Merge master into staging-next

ci/eval/compare/maintainers.nix

@@ -22,18 +22,27 @@ let
 
   anyMatchingFiles = files: builtins.any anyMatchingFile files;
 
-  attrsWithMaintainers = builtins.map (
+  attrsWithMaintainers = lib.pipe (changedattrs ++ removedattrs) [
-    name:
+    (builtins.map (
-    let
+      name:
-      package = lib.getAttrFromPath (lib.splitString "." name) pkgs;
+      let
-    in
+        # Some packages might be reported as changed on a different platform, but
-    {
+        # not even have an attribute on the platform the maintainers are requested on.
-      inherit name package;
+        # Fallback to `null` for these to filter them out below.
-      # TODO: Refactor this so we can ping entire teams instead of the individual members.
+        package = lib.attrByPath (lib.splitString "." name) null pkgs;
-      # Note that this will require keeping track of GH team IDs in "maintainers/teams.nix".
+      in
-      maintainers = package.meta.maintainers or [ ];
+      {
-    }
+        inherit name package;
-  ) (changedattrs ++ removedattrs);
+        # TODO: Refactor this so we can ping entire teams instead of the individual members.
+        # Note that this will require keeping track of GH team IDs in "maintainers/teams.nix".
+        maintainers = package.meta.maintainers or [ ];
+      }
+    ))
+    # No need to match up packages without maintainers with their files.
+    # This also filters out attributes where `packge = null`, which is the
+    # case for libintl, for example.
+    (builtins.filter (pkg: pkg.maintainers != [ ]))
+  ];
 
   relevantFilenames =
     drv:

doc/languages-frameworks/vim.section.md

@@ -186,12 +186,17 @@ Alternatively, set the number of processes to a lower count to avoid rate-limiti
 nix-shell -p vimPluginsUpdater --run 'vim-plugins-updater --proc 1'
 ```
 
-If you want to update only certain plugins, you can specify them after the `update` command. Note that you must use the same plugin names as the `pkgs/applications/editors/vim/plugins/vim-plugin-names` file.
+To update only specific plugins, list them after the `update` command:
 
 ```sh
-nix-shell -p vimPluginsUpdater --run 'vim-plugins-updater update "nvim-treesitter" "LazyVim"'
+nix-shell -p vimPluginsUpdater --run 'vim-plugins-updater update "nvim-treesitter" "mini.nvim" "mini-nvim"'
 ```
 
+The updater script accepts plugin arguments in different formats:
+
+- `"mini.nvim"` := The GitHub repository name, the raw plugin name, or the alias defined in `vim-plugin-names`.
+- `"mini-nvim"` := The normalized plugin name, which matches the attribute name generated in `generated.nix`
+
 ## How to maintain an out-of-tree overlay of vim plugins? {#vim-out-of-tree-overlays}
 
 You can use the updater script to generate basic packages out of a custom vim

nixos/doc/manual/release-notes/rl-2511.section.md

@@ -68,6 +68,8 @@
 
 - [Newt](https://github.com/fosrl/newt), a fully user space WireGuard tunnel client and TCP/UDP proxy, designed to securely expose private resources controlled by Pangolin. Available as [services.newt](options.html#opt-services.newt.enable).
 
+- [IfState](https://ifstate.net), manage host interface settings in a declarative manner. Available as [networking.ifstate](options.html#opt-networking.ifstate.enable) and [boot.initrd.network.ifstate](options.html#opt-boot.initrd.network.ifstate.enable).
+
 - [qBittorrent](https://www.qbittorrent.org/), is a bittorrent client programmed in C++ / Qt that uses libtorrent by Arvid Norberg. Available as [services.qbittorrent](#opt-services.qbittorrent.enable).
 
 - [Speedify](https://speedify.com/), a proprietary VPN which allows combining multiple internet connections (Wi-Fi, 4G, 5G, Ethernet, Starlink, Satellite, and more) to improve the stability, speed, and security of online experiences. Available as [services.speedify](#opt-services.speedify.enable).
@@ -82,6 +84,8 @@
 
 - [dwl](https://codeberg.org/dwl/dwl), a compact, hackable compositor for Wayland based on wlroots. Available as [programs.dwl](#opt-programs.dwl.enable).
 
+- [angrr](https://github.com/linyinfeng/angrr), a service that automatically cleans up old auto GC roots. Available as [services.angrr](#opt-services.angrr.enable).
+
 - [Sharkey](https://joinsharkey.org), a Sharkish microblogging platform. Available as [services.sharkey](#opt-services.sharkey.enable).
 
 - [fw-fanctrl](https://github.com/TamtamHero/fw-fanctrl), a simple systemd service to better control Framework Laptop's fan(s). Available as [hardware.fw-fanctrl](#opt-hardware.fw-fanctrl.enable).

nixos/modules/module-list.nix

@@ -788,6 +788,7 @@
   ./services/misc/airsonic.nix
   ./services/misc/amazon-ssm-agent.nix
   ./services/misc/ananicy.nix
+  ./services/misc/angrr.nix
   ./services/misc/anki-sync-server.nix
   ./services/misc/apache-kafka.nix
   ./services/misc/atuin.nix
@@ -1185,6 +1186,7 @@
   ./services/networking/i2pd.nix
   ./services/networking/icecream/daemon.nix
   ./services/networking/icecream/scheduler.nix
+  ./services/networking/ifstate.nix
   ./services/networking/imaginary.nix
   ./services/networking/inadyn.nix
   ./services/networking/inspircd.nix

nixos/modules/services/home-automation/home-assistant.nix

@@ -868,6 +868,10 @@ in
             "amshan"
             "benqprojector"
           ];
+          componentsUsingInputDevices = [
+            # Components that require access to input devices (/dev/input/*)
+            "keyboard_remote"
+          ];
         in
         {
           ExecStart = escapeSystemdExecArgs (
@@ -898,13 +902,15 @@ in
           # Hardening
           AmbientCapabilities = capabilities;
           CapabilityBoundingSet = capabilities;
-          DeviceAllow = (
+          DeviceAllow =
             optionals (any useComponent componentsUsingSerialDevices) [
               "char-ttyACM rw"
               "char-ttyAMA rw"
               "char-ttyUSB rw"
             ]
-          );
+            ++ optionals (any useComponent componentsUsingInputDevices) [
+              "char-input rw"
+            ];
           DevicePolicy = "closed";
           LockPersonality = true;
           MemoryDenyWriteExecute = true;
@@ -946,9 +952,13 @@ in
           RestrictNamespaces = true;
           RestrictRealtime = true;
           RestrictSUIDSGID = true;
-          SupplementaryGroups = optionals (any useComponent componentsUsingSerialDevices) [
+          SupplementaryGroups =
-            "dialout"
+            optionals (any useComponent componentsUsingSerialDevices) [
-          ];
+              "dialout"
+            ]
+            ++ optionals (any useComponent componentsUsingInputDevices) [
+              "input"
+            ];
           SystemCallArchitectures = "native";
           SystemCallFilter = [
             "@system-service"

nixos/modules/services/misc/angrr.nix

@@ -0,0 +1,128 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+let
+  cfg = config.services.angrr;
+in
+{
+  meta.maintainers = pkgs.angrr.meta.maintainers;
+  options = {
+    services.angrr = {
+      enable = lib.mkEnableOption "angrr";
+      package = lib.mkPackageOption pkgs "angrr" { };
+      period = lib.mkOption {
+        type = lib.types.str;
+        default = "7d";
+        example = "2weeks";
+        description = ''
+          The retention period of auto GC roots.
+        '';
+      };
+      removeRoot = lib.mkOption {
+        type = lib.types.bool;
+        default = false;
+        description = ''
+          Whether to pass the `--remove-root` option to angrr.
+        '';
+      };
+      ownedOnly = lib.mkOption {
+        type = lib.types.bool;
+        default = false;
+        description = ''
+          Control the `--remove-root=<true|false>` option of angrr.
+        '';
+        apply = b: if b then "true" else "false";
+      };
+      logLevel = lib.mkOption {
+        type =
+          with lib.types;
+          enum [
+            "off"
+            "error"
+            "warn"
+            "info"
+            "debug"
+            "trace"
+          ];
+        default = "info";
+        description = ''
+          Set the log level of angrr.
+        '';
+      };
+      extraArgs = lib.mkOption {
+        type = with lib.types; listOf str;
+        default = [ ];
+        description = ''
+          Extra command-line arguments pass to angrr.
+        '';
+      };
+      enableNixGcIntegration = lib.mkOption {
+        type = lib.types.bool;
+        description = ''
+          Whether to enable nix-gc.service integration
+        '';
+      };
+      timer = {
+        enable = lib.mkEnableOption "angrr timer";
+        dates = lib.mkOption {
+          type = lib.types.str;
+          default = "03:00";
+          description = ''
+            How often or when the retention policy is performed.
+          '';
+        };
+      };
+    };
+  };
+
+  config = lib.mkIf cfg.enable (
+    lib.mkMerge [
+      {
+        assertions = [
+          {
+            assertion = cfg.enableNixGcIntegration -> config.nix.gc.automatic;
+            message = "angrr nix-gc.service integration requires `nix.gc.automatic = true`";
+          }
+        ];
+        services.angrr.enableNixGcIntegration = lib.mkDefault config.nix.gc.automatic;
+      }
+
+      {
+        systemd.services.angrr = {
+          description = "Auto Nix GC Roots Retention";
+          script = ''
+            ${lib.getExe cfg.package} run \
+              --log-level "${cfg.logLevel}" \
+              --period "${cfg.period}" \
+              ${lib.optionalString cfg.removeRoot "--remove-root"} \
+              --owned-only="${cfg.ownedOnly}" \
+              --no-prompt ${lib.escapeShellArgs cfg.extraArgs}
+          '';
+          serviceConfig = {
+            Type = "oneshot";
+          };
+        };
+      }
+
+      (lib.mkIf cfg.timer.enable {
+        systemd.timers.angrr = {
+          timerConfig = {
+            OnCalendar = cfg.timer.dates;
+          };
+          wantedBy = [ "timers.target" ];
+        };
+      })
+
+      (lib.mkIf cfg.enableNixGcIntegration {
+        systemd.services.angrr = {
+          wantedBy = [ "nix-gc.service" ];
+          before = [ "nix-gc.service" ];
+        };
+      })
+    ]
+  );
+}

nixos/modules/services/misc/radicle.nix

@@ -227,6 +227,16 @@ in
           default = 8080;
           description = "The port on which `radicle-httpd` listens.";
         };
+        aliases = lib.mkOption {
+          type = lib.types.attrsOf lib.types.str;
+          description = "Alias and RID pairs to shorten git clone commands for repositories.";
+          default = { };
+          example = lib.literalExpression ''
+            {
+              heartwood = "rad:z3gqcJUoA1n9HaHKufZs5FCSGazv5";
+            }
+          '';
+        };
         nginx = lib.mkOption {
           # Type of a single virtual host, or null.
           type = lib.types.nullOr (
@@ -342,7 +352,20 @@ in
                 description = "Radicle HTTP gateway to radicle-node";
                 documentation = [ "man:radicle-httpd(1)" ];
                 serviceConfig = {
-                  ExecStart = "${lib.getExe' cfg.httpd.package "radicle-httpd"} --listen ${cfg.httpd.listenAddress}:${toString cfg.httpd.listenPort} ${lib.escapeShellArgs cfg.httpd.extraArgs}";
+                  ExecStart = lib.escapeShellArgs (
+                    [
+                      (lib.getExe' cfg.httpd.package "radicle-httpd")
+                      "--listen=${cfg.httpd.listenAddress}:${toString cfg.httpd.listenPort}"
+                    ]
+                    ++ lib.flatten (
+                      lib.mapAttrsToList (alias: rid: [
+                        "--alias"
+                        alias
+                        rid
+                      ]) cfg.httpd.aliases
+                    )
+                    ++ cfg.httpd.extraArgs
+                  );
                   Restart = lib.mkDefault "on-failure";
                   RestartSec = "10";
                   SocketBindAllow = [ "tcp:${toString cfg.httpd.listenPort}" ];

nixos/modules/services/networking/ifstate.nix

@@ -0,0 +1,311 @@
+{
+  lib,
+  config,
+  pkgs,
+  ...
+}:
+
+let
+  cfg = config.networking.ifstate;
+  initrdCfg = config.boot.initrd.network.ifstate;
+  settingsFormat = {
+    # override generator in order to:
+    # - use yq and not remarshal because it matches yaml datatype handling with IfState
+    # - validate json schema
+    generate =
+      name: value: package:
+      pkgs.runCommand name
+        {
+          nativeBuildInputs = with pkgs; [
+            yq
+            check-jsonschema
+          ];
+          value = builtins.toJSON value;
+          passAsFile = [ "value" ];
+        }
+        ''
+          yq --yaml-output . $valuePath > $out
+          check-jsonschema --schemafile "${cfg.package.passthru.jsonschema}" "$out"
+          sed -i $'s|\'!include |!include \'|' $out
+        '';
+
+    inherit (pkgs.formats.yaml { }) type;
+  };
+  initrdInterfaceTypes = builtins.map (interface: interface.link.kind) (
+    builtins.attrValues initrdCfg.settings.interfaces
+  );
+  # IfState interface kind to kernel modules mapping
+  interfaceKernelModules = {
+    "ifb" = [ "ifb" ];
+    "ip6tnl" = [ "ip6tnl" ];
+    "ipoib" = [ "ib_ipoib" ];
+    "ipvlan" = [ "ipvlan" ];
+    "macvlan" = [ "macvlan" ];
+    "macvtap" = [ "macvtap" ];
+    "team" = [ "team" ];
+    "tun" = [ "tun" ];
+    "vrf" = [ "vrf" ];
+    "vti" = [ "ip_vti" ];
+    "vti6" = [ "ip6_vti" ];
+    "bond" = [ "bonding" ];
+    "bridge" = [ "bridge" ];
+    # "physical" = ...;
+    "dsa" = [ "dsa_core" ];
+    "dummy" = [ "dummy" ];
+    "veth" = [ "veth" ];
+    "vxcan" = [ "vxcan" ];
+    "vlan" = [ "8021q" ];
+    "vxlan" = [ "vxlan" ];
+    "ipip" = [ "ipip" ];
+    "sit" = [ "sit" ];
+    "gre" = [ "ip_gre" ];
+    "gretap" = [ "ip_gre" ];
+    "ip6gre" = [ "ip6_gre" ];
+    "ip6gretap" = [ "ip6_gre" ];
+    "geneve" = [ "geneve" ];
+    "wireguard" = [ "wireguard" ];
+    "xfrm" = [ "xfrm_interface" ];
+  };
+in
+{
+  meta.maintainers = with lib.maintainers; [ marcel ];
+
+  options = {
+    networking.ifstate = {
+      enable = lib.mkEnableOption "networking using IfState";
+
+      package = lib.mkPackageOption pkgs "ifstate" { };
+
+      settings = lib.mkOption {
+        inherit (settingsFormat) type;
+        default = { };
+        description = "Content of IfState's configuration file. See <https://ifstate.net/2.0/schema/> for details.";
+      };
+    };
+
+    boot.initrd.network.ifstate = {
+      enable = lib.mkEnableOption "initrd networking using IfState";
+
+      allowIfstateToDrasticlyIncreaseInitrdSize = lib.mkOption {
+        type = lib.types.bool;
+        default = false;
+        description = "IfState in initrd drastically increases the size of initrd, your boot partition may be too small and/or you may have significantly fewer generations. By setting this option, you acknowledge this fact and keep it in mind when reporting issues.";
+      };
+
+      package = lib.mkOption {
+        type = lib.types.package;
+        default = cfg.package.override {
+          withConfigValidation = false;
+          withWireguard = false;
+        };
+        defaultText = lib.literalExpression "pkgs.ifstate.override { withConfigValidation = false; withWireguard = false; }";
+        description = "The initrd IfState package to use.";
+      };
+
+      settings = lib.mkOption {
+        inherit (settingsFormat) type;
+        default = { };
+        description = "Content of IfState's initrd configuration file. See <https://ifstate.net/2.0/schema/> for details.";
+      };
+
+      cleanupSettings = lib.mkOption {
+        inherit (settingsFormat) type;
+        default = {
+          # required by json schema
+          interfaces = { };
+          # https://codeberg.org/liske/ifstate/issues/118
+          namespaces = { };
+        };
+        description = "Content of IfState's initrd cleanup configuration file. See <https://ifstate.net/2.0/schema/> for details. This configuration gets applied before systemd switches to stage two. The goas is to deconfigurate the whole network in order to prevent access to services, before the firewall is configured. The stage two IfState configuration will start after the firewall is configured.";
+      };
+    };
+  };
+
+  config = lib.mkMerge [
+    (lib.mkIf cfg.enable {
+      assertions = [
+        {
+          assertion = !config.networking.networkmanager.enable;
+          message = "IfState and NetworkManager cannot be used at the same time, as both configure the network in a conflicting manner.";
+        }
+        {
+          assertion = !config.networking.useDHCP;
+          message = "IfState and networking.useDHCP cannot be used at the same time, as both configure the network. Please look into IfState hooks to integrate DHCP: https://codeberg.org/liske/ifstate/issues/111";
+        }
+      ];
+
+      networking.useDHCP = lib.mkDefault false;
+
+      # sane defaults to not let IfState work against the kernel
+      boot.extraModprobeConfig = ''
+        options bonding max_bonds=0
+        options dummy numdummies=0
+        options ifb numifbs=0
+      '';
+
+      environment = {
+        # ifstatecli command should be available to use user, there are other useful subcommands like check or show
+        systemPackages = [ cfg.package ];
+        # match the default value of the --config flag of IfState
+        etc."ifstate/ifstate.yaml".source = settingsFormat.generate "ifstate.yaml" cfg.settings cfg.package;
+      };
+
+      systemd.services.ifstate = {
+        description = "IfState";
+
+        wantedBy = [
+          "multi-user.target"
+        ];
+        after = [
+          "systemd-udevd.service"
+          "network-pre.target"
+          "systemd-sysusers.service"
+          "systemd-sysctl.service"
+        ];
+        before = [
+          "network.target"
+          "multi-user.target"
+          "shutdown.target"
+          "initrd-switch-root.target"
+        ];
+        conflicts = [
+          "shutdown.target"
+          "initrd-switch-root.target"
+        ];
+        wants = [
+          "network.target"
+        ];
+
+        # mount is always available on nixos, avoid adding additional store paths to the closure
+        path = [ "/run/wrappers" ];
+
+        serviceConfig = {
+          Type = "oneshot";
+          ExecStart = "${lib.getExe cfg.package} --config ${
+            config.environment.etc."ifstate/ifstate.yaml".source
+          } apply";
+          # because oneshot services do not have a timeout by default
+          TimeoutStartSec = "2min";
+        };
+      };
+    })
+    (lib.mkIf initrdCfg.enable {
+      assertions = [
+        {
+          assertion =
+            initrdCfg.package.passthru.features.withWireguard
+            || !(builtins.any (kind: kind == "wireguard") initrdInterfaceTypes);
+          message = "IfState initrd package is configured without the `wireguard` feature, but wireguard interfaces are configured. Please see the `boot.initrd.network.ifstate.package` option.";
+        }
+        {
+          assertion = initrdCfg.allowIfstateToDrasticlyIncreaseInitrdSize;
+          message = "IfState in initrd drastically increases the size of initrd, your boot partition may be too small and/or you may have significantly fewer generations. By setting boot.initrd.network.initrd.allowIfstateToDrasticlyIncreaseInitrdSize to true, you acknowledge this fact and keep it in mind when reporting issues.";
+        }
+        {
+          assertion = cfg.enable;
+          message = "If IfState is used in initrd, it should also be used for the stage 2 system (networking.ifstate), as initrd IfState does not clean up the network stack like it was before after execution.";
+        }
+        {
+          assertion = config.boot.initrd.systemd.enable;
+          message = "IfState only supports systemd stage one. See `boot.initrd.systemd.enable` option.";
+        }
+      ];
+
+      environment.etc = {
+        "ifstate/ifstate.initrd.yaml".source =
+          settingsFormat.generate "ifstate.initrd.yaml" initrdCfg.settings
+            initrdCfg.package;
+        "ifstate/ifstate.initrd-cleanup.yaml".source =
+          settingsFormat.generate "ifstate.initrd-cleanup.yaml" initrdCfg.cleanupSettings
+            initrdCfg.package;
+      };
+
+      boot.initrd = {
+        network.udhcpc.enable = lib.mkDefault false;
+
+        # automatic configuration of kernel modules of virtual interface types
+        availableKernelModules =
+          let
+            enableModule =
+              type:
+              if builtins.hasAttr type interfaceKernelModules then interfaceKernelModules."${type}" else [ ];
+          in
+          lib.flatten (builtins.map enableModule initrdInterfaceTypes);
+
+        systemd = {
+          storePaths = [
+            (pkgs.runCommand "ifstate-closure"
+              {
+                info = pkgs.closureInfo {
+                  rootPaths = [
+                    initrdCfg.package
+                    # copy whole config closure, because it can reference other files using !include
+                    config.environment.etc."ifstate/ifstate.initrd.yaml".source
+                    config.environment.etc."ifstate/ifstate.initrd-cleanup.yaml".source
+                  ];
+                };
+              }
+              ''
+                mkdir $out
+                cat "$info"/store-paths | while read path; do
+                  ln -s "$path" "$out/$(basename "$path")"
+                done
+              ''
+            )
+          ];
+
+          services.ifstate-initrd = {
+            description = "IfState initrd";
+
+            wantedBy = [
+              "initrd.target"
+            ];
+            after = [
+              "systemd-udevd.service"
+              "network-pre.target"
+              "systemd-sysusers.service"
+              "systemd-sysctl.service"
+            ];
+            before = [
+              "network.target"
+              "multi-user.target"
+              "shutdown.target"
+              "initrd-switch-root.target"
+            ];
+            conflicts = [
+              "shutdown.target"
+              "initrd-switch-root.target"
+            ];
+            wants = [
+              "network.target"
+            ];
+
+            # mount is always available on nixos, avoid adding additional store paths to the closure
+            # https://github.com/NixOS/nixpkgs/blob/2b8e2457ebe576ebf41ddfa8452b5b07a8d493ad/nixos/modules/system/boot/systemd/initrd.nix#L550-L551
+            path = [
+              config.boot.initrd.systemd.package.util-linux
+            ];
+
+            serviceConfig = {
+              Type = "oneshot";
+              # Otherwise systemd starts ifstate again, after the encryption password was entered by the user
+              # and we are able to implement the cleanup using ExecStop rather than a separate unit.
+              RemainAfterExit = true;
+              # When using network namespaces pyroute2 expects this directory to exists.
+              # @liske is currently investigating whether this should be considered a bug in pyroute2.
+              ExecStartPre = "${lib.getExe' pkgs.coreutils "mkdir"} /var/run";
+              ExecStart = "${lib.getExe initrdCfg.package} --config ${
+                config.environment.etc."ifstate/ifstate.initrd.yaml".source
+              } apply";
+              ExecStop = "${lib.getExe initrdCfg.package} --config ${
+                config.environment.etc."ifstate/ifstate.initrd-cleanup.yaml".source
+              } apply";
+              # because oneshot services do not have a timeout by default
+              TimeoutStartSec = "2min";
+            };
+          };
+        };
+      };
+    })
+  ];
+}

nixos/modules/services/web-apps/glitchtip.nix

@@ -58,6 +58,12 @@ in
         default = 8000;
       };
 
+      stateDir = lib.mkOption {
+        type = lib.types.path;
+        description = "State directory of glitchtip.";
+        default = "/var/lib/glitchtip";
+      };
+
       settings = lib.mkOption {
         description = ''
           Configuration of GlitchTip. See <https://glitchtip.com/documentation/install#configuration> for more information.
@@ -189,6 +195,7 @@ in
           StateDirectory = "glitchtip";
           EnvironmentFile = cfg.environmentFiles;
           WorkingDirectory = "${pkg}/lib/glitchtip";
+          BindPaths = [ "${cfg.stateDir}/uploads:${pkg}/lib/glitchtip/uploads" ];
 
           # hardening
           AmbientCapabilities = "";
@@ -220,6 +227,7 @@ in
             "@system-service"
             "~@privileged"
             "~@resources"
+            "@chown"
           ];
           UMask = "0077";
         };
@@ -271,7 +279,6 @@ in
 
     users.users = lib.mkIf (cfg.user == "glitchtip") {
       glitchtip = {
-        home = "/var/lib/glitchtip";
         group = cfg.group;
         extraGroups = lib.optionals cfg.redis.createLocally [ "redis-glitchtip" ];
         isSystemUser = true;
@@ -280,6 +287,8 @@ in
 
     users.groups = lib.mkIf (cfg.group == "glitchtip") { glitchtip = { }; };
 
+    systemd.tmpfiles.settings.glitchtip."${cfg.stateDir}/uploads".d = { inherit (cfg) user group; };
+
     environment.systemPackages =
       let
         glitchtip-manage = pkgs.writeShellScriptBin "glitchtip-manage" ''

nixos/tests/all-tests.nix

@@ -210,6 +210,7 @@ in
   amd-sev = runTest ./amd-sev.nix;
   android-translation-layer = runTest ./android-translation-layer.nix;
   angie-api = runTest ./angie-api.nix;
+  angrr = runTest ./angrr.nix;
   anki-sync-server = runTest ./anki-sync-server.nix;
   anubis = runTest ./anubis.nix;
   anuko-time-tracker = runTest ./anuko-time-tracker.nix;
@@ -735,6 +736,7 @@ in
   i3wm = runTest ./i3wm.nix;
   icingaweb2 = runTest ./icingaweb2.nix;
   ifm = runTest ./ifm.nix;
+  ifstate = import ./ifstate { inherit runTest; };
   iftop = runTest ./iftop.nix;
   immich = runTest ./web-apps/immich.nix;
   immich-vectorchord-migration = runTest ./web-apps/immich-vectorchord-migration.nix;
@@ -1035,7 +1037,10 @@ in
   nix-config = runTest ./nix-config.nix;
   nix-ld = runTest ./nix-ld.nix;
   nix-misc = handleTest ./nix/misc.nix { };
-  nix-upgrade = handleTest ./nix/upgrade.nix { inherit (pkgs) nixVersions; };
+  nix-upgrade = handleTest ./nix/upgrade.nix {
+    inherit (pkgs) nixVersions;
+    inherit system;
+  };
   nix-required-mounts = runTest ./nix-required-mounts;
   nix-serve = runTest ./nix-serve.nix;
   nix-serve-ssh = runTest ./nix-serve-ssh.nix;

nixos/tests/angrr.nix

@@ -0,0 +1,63 @@
+{ ... }:
+{
+  name = "angrr";
+  nodes = {
+    machine = {
+      services.angrr = {
+        enable = true;
+        period = "7d";
+      };
+      # `angrr.service` integrates to `nix-gc.service` by default
+      nix.gc.automatic = true;
+
+      # Create a normal nix user for test
+      users.users.normal.isNormalUser = true;
+      # For `nix build /run/current-system --out-link`,
+      # `nix-build` does not support this use case.
+      nix.settings.experimental-features = [ "nix-command" ];
+    };
+  };
+
+  testScript = ''
+    start_all()
+
+    machine.wait_for_unit("default.target")
+
+    machine.systemctl("stop nix-gc.timer")
+
+    # Creates some auto gc roots
+    # Use /run/current-system so that we do not need to build anything new
+    machine.succeed("nix build /run/current-system --out-link /tmp/root-auto-gc-root-1")
+    machine.succeed("nix build /run/current-system --out-link /tmp/root-auto-gc-root-2")
+    machine.succeed("su normal --command 'nix build /run/current-system --out-link /tmp/user-auto-gc-root-1'")
+    machine.succeed("su normal --command 'nix build /run/current-system --out-link /tmp/user-auto-gc-root-2'")
+
+    machine.systemctl("start nix-gc.service")
+    # Not auto gc root will be removed
+    machine.succeed("readlink /tmp/root-auto-gc-root-1")
+    machine.succeed("readlink /tmp/root-auto-gc-root-2")
+    machine.succeed("readlink /tmp/user-auto-gc-root-1")
+    machine.succeed("readlink /tmp/user-auto-gc-root-2")
+
+    # Change time to 8 days after (greater than 7d)
+    machine.succeed("date -s '8 days'")
+
+    # Touch GC roots `-2`
+    machine.succeed("touch /tmp/root-auto-gc-root-2 --no-dereference")
+    machine.succeed("touch /tmp/user-auto-gc-root-2 --no-dereference")
+
+    machine.systemctl("start nix-gc.service")
+    # Only GC roots `-1` are removed
+    machine.succeed("test ! -f /tmp/root-auto-gc-root-1")
+    machine.succeed("readlink  /tmp/root-auto-gc-root-2")
+    machine.succeed("test ! -f /tmp/user-auto-gc-root-1")
+    machine.succeed("readlink  /tmp/user-auto-gc-root-2")
+
+    # Change time again
+    machine.succeed("date -s '8 days'")
+    machine.systemctl("start nix-gc.service")
+    # All auto GC roots are removed
+    machine.succeed("test ! -f /tmp/root-auto-gc-root-2")
+    machine.succeed("test ! -f /tmp/user-auto-gc-root-2")
+  '';
+}

nixos/tests/glitchtip.nix

@@ -42,62 +42,73 @@ in
     ];
   };
 
-  testScript = ''
+  testScript =
-    import json
+    { nodes, ... }: # python
-    import re
+    ''
-    import time
+      import json
+      import re
+      import time
 
-    machine.wait_for_unit("glitchtip.service")
+      machine.wait_for_unit("glitchtip.service")
-    machine.wait_for_unit("glitchtip-worker.service")
+      machine.wait_for_unit("glitchtip-worker.service")
-    machine.wait_for_open_port(8000)
+      machine.wait_for_open_port(8000)
 
-    origin_url = "${domain}"
+      origin_url = "${domain}"
-    cookie_jar_path = "/tmp/cookies.txt"
+      cookie_jar_path = "/tmp/cookies.txt"
-    curl = f"curl -b {cookie_jar_path} -c {cookie_jar_path} -fS -H 'Origin: {origin_url}'"
+      curl = f"curl -b {cookie_jar_path} -c {cookie_jar_path} -fS -H 'Origin: {origin_url}'"
 
-    # create superuser account
+      # create superuser account
-    machine.succeed("DJANGO_SUPERUSER_PASSWORD=password glitchtip-manage createsuperuser --no-input --email=admin@example.com")
+      machine.succeed("DJANGO_SUPERUSER_PASSWORD=password glitchtip-manage createsuperuser --no-input --email=admin@example.com")
 
-    # login
+      # login
-    machine.fail(f"{curl} -s {origin_url}/_allauth/browser/v1/auth/session")  # get the csrf token, returns a 401
+      machine.fail(f"{curl} -s {origin_url}/_allauth/browser/v1/auth/session")  # get the csrf token, returns a 401
-    csrf_token = machine.succeed(f"grep csrftoken {cookie_jar_path} | cut -f7").rstrip()
+      csrf_token = machine.succeed(f"grep csrftoken {cookie_jar_path} | cut -f7").rstrip()
-    machine.succeed(f"{curl} {origin_url}/_allauth/browser/v1/auth/login -s -H 'X-Csrftoken: {csrf_token}' -H 'Content-Type: application/json' -d '{{\"email\": \"admin@example.com\", \"password\": \"password\"}}'")
+      machine.succeed(f"{curl} {origin_url}/_allauth/browser/v1/auth/login -s -H 'X-Csrftoken: {csrf_token}' -H 'Content-Type: application/json' -d '{{\"email\": \"admin@example.com\", \"password\": \"password\"}}'")
 
-    resp = json.loads(machine.succeed(f"{curl} {origin_url}/api/0/users/me/"))
+      resp = json.loads(machine.succeed(f"{curl} {origin_url}/api/0/users/me/"))
-    assert resp["email"] == "admin@example.com"
+      assert resp["email"] == "admin@example.com"
-    assert resp["isSuperuser"] is True
+      assert resp["isSuperuser"] is True
 
-    # create organization
+      # create organization
-    csrf_token = machine.succeed(f"grep csrftoken {cookie_jar_path} | cut -f7").rstrip()
+      csrf_token = machine.succeed(f"grep csrftoken {cookie_jar_path} | cut -f7").rstrip()
-    machine.succeed(f"{curl} {origin_url}/api/0/organizations/ -s -H 'X-Csrftoken: {csrf_token}' -H 'Content-Type: application/json' -d '{{\"name\": \"main\"}}'")
+      machine.succeed(f"{curl} {origin_url}/api/0/organizations/ -s -H 'X-Csrftoken: {csrf_token}' -H 'Content-Type: application/json' -d '{{\"name\": \"main\"}}'")
 
-    resp = json.loads(machine.succeed(f"{curl} {origin_url}/api/0/organizations/"))
+      resp = json.loads(machine.succeed(f"{curl} {origin_url}/api/0/organizations/"))
-    assert len(resp) == 1
+      assert len(resp) == 1
-    assert resp[0]["name"] == "main"
+      assert resp[0]["name"] == "main"
-    assert resp[0]["slug"] == "main"
+      assert resp[0]["slug"] == "main"
 
-    # create team
+      # create team
-    csrf_token = machine.succeed(f"grep csrftoken {cookie_jar_path} | cut -f7").rstrip()
+      csrf_token = machine.succeed(f"grep csrftoken {cookie_jar_path} | cut -f7").rstrip()
-    machine.succeed(f"{curl} {origin_url}/api/0/organizations/main/teams/ -s -H 'X-Csrftoken: {csrf_token}' -H 'Content-Type: application/json' -d '{{\"slug\": \"test\"}}'")
+      machine.succeed(f"{curl} {origin_url}/api/0/organizations/main/teams/ -s -H 'X-Csrftoken: {csrf_token}' -H 'Content-Type: application/json' -d '{{\"slug\": \"test\"}}'")
 
-    # create project
+      # create project
-    csrf_token = machine.succeed(f"grep csrftoken {cookie_jar_path} | cut -f7").rstrip()
+      csrf_token = machine.succeed(f"grep csrftoken {cookie_jar_path} | cut -f7").rstrip()
-    machine.succeed(f"{curl} {origin_url}/api/0/teams/main/test/projects/ -s -H 'X-Csrftoken: {csrf_token}' -H 'Content-Type: application/json' -d '{{\"name\": \"test\"}}'")
+      machine.succeed(f"{curl} {origin_url}/api/0/teams/main/test/projects/ -s -H 'X-Csrftoken: {csrf_token}' -H 'Content-Type: application/json' -d '{{\"name\": \"test\"}}'")
 
-    # fetch dsn
+      # fetch dsn
-    resp = json.loads(machine.succeed(f"{curl} {origin_url}/api/0/projects/main/test/keys/"))
+      resp = json.loads(machine.succeed(f"{curl} {origin_url}/api/0/projects/main/test/keys/"))
-    assert len(resp) == 1
+      assert len(resp) == 1
-    assert re.match(r"^http://[\da-f]+@glitchtip\.local:8000/\d+$", dsn := resp[0]["dsn"]["public"])
+      assert re.match(r"^http://[\da-f]+@glitchtip\.local:8000/\d+$", dsn := resp[0]["dsn"]["public"])
 
-    # send event
+      # send event
-    machine.succeed(f"SENTRY_DSN={dsn} sentry-cli send-event -m 'hello world'")
+      machine.succeed(f"SENTRY_DSN={dsn} sentry-cli send-event -m 'hello world'")
 
-    for _ in range(20):
+      for _ in range(20):
-      resp = json.loads(machine.succeed(f"{curl} {origin_url}/api/0/organizations/main/issues/?query=is:unresolved"))
+        resp = json.loads(machine.succeed(f"{curl} {origin_url}/api/0/organizations/main/issues/?query=is:unresolved"))
-      if len(resp) != 0: break
+        if len(resp) != 0: break
-      time.sleep(1)
+        time.sleep(1)
-    assert len(resp) == 1
+      assert len(resp) == 1
-    assert resp[0]["title"] == "hello world"
+      assert resp[0]["title"] == "hello world"
-    assert int(resp[0]["count"]) == 1
+      assert int(resp[0]["count"]) == 1
-  '';
+
+      # create api token
+      csrf_token = machine.succeed(f"grep csrftoken {cookie_jar_path} | cut -f7").rstrip()
+      resp = json.loads(machine.succeed(f"{curl} {origin_url}/api/0/api-tokens/ -s -H 'X-Csrftoken: {csrf_token}' -H 'Content-Type: application/json' -d '{{\"label\":\"token\",\"scopes\":[\"project:write\"]}}'"))
+      token = resp["token"]
+
+      # upload sourcemaps
+      machine.succeed(f"sentry-cli --url {origin_url} --auth-token {token} sourcemaps upload --org main --project test ${nodes.machine.services.glitchtip.package.frontend}/*.map")
+      assert machine.succeed("ls /var/lib/glitchtip/uploads/file_blobs/").strip()
+    '';
 }

nixos/tests/ifstate/default.nix

@@ -0,0 +1,10 @@
+{ runTest }:
+
+{
+  initrd = runTest ./initrd.nix;
+  initrd-partial-broken-config = runTest ./initrd-partial-broken-config.nix;
+  initrd-wireguard = runTest ./initrd-wireguard.nix;
+  partial-broken-config = runTest ./partial-broken-config.nix;
+  ping = runTest ./ping.nix;
+  wireguard = runTest ./wireguard.nix;
+}

nixos/tests/ifstate/initrd-partial-broken-config.nix

@@ -0,0 +1,79 @@
+let
+  mkIfStateConfig = id: {
+    enable = true;
+    settings.interfaces.eth1 = {
+      addresses = [ "2001:0db8::${builtins.toString id}/64" ];
+      link = {
+        state = "up";
+        kind = "physical";
+      };
+    };
+  };
+in
+{
+  name = "ifstate-initrd-partial-broken-config";
+
+  nodes = {
+    server =
+      { lib, ... }:
+      {
+        imports = [ ../../modules/profiles/minimal.nix ];
+
+        virtualisation.interfaces.eth1.vlan = 1;
+
+        # Initrd IfState enforces stage 2 ifstate using assertion.
+        networking.ifstate = {
+          enable = true;
+          settings.interfaces = { };
+        };
+
+        boot.initrd = {
+          network = {
+            enable = true;
+            ifstate = lib.mkMerge [
+              (mkIfStateConfig 1)
+              {
+                allowIfstateToDrasticlyIncreaseInitrdSize = true;
+
+                # non-existent interface; ifstate should apply eth1 and do not distrupt the boot process
+                settings.interfaces.eth2 = {
+                  addresses = [ "2001:0db8:b::dead:beef/64" ];
+                  link = {
+                    state = "up";
+                    kind = "physical";
+                  };
+                };
+              }
+            ];
+          };
+          systemd = {
+            enable = true;
+            network.enable = false;
+            services.boot-blocker = {
+              before = [ "initrd.target" ];
+              wantedBy = [ "initrd.target" ];
+              script = "sleep infinity";
+              serviceConfig.Type = "oneshot";
+            };
+          };
+        };
+      };
+
+    client = {
+      imports = [ ../../modules/profiles/minimal.nix ];
+
+      virtualisation.interfaces.eth1.vlan = 1;
+
+      networking.ifstate = mkIfStateConfig 2;
+    };
+  };
+
+  testScript = # python
+    ''
+      start_all()
+      client.wait_for_unit("network.target")
+
+      # try to ping the server from the client
+      client.wait_until_succeeds("ping -c 1 2001:0db8::1")
+    '';
+}

nixos/tests/ifstate/initrd-wireguard.nix

@@ -0,0 +1,121 @@
+let
+  mkNodeIfStateConfig =
+    {
+      pkgs,
+      id,
+      wgPriv,
+      wgPeerPubKey,
+      wgPeerId,
+    }:
+    {
+      enable = true;
+      settings = {
+        namespaces.outside.interfaces.eth1 = {
+          addresses = [ "2001:0db8:a::${builtins.toString id}/64" ];
+          link = {
+            state = "up";
+            kind = "physical";
+          };
+        };
+        interfaces = {
+          wg0 = {
+            addresses = [ "2001:0db8:b::${builtins.toString id}/64" ];
+            link = {
+              state = "up";
+              kind = "wireguard";
+              bind_netns = "outside";
+            };
+            wireguard = {
+              private_key = "!include ${pkgs.writeText "wg_priv.key" wgPriv}";
+              listen_port = 51820;
+              peers."${wgPeerPubKey}" = {
+                endpoint = "[2001:0db8:a::${builtins.toString wgPeerId}]:51820";
+                allowedips = [ "::/0" ];
+              };
+            };
+          };
+        };
+        routing.routes = [
+          {
+            to = "2001:0db8:b::/64";
+            dev = "wg0";
+          }
+        ];
+      };
+    };
+in
+{
+  name = "ifstate-initrd-wireguard";
+
+  nodes = {
+    foo =
+      { pkgs, ... }:
+      {
+        imports = [ ../../modules/profiles/minimal.nix ];
+
+        virtualisation.interfaces.eth1.vlan = 1;
+
+        # Initrd IfState enforces stage 2 ifstate using assertion.
+        networking.ifstate = {
+          enable = true;
+          settings.interfaces = { };
+        };
+
+        boot.initrd = {
+          network = {
+            enable = true;
+            ifstate =
+              mkNodeIfStateConfig {
+                inherit pkgs;
+                id = 1;
+                wgPriv = "6KmLyTyrN9OZIOCkdpiAwoVoeSiwvyI+mtn1wooKSEU=";
+                wgPeerPubKey = "olFuE7u5pVwSeWLFtrXSvD8+aCDBiKNKCLjLb/dgXiA=";
+                wgPeerId = 2;
+              }
+              // {
+                package = pkgs.ifstate.override {
+                  withConfigValidation = false;
+                };
+                allowIfstateToDrasticlyIncreaseInitrdSize = true;
+              };
+          };
+          systemd = {
+            enable = true;
+            network.enable = false;
+            services.boot-blocker = {
+              before = [ "initrd.target" ];
+              wantedBy = [ "initrd.target" ];
+              script = "sleep infinity";
+              serviceConfig.Type = "oneshot";
+            };
+          };
+        };
+      };
+
+    bar =
+      { pkgs, ... }:
+      {
+        imports = [ ../../modules/profiles/minimal.nix ];
+
+        virtualisation.interfaces.eth1.vlan = 1;
+
+        networking = {
+          ifstate = mkNodeIfStateConfig {
+            inherit pkgs;
+            id = 2;
+            wgPriv = "QN89cvFD0C8z1MSpUaJa1YBXt2MaIQegVkEYROi71Fg=";
+            wgPeerPubKey = "5qeKbAGc7wh9Xg0MoMXqXCSmp9TawmtI1bVk/vp3Cn4=";
+            wgPeerId = 1;
+          };
+        };
+      };
+  };
+  testScript = # python
+    ''
+      start_all()
+
+      bar.wait_for_unit("default.target")
+
+      bar.wait_until_succeeds("ping -c 1 2001:0db8:b::1")
+    '';
+}

nixos/tests/ifstate/initrd.nix

@@ -0,0 +1,65 @@
+let
+  mkIfStateConfig = id: {
+    enable = true;
+    settings.interfaces.eth1 = {
+      addresses = [ "2001:0db8::${builtins.toString id}/64" ];
+      link = {
+        state = "up";
+        kind = "physical";
+      };
+    };
+  };
+in
+{
+  name = "ifstate-initrd";
+
+  nodes = {
+    server = {
+      imports = [ ../../modules/profiles/minimal.nix ];
+
+      virtualisation.interfaces.eth1.vlan = 1;
+
+      # Initrd IfState enforces stage 2 ifstate using assertion.
+      networking.ifstate = {
+        enable = true;
+        settings.interfaces = { };
+      };
+
+      boot.initrd = {
+        network = {
+          enable = true;
+          ifstate = mkIfStateConfig 1 // {
+            allowIfstateToDrasticlyIncreaseInitrdSize = true;
+          };
+        };
+        systemd = {
+          enable = true;
+          network.enable = false;
+          services.boot-blocker = {
+            before = [ "initrd.target" ];
+            wantedBy = [ "initrd.target" ];
+            script = "sleep infinity";
+            serviceConfig.Type = "oneshot";
+          };
+        };
+      };
+    };
+
+    client = {
+      imports = [ ../../modules/profiles/minimal.nix ];
+
+      virtualisation.interfaces.eth1.vlan = 1;
+
+      networking.ifstate = mkIfStateConfig 2;
+    };
+  };
+
+  testScript = # python
+    ''
+      start_all()
+      client.wait_for_unit("network.target")
+
+      # try to ping the server from the client
+      client.wait_until_succeeds("ping -c 1 2001:0db8::1")
+    '';
+}

nixos/tests/ifstate/partial-broken-config.nix

@@ -0,0 +1,39 @@
+{
+  name = "ifstate-partial-broken-config";
+
+  nodes.machine = {
+    imports = [ ../../modules/profiles/minimal.nix ];
+
+    virtualisation.interfaces.eth1.vlan = 1;
+
+    networking.ifstate = {
+      enable = true;
+      settings.interfaces = {
+        eth1 = {
+          addresses = [ "2001:0db8:a::1/64" ];
+          link = {
+            state = "up";
+            kind = "physical";
+          };
+        };
+        # non-existent interface; ifstate should apply eth1 and do not distrupt the boot process
+        eth2 = {
+          addresses = [ "2001:0db8:b::1/64" ];
+          link = {
+            state = "up";
+            kind = "physical";
+          };
+        };
+      };
+    };
+  };
+
+  testScript = # python
+    ''
+      start_all()
+
+      machine.wait_for_unit("default.target")
+
+      machine.wait_until_succeeds("ping -c 1 2001:0db8:a::1")
+    '';
+}

nixos/tests/ifstate/ping.nix

@@ -0,0 +1,38 @@
+let
+  mkNode = id: {
+    imports = [ ../../modules/profiles/minimal.nix ];
+
+    virtualisation.interfaces.eth1.vlan = 1;
+
+    networking.ifstate = {
+      enable = true;
+      settings.interfaces.eth1 = {
+        addresses = [ "2001:0db8::${builtins.toString id}/64" ];
+        link = {
+          state = "up";
+          kind = "physical";
+        };
+      };
+    };
+  };
+in
+
+{
+  name = "ifstate-ping";
+
+  nodes = {
+    foo = mkNode 1;
+    bar = mkNode 2;
+  };
+
+  testScript = # python
+    ''
+      start_all()
+
+      foo.wait_for_unit("default.target")
+      bar.wait_for_unit("default.target")
+
+      foo.wait_until_succeeds("ping -c 1 2001:0db8::2")
+      bar.wait_until_succeeds("ping -c 1 2001:0db8::1")
+    '';
+}

nixos/tests/ifstate/wireguard.nix

@@ -0,0 +1,88 @@
+let
+  mkNode =
+    {
+      id,
+      wgPriv,
+      wgPeerPubKey,
+      wgPeerId,
+    }:
+    (
+      { pkgs, ... }:
+      {
+        imports = [ ../../modules/profiles/minimal.nix ];
+
+        virtualisation.interfaces.eth1.vlan = 1;
+
+        networking = {
+          firewall.interfaces.eth1.allowedUDPPorts = [ 51820 ];
+
+          ifstate = {
+            enable = true;
+            settings = {
+              namespaces.outside.interfaces.eth1 = {
+                addresses = [ "2001:0db8:a::${builtins.toString id}/64" ];
+                link = {
+                  state = "up";
+                  kind = "physical";
+                };
+              };
+              interfaces = {
+                wg0 = {
+                  addresses = [ "2001:0db8:b::${builtins.toString id}/64" ];
+                  link = {
+                    state = "up";
+                    kind = "wireguard";
+                    bind_netns = "outside";
+                  };
+                  wireguard = {
+                    private_key = "!include ${pkgs.writeText "wg_priv.key" wgPriv}";
+                    listen_port = 51820;
+                    peers."${wgPeerPubKey}" = {
+                      endpoint = "[2001:0db8:a::${builtins.toString wgPeerId}]:51820";
+                      allowedips = [ "::/0" ];
+                    };
+                  };
+                };
+              };
+              routing.routes = [
+                {
+                  to = "2001:0db8:b::/64";
+                  dev = "wg0";
+                }
+              ];
+            };
+          };
+        };
+      }
+    );
+in
+
+{
+  name = "ifstate-wireguard";
+
+  nodes = {
+    foo = mkNode {
+      id = 1;
+      wgPriv = "6KmLyTyrN9OZIOCkdpiAwoVoeSiwvyI+mtn1wooKSEU=";
+      wgPeerPubKey = "olFuE7u5pVwSeWLFtrXSvD8+aCDBiKNKCLjLb/dgXiA=";
+      wgPeerId = 2;
+    };
+    bar = mkNode {
+      id = 2;
+      wgPriv = "QN89cvFD0C8z1MSpUaJa1YBXt2MaIQegVkEYROi71Fg=";
+      wgPeerPubKey = "5qeKbAGc7wh9Xg0MoMXqXCSmp9TawmtI1bVk/vp3Cn4=";
+      wgPeerId = 1;
+    };
+  };
+
+  testScript = # python
+    ''
+      start_all()
+
+      foo.wait_for_unit("default.target")
+      bar.wait_for_unit("default.target")
+
+      foo.wait_until_succeeds("ping -c 1 2001:0db8:b::2")
+      bar.wait_until_succeeds("ping -c 1 2001:0db8:b::1")
+    '';
+}

nixos/tests/nix/upgrade.nix

@@ -1,10 +1,15 @@
-{ pkgs, nixVersions, ... }:
+{
+  pkgs,
+  nixVersions,
+  system,
+  ...
+}:
 let
   lib = pkgs.lib;
 
   fallback-paths-external = pkgs.writeTextDir "fallback-paths.nix" ''
     {
-      ${pkgs.system} = "${nixVersions.latest}";
+      ${system} = "${nixVersions.latest}";
     }'';
 
   nixos-module = builtins.toFile "nixos-module.nix" ''
@@ -71,7 +76,7 @@ pkgs.testers.nixosTest {
         if not match: raise Exception("Couldn't find new version in output: " + result)
 
     with subtest("nix-build-with-mismatch-daemon"):
-        machine.succeed("runuser -u alice -- nix build --expr 'derivation {name =\"test\"; system = \"${pkgs.system}\";builder = \"/bin/sh\"; args = [\"-c\" \"echo test > $out\"];}' --print-out-paths")
+        machine.succeed("runuser -u alice -- nix build --expr 'derivation {name =\"test\"; system = \"${system}\";builder = \"/bin/sh\"; args = [\"-c\" \"echo test > $out\"];}' --print-out-paths")
 
 
     with subtest("remove-new-nix"):
@@ -94,7 +99,7 @@ pkgs.testers.nixosTest {
         if not match: raise Exception("Couldn't find new version in output: " + result)
 
     with subtest("nix-build-with-new-daemon"):
-        machine.succeed("runuser -u alice -- nix build --expr 'derivation {name =\"test-new\"; system = \"${pkgs.system}\";builder = \"/bin/sh\"; args = [\"-c\" \"echo test > $out\"];}' --print-out-paths")
+        machine.succeed("runuser -u alice -- nix build --expr 'derivation {name =\"test-new\"; system = \"${system}\";builder = \"/bin/sh\"; args = [\"-c\" \"echo test > $out\"];}' --print-out-paths")
 
     with subtest("nix-collect-garbage-with-old-nix"):
         machine.succeed("${nixVersions.stable}/bin/nix-collect-garbage")

pkgs/applications/editors/vim/plugins/overrides.nix

@@ -638,6 +638,9 @@ assertNoAdditions {
       # Requires setup call
       "codecompanion.actions.static"
       "codecompanion.actions.init"
+      # Address in use error from fzf-lua on darwin
+      # https://github.com/NixOS/nixpkgs/issues/431458
+      "codecompanion.providers.actions.fzf_lua"
       # Test
       "minimal"
     ];

pkgs/applications/editors/vscode/extensions/default.nix

@@ -318,8 +318,8 @@ let
         mktplcRef = {
           name = "vscode-apollo";
           publisher = "apollographql";
-          version = "2.6.2";
+          version = "2.6.3";
-          hash = "sha256-jS+YPE+D0Q3bw8BCMFseL4xdiW5f6LV7JosgMG3Huo8=";
+          hash = "sha256-1F0iy5GhpuCqTrP/atoOyD0SWNOwa1sKXH14kN4FXNE=";
         };
         meta = {
           changelog = "https://marketplace.visualstudio.com/items/apollographql.vscode-apollo/changelog";

pkgs/applications/editors/vscode/extensions/ndonfris.fish-lsp/default.nix

@@ -7,8 +7,8 @@ vscode-utils.buildVscodeMarketplaceExtension {
   mktplcRef = {
     publisher = "ndonfris";
     name = "fish-lsp";
-    version = "0.1.11";
+    version = "0.1.13";
-    hash = "sha256-I3ikOGK++GL51BGZBPWAIGvWBOAw5himdQvANlPog0s=";
+    hash = "sha256-jPBcSQHuSvvWfc4KdtTkUJkx/fGYiAANFjABe4DzopQ=";
   };
 
   meta = {

pkgs/applications/networking/cluster/terraform-providers/providers.json

@@ -153,11 +153,11 @@
     "vendorHash": null
   },
   "azurerm": {
-    "hash": "sha256-gwodjIFYg6BTIz3ORzWD6tUn2QXwXMN1KC5mMvxyjdE=",
+    "hash": "sha256-rCWT9QmQnobfyqHtb1r/2XIgZEd4eA71eg6ffFQQZOU=",
     "homepage": "https://registry.terraform.io/providers/hashicorp/azurerm",
     "owner": "hashicorp",
     "repo": "terraform-provider-azurerm",
-    "rev": "v4.40.0",
+    "rev": "v4.42.0",
     "spdx": "MPL-2.0",
     "vendorHash": null
   },

pkgs/applications/virtualization/virt-manager/default.nix

@@ -34,13 +34,13 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "virt-manager";
-  version = "5.0.0";
+  version = "5.1.0";
 
   src = fetchFromGitHub {
     owner = pname;
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-KtB2VspkA/vFu7I8y6M8WfAoZglxmCeb4Z3OzdsGuvk=";
+    hash = "sha256-nMWLDo2pfWcqsVuEk0JbzLZ1a0lViTohsZ8gEXGhBuI=";
   };
 
   strictDeps = true;

pkgs/by-name/ac/act/package.nix

@@ -8,7 +8,7 @@
 }:
 
 let
-  version = "0.2.80";
+  version = "0.2.81";
 in
 buildGoModule {
   pname = "act";
@@ -18,7 +18,7 @@ buildGoModule {
     owner = "nektos";
     repo = "act";
     tag = "v${version}";
-    hash = "sha256-DGhZb83q1uC+5xvRTzWUXXKZjnaCP9y/CEu2EaL47I0=";
+    hash = "sha256-5HTdvJiX8F6SA2mzlcmzBlx8oiJ72j9Nfg64b6Ob8NQ=";
   };
 
   vendorHash = "sha256-v17TglIf+N3GfzHhutNX+nZeqVFheh/cXcCN1VgffT0=";

pkgs/by-name/an/angrr/package.nix

@@ -0,0 +1,50 @@
+{
+  lib,
+  rustPlatform,
+  fetchFromGitHub,
+  installShellFiles,
+  nixosTests,
+  testers,
+  nix-update-script,
+}:
+
+rustPlatform.buildRustPackage (finalAttrs: {
+  pname = "angrr";
+  version = "0.1.1";
+
+  src = fetchFromGitHub {
+    owner = "linyinfeng";
+    repo = "angrr";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-SL4UBDoD0pvpCKokQvKLAcS9cQJaFiA+IjswFARswdM=";
+  };
+
+  cargoHash = "sha256-lo9JpsHkvyrEqFnIiGlU2o4rREeQeqWpe9WMwisvw+4=";
+
+  nativeBuildInputs = [ installShellFiles ];
+  postInstall = ''
+    installShellCompletion --cmd angrr \
+      --bash <($out/bin/angrr completion bash) \
+      --fish <($out/bin/angrr completion fish) \
+      --zsh  <($out/bin/angrr completion zsh)
+  '';
+
+  passthru = {
+    tests = {
+      module = nixosTests.angrr;
+      version = testers.testVersion {
+        package = finalAttrs.finalPackage;
+      };
+    };
+    updateScript = nix-update-script { };
+  };
+
+  meta = {
+    description = "Tool for auto Nix GC roots retention";
+    homepage = "https://github.com/linyinfeng/angrr";
+    license = [ lib.licenses.mit ];
+    maintainers = with lib.maintainers; [ yinfeng ];
+    platforms = with lib.platforms; linux ++ darwin;
+    mainProgram = "angrr";
+  };
+})

pkgs/by-name/ba/bakelite/package.nix

@@ -7,13 +7,13 @@
 
 stdenv.mkDerivation {
   pname = "bakelite";
-  version = "0.4.2-unstable-2023-05-30";
+  version = "0.4.2-unstable-2024-08-02";
 
   src = fetchFromGitHub {
     owner = "richfelker";
     repo = "bakelite";
-    rev = "65d69e88e0972d1493ebbd9bf9d1bfde36272636";
+    rev = "bc79a16b4414702c579143154d94a86666e99b78";
-    hash = "sha256-OjBw9aYD2h7BWYgQzZp03hGCyQcRgmm2AjrcT/QrQAo=";
+    hash = "sha256-rRJrtCcgfbqC/4qQiTVeUUcPqoJlNfitYRqIO58AmpA=";
   };
 
   hardeningEnable = [ "pie" ];

pkgs/by-name/ba/bant/package.nix

@@ -20,13 +20,13 @@ let
 in
 buildBazelPackage rec {
   pname = "bant";
-  version = "0.2.1";
+  version = "0.2.2";
 
   src = fetchFromGitHub {
     owner = "hzeller";
     repo = "bant";
     rev = "v${version}";
-    hash = "sha256-xiTi4GrCeoI8hIEgYMAdzUPvJzYvXrvbo6MBq9my5Cw=";
+    hash = "sha256-wrzOszkqWDEylMDZYgtAqB837uWevWCwkhBhv9LGj4Y=";
   };
 
   bazelFlags = [

pkgs/by-name/bm/bmake/package.nix

@@ -57,12 +57,18 @@ stdenv.mkDerivation (finalAttrs: {
   # * opt-keep-going-indirect: not yet known
   # * varmod-localtime: musl doesn't support TZDIR and this test relies on
   #   impure, implicit paths
-  env.BROKEN_TESTS = builtins.concatStringsSep " " [
+  # * interrupt-compat (fails on x86_64-linux building for i686-linux)
-    "directive-export"
+  env.BROKEN_TESTS = lib.concatStringsSep " " (
-    "directive-export-gmake"
+    [
-    "opt-keep-going-indirect"
+      "directive-export"
-    "varmod-localtime"
+      "directive-export-gmake"
-  ];
+      "opt-keep-going-indirect"
+      "varmod-localtime"
+    ]
+    ++ lib.optionals stdenv.targetPlatform.is32bit [
+      "interrupt-compat"
+    ]
+  );
 
   strictDeps = true;
 

pkgs/by-name/bs/bs-manager/package.nix

@@ -19,20 +19,15 @@
 
 buildNpmPackage (finalAttrs: {
   pname = "bs-manager";
-  version = "1.5.3";
+  version = "1.5.4";
 
   src = fetchFromGitHub {
     owner = "Zagrios";
     repo = "bs-manager";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-thqz6sFmov5py7mUBYUC6ANBgjnNFC1hfLEsaxJVYu8=";
+    hash = "sha256-YitQjhnadQrpdBOV2CUedRNm/RW7/rpXtS9PJTa9kUU=";
   };
 
-  patches = [
-    # https://github.com/Zagrios/bs-manager/pull/870
-    ./use-steam-run-for-wine.patch
-  ];
-
   postPatch = ''
     # don't search for resources in electron's resource directory, but our own
     substituteInPlace src/main/services/utils.service.ts \
@@ -43,13 +38,13 @@ buildNpmPackage (finalAttrs: {
     ln -s ${finalAttrs.passthru.depotdownloader}/bin/DepotDownloader assets/scripts/DepotDownloader
   '';
 
-  npmDepsHash = "sha256-VsCbz7ImDnJ0tonVhA4lOPA0w//tqF4hLhrReLUqYI8=";
+  npmDepsHash = "sha256-3NMqYD7S4wYjwYuGJOmq2/C82qtG1mImsR4crjFLe30=";
 
   extraNpmDeps = fetchNpmDeps {
     name = "bs-manager-${finalAttrs.version}-extra-npm-deps";
     inherit (finalAttrs) src;
     sourceRoot = "${finalAttrs.src.name}/release/app";
-    hash = "sha256-JqDsv9kvYnbJdNwXN1EbppSrFVqr2cSnVhV2+8uw54g=";
+    hash = "sha256-UWsxty1kfxMr5fybtykrN2G+yiQ9dw/bbMwfcVLJgp4=";
   };
 
   makeCacheWritable = true;

pkgs/by-name/bs/bs-manager/use-steam-run-for-wine.patch

@@ -1,40 +0,0 @@
-diff --git a/src/main/services/linux.service.ts b/src/main/services/linux.service.ts
-index 7f92bed..5f12896 100644
---- a/src/main/services/linux.service.ts
-+++ b/src/main/services/linux.service.ts
-@@ -129,12 +129,7 @@ export class LinuxService {
-         return fs.pathExistsSync(protonPath) && fs.pathExistsSync(winePath);
-     }
- 
--    public async getWinePath(): Promise<string> {
--        if (await this.isNixOS()) {
--            // Use system wine for nixos
--            return "wine";
--        }
--
-+    public getWinePath(): string {
-         if (!this.staticConfig.has("proton-folder")) {
-             throw new Error("proton-folder variable not set");
-         }
-diff --git a/src/main/services/mods/bs-mods-manager.service.ts b/src/main/services/mods/bs-mods-manager.service.ts
-index c842fda..60cc190 100644
---- a/src/main/services/mods/bs-mods-manager.service.ts
-+++ b/src/main/services/mods/bs-mods-manager.service.ts
-@@ -162,12 +162,15 @@ export class BsModsManagerService {
-         let winePath: string = "";
-         if (process.platform === "linux") {
-             const { error: winePathError, result: winePathResult } =
--                await tryit(async () => this.linuxService.getWinePath());
-+                tryit(() => this.linuxService.getWinePath());
-             if (winePathError) {
-                 log.error(winePathError);
-                 return false;
-             }
--            winePath = `"${winePathResult}"`;
-+
-+            winePath = await this.linuxService.isNixOS()
-+                ? `steam-run "${winePathResult}"`
-+                : `"${winePathResult}"`;
- 
-             const winePrefix = this.linuxService.getWinePrefixPath();
-             if (!winePrefix) {

pkgs/by-name/ca/cargo-deb/package.nix

@@ -8,16 +8,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "cargo-deb";
-  version = "3.5.1";
+  version = "3.6.1";
 
   src = fetchFromGitHub {
     owner = "kornelski";
     repo = "cargo-deb";
     rev = "v${version}";
-    hash = "sha256-lTxMaYb7+cLQB+L8OJ8Q6HwD37Bw3kzRVLtovAJxpe0=";
+    hash = "sha256-/mPsmg2UUwjLKg0GjEGvg6qMswyBgwjP+HpldF3Wm/k=";
   };
 
-  cargoHash = "sha256-QidnhKXGcR4I+FULRrt+jTQNp+DE9SVW8wlH5Ypknqg=";
+  cargoHash = "sha256-HWA/CCDQNMKt2lHcPTByeg2z4TisafeN7Zgo/A+NOrE=";
 
   nativeBuildInputs = [
     makeWrapper

pkgs/by-name/ca/cargo-geiger/package.nix

@@ -15,16 +15,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "cargo-geiger";
-  version = "0.12.0";
+  version = "0.13.0";
 
   src = fetchFromGitHub {
     owner = "geiger-rs";
     repo = "cargo-geiger";
     tag = "cargo-geiger-${version}";
-    hash = "sha256-OW/LOZUCGOIl7jeWnzt4SXTo3gplJx/wbC21S1TdZx0=";
+    hash = "sha256-dZ71WbTKsR6g5UhWuJNfNAAqNNxbTgwL5fsgkm50BaM=";
   };
 
-  cargoHash = "sha256-aDgpEfX0QRkQD6c4ant6uSN18WLHVnZISRr7lyu9IzA=";
+  cargoHash = "sha256-GgCmUNOwvyTB82Y/ddgJIAb1SpO4mRPjECqCagJ8GmE=";
 
   buildInputs = [
     openssl

pkgs/by-name/ca/cargo-sort/package.nix

@@ -6,16 +6,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "cargo-sort";
-  version = "2.0.1";
+  version = "2.0.2";
 
   src = fetchFromGitHub {
     owner = "devinr528";
     repo = "cargo-sort";
     rev = "v${version}";
-    sha256 = "sha256-OFDEM/qYIaWsjHKZhf/kmJo7drY+649gpe4VSE18sXc=";
+    sha256 = "sha256-mdvaRTcs2zVXKX8LrqHFrWTdnFZpAfQuWjYmeWgdGVI=";
   };
 
-  cargoHash = "sha256-nQ1g0rBWx7yHQO9U/J0/XI76quEAvpCyhZDcTJKYYXo=";
+  cargoHash = "sha256-FoFzBf24mNDTRBfFyTEr9Q7sJjUhs0X/XWRGEoierQ4=";
 
   meta = {
     description = "Tool to check that your Cargo.toml dependencies are sorted alphabetically";

pkgs/by-name/cn/cnquery/package.nix

@@ -6,13 +6,13 @@
 
 buildGoModule rec {
   pname = "cnquery";
-  version = "11.68.0";
+  version = "11.69.1";
 
   src = fetchFromGitHub {
     owner = "mondoohq";
     repo = "cnquery";
     tag = "v${version}";
-    hash = "sha256-CmFWfXyMQJ6/wLjSQiwh3Yu1RPlopNesEbp8moj5wG8=";
+    hash = "sha256-Iq44LRKPQq5TWfkoXbqOxUquMdImNU8Jz4ojvmCI310=";
   };
 
   subPackages = [ "apps/cnquery" ];

pkgs/by-name/co/codecrafters-cli/package.nix

@@ -7,13 +7,13 @@
 
 buildGoModule rec {
   pname = "codecrafters-cli";
-  version = "36";
+  version = "37";
 
   src = fetchFromGitHub {
     owner = "codecrafters-io";
     repo = "cli";
     tag = "v${version}";
-    hash = "sha256-YgQPDc5BUIoEd44NLpRluxCKooW99qvcSTrFPm6qJKM=";
+    hash = "sha256-MxeWShst5QZPXImXnCEGYSVzqB4HNygewrQxpwmfafk=";
     # A shortened git commit hash is part of the version output, and is
     # needed at build time. Use the `.git` directory to retrieve the
     # commit SHA, and remove the directory afterwards since it is not needed

pkgs/by-name/cp/cpp-jwt/package.nix

@@ -10,13 +10,13 @@
 
 stdenv.mkDerivation rec {
   pname = "cpp-jwt";
-  version = "1.5";
+  version = "1.5.1";
 
   src = fetchFromGitHub {
     owner = "arun11299";
     repo = "cpp-jwt";
     rev = "v${version}";
-    sha256 = "sha256-l1FevNhGX7vouKmGh/ypCcmZQLMpHJ4JFUp5dnNMEwg=";
+    sha256 = "sha256-TyLYTk7vlpNmYJxaH9zhGwFvv1BEcShTDr7JYfgu6f0=";
   };
 
   cmakeFlags = [

pkgs/by-name/gh/gh-f/package.nix

@@ -15,13 +15,13 @@
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "gh-f";
-  version = "1.6.0";
+  version = "1.7.0";
 
   src = fetchFromGitHub {
     owner = "gennaro-tedesco";
     repo = "gh-f";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-kldhK5ChwHRv7joD9uyCAk1Gdc8+2IyubAB04j8/LPA=";
+    hash = "sha256-rMGyiXniW3M4JnsWufXcsU8mL8KlrIRGGgbQT6utnuc=";
   };
 
   nativeBuildInputs = [ makeBinaryWrapper ];

pkgs/by-name/gh/gh-s/package.nix

@@ -6,13 +6,13 @@
 
 buildGoModule rec {
   pname = "gh-s";
-  version = "0.0.11";
+  version = "0.0.12";
 
   src = fetchFromGitHub {
     owner = "gennaro-tedesco";
     repo = "gh-s";
     rev = "v${version}";
-    hash = "sha256-I1r3FW+qWKRFukeXot009CbH/JbYeCjvoRKrvsyjDJE=";
+    hash = "sha256-+jAJicvk6N2PfOTBR5H9nP3xTiBq4oYfNLvxN4sKvh4=";
   };
 
   vendorHash = "sha256-5UJAgsPND6WrOZZ5PUZNdwd7/0NPdhD1SaZJzZ+2VvM=";

pkgs/by-name/gl/glooctl/package.nix

@@ -7,16 +7,16 @@
 
 buildGoModule rec {
   pname = "glooctl";
-  version = "1.19.4";
+  version = "1.19.6";
 
   src = fetchFromGitHub {
     owner = "solo-io";
     repo = "gloo";
     rev = "v${version}";
-    hash = "sha256-6esnWLO0+6Tst8eplemgs1Z2Ibk+D3ipFHxcBWF3/6w=";
+    hash = "sha256-jH/QnRGeuYv7e7QNGLvVhLwvX5kHtqArOUPYdXcKURw=";
   };
 
-  vendorHash = "sha256-n42H8c4KqgEannLpEdpKSz7J4UZ+lpVhDAE7ZuBKdCU=";
+  vendorHash = "sha256-OJeWijGwxuBd0Qsscy7wjTkzglUZg+jHuPX1s1ayZVI=";
 
   subPackages = [ "projects/gloo/cli/cmd" ];
 

pkgs/by-name/go/goose-cli/package.nix

@@ -27,16 +27,16 @@ let
 in
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "goose-cli";
-  version = "1.4.0";
+  version = "1.6.0";
 
   src = fetchFromGitHub {
     owner = "block";
     repo = "goose";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-xXQFhGwI5aZfRzJ17WXcpOHnaE1MW2S6uje8qSC3NU4=";
+    hash = "sha256-ZfS0U7PpGWWuqGKd7IjRaavqZSySx93F9S1d7r2wMkE=";
   };
 
-  cargoHash = "sha256-b8u226CSW/85HoVuDYGc0cbCA61ZOsrngenZKMgY4us=";
+  cargoHash = "sha256-uYgYzP75QkN1VksYL3KeNMNy7wb0TgCP8HPN1QrfZoo=";
 
   nativeBuildInputs = [
     pkg-config
@@ -58,20 +58,14 @@ rustPlatform.buildRustPackage (finalAttrs: {
   __darwinAllowLocalNetworking = true;
 
   checkFlags = [
-    # need dbus-daemon
+    # need dbus-daemon for keychain access
     "--skip=config::base::tests::test_multiple_secrets"
     "--skip=config::base::tests::test_secret_management"
     "--skip=config::base::tests::test_concurrent_extension_writes"
+    "--skip=config::signup_tetrate::tests::test_configure_tetrate"
     # Observer should be Some with both init project keys set
     "--skip=tracing::langfuse_layer::tests::test_create_langfuse_observer"
     "--skip=providers::gcpauth::tests::test_token_refresh_race_condition"
-    # Lazy instance has previously been poisoned
-    "--skip=jetbrains::tests::test_capabilities"
-    "--skip=jetbrains::tests::test_router_creation"
-    "--skip=logging::tests::test_log_file_name::with_session_name_and_error_capture"
-    "--skip=logging::tests::test_log_file_name::with_session_name_without_error_capture"
-    "--skip=logging::tests::test_log_file_name::without_session_name"
-    "--skip=developer::tests::test_text_editor_str_replace"
     # need API keys
     "--skip=providers::factory::tests::test_create_lead_worker_provider"
     "--skip=providers::factory::tests::test_create_regular_provider_without_lead_config"
@@ -87,15 +81,12 @@ rustPlatform.buildRustPackage (finalAttrs: {
     "--skip=transport::streamable_http::tests::test_handle_outgoing_message_session_id_handling"
     "--skip=transport::streamable_http::tests::test_handle_outgoing_message_session_not_found"
     "--skip=transport::streamable_http::tests::test_handle_outgoing_message_successful_request"
+  ]
+  ++ lib.optionals stdenv.hostPlatform.isLinux [
     "--skip=context_mgmt::auto_compact::tests::test_auto_compact_respects_config"
   ]
   ++ lib.optionals stdenv.hostPlatform.isDarwin [
-    "--skip=providers::gcpauth::tests::test_load_from_metadata_server"
+    "--skip=logging::tests::test_log_file_name_no_session"
-    "--skip=providers::oauth::tests::test_get_workspace_endpoints"
-    "--skip=tracing::langfuse_layer::tests::test_batch_manager_spawn_sender"
-    "--skip=tracing::langfuse_layer::tests::test_batch_send_partial_failure"
-    "--skip=tracing::langfuse_layer::tests::test_batch_send_success"
-    "--skip=logging::tests::test_log_file_name_session_without_error_capture"
     "--skip=recipes::extract_from_cli::tests::test_extract_recipe_info_from_cli_basic"
     "--skip=recipes::extract_from_cli::tests::test_extract_recipe_info_from_cli_with_additional_sub_recipes"
     "--skip=recipes::recipe::tests::load_recipe::test_load_recipe_success"

pkgs/by-name/hm/hmcl/package.nix

@@ -31,13 +31,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "hmcl";
-  version = "3.6.15";
+  version = "3.6.16";
 
   src = fetchurl {
     # HMCL has built-in keys, such as the Microsoft OAuth secret and the CurseForge API key.
     # See https://github.com/HMCL-dev/HMCL/blob/refs/tags/release-3.6.12/.github/workflows/gradle.yml#L26-L28
     url = "https://github.com/HMCL-dev/HMCL/releases/download/release-${finalAttrs.version}/HMCL-${finalAttrs.version}.jar";
-    hash = "sha256-F+QixbA6zEA1qW3yb8MhJNurU8/2jZAEbfQU9cJ7zT4=";
+    hash = "sha256-C3a8pjMllkmTpChucFBunW8uixnnvqrXg06BhLAg6Y8=";
   };
 
   icon = fetchurl {

pkgs/by-name/if/ifstate/package.nix

@@ -0,0 +1,87 @@
+{
+  lib,
+  python3Packages,
+  fetchFromGitea,
+  iproute2,
+  libbpf,
+  nixosTests,
+  withBpf ? false,
+  withConfigValidation ? true,
+  withShellColor ? false,
+  withWireguard ? true,
+}:
+
+let
+  self = python3Packages.buildPythonApplication rec {
+    pname = "ifstate";
+    version = "2.0.0";
+    pyproject = true;
+
+    src = fetchFromGitea {
+      domain = "codeberg.org";
+      owner = "liske";
+      repo = "ifstate";
+      tag = version;
+      hash = "sha256-YxLyiTVLN4nxc2ppqGGnYCGudbdPLSLV8EwDURtpO0U=";
+    };
+
+    postPatch = ''
+      substituteInPlace libifstate/routing/__init__.py \
+        --replace-fail '/usr/share/iproute2' '${iproute2}/share/iproute2'
+    ''
+    + lib.optionalString withBpf ''
+      substituteInPlace libifstate/bpf/ctypes.py \
+        --replace-fail 'libbpf.so.1' '${libbpf}/lib/libbpf.so.1'
+    '';
+
+    build-system = with python3Packages; [
+      setuptools
+    ];
+
+    dependencies =
+      with python3Packages;
+      [
+        pyroute2
+        pyyaml
+        setproctitle
+      ]
+      ++ lib.optional withConfigValidation jsonschema
+      ++ lib.optional withShellColor pygments
+      ++ lib.optional withWireguard wgnlpy;
+
+    pythonRemoveDeps = lib.optional (!withConfigValidation) "jsonschema";
+
+    # has no unit tests
+    doCheck = false;
+
+    pythonImportsCheck = [
+      "libifstate"
+      "ifstate"
+    ];
+
+    passthru = {
+      tests = nixosTests.ifstate;
+      features = {
+        inherit
+          withBpf
+          withConfigValidation
+          withShellColor
+          withWireguard
+          ;
+      };
+      # needed for access in schema validaten in module
+      jsonschema = "${self}/${python3Packages.python.sitePackages}/libifstate/schema/2/ifstate.conf.schema.json";
+    };
+
+    meta = {
+      description = "Manage host interface settings in a declarative manner";
+      homepage = "https://ifstate.net";
+      changelog = "https://codeberg.org/liske/ifstate/src/tag/${src.tag}/CHANGELOG.md";
+      platforms = lib.platforms.linux;
+      license = lib.licenses.gpl3Plus;
+      maintainers = with lib.maintainers; [ marcel ];
+      mainProgram = "ifstatecli";
+    };
+  };
+in
+self

pkgs/by-name/io/iosevka/package.nix

@@ -56,16 +56,16 @@ assert (extraParameters != null) -> set != null;
 
 buildNpmPackage rec {
   pname = "Iosevka${toString set}";
-  version = "33.2.8";
+  version = "33.2.9";
 
   src = fetchFromGitHub {
     owner = "be5invis";
     repo = "iosevka";
     rev = "v${version}";
-    hash = "sha256-rHkIvfS20A0cvFBcLfFLAvcVVF5BgbtMdDxMvwH0B+I=";
+    hash = "sha256-EC3daY7R2AhqrE62dp6sT5BspyZkLccuC5PnBibeRaI=";
   };
 
-  npmDepsHash = "sha256-PYzNg5gduwtwc99GyatXnmHCh9mpAulz43Ehdle0rAM=";
+  npmDepsHash = "sha256-ekODYQ1GjGytlcX4VGIfyl5kPEWW/9VL/He0BBtWeK0=";
 
   nativeBuildInputs = [
     remarshal

pkgs/by-name/jo/josm/package.nix

@@ -11,20 +11,20 @@
 }:
 let
   pname = "josm";
-  version = "19423";
+  version = "19439";
   srcs = {
     jar = fetchurl {
       url = "https://josm.openstreetmap.de/download/josm-snapshot-${version}.jar";
-      hash = "sha256-s8aMV31NsDFE5XLP523PH3RNvq78eTAa+UvmjyY5a+E=";
+      hash = "sha256-EuboKKNpApYlh9b78oB5AbtOM38oMe3NEa4fovA78Uk=";
     };
     macosx = fetchurl {
       url = "https://josm.openstreetmap.de/download/macosx/josm-macos-${version}-java21.zip";
-      hash = "sha256-8eps1eTUn9FHHYwECH/742PV7wnnRO08dlZmaxd1aZU=";
+      hash = "sha256-b38Xd0qx0ceNtJ5UIWDJkGOvaHSB/46onPbd6LJ6siY=";
     };
     pkg = fetchsvn {
       url = "https://josm.openstreetmap.de/svn/trunk/native/linux/tested";
       rev = version;
-      hash = "sha256-4mK+IdVRDhINJqzOovw7YPNiJmFxTCIfYVNMXKSdBv0=";
+      hash = "sha256-9YTSX4chUxijtJ7a1pLE2kYo9hdOB/8vnnfFqMeXKbE=";
     };
   };
 

pkgs/by-name/jo/josm/update.sh

@@ -11,7 +11,7 @@ version="$(curl https://josm.openstreetmap.de/apt/pool/universe/j/josm/ |
   sort -n |
   tail -n1)"
 
-pkgHash="$(nurl -H https://github.com/JOSM/josm "$version-tested")"
+pkgHash="$(nurl -f fetchsvn -H https://josm.openstreetmap.de/svn/trunk/native/linux/tested "$version")"
 
 update-source-version josm "$version" --source-key=srcs.jar
 update-source-version josm "$version" --ignore-same-version --source-key=srcs.macosx

pkgs/by-name/jr/jreleaser-cli/package.nix

@@ -7,11 +7,11 @@
 }:
 stdenv.mkDerivation rec {
   pname = "jreleaser-cli";
-  version = "1.19.0";
+  version = "1.20.0";
 
   src = fetchurl {
     url = "https://github.com/jreleaser/jreleaser/releases/download/v${version}/jreleaser-tool-provider-${version}.jar";
-    hash = "sha256-tUliZBRHAXgv+FR5z298IAG3egTTqwhRYt8r96gdtdM=";
+    hash = "sha256-47MpBFUEHx2yVk05Gd9CyVrHYHRK7NtcGosBJJbdhD0=";
   };
 
   nativeBuildInputs = [ makeWrapper ];

pkgs/by-name/ka/katana/package.nix

@@ -6,16 +6,16 @@
 
 buildGoModule rec {
   pname = "katana";
-  version = "1.2.1";
+  version = "1.2.2";
 
   src = fetchFromGitHub {
     owner = "projectdiscovery";
     repo = "katana";
     tag = "v${version}";
-    hash = "sha256-ldTK8Y6//goFhalF4BaLtbMkwoKJd1NDzUR9pLDRBD8=";
+    hash = "sha256-q7uOtfxSS6cLZKjnObLAzn+JpC2myEkoTd2TINBhYcU=";
   };
 
-  vendorHash = "sha256-st7gj4hynuY1dDUEhA4xbiOnxH3jV5T2RK+PhB46Lpk=";
+  vendorHash = "sha256-9RoL6gpAJXO2/0UCmpRnh8roZw/txNgb/H0kVTKVxWs=";
 
   subPackages = [ "cmd/katana" ];
 

pkgs/by-name/ki/kind/package.nix

@@ -10,13 +10,13 @@
 
 buildGoModule rec {
   pname = "kind";
-  version = "0.29.0";
+  version = "0.30.0";
 
   src = fetchFromGitHub {
     rev = "v${version}";
     owner = "kubernetes-sigs";
     repo = "kind";
-    hash = "sha256-Dv4I50LQcr8fOaCCdaKkz+pHIG05UBQAdDs7gGngm4Y=";
+    hash = "sha256-TssyKO5v3xqSDjS3DYIlO7iOx/zzS3E9O88V9R7S5Ac=";
   };
 
   patches = [
@@ -24,7 +24,7 @@ buildGoModule rec {
     ./kernel-module-path.patch
   ];
 
-  vendorHash = "sha256-QFDQkl1QuIc0fUK0raVxmPT7AF6fsKlQ4F0dzOM9fcw=";
+  vendorHash = "sha256-tRpylYpEGF6XqtBl7ESYlXKEEAt+Jws4x4VlUVW8SNI=";
 
   nativeBuildInputs = [ installShellFiles ];
 

pkgs/by-name/kr/krelay/package.nix

@@ -6,16 +6,16 @@
 
 buildGoModule rec {
   pname = "krelay";
-  version = "0.1.2";
+  version = "0.1.3";
 
   src = fetchFromGitHub {
     owner = "knight42";
     repo = "krelay";
     rev = "v${version}";
-    hash = "sha256-TonkGh4j+xLGgSpspCedg6c2NpIZIzp5pv8VtWFssPk=";
+    hash = "sha256-v7yX5wDf3d07TiWe+9iTkGhc8LqfU1hUkxuf5ZBVcYE=";
   };
 
-  vendorHash = "sha256-Qz3q/503A5QmsgEaDqChxS2tcUEJGmeT6YE6R3LBbcY=";
+  vendorHash = "sha256-9bOU9Zqqb4tdQCIB3UkTdAcD4cn6+7C35gOCywv1/Os=";
 
   subPackages = [ "cmd/client" ];
 

pkgs/by-name/ku/kubedb-cli/package.nix

@@ -6,13 +6,13 @@
 
 buildGoModule rec {
   pname = "kubedb-cli";
-  version = "0.57.0";
+  version = "0.58.0";
 
   src = fetchFromGitHub {
     owner = "kubedb";
     repo = "cli";
     tag = "v${version}";
-    hash = "sha256-U2VdWer9jOW+GmzndyXt9nD7HlUIvljROeS/gL3ZJAc=";
+    hash = "sha256-DfvYWA2D+TuIz5nQnzFHatR9yl8nos7byMz7uK+q7w0=";
   };
 
   vendorHash = null;

pkgs/by-name/ku/kubernetes-polaris/package.nix

@@ -7,13 +7,13 @@
 
 buildGoModule rec {
   pname = "kubernetes-polaris";
-  version = "10.1.0";
+  version = "10.1.1";
 
   src = fetchFromGitHub {
     owner = "FairwindsOps";
     repo = "polaris";
     rev = version;
-    sha256 = "sha256-/YK9Xz/zYksFCde9uoTXrVbaOQ3V7EoSaoWnrSR9Oq8=";
+    sha256 = "sha256-1viEKPU+V+VqFDnrtjSTvNLtgE3TB1ijKv1YOz6AAUo=";
   };
 
   vendorHash = "sha256-4eznwhNf3anhs+GlZGrHJWAproej0dO2NbzfhJeReNY=";

pkgs/by-name/la/lavacli/package.nix

@@ -6,14 +6,14 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "lavacli";
-  version = "2.2.0";
+  version = "2.4";
   pyproject = true;
 
   src = fetchFromGitLab {
     owner = "lava";
     repo = "lavacli";
     tag = "v${version}";
-    hash = "sha256-Pfsf2a5y3rpoTGY3PmNdq9ojSjBVBfawz/LTQmIQ2vU=";
+    hash = "sha256-KNq+UNOC3N+p0HOed2Mdh9EIXLQccH+aepdfJ59Z2oM=";
   };
 
   build-system = with python3.pkgs; [

pkgs/by-name/li/libvgm/package.nix

@@ -38,13 +38,13 @@ assert enableTools -> enableAudio && enableEmulation && enableLibplayer;
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "libvgm";
-  version = "0-unstable-2025-07-14";
+  version = "0-unstable-2025-08-31";
 
   src = fetchFromGitHub {
     owner = "ValleyBell";
     repo = "libvgm";
-    rev = "7cad78367fa35c3f7b3ae16a296d31063cd3a7e4";
+    rev = "e9f2b023e8918b56be0d2e634b3f5aab2a589ffe";
-    hash = "sha256-8Hnr9VeVkrvRe1mwCUBGhSwYYYXxbby+aQU+KBrSyRM=";
+    hash = "sha256-jnjIWB+1IndV7XljG4lUJ93zP9Emlxlx+EWH4xdtLGE=";
   };
 
   outputs = [

pkgs/by-name/li/limine/package.nix

@@ -42,14 +42,14 @@ in
 # as bootloader for various platforms and corresponding binary and helper files.
 stdenv.mkDerivation (finalAttrs: {
   pname = "limine";
-  version = "9.6.1";
+  version = "9.6.5";
 
   # We don't use the Git source but the release tarball, as the source has a
   # `./bootstrap` script performing network access to download resources.
   # Packaging that in Nix is very cumbersome.
   src = fetchurl {
-    url = "https://github.com/limine-bootloader/limine/releases/download/v${finalAttrs.version}/limine-${finalAttrs.version}.tar.gz";
+    url = "https://codeberg.org/Limine/Limine/releases/download/v${finalAttrs.version}/limine-${finalAttrs.version}.tar.gz";
-    hash = "sha256-/GAeZx2ShtC+VoqNO/SB8H4kLLgdLAc/RAGVxF6Imbc=";
+    hash = "sha256-d3teFW6eSKG+VIWbuOs5a9f0cxv2Fssepkcjfle7Ems=";
   };
 
   enableParallelBuilding = true;
@@ -84,7 +84,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   meta = {
     homepage = "https://limine-bootloader.org/";
-    changelog = "https://raw.githubusercontent.com/limine-bootloader/limine/refs/tags/v${finalAttrs.version}/ChangeLog";
+    changelog = "https://codeberg.org/Limine/Limine/raw/tag/v${finalAttrs.version}/ChangeLog";
     description = "Limine Bootloader";
     mainProgram = "limine";
     # The platforms on that the Limine binary and helper tools can run, not
@@ -95,11 +95,11 @@ stdenv.mkDerivation (finalAttrs: {
     license = with lib.licenses; [
       asl20 # cc-runtime
       bsd0 # freestanding-headers, freestanding-toolchain
-      bsd2 # limine, flanterm, libfdt, nyu-efi
+      bsd2 # limine, flanterm, libfdt, PicoEFI
-      bsd2Patent # nyu-efi
+      bsd2Patent # PicoEFI
-      bsd3 # nyu-efi
+      bsd3 # PicoEFI
-      bsdAxisNoDisclaimerUnmodified # nyu-efi
+      bsdAxisNoDisclaimerUnmodified # PicoEFI
-      mit # nyu-efi, stb_image
+      mit # PicoEFI, stb_image
       zlib # tinf
     ];
     maintainers = with lib.maintainers; [

pkgs/by-name/ma/mailpit/package.nix

@@ -5,6 +5,7 @@
   nodejs,
   python3,
   libtool,
+  cctools,
   npmHooks,
   fetchFromGitHub,
   fetchNpmDeps,
@@ -28,6 +29,8 @@ let
     hash = source.hash;
   };
 
+  libtool' = if stdenv.hostPlatform.isDarwin then cctools else libtool;
+
   # Separate derivation, because if we mix this in buildGoModule, the separate
   # go-modules build inherits specific attributes and fails. Getting that to
   # work is hackier than just splitting the build.
@@ -43,7 +46,7 @@ let
     nativeBuildInputs = [
       nodejs
       python3
-      libtool
+      libtool'
       npmHooks.npmConfigHook
     ];
 
@@ -78,7 +81,7 @@ buildGoModule {
     inherit (nixosTests) mailpit;
     version = testers.testVersion {
       package = mailpit;
-      command = "mailpit version";
+      command = "mailpit version --no-release-check";
     };
   };
 

pkgs/by-name/ma/mailpit/source.nix

@@ -0,0 +1,6 @@
+{
+  version = "1.27.7";
+  hash = "sha256-VMfts0tfvW2IeEwSXSjlYLe9vQbZdZ9MrLIa9QUJYr4=";
+  npmDepsHash = "sha256-XRg3dnB3M0KwXV4qP//z11434WsLAxSGjqAb92bHawk=";
+  vendorHash = "sha256-tMxhHxc3SmxKo358W3Fr15RPaE3iJ1ETQRWpN0AVmE4=";
+}

pkgs/by-name/me/memray/package.nix

@@ -20,6 +20,14 @@ python3Packages.buildPythonApplication rec {
     hash = "sha256-bShFMuDJlvBA3rQJRwXlsgRk4q+gdFQjOpDzOrp4/8k=";
   };
 
+  # AttributeError: 'Label' object has no attribute 'renderable'.
+  # In textual==0.6.0, the `renderable` property was renamed to `content`
+  # https://github.com/Textualize/textual/pull/6041
+  postPatch = ''
+    substituteInPlace tests/unit/test_tui_reporter.py \
+      --replace-fail ".renderable" ".content"
+  '';
+
   build-system = with python3Packages; [
     distutils
     setuptools

pkgs/by-name/mi/microsoft-edge/package.nix

@@ -162,11 +162,11 @@ let
 in
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "microsoft-edge";
-  version = "139.0.3405.111";
+  version = "139.0.3405.125";
 
   src = fetchurl {
     url = "https://packages.microsoft.com/repos/edge/pool/main/m/microsoft-edge-stable/microsoft-edge-stable_${finalAttrs.version}-1_amd64.deb";
-    hash = "sha256-1hsvzvaVCDSWGEpqMjsrz7V9Ra+PtoZ//lSXSlmS3FI=";
+    hash = "sha256-MqJPlFoPiTIReXRhLJGR+nbOVwWcpiHTMr5s+M6KXqE=";
   };
 
   # With strictDeps on, some shebangs were not being patched correctly

pkgs/by-name/ne/neovim-unwrapped/package.nix

@@ -95,7 +95,7 @@ stdenv.mkDerivation (
   in
   {
     pname = "neovim-unwrapped";
-    version = "0.11.3";
+    version = "0.11.4";
 
     __structuredAttrs = true;
 
@@ -103,7 +103,7 @@ stdenv.mkDerivation (
       owner = "neovim";
       repo = "neovim";
       tag = "v${finalAttrs.version}";
-      hash = "sha256-B/An+SiRWC3Ea0T/sEk8aNBS1Ab9OENx/l4Z3nn8xE4=";
+      hash = "sha256-IpMHxIDpldg4FXiXPEY2E51DfO/Z5XieKdtesLna9Xw=";
     };
 
     patches = [

pkgs/by-name/ne/neovim-unwrapped/treesitter-parsers.nix

@@ -2,27 +2,27 @@
 
 {
   c.src = fetchurl {
-    url = "https://github.com/tree-sitter/tree-sitter-c/archive/v0.23.4.tar.gz";
+    url = "https://github.com/tree-sitter/tree-sitter-c/archive/v0.24.1.tar.gz";
-    hash = "sha256:b66c5043e26d84e5f17a059af71b157bcf202221069ed220aa1696d7d1d28a7a";
+    hash = "sha256:25dd4bb3dec770769a407e0fc803f424ce02c494a56ce95fedc525316dcf9b48";
   };
   lua.src = fetchurl {
-    url = "https://github.com/tree-sitter-grammars/tree-sitter-lua/archive/v0.3.0.tar.gz";
+    url = "https://github.com/tree-sitter-grammars/tree-sitter-lua/archive/v0.4.0.tar.gz";
-    hash = "sha256:a34cc70abfd8d2d4b0fabf01403ea05f848e1a4bc37d8a4bfea7164657b35d31";
+    hash = "sha256:b0977aced4a63bb75f26725787e047b8f5f4a092712c840ea7070765d4049559";
   };
   vim.src = fetchurl {
-    url = "https://github.com/tree-sitter-grammars/tree-sitter-vim/archive/v0.5.0.tar.gz";
+    url = "https://github.com/tree-sitter-grammars/tree-sitter-vim/archive/v0.7.0.tar.gz";
-    hash = "sha256:90019d12d2da0751c027124f27f5335babf069a050457adaed53693b5e9cf10a";
+    hash = "sha256:44eabc31127c4feacda19f2a05a5788272128ff561ce01093a8b7a53aadcc7b2";
   };
   vimdoc.src = fetchurl {
-    url = "https://github.com/neovim/tree-sitter-vimdoc/archive/v3.0.1.tar.gz";
+    url = "https://github.com/neovim/tree-sitter-vimdoc/archive/v4.0.0.tar.gz";
-    hash = "sha256:76b65e5bee9ff78eb21256619b1995aac4d80f252c19e1c710a4839481ded09e";
+    hash = "sha256:8096794c0f090b2d74b7bff94548ac1be3285b929ec74f839bd9b3ff4f4c6a0b";
   };
   query.src = fetchurl {
-    url = "https://github.com/tree-sitter-grammars/tree-sitter-query/archive/v0.5.1.tar.gz";
+    url = "https://github.com/tree-sitter-grammars/tree-sitter-query/archive/v0.6.2.tar.gz";
-    hash = "sha256:fe8c712880a529d454347cd4c58336ac2db22243bae5055bdb5844fb3ea56192";
+    hash = "sha256:90682e128d048fbf2a2a17edca947db71e326fa0b3dba4136e041e096538b4eb";
   };
   markdown.src = fetchurl {
-    url = "https://github.com/tree-sitter-grammars/tree-sitter-markdown/archive/v0.4.1.tar.gz";
+    url = "https://github.com/tree-sitter-grammars/tree-sitter-markdown/archive/v0.5.0.tar.gz";
-    hash = "sha256:e0fdb2dca1eb3063940122e1475c9c2b069062a638c95939e374c5427eddee9f";
+    hash = "sha256:14c2c948ccf0e9b606eec39b09286c59dddf28307849f71b7ce2b1d1ef06937e";
   };
 }

pkgs/by-name/no/novelwriter/package.nix

@@ -28,6 +28,7 @@ python3.pkgs.buildPythonApplication {
   dependencies = with python3.pkgs; [
     pyqt6
     pyenchant
+    qt6.qtsvg
   ];
 
   # See setup/debian/install

pkgs/by-name/nv/nvidia-mig-parted/package.nix

@@ -6,13 +6,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "nvidia-mig-parted";
-  version = "0.12.1";
+  version = "0.12.3";
 
   src = fetchFromGitHub {
     owner = "NVIDIA";
     repo = "mig-parted";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-mNzwD8DaWJ0L1y2q/3UhKf0zjKRp3+XwhtFF+Stl/A0=";
+    hash = "sha256-B4vSNG3+qbUqCvEmBz+VUgrnvhNvCR74uvo4uo+bD/Q=";
   };
 
   vendorHash = null;

pkgs/by-name/om/omnissa-horizon-client/package.nix

@@ -12,7 +12,7 @@
   configText ? "",
 }:
 let
-  version = "2503";
+  version = "2506";
 
   sysArch =
     if stdenv.hostPlatform.system == "x86_64-linux" then
@@ -39,8 +39,8 @@ let
     pname = "omnissa-horizon-files";
     inherit version;
     src = fetchurl {
-      url = "https://download3.omnissa.com/software/CART26FQ1_LIN_2503_TARBALL/Omnissa-Horizon-Client-Linux-2503-8.15.0-14256322247.tar.gz";
+      url = "https://download3.omnissa.com/software/CART26FQ2_LIN_2506_TARBALL/Omnissa-Horizon-Client-Linux-2506-8.16.0-16536624989.tar.gz";
-      sha256 = "c7df084d717dc70ce53eadfbe5a9d0daa06931b640702a8355705fbd93e16bb4";
+      sha256 = "5515e79188e2605ced5a95c3a3829865b567be5d7a8de00a57455f7b5b2ae392";
     };
     nativeBuildInputs = [ makeWrapper ];
     installPhase = ''

pkgs/by-name/op/openvpn3/package.nix

@@ -40,6 +40,11 @@ stdenv.mkDerivation rec {
     fetchSubmodules = true;
   };
 
+  patches = [
+    # Should be fixed in v26: https://codeberg.org/OpenVPN/openvpn3-linux/issues/70
+    ./v25-latest-linux-fix.patch
+  ];
+
   postPatch = ''
     echo '#define OPENVPN_VERSION "3.git:unknown:unknown"
     #define PACKAGE_GUIVERSION "v${builtins.replaceStrings [ "_" ] [ ":" ] version}"

pkgs/by-name/op/openvpn3/v25-latest-linux-fix.patch

@@ -0,0 +1,27 @@
+diff --git a/openvpn3-core/openvpn/dco/ovpn_dco_linux.h b/openvpn3-core/openvpn/dco/ovpn_dco_linux.h
+index 238f71f7a..5b7fe8d8c 100644
+--- a/openvpn3-core/openvpn/dco/ovpn_dco_linux.h
++++ b/openvpn3-core/openvpn/dco/ovpn_dco_linux.h
+@@ -239,22 +239,6 @@ enum ovpn_netlink_packet_attrs {
+ 	OVPN_PACKET_ATTR_MAX = __OVPN_PACKET_ATTR_AFTER_LAST - 1,
+ };
+ 
+-enum ovpn_ifla_attrs {
+-	IFLA_OVPN_UNSPEC = 0,
+-	IFLA_OVPN_MODE,
+-
+-	__IFLA_OVPN_AFTER_LAST,
+-	IFLA_OVPN_MAX = __IFLA_OVPN_AFTER_LAST - 1,
+-};
+-
+-enum ovpn_mode {
+-	__OVPN_MODE_FIRST = 0,
+-	OVPN_MODE_P2P = __OVPN_MODE_FIRST,
+-	OVPN_MODE_MP,
+-
+-	__OVPN_MODE_AFTER_LAST,
+-};
+-
+ /// \endcond
+ 
+ #endif /* _UAPI_LINUX_OVPN_DCO_H_ */

pkgs/by-name/pr/protolint/package.nix

@@ -5,13 +5,13 @@
 }:
 buildGoModule rec {
   pname = "protolint";
-  version = "0.56.1";
+  version = "0.56.4";
 
   src = fetchFromGitHub {
     owner = "yoheimuta";
     repo = "protolint";
     rev = "v${version}";
-    hash = "sha256-fz7hypg07okEg0Z4XiA5NGh6I8oLFO4coJscTvxLWFw=";
+    hash = "sha256-2R+TW8z3XgjavK19PGy9hMpN8WOSeWbb/vcSWbbBmJc=";
   };
 
   vendorHash = "sha256-RS0t7n6pLYVKHluQtXsMjYL1SvN7IZFdKmkxOI8wFoE=";

pkgs/by-name/py/pyenv/package.nix

@@ -7,13 +7,13 @@
 
 stdenv.mkDerivation rec {
   pname = "pyenv";
-  version = "2.6.6";
+  version = "2.6.7";
 
   src = fetchFromGitHub {
     owner = "pyenv";
     repo = "pyenv";
     tag = "v${version}";
-    hash = "sha256-wJZB3pchbH0kxbMRqGAq7moOT5yMB/dzCa+pEFC82BE=";
+    hash = "sha256-Rm4czJoUu36frPvBPvjWo0x0NKEkAHCL07iffsC741o=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/qq/qq/package.nix

@@ -138,7 +138,7 @@ else
             libuuid
           ]
         }" \
-        --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--ozone-platform-hint=auto --enable-features=WaylandWindowDecorations --enable-wayland-ime=true}}" \
+        --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--ozone-platform-hint=auto --enable-features=WaylandWindowDecorations --enable-wayland-ime=true --wayland-text-input-version=3}}" \
         --add-flags ${lib.escapeShellArg commandLineArgs} \
         "''${gappsWrapperArgs[@]}"
 

pkgs/by-name/re/rectangle/package.nix

@@ -8,11 +8,11 @@
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "rectangle";
-  version = "0.89";
+  version = "0.90";
 
   src = fetchurl {
     url = "https://github.com/rxhanson/Rectangle/releases/download/v${finalAttrs.version}/Rectangle${finalAttrs.version}.dmg";
-    hash = "sha256-eI3C+nDJhxKwbCLRKepoGmbyWKGCxEuMSK3D0sZbDU0=";
+    hash = "sha256-SC479DxtFkonvWqYSB47b4Mjb7VSnWoNTHcfThYNxt4=";
   };
 
   sourceRoot = ".";

pkgs/by-name/re/rexi/package.nix

@@ -16,6 +16,14 @@ python3Packages.buildPythonApplication rec {
     hash = "sha256-tag2/QTM6tDCU3qr4e1GqRYAZgpvEgtA+FtR4P7WdiU=";
   };
 
+  # AttributeError: 'Static' object has no attribute 'renderable'.
+  # In textual==0.6.0, the `renderable` property was renamed to `content`
+  # https://github.com/Textualize/textual/pull/6041
+  postPatch = ''
+    substituteInPlace tests/test_ui.py \
+      --replace-fail ".renderable" ".content"
+  '';
+
   build-system = with python3Packages; [
     poetry-core
   ];

pkgs/by-name/si/sieve-editor-gui/package.nix

@@ -1,42 +1,75 @@
 {
   lib,
+  stdenv,
   buildNpmPackage,
   fetchFromGitHub,
   electron,
-  nodejs_20,
-  nodePackages,
   makeDesktopItem,
   copyDesktopItems,
+  runCommand,
+  zip,
 }:
+
+let
+  electronArch = if stdenv.hostPlatform.isAarch64 then "arm64" else "x64";
+  electronZip =
+    runCommand "electronZip"
+      {
+        nativeBuildInputs = [ zip ];
+      }
+      ''
+        mkdir $out
+
+        cp -r ${electron.dist} electron-dist
+        chmod -R u+w electron-dist
+
+        cd electron-dist
+        zip -0Xqr $out/electron-v${electron.version}-darwin-${electronArch}.zip .
+      '';
+in
+
 buildNpmPackage {
   pname = "sieve-editor-gui";
-  version = "0.6.1-unstable-2024-01-06";
+  version = "0.6.1-unstable-2025-03-12";
-  nodejs = nodejs_20;
 
   src = fetchFromGitHub {
     owner = "thsmi";
     repo = "sieve";
-    rev = "5879679ed8d16a34af760ee56bfec16a1a322b4e";
+    rev = "4bcefba15314177521a45a833e53969b50f4351e";
-    hash = "sha256-wl6dwKoGan+DrpXk2p1fD/QN/C2qT4h/g3N73gF8sOI=";
+    hash = "sha256-jR3+YaVQ+Yd2Xm40SzQNvwWMPe0mJ6bhT96hlUz3/qU=";
   };
 
-  npmDepsHash = "sha256-a2I9csxFZJekG1uCOHqdRaLLi5v/BLTz4SU+uBd855A=";
+  npmDepsHash = "sha256-w2i7XsTx3hlsh/JbvShaxvDyFGcBpL66lMy7KL2tnzM=";
 
-  nativeBuildInputs = [
+  nativeBuildInputs = lib.optionals stdenv.hostPlatform.isLinux [ copyDesktopItems ];
-    electron
-    copyDesktopItems
-    nodePackages.gulp
-  ];
 
-  dontNpmBuild = true;
+  npmBuildScript = "gulp";
-
+  npmBuildFlags = [ "app:package" ];
-  buildPhase = ''
-    gulp -LLLL app:package
-  '';
 
   installPhase = ''
     runHook preInstall
+  ''
+  + lib.optionalString stdenv.hostPlatform.isLinux ''
     mv build/ $out
+
+    install -D $out/electron/resources/libs/icons/linux.png $out/share/icons/hicolor/64x64/apps/sieve.png
+
+    makeWrapper ${lib.getExe electron} $out/bin/sieve-editor-gui \
+      --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--ozone-platform=wayland --enable-features=WaylandWindowDecorations --enable-wayland-ime=true}}" \
+      --add-flags $out/electron/resources/main_esm.js
+  ''
+  + lib.optionalString stdenv.hostPlatform.isDarwin ''
+    npx electron-packager ./build/electron/resources \
+      --electron-zip-dir ${electronZip} \
+      --electron-version ${electron.version} \
+      --icon src/common/icons/mac.icns
+
+    mkdir -p $out/Applications
+    cp -r sieve-darwin-*/sieve.app $out/Applications/
+
+    makeWrapper $out/Applications/sieve.app/Contents/MacOS/Sieve $out/bin/sieve-editor-gui
+  ''
+  + ''
     runHook postInstall
   '';
 
@@ -49,22 +82,24 @@ buildNpmPackage {
       name = "sieve-editor-gui";
       exec = "sieve-editor-gui";
       desktopName = "Sieve Editor";
-      icon = "sieve-editor-gui";
+      icon = "sieve";
-      categories = [ "Utility" ];
+      categories = [
+        "Utility"
+        "Email"
+      ];
+      comment = "Tool to Manage Sieve Message Filters";
     })
   ];
 
-  postInstall = ''
-    makeWrapper ${lib.getExe electron} $out/bin/sieve-editor-gui \
-      --add-flags $out/electron/resources/main_esm.js
-  '';
-
   meta = {
     description = "Activate, edit, delete and add Sieve scripts with a convenient interface";
     homepage = "https://github.com/thsmi/sieve";
     license = lib.licenses.agpl3Only;
-    maintainers = with lib.maintainers; [ Silver-Golden ];
+    maintainers = with lib.maintainers; [
-    platforms = lib.platforms.linux;
+      Silver-Golden
+      fugi
+    ];
     mainProgram = "sieve-editor-gui";
+    inherit (electron.meta) platforms;
   };
 }

pkgs/by-name/sp/spacer/package.nix

@@ -6,16 +6,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "spacer";
-  version = "0.4.5";
+  version = "0.5.0";
 
   src = fetchFromGitHub {
     owner = "samwho";
     repo = "spacer";
     rev = "v${version}";
-    hash = "sha256-GG9v6N7bJN7kYEQRqRIDgPPT0gGJ6LSSr8NWBDKsajo=";
+    hash = "sha256-OryVQmecb8BgnEKeSvAQha+uiv+aZd2Q41T9tZTcWaI=";
   };
 
-  cargoHash = "sha256-sWE0nFFVAUcCgW6R3BWBdSqn1QMRI8tKnuxX4gpRdvA=";
+  cargoHash = "sha256-sFsERAvR99BZm7SmaL/5cmCrwVZIKGRiFYcBtSryFaw=";
 
   meta = with lib; {
     description = "CLI tool to insert spacers when command output stops";

pkgs/by-name/su/surelog/package.nix

@@ -17,14 +17,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "surelog";
-  version = "1.84-unstable-2024-12-06";
+  version = "1.86";
 
   src = fetchFromGitHub {
     owner = "chipsalliance";
     repo = "surelog";
-    # Once we're back on a stable tag, use "v$(finalAttrs.version}" below.
+    tag = "v${finalAttrs.version}";
-    rev = "298a9cddc672cce7f25ec352f9f8f36f5b23aa4e";
+    hash = "sha256-EEhaYimyzOgQB7dxbbTfsa7APC6SlFkz9ah9BLcKDq4=";
-    hash = "sha256-Qv4dosj2dwakNCcvu483ZMuw+LlYs4fhZTULszERLSI=";
     fetchSubmodules = false; # we use all dependencies from nix
   };
 

pkgs/by-name/uh/uhdm/package.nix

@@ -9,16 +9,15 @@
 }:
 
 stdenv.mkDerivation (finalAttrs: {
-  pname = "UHDM";
+  pname = "uhdm";
-  # When updating this package, also consider updating science/logic/surelog
+  # When updating this package, also consider updating surelog
-  version = "1.84-unstable-2024-11-12";
+  version = "1.86";
 
   src = fetchFromGitHub {
     owner = "chipsalliance";
     repo = "UHDM";
-    # After we're back on a stable tag, use v${finalAttrs.version}
+    tag = "v${finalAttrs.version}";
-    rev = "7d90dd0e68759775d0c86885d991925096b5b496";
+    hash = "sha256-f7QJJEP/jL69DdMJOL5WQdDZU+kBnnLi2eX37AoaXls=";
-    hash = "sha256-msdtBAlOXwYJd0HhWmVo8oMJ6h8OUmy0ILxV1MV52PE=";
     fetchSubmodules = false; # we use all dependencies from nix
   };
 
@@ -38,7 +37,14 @@ stdenv.mkDerivation (finalAttrs: {
   ];
 
   doCheck = true;
-  checkPhase = "make test";
+
+  checkPhase = ''
+    runHook preCheck
+
+    make test
+
+    runHook postCheck
+  '';
 
   meta = {
     description = "Universal Hardware Data Model";

pkgs/by-name/uu/uuu/package.nix

@@ -18,13 +18,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "uuu";
-  version = "1.5.222";
+  version = "1.5.233";
 
   src = fetchFromGitHub {
     owner = "nxp-imx";
     repo = "mfgtools";
     rev = "uuu_${finalAttrs.version}";
-    hash = "sha256-n5CgsArkj67vR6WaUaTUYno1pFffXRxjlC7kU8N/oEM=";
+    hash = "sha256-x3C9bEE99XOIpnPjVV7Je5mfdhwN0nTkiuBxrwWZ7CI=";
   };
 
   passthru.updateScript = nix-update-script {

pkgs/by-name/va/vale-ls/package.nix

@@ -9,15 +9,15 @@
   vale,
 }:
 
-rustPlatform.buildRustPackage rec {
+rustPlatform.buildRustPackage (finalAttrs: {
   pname = "vale-ls";
-  version = "0.3.8";
+  version = "0.4.0";
 
   src = fetchFromGitHub {
     owner = "errata-ai";
     repo = "vale-ls";
-    tag = "v${version}";
+    tag = "v${finalAttrs.version}";
-    hash = "sha256-+2peLqj3/ny0hDwJVKEp2XS68VO50IvpCB2fvZoEdJo=";
+    hash = "sha256-lRRKRQTxgXF4E+XghJ5AOp+mtWtiCT13EcsPVydn4Uo=";
   };
 
   nativeBuildInputs = [
@@ -49,14 +49,14 @@ rustPlatform.buildRustPackage rec {
       --suffix PATH : ${lib.makeBinPath [ vale ]}
   '';
 
-  meta = with lib; {
+  meta = {
     description = "LSP implementation for the Vale command-line tool";
     homepage = "https://github.com/errata-ai/vale-ls";
-    license = licenses.mit;
+    license = lib.licenses.mit;
     mainProgram = "vale-ls";
-    maintainers = with maintainers; [
+    maintainers = with lib.maintainers; [
       foo-dogsquared
       jansol
     ];
   };
-}
+})

pkgs/by-name/va/vault-bin/package.nix

@@ -6,7 +6,7 @@
 
 stdenv.mkDerivation rec {
   pname = "vault-bin";
-  version = "1.20.2";
+  version = "1.20.3";
 
   src =
     let
@@ -20,11 +20,11 @@ stdenv.mkDerivation rec {
         aarch64-darwin = "darwin_arm64";
       };
       hash = selectSystem {
-        x86_64-linux = "sha256-Ea+GaukEEd02SzZYe+bzu8EWNPc5XxUVs3qZkF2ry6s=";
+        x86_64-linux = "sha256-3IE0WJ3JmzeUwC6OcorebHOD858SKiBR2Rv6KhKewXU=";
-        aarch64-linux = "sha256-Q1n57tUIaPdg++fr2NREv0hsApJdRqyfs/qEHiyst7Y=";
+        aarch64-linux = "sha256-DsqOf3yeOz3SI+CCvS2KcCJ6k18o4H+LI1Z39i9ezb0=";
-        i686-linux = "sha256-8V/2Dm6F799fBhuPyUrdu6e7KDmr6SYxU74wRXCRobs=";
+        i686-linux = "sha256-ONrB+Gwm0dMAK8lvCg5ljC2KApkugA8zX9HcmV0QzFM=";
-        x86_64-darwin = "sha256-Yuaon05IXauU61xOqAh97DtlKhIQ05qt+Str5JXleHE=";
+        x86_64-darwin = "sha256-cbxdyuLhc8+Ux2ZOX1zncsP2KGqWruuno/Yzct/cyII=";
-        aarch64-darwin = "sha256-wTTEIeoKDNDenhMzwXtldjsz13jvrDY4eOuPFjSyE4Q=";
+        aarch64-darwin = "sha256-zWuI+KFNyqoxnEKI25N4igXnXjoz+AXMU1WgGDKyfog=";
       };
     in
     fetchzip {

pkgs/by-name/va/vault/package.nix

@@ -12,16 +12,16 @@
 
 buildGoModule rec {
   pname = "vault";
-  version = "1.20.2";
+  version = "1.20.3";
 
   src = fetchFromGitHub {
     owner = "hashicorp";
     repo = "vault";
     rev = "v${version}";
-    hash = "sha256-QkBSHkXP67khJa/Ju7yx97ibOU3BcBt6tOHnS0rYvZM=";
+    hash = "sha256-q7Uz8gq092JU1v6sEQvraV6wxgBEGGnZFCBEw2f9GMw=";
   };
 
-  vendorHash = "sha256-O7T7DO3RCQVBBDvFSLAgoD8tJRMJpb4/3ch7OYk4bIk=";
+  vendorHash = "sha256-504WH4KaL1ecsuwXlELKhpbHHK67IcaI+I4DvEQerwA=";
 
   proxyVendor = true;
 

pkgs/by-name/wa/wasmi/package.nix

@@ -7,17 +7,17 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "wasmi";
-  version = "0.51.0";
+  version = "0.51.1";
 
   src = fetchFromGitHub {
     owner = "paritytech";
     repo = "wasmi";
     tag = "v${version}";
-    hash = "sha256-mPArNkPrTW3RikLlQNkAjIUEfRot2nRaqceNopGmZDo=";
+    hash = "sha256-Y9wHrx5UcUzJOJoMq9oPgblrpRjLe9nX79FZxL2cIgY=";
     fetchSubmodules = true;
   };
 
-  cargoHash = "sha256-7L2XQ4E+1wyNMu2IEgqvKuY84k7kQ07m/dXbyDYN/VU=";
+  cargoHash = "sha256-tlvk+UAUMGToWaRbpsvI8eqsYrnoV/pvn+pWvbOv/18=";
   passthru.updateScript = nix-update-script { };
 
   meta = with lib; {

pkgs/by-name/wi/wipefreespace/package.nix

@@ -1,55 +1,48 @@
 {
-  stdenv,
   lib,
-  fetchurl,
+  stdenv,
-  e2fsprogs,
+  fetchFromGitHub,
-  ntfs3g,
+  gettext,
-  xfsprogs,
-  reiser4progs,
-  libaal,
-  jfsutils,
-  libuuid,
   texinfo,
+  xfsprogs,
+  e2fsprogs,
+  libcap,
+  ntfs3g,
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "wipefreespace";
-  version = "2.6";
+  version = "3.0";
 
-  src = fetchurl {
+  src = fetchFromGitHub {
-    url = "mirror://sourceforge/project/wipefreespace/wipefreespace/${version}/wipefreespace-${version}.tar.gz";
+    owner = "bogdro";
-    hash = "sha256-Pt6MDQ9wSJbL4tW/qckTpFsvE9FdXIkp/QmnYSlWR/M=";
+    repo = "wipefreespace";
+    tag = finalAttrs.version;
+    hash = "sha256-zWjMCWQNPPly8xJ7jQraGHi4OLuNrnpNVQC2CRyHUlw=";
   };
 
   nativeBuildInputs = [
+    gettext
     texinfo
+    xfsprogs
   ];
 
   # missed: Reiser3 FAT12/16/32 MinixFS HFS+ OCFS
   buildInputs = [
     e2fsprogs
+    libcap
     ntfs3g
     xfsprogs
-    reiser4progs
-    libaal
-    jfsutils
-    libuuid
   ];
 
   strictDeps = true;
 
-  preConfigure = ''
+  meta = {
-    export PATH=$PATH:${xfsprogs}/bin
-    export CFLAGS=-I${jfsutils}/include
-    export LDFLAGS="-L${jfsutils}/lib -L${reiser4progs}/lib"
-  '';
-
-  meta = with lib; {
     description = "Program which will securely wipe the free space";
     homepage = "https://wipefreespace.sourceforge.io";
-    license = licenses.gpl2Plus;
+    license = lib.licenses.gpl2Plus;
-    platforms = platforms.linux;
+    platforms = lib.platforms.linux;
-    maintainers = with maintainers; [ catap ];
+    maintainers = with lib.maintainers; [ kyehn ];
     mainProgram = "wipefreespace";
   };
-}
+})

pkgs/by-name/zg/zgrab2/fix-go-version-error.patch

@@ -1,46 +0,0 @@
-diff --git a/go.mod b/go.mod
-index 888f10e..5463ef5 100644
---- a/go.mod
-+++ b/go.mod
-@@ -1,25 +1,33 @@
- module github.com/zmap/zgrab2
-
--go 1.12
-+go 1.17
-
- require (
--	github.com/cespare/xxhash/v2 v2.2.0 // indirect
--	github.com/go-kit/kit v0.10.0 // indirect
--	github.com/golang/protobuf v1.5.3 // indirect
- 	github.com/hdm/jarm-go v0.0.7
- 	github.com/prometheus/client_golang v1.14.0
--	github.com/prometheus/common v0.42.0 // indirect
--	github.com/prometheus/procfs v0.9.0 // indirect
- 	github.com/sirupsen/logrus v1.9.0
--	github.com/zmap/rc2 v0.0.0-20190804163417-abaa70531248 // indirect
- 	github.com/zmap/zcrypto v0.0.0-20230310154051-c8b263fd8300
- 	github.com/zmap/zflags v1.4.0-beta.1.0.20200204220219-9d95409821b6
- 	golang.org/x/crypto v0.7.0
- 	golang.org/x/net v0.8.0
- 	golang.org/x/sys v0.6.0
- 	golang.org/x/text v0.8.0
--	google.golang.org/protobuf v1.30.0 // indirect
- 	gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c
- 	gopkg.in/mgo.v2 v2.0.0-20190816093944-a6b53ec6cb22
- 	gopkg.in/yaml.v2 v2.4.0
- )
-+
-+require (
-+	github.com/beorn7/perks v1.0.1 // indirect
-+	github.com/cespare/xxhash/v2 v2.2.0 // indirect
-+	github.com/golang/protobuf v1.5.3 // indirect
-+	github.com/kr/pretty v0.2.1 // indirect
-+	github.com/kr/text v0.1.0 // indirect
-+	github.com/matttproud/golang_protobuf_extensions v1.0.4 // indirect
-+	github.com/prometheus/client_model v0.3.0 // indirect
-+	github.com/prometheus/common v0.42.0 // indirect
-+	github.com/prometheus/procfs v0.9.0 // indirect
-+	github.com/weppos/publicsuffix-go v0.30.0 // indirect
-+	github.com/zmap/rc2 v0.0.0-20190804163417-abaa70531248 // indirect
-+	google.golang.org/protobuf v1.30.0 // indirect
-+)

pkgs/by-name/zg/zgrab2/package.nix

@@ -4,41 +4,34 @@
   fetchFromGitHub,
 }:
 
-buildGoModule {
+buildGoModule (finalAttrs: {
   pname = "zgrab2";
-  version = "unstable-2023-03-23";
+  version = "0.2.0";
 
   src = fetchFromGitHub {
     owner = "zmap";
     repo = "zgrab2";
-    rev = "911c86f13080ceae98f8d63d1ae0e85c4a8f7f61";
+    tag = "v${finalAttrs.version}";
-    hash = "sha256-VOWkBM/SziY3jiIaYYWq+LRzG4vKitiscqdIDfRUkYY=";
+    hash = "sha256-9YDrWtSFFzFMN/pp0Kaknie4NMduOb/ZNrP+7MIMT+0=";
   };
 
-  vendorHash = "sha256-Q3FCqvh4vn64QXqcePhVWTyIHJarI6I4YonH3X/7RhI=";
+  vendorHash = "sha256-8oidWUtSMMm/QMzrTkH07eyyBhCeZ9SUOO1+h1evbac=";
-
-  patches = [
-    # Without this, we get error messages like:
-    # vendor/golang.org/x/sys/unix/syscall.go:83:16: unsafe.Slice requires go1.17 or later (-lang was set to go1.16; check go.mod)
-    # The patch was generated by changing "go 1.12" to "go 1.17" and executing `go mod tidy -compat=1.17`.
-    ./fix-go-version-error.patch
-  ];
 
   subPackages = [
     "cmd/zgrab2"
   ];
 
-  meta = with lib; {
+  meta = {
-    description = "Web application scanner";
+    description = "Fast Application Layer Scanner";
     mainProgram = "zgrab2";
     homepage = "https://github.com/zmap/zgrab2";
-    license = with licenses; [
+    license = with lib.licenses; [
       asl20
       isc
     ];
-    maintainers = with maintainers; [
+    maintainers = with lib.maintainers; [
       fab
       juliusrickert
     ];
   };
-}
+})

pkgs/development/compilers/dart/package-source-builders/audiotags/Cargo-1.4.1.lock

@@ -1,629 +0,0 @@
-# This file is automatically @generated by Cargo.
-# It is not intended for manual editing.
-version = 3
-
-[[package]]
-name = "addr2line"
-version = "0.24.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "dfbe277e56a376000877090da837660b4427aad530e3028d44e0bffe4f89a1c1"
-dependencies = [
- "gimli",
-]
-
-[[package]]
-name = "adler2"
-version = "2.0.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "512761e0bb2578dd7380c6baaa0f4ce03e84f95e960231d1dec8bf4d7d6e2627"
-
-[[package]]
-name = "allo-isolate"
-version = "0.1.26"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1f67642eb6773fb42a95dd3b348c305ee18dee6642274c6b412d67e985e3befc"
-dependencies = [
- "anyhow",
- "atomic",
- "backtrace",
- "chrono",
-]
-
-[[package]]
-name = "android-tzdata"
-version = "0.1.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e999941b234f3131b00bc13c22d06e8c5ff726d1b6318ac7eb276997bbb4fef0"
-
-[[package]]
-name = "android_system_properties"
-version = "0.1.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "819e7219dbd41043ac279b19830f2efc897156490d7fd6ea916720117ee66311"
-dependencies = [
- "libc",
-]
-
-[[package]]
-name = "anyhow"
-version = "1.0.94"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c1fd03a028ef38ba2276dce7e33fcd6369c158a1bca17946c4b1b701891c1ff7"
-
-[[package]]
-name = "atomic"
-version = "0.5.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c59bdb34bc650a32731b31bd8f0829cc15d24a708ee31559e0bb34f2bc320cba"
-
-[[package]]
-name = "audiotags"
-version = "1.4.1"
-dependencies = [
- "anyhow",
- "flutter_rust_bridge",
- "lofty",
-]
-
-[[package]]
-name = "autocfg"
-version = "1.4.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ace50bade8e6234aa140d9a2f552bbee1db4d353f69b8217bc503490fc1a9f26"
-
-[[package]]
-name = "backtrace"
-version = "0.3.74"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8d82cb332cdfaed17ae235a638438ac4d4839913cc2af585c3c6746e8f8bee1a"
-dependencies = [
- "addr2line",
- "cfg-if",
- "libc",
- "miniz_oxide",
- "object",
- "rustc-demangle",
- "windows-targets",
-]
-
-[[package]]
-name = "bitflags"
-version = "2.6.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b048fb63fd8b5923fc5aa7b340d8e156aec7ec02f0c78fa8a6ddc2613f6f71de"
-
-[[package]]
-name = "build-target"
-version = "0.4.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "832133bbabbbaa9fbdba793456a2827627a7d2b8fb96032fa1e7666d7895832b"
-
-[[package]]
-name = "bumpalo"
-version = "3.16.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "79296716171880943b8470b5f8d03aa55eb2e645a4874bdbb28adb49162e012c"
-
-[[package]]
-name = "bytemuck"
-version = "1.20.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8b37c88a63ffd85d15b406896cc343916d7cf57838a847b3a6f2ca5d39a5695a"
-
-[[package]]
-name = "byteorder"
-version = "1.5.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1fd0f2584146f6f2ef48085050886acf353beff7305ebd1ae69500e27c67f64b"
-
-[[package]]
-name = "cc"
-version = "1.2.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f34d93e62b03caf570cccc334cbc6c2fceca82f39211051345108adcba3eebdc"
-dependencies = [
- "shlex",
-]
-
-[[package]]
-name = "cfg-if"
-version = "1.0.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "baf1de4339761588bc0619e3cbc0120ee582ebb74b53b4efbf79117bd2da40fd"
-
-[[package]]
-name = "chrono"
-version = "0.4.38"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a21f936df1771bf62b77f047b726c4625ff2e8aa607c01ec06e5a05bd8463401"
-dependencies = [
- "android-tzdata",
- "iana-time-zone",
- "js-sys",
- "num-traits",
- "wasm-bindgen",
- "windows-targets",
-]
-
-[[package]]
-name = "console_error_panic_hook"
-version = "0.1.7"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a06aeb73f470f66dcdbf7223caeebb85984942f22f1adb2a088cf9668146bbbc"
-dependencies = [
- "cfg-if",
- "wasm-bindgen",
-]
-
-[[package]]
-name = "core-foundation-sys"
-version = "0.8.7"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "773648b94d0e5d620f64f280777445740e61fe701025087ec8b57f45c791888b"
-
-[[package]]
-name = "crc32fast"
-version = "1.4.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a97769d94ddab943e4510d138150169a2758b5ef3eb191a9ee688de3e23ef7b3"
-dependencies = [
- "cfg-if",
-]
-
-[[package]]
-name = "dart-sys"
-version = "4.1.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "57967e4b200d767d091b961d6ab42cc7d0cc14fe9e052e75d0d3cf9eb732d895"
-dependencies = [
- "cc",
-]
-
-[[package]]
-name = "data-encoding"
-version = "2.6.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e8566979429cf69b49a5c740c60791108e86440e8be149bbea4fe54d2c32d6e2"
-
-[[package]]
-name = "flate2"
-version = "1.0.35"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c936bfdafb507ebbf50b8074c54fa31c5be9a1e7e5f467dd659697041407d07c"
-dependencies = [
- "crc32fast",
- "miniz_oxide",
-]
-
-[[package]]
-name = "flutter_rust_bridge"
-version = "1.82.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d5b3f423054f2fbc74e3dcef394ef3fd7a4f8309265a6b9a6ccf9c0fb07bb14b"
-dependencies = [
- "allo-isolate",
- "anyhow",
- "backtrace",
- "build-target",
- "bytemuck",
- "cc",
- "chrono",
- "console_error_panic_hook",
- "dart-sys",
- "flutter_rust_bridge_macros",
- "js-sys",
- "lazy_static",
- "libc",
- "log",
- "parking_lot",
- "threadpool",
- "wasm-bindgen",
- "web-sys",
-]
-
-[[package]]
-name = "flutter_rust_bridge_macros"
-version = "1.82.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a7fe743d921bedf4578b9472346d03a9643a01cd565ca7df7961baebad534ba5"
-
-[[package]]
-name = "gimli"
-version = "0.31.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "07e28edb80900c19c28f1072f2e8aeca7fa06b23cd4169cefe1af5aa3260783f"
-
-[[package]]
-name = "hermit-abi"
-version = "0.3.9"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d231dfb89cfffdbc30e7fc41579ed6066ad03abda9e567ccafae602b97ec5024"
-
-[[package]]
-name = "iana-time-zone"
-version = "0.1.61"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "235e081f3925a06703c2d0117ea8b91f042756fd6e7a6e5d901e8ca1a996b220"
-dependencies = [
- "android_system_properties",
- "core-foundation-sys",
- "iana-time-zone-haiku",
- "js-sys",
- "wasm-bindgen",
- "windows-core",
-]
-
-[[package]]
-name = "iana-time-zone-haiku"
-version = "0.1.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f31827a206f56af32e590ba56d5d2d085f558508192593743f16b2306495269f"
-dependencies = [
- "cc",
-]
-
-[[package]]
-name = "js-sys"
-version = "0.3.74"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a865e038f7f6ed956f788f0d7d60c541fff74c7bd74272c5d4cf15c63743e705"
-dependencies = [
- "once_cell",
- "wasm-bindgen",
-]
-
-[[package]]
-name = "lazy_static"
-version = "1.5.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bbd2bcb4c963f2ddae06a2efc7e9f3591312473c50c6685e1f298068316e66fe"
-
-[[package]]
-name = "libc"
-version = "0.2.167"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "09d6582e104315a817dff97f75133544b2e094ee22447d2acf4a74e189ba06fc"
-
-[[package]]
-name = "lock_api"
-version = "0.4.12"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "07af8b9cdd281b7915f413fa73f29ebd5d55d0d3f0155584dade1ff18cea1b17"
-dependencies = [
- "autocfg",
- "scopeguard",
-]
-
-[[package]]
-name = "lofty"
-version = "0.18.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f75066eb1d25a7047fb2667edb410ae2592439ed81546f95c28b0a1c7d7d3818"
-dependencies = [
- "byteorder",
- "data-encoding",
- "flate2",
- "lofty_attr",
- "log",
- "ogg_pager",
- "paste",
-]
-
-[[package]]
-name = "lofty_attr"
-version = "0.9.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "764b60e1ddd07e5665a6a17636a95cd7d8f3b86c73503a69c32979d05f72f3cf"
-dependencies = [
- "proc-macro2",
- "quote",
- "syn",
-]
-
-[[package]]
-name = "log"
-version = "0.4.22"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a7a70ba024b9dc04c27ea2f0c0548feb474ec5c54bba33a7f72f873a39d07b24"
-
-[[package]]
-name = "memchr"
-version = "2.7.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "78ca9ab1a0babb1e7d5695e3530886289c18cf2f87ec19a575a0abdce112e3a3"
-
-[[package]]
-name = "miniz_oxide"
-version = "0.8.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e2d80299ef12ff69b16a84bb182e3b9df68b5a91574d3d4fa6e41b65deec4df1"
-dependencies = [
- "adler2",
-]
-
-[[package]]
-name = "num-traits"
-version = "0.2.19"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "071dfc062690e90b734c0b2273ce72ad0ffa95f0c74596bc250dcfd960262841"
-dependencies = [
- "autocfg",
-]
-
-[[package]]
-name = "num_cpus"
-version = "1.16.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4161fcb6d602d4d2081af7c3a45852d875a03dd337a6bfdd6e06407b61342a43"
-dependencies = [
- "hermit-abi",
- "libc",
-]
-
-[[package]]
-name = "object"
-version = "0.36.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "aedf0a2d09c573ed1d8d85b30c119153926a2b36dce0ab28322c09a117a4683e"
-dependencies = [
- "memchr",
-]
-
-[[package]]
-name = "ogg_pager"
-version = "0.6.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "87b0bef808533c5890ab77279538212efdbbbd9aa4ef1ccdfcfbf77a42f7e6fa"
-dependencies = [
- "byteorder",
-]
-
-[[package]]
-name = "once_cell"
-version = "1.20.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1261fe7e33c73b354eab43b1273a57c8f967d0391e80353e51f764ac02cf6775"
-
-[[package]]
-name = "parking_lot"
-version = "0.12.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f1bf18183cf54e8d6059647fc3063646a1801cf30896933ec2311622cc4b9a27"
-dependencies = [
- "lock_api",
- "parking_lot_core",
-]
-
-[[package]]
-name = "parking_lot_core"
-version = "0.9.10"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1e401f977ab385c9e4e3ab30627d6f26d00e2c73eef317493c4ec6d468726cf8"
-dependencies = [
- "cfg-if",
- "libc",
- "redox_syscall",
- "smallvec",
- "windows-targets",
-]
-
-[[package]]
-name = "paste"
-version = "1.0.15"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "57c0d7b74b563b49d38dae00a0c37d4d6de9b432382b2892f0574ddcae73fd0a"
-
-[[package]]
-name = "proc-macro2"
-version = "1.0.92"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "37d3544b3f2748c54e147655edb5025752e2303145b5aefb3c3ea2c78b973bb0"
-dependencies = [
- "unicode-ident",
-]
-
-[[package]]
-name = "quote"
-version = "1.0.37"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b5b9d34b8991d19d98081b46eacdd8eb58c6f2b201139f7c5f643cc155a633af"
-dependencies = [
- "proc-macro2",
-]
-
-[[package]]
-name = "redox_syscall"
-version = "0.5.7"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9b6dfecf2c74bce2466cabf93f6664d6998a69eb21e39f4207930065b27b771f"
-dependencies = [
- "bitflags",
-]
-
-[[package]]
-name = "rustc-demangle"
-version = "0.1.24"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "719b953e2095829ee67db738b3bfa9fa368c94900df327b3f07fe6e794d2fe1f"
-
-[[package]]
-name = "scopeguard"
-version = "1.2.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "94143f37725109f92c262ed2cf5e59bce7498c01bcc1502d7b9afe439a4e9f49"
-
-[[package]]
-name = "shlex"
-version = "1.3.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0fda2ff0d084019ba4d7c6f371c95d8fd75ce3524c3cb8fb653a3023f6323e64"
-
-[[package]]
-name = "smallvec"
-version = "1.13.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3c5e1a9a646d36c3599cd173a41282daf47c44583ad367b8e6837255952e5c67"
-
-[[package]]
-name = "syn"
-version = "2.0.90"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "919d3b74a5dd0ccd15aeb8f93e7006bd9e14c295087c9896a110f490752bcf31"
-dependencies = [
- "proc-macro2",
- "quote",
- "unicode-ident",
-]
-
-[[package]]
-name = "threadpool"
-version = "1.8.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d050e60b33d41c19108b32cea32164033a9013fe3b46cbd4457559bfbf77afaa"
-dependencies = [
- "num_cpus",
-]
-
-[[package]]
-name = "unicode-ident"
-version = "1.0.14"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "adb9e6ca4f869e1180728b7950e35922a7fc6397f7b641499e8f3ef06e50dc83"
-
-[[package]]
-name = "wasm-bindgen"
-version = "0.2.97"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d15e63b4482863c109d70a7b8706c1e364eb6ea449b201a76c5b89cedcec2d5c"
-dependencies = [
- "cfg-if",
- "once_cell",
- "wasm-bindgen-macro",
-]
-
-[[package]]
-name = "wasm-bindgen-backend"
-version = "0.2.97"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8d36ef12e3aaca16ddd3f67922bc63e48e953f126de60bd33ccc0101ef9998cd"
-dependencies = [
- "bumpalo",
- "log",
- "once_cell",
- "proc-macro2",
- "quote",
- "syn",
- "wasm-bindgen-shared",
-]
-
-[[package]]
-name = "wasm-bindgen-macro"
-version = "0.2.97"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "705440e08b42d3e4b36de7d66c944be628d579796b8090bfa3471478a2260051"
-dependencies = [
- "quote",
- "wasm-bindgen-macro-support",
-]
-
-[[package]]
-name = "wasm-bindgen-macro-support"
-version = "0.2.97"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "98c9ae5a76e46f4deecd0f0255cc223cfa18dc9b261213b8aa0c7b36f61b3f1d"
-dependencies = [
- "proc-macro2",
- "quote",
- "syn",
- "wasm-bindgen-backend",
- "wasm-bindgen-shared",
-]
-
-[[package]]
-name = "wasm-bindgen-shared"
-version = "0.2.97"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6ee99da9c5ba11bd675621338ef6fa52296b76b83305e9b6e5c77d4c286d6d49"
-
-[[package]]
-name = "web-sys"
-version = "0.3.74"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a98bc3c33f0fe7e59ad7cd041b89034fa82a7c2d4365ca538dda6cdaf513863c"
-dependencies = [
- "js-sys",
- "wasm-bindgen",
-]
-
-[[package]]
-name = "windows-core"
-version = "0.52.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "33ab640c8d7e35bf8ba19b884ba838ceb4fba93a4e8c65a9059d08afcfc683d9"
-dependencies = [
- "windows-targets",
-]
-
-[[package]]
-name = "windows-targets"
-version = "0.52.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9b724f72796e036ab90c1021d4780d4d3d648aca59e491e6b98e725b84e99973"
-dependencies = [
- "windows_aarch64_gnullvm",
- "windows_aarch64_msvc",
- "windows_i686_gnu",
- "windows_i686_gnullvm",
- "windows_i686_msvc",
- "windows_x86_64_gnu",
- "windows_x86_64_gnullvm",
- "windows_x86_64_msvc",
-]
-
-[[package]]
-name = "windows_aarch64_gnullvm"
-version = "0.52.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "32a4622180e7a0ec044bb555404c800bc9fd9ec262ec147edd5989ccd0c02cd3"
-
-[[package]]
-name = "windows_aarch64_msvc"
-version = "0.52.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "09ec2a7bb152e2252b53fa7803150007879548bc709c039df7627cabbd05d469"
-
-[[package]]
-name = "windows_i686_gnu"
-version = "0.52.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8e9b5ad5ab802e97eb8e295ac6720e509ee4c243f69d781394014ebfe8bbfa0b"
-
-[[package]]
-name = "windows_i686_gnullvm"
-version = "0.52.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0eee52d38c090b3caa76c563b86c3a4bd71ef1a819287c19d586d7334ae8ed66"
-
-[[package]]
-name = "windows_i686_msvc"
-version = "0.52.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "240948bc05c5e7c6dabba28bf89d89ffce3e303022809e73deaefe4f6ec56c66"
-
-[[package]]
-name = "windows_x86_64_gnu"
-version = "0.52.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "147a5c80aabfbf0c7d901cb5895d1de30ef2907eb21fbbab29ca94c5b08b1a78"
-
-[[package]]
-name = "windows_x86_64_gnullvm"
-version = "0.52.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "24d5b23dc417412679681396f2b49f3de8c1473deb516bd34410872eff51ed0d"
-
-[[package]]
-name = "windows_x86_64_msvc"
-version = "0.52.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "589f6da84c646204747d1270a2a5661ea66ed1cced2631d546fdfb155959f9ec"

pkgs/development/compilers/dart/package-source-builders/audiotags/default.nix

@@ -1,53 +0,0 @@
-{
-  stdenv,
-  lib,
-  rustPlatform,
-}:
-
-{ version, src, ... }:
-
-let
-  rustDep = rustPlatform.buildRustPackage rec {
-    pname = "audiotags-rs";
-    inherit version src;
-
-    postPatch = ''
-      cp --no-preserve=mode ${cargoLock.lockFile} Cargo.lock
-    '';
-
-    sourceRoot = "${src.name}/rust";
-
-    cargoLock.lockFile =
-      rec {
-        _1_4_2 = _1_4_1;
-        _1_4_1 = ./Cargo-1.4.1.lock;
-      }
-      .${"_" + (lib.replaceStrings [ "." ] [ "_" ] version)} or (throw ''
-        Unsupported version of pub 'audiotags': '${version}'
-        Please add Cargo.lock here. If the Cargo.lock
-        is the same with existing versions, add an alias here.
-      '');
-
-    doCheck = false; # test failed
-
-    passthru.libraryPath = "lib/libaudiotags.so";
-  };
-in
-stdenv.mkDerivation {
-  pname = "audiotags";
-  inherit version src;
-  inherit (src) passthru;
-
-  postPatch = ''
-    sed -i -e '/if(NOT EXISTS/,/endif()/d' -e '/if(NOT EXISTS/,/endif()/d' ./linux/CMakeLists.txt
-    sed -i 's|.*libaudiotags.so.*|${rustDep}/${rustDep.passthru.libraryPath}|' ./linux/CMakeLists.txt
-  '';
-
-  installPhase = ''
-    runHook preInstall
-
-    cp -r . $out
-
-    runHook postInstall
-  '';
-}

pkgs/development/compilers/dart/package-source-builders/default.nix

@@ -1,17 +1,14 @@
 { callPackage }:
 
 {
-  audiotags = callPackage ./audiotags { };
   file_picker = callPackage ./file_picker { };
   flutter_discord_rpc = callPackage ./flutter_discord_rpc { };
   flutter_secure_storage_linux = callPackage ./flutter-secure-storage-linux { };
   flutter_vodozemac = callPackage ./flutter_vodozemac { };
   flutter_volume_controller = callPackage ./flutter_volume_controller { };
-  fvp = callPackage ./fvp { };
   handy_window = callPackage ./handy-window { };
   matrix = callPackage ./matrix { };
   media_kit_libs_linux = callPackage ./media_kit_libs_linux { };
-  metadata_god = callPackage ./metadata_god { };
   olm = callPackage ./olm { };
   objectbox_flutter_libs = callPackage ./objectbox_flutter_libs { };
   pdfrx = callPackage ./pdfrx { };

pkgs/development/compilers/dart/package-source-builders/fvp/default.nix

@@ -1,26 +0,0 @@
-{
-  stdenv,
-  mdk-sdk,
-}:
-
-{ version, src, ... }:
-
-stdenv.mkDerivation rec {
-  pname = "fvp";
-  inherit version src;
-  inherit (src) passthru;
-
-  postPatch = ''
-    sed -i 's|.*libc++.so.1.*|${mdk-sdk}/lib/libc++.so.1|' ./linux/CMakeLists.txt
-    substituteInPlace ./linux/CMakeLists.txt \
-      --replace-fail "fvp_setup_deps()" "include(${mdk-sdk}/lib/cmake/FindMDK.cmake)"
-  '';
-
-  installPhase = ''
-    runHook preInstall
-
-    cp -r . $out
-
-    runHook postInstall
-  '';
-}

pkgs/development/compilers/dart/package-source-builders/metadata_god/default.nix

@@ -1,44 +0,0 @@
-{
-  lib,
-  stdenv,
-  fetchzip,
-  replaceVars,
-}:
-
-{ version, src, ... }:
-
-let
-  inherit (stdenv.hostPlatform) system;
-  selectSystem =
-    attrs: attrs.${system} or (throw "metadata_god: ${stdenv.hostPlatform.system} is not supported");
-  suffix = selectSystem {
-    x86_64-linux = "linux-x64";
-    aarch64-linux = "linux-arm64";
-  };
-  metadata_god = fetchzip {
-    url = "https://github.com/KRTirtho/frb_plugins/releases/download/metadata_god-v0.5.3/linux.tar.gz";
-    hash = "sha256-ZR/q1dF8w4Yab6dRRiS5ZCChVnoecFUrtGiHXGlll9A=";
-    stripRoot = false;
-  };
-in
-stdenv.mkDerivation {
-  pname = "metadata_god";
-  inherit version src;
-  inherit (src) passthru;
-
-  patches = [
-    (replaceVars ./metadata_god.patch {
-      output_lib = "${metadata_god}/${suffix}/libmetadata_god.so";
-    })
-  ];
-
-  installPhase = ''
-    runHook preInstall
-
-    cp -r . $out
-
-    runHook postInstall
-  '';
-
-  meta.sourceProvenance = with lib.sourceTypes; [ binaryBytecode ];
-}

pkgs/development/compilers/dart/package-source-builders/metadata_god/metadata_god.patch

@@ -1,33 +0,0 @@
---- old/linux/CMakeLists.txt	2024-11-30 12:48:42.346266052 +0000
-+++ new/linux/CMakeLists.txt	2024-11-30 12:50:45.495928529 +0000
-@@ -9,29 +9,10 @@
- set(PROJECT_NAME "metadata_god")
- project(${PROJECT_NAME} LANGUAGES CXX)
- 
--# Download the binaries if they are not already present.
--set(LibRoot "${CMAKE_CURRENT_SOURCE_DIR}/${LibraryVersion}")
--set(ArchivePath "${LibRoot}.tar.gz")
--if(NOT EXISTS ${ArchivePath})
--  file(DOWNLOAD
--    "https://github.com/KRTirtho/metadata_god/releases/download/${LibraryVersion}/other.tar.gz"
--    ${ArchivePath}
--    TLS_VERIFY ON
--  )
--endif()
--
--# Extract the binaries, overriding any already present.
--file(REMOVE_RECURSE ${LibRoot})
--file(MAKE_DIRECTORY ${LibRoot})
--execute_process(
--  COMMAND ${CMAKE_COMMAND} -E tar xzf ${ArchivePath}
--  WORKING_DIRECTORY ${LibRoot}
--)
--
- # List of absolute paths to libraries that should be bundled with the plugin.
- # This list could contain prebuilt libraries, or libraries created by an
- # external build triggered from this build file.
- set(metadata_god_bundled_libraries
--  "${LibRoot}/${FLUTTER_TARGET_PLATFORM}/libmetadata_god.so"
-+  @output_lib@
-   PARENT_SCOPE
- )

pkgs/development/compilers/llvm/default.nix

@@ -33,9 +33,9 @@ let
     "20.1.8".officialRelease.sha256 = "sha256-ysyB/EYxi2qE9fD5x/F2zI4vjn8UDoo1Z9ukiIrjFGw=";
     "21.1.0-rc3".officialRelease.sha256 = "sha256-quZuqDIm8OrkDJqu7vJKUP8MF1xCuQNFwW9SnKMFoS8=";
     "22.0.0-git".gitRelease = {
-      rev = "b121cdfe197f7d684723b432c766820ab172a7a8";
+      rev = "0b42e117c829c6e127ef4b1bd82807ba01853128";
-      rev-version = "22.0.0-unstable-2025-08-24";
+      rev-version = "22.0.0-unstable-2025-08-31";
-      sha256 = "sha256-SHR+xoaGlGMp1eqwDyDxdQjjjgbG3UNsDq+wrp2y1Y8=";
+      sha256 = "sha256-rClCPbTYqw0ZO9dJqJn3bqtuu9yxwcEfJs3vAW2xjAc=";
     };
   }
   // llvmVersions;

pkgs/development/libraries/qtpbfimageplugin/default.nix

@@ -8,13 +8,13 @@
 
 stdenv.mkDerivation rec {
   pname = "qtpbfimageplugin";
-  version = "4.5";
+  version = "4.7";
 
   src = fetchFromGitHub {
     owner = "tumic0";
     repo = "QtPBFImagePlugin";
     tag = version;
-    hash = "sha256-uhlm2ELRsWwm2V87ANKT9LdhUdlbfu1I8K98npryq2I=";
+    hash = "sha256-XcHfzBMLCP5ScGz1COpl+kYXzEZATYqvhDfKVS7ona4=";
   };
 
   nativeBuildInputs = [

pkgs/development/python-modules/ase/default.nix

@@ -3,8 +3,6 @@
   stdenv,
   fetchFromGitLab,
   buildPythonPackage,
-  isPy27,
-  fetchPypi,
   pythonAtLeast,
 
   # build-system
@@ -29,14 +27,14 @@
 
 buildPythonPackage rec {
   pname = "ase";
-  version = "3.25.0-unstable-2025-06-24";
+  version = "3.26.0";
   pyproject = true;
 
   src = fetchFromGitLab {
     owner = "ase";
     repo = "ase";
-    rev = "4e22dabfbe7ae2329e50260ca1b6f08a83527ac3";
+    tag = version;
-    hash = "sha256-ehMyVtPxfTxT8T418VyLGnUEyYip4LPTTaGL0va7qgM=";
+    hash = "sha256-1738NQPgOqSr2PZu1T2b9bL0V+ZzGk2jcWBhLF21VQs=";
   };
 
   build-system = [ setuptools ];
@@ -79,7 +77,8 @@ buildPythonPackage rec {
 
   meta = {
     description = "Atomic Simulation Environment";
-    homepage = "https://wiki.fysik.dtu.dk/ase/";
+    homepage = "https://ase-lib.org/";
+    changelog = "https://ase-lib.org/releasenotes.html";
     license = lib.licenses.lgpl21Plus;
     maintainers = [ ];
   };

pkgs/development/python-modules/atproto/default.nix

@@ -27,7 +27,7 @@
 
 buildPythonPackage rec {
   pname = "atproto";
-  version = "0.0.61";
+  version = "0.0.62";
   format = "pyproject";
   disabled = pythonOlder "3.8";
 
@@ -36,7 +36,7 @@ buildPythonPackage rec {
     owner = "MarshalX";
     repo = "atproto";
     tag = "v${version}";
-    hash = "sha256-90u/ew5j6kRU8Mow/dXTUXpv2FbEFpKRPGoaWQ7gvSA=";
+    hash = "sha256-T1Jdg62fSV+5qC486Agsuk6qrDhGSNHq75uvOyvOwpA=";
   };
 
   POETRY_DYNAMIC_VERSIONING_BYPASS = version;

pkgs/development/python-modules/boto3-stubs/default.nix

@@ -359,7 +359,7 @@
 
 buildPythonPackage rec {
   pname = "boto3-stubs";
-  version = "1.40.20";
+  version = "1.40.21";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
@@ -367,7 +367,7 @@ buildPythonPackage rec {
   src = fetchPypi {
     pname = "boto3_stubs";
     inherit version;
-    hash = "sha256-Wv2WCM7csPgJOcL+i8J3vAi8V0OlrtdiaMozyc7G9X0=";
+    hash = "sha256-7zb2XH/ob/vJPBQY+okEgDzjvP/DyTLD0a4zqdAvoc0=";
   };
 
   build-system = [ setuptools ];

pkgs/development/python-modules/botocore-stubs/default.nix

@@ -10,7 +10,7 @@
 
 buildPythonPackage rec {
   pname = "botocore-stubs";
-  version = "1.38.46";
+  version = "1.40.21";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
@@ -18,7 +18,7 @@ buildPythonPackage rec {
   src = fetchPypi {
     pname = "botocore_stubs";
     inherit version;
-    hash = "sha256-oE5pdmq4uuM4kRwYl0kviNBc1InNdfBubrTxNfnajHs=";
+    hash = "sha256-Gld35OTwM17X0xhbDypVwfxeoeYP4mTN6lGhccOwsBE=";
   };
 
   nativeBuildInputs = [ setuptools ];

pkgs/development/python-modules/braintree/default.nix

@@ -9,14 +9,14 @@
 
 buildPythonPackage rec {
   pname = "braintree";
-  version = "4.29.0";
+  version = "4.38.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "braintree";
     repo = "braintree_python";
     rev = version;
-    hash = "sha256-5MF8W2zUVvNiOnmszgJkMDmeYLZ6ppFHqmH6dmlCzQY=";
+    hash = "sha256-cAzqHMkEWaLXHbPUnkyFF5UD43rPk6txRSB2n9NJLTE=";
   };
 
   build-system = [ setuptools ];

pkgs/development/python-modules/chirpstack-api/default.nix

@@ -9,7 +9,7 @@
 
 buildPythonPackage rec {
   pname = "chirpstack-api";
-  version = "3.12.4";
+  version = "3.12.5";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -18,7 +18,7 @@ buildPythonPackage rec {
     owner = "brocaar";
     repo = "chirpstack-api";
     rev = "v${version}";
-    hash = "sha256-69encHMk0eXE2Av87ysKvxoiXog5o68qCUlOx/lgHFU=";
+    hash = "sha256-TDwvUNnGAbt10lLg6U7q+JMg7uu8TLySYqNyt/uk8UY=";
   };
 
   sourceRoot = "${src.name}/python/src";

pkgs/development/python-modules/django-currentuser/default.nix

@@ -13,7 +13,7 @@
 
 buildPythonPackage rec {
   pname = "django-currentuser";
-  version = "0.8.0";
+  version = "0.9.0";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -22,7 +22,7 @@ buildPythonPackage rec {
     owner = "zsoldosp";
     repo = "django-currentuser";
     tag = "v${version}";
-    hash = "sha256-buWYVl/nGxzoaDgA6Ds2R/AhGTYpi9JxxO0ER8Vuly4=";
+    hash = "sha256-pfgsVsWM/aehZZAQzjL1fdsqWlfnquOniu76UoLPREI=";
   };
 
   build-system = [