From 6257c8d29bc7e23281deea452df3c7546bdb15da Mon Sep 17 00:00:00 2001
From: Jeremy Baxter <jeremy@baxters.nz>
Date: Sun, 28 Jul 2024 16:05:32 +1200
Subject: [PATCH 01/71] gdmd: init at 0.1.0-unstable-2024-05-30

Closes #324961
---
 pkgs/by-name/gd/gdmd/0001-gdc-store-path.diff | 11 +++++
 pkgs/by-name/gd/gdmd/package.nix              | 49 +++++++++++++++++++
 2 files changed, 60 insertions(+)
 create mode 100644 pkgs/by-name/gd/gdmd/0001-gdc-store-path.diff
 create mode 100644 pkgs/by-name/gd/gdmd/package.nix

diff --git a/pkgs/by-name/gd/gdmd/0001-gdc-store-path.diff b/pkgs/by-name/gd/gdmd/0001-gdc-store-path.diff
new file mode 100644
index 000000000000..e9813c00be20
--- /dev/null
+++ b/pkgs/by-name/gd/gdmd/0001-gdc-store-path.diff
@@ -0,0 +1,11 @@
+--- a/dmd-script
++++ b/dmd-script
+@@ -72,7 +72,7 @@ my @run_args;
+ # for the target prefix.
+ basename($0) =~ m/^(.*-)?g?dmd(-.*)?$/;
+ my $target_prefix = $1?$1:"";
+-my $gdc_dir = abs_path(dirname($0));
++my $gdc_dir = "@gdc_dir@";
+ my $gdc = File::Spec->catfile( $gdc_dir, $target_prefix . "gdc" . ($2?$2:""));
+ 
+ sub osHasEXE() {
diff --git a/pkgs/by-name/gd/gdmd/package.nix b/pkgs/by-name/gd/gdmd/package.nix
new file mode 100644
index 000000000000..6f98c8a491c8
--- /dev/null
+++ b/pkgs/by-name/gd/gdmd/package.nix
@@ -0,0 +1,49 @@
+{
+  lib,
+  stdenvNoCC,
+  fetchFromGitHub,
+  substituteAll,
+  gdc,
+  perl,
+}:
+stdenvNoCC.mkDerivation {
+  pname = "gdmd";
+  version = "0.1.0-unstable-2024-05-30";
+
+  src = fetchFromGitHub {
+    owner = "D-Programming-GDC";
+    repo = "gdmd";
+    rev = "dc0ad9f739795f3ce5c69825efcd5d1d586bb013";
+    hash = "sha256-Sw8ExEPDvGqGKcM9VKnOI6MGgXW0tAu51A90Wi4qrRE=";
+  };
+
+  patches = [
+    (substituteAll {
+      src = ./0001-gdc-store-path.diff;
+      gdc_dir = "${gdc}/bin";
+    })
+  ];
+
+  buildInputs = [
+    gdc
+    perl
+  ];
+
+  installFlags = [
+    "DESTDIR=$(out)"
+    "prefix="
+  ];
+
+  preInstall = ''
+    install -d $out/bin $out/share/man/man1
+  '';
+
+  meta = {
+    description = "Wrapper for GDC that emulates DMD's command line";
+    homepage = "https://gdcproject.org";
+    license = lib.licenses.gpl3Plus;
+    platforms = lib.platforms.all;
+    maintainers = with lib.maintainers; [ jtbx ];
+    mainProgram = "gdmd";
+  };
+}

From 576a0754c8185cc766022059d542eff1a90bc37b Mon Sep 17 00:00:00 2001
From: Johan Larsson <jolars@posteo.com>
Date: Tue, 7 Jan 2025 15:12:48 +0100
Subject: [PATCH 02/71] maintainers: add jolars

---
 maintainers/maintainer-list.nix | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index 3e1a1e1cbcfe..408a54bc97d0 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -11124,6 +11124,14 @@
     ];
     name = "Ioannis Koutras";
   };
+  jolars = {
+    email = "jolars@posteo.com";
+    matrix = "@jola:mozilla.org";
+    github = "jolars";
+    githubId = 13087841;
+    name = "Johan Larsson";
+    keys = [ { fingerprint = "F0D6 BDE7 C7D1 6B3F 7883  73E7 2A41 C0FE DD6F F540"; } ];
+  };
   jonaenz = {
     name = "Jona Enzinger";
     email = "5xt3zyy5l@mozmail.com";

From d810e9e936624d5f3d3e0acb5cca43f7853896b6 Mon Sep 17 00:00:00 2001
From: Johan Larsson <jolars@posteo.com>
Date: Tue, 7 Jan 2025 15:13:18 +0100
Subject: [PATCH 03/71] snakefmt: init at 0.10.2

---
 pkgs/by-name/sn/snakefmt/package.nix | 46 ++++++++++++++++++++++++++++
 1 file changed, 46 insertions(+)
 create mode 100644 pkgs/by-name/sn/snakefmt/package.nix

diff --git a/pkgs/by-name/sn/snakefmt/package.nix b/pkgs/by-name/sn/snakefmt/package.nix
new file mode 100644
index 000000000000..ba565b5c20b3
--- /dev/null
+++ b/pkgs/by-name/sn/snakefmt/package.nix
@@ -0,0 +1,46 @@
+{
+  lib,
+  python3,
+  fetchPypi,
+  nix-update-script,
+  versionCheckHook,
+}:
+
+python3.pkgs.buildPythonApplication rec {
+  pname = "snakefmt";
+  version = "0.10.2";
+  pyproject = true;
+
+  disabled = python3.pythonOlder "3.8.1";
+
+  src = fetchPypi {
+    inherit pname version;
+    hash = "sha256-QoalkDtm2n5SdjxegYTaTtyVETt1j0RIUogE+1T5t1o=";
+  };
+
+  build-system = [ python3.pkgs.poetry-core ];
+
+  dependencies = with python3.pkgs; [
+    black
+    click
+    importlib-metadata
+    toml
+  ];
+
+  pythonImportsCheck = [ "snakefmt" ];
+
+  nativeInstallCheckInputs = [ versionCheckHook ];
+  versionCheckProgramArg = "--version";
+  doInstallCheck = true;
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "Uncompromising Snakemake code formatter";
+    homepage = "https://pypi.org/project/snakefmt/";
+    changelog = "https://github.com/snakemake/snakefmt/releases/tag/v${version}";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ jolars ];
+    mainProgram = "snakefmt";
+  };
+}

From 705289bf705f5edb1d1065e1a98227cb401c1983 Mon Sep 17 00:00:00 2001
From: Adam Dinwoodie <adam@dinwoodie.org>
Date: Sat, 18 Jan 2025 17:05:11 +0000
Subject: [PATCH 04/71] prusa-slicer: patch curl version checks

Add patch from upstream PR to fix curl version checks that result in the
Printables integration failing.

Fixes #246261
---
 pkgs/applications/misc/prusa-slicer/default.nix | 10 ++++++----
 1 file changed, 6 insertions(+), 4 deletions(-)

diff --git a/pkgs/applications/misc/prusa-slicer/default.nix b/pkgs/applications/misc/prusa-slicer/default.nix
index 75f90b2f4431..baff4e6918e1 100644
--- a/pkgs/applications/misc/prusa-slicer/default.nix
+++ b/pkgs/applications/misc/prusa-slicer/default.nix
@@ -68,14 +68,10 @@ let
   openvdb_tbb_2021_8 = openvdb.override { tbb = tbb_2021_11; };
   wxGTK-override' = if wxGTK-override == null then wxGTK-prusa else wxGTK-override;
   opencascade-override' = if opencascade-override == null then opencascade-occt_7_6_1 else opencascade-override;
-
-  patches = [
-  ];
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "prusa-slicer";
   version = "2.9.0";
-  inherit patches;
 
   src = fetchFromGitHub {
     owner = "prusa3d";
@@ -84,6 +80,12 @@ stdenv.mkDerivation (finalAttrs: {
     rev = "version_${finalAttrs.version}";
   };
 
+  # https://github.com/prusa3d/PrusaSlicer/pull/14010
+  patches = [(fetchpatch {
+    url = "https://github.com/prusa3d/PrusaSlicer/commit/cdc3db58f9002778a0ca74517865527f50ade4c3.patch";
+    hash = "sha256-zgpGg1jtdnCBaWjR6oUcHo5sGuZx5oEzpux3dpRdMAM=";
+  })];
+
   # required for GCC 14
   # (not applicable to super-slicer fork)
   postPatch = lib.optionalString (finalAttrs.pname == "prusa-slicer") ''

From 61a05336ef3d12990282ddd81c7007da57573aca Mon Sep 17 00:00:00 2001
From: andrew-myer <10202735+andrew-myer@users.noreply.github.com>
Date: Wed, 13 Nov 2024 14:23:21 -0800
Subject: [PATCH 05/71] semgrep{,-core}: 1.74.0 -> 1.104.0

---
 .../python-modules/semgrep/common.nix         | 18 ++++-----
 .../python-modules/semgrep/default.nix        | 40 +++++++++++++++----
 .../python-modules/semgrep/semgrep-core.nix   |  2 +-
 3 files changed, 43 insertions(+), 17 deletions(-)

diff --git a/pkgs/development/python-modules/semgrep/common.nix b/pkgs/development/python-modules/semgrep/common.nix
index d51853953bf4..4dbf353e8552 100644
--- a/pkgs/development/python-modules/semgrep/common.nix
+++ b/pkgs/development/python-modules/semgrep/common.nix
@@ -1,9 +1,9 @@
 { lib }:
 
 rec {
-  version = "1.74.0";
+  version = "1.104.0";
 
-  srcHash = "sha256-PH0fTT6n6o3Jtuq+cyyRb048Tuv3VGNduCZCEKTXMrE=";
+  srcHash = "sha256-rVBnjG+g7OaOQ8LYCurqNC2dYY/Dm4hdocgotc4lADg=";
 
   # submodule dependencies
   # these are fetched so we:
@@ -13,8 +13,8 @@ rec {
     "cli/src/semgrep/semgrep_interfaces" = {
       owner = "semgrep";
       repo = "semgrep-interfaces";
-      rev = "9f38254957c50c68ea402eebae0f7aa40dd01cbf";
-      hash = "sha256-/P8b7nSwNZSrm7dUFkehDaGz+r+bofrlFfuIo4U7tJM=";
+      rev = "5e0c767ec323f3f2356d3bf8dbdf7c7836497d8a";
+      hash = "sha256-RvkUbS+q/UqkKLDBCvDWkuRYDzWXp+JonFE7qVkEsY8=";
     };
   };
 
@@ -24,20 +24,20 @@ rec {
   # on github releases
   core = {
     x86_64-linux = {
-      platform = "any";
-      hash = "sha256-ZA5KlbSLkC0IJGqyK0XhuDKRx53987vf53vSM0zwD9k=";
+      platform = "musllinux_1_0_x86_64.manylinux2014_x86_64";
+      hash = "sha256-Qn97ZJI1//n47z/qX87AuIWRvvXurwH26C/vBrZ12gc=";
     };
     aarch64-linux = {
       platform = "musllinux_1_0_aarch64.manylinux2014_aarch64";
-      hash = "sha256-aHq87uzk9TtnlMDfAS6492ocXRJSHdBinng0hu2xLas=";
+      hash = "sha256-vuLuxsqnaPSbcVuwyhRRTTTwDVCZvOkRJURZUKnh/9I=";
     };
     x86_64-darwin = {
       platform = "macosx_10_14_x86_64";
-      hash = "sha256-OorDXQ0oYHV8aPu9o1dQAd22u78/EjpUWA2yPYG0S9E=";
+      hash = "sha256-QWESQQyBzyupzC1V5zs1GgZBtHEUgayvcKwDn+5pXUc=";
     };
     aarch64-darwin = {
       platform = "macosx_11_0_arm64";
-      hash = "sha256-g8sFLh2V9NDIvAZOaDhMpFxKqbS/S1eKep4v1vlOOo8=";
+      hash = "sha256-gkX82X79L+v5A1Mby6sCqXcx79fgJGIfmRdARtULmUc=";
     };
   };
 
diff --git a/pkgs/development/python-modules/semgrep/default.nix b/pkgs/development/python-modules/semgrep/default.nix
index 939454a71975..ad8ec602008d 100644
--- a/pkgs/development/python-modules/semgrep/default.nix
+++ b/pkgs/development/python-modules/semgrep/default.nix
@@ -7,6 +7,31 @@
 
 , pytestCheckHook
 , git
+
+# python packages
+, attrs
+, boltons
+, colorama
+, click
+, click-option-group
+, glom
+, requests
+, rich
+, ruamel-yaml
+, tqdm
+, packaging
+, jsonschema
+, wcmatch
+, peewee
+, defusedxml
+, urllib3
+, typing-extensions
+, python-lsp-jsonrpc
+, tomli
+, opentelemetry-api
+, opentelemetry-sdk
+, opentelemetry-exporter-otlp-proto-http
+, opentelemetry-instrumentation-requests
 }:
 
 # testing locally post build:
@@ -52,7 +77,7 @@ buildPythonPackage rec {
     "glom"
   ];
 
-  propagatedBuildInputs = with pythonPackages; [
+  dependencies =  [
     attrs
     boltons
     colorama
@@ -72,6 +97,10 @@ buildPythonPackage rec {
     typing-extensions
     python-lsp-jsonrpc
     tomli
+    opentelemetry-api
+    opentelemetry-sdk
+    opentelemetry-exporter-otlp-proto-http
+    opentelemetry-instrumentation-requests
   ];
 
   doCheck = true;
@@ -86,8 +115,8 @@ buildPythonPackage rec {
 
   disabledTestPaths = [
     "tests/default/e2e"
-    "tests/default/e2e-pro"
     "tests/default/e2e-pysemgrep"
+    "tests/default/e2e-other"
   ];
 
   disabledTests = [
@@ -99,6 +128,8 @@ buildPythonPackage rec {
     "TestConfigLoaderForProducts"
     # doesn't start flaky plugin correctly
     "test_debug_performance"
+    # requires .git directory
+    "clean_project_url"
   ];
 
   preCheck = ''
@@ -108,11 +139,6 @@ buildPythonPackage rec {
     # tests need access to `semgrep-core`
     export OLD_PATH="$PATH"
     export PATH="$PATH:${semgrepBinPath}"
-
-    # we're in cli
-    # replace old semgrep with wrapped one
-    rm ./bin/semgrep
-    ln -s $out/bin/semgrep ./bin/semgrep
   '';
 
   postCheck = ''
diff --git a/pkgs/development/python-modules/semgrep/semgrep-core.nix b/pkgs/development/python-modules/semgrep/semgrep-core.nix
index fd5f1b37a445..5a598631ceae 100644
--- a/pkgs/development/python-modules/semgrep/semgrep-core.nix
+++ b/pkgs/development/python-modules/semgrep/semgrep-core.nix
@@ -25,7 +25,7 @@ stdenvNoCC.mkDerivation rec {
       inherit version;
       format = "wheel";
       dist = python;
-      python = "cp38.cp39.cp310.cp311.py37.py38.py39.py310.py311";
+      python = "cp39.cp310.cp311.py39.py310.py311";
       inherit (data) platform hash;
     };
 

From 99ab228827cc704a6154af5e7f08f4d44b6c54a1 Mon Sep 17 00:00:00 2001
From: Mikael Voss <mvs@nyantec.com>
Date: Tue, 11 Feb 2025 10:57:24 +0100
Subject: [PATCH 06/71] linux-manual: remove use of rec

---
 pkgs/by-name/li/linux-manual/package.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/by-name/li/linux-manual/package.nix b/pkgs/by-name/li/linux-manual/package.nix
index 4240654d6b34..66d2f25c35f3 100644
--- a/pkgs/by-name/li/linux-manual/package.nix
+++ b/pkgs/by-name/li/linux-manual/package.nix
@@ -5,7 +5,7 @@
   linuxPackages_latest,
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation {
   pname = "linux-manual";
   inherit (linuxPackages_latest.kernel) version src;
 

From 0b0485e729fffd8421dc1c95d5dc71335fb73f03 Mon Sep 17 00:00:00 2001
From: Mikael Voss <mvs@nyantec.com>
Date: Tue, 11 Feb 2025 10:58:21 +0100
Subject: [PATCH 07/71] linux-manual: remove use of with lib;

---
 pkgs/by-name/li/linux-manual/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/li/linux-manual/package.nix b/pkgs/by-name/li/linux-manual/package.nix
index 66d2f25c35f3..bd3b56122682 100644
--- a/pkgs/by-name/li/linux-manual/package.nix
+++ b/pkgs/by-name/li/linux-manual/package.nix
@@ -36,10 +36,10 @@ stdenv.mkDerivation {
     test -f $mandir/kmalloc.9
   '';
 
-  meta = with lib; {
+  meta = {
     homepage = "https://kernel.org/";
     description = "Linux kernel API manual pages";
-    license = licenses.gpl2Only;
-    maintainers = with maintainers; [ mvs ];
+    license = lib.licenses.gpl2Only;
+    maintainers = with lib.maintainers; [ mvs ];
   };
 }

From 9b19af176f07cec7089937a3419889fbae8eb4ac Mon Sep 17 00:00:00 2001
From: Mikael Voss <mvs@nyantec.com>
Date: Tue, 11 Feb 2025 10:58:42 +0100
Subject: [PATCH 08/71] linux-manual: define meta.platforms

---
 pkgs/by-name/li/linux-manual/package.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/pkgs/by-name/li/linux-manual/package.nix b/pkgs/by-name/li/linux-manual/package.nix
index bd3b56122682..d6e112693eb4 100644
--- a/pkgs/by-name/li/linux-manual/package.nix
+++ b/pkgs/by-name/li/linux-manual/package.nix
@@ -41,5 +41,6 @@ stdenv.mkDerivation {
     description = "Linux kernel API manual pages";
     license = lib.licenses.gpl2Only;
     maintainers = with lib.maintainers; [ mvs ];
+    platforms = lib.platforms.linux;
   };
 }

From 192ae83bd19b3a8fa70da2b41d955d3b87d025c8 Mon Sep 17 00:00:00 2001
From: Mikael Voss <mvs@nyantec.com>
Date: Tue, 11 Feb 2025 10:59:19 +0100
Subject: [PATCH 09/71] linux-manual: rely on SOURCE_DATE_EPOCH instead of stat

---
 pkgs/by-name/li/linux-manual/package.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/by-name/li/linux-manual/package.nix b/pkgs/by-name/li/linux-manual/package.nix
index d6e112693eb4..86e77a03144d 100644
--- a/pkgs/by-name/li/linux-manual/package.nix
+++ b/pkgs/by-name/li/linux-manual/package.nix
@@ -24,7 +24,7 @@ stdenv.mkDerivation {
     mandir=$out/share/man/man9
     mkdir -p $mandir
 
-    KBUILD_BUILD_TIMESTAMP=$(stat -c %Y Makefile) \
+    KBUILD_BUILD_TIMESTAMP="$(date -u -d "@$SOURCE_DATE_EPOCH")" \
     grep -F -l -Z \
       --exclude-dir Documentation \
       --exclude-dir tools \

From 0f8ba00a48480b171756be86a412b13a3d552800 Mon Sep 17 00:00:00 2001
From: Mikael Voss <mvs@nyantec.com>
Date: Tue, 11 Feb 2025 11:10:55 +0100
Subject: [PATCH 10/71] linux-manual: properly quote all shell expansions

---
 pkgs/by-name/li/linux-manual/package.nix | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/pkgs/by-name/li/linux-manual/package.nix b/pkgs/by-name/li/linux-manual/package.nix
index 86e77a03144d..7e822bbf893e 100644
--- a/pkgs/by-name/li/linux-manual/package.nix
+++ b/pkgs/by-name/li/linux-manual/package.nix
@@ -21,19 +21,19 @@ stdenv.mkDerivation {
   '';
 
   installPhase = ''
-    mandir=$out/share/man/man9
-    mkdir -p $mandir
+    export mandir="$out/share/man/man9"
+    mkdir -p "$mandir"
 
     KBUILD_BUILD_TIMESTAMP="$(date -u -d "@$SOURCE_DATE_EPOCH")" \
     grep -F -l -Z \
       --exclude-dir Documentation \
       --exclude-dir tools \
       -R '/**' \
-      | xargs -0 -n 256 -P $NIX_BUILD_CORES \
-        $SHELL -c '{ scripts/kernel-doc -man "$@" || :; } \
-          | scripts/split-man.pl '$mandir kernel-doc
+      | xargs -0 -n 256 -P "$NIX_BUILD_CORES" \
+        "$SHELL" -c '{ scripts/kernel-doc -man "$@" || :; } \
+          | scripts/split-man.pl "$mandir"' kernel-doc
 
-    test -f $mandir/kmalloc.9
+    test -f "$mandir/kmalloc.9"
   '';
 
   meta = {

From b26abf80023b96d4aaf8dbbabee23b915a5538e5 Mon Sep 17 00:00:00 2001
From: Mikael Voss <mvs@nyantec.com>
Date: Tue, 11 Feb 2025 11:03:49 +0100
Subject: [PATCH 11/71] =?UTF-8?q?linux-manual:=20call=20pre=E2=80=AF/?=
 =?UTF-8?q?=E2=80=AFpost=20hooks?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 pkgs/by-name/li/linux-manual/package.nix | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/pkgs/by-name/li/linux-manual/package.nix b/pkgs/by-name/li/linux-manual/package.nix
index 7e822bbf893e..9e7fcb37f90e 100644
--- a/pkgs/by-name/li/linux-manual/package.nix
+++ b/pkgs/by-name/li/linux-manual/package.nix
@@ -21,6 +21,8 @@ stdenv.mkDerivation {
   '';
 
   installPhase = ''
+    runHook preInstall
+
     export mandir="$out/share/man/man9"
     mkdir -p "$mandir"
 
@@ -34,6 +36,8 @@ stdenv.mkDerivation {
           | scripts/split-man.pl "$mandir"' kernel-doc
 
     test -f "$mandir/kmalloc.9"
+
+    runHook postInstall
   '';
 
   meta = {

From 884b4116d26aadd24ff0616bdee847eb21d69b23 Mon Sep 17 00:00:00 2001
From: Mikael Voss <mvs@nyantec.com>
Date: Tue, 11 Feb 2025 11:13:25 +0100
Subject: [PATCH 12/71] linux-manual: provide simple installation check

---
 pkgs/by-name/li/linux-manual/package.nix | 16 +++++++++++++---
 1 file changed, 13 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/li/linux-manual/package.nix b/pkgs/by-name/li/linux-manual/package.nix
index 9e7fcb37f90e..62111043d782 100644
--- a/pkgs/by-name/li/linux-manual/package.nix
+++ b/pkgs/by-name/li/linux-manual/package.nix
@@ -1,8 +1,9 @@
 {
   lib,
   stdenv,
-  perl,
   linuxPackages_latest,
+  perl,
+  man,
 }:
 
 stdenv.mkDerivation {
@@ -10,9 +11,11 @@ stdenv.mkDerivation {
   inherit (linuxPackages_latest.kernel) version src;
 
   nativeBuildInputs = [ perl ];
+  nativeInstallCheckInputs = [ man ];
 
   dontConfigure = true;
   dontBuild = true;
+  doInstallCheck = true;
 
   postPatch = ''
     patchShebangs --build \
@@ -35,11 +38,18 @@ stdenv.mkDerivation {
         "$SHELL" -c '{ scripts/kernel-doc -man "$@" || :; } \
           | scripts/split-man.pl "$mandir"' kernel-doc
 
-    test -f "$mandir/kmalloc.9"
-
     runHook postInstall
   '';
 
+  installCheckPhase = ''
+    runHook preInstallCheck
+
+    # Check for well‐known man page
+    man -M "$out/share/man" -P cat 9 kmalloc >/dev/null
+
+    runHook postInstallCheck
+  '';
+
   meta = {
     homepage = "https://kernel.org/";
     description = "Linux kernel API manual pages";

From c256d7b5ecd90d2a12ff6de378bdcb6c6607afbe Mon Sep 17 00:00:00 2001
From: Robert Rose <robert.rose@mailbox.org>
Date: Tue, 21 Jan 2025 17:37:05 +0100
Subject: [PATCH 13/71] nixos/k3s: use dynamic networking in multi node test

The dynamic setup requires less network configuration and allows to use
features of the nixos testing driver, e.g. port forwarding and SSH
access to nodes in interactive mode.
---
 nixos/tests/k3s/multi-node.nix | 49 ++++++++++------------------------
 1 file changed, 14 insertions(+), 35 deletions(-)

diff --git a/nixos/tests/k3s/multi-node.nix b/nixos/tests/k3s/multi-node.nix
index c1d89af2f3e2..335b8f8e6426 100644
--- a/nixos/tests/k3s/multi-node.nix
+++ b/nixos/tests/k3s/multi-node.nix
@@ -60,7 +60,7 @@ import ../make-test-python.nix (
 
     nodes = {
       server =
-        { pkgs, ... }:
+        { nodes, pkgs, ... }:
         {
           environment.systemPackages = with pkgs; [
             gzip
@@ -83,8 +83,12 @@ import ../make-test-python.nix (
               "--disable metrics-server"
               "--disable servicelb"
               "--disable traefik"
-              "--node-ip 192.168.1.1"
               "--pause-image test.local/pause:local"
+              "--node-ip ${nodes.server.networking.primaryIPAddress}"
+              # The interface selection logic of flannel would normally use eth0, as the nixos
+              # testing driver sets a default route via dev eth0. However, in test setups we
+              # have to use eth1 for inter-node communication.
+              "--flannel-iface eth1"
             ];
           };
           networking.firewall.allowedTCPPorts = [
@@ -93,19 +97,10 @@ import ../make-test-python.nix (
             6443
           ];
           networking.firewall.allowedUDPPorts = [ 8472 ];
-          networking.firewall.trustedInterfaces = [ "flannel.1" ];
-          networking.useDHCP = false;
-          networking.defaultGateway = "192.168.1.1";
-          networking.interfaces.eth1.ipv4.addresses = pkgs.lib.mkForce [
-            {
-              address = "192.168.1.1";
-              prefixLength = 24;
-            }
-          ];
         };
 
       server2 =
-        { pkgs, ... }:
+        { nodes, pkgs, ... }:
         {
           environment.systemPackages = with pkgs; [
             gzip
@@ -119,7 +114,7 @@ import ../make-test-python.nix (
             enable = true;
             package = k3s;
             images = [ pauseImage ];
-            serverAddr = "https://192.168.1.1:6443";
+            serverAddr = "https://${nodes.server.networking.primaryIPAddress}:6443";
             clusterInit = false;
             extraFlags = [
               "--disable coredns"
@@ -127,8 +122,9 @@ import ../make-test-python.nix (
               "--disable metrics-server"
               "--disable servicelb"
               "--disable traefik"
-              "--node-ip 192.168.1.3"
               "--pause-image test.local/pause:local"
+              "--node-ip ${nodes.server2.networking.primaryIPAddress}"
+              "--flannel-iface eth1"
             ];
           };
           networking.firewall.allowedTCPPorts = [
@@ -137,19 +133,10 @@ import ../make-test-python.nix (
             6443
           ];
           networking.firewall.allowedUDPPorts = [ 8472 ];
-          networking.firewall.trustedInterfaces = [ "flannel.1" ];
-          networking.useDHCP = false;
-          networking.defaultGateway = "192.168.1.3";
-          networking.interfaces.eth1.ipv4.addresses = pkgs.lib.mkForce [
-            {
-              address = "192.168.1.3";
-              prefixLength = 24;
-            }
-          ];
         };
 
       agent =
-        { pkgs, ... }:
+        { nodes, pkgs, ... }:
         {
           virtualisation.memorySize = 1024;
           virtualisation.diskSize = 2048;
@@ -159,23 +146,15 @@ import ../make-test-python.nix (
             role = "agent";
             package = k3s;
             images = [ pauseImage ];
-            serverAddr = "https://192.168.1.3:6443";
+            serverAddr = "https://${nodes.server2.networking.primaryIPAddress}:6443";
             extraFlags = [
               "--pause-image test.local/pause:local"
-              "--node-ip 192.168.1.2"
+              "--node-ip ${nodes.agent.networking.primaryIPAddress}"
+              "--flannel-iface eth1"
             ];
           };
           networking.firewall.allowedTCPPorts = [ 6443 ];
           networking.firewall.allowedUDPPorts = [ 8472 ];
-          networking.firewall.trustedInterfaces = [ "flannel.1" ];
-          networking.useDHCP = false;
-          networking.defaultGateway = "192.168.1.2";
-          networking.interfaces.eth1.ipv4.addresses = pkgs.lib.mkForce [
-            {
-              address = "192.168.1.2";
-              prefixLength = 24;
-            }
-          ];
         };
     };
 

From 29e175caa7462eb3d7d222538ee61ea12c5f83a0 Mon Sep 17 00:00:00 2001
From: Lorenz Leutgeb <lorenz@leutgeb.xyz>
Date: Thu, 16 Jan 2025 11:49:07 +0100
Subject: [PATCH 14/71] =?UTF-8?q?benchexec:=203.21=20=E2=86=92=203.27?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 pkgs/by-name/be/benchexec/package.nix | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/be/benchexec/package.nix b/pkgs/by-name/be/benchexec/package.nix
index be860eaad4d0..bca21cbc4506 100644
--- a/pkgs/by-name/be/benchexec/package.nix
+++ b/pkgs/by-name/be/benchexec/package.nix
@@ -9,17 +9,22 @@
 }:
 python3.pkgs.buildPythonApplication rec {
   pname = "benchexec";
-  version = "3.21";
+  version = "3.27";
 
   src = fetchFromGitHub {
     owner = "sosy-lab";
     repo = "benchexec";
     rev = version;
-    hash = "sha256-bE3brmmLHZQakDKvd47I1hm9Dcsu6DrSeJyjWWtEZWI=";
+    hash = "sha256-lokz7klAQAascij0T/T43/PrbMh6ZUAvFnIqg13pVUk=";
   };
 
   pyproject = true;
 
+  postPatch = ''
+    substituteInPlace pyproject.toml \
+      --replace-fail 'setuptools ==' 'setuptools >='
+  '';
+
   nativeBuildInputs = with python3.pkgs; [ setuptools ];
 
   # NOTE: CPU Energy Meter is not added,

From 091a9595f34cee856026e4451920d14e23ed0852 Mon Sep 17 00:00:00 2001
From: Niklas Korz <niklas@niklaskorz.de>
Date: Thu, 20 Feb 2025 19:04:43 +0100
Subject: [PATCH 15/71] buildRustCrate: make default value for codegenUnits
 configurable

---
 pkgs/build-support/rust/build-rust-crate/default.nix | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/pkgs/build-support/rust/build-rust-crate/default.nix b/pkgs/build-support/rust/build-rust-crate/default.nix
index db9c2d784f6b..6b17568a81a6 100644
--- a/pkgs/build-support/rust/build-rust-crate/default.nix
+++ b/pkgs/build-support/rust/build-rust-crate/default.nix
@@ -13,6 +13,10 @@
 , cargo
 , jq
 , libiconv
+# Controls codegen parallelization for all crates.
+# May be overriden on a per-crate level.
+# See <https://doc.rust-lang.org/rustc/codegen-options/index.html#codegen-units>
+, defaultCodegenUnits ? 1
 }:
 
 let
@@ -339,7 +343,7 @@ crate_: lib.makeOverridable
       colors = lib.attrByPath [ "colors" ] "always" crate;
       extraLinkFlags = lib.concatStringsSep " " (crate.extraLinkFlags or [ ]);
       edition = crate.edition or null;
-      codegenUnits = if crate ? codegenUnits then crate.codegenUnits else 1;
+      codegenUnits = if crate ? codegenUnits then crate.codegenUnits else defaultCodegenUnits;
       extraRustcOpts =
         lib.optionals (crate ? extraRustcOpts) crate.extraRustcOpts
           ++ extraRustcOpts_

From 816683394f96ca79d56691685d767e9f1e1120d4 Mon Sep 17 00:00:00 2001
From: Shelvacu <git@shelvacu.com>
Date: Mon, 24 Feb 2025 19:43:20 -0800
Subject: [PATCH 16/71] sm64coopdx: 1.1.1 -> 1.2.1

No breaking changes

https://github.com/coop-deluxe/sm64coopdx/releases/tag/v1.2.0

https://github.com/coop-deluxe/sm64coopdx/releases/tag/v1.2.1
---
 pkgs/by-name/sm/sm64coopdx/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/sm/sm64coopdx/package.nix b/pkgs/by-name/sm/sm64coopdx/package.nix
index 52d4911ae070..4727d240eed7 100644
--- a/pkgs/by-name/sm/sm64coopdx/package.nix
+++ b/pkgs/by-name/sm/sm64coopdx/package.nix
@@ -36,13 +36,13 @@ in
 # note: there is a generic builder in pkgs/games/sm64ex/generic.nix that is meant to help build sm64ex and its forks; however sm64coopdx has departed significantly enough in its build that it doesn't make sense to use that other than the baseRom derivation
 stdenv.mkDerivation (finalAttrs: {
   pname = "sm64coopdx";
-  version = "1.1.1";
+  version = "1.2.1";
 
   src = fetchFromGitHub {
     owner = "coop-deluxe";
     repo = "sm64coopdx";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-ktdvzOUYSh6H49BVDovqYt5CGyvJi4UW6nJOOD/HGGU=";
+    hash = "sha256-QWxhu7wGIjOIJyqjqakUzhhF+WxQslZdX3aEWYdDZbw=";
   };
 
   nativeBuildInputs = [ makeWrapper ];

From 4954a67f5cd66b40f7527649db3435738d81c5fa Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Fri, 3 Jan 2025 12:52:02 +0000
Subject: [PATCH 17/71] fping: 5.2 -> 5.3

---
 pkgs/by-name/fp/fping/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/fp/fping/package.nix b/pkgs/by-name/fp/fping/package.nix
index bf97d0c3155a..f38c77f38cb8 100644
--- a/pkgs/by-name/fp/fping/package.nix
+++ b/pkgs/by-name/fp/fping/package.nix
@@ -6,11 +6,11 @@
 
 stdenv.mkDerivation rec {
   pname = "fping";
-  version = "5.2";
+  version = "5.3";
 
   src = fetchurl {
     url = "https://www.fping.org/dist/fping-${version}.tar.gz";
-    hash = "sha256-p2ktENc/sLt24fdFmqfxm7zb/Frb7e8C9GiXSxiw5C8=";
+    hash = "sha256-1XvQFBrqCC4638GYv8PbXf0SpwFMfCZV6X9hzVSQHQ4=";
   };
 
   configureFlags = [

From 99142b983957f5928bd745704efc1aada8fe98d2 Mon Sep 17 00:00:00 2001
From: bb2020 <bb2020@users.noreply.github.com>
Date: Mon, 6 Feb 2023 11:27:47 +0300
Subject: [PATCH 18/71] xkeysnail: fix build

---
 .../{browser-emacs-bindings.py => emacs.py}   | 35 +++++++++----------
 pkgs/by-name/xk/xkeysnail/package.nix         | 22 ++++++------
 2 files changed, 28 insertions(+), 29 deletions(-)
 rename pkgs/by-name/xk/xkeysnail/{browser-emacs-bindings.py => emacs.py} (73%)

diff --git a/pkgs/by-name/xk/xkeysnail/browser-emacs-bindings.py b/pkgs/by-name/xk/xkeysnail/emacs.py
similarity index 73%
rename from pkgs/by-name/xk/xkeysnail/browser-emacs-bindings.py
rename to pkgs/by-name/xk/xkeysnail/emacs.py
index 347ac17d33fc..0df5042e277a 100644
--- a/pkgs/by-name/xk/xkeysnail/browser-emacs-bindings.py
+++ b/pkgs/by-name/xk/xkeysnail/emacs.py
@@ -3,22 +3,21 @@ import re
 from xkeysnail.transform import *
 
 aa = False
-def aa_setvar(v):
-    def _aa_setvar():
+def aaset(v):
+    def _aaset():
         transform._mark_set = False
         global aa; aa = v
-    return _aa_setvar
-def aa_ifvar():
-    def _aa_ifvar():
-        transform._mark_set = False
-        global aa
+    return _aaset
+def aaif():
+    def _aaif():
+        global aa; transform._mark_set = False
         if aa: aa = False; return K("esc")
         return K("enter")
-    return _aa_ifvar
-def aa_flipmark():
-    def _aa_flipmark():
+    return _aaif
+def aaflip():
+    def _aaflip():
         transform._mark_set = not transform._mark_set;
-    return _aa_flipmark
+    return _aaflip
 
 define_keymap(re.compile("Google-chrome|Chromium-browser|firefox"), {
     K("C-b"): with_mark(K("left")),
@@ -37,17 +36,17 @@ define_keymap(re.compile("Google-chrome|Chromium-browser|firefox"), {
     K("C-d"): [K("delete"), set_mark(False)],
     K("M-d"): [K("C-delete"), set_mark(False)],
     K("M-backspace"): [K("C-backspace"), set_mark(False)],
-
     K("C-slash"): [K("C-z"), set_mark(False)],
-    K("C-space"): aa_flipmark(),
+
+    K("C-space"): aaflip(),
+    # K("C-space"): set_mark(True),
     K("C-M-space"): with_or_set_mark(K("C-right")),
 
+    K("enter"): aaif(),
+    K("C-s"): [K("F3"), aaset(True)],
+    K("C-r"): [K("Shift-F3"), aaset(True)],
+    K("C-g"): [K("esc"), aaset(False)]
     # K("C-s"): K("F3"),
     # K("C-r"): K("Shift-F3"),
     # K("C-g"): [K("esc"), set_mark(False)]
-
-    K("C-s"): [K("F3"), aa_setvar(True)],
-    K("C-r"): [K("Shift-F3"), aa_setvar(True)],
-    K("C-g"): [K("esc"), aa_setvar(False)],
-    K("enter"): aa_ifvar()
 })
diff --git a/pkgs/by-name/xk/xkeysnail/package.nix b/pkgs/by-name/xk/xkeysnail/package.nix
index 3ab9d84f5481..4ebbfe05edd7 100644
--- a/pkgs/by-name/xk/xkeysnail/package.nix
+++ b/pkgs/by-name/xk/xkeysnail/package.nix
@@ -1,22 +1,28 @@
 {
   lib,
   fetchFromGitHub,
-  makeWrapper,
   python3Packages,
+  fetchpatch,
 }:
 
 python3Packages.buildPythonApplication rec {
   pname = "xkeysnail";
-  version = "0.4.0";
+  version = "0.4";
 
   src = fetchFromGitHub {
     owner = "mooz";
     repo = pname;
     rev = "bf3c93b4fe6efd42893db4e6588e5ef1c4909cfb";
-    sha256 = "0plcpb4ndzfsd5hj32m0g32swnhyph9sd759cdhhzmjvlq3j8q6p";
+    hash = "sha256-12AkB6Zb1g9hY6mcphO8HlquxXigiiFhadr9Zsm6jF4=";
   };
 
-  nativeBuildInputs = [ makeWrapper ];
+  patches = [
+    (fetchpatch {
+      url = "https://github.com/mooz/xkeysnail/commit/457ab424fb32c4bfc6e6ea307752a2ce5d77853b.patch";
+      hash = "sha256-yqsAfn3SibRW2clbtVwVZi1dJ8pAiXoYpittpz7S/wU=";
+    })
+  ];
+
   propagatedBuildInputs = with python3Packages; [
     evdev
     xlib
@@ -24,15 +30,9 @@ python3Packages.buildPythonApplication rec {
     appdirs
   ];
 
-  doCheck = false;
-
   postInstall = ''
-    mkdir -p $out/share
-    cp ./example/config.py $out/share/example.py
-    cp ${./browser-emacs-bindings.py} $out/share/browser.py
+    install -Dm444 ${./emacs.py} $out/share/browser.py
 
-    makeWrapper $out/bin/xkeysnail $out/bin/xkeysnail-example \
-      --add-flags "-q" --add-flags "$out/share/example.py"
     makeWrapper $out/bin/xkeysnail $out/bin/xkeysnail-browser \
       --add-flags "-q" --add-flags "$out/share/browser.py"
   '';

From b1cdf059e473fac05f9460bb78af59888f7be055 Mon Sep 17 00:00:00 2001
From: Shogo Takata <peshogo@gmail.com>
Date: Sat, 1 Mar 2025 11:47:59 +0900
Subject: [PATCH 19/71] super-productivity: 11.1.2 -> 11.1.3, build from source

---
 .../by-name/su/super-productivity/package.nix | 140 ++++++++++++++----
 1 file changed, 113 insertions(+), 27 deletions(-)

diff --git a/pkgs/by-name/su/super-productivity/package.nix b/pkgs/by-name/su/super-productivity/package.nix
index e96fa46fe336..e15aca393b30 100644
--- a/pkgs/by-name/su/super-productivity/package.nix
+++ b/pkgs/by-name/su/super-productivity/package.nix
@@ -1,51 +1,137 @@
-{ stdenv , lib , fetchurl , appimageTools , makeWrapper , electron }:
+{
+  buildNpmPackage,
+  copyDesktopItems,
+  electron,
+  fetchFromGitHub,
+  lib,
+  makeDesktopItem,
+  nix-update-script,
+  npm-lockfile-fix,
+  python3,
+  stdenv,
+}:
 
-stdenv.mkDerivation rec {
+buildNpmPackage rec {
   pname = "super-productivity";
-  version = "11.1.2";
+  version = "11.1.3";
 
-  src = fetchurl {
-    url = "https://github.com/johannesjo/super-productivity/releases/download/v${version}/superProductivity-x86_64.AppImage";
-    sha256 = "sha256-AtN7x0Vt0wWxNoXwRc78drFE8UfMpssFBYZ83w1QgbU=";
-    name = "${pname}-${version}.AppImage";
+  src = fetchFromGitHub {
+    owner = "johannesjo";
+    repo = "super-productivity";
+    tag = "v${version}";
+    hash = "sha256-GWpKz1q3pmAozlzawi2ITxo3KH0MSrJCszVQdGTeOXA=";
+
+    postFetch = ''
+      ${lib.getExe npm-lockfile-fix} -r $out/package-lock.json
+    '';
   };
 
-  appimageContents = appimageTools.extractType2 {
-    inherit pname version src;
+  npmDepsHash = "sha256-iP1op4R7OUA7cSW/dJCBBGcb5r6icSbx/X7mYogiMkA=";
+  npmFlags = [ "--legacy-peer-deps" ];
+  makeCacheWritable = true;
+
+  env = {
+    ELECTRON_SKIP_BINARY_DOWNLOAD = "1";
+    CHROMEDRIVER_SKIP_DOWNLOAD = "true";
+    CSC_IDENTITY_AUTO_DISCOVERY = "false";
   };
 
-  dontUnpack = true;
-  dontConfigure = true;
-  dontBuild = true;
+  nativeBuildInputs =
+    [ copyDesktopItems ]
+    ++ lib.optionals (stdenv.hostPlatform.system == "aarch64-linux") [
+      (python3.withPackages (ps: [ ps.setuptools ]))
+    ];
 
-  nativeBuildInputs = [ makeWrapper ];
+  # package.json does not include `core-js` and the comment suggests
+  # it is only needed on some mobile platforms
+  postPatch = ''
+    substituteInPlace electron-builder.yaml \
+      --replace-fail "notarize: true" "notarize: false"
+    substituteInPlace src/polyfills.ts \
+      --replace-fail "import 'core-js/es/object';" ""
+  '';
+
+  buildPhase = ''
+    runHook preBuild
+
+    # electronDist needs to be modifiable on Darwin
+    cp -r ${electron.dist} electron-dist
+    chmod -R u+w electron-dist
+
+    npm run buildFrontend:prod:es6
+    npm run electron:build
+    npm exec electron-builder -- --dir \
+      -c.electronDist=electron-dist \
+      -c.electronVersion=${electron.version}
+
+    runHook postBuild
+  '';
 
   installPhase = ''
     runHook preInstall
 
-    mkdir -p $out/bin $out/share/${pname} $out/share/applications
+    ${
+      if stdenv.hostPlatform.isDarwin then
+        ''
+          mkdir -p $out/Applications
+          cp -r "app-builds/mac"*"/Super Productivity.app" "$out/Applications"
+          makeWrapper "$out/Applications/Super Productivity.app/Contents/MacOS/Super Productivity" "$out/bin/super-productivity"
+        ''
+      else
+        ''
+          mkdir -p $out/share/super-productivity/{app,defaults,static/plugins,static/resources/plugins}
+          cp -r app-builds/*-unpacked/{locales,resources{,.pak}} "$out/share/super-productivity/app"
 
-    cp -a ${appimageContents}/{locales,resources} $out/share/${pname}
-    cp -a ${appimageContents}/superproductivity.desktop $out/share/applications/${pname}.desktop
-    cp -a ${appimageContents}/usr/share/icons $out/share
+          for size in 16 32 48 64 128 256 512 1024; do
+            local sizexsize="''${size}x''${size}"
+            mkdir -p $out/share/icons/hicolor/$sizexsize/apps
+            cp -v build/icons/$sizexsize.png \
+              $out/share/icons/hicolor/$sizexsize/apps/super-productivity.png
+          done
 
-    substituteInPlace $out/share/applications/${pname}.desktop \
-      --replace 'Exec=AppRun' 'Exec=${pname}'
+          makeWrapper '${lib.getExe electron}' "$out/bin/super-productivity" \
+            --add-flags "$out/share/super-productivity/app/resources/app.asar" \
+            --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--ozone-platform-hint=auto --enable-features=WaylandWindowDecorations}}" \
+            --set-default ELECTRON_FORCE_IS_PACKAGED 1 \
+            --inherit-argv0
+        ''
+    }
 
     runHook postInstall
   '';
 
-  postFixup = ''
-    makeWrapper ${electron}/bin/electron $out/bin/${pname} \
-      --add-flags $out/share/${pname}/resources/app.asar
-  '';
+  # copied from deb file
+  desktopItems = [
+    (makeDesktopItem {
+      name = "super-productivity";
+      desktopName = "superProductivity";
+      exec = "super-productivity %u";
+      terminal = false;
+      type = "Application";
+      icon = "super-productivity";
+      startupWMClass = "superProductivity";
+      comment = builtins.replaceStrings [ "\n" ] [ " " ] meta.longDescription;
+      categories = [ "Utility" ];
+    })
+  ];
 
-  meta = with lib; {
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
     description = "To Do List / Time Tracker with Jira Integration";
+    longDescription = ''
+      Experience the best ToDo app for digital professionals and get more done!
+      Super Productivity comes with integrated time-boxing and time tracking capabilities
+      and you can load your task from your calendars and from
+      Jira, Gitlab, GitHub, Open Project and others all into a single ToDo list.
+    '';
     homepage = "https://super-productivity.com";
-    license = licenses.mit;
-    platforms = [ "x86_64-linux" ];
-    maintainers = with maintainers; [ offline ];
+    license = lib.licenses.mit;
+    platforms = lib.platforms.all;
+    maintainers = with lib.maintainers; [
+      offline
+      pineapplehunter
+    ];
     mainProgram = "super-productivity";
   };
 }

From 5b82a10c4bb4669651adfffd600d231708871a72 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Mon, 3 Mar 2025 07:54:32 +0000
Subject: [PATCH 20/71] buffybox: 3.2.0-unstable-2024-12-09 ->
 3.2.0-unstable-2025-02-27

---
 pkgs/by-name/bu/buffybox/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/bu/buffybox/package.nix b/pkgs/by-name/bu/buffybox/package.nix
index e264825e97fe..b134c7f105a0 100644
--- a/pkgs/by-name/bu/buffybox/package.nix
+++ b/pkgs/by-name/bu/buffybox/package.nix
@@ -15,15 +15,15 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "buffybox";
-  version = "3.2.0-unstable-2024-12-09";
+  version = "3.2.0-unstable-2025-02-27";
 
   src = fetchFromGitLab {
     domain = "gitlab.postmarketos.org";
     owner = "postmarketOS";
     repo = "buffybox";
     fetchSubmodules = true; # to use its vendored lvgl
-    rev = "32f4837e836fbb0b820d68c74c3278c925369b04";
-    hash = "sha256-d9fa/Zqbm/+WMRmO0hBW83PCTDgaVOAxyRuSTItr9Xs=";
+    rev = "6bf7a8406f3a3fa79831d2d151e519b703b9e135";
+    hash = "sha256-q3TNYRv5Cim+WklXw2ZTW6Ico1h8Xxs9MhTFhHZUMW0=";
   };
 
   depsBuildBuild = [

From 0bc160ade0f6ad4d4babd7f5d1d42004368e9262 Mon Sep 17 00:00:00 2001
From: OPNA2608 <opna2608@protonmail.com>
Date: Mon, 3 Mar 2025 13:50:16 +0100
Subject: [PATCH 21/71] ppsspp-qt: Fix Qt wrapping

---
 pkgs/by-name/pp/ppsspp/package.nix | 15 ++++++++++++---
 1 file changed, 12 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/pp/ppsspp/package.nix b/pkgs/by-name/pp/ppsspp/package.nix
index f965d598dd3d..c909425f7814 100644
--- a/pkgs/by-name/pp/ppsspp/package.nix
+++ b/pkgs/by-name/pp/ppsspp/package.nix
@@ -89,6 +89,8 @@ stdenv.mkDerivation (finalAttrs: {
       libffi
     ];
 
+  dontWrapQtApps = true;
+
   cmakeFlags = [
     (lib.cmakeBool "HEADLESS" (!enableQt))
     (lib.cmakeBool "USE_SYSTEM_FFMPEG" useSystemFfmpeg)
@@ -147,9 +149,16 @@ stdenv.mkDerivation (finalAttrs: {
         lib.optionals enableVulkan [
           "--prefix LD_LIBRARY_PATH : ${lib.makeLibraryPath [ vulkan-loader ]}"
         ]
-        ++ lib.optionals (!enableQt) [
-          "--set SDL_VIDEODRIVER ${if forceWayland then "wayland" else "x11"}"
-        ]
+        ++ (
+          if enableQt then
+            [
+              "\${qtWrapperArgs[@]}"
+            ]
+          else
+            [
+              "--set SDL_VIDEODRIVER ${if forceWayland then "wayland" else "x11"}"
+            ]
+        )
       );
       binToBeWrapped = if enableQt then "PPSSPPQt" else "PPSSPPSDL";
     in

From bf68ce7d1b20a9186073e769a33dcab5186c4ba6 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=E0=B9=82=E0=B8=97=E0=B8=AA=E0=B8=BA=E0=B8=95=E0=B8=B1?=
 =?UTF-8?q?=E0=B8=A5?= <toastal@posteo.net>
Date: Mon, 3 Mar 2025 20:48:29 +0700
Subject: [PATCH 22/71] aerc: make notmuch optional
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

I don’t use it & notmuch is currently not building
---
 pkgs/by-name/ae/aerc/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/ae/aerc/package.nix b/pkgs/by-name/ae/aerc/package.nix
index 7fa713a762e6..14a25b37b414 100644
--- a/pkgs/by-name/ae/aerc/package.nix
+++ b/pkgs/by-name/ae/aerc/package.nix
@@ -3,6 +3,7 @@
   buildGoModule,
   fetchFromSourcehut,
   ncurses,
+  withNotmuch ? true,
   notmuch,
   scdoc,
   python3Packages,
@@ -50,14 +51,13 @@ buildGoModule rec {
 
   buildInputs = [
     python3Packages.python
-    notmuch
     gawk
-  ];
+  ] ++ lib.optional withNotmuch notmuch;
 
   installPhase = ''
     runHook preInstall
 
-    make $makeFlags GOFLAGS="$GOFLAGS -tags=notmuch" install
+    make $makeFlags GOFLAGS="$GOFLAGS${lib.optionalString withNotmuch " -tags=notmuch"}" install
 
     runHook postInstall
   '';

From 0ae7ec758d819f9215644fbf8066721731d4d9b4 Mon Sep 17 00:00:00 2001
From: Silvan Mosberger <silvan.mosberger@moduscreate.com>
Date: Tue, 4 Mar 2025 18:00:12 +0100
Subject: [PATCH 23/71] nixfmt-rfc-style: 2024-12-04 -> 2025-03-03

---
 pkgs/by-name/ni/nixfmt-rfc-style/date.txt              | 2 +-
 pkgs/by-name/ni/nixfmt-rfc-style/generated-package.nix | 6 ++++--
 2 files changed, 5 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/ni/nixfmt-rfc-style/date.txt b/pkgs/by-name/ni/nixfmt-rfc-style/date.txt
index f10b48d26d34..323e1df227fb 100644
--- a/pkgs/by-name/ni/nixfmt-rfc-style/date.txt
+++ b/pkgs/by-name/ni/nixfmt-rfc-style/date.txt
@@ -1 +1 @@
-2024-12-04
+2025-03-03
diff --git a/pkgs/by-name/ni/nixfmt-rfc-style/generated-package.nix b/pkgs/by-name/ni/nixfmt-rfc-style/generated-package.nix
index fef426625f0c..95e0871add42 100644
--- a/pkgs/by-name/ni/nixfmt-rfc-style/generated-package.nix
+++ b/pkgs/by-name/ni/nixfmt-rfc-style/generated-package.nix
@@ -14,6 +14,7 @@
   mtl,
   parser-combinators,
   pretty-simple,
+  process,
   safe-exceptions,
   scientific,
   text,
@@ -24,8 +25,8 @@ mkDerivation {
   pname = "nixfmt";
   version = "0.6.0";
   src = fetchzip {
-    url = "https://github.com/nixos/nixfmt/archive/a4639036723e510d8331124c80d9ca14dd7aba02.tar.gz";
-    sha256 = "0zpkljcvfnwn1ik5cgvq396xkpp053k4lh62a24c4g434n2vz0rj";
+    url = "https://github.com/nixos/nixfmt/archive/3261d1016ecc753c59ff92767a257f91b587e705.tar.gz";
+    sha256 = "0jk6mgp710iwxyc7wa5kzz0p0rpcwbbs21smnv14cyii0jniz42s";
   };
   isLibrary = true;
   isExecutable = true;
@@ -46,6 +47,7 @@ mkDerivation {
     directory
     file-embed
     filepath
+    process
     safe-exceptions
     text
     transformers

From 8bd9f1d37344e9698017f68befabb353bbe117d8 Mon Sep 17 00:00:00 2001
From: Jan Solanti <jhs@psonet.com>
Date: Tue, 4 Mar 2025 21:18:51 +0200
Subject: [PATCH 24/71] tauon: add DB migration warning to release notes

---
 nixos/doc/manual/release-notes/rl-2505.section.md | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/nixos/doc/manual/release-notes/rl-2505.section.md b/nixos/doc/manual/release-notes/rl-2505.section.md
index f6578de089f2..6374e545a1a3 100644
--- a/nixos/doc/manual/release-notes/rl-2505.section.md
+++ b/nixos/doc/manual/release-notes/rl-2505.section.md
@@ -265,6 +265,8 @@
   See the [1.3.0 changelog](https://git.sr.ht/~mil/mepo/refs/1.3.0)
   for more details.
 
+- `tauon` 7.9.0+ when launched for the first time, migrates its database to a new schema that is not backwards compatible. Older versions will refuse to start at all with that database afterwards. If you need to still use older tauon versions, make sure to back up `~/.local/share/TauonMusicBox`.
+
 - The `earlyoom` service is now using upstream systemd service, which enables
   hardening and filesystem isolation by default. If you need filesystem write
   access or want to access home directory via `killHook`, hardening setting can

From 47310c4622262f8ed680ee6d8808b745812f2756 Mon Sep 17 00:00:00 2001
From: Jan Solanti <jhs@psonet.com>
Date: Tue, 4 Mar 2025 21:19:13 +0200
Subject: [PATCH 25/71] tauon: update changelog URL

---
 pkgs/by-name/ta/tauon/package.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/by-name/ta/tauon/package.nix b/pkgs/by-name/ta/tauon/package.nix
index f8cbae0fe90a..ec9388a4435b 100644
--- a/pkgs/by-name/ta/tauon/package.nix
+++ b/pkgs/by-name/ta/tauon/package.nix
@@ -139,7 +139,7 @@ python3Packages.buildPythonApplication rec {
     description = "Linux desktop music player from the future";
     mainProgram = "tauon";
     homepage = "https://tauonmusicbox.rocks/";
-    changelog = "https://github.com/Taiko2k/TauonMusicBox/releases/tag/v${version}";
+    changelog = "https://github.com/Taiko2k/Tauon/releases/tag/v${version}";
     license = licenses.gpl3;
     maintainers = with maintainers; [ jansol ];
     platforms = platforms.linux ++ platforms.darwin;

From 4b1c49fedec451dd9d94f3692191e5df45147a84 Mon Sep 17 00:00:00 2001
From: Lin Jian <me@linj.tech>
Date: Wed, 5 Mar 2025 10:08:16 +0800
Subject: [PATCH 26/71] emacs.pkgs.irony: respect old.env in overrideAttrs

---
 .../editors/emacs/elisp-packages/melpa-packages.nix             | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/applications/editors/emacs/elisp-packages/melpa-packages.nix b/pkgs/applications/editors/emacs/elisp-packages/melpa-packages.nix
index 2ed31090e106..1108d0e154b6 100644
--- a/pkgs/applications/editors/emacs/elisp-packages/melpa-packages.nix
+++ b/pkgs/applications/editors/emacs/elisp-packages/melpa-packages.nix
@@ -294,7 +294,7 @@ let
 
         irony = super.irony.overrideAttrs (old: {
           cmakeFlags = old.cmakeFlags or [ ] ++ [ "-DCMAKE_INSTALL_BINDIR=bin" ];
-          env.NIX_CFLAGS_COMPILE = "-UCLANG_RESOURCE_DIR";
+          env = old.env or { } // { NIX_CFLAGS_COMPILE = "-UCLANG_RESOURCE_DIR"; };
           preConfigure = ''
             pushd server
           '';

From c6fef5561623762dcb8e6d3063a6871225bc592e Mon Sep 17 00:00:00 2001
From: Lin Jian <me@linj.tech>
Date: Wed, 5 Mar 2025 10:10:35 +0800
Subject: [PATCH 27/71] emacs.pkgs.{pdf-tools,auto-complete-clang-async}: use
 env attr

This is compatible with __structuredAttrs.
---
 .../editors/emacs/elisp-packages/melpa-packages.nix       | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/pkgs/applications/editors/emacs/elisp-packages/melpa-packages.nix b/pkgs/applications/editors/emacs/elisp-packages/melpa-packages.nix
index 1108d0e154b6..40a6f2f7aec3 100644
--- a/pkgs/applications/editors/emacs/elisp-packages/melpa-packages.nix
+++ b/pkgs/applications/editors/emacs/elisp-packages/melpa-packages.nix
@@ -153,8 +153,10 @@ let
         # https://github.com/Golevka/emacs-clang-complete-async/issues/90
         auto-complete-clang-async = (addPackageRequires super.auto-complete-clang-async [ self.auto-complete ]).overrideAttrs (old: {
           buildInputs = old.buildInputs ++ [ pkgs.llvmPackages.llvm ];
-          CFLAGS = "-I${lib.getLib pkgs.llvmPackages.libclang}/include";
-          LDFLAGS = "-L${lib.getLib pkgs.llvmPackages.libclang}/lib";
+          env = old.env or { } // {
+            CFLAGS = "-I${lib.getLib pkgs.llvmPackages.libclang}/include";
+            LDFLAGS = "-L${lib.getLib pkgs.llvmPackages.libclang}/lib";
+          };
         });
 
         # part of a larger package
@@ -242,7 +244,7 @@ let
           #   - https://github.com/vedang/pdf-tools/issues/102
           #   - https://github.com/vedang/pdf-tools/issues/103
           #   - https://github.com/vedang/pdf-tools/issues/109
-          CXXFLAGS = "-std=c++17";
+          env = old.env or { } // { CXXFLAGS = "-std=c++17"; };
 
           nativeBuildInputs = old.nativeBuildInputs ++ [
             pkgs.autoconf

From f698c4dd154885c1edf953de65ca44edda253ea8 Mon Sep 17 00:00:00 2001
From: Lin Jian <me@linj.tech>
Date: Wed, 5 Mar 2025 10:02:55 +0800
Subject: [PATCH 28/71] emacs: support __structuredAttrs in elisp build helpers

---
 .../editors/emacs/build-support/elpa.nix         |  4 +++-
 .../editors/emacs/build-support/elpa2nix.el      | 16 ++++------------
 .../editors/emacs/build-support/melpa.nix        |  4 +++-
 3 files changed, 10 insertions(+), 14 deletions(-)

diff --git a/pkgs/applications/editors/emacs/build-support/elpa.nix b/pkgs/applications/editors/emacs/build-support/elpa.nix
index fcaef43953ef..50abadccf9d9 100644
--- a/pkgs/applications/editors/emacs/build-support/elpa.nix
+++ b/pkgs/applications/editors/emacs/build-support/elpa.nix
@@ -43,7 +43,9 @@ lib.extendMkDerivation {
 
           emacs --batch -Q -l "$elpa2nix" \
               -f elpa2nix-install-package \
-              "$src" "$out/share/emacs/site-lisp/elpa"
+              "$src" "$out/share/emacs/site-lisp/elpa" \
+              ${if finalAttrs.turnCompilationWarningToError then "t" else "nil"} \
+              ${if finalAttrs.ignoreCompilationError then "t" else "nil"}
 
           runHook postInstall
         '';
diff --git a/pkgs/applications/editors/emacs/build-support/elpa2nix.el b/pkgs/applications/editors/emacs/build-support/elpa2nix.el
index 97cf2fd58a06..5b363b7b6640 100644
--- a/pkgs/applications/editors/emacs/build-support/elpa2nix.el
+++ b/pkgs/applications/editors/emacs/build-support/elpa2nix.el
@@ -5,8 +5,10 @@
   (if (not noninteractive)
       (error "`elpa2nix-install-package' is to be used only with -batch"))
   (pcase command-line-args-left
-    (`(,archive ,elpa)
-     (progn (setq package-user-dir elpa)
+    (`(,archive ,elpa ,turn-compilation-warning-to-error ,ignore-compilation-error)
+     (progn (setq byte-compile-error-on-warn (string= turn-compilation-warning-to-error "t"))
+            (setq byte-compile-debug (string= ignore-compilation-error "nil"))
+            (setq package-user-dir elpa)
             (elpa2nix-install-file archive)))))
 
 (defun elpa2nix-install-from-buffer ()
@@ -31,13 +33,3 @@ The file can either be a tar file or an Emacs Lisp file."
 
 ;; Allow installing package tarfiles larger than 10MB
 (setq large-file-warning-threshold nil)
-
-(let ((flag (getenv "turnCompilationWarningToError")))
-  (when (and flag
-             ;; we do not use `string-empty-p' because it requires subr-x in Emacs <= 26
-             (not (string= flag "")))
-    (setq byte-compile-error-on-warn t)))
-
-(let ((flag (getenv "ignoreCompilationError")))
-  (when (string= flag "")
-    (setq byte-compile-debug t)))
diff --git a/pkgs/applications/editors/emacs/build-support/melpa.nix b/pkgs/applications/editors/emacs/build-support/melpa.nix
index bdca913e865d..876cf9a46ddc 100644
--- a/pkgs/applications/editors/emacs/build-support/melpa.nix
+++ b/pkgs/applications/editors/emacs/build-support/melpa.nix
@@ -185,7 +185,9 @@ lib.extendMkDerivation {
           emacs --batch -Q \
               -l "$elpa2nix" \
               -f elpa2nix-install-package \
-              "$archive" "$out/share/emacs/site-lisp/elpa"
+              "$archive" "$out/share/emacs/site-lisp/elpa" \
+              ${if finalAttrs.turnCompilationWarningToError then "t" else "nil"} \
+              ${if finalAttrs.ignoreCompilationError then "t" else "nil"}
 
           runHook postInstall
         '';

From d64a233e4cfbffffab25b05bfa51487e718be260 Mon Sep 17 00:00:00 2001
From: Lin Jian <me@linj.tech>
Date: Wed, 5 Mar 2025 10:05:37 +0800
Subject: [PATCH 29/71] emacs: enable __structuredAttrs by default in elisp
 build helpers

---
 nixos/doc/manual/release-notes/rl-2505.section.md         | 3 +++
 pkgs/applications/editors/emacs/build-support/generic.nix | 1 +
 2 files changed, 4 insertions(+)

diff --git a/nixos/doc/manual/release-notes/rl-2505.section.md b/nixos/doc/manual/release-notes/rl-2505.section.md
index 1140e9b5ddff..389998f4a272 100644
--- a/nixos/doc/manual/release-notes/rl-2505.section.md
+++ b/nixos/doc/manual/release-notes/rl-2505.section.md
@@ -198,6 +198,9 @@
 
 - `pkgs.nextcloud28` has been removed since it's out of support upstream.
 
+- Emacs lisp build helpers, such as `emacs.pkgs.melpaBuild`, now enables `__structuredAttrs` by default.
+  Environment variables have to be passed via the `env` attribute.
+
 - `buildGoModule` now passes environment variables via the `env` attribute. `CGO_ENABLED` should now be specified with `env.CGO_ENABLED` when passing to buildGoModule. Direct specification of `CGO_ENABLED` is now redirected by a compatibility layer with a warning, but will become an error in future releases.
 
   Go-related environment variables previously shadowed by `buildGoModule` now results in errors when specified directly. Such variables include `GOOS` and `GOARCH`.
diff --git a/pkgs/applications/editors/emacs/build-support/generic.nix b/pkgs/applications/editors/emacs/build-support/generic.nix
index ddab4bc70a00..b4e96f6490fb 100644
--- a/pkgs/applications/editors/emacs/build-support/generic.nix
+++ b/pkgs/applications/editors/emacs/build-support/generic.nix
@@ -61,6 +61,7 @@ lib.extendMkDerivation {
       propagatedUserEnvPkgs = finalAttrs.packageRequires ++ propagatedUserEnvPkgs;
 
       strictDeps = args.strictDeps or true;
+      __structuredAttrs = args.__structuredAttrs or true;
 
       inherit turnCompilationWarningToError ignoreCompilationError;
 

From e4f7cdf8873ab43f8c6f7ee7f06a705cc8eb27f6 Mon Sep 17 00:00:00 2001
From: Luflosi <luflosi@luflosi.de>
Date: Tue, 25 Feb 2025 16:55:27 +0100
Subject: [PATCH 30/71] feedbackd: add Luflosi as maintainer

---
 pkgs/by-name/fe/feedbackd/package.nix | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/pkgs/by-name/fe/feedbackd/package.nix b/pkgs/by-name/fe/feedbackd/package.nix
index 5c0ab1d28498..66f09bbea4d2 100644
--- a/pkgs/by-name/fe/feedbackd/package.nix
+++ b/pkgs/by-name/fe/feedbackd/package.nix
@@ -110,7 +110,10 @@ stdenv.mkDerivation (finalAttrs: {
     description = "Daemon to provide haptic (and later more) feedback on events";
     homepage = "https://source.puri.sm/Librem5/feedbackd";
     license = licenses.gpl3Plus;
-    maintainers = with maintainers; [ pacman99 ];
+    maintainers = with maintainers; [
+      pacman99
+      Luflosi
+    ];
     platforms = platforms.linux;
   };
 })

From ba9fb5494f2a0cf8586cb904b965caff5fd376ff Mon Sep 17 00:00:00 2001
From: Luflosi <luflosi@luflosi.de>
Date: Tue, 25 Feb 2025 14:53:25 +0100
Subject: [PATCH 31/71] feedbackd: add passthru.updateScript

---
 pkgs/by-name/fe/feedbackd/package.nix | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/pkgs/by-name/fe/feedbackd/package.nix b/pkgs/by-name/fe/feedbackd/package.nix
index 66f09bbea4d2..0202c23cccce 100644
--- a/pkgs/by-name/fe/feedbackd/package.nix
+++ b/pkgs/by-name/fe/feedbackd/package.nix
@@ -20,6 +20,7 @@
   dbus,
   gmobile,
   umockdev,
+  nix-update-script,
 }:
 
 let
@@ -106,6 +107,10 @@ stdenv.mkDerivation (finalAttrs: {
     fi
   '';
 
+  passthru = {
+    updateScript = nix-update-script { };
+  };
+
   meta = with lib; {
     description = "Daemon to provide haptic (and later more) feedback on events";
     homepage = "https://source.puri.sm/Librem5/feedbackd";

From d3d77fbad043f37de345ad9e665c68293f4e261c Mon Sep 17 00:00:00 2001
From: Luflosi <luflosi@luflosi.de>
Date: Tue, 25 Feb 2025 14:54:01 +0100
Subject: [PATCH 32/71] feedbackd: 0.4.1 -> 0.7.0

https://source.puri.sm/Librem5/feedbackd/-/releases/v0.5.0
https://source.puri.sm/Librem5/feedbackd/-/releases/v0.6.0
https://source.puri.sm/Librem5/feedbackd/-/releases/v0.7.0

Release v0.5.0 mentions a new systemd unit "fbd-alert-slider" but I did not attempt to make it work as I don't have such a device.
---
 nixos/modules/programs/feedbackd.nix  | 2 ++
 pkgs/by-name/fe/feedbackd/package.nix | 4 ++--
 2 files changed, 4 insertions(+), 2 deletions(-)

diff --git a/nixos/modules/programs/feedbackd.nix b/nixos/modules/programs/feedbackd.nix
index e114520c4825..dbace6c4fdaa 100644
--- a/nixos/modules/programs/feedbackd.nix
+++ b/nixos/modules/programs/feedbackd.nix
@@ -25,6 +25,8 @@ in
     services.dbus.packages = [ cfg.package ];
     services.udev.packages = [ cfg.package ];
 
+    # TODO: also enable systemd unit fbd-alert-slider for OnePlus 6/6T devices, see release notes of feedbackd v0.5.0
+
     users.groups.feedbackd = { };
   };
 }
diff --git a/pkgs/by-name/fe/feedbackd/package.nix b/pkgs/by-name/fe/feedbackd/package.nix
index 0202c23cccce..092ac7cc6dc5 100644
--- a/pkgs/by-name/fe/feedbackd/package.nix
+++ b/pkgs/by-name/fe/feedbackd/package.nix
@@ -34,7 +34,7 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "feedbackd";
-  version = "0.4.1";
+  version = "0.7.0";
 
   outputs = [
     "out"
@@ -47,7 +47,7 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "Librem5";
     repo = "feedbackd";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-ta14DYqkid8Cp8fx9ZMGOOJroCBszN9/VrTN6mrpTZg=";
+    hash = "sha256-qwyq1v+20Gotpk0CbUe6MdDJ5bmKmTHOen+rxWljjeA=";
   };
 
   depsBuildBuild = [

From 56d2260fcca433d60c33c129e2016ee81b0809bf Mon Sep 17 00:00:00 2001
From: Audrey Dutcher <audrey@rhelmot.io>
Date: Mon, 24 Feb 2025 00:16:28 -0700
Subject: [PATCH 33/71] libipt: fix linkage on FreeBSD. this fixes the gdb
 build

---
 pkgs/by-name/li/libipt/package.nix | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/pkgs/by-name/li/libipt/package.nix b/pkgs/by-name/li/libipt/package.nix
index 8b2baaad6ce1..33e01b9d7a83 100644
--- a/pkgs/by-name/li/libipt/package.nix
+++ b/pkgs/by-name/li/libipt/package.nix
@@ -20,6 +20,10 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [ cmake ];
   buildInputs = lib.optional stdenv.hostPlatform.isFreeBSD freebsd.libstdthreads;
 
+  env = lib.optionalAttrs stdenv.hostPlatform.isFreeBSD {
+    NIX_LDFLAGS = "-lstdthreads";
+  };
+
   meta = with lib; {
     description = "Intel Processor Trace decoder library";
     homepage = "https://github.com/intel/libipt";

From 671e390c61253554c31fc95bfb43226d50f33987 Mon Sep 17 00:00:00 2001
From: Sefa Eyeoglu <contact@scrumplex.net>
Date: Wed, 5 Mar 2025 23:05:36 +0100
Subject: [PATCH 34/71] qt6ct: switch to new upstream

As pointed out in https://github.com/NixOS/nixpkgs/pull/384376#issuecomment-2701697975 the new upstream is hosted on opencode.net

Signed-off-by: Sefa Eyeoglu <contact@scrumplex.net>
---
 pkgs/tools/misc/qt6ct/default.nix | 11 ++++++-----
 1 file changed, 6 insertions(+), 5 deletions(-)

diff --git a/pkgs/tools/misc/qt6ct/default.nix b/pkgs/tools/misc/qt6ct/default.nix
index a6495283da19..0d025a2d8e27 100644
--- a/pkgs/tools/misc/qt6ct/default.nix
+++ b/pkgs/tools/misc/qt6ct/default.nix
@@ -1,7 +1,7 @@
 {
   lib,
   stdenv,
-  fetchFromGitHub,
+  fetchFromGitLab,
   qtbase,
   qtsvg,
   qtwayland,
@@ -14,11 +14,12 @@ stdenv.mkDerivation (finalAttrs: {
   pname = "qt6ct";
   version = "0.10";
 
-  src = fetchFromGitHub {
-    owner = "ilya-fedin";
+  src = fetchFromGitLab {
+    domain = "www.opencode.net";
+    owner = "trialuser";
     repo = "qt6ct";
     tag = finalAttrs.version;
-    hash = "sha256-ePY+BEpEcAq11+pUMjQ4XG358x3bXFQWwI1UAi+KmLo=";
+    hash = "sha256-o2k/b4AGiblS1CkNInqNrlpM1Y7pydIJzEVgVd3ao50=";
   };
 
   nativeBuildInputs = [
@@ -41,7 +42,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   meta = {
     description = "Qt6 Configuration Tool";
-    homepage = "https://github.com/ilya-fedin/qt6ct";
+    homepage = "https://www.opencode.net/trialuser/qt6ct";
     platforms = lib.platforms.linux;
     license = lib.licenses.bsd2;
     maintainers = with lib.maintainers; [

From 1c4ac8fe1ff4a37d8c9966dd9d02bec0b9eae1be Mon Sep 17 00:00:00 2001
From: Sefa Eyeoglu <contact@scrumplex.net>
Date: Wed, 5 Mar 2025 23:06:44 +0100
Subject: [PATCH 35/71] qt6ct: use CMake

Signed-off-by: Sefa Eyeoglu <contact@scrumplex.net>
---
 pkgs/tools/misc/qt6ct/default.nix | 19 +++++++++----------
 1 file changed, 9 insertions(+), 10 deletions(-)

diff --git a/pkgs/tools/misc/qt6ct/default.nix b/pkgs/tools/misc/qt6ct/default.nix
index 0d025a2d8e27..5fb7301afd4e 100644
--- a/pkgs/tools/misc/qt6ct/default.nix
+++ b/pkgs/tools/misc/qt6ct/default.nix
@@ -1,12 +1,12 @@
 {
-  lib,
-  stdenv,
+  cmake,
   fetchFromGitLab,
+  lib,
   qtbase,
   qtsvg,
-  qtwayland,
-  qmake,
   qttools,
+  qtwayland,
+  stdenv,
   wrapQtAppsHook,
 }:
 
@@ -23,7 +23,7 @@ stdenv.mkDerivation (finalAttrs: {
   };
 
   nativeBuildInputs = [
-    qmake
+    cmake
     qttools
     wrapQtAppsHook
   ];
@@ -34,11 +34,10 @@ stdenv.mkDerivation (finalAttrs: {
     qtwayland
   ];
 
-  qmakeFlags = [
-    "LRELEASE_EXECUTABLE=${lib.getDev qttools}/bin/lrelease"
-    "PLUGINDIR=${placeholder "out"}/${qtbase.qtPluginPrefix}"
-    "LIBDIR=${placeholder "out"}/lib"
-  ];
+  postPatch = ''
+    substituteInPlace src/qt6ct-qtplugin/CMakeLists.txt src/qt6ct-style/CMakeLists.txt \
+      --replace-fail "\''${PLUGINDIR}" "$out/${qtbase.qtPluginPrefix}"
+  '';
 
   meta = {
     description = "Qt6 Configuration Tool";

From 3aa13e02b04ba4a531e51b9e3aa966c56e3c2715 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Thu, 6 Mar 2025 18:48:16 +0000
Subject: [PATCH 36/71] bunster: 0.8.0 -> 0.9.0

---
 pkgs/by-name/bu/bunster/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/bu/bunster/package.nix b/pkgs/by-name/bu/bunster/package.nix
index 0e31ecf2bb07..a9d285bdf5cb 100644
--- a/pkgs/by-name/bu/bunster/package.nix
+++ b/pkgs/by-name/bu/bunster/package.nix
@@ -9,13 +9,13 @@
 
 buildGoModule rec {
   pname = "bunster";
-  version = "0.8.0";
+  version = "0.9.0";
 
   src = fetchFromGitHub {
     owner = "yassinebenaid";
     repo = "bunster";
     tag = "v${version}";
-    hash = "sha256-ZooaM9zi6tC7Y6Oks7OEtMPX0+4kd1UaBGzfNLgCj10=";
+    hash = "sha256-HE5Wp5A0wc5jgs9kNkCH1f82Y+SkILHvOwlQAsC6DVU=";
   };
 
   vendorHash = "sha256-Gs+8J+yEVynsBte3Hnx7jnYRPa/61CIISDbMyDKhPRE=";

From 112f86e68386ed67d41f39e56095de2a4a46239e Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Gutyina=20Gerg=C5=91?= <gutyina.gergo.2@gmail.com>
Date: Thu, 6 Mar 2025 20:15:23 +0000
Subject: [PATCH 37/71] osu-lazer: 2025.225.0 -> 2025.306.0

---
 pkgs/by-name/os/osu-lazer/deps.json   | 4 ++--
 pkgs/by-name/os/osu-lazer/package.nix | 4 ++--
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/pkgs/by-name/os/osu-lazer/deps.json b/pkgs/by-name/os/osu-lazer/deps.json
index b0dd10e0c408..358f21b34335 100644
--- a/pkgs/by-name/os/osu-lazer/deps.json
+++ b/pkgs/by-name/os/osu-lazer/deps.json
@@ -666,8 +666,8 @@
   },
   {
     "pname": "ppy.osu.Game.Resources",
-    "version": "2025.217.0",
-    "hash": "sha256-ERVop92Ss/SdmcN7m1sxQRqC8Sxr9NaL3v/V3JxqUq4="
+    "version": "2025.303.0",
+    "hash": "sha256-+Lnin+oEo67ARp9RFWOe00JcOL73O9gh/XJFIF151Yg="
   },
   {
     "pname": "ppy.osuTK.NS20",
diff --git a/pkgs/by-name/os/osu-lazer/package.nix b/pkgs/by-name/os/osu-lazer/package.nix
index 06435097d2e8..6870c819fe57 100644
--- a/pkgs/by-name/os/osu-lazer/package.nix
+++ b/pkgs/by-name/os/osu-lazer/package.nix
@@ -21,13 +21,13 @@
 
 buildDotnetModule rec {
   pname = "osu-lazer";
-  version = "2025.225.0";
+  version = "2025.306.0";
 
   src = fetchFromGitHub {
     owner = "ppy";
     repo = "osu";
     tag = version;
-    hash = "sha256-iqIzspQn1W+Qd5lCkuVknog8I2BEBLdO46Pw+j0H1zc=";
+    hash = "sha256-SqPwVQGmtkaF/Mkcp4WnKRYNXSQD3+56XbNVw9ZMr+A=";
   };
 
   projectFile = "osu.Desktop/osu.Desktop.csproj";

From dc28b97f575e9983971a9760cfdabab40423d2e8 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Gutyina=20Gerg=C5=91?= <gutyina.gergo.2@gmail.com>
Date: Thu, 6 Mar 2025 20:19:14 +0000
Subject: [PATCH 38/71] osu-lazer-bin: 2025.225.0 -> 2025.306.0

---
 pkgs/by-name/os/osu-lazer-bin/package.nix | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/pkgs/by-name/os/osu-lazer-bin/package.nix b/pkgs/by-name/os/osu-lazer-bin/package.nix
index 6b0ad51896c8..5e1ab48b4a74 100644
--- a/pkgs/by-name/os/osu-lazer-bin/package.nix
+++ b/pkgs/by-name/os/osu-lazer-bin/package.nix
@@ -10,23 +10,23 @@
 
 let
   pname = "osu-lazer-bin";
-  version = "2025.225.0";
+  version = "2025.306.0";
 
   src =
     {
       aarch64-darwin = fetchzip {
         url = "https://github.com/ppy/osu/releases/download/${version}/osu.app.Apple.Silicon.zip";
-        hash = "sha256-8KwLHRaGOdlTcByGzQzD28rxPiHhQewFc8bOU3Wh2Ak=";
+        hash = "sha256-VbzHD7LQstBXmSIkDpue6kPGHEzFO+Fy22eLYj+rNcw=";
         stripRoot = false;
       };
       x86_64-darwin = fetchzip {
         url = "https://github.com/ppy/osu/releases/download/${version}/osu.app.Intel.zip";
-        hash = "sha256-0CWRMB4JjC+uY1b2jMQsRuIcBNCKtcV27N9Q5uW4DFs=";
+        hash = "sha256-1KC0PnTMgN0GFhNYmlqfqWSVEpo8i+gb4nVHEwBMSS8=";
         stripRoot = false;
       };
       x86_64-linux = fetchurl {
         url = "https://github.com/ppy/osu/releases/download/${version}/osu.AppImage";
-        hash = "sha256-detSX0/akBJE2bdTxUvUUlBMKswHPF1qg9tsWZ00zso=";
+        hash = "sha256-A9CWoTvByyNkULQ2abeVgiwAmSmyHx9IZqtHGS+bW6Y=";
       };
     }
     .${stdenvNoCC.system} or (throw "osu-lazer-bin: ${stdenvNoCC.system} is unsupported.");

From 0dc89fd2f2afda5b405a4519389ebb1988ce218a Mon Sep 17 00:00:00 2001
From: Audrey Dutcher <audrey@rhelmot.io>
Date: Thu, 6 Mar 2025 12:36:07 -0700
Subject: [PATCH 39/71] pulseaudio: fix build for FreeBSD

- Fix build on lld 17+ with --undefined-version
- Add missing dependencies
- Clarify some predicates which were previously !isDarwin but should
  actually be isLinux
---
 pkgs/servers/pulseaudio/default.nix | 17 ++++++++++++++---
 1 file changed, 14 insertions(+), 3 deletions(-)

diff --git a/pkgs/servers/pulseaudio/default.nix b/pkgs/servers/pulseaudio/default.nix
index e548337948ab..4ca3038d410d 100644
--- a/pkgs/servers/pulseaudio/default.nix
+++ b/pkgs/servers/pulseaudio/default.nix
@@ -115,7 +115,7 @@ stdenv.mkDerivation rec {
       perlPackages.XMLParser
       m4
     ]
-    ++ lib.optionals stdenv.hostPlatform.isLinux [ glib ]
+    ++ lib.optionals (!stdenv.hostPlatform.isDarwin) [ glib ]
     # gstreamer plugin discovery requires wrapping
     ++ lib.optional (bluetoothSupport && advancedBluetoothCodecs) wrapGAppsHook3;
 
@@ -130,7 +130,7 @@ stdenv.mkDerivation rec {
       fftwFloat
       check
     ]
-    ++ lib.optionals stdenv.hostPlatform.isLinux [
+    ++ lib.optionals (!stdenv.hostPlatform.isDarwin) [
       glib
       dbus
     ]
@@ -139,6 +139,8 @@ stdenv.mkDerivation rec {
       Cocoa
       CoreServices
       CoreAudio
+    ]
+    ++ lib.optionals (stdenv.hostPlatform.isDarwin || stdenv.hostPlatform.isFreeBSD) [
       libintl
     ]
     ++ lib.optionals (!libOnly) (
@@ -179,6 +181,13 @@ stdenv.mkDerivation rec {
       ++ lib.optional zeroconfSupport avahi
     );
 
+  env =
+    lib.optionalAttrs (stdenv.cc.bintools.isLLVM && lib.versionAtLeast stdenv.cc.bintools.version "17")
+      {
+        # https://gitlab.freedesktop.org/pulseaudio/pulseaudio/-/issues/3848
+        NIX_LDFLAGS = "--undefined-version";
+      };
+
   mesonFlags =
     [
       (lib.mesonEnable "alsa" (!libOnly && alsaSupport))
@@ -274,7 +283,9 @@ stdenv.mkDerivation rec {
       done
     '';
 
-  passthru.tests = { inherit (nixosTests) pulseaudio; };
+  passthru.tests = {
+    inherit (nixosTests) pulseaudio;
+  };
 
   meta = {
     description = "Sound server for POSIX and Win32 systems";

From 0b724ce0ac7bfa6eb5067b31847429a947df9644 Mon Sep 17 00:00:00 2001
From: Audrey Dutcher <audrey@rhelmot.io>
Date: Thu, 6 Mar 2025 12:21:32 -0700
Subject: [PATCH 40/71] roc-toolkit: fix build for FreeBSD

---
 pkgs/by-name/ro/roc-toolkit/package.nix | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/pkgs/by-name/ro/roc-toolkit/package.nix b/pkgs/by-name/ro/roc-toolkit/package.nix
index 410563c4150e..db097741eaff 100644
--- a/pkgs/by-name/ro/roc-toolkit/package.nix
+++ b/pkgs/by-name/ro/roc-toolkit/package.nix
@@ -68,6 +68,7 @@ stdenv.mkDerivation rec {
     ++ lib.optional (!libunwindSupport) "--disable-libunwind"
     ++ lib.optional (!pulseaudioSupport) "--disable-pulseaudio"
     ++ lib.optional (!libsndfileSupport) "--disable-sndfile"
+    ++ lib.optional stdenv.hostPlatform.isFreeBSD "--platform=unix"
     ++ (
       if (!openfecSupport) then
         [ "--disable-openfec" ]
@@ -78,6 +79,11 @@ stdenv.mkDerivation rec {
         ]
     );
 
+  env = lib.optionalAttrs stdenv.hostPlatform.isFreeBSD {
+    NIX_CFLAGS_COMPILE = "-D_XOPEN_SOURCE=700 -D__BSD_VISIBLE";
+    NIX_LDFLAGS = "-lpthread";
+  };
+
   meta = with lib; {
     description = "Roc is a toolkit for real-time audio streaming over the network";
     homepage = "https://github.com/roc-streaming/roc-toolkit";

From 98b175f44a71c04c8dd8795d9e3c771ef40e7517 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Sandro=20J=C3=A4ckel?= <sandro.jaeckel@gmail.com>
Date: Fri, 7 Mar 2025 13:33:03 +0100
Subject: [PATCH 41/71] nixos/nextcloud: fix shellcheck after #367433

---
 nixos/modules/services/web-apps/nextcloud.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/nixos/modules/services/web-apps/nextcloud.nix b/nixos/modules/services/web-apps/nextcloud.nix
index 1943e06804a6..c035e5fd6ec3 100644
--- a/nixos/modules/services/web-apps/nextcloud.nix
+++ b/nixos/modules/services/web-apps/nextcloud.nix
@@ -1040,12 +1040,12 @@ in {
           restartTriggers = [ overrideConfig ];
           script = ''
             ${optionalString (c.dbpassFile != null) ''
-              if [ -z "$(<$CREDENTIALS_DIRECTORY/dbpass)" ]; then
+              if [ -z "$(<"$CREDENTIALS_DIRECTORY/dbpass")" ]; then
                 echo "dbpassFile ${c.dbpassFile} is empty!"
                 exit 1
               fi
             ''}
-            if [ -z "$(<$CREDENTIALS_DIRECTORY/adminpass)" ]; then
+            if [ -z "$(<"$CREDENTIALS_DIRECTORY/adminpass")" ]; then
               echo "adminpassFile ${c.adminpassFile} is empty!"
               exit 1
             fi

From 198e7a50f062b1c5d13ce56c2d275f53cc8f8026 Mon Sep 17 00:00:00 2001
From: misilelab <misileminecord@gmail.com>
Date: Fri, 7 Mar 2025 01:43:28 +0900
Subject: [PATCH 42/71] pnpm: 10.5.2 -> 10.6.1

https://github.com/pnpm/pnpm/releases/tag/v10.6.0
https://github.com/pnpm/pnpm/releases/tag/v10.6.1

Signed-off-by: misilelab <misileminecord@gmail.com>
---
 pkgs/development/tools/pnpm/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/tools/pnpm/default.nix b/pkgs/development/tools/pnpm/default.nix
index c9bb1ba1a15f..5a29ef8f1aac 100644
--- a/pkgs/development/tools/pnpm/default.nix
+++ b/pkgs/development/tools/pnpm/default.nix
@@ -16,8 +16,8 @@ let
       hash = "sha256-hHIWjD4f0L/yh+aUsFP8y78gV5o/+VJrYzO+q432Wo0=";
     };
     "10" = {
-      version = "10.5.2";
-      hash = "sha256-eamNqpAki1CBXjFGB5DxGMVv4JkRM3CCbKoBU75tq6U=";
+      version = "10.6.1";
+      hash = "sha256-gSBIRaOWliqcS0nMLWyvu0mnWGUtPCQ/ISjLxjgIT+I=";
     };
   };
 

From 50674da309e16b1d1c3bf67fff5273ff37e0bda2 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Fri, 7 Mar 2025 15:48:55 +0000
Subject: [PATCH 43/71] xlights: 2025.03 -> 2025.04

---
 pkgs/by-name/xl/xlights/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/xl/xlights/package.nix b/pkgs/by-name/xl/xlights/package.nix
index 4a7bd0852b2e..7ce354eb2e93 100644
--- a/pkgs/by-name/xl/xlights/package.nix
+++ b/pkgs/by-name/xl/xlights/package.nix
@@ -6,11 +6,11 @@
 
 appimageTools.wrapType2 rec {
   pname = "xlights";
-  version = "2025.03";
+  version = "2025.04";
 
   src = fetchurl {
     url = "https://github.com/smeighan/xLights/releases/download/${version}/xLights-${version}-x86_64.AppImage";
-    hash = "sha256-ASDiIpVLs02Q0vfGCih+a2kKmDbK8BLM8vcdDDaKfSU=";
+    hash = "sha256-YpFOQs+fDHTTWOkkw8dqKoFOVO998/nq2PUOjjA303A=";
   };
 
   meta = {

From ca6edbf7e26a1b8e42a0aedfa5c349ffa9dc8eb4 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Fri, 7 Mar 2025 19:19:17 +0000
Subject: [PATCH 44/71] siyuan: 3.1.22 -> 3.1.24

---
 pkgs/by-name/si/siyuan/package.nix | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/pkgs/by-name/si/siyuan/package.nix b/pkgs/by-name/si/siyuan/package.nix
index 560420c1be5b..101f6dbcd688 100644
--- a/pkgs/by-name/si/siyuan/package.nix
+++ b/pkgs/by-name/si/siyuan/package.nix
@@ -35,20 +35,20 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "siyuan";
-  version = "3.1.22";
+  version = "3.1.24";
 
   src = fetchFromGitHub {
     owner = "siyuan-note";
     repo = "siyuan";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-t7BJBip28xPT4/iNL/zTKzFCcQOt0E4IAT00l/iX6TM=";
+    hash = "sha256-BrFyMaxACkdjQy151vIYiJ9WotogEbEKWnFXNhyqKw4=";
   };
 
   kernel = buildGo123Module {
     name = "${finalAttrs.pname}-${finalAttrs.version}-kernel";
     inherit (finalAttrs) src;
     sourceRoot = "${finalAttrs.src.name}/kernel";
-    vendorHash = "sha256-iO4Qtt0+nHpiYz0gSq+z3XWRp8TBJU8psI0Hz4ofZGA=";
+    vendorHash = "sha256-2ryd+GciVGmvqLNgdvoHC1tjjnFZgWO2uObj8uNwu0E=";
 
     patches = [
       (replaceVars ./set-pandoc-path.patch {
@@ -89,7 +89,7 @@ stdenv.mkDerivation (finalAttrs: {
       src
       sourceRoot
       ;
-    hash = "sha256-GW/shXuaETg/8+d0T876mh5pKJHS4slfakObj8zrNXc=";
+    hash = "sha256-yfcgSCL78hGcq/QDvqx9jMLivW06oRVzI8iqQ7gCrlQ=";
   };
 
   sourceRoot = "${finalAttrs.src.name}/app";

From 9baedcb45b320b986e70727517ba57522178f25e Mon Sep 17 00:00:00 2001
From: Georg Haas <hax404foogit@hax404.de>
Date: Fri, 7 Mar 2025 20:39:48 +0100
Subject: [PATCH 45/71] qsstv: fix source url

---
 pkgs/applications/radio/qsstv/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/applications/radio/qsstv/default.nix b/pkgs/applications/radio/qsstv/default.nix
index 43d9ad13e4b9..9044d68d62c9 100644
--- a/pkgs/applications/radio/qsstv/default.nix
+++ b/pkgs/applications/radio/qsstv/default.nix
@@ -6,7 +6,7 @@ mkDerivation rec {
   pname = "qsstv";
 
   src = fetchurl {
-    url = "http://users.telenet.be/on4qz/qsstv/downloads/qsstv_${version}.tar.gz";
+    url = "https://www.qsl.net/o/on4qz/qsstv/downloads/qsstv_${version}.tar.gz";
     sha256 = "0s3sivc0xan6amibdiwfnknrl3248wzgy98w6gyxikl0qsjpygy0";
   };
 
@@ -27,7 +27,7 @@ mkDerivation rec {
   meta = with lib; {
     description = "Qt-based slow-scan TV and fax";
     mainProgram = "qsstv";
-    homepage = "http://users.telenet.be/on4qz/";
+    homepage = "https://www.qsl.net/on4qz/";
     platforms = platforms.linux;
     license = lib.licenses.gpl3;
     maintainers = with lib.maintainers; [ hax404 ];

From 6c08fd1c4797b2286489c58298b33200a8e50216 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Fri, 7 Mar 2025 19:43:04 +0000
Subject: [PATCH 46/71] nuclei: 3.3.9 -> 3.3.10

---
 pkgs/by-name/nu/nuclei/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/nu/nuclei/package.nix b/pkgs/by-name/nu/nuclei/package.nix
index 788dc8ade7f7..d6a88fdeb916 100644
--- a/pkgs/by-name/nu/nuclei/package.nix
+++ b/pkgs/by-name/nu/nuclei/package.nix
@@ -7,16 +7,16 @@
 
 buildGoModule rec {
   pname = "nuclei";
-  version = "3.3.9";
+  version = "3.3.10";
 
   src = fetchFromGitHub {
     owner = "projectdiscovery";
     repo = "nuclei";
     tag = "v${version}";
-    hash = "sha256-9P8KSuhTI/m0m51PUTZGU+qRbnT3izPbHTzsqZNbMJE=";
+    hash = "sha256-5+alARFuxwJlPYki5TU+4GdaJhBEYXbXH0BrCj2/aic=";
   };
 
-  vendorHash = "sha256-CTdB/+aVaXKqtiwHn8pgmhXjZ0mIDrmLvnKmisExi74=";
+  vendorHash = "sha256-l3733hg11+Qg4h68DnXoD8LyYiB+iFyZyKggpCAsx7Q=";
 
   proxyVendor = true; # hash mismatch between Linux and Darwin
 

From 3e14bab7b48da4375863981e6d4d9377165e7235 Mon Sep 17 00:00:00 2001
From: Sefa Eyeoglu <contact@scrumplex.net>
Date: Fri, 7 Mar 2025 20:42:49 +0100
Subject: [PATCH 47/71] mpd: 0.23.16 -> 0.23.17

mpd has fixed a bug with upstream yajl in https://github.com/MusicPlayerDaemon/MPD/commit/0aeda01ba6d22a8d9fc583faa67ffc6473869a43

We use a fork of yajl which isn't affected by this issue because of https://github.com/containers/yajl/commit/349e55e657024e5ded864601a370f8051d19628c

Signed-off-by: Sefa Eyeoglu <contact@scrumplex.net>
---
 pkgs/servers/mpd/default.nix | 16 ++++++++++++++--
 1 file changed, 14 insertions(+), 2 deletions(-)

diff --git a/pkgs/servers/mpd/default.nix b/pkgs/servers/mpd/default.nix
index 84c8d7ce74bb..808b04d6687e 100644
--- a/pkgs/servers/mpd/default.nix
+++ b/pkgs/servers/mpd/default.nix
@@ -2,6 +2,7 @@
   lib,
   stdenv,
   fetchFromGitHub,
+  fetchpatch2,
   meson,
   ninja,
   pkg-config,
@@ -201,15 +202,26 @@ let
     in
     stdenv.mkDerivation rec {
       pname = "mpd";
-      version = "0.23.16";
+      version = "0.23.17";
 
       src = fetchFromGitHub {
         owner = "MusicPlayerDaemon";
         repo = "MPD";
         rev = "v${version}";
-        sha256 = "sha256-0To+V+4xLjymGpRSpsyE/Une5uUpCEiAg+d041guPA0=";
+        sha256 = "sha256-1+eVLvwMp6mR38y39wV73rhPA998ip7clyyKcJ008z0=";
       };
 
+      patches = [
+        # Revert of https://github.com/MusicPlayerDaemon/MPD/commit/0aeda01ba6d22a8d9fc583faa67ffc6473869a43
+        # We use a yajl fork that fixed this issue in the pkg-config manifest
+        (fetchpatch2 {
+          name = "revert-yajl-include-fix.patch";
+          url = "https://github.com/MusicPlayerDaemon/MPD/commit/0aeda01ba6d22a8d9fc583faa67ffc6473869a43.diff";
+          hash = "sha256-p/sYvWpr0GTw8gjt+W9FQysadOK/QOUp81ykTI50UYg=";
+          revert = true;
+        })
+      ];
+
       buildInputs =
         [
           glib

From 1b1c60feb06c2d252d541746141a13e40075534b Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Fri, 7 Mar 2025 21:47:20 +0000
Subject: [PATCH 48/71] prometheus-postgres-exporter: 0.17.0 -> 0.17.1

---
 pkgs/servers/monitoring/prometheus/postgres-exporter.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/servers/monitoring/prometheus/postgres-exporter.nix b/pkgs/servers/monitoring/prometheus/postgres-exporter.nix
index a5b320423d25..d84cb5d931dd 100644
--- a/pkgs/servers/monitoring/prometheus/postgres-exporter.nix
+++ b/pkgs/servers/monitoring/prometheus/postgres-exporter.nix
@@ -7,13 +7,13 @@
 
 buildGoModule rec {
   pname = "postgres_exporter";
-  version = "0.17.0";
+  version = "0.17.1";
 
   src = fetchFromGitHub {
     owner = "prometheus-community";
     repo = "postgres_exporter";
     rev = "v${version}";
-    sha256 = "sha256-M7CnAbyAeVLfFyPDGYOCubcE7i/caQ0MDLi3JKeN6FA=";
+    sha256 = "sha256-F7nLz6NkvWSeZTzjo1/wNWCPn3Veo9/SkJdlFRwdlo4=";
   };
 
   vendorHash = "sha256-Dl44VTaDE90nhOU0zxZvd/zrVe8bLRnT16ISqJMpzpU=";

From aae795ff01221f9e085c444d995e542a8aba8798 Mon Sep 17 00:00:00 2001
From: Tyler Hardin <th020394@gmail.com>
Date: Fri, 7 Mar 2025 16:53:12 -0500
Subject: [PATCH 49/71] ollama: 0.5.12 -> 0.5.13

---
 pkgs/by-name/ol/ollama/package.nix | 10 ++++++----
 1 file changed, 6 insertions(+), 4 deletions(-)

diff --git a/pkgs/by-name/ol/ollama/package.nix b/pkgs/by-name/ol/ollama/package.nix
index a97558b8419b..969f1e752375 100644
--- a/pkgs/by-name/ol/ollama/package.nix
+++ b/pkgs/by-name/ol/ollama/package.nix
@@ -1,6 +1,6 @@
 {
   lib,
-  buildGoModule,
+  buildGo124Module,
   fetchFromGitHub,
   fetchpatch,
   buildEnv,
@@ -44,17 +44,19 @@ assert builtins.elem acceleration [
 let
   pname = "ollama";
   # don't forget to invalidate all hashes each update
-  version = "0.5.12";
+  version = "0.5.13";
+
+  buildGoModule = buildGo124Module;
 
   src = fetchFromGitHub {
     owner = "ollama";
     repo = "ollama";
     tag = "v${version}";
-    hash = "sha256-le3OeGC/rddY9NNgmO7YcFthsZSQiO+gGSkpcV+TNXo=";
+    hash = "sha256-GRufz01lTSgBmDzRImY02xuAeuzjlIEFWv578fI8ciY=";
     fetchSubmodules = true;
   };
 
-  vendorHash = "sha256-ON9ow9/KglBy+RKNhw1n3E5AJtpjPQvJwNAQTaWzEFA=";
+  vendorHash = "sha256-s/qvMISNpxeEAZx8Je2v4yb2aPWhSYcKhwHQcEXJ20Y=";
 
   validateFallback = lib.warnIf (config.rocmSupport && config.cudaSupport) (lib.concatStrings [
     "both `nixpkgs.config.rocmSupport` and `nixpkgs.config.cudaSupport` are enabled, "

From 5be24021db7f4d62b4d23c241b55f1f92bb86179 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Fri, 7 Mar 2025 23:01:38 +0000
Subject: [PATCH 50/71] gitxray: 1.0.17.2 -> 1.0.17.3

---
 pkgs/by-name/gi/gitxray/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/gi/gitxray/package.nix b/pkgs/by-name/gi/gitxray/package.nix
index fea415c56cd3..de005f4dc030 100644
--- a/pkgs/by-name/gi/gitxray/package.nix
+++ b/pkgs/by-name/gi/gitxray/package.nix
@@ -6,14 +6,14 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "gitxray";
-  version = "1.0.17.2";
+  version = "1.0.17.3";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "kulkansecurity";
     repo = "gitxray";
     tag = version;
-    hash = "sha256-EcDKjUC1Zi6zSvOQRhozzKPrBLjODk8+Lqpagh55LCc=";
+    hash = "sha256-MfYK6D6QkIQRTsnNAiJsfPeYcUTO/BTe0AtczeONSsg=";
   };
 
   build-system = with python3.pkgs; [ setuptools ];

From 43655b06b0a8395b48864ee991e5c70eb1c64192 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Fri, 7 Mar 2025 23:09:03 +0000
Subject: [PATCH 51/71] jwx: 2.1.3 -> 2.1.4

---
 pkgs/by-name/jw/jwx/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/jw/jwx/package.nix b/pkgs/by-name/jw/jwx/package.nix
index 4f3b16cdebd7..2350f9673073 100644
--- a/pkgs/by-name/jw/jwx/package.nix
+++ b/pkgs/by-name/jw/jwx/package.nix
@@ -6,13 +6,13 @@
 
 buildGoModule rec {
   pname = "jwx";
-  version = "2.1.3";
+  version = "2.1.4";
 
   src = fetchFromGitHub {
     owner = "lestrrat-go";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-CuxBfR+q+2JCe7F1gruGrVM+UBkrmz5dEyrDtFdmbhM=";
+    hash = "sha256-UXiF3X1jLk4dCGKmZlx9V08hzNJV+s/K2Wei9i+A6dg=";
   };
 
   vendorHash = "sha256-ZS7xliFymXTE8hlc3GEMNonP5sJTZGirw5YQNzPCl3Y=";

From 94b9c238c45ae99b24d16cee1bc04dbe1833dba4 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sat, 8 Mar 2025 02:19:33 +0000
Subject: [PATCH 52/71] dunst: 1.12.1 -> 1.12.2

---
 pkgs/by-name/du/dunst/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/du/dunst/package.nix b/pkgs/by-name/du/dunst/package.nix
index f877e4f8ac82..6d7ec750e2c1 100644
--- a/pkgs/by-name/du/dunst/package.nix
+++ b/pkgs/by-name/du/dunst/package.nix
@@ -31,13 +31,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "dunst";
-  version = "1.12.1";
+  version = "1.12.2";
 
   src = fetchFromGitHub {
     owner = "dunst-project";
     repo = "dunst";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-MC35UE6cA1xA1qaOppvHAjuevbl2z0Twct1G5Uv84pU=";
+    hash = "sha256-i5/rRlxs+voEXL3udY+55l2mU54yep8RpmLOZpGtDeM=";
   };
 
   nativeBuildInputs = [

From 4c780036f83b6c5ba9630803f6cd1163cc553f29 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sat, 8 Mar 2025 02:34:07 +0000
Subject: [PATCH 53/71] imhex: 1.37.1 -> 1.37.4

---
 pkgs/by-name/im/imhex/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/im/imhex/package.nix b/pkgs/by-name/im/imhex/package.nix
index 5d1d78aedb0c..06d786255197 100644
--- a/pkgs/by-name/im/imhex/package.nix
+++ b/pkgs/by-name/im/imhex/package.nix
@@ -27,8 +27,8 @@
 }:
 
 let
-  version = "1.37.1";
-  patterns_version = "1.37.1";
+  version = "1.37.4";
+  patterns_version = "1.37.4";
 
   patterns_src = fetchFromGitHub {
     name = "ImHex-Patterns-source-${patterns_version}";
@@ -49,7 +49,7 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "WerWolv";
     repo = "ImHex";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-0vfetOUYQmi3FNWI8+QkBHJe2Crg4LNrKeT1vSTdsjM=";
+    hash = "sha256-uenwAaIjtBzrtiLdy6fh5TxtbWtUJbtybNOLP3+8blA=";
   };
 
   strictDeps = true;

From 9168c96e0c6647268d6edee9abb1e281140965ad Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Sandro=20J=C3=A4ckel?= <sandro.jaeckel@gmail.com>
Date: Sat, 8 Mar 2025 04:13:23 +0100
Subject: [PATCH 54/71] ktailctl: 0.19.3 -> 0.20.0

Changelog: https://github.com/f-koehler/KTailctl/releases/tag/v0.20.0
---
 pkgs/applications/networking/ktailctl/default.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/applications/networking/ktailctl/default.nix b/pkgs/applications/networking/ktailctl/default.nix
index e04a8122d7cc..d08ad5686990 100644
--- a/pkgs/applications/networking/ktailctl/default.nix
+++ b/pkgs/applications/networking/ktailctl/default.nix
@@ -26,13 +26,13 @@
 }:
 
 let
-  version = "0.19.3";
+  version = "0.20.0";
 
   src = fetchFromGitHub {
     owner = "f-koehler";
     repo = "KTailctl";
     rev = "v${version}";
-    hash = "sha256-0P3cvBI5CM03y6Km7d31Z3ZzpGW3y1oKkprpPglrujg=";
+    hash = "sha256-BgxWsT/s5Hv5cvzcSjfrgAmZhcoquaydSZKdPmld4Rg=";
   };
 
   goDeps =
@@ -40,7 +40,7 @@ let
       pname = "ktailctl-go-wrapper";
       inherit src version;
       modRoot = "src/wrapper";
-      vendorHash = "sha256-o7eH3f+yeRr5CnBIuL2jMtVQaBLVihz2dg5RTF8RvaM=";
+      vendorHash = "sha256-ntk4WyJYEi6ZX2MyXMGgsYVqhAUQSGJLHWiNLkCwMEY=";
     }).goModules;
 in
 stdenv.mkDerivation {

From c852af0f8d2c4f416198152d696d1a45eecd2b69 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sat, 8 Mar 2025 03:23:38 +0000
Subject: [PATCH 55/71] python312Packages.plugwise: 1.7.2 -> 1.7.3

---
 pkgs/development/python-modules/plugwise/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/plugwise/default.nix b/pkgs/development/python-modules/plugwise/default.nix
index f74c9758604d..a7d252500b69 100644
--- a/pkgs/development/python-modules/plugwise/default.nix
+++ b/pkgs/development/python-modules/plugwise/default.nix
@@ -17,7 +17,7 @@
 
 buildPythonPackage rec {
   pname = "plugwise";
-  version = "1.7.2";
+  version = "1.7.3";
   pyproject = true;
 
   disabled = pythonOlder "3.12";
@@ -26,7 +26,7 @@ buildPythonPackage rec {
     owner = "plugwise";
     repo = "python-plugwise";
     tag = "v${version}";
-    hash = "sha256-WuEVLpFQlPiCYNbAGy3IIOmcbm9MertEQ4tlbd/8OqQ=";
+    hash = "sha256-VnL8rCSpNEs0NnghhgSO4k1Q+yqP5LCMZirC/hLZRO4=";
   };
 
   postPatch = ''

From 861c05f27e1150200b8594e1d3efe4f4ed99de00 Mon Sep 17 00:00:00 2001
From: Francesco Gazzetta <fgaz@fgaz.me>
Date: Sun, 10 Nov 2024 21:35:32 +0100
Subject: [PATCH 56/71] libprojectm: init at 4.1.4

---
 pkgs/by-name/li/libprojectm/package.nix | 46 +++++++++++++++++++++++++
 1 file changed, 46 insertions(+)
 create mode 100644 pkgs/by-name/li/libprojectm/package.nix

diff --git a/pkgs/by-name/li/libprojectm/package.nix b/pkgs/by-name/li/libprojectm/package.nix
new file mode 100644
index 000000000000..b67e2d525519
--- /dev/null
+++ b/pkgs/by-name/li/libprojectm/package.nix
@@ -0,0 +1,46 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  cmake,
+  libGL,
+  xorg,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "libprojectm";
+  version = "4.1.4";
+
+  src = fetchFromGitHub {
+    owner = "projectM-visualizer";
+    repo = "projectm";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-gf1k9iSDARp6/M2/Po1wdOEY6y/QG2nq5uhSFU6bxAM=";
+    fetchSubmodules = true;
+  };
+
+  nativeBuildInputs = [
+    cmake
+  ];
+
+  buildInputs = [
+    libGL
+    xorg.libX11
+  ];
+
+  strictDeps = true;
+
+  meta = {
+    description = "Cross-platform Milkdrop-compatible Music Visualization Library";
+    homepage = "https://github.com/projectM-visualizer/projectm";
+    license = lib.licenses.lgpl21Plus;
+    maintainers = with lib.maintainers; [ fgaz ];
+    platforms = lib.platforms.all;
+    longDescription = ''
+      The open-source project that reimplements the esteemed Winamp Milkdrop by
+      Geiss in a more modern, cross-platform reusable library.
+      Read an audio input and produces mesmerizing visuals, detecting tempo, and
+      rendering advanced equations into a limitless array of user-contributed visualizations.
+    '';
+  };
+})

From 4457f3606c598ae825fb4b185b65a464d9d07a16 Mon Sep 17 00:00:00 2001
From: Francesco Gazzetta <fgaz@fgaz.me>
Date: Sun, 10 Nov 2024 21:36:14 +0100
Subject: [PATCH 57/71] projectm-sdl-cpp: init at 0-unstable-2024-08-07

---
 pkgs/by-name/pr/projectm-sdl-cpp/package.nix | 64 ++++++++++++++++++++
 1 file changed, 64 insertions(+)
 create mode 100644 pkgs/by-name/pr/projectm-sdl-cpp/package.nix

diff --git a/pkgs/by-name/pr/projectm-sdl-cpp/package.nix b/pkgs/by-name/pr/projectm-sdl-cpp/package.nix
new file mode 100644
index 000000000000..8ef432e17b37
--- /dev/null
+++ b/pkgs/by-name/pr/projectm-sdl-cpp/package.nix
@@ -0,0 +1,64 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  cmake,
+  libprojectm,
+  poco,
+  utf8proc,
+  SDL2,
+  unstableGitUpdater,
+}:
+
+stdenv.mkDerivation {
+  pname = "projectm-sdl-cpp";
+  version = "0-unstable-2024-08-07";
+
+  src = fetchFromGitHub {
+    owner = "projectM-visualizer";
+    repo = "frontend-sdl-cpp";
+    rev = "df6bfb51d7be335b4c258e2085f13d14e27f14a9";
+    hash = "sha256-WcQMwI0i7hON31FpgBSSUoqqlENj6SUwKTXfl7i6jn4=";
+    fetchSubmodules = true;
+  };
+
+  # Probably an artifact of the vcpkg package
+  postPatch = ''
+    substituteInPlace ImGui.cmake \
+      --replace-fail "SDL2::SDL2main" ""
+    substituteInPlace src/CMakeLists.txt \
+      --replace-fail "SDL2::SDL2main" ""
+  '';
+
+  cmakeFlags = [
+    # Doesn't seem to be present in the source tree, so the installation fails if enabled
+    (lib.cmakeBool "ENABLE_DESKTOP_ICON" false)
+  ];
+
+  nativeBuildInputs = [
+    cmake
+  ];
+
+  buildInputs = [
+    libprojectm
+    poco
+    utf8proc
+    SDL2
+  ];
+
+  # poco 1.14 requires c++17
+  NIX_CFLAGS_COMPILE = [ "-std=gnu++17" ];
+
+  strictDeps = true;
+
+  passthru.updateScript = unstableGitUpdater { };
+
+  meta = {
+    description = "Standalone application based on libprojectM and libSDL that turns your desktop audio into awesome visuals";
+    homepage = "https://github.com/projectM-visualizer/frontend-sdl-cpp";
+    license = lib.licenses.gpl3Only;
+    maintainers = with lib.maintainers; [ fgaz ];
+    mainProgram = "projectMSDL";
+    platforms = lib.platforms.all;
+  };
+}

From c0aaa9a2eb0bbc466b5b916738fbd80e8f3378fe Mon Sep 17 00:00:00 2001
From: Francesco Gazzetta <fgaz@fgaz.me>
Date: Sun, 10 Nov 2024 21:49:05 +0100
Subject: [PATCH 58/71] projectm: move to projectm_3

ProjectM 4 was split into libprojectm and projectm-sdl
---
 pkgs/applications/audio/clementine/default.nix                | 4 ++--
 pkgs/applications/audio/{projectm => projectm_3}/default.nix  | 0
 .../video/kodi/addons/visualization-projectm/default.nix      | 4 ++--
 pkgs/top-level/aliases.nix                                    | 1 +
 pkgs/top-level/all-packages.nix                               | 2 +-
 5 files changed, 6 insertions(+), 5 deletions(-)
 rename pkgs/applications/audio/{projectm => projectm_3}/default.nix (100%)

diff --git a/pkgs/applications/audio/clementine/default.nix b/pkgs/applications/audio/clementine/default.nix
index 2422511f1275..9ffdd2ebb204 100644
--- a/pkgs/applications/audio/clementine/default.nix
+++ b/pkgs/applications/audio/clementine/default.nix
@@ -24,7 +24,7 @@
   gvfs,
   libcdio,
   pcre,
-  projectm,
+  projectm_3,
   protobuf,
   qca-qt5,
   pkg-config,
@@ -84,7 +84,7 @@ stdenv.mkDerivation (finalAttrs: {
       liblastfm
       libpulseaudio
       pcre
-      projectm
+      projectm_3
       protobuf
       qca-qt5
       qjson
diff --git a/pkgs/applications/audio/projectm/default.nix b/pkgs/applications/audio/projectm_3/default.nix
similarity index 100%
rename from pkgs/applications/audio/projectm/default.nix
rename to pkgs/applications/audio/projectm_3/default.nix
diff --git a/pkgs/applications/video/kodi/addons/visualization-projectm/default.nix b/pkgs/applications/video/kodi/addons/visualization-projectm/default.nix
index bd103adb090c..03a838dcc1b5 100644
--- a/pkgs/applications/video/kodi/addons/visualization-projectm/default.nix
+++ b/pkgs/applications/video/kodi/addons/visualization-projectm/default.nix
@@ -1,4 +1,4 @@
-{ lib, rel, buildKodiBinaryAddon, fetchFromGitHub, pkg-config, glm, libGL, projectm }:
+{ lib, rel, buildKodiBinaryAddon, fetchFromGitHub, pkg-config, glm, libGL, projectm_3 }:
 
 buildKodiBinaryAddon rec {
   pname = "visualization-projectm";
@@ -12,7 +12,7 @@ buildKodiBinaryAddon rec {
     hash = "sha256-J3RtVl+hO8DspLyF2KAVMLDIJBiEb0bKosKhJyKy9hk=";
   };
 
-  extraBuildInputs = [ pkg-config libGL projectm ];
+  extraBuildInputs = [ pkg-config libGL projectm_3 ];
 
   propagatedBuildInputs = [ glm ];
   meta = with lib; {
diff --git a/pkgs/top-level/aliases.nix b/pkgs/top-level/aliases.nix
index 76be3c4173d4..130bf016d017 100644
--- a/pkgs/top-level/aliases.nix
+++ b/pkgs/top-level/aliases.nix
@@ -1182,6 +1182,7 @@ mapAliases {
   poac = cabinpkg; # Added 2025-01-22
   poretools = throw "poretools has been removed from nixpkgs, as it was broken and unmaintained"; # Added 2024-06-03
   powerdns = pdns; # Added 2022-03-28
+  projectm = throw "Since version 4, 'projectm' has been split into 'libprojectm' (the library) and 'projectm-sdl-cpp' (the SDL2 frontend). ProjectM 3 has been moved to 'projectm_3'"; # Added 2024-11-10
 
   # postgresql plugins
   cstore_fdw = postgresqlPackages.cstore_fdw;
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index b21c52cddd7f..8588c147b936 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -4692,7 +4692,7 @@ with pkgs;
     jdk = jdk8;
   };
 
-  projectm = libsForQt5.callPackage ../applications/audio/projectm { };
+  projectm_3 = libsForQt5.callPackage ../applications/audio/projectm_3 { };
 
   proxmark3 = libsForQt5.callPackage ../tools/security/proxmark3/default.nix {
     inherit (darwin.apple_sdk_11_0.frameworks) Foundation AppKit;

From 893c17338ccd53d71e818ef14394a7d6387093fd Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sat, 8 Mar 2025 06:57:29 +0000
Subject: [PATCH 59/71] terraform-compliance: 1.3.49 -> 1.3.50

---
 pkgs/by-name/te/terraform-compliance/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/te/terraform-compliance/package.nix b/pkgs/by-name/te/terraform-compliance/package.nix
index 31929ef65555..4f87bb553e04 100644
--- a/pkgs/by-name/te/terraform-compliance/package.nix
+++ b/pkgs/by-name/te/terraform-compliance/package.nix
@@ -6,14 +6,14 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "terraform-compliance";
-  version = "1.3.49";
+  version = "1.3.50";
   format = "setuptools";
 
   src = fetchFromGitHub {
     owner = "terraform-compliance";
     repo = "cli";
     tag = version;
-    hash = "sha256-wg9n7x7KDqFecZZVmJwpE1kP0eKt1Gmld6XEcavcyU0=";
+    hash = "sha256-FwePzXXxwiV5tWY1a+mG5pcv6XB801qG6Lx+XUe662E=";
   };
 
   postPatch = ''
@@ -55,7 +55,7 @@ python3.pkgs.buildPythonApplication rec {
     description = "BDD test framework for terraform";
     mainProgram = "terraform-compliance";
     homepage = "https://github.com/terraform-compliance/cli";
-    changelog = "https://github.com/terraform-compliance/cli/releases/tag/${version}";
+    changelog = "https://github.com/terraform-compliance/cli/releases/tag/${src.tag}";
     license = licenses.mit;
     maintainers = with maintainers; [
       kalbasit

From 7c97c44d2e442c7c26adbebe0ab74bb6938c1203 Mon Sep 17 00:00:00 2001
From: Maximilian Bosch <maximilian@mbosch.me>
Date: Tue, 4 Mar 2025 23:20:09 +0100
Subject: [PATCH 60/71] rust-synapse-compress-state: rename from
 rust-synapse-state-compress

This was renamed by accident in
4b644d14579db00c452358f990d6bdaf2ef8421b.

Undoing the change and adding an alias to for the people who already
updated their configs.
---
 .../Cargo.lock                                                 | 0
 .../package.nix                                                | 0
 pkgs/top-level/aliases.nix                                     | 3 ++-
 3 files changed, 2 insertions(+), 1 deletion(-)
 rename pkgs/by-name/ru/{rust-synapse-state-compress => rust-synapse-compress-state}/Cargo.lock (100%)
 rename pkgs/by-name/ru/{rust-synapse-state-compress => rust-synapse-compress-state}/package.nix (100%)

diff --git a/pkgs/by-name/ru/rust-synapse-state-compress/Cargo.lock b/pkgs/by-name/ru/rust-synapse-compress-state/Cargo.lock
similarity index 100%
rename from pkgs/by-name/ru/rust-synapse-state-compress/Cargo.lock
rename to pkgs/by-name/ru/rust-synapse-compress-state/Cargo.lock
diff --git a/pkgs/by-name/ru/rust-synapse-state-compress/package.nix b/pkgs/by-name/ru/rust-synapse-compress-state/package.nix
similarity index 100%
rename from pkgs/by-name/ru/rust-synapse-state-compress/package.nix
rename to pkgs/by-name/ru/rust-synapse-compress-state/package.nix
diff --git a/pkgs/top-level/aliases.nix b/pkgs/top-level/aliases.nix
index 8ccf7791d8c6..0d360111d1c2 100644
--- a/pkgs/top-level/aliases.nix
+++ b/pkgs/top-level/aliases.nix
@@ -929,7 +929,7 @@ mapAliases {
   matrique = throw "'matrique' has been renamed to/replaced by 'spectral'"; # Converted to throw 2024-10-17
   matrix-sliding-sync = throw "matrix-sliding-sync has been removed as matrix-synapse 114.0 and later covers its functionality"; # Added 2024-10-20
   matrix-synapse-tools = recurseIntoAttrs {
-    rust-synapse-state-compress = lib.warnOnInstantiate "`matrix-synapse-tools.rust-synapse-compress-state` has been renamed to `rust-synapse-compress-state`" rust-synapse-state-compress;
+    rust-synapse-compress-state = lib.warnOnInstantiate "`matrix-synapse-tools.rust-synapse-compress-state` has been renamed to `rust-synapse-compress-state`" rust-synapse-compress-state;
     synadm = lib.warnOnInstantiate "`matrix-synapse-tools.synadm` has been renamed to `synadm`" synadm;
   }; # Added 2025-02-20
   maui-nota = libsForQt5.mauiPackages.nota; # added 2022-05-17
@@ -1305,6 +1305,7 @@ mapAliases {
   rtx = mise; # Added 2024-01-05
   runCommandNoCC = runCommand;
   runCommandNoCCLocal = runCommandLocal;
+  rust-synapse-state-compress = rust-synapse-compress-state;
   rustc-wasm32 = rustc; # Added 2023-12-01
   rustfilt = throw "'rustfilt' has been removed due to lack of upstream maintenance"; # Added 2025-01-26
   rustic-rs = rustic; # Added 2024-08-02

From 908c6f3c39e0cb985b806eed514fc15a877892ab Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Fri, 7 Mar 2025 11:29:02 +0100
Subject: [PATCH 61/71] python313Packages.aiohomeconnect: 0.16.2 -> 0.16.3

Diff: https://github.com/MartinHjelmare/aiohomeconnect/compare/refs/tags/v0.16.2...v0.16.3

Changelog: https://github.com/MartinHjelmare/aiohomeconnect/blob/refs/tags/v0.16.3/CHANGELOG.md
---
 pkgs/development/python-modules/aiohomeconnect/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/aiohomeconnect/default.nix b/pkgs/development/python-modules/aiohomeconnect/default.nix
index fbcbf4109c10..154885ab2951 100644
--- a/pkgs/development/python-modules/aiohomeconnect/default.nix
+++ b/pkgs/development/python-modules/aiohomeconnect/default.nix
@@ -19,7 +19,7 @@
 
 buildPythonPackage rec {
   pname = "aiohomeconnect";
-  version = "0.16.2";
+  version = "0.16.3";
   pyproject = true;
 
   disabled = pythonOlder "3.11";
@@ -28,7 +28,7 @@ buildPythonPackage rec {
     owner = "MartinHjelmare";
     repo = "aiohomeconnect";
     tag = "v${version}";
-    hash = "sha256-AlmlZoqQxd4RE667rBYFzyAhFN9GJ0Rmk1lniDZKRnM=";
+    hash = "sha256-BwLbShldDhd5jqes4WvzP/+c7vjrY83KWLbYs0ON3K4=";
   };
 
   build-system = [ setuptools ];

From 74c4f53149c21f545f122f58317c156c02e4b121 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Sat, 8 Mar 2025 01:26:37 +0100
Subject: [PATCH 62/71] python313Packages.py-synologydsm-api: 2.7.0 -> 2.7.1

https://github.com/mib1185/py-synologydsm-api/releases/tag/v2.7.1
---
 .../development/python-modules/py-synologydsm-api/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/py-synologydsm-api/default.nix b/pkgs/development/python-modules/py-synologydsm-api/default.nix
index b3b33cfc4bd6..db4d5cbca45f 100644
--- a/pkgs/development/python-modules/py-synologydsm-api/default.nix
+++ b/pkgs/development/python-modules/py-synologydsm-api/default.nix
@@ -13,7 +13,7 @@
 
 buildPythonPackage rec {
   pname = "py-synologydsm-api";
-  version = "2.7.0";
+  version = "2.7.1";
   pyproject = true;
 
   disabled = pythonOlder "3.9";
@@ -22,7 +22,7 @@ buildPythonPackage rec {
     owner = "mib1185";
     repo = "py-synologydsm-api";
     tag = "v${version}";
-    hash = "sha256-Zou0l/t9dWls2GKxcU3SDPxb0RaI2emyg07xLyengDo=";
+    hash = "sha256-Wra0H43eS6kVamavR1lUeonqSIz/BAJBlhoWshDDhZ0=";
   };
 
   build-system = [ setuptools ];

From dbd5f4e5a6d1adadd5d5ed71526f6252ad18a3e8 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Sat, 8 Mar 2025 01:27:11 +0100
Subject: [PATCH 63/71] python313Packages.pysmartthings: 2.6.1 -> 2.7.0

https://github.com/andrewsayre/pysmartthings/releases/tag/v2.7.0
---
 pkgs/development/python-modules/pysmartthings/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/pysmartthings/default.nix b/pkgs/development/python-modules/pysmartthings/default.nix
index 0f706ae0d733..2dc9bd80fdc6 100644
--- a/pkgs/development/python-modules/pysmartthings/default.nix
+++ b/pkgs/development/python-modules/pysmartthings/default.nix
@@ -18,7 +18,7 @@
 
 buildPythonPackage rec {
   pname = "pysmartthings";
-  version = "2.6.1";
+  version = "2.7.0";
   pyproject = true;
 
   disabled = pythonOlder "3.12";
@@ -27,7 +27,7 @@ buildPythonPackage rec {
     owner = "andrewsayre";
     repo = "pysmartthings";
     rev = "v${version}";
-    hash = "sha256-BHPua3JzCTTPPM5QfJN/aWY4iv8Z1TU888p9Y5Hfy/I=";
+    hash = "sha256-ocLJWefXGq2gk6EBi5cKP8kdNBkPiF4I4NXFAaIkAjs=";
   };
 
   build-system = [ poetry-core ];

From a8294c092db3a625e8d2f08590fb9de3d53451d8 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Sat, 8 Mar 2025 01:28:31 +0100
Subject: [PATCH 64/71] home-assistant: 2025.3.0 -> 2025.3.1

https://github.com/home-assistant/core/releases/tag/2025.3.1
---
 .../home-assistant/component-packages.nix      |  2 +-
 pkgs/servers/home-assistant/default.nix        | 18 ++++--------------
 pkgs/servers/home-assistant/frontend.nix       |  4 ++--
 3 files changed, 7 insertions(+), 17 deletions(-)

diff --git a/pkgs/servers/home-assistant/component-packages.nix b/pkgs/servers/home-assistant/component-packages.nix
index 0203c86671f9..283becae93a8 100644
--- a/pkgs/servers/home-assistant/component-packages.nix
+++ b/pkgs/servers/home-assistant/component-packages.nix
@@ -2,7 +2,7 @@
 # Do not edit!
 
 {
-  version = "2025.3.0";
+  version = "2025.3.1";
   components = {
     "3_day_blinds" =
       ps: with ps; [
diff --git a/pkgs/servers/home-assistant/default.nix b/pkgs/servers/home-assistant/default.nix
index 59ace4cff11a..76073d9b21d9 100644
--- a/pkgs/servers/home-assistant/default.nix
+++ b/pkgs/servers/home-assistant/default.nix
@@ -383,7 +383,7 @@ let
   extraBuildInputs = extraPackages python.pkgs;
 
   # Don't forget to run update-component-packages.py after updating
-  hassVersion = "2025.3.0";
+  hassVersion = "2025.3.1";
 
 in
 python.pkgs.buildPythonApplication rec {
@@ -404,13 +404,13 @@ python.pkgs.buildPythonApplication rec {
     owner = "home-assistant";
     repo = "core";
     tag = version;
-    hash = "sha256-zMsJ/YAwMIdLDF256rxj63QsZD26p71SgYpf4zwzD1A=";
+    hash = "sha256-tM23n0/98kzB7fqCNZ0+qREQnLxlc6oBmPAKv//TDNk=";
   };
 
   # Secondary source is pypi sdist for translations
   sdist = fetchPypi {
     inherit pname version;
-    hash = "sha256-jsRIStPIbWXj24qjh9ZxH0QPN+zUOZeP6efRGYovUms=";
+    hash = "sha256-s+4l9FZQ5A0cvPXXypxzxzpMgrEnrgogzH/S7VwUZe4=";
   };
 
   build-system = with python.pkgs; [
@@ -554,6 +554,7 @@ python.pkgs.buildPythonApplication rec {
       # some components are needed even if tests in tests/components are disabled
       "default_config"
       "hue"
+      "qwikswitch"
     ];
 
   pytestFlagsArray = [
@@ -566,17 +567,6 @@ python.pkgs.buildPythonApplication rec {
     "--showlocals"
     # AssertionError: assert 1 == 0
     "--deselect tests/test_config.py::test_merge"
-    # AssertionError: assert 6 == 5
-    "--deselect=tests/helpers/test_translation.py::test_caching"
-    # assert "Detected that integration 'hue' attempted to create an asyncio task from a thread at homeassistant/components/hue/light.py, line 23
-    "--deselect=tests/util/test_async.py::test_create_eager_task_from_thread_in_integration"
-    # Services were renamed to Actions in language strings, but the tests are lagging behind
-    "--deselect=tests/test_core.py::test_serviceregistry_service_that_not_exists"
-    "--deselect=tests/test_core.py::test_services_call_return_response_requires_blocking"
-    "--deselect=tests/test_core.py::test_serviceregistry_return_response_arguments"
-    "--deselect=tests/helpers/test_script.py::test_parallel_error"
-    "--deselect=tests/helpers/test_script.py::test_propagate_error_service_not_found"
-    "--deselect=tests/helpers/test_script.py::test_continue_on_error_automation_issue"
     # checks whether pip is installed
     "--deselect=tests/util/test_package.py::test_check_package_fragment"
     # tests are located in tests/
diff --git a/pkgs/servers/home-assistant/frontend.nix b/pkgs/servers/home-assistant/frontend.nix
index 8ff4f51f2a4a..54b4b316e9ff 100644
--- a/pkgs/servers/home-assistant/frontend.nix
+++ b/pkgs/servers/home-assistant/frontend.nix
@@ -8,7 +8,7 @@ buildPythonPackage rec {
   # the frontend version corresponding to a specific home-assistant version can be found here
   # https://github.com/home-assistant/home-assistant/blob/master/homeassistant/components/frontend/manifest.json
   pname = "home-assistant-frontend";
-  version = "20250305.0";
+  version = "20250306.0";
   format = "wheel";
 
   src = fetchPypi {
@@ -16,7 +16,7 @@ buildPythonPackage rec {
     pname = "home_assistant_frontend";
     dist = "py3";
     python = "py3";
-    hash = "sha256-tzyJp1aKOXnmANR7p6C3rtC90VkGntURiaRgIjL8dDM=";
+    hash = "sha256-Nsh5zCyD72bjQ89BW5lmHdyWW9rxo+v2AW5fSOux/OA=";
   };
 
   # there is nothing to strip in this package

From f40557a42b728e73e05084274de64aed292a43d9 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Fri, 7 Mar 2025 20:21:14 -0800
Subject: [PATCH 65/71] python313Packages.homeassistant-stubs: 2025.3.0 ->
 2025.3.1

Diff: https://github.com/KapJI/homeassistant-stubs/compare/refs/tags/2025.3.0...2025.3.1

Changelog: https://github.com/KapJI/homeassistant-stubs/releases/tag/2025.3.1
---
 pkgs/servers/home-assistant/stubs.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/servers/home-assistant/stubs.nix b/pkgs/servers/home-assistant/stubs.nix
index cea002e1612f..42258f65d400 100644
--- a/pkgs/servers/home-assistant/stubs.nix
+++ b/pkgs/servers/home-assistant/stubs.nix
@@ -10,7 +10,7 @@
 
 buildPythonPackage rec {
   pname = "homeassistant-stubs";
-  version = "2025.3.0";
+  version = "2025.3.1";
   pyproject = true;
 
   disabled = python.version != home-assistant.python.version;
@@ -19,7 +19,7 @@ buildPythonPackage rec {
     owner = "KapJI";
     repo = "homeassistant-stubs";
     rev = "refs/tags/${version}";
-    hash = "sha256-4Chn8PRvTERiTQqhp3ScoV6woISvEWHFoohCKzLJCP8=";
+    hash = "sha256-EtgSd9TXyGjNvFYB7klcdJNhiVQsAfF18b6J35/7bUM=";
   };
 
   build-system = [

From b9d99ad6dff76f18448eea586156557050295e9c Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Sat, 8 Mar 2025 09:35:21 +0100
Subject: [PATCH 66/71] 
 home-assistant.python.pkgs.pytest-homeassistant-custom-component: 0.13.220 ->
 0.13.222

https://github.com/MatthewFlamm/pytest-homeassistant-custom-component/blob/refs/tags/0.13.222/CHANGELOG.md
---
 .../home-assistant/pytest-homeassistant-custom-component.nix  | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/servers/home-assistant/pytest-homeassistant-custom-component.nix b/pkgs/servers/home-assistant/pytest-homeassistant-custom-component.nix
index 3fdec67a3507..a92f6174345b 100644
--- a/pkgs/servers/home-assistant/pytest-homeassistant-custom-component.nix
+++ b/pkgs/servers/home-assistant/pytest-homeassistant-custom-component.nix
@@ -18,7 +18,7 @@
 
 buildPythonPackage rec {
   pname = "pytest-homeassistant-custom-component";
-  version = "0.13.220";
+  version = "0.13.222";
   pyproject = true;
 
   disabled = pythonOlder "3.12";
@@ -27,7 +27,7 @@ buildPythonPackage rec {
     owner = "MatthewFlamm";
     repo = "pytest-homeassistant-custom-component";
     rev = "refs/tags/${version}";
-    hash = "sha256-p/pC0dgKRVPlu3kOiSmeGhbfRW7cPm5W0Lr38XWlcnQ=";
+    hash = "sha256-a7bRxG2rDfxJ/1kfPQFXLaGxlGS6vuxADbJhs5qytkM=";
   };
 
   build-system = [ setuptools ];

From 1a4575f9dbe76482f2a85f496c2aa3a7cd50b759 Mon Sep 17 00:00:00 2001
From: shelvacu <1731537+shelvacu@users.noreply.github.com>
Date: Sat, 8 Mar 2025 00:41:08 -0800
Subject: [PATCH 67/71] nixos/modules: Add security.pki.caBundle option and
 make all services use it for CA bundles (#352244)

Previously some modules used `config.environment.etc."ssl/certs/ca-certificates.crt".source`, some used `"/etc/ssl/certs/ca-certificates.crt"`, and some used `"${pkgs.cacert}/etc/ssl/certs/ca-bundle.crt"`. These were all bad in one way or another:

- `config.environment.etc."ssl/certs/ca-certificates.crt".source` relies on `source` being set; if `text` is set instead this breaks, introducing a weird undocumented requirement
- `"/etc/ssl/certs/ca-certificates.crt"` is probably okay but very un-nix. It's a magic string, and the path doesn't change when the file changes (and so you can't trigger service reloads, for example, when the contents change in a new system activation)
- `"${pkgs.cacert}/etc/ssl/certs/ca-bundle.crt"` silently doesn't include the options from `security.pki`

Co-authored-by: Shelvacu <git@shelvacu.com>
---
 .../manual/release-notes/rl-2505.section.md   |  2 ++
 nixos/modules/security/ca.nix                 | 32 ++++++++++++-------
 nixos/modules/services/audio/gonic.nix        |  2 +-
 nixos/modules/services/audio/navidrome.nix    |  4 +--
 .../gocd-agent/default.nix                    |  2 +-
 .../gocd-server/default.nix                   |  2 +-
 nixos/modules/services/mail/postfix.nix       |  7 ++--
 nixos/modules/services/misc/db-rest.nix       |  2 +-
 nixos/modules/services/misc/gitlab.nix        |  2 +-
 nixos/modules/services/misc/portunus.nix      |  2 +-
 nixos/modules/services/misc/radicle.nix       |  2 +-
 .../modules/services/misc/tandoor-recipes.nix |  4 +--
 .../monitoring/ocsinventory-agent.nix         |  4 +--
 .../services/monitoring/parsedmarc.nix        |  3 +-
 .../services/monitoring/uptime-kuma.nix       |  2 +-
 nixos/modules/services/networking/biboumi.nix |  3 +-
 nixos/modules/services/networking/privoxy.nix |  3 +-
 nixos/modules/services/networking/stunnel.nix |  4 +--
 nixos/modules/services/networking/unbound.nix |  2 +-
 nixos/modules/services/search/hound.nix       |  2 +-
 nixos/modules/services/system/nix-daemon.nix  |  2 +-
 .../modules/services/torrent/transmission.nix |  2 +-
 nixos/modules/services/web-apps/cryptpad.nix  |  2 +-
 nixos/modules/services/web-apps/dex.nix       |  2 +-
 nixos/modules/services/web-apps/grav.nix      |  2 +-
 nixos/modules/services/web-apps/nextcloud.nix |  4 +--
 nixos/modules/services/web-apps/peertube.nix  |  2 +-
 nixos/modules/services/web-apps/sogo.nix      |  2 +-
 28 files changed, 56 insertions(+), 48 deletions(-)

diff --git a/nixos/doc/manual/release-notes/rl-2505.section.md b/nixos/doc/manual/release-notes/rl-2505.section.md
index 0ef44a7ded92..8870360c8128 100644
--- a/nixos/doc/manual/release-notes/rl-2505.section.md
+++ b/nixos/doc/manual/release-notes/rl-2505.section.md
@@ -540,6 +540,8 @@
 
 - `services.avahi.ipv6` now defaults to true.
 
+- All services that require a root certificate bundle now use the value of a new read-only option, `security.pki.caBundle`.
+
 - hddfancontrol has been updated to major release 2. See the [migration guide](https://github.com/desbma/hddfancontrol/tree/master?tab=readme-ov-file#migrating-from-v1x), as there are breaking changes.
 
 - The Home Assistant module has new options {option}`services.home-assistant.blueprints.automation`, `services.home-assistant.blueprints.script`, and {option}`services.home-assistant.blueprints.template` that allow for the declarative installation of [blueprints](https://www.home-assistant.io/docs/blueprint/) into the appropriate configuration directories.
diff --git a/nixos/modules/security/ca.nix b/nixos/modules/security/ca.nix
index 5e85fe902de6..e1e8dae2a918 100644
--- a/nixos/modules/security/ca.nix
+++ b/nixos/modules/security/ca.nix
@@ -5,7 +5,6 @@
   ...
 }:
 let
-
   cfg = config.security.pki;
 
   cacertPackage = pkgs.cacert.override {
@@ -88,22 +87,31 @@ in
       '';
     };
 
+    security.pki.caBundle = lib.mkOption {
+      type = lib.types.path;
+      readOnly = true;
+      description = ''
+        (Read-only) the path to the final bundle of certificate authorities as a single file.
+      '';
+    };
   };
 
-  config = lib.mkIf cfg.installCACerts {
+  config = lib.mkMerge [
+    (lib.mkIf cfg.installCACerts {
 
-    # NixOS canonical location + Debian/Ubuntu/Arch/Gentoo compatibility.
-    environment.etc."ssl/certs/ca-certificates.crt".source = caBundle;
+      # NixOS canonical location + Debian/Ubuntu/Arch/Gentoo compatibility.
+      environment.etc."ssl/certs/ca-certificates.crt".source = caBundle;
 
-    # Old NixOS compatibility.
-    environment.etc."ssl/certs/ca-bundle.crt".source = caBundle;
+      # Old NixOS compatibility.
+      environment.etc."ssl/certs/ca-bundle.crt".source = caBundle;
 
-    # CentOS/Fedora compatibility.
-    environment.etc."pki/tls/certs/ca-bundle.crt".source = caBundle;
+      # CentOS/Fedora compatibility.
+      environment.etc."pki/tls/certs/ca-bundle.crt".source = caBundle;
 
-    # P11-Kit trust source.
-    environment.etc."ssl/trust-source".source = "${cacertPackage.p11kit}/etc/ssl/trust-source";
-
-  };
+      # P11-Kit trust source.
+      environment.etc."ssl/trust-source".source = "${cacertPackage.p11kit}/etc/ssl/trust-source";
+    })
+    { security.pki.caBundle = caBundle; }
+  ];
 
 }
diff --git a/nixos/modules/services/audio/gonic.nix b/nixos/modules/services/audio/gonic.nix
index 130fd3ecdb9a..6ac4286b2e4c 100644
--- a/nixos/modules/services/audio/gonic.nix
+++ b/nixos/modules/services/audio/gonic.nix
@@ -59,7 +59,7 @@ in
         BindReadOnlyPaths = [
           # gonic can access scrobbling services
           "-/etc/resolv.conf"
-          "-/etc/ssl/certs/ca-certificates.crt"
+          "${config.security.pki.caBundle}:/etc/ssl/certs/ca-certificates.crt"
           builtins.storeDir
         ] ++ cfg.settings.music-path
         ++ lib.optional (cfg.settings.tls-cert != null) cfg.settings.tls-cert
diff --git a/nixos/modules/services/audio/navidrome.nix b/nixos/modules/services/audio/navidrome.nix
index e69bfef48438..41d3da158bca 100644
--- a/nixos/modules/services/audio/navidrome.nix
+++ b/nixos/modules/services/audio/navidrome.nix
@@ -118,9 +118,7 @@ in
             BindReadOnlyPaths =
               [
                 # navidrome uses online services to download additional album metadata / covers
-                "${
-                  config.environment.etc."ssl/certs/ca-certificates.crt".source
-                }:/etc/ssl/certs/ca-certificates.crt"
+                "${config.security.pki.caBundle}:/etc/ssl/certs/ca-certificates.crt"
                 builtins.storeDir
                 "/etc"
               ]
diff --git a/nixos/modules/services/continuous-integration/gocd-agent/default.nix b/nixos/modules/services/continuous-integration/gocd-agent/default.nix
index 607ac0e6ce9b..dd5014542507 100644
--- a/nixos/modules/services/continuous-integration/gocd-agent/default.nix
+++ b/nixos/modules/services/continuous-integration/gocd-agent/default.nix
@@ -213,7 +213,7 @@ in
         rm -f config/autoregister.properties
         ln -s "${pkgs.writeText "autoregister.properties" cfg.agentConfig}" config/autoregister.properties
 
-        ${pkgs.git}/bin/git config --global --add http.sslCAinfo /etc/ssl/certs/ca-certificates.crt
+        ${pkgs.git}/bin/git config --global --add http.sslCAinfo ${config.security.pki.caBundle}
         ${pkgs.jre}/bin/java ${lib.concatStringsSep " " cfg.startupOptions} \
                         ${lib.concatStringsSep " " cfg.extraOptions} \
                               -jar ${pkgs.gocd-agent}/go-agent/agent-bootstrapper.jar \
diff --git a/nixos/modules/services/continuous-integration/gocd-server/default.nix b/nixos/modules/services/continuous-integration/gocd-server/default.nix
index 0997cb394cbe..0c3091f85b49 100644
--- a/nixos/modules/services/continuous-integration/gocd-server/default.nix
+++ b/nixos/modules/services/continuous-integration/gocd-server/default.nix
@@ -217,7 +217,7 @@ in
       path = cfg.packages;
 
       script = ''
-        ${pkgs.git}/bin/git config --global --add http.sslCAinfo /etc/ssl/certs/ca-certificates.crt
+        ${pkgs.git}/bin/git config --global --add http.sslCAinfo ${config.security.pki.caBundle}
         ${pkgs.jre}/bin/java -server ${concatStringsSep " " cfg.startupOptions} \
                                ${concatStringsSep " " cfg.extraOptions}  \
                               -jar ${pkgs.gocd-server}/go-server/lib/go.jar
diff --git a/nixos/modules/services/mail/postfix.nix b/nixos/modules/services/mail/postfix.nix
index 309e03266197..826c1e0a463f 100644
--- a/nixos/modules/services/mail/postfix.nix
+++ b/nixos/modules/services/mail/postfix.nix
@@ -591,10 +591,11 @@ in
 
       tlsTrustedAuthorities = lib.mkOption {
         type = lib.types.str;
-        default = "${pkgs.cacert}/etc/ssl/certs/ca-bundle.crt";
-        defaultText = lib.literalExpression ''"''${pkgs.cacert}/etc/ssl/certs/ca-bundle.crt"'';
+        default = config.security.pki.caBundle;
+        defaultText = lib.literalExpression "config.security.pki.caBundle";
+        example = lib.literalExpression ''"''${pkgs.cacert}/etc/ssl/certs/ca-bundle.crt"'';
         description = ''
-          File containing trusted certification authorities (CA) to verify certificates of mailservers contacted for mail delivery. This basically sets smtp_tls_CAfile and enables opportunistic tls. Defaults to NixOS trusted certification authorities.
+          File containing trusted certification authorities (CA) to verify certificates of mailservers contacted for mail delivery. This sets [smtp_tls_CAfile](https://www.postfix.org/postconf.5.html#smtp_tls_CAfile). Defaults to system trusted certificates (see `security.pki.*` options).
         '';
       };
 
diff --git a/nixos/modules/services/misc/db-rest.nix b/nixos/modules/services/misc/db-rest.nix
index 6cb9dd3da577..d1cedfd2b838 100644
--- a/nixos/modules/services/misc/db-rest.nix
+++ b/nixos/modules/services/misc/db-rest.nix
@@ -162,7 +162,7 @@ in
         };
         environment = {
           NODE_ENV = "production";
-          NODE_EXTRA_CA_CERTS = "/etc/ssl/certs/ca-certificates.crt";
+          NODE_EXTRA_CA_CERTS = config.security.pki.caBundle;
           HOSTNAME = cfg.host;
           PORT = toString cfg.port;
         };
diff --git a/nixos/modules/services/misc/gitlab.nix b/nixos/modules/services/misc/gitlab.nix
index 245ced135c51..f96c6f548b0b 100644
--- a/nixos/modules/services/misc/gitlab.nix
+++ b/nixos/modules/services/misc/gitlab.nix
@@ -244,7 +244,7 @@ let
         ${optionalString (cfg.smtp.authentication != null) "authentication: :${cfg.smtp.authentication},"}
         enable_starttls_auto: ${boolToString cfg.smtp.enableStartTLSAuto},
         tls: ${boolToString cfg.smtp.tls},
-        ca_file: "/etc/ssl/certs/ca-certificates.crt",
+        ca_file: "${config.security.pki.caBundle}",
         openssl_verify_mode: '${cfg.smtp.opensslVerifyMode}'
       }
     end
diff --git a/nixos/modules/services/misc/portunus.nix b/nixos/modules/services/misc/portunus.nix
index 0ab9d69df96a..33a49fb25ee7 100644
--- a/nixos/modules/services/misc/portunus.nix
+++ b/nixos/modules/services/misc/portunus.nix
@@ -285,7 +285,7 @@ in
             in
             {
               PORTUNUS_SERVER_HTTP_SECURE = "true";
-              PORTUNUS_SLAPD_TLS_CA_CERTIFICATE = "/etc/ssl/certs/ca-certificates.crt";
+              PORTUNUS_SLAPD_TLS_CA_CERTIFICATE = config.security.pki.caBundle;
               PORTUNUS_SLAPD_TLS_CERTIFICATE = "${acmeDirectory}/cert.pem";
               PORTUNUS_SLAPD_TLS_DOMAIN_NAME = cfg.domain;
               PORTUNUS_SLAPD_TLS_PRIVATE_KEY = "${acmeDirectory}/key.pem";
diff --git a/nixos/modules/services/misc/radicle.nix b/nixos/modules/services/misc/radicle.nix
index cd7a2452223a..e849c8dee817 100644
--- a/nixos/modules/services/misc/radicle.nix
+++ b/nixos/modules/services/misc/radicle.nix
@@ -45,6 +45,7 @@ let
         BindReadOnlyPaths = [
           "${cfg.configFile}:${env.RAD_HOME}/config.json"
           "${if lib.types.path.check cfg.publicKey then cfg.publicKey else pkgs.writeText "radicle.pub" cfg.publicKey}:${env.RAD_HOME}/keys/radicle.pub"
+          "${config.security.pki.caBundle}:/etc/ssl/certs/ca-certificates.crt"
         ];
         KillMode = "process";
         StateDirectory = [ "radicle" ];
@@ -57,7 +58,6 @@ let
       {
         BindReadOnlyPaths = [
           "-/etc/resolv.conf"
-          "/etc/ssl/certs/ca-certificates.crt"
           "/run/systemd"
         ];
         AmbientCapabilities = "";
diff --git a/nixos/modules/services/misc/tandoor-recipes.nix b/nixos/modules/services/misc/tandoor-recipes.nix
index b56185bd0c45..8f1cb4cbadde 100644
--- a/nixos/modules/services/misc/tandoor-recipes.nix
+++ b/nixos/modules/services/misc/tandoor-recipes.nix
@@ -118,9 +118,7 @@ in
         RuntimeDirectory = "tandoor-recipes";
 
         BindReadOnlyPaths = [
-          "${
-            config.environment.etc."ssl/certs/ca-certificates.crt".source
-          }:/etc/ssl/certs/ca-certificates.crt"
+          "${config.security.pki.caBundle}:/etc/ssl/certs/ca-certificates.crt"
           builtins.storeDir
           "-/etc/resolv.conf"
           "-/etc/nsswitch.conf"
diff --git a/nixos/modules/services/monitoring/ocsinventory-agent.nix b/nixos/modules/services/monitoring/ocsinventory-agent.nix
index 83fec3b2b57d..fba1ebcae4a5 100644
--- a/nixos/modules/services/monitoring/ocsinventory-agent.nix
+++ b/nixos/modules/services/monitoring/ocsinventory-agent.nix
@@ -53,7 +53,8 @@ in
 
             ca = lib.mkOption {
               type = lib.types.path;
-              default = "/etc/ssl/certs/ca-certificates.crt";
+              default = config.security.pki.caBundle;
+              defaultText = lib.literalExpression "config.security.pki.caBundle";
               description = ''
                 Path to CA certificates file in PEM format, for server
                 SSL certificate validation.
@@ -72,7 +73,6 @@ in
         };
         default = { };
         example = {
-          ca = "/etc/ssl/certs/ca-certificates.crt";
           debug = true;
           server = "https://ocsinventory.localhost:8080/ocsinventory";
           tag = "01234567890123";
diff --git a/nixos/modules/services/monitoring/parsedmarc.nix b/nixos/modules/services/monitoring/parsedmarc.nix
index 22c37f3e26e2..4b3991ebf188 100644
--- a/nixos/modules/services/monitoring/parsedmarc.nix
+++ b/nixos/modules/services/monitoring/parsedmarc.nix
@@ -371,7 +371,8 @@ in
 
             cert_path = lib.mkOption {
               type = lib.types.path;
-              default = "/etc/ssl/certs/ca-certificates.crt";
+              default = config.security.pki.caBundle;
+              defaultText = lib.literalExpression "config.security.pki.caBundle";
               description = ''
                 The path to a TLS certificate bundle used to verify
                 the server's certificate.
diff --git a/nixos/modules/services/monitoring/uptime-kuma.nix b/nixos/modules/services/monitoring/uptime-kuma.nix
index 3b15cb80a861..c673a09832b0 100644
--- a/nixos/modules/services/monitoring/uptime-kuma.nix
+++ b/nixos/modules/services/monitoring/uptime-kuma.nix
@@ -24,7 +24,7 @@ in
         default = { };
         example = {
           PORT = "4000";
-          NODE_EXTRA_CA_CERTS = "/etc/ssl/certs/ca-certificates.crt";
+          NODE_EXTRA_CA_CERTS = lib.literalExpression "config.security.pki.caBundle";
         };
         description = ''
           Additional configuration for Uptime Kuma, see
diff --git a/nixos/modules/services/networking/biboumi.nix b/nixos/modules/services/networking/biboumi.nix
index ec28cadd8da2..a8318aff59b1 100644
--- a/nixos/modules/services/networking/biboumi.nix
+++ b/nixos/modules/services/networking/biboumi.nix
@@ -57,7 +57,8 @@ in
           };
           options.ca_file = lib.mkOption {
             type = lib.types.path;
-            default = "/etc/ssl/certs/ca-certificates.crt";
+            default = config.security.pki.caBundle;
+            defaultText = lib.literalExpression "config.security.pki.caBundle";
             description = ''
               Specifies which file should be used as the list of trusted CA
               when negotiating a TLS session.
diff --git a/nixos/modules/services/networking/privoxy.nix b/nixos/modules/services/networking/privoxy.nix
index 9c9353f175e9..c57c8377bdac 100644
--- a/nixos/modules/services/networking/privoxy.nix
+++ b/nixos/modules/services/networking/privoxy.nix
@@ -282,9 +282,8 @@ in
         # This allows setting absolute key/crt paths
         ca-directory = "/var/empty";
         certificate-directory = "/run/privoxy/certs";
-        trusted-cas-file = "/etc/ssl/certs/ca-certificates.crt";
+        trusted-cas-file = config.security.pki.caBundle;
       });
-
   };
 
   imports =
diff --git a/nixos/modules/services/networking/stunnel.nix b/nixos/modules/services/networking/stunnel.nix
index ddc50a04789a..0e02cc74184c 100644
--- a/nixos/modules/services/networking/stunnel.nix
+++ b/nixos/modules/services/networking/stunnel.nix
@@ -123,7 +123,7 @@ in
         description = ''
           Define the client configurations.
 
-          By default, verifyChain and OCSPaia are enabled and a CAFile is provided from pkgs.cacert.
+          By default, verifyChain and OCSPaia are enabled and CAFile is set to `security.pki.caBundle`.
 
           See "SERVICE-LEVEL OPTIONS" in {manpage}`stunnel(8)`.
         '';
@@ -144,7 +144,7 @@ in
             applyDefaults =
               c:
               {
-                CAFile = "${pkgs.cacert}/etc/ssl/certs/ca-bundle.crt";
+                CAFile = config.security.pki.caBundle;
                 OCSPaia = true;
                 verifyChain = true;
               }
diff --git a/nixos/modules/services/networking/unbound.nix b/nixos/modules/services/networking/unbound.nix
index 7786f6a8d4d5..26c43521b2c1 100644
--- a/nixos/modules/services/networking/unbound.nix
+++ b/nixos/modules/services/networking/unbound.nix
@@ -195,7 +195,7 @@ in {
         interface = mkDefault ([ "127.0.0.1" ] ++ (optional config.networking.enableIPv6 "::1"));
         access-control = mkDefault ([ "127.0.0.0/8 allow" ] ++ (optional config.networking.enableIPv6 "::1/128 allow"));
         auto-trust-anchor-file = mkIf cfg.enableRootTrustAnchor rootTrustAnchorFile;
-        tls-cert-bundle = mkDefault "/etc/ssl/certs/ca-certificates.crt";
+        tls-cert-bundle = mkDefault config.security.pki.caBundle;
         # prevent race conditions on system startup when interfaces are not yet
         # configured
         ip-freebind = mkDefault true;
diff --git a/nixos/modules/services/search/hound.nix b/nixos/modules/services/search/hound.nix
index 98ef752aa8e8..87066c79374a 100644
--- a/nixos/modules/services/search/hound.nix
+++ b/nixos/modules/services/search/hound.nix
@@ -118,7 +118,7 @@ in
         User = cfg.user;
         Group = cfg.group;
         WorkingDirectory = cfg.home;
-        ExecStartPre = "${pkgs.git}/bin/git config --global --replace-all http.sslCAinfo /etc/ssl/certs/ca-certificates.crt";
+        ExecStartPre = "${pkgs.git}/bin/git config --global --replace-all http.sslCAinfo ${config.security.pki.caBundle}";
         ExecStart = "${cfg.package}/bin/houndd -addr ${cfg.listen} -conf /etc/hound/config.json";
       };
     };
diff --git a/nixos/modules/services/system/nix-daemon.nix b/nixos/modules/services/system/nix-daemon.nix
index 78787d08b1e1..bc5bbcf06cf1 100644
--- a/nixos/modules/services/system/nix-daemon.nix
+++ b/nixos/modules/services/system/nix-daemon.nix
@@ -218,7 +218,7 @@ in
       environment =
         cfg.envVars
         // {
-          CURL_CA_BUNDLE = "/etc/ssl/certs/ca-certificates.crt";
+          CURL_CA_BUNDLE = config.security.pki.caBundle;
         }
         // config.networking.proxy.envVars;
 
diff --git a/nixos/modules/services/torrent/transmission.nix b/nixos/modules/services/torrent/transmission.nix
index 397b11c3e013..65501ecf7f4c 100644
--- a/nixos/modules/services/torrent/transmission.nix
+++ b/nixos/modules/services/torrent/transmission.nix
@@ -361,7 +361,7 @@ in
       wantedBy = [ "multi-user.target" ];
 
       environment = {
-        CURL_CA_BUNDLE = etc."ssl/certs/ca-certificates.crt".source;
+        CURL_CA_BUNDLE = config.security.pki.caBundle;
         TRANSMISSION_WEB_HOME = lib.mkIf (cfg.webHome != null) cfg.webHome;
       };
 
diff --git a/nixos/modules/services/web-apps/cryptpad.nix b/nixos/modules/services/web-apps/cryptpad.nix
index f2493d57e3cf..a5f142553495 100644
--- a/nixos/modules/services/web-apps/cryptpad.nix
+++ b/nixos/modules/services/web-apps/cryptpad.nix
@@ -239,7 +239,7 @@ in
             "-/etc/resolv.conf"
             "-/run/systemd"
             "/etc/hosts"
-            "/etc/ssl/certs/ca-certificates.crt"
+            "${config.security.pki.caBundle}:/etc/ssl/certs/ca-certificates.crt"
           ];
         };
       };
diff --git a/nixos/modules/services/web-apps/dex.nix b/nixos/modules/services/web-apps/dex.nix
index 13af63892fe9..37b27ae8f1cd 100644
--- a/nixos/modules/services/web-apps/dex.nix
+++ b/nixos/modules/services/web-apps/dex.nix
@@ -117,7 +117,7 @@ in
             "-/etc/localtime"
             "-/etc/nsswitch.conf"
             "-/etc/resolv.conf"
-            "-/etc/ssl/certs/ca-certificates.crt"
+            "${config.security.pki.caBundle}:/etc/ssl/certs/ca-certificates.crt"
           ];
           BindPaths = optional (cfg.settings.storage.type == "postgres") "/var/run/postgresql";
           # ProtectClock= adds DeviceAllow=char-rtc r
diff --git a/nixos/modules/services/web-apps/grav.nix b/nixos/modules/services/web-apps/grav.nix
index 25743bc3e3f0..6549002c47ac 100644
--- a/nixos/modules/services/web-apps/grav.nix
+++ b/nixos/modules/services/web-apps/grav.nix
@@ -132,7 +132,7 @@ in
             "opcache.memory_consumption" = "128";
             "opcache.revalidate_freq" = "1";
             "opcache.fast_shutdown" = "1";
-            "openssl.cafile" = "/etc/ssl/certs/ca-certificates.crt";
+            "openssl.cafile" = config.security.pki.caBundle;
             catch_workers_output = "yes";
 
             upload_max_filesize = cfg.maxUploadSize;
diff --git a/nixos/modules/services/web-apps/nextcloud.nix b/nixos/modules/services/web-apps/nextcloud.nix
index 1943e06804a6..cc5dae198837 100644
--- a/nixos/modules/services/web-apps/nextcloud.nix
+++ b/nixos/modules/services/web-apps/nextcloud.nix
@@ -19,7 +19,7 @@ let
     "opcache.memory_consumption" = "128";
     "opcache.revalidate_freq" = "1";
     "opcache.fast_shutdown" = "1";
-    "openssl.cafile" = "/etc/ssl/certs/ca-certificates.crt";
+    "openssl.cafile" = config.security.pki.caBundle;
     catch_workers_output = "yes";
   };
 
@@ -400,7 +400,7 @@ in {
 
     phpOptions = mkOption {
       type = with types; attrsOf (oneOf [ str int ]);
-      defaultText = literalExpression (generators.toPretty { } defaultPHPSettings);
+      defaultText = literalExpression (generators.toPretty { } (defaultPHPSettings // { "openssl.cafile" = literalExpression "config.security.pki.caBundle"; }));
       description = ''
         Options for PHP's php.ini file for nextcloud.
 
diff --git a/nixos/modules/services/web-apps/peertube.nix b/nixos/modules/services/web-apps/peertube.nix
index f52a4ccf6266..2fe726e61525 100644
--- a/nixos/modules/services/web-apps/peertube.nix
+++ b/nixos/modules/services/web-apps/peertube.nix
@@ -16,7 +16,7 @@ let
   env = {
     NODE_CONFIG_DIR = "/var/lib/peertube/config";
     NODE_ENV = "production";
-    NODE_EXTRA_CA_CERTS = "/etc/ssl/certs/ca-certificates.crt";
+    NODE_EXTRA_CA_CERTS = config.security.pki.caBundle;
     NPM_CONFIG_CACHE = "/var/cache/peertube/.npm";
     NPM_CONFIG_PREFIX = cfg.package;
     HOME = cfg.package;
diff --git a/nixos/modules/services/web-apps/sogo.nix b/nixos/modules/services/web-apps/sogo.nix
index c34896d1112e..ddf673dcaf42 100644
--- a/nixos/modules/services/web-apps/sogo.nix
+++ b/nixos/modules/services/web-apps/sogo.nix
@@ -113,7 +113,7 @@ in
       wantedBy = [ "multi-user.target" ];
       restartTriggers = [ config.environment.etc."sogo/sogo.conf.raw".source ];
 
-      environment.LDAPTLS_CACERT = "/etc/ssl/certs/ca-certificates.crt";
+      environment.LDAPTLS_CACERT = config.security.pki.caBundle;
 
       serviceConfig = {
         Type = "forking";

From e43340da27c0e493a008c81cb07d5f26171eac12 Mon Sep 17 00:00:00 2001
From: n <twohexed@gmail.com>
Date: Sat, 8 Mar 2025 14:34:05 +0530
Subject: [PATCH 68/71] nixos/emacs: improve description of
 services.emacs.enable (#387966)

Remove `, whatever its value.` because it makes the sentence confusing.
---
 nixos/modules/services/editors/emacs.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/nixos/modules/services/editors/emacs.nix b/nixos/modules/services/editors/emacs.nix
index 93c814acad2e..50bca3596032 100644
--- a/nixos/modules/services/editors/emacs.nix
+++ b/nixos/modules/services/editors/emacs.nix
@@ -26,7 +26,7 @@ in
       description = ''
         Whether to enable a user service for the Emacs daemon. Use `emacsclient` to connect to the
         daemon. If `true`, {var}`services.emacs.install` is
-        considered `true`, whatever its value.
+        considered `true`.
       '';
     };
 

From afdc6ae625d951a696214ea47e178d5f6d05e85e Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Sat, 8 Mar 2025 11:20:24 +0100
Subject: [PATCH 69/71] python313Packages.django_5: 5.1.6 -> 5.1.7

https://docs.djangoproject.com/en/5.1/releases/5.1.7/
https://www.djangoproject.com/weblog/2025/mar/06/security-releases/

Fixes: CVE-2025-26699
---
 pkgs/development/python-modules/django/5.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/django/5.nix b/pkgs/development/python-modules/django/5.nix
index 9bcc73c74152..3dcf8217e327 100644
--- a/pkgs/development/python-modules/django/5.nix
+++ b/pkgs/development/python-modules/django/5.nix
@@ -44,7 +44,7 @@
 
 buildPythonPackage rec {
   pname = "django";
-  version = "5.1.6";
+  version = "5.1.7";
   pyproject = true;
 
   disabled = pythonOlder "3.10";
@@ -53,7 +53,7 @@ buildPythonPackage rec {
     owner = "django";
     repo = "django";
     rev = "refs/tags/${version}";
-    hash = "sha256-eqyRiMNMmhg08Pga+AGnhGXfUoTMOuIHEPOEEGboIPE=";
+    hash = "sha256-BxhHqWpTZLcx46RofnXzZ5nj4xDPcj7hNng9ppUN5Hw=";
   };
 
   patches =

From 52653625a7d7d32a30f551d7a6e8618f09fb485e Mon Sep 17 00:00:00 2001
From: confusedalex <alex@confusedalex.dev>
Date: Thu, 19 Dec 2024 13:48:12 +0100
Subject: [PATCH 70/71] fishy: init at 0.2.1

---
 pkgs/by-name/fi/fishy/package.nix | 43 +++++++++++++++++++++++++++++++
 1 file changed, 43 insertions(+)
 create mode 100644 pkgs/by-name/fi/fishy/package.nix

diff --git a/pkgs/by-name/fi/fishy/package.nix b/pkgs/by-name/fi/fishy/package.nix
new file mode 100644
index 000000000000..3546c4c2fd88
--- /dev/null
+++ b/pkgs/by-name/fi/fishy/package.nix
@@ -0,0 +1,43 @@
+{
+  fetchFromGitHub,
+  lib,
+  nix-update-script,
+  openssl,
+  pkg-config,
+  rustPlatform,
+  versionCheckHook,
+}:
+
+rustPlatform.buildRustPackage rec {
+  pname = "fishy";
+  version = "0.2.1";
+
+  src = fetchFromGitHub {
+    owner = "p2panda";
+    repo = "fishy";
+    tag = "v${version}";
+    hash = "sha256-nRkP53v9+VzqHKTsHs+cBeLjh3yASFE18sSEY02NR1s=";
+  };
+
+  useFetchCargoVendor = true;
+  cargoHash = "sha256-F4zbalop1PEb381DctUIzdm3v71b6M/hnuw9BuIEkBU=";
+
+  OPENSSL_NO_VENDOR = 1;
+
+  nativeBuildInputs = [ pkg-config ];
+  buildInputs = [ openssl ];
+
+  nativeInstallCheckInputs = [ versionCheckHook ];
+  versionCheckProgramArg = "--version";
+  doInstallCheck = true;
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "Create, manage and deploy p2panda schemas";
+    homepage = "https://github.com/p2panda/fishy";
+    changelog = "https://github.com/p2panda/fishy/blob/${src.rev}/CHANGELOG.md";
+    license = lib.licenses.agpl3Only;
+    maintainers = with lib.maintainers; [ confusedalex ];
+    mainProgram = "fishy";
+  };
+}

From 3ea41d4051a81f0869d3a8d560fc4384bdd70573 Mon Sep 17 00:00:00 2001
From: Stefan Weigl-Bosker <stefan@s00.xyz>
Date: Thu, 6 Mar 2025 16:40:07 -0500
Subject: [PATCH 71/71] wmenu: 0.1.9 -> 0.1.9-unstable-2025-03-01

Fixes a rendering issue that affects all upstream wlroots compositors: https://codeberg.org/adnano/wmenu/issues/14.
---
 pkgs/by-name/wm/wmenu/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/wm/wmenu/package.nix b/pkgs/by-name/wm/wmenu/package.nix
index faa58a57799a..e5704bc65656 100644
--- a/pkgs/by-name/wm/wmenu/package.nix
+++ b/pkgs/by-name/wm/wmenu/package.nix
@@ -16,7 +16,7 @@
 
 stdenv.mkDerivation rec {
   pname = "wmenu";
-  version = "0.1.9";
+  version = "0.1.9-unstable-2025-03-01";
 
   strictDeps = true;
 
@@ -24,8 +24,8 @@ stdenv.mkDerivation rec {
     domain = "codeberg.org";
     owner = "adnano";
     repo = "wmenu";
-    rev = version;
-    hash = "sha256-TF5BvgThvTOqxyfz5Zt/Z1cqjFJwvla+dgdyvz7Zhrg=";
+    rev = "fc69aa6e2bccca461a0bd0c10b448b64ccda1d42";
+    hash = "sha256-ZssptllD6LPQUinKZime9A1dZJ3CkQvp+DUmk+iyaOA=";
   };
 
   nativeBuildInputs = [