Merge staging-next into staging

maintainers/maintainer-list.nix

@@ -6560,6 +6560,11 @@
     githubId = 726447;
     name = "Francisco Demartino";
   };
+  frankp = {
+    github = "MDM23";
+    githubId = 10290864;
+    name = "Peter Frank";
+  };
   franzmondlichtmann = {
     name = "Franz Schroepf";
     email = "franz-schroepf@t-online.de";
@@ -21067,6 +21072,12 @@
     githubId = 973709;
     name = "Jairo Llopis";
   };
+  yamashitax = {
+    email = "hello@yamashit.ax";
+    github = "yamashitax";
+    githubId = 99486674;
+    name = "山下";
+  };
   yana = {
     email = "yana@riseup.net";
     github = "yanateras";

nixos/modules/module-list.nix

@@ -719,6 +719,7 @@
   ./services/misc/libreddit.nix
   ./services/misc/lidarr.nix
   ./services/misc/lifecycled.nix
+  ./services/misc/llama-cpp.nix
   ./services/misc/logkeys.nix
   ./services/misc/mame.nix
   ./services/misc/mbpfan.nix

nixos/modules/services/misc/paperless.nix

@@ -342,6 +342,7 @@ in
         User = cfg.user;
         Restart = "on-failure";
 
+        LimitNOFILE = 65536;
         # gunicorn needs setuid, liblapack needs mbind
         SystemCallFilter = defaultServiceConfig.SystemCallFilter ++ [ "@setuid mbind" ];
         # Needs to serve web page

nixos/modules/services/web-apps/nextcloud.nix

@@ -45,7 +45,7 @@ let
     };
   };
 
-  webroot = pkgs.runCommand
+  webroot = pkgs.runCommandLocal
     "${cfg.package.name or "nextcloud"}-with-apps"
     { }
     ''

nixos/modules/services/web-apps/photoprism.nix

@@ -104,6 +104,7 @@ in
         StateDirectory = "photoprism";
         WorkingDirectory = "/var/lib/photoprism";
         RuntimeDirectory = "photoprism";
+        ReadWritePaths = [ cfg.originalsPath cfg.importPath cfg.storagePath ];
 
         LoadCredential = lib.optionalString (cfg.passwordFile != null)
           "PHOTOPRISM_ADMIN_PASSWORD:${cfg.passwordFile}";

nixos/modules/system/boot/loader/systemd-boot/systemd-boot-builder.py

@@ -43,6 +43,7 @@ class BootSpec:
     system: str
     toplevel: str
     specialisations: Dict[str, "BootSpec"]
+    sortKey: str
     initrdSecrets: str | None = None
 
 
@@ -73,6 +74,7 @@ def system_dir(profile: str | None, generation: int, specialisation: str | None)
         return d
 
 BOOT_ENTRY = """title {title}
+sort-key {sort_key}
 version Generation {generation} {description}
 linux {kernel}
 initrd {initrd}
@@ -123,7 +125,13 @@ def get_bootspec(profile: str | None, generation: int) -> BootSpec:
 def bootspec_from_json(bootspec_json: Dict) -> BootSpec:
     specialisations = bootspec_json['org.nixos.specialisation.v1']
     specialisations = {k: bootspec_from_json(v) for k, v in specialisations.items()}
-    return BootSpec(**bootspec_json['org.nixos.bootspec.v1'], specialisations=specialisations)
+    systemdBootExtension = bootspec_json.get('org.nixos.systemd-boot', {})
+    sortKey = systemdBootExtension.get('sortKey', 'nixos')
+    return BootSpec(
+        **bootspec_json['org.nixos.bootspec.v1'],
+        specialisations=specialisations,
+        sortKey=sortKey
+    )
 
 
 def copy_from_file(file: str, dry_run: bool = False) -> str:
@@ -170,6 +178,7 @@ def write_entry(profile: str | None, generation: int, specialisation: str | None
 
     with open(tmp_path, 'w') as f:
         f.write(BOOT_ENTRY.format(title=title,
+                    sort_key=bootspec.sortKey,
                     generation=generation,
                     kernel=kernel,
                     initrd=initrd,

nixos/modules/system/boot/loader/systemd-boot/systemd-boot.nix

@@ -87,6 +87,16 @@ in {
 
   imports =
     [ (mkRenamedOptionModule [ "boot" "loader" "gummiboot" "enable" ] [ "boot" "loader" "systemd-boot" "enable" ])
+      (lib.mkChangedOptionModule
+        [ "boot" "loader" "systemd-boot" "memtest86" "entryFilename" ]
+        [ "boot" "loader" "systemd-boot" "memtest86" "sortKey" ]
+        (config: lib.strings.removeSuffix ".conf" config.boot.loader.systemd-boot.memtest86.entryFilename)
+      )
+      (lib.mkChangedOptionModule
+        [ "boot" "loader" "systemd-boot" "netbootxyz" "entryFilename" ]
+        [ "boot" "loader" "systemd-boot" "netbootxyz" "sortKey" ]
+        (config: lib.strings.removeSuffix ".conf" config.boot.loader.systemd-boot.netbootxyz.entryFilename)
+      )
     ];
 
   options.boot.loader.systemd-boot = {
@@ -102,6 +112,35 @@ in {
       '';
     };
 
+    sortKey = mkOption {
+      default = "nixos";
+      type = lib.types.str;
+      description = ''
+        The sort key used for the NixOS bootloader entries.
+        This key determines sorting relative to non-NixOS entries.
+        See also https://uapi-group.org/specifications/specs/boot_loader_specification/#sorting
+
+        This option can also be used to control the sorting of NixOS specialisations.
+
+        By default, specialisations inherit the sort key of their parent generation
+        and will have the same value for both the sort-key and the version (i.e. the generation number),
+        systemd-boot will therefore sort them based on their file name, meaning that
+        in your boot menu you will have each main generation directly followed by
+        its specialisations sorted alphabetically by their names.
+
+        If you want a different ordering for a specialisation, you can override
+        its sort-key which will cause the specialisation to be uncoupled from its
+        parent generation. It will then be sorted by its new sort-key just like
+        any other boot entry.
+
+        The sort-key is stored in the generation's bootspec, which means that
+        generations keep their sort-keys even if the original definition of the
+        generation was removed from the NixOS configuration.
+        It also means that updating the sort-key will only affect new generations,
+        while old ones will keep the sort-key that they were originally built with.
+      '';
+    };
+
     editor = mkOption {
       default = true;
 
@@ -184,13 +223,15 @@ in {
         '';
       };
 
-      entryFilename = mkOption {
-        default = "memtest86.conf";
+      sortKey = mkOption {
+        default = "o_memtest86";
         type = types.str;
         description = lib.mdDoc ''
-          `systemd-boot` orders the menu entries by the config file names,
+          `systemd-boot` orders the menu entries by their sort keys,
           so if you want something to appear after all the NixOS entries,
           it should start with {file}`o` or onwards.
+
+          See also {option}`boot.loader.systemd-boot.sortKey`.
         '';
       };
     };
@@ -207,13 +248,15 @@ in {
         '';
       };
 
-      entryFilename = mkOption {
-        default = "o_netbootxyz.conf";
+      sortKey = mkOption {
+        default = "o_netbootxyz";
         type = types.str;
         description = lib.mdDoc ''
-          `systemd-boot` orders the menu entries by the config file names,
+          `systemd-boot` orders the menu entries by their sort keys,
           so if you want something to appear after all the NixOS entries,
           it should start with {file}`o` or onwards.
+
+          See also {option}`boot.loader.systemd-boot.sortKey`.
         '';
       };
     };
@@ -225,6 +268,7 @@ in {
         { "memtest86.conf" = '''
           title Memtest86+
           efi /efi/memtest86/memtest.efi
+          sort-key z_memtest
         '''; }
       '';
       description = lib.mdDoc ''
@@ -233,9 +277,10 @@ in {
         Each attribute name denotes the destination file name,
         and the corresponding attribute value is the contents of the entry.
 
-        `systemd-boot` orders the menu entries by the config file names,
-        so if you want something to appear after all the NixOS entries,
-        it should start with {file}`o` or onwards.
+        To control the ordering of the entry in the boot menu, use the sort-key
+        field, see
+        https://uapi-group.org/specifications/specs/boot_loader_specification/#sorting
+        and {option}`boot.loader.systemd-boot.sortKey`.
       '';
     };
 
@@ -328,19 +373,25 @@ in {
 
     boot.loader.systemd-boot.extraEntries = mkMerge [
       (mkIf cfg.memtest86.enable {
-        "${cfg.memtest86.entryFilename}" = ''
+        "memtest86.conf" = ''
           title  Memtest86+
           efi    /efi/memtest86/memtest.efi
+          sort-key ${cfg.memtest86.sortKey}
         '';
       })
       (mkIf cfg.netbootxyz.enable {
-        "${cfg.netbootxyz.entryFilename}" = ''
+        "netbootxyz.conf" = ''
           title  netboot.xyz
           efi    /efi/netbootxyz/netboot.xyz.efi
+          sort-key ${cfg.netbootxyz.sortKey}
         '';
       })
     ];
 
+    boot.bootspec.extensions."org.nixos.systemd-boot" = {
+      inherit (config.boot.loader.systemd-boot) sortKey;
+    };
+
     system = {
       build.installBootLoader = finalSystemdBootBuilder;
 

nixos/modules/virtualisation/qemu-vm.nix

@@ -877,11 +877,9 @@ in
         type = types.package;
         default = (pkgs.OVMF.override {
           secureBoot = cfg.useSecureBoot;
-          systemManagementModeRequired = cfg.useSecureBoot;
         }).fd;
         defaultText = ''(pkgs.OVMF.override {
           secureBoot = cfg.useSecureBoot;
-          systemManagementModeRequired = cfg.useSecureBoot;
         }).fd'';
         description =
         lib.mdDoc "OVMF firmware package, defaults to OVMF configured with secure boot if needed.";
@@ -1185,7 +1183,7 @@ in
         "-tpmdev emulator,id=tpm_dev_0,chardev=chrtpm"
         "-device ${cfg.tpm.deviceModel},tpmdev=tpm_dev_0"
       ])
-      (mkIf (cfg.efi.OVMF.systemManagementModeRequired or false) [
+      (mkIf (pkgs.stdenv.hostPlatform.isx86 && cfg.efi.OVMF.systemManagementModeRequired) [
         "-machine" "q35,smm=on"
         "-global" "driver=cfi.pflash01,property=secure,value=on"
       ])

nixos/tests/systemd-boot.nix

@@ -93,6 +93,7 @@ in
       machine.wait_for_unit("multi-user.target")
 
       machine.succeed("test -e /boot/loader/entries/nixos-generation-1.conf")
+      machine.succeed("grep 'sort-key nixos' /boot/loader/entries/nixos-generation-1.conf")
 
       # Ensure we actually booted using systemd-boot
       # Magic number is the vendor UUID used by systemd-boot.
@@ -115,15 +116,17 @@ in
       virtualisation.useSecureBoot = true;
     };
 
-    testScript = ''
+    testScript = let
+      efiArch = pkgs.stdenv.hostPlatform.efiArch;
+    in { nodes, ... }: ''
       machine.start(allow_reboot=True)
       machine.wait_for_unit("multi-user.target")
 
       machine.succeed("sbctl create-keys")
       machine.succeed("sbctl enroll-keys --yes-this-might-brick-my-machine")
-      machine.succeed('sbctl sign /boot/EFI/systemd/systemd-bootx64.efi')
-      machine.succeed('sbctl sign /boot/EFI/BOOT/BOOTX64.EFI')
-      machine.succeed('sbctl sign /boot/EFI/nixos/*bzImage.efi')
+      machine.succeed('sbctl sign /boot/EFI/systemd/systemd-boot${efiArch}.efi')
+      machine.succeed('sbctl sign /boot/EFI/BOOT/BOOT${toUpper efiArch}.EFI')
+      machine.succeed('sbctl sign /boot/EFI/nixos/*${nodes.machine.system.boot.loader.kernelFile}.efi')
 
       machine.reboot()
 
@@ -164,7 +167,9 @@ in
 
     nodes.machine = { pkgs, lib, ... }: {
       imports = [ common ];
-      specialisation.something.configuration = {};
+      specialisation.something.configuration = {
+        boot.loader.systemd-boot.sortKey = "something";
+      };
     };
 
     testScript = ''
@@ -177,6 +182,9 @@ in
       machine.succeed(
           "grep -q 'title NixOS (something)' /boot/loader/entries/nixos-generation-1-specialisation-something.conf"
       )
+      machine.succeed(
+          "grep 'sort-key something' /boot/loader/entries/nixos-generation-1-specialisation-something.conf"
+      )
     '';
   };
 
@@ -254,25 +262,25 @@ in
     };
 
     testScript = ''
-      machine.succeed("test -e /boot/loader/entries/o_netbootxyz.conf")
+      machine.succeed("test -e /boot/loader/entries/netbootxyz.conf")
       machine.succeed("test -e /boot/efi/netbootxyz/netboot.xyz.efi")
     '';
   };
 
-  entryFilename = makeTest {
-    name = "systemd-boot-entry-filename";
+  memtestSortKey = makeTest {
+    name = "systemd-boot-memtest-sortkey";
     meta.maintainers = with pkgs.lib.maintainers; [ Enzime julienmalka ];
 
     nodes.machine = { pkgs, lib, ... }: {
       imports = [ common ];
       boot.loader.systemd-boot.memtest86.enable = true;
-      boot.loader.systemd-boot.memtest86.entryFilename = "apple.conf";
+      boot.loader.systemd-boot.memtest86.sortKey = "apple";
     };
 
     testScript = ''
-      machine.fail("test -e /boot/loader/entries/memtest86.conf")
-      machine.succeed("test -e /boot/loader/entries/apple.conf")
+      machine.succeed("test -e /boot/loader/entries/memtest86.conf")
       machine.succeed("test -e /boot/efi/memtest86/memtest.efi")
+      machine.succeed("grep 'sort-key apple' /boot/loader/entries/memtest86.conf")
     '';
   };
 
@@ -283,7 +291,6 @@ in
     nodes.machine = { pkgs, lib, ... }: {
       imports = [ commonXbootldr ];
       boot.loader.systemd-boot.memtest86.enable = true;
-      boot.loader.systemd-boot.memtest86.entryFilename = "apple.conf";
     };
 
     testScript = { nodes, ... }: ''
@@ -293,8 +300,7 @@ in
       machine.wait_for_unit("multi-user.target")
 
       machine.succeed("test -e /efi/EFI/systemd/systemd-bootx64.efi")
-      machine.fail("test -e /boot/loader/entries/memtest86.conf")
-      machine.succeed("test -e /boot/loader/entries/apple.conf")
+      machine.succeed("test -e /boot/loader/entries/memtest86.conf")
       machine.succeed("test -e /boot/EFI/memtest86/memtest.efi")
     '';
   };
@@ -386,9 +392,9 @@ in
           machine.succeed("${finalSystem}/bin/switch-to-configuration boot")
           machine.fail("test -e /boot/efi/fruits/tomato.efi")
           machine.fail("test -e /boot/efi/nixos/.extra-files/efi/fruits/tomato.efi")
-          machine.succeed("test -e /boot/loader/entries/o_netbootxyz.conf")
+          machine.succeed("test -e /boot/loader/entries/netbootxyz.conf")
           machine.succeed("test -e /boot/efi/netbootxyz/netboot.xyz.efi")
-          machine.succeed("test -e /boot/efi/nixos/.extra-files/loader/entries/o_netbootxyz.conf")
+          machine.succeed("test -e /boot/efi/nixos/.extra-files/loader/entries/netbootxyz.conf")
           machine.succeed("test -e /boot/efi/nixos/.extra-files/efi/netbootxyz/netboot.xyz.efi")
     '';
   };

pkgs/applications/emulators/citra/generic.nix

@@ -34,7 +34,7 @@
 , enableQtTranslation ? enableQt, qttools
 , enableWebService ? true
 , enableCubeb ? true, cubeb
-, useDiscordRichPresence ? true, rapidjson
+, useDiscordRichPresence ? false, rapidjson
 }:
 stdenv.mkDerivation {
   inherit pname version src;
@@ -72,23 +72,25 @@ stdenv.mkDerivation {
     ++ lib.optional useDiscordRichPresence rapidjson;
 
   cmakeFlags = [
-    "-DUSE_SYSTEM_LIBS=ON"
+    (lib.cmakeBool "USE_SYSTEM_LIBS" true)
 
-    "-DDISABLE_SYSTEM_DYNARMIC=ON"
-    "-DDISABLE_SYSTEM_GLSLANG=ON" # The following imported targets are referenced, but are missing: SPIRV-Tools-opt
-    "-DDISABLE_SYSTEM_LODEPNG=ON" # Not packaged in nixpkgs
-    "-DDISABLE_SYSTEM_VMA=ON"
-    "-DDISABLE_SYSTEM_XBYAK=ON"
+    (lib.cmakeBool "DISABLE_SYSTEM_DYNARMIC" true)
+    (lib.cmakeBool "DISABLE_SYSTEM_GLSLANG" true) # The following imported targets are referenced, but are missing: SPIRV-Tools-opt
+    (lib.cmakeBool "DISABLE_SYSTEM_LODEPNG" true) # Not packaged in nixpkgs
+    (lib.cmakeBool "DISABLE_SYSTEM_VMA" true)
+    (lib.cmakeBool "DISABLE_SYSTEM_XBYAK" true)
 
     # We don't want to bother upstream with potentially outdated compat reports
-    "-DCITRA_ENABLE_COMPATIBILITY_REPORTING=ON"
-    "-DENABLE_COMPATIBILITY_LIST_DOWNLOAD=OFF" # We provide this deterministically
-  ] ++ lib.optional (!enableSdl2Frontend) "-DENABLE_SDL2_FRONTEND=OFF"
-    ++ lib.optional (!enableQt) "-DENABLE_QT=OFF"
-    ++ lib.optional enableQtTranslation "-DENABLE_QT_TRANSLATION=ON"
-    ++ lib.optional (!enableWebService) "-DENABLE_WEB_SERVICE=OFF"
-    ++ lib.optional (!enableCubeb) "-DENABLE_CUBEB=OFF"
-    ++ lib.optional useDiscordRichPresence "-DUSE_DISCORD_PRESENCE=ON";
+    (lib.cmakeBool "CITRA_ENABLE_COMPATIBILITY_REPORTING" true)
+    (lib.cmakeBool "ENABLE_COMPATIBILITY_LIST_DOWNLOAD" false) # We provide this deterministically
+
+    (lib.cmakeBool "ENABLE_SDL2_FRONTEND" enableSdl2Frontend)
+    (lib.cmakeBool "ENABLE_QT" enableQt)
+    (lib.cmakeBool "ENABLE_QT_TRANSLATION" enableQtTranslation)
+    (lib.cmakeBool "ENABLE_WEB_SERVICE" enableWebService)
+    (lib.cmakeBool "ENABLE_CUBEB" enableCubeb)
+    (lib.cmakeBool "USE_DISCORD_PRESENCE" useDiscordRichPresence)
+  ];
 
   # causes redefinition of _FORTIFY_SOURCE
   hardeningDisable = [ "fortify3" ];

pkgs/applications/misc/monitorcontrol/default.nix

@@ -14,14 +14,6 @@ stdenv.mkDerivation rec {
   };
 
   # MonitorControl.${version}.dmg is APFS formatted, unpack with 7zz
-  unpackCmd = ''
-    runHook preUnpack
-
-    7zz x $src
-
-    runHook postUnpack
-  '';
-
   nativeBuildInputs = [ _7zz ];
 
   sourceRoot = "MonitorControl.app";

pkgs/applications/misc/tableplus/default.nix

@@ -0,0 +1,37 @@
+{ lib
+, fetchurl
+, undmg
+, stdenv
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "tableplus";
+  version = "504";
+  src = fetchurl {
+    url = "https://download.tableplus.com/macos/${finalAttrs.version}/TablePlus.dmg";
+    hash = "sha256-YFUquv71QFEnlmh93+HsFN6XtgoUx6CMOVqfdWAIWfo=";
+  };
+
+  sourceRoot = "TablePlus.app";
+
+  nativeBuildInputs = [ undmg ];
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p "$out/Applications/TablePlus.app"
+    cp -R . "$out/Applications/TablePlus.app"
+    mkdir "$out/bin"
+    ln -s "$out/Applications/TablePlus.app/Contents/MacOS/TablePlus" "$out/bin/${finalAttrs.pname}"
+
+    runHook postInstall
+  '';
+
+  meta = with lib; {
+    description = "Database management made easy";
+    homepage = "https://tableplus.com";
+    license = licenses.unfree;
+    maintainers = with maintainers; [ yamashitax ];
+    platforms = platforms.darwin;
+  };
+})

pkgs/applications/networking/sync/storj-uplink/default.nix

@@ -5,18 +5,18 @@
 
 buildGoModule rec {
   pname = "storj-uplink";
-  version = "1.98.2";
+  version = "1.99.1";
 
   src = fetchFromGitHub {
     owner = "storj";
     repo = "storj";
     rev = "v${version}";
-    hash = "sha256-XnTrQIDUHdW9HwnYRigGFMGmcSCBhdoTXT4xlMCMeCw=";
+    hash = "sha256-UzuKy3pwl+chwYUWtcUEJIrU8wpSg3o2mVryc3qA9EM=";
   };
 
   subPackages = [ "cmd/uplink" ];
 
-  vendorHash = "sha256-n7exLjiDyvnoKAKnJXo1Ag+jh1Ccb2eA3Yv5fg7gkDk=";
+  vendorHash = "sha256-RaZ+yEkzsu/V3734joWtVA2m2vCOW+CnjF5s0mwDI/0=";
 
   ldflags = [ "-s" "-w" ];
 

pkgs/applications/virtualization/OVMF/default.nix

@@ -74,7 +74,6 @@ let
 in
 
 assert platformSpecific ? ${cpuName};
-assert systemManagementModeRequired -> stdenv.hostPlatform.isx86;
 assert msVarsTemplate -> fdSize4MB;
 assert msVarsTemplate -> platformSpecific.${cpuName} ? msVarsArgs;
 

pkgs/applications/window-managers/dk/default.nix

@@ -9,13 +9,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "dk";
-  version = "1.9";
+  version = "2.0";
 
   src = fetchFromBitbucket {
     owner = "natemaia";
     repo = "dk";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-OodD2z9C4oGTK6ynAXRlEZSzzdzIkVjmq5vLdUcht1U=";
+    hash = "sha256-AzvpvcH0S8WJNzYXMwvF6CIRDXnh/c6B8g2iWDQI6Qw=";
   };
 
   buildInputs = [

pkgs/by-name/c-/c-graph/package.nix

@@ -0,0 +1,26 @@
+{ lib, stdenv, fetchurl, gfortran, gnuplot, makeWrapper }:
+
+stdenv.mkDerivation rec {
+  pname = "c-graph";
+  version = "2.0.1";
+
+  src = fetchurl {
+    url = "mirror://gnu/c-graph/c-graph-${version}.tar.gz";
+    hash = "sha256-LSZ948nXXY3pXltR2hHnql6YEpHumjTvbtz4/qUIRCQ=";
+  };
+
+  nativeBuildInputs = [ gfortran makeWrapper ];
+
+  postInstall = ''
+    wrapProgram $out/bin/c-graph --prefix PATH : ${lib.makeBinPath [ gnuplot ]}
+  '';
+
+  meta = with lib; {
+    description = "A Tool for Learning about Convolution";
+    homepage = "https://www.gnu.org/software/c-graph/";
+    license = licenses.gpl3Plus;
+    maintainers = with maintainers; [ sikmir ];
+    platforms = platforms.unix;
+    mainProgram = "c-graph";
+  };
+}

pkgs/by-name/dy/dynamodb-local/package.nix

@@ -4,6 +4,13 @@
 , jdk_headless
 , jre_minimal
 , makeBinaryWrapper
+, curl
+, jq
+, yq
+, dynamodb-local
+, testers
+, common-updater-scripts
+, writeShellScript
 }:
 let
   jre = jre_minimal.override {
@@ -18,11 +25,11 @@ let
 in
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "dynamodb-local";
-  version = "2023-12-14";
+  version = "2.2.1";
 
   src = fetchurl {
-    url = "https://d1ni2b6xgvw0s0.cloudfront.net/v2.x/dynamodb_local_${finalAttrs.version}.tar.gz";
-    hash = "sha256-F9xTcLNAVFVbH7l0FlMuVNoLBrJS/UcHKXTkJh1n40w=";
+    url = "https://d1ni2b6xgvw0s0.cloudfront.net/v2.x/dynamodb_local_2024-01-04.tar.gz";
+    hash = "sha256-CbZ9Z9A70JoHu4G6It+7WycaEtzuwjVJ2YrOK+37zYA=";
   };
 
   sourceRoot = ".";
@@ -41,6 +48,29 @@ stdenvNoCC.mkDerivation (finalAttrs: {
     runHook postInstall
   '';
 
+  passthru = {
+    tests.version = testers.testVersion {
+      package = dynamodb-local;
+    };
+    updateScript = writeShellScript "update-dynamodb-local" ''
+      set -o errexit
+      export PATH="${lib.makeBinPath [ curl jq yq common-updater-scripts ]}:$PATH"
+
+      NEW_VERSION=$(curl -s https://repo1.maven.org/maven2/com/amazonaws/DynamoDBLocal/maven-metadata.xml | xq -r '.metadata.versioning.latest')
+      NEW_VERSION_DATE=$(curl -s https://repo1.maven.org/maven2/com/amazonaws/DynamoDBLocal/maven-metadata.xml | xq -r '.metadata.versioning.lastUpdated | "\(.[:4])-\(.[4:6])-\(.[6:8])"')
+
+      if [[ "${finalAttrs.version}" = "$NEW_VERSION" ]]; then
+          echo "The new version same as the old version."
+          exit 0
+      fi
+
+      DOWNLOAD_URL="https://d1ni2b6xgvw0s0.cloudfront.net/v2.x/dynamodb_local_$NEW_VERSION_DATE.tar.gz"
+      NIX_HASH=$(nix hash to-sri sha256:$(nix-prefetch-url $DOWNLOAD_URL))
+
+      update-source-version "dynamodb-local" "$NEW_VERSION" "$NIX_HASH" "$DOWNLOAD_URL"
+    '';
+  };
+
   meta = with lib; {
     description = "DynamoDB Local is a small client-side database and server that mimics the DynamoDB service.";
     homepage = "https://docs.aws.amazon.com/amazondynamodb/latest/developerguide/DynamoDBLocal.html";

pkgs/by-name/fl/flashprog/package.nix

@@ -11,13 +11,13 @@
 }:
 
 stdenv.mkDerivation rec {
-  pname = "flashrom-stable";
-  version = "1.1";
+  pname = "flashprog";
+  version = "1.0.1";
 
   src = fetchgit {
-    url = "https://review.coreboot.org/flashrom-stable";
-    rev = "272aae888ce5abf5e999d750ee4577407db32246";
-    hash = "sha256-DR4PAING69+TMsyycGxt1cu0ba1tTlG36+H/pJ0oP4E=";
+    url = "https://review.sourcearcade.org/flashprog";
+    rev = "2ca11f9a4101ea230081d448ab2b570425b7f0bd";
+    hash = "sha256-pm9g9iOJAKnzzY9couzt8RmqZFbIpKcO++zsUJ9o49U=";
   };
 
   nativeBuildInputs = [
@@ -34,15 +34,16 @@ stdenv.mkDerivation rec {
     pciutils
   ];
 
-  makeFlags = [ "PREFIX=$(out)" "libinstall" ] ++ lib.optionals stdenv.isDarwin [ "CONFIG_ENABLE_LIBPCI_PROGRAMMERS=no" ]
+  makeFlags = [ "PREFIX=$(out)" "libinstall" ]
+    ++ lib.optionals stdenv.isDarwin [ "CONFIG_ENABLE_LIBPCI_PROGRAMMERS=no" ]
     ++ lib.optionals (stdenv.isDarwin && stdenv.isx86_64) [ "CONFIG_INTERNAL_X86=no" "CONFIG_INTERNAL_DMI=no" "CONFIG_RAYER_SPI=0" ];
 
   meta = with lib; {
-    homepage = "https://www.flashrom.org";
+    homepage = "https://flashprog.org";
     description = "Utility for reading, writing, erasing and verifying flash ROM chips";
     license = with licenses; [ gpl2 gpl2Plus ];
     maintainers = with maintainers; [ felixsinger ];
     platforms = platforms.all;
-    mainProgram = "flashrom";
+    mainProgram = "flashprog";
   };
 }

pkgs/by-name/no/nosql-workbench/package.nix

@@ -39,20 +39,12 @@ if stdenv.isDarwin then stdenv.mkDerivation {
 
   sourceRoot = ".";
 
-  nativeBuildInputs = [ _7zz ];
-
-  buildInputs = [ jdk21 ];
-
   # DMG file is using APFS which is unsupported by "undmg".
   # Instead, use "7zz" to extract the contents.
   # "undmg" issue: https://github.com/matthewbauer/undmg/issues/4
-  unpackCmd = ''
-    runHook preUnpack
+  nativeBuildInputs = [ _7zz ];
 
-    7zz x $curSrc
-
-    runHook postUnpack
-  '';
+  buildInputs = [ jdk21 ];
 
   installPhase = ''
     runHook preInstall

pkgs/by-name/su/surrealist/package.nix

@@ -0,0 +1,186 @@
+{ buildGoModule
+, cacert
+, cairo
+, cargo
+, cargo-tauri
+, esbuild
+, fetchFromGitHub
+, gdk-pixbuf
+, gobject-introspection
+, jq
+, lib
+, libsoup
+, llvmPackages_15
+, makeBinaryWrapper
+, moreutils
+, nodePackages
+, pango
+, pkg-config
+, rustc
+, rustPlatform
+, stdenv
+, stdenvNoCC
+, wasm-bindgen-cli
+, webkitgtk
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "surrealist";
+  version = "1.11.5";
+
+  src = fetchFromGitHub {
+    owner = "StarlaneStudios";
+    repo = "Surrealist";
+    rev = "v${finalAttrs.version}";
+    hash = "sha256-9hm45bTvOhDHYYFUs7nTdOkHOsDJUiqDv8F6wQqEdFs=";
+  };
+
+  sourceRoot = "${finalAttrs.src.name}/src-tauri";
+
+  embed = stdenv.mkDerivation {
+    inherit (finalAttrs) src version;
+    pname = "${finalAttrs.pname}-embed";
+    sourceRoot = "${finalAttrs.src.name}/src-embed";
+    auditable = false;
+    dontInstall = true;
+
+    cargoDeps = rustPlatform.fetchCargoTarball {
+      inherit (finalAttrs) src;
+      sourceRoot = "${finalAttrs.src.name}/src-embed";
+      hash = "sha256-sf1sn3lOKvUu5MXxdMohS1DJ8jP9icZGftJKhrWA/JE=";
+    };
+
+    nativeBuildInputs = [
+      cargo
+      rustc
+      llvmPackages_15.clangNoLibc
+      llvmPackages_15.lld
+      rustPlatform.cargoSetupHook
+      wasm-bindgen-cli
+    ];
+
+    postBuild = ''
+      CC=clang CARGO_TARGET_WASM32_UNKNOWN_UNKNOWN_LINKER=lld cargo build \
+        --target wasm32-unknown-unknown \
+        --release
+
+      wasm-bindgen \
+        target/wasm32-unknown-unknown/release/surrealist_embed.wasm \
+        --out-dir $out \
+        --out-name surrealist-embed \
+        --target web
+    '';
+  };
+
+  pnpm-deps = stdenvNoCC.mkDerivation {
+    inherit (finalAttrs) src version;
+    pname = "${finalAttrs.pname}-pnpm-deps";
+    dontFixup = true;
+
+    nativeBuildInputs = [ cacert jq moreutils nodePackages.pnpm ];
+
+    postInstall = ''
+      export HOME=$(mktemp -d)
+      pnpm config set store-dir $out
+      # use --ignore-script and --no-optional to avoid downloading binaries
+      # use --frozen-lockfile to avoid checking git deps
+      pnpm install --frozen-lockfile --no-optional --ignore-script
+
+      # Remove timestamp and sort the json files
+      rm -rf $out/v3/tmp
+      for f in $(find $out -name "*.json"); do
+        sed -i -E -e 's/"checkedAt":[0-9]+,//g' $f
+        jq --sort-keys . $f | sponge $f
+      done
+    '';
+
+    outputHashMode = "recursive";
+    outputHash = "sha256-jT0Bw0xiusOw/5o6EUaEV3/GqkD/l6jkwXmOqc3a/nc=";
+  };
+
+  ui = stdenvNoCC.mkDerivation {
+    inherit (finalAttrs) src version;
+    pname = "${finalAttrs.pname}-ui";
+    dontFixup = true;
+
+    ESBUILD_BINARY_PATH = let version = "0.18.20";
+    in "${lib.getExe (esbuild.override {
+      buildGoModule = args:
+        buildGoModule (args // {
+          inherit version;
+          src = fetchFromGitHub {
+            owner = "evanw";
+            repo = "esbuild";
+            rev = "v${version}";
+            hash = "sha256-mED3h+mY+4H465m02ewFK/BgA1i/PQ+ksUNxBlgpUoI=";
+          };
+          vendorHash = "sha256-+BfxCyg0KkDQpHt/wycy/8CTG6YBA/VJvJFhhzUnSiQ=";
+        });
+    })}";
+
+    nativeBuildInputs = [ nodePackages.pnpm ];
+
+    postPatch = ''
+      ln -s ${finalAttrs.embed} src/generated
+    '';
+
+    postBuild = ''
+      export HOME=$(mktemp -d)
+      pnpm config set store-dir ${finalAttrs.pnpm-deps}
+      pnpm install --offline --frozen-lockfile --no-optional --ignore-script
+      pnpm build
+    '';
+
+    postInstall = ''
+      cp -r dist $out
+    '';
+  };
+
+  cargoDeps = rustPlatform.importCargoLock {
+    lockFile = ./Cargo.lock;
+    outputHashes = {
+      "tauri-plugin-localhost-0.1.0" =
+        "sha256-7PJgz6t/jPEwX/2xaOe0SYawfPSZw/F1QtOrc6iPiP0=";
+    };
+  };
+
+  nativeBuildInputs = [
+    cargo
+    cargo-tauri
+    makeBinaryWrapper
+    pkg-config
+    rustc
+    rustPlatform.cargoSetupHook
+  ];
+
+  buildInputs =
+    [ cairo gdk-pixbuf gobject-introspection libsoup pango webkitgtk ];
+
+  postPatch = ''
+    substituteInPlace ./tauri.conf.json \
+      --replace '"distDir": "../dist",' '"distDir": "${finalAttrs.ui}",' \
+      --replace '"beforeBuildCommand": "pnpm build",' '"beforeBuildCommand": "",'
+  '';
+
+  postBuild = ''
+    cargo tauri build --bundles deb
+  '';
+
+  postInstall = ''
+    install -Dm555 target/release/bundle/deb/surrealist_${finalAttrs.version}_*/data/usr/bin/surrealist -t $out/bin
+    cp -r target/release/bundle/deb/surrealist_${finalAttrs.version}_*/data/usr/share $out
+  '';
+
+  postFixup = ''
+    wrapProgram "$out/bin/surrealist" --set WEBKIT_DISABLE_COMPOSITING_MODE 1
+  '';
+
+  meta = with lib; {
+    description = "Powerful graphical SurrealDB query playground and database explorer for Browser and Desktop";
+    homepage = "https://surrealist.starlane.studio";
+    license = licenses.mit;
+    mainProgram = "surrealist";
+    maintainers = with maintainers; [ frankp ];
+    platforms = platforms.linux;
+  };
+})

pkgs/by-name/wl/wlogout/package.nix

@@ -1,15 +1,16 @@
 { lib
-, stdenv
 , fetchFromGitHub
-, pkg-config
-, meson
-, ninja
-, scdoc
+, gitUpdater
+, gtk-layer-shell
 , gtk3
 , libxkbcommon
+, meson
+, ninja
+, pkg-config
+, scdoc
+, stdenv
 , wayland
 , wayland-protocols
-, gtk-layer-shell
 # gtk-layer-shell fails to cross-compile due to a hard dependency
 # on gobject-introspection.
 # Disable it when cross-compiling since it's an optional dependency.
@@ -17,20 +18,30 @@
 , withGtkLayerShell ? (stdenv.buildPlatform == stdenv.hostPlatform)
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "wlogout";
-  version = "1.2";
+  version = "1.2.1";
 
   src = fetchFromGitHub {
     owner = "ArtsyMacaw";
     repo = "wlogout";
-    rev = version;
-    hash = "sha256-xeTO8MBUrvcVA7WTRY7OhaVGInijuvXsVYEax8JmMZ0=";
+    rev = finalAttrs.version;
+    hash = "sha256-n8r+E6GXXjyDYBTOMiv5musamaUFSpRTM2qHgb047og=";
   };
 
-  strictDeps = true;
-  depsBuildBuild = [ pkg-config ];
-  nativeBuildInputs = [ pkg-config meson ninja scdoc ];
+  outputs = [ "out" "man" ];
+
+  depsBuildBuild = [
+    pkg-config
+  ];
+
+  nativeBuildInputs = [
+    meson
+    ninja
+    pkg-config
+    scdoc
+  ];
+
   buildInputs = [
     gtk3
     libxkbcommon
@@ -40,26 +51,32 @@ stdenv.mkDerivation rec {
     gtk-layer-shell
   ];
 
-  postPatch = ''
-    substituteInPlace style.css \
-      --replace "/usr/share/wlogout" "$out/share/${pname}"
-
-    substituteInPlace main.c \
-      --replace "/etc/wlogout" "$out/etc/${pname}"
-  '';
+  strictDeps = true;
 
   mesonFlags = [
     "--datadir=${placeholder "out"}/share"
     "--sysconfdir=${placeholder "out"}/etc"
   ];
 
-  meta = with lib; {
+  postPatch = ''
+    substituteInPlace style.css \
+      --replace "/usr/share/wlogout" "$out/share/wlogout"
+
+    substituteInPlace main.c \
+      --replace "/etc/wlogout" "$out/etc/wlogout"
+  '';
+
+  passthru = {
+    updateScript = gitUpdater { };
+  };
+
+  meta = {
     homepage = "https://github.com/ArtsyMacaw/wlogout";
     description = "A wayland based logout menu";
-    license = licenses.mit;
-    maintainers = with maintainers; [ AndersonTorres ];
-    platforms = platforms.linux;
+    changelog = "https://github.com/ArtsyMacaw/wlogout/releases/tag/${finalAttrs.src.rev}";
+    license = with lib.licenses; [ mit ];
     mainProgram = "wlogout";
+    maintainers = with lib.maintainers; [ AndersonTorres ];
+    inherit (wayland.meta) platforms;
   };
-}
-# TODO: shell completions
+})

pkgs/desktops/xfce/applications/xfce4-taskmanager/default.nix

@@ -13,10 +13,10 @@
 mkXfceDerivation {
   category = "apps";
   pname = "xfce4-taskmanager";
-  version = "1.5.6";
+  version = "1.5.7";
   odd-unstable = false;
 
-  sha256 = "sha256-2NkjaK6xXsrMimriO2/gTOZowt9KTX4MrWJpPXM0w68=";
+  sha256 = "sha256-znadP7rrP/IxH22U1D9p6IHZ1J1JfXoCVk8iKUgrkJw=";
 
   nativeBuildInputs = [
     exo

pkgs/desktops/xfce/applications/xfce4-terminal/default.nix

@@ -17,10 +17,10 @@
 mkXfceDerivation {
   category = "apps";
   pname = "xfce4-terminal";
-  version = "1.1.2";
+  version = "1.1.3";
   odd-unstable = false;
 
-  sha256 = "sha256-9RJmHYT9yYhtyzyTcg3nnD2hlCgENyi/3TNOGUto494=";
+  sha256 = "sha256-CUIQf22Lmb6MNPd2wk8LlHFNUhdIoC1gzVV6RDP2PfY=";
 
   nativeBuildInputs = [
     libxslt

pkgs/desktops/xfce/core/xfce4-panel/default.nix

@@ -16,9 +16,9 @@
 mkXfceDerivation {
   category = "xfce";
   pname = "xfce4-panel";
-  version = "4.18.5";
+  version = "4.18.6";
 
-  sha256 = "sha256-1oh9C2ZlpcUulqhxUEPLhX22R7tko0rMmDixgkgaU9o=";
+  sha256 = "sha256-eQLz/LJIx2WkzcSLytRdJdhtGv0woT48mdqG7eHB0U4=";
 
   nativeBuildInputs = [
     gobject-introspection
@@ -44,7 +44,7 @@ mkXfceDerivation {
 
   postPatch = ''
     substituteInPlace plugins/clock/clock.c \
-       --replace "/usr/share/zoneinfo" "${tzdata}/share/zoneinfo"
+       --replace-fail "/usr/share/zoneinfo" "${tzdata}/share/zoneinfo"
   '';
 
   meta = with lib; {

pkgs/desktops/xfce/panel-plugins/xfce4-clipman-plugin/default.nix

@@ -1,5 +1,6 @@
 { lib
 , mkXfceDerivation
+, wayland-scanner
 , glib
 , gtk3
 , libX11
@@ -10,13 +11,18 @@
 , xfce4-panel
 , xfconf
 , wayland
+, wlr-protocols
 }:
 
 mkXfceDerivation {
   category = "panel-plugins";
   pname = "xfce4-clipman-plugin";
-  version = "1.6.5";
-  sha256 = "sha256-aKcIwlNlaJEHgIq0S7+VG/os49+zRqkZXsQVse4B9oE=";
+  version = "1.6.6";
+  sha256 = "sha256-wdEoM4etco+s0+dULkBvWJZ3WBCW3Ph2bdY0E/l5VRc=";
+
+  nativeBuildInputs = [
+    wayland-scanner
+  ];
 
   buildInputs = [
     glib
@@ -29,6 +35,7 @@ mkXfceDerivation {
     xfce4-panel
     xfconf
     wayland
+    wlr-protocols
   ];
 
   meta = with lib; {

pkgs/development/libraries/science/math/mkl/default.nix

@@ -68,9 +68,7 @@ in stdenvNoCC.mkDerivation ({
 
   dontUnpack = stdenvNoCC.isLinux;
 
-  unpackPhase = if stdenvNoCC.isDarwin then ''
-    7zz x $src
-  '' else null;
+  sourceRoot = if stdenvNoCC.isDarwin then "." else null;
 
   nativeBuildInputs = [ validatePkgConfig ] ++ (if stdenvNoCC.isDarwin
     then

pkgs/development/libraries/unixODBCDrivers/default.nix

@@ -64,12 +64,13 @@
     buildInputs = [ unixODBC openssl libiconv zlib ]
       ++ lib.optionals stdenv.isDarwin [ libkrb5 ];
 
-    preConfigure = ''
+    # TODO: remove preConfigure on staging
+    preConfigure = if !stdenv.isDarwin then ''
       # we don't want to build a .pkg
       substituteInPlace CMakeLists.txt \
         --replace "IF(APPLE)" "IF(0)" \
         --replace "CMAKE_SYSTEM_NAME MATCHES AIX" "APPLE"
-    '';
+    '' else null;
 
     cmakeFlags = [
       "-DWITH_EXTERNAL_ZLIB=ON"
@@ -80,6 +81,10 @@
       "-DWITH_IODBC=OFF"
     ];
 
+    buildFlags = if stdenv.isDarwin then [ "maodbc" ] else null;
+
+    installTargets = if stdenv.isDarwin then [ "install/fast" ] else null;
+
     # see the top of the file for an explanation
     passthru = {
       fancyName = "MariaDB";

pkgs/development/php-packages/php-cs-fixer/default.nix

@@ -17,7 +17,7 @@ php.buildComposerProject (finalAttrs: {
   # Missing `composer.lock` from the repository.
   # Issue open at https://github.com/PHP-CS-Fixer/PHP-CS-Fixer/issues/7590
   composerLock = ./composer.lock;
-  vendorHash = "sha256-WhLMU4aCZwNPC+k537nWQfQ0qyI/GGrR4JtgT4chuHg=";
+  vendorHash = "sha256-b0vrjv0dqQTD3nuo6nqpUtF4JkD8mj4OnNKKqp6hcvU=";
 
   meta = {
     changelog = "https://github.com/PHP-CS-Fixer/PHP-CS-Fixer/releases/tag/v${finalAttrs.version}";

pkgs/development/python-modules/databases/default.nix

@@ -8,23 +8,28 @@
 , fetchFromGitHub
 , pytestCheckHook
 , pythonOlder
+, setuptools
 , sqlalchemy
 }:
 
 buildPythonPackage rec {
   pname = "databases";
-  version = "0.8.0";
-  format = "setuptools";
+  version = "0.9.0";
+  pyproject = true;
 
-  disabled = pythonOlder "3.7";
+  disabled = pythonOlder "3.8";
 
   src = fetchFromGitHub {
     owner = "encode";
-    repo = pname;
+    repo = "databases";
     rev = "refs/tags/${version}";
-    hash = "sha256-e3iMZBPdldZFuS7FyhbGj9SufnH5hBBt8MEUjixXfqA=";
+    hash = "sha256-Zf9QqBgDhWAnHdNvzjXtri5rdT00BOjc4YTNzJALldM=";
   };
 
+  nativeBuildInputs = [
+    setuptools
+  ];
+
   propagatedBuildInputs = [
     sqlalchemy
   ];
@@ -78,7 +83,5 @@ buildPythonPackage rec {
     changelog = "https://github.com/encode/databases/releases/tag/${version}";
     license = licenses.bsd3;
     maintainers = with maintainers; [ ];
-    # https://github.com/encode/databases/issues/530
-    broken = lib.versionAtLeast sqlalchemy.version "2.0.0";
   };
 }

pkgs/development/python-modules/oslo-context/default.nix

@@ -2,11 +2,11 @@
 
 buildPythonPackage rec {
   pname = "oslo.context";
-  version = "5.4.0";
+  version = "5.5.0";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-6WSRu91rUecqOoxUahKbhNI56OngtSEMi6fAoKVimRk=";
+    hash = "sha256-6uAxeymSjxk030xguGD+hiUkfLKXxcxi/vjrWCexL6w=";
   };
 
   postPatch = ''

pkgs/development/python-modules/pyarrow/default.nix

@@ -37,6 +37,10 @@ buildPythonPackage rec {
   postPatch = ''
     substituteInPlace pyproject.toml setup.py \
       --replace "setuptools_scm < 8.0.0" "setuptools_scm"
+  '' + lib.optionalString (pythonAtLeast "3.12") ''
+    substituteInPlace ./cmake_modules/FindPython3Alt.cmake --replace-fail \
+      "from distutils import sysconfig" \
+      "import sysconfig"
   '';
 
   nativeBuildInputs = [

pkgs/development/python-modules/python-manilaclient/default.nix

@@ -22,12 +22,12 @@
 
 buildPythonPackage rec {
   pname = "python-manilaclient";
-  version = "4.7.0";
+  version = "4.8.0";
   format = "setuptools";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-blkE+pLzZQ8BCHAmk6yNjzqbBAlK2ab1FySGFB/kN2c=";
+    hash = "sha256-TwvDtbYGkDZFIsr0GgwD2R0Il7pV2GCuDw3OZXxDXso=";
   };
 
   nativeBuildInputs = [

pkgs/development/tools/ijq/default.nix

@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "ijq";
-  version = "0.4.1";
+  version = "1.0.1";
 
   src = fetchFromSourcehut {
     owner = "~gpanders";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-WTA14W8JFHdouDgWmsc4wMygnwlANPjSYCAhxFVrwAA=";
+    sha256 = "sha256-su/PHUt4GpJxt9nm/oYnP1F8EDSl0fUgamWJj1TxuZA=";
   };
 
-  vendorHash = "sha256-DX8m5FsqMZnzk1wgJA/ESZl0QeDv3p9huF4h1HY9DIA=";
+  vendorHash = "sha256-X91kW+dpcxd1+vTV1G1al5cdlwWpbUS85Xxf3yeVg1I=";
 
   nativeBuildInputs = [ installShellFiles makeWrapper scdoc ];
 

pkgs/development/tools/rust/svd2rust/default.nix

@@ -2,14 +2,14 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "svd2rust";
-  version = "0.31.5";
+  version = "0.32.0";
 
   src = fetchCrate {
     inherit pname version;
-    hash = "sha256-iJWF2BDLFH/sNi5xc8BIVmt4A+CSROxxp1TW5fcIp1Q=";
+    hash = "sha256-XA0zSMZTeEOiAKgzU6/znZIoJr4VtGjxWjOqDE7TFbk=";
   };
 
-  cargoHash = "sha256-WcF7XeDfCdGiQQBH1LN3q3iIUJlfLTjJ7xlMG52AO/w=";
+  cargoHash = "sha256-94oSlnTZdGkYLAn5uShIDg2UAMPVu580ofVcgHZvI2M=";
 
   # error: linker `aarch64-linux-gnu-gcc` not found
   postPatch = ''

pkgs/os-specific/darwin/airbuddy/default.nix

@@ -19,16 +19,8 @@ stdenvNoCC.mkDerivation (finalAttrs: {
   dontBuild = true;
   dontFixup = true;
 
-  nativeBuildInputs = [ _7zz ];
-
   # AirBuddy.dmg is APFS formatted, unpack with 7zz
-  unpackCmd = ''
-    runHook preUnpack
-
-    7zz x $src
-
-    runHook postUnpack
-  '';
+  nativeBuildInputs = [ _7zz ];
 
   sourceRoot = "AirBuddy.app";
 

pkgs/os-specific/darwin/aldente/default.nix

@@ -16,16 +16,8 @@ stdenvNoCC.mkDerivation (finalAttrs: {
   dontBuild = true;
   dontFixup = true;
 
-  nativeBuildInputs = [ _7zz ];
-
   # AlDente.dmg is APFS formatted, unpack with 7zz
-  unpackCmd = ''
-    runHook preUnpack
-
-    7zz x $src
-
-    runHook postUnpack
-  '';
+  nativeBuildInputs = [ _7zz ];
 
   sourceRoot = "AlDente.app";
 

pkgs/os-specific/darwin/sensible-side-buttons/default.nix

@@ -0,0 +1,37 @@
+{ lib
+, fetchurl
+, undmg
+, stdenv
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "sensible-side-buttons-bin";
+  version = "1.0.6";
+  src = fetchurl {
+    url = "https://github.com/archagon/sensible-side-buttons/releases/download/${finalAttrs.version}/SensibleSideButtons-${finalAttrs.version}.dmg";
+    hash = "sha256-Hys678R6wf+M4eg6892rgU3Xxua5dLc9zjaU7HQ1iBs=";
+  };
+
+  sourceRoot = "SensibleSideButtons.app";
+
+  nativeBuildInputs = [ undmg ];
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p "$out/Applications/SensibleSideButtons.app"
+    cp -R . "$out/Applications/SensibleSideButtons.app"
+    mkdir "$out/bin"
+    ln -s "$out/Applications/SensibleSideButtons.app/Contents/MacOS/SensibleSideButtons" "$out/bin/${finalAttrs.pname}"
+
+    runHook postInstall
+  '';
+
+  meta = with lib; {
+    description = "Utilize mouse side navigation buttons";
+    homepage = "https://sensible-side-buttons.archagon.net";
+    license = licenses.unfree;
+    maintainers = with maintainers; [ yamashitax ];
+    platforms = platforms.darwin;
+  };
+})

pkgs/servers/home-assistant/custom-components/auth-header/default.nix

@@ -0,0 +1,27 @@
+{ lib
+, buildHomeAssistantComponent
+, fetchFromGitHub
+}:
+
+buildHomeAssistantComponent rec {
+  owner = "BeryJu";
+  domain = "auth_header";
+  version = "1.10-unstable-2024-02-26";
+
+  src = fetchFromGitHub {
+    inherit owner;
+    repo = "hass-auth-header";
+    rev = "5923cb33b57a9d3c23513d54cc74b02ebd243409";
+    hash = "sha256-ZYd1EduzoljaY3OnpjsKEAwtf03435zJmZtgqzbdjjA=";
+  };
+
+  # build step just runs linter
+  dontBuild = true;
+
+  meta = with lib; {
+    description = "Home Assistant custom component which allows you to delegate authentication to a reverse proxy";
+    homepage = "https://github.com/BeryJu/hass-auth-header";
+    maintainers = with maintainers; [ mjm ];
+    license = licenses.gpl3;
+  };
+}

pkgs/servers/home-assistant/custom-components/default.nix

@@ -4,6 +4,8 @@
 {
   adaptive_lighting = callPackage ./adaptive_lighting {};
 
+  auth-header = callPackage ./auth-header {};
+
   emporia_vue = callPackage ./emporia_vue {};
 
   govee-lan = callPackage ./govee-lan {};

pkgs/servers/photoprism/backend.nix

@@ -19,7 +19,7 @@ buildGoModule rec {
     substituteInPlace internal/commands/passwd.go --replace '/bin/stty' "${coreutils}/bin/stty"
   '';
 
-  vendorHash = "sha256-SJjq2O7efqzzsg8I7n7pVqzG+jK0SsPT4J4iDdsMY4c=";
+  vendorHash = "sha256-mt2L5vf57/MntjtfJVua799nF4CkRYI8payLoPc0oQA=";
 
   subPackages = [ "cmd/photoprism" ];
 

pkgs/servers/photoprism/default.nix

@@ -1,14 +1,14 @@
 { pkgs, lib, stdenv, fetchFromGitHub, fetchzip, darktable, rawtherapee, ffmpeg, libheif, exiftool, imagemagick, makeWrapper, testers }:
 
 let
-  version = "231011-63f708417";
+  version = "231128-f48ff16ef";
   pname = "photoprism";
 
   src = fetchFromGitHub {
     owner = pname;
     repo = pname;
     rev = version;
-    hash = "sha256-g/j+L++vb+wiE23d/lm6lga0MeaPrCotEojD9Sajkmg=";
+    hash = "sha256-gVxKa5JKGz5VSVCuJHat0DWCYaUH+9an6JsYUPe9muQ=";
   };
 
   libtensorflow = pkgs.callPackage ./libtensorflow.nix { };

pkgs/servers/photoprism/frontend.nix

@@ -8,7 +8,7 @@ buildNpmPackage {
     cd frontend
   '';
 
-  npmDepsHash = "sha256-v7G06x/6MAFlOPbmkdh9Yt9/0BcMSYXI5EUmIHKiVFo=";
+  npmDepsHash = "sha256-4bAWSSy7kvG1ChzEb2iuxgWxnkjtJlr7Lm7USbgsmAw=";
 
   installPhase = ''
     runHook preInstall

pkgs/servers/sql/postgresql/ext/pg_ivm.nix

@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "pg_ivm";
-  version = "1.7";
+  version = "1.8";
 
   src = fetchFromGitHub {
     owner = "sraoss";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-uSYhNUfd4mw7mGGAcP43X/0v/bNp6SdZjPzktGONgaQ=";
+    hash = "sha256-HncWX3jx9sEvxGGMMZ9QT4tDQ4JYbkNrFw2aZHgCVE8=";
   };
 
   buildInputs = [ postgresql ];

pkgs/servers/x11/xorg/default.nix

@@ -2278,11 +2278,11 @@ self: with self; {
   # THIS IS A GENERATED FILE.  DO NOT EDIT!
   xcbutilcursor = callPackage ({ stdenv, pkg-config, fetchurl, gperf, libxcb, xcbutilimage, xcbutilrenderutil, xorgproto, m4, testers }: stdenv.mkDerivation (finalAttrs: {
     pname = "xcb-util-cursor";
-    version = "0.1.4";
+    version = "0.1.5";
     builder = ./builder.sh;
     src = fetchurl {
-      url = "mirror://xorg/individual/xcb/xcb-util-cursor-0.1.4.tar.xz";
-      sha256 = "1yria9h0vqpblkgzqhpygk3rraijd3mmipg0mdhkayxbpj8gxp18";
+      url = "mirror://xorg/individual/lib/xcb-util-cursor-0.1.5.tar.xz";
+      sha256 = "0mrwcrm6djbd5zdvqb5v4wr87bzawnaacyqwwhfghw09ssq9kbqc";
     };
     hardeningDisable = [ "bindnow" "relro" ];
     strictDeps = true;

pkgs/servers/x11/xorg/tarballs.list

@@ -1,7 +1,6 @@
 https://invisible-mirror.net/archives/luit/luit-20230201.tgz
 mirror://xorg/individual/xcb/libpthread-stubs-0.5.tar.xz
 mirror://xorg/individual/xcb/xcb-util-0.4.1.tar.xz
-mirror://xorg/individual/xcb/xcb-util-cursor-0.1.4.tar.xz
 mirror://xorg/individual/xcb/xcb-util-errors-1.0.1.tar.xz
 mirror://xorg/individual/xcb/xcb-util-image-0.4.1.tar.xz
 mirror://xorg/individual/xcb/xcb-util-keysyms-0.4.1.tar.xz
@@ -208,6 +207,7 @@ mirror://xorg/individual/lib/libXvMC-1.0.14.tar.xz
 mirror://xorg/individual/lib/libXxf86dga-1.1.6.tar.xz
 mirror://xorg/individual/lib/libXxf86misc-1.0.4.tar.bz2
 mirror://xorg/individual/lib/libXxf86vm-1.1.5.tar.xz
+mirror://xorg/individual/lib/xcb-util-cursor-0.1.5.tar.xz
 mirror://xorg/individual/lib/xtrans-1.5.0.tar.xz
 mirror://xorg/individual/proto/xcb-proto-1.16.0.tar.xz
 mirror://xorg/individual/proto/xorgproto-2023.2.tar.xz

pkgs/tools/inputmethods/unnaturalscrollwheels/default.nix

@@ -15,7 +15,6 @@ stdenvNoCC.mkDerivation (finalAttrs: {
 
   # APFS format is unsupported by undmg
   nativeBuildInputs = [ _7zz ];
-  unpackCmd = "7zz x $curSrc";
 
   installPhase = ''
     runHook preInstall

pkgs/tools/misc/archi/default.nix

@@ -42,9 +42,7 @@ stdenv.mkDerivation rec {
     autoPatchelfHook
   ];
 
-  unpackPhase = if stdenv.hostPlatform.isDarwin then ''
-    7zz x $src
-  '' else null;
+  sourceRoot = if stdenv.isDarwin then "." else null;
 
   installPhase =
     if stdenv.hostPlatform.system == "x86_64-linux" then

pkgs/tools/networking/netbird/default.nix

@@ -31,13 +31,13 @@ let
 in
 buildGoModule rec {
   pname = "netbird";
-  version = "0.26.1";
+  version = "0.26.2";
 
   src = fetchFromGitHub {
     owner = "netbirdio";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-FZ6bPn4birCjvWm43clu3lAES38IooLP7PhUfRMO5+0=";
+    hash = "sha256-fnKrv8bMONZbZGZtCQUAeGo3OIvOIqLX3nvVfGhYoK8=";
   };
 
   vendorHash = "sha256-Zp8LAaADpSa/wfnLAQVJ8cG3bMkC7ZU1BT+Dz214c34=";

pkgs/tools/package-management/deploy-rs/default.nix

@@ -8,16 +8,16 @@
 
 rustPlatform.buildRustPackage {
   pname = "deploy-rs";
-  version = "unstable-2023-12-20";
+  version = "unstable-2024-02-16";
 
   src = fetchFromGitHub {
     owner = "serokell";
     repo = "deploy-rs";
-    rev = "b709d63debafce9f5645a5ba550c9e0983b3d1f7";
-    hash = "sha256-0VUbWBW8VyiDRuimMuLsEO4elGuUw/nc2WDeuO1eN1M=";
+    rev = "0a0187794ac7f7a1e62cda3dabf8dc041f868790";
+    hash = "sha256-dTGGw2y8wvfjr+J9CjQbfdulOq72hUG17HXVNxpH1yE=";
   };
 
-  cargoHash = "sha256-PVeCB1g3JSYE6PKWHyE3hfN/CKlb9XErt8uaD/ZyxIs=";
+  cargoHash = "sha256-Vo/45cZM/sBAaoikhEwCvduhMQjurwSZwCjwrIQn7IA=";
 
   buildInputs = lib.optionals stdenv.isDarwin [
     CoreServices

pkgs/tools/security/vault/default.nix

@@ -6,16 +6,16 @@
 
 buildGoModule rec {
   pname = "vault";
-  version = "1.15.5";
+  version = "1.15.6";
 
   src = fetchFromGitHub {
     owner = "hashicorp";
     repo = "vault";
     rev = "v${version}";
-    sha256 = "sha256-KDQgiG+HSkLjiJfej9VqTcPZxOMMTh9n9yTDGfiGF3g=";
+    hash = "sha256-XqPuikUUm8C02Uv6qZHPz/KEmrvBrr8gOznQ7qbMKnU=";
   };
 
-  vendorHash = "sha256-fNUoeyBVci/S4LCpAPYjVbf8r+ROB5uL1TaUKJZsNes=";
+  vendorHash = "sha256-SYGqlLCA7T4MhRlOVBSYnZdZ2+WuJvmmHw3MdnfoezM=";
 
   proxyVendor = true;
 

pkgs/tools/security/vault/vault-bin.nix

@@ -2,7 +2,7 @@
 
 stdenv.mkDerivation rec {
   pname = "vault-bin";
-  version = "1.15.5";
+  version = "1.15.6";
 
   src =
     let
@@ -16,11 +16,11 @@ stdenv.mkDerivation rec {
         aarch64-darwin = "darwin_arm64";
       };
       sha256 = selectSystem {
-        x86_64-linux = "sha256-WchJdMn8PkCu3MydY6ssbXpMCaQBlDbyTQ1kF69KQ+0=";
-        aarch64-linux = "sha256-tjLyPC156q8y4RKB0+QVIxiXbkW6/qTytCC0WhOo8xU=";
-        i686-linux = "sha256-TSAhomxTIKSHE0BE1jiL9a15hpGRmF7clFbTwsrDxuk=";
-        x86_64-darwin = "sha256-vG3S84P7+zvQnIjohPHN3JefN4wM9uDdPqindnwlXpE=";
-        aarch64-darwin = "sha256-nQsKXD+1gGclUoZLlUpA6k9QuNv/NQ+roRa6kvXCIXQ=";
+        x86_64-linux = "sha256-qZXR0bqsU0BcM4hWbCZ6vqnjh5pnddl7WTKKBGt1ioU=";
+        aarch64-linux = "sha256-4f0D+D+rL28mzCN8ku/FWrRFFUevY5yWIgifvZrDbuw=";
+        i686-linux = "sha256-YoG2NC6cBCunIql7kIRIOs0hU0dIQKIHN/Z27IGj1io=";
+        x86_64-darwin = "sha256-sdbwnoWZKbq0l86ikfHAR+LYI285IGRiZBB7woD/s/8=";
+        aarch64-darwin = "sha256-JcTt67eWgORgEmuiBpY5fSGJr8vvCOwKbnOTYZh2fIM=";
       };
     in
     fetchzip {

pkgs/tools/typesetting/tex/texlive/bin.nix

@@ -3,7 +3,7 @@
 , zlib, libiconv, libpng, libX11
 , freetype, gd, libXaw, icu, ghostscript, libXpm, libXmu, libXext
 , perl, perlPackages, python3Packages, pkg-config, cmake, ninja
-, libpaper, graphite2, zziplib, harfbuzz, potrace, gmp, mpfr, mupdf
+, libpaper, graphite2, zziplib, harfbuzz, potrace, gmp, mpfr, mupdf-headless
 , brotli, cairo, pixman, xorg, clisp, biber, woff2, xxHash
 , makeWrapper, shortenPerlShebang, useFixedHashes, asymptote
 , biber-ms
@@ -361,7 +361,7 @@ dvisvgm = stdenv.mkDerivation {
     ++ [ "--with-system-kpathsea" ];
 
   nativeBuildInputs = [ pkg-config ];
-  buildInputs = [ core brotli ghostscript zlib freetype woff2 potrace xxHash mupdf ];
+  buildInputs = [ core brotli ghostscript zlib freetype woff2 potrace xxHash mupdf-headless ];
 
   enableParallelBuilding = true;
 };

pkgs/top-level/aliases.nix

@@ -300,6 +300,7 @@ mapAliases ({
   firmwareLinuxNonfree = linux-firmware; # Added 2022-01-09
   fishfight = jumpy; # Added 2022-08-03
   fitnesstrax = throw "fitnesstrax was removed from nixpkgs because it disappeared upstream and no longer compiles"; # added 2023-07-04
+  flashrom-stable = flashprog;   # Added 2024-03-01
   flatbuffers_2_0 = flatbuffers; # Added 2022-05-12
   flutter2 = throw "flutter2 has been removed because it isn't updated anymore, and no packages in nixpkgs use it. If you still need it, use flutter.mkFlutter to get a custom version"; # Added 2023-07-03
   flutter37 = throw "flutter37 has been removed because it isn't updated anymore, and no packages in nixpkgs use it. If you still need it, use flutter.mkFlutter to get a custom version"; # Added 2023-07-03

pkgs/top-level/all-packages.nix

@@ -4829,8 +4829,6 @@ with pkgs;
 
   wleave = callPackage ../tools/wayland/wleave { };
 
-  wlogout = callPackage ../tools/wayland/wlogout { };
-
   wlopm = callPackage ../tools/wayland/wlopm { };
 
   wlprop = callPackage ../tools/wayland/wlprop { };
@@ -8160,8 +8158,6 @@ with pkgs;
 
   flashrom = callPackage ../tools/misc/flashrom { };
 
-  flashrom-stable = callPackage ../tools/misc/flashrom-stable { };
-
   flent = python3Packages.callPackage ../applications/networking/flent { };
 
   flexoptix-app = callPackage ../tools/misc/flexoptix-app { };
@@ -28668,6 +28664,8 @@ with pkgs;
 
   teensy-udev-rules = callPackage ../os-specific/linux/teensy-udev-rules { };
 
+  sensible-side-buttons = callPackage ../os-specific/darwin/sensible-side-buttons { };
+
   wpa_supplicant = callPackage ../os-specific/linux/wpa_supplicant { };
 
   wpa_supplicant_ro_ssids = wpa_supplicant.override {
@@ -40688,6 +40686,8 @@ with pkgs;
 
   shellz = callPackage ../tools/security/shellz { };
 
+  tableplus = callPackage ../applications/misc/tableplus { };
+
   timeloop = pkgs.darwin.apple_sdk_11_0.callPackage ../applications/science/computer-architecture/timeloop { };
 
   canon-cups-ufr2 = callPackage ../misc/cups/drivers/canon { };