Merge branch 'master' into waagent-module

2024-12-08 12:59:45 +08:00
parent d07d8a5589 d88cb592e9
commit caa41052bb
523 changed files with 8994 additions and 10367 deletions
@@ -0,0 +1,30 @@
+name: "Building Nixpkgs lib-tests"
+
+permissions:
+  contents: read
+
+on:
+  pull_request_target:
+    paths:
+      - 'lib/**'
+jobs:
+  get-merge-commit:
+    uses: ./.github/workflows/get-merge-commit.yml
+
+  nixpkgs-lib-tests:
+    name: nixpkgs-lib-tests
+    runs-on: ubuntu-latest
+    needs: get-merge-commit
+    steps:
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        if: needs.get-merge-commit.outputs.mergedSha
+        with:
+          # pull_request_target checks out the base branch by default
+          ref: ${{ needs.get-merge-commit.outputs.mergedSha }}
+      - uses: cachix/install-nix-action@08dcb3a5e62fa31e2da3d490afc4176ef55ecd72 # v30
+        with:
+          # explicitly enable sandbox
+          extra_nix_config: sandbox = true
+      - name: Building Nixpkgs lib-tests
+        run: |
+          nix-build --arg pkgs "(import ./ci/. {}).pkgs" ./lib/tests/release.nix
@@ -0,0 +1,22 @@
+queue_rules:
+  # This rule is for https://docs.mergify.com/commands/queue/
+  # and can be triggered with: @mergifyio queue
+  - name: default
+    merge_conditions:
+      # all github action checks in this list are required to merge a pull request
+      - check-success=Attributes
+      - check-success=Check
+      - check-success=Outpaths (aarch64-darwin)
+      - check-success=Outpaths (aarch64-linux)
+      - check-success=Outpaths (x86_64-darwin)
+      - check-success=Outpaths (x86_64-linux)
+      - check-success=Process
+      - check-success=Request
+      - check-success=Tag
+      - check-success=editorconfig-check
+      - check-success=label-pr
+      - check-success=nix-files-parseable-check
+      - check-success=nixfmt-check
+      - check-success=nixpkgs-vet
+    # queue up to 5 pull requests at a time
+    batch_size: 5
@@ -157,6 +157,7 @@ nixos/modules/installer/tools/nix-fallback-paths.nix  @NixOS/nix-team @raitobeza
 # Python-related code and docs
 /doc/languages-frameworks/python.section.md   @mweinelt @natsukium
 /maintainers/scripts/update-python-libraries  @mweinelt @natsukium
+/pkgs/by-name/up/update-python-libraries      @mweinelt @natsukium
 /pkgs/development/interpreters/python         @mweinelt @natsukium
 /pkgs/top-level/python-packages.nix                     @natsukium
 /pkgs/top-level/release-python.nix                      @natsukium
@@ -206,8 +207,8 @@ nixos/modules/installer/tools/nix-fallback-paths.nix  @NixOS/nix-team @raitobeza

 # Browsers
 /pkgs/applications/networking/browsers/firefox @mweinelt
-/pkgs/applications/networking/browsers/chromium @emilylange
-/nixos/tests/chromium.nix @emilylange
+/pkgs/applications/networking/browsers/chromium @emilylange @networkException
+/nixos/tests/chromium.nix @emilylange @networkException

 # Certificate Authorities
 pkgs/data/misc/cacert/ @ajs124 @lukegb @mweinelt
@@ -4668,6 +4668,13 @@
    name = "Carl Richard Theodor Schneider";
    keys = [ { fingerprint = "2017 E152 BB81 5C16 955C  E612 45BC C1E2 709B 1788"; } ];
  };
+  cryo = {
+    email = "cryo@disroot.org";
+    github = "cry0ice";
+    githubId = 176274027;
+    name = "Cryo";
+    keys = [ { fingerprint = "2CF7 F8E8 2258 5751 2591  F97F 4B12 E34A 25A9 AB35"; } ];
+  };
  Cryolitia = {
    name = "Cryolitia PukNgae";
    email = "Cryolitia@gmail.com";
@@ -4800,6 +4807,12 @@
    github = "d4ilyrun";
    githubId = 34611103;
  };
+  d4rk = {
+    name = "Anoop Menon";
+    email = "d4rk@blackvoltage.org";
+    github = "d4rk";
+    githubId = 22163;
+  };
  d4rkstar = {
    name = "Bruno Salzano";
    email = "d4rkstar@gmail.com";
@@ -18091,6 +18104,13 @@
    githubId = 4579165;
    name = "Danny Bautista";
  };
+  pyrotelekinetic = {
+    name = "Clover";
+    email = "carter@isons.org";
+    github = "pyrotelekinetic";
+    githubId = 29682759;
+    keys = [ { fingerprint = "5963 78DB 25AA 608D 2743  D466 5D6A D9AE 71B3 F983"; } ];
+  };
  pyrox0 = {
    name = "Pyrox";
    email = "pyrox@pyrox.dev";
@@ -22782,7 +22802,7 @@
    githubId = 332418;
  };
  tsandrini = {
-    email = "tomas.sandrini@seznam.cz";
+    email = "t@tsandrini.sh";
    name = "Tomáš Sandrini";
    github = "tsandrini";
    githubId = 21975189;
@@ -1,3 +1,3 @@
 #!/usr/bin/env nix-shell
 #!nix-shell -I nixpkgs=channel:nixpkgs-unstable -i bash -p "python3.withPackages (ps: with ps; [ packaging requests ])" -p nix-prefetch-git
-exec python3 pkgs/development/interpreters/python/update-python-libraries/update-python-libraries.py $@
+exec python3 pkgs/by-name/up/update-python-libraries/update-python-libraries.py $@
@@ -122,7 +122,7 @@ The primary benefit of this is to remove a dependency on perl.
 This is experimental.
 :::

-Like systemd-sysusers, Userborn adoesn't depend on Perl but offers some more
+Like systemd-sysusers, Userborn doesn't depend on Perl but offers some more
 advantages over systemd-sysusers:

 1. It can create "normal" users (with a GID >= 1000).
@@ -24,6 +24,10 @@

 - [waagent](https://github.com/Azure/WALinuxAgent), the Microsoft Azure Linux Agent (waagent) manages Linux provisioning and VM interaction with the Azure Fabric Controller. Available with [services.waagent](options.html#opt-services.waagent.enable).

+- [mqtt-exporter](https://github.com/kpetremann/mqtt-exporter/), a Prometheus exporter for exposing messages from MQTT. Available as [services.prometheus.exporters.mqtt](#opt-services.prometheus.exporters.mqtt.enable).
+
+- [Buffyboard](https://gitlab.postmarketos.org/postmarketOS/buffybox/-/tree/master/buffyboard), a framebuffer on-screen keyboard. Available as [services.buffyboard](option.html#opt-services.buffyboard).
+
 <!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->

 ## Backward Incompatibilities {#sec-release-25.05-incompatibilities}
@@ -50,6 +54,10 @@

 - `nodePackages.webpack-dev-server` has been removed, as it should be installed in projects that use it instead.

+- `racket_7_9` has been removed, as it is insecure. It is recommended to use Racket 8 instead.
+
+- `fluxus` has been removed, as it depends on `racket_7_9` and had no updates in 9 years.
+
 - The behavior of the `networking.nat.externalIP` and `networking.nat.externalIPv6` options has been changed. `networking.nat.forwardPorts` now only forwards packets destined for the specified IP addresses.

 - `nodePackages.meshcommander` has been removed, as the package was deprecated by Intel.
@@ -64,7 +72,7 @@
  files have changed from `$out/share/fonts/{opentype,truetype}/NerdFonts` to
  `$out/share/fonts/{opentype,truetype}/NerdFonts/<fontDirName>`, where `<fontDirName>` can be found in the
  [official website](https://www.nerdfonts.com/font-downloads) as the titles in preview images, with the "Nerd Font"
-  suffix and any whitespaces trimmed.
+  suffix and any whitespaces trimmed. Configuration changes are required, see build output.

 - `retroarch` has been refactored and the older `retroarch.override { cores = [ ... ]; }` to create a RetroArch derivation with custom cores doesn't work anymore, use `retroarch.withCores (cores: [ ... ])` instead. If you need more customization (e.g.: custom settings), use `wrapRetroArch` instead.

@@ -85,6 +93,11 @@
  add `vimPlugins.notmuch-vim` to your (Neo)vim configuration if you want the
  vim plugin.

+- `prisma` and `prisma-engines` have been updated to version 6.0.1, which
+  introduces several breaking changes. See the
+  [Prisma ORM upgrade guide](https://www.prisma.io/docs/orm/more/upgrade-guides/upgrading-versions/upgrading-to-prisma-6)
+  for more information.
+
 <!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->

 ## Other Notable Changes {#sec-release-25.05-notable-changes}
@@ -93,6 +106,8 @@

 - Cinnamon has been updated to 6.4.

+- `services.avahi.ipv6` now defaults to true.
+
 - `bind.cacheNetworks` now only controls access for recursive queries, where it previously controlled access for all queries.

 <!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->
@@ -278,11 +278,23 @@ in
        PRUNE_BIND_MOUNTS = if cfg.pruneBindMounts then "yes" else "no";
      };
      serviceConfig = {
+        CapabilityBoundingSet = "CAP_DAC_READ_SEARCH CAP_CHOWN";
        Nice = 19;
        IOSchedulingClass = "idle";
+        IPAddressDeny = "any";
+        LockPersonality = true;
+        MemoryDenyWriteExecute = true;
+        NoNewPrivileges = true;
        PrivateTmp = "yes";
+        PrivateDevices = true;
        PrivateNetwork = "yes";
-        NoNewPrivileges = "yes";
+        ProtectClock = true;
+        ProtectControlGroups = true;
+        ProtectHostname = true;
+        RestrictAddressFamilies = "AF_UNIX";
+        RestrictNamespaces = true;
+        RestrictRealtime = true;
+        RestrictSUIDSGID = true;
        ReadOnlyPaths = "/";
        # Use dirOf cfg.output because mlocate creates temporary files next to
        # the actual database. We could specify and create them as well,
@@ -290,6 +302,8 @@ in
        # NOTE: If /var/cache does not exist, this leads to the misleading error message:
        # update-locatedb.service: Failed at step NAMESPACE spawning …/update-locatedb-start: No such file or directory
        ReadWritePaths = dirOf cfg.output;
+        SystemCallArchitectures = "native";
+        SystemCallFilter = "@system-service @chown";
      };
    };

@@ -588,6 +588,7 @@
  ./services/hardware/bluetooth.nix
  ./services/hardware/bolt.nix
  ./services/hardware/brltty.nix
+  ./services/hardware/buffyboard.nix
  ./services/hardware/ddccontrol.nix
  ./services/hardware/display.nix
  ./services/hardware/fancontrol.nix
@@ -210,5 +210,5 @@ in
    };
  };

-  meta.maintainers = with lib.maintainers; [ julm ];
+  meta.maintainers = with lib.maintainers; [ julm grimmauld ];
 }
@@ -170,15 +170,6 @@ static int make_caps_ambient(const char *self_path) {
    "MALLOC_ARENA_TEST\0"

 int main(int argc, char **argv) {
-    ASSERT(argc >= 1);
-
-    // argv[0] goes into a lot of places, to a far greater degree than other elements
-    // of argv. glibc has had buffer overflows relating to argv[0], eg CVE-2023-6246.
-    // Since we expect the wrappers to be invoked from either $PATH or /run/wrappers/bin,
-    // there should be no reason to pass any particularly large values here, so we can
-    // be strict for strictness' sake.
-    ASSERT(strlen(argv[0]) < 512);
-
    int debug = getenv(wrapper_debug) != NULL;

    // Drop insecure environment variables explicitly
@@ -209,10 +200,22 @@ int main(int argc, char **argv) {
        return 1;
    }

+    char *replacement_argv[2] = {SOURCE_PROG, NULL};
+    char *old_argv0;
+    // Replace untrusted or missing argv[0] by the wrapped program path.
+    // This mitigates vulnerabilities caused by incorrect handling in privileged code.
+    if (argv[0]) {
+        old_argv0 = argv[0];
+        argv[0] = SOURCE_PROG;
+    } else {
+        old_argv0 = "«nullptr»";
+        argv = replacement_argv;
+    }
+
    execve(SOURCE_PROG, argv, environ);
-    
+
    fprintf(stderr, "%s: cannot run `%s': %s\n",
-        argv[0], SOURCE_PROG, strerror(errno));
+        old_argv0, SOURCE_PROG, strerror(errno));

    return 1;
 }
@@ -6,5 +6,5 @@
    ./github-runner/service.nix
  ];

-  meta.maintainers = with lib.maintainers; [ veehaitch newam ];
+  meta.maintainers = with lib.maintainers; [ veehaitch ];
 }
@@ -90,6 +90,7 @@ in
            lomiri-filemanager-app
            lomiri-gallery-app
            lomiri-history-service
+            lomiri-mediaplayer-app
            lomiri-polkit-agent
            lomiri-schemas # exposes some required dbus interfaces
            lomiri-session # wrappers to properly launch the session
@@ -0,0 +1,138 @@
+# INTEGRATION NOTES:
+# Buffyboard integrates as a virtual device in /dev/input
+# which reads touch or pointer events from other input devices
+# and generates events based on where those map to the keys it renders to the framebuffer.
+#
+# Buffyboard generates these events whether or not its onscreen keyboard is actually visible.
+# Hence special care is needed if running anything which claims ownership of the display (such as a desktop environment),
+# to avoid unwanted input events being triggered during normal desktop operation.
+#
+# Desktop users are recommended to either:
+# 1. Stop buffyboard once your DE is started.
+#   e.g. `services.buffyboard.unitConfig.Conflicts = [ "my-de.service" ];`
+# 2. Configure your DE to ignore input events from buffyboard (product-id=25209; vendor-id=26214; name=rd)
+#   e.g. `echo 'input "26214:25209:rd" events disabled' > ~/.config/sway/config`
+
+{
+  config,
+  lib,
+  pkgs,
+  utils,
+  ...
+}:
+let
+  cfg = config.services.buffyboard;
+  ini = pkgs.formats.ini { };
+in
+{
+  meta.maintainers = with lib.maintainers; [ colinsane ];
+
+  options = {
+    services.buffyboard = with lib; {
+      enable = mkEnableOption "buffyboard framebuffer keyboard (on-screen keyboard)";
+      package = mkPackageOption pkgs "buffybox" { };
+
+      extraFlags = mkOption {
+        type = types.listOf types.str;
+        default = [ ];
+        description = ''
+          Extra CLI arguments to pass to buffyboard.
+        '';
+        example = [
+          "--geometry=1920x1080@640,0"
+          "--dpi=192"
+          "--rotate=2"
+          "--verbose"
+        ];
+      };
+
+      configFile = mkOption {
+        type = lib.types.path;
+        default = ini.generate "buffyboard.conf" (lib.filterAttrsRecursive (_: v: v != null) cfg.settings);
+        defaultText = lib.literalExpression ''ini.generate "buffyboard.conf" cfg.settings'';
+        description = ''
+          Path to an INI format configuration file to provide Buffyboard.
+          By default, this is generated from whatever you've set in `settings`.
+          If specified manually, then `settings` is ignored.
+
+          For an example config file see [here](https://gitlab.postmarketos.org/postmarketOS/buffybox/-/blob/master/buffyboard/buffyboard.conf)
+        '';
+      };
+
+      settings = mkOption {
+        description = ''
+          Settings to include in /etc/buffyboard.conf.
+          Every option here is strictly optional:
+          Buffyboard will use its own baked-in defaults for those options left unset.
+        '';
+        type = types.submodule {
+          freeformType = ini.type;
+
+          options.input.pointer = mkOption {
+            type = types.nullOr types.bool;
+            default = null;
+            description = ''
+              Enable or disable the use of a hardware mouse or other pointing device.
+            '';
+          };
+          options.input.touchscreen = mkOption {
+            type = types.nullOr types.bool;
+            default = null;
+            description = ''
+              Enable or disable the use of the touchscreen.
+            '';
+          };
+
+          options.theme.default = mkOption {
+            type = types.either types.str (
+              types.enum [
+                null
+                "adwaita-dark"
+                "breezy-dark"
+                "breezy-light"
+                "nord-dark"
+                "nord-light"
+                "pmos-dark"
+                "pmos-light"
+              ]
+            );
+            default = null;
+            description = ''
+              Selects the default theme on boot. Can be changed at runtime to the alternative theme.
+            '';
+          };
+          options.quirks.fbdev_force_refresh = mkOption {
+            type = types.nullOr types.bool;
+            default = null;
+            description = ''
+              If true and using the framebuffer backend, this triggers a display refresh after every draw operation.
+              This has a negative performance impact.
+            '';
+          };
+        };
+        default = { };
+      };
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    systemd.packages = [ cfg.package ];
+    systemd.services.buffyboard = {
+      # upstream provides the service (including systemd hardening): we just configure it to start by default
+      # and override ExecStart so as to optionally pass extra arguments
+      serviceConfig.ExecStart = [
+        "" # clear default ExecStart
+        (utils.escapeSystemdExecArgs (
+          [
+            (lib.getExe' cfg.package "buffyboard")
+            "--config-override"
+            cfg.configFile
+          ]
+          ++ cfg.extraFlags
+        ))
+      ];
+      wantedBy = [ "getty.target" ];
+      before = [ "getty.target" ];
+    };
+  };
+}
@@ -13,7 +13,13 @@ let
  // lib.optionalAttrs (cfg.ddUrl != null) { dd_url = cfg.ddUrl; }
  // lib.optionalAttrs (cfg.site != null) { site = cfg.site; }
  // lib.optionalAttrs (cfg.tags != null ) { tags = lib.concatStringsSep ", " cfg.tags; }
-  // lib.optionalAttrs (cfg.enableLiveProcessCollection) { process_config = { enabled = "true"; }; }
+  // lib.optionalAttrs (cfg.enableLiveProcessCollection) {
+    process_config = {
+      dd_agent_bin = "${datadogPkg}/bin/agent";
+      process_collection.enabled = "true";
+      container_collection.enabled = "true";
+    };
+  }
  // lib.optionalAttrs (cfg.enableTraceAgent) { apm_config = { enabled = true; }; }
  // cfg.extraConfig;

@@ -58,6 +58,7 @@ let
    "mikrotik"
    "modemmanager"
    "mongodb"
+    "mqtt"
    "mysqld"
    "nats"
    "nextcloud"
@@ -0,0 +1,140 @@
+{
+  config,
+  lib,
+  pkgs,
+  options,
+  utils,
+}:
+
+let
+  inherit (lib)
+    mkIf
+    mkEnableOption
+    mkOption
+    types
+    ;
+  cfg = config.services.prometheus.exporters.mqtt;
+  toConfigBoolean = x: if x then "True" else "False";
+  toConfigList = builtins.concatStringsSep ",";
+in
+{
+  # https://github.com/kpetremann/mqtt-exporter/tree/master?tab=readme-ov-file#configuration
+  port = 9000;
+  extraOpts = {
+    keepFullTopic = mkEnableOption "Keep entire topic instead of the first two elements only. Usecase: Shelly 3EM";
+    logLevel = mkOption {
+      type = types.enum [
+        "CRITICAL"
+        "ERROR"
+        "WARNING"
+        "INFO"
+        "DEBUG"
+      ];
+      default = "INFO";
+      example = "DEBUG";
+      description = "Logging level";
+    };
+    logMqttMessage = mkEnableOption "Log MQTT original message, only if `LOG_LEVEL` is set to DEBUG.";
+    mqttIgnoredTopics = mkOption {
+      type = types.listOf types.str;
+      default = [ ];
+      description = "Lists of topics to ignore. Accepts wildcards.";
+    };
+    mqttAddress = mkOption {
+      type = types.str;
+      default = "127.0.0.1";
+      description = "IP or hostname of MQTT broker.";
+    };
+    mqttPort = mkOption {
+      type = types.port;
+      default = 1883;
+      description = "TCP port of MQTT broker.";
+    };
+    mqttTopic = mkOption {
+      type = types.str;
+      default = "#";
+      description = "Topic path to subscribe to.";
+    };
+    mqttKeepAlive = mkOption {
+      type = types.int;
+      default = 60;
+      example = 30;
+      description = "Keep alive interval to maintain connection with MQTT broker.";
+    };
+    mqttUsername = mkOption {
+      type = types.nullOr types.str;
+      default = null;
+      example = "mqttexporter";
+      description = "Username which should be used to authenticate against the MQTT broker.";
+    };
+    mqttV5Protocol = mkEnableOption "Force to use MQTT protocol v5 instead of 3.1.1.";
+    mqttClientId = mkOption {
+      type = types.nullOr types.str;
+      default = null;
+      description = "Set client ID manually for MQTT connection";
+    };
+    mqttExposeClientId = mkEnableOption "Expose the client ID as a label in Prometheus metrics.";
+    prometheusPrefix = mkOption {
+      type = types.str;
+      default = "mqtt_";
+      description = "Prefix added to the metric name.";
+    };
+    topicLabel = mkOption {
+      type = types.str;
+      default = "topic";
+      description = "Define the Prometheus label for the topic.";
+    };
+    zigbee2MqttAvailability = mkEnableOption "Normalize sensor name for device availability metric added by Zigbee2MQTT.";
+    zwaveTopicPrefix = mkOption {
+      type = types.str;
+      default = "zwave/";
+      description = "MQTT topic used for Zwavejs2Mqtt messages.";
+    };
+    esphomeTopicPrefixes = mkOption {
+      type = types.listOf types.str;
+      default = [ ];
+      description = "MQTT topic used for ESPHome messages.";
+    };
+    hubitatTopicPrefixes = mkOption {
+      type = types.listOf types.str;
+      default = [ "hubitat/" ];
+      description = "MQTT topic used for Hubitat messages.";
+    };
+    environmentFile = mkOption {
+      type = types.nullOr types.path;
+      default = null;
+      example = [ "/run/secrets/mqtt-exporter" ];
+      description = ''
+        File to load as environment file. Useful for e.g. setting `MQTT_PASSWORD`
+        without putting any secrets into the Nix store.
+      '';
+    };
+  };
+  serviceOpts = {
+    environment = {
+      KEEP_FULL_TOPIC = toConfigBoolean cfg.keepFullTopic;
+      LOG_LEVEL = cfg.logLevel;
+      LOG_MQTT_MESSAGE = toConfigBoolean cfg.logMqttMessage;
+      MQTT_IGNORED_TOPIC = toConfigList cfg.mqttIgnoredTopics;
+      MQTT_ADDRESS = cfg.mqttAddress;
+      MQTT_PORT = toString cfg.mqttPort;
+      MQTT_TOPIC = cfg.mqttTopic;
+      MQTT_KEEPALIVE = toString cfg.mqttKeepAlive;
+      MQTT_USERNAME = cfg.mqttUsername;
+      MQTT_V5_PROTOCOL = toConfigBoolean cfg.mqttV5Protocol;
+      MQTT_CLIENT_ID = mkIf (cfg.mqttClientId != null) cfg.mqttClientId;
+      PROMETHEUS_ADDRESS = cfg.listenAddress;
+      PROMETHEUS_PORT = toString cfg.port;
+      PROMETHEUS_PREFIX = cfg.prometheusPrefix;
+      TOPIC_LABEL = cfg.topicLabel;
+      ZIGBEE2MQTT_AVAILABILITY = toConfigBoolean cfg.zigbee2MqttAvailability;
+      ZWAVE_TOPIC_PREFIX = cfg.zwaveTopicPrefix;
+      ESPHOME_TOPIC_PREFIXES = toConfigList cfg.esphomeTopicPrefixes;
+      HUBITAT_TOPIC_PREFIXES = toConfigList cfg.hubitatTopicPrefixes;
+    };
+    serviceConfig = {
+      EnvironmentFile = mkIf (cfg.environmentFile != null) cfg.environmentFile;
+      ExecStart = lib.getExe pkgs.mqtt-exporter;
+    };
+  };
+}
@@ -91,7 +91,7 @@ in

    ipv6 = lib.mkOption {
      type = lib.types.bool;
-      default = false;
+      default = true;
      description = "Whether to use IPv6.";
    };

@@ -300,7 +300,7 @@ in {

              capabilities = mkOption {
                type = types.listOf types.str;
-                default = ["HT40" "HT40-" "SHORT-GI-20" "SHORT-GI-40"];
+                default = ["HT40" "SHORT-GI-20" "SHORT-GI-40"];
                example = ["LDPC" "HT40+" "HT40-" "GF" "SHORT-GI-20" "SHORT-GI-40" "TX-STBC" "RX-STBC1"];
                description = ''
                  HT (High Throughput) capabilities given as a list of flags.
@@ -4,7 +4,7 @@ with lib;

 let

-  inherit (pkgs) cups-pk-helper cups-filters xdg-utils;
+  inherit (pkgs) cups-pk-helper libcupsfilters cups-filters xdg-utils;

  cfg = config.services.printing;
  cups = cfg.package;
@@ -35,7 +35,7 @@ let
  bindir = pkgs.buildEnv {
    name = "cups-progs";
    paths =
-      [ cups.out additionalBackends cups-filters pkgs.ghostscript ]
+      [ cups.out additionalBackends libcupsfilters cups-filters pkgs.ghostscript ]
      ++ cfg.drivers;
    pathsToLink = [ "/lib" "/share/cups" "/bin" ];
    postBuild = cfg.bindirCmds;
@@ -278,6 +278,8 @@ in
        '';
      };

+      browsed.package = lib.mkPackageOption pkgs "cups-browsed" {};
+
      browsedConf = mkOption {
        type = types.lines;
        default = "";
@@ -436,7 +438,7 @@ in

        path = [ cups ];

-        serviceConfig.ExecStart = "${cups-filters}/bin/cups-browsed";
+        serviceConfig.ExecStart = "${cfg.browsed.package}/bin/cups-browsed";

        restartTriggers = [ browsedFile ];
      };
@@ -41,6 +41,8 @@ in {
    '';
  };

+  options.services.cage.package = mkPackageOption pkgs "cage" { };
+
  config = mkIf cfg.enable {

    # The service is partially based off of the one provided in the
@@ -64,7 +66,7 @@ in {
      unitConfig.ConditionPathExists = "/dev/tty1";
      serviceConfig = {
        ExecStart = ''
-          ${pkgs.cage}/bin/cage \
+          ${cfg.package}/bin/cage \
            ${escapeShellArgs cfg.extraArguments} \
            -- ${cfg.program}
        '';
@@ -204,7 +204,6 @@ in
          };
          "/" = {
            # mixed frontend and backend requests, based on the request headers
-            recommendedProxySettings = true;
            extraConfig = ''
              set $proxpass "${ui}";
              if ($http_accept = "application/activity+json") {
@@ -221,6 +220,11 @@ in
              rewrite ^(.+)/+$ $1 permanent;

              proxy_pass $proxpass;
+              # Proxied `Host` header is required to validate ActivityPub HTTP signatures for incoming events.
+              # The other headers are optional, for the sake of better log data.
+              proxy_set_header X-Real-IP $remote_addr;
+              proxy_set_header Host $host;
+              proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            '';
          };
        };
@@ -135,6 +135,17 @@ in
      };

      environment.systemPackages = with pkgs; ([
+        # Teach nemo-desktop how to launch file browser.
+        # https://github.com/linuxmint/nemo/blob/6.4.0/src/nemo-desktop-application.c#L398
+        (writeTextFile {
+          name = "x-cinnamon-mimeapps";
+          destination = "/share/applications/x-cinnamon-mimeapps.list";
+          text = ''
+            [Default Applications]
+            inode/directory=nemo.desktop
+          '';
+        })
+
        desktop-file-utils

        # common-files
@@ -761,6 +761,7 @@ in
          lib.nameValuePair "zfs-sync-${pool}" {
            description = "Sync ZFS pool \"${pool}\"";
            wantedBy = [ "shutdown.target" ];
+            before = [ "final.target" ];
            unitConfig = {
              DefaultDependencies = false;
            };
@@ -563,6 +563,7 @@ in {
  lomiri-clock-app = runTest ./lomiri-clock-app.nix;
  lomiri-docviewer-app = runTest ./lomiri-docviewer-app.nix;
  lomiri-filemanager-app = runTest ./lomiri-filemanager-app.nix;
+  lomiri-mediaplayer-app = runTest ./lomiri-mediaplayer-app.nix;
  lomiri-gallery-app = runTest ./lomiri-gallery-app.nix;
  lomiri-system-settings = handleTest ./lomiri-system-settings.nix {};
  lorri = handleTest ./lorri/default.nix {};
@@ -1,6 +1,6 @@
 import ./make-test-python.nix ({ pkgs, lib, ... } : {
  name = "apparmor";
-  meta.maintainers = with lib.maintainers; [ julm ];
+  meta.maintainers = with lib.maintainers; [ julm grimmauld ];

  nodes.machine =
    { lib, pkgs, config, ... }:
@@ -0,0 +1,77 @@
+{ lib, ... }:
+let
+  ocrContent = "Video Test";
+  videoFile = "test.webm";
+in
+{
+  name = "lomiri-mediaplayer-app-standalone";
+  meta.maintainers = lib.teams.lomiri.members;
+
+  nodes.machine =
+    { config, pkgs, ... }:
+    {
+      imports = [ ./common/x11.nix ];
+
+      services.xserver.enable = true;
+
+      environment = {
+        # Setup video
+        etc."${videoFile}".source =
+          pkgs.runCommand videoFile
+            {
+              nativeBuildInputs = with pkgs; [
+                ffmpeg # produce video for OCR
+                (imagemagick.override { ghostscriptSupport = true; }) # produce OCR-able image
+              ];
+            }
+            ''
+              magick -size 400x400 canvas:white -pointsize 40 -fill black -annotate +100+100 '${ocrContent}' output.png
+              ffmpeg -re -loop 1 -i output.png -c:v libvpx -b:v 100K -t 120 $out -loglevel fatal
+            '';
+        systemPackages = with pkgs.lomiri; [
+          suru-icon-theme
+          lomiri-mediaplayer-app
+        ];
+        variables = {
+          UITK_ICON_THEME = "suru";
+        };
+      };
+
+      i18n.supportedLocales = [ "all" ];
+
+      fonts = {
+        packages = with pkgs; [
+          # Intended font & helps with OCR
+          ubuntu-classic
+        ];
+      };
+    };
+
+  enableOCR = true;
+
+  testScript = ''
+    machine.wait_for_x()
+
+    with subtest("lomiri mediaplayer launches"):
+        machine.succeed("lomiri-mediaplayer-app >&2 &")
+        machine.wait_for_text("Choose from")
+        machine.screenshot("lomiri-mediaplayer_open")
+
+    machine.succeed("pkill -f lomiri-mediaplayer-app")
+
+    with subtest("lomiri mediaplayer plays video"):
+        machine.succeed("lomiri-mediaplayer-app /etc/${videoFile} >&2 &")
+        machine.wait_for_text("${ocrContent}")
+        machine.screenshot("lomiri-mediaplayer_playback")
+
+    machine.succeed("pkill -f lomiri-mediaplayer-app")
+
+    with subtest("lomiri mediaplayer localisation works"):
+        # OCR struggles with finding identifying the translated window title, and lomiri-content-hub QML isn't translated
+        # Cause an error, and look for the error popup
+        machine.succeed("touch invalid.mp4")
+        machine.succeed("env LANG=de_DE.UTF-8 lomiri-mediaplayer-app invalid.mp4 >&2 &")
+        machine.wait_for_text("Fehler")
+        machine.screenshot("lomiri-mediaplayer_localised")
+  '';
+}
@@ -804,6 +804,38 @@ let
      '';
    };

+    mqtt = {
+      exporterConfig = {
+        enable = true;
+        environmentFile = pkgs.writeText "mqtt-exporter-envfile" ''
+          MQTT_PASSWORD=testpassword
+        '';
+      };
+      metricProvider = {
+        services.mosquitto = {
+          enable = true;
+          listeners = [{
+            users.exporter = {
+              acl = [ "read #" ];
+              passwordFile = pkgs.writeText "mosquitto-password" "testpassword";
+            };
+          }];
+        };
+        systemd.services.prometheus-mqtt-exporter ={
+          wants = [ "mosquitto.service" ];
+          after = [ "mosquitto.service" ];
+        };
+      };
+      exporterTest = ''
+        wait_for_unit("mosquitto.service")
+        wait_for_unit("prometheus-mqtt-exporter.service")
+        wait_for_open_port(9000)
+        succeed(
+          "curl -sSf http://localhost:9000/metrics | grep '^python_info'"
+        )
+      '';
+    };
+
    mysqld = {
      exporterConfig = {
        enable = true;
@@ -22,7 +22,7 @@
 , libcdio-paranoia, withCD ? true
 , keybinder3, withKeybinder ? false
 , libnotify, withLibnotify ? false
-, libsoup, withLibsoup ? false
+, libsoup_2_4, withLibsoup ? false
 , libgudev, withGudev ? false # experimental
 , libmtp, withMtp ? false # experimental
 , xfce, withXfce4ui ? false
@@ -73,7 +73,7 @@ mkDerivation rec {
  ++ lib.optional withLibnotify libnotify
  ++ lib.optional withLastfm liblastfmSF
  ++ lib.optional withGlyr glyr
-  ++ lib.optional withLibsoup libsoup
+  ++ lib.optional withLibsoup libsoup_2_4
  ++ lib.optional withMtp libmtp
  ++ lib.optional withXfce4ui xfce.libxfce4ui
  ++ lib.optional withTotemPlParser totem-pl-parser
@@ -20,8 +20,7 @@
  libappindicator-gtk3,
  libmodplug,
  librsvg,
-  libsoup,
-  webkitgtk_4_0,
+  libsoup_3,

  # optional features
  withDbusPython ? false,
@@ -89,8 +88,7 @@ python3.pkgs.buildPythonApplication {
      keybinder3
      libappindicator-gtk3
      libmodplug
-      libsoup
-      webkitgtk_4_0
+      libsoup_3
    ]
    ++ lib.optionals (withXineBackend) [ xine-lib ]
    ++ lib.optionals (withGstreamerBackend) (
@@ -1,32 +1,36 @@
-{ callPackage
-, timeshift-unwrapped
-, rsync
-, coreutils
-, mount
-, umount
-, psmisc
-, cron
-, btrfs-progs
-, grubPackage
+{
+  callPackage,
+  btrfs-progs,
+  coreutils,
+  cron,
+  grubPackage,
+  mount,
+  psmisc,
+  rsync,
+  timeshift-unwrapped,
+  umount,
 }:
 let
  timeshift-wrapper = callPackage ./wrapper.nix { };
 in
-(timeshift-wrapper timeshift-unwrapped ([
-  rsync
-  coreutils
-  mount
-  umount
-  psmisc
-  cron
+(timeshift-wrapper timeshift-unwrapped [
  btrfs-progs
+  coreutils
+  cron
  grubPackage
-])).overrideAttrs (oldAttrs: {
-  meta = oldAttrs.meta // {
-    description = oldAttrs.meta.description;
-    longDescription = oldAttrs.meta.longDescription + ''
-      This package comes with runtime dependencies of command utilities provided by rsync, coreutils, mount, umount, psmisc, cron and (optionally) btrfs.
-      If you want to use the commands provided by the system, override the propagatedBuildInputs or use timeshift-minimal instead
-    '';
-  };
-})
+  mount
+  psmisc
+  rsync
+  umount
+]).overrideAttrs
+  (oldAttrs: {
+    meta = oldAttrs.meta // {
+      description = oldAttrs.meta.description;
+      longDescription =
+        oldAttrs.meta.longDescription
+        + ''
+          This package comes with runtime dependencies of command utilities provided by rsync, coreutils, mount, umount, psmisc, cron and btrfs.
+          If you want to use the commands provided by the system, use timeshift-minimal instead.
+        '';
+    };
+  })
@@ -1,5 +1,6 @@
-{ callPackage
-, timeshift-unwrapped
+{
+  callPackage,
+  timeshift-unwrapped,
 }:
 let
  timeshift-wrapper = callPackage ./wrapper.nix { };
@@ -7,9 +8,11 @@ in
 (timeshift-wrapper timeshift-unwrapped [ ]).overrideAttrs (oldAttrs: {
  meta = oldAttrs.meta // {
    description = oldAttrs.meta.description + " (without runtime dependencies)";
-    longDescription = oldAttrs.meta.longDescription + ''
-      This package is a wrapped version of timeshift-unwrapped
-      without runtime dependencies of command utilities.
-    '';
+    longDescription =
+      oldAttrs.meta.longDescription
+      + ''
+        This package is a wrapped version of timeshift-unwrapped
+        without runtime dependencies of command utilities.
+      '';
  };
 })
@@ -1,29 +1,30 @@
-{ lib
-, stdenv
-, fetchFromGitHub
-, gettext
-, help2man
-, meson
-, ninja
-, pkg-config
-, vala
-, gtk3
-, json-glib
-, libgee
-, util-linux
-, vte
-, xapp
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  gettext,
+  help2man,
+  meson,
+  ninja,
+  pkg-config,
+  vala,
+  gtk3,
+  json-glib,
+  libgee,
+  util-linux,
+  vte,
+  xapp,
 }:

 stdenv.mkDerivation rec {
  pname = "timeshift";
-  version = "24.06.3";
+  version = "24.06.5";

  src = fetchFromGitHub {
    owner = "linuxmint";
    repo = "timeshift";
    rev = version;
-    hash = "sha256-npYiUSAPzr6g29ilQ1JELxqR1VbOR7TNMkdx37n92kk=";
+    hash = "sha256-2qNLgUZLMcfoemdLvvjdkR7Ln5loSKGqbd402y5Id8k=";
  };

  patches = [
@@ -65,6 +66,9 @@ stdenv.mkDerivation rec {
    homepage = "https://github.com/linuxmint/timeshift";
    license = licenses.gpl2Plus;
    platforms = platforms.linux;
-    maintainers = with maintainers; [ ShamrockLee bobby285271 ];
+    maintainers = with maintainers; [
+      ShamrockLee
+      bobby285271
+    ];
  };
 }
@@ -1,22 +1,22 @@
-{ stdenvNoCC
-, lib
-, wrapGAppsHook3
-, gdk-pixbuf
-, librsvg
-, xorg
-, shared-mime-info
+{
+  stdenvNoCC,
+  lib,
+  wrapGAppsHook3,
+  gdk-pixbuf,
+  librsvg,
+  xorg,
+  shared-mime-info,
 }:

-timeshift-unwrapped:
-runtimeDeps:
+timeshift-unwrapped: runtimeDeps:
 stdenvNoCC.mkDerivation {
  inherit (timeshift-unwrapped) pname version;

  dontUnpack = true;

  nativeBuildInputs = [
-    xorg.lndir
    wrapGAppsHook3
+    xorg.lndir
  ];

  installPhase = ''
@@ -34,7 +34,13 @@ stdenvNoCC.mkDerivation {
    )
    gappsWrapperArgs+=(
      # Thumbnailers
-      --prefix XDG_DATA_DIRS : "${lib.makeSearchPath "share" [ gdk-pixbuf librsvg shared-mime-info ]}"
+      --prefix XDG_DATA_DIRS : "${
+        lib.makeSearchPath "share" [
+          gdk-pixbuf
+          librsvg
+          shared-mime-info
+        ]
+      }"
      "''${makeWrapperArgs[@]}"
    )
    wrapProgram "$out/bin/timeshift" "''${makeWrapperArgs[@]}"
@@ -11,16 +11,16 @@ let
 in
 rustPlatform.buildRustPackage rec {
  pname = "electrs";
-  version = "0.10.6";
+  version = "0.10.7";

  src = fetchFromGitHub {
    owner = "romanz";
    repo = pname;
    rev = "v${version}";
-    hash = "sha256-yp9fKD7zH9Ne2+WQUupaxvUx39RWE8RdY4U6lHuDGSc=";
+    hash = "sha256-KDl+SV5U2aqsl3UMK8WWZiwkcqLpaRGmH/J8vBKTZcQ=";
  };

-  cargoHash = "sha256-J+6aek1PcW7G6f4h6cQcx5CyliryZeSxkSIQUX3yz6s=";
+  cargoHash = "sha256-vcn+94KklWlYQw4fbH8KxhBnovk0dJc8Hkj+jJ+SeB0=";

  # needed for librocksdb-sys
  nativeBuildInputs = [ rustPlatform.bindgenHook ];
@@ -7,13 +7,13 @@

 melpaBuild {
  pname = "isearch-prop";
-  version = "0-unstable-2022-12-30";
+  version = "0-unstable-2024-10-13";

  src = fetchFromGitHub {
    owner = "emacsmirror";
    repo = "isearch-prop";
-    rev = "5787fd57977c0d6c416ce71471c3b9da246dfb78";
-    hash = "sha256-Xli7TxBenl5cDMJv3Qz7ZELFpvJKStMploLpf9a+uoA=";
+    rev = "7b32697c16541036abadbbb4d65dd67a4f1d2812";
+    hash = "sha256-NmFkbxiRFAqi1TaOFfmAOgIs1QZMKXkJfMmXL9fsV14=";
  };

  passthru.updateScript = unstableGitUpdater { hardcodeZeroVersion = true; };
@@ -7,12 +7,12 @@
  nix-update-script,
 }:
 let
-  version = "0.7.1";
+  version = "0.7.3";
  src = fetchFromGitHub {
    owner = "Saghen";
    repo = "blink.cmp";
    rev = "refs/tags/v${version}";
-    hash = "sha256-IHl+XIldo2kculpbiOuLIJ6RJbFODiRlQU4x8hvE7pI=";
+    hash = "sha256-nxiODLKgGeXzN5sqkLWU0PcsuSSB1scSzTC5qyCxLCI=";
  };
  libExt = if stdenv.hostPlatform.isDarwin then "dylib" else "so";
  blink-fuzzy-lib = rustPlatform.buildRustPackage {
@@ -1037,6 +1037,18 @@ final: prev:
    meta.homepage = "https://github.com/yetone/avante.nvim/";
  };

+  aw-watcher-vim = buildVimPlugin {
+    pname = "aw-watcher-vim";
+    version = "2023-10-09";
+    src = fetchFromGitHub {
+      owner = "ActivityWatch";
+      repo = "aw-watcher-vim";
+      rev = "4ba86d05a940574000c33f280fd7f6eccc284331";
+      sha256 = "0kzpr2dgn80lcqbbf9ig6vx7azz6vbvadi31mxb0qyd91fyiidi3";
+    };
+    meta.homepage = "https://github.com/ActivityWatch/aw-watcher-vim/";
+  };
+
  awesome-vim-colorschemes = buildVimPlugin {
    pname = "awesome-vim-colorschemes";
    version = "2024-05-18";
@@ -258,6 +258,15 @@ in
    }
  );

+  aw-watcher-vim = super.aw-watcher-vim.overrideAttrs {
+    patches = [
+      (substituteAll {
+        src = ./patches/aw-watcher-vim/program_paths.patch;
+        curl = lib.getExe curl;
+      })
+    ];
+  };
+
  bamboo-nvim = super.bamboo-nvim.overrideAttrs {
    nvimSkipModule = [
      # Requires config table
@@ -0,0 +1,13 @@
+diff --git a/plugin/activitywatch.vim b/plugin/activitywatch.vim
+index 6986553..7462b02 100644
+--- a/plugin/activitywatch.vim
+++ b/plugin/activitywatch.vim
+@@ -29,7 +29,7 @@ let s:heartbeat_apiurl = printf('%s/heartbeat?pulsetime=30', s:bucket_apiurl)
+ let s:http_response_code = {}
+ 
+ function! HTTPPostJson(url, data)
+-    let l:req = ['curl', '-s', a:url,
+    let l:req = ['@curl@', '-s', a:url,
+         \ '-H', 'Content-Type: application/json',
+         \ '-X', 'POST',
+         \ '-d', json_encode(a:data),
@@ -2312,8 +2312,8 @@ let
        mktplcRef = {
          name = "haskell";
          publisher = "haskell";
-          version = "2.2.2";
-          hash = "sha256-zWdIVdz+kZg7KZQ7LeBCB4aB9wg8dUbkWfzGlM0Fq7Q=";
+          version = "2.4.4";
+          hash = "sha256-O7tfZ1bQmlMgZGoWuECjSno6DLCO0+CCteRhT6PjZBY=";
        };
        meta = {
          license = lib.licenses.mit;
@@ -2706,8 +2706,8 @@ let
        mktplcRef = {
          name = "nix-ide";
          publisher = "jnoortheen";
-          version = "0.3.1";
-          hash = "sha256-05oMDHvFM/dTXB6T3rcDK3EiNG2T0tBN9Au9b+Bk7rI=";
+          version = "0.3.5";
+          hash = "sha256-hiyFZVsZkxpc2Kh0zi3NGwA/FUbetAS9khWxYesxT4s=";
        };
        meta = {
          changelog = "https://marketplace.visualstudio.com/items/jnoortheen.nix-ide/changelog";
@@ -48,7 +48,7 @@ vscode-utils.buildVscodeMarketplaceExtension rec {
    + lib.optionalString pythonUseFixed ''
      # Patch `packages.json` so that nix's *python* is used as default value for `python.pythonPath`.
      substituteInPlace "./package.json" \
-        --replace "\"default\": \"python\"" "\"default\": \"${python3.interpreter}\""
+        --replace-fail "\"default\":\"python\"" "\"default\":\"${python3.interpreter}\""
    '';

  passthru.updateScript = writeScript "update" ''
@@ -11,7 +11,7 @@ vscode-utils.buildVscodeMarketplaceExtension {
    name = "tinymist";
    publisher = "myriad-dreamin";
    inherit (tinymist) version;
-    hash = "sha256-dHxeyqVe7cA/xK0RpprWRt5xPViyLHHal0pO6xhq4aE=";
+    hash = "sha256-vkVH+CBGSEWqSIDel+Y2O+B17LvLZbOjpHzbGAvEmWg=";
  };

  nativeBuildInputs = [
@@ -6,28 +6,28 @@
 }:

 let
-  version = "0.13.0";
+  version = "0.13.1";

  sources = {
    "x86_64-linux" = {
      arch = "linux-x64";
      url = "https://download.visualjj.com/visualjj-linux-x64-${version}.vsix";
-      hash = "sha256-mhfn/Lw/W1T2PaIglwrO/7VacDutT6Tgs133ePHL7W4=";
+      hash = "sha256-vKlsRxqtEvx4Gu6tkBjERYHl4Xx0K9xnYkh1SMDOYl0=";
    };
    "x86_64-darwin" = {
      arch = "darwin-x64";
      url = "https://download.visualjj.com/visualjj-darwin-x64-${version}.vsix";
-      hash = "sha256-feghMmcqzFM/Ttk8s4fp8et9Suw2kKLocptzwEcB2Sw=";
+      hash = "sha256-hzKZYPL/ZCRP2a4EaZGRXmzVpUNlGh4gOQt7NvGkn4M=";
    };
    "aarch64-linux" = {
      arch = "linux-arm64";
      url = "https://download.visualjj.com/visualjj-linux-arm64-${version}.vsix";
-      hash = "sha256-bfBj/A41FFMwMAEVw77nEDyk0+fYvi2Tg1Ufihxi9F8=";
+      hash = "sha256-nvVeme/qRG1ObSeisIBQHka5zG2f7Bqsjmva5EevXxw=";
    };
    "aarch64-darwin" = {
      arch = "darwin-arm64";
      url = "https://download.visualjj.com/visualjj-darwin-arm64-${version}.vsix";
-      hash = "sha256-xzf3WrH7BTiaX6NC2n9nLCKuBlFzRDYaSR73VGM7Ldc=";
+      hash = "sha256-mW6zJq0XvliCAWuslHdnlMX7bgO0mS9kH7CIYXjlaCE=";
    };
  };
 in
@@ -29,13 +29,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "dosbox-x";
-  version = "2024.10.01";
+  version = "2024.12.04";

  src = fetchFromGitHub {
    owner = "joncampbell123";
    repo = "dosbox-x";
    rev = "dosbox-x-v${finalAttrs.version}";
-    hash = "sha256-qfrEy7OndhJ/UnfFDCp7qlIhYWANkUBy2ejYVvRrG3k=";
+    hash = "sha256-wZCLwEInUfzuOCcUsz8W+Gi00lp4Nwc0QZjLF8/e9iM=";
  };

  # sips is unavailable in sandbox, replacing with imagemagick breaks build due to wrong Foundation propagation(?) so don't generate resolution variants
@@ -33,6 +33,6 @@ stdenv.mkDerivation rec {
    mainProgram = "winetricks";
    license = lib.licenses.lgpl21;
    homepage = "https://github.com/Winetricks/winetricks";
-    platforms = with lib.platforms; linux;
+    platforms = with lib.platforms; linux ++ darwin;
  };
 }
@@ -8,13 +8,13 @@

 python3Packages.buildPythonApplication rec {
  pname = "eddy";
-  version = "1.2.1";
+  version = "3.6";

  src = fetchFromGitHub {
    owner = "obdasystems";
    repo = pname;
-    rev = "v${version}";
-    sha256 = "12j77bbva5py9bd57c80cmjvf8vll40h19n81h16lvv2r2r7jynh";
+    rev = "refs/tags/v${version}";
+    sha256 = "sha256-vRmLUIqU0qfcnKzymBGb9gfM/uQiAcUHUnyz8iH/GrM=";
  };

  propagatedBuildInputs = [
@@ -27,7 +27,7 @@
 , librevenge
 , librsvg
 , libsigcxx
-, libsoup
+, libsoup_2_4
 , libvisio
 , libwpg
 , libXft
@@ -155,7 +155,7 @@ stdenv.mkDerivation rec {
    librevenge
    librsvg # for loading icons
    libsigcxx
-    libsoup
+    libsoup_2_4
    libvisio
    libwpg
    libXft
@@ -1,64 +0,0 @@
-{ lib, stdenv, fetchurl, makeDesktopItem
-, ghostscript, atk, gtk2, glib, fontconfig, freetype
-, libgnomecanvas
-, pango, libX11, xorgproto, zlib, poppler
-, autoconf, automake, libtool, pkg-config}:
-
-let
-  isGdkQuartzBackend = (gtk2.gdktarget == "quartz");
-in
-
-stdenv.mkDerivation rec {
-  version = "0.4.8.2016";
-  pname = "xournal";
-  src = fetchurl {
-    url = "mirror://sourceforge/xournal/xournal-${version}.tar.gz";
-    sha256 = "09i88v3wacmx7f96dmq0l3afpyv95lh6jrx16xzm0jd1szdrhn5j";
-  };
-
-  buildInputs = [
-    ghostscript atk gtk2 glib fontconfig freetype
-    libgnomecanvas
-    pango libX11 xorgproto zlib poppler
-  ];
-
-  nativeBuildInputs = [ autoconf automake libtool pkg-config ];
-
-  NIX_LDFLAGS = "-lz"
-    + lib.optionalString (!isGdkQuartzBackend) " -lX11";
-
-  desktopItem = makeDesktopItem {
-    name = "xournal-${version}";
-    exec = "xournal";
-    icon = "xournal";
-    desktopName = "Xournal";
-    comment = meta.description;
-    categories = [ "Office" "Graphics" ];
-    mimeTypes = [ "application/pdf" "application/x-xoj" ];
-    genericName = "PDF Editor";
-  };
-
-  postInstall=''
-      mkdir --parents $out/share/mime/packages
-      cat << EOF > $out/share/mime/packages/xournal.xml
-      <mime-info xmlns='http://www.freedesktop.org/standards/shared-mime-info'>
-         <mime-type type="application/x-xoj">
-          <comment>Xournal Document</comment>
-          <glob pattern="*.xoj"/>
-         </mime-type>
-      </mime-info>
-      EOF
-      cp --recursive ${desktopItem}/share/applications $out/share
-      mkdir --parents $out/share/icons
-      cp $out/share/xournal/pixmaps/xournal.png $out/share/icons
-  '';
-
-  meta = with lib; {
-    homepage = "https://xournal.sourceforge.net/";
-    description = "Note-taking application (supposes stylus)";
-    maintainers = [ maintainers.guibert ];
-    license = licenses.gpl2;
-    platforms = with platforms; linux ++ darwin;
-    mainProgram = "xournal";
-  };
-}
@@ -30,13 +30,13 @@

 stdenv.mkDerivation rec {
  pname = "xournalpp";
-  version = "1.2.4";
+  version = "1.2.5";

  src = fetchFromGitHub {
    owner = "xournalpp";
    repo = "xournalpp";
    rev = "v${version}";
-    hash = "sha256-72e47fVP0c8KioRHUqyEQIUgrLm+xMPE2Mm6+2v7pZk=";
+    hash = "sha256-Hm3NDVELOnwjg6NiV5VBbt/15slHAgOVZLTV3zBMkLI=";
  };

  postPatch = ''
@@ -17,13 +17,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
  pname = "gpxsee";
-  version = "13.26";
+  version = "13.32";

  src = fetchFromGitHub {
    owner = "tumic0";
    repo = "GPXSee";
    rev = finalAttrs.version;
-    hash = "sha256-EIeUcSHJXpd1/90fAPrP9F/DVyZhkcZk8MJd9VO1D70=";
+    hash = "sha256-wz5cYZe7OHfIgoHrYRj0DKNFjYjb+CGlLnDItRNu+bk=";
  };

  buildInputs = [
@@ -84,6 +84,8 @@ mkChromiumDerivation (base: rec {
    homepage = if ungoogled
      then "https://github.com/ungoogled-software/ungoogled-chromium"
      else "https://www.chromium.org/";
+    # Maintainer pings for this derivation are highly unreliable.
+    # If you add yourself as maintainer here, please also add yourself as CODEOWNER.
    maintainers = with lib.maintainers; if ungoogled
      then [ networkexception emilylange ]
      else [ networkexception emilylange ];
@@ -663,12 +663,7 @@ let
    } // lib.optionalAttrs (!isElectron) {
      inherit chromiumDeps npmDeps;
    };
-  }
-  # overwrite `version` with the exact same `version` from the same source,
-  # except it internally points to `upstream-info.nix` for
-  # `builtins.unsafeGetAttrPos`, which is used by ofborg to decide
-  # which maintainers need to be pinged.
-  // builtins.removeAttrs upstream-info (builtins.filter (e: e != "version") (builtins.attrNames upstream-info));
+  };

 # Remove some extraAttrs we supplied to the base attributes already.
 in stdenv.mkDerivation (base // removeAttrs extraAttrs [
@@ -178,9 +178,3 @@ in stdenv.mkDerivation {
    inherit sandboxExecutableName;
  };
 }
-# the following is a complicated and long-winded variant of
-# `inherit (chromium.browser) version`, with the added benefit
-# that it keeps the pointer to upstream-info.nix for
-# builtins.unsafeGetAttrPos, which is what ofborg uses to
-# decide which maintainers need to be pinged.
-// builtins.removeAttrs chromium.browser (builtins.filter (e: e != "version") (builtins.attrNames chromium.browser))
@@ -766,7 +766,7 @@
    }
  },
  "ungoogled-chromium": {
-    "version": "131.0.6778.85",
+    "version": "131.0.6778.108",
    "deps": {
      "depot_tools": {
        "rev": "20b9bdcace7ed561d6a75728c85373503473cb6b",
@@ -777,16 +777,16 @@
        "hash": "sha256-a8yCdBsl0nBMPS+pCLwrkAvQNP/THx/z/GySyOgx4Jk="
      },
      "ungoogled-patches": {
-        "rev": "131.0.6778.85-1",
-        "hash": "sha256-mcSshjdfUEH4ur4z+0P0oWCjlV8EhFMc+7rdfIIPASI="
+        "rev": "131.0.6778.108-1",
+        "hash": "sha256-xFtxgZRbtG8qxvTyt++wa69dQvr61K29mTubkxoI1Y8="
      },
      "npmHash": "sha256-b1l8SwjAfoColoa3zhTMPEF/rRuxzT3ATHE77rWU5EA="
    },
    "DEPS": {
      "src": {
        "url": "https://chromium.googlesource.com/chromium/src.git",
-        "rev": "3d81e41b6f3ac8bcae63b32e8145c9eb0cd60a2d",
-        "hash": "sha256-fREToEHVbTD0IVGx/sn7csSju4BYajWZ+LDCiKWV4cI=",
+        "rev": "3b014839fbc4fb688b2f5af512d6ce312ad208b1",
+        "hash": "sha256-ypzu3LveMFcOFm7+JlaERjzs3SK/n9+sfm5wOKB8/zw=",
        "recompress": true
      },
      "src/third_party/clang-format/script": {
@@ -886,8 +886,8 @@
      },
      "src/third_party/dawn": {
        "url": "https://dawn.googlesource.com/dawn.git",
-        "rev": "7e742cac42c29a14ab7f54b134b2f17592711267",
-        "hash": "sha256-K2gwKNwonzCIu4hnlYuOaYyKaRV11hwDzF4oykiKsl0="
+        "rev": "740d2502dbbd719a76c5a8d3fb4dac1b5363f42e",
+        "hash": "sha256-R41YVv4uWCU6SsACXPRppeCDguTs+/NVJckvMGGTgJE="
      },
      "src/third_party/dawn/third_party/glfw": {
        "url": "https://chromium.googlesource.com/external/github.com/glfw/glfw",
@@ -1366,8 +1366,8 @@
      },
      "src/third_party/skia": {
        "url": "https://skia.googlesource.com/skia.git",
-        "rev": "94631d9b9a10697325589e1642af63a0137cac94",
-        "hash": "sha256-SKKLOxjimQWt8W+Q3wlCJaUC/lxw6EIZDFBuVQKmnVY="
+        "rev": "f14f6b1ab7cf544c0190074488d17821281cfa4d",
+        "hash": "sha256-0p57otDuIShl6MngYs22XA1QYxptDVa3vCwJsH59H34="
      },
      "src/third_party/smhasher/src": {
        "url": "https://chromium.googlesource.com/external/smhasher.git",
@@ -1491,8 +1491,8 @@
      },
      "src/third_party/webrtc": {
        "url": "https://webrtc.googlesource.com/src.git",
-        "rev": "8445abdf8069cadcbd134369b70d0ebd436ef477",
-        "hash": "sha256-EitEjXNtm0gB9wtAwIYHBHkU7paHg5zvsTz171hRmK4="
+        "rev": "79aff54b0fa9238ce3518dd9eaf9610cd6f22e82",
+        "hash": "sha256-xkMnUduSG88EWiwq6PITN0KgAKjFd4QOis3dgxedK30="
      },
      "src/third_party/wuffs/src": {
        "url": "https://skia.googlesource.com/external/github.com/google/wuffs-mirror-release-c.git",
@@ -1526,8 +1526,8 @@
      },
      "src/v8": {
        "url": "https://chromium.googlesource.com/v8/v8.git",
-        "rev": "bd2671b973062afc614b852ec190524b80aaef8a",
-        "hash": "sha256-uq0CE7Chqzy2d+iifC3hV9RTnDVinpwjl1pOzyNGbSo="
+        "rev": "e38771cb283b9689683c5ac0b5831dd89f8ec690",
+        "hash": "sha256-csSDnepYxil0R3PD/LVxW7JBcasOKG4l6q6vj8zHV/I="
      }
    }
  }
@@ -29,26 +29,31 @@ const flush_to_file_proxy = {
  },
 }
 const lockfile = new Proxy(structuredClone(lockfile_initial), flush_to_file_proxy)
-
+const ungoogled_rev = argv['ungoogled-chromium-rev']

 for (const attr_path of Object.keys(lockfile)) {
-  if (!argv[attr_path]) {
+  const ungoogled = attr_path === 'ungoogled-chromium'
+
+  if (!argv[attr_path] && !(ungoogled && ungoogled_rev)) {
    console.log(`[${attr_path}] Skipping ${attr_path}. Pass --${attr_path} as argument to update.`)
    continue
  }

-  const ungoogled = attr_path === 'ungoogled-chromium'
  const version_nixpkgs = !ungoogled ? lockfile[attr_path].version : lockfile[attr_path].deps['ungoogled-patches'].rev
-  const version_upstream = !ungoogled ? await get_latest_chromium_release() : await get_latest_ungoogled_release()
+  const version_upstream = !ungoogled ? await get_latest_chromium_release() :
+    ungoogled_rev ?? await get_latest_ungoogled_release()

  console.log(`[${attr_path}] ${chalk.red(version_nixpkgs)} (nixpkgs)`)
  console.log(`[${attr_path}] ${chalk.green(version_upstream)} (upstream)`)

-  if (version_greater_than(version_upstream, version_nixpkgs)) {
+  if (ungoogled_rev || version_greater_than(version_upstream, version_nixpkgs)) {
    console.log(`[${attr_path}] ${chalk.green(version_upstream)} from upstream is newer than our ${chalk.red(version_nixpkgs)}...`)

-    // unconditionally remove ungoogled-chromium's epoch/sub-version (e.g. 130.0.6723.116-1 -> 130.0.6723.116)
-    const version_chromium = version_upstream.split('-')[0]
+    let ungoogled_patches = ungoogled ? await fetch_ungoogled(version_upstream) : undefined
+
+    // For ungoogled-chromium we need to remove the patch revision (e.g. 130.0.6723.116-1 -> 130.0.6723.116)
+    // by just using the chromium_version.txt content from the patches checkout (to also work with commit revs).
+    const version_chromium = ungoogled_patches?.chromium_version ?? version_upstream

    const chromium_rev = await chromium_resolve_tag_to_rev(version_chromium)

@@ -58,7 +63,10 @@ for (const attr_path of Object.keys(lockfile)) {
      deps: {
        depot_tools: {},
        gn: {},
-        'ungoogled-patches': ungoogled ? await fetch_ungoogled(version_upstream) : undefined,
+        'ungoogled-patches': !ungoogled ? undefined : {
+          rev: ungoogled_patches.rev,
+          hash: ungoogled_patches.hash,
+        },
        npmHash: dummy_hash,
      },
      DEPS: {},
@@ -187,13 +195,19 @@ async function fetch_ungoogled(rev) {
  const expr = (hash) => [`(import ./. {}).fetchFromGitHub { owner = "ungoogled-software"; repo = "ungoogled-chromium"; rev = "${rev}"; hash = "${hash}"; }`]
  const hash = await prefetch_FOD('--expr', expr(''))

-  const checkout = await $nixpkgs`nix-build  --expr ${expr(hash)}`
+  const checkout = await $nixpkgs`nix-build --expr ${expr(hash)}`
+  const checkout_path = checkout.stdout.trim()

-  await fs.copy(`${checkout.stdout.trim()}/flags.gn`, './ungoogled-flags.toml')
+  await fs.copy(path.join(checkout_path, 'flags.gn'), './ungoogled-flags.toml')
+
+  const chromium_version = (await fs.readFile(path.join(checkout_path, 'chromium_version.txt'))).toString().trim()
+
+  console.log(`[ungoogled-chromium] ${chalk.green(rev)} patch revision resolves to chromium version ${chalk.green(chromium_version)}`)

  return {
    rev,
    hash,
+    chromium_version,
  }
 }

@@ -20,7 +20,7 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "palemoon-bin";
-  version = "33.4.1";
+  version = "33.5.0";

  src = finalAttrs.passthru.sources."gtk${if withGTK3 then "3" else "2"}";

@@ -158,11 +158,11 @@ stdenv.mkDerivation (finalAttrs: {
    in {
      gtk3 = fetchzip {
        urls = urlRegionVariants "gtk3";
-        hash = "sha256-pjOzU8atFNzYujxxoVihn0Cvq4Xvh7U2auSznE29Wpc=";
+        hash = "sha256-TlmDsZKHolTS+y+1BymyY49+AvqUv8zmUXCGNHCRPL0=";
      };
      gtk2 = fetchzip {
        urls = urlRegionVariants "gtk2";
-        hash = "sha256-ikgO0vVTySw3I6gdSu5k2e35xZ95bJY4f18Fjh+c0rA=";
+        hash = "sha256-f6vLHbpmvVfkjZr7x0DiCFoGGvfxHfFZ3KTagq2Mwp4=";
      };
    };

@@ -1,6 +1,6 @@
 { lib, stdenv, fetchgit
 , pkg-config, wrapGAppsHook3
-, glib, gcr, glib-networking, gsettings-desktop-schemas, gtk, libsoup, webkitgtk_4_0
+, glib, gcr, glib-networking, gsettings-desktop-schemas, gtk, libsoup_2_4, webkitgtk_4_0
 , xorg, dmenu, findutils, gnused, coreutils, gst_all_1
 , patches ? null
 }:
@@ -23,7 +23,7 @@ stdenv.mkDerivation rec {
    glib-networking
    gsettings-desktop-schemas
    gtk
-    libsoup
+    libsoup_2_4
    webkitgtk_4_0
  ] ++ (with gst_all_1; [
    # Audio & video support for webkitgtk WebView
@@ -63,13 +63,13 @@
    "vendorHash": "sha256-OAd8SeTqTrH0kMoM2LsK3vM2PI23b3gl57FaJYM9hM0="
  },
  "archive": {
-    "hash": "sha256-Xm9BT8O18aTIa1h166dElYaTq4PlC4u7TgFgCfcC6jI=",
+    "hash": "sha256-q2Ougw8U6kapeGWBLhsvrRMW8/kGhE0eTV35kPHrN5g=",
    "homepage": "https://registry.terraform.io/providers/hashicorp/archive",
    "owner": "hashicorp",
    "repo": "terraform-provider-archive",
-    "rev": "v2.6.0",
+    "rev": "v2.7.0",
    "spdx": "MPL-2.0",
-    "vendorHash": "sha256-b8yGtOUZezGRgURXigv8ySaxxHN/vCCDPgoDC5EBlok="
+    "vendorHash": "sha256-51bLi7cqy7iUt9Aocog7OOKYWSdGbQEoZzasUpDuHu4="
  },
  "argocd": {
    "hash": "sha256-3a/g1SbgeMWFMNTY/sYrItyE1rRimdNro8nu9wPTf6M=",
@@ -552,13 +552,13 @@
    "vendorHash": "sha256-TZxiDRVZPfg3jSflZsSbVaVcfUNqJ2U+ymHIm01pgkI="
  },
  "hcloud": {
-    "hash": "sha256-td1R2Xeo1QfsNJOwE7cCuzF5OjW4XUQJOVd0LPAXfuE=",
+    "hash": "sha256-nkp4XTFRBSxqRAURL0O4H/l7oDF/OEXmew0MkmyQryc=",
    "homepage": "https://registry.terraform.io/providers/hetznercloud/hcloud",
    "owner": "hetznercloud",
    "repo": "terraform-provider-hcloud",
-    "rev": "v1.48.1",
+    "rev": "v1.49.1",
    "spdx": "MPL-2.0",
-    "vendorHash": "sha256-t9nXq30jRSlx9gMR+s8irDVdSE5tg9ZvMp47HZwEm7w="
+    "vendorHash": "sha256-TFH5tHOTRNPUMGYeYQ1ZbM6FjcojYnkB2NwnQOacTvg="
  },
  "helm": {
    "hash": "sha256-8cYhbxbjTfloDd3cLYNPv98TzeC0XVrb4DQ2ScZDYvI=",
@@ -651,13 +651,13 @@
    "vendorHash": null
  },
  "incus": {
-    "hash": "sha256-VHoEUcFwsERC3EKfobTEoWOxuiOEBzEaWXL+mzlTe44=",
+    "hash": "sha256-Dva5bFyJpxifsQl62xnjvqEQ5SknUmCLfGX4fFx5FAE=",
    "homepage": "https://registry.terraform.io/providers/lxc/incus",
    "owner": "lxc",
    "repo": "terraform-provider-incus",
-    "rev": "v0.1.4",
+    "rev": "v0.2.0",
    "spdx": "MPL-2.0",
-    "vendorHash": "sha256-7MQi9gJU0RAm9jTiY/YjkEU5QsxSX2lbUC7qvT20mes="
+    "vendorHash": "sha256-xr54yCVGOJbj0612wiljUkx1wEOSuXB1qrGbF/vCwN8="
  },
  "infoblox": {
    "hash": "sha256-x5WGCYvsXby2O8J15fvoRNsYnBCaYdjx6LuDkYAfIlU=",
@@ -1174,13 +1174,13 @@
    "vendorHash": "sha256-YFV+qXD78eajSeagJPgPu+qIktx1Vh/ZT0fUPOBuZyo="
  },
  "spacelift": {
-    "hash": "sha256-HJ+QlbmMvn45l9KjmVzoK/jETIosOSlcLtw4B1kdEIo=",
+    "hash": "sha256-RWrhVeXPEgFYFGh34vFargTrZH+3CxY36+i0lmFSjXg=",
    "homepage": "https://registry.terraform.io/providers/spacelift-io/spacelift",
    "owner": "spacelift-io",
    "repo": "terraform-provider-spacelift",
-    "rev": "v1.16.1",
+    "rev": "v1.19.0",
    "spdx": "MIT",
-    "vendorHash": "sha256-m/J390su2nUpYMXrrYcOfKSjZb5Y23+g24rroLRss4U="
+    "vendorHash": "sha256-c3R/7k7y7XS2Qli00nSj7gh/3Mj88PY4WybBTq/+pPs="
  },
  "spotinst": {
    "hash": "sha256-Yq52eCxT+XWoTONcLTDlIpy/jnU76JajsoqKYXFK8AM=",
@@ -3,16 +3,16 @@

 buildGoModule rec {
  pname = "discordo";
-  version = "0-unstable-2024-10-13";
+  version = "0-unstable-2024-11-30";

  src = fetchFromGitHub {
    owner = "ayn2op";
    repo = pname;
-    rev = "26b77d9385daa2dc056930fa302a3c06595680ba";
-    hash = "sha256-zXqYj8IBDVeDKjm0m8CYEX+tmHLpY2u7A4g38IiDNZk=";
+    rev = "3286ebecaab3c05ddbab9e6b502a750d07cea5aa";
+    hash = "sha256-DaD6Rv/dzky3gjjqtjObTFZp7EJ8+UK6CoFpqZ/HO9U=";
  };

-  vendorHash = "sha256-68NGcdyKuabSdW6CKAJUaJ0k2dpO0bm3OfNQ7qEVcqk=";
+  vendorHash = "sha256-66Y5hmEEQUBsSfYaj6UzCsFhDkwCDs6y2WOsnYby1gE=";

  CGO_ENABLED = 0;

@@ -3,7 +3,7 @@
 , vala, cmake, ninja, wrapGAppsHook4, pkg-config, gettext
 , gobject-introspection, glib, gdk-pixbuf, gtk4, glib-networking
 , libadwaita
-, libnotify, libsoup, libgee
+, libnotify, libsoup_2_4, libgee
 , libsignal-protocol-c
 , libgcrypt
 , sqlite
@@ -62,7 +62,7 @@ stdenv.mkDerivation (finalAttrs: {
    libnotify
    gpgme
    libgcrypt
-    libsoup
+    libsoup_2_4
    pcre2
    icu
    libsignal-protocol-c
@@ -90,7 +90,7 @@ stdenv.mkDerivation (finalAttrs: {
    "-DXGETTEXT_EXECUTABLE=${lib.getBin buildPackages.gettext}/bin/xgettext"
    "-DMSGFMT_EXECUTABLE=${lib.getBin buildPackages.gettext}/bin/msgfmt"
    "-DGLIB_COMPILE_RESOURCES_EXECUTABLE=${lib.getDev buildPackages.glib}/bin/glib-compile-resources"
-    "-DSOUP_VERSION=${lib.versions.major libsoup.version}"
+    "-DSOUP_VERSION=${lib.versions.major libsoup_2_4.version}"
  ];

  # Undefined symbols for architecture arm64: "_gpg_strerror"
@@ -10,16 +10,16 @@ let
    if stdenv.hostPlatform.isLinux then
      {
        stable = "0.0.76";
-        ptb = "0.0.118";
-        canary = "0.0.528";
-        development = "0.0.50";
+        ptb = "0.0.121";
+        canary = "0.0.535";
+        development = "0.0.53";
      }
    else
      {
-        stable = "0.0.327";
-        ptb = "0.0.148";
-        canary = "0.0.639";
-        development = "0.0.65";
+        stable = "0.0.328";
+        ptb = "0.0.151";
+        canary = "0.0.647";
+        development = "0.0.67";
      };
  version = versions.${branch};
  srcs = rec {
@@ -30,33 +30,33 @@ let
      };
      ptb = fetchurl {
        url = "https://ptb.dl2.discordapp.net/apps/linux/${version}/discord-ptb-${version}.tar.gz";
-        hash = "sha256-msheT6PXTkIq7EwowYwL7g0kgOdLBZHeI5w2kijJUtw=";
+        hash = "sha256-Zaf6Pg6xeSyiIFJMlT+VkE/sXJULSqGzGHmK5MpBuhg=";
      };
      canary = fetchurl {
        url = "https://canary.dl2.discordapp.net/apps/linux/${version}/discord-canary-${version}.tar.gz";
-        hash = "sha256-ajQHWSpjpuadFlT5WVXsSZf5Ng8ta4SyGbZp7TTb+8Q=";
+        hash = "sha256-YUuqkhb04nTTdL6W6VB0ampp3qEi0Gj5iz3lCt7AfMA=";
      };
      development = fetchurl {
        url = "https://development.dl2.discordapp.net/apps/linux/${version}/discord-development-${version}.tar.gz";
-        hash = "sha256-Ygwneo9GY1iVKBl3y6jSj81sexUsSY2J7i/DKxmJJyA=";
+        hash = "sha256-4FxdZsVTQTr5yzuzV6IZYZ6qk7sa9WZ27zCtVA1/uOg=";
      };
    };
    x86_64-darwin = {
      stable = fetchurl {
        url = "https://stable.dl2.discordapp.net/apps/osx/${version}/Discord.dmg";
-        hash = "sha256-5XzjJv2IebVMVml/e+VTVKrlbHTCj+t0lYsq1CwvLi0=";
+        hash = "sha256-yYQHoBv3Cco07WQhS8+BruV1gjGZti+bTS+jlRg0u14=";
      };
      ptb = fetchurl {
        url = "https://ptb.dl2.discordapp.net/apps/osx/${version}/DiscordPTB.dmg";
-        hash = "sha256-YW6wgiplt+ue59i5+2Ap5tVAEhO1xgeP8jVOffkSWj4=";
+        hash = "sha256-R8R3r2i/+ru+82OBGBmF+Kn502RK/64VwtbdRVSwj0g=";
      };
      canary = fetchurl {
        url = "https://canary.dl2.discordapp.net/apps/osx/${version}/DiscordCanary.dmg";
-        hash = "sha256-C+2Cr8D2ZqfdRp0m996p8HvOjkPzN82ywgbx2KMBqAE=";
+        hash = "sha256-GbR6XLK+2jBHGdvWeZv3HXbCr4mylBrdY/3rCFCkeCY=";
      };
      development = fetchurl {
        url = "https://development.dl2.discordapp.net/apps/osx/${version}/DiscordDevelopment.dmg";
-        hash = "sha256-IckTw2wKTwGMGvQAOYG85yU1w9E6PdWA1G0f2BaXJ1Q=";
+        hash = "sha256-nyOQhSjlARvIjFc3uDi7IFtKxxIpO/V6M1eIg56dMdU=";
      };
    };
    aarch64-darwin = x86_64-darwin;
@@ -1,6 +1,6 @@
 { lib, stdenv, requireFile, makeWrapper, autoPatchelfHook, wrapGAppsHook3, which, more
 , file, atk, alsa-lib, cairo, fontconfig, gdk-pixbuf, glib, webkitgtk_4_0, gtk2-x11, gtk3
-, heimdal, krb5, libsoup, libvorbis, speex, openssl, zlib, xorg, pango, gtk2
+, heimdal, krb5, libsoup_2_4, libvorbis, speex, openssl, zlib, xorg, pango, gtk2
 , gnome2, mesa, nss, nspr, gtk_engines, freetype, dconf, libpng12, libxml2
 , libjpeg, libredirect, tzdata, cacert, systemd, libcxx, symlinkJoin
 , libpulseaudio, pcsclite, glib-networking, llvmPackages_12, opencv4
@@ -103,7 +103,7 @@ stdenv.mkDerivation rec {
    libpng12
    libpulseaudio
    libsecret
-    libsoup
+    libsoup_2_4
    libvorbis
    libxml2
    llvmPackages_12.libunwind
@@ -6,7 +6,7 @@
 , libofx
 , intltool
 , wrapGAppsHook3
-, libsoup
+, libsoup_2_4
 , adwaita-icon-theme
 }:

@@ -24,7 +24,7 @@ stdenv.mkDerivation rec {
    gtk
    libgsf
    libofx
-    libsoup
+    libsoup_2_4
    adwaita-icon-theme
  ];

@@ -62,6 +62,7 @@ let
      url = "https://github.com/Reactive-Extensions/RxCpp/archive/v${rxcppVersion}.tar.gz";
      sha256 = "sha256-UOc5WrG8KgAA3xJsaSCjbdPE7gSnFJay9MEK31DWUXg=";
    };
+
    gtest = fetchurl {
      url = "https://github.com/google/googletest/archive/release-${gtestVersion}.tar.gz";
      sha256 = "sha256-WKb0J3yivIVlIis7vVihd2CenEiOinJkk1m6UUUNt9g=";
@@ -69,7 +70,7 @@ let
  };
 in

-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
  inherit pname version;

  outputs = [ "out" "dev" "doc" ];
@@ -132,32 +133,39 @@ stdenv.mkDerivation rec {
    ++ lib.optional opencvSupport opencv;

  cmakeFlags = let
-    enableIf = cond: if cond then "ON" else "OFF";
    excludeTestsRegex = lib.concatStringsSep "|" [
-      # sporadic segfault
+      # segfault
+      "SerializationXML"
      "TrainedModelSerialization"
      # broken by openblas 0.3.21
      "mathematics_lapack"
+      # fails on aarch64
+      "LinearTimeMMD"
+      "QuadraticTimeMMD"
+      "SGVectorTest"
+      "Statistics"
+      # hangs on aarch64
+      "PRange"
      # these take too long on CI
      "evaluation_cross_validation"
      "modelselection_combined_kernel"
      "modelselection_grid_search"
    ];
  in [
-    "-DBUILD_META_EXAMPLES=ON"
-    "-DCMAKE_DISABLE_FIND_PACKAGE_ARPACK=ON"
-    "-DCMAKE_DISABLE_FIND_PACKAGE_ARPREC=ON"
-    "-DCMAKE_DISABLE_FIND_PACKAGE_CPLEX=ON"
-    "-DCMAKE_DISABLE_FIND_PACKAGE_Mosek=ON"
-    "-DCMAKE_DISABLE_FIND_PACKAGE_TFLogger=ON"
-    "-DCMAKE_DISABLE_FIND_PACKAGE_ViennaCL=ON"
-    "-DCMAKE_CTEST_ARGUMENTS=--exclude-regex;'${excludeTestsRegex}'"
-    "-DENABLE_TESTING=${enableIf doCheck}"
-    "-DDISABLE_META_INTEGRATION_TESTS=ON"
-    "-DTRAVIS_DISABLE_META_CPP=ON"
-    "-DINTERFACE_PYTHON=${enableIf pythonSupport}"
-    "-DOpenCV=${enableIf opencvSupport}"
-    "-DUSE_SVMLIGHT=${enableIf withSvmLight}"
+    (lib.cmakeBool "BUILD_META_EXAMPLES" true)
+    (lib.cmakeBool "CMAKE_DISABLE_FIND_PACKAGE_ARPACK" true)
+    (lib.cmakeBool "CMAKE_DISABLE_FIND_PACKAGE_ARPREC" true)
+    (lib.cmakeBool "CMAKE_DISABLE_FIND_PACKAGE_CPLEX" true)
+    (lib.cmakeBool "CMAKE_DISABLE_FIND_PACKAGE_Mosek" true)
+    (lib.cmakeBool "CMAKE_DISABLE_FIND_PACKAGE_TFLogger" true)
+    (lib.cmakeBool "CMAKE_DISABLE_FIND_PACKAGE_ViennaCL" true)
+    (lib.cmakeFeature "CMAKE_CTEST_ARGUMENTS" "--exclude-regex;'${excludeTestsRegex}'")
+    (lib.cmakeBool "ENABLE_TESTING" finalAttrs.doCheck)
+    (lib.cmakeBool "DISABLE_META_INTEGRATION_TESTS" true)
+    (lib.cmakeBool "TRAVIS_DISABLE_META_CPP" true)
+    (lib.cmakeBool "INTERFACE_PYTHON" pythonSupport)
+    (lib.cmakeBool "OpenCV" opencvSupport)
+    (lib.cmakeBool "USE_SVMLIGHT" withSvmLight)
  ];

  CXXFLAGS = "-faligned-new";
@@ -196,7 +204,7 @@ stdenv.mkDerivation rec {
  postFixup = ''
    # CMake incorrectly calculates library path from dev prefix
    substituteInPlace $dev/lib/cmake/shogun/ShogunTargets-release.cmake \
-      --replace "\''${_IMPORT_PREFIX}/lib/" "$out/lib/"
+      --replace-fail "\''${_IMPORT_PREFIX}/lib/" "$out/lib/"
  '';

  meta = with lib; {
@@ -205,4 +213,4 @@ stdenv.mkDerivation rec {
    license = if withSvmLight then licenses.unfree else licenses.gpl3Plus;
    maintainers = with maintainers; [ edwtjo smancill ];
  };
-}
+})
@@ -1,30 +1,34 @@
-{ lib
-, stdenv
-, buildGoModule
-, fetchFromGitHub
-, installShellFiles
-, qemu
-, sigtool
-, makeWrapper
-, nix-update-script
-, apple-sdk_15
+{
+  lib,
+  stdenv,
+  buildGoModule,
+  fetchFromGitHub,
+  installShellFiles,
+  qemu,
+  sigtool,
+  makeWrapper,
+  nix-update-script,
+  apple-sdk_15,
+  lima,
 }:

 buildGoModule rec {
  pname = "lima";
-  version = "1.0.1";
+  version = "1.0.2";

  src = fetchFromGitHub {
    owner = "lima-vm";
-    repo = pname;
+    repo = "lima";
    rev = "v${version}";
-    sha256 = "sha256-XYB8Nxbs76xmiiZ7IYfgn+UgUr6CLOalQrl6Ibo+DRc=";
+    hash = "sha256-LNsxMrbEgdosGDDUNvMZq/hpP5azNiIHjKTp0Iw/PC0=";
  };

-  vendorHash = "sha256-nNSBwvhKSWs6to37+RLziYQqVOYfvjYib3fRRALACho=";
+  vendorHash = "sha256-taozyQBJvkCsJAaOHg1gFK4qOnepRbzIn4jHzxfAn6A=";

-  nativeBuildInputs = [ makeWrapper installShellFiles ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [ sigtool ];
+  nativeBuildInputs = [
+    makeWrapper
+    installShellFiles
+  ] ++ lib.optionals stdenv.hostPlatform.isDarwin [ sigtool ];

  buildInputs = lib.optionals stdenv.hostPlatform.isDarwin [ apple-sdk_15 ];

@@ -48,23 +52,34 @@ buildGoModule rec {
    export LIMA_HOME="$(mktemp -d)"
  '';

-  installPhase = ''
-    runHook preInstall
-    mkdir -p $out
-    cp -r _output/* $out
-    wrapProgram $out/bin/limactl \
-      --prefix PATH : ${lib.makeBinPath [ qemu ]}
-  '' + lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
-    installShellCompletion --cmd limactl \
-      --bash <($out/bin/limactl completion bash) \
-      --fish <($out/bin/limactl completion fish) \
-      --zsh <($out/bin/limactl completion zsh)
-  '' + ''
-    runHook postInstall
-  '';
+  installPhase =
+    ''
+      runHook preInstall
+      mkdir -p $out
+      cp -r _output/* $out
+      wrapProgram $out/bin/limactl \
+        --prefix PATH : ${lib.makeBinPath [ qemu ]}
+    ''
+    + lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
+      installShellCompletion --cmd limactl \
+        --bash <($out/bin/limactl completion bash) \
+        --fish <($out/bin/limactl completion fish) \
+        --zsh <($out/bin/limactl completion zsh)
+    ''
+    + ''
+      runHook postInstall
+    '';

  doInstallCheck = true;
+  # Workaround for: "panic: $HOME is not defined" at https://github.com/lima-vm/lima/blob/v1.0.2/pkg/limayaml/defaults.go#L52
+  # Don't use versionCheckHook for this package. It cannot inject environment variables.
  installCheckPhase = ''
+    if [[ "$(HOME="$(mktemp -d)" "$out/bin/limactl" --version | cut -d ' ' -f 3)" == "${version}" ]]; then
+      echo '${pname} smoke check passed'
+    else
+      echo '${pname} smoke check failed'
+      return 1
+    fi
    USER=nix $out/bin/limactl validate templates/default.yaml
  '';

@@ -1,32 +1,34 @@
-{ lib
-, stdenv
-, callPackage
-, runCommandLocal
-, writeShellScript
-, glibc
-, pkgsHostTarget
-, runCommandCC
-, coreutils
-, bubblewrap
+{
+  lib,
+  stdenv,
+  callPackage,
+  runCommandLocal,
+  writeShellScript,
+  glibc,
+  pkgsHostTarget,
+  runCommandCC,
+  coreutils,
+  bubblewrap,
 }:

-{ runScript ? "bash"
-, nativeBuildInputs ? []
-, extraInstallCommands ? ""
-, meta ? {}
-, passthru ? {}
-, extraPreBwrapCmds ? ""
-, extraBwrapArgs ? []
-, unshareUser ? false
-, unshareIpc ? false
-, unsharePid ? false
-, unshareNet ? false
-, unshareUts ? false
-, unshareCgroup ? false
-, privateTmp ? false
-, dieWithParent ? true
-, ...
-} @ args:
+{
+  runScript ? "bash",
+  nativeBuildInputs ? [ ],
+  extraInstallCommands ? "",
+  meta ? { },
+  passthru ? { },
+  extraPreBwrapCmds ? "",
+  extraBwrapArgs ? [ ],
+  unshareUser ? false,
+  unshareIpc ? false,
+  unsharePid ? false,
+  unshareNet ? false,
+  unshareUts ? false,
+  unshareCgroup ? false,
+  privateTmp ? false,
+  dieWithParent ? true,
+  ...
+}@args:

 assert (!args ? pname || !args ? version) -> (args ? name); # You must provide name if pname or version (preferred) is missing.

@@ -49,59 +51,82 @@ let
  name = args.name or "${args.pname}-${args.version}";
  executableName = args.pname or args.name;
  # we don't know which have been supplied, and want to avoid defaulting missing attrs to null. Passed into runCommandLocal
-  nameAttrs = lib.filterAttrs (key: value: builtins.elem key [ "name" "pname" "version" ]) args;
+  nameAttrs = lib.filterAttrs (
+    key: value:
+    builtins.elem key [
+      "name"
+      "pname"
+      "version"
+    ]
+  ) args;

  buildFHSEnv = callPackage ./buildFHSEnv.nix { };

-  fhsenv = buildFHSEnv (removeAttrs args [
-    "runScript" "extraInstallCommands" "meta" "passthru" "extraPreBwrapCmds" "extraBwrapArgs" "dieWithParent"
-    "unshareUser" "unshareCgroup" "unshareUts" "unshareNet" "unsharePid" "unshareIpc" "privateTmp"
-  ]);
+  fhsenv = buildFHSEnv (
+    removeAttrs args [
+      "runScript"
+      "extraInstallCommands"
+      "meta"
+      "passthru"
+      "extraPreBwrapCmds"
+      "extraBwrapArgs"
+      "dieWithParent"
+      "unshareUser"
+      "unshareCgroup"
+      "unshareUts"
+      "unshareNet"
+      "unsharePid"
+      "unshareIpc"
+      "privateTmp"
+    ]
+  );

-  etcBindEntries = let
-    files = [
-      # NixOS Compatibility
-      "static"
-      "nix" # mainly for nixUnstable users, but also for access to nix/netrc
-      # Shells
-      "shells"
-      "bashrc"
-      "zshenv"
-      "zshrc"
-      "zinputrc"
-      "zprofile"
-      # Users, Groups, NSS
-      "passwd"
-      "group"
-      "shadow"
-      "hosts"
-      "resolv.conf"
-      "nsswitch.conf"
-      # User profiles
-      "profiles"
-      # Sudo & Su
-      "login.defs"
-      "sudoers"
-      "sudoers.d"
-      # Time
-      "localtime"
-      "zoneinfo"
-      # Other Core Stuff
-      "machine-id"
-      "os-release"
-      # PAM
-      "pam.d"
-      # Fonts
-      "fonts"
-      # ALSA
-      "alsa"
-      "asound.conf"
-      # SSL
-      "ssl/certs"
-      "ca-certificates"
-      "pki"
-    ];
-  in map (path: "/etc/${path}") files;
+  etcBindEntries =
+    let
+      files = [
+        # NixOS Compatibility
+        "static"
+        "nix" # mainly for nixUnstable users, but also for access to nix/netrc
+        # Shells
+        "shells"
+        "bashrc"
+        "zshenv"
+        "zshrc"
+        "zinputrc"
+        "zprofile"
+        # Users, Groups, NSS
+        "passwd"
+        "group"
+        "shadow"
+        "hosts"
+        "resolv.conf"
+        "nsswitch.conf"
+        # User profiles
+        "profiles"
+        # Sudo & Su
+        "login.defs"
+        "sudoers"
+        "sudoers.d"
+        # Time
+        "localtime"
+        "zoneinfo"
+        # Other Core Stuff
+        "machine-id"
+        "os-release"
+        # PAM
+        "pam.d"
+        # Fonts
+        "fonts"
+        # ALSA
+        "alsa"
+        "asound.conf"
+        # SSL
+        "ssl/certs"
+        "ca-certificates"
+        "pki"
+      ];
+    in
+    map (path: "/etc/${path}") files;

  # Here's the problem case:
  # - we need to run bash to run the init script
@@ -119,182 +144,208 @@ let
  #
  # Also, the real init is placed strategically at /init, so we don't
  # have to recompile this every time.
-  containerInit = runCommandCC "container-init" {
-    buildInputs = [ stdenv.cc.libc.static or null ];
-  } ''
-    $CXX -static -s -o $out ${./container-init.cc}
-  '';
+  containerInit =
+    runCommandCC "container-init"
+      {
+        buildInputs = [ stdenv.cc.libc.static or null ];
+      }
+      ''
+        $CXX -static -s -o $out ${./container-init.cc}
+      '';

-  realInit = run: writeShellScript "${name}-init" ''
-    source /etc/profile
-    exec ${run} "$@"
-  '';
+  realInit =
+    run:
+    writeShellScript "${name}-init" ''
+      source /etc/profile
+      exec ${run} "$@"
+    '';

  indentLines = str: concatLines (map (s: "  " + s) (filter (s: s != "") (splitString "\n" str)));
-  bwrapCmd = { initArgs ? "" }: ''
-    ignored=(/nix /dev /proc /etc ${optionalString privateTmp "/tmp"})
-    ro_mounts=()
-    symlinks=()
-    etc_ignored=()
+  bwrapCmd =
+    {
+      initArgs ? "",
+    }:
+    ''
+      ignored=(/nix /dev /proc /etc ${optionalString privateTmp "/tmp"})
+      ro_mounts=()
+      symlinks=()
+      etc_ignored=()

-    ${extraPreBwrapCmds}
+      ${extraPreBwrapCmds}

-    # loop through all entries of root in the fhs environment, except its /etc.
-    for i in ${fhsenv}/*; do
-      path="/''${i##*/}"
-      if [[ $path == '/etc' ]]; then
-        :
-      elif [[ -L $i ]]; then
-        symlinks+=(--symlink "$(${coreutils}/bin/readlink "$i")" "$path")
-        ignored+=("$path")
-      else
-        ro_mounts+=(--ro-bind "$i" "$path")
-        ignored+=("$path")
-      fi
-    done
-
-    # loop through the entries of /etc in the fhs environment.
-    if [[ -d ${fhsenv}/etc ]]; then
-      for i in ${fhsenv}/etc/*; do
+      # loop through all entries of root in the fhs environment, except its /etc.
+      for i in ${fhsenv}/*; do
        path="/''${i##*/}"
-        # NOTE: we're binding /etc/fonts and /etc/ssl/certs from the host so we
-        # don't want to override it with a path from the FHS environment.
-        if [[ $path == '/fonts' || $path == '/ssl' ]]; then
+        if [[ $path == '/etc' ]]; then
+          :
+        elif [[ -L $i ]]; then
+          symlinks+=(--symlink "$(${coreutils}/bin/readlink "$i")" "$path")
+          ignored+=("$path")
+        else
+          ro_mounts+=(--ro-bind "$i" "$path")
+          ignored+=("$path")
+        fi
+      done
+
+      # loop through the entries of /etc in the fhs environment.
+      if [[ -d ${fhsenv}/etc ]]; then
+        for i in ${fhsenv}/etc/*; do
+          path="/''${i##*/}"
+          # NOTE: we're binding /etc/fonts and /etc/ssl/certs from the host so we
+          # don't want to override it with a path from the FHS environment.
+          if [[ $path == '/fonts' || $path == '/ssl' ]]; then
+            continue
+          fi
+          if [[ -L $i ]]; then
+            symlinks+=(--symlink "$i" "/etc$path")
+          else
+            ro_mounts+=(--ro-bind "$i" "/etc$path")
+          fi
+          etc_ignored+=("/etc$path")
+        done
+      fi
+
+      # propagate /etc from the actual host if nested
+      if [[ -e /.host-etc ]]; then
+        ro_mounts+=(--ro-bind /.host-etc /.host-etc)
+      else
+        ro_mounts+=(--ro-bind /etc /.host-etc)
+      fi
+
+      # link selected etc entries from the actual root
+      for i in ${escapeShellArgs etcBindEntries}; do
+        if [[ "''${etc_ignored[@]}" =~ "$i" ]]; then
          continue
        fi
-        if [[ -L $i ]]; then
-          symlinks+=(--symlink "$i" "/etc$path")
-        else
-          ro_mounts+=(--ro-bind "$i" "/etc$path")
+        if [[ -e $i ]]; then
+          symlinks+=(--symlink "/.host-etc/''${i#/etc/}" "$i")
        fi
-        etc_ignored+=("/etc$path")
      done
-    fi

-    # propagate /etc from the actual host if nested
-    if [[ -e /.host-etc ]]; then
-      ro_mounts+=(--ro-bind /.host-etc /.host-etc)
-    else
-      ro_mounts+=(--ro-bind /etc /.host-etc)
-    fi
-
-    # link selected etc entries from the actual root
-    for i in ${escapeShellArgs etcBindEntries}; do
-      if [[ "''${etc_ignored[@]}" =~ "$i" ]]; then
-        continue
-      fi
-      if [[ -e $i ]]; then
-        symlinks+=(--symlink "/.host-etc/''${i#/etc/}" "$i")
-      fi
-    done
-
-    declare -a auto_mounts
-    # loop through all directories in the root
-    for dir in /*; do
-      # if it is a directory and it is not ignored
-      if [[ -d "$dir" ]] && [[ ! "''${ignored[@]}" =~ "$dir" ]]; then
-        # add it to the mount list
-        auto_mounts+=(--bind "$dir" "$dir")
-      fi
-    done
-
-    declare -a x11_args
-    # Always mount a tmpfs on /tmp/.X11-unix
-    # Rationale: https://github.com/flatpak/flatpak/blob/be2de97e862e5ca223da40a895e54e7bf24dbfb9/common/flatpak-run.c#L277
-    x11_args+=(--tmpfs /tmp/.X11-unix)
-
-    # Try to guess X socket path. This doesn't cover _everything_, but it covers some things.
-    if [[ "$DISPLAY" == *:* ]]; then
-      # recover display number from $DISPLAY formatted [host]:num[.screen]
-      display_nr=''${DISPLAY/#*:} # strip host
-      display_nr=''${display_nr/%.*} # strip screen
-      local_socket=/tmp/.X11-unix/X$display_nr
-      x11_args+=(--ro-bind-try "$local_socket" "$local_socket")
-    fi
-
-    ${optionalString privateTmp ''
-    # sddm places XAUTHORITY in /tmp
-    if [[ "$XAUTHORITY" == /tmp/* ]]; then
-      x11_args+=(--ro-bind-try "$XAUTHORITY" "$XAUTHORITY")
-    fi
-
-    # dbus-run-session puts the socket in /tmp
-    IFS=";" read -ra addrs <<<"$DBUS_SESSION_BUS_ADDRESS"
-    for addr in "''${addrs[@]}"; do
-      [[ "$addr" == unix:* ]] || continue
-      IFS="," read -ra parts <<<"''${addr#unix:}"
-      for part in "''${parts[@]}"; do
-        printf -v part '%s' "''${part//\\/\\\\}"
-        printf -v part '%b' "''${part//%/\\x}"
-        [[ "$part" == path=/tmp/* ]] || continue
-        x11_args+=(--ro-bind-try "''${part#path=}" "''${part#path=}")
+      declare -a auto_mounts
+      # loop through all directories in the root
+      for dir in /*; do
+        # if it is a directory and it is not ignored
+        if [[ -d "$dir" ]] && [[ ! "''${ignored[@]}" =~ "$dir" ]]; then
+          # add it to the mount list
+          auto_mounts+=(--bind "$dir" "$dir")
+        fi
      done
-    done
-    ''}

-    cmd=(
-      ${bubblewrap}/bin/bwrap
-      --dev-bind /dev /dev
-      --proc /proc
-      --chdir "$(pwd)"
-      ${optionalString unshareUser "--unshare-user"}
-      ${optionalString unshareIpc "--unshare-ipc"}
-      ${optionalString unsharePid "--unshare-pid"}
-      ${optionalString unshareNet "--unshare-net"}
-      ${optionalString unshareUts "--unshare-uts"}
-      ${optionalString unshareCgroup "--unshare-cgroup"}
-      ${optionalString dieWithParent "--die-with-parent"}
-      --ro-bind /nix /nix
-      ${optionalString privateTmp "--tmpfs /tmp"}
-      # Our glibc will look for the cache in its own path in `/nix/store`.
-      # As such, we need a cache to exist there, because pressure-vessel
-      # depends on the existence of an ld cache. However, adding one
-      # globally proved to be a bad idea (see #100655), the solution we
-      # settled on being mounting one via bwrap.
-      # Also, the cache needs to go to both 32 and 64 bit glibcs, for games
-      # of both architectures to work.
-      --tmpfs ${glibc}/etc \
-      --tmpfs /etc \
-      --symlink /etc/ld.so.conf ${glibc}/etc/ld.so.conf \
-      --symlink /etc/ld.so.cache ${glibc}/etc/ld.so.cache \
-      --ro-bind ${glibc}/etc/rpc ${glibc}/etc/rpc \
-      --remount-ro ${glibc}/etc \
-      --symlink ${realInit runScript} /init \
-  '' + optionalString fhsenv.isMultiBuild (indentLines ''
+      declare -a x11_args
+      # Always mount a tmpfs on /tmp/.X11-unix
+      # Rationale: https://github.com/flatpak/flatpak/blob/be2de97e862e5ca223da40a895e54e7bf24dbfb9/common/flatpak-run.c#L277
+      x11_args+=(--tmpfs /tmp/.X11-unix)
+
+      # Try to guess X socket path. This doesn't cover _everything_, but it covers some things.
+      if [[ "$DISPLAY" == *:* ]]; then
+        # recover display number from $DISPLAY formatted [host]:num[.screen]
+        display_nr=''${DISPLAY/#*:} # strip host
+        display_nr=''${display_nr/%.*} # strip screen
+        local_socket=/tmp/.X11-unix/X$display_nr
+        x11_args+=(--ro-bind-try "$local_socket" "$local_socket")
+      fi
+
+      ${optionalString privateTmp ''
+        # sddm places XAUTHORITY in /tmp
+        if [[ "$XAUTHORITY" == /tmp/* ]]; then
+          x11_args+=(--ro-bind-try "$XAUTHORITY" "$XAUTHORITY")
+        fi
+
+        # dbus-run-session puts the socket in /tmp
+        IFS=";" read -ra addrs <<<"$DBUS_SESSION_BUS_ADDRESS"
+        for addr in "''${addrs[@]}"; do
+          [[ "$addr" == unix:* ]] || continue
+          IFS="," read -ra parts <<<"''${addr#unix:}"
+          for part in "''${parts[@]}"; do
+            printf -v part '%s' "''${part//\\/\\\\}"
+            printf -v part '%b' "''${part//%/\\x}"
+            [[ "$part" == path=/tmp/* ]] || continue
+            x11_args+=(--ro-bind-try "''${part#path=}" "''${part#path=}")
+          done
+        done
+      ''}
+
+      cmd=(
+        ${bubblewrap}/bin/bwrap
+        --dev-bind /dev /dev
+        --proc /proc
+        --chdir "$(pwd)"
+        ${optionalString unshareUser "--unshare-user"}
+        ${optionalString unshareIpc "--unshare-ipc"}
+        ${optionalString unsharePid "--unshare-pid"}
+        ${optionalString unshareNet "--unshare-net"}
+        ${optionalString unshareUts "--unshare-uts"}
+        ${optionalString unshareCgroup "--unshare-cgroup"}
+        ${optionalString dieWithParent "--die-with-parent"}
+        --ro-bind /nix /nix
+        ${optionalString privateTmp "--tmpfs /tmp"}
+        # Our glibc will look for the cache in its own path in `/nix/store`.
+        # As such, we need a cache to exist there, because pressure-vessel
+        # depends on the existence of an ld cache. However, adding one
+        # globally proved to be a bad idea (see #100655), the solution we
+        # settled on being mounting one via bwrap.
+        # Also, the cache needs to go to both 32 and 64 bit glibcs, for games
+        # of both architectures to work.
+        --tmpfs ${glibc}/etc \
+        --tmpfs /etc \
+        --symlink /etc/ld.so.conf ${glibc}/etc/ld.so.conf \
+        --symlink /etc/ld.so.cache ${glibc}/etc/ld.so.cache \
+        --ro-bind ${glibc}/etc/rpc ${glibc}/etc/rpc \
+        --remount-ro ${glibc}/etc \
+        --symlink ${realInit runScript} /init \
+    ''
+    + optionalString fhsenv.isMultiBuild (indentLines ''
      --tmpfs ${pkgsi686Linux.glibc}/etc \
      --symlink /etc/ld.so.conf ${pkgsi686Linux.glibc}/etc/ld.so.conf \
      --symlink /etc/ld.so.cache ${pkgsi686Linux.glibc}/etc/ld.so.cache \
      --ro-bind ${pkgsi686Linux.glibc}/etc/rpc ${pkgsi686Linux.glibc}/etc/rpc \
      --remount-ro ${pkgsi686Linux.glibc}/etc \
-  '') + ''
-      "''${ro_mounts[@]}"
-      "''${symlinks[@]}"
-      "''${auto_mounts[@]}"
-      "''${x11_args[@]}"
-      ${concatStringsSep "\n  " extraBwrapArgs}
-      ${containerInit} ${initArgs}
-    )
-    exec "''${cmd[@]}"
-  '';
-
-  bin = writeShellScript "${name}-bwrap" (bwrapCmd { initArgs = ''"$@"''; });
-in runCommandLocal name (nameAttrs // {
-  inherit nativeBuildInputs meta;
-
-  passthru = passthru // {
-    env = runCommandLocal "${name}-shell-env" {
-      shellHook = bwrapCmd {};
-    } ''
-      echo >&2 ""
-      echo >&2 "*** User chroot 'env' attributes are intended for interactive nix-shell sessions, not for building! ***"
-      echo >&2 ""
-      exit 1
+    '')
+    + ''
+        "''${ro_mounts[@]}"
+        "''${symlinks[@]}"
+        "''${auto_mounts[@]}"
+        "''${x11_args[@]}"
+        ${concatStringsSep "\n  " extraBwrapArgs}
+        ${containerInit} ${initArgs}
+      )
+      exec "''${cmd[@]}"
    '';
-    inherit args fhsenv;
-  };
-}) ''
-  mkdir -p $out/bin
-  ln -s ${bin} $out/bin/${executableName}

-  ${extraInstallCommands}
-''
+  bin = writeShellScript "${name}-bwrap" (bwrapCmd {
+    initArgs = ''"$@"'';
+  });
+in
+runCommandLocal name
+  (
+    nameAttrs
+    // {
+      inherit nativeBuildInputs;
+
+      passthru = passthru // {
+        env =
+          runCommandLocal "${name}-shell-env"
+            {
+              shellHook = bwrapCmd { };
+            }
+            ''
+              echo >&2 ""
+              echo >&2 "*** User chroot 'env' attributes are intended for interactive nix-shell sessions, not for building! ***"
+              echo >&2 ""
+              exit 1
+            '';
+        inherit args fhsenv;
+      };
+
+      meta = {
+        mainProgram = executableName;
+      } // meta;
+    }
+  )
+  ''
+    mkdir -p $out/bin
+    ln -s ${bin} $out/bin/${executableName}
+
+    ${extraInstallCommands}
+  ''
@@ -52,8 +52,7 @@
    {
      name = "dotnet-fixup-hook";
      substitutions = {
-        # this is used for DOTNET_ROOT, so we need unwrapped
-        dotnetRuntime = if (dotnet-runtime != null) then dotnet-runtime.unwrapped else null;
+        dotnetRuntime = if (dotnet-runtime != null) then dotnet-runtime else null;
        wrapperPath = lib.makeBinPath [ which coreutils ];
      };
    }
@@ -6,13 +6,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "abcmidi";
-  version = "2024.10.10";
+  version = "2024.12.06";

  src = fetchFromGitHub {
    owner = "sshlien";
    repo = "abcmidi";
    rev = "refs/tags/${finalAttrs.version}";
-    hash = "sha256-dAxr1RJrYppt/Gw6ZF3fL0lDhwJNG5v75M6VA1okrtw=";
+    hash = "sha256-uSmkRoAy2tCvSy/jE0wxg2nhiQRF62zCwnr41YpRkXE=";
  };

  meta = {
@@ -6,14 +6,14 @@

 python3.pkgs.buildPythonApplication rec {
  pname = "ad-miner";
-  version = "1.6.1";
+  version = "1.7.0";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "Mazars-Tech";
    repo = "AD_Miner";
    rev = "refs/tags/v${version}";
-    hash = "sha256-/TIG1UUfLct9MxCmahWk7F6KlypNan+zk/02zVpPV+w=";
+    hash = "sha256-Uzt7tKRj+iq4UR0gUpfhiTzMjecVBcp7jsXC7lSADeg=";
  };

  # All requirements are pinned
@@ -8,7 +8,7 @@
  glib-networking,
  google-fonts,
  lib,
-  libsoup,
+  libsoup_2_4,
  nodejs,
  npmHooks,
  openssl,
@@ -70,7 +70,7 @@ rustPlatform.buildRustPackage {
    [ openssl ]
    ++ lib.optionals stdenv.hostPlatform.isLinux [
      glib-networking
-      libsoup
+      libsoup_2_4
      webkitgtk_4_0
    ]
    ++ dotnetSdk.packages
@@ -23,19 +23,17 @@
 let

  suffix = if stdenv.system == "x86_64-linux" then "64" else "32";
-  # Fix https://github.com/NixOS/nixpkgs/issues/348903 until the glslang update to 15.0.0 is merged into master
-  glslang_fixed = glslang.overrideAttrs (finalAttrs: oldAttrs: { cmakeFlags = [ ]; });

 in
 stdenv.mkDerivation (finalAttrs: {
  pname = "amdvlk";
-  version = "2024.Q3.3";
+  version = "2024.Q4.2";

  src = fetchRepoProject {
    name = "amdvlk-src";
    manifest = "https://github.com/GPUOpen-Drivers/AMDVLK.git";
    rev = "refs/tags/v-${finalAttrs.version}";
-    hash = "sha256-wIPubMsSaNGTykD/K0gxdba128TqW5nu4CjXoLkprc0=";
+    hash = "sha256-16eHtdxoSCVEPQNvi7Kuo7CP4yddMsZqpuRsWobEOnw=";
  };

  buildInputs =
@@ -61,7 +59,7 @@ stdenv.mkDerivation (finalAttrs: {
    [
      cmake
      directx-shader-compiler
-      glslang_fixed
+      glslang
      ninja
      patchelf
      perl
@@ -7,13 +7,13 @@

 stdenvNoCC.mkDerivation {
  pname = "ananicy-rules-cachyos";
-  version = "0-unstable-2024-10-25";
+  version = "0-unstable-2024-11-22";

  src = fetchFromGitHub {
    owner = "CachyOS";
    repo = "ananicy-rules";
-    rev = "707b16506be2c54028546181461ebf47cfe72d83";
-    hash = "sha256-189eHlSLGgSgT2KIkj+c5pKpPZ34vacZzlYOFGfwEFM=";
+    rev = "7b660e4c0e3dccec7ddc4c4dafc1717cb06b7e1e";
+    hash = "sha256-7MwAveke3GL8tmOCxCgKRbllChST22FKWdbGsewCJdM=";
  };

  dontConfigure = true;
@@ -5,15 +5,15 @@
 }:
 let
  pname = "ankama-launcher";
-  version = "3.12.24";
+  version = "3.12.26";

  # The original URL for the launcher is:
  # https://launcher.cdn.ankama.com/installers/production/Ankama%20Launcher-Setup-x86_64.AppImage
  # As it does not encode the version, we use the wayback machine (web.archive.org) to get a fixed URL.
  # To update the client, head to web.archive.org and create a new snapshot of the download page.
  src = fetchurl {
-    url = "https://web.archive.org/web/20241202103051/https://launcher.cdn.ankama.com/installers/production/Ankama%20Launcher-Setup-x86_64.AppImage";
-    hash = "sha256-jI/qcIIrNU9ViaZ/LKMkUETXZpintDsofSgiRfe4GOU=";
+    url = "https://web.archive.org/web/20241206172526/https://launcher.cdn.ankama.com/installers/production/Ankama%20Launcher-Setup-x86_64.AppImage";
+    hash = "sha256-K/qe/qxMfcGWU5gyEfPdl0ptjTCWaqIXMCy4O8WEKCQ=";
  };

  appimageContents = appimageTools.extract { inherit pname version src; };
@@ -44,7 +44,7 @@
 , isocodes
 , libpsl
 , libepoxy
-, libsoup
+, libsoup_2_4
 , exiv2
 , libXtst
 , libthai
@@ -138,7 +138,7 @@ stdenv.mkDerivation {
    libsecret
    libselinux
    libsepol
-    libsoup
+    libsoup_2_4
    libsysprof-capture
    libthai
    libwebp
@@ -0,0 +1,79 @@
+{
+  buildGoModule,
+  lib,
+  fetchFromGitHub,
+  pnpm,
+  nodejs,
+  fetchpatch,
+  stdenv,
+}:
+
+buildGoModule rec {
+  pname = "apache-answer";
+  version = "1.4.1";
+
+  src = fetchFromGitHub {
+    owner = "apache";
+    repo = "incubator-answer";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-nS3ZDwY221axzo1HAz369f5jWZ/mpCn4r3OPPqjiohI=";
+  };
+
+  webui = stdenv.mkDerivation {
+    pname = pname + "-webui";
+    inherit version src;
+
+    sourceRoot = "${src.name}/ui";
+
+    pnpmDeps = pnpm.fetchDeps {
+      inherit src version pname;
+      sourceRoot = "${src.name}/ui";
+      hash = "sha256-/se6IWeHdazqS7PzOpgtT4IxCJ1WptqBzZ/BdmGb4BA=";
+    };
+
+    nativeBuildInputs = [
+      pnpm.configHook
+      nodejs
+    ];
+
+    buildPhase = ''
+      runHook preBuild
+
+      pnpm build
+
+      runHook postBuild
+    '';
+
+    installPhase = ''
+      runHook preInstall
+
+      mkdir -p $out
+      cp -r build/* $out
+
+      runHook postInstall
+    '';
+  };
+
+  vendorHash = "sha256-nvXr1YAqVCyhCgPtABTOtzDH+FCQhN9kSEhxKw7ipsE=";
+
+  preBuild = ''
+    cp -r ${webui}/* ui/build/
+  '';
+
+  patches = [
+    (fetchpatch {
+      url = "https://github.com/apache/incubator-answer/commit/57b0d0e84dd0e0bf3c8a05a38a7f55eddc5f0dda.patch";
+      hash = "sha256-TfF+PtrcMYYgNjgU4lGpnshdII8xECTT2L7M26uebn0=";
+    })
+  ];
+
+  meta = {
+    homepage = "https://answer.apache.org/";
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ bot-wxt1221 ];
+    platforms = lib.platforms.unix;
+    mainProgram = "answer";
+    changelog = "https://github.com/apache/incubator-answer/releases/tag/v${version}";
+    description = "Q&A platform software for teams at any scales";
+  };
+}
@@ -10,7 +10,7 @@
 , gettext
 , gtk3
 , libmpdclient
-, libsoup
+, libsoup_2_4
 , libxml2
 , taglib
 , wrapGAppsHook3
@@ -39,7 +39,7 @@ stdenv.mkDerivation rec {
    dbus-glib
    gtk3
    libmpdclient
-    libsoup
+    libsoup_2_4
    libxml2
    taglib
  ];
@@ -9,11 +9,11 @@

 stdenv.mkDerivation rec {
  pname = "astyle";
-  version = "3.6.4";
+  version = "3.6.5";

  src = fetchurl {
    url = "mirror://sourceforge/${pname}/${pname}-${version}.tar.bz2";
-    hash = "sha256-HpS2T08GRh+QOdCUrv6dSyjGbTSRayekVgVefWLXNwI=";
+    hash = "sha256-8jHNZBBHrbbAGtslEVczJqi7eik9F7VMdwVQmT3q3os=";
  };

  nativeBuildInputs = [ cmake ];
@@ -2,20 +2,20 @@

 buildGoModule rec {
  pname = "atlantis";
-  version = "0.28.5";
+  version = "0.30.0";

  src = fetchFromGitHub {
    owner = "runatlantis";
    repo = "atlantis";
    rev = "v${version}";
-    hash = "sha256-oyECtP/YeEhvsltWZq52YNq+Gbbpko9bbbUTh5NA/9c=";
+    hash = "sha256-hM4IycRE3/jiwFLqkU/jz9sPP9KTfeu8ouIJlqgPxmk=";
  };
  ldflags = [
    "-X=main.version=${version}"
    "-X=main.date=1970-01-01T00:00:00Z"
  ];

-  vendorHash = "sha256-oiRpmGfuc37s3ZD8R7L9EFieqJP7mYvDsiJBzruCSkA=";
+  vendorHash = "sha256-uH+Q5NXBL1+LFa6tw3x2CE1B5QElqK9KuFeYQpCFAW0=";

  subPackages = [ "." ];

@@ -1,9 +1,9 @@
 {
  "owner": "advplyr",
  "repo": "audiobookshelf",
-  "rev": "f850db23fe37dfe5044c2f5f641931528b291bf2",
-  "hash": "sha256-iboQnPmWIk/bYjEF+opjKU+XJVSD5DGCfqp6BJQRW3w=",
-  "version": "2.17.2",
-  "depsHash": "sha256-W56EG5SCiAcjHhR5WR1UBY9Xt0D0p8duEiUzx+luLfc=",
-  "clientDepsHash": "sha256-gEgd2PCFWqNuRXhnFZylGS0GTMJUD0KeHbRgYxMUMPM="
+  "rev": "890b0b949ee758102fd05ba26c5ed5c3ebbd747f",
+  "hash": "sha256-sMtUO2ltlxipjNXqcHLVXlZZ8QOAGND77hItwcxx27Q=",
+  "version": "2.17.4",
+  "depsHash": "sha256-b2mcJ+Qh+VEYaZcy4LGCFPK9dFYsy48wUaEAJGYtBwc=",
+  "clientDepsHash": "sha256-CfRG7GqvtLL675Bkzi/WOERwp0EKzmC3u0ozxHoj9rI="
 }
@@ -0,0 +1,55 @@
+{
+  python3Packages,
+  lib,
+  fetchFromGitHub,
+  awscli,
+}:
+
+python3Packages.buildPythonApplication rec {
+  pname = "aws-shell";
+  version = "0.2.2";
+
+  src = fetchFromGitHub {
+    owner = "awslabs";
+    repo = "aws-shell";
+    rev = "refs/tags/${version}";
+    hash = "sha256-m96XaaFDFQaD2YPjw8D1sGJ5lex4Is4LQ5RhGzVPvH4=";
+  };
+
+  build-system = with python3Packages; [
+    setuptools
+  ];
+
+  dependencies = with python3Packages; [
+    botocore
+    pygments
+    mock
+    configobj
+    awscli
+    (prompt-toolkit.overrideAttrs (old: {
+      src = fetchFromGitHub {
+        owner = "prompt-toolkit";
+        repo = "python-prompt-toolkit";
+        rev = "refs/tags/1.0.18"; # Need >=1.0.0,<1.1.0
+        hash = "sha256-mt/fIubkpeVc7vhAaTk0pXZXI8JzB7n2MzXqgqK0wE4=";
+      };
+    }))
+  ];
+
+  nativeCheckInputs = with python3Packages; [
+    pytestCheckHook
+  ];
+
+  preCheck = ''
+    export HOME=$(mktemp -d)
+  '';
+
+  meta = {
+    homepage = "https://github.com/awslabs/aws-shell";
+    description = "Integrated shell for working with the AWS CLI";
+    platforms = lib.platforms.unix;
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ bot-wxt1221 ];
+    mainProgram = "aws-shell";
+  };
+}
@@ -14,7 +14,7 @@
 , webkitgtk_4_0
 , librsvg
 , gdk-pixbuf
-, libsoup
+, libsoup_2_4
 , glib-networking
 , graphicsmagick_q16
 , libva
@@ -57,7 +57,7 @@ stdenv.mkDerivation (finalAttrs: {
    webkitgtk_4_0
    librsvg
    gdk-pixbuf
-    libsoup
+    libsoup_2_4
    glib-networking
    graphicsmagick_q16
    hiredis
@@ -2,34 +2,31 @@
  lib,
  python3,
  fetchFromGitHub,
+  fetchPypi,
  git,
 }:

 let
-  changeVersion =
-    overrideFunc: version: hash:
-    overrideFunc (oldAttrs: rec {
-      inherit version;
-      src = oldAttrs.src.override {
-        inherit version hash;
-      };
-    });
-
-  localPython = python3.override {
-    self = localPython;
+  python = python3.override {
    packageOverrides = self: super: {
-      cement =
-        changeVersion super.cement.overridePythonAttrs "2.10.14"
-          "sha256-NC4n21SmYW3RiS7QuzWXoifO4z3C2FVgQm3xf8qQcFg=";
+      cement = super.cement.overridePythonAttrs (old: rec {
+        pname = "cement";
+        version = "2.10.14";
+        src = fetchPypi {
+          inherit pname version;
+          hash = "sha256-NC4n21SmYW3RiS7QuzWXoifO4z3C2FVgQm3xf8qQcFg=";
+        };
+        build-system = old.build-system or [ ] ++ (with python.pkgs; [ setuptools ]);
+        doCheck = false;
+      });
    };
  };
-
 in

-localPython.pkgs.buildPythonApplication rec {
+python.pkgs.buildPythonApplication rec {
  pname = "awsebcli";
  version = "3.21";
-  format = "setuptools";
+  pyproject = true;

  src = fetchFromGitHub {
    owner = "aws";
@@ -38,12 +35,23 @@ localPython.pkgs.buildPythonApplication rec {
    hash = "sha256-VU8bXvS4m4eIamjlgGmHE2qwDXWAXvWTa0QHomXR5ZE=";
  };

+  pythonRelaxDeps = [
+    "botocore"
+    "colorama"
+    "pathspec"
+    "PyYAML"
+    "six"
+    "termcolor"
+    "urllib3"
+  ];
+
  postPatch = ''
    # https://github.com/aws/aws-elastic-beanstalk-cli/pull/469
-    substituteInPlace setup.py --replace-fail "scripts=['bin/eb']," ""
+    substituteInPlace setup.py \
+      --replace-fail "scripts=['bin/eb']," ""
  '';

-  propagatedBuildInputs = with localPython.pkgs; [
+  dependencies = with python.pkgs; [
    blessed
    botocore
    cement
@@ -59,20 +67,11 @@ localPython.pkgs.buildPythonApplication rec {
    websocket-client
  ];

-  pythonRelaxDeps = [
-    "botocore"
-    "colorama"
-    "pathspec"
-    "PyYAML"
-    "six"
-    "termcolor"
-  ];
-
-  nativeCheckInputs = with localPython.pkgs; [
-    pytestCheckHook
-    pytest-socket
-    mock
+  nativeCheckInputs = with python.pkgs; [
    git
+    mock
+    pytest-socket
+    pytestCheckHook
  ];

  pytestFlagsArray = [
@@ -92,11 +91,11 @@ localPython.pkgs.buildPythonApplication rec {
  ];

  meta = with lib; {
-    homepage = "https://aws.amazon.com/elasticbeanstalk/";
    description = "Command line interface for Elastic Beanstalk";
+    homepage = "https://aws.amazon.com/elasticbeanstalk/";
    changelog = "https://github.com/aws/aws-elastic-beanstalk-cli/blob/${version}/CHANGES.rst";
-    maintainers = with maintainers; [ kirillrdy ];
    license = licenses.asl20;
+    maintainers = with maintainers; [ kirillrdy ];
    mainProgram = "eb";
  };
 }
@@ -15,16 +15,16 @@

 buildNpmPackage rec {
  pname = "balena-cli";
-  version = "19.0.13";
+  version = "20.0.9";

  src = fetchFromGitHub {
    owner = "balena-io";
    repo = "balena-cli";
    rev = "v${version}";
-    hash = "sha256-2U+P3LsxaRpktNbDn8iNhHQVjokiWZADYVDpJsDosZU=";
+    hash = "sha256-UmtTFSUCxz9oAep9+k0GBCxfFkHNDwoKvThIkFq93PQ=";
  };

-  npmDepsHash = "sha256-CA6qs9Gk19dEK2yCFMVVKmJSoZVLdpnf4V6P5fv2Bcc=";
+  npmDepsHash = "sha256-hie3ZWbqBKB4CRZG46oXyiYC8A/JLjdHkTh6VdZe1Qo=";

  postPatch = ''
    ln -s npm-shrinkwrap.json package-lock.json
@@ -6,12 +6,12 @@
 }:
 let
  pname = "bazecor";
-  version = "1.5.4";
+  version = "1.6.1";
  src = appimageTools.extract {
    inherit pname version;
    src = fetchurl {
      url = "https://github.com/Dygmalab/Bazecor/releases/download/v${version}/Bazecor-${version}-x64.AppImage";
-      hash = "sha256-gu3XPl4gKL+k9hX9OVJYGvG3R81c5lZauRJdUFrqtqk=";
+      hash = "sha256-Qf9FqHgTSCD2rYp8PC/gYHyiYcfFTJJmG4oRK/bch8Y=";
    };

    # Workaround for https://github.com/Dygmalab/Bazecor/issues/370
@@ -5,13 +5,13 @@

 buildGoModule rec {
  pname = "bazel-gazelle";
-  version = "0.39.1";
+  version = "0.40.0";

  src = fetchFromGitHub {
    owner = "bazelbuild";
    repo = pname;
    rev = "v${version}";
-    hash = "sha256-Y+k8ObfMwN6fLR2+Lwn64xHljDf3kxw2xp0YpJKbrDM=";
+    hash = "sha256-cGRE+AX62U6lZbUEid0QWb9zMTiIemop6Gqrqvz5+nk=";
  };

  vendorHash = null;
@@ -2,21 +2,21 @@
  lib,
  stdenv,
  fetchurl,
-  electron_30,
+  electron,
  dpkg,
  makeWrapper,
  commandLineArgs ? "",
 }:
 let
-  version = "1.14.0-2";
+  version = "1.15.2-2";
  srcs = {
    x86_64-linux = fetchurl {
      url = "https://github.com/msojocs/bilibili-linux/releases/download/v${version}/io.github.msojocs.bilibili_${version}_amd64.deb";
-      hash = "sha256-QQMdEpKE7r/fPMaX/yEoaa7KjilhiPMYLRvGPkv1jds=";
+      hash = "sha256-juAhvdeLzjHDs59eS+wwUn3OmnDecC17Vclp0Q0LtJw=";
    };
    aarch64-linux = fetchurl {
      url = "https://github.com/msojocs/bilibili-linux/releases/download/v${version}/io.github.msojocs.bilibili_${version}_arm64.deb";
-      hash = "sha256-UaGI4BLhfoYluZpARsj+I0iEmFXYYNfl4JWhBWOOip0=";
+      hash = "sha256-8o0MX0Ih07KQ9wE+nonSZaupSOuUVyuoIbdHYmR29mc=";
    };
  };
  src =
@@ -25,11 +25,6 @@ in
 stdenv.mkDerivation {
  pname = "bilibili";
  inherit src version;
-  unpackPhase = ''
-    runHook preUnpack
-    dpkg -x $src ./
-    runHook postUnpack
-  '';

  nativeBuildInputs = [
    makeWrapper
@@ -43,7 +38,7 @@ stdenv.mkDerivation {
    cp -r usr/share $out/share
    sed -i "s|Exec=.*|Exec=$out/bin/bilibili|" $out/share/applications/*.desktop
    cp -r opt/apps/io.github.msojocs.bilibili/files/bin/app $out/opt
-    makeWrapper ${lib.getExe electron_30} $out/bin/bilibili \
+    makeWrapper ${lib.getExe electron} $out/bin/bilibili \
      --argv0 "bilibili" \
      --add-flags "$out/opt/app.asar" \
      --add-flags ${lib.escapeShellArg commandLineArgs}
@@ -67,7 +62,7 @@ stdenv.mkDerivation {
      "x86_64-linux"
      "aarch64-linux"
    ];
-    sourceProvenance = [ lib.sourceTypes.binaryNativeCode ];
+    sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
    mainProgram = "bilibili";
  };
 }
@@ -8,13 +8,13 @@

 buildDotnetModule rec {
  pname = "Boogie";
-  version = "3.2.5";
+  version = "3.4.2";

  src = fetchFromGitHub {
    owner = "boogie-org";
    repo = "boogie";
    rev = "v${version}";
-    hash = "sha256-36aGVJEzaAwQgR11NI+v8c4cXm24iiXtiwjW6qd3qsE=";
+    hash = "sha256-IWtYbb1IFB6DLIYYTP+q7q+h/0aqonxr/mWwf+83aRo=";
  };

  dotnet-sdk = dotnetCorePackages.sdk_6_0;
@@ -7,13 +7,9 @@
 , pkg-config
 , libgit2
 , oniguruma
-, libiconv
-, Foundation
-, Security
-, xorg
 , zlib
 , buildPackages
-, withClipboard ? !stdenv.hostPlatform.isDarwin
+, withClipboard ? true
 , withTrash ? !stdenv.hostPlatform.isDarwin
 }:

@@ -36,10 +32,8 @@ rustPlatform.buildRustPackage rec {
    pkg-config
  ];

-  buildInputs = [ libgit2 oniguruma xorg.libxcb ] ++ lib.optionals stdenv.hostPlatform.isDarwin [
-    Foundation
-    libiconv
-    Security
+  # TODO: once https://github.com/Canop/broot/issues/956 is released, oniguruma can be removed.
+  buildInputs = [ libgit2 oniguruma ] ++ lib.optionals stdenv.hostPlatform.isDarwin [
    zlib
  ];

@@ -0,0 +1,60 @@
+{
+  fetchFromGitLab,
+  inih,
+  lib,
+  libdrm,
+  libinput,
+  libxkbcommon,
+  meson,
+  ninja,
+  pkg-config,
+  scdoc,
+  stdenv,
+  unstableGitUpdater,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "buffybox";
+  version = "3.2.0-unstable-2024-11-10";
+
+  src = fetchFromGitLab {
+    domain = "gitlab.postmarketos.org";
+    owner = "postmarketOS";
+    repo = "buffybox";
+    fetchSubmodules = true; # to use its vendored lvgl
+    rev = "07e324c17564cb9aab573259a8e0824a6806a751";
+    hash = "sha256-JY9WqtRjDsQf1UVFnM6oTwyAuhlJvrhcSNJdEZ0zIus=";
+  };
+
+  depsBuildBuild = [
+    pkg-config
+  ];
+
+  nativeBuildInputs = [
+    meson
+    ninja
+    pkg-config
+    scdoc
+  ];
+
+  buildInputs = [
+    inih
+    libdrm
+    libinput
+    libxkbcommon
+  ];
+
+  env.PKG_CONFIG_SYSTEMD_SYSTEMD_SYSTEM_UNIT_DIR = "${placeholder "out"}/lib/systemd/system";
+
+  strictDeps = true;
+
+  passthru.updateScript = unstableGitUpdater { };
+
+  meta = with lib; {
+    description = "A suite of graphical applications for the terminal";
+    homepage = "https://gitlab.postmarketos.org/postmarketOS/buffybox";
+    license = licenses.gpl3Plus;
+    maintainers = with lib.maintainers; [ colinsane ];
+    platforms = platforms.linux;
+  };
+})
@@ -1,4 +1,4 @@
-{ lib, stdenv, rustPlatform, fetchFromGitHub, Security }:
+{ lib, stdenv, rustPlatform, fetchFromGitHub, apple-sdk_11 }:

 rustPlatform.buildRustPackage rec {
  pname = "cargo-deadlinks";
@@ -23,7 +23,7 @@ rustPlatform.buildRustPackage rec {
    # assumes the target is x86_64-unknown-linux-gnu
    "--skip simple_project::it_checks_okay_project_correctly";

-  buildInputs = lib.optional stdenv.hostPlatform.isDarwin Security;
+  buildInputs = lib.optional stdenv.hostPlatform.isDarwin apple-sdk_11;

  meta = with lib; {
    description = "Cargo subcommand to check rust documentation for broken links";
@@ -2,14 +2,14 @@

 rustPlatform.buildRustPackage rec {
  pname = "cargo-hack";
-  version = "0.6.32";
+  version = "0.6.33";

  src = fetchCrate {
    inherit pname version;
-    hash = "sha256-XjubvjK+FySm0nqlzFsRhDQOI9M0enonwwPhZ/KFFlk=";
+    hash = "sha256-/O05q4osyQ30rHKe84oBQJTFuVmPGB5KKy6UM/TzY5Q=";
  };

-  cargoHash = "sha256-sWXeGohH9iLMkmBgNjSfg25eDzZHSzWrOGgccuWPBLM=";
+  cargoHash = "sha256-vkvna8+1+qQh+ZXtQ/HJa8UnstuH1sKlFc4CEUZYc5E=";

  # some necessary files are absent in the crate version
  doCheck = false;
@@ -9,14 +9,14 @@

 rustPlatform.buildRustPackage rec {
  pname = "cargo-show-asm";
-  version = "0.2.41";
+  version = "0.2.42";

  src = fetchCrate {
    inherit pname version;
-    hash = "sha256-U9i/xp9WxMYf4GMsZB7qYOpuuuEw4mWZp+ZEyguGtQQ=";
+    hash = "sha256-3KdHEmoGdtfc5b5H7EQ1q5vqra0hRrROJYCIpiqxshk=";
  };

-  cargoHash = "sha256-eUaEpex9x9bdqPJ4p5QvkWKaxs3ih4Gb9+4deGBZgXU=";
+  cargoHash = "sha256-GwzGdy6aWnKyaQbtgRB6t0cnWWiirN9j/GqhdBc5fHU=";

  nativeBuildInputs = [
    installShellFiles
@@ -6,7 +6,7 @@
  cargo-tauri,
  cargo-tauri_1,
  gtk3,
-  libsoup,
+  libsoup_2_4,
  openssl,
  webkitgtk_4_0,
 }:
@@ -40,7 +40,7 @@ cargo-tauri.overrideAttrs (
      [ openssl ]
      ++ lib.optionals stdenv.hostPlatform.isLinux [
        gtk3
-        libsoup
+        libsoup_2_4
        webkitgtk_4_0
      ];

@@ -8,7 +8,7 @@
  cairo,
  stdenv,
  librsvg,
-  libsoup,
+  libsoup_2_4,
  fetchzip,
  openssl_3,
  webkitgtk_4_0,
@@ -43,7 +43,7 @@ stdenv.mkDerivation {
    gtk3
    cairo
    gdk-pixbuf
-    libsoup
+    libsoup_2_4
    glib
    dbus
    openssl_3
@@ -1,31 +1,29 @@
-{ lib, stdenv, autoreconfHook, pkg-config, SDL2, SDL2_mixer, SDL2_net
-, fetchFromGitHub, fetchpatch, python3 }:
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  autoreconfHook,
+  libpng,
+  libsamplerate,
+  pkg-config,
+  python3,
+  SDL2,
+  SDL2_mixer,
+  SDL2_net,
+}:

-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
  pname = "chocolate-doom";
-  version = "3.0.1";
+  version = "3.1.0";

  src = fetchFromGitHub {
    owner = "chocolate-doom";
-    repo = pname;
-    rev = "${pname}-${version}";
-    sha256 = "1zlcqhd49c5n8vaahgaqrc2y10z86xng51sbd82xm3rk2dly25jp";
+    repo = "chocolate-doom";
+    rev = "refs/tags/chocolate-doom-${finalAttrs.version}";
+    hash = "sha256-yDPfqCuzRbDhOQisIDAGo2bmmMjT+0lds5xc9C2pqoU=";
  };

-  patches = [
-    # Pull upstream patch to fix builx against gcc-10:
-    #   https://github.com/chocolate-doom/chocolate-doom/pull/1257
-    (fetchpatch {
-      name = "fno-common.patch";
-      url = "https://github.com/chocolate-doom/chocolate-doom/commit/a8fd4b1f563d24d4296c3e8225c8404e2724d4c2.patch";
-      sha256 = "1dmbygn952sy5n8qqp0asg11pmygwgygl17lrj7i0fxa0nrhixhj";
-    })
-  ];
-
-  outputs = [ "out" "man" ];
-
  postPatch = ''
-    sed -e 's#/games#/bin#g' -i src{,/setup}/Makefile.am
    patchShebangs --build man/{simplecpp,docgen}
  '';

@@ -35,15 +33,31 @@ stdenv.mkDerivation rec {
    # for documentation
    python3
  ];
-  buildInputs = [ SDL2 SDL2_mixer SDL2_net ];
+
+  buildInputs = [
+    libpng
+    libsamplerate
+    SDL2
+    SDL2_mixer
+    SDL2_net
+  ];
+
+  outputs = [
+    "out"
+    "man"
+  ];
+
  enableParallelBuilding = true;

+  strictDeps = true;
+
  meta = {
-    homepage = "http://chocolate-doom.org/";
+    homepage = "https://www.chocolate-doom.org";
+    changelog = "https://github.com/chocolate-doom/chocolate-doom/releases/tag/chocolate-doom-${finalAttrs.version}";
    description = "Doom source port that accurately reproduces the experience of Doom as it was played in the 1990s";
+    mainProgram = "chocolate-doom";
    license = lib.licenses.gpl2Plus;
    platforms = lib.platforms.unix;
-    hydraPlatforms = lib.platforms.linux; # darwin times out
-    maintainers = [ ];
+    maintainers = with lib.maintainers; [ Gliczy ];
  };
-}
+})
@@ -0,0 +1,14 @@
+diff --git a/Makefile b/Makefile
+index 99065da..2415738 100644
+--- a/Makefile
+++ b/Makefile
+@@ -16,9 +16,6 @@ endif
+ ifeq ($(CC), clang)
+ 	CFLAGS += $(CLANG_FLAGS)
+ endif
+-ifeq ($(shell uname), Linux)
+-	CFLAGS += -static
+-endif
+ 
+ Target = chsrc
+ 
@@ -0,0 +1,46 @@
+{
+  lib,
+  fetchFromGitHub,
+  stdenv,
+  texinfo,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "chsrc";
+  version = "0.1.9";
+
+  src = fetchFromGitHub {
+    owner = "RubyMetric";
+    repo = finalAttrs.pname;
+    rev = "v${finalAttrs.version}";
+    hash = "sha256-MwT6SuDisJ2ynxlOqAUA8WjhrTeUcyoAMArehnby8Yw=";
+  };
+
+  nativeBuildInputs = [ texinfo ];
+
+  patches = [
+    ./disable-static-compiling.patch
+  ];
+
+  installPhase = ''
+    runHook preInstall
+    install -Dm755 chsrc $out/bin/chsrc
+    install -Dm644 doc/chsrc.1 -t $out/share/man/man1/
+    makeinfo doc/chsrc.texi --output=chsrc.info
+    install -Dm 644 chsrc.info -t $out/share/info/
+    runHook postInstall
+  '';
+
+  meta = {
+    description = "Change Source everywhere for every software";
+    homepage = "https://chsrc.run/";
+    changelog = "https://github.com/RubyMetric/chsrc/releases/tag/v${finalAttrs.version}";
+    license = with lib.licenses; [
+      gpl3Plus
+      mit
+    ];
+    maintainers = with lib.maintainers; [ cryo ];
+    platforms = lib.platforms.all;
+    mainProgram = "chsrc";
+  };
+})
@@ -11,16 +11,16 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
  pname = "clouddrive2";
-  version = "0.8.3";
+  version = "0.8.5";

  src = fetchurl {
    url = "https://github.com/cloud-fs/cloud-fs.github.io/releases/download/v${finalAttrs.version}/clouddrive-2-${os}-${arch}-${finalAttrs.version}.tgz";
    hash =
      {
-        x86_64-linux = "sha256-5vyWMoDASzRa9m2UueoyMbmK8JPUpplqk0/uv8fHPAU=";
-        aarch64-linux = "sha256-zfar/dZkSVSrnrRpfF4RnwvkPVzmdLJa4W9Ds8NNNaI=";
-        x86_64-darwin = "sha256-3jab0NxGH+cac2Ughq/l2ZAQLISD7z+WBtFFyiFc+5A=";
-        aarch64-darwin = "sha256-SO5L9aBMN5pYloBeVH1uQO0QeiHzDK+6kHVEg8uYnTo=";
+        x86_64-linux = "sha256-6zdP0d5XyBYG7+SGqb2DSaD6rJrBn8OjGr9BXfP1Ctc=";
+        aarch64-linux = "sha256-7u/AKZGL/AkUsakZexC/oxgjoayaxH7OiRE+xnH+Gus=";
+        x86_64-darwin = "sha256-/uDxZVlULl3PnuAaF7kWAyukaQoF7DV8m5gowTFdMEQ=";
+        aarch64-darwin = "sha256-xZ60pi2JYSLDLaR0Qe/fyEhzyu17U2fbDp1lo2qViIs=";
      }
      .${stdenv.hostPlatform.system} or (throw "unsupported system ${stdenv.hostPlatform.system}");
  };
@@ -1,6 +1,8 @@
-{ lib
-, buildGoModule
-, fetchFromGitHub
+{
+  lib,
+  buildGoModule,
+  fetchFromGitHub,
+  versionCheckHook,
 }:

 buildGoModule rec {
@@ -16,17 +18,25 @@ buildGoModule rec {

  vendorHash = "sha256-6J9AWONLP/FvR0dXt5Zx4n+kTpmnxF79HcWVFp9OZ0g=";

+  subPackages = [ "cmd/cloudlist/" ];
+
  ldflags = [
    "-w"
    "-s"
  ];

+  nativeInstallCheckInputs = [ versionCheckHook ];
+
+  doInstallCheck = true;
+
+  versionCheckProgramArg = [ "--version" ];
+
  meta = with lib; {
    description = "Tool for listing assets from multiple cloud providers";
-    mainProgram = "cloudlist";
    homepage = "https://github.com/projectdiscovery/cloudlist";
    changelog = "https://github.com/projectdiscovery/cloudlist/releases/tag/v${version}";
    license = licenses.mit;
    maintainers = with maintainers; [ fab ];
+    mainProgram = "cloudlist";
  };
 }
--- a/Show More
+++ b/Show More