From 9c460bd2cc95f66e588de86cfea2846fdab2475a Mon Sep 17 00:00:00 2001 From: Victor Engmark Date: Sun, 12 Oct 2025 09:15:11 +0200 Subject: [PATCH 01/70] libvirtd: Conform to ShellCheck --- nixos/modules/virtualisation/libvirtd.nix | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/nixos/modules/virtualisation/libvirtd.nix b/nixos/modules/virtualisation/libvirtd.nix index b4a5e1cebc49..1af65d38eac7 100644 --- a/nixos/modules/virtualisation/libvirtd.nix +++ b/nixos/modules/virtualisation/libvirtd.nix @@ -480,11 +480,12 @@ in ln -s --force ${cfg.qemu.package}/bin/qemu-pr-helper /run/${dirName}/nix-helpers/ # Symlink to OVMF firmware code and variable template images distributed with QEMU - cp -sfv $( + readarray -t firmware_files < <( ${pkgs.jq}/bin/jq -rs \ '[.[] | .mapping.executable.filename, .mapping."nvram-template".filename] | unique | .[]' \ - ${cfg.qemu.package}/share/qemu/firmware/* \ - ) /run/${dirName}/nix-ovmf + ${cfg.qemu.package}/share/qemu/firmware/* + ) + cp -sfv "''${firmware_files[@]}" /run/${dirName}/nix-ovmf # Symlink hooks to /var/lib/libvirt ${concatStringsSep "\n" ( @@ -542,6 +543,8 @@ in OOMScoreAdjust = "-999"; }; restartIfChanged = false; + + enableStrictShellChecks = true; }; systemd.services.virtchd = { From 79d683f4ad85450287f8e723afc09c191d5839b5 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?J=C3=B6rg=20Thalheim?= Date: Tue, 21 Oct 2025 17:12:14 +0200 Subject: [PATCH 02/70] nixos/facter: add graphics hardware detection This adds automatic graphics card configuration: Builds on PR #456698 (virtualization & firmware). Part of incremental upstreaming from nixos-facter-modules. --- nixos/modules/hardware/facter/default.nix | 1 + .../modules/hardware/facter/graphics/amd.nix | 18 ++++++++ .../hardware/facter/graphics/default.nix | 42 +++++++++++++++++++ 3 files changed, 61 insertions(+) create mode 100644 nixos/modules/hardware/facter/graphics/amd.nix create mode 100644 nixos/modules/hardware/facter/graphics/default.nix diff --git a/nixos/modules/hardware/facter/default.nix b/nixos/modules/hardware/facter/default.nix index f3bd58443dc7..30db0d10e48a 100644 --- a/nixos/modules/hardware/facter/default.nix +++ b/nixos/modules/hardware/facter/default.nix @@ -7,6 +7,7 @@ imports = [ ./disk.nix ./firmware.nix + ./graphics ./keyboard.nix ./networking ./system.nix diff --git a/nixos/modules/hardware/facter/graphics/amd.nix b/nixos/modules/hardware/facter/graphics/amd.nix new file mode 100644 index 000000000000..666868035c3d --- /dev/null +++ b/nixos/modules/hardware/facter/graphics/amd.nix @@ -0,0 +1,18 @@ +{ lib, config, ... }: +let + facterLib = import ../lib.nix lib; + cfg = config.hardware.facter.detected.graphics.amd; +in +{ + options.hardware.facter.detected.graphics = { + amd.enable = lib.mkEnableOption "Enable the AMD Graphics module" // { + default = builtins.elem "amdgpu" ( + facterLib.collectDrivers (config.hardware.facter.report.hardware.graphics_card or [ ]) + ); + defaultText = "hardware dependent"; + }; + }; + config = lib.mkIf cfg.enable { + services.xserver.videoDrivers = [ "modesetting" ]; + }; +} diff --git a/nixos/modules/hardware/facter/graphics/default.nix b/nixos/modules/hardware/facter/graphics/default.nix new file mode 100644 index 000000000000..cdb987e0d46e --- /dev/null +++ b/nixos/modules/hardware/facter/graphics/default.nix @@ -0,0 +1,42 @@ +{ lib, config, ... }: +let + facterLib = import ../lib.nix lib; + cfg = config.hardware.facter.detected.graphics; +in +{ + imports = [ + ./amd.nix + ]; + options.hardware.facter.detected = { + graphics.enable = lib.mkEnableOption "Enable the Graphics module" // { + default = builtins.length (config.hardware.facter.report.hardware.monitor or [ ]) > 0; + defaultText = "hardware dependent"; + }; + boot.graphics.kernelModules = lib.mkOption { + type = lib.types.listOf lib.types.str; + # We currently don't auto import nouveau, in case the user might want to use the proprietary nvidia driver, + # We might want to change this in future, if we have a better idea, how to handle this. + default = lib.remove "nouveau" ( + lib.uniqueStrings ( + facterLib.collectDrivers (config.hardware.facter.report.hardware.graphics_card or [ ]) + ) + ); + defaultText = "hardware dependent"; + description = '' + List of kernel modules to load at boot for the graphics card. + ''; + }; + }; + + config = lib.mkIf cfg.enable ( + { + boot.initrd.kernelModules = config.hardware.facter.detected.boot.graphics.kernelModules; + } + // ( + if lib.versionOlder lib.version "24.11pre" then + { hardware.opengl.enable = lib.mkDefault true; } + else + { hardware.graphics.enable = lib.mkDefault true; } + ) + ); +} From 3e758c612d74919965abcf2be64e533589fd0151 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?J=C3=B6rg=20Thalheim?= Date: Tue, 4 Nov 2025 19:19:36 +0100 Subject: [PATCH 03/70] nixos/facter: add reportPath guard to all modules Add lib.mkIf condition checking if config.hardware.facter.reportPath != null to all facter modules. This shortcuts the module effects when no facter report is available, preventing unnecessary evaluation and potential errors when the report is not provided. --- nixos/modules/hardware/facter/disk.nix | 2 +- nixos/modules/hardware/facter/firmware.nix | 2 +- nixos/modules/hardware/facter/graphics/amd.nix | 2 +- nixos/modules/hardware/facter/graphics/default.nix | 2 +- nixos/modules/hardware/facter/keyboard.nix | 2 +- nixos/modules/hardware/facter/networking/default.nix | 12 +++++++----- nixos/modules/hardware/facter/networking/initrd.nix | 2 +- nixos/modules/hardware/facter/networking/intel.nix | 2 +- nixos/modules/hardware/facter/system.nix | 2 +- nixos/modules/hardware/facter/virtualisation.nix | 2 +- 10 files changed, 16 insertions(+), 14 deletions(-) diff --git a/nixos/modules/hardware/facter/disk.nix b/nixos/modules/hardware/facter/disk.nix index 4bb76f16366d..4158bd171bb9 100644 --- a/nixos/modules/hardware/facter/disk.nix +++ b/nixos/modules/hardware/facter/disk.nix @@ -22,7 +22,7 @@ in ''; }; - config = { + config = lib.mkIf (config.hardware.facter.reportPath != null) { boot.initrd.availableKernelModules = config.hardware.facter.detected.boot.disk.kernelModules; }; } diff --git a/nixos/modules/hardware/facter/firmware.nix b/nixos/modules/hardware/facter/firmware.nix index 10962018890c..b614cab85253 100644 --- a/nixos/modules/hardware/facter/firmware.nix +++ b/nixos/modules/hardware/facter/firmware.nix @@ -8,7 +8,7 @@ let hasIntelCpu = facterLib.hasIntelCpu report; in { - config = lib.mkIf isBaremetal { + config = lib.mkIf (config.hardware.facter.reportPath != null && isBaremetal) { # none (e.g. bare-metal) # provide firmware for devices that might not have been detected by nixos-facter hardware.enableRedistributableFirmware = lib.mkDefault true; diff --git a/nixos/modules/hardware/facter/graphics/amd.nix b/nixos/modules/hardware/facter/graphics/amd.nix index 666868035c3d..b2ec114677a0 100644 --- a/nixos/modules/hardware/facter/graphics/amd.nix +++ b/nixos/modules/hardware/facter/graphics/amd.nix @@ -12,7 +12,7 @@ in defaultText = "hardware dependent"; }; }; - config = lib.mkIf cfg.enable { + config = lib.mkIf (config.hardware.facter.reportPath != null && cfg.enable) { services.xserver.videoDrivers = [ "modesetting" ]; }; } diff --git a/nixos/modules/hardware/facter/graphics/default.nix b/nixos/modules/hardware/facter/graphics/default.nix index cdb987e0d46e..cd29040ce67d 100644 --- a/nixos/modules/hardware/facter/graphics/default.nix +++ b/nixos/modules/hardware/facter/graphics/default.nix @@ -28,7 +28,7 @@ in }; }; - config = lib.mkIf cfg.enable ( + config = lib.mkIf (config.hardware.facter.reportPath != null && cfg.enable) ( { boot.initrd.kernelModules = config.hardware.facter.detected.boot.graphics.kernelModules; } diff --git a/nixos/modules/hardware/facter/keyboard.nix b/nixos/modules/hardware/facter/keyboard.nix index d19e17cd6901..62baf5bd32f1 100644 --- a/nixos/modules/hardware/facter/keyboard.nix +++ b/nixos/modules/hardware/facter/keyboard.nix @@ -15,7 +15,7 @@ in ''; }; - config = { + config = lib.mkIf (config.hardware.facter.reportPath != null) { boot.initrd.availableKernelModules = config.hardware.facter.detected.boot.keyboard.kernelModules; }; } diff --git a/nixos/modules/hardware/facter/networking/default.nix b/nixos/modules/hardware/facter/networking/default.nix index dfbc54c8396d..7f662d8785a0 100644 --- a/nixos/modules/hardware/facter/networking/default.nix +++ b/nixos/modules/hardware/facter/networking/default.nix @@ -60,10 +60,12 @@ in ]; }; }; - config = lib.mkIf config.hardware.facter.detected.dhcp.enable { - networking.useDHCP = lib.mkDefault true; + config = + lib.mkIf (config.hardware.facter.reportPath != null && config.hardware.facter.detected.dhcp.enable) + { + networking.useDHCP = lib.mkDefault true; - # Per-interface DHCP configuration - networking.interfaces = perInterfaceConfig; - }; + # Per-interface DHCP configuration + networking.interfaces = perInterfaceConfig; + }; } diff --git a/nixos/modules/hardware/facter/networking/initrd.nix b/nixos/modules/hardware/facter/networking/initrd.nix index 56be802b7cd9..8c3135354f93 100644 --- a/nixos/modules/hardware/facter/networking/initrd.nix +++ b/nixos/modules/hardware/facter/networking/initrd.nix @@ -14,7 +14,7 @@ in ''; }; - config = lib.mkIf config.boot.initrd.network.enable { + config = lib.mkIf (config.hardware.facter.reportPath != null && config.boot.initrd.network.enable) { boot.initrd.kernelModules = config.hardware.facter.detected.boot.initrd.networking.kernelModules; }; } diff --git a/nixos/modules/hardware/facter/networking/intel.nix b/nixos/modules/hardware/facter/networking/intel.nix index 4ae693a3c636..a28e8ecf580d 100644 --- a/nixos/modules/hardware/facter/networking/intel.nix +++ b/nixos/modules/hardware/facter/networking/intel.nix @@ -49,7 +49,7 @@ in }; }; - config = { + config = lib.mkIf (config.hardware.facter.reportPath != null) { networking.enableIntel2200BGFirmware = lib.mkIf cfg._2200BG.enable (lib.mkDefault true); hardware.enableRedistributableFirmware = lib.mkIf cfg._3945ABG.enable (lib.mkDefault true); }; diff --git a/nixos/modules/hardware/facter/system.nix b/nixos/modules/hardware/facter/system.nix index ef51b0e44f1d..32648f7d07e4 100644 --- a/nixos/modules/hardware/facter/system.nix +++ b/nixos/modules/hardware/facter/system.nix @@ -6,7 +6,7 @@ }: { # Skip setting hostPlatform if it's read-only - nixpkgs = + config.nixpkgs = lib.optionalAttrs (config.hardware.facter.report.system or null != null && !options.nixpkgs.hostPlatform.readOnly) { diff --git a/nixos/modules/hardware/facter/virtualisation.nix b/nixos/modules/hardware/facter/virtualisation.nix index 15cf6bab5aee..9f418ecf3488 100644 --- a/nixos/modules/hardware/facter/virtualisation.nix +++ b/nixos/modules/hardware/facter/virtualisation.nix @@ -51,7 +51,7 @@ in }; }; - config = { + config = lib.mkIf (config.hardware.facter.reportPath != null) { # KVM support boot.kernelModules = From a555914285e9d29a88c85763cbb507f0df71793c Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?J=C3=B6rg=20Thalheim?= Date: Tue, 4 Nov 2025 19:26:31 +0100 Subject: [PATCH 04/70] nixos/facter: make hasCPUFeature more fault-tolerant Add default value for features attribute in hasCPUFeature function to handle CPU records that might not have a features field, preventing errors when the report structure varies. --- nixos/modules/hardware/facter/virtualisation.nix | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/nixos/modules/hardware/facter/virtualisation.nix b/nixos/modules/hardware/facter/virtualisation.nix index 9f418ecf3488..e1a9a1647708 100644 --- a/nixos/modules/hardware/facter/virtualisation.nix +++ b/nixos/modules/hardware/facter/virtualisation.nix @@ -57,7 +57,14 @@ in boot.kernelModules = let hasCPUFeature = - feature: lib.any ({ features, ... }: lib.elem feature features) (report.hardware.cpu or [ ]); + feature: + lib.any ( + { + features ? [ ], + ... + }: + lib.elem feature features + ) (report.hardware.cpu or [ ]); in lib.mkMerge [ (lib.mkIf (hasCPUFeature "vmx") [ "kvm-intel" ]) From c642b98568fd03baa1715fd884fcfb4a70ea57a4 Mon Sep 17 00:00:00 2001 From: "R. Ryantm" Date: Fri, 7 Nov 2025 17:21:12 +0000 Subject: [PATCH 05/70] renderdoc: 1.40 -> 1.41 --- pkgs/by-name/re/renderdoc/package.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/by-name/re/renderdoc/package.nix b/pkgs/by-name/re/renderdoc/package.nix index 105deb7bc02e..5346e76c0e7e 100644 --- a/pkgs/by-name/re/renderdoc/package.nix +++ b/pkgs/by-name/re/renderdoc/package.nix @@ -33,13 +33,13 @@ let in stdenv.mkDerivation (finalAttrs: { pname = "renderdoc"; - version = "1.40"; + version = "1.41"; src = fetchFromGitHub { owner = "baldurk"; repo = "renderdoc"; rev = "v${finalAttrs.version}"; - hash = "sha256-420UV9I+jJ8sLOQVhfGfkGPqAnN+kgPy8k0rZLt5X+Y="; + hash = "sha256-1Us+hwvsHX2Zn0BCv8YkOCN1226gAXeZYsg4btyJi8w="; }; outputs = [ From ee5c60ffd5b5fb00d2f4cfdf44bd7ff9445c479c Mon Sep 17 00:00:00 2001 From: Defelo Date: Thu, 13 Nov 2025 16:45:53 +0100 Subject: [PATCH 06/70] obfs4: use finalAttrs pattern --- pkgs/by-name/ob/obfs4/package.nix | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/pkgs/by-name/ob/obfs4/package.nix b/pkgs/by-name/ob/obfs4/package.nix index 744c2cac6965..7a4cd523ae99 100644 --- a/pkgs/by-name/ob/obfs4/package.nix +++ b/pkgs/by-name/ob/obfs4/package.nix @@ -5,7 +5,7 @@ installShellFiles, }: -buildGoModule rec { +buildGoModule (finalAttrs: { pname = "obfs4"; version = "0.4.0"; @@ -16,7 +16,7 @@ buildGoModule rec { # We don't use pname = lyrebird and we use the old obfs4 name as the first # will collide with lyrebird Gtk3 program. repo = "lyrebird"; - rev = "lyrebird-${version}"; + rev = "lyrebird-${finalAttrs.version}"; hash = "sha256-aPALWvngC/BVQO73yUAykHvEb6T0DZcGMowXINDqhpQ="; }; @@ -52,11 +52,11 @@ buildGoModule rec { homepage = "https://gitlab.torproject.org/tpo/anti-censorship/pluggable-transports/lyrebird"; maintainers = with maintainers; [ thoughtpolice ]; mainProgram = "lyrebird"; - changelog = "https://gitlab.torproject.org/tpo/anti-censorship/pluggable-transports/lyrebird/-/raw/${src.rev}/ChangeLog"; + changelog = "https://gitlab.torproject.org/tpo/anti-censorship/pluggable-transports/lyrebird/-/raw/${finalAttrs.src.rev}/ChangeLog"; license = with lib.licenses; [ bsd2 bsd3 gpl3 ]; }; -} +}) From 49dface882a033a6c2c583334c5cdc7213c7d58f Mon Sep 17 00:00:00 2001 From: Defelo Date: Thu, 13 Nov 2025 16:46:17 +0100 Subject: [PATCH 07/70] obfs4: use tag in fetchFromGitLab --- pkgs/by-name/ob/obfs4/package.nix | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/pkgs/by-name/ob/obfs4/package.nix b/pkgs/by-name/ob/obfs4/package.nix index 7a4cd523ae99..4f2fadb408e3 100644 --- a/pkgs/by-name/ob/obfs4/package.nix +++ b/pkgs/by-name/ob/obfs4/package.nix @@ -16,7 +16,7 @@ buildGoModule (finalAttrs: { # We don't use pname = lyrebird and we use the old obfs4 name as the first # will collide with lyrebird Gtk3 program. repo = "lyrebird"; - rev = "lyrebird-${finalAttrs.version}"; + tag = "lyrebird-${finalAttrs.version}"; hash = "sha256-aPALWvngC/BVQO73yUAykHvEb6T0DZcGMowXINDqhpQ="; }; From dc4ced85475de6c87b888e950dce86f8da1e8d30 Mon Sep 17 00:00:00 2001 From: Defelo Date: Thu, 13 Nov 2025 16:46:49 +0100 Subject: [PATCH 08/70] obfs4: remove `with lib;` --- pkgs/by-name/ob/obfs4/package.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/by-name/ob/obfs4/package.nix b/pkgs/by-name/ob/obfs4/package.nix index 4f2fadb408e3..5a13691d9a27 100644 --- a/pkgs/by-name/ob/obfs4/package.nix +++ b/pkgs/by-name/ob/obfs4/package.nix @@ -36,7 +36,7 @@ buildGoModule (finalAttrs: { ln -s $out/share/man/man1/{lyrebird,obfs4proxy}.1 ''; - meta = with lib; { + meta = { description = "Circumvents censorship by transforming Tor traffic between clients and bridges"; longDescription = '' Obfs4proxy is a tool that attempts to circumvent censorship by @@ -50,7 +50,7 @@ buildGoModule (finalAttrs: { multiple pluggable transports. ''; homepage = "https://gitlab.torproject.org/tpo/anti-censorship/pluggable-transports/lyrebird"; - maintainers = with maintainers; [ thoughtpolice ]; + maintainers = with lib.maintainers; [ thoughtpolice ]; mainProgram = "lyrebird"; changelog = "https://gitlab.torproject.org/tpo/anti-censorship/pluggable-transports/lyrebird/-/raw/${finalAttrs.src.rev}/ChangeLog"; license = with lib.licenses; [ From d3d181c6b9a89edcd85d96bd7c7f7457a3c7ba2e Mon Sep 17 00:00:00 2001 From: Defelo Date: Thu, 13 Nov 2025 16:50:34 +0100 Subject: [PATCH 09/70] obfs4: don't use `src.rev` in `meta.changelog` --- pkgs/by-name/ob/obfs4/package.nix | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/pkgs/by-name/ob/obfs4/package.nix b/pkgs/by-name/ob/obfs4/package.nix index 5a13691d9a27..eb40aeff4809 100644 --- a/pkgs/by-name/ob/obfs4/package.nix +++ b/pkgs/by-name/ob/obfs4/package.nix @@ -52,7 +52,7 @@ buildGoModule (finalAttrs: { homepage = "https://gitlab.torproject.org/tpo/anti-censorship/pluggable-transports/lyrebird"; maintainers = with lib.maintainers; [ thoughtpolice ]; mainProgram = "lyrebird"; - changelog = "https://gitlab.torproject.org/tpo/anti-censorship/pluggable-transports/lyrebird/-/raw/${finalAttrs.src.rev}/ChangeLog"; + changelog = "https://gitlab.torproject.org/tpo/anti-censorship/pluggable-transports/lyrebird/-/blob/lyrebird-${finalAttrs.version}/ChangeLog"; license = with lib.licenses; [ bsd2 bsd3 From 8fdf7ab268b12a81d9bb092b2ee846575532d254 Mon Sep 17 00:00:00 2001 From: Defelo Date: Thu, 13 Nov 2025 16:52:56 +0100 Subject: [PATCH 10/70] obfs4: add versionCheckHook --- pkgs/by-name/ob/obfs4/package.nix | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/pkgs/by-name/ob/obfs4/package.nix b/pkgs/by-name/ob/obfs4/package.nix index eb40aeff4809..ddf287173eb2 100644 --- a/pkgs/by-name/ob/obfs4/package.nix +++ b/pkgs/by-name/ob/obfs4/package.nix @@ -3,6 +3,7 @@ buildGoModule, fetchFromGitLab, installShellFiles, + versionCheckHook, }: buildGoModule (finalAttrs: { @@ -25,6 +26,7 @@ buildGoModule (finalAttrs: { ldflags = [ "-s" "-w" + "-X main.lyrebirdVersion=${finalAttrs.version}" ]; subPackages = [ "cmd/lyrebird" ]; @@ -36,6 +38,10 @@ buildGoModule (finalAttrs: { ln -s $out/share/man/man1/{lyrebird,obfs4proxy}.1 ''; + nativeInstallCheckInputs = [ versionCheckHook ]; + versionCheckProgramArg = "--version"; + doInstallCheck = true; + meta = { description = "Circumvents censorship by transforming Tor traffic between clients and bridges"; longDescription = '' From 22aa117819702d77234501a757680c5fdb1a1d27 Mon Sep 17 00:00:00 2001 From: Defelo Date: Thu, 13 Nov 2025 16:53:20 +0100 Subject: [PATCH 11/70] obfs4: add updateScript --- pkgs/by-name/ob/obfs4/package.nix | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/pkgs/by-name/ob/obfs4/package.nix b/pkgs/by-name/ob/obfs4/package.nix index ddf287173eb2..db49a13a07c9 100644 --- a/pkgs/by-name/ob/obfs4/package.nix +++ b/pkgs/by-name/ob/obfs4/package.nix @@ -4,6 +4,7 @@ fetchFromGitLab, installShellFiles, versionCheckHook, + nix-update-script, }: buildGoModule (finalAttrs: { @@ -42,6 +43,10 @@ buildGoModule (finalAttrs: { versionCheckProgramArg = "--version"; doInstallCheck = true; + passthru.updateScript = nix-update-script { + extraArgs = [ "--version-regex=^lyrebird-(\\d+\\.\\d+\\.\\d+)$" ]; + }; + meta = { description = "Circumvents censorship by transforming Tor traffic between clients and bridges"; longDescription = '' From e208eb2f4d522e948f7ce24cf687f4ce2cd965ca Mon Sep 17 00:00:00 2001 From: Defelo Date: Thu, 13 Nov 2025 15:58:03 +0000 Subject: [PATCH 12/70] obfs4: 0.4.0 -> 0.6.2 Changelog: https://gitlab.torproject.org/tpo/anti-censorship/pluggable-transports/lyrebird/-/blob/lyrebird-0.6.2/ChangeLog Diff: https://gitlab.torproject.org/tpo/anti-censorship/pluggable-transports/lyrebird/-/compare/lyrebird-0.4.0...lyrebird-0.6.2 --- pkgs/by-name/ob/obfs4/package.nix | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/pkgs/by-name/ob/obfs4/package.nix b/pkgs/by-name/ob/obfs4/package.nix index db49a13a07c9..0567dcae7830 100644 --- a/pkgs/by-name/ob/obfs4/package.nix +++ b/pkgs/by-name/ob/obfs4/package.nix @@ -9,7 +9,7 @@ buildGoModule (finalAttrs: { pname = "obfs4"; - version = "0.4.0"; + version = "0.6.2"; src = fetchFromGitLab { domain = "gitlab.torproject.org"; @@ -19,10 +19,10 @@ buildGoModule (finalAttrs: { # will collide with lyrebird Gtk3 program. repo = "lyrebird"; tag = "lyrebird-${finalAttrs.version}"; - hash = "sha256-aPALWvngC/BVQO73yUAykHvEb6T0DZcGMowXINDqhpQ="; + hash = "sha256-0Nny97bapiyolmCHcty+HtZTziA50bqoCD+3gyFZIQE="; }; - vendorHash = "sha256-iR3+ZMEF0SB3EoLTf2gtqTe3CQcjtDRhfwwbwGj3pXo="; + vendorHash = "sha256-ifJyOhbaB7BDBayvbh1otF1hxCuxzSG9NLb7Xtvaupg="; ldflags = [ "-s" From 308e699f66f93e866e047e0e1fab96aadf8c383a Mon Sep 17 00:00:00 2001 From: Defelo Date: Thu, 13 Nov 2025 20:21:38 +0100 Subject: [PATCH 13/70] obfs4: reorder meta attributes --- pkgs/by-name/ob/obfs4/package.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/by-name/ob/obfs4/package.nix b/pkgs/by-name/ob/obfs4/package.nix index 0567dcae7830..bd03fab18185 100644 --- a/pkgs/by-name/ob/obfs4/package.nix +++ b/pkgs/by-name/ob/obfs4/package.nix @@ -61,13 +61,13 @@ buildGoModule (finalAttrs: { multiple pluggable transports. ''; homepage = "https://gitlab.torproject.org/tpo/anti-censorship/pluggable-transports/lyrebird"; - maintainers = with lib.maintainers; [ thoughtpolice ]; - mainProgram = "lyrebird"; changelog = "https://gitlab.torproject.org/tpo/anti-censorship/pluggable-transports/lyrebird/-/blob/lyrebird-${finalAttrs.version}/ChangeLog"; license = with lib.licenses; [ bsd2 bsd3 gpl3 ]; + maintainers = with lib.maintainers; [ thoughtpolice ]; + mainProgram = "lyrebird"; }; }) From c536439a556aa5c5eda514275b279be6b434a416 Mon Sep 17 00:00:00 2001 From: Defelo Date: Thu, 13 Nov 2025 20:22:13 +0100 Subject: [PATCH 14/70] obfs4: add defelo as maintainer --- pkgs/by-name/ob/obfs4/package.nix | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/pkgs/by-name/ob/obfs4/package.nix b/pkgs/by-name/ob/obfs4/package.nix index bd03fab18185..e61f4c1df65a 100644 --- a/pkgs/by-name/ob/obfs4/package.nix +++ b/pkgs/by-name/ob/obfs4/package.nix @@ -67,7 +67,10 @@ buildGoModule (finalAttrs: { bsd3 gpl3 ]; - maintainers = with lib.maintainers; [ thoughtpolice ]; + maintainers = with lib.maintainers; [ + thoughtpolice + defelo + ]; mainProgram = "lyrebird"; }; }) From 10de6e5ef8877c18ca4714622a9ba38e30f234c6 Mon Sep 17 00:00:00 2001 From: "R. Ryantm" Date: Sat, 15 Nov 2025 11:11:32 +0000 Subject: [PATCH 15/70] python3Packages.frozendict: 2.4.6 -> 2.4.7 --- pkgs/development/python-modules/frozendict/default.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/development/python-modules/frozendict/default.nix b/pkgs/development/python-modules/frozendict/default.nix index 7fe6bf02311c..db16aa1bafe7 100644 --- a/pkgs/development/python-modules/frozendict/default.nix +++ b/pkgs/development/python-modules/frozendict/default.nix @@ -9,7 +9,7 @@ buildPythonPackage rec { pname = "frozendict"; - version = "2.4.6"; + version = "2.4.7"; pyproject = true; disabled = pythonOlder "3.6"; @@ -18,7 +18,7 @@ buildPythonPackage rec { owner = "Marco-Sulla"; repo = "python-frozendict"; tag = "v${version}"; - hash = "sha256-cdKI0wIr0w6seV12cigqyJL6PSkLVzwVxASUB8n7lFY="; + hash = "sha256-ehx8X3jbKls/DVgCzWJ+nTX+m/Cdknnu/sjrAMxnJFo="; }; # build C version if it exists From f5e1f721d887f40c32a048d3322a4d77d2cc350b Mon Sep 17 00:00:00 2001 From: whispers Date: Tue, 18 Nov 2025 13:59:47 -0500 Subject: [PATCH 16/70] tor: 0.4.8.20 -> 0.4.8.21 Release notes: https://gitlab.torproject.org/tpo/core/tor/-/raw/release-0.4.8/ReleaseNotes --- pkgs/by-name/to/tor/package.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/by-name/to/tor/package.nix b/pkgs/by-name/to/tor/package.nix index ab5d0e8b7bd9..e3691a0467b6 100644 --- a/pkgs/by-name/to/tor/package.nix +++ b/pkgs/by-name/to/tor/package.nix @@ -46,11 +46,11 @@ in stdenv.mkDerivation (finalAttrs: { pname = "tor"; - version = "0.4.8.20"; + version = "0.4.8.21"; src = fetchurl { url = "https://dist.torproject.org/tor-${finalAttrs.version}.tar.gz"; - hash = "sha256-G7IjKM3R7pSGR7/O1XHvp4wS/FBkGHtB1SVAhbUoL6c="; + hash = "sha256-6vb1tzCRuVV2lF6t6YgW3f980AW+/k2UcYpvdmuECQM="; }; outputs = [ From bcf7248f72f439c5428a5781d362f7ff0dab3e15 Mon Sep 17 00:00:00 2001 From: Tom Hunze Date: Tue, 18 Nov 2025 23:46:29 +0100 Subject: [PATCH 17/70] gvm-libs: 22.11.0 -> 22.31.1 --- pkgs/by-name/gv/gvm-libs/package.nix | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/pkgs/by-name/gv/gvm-libs/package.nix b/pkgs/by-name/gv/gvm-libs/package.nix index 982db26458f1..56c56b8bef59 100644 --- a/pkgs/by-name/gv/gvm-libs/package.nix +++ b/pkgs/by-name/gv/gvm-libs/package.nix @@ -1,11 +1,12 @@ { lib, stdenv, + cjson, cmake, + curl, doxygen, fetchFromGitHub, glib, - glib-networking, gnutls, gpgme, hiredis, @@ -25,13 +26,13 @@ stdenv.mkDerivation rec { pname = "gvm-libs"; - version = "22.11.0"; + version = "22.31.1"; src = fetchFromGitHub { owner = "greenbone"; repo = "gvm-libs"; tag = "v${version}"; - hash = "sha256-VYFAy6VVASNOBLs39qukePYr5pV0IR1qjztv+veNCVc="; + hash = "sha256-/2r5jPWqOb9KQyCW1ja9xV/RBQnsZCeJJHL2a6oH3bk="; }; postPatch = '' @@ -45,8 +46,9 @@ stdenv.mkDerivation rec { ]; buildInputs = [ + cjson + curl glib - glib-networking gnutls gpgme hiredis From 292a568c9959c0da693eedf4dd6627c20910b3fd Mon Sep 17 00:00:00 2001 From: "R. Ryantm" Date: Wed, 19 Nov 2025 01:45:03 +0000 Subject: [PATCH 18/70] postgresqlPackages.postgis: 3.6.0 -> 3.6.1 --- pkgs/servers/sql/postgresql/ext/postgis.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/servers/sql/postgresql/ext/postgis.nix b/pkgs/servers/sql/postgresql/ext/postgis.nix index 2c2126190ff6..2ca28f659af8 100644 --- a/pkgs/servers/sql/postgresql/ext/postgis.nix +++ b/pkgs/servers/sql/postgresql/ext/postgis.nix @@ -35,7 +35,7 @@ let in postgresqlBuildExtension (finalAttrs: { pname = "postgis"; - version = "3.6.0"; + version = "3.6.1"; outputs = [ "out" @@ -46,7 +46,7 @@ postgresqlBuildExtension (finalAttrs: { owner = "postgis"; repo = "postgis"; tag = finalAttrs.version; - hash = "sha256-L8k3yk1Dn4Dk7UyHse+8RJsjYsYMebdsiZp6fS7cC0Y="; + hash = "sha256-WVS2TWKishTnCWJ87Vvdcb0i3VR+g/qSjcTDO1cx1s0="; }; buildInputs = [ From 50b2184b47ed1f78826f2728d1f22ca7d38f83ea Mon Sep 17 00:00:00 2001 From: "R. Ryantm" Date: Wed, 19 Nov 2025 12:32:42 +0000 Subject: [PATCH 19/70] python3Packages.beautysh: 6.4.1 -> 6.4.2 --- pkgs/development/python-modules/beautysh/default.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/development/python-modules/beautysh/default.nix b/pkgs/development/python-modules/beautysh/default.nix index 199e6bab6ed5..b66f2b58173a 100644 --- a/pkgs/development/python-modules/beautysh/default.nix +++ b/pkgs/development/python-modules/beautysh/default.nix @@ -13,14 +13,14 @@ buildPythonPackage rec { pname = "beautysh"; - version = "6.4.1"; + version = "6.4.2"; pyproject = true; src = fetchFromGitHub { owner = "lovesegfault"; repo = "beautysh"; tag = "v${version}"; - hash = "sha256-B+1qwivb9MZ+W0u7hccDt3aTjDOcbEQ89Alc8mWd2Sg="; + hash = "sha256-wLqysNhkagZ+sphqMC78cLoKvsMJpJCJr16lgvU37JI="; }; build-system = [ hatchling ]; From 56b05f02fb83d28f86b7303d6b40f1c779bbb377 Mon Sep 17 00:00:00 2001 From: "R. Ryantm" Date: Wed, 19 Nov 2025 16:16:08 +0000 Subject: [PATCH 20/70] brutespray: 2.4.0 -> 2.4.1 --- pkgs/by-name/br/brutespray/package.nix | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/pkgs/by-name/br/brutespray/package.nix b/pkgs/by-name/br/brutespray/package.nix index f455089ea7da..1cbe767851e9 100644 --- a/pkgs/by-name/br/brutespray/package.nix +++ b/pkgs/by-name/br/brutespray/package.nix @@ -8,16 +8,16 @@ buildGoModule (finalAttrs: { pname = "brutespray"; - version = "2.4.0"; + version = "2.4.1"; src = fetchFromGitHub { owner = "x90skysn3k"; repo = "brutespray"; tag = "v${finalAttrs.version}"; - hash = "sha256-tws3BvVQSlGcBgiJ8Ho7V/KJjzoq3TEOiChqTzrMbiU="; + hash = "sha256-szW4Cvby93aWbdH4I/RbGVvPBuM11sJGLuZA4nP2Cb4="; }; - vendorHash = "sha256-Fe3W5rlKygw4z5bF+6xy5mv86wKcBuCf3nhtdtFWJPM="; + vendorHash = "sha256-NJV5lCjr9wNZAZYtO1jWpLW2otWutUSQKdvnKUiFtBo="; nativeBuildInputs = [ makeBinaryWrapper ]; From 6a1d9e741aa9aba0b9cad54853d62585131ed2fe Mon Sep 17 00:00:00 2001 From: "R. Ryantm" Date: Wed, 19 Nov 2025 17:10:30 +0000 Subject: [PATCH 21/70] python3Packages.pytenable: 1.8.4 -> 1.9.0 --- pkgs/development/python-modules/pytenable/default.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/development/python-modules/pytenable/default.nix b/pkgs/development/python-modules/pytenable/default.nix index ad1fa92a6980..8776b245508f 100644 --- a/pkgs/development/python-modules/pytenable/default.nix +++ b/pkgs/development/python-modules/pytenable/default.nix @@ -28,7 +28,7 @@ buildPythonPackage rec { pname = "pytenable"; - version = "1.8.4"; + version = "1.9.0"; pyproject = true; disabled = pythonOlder "3.10"; @@ -37,7 +37,7 @@ buildPythonPackage rec { owner = "tenable"; repo = "pyTenable"; tag = version; - hash = "sha256-Dt6jN+0Ktv3CO88RmbgKCU8v3Oa10MnKjyJaePxXsaI="; + hash = "sha256-ml5364D3qvd6VNhF2JyGoCzxbdO0DBkaBMoD38O5x8o="; }; pythonRelaxDeps = [ From 041b8cce93bc0b3197ee91ef34cd6e34a1de6eed Mon Sep 17 00:00:00 2001 From: Fabian Affolter Date: Wed, 19 Nov 2025 18:15:21 +0100 Subject: [PATCH 22/70] brutespray: update meta --- pkgs/by-name/br/brutespray/package.nix | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/pkgs/by-name/br/brutespray/package.nix b/pkgs/by-name/br/brutespray/package.nix index 1cbe767851e9..fa0797ad7a33 100644 --- a/pkgs/by-name/br/brutespray/package.nix +++ b/pkgs/by-name/br/brutespray/package.nix @@ -29,14 +29,15 @@ buildGoModule (finalAttrs: { ''; meta = { - homepage = "https://github.com/x90skysn3k/brutespray"; description = "Tool to do brute-forcing from Nmap output"; - mainProgram = "brutespray"; + homepage = "https://github.com/x90skysn3k/brutespray"; longDescription = '' This tool automatically attempts default credentials on found services directly from Nmap output. ''; + changelog = "https://github.com/x90skysn3k/brutespray/releases/tag/v${finalAttrs.version}"; license = lib.licenses.mit; maintainers = [ ]; + mainProgram = "brutespray"; }; }) From 8efa0cf1e562cffab9a435081fd38c7dd7d3fd1f Mon Sep 17 00:00:00 2001 From: simonzkl <110235118+simonzkl@users.noreply.github.com> Date: Wed, 19 Nov 2025 19:11:37 +0100 Subject: [PATCH 23/70] Revert "openssl: help build system to detect cross builds" This reverts commit 5d006774c0de6e698ad96bdc0dd3acf779b167da. --- pkgs/development/libraries/openssl/default.nix | 5 ----- 1 file changed, 5 deletions(-) diff --git a/pkgs/development/libraries/openssl/default.nix b/pkgs/development/libraries/openssl/default.nix index 7c702660d390..bb9eb51123d2 100644 --- a/pkgs/development/libraries/openssl/default.nix +++ b/pkgs/development/libraries/openssl/default.nix @@ -186,11 +186,6 @@ let "--openssldir=/.$(etc)/etc/ssl" ) ] - # Tell build system it's cross environment. This allows to skip tests - # that would fail when libc is different. Otherwise, run the tests. - ++ lib.optional ( - !lib.systems.equals stdenv.buildPlatform stdenv.hostPlatform - ) "--cross-compile-prefix=${lib.getBin stdenv.cc}/bin/" ++ lib.optionals withCryptodev [ "-DHAVE_CRYPTODEV" "-DUSE_CRYPTODEV_DIGESTS" From 54efca0fbb6a15d2cfe1a0e2b2bea4f56f220ea3 Mon Sep 17 00:00:00 2001 From: simonzkl <110235118+simonzkl@users.noreply.github.com> Date: Wed, 19 Nov 2025 19:11:47 +0100 Subject: [PATCH 24/70] Reapply "openssl: disable failing test on cross to musl" This reverts commit 27278f6e01f295df6e9af60f994e1e200e6ce8a0. --- pkgs/development/libraries/openssl/default.nix | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) diff --git a/pkgs/development/libraries/openssl/default.nix b/pkgs/development/libraries/openssl/default.nix index bb9eb51123d2..d7f9a42511ad 100644 --- a/pkgs/development/libraries/openssl/default.nix +++ b/pkgs/development/libraries/openssl/default.nix @@ -90,7 +90,15 @@ let substituteInPlace Configurations/unix-Makefile.tmpl \ --replace 'ENGINESDIR=$(libdir)/engines-{- $sover_dirname -}' \ 'ENGINESDIR=$(OPENSSLDIR)/engines-{- $sover_dirname -}' - ''; + '' + # This test will fail if the error strings between the build libc and host + # libc mismatch, e.g. when cross-compiling from glibc to musl + + + lib.optionalString + (finalAttrs.finalPackage.doCheck && stdenv.hostPlatform.libc != stdenv.buildPlatform.libc) + '' + rm test/recipes/02-test_errstr.t + ''; outputs = [ "bin" From 14e61be42c17d58cf2a1102208656032dfdd5f09 Mon Sep 17 00:00:00 2001 From: Tom Hunze Date: Wed, 19 Nov 2025 19:20:37 +0100 Subject: [PATCH 25/70] gvm-libs: refactor --- pkgs/by-name/gv/gvm-libs/package.nix | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/pkgs/by-name/gv/gvm-libs/package.nix b/pkgs/by-name/gv/gvm-libs/package.nix index 56c56b8bef59..d5930d14e505 100644 --- a/pkgs/by-name/gv/gvm-libs/package.nix +++ b/pkgs/by-name/gv/gvm-libs/package.nix @@ -73,7 +73,7 @@ stdenv.mkDerivation rec { meta = { description = "Libraries module for the Greenbone Vulnerability Management Solution"; homepage = "https://github.com/greenbone/gvm-libs"; - changelog = "https://github.com/greenbone/gvm-libs/releases/tag/v${version}"; + changelog = "https://github.com/greenbone/gvm-libs/releases/tag/${src.tag}"; license = with lib.licenses; [ gpl2Plus ]; maintainers = with lib.maintainers; [ fab ]; platforms = lib.platforms.linux; From 39e645995705ba7113077a528f42f42effba576b Mon Sep 17 00:00:00 2001 From: "R. Ryantm" Date: Wed, 19 Nov 2025 19:20:54 +0000 Subject: [PATCH 26/70] libgedit-gfls: 0.3.0 -> 0.3.1 --- pkgs/by-name/li/libgedit-gfls/package.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/by-name/li/libgedit-gfls/package.nix b/pkgs/by-name/li/libgedit-gfls/package.nix index 02000133db28..2cc1093e87ac 100644 --- a/pkgs/by-name/li/libgedit-gfls/package.nix +++ b/pkgs/by-name/li/libgedit-gfls/package.nix @@ -16,7 +16,7 @@ stdenv.mkDerivation (finalAttrs: { pname = "libgedit-gfls"; - version = "0.3.0"; + version = "0.3.1"; outputs = [ "out" @@ -30,7 +30,7 @@ stdenv.mkDerivation (finalAttrs: { owner = "gedit"; repo = "libgedit-gfls"; tag = finalAttrs.version; - hash = "sha256-X56QPcmNB0Ey+kzSqDnb6/j6/w7IU7MFSAxW8mX8I3w="; + hash = "sha256-HBXOphDvFwXea0mlfPqPtaXgNpAZyHYwuHBn5f7hPso="; }; nativeBuildInputs = [ From 69dcf35ffd32f207a13c4836267da2c7caea3dba Mon Sep 17 00:00:00 2001 From: "R. Ryantm" Date: Wed, 19 Nov 2025 20:15:16 +0000 Subject: [PATCH 27/70] cdncheck: 1.2.9 -> 1.2.10 --- pkgs/by-name/cd/cdncheck/package.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/by-name/cd/cdncheck/package.nix b/pkgs/by-name/cd/cdncheck/package.nix index 368814776125..ccd5586fdff2 100644 --- a/pkgs/by-name/cd/cdncheck/package.nix +++ b/pkgs/by-name/cd/cdncheck/package.nix @@ -6,13 +6,13 @@ buildGoModule rec { pname = "cdncheck"; - version = "1.2.9"; + version = "1.2.10"; src = fetchFromGitHub { owner = "projectdiscovery"; repo = "cdncheck"; tag = "v${version}"; - hash = "sha256-d1j/1DYeKolBBJ2DdPBduAymL68DRV0eUFoEuJSL0qU="; + hash = "sha256-KX+LEVRRPGtMEmYgrrSWBsvXyd7nvC5CHoRNI3kuVqI="; }; vendorHash = "sha256-XLfbuqyu+U11v8TZifPyltLQtx+zAFxlTh0rgpXOpYU="; From 543776b529d944c67a7a41b1904e95e2b2dc1383 Mon Sep 17 00:00:00 2001 From: "R. Ryantm" Date: Wed, 19 Nov 2025 21:25:07 +0000 Subject: [PATCH 28/70] python3Packages.llama-index-vector-stores-milvus: 0.9.3 -> 0.9.4 --- .../llama-index-vector-stores-milvus/default.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/development/python-modules/llama-index-vector-stores-milvus/default.nix b/pkgs/development/python-modules/llama-index-vector-stores-milvus/default.nix index e29574277fe2..b534afc3d8be 100644 --- a/pkgs/development/python-modules/llama-index-vector-stores-milvus/default.nix +++ b/pkgs/development/python-modules/llama-index-vector-stores-milvus/default.nix @@ -9,13 +9,13 @@ buildPythonPackage rec { pname = "llama-index-vector-stores-milvus"; - version = "0.9.3"; + version = "0.9.4"; pyproject = true; src = fetchPypi { pname = "llama_index_vector_stores_milvus"; inherit version; - hash = "sha256-JiGsSKKlwV3efEkT5p3lXcEY7hCbVWRdCAX9X539Ke0="; + hash = "sha256-Zf+/xk3bqN/ARvwzDiN4/g7Neo6l9x5wTcTSvzto//A="; }; build-system = [ hatchling ]; From b780918ec082f053da0a4b4eb29eae75cbdf6096 Mon Sep 17 00:00:00 2001 From: "R. Ryantm" Date: Wed, 19 Nov 2025 22:50:22 +0000 Subject: [PATCH 29/70] linuxKernel.kernels.linux_zen: 6.17.7 -> 6.17.8 --- pkgs/os-specific/linux/kernel/zen-kernels.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/os-specific/linux/kernel/zen-kernels.nix b/pkgs/os-specific/linux/kernel/zen-kernels.nix index 1c0435d1306f..235bae47ff91 100644 --- a/pkgs/os-specific/linux/kernel/zen-kernels.nix +++ b/pkgs/os-specific/linux/kernel/zen-kernels.nix @@ -16,9 +16,9 @@ let variants = { # ./update-zen.py zen zen = { - version = "6.17.7"; # zen + version = "6.17.8"; # zen suffix = "zen1"; # zen - sha256 = "01dh7cdqa4rx0fmr22yyn8d6qb8ns7v0x53k2ij3vrp9pz6p5cs4"; # zen + sha256 = "0khz49xgqvbxsq0gk127xspic3ks1x61v3ggnjzwhzsgpqyvjv04"; # zen isLqx = false; }; # ./update-zen.py lqx From 880f64ff9d254e31e6964b4946f8438c406275ab Mon Sep 17 00:00:00 2001 From: "R. Ryantm" Date: Thu, 20 Nov 2025 00:40:29 +0000 Subject: [PATCH 30/70] croc: 10.2.7 -> 10.3.0 --- pkgs/by-name/cr/croc/package.nix | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/pkgs/by-name/cr/croc/package.nix b/pkgs/by-name/cr/croc/package.nix index 6e0741fcb36d..52c9f555acf1 100644 --- a/pkgs/by-name/cr/croc/package.nix +++ b/pkgs/by-name/cr/croc/package.nix @@ -8,16 +8,16 @@ buildGoModule rec { pname = "croc"; - version = "10.2.7"; + version = "10.3.0"; src = fetchFromGitHub { owner = "schollz"; repo = "croc"; rev = "v${version}"; - hash = "sha256-eIWLTWFnF7lMU2b43Txoi8yxAEmPIKl5xmK2Q5wgXeg="; + hash = "sha256-5mxrfYAR4kTy9hdbsC7wFdroHf68dknPH3mq4KXG36Y="; }; - vendorHash = "sha256-kuJrh9cK+ezxbScks0slj7f/nGHQTQpxg5I5bJ16ORk="; + vendorHash = "sha256-xEF1vjYQaeDYxcC3FTgR0zCFqvziNIrJVpJJT4o1cVU="; subPackages = [ "." ]; From c41b7f0e0bea21d8674eaa60046f2ca6b7760b22 Mon Sep 17 00:00:00 2001 From: "R. Ryantm" Date: Thu, 20 Nov 2025 03:36:08 +0000 Subject: [PATCH 31/70] dart-sass: 1.94.0 -> 1.94.2 --- pkgs/by-name/da/dart-sass/package.nix | 4 ++-- pkgs/by-name/da/dart-sass/pubspec.lock.json | 4 ++-- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/pkgs/by-name/da/dart-sass/package.nix b/pkgs/by-name/da/dart-sass/package.nix index f0f9fcf50df1..3997f438b6ed 100644 --- a/pkgs/by-name/da/dart-sass/package.nix +++ b/pkgs/by-name/da/dart-sass/package.nix @@ -23,13 +23,13 @@ let in buildDartApplication rec { pname = "dart-sass"; - version = "1.94.0"; + version = "1.94.2"; src = fetchFromGitHub { owner = "sass"; repo = "dart-sass"; tag = version; - hash = "sha256-upE3IVMvwLABzq3rlgKN6LOnAH1TE8kdsTAh3Hr5QE0="; + hash = "sha256-/ygA4Ymo7n3JWCv/qxkQs6JWoIhMIwHjKCqk4KyKOMw="; }; pubspecLock = lib.importJSON ./pubspec.lock.json; diff --git a/pkgs/by-name/da/dart-sass/pubspec.lock.json b/pkgs/by-name/da/dart-sass/pubspec.lock.json index 8f46beed4389..0831edb476a4 100644 --- a/pkgs/by-name/da/dart-sass/pubspec.lock.json +++ b/pkgs/by-name/da/dart-sass/pubspec.lock.json @@ -184,11 +184,11 @@ "dependency": "transitive", "description": { "name": "dart_style", - "sha256": "c87dfe3d56f183ffe9106a18aebc6db431fc7c98c31a54b952a77f3d54a85697", + "sha256": "a9c30492da18ff84efe2422ba2d319a89942d93e58eb0b73d32abe822ef54b7b", "url": "https://pub.dev" }, "source": "hosted", - "version": "3.1.2" + "version": "3.1.3" }, "dartdoc": { "dependency": "direct dev", From cb2857835654be9da63cd2b8bf7b4ff7e40c7a93 Mon Sep 17 00:00:00 2001 From: Sizhe Zhao Date: Mon, 14 Apr 2025 17:24:41 +0800 Subject: [PATCH 32/70] nixos/firewalld: init --- nixos/modules/module-list.nix | 1 + .../services/networking/firewalld/default.nix | 66 ++++ .../services/networking/firewalld/lib.nix | 55 ++++ .../services/networking/firewalld/service.nix | 121 ++++++++ .../networking/firewalld/settings.nix | 198 ++++++++++++ .../services/networking/firewalld/zone.nix | 281 ++++++++++++++++++ 6 files changed, 722 insertions(+) create mode 100644 nixos/modules/services/networking/firewalld/default.nix create mode 100644 nixos/modules/services/networking/firewalld/lib.nix create mode 100644 nixos/modules/services/networking/firewalld/service.nix create mode 100644 nixos/modules/services/networking/firewalld/settings.nix create mode 100644 nixos/modules/services/networking/firewalld/zone.nix diff --git a/nixos/modules/module-list.nix b/nixos/modules/module-list.nix index 0b9bd6d976f6..f706b63b5e3e 100644 --- a/nixos/modules/module-list.nix +++ b/nixos/modules/module-list.nix @@ -1165,6 +1165,7 @@ ./services/networking/firewall-iptables.nix ./services/networking/firewall-nftables.nix ./services/networking/firewall.nix + ./services/networking/firewalld ./services/networking/firezone/gateway.nix ./services/networking/firezone/gui-client.nix ./services/networking/firezone/headless-client.nix diff --git a/nixos/modules/services/networking/firewalld/default.nix b/nixos/modules/services/networking/firewalld/default.nix new file mode 100644 index 000000000000..e0e8bf4cb47c --- /dev/null +++ b/nixos/modules/services/networking/firewalld/default.nix @@ -0,0 +1,66 @@ +{ + config, + lib, + pkgs, + ... +}: + +let + cfg = config.services.firewalld; + paths = pkgs.buildEnv { + name = "firewalld-paths"; + paths = cfg.packages; + pathsToLink = [ "/lib/firewalld" ]; + }; +in +{ + imports = [ + ./service.nix + ./settings.nix + ./zone.nix + ]; + + options.services.firewalld = { + enable = lib.mkEnableOption "FirewallD"; + package = lib.mkPackageOption pkgs "firewalld" { }; + packages = lib.mkOption { + type = lib.types.listOf lib.types.package; + default = [ ]; + description = '' + Packages providing firewalld zones and other files. + Files found in `/lib/firewalld` will be included. + ''; + }; + extraArgs = lib.mkOption { + type = lib.types.listOf lib.types.str; + default = [ ]; + example = [ "--debug" ]; + description = "Extra arguments to pass to FirewallD."; + }; + }; + + config = lib.mkIf cfg.enable { + environment.systemPackages = [ cfg.package ]; + services.dbus.packages = [ cfg.package ]; + services.firewalld.packages = [ cfg.package ]; + + services.logrotate.settings."/var/log/firewalld" = { + copytruncate = true; + minsize = "1M"; + }; + + environment.etc."sysconfig/firewalld".text = '' + FIREWALLD_ARGS=${lib.concatStringsSep " " cfg.extraArgs} + ''; + + systemd.packages = [ cfg.package ]; + systemd.services.firewalld = { + aliases = [ "dbus-org.fedoraproject.FirewallD1.service" ]; + wantedBy = [ "multi-user.target" ]; + serviceConfig.ExecReload = "${lib.getExe' pkgs.coreutils "kill"} -HUP $MAINPID"; + environment.NIX_FIREWALLD_CONFIG_PATH = "${paths}/lib/firewalld"; + }; + }; + + meta.maintainers = with lib.maintainers; [ prince213 ]; +} diff --git a/nixos/modules/services/networking/firewalld/lib.nix b/nixos/modules/services/networking/firewalld/lib.nix new file mode 100644 index 000000000000..c8977dd346e7 --- /dev/null +++ b/nixos/modules/services/networking/firewalld/lib.nix @@ -0,0 +1,55 @@ +{ lib }: + +let + inherit (lib) mkOption; + inherit (lib.types) + either + enum + nullOr + port + submodule + ; + mkPortOption = + { + optional ? false, + }: + mkOption { + type = + let + type = either port (submodule { + options = { + from = mkOption { type = port; }; + to = mkOption { type = port; }; + }; + }); + in + if optional then (nullOr type) else type; + description = ""; + apply = + value: if builtins.isAttrs value then "${toString value.from}-${toString value.to}" else value; + }; + protocolOption = mkOption { + type = enum [ + "tcp" + "udp" + "sctp" + "dccp" + ]; + description = ""; + }; +in +{ + inherit mkPortOption; + inherit protocolOption; + + toXmlAttrs = lib.mapAttrs' (name: lib.nameValuePair ("@" + name)); + mkXmlAttr = name: value: { "@${name}" = value; }; + filterNullAttrs = lib.filterAttrsRecursive (_: value: value != null); + + portProtocolOptions = { + options = { + port = mkPortOption { }; + protocol = protocolOption; + }; + }; +} diff --git a/nixos/modules/services/networking/firewalld/service.nix b/nixos/modules/services/networking/firewalld/service.nix new file mode 100644 index 000000000000..92db5b251d10 --- /dev/null +++ b/nixos/modules/services/networking/firewalld/service.nix @@ -0,0 +1,121 @@ +{ + config, + lib, + pkgs, + ... +}: + +let + cfg = config.services.firewalld; + format = pkgs.formats.xml { }; + lib' = import ./lib.nix { inherit lib; }; + inherit (lib') + filterNullAttrs + mkXmlAttr + portProtocolOptions + toXmlAttrs + ; + inherit (lib) mkOption; + inherit (lib.types) + attrsOf + listOf + nonEmptyStr + nullOr + strMatching + submodule + ; +in +{ + options.services.firewalld.services = mkOption { + description = '' + firewalld service configuration files. See {manpage}`firewalld.service(5)`. + ''; + default = { }; + type = attrsOf (submodule { + options = { + version = mkOption { + type = nullOr nonEmptyStr; + description = "Version of the service."; + default = null; + }; + short = mkOption { + type = nullOr nonEmptyStr; + description = "Short description for the service."; + default = null; + }; + description = mkOption { + type = nullOr nonEmptyStr; + description = "Description for the service."; + default = null; + }; + ports = mkOption { + type = listOf (submodule portProtocolOptions); + description = "Ports of the service."; + default = [ ]; + }; + protocols = mkOption { + type = listOf nonEmptyStr; + description = "Protocols for the service."; + default = [ ]; + }; + sourcePorts = mkOption { + type = listOf (submodule portProtocolOptions); + description = "Source ports for the service."; + default = [ ]; + }; + destination = mkOption { + type = submodule { + options = { + ipv4 = mkOption { + type = nullOr (strMatching "([0-9]{1,3}\\.){3}[0-9]{1,3}(/[0-9]{1,2})?"); + description = "IPv4 destination."; + default = null; + }; + ipv6 = mkOption { + type = nullOr (strMatching "[0-9A-Fa-f:]{3,39}(/[0-9]{1,3})?"); + description = "IPv6 destination."; + default = null; + }; + }; + }; + description = "Destinations for the service."; + default = { }; + }; + includes = mkOption { + type = listOf nonEmptyStr; + description = "Services to include for the service."; + default = [ ]; + }; + helpers = mkOption { + type = listOf nonEmptyStr; + description = "Helpers for the service."; + default = [ ]; + }; + }; + }); + }; + + config = lib.mkIf cfg.enable { + environment.etc = lib.mapAttrs' ( + name: value: + lib.nameValuePair "firewalld/services/${name}.xml" { + source = format.generate "firewalld-service-${name}.xml" { + service = filterNullAttrs ( + lib.mergeAttrsList [ + (toXmlAttrs { inherit (value) version; }) + { + inherit (value) short description; + port = builtins.map toXmlAttrs value.ports; + protocol = builtins.map (mkXmlAttr "value") value.protocols; + source-port = builtins.map toXmlAttrs value.sourcePorts; + destination = toXmlAttrs value.destination; + include = builtins.map (mkXmlAttr "service") value.includes; + helper = builtins.map (mkXmlAttr "name") value.helpers; + } + ] + ); + }; + } + ) cfg.services; + }; +} diff --git a/nixos/modules/services/networking/firewalld/settings.nix b/nixos/modules/services/networking/firewalld/settings.nix new file mode 100644 index 000000000000..d47e56aac17d --- /dev/null +++ b/nixos/modules/services/networking/firewalld/settings.nix @@ -0,0 +1,198 @@ +{ + config, + lib, + pkgs, + ... +}: + +let + cfg = config.services.firewalld; + format = pkgs.formats.keyValue { }; + inherit (lib) mkOption; + inherit (lib.types) + bool + commas + either + enum + nonEmptyStr + separatedString + submodule + ; +in +{ + options.services.firewalld.settings = mkOption { + description = '' + FirewallD config file. + See {manpage}`firewalld.conf(5)`. + ''; + default = { }; + type = submodule { + freeformType = format.type; + options = { + DefaultZone = mkOption { + type = nonEmptyStr; + description = "Default zone for connections."; + default = "public"; + }; + CleanupOnExit = mkOption { + type = bool; + description = "Whether to clean up firewall rules when firewalld stops."; + default = true; + }; + CleanupModulesOnExit = mkOption { + type = bool; + description = "Whether to unload all firewall-related kernel modules when firewalld stops."; + default = false; + }; + IPv6_rpfilter = mkOption { + type = enum [ + "strict" + "loose" + "strict-forward" + "loose-forward" + "no" + ]; + description = '' + Performs reverse path filtering (RPF) on IPv6 packets as per RFC 3704. + + Possible values: + + `"strict"` + : Performs "strict" filtering as per RFC 3704. + This check verifies that the in ingress interface is the same interface that would be used to send a packet reply to the source. + That is, `ingress == egress`. + + `"loose"` + : Performs "loose" filtering as per RFC 3704. + This check only verifies that there is a route back to the source through any interface; even if it's not the same one on which the packet arrived. + + `"strict-forward"` + : This is almost identical to "strict", but does not perform RPF for packets targeted to the host (INPUT). + + `"loose-forward"` + : This is almost identical to "loose", but does not perform RPF for packets targeted to the host (INPUT). + + `"no"` + : RPF is completely disabled. + + The rp_filter for IPv4 is controlled using sysctl. + ''; + default = "strict"; + }; + IndividualCalls = mkOption { + type = bool; + description = '' + Whether to use individual -restore calls to apply changes to the firewall. + The use of individual calls increases the time that is needed to apply changes and to start the daemon, but is good for debugging as error messages are more specific. + ''; + default = false; + }; + LogDenied = mkOption { + type = enum [ + "all" + "unicast" + "broadcast" + "multicast" + "off" + ]; + description = '' + Add logging rules right before reject and drop rules in the INPUT, FORWARD and OUTPUT chains for the default rules and also final reject and drop rules in zones for the configured link-layer packet type. + ''; + default = "off"; + }; + FirewallBackend = mkOption { + type = enum [ + "nftables" + "iptables" + ]; + description = '' + The firewall backend implementation. + This applies to all firewalld primitives. + The only exception is direct and passthrough rules which always use the traditional iptables, ip6tables, and ebtables backends. + + ::: {.caution} + The iptables backend is deprecated. + It will be removed in a future release. + ::: + ''; + default = "nftables"; + }; + FlushAllOnReload = mkOption { + type = bool; + description = "Whether to flush all runtime rules on a reload."; + default = true; + }; + ReloadPolicy = mkOption { + type = + let + policy = enum [ + "DROP" + "REJECT" + "ACCEPT" + ]; + in + either policy commas; + description = "The policy during reload."; + default = "INPUT:DROP,FORWARD:DROP,OUTPUT:DROP"; + }; + RFC3964_IPv4 = mkOption { + type = bool; + description = '' + Whether to filter IPv6 traffic with 6to4 destination addresses that correspond to IPv4 addresses that should not be routed over the public internet. + ''; + default = true; + }; + StrictForwardPorts = mkOption { + type = bool; + description = '' + If enabled, the generated destination NAT (DNAT) rules will NOT accept traffic that was DNAT'd by other entities, e.g. docker. + Firewalld will be strict and not allow published container ports until they're explicitly allowed via firewalld. + If set to `false`, then docker (and podman) integrates seamlessly with firewalld. + Published container ports are implicitly allowed. + ''; + default = false; + }; + NftablesFlowtable = mkOption { + type = separatedString " "; + description = '' + This may improve forwarded traffic throughput by enabling nftables flowtable. + It is a software fastpath and avoids calling nftables rule evaluation for data packets. + Its value is a space separate list of interfaces. + ''; + default = "off"; + }; + NftablesCounters = mkOption { + type = bool; + description = "Whether to add a counter to every nftables rule."; + default = false; + }; + NftablesTableOwner = mkOption { + type = bool; + description = '' + If enabled, the generated nftables rule set will be owned exclusively by firewalld. + This prevents other entities from mistakenly (or maliciously) modifying firewalld's rule set. + If you intend to modify firewalld's rules, set this to `false`. + ''; + default = true; + }; + }; + }; + }; + + config = lib.mkIf cfg.enable { + assertions = [ + { + assertion = cfg.settings.FirewallBackend == "nftables" -> config.networking.nftables.enable; + message = '' + FirewallD uses nftables as the firewall backend (by default), but nftables support isn't enabled. + Please read the description of networking.nftables.enable for possible problems. + If using nftables is not desired, set services.firewalld.settings.FirewallBackend to "iptables", but be aware that FirewallD has deprecated support for it, and will override firewall rule set by other services, if any. + ''; + } + ]; + + environment.etc."firewalld/firewalld.conf" = { + source = format.generate "firewalld.conf" cfg.settings; + }; + }; +} diff --git a/nixos/modules/services/networking/firewalld/zone.nix b/nixos/modules/services/networking/firewalld/zone.nix new file mode 100644 index 000000000000..574c45304dd8 --- /dev/null +++ b/nixos/modules/services/networking/firewalld/zone.nix @@ -0,0 +1,281 @@ +{ + config, + lib, + pkgs, + ... +}: + +let + cfg = config.services.firewalld; + format = pkgs.formats.xml { }; + lib' = import ./lib.nix { inherit lib; }; + inherit (lib') + filterNullAttrs + mkPortOption + mkXmlAttr + portProtocolOptions + protocolOption + toXmlAttrs + ; + inherit (lib) mkOption; + inherit (lib.types) + attrTag + attrsOf + bool + enum + ints + listOf + nonEmptyStr + nullOr + strMatching + submodule + ; +in +{ + options.services.firewalld.zones = mkOption { + description = '' + firewalld zone configuration files. + See {manpage}`firewalld.zone(5)`. + ''; + default = { }; + example = { + public = { + forward = true; + services = [ + "ssh" + "dhcpv6-client" + ]; + }; + external = { + forward = true; + services = [ + "ssh" + ]; + masquerade = true; + }; + dmz = { + forward = true; + services = [ + "ssh" + ]; + }; + work = { + forward = true; + services = [ + "ssh" + "dhcpv6-client" + ]; + }; + home = { + forward = true; + services = [ + "ssh" + "mdns" + "samba-client" + "dhcpv6-client" + ]; + }; + internal = { + forward = true; + services = [ + "ssh" + "mdns" + "samba-client" + "dhcpv6-client" + ]; + }; + }; + type = attrsOf (submodule { + options = { + version = mkOption { + type = nullOr nonEmptyStr; + description = "Version of the zone."; + default = null; + }; + target = mkOption { + type = enum [ + "ACCEPT" + "%%REJECT%%" + "DROP" + ]; + description = "Action for packets that doesn't match any rules."; + default = "%%REJECT%%"; + }; + ingressPriority = mkOption { + type = nullOr ints.s16; + description = '' + Priority for inbound traffic. + Lower values have higher priority. + ''; + default = null; + }; + egressPriority = mkOption { + type = nullOr ints.s16; + description = '' + Priority for outbound traffic. + Lower values have higher priority. + ''; + default = null; + }; + interfaces = mkOption { + type = listOf nonEmptyStr; + description = "Interfaces to bind."; + default = [ ]; + }; + sources = mkOption { + type = listOf (attrTag { + address = mkOption { + type = nonEmptyStr; + description = '' + An IP address or a network IP address with a mask for IPv4 or IPv6. + For IPv4, the mask can be a network mask or a plain number. + For IPv6 the mask is a plain number. + The use of host names is not supported. + ''; + }; + mac = mkOption { + type = strMatching "([[:xdigit:]]{2}:){5}[[:xdigit:]]{2}"; + description = "A MAC address."; + }; + ipset = mkOption { + type = nonEmptyStr; + description = "An ipset."; + }; + }); + description = "Source addresses, address ranges, MAC addresses or ipsets to bind."; + default = [ ]; + }; + icmpBlockInversion = mkOption { + type = bool; + description = '' + Whether to invert the icmp block handling. + Only enabled ICMP types are accepted and all others are rejected in the zone. + ''; + default = false; + }; + forward = mkOption { + type = bool; + description = '' + Whether to enable intra-zone forwarding. + When enabled, packets will be forwarded between interfaces or sources within a zone, even if the zone's target is not set to ACCEPT. + ''; + default = false; + }; + short = mkOption { + type = nullOr nonEmptyStr; + description = "Short description for the zone."; + default = null; + }; + description = mkOption { + type = nullOr nonEmptyStr; + description = "Description for the zone."; + default = null; + }; + services = mkOption { + type = listOf nonEmptyStr; + description = "Services to allow in the zone."; + default = [ ]; + }; + ports = mkOption { + type = listOf (submodule portProtocolOptions); + description = "Ports to allow in the zone."; + default = [ ]; + }; + protocols = mkOption { + type = listOf nonEmptyStr; + description = "Protocols to allow in the zone."; + default = [ ]; + }; + icmpBlocks = mkOption { + type = listOf nonEmptyStr; + description = "ICMP types to block in the zone."; + default = [ ]; + }; + masquerade = mkOption { + type = bool; + description = "Whether to enable masquerading in the zone."; + default = false; + }; + forwardPorts = mkOption { + type = listOf (submodule { + options = { + port = mkPortOption { }; + protocol = protocolOption; + to-port = (mkPortOption { optional = true; }) // { + default = null; + }; + to-addr = mkOption { + type = nullOr nonEmptyStr; + description = "Destination IP address."; + default = null; + }; + }; + }); + description = "Ports to forward in the zone."; + default = [ ]; + }; + sourcePorts = mkOption { + type = listOf (submodule portProtocolOptions); + description = "Source ports to allow in the zone."; + default = [ ]; + }; + rules = mkOption { + type = listOf (format.type); + description = "Rich rules for the zone."; + default = [ ]; + }; + }; + }); + }; + + config = lib.mkIf cfg.enable { + services.firewalld.zones = { + drop = { + target = "DROP"; + forward = true; + }; + block = { + forward = true; + }; + trusted = { + target = "ACCEPT"; + forward = true; + }; + }; + + environment.etc = lib.mapAttrs' ( + name: value: + lib.nameValuePair "firewalld/zones/${name}.xml" { + source = format.generate "firewalld-zone-${name}.xml" { + zone = + let + mkXmlAttrList = name: builtins.map (mkXmlAttr name); + mkXmlTag = value: if value then "" else null; + in + filterNullAttrs ( + lib.mergeAttrsList [ + (toXmlAttrs { inherit (value) version target; }) + (mkXmlAttr "ingress-priority" value.ingressPriority) + (mkXmlAttr "egress-priority" value.egressPriority) + { + interface = mkXmlAttrList "name" value.interfaces; + source = builtins.map toXmlAttrs value.sources; + icmp-block-inversion = mkXmlTag value.icmpBlockInversion; + forward = mkXmlTag value.forward; + inherit (value) short description; + service = mkXmlAttrList "name" value.services; + port = builtins.map toXmlAttrs value.ports; + protocol = mkXmlAttrList "value" value.protocols; + icmp-block = mkXmlAttrList "name" value.icmpBlocks; + masquerade = mkXmlTag value.masquerade; + forward-port = builtins.map toXmlAttrs (builtins.map filterNullAttrs value.forwardPorts); + source-port = builtins.map toXmlAttrs value.sourcePorts; + rule = value.rules; + } + ] + ); + }; + } + ) cfg.zones; + }; +} From 87882c1e3eb9a8d86efb7a12bfcb323491e256ed Mon Sep 17 00:00:00 2001 From: Sizhe Zhao Date: Tue, 15 Apr 2025 13:35:57 +0800 Subject: [PATCH 33/70] nixos/firewall: add firewalld backend --- nixos/modules/module-list.nix | 1 + .../networking/firewall-firewalld.nix | 61 +++++++++++++++++++ .../services/networking/firewall-iptables.nix | 10 +-- .../services/networking/firewall-nftables.nix | 10 +-- .../modules/services/networking/firewall.nix | 38 ++++++++---- nixos/tests/firewall.nix | 39 ++++++------ 6 files changed, 116 insertions(+), 43 deletions(-) create mode 100644 nixos/modules/services/networking/firewall-firewalld.nix diff --git a/nixos/modules/module-list.nix b/nixos/modules/module-list.nix index f706b63b5e3e..d0a4f0b7db12 100644 --- a/nixos/modules/module-list.nix +++ b/nixos/modules/module-list.nix @@ -1162,6 +1162,7 @@ ./services/networking/ferm.nix ./services/networking/firefox-syncserver.nix ./services/networking/fireqos.nix + ./services/networking/firewall-firewalld.nix ./services/networking/firewall-iptables.nix ./services/networking/firewall-nftables.nix ./services/networking/firewall.nix diff --git a/nixos/modules/services/networking/firewall-firewalld.nix b/nixos/modules/services/networking/firewall-firewalld.nix new file mode 100644 index 000000000000..2db34eb1cad1 --- /dev/null +++ b/nixos/modules/services/networking/firewall-firewalld.nix @@ -0,0 +1,61 @@ +{ config, lib, ... }: + +let + cfg = config.networking.firewall; +in +{ + config = lib.mkIf (cfg.enable && cfg.backend == "firewalld") { + assertions = [ + { + assertion = cfg.interfaces == { }; + message = '' + Per interface configurations is not supported with the firewalld based firewall. + Create zones with `services.firewalld.zones` instead. + ''; + } + ]; + + boot.kernel.sysctl."net.ipv4.conf.all.rp_filter" = + if cfg.checkReversePath == false then + 0 + else if cfg.checkReversePath == "loose" then + 1 + else + 2; + + services.firewalld = { + settings = { + DefaultZone = lib.mkDefault "nixos-fw-default"; + LogDenied = + if cfg.logRefusedConnections then + (if cfg.logRefusedUnicastsOnly then "unicast" else "all") + else + "off"; + IPv6_rpfilter = + if cfg.checkReversePath == false then + "no" + else + let + mode = if cfg.checkReversePath == true then "strict" else cfg.checkReversePath; + suffix = if cfg.filterForward then "" else "-forward"; + in + "${mode}${suffix}"; + }; + zones = { + nixos-fw-default = { + target = if cfg.rejectPackets then "%%REJECT%%" else "DROP"; + icmpBlockInversion = true; + icmpBlocks = lib.mkIf cfg.allowPing [ "echo-request" ]; + ports = + let + f = protocol: port: { inherit protocol port; }; + tcpPorts = map (f "tcp") (cfg.allowedTCPPorts ++ cfg.allowedTCPPortRanges); + udpPorts = map (f "udp") (cfg.allowedUDPPorts ++ cfg.allowedUDPPortRanges); + in + tcpPorts ++ udpPorts; + }; + trusted.interfaces = cfg.trustedInterfaces; + }; + }; + }; +} diff --git a/nixos/modules/services/networking/firewall-iptables.nix b/nixos/modules/services/networking/firewall-iptables.nix index 53d7d3434dae..36b4cfc6f9b7 100644 --- a/nixos/modules/services/networking/firewall-iptables.nix +++ b/nixos/modules/services/networking/firewall-iptables.nix @@ -285,9 +285,7 @@ let in { - options = { - networking.firewall = { extraCommands = lib.mkOption { type = lib.types.lines; @@ -317,13 +315,11 @@ in ''; }; }; - }; # FIXME: Maybe if `enable' is false, the firewall should still be # built but not started by default? - config = lib.mkIf (cfg.enable && config.networking.nftables.enable == false) { - + config = lib.mkIf (cfg.enable && cfg.backend == "iptables") { assertions = [ # This is approximately "checkReversePath -> kernelHasRPFilter", # but the checkReversePath option can include non-boolean @@ -336,6 +332,8 @@ in networking.firewall.checkReversePath = lib.mkIf (!kernelHasRPFilter) (lib.mkDefault false); + environment.systemPackages = [ pkgs.nixos-firewall-tool ]; + systemd.services.firewall = { description = "Firewall"; wantedBy = [ "sysinit.target" ]; @@ -365,7 +363,5 @@ in ExecStop = "@${stopScript} firewall-stop"; }; }; - }; - } diff --git a/nixos/modules/services/networking/firewall-nftables.nix b/nixos/modules/services/networking/firewall-nftables.nix index d9695c0e4d27..a22fc29d35ff 100644 --- a/nixos/modules/services/networking/firewall-nftables.nix +++ b/nixos/modules/services/networking/firewall-nftables.nix @@ -19,9 +19,7 @@ let in { - options = { - networking.firewall = { extraInputRules = lib.mkOption { type = lib.types.lines; @@ -59,11 +57,9 @@ in ''; }; }; - }; - config = lib.mkIf (cfg.enable && config.networking.nftables.enable) { - + config = lib.mkIf (cfg.enable && cfg.backend == "nftables") { assertions = [ { assertion = cfg.extraCommands == ""; @@ -83,6 +79,8 @@ in } ]; + environment.systemPackages = [ pkgs.nixos-firewall-tool ]; + networking.nftables.tables."nixos-fw".family = "inet"; networking.nftables.tables."nixos-fw".content = '' set temp-ports { @@ -203,7 +201,5 @@ in } ''} ''; - }; - } diff --git a/nixos/modules/services/networking/firewall.nix b/nixos/modules/services/networking/firewall.nix index e733e9e6b87b..95308c2a9cfc 100644 --- a/nixos/modules/services/networking/firewall.nix +++ b/nixos/modules/services/networking/firewall.nix @@ -68,9 +68,7 @@ let in { - options = { - networking.firewall = { enable = lib.mkOption { type = lib.types.bool; @@ -82,6 +80,32 @@ in ''; }; + backend = lib.mkOption { + type = lib.types.enum [ + "iptables" + "nftables" + "firewalld" + ]; + default = + if config.services.firewalld.enable then + "firewalld" + else if config.networking.nftables.enable then + "nftables" + else + "iptables"; + defaultText = lib.literalExpression '' + if config.services.firewalld.enable then + "firewalld" + else if config.networking.nftables.enable then + "nftables" + else + "iptables" + ''; + description = '' + Underlying implementation for the firewall service. + ''; + }; + package = lib.mkOption { type = lib.types.package; default = if config.networking.nftables.enable then pkgs.nftables else pkgs.iptables; @@ -292,11 +316,9 @@ in }; } // commonOptions; - }; config = lib.mkIf cfg.enable { - assertions = [ { assertion = cfg.filterForward -> config.networking.nftables.enable; @@ -311,11 +333,7 @@ in networking.firewall.trustedInterfaces = [ "lo" ]; - environment.systemPackages = [ - cfg.package - pkgs.nixos-firewall-tool - ] - ++ cfg.extraPackages; + environment.systemPackages = [ cfg.package ] ++ cfg.extraPackages; boot.kernelModules = (lib.optional cfg.autoLoadConntrackHelpers "nf_conntrack") @@ -323,7 +341,5 @@ in boot.extraModprobeConfig = lib.optionalString cfg.autoLoadConntrackHelpers '' options nf_conntrack nf_conntrack_helper=1 ''; - }; - } diff --git a/nixos/tests/firewall.nix b/nixos/tests/firewall.nix index 019508adb0b2..2adf54f007ad 100644 --- a/nixos/tests/firewall.nix +++ b/nixos/tests/firewall.nix @@ -12,10 +12,11 @@ nodes = { walled = - { ... }: + { lib, ... }: { networking.firewall = { enable = true; + inherit backend; logRefusedPackets = true; # Syntax smoke test, not actually verified otherwise allowedTCPPorts = [ @@ -37,23 +38,25 @@ to = 8010; } ]; - interfaces.eth0 = { - allowedTCPPorts = [ 10003 ]; - allowedTCPPortRanges = [ - { - from = 10000; - to = 10005; - } - ]; - }; - interfaces.eth3 = { - allowedUDPPorts = [ 10003 ]; - allowedUDPPortRanges = [ - { - from = 10000; - to = 10005; - } - ]; + interfaces = lib.mkIf (backend != "firewalld") { + eth0 = { + allowedTCPPorts = [ 10003 ]; + allowedTCPPortRanges = [ + { + from = 10000; + to = 10005; + } + ]; + }; + eth3 = { + allowedUDPPorts = [ 10003 ]; + allowedUDPPortRanges = [ + { + from = 10000; + to = 10005; + } + ]; + }; }; }; networking.nftables.enable = nftables; From 3a7a4fb4501fffe6a7f55caadb2fd191c5045fbc Mon Sep 17 00:00:00 2001 From: Sizhe Zhao Date: Sat, 20 Sep 2025 14:07:36 +0800 Subject: [PATCH 34/70] nixos/podman: don't open ports for firewalld --- nixos/modules/virtualisation/podman/default.nix | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/nixos/modules/virtualisation/podman/default.nix b/nixos/modules/virtualisation/podman/default.nix index 8145c099eead..5f01142b4a13 100644 --- a/nixos/modules/virtualisation/podman/default.nix +++ b/nixos/modules/virtualisation/podman/default.nix @@ -249,7 +249,9 @@ in }; # containers cannot reach aardvark-dns otherwise - networking.firewall.interfaces.${network_interface}.allowedUDPPorts = lib.mkIf dns_enabled [ 53 ]; + networking.firewall = lib.mkIf (config.networking.firewall.backend != "firewalld") { + interfaces.${network_interface}.allowedUDPPorts = lib.mkIf dns_enabled [ 53 ]; + }; virtualisation.containers = { enable = true; # Enable common /etc/containers configuration From 3160f3b9d7df55983105b809835dbd4edf9a9ef5 Mon Sep 17 00:00:00 2001 From: Sizhe Zhao Date: Sat, 20 Sep 2025 14:31:50 +0800 Subject: [PATCH 35/70] nixos/netbird: use firewalld zone --- nixos/modules/services/networking/netbird.nix | 36 +++++++++++++------ 1 file changed, 26 insertions(+), 10 deletions(-) diff --git a/nixos/modules/services/networking/netbird.nix b/nixos/modules/services/networking/netbird.nix index ba2c1be37c52..c19cf7d88edb 100644 --- a/nixos/modules/services/networking/netbird.nix +++ b/nixos/modules/services/networking/netbird.nix @@ -507,19 +507,35 @@ in ) "loose"; # Ports opened on a specific - interfaces = listToAttrs ( - toClientList (client: { - name = client.interface; - value.allowedUDPPorts = optionals client.openInternalFirewall [ - # note: those should be opened up by NetBird itself, but it needs additional - # NixOS -specific debugging and tweaking before it works - 5353 # <0.59.0 DNS forwarder port, kept for compatibility with those clients - 22054 # >=0.59.0 DNS forwarder port - ]; - }) + interfaces = lib.mkIf (config.networking.firewall.backend != "firewalld") ( + listToAttrs ( + toClientList (client: { + name = client.interface; + value.allowedUDPPorts = optionals client.openInternalFirewall [ + # note: those should be opened up by NetBird itself, but it needs additional + # NixOS -specific debugging and tweaking before it works + 5353 # <0.59.0 DNS forwarder port, kept for compatibility with those clients + 22054 # >=0.59.0 DNS forwarder port + ]; + }) + ) ); }; + services.firewalld.zones.netbird = { + interfaces = lib.pipe cfg.clients [ + (lib.filterAttrs (_: client: client.openFirewall)) + lib.attrValues + (map (client: client.interface)) + ]; + ports = [ + { + protocol = "udp"; + port = 5353; + } + ]; + }; + systemd.network.networks = mkIf config.networking.useNetworkd ( toClientAttrs ( client: From 2051b59942b5d5f6cf5413db19309f8ae0b77926 Mon Sep 17 00:00:00 2001 From: Sizhe Zhao Date: Tue, 15 Apr 2025 14:02:38 +0800 Subject: [PATCH 36/70] nixos/tests/firewall: add firewalld backend --- nixos/tests/all-tests.nix | 8 ++++++-- nixos/tests/firewall.nix | 20 ++++++++++++++------ pkgs/by-name/fi/firewalld/package.nix | 5 +++++ 3 files changed, 25 insertions(+), 8 deletions(-) diff --git a/nixos/tests/all-tests.nix b/nixos/tests/all-tests.nix index 0b4b244b263b..c6bd23538dee 100644 --- a/nixos/tests/all-tests.nix +++ b/nixos/tests/all-tests.nix @@ -569,11 +569,15 @@ in firejail = runTest ./firejail.nix; firewall = runTest { imports = [ ./firewall.nix ]; - _module.args.nftables = false; + _module.args.backend = "iptables"; + }; + firewall-firewalld = runTest { + imports = [ ./firewall.nix ]; + _module.args.backend = "firewalld"; }; firewall-nftables = runTest { imports = [ ./firewall.nix ]; - _module.args.nftables = true; + _module.args.backend = "nftables"; }; firezone = runTest ./firezone/firezone.nix; fish = runTest ./fish.nix; diff --git a/nixos/tests/firewall.nix b/nixos/tests/firewall.nix index 2adf54f007ad..31db36ef8dc1 100644 --- a/nixos/tests/firewall.nix +++ b/nixos/tests/firewall.nix @@ -1,10 +1,11 @@ # Test the firewall module. -{ lib, nftables, ... }: +{ lib, backend, ... }: { - name = "firewall" + lib.optionalString nftables "-nftables"; + name = "firewall-${backend}"; meta = with lib.maintainers; { maintainers = [ + prince213 rvfg garyguo ]; @@ -59,7 +60,8 @@ }; }; }; - networking.nftables.enable = nftables; + services.firewalld.enable = backend == "firewalld"; + networking.nftables.enable = backend != "iptables"; services.httpd.enable = true; services.httpd.adminAddr = "foo@example.org"; @@ -80,7 +82,13 @@ testScript = { nodes, ... }: let - unit = if nftables then "nftables" else "firewall"; + unit = if backend == "iptables" then "firewall" else backend; + openPort = + if backend == "firewalld" then + "firewall-cmd --add-port=80/tcp" + else + "nixos-firewall-tool open tcp 80"; + reset = if backend == "firewalld" then "firewall-cmd --reload" else "nixos-firewall-tool reset"; in '' start_all() @@ -101,11 +109,11 @@ walled.succeed("ping -c 1 attacker >&2") # Open tcp port 80 at runtime - walled.succeed("nixos-firewall-tool open tcp 80") + walled.succeed("${openPort}") attacker.succeed("curl -v http://walled/ >&2") # Reset the firewall - walled.succeed("nixos-firewall-tool reset") + walled.succeed("${reset}") attacker.fail("curl --fail --connect-timeout 2 http://walled/ >&2") # If we stop the firewall, then connections should succeed. diff --git a/pkgs/by-name/fi/firewalld/package.nix b/pkgs/by-name/fi/firewalld/package.nix index fbab1684c4e8..2a009be7de0b 100644 --- a/pkgs/by-name/fi/firewalld/package.nix +++ b/pkgs/by-name/fi/firewalld/package.nix @@ -26,6 +26,7 @@ sysctl, wrapGAppsNoGuiHook, withGui ? false, + nixosTests, }: let @@ -153,6 +154,10 @@ stdenv.mkDerivation rec { wrapPythonProgramsIn "$out/bin" "$out ${pythonPath}" ''; + passthru.tests = { + firewall-firewalld = nixosTests.firewall-firewalld; + }; + meta = { description = "Firewall daemon with D-Bus interface"; homepage = "https://firewalld.org"; From 9ca60dbb793c338c30501f2c4c13291929ff524e Mon Sep 17 00:00:00 2001 From: Sizhe Zhao Date: Tue, 15 Apr 2025 16:40:15 +0800 Subject: [PATCH 37/70] nixos/tests/firewalld: init --- nixos/tests/all-tests.nix | 1 + nixos/tests/firewalld.nix | 52 +++++++++++++++++++++++++++ pkgs/by-name/fi/firewalld/package.nix | 1 + 3 files changed, 54 insertions(+) create mode 100644 nixos/tests/firewalld.nix diff --git a/nixos/tests/all-tests.nix b/nixos/tests/all-tests.nix index c6bd23538dee..40f6d0afbf65 100644 --- a/nixos/tests/all-tests.nix +++ b/nixos/tests/all-tests.nix @@ -579,6 +579,7 @@ in imports = [ ./firewall.nix ]; _module.args.backend = "nftables"; }; + firewalld = runTest ./firewalld.nix; firezone = runTest ./firezone/firezone.nix; fish = runTest ./fish.nix; flannel = runTestOn [ "x86_64-linux" ] ./flannel.nix; diff --git a/nixos/tests/firewalld.nix b/nixos/tests/firewalld.nix new file mode 100644 index 000000000000..a191fe806354 --- /dev/null +++ b/nixos/tests/firewalld.nix @@ -0,0 +1,52 @@ +{ lib, pkgs, ... }: +{ + name = "firewalld"; + meta.maintainers = with pkgs.lib.maintainers; [ + prince213 + ]; + + nodes = { + walled = { + networking.nftables.enable = true; + services.firewalld.enable = true; + services.httpd.enable = true; + services.httpd.adminAddr = "foo@example.org"; + }; + + open = { + networking.nftables.enable = true; + services.firewalld = { + enable = true; + settings.DefaultZone = "trusted"; + }; + services.httpd.enable = true; + services.httpd.adminAddr = "foo@example.org"; + }; + }; + + testScript = '' + start_all() + + walled.wait_for_unit("firewalld") + walled.wait_for_unit("httpd") + + open.wait_for_unit("network.target") + + with subtest("walled local httpd works"): + walled.succeed("curl -v http://localhost/ >&2") + + with subtest("incoming connections are blocked"): + open.fail("curl --fail --connect-timeout 2 http://walled/ >&2") + + with subtest("outgoing connections are allowed"): + walled.succeed("curl -v http://open/ >&2") + + with subtest("runtime configuration can be changed"): + walled.succeed("firewall-cmd --add-service=http") + open.succeed("curl -v http://walled/ >&2") + + with subtest("runtime configuration are not permanent"): + walled.succeed("firewall-cmd --complete-reload") + open.fail("curl --fail --connect-timeout 2 http://walled/ >&2") + ''; +} diff --git a/pkgs/by-name/fi/firewalld/package.nix b/pkgs/by-name/fi/firewalld/package.nix index 2a009be7de0b..9b0abeb7cbfd 100644 --- a/pkgs/by-name/fi/firewalld/package.nix +++ b/pkgs/by-name/fi/firewalld/package.nix @@ -155,6 +155,7 @@ stdenv.mkDerivation rec { ''; passthru.tests = { + firewalld = nixosTests.firewalld; firewall-firewalld = nixosTests.firewall-firewalld; }; From bd3e75bf784bf4e36c527aad102864c228858bf6 Mon Sep 17 00:00:00 2001 From: Sizhe Zhao Date: Mon, 14 Apr 2025 21:45:56 +0800 Subject: [PATCH 38/70] nixos/kodi: add firewalld files --- nixos/modules/services/x11/desktop-managers/kodi.nix | 2 ++ 1 file changed, 2 insertions(+) diff --git a/nixos/modules/services/x11/desktop-managers/kodi.nix b/nixos/modules/services/x11/desktop-managers/kodi.nix index 0dd2f8ffb829..01252e47b37e 100644 --- a/nixos/modules/services/x11/desktop-managers/kodi.nix +++ b/nixos/modules/services/x11/desktop-managers/kodi.nix @@ -38,5 +38,7 @@ in ]; environment.systemPackages = [ cfg.package ]; + + services.firewalld.packages = [ cfg.package ]; }; } From 1f6f0211e6fdd5af4cee3e03676fa7fe3e245e67 Mon Sep 17 00:00:00 2001 From: Sizhe Zhao Date: Mon, 14 Apr 2025 21:44:34 +0800 Subject: [PATCH 39/70] nixos/libvirtd: add firewalld files --- nixos/modules/virtualisation/libvirtd.nix | 2 ++ 1 file changed, 2 insertions(+) diff --git a/nixos/modules/virtualisation/libvirtd.nix b/nixos/modules/virtualisation/libvirtd.nix index b4a5e1cebc49..e7b02ee88b00 100644 --- a/nixos/modules/virtualisation/libvirtd.nix +++ b/nixos/modules/virtualisation/libvirtd.nix @@ -447,6 +447,8 @@ in Include ${cfg.package}/etc/ssh/ssh_config.d/30-libvirt-ssh-proxy.conf ''; + services.firewalld.packages = [ cfg.package ]; + systemd.packages = [ cfg.package ]; systemd.services.libvirtd-config = { From 14105a5e862d238522c17b14752e484edd61ea87 Mon Sep 17 00:00:00 2001 From: Sizhe Zhao Date: Mon, 14 Apr 2025 21:42:45 +0800 Subject: [PATCH 40/70] nixos/wivrn: add firewalld files --- nixos/modules/services/video/wivrn.nix | 2 ++ 1 file changed, 2 insertions(+) diff --git a/nixos/modules/services/video/wivrn.nix b/nixos/modules/services/video/wivrn.nix index 9c7250fb7d08..5508a51137c3 100644 --- a/nixos/modules/services/video/wivrn.nix +++ b/nixos/modules/services/video/wivrn.nix @@ -231,6 +231,8 @@ in allowedUDPPorts = [ 9757 ]; }; + services.firewalld.packages = [ cfg.package ]; + environment = { systemPackages = [ cfg.package From 6f2b5946c931992c846584969e0d1cf6b768934f Mon Sep 17 00:00:00 2001 From: Sizhe Zhao Date: Tue, 8 Jul 2025 11:31:08 +0800 Subject: [PATCH 41/70] nixos/doc/rl-25.11: add firewalld --- nixos/doc/manual/release-notes/rl-2511.section.md | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/nixos/doc/manual/release-notes/rl-2511.section.md b/nixos/doc/manual/release-notes/rl-2511.section.md index e8d8392a45e3..142679661d68 100644 --- a/nixos/doc/manual/release-notes/rl-2511.section.md +++ b/nixos/doc/manual/release-notes/rl-2511.section.md @@ -32,6 +32,10 @@ Refer to the [GNOME release notes](https://release.gnome.org/49/) for more details. +- FirewallD support has been added. It can be configured both as a standalone service (through `services.firewalld`), and as a backend to the existing `networking.firewall` options. + +- `networking.firewall` now has a `backend` option for choosing which backend to use. + ## New Modules {#sec-release-25.11-new-modules} @@ -53,6 +57,8 @@ - [umami](https://github.com/umami-software/umami), a simple, fast, privacy-focused alternative to Google Analytics. Available with [services.umami](#opt-services.umami.enable). +- [FirewallD](https://firewalld.org/), a firewall daemon with D-Bus interface providing a dynamic firewall. Available as [services.firewalld](#opt-services.firewalld.enable) and a [networking.firewall.backend](#opt-networking.firewall.backend). + - [FileBrowser](https://filebrowser.org/), a web application for managing and sharing files. Available as [services.filebrowser](#opt-services.filebrowser.enable). - Options under [networking.getaddrinfo](#opt-networking.getaddrinfo.enable) are now allowed to declaratively configure address selection and sorting behavior of `getaddrinfo` in dual-stack networks. From daf7c59977963a638031d17e0ca4323bdc7277c5 Mon Sep 17 00:00:00 2001 From: "R. Ryantm" Date: Thu, 20 Nov 2025 05:15:04 +0000 Subject: [PATCH 42/70] terraform-providers.spacelift-io_spacelift: 1.37.0 -> 1.38.0 --- .../networking/cluster/terraform-providers/providers.json | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/applications/networking/cluster/terraform-providers/providers.json b/pkgs/applications/networking/cluster/terraform-providers/providers.json index dc0e4971be21..6a0dee3059cc 100644 --- a/pkgs/applications/networking/cluster/terraform-providers/providers.json +++ b/pkgs/applications/networking/cluster/terraform-providers/providers.json @@ -1228,11 +1228,11 @@ "vendorHash": "sha256-skswuFKhN4FFpIunbom9rM/FVRJVOFb1WwHeAIaEjn8=" }, "spacelift-io_spacelift": { - "hash": "sha256-d26HPdufp8HgZSMA/wkEMtwXUOXSRgFd7+wqRc3V0OI=", + "hash": "sha256-aOpS9KJm31Rz3LnSLAAxV9A5XLuJxGzIWkv9JuEG3H8=", "homepage": "https://registry.terraform.io/providers/spacelift-io/spacelift", "owner": "spacelift-io", "repo": "terraform-provider-spacelift", - "rev": "v1.37.0", + "rev": "v1.38.0", "spdx": "MIT", "vendorHash": "sha256-cX5K221Jnq701Nb+2bC1LmXVL7YvkZ8dkc2wYjDNOSw=" }, From 51dbb4a96ce6dd610d092724c1a569c85c68c3a9 Mon Sep 17 00:00:00 2001 From: "R. Ryantm" Date: Thu, 20 Nov 2025 06:50:45 +0000 Subject: [PATCH 43/70] kimai: 2.42.0 -> 2.43.0 --- pkgs/by-name/ki/kimai/package.nix | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/pkgs/by-name/ki/kimai/package.nix b/pkgs/by-name/ki/kimai/package.nix index b668aed83bb5..9e09d9948f00 100644 --- a/pkgs/by-name/ki/kimai/package.nix +++ b/pkgs/by-name/ki/kimai/package.nix @@ -7,13 +7,13 @@ php.buildComposerProject2 (finalAttrs: { pname = "kimai"; - version = "2.42.0"; + version = "2.43.0"; src = fetchFromGitHub { owner = "kimai"; repo = "kimai"; tag = finalAttrs.version; - hash = "sha256-5CPNUneOHbKxI/7/ARRt2hDKGmpvtmJwBAWdblCNmCQ="; + hash = "sha256-gleeUCV9Id0GINFfpdYrS8A0yFv8VNCbApv9lsqb6SA="; }; php = php.buildEnv { @@ -38,7 +38,7 @@ php.buildComposerProject2 (finalAttrs: { ''; }; - vendorHash = "sha256-z0bSqSCSPF61x+zCbIVxRJ4SsxWaqL5yrK6+E8cxgiI="; + vendorHash = "sha256-vXkR8UV7CHUfKtfC/onmde0VIqu6HxxoTOKgLrP3Cik="; composerNoPlugins = false; From e7321dd72ab4729e830e9a061aa0610065ad3c80 Mon Sep 17 00:00:00 2001 From: "R. Ryantm" Date: Thu, 20 Nov 2025 08:11:03 +0000 Subject: [PATCH 44/70] python3Packages.rns: 1.0.2 -> 1.0.3 --- pkgs/development/python-modules/rns/default.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/development/python-modules/rns/default.nix b/pkgs/development/python-modules/rns/default.nix index 08d7b9d6d394..6cb2b200cf47 100644 --- a/pkgs/development/python-modules/rns/default.nix +++ b/pkgs/development/python-modules/rns/default.nix @@ -14,14 +14,14 @@ buildPythonPackage rec { pname = "rns"; - version = "1.0.2"; + version = "1.0.3"; pyproject = true; src = fetchFromGitHub { owner = "markqvist"; repo = "Reticulum"; tag = version; - hash = "sha256-c2k+jEiDwtauM+2x8HNqLZIUv4d53hVngS6LbIIs+k4="; + hash = "sha256-Tvn51iODNES35VRDR7/Ev/8El5XDe1nObujrjhcvrM8="; }; patches = [ From b900ff4d2907de975b900801546051fd2851f886 Mon Sep 17 00:00:00 2001 From: "R. Ryantm" Date: Thu, 20 Nov 2025 08:11:48 +0000 Subject: [PATCH 45/70] bookstack: 25.11.1 -> 25.11.2 --- pkgs/by-name/bo/bookstack/package.nix | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/pkgs/by-name/bo/bookstack/package.nix b/pkgs/by-name/bo/bookstack/package.nix index 9350af25b54e..2c0031122167 100644 --- a/pkgs/by-name/bo/bookstack/package.nix +++ b/pkgs/by-name/bo/bookstack/package.nix @@ -8,16 +8,16 @@ php83.buildComposerProject2 (finalAttrs: { pname = "bookstack"; - version = "25.11.1"; + version = "25.11.2"; src = fetchFromGitHub { owner = "bookstackapp"; repo = "bookstack"; tag = "v${finalAttrs.version}"; - hash = "sha256-qRJBBas54x/IoLs97/SBQW1FvhI/HYXQ9etQ+2LUse8="; + hash = "sha256-HHNiGnMVUtFWn2rexmbtbbKWtLs+og70sWYVtgw9Mas="; }; - vendorHash = "sha256-cIkfYc078NMP7QAGuoC4f77SaVPEnQ3H4zqIU4P3wd8="; + vendorHash = "sha256-sqoUGv4+WMblJAW2iJ80v89+dkvAlaNiDaTSCWcavy8="; passthru = { phpPackage = php83; From b6b82245e903672dc4728e157ef39e0f6ad4a7f7 Mon Sep 17 00:00:00 2001 From: Doron Behar Date: Thu, 20 Nov 2025 10:20:05 +0200 Subject: [PATCH 46/70] python312Packages.svgdigitizer: remove unused stdenv argument --- pkgs/development/python-modules/svgdigitizer/default.nix | 1 - 1 file changed, 1 deletion(-) diff --git a/pkgs/development/python-modules/svgdigitizer/default.nix b/pkgs/development/python-modules/svgdigitizer/default.nix index aaac0e457a36..4e2441c48e68 100644 --- a/pkgs/development/python-modules/svgdigitizer/default.nix +++ b/pkgs/development/python-modules/svgdigitizer/default.nix @@ -2,7 +2,6 @@ lib, buildPythonPackage, fetchFromGitHub, - stdenv, # build-system setuptools, From f6c7397981a8dc2080017264684b719a8c8ceff9 Mon Sep 17 00:00:00 2001 From: "R. Ryantm" Date: Thu, 20 Nov 2025 09:01:30 +0000 Subject: [PATCH 47/70] python3Packages.lxmf: 0.9.2 -> 0.9.3 --- pkgs/development/python-modules/lxmf/default.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/development/python-modules/lxmf/default.nix b/pkgs/development/python-modules/lxmf/default.nix index 555c4b605a8f..0d5395388d7e 100644 --- a/pkgs/development/python-modules/lxmf/default.nix +++ b/pkgs/development/python-modules/lxmf/default.nix @@ -9,7 +9,7 @@ buildPythonPackage rec { pname = "lxmf"; - version = "0.9.2"; + version = "0.9.3"; pyproject = true; disabled = pythonOlder "3.7"; @@ -18,7 +18,7 @@ buildPythonPackage rec { owner = "markqvist"; repo = "lxmf"; tag = version; - hash = "sha256-9xmg0ofp/0Cy8+et80qWNFIRyiF3vTmdzACLIO+t27U="; + hash = "sha256-bPRoKJGMy+JAyhKcRXKR3Jra5K1UAjRMg0lMt2lOvzA="; }; build-system = [ setuptools ]; From 5a8b4eac6c7aa99480a3022620fb9bfcb56a724b Mon Sep 17 00:00:00 2001 From: "R. Ryantm" Date: Thu, 20 Nov 2025 09:25:19 +0000 Subject: [PATCH 48/70] mocha: 11.7.4 -> 11.7.5 --- pkgs/by-name/mo/mocha/package.nix | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/pkgs/by-name/mo/mocha/package.nix b/pkgs/by-name/mo/mocha/package.nix index 8b358c766a57..fbfeebd78808 100644 --- a/pkgs/by-name/mo/mocha/package.nix +++ b/pkgs/by-name/mo/mocha/package.nix @@ -6,16 +6,16 @@ buildNpmPackage (finalAttrs: { pname = "mocha"; - version = "11.7.4"; + version = "11.7.5"; src = fetchFromGitHub { owner = "mochajs"; repo = "mocha"; tag = "v${finalAttrs.version}"; - hash = "sha256-mRXdAPKDNnQzr8oz6NrTeUFgT7aBbsTl4TxFvjcVqCs="; + hash = "sha256-Bk/yF3z/DZ4h9mj1a/EG5ofC6/CIpLd81iQ1w7XkZ0A="; }; - npmDepsHash = "sha256-NTJ27KucQcrnpPVtEX3zr6qQZjaLzNHPhgJefntE8hg="; + npmDepsHash = "sha256-dcq6P4BB6w7GGMzW2GfF8AzDnqPV/BS5nz+dxVjnc3o="; postInstall = '' # Installed only for backwards compat, but should just be removed. From 87911efdc4ae78b9057b550709ada7ceb2c3b640 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= Date: Wed, 19 Nov 2025 17:44:45 -0800 Subject: [PATCH 49/70] python3Packages.svgdigitizer: 0.13.0 -> 0.14.1 Diff: https://github.com/echemdb/svgdigitizer/compare/0.13.0...0.14.1 Changelog: https://github.com/echemdb/svgdigitizer/blob/0.14.1/ChangeLog --- pkgs/development/python-modules/svgdigitizer/default.nix | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) diff --git a/pkgs/development/python-modules/svgdigitizer/default.nix b/pkgs/development/python-modules/svgdigitizer/default.nix index 4e2441c48e68..1c12a5f258be 100644 --- a/pkgs/development/python-modules/svgdigitizer/default.nix +++ b/pkgs/development/python-modules/svgdigitizer/default.nix @@ -28,14 +28,14 @@ buildPythonPackage rec { pname = "svgdigitizer"; - version = "0.13.0"; + version = "0.14.1"; pyproject = true; src = fetchFromGitHub { owner = "echemdb"; repo = "svgdigitizer"; tag = version; - hash = "sha256-UlcvCfNoEijIKoqSbufEZ6988rqwT2xDEy4P/9fdgVM="; + hash = "sha256-ZOR9CviQhPyJQjbLpR53ZVwaarrICg87vtzCL1nq+jE="; }; build-system = [ @@ -69,6 +69,11 @@ buildPythonPackage rec { "svgdigitizer" ]; + disabledTests = [ + # test tries to connect to doi.org + "svgdigitizer.pdf.Pdf.bibliographic_entry" + ]; + pythonImportsCheck = [ "svgdigitizer" ]; From c5c04d1a5f80dbbdee787f066852ba9cd30c53e3 Mon Sep 17 00:00:00 2001 From: "R. Ryantm" Date: Thu, 20 Nov 2025 10:21:58 +0000 Subject: [PATCH 50/70] python3Packages.yara-x: 1.9.0 -> 1.10.0 --- pkgs/development/python-modules/yara-x/default.nix | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/pkgs/development/python-modules/yara-x/default.nix b/pkgs/development/python-modules/yara-x/default.nix index dccaaea60ea1..01c4e15df120 100644 --- a/pkgs/development/python-modules/yara-x/default.nix +++ b/pkgs/development/python-modules/yara-x/default.nix @@ -9,21 +9,21 @@ buildPythonPackage rec { pname = "yara-x"; - version = "1.9.0"; + version = "1.10.0"; pyproject = true; src = fetchFromGitHub { owner = "VirusTotal"; repo = "yara-x"; tag = "v${version}"; - hash = "sha256-yoQoAtgXBgniNebU9HMxF1m0UHFD6iU095he9tCNNIo="; + hash = "sha256-aRFDutYFD476xq2TTVWB5CxF1pi3C24NJpfc5kD+aNA="; }; buildAndTestSubdir = "py"; cargoDeps = rustPlatform.fetchCargoVendor { inherit pname src version; - hash = "sha256-/HMyNofKpeYaFfRcZ1LAb3vfW/TQy+DsILXRCpJFlCQ="; + hash = "sha256-CT+walpFIFTaO480ATHO1E38K9Tw14QqLRYzztWQmeA="; }; nativeBuildInputs = [ From d1abdedd7808b60fe6b55ee229609f9a1fee1945 Mon Sep 17 00:00:00 2001 From: "R. Ryantm" Date: Thu, 20 Nov 2025 10:26:56 +0000 Subject: [PATCH 51/70] vscode-extensions.uiua-lang.uiua-vscode: 0.0.66 -> 0.0.67 --- pkgs/applications/editors/vscode/extensions/default.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/applications/editors/vscode/extensions/default.nix b/pkgs/applications/editors/vscode/extensions/default.nix index c5a72472c9eb..41ba5c1b9e08 100644 --- a/pkgs/applications/editors/vscode/extensions/default.nix +++ b/pkgs/applications/editors/vscode/extensions/default.nix @@ -4815,8 +4815,8 @@ let mktplcRef = { name = "uiua-vscode"; publisher = "uiua-lang"; - version = "0.0.66"; - hash = "sha256-eFdRzkoYJeQdpebKcSFhhnZZXFcA3oKURvqjBx5hReQ="; + version = "0.0.67"; + hash = "sha256-Q/wJZ+ObCU+hRpZZKQGQtdt99/I6QHkSuHlNy7oe5Pk="; }; meta = { description = "VSCode language extension for Uiua"; From 6138d9847c101bc36b83514ba330d7fb0535c9f9 Mon Sep 17 00:00:00 2001 From: ryota2357 Date: Thu, 20 Nov 2025 19:41:09 +0900 Subject: [PATCH 52/70] cargo-all-features: fix build error --- pkgs/by-name/ca/cargo-all-features/package.nix | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/pkgs/by-name/ca/cargo-all-features/package.nix b/pkgs/by-name/ca/cargo-all-features/package.nix index fd8ecb5d28d4..3c21481999e4 100644 --- a/pkgs/by-name/ca/cargo-all-features/package.nix +++ b/pkgs/by-name/ca/cargo-all-features/package.nix @@ -13,6 +13,11 @@ rustPlatform.buildRustPackage rec { hash = "sha256-pHwQq6/KGCIYm3Q63YbUit6yUjwEFnpBJCE6lpGBcZc="; }; + postPatch = '' + substituteInPlace tests/settings.rs \ + --replace-fail 'cmd.env("RUSTFLAGS", "-Cinstrument-coverage");' ''' + ''; + cargoHash = "sha256-tAwU7vJLp4KLzYAEbtSpNKbZBz+hBdAiIkUD/A5CpwI="; meta = with lib; { From 21130c19f96e2ec8925b2345c9fb296cbf04c25e Mon Sep 17 00:00:00 2001 From: "R. Ryantm" Date: Thu, 20 Nov 2025 11:07:24 +0000 Subject: [PATCH 53/70] python3Packages.lacuscore: 1.19.3 -> 1.20.1 --- pkgs/development/python-modules/lacuscore/default.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/development/python-modules/lacuscore/default.nix b/pkgs/development/python-modules/lacuscore/default.nix index e4017d2c7899..14924e955cb1 100644 --- a/pkgs/development/python-modules/lacuscore/default.nix +++ b/pkgs/development/python-modules/lacuscore/default.nix @@ -18,14 +18,14 @@ buildPythonPackage rec { pname = "lacuscore"; - version = "1.19.3"; + version = "1.20.1"; pyproject = true; src = fetchFromGitHub { owner = "ail-project"; repo = "LacusCore"; tag = "v${version}"; - hash = "sha256-mm9oInWx7xZ+39kNOt77TLjCCf60Tmisefh71+2ZIMw="; + hash = "sha256-L7hmqNymXkZD/NQk1OQ9H34aJcCa6W23gkQSjomv7Iw="; }; pythonRelaxDeps = [ From cf42dbac1f5b4104fac6da9854ebf7555e22e4fe Mon Sep 17 00:00:00 2001 From: "R. Ryantm" Date: Thu, 20 Nov 2025 11:07:54 +0000 Subject: [PATCH 54/70] fabric-ai: 1.4.323 -> 1.4.328 --- pkgs/by-name/fa/fabric-ai/package.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/by-name/fa/fabric-ai/package.nix b/pkgs/by-name/fa/fabric-ai/package.nix index 30b34799a7c4..4c75df83538e 100644 --- a/pkgs/by-name/fa/fabric-ai/package.nix +++ b/pkgs/by-name/fa/fabric-ai/package.nix @@ -7,13 +7,13 @@ buildGoModule rec { pname = "fabric-ai"; - version = "1.4.323"; + version = "1.4.328"; src = fetchFromGitHub { owner = "danielmiessler"; repo = "fabric"; tag = "v${version}"; - hash = "sha256-1l0O6o6bFqfFjEAwgU8KM5K1Bx0BC654lSY+SmGUNu4="; + hash = "sha256-s7XZDYD8y36zUw5StJnYMNxCkDiub3ubg7/I7AY91mE="; }; vendorHash = "sha256-bOA4vKwiRNRCyDWKCmzwLZlhsZwjSVe194Th6MNlwvM="; From 9c6a77d37a9c970aefa76d9070f5036d5787f8a2 Mon Sep 17 00:00:00 2001 From: "R. Ryantm" Date: Thu, 20 Nov 2025 11:38:37 +0000 Subject: [PATCH 55/70] python3Packages.cantools: 41.0.0 -> 41.0.1 --- pkgs/development/python-modules/cantools/default.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/development/python-modules/cantools/default.nix b/pkgs/development/python-modules/cantools/default.nix index 73da6bd0fbe2..a3a2bf11142d 100644 --- a/pkgs/development/python-modules/cantools/default.nix +++ b/pkgs/development/python-modules/cantools/default.nix @@ -18,12 +18,12 @@ buildPythonPackage rec { pname = "cantools"; - version = "41.0.0"; + version = "41.0.1"; pyproject = true; src = fetchPypi { inherit pname version; - hash = "sha256-gdfvoy1moUmTSyG2kaQPtA254LdPoCwk9PJX9YfRaa4="; + hash = "sha256-WycDUgKJuRFR5fPFT8wBxoijgrqDqjf6RnQxV4Pl8uk="; }; build-system = [ From 0aab329d05ba95098153453da49e964d341e3a08 Mon Sep 17 00:00:00 2001 From: Bobby Rong Date: Thu, 20 Nov 2025 19:54:24 +0800 Subject: [PATCH 56/70] bulky: 3.9 -> 4.0 https://github.com/linuxmint/bulky/compare/3.9...4.0 --- pkgs/by-name/bu/bulky/package.nix | 19 +++++++++++++------ 1 file changed, 13 insertions(+), 6 deletions(-) diff --git a/pkgs/by-name/bu/bulky/package.nix b/pkgs/by-name/bu/bulky/package.nix index f926e9979b78..2592d397beb1 100644 --- a/pkgs/by-name/bu/bulky/package.nix +++ b/pkgs/by-name/bu/bulky/package.nix @@ -10,17 +10,18 @@ gtk3, glib, common-licenses, + xapp-symbolic-icons, }: stdenv.mkDerivation rec { pname = "bulky"; - version = "3.9"; + version = "4.0"; src = fetchFromGitHub { owner = "linuxmint"; repo = "bulky"; tag = version; - hash = "sha256-LrArLx0AOEaeAvLBVhV9ho5H+qeiaBfjs8+iV5W9u+w="; + hash = "sha256-BHMCtvnz3Ua4pa3Pnh2PbxZ9a0vJOJ+Se2/DaPbUqQA="; }; nativeBuildInputs = [ @@ -45,10 +46,10 @@ stdenv.mkDerivation rec { postPatch = '' substituteInPlace usr/lib/bulky/bulky.py \ - --replace "/usr/share/locale" "$out/share/locale" \ - --replace /usr/share/bulky "$out/share/bulky" \ - --replace /usr/share/common-licenses "${common-licenses}/share/common-licenses" \ - --replace __DEB_VERSION__ "${version}" + --replace-fail "/usr/share/locale" "$out/share/locale" \ + --replace-fail /usr/share/bulky "$out/share/bulky" \ + --replace-fail /usr/share/common-licenses "${common-licenses}/share/common-licenses" \ + --replace-fail __DEB_VERSION__ "${version}" ''; installPhase = '' @@ -63,6 +64,12 @@ stdenv.mkDerivation rec { glib-compile-schemas $out/share/glib-2.0/schemas ''; + preFixup = '' + gappsWrapperArgs+=( + --prefix XDG_DATA_DIRS : ${lib.makeSearchPath "share" [ xapp-symbolic-icons ]} + ) + ''; + meta = with lib; { description = "Bulk rename app"; mainProgram = "bulky"; From 484feccb9f07b95b9bd9fb217a8232396d8edce7 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?J=C3=B6rg=20Thalheim?= Date: Thu, 20 Nov 2025 12:40:09 +0100 Subject: [PATCH 57/70] nixos/facter: handle case where we do not have readOnly included --- nixos/modules/hardware/facter/system.nix | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/nixos/modules/hardware/facter/system.nix b/nixos/modules/hardware/facter/system.nix index 32648f7d07e4..2019bfa522d3 100644 --- a/nixos/modules/hardware/facter/system.nix +++ b/nixos/modules/hardware/facter/system.nix @@ -8,7 +8,10 @@ # Skip setting hostPlatform if it's read-only config.nixpkgs = lib.optionalAttrs - (config.hardware.facter.report.system or null != null && !options.nixpkgs.hostPlatform.readOnly) + ( + config.hardware.facter.report.system or null != null + && !(options.nixpkgs.hostPlatform.readOnly or false) + ) { hostPlatform = lib.mkDefault config.hardware.facter.report.system; }; From e7477f70ee00d463206ae55d9b79cdbec51634d6 Mon Sep 17 00:00:00 2001 From: "R. Ryantm" Date: Thu, 20 Nov 2025 00:28:32 +0000 Subject: [PATCH 58/70] gnome-online-accounts-gtk: 3.50.7 -> 3.50.8 https://github.com/xapp-project/gnome-online-accounts-gtk/compare/3.50.7...3.50.8 --- pkgs/by-name/gn/gnome-online-accounts-gtk/package.nix | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-) diff --git a/pkgs/by-name/gn/gnome-online-accounts-gtk/package.nix b/pkgs/by-name/gn/gnome-online-accounts-gtk/package.nix index ef4e232f9b7d..63428397976d 100644 --- a/pkgs/by-name/gn/gnome-online-accounts-gtk/package.nix +++ b/pkgs/by-name/gn/gnome-online-accounts-gtk/package.nix @@ -11,17 +11,18 @@ gnome-online-accounts, gtk4, libadwaita, + xapp-symbolic-icons, }: stdenv.mkDerivation (finalAttrs: { pname = "gnome-online-accounts-gtk"; - version = "3.50.7"; + version = "3.50.8"; src = fetchFromGitHub { owner = "xapp-project"; repo = "gnome-online-accounts-gtk"; rev = finalAttrs.version; - hash = "sha256-CFPaCx3tfOIoovm9AXofBdZzl/Rxiz5RVOrVKCuxZbI="; + hash = "sha256-DcW88Zx8uoxOL+2mV7uBIsnmQEuy02tbAO1ljf0ZigQ="; }; nativeBuildInputs = [ @@ -39,6 +40,12 @@ stdenv.mkDerivation (finalAttrs: { libadwaita # for goa-backend ]; + preFixup = '' + gappsWrapperArgs+=( + --prefix XDG_DATA_DIRS : ${lib.makeSearchPath "share" [ xapp-symbolic-icons ]} + ) + ''; + meta = with lib; { description = "Online accounts configuration utility"; homepage = "https://github.com/xapp-project/gnome-online-accounts-gtk"; From eea7b9adfa0c32751cbe79ce04af8660f8317806 Mon Sep 17 00:00:00 2001 From: Felix Singer Date: Thu, 20 Nov 2025 13:20:19 +0100 Subject: [PATCH 59/70] dediprog-sf100: Add Felix Singer as maintainer Signed-off-by: Felix Singer --- pkgs/by-name/de/dediprog-sf100/package.nix | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/pkgs/by-name/de/dediprog-sf100/package.nix b/pkgs/by-name/de/dediprog-sf100/package.nix index ea9abd8f5be2..300e4ac8b126 100644 --- a/pkgs/by-name/de/dediprog-sf100/package.nix +++ b/pkgs/by-name/de/dediprog-sf100/package.nix @@ -47,6 +47,9 @@ stdenv.mkDerivation (finalAttrs: { description = "Linux software for DediProg SF100/SF600 programmers"; license = lib.licenses.gpl2; platforms = lib.platforms.linux; - maintainers = with lib.maintainers; [ thillux ]; + maintainers = with lib.maintainers; [ + thillux + felixsinger + ]; }; }) From bc41af7fb61b9485bffb9ee6038b9a2c2d5c524f Mon Sep 17 00:00:00 2001 From: Sizhe Zhao Date: Thu, 20 Nov 2025 15:41:57 +0800 Subject: [PATCH 60/70] wechat: 4.1.5.11-31899 -> 4.1.5.17-31953 for darwin --- pkgs/by-name/we/wechat/package.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/by-name/we/wechat/package.nix b/pkgs/by-name/we/wechat/package.nix index d9424500e0d4..828df591d7d9 100644 --- a/pkgs/by-name/we/wechat/package.nix +++ b/pkgs/by-name/we/wechat/package.nix @@ -30,14 +30,14 @@ let # https://dldir1.qq.com/weixin/mac/mac-release.xml any-darwin = let - version = "4.1.5.11-31899"; + version = "4.1.5.17-31953"; version' = lib.replaceString "-" "_" version; in { inherit version; src = fetchurl { url = "https://dldir1v6.qq.com/weixin/Universal/Mac/xWeChatMac_universal_${version'}.dmg"; - hash = "sha256-uBOjBrUH2kTxSMJjycHynCN/FZqxphzp3zkgouiJp+o="; + hash = "sha256-eItxPcvlzxwqXG7IxN001aoR+9SqyVOA7y71Sh83jYI="; }; }; in From 3e1636184be840de964cc021e47fdd95a56ed20e Mon Sep 17 00:00:00 2001 From: "R. Ryantm" Date: Thu, 20 Nov 2025 13:04:24 +0000 Subject: [PATCH 61/70] bottom: 0.11.3 -> 0.11.4 --- pkgs/by-name/bo/bottom/package.nix | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/pkgs/by-name/bo/bottom/package.nix b/pkgs/by-name/bo/bottom/package.nix index 45dd64fb0c90..a524235e2078 100644 --- a/pkgs/by-name/bo/bottom/package.nix +++ b/pkgs/by-name/bo/bottom/package.nix @@ -11,16 +11,16 @@ rustPlatform.buildRustPackage (finalAttrs: { pname = "bottom"; - version = "0.11.3"; + version = "0.11.4"; src = fetchFromGitHub { owner = "ClementTsang"; repo = "bottom"; tag = finalAttrs.version; - hash = "sha256-7rVvKAqK8hqICnSr/Ax9ndsIZAdTaUyOAoVZ13W5BJs="; + hash = "sha256-hyEYSkoV86BWVMjolU9IjU0rTABxE4ag26el0UydsFQ="; }; - cargoHash = "sha256-OXprj84ixm5KFayWsHuxCB3p5Ob/oZgsk3u3lqkOiuk="; + cargoHash = "sha256-VnpSgaBxSHJj+brMtNwmbrXUN9H3y0oinF8ya+vsl88="; nativeBuildInputs = [ autoAddDriverRunpath From b9244ee44af9d20bbf674d731b8e9c51197bbe94 Mon Sep 17 00:00:00 2001 From: Fabian Affolter Date: Thu, 20 Nov 2025 14:08:28 +0100 Subject: [PATCH 62/70] python313Packages.lxmf: remove disabled --- pkgs/development/python-modules/lxmf/default.nix | 3 --- 1 file changed, 3 deletions(-) diff --git a/pkgs/development/python-modules/lxmf/default.nix b/pkgs/development/python-modules/lxmf/default.nix index 0d5395388d7e..b49e18f29e1b 100644 --- a/pkgs/development/python-modules/lxmf/default.nix +++ b/pkgs/development/python-modules/lxmf/default.nix @@ -2,7 +2,6 @@ lib, buildPythonPackage, fetchFromGitHub, - pythonOlder, rns, setuptools, }: @@ -12,8 +11,6 @@ buildPythonPackage rec { version = "0.9.3"; pyproject = true; - disabled = pythonOlder "3.7"; - src = fetchFromGitHub { owner = "markqvist"; repo = "lxmf"; From 4955f7f43f93fa4dd1ba153abc0843493243f76b Mon Sep 17 00:00:00 2001 From: Fabian Affolter Date: Thu, 20 Nov 2025 14:13:53 +0100 Subject: [PATCH 63/70] python313Packages.pytenable: modernize --- pkgs/development/python-modules/pytenable/default.nix | 5 +---- 1 file changed, 1 insertion(+), 4 deletions(-) diff --git a/pkgs/development/python-modules/pytenable/default.nix b/pkgs/development/python-modules/pytenable/default.nix index 8776b245508f..e3d05bc51238 100644 --- a/pkgs/development/python-modules/pytenable/default.nix +++ b/pkgs/development/python-modules/pytenable/default.nix @@ -15,7 +15,6 @@ pytestCheckHook, python-box, python-dateutil, - pythonOlder, requests-pkcs12, requests-toolbelt, requests, @@ -31,8 +30,6 @@ buildPythonPackage rec { version = "1.9.0"; pyproject = true; - disabled = pythonOlder "3.10"; - src = fetchFromGitHub { owner = "tenable"; repo = "pyTenable"; @@ -102,7 +99,7 @@ buildPythonPackage rec { description = "Python library for the Tenable.io and TenableSC API"; homepage = "https://github.com/tenable/pyTenable"; changelog = "https://github.com/tenable/pyTenable/releases/tag/${src.tag}"; - license = with licenses; [ mit ]; + license = licenses.mit; maintainers = with maintainers; [ fab ]; }; } From 0f49cac57dde57081be4d9a5ad86557ff34185ed Mon Sep 17 00:00:00 2001 From: ljxfstorm Date: Thu, 20 Nov 2025 17:30:02 +0800 Subject: [PATCH 64/70] gemini-cli-bin: disable auto-update by default Co-authored-by: aleksana --- pkgs/by-name/ge/gemini-cli-bin/package.nix | 1 + 1 file changed, 1 insertion(+) diff --git a/pkgs/by-name/ge/gemini-cli-bin/package.nix b/pkgs/by-name/ge/gemini-cli-bin/package.nix index 240d1444418f..b87aef708e3f 100644 --- a/pkgs/by-name/ge/gemini-cli-bin/package.nix +++ b/pkgs/by-name/ge/gemini-cli-bin/package.nix @@ -25,6 +25,7 @@ stdenvNoCC.mkDerivation (finalAttrs: { runHook preInstall install -D "$src" "$out/bin/gemini" + sed -i '/disableAutoUpdate: {/,/}/ s/default: false/default: true/' "$out/bin/gemini" runHook postInstall ''; From 5a2f019ca86c94b1e7b7eaef729c1af084479b33 Mon Sep 17 00:00:00 2001 From: ljxfstorm Date: Thu, 20 Nov 2025 21:12:08 +0800 Subject: [PATCH 65/70] gemini-cli-bin: 0.15.4 -> 0.16.0 https://github.com/google-gemini/gemini-cli/releases/tag/v0.16.0 --- pkgs/by-name/ge/gemini-cli-bin/package.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/by-name/ge/gemini-cli-bin/package.nix b/pkgs/by-name/ge/gemini-cli-bin/package.nix index b87aef708e3f..03384973e181 100644 --- a/pkgs/by-name/ge/gemini-cli-bin/package.nix +++ b/pkgs/by-name/ge/gemini-cli-bin/package.nix @@ -8,11 +8,11 @@ }: stdenvNoCC.mkDerivation (finalAttrs: { pname = "gemini-cli-bin"; - version = "0.15.4"; + version = "0.16.0"; src = fetchurl { url = "https://github.com/google-gemini/gemini-cli/releases/download/v${finalAttrs.version}/gemini.js"; - hash = "sha256-X4QXDZYtTY0LO9OiE9F99DBvit79Tsz/4zhfVHPQxSE="; + hash = "sha256-BL+qIQgqqVuOQzCVjS9lnExijM0XDj5v3+RPkbspw9Q="; }; dontUnpack = true; From ca8e113f2b5a3fe3a3e1cb362e30d7e38a1066f1 Mon Sep 17 00:00:00 2001 From: Thierry Delafontaine Date: Thu, 20 Nov 2025 14:45:38 +0100 Subject: [PATCH 66/70] models-dev: refactor package.nix to use let-in for better readability --- pkgs/by-name/mo/models-dev/package.nix | 22 +++++++++++++++------- 1 file changed, 15 insertions(+), 7 deletions(-) diff --git a/pkgs/by-name/mo/models-dev/package.nix b/pkgs/by-name/mo/models-dev/package.nix index 6f3972882dd6..0c76fb13dbc4 100644 --- a/pkgs/by-name/mo/models-dev/package.nix +++ b/pkgs/by-name/mo/models-dev/package.nix @@ -6,19 +6,19 @@ nix-update-script, writableTmpDirAsHomeHook, }: -stdenvNoCC.mkDerivation (finalAttrs: { +let pname = "models-dev"; - version = "0-unstable-2025-11-17"; + version = "0-unstable-2025-11-20"; src = fetchFromGitHub { owner = "sst"; repo = "models.dev"; - rev = "0cb3e3498ba712bd31528926d2efdd26e925267b"; - hash = "sha256-ICMR59DaqriZZmO7260iuyMjuIRJ9AYtWlzVZY0KFXw="; + rev = "5389818cb714afeeca30ceef3c012498bba7f709"; + hash = "sha256-ld/bWHJPGoDO7lyXnmGCzSt1f3A/JA8azJcj0C5HT8E="; }; node_modules = stdenvNoCC.mkDerivation { - pname = "models-dev-node_modules"; - inherit (finalAttrs) version src; + pname = "${pname}-node_modules"; + inherit version src; impureEnvVars = lib.fetchers.proxyImpureEnvVars ++ [ "GIT_PROXY_COMMAND" @@ -69,13 +69,21 @@ stdenvNoCC.mkDerivation (finalAttrs: { outputHashAlgo = "sha256"; outputHashMode = "recursive"; }; +in +stdenvNoCC.mkDerivation (finalAttrs: { + inherit + pname + version + src + node_modules + ; nativeBuildInputs = [ bun ]; configurePhase = '' runHook preConfigure - cp -R ${finalAttrs.node_modules}/. . + cp -R ${node_modules}/. . runHook postConfigure ''; From 4fb7a8dbd5f464948a84fe24b91d6d6e1162e609 Mon Sep 17 00:00:00 2001 From: "R. Ryantm" Date: Thu, 20 Nov 2025 14:16:26 +0000 Subject: [PATCH 67/70] luau-lsp: 1.56.1 -> 1.56.2 --- pkgs/by-name/lu/luau-lsp/package.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/by-name/lu/luau-lsp/package.nix b/pkgs/by-name/lu/luau-lsp/package.nix index 176a8c7532a2..9156dae7f9c8 100644 --- a/pkgs/by-name/lu/luau-lsp/package.nix +++ b/pkgs/by-name/lu/luau-lsp/package.nix @@ -9,13 +9,13 @@ stdenv.mkDerivation (finalAttrs: { pname = "luau-lsp"; - version = "1.56.1"; + version = "1.56.2"; src = fetchFromGitHub { owner = "JohnnyMorganz"; repo = "luau-lsp"; tag = finalAttrs.version; - hash = "sha256-IRBVLLWycc4zkjR82jAEcTlmDgXSLbaAA7ejSIYm41U="; + hash = "sha256-lEv4ZysuYrK86JRoH8M2PesGEo7LI9ybGLIOExPtTZQ="; fetchSubmodules = true; }; From 7e0bb4aff1abdc642d9ae3b7f775b87ff3c1cb2b Mon Sep 17 00:00:00 2001 From: "R. Ryantm" Date: Thu, 20 Nov 2025 15:40:54 +0000 Subject: [PATCH 68/70] cargo-shear: 1.6.2 -> 1.6.3 --- pkgs/by-name/ca/cargo-shear/package.nix | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/pkgs/by-name/ca/cargo-shear/package.nix b/pkgs/by-name/ca/cargo-shear/package.nix index d7fa1f01c8fc..613b3dce7aea 100644 --- a/pkgs/by-name/ca/cargo-shear/package.nix +++ b/pkgs/by-name/ca/cargo-shear/package.nix @@ -8,15 +8,15 @@ rustPlatform.buildRustPackage (finalAttrs: { pname = "cargo-shear"; - version = "1.6.2"; + version = "1.6.3"; src = fetchCrate { pname = "cargo-shear"; version = finalAttrs.version; - hash = "sha256-5N8sAKStdQnrgzXECxu/oRuGVLwLx/KfW2vcPClVZGM="; + hash = "sha256-8aRIDzMaVbu0oKU1Ufig3rBj/X8P/DPzUdrTfA77z0w="; }; - cargoHash = "sha256-WdB4oJtQAh90Fe+Km+SddpmyvHdyemo3KsuRyBtZ5FY="; + cargoHash = "sha256-A29u5ZI6zKUuBtpEEVkM4dVbTqETZlK8f33MG8V1SwE="; env = { # https://github.com/Boshen/cargo-shear/blob/v1.6.2/src/lib.rs#L51-L54 From e554e2eb2a32ff33e1fde282b9e9f99e86b78863 Mon Sep 17 00:00:00 2001 From: "R. Ryantm" Date: Thu, 20 Nov 2025 15:43:19 +0000 Subject: [PATCH 69/70] di-tui: 1.11.3 -> 1.11.4 --- pkgs/by-name/di/di-tui/package.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/by-name/di/di-tui/package.nix b/pkgs/by-name/di/di-tui/package.nix index 9201fc2b853a..7b8ec127ef6d 100644 --- a/pkgs/by-name/di/di-tui/package.nix +++ b/pkgs/by-name/di/di-tui/package.nix @@ -6,13 +6,13 @@ }: buildGoModule rec { pname = "di-tui"; - version = "1.11.3"; + version = "1.11.4"; src = fetchFromGitHub { owner = "acaloiaro"; repo = "di-tui"; rev = "v${version}"; - hash = "sha256-Qd+Rwyw0aC5RGucvl3v3mHbV6dB9VHvk9/nh/glWU90="; + hash = "sha256-CTZ98EbOdM/uCFZHtCGnU4OHmFw4iPwqseb0RuJvDnk="; }; vendorHash = "sha256-b7dG0nSjPQpjWUbOlIxWudPZWKqtq96sQaJxKvsQT9I="; From 2b9511c52c0f11ccf871e0a655fe8a3377e90948 Mon Sep 17 00:00:00 2001 From: "R. Ryantm" Date: Thu, 20 Nov 2025 16:06:12 +0000 Subject: [PATCH 70/70] plasma-panel-colorizer: 5.3.0 -> 5.4.0 --- pkgs/by-name/pl/plasma-panel-colorizer/package.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/by-name/pl/plasma-panel-colorizer/package.nix b/pkgs/by-name/pl/plasma-panel-colorizer/package.nix index 4d6b6c382823..10356dba4314 100644 --- a/pkgs/by-name/pl/plasma-panel-colorizer/package.nix +++ b/pkgs/by-name/pl/plasma-panel-colorizer/package.nix @@ -9,13 +9,13 @@ stdenv.mkDerivation (finalAttrs: { pname = "plasma-panel-colorizer"; - version = "5.3.0"; + version = "5.4.0"; src = fetchFromGitHub { owner = "luisbocanegra"; repo = "plasma-panel-colorizer"; tag = "v${finalAttrs.version}"; - hash = "sha256-hv0XBBeXjpwtjFuQ5RRFf/v3ygZbTfsKjWBsd7vs7ps="; + hash = "sha256-8cjOyQzX3MOcXLux0raiAlx6kNreLa5jGdGQDlFNGiw="; }; nativeBuildInputs = [