Merge master into haskell-updates

doc/build-helpers/images/dockertools.section.md

@@ -50,6 +50,10 @@ Similarly, if you encounter errors similar to `Error_Protocol ("certificate has
   If specified, the layer created by `buildImage` will be appended to the layers defined in the base image, resulting in an image with at least two layers (one or more layers from the base image, and the layer created by `buildImage`).
   Otherwise, the resulting image with contain the single layer created by `buildImage`.
 
+  :::{.note}
+  Only **Env** configuration is inherited from the base image.
+  :::
+
   _Default value:_ `null`.
 
 `fromImageName` (String or Null; _optional_)

doc/languages-frameworks/javascript.section.md

@@ -467,6 +467,7 @@ Yarn based projects use a `yarn.lock` file instead of a `package-lock.json` to p
 
 - `yarnConfigHook`: Fetches the dependencies from the offline cache and installs them into `node_modules`.
 - `yarnBuildHook`: Runs `yarn build` or a specified `yarn` command that builds the project.
+- `yarnInstallHook`: Runs `yarn install --production` to prune dependencies and installs the project into `$out`.
 
 An example usage of the above attributes is:
 
@@ -501,9 +502,9 @@ stdenv.mkDerivation (finalAttrs: {
   nativeBuildInputs = [
     yarnConfigHook
     yarnBuildHook
+    yarnInstallHook
     # Needed for executing package.json scripts
     nodejs
-    npmHooks.npmInstallHook
   ];
 
   meta = {
@@ -512,8 +513,6 @@ stdenv.mkDerivation (finalAttrs: {
 })
 ```
 
-Note that there is no setup hook for installing yarn based packages - `npmHooks.npmInstallHook` should fit most cases, but sometimes you may need to override the `installPhase` completely.
-
 #### `yarnConfigHook` arguments {#javascript-yarnconfighook}
 
 By default, `yarnConfigHook` relies upon the attribute `${yarnOfflineCache}` (or `${offlineCache}` if the former is not set) to find the location of the offline cache produced by `fetchYarnDeps`. To disable this phase, you can set `dontYarnInstallDeps = true` or override the `configurePhase`.
@@ -525,9 +524,15 @@ This script by default runs `yarn --offline build`, and it relies upon the proje
 - `yarnBuildScript`: Sets a different `yarn --offline` subcommand (defaults to `build`).
 - `yarnBuildFlags`: Single string list of additional flags to pass the above command, or a Nix list of such additional flags.
 
+#### `yarnInstallHook` arguments {#javascript-yarninstallhook}
+
+To install the package `yarnInstallHook` uses both `npm` and `yarn` to cleanup project files and dependencies. To disable this phase, you can set `dontYarnInstall = true` or override the `installPhase`. Below is a list of additional `mkDerivation` arguments read by this hook:
+
+- `yarnKeepDevDeps`: Disables the removal of devDependencies from `node_modules` before installation.
+
 ### yarn2nix {#javascript-yarn2nix}
 
-WARNING: The `yarn2nix` functions have been deprecated in favor of the new `yarnConfigHook` and `yarnBuildHook`. Documentation for them still appears here for the sake of the packages that still use them. See also a tracking issue [#324246](https://github.com/NixOS/nixpkgs/issues/324246).
+WARNING: The `yarn2nix` functions have been deprecated in favor of the new `yarnConfigHook`, `yarnBuildHook` and `yarnInstallHook`. Documentation for them still appears here for the sake of the packages that still use them. See also a tracking issue [#324246](https://github.com/NixOS/nixpkgs/issues/324246).
 
 #### Preparation {#javascript-yarn2nix-preparation}
 

maintainers/maintainer-list.nix

@@ -2255,6 +2255,12 @@
     githubId = 80325;
     name = "Benjamin Andresen";
   };
+  banh-canh = {
+    email = "vhvictorhang@gmail.com";
+    github = "Banh-Canh";
+    githubId = 66330398;
+    name = "Victor Hang";
+  };
   barab-i = {
     email = "barab_i@outlook.com";
     github = "barab-i";
@@ -21425,6 +21431,11 @@
     githubId = 1215104;
     keys = [ { fingerprint = "B1FD 4E2A 84B2 2379 F4BF  2EF5 FE33 A228 2371 E831"; } ];
   };
+  tyberius-prime = {
+    name = "Tyberius Prime";
+    github = "TyberiusPrime";
+    githubId = 1257580;
+  };
   tylerjl = {
     email = "tyler+nixpkgs@langlois.to";
     github = "tylerjl";
@@ -23156,6 +23167,12 @@
     github = "zbioe";
     githubId = 7332055;
   };
+  zebradil = {
+    email = "german.lashevich+nixpkgs@gmail.com";
+    github = "zebradil";
+    githubId = 1475583;
+    name = "German Lashevich";
+  };
   zebreus = {
     matrix = "@lennart:cicen.net";
     email = "lennarteichhorn+nixpkgs@gmail.com";

nixos/doc/manual/release-notes/rl-2411.section.md

@@ -31,6 +31,10 @@
   Users can use it by `services.displayManager.ly.enable` and config it by
   `services.displayManager.ly.settings` to generate `/etc/ly/config.ini`
 
+- The default sound server for most graphical sessions has been switched from PulseAudio to PipeWire.
+  Users that want to keep PulseAudio will want to set `services.pipewire.enable = false;` and `hardware.pulseaudio.enable = true;`.
+  There is currently no plan to fully deprecate and remove PulseAudio, however, PipeWire should generally be preferred for new installs.
+
 ## New Modules {#sec-release-24.11-new-modules}
 
 - [TaskChampion Sync-Server](https://github.com/GothenburgBitFactory/taskchampion-sync-server), a [Taskwariror 3](https://taskwarrior.org/docs/upgrade-3/) sync server, replacing Taskwarrior 2's sync server named [`taskserver`](https://github.com/GothenburgBitFactory/taskserver).
@@ -331,6 +335,10 @@
 - `zx` was updated to v8, which introduces several breaking changes.
   See the [v8 changelog](https://github.com/google/zx/releases/tag/8.0.0) for more information.
 
+- `system.stateVersion` is now validated. If you never changed this yourself, you don't need to do anything. If your `stateVersion` is not a valid NixOS release version (e.g. "24.11" is valid),
+  your system was already at risk of experiencing silent incompatible state updates. If your previous value is a well-formed version but not a valid release (e.g. "23.12"),
+  round down to the nearest actual release. If it wasn't a well-formed version (e.g. "nixos-unstable"), set it to the version of NixOS that you originally installed.
+
 - The `portunus` package and service do not support weak password hashes anymore.
   If you installed Portunus on NixOS 23.11 or earlier, upgrade to NixOS 24.05 first to get support for strong password hashing.
   Then, follow the instructions on the [upstream release notes](https://github.com/majewsky/portunus/releases/tag/v2.0.0) to upgrade all existing user accounts to strong password hashes.
@@ -448,6 +456,10 @@
 
 - The hooks `yarnConfigHook` and `yarnBuildHook` were added. These should replace `yarn2nix.mkYarnPackage` and other `yarn2nix` related tools. The motivation to get rid of `yarn2nix` tools is the fact that they are too complex and hard to maintain, and they rely upon too much Nix evaluation which is problematic if import-from-derivation is not allowed (see more details at [#296856](https://github.com/NixOS/nixpkgs/issues/296856). The transition from `mkYarnPackage` to `yarn{Config,Build}Hook` is tracked at [#324246](https://github.com/NixOS/nixpkgs/issues/324246).
 
+- `services.timesyncd.servers` now defaults to `null`, allowing systemd-timesyncd to use NTP servers advertised by DHCP.
+
+- `services.timesyncd.fallbackServers` was added and defaults to `networking.timeServers`.
+
 - Cinnamon has been updated to 6.2, please check [upstream announcement](https://www.linuxmint.com/rel_wilma_whatsnew.php) for more details.
   Following Mint 22 defaults, the Cinnamon module no longer ships geary and hexchat by default.
 

nixos/modules/config/i18n.nix

@@ -13,7 +13,7 @@
         };
         defaultText = lib.literalExpression ''
           pkgs.glibcLocales.override {
-            allLocales = any (x: x == "all") config.i18n.supportedLocales;
+            allLocales = lib.any (x: x == "all") config.i18n.supportedLocales;
             locales = config.i18n.supportedLocales;
           }
         '';

nixos/modules/config/resolvconf.nix

@@ -35,7 +35,7 @@ in
     (lib.mkRenamedOptionModule [ "networking" "dnsExtensionMechanism" ] [ "networking" "resolvconf" "dnsExtensionMechanism" ])
     (lib.mkRenamedOptionModule [ "networking" "extraResolvconfConf" ] [ "networking" "resolvconf" "extraConfig" ])
     (lib.mkRenamedOptionModule [ "networking" "resolvconfOptions" ] [ "networking" "resolvconf" "extraOptions" ])
-    (lib.mkRemovedOptionModule [ "networking" "resolvconf" "useHostResolvConf" ] "This option was never used for lib.anything lib.anyways")
+    (lib.mkRemovedOptionModule [ "networking" "resolvconf" "useHostResolvConf" ] "This option was never used for anything anyways")
   ];
 
   options = {

nixos/modules/installer/cd-dvd/installation-cd-graphical-base.nix

@@ -32,9 +32,6 @@ with lib;
   # there is no power management backend such as upower).
   powerManagement.enable = true;
 
-  # Enable sound in graphical iso's.
-  hardware.pulseaudio.enable = true;
-
   # VM guest additions to improve host-guest interaction
   services.spice-vdagentd.enable = true;
   services.qemuGuest.enable = true;

nixos/modules/misc/version.nix

@@ -44,6 +44,49 @@ let
   };
   initrdRelease = pkgs.writeText "initrd-release" (attrsToText initrdReleaseContents);
 
+  checkRelease = version:
+    let
+      parts = lib.versions.splitVersion version;
+      isVersion = lib.length parts == 2 && lib.all (p: lib.stringLength p == 2) parts;
+      majorVersion = lib.toIntBase10 (lib.elemAt parts 0);
+      minorVersion = lib.elemAt parts 1;
+
+      versionPatterns = [
+        # only 13.10
+        { fromMajor = 13; minor = [ "10" ]; }
+        # 14.04 and 14.12
+        { fromMajor = 14; minor = [ "04" "12" ]; }
+        # only 15.09
+        { fromMajor = 15; minor = [ "09" ]; }
+        # 16.03 to 20.09
+        { fromMajor = 16; minor = [ "03" "09" ]; }
+        # from 21.05
+        { fromMajor = 21; minor = [ "05" "11" ]; }
+      ];
+
+      # find the versioning pattern that applies by looking for the first
+      # major version newer than `majorVersion`, and picking the previous pattern
+      patternIndex = lib.lists.findFirstIndex
+        ({ fromMajor, ... }: fromMajor > majorVersion)
+        (lib.length versionPatterns)
+        versionPatterns;
+
+      validMinorVersions =
+        if patternIndex == 0
+        then []
+        else (lib.elemAt versionPatterns (patternIndex - 1)).minor;
+
+      correctMinorVersion = lib.elem minorVersion validMinorVersions;
+      notNewerThanNixpkgs = lib.versionAtLeast trivial.release version;
+    in isVersion && correctMinorVersion && notNewerThanNixpkgs;
+
+  releaseType = types.addCheck
+    (types.strMatching "[[:digit:]]{2}\\.[[:digit:]]{2}")
+    checkRelease // {
+      name = "nixosRelease";
+      description = "NixOS release version, e.g. \"${trivial.release}\"";
+      descriptionClass = "nonRestrictiveClause";
+    };
 in
 {
   imports = [
@@ -70,7 +113,7 @@ in
 
       release = mkOption {
         readOnly = true;
-        type = types.str;
+        type = releaseType;
         default = trivial.release;
         description = "The NixOS release (e.g. `16.03`).";
       };
@@ -151,7 +194,7 @@ in
     };
 
     stateVersion = mkOption {
-      type = types.str;
+      type = releaseType;
       # TODO Remove this and drop the default of the option so people are forced to set it.
       # Doing this also means fixing the comment in nixos/modules/testing/test-instrumentation.nix
       apply = v:

nixos/modules/profiles/graphical.nix

@@ -14,8 +14,5 @@
     libinput.enable = true; # for touchpad support on many laptops
   };
 
-  # Enable sound in virtualbox appliances.
-  hardware.pulseaudio.enable = true;
-
   environment.systemPackages = [ pkgs.mesa-demos pkgs.firefox ];
 }

nixos/modules/programs/steam.nix

@@ -196,8 +196,9 @@ in {
     programs.gamescope.enable = lib.mkDefault cfg.gamescopeSession.enable;
     services.displayManager.sessionPackages = lib.mkIf cfg.gamescopeSession.enable [ gamescopeSessionFile ];
 
-    # optionally enable 32bit pulseaudio support if pulseaudio is enabled
+    # enable 32bit pulseaudio/pipewire support if needed
     hardware.pulseaudio.support32Bit = config.hardware.pulseaudio.enable;
+    services.pipewire.alsa.support32Bit = config.services.pipewire.alsa.enable;
 
     hardware.steam-hardware.enable = true;
 

nixos/modules/services/continuous-integration/github-runner/service.nix

@@ -151,9 +151,10 @@ with lib;
                 # Always clean workDir
                 find -H "$WORK_DIRECTORY" -mindepth 1 -delete
               '';
-              configureRunner = writeScript "configure" ''
+              configureRunner = writeScript "configure" /*bash*/''
                 if [[ -e "${newConfigTokenPath}" ]]; then
                   echo "Configuring GitHub Actions Runner"
+                  # shellcheck disable=SC2054  # don't complain about commas in --labels
                   args=(
                     --unattended
                     --disableupdate

nixos/modules/services/continuous-integration/jenkins/default.nix

@@ -205,13 +205,13 @@ in {
       preStart =
         let replacePlugins =
               lib.optionalString (cfg.plugins != null) (
-                let pluginCmds = lib.attrsets.lib.mapAttrsToList
+                let pluginCmds = lib.mapAttrsToList
                       (n: v: "cp ${v} ${cfg.home}/plugins/${n}.jpi")
                       cfg.plugins;
                 in ''
                   rm -r ${cfg.home}/plugins || true
                   mkdir -p ${cfg.home}/plugins
-                  ${lib.strings.lib.concatStringsSep "\n" pluginCmds}
+                  ${lib.concatStringsSep "\n" pluginCmds}
                 '');
         in ''
           rm -rf ${cfg.home}/war

nixos/modules/services/desktop-managers/lomiri.nix

@@ -50,7 +50,6 @@ in {
       };
     };
 
-    hardware.pulseaudio.enable = lib.mkDefault true;
     networking.networkmanager.enable = lib.mkDefault true;
 
     systemd.packages = with pkgs.lomiri; [

nixos/modules/services/misc/graphical-desktop.nix

@@ -55,6 +55,12 @@ in
 
     services.speechd.enable = lib.mkDefault true;
 
+    services.pipewire = {
+      enable = lib.mkDefault true;
+      pulse.enable = lib.mkDefault true;
+      alsa.enable = lib.mkDefault true;
+    };
+
     systemd.defaultUnit = lib.mkIf (xcfg.autorun || dmcfg.enable) "graphical.target";
 
     xdg = {

nixos/modules/services/monitoring/unpoller.nix

@@ -1,11 +1,8 @@
 { config, lib, pkgs, ... }:
-
-with lib;
-
 let
   cfg = config.services.unpoller;
 
-  configFile = pkgs.writeText "unpoller.json" (generators.toJSON {} {
+  configFile = pkgs.writeText "unpoller.json" (lib.generators.toJSON {} {
     inherit (cfg) poller influxdb loki prometheus unifi;
   });
 
@@ -15,26 +12,26 @@ in {
   ];
 
   options.services.unpoller = {
-    enable = mkEnableOption "unpoller";
+    enable = lib.mkEnableOption "unpoller";
 
     poller = {
-      debug = mkOption {
-        type = types.bool;
+      debug = lib.mkOption {
+        type = lib.types.bool;
         default = false;
         description = ''
           Turns on line numbers, microsecond logging, and a per-device log.
           This may be noisy if you have a lot of devices. It adds one line per device.
         '';
       };
-      quiet = mkOption {
-        type = types.bool;
+      quiet = lib.mkOption {
+        type = lib.types.bool;
         default = false;
         description = ''
           Turns off per-interval logs. Only startup and error logs will be emitted.
         '';
       };
-      plugins = mkOption {
-        type = with types; listOf str;
+      plugins = lib.mkOption {
+        type = with lib.types; listOf str;
         default = [];
         description = ''
           Load additional plugins.
@@ -43,22 +40,22 @@ in {
     };
 
     prometheus = {
-      disable = mkOption {
-        type = types.bool;
+      disable = lib.mkOption {
+        type = lib.types.bool;
         default = false;
         description = ''
           Whether to disable the prometheus output plugin.
         '';
       };
-      http_listen = mkOption {
-        type = types.str;
+      http_listen = lib.mkOption {
+        type = lib.types.str;
         default = "[::]:9130";
         description = ''
           Bind the prometheus exporter to this IP or hostname.
         '';
       };
-      report_errors = mkOption {
-        type = types.bool;
+      report_errors = lib.mkOption {
+        type = lib.types.bool;
         default = false;
         description = ''
           Whether to report errors.
@@ -67,53 +64,53 @@ in {
     };
 
     influxdb = {
-      disable = mkOption {
-        type = types.bool;
+      disable = lib.mkOption {
+        type = lib.types.bool;
         default = false;
         description = ''
           Whether to disable the influxdb output plugin.
         '';
       };
-      url = mkOption {
-        type = types.str;
+      url = lib.mkOption {
+        type = lib.types.str;
         default = "http://127.0.0.1:8086";
         description = ''
           URL of the influxdb host.
         '';
       };
-      user = mkOption {
-        type = types.str;
+      user = lib.mkOption {
+        type = lib.types.str;
         default = "unifipoller";
         description = ''
           Username for the influxdb.
         '';
       };
-      pass = mkOption {
-        type = types.path;
+      pass = lib.mkOption {
+        type = lib.types.path;
         default = pkgs.writeText "unpoller-influxdb-default.password" "unifipoller";
-        defaultText = literalExpression "unpoller-influxdb-default.password";
+        defaultText = lib.literalExpression "unpoller-influxdb-default.password";
         description = ''
           Path of a file containing the password for influxdb.
           This file needs to be readable by the unifi-poller user.
         '';
         apply = v: "file://${v}";
       };
-      db = mkOption {
-        type = types.str;
+      db = lib.mkOption {
+        type = lib.types.str;
         default = "unifi";
         description = ''
           Database name. Database should exist.
         '';
       };
-      verify_ssl = mkOption {
-        type = types.bool;
+      verify_ssl = lib.mkOption {
+        type = lib.types.bool;
         default = true;
         description = ''
           Verify the influxdb's certificate.
         '';
       };
-      interval = mkOption {
-        type = types.str;
+      interval = lib.mkOption {
+        type = lib.types.str;
         default = "30s";
         description = ''
           Setting this lower than the Unifi controller's refresh
@@ -123,22 +120,22 @@ in {
     };
 
     loki = {
-      url = mkOption {
-        type = types.str;
+      url = lib.mkOption {
+        type = lib.types.str;
         default = "";
         description = ''
           URL of the Loki host.
         '';
       };
-      user = mkOption {
-        type = types.str;
+      user = lib.mkOption {
+        type = lib.types.str;
         default = "";
         description = ''
           Username for Loki.
         '';
       };
-      pass = mkOption {
-        type = types.path;
+      pass = lib.mkOption {
+        type = lib.types.path;
         default = pkgs.writeText "unpoller-loki-default.password" "";
         defaultText = "unpoller-influxdb-default.password";
         description = ''
@@ -147,29 +144,29 @@ in {
         '';
         apply = v: "file://${v}";
       };
-      verify_ssl = mkOption {
-        type = types.bool;
+      verify_ssl = lib.mkOption {
+        type = lib.types.bool;
         default = false;
         description = ''
           Verify Loki's certificate.
         '';
       };
-      tenant_id = mkOption {
-        type = types.str;
+      tenant_id = lib.mkOption {
+        type = lib.types.str;
         default = "";
         description = ''
           Tenant ID to use in Loki.
         '';
       };
-      interval = mkOption {
-        type = types.str;
+      interval = lib.mkOption {
+        type = lib.types.str;
         default = "2m";
         description = ''
           How often the events are polled and pushed to Loki.
         '';
       };
-      timeout = mkOption {
-        type = types.str;
+      timeout = lib.mkOption {
+        type = lib.types.str;
         default = "10s";
         description = ''
           Should be increased in case of timeout errors.
@@ -179,92 +176,92 @@ in {
 
     unifi = let
       controllerOptions = {
-        user = mkOption {
-          type = types.str;
+        user = lib.mkOption {
+          type = lib.types.str;
           default = "unifi";
           description = ''
             Unifi service user name.
           '';
         };
-        pass = mkOption {
-          type = types.path;
+        pass = lib.mkOption {
+          type = lib.types.path;
           default = pkgs.writeText "unpoller-unifi-default.password" "unifi";
-          defaultText = literalExpression "unpoller-unifi-default.password";
+          defaultText = lib.literalExpression "unpoller-unifi-default.password";
           description = ''
             Path of a file containing the password for the unifi service user.
             This file needs to be readable by the unifi-poller user.
           '';
           apply = v: "file://${v}";
         };
-        url = mkOption {
-          type = types.str;
+        url = lib.mkOption {
+          type = lib.types.str;
           default = "https://unifi:8443";
           description = ''
             URL of the Unifi controller.
           '';
         };
-        sites = mkOption {
-          type = with types; either (enum [ "default" "all" ]) (listOf str);
+        sites = lib.mkOption {
+          type = with lib.types; either (enum [ "default" "all" ]) (listOf str);
           default = "all";
           description = ''
             List of site names for which statistics should be exported.
             Or the string "default" for the default site or the string "all" for all sites.
           '';
-          apply = toList;
+          apply = lib.toList;
         };
-        save_ids = mkOption {
-          type = types.bool;
+        save_ids = lib.mkOption {
+          type = lib.types.bool;
           default = false;
           description = ''
             Collect and save data from the intrusion detection system to influxdb and Loki.
           '';
         };
-        save_events = mkOption {
-          type = types.bool;
+        save_events = lib.mkOption {
+          type = lib.types.bool;
           default = false;
           description = ''
             Collect and save data from UniFi events to influxdb and Loki.
           '';
         };
-        save_alarms = mkOption {
-          type = types.bool;
+        save_alarms = lib.mkOption {
+          type = lib.types.bool;
           default = false;
           description = ''
             Collect and save data from UniFi alarms to influxdb and Loki.
           '';
         };
-        save_anomalies = mkOption {
-          type = types.bool;
+        save_anomalies = lib.mkOption {
+          type = lib.types.bool;
           default = false;
           description = ''
             Collect and save data from UniFi anomalies to influxdb and Loki.
           '';
         };
-        save_dpi = mkOption {
-          type = types.bool;
+        save_dpi = lib.mkOption {
+          type = lib.types.bool;
           default = false;
           description = ''
             Collect and save data from deep packet inspection.
             Adds around 150 data points and impacts performance.
           '';
         };
-        save_sites = mkOption {
-          type = types.bool;
+        save_sites = lib.mkOption {
+          type = lib.types.bool;
           default = true;
           description = ''
             Collect and save site data.
           '';
         };
-        hash_pii = mkOption {
-          type = types.bool;
+        hash_pii = lib.mkOption {
+          type = lib.types.bool;
           default = false;
           description = ''
             Hash, with md5, client names and MAC addresses. This attempts
             to protect personally identifiable information.
           '';
         };
-        verify_ssl = mkOption {
-          type = types.bool;
+        verify_ssl = lib.mkOption {
+          type = lib.types.bool;
           default = true;
           description = ''
             Verify the Unifi controller's certificate.
@@ -273,8 +270,8 @@ in {
       };
 
     in {
-      dynamic = mkOption {
-        type = types.bool;
+      dynamic = lib.mkOption {
+        type = lib.types.bool;
         default = false;
         description = ''
           Let prometheus select which controller to poll when scraping.
@@ -284,18 +281,18 @@ in {
 
       defaults = controllerOptions;
 
-      controllers = mkOption {
-        type = with types; listOf (submodule { options = controllerOptions; });
+      controllers = lib.mkOption {
+        type = with lib.types; listOf (submodule { options = controllerOptions; });
         default = [];
         description = ''
           List of Unifi controllers to poll. Use defaults if empty.
         '';
-        apply = map (flip removeAttrs [ "_module" ]);
+        apply = map (lib.flip removeAttrs [ "_module" ]);
       };
     };
   };
 
-  config = mkIf cfg.enable {
+  config = lib.mkIf cfg.enable {
     users.groups.unifi-poller = { };
     users.users.unifi-poller = {
       description = "unifi-poller Service User";

nixos/modules/services/network-filesystems/samba.nix

@@ -239,6 +239,15 @@ in
 
         security.pam.services.samba = {};
         environment.systemPackages = [ cfg.package ];
+        # Like other mount* related commands that need the setuid bit, this is
+        # required too.
+        security.wrappers."mount.cifs" = {
+          program = "mount.cifs";
+          source = "${lib.getBin pkgs.cifs-utils}/bin/mount.cifs";
+          owner = "root";
+          group = "root";
+          setuid = true;
+        };
 
         networking.firewall.allowedTCPPorts = mkIf cfg.openFirewall [ 139 445 ];
         networking.firewall.allowedUDPPorts = mkIf cfg.openFirewall [ 137 138 ];

nixos/modules/services/networking/firewall-iptables.nix

@@ -123,9 +123,6 @@ let
       # Allows this host to act as a DHCP4 client without first having to use APIPA
       iptables -t mangle -A nixos-fw-rpfilter -p udp --sport 67 --dport 68 -j RETURN
 
-      # Allows decrypted packets from an IPsec VPN
-      ip46tables -t mangle -A nixos-fw-rpfilter -m policy --dir in --pol ipsec -j RETURN
-
       # Allows this host to act as a DHCPv4 server
       iptables -t mangle -A nixos-fw-rpfilter -s 0.0.0.0 -d 255.255.255.255 -p udp --sport 68 --dport 67 -j RETURN
 

nixos/modules/services/networking/firewall-nftables.nix

@@ -82,11 +82,6 @@ in
       }
     ];
 
-    networking.nftables.preCheckRuleset = ''
-      # can't validate IPsec rules
-      sed '/meta ipsec/d' -i ruleset.conf
-    '';
-
     networking.nftables.tables."nixos-fw".family = "inet";
     networking.nftables.tables."nixos-fw".content = ''
         ${optionalString (cfg.checkReversePath != false) ''
@@ -94,7 +89,6 @@ in
             type filter hook prerouting priority mangle + 10; policy drop;
 
             meta nfproto ipv4 udp sport . udp dport { 67 . 68, 68 . 67 } accept comment "DHCPv4 client/server"
-            meta ipsec exists accept comment "decrypted packets from an IPsec VPN"
             fib saddr . mark ${optionalString (cfg.checkReversePath != "loose") ". iif"} oif exists accept
 
             jump rpfilter-allow

nixos/modules/services/web-apps/weblate.nix

@@ -132,6 +132,7 @@ let
 
   weblatePath = with pkgs; [
     gitSVN
+    borgbackup
 
     #optional
     git-review

nixos/modules/services/x11/desktop-managers/budgie.nix

@@ -204,7 +204,6 @@ in {
     programs.nm-applet.indicator = true; # Budgie uses AppIndicators.
 
     hardware.bluetooth.enable = mkDefault true; # for Budgie's Status Indicator and BCC's Bluetooth panel.
-    hardware.pulseaudio.enable = mkDefault true; # for Budgie's Status Indicator and BCC's Sound panel.
 
     xdg.portal.enable = mkDefault true; # for BCC's Applications panel.
     xdg.portal.extraPortals = with pkgs; [

nixos/modules/services/x11/desktop-managers/cinnamon.nix

@@ -97,7 +97,6 @@ in
       # Default services
       services.blueman.enable = mkDefault (notExcluded pkgs.blueman);
       hardware.bluetooth.enable = mkDefault true;
-      hardware.pulseaudio.enable = mkDefault true;
       security.polkit.enable = true;
       services.accounts-daemon.enable = true;
       services.system-config-printer.enable = (mkIf config.services.printing.enable (mkDefault true));

nixos/modules/services/x11/desktop-managers/deepin.nix

@@ -47,7 +47,6 @@ in
       '';
 
       hardware.bluetooth.enable = mkDefault true;
-      hardware.pulseaudio.enable = mkDefault true;
       security.polkit.enable = true;
 
       services.deepin.dde-daemon.enable = mkForce true;

nixos/modules/services/x11/desktop-managers/gnome.nix

@@ -255,7 +255,6 @@ in
 
     (lib.mkIf serviceCfg.core-os-services.enable {
       hardware.bluetooth.enable = mkDefault true;
-      hardware.pulseaudio.enable = mkDefault true;
       programs.dconf.enable = true;
       security.polkit.enable = true;
       services.accounts-daemon.enable = true;

nixos/modules/services/x11/desktop-managers/pantheon.nix

@@ -130,7 +130,6 @@ in
 
       # Default services
       hardware.bluetooth.enable = mkDefault true;
-      hardware.pulseaudio.enable = mkDefault true;
       security.polkit.enable = true;
       services.accounts-daemon.enable = true;
       services.bamf.enable = true;

nixos/modules/services/x11/desktop-managers/plasma5.nix

@@ -380,7 +380,6 @@ in
       xdg.portal.extraPortals = [ pkgs.plasma5Packages.xdg-desktop-portal-kde ];
       xdg.portal.configPackages = mkDefault [ pkgs.plasma5Packages.xdg-desktop-portal-kde ];
       # xdg-desktop-portal-kde expects PipeWire to be running.
-      # This does not, by default, replace PulseAudio.
       services.pipewire.enable = mkDefault true;
 
       # Update the start menu for each user that is currently logged in
@@ -476,7 +475,7 @@ in
         {
           # The user interface breaks without pulse
           assertion = config.hardware.pulseaudio.enable || (config.services.pipewire.enable && config.services.pipewire.pulse.enable);
-          message = "Plasma Mobile requires pulseaudio.";
+          message = "Plasma Mobile requires a Pulseaudio compatible sound server.";
         }
       ];
 
@@ -512,7 +511,6 @@ in
 
       # The following services are needed or the UI is broken.
       hardware.bluetooth.enable = true;
-      hardware.pulseaudio.enable = true;
       networking.networkmanager.enable = true;
       # Required for autorotate
       hardware.sensor.iio.enable = lib.mkDefault true;

nixos/modules/system/boot/timesyncd.nix

@@ -2,33 +2,52 @@
 
 with lib;
 
+let
+  cfg = config.services.timesyncd;
+in
 {
 
   options = {
 
-    services.timesyncd = {
+    services.timesyncd = with types; {
       enable = mkOption {
         default = !config.boot.isContainer;
         defaultText = literalExpression "!config.boot.isContainer";
-        type = types.bool;
+        type = bool;
         description = ''
           Enables the systemd NTP client daemon.
         '';
       };
       servers = mkOption {
-        default = config.networking.timeServers;
-        defaultText = literalExpression "config.networking.timeServers";
-        type = types.listOf types.str;
+        default = null;
+        type = nullOr (listOf str);
         description = ''
           The set of NTP servers from which to synchronise.
-          Note if this is set to an empty list, the defaults systemd itself is
-          compiled with ({0..4}.nixos.pool.ntp.org) apply,
-          In case you want to disable timesyncd altogether, use the `enable` option.
+
+          Setting this option to an empty list will write `NTP=` to the
+          `timesyncd.conf` file as opposed to setting this option to null which
+          will remove `NTP=` entirely.
+
+          See man:timesyncd.conf(5) for details.
+        '';
+      };
+      fallbackServers = mkOption {
+        default = config.networking.timeServers;
+        defaultText = literalExpression "config.networking.timeServers";
+        type = nullOr (listOf str);
+        description = ''
+          The set of fallback NTP servers from which to synchronise.
+
+          Setting this option to an empty list will write `FallbackNTP=` to the
+          `timesyncd.conf` file as opposed to setting this option to null which
+          will remove `FallbackNTP=` entirely.
+
+          See man:timesyncd.conf(5) for details.
         '';
       };
       extraConfig = mkOption {
         default = "";
-        type = types.lines;
+        type = lines;
         example = ''
           PollIntervalMaxSec=180
         '';
@@ -41,7 +60,7 @@ with lib;
     };
   };
 
-  config = mkIf config.services.timesyncd.enable {
+  config = mkIf cfg.enable {
 
     systemd.additionalUpstreamSystemUnits = [ "systemd-timesyncd.service" ];
 
@@ -82,9 +101,14 @@ with lib;
 
     environment.etc."systemd/timesyncd.conf".text = ''
       [Time]
-      NTP=${concatStringsSep " " config.services.timesyncd.servers}
-      ${config.services.timesyncd.extraConfig}
-    '';
+    ''
+    + optionalString (cfg.servers != null) ''
+      NTP=${concatStringsSep " " cfg.servers}
+    ''
+    + optionalString (cfg.fallbackServers != null) ''
+      FallbackNTP=${concatStringsSep " " cfg.fallbackServers}
+    ''
+    + cfg.extraConfig;
 
     users.users.systemd-timesync = {
       uid = config.ids.uids.systemd-timesync;

nixos/tests/ayatana-indicators.nix

@@ -50,8 +50,6 @@ in
 
       services.accounts-daemon.enable = true; # messages
 
-      hardware.pulseaudio.enable = true; # sound
-
       # Lomiri-ish setup for Lomiri indicators
       # TODO move into a Lomiri module, once the package set is far enough for the DE to start
 

nixos/tests/ec2.nix

@@ -22,6 +22,8 @@ let
           ln -s vda1 /dev/xvda1
         '';
 
+        amazonImage.format = "qcow2";
+
         # In a NixOS test the serial console is occupied by the "backdoor"
         # (see testing/test-instrumentation.nix) and is incompatible with
         # the configuration in virtualisation/amazon-image.nix.
@@ -53,7 +55,7 @@ let
       }
     ];
   }).config;
-  image = "${imageCfg.system.build.amazonImage}/${imageCfg.amazonImage.name}.vhd";
+  image = "${imageCfg.system.build.amazonImage}/${imageCfg.amazonImage.name}.qcow2";
 
   sshKeys = import ./ssh-keys.nix pkgs;
   snakeOilPrivateKey = sshKeys.snakeOilPrivateKey.text;
@@ -63,6 +65,7 @@ let
 in {
   boot-ec2-nixops = makeEc2Test {
     name         = "nixops-userdata";
+    meta.timeout = 600;
     inherit image;
     sshPublicKey = snakeOilPublicKey; # That's right folks! My user's key is also the host key!
 
@@ -95,7 +98,7 @@ in {
       machine.succeed(
           "echo localhost,127.0.0.1 ${snakeOilPublicKey} > ~/.ssh/known_hosts"
       )
-      machine.succeed("ssh -o BatchMode=yes localhost exit")
+      machine.succeed("ssh -o BatchMode=yes localhost exit", timeout=120)
 
       # Test whether the root disk was resized.
       blocks, block_size = map(int, machine.succeed("stat -c %b:%S -f /").split(":"))

nixos/tests/enlightenment.nix

@@ -21,7 +21,6 @@ import ./make-test-python.nix ({ pkgs, ...} :
         user = "alice";
       };
     };
-    hardware.pulseaudio.enable = true; # needed for the factl test, /dev/snd/* exists without them but udev doesn't care then
     environment.systemPackages = [ pkgs.xdotool ];
     services.acpid.enable = true;
     services.connman.enable = true;

nixos/tests/mate.nix

@@ -21,10 +21,6 @@ import ./make-test-python.nix ({ pkgs, lib, ... }: {
     };
 
     services.xserver.desktopManager.mate.enable = true;
-
-    # Silence log spam due to no sound drivers loaded:
-    # ALSA lib confmisc.c:855:(parse_card) cannot find card '0'
-    hardware.pulseaudio.enable = true;
   };
 
   enableOCR = true;

nixos/tests/plasma5.nix

@@ -19,7 +19,6 @@ import ./make-test-python.nix ({ pkgs, ...} :
       enable = true;
       user = "alice";
     };
-    hardware.pulseaudio.enable = true; # needed for the factl test, /dev/snd/* exists without them but udev doesn't care then
   };
 
   testScript = { nodes, ... }: let

nixos/tests/xfce.nix

@@ -19,9 +19,6 @@ import ./make-test-python.nix ({ pkgs, ...} : {
 
       services.xserver.desktopManager.xfce.enable = true;
       environment.systemPackages = [ pkgs.xfce.xfce4-whiskermenu-plugin ];
-
-      hardware.pulseaudio.enable = true; # needed for the factl test, /dev/snd/* exists without them but udev doesn't care then
-
     };
 
   enableOCR = true;

pkgs/applications/blockchains/dcrwallet/default.nix

@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "dcrwallet";
-  version = "2.0.3";
+  version = "2.0.4";
 
   src = fetchFromGitHub {
     owner = "decred";
     repo = "dcrwallet";
     rev = "release-v${version}";
-    hash = "sha256-sRwGpOVydfZjgo7W+4RsHC4JElPyilbV5xhcHxPh2Wc=";
+    hash = "sha256-JKux64ANtoBumfVU2OyAyLgHDNZMe/bn+SMuQ8qV43M=";
   };
 
-  vendorHash = "sha256-lVVIS3FL8XwthCpzRKdw59NVtHVxXQ0ouD7jYQzOecM=";
+  vendorHash = "sha256-ic8328r3BpycC2NiErTiFtRIkQaBhYcBwRgq/t9hmT8=";
 
   subPackages = [ "." ];
 

pkgs/applications/blockchains/polkadot/Cargo.lock

@@ -3654,7 +3654,7 @@ dependencies = [
 
 [[package]]
 name = "cumulus-client-consensus-aura"
-version = "0.17.0"
+version = "0.17.1"
 dependencies = [
  "async-trait",
  "cumulus-client-collator",
@@ -11507,7 +11507,7 @@ dependencies = [
 
 [[package]]
 name = "pallet-timestamp"
-version = "36.0.0"
+version = "36.0.1"
 dependencies = [
  "docify",
  "frame-benchmarking",
@@ -12833,7 +12833,7 @@ dependencies = [
 
 [[package]]
 name = "polkadot-dispute-distribution"
-version = "17.0.0"
+version = "17.0.1"
 dependencies = [
  "assert_matches",
  "async-channel",
@@ -13862,7 +13862,7 @@ dependencies = [
 
 [[package]]
 name = "polkadot-runtime-parachains"
-version = "16.0.1"
+version = "16.0.2"
 dependencies = [
  "assert_matches",
  "bitflags 1.3.2",

pkgs/applications/blockchains/polkadot/default.nix

@@ -17,13 +17,13 @@ let
 in
 rustPlatform.buildRustPackage rec {
   pname = "polkadot";
-  version = "stable2407-1";
+  version = "stable2407-2";
 
   src = fetchFromGitHub {
     owner = "paritytech";
     repo = "polkadot-sdk";
     rev = "polkadot-${version}";
-    hash = "sha256-IYRkXmFBjRAYSROL37EgEjC7wM1N97HabuSHtcSUxdg=";
+    hash = "sha256-4WOoFjihzErc6lIgiWvLg6fqDOxs1A+A0ERvu/D8btw=";
 
     # the build process of polkadot requires a .git folder in order to determine
     # the git commit hash that is being built and add it to the version string.

pkgs/applications/editors/vim/plugins/generated.nix

@@ -2934,6 +2934,78 @@ final: prev:
     meta.homepage = "https://github.com/nvimdev/dashboard-nvim/";
   };
 
+  ddc-filter-matcher_head = buildVimPlugin {
+    pname = "ddc-filter-matcher_head";
+    version = "2024-08-02";
+    src = fetchFromGitHub {
+      owner = "Shougo";
+      repo = "ddc-filter-matcher_head";
+      rev = "28f60903e1a9f1010ec01575cb99c64e76683466";
+      sha256 = "155yp27p3j982cchgjijci7f1vci1idrv7hp6imz5kxxrcdvfcz4";
+    };
+    meta.homepage = "https://github.com/Shougo/ddc-filter-matcher_head/";
+  };
+
+  ddc-filter-sorter_rank = buildVimPlugin {
+    pname = "ddc-filter-sorter_rank";
+    version = "2024-08-02";
+    src = fetchFromGitHub {
+      owner = "Shougo";
+      repo = "ddc-filter-sorter_rank";
+      rev = "539584150b922acb549203730d427dd2fd85fe86";
+      sha256 = "16d8jx7bq3602wd9a019zh93ifv1bxdnrrjhsa8d8g8zm2wmv47x";
+    };
+    meta.homepage = "https://github.com/Shougo/ddc-filter-sorter_rank/";
+  };
+
+  ddc-source-lsp = buildVimPlugin {
+    pname = "ddc-source-lsp";
+    version = "2024-08-16";
+    src = fetchFromGitHub {
+      owner = "Shougo";
+      repo = "ddc-source-lsp";
+      rev = "7511be6f82cab3dd9fd1592a9076c19f4273570d";
+      sha256 = "0kbm1w89rc3kmh4zi1fn8wskj785a0gq1lr5d1ijrb0i2z237rcy";
+    };
+    meta.homepage = "https://github.com/Shougo/ddc-source-lsp/";
+  };
+
+  ddc-ui-native = buildVimPlugin {
+    pname = "ddc-ui-native";
+    version = "2024-07-29";
+    src = fetchFromGitHub {
+      owner = "Shougo";
+      repo = "ddc-ui-native";
+      rev = "2567067b60419a9be265aae5fa480dc51e4ba1c3";
+      sha256 = "1lr039vnr1yw0nccr3f20a19f4mnxm12kkr8rlzix4r6j3z6vz0h";
+    };
+    meta.homepage = "https://github.com/Shougo/ddc-ui-native/";
+  };
+
+  ddc-ui-pum = buildVimPlugin {
+    pname = "ddc-ui-pum";
+    version = "2024-08-01";
+    src = fetchFromGitHub {
+      owner = "Shougo";
+      repo = "ddc-ui-pum";
+      rev = "989b3f0acb0d35bfcd0a3b0ec9239ad2a838e478";
+      sha256 = "14ysvz1gp2ha6143f60v3nq2s2yybx7b916q8bs845jzk5q7qlwd";
+    };
+    meta.homepage = "https://github.com/Shougo/ddc-ui-pum/";
+  };
+
+  ddc-vim = buildVimPlugin {
+    pname = "ddc.vim";
+    version = "2024-08-21";
+    src = fetchFromGitHub {
+      owner = "Shougo";
+      repo = "ddc.vim";
+      rev = "09f2f778f2da1c2c96965669e9791665455c12eb";
+      sha256 = "1ipzlxxlwbzz076cp9ggln2qspgvmnzaqbbq1m1c5rr756d6k7k3";
+    };
+    meta.homepage = "https://github.com/Shougo/ddc.vim/";
+  };
+
   debugprint-nvim = buildVimPlugin {
     pname = "debugprint.nvim";
     version = "2024-07-28";

pkgs/applications/editors/vim/plugins/overrides.nix

@@ -662,6 +662,30 @@
     '';
   };
 
+  ddc-filter-matcher_head = super.ddc-filter-matcher_head.overrideAttrs {
+    dependencies = with self; [ ddc-vim ];
+  };
+
+  ddc-source-lsp = super.ddc-source-lsp.overrideAttrs {
+    dependencies = with self; [ ddc-vim ];
+  };
+
+  ddc-vim = super.ddc-vim.overrideAttrs {
+    dependencies = with self; [ denops-vim ];
+  };
+
+  ddc-filter-sorter_rank = super.ddc-filter-sorter_rank.overrideAttrs {
+    dependencies = with self; [ ddc-vim ];
+  };
+
+  ddc-ui-native = super.ddc-ui-native.overrideAttrs {
+    dependencies = with self; [ ddc-vim ];
+  };
+
+  ddc-ui-pum = super.ddc-ui-pum.overrideAttrs {
+    dependencies = with self; [ ddc-vim pum-vim ];
+  };
+
   defx-nvim = super.defx-nvim.overrideAttrs {
     dependencies = with self; [ nvim-yarp ];
   };

pkgs/applications/editors/vim/plugins/vim-plugin-names

@@ -244,6 +244,12 @@ https://github.com/ptdewey/darkearth-nvim/,HEAD,
 https://github.com/dart-lang/dart-vim-plugin/,,
 https://github.com/rizzatti/dash.vim/,HEAD,
 https://github.com/glepnir/dashboard-nvim/,,
+https://github.com/Shougo/ddc-filter-matcher_head/,HEAD,
+https://github.com/Shougo/ddc-filter-sorter_rank/,HEAD,
+https://github.com/Shougo/ddc-source-lsp/,HEAD,
+https://github.com/Shougo/ddc-ui-native/,HEAD,
+https://github.com/Shougo/ddc-ui-pum/,HEAD,
+https://github.com/Shougo/ddc.vim/,HEAD,
 https://github.com/andrewferrier/debugprint.nvim/,HEAD,
 https://github.com/Verf/deepwhite.nvim/,,
 https://github.com/kristijanhusak/defx-git/,,

pkgs/applications/emulators/86box/default.nix

@@ -40,13 +40,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "86Box";
-  version = "4.2";
+  version = "4.2.1";
 
   src = fetchFromGitHub {
     owner = "86Box";
     repo = "86Box";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-hXupMQ+i27sw3XOweZGatdRCUlp7weGR/PqCLAw/8fo=";
+    hash = "sha256-ue5Coy2MpP7Iwl81KJPQPC7eD53/Db5a0PGIR+DdPYI=";
   };
 
   patches = [ ./darwin.patch ];
@@ -119,7 +119,7 @@ stdenv.mkDerivation (finalAttrs: {
       owner = "86Box";
       repo = "roms";
       rev = "v${finalAttrs.version}";
-      hash = "sha256-WdQebSBuw2Wtz8ggMnGuxGoi2EKtNub3S8JKa6ZmdU8=";
+      hash = "sha256-p3djn950mTUIchFCEg56JbJtIsUuxmqRdYFRl50kI5Y=";
     };
     updateScript = ./update.sh;
   };

pkgs/applications/graphics/drawio/default.nix

@@ -14,14 +14,14 @@
 
 stdenv.mkDerivation rec {
   pname = "drawio";
-  version = "24.6.4";
+  version = "24.7.8";
 
   src = fetchFromGitHub {
     owner = "jgraph";
     repo = "drawio-desktop";
     rev = "v${version}";
     fetchSubmodules = true;
-    hash = "sha256-6+a+70uN4Tk4pMXg3DQ3D0GcLNGFQEcPG05xxyUv1DQ=";
+    hash = "sha256-mpFmUPdgK9S6HcoO5wc6onUkmS6tRbFwLAsMhvIQ8sU=";
   };
 
   # `@electron/fuses` tries to run `codesign` and fails. Disable and use autoSignDarwinBinariesHook instead
@@ -31,7 +31,7 @@ stdenv.mkDerivation rec {
 
   offlineCache = fetchYarnDeps {
     yarnLock = src + "/yarn.lock";
-    hash = "sha256-R8eCnp/ik3EfsmsVyJfLjyScUVQSm/EdXJesS/eVIX0=";
+    hash = "sha256-/3Dn4l5Bao01pcSXuPhq/AbH+gxZzHILP8TiHvplJpw=";
   };
 
   nativeBuildInputs = [

pkgs/applications/misc/chatblade/default.nix

@@ -2,12 +2,12 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "chatblade";
-  version = "0.6.3";
+  version = "0.6.4";
   format = "setuptools";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-4zLyIrBkilZ2ciBRkU41iK6Q8xDTdFJYOYalNeEMApg=";
+    hash = "sha256-d8XavZBuWsuIUxraC2XaWM6tgo2JmsPZwzyl9Rj5wWM=";
   };
 
   doCheck = false; # there are no tests

pkgs/applications/misc/mkgmap/default.nix

@@ -16,12 +16,12 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "mkgmap";
-  version = "4921";
+  version = "4922";
 
   src = fetchsvn {
     url = "https://svn.mkgmap.org.uk/mkgmap/mkgmap/trunk";
     rev = version;
-    sha256 = "sha256-s7EKHXh3UNMDzBmWUTZaLR1P21e27cWJNYRlFcpJu50=";
+    sha256 = "sha256-LgGdV6l9tjRR4BpGTDTm0MeAq2uiOe7Pv0qv87nbbWw=";
   };
 
   patches = [

pkgs/applications/misc/redshift/default.nix

@@ -6,6 +6,7 @@
 , withQuartz ? stdenv.isDarwin, ApplicationServices
 , withRandr ? stdenv.isLinux, libxcb
 , withDrm ? stdenv.isLinux, libdrm
+, withVidmode ? stdenv.isLinux, libXxf86vm
 
 , withGeolocation ? true
 , withCoreLocation ? withGeolocation && stdenv.isDarwin, CoreLocation, Foundation, Cocoa
@@ -45,6 +46,7 @@ let
         "--enable-randr=${if withRandr then "yes" else "no"}"
         "--enable-geoclue2=${if withGeoclue then "yes" else "no"}"
         "--enable-drm=${if withDrm then "yes" else "no"}"
+        "--enable-vidmode=${if withVidmode then "yes" else "no"}"
         "--enable-quartz=${if withQuartz then "yes" else "no"}"
         "--enable-corelocation=${if withCoreLocation then "yes" else "no"}"
       ] ++ lib.optionals (pname == "gammastep") [
@@ -57,6 +59,7 @@ let
       ] ++ lib.optional  withRandr        libxcb
         ++ lib.optional  withGeoclue      geoclue
         ++ lib.optional  withDrm          libdrm
+        ++ lib.optional  withVidmode      libXxf86vm
         ++ lib.optional  withQuartz       ApplicationServices
         ++ lib.optionals withCoreLocation [ CoreLocation Foundation Cocoa ]
         ++ lib.optional  withAppIndicator (if (pname != "gammastep")

pkgs/applications/misc/stretchly/default.nix

@@ -10,11 +10,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "stretchly";
-  version = "1.15.1";
+  version = "1.16.0";
 
   src = fetchurl {
     url = "https://github.com/hovancik/stretchly/releases/download/v${finalAttrs.version}/stretchly-${finalAttrs.version}.tar.xz";
-    hash = "sha256-suTH6o7vtUr2DidPXAwqrya5/WukQOFmS/34LaiWDBs=";
+    hash = "sha256-gOMUXGldtZUfqLABJHfbToYe0pcAn8dRWEFxCi/gY9Y=";
   };
 
   icon = fetchurl {

pkgs/applications/misc/syncthingtray/default.nix

@@ -35,14 +35,14 @@ https://github.com/NixOS/nixpkgs/issues/199596#issuecomment-1310136382 */
 }:
 
 stdenv.mkDerivation (finalAttrs: {
-  version = "1.6.0";
+  version = "1.6.1";
   pname = "syncthingtray";
 
   src = fetchFromGitHub {
     owner = "Martchus";
     repo = "syncthingtray";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-tbtSISWBNHxuF2T1XK5JnkiPMYzgP4fyw5t6z91P2p8=";
+    hash = "sha256-ZyYByMNMlXRjCCrvr5l+ePkWDrX7uxleVvxr09YeURQ=";
   };
 
   buildInputs = [

pkgs/applications/networking/browsers/firefox/common.nix

@@ -237,7 +237,7 @@ buildStdenv.mkDerivation {
   patches = lib.optionals (lib.versionAtLeast version "111") [ ./env_var_for_system_dir-ff111.patch ]
   ++ lib.optionals (lib.versionAtLeast version "96" && lib.versionOlder version "121") [ ./no-buildconfig-ffx96.patch ]
   ++ lib.optionals (lib.versionAtLeast version "121") [ ./no-buildconfig-ffx121.patch ]
-  ++ lib.optionals (lib.versionOlder version "131") [
+  ++ lib.optionals (lib.versionOlder version "128.2" || (lib.versionAtLeast version "129" && lib.versionOlder version "130")) [
     (fetchpatch {
       # https://bugzilla.mozilla.org/show_bug.cgi?id=1912663
       name = "cbindgen-0.27.0-compat.patch";
@@ -245,24 +245,6 @@ buildStdenv.mkDerivation {
       hash = "sha256-MqgWHgbDedVzDOqY2/fvCCp+bGwFBHqmaJLi/mllZug=";
     })
   ]
-  ++ lib.optionals (lib.versionOlder version "130" && lib.versionAtLeast version "128") [
-    # https://bugzilla.mozilla.org/show_bug.cgi?id=1898476
-    (fetchpatch {
-      name = "mozbz-1898476-1.patch";
-      url = "https://hg.mozilla.org/mozilla-central/raw-rev/f9323daf7abe";
-      hash = "sha256-fvIowXJLWnm16LeiSz6EasGypTi1ilG+s/T6+lNLbMQ=";
-    })
-    (fetchpatch {
-      name = "mozbz-1898476-2.patch";
-      url = "https://hg.mozilla.org/mozilla-central/raw-rev/a264ff9e9f6f";
-      hash = "sha256-9vkI/Ho4BXvLnoRGdfTzUODcIlA6K3RjbdhZjb/LEz0=";
-    })
-    (fetchpatch {
-      name = "mozbz-1898476-3.patch";
-      url = "https://hg.mozilla.org/mozilla-central/raw-rev/eb230ecdf8eb";
-      hash = "sha256-IaLltxf5W1WEzxvbi10wphqXVQPtBiLc2zlk38CIiz4=";
-    })
-  ]
   ++ lib.optionals (lib.versionOlder version "122") [ ./bindgen-0.64-clang-18.patch  ]
   ++ lib.optionals (lib.versionOlder version "123") [
     (fetchpatch {

pkgs/applications/networking/browsers/firefox/packages.nix

@@ -5,10 +5,10 @@
 {
   firefox = buildMozillaMach rec {
     pname = "firefox";
-    version = "129.0.2";
+    version = "130.0";
     src = fetchurl {
       url = "mirror://mozilla/firefox/releases/${version}/source/firefox-${version}.source.tar.xz";
-      sha512 = "f6805a87e5cb4e437583916e3ec1b312dc73eec5fc06ce7a038b13bd7c6827b18cf383c30645d96623ce41675351f3023ec6b9f89d676f1c889994eae79f2c13";
+      sha512 = "d0d11b38d9e02fa15298ec13336bb086668b4f36b3ce9ced218a265327fd4822b9fea4303402631947ea3c20490c414de87f8df3e7c23d2e02b70f0456b9af40";
     };
 
     extraPatches = [
@@ -96,10 +96,10 @@
 
   firefox-esr-128 = buildMozillaMach rec {
     pname = "firefox";
-    version = "128.1.0esr";
+    version = "128.2.0esr";
     src = fetchurl {
       url = "mirror://mozilla/firefox/releases/${version}/source/firefox-${version}.source.tar.xz";
-      sha512 = "8055a7f83acf0cab6124ba5809aff1c082e81a0d30ff318ec719f8fd3f4af9aa60e2094c1abd6c981193d751075a9569370176e20e50f3c1959fe27a15511388";
+      sha512 = "9a689929f6f86d795ea2c0318bb78f77f72a552f40715a1108dbd6361b0dedc3aaf049f1883424012459899607067d5a8374d895564591ec6679a1ce80708d7d";
     };
 
     meta = {
@@ -125,11 +125,11 @@
 
   firefox-esr-115 = (buildMozillaMach rec {
     pname = "firefox-esr-115";
-    version = "115.14.0esr";
+    version = "115.15.0esr";
     applicationName = "Mozilla Firefox ESR";
     src = fetchurl {
       url = "mirror://mozilla/firefox/releases/${version}/source/firefox-${version}.source.tar.xz";
-      sha512 = "dd40c1fd3cf454dbf33a85d38e47bb0e736ed89b829643653e239f43232441f4e9f3c7876f058ff2e6f19daf2b50a8f2d13274e9a107d8a258a6067d1fc43f54";
+      sha512 = "0df4c498c99cce08903004d2e0f9e977a19f7de86240aa82dba179b60f1d67ca3021eb474f56bddc38035e773eeb5d99bb3e1b0756d9f7583dc8e1f747f477ba";
     };
 
     meta = {

pkgs/applications/networking/cluster/bosh-cli/default.nix

@@ -8,13 +8,13 @@
 buildGoModule rec {
   pname = "bosh-cli";
 
-  version = "7.7.0";
+  version = "7.7.1";
 
   src = fetchFromGitHub {
     owner = "cloudfoundry";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-z3nC9h8kSQYukIVrcdtUiGyHIUl5W6r43RC7l40Vlwo=";
+    sha256 = "sha256-Bs7bKB9P6TzlH4ztXFsQ1Q81nxNR5n6cuZ6Ap23nLUw=";
   };
   vendorHash = null;
 

pkgs/applications/networking/cluster/krelay/default.nix

@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "krelay";
-  version = "0.1.0";
+  version = "0.1.1";
 
   src = fetchFromGitHub {
     owner = "knight42";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-tZnHkjsAT8AOIpVDIiHnD6k/2S/S/+jM9uw18TaYJaA=";
+    hash = "sha256-MnIeWsFpxSpE01uZtfI8Mhg6TSI9quz2TDKaMmBYbR0=";
   };
 
-  vendorHash = "sha256-5lA7I/vrc6+XsiSCL61a/p7jbseLcJyXnOC5R/z85vQ=";
+  vendorHash = "sha256-N8r+C+j9hyAWdDXTzJgFNUfjL1mROr2KfyY0+XEdZVk=";
 
   subPackages = [ "cmd/client" ];
 

pkgs/applications/networking/cluster/openshift/default.nix

@@ -60,7 +60,7 @@ buildGoModule rec {
     description = "Build, deploy, and manage your applications with Docker and Kubernetes";
     homepage = "http://www.openshift.org";
     license = licenses.asl20;
-    maintainers = with maintainers; [ offline bachp moretea stehessel ];
+    maintainers = with maintainers; [ offline moretea stehessel ];
     mainProgram = "oc";
   };
 }

pkgs/applications/networking/cluster/prow/default.nix

@@ -1,68 +0,0 @@
-{ buildGoModule, fetchFromGitHub, lib }:
-
-buildGoModule rec {
-  pname = "prow-unstable";
-  version = "2020-04-01";
-  rev = "32e3b5ce7695fb622381421653db436cb57b47c5";
-
-  src = fetchFromGitHub {
-    inherit rev;
-
-    owner = "kubernetes";
-    repo = "test-infra";
-    hash = "sha256-ZNa7iAcN1qlBFT/UfziivW4q+9hjIt9WbHEOt6r1g1U=";
-  };
-
-  vendorHash = "sha256-FJO8KVCZLehaN1Eku6uQpj/vgwOyO+Irqs0qJHJhzZk=";
-
-  doCheck = false;
-
-  subPackages = [
-    "prow/cmd/admission"
-    "prow/cmd/branchprotector"
-    "prow/cmd/checkconfig"
-    "prow/cmd/clonerefs"
-    "prow/cmd/cm2kc"
-    "prow/cmd/config-bootstrapper"
-    "prow/cmd/crier"
-    "prow/cmd/deck"
-    "prow/cmd/entrypoint"
-    "prow/cmd/exporter"
-    "prow/cmd/gcsupload"
-    "prow/cmd/gerrit"
-    "prow/cmd/hook"
-    "prow/cmd/horologium"
-    "prow/cmd/initupload"
-    "prow/cmd/jenkins-operator"
-    "prow/cmd/mkbuild-cluster"
-    "prow/cmd/mkpj"
-    "prow/cmd/mkpod"
-    "prow/cmd/peribolos"
-    "prow/cmd/phaino"
-    "prow/cmd/phony"
-    "prow/cmd/pipeline"
-    "prow/cmd/plank"
-    "prow/cmd/sidecar"
-    "prow/cmd/sinker"
-    "prow/cmd/status-reconciler"
-    "prow/cmd/sub"
-    "prow/cmd/tackle"
-    "prow/cmd/tide"
-    "prow/cmd/tot"
-  ];
-
-  meta = with lib; {
-    description = "Kubernetes based CI/CD system";
-    longDescription = ''
-      Prow is a Kubernetes based CI/CD system. Jobs can be triggered by various
-      types of events and report their status to many different services. In
-      addition to job execution, Prow provides GitHub automation in the form of
-      policy enforcement, chat-ops via /foo style commands, and automatic PR
-      merging.
-    '';
-    homepage = "https://github.com/kubernetes/test-infra/tree/master/prow";
-    license = licenses.asl20;
-    maintainers = with maintainers; [ kalbasit ];
-    platforms = platforms.linux ++ platforms.darwin;
-  };
-}

pkgs/applications/networking/dnscontrol/default.nix

@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "dnscontrol";
-  version = "4.12.5";
+  version = "4.13.0";
 
   src = fetchFromGitHub {
     owner = "StackExchange";
     repo = "dnscontrol";
     rev = "v${version}";
-    hash = "sha256-xNbCKRAHs9xiZMLbsV6vcu8ga7WaGqZ+Dg4itTmRRr4=";
+    hash = "sha256-qDCt1Ld3xHPexpCv/0SbvQwGhWE46cVX3BJ0PoBsKcA=";
   };
 
-  vendorHash = "sha256-Zq/98A3FiOPySXqY83rboC39cLcwrk6AvBk8+XIPrT8=";
+  vendorHash = "sha256-qEIvxQ4PRtDWyIw3MWmyXV4HLraCLSglHivlV7UJ9jM=";
 
   nativeBuildInputs = [ installShellFiles ];
 

pkgs/applications/networking/mailreaders/notmuch/notmuch-mailmover.nix

@@ -6,23 +6,23 @@
 }:
 rustPlatform.buildRustPackage rec {
   pname = "notmuch-mailmover";
-  version = "0.2.0";
+  version = "0.3.0";
 
   src = fetchFromGitHub {
     owner = "michaeladler";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-12eDCqer13GJS0YjJDleJbkP4o7kZfof6HlLG06qZW0=";
+    hash = "sha256-b+6vQ7m49+9RQ+GA75VgOAJej/2zeu5JAje/OazsEsk=";
   };
 
-  cargoHash = "sha256-B5VSkhY4nNXSG2SeCl22pSkl6SXEEoYj99wEsNhs/bQ=";
+  cargoHash = "sha256-qHSmfR5iUBXq8OQJkGCVA4JnExXisN2OIAVKiVMUaZo=";
 
   nativeBuildInputs = [ installShellFiles ];
 
   buildInputs = [ notmuch ];
 
   postInstall = ''
-    installManPage share/notmuch-mailmover.1
+    installManPage share/notmuch-mailmover.1.gz
     installShellCompletion --cmd notmuch-mailmover \
       --bash share/notmuch-mailmover.bash \
       --fish share/notmuch-mailmover.fish \

pkgs/applications/science/logic/coq/default.nix

@@ -58,7 +58,7 @@ let
    "8.19.0".sha256   = "sha256-ixsYCvCXpBHqJ71hLQklphlwoOO3i/6w2PJjllKqf9k=";
    "8.19.1".sha256   = "sha256-kmZ8Uk8jpzjOd67aAPp3C+vU2oNaBw9pr7+Uixcgg94=";
    "8.19.2".sha256   = "sha256-q+i07JsMZp83Gqav6v1jxsgPLN7sPvp5/oszVnavmz0=";
-   "8.20+rc1".sha256 = "sha256-OLGPMvvA3hc42zdgWSOnOkN0/WwzBpneUcUVRNcNVms=";
+   "8.20.0".sha256   = "sha256-WFpZlA6CzFVAruPhWcHQI7VOBVhrGLdFzWrHW0DTSl0=";
   };
   releaseRev = v: "V${v}";
   fetched = import ../../../../build-support/coq/meta-fetch/default.nix

pkgs/applications/science/molecular-dynamics/lammps/default.nix

@@ -46,14 +46,14 @@
 stdenv.mkDerivation (finalAttrs: {
   # LAMMPS has weird versioning convention. Updates should go smoothly with:
   # nix-update --commit lammps --version-regex 'stable_(.*)'
-  version = "2Aug2023_update4";
+  version = "29Aug2024";
   pname = "lammps";
 
   src = fetchFromGitHub {
     owner = "lammps";
     repo = "lammps";
     rev = "stable_${finalAttrs.version}";
-    hash = "sha256-4y41kRO1iKFoCDVe6Dap4njcFa3z+9acKomoxOL7ipI=";
+    hash = "sha256-UySWbJPubl318IA2MeTrz3Ya+9YyVOeR/Fs4aYI1R2o=";
   };
   preConfigure = ''
     cd cmake

pkgs/applications/version-management/jujutsu/default.nix

@@ -20,24 +20,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "jujutsu";
-  version = "0.20.0";
+  version = "0.21.0";
 
   src = fetchFromGitHub {
     owner = "martinvonz";
     repo = "jj";
     rev = "v${version}";
-    hash = "sha256-1lONtpataRi0yE6LpN6oNnC3OAW918v8GFCUwinYJWI=";
+    hash = "sha256-uZsfHhcYpobatWaDQczuc9Z3BWHN5VO0qr/8mu5kEio=";
   };
 
-  cargoPatches = [
-    # cargo: bump `git2` to 0.19.0
-    (fetchpatch2 {
-      url = "https://github.com/martinvonz/jj/commit/38f6ee89183d886e432472c5888908c9900c9c18.patch?full_index=1";
-      hash = "sha256-BVcak7uIEhwoO0f9hf0GVKKSVmp/ueKD5C9F8J0iL3w=";
-    })
-  ];
-
-  cargoHash = "sha256-FxcvLT0YnXcjDCKxuyijYsVSMLjx1glDzmFH5ctSx6s=";
+  cargoHash = "sha256-BOO1jP1Y5CNbE97zj+tpariiBdcuxKb1wyvI7i/VpYI=";
 
   cargoBuildFlags = [ "--bin" "jj" ]; # don't install the fake editors
   useNextest = false; # nextest is the upstream integration framework, but is problematic for test skipping

pkgs/applications/virtualization/cri-o/default.nix

@@ -15,13 +15,13 @@
 
 buildGoModule rec {
   pname = "cri-o";
-  version = "1.30.4";
+  version = "1.30.5";
 
   src = fetchFromGitHub {
     owner = "cri-o";
     repo = "cri-o";
     rev = "v${version}";
-    hash = "sha256-PfG5RlUmMGMduTApdlHoI+4kdRprvWXeXZDkd6brVkM=";
+    hash = "sha256-snhuV4hqbqMJK8Fg6vJGJoQ3heCFULK1iIQQB65kiR0=";
   };
   vendorHash = null;
 

pkgs/applications/virtualization/qemu/default.nix

@@ -296,7 +296,7 @@ stdenv.mkDerivation (finalAttrs: {
     homepage = "https://www.qemu.org/";
     description = "Generic and open source machine emulator and virtualizer";
     license = licenses.gpl2Plus;
-    maintainers = with maintainers; [ qyliss ];
+    maintainers = with maintainers; [ qyliss ] ++ lib.optionals xenSupport xen.meta.maintainers;
     platforms = platforms.unix;
   }
   # toolsOnly: Does not have qemu-kvm and there's no main support tool

pkgs/applications/virtualization/runc/default.nix

@@ -14,13 +14,13 @@
 
 buildGoModule rec {
   pname = "runc";
-  version = "1.1.13";
+  version = "1.1.14";
 
   src = fetchFromGitHub {
     owner = "opencontainers";
     repo = "runc";
     rev = "v${version}";
-    hash = "sha256-RQsM8Q7HogDVGbNpen3wxXNGR9lfqmNhkXTRoC+LBk8=";
+    hash = "sha256-7PYbSZqCQLTaeFppuNz5mxDlwEyLkA5zpdMhWy1tWmc=";
   };
 
   vendorHash = null;

pkgs/applications/window-managers/weston/default.nix

@@ -1,10 +1,9 @@
 { lib, stdenv, fetchurl
 , meson, ninja, pkg-config, python3, wayland-scanner
-, cairo, libGL, libdrm, libevdev, libinput, libxkbcommon, mesa, seatd, wayland
-, wayland-protocols, xcbutilcursor
+, cairo, libGL, libdisplay-info, libdrm, libevdev, libinput, libxkbcommon, mesa
+, seatd, wayland, wayland-protocols, xcbutilcursor
 
 , demoSupport ? true
-, hdrSupport ? true, libdisplay-info
 , jpegSupport ? true, libjpeg
 , lcmsSupport ? true, lcms2
 , pangoSupport ? true, pango
@@ -19,27 +18,19 @@
 
 stdenv.mkDerivation rec {
   pname = "weston";
-  version = "13.0.3";
+  version = "14.0.0";
 
   src = fetchurl {
     url = "https://gitlab.freedesktop.org/wayland/weston/-/releases/${version}/downloads/weston-${version}.tar.xz";
-    hash = "sha256-J/aNluO5fZjare8TogI1ZSSST6OBQY+mcWuRNu8JkJM=";
+    hash = "sha256-R/0DJbC5SOmwA6OP306zqFgfP9x0C4kys1roeTv05KU=";
   };
 
-  postPatch = ''
-    # raise neatvnc version bound to < 0.9.0
-    # https://gitlab.freedesktop.org/wayland/weston/-/issues/890
-    substituteInPlace libweston/backend-vnc/meson.build \
-      --replace-fail "'neatvnc', version: ['>= 0.7.0', '< 0.8.0']" "'neatvnc', version: ['>= 0.7.0', '< 0.9.0']"
-  '';
-
   depsBuildBuild = [ pkg-config ];
   nativeBuildInputs = [ meson ninja pkg-config python3 wayland-scanner ];
   buildInputs = [
-    cairo libGL libdrm libevdev libinput libxkbcommon mesa seatd wayland
-    wayland-protocols
-  ] ++ lib.optional hdrSupport libdisplay-info
-    ++ lib.optional jpegSupport libjpeg
+    cairo libGL libdisplay-info libdrm libevdev libinput libxkbcommon mesa seatd
+    wayland wayland-protocols
+  ] ++ lib.optional jpegSupport libjpeg
     ++ lib.optional lcmsSupport lcms2
     ++ lib.optional pangoSupport pango
     ++ lib.optional pipewireSupport pipewire

pkgs/build-support/dotnet/build-dotnet-module/default.nix

@@ -147,6 +147,8 @@ let
       dotnetUseAppHost = useAppHost;
       inherit useDotnetFromEnv;
 
+      inherit enableParallelBuilding;
+
       nativeBuildInputs = args.nativeBuildInputs or [ ] ++ [
         dotnetConfigureHook
         dotnetBuildHook

pkgs/build-support/node/fetch-yarn-deps/default.nix

@@ -2,9 +2,14 @@
   stdenv,
   lib,
   makeWrapper,
+  installShellFiles,
+  nodejsInstallManuals,
+  nodejsInstallExecutables,
   coreutils,
   nix-prefetch-git,
   fetchurl,
+  jq,
+  nodejs,
   nodejs-slim,
   prefetch-yarn-deps,
   fixup-yarn-lock,
@@ -175,4 +180,16 @@ in
       description = "Run yarn build in buildPhase";
     };
   } ./yarn-build-hook.sh;
+
+  yarnInstallHook = makeSetupHook {
+    name = "yarn-install-hook";
+    propagatedBuildInputs = [
+      yarn
+      nodejsInstallManuals
+      nodejsInstallExecutables
+    ];
+    substitutions = {
+      jq = lib.getExe jq;
+    };
+  } ./yarn-install-hook.sh;
 }

pkgs/build-support/node/fetch-yarn-deps/yarn-install-hook.sh

@@ -0,0 +1,79 @@
+# shellcheck shell=bash
+
+yarnInstallHook() {
+    echo "Executing yarnInstallHook"
+
+    runHook preInstall
+
+    local -r packageOut="$out/lib/node_modules/$(@jq@ --raw-output '.name' ./package.json)"
+    mkdir -p "$packageOut"
+
+    local -ar yarnArgs=(
+        --ignore-engines
+        --ignore-platform
+        --ignore-scripts
+        --no-progress
+        --non-interactive
+        --offline
+    )
+
+    local -r tmpDir="$(mktemp -d yarnInstallHook.XXXXXX)"
+
+    # yarn pack does not work at all with bundleDependencies.
+    # Since we are imediately unpacking, we can just remove them from package.json
+    # This will NOT be fixed in yarn v1: https://github.com/yarnpkg/yarn/issues/6794
+    mv ./package.json "$tmpDir/package.json.orig"
+    # Note: two spellings are accepted, 'bundleDependencies' and 'bundledDependencies'
+    @jq@ 'del(.bundleDependencies)|del(.bundledDependencies)' "$tmpDir/package.json.orig" > ./package.json
+
+    # TODO: figure out a way to avoid redundant compress/decompress steps
+    yarn pack \
+        --filename "$tmpDir/yarn-pack.tgz" \
+        "${yarnArgs[@]}"
+
+    tar xzf "$tmpDir/yarn-pack.tgz" \
+        -C "$packageOut" \
+        --strip-components 1 \
+        package/
+
+    mv "$tmpDir/package.json.orig" ./package.json
+
+    nodejsInstallExecutables ./package.json
+
+    nodejsInstallManuals ./package.json
+
+    local -r nodeModulesPath="$packageOut/node_modules"
+
+    if [ ! -d "$nodeModulesPath" ]; then
+        if [ -z "${yarnKeepDevDeps-}" ]; then
+            # Yarn has a 'prune' command, but it's only a stub that directs you to use install
+            if ! yarn install \
+                --frozen-lockfile \
+                --force \
+                --production=true \
+                "${yarnArgs[@]}"
+            then
+              echo
+              echo
+              echo "ERROR: yarn prune step failed"
+              echo
+              echo 'If yarn tried to download additional dependencies above, try setting `yarnKeepDevDeps = true`.'
+              echo
+
+              exit 1
+            fi
+        fi
+
+        find node_modules -maxdepth 1 -type d -empty -delete
+
+        cp -r node_modules "$nodeModulesPath"
+    fi
+
+    runHook postInstall
+
+    echo "Finished yarnInstallHook"
+}
+
+if [ -z "${dontYarnInstall-}" ] && [ -z "${installPhase-}" ]; then
+    installPhase=yarnInstallHook
+fi

pkgs/by-name/ae/aerc/package.nix

@@ -1,6 +1,7 @@
 { lib
 , buildGoModule
 , fetchFromSourcehut
+, fetchpatch
 , ncurses
 , notmuch
 , scdoc
@@ -31,6 +32,12 @@ buildGoModule rec {
 
   patches = [
     ./runtime-libexec.patch
+
+    # patch to fix a encoding problem with gpg signed messages
+    (fetchpatch {
+      url ="https://git.sr.ht/~rjarry/aerc/commit/7346d20.patch";
+      hash = "sha256-OCm8BcovYN2IDSgslZklQxkGVkSYQ8HLCrf2+DRB2mM=";
+    })
   ];
 
   postPatch = ''

pkgs/by-name/ar/artalk/package.nix

@@ -11,22 +11,22 @@
 }:
 buildGoModule rec {
   pname = "artalk";
-  version = "2.8.7";
+  version = "2.9.0";
 
   src = fetchFromGitHub {
     owner = "ArtalkJS";
     repo = "artalk";
     rev = "refs/tags/v${version}";
-    hash = "sha256-fOuZiFomXGvRUXkpEM3BpJyMOtSm6/RHd0a7dPOsoT4=";
+    hash = "sha256-5tUUlkGeT4kY/81EQ29M6z+JnBT4YCa8gecbV9WMuDo=";
   };
   web = fetchurl {
     url = "https://github.com/${src.owner}/${src.repo}/releases/download/v${version}/artalk_ui.tar.gz";
-    hash = "sha256-3Rg5mCFigLkZ+X8Fxe6A16THd9j6hcTYMEAKU1SrLMw=";
+    hash = "sha256-Cx3fDpnl52kwILzH9BBLfsWe5qEbIl/ecJd1wJEB/Hc=";
   };
 
   CGO_ENABLED = 1;
 
-  vendorHash = "sha256-Hm388ub/ja3PuSRqPkr6A+pgKUQ+czMj1WKU8W8H5wI=";
+  vendorHash = "sha256-edqmv/Q99pgnScJqCmLwjHd7uKMNPGfCSujNTUQtpLc=";
 
   ldflags = [
     "-s"

pkgs/by-name/bc/bcc/package.nix

@@ -13,12 +13,12 @@
 , makeWrapper
 , netperf
 , nixosTests
-, python3
+, python3Packages
 , stdenv
 , zip
 }:
 
-python3.pkgs.buildPythonApplication rec {
+python3Packages.buildPythonApplication rec {
   pname = "bcc";
   version = "0.31.0";
 
@@ -44,14 +44,14 @@ python3.pkgs.buildPythonApplication rec {
     ./fix-deadlock-detector-import.patch
   ];
 
-  propagatedBuildInputs = [ python3.pkgs.netaddr ];
+  propagatedBuildInputs = [ python3Packages.netaddr ];
   nativeBuildInputs = [
     bison
     cmake
     flex
     llvmPackages.llvm.dev
     makeWrapper
-    python3.pkgs.setuptools
+    python3Packages.setuptools
     zip
   ];
 
@@ -82,7 +82,7 @@ python3.pkgs.buildPythonApplication rec {
 
   preInstall = ''
     # required for setuptool during install
-    export PYTHONPATH=$out/${python3.sitePackages}:$PYTHONPATH
+    export PYTHONPATH=$out/${python3Packages.python.sitePackages}:$PYTHONPATH
   '';
   postInstall = ''
     mkdir -p $out/bin $out/share

pkgs/by-name/bl/blade-formatter/package.nix

@@ -1,33 +1,44 @@
 {
+  stdenvNoCC,
   lib,
-  buildNpmPackage,
   fetchFromGitHub,
+  fetchYarnDeps,
+  yarnConfigHook,
+  yarnBuildHook,
+  yarnInstallHook,
+  nodejs,
+  nix-update-script,
   testers,
   writeText,
   runCommand,
   blade-formatter,
-  nodejs,
 }:
 
-buildNpmPackage rec {
+stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "blade-formatter";
   version = "1.41.1";
 
   src = fetchFromGitHub {
     owner = "shufo";
     repo = "blade-formatter";
-    rev = "v${version}";
+    rev = "v${finalAttrs.version}";
     hash = "sha256-iaWpIa+H+ocAXGc042PfmCu9UcJZeso9ripWB2/1oTs=";
   };
 
-  postPatch = ''
-    cp ${./package-lock.json} ./package-lock.json
-  '';
+  yarnOfflineCache = fetchYarnDeps {
+    yarnLock = finalAttrs.src + "/yarn.lock";
+    hash = "sha256-zn0PgLIWk23EhYeOKF2RkpvLOusVrqoBazKcJpIAzm8=";
+  };
 
-  npmDepsHash = "sha256-wEz0DTbg+Fdmsf0Qyeu9QS+I8gkPJeaJC/3HuP913og=";
+  nativeBuildInputs = [
+    yarnConfigHook
+    yarnBuildHook
+    yarnInstallHook
+    nodejs
+  ];
 
   passthru = {
-    updateScript = ./update.sh;
+    updateScript = nix-update-script { };
     tests = {
       version = testers.testVersion {
         package = blade-formatter;
@@ -64,4 +75,4 @@ buildNpmPackage rec {
     mainProgram = "blade-formatter";
     inherit (nodejs.meta) platforms;
   };
-}
+})

pkgs/by-name/bl/blade-formatter/update.sh

@@ -1,38 +0,0 @@
-#!/usr/bin/env nix-shell
-#!nix-shell -i bash -p ripgrep common-updater-scripts prefetch-npm-deps jq sd
-
-set -xeu -o pipefail
-
-PACKAGE_DIR="$(realpath "$(dirname "$0")")"
-cd "$PACKAGE_DIR/.."
-while ! test -f default.nix; do cd .. ; done
-NIXPKGS_DIR="$PWD"
-
-new_version="$(
-  list-git-tags --url=https://github.com/shufo/blade-formatter \
-  | rg '^v([\d.]*)' -r '$1' \
-  | sort --version-sort \
-  | tail -n1
-)"
-
-cd "$NIXPKGS_DIR"
-update-source-version blade-formatter "$new_version"
-
-TMPDIR="$(mktemp -d)"
-cd "$TMPDIR"
-
-src="$(nix-build --no-link "$NIXPKGS_DIR" -A blade-formatter.src)"
-cp $src/package.json .
-npm update
-cp ./package-lock.json "$PACKAGE_DIR"
-
-prev_npm_hash="$(nix-instantiate "$NIXPKGS_DIR" \
-  --eval --json \
-  -A blade-formatter.npmDepsHash \
-  | jq -r .
-)"
-new_npm_hash="$(prefetch-npm-deps ./package-lock.json)"
-
-sd --fixed-strings "$prev_npm_hash" "$new_npm_hash" "$PACKAGE_DIR/package.nix"
-
-rm -rf "$TMPDIR"

pkgs/by-name/cl/cloudflare-dynamic-dns/package.nix

@@ -0,0 +1,43 @@
+{
+  lib,
+  buildGoModule,
+  cloudflare-dynamic-dns,
+  fetchFromGitHub,
+  testers,
+}:
+buildGoModule rec {
+  pname = "cloudflare-dynamic-dns";
+  version = "4.3.2";
+
+  src = fetchFromGitHub {
+    owner = "zebradil";
+    repo = "cloudflare-dynamic-dns";
+    rev = "refs/tags/${version}";
+    hash = "sha256-SuDiR/saqxgfnEku31tjAtahWNg+5wFriD0F2FPkEEo=";
+  };
+
+  vendorHash = "sha256-vHlBZOeJ0oZZ4zjy4UycbdiMGzEpGRqT7v3q0hDz28M=";
+
+  subPackages = ".";
+
+  ldflags = [
+    "-s"
+    "-w"
+    "-X=main.version=${version}"
+    "-X=main.commit=nixpkg-${version}"
+    "-X=main.date=1970-01-01"
+  ];
+
+  CGO_ENABLED = 0;
+
+  passthru.tests.version = testers.testVersion { package = cloudflare-dynamic-dns; };
+
+  meta = with lib; {
+    changelog = "https://github.com/Zebradil/cloudflare-dynamic-dns/blob/${version}/CHANGELOG.md";
+    description = "Dynamic DNS client for Cloudflare";
+    homepage = "https://github.com/Zebradil/cloudflare-dynamic-dns";
+    license = licenses.mit;
+    mainProgram = "cloudflare-dynamic-dns";
+    maintainers = [ maintainers.zebradil ];
+  };
+}

pkgs/by-name/co/codefresh/package.nix

@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchFromGitHub, fetchYarnDeps, yarnConfigHook, npmHooks, nodejs, testers }:
+{ lib, stdenv, fetchFromGitHub, fetchYarnDeps, yarnConfigHook, yarnInstallHook, nodejs, testers }:
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "codefresh";
@@ -17,11 +17,9 @@ stdenv.mkDerivation (finalAttrs: {
   };
   nativeBuildInputs = [
     yarnConfigHook
-    npmHooks.npmInstallHook
+    yarnInstallHook
     nodejs
   ];
-  # Tries to fetch stuff from the internet
-  dontNpmPrune = true;
 
   passthru.tests.version = testers.testVersion {
     package = finalAttrs.finalPackage;

pkgs/by-name/co/conduwuit/package.nix

@@ -0,0 +1,107 @@
+{
+  lib,
+  rustPlatform,
+  fetchFromGitHub,
+  pkg-config,
+  bzip2,
+  zstd,
+  stdenv,
+  darwin,
+  rocksdb,
+  nix-update-script,
+  testers,
+  conduwuit,
+  # upstream conduwuit enables jemalloc by default, so we follow suit
+  enableJemalloc ? true,
+  rust-jemalloc-sys,
+  enableLiburing ? stdenv.isLinux,
+  liburing,
+}:
+let
+  rust-jemalloc-sys' = rust-jemalloc-sys.override {
+    unprefixed = !stdenv.isDarwin;
+  };
+  rocksdb' = rocksdb.override {
+    inherit enableLiburing;
+    # rocksdb does not support prefixed jemalloc, which is required on darwin
+    enableJemalloc = enableJemalloc && !stdenv.isDarwin;
+    jemalloc = rust-jemalloc-sys';
+  };
+in
+rustPlatform.buildRustPackage rec {
+  pname = "conduwuit";
+  version = "0.4.6";
+
+  src = fetchFromGitHub {
+    owner = "girlbossceo";
+    repo = "conduwuit";
+    rev = "v${version}";
+    hash = "sha256-ut3IWEueNR/hT7NyGfuK5IYtppC6ArSoJdEfFuD/0vE=";
+  };
+
+  cargoLock = {
+    lockFile = ./Cargo.lock;
+    outputHashes = {
+      "ruma-0.10.1" = "sha256-u4C2VwRBmw8iVaPrkSmF/EKi5U3nWJWVktUDFmQcI1E=";
+      "rust-librocksdb-sys-0.25.0+9.5.2" = "sha256-wz6QDLoXtY8+EU2DlPf4MbWC67KJK0hZnRswCeomkLQ=";
+      "rustyline-async-0.4.3" = "sha256-7yYOGZ14SODD4+e9fTGgggUKqTi31479S0lEVKTKLPI=";
+      "tikv-jemalloc-ctl-0.6.0" = "sha256-guiH6Gw/Oeb6A8Ri1SFcB6CW6mt+9XeA6vfwdS72yDQ=";
+      "tracing-0.1.40" = "sha256-J6+8hBC/755SU8n1fTiJwBh17Unluv1SXfd5+dDAEhk=";
+    };
+  };
+
+  nativeBuildInputs = [
+    pkg-config
+    rustPlatform.bindgenHook
+  ];
+
+  buildInputs =
+    [
+      bzip2
+      zstd
+    ]
+    ++ lib.optional enableJemalloc rust-jemalloc-sys'
+    ++ lib.optional enableLiburing liburing
+    ++ lib.optionals stdenv.isDarwin [
+      darwin.apple_sdk.frameworks.Security
+    ];
+
+  env = {
+    ZSTD_SYS_USE_PKG_CONFIG = true;
+    ROCKSDB_INCLUDE_DIR = "${rocksdb'}/include";
+    ROCKSDB_LIB_DIR = "${rocksdb'}/lib";
+  };
+
+  buildNoDefaultFeatures = true;
+  # See https://github.com/girlbossceo/conduwuit/blob/main/src/main/Cargo.toml
+  # for available features.
+  # We enable all default features except jemalloc and io_uring, which
+  # we guard behind our own (default-enabled) flags.
+  buildFeatures = [
+    "brotli_compression"
+    "element_hacks"
+    "gzip_compression"
+    "release_max_log_level"
+    "sentry_telemetry"
+    "systemd"
+    "zstd_compression"
+  ] ++ lib.optional enableJemalloc "jemalloc" ++ lib.optional enableLiburing "io_uring";
+
+  passthru = {
+    updateScript = nix-update-script { };
+    tests.version = testers.testVersion {
+      package = conduwuit;
+      version = "${version}";
+    };
+  };
+
+  meta = {
+    description = "Matrix homeserver written in Rust, forked from conduit";
+    homepage = "https://conduwuit.puppyirl.gay/";
+    changelog = "https://github.com/girlbossceo/conduwuit/releases/tag/v${version}";
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ niklaskorz ];
+    # Not a typo, conduwuit is a drop-in replacement for conduit.
+    mainProgram = "conduit";
+  };
+}

pkgs/by-name/co/container-structure-test/package.nix

@@ -4,24 +4,24 @@
   fetchurl,
 }:
 let
-  version = "v1.18.1";
+  version = "v1.19.1";
 
   sources = {
     x86_64-linux = {
       url = "https://github.com/GoogleContainerTools/container-structure-test/releases/download/${version}/container-structure-test-linux-amd64";
-      hash = "sha256-vnZsdjRix3P7DpDz00WUTbNBLQIFPKzfUbVbxn+1ygM=";
+      hash = "sha256-7KScpej6Km4fuv6XJez4frLwXUm91lII2RLLT71YRrs=";
     };
     aarch64-linux = {
       url = "https://github.com/GoogleContainerTools/container-structure-test/releases/download/${version}/container-structure-test-linux-arm64";
-      hash = "sha256-/YPAeh/Ad2YVdZ/irpgikQST0uWITWYQOB4qI54aPlY=";
+      hash = "sha256-5MyjOzbDPrV5R3ldJCINipJPOILCzx8+xBVO4bxq9ic=";
     };
     x86_64-darwin = {
       url = "https://github.com/GoogleContainerTools/container-structure-test/releases/download/${version}/container-structure-test-darwin-amd64";
-      hash = "sha256-tJ1gMnQ7d6du65fnw5GV425kWl/3jLwcqj3gIHHuOyU=";
+      hash = "sha256-2QwyKvgzOdGOEuZVwntCpBGBk0JnOLpYOoEYp48qB/I=";
     };
     aarch64-darwin = {
       url = "https://github.com/GoogleContainerTools/container-structure-test/releases/download/${version}/container-structure-test-darwin-arm64";
-      hash = "sha256-cNSb3nhSGU9q/PJDNdEeV/hlCXAdXkaV6SROdXnXjp0=";
+      hash = "sha256-x3RmVdDFmHoGOqX49OWeAab/6m1U0jq/g/30rNjj5aI=";
     };
   };
 in

pkgs/by-name/co/cosmic-bg/package.nix

@@ -30,7 +30,7 @@ rustPlatform.buildRustPackage rec {
   };
 
   postPatch = ''
-    substituteInPlace justfile --replace '#!/usr/bin/env' "#!$(command -v env)"
+    substituteInPlace justfile --replace-fail '#!/usr/bin/env' "#!$(command -v env)"
   '';
 
   nativeBuildInputs = [ just pkg-config makeBinaryWrapper ];

pkgs/by-name/co/cosmic-icons/package.nix

@@ -8,12 +8,12 @@
 }:
 stdenvNoCC.mkDerivation rec {
   pname = "cosmic-icons";
-  version = "0-unstable-2024-08-04";
+  version = "1.0.0-alpha.1-unstable-2024-08-16";
 
   src = fetchFromGitHub {
     owner = "pop-os";
     repo = pname;
-    rev = "f93dcdfa1060c2cf3f8cf0b56b0338292edcafa5";
+    rev = "ea9e3b8cf12bfa7112b8be8390c0185888358504";
     sha256 = "sha256-KvEKFmsh7ljt9JbaqyZfTUiFZHZM2Ha1TwUDljXXLDw=";
   };
 

pkgs/by-name/cp/cpu-x/package.nix

@@ -1,12 +1,35 @@
-{ lib, stdenv, fetchFromGitHub, cmake, pkg-config, gtk3, ncurses
-, libcpuid, pciutils, procps, wrapGAppsHook3, nasm, makeWrapper
-, opencl-headers, ocl-icd
-, vulkan-headers, vulkan-loader, glfw
-, libXdmcp, pcre, util-linux
-, libselinux, libsepol
-, libthai, libdatrie, libxkbcommon, libepoxy
-, dbus, at-spi2-core
-, libXtst
+{
+  lib,
+  testers,
+  stdenv,
+  fetchFromGitHub,
+  cmake,
+  pkg-config,
+  gtk3,
+  ncurses,
+  libcpuid,
+  pciutils,
+  procps,
+  wrapGAppsHook3,
+  nasm,
+  opencl-headers,
+  ocl-icd,
+  vulkan-headers,
+  vulkan-loader,
+  glfw,
+  libXdmcp,
+  pcre,
+  util-linux,
+  libselinux,
+  libsepol,
+  libthai,
+  libdatrie,
+  libxkbcommon,
+  libepoxy,
+  dbus,
+  at-spi2-core,
+  libXtst,
+  gtkmm3,
 }:
 
 # Known issues:
@@ -14,41 +37,69 @@
 #   registered in /etc/shells. The nix's bash is not in there when running
 #   cpu-x from nixpkgs.
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "cpu-x";
   version = "5.0.4";
 
   src = fetchFromGitHub {
     owner = "X0rg";
     repo = "CPU-X";
-    rev = "v${version}";
-    sha256 = "sha256-8jJP0gxH3B6qLrhKNa4P9ZfSjxaXTeBB1+UuadflLQo=";
+    rev = "refs/tags/v${finalAttrs.version}";
+    hash = "sha256-8jJP0gxH3B6qLrhKNa4P9ZfSjxaXTeBB1+UuadflLQo=";
   };
 
-  nativeBuildInputs = [ cmake pkg-config wrapGAppsHook3 nasm makeWrapper ];
+  nativeBuildInputs = [
+    cmake
+    pkg-config
+    wrapGAppsHook3
+    nasm
+  ];
+
   buildInputs = [
-    gtk3 ncurses libcpuid pciutils procps
-    vulkan-headers vulkan-loader glfw
-    opencl-headers ocl-icd
-    libXdmcp pcre util-linux
-    libselinux libsepol
-    libthai libdatrie libxkbcommon libepoxy
-    dbus at-spi2-core
+    gtk3
+    gtkmm3
+    ncurses
+    libcpuid
+    pciutils
+    procps
+    vulkan-headers
+    vulkan-loader
+    glfw
+    opencl-headers
+    ocl-icd
+    libXdmcp
+    pcre
+    util-linux
+    libselinux
+    libsepol
+    libthai
+    libdatrie
+    libxkbcommon
+    libepoxy
+    dbus
+    at-spi2-core
     libXtst
   ];
 
-  postInstall = ''
-    wrapProgram $out/bin/cpu-x \
-      --prefix PATH : ${lib.makeBinPath [ stdenv.cc ]} \
+  preFixup = ''
+    gappsWrapperArgs+=(
+      --prefix PATH : ${lib.makeBinPath [ stdenv.cc ]}
       --prefix LD_LIBRARY_PATH : ${vulkan-loader}/lib
+    )
   '';
 
-  meta = with lib; {
+  passthru = {
+    tests = {
+      version = testers.testVersion { package = finalAttrs.finalPackage; };
+    };
+  };
+
+  meta = {
     description = "Free software that gathers information on CPU, motherboard and more";
     mainProgram = "cpu-x";
     homepage = "https://thetumultuousunicornofdarkness.github.io/CPU-X";
-    license = licenses.gpl3Plus;
+    license = lib.licenses.gpl3Plus;
     platforms = [ "x86_64-linux" ];
-    maintainers = with maintainers; [ viraptor ];
+    maintainers = with lib.maintainers; [ viraptor ];
   };
-}
+})

pkgs/by-name/di/disko/package.nix

@@ -10,12 +10,12 @@
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "disko";
-  version = "1.6.1";
+  version = "1.7.0";
   src = fetchFromGitHub {
     owner = "nix-community";
     repo = "disko";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-5CNvkH0Nf7yMwgKhjUNg/lUK40C7DXB4zKOuA2jVO90=";
+    hash = "sha256-tqoAO8oT6zEUDXte98cvA1saU9+1dLJQe3pMKLXv8ps=";
   };
   nativeBuildInputs = [ makeWrapper ];
   buildInputs = [ bash ];

pkgs/by-name/dm/dms/package.nix

@@ -0,0 +1,28 @@
+{
+  lib,
+  buildGoModule,
+  fetchFromGitHub,
+}:
+
+buildGoModule rec {
+  pname = "dms";
+  version = "1.6.0";
+
+  src = fetchFromGitHub {
+    owner = "anacrolix";
+    repo = "dms";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-QwRLNCXDu/dKh2o17AyASlVQPIEOX6e4kTINa2ZzZkU=";
+  };
+
+  vendorHash = "sha256-Z0DoVmL0zJ4l9hrO+zGp6FcExvhbiPu5+N3Mfyxi5DE=";
+
+  meta = {
+    homepage = "https://github.com/anacrolix/dms";
+    description = "UPnP DLNA Digital Media Server with basic video transcoding";
+    license = lib.licenses.bsd3;
+    maintainers = [ lib.maintainers.claes ];
+    platforms = lib.platforms.linux;
+    mainProgram = "dms";
+  };
+}

pkgs/by-name/du/duckstation/package.nix

@@ -76,6 +76,9 @@ stdenv.mkDerivation (finalAttrs: {
       substituteAllInPlace src/scmversion/gen_scmversion.sh
   '';
 
+  # error: cannot convert 'int16x8_t' to '__Int32x4_t'
+  env.NIX_CFLAGS_COMPILE = lib.optionalString stdenv.hostPlatform.isAarch64 "-flax-vector-conversions";
+
   installCheckPhase = ''
     runHook preCheck
 

pkgs/by-name/ek/eksctl/package.nix

@@ -6,16 +6,16 @@
 
 buildGoModule rec {
   pname = "eksctl";
-  version = "0.189.0";
+  version = "0.190.0";
 
   src = fetchFromGitHub {
     owner = "weaveworks";
     repo = pname;
     rev = version;
-    hash = "sha256-YG1p7T2K1b3LO2MiTkCC88ZpgCpVTSCBUoCEcJK+V7I=";
+    hash = "sha256-IEe0NDl8Z1XBvfy/2cwL+O/RYGFS6VXd2ZUpyhEdaGs=";
   };
 
-  vendorHash = "sha256-W7tAdImEsPWSQkK8FnXgx5ADZ2JOdVc2xNBkNM11FOw=";
+  vendorHash = "sha256-mdGkdiYjcmsmYnM6fbyUeTC4Zb/Q1+geZrqJELv5i+4=";
 
   doCheck = false;
 

pkgs/by-name/el/element-call/package.nix

@@ -4,8 +4,8 @@
 , fetchYarnDeps
 , yarnConfigHook
 , yarnBuildHook
+, yarnInstallHook
 , nodejs
-, npmHooks
 }:
 
 let
@@ -37,12 +37,9 @@ stdenv.mkDerivation (finalAttrs: {
   nativeBuildInputs = [
     yarnConfigHook
     yarnBuildHook
+    yarnInstallHook
     nodejs
-    npmHooks.npmInstallHook
   ];
-  # From some reason causes the build to fail due to dependencies not available
-  # offline
-  dontNpmPrune = true;
 
   meta = with lib; {
     homepage = "https://github.com/element-hq/element-call";

pkgs/by-name/fe/feishin/package.nix

@@ -11,13 +11,13 @@
 }:
 let
   pname = "feishin";
-  version = "0.7.3";
+  version = "0.8.0";
 
   src = fetchFromGitHub {
     owner = "jeffvli";
     repo = "feishin";
     rev = "v${version}";
-    hash = "sha256-UOY0wjWGK7sal/qQbbkHjFUIA49QtbO+Ei6hSTOyHWk=";
+    hash = "sha256-KaZA7ZAeN6f1PWMeUl0Z4Xl/S/uD2vLPHM5uM+dIbko=";
   };
 
   electron = electron_31;
@@ -26,7 +26,7 @@ buildNpmPackage {
   inherit pname version;
 
   inherit src;
-  npmDepsHash = "sha256-FLo8FCpxvh2Iqd3pkpgwRZ4f2viX4iET64VAuXN362g=";
+  npmDepsHash = "sha256-1BG4U6x+e204KdrIh0S/rrdj/3wh2iuuWQgFXLjO3iw=";
 
   npmFlags = [ "--legacy-peer-deps" ];
   makeCacheWritable = true;
@@ -60,7 +60,7 @@ buildNpmPackage {
         inherit version;
 
         src = "${src}/release/app";
-        npmDepsHash = "sha256-fQV2yqyNZCjeNUekBaXUsND2lIZYYz07YQ6TGoFxT9Q=";
+        npmDepsHash = "sha256-//K8jiO3nEHs08l9eMDW2HnZBeBgxBMai2omoCI7wQw=";
 
         npmFlags = [ "--ignore-scripts" ];
         dontNpmBuild = true;

pkgs/by-name/fl/flake-edit/package.nix

@@ -0,0 +1,57 @@
+{
+  lib,
+  rustPlatform,
+  fetchFromGitHub,
+  pkg-config,
+  openssl,
+  stdenv,
+  installShellFiles,
+  darwin,
+}:
+
+rustPlatform.buildRustPackage rec {
+  pname = "flake-edit";
+  version = "0.1.0";
+
+  src = fetchFromGitHub {
+    owner = "a-kenji";
+    repo = "flake-edit";
+    rev = "v${version}";
+    hash = "sha256-dNTvAYBVZLeDlC1bsaonwojE7+1CD16/sCxtQVvT9WE=";
+  };
+
+  cargoHash = "sha256-ipLjbfnNqrUUD40awRnE8URX5pHhG4SwUM9JedoBM8Y=";
+
+  nativeBuildInputs = [
+    installShellFiles
+    pkg-config
+  ];
+
+  buildInputs =
+    [
+      openssl
+    ]
+    ++ lib.optionals stdenv.isDarwin [
+      darwin.apple_sdk.frameworks.Security
+      darwin.apple_sdk.frameworks.SystemConfiguration
+    ];
+
+  env.ASSET_DIR = "target/assets";
+
+  postInstall = ''
+    installManPage target/assets/flake-edit.1
+
+    installShellCompletion --bash --name flake-edit.bash target/assets/flake-edit.bash
+    installShellCompletion --fish --name flake-edit.fish target/assets/flake-edit.fish
+    installShellCompletion --zsh --name _flake-edit target/assets/_flake-edit
+  '';
+
+  meta = {
+    description = "Edit your flake inputs with ease";
+    homepage = "https://github.com/a-kenji/flake-edit";
+    changelog = "https://github.com/a-kenji/flake-edit/blob/${src.rev}/CHANGELOG.md";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ a-kenji ];
+    mainProgram = "flake-edit";
+  };
+}

pkgs/by-name/fl/fluent-bit/package.nix

@@ -14,13 +14,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "fluent-bit";
-  version = "3.1.6";
+  version = "3.1.7";
 
   src = fetchFromGitHub {
     owner = "fluent";
     repo = "fluent-bit";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-l33DDS7rk/uLCGTU5WTGvQH0JUEarKo3cxMrXn5eefc=";
+    hash = "sha256-aolwCWZa+HS7NEbRxkcH+8Lv3Q3sDYqa4uFS1fANRHI=";
   };
 
   # optional only to avoid linux rebuild

pkgs/by-name/fr/fragments/package.nix

@@ -1,41 +1,42 @@
-{ lib
-, stdenv
-, fetchFromGitLab
-, appstream-glib
-, cargo
-, dbus
-, desktop-file-utils
-, git
-, glib
-, gtk4
-, libadwaita
-, meson
-, ninja
-, openssl
-, pkg-config
-, rustPlatform
-, rustc
-, sqlite
-, transmission_4
-, wrapGAppsHook4
+{
+  lib,
+  stdenv,
+  fetchFromGitLab,
+  appstream-glib,
+  cargo,
+  dbus,
+  desktop-file-utils,
+  git,
+  glib,
+  gtk4,
+  libadwaita,
+  meson,
+  ninja,
+  openssl,
+  pkg-config,
+  rustPlatform,
+  rustc,
+  sqlite,
+  transmission_4,
+  wrapGAppsHook4,
 }:
 
 stdenv.mkDerivation rec {
   pname = "fragments";
-  version = "3.0.0";
+  version = "3.0.1";
 
   src = fetchFromGitLab {
     domain = "gitlab.gnome.org";
     owner = "World";
     repo = "Fragments";
     rev = version;
-    hash = "sha256-HtulyB1XYBsA595ghJN0EmyJT7DjGUbtJKaMGM3f0I8=";
+    hash = "sha256-lTOO6ZQWImaFqYZ3qerYYHWj/eOLYU/2k2Wh/ju9Njw=";
   };
 
   cargoDeps = rustPlatform.fetchCargoTarball {
     inherit src;
     name = "${pname}-${version}";
-    hash = "sha256-EUE+Qc+MqsKPqHMYJflZQ6zm3ErW+KLuJq/7HEBf8VM=";
+    hash = "sha256-7TIjd1ewazJGY8uG6f1B97ol+7+uLjnZVGC2/2DlUdQ=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/gi/gickup/package.nix

@@ -7,13 +7,13 @@
 
 buildGoModule rec {
   pname = "gickup";
-  version = "0.10.34";
+  version = "0.10.36";
 
   src = fetchFromGitHub {
     owner = "cooperspencer";
     repo = "gickup";
     rev = "refs/tags/v${version}";
-    hash = "sha256-cdYQU5pQj+vypFtvPxN1Vg4ckui+vcYUmOJQ9d3XTK4=";
+    hash = "sha256-Os26Il/FhH5cpgpaMZGfOljZ4p3XlCrRPEvzKD6kgpg=";
   };
 
   vendorHash = "sha256-x+K3qXV0F4OKsldsnNcR5w4fmwYyt7V7IDrcHBNPttI=";

pkgs/by-name/gi/gitlab-runner/package.nix

@@ -70,6 +70,6 @@ buildGoModule rec {
     license = licenses.mit;
     homepage = "https://docs.gitlab.com/runner/";
     platforms = platforms.unix ++ platforms.darwin;
-    maintainers = with maintainers; [ bachp zimbatm ] ++ teams.gitlab.members;
+    maintainers = with maintainers; [ zimbatm ] ++ teams.gitlab.members;
   };
 }

pkgs/by-name/gi/gitu/package.nix

@@ -12,16 +12,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "gitu";
-  version = "0.24.0";
+  version = "0.25.0";
 
   src = fetchFromGitHub {
     owner = "altsem";
     repo = "gitu";
     rev = "v${version}";
-    hash = "sha256-ERowsPJujsN27uKD0yW1kPADV9YOKH7KR3/4r1iISvc=";
+    hash = "sha256-DqJ/O87LdNXmJNmoBCdAvLod8uDRHlNuMzAv+kEew1w=";
   };
 
-  cargoHash = "sha256-VhcCFh1seqanecRT3lER0ZSYFRoKn9V5sbGYlNg49DQ=";
+  cargoHash = "sha256-rfj2rDqO/sMaghpou2TCTfqrUmPxh0qooR6hhqlS4PM=";
 
   nativeBuildInputs = [
     pkg-config

pkgs/by-name/go/google-chrome/package.nix

@@ -243,7 +243,13 @@ let
         --prefix XDG_DATA_DIRS   : "$XDG_ICON_DIRS:$GSETTINGS_SCHEMAS_PATH:${addDriverRunpath.driverLink}/share" \
         --set CHROME_WRAPPER  "google-chrome-$dist" \
         --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--ozone-platform-hint=auto --enable-features=WaylandWindowDecorations}}" \
-        --add-flags ${lib.escapeShellArg commandLineArgs}
+        --add-flags ${
+          lib.concatStringsSep " " [
+            (lib.escapeShellArg commandLineArgs)
+            # Disables auto updates and browser outdated popup
+            "--simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT'"
+          ]
+        }
 
       for elf in $out/share/google/$appname/{chrome,chrome-sandbox,chrome_crashpad_handler}; do
         patchelf --set-rpath $rpath $elf
@@ -283,7 +289,13 @@ let
 
       mkdir -p $out/bin
       makeWrapper $out/Applications/Google\ Chrome.app/Contents/MacOS/Google\ Chrome $out/bin/google-chrome-stable \
-        --add-flags ${lib.escapeShellArg commandLineArgs}
+        --add-flags ${
+          lib.concatStringsSep " " [
+            (lib.escapeShellArg commandLineArgs)
+            # Disables auto updates and browser outdated popup
+            "--simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT'"
+          ]
+        }
 
       runHook postInstall
     '';

pkgs/by-name/ha/havoc/package.nix

@@ -10,13 +10,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "havoc";
-  version = "0.5.0";
+  version = "0.6.0";
 
   src = fetchFromGitHub {
     owner = "ii8";
     repo = "havoc";
     rev = finalAttrs.version;
-    hash = "sha256-jvGm2gFdMS61otETF7gOEpYn6IuLfqI95IpEVfIv+C4=";
+    hash = "sha256-YCZdAlIDptVLMUko40gfp2BCAbhGNsYyVTDB14VTNSE=";
   };
 
   depsBuildBuild = [

pkgs/by-name/he/hextazy/package.nix

@@ -6,16 +6,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "hextazy";
-  version = "0.4";
+  version = "0.6";
 
   src = fetchFromGitHub {
     owner = "0xfalafel";
     repo = "hextazy";
     rev = "${version}";
-    hash = "sha256-5ZT6oXG3dWJ8vPX0oieWQsYJQYCTwtlb1B8kmGlLv0k=";
+    hash = "sha256-unZAW5ErHaEPpPwlo20/3//qhTpCjcmj0ses9FKgVJc=";
   };
 
-  cargoHash = "sha256-n1HvkWNbHU8UUlqsCnuKESKQznk1WTe6eQiUJjVVXYE=";
+  cargoHash = "sha256-4JpgUGthCbXSn98f4RrPoTcaGSCyZeuJqMVdLH7gKgs=";
 
   meta = {
     description = "TUI hexeditor in Rust with colored bytes";

pkgs/by-name/hu/hugo/package.nix

@@ -10,16 +10,16 @@
 
 buildGo123Module rec {
   pname = "hugo";
-  version = "0.133.1";
+  version = "0.134.0";
 
   src = fetchFromGitHub {
     owner = "gohugoio";
     repo = "hugo";
     rev = "refs/tags/v${version}";
-    hash = "sha256-vTUhUSaUvj3gBoiYOJwmxScCpl2Z6/xRWvyV3ivPBTo=";
+    hash = "sha256-XglHrV+MD9Nq1qwJB63eATuS+6SwjZVF5u6H5EejEow=";
   };
 
-  vendorHash = "sha256-+1wNCavx9pVWlFeP3NF/OAMgTVfIqAQdCkq4fW9RZxc=";
+  vendorHash = "sha256-oDa5uWQ/vFSmTNwZ3zsYtsuLCzddV9DeaEGx5krwWRE=";
 
   doCheck = false;
 

pkgs/by-name/hw/hwinfo/package.nix

@@ -14,6 +14,8 @@
   runCommand,
   validatePkgConfig,
   gitUpdater,
+  buildPackages,
+  perlPackages,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
@@ -30,15 +32,21 @@ stdenv.mkDerivation (finalAttrs: {
   nativeBuildInputs = [
     flex
     validatePkgConfig
+    perl
+    perlPackages.XMLWriter
+    perlPackages.XMLParser
   ];
+  depsBuildBuild = [ buildPackages.stdenv.cc ];
 
   buildInputs = [
     libuuid
     libx86emu
-    perl
   ];
 
   postPatch = ''
+    # used by the build system
+    echo ${finalAttrs.version} > VERSION
+
     # Replace /usr paths with Nix store paths
     substituteInPlace Makefile \
       --replace-fail "/sbin" "/bin" \
@@ -56,13 +64,32 @@ stdenv.mkDerivation (finalAttrs: {
       --replace-fail "/sbin/rmmod" "${kmod}/bin/rmmod" \
       --replace-fail "/usr/bin/udevinfo" "${systemdMinimal}/bin/udevinfo" \
       --replace-fail "/usr/bin/udevadm" "${systemdMinimal}/bin/udevadm"
+
+  '';
+
+  # The pci/usb ids in hwinfo are ancient. We can get a more up-to-date list simply by copying from systemd
+  preBuild = ''
+    # since we don't have .git, we cannot run this.
+    rm git2log
+    pushd src/ids
+    cp ${systemdMinimal.src}/hwdb.d/pci.ids src/pci
+    cp ${systemdMinimal.src}/hwdb.d/usb.ids src/usb
+    # taken from https://github.com/openSUSE/hwinfo/blob/c87f449f1d4882c71b0a1e6dc80638224a5baeed/src/ids/update_pci_usb
+    perl -pi -e 'undef $_ if /^C\s/..1' src/usb
+    perl ./convert_hd src/pci
+    perl ./convert_hd src/usb
+    popd
+
+    # build tools for build arch
+    make -C src/ids CC=$CC_FOR_BUILD -j $NIX_BUILD_CORES check_hd
+    make -C src/isdn/cdb CC=$CC_FOR_BUILD -j $NIX_BUILD_CORES isdn_cdb mk_isdnhwdb
   '';
 
   makeFlags = [
     "LIBDIR=/lib"
-    "HWINFO_VERSION=${finalAttrs.version}"
+    "CC=${stdenv.cc.targetPrefix}cc"
+    "ARCH=${stdenv.hostPlatform.uname.processor}"
   ];
-
   installFlags = [ "DESTDIR=$(out)" ];
 
   passthru = {

pkgs/by-name/im/impala/package.nix

@@ -5,16 +5,16 @@
 }:
 rustPlatform.buildRustPackage rec {
   pname = "impala";
-  version = "0.2.1";
+  version = "0.2.3";
 
   src = fetchFromGitHub {
     owner = "pythops";
     repo = "impala";
     rev = "v${version}";
-    hash = "sha256-0ULcknkZKYEvuqlcY8E1kZtpA0lPxxjRV2/zfak+FKU=";
+    hash = "sha256-4LQmM4VTW3ykh6eDWKxBe3jxlJphgAytgeaQZNwivsQ=";
   };
 
-  cargoHash = "sha256-1jFUfpinqXBu8eTFAA1dRDk1F1IhNjcA7CkJmaIjkFQ=";
+  cargoHash = "sha256-IMvlGAD9DB00luu9F4UKxwSYt0sV+IU8Pb7r10VtyYg=";
 
   meta = {
     description = "TUI for managing wifi";

pkgs/by-name/ka/kas/package.nix

@@ -2,16 +2,16 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "kas";
-  version = "4.2";
+  version = "4.4";
 
   src = fetchFromGitHub {
     owner = "siemens";
     repo = pname;
     rev = "refs/tags/${version}";
-    hash = "sha256-NjNPcCqmjFeydTgNdN8QRrFG5Mys2jL4I8TiznO2rSA=";
+    hash = "sha256-ws2V16HSGn2zyMmcG601ScHfONSE/DBVO3Gaj8dktf4=";
   };
 
-  propagatedBuildInputs = with python3.pkgs; [ setuptools kconfiglib jsonschema distro pyyaml ];
+  propagatedBuildInputs = with python3.pkgs; [ setuptools kconfiglib jsonschema distro pyyaml gitpython ];
 
   # Tests require network as they try to clone repos
   doCheck = false;

pkgs/by-name/li/libcutl/package.nix

@@ -0,0 +1,40 @@
+{
+  build2,
+  fetchgit,
+  gccStdenv,
+  lib,
+  xercesc,
+}:
+
+gccStdenv.mkDerivation (finalAttrs: {
+  pname = "libcutl";
+  version = "1.11.0";
+
+  src = fetchgit {
+    url = "https://git.codesynthesis.com/libcutl/libcutl.git";
+    rev = "refs/tags/v${finalAttrs.version}";
+    hash = "sha256-LY2ZyxduI6xftVjVqjNkhYPFTL5bvHC289Qcei1Kiw4=";
+  };
+
+  nativeBuildInputs = [ build2 ];
+
+  buildInputs = [ xercesc ];
+
+  enableParallelBuilding = true;
+
+  doCheck = true;
+
+  meta = {
+    description = "C++ utility library from Code Synthesis";
+    longDescription = ''
+      libcutl is a C++ utility library.
+      It contains a collection of generic and independent components such as
+      meta-programming tests, smart pointers, containers, compiler building blocks, etc.
+    '';
+    homepage = "https://codesynthesis.com/projects/libcutl/";
+    changelog = "https://git.codesynthesis.com/cgit/libcutl/libcutl/log/";
+    platforms = lib.platforms.all;
+    maintainers = [ lib.maintainers.xzfc ];
+    license = lib.licenses.mit;
+  };
+})

pkgs/by-name/li/libeufin/package.nix

@@ -14,12 +14,12 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "libeufin";
-  version = "0.11.3";
+  version = "0.13.0";
 
   src = fetchgit {
     url = "https://git.taler.net/libeufin.git/";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-6bMYcpxwL1UJXt0AX6R97C0Orwqb7E+TZO2Sz1qode8=";
+    hash = "sha256-whGcFZYuyeFfhu+mIi7oUNJRXjaVGuL67sfUrHF85Fs=";
     fetchSubmodules = true;
     leaveDotGit = true; # required for correct submodule fetching
     # Delete .git folder for reproducibility (otherwise, the hash changes unexpectedly after fetching submodules)
@@ -39,15 +39,9 @@ stdenv.mkDerivation (finalAttrs: {
     substituteInPlace build.gradle \
       --replace-fail "commandLine 'git', 'rev-parse', '--short', 'HEAD'" 'commandLine "cat", "$projectDir/common/src/main/resources/HEAD.txt"'
 
-    # Gradle projects provide a .module metadata file as artifact. This artifact is used by gradle
-    # to download dependencies to the cache when needed, but do not provide the jar for the
-    # offline installation for our build phase. Since we make an offline Maven repo, we have to
-    # substitute the gradle deps for their maven counterpart to retrieve the .jar artifacts.
-    for dir in common bank nexus testbench; do
-      substituteInPlace $dir/build.gradle \
-        --replace-fail ':$ktor_version' '-jvm:$ktor_version' \
-        --replace-fail ':$clikt_version' '-jvm:$clikt_version'
-    done
+    # Use gradle repo to download dependencies
+    substituteInPlace build.gradle \
+      --replace-fail 'mavenCentral()' "gradlePluginPortal()"
 
     runHook postPatch
   '';