Merge 5553a77a0a into haskell-updates

ci/OWNERS

@@ -253,6 +253,7 @@ pkgs/development/python-modules/buildcatrust/ @ajs124 @lukegb @mweinelt
 /nixos/tests/postgresql @NixOS/postgres
 
 # MySQL/MariaDB and related stuff
+/nixos/modules/services/databases/mysql.nix     @6543
 /nixos/modules/services/backup/mysql-backup.nix @6543
 
 # Hardened profile & related modules

ci/eval/default.nix

@@ -87,8 +87,10 @@ let
         export NIX_SHOW_STATS_PATH="$outputDir/stats/$myChunk"
         echo "Chunk $myChunk on $system start"
         set +e
-        command time -f "Chunk $myChunk on $system done [%MKB max resident, %Es elapsed] %C" \
+        command time -o "$outputDir/timestats/$myChunk" \
+          -f "Chunk $myChunk on $system done [%MKB max resident, %Es elapsed] %C" \
           nix-env -f "${nixpkgs}/pkgs/top-level/release-attrpaths-parallel.nix" \
+          --eval-system "$system" \
           --option restrict-eval true \
           --option allow-import-from-derivation false \
           --query --available \
@@ -102,13 +104,19 @@ let
           --arg includeBroken ${lib.boolToString includeBroken} \
           -I ${nixpkgs} \
           -I ${attrpathFile} \
-          > "$outputDir/result/$myChunk"
+          > "$outputDir/result/$myChunk" \
+          2> "$outputDir/stderr/$myChunk"
         exitCode=$?
         set -e
+        cat "$outputDir/stderr/$myChunk"
+        cat "$outputDir/timestats/$myChunk"
         if (( exitCode != 0 )); then
           echo "Evaluation failed with exit code $exitCode"
           # This immediately halts all xargs processes
           kill $PPID
+        elif [[ -s "$outputDir/stderr/$myChunk" ]]; then
+          echo "Nixpkgs on $system evaluated with warnings, aborting"
+          kill $PPID
         fi
       '';
     in
@@ -164,7 +172,7 @@ let
         ''}
 
         chunkOutputDir=$(mktemp -d)
-        mkdir "$chunkOutputDir"/{result,stats}
+        mkdir "$chunkOutputDir"/{result,stats,timestats,stderr}
 
         seq -w 0 "$seq_end" |
           command time -f "%e" -o "$out/total-time" \

maintainers/maintainer-list.nix

@@ -3065,6 +3065,12 @@
     githubId = 19915050;
     name = "binarycat";
   };
+  binarydigitz01 = {
+    email = "binarydigitz01@protonmail.com";
+    github = "binarydigitz01";
+    githubId = 47600778;
+    name = "Arnav Vijaywargiya";
+  };
   binary-eater = {
     email = "sergeantsagara@protonmail.com";
     github = "Binary-Eater";
@@ -7498,6 +7504,12 @@
     name = "A Frederick Christensen";
     keys = [ { fingerprint = "5A49 F4F9 3EDC 21E9 B7CC  4E94 9EEF 4142 5355 8AC4"; } ];
   };
+  fazzi = {
+    email = "faaris.ansari@proton.me";
+    github = "fxzzi";
+    githubId = 18248986;
+    name = "Faaris Ansari";
+  };
   fbeffa = {
     email = "beffa@fbengineering.ch";
     github = "fedeinthemix";
@@ -11418,6 +11430,12 @@
     github = "jordanisaacs";
     githubId = 19742638;
   };
+  jorikvanveen = {
+    email = "vanveenjorik@protonmail.com";
+    github = "jorikvanveen";
+    githubId = 33939820;
+    name = "Jorik van Veen";
+  };
   jorise = {
     email = "info@jorisengbers.nl";
     github = "JorisE";

maintainers/team-list.nix

@@ -770,7 +770,6 @@ with lib.maintainers;
       mguentner
       ralith
       dandellion
-      sumnerevans
       nickcao
       teutat3s
     ];

nixos/doc/manual/release-notes/rl-2505.section.md

@@ -362,6 +362,8 @@
 
 - `borgmatic` has been updated from 1.8.14 to 1.9.5, please check the [upstream changelog](https://projects.torsion.org/borgmatic-collective/borgmatic/releases) for more details, especially for a few possibly breaking changes noted in the [1.9.0 changelog](https://projects.torsion.org/borgmatic-collective/borgmatic/releases/tag/1.9.0).
 
+- `programs.xonsh.package` now gets overrided internally with `extraPackages` to support `programs.xonsh.extraPackages`. See `programs.xonsh.extraPackages` for more details.
+
 - `nodePackages.ganache` has been removed, as the package has been deprecated by upstream.
 
 - `virtualisation.azure.agent` option provided by `azure-agent.nix` is replaced by `services.waagent`, and will be removed in a future release.
@@ -468,6 +470,8 @@
 
 - `networking.wireguard` now has an optional networkd backend. It is enabled by default when `networking.useNetworkd` is enabled, and it can be enabled alongside scripted networking with `networking.wireguard.useNetworkd`. Some `networking.wireguard` options have slightly different behavior with the networkd and script-based backends, documented in each option.
 
+- `services.rss-bridge` now has a `package` option as well as support for `caddy` as reverse proxy.
+
 - `services.avahi.ipv6` now defaults to true.
 
 - The Home Assistant module has new options {option}`services.home-assistant.blueprints.automation`, `services.home-assistant.blueprints.script`, and {option}`services.home-assistant.blueprints.template` that allow for the declarative installation of [blueprints](https://www.home-assistant.io/docs/blueprint/) into the appropriate configuration directories.

nixos/modules/config/nix.nix

@@ -27,7 +27,6 @@ let
     literalExpression
     mapAttrsToList
     mkAfter
-    mkDefault
     mkIf
     mkOption
     mkRenamedOptionModuleWith
@@ -316,15 +315,25 @@ in
 
             system-features = mkOption {
               type = types.listOf types.str;
-              example = [ "kvm" "big-parallel" "gccarch-skylake" ];
+              default =
+                [
+                  "nixos-test"
+                  "benchmark"
+                  "big-parallel"
+                  "kvm"
+                ]
+                ++ optionals (pkgs.stdenv.hostPlatform ? gcc.arch) (
+                  # a builder can run code for `gcc.arch` and inferior architectures
+                  [ "gccarch-${pkgs.stdenv.hostPlatform.gcc.arch}" ]
+                  ++ map (x: "gccarch-${x}") (
+                    systems.architectures.inferiors.${pkgs.stdenv.hostPlatform.gcc.arch} or [ ]
+                  )
+                );
+              defaultText = literalExpression ''[ "nixos-test" "benchmark" "big-parallel" "kvm" "gccarch-<arch>" ]'';
               description = ''
                 The set of features supported by the machine. Derivations
                 can express dependencies on system features through the
                 `requiredSystemFeatures` attribute.
-
-                By default, pseudo-features `nixos-test`, `benchmark`,
-                and `big-parallel` used in Nixpkgs are set, `kvm`
-                is also included if it is available.
               '';
             };
 
@@ -350,7 +359,6 @@ in
             use-sandbox = true;
             show-trace = true;
 
-            system-features = [ "big-parallel" "kvm" "recursive-nix" ];
             sandbox-paths = [ "/bin/sh=''${pkgs.busybox-sandbox-shell.out}/bin/busybox" ];
           }
         '';
@@ -377,14 +385,6 @@ in
       trusted-public-keys = [ "cache.nixos.org-1:6NCHdD59X431o0gWypbMrAURkbJ16ZPMQFGspcDShjY=" ];
       trusted-users = [ "root" ];
       substituters = mkAfter [ "https://cache.nixos.org/" ];
-      system-features = mkDefault (
-        [ "nixos-test" "benchmark" "big-parallel" "kvm" ] ++
-        optionals (pkgs.stdenv.hostPlatform ? gcc.arch) (
-          # a builder can run code for `gcc.arch` and inferior architectures
-          [ "gccarch-${pkgs.stdenv.hostPlatform.gcc.arch}" ] ++
-          map (x: "gccarch-${x}") (systems.architectures.inferiors.${pkgs.stdenv.hostPlatform.gcc.arch} or [])
-        )
-      );
     };
   };
 }

nixos/modules/module-list.nix

@@ -737,7 +737,6 @@
   ./services/matrix/hebbot.nix
   ./services/matrix/hookshot.nix
   ./services/matrix/maubot.nix
-  ./services/matrix/mautrix-facebook.nix
   ./services/matrix/mautrix-meta.nix
   ./services/matrix/mautrix-signal.nix
   ./services/matrix/mautrix-telegram.nix

nixos/modules/programs/xonsh.nix

@@ -5,7 +5,7 @@
 let
 
   cfg = config.programs.xonsh;
-
+  package = cfg.package.override { inherit (cfg) extraPackages; };
 in
 
 {
@@ -32,6 +32,21 @@ in
         type = lib.types.lines;
       };
 
+      extraPackages = lib.mkOption {
+        default = (ps: [ ]);
+        type = with lib.types; coercedTo (listOf lib.types.package) (v: (_: v)) (functionTo (listOf lib.types.package));
+        description = ''
+          Add the specified extra packages to the xonsh package.
+          Preferred over using `programs.xonsh.package` as it composes with `programs.xonsh.xontribs`.
+
+          Take care in using this option along with manually defining the package
+          option above, as the two can result in conflicting sets of build dependencies.
+          This option assumes that the package option has an overridable argument
+          called `extraPackages`, so if you override the package option but also
+          intend to use this option, be sure that your resulting package still honors
+          the necessary option.
+        '';
+      };
     };
 
   };
@@ -64,11 +79,11 @@ in
       ${cfg.config}
     '';
 
-    environment.systemPackages = [ cfg.package ];
+    environment.systemPackages = [ package ];
 
     environment.shells = [
       "/run/current-system/sw/bin/xonsh"
-      "${lib.getExe cfg.package}"
+      "${lib.getExe package}"
     ];
   };
 }

nixos/modules/services/databases/mysql.nix

@@ -1,4 +1,9 @@
-{ config, lib, pkgs, ... }:
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
 let
 
   cfg = config.services.mysql;
@@ -8,8 +13,7 @@ let
   # Oracle MySQL has supported "notify" service type since 8.0
   hasNotify = isMariaDB || (isOracle && lib.versionAtLeast cfg.package.version "8.0");
 
-  mysqldOptions =
-    "--user=${cfg.user} --datadir=${cfg.dataDir} --basedir=${cfg.package}";
+  mysqldOptions = "--user=${cfg.user} --datadir=${cfg.dataDir} --basedir=${cfg.package}";
 
   format = pkgs.formats.ini { listsAsDuplicateKeys = true; };
   configFile = format.generate "my.cnf" cfg.settings;
@@ -18,11 +22,31 @@ in
 
 {
   imports = [
-    (lib.mkRemovedOptionModule [ "services" "mysql" "pidDir" ] "Don't wait for pidfiles, describe dependencies through systemd.")
-    (lib.mkRemovedOptionModule [ "services" "mysql" "rootPassword" ] "Use socket authentication or set the password outside of the nix store.")
-    (lib.mkRemovedOptionModule [ "services" "mysql" "extraOptions" ] "Use services.mysql.settings.mysqld instead.")
-    (lib.mkRemovedOptionModule [ "services" "mysql" "bind" ] "Use services.mysql.settings.mysqld.bind-address instead.")
-    (lib.mkRemovedOptionModule [ "services" "mysql" "port" ] "Use services.mysql.settings.mysqld.port instead.")
+    (lib.mkRemovedOptionModule [
+      "services"
+      "mysql"
+      "pidDir"
+    ] "Don't wait for pidfiles, describe dependencies through systemd.")
+    (lib.mkRemovedOptionModule [
+      "services"
+      "mysql"
+      "rootPassword"
+    ] "Use socket authentication or set the password outside of the nix store.")
+    (lib.mkRemovedOptionModule [
+      "services"
+      "mysql"
+      "extraOptions"
+    ] "Use services.mysql.settings.mysqld instead.")
+    (lib.mkRemovedOptionModule [
+      "services"
+      "mysql"
+      "bind"
+    ] "Use services.mysql.settings.mysqld.bind-address instead.")
+    (lib.mkRemovedOptionModule [
+      "services"
+      "mysql"
+      "port"
+    ] "Use services.mysql.settings.mysqld.port instead.")
   ];
 
   ###### interface
@@ -106,7 +130,7 @@ in
 
       settings = lib.mkOption {
         type = format.type;
-        default = {};
+        default = { };
         description = ''
           MySQL configuration. Refer to
           <https://dev.mysql.com/doc/refman/5.7/en/server-system-variables.html>,
@@ -137,25 +161,27 @@ in
       };
 
       initialDatabases = lib.mkOption {
-        type = lib.types.listOf (lib.types.submodule {
-          options = {
-            name = lib.mkOption {
-              type = lib.types.str;
-              description = ''
-                The name of the database to create.
-              '';
+        type = lib.types.listOf (
+          lib.types.submodule {
+            options = {
+              name = lib.mkOption {
+                type = lib.types.str;
+                description = ''
+                  The name of the database to create.
+                '';
+              };
+              schema = lib.mkOption {
+                type = lib.types.nullOr lib.types.path;
+                default = null;
+                description = ''
+                  The initial schema of the database; if null (the default),
+                  an empty database is created.
+                '';
+              };
             };
-            schema = lib.mkOption {
-              type = lib.types.nullOr lib.types.path;
-              default = null;
-              description = ''
-                The initial schema of the database; if null (the default),
-                an empty database is created.
-              '';
-            };
-          };
-        });
-        default = [];
+          }
+        );
+        default = [ ];
         description = ''
           List of database names and their initial schemas that should be used to create databases on the first startup
           of MySQL. The schema attribute is optional: If not specified, an empty database is created.
@@ -176,7 +202,7 @@ in
 
       ensureDatabases = lib.mkOption {
         type = lib.types.listOf lib.types.str;
-        default = [];
+        default = [ ];
         description = ''
           Ensures that the specified databases exist.
           This option will never delete existing databases, especially not when the value of this
@@ -190,39 +216,41 @@ in
       };
 
       ensureUsers = lib.mkOption {
-        type = lib.types.listOf (lib.types.submodule {
-          options = {
-            name = lib.mkOption {
-              type = lib.types.str;
-              description = ''
-                Name of the user to ensure.
-              '';
-            };
-            ensurePermissions = lib.mkOption {
-              type = lib.types.attrsOf lib.types.str;
-              default = {};
-              description = ''
-                Permissions to ensure for the user, specified as attribute set.
-                The attribute names specify the database and tables to grant the permissions for,
-                separated by a dot. You may use wildcards here.
-                The attribute values specfiy the permissions to grant.
-                You may specify one or multiple comma-separated SQL privileges here.
+        type = lib.types.listOf (
+          lib.types.submodule {
+            options = {
+              name = lib.mkOption {
+                type = lib.types.str;
+                description = ''
+                  Name of the user to ensure.
+                '';
+              };
+              ensurePermissions = lib.mkOption {
+                type = lib.types.attrsOf lib.types.str;
+                default = { };
+                description = ''
+                  Permissions to ensure for the user, specified as attribute set.
+                  The attribute names specify the database and tables to grant the permissions for,
+                  separated by a dot. You may use wildcards here.
+                  The attribute values specfiy the permissions to grant.
+                  You may specify one or multiple comma-separated SQL privileges here.
 
-                For more information on how to specify the target
-                and on which privileges exist, see the
-                [GRANT syntax](https://mariadb.com/kb/en/library/grant/).
-                The attributes are used as `GRANT ''${attrName} ON ''${attrValue}`.
-              '';
-              example = lib.literalExpression ''
-                {
-                  "database.*" = "ALL PRIVILEGES";
-                  "*.*" = "SELECT, LOCK TABLES";
-                }
-              '';
+                  For more information on how to specify the target
+                  and on which privileges exist, see the
+                  [GRANT syntax](https://mariadb.com/kb/en/library/grant/).
+                  The attributes are used as `GRANT ''${attrName} ON ''${attrValue}`.
+                '';
+                example = lib.literalExpression ''
+                  {
+                    "database.*" = "ALL PRIVILEGES";
+                    "*.*" = "SELECT, LOCK TABLES";
+                  }
+                '';
+              };
             };
-          };
-        });
-        default = [];
+          }
+        );
+        default = [ ];
         description = ''
           Ensures that the specified users exist and have at least the ensured permissions.
           The MySQL users will be identified using Unix socket authentication. This authenticates the Unix user with the
@@ -251,7 +279,11 @@ in
 
       replication = {
         role = lib.mkOption {
-          type = lib.types.enum [ "master" "slave" "none" ];
+          type = lib.types.enum [
+            "master"
+            "slave"
+            "none"
+          ];
           default = "none";
           description = "Role of the MySQL server instance.";
         };
@@ -292,14 +324,13 @@ in
 
   };
 
-
   ###### implementation
 
   config = lib.mkIf cfg.enable {
 
-    services.mysql.dataDir =
-      lib.mkDefault (if lib.versionAtLeast config.system.stateVersion "17.09" then "/var/lib/mysql"
-                 else "/var/mysql");
+    services.mysql.dataDir = lib.mkDefault (
+      if lib.versionAtLeast config.system.stateVersion "17.09" then "/var/lib/mysql" else "/var/mysql"
+    );
 
     services.mysql.settings.mysqld = lib.mkMerge [
       {
@@ -311,7 +342,11 @@ in
         log-bin-index = "mysql-bin-${toString cfg.replication.serverId}.index";
         relay-log = "mysql-relay-bin";
         server-id = cfg.replication.serverId;
-        binlog-ignore-db = [ "information_schema" "performance_schema" "mysql" ];
+        binlog-ignore-db = [
+          "information_schema"
+          "performance_schema"
+          "mysql"
+        ];
       })
       (lib.mkIf (!isMariaDB) {
         plugin-load-add = [ "auth_socket.so" ];
@@ -355,17 +390,21 @@ in
         pkgs.nettools
       ];
 
-      preStart = if isMariaDB then ''
-        if ! test -e ${cfg.dataDir}/mysql; then
-          ${cfg.package}/bin/mysql_install_db --defaults-file=/etc/my.cnf ${mysqldOptions}
-          touch ${cfg.dataDir}/mysql_init
-        fi
-      '' else ''
-        if ! test -e ${cfg.dataDir}/mysql; then
-          ${cfg.package}/bin/mysqld --defaults-file=/etc/my.cnf ${mysqldOptions} --initialize-insecure
-          touch ${cfg.dataDir}/mysql_init
-        fi
-      '';
+      preStart =
+        if isMariaDB then
+          ''
+            if ! test -e ${cfg.dataDir}/mysql; then
+              ${cfg.package}/bin/mysql_install_db --defaults-file=/etc/my.cnf ${mysqldOptions}
+              touch ${cfg.dataDir}/mysql_init
+            fi
+          ''
+        else
+          ''
+            if ! test -e ${cfg.dataDir}/mysql; then
+              ${cfg.package}/bin/mysqld --defaults-file=/etc/my.cnf ${mysqldOptions} --initialize-insecure
+              touch ${cfg.dataDir}/mysql_init
+            fi
+          '';
 
       script = ''
         # https://mariadb.com/kb/en/getting-started-with-mariadb-galera-cluster/#systemd-and-galera-recovery
@@ -379,52 +418,55 @@ in
         exec ${cfg.package}/bin/mysqld --defaults-file=/etc/my.cnf ${mysqldOptions} $_WSREP_NEW_CLUSTER $_WSREP_START_POSITION
       '';
 
-      postStart = let
-        # The super user account to use on *first* run of MySQL server
-        superUser = if isMariaDB then cfg.user else "root";
-      in ''
-        ${lib.optionalString (!hasNotify) ''
-          # Wait until the MySQL server is available for use
-          while [ ! -e /run/mysqld/mysqld.sock ]
-          do
-              echo "MySQL daemon not yet started. Waiting for 1 second..."
-              sleep 1
-          done
-        ''}
+      postStart =
+        let
+          # The super user account to use on *first* run of MySQL server
+          superUser = if isMariaDB then cfg.user else "root";
+        in
+        ''
+          ${lib.optionalString (!hasNotify) ''
+            # Wait until the MySQL server is available for use
+            while [ ! -e /run/mysqld/mysqld.sock ]
+            do
+                echo "MySQL daemon not yet started. Waiting for 1 second..."
+                sleep 1
+            done
+          ''}
 
-        if [ -f ${cfg.dataDir}/mysql_init ]
-        then
-            # While MariaDB comes with a 'mysql' super user account since 10.4.x, MySQL does not
-            # Since we don't want to run this service as 'root' we need to ensure the account exists on first run
-            ( echo "CREATE USER IF NOT EXISTS '${cfg.user}'@'localhost' IDENTIFIED WITH ${if isMariaDB then "unix_socket" else "auth_socket"};"
-              echo "GRANT ALL PRIVILEGES ON *.* TO '${cfg.user}'@'localhost' WITH GRANT OPTION;"
-            ) | ${cfg.package}/bin/mysql -u ${superUser} -N
+          if [ -f ${cfg.dataDir}/mysql_init ]
+          then
+              # While MariaDB comes with a 'mysql' super user account since 10.4.x, MySQL does not
+              # Since we don't want to run this service as 'root' we need to ensure the account exists on first run
+              ( echo "CREATE USER IF NOT EXISTS '${cfg.user}'@'localhost' IDENTIFIED WITH ${
+                if isMariaDB then "unix_socket" else "auth_socket"
+              };"
+                echo "GRANT ALL PRIVILEGES ON *.* TO '${cfg.user}'@'localhost' WITH GRANT OPTION;"
+              ) | ${cfg.package}/bin/mysql -u ${superUser} -N
 
-            ${lib.concatMapStrings (database: ''
-              # Create initial databases
-              if ! test -e "${cfg.dataDir}/${database.name}"; then
-                  echo "Creating initial database: ${database.name}"
-                  ( echo 'create database `${database.name}`;'
+              ${lib.concatMapStrings (database: ''
+                # Create initial databases
+                if ! test -e "${cfg.dataDir}/${database.name}"; then
+                    echo "Creating initial database: ${database.name}"
+                    ( echo 'create database `${database.name}`;'
 
-                    ${lib.optionalString (database.schema != null) ''
-                    echo 'use `${database.name}`;'
+                      ${lib.optionalString (database.schema != null) ''
+                        echo 'use `${database.name}`;'
 
-                    # TODO: this silently falls through if database.schema does not exist,
-                    # we should catch this somehow and exit, but can't do it here because we're in a subshell.
-                    if [ -f "${database.schema}" ]
-                    then
-                        cat ${database.schema}
-                    elif [ -d "${database.schema}" ]
-                    then
-                        cat ${database.schema}/mysql-databases/*.sql
-                    fi
-                    ''}
-                  ) | ${cfg.package}/bin/mysql -u ${superUser} -N
-              fi
-            '') cfg.initialDatabases}
+                        # TODO: this silently falls through if database.schema does not exist,
+                        # we should catch this somehow and exit, but can't do it here because we're in a subshell.
+                        if [ -f "${database.schema}" ]
+                        then
+                            cat ${database.schema}
+                        elif [ -d "${database.schema}" ]
+                        then
+                            cat ${database.schema}/mysql-databases/*.sql
+                        fi
+                      ''}
+                    ) | ${cfg.package}/bin/mysql -u ${superUser} -N
+                fi
+              '') cfg.initialDatabases}
 
-            ${lib.optionalString (cfg.replication.role == "master")
-              ''
+              ${lib.optionalString (cfg.replication.role == "master") ''
                 # Set up the replication master
 
                 ( echo "use mysql;"
@@ -434,8 +476,7 @@ in
                 ) | ${cfg.package}/bin/mysql -u ${superUser} -N
               ''}
 
-            ${lib.optionalString (cfg.replication.role == "slave")
-              ''
+              ${lib.optionalString (cfg.replication.role == "slave") ''
                 # Set up the replication slave
 
                 ( echo "stop slave;"
@@ -444,34 +485,36 @@ in
                 ) | ${cfg.package}/bin/mysql -u ${superUser} -N
               ''}
 
-            ${lib.optionalString (cfg.initialScript != null)
-              ''
+              ${lib.optionalString (cfg.initialScript != null) ''
                 # Execute initial script
                 # using toString to avoid copying the file to nix store if given as path instead of string,
                 # as it might contain credentials
                 cat ${toString cfg.initialScript} | ${cfg.package}/bin/mysql -u ${superUser} -N
               ''}
 
-            rm ${cfg.dataDir}/mysql_init
-        fi
+              rm ${cfg.dataDir}/mysql_init
+          fi
 
-        ${lib.optionalString (cfg.ensureDatabases != []) ''
-          (
-          ${lib.concatMapStrings (database: ''
-            echo "CREATE DATABASE IF NOT EXISTS \`${database}\`;"
-          '') cfg.ensureDatabases}
-          ) | ${cfg.package}/bin/mysql -N
-        ''}
+          ${lib.optionalString (cfg.ensureDatabases != [ ]) ''
+            (
+            ${lib.concatMapStrings (database: ''
+              echo "CREATE DATABASE IF NOT EXISTS \`${database}\`;"
+            '') cfg.ensureDatabases}
+            ) | ${cfg.package}/bin/mysql -N
+          ''}
 
-        ${lib.concatMapStrings (user:
-          ''
-            ( echo "CREATE USER IF NOT EXISTS '${user.name}'@'localhost' IDENTIFIED WITH ${if isMariaDB then "unix_socket" else "auth_socket"};"
-              ${lib.concatStringsSep "\n" (lib.mapAttrsToList (database: permission: ''
-                echo "GRANT ${permission} ON ${database} TO '${user.name}'@'localhost';"
-              '') user.ensurePermissions)}
+          ${lib.concatMapStrings (user: ''
+            ( echo "CREATE USER IF NOT EXISTS '${user.name}'@'localhost' IDENTIFIED WITH ${
+              if isMariaDB then "unix_socket" else "auth_socket"
+            };"
+              ${lib.concatStringsSep "\n" (
+                lib.mapAttrsToList (database: permission: ''
+                  echo "GRANT ${permission} ON ${database} TO '${user.name}'@'localhost';"
+                '') user.ensurePermissions
+              )}
             ) | ${cfg.package}/bin/mysql -N
           '') cfg.ensureUsers}
-      '';
+        '';
 
       serviceConfig = lib.mkMerge [
         {
@@ -500,7 +543,11 @@ in
           ProtectKernelTunables = true;
           ProtectKernelModules = true;
           ProtectControlGroups = true;
-          RestrictAddressFamilies = [ "AF_UNIX" "AF_INET" "AF_INET6" ];
+          RestrictAddressFamilies = [
+            "AF_UNIX"
+            "AF_INET"
+            "AF_INET6"
+          ];
           LockPersonality = true;
           MemoryDenyWriteExecute = true;
           RestrictRealtime = true;
@@ -516,4 +563,6 @@ in
       ];
     };
   };
+
+  meta.maintainers = [ lib.maintainers._6543 ];
 }

nixos/modules/services/matrix/conduwuit.nix

@@ -246,22 +246,8 @@ in
         RestrictRealtime = true;
         SystemCallArchitectures = "native";
         SystemCallFilter = [
-          "@system-service"
-          "@resources"
-          "~@clock"
-          "@debug"
-          "@module"
-          "@mount"
-          "@reboot"
-          "@swap"
-          "@cpu-emulation"
-          "@obsolete"
-          "@timer"
-          "@chown"
-          "@setuid"
-          "@privileged"
-          "@keyring"
-          "@ipc"
+          "@system-service @resources"
+          "~@clock @debug @module @mount @reboot @swap @cpu-emulation @obsolete @timer @chown @setuid @privileged @keyring @ipc"
         ];
         SystemCallErrorNumber = "EPERM";
 

nixos/modules/services/matrix/mautrix-facebook.nix

@@ -1,203 +0,0 @@
-{
-  config,
-  pkgs,
-  lib,
-  ...
-}:
-let
-  cfg = config.services.mautrix-facebook;
-  settingsFormat = pkgs.formats.json { };
-  settingsFile = settingsFormat.generate "mautrix-facebook-config.json" cfg.settings;
-
-  puppetRegex = lib.concatStringsSep ".*" (
-    map lib.escapeRegex (lib.splitString "{userid}" cfg.settings.bridge.username_template)
-  );
-in
-{
-  options = {
-    services.mautrix-facebook = {
-      enable = lib.mkEnableOption "Mautrix-Facebook, a Matrix-Facebook hybrid puppeting/relaybot bridge";
-
-      settings = lib.mkOption rec {
-        apply = lib.recursiveUpdate default;
-        type = settingsFormat.type;
-        default = {
-          homeserver = {
-            address = "http://localhost:8008";
-            software = "standard";
-          };
-
-          appservice = rec {
-            id = "facebook";
-            address = "http://${hostname}:${toString port}";
-            hostname = "localhost";
-            port = 29319;
-
-            database = "postgresql://";
-
-            bot_username = "facebookbot";
-          };
-
-          metrics.enabled = false;
-          manhole.enabled = false;
-
-          bridge = {
-            encryption = {
-              allow = true;
-              default = true;
-
-              verification_levels = {
-                receive = "cross-signed-tofu";
-                send = "cross-signed-tofu";
-                share = "cross-signed-tofu";
-              };
-            };
-            username_template = "facebook_{userid}";
-          };
-
-          logging = {
-            version = 1;
-            formatters.journal_fmt.format = "%(name)s: %(message)s";
-            handlers.journal = {
-              class = "systemd.journal.JournalHandler";
-              formatter = "journal_fmt";
-              SYSLOG_IDENTIFIER = "mautrix-facebook";
-            };
-            root = {
-              level = "INFO";
-              handlers = [ "journal" ];
-            };
-          };
-        };
-        example = lib.literalExpression ''
-          {
-            homeserver = {
-              address = "http://localhost:8008";
-              domain = "mydomain.example";
-            };
-
-            bridge.permissions = {
-              "@admin:mydomain.example" = "admin";
-              "mydomain.example" = "user";
-            };
-          }
-        '';
-        description = ''
-          {file}`config.yaml` configuration as a Nix attribute set.
-          Configuration options should match those described in
-          [example-config.yaml](https://github.com/mautrix/facebook/blob/master/mautrix_facebook/example-config.yaml).
-
-          Secret tokens should be specified using {option}`environmentFile`
-          instead of this world-readable attribute set.
-        '';
-      };
-
-      environmentFile = lib.mkOption {
-        type = lib.types.nullOr lib.types.path;
-        default = null;
-        description = ''
-          File containing environment variables to be passed to the mautrix-facebook service.
-
-          Any config variable can be overridden by setting `MAUTRIX_FACEBOOK_SOME_KEY` to override the `some.key` variable.
-        '';
-      };
-
-      configurePostgresql = lib.mkOption {
-        type = lib.types.bool;
-        default = true;
-        description = ''
-          Enable PostgreSQL and create a user and database for mautrix-facebook. The default `settings` reference this database, if you disable this option you must provide a database URL.
-        '';
-      };
-
-      registrationData = lib.mkOption {
-        type = lib.types.attrs;
-        default = { };
-        description = ''
-          Output data for appservice registration. Simply make any desired changes and serialize to JSON. Note that this data contains secrets so think twice before putting it into the nix store.
-
-          Currently `as_token` and `hs_token` need to be added as they are not known to this module.
-        '';
-      };
-    };
-  };
-
-  config = lib.mkIf cfg.enable {
-    users.groups.mautrix-facebook = { };
-
-    users.users.mautrix-facebook = {
-      group = "mautrix-facebook";
-      isSystemUser = true;
-    };
-
-    services.postgresql = lib.mkIf cfg.configurePostgresql {
-      ensureDatabases = [ "mautrix-facebook" ];
-      ensureUsers = [
-        {
-          name = "mautrix-facebook";
-          ensureDBOwnership = true;
-        }
-      ];
-    };
-
-    systemd.services.mautrix-facebook = rec {
-      wantedBy = [ "multi-user.target" ];
-      wants =
-        [
-          "network-online.target"
-        ]
-        ++ lib.optional config.services.matrix-synapse.enable config.services.matrix-synapse.serviceUnit
-        ++ lib.optional cfg.configurePostgresql "postgresql.service";
-      after = wants;
-
-      serviceConfig = {
-        Type = "simple";
-        Restart = "always";
-
-        User = "mautrix-facebook";
-
-        ProtectSystem = "strict";
-        ProtectHome = true;
-        ProtectKernelTunables = true;
-        ProtectKernelModules = true;
-        ProtectControlGroups = true;
-        PrivateTmp = true;
-
-        EnvironmentFile = cfg.environmentFile;
-
-        ExecStart = ''
-          ${pkgs.mautrix-facebook}/bin/mautrix-facebook --config=${settingsFile}
-        '';
-      };
-    };
-
-    services.mautrix-facebook = {
-      registrationData = {
-        id = cfg.settings.appservice.id;
-
-        namespaces = {
-          users = [
-            {
-              exclusive = true;
-              regex = lib.escapeRegex "@${cfg.settings.appservice.bot_username}:${cfg.settings.homeserver.domain}";
-            }
-            {
-              exclusive = true;
-              regex = "@${puppetRegex}:${lib.escapeRegex cfg.settings.homeserver.domain}";
-            }
-          ];
-          aliases = [ ];
-        };
-
-        url = cfg.settings.appservice.address;
-        sender_localpart = "mautrix-facebook-sender";
-
-        rate_limited = false;
-        "de.sorunome.msc2409.push_ephemeral" = true;
-        push_ephemeral = true;
-      };
-    };
-  };
-
-  meta.maintainers = with lib.maintainers; [ kevincox ];
-}

nixos/modules/services/matrix/synapse.nix

@@ -1597,9 +1597,9 @@ in
   };
 
   meta = {
+    inherit (pkgs.matrix-synapse.meta) maintainers;
     buildDocsInSandbox = false;
     doc = ./synapse.md;
-    maintainers = teams.matrix.members;
   };
 
 }

nixos/modules/services/misc/autobrr.nix

@@ -9,7 +9,7 @@ let
   cfg = config.services.autobrr;
   configFormat = pkgs.formats.toml { };
   configTemplate = configFormat.generate "autobrr.toml" cfg.settings;
-  templaterCmd = "${lib.getExe pkgs.dasel} put -f '${configTemplate}' -v $(cat ${cfg.secretFile}) -o %S/autobrr/config.toml 'sessionSecret'";
+  templaterCmd = ''${lib.getExe pkgs.dasel} put -f '${configTemplate}' -v "$(${config.systemd.package}/bin/systemd-creds cat sessionSecret)" -o %S/autobrr/config.toml "sessionSecret"'';
 in
 {
   options = {
@@ -73,9 +73,10 @@ in
       serviceConfig = {
         Type = "simple";
         DynamicUser = true;
+        LoadCredential = "sessionSecret:${cfg.secretFile}";
         StateDirectory = "autobrr";
         ExecStartPre = "${lib.getExe pkgs.bash} -c '${templaterCmd}'";
-        ExecStart = "${lib.getExe pkgs.autobrr} --config %S/autobrr";
+        ExecStart = "${lib.getExe cfg.package} --config %S/autobrr";
         Restart = "on-failure";
       };
     };

nixos/modules/services/misc/tabby.nix

@@ -16,7 +16,8 @@ in
 {
   imports = [
     (mkRemovedOptionModule [
-      "settings"
+      "services"
+      "tabby"
       "indexInterval"
     ] "These options are now managed within the tabby WebGUI")
   ];

nixos/modules/services/monitoring/glpi-agent.nix

@@ -77,6 +77,16 @@ in
       }
     ];
 
+    systemd.tmpfiles.settings."10-glpi-agent" = {
+      ${cfg.stateDir} = {
+        d = {
+          mode = "0755";
+          user = "root";
+          group = "root";
+        };
+      };
+    };
+
     systemd.services.glpi-agent = {
       description = "GLPI Agent";
       wantedBy = [ "multi-user.target" ];

nixos/modules/services/networking/yggdrasil.nix

@@ -193,7 +193,7 @@ in
             "${binYggdrasil} -genconf") + " > /run/yggdrasil/yggdrasil.conf"}
 
           # start yggdrasil
-          ${binYggdrasil} -useconffile /run/yggdrasil/yggdrasil.conf ${lib.strings.escapeShellArgs cfg.extraArgs}
+          exec ${binYggdrasil} -useconffile /run/yggdrasil/yggdrasil.conf ${lib.strings.escapeShellArgs cfg.extraArgs}
         '';
 
         serviceConfig = {

nixos/modules/services/web-apps/nextcloud.md

@@ -245,7 +245,7 @@ that are managed by Nix. If you want automatic updates it is recommended that yo
 
 ## Known warnings {#module-services-nextcloud-known-warnings}
 
-### Failed to get an iterator for log entries: Logreader application only supports "file" log_type {#module-services-nextcloud-warning-logreader}
+### Logreader application only supports "file" log_type {#module-services-nextcloud-warning-logreader}
 
 This is because
 
@@ -253,16 +253,12 @@ This is because
 * the Logreader application that allows reading logs in the admin panel is enabled
   by default and requires logs written to a file.
 
-The logreader application doesn't work, as it was the case before. The only change is that
-it complains loudly now. So nothing actionable here by default. Alternatively you can
+If you want to view logs in the admin panel,
+set [](#opt-services.nextcloud.settings.log_type) to "file".
 
-* disable the logreader application to shut up the "error".
-
-  We can't really do that by default since whether apps are enabled/disabled is part
-  of the application's state and tracked inside the database.
-
-* set [](#opt-services.nextcloud.settings.log_type) to "file" to be able to view logs
-  from the admin panel.
+If you prefer logs in the journal, disable the logreader application to shut up the
+"info". We can't really do that by default since whether apps are enabled/disabled
+is part of the application's state and tracked inside the database.
 
 ## Maintainer information {#module-services-nextcloud-maintainer-info}
 

nixos/modules/services/web-apps/rss-bridge.nix

@@ -4,33 +4,53 @@
   pkgs,
   ...
 }:
-with lib;
 let
+  inherit (lib)
+    literalExpression
+    mkDefault
+    mkEnableOption
+    mkIf
+    mkOption
+    mkPackageOption
+    mkRenamedOptionModule
+    types
+    ;
+
   cfg = config.services.rss-bridge;
 
-  poolName = "rss-bridge";
-
-  cfgHalf = lib.mapAttrsRecursive (
-    path: value:
-    let
-      envName = lib.toUpper ("RSSBRIDGE_" + lib.concatStringsSep "_" path);
-      envValue =
-        if lib.isList value then
-          lib.concatStringsSep "," value
-        else if lib.isBool value then
-          lib.boolToString value
-        else
-          toString value;
-    in
-    if (value != null) then "fastcgi_param \"${envName}\" \"${envValue}\";" else null
-  ) cfg.config;
-  cfgEnv = lib.concatStringsSep "\n" (lib.collect lib.isString cfgHalf);
+  cfgEnv = lib.pipe cfg.config [
+    (lib.mapAttrsRecursive (
+      path: value:
+      lib.optionalAttrs (value != null) {
+        name = lib.toUpper "RSSBRIDGE_${lib.concatStringsSep "_" path}";
+        value =
+          if lib.isList value then
+            lib.concatStringsSep "," value
+          else if lib.isBool value then
+            lib.boolToString value
+          else
+            toString value;
+      }
+    ))
+    (lib.collect (x: lib.isString x.name or false && lib.isString x.value or false))
+    lib.listToAttrs
+  ];
 in
 {
   imports = [
     (mkRenamedOptionModule
-      [ "services" "rss-bridge" "whitelist" ]
-      [ "services" "rss-bridge" "config" "system" "enabled_bridges" ]
+      [
+        "services"
+        "rss-bridge"
+        "whitelist"
+      ]
+      [
+        "services"
+        "rss-bridge"
+        "config"
+        "system"
+        "enabled_bridges"
+      ]
     )
   ];
 
@@ -40,27 +60,30 @@ in
 
       user = mkOption {
         type = types.str;
-        default = "nginx";
+        default = if cfg.webserver == null then "rss-bridge" else cfg.webserver;
+        defaultText = "{option}`config.services.rss-bridge.webserver` or \"rss-bridge\"";
         description = ''
-          User account under which both the service and the web-application run.
+          The user account under which both the service and the web application run.
         '';
       };
 
       group = mkOption {
         type = types.str;
-        default = "nginx";
+        default = if cfg.webserver == null then "rss-bridge" else cfg.webserver;
+        defaultText = "{option}`config.services.rss-bridge.webserver` or \"rss-bridge\"";
         description = ''
-          Group under which the web-application run.
+          The group under which the web application runs.
         '';
       };
 
+      package = mkPackageOption pkgs "rss-bridge" { };
+
       pool = mkOption {
-        type = types.str;
-        default = poolName;
+        type = types.nullOr types.str;
+        default = "rss-bridge";
         description = ''
-          Name of existing phpfpm pool that is used to run web-application.
-          If not specified a pool will be created automatically with
-          default values.
+          Name of phpfpm pool that is used to run web-application.
+          If `null` specified none will be created, otherwise automatically created with default values.
         '';
       };
 
@@ -77,7 +100,20 @@ in
         type = types.nullOr types.str;
         default = "rss-bridge";
         description = ''
-          Name of the nginx virtualhost to use and setup. If null, do not setup any virtualhost.
+          Name of the nginx or caddy virtualhost to use and setup. If null, do not setup any virtualhost.
+        '';
+      };
+
+      webserver = mkOption {
+        type = types.nullOr (
+          types.enum [
+            "nginx"
+            "caddy"
+          ]
+        );
+        default = "nginx";
+        description = ''
+          Type of virtualhost to use and setup. If null, do not setup any virtualhost.
         '';
       };
 
@@ -97,12 +133,12 @@ in
                 type = types.str;
                 description = "Directory where to store cache files (if cache.type = \"file\").";
                 default = "${cfg.dataDir}/cache/";
-                defaultText = options.literalExpression "\${config.services.rss-bridge.dataDir}/cache/";
+                defaultText = literalExpression "\${config.services.rss-bridge.dataDir}/cache/";
               };
             };
           };
         };
-        example = options.literalExpression ''
+        example = literalExpression ''
           {
             system.enabled_bridges = [ "*" ];
             error = {
@@ -124,12 +160,12 @@ in
   };
 
   config = mkIf cfg.enable {
-    services.phpfpm.pools = mkIf (cfg.pool == poolName) {
-      ${poolName} = {
+    services.phpfpm.pools = mkIf (cfg.pool != null) {
+      ${cfg.pool} = {
         user = cfg.user;
-        settings = mapAttrs (name: mkDefault) {
+        settings = lib.mapAttrs (name: mkDefault) {
           "listen.owner" = cfg.user;
-          "listen.group" = cfg.user;
+          "listen.group" = cfg.group;
           "listen.mode" = "0600";
           "pm" = "dynamic";
           "pm.max_children" = 75;
@@ -150,11 +186,11 @@ in
       };
     };
 
-    services.nginx = mkIf (cfg.virtualHost != null) {
+    services.nginx = mkIf (cfg.virtualHost != null && cfg.webserver == "nginx") {
       enable = true;
       virtualHosts = {
         ${cfg.virtualHost} = {
-          root = "${pkgs.rss-bridge}";
+          root = "${cfg.package}";
 
           locations."/" = {
             tryFiles = "$uri /index.php$is_args$args";
@@ -166,11 +202,26 @@ in
               fastcgi_split_path_info ^(.+\.php)(/.+)$;
               fastcgi_pass unix:${config.services.phpfpm.pools.${cfg.pool}.socket};
               fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
-              ${cfgEnv}
+              ${lib.concatStringsSep "\n" (lib.mapAttrsToList (n: v: "fastcgi_param \"${n}\" \"${v}\";") cfgEnv)}
             '';
           };
         };
       };
     };
+
+    services.caddy = mkIf (cfg.virtualHost != null && cfg.webserver == "caddy") {
+      enable = true;
+      virtualHosts.${cfg.virtualHost} = {
+        extraConfig = ''
+          root * ${cfg.package}
+          file_server
+          php_fastcgi unix/${config.services.phpfpm.pools.${cfg.pool}.socket} {
+          ${lib.concatStringsSep "\n" (lib.mapAttrsToList (n: v: "  env ${n} \"${v}\"") cfgEnv)}
+          }
+        '';
+      };
+    };
   };
+
+  meta.maintainers = with lib.maintainers; [ quantenzitrone ];
 }

nixos/modules/system/boot/systemd/tmpfiles.nix

@@ -29,10 +29,11 @@ let
       };
     };
     default = {};
-    type = attrsWith' "config-name" (attrsWith' "tmpfiles-type" (attrsWith' "path" (types.submodule ({ name, config, ... }: {
+    type = attrsWith' "config-name" (attrsWith' "path" (attrsWith' "tmpfiles-type" (types.submodule ({ name, config, ... }: {
       options.type = mkOption {
         type = types.str;
         default = name;
+        defaultText = "‹tmpfiles-type›";
         example = "d";
         description = ''
           The type of operation to perform on the file.

nixos/tests/all-tests.nix

@@ -922,7 +922,7 @@ in {
   rshim = handleTest ./rshim.nix {};
   rspamd = handleTest ./rspamd.nix {};
   rspamd-trainer = handleTest ./rspamd-trainer.nix {};
-  rss-bridge = handleTest ./web-apps/rss-bridge.nix {};
+  rss-bridge = handleTest ./web-apps/rss-bridge {};
   rss2email = handleTest ./rss2email.nix {};
   rstudio-server = handleTest ./rstudio-server.nix {};
   rsyncd = handleTest ./rsyncd.nix {};

nixos/tests/matrix/mjolnir.nix

@@ -30,8 +30,8 @@ import ../make-test-python.nix (
   in
   {
     name = "mjolnir";
-    meta = with pkgs.lib; {
-      maintainers = teams.matrix.members;
+    meta = {
+      inherit (pkgs.mjolnir.meta) maintainers;
     };
 
     nodes = {

nixos/tests/matrix/synapse-workers.nix

@@ -2,8 +2,8 @@ import ../make-test-python.nix (
   { pkgs, ... }:
   {
     name = "matrix-synapse-workers";
-    meta = with pkgs.lib; {
-      maintainers = teams.matrix.members;
+    meta = {
+      inherit (pkgs.matrix-synapse.meta) maintainers;
     };
 
     nodes = {

nixos/tests/matrix/synapse.nix

@@ -54,8 +54,8 @@ import ../make-test-python.nix (
   {
 
     name = "matrix-synapse";
-    meta = with pkgs.lib; {
-      maintainers = teams.matrix.members;
+    meta = {
+      inherit (pkgs.matrix-synapse.meta) maintainers;
     };
 
     nodes = {

nixos/tests/web-apps/rss-bridge.nix

@@ -1,22 +0,0 @@
-{ pkgs, ... }:
-{
-  name = "rss-bridge";
-  meta.maintainers = with pkgs.lib.maintainers; [ mynacol ];
-
-  nodes.machine =
-    { ... }:
-    {
-      services.rss-bridge = {
-        enable = true;
-      };
-    };
-
-  testScript = ''
-    start_all()
-    machine.wait_for_unit("nginx.service")
-    machine.wait_for_unit("phpfpm-rss-bridge.service")
-
-    # check for successful feed download
-    machine.succeed("curl -sS -f 'http://localhost/?action=display&bridge=DemoBridge&context=testCheckbox&format=Atom'")
-  '';
-}

nixos/tests/web-apps/rss-bridge/caddy.nix

@@ -0,0 +1,28 @@
+import ../../make-test-python.nix (
+  { lib, pkgs, ... }:
+  {
+    name = "rss-bridge-caddy";
+    meta.maintainers = with lib.maintainers; [ mynacol ];
+
+    nodes.machine =
+      { ... }:
+      {
+        services.rss-bridge = {
+          enable = true;
+          webserver = "caddy";
+          virtualHost = "localhost:80";
+          config.system.enabled_bridges = [ "DemoBridge" ];
+        };
+      };
+
+    testScript = ''
+      machine.wait_for_unit("caddy.service")
+      machine.wait_for_unit("phpfpm-rss-bridge.service")
+      machine.wait_for_open_port(80)
+
+      # check for successful feed download
+      response = machine.succeed("curl -f 'http://localhost:80/?action=display&bridge=DemoBridge&context=testCheckbox&format=Atom'")
+      assert '<title type="html">Test</title>' in response, "Feed didn't load successfully"
+    '';
+  }
+)

nixos/tests/web-apps/rss-bridge/default.nix

@@ -0,0 +1,5 @@
+{ system, pkgs, ... }:
+{
+  nginx = import ./nginx.nix { inherit system pkgs; };
+  caddy = import ./caddy.nix { inherit system pkgs; };
+}

nixos/tests/web-apps/rss-bridge/nginx.nix

@@ -0,0 +1,27 @@
+import ../../make-test-python.nix (
+  { lib, pkgs, ... }:
+  {
+    name = "rss-bridge-nginx";
+    meta.maintainers = with lib.maintainers; [ mynacol ];
+
+    nodes.machine =
+      { ... }:
+      {
+        services.rss-bridge = {
+          enable = true;
+          webserver = "nginx";
+          config.system.enabled_bridges = [ "DemoBridge" ];
+        };
+      };
+
+    testScript = ''
+      machine.wait_for_unit("nginx.service")
+      machine.wait_for_unit("phpfpm-rss-bridge.service")
+      machine.wait_for_open_port(80)
+
+      # check for successful feed download
+      response = machine.succeed("curl -f 'http://localhost:80/?action=display&bridge=DemoBridge&context=testCheckbox&format=Atom'")
+      assert '<title type="html">Test</title>' in response, "Feed didn't load successfully"
+    '';
+  }
+)

pkgs/README.md

@@ -87,7 +87,7 @@ Now that this is out of the way. To add a package to Nixpkgs:
 
    - XML::Simple, a Perl module: [`pkgs/top-level/perl-packages.nix`](top-level/perl-packages.nix) (search for the `XMLSimple` attribute). Most Perl modules are so simple to build that they are defined directly in `perl-packages.nix`; no need to make a separate file for them.
 
-   - Adobe Reader: [`pkgs/applications/misc/adobe-reader/default.nix`](applications/misc/adobe-reader/default.nix). Shows how binary-only packages can be supported. In particular the [builder](applications/misc/adobe-reader/builder.sh) uses `patchelf` to set the RUNPATH and ELF interpreter of the executables so that the right libraries are found at runtime.
+   - Adobe Reader: [`pkgs/applications/misc/adobe-reader/default.nix`](applications/misc/adobe-reader/default.nix). Shows how binary-only packages can be supported. In particular the `postFixup` phase uses `patchelf` to set the RUNPATH and ELF interpreter of the executables so that the right libraries are found at runtime.
 
    Some notes:
 
@@ -337,7 +337,7 @@ In Nixpkgs, there are generally three different names associated with a package:
 
 - The `pname` attribute of the derivation. This is what most users see, in particular when using `nix-env`.
 
-- The attribute name used for the package in the [`pkgs/by-name` structure](./pkgs/by-name/README.md) or in [`all-packages.nix`](./pkgs/top-level/all-packages.nix), and when passing it as a dependency in recipes.
+- The attribute name used for the package in the [`pkgs/by-name` structure](./by-name/README.md) or in [`all-packages.nix`](./top-level/all-packages.nix), and when passing it as a dependency in recipes.
 
 - The filename for (the directory containing) the Nix expression.
 
@@ -729,7 +729,7 @@ $ nix-build -A phoronix-test-suite.tests
 
 Here are examples of package tests:
 
-- [Jasmin compile test](development/compilers/jasmin/test-assemble-hello-world/default.nix)
+- [Jasmin compile test](by-name/ja/jasmin/test-assemble-hello-world/default.nix)
 - [Lobster compile test](development/compilers/lobster/test-can-run-hello-world.nix)
 - [Spacy annotation test](development/python-modules/spacy/annotation-test/default.nix)
 - [Libtorch test](development/libraries/science/math/libtorch/test/default.nix)

pkgs/applications/audio/ardour/default.nix

@@ -1,76 +1,77 @@
-{ lib
-, stdenv
-, fetchgit
-, fetchzip
-, alsa-lib
-, aubio
-, boost
-, cairomm
-, cppunit
-, curl
-, dbus
-, doxygen
-, ffmpeg
-, fftw
-, fftwSinglePrec
-, flac
-, fluidsynth
-, glibc
-, glibmm
-, graphviz
-, gtkmm2
-, harvid
-, hidapi
-, itstool
-, kissfft
-, libarchive
-, libjack2
-, liblo
-, libltc
-, libogg
-, libpulseaudio
-, librdf_rasqal
-, libsamplerate
-, libsigcxx
-, libsndfile
-, libusb1
-, libuv
-, libwebsockets
-, libxml2
-, libxslt
-, lilv
-, lrdf
-, lv2
-, makeWrapper
-, pango
-, perl
-, pkg-config
-, python3
-, qm-dsp
-, readline
-, rubberband
-, serd
-, sord
-, soundtouch
-, sratom
-, suil
-, taglib
-, vamp-plugin-sdk
-, wafHook
-, xjadeo
-, optimize ? true # disable to print Lua DSP script output to stdout
-, videoSupport ? true
+{
+  lib,
+  stdenv,
+  fetchgit,
+  fetchzip,
+  alsa-lib,
+  aubio,
+  boost,
+  cairomm,
+  cppunit,
+  curl,
+  dbus,
+  doxygen,
+  ffmpeg,
+  fftw,
+  fftwSinglePrec,
+  flac,
+  fluidsynth,
+  glibc,
+  glibmm,
+  graphviz,
+  gtkmm2,
+  harvid,
+  hidapi,
+  itstool,
+  kissfft,
+  libarchive,
+  libjack2,
+  liblo,
+  libltc,
+  libogg,
+  libpulseaudio,
+  librdf_rasqal,
+  libsamplerate,
+  libsigcxx,
+  libsndfile,
+  libusb1,
+  libuv,
+  libwebsockets,
+  libxml2,
+  libxslt,
+  lilv,
+  lrdf,
+  lv2,
+  makeWrapper,
+  pango,
+  perl,
+  pkg-config,
+  python3,
+  qm-dsp,
+  readline,
+  rubberband,
+  serd,
+  sord,
+  soundtouch,
+  sratom,
+  suil,
+  taglib,
+  vamp-plugin-sdk,
+  wafHook,
+  xjadeo,
+  optimize ? true, # disable to print Lua DSP script output to stdout
+  videoSupport ? true,
 }:
 stdenv.mkDerivation rec {
   pname = "ardour";
-  version = "8.10";
+  version = "8.11";
 
   # We can't use `fetchFromGitea` here, as attempting to fetch release archives from git.ardour.org
   # result in an empty archive. See https://tracker.ardour.org/view.php?id=7328 for more info.
   src = fetchgit {
     url = "git://git.ardour.org/ardour/ardour.git";
     rev = version;
-    hash = "sha256-y4eNo0ukRL6v0T1XvJ46sYnsiVSdL527punnkmf/TIU=";
+    hash = "sha256-z+rIWFVua1IG4GZ8kH3quKaBbN+I7Yr62vukJZk6KAg=";
   };
 
   bundledContent = fetchzip {
@@ -93,8 +94,8 @@ stdenv.mkDerivation rec {
     sed 's|/usr/include/libintl.h|${glibc.dev}/include/libintl.h|' -i wscript
     patchShebangs ./tools/
     substituteInPlace libs/ardour/video_tools_paths.cc \
-      --replace 'ffmpeg_exe = X_("");' 'ffmpeg_exe = X_("${ffmpeg}/bin/ffmpeg");' \
-      --replace 'ffprobe_exe = X_("");' 'ffprobe_exe = X_("${ffmpeg}/bin/ffprobe");'
+      --replace-fail 'ffmpeg_exe = X_("");' 'ffmpeg_exe = X_("${ffmpeg}/bin/ffmpeg");' \
+      --replace-fail 'ffprobe_exe = X_("");' 'ffprobe_exe = X_("${ffmpeg}/bin/ffprobe");'
   '';
 
   nativeBuildInputs = [
@@ -108,56 +109,61 @@ stdenv.mkDerivation rec {
     wafHook
   ];
 
-  buildInputs = [
-    alsa-lib
-    aubio
-    boost
-    cairomm
-    cppunit
-    curl
-    dbus
-    ffmpeg
-    fftw
-    fftwSinglePrec
-    flac
-    fluidsynth
-    glibmm
-    gtkmm2
-    hidapi
-    itstool
-    kissfft
-    libarchive
-    libjack2
-    liblo
-    libltc
-    libogg
-    libpulseaudio
-    librdf_rasqal
-    libsamplerate
-    libsigcxx
-    libsndfile
-    libusb1
-    libuv
-    libwebsockets
-    libxml2
-    libxslt
-    lilv
-    lrdf
-    lv2
-    pango
-    perl
-    python3
-    qm-dsp
-    readline
-    rubberband
-    serd
-    sord
-    soundtouch
-    sratom
-    suil
-    taglib
-    vamp-plugin-sdk
-  ] ++ lib.optionals videoSupport [ harvid xjadeo ];
+  buildInputs =
+    [
+      alsa-lib
+      aubio
+      boost
+      cairomm
+      cppunit
+      curl
+      dbus
+      ffmpeg
+      fftw
+      fftwSinglePrec
+      flac
+      fluidsynth
+      glibmm
+      gtkmm2
+      hidapi
+      itstool
+      kissfft
+      libarchive
+      libjack2
+      liblo
+      libltc
+      libogg
+      libpulseaudio
+      librdf_rasqal
+      libsamplerate
+      libsigcxx
+      libsndfile
+      libusb1
+      libuv
+      libwebsockets
+      libxml2
+      libxslt
+      lilv
+      lrdf
+      lv2
+      pango
+      perl
+      python3
+      qm-dsp
+      readline
+      rubberband
+      serd
+      sord
+      soundtouch
+      sratom
+      suil
+      taglib
+      vamp-plugin-sdk
+    ]
+    ++ lib.optionals videoSupport [
+      harvid
+      xjadeo
+    ];
 
   wafConfigureFlags = [
     "--cxx17"
@@ -175,29 +181,36 @@ stdenv.mkDerivation rec {
     # "--use-external-libs"
   ] ++ lib.optional optimize "--optimize";
 
-  postInstall = ''
-    # wscript does not install these for some reason
-    install -vDm 644 "build/gtk2_ardour/ardour.xml" \
-      -t "$out/share/mime/packages"
-    install -vDm 644 "build/gtk2_ardour/ardour${lib.versions.major version}.desktop" \
-      -t "$out/share/applications"
-    for size in 16 22 32 48 256 512; do
-      install -vDm 644 "gtk2_ardour/resources/Ardour-icon_''${size}px.png" \
-        "$out/share/icons/hicolor/''${size}x''${size}/apps/ardour${lib.versions.major version}.png"
-    done
-    install -vDm 644 "ardour.1"* -t "$out/share/man/man1"
+  postInstall =
+    ''
+      # wscript does not install these for some reason
+      install -vDm 644 "build/gtk2_ardour/ardour.xml" \
+        -t "$out/share/mime/packages"
+      install -vDm 644 "build/gtk2_ardour/ardour${lib.versions.major version}.desktop" \
+        -t "$out/share/applications"
+      for size in 16 22 32 48 256 512; do
+        install -vDm 644 "gtk2_ardour/resources/Ardour-icon_''${size}px.png" \
+          "$out/share/icons/hicolor/''${size}x''${size}/apps/ardour${lib.versions.major version}.png"
+      done
+      install -vDm 644 "ardour.1"* -t "$out/share/man/man1"
 
-    # install additional bundled beats, chords and progressions
-    cp -rp "${bundledContent}"/* "$out/share/ardour${lib.versions.major version}/media"
-  '' + lib.optionalString videoSupport ''
-    # `harvid` and `xjadeo` must be accessible in `PATH` for video to work.
-    wrapProgram "$out/bin/ardour${lib.versions.major version}" \
-      --prefix PATH : "${lib.makeBinPath [ harvid xjadeo ]}"
-  '';
+      # install additional bundled beats, chords and progressions
+      cp -rp "${bundledContent}"/* "$out/share/ardour${lib.versions.major version}/media"
+    ''
+    + lib.optionalString videoSupport ''
+      # `harvid` and `xjadeo` must be accessible in `PATH` for video to work.
+      wrapProgram "$out/bin/ardour${lib.versions.major version}" \
+        --prefix PATH : "${
+          lib.makeBinPath [
+            harvid
+            xjadeo
+          ]
+        }"
+    '';
 
   LINKFLAGS = "-lpthread";
 
-  meta = with lib; {
+  meta = {
     description = "Multi-track hard disk recording software";
     longDescription = ''
       Ardour is a digital audio workstation (DAW), You can use it to
@@ -209,9 +222,12 @@ stdenv.mkDerivation rec {
       https://community.ardour.org/donate
     '';
     homepage = "https://ardour.org/";
-    license = licenses.gpl2Plus;
+    license = lib.licenses.gpl2Plus;
     mainProgram = "ardour8";
-    platforms = platforms.linux;
-    maintainers = with maintainers; [ magnetophon mitchmindtree ];
+    platforms = lib.platforms.linux;
+    maintainers = with lib.maintainers; [
+      magnetophon
+      mitchmindtree
+    ];
   };
 }

pkgs/applications/editors/android-studio/common.nix

@@ -100,7 +100,7 @@ let
 
     installPhase = ''
       cp -r . $out
-      wrapProgram $out/bin/studio.sh \
+      wrapProgram $out/bin/studio \
         --set-default JAVA_HOME "$out/jbr" \
         --set ANDROID_EMULATOR_USE_SYSTEM_LIBS 1 \
         --set QT_XKB_CONFIG_ROOT "${xkeyboard_config}/share/X11/xkb" \
@@ -204,6 +204,7 @@ let
         ]
       }"
     '';
+    meta.mainProgram = "studio";
   };
 
   desktopItem = makeDesktopItem {
@@ -279,7 +280,7 @@ let
                 unset ANDROID_HOME
               fi
             ''}
-            exec ${fhsEnv}/bin/${drvName}-fhs-env ${androidStudio}/bin/studio.sh "$@"
+            exec ${fhsEnv}/bin/${drvName}-fhs-env ${lib.getExe androidStudio} "$@"
           '';
         preferLocalBuild = true;
         allowSubstitutes = false;

pkgs/applications/editors/vscode/extensions/marus25.cortex-debug/default.nix

@@ -4,8 +4,8 @@ vscode-utils.buildVscodeMarketplaceExtension {
   mktplcRef = {
     name = "cortex-debug";
     publisher = "marus25";
-    version = "1.6.10";
-    hash = "sha256-6b3JDkX6Xd91VE1h7gYyeukxLsBkn/nNzDQgBm0axRA=";
+    version = "1.12.1";
+    hash = "sha256-ioK6gwtkaAcfxn11lqpwhrpILSfft/byeEqoEtJIfM0=";
   };
   meta = {
     changelog = "https://marketplace.visualstudio.com/items/marus25.cortex-debug/changelog";

pkgs/applications/editors/vscode/extensions/timonwong.shellcheck/default.nix

@@ -10,8 +10,8 @@ vscode-utils.buildVscodeMarketplaceExtension {
   mktplcRef = {
     name = "shellcheck";
     publisher = "timonwong";
-    version = "0.37.6";
-    sha256 = "sha256-xfVKI+xxA/8YUcCWpskxZLbBLPsYCF46iKJkrV2zODs=";
+    version = "0.37.7";
+    sha256 = "sha256-i8cVY8EcKSxnmWmRWDiARF79pOEcYMc+y+7i4d8EDTo=";
   };
   nativeBuildInputs = [
     jq

pkgs/applications/editors/vscode/extensions/update_installed_exts.sh

@@ -43,8 +43,8 @@ function get_vsixpkg() {
     curl --silent --show-error --retry 3 --fail -X GET -o "$EXTTMP/$N.zip" "$URL"
     # Unpack the file we need to stdout then pull out the version
     VER=$(jq -r '.version' <(unzip -qc "$EXTTMP/$N.zip" "extension/package.json"))
-    # Calculate the SHA
-    SHA=$(nix-hash --flat --base32 --type sha256 "$EXTTMP/$N.zip")
+    # Calculate the hash
+    HASH=$(nix-hash --flat --sri --type sha256 "$EXTTMP/$N.zip")
 
     # Clean up.
     rm -Rf "$EXTTMP"
@@ -55,7 +55,7 @@ function get_vsixpkg() {
     name = "$2";
     publisher = "$1";
     version = "$VER";
-    sha256 = "$SHA";
+    hash = "$HASH";
   }
 EOF
 }

pkgs/applications/editors/vscode/vscode.nix

@@ -36,22 +36,22 @@ let
 
   sha256 =
     {
-      x86_64-linux = "0gr2z4vzms6fv4kcc8dzc7l3inpb5hasnzdfr1zc2n4i3nl8z8vw";
-      x86_64-darwin = "1qplpjazjds5kns0kmp5qa6zfix30cqa93bl4bcpvblb2x9fh1v8";
-      aarch64-linux = "1jhrmwrnxzwvhqgfrs35kyd5hhg2b7dyq3p5k88jhm8607nkds79";
-      aarch64-darwin = "072lg4nvq3cdjzrwngaxnz9p952zkxsknsb39zjh55vzrij55g9x";
-      armv7l-linux = "06bvh72bq4ippr2k8ifcfqhkhhh6na4vxsz1k50swr1k2kzwwr5d";
+      x86_64-linux = "11a0y0zdz3mmc2xvpnlq06a7q06y6529xpp4hlhpjylj0bk06xn1";
+      x86_64-darwin = "12fxhwqcz36f5pv4kvs7bblmymxyixg7pvi0gb5k0j73pkvqrr6g";
+      aarch64-linux = "0g5qz7gq7k65p2f8iwz1jiy03nwsmy3v3gb18qwg9mbhm0dk59la";
+      aarch64-darwin = "1g4fz8nw5m7krjlsjs43937kz1sr7lkflbphpyh8cmalwpxa8ysn";
+      armv7l-linux = "09r12y9xbpqnnw9mab3k4kx0ngpfng1l6rk09n9l2q36ji20ijmy";
     }
     .${system} or throwSystem;
 in
 callPackage ./generic.nix rec {
   # Please backport all compatible updates to the stable release.
   # This is important for the extension ecosystem.
-  version = "1.97.1";
+  version = "1.97.2";
   pname = "vscode" + lib.optionalString isInsiders "-insiders";
 
   # This is used for VS Code - Remote SSH test
-  rev = "e249dada235c2083c83813bd65b7f4707fb97b76";
+  rev = "e54c774e0add60467559eb0d1e229c6452cf8447";
 
   executableName = "code" + lib.optionalString isInsiders "-insiders";
   longName = "Visual Studio Code" + lib.optionalString isInsiders " - Insiders";
@@ -75,7 +75,7 @@ callPackage ./generic.nix rec {
     src = fetchurl {
       name = "vscode-server-${rev}.tar.gz";
       url = "https://update.code.visualstudio.com/commit:${rev}/server-linux-x64/stable";
-      sha256 = "01snzahh794ygpgwh4r57c8mnisp6a4fc3v5x76cdhxw2hd9s26n";
+      sha256 = "15fd401sqmlkpw48pysqpyi5rlsqx4cm55bbwakhkal4qa1qnq4m";
     };
     stdenv = stdenvNoCC;
   };

pkgs/applications/misc/ArchiSteamFarm/default.nix

@@ -11,13 +11,13 @@
 buildDotnetModule rec {
   pname = "ArchiSteamFarm";
   # nixpkgs-update: no auto update
-  version = "6.1.1.3";
+  version = "6.1.2.3";
 
   src = fetchFromGitHub {
     owner = "JustArchiNET";
     repo = "ArchiSteamFarm";
     rev = version;
-    hash = "sha256-e0LzM0N5N7BHyQDRQIPziQrAilJN1aUttKyLod/T8rU=";
+    hash = "sha256-FYh54KE42DizwpleBquDP7CNLHJySSz5pjsfjpn63u8=";
   };
 
   dotnet-runtime = dotnetCorePackages.aspnetcore_9_0;

pkgs/applications/misc/ArchiSteamFarm/deps.json

@@ -281,14 +281,19 @@
   },
   {
     "pname": "Markdig.Signed",
-    "version": "0.39.1",
-    "hash": "sha256-jofkP6JUp4xuUjJ6B6+HDfBJ3+V2vgECt2CWmFq62k4="
+    "version": "0.40.0",
+    "hash": "sha256-msd36cVKi3MTkT1QQg/b5yW4oLM3e8hbahPPkvhzRZw="
   },
   {
     "pname": "Microsoft.ApplicationInsights",
     "version": "2.22.0",
     "hash": "sha256-mUQ63atpT00r49ca50uZu2YCiLg3yd6r3HzTryqcuEA="
   },
+  {
+    "pname": "Microsoft.AspNetCore.OpenApi",
+    "version": "9.0.1",
+    "hash": "sha256-L93MBkDOrxiQx0YRZrxDwli7to5Va5+7VJFffyhk8cE="
+  },
   {
     "pname": "Microsoft.Bcl.AsyncInterfaces",
     "version": "6.0.0",
@@ -296,8 +301,8 @@
   },
   {
     "pname": "Microsoft.CodeAnalysis.ResxSourceGenerator",
-    "version": "3.11.0-beta1.24527.2",
-    "hash": "sha256-NVqJ5cRa9G+ilWKazOTA8Xfm6ExOPpst8HMIFBC1/BU="
+    "version": "3.11.0-beta1.24605.2",
+    "hash": "sha256-N+A3i0qC364THr1rmehG168V3W+3xXaQYIjgFE1zO6Q="
   },
   {
     "pname": "Microsoft.CodeCoverage",
@@ -426,23 +431,23 @@
   },
   {
     "pname": "Microsoft.IdentityModel.Abstractions",
-    "version": "8.3.0",
-    "hash": "sha256-LSZ91DbPswCWibHNSGWC3Jh3KQwAthVaU3r7XQJyutM="
+    "version": "8.3.1",
+    "hash": "sha256-K2ahV9EZFZD7idRzF0wKD/5FD7BuSiRtSNuFAqauo1Y="
   },
   {
     "pname": "Microsoft.IdentityModel.JsonWebTokens",
-    "version": "8.3.0",
-    "hash": "sha256-Hiiv10LSOMIt7KsQSsteJV4DFkLebHMYmoISn/pl2F8="
+    "version": "8.3.1",
+    "hash": "sha256-laNV7ziGznCb7TuYO6987C62To870os1az4YbhG84vc="
   },
   {
     "pname": "Microsoft.IdentityModel.Logging",
-    "version": "8.3.0",
-    "hash": "sha256-0P14ilpV+9yp+nqZWI/ilkTnRas4pic8NjNVcYxuXWs="
+    "version": "8.3.1",
+    "hash": "sha256-uLgVE2ZCiz5F3/SMes+nNEqXNEdDH0vfUk3eOv3MXbU="
   },
   {
     "pname": "Microsoft.IdentityModel.Tokens",
-    "version": "8.3.0",
-    "hash": "sha256-+TzBeZH2Tgs0EMoU5QuCdOD/5V8xM7MHClX578AUIxw="
+    "version": "8.3.1",
+    "hash": "sha256-C9Aj8YZ7corhP6LOCx/fBXbyAR9baqzQtFvhsGeQ/Mo="
   },
   {
     "pname": "Microsoft.NET.Test.Sdk",
@@ -454,6 +459,11 @@
     "version": "5.0.0",
     "hash": "sha256-LIcg1StDcQLPOABp4JRXIs837d7z0ia6+++3SF3jl1c="
   },
+  {
+    "pname": "Microsoft.OpenApi",
+    "version": "1.6.17",
+    "hash": "sha256-Wx9PwlEJPNMq1kp59nJJnLHQ+yNhqCTudcokmlP+tSk="
+  },
   {
     "pname": "Microsoft.OpenApi",
     "version": "1.6.22",
@@ -461,28 +471,28 @@
   },
   {
     "pname": "Microsoft.Testing.Extensions.Telemetry",
-    "version": "1.5.0",
-    "hash": "sha256-aKKGFpsp88Yy29GLbWRWnEil2M2WEHjRXZ62Q8x5QRQ="
+    "version": "1.5.3",
+    "hash": "sha256-bIXwPSa3jkr2b6xINOqMUs6/uj/r4oVFM7xq3uVIZDU="
   },
   {
     "pname": "Microsoft.Testing.Extensions.TrxReport.Abstractions",
-    "version": "1.5.0",
-    "hash": "sha256-oiePvWpZMkT2AnEpfzWgvaXJai6crgHdoUSMZct3JB0="
+    "version": "1.5.3",
+    "hash": "sha256-IfMRfcyaIKEMRtx326ICKtinDBEfGw/Sv8ZHawJ96Yc="
   },
   {
     "pname": "Microsoft.Testing.Extensions.VSTestBridge",
-    "version": "1.5.0",
-    "hash": "sha256-XauIF+r05RDgORsnxEp6Cq0WZjLycJ1hPH79QUi/SgM="
+    "version": "1.5.3",
+    "hash": "sha256-XpM/yFjhLSsuzyDV+xKubs4V1zVVYiV05E0+N4S1h0g="
   },
   {
     "pname": "Microsoft.Testing.Platform",
-    "version": "1.5.0",
-    "hash": "sha256-67ZNhvMifCIM7SFnwDN25EanRNKsjAFQWugrrYWAkrM="
+    "version": "1.5.3",
+    "hash": "sha256-y61Iih6w5D79dmrj2V675mcaeIiHoj1HSa1FRit2BLM="
   },
   {
     "pname": "Microsoft.Testing.Platform.MSBuild",
-    "version": "1.5.0",
-    "hash": "sha256-nJ5fv8MwFw2PeJIZA9qKLfGPWYKmHww1CtVFICz6S00="
+    "version": "1.5.3",
+    "hash": "sha256-YspvjE5Jfi587TAfsvfDVJXNrFOkx1B3y1CKV6m7YLY="
   },
   {
     "pname": "Microsoft.TestPlatform.ObjectModel",
@@ -501,23 +511,23 @@
   },
   {
     "pname": "MSTest",
-    "version": "3.7.0",
-    "hash": "sha256-z302okYPT36ebQhReEihire5fyig5pLkrx09nLyVuME="
+    "version": "3.7.3",
+    "hash": "sha256-0fFXB4ZYX+RFntYFin9SrgiW/neD7iXEHF+nJoN6Iys="
   },
   {
     "pname": "MSTest.Analyzers",
-    "version": "3.7.0",
-    "hash": "sha256-TVMFle7oE2ZU6U+VkJ0G9iNjJxnRU4rDIJCtZFwDhz0="
+    "version": "3.7.3",
+    "hash": "sha256-6mNfHtx9FBWA6/QrRUepwbxXWG/54GRyeZYazDiMacg="
   },
   {
     "pname": "MSTest.TestAdapter",
-    "version": "3.7.0",
-    "hash": "sha256-b6JCu2yyZmTZwZVd4MHaIwa01eQGWpFd8mNzHUBS6Tg="
+    "version": "3.7.3",
+    "hash": "sha256-3O/AXeS+3rHWstinivt73oa0QDp+xQpTc9p46EF+Mtc="
   },
   {
     "pname": "MSTest.TestFramework",
-    "version": "3.7.0",
-    "hash": "sha256-fIHwuc/zimd8oxvTiA3gmUzmJAj7JsQYh9IOb8NRJ/Y="
+    "version": "3.7.3",
+    "hash": "sha256-RweCMMf14GI6HqjDIP68JM67IaJKYQTZy0jk5Q4DFxs="
   },
   {
     "pname": "Newtonsoft.Json",
@@ -546,23 +556,23 @@
   },
   {
     "pname": "NLog",
-    "version": "5.3.4",
-    "hash": "sha256-Cwr1Wu9VbOcRz3GdVKkt7lIpNwC1E4Hdb0g+qEkEr3k="
+    "version": "5.4.0",
+    "hash": "sha256-l2R0UHHCL02KPMC96e62AL2ONFD0PAty619y9UnD25A="
   },
   {
     "pname": "NLog.Extensions.Logging",
-    "version": "5.3.15",
-    "hash": "sha256-otzOJncsEmzeGkJ9yxuwQgYFlKIG9ALX+DaKJ/Jhux4="
+    "version": "5.4.0",
+    "hash": "sha256-9pVBguAKnjmbtKM3wBVBEzovXkoEXgqvB4IhiayAkVo="
   },
   {
     "pname": "NLog.Web.AspNetCore",
-    "version": "5.3.15",
-    "hash": "sha256-JaxCAfsgYM8N7bmAciDowSdOxtMS3eoMszODqWPcqao="
+    "version": "5.4.0",
+    "hash": "sha256-tDCsOqYNVg+dNBk85HjNgbZuQwMgGPIdsMqoPhhPROk="
   },
   {
     "pname": "OpenTelemetry",
-    "version": "1.10.0",
-    "hash": "sha256-ucUy3vIabYb0TGDhraqMEzT+LLPmXrO1NgAjEeyVCO8="
+    "version": "1.11.1",
+    "hash": "sha256-Z4U/FCSlY+qdQRS2haJDSYyxI624mDCwHZhf5At2Atk="
   },
   {
     "pname": "OpenTelemetry",
@@ -571,13 +581,13 @@
   },
   {
     "pname": "OpenTelemetry.Api",
-    "version": "1.10.0",
-    "hash": "sha256-ZSpQFnNgkk3dO8Q7yokJ/VSl4wp5PuIv9nduxgC6UxU="
+    "version": "1.11.1",
+    "hash": "sha256-1qDEHEvelvySuCPcevWgO7N9ZEmPXwnFog+tiWXr2qU="
   },
   {
     "pname": "OpenTelemetry.Api.ProviderBuilderExtensions",
-    "version": "1.10.0",
-    "hash": "sha256-hLw3Sf1fviAlVJYhaMudVJEdG5pjX5JvVrqv9DgYAk8="
+    "version": "1.11.1",
+    "hash": "sha256-rioqazZAS6aZ7W8jJ4owu58rcnRbQyPrWVTBoqu1zPc="
   },
   {
     "pname": "OpenTelemetry.Api.ProviderBuilderExtensions",
@@ -591,38 +601,38 @@
   },
   {
     "pname": "OpenTelemetry.Extensions.Hosting",
-    "version": "1.10.0",
-    "hash": "sha256-+O9oaAUYaKUItLAaT7yQUs2nrHVDNkj8YcFuUxiTy6M="
+    "version": "1.11.1",
+    "hash": "sha256-eHQaUToWOpmJgD5XCHDCWsUcChKH3roaO8ZTAIulJVk="
   },
   {
     "pname": "OpenTelemetry.Instrumentation.AspNetCore",
-    "version": "1.10.1",
-    "hash": "sha256-HqMFDpFsMaPlgyFt1MU3Un+BysEoj5qPc8HVxTlt0mE="
+    "version": "1.11.0",
+    "hash": "sha256-F3WTwCPVUe+VppF1ZOAdBKaSseKmFZEU7D81uegqpGo="
   },
   {
     "pname": "OpenTelemetry.Instrumentation.Http",
-    "version": "1.10.0",
-    "hash": "sha256-U9ojqPSJu4OQEAfRJ+7MjzxayzsGWI0Ep8CPAcpkhhA="
+    "version": "1.11.0",
+    "hash": "sha256-4J7ZvginaiISaLB4M9tTK2o6avBz2dSI+fAhyfraBQ4="
   },
   {
     "pname": "OpenTelemetry.Instrumentation.Runtime",
-    "version": "1.10.0",
-    "hash": "sha256-cCTYKxHh1Qzu8X51B8gGsrxwKhVSqJfiql/+o4TWrwg="
+    "version": "1.11.0",
+    "hash": "sha256-VBSSJ3eORWUlVH12xzubtMtrDACAsyd1nSfgUt5ltCg="
   },
   {
     "pname": "protobuf-net",
-    "version": "3.2.45",
-    "hash": "sha256-rWitxe3uP3SOyoG1fwM5n00RpR5IL1V6u1zXMI0p0JA="
+    "version": "3.2.46",
+    "hash": "sha256-NirxAUXEIUQz0HHLS+KS4fgOZwJy1zJZYGcjPa5ujTs="
   },
   {
     "pname": "protobuf-net.Core",
-    "version": "3.2.45",
-    "hash": "sha256-bsMGUmd0yno8g0H0637jJboKJwyyHLHoHg45+bt9pLQ="
+    "version": "3.2.46",
+    "hash": "sha256-Srg7pP7rleL462idLPFUxgXBLrywWeHFyEvSV+keA4E="
   },
   {
     "pname": "SteamKit2",
-    "version": "3.0.0",
-    "hash": "sha256-bRRdX8WFo9k+QCZWh0KHb3TULpJxpR4Hg9FDXKBW6d4="
+    "version": "3.0.2",
+    "hash": "sha256-bRiLFaq/hsr+7BKtSKoD2+pf0VCGhBYe/rO3DgqMZpo="
   },
   {
     "pname": "Swashbuckle.AspNetCore",
@@ -661,33 +671,33 @@
   },
   {
     "pname": "System.Composition",
-    "version": "9.0.0",
-    "hash": "sha256-FehOkQ2u1p8mQ0/wn3cZ+24HjhTLdck8VZYWA1CcgbM="
+    "version": "9.0.1",
+    "hash": "sha256-KUJnkjMNNJ2b/1664xflRM9AmAs00PkmXLfbTnNdL6U="
   },
   {
     "pname": "System.Composition.AttributedModel",
-    "version": "9.0.0",
-    "hash": "sha256-a7y7H6zj+kmYkllNHA402DoVfY9IaqC3Ooys8Vzl24M="
+    "version": "9.0.1",
+    "hash": "sha256-93Q8jFzbF0tEhk+UAHoULA+DWiwgrKiBxcm8k/dQ75M="
   },
   {
     "pname": "System.Composition.Convention",
-    "version": "9.0.0",
-    "hash": "sha256-tw4vE5JRQ60ubTZBbxoMPhtjOQCC3XoDFUH7NHO7o8U="
+    "version": "9.0.1",
+    "hash": "sha256-FQihbXN3FkEiPprS5XLDIbYLye3RI0yHba099oDuIxY="
   },
   {
     "pname": "System.Composition.Hosting",
-    "version": "9.0.0",
-    "hash": "sha256-oOxU+DPEEfMCuNLgW6wSkZp0JY5gYt44FJNnWt+967s="
+    "version": "9.0.1",
+    "hash": "sha256-jas95z5TZo4VtLIev6Ixqfh0Xv54CI7zCzJ8867bpVE="
   },
   {
     "pname": "System.Composition.Runtime",
-    "version": "9.0.0",
-    "hash": "sha256-AyIe+di1TqwUBbSJ/sJ8Q8tzsnTN+VBdJw4K8xZz43s="
+    "version": "9.0.1",
+    "hash": "sha256-wAciMAsH7WR8ETiulgFhBRLBihdNEXb8Zjtzook2UQ4="
   },
   {
     "pname": "System.Composition.TypedParts",
-    "version": "9.0.0",
-    "hash": "sha256-F5fpTUs3Rr7yP/NyIzr+Xn5NdTXXp8rrjBnF9UBBUog="
+    "version": "9.0.1",
+    "hash": "sha256-fyLCfmGKgUSIpizl6OiSX61Td9xmLjii/PDQAowCihc="
   },
   {
     "pname": "System.Diagnostics.DiagnosticSource",
@@ -701,8 +711,8 @@
   },
   {
     "pname": "System.IO.Hashing",
-    "version": "8.0.0",
-    "hash": "sha256-szOGt0TNBo6dEdC3gf6H+e9YW3Nw0woa6UnCGGGK5cE="
+    "version": "9.0.1",
+    "hash": "sha256-IJru9BdFNsNs7FbG+F9djJdkkWdpoz2IxQ+GgvKvUOs="
   },
   {
     "pname": "System.Linq.Async",
@@ -726,8 +736,8 @@
   },
   {
     "pname": "System.Security.Cryptography.ProtectedData",
-    "version": "9.0.0",
-    "hash": "sha256-gPgPU7k/InTqmXoRzQfUMEKL3QuTnOKowFqmXTnWaBQ="
+    "version": "9.0.1",
+    "hash": "sha256-U2c8q6vD+O42zNTGRSAbsdj+r3+nXegoDYdB/Qm4nvU="
   },
   {
     "pname": "System.Security.Principal.Windows",

pkgs/applications/misc/ArchiSteamFarm/web-ui/default.nix

@@ -7,7 +7,7 @@
 
 buildNpmPackage rec {
   pname = "asf-ui";
-  version = "6be24065cd4904389d94140f4ed1f6738b1f7fbb";
+  version = "fbdc518fa1e82c16b9de0a5e2228898796d3f5a2";
 
   src = fetchFromGitHub {
     owner = "JustArchiNET";
@@ -15,10 +15,10 @@ buildNpmPackage rec {
     # updated by the update script
     # this is always the commit that should be used with asf-ui from the latest asf version
     rev = version;
-    hash = "sha256-DFl+DCNj4JFKZG1awX5rlsHzj+67OFyBj9d16zDiKRA=";
+    hash = "sha256-n9V5xUHIByspVSkpcwkohgcPlk22UfA2FBZq7CG1LmE=";
   };
 
-  npmDepsHash = "sha256-jZSiWZDckfGfgrBMHTX/sm7Pcl5ap3lfmwGi8SHXqu8=";
+  npmDepsHash = "sha256-lJZgHVO770aYwnudUj2wkUqrSV6rbSDJ9zwtCe+36k8=";
 
   installPhase = ''
     runHook preInstall

pkgs/applications/misc/qcad/default.nix

@@ -18,14 +18,14 @@
 
 stdenv.mkDerivation rec {
   pname = "qcad";
-  version = "3.31.2.7";
+  version = "3.32.1.0";
 
   src = fetchFromGitHub {
     name = "qcad-${version}-src";
     owner = "qcad";
     repo = "qcad";
     rev = "v${version}";
-    hash = "sha256-gNUmcpyDctmsqavOOaPzyghmfMp6QnZcToUtFoVgoxI=";
+    hash = "sha256-3P6iudD/swpNDPL4G8isJI6zxqc6/rmHAMpPnEwnuiM=";
   };
 
   patches = [

pkgs/applications/misc/tellico/default.nix

@@ -27,14 +27,14 @@
 
 stdenv.mkDerivation rec {
   pname = "tellico";
-  version = "4.1";
+  version = "4.1.1";
 
   src = fetchFromGitLab {
     domain = "invent.kde.org";
     owner = "office";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-xzMPYze77oajMjS2fprjGu2FsZgI7MjnWVxIxYYN0TY=";
+    hash = "sha256-eYmLDQfnC0/R7VF+oMBwb5Q56CBl2icusoit/LIIpUs=";
   };
 
   nativeBuildInputs = [

pkgs/applications/networking/browsers/chromium/info.json

@@ -791,7 +791,7 @@
     }
   },
   "ungoogled-chromium": {
-    "version": "133.0.6943.53",
+    "version": "133.0.6943.98",
     "deps": {
       "depot_tools": {
         "rev": "423f1e1914ab4aa7b2bdf804e216d4c097853ba2",
@@ -802,16 +802,16 @@
         "hash": "sha256-T2dcISln9WCODoI/LsE2ldkRfFdMwVOmqqjQinAmZss="
       },
       "ungoogled-patches": {
-        "rev": "133.0.6943.53-1",
-        "hash": "sha256-8n0BST0sqQRcfv0lCiEflrvyxt8Agj/kK0O2fVzWqCY="
+        "rev": "133.0.6943.98-1",
+        "hash": "sha256-lSRJD8tKmZ89MJr6MkldV8/50iB/l8FEwl6ZM/KtZHA="
       },
       "npmHash": "sha256-oVoTruhxTymYiGkELd2Oa1wOfjGLtChQZozP4GzOO1A="
     },
     "DEPS": {
       "src": {
         "url": "https://chromium.googlesource.com/chromium/src.git",
-        "rev": "9a80935019b0925b01cc21d254da203bc3986f04",
-        "hash": "sha256-doJ/HygMtLxr04S73lhs5kTt8qC7SHrCxHbjAoFPv2M=",
+        "rev": "da53563ceb66412e2637507c8724bd0cab05e453",
+        "hash": "sha256-yltjJNXU+YQD/sFEa8+ZKqUJpVZ2Yi0YDx27bnekcng=",
         "recompress": true
       },
       "src/third_party/clang-format/script": {
@@ -1366,8 +1366,8 @@
       },
       "src/third_party/pdfium": {
         "url": "https://pdfium.googlesource.com/pdfium.git",
-        "rev": "c674dba647e81805158339785c0c7e3b57643f8c",
-        "hash": "sha256-2Z7Dg3IuxMB+xKFURo0Z7NztPQht7Fd+A1dX99gQ+A4="
+        "rev": "b57762c6c6ad261024f11fc724687593c03cce67",
+        "hash": "sha256-ksN/7volHAeQLJSFQMV/YOfkXyZ97GSawXp31uca4oc="
       },
       "src/third_party/perfetto": {
         "url": "https://android.googlesource.com/platform/external/perfetto.git",
@@ -1546,8 +1546,8 @@
       },
       "src/third_party/webrtc": {
         "url": "https://webrtc.googlesource.com/src.git",
-        "rev": "283b6ef9d3eabe5bb3ed7c9d6b6d211a92f9b6d0",
-        "hash": "sha256-KMyO88KoYiTHq+stdbc8vRYqeQbrqexDIiOeWbqytrU="
+        "rev": "cd3e2951ff0f36fa12bea747862c52533a2b39f3",
+        "hash": "sha256-5tdES3wILTC25Lvos5mWYlfT4ZnM2pBFy5LVACVMXEY="
       },
       "src/third_party/wuffs/src": {
         "url": "https://skia.googlesource.com/external/github.com/google/wuffs-mirror-release-c.git",
@@ -1576,8 +1576,8 @@
       },
       "src/v8": {
         "url": "https://chromium.googlesource.com/v8/v8.git",
-        "rev": "fe051262efbbd92479a08436f733eba9f756e008",
-        "hash": "sha256-l3hMgnhy2Ml6kExwGFWi+M6Oq4YFsOSIkRDCmji+syY="
+        "rev": "79c3c1ab7faee8247b740b4ec660a998f2881633",
+        "hash": "sha256-fmd2mIjJs6l9zRTJ2bFIMQNnApFN3epeS+57TBlF/Uk="
       }
     }
   }

pkgs/applications/networking/cluster/helm/default.nix

@@ -9,15 +9,15 @@
 
 buildGoModule rec {
   pname = "kubernetes-helm";
-  version = "3.17.0";
+  version = "3.17.1";
 
   src = fetchFromGitHub {
     owner = "helm";
     repo = "helm";
     rev = "v${version}";
-    sha256 = "sha256-kLiYzZFqJQGkqpjFPTB9BHQf7yWiWRUvWDpF5WkfJEU=";
+    sha256 = "sha256-wGORNOlfnBt8iApAP5s5tvy4Zfk87fOTpLSY5XYnzQM=";
   };
-  vendorHash = "sha256-mARUYjnbn5dmR0cKAXiHFJcYNx1ROabLv9Z7KCY9PRM=";
+  vendorHash = "sha256-dZN1rOcGDIvhqXi35904kTBQ8RPeS1PFgspzn/j1ZQU=";
 
   subPackages = [ "cmd/helm" ];
   ldflags = [

pkgs/applications/networking/cluster/helmfile/default.nix

@@ -9,16 +9,16 @@
 
 buildGoModule rec {
   pname = "helmfile";
-  version = "0.170.1";
+  version = "0.171.0";
 
   src = fetchFromGitHub {
     owner = "helmfile";
     repo = "helmfile";
     rev = "v${version}";
-    hash = "sha256-qu/0l+4fZUk7H5sCZopmCNxja5hI5WwfXga90Yeuy7o=";
+    hash = "sha256-zZt0YxGbDqIhg2tXjQo5QnD09ASOUgFyQ1uWbGcujkc=";
   };
 
-  vendorHash = "sha256-vAv/VlAvkPRWrOHDNkt4VdXXjqi65RVjYtvqSJjb8ds=";
+  vendorHash = "sha256-sGqnM40Y1nr9dXcSSC1lkwh1ToRLpCMiWJhyMcxxH9U=";
 
   proxyVendor = true; # darwin/linux hash mismatch
 

pkgs/applications/networking/cluster/kubernetes/default.nix

@@ -21,13 +21,13 @@
 
 buildGoModule rec {
   pname = "kubernetes";
-  version = "1.32.1";
+  version = "1.32.2";
 
   src = fetchFromGitHub {
     owner = "kubernetes";
     repo = "kubernetes";
     rev = "v${version}";
-    hash = "sha256-6KZlbwSMmFvh6XKJR1W/qa3xU0O3fuQaMW/P5An/AtQ=";
+    hash = "sha256-pie36Y3zKGKvnCDHtjNHYox1b2xhy6w7MShkAfkDVrs=";
   };
 
   vendorHash = null;

pkgs/applications/networking/cluster/terraform-providers/providers.json

@@ -1092,6 +1092,15 @@
     "spdx": "MPL-2.0",
     "vendorHash": null
   },
+  "sakuracloud": {
+    "hash": "sha256-KrzqIAK6ImUW22Iik97R4HARoXN4lG6AquitLjCqS/A=",
+    "homepage": "https://registry.terraform.io/providers/sacloud/sakuracloud",
+    "owner": "sacloud",
+    "repo": "terraform-provider-sakuracloud",
+    "rev": "v2.26.1",
+    "spdx": "Apache-2.0",
+    "vendorHash": "sha256-Ry791h5AuYP03nex9nM8X5Mk6PeL7hNDbFyVRvVPJNE="
+  },
   "scaleway": {
     "hash": "sha256-8aESalFQaA6Qwod4rDeUzrKe80rbHfVJZIKtLliKUME=",
     "homepage": "https://registry.terraform.io/providers/scaleway/scaleway",

pkgs/applications/networking/cluster/timoni/default.nix

@@ -7,16 +7,16 @@
 
 buildGoModule rec {
   pname = "timoni";
-  version = "0.23.0";
+  version = "0.24.0";
 
   src = fetchFromGitHub {
     owner = "stefanprodan";
     repo = "timoni";
     rev = "v${version}";
-    hash = "sha256-WlsBW8c6x68oM6g/bVXzPgIglMn+rPcfJKXmUZPC0n0=";
+    hash = "sha256-nI0yy/zhsJUvisHo+C+/uNRF96ZQ1Ve8VWpE8ZvUeJc=";
   };
 
-  vendorHash = "sha256-mv9H0D99am/VXTP01sXQ+4Dt513Zmo0VffkUVPyF3Kk=";
+  vendorHash = "sha256-YpwESaR+X2eOyaPdR+I3mURD7yvwzmpPmgPoSPrXjH8=";
 
   subPackages = [ "cmd/timoni" ];
   nativeBuildInputs = [ installShellFiles ];

pkgs/applications/networking/instant-messengers/telegram/telegram-desktop/unwrapped.nix

@@ -46,14 +46,14 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "telegram-desktop-unwrapped";
-  version = "5.10.7";
+  version = "5.11.1";
 
   src = fetchFromGitHub {
     owner = "telegramdesktop";
     repo = "tdesktop";
     rev = "v${finalAttrs.version}";
     fetchSubmodules = true;
-    hash = "sha256-lcU2EJQgT7vQa2z0SB8LKhWjhn22Wc+eHi92junY2PY=";
+    hash = "sha256-lhZ/RSHRr+yaOAec5GOM2mrU0dNQbUxd4g7w+oAF+ZY=";
   };
 
   postPatch = lib.optionalString stdenv.hostPlatform.isLinux ''

pkgs/applications/networking/remote/citrix-workspace/generic.nix

@@ -3,7 +3,7 @@
 , heimdal, krb5, libsoup_2_4, libvorbis, speex, openssl, zlib, xorg, pango, gtk2
 , gnome2, libgbm, nss, nspr, gtk_engines, freetype, dconf, libpng12, libxml2
 , libjpeg, libredirect, tzdata, cacert, systemd, libcxx, symlinkJoin
-, libpulseaudio, pcsclite, glib-networking, llvmPackages_12, opencv4
+, libpulseaudio, pcsclite, glib-networking, llvmPackages, opencv4
 , libfaketime
 , libinput, libcap, libjson, libsecret, libcanberra-gtk3
 
@@ -106,7 +106,7 @@ stdenv.mkDerivation rec {
     libsoup_2_4
     libvorbis
     libxml2
-    llvmPackages_12.libunwind
+    llvmPackages.libunwind
     libgbm
     nspr
     nss

pkgs/applications/office/mendeley/default.nix

@@ -8,13 +8,13 @@
 
 let
   pname = "mendeley";
-  version = "2.129.0";
+  version = "2.130.0";
 
   executableName = "${pname}-reference-manager";
 
   src = fetchurl {
     url = "https://static.mendeley.com/bin/desktop/mendeley-reference-manager-${version}-x86_64.AppImage";
-    hash = "sha256-lA3ald0pgNd6az7nP5MPMrs12EEvJaHpEypXFfCvKCQ=";
+    hash = "sha256-ldlMWitLe3pcA1ip+/NZuswKvPdpn9l8tVSCOOr4pbc=";
   };
 
   appimageContents = appimageTools.extractType2 {

pkgs/applications/video/anilibria-winmaclinux/default.nix

@@ -21,13 +21,13 @@
 
 mkDerivation rec {
   pname = "anilibria-winmaclinux";
-  version = "2.2.24";
+  version = "2.2.25";
 
   src = fetchFromGitHub {
     owner = "anilibria";
     repo = "anilibria-winmaclinux";
     rev = version;
-    hash = "sha256-FAnVgrH6ZXfIp8FaacSpcHIwF6DCFt4K5e+UMAUb6qI=";
+    hash = "sha256-9jlGENJVgzQi5oEspM6JHIgYt9np8WNKPJzoW2kSgQs=";
   };
 
   sourceRoot = "${src.name}/src";

pkgs/applications/video/mpv/scripts/autosubsync-mpv.nix

@@ -7,13 +7,13 @@
 
 buildLua {
   pname = "autosubsync-mpv";
-  version = "0-unstable-2022-12-26";
+  version = "0-unstable-2024-10-29";
 
   src = fetchFromGitHub {
     owner = "joaquintorres";
     repo = "autosubsync-mpv";
-    rev = "22cb928ecd94cc8cadaf8c354438123c43e0c70d";
-    sha256 = "sha256-XQPFC7l9MTZAW5FfULRQJfu/7FuGj9bbjQUZhNv0rlc=";
+    rev = "125ac13d1b84b3a64bb2e912225a8356c1c01364";
+    sha256 = "sha256-Xwu8WTB3p3YDTydfyidF/zpN6CyTQyZgQvGX/HAa9hw=";
   };
 
   # While nixpkgs only packages alass, we might as well make that the default

pkgs/applications/video/obs-studio/plugins/obs-pipewire-audio-capture.nix

@@ -8,16 +8,15 @@
   pipewire,
   pkg-config,
 }:
-
 stdenv.mkDerivation rec {
   pname = "obs-pipewire-audio-capture";
-  version = "1.1.5";
+  version = "1.2.0";
 
   src = fetchFromGitHub {
     owner = "dimtpap";
     repo = pname;
     rev = version;
-    sha256 = "sha256-qYHU0m+jz/mQmjleITnzxNkTio5ir8dFkHKfmY4l0Es=";
+    sha256 = "sha256-nkd/AoMsEUUxQQH5CjbnPbNwAwkd1y6j2nCa1GIAFPs=";
   };
 
   nativeBuildInputs = [
@@ -31,13 +30,17 @@ stdenv.mkDerivation rec {
   ];
 
   cmakeFlags = [
-    "-DCMAKE_INSTALL_LIBDIR=/lib"
+    "-DCMAKE_INSTALL_LIBDIR=./lib"
+    "-DCMAKE_INSTALL_DATADIR=./usr"
   ];
 
   meta = with lib; {
     description = "Audio device and application capture for OBS Studio using PipeWire";
     homepage = "https://github.com/dimtpap/obs-pipewire-audio-capture";
-    maintainers = with maintainers; [ Elinvention ];
+    maintainers = with maintainers; [
+      Elinvention
+      fazzi
+    ];
     license = licenses.gpl2Plus;
     platforms = [
       "x86_64-linux"

pkgs/by-name/README.md

@@ -85,7 +85,7 @@ though it is expected to still take some time to get done.
 If you're interested in helping out with this effort,
 please see [this ticket](https://github.com/NixOS/nixpkgs-vet/issues/56).
 
-Since [only PRs to packages in `pkgs/by-name` can be automatically merged](../../CONTRIBUTING.md#how-to-merge-pull-requests),
+Since [only PRs to packages in `pkgs/by-name` can be automatically merged](../../CONTRIBUTING.md#how-to-merge-pull-requests-yourself),
 if package maintainers would like to use this feature, they are welcome to migrate their packages to `pkgs/by-name`.
 To lessen PR traffic, they're encouraged to also perform some more general maintenance on the package in the same PR,
 though this is not required and must not be expected.

pkgs/by-name/aa/aardvark-dns/package.nix

@@ -7,17 +7,17 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "aardvark-dns";
-  version = "1.13.1";
+  version = "1.14.0";
 
   src = fetchFromGitHub {
     owner = "containers";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-VXuTHc/t+5QidTqMptoQqircHTtYzeEXfFFII8jeOrI=";
+    hash = "sha256-mWaB1E/n/N2Tb5bqrMJX2XfPvZBCG+dxar3kGCHgv0I=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-ydvvV3w8VmfdSTXeJvMuN0oqkkZdWs6/9KocalRGWpg=";
+  cargoHash = "sha256-t9qfPz4Jy1RueiDEY2fB3Y1uty0i/Wf0ElsR+nSVF5g=";
 
   passthru.tests = { inherit (nixosTests) podman; };
 

pkgs/by-name/ad/ada/package.nix

@@ -7,13 +7,13 @@
 
 stdenv.mkDerivation rec {
   pname = "ada";
-  version = "3.0.0";
+  version = "3.1.0";
 
   src = fetchFromGitHub {
     owner = "ada-url";
     repo = "ada";
     rev = "v${version}";
-    hash = "sha256-6heohik9MlIvDTSWe8U6/mdHuSHaEv4rkGwaz0LH8NU=";
+    hash = "sha256-BVVYK4JyLyjIjkTCohiA20qwftFdyCo84fWMVVgia0Q=";
   };
 
   nativeBuildInputs = [ cmake ];

pkgs/by-name/ad/add-determinism/Cargo.lock

@@ -4,7 +4,7 @@ version = 4
 
 [[package]]
 name = "add-determinism"
-version = "0.5.0"
+version = "0.6.0"
 dependencies = [
  "anyhow",
  "chrono",
@@ -28,10 +28,10 @@ dependencies = [
 ]
 
 [[package]]
-name = "adler"
-version = "1.0.2"
+name = "adler2"
+version = "2.0.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f26201604c87b1e01bd3d98f8d5d9a8fcbb815e8cedb41ffccbeb4bf593a35fe"
+checksum = "512761e0bb2578dd7380c6baaa0f4ce03e84f95e960231d1dec8bf4d7d6e2627"
 
 [[package]]
 name = "aho-corasick"
@@ -59,9 +59,9 @@ dependencies = [
 
 [[package]]
 name = "anstream"
-version = "0.6.14"
+version = "0.6.18"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "418c75fa768af9c03be99d17643f93f79bbba589895012a80e3452a19ddda15b"
+checksum = "8acc5369981196006228e28809f761875c0327210a891e941f4c683b3a99529b"
 dependencies = [
  "anstyle",
  "anstyle-parse",
@@ -74,61 +74,62 @@ dependencies = [
 
 [[package]]
 name = "anstyle"
-version = "1.0.7"
+version = "1.0.10"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "038dfcf04a5feb68e9c60b21c9625a54c2c0616e79b72b0fd87075a056ae1d1b"
+checksum = "55cc3b69f167a1ef2e161439aa98aed94e6028e5f9a59be9a6ffb47aef1651f9"
 
 [[package]]
 name = "anstyle-parse"
-version = "0.2.4"
+version = "0.2.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c03a11a9034d92058ceb6ee011ce58af4a9bf61491aa7e1e59ecd24bd40d22d4"
+checksum = "3b2d16507662817a6a20a9ea92df6652ee4f94f914589377d69f3b21bc5798a9"
 dependencies = [
  "utf8parse",
 ]
 
 [[package]]
 name = "anstyle-query"
-version = "1.1.0"
+version = "1.1.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ad186efb764318d35165f1758e7dcef3b10628e26d41a44bc5550652e6804391"
+checksum = "79947af37f4177cfead1110013d678905c37501914fba0efea834c3fe9a8d60c"
 dependencies = [
  "windows-sys",
 ]
 
 [[package]]
 name = "anstyle-wincon"
-version = "3.0.3"
+version = "3.0.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "61a38449feb7068f52bb06c12759005cf459ee52bb4adc1d5a7c4322d716fb19"
+checksum = "ca3534e77181a9cc07539ad51f2141fe32f6c3ffd4df76db8ad92346b003ae4e"
 dependencies = [
  "anstyle",
+ "once_cell",
  "windows-sys",
 ]
 
 [[package]]
 name = "anyhow"
-version = "1.0.86"
+version = "1.0.95"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b3d1d046238990b9cf5bcde22a3fb3584ee5cf65fb2765f454ed428c7a0063da"
+checksum = "34ac096ce696dc2fcabef30516bb13c0a68a11d30131d3df6f04711467681b04"
 
 [[package]]
 name = "autocfg"
-version = "1.3.0"
+version = "1.4.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0c4b4d0bd25bd0b74681c0ad21497610ce1b7c91b1022cd21c80c6fbdd9476b0"
+checksum = "ace50bade8e6234aa140d9a2f552bbee1db4d353f69b8217bc503490fc1a9f26"
 
 [[package]]
 name = "bitflags"
-version = "2.5.0"
+version = "2.8.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cf4b9d6a944f767f8e5e0db018570623c85f3d925ac718db4e06d0187adb21c1"
+checksum = "8f68f53c83ab957f72c32642f3868eec03eb974d1fb82e453128456482613d36"
 
 [[package]]
 name = "bumpalo"
-version = "3.16.0"
+version = "3.17.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "79296716171880943b8470b5f8d03aa55eb2e645a4874bdbb28adb49162e012c"
+checksum = "1628fb46dfa0b37568d12e5edd512553eccf6a22a78e8bde00bb4aed84d5bdbf"
 
 [[package]]
 name = "byteorder"
@@ -138,9 +139,12 @@ checksum = "1fd0f2584146f6f2ef48085050886acf353beff7305ebd1ae69500e27c67f64b"
 
 [[package]]
 name = "cc"
-version = "1.0.98"
+version = "1.2.13"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "41c270e7540d725e65ac7f1b212ac8ce349719624d7bcff99f8e2e488e8cf03f"
+checksum = "c7777341816418c02e033934a09f20dc0ccaf65a5201ef8a450ae0105a573fda"
+dependencies = [
+ "shlex",
+]
 
 [[package]]
 name = "cfg-if"
@@ -156,9 +160,9 @@ checksum = "fd16c4719339c4530435d38e511904438d07cce7950afa3718a84ac36c10e89e"
 
 [[package]]
 name = "chrono"
-version = "0.4.38"
+version = "0.4.39"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a21f936df1771bf62b77f047b726c4625ff2e8aa607c01ec06e5a05bd8463401"
+checksum = "7e36cc9d416881d2e24f9a963be5fb1cd90966419ac844274161d10488b3e825"
 dependencies = [
  "android-tzdata",
  "iana-time-zone",
@@ -170,9 +174,9 @@ dependencies = [
 
 [[package]]
 name = "clap"
-version = "4.5.4"
+version = "4.5.29"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "90bc066a67923782aa8515dbaea16946c5bcc5addbd668bb80af688e53e548a0"
+checksum = "8acebd8ad879283633b343856142139f2da2317c96b05b4dd6181c61e2480184"
 dependencies = [
  "clap_builder",
  "clap_derive",
@@ -180,9 +184,9 @@ dependencies = [
 
 [[package]]
 name = "clap_builder"
-version = "4.5.2"
+version = "4.5.29"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ae129e2e766ae0ec03484e609954119f123cc1fe650337e155d03b022f24f7b4"
+checksum = "f6ba32cbda51c7e1dfd49acc1457ba1a7dec5b64fe360e828acb13ca8dc9c2f9"
 dependencies = [
  "anstream",
  "anstyle",
@@ -192,9 +196,9 @@ dependencies = [
 
 [[package]]
 name = "clap_derive"
-version = "4.5.4"
+version = "4.5.28"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "528131438037fd55894f62d6e9f068b8f45ac57ffa77517819645d10aed04f64"
+checksum = "bf4ced95c6f4a675af3da73304b9ac4ed991640c36374e4b46795c49e17cf1ed"
 dependencies = [
  "heck",
  "proc-macro2",
@@ -204,21 +208,21 @@ dependencies = [
 
 [[package]]
 name = "clap_lex"
-version = "0.7.0"
+version = "0.7.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "98cc8fbded0c607b7ba9dd60cd98df59af97e84d24e49c8557331cfc26d301ce"
+checksum = "f46ad14479a25103f283c0f10005961cf086d8dc42205bb44c46ac563475dca6"
 
 [[package]]
 name = "colorchoice"
-version = "1.0.1"
+version = "1.0.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0b6a852b24ab71dffc585bcb46eaf7959d175cb865a7152e35b348d1b2960422"
+checksum = "5b63caa9aa9397e2d9480a9b13673856c78d8ac123288526c37d7839f2a86990"
 
 [[package]]
 name = "core-foundation-sys"
-version = "0.8.6"
+version = "0.8.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "06ea2b9bc92be3c2baa9334a323ebca2d6f074ff852cd1d7b11064035cd3868f"
+checksum = "773648b94d0e5d620f64f280777445740e61fe701025087ec8b57f45c791888b"
 
 [[package]]
 name = "crc32fast"
@@ -231,9 +235,9 @@ dependencies = [
 
 [[package]]
 name = "crossbeam-utils"
-version = "0.8.20"
+version = "0.8.21"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "22ec99545bb0ed0ea7bb9b8e1e9122ea386ff8a48c0922e43f36d45ab09e0e80"
+checksum = "d0a5c400df2834b80a4c3327b3aad3a4c4cd4de0629063962b03235697506a28"
 
 [[package]]
 name = "deranged"
@@ -252,9 +256,9 @@ checksum = "60b1af1c220855b6ceac025d3f6ecdd2b7c4894bfe9cd9bda4fbb4bc7c0d4cf0"
 
 [[package]]
 name = "errno"
-version = "0.3.9"
+version = "0.3.10"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "534c5cf6194dfab3db3242765c03bbe257cf92f22b38f6bc0c58d59108a820ba"
+checksum = "33d852cb9b869c2a9b3df2f71a3074817f01e1844f839a144f5fcef059a4eb5d"
 dependencies = [
  "libc",
  "windows-sys",
@@ -262,15 +266,15 @@ dependencies = [
 
 [[package]]
 name = "fastrand"
-version = "2.1.0"
+version = "2.3.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9fc0510504f03c51ada170672ac806f1f105a88aa97a5281117e1ddc3368e51a"
+checksum = "37909eebbb50d72f9059c3b6d82c0463f2ff062c9e95845c43a6c9c0355411be"
 
 [[package]]
 name = "flate2"
-version = "1.0.30"
+version = "1.0.35"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5f54427cfd1c7829e2a139fcefea601bf088ebca651d2bf53ebc600eac295dae"
+checksum = "c936bfdafb507ebbf50b8074c54fa31c5be9a1e7e5f467dd659697041407d07c"
 dependencies = [
  "crc32fast",
  "libz-sys",
@@ -285,7 +289,19 @@ checksum = "c4567c8db10ae91089c99af84c68c38da3ec2f087c3f82960bcdbf3656b6f4d7"
 dependencies = [
  "cfg-if",
  "libc",
- "wasi",
+ "wasi 0.11.0+wasi-snapshot-preview1",
+]
+
+[[package]]
+name = "getrandom"
+version = "0.3.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "43a49c392881ce6d5c3b8cb70f98717b7c07aabbdff06687b9030dbfbe2725f8"
+dependencies = [
+ "cfg-if",
+ "libc",
+ "wasi 0.13.3+wasi-0.2.2",
+ "windows-targets",
 ]
 
 [[package]]
@@ -308,9 +324,9 @@ checksum = "2304e00983f87ffb38b55b444b5e3b60a884b5d30c0fca7d82fe33449bbe55ea"
 
 [[package]]
 name = "iana-time-zone"
-version = "0.1.60"
+version = "0.1.61"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e7ffbb5a1b541ea2561f8c41c087286cc091e21e556a4f09a8f6cbf17b69b141"
+checksum = "235e081f3925a06703c2d0117ea8b91f042756fd6e7a6e5d901e8ca1a996b220"
 dependencies = [
  "android_system_properties",
  "core-foundation-sys",
@@ -337,9 +353,9 @@ checksum = "b248f5224d1d606005e02c97f5aa4e88eeb230488bcc03bc9ca4d7991399f2b5"
 
 [[package]]
 name = "is_terminal_polyfill"
-version = "1.70.0"
+version = "1.70.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f8478577c03552c21db0e2724ffb8986a5ce7af88107e6be5d2ee6e158c12800"
+checksum = "7943c866cc5cd64cbc25b2e01621d07fa8eb2a1a23160ee81ce38704e97b8ecf"
 
 [[package]]
 name = "itertools"
@@ -352,10 +368,11 @@ dependencies = [
 
 [[package]]
 name = "js-sys"
-version = "0.3.69"
+version = "0.3.77"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "29c15563dc2726973df627357ce0c9ddddbea194836909d655df6a75d2cf296d"
+checksum = "1cfaf33c695fc6e08064efbc1f72ec937429614f25eef83af942d0e227c3a28f"
 dependencies = [
+ "once_cell",
  "wasm-bindgen",
 ]
 
@@ -370,9 +387,9 @@ dependencies = [
 
 [[package]]
 name = "libc"
-version = "0.2.155"
+version = "0.2.169"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "97b3888a4aecf77e811145cadf6eef5901f4782c53886191b2f693f24761847c"
+checksum = "b5aba8db14291edd000dfcc4d620c7ebfb122c613afb886ca8803fa4e128a20a"
 
 [[package]]
 name = "libm"
@@ -382,9 +399,9 @@ checksum = "8355be11b20d696c8f18f6cc018c4e372165b1fa8126cef092399c9951984ffa"
 
 [[package]]
 name = "libz-sys"
-version = "1.1.18"
+version = "1.1.21"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c15da26e5af7e25c90b37a2d75cdbf940cf4a55316de9d84c679c9b8bfabf82e"
+checksum = "df9b68e50e6e0b26f672573834882eb57759f6db9b3be2ea3c35c91188bb4eaa"
 dependencies = [
  "cc",
  "pkg-config",
@@ -393,21 +410,21 @@ dependencies = [
 
 [[package]]
 name = "linux-raw-sys"
-version = "0.4.14"
+version = "0.4.15"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "78b3ae25bc7c8c38cec158d1f2757ee79e9b3740fbc7ccf0e59e4b08d793fa89"
+checksum = "d26c52dbd32dccf2d10cac7725f8eae5296885fb5703b261f7d0a0739ec807ab"
 
 [[package]]
 name = "log"
-version = "0.4.21"
+version = "0.4.25"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "90ed8c1e510134f979dbc4f070f87d4313098b704861a105fe34231c70a3901c"
+checksum = "04cbf5b083de1c7e0222a7a51dbfdba1cbe1c6ab0b15e29fff3f6c077fd9cd9f"
 
 [[package]]
 name = "memchr"
-version = "2.7.2"
+version = "2.7.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6c8640c5d730cb13ebd907d8d04b52f55ac9a2eec55b440c8892f40d56c76c1d"
+checksum = "78ca9ab1a0babb1e7d5695e3530886289c18cf2f87ec19a575a0abdce112e3a3"
 
 [[package]]
 name = "memoffset"
@@ -420,11 +437,11 @@ dependencies = [
 
 [[package]]
 name = "miniz_oxide"
-version = "0.7.3"
+version = "0.8.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "87dfd01fe195c66b572b37921ad8803d010623c0aca821bea2302239d155cdae"
+checksum = "b3b1c9bd4fe1f0f8b387f6eb9eb3b4a1aa26185e5750efb9140301703f62cd1b"
 dependencies = [
- "adler",
+ "adler2",
 ]
 
 [[package]]
@@ -494,15 +511,15 @@ dependencies = [
 
 [[package]]
 name = "once_cell"
-version = "1.19.0"
+version = "1.20.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3fdb12b2476b595f9358c5161aa467c2438859caa136dec86c26fdd2efe17b92"
+checksum = "945462a4b81e43c4e3ba96bd7b49d834c6f61198356aa858733bc4acf3cbe62e"
 
 [[package]]
 name = "pkg-config"
-version = "0.3.30"
+version = "0.3.31"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d231b230927b5e4ad203db57bbcbee2802f6bce620b1e4a9024a07d94e2907ec"
+checksum = "953ec861398dccce10c670dfeaf3ec4911ca479e9c02154b3a215178c5f566f2"
 
 [[package]]
 name = "powerfmt"
@@ -530,9 +547,9 @@ dependencies = [
 
 [[package]]
 name = "quote"
-version = "1.0.36"
+version = "1.0.38"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0fa76aaf39101c457836aec0ce2316dbdc3ab723cdda1c6bd4e6ad4208acaca7"
+checksum = "0e4dccaaaf89514f546c693ddc140f729f958c247918a13380cccc6078391acc"
 dependencies = [
  "proc-macro2",
 ]
@@ -564,14 +581,14 @@ version = "0.6.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "ec0be4795e2f6a28069bec0b5ff3e2ac9bafc99e6a9a7dc3547996c5c816922c"
 dependencies = [
- "getrandom",
+ "getrandom 0.2.15",
 ]
 
 [[package]]
 name = "regex"
-version = "1.10.4"
+version = "1.11.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c117dbdfde9c8308975b6a18d71f3f385c89461f7b3fb054288ecf2a2058ba4c"
+checksum = "b544ef1b4eac5dc2db33ea63606ae9ffcfac26c1416a2806ae0bf5f56b201191"
 dependencies = [
  "aho-corasick",
  "memchr",
@@ -581,9 +598,9 @@ dependencies = [
 
 [[package]]
 name = "regex-automata"
-version = "0.4.6"
+version = "0.4.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "86b83b8b9847f9bf95ef68afb0b8e6cdb80f498442f5179a29fad448fcc1eaea"
+checksum = "809e8dc61f6de73b46c85f4c96486310fe304c434cfa43669d7b40f711150908"
 dependencies = [
  "aho-corasick",
  "memchr",
@@ -592,15 +609,15 @@ dependencies = [
 
 [[package]]
 name = "regex-syntax"
-version = "0.8.3"
+version = "0.8.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "adad44e29e4c806119491a7f06f03de4d1af22c3a680dd47f1e6e179439d1f56"
+checksum = "2b15c43186be67a4fd63bee50d0303afffcef381492ebe2c5d87f324e1b8815c"
 
 [[package]]
 name = "rustix"
-version = "0.38.34"
+version = "0.38.44"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "70dc5ec042f7a43c4a73241207cecc9873a06d45debb38b329f8541d85c2730f"
+checksum = "fdb5bc1ae2baa591800df16c9ca78619bf65c0488b41b96ccec5d11220d8c154"
 dependencies = [
  "bitflags",
  "errno",
@@ -609,6 +626,12 @@ dependencies = [
  "windows-sys",
 ]
 
+[[package]]
+name = "rustversion"
+version = "1.0.19"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f7c45b9784283f1b2e7fb61b42047c2fd678ef0960d4f6f1eba131594cc369d4"
+
 [[package]]
 name = "same-file"
 version = "1.0.6"
@@ -620,9 +643,9 @@ dependencies = [
 
 [[package]]
 name = "serde"
-version = "1.0.203"
+version = "1.0.217"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7253ab4de971e72fb7be983802300c30b5a7f0c2e56fab8abfc6a214307c0094"
+checksum = "02fc4265df13d6fa1d00ecff087228cc0a2b5f3c0e87e258d8b94a156e984c70"
 dependencies = [
  "serde_derive",
 ]
@@ -639,15 +662,21 @@ dependencies = [
 
 [[package]]
 name = "serde_derive"
-version = "1.0.203"
+version = "1.0.217"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "500cbc0ebeb6f46627f50f3f5811ccf6bf00643be300b4c3eabc0ef55dc5b5ba"
+checksum = "5a9bf7cf98d04a2b28aead066b7496853d4779c9cc183c440dbac457641e19a0"
 dependencies = [
  "proc-macro2",
  "quote",
  "syn",
 ]
 
+[[package]]
+name = "shlex"
+version = "1.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0fda2ff0d084019ba4d7c6f371c95d8fd75ce3524c3cb8fb653a3023f6323e64"
+
 [[package]]
 name = "smallvec"
 version = "1.13.2"
@@ -668,9 +697,9 @@ checksum = "7da8b5736845d9f2fcb837ea5d9e2628564b3b043a70948a3f0b778838c5fb4f"
 
 [[package]]
 name = "syn"
-version = "2.0.96"
+version = "2.0.98"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d5d0adab1ae378d7f53bdebc67a39f1f151407ef230f0ce2883572f5d8985c80"
+checksum = "36147f1a48ae0ec2b5b3bc5b537d267457555a10dc06f3dbc8cb11ba3006d3b1"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -679,12 +708,14 @@ dependencies = [
 
 [[package]]
 name = "tempfile"
-version = "3.10.1"
+version = "3.16.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "85b77fafb263dd9d05cbeac119526425676db3784113aa9295c88498cbf8bff1"
+checksum = "38c246215d7d24f48ae091a2902398798e05d978b24315d6efbc00ede9a8bb91"
 dependencies = [
  "cfg-if",
  "fastrand",
+ "getrandom 0.3.1",
+ "once_cell",
  "rustix",
  "windows-sys",
 ]
@@ -711,9 +742,9 @@ dependencies = [
 
 [[package]]
 name = "time"
-version = "0.3.36"
+version = "0.3.37"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5dfd88e563464686c916c7e46e623e520ddc6d79fa6641390f2e3fa86e83e885"
+checksum = "35e7868883861bd0e56d9ac6efcaaca0d6d5d82a2a7ec8209ff492c07cf37b21"
 dependencies = [
  "deranged",
  "num-conv",
@@ -730,15 +761,15 @@ checksum = "ef927ca75afb808a4d64dd374f00a2adf8d0fcff8e7b184af886c3c87ec4a3f3"
 
 [[package]]
 name = "unicode-ident"
-version = "1.0.12"
+version = "1.0.16"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3354b9ac3fae1ff6755cb6db53683adb661634f67557942dea4facebec0fee4b"
+checksum = "a210d160f08b701c8721ba1c726c11662f877ea6b7094007e1ca9a1041945034"
 
 [[package]]
 name = "utf8parse"
-version = "0.2.1"
+version = "0.2.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "711b9620af191e0cdc7468a8d14e709c3dcdb115b36f838e601583af800a370a"
+checksum = "06abde3611657adf66d383f00b093d7faecc7fa57071cce2578660c9f1010821"
 
 [[package]]
 name = "vcpkg"
@@ -763,24 +794,34 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "9c8d87e72b64a3b4db28d11ce29237c246188f4f51057d65a7eab63b7987e423"
 
 [[package]]
-name = "wasm-bindgen"
-version = "0.2.92"
+name = "wasi"
+version = "0.13.3+wasi-0.2.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4be2531df63900aeb2bca0daaaddec08491ee64ceecbee5076636a3b026795a8"
+checksum = "26816d2e1a4a36a2940b96c5296ce403917633dff8f3440e9b236ed6f6bacad2"
+dependencies = [
+ "wit-bindgen-rt",
+]
+
+[[package]]
+name = "wasm-bindgen"
+version = "0.2.100"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1edc8929d7499fc4e8f0be2262a241556cfc54a0bea223790e71446f2aab1ef5"
 dependencies = [
  "cfg-if",
+ "once_cell",
+ "rustversion",
  "wasm-bindgen-macro",
 ]
 
 [[package]]
 name = "wasm-bindgen-backend"
-version = "0.2.92"
+version = "0.2.100"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "614d787b966d3989fa7bb98a654e369c762374fd3213d212cfc0251257e747da"
+checksum = "2f0a0651a5c2bc21487bde11ee802ccaf4c51935d0d3d42a6101f98161700bc6"
 dependencies = [
  "bumpalo",
  "log",
- "once_cell",
  "proc-macro2",
  "quote",
  "syn",
@@ -789,9 +830,9 @@ dependencies = [
 
 [[package]]
 name = "wasm-bindgen-macro"
-version = "0.2.92"
+version = "0.2.100"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a1f8823de937b71b9460c0c34e25f3da88250760bec0ebac694b49997550d726"
+checksum = "7fe63fc6d09ed3792bd0897b314f53de8e16568c2b3f7982f468c0bf9bd0b407"
 dependencies = [
  "quote",
  "wasm-bindgen-macro-support",
@@ -799,9 +840,9 @@ dependencies = [
 
 [[package]]
 name = "wasm-bindgen-macro-support"
-version = "0.2.92"
+version = "0.2.100"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e94f17b526d0a461a191c78ea52bbce64071ed5c04c9ffe424dcb38f74171bb7"
+checksum = "8ae87ea40c9f689fc23f209965b6fb8a99ad69aeeb0231408be24920604395de"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -812,15 +853,18 @@ dependencies = [
 
 [[package]]
 name = "wasm-bindgen-shared"
-version = "0.2.92"
+version = "0.2.100"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "af190c94f2773fdb3729c55b007a722abb5384da03bc0986df4c289bf5567e96"
+checksum = "1a05d73b933a847d6cccdda8f838a22ff101ad9bf93e33684f39c1f5f0eece3d"
+dependencies = [
+ "unicode-ident",
+]
 
 [[package]]
 name = "winapi-util"
-version = "0.1.8"
+version = "0.1.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4d4cc384e1e73b93bafa6fb4f1df8c41695c8a91cf9c4c64358067d15a7b6c6b"
+checksum = "cf221c93e13a30d793f7645a0e7762c55d169dbb0a49671918a2319d289b10bb"
 dependencies = [
  "windows-sys",
 ]
@@ -836,18 +880,18 @@ dependencies = [
 
 [[package]]
 name = "windows-sys"
-version = "0.52.0"
+version = "0.59.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "282be5f36a8ce781fad8c8ae18fa3f9beff57ec1b52cb3de0789201425d9a33d"
+checksum = "1e38bc4d79ed67fd075bcc251a1c39b32a1776bbe92e5bef1f0bf1f8c531853b"
 dependencies = [
  "windows-targets",
 ]
 
 [[package]]
 name = "windows-targets"
-version = "0.52.5"
+version = "0.52.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6f0713a46559409d202e70e28227288446bf7841d3211583a4b53e3f6d96e7eb"
+checksum = "9b724f72796e036ab90c1021d4780d4d3d648aca59e491e6b98e725b84e99973"
 dependencies = [
  "windows_aarch64_gnullvm",
  "windows_aarch64_msvc",
@@ -861,51 +905,60 @@ dependencies = [
 
 [[package]]
 name = "windows_aarch64_gnullvm"
-version = "0.52.5"
+version = "0.52.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7088eed71e8b8dda258ecc8bac5fb1153c5cffaf2578fc8ff5d61e23578d3263"
+checksum = "32a4622180e7a0ec044bb555404c800bc9fd9ec262ec147edd5989ccd0c02cd3"
 
 [[package]]
 name = "windows_aarch64_msvc"
-version = "0.52.5"
+version = "0.52.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9985fd1504e250c615ca5f281c3f7a6da76213ebd5ccc9561496568a2752afb6"
+checksum = "09ec2a7bb152e2252b53fa7803150007879548bc709c039df7627cabbd05d469"
 
 [[package]]
 name = "windows_i686_gnu"
-version = "0.52.5"
+version = "0.52.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "88ba073cf16d5372720ec942a8ccbf61626074c6d4dd2e745299726ce8b89670"
+checksum = "8e9b5ad5ab802e97eb8e295ac6720e509ee4c243f69d781394014ebfe8bbfa0b"
 
 [[package]]
 name = "windows_i686_gnullvm"
-version = "0.52.5"
+version = "0.52.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "87f4261229030a858f36b459e748ae97545d6f1ec60e5e0d6a3d32e0dc232ee9"
+checksum = "0eee52d38c090b3caa76c563b86c3a4bd71ef1a819287c19d586d7334ae8ed66"
 
 [[package]]
 name = "windows_i686_msvc"
-version = "0.52.5"
+version = "0.52.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "db3c2bf3d13d5b658be73463284eaf12830ac9a26a90c717b7f771dfe97487bf"
+checksum = "240948bc05c5e7c6dabba28bf89d89ffce3e303022809e73deaefe4f6ec56c66"
 
 [[package]]
 name = "windows_x86_64_gnu"
-version = "0.52.5"
+version = "0.52.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4e4246f76bdeff09eb48875a0fd3e2af6aada79d409d33011886d3e1581517d9"
+checksum = "147a5c80aabfbf0c7d901cb5895d1de30ef2907eb21fbbab29ca94c5b08b1a78"
 
 [[package]]
 name = "windows_x86_64_gnullvm"
-version = "0.52.5"
+version = "0.52.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "852298e482cd67c356ddd9570386e2862b5673c85bd5f88df9ab6802b334c596"
+checksum = "24d5b23dc417412679681396f2b49f3de8c1473deb516bd34410872eff51ed0d"
 
 [[package]]
 name = "windows_x86_64_msvc"
-version = "0.52.5"
+version = "0.52.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bec47e5bfd1bff0eeaf6d8b485cc1074891a197ab4225d504cb7a1ab88b02bf0"
+checksum = "589f6da84c646204747d1270a2a5661ea66ed1cced2631d546fdfb155959f9ec"
+
+[[package]]
+name = "wit-bindgen-rt"
+version = "0.33.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3268f3d866458b787f390cf61f4bbb563b922d091359f9608842999eaee3943c"
+dependencies = [
+ "bitflags",
+]
 
 [[package]]
 name = "zerocopy"

pkgs/by-name/ad/add-determinism/package.nix

@@ -10,13 +10,13 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "add-determinism";
-  version = "0.5.0";
+  version = "0.6.0";
 
   src = fetchFromGitHub {
     owner = "keszybz";
     repo = pname;
     tag = "v${version}";
-    hash = "sha256-YfY0l57SjBfO5nLlCfEBzwyVPdzZKK5YKVvVATsObi0=";
+    hash = "sha256-QFhed8YTgvfm6bB/cRsrnN0foplJhK1b9IYD9HGdJUc=";
   };
 
   # this project has no Cargo.lock now

pkgs/by-name/af/affine/package.nix

@@ -1,23 +1,24 @@
 {
-  cacert,
-  cargo,
-  copyDesktopItems,
-  fetchFromGitHub,
-  fetchurl,
-  findutils,
-  jq,
   lib,
-  makeDesktopItem,
-  makeWrapper,
-  rsync,
-  rustPlatform,
-  rustc,
   stdenv,
   stdenvNoCC,
-  yarn-berry,
-  zip,
+  fetchFromGitHub,
+  rustPlatform,
   electron_33,
   nodejs_20,
+  yarn-berry,
+  cacert,
+  writableTmpDirAsHomeHook,
+  cargo,
+  rustc,
+  findutils,
+  zip,
+  rsync,
+  jq,
+  copyDesktopItems,
+  makeWrapper,
+  makeDesktopItem,
+  nix-update-script,
   buildType ? "stable",
   commandLineArgs ? "",
 }:
@@ -34,213 +35,203 @@ let
   electron = electron_33;
   nodejs = nodejs_20;
   yarn = yarn-berry.override { inherit nodejs; };
+  productName = if buildType != "stable" then "AFFiNE-${buildType}" else "AFFiNE";
+  binName = lib.toLower productName;
 in
-stdenv.mkDerivation (
-  finalAttrs:
-  (
-    {
-      productName = if buildType == "stable" then "AFFiNE" else "AFFiNE-" + buildType;
-      binName = lib.toLower finalAttrs.productName;
-      pname = finalAttrs.binName;
+stdenv.mkDerivation (finalAttrs: {
+  pname = binName;
 
-      # https://github.com/toeverything/AFFiNE/releases/tag/v0.18.1
-      version = "0.18.1";
-      GITHUB_SHA = "8b066a4b398aace25a20508a8e3c1a381721971f";
-      src = fetchFromGitHub {
-        owner = "toeverything";
-        repo = "AFFiNE";
-        rev = finalAttrs.GITHUB_SHA;
-        hash = "sha256-TWwojG3lqQlQFX3BKoFjJ27a3T/SawXgNDO6fP6gW4k=";
-      };
+  version = "0.19.6";
+  src = fetchFromGitHub {
+    owner = "toeverything";
+    repo = "AFFiNE";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-BydTNE36oRIxr2lTnc2+EY0lvMXn4NTLB4EjqzhdjGk=";
+  };
 
-      meta =
-        {
-          description = "Workspace with fully merged docs, whiteboards and databases";
-          longDescription = ''
-            AFFiNE is an open-source, all-in-one workspace and an operating
-            system for all the building blocks that assemble your knowledge
-            base and much more -- wiki, knowledge management, presentation
-            and digital assets
-          '';
-          homepage = "https://affine.pro/";
-          license = lib.licenses.mit;
-          maintainers = with lib.maintainers; [ xiaoxiangmoe ];
-          platforms = [
-            "aarch64-darwin"
-            "aarch64-linux"
-            "x86_64-darwin"
-            "x86_64-linux"
-          ];
-          sourceProvenance = [ lib.sourceTypes.fromSource ];
-        }
-        // lib.optionalAttrs hostPlatform.isLinux {
-          mainProgram = finalAttrs.binName;
-        };
-
-      env = {
-        BUILD_TYPE = buildType;
-      };
-      cargoDeps = rustPlatform.fetchCargoVendor {
-        src = finalAttrs.src;
-        hash = "sha256-5s/X9CD/H9rSn7SqMHioLg1KRP7y9fsozdFRY3hNiP8=";
-      };
-      yarnOfflineCache = stdenvNoCC.mkDerivation {
-        name = "yarn-offline-cache";
-        src = finalAttrs.src;
-        nativeBuildInputs = [
-          yarn
-          cacert
-        ];
+  cargoDeps = rustPlatform.fetchCargoVendor {
+    inherit (finalAttrs) pname version src;
+    hash = "sha256-racjpf0VgNod6OxWKSaCbKS9fEkInpDyhVbAHfYWIDo=";
+  };
+  yarnOfflineCache = stdenvNoCC.mkDerivation {
+    name = "yarn-offline-cache";
+    inherit (finalAttrs) src;
+    nativeBuildInputs = [
+      yarn
+      cacert
+      writableTmpDirAsHomeHook
+    ];
+    # force yarn install run in CI mode
+    env.CI = "1";
+    buildPhase =
+      let
         supportedArchitectures = builtins.toJSON {
           os = [
             "darwin"
             "linux"
           ];
           cpu = [
-            "arm64"
             "x64"
+            "ia32"
+            "arm64"
           ];
           libc = [
             "glibc"
             "musl"
           ];
         };
-        buildPhase = ''
-          export HOME="$NIX_BUILD_TOP"
-          export CI=1
-
-          mkdir -p $out
-          yarn config set enableTelemetry false
-          yarn config set cacheFolder $out
-          yarn config set enableGlobalCache false
-          yarn config set supportedArchitectures --json "$supportedArchitectures"
-
-          yarn install --immutable --mode=skip-build
-        '';
-        dontInstall = true;
-        outputHashMode = "recursive";
-        outputHash = "sha256-HueTia+1ApfvbBK/b+iE84TB1DCWIDLoQ9XhjYlGCUs=";
-      };
-      nativeBuildInputs =
-        [
-          nodejs
-          yarn
-          cargo
-          rustc
-          findutils
-          zip
-          jq
-          rsync
-        ]
-        ++ lib.optionals hostPlatform.isLinux [
-          copyDesktopItems
-          makeWrapper
-        ];
-
-      patchPhase = ''
-        runHook prePatchPhase
-
-        sed -i '/packagerConfig/a \    electronZipDir: process.env.ELECTRON_FORGE_ELECTRON_ZIP_DIR,' packages/frontend/apps/electron/forge.config.mjs
-
-        runHook postPatchPhase
-      '';
-
-      configurePhase =
-        let
-          electronContentPath =
-            electron + (if hostPlatform.isLinux then "/libexec/electron/" else "/Applications/");
-        in
-        ''
-          runHook preConfigurePhase
-
-          export HOME="$NIX_BUILD_TOP"
-          export CI=1
-
-          # cargo config
-          mkdir -p .cargo
-          cat $cargoDeps/.cargo/config.toml >> .cargo/config.toml
-          ln -s $cargoDeps @vendor@
-
-          # yarn config
-          yarn config set enableTelemetry false
-          yarn config set enableGlobalCache false
-          yarn config set cacheFolder $yarnOfflineCache
-
-          # electron config
-          ELECTRON_VERSION_IN_LOCKFILE=$(yarn why electron --json | tail --lines 1 | jq --raw-output '.children | to_entries | first | .key ' | cut -d : -f 2)
-          rsync --archive --chmod=u+w ${electronContentPath} $HOME/.electron-prebuilt-zip-tmp
-          export ELECTRON_FORGE_ELECTRON_ZIP_DIR=$PWD/.electron_zip_dir
-          mkdir -p $ELECTRON_FORGE_ELECTRON_ZIP_DIR
-          (cd $HOME/.electron-prebuilt-zip-tmp && zip --recurse-paths - .) > $ELECTRON_FORGE_ELECTRON_ZIP_DIR/electron-v$ELECTRON_VERSION_IN_LOCKFILE-${nodePlatform}-${nodeArch}.zip
-          export ELECTRON_SKIP_BINARY_DOWNLOAD=1
-
-          runHook postConfigurePhase
-        '';
-      buildPhase = ''
+      in
+      ''
         runHook preBuild
 
-        # first build
-        yarn workspaces focus @affine/electron @affine/monorepo
-        CARGO_NET_OFFLINE=true yarn workspace @affine/native build
-        BUILD_TYPE=${buildType} SKIP_NX_CACHE=1 yarn workspace @affine/electron generate-assets
+        mkdir -p $out
+        yarn config set enableTelemetry false
+        yarn config set cacheFolder $out
+        yarn config set enableGlobalCache false
+        yarn config set supportedArchitectures --json '${supportedArchitectures}'
 
-        # second build
-        yarn config set nmMode classic
-        yarn config set nmHoistingLimits workspaces
-        find . -name 'node_modules' -type d -prune -exec rm -rf '{}' +
-        yarn workspaces focus @affine/electron @affine/monorepo
-        BUILD_TYPE=${buildType} SKIP_WEB_BUILD=1 SKIP_BUNDLE=1 HOIST_NODE_MODULES=1 yarn workspace @affine/electron make
+        yarn install --immutable --mode=skip-build
 
         runHook postBuild
       '';
-      installPhase =
-        let
-          inherit (finalAttrs) binName productName;
-        in
-        if hostPlatform.isDarwin then
-          ''
-            runHook preInstall
+    dontInstall = true;
+    outputHashMode = "recursive";
+    outputHash = "sha256-OuBxx0nrZ/KVFD1JinjBBXiQUcePWx5zRACld1CoHX0=";
+  };
+  nativeBuildInputs =
+    [
+      nodejs
+      yarn
+      cargo
+      rustc
+      findutils
+      zip
+      jq
+      rsync
+      writableTmpDirAsHomeHook
+    ]
+    ++ lib.optionals hostPlatform.isLinux [
+      copyDesktopItems
+      makeWrapper
+    ];
 
-            mkdir -p $out/Applications
-            mv packages/frontend/apps/electron/out/${buildType}/${productName}-darwin-${nodeArch}/${productName}.app $out/Applications
+  # force yarn install run in CI mode
+  env.CI = "1";
 
-            runHook postInstall
-          ''
-        else
-          ''
-            runHook preInstall
+  # Remove code under The AFFiNE Enterprise Edition (EE) license.
+  # Keep file package.json for `yarn install --immutable` lockfile check.
+  postPatch = ''
+    BACKEND_SERVER_PACKAGE_JSON="$(jq 'del(.scripts.postinstall)' packages/backend/server/package.json)"
+    rm -rf packages/backend/server/{.*,*}
+    echo "$BACKEND_SERVER_PACKAGE_JSON" > packages/backend/server/package.json
+  '';
 
-            mkdir --parents $out/lib/${binName}/
-            mv packages/frontend/apps/electron/out/${buildType}/${productName}-linux-${nodeArch}/{resources,LICENSE*} $out/lib/${binName}/
-            install -Dm644 packages/frontend/apps/electron/resources/icons/icon_${buildType}_64x64.png $out/share/icons/hicolor/64x64/apps/${binName}.png
+  configurePhase = ''
+    runHook preConfigurePhase
 
-            makeWrapper "${electron}/bin/electron" $out/bin/${binName} \
-              --inherit-argv0 \
-              --add-flags $out/lib/${binName}/resources/app.asar \
-              --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--ozone-platform-hint=auto --enable-features=WaylandWindowDecorations --enable-wayland-ime=true}}" \
-              --add-flags ${lib.escapeShellArg commandLineArgs}
+    # cargo config
+    mkdir -p .cargo
+    cat $cargoDeps/.cargo/config.toml >> .cargo/config.toml
+    ln -s $cargoDeps @vendor@
 
-            runHook postInstall
-          '';
-    }
-    // (lib.optionalAttrs hostPlatform.isLinux {
-      desktopItems =
-        let
-          inherit (finalAttrs) binName productName;
-        in
-        [
-          (makeDesktopItem {
-            name = binName;
-            desktopName = productName;
-            comment = "AFFiNE Desktop App";
-            exec = "${binName} %U";
-            terminal = false;
-            icon = binName;
-            startupWMClass = binName;
-            categories = [ "Utility" ];
-            mimeTypes = [ "x-scheme-handler/${binName}" ];
-          })
-        ];
+    # yarn config
+    yarn config set enableTelemetry false
+    yarn config set enableGlobalCache false
+    yarn config set cacheFolder $yarnOfflineCache
+
+    # electron config
+    ELECTRON_VERSION_IN_LOCKFILE=$(yarn why electron --json | tail --lines 1 | jq --raw-output '.children | to_entries | first | .key ' | cut -d : -f 2)
+    rsync --archive --chmod=u+w "${electron.dist}/" $HOME/.electron-prebuilt-zip-tmp
+    export ELECTRON_FORGE_ELECTRON_ZIP_DIR=$PWD/.electron_zip_dir
+    mkdir -p $ELECTRON_FORGE_ELECTRON_ZIP_DIR
+    (cd $HOME/.electron-prebuilt-zip-tmp && zip --recurse-paths - .) > $ELECTRON_FORGE_ELECTRON_ZIP_DIR/electron-v$ELECTRON_VERSION_IN_LOCKFILE-${nodePlatform}-${nodeArch}.zip
+    export ELECTRON_SKIP_BINARY_DOWNLOAD=1
+
+    runHook postConfigurePhase
+  '';
+
+  buildPhase = ''
+    runHook preBuild
+
+    # first build
+    yarn install
+    CARGO_NET_OFFLINE=true yarn affine @affine/native build
+    GITHUB_SHA=ffffffffffffffffffffffffffffffffffffffff BUILD_TYPE=${buildType} SKIP_NX_CACHE=1 yarn affine @affine/electron generate-assets
+
+    # second build
+    yarn config set nmMode classic
+    yarn config set nmHoistingLimits workspaces
+    find . -name 'node_modules' -type d -prune -exec rm -rf '{}' +
+    yarn install
+    BUILD_TYPE=${buildType} SKIP_WEB_BUILD=1 SKIP_BUNDLE=1 HOIST_NODE_MODULES=1 yarn affine @affine/electron make
+
+    runHook postBuild
+  '';
+
+  installPhase =
+    if hostPlatform.isDarwin then
+      ''
+        runHook preInstall
+
+        mkdir -p $out/Applications
+        mv packages/frontend/apps/electron/out/${buildType}/${productName}-darwin-${nodeArch}/${productName}.app $out/Applications
+
+        runHook postInstall
+      ''
+    else
+      ''
+        runHook preInstall
+
+        mkdir --parents $out/lib/${binName}/
+        mv packages/frontend/apps/electron/out/${buildType}/${productName}-linux-${nodeArch}/{resources,LICENSE*} $out/lib/${binName}/
+        install -Dm644 packages/frontend/apps/electron/resources/icons/icon_${buildType}_64x64.png $out/share/icons/hicolor/64x64/apps/${binName}.png
+
+        makeWrapper "${lib.getExe electron}" $out/bin/${binName} \
+          --inherit-argv0 \
+          --add-flags $out/lib/${binName}/resources/app.asar \
+          --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--ozone-platform-hint=auto --enable-features=WaylandWindowDecorations --enable-wayland-ime=true}}" \
+          --add-flags ${lib.escapeShellArg commandLineArgs}
+
+        runHook postInstall
+      '';
+
+  desktopItems = [
+    (makeDesktopItem {
+      name = binName;
+      desktopName = productName;
+      comment = "AFFiNE Desktop App";
+      exec = "${binName} %U";
+      terminal = false;
+      icon = binName;
+      startupWMClass = binName;
+      categories = [ "Utility" ];
+      mimeTypes = [ "x-scheme-handler/${binName}" ];
     })
-  )
-)
+  ];
+
+  passthru.updateScript = nix-update-script {
+    extraArgs = [
+      "--version-regex=^v(\\d+\\.\\d+\\.\\d+)$"
+    ];
+  };
+
+  meta = {
+    description = "Workspace with fully merged docs, whiteboards and databases";
+    longDescription = ''
+      AFFiNE is an open-source, all-in-one workspace and an operating
+      system for all the building blocks that assemble your knowledge
+      base and much more -- wiki, knowledge management, presentation
+      and digital assets
+    '';
+    homepage = "https://affine.pro/";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ xiaoxiangmoe ];
+    platforms = [
+      "aarch64-darwin"
+      "aarch64-linux"
+      "x86_64-darwin"
+      "x86_64-linux"
+    ];
+    sourceProvenance = [ lib.sourceTypes.fromSource ];
+  };
+})

pkgs/by-name/ai/aiken/package.nix

@@ -10,17 +10,17 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "aiken";
-  version = "1.1.10";
+  version = "1.1.11";
 
   src = fetchFromGitHub {
     owner = "aiken-lang";
     repo = "aiken";
     rev = "v${version}";
-    hash = "sha256-qM6rBBBwLUwB3g+jjT0R6z0473x929t2W8tOY663EcI=";
+    hash = "sha256-RCMUF9+dj+zJM1tyuUs2oOMk+5xdHrzWYejuOPd/Ngc=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-bgf9iVqQ7HuUV+idlPxyuILmxjBi2ThihdeCLjhj8Hk=";
+  cargoHash = "sha256-R6jTr4F+ZbRracW8yQdpDHHerzbJy1jQYr/ttFSwCWc=";
 
   buildInputs =
     [ openssl ]

pkgs/by-name/am/amazon-ec2-metadata-mock/package.nix

@@ -0,0 +1,43 @@
+{
+  lib,
+  buildGoModule,
+  fetchFromGitHub,
+  nix-update-script,
+  versionCheckHook,
+}:
+
+buildGoModule rec {
+  pname = "amazon-ec2-metadata-mock";
+  version = "1.13.0";
+
+  src = fetchFromGitHub {
+    owner = "aws";
+    repo = "amazon-ec2-metadata-mock";
+    tag = "v${version}";
+    hash = "sha256-gqzROHfwhd3i1GWSp58dBKjS1EU7Xu0Fqbzv2PoLaF8=";
+  };
+
+  vendorHash = "sha256-Px4vhFW1mhXbBuPbxEpukmeLZewF7zooOXKxL8sEFLU=";
+
+  subPackages = [ "cmd/ec2-metadata-mock" ];
+
+  doInstallCheck = true;
+
+  nativeInstallCheckInputs = [ versionCheckHook ];
+
+  versionCheckProgram = "${builtins.placeholder "out"}/bin/ec2-metadata-mock";
+
+  versionCheckProgramArg = "--version";
+
+  passthru = {
+    updateScript = nix-update-script { };
+  };
+
+  meta = {
+    description = "Tool to simulate Amazon EC2 instance metadata";
+    homepage = "https://github.com/aws/amazon-ec2-metadata-mock";
+    license = lib.licenses.asl20;
+    mainProgram = "ec2-metadata-mock";
+    maintainers = with lib.maintainers; [ arianvp ];
+  };
+}

pkgs/by-name/am/amazon-ecr-credential-helper/package.nix

@@ -8,13 +8,13 @@
 
 buildGoModule rec {
   pname = "amazon-ecr-credential-helper";
-  version = "0.9.0";
+  version = "0.9.1";
 
   src = fetchFromGitHub {
     owner = "awslabs";
     repo = "amazon-ecr-credential-helper";
     rev = "v${version}";
-    sha256 = "sha256-TRYBZiddnN6wCErSLKCr9JEH/Ldxg+Oh2hA63+EwRjo=";
+    sha256 = "sha256-kX1I8HsOJKFogqpfTgFBedM6BObdkpYfYwx3tS2IdMo=";
   };
 
   vendorHash = null;

pkgs/by-name/an/angular-language-server/package.nix

@@ -15,11 +15,11 @@
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "angular-language-server";
-  version = "19.0.4";
+  version = "19.1.0";
   src = fetchurl {
     name = "angular-language-server-${finalAttrs.version}.zip";
     url = "https://github.com/angular/vscode-ng-language-service/releases/download/v${finalAttrs.version}/ng-template.vsix";
-    hash = "sha256-0vED1AcNIbZ7SmXn4KaBBajxfAptQg+XKL3NtJfnvG8=";
+    hash = "sha256-ipF8UOUUuUr6LWetJ9V7Mm1EcxL4fQCZvl1ti5VBo5U=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/ap/apprun-cli/package.nix

@@ -0,0 +1,36 @@
+{
+  lib,
+  buildGoModule,
+  fetchFromGitHub,
+  nix-update-script,
+}:
+
+buildGoModule rec {
+  pname = "apprun-cli";
+  version = "0.0.2";
+
+  src = fetchFromGitHub {
+    owner = "fujiwara";
+    repo = "apprun-cli";
+    tag = "v${version}";
+    hash = "sha256-SvFShjAHjIKhz/YolgmFeaAxflh3FRPEZDx57+AtXeQ=";
+  };
+
+  vendorHash = "sha256-pz97Eihc/6b2J+JuEZJQoqBkKtf1J5XbSFMQa1CJrRo=";
+
+  ldflags = [
+    "-s"
+    "-w"
+  ];
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "CLI for sakura AppRun";
+    homepage = "https://github.com/fujiwara/apprun-cli";
+    changelog = "https://github.com/fujiwara/apprun-cli/blob/v${version}/CHANGELOG.md";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ natsukium ];
+    mainProgram = "apprun-cli";
+  };
+}

pkgs/by-name/ar/argo/package.nix

@@ -34,16 +34,16 @@ let
 in
 buildGoModule rec {
   pname = "argo";
-  version = "3.6.2";
+  version = "3.6.3";
 
   src = fetchFromGitHub {
     owner = "argoproj";
     repo = "argo";
     tag = "v${version}";
-    hash = "sha256-GRs6xF9/vZi5LdkDA4RkBR6ElvWi0uji/05h0Y7P2eU=";
+    hash = "sha256-FbhF/oPWtcDqukeQf+NjfSCieQmrSTKBn3vbRr9IQIE=";
   };
 
-  vendorHash = "sha256-8+0iBtXNHyLwE6+AeDDQRERt0930kPIjhQ5abqEqey0=";
+  vendorHash = "sha256-uCIdZkoPgppJtrFf7nOVIyEXo1bVILYXNs5LtLLLmsY=";
 
   doCheck = false;
 

pkgs/by-name/as/astc-encoder/package.nix

@@ -47,13 +47,13 @@ in
 
 stdenv.mkDerivation rec {
   pname = "astc-encoder";
-  version = "5.1.0";
+  version = "5.2.0";
 
   src = fetchFromGitHub {
     owner = "ARM-software";
     repo = "astc-encoder";
     rev = version;
-    sha256 = "sha256-IGzH/0JLDUkwABCFRVVEJevWwcT5El3HweU6nsVQCJw=";
+    sha256 = "sha256-rCyi5Nla2IXsLD+rLMTN1h3B9umlNN0epZmPi/IFHPQ=";
   };
 
   nativeBuildInputs = [ cmake ];

pkgs/by-name/au/audacity/package.nix

@@ -176,15 +176,17 @@ stdenv.mkDerivation (finalAttrs: {
   dontWrapGApps = true;
 
   # Replace audacity's wrapper, to:
-  # - put it in the right place, it shouldn't be in "$out/audacity"
+  # - Put it in the right place; it shouldn't be in "$out/audacity"
   # - Add the ffmpeg dynamic dependency
+  # - Use Xwayland by default on Wayland. See https://github.com/audacity/audacity/pull/5977
   postFixup =
     lib.optionalString stdenv.hostPlatform.isLinux ''
       wrapProgram "$out/bin/audacity" \
         "''${gappsWrapperArgs[@]}" \
         --prefix LD_LIBRARY_PATH : "$out/lib/audacity":${lib.makeLibraryPath [ ffmpeg ]} \
         --suffix AUDACITY_MODULES_PATH : "$out/lib/audacity/modules" \
-        --suffix AUDACITY_PATH : "$out/share/audacity"
+        --suffix AUDACITY_PATH : "$out/share/audacity" \
+        --set-default GDK_BACKEND x11
     ''
     + lib.optionalString stdenv.hostPlatform.isDarwin ''
       mkdir -p $out/{Applications,bin}

pkgs/by-name/ba/badkeys/package.nix

@@ -1,19 +1,21 @@
 {
   lib,
+  badkeys,
   fetchFromGitHub,
   python3Packages,
+  testers,
 }:
 
 python3Packages.buildPythonApplication rec {
   pname = "badkeys";
-  version = "0.0.12";
+  version = "0.0.13";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "badkeys";
     repo = "badkeys";
     tag = "v${version}";
-    hash = "sha256-LFoB/ZHIMRpN/eHg3x8HCxNbMKclf2SJSDPk33OIil8=";
+    hash = "sha256-xukdaqyQKEnwPmAN4WZqeLo5g2tJxPehabTyDgCv8q4=";
   };
 
   build-system = with python3Packages; [
@@ -35,10 +37,14 @@ python3Packages.buildPythonApplication rec {
 
   pythonImportsCheck = [ "badkeys" ];
 
+  passthru = {
+    tests.version = testers.testVersion { package = badkeys; };
+  };
+
   meta = {
     description = "Tool to find common vulnerabilities in cryptographic public keys";
     homepage = "https://badkeys.info/";
-    changelog = "https://github.com/badkeys/badkeys/releases/tag/v${version}";
+    changelog = "https://github.com/badkeys/badkeys/releases/tag/${src.tag}";
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [ getchoo ];
     mainProgram = "badkeys";

pkgs/by-name/ba/bakelite/package.nix

@@ -2,15 +2,16 @@
   lib,
   stdenv,
   fetchFromGitHub,
+  unstableGitUpdater,
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation {
   pname = "bakelite";
-  version = "unstable-2023-03-30";
+  version = "0.4.2-unstable-2023-05-30";
 
   src = fetchFromGitHub {
     owner = "richfelker";
-    repo = pname;
+    repo = "bakelite";
     rev = "65d69e88e0972d1493ebbd9bf9d1bfde36272636";
     hash = "sha256-OjBw9aYD2h7BWYgQzZp03hGCyQcRgmm2AjrcT/QrQAo=";
   };
@@ -27,13 +28,19 @@ stdenv.mkDerivation rec {
     cp bakelite $out/bin
   '';
 
-  meta = with lib; {
+  passthru = {
+    updateScript = unstableGitUpdater {
+      tagPrefix = "v";
+    };
+  };
+
+  meta = {
     homepage = "https://github.com/richfelker/bakelite";
     description = "Incremental backup with strong cryptographic confidentality";
     mainProgram = "bakelite";
-    license = licenses.gpl2Only;
-    maintainers = with maintainers; [ mvs ];
+    license = lib.licenses.gpl2Only;
+    maintainers = with lib.maintainers; [ mvs ];
     # no support for Darwin (yet: https://github.com/richfelker/bakelite/pull/5)
-    platforms = platforms.linux;
+    platforms = lib.platforms.linux;
   };
 }

pkgs/by-name/bf/bfg-repo-cleaner/package.nix

@@ -4,19 +4,18 @@
   fetchurl,
   jre,
   makeWrapper,
-  testers,
-  bfg-repo-cleaner,
+  versionCheckHook,
 }:
 
 stdenv.mkDerivation rec {
   pname = "bfg-repo-cleaner";
-  version = "1.14.0";
+  version = "1.15.0";
 
   jarName = "bfg-${version}.jar";
 
   src = fetchurl {
     url = "mirror://maven/com/madgag/bfg/${version}/${jarName}";
-    hash = "sha256-GnXpOQVB9LVdnAElazYbgVweCiY+L7PQcrVcKRHq0Lc=";
+    hash = "sha256-3+KIWtwpFjeQk/AqgBgSAFNoVsmph78hxJLkUq3v73o=";
   };
 
   nativeBuildInputs = [ makeWrapper ];
@@ -31,9 +30,12 @@ stdenv.mkDerivation rec {
     makeWrapper "${jre}/bin/java" $out/bin/bfg --add-flags "-cp $out/share/java/$jarName com.madgag.git.bfg.cli.Main"
   '';
 
-  passthru.tests.version = testers.testVersion {
-    package = bfg-repo-cleaner;
-  };
+  nativeInstallCheckInputs = [
+    versionCheckHook
+  ];
+  doInstallCheck = true;
+  versionCheckProgram = "${placeholder "out"}/bin/${meta.mainProgram}";
+  versionCheckProgramArg = [ "--version" ];
 
   meta = with lib; {
     homepage = "https://rtyley.github.io/bfg-repo-cleaner/";

pkgs/by-name/bl/blst/package.nix

@@ -6,13 +6,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "blst";
-  version = "0.3.13";
+  version = "0.3.14";
 
   src = fetchFromGitHub {
     owner = "supranational";
     repo = "blst";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-+Ae2cCVVEXnV/ftVOApxDcXM3COf/4DXXd1AOuGS5uc=";
+    hash = "sha256-IlbNMLBjs/dvGogcdbWQIL+3qwy7EXJbIDpo4xBd4bY=";
   };
 
   buildPhase = ''

pkgs/by-name/bo/bosh-cli/package.nix

@@ -9,13 +9,13 @@
 buildGoModule rec {
   pname = "bosh-cli";
 
-  version = "7.8.6";
+  version = "7.9.2";
 
   src = fetchFromGitHub {
     owner = "cloudfoundry";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-rrYB8W1Zq9rCRgVyAPFZ5i37uEKXvV83hpkLaB7N9zQ=";
+    sha256 = "sha256-+t1gJJMp2x+V5Wrbt/HnygFa1LlDQWB1NPTKi399HhA=";
   };
   vendorHash = null;
 

pkgs/by-name/br/broot/package.nix

@@ -15,17 +15,17 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "broot";
-  version = "1.44.6";
+  version = "1.44.7";
 
   src = fetchFromGitHub {
     owner = "Canop";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-cvrWcfQj5Pc2tyaQjhhTK9Ko240Bz6dbUe+OFLTz/+M=";
+    hash = "sha256-GaOPC1lIu48qFo99AQ99f49e8qH/TEQubpluptLc0jY=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-k0H68lvciLjfRx2J1s1dKA8kijFkSBryoGWXCVAR6Ic=";
+  cargoHash = "sha256-J7zc1aTH62nL96cSb9CiIk8uJdR7nk9EnERiAfMvqNM=";
 
   nativeBuildInputs = [
     installShellFiles

pkgs/by-name/bw/bwa-mem2/no-submodule.patch

@@ -0,0 +1,42 @@
+diff --git a/Makefile b/Makefile
+index 359585f..13ec279 100644
+--- a/Makefile
++++ b/Makefile
+@@ -49,7 +49,6 @@ OBJS=		src/fastmap.o src/bwtindex.o src/utils.o src/memcpy_bwamem.o src/kthread.
+ 			src/FMI_search.o src/read_index_ele.o src/bwamem_pair.o src/kswv.o src/bwa.o \
+ 			src/bwamem_extra.o src/kopen.o
+ BWA_LIB=    libbwa.a
+-SAFE_STR_LIB=    ext/safestringlib/libsafestring.a
+ 
+ ifeq ($(arch),sse41)
+ 	ifeq ($(CXX), icpc)
+@@ -101,16 +100,6 @@ CXXFLAGS+=	-g -O3 -fpermissive $(ARCH_FLAGS) #-Wall ##-xSSE2
+ all:$(EXE)
+ 
+ multi:
+-	rm -f src/*.o $(BWA_LIB); cd ext/safestringlib/ && $(MAKE) clean;
+-	$(MAKE) arch=sse41    EXE=bwa-mem2.sse41    CXX=$(CXX) all
+-	rm -f src/*.o $(BWA_LIB); cd ext/safestringlib/ && $(MAKE) clean;
+-	$(MAKE) arch=sse42    EXE=bwa-mem2.sse42    CXX=$(CXX) all
+-	rm -f src/*.o $(BWA_LIB); cd ext/safestringlib/ && $(MAKE) clean;
+-	$(MAKE) arch=avx    EXE=bwa-mem2.avx    CXX=$(CXX) all
+-	rm -f src/*.o $(BWA_LIB); cd ext/safestringlib/ && $(MAKE) clean;
+-	$(MAKE) arch=avx2   EXE=bwa-mem2.avx2     CXX=$(CXX) all
+-	rm -f src/*.o $(BWA_LIB); cd ext/safestringlib/ && $(MAKE) clean;
+-	$(MAKE) arch=avx512 EXE=bwa-mem2.avx512bw CXX=$(CXX) all
+ 	$(CXX) -Wall -O3 src/runsimd.cpp -Iext/safestringlib/include -Lext/safestringlib/ -lsafestring $(STATIC_GCC) -o bwa-mem2
+ 
+ 
+@@ -120,12 +109,8 @@ $(EXE):$(BWA_LIB) $(SAFE_STR_LIB) src/main.o
+ $(BWA_LIB):$(OBJS)
+ 	ar rcs $(BWA_LIB) $(OBJS)
+ 
+-$(SAFE_STR_LIB):
+-	cd ext/safestringlib/ && $(MAKE) clean && $(MAKE) CC=$(CC) directories libsafestring.a
+-
+ clean:
+ 	rm -fr src/*.o $(BWA_LIB) $(EXE) bwa-mem2.sse41 bwa-mem2.sse42 bwa-mem2.avx bwa-mem2.avx2 bwa-mem2.avx512bw
+-	cd ext/safestringlib/ && $(MAKE) clean
+ 
+ depend:
+ 	(LC_ALL=C; export LC_ALL; makedepend -Y -- $(CXXFLAGS) $(CPPFLAGS) -I. -- src/*.cpp)

pkgs/by-name/bw/bwa-mem2/package.nix

@@ -2,6 +2,7 @@
   lib,
   stdenv,
   fetchFromGitHub,
+  safestringlib,
   zlib,
 }:
 
@@ -13,21 +14,11 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "bwa-mem2";
     repo = "bwa-mem2";
     rev = "cf4306a47dac35e7e79a9e75398a35f33900cfd0";
-    fetchSubmodules = true;
-    hash = "sha256-1AYSn7nBrDwbX7oSrdEoa1d3t6xzwKnA0S87Y/XeXJg=";
+    hash = "sha256-hY8nLRFWt0GAElhDIcYdUX6cJrzOE3NlYRQr0tC3on4=";
   };
 
   buildInputs = [ zlib ];
 
-  # see https://github.com/bwa-mem2/bwa-mem2/issues/93
-  postPatch = lib.optionalString stdenv.hostPlatform.isDarwin ''
-    sed -i 's/memset_s/memset8_s/g' ext/safestringlib/include/safe_mem_lib.h
-    sed -i 's/memset_s/memset8_s/g' ext/safestringlib/safeclib/memset16_s.c
-    sed -i 's/memset_s/memset8_s/g' ext/safestringlib/safeclib/memset32_s.c
-    sed -i 's/memset_s/memset8_s/g' ext/safestringlib/safeclib/memset_s.c
-    sed -i 's/memset_s/memset8_s/g' ext/safestringlib/safeclib/wmemset_s.c
-  '';
-
   buildFlags = [
     (
       if stdenv.hostPlatform.sse4_2Support then
@@ -43,14 +34,45 @@ stdenv.mkDerivation (finalAttrs: {
     )
   ];
 
-  env = lib.optionalAttrs stdenv.hostPlatform.isDarwin {
-    NIX_CFLAGS_COMPILE = toString [
+  patches = [
+    ./no-submodule.patch
+  ];
+
+  # Also, patch the tests
+  postPatch =
+    # Force path to static link, otherwise, it fails at runtime to
+    # find the shared library
+    ''
+      substituteInPlace Makefile \
+        --replace-fail "-Iext/safestringlib/include" "-I${safestringlib}/include" \
+        --replace-fail "-Lext/safestringlib" "-L${safestringlib}/lib"
+    ''
+    # Make test compile by changing the compiler and path to library
+    # Remove xeonbsw test that fails to compile due to missing _rdsc
+    # also, not portable
+    + ''
+      substituteInPlace test/Makefile \
+        --replace-fail "icpc" "g++" \
+        --replace-fail "../ext/safestringlib/libsafestring.a"  \
+                       "${safestringlib}/lib/libsafestring.a" \
+        --replace-fail \
+          "fmi_test smem2_test bwt_seed_strategy_test sa2ref_test xeonbsw" \
+          "fmi_test smem2_test bwt_seed_strategy_test sa2ref_test"
+    '';
+
+  env.NIX_CFLAGS_COMPILE = toString (
+    lib.optionals stdenv.hostPlatform.isDarwin [
       "-Wno-error=register"
       "-Wno-error=implicit-function-declaration"
-    ];
-  };
+    ]
+  );
+
+  nativeBuildInputs = [
+    safestringlib
+  ];
 
   enableParallelBuilding = true;
+
   installPhase = ''
     runHook preInstall
 
@@ -67,6 +89,6 @@ stdenv.mkDerivation (finalAttrs: {
     homepage = "https://github.com/bwa-mem2/bwa-mem2/";
     changelog = "https://github.com/bwa-mem2/bwa-mem2/blob/${finalAttrs.src.rev}/NEWS.md";
     platforms = platforms.x86_64;
-    maintainers = with maintainers; [ alxsimon ];
+    maintainers = with maintainers; [ apraga ];
   };
 })

pkgs/by-name/ca/cadical/package.nix

@@ -4,7 +4,7 @@
   fetchFromGitHub,
   copyPkgconfigItems,
   makePkgconfigItem,
-  version ? "2.1.2",
+  version ? "2.1.3",
 }:
 
 stdenv.mkDerivation rec {
@@ -17,7 +17,7 @@ stdenv.mkDerivation rec {
     rev = "rel-${version}";
     hash =
       {
-        "2.1.2" = "sha256-fhvQd/f8eaw7OA2/XoOTVOnQxSSxUvugu6VWo2nmpQ0=";
+        "2.1.3" = "sha256-W3kO+6nVzkmJXyHJU+NZWP0oatK3gon4EWF1/03rgL4=";
         "2.0.0" = "sha256-qoeEM9SdpuFuBPeQlCzuhPLcJ+bMQkTUTGiT8QdU8rc=";
       }
       .${version};

pkgs/by-name/ca/cairo-lang/package.nix

@@ -8,17 +8,17 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "cairo";
-  version = "2.9.2";
+  version = "2.9.3";
 
   src = fetchFromGitHub {
     owner = "starkware-libs";
     repo = "cairo";
     rev = "v${version}";
-    hash = "sha256-zjgCOrTlIPN4aU0+FCohJmISPiwpppj3zO/7unVi/iU=";
+    hash = "sha256-X6aEyo3VY0C+1w1S7ZuxVKACKDHWaxPMR98ICq6/icg=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-d9S8d0KLxoipH5nE0jyUaFAl/V8eSOvOwf2skrW5K5g=";
+  cargoHash = "sha256-yjo7nxt/oAqPRI6I3WlnFC+lfT5HiQJnsjTuijx4ekk=";
 
   # openssl crate requires perl during build process
   nativeBuildInputs = [

pkgs/by-name/ca/cargo-shuttle/package.nix

@@ -11,17 +11,17 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "cargo-shuttle";
-  version = "0.51.0";
+  version = "0.52.0";
 
   src = fetchFromGitHub {
     owner = "shuttle-hq";
     repo = "shuttle";
     rev = "v${version}";
-    hash = "sha256-oKFL/tnMsXz/qic65DgLmnmeyBsrklacs+XeVM6RGSs=";
+    hash = "sha256-uAxNLoB8ExfHpGRl96OZWhzV8hSiDzt1E7T4OD21w74=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-ocTkpIqXTf8k+onUroaCt/jMnslctzCt7g9wNtkI82g=";
+  cargoHash = "sha256-cHwF4+5HQmT2hICJjCF1zaivq6AtFhhLatxUWv+esCo=";
 
   nativeBuildInputs = [ pkg-config ];
 

pkgs/by-name/cd/cdncheck/package.nix

@@ -6,16 +6,16 @@
 
 buildGoModule rec {
   pname = "cdncheck";
-  version = "1.1.0";
+  version = "1.1.1";
 
   src = fetchFromGitHub {
     owner = "projectdiscovery";
     repo = "cdncheck";
     tag = "v${version}";
-    hash = "sha256-1TYUSWbcWnRsOM8ctY1g9CmFSAXiK9NmN5ZDaKeJIgw=";
+    hash = "sha256-vz/PAu/YMrlUQ6oXERNm1bl3fZ0YDrvYCv64Qe0+zUo=";
   };
 
-  vendorHash = "sha256-0fiZJeBvxUib8a9CeTmYottOp+15YEdTVYhdzKSSCrk=";
+  vendorHash = "sha256-/1REkZ5+sz/H4T4lXhloz7fu5cLv1GoaD3dlttN+Qd4=";
 
   subPackages = [ "cmd/cdncheck/" ];
 

pkgs/by-name/ce/cemu/0002-cemu-imgui.patch

@@ -0,0 +1,13 @@
+diff --git a/src/imgui/imgui_extension.cpp b/src/imgui/imgui_extension.cpp
+index f1c072f..e3e901d 100644
+--- a/src/imgui/imgui_extension.cpp
++++ b/src/imgui/imgui_extension.cpp
+@@ -129,8 +129,6 @@ void ImGui_UpdateWindowInformation(bool mainWindow)
+ 	io.ConfigFlags |= ImGuiConfigFlags_NavEnableGamepad;
+ #if BOOST_OS_WINDOWS
+ 	io.ImeWindowHandle = mainWindow ? g_window_info.window_main.hwnd : g_window_info.window_pad.hwnd;
+-#else
+-	io.ImeWindowHandle = nullptr;
+ #endif
+ 
+ 	io.MousePos = ImVec2(-FLT_MAX, -FLT_MAX);

pkgs/by-name/ce/cemu/package.nix

@@ -34,24 +34,25 @@
   wrapGAppsHook3,
   wxGTK32,
   zarchive,
+  bluez,
 }:
 
 let
-  # cemu doesn't build with imgui 1.90.2 or newer:
-  # error: 'struct ImGuiIO' has no member named 'ImeWindowHandle'
+  # cemu doesn't build with imgui 1.91.4 or newer:
+  # before v1.91.4 (2024/10/08) the default type for ImTextureID was void*.
   imgui' = imgui.overrideAttrs rec {
-    version = "1.90.1";
+    version = "1.91.3";
     src = fetchFromGitHub {
       owner = "ocornut";
       repo = "imgui";
       rev = "v${version}";
-      hash = "sha256-gf47uLeNiXQic43buB5ZnMqiotlUfIyAsP+3H7yJuFg=";
+      hash = "sha256-J4gz4rnydu8JlzqNC/OIoVoRcgeFd6B1Qboxu5drOKY=";
     };
   };
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "cemu";
-  version = "2.4";
+  version = "2.5";
 
   src = fetchFromGitHub {
     owner = "cemu-project";
@@ -71,6 +72,7 @@ stdenv.mkDerivation (finalAttrs: {
       url = "https://github.com/cemu-project/Cemu/commit/2b0cbf7f6b6c34c748585d255ee7756ff592a502.patch";
       hash = "sha256-jHB/9MWZ/oNfUgZtxtgkSN/OnRARSuGVfXFFB9ldDpI=";
     })
+    ./0002-cemu-imgui.patch
   ];
 
   nativeBuildInputs = [
@@ -106,6 +108,7 @@ stdenv.mkDerivation (finalAttrs: {
     wayland
     wxGTK32
     zarchive
+    bluez
   ];
 
   cmakeFlags = [

pkgs/by-name/ce/certificate-ripper/package.nix

@@ -7,7 +7,7 @@
 
 let
   pname = "certificate-ripper";
-  version = "2.3.0";
+  version = "2.4.0";
 
   jar = maven.buildMavenPackage {
     pname = "${pname}-jar";
@@ -16,8 +16,8 @@ let
     src = fetchFromGitHub {
       owner = "Hakky54";
       repo = "certificate-ripper";
-      rev = version;
-      hash = "sha256-q/UhKLFAre3YUH2W7e+SH4kRM0GIZAUyNJFDm02eL+8=";
+      tag = version;
+      hash = "sha256-2EXALTGeGkHne335B1R42VrA5vMCMkFF5FBatAfO9Tc=";
     };
 
     patches = [
@@ -25,12 +25,22 @@ let
       ./fix-test-temp-dir-path.patch
     ];
 
-    mvnHash = "sha256-/iy7DXBAyq8TIpvrd2WAQh+9OApfxCWo1NoGwbzbq7s=";
+    mvnHash = "sha256-Nv/V2+QPSPMxkDcUh6gJrI6aSi+9O+brxpOZg/JPGxI=";
 
-    mvnParameters = lib.escapeShellArgs [
-      "-Dproject.build.outputTimestamp=1980-01-01T00:00:02Z" # make timestamp deterministic
-      "-Dtest=!PemExportCommandShould#resolveRootCaOnlyWhenEnabled" # disable test using network
-    ];
+    mvnParameters =
+      let
+        disabledTests = [
+          "PemExportCommandShould#resolveRootCaOnlyWhenEnabled" # uses network
+          "DerExportCommandShould#processSystemTrustedCertificates"
+          "JksExportCommandShould#processSystemTrustedCertificates"
+          "PemExportCommandShould#processSystemTrustedCertificates"
+          "Pkcs12ExportCommandShould#processSystemTrustedCertificates"
+        ];
+      in
+      lib.escapeShellArgs [
+        "-Dproject.build.outputTimestamp=1980-01-01T00:00:02Z" # make timestamp deterministic
+        "-Dtest=${lib.concatMapStringsSep "," (t: "!" + t) disabledTests}"
+      ];
 
     installPhase = ''
       install -Dm644 target/crip.jar $out
@@ -47,13 +57,12 @@ buildGraalvmNativeImage {
   # Copied from pom.xml
   extraNativeImageBuildArgs = [
     "--no-fallback"
-    "-H:ReflectionConfigurationResources=graalvm_config.json"
     "-H:EnableURLProtocols=https"
     "-H:EnableURLProtocols=http"
   ];
 
   meta = {
-    changelog = "https://github.com/Hakky54/certificate-ripper/releases/tag/${version}";
+    changelog = "https://github.com/Hakky54/certificate-ripper/releases/tag/${jar.src.tag}";
     description = "CLI tool to extract server certificates";
     homepage = "https://github.com/Hakky54/certificate-ripper";
     license = lib.licenses.asl20;

pkgs/by-name/cg/cglm/package.nix

@@ -7,13 +7,13 @@
 
 stdenv.mkDerivation rec {
   pname = "cglm";
-  version = "0.9.4";
+  version = "0.9.5";
 
   src = fetchFromGitHub {
     owner = "recp";
     repo = "cglm";
     rev = "v${version}";
-    sha256 = "sha256-VQgnc3DSZoY1ounc9fj3Mju52noI0JZ7ck8FqWpEgY8=";
+    sha256 = "sha256-yc8UFKl0q+QZ9helTzrxfZdk7yeRSb3bUVyIL+uRWdQ=";
   };
 
   nativeBuildInputs = [ cmake ];

pkgs/by-name/ch/charmcraft/package.nix

@@ -8,7 +8,7 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "charmcraft";
-  version = "3.4.2";
+  version = "3.4.3";
 
   pyproject = true;
 
@@ -16,7 +16,7 @@ python3Packages.buildPythonApplication rec {
     owner = "canonical";
     repo = "charmcraft";
     tag = version;
-    hash = "sha256-6ucF0iQxQrFFz7jlaktYsB538W8jbX+Sw5hP0/VoYsk=";
+    hash = "sha256-TCr6iZHUIJ/dZhj8pWsCYKAfqv9LXD3fGP432UQh/Lo=";
   };
 
   postPatch = ''

pkgs/by-name/ch/checkov/package.nix

@@ -4,20 +4,37 @@
   python3,
 }:
 
+let
+  py = python3.override {
+    packageOverrides = self: super: {
+
+      # Requires 'cyclonedx-python-lib = ">=6.0.0,<8.0.0"'
+      cyclonedx-python-lib = super.cyclonedx-python-lib.overridePythonAttrs (oldAttrs: rec {
+        version = "7.6.2";
+        src = fetchFromGitHub {
+          owner = "CycloneDX";
+          repo = "cyclonedx-python-lib";
+          tag = "v${version}";
+          hash = "sha256-nklizCiu7Nmynjd5WU5oX/v2TWy9xFVF4GkmCwFKZLI=";
+        };
+      });
+    };
+  };
+in
+with py.pkgs;
+
 python3.pkgs.buildPythonApplication rec {
   pname = "checkov";
-  version = "3.2.364";
+  version = "3.2.370";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "bridgecrewio";
     repo = "checkov";
     tag = version;
-    hash = "sha256-ZmvIICAnC9RDizKl06aOD1LNEAo8WG7E1ZZB3Rero+c=";
+    hash = "sha256-IaE2Mg8Fk1Xb3ujPRHTY1N4ev75qM8Kj5o7IPtKuNsk=";
   };
 
-  patches = [ ./flake8-compat-5.x.patch ];
-
   pythonRelaxDeps = [
     "bc-detect-secrets"
     "bc-python-hcl2"
@@ -45,9 +62,9 @@ python3.pkgs.buildPythonApplication rec {
     "pycep-parser"
   ];
 
-  build-system = with python3.pkgs; [ setuptools-scm ];
+  build-system = with py.pkgs; [ setuptools-scm ];
 
-  dependencies = with python3.pkgs; [
+  dependencies = with py.pkgs; [
     aiodns
     aiohttp
     aiomultiprocess
@@ -90,7 +107,7 @@ python3.pkgs.buildPythonApplication rec {
     update-checker
   ];
 
-  nativeCheckInputs = with python3.pkgs; [
+  nativeCheckInputs = with py.pkgs; [
     aioresponses
     distutils
     mock

pkgs/by-name/ch/chroma/package.nix

@@ -10,7 +10,7 @@ in
 
 buildGoModule rec {
   pname = "chroma";
-  version = "2.8.0";
+  version = "2.15.0";
 
   # To update:
   # nix-prefetch-git --rev v${version} https://github.com/alecthomas/chroma.git > src.json
@@ -21,7 +21,7 @@ buildGoModule rec {
     inherit (srcInfo) sha256;
   };
 
-  vendorHash = "sha256-Bol5yMvNYuoVnSjEgf3h6X4CeUooy2Hpdy3SCaNXXOE=";
+  vendorHash = "sha256:14jg809xz647yv6sc8rnnksg2bpnn75panj8a2kdk2v87yrpq2zr";
 
   modRoot = "./cmd/chroma";
 

pkgs/by-name/ch/chroma/src.json

@@ -1,9 +1,10 @@
 {
   "url": "https://github.com/alecthomas/chroma.git",
-  "rev": "e8acfc274c22a76fd38030d2977a2246cd4322b3",
-  "date": "2023-06-30T08:43:39+10:00",
-  "path": "/nix/store/57y15g11dmdy2s6vxrjzl03s03j509gy-chroma",
-  "sha256": "0fdgpi5r0k42qzdn4lxh81ww1zcn9mwfildwrqf1s7crsqmr9dc5",
+  "rev": "009385f9487ee14c8a54e49aaf4331fea0830310",
+  "date": "2024-12-30T09:27:18+11:00",
+  "path": "/nix/store/rr2cj4bmlfw803diwyfpbrpai35gifaw-chroma",
+  "sha256": "088w3aixwfk8s04iyb2mjn3kx5dl3gb9q14jzawabcdy2ar7iijn",
+  "hash": "sha256-VsZ4shK+saW4+pIEnNYbtJU+h5VVLB8J0Gg63qMaHCE=",
   "fetchLFS": false,
   "fetchSubmodules": false,
   "deepClone": false,

pkgs/by-name/cl/cloudflare-warp/package.nix

@@ -4,6 +4,7 @@
   autoPatchelfHook,
   versionCheckHook,
   copyDesktopItems,
+  desktop-file-utils,
   dbus,
   dpkg,
   fetchurl,
@@ -43,6 +44,7 @@ stdenv.mkDerivation rec {
     versionCheckHook
     makeWrapper
     copyDesktopItems
+    desktop-file-utils
   ];
 
   buildInputs = [

pkgs/by-name/cn/cntb/package.nix

@@ -5,13 +5,13 @@
 }:
 buildGoModule rec {
   pname = "cntb";
-  version = "1.4.12";
+  version = "1.5.2";
 
   src = fetchFromGitHub {
     owner = "contabo";
     repo = "cntb";
     rev = "v${version}";
-    hash = "sha256-5JOO9tWMjy81wSB9Vq/gBYZ0xfrhES0dm/cTqXP8HiI";
+    hash = "sha256-ym4SYeAkxKBq/0VgyXx1uoHiM29LEXMqHl3XICdM30Y=";
     # docs contains two files with the same name but different cases,
     # this leads to a different hash on case insensitive filesystems (e.g. darwin)
     # https://github.com/contabo/cntb/issues/34
@@ -22,7 +22,7 @@ buildGoModule rec {
 
   subPackages = [ "." ];
 
-  vendorHash = "sha256-IBDVHQe6OOGQ27G7uXKRtavy4tnCvIbL07j969/E9Vg=";
+  vendorHash = "sha256-6J93Nt9MhnTjsah8sDff0SvImzOEsSdnDHBhUADmO1k=";
 
   ldflags = [
     "-X contabo.com/cli/cntb/cmd.version=${src.rev}"

pkgs/by-name/co/consul/package.nix

@@ -8,7 +8,7 @@
 
 buildGoModule rec {
   pname = "consul";
-  version = "1.20.2";
+  version = "1.20.3";
 
   # Note: Currently only release tags are supported, because they have the Consul UI
   # vendored. See
@@ -22,7 +22,7 @@ buildGoModule rec {
     owner = "hashicorp";
     repo = pname;
     tag = "v${version}";
-    hash = "sha256-pUKX94OgJ2PTchBokAI5QzLxvdzQjcePrKHEiB782hc=";
+    hash = "sha256-Bgzanv7z2mVtzp6UC5mxzkYaE82ULioVmaXN2DqJ4LI=";
   };
 
   # This corresponds to paths with package main - normally unneeded but consul
@@ -32,7 +32,7 @@ buildGoModule rec {
     "connect/certgen"
   ];
 
-  vendorHash = "sha256-pH9KVyHgSULZ+fuUSDIXOzLhrdhsbJEom67k6jaW31E=";
+  vendorHash = "sha256-Sa6OcRMgx1WUXVNbgSAR+2KWYlc6b/50ZqPS8/ycBkI=";
 
   doCheck = false;
 

pkgs/by-name/cy/cyclonedx-python/package.nix

@@ -6,14 +6,14 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "cyclonedx-python";
-  version = "4.6.0";
+  version = "5.1.2";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "CycloneDX";
     repo = "cyclonedx-python";
     tag = "v${version}";
-    hash = "sha256-EcCxw3SppuGUgN7AIU9NhpRw7dLDhTHHT5emGOgkDFU=";
+    hash = "sha256-jh/7sMVBQWptC6Zi+yEwraR7leoyqYg4is83qao7gaY=";
   };
 
   build-system = with python3Packages; [ poetry-core ];

pkgs/by-name/da/dafny/deps.json

@@ -244,6 +244,16 @@
     "version": "1.1.0",
     "hash": "sha256-0AqQ2gMS8iNlYkrD+BxtIg7cXMnr9xZHtKAuN4bjfaQ="
   },
+  {
+    "pname": "Microsoft.NETFramework.ReferenceAssemblies",
+    "version": "1.0.3",
+    "hash": "sha256-FBoJP5DHZF0QHM0xLm9yd4HJZVQOuSpSKA+VQRpphEE="
+  },
+  {
+    "pname": "Microsoft.NETFramework.ReferenceAssemblies.net452",
+    "version": "1.0.3",
+    "hash": "sha256-RTPuFG8D7gnwINEoEtAqmVm4oTW8K4Z87v1o4DDeLMI="
+  },
   {
     "pname": "Microsoft.TestPlatform.Extensions.TrxLogger",
     "version": "17.9.0",
@@ -294,6 +304,11 @@
     "version": "2.6.81",
     "hash": "sha256-0Zshmi1IMWj9/MKUieffpgJxKhJyVgBXPKMg9RSDkRs="
   },
+  {
+    "pname": "NETStandard.Library",
+    "version": "2.0.3",
+    "hash": "sha256-Prh2RPebz/s8AzHb2sPHg3Jl8s31inv9k+Qxd293ybo="
+  },
   {
     "pname": "Newtonsoft.Json",
     "version": "11.0.2",
@@ -529,6 +544,11 @@
     "version": "4.3.0",
     "hash": "sha256-XqZWb4Kd04960h4U9seivjKseGA/YEIpdplfHYHQ9jk="
   },
+  {
+    "pname": "System.Buffers",
+    "version": "4.4.0",
+    "hash": "sha256-KTxAhYawFG2V5VX1jw3pzx3IrQXRgn1TsvgjPgxAbqA="
+  },
   {
     "pname": "System.Collections",
     "version": "4.3.0",
@@ -624,11 +644,21 @@
     "version": "4.1.0",
     "hash": "sha256-7zqB+FXgkvhtlBzpcZyd81xczWP0D3uWssyAGw3t7b4="
   },
+  {
+    "pname": "System.Memory",
+    "version": "4.5.3",
+    "hash": "sha256-Cvl7RbRbRu9qKzeRBWjavUkseT2jhZBUWV1SPipUWFk="
+  },
   {
     "pname": "System.Net.WebSockets",
     "version": "4.3.0",
     "hash": "sha256-l3h3cF1cCC9zMhWLKSDnZBZvFADUd0Afe2+iAwBA0r0="
   },
+  {
+    "pname": "System.Numerics.Vectors",
+    "version": "4.4.0",
+    "hash": "sha256-auXQK2flL/JpnB/rEcAcUm4vYMCYMEMiWOCAlIaqu2U="
+  },
   {
     "pname": "System.ObjectModel",
     "version": "4.0.12",
@@ -724,6 +754,11 @@
     "version": "4.4.0",
     "hash": "sha256-SeTI4+yVRO2SmAKgOrMni4070OD+Oo8L1YiEVeKDyig="
   },
+  {
+    "pname": "System.Runtime.CompilerServices.Unsafe",
+    "version": "4.5.2",
+    "hash": "sha256-8eUXXGWO2LL7uATMZye2iCpQOETn2jCcjUhG6coR5O8="
+  },
   {
     "pname": "System.Runtime.CompilerServices.Unsafe",
     "version": "4.7.1",
@@ -841,7 +876,7 @@
   },
   {
     "pname": "Tomlyn",
-    "version": "0.16.2",
-    "hash": "sha256-ULW4n8s2lvTMG3I18rpsVfXtKXN7C8nPrMXQowxGIsU="
+    "version": "0.17.0",
+    "hash": "sha256-pJHF7w8RJhV23wiI3qzm5el4qPlPlgYTmTKA8yGhzXY="
   }
 ]

pkgs/by-name/da/dafny/package.nix

@@ -38,18 +38,18 @@ let
 in
 buildDotnetModule rec {
   pname = "Dafny";
-  version = "4.9.1";
+  version = "4.10.0";
 
   src = fetchFromGitHub {
     owner = "dafny-lang";
     repo = "dafny";
     tag = "v${version}";
-    hash = "sha256-fCBaOF1mDrqJaUiATZAhzLjlK3NGVFnxdOwgHbOkkgY=";
+    hash = "sha256-aPOjt4bwalhJUTJm4+pGqN88LwDP5zrVtakF26b3K4s=";
   };
 
   postPatch =
     let
-      runtimeJarVersion = "4.9.1";
+      runtimeJarVersion = "4.10.0";
     in
     ''
       cp ${writeScript "fake-gradlew-for-dafny" ''
@@ -66,13 +66,6 @@ buildDotnetModule rec {
       substituteInPlace Source/DafnyRuntime/DafnyRuntime.csproj \
         --replace-fail TargetFrameworks TargetFramework \
         --replace-fail "netstandard2.0;net452" net8.0
-
-      for f in Source/**/*.csproj ; do
-        [[ "$f" == "Source/DafnyRuntime/DafnyRuntime.csproj" ]] && continue;
-
-        substituteInPlace $f \
-          --replace-fail net6.0 net8.0
-      done
     '';
 
   dotnet-sdk = dotnetCorePackages.sdk_8_0;

pkgs/by-name/da/dayon/package.nix

@@ -11,13 +11,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "dayon";
-  version = "15.0.2";
+  version = "16.0.0";
 
   src = fetchFromGitHub {
     owner = "RetGal";
     repo = "dayon";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-5gpST5c3UGutrGuysBEHWqbj9O5+XagA6fTZ7D/R7Oo=";
+    hash = "sha256-glE8Y8w70nIoOhGqYb90+HuiFeKkORjGLyixsPvjmOI=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/db/dbeaver-bin/package.nix

@@ -60,6 +60,14 @@ stdenvNoCC.mkDerivation (finalAttrs: {
       --replace-fail '-Xmx1024m' '-Xmx${override_xmx}'
   '';
 
+  preInstall = ''
+    # most directories are for different architectures, only keep what we need
+    shopt -s extglob
+    pushd ${lib.optionalString stdenvNoCC.hostPlatform.isDarwin "Contents/Eclipse/"}plugins/com.sun.jna_5.15.0.v20240915-2000/com/sun/jna/
+    rm -r !(ptr|internal|linux-x86-64|linux-aarch64|darwin-x86-64|darwin-aarch64)/
+    popd
+  '';
+
   installPhase =
     if !stdenvNoCC.hostPlatform.isDarwin then
       ''
@@ -81,7 +89,10 @@ stdenvNoCC.mkDerivation (finalAttrs: {
           }"
 
         mkdir -p $out/share/icons/hicolor/256x256/apps
-        ln -s $out/opt/dbeaver/dbeaver.png $out/share/icons/hicolor/256x256/apps/dbeaver.png
+        # for some reason it's missing from the aarch64 build
+        if [ -e $out/opt/dbeaver/dbeaver.png ]; then
+          ln -s $out/opt/dbeaver/dbeaver.png $out/share/icons/hicolor/256x256/apps/dbeaver.png
+        fi
 
         mkdir -p $out/share/applications
         ln -s $out/opt/dbeaver/dbeaver-ce.desktop $out/share/applications/dbeaver.desktop
@@ -107,10 +118,6 @@ stdenvNoCC.mkDerivation (finalAttrs: {
         runHook postInstall
       '';
 
-  autoPatchelfIgnoreMissingDeps = [
-    "libc.so.8"
-  ];
-
   passthru.updateScript = ./update.sh;
 
   meta = {

pkgs/by-name/de/deno/package.nix

@@ -18,17 +18,17 @@ let
 in
 rustPlatform.buildRustPackage rec {
   pname = "deno";
-  version = "2.1.9";
+  version = "2.1.10";
 
   src = fetchFromGitHub {
     owner = "denoland";
     repo = "deno";
     tag = "v${version}";
-    hash = "sha256-a3oMEZIs9RkD0T4saeaCuQh0VrdNXciKwPJaHO7/Y3I=";
+    hash = "sha256-1NqBNrTYHhsG6O2qsgANM15FOxx3xheE9T3nYDDH1D0=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-UqjkO3k77nUGnV8V4TDC3BbA+jR6/h2wGkgSLus0yVA=";
+  cargoHash = "sha256-D7dt9RdlTmR2C1dwOl5vZKUlLUnTkdudtZ4FQpr9ddU=";
 
   postPatch = ''
     # upstream uses lld on aarch64-darwin for faster builds

pkgs/by-name/de/descent3-unwrapped/package.nix

@@ -17,11 +17,11 @@ stdenv.mkDerivation rec {
   # the wrapped version of Descent 3. Once there’s a stable version of Descent
   # 3 that supports the -additionaldir command-line option, we can stop using
   # an unstable version of Descent 3.
-  version = "1.5.0-beta-unstable-2025-01-01";
+  version = "1.5.0-beta-unstable-2025-02-13";
   src = fetchFromGitHub {
     owner = "DescentDevelopers";
     repo = "Descent3";
-    rev = "11f93221e71201d51a71650a3b190017328cd721";
+    rev = "10a20d7cb769a08010e7887b4701a0ecfb142492";
     fetchSubmodules = true;
     leaveDotGit = true;
     # Descent 3 is supposed to display its Git commit hash in the bottom right
@@ -48,7 +48,7 @@ stdenv.mkDerivation rec {
       git rev-parse --verify HEAD | tr --delete '\n' > git-hash.txt
       rm -r .git
     '';
-    hash = "sha256-L+Y8Eum9SjGpbbLnBH25uUI4UgCGDwrgE5op19GOAtQ=";
+    hash = "sha256-Ufu6oHLUn0eI6OTp8cfHRLYpx+tZ3QwX4qz3KpTbQ68=";
   };
 
   hardeningDisable = [ "format" ];

pkgs/by-name/di/dioxus-cli/fix-wasm-opt-target-dir.patch

@@ -0,0 +1,11 @@
+--- a/src/build/bundle.rs
++++ b/src/build/bundle.rs
+@@ -334,7 +334,7 @@ impl AppBundle {
+                 // Only run wasm-opt if the feature is enabled
+                 // Wasm-opt has an expensive build script that makes it annoying to keep enabled for iterative dev
+                 // We put it behind the "wasm-opt" feature flag so that it can be disabled when iterating on the cli
+-                self.run_wasm_opt(&self.build.exe_dir())?;
++                self.run_wasm_opt(&self.build.wasm_bindgen_out_dir())?;
+ 
+                 // Write the index.html file with the pre-configured contents we got from pre-rendering
+                 std::fs::write(

pkgs/by-name/di/dioxus-cli/package.nix

@@ -14,16 +14,24 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "dioxus-cli";
-  version = "0.6.0";
+  version = "0.6.2";
 
   src = fetchCrate {
     inherit pname version;
-    hash = "sha256-0Kg2/+S8EuMYZQaK4Ao+mbS7K48VhVWjPL+LnoVJMSw=";
+    hash = "sha256-jUS/it2N5o5D7Jon0fKHWEt3f0wdtVgNIkqSNc7u830=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-uD3AHHY3edpqyQ8gnsTtxQsen8UzyVIbArSvpMa+B+8=";
-  buildFeatures = [ "optimizations" ];
+  cargoHash = "sha256-izvo092FGZmci1cXLo+qhGlBh8W3A1TeBHrYXcjE6HU=";
+  cargoPatches = [
+    # TODO: Remove once https://github.com/DioxusLabs/dioxus/issues/3659 is fixed upstream.
+    ./fix-wasm-opt-target-dir.patch
+  ];
+
+  buildFeatures = [
+    "no-downloads"
+    "optimizations"
+  ];
 
   nativeBuildInputs = [
     pkg-config
@@ -34,11 +42,18 @@ rustPlatform.buildRustPackage rec {
 
   OPENSSL_NO_VENDOR = 1;
 
+  # wasm-opt-sys build.rs tries to verify C++17 support, but the check appears to be faulty.
+  postPatch = ''
+    substituteInPlace $cargoDepsCopy/wasm-opt-sys-*/build.rs \
+      --replace-fail 'check_cxx17_support()?;' '// check_cxx17_support()?;'
+  '';
+
   nativeCheckInputs = [ rustfmt ];
 
   checkFlags = [
     # requires network access
     "--skip=serve::proxy::test"
+    "--skip=wasm_bindgen::test"
   ];
 
   passthru = {

pkgs/by-name/do/domino-chain/algorithm-header.patch

@@ -0,0 +1,13 @@
+diff --git a/src/domino-chain/tools.cpp b/src/domino-chain/tools.cpp
+index 0eaa592..e91c760 100644
+--- a/src/domino-chain/tools.cpp
++++ b/src/domino-chain/tools.cpp
+@@ -48,6 +48,8 @@
+ 
+ #include <boost/filesystem.hpp>
+ 
++#include <algorithm>
++
+ uint64_t getTime(void)
+ {
+ #if defined(WIN32) || defined(_WIN32)

pkgs/by-name/do/domino-chain/package.nix

@@ -0,0 +1,84 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitLab,
+  boost,
+  freefont_ttf,
+  fribidi,
+  gettext,
+  imagemagick,
+  libpng,
+  lua,
+  pkg-config,
+  povray,
+  SDL2,
+  SDL2_image,
+  SDL2_mixer,
+  SDL2_ttf,
+  zlib,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "domino-chain";
+  version = "1.1";
+
+  src = fetchFromGitLab {
+    owner = "domino-chain";
+    repo = "domino-chain.gitlab.io";
+    tag = finalAttrs.version;
+    hash = "sha256-ERR5QwQpTFLeAijlGtGU0Lpd40II/L5i3muYDN2EfX4=";
+  };
+
+  patches = [
+    ./algorithm-header.patch
+  ];
+
+  postPatch = ''
+    substituteInPlace Makefile \
+      --replace-warn /usr/share/fonts/truetype/freefont/ ${freefont_ttf}/share/fonts/truetype/
+    substituteInPlace src/domino-chain/screen.cpp \
+      --replace-fail /usr/share/fonts/truetype/freefont/ ${freefont_ttf}/share/fonts/truetype/
+  '';
+
+  nativeBuildInputs = [
+    gettext
+    imagemagick
+    pkg-config
+    povray
+  ];
+
+  buildInputs = [
+    boost
+    freefont_ttf
+    fribidi
+    libpng
+    lua
+    SDL2
+    SDL2_image
+    SDL2_mixer
+    SDL2_ttf
+    zlib
+  ];
+
+  enableParallelBuilding = true;
+
+  __structuredAttrs = true;
+  makeFlags = [
+    "PREFIX=$(out)"
+    "POVRAY=povray Work_Threads=$(NIX_BUILD_CORES)"
+  ];
+
+  env.NIX_CFLAGS_COMPILE = toString [
+    "-I${lib.getDev SDL2}/include/SDL2"
+    "-I${lib.getDev SDL2_mixer}/include/SDL2"
+  ];
+
+  meta = {
+    description = "Rearrange dominoes on different platforms to start a chain reaction";
+    homepage = "https://domino-chain.gitlab.io/";
+    license = lib.licenses.gpl3Plus;
+    maintainers = with lib.maintainers; [ fgaz ];
+    mainProgram = "domino-chain";
+    platforms = lib.platforms.all;
+  };
+})