Merge branch master into haskell-updates

doc/build-helpers/testers.chapter.md

@@ -116,6 +116,55 @@ It has two modes:
 
 : The `lychee` package to use.
 
+## `shellcheck` {#tester-shellcheck}
+
+Runs files through `shellcheck`, a static analysis tool for shell scripts.
+
+:::{.example #ex-shellcheck}
+# Run `testers.shellcheck`
+
+A single script
+
+```nix
+testers.shellcheck {
+  name = "shellcheck";
+  src = ./script.sh;
+}
+```
+
+Multiple files
+
+```nix
+let
+  inherit (lib) fileset;
+in
+testers.shellcheck {
+  name = "shellcheck";
+  src = fileset.toSource {
+    root = ./.;
+    fileset = fileset.unions [
+      ./lib.sh
+      ./nixbsd-activate
+    ];
+  };
+}
+```
+
+:::
+
+### Inputs {#tester-shellcheck-inputs}
+
+[`src` (path or string)]{#tester-shellcheck-param-src}
+
+: The path to the shell script(s) to check.
+  This can be a single file or a directory containing shell files.
+  All files in `src` will be checked, so you may want to provide `fileset`-based source instead of a whole directory.
+
+### Return value {#tester-shellcheck-return}
+
+A derivation that runs `shellcheck` on the given script(s).
+The build will fail if `shellcheck` finds any issues.
+
 ## `testVersion` {#tester-testVersion}
 
 Checks that the output from running a command contains the specified version string in it as a whole word.

doc/languages-frameworks/rust.section.md

@@ -46,11 +46,16 @@ rustPlatform.buildRustPackage rec {
 }
 ```
 
-`buildRustPackage` requires either a `cargoHash` (preferred) or a
-`cargoSha256` attribute, computed over all crate sources of this package.
-`cargoHash` supports [SRI](https://www.w3.org/TR/SRI/) hashes and should be
-preferred over `cargoSha256` which was used for traditional Nix SHA-256 hashes.
-For example:
+`buildRustPackage` requires a `cargoHash` attribute, computed over all crate sources of this package.
+
+::: {.warning}
+`cargoSha256` is already deprecated, and is subject to removal in favor of
+`cargoHash` which supports [SRI](https://www.w3.org/TR/SRI/) hashes.
+
+If you are still using `cargoSha256`, you can simply replace it with
+`cargoHash` and recompute the hash, or convert the original sha256 to SRI
+hash using `nix-hash --to-sri --type sha256 "<original sha256>"`.
+:::
 
 ```nix
 {
@@ -58,7 +63,7 @@ For example:
 }
 ```
 
-Exception: If the application has cargo `git` dependencies, the `cargoHash`/`cargoSha256`
+Exception: If the application has cargo `git` dependencies, the `cargoHash`
 approach will not work, and you will need to copy the `Cargo.lock` file of the application
 to nixpkgs and continue with the next section for specifying the options of the `cargoLock`
 section.
@@ -76,14 +81,6 @@ then be taken from the failed build. A fake hash can be used for
 }
 ```
 
-For `cargoSha256` you can use:
-
-```nix
-{
-  cargoSha256 = lib.fakeSha256;
-}
-```
-
 Per the instructions in the [Cargo Book](https://doc.rust-lang.org/cargo/guide/cargo-toml-vs-cargo-lock.html)
 best practices guide, Rust applications should always commit the `Cargo.lock`
 file in git to ensure a reproducible build. However, a few packages do not, and
@@ -98,7 +95,7 @@ directory into a tar.gz archive.
 The tarball with vendored dependencies contains a directory with the
 package's `name`, which is normally composed of `pname` and
 `version`. This means that the vendored dependencies hash
-(`cargoHash`/`cargoSha256`) is dependent on the package name and
+(`cargoHash`) is dependent on the package name and
 version. The `cargoDepsName` attribute can be used to use another name
 for the directory of vendored dependencies. For example, the hash can
 be made invariant to the version by setting `cargoDepsName` to
@@ -123,7 +120,7 @@ rustPlatform.buildRustPackage rec {
 
 ### Importing a `Cargo.lock` file {#importing-a-cargo.lock-file}
 
-Using a vendored hash (`cargoHash`/`cargoSha256`) is tedious when using
+Using a vendored hash (`cargoHash`) is tedious when using
 `buildRustPackage` within a project, since it requires that the hash
 is updated after every change to `Cargo.lock`. Therefore,
 `buildRustPackage` also supports vendoring dependencies directly from

maintainers/maintainer-list.nix

@@ -20260,6 +20260,13 @@
     githubId = 71843723;
     keys = [ { fingerprint = "EEFB CC3A C529 CFD1 943D  A75C BDD5 7BE9 9D55 5965"; } ];
   };
+  thepuzzlemaker = {
+    name = "ThePuzzlemaker";
+    email = "tpzker@thepuzzlemaker.info";
+    github = "ThePuzzlemaker";
+    githubId = 12666617;
+    keys = [ { fingerprint = "7095 C20A 9224 3DB6 5177  07B0 968C D9D7 1C9F BB6C"; } ];
+  };
   therealansh = {
     email = "tyagiansh23@gmail.com";
     github = "therealansh";
@@ -21578,6 +21585,12 @@
     githubId = 70410;
     name = "Rahul Gopinath";
   };
+  vsharathchandra = {
+    email = "chandrasharath.v@gmail.com";
+    github = "vsharathchandra";
+    githubId = 12689380;
+    name = "sharath chandra";
+  };
   vskilet = {
     email = "victor@sene.ovh";
     github = "Vskilet";

nixos/doc/manual/release-notes/rl-2411.section.md

@@ -140,6 +140,8 @@
   Refer to upstream [upgrade instructions](https://goteleport.com/docs/management/operations/upgrading/)
   and [release notes for v16](https://goteleport.com/docs/changelog/#1600-061324).
 
+- `tests.overriding` has its `passthru.tests` restructured as an attribute set instead of a list, making individual tests accessible by their names.
+
 - `vaultwarden` lost the capability to bind to privileged ports. If you rely on
    this behavior, override the systemd unit to allow `CAP_NET_BIND_SERVICE` in
    your local configuration.
@@ -252,6 +254,9 @@
 - The `services.mxisd` module has been removed as both [mxisd](https://github.com/kamax-matrix/mxisd) and [ma1sd](https://github.com/ma1uta/ma1sd) are not maintained any longer.
   Consequently the package `pkgs.ma1sd` has also been removed.
 
+- `ffmpeg_5` has been removed. Please use the unversioned `ffmpeg`,
+  pin a newer version, or if necessary pin `ffmpeg_4` for compatibility.
+
 ## Other Notable Changes {#sec-release-24.11-notable-changes}
 
 <!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->
@@ -260,6 +265,11 @@
 
 - The `stackclashprotection` hardening flag has been added, though disabled by default.
 
+- `cargoSha256` in `rustPlatform.buildRustPackage` has been deprecated in favor
+  of `cargoHash` which supports SRI hashes. See
+  [buildRustPackage: Compiling Rust applications with Cargo](https://nixos.org/manual/nixpkgs/unstable/#compiling-rust-applications-with-cargo)
+  for more information.
+
 - `hareHook` has been added as the language framework for Hare. From now on, it,
   not the `hare` package, should be added to `nativeBuildInputs` when building
   Hare programs.
@@ -293,6 +303,8 @@
   {option}`services.gitlab-runner.services.<name>.authenticationTokenConfigFile` instead of the former
   {option}`services.gitlab-runner.services.<name>.registrationConfigFile` option.
 
+- `iproute2` now has libbpf support.
+
 - `nix.channel.enable = false` no longer implies `nix.settings.nix-path = []`.
   Since Nix 2.13, a `nix-path` set in `nix.conf` cannot be overriden by the `NIX_PATH` configuration variable.
 

nixos/lib/systemd-lib.nix

@@ -169,6 +169,10 @@ in rec {
     optional (attr ? ${name} && !isInt attr.${name})
       "Systemd ${group} field `${name}' is not an integer";
 
+  assertRemoved = name: see: group: attr:
+    optional (attr ? ${name})
+      "Systemd ${group} field `${name}' has been removed. See ${see}";
+
   checkUnitConfig = group: checks: attrs: let
     # We're applied at the top-level type (attrsOf unitOption), so the actual
     # unit options might contain attributes from mkOverride and mkIf that we need to

nixos/lib/systemd-types.nix

@@ -45,12 +45,61 @@ let
 
   inherit (lib.types)
     attrsOf
+    coercedTo
+    enum
     lines
     listOf
     nullOr
+    oneOf
+    package
     path
+    singleLineStr
     submodule
     ;
+
+  initrdStorePathModule = { config, ... }: {
+    options = {
+      enable = (mkEnableOption "copying of this file and symlinking it") // { default = true; };
+
+      target = mkOption {
+        type = nullOr path;
+        description = ''
+          Path of the symlink.
+        '';
+        default = null;
+      };
+
+      source = mkOption {
+        type = path;
+        description = "Path of the source file.";
+      };
+
+      dlopen = {
+        usePriority = mkOption {
+          type = enum [ "required" "recommended" "suggested" ];
+          default = "recommended";
+          description = ''
+            Priority of dlopen ELF notes to include. "required" is
+            minimal, "recommended" includes "required", and
+            "suggested" includes "recommended".
+
+            See: https://systemd.io/ELF_DLOPEN_METADATA/
+          '';
+        };
+
+        features = mkOption {
+          type = listOf singleLineStr;
+          default = [ ];
+          description = ''
+            Features to enable via dlopen ELF notes. These will be in
+            addition to anything included via 'usePriority',
+            regardless of their priority.
+          '';
+        };
+      };
+    };
+  };
+
 in
 
 {
@@ -86,31 +135,23 @@ in
   automounts = listOf (submodule [ stage2AutomountOptions unitConfig automountConfig ]);
   initrdAutomounts = attrsOf (submodule [ stage1AutomountOptions unitConfig automountConfig ]);
 
+  initrdStorePath = listOf (coercedTo
+    (oneOf [ singleLineStr package ])
+    (source: { inherit source; })
+    (submodule initrdStorePathModule));
+
   initrdContents = attrsOf (submodule ({ config, options, name, ... }: {
+    imports = [ initrdStorePathModule ];
     options = {
-      enable = (mkEnableOption "copying of this file and symlinking it") // { default = true; };
-
-      target = mkOption {
-        type = path;
-        description = ''
-          Path of the symlink.
-        '';
-        default = name;
-      };
-
       text = mkOption {
         default = null;
         type = nullOr lines;
         description = "Text of the file.";
       };
-
-      source = mkOption {
-        type = path;
-        description = "Path of the source file.";
-      };
     };
 
     config = {
+      target = mkDefault name;
       source = mkIf (config.text != null) (
         let name' = "initrd-" + baseNameOf name;
         in mkDerivedConfig options.text (pkgs.writeText name')

nixos/modules/config/nix-channel.nix

@@ -12,6 +12,7 @@ let
     mkDefault
     mkIf
     mkOption
+    stringAfter
     types
     ;
 
@@ -97,5 +98,8 @@ in
     systemd.tmpfiles.rules = lib.mkIf cfg.channel.enable [
       ''f /root/.nix-channels - - - - ${config.system.defaultChannel} nixos\n''
     ];
+
+    system.activationScripts.no-nix-channel = mkIf (!cfg.channel.enable)
+      (stringAfter [ "etc" "users" ] (builtins.readFile ./nix-channel/activation-check.sh));
   };
 }

nixos/modules/config/nix-channel/activation-check.sh

@@ -0,0 +1,21 @@
+# shellcheck shell=bash
+
+explainChannelWarning=0
+if [[ -e "/root/.nix-defexpr/channels" ]]; then
+    warn '/root/.nix-defexpr/channels exists, but channels have been disabled.'
+    explainChannelWarning=1
+fi
+if [[ -e "/nix/var/nix/profiles/per-user/root/channels" ]]; then
+    warn "/nix/var/nix/profiles/per-user/root/channels exists, but channels have been disabled."
+    explainChannelWarning=1
+fi
+while IFS=: read -r _ _ _ _ _ home _ ; do
+    if [[ -n  "$home" && -e "$home/.nix-defexpr/channels" ]]; then
+        warn "$home/.nix-defexpr/channels exists, but channels have been disabled." 1>&2
+        explainChannelWarning=1
+    fi
+done < <(getent passwd)
+if [[ $explainChannelWarning -eq 1 ]]; then
+    echo "Due to https://github.com/NixOS/nix/issues/9574, Nix may still use these channels when NIX_PATH is unset." 1>&2
+    echo "Delete the above directory or directories to prevent this." 1>&2
+fi

nixos/modules/config/nix-channel/test.nix

@@ -0,0 +1,19 @@
+# Run:
+#   nix-build -A nixosTests.nix-channel
+{ lib, testers }:
+let
+  inherit (lib) fileset;
+
+  runShellcheck = testers.shellcheck {
+    src = fileset.toSource {
+      root = ./.;
+      fileset = fileset.unions [
+        ./activation-check.sh
+      ];
+    };
+  };
+
+in
+lib.recurseIntoAttrs {
+  inherit runShellcheck;
+}

nixos/modules/config/no-x-libs.nix

@@ -33,7 +33,6 @@ with lib;
       fastfetch = super.fastfetch.override { vulkanSupport = false; waylandSupport = false; x11Support = false; };
       ffmpeg = super.ffmpeg.override { ffmpegVariant = "headless"; };
       ffmpeg_4 = super.ffmpeg_4.override { ffmpegVariant = "headless"; };
-      ffmpeg_5 = super.ffmpeg_5.override { ffmpegVariant = "headless"; };
       ffmpeg_6 = super.ffmpeg_6.override { ffmpegVariant = "headless"; };
       ffmpeg_7 = super.ffmpeg_7.override { ffmpegVariant = "headless"; };
       # dep of graphviz, libXpm is optional for Xpm support

nixos/modules/module-list.nix

@@ -356,6 +356,7 @@
   ./security/systemd-confinement.nix
   ./security/tpm2.nix
   ./security/wrappers/default.nix
+  ./services/accessibility/speechd.nix
   ./services/admin/docuum.nix
   ./services/admin/meshcentral.nix
   ./services/admin/oxidized.nix
@@ -414,6 +415,7 @@
   ./services/blockchain/ethereum/geth.nix
   ./services/blockchain/ethereum/lighthouse.nix
   ./services/cluster/corosync/default.nix
+  ./services/cluster/druid/default.nix
   ./services/cluster/hadoop/default.nix
   ./services/cluster/k3s/default.nix
   ./services/cluster/kubernetes/addon-manager.nix

nixos/modules/profiles/installation-device.nix

@@ -126,5 +126,15 @@ with lib;
 
     # allow nix-copy to live system
     nix.settings.trusted-users = [ "root" "nixos" ];
+
+    # Install less voices for speechd to save some space
+    services.speechd.package = pkgs.speechd.override {
+      mbrola = pkgs.mbrola.override {
+        mbrola-voices = pkgs.mbrola-voices.override {
+          # only ship with one voice per language
+          languages = [ "*1" ];
+        };
+      };
+    };
   };
 }

nixos/modules/programs/direnv.nix

@@ -3,9 +3,18 @@
   config,
   pkgs,
   ...
-}: let
+}:
+let
   cfg = config.programs.direnv;
-in {
+  enabledOption =
+    x:
+    lib.mkEnableOption x
+    // {
+      default = true;
+      example = false;
+    };
+in
+{
   options.programs.direnv = {
 
     enable = lib.mkEnableOption ''
@@ -14,7 +23,17 @@ in {
       integration. Note that you need to logout and login for this change to apply
     '';
 
-    package = lib.mkPackageOption pkgs "direnv" {};
+    package = lib.mkPackageOption pkgs "direnv" { };
+
+    enableBashIntegration = enabledOption ''
+      Bash integration
+    '';
+    enableZshIntegration = enabledOption ''
+      Zsh integration
+    '';
+    enableFishIntegration = enabledOption ''
+      Fish integration
+    '';
 
     direnvrcExtra = lib.mkOption {
       type = lib.types.lines;
@@ -32,22 +51,14 @@ in {
       the hiding of direnv logging
     '';
 
-    loadInNixShell =
-      lib.mkEnableOption ''
-        loading direnv in `nix-shell` `nix shell` or `nix develop`
-      ''
-      // {
-        default = true;
-      };
+    loadInNixShell = enabledOption ''
+      loading direnv in `nix-shell` `nix shell` or `nix develop`
+    '';
 
     nix-direnv = {
-      enable =
-        (lib.mkEnableOption ''
-          a faster, persistent implementation of use_nix and use_flake, to replace the built-in one
-        '')
-        // {
-          default = true;
-        };
+      enable = enabledOption ''
+        a faster, persistent implementation of use_nix and use_flake, to replace the builtin one
+      '';
 
       package = lib.mkOption {
         default = pkgs.nix-direnv.override { nix = config.nix.package; };
@@ -60,14 +71,10 @@ in {
     };
   };
 
-  imports = [
-    (lib.mkRemovedOptionModule ["programs" "direnv" "persistDerivations"] "persistDerivations was removed as it is no longer necessary")
-  ];
-
   config = lib.mkIf cfg.enable {
 
     programs = {
-      zsh.interactiveShellInit = ''
+      zsh.interactiveShellInit = lib.mkIf cfg.enableZshIntegration ''
         if ${lib.boolToString cfg.loadInNixShell} || printenv PATH | grep -vqc '/nix/store'; then
          eval "$(${lib.getExe cfg.package} hook zsh)"
         fi
@@ -75,13 +82,13 @@ in {
 
       #$NIX_GCROOT for "nix develop" https://github.com/NixOS/nix/blob/6db66ebfc55769edd0c6bc70fcbd76246d4d26e0/src/nix/develop.cc#L530
       #$IN_NIX_SHELL for "nix-shell"
-      bash.interactiveShellInit = ''
+      bash.interactiveShellInit = lib.mkIf cfg.enableBashIntegration ''
         if ${lib.boolToString cfg.loadInNixShell} || [ -z "$IN_NIX_SHELL$NIX_GCROOT$(printenv PATH | grep '/nix/store')" ] ; then
          eval "$(${lib.getExe cfg.package} hook bash)"
         fi
       '';
 
-      fish.interactiveShellInit = ''
+      fish.interactiveShellInit = lib.mkIf cfg.enableFishIntegration ''
         if ${lib.boolToString cfg.loadInNixShell};
         or printenv PATH | grep -vqc '/nix/store';
          ${lib.getExe cfg.package} hook fish | source
@@ -90,18 +97,17 @@ in {
     };
 
     environment = {
-      systemPackages =
-        if cfg.loadInNixShell then [cfg.package]
-        else [
-          #direnv has a fish library which sources direnv for some reason
-          (cfg.package.overrideAttrs (old: {
-            installPhase =
-              (old.installPhase or "")
-              + ''
-                rm -rf $out/share/fish
-              '';
-          }))
-        ];
+      systemPackages = [
+        # direnv has a fish library which automatically sources direnv for some reason
+        # I don't see any harm in doing this if we're sourcing it with fish.interactiveShellInit
+        (pkgs.symlinkJoin {
+          inherit (cfg.package) name;
+          paths = [ cfg.package ];
+          postBuild = ''
+            rm -rf $out/share/fish
+          '';
+        })
+      ];
 
       variables = {
         DIRENV_CONFIG = "/etc/direnv";
@@ -141,4 +147,5 @@ in {
       };
     };
   };
+  meta.maintainers = with lib.maintainers; [ gerg-l ];
 }

nixos/modules/programs/nix-required-mounts.nix

@@ -47,7 +47,7 @@ let
     );
 
   driverPaths = [
-    pkgs.addOpenGLRunpath.driverLink
+    pkgs.addDriverRunpath.driverLink
 
     # mesa:
     config.hardware.opengl.package
@@ -84,7 +84,7 @@ in
           {
             opengl.paths = config.hardware.opengl.extraPackages ++ [
               config.hardware.opengl.package
-              pkgs.addOpenGLRunpath.driverLink
+              pkgs.addDriverRunpath.driverLink
               "/dev/dri"
             ];
           }

nixos/modules/services/accessibility/speechd.nix

@@ -0,0 +1,32 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+let
+  cfg = config.services.speechd;
+  inherit (lib)
+    getExe
+    mkEnableOption
+    mkIf
+    mkPackageOption
+    ;
+in
+{
+  options.services.speechd = {
+    # FIXME: figure out how to deprecate this EXTREMELY CAREFULLY
+    # default guessed conservatively in ../misc/graphical-desktop.nix
+    enable = mkEnableOption "speech-dispatcher speech synthesizer daemon";
+    package = mkPackageOption pkgs "speechd" { };
+  };
+
+  # FIXME: speechd 0.12 (or whatever the next version is)
+  # will support socket activation, so switch to that once it's out.
+  config = mkIf cfg.enable {
+    environment = {
+      systemPackages = [ cfg.package ];
+      sessionVariables.SPEECHD_CMD = getExe cfg.package;
+    };
+  };
+}

nixos/modules/services/cluster/druid/default.nix

@@ -0,0 +1,296 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+let
+  cfg = config.services.druid;
+  inherit (lib)
+    concatStrings
+    concatStringsSep
+    mapAttrsToList
+    concatMap
+    attrByPath
+    mkIf
+    mkMerge
+    mkEnableOption
+    mkOption
+    types
+    mkPackageOption
+    ;
+
+  druidServiceOption = serviceName: {
+    enable = mkEnableOption serviceName;
+
+    restartIfChanged = mkOption {
+      type = types.bool;
+      description = ''
+        Automatically restart the service on config change.
+        This can be set to false to defer restarts on clusters running critical applications.
+        Please consider the security implications of inadvertently running an older version,
+        and the possibility of unexpected behavior caused by inconsistent versions across a cluster when disabling this option.
+      '';
+      default = false;
+    };
+
+    config = mkOption {
+      default = { };
+      type = types.attrsOf types.anything;
+      description = ''
+        (key=value) Configuration to be written to runtime.properties of the druid ${serviceName}
+        <https://druid.apache.org/docs/latest/configuration/index.html>
+      '';
+      example = {
+        "druid.plainTextPort" = "8082";
+        "druid.service" = "servicename";
+      };
+    };
+
+    jdk = mkPackageOption pkgs "JDK" { default = [ "jdk17_headless" ]; };
+
+    jvmArgs = mkOption {
+      type = types.str;
+      default = "";
+      description = "Arguments to pass to the JVM";
+    };
+
+    openFirewall = mkOption {
+      type = types.bool;
+      default = false;
+      description = "Open firewall ports for ${serviceName}.";
+    };
+
+    internalConfig = mkOption {
+      default = { };
+      type = types.attrsOf types.anything;
+      internal = true;
+      description = "Internal Option to add to runtime.properties for ${serviceName}.";
+    };
+  };
+
+  druidServiceConfig =
+    {
+      name,
+      serviceOptions ? cfg."${name}",
+      allowedTCPPorts ? [ ],
+      tmpDirs ? [ ],
+      extraConfig ? { },
+    }:
+    (mkIf serviceOptions.enable (mkMerge [
+      {
+        systemd = {
+          services."druid-${name}" = {
+            after = [ "network.target" ];
+
+            description = "Druid ${name}";
+
+            wantedBy = [ "multi-user.target" ];
+
+            inherit (serviceOptions) restartIfChanged;
+
+            path = [
+              cfg.package
+              serviceOptions.jdk
+            ];
+
+            script =
+              let
+                cfgFile =
+                  fileName: properties:
+                  pkgs.writeTextDir fileName (
+                    concatStringsSep "\n" (mapAttrsToList (n: v: "${n}=${toString v}") properties)
+                  );
+
+                commonConfigFile = cfgFile "common.runtime.properties" cfg.commonConfig;
+
+                configFile = cfgFile "runtime.properties" (serviceOptions.config // serviceOptions.internalConfig);
+
+                extraClassPath = concatStrings (map (path: ":" + path) cfg.extraClassPaths);
+
+                extraConfDir = concatStrings (map (dir: ":" + dir + "/*") cfg.extraConfDirs);
+              in
+              ''
+                run-java -Dlog4j.configurationFile=file:${cfg.log4j} \
+                  -Ddruid.extensions.directory=${cfg.package}/extensions \
+                  -Ddruid.extensions.hadoopDependenciesDir=${cfg.package}/hadoop-dependencies \
+                  -classpath  ${commonConfigFile}:${configFile}:${cfg.package}/lib/\*${extraClassPath}${extraConfDir} \
+                  ${serviceOptions.jvmArgs} \
+                  org.apache.druid.cli.Main server ${name}
+              '';
+
+            serviceConfig = {
+              User = "druid";
+              SyslogIdentifier = "druid-${name}";
+              Restart = "always";
+            };
+          };
+
+          tmpfiles.rules = concatMap (x: [ "d ${x} 0755 druid druid" ]) (cfg.commonTmpDirs ++ tmpDirs);
+        };
+        networking.firewall.allowedTCPPorts = mkIf (attrByPath [
+          "openFirewall"
+        ] false serviceOptions) allowedTCPPorts;
+
+        users = {
+          users.druid = {
+            description = "Druid user";
+            group = "druid";
+            isNormalUser = true;
+          };
+          groups.druid = { };
+        };
+      }
+      extraConfig
+    ]));
+in
+{
+  options.services.druid = {
+    package = mkPackageOption pkgs "apache-druid" { default = [ "druid" ]; };
+
+    commonConfig = mkOption {
+      default = { };
+
+      type = types.attrsOf types.anything;
+
+      description = "(key=value) Configuration to be written to common.runtime.properties";
+
+      example = {
+        "druid.zk.service.host" = "localhost:2181";
+        "druid.metadata.storage.type" = "mysql";
+        "druid.metadata.storage.connector.connectURI" = "jdbc:mysql://localhost:3306/druid";
+        "druid.extensions.loadList" = ''[ "mysql-metadata-storage" ]'';
+      };
+    };
+
+    commonTmpDirs = mkOption {
+      default = [ "/var/log/druid/requests" ];
+      type = types.listOf types.str;
+      description = "Common List of directories used by druid processes";
+    };
+
+    log4j = mkOption {
+      type = types.path;
+      description = "Log4j Configuration for the druid process";
+    };
+
+    extraClassPaths = mkOption {
+      default = [ ];
+      type = types.listOf types.str;
+      description = "Extra classpath to include in the jvm";
+    };
+
+    extraConfDirs = mkOption {
+      default = [ ];
+      type = types.listOf types.path;
+      description = "Extra Conf Dirs to include in the jvm";
+    };
+
+    overlord = druidServiceOption "Druid Overlord";
+
+    coordinator = druidServiceOption "Druid Coordinator";
+
+    broker = druidServiceOption "Druid Broker";
+
+    historical = (druidServiceOption "Druid Historical") // {
+      segmentLocations = mkOption {
+
+        default = null;
+
+        description = "Locations where the historical will store its data.";
+
+        type =
+          with types;
+          nullOr (
+            listOf (submodule {
+              options = {
+                path = mkOption {
+                  type = path;
+                  description = "the path to store the segments";
+                };
+
+                maxSize = mkOption {
+                  type = str;
+                  description = "Max size the druid historical can occupy";
+                };
+
+                freeSpacePercent = mkOption {
+                  type = float;
+                  default = 1.0;
+                  description = "Druid Historical will fail to write if it exceeds this value";
+                };
+              };
+            })
+          );
+
+      };
+    };
+
+    middleManager = druidServiceOption "Druid middleManager";
+    router = druidServiceOption "Druid Router";
+  };
+  config = mkMerge [
+    (druidServiceConfig rec {
+      name = "overlord";
+      allowedTCPPorts = [ (attrByPath [ "druid.plaintextPort" ] 8090 cfg."${name}".config) ];
+    })
+
+    (druidServiceConfig rec {
+      name = "coordinator";
+      allowedTCPPorts = [ (attrByPath [ "druid.plaintextPort" ] 8081 cfg."${name}".config) ];
+    })
+
+    (druidServiceConfig rec {
+      name = "broker";
+
+      tmpDirs = [ (attrByPath [ "druid.lookup.snapshotWorkingDir" ] "" cfg."${name}".config) ];
+
+      allowedTCPPorts = [ (attrByPath [ "druid.plaintextPort" ] 8082 cfg."${name}".config) ];
+    })
+
+    (druidServiceConfig rec {
+      name = "historical";
+
+      tmpDirs = [
+        (attrByPath [ "druid.lookup.snapshotWorkingDir" ] "" cfg."${name}".config)
+      ] ++ (map (x: x.path) cfg."${name}".segmentLocations);
+
+      allowedTCPPorts = [ (attrByPath [ "druid.plaintextPort" ] 8083 cfg."${name}".config) ];
+
+      extraConfig.services.druid.historical.internalConfig."druid.segmentCache.locations" = builtins.toJSON cfg.historical.segmentLocations;
+    })
+
+    (druidServiceConfig rec {
+      name = "middleManager";
+
+      tmpDirs = [
+        "/var/log/druid/indexer"
+      ] ++ [ (attrByPath [ "druid.indexer.task.baseTaskDir" ] "" cfg."${name}".config) ];
+
+      allowedTCPPorts = [ (attrByPath [ "druid.plaintextPort" ] 8091 cfg."${name}".config) ];
+
+      extraConfig = {
+        services.druid.middleManager.internalConfig = {
+          "druid.indexer.runner.javaCommand" = "${cfg.middleManager.jdk}/bin/java";
+          "druid.indexer.runner.javaOpts" =
+            (attrByPath [ "druid.indexer.runner.javaOpts" ] "" cfg.middleManager.config)
+            + " -Dlog4j.configurationFile=file:${cfg.log4j}";
+        };
+
+        networking.firewall.allowedTCPPortRanges = mkIf cfg.middleManager.openFirewall [
+          {
+            from = attrByPath [ "druid.indexer.runner.startPort" ] 8100 cfg.middleManager.config;
+            to = attrByPath [ "druid.indexer.runner.endPort" ] 65535 cfg.middleManager.config;
+          }
+        ];
+      };
+    })
+
+    (druidServiceConfig rec {
+      name = "router";
+
+      allowedTCPPorts = [ (attrByPath [ "druid.plaintextPort" ] 8888 cfg."${name}".config) ];
+    })
+  ];
+
+}

nixos/modules/services/hardware/udev.nix

@@ -29,9 +29,6 @@ let
   };
 
   nixosRules = ''
-    # Miscellaneous devices.
-    KERNEL=="kvm",                  MODE="0666"
-
     # Needed for gpm.
     SUBSYSTEM=="input", KERNEL=="mice", TAG+="systemd"
   '';

nixos/modules/services/misc/graphical-desktop.nix

@@ -42,6 +42,8 @@ in
 
     programs.gnupg.agent.pinentryPackage = lib.mkOverride 1100 pkgs.pinentry-gnome3;
 
+    services.speechd.enable = lib.mkDefault true;
+
     systemd.defaultUnit = lib.mkIf (xcfg.autorun || dmcfg.enable) "graphical.target";
 
     xdg = {

nixos/modules/services/video/frigate.nix

@@ -403,7 +403,7 @@ in
       path = with pkgs; [
         # unfree:
         # config.boot.kernelPackages.nvidiaPackages.latest.bin
-        ffmpeg_5-headless
+        ffmpeg-headless
         libva-utils
         procps
         radeontop

nixos/modules/services/web-apps/akkoma.nix

@@ -452,9 +452,9 @@ in {
 
       extraPackages = mkOption {
         type = with types; listOf package;
-        default = with pkgs; [ exiftool ffmpeg_5-headless graphicsmagick-imagemagick-compat ];
-        defaultText = literalExpression "with pkgs; [ exiftool graphicsmagick-imagemagick-compat ffmpeg_5-headless ]";
-        example = literalExpression "with pkgs; [ exiftool imagemagick ffmpeg_5-full ]";
+        default = with pkgs; [ exiftool ffmpeg-headless graphicsmagick-imagemagick-compat ];
+        defaultText = literalExpression "with pkgs; [ exiftool ffmpeg-headless graphicsmagick-imagemagick-compat ]";
+        example = literalExpression "with pkgs; [ exiftool ffmpeg-full imagemagick ]";
         description = ''
           List of extra packages to include in the executable search path of the service unit.
           These are needed by various configurable components such as:

nixos/modules/system/activation/activation-script.nix

@@ -33,6 +33,8 @@ let
     ''
       #!${pkgs.runtimeShell}
 
+      source ${./lib/lib.sh}
+
       systemConfig='@out@'
 
       export PATH=/empty

nixos/modules/system/activation/lib/lib.sh

@@ -0,0 +1,5 @@
+# shellcheck shell=bash
+
+warn() {
+    printf "\033[1;35mwarning:\033[0m %s\n" "$*" >&2
+}

nixos/modules/system/activation/lib/test.nix

@@ -0,0 +1,36 @@
+# Run:
+#   nix-build -A nixosTests.activation-lib
+{ lib, stdenv, testers }:
+let
+  inherit (lib) fileset;
+
+  runTests = stdenv.mkDerivation {
+    name = "tests-activation-lib";
+    src = fileset.toSource {
+      root = ./.;
+      fileset = fileset.unions [
+        ./lib.sh
+        ./test.sh
+      ];
+    };
+    buildPhase = ":";
+    doCheck = true;
+    postUnpack = ''
+      patchShebangs --build .
+    '';
+    checkPhase = ''
+      ./test.sh
+    '';
+    installPhase = ''
+      touch $out
+    '';
+  };
+
+  runShellcheck = testers.shellcheck {
+    src = runTests.src;
+  };
+
+in
+lib.recurseIntoAttrs {
+  inherit runTests runShellcheck;
+}

nixos/modules/system/activation/lib/test.sh

@@ -0,0 +1,34 @@
+#!/usr/bin/env bash
+
+# Run:
+#   ./test.sh
+# or:
+#   nix-build -A nixosTests.activation-lib
+
+cd "$(dirname "${BASH_SOURCE[0]}")"
+set -euo pipefail
+
+# report failure
+onerr() {
+  set +e
+  # find failed statement
+  echo "call trace:"
+  local i=0
+  while t="$(caller $i)"; do
+    line="${t%% *}"
+    file="${t##* }"
+    echo "  $file:$line" >&2
+    ((i++))
+  done
+  # red
+  printf "\033[1;31mtest failed\033[0m\n" >&2
+  exit 1
+}
+trap onerr ERR
+
+source ./lib.sh
+
+(warn hi, this works >/dev/null) 2>&1 | grep -E $'.*warning:.* hi, this works' >/dev/null
+
+# green
+printf "\033[1;32mok\033[0m\n"

nixos/modules/system/boot/networkd.nix

@@ -18,12 +18,16 @@ let
           "ManageForeignRoutes"
           "RouteTable"
           "IPv6PrivacyExtensions"
+          "IPv4Forwarding"
+          "IPv6Forwarding"
         ])
         (assertValueOneOf "SpeedMeter" boolValues)
         (assertInt "SpeedMeterIntervalSec")
         (assertValueOneOf "ManageForeignRoutingPolicyRules" boolValues)
         (assertValueOneOf "ManageForeignRoutes" boolValues)
         (assertValueOneOf "IPv6PrivacyExtensions" (boolValues ++ ["prefer-public" "kernel"]))
+        (assertValueOneOf "IPv4Forwarding" boolValues)
+        (assertValueOneOf "IPv6Forwarding" boolValues)
       ];
 
       sectionDHCPv4 = checkUnitConfig "DHCPv4" [
@@ -652,6 +656,8 @@ let
           "DNSDefaultRoute"
           "NTP"
           "IPForward"
+          "IPv4Forwarding"
+          "IPv6Forwarding"
           "IPMasquerade"
           "IPv6PrivacyExtensions"
           "IPv6AcceptRA"
@@ -700,7 +706,9 @@ let
         (assertValueOneOf "LLDP" (boolValues ++ ["routers-only"]))
         (assertValueOneOf "EmitLLDP" (boolValues ++ ["nearest-bridge" "non-tpmr-bridge" "customer-bridge"]))
         (assertValueOneOf "DNSDefaultRoute" boolValues)
-        (assertValueOneOf "IPForward" (boolValues ++ ["ipv4" "ipv6"]))
+        (assertRemoved "IPForward" "IPv4Forwarding and IPv6Forwarding in systemd.network(5) and networkd.conf(5)")
+        (assertValueOneOf "IPv4Forwarding" boolValues)
+        (assertValueOneOf "IPv6Forwarding" boolValues)
         (assertValueOneOf "IPMasquerade" (boolValues ++ ["ipv4" "ipv6" "both"]))
         (assertValueOneOf "IPv6PrivacyExtensions" (boolValues ++ ["prefer-public" "kernel"]))
         (assertValueOneOf "IPv6AcceptRA" boolValues)
@@ -2835,6 +2843,7 @@ let
         "systemd-networkd-wait-online.service"
         "systemd-networkd.service"
         "systemd-networkd.socket"
+        "systemd-networkd-persistent-storage.service"
       ];
 
       environment.etc."systemd/networkd.conf" = renderConfig cfg.config;

nixos/modules/system/boot/stage-1.nix

@@ -131,6 +131,7 @@ let
 
       # Copy udev.
       copy_bin_and_libs ${udev}/bin/udevadm
+      cp ${lib.getLib udev.kmod}/lib/libkmod.so* $out/lib
       copy_bin_and_libs ${udev}/lib/systemd/systemd-sysctl
       for BIN in ${udev}/lib/udev/*_id; do
         copy_bin_and_libs $BIN

nixos/modules/system/boot/systemd.nix

@@ -37,6 +37,8 @@ let
       "cryptsetup.target"
       "cryptsetup-pre.target"
       "remote-cryptsetup.target"
+    ] ++ optionals cfg.package.withTpm2Tss [
+      "tpm2.target"
     ] ++ [
       "sigpwr.target"
       "timers.target"
@@ -116,6 +118,7 @@ let
       "sleep.target"
       "hybrid-sleep.target"
       "systemd-hibernate.service"
+      "systemd-hibernate-clear.service"
       "systemd-hybrid-sleep.service"
       "systemd-suspend.service"
       "systemd-suspend-then-hibernate.service"
@@ -140,6 +143,16 @@ let
       "systemd-ask-password-wall.path"
       "systemd-ask-password-wall.service"
 
+      # Varlink APIs
+      "systemd-bootctl@.service"
+      "systemd-bootctl.socket"
+      "systemd-creds@.service"
+      "systemd-creds.socket"
+    ] ++ lib.optional cfg.package.withTpm2Tss [
+      "systemd-pcrlock@.service"
+      "systemd-pcrlock.socket"
+    ] ++ [
+
       # Slices / containers.
       "slices.target"
     ] ++ optionals cfg.package.withImportd [
@@ -162,6 +175,7 @@ let
     ] ++ optionals cfg.package.withHostnamed [
       "dbus-org.freedesktop.hostname1.service"
       "systemd-hostnamed.service"
+      "systemd-hostnamed.socket"
     ] ++ optionals cfg.package.withPortabled [
       "dbus-org.freedesktop.portable1.service"
       "systemd-portabled.service"

nixos/modules/system/boot/systemd/initrd.nix

@@ -70,6 +70,7 @@ let
     "systemd-tmpfiles-setup-dev.service"
     "systemd-tmpfiles-setup.service"
     "timers.target"
+    "tpm2.target"
     "umount.target"
     "systemd-bsod.service"
   ] ++ cfg.additionalUpstreamUnits;
@@ -111,8 +112,7 @@ let
     inherit (config.boot.initrd) compressor compressorArgs prepend;
     inherit (cfg) strip;
 
-    contents = map (path: { object = path; symlink = ""; }) (subtractLists cfg.suppressedStorePaths cfg.storePaths)
-      ++ mapAttrsToList (_: v: { object = v.source; symlink = v.target; }) (filterAttrs (_: v: v.enable) cfg.contents);
+    contents = lib.filter ({ source, ... }: !lib.elem source cfg.suppressedStorePaths) cfg.storePaths;
   };
 
 in {
@@ -171,7 +171,7 @@ in {
       description = ''
         Store paths to copy into the initrd as well.
       '';
-      type = with types; listOf (oneOf [ singleLineStr package ]);
+      type = utils.systemdUtils.types.initrdStorePath;
       default = [];
     };
 
@@ -344,7 +344,8 @@ in {
     };
 
     enableTpm2 = mkOption {
-      default = true;
+      default = cfg.package.withTpm2Tss;
+      defaultText = "boot.initrd.systemd.package.withTpm2Tss";
       type = types.bool;
       description = ''
         Whether to enable TPM2 support in the initrd.
@@ -460,6 +461,7 @@ in {
         "${cfg.package}/lib/systemd/systemd-sulogin-shell"
         "${cfg.package}/lib/systemd/systemd-sysctl"
         "${cfg.package}/lib/systemd/systemd-bsod"
+        "${cfg.package}/lib/systemd/systemd-sysroot-fstab-check"
 
         # generators
         "${cfg.package}/lib/systemd/system-generators/systemd-debug-generator"
@@ -486,7 +488,8 @@ in {
         # fido2 support
         "${cfg.package}/lib/cryptsetup/libcryptsetup-token-systemd-fido2.so"
         "${pkgs.libfido2}/lib/libfido2.so.1"
-      ] ++ jobScripts;
+      ] ++ jobScripts
+      ++ map (c: builtins.removeAttrs c ["text"]) (builtins.attrValues cfg.contents);
 
       targets.initrd.aliases = ["default.target"];
       units =

nixos/modules/system/boot/systemd/journald.nix

@@ -96,6 +96,7 @@ in {
       "systemd-journald@.service"
       "systemd-journal-flush.service"
       "systemd-journal-catalog-update.service"
+      "systemd-journald-sync@.service"
       ] ++ (optional (!config.boot.isContainer) "systemd-journald-audit.socket") ++ [
       "systemd-journald-dev-log.socket"
       "syslog.socket"

nixos/modules/system/boot/systemd/shutdown.nix

@@ -2,10 +2,7 @@
 
   cfg = config.systemd.shutdownRamfs;
 
-  ramfsContents = let
-    storePaths = map (p: "${p}\n") cfg.storePaths;
-    contents = lib.mapAttrsToList (_: v: "${v.source}\n${v.target}") (lib.filterAttrs (_: v: v.enable) cfg.contents);
-  in pkgs.writeText "shutdown-ramfs-contents" (lib.concatStringsSep "\n" (storePaths ++ contents));
+  ramfsContents = pkgs.writeText "shutdown-ramfs-contents.json" (builtins.toJSON cfg.storePaths);
 
 in {
   options.systemd.shutdownRamfs = {
@@ -24,7 +21,7 @@ in {
       description = ''
         Store paths to copy into the shutdown ramfs as well.
       '';
-      type = lib.types.listOf lib.types.singleLineStr;
+      type = utils.systemdUtils.types.initrdStorePath;
       default = [];
     };
   };
@@ -35,7 +32,8 @@ in {
       "/etc/initrd-release".source = config.environment.etc.os-release.source;
       "/etc/os-release".source = config.environment.etc.os-release.source;
     };
-    systemd.shutdownRamfs.storePaths = [pkgs.runtimeShell "${pkgs.coreutils}/bin"];
+    systemd.shutdownRamfs.storePaths = [pkgs.runtimeShell "${pkgs.coreutils}/bin"]
+      ++ map (c: builtins.removeAttrs c ["text"]) (builtins.attrValues cfg.contents);
 
     systemd.mounts = [{
       what = "tmpfs";

nixos/modules/virtualisation/docker.nix

@@ -69,7 +69,7 @@ in
         type = types.bool;
         default = false;
         description = ''
-          **Deprecated**, please use virtualisation.containers.cdi.dynamic.nvidia.enable instead.
+          **Deprecated**, please use hardware.nvidia-container-toolkit.enable instead.
 
           Enable nvidia-docker wrapper, supporting NVIDIA GPUs inside docker containers.
         '';
@@ -186,7 +186,7 @@ in
       # wrappers.
       warnings = lib.optionals (cfg.enableNvidia && (lib.strings.versionAtLeast cfg.package.version "25")) [
         ''
-          You have set virtualisation.docker.enableNvidia. This option is deprecated, please set virtualisation.containers.cdi.dynamic.nvidia.enable instead.
+          You have set virtualisation.docker.enableNvidia. This option is deprecated, please set hardware.nvidia-container-toolkit.enable instead.
         ''
       ];
 

nixos/modules/virtualisation/podman/default.nix

@@ -82,7 +82,7 @@ in
       type = types.bool;
       default = false;
       description = ''
-        **Deprecated**, please use virtualisation.containers.cdi.dynamic.nvidia.enable instead.
+        **Deprecated**, please use hardware.nvidia-container-toolkit.enable instead.
 
         Enable use of NVidia GPUs from within podman containers.
       '';

nixos/tests/all-tests.nix

@@ -275,6 +275,7 @@ in {
   dovecot = handleTest ./dovecot.nix {};
   drawterm = discoverTests (import ./drawterm.nix);
   drbd = handleTest ./drbd.nix {};
+  druid = handleTestOn [ "x86_64-linux" ] ./druid {};
   dublin-traceroute = handleTest ./dublin-traceroute.nix {};
   earlyoom = handleTestOn ["x86_64-linux"] ./earlyoom.nix {};
   early-mount-options = handleTest ./early-mount-options.nix {};
@@ -300,6 +301,7 @@ in {
   esphome = handleTest ./esphome.nix {};
   etc = pkgs.callPackage ../modules/system/etc/test.nix { inherit evalMinimalConfig; };
   activation = pkgs.callPackage ../modules/system/activation/test.nix { };
+  activation-lib = pkgs.callPackage ../modules/system/activation/lib/test.nix { };
   activation-var = runTest ./activation/var.nix;
   activation-nix-channel = runTest ./activation/nix-channel.nix;
   activation-etc-overlay-mutable = runTest ./activation/etc-overlay-mutable.nix;
@@ -623,6 +625,7 @@ in {
   nbd = handleTest ./nbd.nix {};
   ncdns = handleTest ./ncdns.nix {};
   ndppd = handleTest ./ndppd.nix {};
+  nix-channel = pkgs.callPackage ../modules/config/nix-channel/test.nix { };
   nebula = handleTest ./nebula.nix {};
   netbird = handleTest ./netbird.nix {};
   nimdow = handleTest ./nimdow.nix {};

nixos/tests/druid/default.nix

@@ -0,0 +1,289 @@
+{ pkgs, ... }:
+let
+  inherit (pkgs) lib;
+  commonConfig = {
+    "druid.zk.service.host" = "zk1:2181";
+    "druid.extensions.loadList" = ''[ "druid-histogram", "druid-datasketches",  "mysql-metadata-storage", "druid-avro-extensions", "druid-parquet-extensions", "druid-lookups-cached-global", "druid-hdfs-storage","druid-kafka-indexing-service","druid-basic-security","druid-kinesis-indexing-service"]'';
+    "druid.startup.logging.logProperties" = "true";
+    "druid.metadata.storage.connector.connectURI" = "jdbc:mysql://mysql:3306/druid";
+    "druid.metadata.storage.connector.user" = "druid";
+    "druid.metadata.storage.connector.password" = "druid";
+    "druid.request.logging.type" = "file";
+    "druid.request.logging.dir" = "/var/log/druid/requests";
+    "druid.javascript.enabled" = "true";
+    "druid.sql.enable" = "true";
+    "druid.metadata.storage.type" = "mysql";
+    "druid.storage.type" = "hdfs";
+    "druid.storage.storageDirectory" = "/druid-deepstore";
+  };
+  log4jConfig = ''
+    <?xml version="1.0" encoding="UTF-8" ?>
+    <Configuration status="WARN">
+     <Appenders>
+        <Console name="Console" target="SYSTEM_OUT">
+          <PatternLayout pattern="%d{ISO8601} %p [%t] %c - %m%n"/>
+        </Console>
+      </Appenders>
+      <Loggers>
+        <Root level="error">
+          <AppenderRef ref="Console"/>
+        </Root>
+      </Loggers>
+    </Configuration>
+  '';
+  log4j = pkgs.writeText "log4j2.xml" log4jConfig;
+  coreSite = {
+    "fs.defaultFS" = "hdfs://namenode:8020";
+  };
+  tests = {
+    default = testsForPackage {
+      druidPackage = pkgs.druid;
+      hadoopPackage = pkgs.hadoop_3_2;
+    };
+  };
+  testsForPackage =
+    args:
+    lib.recurseIntoAttrs {
+      druidCluster = testDruidCluster args;
+      passthru.override = args': testsForPackage (args // args');
+    };
+  testDruidCluster =
+    { druidPackage, hadoopPackage, ... }:
+    pkgs.testers.nixosTest {
+      name = "druid-hdfs";
+      nodes = {
+        zk1 =
+          { ... }:
+          {
+            services.zookeeper.enable = true;
+            networking.firewall.allowedTCPPorts = [ 2181 ];
+          };
+        namenode =
+          { ... }:
+          {
+            services.hadoop = {
+              package = hadoopPackage;
+              hdfs = {
+                namenode = {
+                  enable = true;
+                  openFirewall = true;
+                  formatOnInit = true;
+                };
+              };
+              inherit coreSite;
+            };
+          };
+        datanode =
+          { ... }:
+          {
+            services.hadoop = {
+              package = hadoopPackage;
+              hdfs.datanode = {
+                enable = true;
+                openFirewall = true;
+              };
+              inherit coreSite;
+            };
+          };
+        mm =
+          { ... }:
+          {
+            virtualisation.memorySize = 1024;
+            services.druid = {
+              inherit commonConfig log4j;
+              package = druidPackage;
+              extraClassPaths = [ "/etc/hadoop-conf" ];
+              middleManager = {
+                config = {
+                  "druid.indexer.task.baseTaskDir" = "/tmp/druid/persistent/task";
+                  "druid.worker.capacity" = 1;
+                  "druid.indexer.logs.type" = "file";
+                  "druid.indexer.logs.directory" = "/var/log/druid/indexer";
+                  "druid.indexer.runner.startPort" = 8100;
+                  "druid.indexer.runner.endPort" = 8101;
+                };
+                enable = true;
+                openFirewall = true;
+              };
+            };
+            services.hadoop = {
+              gatewayRole.enable = true;
+              package = hadoopPackage;
+              inherit coreSite;
+            };
+          };
+        overlord =
+          { ... }:
+          {
+            services.druid = {
+              inherit commonConfig log4j;
+              package = druidPackage;
+              extraClassPaths = [ "/etc/hadoop-conf" ];
+              overlord = {
+                config = {
+                  "druid.indexer.runner.type" = "remote";
+                  "druid.indexer.storage.type" = "metadata";
+                };
+                enable = true;
+                openFirewall = true;
+              };
+            };
+            services.hadoop = {
+              gatewayRole.enable = true;
+              package = hadoopPackage;
+              inherit coreSite;
+            };
+          };
+        broker =
+          { ... }:
+          {
+            services.druid = {
+              package = druidPackage;
+              inherit commonConfig log4j;
+              extraClassPaths = [ "/etc/hadoop-conf" ];
+              broker = {
+                config = {
+                  "druid.plaintextPort" = 8082;
+                  "druid.broker.http.numConnections" = "2";
+                  "druid.server.http.numThreads" = "2";
+                  "druid.processing.buffer.sizeBytes" = "100";
+                  "druid.processing.numThreads" = "1";
+                  "druid.processing.numMergeBuffers" = "1";
+                  "druid.broker.cache.unCacheable" = ''["groupBy"]'';
+                  "druid.lookup.snapshotWorkingDir" = "/opt/broker/lookups";
+                };
+                enable = true;
+                openFirewall = true;
+              };
+            };
+            services.hadoop = {
+              gatewayRole.enable = true;
+              package = hadoopPackage;
+              inherit coreSite;
+            };
+
+          };
+        historical =
+          { ... }:
+          {
+            services.druid = {
+              package = druidPackage;
+              inherit commonConfig log4j;
+              extraClassPaths = [ "/etc/hadoop-conf" ];
+              historical = {
+                config = {
+                  "maxSize" = 200000000;
+                  "druid.lookup.snapshotWorkingDir" = "/opt/historical/lookups";
+                };
+                segmentLocations = [
+                  {
+                    "path" = "/tmp/1";
+                    "maxSize" = "100000000";
+                  }
+                  {
+                    "path" = "/tmp/2";
+                    "maxSize" = "100000000";
+                  }
+                ];
+                enable = true;
+                openFirewall = true;
+              };
+            };
+            services.hadoop = {
+              gatewayRole.enable = true;
+              package = hadoopPackage;
+              inherit coreSite;
+            };
+
+          };
+        coordinator =
+          { ... }:
+          {
+            services.druid = {
+              package = druidPackage;
+              inherit commonConfig log4j;
+              extraClassPaths = [ "/etc/hadoop-conf" ];
+              coordinator = {
+                config = {
+                  "druid.plaintextPort" = 9091;
+                  "druid.service" = "coordinator";
+                  "druid.coordinator.startDelay" = "PT10S";
+                  "druid.coordinator.period" = "PT10S";
+                  "druid.manager.config.pollDuration" = "PT10S";
+                  "druid.manager.segments.pollDuration" = "PT10S";
+                  "druid.manager.rules.pollDuration" = "PT10S";
+                };
+                enable = true;
+                openFirewall = true;
+              };
+            };
+            services.hadoop = {
+              gatewayRole.enable = true;
+              package = hadoopPackage;
+              inherit coreSite;
+            };
+
+          };
+
+        mysql =
+          { ... }:
+          {
+            services.mysql = {
+              enable = true;
+              package = pkgs.mariadb;
+              initialDatabases = [ { name = "druid"; } ];
+              initialScript = pkgs.writeText "mysql-init.sql" ''
+                CREATE USER 'druid'@'%' IDENTIFIED BY 'druid';
+                GRANT ALL PRIVILEGES ON druid.* TO 'druid'@'%';
+              '';
+            };
+            networking.firewall.allowedTCPPorts = [ 3306 ];
+          };
+
+      };
+      testScript = ''
+        start_all()
+        namenode.wait_for_unit("hdfs-namenode")
+        namenode.wait_for_unit("network.target")
+        namenode.wait_for_open_port(8020)
+        namenode.succeed("ss -tulpne | systemd-cat")
+        namenode.succeed("cat /etc/hadoop*/hdfs-site.xml | systemd-cat")
+        namenode.wait_for_open_port(9870)
+        datanode.wait_for_unit("hdfs-datanode")
+        datanode.wait_for_unit("network.target")
+
+        mm.succeed("mkdir -p /quickstart/")
+        mm.succeed("cp -r ${pkgs.druid}/quickstart/* /quickstart/")
+        mm.succeed("touch /quickstart/tutorial/wikiticker-2015-09-12-sampled.json")
+        mm.succeed("zcat /quickstart/tutorial/wikiticker-2015-09-12-sampled.json.gz | head -n 10 > /quickstart/tutorial/wikiticker-2015-09-12-sampled.json || true")
+        mm.succeed("rm /quickstart/tutorial/wikiticker-2015-09-12-sampled.json.gz && gzip /quickstart/tutorial/wikiticker-2015-09-12-sampled.json")
+
+        namenode.succeed("sudo -u hdfs hdfs dfs -mkdir /druid-deepstore")
+        namenode.succeed("HADOOP_USER_NAME=druid sudo -u hdfs hdfs dfs -chown druid:hadoop /druid-deepstore")
+
+
+        ### Druid tests
+        coordinator.wait_for_unit("druid-coordinator")
+        overlord.wait_for_unit("druid-overlord")
+        historical.wait_for_unit("druid-historical")
+        mm.wait_for_unit("druid-middleManager")
+
+        coordinator.wait_for_open_port(9091)
+        overlord.wait_for_open_port(8090)
+        historical.wait_for_open_port(8083)
+        mm.wait_for_open_port(8091)
+
+        broker.wait_for_unit("network.target")
+        broker.wait_for_open_port(8082)
+
+        broker.succeed("curl -X 'POST' -H 'Content-Type:application/json' -d @${pkgs.druid}/quickstart/tutorial/wikipedia-index.json http://coordinator:9091/druid/indexer/v1/task")
+        broker.wait_until_succeeds("curl http://coordinator:9091/druid/coordinator/v1/metadata/datasources | grep  'wikipedia'")
+
+        broker.wait_until_succeeds("curl http://localhost:8082/druid/v2/datasources/ | grep wikipedia")
+        broker.succeed("curl -X 'POST' -H 'Content-Type:application/json' -d @${pkgs.druid}/quickstart/tutorial/wikipedia-top-pages.json http://localhost:8082/druid/v2/")
+
+      '';
+
+    };
+in
+tests

nixos/tests/installer.nix

@@ -463,7 +463,32 @@ let
         """)
 
       with subtest("Switch to flake based config"):
-        target.succeed("nixos-rebuild switch --flake /root/my-config#xyz")
+        target.succeed("nixos-rebuild switch --flake /root/my-config#xyz 2>&1 | tee activation-log >&2")
+
+        target.succeed("""
+          cat -n activation-log >&2
+        """)
+
+        target.succeed("""
+          grep -F '/root/.nix-defexpr/channels exists, but channels have been disabled.' activation-log
+        """)
+        target.succeed("""
+          grep -F '/nix/var/nix/profiles/per-user/root/channels exists, but channels have been disabled.' activation-log
+        """)
+        target.succeed("""
+          grep -F '/root/.nix-defexpr/channels exists, but channels have been disabled.' activation-log
+        """)
+        target.succeed("""
+          grep -F 'Due to https://github.com/NixOS/nix/issues/9574, Nix may still use these channels when NIX_PATH is unset.' activation-log
+        """)
+        target.succeed("rm activation-log")
+
+        # Perform the suggested cleanups we've just seen in the log
+        # TODO after https://github.com/NixOS/nix/issues/9574: don't remove them yet
+        target.succeed("""
+          rm -rf /root/.nix-defexpr/channels /nix/var/nix/profiles/per-user/root/channels /root/.nix-defexpr/channels
+        """)
+
 
       target.shutdown()
 
@@ -474,10 +499,20 @@ let
 
       # Note that the channel profile is still present on disk, but configured
       # not to be used.
-      with subtest("builtins.nixPath is now empty"):
-        target.succeed("""
-          [[ "[ ]" == "$(nix-instantiate builtins.nixPath --eval --expr)" ]]
-        """)
+      # TODO after issue https://github.com/NixOS/nix/issues/9574: re-enable this assertion
+      # I believe what happens is
+      #   - because of the issue, we've removed the `nix-path =` line from nix.conf
+      #   - the "backdoor" shell is not a proper session and does not have `NIX_PATH=""` set
+      #   - seeing no nix path settings at all, Nix loads its hardcoded default value,
+      #     which is unfortunately non-empty
+      # Or maybe it's the new default NIX_PATH?? :(
+      # with subtest("builtins.nixPath is now empty"):
+      #   target.succeed("""
+      #     (
+      #       set -x;
+      #       [[ "[ ]" == "$(nix-instantiate builtins.nixPath --eval --expr)" ]];
+      #     )
+      #   """)
 
       with subtest("<nixpkgs> does not resolve"):
         target.succeed("""
@@ -491,12 +526,16 @@ let
         target.succeed("""
           (
             exec 1>&2
-            rm -v /root/.nix-channels
+            rm -vf /root/.nix-channels
             rm -vrf ~/.nix-defexpr
             rm -vrf /nix/var/nix/profiles/per-user/root/channels*
           )
         """)
-        target.succeed("nixos-rebuild switch --flake /root/my-config#xyz")
+        target.succeed("nixos-rebuild switch --flake /root/my-config#xyz | tee activation-log >&2")
+        target.succeed("cat -n activation-log >&2")
+        target.succeed("! grep -F '/root/.nix-defexpr/channels' activation-log")
+        target.succeed("! grep -F 'but channels have been disabled' activation-log")
+        target.succeed("! grep -F 'https://github.com/NixOS/nix/issues/9574' activation-log")
 
       target.shutdown()
     '';

nixos/tests/rosenpass.nix

@@ -44,7 +44,8 @@ in
           enable = true;
           networks."rosenpass" = {
             matchConfig.Name = deviceName;
-            networkConfig.IPForward = true;
+            networkConfig.IPv4Forwarding = true;
+            networkConfig.IPv6Forwarding = true;
             address = [ "${peer.ip}/64" ];
           };
 

nixos/tests/systemd-boot.nix

@@ -235,8 +235,10 @@ rec {
       """
       )
 
-      output = machine.succeed("/run/current-system/bin/switch-to-configuration boot")
+      output = machine.succeed("/run/current-system/bin/switch-to-configuration boot 2>&1")
       assert "updating systemd-boot from 000.0-1-notnixos to " in output, "Couldn't find systemd-boot update message"
+      assert 'to "/boot/EFI/systemd/systemd-bootx64.efi"' in output, "systemd-boot not copied to to /boot/EFI/systemd/systemd-bootx64.efi"
+      assert 'to "/boot/EFI/BOOT/BOOTX64.EFI"' in output, "systemd-boot not copied to to /boot/EFI/BOOT/BOOTX64.EFI"
     '';
   };
 

nixos/tests/systemd-networkd-dhcpserver-static-leases.nix

@@ -24,8 +24,6 @@ import ./make-test-python.nix ({ lib, ... }: {
           "01-eth1" = {
             name = "eth1";
             networkConfig = {
-              # IPForward prevents dynamic address configuration
-              IPForward = true;
               DHCPServer = true;
               Address = "10.0.0.1/24";
             };

nixos/tests/systemd-networkd-ipv6-prefix-delegation.nix

@@ -40,7 +40,8 @@ import ./make-test-python.nix ({ pkgs, lib, ... }: {
             address = [
               "2001:DB8::1/64"
             ];
-            networkConfig.IPForward = true;
+            networkConfig.IPv4Forwarding = true;
+            networkConfig.IPv6Forwarding = true;
           };
         };
       };

nixos/tests/systemd-networkd-vrf.nix

@@ -16,7 +16,8 @@ import ./make-test-python.nix ({ pkgs, lib, ... }: let
         linkConfig.RequiredForOnline = "no";
         networkConfig = {
           Address = "192.168.${toString vlan}.${toString id}/24";
-          IPForward = "yes";
+          IPv4Forwarding = "yes";
+          IPv6Forwarding = "yes";
         };
       };
     };
@@ -57,14 +58,16 @@ in {
 
         networks."10-vrf1" = {
           matchConfig.Name = "vrf1";
-          networkConfig.IPForward = "yes";
+          networkConfig.IPv4Forwarding = "yes";
+          networkConfig.IPv6Forwarding = "yes";
           routes = [
             { Destination = "192.168.1.2"; Metric = 100; }
           ];
         };
         networks."10-vrf2" = {
           matchConfig.Name = "vrf2";
-          networkConfig.IPForward = "yes";
+          networkConfig.IPv4Forwarding = "yes";
+          networkConfig.IPv6Forwarding = "yes";
           routes = [
             { Destination = "192.168.2.3"; Metric = 100; }
           ];
@@ -76,7 +79,8 @@ in {
           networkConfig = {
             VRF = "vrf1";
             Address = "192.168.1.1/24";
-            IPForward = "yes";
+            IPv4Forwarding = "yes";
+            IPv6Forwarding = "yes";
           };
         };
         networks."10-eth2" = {
@@ -85,7 +89,8 @@ in {
           networkConfig = {
             VRF = "vrf2";
             Address = "192.168.2.1/24";
-            IPForward = "yes";
+            IPv4Forwarding = "yes";
+            IPv6Forwarding = "yes";
           };
         };
       };

nixos/tests/systemd.nix

@@ -204,8 +204,7 @@ import ./make-test-python.nix ({ pkgs, ... }: {
         assert "0B read, 0B written" not in output
 
     with subtest("systemd per-unit accounting works"):
-        assert "IP traffic received: 84B" in output_ping
-        assert "IP traffic sent: 84B" in output_ping
+        assert "IP traffic received: 84B sent: 84B" in output_ping
 
     with subtest("systemd environment is properly set"):
         machine.systemctl("daemon-reexec")  # Rewrites /proc/1/environ

pkgs/applications/accessibility/dasher/default.nix

@@ -15,7 +15,7 @@
 , libxslt
 , libxml2
 , speechSupport ? true
-, speechd
+, speechd-minimal
 }:
 
 stdenv.mkDerivation {
@@ -56,7 +56,7 @@ stdenv.mkDerivation {
     # at-spi2 needs dbus to be recognized by pkg-config
     at-spi2-core
     dbus
-  ] ++ lib.optional speechSupport speechd;
+  ] ++ lib.optional speechSupport speechd-minimal;
 
   enableParallelBuilding = true;
 

pkgs/applications/audio/bitwig-studio/bitwig-studio5.nix

@@ -21,6 +21,7 @@
 , pulseaudio
 , vulkan-loader
 , wrapGAppsHook3
+, xcb-imdkit
 , xdg-utils
 , xorg
 , zlib
@@ -68,6 +69,7 @@ stdenv.mkDerivation rec {
     pulseaudio
     stdenv.cc.cc.lib
     vulkan-loader
+    xcb-imdkit
     xcbutil
     xcbutilwm
     zlib
@@ -80,6 +82,11 @@ stdenv.mkDerivation rec {
     cp -r opt/bitwig-studio $out/libexec
     ln -s $out/libexec/bitwig-studio $out/bin/bitwig-studio
     cp -r usr/share $out/share
+
+    # Bitwig includes a copy of libxcb-imdkit.
+    # Removing it will force it to use our version.
+    rm $out/libexec/lib/bitwig-studio/libxcb-imdkit.so.1
+
     substitute usr/share/applications/com.bitwig.BitwigStudio.desktop \
       $out/share/applications/com.bitwig.BitwigStudio.desktop \
       --replace /usr/bin/bitwig-studio $out/bin/bitwig-studio

pkgs/applications/audio/dexed/default.nix

@@ -34,7 +34,6 @@ stdenv.mkDerivation rec {
 
   postPatch = ''
     # needs special setup on Linux, dunno if it can work on Darwin
-    # https://github.com/NixOS/nixpkgs/issues/19098
     sed -i -e '/juce::juce_recommended_lto_flags/d' Source/CMakeLists.txt
   '';
 

pkgs/applications/audio/fire/default.nix

@@ -49,7 +49,6 @@ stdenv.mkDerivation rec {
   postPatch = ''
     # 1. Remove hardcoded LTO flags: needs extra setup on Linux,
     #    possibly broken on Darwin
-    #    https://github.com/NixOS/nixpkgs/issues/19098
     # 2. Disable automatic copying of built plugins during buildPhase, it defaults
     #    into user home and we want to have building & installing separated.
     sed -i \

pkgs/applications/audio/librespot/default.nix

@@ -26,7 +26,7 @@ rustPlatform.buildRustPackage rec {
     sha256 = "sha256-DtF6asSlLdC2m/0JTBo4YUx9HgsojpfiqVdqaIwniKA=";
   };
 
-  cargoSha256 = "sha256-tbDlWP0sUIa0W9HhdYNOvo9cGeqFemclhA7quh7f/Rw=";
+  cargoHash = "sha256-tbDlWP0sUIa0W9HhdYNOvo9cGeqFemclhA7quh7f/Rw=";
 
   nativeBuildInputs = [ pkg-config makeWrapper ] ++ lib.optionals stdenv.isDarwin [
     rustPlatform.bindgenHook

pkgs/applications/audio/mbrola/default.nix

@@ -1,4 +1,4 @@
-{ stdenv, lib, fetchFromGitHub, runCommandLocal }:
+{ stdenv, lib, fetchFromGitHub, runCommandLocal, mbrola-voices }:
 
 let
   pname = "mbrola";
@@ -12,20 +12,6 @@ let
     homepage = "https://github.com/numediart/MBROLA";
   };
 
-  # Very big (0.65 G) so kept as a fixed-output derivation to limit "duplicates".
-  voices = fetchFromGitHub {
-    owner = "numediart";
-    repo = "MBROLA-voices";
-    rev = "fe05a0ccef6a941207fd6aaad0b31294a1f93a51";  # using latest commit
-    sha256 = "1w0y2xjp9rndwdjagp2wxh656mdm3d6w9cs411g27rjyfy1205a0";
-
-    name = "${pname}-voices-${version}";
-    meta = meta // {
-      description = "Speech synthesizer based on the concatenation of diphones (voice files)";
-      homepage = "https://github.com/numediart/MBROLA-voices";
-    };
-  };
-
   bin = stdenv.mkDerivation {
     pname = "${pname}-bin";
     inherit version;
@@ -60,7 +46,7 @@ in
     }
     ''
       mkdir -p "$out/share/mbrola"
-      ln -s '${voices}/data' "$out/share/mbrola/voices"
+      ln -s '${mbrola-voices}/data' "$out/share/mbrola/voices"
       ln -s '${bin}/bin' "$out/"
     ''
 

pkgs/applications/audio/mbrola/voices.nix

@@ -0,0 +1,51 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  unstableGitUpdater,
+  mbrola,
+  languages ? [ ],
+}:
+
+let
+  src = fetchFromGitHub {
+    owner = "numediart";
+    repo = "MBROLA-voices";
+    rev = "fe05a0ccef6a941207fd6aaad0b31294a1f93a51";
+    hash = "sha256-QBUggnde5iNeCESzxE0btVVTDOxc3Kdk483mdGUXHvA=";
+  };
+
+  meta = {
+    description = "Speech synthesizer based on the concatenation of diphones (voice files)";
+    homepage = "https://github.com/numediart/MBROLA-voices";
+    license = mbrola.meta.license;
+  };
+in
+
+if (languages == [ ]) then
+  src // { inherit meta; }
+else
+  stdenv.mkDerivation {
+    pname = "mbrola-voices";
+    version = "0-unstable-2020-03-30";
+
+    inherit src;
+
+    postPatch = ''
+      shopt -s extglob
+      pushd data
+      rm -rfv !(${lib.concatStringsSep "|" languages})
+      popd
+    '';
+
+    installPhase = ''
+      runHook preInstall
+
+      mkdir $out
+      cp -R data $out/
+
+      runHook postInstall
+    '';
+
+    inherit meta;
+  }

pkgs/applications/audio/mmtc/default.nix

@@ -11,7 +11,7 @@ rustPlatform.buildRustPackage rec {
     sha256 = "sha256-gs6uytX4rm2JrJ4UbtHJDg+b+Z1ZjcsuUR0b13jQIy4=";
   };
 
-  cargoSha256 = "sha256-7zV/AsSZHk99ROC1301nkwJ22dvh4afeCI//G1zWHu8=";
+  cargoHash = "sha256-7zV/AsSZHk99ROC1301nkwJ22dvh4afeCI//G1zWHu8=";
 
   nativeBuildInputs = [ installShellFiles ];
 

pkgs/applications/audio/pulseeffects-legacy/default.nix

@@ -99,11 +99,6 @@ in stdenv.mkDerivation rec {
     )
   '';
 
-  # Meson is no longer able to pick up Boost automatically.
-  # https://github.com/NixOS/nixpkgs/issues/86131
-  BOOST_INCLUDEDIR = "${lib.getDev boost}/include";
-  BOOST_LIBRARYDIR = "${lib.getLib boost}/lib";
-
   meta = with lib; {
     description = "Limiter, compressor, reverberation, equalizer and auto volume effects for Pulseaudio applications";
     mainProgram = "pulseeffects";

pkgs/applications/audio/rhvoice/default.nix

@@ -7,7 +7,7 @@
 , glibmm
 , libpulseaudio
 , libao
-, speechd
+, speechd-minimal
 }:
 
 stdenv.mkDerivation rec {
@@ -42,7 +42,7 @@ stdenv.mkDerivation rec {
     glibmm
     libpulseaudio
     libao
-    speechd
+    speechd-minimal
   ];
 
   meta = {

pkgs/applications/audio/sonobus/default.nix

@@ -61,7 +61,6 @@ stdenv.mkDerivation (finalAttrs: {
 
   postPatch = lib.optionalString (stdenv.isLinux) ''
     # needs special setup on Linux, dunno if it can work on Darwin
-    # https://github.com/NixOS/nixpkgs/issues/19098
     # Also, I get issues with linking without that, not sure why
     sed -i -e '/juce::juce_recommended_lto_flags/d' CMakeLists.txt
     patchShebangs linux/install.sh

pkgs/applications/audio/tenacity/default.nix

@@ -29,7 +29,7 @@
 , expat
 , libid3tag
 , libopus
-, ffmpeg_5
+, ffmpeg
 , soundtouch
 , pcre
 , portaudio
@@ -104,7 +104,7 @@ stdenv.mkDerivation rec {
   buildInputs = [
     alsa-lib
     expat
-    ffmpeg_5
+    ffmpeg
     file
     flac
     glib

pkgs/applications/blockchains/clightning/default.nix

@@ -1,5 +1,6 @@
 { lib
 , stdenv
+, cctools
 , darwin
 , fetchurl
 , autoconf
@@ -30,11 +31,11 @@ stdenv.mkDerivation rec {
     hash = "sha256-FD7JFM80wrruqBWjYnJHZh2f2GZJ6XDQmUQ0XetnWBg=";
   };
 
-  # when building on darwin we need dawin.cctools to provide the correct libtool
+  # when building on darwin we need cctools to provide the correct libtool
   # as libwally-core detects the host as darwin and tries to add the -static
   # option to libtool, also we have to add the modified gsed package.
   nativeBuildInputs = [ autoconf autogen automake gettext libtool lowdown protobuf py3 unzip which ]
-    ++ lib.optionals stdenv.isDarwin [ darwin.cctools darwin.autoSignDarwinBinariesHook ];
+    ++ lib.optionals stdenv.isDarwin [ cctools darwin.autoSignDarwinBinariesHook ];
 
   buildInputs = [ gmp libsodium sqlite zlib jq ];
 

pkgs/applications/blockchains/miniscript/default.nix

@@ -18,12 +18,8 @@ stdenv.mkDerivation rec {
     postPatch = lib.optionalString stdenv.isDarwin ''
     # Replace hardcoded g++ with c++ so clang can be used
     # on darwin
-    #
-    # lto must be disabled on darwin as well due to
-    # https://github.com/NixOS/nixpkgs/issues/19098
     substituteInPlace Makefile \
-        --replace-fail 'g++' 'c++' \
-        --replace-fail '-flto' ""
+        --replace-fail 'g++' 'c++'
   '';
 
   installPhase = ''

pkgs/applications/display-managers/greetd/tuigreet.nix

@@ -14,7 +14,7 @@ rustPlatform.buildRustPackage rec {
     sha256 = "sha256-e0YtpakEaaWdgu+bMr2VFoUc6+SUMFk4hYtSyk5aApY=";
   };
 
-  cargoSha256 = "sha256-RkJjAmZ++4nc/lLh8g0LxGq2DjZGxQEjFOl8Yzx116A=";
+  cargoHash = "sha256-RkJjAmZ++4nc/lLh8g0LxGq2DjZGxQEjFOl8Yzx116A=";
 
   meta = {
     description = "Graphical console greeter for greetd";

pkgs/applications/editors/ed/default.nix

@@ -1,14 +0,0 @@
-{ lib, pkgs }:
-
-lib.makeScope pkgs.newScope (self:
-  let
-    inherit (self) callPackage;
-  in {
-    sources = import ./sources.nix {
-      inherit lib;
-      inherit (pkgs) fetchurl;
-    };
-
-    ed = callPackage (self.sources.ed) { };
-    edUnstable = callPackage (self.sources.edUnstable) { };
-  })

pkgs/applications/editors/ed/generic.nix

@@ -1,32 +0,0 @@
-{ pname
-, version
-, src
-, patches ? [ ]
-, meta
-}:
-
-# Note: this package is used for bootstrapping fetchurl, and thus cannot use
-# fetchpatch! All mutable patches (generated by GitHub or cgit) that are needed
-# here should be included directly in Nixpkgs as files.
-
-{ lib
-, stdenv
-, fetchurl
-, lzip
-, runtimeShellPackage
-}:
-
-stdenv.mkDerivation {
-  inherit pname version src patches;
-
-  nativeBuildInputs = [ lzip ];
-  buildInputs = [ runtimeShellPackage ];
-
-  configureFlags = [
-    "CC=${stdenv.cc.targetPrefix}cc"
-  ];
-
-  doCheck = true;
-
-  inherit meta;
-}

pkgs/applications/editors/ed/sources.nix

@@ -1,45 +0,0 @@
-{ lib
-, fetchurl
-}:
-
-let
-  meta = {
-    description = "GNU implementation of the standard Unix editor";
-    longDescription = ''
-      GNU ed is a line-oriented text editor. It is used to create, display,
-      modify and otherwise manipulate text files, both interactively and via
-      shell scripts. A restricted version of ed, red, can only edit files in the
-      current directory and cannot execute shell commands. Ed is the 'standard'
-      text editor in the sense that it is the original editor for Unix, and thus
-      widely available. For most purposes, however, it is superseded by
-      full-screen editors such as GNU Emacs or GNU Moe.
-    '';
-    license = lib.licenses.gpl3Plus;
-    homepage = "https://www.gnu.org/software/ed/";
-    maintainers = with lib.maintainers; [ AndersonTorres ];
-    platforms = lib.platforms.unix;
-  };
-in
-{
-  ed = let
-    pname = "ed";
-    version = "1.20.2";
-    src = fetchurl {
-      url = "mirror://gnu/ed/ed-${version}.tar.lz";
-      hash = "sha256-Zf7HMY9IwsoX8zSsD0cD3v5iA3uxPMI5IN4He1+iRSM=";
-    };
-  in import ./generic.nix {
-    inherit pname version src meta;
-  };
-
-  edUnstable = let
-    pname = "ed";
-    version = "1.20-pre2";
-    src = fetchurl {
-      url = "http://download.savannah.gnu.org/releases/ed/ed-${version}.tar.lz";
-      hash = "sha256-bHTDeMhVNNo3qqDNoBNaBA+DHDa4WJpfQNcTvAUPgsY=";
-    };
-  in import ./generic.nix {
-    inherit pname version src meta;
-  };
-}

pkgs/applications/editors/emacs/build-support/generic.nix

@@ -31,6 +31,8 @@ in
 , propagatedUserEnvPkgs ? []
 , postInstall ? ""
 , meta ? {}
+, turnCompilationWarningToError ? false
+, ignoreCompilationError ? true
 , ...
 }@args:
 
@@ -77,6 +79,8 @@ stdenv.mkDerivation (finalAttrs: ({
 
   addEmacsNativeLoadPath = true;
 
+  inherit turnCompilationWarningToError ignoreCompilationError;
+
   postInstall = ''
     # Besides adding the output directory to the native load path, make sure
     # the current package's elisp files are in the load path, otherwise
@@ -86,8 +90,13 @@ stdenv.mkDerivation (finalAttrs: ({
     addEmacsVars "$out"
 
     find $out/share/emacs -type f -name '*.el' -print0 \
-      | xargs -0 -I {} -n 1 -P $NIX_BUILD_CORES sh -c \
-          "emacs --batch --eval '(setq large-file-warning-threshold nil)' -f batch-native-compile {} || true"
+      | xargs --verbose -0 -I {} -n 1 -P $NIX_BUILD_CORES sh -c \
+          "emacs \
+             --batch \
+             --eval '(setq large-file-warning-threshold nil)' \
+             --eval '(setq byte-compile-error-on-warn ${if finalAttrs.turnCompilationWarningToError then "t" else "nil"})' \
+             -f batch-native-compile {} \
+           || exit ${if finalAttrs.ignoreCompilationError then "0" else "\\$?"}"
   '' + postInstall;
 }
 

pkgs/applications/editors/emacs/elisp-packages/elpa-devel-packages.nix

@@ -64,26 +64,6 @@ self: let
         '';
       });
 
-      org = super.org.overrideAttrs (old: {
-        dontUnpack = false;
-        patches = old.patches or [ ] ++ lib.optionals (lib.versionOlder old.version "9.7.5") [
-          # security fix backported from 9.7.5
-          (pkgs.fetchpatch {
-            url = "https://git.savannah.gnu.org/cgit/emacs/org-mode.git/patch/?id=f4cc61636947b5c2f0afc67174dd369fe3277aa8";
-            hash = "sha256-bGgsnTSn6SMu1J8P2BfJjrKx2845FCsUB2okcIrEjDg=";
-            stripLen = 1;
-          })
-        ];
-        postPatch = old.postPatch or "" + "\n" + ''
-          pushd ..
-          local content_directory=${old.ename}-${old.version}
-          src=$PWD/$content_directory.tar
-          tar --create --verbose --file=$src $content_directory
-          popd
-        '';
-        dontBuild = true;
-      });
-
       pq = super.pq.overrideAttrs (old: {
         buildInputs = (old.buildInputs or [ ]) ++ [ pkgs.postgresql ];
       });

pkgs/applications/editors/emacs/elisp-packages/elpa-generated.nix

@@ -295,10 +295,10 @@
       elpaBuild {
         pname = "auctex";
         ename = "auctex";
-        version = "14.0.5";
+        version = "14.0.6";
         src = fetchurl {
-          url = "https://elpa.gnu.org/packages/auctex-14.0.5.tar";
-          sha256 = "0sycj6ad5jazmsxq37hsnvbywkpj66lrw3d3mxqr1wqkb67cdd3k";
+          url = "https://elpa.gnu.org/packages/auctex-14.0.6.tar";
+          sha256 = "0cajri7x6770wjkrasa0p2s0dvcp74fpv1znac5wdfiwhvl1i9yr";
         };
         packageRequires = [ emacs ];
         meta = {
@@ -306,6 +306,44 @@
           license = lib.licenses.free;
         };
       }) {};
+    auctex-cont-latexmk = callPackage ({ auctex
+                                       , elpaBuild
+                                       , emacs
+                                       , fetchurl
+                                       , lib }:
+      elpaBuild {
+        pname = "auctex-cont-latexmk";
+        ename = "auctex-cont-latexmk";
+        version = "0.2";
+        src = fetchurl {
+          url = "https://elpa.gnu.org/packages/auctex-cont-latexmk-0.2.tar";
+          sha256 = "0ggyjxjqwpx3h1963i8w96m6kisc65ni9hksn2kjfjddnj1hx0hf";
+        };
+        packageRequires = [ auctex emacs ];
+        meta = {
+          homepage = "https://elpa.gnu.org/packages/auctex-cont-latexmk.html";
+          license = lib.licenses.free;
+        };
+      }) {};
+    auctex-label-numbers = callPackage ({ auctex
+                                        , elpaBuild
+                                        , emacs
+                                        , fetchurl
+                                        , lib }:
+      elpaBuild {
+        pname = "auctex-label-numbers";
+        ename = "auctex-label-numbers";
+        version = "0.2";
+        src = fetchurl {
+          url = "https://elpa.gnu.org/packages/auctex-label-numbers-0.2.tar";
+          sha256 = "1cd68yvpm061r9k4x6rvy3g2wdynv5gbjg2dyp06nkrgvakdb00x";
+        };
+        packageRequires = [ auctex emacs ];
+        meta = {
+          homepage = "https://elpa.gnu.org/packages/auctex-label-numbers.html";
+          license = lib.licenses.free;
+        };
+      }) {};
     aumix-mode = callPackage ({ elpaBuild, fetchurl, lib }:
       elpaBuild {
         pname = "aumix-mode";
@@ -824,10 +862,10 @@
       elpaBuild {
         pname = "colorful-mode";
         ename = "colorful-mode";
-        version = "1.0.0";
+        version = "1.0.4";
         src = fetchurl {
-          url = "https://elpa.gnu.org/packages/colorful-mode-1.0.0.tar";
-          sha256 = "1gmbrb5z3rmw0fjrdymfbcx74szcy963dx53ksykvfd9355azj3x";
+          url = "https://elpa.gnu.org/packages/colorful-mode-1.0.4.tar";
+          sha256 = "0vy1rqv9aknns81v97j6dwr621hbs0489p7bhpg7k7qva39i97vs";
         };
         packageRequires = [ compat emacs ];
         meta = {
@@ -937,10 +975,10 @@
       elpaBuild {
         pname = "compat";
         ename = "compat";
-        version = "29.1.4.5";
+        version = "30.0.0.0";
         src = fetchurl {
-          url = "https://elpa.gnu.org/packages/compat-29.1.4.5.tar";
-          sha256 = "0i57hs3ak5y0fsfdwg87ib64ny0ar1nk67f5dy2qrm8x3i0h086s";
+          url = "https://elpa.gnu.org/packages/compat-30.0.0.0.tar";
+          sha256 = "0z7049xkdyx22ywq821d19lp73ywaz6brxj461h0h2a73y7999cl";
         };
         packageRequires = [ emacs seq ];
         meta = {
@@ -952,10 +990,10 @@
       elpaBuild {
         pname = "consult";
         ename = "consult";
-        version = "1.6";
+        version = "1.7";
         src = fetchurl {
-          url = "https://elpa.gnu.org/packages/consult-1.6.tar";
-          sha256 = "00wsv6dvlyf7ygi586pdyhgp7f5ic2qqyqjz3g2g8hmgya5javdb";
+          url = "https://elpa.gnu.org/packages/consult-1.7.tar";
+          sha256 = "02ji5yxa92jj7chs6al5amjdag1waz2sngbbk45mgg9nv81b4d3c";
         };
         packageRequires = [ compat emacs ];
         meta = {
@@ -972,10 +1010,10 @@
       elpaBuild {
         pname = "consult-denote";
         ename = "consult-denote";
-        version = "0.0.0";
+        version = "0.1.1";
         src = fetchurl {
-          url = "https://elpa.gnu.org/packages/consult-denote-0.0.0.tar";
-          sha256 = "191qf8knrmimam98jv8kgrl6mfrnwpdmw160s5qw6wcik7j4z6kv";
+          url = "https://elpa.gnu.org/packages/consult-denote-0.1.1.tar";
+          sha256 = "0yhf9fifas87rs4wdapszbpx1xqyq44izjq7vzpyvdlh5a5fhhx1";
         };
         packageRequires = [ consult denote emacs ];
         meta = {
@@ -1036,10 +1074,10 @@
       elpaBuild {
         pname = "corfu";
         ename = "corfu";
-        version = "1.3";
+        version = "1.4";
         src = fetchurl {
-          url = "https://elpa.gnu.org/packages/corfu-1.3.tar";
-          sha256 = "13y0dws1k4682v039ab6b0xxqlg7anknscqs20bmj8lfm2z48znx";
+          url = "https://elpa.gnu.org/packages/corfu-1.4.tar";
+          sha256 = "0jsxrs08zwbwb1mzn8a2ja3wr2w34cx8ca09l4fz05labv7p7i85";
         };
         packageRequires = [ compat emacs ];
         meta = {
@@ -1156,10 +1194,10 @@
       elpaBuild {
         pname = "csv-mode";
         ename = "csv-mode";
-        version = "1.23";
+        version = "1.25";
         src = fetchurl {
-          url = "https://elpa.gnu.org/packages/csv-mode-1.23.tar";
-          sha256 = "0b5qcxdp7y78mfgcvh9plfc0l5qbwsvrj1bswyimrzg210zhk4zm";
+          url = "https://elpa.gnu.org/packages/csv-mode-1.25.tar";
+          sha256 = "15yhhn742fqq7699i6jsimg3gpifrhhybiav1qwwzq4prmk9g984";
         };
         packageRequires = [ cl-lib emacs ];
         meta = {
@@ -1201,10 +1239,10 @@
       elpaBuild {
         pname = "dape";
         ename = "dape";
-        version = "0.11.1";
+        version = "0.13.0";
         src = fetchurl {
-          url = "https://elpa.gnu.org/packages/dape-0.11.1.tar";
-          sha256 = "0i04wwklypzxh78gwd9zjxjm3lwi2sn7qpqnlgd6n8hhcigyzhp0";
+          url = "https://elpa.gnu.org/packages/dape-0.13.0.tar";
+          sha256 = "1zzghp73yh1vl9vf3njkqyhh6vmmx6klnd9z37p62467bd19wr8a";
         };
         packageRequires = [ emacs jsonrpc ];
         meta = {
@@ -1291,10 +1329,10 @@
       elpaBuild {
         pname = "denote";
         ename = "denote";
-        version = "2.3.5";
+        version = "3.0.6";
         src = fetchurl {
-          url = "https://elpa.gnu.org/packages/denote-2.3.5.tar";
-          sha256 = "1l8nlr8q7c51j2f528a0568pa3ywfv8pr47fzpd6pk2scc0y372b";
+          url = "https://elpa.gnu.org/packages/denote-3.0.6.tar";
+          sha256 = "1wq44r4j624hiwpyzkrrbk998321wzj7x45y9rwy4gpi8f6xi1nv";
         };
         packageRequires = [ emacs ];
         meta = {
@@ -1537,10 +1575,10 @@
       elpaBuild {
         pname = "do-at-point";
         ename = "do-at-point";
-        version = "0.1.1";
+        version = "0.1.2";
         src = fetchurl {
-          url = "https://elpa.gnu.org/packages/do-at-point-0.1.1.tar";
-          sha256 = "1lqnarb9jiig85j3dv37jsqkmmfbcwb52i2akimzf9r57pypiylk";
+          url = "https://elpa.gnu.org/packages/do-at-point-0.1.2.tar";
+          sha256 = "0kirhg78ra6311hx1f1kpqhpxjxxg61gnzsh9j6id10f92h6m5gz";
         };
         packageRequires = [ emacs ];
         meta = {
@@ -1702,10 +1740,10 @@
       elpaBuild {
         pname = "eev";
         ename = "eev";
-        version = "20240513";
+        version = "20240710";
         src = fetchurl {
-          url = "https://elpa.gnu.org/packages/eev-20240513.tar";
-          sha256 = "133blp5696f2adxqny5kyylr6s3n3vixs0ak1n3i58sqb0krp2pj";
+          url = "https://elpa.gnu.org/packages/eev-20240710.tar";
+          sha256 = "1mia27ilfg4zkkwvwy3m24ypgi1fm8k27rm77xwjpq87pb2wvr02";
         };
         packageRequires = [ emacs ];
         meta = {
@@ -1827,16 +1865,22 @@
           license = lib.licenses.free;
         };
       }) {};
-    ellama = callPackage ({ elpaBuild, emacs, fetchurl, lib, llm, spinner }:
+    ellama = callPackage ({ compat
+                          , elpaBuild
+                          , emacs
+                          , fetchurl
+                          , lib
+                          , llm
+                          , spinner }:
       elpaBuild {
         pname = "ellama";
         ename = "ellama";
-        version = "0.9.4";
+        version = "0.11.9";
         src = fetchurl {
-          url = "https://elpa.gnu.org/packages/ellama-0.9.4.tar";
-          sha256 = "12l8k7dwcdgndy0zbdgkhx94y46fkzwjrbwlgj9922zbk38nnz46";
+          url = "https://elpa.gnu.org/packages/ellama-0.11.9.tar";
+          sha256 = "0h41hsvz34v0gb9d7d8aw6phc7iyrpbs0r8djsz59yd0ijzbz12j";
         };
-        packageRequires = [ emacs llm spinner ];
+        packageRequires = [ compat emacs llm spinner ];
         meta = {
           homepage = "https://elpa.gnu.org/packages/ellama.html";
           license = lib.licenses.free;
@@ -1907,10 +1951,10 @@
       elpaBuild {
         pname = "ement";
         ename = "ement";
-        version = "0.15";
+        version = "0.15.1";
         src = fetchurl {
-          url = "https://elpa.gnu.org/packages/ement-0.15.tar";
-          sha256 = "0mphkvmsmrfyr3prr5a2x6ijr27z96ixpaxs9871kn7f1x0brn5r";
+          url = "https://elpa.gnu.org/packages/ement-0.15.1.tar";
+          sha256 = "1n1kxj5p6c6cnz6z54zayyb9lr6l54crfh5im2pbwpai1bk8lsld";
         };
         packageRequires = [
           emacs
@@ -1936,10 +1980,10 @@
       elpaBuild {
         pname = "emms";
         ename = "emms";
-        version = "19";
+        version = "20.1";
         src = fetchurl {
-          url = "https://elpa.gnu.org/packages/emms-19.tar";
-          sha256 = "1k0hybw826f2hlw8m0aihkydlkdzjsgvrfibpsqrxxcn9d7zxwjd";
+          url = "https://elpa.gnu.org/packages/emms-20.1.tar";
+          sha256 = "0h0v31f1q7k45k8s9kncvim3a7np7fgjz4qg9v8gjc5ag01dzwkx";
         };
         packageRequires = [ cl-lib nadvice seq ];
         meta = {
@@ -1996,10 +2040,10 @@
       elpaBuild {
         pname = "erc";
         ename = "erc";
-        version = "5.5";
+        version = "5.6";
         src = fetchurl {
-          url = "https://elpa.gnu.org/packages/erc-5.5.tar";
-          sha256 = "02649ijnpyalk0k1yq1dcinj92awhbnkia2x9sdb9xjk80xw1gqp";
+          url = "https://elpa.gnu.org/packages/erc-5.6.tar";
+          sha256 = "16qyfsa2q297xcfjiacjms9v14kjwwrsp3m8kcs5s50aavzfvc1s";
         };
         packageRequires = [ compat emacs ];
         meta = {
@@ -2119,16 +2163,16 @@
           license = lib.licenses.free;
         };
       }) {};
-    exwm = callPackage ({ elpaBuild, fetchurl, lib, xelb }:
+    exwm = callPackage ({ compat, elpaBuild, emacs, fetchurl, lib, xelb }:
       elpaBuild {
         pname = "exwm";
         ename = "exwm";
-        version = "0.28";
+        version = "0.31";
         src = fetchurl {
-          url = "https://elpa.gnu.org/packages/exwm-0.28.tar";
-          sha256 = "11j1ciyrnzkbcb7ffgs670mxqd1xbxf41c6jwnwwqjfzmqhsm0m4";
+          url = "https://elpa.gnu.org/packages/exwm-0.31.tar";
+          sha256 = "1i1k8w641n2fd6xifl92pvvq0s0b820lq76d1cyc7iyaqs44w9qq";
         };
-        packageRequires = [ xelb ];
+        packageRequires = [ compat emacs xelb ];
         meta = {
           homepage = "https://elpa.gnu.org/packages/exwm.html";
           license = lib.licenses.free;
@@ -2168,10 +2212,10 @@
       elpaBuild {
         pname = "filechooser";
         ename = "filechooser";
-        version = "0.2.0";
+        version = "0.2.1";
         src = fetchurl {
-          url = "https://elpa.gnu.org/packages/filechooser-0.2.0.tar";
-          sha256 = "1fjf8bmdrrrgbv4sgx4nry5pl8plg9kyzyfd038985v3dsqasi9q";
+          url = "https://elpa.gnu.org/packages/filechooser-0.2.1.tar";
+          sha256 = "1q9yxq4c6lp1fllcd60mcj4bs0ia03i649jilknkcp7jmjihq07i";
         };
         packageRequires = [ compat emacs ];
         meta = {
@@ -2477,10 +2521,10 @@
       elpaBuild {
         pname = "gnu-elpa-keyring-update";
         ename = "gnu-elpa-keyring-update";
-        version = "2022.12";
+        version = "2022.12.1";
         src = fetchurl {
-          url = "https://elpa.gnu.org/packages/gnu-elpa-keyring-update-2022.12.tar";
-          sha256 = "0pabqsfw0d9knfigpcsrwfw7qrf2vlg9h0i582212gsqd7snlnxb";
+          url = "https://elpa.gnu.org/packages/gnu-elpa-keyring-update-2022.12.1.tar";
+          sha256 = "0yb81ly7y5262fpa0n96yngqmz1rgfwrpm0a6vqghdpr5x0c8z6n";
         };
         packageRequires = [];
         meta = {
@@ -2593,16 +2637,16 @@
           license = lib.licenses.free;
         };
       }) {};
-    greader = callPackage ({ elpaBuild, emacs, fetchurl, lib }:
+    greader = callPackage ({ compat, elpaBuild, emacs, fetchurl, lib, seq }:
       elpaBuild {
         pname = "greader";
         ename = "greader";
-        version = "0.9.20";
+        version = "0.11.13";
         src = fetchurl {
-          url = "https://elpa.gnu.org/packages/greader-0.9.20.tar";
-          sha256 = "11n88xmr2qa5as5kpy4yy616nlh08nw5rkcbgmf9skgka3g1hmip";
+          url = "https://elpa.gnu.org/packages/greader-0.11.13.tar";
+          sha256 = "0kyfws0b5dahf96b9wx06hmx0a0qsmywx6bay6xl6a5a4lchszsn";
         };
-        packageRequires = [ emacs ];
+        packageRequires = [ compat emacs seq ];
         meta = {
           homepage = "https://elpa.gnu.org/packages/greader.html";
           license = lib.licenses.free;
@@ -2627,10 +2671,10 @@
       elpaBuild {
         pname = "gtags-mode";
         ename = "gtags-mode";
-        version = "1.6";
+        version = "1.8";
         src = fetchurl {
-          url = "https://elpa.gnu.org/packages/gtags-mode-1.6.tar";
-          sha256 = "1r3ih44kzkrx9bmfl8ri2yv90b7g4nhb0vvdnz1ba3f44x15ppjx";
+          url = "https://elpa.gnu.org/packages/gtags-mode-1.8.tar";
+          sha256 = "1rd0a3q45b5i46hi8snf25cyv65b7699ghbz8c6hrr4991h3ksll";
         };
         packageRequires = [ emacs ];
         meta = {
@@ -2780,6 +2824,21 @@
           license = lib.licenses.free;
         };
       }) {};
+    idlwave = callPackage ({ elpaBuild, fetchurl, lib }:
+      elpaBuild {
+        pname = "idlwave";
+        ename = "idlwave";
+        version = "6.5.1";
+        src = fetchurl {
+          url = "https://elpa.gnu.org/packages/idlwave-6.5.1.tar";
+          sha256 = "0dd0dm92qyin8k4kgavrg82zwjhv6wsjq6gk55rzcspx0s8y2c24";
+        };
+        packageRequires = [];
+        meta = {
+          homepage = "https://elpa.gnu.org/packages/idlwave.html";
+          license = lib.licenses.free;
+        };
+      }) {};
     ilist = callPackage ({ elpaBuild, fetchurl, lib }:
       elpaBuild {
         pname = "ilist";
@@ -2999,10 +3058,10 @@
       elpaBuild {
         pname = "jinx";
         ename = "jinx";
-        version = "1.7";
+        version = "1.9";
         src = fetchurl {
-          url = "https://elpa.gnu.org/packages/jinx-1.7.tar";
-          sha256 = "13snfsrwdbn23fdwpk42xp24x8bskl8sgsbq51nr896smjp2x3b4";
+          url = "https://elpa.gnu.org/packages/jinx-1.9.tar";
+          sha256 = "0k6km295y5w13kl18v9b6y0szdccf89nbar3zkdincy4iid5z6n1";
         };
         packageRequires = [ compat emacs ];
         meta = {
@@ -3281,14 +3340,29 @@
           license = lib.licenses.free;
         };
       }) {};
+    literate-scratch = callPackage ({ elpaBuild, emacs, fetchurl, lib }:
+      elpaBuild {
+        pname = "literate-scratch";
+        ename = "literate-scratch";
+        version = "1.0";
+        src = fetchurl {
+          url = "https://elpa.gnu.org/packages/literate-scratch-1.0.tar";
+          sha256 = "1rby70wfj6g0p4hc6xqzwgqj2g8780qm5mnjn95bl2wrvdi0ds6n";
+        };
+        packageRequires = [ emacs ];
+        meta = {
+          homepage = "https://elpa.gnu.org/packages/literate-scratch.html";
+          license = lib.licenses.free;
+        };
+      }) {};
     llm = callPackage ({ elpaBuild, emacs, fetchurl, lib, plz }:
       elpaBuild {
         pname = "llm";
         ename = "llm";
-        version = "0.15.0";
+        version = "0.16.1";
         src = fetchurl {
-          url = "https://elpa.gnu.org/packages/llm-0.15.0.tar";
-          sha256 = "1y3gs8zsng87wmlkx5az396hci4xyn0ww7cbaavisqbrxam51qvj";
+          url = "https://elpa.gnu.org/packages/llm-0.16.1.tar";
+          sha256 = "1fqn4fdxhazpmlh8pf6ihnh132zjqrixry3kyymsmwang6vh2y7s";
         };
         packageRequires = [ emacs plz ];
         meta = {
@@ -3360,10 +3434,10 @@
       elpaBuild {
         pname = "loccur";
         ename = "loccur";
-        version = "1.2.4";
+        version = "1.2.5";
         src = fetchurl {
-          url = "https://elpa.gnu.org/packages/loccur-1.2.4.tar";
-          sha256 = "1b8rmbl03k8fdy217ngbxsc0a3jxxmqnwshf72f4iay8ln4hasgk";
+          url = "https://elpa.gnu.org/packages/loccur-1.2.5.tar";
+          sha256 = "0dp7nhafx5x0aw4svd826bqsrn6qk46w12p04w7khpk7d9768a8x";
         };
         packageRequires = [ emacs ];
         meta = {
@@ -3645,10 +3719,10 @@
       elpaBuild {
         pname = "mpdired";
         ename = "mpdired";
-        version = "1";
+        version = "2";
         src = fetchurl {
-          url = "https://elpa.gnu.org/packages/mpdired-1.tar";
-          sha256 = "08lc0j25kxisykd2l9v4iamalmm5hzsnsm026v808krny28wwbp3";
+          url = "https://elpa.gnu.org/packages/mpdired-2.tar";
+          sha256 = "0synpanyqka8nyz9mma69na307vm5pjvn21znbdvz56gka2mbg23";
         };
         packageRequires = [ emacs ];
         meta = {
@@ -4039,10 +4113,10 @@
       elpaBuild {
         pname = "org";
         ename = "org";
-        version = "9.6.30";
+        version = "9.7.6";
         src = fetchurl {
-          url = "https://elpa.gnu.org/packages/org-9.6.30.tar";
-          sha256 = "0h2p7gjiys5ch68y35l6bpw9pp852vprmfzi0dk86z1wkilhycip";
+          url = "https://elpa.gnu.org/packages/org-9.7.6.tar";
+          sha256 = "0pxjc2bydnzd31wg71nfh7zzf3mhsnzm2nd7p736bj1w0pvg89ng";
         };
         packageRequires = [ emacs ];
         meta = {
@@ -4099,10 +4173,10 @@
       elpaBuild {
         pname = "org-modern";
         ename = "org-modern";
-        version = "1.2";
+        version = "1.3";
         src = fetchurl {
-          url = "https://elpa.gnu.org/packages/org-modern-1.2.tar";
-          sha256 = "1bm8kkcrn0glsb69sapj1zmb2ygd4sxksb3gag4hw1v5w3g51jjh";
+          url = "https://elpa.gnu.org/packages/org-modern-1.3.tar";
+          sha256 = "1lpl9q9ijyp6pwb0qap9ydzkq0pd5xkbfpaqy1nvcy5b906jmkdj";
         };
         packageRequires = [ compat emacs ];
         meta = {
@@ -4189,10 +4263,10 @@
       elpaBuild {
         pname = "orgalist";
         ename = "orgalist";
-        version = "1.14";
+        version = "1.16";
         src = fetchurl {
-          url = "https://elpa.gnu.org/packages/orgalist-1.14.tar";
-          sha256 = "02diwanqldzr42aaa5kqcj1xgxmf1k6rqhk9zv40psqpzgd1yms5";
+          url = "https://elpa.gnu.org/packages/orgalist-1.16.tar";
+          sha256 = "0j78g12q66piclraa2nvd1h4ri8d6cnw5jahw6k5zi4xfjag6yx3";
         };
         packageRequires = [ emacs ];
         meta = {
@@ -4350,16 +4424,16 @@
           license = lib.licenses.free;
         };
       }) {};
-    persist = callPackage ({ elpaBuild, fetchurl, lib }:
+    persist = callPackage ({ elpaBuild, emacs, fetchurl, lib }:
       elpaBuild {
         pname = "persist";
         ename = "persist";
-        version = "0.6";
+        version = "0.6.1";
         src = fetchurl {
-          url = "https://elpa.gnu.org/packages/persist-0.6.tar";
-          sha256 = "1p6h211xk0lrk4zqlm51rsms5lza9ymx6ayh9ij0afqrjqgffw77";
+          url = "https://elpa.gnu.org/packages/persist-0.6.1.tar";
+          sha256 = "1a7lls81q247mbkcnifmsva16cfjjma6yihxmj5zrj8ac774z9j3";
         };
-        packageRequires = [];
+        packageRequires = [ emacs ];
         meta = {
           homepage = "https://elpa.gnu.org/packages/persist.html";
           license = lib.licenses.free;
@@ -4399,10 +4473,10 @@
       elpaBuild {
         pname = "plz";
         ename = "plz";
-        version = "0.8";
+        version = "0.9";
         src = fetchurl {
-          url = "https://elpa.gnu.org/packages/plz-0.8.tar";
-          sha256 = "0kg275kq5hi83ry0n83w8pi0qn2lmlv9gnxcbwf1dcqk7n9i2v64";
+          url = "https://elpa.gnu.org/packages/plz-0.9.tar";
+          sha256 = "1wgcfwrmbw6bl00midhn99hn3fvbavkibb4r6s99yzmd48vyapr8";
         };
         packageRequires = [ emacs ];
         meta = {
@@ -4515,14 +4589,44 @@
           license = lib.licenses.free;
         };
       }) {};
+    preview-auto = callPackage ({ auctex, elpaBuild, emacs, fetchurl, lib }:
+      elpaBuild {
+        pname = "preview-auto";
+        ename = "preview-auto";
+        version = "0.3";
+        src = fetchurl {
+          url = "https://elpa.gnu.org/packages/preview-auto-0.3.tar";
+          sha256 = "19jih2bn6ac82jx6w7jhv9hbz47c8argv24lfglvv6532fda218r";
+        };
+        packageRequires = [ auctex emacs ];
+        meta = {
+          homepage = "https://elpa.gnu.org/packages/preview-auto.html";
+          license = lib.licenses.free;
+        };
+      }) {};
+    preview-tailor = callPackage ({ auctex, elpaBuild, emacs, fetchurl, lib }:
+      elpaBuild {
+        pname = "preview-tailor";
+        ename = "preview-tailor";
+        version = "0.2";
+        src = fetchurl {
+          url = "https://elpa.gnu.org/packages/preview-tailor-0.2.tar";
+          sha256 = "1mqh2myz5w84f4n01ibd695h4mnqwjxmg7rvs7pz3sylz1xqyks7";
+        };
+        packageRequires = [ auctex emacs ];
+        meta = {
+          homepage = "https://elpa.gnu.org/packages/preview-tailor.html";
+          license = lib.licenses.free;
+        };
+      }) {};
     project = callPackage ({ elpaBuild, emacs, fetchurl, lib, xref }:
       elpaBuild {
         pname = "project";
         ename = "project";
-        version = "0.10.0";
+        version = "0.11.1";
         src = fetchurl {
-          url = "https://elpa.gnu.org/packages/project-0.10.0.tar";
-          sha256 = "07lv41asdah2v3k6nrc73z3pjhsm7viygr12ly9p96g2yw11irg6";
+          url = "https://elpa.gnu.org/packages/project-0.11.1.tar";
+          sha256 = "1973d6z7nx9pp5gadqk8p71v6s5wqja40a0f8zjrn6rrnfarrcd0";
         };
         packageRequires = [ emacs xref ];
         meta = {
@@ -4714,10 +4818,10 @@
       elpaBuild {
         pname = "rcirc-sqlite";
         ename = "rcirc-sqlite";
-        version = "1.0.1";
+        version = "1.0.2";
         src = fetchurl {
-          url = "https://elpa.gnu.org/packages/rcirc-sqlite-1.0.1.tar";
-          sha256 = "0n0492s500gplmv7l8n8l7s3rpm1nli3n706n9f91qc15z6p6mcv";
+          url = "https://elpa.gnu.org/packages/rcirc-sqlite-1.0.2.tar";
+          sha256 = "128wq3mm2ckcchly6c31i87jrkq19q7ysvx5fg34jhjg53dkrz28";
         };
         packageRequires = [ emacs ];
         meta = {
@@ -5725,6 +5829,36 @@
           license = lib.licenses.free;
         };
       }) {};
+    tex-item = callPackage ({ elpaBuild, emacs, fetchurl, lib }:
+      elpaBuild {
+        pname = "tex-item";
+        ename = "tex-item";
+        version = "0.1";
+        src = fetchurl {
+          url = "https://elpa.gnu.org/packages/tex-item-0.1.tar";
+          sha256 = "0ggbn3lk64cv6pnw97ww7vn250jchj80zx3hvkcqlccyw34x6ziy";
+        };
+        packageRequires = [ emacs ];
+        meta = {
+          homepage = "https://elpa.gnu.org/packages/tex-item.html";
+          license = lib.licenses.free;
+        };
+      }) {};
+    tex-parens = callPackage ({ auctex, elpaBuild, emacs, fetchurl, lib }:
+      elpaBuild {
+        pname = "tex-parens";
+        ename = "tex-parens";
+        version = "0.4";
+        src = fetchurl {
+          url = "https://elpa.gnu.org/packages/tex-parens-0.4.tar";
+          sha256 = "08mj18sh32z61kjizf3y6bb0zvb6qgdhrk9q7b15bi5mllk834zd";
+        };
+        packageRequires = [ auctex emacs ];
+        meta = {
+          homepage = "https://elpa.gnu.org/packages/tex-parens.html";
+          license = lib.licenses.free;
+        };
+      }) {};
     theme-buffet = callPackage ({ elpaBuild, emacs, fetchurl, lib }:
       elpaBuild {
         pname = "theme-buffet";
@@ -5838,10 +5972,10 @@
       elpaBuild {
         pname = "tramp";
         ename = "tramp";
-        version = "2.6.3";
+        version = "2.7.1";
         src = fetchurl {
-          url = "https://elpa.gnu.org/packages/tramp-2.6.3.tar";
-          sha256 = "0z44mfpvn4qy2xc2fsiahw3xir140ljna8aq45dcb7qnmr044xjb";
+          url = "https://elpa.gnu.org/packages/tramp-2.7.1.tar";
+          sha256 = "128k591219ffwbk1cifki0xx94rg6b7crh7gmhaiqfa6jylqhcg8";
         };
         packageRequires = [ emacs ];
         meta = {
@@ -5898,10 +6032,10 @@
       elpaBuild {
         pname = "transient";
         ename = "transient";
-        version = "0.6.0";
+        version = "0.7.2";
         src = fetchurl {
-          url = "https://elpa.gnu.org/packages/transient-0.6.0.tar";
-          sha256 = "0rk4gafx3yylzawiny86ml4jzrs8x6cf2bvmnv36p8l13wgp0w9p";
+          url = "https://elpa.gnu.org/packages/transient-0.7.2.tar";
+          sha256 = "0i68wpwxf729qxjxhafkp098wcmkqn06ka3hcqnlky2p1zl29hby";
         };
         packageRequires = [ compat emacs seq ];
         meta = {
@@ -6484,16 +6618,16 @@
           license = lib.licenses.free;
         };
       }) {};
-    window-tool-bar = callPackage ({ elpaBuild, emacs, fetchurl, lib }:
+    window-tool-bar = callPackage ({ compat, elpaBuild, emacs, fetchurl, lib }:
       elpaBuild {
         pname = "window-tool-bar";
         ename = "window-tool-bar";
-        version = "0.2";
+        version = "0.2.1";
         src = fetchurl {
-          url = "https://elpa.gnu.org/packages/window-tool-bar-0.2.tar";
-          sha256 = "191v21rrw1j560512mjn1s1avhirk1awy746xajjra8lb1ywnxw7";
+          url = "https://elpa.gnu.org/packages/window-tool-bar-0.2.1.tar";
+          sha256 = "06wf3kwc4sjd14ihagmahxjvk35skb28rh9yclpzbrvjqk0ss35v";
         };
-        packageRequires = [ emacs ];
+        packageRequires = [ compat emacs ];
         meta = {
           homepage = "https://elpa.gnu.org/packages/window-tool-bar.html";
           license = lib.licenses.free;
@@ -6624,16 +6758,16 @@
           license = lib.licenses.free;
         };
       }) {};
-    xelb = callPackage ({ cl-generic, elpaBuild, emacs, fetchurl, lib }:
+    xelb = callPackage ({ compat, elpaBuild, emacs, fetchurl, lib }:
       elpaBuild {
         pname = "xelb";
         ename = "xelb";
-        version = "0.18";
+        version = "0.20";
         src = fetchurl {
-          url = "https://elpa.gnu.org/packages/xelb-0.18.tar";
-          sha256 = "1qixb236z01azjbc1xycji99rjkq747hip4gcf0gli1is8ink0bs";
+          url = "https://elpa.gnu.org/packages/xelb-0.20.tar";
+          sha256 = "12ikrnvik1n1fdc6ixx53d0z84v269wi463380k0i5zb6q8ncwpk";
         };
-        packageRequires = [ cl-generic emacs ];
+        packageRequires = [ compat emacs ];
         meta = {
           homepage = "https://elpa.gnu.org/packages/xelb.html";
           license = lib.licenses.free;
@@ -6673,10 +6807,10 @@
       elpaBuild {
         pname = "xref";
         ename = "xref";
-        version = "1.6.3";
+        version = "1.7.0";
         src = fetchurl {
-          url = "https://elpa.gnu.org/packages/xref-1.6.3.tar";
-          sha256 = "0mir1nhic0rnz12d8i1n6m2ihfynhkkg8yccy4v9j4kd31w6f1gs";
+          url = "https://elpa.gnu.org/packages/xref-1.7.0.tar";
+          sha256 = "0jy49zrkqiqg9131k24y6nyjnq2am4dwwdrqmginrrwzvi3y9d24";
         };
         packageRequires = [ emacs ];
         meta = {

pkgs/applications/editors/emacs/elisp-packages/elpa-packages.nix

@@ -141,26 +141,6 @@ self: let
         };
       });
 
-      org = super.org.overrideAttrs (old: {
-        dontUnpack = false;
-        patches = old.patches or [ ] ++ lib.optionals (lib.versionOlder old.version "9.7.5") [
-          # security fix backported from 9.7.5
-          (pkgs.fetchpatch {
-            url = "https://git.savannah.gnu.org/cgit/emacs/org-mode.git/patch/?id=f4cc61636947b5c2f0afc67174dd369fe3277aa8";
-            hash = "sha256-bGgsnTSn6SMu1J8P2BfJjrKx2845FCsUB2okcIrEjDg=";
-            stripLen = 1;
-          })
-        ];
-        postPatch = old.postPatch or "" + "\n" + ''
-          pushd ..
-          local content_directory=${old.ename}-${old.version}
-          src=$PWD/$content_directory.tar
-          tar --create --verbose --file=$src $content_directory
-          popd
-        '';
-        dontBuild = true;
-      });
-
       plz = super.plz.overrideAttrs (
         old: {
           dontUnpack = false;

pkgs/applications/editors/emacs/elisp-packages/manual-packages.nix

@@ -13,11 +13,11 @@ in
 
   agda2-mode = callPackage ./manual-packages/agda2-mode { };
 
-  beancount = callPackage ./manual-packages/beancount { };
-
   cask = callPackage ./manual-packages/cask { };
 
-  codeium = callPackage ./manual-packages/codeium { };
+  codeium = callPackage ./manual-packages/codeium {
+    inherit (pkgs) codeium;
+  };
 
   consult-gh = callPackage ./manual-packages/consult-gh { };
 
@@ -33,8 +33,6 @@ in
 
   emacs-conflict = callPackage ./manual-packages/emacs-conflict { };
 
-  enlight = callPackage ./manual-packages/enlight { };
-
   evil-markdown = callPackage ./manual-packages/evil-markdown { };
 
   font-lock-plus = callPackage ./manual-packages/font-lock-plus { };
@@ -45,6 +43,8 @@ in
 
   helm-words = callPackage ./manual-packages/helm-words { };
 
+  icicles = callPackage ./manual-packages/icicles { };
+
   idris2-mode = callPackage ./manual-packages/idris2-mode { };
 
   isearch-plus = callPackage ./manual-packages/isearch-plus { };

pkgs/applications/editors/emacs/elisp-packages/manual-packages/beancount/default.nix

@@ -1,35 +0,0 @@
-{ lib
-, melpaBuild
-, fetchFromGitHub
-, emacs
-, writeText
-}:
-
-let
-  rev = "519bfd868f206ed2fc538a57cdb631c4fec3c93e";
-in
-melpaBuild {
-  pname = "beancount";
-  version = "20230205.436";
-
-  src = fetchFromGitHub {
-    owner = "beancount";
-    repo = "beancount-mode";
-    inherit rev;
-    hash = "sha256-nTEXJdPEPZpNm06uYvRxLuiOHmsiIgMLerd//dA0+KQ=";
-  };
-
-  commit = rev;
-
-  recipe = writeText "recipe" ''
-    (beancount :repo "beancount/beancount-mode" :fetcher github)
-  '';
-
-  meta = {
-    homepage = "https://github.com/beancount/beancount-mode";
-    description = "Emacs major-mode to work with Beancount ledger files";
-    maintainers = with lib.maintainers; [ polarmutex ];
-    license = lib.licenses.gpl3Only;
-    inherit (emacs.meta) platforms;
-  };
-}

pkgs/applications/editors/emacs/elisp-packages/manual-packages/codeium/default.nix

@@ -1,9 +1,10 @@
 {
+  lib,
+  codeium,
   fetchFromGitHub,
   melpaBuild,
-  pkgs,
-  lib,
   substituteAll,
+  gitUpdater,
 }:
 
 melpaBuild {
@@ -19,17 +20,19 @@ melpaBuild {
 
   patches = [
     (substituteAll {
-      src = ./codeium.el.patch;
-      codeium = "${pkgs.codeium}/bin/codeium_language_server";
+      src = ./0000-set-codeium-command-executable.patch;
+      codeium = lib.getExe' codeium "codeium_language_server";
     })
   ];
 
+  passthru.updateScript = gitUpdater { };
+
   meta = {
     description = "Free, ultrafast Copilot alternative for Emacs";
     homepage = "https://github.com/Exafunction/codeium.el";
     license = lib.licenses.mit;
     maintainers = [ lib.maintainers.running-grass ];
-    platforms = pkgs.codeium.meta.platforms;
+    inherit (codeium.meta) platforms;
     sourceProvenance = [ lib.sourceTypes.fromSource ];
   };
 

pkgs/applications/editors/emacs/elisp-packages/manual-packages/enlight/default.nix

@@ -1,27 +0,0 @@
-{
-  lib,
-  compat,
-  fetchFromGitHub,
-  melpaBuild,
-}:
-
-melpaBuild {
-  pname = "enlight";
-  version = "20240601.1150";
-
-  src = fetchFromGitHub {
-    owner = "ichernyshovvv";
-    repo = "enlight";
-    rev = "76753736da1777c8f9ebbeb08beec15b330a5878";
-    hash = "sha256-Ccfv4Ud5B4L4FfIOI2PDKikV9x8x3a7VeHYDyLV7t4g=";
-  };
-
-  packageRequires = [ compat ];
-
-  meta = {
-    homepage = "https://github.com/ichernyshovvv/enlight";
-    description = "Highly customizable startup screen for Emacs";
-    license = lib.licenses.gpl3Plus;
-    maintainers = with lib.maintainers; [ AndersonTorres ];
-  };
-}

pkgs/applications/editors/emacs/elisp-packages/manual-packages/icicles/default.nix

@@ -0,0 +1,27 @@
+{
+  lib,
+  fetchFromGitHub,
+  melpaBuild,
+  unstableGitUpdater,
+}:
+
+melpaBuild {
+  pname = "icicles";
+  version = "0-unstable-2023-07-27";
+
+  src = fetchFromGitHub {
+    owner = "emacsmirror";
+    repo = "icicles";
+    rev = "dfc1d9caf1b5156567292c9548547a2975a841bc";
+    hash = "sha256-Xbt0D9EgmvN1hDTeLbdxq1ARHObj8M4GfH2sbFILRTI=";
+  };
+
+  passthru.updateScript = unstableGitUpdater { hardcodeZeroVersion = true; };
+
+  meta = {
+    homepage = "https://emacswiki.org/emacs/Icicles";
+    description = "Emacs library that enhances minibuffer completion";
+    license = lib.licenses.gpl2Plus;
+    maintainers = with lib.maintainers; [ AndersonTorres ];
+  };
+}

pkgs/applications/editors/emacs/elisp-packages/nongnu-generated.nix

@@ -139,10 +139,10 @@
       elpaBuild {
         pname = "arduino-mode";
         ename = "arduino-mode";
-        version = "1.3.0";
+        version = "1.3.1";
         src = fetchurl {
-          url = "https://elpa.nongnu.org/nongnu/arduino-mode-1.3.0.tar";
-          sha256 = "167b35s34x51qnlx59sawaz4wzlnk2kf9130ylz2b1bj7jy5n27a";
+          url = "https://elpa.nongnu.org/nongnu/arduino-mode-1.3.1.tar";
+          sha256 = "1k42qx7kgm8svv70czzlkmm3c7cddf93bqvf6267hbkaihhyd21y";
         };
         packageRequires = [ emacs spinner ];
         meta = {
@@ -212,6 +212,21 @@
           license = lib.licenses.free;
         };
       }) {};
+    beancount = callPackage ({ elpaBuild, fetchurl, lib }:
+      elpaBuild {
+        pname = "beancount";
+        ename = "beancount";
+        version = "0.9";
+        src = fetchurl {
+          url = "https://elpa.nongnu.org/nongnu/beancount-0.9.tar";
+          sha256 = "1s0w17mq8kilkrd33pan78px6mz5z96d7gvdmy2shg3hvj1jbq09";
+        };
+        packageRequires = [];
+        meta = {
+          homepage = "https://elpa.gnu.org/packages/beancount.html";
+          license = lib.licenses.free;
+        };
+      }) {};
     better-jumper = callPackage ({ elpaBuild, emacs, fetchurl, lib }:
       elpaBuild {
         pname = "better-jumper";
@@ -376,10 +391,10 @@
       elpaBuild {
         pname = "cider";
         ename = "cider";
-        version = "1.13.1";
+        version = "1.15.1";
         src = fetchurl {
-          url = "https://elpa.nongnu.org/nongnu/cider-1.13.1.tar";
-          sha256 = "0df5z57schfszlp1vkb6fiiadx12qlpk5qzfw61g664a2i654fsg";
+          url = "https://elpa.nongnu.org/nongnu/cider-1.15.1.tar";
+          sha256 = "0qfh98hrlxpr71jqgsghmv687sp90iaffcgb7q5candcq8dscfb6";
         };
         packageRequires = [
           clojure-mode
@@ -400,10 +415,10 @@
       elpaBuild {
         pname = "clojure-mode";
         ename = "clojure-mode";
-        version = "5.18.1";
+        version = "5.19.0";
         src = fetchurl {
-          url = "https://elpa.nongnu.org/nongnu/clojure-mode-5.18.1.tar";
-          sha256 = "1p9nh4p3skjxbsnyj2in3m8jdyrrj8iw0malfcz0ppc4d7zm6klx";
+          url = "https://elpa.nongnu.org/nongnu/clojure-mode-5.19.0.tar";
+          sha256 = "10dpdi4yc7bbga2mllk46jfy58ppj8vlhs37zd9vlk9rnfc54r99";
         };
         packageRequires = [ emacs ];
         meta = {
@@ -518,6 +533,21 @@
           license = lib.licenses.free;
         };
       }) {};
+    csv2ledger = callPackage ({ csv-mode, elpaBuild, emacs, fetchurl, lib }:
+      elpaBuild {
+        pname = "csv2ledger";
+        ename = "csv2ledger";
+        version = "1.5.4";
+        src = fetchurl {
+          url = "https://elpa.nongnu.org/nongnu/csv2ledger-1.5.4.tar";
+          sha256 = "1h935g97fjrs1q0yz0q071zp91bhsb3yg13zqpp8il5gif20qqls";
+        };
+        packageRequires = [ csv-mode emacs ];
+        meta = {
+          homepage = "https://elpa.gnu.org/packages/csv2ledger.html";
+          license = lib.licenses.free;
+        };
+      }) {};
     cyberpunk-theme = callPackage ({ elpaBuild, fetchurl, lib }:
       elpaBuild {
         pname = "cyberpunk-theme";
@@ -702,6 +732,21 @@
           license = lib.licenses.free;
         };
       }) {};
+    dslide = callPackage ({ elpaBuild, emacs, fetchurl, lib }:
+      elpaBuild {
+        pname = "dslide";
+        ename = "dslide";
+        version = "0.5.3";
+        src = fetchurl {
+          url = "https://elpa.nongnu.org/nongnu/dslide-0.5.3.tar";
+          sha256 = "11q807jp90y37s1njmr6qlnqi9pk371gj8mwg57kgjvc55qdyas5";
+        };
+        packageRequires = [ emacs ];
+        meta = {
+          homepage = "https://elpa.gnu.org/packages/dslide.html";
+          license = lib.licenses.free;
+        };
+      }) {};
     eat = callPackage ({ compat, elpaBuild, emacs, fetchurl, lib }:
       elpaBuild {
         pname = "eat";
@@ -766,10 +811,10 @@
       elpaBuild {
         pname = "elpher";
         ename = "elpher";
-        version = "3.6.0";
+        version = "3.6.2";
         src = fetchurl {
-          url = "https://elpa.nongnu.org/nongnu/elpher-3.6.0.tar";
-          sha256 = "1xf3kl09inswx4w03fxj35n1ypvlin39z493fw4ksnpf79ccfk4x";
+          url = "https://elpa.nongnu.org/nongnu/elpher-3.6.2.tar";
+          sha256 = "168cyhkp2q57k26r961c3g521qf8gj2b5rl8k1fg4z60y63s1rpk";
         };
         packageRequires = [ emacs ];
         meta = {
@@ -1218,10 +1263,10 @@
       elpaBuild {
         pname = "geiser";
         ename = "geiser";
-        version = "0.30";
+        version = "0.31";
         src = fetchurl {
-          url = "https://elpa.nongnu.org/nongnu/geiser-0.30.tar";
-          sha256 = "0h63skslmc23rjlsrqmcnqf2s431ml0wmkbza38j44kzxnsz0x5g";
+          url = "https://elpa.nongnu.org/nongnu/geiser-0.31.tar";
+          sha256 = "0szyasza76ak4qny9v9i3sk1m3mahlxcvvsk078q8rp9cms5lzkv";
         };
         packageRequires = [ emacs project ];
         meta = {
@@ -1409,10 +1454,10 @@
       elpaBuild {
         pname = "git-modes";
         ename = "git-modes";
-        version = "1.4.2";
+        version = "1.4.3";
         src = fetchurl {
-          url = "https://elpa.nongnu.org/nongnu/git-modes-1.4.2.tar";
-          sha256 = "0hdy4wpnyrn3a8i9yxk5gvsggnpgpg6r0wip0zmhcl9nxi4h6kb3";
+          url = "https://elpa.nongnu.org/nongnu/git-modes-1.4.3.tar";
+          sha256 = "0fhmzx4cmj7g4cbv3h1gjwhwnvfqcgiifhz4hl98r7zzmz8z7kdk";
         };
         packageRequires = [ compat emacs ];
         meta = {
@@ -1529,10 +1574,10 @@
       elpaBuild {
         pname = "gptel";
         ename = "gptel";
-        version = "0.8.6";
+        version = "0.9.0";
         src = fetchurl {
-          url = "https://elpa.nongnu.org/nongnu/gptel-0.8.6.tar";
-          sha256 = "1ds0i32bdmdi5w68cjxm9xlg0m9n29yr4hl6sqi8gn3kgswfx1sb";
+          url = "https://elpa.nongnu.org/nongnu/gptel-0.9.0.tar";
+          sha256 = "1crcng1h6i64h6l3pha96k3hy2hga73pp0wy4i9gdrc1ra0dbjf4";
         };
         packageRequires = [ compat emacs transient ];
         meta = {
@@ -1645,16 +1690,16 @@
           license = lib.licenses.free;
         };
       }) {};
-    helm = callPackage ({ elpaBuild, fetchurl, helm-core, lib, popup, wfnames }:
+    helm = callPackage ({ elpaBuild, fetchurl, helm-core, lib, wfnames }:
       elpaBuild {
         pname = "helm";
         ename = "helm";
-        version = "3.9.8";
+        version = "3.9.9";
         src = fetchurl {
-          url = "https://elpa.nongnu.org/nongnu/helm-3.9.8.tar";
-          sha256 = "1vcz3vj6drp5v66s3nsrai39rcwp1q3l2qdd1qxw7n58m4fgrkm6";
+          url = "https://elpa.nongnu.org/nongnu/helm-3.9.9.tar";
+          sha256 = "1k3jq2miivj881h0mpl68zgd229kj50axynsgxizdddg56nfsdm0";
         };
-        packageRequires = [ helm-core popup wfnames ];
+        packageRequires = [ helm-core wfnames ];
         meta = {
           homepage = "https://elpa.gnu.org/packages/helm.html";
           license = lib.licenses.free;
@@ -1664,10 +1709,10 @@
       elpaBuild {
         pname = "helm-core";
         ename = "helm-core";
-        version = "3.9.8";
+        version = "3.9.9";
         src = fetchurl {
-          url = "https://elpa.nongnu.org/nongnu/helm-core-3.9.8.tar";
-          sha256 = "03l5sva3qhfmjdpys1k2pbcja58fsdxljvmffjx70j7wyclb3v03";
+          url = "https://elpa.nongnu.org/nongnu/helm-core-3.9.9.tar";
+          sha256 = "067x4g19w032671545bfah4262xyhgnwxkaw8pdk4fqd5znw0yck";
         };
         packageRequires = [ async emacs ];
         meta = {
@@ -1675,6 +1720,21 @@
           license = lib.licenses.free;
         };
       }) {};
+    hideshowvis = callPackage ({ elpaBuild, emacs, fetchurl, lib }:
+      elpaBuild {
+        pname = "hideshowvis";
+        ename = "hideshowvis";
+        version = "0.8";
+        src = fetchurl {
+          url = "https://elpa.nongnu.org/nongnu/hideshowvis-0.8.tar";
+          sha256 = "0xx2jjv95r1nhlf729y0zplfpjlh46nfnixmd3f5jc3z2pc6zf5b";
+        };
+        packageRequires = [ emacs ];
+        meta = {
+          homepage = "https://elpa.gnu.org/packages/hideshowvis.html";
+          license = lib.licenses.free;
+        };
+      }) {};
     highlight-parentheses = callPackage ({ elpaBuild
                                          , emacs
                                          , fetchurl
@@ -1888,10 +1948,10 @@
       elpaBuild {
         pname = "j-mode";
         ename = "j-mode";
-        version = "1.1.1";
+        version = "2.0.1";
         src = fetchurl {
-          url = "https://elpa.nongnu.org/nongnu/j-mode-1.1.1.tar";
-          sha256 = "056af7l7rn116nygln41rsq2val5s3y0pz1pj2736mqsx3lcyiy2";
+          url = "https://elpa.nongnu.org/nongnu/j-mode-2.0.1.tar";
+          sha256 = "0kk29s3xqad72jxvzzbl4b4z8b4l7xx1vyfcbsj8ns8hv8cip3l3";
         };
         packageRequires = [];
         meta = {
@@ -1948,10 +2008,10 @@
       elpaBuild {
         pname = "keycast";
         ename = "keycast";
-        version = "1.3.3";
+        version = "1.4.0";
         src = fetchurl {
-          url = "https://elpa.nongnu.org/nongnu/keycast-1.3.3.tar";
-          sha256 = "048j5q4hpr8y89lrcqwbcqjazj52rak8jv8nl6fs4sqjik10zcji";
+          url = "https://elpa.nongnu.org/nongnu/keycast-1.4.0.tar";
+          sha256 = "0az8jixzncbz042il45hq1hwj6qvcm53f2fns19bspf1k4v4dphk";
         };
         packageRequires = [ compat emacs ];
         meta = {
@@ -2092,10 +2152,10 @@
       elpaBuild {
         pname = "mastodon";
         ename = "mastodon";
-        version = "1.0.21";
+        version = "1.0.24";
         src = fetchurl {
-          url = "https://elpa.nongnu.org/nongnu/mastodon-1.0.21.tar";
-          sha256 = "1qlpkg28q4iyvjjzv8b40b8q7ni7rc94lj5akgzxbzw4avpp1217";
+          url = "https://elpa.nongnu.org/nongnu/mastodon-1.0.24.tar";
+          sha256 = "05jj62klf7cf44nlkjxdzg63xi4z30n5c4806xd5i2yw19nfw023";
         };
         packageRequires = [ emacs persist request ];
         meta = {
@@ -2427,6 +2487,26 @@
           license = lib.licenses.free;
         };
       }) {};
+    org-transclusion-http = callPackage ({ elpaBuild
+                                         , emacs
+                                         , fetchurl
+                                         , lib
+                                         , org-transclusion
+                                         , plz }:
+      elpaBuild {
+        pname = "org-transclusion-http";
+        ename = "org-transclusion-http";
+        version = "0.4";
+        src = fetchurl {
+          url = "https://elpa.nongnu.org/nongnu/org-transclusion-http-0.4.tar";
+          sha256 = "1k57672w0dcw63dp1a6m5fc0pkm8p5la9811m16r440i7wqq0kmr";
+        };
+        packageRequires = [ emacs org-transclusion plz ];
+        meta = {
+          homepage = "https://elpa.gnu.org/packages/org-transclusion-http.html";
+          license = lib.licenses.free;
+        };
+      }) {};
     org-tree-slide = callPackage ({ elpaBuild, emacs, fetchurl, lib }:
       elpaBuild {
         pname = "org-tree-slide";
@@ -2715,10 +2795,10 @@
       elpaBuild {
         pname = "racket-mode";
         ename = "racket-mode";
-        version = "1.0.20240514.112412";
+        version = "1.0.20240621.124732";
         src = fetchurl {
-          url = "https://elpa.nongnu.org/nongnu/racket-mode-1.0.20240514.112412.tar";
-          sha256 = "1ysjq9jvkm8qibj0z6j4q90sx19xyz9z9qzdlci9mw872r21ak9h";
+          url = "https://elpa.nongnu.org/nongnu/racket-mode-1.0.20240621.124732.tar";
+          sha256 = "1b5kq8r2skssqzqg9iah8h9jmxgzhzlzi0spbk3wkiadqyw6flbs";
         };
         packageRequires = [ emacs ];
         meta = {
@@ -2865,10 +2945,10 @@
       elpaBuild {
         pname = "scad-mode";
         ename = "scad-mode";
-        version = "93.3";
+        version = "94.0";
         src = fetchurl {
-          url = "https://elpa.nongnu.org/nongnu/scad-mode-93.3.tar";
-          sha256 = "1d3mv50n3d0qg1sxvp11a4i15vc75j9gpzlqcxnc0l1lqhn64rwh";
+          url = "https://elpa.nongnu.org/nongnu/scad-mode-94.0.tar";
+          sha256 = "1cqai7qb9m17rf7llkn9vbxddgn0ixcf3dbnsjk1aflvj8mq9nr3";
         };
         packageRequires = [ compat emacs ];
         meta = {
@@ -3090,10 +3170,10 @@
       elpaBuild {
         pname = "subed";
         ename = "subed";
-        version = "1.2.11";
+        version = "1.2.14";
         src = fetchurl {
-          url = "https://elpa.nongnu.org/nongnu/subed-1.2.11.tar";
-          sha256 = "0grzlxibv57qds3dml6yjpw9hag86hbkrb1f66k7qn5hxaadmvpw";
+          url = "https://elpa.nongnu.org/nongnu/subed-1.2.14.tar";
+          sha256 = "0kzb054radxq9hqviadmbr4cln39yp7yz4inq4ip52rd3qdm8vy4";
         };
         packageRequires = [ emacs ];
         meta = {
@@ -3366,10 +3446,10 @@
       elpaBuild {
         pname = "undo-fu-session";
         ename = "undo-fu-session";
-        version = "0.6";
+        version = "0.7";
         src = fetchurl {
-          url = "https://elpa.nongnu.org/nongnu/undo-fu-session-0.6.tar";
-          sha256 = "057izvr86har50z1sfk4s6r88w2ga57afwm2w9p5v14lq31vj7cp";
+          url = "https://elpa.nongnu.org/nongnu/undo-fu-session-0.7.tar";
+          sha256 = "1gly9fl8kvfssh2h90j9qcqvxvmnckn0x1wfm4qbz9ax57xvms23";
         };
         packageRequires = [ emacs ];
         meta = {
@@ -3506,10 +3586,10 @@
       elpaBuild {
         pname = "with-editor";
         ename = "with-editor";
-        version = "3.3.2";
+        version = "3.3.4";
         src = fetchurl {
-          url = "https://elpa.nongnu.org/nongnu/with-editor-3.3.2.tar";
-          sha256 = "1yjx1w54qdjpmq5f7l3y19d4bayyk01rgd82c56swsaxsf4j5fpv";
+          url = "https://elpa.nongnu.org/nongnu/with-editor-3.3.4.tar";
+          sha256 = "1q9h181r1192zz5ff95rb3j2j69w9ha00qrap5df8cs73z8kh2vc";
         };
         packageRequires = [ compat emacs ];
         meta = {
@@ -3589,10 +3669,10 @@
       elpaBuild {
         pname = "xah-fly-keys";
         ename = "xah-fly-keys";
-        version = "25.6.20240521220424";
+        version = "25.9.20240703220947";
         src = fetchurl {
-          url = "https://elpa.nongnu.org/nongnu/xah-fly-keys-25.6.20240521220424.tar";
-          sha256 = "029hy3qmf6nvibbq9w2b964gzbw99lja595h4g1y5zzyrgzqrhrn";
+          url = "https://elpa.nongnu.org/nongnu/xah-fly-keys-25.9.20240703220947.tar";
+          sha256 = "1kg8qhr1wnbcm44bmvan62k68603pjickaaj68q7g78vkzlzwpya";
         };
         packageRequires = [ emacs ];
         meta = {

pkgs/applications/editors/emacs/elisp-packages/updater-emacs.nix

@@ -3,27 +3,32 @@ let
 
   emacsEnv = pkgs.emacs.pkgs.withPackages (epkgs: let
 
-    promise = epkgs.trivialBuild {
+    promise = epkgs.melpaBuild {
       pname = "promise";
-      version = "1";
+      version = "0-unstable-2019-06-07";
+
       src = pkgs.fetchFromGitHub {
         owner = "bendlas";
         repo = "emacs-promise";
         rev = "4da97087c5babbd8429b5ce62a8323b9b03c6022";
-        sha256 = "0yin7kj69g4zxs30pvk47cnfygxlaw7jc7chr3b36lz51yqczjsy";
+        hash = "sha256-XsvPsA/lUzPWyJAdJg9XtD/vLDtk7guG7p+8ZOQ8Nno=";
       };
+
+      packageRequires = [ epkgs.async ];
     };
 
-    semaphore = epkgs.trivialBuild {
+    semaphore = epkgs.melpaBuild {
       pname = "semaphore";
-      version = "1";
-      packageRequires = [ promise ];
+      version = "0-unstable-2019-06-07";
+
       src = pkgs.fetchFromGitHub {
         owner = "webnf";
         repo = "semaphore.el";
         rev = "93802cb093073bc6a6ccd797328dafffcef248e0";
-        sha256 = "09pfyp27m35sv340xarhld7xx2vv5fs5xj4418709iw6l6hpk853";
+        hash = "sha256-o6B5oaGGxwQOCoTIXrQre4veT6Mwqw7I2LqMesT17iY=";
       };
+
+      packageRequires = [ promise ];
     };
 
   in [ promise semaphore ]);

pkgs/applications/editors/emacs/make-emacs.nix

@@ -60,6 +60,7 @@
 , texinfo
 , webkitgtk
 , wrapGAppsHook3
+, zlib
 
 # Boolean flags
 , withNativeCompilation ? stdenv.buildPlatform.canExecute stdenv.hostPlatform
@@ -250,6 +251,7 @@ mkDerivation (finalAttrs: {
     glib-networking
   ] ++ lib.optionals withNativeCompilation [
     libgccjit
+    zlib
   ] ++ lib.optionals withImageMagick [
     imagemagick
   ] ++ lib.optionals withPgtk [

pkgs/applications/editors/kibi/default.nix

@@ -8,7 +8,7 @@ rustPlatform.buildRustPackage rec {
   pname = "kibi";
   version = "0.2.2";
 
-  cargoSha256 = "sha256-ebUCkcUACganeq5U0XU4VIGClKDZGhUw6K3WBgTUUUw=";
+  cargoHash = "sha256-ebUCkcUACganeq5U0XU4VIGClKDZGhUw6K3WBgTUUUw=";
 
   src = fetchFromGitHub {
     owner = "ilai-deutel";

pkgs/applications/editors/vim/common.nix

@@ -1,6 +1,6 @@
 { lib, fetchFromGitHub }:
 rec {
-  version = "9.1.0509";
+  version = "9.1.0595";
 
   outputs = [ "out" "xxd" ];
 
@@ -8,7 +8,7 @@ rec {
     owner = "vim";
     repo = "vim";
     rev = "v${version}";
-    hash = "sha256-CATjUalRjvVjEfWT5evFAk//Oj4iB1fDBsRU5MhDyn4=";
+    hash = "sha256-v8xVP1WuvE9XdQl1LDIq3pjaKyqPWM0fsFKcpIwPbNA=";
   };
 
   enableParallelBuilding = true;

pkgs/applications/editors/vim/plugins/overrides.nix

@@ -564,7 +564,7 @@
         pname = "cord.nvim-rust";
         inherit version src;
 
-        cargoSha256 = "sha256-6FYf4pHEPxvhKHHPmkjQ40zPxaiypnpDxF8kNH+h+tg=";
+        cargoHash = "sha256-6FYf4pHEPxvhKHHPmkjQ40zPxaiypnpDxF8kNH+h+tg=";
 
         installPhase = let
           cargoTarget = stdenv.hostPlatform.rust.cargoShortTarget;
@@ -928,7 +928,7 @@
         inherit version;
         src = LanguageClient-neovim-src;
 
-        cargoSha256 = "H34UqJ6JOwuSABdOup5yKeIwFrGc83TUnw1ggJEx9o4=";
+        cargoHash = "sha256-H34UqJ6JOwuSABdOup5yKeIwFrGc83TUnw1ggJEx9o4=";
         buildInputs = lib.optionals stdenv.isDarwin [ CoreServices ];
 
         # FIXME: Use impure version of CoreFoundation because of missing symbols.
@@ -1437,12 +1437,12 @@
 
   sniprun =
     let
-      version = "1.3.14";
+      version = "1.3.15";
       src = fetchFromGitHub {
         owner = "michaelb";
         repo = "sniprun";
         rev = "refs/tags/v${version}";
-        hash = "sha256-9vglmQ9sy0aCbj4H81ublHclpoSfOA7ss5CNdoX54sY=";
+        hash = "sha256-8N+KUawQ6RI6sG8m9wpvJTMQyJ5j/43PRkrTPrWAREQ=";
       };
       sniprun-bin = rustPlatform.buildRustPackage {
         pname = "sniprun-bin";
@@ -1452,7 +1452,7 @@
           darwin.apple_sdk.frameworks.Security
         ];
 
-        cargoHash = "sha256-p4rZBgB3xQC14hRRTjNZT1G1gbaKydlKu6MYNSLk6iA=";
+        cargoHash = "sha256-bLki+6uMKJtk/bu+LNf2E1m/HpEG8zmnM3JI89IjmNs=";
 
         nativeBuildInputs = [ makeWrapper ];
 
@@ -1901,7 +1901,7 @@
       vim-markdown-composer-bin = rustPlatform.buildRustPackage {
         pname = "vim-markdown-composer-bin";
         inherit (super.vim-markdown-composer) src version;
-        cargoSha256 = "sha256-Vie8vLTplhaVU4E9IohvxERfz3eBpd62m8/1Ukzk8e4=";
+        cargoHash = "sha256-Vie8vLTplhaVU4E9IohvxERfz3eBpd62m8/1Ukzk8e4=";
         # tests require network access
         doCheck = false;
       };

pkgs/applications/emulators/darling/default.nix

@@ -38,7 +38,7 @@
 
 , xdg-user-dirs
 
-, addOpenGLRunpath
+, addDriverRunpath
 
 # Whether to pre-compile Python 2 bytecode for performance.
 , compilePy2Bytecode ? false
@@ -217,7 +217,7 @@ in stdenv.mkDerivation {
       exit 1
     fi
 
-    patchelf --add-rpath "${lib.makeLibraryPath wrappedLibs}:${addOpenGLRunpath.driverLink}/lib" \
+    patchelf --add-rpath "${lib.makeLibraryPath wrappedLibs}:${addDriverRunpath.driverLink}/lib" \
       $out/libexec/darling/usr/libexec/darling/mldr
   '';
 

pkgs/applications/emulators/firebird-emu/default.nix

@@ -19,9 +19,6 @@ stdenv.mkDerivation rec {
     hash = "sha256-ZptjlnOiF+hKuKYvBFJL95H5YQuR99d4biOco/MVEmE=";
   };
 
-  # work around https://github.com/NixOS/nixpkgs/issues/19098
-  env.NIX_CFLAGS_COMPILE = lib.optionalString (stdenv.cc.isClang && stdenv.isDarwin) "-fno-lto";
-
   nativeBuildInputs = [ wrapQtAppsHook qmake ];
 
   buildInputs = [ qtbase qtdeclarative qtquickcontrols ];

pkgs/applications/graphics/epick/default.nix

@@ -22,7 +22,7 @@ rustPlatform.buildRustPackage rec {
     sha256 = "sha256-k0WQu1n1sAHVor58jr060vD5/2rDrt1k5zzJlrK9WrU=";
   };
 
-  cargoSha256 = "sha256-OQZPOiMTpoWabxHa3TJG8L3zq8WxMeFttw8xggSXsMA=";
+  cargoHash = "sha256-OQZPOiMTpoWabxHa3TJG8L3zq8WxMeFttw8xggSXsMA=";
 
   nativeBuildInputs = lib.optionals stdenv.isLinux [
     pkg-config

pkgs/applications/graphics/hydrus/default.nix

@@ -82,9 +82,6 @@ python3Packages.buildPythonPackage rec {
     twisted
   ];
 
-  # tests rely on nose
-  doCheck = pythonOlder "3.12";
-
   nativeCheckInputs = with python3Packages; [
     nose
     mock

pkgs/applications/graphics/image-roll/default.nix

@@ -18,7 +18,7 @@ rustPlatform.buildRustPackage rec {
     sha256 = "sha256-CC40TU38bJFnbJl2EHqeB9RBvbVUrBmRdZVS2GxqGu4=";
   };
 
-  cargoSha256 = "sha256-cUE2IZOunR/NIo/qytORRfNqCsf87LfpKA8o/v4Nkhk=";
+  cargoHash = "sha256-cUE2IZOunR/NIo/qytORRfNqCsf87LfpKA8o/v4Nkhk=";
 
   nativeBuildInputs = [ glib pkg-config wrapGAppsHook4 ];
 

pkgs/applications/graphics/menyoki/default.nix

@@ -22,7 +22,7 @@ rustPlatform.buildRustPackage rec {
     sha256 = "sha256-owP3G1Rygraifdc4iPURQ1Es0msNhYZIlfrtj0CSU6Y=";
   };
 
-  cargoSha256 = "sha256-NtXjlGkX8AzSw98xHPymzdnTipMIunyDbpSr4eVowa0=";
+  cargoHash = "sha256-NtXjlGkX8AzSw98xHPymzdnTipMIunyDbpSr4eVowa0=";
 
   nativeBuildInputs = [ installShellFiles ]
     ++ lib.optional stdenv.isLinux pkg-config;

pkgs/applications/graphics/rx/default.nix

@@ -16,7 +16,7 @@ rustPlatform.buildRustPackage rec {
     sha256 = "sha256-LTpaV/fgYUgA2M6Wz5qLHnTNywh13900g+umhgLvciM=";
   };
 
-  cargoSha256 = "sha256-4hi1U4jl6QA7H8AKHlU+Hqz5iKGYHRXHDsrcqY7imkU=";
+  cargoHash = "sha256-4hi1U4jl6QA7H8AKHlU+Hqz5iKGYHRXHDsrcqY7imkU=";
 
   nativeBuildInputs = [ cmake pkg-config makeWrapper ];
 

pkgs/applications/graphics/seamly2d/default.nix

@@ -1,5 +1,5 @@
 { stdenv, lib, qtbase, wrapQtAppsHook, fetchFromGitHub,
-  addOpenGLRunpath, poppler_utils, qtxmlpatterns, qtsvg, mesa, xvfb-run,
+  addDriverRunpath, poppler_utils, qtxmlpatterns, qtsvg, mesa, xvfb-run,
   fontconfig, freetype, xorg, qmake, python3, qttools, git
 }:
 let
@@ -31,7 +31,7 @@ stdenv.mkDerivation rec {
   ];
 
   nativeBuildInputs = [
-    addOpenGLRunpath
+    addDriverRunpath
     xvfb-run
     fontconfig
     wrapQtAppsHook

pkgs/applications/misc/blender/default.nix

@@ -5,7 +5,7 @@
   OpenAL,
   OpenGL,
   SDL,
-  addOpenGLRunpath,
+  addDriverRunpath,
   alembic,
   blender,
   boost,
@@ -220,7 +220,7 @@ stdenv.mkDerivation (finalAttrs: {
       python3Packages.wrapPython
     ]
     ++ lib.optionals cudaSupport [
-      addOpenGLRunpath
+      addDriverRunpath
       cudaPackages.cuda_nvcc
     ]
     ++ lib.optionals waylandSupport [ pkg-config ];
@@ -344,7 +344,7 @@ stdenv.mkDerivation (finalAttrs: {
     lib.optionalString cudaSupport ''
       for program in $out/bin/blender $out/bin/.blender-wrapped; do
         isELF "$program" || continue
-        addOpenGLRunpath "$program"
+        addDriverRunpath "$program"
       done
     ''
     + lib.optionalString stdenv.isDarwin ''

pkgs/applications/misc/calibre/default.nix

@@ -21,7 +21,7 @@
 , qmake
 , qtbase
 , qtwayland
-, speechd
+, speechd-minimal
 , sqlite
 , wrapQtAppsHook
 , xdg-utils
@@ -132,7 +132,7 @@ stdenv.mkDerivation (finalAttrs: {
       ] ++ lib.optional (unrarSupport) unrardll)
     )
     xdg-utils
-  ] ++ lib.optional (speechSupport) speechd;
+  ] ++ lib.optional (speechSupport) speechd-minimal;
 
   installPhase = ''
     runHook preInstall

pkgs/applications/misc/dbx/default.nix

@@ -50,8 +50,7 @@ python.pkgs.buildPythonApplication rec {
       tenacity
       typer
       watchdog
-    ]
-    ++ typer.optional-dependencies.all;
+    ];
 
   passthru.optional-dependencies = with python3.pkgs; {
     aws = [ boto3 ];

pkgs/applications/misc/doctave/default.nix

@@ -14,7 +14,7 @@ rustPlatform.buildRustPackage rec {
   # Cargo.lock is outdated
   cargoPatches = [ ./cargo-lock.patch ];
 
-  cargoSha256 = "sha256-keLcNttdM9JUnn3qi/bWkcObIHl3MRACDHKPSZuScOc=";
+  cargoHash = "sha256-keLcNttdM9JUnn3qi/bWkcObIHl3MRACDHKPSZuScOc=";
 
   buildInputs = lib.optionals stdenv.isDarwin [
     CoreServices

pkgs/applications/misc/eureka-ideas/default.nix

@@ -19,7 +19,7 @@ rustPlatform.buildRustPackage rec {
     sha256 = "sha256-NJ1O8+NBG0y39bMOZeah2jSZlvnPrtpCtXrgAYmVrAc=";
   };
 
-  cargoSha256 = "sha256-tNUWW0HgXl+tM9uciApLSkLDDkzrvAiWmiYs2y/dEOM=";
+  cargoHash = "sha256-tNUWW0HgXl+tM9uciApLSkLDDkzrvAiWmiYs2y/dEOM=";
 
   nativeBuildInputs = [ pkg-config ];
 

pkgs/applications/misc/firestarter/default.nix

@@ -2,7 +2,7 @@
 , lib
 , fetchFromGitHub
 , fetchzip
-, addOpenGLRunpath
+, addDriverRunpath
 , cmake
 , glibc_multi
 , glibc
@@ -67,7 +67,7 @@ stdenv.mkDerivation rec {
     git
     pkg-config
   ] ++ lib.optionals withCuda [
-    addOpenGLRunpath
+    addDriverRunpath
   ];
 
   buildInputs = [ hwloc ] ++ (if withCuda then
@@ -95,7 +95,7 @@ stdenv.mkDerivation rec {
   '';
 
   postFixup = lib.optionalString withCuda ''
-    addOpenGLRunpath $out/bin/FIRESTARTER_CUDA
+    addDriverRunpath $out/bin/FIRESTARTER_CUDA
   '';
 
   meta = with lib; {

pkgs/applications/misc/gpu-burn/default.nix

@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchFromGitHub, addOpenGLRunpath, cudatoolkit }:
+{ lib, stdenv, fetchFromGitHub, addDriverRunpath, cudatoolkit }:
 
 stdenv.mkDerivation {
   pname = "gpu-burn";
@@ -19,7 +19,7 @@ stdenv.mkDerivation {
 
   buildInputs = [ cudatoolkit ];
 
-  nativeBuildInputs = [ addOpenGLRunpath ];
+  nativeBuildInputs = [ addDriverRunpath ];
 
   makeFlags = [ "CUDAPATH=${cudatoolkit}" ];
 
@@ -32,7 +32,7 @@ stdenv.mkDerivation {
   '';
 
   postFixup = ''
-    addOpenGLRunpath $out/bin/gpu_burn
+    addDriverRunpath $out/bin/gpu_burn
   '';
 
   meta = with lib; {

pkgs/applications/misc/inherd-quake/default.nix

@@ -19,7 +19,7 @@ rustPlatform.buildRustPackage rec {
     sha256 = "sha256-HKAR4LJm0lrQgTOCqtYIRFbO3qHtPbr4Fpx2ek1oJ4Q=";
   };
 
-  cargoSha256 = "sha256-svvtZyfN91OT3yqxH6TgFhGYg9drpXsts4p2WqSHG8w=";
+  cargoHash = "sha256-svvtZyfN91OT3yqxH6TgFhGYg9drpXsts4p2WqSHG8w=";
 
   nativeBuildInputs = [ pkg-config ];
 

pkgs/applications/misc/joplin-desktop/default.nix

@@ -2,7 +2,7 @@
 
 let
   pname = "joplin-desktop";
-  version = "3.0.12";
+  version = "3.0.13";
 
   inherit (stdenv.hostPlatform) system;
   throwSystem = throw "Unsupported system: ${system}";
@@ -16,7 +16,7 @@ let
   src = fetchurl {
     url = "https://github.com/laurent22/joplin/releases/download/v${version}/Joplin-${version}${suffix}";
     sha256 = {
-      x86_64-linux = "sha256-vMz+ZeBHP+9Ugy8KO8lbp8zqC8VHtf1TWw10YytQFSs=";
+      x86_64-linux = "sha256-/B7udtkRP8rOYzXupWSEGg0FrJoRJ63l4uLtQWe2CZ8=";
       x86_64-darwin = "sha256-XZN1jTv/FhJXuFxZ6D6h/vFMdKi84Z9UWfj2CrMgBBA=";
       aarch64-darwin = "sha256-lsODOBkZ4+x5D6Er2/paTzAMKZvqIBVkKrWHh5iRvrk=";
     }.${system} or throwSystem;

pkgs/applications/misc/parsec/bin.nix

@@ -16,7 +16,7 @@
 , libXfixes
 , libpulseaudio
 , libva
-, ffmpeg_5
+, ffmpeg_4
 , libpng
 , libjpeg8
 , curl
@@ -57,7 +57,7 @@ stdenvNoCC.mkDerivation {
     alsa-lib
     libpulseaudio
     libva
-    ffmpeg_5
+    ffmpeg_4
     libpng
     libjpeg8
     curl

pkgs/applications/misc/pastel/default.nix

@@ -11,7 +11,7 @@ rustPlatform.buildRustPackage rec {
     sha256 = "sha256-uK4HWC+uGiey+K0p8+Wi+Pi+U7b4k09b8iKF9BmTPcc=";
   };
 
-  cargoSha256 = "sha256-5paHSrqU8tItD/CAbauj6KcW/mKsveOAfXjD/NUuFAc=";
+  cargoHash = "sha256-5paHSrqU8tItD/CAbauj6KcW/mKsveOAfXjD/NUuFAc=";
 
   buildInputs = lib.optional stdenv.isDarwin Security;
 

pkgs/applications/misc/pipr/default.nix

@@ -16,7 +16,7 @@ rustPlatform.buildRustPackage rec {
     sha256 = "sha256-6jtUNhib6iveuZ7qUKK7AllyMKFpZ8OUUaIieFqseY8=";
   };
 
-  cargoSha256 = "sha256-SLOiX8z8LuQ9VA/lg0lOhqs85MGs0vmeP74cS6sgghI=";
+  cargoHash = "sha256-SLOiX8z8LuQ9VA/lg0lOhqs85MGs0vmeP74cS6sgghI=";
 
   nativeBuildInputs = [ makeWrapper ];
   postFixup = ''

pkgs/applications/misc/pomodoro/default.nix

@@ -11,7 +11,7 @@ rustPlatform.buildRustPackage rec {
     sha256 = "sha256-ZA1q1YVJcdSUF9NTikyT3vrRnqbsu5plzRI2gMu+qnQ=";
   };
 
-  cargoSha256 = "sha256-6ZhWStZebXSwrej36DXifrsrmR1SWW3PwGUX0hqPwE4=";
+  cargoHash = "sha256-6ZhWStZebXSwrej36DXifrsrmR1SWW3PwGUX0hqPwE4=";
   buildInputs = lib.optionals stdenv.isDarwin [ Foundation ];
 
   meta = with lib; {

pkgs/applications/misc/pop-launcher/default.nix

@@ -29,7 +29,7 @@ rustPlatform.buildRustPackage rec {
         --replace '/usr/bin/gnome-terminal' 'gnome-terminal'
   '';
 
-  cargoSha256 = "sha256-cTvrq0fH057UIx/O9u8zHMsg+psMGg1q9klV5OMxtok=";
+  cargoHash = "sha256-cTvrq0fH057UIx/O9u8zHMsg+psMGg1q9klV5OMxtok=";
 
   cargoBuildFlags = [ "--package" "pop-launcher-bin" ];
 

pkgs/applications/misc/process-viewer/default.nix

@@ -16,7 +16,7 @@ rustPlatform.buildRustPackage rec {
     hash = "sha256-mEmtLCtHlrCurjKKJ3vEtEkLBik4LwuUED5UeQ1QLws=";
   };
 
-  cargoSha256 = "sha256-lgVByl+mpCDbhwlC1Eiw9ZkHIDYJsOR06Ds790pXOMc=";
+  cargoHash = "sha256-lgVByl+mpCDbhwlC1Eiw9ZkHIDYJsOR06Ds790pXOMc=";
 
   nativeBuildInputs = [ pkg-config ];