Merge master into haskell-updates

maintainers/maintainer-list.nix

@@ -6644,6 +6644,14 @@
     github = "ErinvanderVeen";
     githubId = 10973664;
   };
+  erooke = {
+    email = "ethan@roo.ke";
+    name = "Ethan Rooke";
+    keys = [ { fingerprint = "B66B EB9F 6111 E44B 7588  8240 B287 4A77 049A 5923"; } ];
+    github = "erooke";
+    githubId = 46689793;
+    matrix = "@ethan:roo.ke";
+  };
   erosennin = {
     email = "ag@sologoc.com";
     github = "erosennin";
@@ -11279,6 +11287,13 @@
     github = "keenanweaver";
     githubId = 37268985;
   };
+  keksgesicht = {
+    name = "Jan Braun";
+    email = "git@keksgesicht.de";
+    github = "Keksgesicht";
+    githubId = 32649612;
+    keys = [ { fingerprint = "65DF D21C 22A9 E4CD FD1A  0804 C3D7 16E7 29B3 C86A"; } ];
+  };
   keldu = {
     email = "mail@keldu.de";
     github = "keldu";
@@ -23120,6 +23135,12 @@
     githubId = 7677567;
     name = "Victor SENE";
   };
+  vtimofeenko = {
+    email = "nixpkgs.maintain@vtimofeenko.com";
+    github = "VTimofeenko";
+    githubId = 9886026;
+    name = "Vladimir Timofeenko";
+  };
   vtuan10 = {
     email = "mail@tuan-vo.de";
     github = "vtuan10";

nixos/doc/manual/release-notes/rl-2411.section.md

@@ -448,7 +448,9 @@
   before changing the package to `pkgs.stalwart-mail` in
   [`services.stalwart-mail.package`](#opt-services.stalwart-mail.package).
 
-- The `nomad_1_5` package was dropped, as [it has reached end-of-life upstream](https://support.hashicorp.com/hc/en-us/articles/360021185113-Support-Period-and-End-of-Life-EOL-Policy). Evaluating it will throw an error.
+- The `nomad_1_5` and `nomad_1_6` package were dropped, as [they have reached end-of-life upstream](https://support.hashicorp.com/hc/en-us/articles/360021185113-Support-Period-and-End-of-Life-EOL-Policy). Evaluating them will throw an error.
+
+- The default `nomad` package has been updated to 1.8.x. For more information, see [breaking changes for Nomad 1.8](https://developer.hashicorp.com/nomad/docs/upgrade/upgrade-specific#nomad-1-8-0)
 
 - `androidndkPkgs` has been updated to `androidndkPkgs_26`.
 
@@ -727,6 +729,8 @@
 
 - `lib.misc.mapAttrsFlatten` is now formally deprecated and will be removed in future releases; use the identical [`lib.attrsets.mapAttrsToList`](https://nixos.org/manual/nixpkgs/unstable#function-library-lib.attrsets.mapAttrsToList) instead.
 
+- `virtualisation.docker.liveRestore` has been renamed to `virtualisation.docker.daemon.settings."live-restore"` and turned off by default for state versions of at least 24.11.
+
 - Tailscale's `authKeyFile` can now have its corresponding parameters set through `config.services.tailscale.authKeyParameters`, allowing for non-ephemeral unsupervised deployment and more.
   See [Registering new nodes using OAuth credentials](https://tailscale.com/kb/1215/oauth-clients#registering-new-nodes-using-oauth-credentials) for the supported options.
 

nixos/modules/hardware/tuxedo-drivers.nix

@@ -0,0 +1,35 @@
+{ config, lib, ... }:
+let
+  cfg = config.hardware.tuxedo-drivers;
+  tuxedo-drivers = config.boot.kernelPackages.tuxedo-drivers;
+in
+{
+  imports = [
+    (lib.mkRenamedOptionModule
+      [
+        "hardware"
+        "tuxedo-keyboard"
+      ]
+      [
+        "hardware"
+        "tuxedo-drivers"
+      ]
+    )
+  ];
+
+  options.hardware.tuxedo-drivers = {
+    enable = lib.mkEnableOption ''
+      The tuxedo-drivers driver enables access to the following on TUXEDO notebooks:
+      - Driver for Fn-keys
+      - SysFS control of brightness/color/mode for most TUXEDO keyboards
+      - Hardware I/O driver for TUXEDO Control Center
+
+      For more inforation it is best to check at the source code description: <https://gitlab.com/tuxedocomputers/development/packages/tuxedo-drivers>
+    '';
+  };
+
+  config = lib.mkIf cfg.enable {
+    boot.kernelModules = [ "tuxedo_keyboard" ];
+    boot.extraModulePackages = [ tuxedo-drivers ];
+  };
+}

nixos/modules/hardware/tuxedo-keyboard.nix

@@ -1,32 +0,0 @@
-{ config, lib, pkgs, ... }:
-let
-  cfg = config.hardware.tuxedo-keyboard;
-  tuxedo-keyboard = config.boot.kernelPackages.tuxedo-keyboard;
-in
-  {
-    options.hardware.tuxedo-keyboard = {
-      enable = lib.mkEnableOption ''
-          the tuxedo-keyboard driver.
-
-          To configure the driver, pass the options to the {option}`boot.kernelParams` configuration.
-          There are several parameters you can change. It's best to check at the source code description which options are supported.
-          You can find all the supported parameters at: <https://github.com/tuxedocomputers/tuxedo-keyboard#kernelparam>
-
-          In order to use the `custom` lighting with the maximumg brightness and a color of `0xff0a0a` one would put pass {option}`boot.kernelParams` like this:
-
-          ```
-          boot.kernelParams = [
-           "tuxedo_keyboard.mode=0"
-           "tuxedo_keyboard.brightness=255"
-           "tuxedo_keyboard.color_left=0xff0a0a"
-          ];
-          ```
-      '';
-    };
-
-    config = lib.mkIf cfg.enable
-    {
-      boot.kernelModules = ["tuxedo_keyboard"];
-      boot.extraModulePackages = [ tuxedo-keyboard ];
-    };
-  }

nixos/modules/module-list.nix

@@ -98,7 +98,7 @@
   ./hardware/sensor/iio.nix
   ./hardware/steam-hardware.nix
   ./hardware/system-76.nix
-  ./hardware/tuxedo-keyboard.nix
+  ./hardware/tuxedo-drivers.nix
   ./hardware/ubertooth.nix
   ./hardware/uinput.nix
   ./hardware/uni-sync.nix
@@ -1479,6 +1479,7 @@
   ./services/web-apps/ocis.nix
   ./services/web-apps/onlyoffice.nix
   ./services/web-apps/openvscode-server.nix
+  ./services/web-apps/mediagoblin.nix
   ./services/web-apps/mobilizon.nix
   ./services/web-apps/openwebrx.nix
   ./services/web-apps/outline.nix

nixos/modules/profiles/minimal.nix

@@ -29,8 +29,6 @@ with lib;
 
   programs.command-not-found.enable = mkDefault false;
 
-  programs.ssh.setXAuthLocation = mkDefault false;
-
   services.logrotate.enable = mkDefault false;
 
   services.udisks2.enable = mkDefault false;

nixos/modules/services/databases/victoriametrics.nix

@@ -1,65 +1,188 @@
-{ config, pkgs, lib, ... }:
-let cfg = config.services.victoriametrics; in
 {
-  options.services.victoriametrics = with lib; {
-    enable = mkEnableOption "VictoriaMetrics, a time series database, long-term remote storage for Prometheus";
+  config,
+  pkgs,
+  lib,
+  ...
+}:
+with lib;
+let
+  cfg = config.services.victoriametrics;
+  settingsFormat = pkgs.formats.yaml { };
+
+  startCLIList =
+    [
+      "${cfg.package}/bin/victoria-metrics"
+      "-storageDataPath=/var/lib/${cfg.stateDir}"
+      "-httpListenAddr=${cfg.listenAddress}"
+
+    ]
+    ++ lib.optionals (cfg.retentionPeriod != null) [ "-retentionPeriod=${cfg.retentionPeriod}" ]
+    ++ cfg.extraOptions;
+  prometheusConfigYml = checkedConfig (
+    settingsFormat.generate "prometheusConfig.yaml" cfg.prometheusConfig
+  );
+
+  checkedConfig =
+    file:
+    pkgs.runCommand "checked-config" { nativeBuildInputs = [ cfg.package ]; } ''
+      ln -s ${file} $out
+      ${lib.escapeShellArgs startCLIList} -promscrape.config=${file} -dryRun
+    '';
+in
+{
+  options.services.victoriametrics = {
+    enable = mkEnableOption "VictoriaMetrics is a fast, cost-effective and scalable monitoring solution and time series database.";
     package = mkPackageOption pkgs "victoriametrics" { };
+
     listenAddress = mkOption {
       default = ":8428";
       type = types.str;
       description = ''
-        The listen address for the http interface.
+        TCP address to listen for incoming http requests.
       '';
     };
-    retentionPeriod = mkOption {
-      type = types.int;
-      default = 1;
+
+    stateDir = mkOption {
+      type = types.str;
+      default = "victoriametrics";
       description = ''
-        Retention period in months.
+        Directory below `/var/lib` to store VictoriaMetrics metrics data.
+        This directory will be created automatically using systemd's StateDirectory mechanism.
       '';
     };
+
+    retentionPeriod = mkOption {
+      type = types.nullOr types.str;
+      default = null;
+      example = "15d";
+      description = ''
+        How long to retain samples in storage.
+        The minimum retentionPeriod is 24h or 1d. See also -retentionFilter
+        The following optional suffixes are supported: s (second), h (hour), d (day), w (week), y (year).
+        If suffix isn't set, then the duration is counted in months (default 1)
+      '';
+    };
+
+    prometheusConfig = lib.mkOption {
+      type = lib.types.submodule { freeformType = settingsFormat.type; };
+      default = { };
+      example = literalExpression ''
+        {
+          scrape_configs = [
+            {
+              job_name = "postgres-exporter";
+              metrics_path = "/metrics";
+              static_configs = [
+                {
+                  targets = ["1.2.3.4:9187"];
+                  labels.type = "database";
+                }
+              ];
+            }
+            {
+              job_name = "node-exporter";
+              metrics_path = "/metrics";
+              static_configs = [
+                {
+                  targets = ["1.2.3.4:9100"];
+                  labels.type = "node";
+                }
+                {
+                  targets = ["5.6.7.8:9100"];
+                  labels.type = "node";
+                }
+              ];
+            }
+          ];
+        }
+      '';
+      description = ''
+        Config for prometheus style metrics.
+        See the docs: <https://docs.victoriametrics.com/vmagent/#how-to-collect-metrics-in-prometheus-format>
+        for more information.
+      '';
+    };
+
     extraOptions = mkOption {
       type = types.listOf types.str;
-      default = [];
+      default = [ ];
+      example = literalExpression ''
+        [
+          "-httpAuth.username=username"
+          "-httpAuth.password=file:///abs/path/to/file"
+          "-loggerLevel=WARN"
+        ]
+      '';
       description = ''
-        Extra options to pass to VictoriaMetrics. See the README:
-        <https://github.com/VictoriaMetrics/VictoriaMetrics/blob/master/README.md>
-        or {command}`victoriametrics -help` for more
-        information.
+        Extra options to pass to VictoriaMetrics. See the docs:
+        <https://docs.victoriametrics.com/single-server-victoriametrics/#list-of-command-line-flags>
+        or {command}`victoriametrics -help` for more information.
       '';
     };
   };
+
   config = lib.mkIf cfg.enable {
     systemd.services.victoriametrics = {
       description = "VictoriaMetrics time series database";
+      wantedBy = [ "multi-user.target" ];
       after = [ "network.target" ];
       startLimitBurst = 5;
+
       serviceConfig = {
-        Restart = "on-failure";
-        RestartSec = 1;
-        StateDirectory = "victoriametrics";
+        ExecStart = lib.escapeShellArgs (
+          startCLIList
+          ++ lib.optionals (cfg.prometheusConfig != null) [ "-promscrape.config=${prometheusConfigYml}" ]
+        );
+
         DynamicUser = true;
-        ExecStart = ''
-          ${cfg.package}/bin/victoria-metrics \
-              -storageDataPath=/var/lib/victoriametrics \
-              -httpListenAddr ${cfg.listenAddress} \
-              -retentionPeriod ${toString cfg.retentionPeriod} \
-              ${lib.escapeShellArgs cfg.extraOptions}
-        '';
-        # victoriametrics 1.59 with ~7GB of data seems to eventually panic when merging files and then
-        # begins restart-looping forever. Set LimitNOFILE= to a large number to work around this issue.
-        #
-        # panic: FATAL: unrecoverable error when merging small parts in the partition "/var/lib/victoriametrics/data/small/2021_08":
-        # cannot open source part for merging: cannot open values file in stream mode:
-        # cannot open file "/var/lib/victoriametrics/data/small/2021_08/[...]/values.bin":
-        # open /var/lib/victoriametrics/data/small/2021_08/[...]/values.bin: too many open files
+        RestartSec = 1;
+        Restart = "on-failure";
+        RuntimeDirectory = "victoriametrics";
+        RuntimeDirectoryMode = "0700";
+        StateDirectory = cfg.stateDir;
+        StateDirectoryMode = "0700";
+
+        # Increase the limit to avoid errors like 'too many open files'  when merging small parts
         LimitNOFILE = 1048576;
+
+        # Hardening
+        DeviceAllow = [ "/dev/null rw" ];
+        DevicePolicy = "strict";
+        LockPersonality = true;
+        MemoryDenyWriteExecute = true;
+        NoNewPrivileges = true;
+        PrivateDevices = true;
+        PrivateTmp = true;
+        PrivateUsers = true;
+        ProtectClock = true;
+        ProtectControlGroups = true;
+        ProtectHome = true;
+        ProtectHostname = true;
+        ProtectKernelLogs = true;
+        ProtectKernelModules = true;
+        ProtectKernelTunables = true;
+        ProtectProc = "invisible";
+        ProtectSystem = "full";
+        RemoveIPC = true;
+        RestrictAddressFamilies = [
+          "AF_INET"
+          "AF_INET6"
+          "AF_UNIX"
+        ];
+        RestrictNamespaces = true;
+        RestrictRealtime = true;
+        RestrictSUIDSGID = true;
+        SystemCallArchitectures = "native";
+        SystemCallFilter = [
+          "@system-service"
+          "~@privileged"
+        ];
       };
-      wantedBy = [ "multi-user.target" ];
 
       postStart =
         let
-          bindAddr = (lib.optionalString (lib.hasPrefix ":" cfg.listenAddress) "127.0.0.1") + cfg.listenAddress;
+          bindAddr =
+            (lib.optionalString (lib.hasPrefix ":" cfg.listenAddress) "127.0.0.1") + cfg.listenAddress;
         in
         lib.mkBefore ''
           until ${lib.getBin pkgs.curl}/bin/curl -s -o /dev/null http://${bindAddr}/ping; do

nixos/modules/services/desktops/pipewire/pipewire.nix

@@ -332,7 +332,7 @@ in {
       {
         # JACK intentionally not checked, as PW-on-JACK setups are a thing that some people may want
         assertion = (cfg.alsa.enable || cfg.pulse.enable) -> cfg.audio.enable;
-        message = "Using PipeWire's ALSA/PulseAudio compatibility layers requires running PipeWire as the sound server. Set `services.pipewire.audio.enable` to true.";
+        message = "Using PipeWire's ALSA/PulseAudio compatibility layers requires running PipeWire as the sound server. Either set `services.pipewire.audio.enable` to true to enable audio support, or set both `services.pipewire.pulse.enable` and `services.pipewire.alsa.enable` to false to use pipewire exclusively for the compositor.";
       }
       {
         assertion = length

nixos/modules/services/hardware/tuxedo-rs.nix

@@ -14,7 +14,7 @@ in
 
   config = lib.mkIf cfg.enable (lib.mkMerge [
     {
-      hardware.tuxedo-keyboard.enable = true;
+      hardware.tuxedo-drivers.enable = true;
 
       systemd = {
         services.tailord = {

nixos/modules/services/web-apps/mediagoblin.nix

@@ -0,0 +1,377 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+let
+  cfg = config.services.mediagoblin;
+
+  mkSubSectionKeyValue =
+    depth: k: v:
+    if lib.isAttrs v then
+      let
+        inherit (lib.strings) replicate;
+      in
+      "${replicate depth "["}${k}${replicate depth "]"}\n"
+      + lib.generators.toINIWithGlobalSection {
+        mkKeyValue = mkSubSectionKeyValue (depth + 1);
+      } { globalSection = v; }
+    else
+      lib.generators.mkKeyValueDefault {
+        mkValueString = v: if lib.isString v then ''"${v}"'' else lib.generators.mkValueStringDefault { } v;
+      } " = " k v;
+
+  iniFormat = pkgs.formats.ini { };
+
+  # we need to build our own GI_TYPELIB_PATH because celery and paster need this information, too and cannot easily be re-wrapped
+  GI_TYPELIB_PATH =
+    let
+      needsGst =
+        (cfg.settings.mediagoblin.plugins ? "mediagoblin.media_types.audio")
+        || (cfg.settings.mediagoblin.plugins ? "mediagoblin.media_types.video");
+    in
+    lib.makeSearchPathOutput "out" "lib/girepository-1.0" (
+      with pkgs.gst_all_1;
+      [
+        pkgs.glib
+        gst-plugins-base
+        gstreamer
+      ]
+      # audio and video share most dependencies, so we can just take audio
+      ++ lib.optionals needsGst cfg.package.optional-dependencies.audio
+    );
+
+  finalPackage = cfg.package.python.buildEnv.override {
+    extraLibs =
+      with cfg.package.python.pkgs;
+      [
+        (toPythonModule cfg.package)
+      ]
+      ++ cfg.pluginPackages
+      # not documented in extras...
+      ++ lib.optional (lib.hasPrefix "postgresql://" cfg.settings.mediagoblin.sql_engine) psycopg2
+      ++ (
+        let
+          inherit (cfg.settings.mediagoblin) plugins;
+        in
+        with cfg.package.optional-dependencies;
+        lib.optionals (plugins ? "mediagoblin.media_types.audio") audio
+        ++ lib.optionals (plugins ? "mediagoblin.media_types.video") video
+        ++ lib.optionals (plugins ? "mediagoblin.media_types.raw_image") raw_image
+        ++ lib.optionals (plugins ? "mediagoblin.media_types.ascii") ascii
+        ++ lib.optionals (plugins ? "mediagoblin.plugins.ldap") ldap
+      );
+  };
+in
+{
+  options = {
+    services.mediagoblin = {
+      enable = lib.mkOption {
+        type = lib.types.bool;
+        default = false;
+        description = ''
+          Whether to enable MediaGoblin.
+
+          After the initial deployment, make sure to add an admin account:
+          ```
+          mediagoblin-gmg adduser --username admin --email admin@example.com
+          mediagoblin-gmg makeadmin admin
+          ```
+        '';
+      };
+
+      domain = lib.mkOption {
+        type = lib.types.str;
+        example = "mediagoblin.example.com";
+        description = "Domain under which mediagoblin will be served.";
+      };
+
+      createDatabaseLocally = lib.mkOption {
+        type = lib.types.bool;
+        default = true;
+        example = false;
+        description = "Whether to configure a local postgres database and connect to it.";
+      };
+
+      package = lib.mkPackageOption pkgs "mediagoblin" { };
+
+      pluginPackages = lib.mkOption {
+        type = with lib.types; listOf package;
+        default = [ ];
+        description = "Plugins to add to the environment of MediaGoblin. They still need to be enabled in the config.";
+      };
+
+      settings = lib.mkOption {
+        description = "Settings which are written into `mediagoblin.ini`.";
+        default = { };
+        type = lib.types.submodule {
+          freeformType = lib.types.anything;
+
+          options = {
+            mediagoblin = {
+              allow_registration = lib.mkOption {
+                type = lib.types.bool;
+                default = false;
+                description = ''
+                  Whether to enable user self registration. This is generally not recommend due to spammers.
+                  See [upstream FAQ](https://docs.mediagoblin.org/en/stable/siteadmin/production-deployments.html#should-i-keep-open-registration-enabled).
+                '';
+              };
+
+              email_debug_mode = lib.mkOption {
+                type = lib.types.bool;
+                default = true;
+                example = false;
+                description = ''
+                  Disable email debug mode to start sending outgoing mails.
+                  This requires configuring SMTP settings,
+                  see the [upstream docs](https://docs.mediagoblin.org/en/stable/siteadmin/configuration.html#enabling-email-notifications)
+                  for details.
+                '';
+              };
+
+              email_sender_address = lib.mkOption {
+                type = lib.types.str;
+                example = "noreply@example.org";
+                description = "Email address which notices are sent from.";
+              };
+
+              sql_engine = lib.mkOption {
+                type = lib.types.str;
+                default = "sqlite:///var/lib/mediagoblin/mediagoblin.db";
+                example = "postgresql:///mediagoblin";
+                description = "Database to use.";
+              };
+
+              plugins = lib.mkOption {
+                defaultText = ''
+                  {
+                    "mediagoblin.plugins.geolocation" = { };
+                    "mediagoblin.plugins.processing_info" = { };
+                    "mediagoblin.plugins.basic_auth" = { };
+                    "mediagoblin.media_types.image" = { };
+                  }
+                '';
+                description = ''
+                  Plugins to enable. See [upstream docs](https://docs.mediagoblin.org/en/stable/siteadmin/plugins.html) for details.
+                  Extra dependencies are automatically enabled.
+                '';
+              };
+            };
+          };
+        };
+      };
+
+      paste = {
+        port = lib.mkOption {
+          type = lib.types.port;
+          default = 6543;
+          description = "Port under which paste will listen.";
+        };
+
+        settings = lib.mkOption {
+          description = "Settings which are written into `paste.ini`.";
+          default = { };
+          type = lib.types.submodule {
+            freeformType = iniFormat.type;
+          };
+        };
+      };
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    environment.systemPackages = [
+      (pkgs.writeShellScriptBin "mediagoblin-gmg" ''
+        sudo=exec
+        if [[ "$USER" != mediagoblin ]]; then
+         sudo='exec /run/wrappers/bin/sudo -u mediagoblin'
+        fi
+        $sudo sh -c "cd /var/lib/mediagoblin; env GI_TYPELIB_PATH=${GI_TYPELIB_PATH} ${lib.getExe' finalPackage "gmg"} $@"
+      '')
+    ];
+
+    services = {
+      mediagoblin.settings.mediagoblin = {
+        plugins = {
+          "mediagoblin.media_types.image" = { };
+          "mediagoblin.plugins.basic_auth" = { };
+          "mediagoblin.plugins.geolocation" = { };
+          "mediagoblin.plugins.processing_info" = { };
+        };
+        sql_engine = lib.mkIf cfg.createDatabaseLocally "postgresql:///mediagoblin";
+      };
+
+      nginx = {
+        enable = true;
+        recommendedGzipSettings = true;
+        recommendedProxySettings = true;
+        virtualHosts = {
+          # see https://git.sr.ht/~mediagoblin/mediagoblin/tree/bf61d38df21748aadb480c53fdd928647285e35f/item/nginx.conf.template
+          "${cfg.domain}" = {
+            forceSSL = true;
+            extraConfig = ''
+              # https://git.sr.ht/~mediagoblin/mediagoblin/tree/bf61d38df21748aadb480c53fdd928647285e35f/item/Dockerfile.nginx.in#L5
+              client_max_body_size 100M;
+
+              more_set_headers X-Content-Type-Options nosniff;
+            '';
+            locations = {
+              "/".proxyPass = "http://127.0.0.1:${toString cfg.paste.port}";
+              "/mgoblin_static/".alias = "${finalPackage}/${finalPackage.python.sitePackages}/mediagoblin/static/";
+              "/mgoblin_media/".alias = "/var/lib/mediagoblin/user_dev/media/public/";
+              "/theme_static/".alias = "/var/lib/mediagoblin/user_dev/theme_static/";
+              "/plugin_static/".alias = "/var/lib/mediagoblin/user_dev/plugin_static/";
+            };
+          };
+        };
+      };
+
+      postgresql = lib.mkIf cfg.createDatabaseLocally {
+        enable = true;
+        ensureDatabases = [ "mediagoblin" ];
+        ensureUsers = [
+          {
+            name = "mediagoblin";
+            ensureDBOwnership = true;
+          }
+        ];
+      };
+
+      rabbitmq.enable = true;
+    };
+
+    systemd.services =
+      let
+        serviceDefaults = {
+          wantedBy = [ "multi-user.target" ];
+          path =
+            lib.optionals (cfg.settings.mediagoblin.plugins ? "mediagoblin.media_types.stl") [ pkgs.blender ]
+            ++ lib.optionals (cfg.settings.mediagoblin.plugins ? "mediagoblin.media_types.pdf") (
+              with pkgs;
+              [
+                poppler_utils
+                unoconv
+              ]
+            );
+          serviceConfig = {
+            AmbientCapabilities = "";
+            CapabilityBoundingSet = [ "" ];
+            DevicePolicy = "closed";
+            Group = "mediagoblin";
+            LockPersonality = true;
+            MemoryDenyWriteExecute = true;
+            NoNewPrivileges = true;
+            PrivateDevices = true;
+            PrivateTmp = true;
+            ProcSubset = "pid";
+            ProtectControlGroups = true;
+            ProtectHome = true;
+            ProtectHostname = true;
+            ProtectKernelLogs = true;
+            ProtectKernelModules = true;
+            ProtectKernelTunables = true;
+            ProtectProc = "invisible";
+            ProtectSystem = "strict";
+            RestrictAddressFamilies = [
+              "AF_INET"
+              "AF_INET6"
+              "AF_UNIX"
+            ];
+            RemoveIPC = true;
+            StateDirectory = "mediagoblin";
+            StateDirectoryMode = "0750";
+            User = "mediagoblin";
+            WorkingDirectory = "/var/lib/mediagoblin/";
+            RestrictNamespaces = true;
+            RestrictRealtime = true;
+            RestrictSUIDSGID = true;
+            SystemCallArchitectures = "native";
+            SystemCallFilter = [
+              "@system-service"
+              "~@privileged"
+              "@chown"
+            ];
+            UMask = "0027";
+          };
+        };
+
+        generatedPasteConfig = iniFormat.generate "paste.ini" cfg.paste.settings;
+        pasteConfig = pkgs.runCommand "paste-combined.ini" { nativeBuildInputs = [ pkgs.crudini ]; } ''
+          cp ${cfg.package.src}/paste.ini $out
+          chmod +w $out
+          crudini --merge $out < ${generatedPasteConfig}
+        '';
+      in
+      {
+        mediagoblin-celeryd = lib.recursiveUpdate serviceDefaults {
+          # we cannot change DEFAULT.data_dir inside mediagoblin.ini because of an annoying bug
+          # https://todo.sr.ht/~mediagoblin/mediagoblin/57
+          preStart = ''
+            cp --remove-destination ${
+              pkgs.writeText "mediagoblin.ini" (
+                lib.generators.toINI { } (lib.filterAttrsRecursive (n: v: n != "plugins") cfg.settings)
+                + "\n"
+                + lib.generators.toINI { mkKeyValue = mkSubSectionKeyValue 2; } {
+                  inherit (cfg.settings.mediagoblin) plugins;
+                }
+              )
+            } /var/lib/mediagoblin/mediagoblin.ini
+          '';
+          serviceConfig = {
+            Environment = [
+              "CELERY_CONFIG_MODULE=mediagoblin.init.celery.from_celery"
+              "GI_TYPELIB_PATH=${GI_TYPELIB_PATH}"
+              "MEDIAGOBLIN_CONFIG=/var/lib/mediagoblin/mediagoblin.ini"
+              "PASTE_CONFIG=${pasteConfig}"
+            ];
+            ExecStart = "${lib.getExe' finalPackage "celery"} worker --loglevel=INFO";
+          };
+          unitConfig.Description = "MediaGoblin Celery";
+        };
+
+        mediagoblin-paster = lib.recursiveUpdate serviceDefaults {
+          after = [
+            "mediagoblin-celeryd.service"
+            "postgresql.service"
+          ];
+          requires = [
+            "mediagoblin-celeryd.service"
+            "postgresql.service"
+          ];
+          preStart = ''
+            cp --remove-destination ${pasteConfig} /var/lib/mediagoblin/paste.ini
+            ${lib.getExe' finalPackage "gmg"} dbupdate
+          '';
+          serviceConfig = {
+            Environment = [
+              "CELERY_ALWAYS_EAGER=false"
+              "GI_TYPELIB_PATH=${GI_TYPELIB_PATH}"
+            ];
+            ExecStart = "${lib.getExe' finalPackage "paster"} serve /var/lib/mediagoblin/paste.ini";
+          };
+          unitConfig.Description = "Mediagoblin";
+        };
+      };
+
+    systemd.tmpfiles.settings."mediagoblin"."/var/lib/mediagoblin/user_dev".d = {
+      group = "mediagoblin";
+      mode = "2750";
+      user = "mediagoblin";
+    };
+
+    users = {
+      groups.mediagoblin = { };
+      users = {
+        mediagoblin = {
+          group = "mediagoblin";
+          home = "/var/lib/mediagoblin";
+          isSystemUser = true;
+        };
+        nginx.extraGroups = [ "mediagoblin" ];
+      };
+    };
+  };
+}

nixos/modules/system/activation/activation-script.nix

@@ -205,10 +205,14 @@ in
 
     system.build.installBootLoader = mkOption {
       internal = true;
-      # "; true" => make the `$out` argument from switch-to-configuration.pl
-      #             go to `true` instead of `echo`, hiding the useless path
-      #             from the log.
-      default = "echo 'Warning: do not know how to make this configuration bootable; please enable a boot loader.' 1>&2; true";
+      default = pkgs.writeShellScript "no-bootloader" ''
+        echo 'Warning: do not know how to make this configuration bootable; please enable a boot loader.' 1>&2
+      '';
+      defaultText = lib.literalExpression ''
+        pkgs.writeShellScript "no-bootloader" '''
+          echo 'Warning: do not know how to make this configuration bootable; please enable a boot loader.' 1>&2
+        '''
+      '';
       description = ''
         A program that writes a bootloader installation script to the path passed in the first command line argument.
 

nixos/modules/system/boot/systemd.nix

@@ -198,7 +198,7 @@ in
 
     package = mkPackageOption pkgs "systemd" {};
 
-    enableStrictShellChecks = mkEnableOption "running shellcheck on the generated scripts for systemd units.";
+    enableStrictShellChecks = mkEnableOption "" // { description = "Whether to run shellcheck on the generated scripts for systemd units."; };
 
     units = mkOption {
       description = "Definition of systemd units; see {manpage}`systemd.unit(5)`.";

nixos/modules/system/etc/etc.nix

@@ -231,13 +231,13 @@ in
       if [[ ! $IN_NIXOS_SYSTEMD_STAGE1 ]] && [[ "${config.system.build.etc}/etc" != "$(readlink -f /run/current-system/etc)" ]]; then
         echo "remounting /etc..."
 
-        tmpMetadataMount=$(mktemp --directory)
+        tmpMetadataMount=$(mktemp --directory -t nixos-etc-metadata.XXXXXXXXXX)
         mount --type erofs ${config.system.build.etcMetadataImage} $tmpMetadataMount
 
         # Mount the new /etc overlay to a temporary private mount.
         # This needs the indirection via a private bind mount because you
         # cannot move shared mounts.
-        tmpEtcMount=$(mktemp --directory)
+        tmpEtcMount=$(mktemp --directory -t nixos-etc.XXXXXXXXXX)
         mount --bind --make-private $tmpEtcMount $tmpEtcMount
         mount --type overlay overlay \
           --options lowerdir=$tmpMetadataMount::${config.system.build.etcBasedir},${etcOverlayOptions} \
@@ -276,6 +276,22 @@ in
 
         # Unmount the top /etc mount to atomically reveal the new mount.
         umount --lazy --recursive /etc
+
+        # Unmount the temporary mount
+        umount --lazy "$tmpEtcMount"
+        rmdir "$tmpEtcMount"
+
+        # Unmount old metadata mounts
+        # For some reason, `findmnt /tmp --submounts` does not show the nested
+        # mounts. So we'll just find all mounts of type erofs and filter on the
+        # name of the mountpoint.
+        findmnt --type erofs --list --kernel --output TARGET | while read -r mountPoint; do
+          if [[ "$mountPoint" =~ ^/tmp/nixos-etc-metadata\..{10}$ &&
+                "$mountPoint" != "$tmpMetadataMount" ]]; then
+            umount --lazy $mountPoint
+            rmdir "$mountPoint"
+          fi
+        done
       fi
     '' else ''
       # Set up the statically computed bits of /etc.

nixos/modules/virtualisation/docker.nix

@@ -52,10 +52,26 @@ in
 
     daemon.settings =
       mkOption {
-        type = settingsFormat.type;
+        type = types.submodule {
+          freeformType = settingsFormat.type;
+          options = {
+            live-restore = mkOption {
+              type = types.bool;
+              # Prior to NixOS 24.11, this was set to true by default, while upstream defaulted to false.
+              # Keep the option unset to follow upstream defaults
+              default = versionOlder config.system.stateVersion "24.11";
+              defaultText = literalExpression "lib.versionOlder config.system.stateVersion \"24.11\"";
+              description = ''
+                Allow dockerd to be restarted without affecting running container.
+                This option is incompatible with docker swarm.
+              '';
+            };
+          };
+        };
         default = { };
         example = {
           ipv6 = true;
+          "live-restore" = true;
           "fixed-cidr-v6" = "fd00::/80";
         };
         description = ''
@@ -75,16 +91,6 @@ in
         '';
       };
 
-    liveRestore =
-      mkOption {
-        type = types.bool;
-        default = true;
-        description = ''
-            Allow dockerd to be restarted without affecting running container.
-            This option is incompatible with docker swarm.
-          '';
-      };
-
     storageDriver =
       mkOption {
         type = types.nullOr (types.enum ["aufs" "btrfs" "devicemapper" "overlay" "overlay2" "zfs"]);
@@ -167,6 +173,11 @@ in
     };
   };
 
+  imports = [
+    (mkRemovedOptionModule ["virtualisation" "docker" "socketActivation"] "This option was removed and socket activation is now always active")
+    (mkAliasOptionModule ["virtualisation" "docker" "liveRestore"] ["virtualisation" "docker" "daemon" "settings" "live-restore"])
+  ];
+
   ###### implementation
 
   config = mkIf cfg.enable (mkMerge [{
@@ -253,7 +264,6 @@ in
         hosts = [ "fd://" ];
         log-driver = mkDefault cfg.logDriver;
         storage-driver = mkIf (cfg.storageDriver != null) (mkDefault cfg.storageDriver);
-        live-restore = mkDefault cfg.liveRestore;
         runtimes = mkIf cfg.enableNvidia {
           nvidia = {
             # Use the legacy nvidia-container-runtime wrapper to allow
@@ -266,9 +276,4 @@ in
       };
     }
   ]);
-
-  imports = [
-    (mkRemovedOptionModule ["virtualisation" "docker" "socketActivation"] "This option was removed and socket activation is now always active")
-  ];
-
 }

nixos/modules/virtualisation/vmware-guest.nix

@@ -1,50 +1,62 @@
 { config, lib, pkgs, ... }:
 let
+  inherit (lib) getExe' literalExpression mkEnableOption mkIf mkOption mkRenamedOptionModule optionals optionalString types;
   cfg = config.virtualisation.vmware.guest;
-  open-vm-tools = if cfg.headless then pkgs.open-vm-tools-headless else pkgs.open-vm-tools;
   xf86inputvmmouse = pkgs.xorg.xf86inputvmmouse;
 in
 {
   imports = [
-    (lib.mkRenamedOptionModule [ "services" "vmwareGuest" ] [ "virtualisation" "vmware" "guest" ])
+    (mkRenamedOptionModule [ "services" "vmwareGuest" ] [ "virtualisation" "vmware" "guest" ])
   ];
 
+  meta = {
+    maintainers = [ lib.maintainers.kjeremy ];
+  };
+
   options.virtualisation.vmware.guest = {
-    enable = lib.mkEnableOption "VMWare Guest Support";
-    headless = lib.mkOption {
-      type = lib.types.bool;
+    enable = mkEnableOption "VMWare Guest Support";
+    headless = mkOption {
+      type = types.bool;
       default = !config.services.xserver.enable;
-      defaultText = "!config.services.xserver.enable";
+      defaultText = literalExpression "!config.services.xserver.enable";
       description = "Whether to disable X11-related features.";
     };
+
+    package = mkOption {
+      type = types.package;
+      default = if cfg.headless then pkgs.open-vm-tools-headless else pkgs.open-vm-tools;
+      defaultText = literalExpression  "if config.virtualisation.vmware.headless then pkgs.open-vm-tools-headless else pkgs.open-vm-tools;";
+      example = literalExpression "pkgs.open-vm-tools";
+      description = "Package providing open-vm-tools.";
+    };
   };
 
-  config = lib.mkIf cfg.enable {
+  config = mkIf cfg.enable {
     assertions = [ {
       assertion = pkgs.stdenv.hostPlatform.isx86 || pkgs.stdenv.hostPlatform.isAarch64;
       message = "VMWare guest is not currently supported on ${pkgs.stdenv.hostPlatform.system}";
     } ];
 
     boot.initrd.availableKernelModules = [ "mptspi" ];
-    boot.initrd.kernelModules = lib.optionals pkgs.stdenv.hostPlatform.isx86 [ "vmw_pvscsi" ];
+    boot.initrd.kernelModules = optionals pkgs.stdenv.hostPlatform.isx86 [ "vmw_pvscsi" ];
 
-    environment.systemPackages = [ open-vm-tools ];
+    environment.systemPackages = [ cfg.package ];
 
     systemd.services.vmware =
       { description = "VMWare Guest Service";
         wantedBy = [ "multi-user.target" ];
         after = [ "display-manager.service" ];
         unitConfig.ConditionVirtualization = "vmware";
-        serviceConfig.ExecStart = "${open-vm-tools}/bin/vmtoolsd";
+        serviceConfig.ExecStart = getExe' cfg.package "vmtoolsd";
       };
 
     # Mount the vmblock for drag-and-drop and copy-and-paste.
-    systemd.mounts = lib.mkIf (!cfg.headless) [
+    systemd.mounts = mkIf (!cfg.headless) [
       {
         description = "VMware vmblock fuse mount";
         documentation = [ "https://github.com/vmware/open-vm-tools/blob/master/open-vm-tools/vmblock-fuse/design.txt" ];
         unitConfig.ConditionVirtualization = "vmware";
-        what = "${open-vm-tools}/bin/vmware-vmblock-fuse";
+        what = getExe' cfg.package "vmware-vmblock-fuse";
         where = "/run/vmblock-fuse";
         type = "fuse";
         options = "subtype=vmware-vmblock,default_permissions,allow_other";
@@ -52,19 +64,19 @@ in
       }
     ];
 
-    security.wrappers.vmware-user-suid-wrapper = lib.mkIf (!cfg.headless) {
+    security.wrappers.vmware-user-suid-wrapper = mkIf (!cfg.headless) {
         setuid = true;
         owner = "root";
         group = "root";
-        source = "${open-vm-tools}/bin/vmware-user-suid-wrapper";
+        source = getExe' cfg.package "vmware-user-suid-wrapper";
       };
 
-    environment.etc.vmware-tools.source = "${open-vm-tools}/etc/vmware-tools/*";
+    environment.etc.vmware-tools.source = "${cfg.package}/etc/vmware-tools/*";
 
-    services.xserver = lib.mkIf (!cfg.headless) {
-      modules = lib.optionals pkgs.stdenv.hostPlatform.isx86 [ xf86inputvmmouse ];
+    services.xserver = mkIf (!cfg.headless) {
+      modules = optionals pkgs.stdenv.hostPlatform.isx86 [ xf86inputvmmouse ];
 
-      config = lib.optionalString (pkgs.stdenv.hostPlatform.isx86) ''
+      config = optionalString (pkgs.stdenv.hostPlatform.isx86) ''
           Section "InputClass"
             Identifier "VMMouse"
             MatchDevicePath "/dev/input/event*"
@@ -74,10 +86,10 @@ in
         '';
 
       displayManager.sessionCommands = ''
-          ${open-vm-tools}/bin/vmware-user-suid-wrapper
+          ${getExe' cfg.package "vmware-user-suid-wrapper"}
         '';
     };
 
-    services.udev.packages = [ open-vm-tools ];
+    services.udev.packages = [ cfg.package ];
   };
 }

nixos/tests/activation/etc-overlay-immutable.nix

@@ -27,9 +27,14 @@
     specialisation.new-generation.configuration = {
       environment.etc."newgen".text = "newgen";
     };
+    specialisation.newer-generation.configuration = {
+      environment.etc."newergen".text = "newergen";
+    };
   };
 
-  testScript = ''
+  testScript = /* python */ ''
+    newergen = machine.succeed("realpath /run/current-system/specialisation/newer-generation/bin/switch-to-configuration").rstrip()
+
     with subtest("/run/etc-metadata/ is mounted"):
       print(machine.succeed("mountpoint /run/etc-metadata"))
 
@@ -79,5 +84,13 @@
       print(machine.succeed("ls /etc/mountpoint"))
       print(machine.succeed("stat /etc/mountpoint/extra-file"))
       print(machine.succeed("findmnt /etc/filemount"))
+
+      machine.succeed(f"{newergen} switch")
+
+      tmpMounts = machine.succeed("find /tmp -maxdepth 1 -type d -regex '/tmp/nixos-etc\\..*' | wc -l").rstrip()
+      metaMounts = machine.succeed("find /tmp -maxdepth 1 -type d -regex '/tmp/nixos-etc-metadata\\..*' | wc -l").rstrip()
+
+      assert tmpMounts == "0", f"Found {tmpMounts} remaining tmpmounts"
+      assert metaMounts == "1", f"Found {metaMounts} remaining metamounts"
   '';
 }

nixos/tests/activation/etc-overlay-mutable.nix

@@ -15,9 +15,14 @@
     specialisation.new-generation.configuration = {
       environment.etc."newgen".text = "newgen";
     };
+    specialisation.newer-generation.configuration = {
+      environment.etc."newergen".text = "newergen";
+    };
   };
 
-  testScript = ''
+  testScript = /* python */ ''
+    newergen = machine.succeed("realpath /run/current-system/specialisation/newer-generation/bin/switch-to-configuration").rstrip()
+
     with subtest("/run/etc-metadata/ is mounted"):
       print(machine.succeed("mountpoint /run/etc-metadata"))
 
@@ -55,5 +60,14 @@
       print(machine.succeed("findmnt /etc/mountpoint"))
       print(machine.succeed("stat /etc/mountpoint/extra-file"))
       print(machine.succeed("findmnt /etc/filemount"))
+
+      machine.succeed(f"{newergen} switch")
+      assert machine.succeed("cat /etc/newergen") == "newergen"
+
+      tmpMounts = machine.succeed("find /tmp -maxdepth 1 -type d -regex '/tmp/nixos-etc\\..*' | wc -l").rstrip()
+      metaMounts = machine.succeed("find /tmp -maxdepth 1 -type d -regex '/tmp/nixos-etc-metadata\\..*' | wc -l").rstrip()
+
+      assert tmpMounts == "0", f"Found {tmpMounts} remaining tmpmounts"
+      assert metaMounts == "1", f"Found {metaMounts} remaining metamounts"
   '';
 }

nixos/tests/prometheus-exporters.nix

@@ -356,6 +356,46 @@ let
       '';
     };
 
+    exportarr-sonarr = let apikey = "eccff6a992bc2e4b88e46d064b26bb4e"; in {
+      nodeName = "exportarr_sonarr";
+      exporterConfig = {
+        enable = true;
+        url = "http://127.0.0.1:8989";
+        apiKeyFile = pkgs.writeText "dummy-api-key" apikey;
+      };
+      metricProvider = {
+        services.sonarr.enable = true;
+        systemd.services.sonarr.serviceConfig.ExecStartPre =
+          let
+            sonarr_config = pkgs.writeText "config.xml" ''
+              <Config>
+                <LogLevel>info</LogLevel>
+                <EnableSsl>False</EnableSsl>
+                <Port>8989</Port>
+                <SslPort>9898</SslPort>
+                <UrlBase></UrlBase>
+                <BindAddress>*</BindAddress>
+                <ApiKey>${apikey}</ApiKey>
+                <AuthenticationMethod>None</AuthenticationMethod>
+                <UpdateMechanism>BuiltIn</UpdateMechanism>
+                <Branch>main</Branch>
+                <InstanceName>Sonarr</InstanceName>
+              </Config>
+            '';
+          in
+          [
+            ''${pkgs.coreutils}/bin/install -D -m 777 ${sonarr_config} -T /var/lib/sonarr/.config/NzbDrone/config.xml''
+          ];
+      };
+      exporterTest = ''
+        wait_for_unit("sonarr.service")
+        wait_for_open_port(8989)
+        wait_for_unit("prometheus-exportarr-sonarr-exporter.service")
+        wait_for_open_port(9708)
+        succeed("curl -sSf http://localhost:9708/metrics | grep sonarr_series_total")
+      '';
+    };
+
     fastly = {
       exporterConfig = {
         enable = true;

nixos/tests/switch-test.nix

@@ -53,11 +53,8 @@ in {
       environment.systemPackages = [ pkgs.socat ]; # for the socket activation stuff
       users.mutableUsers = false;
 
-      # For boot/switch testing
-      system.build.installBootLoader = lib.mkForce (pkgs.writeShellScript "install-dummy-loader" ''
-        echo "installing dummy bootloader"
-        touch /tmp/bootloader-installed
-      '');
+      # Test that no boot loader still switches, e.g. in the ISO
+      boot.loader.grub.enable = false;
 
       specialisation = rec {
         brokenInitInterface.configuration.config.system.extraSystemBuilderCmds = ''
@@ -596,6 +593,19 @@ in {
           imports = [ slice.configuration ];
           systemd.slices.testslice.sliceConfig.MemoryMax = lib.mkForce null;
         };
+
+        dbusReload.configuration = { config, ... }: let
+          dbusService = {
+            "dbus" = "dbus";
+            "broker" = "dbus-broker";
+          }.${config.services.dbus.implementation};
+        in {
+          # We want to make sure that stc catches this as a reload,
+          # not a restart.
+          systemd.services.${dbusService}.restartTriggers = [
+            (pkgs.writeText "dbus-reload-dummy" "dbus reload dummy")
+          ];
+        };
       };
     };
 
@@ -672,22 +682,18 @@ in {
         "${stderrRunner} ${otherSystem}/bin/switch-to-configuration test"
     )
 
+    boot_loader_text = "Warning: do not know how to make this configuration bootable; please enable a boot loader."
 
     with subtest("actions"):
         # boot action
-        machine.fail("test -f /tmp/bootloader-installed")
         out = switch_to_specialisation("${machine}", "simpleService", action="boot")
-        assert_contains(out, "installing dummy bootloader")
+        assert_contains(out, boot_loader_text)
         assert_lacks(out, "activating the configuration...")  # good indicator of a system activation
-        machine.succeed("test -f /tmp/bootloader-installed")
-        machine.succeed("rm /tmp/bootloader-installed")
 
         # switch action
-        machine.fail("test -f /tmp/bootloader-installed")
         out = switch_to_specialisation("${machine}", "", action="switch")
-        assert_contains(out, "installing dummy bootloader")
+        assert_contains(out, boot_loader_text)
         assert_contains(out, "activating the configuration...")  # good indicator of a system activation
-        machine.succeed("test -f /tmp/bootloader-installed")
 
         # test and dry-activate actions are tested further down below
 
@@ -749,7 +755,7 @@ in {
         out = switch_to_specialisation("${machine}", "")
         assert_contains(out, "stopping the following units: test.mount\n")
         assert_lacks(out, "NOT restarting the following changed units:")
-        assert_contains(out, "reloading the following units: ${dbusService}\n")
+        assert_lacks(out, "reloading the following units:")
         assert_lacks(out, "\nrestarting the following units:")
         assert_lacks(out, "\nstarting the following units:")
         assert_lacks(out, "the following new units were started:")
@@ -757,7 +763,7 @@ in {
         out = switch_to_specialisation("${machine}", "storeMountModified")
         assert_lacks(out, "stopping the following units:")
         assert_contains(out, "NOT restarting the following changed units: -.mount")
-        assert_contains(out, "reloading the following units: ${dbusService}\n")
+        assert_lacks(out, "reloading the following units:")
         assert_lacks(out, "\nrestarting the following units:")
         assert_lacks(out, "\nstarting the following units:")
         assert_lacks(out, "the following new units were started:")
@@ -768,7 +774,7 @@ in {
         out = switch_to_specialisation("${machine}", "swap")
         assert_lacks(out, "stopping the following units:")
         assert_lacks(out, "NOT restarting the following changed units:")
-        assert_contains(out, "reloading the following units: ${dbusService}\n")
+        assert_lacks(out, "reloading the following units:")
         assert_lacks(out, "\nrestarting the following units:")
         assert_lacks(out, "\nstarting the following units:")
         assert_contains(out, "the following new units were started: swapfile.swap")
@@ -777,7 +783,7 @@ in {
         assert_contains(out, "stopping swap device: /swapfile")
         assert_lacks(out, "stopping the following units:")
         assert_lacks(out, "NOT restarting the following changed units:")
-        assert_contains(out, "reloading the following units: ${dbusService}\n")
+        assert_lacks(out, "reloading the following units:")
         assert_lacks(out, "\nrestarting the following units:")
         assert_lacks(out, "\nstarting the following units:")
         assert_lacks(out, "the following new units were started:")
@@ -795,10 +801,10 @@ in {
 
         # Start a simple service
         out = switch_to_specialisation("${machine}", "simpleService")
-        assert_lacks(out, "installing dummy bootloader")  # test does not install a bootloader
+        assert_lacks(out, boot_loader_text)  # test does not install a bootloader
         assert_lacks(out, "stopping the following units:")
         assert_lacks(out, "NOT restarting the following changed units:")
-        assert_contains(out, "reloading the following units: ${dbusService}\n")  # huh
+        assert_lacks(out, "reloading the following units:")
         assert_lacks(out, "\nrestarting the following units:")
         assert_lacks(out, "\nstarting the following units:")
         assert_contains(out, "the following new units were started: test.service\n")
@@ -872,10 +878,10 @@ in {
         # Ensure the service can be started when the activation script isn't in toplevel
         # This is a lot like "Start a simple service", except activation-only deps could be gc-ed
         out = run_switch("${nodes.machine.specialisation.simpleServiceSeparateActivationScript.configuration.system.build.separateActivationScript}/bin/switch-to-configuration");
-        assert_lacks(out, "installing dummy bootloader")  # test does not install a bootloader
+        assert_lacks(out, boot_loader_text)  # test does not install a bootloader
         assert_lacks(out, "stopping the following units:")
         assert_lacks(out, "NOT restarting the following changed units:")
-        assert_contains(out, "reloading the following units: ${dbusService}\n")  # huh
+        assert_lacks(out, "reloading the following units:")
         assert_lacks(out, "\nrestarting the following units:")
         assert_lacks(out, "\nstarting the following units:")
         assert_contains(out, "the following new units were started: test.service\n")
@@ -1429,5 +1435,15 @@ in {
         assert_lacks(out, "the following new units were started:")
         machine.succeed("systemctl start testservice.service")
         machine.succeed("echo 1 > /proc/sys/vm/panic_on_oom")  # disallow OOMing
+
+    with subtest("dbus reloads"):
+        out = switch_to_specialisation("${machine}", "")
+        out = switch_to_specialisation("${machine}", "dbusReload")
+        assert_lacks(out, "stopping the following units:")
+        assert_lacks(out, "NOT restarting the following changed units:")
+        assert_contains(out, "reloading the following units: ${dbusService}\n")
+        assert_lacks(out, "\nrestarting the following units:")
+        assert_lacks(out, "\nstarting the following units:")
+        assert_lacks(out, "the following new units were started:")
   '';
 })

nixos/tests/victoriametrics.nix

@@ -1,33 +1,41 @@
-# This test runs influxdb and checks if influxdb is up and running
+# This test runs victoriametrics and checks if victoriametrics is able to write points and run simple query
 
-import ./make-test-python.nix ({ pkgs, ...} : {
-  name = "victoriametrics";
-  meta = with pkgs.lib.maintainers; {
-    maintainers = [ yorickvp ];
-  };
-
-  nodes = {
-    one = { ... }: {
-      services.victoriametrics.enable = true;
+import ./make-test-python.nix (
+  { pkgs, ... }:
+  {
+    name = "victoriametrics";
+    meta = with pkgs.lib.maintainers; {
+      maintainers = [
+        yorickvp
+        ryan4yin
+      ];
     };
-  };
 
-  testScript = ''
-    start_all()
+    nodes = {
+      one =
+        { ... }:
+        {
+          services.victoriametrics.enable = true;
+        };
+    };
 
-    one.wait_for_unit("victoriametrics.service")
+    testScript = ''
+      start_all()
 
-    # write some points and run simple query
-    out = one.succeed(
-        "curl -f -d 'measurement,tag1=value1,tag2=value2 field1=123,field2=1.23' -X POST 'http://localhost:8428/write'"
-    )
-    cmd = (
-        """curl -f -s -G 'http://localhost:8428/api/v1/export' -d 'match={__name__!=""}'"""
-    )
-    # data takes a while to appear
-    one.wait_until_succeeds(f"[[ $({cmd} | wc -l) -ne 0 ]]")
-    out = one.succeed(cmd)
-    assert '"values":[123]' in out
-    assert '"values":[1.23]' in out
-  '';
-})
+      one.wait_for_unit("victoriametrics.service")
+
+      # write some points and run simple query
+      out = one.succeed(
+          "curl -f -d 'measurement,tag1=value1,tag2=value2 field1=123,field2=1.23' -X POST 'http://localhost:8428/write'"
+      )
+      cmd = (
+          """curl -f -s -G 'http://localhost:8428/api/v1/export' -d 'match={__name__!=""}'"""
+      )
+      # data takes a while to appear
+      one.wait_until_succeeds(f"[[ $({cmd} | wc -l) -ne 0 ]]")
+      out = one.succeed(cmd)
+      assert '"values":[123]' in out
+      assert '"values":[1.23]' in out
+    '';
+  }
+)

pkgs/applications/audio/cmus/default.nix

@@ -92,13 +92,13 @@ in
 
 stdenv.mkDerivation rec {
   pname = "cmus";
-  version = "2.11.0";
+  version = "2.12.0";
 
   src = fetchFromGitHub {
     owner  = "cmus";
     repo   = "cmus";
     rev    = "v${version}";
-    hash   = "sha256-kUJC+ORLkYD57mPL/1p5VCm9yiNzVdOZhxp7sVP6oMw=";
+    hash   = "sha256-8hgibGtkiwzenMI9YImIApRmw2EzTwE6RhglALpUkp4=";
   };
 
   nativeBuildInputs = [ pkg-config ];

pkgs/applications/editors/emacs/elisp-packages/melpa-packages.nix

@@ -1385,6 +1385,13 @@ let
 
         org-trello = ignoreCompilationError super.org-trello; # elisp error
 
+        # Requires xwidgets compiled into emacs, so mark this package
+        # as broken if emacs hasn't been compiled with the flag.
+        org-xlatex =
+          if self.emacs.withXwidgets
+          then super.org-xlatex
+          else markBroken super.org-xlatex;
+
         # Optimizer error: too much on the stack
         orgnav = ignoreCompilationError super.orgnav;
 

pkgs/applications/editors/emacs/make-emacs.nix

@@ -407,6 +407,7 @@ mkDerivation (finalAttrs: {
   passthru = {
     inherit withNativeCompilation;
     inherit withTreeSitter;
+    inherit withXwidgets;
     pkgs = recurseIntoAttrs (emacsPackagesFor finalAttrs.finalPackage);
     tests = { inherit (nixosTests) emacs-daemon; };
   };

pkgs/applications/editors/gnome-builder/default.nix

@@ -41,13 +41,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "gnome-builder";
-  version = "47.1";
+  version = "47.2";
 
   outputs = [ "out" "devdoc" ];
 
   src = fetchurl {
     url = "mirror://gnome/sources/gnome-builder/${lib.versions.major finalAttrs.version}/gnome-builder-${finalAttrs.version}.tar.xz";
-    hash = "sha256-5vduvPbFXMmC1EYAWdPRVtm0ESf7erZg7LqdyWBok8U=";
+    hash = "sha256-Roe5PEfNHjNmWi3FA3kLYhPugnhy/ABNl40UvL+ptJU=";
   };
 
   patches = [

pkgs/applications/editors/vim/plugins/avante-nvim/default.nix

@@ -1,75 +0,0 @@
-{
-  lib,
-  rustPlatform,
-  fetchFromGitHub,
-  pkg-config,
-  openssl,
-  stdenv,
-  vimUtils,
-  darwin,
-}:
-
-let
-  version = "2024-10-18";
-
-  src = fetchFromGitHub {
-    owner = "yetone";
-    repo = "avante.nvim";
-    rev = "36b23cef16c2c624c34bea213f01c06782d2ca40";
-    hash = "sha256-QUFcJMbfr5BAS04ig1IHLCMLACeQhFVH9ZCH/VD8i8Y=";
-  };
-
-  meta = with lib; {
-    description = "Neovim plugin designed to emulate the behaviour of the Cursor AI IDE";
-    homepage = "https://github.com/yetone/avante.nvim";
-    license = licenses.asl20;
-    maintainers = with lib.maintainers; [
-      ttrei
-      aarnphm
-    ];
-  };
-
-  avante-nvim-lib = rustPlatform.buildRustPackage {
-    pname = "avante-nvim-lib";
-    inherit version src meta;
-    cargoLock = {
-      lockFile = ./Cargo.lock;
-      outputHashes = {
-        "mlua-0.10.0-beta.1" = "sha256-ZEZFATVldwj0pmlmi0s5VT0eABA15qKhgjmganrhGBY=";
-      };
-    };
-
-    nativeBuildInputs = [
-      pkg-config
-    ];
-
-    buildInputs =
-      [
-        openssl
-      ]
-      ++ lib.optionals stdenv.hostPlatform.isDarwin [
-        darwin.apple_sdk.frameworks.Security
-      ];
-
-    buildFeatures = [ "luajit" ];
-  };
-in
-
-vimUtils.buildVimPlugin {
-  pname = "avante.nvim";
-  inherit version src meta;
-
-  postInstall =
-    let
-      ext = stdenv.hostPlatform.extensions.sharedLibrary;
-    in
-    ''
-      mkdir -p $out/build
-      ln -s ${avante-nvim-lib}/lib/libavante_repo_map${ext} $out/build/avante_repo_map${ext}
-      ln -s ${avante-nvim-lib}/lib/libavante_templates${ext} $out/build/avante_templates${ext}
-      ln -s ${avante-nvim-lib}/lib/libavante_tokenizers${ext} $out/build/avante_tokenizers${ext}
-    '';
-
-  doInstallCheck = true;
-  nvimRequireCheck = "avante";
-}

pkgs/applications/editors/vim/plugins/blink-cmp/default.nix

@@ -6,12 +6,12 @@
   vimUtils,
 }:
 let
-  version = "0.5.0";
+  version = "0.5.1";
   src = fetchFromGitHub {
     owner = "Saghen";
     repo = "blink.cmp";
     rev = "refs/tags/v${version}";
-    hash = "sha256-DmHMySR1K4j/z5+bZDJHIuqo5BqRP9XaOMEdCb78chk=";
+    hash = "sha256-LWA3rPvqq+zeK+8zS1kM1BaQ+uaBmlHJy4o7IaT1zsg=";
   };
   libExt = if stdenv.hostPlatform.isDarwin then "dylib" else "so";
   blink-fuzzy-lib = rustPlatform.buildRustPackage {

pkgs/applications/editors/vim/plugins/generated.nix

@@ -18851,4 +18851,28 @@ final: prev:
     };
     meta.homepage = "https://github.com/jghauser/follow-md-links.nvim/";
   };
+
+  avante-nvim = buildVimPlugin {
+    pname = "avante.nvim";
+    version = "2024-11-04";
+    src = fetchFromGitHub {
+      owner = "yetone";
+      repo = "avante.nvim";
+      rev = "5db2a0f92ff0ac4cfde27266cbc91eabdc2bb7f5";
+      sha256 = "sha256-bLHKJfmn8a57U3WRrvib7yWUgO8PI1V0H77Q+xsGlfM=";
+    };
+    meta.homepage = "https://github.com/yetone/avante.nvim";
+  };
+
+  muren-nvim = buildVimPlugin {
+    pname = "muren.nvim";
+    version = "2023-08-26";
+    src = fetchFromGitHub {
+      owner = "AckslD";
+      repo = "muren.nvim";
+      rev = "818c09097dba1322b2ca099e35f7471feccfef93";
+      sha256 = "sha256-KDXytsyvUQVZoKdr6ieoUE3e0v5NT2gf3M1d15aYVFs=";
+    };
+    meta.homepage = "https://github.com/AckslD/muren.nvim/";
+  };
 }

pkgs/applications/editors/vim/plugins/overrides.nix

@@ -166,14 +166,66 @@ in
     nvimRequireCheck = "autosave";
   };
 
-  avante-nvim = (callPackage ./avante-nvim { }).overrideAttrs {
-    dependencies = with self; [
-      dressing-nvim
-      nui-nvim
-      nvim-treesitter
-      plenary-nvim
-    ];
-  };
+  avante-nvim = super.avante-nvim.overrideAttrs (
+    oldAttrs:
+    let
+      avante-nvim-lib = rustPlatform.buildRustPackage {
+        pname = "avante-nvim-lib";
+        inherit (oldAttrs) version src;
+
+        cargoHash = "sha256-Hh7qAmGtxfWtkBBsNq0iVTruUSe0duE4tXaajDIt8zQ=";
+
+        nativeBuildInputs = [
+          pkg-config
+        ];
+
+        buildInputs = [
+          openssl
+        ];
+
+        buildFeatures = [ "luajit" ];
+
+        checkFlags = [
+          # Disabled because they access the network.
+          "--skip=test_hf"
+          "--skip=test_public_url"
+          "--skip=test_roundtrip"
+        ];
+      };
+    in
+    {
+      dependencies = with self; [
+        dressing-nvim
+        nui-nvim
+        nvim-treesitter
+        plenary-nvim
+      ];
+
+      postInstall =
+        let
+          ext = stdenv.hostPlatform.extensions.sharedLibrary;
+        in
+        ''
+          mkdir -p $out/build
+          ln -s ${avante-nvim-lib}/lib/libavante_repo_map${ext} $out/build/avante_repo_map${ext}
+          ln -s ${avante-nvim-lib}/lib/libavante_templates${ext} $out/build/avante_templates${ext}
+          ln -s ${avante-nvim-lib}/lib/libavante_tokenizers${ext} $out/build/avante_tokenizers${ext}
+        '';
+
+      doInstallCheck = true;
+      nvimRequireCheck = "avante";
+
+      meta = {
+        description = "Neovim plugin designed to emulate the behaviour of the Cursor AI IDE";
+        homepage = "https://github.com/yetone/avante.nvim";
+        license = lib.licenses.asl20;
+        maintainers = with lib.maintainers; [
+          ttrei
+          aarnphm
+        ];
+      };
+    }
+  );
 
   barbecue-nvim = super.barbecue-nvim.overrideAttrs {
     dependencies = with self; [

pkgs/applications/editors/vim/plugins/vim-plugin-names

@@ -85,6 +85,7 @@ https://github.com/m4xshen/autoclose.nvim/,HEAD,
 https://github.com/gaoDean/autolist.nvim/,,
 https://github.com/vim-scripts/autoload_cscope.vim/,,
 https://github.com/nullishamy/autosave.nvim/,HEAD,
+https://github.com/yetone/avante.nvim/,HEAD,
 https://github.com/rafi/awesome-vim-colorschemes/,,
 https://github.com/AhmedAbdulrahman/aylin.vim/,,
 https://github.com/ayu-theme/ayu-vim/,,
@@ -604,6 +605,7 @@ https://github.com/shaunsingh/moonlight.nvim/,,pure-lua
 https://github.com/leafo/moonscript-vim/,HEAD,
 https://github.com/yegappan/mru/,,
 https://github.com/smoka7/multicursors.nvim/,HEAD,
+https://github.com/AckslD/muren.nvim/,HEAD,
 https://github.com/jbyuki/nabla.nvim/,HEAD,
 https://github.com/ncm2/ncm2/,,
 https://github.com/ncm2/ncm2-bufword/,,

pkgs/applications/emulators/86box/default.nix

@@ -1,6 +1,6 @@
 {
   stdenv,
-  darwin,
+  apple-sdk_11,
   lib,
   fetchFromGitHub,
   cmake,
@@ -91,7 +91,7 @@ stdenv.mkDerivation (finalAttrs: {
     ++ lib.optional stdenv.hostPlatform.isLinux alsa-lib
     ++ lib.optional enableWayland wayland
     ++ lib.optional enableVncRenderer libvncserver
-    ++ lib.optional stdenv.hostPlatform.isDarwin darwin.apple_sdk_11_0.libs.xpc;
+    ++ lib.optional stdenv.hostPlatform.isDarwin apple-sdk_11;
 
   cmakeFlags =
     lib.optional stdenv.hostPlatform.isDarwin "-DCMAKE_MACOSX_BUNDLE=OFF"

pkgs/applications/misc/bambu-studio/orca-slicer.nix

@@ -5,23 +5,20 @@
 }:
 bambu-studio.overrideAttrs (
   finalAttrs: previousAttrs: {
-    version = "2.1.1";
+    version = "2.2.0";
     pname = "orca-slicer";
 
     src = fetchFromGitHub {
       owner = "SoftFever";
       repo = "OrcaSlicer";
       rev = "v${finalAttrs.version}";
-      hash = "sha256-7fusdSYpZb4sYl5L/+81PzMd42Nsejj+kCZsq0f7eIk=";
+      hash = "sha256-h+cHWhrp894KEbb3ic2N4fNTn13WlOSYoMsaof0RvRI=";
     };
 
-    patches =[
-      # FIXME: only required for 2.1.1, can be removed in the next version
-      ./patches/0002-fix-build-for-gcc-13.diff
+    patches = [
       # Fix for webkitgtk linking
       ./patches/0001-not-for-upstream-CMakeLists-Link-against-webkit2gtk-.patch
-      # Fix build with cgal-5.6.1+
-      ./patches/meshboolean-const.patch
+
       ./patches/dont-link-opencv-world-orca.patch
     ];
 

pkgs/applications/misc/bambu-studio/patches/0002-fix-build-for-gcc-13.diff

@@ -1,38 +0,0 @@
-diff --git a/src/slic3r/Utils/Http.cpp b/src/slic3r/Utils/Http.cpp
-index 11a36dfabc..77a44e699b 100644
---- a/src/slic3r/Utils/Http.cpp
-+++ b/src/slic3r/Utils/Http.cpp
-@@ -88,9 +88,13 @@ std::mutex g_mutex;
- 
- struct form_file
- {
--    fs::ifstream ifs;
-+    fs::ifstream                          ifs;
-     boost::filesystem::ifstream::off_type init_offset;
-     size_t                                content_length;
-+
-+    form_file(fs::path const& p, const boost::filesystem::ifstream::off_type offset, const size_t content_length)
-+        : ifs(p, std::ios::in | std::ios::binary), init_offset(offset), content_length(content_length)
-+    {}
- };
- 
- struct Http::priv
-@@ -314,7 +318,7 @@ void Http::priv::form_add_file(const char *name, const fs::path &path, const cha
- 		filename = path.string().c_str();
- 	}
- 
--	form_files.emplace_back(form_file{{path, std::ios::in | std::ios::binary}, offset, length});
-+	form_files.emplace_back(path, offset, length);
- 	auto &f = form_files.back();
-     size_t size = length;
-     if (length == 0) {
-@@ -381,7 +385,7 @@ void Http::priv::set_put_body(const fs::path &path)
- 	boost::system::error_code ec;
- 	boost::uintmax_t filesize = file_size(path, ec);
- 	if (!ec) {
--        putFile = std::make_unique<form_file>(form_file{{path, std::ios_base::binary | std::ios_base::in}, 0, 0});
-+        putFile = std::make_unique<form_file>(path, 0, 0);
- 		::curl_easy_setopt(curl, CURLOPT_UPLOAD, 1L);
- 		::curl_easy_setopt(curl, CURLOPT_READDATA, (void *) (putFile.get()));
- 		::curl_easy_setopt(curl, CURLOPT_INFILESIZE, filesize);
-

pkgs/applications/misc/goldendict-ng/default.nix

@@ -30,13 +30,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "goldendict-ng";
-  version = "24.09.0";
+  version = "24.09.1";
 
   src = fetchFromGitHub {
     owner = "xiaoyifang";
     repo = "goldendict-ng";
-    rev = "v${finalAttrs.version}-Release.316ec900";
-    hash = "sha256-LriKJLjqEuD0v8yjoE35O+V6oUX2jhWGFguqlXaDlQA=";
+    rev = "v${finalAttrs.version}-Release.ca9dd133";
+    hash = "sha256-HvXC9fNLDZAEtXNjzFmaKz9Ih3n4Au69NPMuVeCiQPk=";
   };
 
   nativeBuildInputs = [ pkg-config cmake wrapQtAppsHook wrapGAppsHook3 ];

pkgs/applications/misc/upwork/default.nix

@@ -6,12 +6,12 @@
 
 stdenv.mkDerivation rec {
   pname = "upwork";
-  version = "5.8.0.33";
+  version = "5.8.0.35";
 
   src = requireFile {
     name = "${pname}_${version}_amd64.deb";
     url = "https://www.upwork.com/ab/downloads/os/linux/";
-    sha256 = "sha256-MU0usTAfNNMN8OYmS6dWU6Xk2o5dg5J0V7OQiv3dLug=";
+    sha256 = "sha256-Suv23TL6l5HhkOSRT56LpFRZJxuSLYVc1uT6he8j7O0=";
   };
 
   nativeBuildInputs = [

pkgs/applications/networking/browsers/firefox/packages.nix

@@ -5,10 +5,10 @@
 {
   firefox = buildMozillaMach rec {
     pname = "firefox";
-    version = "132.0";
+    version = "132.0.1";
     src = fetchurl {
       url = "mirror://mozilla/firefox/releases/${version}/source/firefox-${version}.source.tar.xz";
-      sha512 = "254ffba16d6e6c61cffaa8131f81a9a78880e5723b7ee78ac36251a27d82e6ff088238ae289d07469ba3a51b5b5969a08ecd1fc02dcb4d93325a08fac1cfc916";
+      sha512 = "10d5b05f61628deb9a69cb34b2cf3c75bb6b8768f5a718cef2157d5feb1671ede0d583439562e1c1221914eb6ed37fdf415dd651b1465c056be174136cd80b9d";
     };
 
     extraPatches = [

pkgs/applications/networking/cluster/nomad/default.nix

@@ -1,6 +1,7 @@
 { lib
 , buildGoModule
 , buildGo122Module
+, buildGo123Module
 , fetchFromGitHub
 , nixosTests
 , installShellFiles
@@ -54,7 +55,7 @@ rec {
   # Upstream partially documents used Go versions here
   # https://github.com/hashicorp/nomad/blob/master/contributing/golang.md
 
-  nomad = nomad_1_7;
+  nomad = nomad_1_8;
 
   nomad_1_4 = throwUnsupportaed "nomad_1_4";
 
@@ -85,4 +86,16 @@ rec {
       export PATH="$PATH:$NIX_BUILD_TOP/go/bin"
     '';
   };
+
+  nomad_1_9 = generic {
+    buildGoModule = buildGo123Module;
+    version = "1.9.0";
+    sha256 = "sha256-MJNPYSH3KsRmGQeOcWw4VvDeFGinfsyGSo4q3OdOZo8=";
+    vendorHash = "sha256-Ss/qwQ14VUu40nXaIgTfNuj95ekTTVrY+zcStFDSCyI=";
+    license = lib.licenses.bsl11;
+    passthru.tests.nomad = nixosTests.nomad;
+    preCheck = ''
+      export PATH="$PATH:$NIX_BUILD_TOP/go/bin"
+    '';
+  };
 }

pkgs/applications/networking/instant-messengers/discord/default.nix

@@ -9,54 +9,54 @@ let
   versions =
     if stdenv.hostPlatform.isLinux then
       {
-        stable = "0.0.72";
-        ptb = "0.0.113";
-        canary = "0.0.509";
-        development = "0.0.33";
+        stable = "0.0.73";
+        ptb = "0.0.114";
+        canary = "0.0.511";
+        development = "0.0.42";
       }
     else
       {
-        stable = "0.0.323";
-        ptb = "0.0.143";
-        canary = "0.0.618";
-        development = "0.0.55";
+        stable = "0.0.324";
+        ptb = "0.0.144";
+        canary = "0.0.620";
+        development = "0.0.63";
       };
   version = versions.${branch};
   srcs = rec {
     x86_64-linux = {
       stable = fetchurl {
         url = "https://stable.dl2.discordapp.net/apps/linux/${version}/discord-${version}.tar.gz";
-        hash = "sha256-IAvlxs6oEdO//qVWwH0cBJEbDxyPLG6HHwmOgqMzRRU=";
+        hash = "sha256-LZ3IgtGr94NWbykYS5Xllkl4OOHLG66+ZqQ+OrpnVzs=";
       };
       ptb = fetchurl {
         url = "https://ptb.dl2.discordapp.net/apps/linux/${version}/discord-ptb-${version}.tar.gz";
-        hash = "sha256-1Rhn6pH6KvuhGNTymBK01tA78it7JXekG48XvRZQOiA=";
+        hash = "sha256-fdpG9V4EJaARSJA9XmW+Zq6exPaFMJ/FWhzwgarDIpI=";
       };
       canary = fetchurl {
         url = "https://canary.dl2.discordapp.net/apps/linux/${version}/discord-canary-${version}.tar.gz";
-        hash = "sha256-jLAeix6IQ6rqOM8NKNryEeswB5VSzc1lIEI7X7Nrc68=";
+        hash = "sha256-srjYJFVM1UVpkB+koqrZfwgRAWpa7s8Arq2DnAFuaKs=";
       };
       development = fetchurl {
         url = "https://development.dl2.discordapp.net/apps/linux/${version}/discord-development-${version}.tar.gz";
-        hash = "sha256-A87sVmaYRjRi0Q9IrXuQBr+yC+FtGgZA2L/9V4WuYbU=";
+        hash = "sha256-HZdodWwczgxaGgal5gfr6NQlquf4ZO//QMVcebxQG7s=";
       };
     };
     x86_64-darwin = {
       stable = fetchurl {
         url = "https://stable.dl2.discordapp.net/apps/osx/${version}/Discord.dmg";
-        hash = "sha256-9ySE75TjVDLdPSWAawsVpOgCtL/Di+J3fKUEDH5/Oog=";
+        hash = "sha256-Q/PWTBTnmdNeZV+InLQ3nSpETYF3rzTq9nxEh9HEOWY=";
       };
       ptb = fetchurl {
         url = "https://ptb.dl2.discordapp.net/apps/osx/${version}/DiscordPTB.dmg";
-        hash = "sha256-ZbHz0OR7p873U7YpwsHxa3Uuf3uPsmVOQF9exARQzdI=";
+        hash = "sha256-Xv8TPzfK1gOLG57F9gtt4PvwkCqjDQjYJmKfyNIkEZY=";
       };
       canary = fetchurl {
         url = "https://canary.dl2.discordapp.net/apps/osx/${version}/DiscordCanary.dmg";
-        hash = "sha256-UsJRw7gforZ1OAA6GNtXuTe/y95mIr7R6MRa+qe44tk=";
+        hash = "sha256-6rBDZPVYxS3q328d2T9LOs0DUirPbMg2GKDacCSsOG4=";
       };
       development = fetchurl {
         url = "https://development.dl2.discordapp.net/apps/osx/${version}/DiscordDevelopment.dmg";
-        hash = "sha256-tZbFrb6OFEa3/IrjzHCcQultFgrMIvaNTmzNj3RHUgQ=";
+        hash = "sha256-E1qQUnwemS6SIHeO1BBifrCu706ldZH18isR7+nGNRU=";
       };
     };
     aarch64-darwin = x86_64-darwin;

pkgs/applications/networking/instant-messengers/wavebox/default.nix

@@ -156,11 +156,11 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "wavebox";
-  version = "10.129.29-2";
+  version = "10.129.32-2";
 
   src = fetchurl {
     url = "https://download.wavebox.app/stable/linux/deb/amd64/wavebox_${finalAttrs.version}_amd64.deb";
-    hash = "sha256-HGzBvCv6ASW2wXMd0BrA6NNGAEsuN2yHwS+0WbABfWM=";
+    hash = "sha256-MaVmiD+XwQLZVVTEZTn/2Kme5pCHXpgQ9bgJRsfrlU0=";
   };
 
   nativeBuildInputs = [

pkgs/applications/networking/mailreaders/evolution/evolution-ews/default.nix

@@ -22,11 +22,11 @@
 
 stdenv.mkDerivation rec {
   pname = "evolution-ews";
-  version = "3.54.0";
+  version = "3.54.1";
 
   src = fetchurl {
     url = "mirror://gnome/sources/${pname}/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    hash = "sha256-EZIOIudgpOv9s3aeZgE3He3YDA16N9TCN1i0RKo/Ftg=";
+    hash = "sha256-oeM9aED4GLdLv+iafb2jcpXdgUWn30JlrS2yQUU4kDo=";
   };
 
   patches = [

pkgs/applications/networking/mailreaders/evolution/evolution/default.nix

@@ -45,11 +45,11 @@
 
 stdenv.mkDerivation rec {
   pname = "evolution";
-  version = "3.54.0";
+  version = "3.54.1";
 
   src = fetchurl {
     url = "mirror://gnome/sources/evolution/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    hash = "sha256-qlLXP76wmgk/gZHHJ6ERVCkOVdBHNRJaw5eBTrWGz58=";
+    hash = "sha256-qEQzdJd6AcY70Dr9tcY+c6SOZ0XX1Fm08mgj3Vz5lxs=";
   };
 
   nativeBuildInputs = [

pkgs/applications/networking/nextcloud-client/default.nix

@@ -27,7 +27,7 @@
 
 stdenv.mkDerivation rec {
   pname = "nextcloud-client";
-  version = "3.14.2";
+  version = "3.14.3";
 
   outputs = [ "out" "dev" ];
 
@@ -35,7 +35,7 @@ stdenv.mkDerivation rec {
     owner = "nextcloud-releases";
     repo = "desktop";
     rev = "refs/tags/v${version}";
-    hash = "sha256-vxCt/FNfQZ7rWME2zLGESgW/+FNoENZeCr8FFcGwoFQ=";
+    hash = "sha256-nYoBs5EnWiqYRsqc5CPxCIs0NAxSprI9PV0lO/c8khw=";
   };
 
   patches = [

pkgs/applications/office/paperless-ngx/default.nix

@@ -25,13 +25,13 @@
 }:
 
 let
-  version = "2.12.1";
+  version = "2.13.4";
 
   src = fetchFromGitHub {
     owner = "paperless-ngx";
     repo = "paperless-ngx";
     rev = "refs/tags/v${version}";
-    hash = "sha256-txqwVGLUel74ObCqwMWSqa4Nd2eDRf0SqAIes5tlMDg=";
+    hash = "sha256-db8omhyngvenAgfGGpMAhGkgqGug/sv7AL1G+sniM/c=";
   };
 
   # subpath installation is broken with uvicorn >= 0.26
@@ -40,6 +40,27 @@ let
   python = python3.override {
     self = python;
     packageOverrides = final: prev: {
+      django = prev.django_5;
+
+      # TODO: drop after https://github.com/NixOS/nixpkgs/pull/306556 or similar got merged
+      django-allauth = prev.django-allauth.overridePythonAttrs ({ src, nativeCheckInputs, ... }: let
+        version = "65.0.2";
+      in {
+        inherit version;
+        src = src.override {
+          rev = "refs/tags/${version}";
+          hash = "sha256-GvYdExkNuySrg8ERnWOJxucFe5HVdPAcHfRNeqiVS7M=";
+        };
+
+        nativeCheckInputs = nativeCheckInputs ++ [ prev.fido2 ];
+      });
+
+      django-extensions = prev.django-extensions.overridePythonAttrs (_: {
+        # fails with: TypeError: 'class Meta' got invalid attribute(s): index_together
+        # probably because of django_5 but it is the latest version available and used like that in paperless-ngx
+        doCheck = false;
+      });
+
       # tesseract5 may be overwritten in the paperless module and we need to propagate that to make the closure reduction effective
       ocrmypdf = prev.ocrmypdf.override { tesseract = tesseract5; };
 
@@ -76,7 +97,7 @@ let
       cd src-ui
     '';
 
-    npmDepsHash = "sha256-hb2z2cPMTN5bHtUldTR5Mvgo4nZL8/S+Uhfis37gF44=";
+    npmDepsHash = "sha256-pBCWcdCTQh0N4pRLBWLZXybuhpiat030xvPZ5z7CUJ0=";
 
     nativeBuildInputs = [
       pkg-config
@@ -137,7 +158,7 @@ python.pkgs.buildPythonApplication rec {
     channels-redis
     concurrent-log-handler
     dateparser
-    django
+    django_5
     django-allauth
     django-auditlog
     django-celery-results
@@ -155,8 +176,10 @@ python.pkgs.buildPythonApplication rec {
     flower
     gotenberg-client
     gunicorn
+    httpx-oauth
     imap-tools
     inotifyrecursive
+    jinja2
     langdetect
     mysqlclient
     nltk
@@ -257,10 +280,8 @@ python.pkgs.buildPythonApplication rec {
     "testNormalOperation"
     # Something broken with new Tesseract and inline RTL/LTR overrides?
     "test_rtl_language_detection"
-    # Broke during the pytest-httpx 0.30.0 -> 0.32.0 upgrade
-    "test_request_pdf_a_format"
-    "test_generate_pdf_html_email"
-    "test_generate_pdf_html_email_merge_failure"
+    # django.core.exceptions.FieldDoesNotExist: Document has no field named 'transaction_id'
+    "test_convert"
   ];
 
   doCheck = !stdenv.hostPlatform.isDarwin;

pkgs/applications/science/chemistry/openmolcas/default.nix

@@ -159,9 +159,10 @@ stdenv.mkDerivation rec {
   noAuditTmpdir = true;
 
   postFixup = ''
-    # Wrong store path in shebang (no Python pkgs), force re-patching
-    sed -i "1s:/.*:/usr/bin/env python:" $out/bin/pymolcas
-    patchShebangs $out/bin
+    # Wrong store path in shebang (bare Python, no Python pkgs), force manual re-patching
+    for exe in $(find $out/bin/ -type f -name "*.py"); do
+      sed -i "1s:.*:#!${python}/bin/python:" "$exe"
+    done
 
     wrapProgram $out/bin/pymolcas --set MOLCAS $out
   '';

pkgs/applications/science/logic/tamarin-prover/default.nix

@@ -1,20 +1,15 @@
-{ haskellPackages, mkDerivation, fetchFromGitHub, applyPatches, lib, stdenv
+{ haskellPackages, mkDerivation, fetchFromGitHub, lib, stdenv
 # the following are non-haskell dependencies
 , makeWrapper, which, maude, graphviz, glibcLocales
 }:
 
 let
-  version = "1.8.0";
-  src = applyPatches {
-      src = fetchFromGitHub {
-      owner  = "tamarin-prover";
-      repo   = "tamarin-prover";
-      rev    = version;
-      sha256 = "sha256-ujnaUdbjqajmkphOS4Fs4QBCRGX4JZkQ2p1X2jripww=";
-    };
-    patches = [
-      ./tamarin-prover-1.8.0-ghc-9.6.patch
-    ];
+  version = "1.10.0";
+  src = fetchFromGitHub {
+    owner = "tamarin-prover";
+    repo  = "tamarin-prover";
+    rev   = version;
+    hash  = "sha256-v1BruU2p/Sg/g7b9a+QRza46bD7PkMtsGq82qFaNhpI=";
   };
 
 
@@ -41,7 +36,7 @@ let
     postPatch = replaceSymlinks;
     libraryHaskellDepends = with haskellPackages; [
       base64-bytestring blaze-builder list-t
-      dlist exceptions fclabels safe SHA syb
+      dlist exceptions fclabels haskellPackages.graphviz safe SHA split syb
     ];
   });
 
@@ -84,9 +79,7 @@ let
   tamarin-prover-export = mkDerivation (common "tamarin-prover-export" (src + "/lib/export") // {
     postPatch = "cp --remove-destination ${src}/LICENSE .";
     doHaddock = false; # broken
-    libraryHaskellDepends = (with haskellPackages; [
-      HStringTemplate
-    ]) ++ [
+    libraryHaskellDepends = [
       tamarin-prover-utils
       tamarin-prover-term
       tamarin-prover-theory
@@ -125,7 +118,7 @@ mkDerivation (common "tamarin-prover" src // {
 
   executableHaskellDepends = (with haskellPackages; [
     binary-instances binary-orphans blaze-html conduit file-embed
-    gitrev http-types lifted-base monad-control
+    gitrev http-types
     resourcet shakespeare threads wai warp yesod-core yesod-static
   ]) ++ [ tamarin-prover-utils
           tamarin-prover-sapic

pkgs/applications/science/logic/tamarin-prover/tamarin-prover-1.8.0-ghc-9.6.patch

@@ -1,237 +0,0 @@
-commit 084bd5474d9ac687656c2a3a6b2e1d507febaa98
-Author: Artur Cygan <arczicygan@gmail.com>
-Date:   Mon Feb 26 10:04:48 2024 +0100
-
-    Update to GHC 9.6 (#618)
-    
-    Cherry-picked from b3e18f61e45d701d42d794bc91ccbb4c0e3834ec.
-    
-    Removing Control.Monad.List
-
-diff --git a/lib/sapic/src/Sapic/Exceptions.hs b/lib/sapic/src/Sapic/Exceptions.hs
-index 146b721e..b9962478 100644
---- a/lib/sapic/src/Sapic/Exceptions.hs
-+++ b/lib/sapic/src/Sapic/Exceptions.hs
-@@ -23,7 +23,6 @@ import Theory.Sapic
- import Data.Label
- import qualified Data.Maybe
- import Theory.Text.Pretty
--import Sapic.Annotation  --toAnProcess
- import Theory.Sapic.Print (prettySapic)
- import qualified Theory.Text.Pretty as Pretty
- 
-@@ -67,14 +66,14 @@ data ExportException = UnsupportedBuiltinMS
-                        | UnsupportedTypes [String]
- 
- instance Show ExportException where
--    
-+
-     show (UnsupportedTypes incorrectFunctionUsages) = do
-         let functionsString = List.intercalate ", " incorrectFunctionUsages
-         (case length functionsString of
-           1 -> "The function " ++ functionsString ++ ", which is declared with a user-defined type, appears in a rewrite rule. "
-           _ -> "The functions " ++ functionsString ++ ", which are declared with a user-defined type, appear in a rewrite rule. ")
-         ++ "However, the translation of rules only works with bitstrings at the moment."
--    show unsuppBuiltin = 
-+    show unsuppBuiltin =
-         "The builtins bilinear-pairing and multiset are not supported for export. However, your model uses " ++
-         (case unsuppBuiltin of
-             UnsupportedBuiltinBP -> "bilinear-pairing."
-@@ -93,7 +92,7 @@ instance Show (SapicException an) where
-     show (InvalidPosition p) = "Invalid position:" ++ prettyPosition p
-     show (NotImplementedError s) = "This feature is not implemented yet. Sorry! " ++ s
-     show (ImplementationError s) = "You've encountered an error in the implementation: " ++ s
--    show a@(ProcessNotWellformed e p) = "Process not well-formed: " ++ Pretty.render (text (show e) $-$ nest 2 (maybe emptyDoc prettySapic p))
-+    show (ProcessNotWellformed e p) = "Process not well-formed: " ++ Pretty.render (text (show e) $-$ nest 2 (maybe emptyDoc prettySapic p))
-     show ReliableTransmissionButNoProcess = "The builtin support for reliable channels currently only affects the process calculus, but you have not specified a top-level process. Please remove \"builtins: reliable-channel\" to proceed."
-     show (CannotExpandPredicate facttag rstr) = "Undefined predicate "
-                               ++ showFactTagArity facttag
-@@ -135,7 +134,7 @@ instance Show WFerror where
-                               ++ prettySapicFunType t2
-                               ++ "."
-     show (FunctionNotDefined sym ) = "Function not defined " ++ show sym
--        
-+
- 
- instance Exception WFerror
- instance (Typeable an) => Exception (SapicException an)
-diff --git a/lib/term/src/Term/Narrowing/Narrow.hs b/lib/term/src/Term/Narrowing/Narrow.hs
-index 56f145d9..88f89aa1 100644
---- a/lib/term/src/Term/Narrowing/Narrow.hs
-+++ b/lib/term/src/Term/Narrowing/Narrow.hs
-@@ -12,6 +12,7 @@ module Term.Narrowing.Narrow (
- import           Term.Unification
- import           Term.Positions
- 
-+import           Control.Monad
- import           Control.Monad.Reader
- 
- import           Extension.Prelude
-diff --git a/lib/term/src/Term/Unification.hs b/lib/term/src/Term/Unification.hs
-index b5c107cd..fcf52128 100644
---- a/lib/term/src/Term/Unification.hs
-+++ b/lib/term/src/Term/Unification.hs
-@@ -61,7 +61,7 @@ module Term.Unification (
-   , pairDestMaudeSig
-   , symEncDestMaudeSig
-   , asymEncDestMaudeSig
--  , signatureDestMaudeSig  
-+  , signatureDestMaudeSig
-   , locationReportMaudeSig
-   , revealSignatureMaudeSig
-   , hashMaudeSig
-@@ -80,7 +80,7 @@ module Term.Unification (
-   , module Term.Rewriting.Definitions
- ) where
- 
---- import           Control.Applicative
-+import           Control.Monad
- import           Control.Monad.RWS
- import           Control.Monad.Except
- import           Control.Monad.State
-diff --git a/lib/theory/src/Theory/Constraint/System/Guarded.hs b/lib/theory/src/Theory/Constraint/System/Guarded.hs
-index 99f985a8..3f0cd8d8 100644
---- a/lib/theory/src/Theory/Constraint/System/Guarded.hs
-+++ b/lib/theory/src/Theory/Constraint/System/Guarded.hs
-@@ -88,6 +88,7 @@ module Theory.Constraint.System.Guarded (
- 
- import           Control.Arrow
- import           Control.DeepSeq
-+import           Control.Monad
- import           Control.Monad.Except
- import           Control.Monad.Fresh              (MonadFresh, scopeFreshness)
- import qualified Control.Monad.Trans.PreciseFresh as Precise (Fresh, evalFresh, evalFreshT)
-diff --git a/lib/utils/src/Control/Monad/Trans/Disj.hs b/lib/utils/src/Control/Monad/Trans/Disj.hs
-index 96dae742..b3b63825 100644
---- a/lib/utils/src/Control/Monad/Trans/Disj.hs
-+++ b/lib/utils/src/Control/Monad/Trans/Disj.hs
-@@ -18,10 +18,10 @@ module Control.Monad.Trans.Disj (
-   , runDisjT
-   ) where
- 
---- import Control.Applicative
--import Control.Monad.List
--import Control.Monad.Reader
-+import Control.Monad
- import Control.Monad.Disj.Class
-+import Control.Monad.Reader
-+import ListT
- 
- 
- ------------------------------------------------------------------------------
-@@ -33,12 +33,12 @@ newtype DisjT m a = DisjT { unDisjT :: ListT m a }
-   deriving (Functor, Applicative, MonadTrans )
- 
- -- | Construct a 'DisjT' action.
--disjT :: m [a] -> DisjT m a
--disjT = DisjT . ListT
-+disjT :: (Monad m, Foldable m) => m a -> DisjT m a
-+disjT = DisjT . fromFoldable
- 
- -- | Run a 'DisjT' action.
--runDisjT :: DisjT m a -> m [a]
--runDisjT = runListT . unDisjT
-+runDisjT :: Monad m => DisjT m a -> m [a]
-+runDisjT = toList . unDisjT
- 
- 
- 
-@@ -47,8 +47,6 @@ runDisjT = runListT . unDisjT
- ------------
- 
- instance Monad m => Monad (DisjT m) where
--    {-# INLINE return #-}
--    return  = DisjT . return
-     {-# INLINE (>>=) #-}
-     m >>= f = DisjT $ (unDisjT . f) =<< unDisjT m
- 
-diff --git a/lib/utils/tamarin-prover-utils.cabal b/lib/utils/tamarin-prover-utils.cabal
-index 75ed2b46..bb54d1e5 100644
---- a/lib/utils/tamarin-prover-utils.cabal
-+++ b/lib/utils/tamarin-prover-utils.cabal
-@@ -47,6 +47,7 @@ library
-       , deepseq
-       , dlist
-       , fclabels
-+      , list-t
-       , mtl
-       , pretty
-       , safe
-diff --git a/src/Main/Mode/Batch.hs b/src/Main/Mode/Batch.hs
-index e7710682..d370da85 100644
---- a/src/Main/Mode/Batch.hs
-+++ b/src/Main/Mode/Batch.hs
-@@ -32,7 +32,8 @@ import           Main.TheoryLoader
- import           Main.Utils
- 
- import           Theory.Module
--import           Control.Monad.Except (MonadIO(liftIO), runExceptT)
-+import           Control.Monad.Except (runExceptT)
-+import           Control.Monad.IO.Class (MonadIO(liftIO))
- import           System.Exit (die)
- import Theory.Tools.Wellformedness (prettyWfErrorReport)
- import           Text.Printf                     (printf)
-diff --git a/src/Main/TheoryLoader.hs b/src/Main/TheoryLoader.hs
-index 7fffb85b..71fba2b9 100644
---- a/src/Main/TheoryLoader.hs
-+++ b/src/Main/TheoryLoader.hs
-@@ -42,8 +42,6 @@ module Main.TheoryLoader (
- 
-   ) where
- 
---- import           Debug.Trace
--
- import           Prelude                             hiding (id, (.))
- 
- import           Data.Char                           (toLower)
-@@ -58,8 +56,10 @@ import           Data.Bifunctor (Bifunctor(bimap))
- import           Data.Bitraversable (Bitraversable(bitraverse))
- 
- import           Control.Category
--import           Control.Exception (evaluate)
- import           Control.DeepSeq (force)
-+import           Control.Exception (evaluate)
-+import           Control.Monad
-+import           Control.Monad.IO.Class (MonadIO(liftIO))
- 
- import           System.Console.CmdArgs.Explicit
- import           System.Timeout (timeout)
-@@ -387,10 +387,10 @@ closeTheory version thyOpts sign srcThy = do
-   deducThy   <- bitraverse (return . addMessageDeductionRuleVariants)
-                            (return . addMessageDeductionRuleVariantsDiff) transThy
- 
--  derivCheckSignature <- Control.Monad.Except.liftIO $ toSignatureWithMaude (get oMaudePath thyOpts) $ maudePublicSig (toSignaturePure sign)
-+  derivCheckSignature <- liftIO $ toSignatureWithMaude (get oMaudePath thyOpts) $ maudePublicSig (toSignaturePure sign)
-   variableReport <- case compare derivChecks 0 of
-     EQ -> pure $ Just []
--    _ -> Control.Monad.Except.liftIO $ timeout (1000000 * derivChecks) $ evaluate . force $ (either (\t -> checkVariableDeducability  t derivCheckSignature autoSources defaultProver)
-+    _ -> liftIO $ timeout (1000000 * derivChecks) $ evaluate . force $ (either (\t -> checkVariableDeducability  t derivCheckSignature autoSources defaultProver)
-       (\t-> diffCheckVariableDeducability t derivCheckSignature autoSources defaultProver defaultDiffProver) deducThy)
- 
-   let report = wellformednessReport  ++ (fromMaybe [(underlineTopic "Derivation Checks", Pretty.text "Derivation checks timed out. Use --derivcheck-timeout=INT to configure timeout, 0 to deactivate.")] variableReport)
-diff --git a/stack.yaml b/stack.yaml
-index 7267ba17..b53f6ff8 100644
---- a/stack.yaml
-+++ b/stack.yaml
-@@ -7,7 +7,7 @@ packages:
- - lib/sapic/
- - lib/export/
- - lib/accountability/
--resolver: lts-20.26
-+resolver: lts-22.11
- ghc-options:
-   "$everything": -Wall
- nix:
-diff --git a/tamarin-prover.cabal b/tamarin-prover.cabal
-index 89a7e3a8..986274ea 100644
---- a/tamarin-prover.cabal
-+++ b/tamarin-prover.cabal
-@@ -106,7 +106,7 @@ executable tamarin-prover
-     default-language: Haskell2010
- 
-     if flag(threaded)
--        ghc-options:   -threaded -eventlog
-+        ghc-options:   -threaded
- 
-     -- -XFlexibleInstances
- 

pkgs/applications/science/math/cemu-ti/default.nix

@@ -21,6 +21,11 @@ stdenv.mkDerivation (finalAttrs: {
 
   sourceRoot = "${finalAttrs.src.name}/gui/qt/";
 
+  patches = [
+    # This is resolved upstream, but I can't apply the patch because the
+    # sourceRoot isn't set to the base of the Git repo.
+    ./resolve-ambiguous-constexpr.patch
+  ];
 
   nativeBuildInputs = [
     cmake

pkgs/applications/science/math/cemu-ti/resolve-ambiguous-constexpr.patch

@@ -0,0 +1,13 @@
+diff --git a/mainwindow.cpp b/mainwindow.cpp
+index f03a743e..70c29a45 100644
+--- a/mainwindow.cpp
++++ b/mainwindow.cpp
+@@ -970,7 +970,7 @@ void MainWindow::showEvent(QShowEvent *e) {
+ DockWidget *MainWindow::redistributeFindDock(const QPoint &pos) {
+     QWidget *child = childAt(pos);
+     if (QTabBar *tabBar = findSelfOrParent<QTabBar *>(child)) {
+-        child = childAt({pos.x(), tabBar->mapTo(this, QPoint{}).y() - 1});
++        child = childAt(QPoint({pos.x(), tabBar->mapTo(this, QPoint{}).y() - 1}));
+     }
+     return findSelfOrParent<DockWidget *>(child);
+ }

pkgs/applications/science/molecular-dynamics/gromacs/default.nix

@@ -45,8 +45,8 @@ let
       }
     else
       {
-        version = "2024.3";
-        hash = "sha256-u9oFbuWTkL59WNhME6nsDU42NWF63y63RwNJIsuh8Ck=";
+        version = "2024.4";
+        hash = "sha256-rGGOzi5Yr6hrU2xaLE/Lk38HYDGPEtGPEDRra969hqg=";
       };
 
 in stdenv.mkDerivation rec {

pkgs/applications/terminal-emulators/blackbox-terminal/default.nix

@@ -72,6 +72,7 @@ stdenv.mkDerivation rec {
         rev = "3c8f66be867aca6656e4109ce880b6ea7431b895";
         hash = "sha256-vz9ircmPy2Q4fxNnjurkgJtuTSS49rBq/m61p1B43eU=";
       };
+      patches = lib.optional (old ? patches) (lib.head old.patches);
       postPatch = (old.postPatch or "") + ''
         patchShebangs src/box_drawing_generate.sh
       '';

pkgs/applications/terminal-emulators/rio/default.nix

@@ -1,57 +1,56 @@
-{ lib
-, stdenv
-, darwin
-, fetchFromGitHub
-, rustPlatform
-, nixosTests
-, nix-update-script
+{
+  lib,
+  stdenv,
+  darwin,
+  fetchFromGitHub,
+  rustPlatform,
+  nixosTests,
+  nix-update-script,
 
-, autoPatchelfHook
-, cmake
-, ncurses
-, pkg-config
+  autoPatchelfHook,
+  cmake,
+  ncurses,
+  pkg-config,
 
-, gcc-unwrapped
-, fontconfig
-, libGL
-, vulkan-loader
-, libxkbcommon
+  gcc-unwrapped,
+  fontconfig,
+  libGL,
+  vulkan-loader,
+  libxkbcommon,
+  apple-sdk_11,
 
-, withX11 ? !stdenv.hostPlatform.isDarwin
-, libX11
-, libXcursor
-, libXi
-, libXrandr
-, libxcb
+  withX11 ? !stdenv.hostPlatform.isDarwin,
+  libX11,
+  libXcursor,
+  libXi,
+  libXrandr,
+  libxcb,
 
-, withWayland ? !stdenv.hostPlatform.isDarwin
-, wayland
+  withWayland ? !stdenv.hostPlatform.isDarwin,
+  wayland,
 
-, testers
-, rio
+  testers,
+  rio,
 }:
 let
-  rlinkLibs = if stdenv.hostPlatform.isDarwin then [
-    darwin.libobjc
-    darwin.apple_sdk_11_0.frameworks.AppKit
-    darwin.apple_sdk_11_0.frameworks.AVFoundation
-    darwin.apple_sdk_11_0.frameworks.MetalKit
-    darwin.apple_sdk_11_0.frameworks.Vision
-  ] else [
-    (lib.getLib gcc-unwrapped)
-    fontconfig
-    libGL
-    libxkbcommon
-    vulkan-loader
-  ] ++ lib.optionals withX11 [
-    libX11
-    libXcursor
-    libXi
-    libXrandr
-    libxcb
-  ] ++ lib.optionals withWayland [
-    wayland
-  ];
+  rlinkLibs =
+    lib.optionals stdenv.hostPlatform.isLinux [
+      (lib.getLib gcc-unwrapped)
+      fontconfig
+      libGL
+      libxkbcommon
+      vulkan-loader
+    ]
+    ++ lib.optionals withX11 [
+      libX11
+      libXcursor
+      libXi
+      libXrandr
+      libxcb
+    ]
+    ++ lib.optionals withWayland [
+      wayland
+    ];
 in
 rustPlatform.buildRustPackage rec {
   pname = "rio";
@@ -66,67 +65,86 @@ rustPlatform.buildRustPackage rec {
 
   cargoHash = "sha256-yGOvY5+ThSey/k8ilTTC0CzaOIJtc4hDYmdrHJC3HyE=";
 
-  nativeBuildInputs = [
-    ncurses
-  ] ++ lib.optionals stdenv.hostPlatform.isLinux [
-    cmake
-    pkg-config
-    autoPatchelfHook
-  ];
+  nativeBuildInputs =
+    [
+      ncurses
+    ]
+    ++ lib.optionals stdenv.hostPlatform.isLinux [
+      cmake
+      pkg-config
+      autoPatchelfHook
+    ];
 
   runtimeDependencies = rlinkLibs;
 
-  buildInputs = rlinkLibs;
+  buildInputs =
+    rlinkLibs
+    ++ lib.optionals stdenv.hostPlatform.isDarwin [
+      darwin.libutil
+      apple-sdk_11 # Needs _NSPasteboardTypeFileURL, can be removed once x86_64-darwin defaults to a higher SDK
+    ];
 
-  outputs = [ "out" "terminfo" ];
+  outputs = [
+    "out"
+    "terminfo"
+  ];
 
   buildNoDefaultFeatures = true;
-  buildFeatures = [ ]
-    ++ lib.optional withX11 "x11"
-    ++ lib.optional withWayland "wayland";
+  buildFeatures = [ ] ++ lib.optional withX11 "x11" ++ lib.optional withWayland "wayland";
 
   checkFlags = [
     # Fail to run in sandbox environment.
     "--skip=sys::unix::eventedfd::EventedFd"
   ];
 
-  postInstall = ''
-    install -D -m 644 misc/rio.desktop -t $out/share/applications
-    install -D -m 644 misc/logo.svg \
-                      $out/share/icons/hicolor/scalable/apps/rio.svg
+  postInstall =
+    ''
+      install -D -m 644 misc/rio.desktop -t $out/share/applications
+      install -D -m 644 misc/logo.svg \
+                        $out/share/icons/hicolor/scalable/apps/rio.svg
 
-    install -dm 755 "$terminfo/share/terminfo/r/"
-    tic -xe rio,rio-direct -o "$terminfo/share/terminfo" misc/rio.terminfo
-    mkdir -p $out/nix-support
-    echo "$terminfo" >> $out/nix-support/propagated-user-env-packages
-  '' + lib.optionalString stdenv.hostPlatform.isDarwin ''
-    mkdir $out/Applications/
-    mv misc/osx/Rio.app/ $out/Applications/
-    mkdir $out/Applications/Rio.app/Contents/MacOS/
-    ln -s $out/bin/rio $out/Applications/Rio.app/Contents/MacOS/
-  '';
+      install -dm 755 "$terminfo/share/terminfo/r/"
+      tic -xe rio,rio-direct -o "$terminfo/share/terminfo" misc/rio.terminfo
+      mkdir -p $out/nix-support
+      echo "$terminfo" >> $out/nix-support/propagated-user-env-packages
+    ''
+    + lib.optionalString stdenv.hostPlatform.isDarwin ''
+      mkdir $out/Applications/
+      mv misc/osx/Rio.app/ $out/Applications/
+      mkdir $out/Applications/Rio.app/Contents/MacOS/
+      ln -s $out/bin/rio $out/Applications/Rio.app/Contents/MacOS/
+    '';
 
   passthru = {
     updateScript = nix-update-script {
-      extraArgs = [ "--version-regex" "v([0-9.]+)" ];
+      extraArgs = [
+        "--version-regex"
+        "v([0-9.]+)"
+      ];
     };
 
-    tests = {
-      version = testers.testVersion { package = rio; };
-    } // lib.optionalAttrs stdenv.buildPlatform.isLinux {
-      # FIXME: Restrict test execution inside nixosTests for Linux devices as ofborg
-      # 'passthru.tests' nixosTests are failing on Darwin architectures.
-      #
-      # Ref: https://github.com/NixOS/nixpkgs/issues/345825
-      test = nixosTests.terminal-emulators.rio;
-    };
+    tests =
+      {
+        version = testers.testVersion { package = rio; };
+      }
+      // lib.optionalAttrs stdenv.buildPlatform.isLinux {
+        # FIXME: Restrict test execution inside nixosTests for Linux devices as ofborg
+        # 'passthru.tests' nixosTests are failing on Darwin architectures.
+        #
+        # Ref: https://github.com/NixOS/nixpkgs/issues/345825
+        test = nixosTests.terminal-emulators.rio;
+      };
   };
 
   meta = {
     description = "Hardware-accelerated GPU terminal emulator powered by WebGPU";
     homepage = "https://raphamorim.io/rio";
     license = lib.licenses.mit;
-    maintainers = with lib.maintainers; [ tornax otavio oluceps ];
+    maintainers = with lib.maintainers; [
+      tornax
+      otavio
+      oluceps
+    ];
     platforms = lib.platforms.unix;
     changelog = "https://github.com/raphamorim/rio/blob/v${version}/docs/docs/releases.md";
     mainProgram = "rio";

pkgs/applications/version-management/delta/default.nix

@@ -5,7 +5,7 @@
 , pkg-config
 , oniguruma
 , stdenv
-, darwin
+, apple-sdk_11
 , git
 }:
 
@@ -30,7 +30,7 @@ rustPlatform.buildRustPackage rec {
   buildInputs = [
     oniguruma
   ] ++ lib.optionals stdenv.hostPlatform.isDarwin [
-    darwin.apple_sdk_11_0.frameworks.Foundation
+    apple-sdk_11
   ];
 
   nativeCheckInputs = [ git ];

pkgs/applications/version-management/git-interactive-rebase-tool/default.nix

@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchFromGitHub, rustPlatform, libiconv, Security }:
+{ lib, stdenv, fetchFromGitHub, rustPlatform, libiconv, apple-sdk_11 }:
 
 rustPlatform.buildRustPackage rec {
   pname = "git-interactive-rebase-tool";
@@ -13,7 +13,7 @@ rustPlatform.buildRustPackage rec {
 
   cargoHash = "sha256-9pUUKxPpyoX9f10ZiLWsol2rv66WzQqwa6VubRTrT9Y=";
 
-  buildInputs = lib.optionals stdenv.hostPlatform.isDarwin [ libiconv Security ];
+  buildInputs = lib.optionals stdenv.hostPlatform.isDarwin [ libiconv apple-sdk_11 ];
 
   # Compilation during tests fails if this env var is not set.
   preCheck = "export GIRT_BUILD_GIT_HASH=${version}";

pkgs/applications/video/linuxstopmotion/default.nix

@@ -1,28 +0,0 @@
-{ mkDerivation, lib, fetchgit, pkg-config, qmake, qtbase, qttools, qtmultimedia, libvorbis, libtar, libxml2 }:
-
-mkDerivation rec {
-  version = "0.8.5";
-  pname = "linuxstopmotion";
-
-  src = fetchgit {
-    url = "https://git.code.sf.net/p/linuxstopmotion/code";
-    rev = version;
-    sha256 = "1612lkwsfzc59wvdj2zbj5cwsyw66bwn31jrzjrxvygxdh4ab069";
-  };
-
-  nativeBuildInputs = [ qmake pkg-config ];
-  buildInputs = [ qtbase qttools qtmultimedia libvorbis libtar libxml2 ];
-
-  postPatch = ''
-    substituteInPlace stopmotion.pro --replace '$$[QT_INSTALL_BINS]' '${lib.getDev qttools}/bin'
-  '';
-
-  meta = with lib; {
-    description = "Create stop-motion animation movies";
-    homepage = "http://linuxstopmotion.org/";
-    license = licenses.gpl2Plus;
-    platforms = platforms.linux;
-    maintainers = [ maintainers.bjornfor ];
-    mainProgram = "stopmotion";
-  };
-}

pkgs/applications/virtualization/crun/default.nix

@@ -39,13 +39,13 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "crun";
-  version = "1.18";
+  version = "1.18.2";
 
   src = fetchFromGitHub {
     owner = "containers";
     repo = pname;
     rev = version;
-    hash = "sha256-t04jmLfkxZhvlfW79s8G7cc4W9ptFUQsD2a4/VODAC8=";
+    hash = "sha256-v/ZYy4aPsE7couVHSM4VFXPhn48cZK1odDK3r9yYprc=";
     fetchSubmodules = true;
   };
 

pkgs/build-support/node/build-npm-package/default.nix

@@ -13,6 +13,7 @@
 , prePatch ? ""
 , patches ? [ ]
 , postPatch ? ""
+, patchFlags ? []
 , nativeBuildInputs ? [ ]
 , buildInputs ? [ ]
   # The output hash of the dependencies for this project.
@@ -45,7 +46,7 @@
 , npmWorkspace ? null
 , nodejs ? topLevelArgs.nodejs
 , npmDeps ?  fetchNpmDeps {
-  inherit forceGitDeps forceEmptyCache src srcs sourceRoot prePatch patches postPatch;
+  inherit forceGitDeps forceEmptyCache src srcs sourceRoot prePatch patches postPatch patchFlags;
   name = "${name}-npm-deps";
   hash = npmDepsHash;
 }

pkgs/by-name/ac/aces-container/package.nix

@@ -20,6 +20,8 @@ stdenv.mkDerivation (finalAttrs: {
     cmake
   ];
 
+  env.NIX_CFLAGS_COMPILE = lib.optionalString stdenv.cc.isClang "-Wno-c++11-narrowing";
+
   meta = {
     description = "Reference Implementation of SMPTE ST2065-4";
     homepage = "https://github.com/ampas/aces_container";

pkgs/by-name/al/alsa-plugins/package.nix

@@ -1,4 +1,15 @@
-{ stdenv, fetchurl, lib, pkg-config, alsa-lib, libogg, libpulseaudio ? null, libjack2 ? null }:
+{
+  stdenv,
+  fetchurl,
+  lib,
+  pkg-config,
+  alsa-lib,
+  ffmpeg,
+  libjack2,
+  libogg,
+  libpulseaudio,
+  speexdsp,
+}:
 
 stdenv.mkDerivation rec {
   pname = "alsa-plugins";
@@ -11,11 +22,14 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ pkg-config ];
 
-  # ToDo: a52, etc.?
-  buildInputs =
-    [ alsa-lib libogg ]
-    ++ lib.optional (libpulseaudio != null) libpulseaudio
-    ++ lib.optional (libjack2 != null) libjack2;
+  buildInputs = [
+    alsa-lib
+    ffmpeg
+    libjack2
+    libogg
+    libpulseaudio
+    speexdsp
+  ];
 
   meta = with lib; {
     description = "Various plugins for ALSA";

pkgs/by-name/as/asleap/package.nix

@@ -1,27 +1,43 @@
-{lib, stdenv, fetchFromGitHub, openssl, libpcap, libxcrypt}:
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  openssl,
+  libpcap,
+  libxcrypt,
+}:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation {
   pname = "asleap";
   version = "unstable-2021-06-20";
 
   src = fetchFromGitHub {
     owner = "zackw";
-    repo = pname;
+    repo = "asleap";
     rev = "eb3bd42098cba42b65f499c9d8c73d890861b94f";
     sha256 = "sha256-S6jS0cg9tHSfmP6VHyISkXJxczhPx3HDdxT46c+YmE8=";
   };
 
-  buildInputs = [ openssl libpcap libxcrypt ];
+  buildInputs = [
+    openssl
+    libpcap
+    libxcrypt
+  ];
 
   installPhase = ''
+    runHook preInstall
+
     install -Dm755 asleap $out/bin/asleap
     install -Dm755 genkeys $out/bin/genkeys
+
+    runHook postInstall
   '';
 
-  meta = with lib; {
+  meta = {
     homepage = "https://github.com/zackw/asleap";
     description = "Recovers weak LEAP and PPTP passwords";
-    license = licenses.gpl2Only;
-    maintainers = with maintainers; [ pyrox0 ];
+    license = lib.licenses.gpl2Only;
+    maintainers = with lib.maintainers; [ pyrox0 ];
+    platforms = lib.platforms.linux;
   };
 }

pkgs/by-name/at/atkinson-monolegible/package.nix

@@ -0,0 +1,31 @@
+{
+  lib,
+  stdenvNoCC,
+  fetchFromGitHub,
+}:
+
+stdenvNoCC.mkDerivation {
+  pname = "atkinson-monolegible";
+  version = "0-unstable-2023-02-27";
+
+  src = fetchFromGitHub {
+    owner = "Hylian";
+    repo = "atkinson-monolegible";
+    rev = "4d0e404118dece699ca926c310588316bfcd5ac2";
+    hash = "sha256-U09ysphpDjXG/OwPxQDUiLHAYHGfiY+lL4+QIQLPj74=";
+  };
+
+  installPhase = ''
+    runHook preInstall
+    install -Dm644 AtkinsonMonolegible.ttf -t $out/share/fonts/truetype
+    runHook postInstall
+  '';
+
+  meta = {
+    homepage = "https://github.com/Hylian/atkinson-monolegible";
+    description = "Mono variant of the Atkinson Hyperlegible typeface";
+    license = lib.licenses.ofl;
+    platforms = lib.platforms.all;
+    maintainers = with lib.maintainers; [ Gliczy ];
+  };
+}

pkgs/by-name/at/atlauncher/deps.json

@@ -475,6 +475,39 @@
    "jar": "sha256-X08MQDHkuDyzae8A9JCc229isR49JT+DphhNgMXrMVc=",
    "pom": "sha256-jcFqM2Rg2Fc4wPw+JKyUwGNwmwHZFYOOBV/PaAFgXV0="
   },
+  "com/twelvemonkeys#twelvemonkeys/3.12.0": {
+   "pom": "sha256-ttCYdPvd2bslDReBepMe+OCTvBjnQob/BrBAVBmAxzA="
+  },
+  "com/twelvemonkeys/common#common-image/3.12.0": {
+   "jar": "sha256-YqOCHHJPrf2jRsHi2DsMUGoMQHS+JppSv04xksfdkrw=",
+   "pom": "sha256-Mvxj0YSlsUAz7Z6uKPTH91cL6IUMZ+80q1DIpb3qlX8="
+  },
+  "com/twelvemonkeys/common#common-io/3.12.0": {
+   "jar": "sha256-v6z+sCrKxH2/0fqwAC6uymVUfQQklJi2VDIMng/fZkc=",
+   "pom": "sha256-X7G3pgrtAmv+FsK7u0MDlUfe3Q1OYT6AEnuTtKLFY1k="
+  },
+  "com/twelvemonkeys/common#common-lang/3.12.0": {
+   "jar": "sha256-XGXlBLW2TYBoPg+nCh3RVN2D1N59o38h6VD1qcA7xm0=",
+   "pom": "sha256-nFFSKc9KTl73IdpjR/+hm5wCetXeEHmQWUBdf6MtjVI="
+  },
+  "com/twelvemonkeys/common#common/3.12.0": {
+   "pom": "sha256-2prJlYu3TvpH0EAuhjHAw4djh0qVMDcP9X8HMTLJVv8="
+  },
+  "com/twelvemonkeys/imageio#imageio-core/3.12.0": {
+   "jar": "sha256-NMb5G/OyF+0BFbzoKDI4+9AmRWKqaCtCJqOWDQ7emBU=",
+   "pom": "sha256-N9att80pHm9n9inza8bpGiV6VFjj7lgf7BJ/aZIYG3g="
+  },
+  "com/twelvemonkeys/imageio#imageio-metadata/3.12.0": {
+   "jar": "sha256-eX0Ca2fQfm1esAoatTpVrKq2+Apxxe4yVXIJPrkMDKo=",
+   "pom": "sha256-kIUqjzz4kZBqjShwC8/EQ/EZd1iEbm7lZR1pHBNCrpw="
+  },
+  "com/twelvemonkeys/imageio#imageio-webp/3.12.0": {
+   "jar": "sha256-Q9xEfM/jTFxcb10xGQJw4fm/ZfYDddaXriqP9DNGhSY=",
+   "pom": "sha256-YciGwb7ZmY5w46JD9w11sWV7CIAgf+FdOgbEh7LhQfg="
+  },
+  "com/twelvemonkeys/imageio#imageio/3.12.0": {
+   "pom": "sha256-ZI62q9rpluXh0kjqy1Gk3LYD4uwnHK6Mjh8PnLpK+Pk="
+  },
   "commons-beanutils#commons-beanutils/1.9.4": {
    "jar": "sha256-fZOMgXiQKARcCMBl6UvnX8KAUnYg1b1itRnVg4UyNoo=",
    "pom": "sha256-w1zKe2HUZ42VeMvAuQG4cXtTmr+SVEQdp4uP5g3gZNA="

pkgs/by-name/at/atlauncher/package.nix

@@ -21,13 +21,13 @@
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "atlauncher";
-  version = "3.4.37.3";
+  version = "3.4.37.4";
 
   src = fetchFromGitHub {
     owner = "ATLauncher";
     repo = "ATLauncher";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-XdTbrM7FPR0o0d+p4ko48UonMsY+nLfiXj5fP2a3/zI=";
+    hash = "sha256-3Rs6XtqhD9PKz8ekF0STaANvPQ73KSUS8GIPvn9DmbQ=";
   };
 
   postPatch = ''

pkgs/by-name/at/ats2/package.nix

@@ -1,6 +1,11 @@
-{ lib, stdenv, fetchurl, gmp
-, withEmacsSupport ? true
-, withContrib ? true }:
+{
+  lib,
+  stdenv,
+  fetchurl,
+  gmp,
+  withEmacsSupport ? true,
+  withContrib ? true,
+}:
 
 let
   versionPkg = "0.4.2";
@@ -10,15 +15,13 @@ let
     hash = "sha256-m0hfBLsaNiLaIktcioK+ZtWUsWht3IDSJ6CzgJmS06c=";
   };
 
-  postInstallContrib = lib.optionalString withContrib
-  ''
+  postInstallContrib = lib.optionalString withContrib ''
     local contribDir=$out/lib/ats2-postiats-*/ ;
     mkdir -p $contribDir ;
     tar -xzf "${contrib}" --strip-components 1 -C $contribDir ;
   '';
 
-  postInstallEmacs = lib.optionalString withEmacsSupport
-  ''
+  postInstallEmacs = lib.optionalString withEmacsSupport ''
     local siteLispDir=$out/share/emacs/site-lisp/ats2 ;
     mkdir -p $siteLispDir ;
     install -m 0644 -v ./utils/emacs/*.el $siteLispDir ;
@@ -49,20 +52,25 @@ stdenv.mkDerivation rec {
     "CCOMP=${stdenv.cc.targetPrefix}cc"
   ];
 
+  env.NIX_CFLAGS_COMPILE = lib.optionalString stdenv.cc.isClang "-Wno-error=implicit-function-declaration";
+
   setupHook =
     let
       hookFiles = [ ./setup-hook.sh ] ++ lib.optional withContrib ./setup-contrib-hook.sh;
     in
-      builtins.toFile "setupHook.sh"
-      (lib.concatMapStringsSep "\n" builtins.readFile hookFiles);
+    builtins.toFile "setupHook.sh" (lib.concatMapStringsSep "\n" builtins.readFile hookFiles);
 
   postInstall = postInstallContrib + postInstallEmacs;
 
   meta = with lib; {
     description = "Functional programming language with dependent types";
-    homepage    = "http://www.ats-lang.org";
-    license     = licenses.gpl3Plus;
-    platforms   = platforms.unix;
-    maintainers = with maintainers; [ thoughtpolice ttuegel bbarker ];
+    homepage = "http://www.ats-lang.org";
+    license = licenses.gpl3Plus;
+    platforms = platforms.unix;
+    maintainers = with maintainers; [
+      thoughtpolice
+      ttuegel
+      bbarker
+    ];
   };
 }

pkgs/by-name/aw/aws-assume-role/0001-add-go.mod-go.sum.patch

@@ -0,0 +1,53 @@
+From 7eff498538c201cabae769e20715282a1aab2266 Mon Sep 17 00:00:00 2001
+From: wxt <3264117476@qq.com>
+Date: Mon, 4 Nov 2024 21:25:33 +0800
+Subject: [PATCH] add go.mod & go.sum
+
+---
+ go.mod | 10 ++++++++++
+ go.sum | 16 ++++++++++++++++
+ 2 files changed, 26 insertions(+)
+ create mode 100644 go.mod
+ create mode 100644 go.sum
+
+diff --git a/go.mod b/go.mod
+new file mode 100644
+index 0000000..5d3a1fa
+--- /dev/null
++++ b/go.mod
+@@ -0,0 +1,10 @@
++module github.com/remind101/assume-role
++
++go 1.23.2
++
++require (
++	github.com/aws/aws-sdk-go v1.55.5
++	gopkg.in/yaml.v2 v2.4.0
++)
++
++require github.com/jmespath/go-jmespath v0.4.0 // indirect
+diff --git a/go.sum b/go.sum
+new file mode 100644
+index 0000000..b35ff93
+--- /dev/null
++++ b/go.sum
+@@ -0,0 +1,16 @@
++github.com/aws/aws-sdk-go v1.55.5 h1:KKUZBfBoyqy5d3swXyiC7Q76ic40rYcbqH7qjh59kzU=
++github.com/aws/aws-sdk-go v1.55.5/go.mod h1:eRwEWoyTWFMVYVQzKMNHWP5/RV4xIUGMQfXQHfHkpNU=
++github.com/davecgh/go-spew v1.1.0 h1:ZDRjVQ15GmhC3fiQ8ni8+OwkZQO4DARzQgrnXU1Liz8=
++github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
++github.com/jmespath/go-jmespath v0.4.0 h1:BEgLn5cpjn8UN1mAw4NjwDrS35OdebyEtFe+9YPoQUg=
++github.com/jmespath/go-jmespath v0.4.0/go.mod h1:T8mJZnbsbmF+m6zOOFylbeCJqk5+pHWvzYPziyZiYoo=
++github.com/jmespath/go-jmespath/internal/testify v1.5.1 h1:shLQSRRSCCPj3f2gpwzGwWFoC7ycTf1rcQZHOlsJ6N8=
++github.com/jmespath/go-jmespath/internal/testify v1.5.1/go.mod h1:L3OGu8Wl2/fWfCI6z80xFu9LTZmf1ZRjMHUOPmWr69U=
++github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
++github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
++github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
++gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405 h1:yhCVgyC4o1eVCa2tZl7eS0r+SDo693bJlVdllGtEeKM=
++gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
++gopkg.in/yaml.v2 v2.2.8/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
++gopkg.in/yaml.v2 v2.4.0 h1:D8xgwECY7CYvx+Y2n4sBz93Jn9JRvxdiyyo8CTfuKaY=
++gopkg.in/yaml.v2 v2.4.0/go.mod h1:RDklbk79AGWmwhnvt/jBztapEOGDOx6ZbXqjP6csGnQ=
+-- 
+2.46.1
+

pkgs/by-name/aw/aws-assume-role/package.nix

@@ -1,13 +1,17 @@
-{ lib
-, fetchFromGitHub
-, buildGoModule
+{
+  lib,
+  fetchFromGitHub,
+  buildGoModule,
 }:
 
 buildGoModule rec {
   pname = "aws-assume-role";
   version = "0.3.2";
 
-  outputs = [ "out" "doc" ];
+  outputs = [
+    "out"
+    "doc"
+  ];
 
   src = fetchFromGitHub {
     owner = "remind101";
@@ -16,11 +20,14 @@ buildGoModule rec {
     sha256 = "sha256-7+9qi9lYzv1YCFhUyla+5Gqs5nBUiiazhFwiqHzMFd4=";
   };
 
-  vendorHash = null;
+  deleteVendor = true;
 
-  postPatch = ''
-    go mod init github.com/remind101/assume-role
-  '';
+  vendorHash = "sha256-NIY6w/hQQ357KHEDEHUYVLbkQKsm8FLtRf3/AbbgukA=";
+
+  patches = [
+    # Generate with go mod init github.com/remind101/assume-role && go mod tidy
+    ./0001-add-go.mod-go.sum.patch
+  ];
 
   postInstall = ''
     install -Dm444 -t $out/share/doc/aws-assume-role README.md

pkgs/by-name/ba/bacon/package.nix

@@ -10,16 +10,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "bacon";
-  version = "3.0.0";
+  version = "3.2.0";
 
   src = fetchFromGitHub {
     owner = "Canop";
     repo = "bacon";
     rev = "refs/tags/v${version}";
-    hash = "sha256-fSlakjZbY8jrFkCqVxPr3UKwf1Oq4yPhLmVbzsksSeg=";
+    hash = "sha256-WbTxy8ijXez1x2G7NGGVMcyjgE7J7MDsGgGRpb4jKXQ=";
   };
 
-  cargoHash = "sha256-WT0uXmchhapss3AU4+e2wA3nBVjzikfRNRyAvQnpJfY=";
+  cargoHash = "sha256-rlWNrkzUDs3rbQ5ZV4fKU/EKEy4fVbxEP0+wNwXi7Ag=";
 
   buildInputs = lib.optionals stdenv.hostPlatform.isDarwin [
     darwin.apple_sdk.frameworks.CoreServices

pkgs/by-name/ba/bant/package.nix

@@ -5,6 +5,7 @@
   fetchFromGitHub,
   bazel_6,
   jdk,
+  nix-update-script,
 }:
 
 let
@@ -18,13 +19,13 @@ let
 in
 buildBazelPackage rec {
   pname = "bant";
-  version = "0.1.7";
+  version = "0.1.8";
 
   src = fetchFromGitHub {
     owner = "hzeller";
     repo = "bant";
     rev = "v${version}";
-    hash = "sha256-QbxPosjlrpxbz6gQKUKccF2Gu/i5xvqh2gwfABYE8kE=";
+    hash = "sha256-CMqh2v6Y/jvrDC2M4Q+pC0FkNJ95gbGTR1UC6zviwV4=";
   };
 
   bazelFlags = [
@@ -39,8 +40,8 @@ buildBazelPackage rec {
   fetchAttrs = {
     hash =
       {
-        aarch64-linux = "sha256-LNca4h4yceSgve9GYUoXqlODKPjLAa71kh1BWXqRYtk=";
-        x86_64-linux = "sha256-bRFIfaVbsU2WroXR/i0E7J4rWeaNEoum93r8qOMXXvc=";
+        aarch64-linux = "sha256-K+uGH3ox49taSPZ1aLYPrOLNRO3aLQeOSdrkmTC444U=";
+        x86_64-linux = "sha256-yNwD3n7exyG5LbhR2GuKIvoul6UQnyk3+8pLpnDzjFw=";
       }
       .${system} or (throw "No hash for system: ${system}");
   };
@@ -60,14 +61,16 @@ buildBazelPackage rec {
     '';
   };
 
-  meta = with lib; {
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
     description = "Bazel/Build Analysis and Navigation Tool";
     homepage = "http://bant.build/";
-    license = licenses.gpl2Only;
-    maintainers = with maintainers; [
+    license = lib.licenses.gpl2Only;
+    maintainers = with lib.maintainers; [
       hzeller
       lromor
     ];
-    platforms = platforms.linux;
+    platforms = lib.platforms.linux;
   };
 }

pkgs/by-name/ba/bat/package.nix

@@ -7,7 +7,7 @@
 , libiconv
 , installShellFiles
 , makeWrapper
-, darwin
+, apple-sdk_11
 }:
 
 rustPlatform.buildRustPackage rec {
@@ -24,7 +24,7 @@ rustPlatform.buildRustPackage rec {
 
   nativeBuildInputs = [ pkg-config installShellFiles makeWrapper ];
 
-  buildInputs = lib.optionals stdenv.hostPlatform.isDarwin [ libiconv darwin.apple_sdk.frameworks.Security ];
+  buildInputs = lib.optionals stdenv.hostPlatform.isDarwin [ libiconv apple-sdk_11 ];
 
   postInstall = ''
     installManPage $releaseDir/build/bat-*/out/assets/manual/bat.1

pkgs/by-name/be/berry/package.nix

@@ -1,16 +1,17 @@
-{ lib
-, stdenv
-, fetchFromGitHub
-, copyDesktopItems
-, fontconfig
-, freetype
-, libX11
-, libXext
-, libXft
-, libXinerama
-, makeDesktopItem
-, pkg-config
-, which
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  copyDesktopItems,
+  fontconfig,
+  freetype,
+  libX11,
+  libXext,
+  libXft,
+  libXinerama,
+  makeDesktopItem,
+  pkg-config,
+  which,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
@@ -30,7 +31,7 @@ stdenv.mkDerivation (finalAttrs: {
     which
   ];
 
-  buildInputs =[
+  buildInputs = [
     libX11
     libXext
     libXft
@@ -39,7 +40,10 @@ stdenv.mkDerivation (finalAttrs: {
     freetype
   ];
 
-  outputs = [ "out" "man" ];
+  outputs = [
+    "out"
+    "man"
+  ];
 
   strictDeps = true;
 
@@ -51,6 +55,8 @@ stdenv.mkDerivation (finalAttrs: {
     patchShebangs configure
   '';
 
+  env.NIX_CFLAGS_COMPILE = lib.optionalString stdenv.hostPlatform.isDarwin "-D_C99_SOURCE";
+
   desktopItems = [
     (makeDesktopItem {
       name = "berry";

pkgs/by-name/bl/blueutil/package.nix

@@ -2,14 +2,10 @@
   lib,
   stdenv,
   fetchFromGitHub,
-  darwin,
   testers,
   nix-update-script,
 }:
 
-let
-  inherit (darwin.apple_sdk.frameworks) Foundation IOBluetooth;
-in
 stdenv.mkDerivation (finalAttrs: {
   pname = "blueutil";
   version = "2.10.0";
@@ -21,11 +17,6 @@ stdenv.mkDerivation (finalAttrs: {
     hash = "sha256-x2khx8Y0PolpMiyrBatT2aHHyacrQVU/02Z4Dz9fBtI=";
   };
 
-  buildInputs = [
-    Foundation
-    IOBluetooth
-  ];
-
   env.NIX_CFLAGS_COMPILE = "-Wall -Wextra -Werror -mmacosx-version-min=10.9 -framework Foundation -framework IOBluetooth";
 
   installPhase = ''

pkgs/by-name/br/bruno/package.nix

@@ -14,17 +14,10 @@
   cairo,
   pango,
   npm-lockfile-fix,
-  overrideSDK,
-  darwin,
+  apple-sdk_11,
 }:
 
-let
-  # fix for: https://github.com/NixOS/nixpkgs/issues/272156
-  buildNpmPackage' = buildNpmPackage.override {
-    stdenv = if stdenv.hostPlatform.isDarwin then overrideSDK stdenv "11.0" else stdenv;
-  };
-in
-buildNpmPackage' rec {
+buildNpmPackage rec {
   pname = "bruno";
   version = "1.34.0";
 
@@ -59,7 +52,8 @@ buildNpmPackage' rec {
       pango
     ]
     ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      darwin.apple_sdk_11_0.frameworks.CoreText
+      # fix for: https://github.com/NixOS/nixpkgs/issues/272156
+      apple-sdk_11
     ];
 
   desktopItems = [

pkgs/by-name/bu/buffer/package.nix

@@ -16,14 +16,14 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "buffer";
-  version = "0.9.5";
+  version = "0.9.7";
 
   src = fetchFromGitLab {
     domain = "gitlab.gnome.org";
     owner = "cheywood";
     repo = "buffer";
     rev = finalAttrs.version;
-    hash = "sha256-WhUSiZ2Nty5CdaJC8zZVkUptP5cRnMByZKy3e9TAyjs=";
+    hash = "sha256-W6LTTQvIMAB99q2W11EBlBknJnOuv4ptgf5SSM422Cg=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/cb/cbconvert/gui.nix

@@ -0,0 +1,48 @@
+{
+  buildGoModule,
+  cbconvert,
+  gtk3,
+  wrapGAppsHook3,
+}:
+
+buildGoModule rec {
+  pname = "cbconvert-gui";
+
+  inherit (cbconvert)
+    patches
+    proxyVendor
+    src
+    tags
+    version
+    ;
+
+  nativeBuildInputs = cbconvert.nativeBuildInputs ++ [
+    wrapGAppsHook3
+  ];
+  buildInputs = cbconvert.buildInputs ++ [ gtk3 ];
+
+  vendorHash = "sha256-vvCvKecPszhNCQdgm3mQMb5+486BGZ9sz3R0b70eLeQ=";
+  modRoot = "cmd/cbconvert-gui";
+
+  ldflags = [
+    "-s"
+    "-w"
+    "-X main.appVersion=${version}"
+  ];
+
+  postInstall = ''
+    install -D --mode=0644 --target-directory=$out/share/applications/ dist/linux/cbconvert.desktop
+    install -D --mode=0644 --target-directory=$out/icons/hicolor/256x256/apps dist/linux/cbconvert.png
+    install -D --mode=0644 --target-directory=$out/share/thumbnailers dist/linux/cbconvert.thumbnailer
+    install -D --mode=0644 dist/linux/flatpak/io.github.gen2brain.cbconvert.metainfo.xml $out/share/metainfo/cbconvert.metainfo.xml
+  '';
+
+  postFixup = ''
+    substituteInPlace $out/share/metainfo/cbconvert.metainfo.xml \
+      --replace-fail "io.github.gen2brain.cbconvert" "cbconvert"
+  '';
+
+  meta = cbconvert.meta // {
+    mainProgram = "cbconvert-gui";
+  };
+}

pkgs/by-name/cb/cbconvert/package.nix

@@ -0,0 +1,87 @@
+{
+  buildGoModule,
+  bzip2,
+  callPackage,
+  cbconvert,
+  fetchFromGitHub,
+  fetchpatch2,
+  imagemagick,
+  lib,
+  libunarr,
+  mupdf-headless,
+  nix-update-script,
+  pkg-config,
+  testers,
+  zlib,
+}:
+
+buildGoModule rec {
+  pname = "cbconvert";
+  version = "1.0.4";
+
+  src = fetchFromGitHub {
+    owner = "gen2brain";
+    repo = "cbconvert";
+    rev = "v${version}";
+    hash = "sha256-9x7RXyiQoV2nIVFnG1XHcYfTQiMZ88Ck7uuY7NLK8CA=";
+  };
+
+  # Update dependencies in order to use the extlib tag.
+  patches = [
+    (fetchpatch2 {
+      name = "update-dependencies-1.patch";
+      url = "https://github.com/gen2brain/cbconvert/commit/1a36ec17b2c012f278492d60d469b8e8457a6110.patch";
+      hash = "sha256-E+HWYPz9FtU3JAktzIRflF/pHdLfoaciBmjb7UOQYLo=";
+    })
+    (fetchpatch2 {
+      name = "update-dependencies-2.patch";
+      url = "https://github.com/gen2brain/cbconvert/commit/74c5de699413e95133f97666b64a1866f88fedd5.patch";
+      hash = "sha256-rrJsYJHcfNWF90vwUAT3J/gqg22e1gk6I48LsTrYbmU=";
+    })
+  ];
+
+  vendorHash = "sha256-aVInsWvygNH+/h7uQs4hAPOO2gsSkBx+tI+TK77M/hg=";
+  modRoot = "cmd/cbconvert";
+
+  proxyVendor = true;
+
+  # The extlib tag forces the github.com/gen2brain/go-unarr module to use external libraries instead of bundled ones.
+  tags = [ "extlib" ];
+
+  ldflags = [
+    "-s"
+    "-w"
+    "-X main.appVersion=${version}"
+  ];
+
+  nativeBuildInputs = [
+    pkg-config
+  ];
+
+  buildInputs = [
+    bzip2
+    imagemagick
+    libunarr
+    mupdf-headless
+    zlib
+  ];
+
+  passthru = {
+    gui = callPackage ./gui.nix { };
+    updateScript = nix-update-script { };
+    tests.version = testers.testVersion {
+      package = cbconvert;
+      command = "cbconvert version";
+    };
+  };
+
+  meta = {
+    description = "Comic Book converter";
+    homepage = "https://github.com/gen2brain/cbconvert";
+    changelog = "https://github.com/gen2brain/cbconvert/releases/tag/v${version}";
+    license = with lib.licenses; [ gpl3Only ];
+    platforms = lib.platforms.linux;
+    maintainers = with lib.maintainers; [ jwillikers ];
+    mainProgram = "cbconvert";
+  };
+}

pkgs/by-name/cl/clairvoyant/package.nix

@@ -13,13 +13,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "clairvoyant";
-  version = "3.1.7";
+  version = "3.1.8";
 
   src = fetchFromGitHub {
     owner = "cassidyjames";
     repo = "clairvoyant";
     rev = finalAttrs.version;
-    hash = "sha256-p9Lgs5z5oRuMQYRKzWp+aQDi0FnxvbQGLZpBigolHUw=";
+    hash = "sha256-SksJ0hOt2CJwrQj4dz63D53GM/PYx7Q/g+OgCo76dIE=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/cl/clps2c-compiler/deps.nix

@@ -0,0 +1,11 @@
+# This file was automatically generated by passthru.fetch-deps.
+# Please dont edit it manually, your changes might get overwritten!
+
+{ fetchNuGet }:
+[
+  (fetchNuGet {
+    pname = "CommandLineParser";
+    version = "2.9.1";
+    hash = "sha256-ApU9y1yX60daSjPk3KYDBeJ7XZByKW8hse9NRZGcjeo=";
+  })
+]

pkgs/by-name/cl/clps2c-compiler/package.nix

@@ -0,0 +1,75 @@
+{
+  keystone,
+  fetchFromGitHub,
+  buildDotnetModule,
+  dotnetCorePackages,
+  lib,
+}:
+let
+  version = "1.0.1";
+  pname = "CLPS2C-Compiler";
+  owner = "NiV-L-A";
+  keystone-rev = "MIPS-0.9.2";
+  keystone-sha256 = "sha256-xLkO06ZgnmAavJMP1kjDwXT1hc5eSDXv+4MUkOz6xeo=";
+  keystone-src = (
+    fetchFromGitHub {
+      name = "keystone";
+      inherit owner;
+      repo = "keystone";
+      rev = keystone-rev;
+      sha256 = keystone-sha256;
+    }
+  );
+  keystone-override = keystone.overrideAttrs (old: {
+    src = keystone-src;
+  });
+in
+buildDotnetModule rec {
+  inherit version pname;
+
+  srcs = [
+    (fetchFromGitHub {
+      name = pname;
+      inherit owner;
+      repo = pname;
+      rev = "CLPS2C-Compiler-${version}";
+      sha256 = "sha256-4gLdrIxyw9BFSxF+EXZqTgUf9Kik6oK7eO9HBUzk4QM=";
+    })
+    keystone-src
+  ];
+
+  sourceRoot = ".";
+
+  patches = [
+    ./patches/dont_trim_leading_newline.patch
+    ./patches/build_fixes.patch
+    ./patches/remove_platformtarget.patch
+    ./patches/use_compiled_keystone.patch
+    ./patches/set_langversion.patch
+    ./patches/set_runtimeidentifiers.patch
+    ./patches/keystone_set_targetframework.patch
+  ];
+
+  dotnet-sdk = dotnetCorePackages.sdk_8_0;
+  dotnet-runtime = dotnetCorePackages.runtime_8_0;
+
+  dotnetFlags = [
+    "-p:TargetFramework=net8.0"
+  ];
+
+  nugetDeps = ./deps.nix;
+
+  runtimeDeps = [
+    keystone-override
+  ];
+
+  projectFile = "CLPS2C-Compiler/CLPS2C-Compiler/CLPS2C-Compiler.csproj";
+
+  meta = {
+    homepage = "https://github.com/NiV-L-A/CLPS2C-Compiler";
+    description = "Compiler for CLPS2C, a domain-specific language built specifically for writing PS2 cheat codes";
+    mainProgram = "CLPS2C-Compiler";
+    maintainers = [ lib.maintainers.gigahawk ];
+    license = lib.licenses.gpl3Only;
+  };
+}

pkgs/by-name/cl/clps2c-compiler/patches/build_fixes.patch

@@ -0,0 +1,193 @@
+diff --git a/CLPS2C-Compiler/Program.cs b/CLPS2C-Compiler/Program.cs
+index 6991896..a086433 100644
+--- a/CLPS2C-Compiler/CLPS2C-Compiler/Program.cs
++++ b/CLPS2C-Compiler/CLPS2C-Compiler/Program.cs
+@@ -1166,7 +1166,7 @@ namespace CLPS2C_Compiler
+                 string Value_1 = "";
+                 string Value_2 = "";
+                 // Handle a bit differently in case there's a label at the start
+-                if (command.Type.EndsWith(':'))
++                if (command.Type.EndsWith(":"))
+                 {
+                     OpCode = command.Data[0].ToUpper();
+                     Register = command.Data[1];
+@@ -1201,7 +1201,7 @@ namespace CLPS2C_Compiler
+                     }
+
+                     Output = $"lui {Register},0x{Value_1}; {OpCode} {Register},{Value_2}({Register})";
+-                    if (command.Type.EndsWith(':'))
++                    if (command.Type.EndsWith(":"))
+                     {
+                         Output = $"{command.FullLine.Substring(0, command.FullLine.IndexOf(':'))}: {Output}";
+                     }
+@@ -1589,7 +1589,7 @@ namespace CLPS2C_Compiler
+
+             while (IfIndex != -1)
+             {
+-                int ExtraIfCount = commands[IfIndex].FullLine.Split("&&", StringSplitOptions.None).Length - 1;
++                int ExtraIfCount = commands[IfIndex].FullLine.Split(new string[] { "&&" }, StringSplitOptions.None).Length - 1;
+                 for (int i = 0; i < ExtraIfCount; i++)
+                 {
+                     // Add more IF commands
+@@ -1807,7 +1807,7 @@ namespace CLPS2C_Compiler
+                 for (int j = 0; j < commands[i].Data.Count; j++)
+                 {
+                     string Target = commands[i].Data[j];
+-                    if (Target.StartsWith('+') || Target.StartsWith(','))
++                    if (Target.StartsWith("+") || Target.StartsWith(","))
+                     {
+                         Target = Target.Substring(1).TrimStart();
+                     }
+@@ -1815,14 +1815,14 @@ namespace CLPS2C_Compiler
+                     if (IsVarDeclared(Target, listSets))
+                     {
+                         List<string> ListValues = GetSetValueFromTarget(Target, commands[i].ID, listSets);
+-                        if (commands[i].Data[j].StartsWith('+') || commands[i].Data[j].StartsWith(','))
++                        if (commands[i].Data[j].StartsWith("+") || commands[i].Data[j].StartsWith(","))
+                         {
+                             ListValues[0] = commands[i].Data[j][0] + ListValues[0];
+                         }
+
+                         for (int k = 1; k < ListValues.Count; k++)
+                         {
+-                            if (ListValues[k].StartsWith('+') || ListValues[k].StartsWith(','))
++                            if (ListValues[k].StartsWith("+") || ListValues[k].StartsWith(","))
+                             {
+                                 ListValues[k] = ListValues[k][0] + ListValues[k].Substring(1).TrimStart();
+                             }
+@@ -1834,7 +1834,7 @@ namespace CLPS2C_Compiler
+                         continue;
+                     }
+
+-                    if (commands[i].Data[j].StartsWith('+') || commands[i].Data[j].StartsWith(','))
++                    if (commands[i].Data[j].StartsWith("+") || commands[i].Data[j].StartsWith(","))
+                     {
+                         commands[i].Data[j] = commands[i].Data[j][0] + Target;
+                     }
+@@ -1912,7 +1912,7 @@ namespace CLPS2C_Compiler
+
+             for (i = i + 1; i < command.Data.Count; i++)
+             {
+-                if (!command.Data[i].StartsWith('+'))
++                if (!command.Data[i].StartsWith("+"))
+                 {
+                     break;
+                 }
+@@ -1940,12 +1940,12 @@ namespace CLPS2C_Compiler
+
+             for (i = i + 1; i < command.Data.Count; i++)
+             {
+-                if (command.Data[i].StartsWith(','))
++                if (command.Data[i].StartsWith(","))
+                 {
+                     ListOffs.Add(TmpAddress.ToString("X8"));
+                     TmpAddress = 0;
+                 }
+-                else if (!command.Data[i].StartsWith('+'))
++                else if (!command.Data[i].StartsWith("+"))
+                 {
+                     ListOffs.Add(TmpAddress.ToString("X8"));
+                     TmpAddress = 0;
+@@ -1980,7 +1980,7 @@ namespace CLPS2C_Compiler
+
+             for (i = i + 1; i < command.Data.Count; i++)
+             {
+-                if (!command.Data[i].StartsWith('+'))
++                if (!command.Data[i].StartsWith("+"))
+                 {
+                     break;
+                 }
+@@ -2008,7 +2008,7 @@ namespace CLPS2C_Compiler
+
+             for (i = i + 1; i < command.Data.Count; i++)
+             {
+-                if (!command.Data[i].StartsWith('+'))
++                if (!command.Data[i].StartsWith("+"))
+                 {
+                     break;
+                 }
+@@ -2040,7 +2040,7 @@ namespace CLPS2C_Compiler
+         {
+             string Value = "";
+             uint Sum = 0;
+-            if (command.Data[i].StartsWith('"'))
++            if (command.Data[i].StartsWith("\""))
+             {
+                 // string
+                 Value = command.Data[i];
+@@ -2059,7 +2059,7 @@ namespace CLPS2C_Compiler
+             for (i = i + 1; i < command.Data.Count; i++)
+             {
+                 string Element = command.Data[i];
+-                if (!Element.StartsWith('+') || Element == "+")
++                if (!Element.StartsWith("+") || Element == "+")
+                 {
+                     // without +, or just '+'
+                     SetError(ERROR.WRONG_SYNTAX, command);
+@@ -2072,7 +2072,7 @@ namespace CLPS2C_Compiler
+                     // string
+                     if (Sum > 0)
+                     {
+-                        if (Value.EndsWith('"'))
++                        if (Value.EndsWith("\""))
+                         {
+                             Value = Value.TrimEnd('"') + Sum.ToString() + '"';
+                         }
+@@ -2089,7 +2089,7 @@ namespace CLPS2C_Compiler
+                         return "";
+                     }
+                     string Tmp = GetSubstringInQuotes(Element, false);
+-                    if (Value.EndsWith('"'))
++                    if (Value.EndsWith("\""))
+                     {
+                         Value = Value.TrimEnd('"') + Tmp + '"';
+                     }
+@@ -2112,7 +2112,7 @@ namespace CLPS2C_Compiler
+
+             if (Sum > 0)
+             {
+-                if (Value.EndsWith('"'))
++                if (Value.EndsWith("\""))
+                 {
+                     Value = Value.TrimEnd('"') + Sum.ToString() + '"';
+                 }
+diff --git a/CLPS2C-Compiler/Util.cs b/CLPS2C-Compiler/Util.cs
+index 4560c73..7f82ae6 100644
+--- a/CLPS2C-Compiler/CLPS2C-Compiler/Util.cs
++++ b/CLPS2C-Compiler/CLPS2C-Compiler/Util.cs
+@@ -48,7 +48,7 @@ namespace CLPS2C_Compiler
+                 // ([^ \t\n\r\f\v(+,]+) - Any other word. This is \S, and '(', '+', ','
+                 MatchCollection Matches = Regex.Matches(line, @"(\(.*\))|(""(?:\\.|[^""])*""?)|(\+\s*((""(?:\\.|[^""])*""?)|([^+""]+?))?(?=\+|$| |,))|(,(""?)([^,""]+?)\8(?=,|$| |\+))|([^ \t\n\r\f\v(+,]+)");
+                 Type = Matches[0].Value.ToUpper();
+-                Data = Matches.Skip(1).Take(Matches.Count - 1).Select(item => item.Value).ToList(); // Data has every word except first
++                Data = Matches.Cast<Match>().Skip(1).Take(Matches.Count - 1).Select(item => item.Value).ToList(); // Data has every word except first
+             }
+
+             public void AppendToTraceback(string file, string fullLine, int lineIdx)
+@@ -165,7 +165,7 @@ namespace CLPS2C_Compiler
+                 else
+                 {
+                     // It's a comment, count new lines
+-                    int newLinesCount = match.Value.Split(Program._newLine).Length - 1;
++                    int newLinesCount = match.Value.Split(new string[] { Program._newLine }, StringSplitOptions.None).Length - 1;
+                     return string.Concat(Enumerable.Repeat(Program._newLine, newLinesCount));
+                 }
+             });
+@@ -486,7 +486,7 @@ namespace CLPS2C_Compiler
+             for (int i = 0; i < Output.Count; i++)
+             {
+                 string Element = Output[i];
+-                if (Element.StartsWith('+'))
++                if (Element.StartsWith("+"))
+                 {
+                     Element = Element.Substring(1).TrimStart();
+                 }
+@@ -496,7 +496,7 @@ namespace CLPS2C_Compiler
+                     List<string> RecursiveValues = GetSetValueFromTarget(Element, SetID, listSets);
+                     if (RecursiveValues.Count != 0)
+                     {
+-                        if (Output[i].StartsWith('+'))
++                        if (Output[i].StartsWith("+"))
+                         {
+                             RecursiveValues[0] = "+" + RecursiveValues[0];
+                         }

pkgs/by-name/cl/clps2c-compiler/patches/dont_trim_leading_newline.patch

@@ -0,0 +1,15 @@
+diff --git a/CLPS2C-Compiler/Program.cs b/CLPS2C-Compiler/Program.cs
+index 6991896..fe8cd5f 100644
+--- a/CLPS2C-Compiler/CLPS2C-Compiler/Program.cs
++++ b/CLPS2C-Compiler/CLPS2C-Compiler/Program.cs
+@@ -90,10 +90,6 @@ namespace CLPS2C_Compiler
+             }
+             else if (OutputLines.Count != 0)
+             {
+-                if (OutputLines[0].StartsWith(_newLine))
+-                {
+-                    OutputLines[0] = OutputLines[0].Substring(2);
+-                }
+                 Output += string.Join("", OutputLines);
+
+                 // Convert to PNACH Format

pkgs/by-name/cl/clps2c-compiler/patches/keystone_set_targetframework.patch

@@ -0,0 +1,13 @@
+diff --git a/bindings/csharp/Keystone.Net/Keystone.Net.csproj b/bindings/csharp/Keystone.Net/Keystone.Net.csproj
+index 04801b4..4c6fe15 100644
+--- a/keystone/bindings/csharp/Keystone.Net/Keystone.Net.csproj
++++ b/keystone/bindings/csharp/Keystone.Net/Keystone.Net.csproj
+@@ -1,7 +1,7 @@
+ <Project Sdk="Microsoft.NET.Sdk">
+
+   <PropertyGroup>
+-    <TargetFramework>netstandard2.0</TargetFramework>
++    <TargetFramework>net8.0</TargetFramework>
+     <RootNamespace>Keystone</RootNamespace>
+
+     <Version>1.1.0</Version>

pkgs/by-name/cl/clps2c-compiler/patches/remove_platformtarget.patch

@@ -0,0 +1,12 @@
+diff --git a/CLPS2C-Compiler/CLPS2C-Compiler.csproj b/CLPS2C-Compiler/CLPS2C-Compiler.csproj
+index 867533e..80f7923 100644
+--- a/CLPS2C-Compiler/CLPS2C-Compiler/CLPS2C-Compiler.csproj
++++ b/CLPS2C-Compiler/CLPS2C-Compiler/CLPS2C-Compiler.csproj
+@@ -6,7 +6,6 @@
+     <RootNamespace>CLPS2C_Compiler</RootNamespace>
+     <ImplicitUsings>enable</ImplicitUsings>
+     <Nullable>enable</Nullable>
+-    <PlatformTarget>x86</PlatformTarget>
+     <ApplicationIcon>256x256.ico</ApplicationIcon>
+     <Version>1.0.1</Version>
+   </PropertyGroup>

pkgs/by-name/cl/clps2c-compiler/patches/set_langversion.patch

@@ -0,0 +1,12 @@
+diff --git a/CLPS2C-Compiler/CLPS2C-Compiler.csproj b/CLPS2C-Compiler/CLPS2C-Compiler.csproj
+index 867533e..34b30a4 100644
+--- a/CLPS2C-Compiler/CLPS2C-Compiler/CLPS2C-Compiler.csproj
++++ b/CLPS2C-Compiler/CLPS2C-Compiler/CLPS2C-Compiler.csproj
+@@ -5,6 +5,7 @@
+     <TargetFramework>net8.0</TargetFramework>
+     <RootNamespace>CLPS2C_Compiler</RootNamespace>
+     <ImplicitUsings>enable</ImplicitUsings>
++    <LangVersion>10.0</LangVersion>
+     <Nullable>enable</Nullable>
+     <PlatformTarget>x86</PlatformTarget>
+     <ApplicationIcon>256x256.ico</ApplicationIcon>

pkgs/by-name/cl/clps2c-compiler/patches/set_runtimeidentifiers.patch

@@ -0,0 +1,12 @@
+diff --git a/CLPS2C-Compiler/CLPS2C-Compiler.csproj b/CLPS2C-Compiler/CLPS2C-Compiler.csproj
+index 867533e..ab44095 100644
+--- a/CLPS2C-Compiler/CLPS2C-Compiler/CLPS2C-Compiler.csproj
++++ b/CLPS2C-Compiler/CLPS2C-Compiler/CLPS2C-Compiler.csproj
+@@ -3,6 +3,7 @@
+   <PropertyGroup>
+     <OutputType>Exe</OutputType>
+     <TargetFramework>net8.0</TargetFramework>
++    <RuntimeIdentifiers>win-x86;win-x64;win-arm64;linux-x64;linux-arm64;osx-x64</RuntimeIdentifiers>
+     <RootNamespace>CLPS2C_Compiler</RootNamespace>
+     <ImplicitUsings>enable</ImplicitUsings>
+     <Nullable>enable</Nullable>

pkgs/by-name/cl/clps2c-compiler/patches/use_compiled_keystone.patch

@@ -0,0 +1,20 @@
+diff --git a/CLPS2C-Compiler/CLPS2C-Compiler.csproj b/CLPS2C-Compiler/CLPS2C-Compiler.csproj
+index 867533e..17a3aca 100644
+--- a/CLPS2C-Compiler/CLPS2C-Compiler/CLPS2C-Compiler.csproj
++++ b/CLPS2C-Compiler/CLPS2C-Compiler/CLPS2C-Compiler.csproj
+@@ -28,16 +29,7 @@
+   </ItemGroup>
+
+   <ItemGroup>
+-    <Reference Include="Keystone.Net">
+-      <HintPath>Keystone.Net.dll</HintPath>
+-      <Private>True</Private>
+-    </Reference>
+-  </ItemGroup>
+-
+-  <ItemGroup>
+-    <None Update="keystone.dll">
+-      <CopyToOutputDirectory>PreserveNewest</CopyToOutputDirectory>
+-    </None>
++    <ProjectReference Include="..\..\keystone\bindings\csharp\Keystone.Net\Keystone.Net.csproj"/>
+   </ItemGroup>

pkgs/by-name/co/coroot/package.nix

@@ -3,7 +3,6 @@
   buildGoModule,
   fetchFromGitHub,
   fetchNpmDeps,
-  fetchpatch,
   pkg-config,
   nodejs,
   npmHooks,
@@ -12,24 +11,16 @@
 
 buildGoModule rec {
   pname = "coroot";
-  version = "1.5.9";
+  version = "1.5.11";
 
   src = fetchFromGitHub {
     owner = "coroot";
     repo = "coroot";
     rev = "v${version}";
-    hash = "sha256-z6eD+qAdwu7DoyKTlAQqucdWRtT+h4qCPt0eTQceYXw=";
+    hash = "sha256-lHzTKmD3HCwosvs1x6XxmRdiW/ENNGQiR0hzWzdU8EM=";
   };
-  # github.com/grafana/pyroscope-go/godeltaprof 0.1.6 is broken on go 1.23
-  # use patch from https://github.com/coroot/coroot/pull/357 until it gets fixed
-  patches = [
-    (fetchpatch {
-      url = "https://github.com/coroot/coroot/commit/9bf6ac0ad4dfaa7f13e6d9b5ce5e331d1478aafc.patch";
-      hash = "sha256-5otqdYyQ57sNjF84CRgx0wcztsRdTdsNuhEkvGyw7UE=";
-    })
-  ];
 
-  vendorHash = "sha256-W0UNw8FEIHDKQDCjBryDSJB/UhNyAtMxC6A/9lr79sg=";
+  vendorHash = "sha256-YqZHhoaAgubI2+O2CTULXeQocLaz9WGpWRhETIzU7MU=";
   npmDeps = fetchNpmDeps {
     src = "${src}/front";
     hash = "sha256-inZV+iv837+7ntBae/oLSNLxpzoqEcJNPNdBE+osJHQ=";

pkgs/by-name/di/dialect/package.nix

@@ -1,34 +1,35 @@
-{ lib
-, fetchFromGitHub
-, wrapGAppsHook4
-, python3
-, blueprint-compiler
-, desktop-file-utils
-, meson
-, ninja
-, pkg-config
-, glib
-, gtk4
-, gobject-introspection
-, gst_all_1
-, libsoup_3
-, glib-networking
-, libadwaita
-, libsecret
-, nix-update-script
+{
+  lib,
+  fetchFromGitHub,
+  wrapGAppsHook4,
+  python3,
+  blueprint-compiler,
+  desktop-file-utils,
+  meson,
+  ninja,
+  pkg-config,
+  glib,
+  gtk4,
+  gobject-introspection,
+  gst_all_1,
+  libsoup_3,
+  glib-networking,
+  libadwaita,
+  libsecret,
+  nix-update-script,
 }:
 
 python3.pkgs.buildPythonApplication rec {
   pname = "dialect";
-  version = "2.4.2";
+  version = "2.5.0";
   pyproject = false; # built with meson
 
   src = fetchFromGitHub {
     owner = "dialect-app";
     repo = "dialect";
-    rev = version;
+    rev = "refs/tags/${version}";
     fetchSubmodules = true;
-    hash = "sha256-DAhzvia5ut806rTc2iMuMrVKyYBSaAiMyC4rEOyU4x0=";
+    hash = "sha256-TWXJlzuSBy+Ij3s0KS02bh8vdXP10hQpgdz4QMTLf/Q=";
   };
 
   nativeBuildInputs = [
@@ -53,7 +54,7 @@ python3.pkgs.buildPythonApplication rec {
     libsecret
   ];
 
-  propagatedBuildInputs = with python3.pkgs; [
+  dependencies = with python3.pkgs; [
     dbus-python
     gtts
     pygobject3

pkgs/by-name/ep/epiphany/package.nix

@@ -36,11 +36,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "epiphany";
-  version = "47.1";
+  version = "47.2";
 
   src = fetchurl {
     url = "mirror://gnome/sources/epiphany/${lib.versions.major finalAttrs.version}/epiphany-${finalAttrs.version}.tar.xz";
-    hash = "sha256-ZC/XIEX26bGPCcPvFt92LZt4FhGauyLt1dgu9ofGoAQ=";
+    hash = "sha256-NNr9g2OgmLRNR24umCO0y+puZq+tM7uhDtehP/GpZPE=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/er/erlang-language-platform/package.nix

@@ -0,0 +1,55 @@
+{
+  stdenv,
+  lib,
+  fetchurl,
+  autoPatchelfHook,
+}:
+let
+  arch = if stdenv.isAarch64 then "aarch64" else "x86_64";
+  release =
+    if stdenv.isDarwin then "macos-${arch}-apple-darwin" else "linux-${arch}-unknown-linux-gnu";
+
+  hashes = {
+    linux-aarch64-unknown-linux-gnu = "sha256-vWMrq/uFU/uyuDnsxZK0ZyvtraVCZwvGjzO1a5QjR8g=";
+    linux-x86_64-unknown-linux-gnu = "sha256-iE/zH6M51C6sFZrsUMwZTQ0+hzfpRFJtiKh3MS9bDto=";
+    macos-aarch64-apple-darwin = "sha256-55LSChvO0wRHGL0H29MLy/JW8V52GFr3z/qoxdIPun0=";
+    macos-x86_64-apple-darwin = "sha256-l9bzQ5z9hQ/N2dOkAjPAU4OfRbLCUoRt1eQB6EZE0NI=";
+  };
+in
+stdenv.mkDerivation rec {
+  pname = "erlang-language-platform";
+  version = "2024-07-16";
+
+  src = fetchurl {
+    url = "https://github.com/WhatsApp/erlang-language-platform/releases/download/${version}/elp-${release}-otp-26.2.tar.gz";
+    hash = hashes.${release};
+  };
+
+  nativeBuildInputs = [ autoPatchelfHook ];
+
+  buildInputs = [ stdenv.cc.cc.lib ];
+
+  sourceRoot = ".";
+
+  installPhase = ''
+    runHook preInstall
+    install -m755 -D elp $out/bin/elp
+    runHook postInstall
+  '';
+
+  meta = {
+    description = "An IDE-first library for the semantic analysis of Erlang code, including LSP server, linting and refactoring tools.";
+    homepage = "https://github.com/WhatsApp/erlang-language-platform/";
+    license = with lib.licenses; [
+      mit
+      asl20
+    ];
+    platforms = [
+      "aarch64-linux"
+      "x86_64-linux"
+      "aarch64-darwin"
+      "x86_64-darwin"
+    ];
+    maintainers = with lib.maintainers; [ offsetcyan ];
+  };
+}

pkgs/by-name/ev/evolution-data-server/package.nix

@@ -49,13 +49,13 @@
 
 stdenv.mkDerivation rec {
   pname = "evolution-data-server";
-  version = "3.54.0";
+  version = "3.54.1";
 
   outputs = [ "out" "dev" ];
 
   src = fetchurl {
     url = "mirror://gnome/sources/evolution-data-server/${lib.versions.majorMinor version}/evolution-data-server-${version}.tar.xz";
-    hash = "sha256-pUtHuXepcDD3OKQS9PXVsu++9eDr6JKbfM4ArFRoEIQ=";
+    hash = "sha256-JbM2xIprq8NjIdiAlLOCrq8Yq8urSpQ4s//5DCnhBa4=";
   };
 
   patches = [

pkgs/by-name/fa/fastfetch/package.nix

@@ -44,13 +44,13 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "fastfetch";
-  version = "2.28.0";
+  version = "2.29.0";
 
   src = fetchFromGitHub {
     owner = "fastfetch-cli";
     repo = "fastfetch";
     rev = finalAttrs.version;
-    hash = "sha256-fkAtBO9POd3JKNNt0jV1ufIN1s8HaFW7P2+32cRycWs=";
+    hash = "sha256-qXzE2v2BS1CgPVPIj+mct9zoJ4hpNCsTZ12keQThRZI=";
   };
 
   outputs = [

pkgs/by-name/fi/fish-lsp/package.nix

@@ -0,0 +1,83 @@
+{
+  fetchFromGitHub,
+  fetchYarnDeps,
+  fish,
+  installShellFiles,
+  lib,
+  makeWrapper,
+  nix-update-script,
+  nodejs,
+  npmHooks,
+  stdenv,
+  which,
+  yarnBuildHook,
+  yarnConfigHook,
+}:
+stdenv.mkDerivation rec {
+  pname = "fish-lsp";
+  version = "1.0.8-1";
+
+  src = fetchFromGitHub {
+    owner = "ndonfris";
+    repo = "fish-lsp";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-u125EZXQEouVbmJuoW3KNDNqLB5cS/TzblXraClcw6Q=";
+  };
+
+  yarnOfflineCache = fetchYarnDeps {
+    yarnLock = src + "/yarn.lock";
+    hash = "sha256-hHw7DbeqaCapqx4dK5Y3sPut94ist9JOU8g9dd6gBdo=";
+  };
+
+  nativeBuildInputs = [
+    yarnBuildHook
+    yarnConfigHook
+    npmHooks.npmInstallHook
+    nodejs
+    installShellFiles
+    makeWrapper
+    fish
+  ];
+
+  yarnBuildScript = "setup";
+
+  postBuild = ''
+    yarn --offline compile
+  '';
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p $out/share/fish-lsp
+    cp -r . $out/share/fish-lsp
+
+    makeWrapper ${lib.getExe nodejs} "$out/bin/fish-lsp" \
+      --add-flags "$out/share/fish-lsp/out/cli.js" \
+      --prefix PATH : "${
+        lib.makeBinPath [
+          fish
+          which
+        ]
+      }"
+
+    ${lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
+      installShellCompletion --cmd fish-lsp \
+        --fish <($out/bin/fish-lsp complete --fish)
+    ''}
+
+    runHook postInstall
+  '';
+
+  doDist = false;
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "LSP implementation for the fish shell language";
+    homepage = "https://github.com/ndonfris/fish-lsp";
+    license = lib.licenses.mit;
+    mainProgram = "fish-lsp";
+    maintainers = with lib.maintainers; [ petertriho ];
+    platforms = lib.platforms.unix;
+  };
+}

pkgs/by-name/fl/florist/package.nix

@@ -0,0 +1,34 @@
+{
+  stdenv,
+  gnat13,
+  gnat13Packages,
+  fetchFromGitHub,
+  lib,
+}:
+
+stdenv.mkDerivation rec {
+  name = "florist";
+  version = "24.2";
+
+  src = fetchFromGitHub {
+    owner = "adacore";
+    repo = "florist";
+    rev = "refs/heads/${version}";
+    hash = "sha256-EFGmcQfWpxEWfsAoQrHegTlizl6siE8obKx+fCpVwUQ=";
+  };
+
+  configureFlags = [ "--enable-shared" ];
+
+  nativeBuildInputs = [
+    gnat13
+    gnat13Packages.gprbuild
+  ];
+
+  meta = {
+    description = "Posix Ada Bindings";
+    homepage = "https://github.com/adacore/florist";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ lutzberger ];
+    platforms = lib.platforms.linux;
+  };
+}

pkgs/by-name/fr/fritz-exporter/package.nix

@@ -22,6 +22,7 @@ python3.pkgs.buildPythonApplication rec {
 
   pythonRelaxDeps = [
     "defusedxml"
+    "attrs"
   ];
 
   nativeBuildInputs = with python3.pkgs; [

pkgs/by-name/gh/gh-contribs/package.nix

@@ -0,0 +1,49 @@
+{
+  coreutils,
+  fetchFromGitHub,
+  gh,
+  lib,
+  makeWrapper,
+  nix-update-script,
+  stdenvNoCC,
+}:
+stdenvNoCC.mkDerivation rec {
+  pname = "gh-contribs";
+  version = "0.9.0";
+
+  src = fetchFromGitHub {
+    owner = "MintArchit";
+    repo = "gh-contribs";
+    rev = "v${version}";
+    hash = "sha256-yPJ9pmnbqR+fXH02Q5VMn0v2MuDQbPUpNzKw1awmKVE=";
+  };
+
+  nativeBuildInputs = [
+    makeWrapper
+  ];
+
+  installPhase = ''
+    install -D -m755 "gh-contribs" "$out/bin/gh-contribs"
+  '';
+
+  postFixup = ''
+    wrapProgram "$out/bin/gh-contribs" \
+      --prefix PATH : "${
+        lib.makeBinPath [
+          coreutils
+          gh
+        ]
+      }"
+  '';
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    homepage = "https://github.com/MintArchit/gh-contribs";
+    description = "GitHub Contribution Graph CLI";
+    maintainers = [ lib.maintainers.vinnymeller ];
+    license = lib.licenses.unlicense;
+    mainProgram = "gh-contribs";
+    platforms = lib.platforms.all;
+  };
+}

pkgs/by-name/gi/git-fast-export/package.nix

@@ -1,22 +1,41 @@
-{lib, stdenv, fetchFromGitHub, git, mercurial, makeWrapper}:
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  git,
+  mercurial,
+  makeWrapper,
+  nix-update-script,
+  fetchpatch,
+}:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "fast-export";
-  version = "221024";
+  version = "231118";
 
   src = fetchFromGitHub {
     owner = "frej";
-    repo = pname;
-    rev = "v${version}";
-    sha256 = "sha256-re8iXM8s+TD35UGKalq2kVn8fx68fsnUC7Yo+/DQ9SM=";
+    repo = "fast-export";
+    rev = "v${finalAttrs.version}";
+    hash = "sha256-JUy0t2yzd4bI7WPGG1E8L1topLfR5leV/WTU+u0bCyM=";
   };
 
+  patches = [
+    (fetchpatch {
+      url = "https://github.com/frej/fast-export/commit/a3d0562737e1e711659e03264e45cb47a5a2f46d.patch?full_index=1";
+      hash = "sha256-vZOHnb5lXO22ElCK4oWQKCcPIqRyZV5axWfZqa84V1Y=";
+    })
+  ];
+
   nativeBuildInputs = [ makeWrapper ];
-  buildInputs = [mercurial.python mercurial];
+  buildInputs = [
+    mercurial.python
+    mercurial
+  ];
 
   installPhase = ''
     binPath=$out/bin
-    libexecPath=$out/libexec/${pname}
+    libexecPath=$out/libexec/fast-export
     sitepackagesPath=$out/${mercurial.python.sitePackages}
     mkdir -p $binPath $libexecPath $sitepackagesPath
 
@@ -57,11 +76,13 @@ stdenv.mkDerivation rec {
     popd
   '';
 
-  meta = with lib; {
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
     description = "Import mercurial into git";
     homepage = "https://repo.or.cz/w/fast-export.git";
-    license = licenses.gpl2;
-    maintainers = [ maintainers.koral ];
-    platforms = platforms.unix;
+    license = lib.licenses.gpl2;
+    maintainers = [ lib.maintainers.koral ];
+    platforms = lib.platforms.unix;
   };
-}
+})

pkgs/by-name/gn/gnome-terminal/package.nix

@@ -29,14 +29,14 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "gnome-terminal";
-  version = "3.52.2";
+  version = "3.54.1";
 
   src = fetchFromGitLab {
     domain = "gitlab.gnome.org";
     owner = "GNOME";
     repo = "gnome-terminal";
     rev = finalAttrs.version;
-    hash = "sha256-c6xMUyhQnJiIrFnnUEx6vGVvFghGvLjTxiAFq+nSj2A=";
+    hash = "sha256-1Lu/qaeMUL8QvZGIxq2iuI7lfZSB+jMjkI2Jg6qULI0=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/go/goreleaser/package.nix

@@ -10,16 +10,16 @@
 }:
 buildGoModule rec {
   pname = "goreleaser";
-  version = "2.3.2";
+  version = "2.4.4";
 
   src = fetchFromGitHub {
     owner = "goreleaser";
-    repo = pname;
+    repo = "goreleaser";
     rev = "v${version}";
-    hash = "sha256-YKcduPxcXU1Ixexr/DxeVRfLxYdHNFcGNLbBiH6cIUU=";
+    hash = "sha256-c9fdv+lvUPMVzWzliT/ss8X/OD8s1UX22ee2bo77YwY=";
   };
 
-  vendorHash = "sha256-3gC2wZz3t6ObqAJ2g80kTrW2OEAyBptdqmN7cQKqZ/w=";
+  vendorHash = "sha256-pU64v3qQUX0T0X+AOdE/1McKMA4uOiTmGfZ87FUYl7c=";
 
   ldflags = [
     "-s"
@@ -28,6 +28,10 @@ buildGoModule rec {
     "-X main.builtBy=nixpkgs"
   ];
 
+  subPackages = [
+    "."
+  ];
+
   # tests expect the source files to be a build repo
   doCheck = false;
 
@@ -56,10 +60,8 @@ buildGoModule rec {
     description = "Deliver Go binaries as fast and easily as possible";
     homepage = "https://goreleaser.com";
     maintainers = with maintainers; [
-      c0deaddict
       sarcasticadmin
       techknowlogick
-      developer-guy
       caarlos0
     ];
     license = licenses.mit;