Merge master into staging-next

doc/hooks/breakpoint.section.md

@@ -1,6 +1,6 @@
 # breakpointHook {#breakpointhook}
 
-This hook will make a build pause instead of stopping when a failure happens. It prevents nix from cleaning up the build environment immediately and allows the user to attach to a build environment using the `cntr` command. Upon build error it will print instructions on how to use `cntr`, which can be used to enter the environment for debugging. Installing cntr and running the command will provide shell access to the build sandbox of failed build. At `/var/lib/cntr` the sandboxed filesystem is mounted. All commands and files of the system are still accessible within the shell. To execute commands from the sandbox use the cntr exec subcommand. `cntr` is only supported on Linux-based platforms. To use it first add `cntr` to your `environment.systemPackages` on NixOS or alternatively to the root user on non-NixOS systems. Then in the package that is supposed to be inspected, add `breakpointHook` to `nativeBuildInputs`.
+This hook makes a build pause instead of stopping when a failure occurs. It prevents Nix from cleaning up the build environment immediately and allows the user to attach to the build environment. Upon a build error, it will print instructions that can be used to enter the environment for debugging. breakpointHook is only available on Linux. To use it, add `breakpointHook` to `nativeBuildInputs` in the package to be inspected.
 
 ```nix
 {
@@ -8,10 +8,10 @@ This hook will make a build pause instead of stopping when a failure happens. It
 }
 ```
 
-When a build failure happens there will be an instruction printed that shows how to attach with `cntr` to the build sandbox.
+When a build failure occurs, an instruction will be printed showing how to attach to the build sandbox.
 
 ::: {.note}
 Caution with remote builds
 
-This won’t work with remote builds as the build environment is on a different machine and can’t be accessed by `cntr`. Remote builds can be turned off by setting `--option builders ''` for `nix-build` or `--builders ''` for `nix build`.
+For remote builds, the printed instructions need to be run on the remote machine, as the build sandbox is only accessible on the machine running the builds. Remote builds can be turned off by setting `--option builders ''` for `nix-build` or `--builders ''` for `nix build`. :::
 :::

nixos/doc/manual/release-notes/rl-2411.section.md

@@ -815,6 +815,8 @@
 
 - Kanidm previously had an incorrect systemd service type, causing dependent units with an `after` and `requires` directive to start before `kanidm*` finished startup. The module has now been updated in line with upstream recommendations.
 
+- [`services.jupyter`](#opt-services.jupyter.enable) is now compatible with `Jupyter Notebook 7`. See [the migration guide](https://jupyter-notebook.readthedocs.io/en/latest/migrate_to_notebook7.html) for details.
+
 - The kubelet configuration file can now be amended with arbitrary additional content using the `services.kubernetes.kubelet.extraConfig` option.
 
 - The `services.seafile` module was updated to major version 11.

nixos/doc/manual/release-notes/rl-2505.section.md

@@ -318,6 +318,8 @@
 
 - GOverlay has been updated to 1.2, please check the [upstream changelog](https://github.com/benjamimgois/goverlay/releases) for more details.
 
+- [`services.jupyter`](#opt-services.jupyter.enable) is now compatible with `Jupyter Notebook 7`. See [the migration guide](https://jupyter-notebook.readthedocs.io/en/latest/migrate_to_notebook7.html) for details.
+
 - `networking.wireguard` now has an optional networkd backend. It is enabled by default when `networking.useNetworkd` is enabled, and it can be enabled alongside scripted networking with `networking.wireguard.useNetworkd`. Some `networking.wireguard` options have slightly different behavior with the networkd and script-based backends, documented in each option.
 
 - `services.avahi.ipv6` now defaults to true.
@@ -358,6 +360,8 @@
 
 - `programs.fzf.keybindings` now supports the fish shell.
 
+- `gerbera` now has wavpack support.
+
 <!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->
 
 ```{=include=} sections

nixos/modules/services/development/jupyter/default.nix

@@ -2,13 +2,20 @@
   config,
   lib,
   pkgs,
+  options,
   ...
 }:
 let
 
   cfg = config.services.jupyter;
 
-  package = cfg.package;
+  package = pkgs.python3.withPackages (
+    ps:
+    [
+      cfg.package
+    ]
+    ++ cfg.extraPackages
+  );
 
   kernels = (
     pkgs.jupyter-kernel.create {
@@ -16,15 +23,17 @@ let
     }
   );
 
-  notebookConfig = pkgs.writeText "jupyter_config.py" ''
+  notebookConfig = pkgs.writeText "jupyter_server_config.py" ''
     ${cfg.notebookConfig}
-
-    c.NotebookApp.password = ${cfg.password}
+    c.ServerApp.password = "${cfg.password}"
   '';
 
 in
 {
-  meta.maintainers = with lib.maintainers; [ aborsu ];
+  meta.maintainers = with lib.maintainers; [
+    aborsu
+    b-m-f
+  ];
 
   options.services.jupyter = {
     enable = lib.mkEnableOption "Jupyter development server";
@@ -37,18 +46,42 @@ in
       '';
     };
 
-    # NOTE: We don't use top-level jupyter because we don't
-    # want to pass in JUPYTER_PATH but use .environment instead,
-    # saving a rebuild.
-    package = lib.mkPackageOption pkgs [ "python3" "pkgs" "notebook" ] { };
+    package = lib.mkPackageOption pkgs [
+      "python3"
+      "pkgs"
+      "jupyter"
+    ] { };
+
+    extraPackages = lib.mkOption {
+      type = lib.types.listOf lib.types.package;
+      default = [ ];
+      example = lib.literalExpression ''
+        [
+          pkgs.python3.pkgs.nbconvert
+          pkgs.python3.pkgs.playwright
+        ]
+      '';
+      description = ''Extra packages to be available in the jupyter runtime enviroment'';
+    };
+    extraEnvironmentVariables = lib.mkOption {
+      description = ''Extra enviroment variables to be set in the runtime context of jupyter notebook'';
+      default = { };
+      example = lib.literalExpression ''
+        {
+          PLAYWRIGHT_BROWSERS_PATH = "''${pkgs.playwright-driver.browsers}";
+          PLAYWRIGHT_SKIP_VALIDATE_HOST_REQUIREMENTS = "true";
+        }
+      '';
+      inherit (options.environment.variables) type apply;
+    };
 
     command = lib.mkOption {
       type = lib.types.str;
-      default = "jupyter-notebook";
-      example = "jupyter-lab";
+      default = "jupyter notebook";
+      example = "jupyter lab";
       description = ''
         Which command the service runs. Note that not all jupyter packages
-        have all commands, e.g. jupyter-lab isn't present in the default package.
+        have all commands, e.g. `jupyter lab` isn't present in the `notebook` package.
       '';
     };
 
@@ -93,16 +126,9 @@ in
       type = lib.types.str;
       description = ''
         Password to use with notebook.
-        Can be generated using:
-          In [1]: from notebook.auth import passwd
-          In [2]: passwd('test')
-          Out[2]: 'sha1:1b961dc713fb:88483270a63e57d18d43cf337e629539de1436ba'
-          NOTE: you need to keep the single quote inside the nix string.
-        Or you can use a python oneliner:
-          "open('/path/secret_file', 'r', encoding='utf8').read().strip()"
-        It will be interpreted at the end of the notebookConfig.
+        Can be generated following: https://jupyter-server.readthedocs.io/en/stable/operators/public-server.html#preparing-a-hashed-password
       '';
-      example = "'sha1:1b961dc713fb:88483270a63e57d18d43cf337e629539de1436ba'";
+      example = "argon2:$argon2id$v=19$m=10240,t=10,p=8$48hF+vTUuy1LB83/GzNhUg$J1nx4jPWD7PwOJHs5OtDW8pjYK2s0c1R3rYGbSIKB54";
     };
 
     notebookConfig = lib.mkOption {
@@ -110,6 +136,7 @@ in
       default = "";
       description = ''
         Raw jupyter config.
+        Please use the password configuration option to set a password instead of passing it in here.
       '';
     };
 
@@ -175,7 +202,7 @@ in
 
         environment = {
           JUPYTER_PATH = toString kernels;
-        };
+        } // cfg.extraEnvironmentVariables;
 
         serviceConfig = {
           Restart = "always";
@@ -185,7 +212,8 @@ in
                         --ip=${cfg.ip} \
                         --port=${toString cfg.port} --port-retries 0 \
                         --notebook-dir=${cfg.notebookDir} \
-                        --NotebookApp.config_file=${notebookConfig}
+                        --JupyterApp.config_file=${notebookConfig}
+
           '';
           User = cfg.user;
           Group = cfg.group;

nixos/modules/services/networking/wstunnel.nix

@@ -168,7 +168,7 @@ let
         };
 
         localToRemote = lib.mkOption {
-          description = ''Listen on local and forwards traffic from remote.'';
+          description = "Listen on local and forwards traffic from remote.";
           type = lib.types.listOf (lib.types.str);
           default = [ ];
           example = [
@@ -468,10 +468,11 @@ in
 
         (lib.mapAttrsToList (name: serverCfg: {
           assertion =
-            (serverCfg.tlsCertificate == null && serverCfg.tlsKey == null)
-            || (serverCfg.tlsCertificate != null && serverCfg.tlsKey != null);
+            serverCfg.enableHTTPS
+            ->
+              (serverCfg.useACMEHost != null) || (serverCfg.tlsCertificate != null && serverCfg.tlsKey != null);
           message = ''
-            services.wstunnel.servers."${name}".tlsCertificate and services.wstunnel.servers."${name}".tlsKey need to be set together.
+            If services.wstunnel.servers."${name}".enableHTTPS is set to true, either services.wstunnel.servers."${name}".useACMEHost or both services.wstunnel.servers."${name}".tlsKey and services.wstunnel.servers."${name}".tlsCertificate need to be set.
           '';
         }) cfg.servers)
       ++

nixos/modules/services/web-apps/cryptpad.nix

@@ -195,7 +195,7 @@ in
           SystemCallFilter = [
             "@pkey"
             "@system-service"
-            "~@chown"
+            "@chown"
             "~@keyring"
             "~@memlock"
             "~@privileged"

pkgs/applications/editors/vim/plugins/non-generated/blink-cmp/default.nix

@@ -9,12 +9,12 @@
   replaceVars,
 }:
 let
-  version = "0.8.2";
+  version = "0.9.2";
   src = fetchFromGitHub {
     owner = "Saghen";
     repo = "blink.cmp";
     tag = "v${version}";
-    hash = "sha256-b+7be0ShxFhkUfQo0QTnYaaEE62HQKF5g+xCuTrPRXE=";
+    hash = "sha256-uvMB3oU6uxERfkXiweeFS0cCIOgO/ogy7GoYAlXUPDs=";
   };
   libExt = if stdenv.hostPlatform.isDarwin then "dylib" else "so";
   blink-fuzzy-lib = rustPlatform.buildRustPackage {
@@ -22,7 +22,7 @@ let
     pname = "blink-fuzzy-lib";
 
     useFetchCargoVendor = true;
-    cargoHash = "sha256-t84hokb2loZ6FPPt4eN8HzgNQJrQUdiG5//ZbmlasWY=";
+    cargoHash = "sha256-ISCrUaIWNn+SfNzrAXKqeBbQyEnuqs3F8GAEl90kK7I=";
 
     nativeBuildInputs = [ git ];
 

pkgs/by-name/ar/archivemount/package.nix

@@ -2,7 +2,6 @@
   lib,
   stdenv,
   fetchFromSourcehut,
-  fetchpatch,
   pkg-config,
   fuse,
   libarchive,
@@ -10,13 +9,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "archivemount";
-  version = "1";
+  version = "1a";
 
   src = fetchFromSourcehut {
     owner = "~nabijaczleweli";
     repo = "archivemount-ng";
     rev = finalAttrs.version;
-    hash = "sha256-xuLtbqC9iS86BKz4jG8of4id+GTlBXoohONrkmIzOpY=";
+    hash = "sha256-XfWs8+vYCa9G9aPtXk/s5YYq/CHNOS7XDrGW7WpSWBQ=";
   };
 
   nativeBuildInputs = [ pkg-config ];
@@ -32,16 +31,6 @@ stdenv.mkDerivation (finalAttrs: {
 
   dontConfigure = true;
 
-  # Fix missing standard struct stat on Darwin
-  # Already on upstream, but no new release made
-  patches = [
-    (fetchpatch {
-      name = "fix-missing-standard-struct-stat-on-darwin.patch";
-      url = "https://git.sr.ht/~nabijaczleweli/archivemount-ng/commit/53dd70f05fdb6ababe7c1ca70f0f62bcf4930b5a.patch";
-      hash = "sha256-UqoALAJoNXihop6Mem4mu+W8REOV92Zyv7pPW20Ugz8=";
-    })
-  ];
-
   # Fix cross-compilation
   postPatch = ''
     substituteInPlace Makefile --replace-fail pkg-config "$PKG_CONFIG"
@@ -49,6 +38,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   meta = {
     description = "Gateway between FUSE and libarchive: allows mounting of cpio, .tar.gz, .tar.bz2 archives";
+    changelog = "https://git.sr.ht/~nabijaczleweli/archivemount-ng/refs/${finalAttrs.version}";
     mainProgram = "archivemount";
     license = [
       lib.licenses.lgpl2Plus

pkgs/by-name/at/ats2/package.nix

@@ -52,7 +52,7 @@ stdenv.mkDerivation rec {
     "CCOMP=${stdenv.cc.targetPrefix}cc"
   ];
 
-  env.NIX_CFLAGS_COMPILE = lib.optionalString stdenv.cc.isClang "-Wno-error=implicit-function-declaration";
+  env.NIX_CFLAGS_COMPILE = "-Wno-error=implicit-function-declaration";
 
   setupHook =
     let

pkgs/by-name/br/breakpointHook/attach.sh

@@ -0,0 +1,46 @@
+#! /usr/bin/env bash
+
+set -eu -o pipefail
+
+id="$1"
+pids="$(pgrep -f "sleep $id" || :)"
+if [ -z "$pids" ]; then
+  echo "Error: No process found for 'sleep $id'. The build must still be running in order to attach. Also make sure it's not on a remote builder." >&2
+  exit 1
+elif [ "$(echo "$pids" | wc -l)" -ne 1 ]; then
+  echo "Error: Multiple processes found matching 'sleep $id'" >&2
+  exit 1
+fi
+pid="$(echo "$pids" | head -n1)"
+
+# helper to extract variables from the build env
+getVar(){
+  while IFS= read -r -d $'\0' line; do
+    case "$line" in
+      *"$1="* )
+        echo "$line"
+        ;;
+    esac
+  done < /proc/$pid/environ \
+  | cut -d "=" -f 2
+}
+
+# bash is needed to load the env vars, as we do not know the syntax of the debug shell.
+# bashInteractive is used instead of bash, as we depend on it anyways, due to it being
+#   the default debug shell
+bashInteractive="$(getVar bashInteractive)"
+# the debug shell will be started as interactive shell after loading the env vars
+debugShell="$(getVar debugShell)"
+# to drop the user into the working directory at the point of failure
+pwd="$(readlink /proc/$pid/cwd)"
+
+# enter the namespace of the failed build
+exec nsenter --mount --net --target "$pid" "$bashInteractive" -c "
+  set -eu -o pipefail
+  while IFS= read -r -d \$'\0' line; do
+    export \"\$line\"
+  done <&3
+  exec 3>&-
+  cd \"$pwd\"
+  exec \"$debugShell\"
+" 3< /proc/$pid/environ

pkgs/by-name/br/breakpointHook/breakpoint-hook.sh

@@ -1,9 +1,20 @@
 breakpointHook() {
     local red='\033[0;31m'
+    local cyan='\033[0;36m'
+    local green='\033[0;32m'
     local no_color='\033[0m'
 
-    echo -e "${red}build failed in ${curPhase} with exit code ${exitCode}${no_color}"
-    printf "To attach install cntr and run the following command as root:\n\n"
-    sh -c "echo '   cntr attach -t command cntr-${out}'; while true; do sleep 99999999; done"
+    # provide the user with an interactive shell for better experience
+    export bashInteractive="@bashInteractive@"
+    if [ -z "$debugShell" ]; then
+        export debugShell="@bashInteractive@"
+    fi
+
+    local id
+    id="$(shuf -i 999999-9999999 -n1)"
+    echo -e "${red}build for ${cyan}${name:-unknown}${red} failed in ${curPhase:-unknown} with exit code ${exitCode:-unknown}${no_color}"
+    echo -e "${green}To attach, run the following command:${no_color}"
+    echo -e "${green}    sudo @attach@ $id${no_color}"
+    sleep "$id"
 }
 failureHooks+=(breakpointHook)

pkgs/by-name/br/breakpointHook/package.nix

@@ -1,6 +1,38 @@
-{ stdenv, makeSetupHook }:
+{
+  lib,
+  stdenv,
+
+  bash,
+  bashInteractive,
+  coreutils,
+  makeSetupHook,
+  procps,
+  util-linux,
+  writeShellScriptBin,
+}:
+
+let
+  attach = writeShellScriptBin "attach" ''
+    export PATH="${
+      lib.makeBinPath [
+        bash
+        coreutils
+        procps # needed for pgrep
+        util-linux # needed for nsenter
+      ]
+    }"
+    exec bash ${./attach.sh} "$@"
+  '';
+in
 
 makeSetupHook {
   name = "breakpoint-hook";
   meta.broken = !stdenv.buildPlatform.isLinux;
+  substitutions = {
+    attach = "${attach}/bin/attach";
+    # The default interactive shell in case $debugShell is not set in the derivation.
+    # Can be overridden to zsh or fish, etc.
+    # This shell is also used to load the env variables before the $debugShell is started.
+    bashInteractive = lib.getExe bashInteractive;
+  };
 } ./breakpoint-hook.sh

pkgs/by-name/br/breakpointHookCntr/breakpoint-hook.sh

@@ -0,0 +1,9 @@
+breakpointHook() {
+    local red='\033[0;31m'
+    local no_color='\033[0m'
+
+    echo -e "${red}build failed in ${curPhase} with exit code ${exitCode}${no_color}"
+    printf "To attach install cntr and run the following command as root:\n\n"
+    sh -c "echo '   cntr attach -t command cntr-${out}'; while true; do sleep 99999999; done"
+}
+failureHooks+=(breakpointHook)

pkgs/by-name/br/breakpointHookCntr/package.nix

@@ -0,0 +1,6 @@
+{ stdenv, makeSetupHook }:
+
+makeSetupHook {
+  name = "breakpoint-hook";
+  meta.broken = !stdenv.buildPlatform.isLinux;
+} ./breakpoint-hook.sh

pkgs/by-name/ca/cargo-mutants/package.nix

@@ -6,16 +6,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "cargo-mutants";
-  version = "24.11.2";
+  version = "25.0.0";
 
   src = fetchFromGitHub {
     owner = "sourcefrog";
     repo = "cargo-mutants";
     rev = "v${version}";
-    hash = "sha256-tUPOBTNS3cGUSmOpMGJrCqZBnnvYH/s1gvP2kpFddEg=";
+    hash = "sha256-JwRMXFXYXPg/grFqeGIcWpDPI5/wFIldx4ORE8ODyk8=";
   };
 
-  cargoHash = "sha256-3CndHAWoMvTc2cxAz+b7UEBxxrWmroOPzqMX6DhxhPQ=";
+  cargoHash = "sha256-8sAyQ858brL6EFW8gRAPrlpSPW7lYrd4dFOyUDOnIaU=";
 
   # too many tests require internet access
   doCheck = false;

pkgs/by-name/ct/ctune/package.nix

@@ -17,13 +17,13 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "ctune";
-  version = "1.3.2";
+  version = "1.3.3";
 
   src = fetchFromGitHub {
     owner = "An7ar35";
     repo = "ctune";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-fy7Wb4R6HDa+cLxI5YWq67gxw1XS/iDDN4M3Rn7GYeI=";
+    hash = "sha256-jiRUEUmcjuylJj23ZFJS0BNS4NIdzuVL4AmO6CNaxHY=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/cu/cunicu/package.nix

@@ -12,16 +12,16 @@
 }:
 buildGoModule rec {
   pname = "cunicu";
-  version = "0.6.5";
+  version = "0.10.0";
 
   src = fetchFromGitHub {
     owner = "cunicu";
     repo = "cunicu";
     rev = "v${version}";
-    hash = "sha256-bDXZ0a9yQZMHmNrwKRQzLoPtwkthDIDRhBxDAeXN064=";
+    hash = "sha256-rUUJMvT3JkIehoWLOtruUSU8YbKd6mS7Wp2TXwn9aVE=";
   };
 
-  vendorHash = "sha256-g2FA5b/80yRwIbAf3Sot74Eftj/Q/bTBj8lK+tQ2UNg=";
+  vendorHash = "sha256-yFpkYI6ue5LXwRCj4EqWDBaO3TYzZ3Ov/39PRQWMWzk=";
 
   nativeBuildInputs = [
     installShellFiles

pkgs/by-name/do/doas-sudo-shim/package.nix

@@ -15,13 +15,13 @@
 
 stdenv.mkDerivation rec {
   pname = "doas-sudo-shim";
-  version = "0.1.1";
+  version = "0.1.2";
 
   src = fetchFromGitHub {
     owner = "jirutka";
     repo = "doas-sudo-shim";
     rev = "v${version}";
-    sha256 = "QYVqGxeWC7Tiz8aNY/LukwG4EW0km/RunGEfkzY/A38=";
+    sha256 = "sha256-jgakKxglJi4LcxXsSE4mEdY/44kPxVb/jF7CgX7dllA=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/el/elan/0001-dynamically-patchelf-binaries.patch

@@ -2,7 +2,7 @@ diff --git a/src/elan-dist/src/component/package.rs b/src/elan-dist/src/componen
 index c51e76d..ae8159e 100644
 --- a/src/elan-dist/src/component/package.rs
 +++ b/src/elan-dist/src/component/package.rs
-@@ -56,6 +56,37 @@ fn unpack_without_first_dir<R: Read>(archive: &mut tar::Archive<R>, path: &Path)
+@@ -56,6 +56,52 @@ fn unpack_without_first_dir<R: Read>(archive: &mut tar::Archive<R>, path: &Path)
          entry
              .unpack(&full_path)
              .chain_err(|| ErrorKind::ExtractingPackage)?;
@@ -14,13 +14,12 @@ index c51e76d..ae8159e 100644
 +
 +fn nix_patch_if_needed(dest_path: &Path) -> Result<()> {
 +    let is_bin = matches!(dest_path.parent(), Some(p) if p.ends_with("bin"));
-+    if is_bin {
-+        let _ = ::std::process::Command::new("@patchelf@/bin/patchelf")
-+            .arg("--set-interpreter")
-+            .arg("@dynamicLinker@")
-+            .arg(dest_path)
-+            .output();
-+    }
++    if !is_bin { return Ok(()) }
++    let _ = ::std::process::Command::new("@patchelf@/bin/patchelf")
++        .arg("--set-interpreter")
++        .arg("@dynamicLinker@")
++        .arg(dest_path)
++        .output();
 +
 +    if dest_path.file_name() == Some(::std::ffi::OsStr::new("leanc")) {
 +        use std::os::unix::fs::PermissionsExt;
@@ -32,11 +31,27 @@ index c51e76d..ae8159e 100644
 +LEAN_CC="${LEAN_CC:-@cc@}" exec -a "$0" "$dir/leanc.orig" "$@" -L"$dir/../lib"
 +"#)?;
 +        ::std::fs::set_permissions(dest_path, ::std::fs::Permissions::from_mode(0o755))?;
-+    }
++    } else if dest_path.file_name() == Some(::std::ffi::OsStr::new("lake")) {
++        // since Lean 4.16.0, `lake` calls `LEAN_CC` directly instead of through `leanc`
++        use std::os::unix::fs::PermissionsExt;
++        ::std::fs::write(dest_path.with_file_name("cc"), r#"#! @shell@
++dir="$(dirname "${BASH_SOURCE[0]}")"
++# use bundled libraries, but not bundled compiler that doesn't know about NIX_LDFLAGS
++exec "@cc@" "$@" -L"$dir/../lib"
++"#)?;
++        ::std::fs::set_permissions(dest_path.with_file_name("cc"), ::std::fs::Permissions::from_mode(0o755))?;
 +
-+    if dest_path.file_name() == Some(::std::ffi::OsStr::new("llvm-ar")) {
++        let new_path = dest_path.with_extension("orig");
++        ::std::fs::rename(dest_path, &new_path)?;
++        ::std::fs::write(dest_path, r#"#! @shell@
++dir="$(dirname "${BASH_SOURCE[0]}")"
++# use custom `cc`
++LEAN_CC="${LEAN_CC:-"$dir/cc"}" exec -a "$0" "$dir/lake.orig" "$@"
++"#)?;
++        ::std::fs::set_permissions(dest_path, ::std::fs::Permissions::from_mode(0o755))?;
++    } else if dest_path.file_name() == Some(::std::ffi::OsStr::new("llvm-ar")) {
 +        ::std::fs::remove_file(dest_path)?;
 +        ::std::os::unix::fs::symlink("@ar@", dest_path)?;
      }
- 
+
      Ok(())

pkgs/by-name/en/enzyme/package.nix

@@ -7,13 +7,13 @@
 }:
 llvmPackages.stdenv.mkDerivation rec {
   pname = "enzyme";
-  version = "0.0.170";
+  version = "0.0.172";
 
   src = fetchFromGitHub {
     owner = "EnzymeAD";
     repo = "Enzyme";
     rev = "v${version}";
-    hash = "sha256-8ljzf/opZnZMOcXi5IBMiS2KYlvIjrtSq/Aee2/IUdU=";
+    hash = "sha256-/FxjXCML7hBNYOVf1PLG+VwCdaNGYwwirRJSQxIvLcg=";
   };
 
   postPatch = ''

pkgs/by-name/ep/epson-escpr2/package.nix

@@ -10,14 +10,14 @@
 
 stdenv.mkDerivation rec {
   pname = "epson-inkjet-printer-escpr2";
-  version = "1.2.21";
+  version = "1.2.24";
 
   src = fetchurl {
     # To find the most recent version go to
     # https://support.epson.net/linux/Printer/LSB_distribution_pages/en/escpr2.php
     # and retreive the download link for source package for x86 CPU
-    url = "https://download3.ebz.epson.net/dsc/f/03/00/16/37/15/74a363ac972fde613c55618c2518f67e2a295cc8/epson-inkjet-printer-escpr2-1.2.21-1.src.rpm";
-    sha256 = "sha256-GwGR+K4VoLffAnI6wuJKOUCLnTrKEBK9j6rAzqKbX7U=";
+    url = "https://download3.ebz.epson.net/dsc/f/03/00/16/58/53/436aba09336f96ed31378f90848be6588a177439/epson-inkjet-printer-escpr2-1.2.24-1.src.rpm";
+    sha256 = "sha256-SI5vXdpxRu6/QdAMdgNpqgcTqyHntiS0zo38XPd4Xtg=";
   };
 
   unpackPhase = ''

pkgs/by-name/ge/gerbera/package.nix

@@ -2,7 +2,6 @@
   lib,
   stdenv,
   fetchFromGitHub,
-  fetchpatch,
   cmake,
   pkg-config,
   nixosTests,
@@ -14,6 +13,7 @@
   spdlog,
   sqlite,
   zlib,
+  fmt_11,
   # options
   enableMysql ? false,
   libmysqlclient,
@@ -38,6 +38,8 @@
   ffmpegthumbnailer,
   enableInotifyTools ? true,
   inotify-tools,
+  wavpack,
+  enableWavPack ? false,
 }:
 
 let
@@ -107,37 +109,38 @@ let
       enable = enableTaglib;
       packages = [ taglib ];
     }
+    {
+      name = "WAVPACK";
+      enable = enableWavPack;
+      packages = [ wavpack ];
+    }
   ];
 
-  inherit (lib) flatten optionals;
+  inherit (lib) flatten;
 
 in
 stdenv.mkDerivation rec {
   pname = "gerbera";
-  version = "1.12.1";
+  version = "2.3.0";
 
   src = fetchFromGitHub {
     repo = "gerbera";
     owner = "gerbera";
     rev = "v${version}";
-    sha256 = "sha256-j5J0u0zIjHY2kP5P8IzN2h+QQSCwsel/iTspad6V48s=";
+    sha256 = "sha256-SUMXnVCmrxoEbKKuzh+b7uvIanxilvpDDiH5ihjAm38=";
   };
 
-  patches = [
-    # Can be removed on the next bump, see:
-    # https://github.com/gerbera/gerbera/pull/2840.
-    (fetchpatch {
-      name = "gerbera-fmt10.patch";
-      url = "https://github.com/gerbera/gerbera/commit/37957aac0aea776e6f843af2358916f81056a405.patch";
-      hash = "sha256-U7dyFGEbelVZeHYX/4fLOC0k+9pUKZ8qP/LIVXWCMcU=";
-    })
-  ];
-
-  postPatch = lib.optionalString enableMysql ''
-    substituteInPlace cmake/FindMySQL.cmake \
-      --replace /usr/include/mysql ${lib.getDev libmysqlclient}/include/mariadb \
-      --replace /usr/lib/mysql     ${lib.getLib libmysqlclient}/lib/mariadb
-  '';
+  postPatch =
+    let
+      mysqlPatch = lib.optionalString enableMysql ''
+        substituteInPlace cmake/FindMySQL.cmake \
+          --replace /usr/include/mysql ${lib.getDev libmysqlclient}/include/mariadb \
+          --replace /usr/lib/mysql     ${lib.getLib libmysqlclient}/lib/mariadb
+      '';
+    in
+    ''
+      ${mysqlPatch}
+    '';
 
   cmakeFlags = [
     # systemd service will be generated alongside the service
@@ -157,6 +160,7 @@ stdenv.mkDerivation rec {
     spdlog
     sqlite
     zlib
+    fmt_11
   ] ++ flatten (builtins.catAttrs "packages" (builtins.filter (e: e.enable) options));
 
   passthru.tests = { inherit (nixosTests) mediatomb; };
@@ -164,7 +168,7 @@ stdenv.mkDerivation rec {
   meta = with lib; {
     homepage = "https://docs.gerbera.io/";
     changelog = "https://github.com/gerbera/gerbera/releases/tag/v${version}";
-    description = "UPnP Media Server for 2020";
+    description = "UPnP Media Server for 2024";
     longDescription = ''
       Gerbera is a Mediatomb fork.
       It allows to stream your digital media through your home network and consume it on all kinds

pkgs/by-name/gi/gitsign/package.nix

@@ -10,15 +10,15 @@
 
 buildGoModule rec {
   pname = "gitsign";
-  version = "0.11.0";
+  version = "0.12.0";
 
   src = fetchFromGitHub {
     owner = "sigstore";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-103sW7X5Bddvqat9oHfkpG2BReu7g24xGH2ia0JLAjQ=";
+    hash = "sha256-MOj3bpVgeZlsvJqPD5mAud7jSHsRPCKvYAe2aQ4rWcw=";
   };
-  vendorHash = "sha256-XzKpzEYAKQUkGT+/XQJPzEp/qYuBOnE7jWHXtmitZDI=";
+  vendorHash = "sha256-POB8mSGyW45RSbNq9Vp/LW3jEtnHi7zufihXFTnWEfw=";
 
   subPackages = [
     "."

pkgs/by-name/go/gopeed/package.nix

@@ -14,11 +14,11 @@
 }:
 stdenv.mkDerivation rec {
   pname = "gopeed";
-  version = "1.6.5";
+  version = "1.6.6";
 
   src = fetchurl {
     url = "https://github.com/GopeedLab/gopeed/releases/download/v${version}/Gopeed-v${version}-linux-amd64.deb";
-    hash = "sha256-pFxFw8ZNV8u0Wbeh5/j/EpuH9GiyjFVyLl2M7jUr7tc=";
+    hash = "sha256-Q2eCOah5Pz5kOiHjvB0CzC0iL8m4XAjAJzYxQ+YyBoY=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/ha/harsh/package.nix

@@ -6,13 +6,13 @@
 
 buildGoModule rec {
   pname = "harsh";
-  version = "0.10.6";
+  version = "0.10.7";
 
   src = fetchFromGitHub {
     owner = "wakatara";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-yOF+SZaUOkZnU0uYrsvClpPvKO64cFFB9qmOPoh6ZcA=";
+    hash = "sha256-M19JX+a1dFq05UZmPJyhkhxDwNBRQTPE8mdKbCER+4M=";
   };
 
   vendorHash = "sha256-hdPkiF1HHuIl6KbilPre6tAqSnYPhYhrxBEj3Ayy2AY=";

pkgs/by-name/ke/keymapper/package.nix

@@ -17,13 +17,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "keymapper";
-  version = "4.9.1";
+  version = "4.9.2";
 
   src = fetchFromGitHub {
     owner = "houmain";
     repo = "keymapper";
     rev = finalAttrs.version;
-    hash = "sha256-i/iAOj2fdC4XeC3XbQU0BPoY36Ccva5YaYIvDdrmCD8=";
+    hash = "sha256-8SHFIL0HLzi0UkZ8E+VnLf9pQ/I048/HhVx3eWavt/Y=";
   };
 
   # all the following must be in nativeBuildInputs

pkgs/by-name/m4/m4ri/package.nix

@@ -1,19 +1,22 @@
 {
   lib,
   stdenv,
-  fetchFromBitbucket,
+  fetchFromGitHub,
   autoreconfHook,
 }:
 
 stdenv.mkDerivation rec {
-  version = "20200125";
+  version = "20240729";
   pname = "m4ri";
 
-  src = fetchFromBitbucket {
+  src = fetchFromGitHub {
     owner = "malb";
     repo = "m4ri";
-    rev = "release-${version}";
-    sha256 = "1dxgbv6zdyki3h61qlv7003wzhy6x14zmcaz9x19md1i7ng07w1k";
+    # 20240729 has a broken m4ri.pc file, fixed in the next commit.
+    # TODO: remove if on update
+    rev =
+      if version == "20240729" then "775189bfea96ffaeab460513413fcf4fbcd64392" else "release-${version}";
+    hash = "sha256-untwo0go8O8zNO0EyZ4n/n7mngSXLr3Z/FSkXA8ptnU=";
   };
 
   doCheck = true;

pkgs/by-name/m4/m4rie/package.nix

@@ -7,14 +7,14 @@
 }:
 
 stdenv.mkDerivation rec {
-  version = "20200125";
+  version = "20250103";
   pname = "m4rie";
 
   src = fetchFromBitbucket {
     owner = "malb";
     repo = "m4rie";
     rev = "release-${version}";
-    sha256 = "sha256-bjAcxfXsC6+jPYC472CN78jm4UljJQlkWyvsqckCDh0=";
+    hash = "sha256-CbzDLSqdtQ+CLKoKycznKzD3VCa+gfuh8TLvRC1fVz0=";
   };
 
   doCheck = true;

pkgs/by-name/nw/nwg-dock-hyprland/package.nix

@@ -16,10 +16,10 @@ buildGoModule rec {
     owner = "nwg-piotr";
     repo = "nwg-dock-hyprland";
     tag = "v${version}";
-    hash = "sha256-IKdXH2UK2CBZTHY8c9eN6JSbqsF4OpIHYH14XEKyrM0=";
+    hash = "sha256-MujQMrqyxKl32cIzy7JHDeUIDEqDzFp6mr7pM3y9xng=";
   };
 
-  vendorHash = "sha256-ZUk3Pust9+Ei7s4ArNtTqBIWhxlzFjXcmDePBUYCaEU=";
+  vendorHash = "sha256-cAfKmcBf2hu3eP6a4ELEeNyPOYXi3chLkbHKFks14I0=";
 
   ldflags = [
     "-s"

pkgs/by-name/pr/protols/package.nix

@@ -6,16 +6,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "protols";
-  version = "0.8.0";
+  version = "0.9.0";
 
   src = fetchFromGitHub {
     owner = "coder3101";
     repo = "protols";
     tag = version;
-    hash = "sha256-Y2gmOlQO6yP/sP2z4NJGbJimlSC5Q7B9Lw8BinzOwHA=";
+    hash = "sha256-MsQFGbUWymGYXLABWsDlSXAWBwxw0P9de/txrxdf/Lw=";
   };
 
-  cargoHash = "sha256-xi1nJ0/rIDYUGJkxtjAysR77+FtmpD97OuuFX0oLuc0=";
+  cargoHash = "sha256-BTCcAv7JlyDDG90rKwr2lmEHyxxLFEvZzUGS2DVxqmc=";
 
   meta = {
     description = "Protocol Buffers language server written in Rust";

pkgs/by-name/re/restic-browser/package.nix

@@ -16,26 +16,26 @@
 }:
 rustPlatform.buildRustPackage rec {
   pname = "restic-browser";
-  version = "0.3.1";
+  version = "0.3.2";
 
   src = fetchFromGitHub {
     owner = "emuell";
     repo = "restic-browser";
     rev = "v${version}";
-    hash = "sha256-KE9pa4P6WyzNo3CxPKgREb6EEkUEQSuhihn938XN45A=";
+    hash = "sha256-magf19hA5PVAZafRcQXFaAD50qGofztpiluVc2aCeOk=";
   };
 
   cargoLock = {
     lockFile = ./Cargo.lock;
     outputHashes = {
-      "tauri-plugin-window-state-0.1.1" = "sha256-Mf2/cnKotd751ZcSHfiSLNe2nxBfo4dMBdoCwQhe7yI=";
+      "fix-path-env-0.0.0" = "sha256-kSpWO2qMotpsYKJokqUWCUzGGmNOazaREDLjke4/CtE=";
     };
   };
 
   npmDeps = fetchNpmDeps {
     name = "${pname}-npm-deps-${version}";
     inherit src;
-    hash = "sha256-OhJQ+rhtsEkwrPu+V6ITkXSJT6RJ8pYFATo0VfJaijc=";
+    hash = "sha256-U82hVPfVd12vBeDT3PHexwmc9OitkuxTugYRe4Z/3eo=";
   };
 
   nativeBuildInputs =

pkgs/by-name/wx/wxhexeditor/package.nix

@@ -8,22 +8,41 @@
   gettext,
   libtool,
   python3,
-  wxGTK,
-  openmp,
-  Cocoa,
+  wxGTK32,
+  llvmPackages,
 }:
 
 stdenv.mkDerivation rec {
-  pname = "wxHexEditor";
+  pname = "wxhexeditor";
   version = "0.24";
 
   src = fetchFromGitHub {
     repo = "wxHexEditor";
     owner = "EUA";
     rev = "v${version}";
-    sha256 = "08xnhaif8syv1fa0k6lc3jm7yg2k50b02lyds8w0jyzh4xi5crqj";
+    hash = "sha256-EmdWYifwewk40s1TARYoUzx/qhyMmgmUC9tr5KKCtiM=";
   };
 
+  patches = [
+    # https://github.com/EUA/wxHexEditor/issues/90
+    (fetchpatch {
+      url = "https://github.com/EUA/wxHexEditor/commit/d0fa3ddc3e9dc9b05f90b650991ef134f74eed01.patch";
+      hash = "sha256-0m+dvsPlEoRnc22O73InR+NLPWb5JiSzEwdDmyE4i/E=";
+    })
+    ./missing-semicolon.patch
+  ];
+
+  postPatch =
+    ''
+      substituteInPlace Makefile \
+        --replace-fail "/usr" "$out" \
+        --replace-fail "mhash; ./configure" "mhash; ./configure --prefix=$out"
+    ''
+    + lib.optionalString stdenv.cc.isClang ''
+      substituteInPlace Makefile \
+        --replace-fail "-lgomp" "-lomp"
+    '';
+
   strictDeps = true;
 
   nativeBuildInputs = [
@@ -32,39 +51,19 @@ stdenv.mkDerivation rec {
     gettext
     libtool
     python3
-    wxGTK
+    wxGTK32
   ];
 
-  buildInputs =
-    lib.optionals stdenv.cc.isClang [
-      openmp
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      Cocoa
-    ];
+  buildInputs = lib.optionals stdenv.cc.isClang [
+    llvmPackages.openmp
+  ];
 
   preConfigure = "patchShebangs .";
 
-  prePatch =
-    ''
-      substituteInPlace Makefile --replace "/usr" "$out"
-      substituteInPlace Makefile --replace "mhash; ./configure" "mhash; ./configure --prefix=$out"
-    ''
-    + lib.optionalString stdenv.cc.isClang ''
-      substituteInPlace Makefile --replace "-lgomp" "-lomp"
-    '';
-
-  patches = [
-    # https://github.com/EUA/wxHexEditor/issues/90
-    (fetchpatch {
-      url = "https://github.com/EUA/wxHexEditor/commit/d0fa3ddc3e9dc9b05f90b650991ef134f74eed01.patch";
-      sha256 = "1wcb70hrnhq72frj89prcqylpqs74xrfz3kdfdkq84p5qfz9svyj";
-    })
-    ./missing-semicolon.patch
+  makeFlags = lib.optionals stdenv.cc.isGNU [
+    "OPTFLAGS=-fopenmp"
   ];
 
-  makeFlags = lib.optionals stdenv.cc.isGNU [ "OPTFLAGS=-fopenmp" ];
-
   meta = {
     description = "Hex Editor / Disk Editor for Huge Files or Devices";
     longDescription = ''
@@ -79,8 +78,8 @@ stdenv.mkDerivation rec {
     '';
     homepage = "http://www.wxhexeditor.org/";
     license = lib.licenses.gpl2Plus;
-    platforms = lib.platforms.unix;
     maintainers = with lib.maintainers; [ wegank ];
     mainProgram = "wxHexEditor";
+    platforms = lib.platforms.unix;
   };
 }

pkgs/development/libraries/qxlsx/default.nix

@@ -8,13 +8,13 @@
 
 stdenv.mkDerivation rec {
   pname = "qxlsx";
-  version = "1.4.8";
+  version = "1.5.0";
 
   src = fetchFromGitHub {
     owner = "QtExcel";
     repo = "QXlsx";
     rev = "v${version}";
-    hash = "sha256-mMhe4yztU9I/zJFbj/0GNiIoSy7U4rQ1Y3mDvvHNKXk=";
+    hash = "sha256-twOlAiLE0v7+9nWo/Gd+oiKT1umL3UnG1Xa0zDG7u7s=";
   };
 
   nativeBuildInputs = [ cmake ];

pkgs/development/python-modules/ariadne/default.nix

@@ -19,7 +19,7 @@
 
 buildPythonPackage rec {
   pname = "ariadne";
-  version = "0.23.0";
+  version = "0.24";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -28,7 +28,7 @@ buildPythonPackage rec {
     owner = "mirumee";
     repo = "ariadne";
     tag = version;
-    hash = "sha256-zdM6LKtrD6m3hWn90yAgsinCvaa86BaTdhgf/VzGDLA=";
+    hash = "sha256-QLMPmep/mtw/ZDto3kK1y/9N+7aZwAke8ZHC6dzwUuM=";
   };
 
   patches = [ ./remove-opentracing.patch ];

pkgs/development/python-modules/chainstream/default.nix

@@ -7,7 +7,7 @@
 
 buildPythonPackage rec {
   pname = "chainstream";
-  version = "1.0.1";
+  version = "1.0.2";
 
   pyproject = true;
 
@@ -15,7 +15,7 @@ buildPythonPackage rec {
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-302P1BixEmkODm+qTLZwaWLktrlf9cEziQ/TIVfI07c=";
+    hash = "sha256-syl107PRwDClB6wpgETCj6PKMNUnq9+uKB7dUydmF7M=";
   };
 
   pythonImportsCheck = [ "chainstream" ];

pkgs/development/python-modules/edk2-pytool-library/default.nix

@@ -17,7 +17,7 @@
 
 buildPythonPackage rec {
   pname = "edk2-pytool-library";
-  version = "0.22.3";
+  version = "0.22.4";
   pyproject = true;
 
   disabled = pythonOlder "3.11";
@@ -26,7 +26,7 @@ buildPythonPackage rec {
     owner = "tianocore";
     repo = "edk2-pytool-library";
     tag = "v${version}";
-    hash = "sha256-N2ATC/GALKd8JUrkvlvHe9JPzwzbB5GPTBavo17DW5Y=";
+    hash = "sha256-uTXE5b9iqGhrkbevz6GIw4MMDh3yA4Op0JHCTRo0ZfY=";
   };
 
   build-system = [

pkgs/development/python-modules/human-readable/default.nix

@@ -8,12 +8,12 @@
 
 buildPythonPackage rec {
   pname = "human-readable";
-  version = "1.3.4";
+  version = "1.4.1";
 
   src = fetchPypi {
     pname = "human_readable";
     inherit version;
-    hash = "sha256-VybqyJBm7CXRREehc+ZFqFUYRkXQJOswZwXiv7tg8MA=";
+    hash = "sha256-yBv6A10ogYM3mVRqbxLnG6TB76fdpqi+wQ/WunhQIR8=";
   };
 
   pyproject = true;

pkgs/development/python-modules/ipympl/default.nix

@@ -14,14 +14,14 @@
 
 buildPythonPackage rec {
   pname = "ipympl";
-  version = "0.9.5";
+  version = "0.9.6";
   format = "wheel";
 
   disabled = pythonOlder "3.5";
 
   src = fetchPypi {
     inherit pname version format;
-    hash = "sha256-/xSjV/Q1UuySWC64svdrhEtGmqL6doM/FerX+lhMGfw=";
+    hash = "sha256-xK/flerCRNBnVQk0V0Bhuv0URr8xr0K26fZ1DLl/JEY=";
     dist = "py3";
     python = "py3";
   };

pkgs/development/python-modules/msgraph-sdk/default.nix

@@ -17,7 +17,7 @@
 
 buildPythonPackage rec {
   pname = "msgraph-sdk";
-  version = "1.15.0";
+  version = "1.16.0";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -26,7 +26,7 @@ buildPythonPackage rec {
     owner = "microsoftgraph";
     repo = "msgraph-sdk-python";
     tag = "v${version}";
-    hash = "sha256-jGGBWakuGXY7zH7Gb5C/e7hJB//B+Ko/l0TyxGHz0N4=";
+    hash = "sha256-wO+6L3u4bPRFu71rItI5Lttj87R8Wr9BTkkl5whxniY=";
   };
 
   build-system = [ flit-core ];

pkgs/development/python-modules/onigurumacffi/default.nix

@@ -8,12 +8,12 @@
 }:
 buildPythonPackage rec {
   pname = "onigurumacffi";
-  version = "1.3.0";
+  version = "1.4.1";
   format = "pyproject";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-d0XNxWCWrOyIofOwhmCiKwnGWe040/WdtsHK12qXa+8=";
+    hash = "sha256-W/vB725dEXniJFP4JDeoJPnVdx4M5l86csprnGEiZTY=";
   };
 
   buildInputs = [

pkgs/development/python-modules/spotipy/default.nix

@@ -10,14 +10,14 @@
 
 buildPythonPackage rec {
   pname = "spotipy";
-  version = "2.24.0";
+  version = "2.25.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.8";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-OWr4HmQghlUa8VcnDN/nQsFzlAWHG6nawfplG4ZJ7w0=";
+    hash = "sha256-xycg74U1Wv+Vn3/o2J3tSFBNjDO5JYPbkOwW2qwNpU8=";
   };
 
   propagatedBuildInputs = [

pkgs/development/python-modules/sqids/default.nix

@@ -10,14 +10,14 @@
 
 buildPythonPackage rec {
   pname = "sqids";
-  version = "0.5.0";
+  version = "0.5.1";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-ZHeY59W/6yNuesRwnP1M2AhjCmxQ+AIF3xe0yT5WAUA=";
+    hash = "sha256-1p0GtQTlvm/pUjyLtWEEzdBxw56pYAgxLz2xA4sfCL4=";
   };
 
   build-system = [ setuptools-scm ];

pkgs/development/tools/analysis/radare2/default.nix

@@ -47,13 +47,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "radare2";
-  version = "5.9.6";
+  version = "5.9.8";
 
   src = fetchFromGitHub {
     owner = "radare";
     repo = "radare2";
     tag = finalAttrs.version;
-    hash = "sha256-t/BMsYqNLMAlBBYm6JCDkFYL5YwJBwmEaaIY4KFYxY4=";
+    hash = "sha256-XSnv0yWEPlXHUPjf1Qu50AN3Gvgr0o6Q4e0dOyRdO9A=";
   };
 
   preBuild = ''

pkgs/games/vcmi/default.nix

@@ -29,14 +29,14 @@
 
 stdenv.mkDerivation rec {
   pname = "vcmi";
-  version = "1.6.1";
+  version = "1.6.2";
 
   src = fetchFromGitHub {
     owner = "vcmi";
     repo = "vcmi";
     rev = version;
     fetchSubmodules = true;
-    hash = "sha256-+fgtAjjDlR6CeV0kO1sgvZc09gTYHVaisLKnqQlyRFI=";
+    hash = "sha256-IUE/19tknfvca84Jiybbq0zb00WxOgP9N+BMTbUfPzA=";
   };
 
   nativeBuildInputs = [

pkgs/top-level/all-packages.nix

@@ -15863,12 +15863,6 @@ with pkgs;
 
   wsjtx = qt5.callPackage ../applications/radio/wsjtx { };
 
-  wxhexeditor = callPackage ../applications/editors/wxhexeditor {
-    inherit (darwin.apple_sdk.frameworks) Cocoa;
-    inherit (llvmPackages) openmp;
-    wxGTK = wxGTK32;
-  };
-
   x11basic = callPackage ../development/compilers/x11basic {
     autoconf = buildPackages.autoconf269;
   };