Merge master into haskell-updates

maintainers/maintainer-list.nix

@@ -1234,6 +1234,12 @@
     githubId = 37040543;
     name = "Wroclaw";
   };
+  amuckstot30 = {
+    email = "amuckstot30@tutanota.com";
+    github = "amuckstot30";
+    githubId = 157274630;
+    name = "amuckstot30";
+  };
   amyipdev = {
     email = "amy@amyip.net";
     github = "amyipdev";
@@ -2938,6 +2944,14 @@
     githubId = 3229981;
     name = "Duncan Fairbanks";
   };
+  BonusPlay = {
+    name = "Bonus";
+    email = "nixos@bonusplay.pl";
+    matrix = "@bonus:bonusplay.pl";
+    github = "BonusPlay";
+    githubId = 8405359;
+    keys = [ { fingerprint = "8279 6487 A4CA 2A28 E8B3  3CD6 C7F9 9743 6A20 4683"; } ];
+  };
   booklearner = {
     name = "booklearner";
     email = "booklearner@proton.me";
@@ -5597,6 +5611,12 @@
     name = "Misha Gusarov";
     keys = [ { fingerprint = "A8DF 1326 9E5D 9A38 E57C  FAC2 9D20 F650 3E33 8888"; } ];
   };
+  dottybot = {
+    name = "Scala Organization (dottybot)";
+    email = "dottybot@groupes.epfl.ch";
+    github = "dottybot";
+    githubId = 12519979;
+  };
   dpaetzel = {
     email = "david.paetzel@posteo.de";
     github = "dpaetzel";
@@ -8237,6 +8257,12 @@
     githubId = 1742172;
     name = "Hamish Hutchings";
   };
+  hamzaremmal = {
+    email = "hamza.remmal@epfl.ch";
+    github = "hamzaremmal";
+    githubId = 56235032;
+    name = "Hamza Remmal";
+  };
   hanemile = {
     email = "mail@emile.space";
     github = "HanEmile";
@@ -14759,6 +14785,13 @@
     githubId = 818502;
     name = "Nathan Yong";
   };
+  natsukagami = {
+    email = "natsukagami@gmail.com";
+    github = "natsukagami";
+    githubId = 9061737;
+    name = "Natsu Kagami";
+    keys = [ { fingerprint = "5581 26DC 886F E14D 501D  B0F2 D6AD 7B57 A992 460C"; } ];
+  };
   natsukium = {
     email = "nixpkgs@natsukium.com";
     github = "natsukium";

nixos/doc/manual/release-notes/rl-2411.section.md

@@ -73,6 +73,8 @@
 
 - [Goatcounter](https://www.goatcounter.com/), Easy web analytics. No tracking of personal data. Available as [services.goatcounter](options.html#opt-services.goatcocunter.enable).
 
+- [Privatebin](https://github.com/PrivateBin/PrivateBin/), A minimalist, open source online pastebin where the server has zero knowledge of pasted data. Available as [services.privatebin](#opt-services.privatebin.enable)
+
 - [UWSM](https://github.com/Vladimir-csp/uwsm), a wayland session manager to wrap Wayland Compositors into useful systemd units such as `graphical-session.target`. Available as [programs.uwsm](#opt-programs.uwsm.enable).
 
 - [Open-WebUI](https://github.com/open-webui/open-webui), a user-friendly WebUI
@@ -331,6 +333,15 @@
   a static `user` and `group`. The `writablePaths` option has been removed and
   the models directory is now always exempt from sandboxing.
 
+- The `gns3-server` service now runs under the `gns3` system user
+  instead of a dynamically created one via `DynamicUser`.
+  The use of SUID wrappers is incompatible with SystemD's `DynamicUser` setting,
+  and GNS3 requires calling ubridge through its SUID wrapper to function properly.
+  This change requires to manually move the following directories:
+    * from `/var/lib/private/gns3` to `/var/lib/gns3`
+    * from `/var/log/private/gns3` to `/var/log/gns3`
+  and to change the ownership of these directories and their contents to `gns3` (including `/etc/gns3`).
+
 - Legacy package `stalwart-mail_0_6` was dropped, please note the
   [manual upgrade process](https://github.com/stalwartlabs/mail-server/blob/main/UPGRADING.md)
   before changing the package to `pkgs.stalwart-mail` in

nixos/modules/config/nix-flakes.nix

@@ -72,7 +72,7 @@ in
                   type = "path";
                   path = config.flake.outPath;
                 } // filterAttrs
-                  (n: _: n == "lastModified" || n == "rev" || n == "revCount" || n == "narHash")
+                  (n: _: n == "lastModified" || n == "rev" || n == "narHash")
                   config.flake
               ));
             };

nixos/modules/module-list.nix

@@ -1489,6 +1489,7 @@
   ./services/web-apps/powerdns-admin.nix
   ./services/web-apps/pretalx.nix
   ./services/web-apps/pretix.nix
+  ./services/web-apps/privatebin.nix
   ./services/web-apps/prosody-filer.nix
   ./services/web-apps/rimgo.nix
   ./services/web-apps/rutorrent.nix

nixos/modules/profiles/macos-builder.nix

@@ -196,14 +196,8 @@ in
       # To prevent gratuitous rebuilds on each change to Nixpkgs
       nixos.revision = null;
 
-      stateVersion = lib.mkDefault (throw ''
-        The macOS linux builder should not need a stateVersion to be set, but a module
-        has accessed stateVersion nonetheless.
-        Please inspect the trace of the following command to figure out which module
-        has a dependency on stateVersion.
-
-          nix-instantiate --attr darwin.linux-builder --show-trace
-      '');
+      # to be updated by module maintainers, see nixpkgs#325610
+      stateVersion = "24.05";
     };
 
     users.users."${user}" = {

nixos/modules/programs/tsm-client.nix

@@ -22,7 +22,7 @@ let
   serverOptions = { name, config, ... }: {
     freeformType = attrsOf (either scalarType (listOf scalarType));
     # Client system-options file directives are explained here:
-    # https://www.ibm.com/docs/en/storage-protect/8.1.23?topic=commands-processing-options
+    # https://www.ibm.com/docs/en/storage-protect/8.1.24?topic=commands-processing-options
     options.servername = mkOption {
       type = servernameType;
       default = name;

nixos/modules/security/isolate.nix

@@ -125,7 +125,7 @@ in
     };
 
     systemd.slices.isolate = {
-      description = "Isolate sandbox slice";
+      description = "Isolate Sandbox Slice";
     };
 
     meta.maintainers = with maintainers; [ virchau13 ];

nixos/modules/services/backup/bacula.nix

@@ -657,7 +657,7 @@ in {
 
   config = mkIf (fd_cfg.enable || sd_cfg.enable || dir_cfg.enable) {
     systemd.slices.system-bacula = {
-      description = "Bacula Slice";
+      description = "Bacula Backup System Slice";
       documentation = [ "man:bacula(8)" "https://www.bacula.org/" ];
     };
 

nixos/modules/services/backup/tsm.nix

@@ -90,7 +90,7 @@ in
       environment.HOME = "/var/lib/tsm-backup";
       serviceConfig = {
         # for exit status description see
-        # https://www.ibm.com/docs/en/storage-protect/8.1.23?topic=clients-client-return-codes
+        # https://www.ibm.com/docs/en/storage-protect/8.1.24?topic=clients-client-return-codes
         SuccessExitStatus = "4 8";
         # The `-se` option must come after the command.
         # The `-optfile` option suppresses a `dsm.opt`-not-found warning.

nixos/modules/services/continuous-integration/hydra/default.nix

@@ -311,7 +311,7 @@ in
     ];
 
     systemd.slices.system-hydra = {
-      description = "Hydra Slice";
+      description = "Hydra CI Server Slice";
       documentation = [ "file://${cfg.package}/share/doc/hydra/index.html" "https://nixos.org/hydra/manual/" ];
     };
 

nixos/modules/services/development/athens.nix

@@ -168,7 +168,7 @@ in
       type = lib.types.package;
       default = pkgs.go;
       defaultText = lib.literalExpression "pkgs.go";
-      example = "pkgs.go_1_21";
+      example = "pkgs.go_1_23";
       description = ''
         The Go package used by Athens at runtime.
 

nixos/modules/services/misc/paperless.nix

@@ -234,7 +234,7 @@ in
     services.redis.servers.paperless.enable = mkIf enableRedis true;
 
     systemd.slices.system-paperless = {
-      description = "Paperless slice";
+      description = "Paperless Document Management System Slice";
       documentation = [ "https://docs.paperless-ngx.com" ];
     };
 

nixos/modules/services/misc/redmine.nix

@@ -74,6 +74,12 @@ in
         description = "Group under which Redmine is ran.";
       };
 
+      address = mkOption {
+        type = types.str;
+        default = "0.0.0.0";
+        description = "IP address Redmine should bind to.";
+      };
+
       port = mkOption {
         type = types.port;
         default = 3000;
@@ -429,7 +435,7 @@ in
         Group = cfg.group;
         TimeoutSec = "300";
         WorkingDirectory = "${cfg.package}/share/redmine";
-        ExecStart="${bundle} exec rails server -u webrick -e production -p ${toString cfg.port} -P '${cfg.stateDir}/redmine.pid'";
+        ExecStart="${bundle} exec rails server -u webrick -e production -b ${toString cfg.address} -p ${toString cfg.port} -P '${cfg.stateDir}/redmine.pid'";
       };
 
     };

nixos/modules/services/monitoring/rustdesk-server.nix

@@ -86,7 +86,7 @@ in {
 
     systemd.slices.system-rustdesk = {
       enable = true;
-      description = "Slice designed to contain RustDesk Signal & RustDesk Relay";
+      description = "RustDesk Remote Desktop Slice";
     };
 
     systemd.targets.rustdesk = {

nixos/modules/services/network-filesystems/samba.nix

@@ -179,7 +179,7 @@ in
 
         systemd = {
           slices.system-samba = {
-            description = "Samba slice";
+            description = "Samba (SMB Networking Protocol) Slice";
           };
           targets.samba = {
             description = "Samba Server";

nixos/modules/services/networking/gns3-server.nix

@@ -129,8 +129,15 @@ in {
       }
     ];
 
+    users.groups.gns3 = { };
+
     users.groups.ubridge = lib.mkIf cfg.ubridge.enable { };
 
+    users.users.gns3 = {
+      group = "gns3";
+      isSystemUser = true;
+    };
+
     security.wrappers.ubridge = lib.mkIf cfg.ubridge.enable {
       capabilities = "cap_net_raw,cap_net_admin=eip";
       group = "ubridge";
@@ -150,7 +157,7 @@ in {
         };
       }
       (lib.mkIf (cfg.ubridge.enable) {
-        Server.ubridge_path = lib.mkDefault (lib.getExe cfg.ubridge.package);
+        Server.ubridge_path = lib.mkDefault "/run/wrappers/bin/ubridge";
       })
       (lib.mkIf (cfg.auth.enable) {
         Server = {
@@ -206,7 +213,6 @@ in {
       serviceConfig = {
         ConfigurationDirectory = "gns3";
         ConfigurationDirectoryMode = "0750";
-        DynamicUser = true;
         Environment = "HOME=%S/gns3";
         ExecReload = "${pkgs.coreutils}/bin/kill -HUP $MAINPID";
         ExecStart = "${lib.getExe cfg.package} ${commandArgs}";
@@ -227,14 +233,27 @@ in {
         User = "gns3";
         WorkingDirectory = "%S/gns3";
 
+        # Required for ubridge integration to work
+        #
+        # GNS3 needs to run SUID binaries (ubridge)
+        # but NoNewPrivileges breaks execution of SUID binaries
+        DynamicUser = false;
+        NoNewPrivileges = false;
+        RestrictSUIDSGID = false;
+        PrivateUsers = false;
+
         # Hardening
-        DeviceAllow = lib.optional flags.enableLibvirtd "/dev/kvm";
+        DeviceAllow = [
+          # ubridge needs access to tun/tap devices
+          "/dev/net/tap rw"
+          "/dev/net/tun rw"
+        ] ++ lib.optionals flags.enableLibvirtd [
+          "/dev/kvm"
+        ];
         DevicePolicy = "closed";
         LockPersonality = true;
         MemoryDenyWriteExecute = true;
-        NoNewPrivileges = true;
         PrivateTmp = true;
-        PrivateUsers = true;
         # Don't restrict ProcSubset because python3Packages.psutil requires read access to /proc/stat
         # ProcSubset = "pid";
         ProtectClock = true;
@@ -255,8 +274,7 @@ in {
         ];
         RestrictNamespaces = true;
         RestrictRealtime = true;
-        RestrictSUIDSGID = true;
-        UMask = "0077";
+        UMask = "0022";
       };
     };
   };

nixos/modules/services/security/clamav.nix

@@ -165,7 +165,7 @@ in
     environment.etc."clamav/clamd.conf".source = clamdConfigFile;
 
     systemd.slices.system-clamav = {
-      description = "ClamAV slice";
+      description = "ClamAV Antivirus Slice";
     };
 
     systemd.services.clamav-daemon = mkIf cfg.daemon.enable {

nixos/modules/services/web-apps/openwebrx.nix

@@ -18,7 +18,7 @@ in
         codec2
         js8call
         m17-cxx-demod
-        alsaUtils
+        alsa-utils
         netcat
       ];
       serviceConfig = {

nixos/modules/services/web-apps/privatebin.nix

@@ -0,0 +1,228 @@
+{
+  pkgs,
+  config,
+  lib,
+  ...
+}:
+
+let
+  cfg = config.services.privatebin;
+
+  customToINI = lib.generators.toINI {
+    mkKeyValue = lib.generators.mkKeyValueDefault {
+      mkValueString =
+        v:
+        if v == true then
+          ''true''
+        else if v == false then
+          ''false''
+        else if builtins.isInt v then
+          ''${builtins.toString v}''
+        else if builtins.isPath v then
+          ''"${builtins.toString v}"''
+        else if builtins.isString v then
+          ''"${v}"''
+        else
+          lib.generators.mkValueStringDefault { } v;
+    } "=";
+  };
+
+  privatebinSettings = pkgs.writeTextDir "conf.php" (customToINI cfg.settings);
+
+  user = cfg.user;
+  group = cfg.group;
+
+  defaultUser = "privatebin";
+  defaultGroup = "privatebin";
+
+in
+{
+
+  options.services.privatebin = {
+
+    enable = lib.mkEnableOption "Privatebin: A minimalist, open source online
+      pastebin where the server has zero knowledge of pasted data.";
+
+    user = lib.mkOption {
+      type = lib.types.str;
+      default = defaultUser;
+      description = "User account under which privatebin runs.";
+    };
+
+    group = lib.mkOption {
+      type = lib.types.str;
+      default = if cfg.enableNginx then "nginx" else defaultGroup;
+      defaultText = "If `services.privatebin.enableNginx` is true then `nginx` else ${defaultGroup}";
+      description = ''
+        Group under which privatebin runs. It is best to set this to the group
+        of whatever webserver is being used as the frontend.
+      '';
+    };
+
+    dataDir = lib.mkOption {
+      type = lib.types.path;
+      default = "/var/lib/privatebin";
+      description = ''
+        The place where privatebin stores its state.
+      '';
+    };
+
+    package = lib.mkPackageOption pkgs "privatebin" { };
+
+    enableNginx = lib.mkOption {
+      type = lib.types.bool;
+      default = false;
+      description = ''
+        Whether to enable nginx or not. If enabled, an nginx virtual host will
+        be created for access to firefly-iii. If not enabled, then you may use
+        `''${config.services.firefly-iii.package}` as your document root in
+        whichever webserver you wish to setup.
+      '';
+    };
+
+    virtualHost = lib.mkOption {
+      type = lib.types.str;
+      default = "localhost";
+      description = ''
+        The hostname at which you wish privatebin to be served. If you have
+        enabled nginx using `services.privatebin.enableNginx` then this will
+        be used.
+      '';
+    };
+
+    poolConfig = lib.mkOption {
+      type = lib.types.attrsOf (
+        lib.types.oneOf [
+          lib.types.str
+          lib.types.int
+          lib.types.bool
+        ]
+      );
+      defaultText = lib.literalExpression ''
+        {
+          "pm" = "dynamic";
+          "pm.max_children" = 32;
+          "pm.start_servers" = 2;
+          "pm.min_spare_servers" = 2;
+          "pm.max_spare_servers" = 4;
+          "pm.max_requests" = 500;
+        }
+      '';
+      default = { };
+      description = ''
+        Options for the PrivateBin PHP pool. See the documentation on <literal>php-fpm.conf</literal>
+        for details on configuration directives.
+      '';
+    };
+
+    settings = lib.mkOption {
+      default = { };
+      description = ''
+        Options for privatebin configuration. Refer to
+        <https://github.com/PrivateBin/PrivateBin/wiki/Configuration> for
+        details on supported values.
+      '';
+      example = lib.literalExpression ''
+        {
+          main = {
+            name = "NixOS Based Privatebin";
+            discussion = false;
+            defaultformatter = "plalib.types.intext";
+            qrcode = true
+          };
+          model.class = "Filesystem";
+          model_options.dir = "/var/lib/privatebin/data";
+        }
+      '';
+      type = lib.types.submodule { freeformType = lib.types.attrsOf lib.types.anything; };
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+
+    services.privatebin.settings = {
+      main = lib.mkDefault { };
+      model.class = lib.mkDefault "Filesystem";
+      model_options.dir = lib.mkDefault "${cfg.dataDir}/data";
+      purge.dir = lib.mkDefault "${cfg.dataDir}/purge";
+      traffic = {
+        dir = lib.mkDefault "${cfg.dataDir}/traffic";
+        header = "X_FORWARDED_FOR";
+      };
+    };
+
+    services.phpfpm.pools.privatebin = {
+      inherit user group;
+      phpPackage = pkgs.php83;
+      phpOptions = ''
+        log_errors = on
+      '';
+      settings = {
+        "listen.mode" = lib.mkDefault "0660";
+        "listen.owner" = lib.mkDefault user;
+        "listen.group" = lib.mkDefault group;
+        "pm" = lib.mkDefault "dynamic";
+        "pm.max_children" = lib.mkDefault 32;
+        "pm.start_servers" = lib.mkDefault 2;
+        "pm.min_spare_servers" = lib.mkDefault 2;
+        "pm.max_spare_servers" = lib.mkDefault 4;
+        "pm.max_requests" = lib.mkDefault 500;
+      };
+      phpEnv.CONFIG_PATH = lib.strings.removeSuffix "/conf.php" (builtins.toString privatebinSettings);
+    };
+
+    services.nginx = lib.mkIf cfg.enableNginx {
+      enable = true;
+      recommendedTlsSettings = lib.mkDefault true;
+      recommendedOptimisation = lib.mkDefault true;
+      recommendedGzipSettings = lib.mkDefault true;
+      virtualHosts.${cfg.virtualHost} = {
+        root = "${cfg.package}";
+        locations = {
+          "/" = {
+            tryFiles = "$uri $uri/ /index.php?$query_string";
+            index = "index.php";
+            extraConfig = ''
+              sendfile off;
+            '';
+          };
+          "~ \.php$" = {
+            extraConfig = ''
+              include ${config.services.nginx.package}/conf/fastcgi_params ;
+              fastcgi_param SCRIPT_FILENAME $request_filename;
+              fastcgi_param modHeadersAvailable true; #Avoid sending the security headers twice
+              fastcgi_pass unix:${config.services.phpfpm.pools.privatebin.socket};
+            '';
+          };
+        };
+      };
+    };
+
+    systemd.tmpfiles.settings."10-privatebin" =
+      lib.attrsets.genAttrs
+        [
+          "${cfg.dataDir}/data"
+          "${cfg.dataDir}/traffic"
+          "${cfg.dataDir}/purge"
+        ]
+        (n: {
+          d = {
+            group = group;
+            mode = "0750";
+            user = user;
+          };
+        });
+
+    users = {
+      users = lib.mkIf (user == defaultUser) {
+        ${defaultUser} = {
+          description = "Privatebin service user";
+          inherit group;
+          isSystemUser = true;
+          home = cfg.dataDir;
+        };
+      };
+      groups = lib.mkIf (group == defaultGroup) { ${defaultGroup} = { }; };
+    };
+  };
+}

nixos/modules/services/web-servers/phpfpm/default.nix

@@ -240,7 +240,7 @@ in {
     };
 
     systemd.slices.system-phpfpm = {
-      description = "PHP FastCGI Process manager pools slice";
+      description = "PHP FastCGI Process Manager Slice";
     };
 
     systemd.targets.phpfpm = {

nixos/modules/services/x11/desktop-managers/cinnamon.nix

@@ -192,10 +192,7 @@ in
       xdg.portal.enable = true;
       xdg.portal.extraPortals = [
         pkgs.xdg-desktop-portal-xapp
-        (pkgs.xdg-desktop-portal-gtk.override {
-          # Do not build portals that we already have.
-          buildPortalsInGnome = false;
-        })
+        pkgs.xdg-desktop-portal-gtk
       ];
 
       services.orca.enable = mkDefault (notExcluded pkgs.orca);

nixos/modules/services/x11/desktop-managers/deepin.nix

@@ -74,9 +74,7 @@ in
       xdg.icons.enable = true;
       xdg.portal.enable = mkDefault true;
       xdg.portal.extraPortals = mkDefault [
-        (pkgs.xdg-desktop-portal-gtk.override {
-          buildPortalsInGnome = false;
-        })
+        pkgs.xdg-desktop-portal-gtk
       ];
 
       # https://github.com/NixOS/nixpkgs/pull/247766#issuecomment-1722839259

nixos/modules/services/x11/desktop-managers/gnome.nix

@@ -281,10 +281,7 @@ in
       xdg.portal.enable = true;
       xdg.portal.extraPortals = [
         pkgs.xdg-desktop-portal-gnome
-        (pkgs.xdg-desktop-portal-gtk.override {
-          # Do not build portals that we already have.
-          buildPortalsInGnome = false;
-        })
+        pkgs.xdg-desktop-portal-gtk
       ];
       xdg.portal.configPackages = mkDefault [ pkgs.gnome-session ];
 

nixos/modules/tasks/network-interfaces-scripted.nix

@@ -447,7 +447,7 @@ let
           (let
             deps = deviceDependency v.interface;
           in
-          { description = "Vlan Interface ${n}";
+          { description = "MACVLAN Interface ${n}";
             wantedBy = [ "network-setup.service" (subsystemDevice n) ];
             bindsTo = deps;
             partOf = [ "network-setup.service" ];
@@ -567,7 +567,7 @@ let
           (let
             deps = deviceDependency v.interface;
           in
-          { description = "Vlan Interface ${n}";
+          { description = "VLAN Interface ${n}";
             wantedBy = [ "network-setup.service" (subsystemDevice n) ];
             bindsTo = deps;
             partOf = [ "network-setup.service" ];

nixos/modules/virtualisation/nixos-containers.nix

@@ -109,13 +109,15 @@ let
 
       cp --remove-destination /etc/resolv.conf "$root/etc/resolv.conf"
 
+      declare -a extraFlags
+
       if [ "$PRIVATE_NETWORK" = 1 ]; then
-        extraFlags+=" --private-network"
+        extraFlags+=("--private-network")
       fi
 
       if [ -n "$HOST_ADDRESS" ]  || [ -n "$LOCAL_ADDRESS" ] ||
          [ -n "$HOST_ADDRESS6" ] || [ -n "$LOCAL_ADDRESS6" ]; then
-        extraFlags+=" --network-veth"
+        extraFlags+=("--network-veth")
       fi
 
       if [ -n "$HOST_PORT" ]; then
@@ -123,30 +125,30 @@ let
         IFS=","
         for i in $HOST_PORT
         do
-            extraFlags+=" --port=$i"
+            extraFlags+=("--port=$i")
         done
         IFS=$OIFS
       fi
 
       if [ -n "$HOST_BRIDGE" ]; then
-        extraFlags+=" --network-bridge=$HOST_BRIDGE"
+        extraFlags+=("--network-bridge=$HOST_BRIDGE")
       fi
 
-      extraFlags+=" ${concatStringsSep " " (mapAttrsToList nspawnExtraVethArgs cfg.extraVeths)}"
+      extraFlags+=(${lib.escapeShellArgs (mapAttrsToList nspawnExtraVethArgs cfg.extraVeths)})
 
       for iface in $INTERFACES; do
-        extraFlags+=" --network-interface=$iface"
+        extraFlags+=("--network-interface=$iface")
       done
 
       for iface in $MACVLANS; do
-        extraFlags+=" --network-macvlan=$iface"
+        extraFlags+=("--network-macvlan=$iface")
       done
 
       # If the host is 64-bit and the container is 32-bit, add a
       # --personality flag.
       ${optionalString (pkgs.stdenv.hostPlatform.system == "x86_64-linux") ''
         if [ "$(< "''${SYSTEM_PATH:-/nix/var/nix/profiles/per-container/$INSTANCE/system}/system")" = i686-linux ]; then
-          extraFlags+=" --personality=x86"
+          extraFlags+=("--personality=x86")
         fi
       ''}
 
@@ -157,9 +159,11 @@ let
       # Kill signal handling means systemd-nspawn will pass a system-halt signal
       # to the container systemd when it receives SIGTERM for container shutdown;
       # containerInit and stage2 have to handle this as well.
+      # TODO: fix shellcheck issue properly
+      # shellcheck disable=SC2086
       exec ${config.systemd.package}/bin/systemd-nspawn \
         --keep-unit \
-        -M "$INSTANCE" -D "$root" $extraFlags \
+        -M "$INSTANCE" -D "$root" "''${extraFlags[@]}" \
         $EXTRA_NSPAWN_FLAGS \
         --notify-ready=yes \
         --kill-signal=SIGRTMIN+3 \

nixos/tests/all-tests.nix

@@ -825,6 +825,7 @@ in {
   printing-socket = handleTest ./printing.nix { socket = true; };
   printing-service = handleTest ./printing.nix { socket = false; };
   private-gpt = handleTest ./private-gpt.nix {};
+  privatebin = runTest ./privatebin.nix;
   privoxy = handleTest ./privoxy.nix {};
   prometheus = handleTest ./prometheus {};
   prometheus-exporters = handleTest ./prometheus-exporters.nix {};

nixos/tests/apfs.nix

@@ -18,6 +18,10 @@
     with subtest("mkapfs works with the maximum label length"):
       machine.succeed("mkapfs -L '000102030405060708090A0B0C0D0E0F101112131415161718191A1B1C1D1E1F202122232425262728292A2B2C2D2E2F303132333435363738393A3B3C3D3E3F404142434445464748494A4B4C4D4E4F505152535455565758595A5B5C5D5E5F606162636465666768696A6B6C6D6E6F707172737475767778797A7B7C7D7E7' /dev/vdb")
 
+    with subtest("apfs-label works"):
+      machine.succeed("mkapfs -L 'myLabel' /dev/vdb")
+      machine.succeed("apfs-label /dev/vdb | grep -q myLabel")
+
     with subtest("Enable case sensitivity and normalization sensitivity"):
       machine.succeed(
           "mkapfs -s -z /dev/vdb",

nixos/tests/postgis.nix

@@ -26,5 +26,13 @@ import ./make-test-python.nix ({ pkgs, ...} : {
     master.succeed("sudo -u postgres psql -c 'CREATE EXTENSION postgis;'")
     master.succeed("sudo -u postgres psql -c 'CREATE EXTENSION postgis_raster;'")
     master.succeed("sudo -u postgres psql -c 'CREATE EXTENSION postgis_topology;'")
+    master.succeed("sudo -u postgres psql -c 'select postgis_version();'")
+    master.succeed("[ \"$(sudo -u postgres psql --no-psqlrc --tuples-only -c 'select postgis_version();')\" = \" ${
+      pkgs.lib.versions.major pkgs.postgis.version
+    }.${
+      pkgs.lib.versions.minor pkgs.postgis.version
+    } USE_GEOS=1 USE_PROJ=1 USE_STATS=1\" ]")
+    # st_makepoint goes through c code
+    master.succeed("sudo -u postgres psql --no-psqlrc --tuples-only -c 'select st_makepoint(1, 1)'")
   '';
 })

nixos/tests/privatebin.nix

@@ -0,0 +1,21 @@
+{ lib, ... }:
+
+{
+  name = "privatebin";
+  meta.maintainers = [ lib.maintainers.savyajha ];
+
+  nodes.dataImporter =
+    { ... }:
+    {
+      services.privatebin = {
+        enable = true;
+        enableNginx = true;
+      };
+    };
+
+  testScript = ''
+    dataImporter.wait_for_unit("phpfpm-privatebin.service")
+    dataImporter.wait_for_unit("nginx.service")
+    dataImporter.succeed("curl -fvvv -Ls http://localhost/ | grep 'PrivateBin'")
+  '';
+}

pkgs/applications/blockchains/alfis/default.nix

@@ -62,6 +62,7 @@ rustPlatform.buildRustPackage rec {
   meta = {
     description = "Alternative Free Identity System";
     homepage = "https://alfis.name";
+    changelog = "https://github.com/Revertron/Alfis/releases/tag/v${version}";
     license = lib.licenses.agpl3Only;
     maintainers = with lib.maintainers; [ misuzu ];
     platforms = lib.platforms.unix;

pkgs/applications/blockchains/aperture/default.nix

@@ -21,6 +21,7 @@ buildGoModule rec {
   meta = with lib; {
     description = "L402 (Lightning HTTP 402) Reverse Proxy";
     homepage = "https://github.com/lightninglabs/aperture";
+    changelog = "https://github.com/lightninglabs/aperture/releases/tag/v${version}";
     license = licenses.mit;
     maintainers = with maintainers; [ sputn1ck HannahMR ];
     mainProgram = "aperture";

pkgs/applications/blockchains/atomic-swap/default.nix

@@ -35,6 +35,7 @@ buildGoModule {
 
   meta = with lib; {
     homepage = "https://github.com/AthanorLabs/atomic-swap";
+    changelog = "https://github.com/AthanorLabs/atomic-swap/releases/tag/v${version}";
     description = "ETH-XMR atomic swap implementation";
     license = with licenses; [ lgpl3Only ];
     maintainers = with maintainers; [ happysalada lord-valen ];

pkgs/applications/blockchains/besu/default.nix

@@ -41,6 +41,7 @@ stdenv.mkDerivation (finalAttrs: rec {
   meta = with lib; {
     description = "Enterprise-grade Java-based, Apache 2.0 licensed Ethereum client";
     homepage = "https://www.hyperledger.org/projects/besu";
+    changelog = "https://github.com/hyperledger/besu/blob/${finalAttrs.version}/CHANGELOG.md";
     license = licenses.asl20;
     sourceProvenance = with sourceTypes; [ binaryBytecode ];
     platforms = platforms.all;

pkgs/applications/blockchains/bisq-desktop/default.nix

@@ -117,6 +117,7 @@ stdenv.mkDerivation rec {
   meta = with lib; {
     description = "Decentralized bitcoin exchange network";
     homepage = "https://bisq.network";
+    changelog = "https://github.com/bisq-network/bisq/releases/tag/v${version}";
     sourceProvenance = with sourceTypes; [ binaryBytecode ];
     license = licenses.mit;
     maintainers = with maintainers; [ juaningan emmanuelrosa ];

pkgs/applications/blockchains/bitcoin-abc/default.nix

@@ -79,6 +79,7 @@ mkDerivation rec {
       Bitcoin ABC is a fork of the Bitcoin Core software project.
     '';
     homepage = "https://bitcoinabc.org/";
+    changelog = "https://www.bitcoinabc.org/doc/release-notes/release-notes-${version}.html";
     maintainers = with maintainers; [ lassulus ];
     license = licenses.mit;
     broken = stdenv.hostPlatform.isDarwin;

pkgs/applications/blockchains/bitcoin-knots/default.nix

@@ -80,6 +80,7 @@ stdenv.mkDerivation rec {
   meta = with lib; {
     description = "Derivative of Bitcoin Core with a collection of improvements";
     homepage = "https://bitcoinknots.org/";
+    changelog = "https://github.com/bitcoinknots/bitcoin/blob/v${version}/doc/release-notes.md";
     maintainers = with maintainers; [ prusnak mmahut ];
     license = licenses.mit;
     platforms = platforms.unix;

pkgs/applications/blockchains/btcd/default.nix

@@ -25,6 +25,7 @@ buildGoModule rec {
   meta = with lib; {
     description = "Alternative full node bitcoin implementation written in Go (golang)";
     homepage = "https://github.com/btcsuite/btcd";
+    changelog = "https://github.com/btcsuite/btcd/releases/tag/v${version}";
     license = licenses.isc;
     maintainers = with maintainers; [ _0xB10C ];
   };

pkgs/applications/blockchains/btcdeb/default.nix

@@ -27,6 +27,7 @@ stdenv.mkDerivation {
   meta = with lib; {
     description = "Bitcoin Script Debugger";
     homepage = "https://github.com/bitcoin-core/btcdeb";
+    changelog = "https://github.com/bitcoin-core/btcdeb/releases";
     license = licenses.mit;
     maintainers = with maintainers; [ akru ];
     platforms = platforms.unix;

pkgs/applications/blockchains/btcpayserver/default.nix

@@ -31,6 +31,7 @@ buildDotnetModule rec {
   meta = with lib; {
     description = "Self-hosted, open-source cryptocurrency payment processor";
     homepage = "https://btcpayserver.org";
+    changelog = "https://github.com/btcpayserver/btcpayserver/blob/v${version}/Changelog.md";
     maintainers = with maintainers; [ kcalvinalvin erikarvstedt ];
     license = licenses.mit;
     platforms = platforms.linux ++ platforms.darwin;

pkgs/applications/editors/emacs/elisp-packages/emacs2nix.nix

@@ -4,8 +4,8 @@ let
   src = pkgs.fetchFromGitHub {
     owner = "nix-community";
     repo = "emacs2nix";
-    rev = "8454f2857252f32621b8022f797fef9b96862204";
-    hash = "sha256-UHHEkY+t/IzWe8jC8bm+p275sKfnL5/v5wbwRDw6FZw=";
+    rev = "9458961fc433a6c4cd91e7763f0aa1ef15f7b4aa";
+    hash = "sha256-NJVKrYSF/22hrUJNJ3/znbcfHi/FtTePQ8Xzfp2eKAk=";
     fetchSubmodules = true;
   };
 in

pkgs/applications/editors/vim/plugins/generated.nix

@@ -2682,6 +2682,18 @@ final: prev:
     meta.homepage = "https://github.com/zbirenbaum/copilot-cmp/";
   };
 
+  copilot-lualine = buildVimPlugin {
+    pname = "copilot-lualine";
+    version = "2024-09-03";
+    src = fetchFromGitHub {
+      owner = "AndreM222";
+      repo = "copilot-lualine";
+      rev = "f40450c3e138766026327e7807877ea860618258";
+      sha256 = "0qx9x28f0c20cz2ax1631rd7qzzkzvhbnv9ivmyw44v5nzp8jy1x";
+    };
+    meta.homepage = "https://github.com/AndreM222/copilot-lualine/";
+  };
+
   copilot-lua = buildVimPlugin {
     pname = "copilot.lua";
     version = "2024-09-11";

pkgs/applications/editors/vim/plugins/overrides.nix

@@ -561,6 +561,12 @@ in
     dependencies = with self; [ copilot-lua plenary-nvim ];
   };
 
+  copilot-lualine = super.copilot-lualine.overrideAttrs {
+    dependencies = with self; [ copilot-lua lualine-nvim ];
+    doInstallCheck = true;
+    nvimRequireCheck = "copilot-lualine";
+  };
+
   copilot-vim = super.copilot-vim.overrideAttrs (old: {
     postInstall = ''
       substituteInPlace $out/autoload/copilot/client.vim \

pkgs/applications/editors/vim/plugins/vim-plugin-names

@@ -223,6 +223,7 @@ https://github.com/Olical/conjure/,,
 https://github.com/wellle/context.vim/,,
 https://github.com/Shougo/context_filetype.vim/,,
 https://github.com/zbirenbaum/copilot-cmp/,HEAD,
+https://github.com/AndreM222/copilot-lualine/,HEAD,
 https://github.com/zbirenbaum/copilot.lua/,HEAD,
 https://github.com/github/copilot.vim/,,
 https://github.com/ms-jpq/coq.artifacts/,HEAD,

pkgs/applications/editors/vscode/extensions/default.nix

@@ -3903,6 +3903,8 @@ let
         };
       };
 
+      pylyzer.pylyzer = callPackage ./pylyzer.pylyzer { };
+
       pythagoratechnologies.gpt-pilot-vs-code = buildVscodeMarketplaceExtension {
         mktplcRef = {
           name = "gpt-pilot-vs-code";

pkgs/applications/editors/vscode/extensions/mongodb.mongodb-vscode/default.nix

@@ -4,8 +4,8 @@ vscode-utils.buildVscodeMarketplaceExtension {
   mktplcRef = {
     name = "mongodb-vscode";
     publisher = "mongodb";
-    version = "1.8.1";
-    hash = "sha256-dHvYl3bg5OB/HYBoHQnUODhAob/ZylFNGLAuUQByvdM=";
+    version = "1.9.1";
+    hash = "sha256-XWWBk/QW37Dg0RJJwJ65w1r9WGC6iAGCgigsnGm/ilc=";
   };
 
   meta = {

pkgs/applications/editors/vscode/extensions/pylyzer.pylyzer/default.nix

@@ -0,0 +1,18 @@
+{ lib, vscode-utils }:
+
+vscode-utils.buildVscodeMarketplaceExtension {
+  mktplcRef = {
+    name = "pylyzer";
+    publisher = "pylyzer";
+    version = "0.1.8";
+    hash = "sha256-GoY4cobxL64bREtgl7q/iR66axSM3tBrle/b9h3ED8Q=";
+  };
+
+  meta = {
+    description = "A VS Code extension for Pylyzer, a fast static code analyzer & language server for Python";
+    downloadPage = "https://marketplace.visualstudio.com/items?itemName=pylyzer.pylyzer";
+    homepage = "https://github.com/mtshiba/pylyzer/";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ drupol ];
+  };
+}

pkgs/applications/editors/vscode/vscode.nix

@@ -30,21 +30,21 @@ let
   archive_fmt = if stdenv.hostPlatform.isDarwin then "zip" else "tar.gz";
 
   sha256 = {
-    x86_64-linux = "0475kwa3ym14l9ggaf2hg4lcrc0lpi9vchzj4sgj4c3606l9i1aa";
-    x86_64-darwin = "15sz42p7khzxpxii4zx14770kzyk4a3g1kwxjwvd46nxqjqciys4";
-    aarch64-linux = "14d5p764vx1ppi5f6b6v0wrn1wr3qqyfr6mpncjhnzr2pdss9fz0";
-    aarch64-darwin = "0kdh7a0nfpadhyn6cj89vw76hhbab4fg5wifbzdrjikwfg8jbd4b";
-    armv7l-linux = "1aqlpxyzjrf6qm0znyqbl7srn251f7ra5lj594b7906lxhirin3c";
+    x86_64-linux = "1adwsm4n934a5z3hnsj9k7mi2l4npl499q8jzk2xhbbpqhkvd96a";
+    x86_64-darwin = "04cvhhxx7s14z5794gn3pwd482cswpqyrmb1qcwm797cz1rz29z5";
+    aarch64-linux = "1fca5rir2bkf4wqrs56qhv3kwrxivx17pa5brxp1k4k8a9jmhy7k";
+    aarch64-darwin = "1mwymizy2a6m9fj3r00h762283fwrkhl9kv5607r0q7widggfg0j";
+    armv7l-linux = "16ndp0mcfb05wfarpq3nxp3bnac1s1yay596mwjmwbwv44qcq40b";
   }.${system} or throwSystem;
 in
   callPackage ./generic.nix rec {
     # Please backport all compatible updates to the stable release.
     # This is important for the extension ecosystem.
-    version = "1.93.1";
+    version = "1.94.0";
     pname = "vscode" + lib.optionalString isInsiders "-insiders";
 
     # This is used for VS Code - Remote SSH test
-    rev = "38c31bc77e0dd6ae88a4e9cc93428cc27a56ba40";
+    rev = "d78a74bcdfad14d5d3b1b782f87255d802b57511";
 
     executableName = "code" + lib.optionalString isInsiders "-insiders";
     longName = "Visual Studio Code" + lib.optionalString isInsiders " - Insiders";
@@ -68,7 +68,7 @@ in
       src = fetchurl {
         name = "vscode-server-${rev}.tar.gz";
         url = "https://update.code.visualstudio.com/commit:${rev}/server-linux-x64/stable";
-        sha256 = "0cxpv9q681nk7gjcs1msn2rnj8i86hlrkb0x4ja1id42aj4xwrqy";
+        sha256 = "1iqglh4wx4wc80ihzcw4is7hd49s6kxpg9fz357r57a2679q0qw6";
       };
     };
 

pkgs/applications/emulators/86box/default.nix

@@ -139,6 +139,7 @@ stdenv.mkDerivation (finalAttrs: {
     description = "Emulator of x86-based machines based on PCem";
     mainProgram = "86Box";
     homepage = "https://86box.net/";
+    changelog = "https://github.com/86Box/86Box/releases/tag/v${finalAttrs.version}";
     license =
       with lib.licenses;
       [ gpl2Only ] ++ lib.optional (unfreeEnableDiscord || unfreeEnableRoms) unfree;

pkgs/applications/emulators/darling/default.nix

@@ -243,6 +243,7 @@ in stdenv.mkDerivation {
   meta = with lib; {
     description = "Open-source Darwin/macOS emulation layer for Linux";
     homepage = "https://www.darlinghq.org";
+    changelog = "https://github.com/darlinghq/darling/releases";
     license = licenses.gpl3Plus;
     maintainers = with maintainers; [ zhaofengli ];
     platforms = [ "x86_64-linux" ];

pkgs/applications/emulators/dosbox-x/default.nix

@@ -29,13 +29,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "dosbox-x";
-  version = "2024.07.01";
+  version = "2024.10.01";
 
   src = fetchFromGitHub {
     owner = "joncampbell123";
     repo = "dosbox-x";
     rev = "dosbox-x-v${finalAttrs.version}";
-    hash = "sha256-mOoOvmsBW6igi5BiLNcmTSKmTeEkBK9WwPu/WKBSJC4=";
+    hash = "sha256-qfrEy7OndhJ/UnfFDCp7qlIhYWANkUBy2ejYVvRrG3k=";
   };
 
   # sips is unavailable in sandbox, replacing with imagemagick breaks build due to wrong Foundation propagation(?) so don't generate resolution variants

pkgs/applications/emulators/dosbox/default.nix

@@ -78,6 +78,7 @@ stdenv.mkDerivation rec {
 
   meta = with lib; {
     homepage = "http://www.dosbox.com/";
+    changelog = "https://www.dosbox.com/wiki/Releases";
     description = "DOS emulator";
     longDescription = ''
       DOSBox is an emulator that recreates a MS-DOS compatible environment

pkgs/applications/emulators/firebird-emu/default.nix

@@ -30,6 +30,7 @@ stdenv.mkDerivation rec {
 
   meta = {
     homepage = "https://github.com/nspire-emus/firebird";
+    changelog = "https://github.com/nspire-emus/firebird/releases/tag/v${version}";
     description = "Third-party multi-platform emulator of the ARM-based TI-Nspire™ calculators";
     license = lib.licenses.gpl3;
     maintainers = with lib.maintainers; [ pneumaticat ];

pkgs/applications/emulators/maiko/default.nix

@@ -19,6 +19,7 @@ stdenv.mkDerivation rec {
   meta = with lib; {
     description = "Medley Interlisp virtual machine";
     homepage = "https://interlisp.org/";
+    changelog = "https://github.com/Interlisp/maiko/releases";
     license = licenses.mit;
     maintainers = with maintainers; [ ehmry ];
     inherit (xorg.libX11.meta) platforms;

pkgs/applications/graphics/krita/default.nix

@@ -1,7 +1,7 @@
 { callPackage, ... }:
 
 callPackage ./generic.nix {
-  version = "5.2.3";
+  version = "5.2.6";
   kde-channel = "stable";
-  hash = "sha256-RmpG7bk8PjetZSB8+WAjSJCnJ0Tg9E8shV3kx9iCXMA=";
+  hash = "sha256-SNcShVT99LTpLFSuMbUq95IfR6jabOyqBnRKu/yC1fs=";
 }

pkgs/applications/graphics/xpano/default.nix

@@ -15,13 +15,13 @@
 
 stdenv.mkDerivation rec {
   pname = "xpano";
-  version = "0.19.0";
+  version = "0.19.2";
 
   src = fetchFromGitHub {
     owner = "krupkat";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-cb6BJg0wdfhqEFLbQ27NpjJU/cc4SZSk94UHzJfzn5U=";
+    sha256 = "sha256-CgUiZHjWQSoAam2Itan3Zadt8+w6j9W5KGMZ5f6bHiQ=";
     fetchSubmodules = true;
   };
 

pkgs/applications/misc/iptsd/default.nix

@@ -63,7 +63,7 @@ stdenv.mkDerivation rec {
   ];
 
   meta = with lib; {
-    changelog = "https://github.com/linux-surface/iptsd/releases/tag/${src.rev}";
+    changelog = "https://github.com/linux-surface/iptsd/releases/tag/${lib.removePrefix "refs/tags/" src.rev}";
     description = "Userspace daemon for Intel Precise Touch & Stylus";
     homepage = "https://github.com/linux-surface/iptsd";
     license = licenses.gpl2Plus;

pkgs/applications/misc/krabby/default.nix

@@ -4,14 +4,14 @@
 }:
 rustPlatform.buildRustPackage rec {
   pname = "krabby";
-  version = "0.1.8";
+  version = "0.2.0";
 
   src = fetchCrate {
     inherit pname version;
-    hash = "sha256-pqLk05hDPMvbrDG3xatAP0licaJszBSujo1fqsEtpRI=";
+    hash = "sha256-R4GW0e0tjLiCXQMf8iA+yYyMp43/28GeNsjs+QNQMSM=";
   };
 
-  cargoHash = "sha256-/wXfdH9ObKGOw8EXHG/3Gvhm66v632lpDp/V3zFIzh4=";
+  cargoHash = "sha256-eQyU0sMfecOjX5k1qYeetrAhk41FIMcg9QmhhTYOxWc=";
 
   meta = with lib; {
     description = "Print pokemon sprites in your terminal";

pkgs/applications/misc/nanoblogger/default.nix

@@ -9,8 +9,6 @@ stdenv.mkDerivation rec {
     sha256 = "09mv52a5f0h3das8x96irqyznm69arfskx472b7w3b9q4a2ipxbq";
   };
 
-  buildInputs = [ ];
-
   installPhase = ''
     mkdir -p $out/bin
     cp -r * $out

pkgs/applications/misc/pagefind/default.nix

@@ -123,7 +123,7 @@ rustPlatform.buildRustPackage rec {
       wasm-pack
       httplz
     ]
-    ++ lib.optionals stdenv.isDarwin [
+    ++ lib.optionals stdenv.buildPlatform.isDarwin [
       python3
     ];
 

pkgs/applications/misc/tui-journal/default.nix

@@ -11,16 +11,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "tui-journal";
-  version = "0.11.0";
+  version = "0.12.0";
 
   src = fetchFromGitHub {
     owner = "AmmarAbouZor";
     repo = "tui-journal";
     rev = "v${version}";
-    hash = "sha256-2tl2jL/ikBAziwjgpP4JIDnAvpFGjm/U0etz+SC8xHk=";
+    hash = "sha256-A3uSbd3tXrXe3jvlppndyg3L2gi5eiaxIrPTKqD5vog=";
   };
 
-  cargoHash = "sha256-rZVIlKK9TdIUabzmuRAzAnybz8mgDpto0nkImb8Mx8A=";
+  cargoHash = "sha256-b3loo6ZzZs3XwBI4JT9oth57vP3Aaulp24B7YDSnhhQ=";
 
   nativeBuildInputs = [
     pkg-config

pkgs/applications/networking/browsers/brave/default.nix

@@ -6,17 +6,17 @@ callPackage ./make-brave.nix (removeAttrs args [ "callPackage" ])
     if stdenv.hostPlatform.isAarch64 then
       rec {
         pname = "brave";
-        version = "1.70.119";
+        version = "1.70.123";
         url = "https://github.com/brave/brave-browser/releases/download/v${version}/brave-browser_${version}_arm64.deb";
-        hash = "sha256-we/M1/hMdnxxKfhS6q+Lc3G2OCj+wyBpoC6pfd0Ta08=";
+        hash = "sha256-YqSZYQinNyQQQds5ACyDCeZA+D4sBxyMvMiOvD6CVeU=";
         platform = "aarch64-linux";
       }
     else if stdenv.hostPlatform.isx86_64 then
       rec {
         pname = "brave";
-        version = "1.70.119";
+        version = "1.70.123";
         url = "https://github.com/brave/brave-browser/releases/download/v${version}/brave-browser_${version}_amd64.deb";
-        hash = "sha256-GtFkE0R4s0G9pO2Omt1V+YvBv0kvyJrcPc41ba07TTQ=";
+        hash = "sha256-Hr7/Yry7fhSDe1gzpZqtjuIDrbB6HuC1PSeBQ3HlAdE=";
         platform = "x86_64-linux";
       }
     else

pkgs/applications/networking/browsers/chromium/upstream-info.nix

@@ -27,11 +27,11 @@
         version = "2024-08-19";
       };
       ungoogled-patches = {
-        hash = "sha256-LKtkNFb0y1v+p6hInulR7CrRO5pPk5J5Jd4nlAwZRwI=";
-        rev = "129.0.6668.70-1";
+        hash = "sha256-fKMa/TxQRzteLIYMy+gn5fDvxLyrqtSwXHWxle0bhsE=";
+        rev = "129.0.6668.89-1";
       };
     };
-    hash = "sha256-L9h9jbwEMcUi/cu7FP2O/6wD0Br/3SzWCazu7m9ua+o=";
-    version = "129.0.6668.70";
+    hash = "sha256-+n9LjRLFvVB/pYkSrRCxln/Xn2paFyoY+mJGD73NtII=";
+    version = "129.0.6668.89";
   };
 }

pkgs/applications/networking/cluster/nomad/default.nix

@@ -1,6 +1,5 @@
 { lib
 , buildGoModule
-, buildGo121Module
 , buildGo122Module
 , fetchFromGitHub
 , nixosTests
@@ -61,17 +60,7 @@ rec {
 
   nomad_1_5 = throwUnsupportaed "nomad_1_5";
 
-  nomad_1_6 = generic {
-    buildGoModule = buildGo121Module;
-    version = "1.6.10";
-    sha256 = "sha256-kiMdpJzjF0S7lrTX3sBFkWm0Gac9a+qlwCPcMKeVXXQ=";
-    vendorHash = "sha256-qnsPPV/NWTrqUa1v1CL16WfCH7B0zW9ZSnEmtqvotqI=";
-    license = lib.licenses.mpl20;
-    passthru.tests.nomad = nixosTests.nomad;
-    preCheck = ''
-      export PATH="$PATH:$NIX_BUILD_TOP/go/bin"
-    '';
-  };
+  nomad_1_6 = throwUnsupportaed "nomad_1_6";
 
   nomad_1_7 = generic {
     buildGoModule = buildGo122Module;

pkgs/applications/networking/cluster/roxctl/default.nix

@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "roxctl";
-  version = "4.5.2";
+  version = "4.5.3";
 
   src = fetchFromGitHub {
     owner = "stackrox";
     repo = "stackrox";
     rev = version;
-    sha256 = "sha256-H6pgPo2/RIpYnNOxP6PgIZhij1I45bm9DVkV2sNcW3A=";
+    sha256 = "sha256-TWmbpU27ZGG8L66TW3yWoxUO8M4N6mMOmLv2VVXM+Q4=";
   };
 
   vendorHash = "sha256-qDSi1Jk6erSCwPiLubdVlqOT6PQygMQghS8leieJ78s=";

pkgs/applications/networking/cluster/tfswitch/default.nix

@@ -1,16 +1,16 @@
 { buildGoModule, lib, fetchFromGitHub }:
 buildGoModule rec {
   pname = "tfswitch";
-  version = "1.2.2";
+  version = "1.2.3";
 
   src = fetchFromGitHub {
     owner = "warrensbox";
     repo = "terraform-switcher";
     rev = "v${version}";
-    sha256 = "sha256-Ym0ypMfoceOvje1z1oCxjnFrl1oosMFSplM7bhI0KXU=";
+    sha256 = "sha256-Eb1pniSppowyQsLkCbbNlWtMCrDu4URqKXHnVFbA5lE=";
   };
 
-  vendorHash = "sha256-44A9fF+HIOJrlxpps6GV3yjPBqfpwOhEZ8Ejnp2o/wk=";
+  vendorHash = "sha256-KQfsWbWwxznGkJB/KA/OkG8r8FnfsoSL90+mFUN9454=";
 
   # Disable tests since it requires network access and relies on the
   # presence of release.hashicorp.com

pkgs/applications/networking/instant-messengers/beeper/default.nix

@@ -10,10 +10,10 @@
 }:
 let
   pname = "beeper";
-  version = "3.108.3";
+  version = "3.109.1";
   src = fetchurl {
-    url = "https://download.todesktop.com/2003241lzgn20jd/beeper-3.108.3-build-2407188w36frwla-x86_64.AppImage";
-    hash = "sha256-mlbw5K7+xZqz05FWKgKnro5SiVG+uSTI7muErAt8PM0=";
+    url = "https://download.todesktop.com/2003241lzgn20jd/beeper-3.109.1-build-240923466rji1i4-x86_64.AppImage";
+    hash = "sha256-RXpoOgnoPmNID5Jx/lNxqsHsifFSS9dZzhjSu8kGtXc=";
   };
   appimage = appimageTools.wrapType2 {
     inherit version pname src;

pkgs/applications/networking/instant-messengers/nchat/default.nix

@@ -1,45 +0,0 @@
-{ lib, stdenv,  fetchFromGitHub, cmake, gperf
-, file, ncurses, openssl, readline, sqlite, zlib
-, AppKit, Cocoa, Foundation
-}:
-
-stdenv.mkDerivation rec {
-  pname = "nchat";
-  version = "3.67";
-
-  src = fetchFromGitHub {
-    owner = "d99kris";
-    repo = "nchat";
-    rev = "v${version}";
-    hash = "sha256-PhvZejtSoDptzoMP5uIe6T0Ws/bQQXVuYH9uoZo3JsI=";
-  };
-
-  postPatch = ''
-    substituteInPlace lib/tgchat/ext/td/CMakeLists.txt \
-      --replace "get_git_head_revision" "#get_git_head_revision"
-  '';
-
-  nativeBuildInputs = [ cmake gperf ];
-
-  buildInputs = [
-    file # for libmagic
-    ncurses
-    openssl
-    readline
-    sqlite
-    zlib
-  ] ++ lib.optionals stdenv.hostPlatform.isDarwin [ AppKit Cocoa Foundation ];
-
-  cmakeFlags = [
-    "-DHAS_WHATSAPP=OFF" # go module build required
-  ];
-
-  meta = with lib; {
-    description = "Terminal-based chat client with support for Telegram and WhatsApp";
-    mainProgram = "nchat";
-    homepage = "https://github.com/d99kris/nchat";
-    license = licenses.mit;
-    maintainers = with maintainers; [ sikmir ];
-    platforms = platforms.unix;
-  };
-}

pkgs/applications/networking/instant-messengers/signal-cli/default.nix

@@ -2,12 +2,12 @@
 
 stdenv.mkDerivation rec {
   pname = "signal-cli";
-  version = "0.13.6";
+  version = "0.13.7";
 
   # Building from source would be preferred, but is much more involved.
   src = fetchurl {
     url = "https://github.com/AsamK/signal-cli/releases/download/v${version}/signal-cli-${version}.tar.gz";
-    hash = "sha256-OTKXLcLktWiSdRhGe7ioL2ViJQQcCjR1+2LlGoMnSgE=";
+    hash = "sha256-KeSKupExFIaLKdkXJw+UTclNaiMfrIomCec6GUV0E7M=";
   };
 
   buildInputs = lib.optionals stdenv.hostPlatform.isLinux [ libmatthew_java dbus dbus_java ];

pkgs/applications/networking/instant-messengers/wavebox/default.nix

@@ -156,11 +156,11 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "wavebox";
-  version = "10.129.27-2";
+  version = "10.129.29-2";
 
   src = fetchurl {
     url = "https://download.wavebox.app/stable/linux/deb/amd64/wavebox_${finalAttrs.version}_amd64.deb";
-    hash = "sha256-SHlKsiDS0UoOxy3vzGD7Ae7h6GM+r+XzFHZ33uEuEko=";
+    hash = "sha256-HGzBvCv6ASW2wXMd0BrA6NNGAEsuN2yHwS+0WbABfWM=";
   };
 
   nativeBuildInputs = [

pkgs/applications/networking/iroh/default.nix

@@ -7,16 +7,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "iroh";
-  version = "0.25.0";
+  version = "0.26.0";
 
   src = fetchFromGitHub {
     owner = "n0-computer";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-hF1Nf4+uJXVPpkfsLFKjySMmCSmJdX2LeSHNb0vrBoA=";
+    hash = "sha256-MQJQsM1nH6p91JWPR75iAvNox8eem4ZnM6n5DUxFzlE=";
   };
 
-  cargoHash = "sha256-t1re2vpxGZkC45n0jUytqe2SPAC/+fh4Itq1h9znYnM=";
+  cargoHash = "sha256-24sBTXE+2CeiietuSL3UNbsjkE25gnYkQtc62RgD6eM=";
 
   buildInputs = lib.optionals stdenv.hostPlatform.isDarwin (
     with darwin.apple_sdk.frameworks; [

pkgs/applications/science/computer-architecture/qtrvsim/default.nix

@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "QtRVSim";
-  version = "0.9.7";
+  version = "0.9.8";
 
   src = fetchFromGitHub {
     owner = "cvut";
     repo = "qtrvsim";
     rev = "refs/tags/v${version}";
-    sha256 = "sha256-SelmqHauj5Yxg043NZqR4bhqW5clwg1h7UD8mW7j7vE=";
+    sha256 = "sha256-+EpPDA2+mBTdQjq6i9TN11yeXqvJA28JtmdNihM1a/U=";
   };
 
   nativeBuildInputs = [ cmake wrapQtAppsHook ];

pkgs/applications/science/physics/crystfel/disable-fmemopen-on-aarch64-darwin.patch

@@ -1,13 +0,0 @@
-diff --git a/libcrystfel/src/image-cbf.c b/libcrystfel/src/image-cbf.c
-index b8f09a1f..f8a15c1b 100644
---- a/libcrystfel/src/image-cbf.c
-+++ b/libcrystfel/src/image-cbf.c
-@@ -287,7 +287,7 @@ static float *read_cbf_data(const char *filename, int gz, int *w, int *h)
- 
- 	} else {
- 
--		#ifdef HAVE_ZLIB
-+		#if defined(HAVE_ZLIB) && !(defined(__aarch64__) && defined(__APPLE__))
- 		gzFile gzfh;
- 		int len_read;
- 		size_t len;

pkgs/applications/science/robotics/mission-planner/default.nix

@@ -1,4 +1,5 @@
-{ lib, stdenv, fetchurl, makeDesktopItem, makeWrapper, unzip, mono }:
+{ lib, stdenv, fetchurl, makeDesktopItem, makeWrapper, unzip, mono, gitUpdater
+}:
 
 let
   pname = "mission-planner";
@@ -12,11 +13,12 @@ let
   };
 in stdenv.mkDerivation rec {
   inherit pname;
-  version = "1.3.80";
+  version = "1.3.82";
 
   src = fetchurl {
-    url = "https://firmware.ardupilot.org/Tools/MissionPlanner/MissionPlanner-${version}.zip";
-    sha256 = "sha256-iivlaQWtOMJHchmR92FoqTaosGJ9F1AgFtuFgDE/9qQ=";
+    url =
+      "https://firmware.ardupilot.org/Tools/MissionPlanner/MissionPlanner-${version}.zip";
+    sha256 = "sha256-554fFDxHMo4jV3yrPdGgDYQ6XeW+TWdVIIkGQIBdrCQ=";
   };
 
   nativeBuildInputs = [ makeWrapper mono unzip ];
@@ -44,6 +46,8 @@ in stdenv.mkDerivation rec {
     runHook postInstall
   '';
 
+  passthru.updateScript = gitUpdater { };
+
   meta = with lib; {
     description = "ArduPilot ground station";
     mainProgram = "mission-planner";

pkgs/applications/version-management/ungit/default.nix

@@ -5,16 +5,16 @@
 
 buildNpmPackage rec {
   pname = "ungit";
-  version = "1.5.27";
+  version = "1.5.28";
 
   src = fetchFromGitHub {
     owner = "FredrikNoren";
     repo = "ungit";
     rev = "v${version}";
-    hash = "sha256-UYY8AJWeGAcb83bmr7KX8ocxz8oQqUaXEXwwoVlwvoc=";
+    hash = "sha256-zLc+qzbbaQs6Y3NJFHupxyZ0QfuM/VW97dFESR+5dVQ=";
   };
 
-  npmDepsHash = "sha256-AE0V+IoO9Yz80y81ayR08us4gyjjvshRVYPq6thpMr8=";
+  npmDepsHash = "sha256-pYOBdCb6G24JBGWOhd4fyVEEUn19D9t/GxjjIi/2ya0=";
 
   env = {
     ELECTRON_SKIP_BINARY_DOWNLOAD = true;

pkgs/applications/video/davinci-resolve/default.nix

@@ -34,7 +34,7 @@ let
   davinci = (
     stdenv.mkDerivation rec {
       pname = "davinci-resolve${lib.optionalString studioVariant "-studio"}";
-      version = "19.0.1";
+      version = "19.0.2";
 
       nativeBuildInputs = [
         (appimage-run.override { buildFHSEnv = buildFHSEnvChroot; } )
@@ -55,8 +55,8 @@ let
           outputHashAlgo = "sha256";
           outputHash =
             if studioVariant
-            then "sha256-dtwweoxUE/DwHoqwKCTp7vQUg09h4/TrNl92hpOKd1E="
-            else "sha256-MNaP0+sKBH4Ps5EMM5Gtdncai+rXZRmIQBXF5lVbDws=";
+            then "sha256-q11stWFWRDUebAUzGH23R3Spd3EdDG85+6yB/srYCJY="
+            else "sha256-dYTrO0wpIN68WhBovmYLK5uWOQ1nubpSyKqPCDMPMiM=";
 
           impureEnvVars = lib.fetchers.proxyImpureEnvVars;
 

pkgs/applications/video/streamlink/default.nix

@@ -7,12 +7,12 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "streamlink";
-  version = "6.10.0";
+  version = "6.11.0";
   pyproject = true;
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-VI1fy8Oo4dXSn6IQoFlT+F9IyucLUqwuvkn5DoWRdSE=";
+    hash = "sha256-Vi5ddTyhCeGVYgfeSsJ8M3zmuZ++ftcgO5RRBe1bL4Y=";
   };
 
   patches = [
@@ -31,7 +31,6 @@ python3Packages.buildPythonApplication rec {
     mock
     requests-mock
     freezegun
-    pytest-asyncio
     pytest-trio
   ];
 

pkgs/applications/virtualization/tart/default.nix

@@ -10,11 +10,11 @@
 }:
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "tart";
-  version = "2.18.2";
+  version = "2.18.5";
 
   src = fetchurl {
       url = "https://github.com/cirruslabs/tart/releases/download/${finalAttrs.version}/tart-arm64.tar.gz";
-      hash = "sha256-0057/lRisAw3fzh2LNqHUx72PR/67mW/cqm7hU34GAU=";
+      hash = "sha256-3mbO6HlJxEl9NZzJ8IaZWESqPzS7OTw+I+t0XH25D/Q=";
   };
   sourceRoot = ".";
 

pkgs/applications/virtualization/virtualbox/guest-additions/default.nix

@@ -31,7 +31,6 @@ in stdenv.mkDerivation {
     env.NIX_CFLAGS_COMPILE = "-Wno-error=incompatible-pointer-types -Wno-error=implicit-function-declaration";
 
     nativeBuildInputs = [ patchelf makeWrapper virtualBoxNixGuestAdditionsBuilder ] ++ kernel.moduleBuildDependencies;
-    buildInputs = [ ];
 
     buildPhase = ''
       runHook preBuild

pkgs/build-support/writers/scripts.nix

@@ -522,6 +522,89 @@ rec {
   */
   writeFishBin = name: writeFish "/bin/${name}";
 
+  /**
+    Like writeScript but the first line is a shebang to babashka
+
+    Can be called with or without extra arguments.
+
+    :::{.example}
+    ## `pkgs.writers.writeBabashka` without arguments
+
+    ```nix
+    writeBabashka "example" ''
+      (println "hello world")
+    ''
+    ```
+    :::
+
+    :::{.example}
+    ## `pkgs.writers.writeBabashka` with arguments
+
+    ```nix
+    writeBabashka "example"
+    {
+      makeWrapperArgs = [
+        "--prefix" "PATH" ":" "${lib.makeBinPath [ pkgs.hello ]}"
+      ];
+    }
+    ''
+      (require '[babashka.tasks :as tasks])
+      (tasks/shell "hello" "-g" "Hello babashka!")
+    ''
+    ```
+    :::
+  */
+  writeBabashka =
+    name: argsOrScript:
+    if lib.isAttrs argsOrScript && !lib.isDerivation argsOrScript then
+      makeScriptWriter (
+        argsOrScript
+        // {
+          interpreter = "${lib.getExe pkgs.babashka}";
+          check = "${lib.getExe pkgs.clj-kondo} --lint";
+        }
+      ) name
+    else
+      makeScriptWriter {
+        interpreter = "${lib.getExe pkgs.babashka}";
+        check = "${lib.getExe pkgs.clj-kondo} --lint";
+      } name argsOrScript;
+
+  /**
+    Like writeScriptBin but the first line is a shebang to babashka
+
+    Can be called with or without extra arguments.
+
+    # Examples
+    :::{.example}
+    ## `pkgs.writers.writeBabashkaBin` without arguments
+
+    ```nix
+    writeBabashkaBin "example" ''
+      (println "hello world")
+    ''
+    ```
+    :::
+
+    :::{.example}
+    ## `pkgs.writers.writeBabashkaBin` with arguments
+
+    ```nix
+    writeBabashkaBin "example"
+    {
+      makeWrapperArgs = [
+        "--prefix" "PATH" ":" "${lib.makeBinPath [ pkgs.hello ]}"
+      ];
+    }
+    ''
+      (require '[babashka.tasks :as tasks])
+      (tasks/shell "hello" "-g" "Hello babashka!")
+    ''
+    ```
+    :::
+  */
+  writeBabashkaBin = name: writeBabashka "/bin/${name}";
+
   /**
     writeHaskell takes a name, an attrset with libraries and haskell version (both optional)
     and some haskell source code and returns an executable.

pkgs/build-support/writers/test.nix

@@ -18,6 +18,8 @@ let
     makeFSharpWriter
     writeBash
     writeBashBin
+    writeBabashka
+    writeBabashkaBin
     writeDash
     writeDashBin
     writeFish
@@ -85,6 +87,10 @@ recurseIntoAttrs {
       end
     '');
 
+    babashka = expectSuccessBin (writeBabashkaBin "test-writers-babashka-bin" ''
+      (println "success")
+    '');
+
     rust = expectSuccessBin (writeRustBin "test-writers-rust-bin" {} ''
       fn main(){
         println!("success")
@@ -189,6 +195,10 @@ recurseIntoAttrs {
       echo "success"
     '');
 
+    babashka = expectSuccess (writeBabashka "test-writers-babashka" ''
+      (println "success")
+    '');
+
     haskell = expectSuccess (writeHaskell "test-writers-haskell" { libraries = [ haskellPackages.acme-default ]; } ''
       import Data.Default
 
@@ -245,30 +255,32 @@ recurseIntoAttrs {
     #  print(y[0]['test'])
     #'');
 
-    fsharp = expectSuccess (makeFSharpWriter {
-      libraries = { fetchNuGet }: [
-        (fetchNuGet { pname = "FSharp.SystemTextJson"; version = "0.17.4"; sha256 = "1bplzc9ybdqspii4q28l8gmfvzpkmgq5l1hlsiyg2h46w881lwg2"; })
-        (fetchNuGet { pname = "System.Text.Json"; version = "4.6.0"; sha256 = "0ism236hwi0k6axssfq58s1d8lihplwiz058pdvl8al71hagri39"; })
-      ];
-    } "test-writers-fsharp" ''
+    # Commented out because fails with 'error FS0039: The value or constructor 'JsonFSharpConverter' is not defined.'
 
-      #r "nuget: FSharp.SystemTextJson, 0.17.4"
-
-      module Json =
-          open System.Text.Json
-          open System.Text.Json.Serialization
-          let options = JsonSerializerOptions()
-          options.Converters.Add(JsonFSharpConverter())
-          let serialize<'a> (o: 'a) = JsonSerializer.Serialize<'a>(o, options)
-          let deserialize<'a> (str: string) = JsonSerializer.Deserialize<'a>(str, options)
-
-      type Letter = A | B
-      let a = {| Hello = Some "World"; Letter = A |}
-      if a |> Json.serialize |> Json.deserialize |> (=) a
-      then "success"
-      else "failed"
-      |> printfn "%s"
-    '');
+    # fsharp = expectSuccess (makeFSharpWriter {
+    #   libraries = { fetchNuGet }: [
+    #     (fetchNuGet { pname = "FSharp.SystemTextJson"; version = "0.17.4"; sha256 = "1bplzc9ybdqspii4q28l8gmfvzpkmgq5l1hlsiyg2h46w881lwg2"; })
+    #     (fetchNuGet { pname = "System.Text.Json"; version = "4.6.0"; sha256 = "0ism236hwi0k6axssfq58s1d8lihplwiz058pdvl8al71hagri39"; })
+    #   ];
+    # } "test-writers-fsharp" ''
+    #
+    #   #r "nuget: FSharp.SystemTextJson, 0.17.4"
+    #
+    #   module Json =
+    #       open System.Text.Json
+    #       open System.Text.Json.Serialization
+    #       let options = JsonSerializerOptions()
+    #       options.Converters.Add(JsonFSharpConverter())
+    #       let serialize<'a> (o: 'a) = JsonSerializer.Serialize<'a>(o, options)
+    #       let deserialize<'a> (str: string) = JsonSerializer.Deserialize<'a>(str, options)
+    #
+    #   type Letter = A | B
+    #   let a = {| Hello = Some "World"; Letter = A |}
+    #   if a |> Json.serialize |> Json.deserialize |> (=) a
+    #   then "success"
+    #   else "failed"
+    #   |> printfn "%s"
+    # '');
 
     #pypy2NoLibs = expectSuccess (writePyPy2 "test-writers-pypy2-no-libs" {} ''
     #  print("success")
@@ -369,6 +381,36 @@ recurseIntoAttrs {
         ''
     );
 
+    babashka-bin = expectSuccessBin (
+      writeBabashkaBin "test-writers-wrapping-babashka-bin"
+        {
+          makeWrapperArgs = [
+            "--set"
+            "ThaigerSprint"
+            "Thailand"
+          ];
+        }
+        ''
+          (when (= (System/getenv "ThaigerSprint") "Thailand")
+            (println "success"))
+        ''
+    );
+
+    babashka = expectSuccess (
+      writeBabashka "test-writers-wrapping-babashka"
+        {
+          makeWrapperArgs = [
+            "--set"
+            "ThaigerSprint"
+            "Thailand"
+          ];
+        }
+        ''
+          (when (= (System/getenv "ThaigerSprint") "Thailand")
+            (println "success"))
+        ''
+    );
+
     python = expectSuccess (
       writePython3 "test-writers-wrapping-python"
         {

pkgs/by-name/_1/_1oom/package.nix

@@ -54,6 +54,7 @@ stdenv.mkDerivation rec {
 
   meta = with lib; {
     homepage = "https://github.com/1oom-fork/1oom";
+    changelog = "https://github.com/1oom-fork/1oom/releases/tag/v${version}";
     description = "Master of Orion (1993) game engine recreation; a more updated fork";
     license = licenses.gpl2Only;
     platforms = platforms.linux;

pkgs/by-name/a5/a52dec/package.nix

@@ -36,6 +36,7 @@ stdenv.mkDerivation rec {
   meta = with lib; {
     description = "ATSC A/52 stream decoder";
     homepage = "https://liba52.sourceforge.io/";
+    changelog = "https://git.adelielinux.org/community/a52dec/-/blob/v${version}/ChangeLog?ref_type=tags";
     license = licenses.gpl2Plus;
     maintainers = with maintainers; [ wegank ];
     mainProgram = "a52dec";

pkgs/by-name/ab/ab-av1/package.nix

@@ -2,16 +2,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "ab-av1";
-  version = "0.7.17";
+  version = "0.7.18";
 
   src = fetchFromGitHub {
     owner = "alexheretic";
     repo = "ab-av1";
     rev = "v${version}";
-    hash = "sha256-QPelXqJT3zbVP+lNiczrCR+JD4icimSyCravlIwTAyw=";
+    hash = "sha256-n8yclhjeEkkge9xHuM4ZW+7aubIiLWwxCmmGTI1bE9I=";
   };
 
-  cargoHash = "sha256-7h1Hbtsk0pnoPXX5sFfzcZoH/sqcb0YTpmJp6yCzTG0=";
+  cargoHash = "sha256-Rn+y1W2Cimt5JrD2dLmvLmZshxyLO7N+oIALwGjxhvM=";
 
   nativeBuildInputs = [ installShellFiles ];
 

pkgs/by-name/ac/accerciser/package.nix

@@ -68,6 +68,7 @@ python3.pkgs.buildPythonApplication rec {
 
   meta = with lib; {
     homepage = "https://gitlab.gnome.org/GNOME/accerciser";
+    changelog = "https://gitlab.gnome.org/GNOME/accerciser/-/blob/${version}/NEWS?ref_type=tags";
     description = "Interactive Python accessibility explorer";
     mainProgram = "accerciser";
     maintainers = teams.gnome.members;

pkgs/by-name/ad/adwaita-icon-theme-legacy/package.nix

@@ -32,6 +32,7 @@ stdenv.mkDerivation (finalAttrs: {
   meta = with lib; {
     description = "Fullcolor icon theme providing fallback for legacy apps";
     homepage = "https://gitlab.gnome.org/GNOME/adwaita-icon-theme-legacy";
+    changelog = "https://gitlab.gnome.org/GNOME/adwaita-icon-theme-legacy/-/blob/${finalAttrs.version}/NEWS?ref_type=tags";
     license = licenses.cc-by-sa-30;
     maintainers = teams.gnome.members;
     platforms = platforms.all;

pkgs/by-name/ad/adwaita-icon-theme/package.nix

@@ -47,6 +47,7 @@ stdenv.mkDerivation rec {
 
   meta = with lib; {
     homepage = "https://gitlab.gnome.org/GNOME/adwaita-icon-theme";
+    changelog = "https://gitlab.gnome.org/GNOME/adwaita-icon-theme/-/blob/${version}/NEWS?ref_type=tags";
     platforms = with platforms; linux ++ darwin;
     maintainers = teams.gnome.members;
     license = licenses.cc-by-sa-30;

pkgs/by-name/al/alacarte/package.nix

@@ -61,6 +61,7 @@ python3.pkgs.buildPythonApplication rec {
 
   meta = {
     homepage = "https://gitlab.gnome.org/GNOME/alacarte";
+    changelog = "https://gitlab.gnome.org/GNOME/alacarte/-/blob/${version}/NEWS?ref_type=tags";
     description = "Menu editor for GNOME using the freedesktop.org menu specification";
     license = lib.licenses.gpl2Only;
     platforms = lib.platforms.linux;

pkgs/by-name/al/alpaca/package.nix

@@ -17,14 +17,14 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "alpaca";
-  version = "2.0.3";
+  version = "2.0.5";
   pyproject = false; # Built with meson
 
   src = fetchFromGitHub {
     owner = "Jeffser";
     repo = "Alpaca";
-    rev = version;
-    hash = "sha256-CXrnPhNu/doz145rvonuBXoJQolz7qgMdn5KgVio6J4=";
+    rev = "refs/tags/${version}";
+    hash = "sha256-BLLcU2GESyHGFJJicE42V3nMFf/YfnYsXcAOPIHuCAg=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/ap/apfsprogs/package.nix

@@ -6,20 +6,20 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "apfsprogs";
-  version = "unstable-2023-11-30";
+  version = "0-unstable-2024-09-27";
 
   src = fetchFromGitHub {
     owner = "linux-apfs";
     repo = "apfsprogs";
-    rev = "990163894d871f51ba102a75aed384a275c5991b";
-    hash = "sha256-yCShZ+ALzSe/svErt9/i1JyyEvbIeABGPbpS4lVil0A=";
+    rev = "f31d7c2d69d212ce381399d2bb1e91410f592484";
+    hash = "sha256-+c+wU52XKNOTxSpSrkrNWoGEYw6Zo4CGEOyKMvkXEa0=";
   };
 
   postPatch = let
     shortRev = builtins.substring 0 9 finalAttrs.src.rev;
   in ''
     substituteInPlace \
-      apfs-snap/Makefile apfsck/Makefile mkapfs/Makefile \
+      apfs-snap/Makefile apfsck/Makefile mkapfs/Makefile apfs-label/Makefile \
       --replace-fail \
         '$(shell git describe --always HEAD | tail -c 9)' \
         '${shortRev}'
@@ -30,6 +30,7 @@ stdenv.mkDerivation (finalAttrs: {
     make -C apfs-snap $makeFlags
     make -C apfsck $makeFlags
     make -C mkapfs $makeFlags
+    make -C apfs-label $makeFlags
     runHook postBuild
   '';
 
@@ -38,6 +39,7 @@ stdenv.mkDerivation (finalAttrs: {
     make -C apfs-snap install DESTDIR="$out" $installFlags
     make -C apfsck install DESTDIR="$out" $installFlags
     make -C mkapfs install DESTDIR="$out" $installFlags
+    make -C apfs-label install DESTDIR="$out" $installFlags
     runHook postInstall
   '';
 

pkgs/by-name/at/atomix/package.nix

@@ -53,6 +53,7 @@ stdenv.mkDerivation (finalAttrs: {
     description = "Puzzle game where you move atoms to build a molecule";
     mainProgram = "atomix";
     homepage = "https://gitlab.gnome.org/GNOME/atomix";
+    changelog = "https://gitlab.gnome.org/GNOME/atomix/-/blob/${finalAttrs.version}/NEWS?ref_type=tags";
     license = licenses.gpl2Plus;
     maintainers = teams.gnome.members;
     platforms = platforms.unix;

pkgs/by-name/az/azuki/package.nix

@@ -0,0 +1,78 @@
+{
+  lib,
+  stdenvNoCC,
+  fetchzip,
+}:
+
+let
+  fonts = [
+    {
+      name = "azuki";
+      downloadVersion = "121";
+      hash = "sha256-AMpEJDD8lN0qWJ5C0y4V+/2JE/pKQrUHGfKHcnV+dhA=";
+    }
+    {
+      name = "azuki-b";
+      downloadVersion = "B120";
+      hash = "sha256-GoXnDX9H6D1X0QEgrD2jmQp7ek081PpO+xR3OdIY8Ck=";
+    }
+    {
+      name = "azuki-l";
+      downloadVersion = "L120";
+      hash = "sha256-rvWvSuvLnK3m2+iyKPQyIB1UGjg8dAW5oygjsLCQZ48=";
+    }
+    {
+      name = "azuki-lb";
+      downloadVersion = "LB100";
+      hash = "sha256-zpGomVshCe2W2Z2C5UGtVrJ2k7F//MftndSHPHmG290=";
+    }
+    {
+      name = "azuki-lp";
+      downloadVersion = "LP100";
+      hash = "sha256-Q/ND3dv8q7WTQx4oYVY5pTiGl4Ht89oA+tuCyfPOLUk=";
+    }
+    {
+      name = "azuki-p";
+      downloadVersion = "P100";
+      hash = "sha256-s4uodxyXP5R7jwkzjmg6qJZCllJ/MtgkkVOeELI8hLI=";
+    }
+  ];
+
+in
+stdenvNoCC.mkDerivation {
+  pname = "azuki";
+  version = "0-unstable-2021-07-02";
+
+  sourceRoot = "azuki";
+
+  srcs = map (
+    {
+      name,
+      downloadVersion,
+      hash,
+    }:
+    fetchzip {
+      url = "https://azukifont.com/font/azukifont${downloadVersion}.zip";
+      stripRoot = false;
+      inherit name hash;
+    }
+  ) fonts;
+
+  installPhase = ''
+    runHook preInstall
+
+    for font in $srcs; do
+      install -Dm644 $font/azukifont*/*.ttf -t $out/share/fonts/truetype
+    done
+
+    runHook postInstall
+  '';
+
+  meta = {
+    homepage = "http://azukifont.com/font/azuki.html";
+    description = "Azuki Font";
+    license = lib.licenses.unfree;
+    platforms = lib.platforms.all;
+    maintainers = with lib.maintainers; [ nyadiia ];
+  };
+}

pkgs/by-name/ba/backrest/package.nix

@@ -5,6 +5,7 @@
   lib,
   restic,
   util-linux,
+  stdenv,
 }:
 let
   pname = "backrest";
@@ -44,8 +45,17 @@ buildGoModule {
 
   nativeCheckInputs = [ util-linux ];
 
-  # Fails with handler returned wrong content encoding
-  checkFlags = [ "-skip=TestServeIndex" ];
+  checkFlags =
+    let
+      skippedTests =
+        [
+          "TestServeIndex" # Fails with handler returned wrong content encoding
+        ]
+        ++ lib.optionals stdenv.isDarwin [
+          "TestBackup" # relies on ionice
+        ];
+    in
+    [ "-skip=^${builtins.concatStringsSep "$|^" skippedTests}$" ];
 
   preCheck = ''
     # Use restic from nixpkgs, otherwise download fails in sandbox

pkgs/by-name/ba/bazecor/package.nix

@@ -6,12 +6,12 @@
 }:
 let
   pname = "bazecor";
-  version = "1.5.0";
+  version = "1.5.1";
   src = appimageTools.extract {
     inherit pname version;
     src = fetchurl {
       url = "https://github.com/Dygmalab/Bazecor/releases/download/v${version}/Bazecor-${version}-x64.AppImage";
-      hash = "sha256-cxDTNtxy2APAjnHw/cVd1/hUazASJs46rCHNGQ/JbSM=";
+      hash = "sha256-Vnbyq6NVJ/QtDqXT6IY/sjqsWqxs34C+ibebbx8Vp4E=";
     };
 
     # Workaround for https://github.com/Dygmalab/Bazecor/issues/370

pkgs/by-name/br/brainflow/package.nix

@@ -17,13 +17,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "brainflow";
-  version = "5.13.3";
+  version = "5.14.0";
 
   src = fetchFromGitHub {
     owner = "brainflow-dev";
     repo = "brainflow";
     rev = "refs/tags/${finalAttrs.version}";
-    hash = "sha256-LFiDyNuWbEAKU0Rl+n7ozxr5CM4NLphR2o9bYHw6xJY=";
+    hash = "sha256-cnItKuOu4ez54mAyRuk8PDC3oKKUIqdkAUuuaxNs5Z8=";
   };
 
   patches = [ ];

pkgs/by-name/ca/cargo-make/package.nix

@@ -10,16 +10,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "cargo-make";
-  version = "0.37.18";
+  version = "0.37.20";
 
   src = fetchFromGitHub {
     owner = "sagiegurari";
     repo = "cargo-make";
     rev = version;
-    hash = "sha256-fiS4Z+Ao3DHyIal1GNXsCEgbLy1fsjbOdLcr7jNvhzA=";
+    hash = "sha256-PmCpm+ZOqnJdGrQtOciU6hEKV2lfoUT8bGtWzRpBXxQ=";
   };
 
-  cargoHash = "sha256-GyHaVcrrq3v/d1WJmpteGwVkB9mLk+OIRDSkwR+aPMI=";
+  cargoHash = "sha256-RjsYrFbS/OiMQKTiPshGcBI9KF75Z5stn2HaB6mniZE=";
 
   nativeBuildInputs = [ pkg-config ];
 

pkgs/by-name/ch/charmcraft/package.nix

@@ -1,37 +1,14 @@
 {
   lib,
   git,
-  python3,
+  python3Packages,
   fetchFromGitHub,
   nix-update-script,
 }:
 
-let
-  python = python3.override {
-    self = python;
-    packageOverrides = self: super: {
-      pydantic-yaml = super.pydantic-yaml.overridePythonAttrs (old: rec {
-        version = "0.11.2";
-        src = fetchFromGitHub {
-          owner = "NowanIlfideme";
-          repo = "pydantic-yaml";
-          rev = "refs/tags/v${version}";
-          hash = "sha256-AeUyVav0/k4Fz69Qizn4hcJKoi/CDR9eUan/nJhWsDY=";
-        };
-        dependencies = with self; [
-          deprecated
-          importlib-metadata
-          pydantic_1
-          ruamel-yaml
-          types-deprecated
-        ];
-      });
-    };
-  };
-in
-python.pkgs.buildPythonApplication rec {
+python3Packages.buildPythonApplication rec {
   pname = "charmcraft";
-  version = "3.1.2";
+  version = "3.2.1";
 
   pyproject = true;
 
@@ -39,14 +16,14 @@ python.pkgs.buildPythonApplication rec {
     owner = "canonical";
     repo = "charmcraft";
     rev = "refs/tags/${version}";
-    hash = "sha256-Qi2ZtAYgQlKj77QPovcT3RrPwAlEwaFyoJ0MAq4EETE=";
+    hash = "sha256-VqJZP82OIfxPBkayq0ijXDsotgKPbo34RTMuNkLfjls=";
   };
 
   postPatch = ''
     substituteInPlace charmcraft/__init__.py --replace-fail "dev" "${version}"
   '';
 
-  dependencies = with python.pkgs; [
+  dependencies = with python3Packages; [
     craft-application
     craft-cli
     craft-parts
@@ -58,7 +35,7 @@ python.pkgs.buildPythonApplication rec {
     humanize
     jinja2
     jsonschema
-    pydantic_1
+    pydantic
     python-dateutil
     pyyaml
     requests
@@ -69,15 +46,15 @@ python.pkgs.buildPythonApplication rec {
     urllib3
   ];
 
-  build-system = with python.pkgs; [
-    setuptools
-    setuptools-scm
+  build-system = with python3Packages; [ setuptools-scm ];
+
+  pythonRelaxDeps = [
+    "urllib3"
+    "craft-application"
   ];
 
-  pythonRelaxDeps = [ "urllib3" ];
-
   nativeCheckInputs =
-    with python.pkgs;
+    with python3Packages;
     [
       hypothesis
       pyfakefs

pkgs/by-name/ch/chatd/package.nix

@@ -33,9 +33,8 @@ buildNpmPackage rec {
   nativeBuildInputs = [
     makeWrapper
     electron
-    autoPatchelfHook # for onnx libs
     pkg-config
-  ];
+  ] ++ lib.optional stdenv.isLinux autoPatchelfHook; # for onnx libs
 
   buildInputs = [
     stdenv.cc.cc.lib # for libstdc++.so, required by onnxruntime

pkgs/by-name/ch/cheese/package.nix

@@ -98,6 +98,7 @@ stdenv.mkDerivation rec {
 
   meta = with lib; {
     homepage = "https://gitlab.gnome.org/GNOME/cheese";
+    changelog = "https://gitlab.gnome.org/GNOME/cheese/-/blob/${version}/NEWS?ref_type=tags";
     description = "Take photos and videos with your webcam, with fun graphical effects";
     mainProgram = "cheese";
     maintainers = with maintainers; [ aleksana ];

pkgs/by-name/ch/chezmoi/package.nix

@@ -8,16 +8,16 @@
 let
   argset = {
     pname = "chezmoi";
-    version = "2.52.2";
+    version = "2.52.3";
 
     src = fetchFromGitHub {
       owner = "twpayne";
       repo = "chezmoi";
       rev = "v${argset.version}";
-      hash = "sha256-SSwQQoHCcSVHMEpngpmdTThhwrob5/0TP9nQhOD6+1U=";
+      hash = "sha256-OoVf0Gxyd+hTlM4VOei1atNEZYL2ZF3eKAHyUqRkRzs=";
     };
 
-    vendorHash = "sha256-t+lw1AtYnCBjJT+/pQZ71xycx4dJggqz08dNonbkP74=";
+    vendorHash = "sha256-QJkTscj3MvmscanEqA9Md2OZPYoNtxIJsAd2J6E9zHk=";
 
     nativeBuildInputs = [
       installShellFiles

pkgs/by-name/cl/clang-uml/package.nix

@@ -17,13 +17,13 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "clang-uml";
-  version = "0.5.4";
+  version = "0.5.5";
 
   src = fetchFromGitHub {
     owner = "bkryza";
     repo = "clang-uml";
     rev = finalAttrs.version;
-    hash = "sha256-PEzTvwW/wUg8wgKjeNGbpgpP3SH2sVWRYc6o3gFjxx0=";
+    hash = "sha256-YzHlauVuFLT2PmfqJBNwqQ/P7d7tyl3brk7Vo/kTOF4=";
   };
 
   nativeBuildInputs = [