Merge remote-tracking branch 'origin/staging-next' into staging

Conflicts:
- pkgs/tools/misc/watchlog/default.nix

.github/workflows/check-by-name.yml

@@ -58,7 +58,7 @@ jobs:
 
             if [[ "$mergeable" == "null" ]]; then
               if (( retryCount == 0 )); then
-                echo "Not retrying anymore, probably GitHub is having internal issues"
+                echo "Not retrying anymore. It's likely that GitHub is having internal issues: check https://www.githubstatus.com/"
                 exit 1
               else
                 (( retryCount -= 1 )) || true

doc/build-helpers/fetchers.chapter.md

@@ -869,7 +869,7 @@ It produces packages that cannot be built automatically.
 fetchtorrent {
   config = { peer-limit-global = 100; };
   url = "magnet:?xt=urn:btih:dd8255ecdc7ca55fb0bbf81323d87062db1f6d1c";
-  sha256 = "";
+  hash = "";
 }
 ```
 

doc/languages-frameworks/dart.section.md

@@ -114,7 +114,7 @@ flutter322.buildFlutterApplication {
     owner = "canonical";
     repo = "firmware-updater";
     rev = "6e7dbdb64e344633ea62874b54ff3990bd3b8440";
-    sha256 = "sha256-s5mwtr5MSPqLMN+k851+pFIFFPa0N1hqz97ys050tFA=";
+    hash = "sha256-s5mwtr5MSPqLMN+k851+pFIFFPa0N1hqz97ys050tFA=";
     fetchSubmodules = true;
   };
 

doc/languages-frameworks/dotnet.section.md

@@ -194,7 +194,7 @@ This helper has the same arguments as `buildDotnetModule`, with a few difference
 
 * `pname` and `version` are required, and will be used to find the NuGet package of the tool
 * `nugetName` can be used to override the NuGet package name that will be downloaded, if it's different from `pname`
-* `nugetSha256` is the hash of the fetched NuGet package. Set this to `lib.fakeHash256` for the first build, and it will error out, giving you the proper hash. Also remember to update it during version updates (it will not error out if you just change the version while having a fetched package in `/nix/store`)
+* `nugetHash` is the hash of the fetched NuGet package. `nugetSha256` is also supported, but not recommended. Set this to `lib.fakeHash` for the first build, and it will error out, giving you the proper hash. Also remember to update it during version updates (it will not error out if you just change the version while having a fetched package in `/nix/store`)
 * `dotnet-runtime` is set to `dotnet-sdk` by default. When changing this, remember that .NET tools fetched from NuGet require an SDK.
 
 Here is an example of packaging `pbm`, an unfree binary without source available:
@@ -205,7 +205,7 @@ buildDotnetGlobalTool {
   pname = "pbm";
   version = "1.3.1";
 
-  nugetSha256 = "sha256-ZG2HFyKYhVNVYd2kRlkbAjZJq88OADe3yjxmLuxXDUo=";
+  nugetHash = "sha256-ZG2HFyKYhVNVYd2kRlkbAjZJq88OADe3yjxmLuxXDUo=";
 
   meta = {
     homepage = "https://cmd.petabridge.com/index.html";
@@ -241,15 +241,15 @@ $ nuget-to-nix out > deps.nix
 Which `nuget-to-nix` will generate an output similar to below
 ```nix
 { fetchNuGet }: [
-  (fetchNuGet { pname = "FosterFramework"; version = "0.1.15-alpha"; sha256 = "0pzsdfbsfx28xfqljcwy100xhbs6wyx0z1d5qxgmv3l60di9xkll"; })
-  (fetchNuGet { pname = "Microsoft.AspNetCore.App.Runtime.linux-x64"; version = "8.0.1"; sha256 = "1gjz379y61ag9whi78qxx09bwkwcznkx2mzypgycibxk61g11da1"; })
-  (fetchNuGet { pname = "Microsoft.NET.ILLink.Tasks"; version = "8.0.1"; sha256 = "1drbgqdcvbpisjn8mqfgba1pwb6yri80qc4mfvyczqwrcsj5k2ja"; })
-  (fetchNuGet { pname = "Microsoft.NETCore.App.Runtime.linux-x64"; version = "8.0.1"; sha256 = "1g5b30f4l8a1zjjr3b8pk9mcqxkxqwa86362f84646xaj4iw3a4d"; })
-  (fetchNuGet { pname = "SharpGLTF.Core"; version = "1.0.0-alpha0031"; sha256 = "0ln78mkhbcxqvwnf944hbgg24vbsva2jpih6q3x82d3h7rl1pkh6"; })
-  (fetchNuGet { pname = "SharpGLTF.Runtime"; version = "1.0.0-alpha0031"; sha256 = "0lvb3asi3v0n718qf9y367km7qpkb9wci38y880nqvifpzllw0jg"; })
-  (fetchNuGet { pname = "Sledge.Formats"; version = "1.2.2"; sha256 = "1y0l66m9rym0p1y4ifjlmg3j9lsmhkvbh38frh40rpvf1axn2dyh"; })
-  (fetchNuGet { pname = "Sledge.Formats.Map"; version = "1.1.5"; sha256 = "1bww60hv9xcyxpvkzz5q3ybafdxxkw6knhv97phvpkw84pd0jil6"; })
-  (fetchNuGet { pname = "System.Numerics.Vectors"; version = "4.5.0"; sha256 = "1kzrj37yzawf1b19jq0253rcs8hsq1l2q8g69d7ipnhzb0h97m59"; })
+  (fetchNuGet { pname = "FosterFramework"; version = "0.1.15-alpha"; hash = "sha256-lM6eYgOGjl1fx6WFD7rnRi/YAQieM0mx60h0p5dr+l8="; })
+  (fetchNuGet { pname = "Microsoft.AspNetCore.App.Runtime.linux-x64"; version = "8.0.1"; hash = "sha256-QbUQXjCzr8j8u/5X0af9jE++EugdoxMhT08F49MZX74="; })
+  (fetchNuGet { pname = "Microsoft.NET.ILLink.Tasks"; version = "8.0.1"; hash = "sha256-SopZpGaZ48/8dpUwDFDM3ix+g1rP4Yqs1PGuzRp+K7c="; })
+  (fetchNuGet { pname = "Microsoft.NETCore.App.Runtime.linux-x64"; version = "8.0.1"; hash = "sha256-jajBI5GqG2IIcsIMgxTHfXbMapoXrZGl/EEhShwYq7w="; })
+  (fetchNuGet { pname = "SharpGLTF.Core"; version = "1.0.0-alpha0031"; hash = "sha256-Bs4baD5wNIH6wAbGK4Xaem0i3luQkOQs37izBWdFx1I="; })
+  (fetchNuGet { pname = "SharpGLTF.Runtime"; version = "1.0.0-alpha0031"; hash = "sha256-TwJO6b8ubmwBQh6NyHha8+JT5zHDJ4dROBbsEbUaa1M="; })
+  (fetchNuGet { pname = "Sledge.Formats"; version = "1.2.2"; hash = "sha256-0Ddhuwpu3wwIzA4NuPaEVdMkx6tUukh8uKD6nKoxFPg="; })
+  (fetchNuGet { pname = "Sledge.Formats.Map"; version = "1.1.5"; hash = "sha256-hkYJ2iWIz7vhPWlDOw2fvTenlh+4/D/37Z71tCEwnK8="; })
+  (fetchNuGet { pname = "System.Numerics.Vectors"; version = "4.5.0"; hash = "sha256-qdSTIFgf2htPS+YhLGjAGiLN8igCYJnCCo6r78+Q+c8="; })
 ]
 ```
 

lib/default.nix

@@ -66,7 +66,7 @@ let
 
     # TODO: For consistency, all builtins should also be available from a sub-library;
     # these are the only ones that are currently not
-    inherit (builtins) addErrorContext isPath trace;
+    inherit (builtins) addErrorContext isPath trace typeOf unsafeGetAttrPos;
     inherit (self.trivial) id const pipe concat or and xor bitAnd bitOr bitXor
       bitNot boolToString mergeAttrs flip mapNullable inNixShell isFloat min max
       importJSON importTOML warn warnIf warnIfNot throwIf throwIfNot checkListOfEnum

lib/modules.nix

@@ -2,6 +2,7 @@
 
 let
   inherit (lib)
+    addErrorContext
     all
     any
     attrByPath
@@ -13,13 +14,16 @@ let
     elem
     filter
     foldl'
+    functionArgs
     getAttrFromPath
+    genericClosure
     head
     id
     imap1
     isAttrs
     isBool
     isFunction
+    isInOldestRelease
     isList
     isString
     length
@@ -32,9 +36,17 @@ let
     optionalString
     recursiveUpdate
     reverseList sort
+    seq
     setAttrByPath
+    substring
+    throwIfNot
+    trace
+    typeOf
     types
+    unsafeGetAttrPos
+    warn
     warnIf
+    zipAttrs
     zipAttrsWith
     ;
   inherit (lib.options)
@@ -89,8 +101,8 @@ let
                 }:
     let
       withWarnings = x:
-        lib.warnIf (evalModulesArgs?args) "The args argument to evalModules is deprecated. Please set config._module.args instead."
-        lib.warnIf (evalModulesArgs?check) "The check argument to evalModules is deprecated. Please set config._module.check instead."
+        warnIf (evalModulesArgs?args) "The args argument to evalModules is deprecated. Please set config._module.args instead."
+        warnIf (evalModulesArgs?check) "The check argument to evalModules is deprecated. Please set config._module.check instead."
         x;
 
       legacyModules =
@@ -265,9 +277,9 @@ let
               let
                 optText = showOption (prefix ++ firstDef.prefix);
                 defText =
-                  builtins.addErrorContext
+                  addErrorContext
                     "while evaluating the error message for definitions for `${optText}', which is an option that does not exist"
-                    (builtins.addErrorContext
+                    (addErrorContext
                       "while evaluating a definition from `${firstDef.file}'"
                       ( showDefs [ firstDef ])
                     );
@@ -298,7 +310,7 @@ let
             else throw baseMsg
         else null;
 
-      checked = builtins.seq checkUnmatched;
+      checked = seq checkUnmatched;
 
       extendModules = extendArgs@{
         modules ? [],
@@ -312,7 +324,7 @@ let
             prefix = extendArgs.prefix or evalModulesArgs.prefix or [];
           });
 
-      type = lib.types.submoduleWith {
+      type = types.submoduleWith {
         inherit modules specialArgs class;
       };
 
@@ -344,8 +356,8 @@ let
           else
             throw (
               "Could not load a value as a module, because it is of type ${lib.strings.escapeNixString m._type}"
-              + lib.optionalString (fallbackFile != unknownModule) ", in file ${toString fallbackFile}."
-              + lib.optionalString (m._type == "configuration") " If you do intend to import this configuration, please only import the modules that make up the configuration. You may have to create a `let` binding, file or attribute to give yourself access to the relevant modules.\nWhile loading a configuration into the module system is a very sensible idea, it can not be done cleanly in practice."
+              + optionalString (fallbackFile != unknownModule) ", in file ${toString fallbackFile}."
+              + optionalString (m._type == "configuration") " If you do intend to import this configuration, please only import the modules that make up the configuration. You may have to create a `let` binding, file or attribute to give yourself access to the relevant modules.\nWhile loading a configuration into the module system is a very sensible idea, it can not be done cleanly in practice."
                # Extended explanation: That's because a finalized configuration is more than just a set of modules. For instance, it has its own `specialArgs` that, by the nature of `specialArgs` can't be loaded through `imports` or the the `modules` argument. So instead, we have to ask you to extract the relevant modules and use those instead. This way, we keep the module system comparatively simple, and hopefully avoid a bad surprise down the line.
             )
         else if isList m then
@@ -415,7 +427,7 @@ let
           moduleKey = file: m:
             if isString m
             then
-              if builtins.substring 0 1 m == "/"
+              if substring 0 1 m == "/"
               then m
               else toString modulesPath + "/" + m
 
@@ -433,11 +445,11 @@ let
 
             else if isAttrs m
             then throw "Module `${file}` contains a disabledModules item that is an attribute set, presumably a module, that does not have a `key` attribute. This means that the module system doesn't have any means to identify the module that should be disabled. Make sure that you've put the correct value in disabledModules: a string path relative to modulesPath, a path value, or an attribute set with a `key` attribute."
-            else throw "Each disabledModules item must be a path, string, or a attribute set with a key attribute, or a value supported by toString. However, one of the disabledModules items in `${toString file}` is none of that, but is of type ${builtins.typeOf m}.";
+            else throw "Each disabledModules item must be a path, string, or a attribute set with a key attribute, or a value supported by toString. However, one of the disabledModules items in `${toString file}` is none of that, but is of type ${typeOf m}.";
 
           disabledKeys = concatMap ({ file, disabled }: map (moduleKey file) disabled) disabled;
           keyFilter = filter (attrs: ! elem attrs.key disabledKeys);
-        in map (attrs: attrs.module) (builtins.genericClosure {
+        in map (attrs: attrs.module) (genericClosure {
           startSet = keyFilter modules;
           operator = attrs: keyFilter attrs.modules;
         });
@@ -475,7 +487,7 @@ let
         }
     else
       # shorthand syntax
-      lib.throwIfNot (isAttrs m) "module ${file} (${key}) does not look like a module."
+      throwIfNot (isAttrs m) "module ${file} (${key}) does not look like a module."
       { _file = toString m._file or file;
         _class = m._class or null;
         key = toString m.key or key;
@@ -485,10 +497,10 @@ let
         config = addFreeformType (removeAttrs m ["_class" "_file" "key" "disabledModules" "require" "imports" "freeformType"]);
       };
 
-  applyModuleArgsIfFunction = key: f: args@{ config, options, lib, ... }:
+  applyModuleArgsIfFunction = key: f: args@{ config, ... }:
     if isFunction f then applyModuleArgs key f args else f;
 
-  applyModuleArgs = key: f: args@{ config, options, lib, ... }:
+  applyModuleArgs = key: f: args@{ config, ... }:
     let
       # Module arguments are resolved in a strict manner when attribute set
       # deconstruction is used.  As the arguments are now defined with the
@@ -503,10 +515,10 @@ let
       # not their values.  The values are forwarding the result of the
       # evaluation of the option.
       context = name: ''while evaluating the module argument `${name}' in "${key}":'';
-      extraArgs = builtins.mapAttrs (name: _:
-        builtins.addErrorContext (context name)
+      extraArgs = mapAttrs (name: _:
+        addErrorContext (context name)
           (args.${name} or config._module.args.${name})
-      ) (lib.functionArgs f);
+      ) (functionArgs f);
 
       # Note: we append in the opposite order such that we can add an error
       # context on the explicit arguments of "args" too. This update
@@ -547,16 +559,16 @@ let
           (n: concatLists)
           (map
             (module: let subtree = module.options; in
-              if !(builtins.isAttrs subtree) then
+              if !(isAttrs subtree) then
                 throw ''
-                  An option declaration for `${builtins.concatStringsSep "." prefix}' has type
-                  `${builtins.typeOf subtree}' rather than an attribute set.
+                  An option declaration for `${concatStringsSep "." prefix}' has type
+                  `${typeOf subtree}' rather than an attribute set.
                   Did you mean to define this outside of `options'?
                 ''
               else
                 mapAttrs
                   (n: option:
-                    [{ inherit (module) _file; pos = builtins.unsafeGetAttrPos n subtree; options = option; }]
+                    [{ inherit (module) _file; pos = unsafeGetAttrPos n subtree; options = option; }]
                   )
                   subtree
               )
@@ -565,17 +577,17 @@ let
       # The root of any module definition must be an attrset.
       checkedConfigs =
         assert
-          lib.all
+          all
             (c:
               # TODO: I have my doubts that this error would occur when option definitions are not matched.
               #       The implementation of this check used to be tied to a superficially similar check for
               #       options, so maybe that's why this is here.
               isAttrs c.config || throw ''
-                In module `${c.file}', you're trying to define a value of type `${builtins.typeOf c.config}'
+                In module `${c.file}', you're trying to define a value of type `${typeOf c.config}'
                 rather than an attribute set for the option
-                `${builtins.concatStringsSep "." prefix}'!
+                `${concatStringsSep "." prefix}'!
 
-                This usually happens if `${builtins.concatStringsSep "." prefix}' has option
+                This usually happens if `${concatStringsSep "." prefix}' has option
                 definitions inside that are not matched. Please check how to properly define
                 this option by e.g. referring to `man 5 configuration.nix'!
               ''
@@ -667,7 +679,7 @@ let
                 let
                   nonOptions = filter (m: !isOption m.options) decls;
                 in
-                throw "The option `${showOption loc}' in module `${(lib.head optionDecls)._file}' would be a parent of the following options, but its type `${(lib.head optionDecls).options.type.description or "<no description>"}' does not support nested options.\n${
+                throw "The option `${showOption loc}' in module `${(head optionDecls)._file}' would be a parent of the following options, but its type `${(head optionDecls).options.type.description or "<no description>"}' does not support nested options.\n${
                   showRawDecls loc nonOptions
                 }"
           else
@@ -806,7 +818,7 @@ let
           "The type `types.${opt.type.name}' of option `${showOption loc}' defined in ${showFiles opt.declarations} is deprecated. ${opt.type.deprecationMessage}";
 
     in warnDeprecation opt //
-      { value = builtins.addErrorContext "while evaluating the option `${showOption loc}':" value;
+      { value = addErrorContext "while evaluating the option `${showOption loc}':" value;
         inherit (res.defsFinal') highestPrio;
         definitions = map (def: def.value) res.defsFinal;
         files = map (def: def.file) res.defsFinal;
@@ -822,7 +834,7 @@ let
       let
         # Process mkMerge and mkIf properties.
         defs' = concatMap (m:
-          map (value: { inherit (m) file; inherit value; }) (builtins.addErrorContext "while evaluating definitions from `${m.file}':" (dischargeProperties m.value))
+          map (value: { inherit (m) file; inherit value; }) (addErrorContext "while evaluating definitions from `${m.file}':" (dischargeProperties m.value))
         ) defs;
 
         # Process mkOverride properties.
@@ -972,12 +984,12 @@ let
   mergeAttrDefinitionsWithPrio = opt:
         let
             defsByAttr =
-              lib.zipAttrs (
-                lib.concatLists (
-                  lib.concatMap
+              zipAttrs (
+                concatLists (
+                  concatMap
                     ({ value, ... }@def:
                       map
-                        (lib.mapAttrsToList (k: value: { ${k} = def // { inherit value; }; }))
+                        (mapAttrsToList (k: value: { ${k} = def // { inherit value; }; }))
                         (pushDownProperties value)
                     )
                     opt.definitionsWithLocations
@@ -985,9 +997,9 @@ let
               );
         in
           assert opt.type.name == "attrsOf" || opt.type.name == "lazyAttrsOf";
-          lib.mapAttrs
+          mapAttrs
                 (k: v:
-                  let merging = lib.mergeDefinitions (opt.loc ++ [k]) opt.type.nestedTypes.elemType v;
+                  let merging = mergeDefinitions (opt.loc ++ [k]) opt.type.nestedTypes.elemType v;
                   in {
                     value = merging.mergedValue;
                     inherit (merging.defsFinal') highestPrio;
@@ -1023,9 +1035,9 @@ let
   mkForce = mkOverride 50;
   mkVMOverride = mkOverride 10; # used by ‘nixos-rebuild build-vm’
 
-  defaultPriority = lib.warnIf (lib.isInOldestRelease 2305) "lib.modules.defaultPriority is deprecated, please use lib.modules.defaultOverridePriority instead." defaultOverridePriority;
+  defaultPriority = warnIf (isInOldestRelease 2305) "lib.modules.defaultPriority is deprecated, please use lib.modules.defaultOverridePriority instead." defaultOverridePriority;
 
-  mkFixStrictness = lib.warn "lib.mkFixStrictness has no effect and will be removed. It returns its argument unmodified, so you can just remove any calls." id;
+  mkFixStrictness = warn "lib.mkFixStrictness has no effect and will be removed. It returns its argument unmodified, so you can just remove any calls." id;
 
   mkOrder = priority: content:
     { _type = "order";
@@ -1121,7 +1133,7 @@ let
     inherit from to;
     visible = false;
     warn = true;
-    use = builtins.trace "Obsolete option `${showOption from}' is used. It was renamed to `${showOption to}'.";
+    use = trace "Obsolete option `${showOption from}' is used. It was renamed to `${showOption to}'.";
   };
 
   mkRenamedOptionModuleWith = {
@@ -1139,8 +1151,8 @@ let
   }: doRename {
     inherit from to;
     visible = false;
-    warn = lib.isInOldestRelease sinceRelease;
-    use = lib.warnIf (lib.isInOldestRelease sinceRelease)
+    warn = isInOldestRelease sinceRelease;
+    use = warnIf (isInOldestRelease sinceRelease)
       "Obsolete option `${showOption from}' is used. It was renamed to `${showOption to}'.";
   };
 
@@ -1372,8 +1384,8 @@ let
     config = lib.importTOML file;
   };
 
-  private = lib.mapAttrs
-    (k: lib.warn "External use of `lib.modules.${k}` is deprecated. If your use case isn't covered by non-deprecated functions, we'd like to know more and perhaps support your use case well, instead of providing access to these low level functions. In this case please open an issue in https://github.com/nixos/nixpkgs/issues/.")
+  private = mapAttrs
+    (k: warn "External use of `lib.modules.${k}` is deprecated. If your use case isn't covered by non-deprecated functions, we'd like to know more and perhaps support your use case well, instead of providing access to these low level functions. In this case please open an issue in https://github.com/nixos/nixpkgs/issues/.")
     {
       inherit
         applyModuleArgsIfFunction

lib/tests/modules.sh

@@ -94,6 +94,8 @@ checkConfigOutput '^true$' config.result ./module-argument-default.nix
 # gvariant
 checkConfigOutput '^true$' config.assertion ./gvariant.nix
 
+checkConfigOutput '"ok"' config.result ./specialArgs-lib.nix
+
 # https://github.com/NixOS/nixpkgs/pull/131205
 # We currently throw this error already in `config`, but throwing in `config.wrong1` would be acceptable.
 checkConfigError 'It seems as if you.re trying to declare an option by placing it into .config. rather than .options.' config.wrong1 ./error-mkOption-in-config.nix

lib/tests/modules/specialArgs-lib.nix

@@ -0,0 +1,28 @@
+{ config, lib, ... }:
+
+{
+  options = {
+    result = lib.mkOption { };
+    weird = lib.mkOption {
+      type = lib.types.submoduleWith {
+        # I generally recommend against overriding lib, because that leads to
+        # slightly incompatible dialects of the module system.
+        # Nonetheless, it's worth guarding the property that the module system
+        # evaluates with a completely custom lib, as a matter of separation of
+        # concerns.
+        specialArgs.lib = { };
+        modules = [ ];
+      };
+    };
+  };
+  config.weird = args@{ ... /* note the lack of a `lib` argument */ }:
+  assert args.lib == { };
+  assert args.specialArgs == { lib = { }; };
+  {
+    options.foo = lib.mkOption { };
+    config.foo = lib.mkIf true "alright";
+  };
+  config.result =
+    assert config.weird.foo == "alright";
+    "ok";
+}

maintainers/maintainer-list.nix

@@ -2420,14 +2420,6 @@
     githubId = 7118777;
     keys = [ { fingerprint = "E9A3 7864 2165 28CE 507C  CA82 72EA BF75 C331 CD25"; } ];
   };
-  Benjamin-L = {
-    name = "Benjamin Lee";
-    email = "benjamin@computer.surgery";
-    matrix = "@benjamin:computer.surgery";
-    github = "Benjamin-L";
-    githubId = 6504174;
-    keys = [ { fingerprint = "9D84 09A0 44FC 1EEB AE2D  FA30 FB96 24E2 885D 55A4"; } ];
-  };
   benkuhn = {
     email = "ben@ben-kuhn.com";
     github = "ben-kuhn";
@@ -2985,12 +2977,6 @@
     githubId = 2379774;
     name = "Sean Buckley";
   };
-  buffet = {
-    email = "niclas@countingsort.com";
-    github = "buffet";
-    githubId = 33751841;
-    name = "Niclas Meyer";
-  };
   bugworm = {
     email = "bugworm@zoho.com";
     github = "bugworm";
@@ -5101,6 +5087,12 @@
     githubId = 56017218;
     keys = [ { fingerprint = "E6F4 BFB4 8DE3 893F 68FC  A15F FF5F 4B30 A41B BAC8"; } ];
   };
+  Djabx = {
+    email = "alexandre@badez.eu";
+    github = "Djabx";
+    githubId = 69534;
+    name = "Alexandre Badez";
+  };
   djacu = {
     email = "daniel.n.baker@gmail.com";
     github = "djacu";
@@ -8049,6 +8041,12 @@
     name = "Nova Witterick";
     keys = [ { fingerprint = "4304 6B43 8D83 078E 3DF7  10D6 DEB0 E15C 6D2A 5A7C"; } ];
   };
+  heywoodlh = {
+    email = "nixpkgs@heywoodlh.io";
+    github = "heywoodlh";
+    githubId = 18178614;
+    name = "Spencer Heywood";
+  };
   hh = {
     email = "hh@m-labs.hk";
     github = "HarryMakes";
@@ -8966,6 +8964,13 @@
     github = "jali-clarke";
     githubId = 17733984;
   };
+  jamalam = {
+    email = "james@jamalam.tech";
+    name = "jamalam";
+    github = "Jamalam360";
+    githubId = 56727311;
+    keys = [ { fingerprint = "B1B2 2BA0 FC39 D4B4 2240  5F55 D86C D68E 8DB2 E368"; } ];
+  };
   james-atkins = {
     name = "James Atkins";
     github = "james-atkins";
@@ -11435,6 +11440,13 @@
     githubId = 101508537;
     name = "Yuchen He";
   };
+  LilleAila = {
+    name = "Olai";
+    email = "olai@olai.dev";
+    github = "LilleAila";
+    githubId = 67327023;
+    keys = [ { fingerprint = "8185 29F9 BB4C 33F0 69BB  9782 D1AC CDCF 2B9B 9799"; } ];
+  };
   lillycham = {
     email = "lillycat332@gmail.com";
     github = "lillycat332";
@@ -14699,12 +14711,6 @@
     github = "nullishamy";
     githubId = 99221043;
   };
-  nullx76 = {
-    email = "nix@xirion.net";
-    github = "NULLx76";
-    githubId = 1809198;
-    name = "Victor Roest";
-  };
   numinit = {
     email = "me@numin.it";
     github = "numinit";
@@ -19511,13 +19517,6 @@
     githubId = 28858039;
     name = "Tuomas Mäkinen";
   };
-  tadeokondrak = {
-    email = "me@tadeo.ca";
-    github = "tadeokondrak";
-    githubId = 4098453;
-    name = "Tadeo Kondrak";
-    keys = [ { fingerprint = "0F2B C0C7 E77C 5B42 AC5B  4C18 FBE6 07FC C495 16D3"; } ];
-  };
   tadfisher = {
     email = "tadfisher@gmail.com";
     github = "tadfisher";

nixos/doc/manual/release-notes/rl-2411.section.md

@@ -8,6 +8,7 @@
 
 - [AMDVLK](https://github.com/GPUOpen-Drivers/AMDVLK), AMD's open source Vulkan driver, is now available to be configured as `hardware.amdgpu.amdvlk` option.
   This also allows configuring runtime settings of AMDVLK and enabling experimental features.
+- The `moonlight-qt` package ([Moonlight game streaming](https://moonlight-stream.org/)) now has HDR support on Linux systems.
 
 ## New Services {#sec-release-24.11-new-services}
 
@@ -19,10 +20,14 @@
 
 - [Flood](https://flood.js.org/), a beautiful WebUI for various torrent clients. Available as [services.flood](options.html#opt-services.flood).
 
+- [Eintopf](https://eintopf.info), community event and calendar web application. Available as [services.eintopf](options.html#opt-services.eintopf).
+
 - [Renovate](https://github.com/renovatebot/renovate), a dependency updating tool for various git forges and language ecosystems. Available as [services.renovate](#opt-services.renovate.enable).
 
 - [wg-access-server](https://github.com/freifunkMUC/wg-access-server/), an all-in-one WireGuard VPN solution with a web ui for connecting devices. Available at [services.wg-access-server](#opt-services.wg-access-server.enable).
 
+- [Envision](https://gitlab.com/gabmus/envision), a UI for building, configuring and running Monado, the open source OpenXR runtime. Available as [programs.envision](#opt-programs.envision.enable).
+
 - [Playerctld](https://github.com/altdesktop/playerctl), a daemon to track media player activity. Available as [services.playerctld](option.html#opt-services.playerctld).
 
 ## Backward Incompatibilities {#sec-release-24.11-incompatibilities}
@@ -87,6 +92,10 @@
 
 - `services.ddclient.use` has been deprecated: `ddclient` now supports separate IPv4 and IPv6 configuration. Use `services.ddclient.usev4` and `services.ddclient.usev6` instead.
 
+- `teleport` has been upgraded from major version 15 to major version 16.
+  Refer to upstream [upgrade instructions](https://goteleport.com/docs/management/operations/upgrading/)
+  and [release notes for v16](https://goteleport.com/docs/changelog/#1600-061324).
+
 - `vaultwarden` lost the capability to bind to privileged ports. If you rely on
    this behavior, override the systemd unit to allow `CAP_NET_BIND_SERVICE` in
    your local configuration.
@@ -172,6 +181,10 @@
 - The `services.prometheus.exporters.minio` option has been removed, as it's upstream implementation was broken and unmaintained.
   Minio now has built-in [Prometheus metrics exposure](https://min.io/docs/minio/linux/operations/monitoring/collect-minio-metrics-using-prometheus.html), which can be used instead.
 
+- The `services.patroni.raft` option has been removed, as Raft has been [deprecated by upstream since 3.0.0](https://github.com/patroni/patroni/blob/master/docs/releases.rst#version-300)
+
+- `services.roundcube.maxAttachmentSize` will multiply the value set with `1.37` to offset overhead introduced by the base64 encoding applied to attachments.
+
 ## Other Notable Changes {#sec-release-24.11-notable-changes}
 
 <!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->
@@ -195,6 +208,9 @@
   The derivation now installs "impl" headers selectively instead of by a wildcard.
   Use `imgui.src` if you just want to access the unpacked sources.
 
+- `security.pam.u2f` now follows RFC42.
+  All module options are now settable through the freeform `.settings`.
+
 - Cinnamon has been updated to 6.2.
   - Following Mint 22 defaults, the Cinnamon module no longer ships geary and hexchat by default.
   - Nemo is now built with gtk-layer-shell support, note that for now it will be expected to see nemo-desktop

nixos/modules/module-list.nix

@@ -180,6 +180,7 @@
   ./programs/dublin-traceroute.nix
   ./programs/ecryptfs.nix
   ./programs/environment.nix
+  ./programs/envision.nix
   ./programs/evince.nix
   ./programs/extra-container.nix
   ./programs/fcast-receiver.nix
@@ -1369,6 +1370,7 @@
   ./services/web-apps/documize.nix
   ./services/web-apps/dokuwiki.nix
   ./services/web-apps/dolibarr.nix
+  ./services/web-apps/eintopf.nix
   ./services/web-apps/engelsystem.nix
   ./services/web-apps/ethercalc.nix
   ./services/web-apps/filesender.nix

nixos/modules/profiles/qemu-guest.nix

@@ -6,12 +6,4 @@
 {
   boot.initrd.availableKernelModules = [ "virtio_net" "virtio_pci" "virtio_mmio" "virtio_blk" "virtio_scsi" "9p" "9pnet_virtio" ];
   boot.initrd.kernelModules = [ "virtio_balloon" "virtio_console" "virtio_rng" ];
-
-  boot.initrd.postDeviceCommands = lib.mkIf (!config.boot.initrd.systemd.enable)
-    ''
-      # Set the system time from the hardware clock to work around a
-      # bug in qemu-kvm > 1.5.2 (where the VM clock is initialised
-      # to the *boot time* of the host).
-      hwclock -s
-    '';
 }

nixos/modules/programs/envision.nix

@@ -0,0 +1,43 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+let
+  cfg = config.programs.envision;
+in
+{
+
+  options = {
+    programs.envision = {
+      enable = lib.mkEnableOption "envision";
+
+      package = lib.mkPackageOption pkgs "envision" {};
+
+      openFirewall = lib.mkEnableOption "the default ports in the firewall for the WiVRn server" // {
+        default = true;
+      };
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    services.avahi = {
+      enable = true;
+      publish = {
+        enable = true;
+        userServices = true;
+      };
+    };
+
+    environment.systemPackages = [ cfg.package ];
+
+    networking.firewall = lib.mkIf cfg.openFirewall {
+      allowedTCPPorts = [ 9757 ];
+      allowedUDPPorts = [ 9757 ];
+    };
+  };
+
+  meta.maintainers = pkgs.envision.meta.maintainers;
+}

nixos/modules/security/pam.nix

@@ -7,6 +7,13 @@ with lib;
 
 let
 
+  moduleSettingsType = with types; attrsOf (nullOr (oneOf [ bool str int pathInStore ]));
+  moduleSettingsDescription = ''
+    Boolean values render just the key if true, and nothing if false.
+    Null values are ignored.
+    All other values are rendered as key-value pairs.
+  '';
+
   mkRulesTypeOption = type: mkOption {
     # These options are experimental and subject to breaking changes without notice.
     description = ''
@@ -71,12 +78,12 @@ let
           '';
         };
         settings = mkOption {
-          type = with types; attrsOf (nullOr (oneOf [ bool str int pathInStore ]));
+          type = moduleSettingsType;
           default = {};
           description = ''
             Settings to add as `module-arguments`.
 
-            Boolean values render just the key if true, and nothing if false. Null values are ignored. All other values are rendered as key-value pairs.
+            ${moduleSettingsDescription}
           '';
         };
       };
@@ -660,11 +667,7 @@ let
           (let p11 = config.security.pam.p11; in { name = "p11"; enable = cfg.p11Auth; control = p11.control; modulePath = "${pkgs.pam_p11}/lib/security/pam_p11.so"; args = [
             "${pkgs.opensc}/lib/opensc-pkcs11.so"
           ]; })
-          (let u2f = config.security.pam.u2f; in { name = "u2f"; enable = cfg.u2fAuth; control = u2f.control; modulePath = "${pkgs.pam_u2f}/lib/security/pam_u2f.so"; settings = {
-            inherit (u2f) debug interactive cue origin;
-            authfile = u2f.authFile;
-            appid = u2f.appId;
-          }; })
+          (let u2f = config.security.pam.u2f; in { name = "u2f"; enable = cfg.u2fAuth; control = u2f.control; modulePath = "${pkgs.pam_u2f}/lib/security/pam_u2f.so"; inherit (u2f) settings; })
           (let ussh = config.security.pam.ussh; in { name = "ussh"; enable = config.security.pam.ussh.enable && cfg.usshAuth; control = ussh.control; modulePath = "${pkgs.pam_ussh}/lib/security/pam_ussh.so"; settings = {
             ca_file = ussh.caFile;
             authorized_principals = ussh.authorizedPrincipals;
@@ -952,6 +955,12 @@ in
   imports = [
     (mkRenamedOptionModule [ "security" "pam" "enableU2F" ] [ "security" "pam" "u2f" "enable" ])
     (mkRenamedOptionModule [ "security" "pam" "enableSSHAgentAuth" ] [ "security" "pam" "sshAgentAuth" "enable" ])
+    (mkRenamedOptionModule [ "security" "pam" "u2f" "authFile" ] [ "security" "pam" "u2f" "settings" "authfile" ])
+    (mkRenamedOptionModule [ "security" "pam" "u2f" "appId" ] [ "security" "pam" "u2f" "settings" "appid" ])
+    (mkRenamedOptionModule [ "security" "pam" "u2f" "origin" ] [ "security" "pam" "u2f" "settings" "origin" ])
+    (mkRenamedOptionModule [ "security" "pam" "u2f" "debug" ] [ "security" "pam" "u2f" "settings" "debug" ])
+    (mkRenamedOptionModule [ "security" "pam" "u2f" "interactive" ] [ "security" "pam" "u2f" "settings" "interactive" ])
+    (mkRenamedOptionModule [ "security" "pam" "u2f" "cue" ] [ "security" "pam" "u2f" "settings" "cue" ])
   ];
 
   ###### interface
@@ -1144,57 +1153,6 @@ in
         '';
       };
 
-      authFile = mkOption {
-        default = null;
-        type = with types; nullOr path;
-        description = ''
-          By default `pam-u2f` module reads the keys from
-          {file}`$XDG_CONFIG_HOME/Yubico/u2f_keys` (or
-          {file}`$HOME/.config/Yubico/u2f_keys` if XDG variable is
-          not set).
-
-          If you want to change auth file locations or centralize database (for
-          example use {file}`/etc/u2f-mappings`) you can set this
-          option.
-
-          File format is:
-          `username:first_keyHandle,first_public_key: second_keyHandle,second_public_key`
-          This file can be generated using {command}`pamu2fcfg` command.
-
-          More information can be found [here](https://developers.yubico.com/pam-u2f/).
-        '';
-      };
-
-      appId = mkOption {
-        default = null;
-        type = with types; nullOr str;
-        description = ''
-            By default `pam-u2f` module sets the application
-            ID to `pam://$HOSTNAME`.
-
-            When using {command}`pamu2fcfg`, you can specify your
-            application ID with the `-i` flag.
-
-            More information can be found [here](https://developers.yubico.com/pam-u2f/Manuals/pam_u2f.8.html)
-        '';
-      };
-
-      origin = mkOption {
-        default = null;
-        type = with types; nullOr str;
-        description = ''
-            By default `pam-u2f` module sets the origin
-            to `pam://$HOSTNAME`.
-            Setting origin to an host independent value will allow you to
-            reuse credentials across machines
-
-            When using {command}`pamu2fcfg`, you can specify your
-            application ID with the `-o` flag.
-
-            More information can be found [here](https://developers.yubico.com/pam-u2f/Manuals/pam_u2f.8.html)
-        '';
-      };
-
       control = mkOption {
         default = "sufficient";
         type = types.enum [ "required" "requisite" "sufficient" "optional" ];
@@ -1209,33 +1167,104 @@ in
         '';
       };
 
-      debug = mkOption {
-        default = false;
-        type = types.bool;
-        description = ''
-          Debug output to stderr.
-        '';
-      };
+      settings = mkOption {
+        type = types.submodule {
+          freeformType = moduleSettingsType;
 
-      interactive = mkOption {
-        default = false;
-        type = types.bool;
-        description = ''
-          Set to prompt a message and wait before testing the presence of a U2F device.
-          Recommended if your device doesn’t have a tactile trigger.
-        '';
-      };
+          options = {
+            authfile = mkOption {
+              default = null;
+              type = with types; nullOr path;
+              description = ''
+                By default `pam-u2f` module reads the keys from
+                {file}`$XDG_CONFIG_HOME/Yubico/u2f_keys` (or
+                {file}`$HOME/.config/Yubico/u2f_keys` if XDG variable is
+                not set).
 
-      cue = mkOption {
-        default = false;
-        type = types.bool;
-        description = ''
-          By default `pam-u2f` module does not inform user
-          that he needs to use the u2f device, it just waits without a prompt.
+                If you want to change auth file locations or centralize database (for
+                example use {file}`/etc/u2f-mappings`) you can set this
+                option.
 
-          If you set this option to `true`,
-          `cue` option is added to `pam-u2f`
-          module and reminder message will be displayed.
+                File format is:
+                `username:first_keyHandle,first_public_key: second_keyHandle,second_public_key`
+                This file can be generated using {command}`pamu2fcfg` command.
+
+                More information can be found [here](https://developers.yubico.com/pam-u2f/).
+              '';
+            };
+
+            appid = mkOption {
+              default = null;
+              type = with types; nullOr str;
+              description = ''
+                  By default `pam-u2f` module sets the application
+                  ID to `pam://$HOSTNAME`.
+
+                  When using {command}`pamu2fcfg`, you can specify your
+                  application ID with the `-i` flag.
+
+                  More information can be found [here](https://developers.yubico.com/pam-u2f/Manuals/pam_u2f.8.html)
+              '';
+            };
+
+            origin = mkOption {
+              default = null;
+              type = with types; nullOr str;
+              description = ''
+                  By default `pam-u2f` module sets the origin
+                  to `pam://$HOSTNAME`.
+                  Setting origin to an host independent value will allow you to
+                  reuse credentials across machines
+
+                  When using {command}`pamu2fcfg`, you can specify your
+                  application ID with the `-o` flag.
+
+                  More information can be found [here](https://developers.yubico.com/pam-u2f/Manuals/pam_u2f.8.html)
+              '';
+            };
+
+            debug = mkOption {
+              default = false;
+              type = types.bool;
+              description = ''
+                Debug output to stderr.
+              '';
+            };
+
+            interactive = mkOption {
+              default = false;
+              type = types.bool;
+              description = ''
+                Set to prompt a message and wait before testing the presence of a U2F device.
+                Recommended if your device doesn’t have a tactile trigger.
+              '';
+            };
+
+            cue = mkOption {
+              default = false;
+              type = types.bool;
+              description = ''
+                By default `pam-u2f` module does not inform user
+                that he needs to use the u2f device, it just waits without a prompt.
+
+                If you set this option to `true`,
+                `cue` option is added to `pam-u2f`
+                module and reminder message will be displayed.
+              '';
+            };
+          };
+        };
+        default = { };
+        example = {
+          authfile = "/etc/u2f_keys";
+          authpending_file = "";
+          userpresence = 0;
+          pinverification = 1;
+        };
+        description = ''
+          Options to pass to the PAM module.
+
+          ${moduleSettingsDescription}
         '';
       };
     };

nixos/modules/services/cluster/patroni/default.nix

@@ -10,6 +10,15 @@ let
   configFile = format.generate configFileName cfg.settings;
 in
 {
+  imports = [
+    (lib.mkRemovedOptionModule [ "services" "patroni" "raft" ] ''
+      Raft has been deprecated by upstream.
+    '')
+    (lib.mkRemovedOptionModule [ "services" "patroni" "raftPort" ] ''
+      Raft has been deprecated by upstream.
+    '')
+  ];
+
   options.services.patroni = {
 
     enable = mkEnableOption "Patroni";
@@ -68,7 +77,7 @@ in
       type = types.path;
       default = "/var/lib/patroni";
       description = ''
-        Folder where Patroni data will be written, used by Raft as well if enabled.
+        Folder where Patroni data will be written, this is where the pgpass password file will be written.
       '';
     };
 
@@ -120,22 +129,6 @@ in
       '';
     };
 
-    raft = mkOption {
-      type = types.bool;
-      default = false;
-      description = ''
-        This will configure Patroni to use its own RAFT implementation instead of using a dedicated DCS.
-      '';
-    };
-
-    raftPort = mkOption {
-      type = types.port;
-      default = 5010;
-      description = ''
-        The port on which RAFT listens.
-      '';
-    };
-
     softwareWatchdog = mkOption {
       type = types.bool;
       default = false;
@@ -178,12 +171,6 @@ in
         connect_address = "${cfg.nodeIp}:${toString cfg.restApiPort}";
       };
 
-      raft = mkIf cfg.raft {
-        data_dir = "${cfg.dataDir}/raft";
-        self_addr = "${cfg.nodeIp}:5010";
-        partner_addrs = map (ip: ip + ":5010") cfg.otherNodesIps;
-      };
-
       postgresql = {
         listen = "${cfg.nodeIp}:${toString cfg.postgresqlPort}";
         connect_address = "${cfg.nodeIp}:${toString cfg.postgresqlPort}";
@@ -235,7 +222,7 @@ in
             KillMode = "process";
           }
           (mkIf (cfg.postgresqlDataDir == "/var/lib/postgresql/${cfg.postgresqlPackage.psqlSchema}" && cfg.dataDir == "/var/lib/patroni") {
-            StateDirectory = "patroni patroni/raft postgresql postgresql/${cfg.postgresqlPackage.psqlSchema}";
+            StateDirectory = "patroni postgresql postgresql/${cfg.postgresqlPackage.psqlSchema}";
             StateDirectoryMode = "0750";
           })
         ];
@@ -251,7 +238,6 @@ in
     environment.systemPackages = [
       pkgs.patroni
       cfg.postgresqlPackage
-      (mkIf cfg.raft pkgs.python310Packages.pysyncobj)
     ];
 
     environment.etc."${configFileName}".source = configFile;

nixos/modules/services/continuous-integration/gitlab-runner.nix

@@ -137,8 +137,10 @@ let
             "--builds-dir ${service.buildsDir}"
             ++ optional (service.cloneUrl != null)
             "--clone-url ${service.cloneUrl}"
-            ++ optional (service.preCloneScript != null)
-            "--pre-clone-script ${service.preCloneScript}"
+            ++ optional (service.preGetSourcesScript != null)
+            "--pre-get-sources-script ${service.preGetSourcesScript}"
+            ++ optional (service.postGetSourcesScript != null)
+            "--post-get-sources-script ${service.postGetSourcesScript}"
             ++ optional (service.preBuildScript != null)
             "--pre-build-script ${service.preBuildScript}"
             ++ optional (service.postBuildScript != null)
@@ -495,13 +497,20 @@ in {
               Whitelist allowed services.
             '';
           };
-          preCloneScript = mkOption {
+          preGetSourcesScript = mkOption {
             type = types.nullOr types.path;
             default = null;
             description = ''
               Runner-specific command script executed before code is pulled.
             '';
           };
+          postGetSourcesScript = mkOption {
+            type = types.nullOr types.path;
+            default = null;
+            description = ''
+              Runner-specific command script executed after code is pulled.
+            '';
+          };
           preBuildScript = mkOption {
             type = types.nullOr types.path;
             default = null;

nixos/modules/services/databases/monetdb.nix

@@ -6,7 +6,7 @@ let
   cfg = config.services.monetdb;
 
 in {
-  meta.maintainers = with maintainers; [ StillerHarpo primeos ];
+  meta.maintainers = with maintainers; [ StillerHarpo ];
 
   ###### interface
   options = {

nixos/modules/services/mail/roundcube.nix

@@ -93,13 +93,17 @@ in
     maxAttachmentSize = mkOption {
       type = types.int;
       default = 18;
+      apply = configuredMaxAttachmentSize: "${toString (configuredMaxAttachmentSize * 1.37)}M";
       description = ''
         The maximum attachment size in MB.
-
-        Note: Since roundcube only uses 70% of max upload values configured in php
-        30% is added automatically to [](#opt-services.roundcube.maxAttachmentSize).
+        [upstream issue comment]: https://github.com/roundcube/roundcubemail/issues/7979#issuecomment-808879209
+        ::: {.note}
+        Since there is some overhead in base64 encoding applied to attachments, + 37% will be added
+        to the value set in this option in order to offset the overhead. For example, setting
+        `maxAttachmentSize` to `100` would result in `137M` being the real value in the configuration.
+        See [upstream issue comment] for more details on the motivations behind this.
+        :::
       '';
-      apply = configuredMaxAttachmentSize: "${toString (configuredMaxAttachmentSize * 1.3)}M";
     };
 
     configureNginx = lib.mkOption {

nixos/modules/services/misc/dictd.nix

@@ -62,6 +62,9 @@ in
       description = "DICT.org Dictionary Server";
       wantedBy = [ "multi-user.target" ];
       environment = { LOCALE_ARCHIVE = "/run/current-system/sw/lib/locale/locale-archive"; };
+      # Work around the fact that dictd doesn't handle SIGTERM; it terminates
+      # with code 143 instead of exiting with code 0.
+      serviceConfig.SuccessExitStatus = [ 143 ];
       serviceConfig.Type = "forking";
       script = "${pkgs.dict}/sbin/dictd -s -c ${dictdb}/share/dictd/dictd.conf --locale en_US.UTF-8";
     };

nixos/modules/services/misc/jellyseerr.nix

@@ -9,6 +9,7 @@ in
 
   options.services.jellyseerr = {
     enable = mkEnableOption ''Jellyseerr, a requests manager for Jellyfin'';
+    package = mkPackageOption pkgs "jellyseerr" { };
 
     openFirewall = mkOption {
       type = types.bool;
@@ -32,10 +33,10 @@ in
       serviceConfig = {
         Type = "exec";
         StateDirectory = "jellyseerr";
-        WorkingDirectory = "${pkgs.jellyseerr}/libexec/jellyseerr/deps/jellyseerr";
+        WorkingDirectory = "${cfg.package}/libexec/jellyseerr/deps/jellyseerr";
         DynamicUser = true;
-        ExecStart = "${pkgs.jellyseerr}/bin/jellyseerr";
-        BindPaths = [ "/var/lib/jellyseerr/:${pkgs.jellyseerr}/libexec/jellyseerr/deps/jellyseerr/config/" ];
+        ExecStart = lib.getExe cfg.package;
+        BindPaths = [ "/var/lib/jellyseerr/:${cfg.package}/libexec/jellyseerr/deps/jellyseerr/config/" ];
         Restart = "on-failure";
         ProtectHome = true;
         ProtectSystem = "strict";

nixos/modules/services/misc/snapper.nix

@@ -96,48 +96,48 @@ let
     };
 
     TIMELINE_LIMIT_HOURLY = mkOption {
-      type = types.str;
-      default = "10";
+      type = types.int;
+      default = 10;
       description = ''
         Limits for timeline cleanup.
       '';
     };
 
     TIMELINE_LIMIT_DAILY = mkOption {
-      type = types.str;
-      default = "10";
+      type = types.int;
+      default = 10;
       description = ''
         Limits for timeline cleanup.
       '';
     };
 
     TIMELINE_LIMIT_WEEKLY = mkOption {
-      type = types.str;
-      default = "0";
+      type = types.int;
+      default = 0;
       description = ''
         Limits for timeline cleanup.
       '';
     };
 
     TIMELINE_LIMIT_MONTHLY = mkOption {
-      type = types.str;
-      default = "10";
+      type = types.int;
+      default = 10;
       description = ''
         Limits for timeline cleanup.
       '';
     };
 
     TIMELINE_LIMIT_QUARTERLY = mkOption {
-      type = types.str;
-      default = "0";
+      type = types.int;
+      default = 0;
       description = ''
         Limits for timeline cleanup.
       '';
     };
 
     TIMELINE_LIMIT_YEARLY = mkOption {
-      type = types.str;
-      default = "10";
+      type = types.int;
+      default = 10;
       description = ''
         Limits for timeline cleanup.
       '';
@@ -353,4 +353,6 @@ in
       ) (attrNames cfg.configs);
     }
   );
+
+  meta.maintainers = with lib.maintainers; [ Djabx ];
 }

nixos/modules/services/misc/sonarr.nix

@@ -1,4 +1,4 @@
-{ config, pkgs, lib, ... }:
+{ config, pkgs, lib, utils, ... }:
 
 with lib;
 
@@ -54,7 +54,11 @@ in
         Type = "simple";
         User = cfg.user;
         Group = cfg.group;
-        ExecStart = "${cfg.package}/bin/NzbDrone -nobrowser -data='${cfg.dataDir}'";
+        ExecStart = utils.escapeSystemdExecArgs [
+          (lib.getExe cfg.package)
+          "-nobrowser"
+          "-data=${cfg.dataDir}"
+        ];
         Restart = "on-failure";
       };
     };

nixos/modules/services/networking/cloudflare-dyndns.nix

@@ -28,6 +28,16 @@ in
         '';
       };
 
+      frequency = mkOption {
+        type = types.nullOr types.str;
+        default = "*:0/5";
+        description = ''
+          Run cloudflare-dyndns with the given frequency (see
+          {manpage}`systemd.time(7)` for the format).
+          If null, do not run automatically.
+        '';
+      };
+
       proxied = mkOption {
         type = types.bool;
         default = false;
@@ -67,7 +77,6 @@ in
       description = "CloudFlare Dynamic DNS Client";
       after = [ "network.target" ];
       wantedBy = [ "multi-user.target" ];
-      startAt = "*:0/5";
 
       environment = {
         CLOUDFLARE_DOMAINS = toString cfg.domains;
@@ -88,6 +97,8 @@ in
           in
           "${pkgs.cloudflare-dyndns}/bin/cloudflare-dyndns ${toString args}";
       };
+    } // optionalAttrs (cfg.frequency != null) {
+      startAt = cfg.frequency;
     };
   };
 }

nixos/modules/services/networking/prosody.nix

@@ -266,6 +266,13 @@ let
     else if builtins.isList x then "{ ${lib.concatMapStringsSep ", " toLua x} }"
     else throw "Invalid Lua value";
 
+  settingsToLua = prefix: settings: generators.toKeyValue {
+    listsAsDuplicateKeys = false;
+    mkKeyValue = k: generators.mkKeyValueDefault {
+      mkValueString = toLua;
+    } " = " (prefix + k);
+  } (filterAttrs (k: v: v != null) settings);
+
   createSSLOptsStr = o: ''
     ssl = {
       cafile = "/etc/ssl/certs/ca-bundle.crt";
@@ -418,15 +425,26 @@ let
       httpUploadPath = mkOption {
         type = types.str;
         description = ''
-          Directory where the uploaded files will be stored. By
-          default, uploaded files are put in a sub-directory of the
-          default Prosody storage path (usually /var/lib/prosody).
+          Directory where the uploaded files will be stored when the http_upload module is used.
+          By default, uploaded files are put in a sub-directory of the default Prosody storage path (usually /var/lib/prosody).
         '';
         default = "/var/lib/prosody";
       };
     };
   };
 
+  httpFileShareOpts = { ... }: {
+    freeformType = with types;
+      let atom = oneOf [ int bool str (listOf atom) ]; in
+      attrsOf (nullOr atom) // {
+        description = "int, bool, string or list of them";
+      };
+    options.domain = mkOption {
+      type = with types; nullOr str;
+      description = "Domain name for a http_file_share service.";
+    };
+  };
+
   vHostOpts = { ... }: {
 
     options = {
@@ -650,7 +668,7 @@ in
 
       uploadHttp = mkOption {
         description = ''
-          Configures the Prosody builtin HTTP server to handle user uploads.
+          Configures the old Prosody builtin HTTP server to handle user uploads.
         '';
         type = types.nullOr (types.submodule uploadHttpOpts);
         default = null;
@@ -659,6 +677,17 @@ in
         };
       };
 
+      httpFileShare = mkOption {
+        description = ''
+          Configures the http_file_share module to handle user uploads.
+        '';
+        type = types.nullOr (types.submodule httpFileShareOpts);
+        default = null;
+        example = {
+          domain = "uploads.my-xmpp-example-host.org";
+        };
+      };
+
       muc = mkOption {
         type = types.listOf (types.submodule mucOpts);
         default = [ ];
@@ -751,11 +780,10 @@ in
             You need to setup at least a MUC domain to comply with
             XEP-0423.
           '' + genericErrMsg;}
-        { assertion = cfg.uploadHttp != null || !cfg.xmppComplianceSuite;
+        { assertion = cfg.uploadHttp != null || cfg.httpFileShare != null || !cfg.xmppComplianceSuite;
           message = ''
-            You need to setup the uploadHttp module through
-            config.services.prosody.uploadHttp to comply with
-            XEP-0423.
+            You need to setup the http_upload or http_file_share modules through config.services.prosody.uploadHttp
+            or config.services.prosody.httpFileShare to comply with XEP-0423.
           '' + genericErrMsg;}
       ];
     in errors;
@@ -764,8 +792,11 @@ in
 
     environment.etc."prosody/prosody.cfg.lua".text =
       let
-        httpDiscoItems = optionals (cfg.uploadHttp != null)
-            [{ url = cfg.uploadHttp.domain; description = "HTTP upload endpoint";}];
+        httpDiscoItems = optional (cfg.uploadHttp != null) {
+          url = cfg.uploadHttp.domain; description = "HTTP upload endpoint";
+        } ++ optional (cfg.httpFileShare != null) {
+          url = cfg.httpFileShare.domain; description = "HTTP file share endpoint";
+        };
         mucDiscoItems = builtins.foldl'
             (acc: muc: [{ url = muc.domain; description = "${muc.domain} MUC endpoint";}] ++ acc)
             []
@@ -844,7 +875,6 @@ in
         '') cfg.muc}
 
       ${ lib.optionalString (cfg.uploadHttp != null) ''
-        -- TODO: think about migrating this to mod-http_file_share instead.
         Component ${toLua cfg.uploadHttp.domain} "http_upload"
             http_upload_file_size_limit = ${cfg.uploadHttp.uploadFileSizeLimit}
             http_upload_expire_after = ${cfg.uploadHttp.uploadExpireAfter}
@@ -852,6 +882,11 @@ in
             http_upload_path = ${toLua cfg.uploadHttp.httpUploadPath}
       ''}
 
+      ${lib.optionalString (cfg.httpFileShare != null) ''
+        Component ${toLua cfg.httpFileShare.domain} "http_file_share"
+        ${settingsToLua "  http_file_share_" (cfg.httpFileShare // { domain = null; })}
+      ''}
+
       ${ lib.concatStringsSep "\n" (lib.mapAttrsToList (n: v: ''
         VirtualHost "${v.domain}"
           enabled = ${boolToString v.enabled};

nixos/modules/services/security/sks.nix

@@ -10,7 +10,7 @@ let
   '';
 
 in {
-  meta.maintainers = with maintainers; [ primeos calbrecht jcumming ];
+  meta.maintainers = with maintainers; [ calbrecht jcumming ];
 
   options = {
 

nixos/modules/services/web-apps/eintopf.nix

@@ -0,0 +1,92 @@
+{ config, lib, pkgs, ... }:
+
+with lib;
+
+let
+
+  cfg = config.services.eintopf;
+
+in {
+  options.services.eintopf = {
+
+    enable = mkEnableOption "Eintopf community event calendar web app";
+
+    settings = mkOption {
+      type = types.attrsOf types.str;
+      default = { };
+      description = ''
+        Settings to configure web service. See
+        <https://codeberg.org/Klasse-Methode/eintopf/src/branch/main/DEPLOYMENT.md>
+        for available options.
+      '';
+      example = literalExpression ''
+        {
+          EINTOPF_ADDR = ":1234";
+          EINTOPF_ADMIN_EMAIL = "admin@example.org";
+          EINTOPF_TIMEZONE = "Europe/Berlin";
+        }
+      '';
+    };
+
+    secrets = lib.mkOption {
+      type = with types; listOf path;
+      description = ''
+        A list of files containing the various secrets. Should be in the
+        format expected by systemd's `EnvironmentFile` directory.
+      '';
+      default = [ ];
+    };
+
+  };
+
+  config = mkIf cfg.enable {
+
+    systemd.services.eintopf = {
+      description = "Community event calendar web app";
+      wantedBy = [ "multi-user.target" ];
+      after = [ "network-online.target" ];
+      wants = [ "network-online.target" ];
+      environment = cfg.settings;
+      serviceConfig = {
+        ExecStart = "${pkgs.eintopf}/bin/eintopf";
+        WorkingDirectory = "/var/lib/eintopf";
+        StateDirectory = "eintopf" ;
+        EnvironmentFile = [ cfg.secrets ];
+
+        # hardening
+        AmbientCapabilities = "";
+        CapabilityBoundingSet = "" ;
+        DevicePolicy = "closed";
+        DynamicUser = true;
+        LockPersonality = true;
+        MemoryDenyWriteExecute = true;
+        NoNewPrivileges = true;
+        PrivateDevices = true;
+        PrivateTmp = true;
+        PrivateUsers = true;
+        ProcSubset = "pid";
+        ProtectClock = true;
+        ProtectControlGroups = true;
+        ProtectHome = true;
+        ProtectHostname = true;
+        ProtectKernelLogs = true;
+        ProtectKernelModules = true;
+        ProtectKernelTunables = true;
+        ProtectProc = "invisible";
+        ProtectSystem = "strict";
+        RemoveIPC = true;
+        RestrictAddressFamilies = [ "AF_INET" "AF_INET6" ];
+        RestrictNamespaces = true;
+        RestrictRealtime = true;
+        RestrictSUIDSGID = true;
+        SystemCallArchitectures = "native";
+        SystemCallFilter = [ "@system-service" "~@privileged" ];
+        UMask = "0077";
+      };
+    };
+
+  };
+
+  meta.maintainers = with lib.maintainers; [ onny ];
+
+}

nixos/modules/services/web-apps/nextcloud.nix

@@ -91,10 +91,10 @@ let
     cd ${webroot}
     sudo=exec
     if [[ "$USER" != nextcloud ]]; then
-      sudo='exec /run/wrappers/bin/sudo -u nextcloud --preserve-env=NEXTCLOUD_CONFIG_DIR --preserve-env=OC_PASS'
+      sudo='exec /run/wrappers/bin/sudo -u nextcloud'
     fi
-    export NEXTCLOUD_CONFIG_DIR="${datadir}/config"
-    $sudo \
+    $sudo ${pkgs.coreutils}/bin/env \
+      NEXTCLOUD_CONFIG_DIR="${datadir}/config" \
       ${phpCli} \
       occ "$@"
   '';

nixos/modules/services/web-servers/apache-httpd/default.nix

@@ -538,25 +538,13 @@ in
         '';
       };
 
-      enableMellon = mkOption {
-        type = types.bool;
-        default = false;
-        description = "Whether to enable the mod_auth_mellon module.";
-      };
+      enableMellon = mkEnableOption "the mod_auth_mellon module";
 
-      enablePHP = mkOption {
-        type = types.bool;
-        default = false;
-        description = "Whether to enable the PHP module.";
-      };
+      enablePHP = mkEnableOption "the PHP module";
 
       phpPackage = mkPackageOption pkgs "php" { };
 
-      enablePerl = mkOption {
-        type = types.bool;
-        default = false;
-        description = "Whether to enable the Perl module (mod_perl).";
-      };
+      enablePerl = mkEnableOption "the Perl module (mod_perl)";
 
       phpOptions = mkOption {
         type = types.lines;

nixos/modules/system/boot/networkd.nix

@@ -119,10 +119,12 @@ let
           "VNetHeader"
           "User"
           "Group"
+          "KeepCarrier"
         ])
         (assertValueOneOf "MultiQueue" boolValues)
         (assertValueOneOf "PacketInfo" boolValues)
         (assertValueOneOf "VNetHeader" boolValues)
+        (assertValueOneOf "KeepCarrier" boolValues)
       ];
 
       # See https://www.freedesktop.org/software/systemd/man/latest/systemd.netdev.html#%5BIPVTAP%5D%20Section%20Options
@@ -632,6 +634,7 @@ let
           "LinkLocalAddressing"
           "IPv6LinkLocalAddressGenerationMode"
           "IPv6StableSecretAddress"
+          "IPv4LLStartAddress"
           "IPv4LLRoute"
           "DefaultRouteOnDevice"
           "LLMNR"
@@ -654,12 +657,16 @@ let
           "IPv6AcceptRA"
           "IPv6DuplicateAddressDetection"
           "IPv6HopLimit"
+          "IPv4ReversePathFilter"
+          "IPv4AcceptLocal"
+          "IPv4RouteLocalnet"
           "IPv4ProxyARP"
           "IPv6ProxyNDP"
           "IPv6ProxyNDPAddress"
           "IPv6SendRA"
           "DHCPPrefixDelegation"
           "IPv6MTUBytes"
+          "KeepMaster"
           "Bridge"
           "Bond"
           "VRF"
@@ -701,11 +708,15 @@ let
         (assertMinimum "IPv6DuplicateAddressDetection" 0)
         (assertInt "IPv6HopLimit")
         (assertMinimum "IPv6HopLimit" 0)
+        (assertValueOneOf "IPv4ReversePathFilter" ["no" "strict" "loose"])
+        (assertValueOneOf "IPv4AcceptLocal" boolValues)
+        (assertValueOneOf "IPv4RouteLocalnet" boolValues)
         (assertValueOneOf "IPv4ProxyARP" boolValues)
         (assertValueOneOf "IPv6ProxyNDP" boolValues)
         (assertValueOneOf "IPv6SendRA" boolValues)
         (assertValueOneOf "DHCPPrefixDelegation" boolValues)
         (assertByteFormat "IPv6MTUBytes")
+        (assertValueOneOf "KeepMaster" boolValues)
         (assertValueOneOf "ActiveSlave" boolValues)
         (assertValueOneOf "PrimarySlave" boolValues)
         (assertValueOneOf "ConfigureWithoutCarrier" boolValues)

nixos/tests/all-tests.nix

@@ -280,6 +280,7 @@ in {
   ecryptfs = handleTest ./ecryptfs.nix {};
   fscrypt = handleTest ./fscrypt.nix {};
   fastnetmon-advanced = runTest ./fastnetmon-advanced.nix;
+  eintopf = handleTest ./eintopf.nix {};
   ejabberd = handleTest ./xmpp/ejabberd.nix {};
   elk = handleTestOn ["x86_64-linux"] ./elk.nix {};
   emacs-daemon = handleTest ./emacs-daemon.nix {};
@@ -535,7 +536,7 @@ in {
   mailman = handleTest ./mailman.nix {};
   man = handleTest ./man.nix {};
   mariadb-galera = handleTest ./mysql/mariadb-galera.nix {};
-  mastodon = discoverTests (import ./web-apps/mastodon { inherit handleTestOn; });
+  mastodon = pkgs.recurseIntoAttrs (handleTest ./web-apps/mastodon { inherit handleTestOn; });
   pixelfed = discoverTests (import ./web-apps/pixelfed { inherit handleTestOn; });
   mate = handleTest ./mate.nix {};
   mate-wayland = handleTest ./mate-wayland.nix {};

nixos/tests/eintopf.nix

@@ -0,0 +1,21 @@
+import ./make-test-python.nix ({ pkgs, ...} : {
+  name = "eintopf";
+  meta = with pkgs.lib.maintainers; {
+    maintainers = [ onny ];
+  };
+
+  nodes = {
+    eintopf = { config, pkgs, ... }: {
+      services.eintopf = {
+        enable = true;
+      };
+    };
+  };
+
+  testScript = ''
+    eintopf.start
+    eintopf.wait_for_unit("eintopf.service")
+    eintopf.wait_for_open_port(3333)
+    eintopf.succeed("curl -sSfL http://eintopf:3333 | grep 'Es sind keine Veranstaltungen eingetragen'")
+  '';
+})

nixos/tests/graylog.nix

@@ -4,7 +4,7 @@ import ./make-test-python.nix ({ pkgs, lib, ... }: {
 
   nodes.machine = { pkgs, ... }: {
     virtualisation.memorySize = 4096;
-    virtualisation.diskSize = 4096;
+    virtualisation.diskSize = 1024 * 6;
 
     services.mongodb.enable = true;
     services.elasticsearch.enable = true;
@@ -65,9 +65,18 @@ import ./make-test-python.nix ({ pkgs, lib, ... }: {
   in ''
     machine.start()
     machine.wait_for_unit("graylog.service")
+
+    machine.wait_until_succeeds(
+      "journalctl -o cat -u graylog.service | grep 'Started REST API at <127.0.0.1:9000>'"
+    )
+
     machine.wait_for_open_port(9000)
     machine.succeed("curl -sSfL http://127.0.0.1:9000/")
 
+    machine.wait_until_succeeds(
+      "journalctl -o cat -u graylog.service | grep 'Graylog server up and running'"
+    )
+
     session = machine.succeed(
         "curl -X POST "
         + "-sSfL http://127.0.0.1:9000/api/system/sessions "
@@ -87,6 +96,10 @@ import ./make-test-python.nix ({ pkgs, lib, ... }: {
         + "-H 'x-requested-by: cli' "
     )
 
+    machine.wait_until_succeeds(
+      "journalctl -o cat -u graylog.service | grep -E 'Input \[GELF UDP/Demo/[[:alnum:]]{24}\] is now RUNNING'"
+    )
+
     machine.wait_until_succeeds(
         "test \"$(curl -sSfL 'http://127.0.0.1:9000/api/cluster/inputstates' "
         + f"-u {session}:session "

nixos/tests/lomiri.nix

@@ -282,6 +282,7 @@ in {
         # Testing any more would require more applications & setup, the fact that it's already being attempted is a good sign
         machine.send_key("esc")
 
+        machine.sleep(2) # sleep a tiny bit so morph can close & the focus can return to LSS
         machine.send_key("alt-f4")
 
     # The ayatana indicators are an important part of the experience, and they hold the only graphical way of exiting the session.

nixos/tests/pam/pam-u2f.nix

@@ -7,12 +7,16 @@ import ../make-test-python.nix ({ ... }:
     { ... }:
     {
       security.pam.u2f = {
-        control = "required";
-        cue = true;
-        debug = true;
         enable = true;
-        interactive = true;
-        origin = "nixos-test";
+        control = "required";
+        settings = {
+          cue = true;
+          debug = true;
+          interactive = true;
+          origin = "nixos-test";
+          # Freeform option
+          userpresence = 1;
+        };
       };
     };
 
@@ -20,7 +24,7 @@ import ../make-test-python.nix ({ ... }:
     ''
       machine.wait_for_unit("multi-user.target")
       machine.succeed(
-          'egrep "auth required .*/lib/security/pam_u2f.so.*cue.*debug.*interactive.*origin=nixos-test" /etc/pam.d/ -R'
+          'egrep "auth required .*/lib/security/pam_u2f.so.*cue.*debug.*interactive.*origin=nixos-test.*userpresence=1" /etc/pam.d/ -R'
       )
     '';
 })

nixos/tests/soju.nix

@@ -8,7 +8,7 @@ let
 in
 {
   name = "soju";
-  meta.maintainers = with lib.maintainers; [ Benjamin-L ];
+  meta.maintainers = with lib.maintainers; [ ];
 
   nodes.machine = { ... }: {
     services.soju = {

nixos/tests/teleport.nix

@@ -10,6 +10,7 @@ let
   packages = with pkgs; {
     "default" = teleport;
     "14" = teleport_14;
+    "15" = teleport_15;
   };
 
   minimal = package: {

nixos/tests/web-apps/mastodon/default.nix

@@ -1,9 +1,9 @@
-{ system ? builtins.currentSystem, handleTestOn }:
+{ system ? builtins.currentSystem, pkgs, handleTestOn, ... }:
 let
   supportedSystems = [ "x86_64-linux" "i686-linux" "aarch64-linux" ];
 
 in
 {
-  standard = handleTestOn supportedSystems ./standard.nix { inherit system; };
-  remote-databases = handleTestOn supportedSystems ./remote-databases.nix { inherit system; };
+  standard = handleTestOn supportedSystems ./standard.nix { inherit system pkgs; };
+  remote-databases = handleTestOn supportedSystems ./remote-databases.nix { inherit system pkgs; };
 }

pkgs/applications/audio/callaudiod/default.nix

@@ -11,14 +11,14 @@
 
 stdenv.mkDerivation rec {
   pname = "callaudiod";
-  version = "0.1.9";
+  version = "0.1.10";
 
   src = fetchFromGitLab {
     domain = "gitlab.com";
     owner = "mobian1";
     repo = pname;
     rev = version;
-    sha256 = "sha256-OuWn1DA+4LmN1KwouiqW3kn6CMg8jhm0FiyAgMSi1GI=";
+    sha256 = "sha256-gc66XrrFyhF1TvrDECBfGQc+MiDtqZPxdCn0S/43XQU=";
   };
 
   strictDeps = true;

pkgs/applications/editors/vscode/extensions/default.nix

@@ -860,7 +860,7 @@ let
             description = "Soothing pastel theme for VSCode";
             license = lib.licenses.mit;
             downloadPage = "https://marketplace.visualstudio.com/items?itemName=Catppuccin.catppuccin-vsc";
-            maintainers = [ lib.maintainers.nullx76 ];
+            maintainers = [ ];
           };
         };
         catppuccin-vsc-icons = buildVscodeMarketplaceExtension {
@@ -3078,7 +3078,7 @@ let
           description = "direnv support for Visual Studio Code";
           license = lib.licenses.bsd0;
           downloadPage = "https://marketplace.visualstudio.com/items?itemName=mkhl.direnv";
-          maintainers = [ lib.maintainers.nullx76 ];
+          maintainers = [ ];
         };
       };
 
@@ -3397,8 +3397,8 @@ let
         mktplcRef = {
           name = "remote-containers";
           publisher = "ms-vscode-remote";
-          version = "0.347.0";
-          hash = "sha256-E9H1nPWG5JuzBxbYc/yWd8Y3azEWrd9whGirl0GK7kU=";
+          version = "0.376.0";
+          hash = "sha256-fJ8ZcwGFWXzJZ8UgnzTxR+842vjiU0qCjV/zWzbq/KQ=";
         };
         meta = {
           description = "Open any folder or repository inside a Docker container";

pkgs/applications/editors/vscode/vscode.nix

@@ -30,21 +30,21 @@ let
   archive_fmt = if stdenv.isDarwin then "zip" else "tar.gz";
 
   sha256 = {
-    x86_64-linux = "0d0cgsiafmr1wmxqji7mi4hmms7zqql868bcfbq9lmkw96zw85dw";
-    x86_64-darwin = "1zga9zm25h33m42cdnbkpzx5vbcwm9n7036qapq8pgrb23mals7f";
-    aarch64-linux = "0wsdcny0y8xfvdf62qh792ifcq1am8i8xkchh5rscjc3xli6r86s";
-    aarch64-darwin = "13jd39lm667206ga8fqbdb7mdqbkmbgq1l7wid3h4yanz87zbm99";
-    armv7l-linux = "1xpvcypm0xnwjmbj2c1a245yav3nwi0g2k564x91vazfw4nmi7mv";
+    x86_64-linux = "0bzf0mx1rgndpdd4a97kr01xsgsgp86gyscg8js2cvaad4265bmv";
+    x86_64-darwin = "1m7f91cqbbv00difvfqld8fqkj9kvyddihmzi3zyzn4gfkv8gvf0";
+    aarch64-linux = "09mxsk4qkq34yg1sd67cdasfxwdhdzcfij50fv1nl3kdjzp2i0iz";
+    aarch64-darwin = "1jxjzfz6gr0pcp2anwjqwm38ma2i8fnzf5zpscfdklrlbhf438k2";
+    armv7l-linux = "1yp4npgw4dkx8halsr1vm5ll1w4phx67dwd4krz1914mddx7x2kr";
   }.${system} or throwSystem;
 in
   callPackage ./generic.nix rec {
     # Please backport all compatible updates to the stable release.
     # This is important for the extension ecosystem.
-    version = "1.90.2";
+    version = "1.91.0";
     pname = "vscode" + lib.optionalString isInsiders "-insiders";
 
     # This is used for VS Code - Remote SSH test
-    rev = "5437499feb04f7a586f677b155b039bc2b3669eb";
+    rev = "ea1445cc7016315d0f5728f8e8b12a45dc0a7286";
 
     executableName = "code" + lib.optionalString isInsiders "-insiders";
     longName = "Visual Studio Code" + lib.optionalString isInsiders " - Insiders";
@@ -68,7 +68,7 @@ in
       src = fetchurl {
         name = "vscode-server-${rev}.tar.gz";
         url = "https://update.code.visualstudio.com/commit:${rev}/server-linux-x64/stable";
-        sha256 = "18npvj29g9xwjyxv3a0fxipk30hgm487cfr3d91dvp5hxhl4dwwr";
+        sha256 = "08mgfrwiji16q8x8kwmw3pdmb0325hfr9pd2fa5g5kmy9gnfw38v";
       };
     };
 

pkgs/applications/editors/xed-editor/default.nix

@@ -19,13 +19,13 @@
 
 stdenv.mkDerivation rec {
   pname = "xed-editor";
-  version = "3.6.3";
+  version = "3.6.4";
 
   src = fetchFromGitHub {
     owner = "linuxmint";
     repo = "xed";
     rev = version;
-    sha256 = "sha256-xsNqzicI11dM/DjY00pXaPpQdHA0ltP23g34fMWUoUA=";
+    sha256 = "sha256-EwBcgFHw6Mh+eS5hfTLoywH0dVt/TpNt4y6xQxe/x/Q=";
   };
 
   patches = [

pkgs/applications/emulators/dolphin-emu/default.nix

@@ -40,11 +40,7 @@
 , xz
 
   # Used in passthru
-, common-updater-scripts
-, dolphin-emu
-, jq
 , testers
-, writeShellScript
 
   # Darwin-only dependencies
 , CoreBluetooth
@@ -56,23 +52,18 @@
 , VideoToolbox
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "dolphin-emu";
-  version = "5.0-21460";
+  version = "2407";
 
   src = fetchFromGitHub {
     owner = "dolphin-emu";
     repo = "dolphin";
-    rev = "a9544510468740b77cf06ef28daaa65fe247fd32";
-    hash = "sha256-mhD7Uaqi8GzHdR7Y81TspvCnrZH2evWuWFgXMQ2c8g0=";
+    rev = "refs/tags/${finalAttrs.version}";
+    hash = "sha256-8W4KyIj+rhDkWnQogjpzlEJVo3HJenfpWKimSyMGN7c=";
     fetchSubmodules = true;
   };
 
-  patches = [
-    # TODO: Remove when merged https://github.com/dolphin-emu/dolphin/pull/12736
-    ./find-minizip-ng.patch
-  ];
-
   strictDeps = true;
 
   nativeBuildInputs = [
@@ -133,8 +124,8 @@ stdenv.mkDerivation rec {
 
   cmakeFlags = [
     "-DDISTRIBUTOR=NixOS"
-    "-DDOLPHIN_WC_REVISION=${src.rev}"
-    "-DDOLPHIN_WC_DESCRIBE=${version}"
+    "-DDOLPHIN_WC_REVISION=${finalAttrs.src.rev}"
+    "-DDOLPHIN_WC_DESCRIBE=${finalAttrs.version}"
     "-DDOLPHIN_WC_BRANCH=master"
   ] ++ lib.optionals stdenv.isDarwin [
     "-DOSX_USE_DEFAULT_SEARCH_PATH=True"
@@ -165,20 +156,10 @@ stdenv.mkDerivation rec {
 
   passthru = {
     tests.version = testers.testVersion {
-      package = dolphin-emu;
+      package = finalAttrs.finalPackage;
       command = "dolphin-emu-nogui --version";
-      version = if stdenv.hostPlatform.isDarwin then "Dolphin 5.0" else version;
+      inherit (finalAttrs) version;
     };
-
-    updateScript = writeShellScript "dolphin-update-script" ''
-      set -eou pipefail
-      export PATH=${lib.makeBinPath [ curl jq common-updater-scripts ]}
-
-      json="$(curl -s https://dolphin-emu.org/update/latest/beta)"
-      version="$(jq -r '.shortrev' <<< "$json")"
-      rev="$(jq -r '.hash' <<< "$json")"
-      update-source-version dolphin-emu "$version" --rev="$rev"
-    '';
   };
 
   meta = with lib; {
@@ -188,6 +169,6 @@ stdenv.mkDerivation rec {
     branch = "master";
     license = licenses.gpl2Plus;
     platforms = platforms.unix;
-    maintainers = with maintainers; [ ];
+    maintainers = with maintainers; [ pbsds ];
   };
-}
+})

pkgs/applications/emulators/dolphin-emu/find-minizip-ng.patch

@@ -1,13 +0,0 @@
-diff --git a/CMakeLists.txt b/CMakeLists.txt
-index fb37788513..289a25fa57 100644
---- a/CMakeLists.txt
-+++ b/CMakeLists.txt
-@@ -676,7 +676,7 @@ dolphin_find_optional_system_library_pkgconfig(ZLIB zlib-ng ZLIB::ZLIB Externals
- 
- # https://github.com/zlib-ng/minizip-ng/commit/6c5f265a55f1a12a7a016cd2962feff91cff5d2e
- add_definitions(-DMZ_COMPAT_VERSION=110)  # This macro is for forwards compatibility with 4.0.4+
--dolphin_find_optional_system_library_pkgconfig(MINIZIP minizip>=3.0.0 minizip::minizip Externals/minizip)
-+dolphin_find_optional_system_library_pkgconfig(MINIZIP minizip-ng>=3.0.0 minizip::minizip Externals/minizip)
- 
- dolphin_find_optional_system_library(LZO Externals/LZO)
- 

pkgs/applications/emulators/mame/default.nix

@@ -38,14 +38,14 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "mame";
-  version = "0.266";
+  version = "0.267";
   srcVersion = builtins.replaceStrings [ "." ] [ "" ] version;
 
   src = fetchFromGitHub {
     owner = "mamedev";
     repo = "mame";
     rev = "mame${srcVersion}";
-    hash = "sha256-nggpDKcZURwC4SQHiRnF7lJNaAWSniVHvsF/IjAPd9E=";
+    hash = "sha256-H3idND2cC0KSGa9EIEVN2diticfM9r6FwRqQYkWmEM0=";
   };
 
   outputs = [ "out" "tools" ];

pkgs/applications/graphics/hydrus/default.nix

@@ -14,14 +14,14 @@
 
 python3Packages.buildPythonPackage rec {
   pname = "hydrus";
-  version = "578";
+  version = "580";
   format = "other";
 
   src = fetchFromGitHub {
     owner = "hydrusnetwork";
     repo = "hydrus";
     rev = "refs/tags/v${version}";
-    hash = "sha256-u2SXhL57iNVjRFqerzc/TByB9ArAJx81mxOjTBVBMkg=";
+    hash = "sha256-QdRItwbgVYgA6PU9Ybimk+/sBe1CHV79ssTrIturVpg=";
   };
 
   nativeBuildInputs = [
@@ -60,6 +60,7 @@ python3Packages.buildPythonPackage rec {
     lz4
     numpy
     opencv4
+    olefile
     pillow
     pillow-heif
     psutil
@@ -74,6 +75,7 @@ python3Packages.buildPythonPackage rec {
     pyyaml
     qtpy
     requests
+    show-in-file-manager
     send2trash
     service-identity
     twisted

pkgs/applications/graphics/komikku/default.nix

@@ -19,7 +19,7 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "komikku";
-  version = "1.49.0";
+  version = "1.50.0";
 
   format = "other";
 
@@ -28,7 +28,7 @@ python3.pkgs.buildPythonApplication rec {
     owner = "valos";
     repo = "Komikku";
     rev = "v${version}";
-    hash = "sha256-AMlhhsbwLhofV/Sy/EXuE4l0UAwZf2Gxn9+x3MHno4Y=";
+    hash = "sha256-lyBXMctEL8Z6rscsSDHh7xLhjvnpN2q4qMVV2ek9Cyk=";
   };
 
   nativeBuildInputs = [

pkgs/applications/kde/kdenlive/default.nix

@@ -1,4 +1,5 @@
 { mkDerivation
+, substituteAll
 , lib
 , extra-cmake-modules
 , breeze-icons
@@ -83,23 +84,25 @@ mkDerivation {
     wrapGAppsHook3
     glaxnimate
   ];
+
   # Both MLT and FFMpeg paths must be set or Kdenlive will complain that it
   # doesn't find them. See:
   # https://github.com/NixOS/nixpkgs/issues/83885
-  patches = [ ./dependency-paths.patch ./dependency-paths-glaxnimate.patch ];
-
-  # Needed to replace @glaxnimate@ by its path
-  env = {
-    inherit mediainfo glaxnimate;
-    ffmpeg = ffmpeg-full;
-    mlt = mlt-full;
-  };
+  patches = [
+    (
+      substituteAll {
+        src = ./dependency-paths.patch;
+        inherit mediainfo glaxnimate;
+        ffmpeg = ffmpeg-full;
+        mlt = mlt-full;
+      }
+    )
+  ];
 
   postPatch =
     # Module Qt5::Concurrent must be included in `find_package` before it is used.
     ''
       sed -i CMakeLists.txt -e '/find_package(Qt5 REQUIRED/ s|)| Concurrent)|'
-      substituteAllInPlace src/kdenlivesettings.kcfg
     '';
 
   dontWrapGApps = true;

pkgs/applications/kde/kdenlive/dependency-paths-glaxnimate.patch

@@ -1,13 +0,0 @@
-diff --git a/src/kdenlivesettings.kcfg b/src/kdenlivesettings.kcfg
-index 86fa5ef..6aeccbe 100644
---- a/src/kdenlivesettings.kcfg
-+++ b/src/kdenlivesettings.kcfg
-@@ -657,7 +657,7 @@
-
-     <entry name="glaxnimatePath" type="String">
-       <label>Path to the Glaxnimate application.</label>
--      <default></default>
-+      <default>@glaxnimate@/bin/glaxnimate</default>
-     </entry>
-
-     <entry name="nice_tasks" type="Bool">

pkgs/applications/kde/kdenlive/dependency-paths.patch

@@ -1,6 +1,5 @@
-diff --git a/src/kdenlivesettings.kcfg b/src/kdenlivesettings.kcfg
-index 029849e5f..8befe4888 100644
---- a/src/kdenlivesettings.kcfg
+diff -u b/src/kdenlivesettings.kcfg b/src/kdenlivesettings.kcfg
+--- b/src/kdenlivesettings.kcfg
 +++ b/src/kdenlivesettings.kcfg
 @@ -517,7 +517,7 @@
    <group name="env">
@@ -44,3 +43,10 @@ index 029849e5f..8befe4888 100644
      </entry>
  
      <entry name="processingthreads" type="Int">
+@@ -657,5 +657,5 @@
+     <entry name="glaxnimatePath" type="String">
+       <label>Path to the Glaxnimate application.</label>
+-      <default></default>
++      <default>@glaxnimate@/bin/glaxnimate</default>
+     </entry>
+     <entry name="nice_tasks" type="Bool">

pkgs/applications/misc/cum/default.nix

@@ -31,7 +31,7 @@ buildPythonApplication rec {
     mainProgram = "cum";
     homepage = "https://github.com/Hamuko/cum";
     license = licenses.asl20;
-    maintainers = with maintainers; [ tadeokondrak ];
+    maintainers = with maintainers; [ ];
     platforms = platforms.all;
   };
 }

pkgs/applications/misc/dasel/default.nix

@@ -6,13 +6,13 @@
 
 buildGoModule rec {
   pname = "dasel";
-  version = "2.8.0";
+  version = "2.8.1";
 
   src = fetchFromGitHub {
     owner = "TomWright";
     repo = "dasel";
     rev = "v${version}";
-    hash = "sha256-j9gwE/iLbBM8sdNZgc7hYnKhJEMkLn/g9HVlsKn4moo=";
+    hash = "sha256-vq4lRCsqD2hmQw0yH84Wji5LeJ/aiMGJJIyCDvATA+I=";
   };
 
   vendorHash = "sha256-edyFs5oURklkqsTF7JA1in3XteSBx/6YEVu4MjIcGN4=";

pkgs/applications/misc/fff/default.nix

@@ -28,7 +28,7 @@ stdenv.mkDerivation rec {
     mainProgram = "fff";
     homepage = "https://github.com/dylanaraps/fff";
     license = licenses.mit;
-    maintainers = [ maintainers.tadeokondrak ];
+    maintainers = [ ];
     platforms = platforms.all;
   };
 }

pkgs/applications/misc/filet/default.nix

@@ -18,7 +18,7 @@ stdenv.mkDerivation rec {
     homepage = "https://github.com/buffet/filet";
     license = licenses.mpl20;
     platforms = platforms.all;
-    maintainers = with maintainers; [ buffet ];
+    maintainers = with maintainers; [ ];
     mainProgram = "filet";
   };
 }

pkgs/applications/misc/gcal/default.nix

@@ -34,5 +34,6 @@ stdenv.mkDerivation rec {
     license = lib.licenses.gpl3Plus;
     platforms = lib.platforms.unix;
     maintainers = [ lib.maintainers.romildo ];
+    mainProgram = "gcal";
   };
 }

pkgs/applications/misc/lunatask/default.nix

@@ -1,12 +1,12 @@
 { lib, appimageTools, fetchurl }:
 
 let
-  version = "2.0.0";
+  version = "2.0.4";
   pname = "lunatask";
 
   src = fetchurl {
     url = "https://lunatask.app/download/Lunatask-${version}.AppImage";
-    sha256 = "sha256-rRE7VE6Fugqbbv/fTIZGuWDQmTP1tRDiKrb6VcpsBjk=";
+    sha256 = "sha256-U+yelFSulAhgsn5xt45mxC7qGpQwmb3m3lt9nEW6MHU=";
   };
 
   appimageContents = appimageTools.extractType2 {

pkgs/applications/misc/lutris/default.nix

@@ -75,13 +75,13 @@ let
 in
 buildPythonApplication rec {
   pname = "lutris-unwrapped";
-  version = "0.5.16";
+  version = "0.5.17";
 
   src = fetchFromGitHub {
     owner = "lutris";
     repo = "lutris";
     rev = "v${version}";
-    hash = "sha256-Ed1bhugBe97XmY050A5jCPcnLj0Fd7qPX2p/Ab+YbOE=";
+    hash = "sha256-Tr5k5LU0s75+1B17oK8tlgA6SlS1SHyyLS6UBKadUmw=";
   };
 
   nativeBuildInputs = [ wrapGAppsHook3 gobject-introspection ];
@@ -121,7 +121,7 @@ buildPythonApplication rec {
 
   postPatch = ''
     substituteInPlace lutris/util/magic.py \
-      --replace "'libmagic.so.1'" "'${lib.getLib file}/lib/libmagic.so.1'"
+      --replace '"libmagic.so.1"' "'${lib.getLib file}/lib/libmagic.so.1'"
   '';
 
   nativeCheckInputs = [ xvfb-run nose2 flake8 ] ++ requiredTools;

pkgs/applications/misc/moonlight-qt/darwin.diff

@@ -1,38 +0,0 @@
---- a/app/app.pro	2023-06-24 19:10:00.653377668 +0800
-+++ b/app/app.pro	2023-06-24 19:20:06.632188299 +0800
-@@ -49,19 +49,8 @@
-     INCLUDEPATH += $$PWD/../libs/windows/include
-     LIBS += ws2_32.lib winmm.lib dxva2.lib ole32.lib gdi32.lib user32.lib d3d9.lib dwmapi.lib dbghelp.lib
- }
--macx {
--    INCLUDEPATH += $$PWD/../libs/mac/include
--    INCLUDEPATH += $$PWD/../libs/mac/Frameworks/SDL2.framework/Versions/A/Headers
--    INCLUDEPATH += $$PWD/../libs/mac/Frameworks/SDL2_ttf.framework/Versions/A/Headers
--    LIBS += -L$$PWD/../libs/mac/lib -F$$PWD/../libs/mac/Frameworks
--
--    # QMake doesn't handle framework-style includes correctly on its own
--    QMAKE_CFLAGS += -F$$PWD/../libs/mac/Frameworks
--    QMAKE_CXXFLAGS += -F$$PWD/../libs/mac/Frameworks
--    QMAKE_OBJECTIVE_CFLAGS += -F$$PWD/../libs/mac/Frameworks
--}
- 
--unix:!macx {
-+unix {
-     CONFIG += link_pkgconfig
-     PKGCONFIG += openssl sdl2 SDL2_ttf opus
- 
-@@ -120,13 +109,12 @@
-     CONFIG += soundio discord-rpc
- }
- macx {
--    LIBS += -lssl -lcrypto -lavcodec.60 -lavutil.58 -lopus -framework SDL2 -framework SDL2_ttf
-     LIBS += -lobjc -framework VideoToolbox -framework AVFoundation -framework CoreVideo -framework CoreGraphics -framework CoreMedia -framework AppKit -framework Metal
- 
-     # For libsoundio
-     LIBS += -framework CoreAudio -framework AudioUnit
- 
--    CONFIG += ffmpeg soundio discord-rpc
-+    CONFIG += ffmpeg soundio
- }
- 
- SOURCES += \

pkgs/applications/misc/moonlight-qt/default.nix

@@ -1,82 +0,0 @@
-{ stdenv
-, lib
-, fetchFromGitHub
-, wrapQtAppsHook
-, pkg-config
-, qmake
-, qtquickcontrols2
-, SDL2
-, SDL2_ttf
-, libva
-, libvdpau
-, libxkbcommon
-, alsa-lib
-, libpulseaudio
-, openssl
-, libopus
-, ffmpeg
-, wayland
-, darwin
-}:
-
-let
-  inherit (darwin.apple_sdk_11_0.frameworks) AVFoundation AppKit AudioUnit VideoToolbox;
-in
-
-stdenv.mkDerivation rec {
-  pname = "moonlight-qt";
-  version = "5.0.1";
-
-  src = fetchFromGitHub {
-    owner = "moonlight-stream";
-    repo = pname;
-    rev = "v${version}";
-    sha256 = "sha256-0ONjUqpM1tUnyaEnMgVl7ff6pND7kyqouv2mpgteZP0=";
-    fetchSubmodules = true;
-  };
-
-  patches = [ ./darwin.diff ];
-
-  nativeBuildInputs = [
-    wrapQtAppsHook
-    pkg-config
-    qmake
-  ];
-
-  buildInputs = [
-    qtquickcontrols2
-    SDL2
-    SDL2_ttf
-    openssl
-    libopus
-    ffmpeg
-  ] ++ lib.optionals stdenv.isLinux [
-    libva
-    libvdpau
-    libxkbcommon
-    alsa-lib
-    libpulseaudio
-    wayland
-  ] ++ lib.optionals stdenv.isDarwin [
-    AVFoundation
-    AppKit
-    AudioUnit
-    VideoToolbox
-  ];
-
-  postInstall = lib.optionalString stdenv.isDarwin ''
-    mkdir $out/Applications $out/bin
-    mv app/Moonlight.app $out/Applications
-    rm -r $out/Applications/Moonlight.app/Contents/Frameworks
-    ln -s $out/Applications/Moonlight.app/Contents/MacOS/Moonlight $out/bin/moonlight
-  '';
-
-  meta = with lib; {
-    description = "Play your PC games on almost any device";
-    homepage = "https://moonlight-stream.org";
-    license = licenses.gpl3Plus;
-    maintainers = with maintainers; [ luc65r ];
-    platforms = platforms.all;
-    mainProgram = "moonlight";
-  };
-}

pkgs/applications/misc/qMasterPassword/default.nix

@@ -71,7 +71,7 @@ stdenv.mkDerivation rec {
     '';
     homepage = "https://github.com/bkueng/qMasterPassword";
     license = licenses.gpl3;
-    maintainers = with lib.maintainers; [ tadeokondrak teutat3s ];
+    maintainers = with lib.maintainers; [ teutat3s ];
     platforms = platforms.all;
   };
 }

pkgs/applications/misc/tabula-java/default.nix

@@ -16,7 +16,7 @@ maven.buildMavenPackage rec {
     hash = "sha256-lg8/diyGhfkUU0w7PEOlxb1WNpJZVDDllxMMsTIU/Cw=";
   };
 
-  mvnHash = "sha256-yULCBHgctZZU3Deod+nQujssmUy+kgdFdgE3NUuFhOw=";
+  mvnHash = "sha256-CXJm9YlYsYViChFcH9e2P9pxK0q/tLWODOzZPXZ8hK0=";
   mvnParameters = "compile assembly:single -Dmaven.test.skip=true";
 
   nativeBuildInputs = [ makeWrapper ];

pkgs/applications/networking/calls/default.nix

@@ -34,7 +34,7 @@
 
 stdenv.mkDerivation rec {
   pname = "calls";
-  version = "46.0";
+  version = "46.3";
 
   src = fetchFromGitLab {
     domain = "gitlab.gnome.org";
@@ -42,7 +42,7 @@ stdenv.mkDerivation rec {
     repo = pname;
     rev = "v${version}";
     fetchSubmodules = true;
-    hash = "sha256-ZUVMK0Ex77EQKTGM0gBDHt8W9l4rHspihYduMcwMGho=";
+    hash = "sha256-J1wuhAXPCvLWzPqMU4alVFFpHoCAzX3wVOP3Bw0wW/o=";
   };
 
   outputs = [ "out" "devdoc" ];

pkgs/applications/networking/cluster/jx/default.nix

@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "jx";
-  version = "3.10.150";
+  version = "3.10.152";
 
   src = fetchFromGitHub {
     owner = "jenkins-x";
     repo = "jx";
     rev = "v${version}";
-    sha256 = "sha256-Zck06wbe+hLbecFnfY/udi1s712ilt7j0EdoumohOEI=";
+    sha256 = "sha256-rOpKaVn2D5UMYaVXLRxvwTRzo+nD1H/95FcQSeFgeFo=";
   };
 
   vendorHash = "sha256-AIaZVkWdNj1Vsrv2k4B5lLE0lOFuiTD7lwS/DikmC14=";

pkgs/applications/networking/cluster/linkerd/edge.nix

@@ -2,7 +2,7 @@
 
 (callPackage ./generic.nix { }) {
   channel = "edge";
-  version = "24.6.3";
-  sha256 = "1mlbb8qkx71anwqi027p9lv10kfck811ikfvc5gpnavfaaiwrrd1";
-  vendorHash = "sha256-nIDbwUvu1e/1ImVQMj4eOaPeFHM7HCcJMFk/ackdJSE=";
+  version = "24.6.4";
+  sha256 = "0pic9jncnal93g4kd8c02yl00jm0s11rax3bzz37l0iljjppxr6c";
+  vendorHash = "sha256-oNEXVyNvdDsEws+8WklYxpxeTOykLEvmvyY8FAIB6HU=";
 }

pkgs/applications/networking/cluster/ssm-session-manager-plugin/default.nix

@@ -5,7 +5,7 @@
 
 buildGoPackage rec {
   pname = "ssm-session-manager-plugin";
-  version = "1.2.633.0";
+  version = "1.2.650.0";
 
   goPackagePath = "github.com/aws/session-manager-plugin";
 
@@ -13,7 +13,7 @@ buildGoPackage rec {
     owner = "aws";
     repo = "session-manager-plugin";
     rev = version;
-    hash = "sha256-dwNCTJOxpothAcJSfch2jkxdgXg6xDd/fDQCQo2Xd+8=";
+    hash = "sha256-IcDVt/iE/EYV9Blvl7Gj0UFJcdsUCFdaSQkIto0CKRI=";
   };
 
   postPatch = ''

pkgs/applications/networking/cluster/weave-gitops/default.nix

@@ -31,7 +31,7 @@ buildGoModule rec {
     description = "Weave Gitops CLI";
     license = licenses.mpl20;
     platforms = platforms.linux;
-    maintainers = with maintainers; [ nullx76 ];
+    maintainers = with maintainers; [ ];
     mainProgram = "gitops";
   };
 }

pkgs/applications/networking/ids/suricata/default.nix

@@ -33,11 +33,11 @@
 in
 stdenv.mkDerivation rec {
   pname = "suricata";
-  version = "7.0.5";
+  version = "7.0.6";
 
   src = fetchurl {
     url = "https://www.openinfosecfoundation.org/download/${pname}-${version}.tar.gz";
-    hash = "sha256-H/tWgVjyZcCFVEZL+4VOZWjvaDvwMxKSO1HyjFB5Ck4=";
+    hash = "sha256-IYJPf/Egh8DJud4gcZmnWpwxsDA2aIx8ucF48KO1f40=";
   };
 
   nativeBuildInputs = [

pkgs/applications/networking/instant-messengers/qq/sources.nix

@@ -1,9 +1,9 @@
 # Generated by ./update.sh - do not update manually!
 # Last updated: 2024-06-17
 {
-  version = "3.2.9";
-  amd64_url = "https://dldir1.qq.com/qqfile/qq/QQNT/Linux/QQ_3.2.9_240617_amd64_01.deb";
-  arm64_url = "https://dldir1.qq.com/qqfile/qq/QQNT/Linux/QQ_3.2.9_240617_arm64_01.deb";
-  arm64_hash = "sha256-qC3eUc3Hs1nolZJhAds0Qx+tAlD/AR3scGxmcA8dtEw=";
-  amd64_hash = "sha256-ofoelAzbuCgxSHsZciWSVkDFDv+zsW+AzZqjeNlaja0=";
+  version = "3.2.10";
+  amd64_url = "https://dldir1.qq.com/qqfile/qq/QQNT/944f8942/linuxqq_3.2.10-25234_amd64.deb";
+  arm64_url = "https://dldir1.qq.com/qqfile/qq/QQNT/944f8942/linuxqq_3.2.10-25234_arm64.deb";
+  arm64_hash = "sha256-UY9UFbwQjXBd0+52iron1LZQWP/ncUZwylrtDzm5lW8=";
+  amd64_hash = "sha256-CHVX5tBV/w//At2wBjLqgTzayi4NI5i06IDgyW++ha4=";
 }

pkgs/applications/networking/instant-messengers/telegram/telegram-desktop/default.nix

@@ -59,16 +59,15 @@ let
       cxxStandard = "20";
     };
   };
-  mainProgram = if stdenv.isLinux then "telegram-desktop" else "Telegram";
 in
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "telegram-desktop";
   version = "5.2.2";
 
   src = fetchFromGitHub {
     owner = "telegramdesktop";
     repo = "tdesktop";
-    rev = "v${version}";
+    rev = "v${finalAttrs.version}";
     fetchSubmodules = true;
     hash = "sha256-rvd4Ei4MpWiilHCV291UrJkHaUcwth9AWc3PSqjj+EI=";
   };
@@ -200,19 +199,19 @@ stdenv.mkDerivation rec {
 
   installPhase = lib.optionalString stdenv.isDarwin ''
     mkdir -p $out/Applications
-    cp -r ${mainProgram}.app $out/Applications
-    ln -s $out/{Applications/${mainProgram}.app/Contents/MacOS,bin}
+    cp -r ${finalAttrs.meta.mainProgram}.app $out/Applications
+    ln -s $out/{Applications/${finalAttrs.meta.mainProgram}.app/Contents/MacOS,bin}
   '';
 
   postFixup = lib.optionalString stdenv.isLinux ''
     # This is necessary to run Telegram in a pure environment.
     # We also use gappsWrapperArgs from wrapGAppsHook.
-    wrapProgram $out/bin/${mainProgram} \
+    wrapProgram $out/bin/${finalAttrs.meta.mainProgram} \
       "''${gappsWrapperArgs[@]}" \
       "''${qtWrapperArgs[@]}" \
       --suffix PATH : ${lib.makeBinPath [ xdg-utils ]}
   '' + lib.optionalString stdenv.isDarwin ''
-    wrapQtApp $out/Applications/${mainProgram}.app/Contents/MacOS/${mainProgram}
+    wrapQtApp $out/Applications/${finalAttrs.meta.mainProgram}.app/Contents/MacOS/${finalAttrs.meta.mainProgram}
   '';
 
   passthru = {
@@ -231,6 +230,6 @@ stdenv.mkDerivation rec {
     homepage = "https://desktop.telegram.org/";
     changelog = "https://github.com/telegramdesktop/tdesktop/releases/tag/v${version}";
     maintainers = with maintainers; [ nickcao ];
-    inherit mainProgram;
+    mainProgram = if stdenv.hostPlatform.isLinux then "telegram-desktop" else "Telegram";
   };
-}
+})

pkgs/applications/networking/mailreaders/aerc/default.nix

@@ -71,7 +71,7 @@ buildGoModule rec {
   meta = with lib; {
     description = "Email client for your terminal";
     homepage = "https://aerc-mail.org/";
-    maintainers = with maintainers; [ tadeokondrak ];
+    maintainers = with maintainers; [ ];
     mainProgram = "aerc";
     license = licenses.mit;
     platforms = platforms.unix;

pkgs/applications/networking/mailreaders/evolution/evolution-ews/default.nix

@@ -22,11 +22,11 @@
 
 stdenv.mkDerivation rec {
   pname = "evolution-ews";
-  version = "3.52.2";
+  version = "3.52.3";
 
   src = fetchurl {
     url = "mirror://gnome/sources/${pname}/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    hash = "sha256-qVUPG1PUdANt0jmWJ7MRjrO4QxhBztwO3yFFewlhkUE=";
+    hash = "sha256-H9Y4L9X9MAQ4Rc/F3Ew0/gErzINRK2AwFUJQvGGAaMA=";
   };
 
   patches = [

pkgs/applications/networking/mailreaders/evolution/evolution/default.nix

@@ -45,11 +45,11 @@
 
 stdenv.mkDerivation rec {
   pname = "evolution";
-  version = "3.52.2";
+  version = "3.52.3";
 
   src = fetchurl {
     url = "mirror://gnome/sources/evolution/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    hash = "sha256-pIt0EtE+2sdPbAms+mdmVuahLt8AMM3cJgKawE2j5VE=";
+    hash = "sha256-HCL1O1VU4mCkjpF/PWaYNNJOTTrVoSTL4EKipKzkQcU=";
   };
 
   nativeBuildInputs = [

pkgs/applications/networking/remote/freerdp/3.nix

@@ -68,13 +68,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "freerdp";
-  version = "3.5.1";
+  version = "3.6.0";
 
   src = fetchFromGitHub {
     owner = "FreeRDP";
     repo = "FreeRDP";
     rev = finalAttrs.version;
-    hash = "sha256-8yWMnwJbvyUiEuX+2bEim1IeqPx20u9yvNIVe7MC/ZQ=";
+    hash = "sha256-wGfktzy8vrhTZE0ZG+gtsXsCmarXFs/yHcnZFeoFHGY=";
   };
 
   postPatch = ''

pkgs/applications/office/appflowy/default.nix

@@ -13,11 +13,11 @@
 
 stdenv.mkDerivation rec {
   pname = "appflowy";
-  version = "0.6.1";
+  version = "0.6.2";
 
   src = fetchzip {
     url = "https://github.com/AppFlowy-IO/appflowy/releases/download/${version}/AppFlowy-${version}-linux-x86_64.tar.gz";
-    hash = "sha256-a8oupvBtT3sKhboSeS/GbVSauKXx54J4WZd+PyIbuzU=";
+    hash = "sha256-vwhFFSdKlt2Ddikhdr3uyILjTVdgCjMtAW9HeLmT5qU=";
     stripRoot = false;
   };
 

pkgs/applications/office/ticktick/default.nix

@@ -15,11 +15,11 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "ticktick";
-  version = "2.0.20";
+  version = "2.0.30";
 
   src = fetchurl {
     url = "https://d2atcrkye2ik4e.cloudfront.net/download/linux/linux_deb_x64/${finalAttrs.pname}-${finalAttrs.version}-amd64.deb";
-    hash = "sha256-5w50QMSMmkpuhSOqv3LjrcQQDwaD7pIdKUo+8YUgvpk=";
+    hash = "sha256-oo1ssIU6nYMBoEc888xAiTS7PHuEkoaC7KsPRTwL0ZA=";
   };
 
   nativeBuildInputs = [

pkgs/applications/office/treesheets/default.nix

@@ -12,13 +12,13 @@
 
 stdenv.mkDerivation rec {
   pname = "treesheets";
-  version = "0-unstable-2024-06-23";
+  version = "0-unstable-2024-06-29";
 
   src = fetchFromGitHub {
     owner = "aardappel";
     repo = "treesheets";
-    rev = "91dea2ba714e9b1fb6ab660ddd295653218bdebc";
-    hash = "sha256-pn+Ki60lBL+2sKXnhYEly8/Yi94mhiMDxTnWZi4ZFOk=";
+    rev = "0d3eff693f23929e8b53317b08df9da2d610994f";
+    hash = "sha256-c5HMxFxDD439kKguW8Mwkjmnavh2MSSiODTgrnZcbjo=";
   };
 
   nativeBuildInputs = [

pkgs/applications/science/logic/workcraft/default.nix

@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "workcraft";
-  version = "3.4.2";
+  version = "3.5.0";
 
   src = fetchurl {
     url = "https://github.com/workcraft/workcraft/releases/download/v${version}/workcraft-v${version}-linux.tar.gz";
-    sha256 = "sha256-+O6fl/+D89L5xrrTaAnBTfw0tFz/CoKLaBa+OHtdnaA=";
+    sha256 = "sha256-ZOmc83OZVHIt/Sq6KQWuG4/xyeaETL8qJmmSjGcqL60=";
   };
 
   nativeBuildInputs = [ makeWrapper ];

pkgs/applications/science/logic/yices/default.nix

@@ -2,20 +2,15 @@
 
 stdenv.mkDerivation rec {
   pname = "yices";
-  # We never want X.Y.${odd} versions as they are moving development tags.
-  version = "2.6.4";
+  version = "2.6.5";
 
   src = fetchFromGitHub {
     owner  = "SRI-CSL";
     repo   = "yices2";
     rev    = "Yices-${version}";
-    sha256 = "sha256-qdxh86CkKdm65oHcRgaafTG9GUOoIgTDjeWmRofIpNE=";
+    hash = "sha256-/sKyHkFW5I5kojNIRPEKojzTvfRZiyVIN5VlBIbAV7k=";
   };
 
-  patches = [
-    # musl has no ldconfig, create symlinks explicitly
-    ./linux-no-ldconfig.patch
-  ];
   postPatch = "patchShebangs tests/regress/check.sh";
 
   nativeBuildInputs = [ autoreconfHook ];

pkgs/applications/science/logic/yices/linux-no-ldconfig.patch

@@ -1,13 +0,0 @@
---- a/Makefile.build
-+++ b/Makefile.build
-@@ -474,8 +474,9 @@ install-darwin: install-default
- install-solaris: install-default
- 	$(LDCONFIG) -n $(DESTDIR)$(libdir) && (cd $(DESTDIR)$(libdir) && $(LN_S) -f libyices.so.$(YICES_VERSION) libyices.so)
- 
-+# avoid ldconfig as it's not present on musl
- install-linux install-unix: install-default
--	$(LDCONFIG) -n $(DESTDIR)$(libdir) && (cd $(DESTDIR)$(libdir) && $(LN_S) -f libyices.so.$(YICES_VERSION) libyices.so)
-+	(cd $(DESTDIR)$(libdir) && $(LN_S) -f libyices.so.$(YICES_VERSION) libyices.so.$(MAJOR).$(MINOR) && $(LN_S) -f libyices.so.$(MAJOR).$(MINOR) libyices.so)
- 
- # on FreeBSD: the library file is libyices.so.X.Y and ldconfig does not take -n
- # TODO: fix this. We must also create a symbolic link: libyices.so.X in libdir

pkgs/applications/science/math/geogebra/geogebra6.nix

@@ -1,4 +1,12 @@
-{ lib, stdenv, unzip, fetchurl, electron, makeWrapper, geogebra }:
+{
+  lib,
+  stdenv,
+  unzip,
+  fetchurl,
+  electron,
+  makeWrapper,
+  geogebra,
+}:
 let
   pname = "geogebra";
   version = "6-0-794-0";
@@ -14,14 +22,17 @@ let
       calculus in one easy-to-use package.
     '';
     homepage = "https://www.geogebra.org/";
-    maintainers = with maintainers; [ voidless sikmir ];
+    maintainers = with maintainers; [
+      voidless
+      sikmir
+    ];
     license = licenses.geogebra;
     sourceProvenance = with sourceTypes; [
       binaryBytecode
-      binaryNativeCode  # some jars include native binaries
+      binaryNativeCode # some jars include native binaries
     ];
     platforms = with platforms; linux ++ darwin;
-    hydraPlatforms = [];
+    hydraPlatforms = [ ];
   };
 
   linuxPkg = stdenv.mkDerivation {
@@ -50,7 +61,9 @@ let
     installPhase = ''
       mkdir -p $out/libexec/geogebra/ $out/bin
       cp -r GeoGebra-linux-x64/{resources,locales} "$out/"
-      makeWrapper ${lib.getBin electron}/bin/electron $out/bin/geogebra --add-flags "$out/resources/app"
+      makeWrapper ${lib.getBin electron}/bin/electron $out/bin/geogebra \
+        --add-flags "$out/resources/app" \
+        --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--ozone-platform-hint=auto --enable-features=WaylandWindowDecorations}}"
       install -Dm644 "${desktopItem}/share/applications/"* \
         -t $out/share/applications/
 
@@ -84,6 +97,4 @@ let
     };
   };
 in
-if stdenv.isDarwin
-then darwinPkg
-else linuxPkg
+if stdenv.isDarwin then darwinPkg else linuxPkg

pkgs/applications/science/misc/openrefine/default.nix

@@ -56,7 +56,7 @@ in maven'.buildMavenPackage {
     cp -r ${npmPkg} main/webapp/modules/core/3rdparty
   '';
   mvnParameters = "-pl !packaging";
-  mvnHash = "sha256-0qsKUMV9M0ZaddR5ust8VikSrsutdxVNNezKqR+F/6M=";
+  mvnHash = "sha256-FD4g0Mshz39N1h8MDAk907PhF5TguWTZ7AXKECHuhzQ=";
 
   nativeBuildInputs = [ makeWrapper ];
 

pkgs/applications/version-management/git-cola/default.nix

@@ -64,5 +64,6 @@ python3Packages.buildPythonApplication rec {
     description = "Sleek and powerful Git GUI";
     license = licenses.gpl2;
     maintainers = [ maintainers.bobvanderlinden ];
+    mainProgram = "git-cola";
   };
 }

pkgs/applications/version-management/jujutsu/default.nix

@@ -19,16 +19,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "jujutsu";
-  version = "0.18.0";
+  version = "0.19.0";
 
   src = fetchFromGitHub {
     owner = "martinvonz";
     repo = "jj";
     rev = "v${version}";
-    hash = "sha256-5KKF85RNCPPaXMxBb7m2XC3EaEo+UcEhBdfMEzNPsAg=";
+    hash = "sha256-coASwU7nMalqvtqukhuRWz52My4e2Zl/7tqHNEvS1Nk=";
   };
 
-  cargoHash = "sha256-MiJuen3Lo7nPaAK30cENw3ACAdoYbHDoiGS05dk5m6U=";
+  cargoHash = "sha256-9SYjC3xL8OGGT56Q/yhH1oWeRT0Z956Yms6DGvCzlUY=";
 
   cargoBuildFlags = [ "--bin" "jj" ]; # don't install the fake editors
   useNextest = false; # nextest is the upstream integration framework, but is problematic for test skipping

pkgs/applications/video/kodi/no-python-lib.patch

@@ -0,0 +1,13 @@
+diff --git a/cmake/scripts/linux/Install.cmake b/cmake/scripts/linux/Install.cmake
+index 9c45c91774..763d6acab4 100644
+--- a/cmake/scripts/linux/Install.cmake
++++ b/cmake/scripts/linux/Install.cmake
+@@ -199,8 +199,6 @@ install(FILES ${CMAKE_BINARY_DIR}/${CORE_BUILD_DIR}/scripts/${APP_NAME}Config.cm
+ 
+ if(ENABLE_EVENTCLIENTS)
+   find_package(PythonInterpreter REQUIRED)
+-  execute_process(COMMAND ${PYTHON_EXECUTABLE} -c "from distutils.sysconfig import get_python_lib; print(get_python_lib(prefix=''))"
+-                  OUTPUT_VARIABLE PYTHON_LIB_PATH OUTPUT_STRIP_TRAILING_WHITESPACE)
+   # Install kodi-eventclients-common BT python files
+   install(PROGRAMS ${CMAKE_SOURCE_DIR}/tools/EventClients/lib/python/bt/__init__.py
+                    ${CMAKE_SOURCE_DIR}/tools/EventClients/lib/python/bt/bt.py

pkgs/applications/video/kodi/unwrapped.nix

@@ -1,4 +1,4 @@
-{ stdenv, lib, fetchFromGitHub, fetchzip
+{ stdenv, lib, fetchFromGitHub, fetchzip, fetchpatch
 , autoconf, automake, libtool, makeWrapper
 , pkg-config, cmake, yasm, python3Packages
 , libxcrypt, libgcrypt, libgpg-error, libunistring
@@ -97,6 +97,10 @@ in stdenv.mkDerivation (finalAttrs: {
       hash  = "sha256-xrFWqgwTkurEwt3/+/e4SCM6Uk9nxuW62SrCFWWqZO0=";
     };
 
+    patches = [
+      ./no-python-lib.patch
+    ];
+
     # make  derivations declared in the let binding available here, so
     # they can be overridden
     inherit libdvdcss libdvdnav libdvdread groovy
@@ -189,6 +193,7 @@ in stdenv.mkDerivation (finalAttrs: {
       "-DSWIG_EXECUTABLE=${buildPackages.swig}/bin/swig"
       "-DFLATBUFFERS_FLATC_EXECUTABLE=${buildPackages.flatbuffers}/bin/flatc"
       "-DPYTHON_EXECUTABLE=${buildPackages.python3Packages.python}/bin/python"
+      "-DPYTHON_LIB_PATH=${python3Packages.python.sitePackages}"
       # When wrapped KODI_HOME will likely contain symlinks to static assets
       # that Kodi's built in webserver will cautiously refuse to serve up
       # (because their realpaths are outside of KODI_HOME and the other

pkgs/applications/video/mpc-qt/default.nix

@@ -12,13 +12,13 @@
 
 stdenv.mkDerivation rec {
   pname = "mpc-qt";
-  version = "23.12";
+  version = "24.06";
 
   src = fetchFromGitHub {
     owner = "mpc-qt";
     repo = "mpc-qt";
     rev = "v${version}";
-    hash = "sha256-v22o5QtCY9Z8bPoIkwypG0oTBEPqPFeKZ8cWO+pKCD0=";
+    hash = "sha256-kEG7B99io3BGjN94nEX1pN10Bcjj21rb46Vcn2OtpN8=";
   };
 
   nativeBuildInputs = [

pkgs/applications/video/mpv/default.nix

@@ -377,7 +377,6 @@ stdenv'.mkDerivation (finalAttrs: {
       fpletz
       globin
       ma27
-      tadeokondrak
     ];
     platforms = lib.platforms.unix;
   };

pkgs/applications/video/mpv/scripts/memo.nix

@@ -7,13 +7,13 @@
 
 buildLua {
   pname = "memo";
-  version = "0-unstable-2023-10-31";
+  version = "0-unstable-2024-07-02";
 
   src = fetchFromGitHub {
     owner = "po5";
     repo = "memo";
-    rev = "6f2b036ef860e130ea584657389e0a7ceb4d954f";
-    hash = "sha256-m8ikXuw7PM4Btg8w7ufLneKA4fnYjMyfVJYueZILMw8=";
+    rev = "43ad5bc37d4ac63a00dd2a8f15b9028789467da7";
+    hash = "sha256-nHJ1x5R4Rw2YjB3Li3ZFbI3ZdLSqddJFzJlni4NjpH0=";
   };
 
   passthru.updateScript = unstableGitUpdater { };

pkgs/applications/video/vdr/softhddevice/default.nix

@@ -14,12 +14,12 @@
 }:
 stdenv.mkDerivation rec {
   pname = "vdr-softhddevice";
-  version = "2.3.3";
+  version = "2.3.4";
 
   src = fetchFromGitHub {
     owner = "ua0lnj";
     repo = "vdr-plugin-softhddevice";
-    sha256 = "sha256-PvSo5qiDMVrL6ylts5leR/3YAqIpIZcmnAqnGopPG94=";
+    sha256 = "sha256-pwA0LBQZ0jYXgBHhboAhyPM/kM7sboGw0O+3OIg5Nz4=";
     rev = "v${version}";
   };
 

pkgs/applications/virtualization/singularity/packages.nix

@@ -9,14 +9,14 @@ let
     callPackage
       (import ./generic.nix rec {
         pname = "apptainer";
-        version = "1.3.2";
+        version = "1.3.3";
         projectName = "apptainer";
 
         src = fetchFromGitHub {
           owner = "apptainer";
           repo = "apptainer";
           rev = "refs/tags/v${version}";
-          hash = "sha256-NseigaPmRKDsBk8v7RpYf+uoEGvQHVnqOMO49kP0mQ8=";
+          hash = "sha256-xQZCQa9z1aJ2tVtxMlwcNhlm0EV/nn8OnbfaVZRm4JI=";
         };
 
         # Update by running

pkgs/applications/virtualization/virt-what/default.nix

@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "virt-what";
-  version = "1.25";
+  version = "1.26";
 
   src = fetchurl {
     url = "https://people.redhat.com/~rjones/virt-what/files/${pname}-${version}.tar.gz";
-    sha256 = "sha256-1Py0I2Irr75eK7zYS32SrU1YP0d4siW3LEqBrp/Dxz0=";
+    sha256 = "sha256-qoap0xO1yQSK+a2aA4fkr/I4uw6kLzuDARTotQzTFTU=";
   };
 
   meta = with lib; {

pkgs/build-support/docker/examples.nix

@@ -619,10 +619,14 @@ rec {
     fakeRootCommands = ''
       mkdir -p ./home/alice
       chown 1000 ./home/alice
-      ln -s ${pkgs.hello.overrideAttrs (o: {
+      ln -s ${pkgs.hello.overrideAttrs (finalAttrs: prevAttrs: {
         # A unique `hello` to make sure that it isn't included via another mechanism by accident.
-        configureFlags = o.configureFlags or [] ++ [ " --program-prefix=layeredImageWithFakeRootCommands-" ];
+        configureFlags = prevAttrs.configureFlags or [] ++ [ " --program-prefix=layeredImageWithFakeRootCommands-" ];
         doCheck = false;
+        versionCheckProgram = "${builtins.placeholder "out"}/bin/${finalAttrs.meta.mainProgram}";
+        meta = prevAttrs.meta // {
+          mainProgram = "layeredImageWithFakeRootCommands-hello";
+        };
       })} ./hello
     '';
   };

pkgs/build-support/dotnet/build-dotnet-global-tool/default.nix

@@ -5,6 +5,8 @@
   # Name of the nuget package to install, if different from pname
 , nugetName ? pname
   # Hash of the nuget package to install, will be given on first build
+  # nugetHash uses SRI hash and should be preferred
+, nugetHash ? ""
 , nugetSha256 ? ""
   # Additional nuget deps needed by the tool package
 , nugetDeps ? (_: [])
@@ -24,7 +26,7 @@ buildDotnetModule (args // {
   nugetDeps = mkNugetDeps {
     name = pname;
     nugetDeps = { fetchNuGet }: [
-      (fetchNuGet { pname = nugetName; inherit version; sha256 = nugetSha256; })
+      (fetchNuGet { pname = nugetName; inherit version; sha256 = nugetSha256; hash = nugetHash; })
     ] ++ (nugetDeps fetchNuGet);
   };
 

pkgs/build-support/dotnet/fetchnuget/default.nix

@@ -5,15 +5,19 @@ attrs @
 , version
 , url ? "https://www.nuget.org/api/v2/package/${pname}/${version}"
 , sha256 ? ""
+, hash ? ""
 , md5 ? ""
 , ...
 }:
 if md5 != "" then
-  throw "fetchnuget does not support md5 anymore, please use sha256"
+  throw "fetchnuget does not support md5 anymore, please use 'hash' attribute with SRI hash"
+# This is also detected in fetchurl, but we just throw here to avoid confusion
+else if (sha256 != "" && hash != "") then
+  throw "multiple hashes passed to fetchNuGet"
 else
   buildDotnetPackage ({
     src = fetchurl {
-      inherit url sha256;
+      inherit url sha256 hash;
       name = "${pname}.${version}.zip";
     };
 

pkgs/build-support/dotnet/make-nuget-deps/default.nix

@@ -1,11 +1,14 @@
 { linkFarmFromDrvs, fetchurl }:
 { name, nugetDeps ? import sourceFile, sourceFile ? null }:
 linkFarmFromDrvs "${name}-nuget-deps" (nugetDeps {
-  fetchNuGet = { pname, version, sha256
+  fetchNuGet = { pname, version, sha256 ? "", hash ? ""
     , url ? "https://www.nuget.org/api/v2/package/${pname}/${version}" }:
     fetchurl {
       name = "${pname}.${version}.nupkg";
-      inherit url sha256;
+      # There is no need to verify whether both sha256 and hash are
+      # valid here, because nuget-to-nix does not generate a deps.nix
+      # containing both.
+      inherit url sha256 hash;
     };
 }) // {
   inherit sourceFile;

pkgs/build-support/dotnet/nuget-to-nix/nuget-to-nix.sh

@@ -65,11 +65,11 @@ for package in *; do
     for source in "${remote_sources[@]}"; do
       url="${base_addresses[$source]}$package/$version/$package.$version.nupkg"
       if [[ "$source" == "$used_source" ]]; then
-        sha256="$(nix-hash --type sha256 --flat --base32 "$version/$package.$version".nupkg)"
+        hash="$(nix-hash --type sha256 --flat --sri "$version/$package.$version".nupkg)"
         found=true
         break
       else
-        if sha256=$(nix-prefetch-url "$url" 2>"$tmp"/error); then
+        if hash=$(nix-prefetch-url "$url" 2>"$tmp"/error); then
           # If multiple remote sources are enabled, nuget will try them all
           # concurrently and use the one that responds first. We always use the
           # first source that has the package.
@@ -91,9 +91,9 @@ for package in *; do
     fi
 
     if [[ "$source" != https://api.nuget.org/v3/index.json ]]; then
-      echo "  (fetchNuGet { pname = \"$id\"; version = \"$version\"; sha256 = \"$sha256\"; url = \"$url\"; })"
+      echo "  (fetchNuGet { pname = \"$id\"; version = \"$version\"; hash = \"$hash\"; url = \"$url\"; })"
     else
-      echo "  (fetchNuGet { pname = \"$id\"; version = \"$version\"; sha256 = \"$sha256\"; })"
+      echo "  (fetchNuGet { pname = \"$id\"; version = \"$version\"; hash = \"$hash\"; })"
     fi
   done
   cd ..

pkgs/build-support/make-desktopitem/default.nix

@@ -108,11 +108,12 @@ let
   renderAction = name: attrs: renderSection "Desktop Action ${name}" (preprocessAction attrs);
   actionsRendered = lib.mapAttrsToList renderAction actions;
 
+  extension = if type == "Directory" then "directory" else "desktop";
   content = [ mainSectionRendered ] ++ actionsRendered;
 in
 writeTextFile {
-  name = "${name}.desktop";
-  destination = "/share/applications/${name}.desktop";
+  name = "${name}.${extension}";
+  destination = "/share/applications/${name}.${extension}";
   text = builtins.concatStringsSep "\n" content;
   checkPhase = ''${buildPackages.desktop-file-utils}/bin/desktop-file-validate "$target"'';
 })

pkgs/build-support/rust/build-rust-crate/configure-crate.nix

@@ -195,7 +195,7 @@ in ''
          export CARGO_FEATURE_$feature=1
        done
 
-       target/build/${crateName}/build_script_build > target/build/${crateName}.opt
+       target/build/${crateName}/build_script_build | tee target/build/${crateName}.opt
      )
 
      set +e

pkgs/by-name/an/ananicy-rules-cachyos/package.nix

@@ -7,13 +7,13 @@
 
 stdenvNoCC.mkDerivation {
   pname = "ananicy-rules-cachyos";
-  version = "0-unstable-2024-06-22";
+  version = "0-unstable-2024-07-03";
 
   src = fetchFromGitHub {
     owner = "CachyOS";
     repo = "ananicy-rules";
-    rev = "049badd3263ed2af20c9e98b062f8c31cf74cec6";
-    hash = "sha256-KEFXCaLZL3D7ue4W+MqODg/F633sU8JzDMKM2ebUoD8=";
+    rev = "3f76b3f497e590c4b6a4f9316b212c627631399b";
+    hash = "sha256-qwyqOgv4djIrJn9MlHO/I8zC741b4ORxDMgYZ+Da2eM=";
   };
 
   dontConfigure = true;

pkgs/by-name/ap/apt/package.nix

@@ -33,11 +33,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "apt";
-  version = "2.9.5";
+  version = "2.9.6";
 
   src = fetchurl {
     url = "mirror://debian/pool/main/a/apt/apt_${finalAttrs.version}.tar.xz";
-    hash = "sha256-bSstTP+9gxOhHnO8PIb4/5W8Xg3vc1nvrDAz9WMFGJQ=";
+    hash = "sha256-eapV5XBc/WmpMSsf8j17WOUyMu4itk0WozPzrmJmDdc=";
   };
 
   # cycle detection; lib can't be split

pkgs/by-name/ar/arc-browser/package.nix

@@ -9,11 +9,11 @@
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "arc-browser";
-  version = "1.49.0-51346";
+  version = "1.49.1-51495";
 
   src = fetchurl {
     url = "https://releases.arc.net/release/Arc-${finalAttrs.version}.dmg";
-    hash = "sha256-XrFDYzRUGCSyM8E+zHK/OZMKWYI9kCxUQ2TI98htPWk=";
+    hash = "sha256-9wuZQgf8uta0ynMRe3GKqORZsCuwhvxjSpGLajCp7N8=";
   };
 
   nativeBuildInputs = [ undmg ];