@@ -111,7 +111,7 @@
+ 
+ /* Update this if you make incompatible changes and ALSO update the
+  * SUBPROTOCOL_VERSION if it is not a final (official) release. */
+-#define PROTOCOL_VERSION 31
++#define PROTOCOL_VERSION 32
+ 
+ /* This is used when working on a new protocol version or for any unofficial
+  * protocol tweaks.  It should be a non-zero value for each pre-release repo
+-- 
+2.34.1
+

pkgs/applications/office/scribus/default.nix

@@ -32,11 +32,11 @@ in
 stdenv.mkDerivation (finalAttrs: {
   pname = "scribus";
 
-  version = "1.6.2";
+  version = "1.6.3";
 
   src = fetchurl {
     url = "mirror://sourceforge/scribus/scribus-devel/scribus-${finalAttrs.version}.tar.xz";
-    hash = "sha256-fv+bH0fjcuVrs2nx2+GP5JEBeJtea8/beJDgNGtkE4M=";
+    hash = "sha256-CuWM7UEBAegmVeO0wgoHDPF2cUWtojPc73wguLpr1Ic=";
   };
 
   nativeBuildInputs = [

pkgs/applications/video/obs-studio/plugins/obs-transition-table.nix

@@ -9,13 +9,13 @@
 
 stdenv.mkDerivation rec {
   pname = "obs-transition-table";
-  version = "0.2.7";
+  version = "0.2.7-unstable-2024-11-27";
 
   src = fetchFromGitHub {
     owner = "exeldro";
     repo = "obs-transition-table";
-    rev = version;
-    sha256 = "sha256-rGF7hugC5ybpZBAIIXDiy3YDooMawf/yYX2YucQm2/U=";
+    rev = "976fe236dac7082b6c953f950fcb9e50495ce624";
+    sha256 = "sha256-TPRqKjEXdvjv+RfHTaeeO4GHur2j/+onehcu0I/HdD0=";
   };
 
   nativeBuildInputs = [ cmake ];
@@ -24,10 +24,6 @@ stdenv.mkDerivation rec {
     qtbase
   ];
 
-  cmakeFlags = [
-    "-DBUILD_OUT_OF_TREE=On"
-  ];
-
   dontWrapQtApps = true;
 
   postInstall = ''

pkgs/build-support/build-fhsenv-bubblewrap/default.nix

@@ -12,9 +12,13 @@
 }:
 
 {
+  pname ? throw "You must provide either `name` or `pname`",
+  version ? throw "You must provide either `name` or `version`",
+  name ? "${pname}-${version}",
   runScript ? "bash",
   nativeBuildInputs ? [ ],
   extraInstallCommands ? "",
+  executableName ? args.pname or name,
   meta ? { },
   passthru ? { },
   extraPreBwrapCmds ? "",
@@ -30,7 +34,12 @@
   ...
 }@args:
 
-assert (!args ? pname || !args ? version) -> (args ? name); # You must provide name if pname or version (preferred) is missing.
+# NOTE:
+# `pname` and `version` will throw if they were not provided.
+# Use `name` instead of directly evaluating `pname` or `version`.
+#
+# If you need `pname` or `version` sepcifically, use `args` instead:
+# e.g. `args.pname or ...`.
 
 let
   inherit (lib)
@@ -48,8 +57,6 @@ let
   # explicit about which package set it's coming from.
   inherit (pkgsHostTarget) pkgsi686Linux;
 
-  name = args.name or "${args.pname}-${args.version}";
-  executableName = args.pname or args.name;
   # we don't know which have been supplied, and want to avoid defaulting missing attrs to null. Passed into runCommandLocal
   nameAttrs = lib.filterAttrs (
     key: value:

pkgs/by-name/ae/aerospike/package.nix

@@ -12,13 +12,13 @@
 
 stdenv.mkDerivation rec {
   pname = "aerospike-server";
-  version = "7.2.0.4";
+  version = "7.2.0.6";
 
   src = fetchFromGitHub {
     owner = "aerospike";
     repo = "aerospike-server";
     rev = version;
-    hash = "sha256-g07rfQabjfvfl8rkLDgeTGq1J0pczdasTXIsWqUvz7w=";
+    hash = "sha256-YjX/2+0n+nrtNwQaZSY5PPYAOnhR+jrIMp02STcJHRY=";
     fetchSubmodules = true;
   };
 

pkgs/by-name/ap/api-linter/package.nix

@@ -6,16 +6,16 @@
 
 buildGoModule rec {
   pname = "api-linter";
-  version = "1.67.6";
+  version = "1.68.0";
 
   src = fetchFromGitHub {
     owner = "googleapis";
     repo = "api-linter";
     rev = "v${version}";
-    hash = "sha256-Dp5bZu9/wqrBZuups69P/SxK6RAKLSPqYt3TXdxMQss=";
+    hash = "sha256-pYzdI7bcAPP47K4EKjsAV7UY2RLGX9m3tksYRZeGdTQ=";
   };
 
-  vendorHash = "sha256-RPw8SPfs/M5ycPxB7eM2BmSYU0kKp/4drBvju0u+eoM=";
+  vendorHash = "sha256-vdoEMMlFwS+BBd0EsrahVL3ZZE4PHQJP4CNwsqIo5Y8=";
 
   subPackages = [ "cmd/api-linter" ];
 

pkgs/by-name/au/authentik/package.nix

@@ -15,13 +15,13 @@
 }:
 
 let
-  version = "2024.12.1";
+  version = "2024.12.2";
 
   src = fetchFromGitHub {
     owner = "goauthentik";
     repo = "authentik";
     rev = "version/${version}";
-    hash = "sha256-CkUmsVKzAQ/VWIhtxWxlcGtrWVa8hxqsMqvfcsG5ktA=";
+    hash = "sha256-Z3rFFrXrOKaF9NpY/fInsEbzdOWnWqLfEYl7YX9hFEU=";
   };
 
   meta = with lib; {

pkgs/by-name/ca/cargo-expand/package.nix

@@ -6,16 +6,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "cargo-expand";
-  version = "1.0.96";
+  version = "1.0.100";
 
   src = fetchFromGitHub {
     owner = "dtolnay";
     repo = pname;
     rev = version;
-    hash = "sha256-uLJ7XD1m4KreIue+p6Duoa8+DYjhaHagDMmPKcvHZ0I=";
+    hash = "sha256-nbzQmZ8hAiU8K+/VHwbEniTsioCgQhbADIxV9tL3M1k=";
   };
 
-  cargoHash = "sha256-XAkEcd/QDw1SyrPuuk5ojqlKHiG28DgdipbKtnlWsGg=";
+  cargoHash = "sha256-sOxLRNGIHsUBNWWRUo2qyeewL06rU5paq4LbXpksMzg=";
 
   meta = with lib; {
     description = "Cargo subcommand to show result of macro expansion";

pkgs/by-name/cl/cloud-hypervisor/package.nix

@@ -20,8 +20,16 @@ rustPlatform.buildRustPackage rec {
     hash = "sha256-drxJtlvBpkK3I7Ob3+pH4KLUq53GWXe1pmv7CI3bbP4=";
   };
 
+  cargoPatches = [
+    (fetchpatch {
+      name = "kvm-ioctls-0.19.1.patch";
+      url = "https://github.com/cloud-hypervisor/cloud-hypervisor/commit/eaa21946993276434403d41419a34e564935c8e9.patch";
+      hash = "sha256-G7B0uGl/RAkwub8x1jNNgBrC0dwq/Gv46XpbtTZWD5M=";
+    })
+  ];
+
   useFetchCargoVendor = true;
-  cargoHash = "sha256-wifctp30ApnxtRMlzksoSGrIJUT1cB0p1RBxfyITuZI=";
+  cargoHash = "sha256-F6ukvSwMHRHXoZKgXEFnTAN1B80GsQDW8iqZAvsREr4=";
 
   separateDebugInfo = true;
 

pkgs/by-name/co/code-cursor/package.nix

@@ -9,21 +9,32 @@
 let
   pname = "cursor";
   version = "0.44.11";
-  appKey = "230313mzl4w4u92";
-  src = fetchurl {
-    url = "https://download.todesktop.com/230313mzl4w4u92/cursor-0.44.11-build-250103fqxdt5u9z-x86_64.AppImage";
-    hash = "sha256-eOZuofnpED9F6wic0S9m933Tb7Gq7cb/v0kRDltvFVg=";
+
+  sources = {
+    x86_64-linux = fetchurl {
+      url = "https://download.todesktop.com/230313mzl4w4u92/cursor-0.44.11-build-250103fqxdt5u9z-x86_64.AppImage";
+      hash = "sha256-eOZuofnpED9F6wic0S9m933Tb7Gq7cb/v0kRDltvFVg=";
+    };
+    aarch64-linux = fetchurl {
+      url = "https://download.todesktop.com/230313mzl4w4u92/cursor-0.44.11-build-250103fqxdt5u9z-arm64.AppImage";
+      hash = "sha256-mxq7tQJfDccE0QsZDZbaFUKO0Xc141N00ntX3oEYRcc=";
+    };
   };
-  appimageContents = appimageTools.extractType2 { inherit version pname src; };
-in
-stdenvNoCC.mkDerivation {
-  inherit pname version;
 
-  src = appimageTools.wrapType2 { inherit version pname src; };
+  supportedPlatforms = [
+    "x86_64-linux"
+    "aarch64-linux"
+  ];
 
-  nativeBuildInputs = [ makeWrapper ];
+  src = sources.${stdenvNoCC.hostPlatform.system};
 
-  installPhase = ''
+  appimageContents = appimageTools.extractType2 {
+    inherit version pname src;
+  };
+
+  wrappedAppImage = appimageTools.wrapType2 { inherit version pname src; };
+
+  appimageInstall = ''
     runHook preInstall
 
     mkdir -p $out/
@@ -43,21 +54,47 @@ stdenvNoCC.mkDerivation {
     runHook postInstall
   '';
 
-  passthru.updateScript = writeScript "update.sh" ''
-    #!/usr/bin/env nix-shell
-    #!nix-shell -i bash -p curl yq coreutils gnused common-updater-scripts
-    set -eu -o pipefail
-    latestLinux="$(curl -s https://download.todesktop.com/${appKey}/latest-linux.yml)"
-    version="$(echo "$latestLinux" | yq -r .version)"
-    filename="$(echo "$latestLinux" | yq -r '.files[] | .url | select(. | endswith(".AppImage"))')"
-    url="https://download.todesktop.com/${appKey}/$filename"
-    currentVersion=$(nix-instantiate --eval -E "with import ./. {}; code-cursor.version or (lib.getVersion code-cursor)" | tr -d '"')
+in
+stdenvNoCC.mkDerivation {
+  inherit pname version;
 
-    if [[ "$version" != "$currentVersion" ]]; then
-      hash=$(nix-hash --to-sri --type sha256 "$(nix-prefetch-url "$url")")
-      update-source-version code-cursor "$version" "$hash" "$url" --source-key=src.src
-    fi
-  '';
+  src = wrappedAppImage;
+
+  nativeBuildInputs = [ makeWrapper ];
+
+  installPhase = appimageInstall;
+
+  passthru = {
+    inherit sources;
+    updateScript = writeScript "update.sh" ''
+      #!/usr/bin/env nix-shell
+      #!nix-shell -i bash -p curl yq coreutils gnused common-updater-scripts
+      set -eu -o pipefail
+      baseUrl="https://download.todesktop.com/230313mzl4w4u92"
+      latestLinux="$(curl -s $baseUrl/latest-linux.yml)"
+      version="$(echo "$latestLinux" | yq -r .version)"
+      filename="$(echo "$latestLinux" | yq -r '.files[] | .url | select(. | endswith(".AppImage"))')"
+      linuxStem="$(echo "$filename" | sed -E s/^\(cursor-.+-build-.*\)-.+$/\\1/)"
+
+      currentVersion=$(nix-instantiate --eval -E "with import ./. {}; code-cursor.version or (lib.getVersion code-cursor)" | tr -d '"')
+
+      if [[ "$version" != "$currentVersion" ]]; then
+        for platform in ${lib.escapeShellArgs supportedPlatforms}; do
+          if [ $platform = "x86_64-linux" ]; then
+            url="$baseUrl/$linuxStem-x86_64.AppImage"
+          elif [ $platform = "aarch64-linux" ]; then
+            url="$baseUrl/$linuxStem-arm64.AppImage"
+          else
+            echo "Unsupported platform: $platform"
+            exit 1
+          fi
+
+          hash=$(nix-hash --to-sri --type sha256 "$(nix-prefetch-url "$url")")
+          update-source-version code-cursor $version $hash $url --system=$platform --ignore-same-version --source-key="sources.$platform"
+        done
+      fi
+    '';
+  };
 
   meta = {
     description = "AI-powered code editor built on vscode";
@@ -66,7 +103,7 @@ stdenvNoCC.mkDerivation {
     license = lib.licenses.unfree;
     sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
     maintainers = with lib.maintainers; [ sarahec ];
-    platforms = [ "x86_64-linux" ];
+    platforms = lib.platforms.linux;
     mainProgram = "cursor";
   };
 }

pkgs/by-name/co/containerd/package.nix

@@ -16,7 +16,7 @@
 
 buildGoModule rec {
   pname = "containerd";
-  version = "2.0.1";
+  version = "2.0.2";
 
   outputs = [
     "out"
@@ -27,7 +27,7 @@ buildGoModule rec {
     owner = "containerd";
     repo = "containerd";
     tag = "v${version}";
-    hash = "sha256-gD0XRZThU/T8qxLyyboyE6GsX911ylt7hH59S+rB7vQ=";
+    hash = "sha256-aCC6nH+bxjk6dUIzUva4ILH0FD6QkWiJmdrcMLA18Jw=";
   };
 
   postPatch = "patchShebangs .";
@@ -89,7 +89,7 @@ buildGoModule rec {
   meta = {
     description = "Daemon to control runC";
     homepage = "https://containerd.io/";
-    changelog = "https://github.com/containerd/containerd/releases/tag/${version}";
+    changelog = "https://github.com/containerd/containerd/releases/tag/v${version}";
     license = lib.licenses.asl20;
     maintainers = with lib.maintainers; [
       offline

pkgs/by-name/cu/curv/package.nix

@@ -1,8 +1,10 @@
 {
   lib,
   stdenv,
-  fetchFromGitHub,
+  fetchFromGitea,
   cmake,
+  git,
+  pkg-config,
   boost,
   eigen,
   glm,
@@ -17,19 +19,22 @@
 
 stdenv.mkDerivation rec {
   pname = "curv";
-  version = "0.5";
+  version = "0.5-unstable-2025-01-06";
 
-  src = fetchFromGitHub {
-    owner = "curv3d";
+  src = fetchFromGitea {
+    domain = "codeberg.org";
+    owner = "doug-moen";
     repo = "curv";
-    tag = version;
-    hash = "sha256-m4p5uxRk6kEJUilmbQ1zJcQDRvRCV7pkxnqupZJxyjo=";
+    rev = "a496d98459b65d15feae8e69036944dafb7ec26e";
+    hash = "sha256-2pe76fBU78xRvHxol8O1xv0bBVwbpKDVPLQqqUCTO0Y=";
     fetchSubmodules = true;
   };
 
   strictDeps = true;
   nativeBuildInputs = [
     cmake
+    git
+    pkg-config
   ];
 
   buildInputs =

pkgs/by-name/cy/cyrus-imapd/package.nix

@@ -126,6 +126,7 @@ stdenv.mkDerivation (finalAttrs: {
         [
           zlib
           cyrus_sasl
+          sqlite
         ]
         # Darwin doesn't have libuuid, try to build without it
         ++ lib.optional (!stdenv.hostPlatform.isDarwin) libuuid;

pkgs/by-name/dd/ddns-go/package.nix

@@ -6,16 +6,16 @@
 
 buildGoModule rec {
   pname = "ddns-go";
-  version = "6.7.7";
+  version = "6.8.0";
 
   src = fetchFromGitHub {
     owner = "jeessy2";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-MzhZ9u4noPLdtrbALi42GI9i+nb4rRdugMzd20rJ6b0=";
+    hash = "sha256-zVNlsFPSLI8mXBUOo8z7nM4nShNd0ZwG5lZL2VyeGi8=";
   };
 
-  vendorHash = "sha256-e8/z1vriyHXPY1OvkGFqeZHJhz5ssOlqD/Uwt5xq8Uw=";
+  vendorHash = "sha256-D66uremGVcTcyBlCA9vrQM5zGPFR96FqVak6tATEdI0=";
 
   ldflags = [
     "-X main.version=${version}"

pkgs/by-name/ds/dsniff/package.nix

@@ -71,8 +71,8 @@ stdenv.mkDerivation rec {
     domain = "salsa.debian.org";
     owner = "pkg-security-team";
     repo = "dsniff";
-    rev = "debian/${version}+debian-30";
-    sha256 = "1fk2k0sfdp5g27i11g0sbzm7al52raz5yr1aibzssnysv7l9xgzh";
+    rev = "debian/${version}+debian-34";
+    sha256 = "sha256-CY0+G09KZXtAwKuaYh5/qcmZjuNhdGis3zCG14hWtqw=";
     name = "dsniff.tar.gz";
   };
 

pkgs/by-name/ff/ffizer/package.nix

@@ -0,0 +1,51 @@
+{
+  lib,
+  rustPlatform,
+  fetchFromGitHub,
+  pkg-config,
+  libgit2,
+  openssl,
+  zlib,
+}:
+
+rustPlatform.buildRustPackage rec {
+  pname = "ffizer";
+  version = "2.13.1";
+
+  buildFeatures = [ "cli" ];
+
+  src = fetchFromGitHub {
+    owner = "ffizer";
+    repo = "ffizer";
+    rev = version;
+    hash = "sha256-ZX6Zv6ioAO33Cc5WCVBgJWlOmNvbVgckMylRnphpOdw=";
+  };
+
+  cargoHash = "sha256-4fZLL4vQxAeyqQssmEd1C72fzMXCGHtUPCGpaVupy6Q=";
+
+  nativeBuildInputs = [
+    pkg-config
+  ];
+
+  buildInputs = [
+    libgit2
+    openssl
+    zlib
+  ];
+
+  env.OPENSSL_NO_VENDOR = true;
+
+  checkFlags = [
+    # requires internet access
+    "--skip=run_test_samples_tests_data_template_2"
+  ];
+
+  meta = {
+    description = "Files and folders initializer / generator based on templates";
+    homepage = "https://github.com/ffizer/ffizer";
+    changelog = "https://github.com/ffizer/ffizer/blob/${src.rev}/CHANGELOG.md";
+    license = lib.licenses.cc0;
+    maintainers = with lib.maintainers; [ XBagon ];
+    mainProgram = "ffizer";
+  };
+}

pkgs/by-name/fl/flaca/package.nix

@@ -9,7 +9,7 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "flaca";
-  version = "3.1.6";
+  version = "3.2.0";
 
   src =
     let
@@ -17,11 +17,11 @@ rustPlatform.buildRustPackage rec {
         owner = "Blobfolio";
         repo = pname;
         rev = "v${version}";
-        hash = "sha256-mNCb9d7/nRWSkiir2bYkslw/F2GmjvE0cPi7HhzEN68=";
+        hash = "sha256-pT3CizoqMQe+JljuDbV7hQpUmG+fx/ES2reupeX60iY=";
       };
       lockFile = fetchurl {
         url = "https://github.com/Blobfolio/flaca/releases/download/v${version}/Cargo.lock";
-        hash = "sha256-tyxTgYEGROCtoiKPX57pF32UcfpDCuMdFSttZu++ju8=";
+        hash = "sha256-Ek33acdDA9iMgpyIdx12arKtPHoKaIrfh5GNdgT7ib0=";
       };
     in
     runCommand "source-with-lock" { nativeBuildInputs = [ lndir ]; } ''
@@ -32,7 +32,7 @@ rustPlatform.buildRustPackage rec {
 
   nativeBuildInputs = [ rustPlatform.bindgenHook ];
 
-  cargoHash = "sha256-YYNWCJT5ZT36v4u4P3gtW/osor6eIvR8leqlQHHZYMk=";
+  cargoHash = "sha256-n8GDe8OVmHYgBaSp9Zb7Z/F2orDAR6d82Tikrd0y6Ts=";
 
   meta = with lib; {
     description = "CLI tool to losslessly compress JPEG and PNG images";

pkgs/by-name/gi/gitleaks/package.nix

@@ -3,7 +3,6 @@
   stdenv,
   buildGoModule,
   fetchFromGitHub,
-  gitleaks,
   installShellFiles,
   nix-update-script,
   versionCheckHook,
@@ -11,13 +10,13 @@
 
 buildGoModule rec {
   pname = "gitleaks";
-  version = "8.22.1";
+  version = "8.23.0";
 
   src = fetchFromGitHub {
     owner = "zricethezav";
     repo = "gitleaks";
     tag = "v${version}";
-    hash = "sha256-PJczVI2/TogRaw+Hs6HibHuwhKwL2scrCpsTQMsHv6Y=";
+    hash = "sha256-+9aZXjinvDYbPw+yjkQ/BH3LB0xbY1eual/zKoWMlJc=";
   };
 
   vendorHash = "sha256-hq3v//fhCUOvKPBZ/+YrLIc4nDLxR9Yc+MeIXY7TArA=";

pkgs/by-name/gn/gnome-builder/package.nix

@@ -142,6 +142,8 @@ stdenv.mkDerivation (finalAttrs: {
     gappsWrapperArgs+=(
       # For sysprof-agent
       --prefix PATH : "${sysprof}/bin"
+      # libpanel icons
+      --prefix XDG_DATA_DIRS : "${libpanel}/share"
     )
 
     # Ensure that all plugins get their interpreter paths fixed up.

pkgs/by-name/go/gogup/package.nix

@@ -6,16 +6,16 @@
 
 buildGoModule rec {
   pname = "gogup";
-  version = "0.27.5";
+  version = "0.27.6";
 
   src = fetchFromGitHub {
     owner = "nao1215";
     repo = "gup";
     rev = "v${version}";
-    hash = "sha256-I4l/sDqafc/ZO8kKc4iOSMFLS0YZrAqRFOXn0N7Myo4=";
+    hash = "sha256-d+VN3BBhGiVdLpCHP08vi7lYSeL6QovswtPNvEbS9fc=";
   };
 
-  vendorHash = "sha256-rtdbPwVZHwofpGccYU8NBiaikzNMIwSDggbRdnGTBu8=";
+  vendorHash = "sha256-jvVtwA7563ptWat/YS8klRnG3+NO3PeW0vl17yt8q8M=";
   doCheck = false;
 
   ldflags = [

pkgs/by-name/go/gomanagedocker/package.nix

@@ -1,13 +1,17 @@
 {
   lib,
+  stdenv,
   buildGoModule,
   fetchFromGitHub,
-  stdenv,
-  darwin,
+  versionCheckHook,
+  nix-update-script,
   xorg,
+  pkg-config,
+  gpgme,
+  btrfs-progs,
 }:
 let
-  version = "1.4";
+  version = "1.5";
 in
 buildGoModule {
   pname = "gomanagedocker";
@@ -17,20 +21,39 @@ buildGoModule {
     owner = "ajayd-san";
     repo = "gomanagedocker";
     tag = "v${version}";
-    hash = "sha256-oM0DCOHdVPJFWgmHF8yeGGo6XvuTCXar7NebM1obahg=";
+    hash = "sha256-y2lepnhaLsjokd587D0bCEd9cmG7GuNBbbx+0sKSCGA=";
   };
 
-  vendorHash = "sha256-M/jfQWCBrv7hZm450yLBmcjWtNSCziKOpfipxI6U9ak=";
+  vendorHash = "sha256-hUlv3i+ri9W8Pf1zVtFxB/QSdPJu1cWCjMbquCxoSno=";
 
-  buildInputs =
-    lib.optionals stdenv.hostPlatform.isDarwin [ darwin.apple_sdk.frameworks.Cocoa ]
-    ++ lib.optionals stdenv.hostPlatform.isLinux [ xorg.libX11 ];
+  nativeBuildInputs = [
+    pkg-config
+  ];
+
+  buildInputs = [
+    gpgme
+    btrfs-progs
+  ] ++ lib.optionals stdenv.hostPlatform.isLinux [ xorg.libX11 ];
 
   ldflags = [
     "-s"
     "-w"
   ];
 
+  # Mocking of docker and podman containers fails
+  doCheck = false;
+
+  nativeInstallCheckInputs = [
+    versionCheckHook
+  ];
+
+  versionCheckProgramArg = [ "--version" ];
+  doInstallCheck = true;
+
+  passthru = {
+    updateScript = nix-update-script { };
+  };
+
   meta = {
     description = "TUI tool to manage your docker images, containers and volumes";
     homepage = "https://github.com/ajayd-san/gomanagedocker";

pkgs/by-name/go/goperf/package.nix

@@ -9,15 +9,15 @@
 
 buildGoModule rec {
   pname = "goperf";
-  version = "0-unstable-2024-12-04";
+  version = "0-unstable-2025-01-06";
 
   src = fetchgit {
     url = "https://go.googlesource.com/perf";
-    rev = "711ff2ab72314f5a878a356d9ff7ab8460de731f";
-    hash = "sha256-T0LHlO9ObVJ68pERkY+6eJCxY+Lj9eHvOxlCRevwbuE=";
+    rev = "400946f43c825f133ced1d2662be611959d1335c";
+    hash = "sha256-w7HUDDfsZ60ZNryewh83mJ6ZMfMpnvW6ehhijKss7B0=";
   };
 
-  vendorHash = "sha256-OrrciJqJLTMM+yF9SD/eRucwOrfcZuuyR+xE6+DlYpo=";
+  vendorHash = "sha256-WHkeLS8Sdq2oP7hD0MKVrcENclaOWTeSVCXm+aimqIU=";
 
   passthru.updateScript = writeShellScript "update-goperf" ''
     export UPDATE_NIX_ATTR_PATH=goperf

pkgs/by-name/gr/greetd-mini-wl-greeter/package.nix

@@ -0,0 +1,67 @@
+{
+  fetchFromGitHub,
+  lib,
+  stdenv,
+  unstableGitUpdater,
+  cairo,
+  glib,
+  json_c,
+  libGL,
+  libepoxy,
+  libpng,
+  libxkbcommon,
+  meson,
+  ninja,
+  pango,
+  pkg-config,
+  scdoc,
+  wayland,
+  wayland-protocols,
+  wayland-scanner,
+}:
+stdenv.mkDerivation {
+  pname = "greetd-mini-wl-greeter";
+  version = "0-unstable-2024-12-27";
+
+  src = fetchFromGitHub {
+    owner = "philj56";
+    repo = "greetd-mini-wl-greeter";
+    rev = "61f25ed34a1a35a061c2f3605fc3d4b37a7d0d8e";
+    hash = "sha256-ifeQbzMA9O+yhLveTXpEmgG2BsSp4lxbd3yo8o69fxA=";
+  };
+
+  nativeBuildInputs = [
+    libGL
+    cairo
+    glib
+    json_c
+    libepoxy
+    libpng
+    libxkbcommon
+    pango
+    wayland
+    wayland-protocols
+    wayland-scanner
+  ];
+
+  # https://github.com/philj56/greetd-mini-wl-greeter/issues/2
+  mesonBuildType = "release";
+
+  buildInputs = [
+    meson
+    ninja
+    pkg-config
+    scdoc
+  ];
+
+  passthru.updateScript = unstableGitUpdater { };
+
+  meta = {
+    description = "Extremely minimal raw Wayland greeter for greetd";
+    license = lib.licenses.mit;
+    homepage = "https://github.com/philj56/greetd-mini-wl-greeter";
+    mainProgram = "greetd-mini-wl-greeter";
+    platforms = lib.platforms.linux;
+    maintainers = with lib.maintainers; [ _0x5a4 ];
+  };
+}

pkgs/by-name/gs/gssg/package.nix

@@ -0,0 +1,37 @@
+{
+  lib,
+  fetchFromSourcehut,
+  buildGoModule,
+  unstableGitUpdater,
+}:
+
+buildGoModule {
+  pname = "gssg";
+  version = "0-unstable-2023-05-29";
+
+  src = fetchFromSourcehut {
+    owner = "~gsthnz";
+    repo = "gssg";
+    rev = "fc755f281d750d0b022689d58d0f32e6799dfef8";
+    hash = "sha256-m0bVH6upLSA1dcxds3VJFFaSYs7YoMuoAmEe5qAUTmw=";
+  };
+
+  vendorHash = "sha256-NxfZbwKo8SY0XfWivQ42cNqIbJQ1EBsxPFr70ZU9G6E=";
+
+  ldFlags = [
+    "-s"
+    "-w"
+  ];
+
+  passthru = {
+    updateScript = unstableGitUpdater { };
+  };
+
+  meta = {
+    description = "Gemini static site generator";
+    homepage = "https://git.sr.ht/~gsthnz/gssg";
+    license = lib.licenses.gpl3Only;
+    maintainers = with lib.maintainers; [ genga898 ];
+    mainProgram = "gssg";
+  };
+}

pkgs/by-name/im/imhex/package.nix

@@ -2,7 +2,7 @@
   lib,
   stdenv,
   cmake,
-  llvmPackages_17,
+  llvm,
   fetchFromGitHub,
   mbedtls,
   gtk3,
@@ -24,21 +24,12 @@
   nix-update-script,
   autoPatchelfHook,
   makeWrapper,
-  overrideSDK,
 }:
 
 let
   version = "1.36.2";
   patterns_version = "1.36.2";
 
-  llvmPackages = llvmPackages_17;
-
-  stdenv' =
-    let
-      baseStdenv = if stdenv.cc.isClang then llvmPackages.stdenv else stdenv;
-    in
-    if stdenv.hostPlatform.isDarwin then overrideSDK baseStdenv "11.0" else baseStdenv;
-
   patterns_src = fetchFromGitHub {
     name = "ImHex-Patterns-source-${patterns_version}";
     owner = "WerWolv";
@@ -48,7 +39,7 @@ let
   };
 
 in
-stdenv'.mkDerivation (finalAttrs: {
+stdenv.mkDerivation (finalAttrs: {
   pname = "imhex";
   inherit version;
 
@@ -65,7 +56,7 @@ stdenv'.mkDerivation (finalAttrs: {
 
   nativeBuildInputs = [
     cmake
-    llvmPackages.llvm
+    llvm
     python3
     perl
     pkg-config

pkgs/by-name/ja/jawiki-all-titles-in-ns0/package.nix

@@ -7,13 +7,13 @@
 
 stdenvNoCC.mkDerivation {
   pname = "jawiki-all-titles-in-ns0";
-  version = "0-unstable-2024-12-01";
+  version = "0-unstable-2025-01-01";
 
   src = fetchFromGitHub {
     owner = "musjj";
     repo = "jawiki-archive";
-    rev = "a4146faaca34c37a36f26e1e75990187cac40954";
-    hash = "sha256-FuLtXgyEpHZWeZbbrKXalXeycf7gtkfWMYoM7j2mOds=";
+    rev = "dbd1e032f8685387c0dbeb1a472ab9215250d11f";
+    hash = "sha256-2GjbXjsf8OV/9EuX675hBXTWQsf+KhKhh1IiAxbzqfU=";
   };
 
   installPhase = ''

pkgs/by-name/jp/jp-zip-codes/package.nix

@@ -7,15 +7,15 @@
 
 stdenvNoCC.mkDerivation {
   pname = "jp-zip-code";
-  version = "0-unstable-2024-12-01";
+  version = "0-unstable-2025-01-01";
 
   # This package uses a mirror as the source because the
   # original provider uses the same URL for updated content.
   src = fetchFromGitHub {
     owner = "musjj";
     repo = "jp-zip-codes";
-    rev = "94071d5f73bcea043694d1e9a557f6e526b44096";
-    hash = "sha256-RyXJZOwZmtW9vP0lEctE3t1DItBFOop7vdTi0IAH8E8=";
+    rev = "45aa11f1f60515893b0eb8f533f540632b394564";
+    hash = "sha256-qcP1lc5E1RS+n7e3hmZwaHtnf9ErOYprW+/w0r65ZuI=";
   };
 
   installPhase = ''

pkgs/by-name/ju/justbuild/package.nix

@@ -33,13 +33,13 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "justbuild";
-  version = "1.4.1";
+  version = "1.4.2";
 
   src = fetchFromGitHub {
     owner = "just-buildsystem";
     repo = "justbuild";
     rev = "refs/tags/v${version}";
-    hash = "sha256-asbJdm50srMinr8sguGR3rWT7YXm75Zjm2Dvj53PpMc=";
+    hash = "sha256-oMl+hY7E4vYB4J/5LXq6sw9bafYwhXY8lkEWwU6j0Fk=";
   };
 
   bazelapi = fetchurl {

pkgs/by-name/k6/k6/package.nix

@@ -8,13 +8,13 @@
 
 buildGoModule rec {
   pname = "k6";
-  version = "0.55.2";
+  version = "0.56.0";
 
   src = fetchFromGitHub {
     owner = "grafana";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-BuZsz5+vp4obL/Gj/gJSgA0xxdYmqd+MKggS62Jo+bM=";
+    hash = "sha256-QU/FJZqyodwUGxb3MjaQXIGWZSlrkxKe4bh6r/p7jrQ=";
   };
 
   subPackages = [ "./" ];

pkgs/by-name/ke/keycloak/package.nix

@@ -24,11 +24,11 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "keycloak";
-  version = "26.0.7";
+  version = "26.0.8";
 
   src = fetchzip {
     url = "https://github.com/keycloak/keycloak/releases/download/${version}/keycloak-${version}.zip";
-    hash = "sha256-yIv9gAjCfzjWDLZHQbgGEjhMefY1idzZTEbqVyXjFdw=";
+    hash = "sha256-o4Yken4PlitebEBNI+BrQqYM+RtsURj0LvYFBSjuQIE=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/le/lean4/package.nix

@@ -13,18 +13,18 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "lean4";
-  version = "4.12.0";
+  version = "4.15.0";
 
   src = fetchFromGitHub {
     owner = "leanprover";
     repo = "lean4";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-O2Egyh2D0TfQWzQKfHUeAh7qAjMfeLVwXwGUw5QqcvE=";
+    hash = "sha256-Xzuk41voBP93vsl3u/bBii9Y6DMfvi6UazKiLLABgHA=";
   };
 
   postPatch = ''
     substituteInPlace src/CMakeLists.txt \
-      --replace 'set(GIT_SHA1 "")' 'set(GIT_SHA1 "${finalAttrs.src.rev}")'
+      --replace-fail 'set(GIT_SHA1 "")' 'set(GIT_SHA1 "${finalAttrs.src.rev}")'
 
     # Remove tests that fails in sandbox.
     # It expects `sourceRoot` to be a git repository.
@@ -37,12 +37,12 @@ stdenv.mkDerivation (finalAttrs: {
 
   nativeBuildInputs = [
     cmake
-    cadical
   ];
 
   buildInputs = [
     gmp
     libuv
+    cadical
   ];
 
   nativeCheckInputs = [

pkgs/by-name/lo/lockbook-desktop/package.nix

@@ -18,17 +18,17 @@ let
 in
 rustPlatform.buildRustPackage rec {
   pname = "lockbook-desktop";
-  version = "0.9.15";
+  version = "0.9.16";
 
   src = fetchFromGitHub {
     owner = "lockbook";
     repo = "lockbook";
     tag = version;
-    hash = "sha256-hqBjA/6MWlhVjV4m+cIcnoRTApHuzbPzivMsaQHfRcc=";
+    hash = "sha256-FHD84IJ2ahxB8L75xep+TSb8e+DtUsjEyHc6P/SFi9c=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-+M+wL26KDbLKhcujPyWAsTlXwLrQVCUbTnnu/7sXul4=";
+  cargoHash = "sha256-z00WBA/51zmqFCBX1hD3dLKvuvxQvuyvtBGrxxAr7FE=";
 
   nativeBuildInputs = [
     pkg-config

pkgs/by-name/lo/lockbook/package.nix

@@ -7,17 +7,17 @@
 }:
 rustPlatform.buildRustPackage rec {
   pname = "lockbook";
-  version = "0.9.15";
+  version = "0.9.16";
 
   src = fetchFromGitHub {
     owner = "lockbook";
     repo = "lockbook";
     tag = version;
-    hash = "sha256-hqBjA/6MWlhVjV4m+cIcnoRTApHuzbPzivMsaQHfRcc=";
+    hash = "sha256-FHD84IJ2ahxB8L75xep+TSb8e+DtUsjEyHc6P/SFi9c=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-+M+wL26KDbLKhcujPyWAsTlXwLrQVCUbTnnu/7sXul4=";
+  cargoHash = "sha256-z00WBA/51zmqFCBX1hD3dLKvuvxQvuyvtBGrxxAr7FE=";
 
   doCheck = false; # there are no cli tests
   cargoBuildFlags = [

pkgs/by-name/lo/losslesscut-bin/build-from-appimage.nix

@@ -9,8 +9,6 @@
 }:
 
 let
-  pname = "losslesscut";
-
   src = fetchurl {
     url = "https://github.com/mifi/lossless-cut/releases/download/v${version}/LosslessCut-linux-x86_64.AppImage";
     inherit hash;

pkgs/by-name/lo/losslesscut-bin/build-from-dmg.nix

@@ -10,17 +10,15 @@
   metaCommon ? { },
 }:
 
-let
-  pname = "losslesscut";
+stdenvNoCC.mkDerivation {
+  inherit pname version;
+
   src = fetchurl {
     url = "https://github.com/mifi/lossless-cut/releases/download/v${version}/LosslessCut-mac-${
       if isAarch64 then "arm64" else "x64"
     }.dmg";
     inherit hash;
   };
-in
-stdenvNoCC.mkDerivation {
-  inherit pname version src;
 
   nativeBuildInputs = [ _7zz ];
 

pkgs/by-name/lo/losslesscut-bin/package.nix

@@ -7,7 +7,7 @@
 
 let
   pname = "losslesscut";
-  version = "3.61.1";
+  version = "3.64.0";
   metaCommon = with lib; {
     description = "Swiss army knife of lossless video/audio editing";
     homepage = "https://mifi.no/losslesscut/";
@@ -18,22 +18,22 @@ let
   };
   x86_64-appimage = callPackage ./build-from-appimage.nix {
     inherit pname version metaCommon;
-    hash = "sha256-wKhEB+MfOsBvZRTIt3hLofw37+YO+hWKowlSi1OxSAU=";
+    hash = "sha256-K90cJuJFcIkPuAQusJcOBkZ5PQ8T25q7IFIhtmK+jzc=";
     inherit (buildPackages) makeWrapper;
   };
   x86_64-dmg = callPackage ./build-from-dmg.nix {
     inherit pname version metaCommon;
-    hash = "sha256-yZYmM533D9VzM+a0bnYz/aqocaEJVFOTgLWjbQGOQR0=";
+    hash = "sha256-BO2KoYAevbVL0Eix1knvaPVBkWucYI89VkueWYRTcXY=";
     isAarch64 = false;
   };
   aarch64-dmg = callPackage ./build-from-dmg.nix {
     inherit pname version metaCommon;
-    hash = "sha256-/qa2P0R7xRzDgnPKqkeKN6lrDbPg9WuZ/Nnc51NTzaM=";
+    hash = "sha256-/M5yafZQDqCoDzHpjZBC80CcL9KMO5lwvyCcq19caRg=";
     isAarch64 = true;
   };
   x86_64-windows = callPackage ./build-from-windows.nix {
     inherit pname version metaCommon;
-    hash = "sha256-0awYmSGxm8M12X0WQftlapRF9m3GGCZivNwBtRjSa4E=";
+    hash = "sha256-FYrnTiZ5ATT+Y08zceIIHbVM//5Bg2ozIEyC5UxmIno=";
   };
 in
 (

pkgs/by-name/lz/lzlib/package.nix

@@ -8,7 +8,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "lzlib";
-  version = "1.14";
+  version = "1.15";
   outputs = [
     "out"
     "info"
@@ -21,7 +21,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   src = fetchurl {
     url = "mirror://savannah/lzip/lzlib/lzlib-${finalAttrs.version}.tar.lz";
-    hash = "sha256-42LszNgtTdKX32pRuVLGXSFy+b9BpcRZDTYE2DqlGdM=";
+    hash = "sha256-nUVIDnyBccZPodW+7iy9guaf6+kQ8M5ii4dqj+IUFTQ=";
     # hash from release email
   };
 

pkgs/by-name/me/mercure/package.nix

@@ -9,18 +9,18 @@
 
 buildGoModule rec {
   pname = "mercure";
-  version = "0.17.1";
+  version = "0.18.1";
 
   src = fetchFromGitHub {
     owner = "dunglas";
     repo = "mercure";
     rev = "v${version}";
-    hash = "sha256-TRKlX4dNCvD9wBp+JNpmB9J1lt0Eyc0pQ/ucvtiDGto=";
+    hash = "sha256-BJVCVvz8AdkQwLD37oQc7YPaZ7l74o9Dik9u/ZBSRro=";
   };
 
   sourceRoot = "${src.name}/caddy";
 
-  vendorHash = "sha256-0tyvb11rBtrTbA+eAV1E5Y2tZeAwtrpONHBOLaVxuaQ=";
+  vendorHash = "sha256-QqG8rxGQW+Lmd2L+wKiKUV+GXcxoO04yhJhDvMqwTVc=";
 
   subPackages = [ "mercure" ];
   excludedPackages = [ "../cmd/mercure" ];

pkgs/by-name/mq/mqtt-exporter/package.nix

@@ -6,14 +6,14 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "mqtt-exporter";
-  version = "1.5.0";
+  version = "1.6.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "kpetremann";
     repo = "mqtt-exporter";
     tag = "v${version}";
-    hash = "sha256-3gUAiujfBXJpVailx8cMmSJS7l69XpE4UGK/aebcQqY=";
+    hash = "sha256-XTgnD3H48KKclPhfmBPiWQPaJkfiBxjq2YQusOPLFJQ=";
   };
 
   pythonRelaxDeps = [ "prometheus-client" ];

pkgs/by-name/mu/mujoco/mujoco-system-deps-dont-fetch.patch

@@ -1,17 +1,8 @@
 diff --git a/CMakeLists.txt b/CMakeLists.txt
-index eea180c0..efb39178 100644
+index aaac4e38..fe4e9932 100644
 --- a/CMakeLists.txt
 +++ b/CMakeLists.txt
-@@ -93,7 +93,7 @@ add_subdirectory(src/render)
- add_subdirectory(src/thread)
- add_subdirectory(src/ui)
- 
--target_compile_definitions(mujoco PRIVATE _GNU_SOURCE CCD_STATIC_DEFINE MUJOCO_DLL_EXPORTS -DMC_IMPLEM_ENABLE)
-+target_compile_definitions(mujoco PRIVATE _GNU_SOURCE MUJOCO_DLL_EXPORTS -DMC_IMPLEM_ENABLE)
- if(MUJOCO_ENABLE_AVX_INTRINSICS)
-   target_compile_definitions(mujoco PUBLIC mjUSEPLATFORMSIMD)
- endif()
-@@ -118,7 +118,7 @@ target_link_libraries(
+@@ -120,7 +120,7 @@ target_link_libraries(
            lodepng
            qhullstatic_r
            tinyobjloader
@@ -21,7 +12,7 @@ index eea180c0..efb39178 100644
  
  set_target_properties(
 diff --git a/cmake/MujocoDependencies.cmake b/cmake/MujocoDependencies.cmake
-index 44962272..656beeb8 100644
+index 23e4e71e..33081e00 100644
 --- a/cmake/MujocoDependencies.cmake
 +++ b/cmake/MujocoDependencies.cmake
 @@ -93,28 +93,36 @@ set(BUILD_SHARED_LIBS
@@ -75,7 +66,7 @@ index 44962272..656beeb8 100644
    )
  
    FetchContent_GetProperties(marchingcubecpp)
-@@ -124,119 +132,158 @@ if(NOT TARGET marchingcubecpp)
+@@ -124,119 +132,157 @@ if(NOT TARGET marchingcubecpp)
    endif()
  endif()
  
@@ -196,7 +187,6 @@ index 44962272..656beeb8 100644
  option(SDFLIB_USE_ASSIMP OFF)
  option(SDFLIB_USE_OPENMP OFF)
  option(SDFLIB_USE_ENOKI OFF)
-+
  findorfetch(
    USE_SYSTEM_PACKAGE
 -  OFF
@@ -285,7 +275,7 @@ index 44962272..656beeb8 100644
    set(ABSL_PROPAGATE_CXX_STD ON)
  
    # This specific version of Abseil does not have the following variable. We need to work with BUILD_TESTING
-@@ -249,15 +296,11 @@ if(MUJOCO_BUILD_TESTS)
+@@ -249,15 +295,11 @@ if(MUJOCO_BUILD_TESTS)
    set(ABSL_BUILD_TESTING OFF)
    findorfetch(
      USE_SYSTEM_PACKAGE
@@ -302,7 +292,7 @@ index 44962272..656beeb8 100644
      TARGETS
      absl::core_headers
      EXCLUDE_FROM_ALL
-@@ -268,6 +311,9 @@ if(MUJOCO_BUILD_TESTS)
+@@ -268,6 +310,9 @@ if(MUJOCO_BUILD_TESTS)
        CACHE BOOL "Build tests." FORCE
    )
  
@@ -312,7 +302,7 @@ index 44962272..656beeb8 100644
    # Avoid linking errors on Windows by dynamically linking to the C runtime.
    set(gtest_force_shared_crt
        ON
-@@ -276,22 +322,20 @@ if(MUJOCO_BUILD_TESTS)
+@@ -276,22 +321,20 @@ if(MUJOCO_BUILD_TESTS)
  
    findorfetch(
      USE_SYSTEM_PACKAGE
@@ -341,7 +331,7 @@ index 44962272..656beeb8 100644
    set(BENCHMARK_EXTRA_FETCH_ARGS "")
    if(WIN32 AND NOT MSVC)
      set(BENCHMARK_EXTRA_FETCH_ARGS
-@@ -310,15 +354,11 @@ if(MUJOCO_BUILD_TESTS)
+@@ -310,15 +353,11 @@ if(MUJOCO_BUILD_TESTS)
  
    findorfetch(
      USE_SYSTEM_PACKAGE
@@ -358,7 +348,7 @@ index 44962272..656beeb8 100644
      TARGETS
      benchmark::benchmark
      benchmark::benchmark_main
-@@ -328,15 +368,18 @@ if(MUJOCO_BUILD_TESTS)
+@@ -328,15 +367,18 @@ if(MUJOCO_BUILD_TESTS)
  endif()
  
  if(MUJOCO_TEST_PYTHON_UTIL)
@@ -382,7 +372,7 @@ index 44962272..656beeb8 100644
      )
  
      FetchContent_GetProperties(Eigen3)
-@@ -348,6 +391,19 @@ if(MUJOCO_TEST_PYTHON_UTIL)
+@@ -348,6 +390,19 @@ if(MUJOCO_TEST_PYTHON_UTIL)
        set_target_properties(
          Eigen3::Eigen PROPERTIES INTERFACE_INCLUDE_DIRECTORIES "${eigen3_SOURCE_DIR}"
        )
@@ -479,19 +469,10 @@ index 5141406c..75ff7884 100644
    glfw
    EXCLUDE_FROM_ALL
 diff --git a/test/CMakeLists.txt b/test/CMakeLists.txt
-index 122760a9..ddd90819 100644
+index 0f92803d..da9dce4c 100644
 --- a/test/CMakeLists.txt
 +++ b/test/CMakeLists.txt
-@@ -30,7 +30,7 @@ macro(mujoco_test name)
-   )
- 
-   add_executable(${name} ${name}.cc)
--  target_link_libraries(${name} gtest_main mujoco)
-+  target_link_libraries(${name} GTest::gtest_main mujoco)
-   target_include_directories(${name} PRIVATE ${MUJOCO_TEST_INCLUDE})
-   set_target_properties(${name} PROPERTIES BUILD_RPATH ${CMAKE_LIBRARY_OUTPUT_DIRECTORY})
-   # gtest_discover_tests is recommended over gtest_add_tests, but has some issues in Windows.
-@@ -60,20 +60,20 @@ target_link_libraries(
+@@ -81,8 +81,8 @@ target_link_libraries(
           absl::synchronization
           absl::flat_hash_map
           absl::flat_hash_set
@@ -502,18 +483,3 @@ index 122760a9..ddd90819 100644
           mujoco::mujoco
  )
  target_include_directories(fixture PRIVATE ${mujoco_SOURCE_DIR}/include gmock)
- 
- mujoco_test(fixture_test)
--target_link_libraries(fixture_test fixture gmock)
-+target_link_libraries(fixture_test fixture GTest::gmock)
- 
- mujoco_test(header_test)
--target_link_libraries(header_test fixture gmock)
-+target_link_libraries(fixture_test fixture GTest::gmock)
- 
- mujoco_test(pipeline_test)
--target_link_libraries(pipeline_test fixture gmock)
-+target_link_libraries(fixture_test fixture GTest::gmock)
- 
- add_subdirectory(benchmark)
- add_subdirectory(engine)

pkgs/by-name/mu/mujoco/package.nix

@@ -1,13 +1,14 @@
 {
-  cereal_1_3_2,
-  cmake,
+  lib,
+  stdenv,
   fetchFromGitHub,
+  cmake,
   fetchFromGitLab,
   glfw,
   glm,
-  lib,
   spdlog,
-  stdenv,
+  cereal_1_3_2,
+  python3Packages,
 }:
 
 let
@@ -35,8 +36,8 @@ let
     eigen3 = fetchFromGitLab {
       owner = "libeigen";
       repo = "eigen";
-      rev = "d34b100c137ac931379ae5e1b888f16a9c8d6c72";
-      hash = "sha256-GYjENtobSWCJqRw2GJbxAJDZSdyBNqWkobn2Vm5H53Q=";
+      rev = "7f2377859377da6f22152015c28b12c04752af77";
+      hash = "sha256-SmyvY/WlU9jryD9ZpSw73dQEc9jI4ySQPRnplg/BC4w=";
     };
     googletest = fetchFromGitHub {
       owner = "google";
@@ -131,7 +132,7 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "mujoco";
-  version = "3.2.6";
+  version = "3.2.7";
 
   # Bumping version? Make sure to look though the MuJoCo's commit
   # history for bumped dependency pins!
@@ -139,7 +140,7 @@ stdenv.mkDerivation rec {
     owner = "google-deepmind";
     repo = "mujoco";
     tag = version;
-    hash = "sha256-n1H9e+GMqHYsimypF7AiVzHC2dXkL+4FWDEHB5B2ZIE=";
+    hash = "sha256-TAhgu3h7tCflIMscVS+jYuUfMmIYcCcI3JFxUlj8g9E=";
   };
 
   patches = [ ./mujoco-system-deps-dont-fetch.patch ];
@@ -177,8 +178,13 @@ stdenv.mkDerivation rec {
     ln -s ${pin.marchingcubecpp} build/_deps/marchingcubecpp-src
   '';
 
-  passthru.pin = {
-    inherit (pin) lodepng eigen3 abseil-cpp;
+  passthru = {
+    pin = {
+      inherit (pin) lodepng eigen3 abseil-cpp;
+    };
+    tests = {
+      pythonMujoco = python3Packages.mujoco;
+    };
   };
 
   meta = {

pkgs/by-name/my/mysql-workbench/dont-search-for-antlr-jar.patch

@@ -1,5 +1,5 @@
 diff --git a/CMakeLists.txt b/CMakeLists.txt
-index b7320bb..d7169da 100644
+index 3dd3e19..4290041 100644
 --- a/CMakeLists.txt
 +++ b/CMakeLists.txt
 @@ -143,25 +143,6 @@ check_function_exists (strtoull HAVE_STRTOULL)

pkgs/by-name/my/mysql-workbench/hardcode-paths.patch

@@ -84,7 +84,7 @@ index 40ed515..00da327 100644
      if to_spawn:
          command += ' &'
 -        sudo_prefix += ' /usr/bin/nohup'
-+        sudo_prefix += ' @nohup@'
++        sudo_prefix += ' @coreutils@/bin/nohup'
        
      # If as_user is the CURRENT then there's no need to sudo
      if as_user != Users.CURRENT:
@@ -102,10 +102,10 @@ index 40ed515..00da327 100644
      def get_file_owner(self, path, as_user = Users.CURRENT, user_password = None):
          if self.target_os == wbaOS.linux:
 -          command = 'LC_ALL=C stat -c %U '
-+          command = 'LC_ALL=C @stat@ -c %U '
++          command = 'LC_ALL=C @coreutils@/bin/stat -c %U '
          else:
 -          command = 'LC_ALL=C /usr/bin/stat -f "%Su" '
-+          command = 'LC_ALL=C @stat@ -f "%Su" '
++          command = 'LC_ALL=C @coreutils@/bin/stat -f "%Su" '
        
          output = io.StringIO()
          command = command + quote_path(path)
@@ -114,10 +114,10 @@ index 40ed515..00da327 100644
                  raise PermissionDeniedError("Cannot set owner of directory %s" % path)        
              else:
 -                command = "/bin/mkdir %s && chown %s %s" % (quote_path(path), with_owner, quote_path(path))
-+                command = "@mkdir@ %s && chown %s %s" % (quote_path(path), with_owner, quote_path(path))
++                command = "@coreutils@/bin/mkdir %s && chown %s %s" % (quote_path(path), with_owner, quote_path(path))
          else:
 -            command = "/bin/mkdir %s" % (quote_path(path))
-+            command = "@mkdir@ %s" % (quote_path(path))
++            command = "@coreutils@/bin/mkdir %s" % (quote_path(path))
              
          res = self.process_ops.exec_cmd(command,
                                          as_user   = as_user,
@@ -126,7 +126,7 @@ index 40ed515..00da327 100644
      def remove_directory(self, path, as_user = Users.CURRENT, user_password = None):
          output = io.StringIO()
 -        res = self.process_ops.exec_cmd('/bin/rmdir ' + quote_path(path),
-+        res = self.process_ops.exec_cmd('@rmdir@ ' + quote_path(path),
++        res = self.process_ops.exec_cmd('@coreutils@/bin/rmdir ' + quote_path(path),
                                          as_user   = as_user,
                                          user_password = user_password,
                                          output_handler = output.write,
@@ -135,7 +135,7 @@ index 40ed515..00da327 100644
      def remove_directory_recursive(self, path, as_user = Users.CURRENT, user_password = None):
          output = io.StringIO()
 -        res = self.process_ops.exec_cmd('/bin/rm -R ' + quote_path(path),
-+        res = self.process_ops.exec_cmd('@rm@ -R ' + quote_path(path),
++        res = self.process_ops.exec_cmd('@coreutils@/bin/rm -R ' + quote_path(path),
                                          as_user   = as_user,
                                          user_password = user_password,
                                          output_handler = output.write,
@@ -144,7 +144,7 @@ index 40ed515..00da327 100644
      def delete_file(self, path, as_user = Users.CURRENT, user_password = None):
          output = io.StringIO()
 -        res = self.process_ops.exec_cmd("/bin/rm " + quote_path(path),
-+        res = self.process_ops.exec_cmd("@rm@ " + quote_path(path),
++        res = self.process_ops.exec_cmd("@coreutils@/bin/rm " + quote_path(path),
                                          as_user   = as_user,
                                          user_password = user_password,
                                          output_handler = output.write,
@@ -153,7 +153,7 @@ index 40ed515..00da327 100644
          output = io.StringIO()
          
 -        res = self.process_ops.exec_cmd("LC_ALL=C /bin/cp " + quote_path(source) + " " + quote_path(dest),
-+        res = self.process_ops.exec_cmd("LC_ALL=C @cp@ " + quote_path(source) + " " + quote_path(dest),
++        res = self.process_ops.exec_cmd("LC_ALL=C @coreutils@/bin/cp " + quote_path(source) + " " + quote_path(dest),
                        as_user   = as_user,
                        user_password = user_password,
                        output_handler = output.write,
@@ -162,10 +162,10 @@ index 40ed515..00da327 100644
              # since both cases are possible, we need to handle both at the same time (1st line being total <nnnn> or not)
              # the good news is that if the line is there, then it will always start with total, regardless of the locale
 -            command = 'LC_ALL=C /bin/ls -l -p %s' % quote_path(path)
-+            command = 'LC_ALL=C @ls@ -l -p %s' % quote_path(path)
++            command = 'LC_ALL=C @coreutils@/bin/ls -l -p %s' % quote_path(path)
          else:
 -            command = 'LC_ALL=C /bin/ls -1 -p %s' % quote_path(path)
-+            command = 'LC_ALL=C @ls@ -1 -p %s' % quote_path(path)
++            command = 'LC_ALL=C @coreutils@/bin/ls -1 -p %s' % quote_path(path)
              
          output = io.StringIO()
          res = self.process_ops.exec_cmd(command,
@@ -174,10 +174,10 @@ index 40ed515..00da327 100644
          f = io.StringIO()
          if not self._need_sudo:
 -            ret = self.server_helper.execute_command("/bin/dd if=%s ibs=1 skip=%i count=%i 2> /dev/null" % (quote_path(self.path), start, end-start), as_user = Users.CURRENT, user_password=None, output_handler=f.write)
-+            ret = self.server_helper.execute_command("@dd@ if=%s ibs=1 skip=%i count=%i 2> /dev/null" % (quote_path(self.path), start, end-start), as_user = Users.CURRENT, user_password=None, output_handler=f.write)
++            ret = self.server_helper.execute_command("@coreutils@/bin/dd if=%s ibs=1 skip=%i count=%i 2> /dev/null" % (quote_path(self.path), start, end-start), as_user = Users.CURRENT, user_password=None, output_handler=f.write)
          else:
 -            ret = self.server_helper.execute_command("/bin/dd if=%s ibs=1 skip=%i count=%i 2> /dev/null" % (quote_path(self.path), start, end-start), as_user = Users.ADMIN, user_password=self.get_password, output_handler=f.write)
-+            ret = self.server_helper.execute_command("@dd@ if=%s ibs=1 skip=%i count=%i 2> /dev/null" % (quote_path(self.path), start, end-start), as_user = Users.ADMIN, user_password=self.get_password, output_handler=f.write)
++            ret = self.server_helper.execute_command("@coreutils@/bin/dd if=%s ibs=1 skip=%i count=%i 2> /dev/null" % (quote_path(self.path), start, end-start), as_user = Users.ADMIN, user_password=self.get_password, output_handler=f.write)
  
          if ret != 0:
              raise RuntimeError("Could not get data from file %s" % self.path)
@@ -186,10 +186,10 @@ index 40ed515..00da327 100644
      def read_task(self, offset, file):
          if not self._need_sudo:
 -            self.server_helper.execute_command("/bin/dd if=%s ibs=1 skip=%i 2> /dev/null" % (quote_path(self.path), offset), as_user = Users.CURRENT, user_password=None, output_handler=file.write)
-+            self.server_helper.execute_command("@dd@ if=%s ibs=1 skip=%i 2> /dev/null" % (quote_path(self.path), offset), as_user = Users.CURRENT, user_password=None, output_handler=file.write)
++            self.server_helper.execute_command("@coreutils@/bin/dd if=%s ibs=1 skip=%i 2> /dev/null" % (quote_path(self.path), offset), as_user = Users.CURRENT, user_password=None, output_handler=file.write)
          else:
 -            self.server_helper.execute_command("/bin/dd if=%s ibs=1 skip=%i 2> /dev/null" % (quote_path(self.path), offset), as_user = Users.ADMIN, user_password=self.get_password, output_handler=file.write)
-+            self.server_helper.execute_command("@dd@ if=%s ibs=1 skip=%i 2> /dev/null" % (quote_path(self.path), offset), as_user = Users.ADMIN, user_password=self.get_password, output_handler=file.write)
++            self.server_helper.execute_command("@coreutils@/bin/dd if=%s ibs=1 skip=%i 2> /dev/null" % (quote_path(self.path), offset), as_user = Users.ADMIN, user_password=self.get_password, output_handler=file.write)
          # this will signal the reader end that there's no more data
          file.close()
  
@@ -198,10 +198,10 @@ index 40ed515..00da327 100644
          f = io.StringIO()
          if not self._need_sudo:
 -            self.server_helper.execute_command("/bin/dd if=%s ibs=1 skip=%i 2> /dev/null" % (quote_path(self.path), offset), as_user = Users.CURRENT, user_password=None, output_handler=f.write)
-+            self.server_helper.execute_command("@dd@ if=%s ibs=1 skip=%i 2> /dev/null" % (quote_path(self.path), offset), as_user = Users.CURRENT, user_password=None, output_handler=f.write)
++            self.server_helper.execute_command("@coreutils@/bin/dd if=%s ibs=1 skip=%i 2> /dev/null" % (quote_path(self.path), offset), as_user = Users.CURRENT, user_password=None, output_handler=f.write)
          else:
 -            self.server_helper.execute_command("/bin/dd if=%s ibs=1 skip=%i 2> /dev/null" % (quote_path(self.path), offset), as_user = Users.ADMIN, user_password=self._password, output_handler=f.write)
-+            self.server_helper.execute_command("@dd@ if=%s ibs=1 skip=%i 2> /dev/null" % (quote_path(self.path), offset), as_user = Users.ADMIN, user_password=self._password, output_handler=f.write)
++            self.server_helper.execute_command("@coreutils@/bin/dd if=%s ibs=1 skip=%i 2> /dev/null" % (quote_path(self.path), offset), as_user = Users.ADMIN, user_password=self._password, output_handler=f.write)
          self.data = f
          self.data.seek(0)
          if self.skip_first_newline:

pkgs/by-name/my/mysql-workbench/package.nix

@@ -46,8 +46,6 @@ let
     };
   });
 
-  getCoreExe = lib.getExe' coreutils;
-
   inherit (python3Packages) paramiko pycairo pyodbc;
 in
 stdenv.mkDerivation (finalAttrs: {
@@ -63,14 +61,7 @@ stdenv.mkDerivation (finalAttrs: {
     (replaceVars ./hardcode-paths.patch {
       bash = lib.getExe bash;
       catchsegv = lib.getExe' glibc "catchsegv";
-      cp = getCoreExe "cp";
-      dd = getCoreExe "dd";
-      ls = getCoreExe "ls";
-      mkdir = getCoreExe "mkdir";
-      nohup = getCoreExe "nohup";
-      rm = getCoreExe "rm";
-      rmdir = getCoreExe "rmdir";
-      stat = getCoreExe "stat";
+      coreutils = lib.getBin coreutils;
       sudo = lib.getExe sudo;
     })
 

pkgs/by-name/n8/n8n/package.nix

@@ -16,18 +16,18 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "n8n";
-  version = "1.72.1";
+  version = "1.73.1";
 
   src = fetchFromGitHub {
     owner = "n8n-io";
     repo = "n8n";
     tag = "n8n@${finalAttrs.version}";
-    hash = "sha256-GIA2y81nuKWe1zuZQ99oczQtQWStyT1Qh3bZ1oe8me4=";
+    hash = "sha256-gPdJKVOZlizdS0o+2nBgCImnIhtHzRjE2xk0zJA52go=";
   };
 
   pnpmDeps = pnpm.fetchDeps {
     inherit (finalAttrs) pname version src;
-    hash = "sha256-riuN7o+uUXS5G7fMgE7cZhGWHZtGwSHm4CP7G46R5Cw=";
+    hash = "sha256-Am9R2rfQiw1IPd22/UraqzEqvVeB5XuSrrLSYXWsWfU=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/ne/netlify-cli/package.nix

@@ -11,16 +11,16 @@
 
 buildNpmPackage rec {
   pname = "netlify-cli";
-  version = "17.38.0";
+  version = "18.0.0";
 
   src = fetchFromGitHub {
     owner = "netlify";
     repo = "cli";
     tag = "v${version}";
-    hash = "sha256-fK+Z6bqnaqSYXgO0lUbGALZeCiAnvMd6LkMSH7JB7J8=";
+    hash = "sha256-LGnFVg7c+CMgjxkVdy/rdoo6uU5HaOwGKRDHRe5Hz3Y=";
   };
 
-  npmDepsHash = "sha256-oFt+l8CigOtm3W5kiT0kFsqKLOJB9ggfiFQgUU5xQ1I=";
+  npmDepsHash = "sha256-ONLkCbmmY45/sRwaGUWhA187YVtCcdPVnD7ZMFoQ2Y0=";
 
   inherit nodejs;
 

pkgs/by-name/ni/nixos-facter/package.nix

@@ -24,16 +24,16 @@ let
 in
 buildGoModule rec {
   pname = "nixos-facter";
-  version = "0.3.0";
+  version = "0.3.1";
 
   src = fetchFromGitHub {
     owner = "numtide";
     repo = "nixos-facter";
     rev = "v${version}";
-    hash = "sha256-T7x9xU/Tr2BKfrHQHrP6Mm6rNUWYASjEPzHIKgyS7aE=";
+    hash = "sha256-HJt6FEQbzwlVMow47p1DtqXdmCxLYA6g3D1EgGnKcUo=";
   };
 
-  vendorHash = "sha256-qDzd+aq08PN9kl1YkvNLGvWaFVh7xFXJhGdx/ELwYGY=";
+  vendorHash = "sha256-WCItbRbGgclXGtJyHCkDgaPe3Mobe4mT/4c16AEdF5o=";
 
   env.CGO_ENABLED = 1;
 

pkgs/by-name/ni/nixos-render-docs/src/nixos_render_docs/options.py

@@ -21,7 +21,7 @@ from .html import HTMLRenderer
 from .manpage import ManpageRenderer, man_escape
 from .manual_structure import make_xml_id, XrefTarget
 from .md import Converter, md_escape, md_make_code
-from .types import OptionLoc, Option, RenderedOption
+from .types import OptionLoc, Option, RenderedOption, AnchorStyle
 
 def option_is(option: Option, key: str, typ: str) -> Optional[dict[str, str]]:
     if key not in option:
@@ -317,10 +317,15 @@ class OptionsCommonMarkRenderer(OptionDocsRestrictions, CommonMarkRenderer):
 
 class CommonMarkConverter(BaseConverter[OptionsCommonMarkRenderer]):
     __option_block_separator__ = ""
+    _anchor_style: AnchorStyle
+    _anchor_prefix: str
 
-    def __init__(self, manpage_urls: Mapping[str, str], revision: str):
+
+    def __init__(self, manpage_urls: Mapping[str, str], revision: str, anchor_style: AnchorStyle = AnchorStyle.NONE, anchor_prefix: str = ""):
         super().__init__(revision)
         self._renderer = OptionsCommonMarkRenderer(manpage_urls)
+        self._anchor_style = anchor_style
+        self._anchor_prefix = anchor_prefix
 
     def _parallel_render_prepare(self) -> Any:
         return (self._renderer._manpage_urls, self._revision)
@@ -342,11 +347,21 @@ class CommonMarkConverter(BaseConverter[OptionsCommonMarkRenderer]):
     def _decl_def_footer(self) -> list[str]:
         return []
 
+    def _make_anchor_suffix(self, loc: list[str]) -> str:
+        if self._anchor_style == AnchorStyle.NONE:
+            return ""
+        elif self._anchor_style == AnchorStyle.LEGACY:
+            sanitized = ".".join(map(make_xml_id, loc))
+            return f" {{#{self._anchor_prefix}{sanitized}}}"
+        else:
+            raise RuntimeError("unhandled anchor style", self._anchor_style)
+
     def finalize(self) -> str:
         result = []
 
         for (name, opt) in self._sorted_options():
-            result.append(f"## {md_escape(name)}\n")
+            anchor_suffix = self._make_anchor_suffix(opt.loc)
+            result.append(f"## {md_escape(name)}{anchor_suffix}\n")
             result += opt.lines
             result.append("\n\n")
 
@@ -490,9 +505,30 @@ def _build_cli_manpage(p: argparse.ArgumentParser) -> None:
     p.add_argument("infile")
     p.add_argument("outfile")
 
+def parse_anchor_style(value: str|AnchorStyle) -> AnchorStyle:
+    if isinstance(value, AnchorStyle):
+        # Used by `argparse.add_argument`'s `default`
+        return value
+    try:
+        return AnchorStyle(value.lower())
+    except ValueError:
+        raise argparse.ArgumentTypeError(f"Invalid value {value}\nExpected one of {', '.join(style.value for style in AnchorStyle)}")
+
 def _build_cli_commonmark(p: argparse.ArgumentParser) -> None:
     p.add_argument('--manpage-urls', required=True)
     p.add_argument('--revision', required=True)
+    p.add_argument(
+        '--anchor-style',
+        required=False,
+        default=AnchorStyle.NONE.value,
+        choices = [style.value for style in AnchorStyle],
+        help = "(default: %(default)s) Anchor style to use for links to options. \nOnly none is standard CommonMark."
+    )
+    p.add_argument('--anchor-prefix',
+        required=False,
+        default="",
+        help="(default: no prefix) String to prepend to anchor ids. Not used when anchor style is none."
+    )
     p.add_argument("infile")
     p.add_argument("outfile")
 
@@ -527,7 +563,10 @@ def _run_cli_manpage(args: argparse.Namespace) -> None:
 
 def _run_cli_commonmark(args: argparse.Namespace) -> None:
     with open(args.manpage_urls, 'r') as manpage_urls:
-        md = CommonMarkConverter(json.load(manpage_urls), revision = args.revision)
+        md = CommonMarkConverter(json.load(manpage_urls),
+            revision = args.revision,
+            anchor_style = parse_anchor_style(args.anchor_style),
+            anchor_prefix = args.anchor_prefix)
 
         with open(args.infile, 'r') as f:
             md.add_options(json.load(f))

pkgs/by-name/ni/nixos-render-docs/src/nixos_render_docs/types.py

@@ -1,4 +1,5 @@
 from collections.abc import Sequence
+from enum import Enum
 from typing import Callable, Optional, NamedTuple
 
 from markdown_it.token import Token
@@ -12,3 +13,7 @@ class RenderedOption(NamedTuple):
     links: Optional[list[str]] = None
 
 RenderFn = Callable[[Token, Sequence[Token], int], str]
+
+class AnchorStyle(Enum):
+    NONE = "none"
+    LEGACY = "legacy"

pkgs/by-name/ni/nixos-render-docs/src/tests/sample_options_simple.json

@@ -0,0 +1,17 @@
+{
+  "services.frobnicator.types.<name>.enable": {
+    "declarations": [
+      "nixos/modules/services/frobnicator.nix"
+    ],
+    "description": "Whether to enable the frobnication of this (`<name>`) type.",
+    "loc": [
+      "services",
+      "frobnicator",
+      "types",
+      "<name>",
+      "enable"
+    ],
+    "readOnly": false,
+    "type": "boolean"
+  }
+}

pkgs/by-name/ni/nixos-render-docs/src/tests/sample_options_simple_default.md

@@ -0,0 +1,13 @@
+## services\.frobnicator\.types\.\<name>\.enable
+
+Whether to enable the frobnication of this (` <name> `) type\.
+
+
+
+*Type:*
+boolean
+
+*Declared by:*
+ - [\<nixpkgs/nixos/modules/services/frobnicator\.nix>](https://github.com/NixOS/nixpkgs/blob/master/nixos/modules/services/frobnicator.nix)
+
+

pkgs/by-name/ni/nixos-render-docs/src/tests/sample_options_simple_legacy.md

@@ -0,0 +1,13 @@
+## services\.frobnicator\.types\.\<name>\.enable {#opt-services.frobnicator.types._name_.enable}
+
+Whether to enable the frobnication of this (` <name> `) type\.
+
+
+
+*Type:*
+boolean
+
+*Declared by:*
+ - [\<nixpkgs/nixos/modules/services/frobnicator\.nix>](https://github.com/NixOS/nixpkgs/blob/master/nixos/modules/services/frobnicator.nix)
+
+

pkgs/by-name/ni/nixos-render-docs/src/tests/test_options.py

@@ -1,6 +1,9 @@
 import nixos_render_docs
+from nixos_render_docs.options import AnchorStyle
 
+import json
 from markdown_it.token import Token
+from pathlib import Path
 import pytest
 
 def test_option_headings() -> None:
@@ -12,3 +15,27 @@ def test_option_headings() -> None:
         type='heading_open', tag='h1', nesting=1, attrs={}, map=[0, 1], level=0, children=None,
         content='', markup='#', info='', meta={}, block=True, hidden=False
     )
+
+def test_options_commonmark() -> None:
+    c = nixos_render_docs.options.CommonMarkConverter({}, 'local')
+    with Path('tests/sample_options_simple.json').open() as f:
+        opts = json.load(f)
+    assert opts is not None
+    with Path('tests/sample_options_simple_default.md').open() as f:
+        expected = f.read()
+
+    c.add_options(opts)
+    s = c.finalize()
+    assert s == expected
+
+def test_options_commonmark_legacy_anchors() -> None:
+    c = nixos_render_docs.options.CommonMarkConverter({}, 'local', anchor_style = AnchorStyle.LEGACY, anchor_prefix = 'opt-')
+    with Path('tests/sample_options_simple.json').open() as f:
+        opts = json.load(f)
+    assert opts is not None
+    with Path('tests/sample_options_simple_legacy.md').open() as f:
+        expected = f.read()
+
+    c.add_options(opts)
+    s = c.finalize()
+    assert s == expected

pkgs/by-name/nw/nwjs-ffmpeg-prebuilt/package.nix

@@ -7,7 +7,7 @@
 
 let
   bits = if stdenv.hostPlatform.is64bit then "x64" else "ia32";
-  version = "0.94.0";
+  version = "0.94.1";
 in
 stdenv.mkDerivation {
   pname = "nwjs-ffmpeg-prebuilt";
@@ -16,8 +16,8 @@ stdenv.mkDerivation {
   src =
     let
       hashes = {
-        "x64" = "sha256-lepsr2/sCEUrq+an/z2g4Auj7MZcDT5I9PAKlFIbkpQ=";
-        "ia32" = "sha256-lepsr2/sCEUrq+an/z2g4Auj7MZcDT5I9PAKlFIbkpQ=";
+        "x64" = "sha256-FlhYfEUmmB4kgy2QT3e3cniNY/8eBYD4p2c23oTnEJU=";
+        "ia32" = "sha256-FlhYfEUmmB4kgy2QT3e3cniNY/8eBYD4p2c23oTnEJU=";
       };
     in
     fetchurl {

pkgs/by-name/op/opencomposite/package.nix

@@ -26,13 +26,15 @@ stdenv.mkDerivation {
     hash = "sha256-SV8E+4qu5J7MueHmdsdTDKNx4CH085fidgIJyewj8RQ=";
   };
 
-  nativeBuildInputs = [ cmake ];
+  nativeBuildInputs = [
+    cmake
+    python3
+  ];
 
   buildInputs = [
     glm
     jsoncpp
     libGL
-    python3
     vulkan-headers
     vulkan-loader
     xorg.libX11

pkgs/by-name/op/opensnitch-ui/package.nix

@@ -34,6 +34,7 @@ python311Packages.buildPythonApplication rec {
   propagatedBuildInputs = with python311Packages; [
     grpcio-tools
     notify2
+    packaging
     pyasn
     pyinotify
     pyqt5

pkgs/by-name/p2/p2pool/package.nix

@@ -20,13 +20,13 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "p2pool";
-  version = "4.2";
+  version = "4.3";
 
   src = fetchFromGitHub {
     owner = "SChernykh";
     repo = "p2pool";
     rev = "v${version}";
-    hash = "sha256-zowRQeFrT0sY9L5XJQ10f8tRnEchjKVdBixtPbAQyvo=";
+    hash = "sha256-PHrmTkmpYOPKx9q+/mhjr8MIbFqmljKs2F26tqyCzcE=";
     fetchSubmodules = true;
   };
 

pkgs/by-name/pa/pam_u2f/package.nix

@@ -10,11 +10,11 @@
 
 stdenv.mkDerivation rec {
   pname = "pam_u2f";
-  version = "1.3.0";
+  version = "1.3.1";
 
   src = fetchurl {
     url = "https://developers.yubico.com/pam-u2f/Releases/${pname}-${version}.tar.gz";
-    sha256 = "sha256-cjYMaHVIXrTfQJ2o+PUrF4k/BeTZmFKcI4gUSA4RUiA=";
+    hash = "sha256-mhNUmUf4RPazq2kdca+09vAKRdFl/tJ7AcZsB3UKk4c=";
   };
 
   nativeBuildInputs = [ pkg-config ];

pkgs/by-name/pi/pigz/package.nix

@@ -40,6 +40,7 @@ stdenv.mkDerivation rec {
   meta = with lib; {
     homepage = "https://www.zlib.net/pigz/";
     description = "Parallel implementation of gzip for multi-core machines";
+    mainProgram = "pigz";
     maintainers = [ ];
     license = licenses.zlib;
     platforms = platforms.unix;

pkgs/by-name/po/poptracker/package.nix

@@ -12,20 +12,23 @@
   makeWrapper,
   makeDesktopItem,
   copyDesktopItems,
+  nix-update-script,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "poptracker";
-  version = "0.27.0";
+  version = "0.29.0";
 
   src = fetchFromGitHub {
     owner = "black-sliver";
     repo = "PopTracker";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-Tz3rVbaHw5RfFKuLih4BEEnn3uNeLrtDQpBD2yYUzkM=";
+    hash = "sha256-rkEaq8YLt0NhspXVgEqZ/9FF7GDlTU5fKgWGXeA6UX4=";
     fetchSubmodules = true;
   };
 
+  passthru.updateScript = nix-update-script { };
+
   patches = [ ./assets-path.diff ];
 
   postPatch = ''

pkgs/by-name/pr/prowler/package.nix

@@ -6,14 +6,14 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "prowler";
-  version = "5.0.5";
+  version = "5.1.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "prowler-cloud";
     repo = "prowler";
     tag = version;
-    hash = "sha256-rjx0s+qUnpGQoUlvsEqwlJWZbC8Gb72s9MF0lRvJKZU=";
+    hash = "sha256-+wMoHzys4iceiQvRvwsl2aSvTYZxeZlKHy7D4xx33aU=";
   };
 
   pythonRelaxDeps = true;

pkgs/by-name/re/readarr/package.nix

@@ -24,15 +24,15 @@ let
     ."${stdenv.hostPlatform.system}" or (throw "Unsupported system: ${stdenv.hostPlatform.system}");
   hash =
     {
-      x64-linux_hash = "sha256-ijBsMc/37cpw1WJ36vIUm1d0wzHjpTsBX9mZRkL91BU=";
-      arm64-linux_hash = "sha256-oTA1O6M/P7kGI/YCoWzTw6kvmMg+QGhpn/jWrOc4rug=";
-      x64-osx_hash = "sha256-ZAZ0Y5O64llljc/NjnOHynEP7wXB/U4J5T1n5Pe+2A4=";
+      x64-linux_hash = "sha256-dYYvrsYR+xsS9N/btJPCaCg4mS2UVgZs5FaBbWU4ytM=";
+      arm64-linux_hash = "sha256-Vfdq6Mngr3Cbq844Upq84k6gH0SnbpdPK0dU7LBnJO8=";
+      x64-osx_hash = "sha256-7mtnnbEQ+70qY5iSfX7pDUYPqKQG2JdzGRFgm1CEhs4=";
     }
     ."${arch}-${os}_hash";
 in
 stdenv.mkDerivation rec {
   pname = "readarr";
-  version = "0.4.6.2711";
+  version = "0.4.8.2726";
 
   src = fetchurl {
     url = "https://github.com/Readarr/Readarr/releases/download/v${version}/Readarr.develop.${version}.${os}-core-${arch}.tar.gz";

pkgs/by-name/re/recordbox/package.nix

@@ -24,14 +24,14 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "recordbox";
-  version = "0.8.3";
+  version = "0.9.0";
 
   src = fetchFromGitea {
     domain = "codeberg.org";
     owner = "edestcroix";
     repo = "Recordbox";
     rev = "refs/tags/v${finalAttrs.version}";
-    hash = "sha256-/yg/75LswCj3HhsUhMXgIDpx2tlNkdTuImkqMwU6uio=";
+    hash = "sha256-KfIlh9ORqjJ5V8mNOx7Q9jsYg4OJDX6q+ht+eckxMRU=";
   };
 
   # Patch in our Cargo.lock and ensure AppStream tests don't use the network

pkgs/by-name/sa/saga/package.nix

@@ -34,11 +34,11 @@
 
 stdenv.mkDerivation rec {
   pname = "saga";
-  version = "9.7.0";
+  version = "9.7.1";
 
   src = fetchurl {
     url = "mirror://sourceforge/saga-gis/saga-${version}.tar.gz";
-    hash = "sha256-wUj0TvZoL/9miCwVk3eYilYXqczkbgsStCrbKAoeuxw=";
+    hash = "sha256-ZPJ8OlVEqG/jmRaA7BJRsw3b1X/3tKtRcYTXqfGdJ0I=";
   };
 
   sourceRoot = "saga-${version}/saga-gis";

pkgs/by-name/se/seafile-server/package.nix

@@ -2,6 +2,7 @@
   stdenv,
   lib,
   fetchFromGitHub,
+  fetchpatch,
   pkg-config,
   python3,
   autoreconfHook,
@@ -69,6 +70,14 @@ stdenv.mkDerivation {
     oniguruma
   ];
 
+  patches = [
+    # https://github.com/haiwen/seafile-server/pull/658
+    (fetchpatch {
+      url = "https://github.com/haiwen/seafile-server/commit/8029a11a731bfe142af43f230f47b93811ebaaaa.patch";
+      hash = "sha256-AWNDXIyrKXgqgq3p0m8+s3YH8dKxWnf7uEMYzSsjmX4=";
+    })
+  ];
+
   postInstall = ''
     mkdir -p $out/share/seafile/sql
     cp -r scripts/sql $out/share/seafile

pkgs/by-name/si/simdutf/package.nix

@@ -8,13 +8,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "simdutf";
-  version = "5.7.2";
+  version = "6.0.3";
 
   src = fetchFromGitHub {
     owner = "simdutf";
     repo = "simdutf";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-rSEl5g9FZiOrYRoHkBAUbMWE1kZvl3pbhkskzoMbIb0=";
+    hash = "sha256-BTnj7SUKgbJ2LM2gzw+8bSJ4+Zd6Z/KZy9B46fxIvsg=";
   };
 
   # Fix build on darwin

pkgs/by-name/so/sops/package.nix

@@ -8,16 +8,16 @@
 
 buildGo122Module rec {
   pname = "sops";
-  version = "3.9.2";
+  version = "3.9.3";
 
   src = fetchFromGitHub {
     owner = "getsops";
     repo = pname;
     tag = "v${version}";
-    hash = "sha256-v35LRFYdnWigWYlDhrOgSOcCI7SUqJbJHaZvlQ6PC4I=";
+    hash = "sha256-U8ZJktOSj0JJ70CbXDS3FpNmk07cKnco5w2rt4BnQBU=";
   };
 
-  vendorHash = "sha256-dnhrZPXZWeU98+dEaFLIdtcLWgIrh47l+WAxe+F+0/I=";
+  vendorHash = "sha256-+UxngJgKG+gAjnXXEcdXPXQqRcMfRDn4wPeR1IhltC0=";
 
   postPatch = ''
     substituteInPlace go.mod \

pkgs/by-name/sp/spatialite-gui/package.nix

@@ -23,9 +23,6 @@
   wxGTK,
   xz,
   zstd,
-  Carbon,
-  Cocoa,
-  IOKit,
 }:
 
 stdenv.mkDerivation rec {
@@ -41,33 +38,27 @@ stdenv.mkDerivation rec {
     pkg-config
   ] ++ lib.optional stdenv.hostPlatform.isDarwin desktopToDarwinBundle;
 
-  buildInputs =
-    [
-      curl
-      freexl
-      geos
-      librasterlite2
-      librttopo
-      libspatialite
-      libwebp
-      libxlsxwriter
-      libxml2
-      lz4
-      minizip
-      openjpeg
-      postgresql
-      proj
-      sqlite
-      virtualpg
-      wxGTK
-      xz
-      zstd
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      Carbon
-      Cocoa
-      IOKit
-    ];
+  buildInputs = [
+    curl
+    freexl
+    geos
+    librasterlite2
+    librttopo
+    libspatialite
+    libwebp
+    libxlsxwriter
+    libxml2
+    lz4
+    minizip
+    openjpeg
+    postgresql
+    proj
+    sqlite
+    virtualpg
+    wxGTK
+    xz
+    zstd
+  ];
 
   enableParallelBuilding = true;
 

pkgs/by-name/su/surrealist/package.nix

@@ -1,16 +1,18 @@
 {
   buildGoModule,
   cairo,
-  cargo,
   cargo-tauri,
+  cargo,
   esbuild,
   fetchFromGitHub,
   gdk-pixbuf,
   glib-networking,
   gobject-introspection,
+  jq,
   lib,
   libsoup_3,
   makeBinaryWrapper,
+  moreutils,
   nodejs,
   openssl,
   pango,
@@ -48,13 +50,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "surrealist";
-  version = "3.0.8";
+  version = "3.1.9";
 
   src = fetchFromGitHub {
     owner = "surrealdb";
     repo = "surrealist";
     rev = "surrealist-v${finalAttrs.version}";
-    hash = "sha256-46CXldjhWc7H6wdKfMK2IlmBqfe0QHi/J1uFhbV42HY=";
+    hash = "sha256-p+Tyu65A+vykqafu1RCRKYFXb435Uyu9WxUoEqjI8d8=";
   };
 
   # HACK: A dependency (surrealist -> tauri -> **reqwest**) contains hyper-tls
@@ -70,23 +72,25 @@ stdenv.mkDerivation (finalAttrs: {
   cargoDeps = rustPlatform.fetchCargoTarball {
     inherit (finalAttrs) patches src;
     sourceRoot = "${finalAttrs.src.name}/${finalAttrs.cargoRoot}";
-    hash = "sha256-HmdEcjgxPyRsQqhU0P/C3KVgwZsSvfHjyzj0OHKe5jY";
+    hash = "sha256-8rw3x17f5pLLyvxozFPWq9pJNHy4wXwV9CcaUGAbdd0=";
     patchFlags = [ "-p2" ];
   };
 
   pnpmDeps = pnpm.fetchDeps {
     inherit (finalAttrs) pname version src;
-    hash = "sha256-uBDbBfWC9HxxzY1x4+rNo87D5C1zZa2beFLa5NkLs80=";
+    hash = "sha256-JwOY6Z8UjbrodSQ3csnT+puftbQUDF3NIK7o6rSpl2o=";
   };
 
   nativeBuildInputs = [
     cargo
     cargo-tauri.hook
     gobject-introspection
+    jq
     makeBinaryWrapper
+    moreutils
     nodejs
-    pnpm.configHook
     pkg-config
+    pnpm.configHook
     rustc
     rustPlatform.cargoSetupHook
   ];
@@ -108,6 +112,15 @@ stdenv.mkDerivation (finalAttrs: {
   cargoRoot = "src-tauri";
   buildAndTestSubdir = finalAttrs.cargoRoot;
 
+  # Deactivate the upstream update mechanism
+  postPatch = ''
+    jq '
+      .bundle.createUpdaterArtifacts = false |
+      .plugins.updater = {"active": false, "pubkey": "", "endpoints": []}
+    ' \
+    src-tauri/tauri.conf.json | sponge src-tauri/tauri.conf.json
+  '';
+
   postFixup = ''
     wrapProgram "$out/bin/surrealist" \
       --set GIO_EXTRA_MODULES ${glib-networking}/lib/gio/modules \

pkgs/by-name/sw/swiftlint/package.nix

@@ -8,11 +8,11 @@
 }:
 stdenvNoCC.mkDerivation rec {
   pname = "swiftlint";
-  version = "0.57.1";
+  version = "0.58.0";
 
   src = fetchurl {
     url = "https://github.com/realm/SwiftLint/releases/download/${version}/portable_swiftlint.zip";
-    hash = "sha256-qi4Pj4JyVF5Vk+vt14cttREy/OxOrXbQAbvhevaceuU=";
+    hash = "sha256-Mp8S0f/xn3XHF4/doLF5s/kvhE+X6KiswY+3lZ/J4wc=";
   };
 
   dontPatch = true;

pkgs/by-name/sy/systemctl-tui/package.nix

@@ -8,16 +8,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "systemctl-tui";
-  version = "0.3.9";
+  version = "0.3.10";
 
   src = fetchFromGitHub {
     owner = "rgwood";
     repo = "systemctl-tui";
     tag = "v${version}";
-    hash = "sha256-LuE0+HxTWROFbqEqqM6464U236/7qxed7xMUkSNUK68=";
+    hash = "sha256-7I4PM4ZQVtDESfchX0/HGu0Y94BxMCLNIrPw8bSokCQ=";
   };
 
-  cargoHash = "sha256-R1JV5Hp10I9DO6I2k8sQC2IXJ+U7iJ2iAzb391e895c=";
+  cargoHash = "sha256-Ur1/3AAN55doW8xyeoeuU6C1KvjTQQjooCl9WVDAGuM=";
 
   nativeInstallCheckInputs = [
     versionCheckHook

pkgs/by-name/te/tempo/package.nix

@@ -1,21 +1,20 @@
 {
   lib,
-  buildGo122Module,
+  buildGoModule,
   fetchFromGitHub,
+  nix-update-script,
 }:
 
-# Does not build with Go 1.23
-# FIXME: check again for next release
-buildGo122Module rec {
+buildGoModule rec {
   pname = "tempo";
-  version = "2.6.0";
+  version = "2.7.0";
 
   src = fetchFromGitHub {
     owner = "grafana";
     repo = "tempo";
     rev = "v${version}";
     fetchSubmodules = true;
-    hash = "sha256-jWoGKY+kC9VAK7jPFaGMJQkC/JeAiUjzqKhE2XjuJio=";
+    hash = "sha256-aCtITq5qT0a1DuoSDK3F46cPvfVsvXOPkZELEuRYi5w=";
   };
 
   vendorHash = null;
@@ -39,6 +38,8 @@ buildGo122Module rec {
   # tests use docker
   doCheck = false;
 
+  passthru.updateScript = nix-update-script { };
+
   meta = with lib; {
     description = "High volume, minimal dependency trace storage";
     license = licenses.asl20;