Merge master into staging-next

maintainers/maintainer-list.nix

@@ -11481,6 +11481,14 @@
     ];
     name = "Ioannis Koutras";
   };
+  jolars = {
+    email = "jolars@posteo.com";
+    matrix = "@jola:mozilla.org";
+    github = "jolars";
+    githubId = 13087841;
+    name = "Johan Larsson";
+    keys = [ { fingerprint = "F0D6 BDE7 C7D1 6B3F 7883  73E7 2A41 C0FE DD6F F540"; } ];
+  };
   jonaenz = {
     name = "Jona Enzinger";
     email = "5xt3zyy5l@mozmail.com";

nixos/doc/manual/release-notes/rl-2505.section.md

@@ -204,6 +204,9 @@
 
 - `pkgs.nextcloud28` has been removed since it's out of support upstream.
 
+- Emacs lisp build helpers, such as `emacs.pkgs.melpaBuild`, now enables `__structuredAttrs` by default.
+  Environment variables have to be passed via the `env` attribute.
+
 - `buildGoModule` now passes environment variables via the `env` attribute. `CGO_ENABLED` should now be specified with `env.CGO_ENABLED` when passing to buildGoModule. Direct specification of `CGO_ENABLED` is now redirected by a compatibility layer with a warning, but will become an error in future releases.
 
   Go-related environment variables previously shadowed by `buildGoModule` now results in errors when specified directly. Such variables include `GOOS` and `GOARCH`.
@@ -275,6 +278,8 @@
   See the [1.3.0 changelog](https://git.sr.ht/~mil/mepo/refs/1.3.0)
   for more details.
 
+- `tauon` 7.9.0+ when launched for the first time, migrates its database to a new schema that is not backwards compatible. Older versions will refuse to start at all with that database afterwards. If you need to still use older tauon versions, make sure to back up `~/.local/share/TauonMusicBox`.
+
 - The `earlyoom` service is now using upstream systemd service, which enables
   hardening and filesystem isolation by default. If you need filesystem write
   access or want to access home directory via `killHook`, hardening setting can
@@ -540,6 +545,8 @@
 
 - `services.avahi.ipv6` now defaults to true.
 
+- All services that require a root certificate bundle now use the value of a new read-only option, `security.pki.caBundle`.
+
 - hddfancontrol has been updated to major release 2. See the [migration guide](https://github.com/desbma/hddfancontrol/tree/master?tab=readme-ov-file#migrating-from-v1x), as there are breaking changes.
 
 - The Home Assistant module has new options {option}`services.home-assistant.blueprints.automation`, `services.home-assistant.blueprints.script`, and {option}`services.home-assistant.blueprints.template` that allow for the declarative installation of [blueprints](https://www.home-assistant.io/docs/blueprint/) into the appropriate configuration directories.

nixos/modules/programs/feedbackd.nix

@@ -25,6 +25,8 @@ in
     services.dbus.packages = [ cfg.package ];
     services.udev.packages = [ cfg.package ];
 
+    # TODO: also enable systemd unit fbd-alert-slider for OnePlus 6/6T devices, see release notes of feedbackd v0.5.0
+
     users.groups.feedbackd = { };
   };
 }

nixos/modules/security/ca.nix

@@ -5,7 +5,6 @@
   ...
 }:
 let
-
   cfg = config.security.pki;
 
   cacertPackage = pkgs.cacert.override {
@@ -88,22 +87,31 @@ in
       '';
     };
 
+    security.pki.caBundle = lib.mkOption {
+      type = lib.types.path;
+      readOnly = true;
+      description = ''
+        (Read-only) the path to the final bundle of certificate authorities as a single file.
+      '';
+    };
   };
 
-  config = lib.mkIf cfg.installCACerts {
+  config = lib.mkMerge [
+    (lib.mkIf cfg.installCACerts {
 
-    # NixOS canonical location + Debian/Ubuntu/Arch/Gentoo compatibility.
-    environment.etc."ssl/certs/ca-certificates.crt".source = caBundle;
+      # NixOS canonical location + Debian/Ubuntu/Arch/Gentoo compatibility.
+      environment.etc."ssl/certs/ca-certificates.crt".source = caBundle;
 
-    # Old NixOS compatibility.
-    environment.etc."ssl/certs/ca-bundle.crt".source = caBundle;
+      # Old NixOS compatibility.
+      environment.etc."ssl/certs/ca-bundle.crt".source = caBundle;
 
-    # CentOS/Fedora compatibility.
-    environment.etc."pki/tls/certs/ca-bundle.crt".source = caBundle;
+      # CentOS/Fedora compatibility.
+      environment.etc."pki/tls/certs/ca-bundle.crt".source = caBundle;
 
-    # P11-Kit trust source.
-    environment.etc."ssl/trust-source".source = "${cacertPackage.p11kit}/etc/ssl/trust-source";
-
-  };
+      # P11-Kit trust source.
+      environment.etc."ssl/trust-source".source = "${cacertPackage.p11kit}/etc/ssl/trust-source";
+    })
+    { security.pki.caBundle = caBundle; }
+  ];
 
 }

nixos/modules/services/audio/gonic.nix

@@ -59,7 +59,7 @@ in
         BindReadOnlyPaths = [
           # gonic can access scrobbling services
           "-/etc/resolv.conf"
-          "-/etc/ssl/certs/ca-certificates.crt"
+          "${config.security.pki.caBundle}:/etc/ssl/certs/ca-certificates.crt"
           builtins.storeDir
         ] ++ cfg.settings.music-path
         ++ lib.optional (cfg.settings.tls-cert != null) cfg.settings.tls-cert

nixos/modules/services/audio/navidrome.nix

@@ -118,9 +118,7 @@ in
             BindReadOnlyPaths =
               [
                 # navidrome uses online services to download additional album metadata / covers
-                "${
-                  config.environment.etc."ssl/certs/ca-certificates.crt".source
-                }:/etc/ssl/certs/ca-certificates.crt"
+                "${config.security.pki.caBundle}:/etc/ssl/certs/ca-certificates.crt"
                 builtins.storeDir
                 "/etc"
               ]

nixos/modules/services/continuous-integration/gocd-agent/default.nix

@@ -213,7 +213,7 @@ in
         rm -f config/autoregister.properties
         ln -s "${pkgs.writeText "autoregister.properties" cfg.agentConfig}" config/autoregister.properties
 
-        ${pkgs.git}/bin/git config --global --add http.sslCAinfo /etc/ssl/certs/ca-certificates.crt
+        ${pkgs.git}/bin/git config --global --add http.sslCAinfo ${config.security.pki.caBundle}
         ${pkgs.jre}/bin/java ${lib.concatStringsSep " " cfg.startupOptions} \
                         ${lib.concatStringsSep " " cfg.extraOptions} \
                               -jar ${pkgs.gocd-agent}/go-agent/agent-bootstrapper.jar \

nixos/modules/services/continuous-integration/gocd-server/default.nix

@@ -217,7 +217,7 @@ in
       path = cfg.packages;
 
       script = ''
-        ${pkgs.git}/bin/git config --global --add http.sslCAinfo /etc/ssl/certs/ca-certificates.crt
+        ${pkgs.git}/bin/git config --global --add http.sslCAinfo ${config.security.pki.caBundle}
         ${pkgs.jre}/bin/java -server ${concatStringsSep " " cfg.startupOptions} \
                                ${concatStringsSep " " cfg.extraOptions}  \
                               -jar ${pkgs.gocd-server}/go-server/lib/go.jar

nixos/modules/services/editors/emacs.nix

@@ -26,7 +26,7 @@ in
       description = ''
         Whether to enable a user service for the Emacs daemon. Use `emacsclient` to connect to the
         daemon. If `true`, {var}`services.emacs.install` is
-        considered `true`, whatever its value.
+        considered `true`.
       '';
     };
 

nixos/modules/services/mail/postfix.nix

@@ -591,10 +591,11 @@ in
 
       tlsTrustedAuthorities = lib.mkOption {
         type = lib.types.str;
-        default = "${pkgs.cacert}/etc/ssl/certs/ca-bundle.crt";
-        defaultText = lib.literalExpression ''"''${pkgs.cacert}/etc/ssl/certs/ca-bundle.crt"'';
+        default = config.security.pki.caBundle;
+        defaultText = lib.literalExpression "config.security.pki.caBundle";
+        example = lib.literalExpression ''"''${pkgs.cacert}/etc/ssl/certs/ca-bundle.crt"'';
         description = ''
-          File containing trusted certification authorities (CA) to verify certificates of mailservers contacted for mail delivery. This basically sets smtp_tls_CAfile and enables opportunistic tls. Defaults to NixOS trusted certification authorities.
+          File containing trusted certification authorities (CA) to verify certificates of mailservers contacted for mail delivery. This sets [smtp_tls_CAfile](https://www.postfix.org/postconf.5.html#smtp_tls_CAfile). Defaults to system trusted certificates (see `security.pki.*` options).
         '';
       };
 

nixos/modules/services/misc/db-rest.nix

@@ -162,7 +162,7 @@ in
         };
         environment = {
           NODE_ENV = "production";
-          NODE_EXTRA_CA_CERTS = "/etc/ssl/certs/ca-certificates.crt";
+          NODE_EXTRA_CA_CERTS = config.security.pki.caBundle;
           HOSTNAME = cfg.host;
           PORT = toString cfg.port;
         };

nixos/modules/services/misc/gitlab.nix

@@ -244,7 +244,7 @@ let
         ${optionalString (cfg.smtp.authentication != null) "authentication: :${cfg.smtp.authentication},"}
         enable_starttls_auto: ${boolToString cfg.smtp.enableStartTLSAuto},
         tls: ${boolToString cfg.smtp.tls},
-        ca_file: "/etc/ssl/certs/ca-certificates.crt",
+        ca_file: "${config.security.pki.caBundle}",
         openssl_verify_mode: '${cfg.smtp.opensslVerifyMode}'
       }
     end

nixos/modules/services/misc/portunus.nix

@@ -285,7 +285,7 @@ in
             in
             {
               PORTUNUS_SERVER_HTTP_SECURE = "true";
-              PORTUNUS_SLAPD_TLS_CA_CERTIFICATE = "/etc/ssl/certs/ca-certificates.crt";
+              PORTUNUS_SLAPD_TLS_CA_CERTIFICATE = config.security.pki.caBundle;
               PORTUNUS_SLAPD_TLS_CERTIFICATE = "${acmeDirectory}/cert.pem";
               PORTUNUS_SLAPD_TLS_DOMAIN_NAME = cfg.domain;
               PORTUNUS_SLAPD_TLS_PRIVATE_KEY = "${acmeDirectory}/key.pem";

nixos/modules/services/misc/radicle.nix

@@ -45,6 +45,7 @@ let
         BindReadOnlyPaths = [
           "${cfg.configFile}:${env.RAD_HOME}/config.json"
           "${if lib.types.path.check cfg.publicKey then cfg.publicKey else pkgs.writeText "radicle.pub" cfg.publicKey}:${env.RAD_HOME}/keys/radicle.pub"
+          "${config.security.pki.caBundle}:/etc/ssl/certs/ca-certificates.crt"
         ];
         KillMode = "process";
         StateDirectory = [ "radicle" ];
@@ -57,7 +58,6 @@ let
       {
         BindReadOnlyPaths = [
           "-/etc/resolv.conf"
-          "/etc/ssl/certs/ca-certificates.crt"
           "/run/systemd"
         ];
         AmbientCapabilities = "";

nixos/modules/services/misc/tandoor-recipes.nix

@@ -118,9 +118,7 @@ in
         RuntimeDirectory = "tandoor-recipes";
 
         BindReadOnlyPaths = [
-          "${
-            config.environment.etc."ssl/certs/ca-certificates.crt".source
-          }:/etc/ssl/certs/ca-certificates.crt"
+          "${config.security.pki.caBundle}:/etc/ssl/certs/ca-certificates.crt"
           builtins.storeDir
           "-/etc/resolv.conf"
           "-/etc/nsswitch.conf"

nixos/modules/services/monitoring/ocsinventory-agent.nix

@@ -53,7 +53,8 @@ in
 
             ca = lib.mkOption {
               type = lib.types.path;
-              default = "/etc/ssl/certs/ca-certificates.crt";
+              default = config.security.pki.caBundle;
+              defaultText = lib.literalExpression "config.security.pki.caBundle";
               description = ''
                 Path to CA certificates file in PEM format, for server
                 SSL certificate validation.
@@ -72,7 +73,6 @@ in
         };
         default = { };
         example = {
-          ca = "/etc/ssl/certs/ca-certificates.crt";
           debug = true;
           server = "https://ocsinventory.localhost:8080/ocsinventory";
           tag = "01234567890123";

nixos/modules/services/monitoring/parsedmarc.nix

@@ -371,7 +371,8 @@ in
 
             cert_path = lib.mkOption {
               type = lib.types.path;
-              default = "/etc/ssl/certs/ca-certificates.crt";
+              default = config.security.pki.caBundle;
+              defaultText = lib.literalExpression "config.security.pki.caBundle";
               description = ''
                 The path to a TLS certificate bundle used to verify
                 the server's certificate.

nixos/modules/services/monitoring/uptime-kuma.nix

@@ -24,7 +24,7 @@ in
         default = { };
         example = {
           PORT = "4000";
-          NODE_EXTRA_CA_CERTS = "/etc/ssl/certs/ca-certificates.crt";
+          NODE_EXTRA_CA_CERTS = lib.literalExpression "config.security.pki.caBundle";
         };
         description = ''
           Additional configuration for Uptime Kuma, see

nixos/modules/services/networking/biboumi.nix

@@ -57,7 +57,8 @@ in
           };
           options.ca_file = lib.mkOption {
             type = lib.types.path;
-            default = "/etc/ssl/certs/ca-certificates.crt";
+            default = config.security.pki.caBundle;
+            defaultText = lib.literalExpression "config.security.pki.caBundle";
             description = ''
               Specifies which file should be used as the list of trusted CA
               when negotiating a TLS session.

nixos/modules/services/networking/privoxy.nix

@@ -282,9 +282,8 @@ in
         # This allows setting absolute key/crt paths
         ca-directory = "/var/empty";
         certificate-directory = "/run/privoxy/certs";
-        trusted-cas-file = "/etc/ssl/certs/ca-certificates.crt";
+        trusted-cas-file = config.security.pki.caBundle;
       });
-
   };
 
   imports =

nixos/modules/services/networking/stunnel.nix

@@ -123,7 +123,7 @@ in
         description = ''
           Define the client configurations.
 
-          By default, verifyChain and OCSPaia are enabled and a CAFile is provided from pkgs.cacert.
+          By default, verifyChain and OCSPaia are enabled and CAFile is set to `security.pki.caBundle`.
 
           See "SERVICE-LEVEL OPTIONS" in {manpage}`stunnel(8)`.
         '';
@@ -144,7 +144,7 @@ in
             applyDefaults =
               c:
               {
-                CAFile = "${pkgs.cacert}/etc/ssl/certs/ca-bundle.crt";
+                CAFile = config.security.pki.caBundle;
                 OCSPaia = true;
                 verifyChain = true;
               }

nixos/modules/services/networking/unbound.nix

@@ -195,7 +195,7 @@ in {
         interface = mkDefault ([ "127.0.0.1" ] ++ (optional config.networking.enableIPv6 "::1"));
         access-control = mkDefault ([ "127.0.0.0/8 allow" ] ++ (optional config.networking.enableIPv6 "::1/128 allow"));
         auto-trust-anchor-file = mkIf cfg.enableRootTrustAnchor rootTrustAnchorFile;
-        tls-cert-bundle = mkDefault "/etc/ssl/certs/ca-certificates.crt";
+        tls-cert-bundle = mkDefault config.security.pki.caBundle;
         # prevent race conditions on system startup when interfaces are not yet
         # configured
         ip-freebind = mkDefault true;

nixos/modules/services/search/hound.nix

@@ -118,7 +118,7 @@ in
         User = cfg.user;
         Group = cfg.group;
         WorkingDirectory = cfg.home;
-        ExecStartPre = "${pkgs.git}/bin/git config --global --replace-all http.sslCAinfo /etc/ssl/certs/ca-certificates.crt";
+        ExecStartPre = "${pkgs.git}/bin/git config --global --replace-all http.sslCAinfo ${config.security.pki.caBundle}";
         ExecStart = "${cfg.package}/bin/houndd -addr ${cfg.listen} -conf /etc/hound/config.json";
       };
     };

nixos/modules/services/system/nix-daemon.nix

@@ -218,7 +218,7 @@ in
       environment =
         cfg.envVars
         // {
-          CURL_CA_BUNDLE = "/etc/ssl/certs/ca-certificates.crt";
+          CURL_CA_BUNDLE = config.security.pki.caBundle;
         }
         // config.networking.proxy.envVars;
 

nixos/modules/services/torrent/transmission.nix

@@ -361,7 +361,7 @@ in
       wantedBy = [ "multi-user.target" ];
 
       environment = {
-        CURL_CA_BUNDLE = etc."ssl/certs/ca-certificates.crt".source;
+        CURL_CA_BUNDLE = config.security.pki.caBundle;
         TRANSMISSION_WEB_HOME = lib.mkIf (cfg.webHome != null) cfg.webHome;
       };
 

nixos/modules/services/web-apps/cryptpad.nix

@@ -239,7 +239,7 @@ in
             "-/etc/resolv.conf"
             "-/run/systemd"
             "/etc/hosts"
-            "/etc/ssl/certs/ca-certificates.crt"
+            "${config.security.pki.caBundle}:/etc/ssl/certs/ca-certificates.crt"
           ];
         };
       };

nixos/modules/services/web-apps/dex.nix

@@ -117,7 +117,7 @@ in
             "-/etc/localtime"
             "-/etc/nsswitch.conf"
             "-/etc/resolv.conf"
-            "-/etc/ssl/certs/ca-certificates.crt"
+            "${config.security.pki.caBundle}:/etc/ssl/certs/ca-certificates.crt"
           ];
           BindPaths = optional (cfg.settings.storage.type == "postgres") "/var/run/postgresql";
           # ProtectClock= adds DeviceAllow=char-rtc r

nixos/modules/services/web-apps/grav.nix

@@ -132,7 +132,7 @@ in
             "opcache.memory_consumption" = "128";
             "opcache.revalidate_freq" = "1";
             "opcache.fast_shutdown" = "1";
-            "openssl.cafile" = "/etc/ssl/certs/ca-certificates.crt";
+            "openssl.cafile" = config.security.pki.caBundle;
             catch_workers_output = "yes";
 
             upload_max_filesize = cfg.maxUploadSize;

nixos/modules/services/web-apps/nextcloud.nix

@@ -19,7 +19,7 @@ let
     "opcache.memory_consumption" = "128";
     "opcache.revalidate_freq" = "1";
     "opcache.fast_shutdown" = "1";
-    "openssl.cafile" = "/etc/ssl/certs/ca-certificates.crt";
+    "openssl.cafile" = config.security.pki.caBundle;
     catch_workers_output = "yes";
   };
 
@@ -400,7 +400,7 @@ in {
 
     phpOptions = mkOption {
       type = with types; attrsOf (oneOf [ str int ]);
-      defaultText = literalExpression (generators.toPretty { } defaultPHPSettings);
+      defaultText = literalExpression (generators.toPretty { } (defaultPHPSettings // { "openssl.cafile" = literalExpression "config.security.pki.caBundle"; }));
       description = ''
         Options for PHP's php.ini file for nextcloud.
 
@@ -1040,12 +1040,12 @@ in {
           restartTriggers = [ overrideConfig ];
           script = ''
             ${optionalString (c.dbpassFile != null) ''
-              if [ -z "$(<$CREDENTIALS_DIRECTORY/dbpass)" ]; then
+              if [ -z "$(<"$CREDENTIALS_DIRECTORY/dbpass")" ]; then
                 echo "dbpassFile ${c.dbpassFile} is empty!"
                 exit 1
               fi
             ''}
-            if [ -z "$(<$CREDENTIALS_DIRECTORY/adminpass)" ]; then
+            if [ -z "$(<"$CREDENTIALS_DIRECTORY/adminpass")" ]; then
               echo "adminpassFile ${c.adminpassFile} is empty!"
               exit 1
             fi

nixos/modules/services/web-apps/peertube.nix

@@ -16,7 +16,7 @@ let
   env = {
     NODE_CONFIG_DIR = "/var/lib/peertube/config";
     NODE_ENV = "production";
-    NODE_EXTRA_CA_CERTS = "/etc/ssl/certs/ca-certificates.crt";
+    NODE_EXTRA_CA_CERTS = config.security.pki.caBundle;
     NPM_CONFIG_CACHE = "/var/cache/peertube/.npm";
     NPM_CONFIG_PREFIX = cfg.package;
     HOME = cfg.package;

nixos/modules/services/web-apps/sogo.nix

@@ -113,7 +113,7 @@ in
       wantedBy = [ "multi-user.target" ];
       restartTriggers = [ config.environment.etc."sogo/sogo.conf.raw".source ];
 
-      environment.LDAPTLS_CACERT = "/etc/ssl/certs/ca-certificates.crt";
+      environment.LDAPTLS_CACERT = config.security.pki.caBundle;
 
       serviceConfig = {
         Type = "forking";

nixos/tests/k3s/multi-node.nix

@@ -60,7 +60,7 @@ import ../make-test-python.nix (
 
     nodes = {
       server =
-        { pkgs, ... }:
+        { nodes, pkgs, ... }:
         {
           environment.systemPackages = with pkgs; [
             gzip
@@ -83,8 +83,12 @@ import ../make-test-python.nix (
               "--disable metrics-server"
               "--disable servicelb"
               "--disable traefik"
-              "--node-ip 192.168.1.1"
               "--pause-image test.local/pause:local"
+              "--node-ip ${nodes.server.networking.primaryIPAddress}"
+              # The interface selection logic of flannel would normally use eth0, as the nixos
+              # testing driver sets a default route via dev eth0. However, in test setups we
+              # have to use eth1 for inter-node communication.
+              "--flannel-iface eth1"
             ];
           };
           networking.firewall.allowedTCPPorts = [
@@ -93,19 +97,10 @@ import ../make-test-python.nix (
             6443
           ];
           networking.firewall.allowedUDPPorts = [ 8472 ];
-          networking.firewall.trustedInterfaces = [ "flannel.1" ];
-          networking.useDHCP = false;
-          networking.defaultGateway = "192.168.1.1";
-          networking.interfaces.eth1.ipv4.addresses = pkgs.lib.mkForce [
-            {
-              address = "192.168.1.1";
-              prefixLength = 24;
-            }
-          ];
         };
 
       server2 =
-        { pkgs, ... }:
+        { nodes, pkgs, ... }:
         {
           environment.systemPackages = with pkgs; [
             gzip
@@ -119,7 +114,7 @@ import ../make-test-python.nix (
             enable = true;
             package = k3s;
             images = [ pauseImage ];
-            serverAddr = "https://192.168.1.1:6443";
+            serverAddr = "https://${nodes.server.networking.primaryIPAddress}:6443";
             clusterInit = false;
             extraFlags = [
               "--disable coredns"
@@ -127,8 +122,9 @@ import ../make-test-python.nix (
               "--disable metrics-server"
               "--disable servicelb"
               "--disable traefik"
-              "--node-ip 192.168.1.3"
               "--pause-image test.local/pause:local"
+              "--node-ip ${nodes.server2.networking.primaryIPAddress}"
+              "--flannel-iface eth1"
             ];
           };
           networking.firewall.allowedTCPPorts = [
@@ -137,19 +133,10 @@ import ../make-test-python.nix (
             6443
           ];
           networking.firewall.allowedUDPPorts = [ 8472 ];
-          networking.firewall.trustedInterfaces = [ "flannel.1" ];
-          networking.useDHCP = false;
-          networking.defaultGateway = "192.168.1.3";
-          networking.interfaces.eth1.ipv4.addresses = pkgs.lib.mkForce [
-            {
-              address = "192.168.1.3";
-              prefixLength = 24;
-            }
-          ];
         };
 
       agent =
-        { pkgs, ... }:
+        { nodes, pkgs, ... }:
         {
           virtualisation.memorySize = 1024;
           virtualisation.diskSize = 2048;
@@ -159,23 +146,15 @@ import ../make-test-python.nix (
             role = "agent";
             package = k3s;
             images = [ pauseImage ];
-            serverAddr = "https://192.168.1.3:6443";
+            serverAddr = "https://${nodes.server2.networking.primaryIPAddress}:6443";
             extraFlags = [
               "--pause-image test.local/pause:local"
-              "--node-ip 192.168.1.2"
+              "--node-ip ${nodes.agent.networking.primaryIPAddress}"
+              "--flannel-iface eth1"
             ];
           };
           networking.firewall.allowedTCPPorts = [ 6443 ];
           networking.firewall.allowedUDPPorts = [ 8472 ];
-          networking.firewall.trustedInterfaces = [ "flannel.1" ];
-          networking.useDHCP = false;
-          networking.defaultGateway = "192.168.1.2";
-          networking.interfaces.eth1.ipv4.addresses = pkgs.lib.mkForce [
-            {
-              address = "192.168.1.2";
-              prefixLength = 24;
-            }
-          ];
         };
     };
 

pkgs/applications/audio/clementine/default.nix

@@ -24,7 +24,7 @@
   gvfs,
   libcdio,
   pcre,
-  projectm,
+  projectm_3,
   protobuf,
   qca-qt5,
   pkg-config,
@@ -84,7 +84,7 @@ stdenv.mkDerivation (finalAttrs: {
       liblastfm
       libpulseaudio
       pcre
-      projectm
+      projectm_3
       protobuf
       qca-qt5
       qjson

pkgs/applications/editors/emacs/build-support/elpa.nix

@@ -43,7 +43,9 @@ lib.extendMkDerivation {
 
           emacs --batch -Q -l "$elpa2nix" \
               -f elpa2nix-install-package \
-              "$src" "$out/share/emacs/site-lisp/elpa"
+              "$src" "$out/share/emacs/site-lisp/elpa" \
+              ${if finalAttrs.turnCompilationWarningToError then "t" else "nil"} \
+              ${if finalAttrs.ignoreCompilationError then "t" else "nil"}
 
           runHook postInstall
         '';

pkgs/applications/editors/emacs/build-support/elpa2nix.el

@@ -5,8 +5,10 @@
   (if (not noninteractive)
       (error "`elpa2nix-install-package' is to be used only with -batch"))
   (pcase command-line-args-left
-    (`(,archive ,elpa)
-     (progn (setq package-user-dir elpa)
+    (`(,archive ,elpa ,turn-compilation-warning-to-error ,ignore-compilation-error)
+     (progn (setq byte-compile-error-on-warn (string= turn-compilation-warning-to-error "t"))
+            (setq byte-compile-debug (string= ignore-compilation-error "nil"))
+            (setq package-user-dir elpa)
             (elpa2nix-install-file archive)))))
 
 (defun elpa2nix-install-from-buffer ()
@@ -31,13 +33,3 @@ The file can either be a tar file or an Emacs Lisp file."
 
 ;; Allow installing package tarfiles larger than 10MB
 (setq large-file-warning-threshold nil)
-
-(let ((flag (getenv "turnCompilationWarningToError")))
-  (when (and flag
-             ;; we do not use `string-empty-p' because it requires subr-x in Emacs <= 26
-             (not (string= flag "")))
-    (setq byte-compile-error-on-warn t)))
-
-(let ((flag (getenv "ignoreCompilationError")))
-  (when (string= flag "")
-    (setq byte-compile-debug t)))

pkgs/applications/editors/emacs/build-support/generic.nix

@@ -61,6 +61,7 @@ lib.extendMkDerivation {
       propagatedUserEnvPkgs = finalAttrs.packageRequires ++ propagatedUserEnvPkgs;
 
       strictDeps = args.strictDeps or true;
+      __structuredAttrs = args.__structuredAttrs or true;
 
       inherit turnCompilationWarningToError ignoreCompilationError;
 

pkgs/applications/editors/emacs/build-support/melpa.nix

@@ -185,7 +185,9 @@ lib.extendMkDerivation {
           emacs --batch -Q \
               -l "$elpa2nix" \
               -f elpa2nix-install-package \
-              "$archive" "$out/share/emacs/site-lisp/elpa"
+              "$archive" "$out/share/emacs/site-lisp/elpa" \
+              ${if finalAttrs.turnCompilationWarningToError then "t" else "nil"} \
+              ${if finalAttrs.ignoreCompilationError then "t" else "nil"}
 
           runHook postInstall
         '';

pkgs/applications/editors/emacs/elisp-packages/melpa-packages.nix

@@ -153,8 +153,10 @@ let
         # https://github.com/Golevka/emacs-clang-complete-async/issues/90
         auto-complete-clang-async = (addPackageRequires super.auto-complete-clang-async [ self.auto-complete ]).overrideAttrs (old: {
           buildInputs = old.buildInputs ++ [ pkgs.llvmPackages.llvm ];
-          CFLAGS = "-I${lib.getLib pkgs.llvmPackages.libclang}/include";
-          LDFLAGS = "-L${lib.getLib pkgs.llvmPackages.libclang}/lib";
+          env = old.env or { } // {
+            CFLAGS = "-I${lib.getLib pkgs.llvmPackages.libclang}/include";
+            LDFLAGS = "-L${lib.getLib pkgs.llvmPackages.libclang}/lib";
+          };
         });
 
         # part of a larger package
@@ -242,7 +244,7 @@ let
           #   - https://github.com/vedang/pdf-tools/issues/102
           #   - https://github.com/vedang/pdf-tools/issues/103
           #   - https://github.com/vedang/pdf-tools/issues/109
-          CXXFLAGS = "-std=c++17";
+          env = old.env or { } // { CXXFLAGS = "-std=c++17"; };
 
           nativeBuildInputs = old.nativeBuildInputs ++ [
             pkgs.autoconf
@@ -294,7 +296,7 @@ let
 
         irony = super.irony.overrideAttrs (old: {
           cmakeFlags = old.cmakeFlags or [ ] ++ [ "-DCMAKE_INSTALL_BINDIR=bin" ];
-          env.NIX_CFLAGS_COMPILE = "-UCLANG_RESOURCE_DIR";
+          env = old.env or { } // { NIX_CFLAGS_COMPILE = "-UCLANG_RESOURCE_DIR"; };
           preConfigure = ''
             pushd server
           '';

pkgs/applications/misc/prusa-slicer/default.nix

@@ -68,14 +68,10 @@ let
   openvdb_tbb_2021_8 = openvdb.override { tbb = tbb_2021_11; };
   wxGTK-override' = if wxGTK-override == null then wxGTK-prusa else wxGTK-override;
   opencascade-override' = if opencascade-override == null then opencascade-occt_7_6_1 else opencascade-override;
-
-  patches = [
-  ];
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "prusa-slicer";
   version = "2.9.0";
-  inherit patches;
 
   src = fetchFromGitHub {
     owner = "prusa3d";
@@ -84,6 +80,12 @@ stdenv.mkDerivation (finalAttrs: {
     rev = "version_${finalAttrs.version}";
   };
 
+  # https://github.com/prusa3d/PrusaSlicer/pull/14010
+  patches = [(fetchpatch {
+    url = "https://github.com/prusa3d/PrusaSlicer/commit/cdc3db58f9002778a0ca74517865527f50ade4c3.patch";
+    hash = "sha256-zgpGg1jtdnCBaWjR6oUcHo5sGuZx5oEzpux3dpRdMAM=";
+  })];
+
   # required for GCC 14
   # (not applicable to super-slicer fork)
   postPatch = lib.optionalString (finalAttrs.pname == "prusa-slicer") ''

pkgs/applications/networking/ktailctl/default.nix

@@ -26,13 +26,13 @@
 }:
 
 let
-  version = "0.19.3";
+  version = "0.20.0";
 
   src = fetchFromGitHub {
     owner = "f-koehler";
     repo = "KTailctl";
     rev = "v${version}";
-    hash = "sha256-0P3cvBI5CM03y6Km7d31Z3ZzpGW3y1oKkprpPglrujg=";
+    hash = "sha256-BgxWsT/s5Hv5cvzcSjfrgAmZhcoquaydSZKdPmld4Rg=";
   };
 
   goDeps =
@@ -40,7 +40,7 @@ let
       pname = "ktailctl-go-wrapper";
       inherit src version;
       modRoot = "src/wrapper";
-      vendorHash = "sha256-o7eH3f+yeRr5CnBIuL2jMtVQaBLVihz2dg5RTF8RvaM=";
+      vendorHash = "sha256-ntk4WyJYEi6ZX2MyXMGgsYVqhAUQSGJLHWiNLkCwMEY=";
     }).goModules;
 in
 stdenv.mkDerivation {

pkgs/applications/radio/qsstv/default.nix

@@ -19,7 +19,7 @@ mkDerivation rec {
   pname = "qsstv";
 
   src = fetchurl {
-    url = "http://users.telenet.be/on4qz/qsstv/downloads/qsstv_${version}.tar.gz";
+    url = "https://www.qsl.net/o/on4qz/qsstv/downloads/qsstv_${version}.tar.gz";
     sha256 = "0s3sivc0xan6amibdiwfnknrl3248wzgy98w6gyxikl0qsjpygy0";
   };
 
@@ -48,7 +48,7 @@ mkDerivation rec {
   meta = with lib; {
     description = "Qt-based slow-scan TV and fax";
     mainProgram = "qsstv";
-    homepage = "http://users.telenet.be/on4qz/";
+    homepage = "https://www.qsl.net/on4qz/";
     platforms = platforms.linux;
     license = lib.licenses.gpl3;
     maintainers = with lib.maintainers; [ hax404 ];

pkgs/applications/video/kodi/addons/visualization-projectm/default.nix

@@ -1,4 +1,4 @@
-{ lib, rel, buildKodiBinaryAddon, fetchFromGitHub, pkg-config, glm, libGL, projectm }:
+{ lib, rel, buildKodiBinaryAddon, fetchFromGitHub, pkg-config, glm, libGL, projectm_3 }:
 
 buildKodiBinaryAddon rec {
   pname = "visualization-projectm";
@@ -12,7 +12,7 @@ buildKodiBinaryAddon rec {
     hash = "sha256-J3RtVl+hO8DspLyF2KAVMLDIJBiEb0bKosKhJyKy9hk=";
   };
 
-  extraBuildInputs = [ pkg-config libGL projectm ];
+  extraBuildInputs = [ pkg-config libGL projectm_3 ];
 
   propagatedBuildInputs = [ glm ];
   meta = with lib; {

pkgs/build-support/rust/build-rust-crate/default.nix

@@ -13,6 +13,10 @@
 , cargo
 , jq
 , libiconv
+# Controls codegen parallelization for all crates.
+# May be overriden on a per-crate level.
+# See <https://doc.rust-lang.org/rustc/codegen-options/index.html#codegen-units>
+, defaultCodegenUnits ? 1
 }:
 
 let
@@ -339,7 +343,7 @@ crate_: lib.makeOverridable
       colors = lib.attrByPath [ "colors" ] "always" crate;
       extraLinkFlags = lib.concatStringsSep " " (crate.extraLinkFlags or [ ]);
       edition = crate.edition or null;
-      codegenUnits = if crate ? codegenUnits then crate.codegenUnits else 1;
+      codegenUnits = if crate ? codegenUnits then crate.codegenUnits else defaultCodegenUnits;
       extraRustcOpts =
         lib.optionals (crate ? extraRustcOpts) crate.extraRustcOpts
           ++ extraRustcOpts_

pkgs/by-name/ae/aerc/package.nix

@@ -3,6 +3,7 @@
   buildGoModule,
   fetchFromSourcehut,
   ncurses,
+  withNotmuch ? true,
   notmuch,
   scdoc,
   python3Packages,
@@ -50,14 +51,13 @@ buildGoModule rec {
 
   buildInputs = [
     python3Packages.python
-    notmuch
     gawk
-  ];
+  ] ++ lib.optional withNotmuch notmuch;
 
   installPhase = ''
     runHook preInstall
 
-    make $makeFlags GOFLAGS="$GOFLAGS -tags=notmuch" install
+    make $makeFlags GOFLAGS="$GOFLAGS${lib.optionalString withNotmuch " -tags=notmuch"}" install
 
     runHook postInstall
   '';

pkgs/by-name/be/benchexec/package.nix

@@ -9,17 +9,22 @@
 }:
 python3.pkgs.buildPythonApplication rec {
   pname = "benchexec";
-  version = "3.21";
+  version = "3.27";
 
   src = fetchFromGitHub {
     owner = "sosy-lab";
     repo = "benchexec";
     rev = version;
-    hash = "sha256-bE3brmmLHZQakDKvd47I1hm9Dcsu6DrSeJyjWWtEZWI=";
+    hash = "sha256-lokz7klAQAascij0T/T43/PrbMh6ZUAvFnIqg13pVUk=";
   };
 
   pyproject = true;
 
+  postPatch = ''
+    substituteInPlace pyproject.toml \
+      --replace-fail 'setuptools ==' 'setuptools >='
+  '';
+
   nativeBuildInputs = with python3.pkgs; [ setuptools ];
 
   # NOTE: CPU Energy Meter is not added,

pkgs/by-name/bu/buffybox/package.nix

@@ -15,15 +15,15 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "buffybox";
-  version = "3.2.0-unstable-2024-12-09";
+  version = "3.2.0-unstable-2025-02-27";
 
   src = fetchFromGitLab {
     domain = "gitlab.postmarketos.org";
     owner = "postmarketOS";
     repo = "buffybox";
     fetchSubmodules = true; # to use its vendored lvgl
-    rev = "32f4837e836fbb0b820d68c74c3278c925369b04";
-    hash = "sha256-d9fa/Zqbm/+WMRmO0hBW83PCTDgaVOAxyRuSTItr9Xs=";
+    rev = "6bf7a8406f3a3fa79831d2d151e519b703b9e135";
+    hash = "sha256-q3TNYRv5Cim+WklXw2ZTW6Ico1h8Xxs9MhTFhHZUMW0=";
   };
 
   depsBuildBuild = [

pkgs/by-name/bu/bunster/package.nix

@@ -9,13 +9,13 @@
 
 buildGoModule rec {
   pname = "bunster";
-  version = "0.8.0";
+  version = "0.9.0";
 
   src = fetchFromGitHub {
     owner = "yassinebenaid";
     repo = "bunster";
     tag = "v${version}";
-    hash = "sha256-ZooaM9zi6tC7Y6Oks7OEtMPX0+4kd1UaBGzfNLgCj10=";
+    hash = "sha256-HE5Wp5A0wc5jgs9kNkCH1f82Y+SkILHvOwlQAsC6DVU=";
   };
 
   vendorHash = "sha256-Gs+8J+yEVynsBte3Hnx7jnYRPa/61CIISDbMyDKhPRE=";

pkgs/by-name/du/dunst/package.nix

@@ -31,13 +31,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "dunst";
-  version = "1.12.1";
+  version = "1.12.2";
 
   src = fetchFromGitHub {
     owner = "dunst-project";
     repo = "dunst";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-MC35UE6cA1xA1qaOppvHAjuevbl2z0Twct1G5Uv84pU=";
+    hash = "sha256-i5/rRlxs+voEXL3udY+55l2mU54yep8RpmLOZpGtDeM=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/fe/feedbackd/package.nix

@@ -20,6 +20,7 @@
   dbus,
   gmobile,
   umockdev,
+  nix-update-script,
 }:
 
 let
@@ -33,7 +34,7 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "feedbackd";
-  version = "0.4.1";
+  version = "0.7.0";
 
   outputs = [
     "out"
@@ -46,7 +47,7 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "Librem5";
     repo = "feedbackd";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-ta14DYqkid8Cp8fx9ZMGOOJroCBszN9/VrTN6mrpTZg=";
+    hash = "sha256-qwyq1v+20Gotpk0CbUe6MdDJ5bmKmTHOen+rxWljjeA=";
   };
 
   depsBuildBuild = [
@@ -106,11 +107,18 @@ stdenv.mkDerivation (finalAttrs: {
     fi
   '';
 
+  passthru = {
+    updateScript = nix-update-script { };
+  };
+
   meta = with lib; {
     description = "Daemon to provide haptic (and later more) feedback on events";
     homepage = "https://source.puri.sm/Librem5/feedbackd";
     license = licenses.gpl3Plus;
-    maintainers = with maintainers; [ pacman99 ];
+    maintainers = with maintainers; [
+      pacman99
+      Luflosi
+    ];
     platforms = platforms.linux;
   };
 })

pkgs/by-name/fi/fishy/package.nix

@@ -0,0 +1,43 @@
+{
+  fetchFromGitHub,
+  lib,
+  nix-update-script,
+  openssl,
+  pkg-config,
+  rustPlatform,
+  versionCheckHook,
+}:
+
+rustPlatform.buildRustPackage rec {
+  pname = "fishy";
+  version = "0.2.1";
+
+  src = fetchFromGitHub {
+    owner = "p2panda";
+    repo = "fishy";
+    tag = "v${version}";
+    hash = "sha256-nRkP53v9+VzqHKTsHs+cBeLjh3yASFE18sSEY02NR1s=";
+  };
+
+  useFetchCargoVendor = true;
+  cargoHash = "sha256-F4zbalop1PEb381DctUIzdm3v71b6M/hnuw9BuIEkBU=";
+
+  OPENSSL_NO_VENDOR = 1;
+
+  nativeBuildInputs = [ pkg-config ];
+  buildInputs = [ openssl ];
+
+  nativeInstallCheckInputs = [ versionCheckHook ];
+  versionCheckProgramArg = "--version";
+  doInstallCheck = true;
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "Create, manage and deploy p2panda schemas";
+    homepage = "https://github.com/p2panda/fishy";
+    changelog = "https://github.com/p2panda/fishy/blob/${src.rev}/CHANGELOG.md";
+    license = lib.licenses.agpl3Only;
+    maintainers = with lib.maintainers; [ confusedalex ];
+    mainProgram = "fishy";
+  };
+}

pkgs/by-name/fp/fping/package.nix

@@ -6,11 +6,11 @@
 
 stdenv.mkDerivation rec {
   pname = "fping";
-  version = "5.2";
+  version = "5.3";
 
   src = fetchurl {
     url = "https://www.fping.org/dist/fping-${version}.tar.gz";
-    hash = "sha256-p2ktENc/sLt24fdFmqfxm7zb/Frb7e8C9GiXSxiw5C8=";
+    hash = "sha256-1XvQFBrqCC4638GYv8PbXf0SpwFMfCZV6X9hzVSQHQ4=";
   };
 
   configureFlags = [

pkgs/by-name/gd/gdmd/0001-gdc-store-path.diff

@@ -0,0 +1,11 @@
+--- a/dmd-script
++++ b/dmd-script
+@@ -72,7 +72,7 @@ my @run_args;
+ # for the target prefix.
+ basename($0) =~ m/^(.*-)?g?dmd(-.*)?$/;
+ my $target_prefix = $1?$1:"";
+-my $gdc_dir = abs_path(dirname($0));
++my $gdc_dir = "@gdc_dir@";
+ my $gdc = File::Spec->catfile( $gdc_dir, $target_prefix . "gdc" . ($2?$2:""));
+ 
+ sub osHasEXE() {

pkgs/by-name/gd/gdmd/package.nix

@@ -0,0 +1,49 @@
+{
+  lib,
+  stdenvNoCC,
+  fetchFromGitHub,
+  substituteAll,
+  gdc,
+  perl,
+}:
+stdenvNoCC.mkDerivation {
+  pname = "gdmd";
+  version = "0.1.0-unstable-2024-05-30";
+
+  src = fetchFromGitHub {
+    owner = "D-Programming-GDC";
+    repo = "gdmd";
+    rev = "dc0ad9f739795f3ce5c69825efcd5d1d586bb013";
+    hash = "sha256-Sw8ExEPDvGqGKcM9VKnOI6MGgXW0tAu51A90Wi4qrRE=";
+  };
+
+  patches = [
+    (substituteAll {
+      src = ./0001-gdc-store-path.diff;
+      gdc_dir = "${gdc}/bin";
+    })
+  ];
+
+  buildInputs = [
+    gdc
+    perl
+  ];
+
+  installFlags = [
+    "DESTDIR=$(out)"
+    "prefix="
+  ];
+
+  preInstall = ''
+    install -d $out/bin $out/share/man/man1
+  '';
+
+  meta = {
+    description = "Wrapper for GDC that emulates DMD's command line";
+    homepage = "https://gdcproject.org";
+    license = lib.licenses.gpl3Plus;
+    platforms = lib.platforms.all;
+    maintainers = with lib.maintainers; [ jtbx ];
+    mainProgram = "gdmd";
+  };
+}

pkgs/by-name/gi/gitxray/package.nix

@@ -6,14 +6,14 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "gitxray";
-  version = "1.0.17.2";
+  version = "1.0.17.3";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "kulkansecurity";
     repo = "gitxray";
     tag = version;
-    hash = "sha256-EcDKjUC1Zi6zSvOQRhozzKPrBLjODk8+Lqpagh55LCc=";
+    hash = "sha256-MfYK6D6QkIQRTsnNAiJsfPeYcUTO/BTe0AtczeONSsg=";
   };
 
   build-system = with python3.pkgs; [ setuptools ];

pkgs/by-name/im/imhex/package.nix

@@ -27,8 +27,8 @@
 }:
 
 let
-  version = "1.37.1";
-  patterns_version = "1.37.1";
+  version = "1.37.4";
+  patterns_version = "1.37.4";
 
   patterns_src = fetchFromGitHub {
     name = "ImHex-Patterns-source-${patterns_version}";
@@ -49,7 +49,7 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "WerWolv";
     repo = "ImHex";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-0vfetOUYQmi3FNWI8+QkBHJe2Crg4LNrKeT1vSTdsjM=";
+    hash = "sha256-uenwAaIjtBzrtiLdy6fh5TxtbWtUJbtybNOLP3+8blA=";
   };
 
   strictDeps = true;

pkgs/by-name/jw/jwx/package.nix

@@ -6,13 +6,13 @@
 
 buildGoModule rec {
   pname = "jwx";
-  version = "2.1.3";
+  version = "2.1.4";
 
   src = fetchFromGitHub {
     owner = "lestrrat-go";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-CuxBfR+q+2JCe7F1gruGrVM+UBkrmz5dEyrDtFdmbhM=";
+    hash = "sha256-UXiF3X1jLk4dCGKmZlx9V08hzNJV+s/K2Wei9i+A6dg=";
   };
 
   vendorHash = "sha256-ZS7xliFymXTE8hlc3GEMNonP5sJTZGirw5YQNzPCl3Y=";

pkgs/by-name/li/libipt/package.nix

@@ -20,6 +20,10 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [ cmake ];
   buildInputs = lib.optional stdenv.hostPlatform.isFreeBSD freebsd.libstdthreads;
 
+  env = lib.optionalAttrs stdenv.hostPlatform.isFreeBSD {
+    NIX_LDFLAGS = "-lstdthreads";
+  };
+
   meta = with lib; {
     description = "Intel Processor Trace decoder library";
     homepage = "https://github.com/intel/libipt";

pkgs/by-name/li/libprojectm/package.nix

@@ -0,0 +1,46 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  cmake,
+  libGL,
+  xorg,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "libprojectm";
+  version = "4.1.4";
+
+  src = fetchFromGitHub {
+    owner = "projectM-visualizer";
+    repo = "projectm";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-gf1k9iSDARp6/M2/Po1wdOEY6y/QG2nq5uhSFU6bxAM=";
+    fetchSubmodules = true;
+  };
+
+  nativeBuildInputs = [
+    cmake
+  ];
+
+  buildInputs = [
+    libGL
+    xorg.libX11
+  ];
+
+  strictDeps = true;
+
+  meta = {
+    description = "Cross-platform Milkdrop-compatible Music Visualization Library";
+    homepage = "https://github.com/projectM-visualizer/projectm";
+    license = lib.licenses.lgpl21Plus;
+    maintainers = with lib.maintainers; [ fgaz ];
+    platforms = lib.platforms.all;
+    longDescription = ''
+      The open-source project that reimplements the esteemed Winamp Milkdrop by
+      Geiss in a more modern, cross-platform reusable library.
+      Read an audio input and produces mesmerizing visuals, detecting tempo, and
+      rendering advanced equations into a limitless array of user-contributed visualizations.
+    '';
+  };
+})

pkgs/by-name/li/linux-manual/package.nix

@@ -1,18 +1,21 @@
 {
   lib,
   stdenv,
-  perl,
   linuxPackages_latest,
+  perl,
+  man,
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation {
   pname = "linux-manual";
   inherit (linuxPackages_latest.kernel) version src;
 
   nativeBuildInputs = [ perl ];
+  nativeInstallCheckInputs = [ man ];
 
   dontConfigure = true;
   dontBuild = true;
+  doInstallCheck = true;
 
   postPatch = ''
     patchShebangs --build \
@@ -21,25 +24,37 @@ stdenv.mkDerivation rec {
   '';
 
   installPhase = ''
-    mandir=$out/share/man/man9
-    mkdir -p $mandir
+    runHook preInstall
 
-    KBUILD_BUILD_TIMESTAMP=$(stat -c %Y Makefile) \
+    export mandir="$out/share/man/man9"
+    mkdir -p "$mandir"
+
+    KBUILD_BUILD_TIMESTAMP="$(date -u -d "@$SOURCE_DATE_EPOCH")" \
     grep -F -l -Z \
       --exclude-dir Documentation \
       --exclude-dir tools \
       -R '/**' \
-      | xargs -0 -n 256 -P $NIX_BUILD_CORES \
-        $SHELL -c '{ scripts/kernel-doc -man "$@" || :; } \
-          | scripts/split-man.pl '$mandir kernel-doc
+      | xargs -0 -n 256 -P "$NIX_BUILD_CORES" \
+        "$SHELL" -c '{ scripts/kernel-doc -man "$@" || :; } \
+          | scripts/split-man.pl "$mandir"' kernel-doc
 
-    test -f $mandir/kmalloc.9
+    runHook postInstall
   '';
 
-  meta = with lib; {
+  installCheckPhase = ''
+    runHook preInstallCheck
+
+    # Check for well‐known man page
+    man -M "$out/share/man" -P cat 9 kmalloc >/dev/null
+
+    runHook postInstallCheck
+  '';
+
+  meta = {
     homepage = "https://kernel.org/";
     description = "Linux kernel API manual pages";
-    license = licenses.gpl2Only;
-    maintainers = with maintainers; [ mvs ];
+    license = lib.licenses.gpl2Only;
+    maintainers = with lib.maintainers; [ mvs ];
+    platforms = lib.platforms.linux;
   };
 }

pkgs/by-name/ni/nixfmt-rfc-style/date.txt

@@ -1 +1 @@
-2024-12-04
+2025-03-03

pkgs/by-name/ni/nixfmt-rfc-style/generated-package.nix

@@ -14,6 +14,7 @@
   mtl,
   parser-combinators,
   pretty-simple,
+  process,
   safe-exceptions,
   scientific,
   text,
@@ -24,8 +25,8 @@ mkDerivation {
   pname = "nixfmt";
   version = "0.6.0";
   src = fetchzip {
-    url = "https://github.com/nixos/nixfmt/archive/a4639036723e510d8331124c80d9ca14dd7aba02.tar.gz";
-    sha256 = "0zpkljcvfnwn1ik5cgvq396xkpp053k4lh62a24c4g434n2vz0rj";
+    url = "https://github.com/nixos/nixfmt/archive/3261d1016ecc753c59ff92767a257f91b587e705.tar.gz";
+    sha256 = "0jk6mgp710iwxyc7wa5kzz0p0rpcwbbs21smnv14cyii0jniz42s";
   };
   isLibrary = true;
   isExecutable = true;
@@ -46,6 +47,7 @@ mkDerivation {
     directory
     file-embed
     filepath
+    process
     safe-exceptions
     text
     transformers

pkgs/by-name/nu/nuclei/package.nix

@@ -7,16 +7,16 @@
 
 buildGoModule rec {
   pname = "nuclei";
-  version = "3.3.9";
+  version = "3.3.10";
 
   src = fetchFromGitHub {
     owner = "projectdiscovery";
     repo = "nuclei";
     tag = "v${version}";
-    hash = "sha256-9P8KSuhTI/m0m51PUTZGU+qRbnT3izPbHTzsqZNbMJE=";
+    hash = "sha256-5+alARFuxwJlPYki5TU+4GdaJhBEYXbXH0BrCj2/aic=";
   };
 
-  vendorHash = "sha256-CTdB/+aVaXKqtiwHn8pgmhXjZ0mIDrmLvnKmisExi74=";
+  vendorHash = "sha256-l3733hg11+Qg4h68DnXoD8LyYiB+iFyZyKggpCAsx7Q=";
 
   proxyVendor = true; # hash mismatch between Linux and Darwin
 

pkgs/by-name/ol/ollama/package.nix

@@ -1,6 +1,6 @@
 {
   lib,
-  buildGoModule,
+  buildGo124Module,
   fetchFromGitHub,
   fetchpatch,
   buildEnv,
@@ -44,17 +44,19 @@ assert builtins.elem acceleration [
 let
   pname = "ollama";
   # don't forget to invalidate all hashes each update
-  version = "0.5.12";
+  version = "0.5.13";
+
+  buildGoModule = buildGo124Module;
 
   src = fetchFromGitHub {
     owner = "ollama";
     repo = "ollama";
     tag = "v${version}";
-    hash = "sha256-le3OeGC/rddY9NNgmO7YcFthsZSQiO+gGSkpcV+TNXo=";
+    hash = "sha256-GRufz01lTSgBmDzRImY02xuAeuzjlIEFWv578fI8ciY=";
     fetchSubmodules = true;
   };
 
-  vendorHash = "sha256-ON9ow9/KglBy+RKNhw1n3E5AJtpjPQvJwNAQTaWzEFA=";
+  vendorHash = "sha256-s/qvMISNpxeEAZx8Je2v4yb2aPWhSYcKhwHQcEXJ20Y=";
 
   validateFallback = lib.warnIf (config.rocmSupport && config.cudaSupport) (lib.concatStrings [
     "both `nixpkgs.config.rocmSupport` and `nixpkgs.config.cudaSupport` are enabled, "

pkgs/by-name/os/osu-lazer-bin/package.nix

@@ -10,23 +10,23 @@
 
 let
   pname = "osu-lazer-bin";
-  version = "2025.225.0";
+  version = "2025.306.0";
 
   src =
     {
       aarch64-darwin = fetchzip {
         url = "https://github.com/ppy/osu/releases/download/${version}/osu.app.Apple.Silicon.zip";
-        hash = "sha256-8KwLHRaGOdlTcByGzQzD28rxPiHhQewFc8bOU3Wh2Ak=";
+        hash = "sha256-VbzHD7LQstBXmSIkDpue6kPGHEzFO+Fy22eLYj+rNcw=";
         stripRoot = false;
       };
       x86_64-darwin = fetchzip {
         url = "https://github.com/ppy/osu/releases/download/${version}/osu.app.Intel.zip";
-        hash = "sha256-0CWRMB4JjC+uY1b2jMQsRuIcBNCKtcV27N9Q5uW4DFs=";
+        hash = "sha256-1KC0PnTMgN0GFhNYmlqfqWSVEpo8i+gb4nVHEwBMSS8=";
         stripRoot = false;
       };
       x86_64-linux = fetchurl {
         url = "https://github.com/ppy/osu/releases/download/${version}/osu.AppImage";
-        hash = "sha256-detSX0/akBJE2bdTxUvUUlBMKswHPF1qg9tsWZ00zso=";
+        hash = "sha256-A9CWoTvByyNkULQ2abeVgiwAmSmyHx9IZqtHGS+bW6Y=";
       };
     }
     .${stdenvNoCC.system} or (throw "osu-lazer-bin: ${stdenvNoCC.system} is unsupported.");

pkgs/by-name/os/osu-lazer/deps.json

@@ -666,8 +666,8 @@
   },
   {
     "pname": "ppy.osu.Game.Resources",
-    "version": "2025.217.0",
-    "hash": "sha256-ERVop92Ss/SdmcN7m1sxQRqC8Sxr9NaL3v/V3JxqUq4="
+    "version": "2025.303.0",
+    "hash": "sha256-+Lnin+oEo67ARp9RFWOe00JcOL73O9gh/XJFIF151Yg="
   },
   {
     "pname": "ppy.osuTK.NS20",

pkgs/by-name/os/osu-lazer/package.nix

@@ -21,13 +21,13 @@
 
 buildDotnetModule rec {
   pname = "osu-lazer";
-  version = "2025.225.0";
+  version = "2025.306.0";
 
   src = fetchFromGitHub {
     owner = "ppy";
     repo = "osu";
     tag = version;
-    hash = "sha256-iqIzspQn1W+Qd5lCkuVknog8I2BEBLdO46Pw+j0H1zc=";
+    hash = "sha256-SqPwVQGmtkaF/Mkcp4WnKRYNXSQD3+56XbNVw9ZMr+A=";
   };
 
   projectFile = "osu.Desktop/osu.Desktop.csproj";

pkgs/by-name/pp/ppsspp/package.nix

@@ -89,6 +89,8 @@ stdenv.mkDerivation (finalAttrs: {
       libffi
     ];
 
+  dontWrapQtApps = true;
+
   cmakeFlags = [
     (lib.cmakeBool "HEADLESS" (!enableQt))
     (lib.cmakeBool "USE_SYSTEM_FFMPEG" useSystemFfmpeg)
@@ -147,9 +149,16 @@ stdenv.mkDerivation (finalAttrs: {
         lib.optionals enableVulkan [
           "--prefix LD_LIBRARY_PATH : ${lib.makeLibraryPath [ vulkan-loader ]}"
         ]
-        ++ lib.optionals (!enableQt) [
-          "--set SDL_VIDEODRIVER ${if forceWayland then "wayland" else "x11"}"
-        ]
+        ++ (
+          if enableQt then
+            [
+              "\${qtWrapperArgs[@]}"
+            ]
+          else
+            [
+              "--set SDL_VIDEODRIVER ${if forceWayland then "wayland" else "x11"}"
+            ]
+        )
       );
       binToBeWrapped = if enableQt then "PPSSPPQt" else "PPSSPPSDL";
     in

pkgs/by-name/pr/projectm-sdl-cpp/package.nix

@@ -0,0 +1,64 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  cmake,
+  libprojectm,
+  poco,
+  utf8proc,
+  SDL2,
+  unstableGitUpdater,
+}:
+
+stdenv.mkDerivation {
+  pname = "projectm-sdl-cpp";
+  version = "0-unstable-2024-08-07";
+
+  src = fetchFromGitHub {
+    owner = "projectM-visualizer";
+    repo = "frontend-sdl-cpp";
+    rev = "df6bfb51d7be335b4c258e2085f13d14e27f14a9";
+    hash = "sha256-WcQMwI0i7hON31FpgBSSUoqqlENj6SUwKTXfl7i6jn4=";
+    fetchSubmodules = true;
+  };
+
+  # Probably an artifact of the vcpkg package
+  postPatch = ''
+    substituteInPlace ImGui.cmake \
+      --replace-fail "SDL2::SDL2main" ""
+    substituteInPlace src/CMakeLists.txt \
+      --replace-fail "SDL2::SDL2main" ""
+  '';
+
+  cmakeFlags = [
+    # Doesn't seem to be present in the source tree, so the installation fails if enabled
+    (lib.cmakeBool "ENABLE_DESKTOP_ICON" false)
+  ];
+
+  nativeBuildInputs = [
+    cmake
+  ];
+
+  buildInputs = [
+    libprojectm
+    poco
+    utf8proc
+    SDL2
+  ];
+
+  # poco 1.14 requires c++17
+  NIX_CFLAGS_COMPILE = [ "-std=gnu++17" ];
+
+  strictDeps = true;
+
+  passthru.updateScript = unstableGitUpdater { };
+
+  meta = {
+    description = "Standalone application based on libprojectM and libSDL that turns your desktop audio into awesome visuals";
+    homepage = "https://github.com/projectM-visualizer/frontend-sdl-cpp";
+    license = lib.licenses.gpl3Only;
+    maintainers = with lib.maintainers; [ fgaz ];
+    mainProgram = "projectMSDL";
+    platforms = lib.platforms.all;
+  };
+}

pkgs/by-name/ro/roc-toolkit/package.nix

@@ -68,6 +68,7 @@ stdenv.mkDerivation rec {
     ++ lib.optional (!libunwindSupport) "--disable-libunwind"
     ++ lib.optional (!pulseaudioSupport) "--disable-pulseaudio"
     ++ lib.optional (!libsndfileSupport) "--disable-sndfile"
+    ++ lib.optional stdenv.hostPlatform.isFreeBSD "--platform=unix"
     ++ (
       if (!openfecSupport) then
         [ "--disable-openfec" ]
@@ -78,6 +79,11 @@ stdenv.mkDerivation rec {
         ]
     );
 
+  env = lib.optionalAttrs stdenv.hostPlatform.isFreeBSD {
+    NIX_CFLAGS_COMPILE = "-D_XOPEN_SOURCE=700 -D__BSD_VISIBLE";
+    NIX_LDFLAGS = "-lpthread";
+  };
+
   meta = with lib; {
     description = "Roc is a toolkit for real-time audio streaming over the network";
     homepage = "https://github.com/roc-streaming/roc-toolkit";

pkgs/by-name/si/siyuan/package.nix

@@ -35,20 +35,20 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "siyuan";
-  version = "3.1.22";
+  version = "3.1.24";
 
   src = fetchFromGitHub {
     owner = "siyuan-note";
     repo = "siyuan";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-t7BJBip28xPT4/iNL/zTKzFCcQOt0E4IAT00l/iX6TM=";
+    hash = "sha256-BrFyMaxACkdjQy151vIYiJ9WotogEbEKWnFXNhyqKw4=";
   };
 
   kernel = buildGo123Module {
     name = "${finalAttrs.pname}-${finalAttrs.version}-kernel";
     inherit (finalAttrs) src;
     sourceRoot = "${finalAttrs.src.name}/kernel";
-    vendorHash = "sha256-iO4Qtt0+nHpiYz0gSq+z3XWRp8TBJU8psI0Hz4ofZGA=";
+    vendorHash = "sha256-2ryd+GciVGmvqLNgdvoHC1tjjnFZgWO2uObj8uNwu0E=";
 
     patches = [
       (replaceVars ./set-pandoc-path.patch {
@@ -89,7 +89,7 @@ stdenv.mkDerivation (finalAttrs: {
       src
       sourceRoot
       ;
-    hash = "sha256-GW/shXuaETg/8+d0T876mh5pKJHS4slfakObj8zrNXc=";
+    hash = "sha256-yfcgSCL78hGcq/QDvqx9jMLivW06oRVzI8iqQ7gCrlQ=";
   };
 
   sourceRoot = "${finalAttrs.src.name}/app";

pkgs/by-name/sm/sm64coopdx/package.nix

@@ -36,13 +36,13 @@ in
 # note: there is a generic builder in pkgs/games/sm64ex/generic.nix that is meant to help build sm64ex and its forks; however sm64coopdx has departed significantly enough in its build that it doesn't make sense to use that other than the baseRom derivation
 stdenv.mkDerivation (finalAttrs: {
   pname = "sm64coopdx";
-  version = "1.1.1";
+  version = "1.2.1";
 
   src = fetchFromGitHub {
     owner = "coop-deluxe";
     repo = "sm64coopdx";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-ktdvzOUYSh6H49BVDovqYt5CGyvJi4UW6nJOOD/HGGU=";
+    hash = "sha256-QWxhu7wGIjOIJyqjqakUzhhF+WxQslZdX3aEWYdDZbw=";
   };
 
   nativeBuildInputs = [ makeWrapper ];

pkgs/by-name/sn/snakefmt/package.nix

@@ -0,0 +1,46 @@
+{
+  lib,
+  python3,
+  fetchPypi,
+  nix-update-script,
+  versionCheckHook,
+}:
+
+python3.pkgs.buildPythonApplication rec {
+  pname = "snakefmt";
+  version = "0.10.2";
+  pyproject = true;
+
+  disabled = python3.pythonOlder "3.8.1";
+
+  src = fetchPypi {
+    inherit pname version;
+    hash = "sha256-QoalkDtm2n5SdjxegYTaTtyVETt1j0RIUogE+1T5t1o=";
+  };
+
+  build-system = [ python3.pkgs.poetry-core ];
+
+  dependencies = with python3.pkgs; [
+    black
+    click
+    importlib-metadata
+    toml
+  ];
+
+  pythonImportsCheck = [ "snakefmt" ];
+
+  nativeInstallCheckInputs = [ versionCheckHook ];
+  versionCheckProgramArg = "--version";
+  doInstallCheck = true;
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "Uncompromising Snakemake code formatter";
+    homepage = "https://pypi.org/project/snakefmt/";
+    changelog = "https://github.com/snakemake/snakefmt/releases/tag/v${version}";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ jolars ];
+    mainProgram = "snakefmt";
+  };
+}

pkgs/by-name/su/super-productivity/package.nix

@@ -1,51 +1,137 @@
-{ stdenv , lib , fetchurl , appimageTools , makeWrapper , electron }:
+{
+  buildNpmPackage,
+  copyDesktopItems,
+  electron,
+  fetchFromGitHub,
+  lib,
+  makeDesktopItem,
+  nix-update-script,
+  npm-lockfile-fix,
+  python3,
+  stdenv,
+}:
 
-stdenv.mkDerivation rec {
+buildNpmPackage rec {
   pname = "super-productivity";
-  version = "11.1.2";
+  version = "11.1.3";
 
-  src = fetchurl {
-    url = "https://github.com/johannesjo/super-productivity/releases/download/v${version}/superProductivity-x86_64.AppImage";
-    sha256 = "sha256-AtN7x0Vt0wWxNoXwRc78drFE8UfMpssFBYZ83w1QgbU=";
-    name = "${pname}-${version}.AppImage";
+  src = fetchFromGitHub {
+    owner = "johannesjo";
+    repo = "super-productivity";
+    tag = "v${version}";
+    hash = "sha256-GWpKz1q3pmAozlzawi2ITxo3KH0MSrJCszVQdGTeOXA=";
+
+    postFetch = ''
+      ${lib.getExe npm-lockfile-fix} -r $out/package-lock.json
+    '';
   };
 
-  appimageContents = appimageTools.extractType2 {
-    inherit pname version src;
+  npmDepsHash = "sha256-iP1op4R7OUA7cSW/dJCBBGcb5r6icSbx/X7mYogiMkA=";
+  npmFlags = [ "--legacy-peer-deps" ];
+  makeCacheWritable = true;
+
+  env = {
+    ELECTRON_SKIP_BINARY_DOWNLOAD = "1";
+    CHROMEDRIVER_SKIP_DOWNLOAD = "true";
+    CSC_IDENTITY_AUTO_DISCOVERY = "false";
   };
 
-  dontUnpack = true;
-  dontConfigure = true;
-  dontBuild = true;
+  nativeBuildInputs =
+    [ copyDesktopItems ]
+    ++ lib.optionals (stdenv.hostPlatform.system == "aarch64-linux") [
+      (python3.withPackages (ps: [ ps.setuptools ]))
+    ];
 
-  nativeBuildInputs = [ makeWrapper ];
+  # package.json does not include `core-js` and the comment suggests
+  # it is only needed on some mobile platforms
+  postPatch = ''
+    substituteInPlace electron-builder.yaml \
+      --replace-fail "notarize: true" "notarize: false"
+    substituteInPlace src/polyfills.ts \
+      --replace-fail "import 'core-js/es/object';" ""
+  '';
+
+  buildPhase = ''
+    runHook preBuild
+
+    # electronDist needs to be modifiable on Darwin
+    cp -r ${electron.dist} electron-dist
+    chmod -R u+w electron-dist
+
+    npm run buildFrontend:prod:es6
+    npm run electron:build
+    npm exec electron-builder -- --dir \
+      -c.electronDist=electron-dist \
+      -c.electronVersion=${electron.version}
+
+    runHook postBuild
+  '';
 
   installPhase = ''
     runHook preInstall
 
-    mkdir -p $out/bin $out/share/${pname} $out/share/applications
+    ${
+      if stdenv.hostPlatform.isDarwin then
+        ''
+          mkdir -p $out/Applications
+          cp -r "app-builds/mac"*"/Super Productivity.app" "$out/Applications"
+          makeWrapper "$out/Applications/Super Productivity.app/Contents/MacOS/Super Productivity" "$out/bin/super-productivity"
+        ''
+      else
+        ''
+          mkdir -p $out/share/super-productivity/{app,defaults,static/plugins,static/resources/plugins}
+          cp -r app-builds/*-unpacked/{locales,resources{,.pak}} "$out/share/super-productivity/app"
 
-    cp -a ${appimageContents}/{locales,resources} $out/share/${pname}
-    cp -a ${appimageContents}/superproductivity.desktop $out/share/applications/${pname}.desktop
-    cp -a ${appimageContents}/usr/share/icons $out/share
+          for size in 16 32 48 64 128 256 512 1024; do
+            local sizexsize="''${size}x''${size}"
+            mkdir -p $out/share/icons/hicolor/$sizexsize/apps
+            cp -v build/icons/$sizexsize.png \
+              $out/share/icons/hicolor/$sizexsize/apps/super-productivity.png
+          done
 
-    substituteInPlace $out/share/applications/${pname}.desktop \
-      --replace 'Exec=AppRun' 'Exec=${pname}'
+          makeWrapper '${lib.getExe electron}' "$out/bin/super-productivity" \
+            --add-flags "$out/share/super-productivity/app/resources/app.asar" \
+            --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--ozone-platform-hint=auto --enable-features=WaylandWindowDecorations}}" \
+            --set-default ELECTRON_FORCE_IS_PACKAGED 1 \
+            --inherit-argv0
+        ''
+    }
 
     runHook postInstall
   '';
 
-  postFixup = ''
-    makeWrapper ${electron}/bin/electron $out/bin/${pname} \
-      --add-flags $out/share/${pname}/resources/app.asar
-  '';
+  # copied from deb file
+  desktopItems = [
+    (makeDesktopItem {
+      name = "super-productivity";
+      desktopName = "superProductivity";
+      exec = "super-productivity %u";
+      terminal = false;
+      type = "Application";
+      icon = "super-productivity";
+      startupWMClass = "superProductivity";
+      comment = builtins.replaceStrings [ "\n" ] [ " " ] meta.longDescription;
+      categories = [ "Utility" ];
+    })
+  ];
 
-  meta = with lib; {
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
     description = "To Do List / Time Tracker with Jira Integration";
+    longDescription = ''
+      Experience the best ToDo app for digital professionals and get more done!
+      Super Productivity comes with integrated time-boxing and time tracking capabilities
+      and you can load your task from your calendars and from
+      Jira, Gitlab, GitHub, Open Project and others all into a single ToDo list.
+    '';
     homepage = "https://super-productivity.com";
-    license = licenses.mit;
-    platforms = [ "x86_64-linux" ];
-    maintainers = with maintainers; [ offline ];
+    license = lib.licenses.mit;
+    platforms = lib.platforms.all;
+    maintainers = with lib.maintainers; [
+      offline
+      pineapplehunter
+    ];
     mainProgram = "super-productivity";
   };
 }

pkgs/by-name/ta/tauon/package.nix

@@ -139,7 +139,7 @@ python3Packages.buildPythonApplication rec {
     description = "Linux desktop music player from the future";
     mainProgram = "tauon";
     homepage = "https://tauonmusicbox.rocks/";
-    changelog = "https://github.com/Taiko2k/TauonMusicBox/releases/tag/v${version}";
+    changelog = "https://github.com/Taiko2k/Tauon/releases/tag/v${version}";
     license = licenses.gpl3;
     maintainers = with maintainers; [ jansol ];
     platforms = platforms.linux ++ platforms.darwin;

pkgs/by-name/te/terraform-compliance/package.nix

@@ -6,14 +6,14 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "terraform-compliance";
-  version = "1.3.49";
+  version = "1.3.50";
   format = "setuptools";
 
   src = fetchFromGitHub {
     owner = "terraform-compliance";
     repo = "cli";
     tag = version;
-    hash = "sha256-wg9n7x7KDqFecZZVmJwpE1kP0eKt1Gmld6XEcavcyU0=";
+    hash = "sha256-FwePzXXxwiV5tWY1a+mG5pcv6XB801qG6Lx+XUe662E=";
   };
 
   postPatch = ''
@@ -55,7 +55,7 @@ python3.pkgs.buildPythonApplication rec {
     description = "BDD test framework for terraform";
     mainProgram = "terraform-compliance";
     homepage = "https://github.com/terraform-compliance/cli";
-    changelog = "https://github.com/terraform-compliance/cli/releases/tag/${version}";
+    changelog = "https://github.com/terraform-compliance/cli/releases/tag/${src.tag}";
     license = licenses.mit;
     maintainers = with maintainers; [
       kalbasit

pkgs/by-name/wm/wmenu/package.nix

@@ -16,7 +16,7 @@
 
 stdenv.mkDerivation rec {
   pname = "wmenu";
-  version = "0.1.9";
+  version = "0.1.9-unstable-2025-03-01";
 
   strictDeps = true;
 
@@ -24,8 +24,8 @@ stdenv.mkDerivation rec {
     domain = "codeberg.org";
     owner = "adnano";
     repo = "wmenu";
-    rev = version;
-    hash = "sha256-TF5BvgThvTOqxyfz5Zt/Z1cqjFJwvla+dgdyvz7Zhrg=";
+    rev = "fc69aa6e2bccca461a0bd0c10b448b64ccda1d42";
+    hash = "sha256-ZssptllD6LPQUinKZime9A1dZJ3CkQvp+DUmk+iyaOA=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/xk/xkeysnail/emacs.py

@@ -3,22 +3,21 @@ import re
 from xkeysnail.transform import *
 
 aa = False
-def aa_setvar(v):
-    def _aa_setvar():
+def aaset(v):
+    def _aaset():
         transform._mark_set = False
         global aa; aa = v
-    return _aa_setvar
-def aa_ifvar():
-    def _aa_ifvar():
-        transform._mark_set = False
-        global aa
+    return _aaset
+def aaif():
+    def _aaif():
+        global aa; transform._mark_set = False
         if aa: aa = False; return K("esc")
         return K("enter")
-    return _aa_ifvar
-def aa_flipmark():
-    def _aa_flipmark():
+    return _aaif
+def aaflip():
+    def _aaflip():
         transform._mark_set = not transform._mark_set;
-    return _aa_flipmark
+    return _aaflip
 
 define_keymap(re.compile("Google-chrome|Chromium-browser|firefox"), {
     K("C-b"): with_mark(K("left")),
@@ -37,17 +36,17 @@ define_keymap(re.compile("Google-chrome|Chromium-browser|firefox"), {
     K("C-d"): [K("delete"), set_mark(False)],
     K("M-d"): [K("C-delete"), set_mark(False)],
     K("M-backspace"): [K("C-backspace"), set_mark(False)],
-
     K("C-slash"): [K("C-z"), set_mark(False)],
-    K("C-space"): aa_flipmark(),
+
+    K("C-space"): aaflip(),
+    # K("C-space"): set_mark(True),
     K("C-M-space"): with_or_set_mark(K("C-right")),
 
+    K("enter"): aaif(),
+    K("C-s"): [K("F3"), aaset(True)],
+    K("C-r"): [K("Shift-F3"), aaset(True)],
+    K("C-g"): [K("esc"), aaset(False)]
     # K("C-s"): K("F3"),
     # K("C-r"): K("Shift-F3"),
     # K("C-g"): [K("esc"), set_mark(False)]
-
-    K("C-s"): [K("F3"), aa_setvar(True)],
-    K("C-r"): [K("Shift-F3"), aa_setvar(True)],
-    K("C-g"): [K("esc"), aa_setvar(False)],
-    K("enter"): aa_ifvar()
 })

pkgs/by-name/xk/xkeysnail/package.nix

@@ -1,22 +1,28 @@
 {
   lib,
   fetchFromGitHub,
-  makeWrapper,
   python3Packages,
+  fetchpatch,
 }:
 
 python3Packages.buildPythonApplication rec {
   pname = "xkeysnail";
-  version = "0.4.0";
+  version = "0.4";
 
   src = fetchFromGitHub {
     owner = "mooz";
     repo = pname;
     rev = "bf3c93b4fe6efd42893db4e6588e5ef1c4909cfb";
-    sha256 = "0plcpb4ndzfsd5hj32m0g32swnhyph9sd759cdhhzmjvlq3j8q6p";
+    hash = "sha256-12AkB6Zb1g9hY6mcphO8HlquxXigiiFhadr9Zsm6jF4=";
   };
 
-  nativeBuildInputs = [ makeWrapper ];
+  patches = [
+    (fetchpatch {
+      url = "https://github.com/mooz/xkeysnail/commit/457ab424fb32c4bfc6e6ea307752a2ce5d77853b.patch";
+      hash = "sha256-yqsAfn3SibRW2clbtVwVZi1dJ8pAiXoYpittpz7S/wU=";
+    })
+  ];
+
   propagatedBuildInputs = with python3Packages; [
     evdev
     xlib
@@ -24,15 +30,9 @@ python3Packages.buildPythonApplication rec {
     appdirs
   ];
 
-  doCheck = false;
-
   postInstall = ''
-    mkdir -p $out/share
-    cp ./example/config.py $out/share/example.py
-    cp ${./browser-emacs-bindings.py} $out/share/browser.py
+    install -Dm444 ${./emacs.py} $out/share/browser.py
 
-    makeWrapper $out/bin/xkeysnail $out/bin/xkeysnail-example \
-      --add-flags "-q" --add-flags "$out/share/example.py"
     makeWrapper $out/bin/xkeysnail $out/bin/xkeysnail-browser \
       --add-flags "-q" --add-flags "$out/share/browser.py"
   '';

pkgs/by-name/xl/xlights/package.nix

@@ -6,11 +6,11 @@
 
 appimageTools.wrapType2 rec {
   pname = "xlights";
-  version = "2025.03";
+  version = "2025.04";
 
   src = fetchurl {
     url = "https://github.com/smeighan/xLights/releases/download/${version}/xLights-${version}-x86_64.AppImage";
-    hash = "sha256-ASDiIpVLs02Q0vfGCih+a2kKmDbK8BLM8vcdDDaKfSU=";
+    hash = "sha256-YpFOQs+fDHTTWOkkw8dqKoFOVO998/nq2PUOjjA303A=";
   };
 
   meta = {

pkgs/development/python-modules/aiohomeconnect/default.nix

@@ -19,7 +19,7 @@
 
 buildPythonPackage rec {
   pname = "aiohomeconnect";
-  version = "0.16.2";
+  version = "0.16.3";
   pyproject = true;
 
   disabled = pythonOlder "3.11";
@@ -28,7 +28,7 @@ buildPythonPackage rec {
     owner = "MartinHjelmare";
     repo = "aiohomeconnect";
     tag = "v${version}";
-    hash = "sha256-AlmlZoqQxd4RE667rBYFzyAhFN9GJ0Rmk1lniDZKRnM=";
+    hash = "sha256-BwLbShldDhd5jqes4WvzP/+c7vjrY83KWLbYs0ON3K4=";
   };
 
   build-system = [ setuptools ];

pkgs/development/python-modules/django/5.nix

@@ -44,7 +44,7 @@
 
 buildPythonPackage rec {
   pname = "django";
-  version = "5.1.6";
+  version = "5.1.7";
   pyproject = true;
 
   disabled = pythonOlder "3.10";
@@ -53,7 +53,7 @@ buildPythonPackage rec {
     owner = "django";
     repo = "django";
     rev = "refs/tags/${version}";
-    hash = "sha256-eqyRiMNMmhg08Pga+AGnhGXfUoTMOuIHEPOEEGboIPE=";
+    hash = "sha256-BxhHqWpTZLcx46RofnXzZ5nj4xDPcj7hNng9ppUN5Hw=";
   };
 
   patches =

pkgs/development/python-modules/plugwise/default.nix

@@ -17,7 +17,7 @@
 
 buildPythonPackage rec {
   pname = "plugwise";
-  version = "1.7.2";
+  version = "1.7.3";
   pyproject = true;
 
   disabled = pythonOlder "3.12";
@@ -26,7 +26,7 @@ buildPythonPackage rec {
     owner = "plugwise";
     repo = "python-plugwise";
     tag = "v${version}";
-    hash = "sha256-WuEVLpFQlPiCYNbAGy3IIOmcbm9MertEQ4tlbd/8OqQ=";
+    hash = "sha256-VnL8rCSpNEs0NnghhgSO4k1Q+yqP5LCMZirC/hLZRO4=";
   };
 
   postPatch = ''

pkgs/development/python-modules/py-synologydsm-api/default.nix

@@ -13,7 +13,7 @@
 
 buildPythonPackage rec {
   pname = "py-synologydsm-api";
-  version = "2.7.0";
+  version = "2.7.1";
   pyproject = true;
 
   disabled = pythonOlder "3.9";
@@ -22,7 +22,7 @@ buildPythonPackage rec {
     owner = "mib1185";
     repo = "py-synologydsm-api";
     tag = "v${version}";
-    hash = "sha256-Zou0l/t9dWls2GKxcU3SDPxb0RaI2emyg07xLyengDo=";
+    hash = "sha256-Wra0H43eS6kVamavR1lUeonqSIz/BAJBlhoWshDDhZ0=";
   };
 
   build-system = [ setuptools ];

pkgs/development/python-modules/pysmartthings/default.nix

@@ -18,7 +18,7 @@
 
 buildPythonPackage rec {
   pname = "pysmartthings";
-  version = "2.6.1";
+  version = "2.7.0";
   pyproject = true;
 
   disabled = pythonOlder "3.12";
@@ -27,7 +27,7 @@ buildPythonPackage rec {
     owner = "andrewsayre";
     repo = "pysmartthings";
     rev = "v${version}";
-    hash = "sha256-BHPua3JzCTTPPM5QfJN/aWY4iv8Z1TU888p9Y5Hfy/I=";
+    hash = "sha256-ocLJWefXGq2gk6EBi5cKP8kdNBkPiF4I4NXFAaIkAjs=";
   };
 
   build-system = [ poetry-core ];

pkgs/development/python-modules/semgrep/common.nix

@@ -1,9 +1,9 @@
 { lib }:
 
 rec {
-  version = "1.74.0";
+  version = "1.104.0";
 
-  srcHash = "sha256-PH0fTT6n6o3Jtuq+cyyRb048Tuv3VGNduCZCEKTXMrE=";
+  srcHash = "sha256-rVBnjG+g7OaOQ8LYCurqNC2dYY/Dm4hdocgotc4lADg=";
 
   # submodule dependencies
   # these are fetched so we:
@@ -13,8 +13,8 @@ rec {
     "cli/src/semgrep/semgrep_interfaces" = {
       owner = "semgrep";
       repo = "semgrep-interfaces";
-      rev = "9f38254957c50c68ea402eebae0f7aa40dd01cbf";
-      hash = "sha256-/P8b7nSwNZSrm7dUFkehDaGz+r+bofrlFfuIo4U7tJM=";
+      rev = "5e0c767ec323f3f2356d3bf8dbdf7c7836497d8a";
+      hash = "sha256-RvkUbS+q/UqkKLDBCvDWkuRYDzWXp+JonFE7qVkEsY8=";
     };
   };
 
@@ -24,20 +24,20 @@ rec {
   # on github releases
   core = {
     x86_64-linux = {
-      platform = "any";
-      hash = "sha256-ZA5KlbSLkC0IJGqyK0XhuDKRx53987vf53vSM0zwD9k=";
+      platform = "musllinux_1_0_x86_64.manylinux2014_x86_64";
+      hash = "sha256-Qn97ZJI1//n47z/qX87AuIWRvvXurwH26C/vBrZ12gc=";
     };
     aarch64-linux = {
       platform = "musllinux_1_0_aarch64.manylinux2014_aarch64";
-      hash = "sha256-aHq87uzk9TtnlMDfAS6492ocXRJSHdBinng0hu2xLas=";
+      hash = "sha256-vuLuxsqnaPSbcVuwyhRRTTTwDVCZvOkRJURZUKnh/9I=";
     };
     x86_64-darwin = {
       platform = "macosx_10_14_x86_64";
-      hash = "sha256-OorDXQ0oYHV8aPu9o1dQAd22u78/EjpUWA2yPYG0S9E=";
+      hash = "sha256-QWESQQyBzyupzC1V5zs1GgZBtHEUgayvcKwDn+5pXUc=";
     };
     aarch64-darwin = {
       platform = "macosx_11_0_arm64";
-      hash = "sha256-g8sFLh2V9NDIvAZOaDhMpFxKqbS/S1eKep4v1vlOOo8=";
+      hash = "sha256-gkX82X79L+v5A1Mby6sCqXcx79fgJGIfmRdARtULmUc=";
     };
   };
 

pkgs/development/python-modules/semgrep/default.nix

@@ -7,6 +7,31 @@
 
 , pytestCheckHook
 , git
+
+# python packages
+, attrs
+, boltons
+, colorama
+, click
+, click-option-group
+, glom
+, requests
+, rich
+, ruamel-yaml
+, tqdm
+, packaging
+, jsonschema
+, wcmatch
+, peewee
+, defusedxml
+, urllib3
+, typing-extensions
+, python-lsp-jsonrpc
+, tomli
+, opentelemetry-api
+, opentelemetry-sdk
+, opentelemetry-exporter-otlp-proto-http
+, opentelemetry-instrumentation-requests
 }:
 
 # testing locally post build:
@@ -52,7 +77,7 @@ buildPythonPackage rec {
     "glom"
   ];
 
-  propagatedBuildInputs = with pythonPackages; [
+  dependencies =  [
     attrs
     boltons
     colorama
@@ -72,6 +97,10 @@ buildPythonPackage rec {
     typing-extensions
     python-lsp-jsonrpc
     tomli
+    opentelemetry-api
+    opentelemetry-sdk
+    opentelemetry-exporter-otlp-proto-http
+    opentelemetry-instrumentation-requests
   ];
 
   doCheck = true;
@@ -86,8 +115,8 @@ buildPythonPackage rec {
 
   disabledTestPaths = [
     "tests/default/e2e"
-    "tests/default/e2e-pro"
     "tests/default/e2e-pysemgrep"
+    "tests/default/e2e-other"
   ];
 
   disabledTests = [
@@ -99,6 +128,8 @@ buildPythonPackage rec {
     "TestConfigLoaderForProducts"
     # doesn't start flaky plugin correctly
     "test_debug_performance"
+    # requires .git directory
+    "clean_project_url"
   ];
 
   preCheck = ''
@@ -108,11 +139,6 @@ buildPythonPackage rec {
     # tests need access to `semgrep-core`
     export OLD_PATH="$PATH"
     export PATH="$PATH:${semgrepBinPath}"
-
-    # we're in cli
-    # replace old semgrep with wrapped one
-    rm ./bin/semgrep
-    ln -s $out/bin/semgrep ./bin/semgrep
   '';
 
   postCheck = ''

pkgs/development/python-modules/semgrep/semgrep-core.nix

@@ -25,7 +25,7 @@ stdenvNoCC.mkDerivation rec {
       inherit version;
       format = "wheel";
       dist = python;
-      python = "cp38.cp39.cp310.cp311.py37.py38.py39.py310.py311";
+      python = "cp39.cp310.cp311.py39.py310.py311";
       inherit (data) platform hash;
     };
 

pkgs/development/tools/pnpm/default.nix

@@ -16,8 +16,8 @@ let
       hash = "sha256-hHIWjD4f0L/yh+aUsFP8y78gV5o/+VJrYzO+q432Wo0=";
     };
     "10" = {
-      version = "10.5.2";
-      hash = "sha256-eamNqpAki1CBXjFGB5DxGMVv4JkRM3CCbKoBU75tq6U=";
+      version = "10.6.1";
+      hash = "sha256-gSBIRaOWliqcS0nMLWyvu0mnWGUtPCQ/ISjLxjgIT+I=";
     };
   };
 

pkgs/servers/home-assistant/component-packages.nix

@@ -2,7 +2,7 @@
 # Do not edit!
 
 {
-  version = "2025.3.0";
+  version = "2025.3.1";
   components = {
     "3_day_blinds" =
       ps: with ps; [

pkgs/servers/home-assistant/default.nix

@@ -383,7 +383,7 @@ let
   extraBuildInputs = extraPackages python.pkgs;
 
   # Don't forget to run update-component-packages.py after updating
-  hassVersion = "2025.3.0";
+  hassVersion = "2025.3.1";
 
 in
 python.pkgs.buildPythonApplication rec {
@@ -404,13 +404,13 @@ python.pkgs.buildPythonApplication rec {
     owner = "home-assistant";
     repo = "core";
     tag = version;
-    hash = "sha256-zMsJ/YAwMIdLDF256rxj63QsZD26p71SgYpf4zwzD1A=";
+    hash = "sha256-tM23n0/98kzB7fqCNZ0+qREQnLxlc6oBmPAKv//TDNk=";
   };
 
   # Secondary source is pypi sdist for translations
   sdist = fetchPypi {
     inherit pname version;
-    hash = "sha256-jsRIStPIbWXj24qjh9ZxH0QPN+zUOZeP6efRGYovUms=";
+    hash = "sha256-s+4l9FZQ5A0cvPXXypxzxzpMgrEnrgogzH/S7VwUZe4=";
   };
 
   build-system = with python.pkgs; [
@@ -554,6 +554,7 @@ python.pkgs.buildPythonApplication rec {
       # some components are needed even if tests in tests/components are disabled
       "default_config"
       "hue"
+      "qwikswitch"
     ];
 
   pytestFlagsArray = [
@@ -566,17 +567,6 @@ python.pkgs.buildPythonApplication rec {
     "--showlocals"
     # AssertionError: assert 1 == 0
     "--deselect tests/test_config.py::test_merge"
-    # AssertionError: assert 6 == 5
-    "--deselect=tests/helpers/test_translation.py::test_caching"
-    # assert "Detected that integration 'hue' attempted to create an asyncio task from a thread at homeassistant/components/hue/light.py, line 23
-    "--deselect=tests/util/test_async.py::test_create_eager_task_from_thread_in_integration"
-    # Services were renamed to Actions in language strings, but the tests are lagging behind
-    "--deselect=tests/test_core.py::test_serviceregistry_service_that_not_exists"
-    "--deselect=tests/test_core.py::test_services_call_return_response_requires_blocking"
-    "--deselect=tests/test_core.py::test_serviceregistry_return_response_arguments"
-    "--deselect=tests/helpers/test_script.py::test_parallel_error"
-    "--deselect=tests/helpers/test_script.py::test_propagate_error_service_not_found"
-    "--deselect=tests/helpers/test_script.py::test_continue_on_error_automation_issue"
     # checks whether pip is installed
     "--deselect=tests/util/test_package.py::test_check_package_fragment"
     # tests are located in tests/

pkgs/servers/home-assistant/frontend.nix

@@ -8,7 +8,7 @@ buildPythonPackage rec {
   # the frontend version corresponding to a specific home-assistant version can be found here
   # https://github.com/home-assistant/home-assistant/blob/master/homeassistant/components/frontend/manifest.json
   pname = "home-assistant-frontend";
-  version = "20250305.0";
+  version = "20250306.0";
   format = "wheel";
 
   src = fetchPypi {
@@ -16,7 +16,7 @@ buildPythonPackage rec {
     pname = "home_assistant_frontend";
     dist = "py3";
     python = "py3";
-    hash = "sha256-tzyJp1aKOXnmANR7p6C3rtC90VkGntURiaRgIjL8dDM=";
+    hash = "sha256-Nsh5zCyD72bjQ89BW5lmHdyWW9rxo+v2AW5fSOux/OA=";
   };
 
   # there is nothing to strip in this package

pkgs/servers/home-assistant/pytest-homeassistant-custom-component.nix

@@ -18,7 +18,7 @@
 
 buildPythonPackage rec {
   pname = "pytest-homeassistant-custom-component";
-  version = "0.13.220";
+  version = "0.13.222";
   pyproject = true;
 
   disabled = pythonOlder "3.12";
@@ -27,7 +27,7 @@ buildPythonPackage rec {
     owner = "MatthewFlamm";
     repo = "pytest-homeassistant-custom-component";
     rev = "refs/tags/${version}";
-    hash = "sha256-p/pC0dgKRVPlu3kOiSmeGhbfRW7cPm5W0Lr38XWlcnQ=";
+    hash = "sha256-a7bRxG2rDfxJ/1kfPQFXLaGxlGS6vuxADbJhs5qytkM=";
   };
 
   build-system = [ setuptools ];

pkgs/servers/home-assistant/stubs.nix

@@ -10,7 +10,7 @@
 
 buildPythonPackage rec {
   pname = "homeassistant-stubs";
-  version = "2025.3.0";
+  version = "2025.3.1";
   pyproject = true;
 
   disabled = python.version != home-assistant.python.version;
@@ -19,7 +19,7 @@ buildPythonPackage rec {
     owner = "KapJI";
     repo = "homeassistant-stubs";
     rev = "refs/tags/${version}";
-    hash = "sha256-4Chn8PRvTERiTQqhp3ScoV6woISvEWHFoohCKzLJCP8=";
+    hash = "sha256-EtgSd9TXyGjNvFYB7klcdJNhiVQsAfF18b6J35/7bUM=";
   };
 
   build-system = [

pkgs/servers/monitoring/prometheus/postgres-exporter.nix

@@ -7,13 +7,13 @@
 
 buildGoModule rec {
   pname = "postgres_exporter";
-  version = "0.17.0";
+  version = "0.17.1";
 
   src = fetchFromGitHub {
     owner = "prometheus-community";
     repo = "postgres_exporter";
     rev = "v${version}";
-    sha256 = "sha256-M7CnAbyAeVLfFyPDGYOCubcE7i/caQ0MDLi3JKeN6FA=";
+    sha256 = "sha256-F7nLz6NkvWSeZTzjo1/wNWCPn3Veo9/SkJdlFRwdlo4=";
   };
 
   vendorHash = "sha256-Dl44VTaDE90nhOU0zxZvd/zrVe8bLRnT16ISqJMpzpU=";

pkgs/servers/mpd/default.nix

@@ -2,6 +2,7 @@
   lib,
   stdenv,
   fetchFromGitHub,
+  fetchpatch2,
   meson,
   ninja,
   pkg-config,
@@ -201,15 +202,26 @@ let
     in
     stdenv.mkDerivation rec {
       pname = "mpd";
-      version = "0.23.16";
+      version = "0.23.17";
 
       src = fetchFromGitHub {
         owner = "MusicPlayerDaemon";
         repo = "MPD";
         rev = "v${version}";
-        sha256 = "sha256-0To+V+4xLjymGpRSpsyE/Une5uUpCEiAg+d041guPA0=";
+        sha256 = "sha256-1+eVLvwMp6mR38y39wV73rhPA998ip7clyyKcJ008z0=";
       };
 
+      patches = [
+        # Revert of https://github.com/MusicPlayerDaemon/MPD/commit/0aeda01ba6d22a8d9fc583faa67ffc6473869a43
+        # We use a yajl fork that fixed this issue in the pkg-config manifest
+        (fetchpatch2 {
+          name = "revert-yajl-include-fix.patch";
+          url = "https://github.com/MusicPlayerDaemon/MPD/commit/0aeda01ba6d22a8d9fc583faa67ffc6473869a43.diff";
+          hash = "sha256-p/sYvWpr0GTw8gjt+W9FQysadOK/QOUp81ykTI50UYg=";
+          revert = true;
+        })
+      ];
+
       buildInputs =
         [
           glib

pkgs/servers/pulseaudio/default.nix

@@ -115,7 +115,7 @@ stdenv.mkDerivation rec {
       perlPackages.XMLParser
       m4
     ]
-    ++ lib.optionals stdenv.hostPlatform.isLinux [ glib ]
+    ++ lib.optionals (!stdenv.hostPlatform.isDarwin) [ glib ]
     # gstreamer plugin discovery requires wrapping
     ++ lib.optional (bluetoothSupport && advancedBluetoothCodecs) wrapGAppsHook3;
 
@@ -130,7 +130,7 @@ stdenv.mkDerivation rec {
       fftwFloat
       check
     ]
-    ++ lib.optionals stdenv.hostPlatform.isLinux [
+    ++ lib.optionals (!stdenv.hostPlatform.isDarwin) [
       glib
       dbus
     ]
@@ -139,6 +139,8 @@ stdenv.mkDerivation rec {
       Cocoa
       CoreServices
       CoreAudio
+    ]
+    ++ lib.optionals (stdenv.hostPlatform.isDarwin || stdenv.hostPlatform.isFreeBSD) [
       libintl
     ]
     ++ lib.optionals (!libOnly) (
@@ -179,6 +181,13 @@ stdenv.mkDerivation rec {
       ++ lib.optional zeroconfSupport avahi
     );
 
+  env =
+    lib.optionalAttrs (stdenv.cc.bintools.isLLVM && lib.versionAtLeast stdenv.cc.bintools.version "17")
+      {
+        # https://gitlab.freedesktop.org/pulseaudio/pulseaudio/-/issues/3848
+        NIX_LDFLAGS = "--undefined-version";
+      };
+
   mesonFlags =
     [
       (lib.mesonEnable "alsa" (!libOnly && alsaSupport))
@@ -274,7 +283,9 @@ stdenv.mkDerivation rec {
       done
     '';
 
-  passthru.tests = { inherit (nixosTests) pulseaudio; };
+  passthru.tests = {
+    inherit (nixosTests) pulseaudio;
+  };
 
   meta = {
     description = "Sound server for POSIX and Win32 systems";

pkgs/tools/misc/qt6ct/default.nix

@@ -1,12 +1,12 @@
 {
+  cmake,
+  fetchFromGitLab,
   lib,
-  stdenv,
-  fetchFromGitHub,
   qtbase,
   qtsvg,
-  qtwayland,
-  qmake,
   qttools,
+  qtwayland,
+  stdenv,
   wrapQtAppsHook,
 }:
 
@@ -14,15 +14,16 @@ stdenv.mkDerivation (finalAttrs: {
   pname = "qt6ct";
   version = "0.10";
 
-  src = fetchFromGitHub {
-    owner = "ilya-fedin";
+  src = fetchFromGitLab {
+    domain = "www.opencode.net";
+    owner = "trialuser";
     repo = "qt6ct";
     tag = finalAttrs.version;
-    hash = "sha256-ePY+BEpEcAq11+pUMjQ4XG358x3bXFQWwI1UAi+KmLo=";
+    hash = "sha256-o2k/b4AGiblS1CkNInqNrlpM1Y7pydIJzEVgVd3ao50=";
   };
 
   nativeBuildInputs = [
-    qmake
+    cmake
     qttools
     wrapQtAppsHook
   ];
@@ -33,15 +34,14 @@ stdenv.mkDerivation (finalAttrs: {
     qtwayland
   ];
 
-  qmakeFlags = [
-    "LRELEASE_EXECUTABLE=${lib.getDev qttools}/bin/lrelease"
-    "PLUGINDIR=${placeholder "out"}/${qtbase.qtPluginPrefix}"
-    "LIBDIR=${placeholder "out"}/lib"
-  ];
+  postPatch = ''
+    substituteInPlace src/qt6ct-qtplugin/CMakeLists.txt src/qt6ct-style/CMakeLists.txt \
+      --replace-fail "\''${PLUGINDIR}" "$out/${qtbase.qtPluginPrefix}"
+  '';
 
   meta = {
     description = "Qt6 Configuration Tool";
-    homepage = "https://github.com/ilya-fedin/qt6ct";
+    homepage = "https://www.opencode.net/trialuser/qt6ct";
     platforms = lib.platforms.linux;
     license = lib.licenses.bsd2;
     maintainers = with lib.maintainers; [