Merge branch 'master' into current

wgnord: add platforms.linux to meta

CONTRIBUTING.md

@@ -321,7 +321,7 @@ All the review template samples provided in this section are generic and meant a
 
 To get more information about how to review specific parts of Nixpkgs, refer to the documents linked to in the [overview section][overview].
 
-If a pull request contains documentation changes that might require feedback from the documentation team, ping [@NixOS/documentation-reviewers](https://github.com/orgs/nixos/teams/documentation-reviewers) on the pull request.
+If a pull request contains documentation changes that might require feedback from the documentation team, ping [@NixOS/documentation-team](https://github.com/orgs/nixos/teams/documentation-team) on the pull request.
 
 If you consider having enough knowledge and experience in a topic and would like to be a long-term reviewer for related submissions, please contact the current reviewers for that topic. They will give you information about the reviewing process. The main reviewers for a topic can be hard to find as there is no list, but checking past pull requests to see who reviewed or git-blaming the code to see who committed to that topic can give some hints.
 

doc/README.md

@@ -345,4 +345,4 @@ Typographic replacements are enabled. Check the [list of possible replacement pa
 
 ## Getting help
 
-If you need documentation-specific help or reviews, ping [@NixOS/documentation-reviewers](https://github.com/orgs/nixos/teams/documentation-reviewers) on your pull request.
+If you need documentation-specific help or reviews, ping [@NixOS/documentation-team](https://github.com/orgs/nixos/teams/documentation-team) on your pull request.

lib/fetchers.nix

@@ -8,6 +8,7 @@
     # derivation like fetchurl is allowed to do so since its result is
     # by definition pure.
     "http_proxy" "https_proxy" "ftp_proxy" "all_proxy" "no_proxy"
+    "HTTP_PROXY" "HTTPS_PROXY" "FTP_PROXY" "ALL_PROXY" "NO_PROXY"
   ];
 
 }

maintainers/team-list.nix

@@ -263,6 +263,9 @@ with lib.maintainers; {
 
   docs = {
     members = [ ];
+    githubTeams = [
+      "documentation-team"
+    ];
     scope = "Maintain nixpkgs/NixOS documentation and tools for building it.";
     shortName = "Docs";
     enableFeatureFreezePing = true;
@@ -811,6 +814,7 @@ with lib.maintainers; {
       aanderse
       drupol
       ma27
+      patka
       talyz
     ];
     githubTeams = [

nixos/doc/manual/installation/installing-from-other-distro.section.md

@@ -42,9 +42,11 @@ The first steps to all these are the same:
     will be safer to use the `nixos-*` channels instead:
 
     ```ShellSession
-    $ nix-channel --add https://nixos.org/channels/nixos-version nixpkgs
+    $ nix-channel --add https://nixos.org/channels/nixos-<version> nixpkgs
     ```
 
+    Where `<version>` corresponds to the latest version available on [channels.nixos.org](https://channels.nixos.org/).
+
     You may want to throw in a `nix-channel --update` for good measure.
 
 1.  Install the NixOS installation tools:

nixos/doc/manual/release-notes/rl-2405.section.md

@@ -209,6 +209,8 @@ The pre-existing [services.ankisyncd](#opt-services.ankisyncd.enable) has been m
 
 - [isolate](https://github.com/ioi/isolate), a sandbox for securely executing untrusted programs. Available as [security.isolate](#opt-security.isolate.enable).
 
+- [ydotool](https://github.com/ReimuNotMoe/ydotool), a generic command-line automation tool now has a module. Available as [programs.ydotool](#opt-programs.ydotool.enable).
+
 - [private-gpt](https://github.com/zylon-ai/private-gpt), a service to interact with your documents using the power of LLMs, 100% privately, no data leaks. Available as [services.private-gpt](#opt-services.private-gpt.enable).
 
 - [keto](https://www.ory.sh/keto/), a permission & access control server, the first open source implementation of ["Zanzibar: Google's Consistent, Global Authorization System"](https://research.google/pubs/zanzibar-googles-consistent-global-authorization-system/).

nixos/modules/module-list.nix

@@ -308,6 +308,7 @@
   ./programs/xwayland.nix
   ./programs/yabar.nix
   ./programs/yazi.nix
+  ./programs/ydotool.nix
   ./programs/yubikey-touch-detector.nix
   ./programs/zmap.nix
   ./programs/zsh/oh-my-zsh.nix

nixos/modules/programs/ydotool.nix

@@ -0,0 +1,83 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+let
+  cfg = config.programs.ydotool;
+in
+{
+  meta = {
+    maintainers = with lib.maintainers; [ quantenzitrone ];
+  };
+
+  options.programs.ydotool = {
+    enable = lib.mkEnableOption ''
+      ydotoold system service and install ydotool.
+      Add yourself to the 'ydotool' group to be able to use it.
+    '';
+  };
+
+  config = lib.mkIf cfg.enable {
+    users.groups.ydotool = { };
+
+    systemd.services.ydotoold = {
+      description = "ydotoold - backend for ydotool";
+      wantedBy = [ "multi-user.target" ];
+      partOf = [ "multi-user.target" ];
+      serviceConfig = {
+        Group = "ydotool";
+        RuntimeDirectory = "ydotoold";
+        RuntimeDirectoryMode = "0750";
+        ExecStart = "${lib.getExe' pkgs.ydotool "ydotoold"} --socket-path=/run/ydotoold/socket --socket-perm=0660";
+
+        # hardening
+
+        ## allow access to uinput
+        DeviceAllow = [ "/dev/uinput" ];
+        DevicePolicy = "closed";
+
+        ## allow creation of unix sockets
+        RestrictAddressFamilies = [ "AF_UNIX" ];
+
+        CapabilityBoundingSet = "";
+        IPAddressDeny = "any";
+        LockPersonality = true;
+        MemoryDenyWriteExecute = true;
+        NoNewPrivileges = true;
+        PrivateNetwork = true;
+        PrivateTmp = true;
+        PrivateUsers = true;
+        ProcSubset = "pid";
+        ProtectClock = true;
+        ProtectControlGroups = true;
+        ProtectHome = true;
+        ProtectHostname = true;
+        ProtectKernelLogs = true;
+        ProtectKernelModules = true;
+        ProtectKernelTunables = true;
+        ProtectProc = "invisible";
+        ProtectSystem = "strict";
+        ProtectUser = true;
+        RestrictNamespaces = true;
+        RestrictRealtime = true;
+        RestrictSUIDSGID = true;
+        SystemCallArchitectures = "native";
+        SystemCallFilter = [
+          "@system-service"
+          "~@privileged"
+          "~@resources"
+        ];
+        UMask = "0077";
+
+        # -> systemd-analyze security score 0.7 SAFE 😀
+      };
+    };
+
+    environment.variables = {
+      YDOTOOL_SOCKET = "/run/ydotoold/socket";
+    };
+    environment.systemPackages = with pkgs; [ ydotool ];
+  };
+}

nixos/modules/services/backup/borgbackup.nix

@@ -33,13 +33,24 @@ let
     }
     trap on_exit EXIT
 
+    borgWrapper () {
+      local result
+      borg "$@" && result=$? || result=$?
+      if [[ -z "${toString cfg.failOnWarnings}" ]] && [[ "$result" == 1 ]]; then
+        echo "ignoring warning return value 1"
+        return 0
+      else
+        return "$result"
+      fi
+    }
+
     archiveName="${optionalString (cfg.archiveBaseName != null) (cfg.archiveBaseName + "-")}$(date ${cfg.dateFormat})"
     archiveSuffix="${optionalString cfg.appendFailedSuffix ".failed"}"
     ${cfg.preHook}
   '' + optionalString cfg.doInit ''
     # Run borg init if the repo doesn't exist yet
-    if ! borg list $extraArgs > /dev/null; then
-      borg init $extraArgs \
+    if ! borgWrapper list $extraArgs > /dev/null; then
+      borgWrapper init $extraArgs \
         --encryption ${cfg.encryption.mode} \
         $extraInitArgs
       ${cfg.postInit}
@@ -48,7 +59,7 @@ let
     (
       set -o pipefail
       ${optionalString (cfg.dumpCommand != null) ''${escapeShellArg cfg.dumpCommand} | \''}
-      borg create $extraArgs \
+      borgWrapper create $extraArgs \
         --compression ${cfg.compression} \
         --exclude-from ${mkExcludeFile cfg} \
         --patterns-from ${mkPatternsFile cfg} \
@@ -57,16 +68,16 @@ let
         ${if cfg.paths == null then "-" else escapeShellArgs cfg.paths}
     )
   '' + optionalString cfg.appendFailedSuffix ''
-    borg rename $extraArgs \
+    borgWrapper rename $extraArgs \
       "::$archiveName$archiveSuffix" "$archiveName"
   '' + ''
     ${cfg.postCreate}
   '' + optionalString (cfg.prune.keep != { }) ''
-    borg prune $extraArgs \
+    borgWrapper prune $extraArgs \
       ${mkKeepArgs cfg} \
       ${optionalString (cfg.prune.prefix != null) "--glob-archives ${escapeShellArg "${cfg.prune.prefix}*"}"} \
       $extraPruneArgs
-    borg compact $extraArgs $extraCompactArgs
+    borgWrapper compact $extraArgs $extraCompactArgs
     ${cfg.postPrune}
   '');
 
@@ -488,6 +499,15 @@ in {
             default = true;
           };
 
+          failOnWarnings = mkOption {
+            type = types.bool;
+            description = ''
+              Fail the whole backup job if any borg command returns a warning
+              (exit code 1), for example because a file changed during backup.
+            '';
+            default = true;
+          };
+
           doInit = mkOption {
             type = types.bool;
             description = ''

nixos/modules/services/display-managers/greetd.nix

@@ -27,6 +27,17 @@ in
       '';
     };
 
+    greeterManagesPlymouth = mkOption {
+      type = types.bool;
+      internal = true;
+      default = false;
+      description = ''
+        Don't configure the greetd service to wait for Plymouth to exit.
+
+        Enable this if the greeter you're using can manage Plymouth itself to provide a smoother handoff.
+      '';
+    };
+
     vt = mkOption {
       type = types.int;
       default = 1;
@@ -72,8 +83,9 @@ in
         ];
         After = [
           "systemd-user-sessions.service"
-          "plymouth-quit-wait.service"
           "getty@${tty}.service"
+        ] ++ lib.optionals (!cfg.greeterManagesPlymouth) [
+          "plymouth-quit-wait.service"
         ];
         Conflicts = [
           "getty@${tty}.service"

nixos/modules/services/networking/hostapd.nix

@@ -687,7 +687,7 @@ in {
                   authentication = {
                     mode = mkOption {
                       default = "wpa3-sae";
-                      type = types.enum ["none" "wpa2-sha256" "wpa3-sae-transition" "wpa3-sae"];
+                      type = types.enum ["none" "wpa2-sha1" "wpa2-sha256" "wpa3-sae-transition" "wpa3-sae"];
                       description = ''
                         Selects the authentication mode for this AP.
 
@@ -695,7 +695,9 @@ in {
                           and create an open AP. Use {option}`settings` together with this option if you
                           want to configure the authentication manually. Any password options will still be
                           effective, if set.
-                        - {var}`"wpa2-sha256"`: WPA2-Personal using SHA256 (IEEE 802.11i/RSN). Passwords are set
+                        - {var}`"wpa2-sha1"`: Not recommended. WPA2-Personal using HMAC-SHA1. Passwords are set
+                          using {option}`wpaPassword` or preferably by {option}`wpaPasswordFile` or {option}`wpaPskFile`.
+                        - {var}`"wpa2-sha256"`: WPA2-Personal using HMAC-SHA256 (IEEE 802.11i/RSN). Passwords are set
                           using {option}`wpaPassword` or preferably by {option}`wpaPasswordFile` or {option}`wpaPskFile`.
                         - {var}`"wpa3-sae-transition"`: Use WPA3-Personal (SAE) if possible, otherwise fallback
                           to WPA2-SHA256. Only use if necessary and switch to the newer WPA3-SAE when possible.
@@ -812,7 +814,7 @@ in {
                         Warning: These entries will get put into a world-readable file in
                         the Nix store! Using {option}`saePasswordFile` instead is recommended.
 
-                        Not used when {option}`mode` is {var}`"wpa2-sha256"`.
+                        Not used when {option}`mode` is {var}`"wpa2-sha1"` or {var}`"wpa2-sha256"`.
                       '';
                       type = types.listOf (types.submodule {
                         options = {
@@ -884,7 +886,7 @@ in {
                         parameters doesn't matter:
                         `<password>[|mac=<peer mac>][|vlanid=<VLAN ID>][|pk=<m:ECPrivateKey-base64>][|id=<identifier>]`
 
-                        Not used when {option}`mode` is {var}`"wpa2-sha256"`.
+                        Not used when {option}`mode` is {var}`"wpa2-sha1"` or {var}`"wpa2-sha256"`.
                       '';
                     };
 
@@ -959,6 +961,9 @@ in {
                   } // optionalAttrs (bssCfg.authentication.mode == "wpa3-sae-transition") {
                     wpa = 2;
                     wpa_key_mgmt = "WPA-PSK-SHA256 SAE";
+                  } // optionalAttrs (bssCfg.authentication.mode == "wpa2-sha1") {
+                    wpa = 2;
+                    wpa_key_mgmt = "WPA-PSK";
                   } // optionalAttrs (bssCfg.authentication.mode == "wpa2-sha256") {
                     wpa = 2;
                     wpa_key_mgmt = "WPA-PSK-SHA256";
@@ -1186,8 +1191,8 @@ in {
                   message = ''hostapd radio ${radio} bss ${bss}: uses WPA3-SAE in transition mode requires defining both a wpa password option and a sae password option'';
                 }
                 {
-                  assertion = auth.mode == "wpa2-sha256" -> countWpaPasswordDefinitions == 1;
-                  message = ''hostapd radio ${radio} bss ${bss}: uses WPA2-SHA256 which requires defining a wpa password option'';
+                  assertion = (auth.mode == "wpa2-sha1" || auth.mode == "wpa2-sha256") -> countWpaPasswordDefinitions == 1;
+                  message = ''hostapd radio ${radio} bss ${bss}: uses WPA2-PSK which requires defining a wpa password option'';
                 }
               ])
               radioCfg.networks))

nixos/modules/services/x11/xserver.nix

@@ -728,9 +728,6 @@ in
             rm -f /tmp/.X0-lock
           '';
 
-        # TODO: move declaring the systemd service to its own mkIf
-        script = mkIf (config.systemd.services.display-manager.enable == true) "${config.services.displayManager.execCmd}";
-
         # Stop restarting if the display manager stops (crashes) 2 times
         # in one minute. Starting X typically takes 3-4s.
         startLimitIntervalSec = 30;

nixos/modules/system/activation/switchable-system.nix

@@ -4,52 +4,93 @@ let
 
   perlWrapped = pkgs.perl.withPackages (p: with p; [ ConfigIniFiles FileSlurp ]);
 
+  description = extra: ''
+    Whether to include the capability to switch configurations.
+
+    Disabling this makes the system unable to be reconfigured via `nixos-rebuild`.
+
+    ${extra}
+  '';
+
 in
 
 {
 
-  options = {
-    system.switch.enable = lib.mkOption {
+  options.system.switch = {
+    enable = lib.mkOption {
       type = lib.types.bool;
       default = true;
-      description = ''
-        Whether to include the capability to switch configurations.
-
-        Disabling this makes the system unable to be reconfigured via `nixos-rebuild`.
-
+      description = description ''
         This is good for image based appliances where updates are handled
         outside the image. Reducing features makes the image lighter and
         slightly more secure.
       '';
     };
+
+    enableNg = lib.mkOption {
+      type = lib.types.bool;
+      default = false;
+      description = description ''
+        Whether to use `switch-to-configuration-ng`, an experimental
+        re-implementation of `switch-to-configuration` with the goal of
+        replacing the original.
+      '';
+    };
   };
 
-  config = lib.mkIf config.system.switch.enable {
-    system.activatableSystemBuilderCommands = ''
-      mkdir $out/bin
-      substitute ${./switch-to-configuration.pl} $out/bin/switch-to-configuration \
-        --subst-var out \
-        --subst-var-by toplevel ''${!toplevelVar} \
-        --subst-var-by coreutils "${pkgs.coreutils}" \
-        --subst-var-by distroId ${lib.escapeShellArg config.system.nixos.distroId} \
-        --subst-var-by installBootLoader ${lib.escapeShellArg config.system.build.installBootLoader} \
-        --subst-var-by localeArchive "${config.i18n.glibcLocales}/lib/locale/locale-archive" \
-        --subst-var-by perl "${perlWrapped}" \
-        --subst-var-by shell "${pkgs.bash}/bin/sh" \
-        --subst-var-by su "${pkgs.shadow.su}/bin/su" \
-        --subst-var-by systemd "${config.systemd.package}" \
-        --subst-var-by utillinux "${pkgs.util-linux}" \
-        ;
+  config = lib.mkMerge [
+    {
+      assertions = [{
+        assertion = with config.system.switch; enable -> !enableNg;
+        message = "Only one of system.switch.enable and system.switch.enableNg may be enabled at a time";
+      }];
+    }
+    (lib.mkIf config.system.switch.enable {
+      system.activatableSystemBuilderCommands = ''
+        mkdir $out/bin
+        substitute ${./switch-to-configuration.pl} $out/bin/switch-to-configuration \
+          --subst-var out \
+          --subst-var-by toplevel ''${!toplevelVar} \
+          --subst-var-by coreutils "${pkgs.coreutils}" \
+          --subst-var-by distroId ${lib.escapeShellArg config.system.nixos.distroId} \
+          --subst-var-by installBootLoader ${lib.escapeShellArg config.system.build.installBootLoader} \
+          --subst-var-by localeArchive "${config.i18n.glibcLocales}/lib/locale/locale-archive" \
+          --subst-var-by perl "${perlWrapped}" \
+          --subst-var-by shell "${pkgs.bash}/bin/sh" \
+          --subst-var-by su "${pkgs.shadow.su}/bin/su" \
+          --subst-var-by systemd "${config.systemd.package}" \
+          --subst-var-by utillinux "${pkgs.util-linux}" \
+          ;
 
-      chmod +x $out/bin/switch-to-configuration
-      ${lib.optionalString (pkgs.stdenv.hostPlatform == pkgs.stdenv.buildPlatform) ''
-        if ! output=$(${perlWrapped}/bin/perl -c $out/bin/switch-to-configuration 2>&1); then
-          echo "switch-to-configuration syntax is not valid:"
-          echo "$output"
-          exit 1
-        fi
-      ''}
-    '';
-  };
+        chmod +x $out/bin/switch-to-configuration
+        ${lib.optionalString (pkgs.stdenv.hostPlatform == pkgs.stdenv.buildPlatform) ''
+          if ! output=$(${perlWrapped}/bin/perl -c $out/bin/switch-to-configuration 2>&1); then
+            echo "switch-to-configuration syntax is not valid:"
+            echo "$output"
+            exit 1
+          fi
+        ''}
+      '';
+    })
+    (lib.mkIf config.system.switch.enableNg {
+      # Use a subshell so we can source makeWrapper's setup hook without
+      # affecting the rest of activatableSystemBuilderCommands.
+      system.activatableSystemBuilderCommands = ''
+        (
+          source ${pkgs.buildPackages.makeWrapper}/nix-support/setup-hook
+
+          mkdir $out/bin
+          ln -sf ${lib.getExe pkgs.switch-to-configuration-ng} $out/bin/switch-to-configuration
+          wrapProgram $out/bin/switch-to-configuration \
+            --set OUT $out \
+            --set TOPLEVEL ''${!toplevelVar} \
+            --set DISTRO_ID ${lib.escapeShellArg config.system.nixos.distroId} \
+            --set INSTALL_BOOTLOADER ${lib.escapeShellArg config.system.build.installBootLoader} \
+            --set LOCALE_ARCHIVE ${config.i18n.glibcLocales}/lib/locale/locale-archive \
+            --set SYSTEMD ${config.systemd.package}
+        )
+      '';
+    })
+  ];
 
 }

nixos/tests/all-tests.nix

@@ -873,7 +873,8 @@ in {
   swap-random-encryption = handleTest ./swap-random-encryption.nix {};
   sway = handleTest ./sway.nix {};
   swayfx = handleTest ./swayfx.nix {};
-  switchTest = handleTest ./switch-test.nix {};
+  switchTest = handleTest ./switch-test.nix { ng = false; };
+  switchTestNg = handleTest ./switch-test.nix { ng = true; };
   sympa = handleTest ./sympa.nix {};
   syncthing = handleTest ./syncthing.nix {};
   syncthing-no-settings = handleTest ./syncthing-no-settings.nix {};
@@ -1039,6 +1040,7 @@ in {
   xterm = handleTest ./xterm.nix {};
   xxh = handleTest ./xxh.nix {};
   yabar = handleTest ./yabar.nix {};
+  ydotool = handleTest ./ydotool.nix {};
   yggdrasil = handleTest ./yggdrasil.nix {};
   zammad = handleTest ./zammad.nix {};
   zeronet-conservancy = handleTest ./zeronet-conservancy.nix {};

nixos/tests/fcitx5/default.nix

@@ -89,10 +89,13 @@ rec {
             machine.succeed("xauth merge ${xauth}")
             machine.sleep(5)
 
+            machine.wait_until_succeeds("pgrep fcitx5")
             machine.succeed("su - ${user.name} -c 'kill $(pgrep fcitx5)'")
             machine.sleep(1)
 
             machine.succeed("su - ${user.name} -c 'alacritty >&2 &'")
+            machine.wait_for_window("alice@machine")
+
             machine.succeed("su - ${user.name} -c 'fcitx5 >&2 &'")
             machine.sleep(10)
 

nixos/tests/pgvecto-rs.nix

@@ -66,7 +66,7 @@ let
     '';
 
   };
-  applicablePostgresqlVersions = filterAttrs (_: value: versionAtLeast value.version "12") postgresql-versions;
+  applicablePostgresqlVersions = filterAttrs (_: value: versionAtLeast value.version "14") postgresql-versions;
 in
 mapAttrs'
   (name: package: {

nixos/tests/switch-test.nix

@@ -1,6 +1,6 @@
 # Test configuration switching.
 
-import ./make-test-python.nix ({ lib, pkgs, ...} : let
+import ./make-test-python.nix ({ lib, pkgs, ng, ...} : let
 
   # Simple service that can either be socket-activated or that will
   # listen on port 1234 if not socket-activated.
@@ -48,6 +48,11 @@ in {
 
   nodes = {
     machine = { pkgs, lib, ... }: {
+      system.switch = {
+        enable = !ng;
+        enableNg = ng;
+      };
+
       environment.systemPackages = [ pkgs.socat ]; # for the socket activation stuff
       users.mutableUsers = false;
 

nixos/tests/systemd-initrd-modprobe.nix

@@ -4,21 +4,21 @@ import ./make-test-python.nix ({ lib, pkgs, ... }: {
   nodes.machine = { pkgs, ... }: {
     testing.initrdBackdoor = true;
     boot.initrd.systemd.enable = true;
-    boot.initrd.kernelModules = [ "loop" ]; # Load module in initrd.
+    boot.initrd.kernelModules = [ "tcp_hybla" ]; # Load module in initrd.
     boot.extraModprobeConfig = ''
-      options loop max_loop=42
+      options tcp_hybla rtt0=42
     '';
   };
 
   testScript = ''
     machine.wait_for_unit("initrd.target")
-    max_loop = machine.succeed("cat /sys/module/loop/parameters/max_loop")
-    assert int(max_loop) == 42, "Parameter should be respected for initrd kernel modules"
+    rtt = machine.succeed("cat /sys/module/tcp_hybla/parameters/rtt0")
+    assert int(rtt) == 42, "Parameter should be respected for initrd kernel modules"
 
     # Make sure it sticks in stage 2
     machine.switch_root()
     machine.wait_for_unit("multi-user.target")
-    max_loop = machine.succeed("cat /sys/module/loop/parameters/max_loop")
-    assert int(max_loop) == 42, "Parameter should be respected for initrd kernel modules"
+    rtt = machine.succeed("cat /sys/module/tcp_hybla/parameters/rtt0")
+    assert int(rtt) == 42, "Parameter should be respected for initrd kernel modules"
   '';
 })

nixos/tests/ydotool.nix

@@ -0,0 +1,115 @@
+import ./make-test-python.nix (
+  { pkgs, lib, ... }:
+  let
+    textInput = "This works.";
+    inputBoxText = "Enter input";
+    inputBox = pkgs.writeShellScript "zenity-input" ''
+      ${lib.getExe pkgs.gnome.zenity} --entry --text '${inputBoxText}:' > /tmp/output &
+    '';
+  in
+  {
+    name = "ydotool";
+
+    meta = {
+      maintainers = with lib.maintainers; [
+        OPNA2608
+        quantenzitrone
+      ];
+    };
+
+    nodes = {
+      headless =
+        { config, ... }:
+        {
+          imports = [ ./common/user-account.nix ];
+
+          users.users.alice.extraGroups = [ "ydotool" ];
+
+          programs.ydotool.enable = true;
+
+          services.getty.autologinUser = "alice";
+        };
+
+      x11 =
+        { config, ... }:
+        {
+          imports = [
+            ./common/user-account.nix
+            ./common/auto.nix
+            ./common/x11.nix
+          ];
+
+          users.users.alice.extraGroups = [ "ydotool" ];
+
+          programs.ydotool.enable = true;
+
+          test-support.displayManager.auto = {
+            enable = true;
+            user = "alice";
+          };
+
+          services.xserver.windowManager.dwm.enable = true;
+          services.displayManager.defaultSession = lib.mkForce "none+dwm";
+        };
+
+      wayland =
+        { config, ... }:
+        {
+          imports = [ ./common/user-account.nix ];
+
+          services.cage = {
+            enable = true;
+            user = "alice";
+          };
+
+          programs.ydotool.enable = true;
+
+          services.cage.program = inputBox;
+        };
+    };
+
+    enableOCR = true;
+
+    testScript =
+      { nodes, ... }:
+      ''
+        def as_user(cmd: str):
+          """
+          Return a shell command for running a shell command as a specific user.
+          """
+          return f"sudo -u alice -i {cmd}"
+
+        start_all()
+
+        # Headless
+        headless.wait_for_unit("multi-user.target")
+        headless.wait_for_text("alice")
+        headless.succeed(as_user("ydotool type 'echo ${textInput} > /tmp/output'")) # text input
+        headless.succeed(as_user("ydotool key 28:1 28:0")) # text input
+        headless.screenshot("headless_input")
+        headless.wait_for_file("/tmp/output")
+        headless.wait_until_succeeds("grep '${textInput}' /tmp/output") # text input
+
+        # X11
+        x11.wait_for_x()
+        x11.execute(as_user("${inputBox}"))
+        x11.wait_for_text("${inputBoxText}")
+        x11.succeed(as_user("ydotool type '${textInput}'")) # text input
+        x11.screenshot("x11_input")
+        x11.succeed(as_user("ydotool mousemove -a 400 110")) # mouse input
+        x11.succeed(as_user("ydotool click 0xC0")) # mouse input
+        x11.wait_for_file("/tmp/output")
+        x11.wait_until_succeeds("grep '${textInput}' /tmp/output") # text input
+
+        # Wayland
+        wayland.wait_for_unit("graphical.target")
+        wayland.wait_for_text("${inputBoxText}")
+        wayland.succeed("ydotool type '${textInput}'") # text input
+        wayland.screenshot("wayland_input")
+        wayland.succeed("ydotool mousemove -a 100 100") # mouse input
+        wayland.succeed("ydotool click 0xC0") # mouse input
+        wayland.wait_for_file("/tmp/output")
+        wayland.wait_until_succeeds("grep '${textInput}' /tmp/output") # text input
+      '';
+  }
+)

pkgs/applications/audio/go-musicfox/default.nix

@@ -9,18 +9,18 @@
 
 buildGoModule rec {
   pname = "go-musicfox";
-  version = "4.3.3";
+  version = "4.4.0";
 
   src = fetchFromGitHub {
     owner = "go-musicfox";
     repo = "go-musicfox";
     rev = "v${version}";
-    hash = "sha256-J6R3T92cHFUkKwc+GKm612tVjglP2Tc/kDUmzUMhvio=";
+    hash = "sha256-11N3dykuEDKAryieNVaPfb3G7E/a4A7Znx9rBvFTHC4=";
   };
 
   deleteVendor = true;
 
-  vendorHash = "sha256-KSIdBEEvYaYcDIDmzfRO857I8FSN4Ajw6phAPQLYEqg=";
+  vendorHash = "sha256-ey78zeCSEuRgteG5ZRb4uO88E6lwEgqSxKfjJg3NGT4=";
 
   subPackages = [ "cmd/musicfox.go" ];
 

pkgs/applications/audio/plexamp/default.nix

@@ -1,4 +1,4 @@
-{ lib, fetchurl, appimageTools, pkgs }:
+{ lib, fetchurl, appimageTools }:
 
 let
   pname = "plexamp";
@@ -16,9 +16,6 @@ let
 in appimageTools.wrapType2 {
   inherit pname version src;
 
-  multiArch = false; # no 32bit needed
-  extraPkgs = pkgs: appimageTools.defaultFhsEnvArgs.multiPkgs pkgs ++ [ pkgs.bash ];
-
   extraInstallCommands = ''
     install -m 444 -D ${appimageContents}/plexamp.desktop $out/share/applications/plexamp.desktop
     install -m 444 -D ${appimageContents}/plexamp.png \

pkgs/applications/audio/squeezelite/default.nix

@@ -45,13 +45,13 @@ stdenv.mkDerivation {
   pname = binName;
   # versions are specified in `squeezelite.h`
   # see https://github.com/ralph-irving/squeezelite/issues/29
-  version = "2.0.0.1486";
+  version = "2.0.0.1488";
 
   src = fetchFromGitHub {
     owner = "ralph-irving";
     repo = "squeezelite";
-    rev = "fd4a82e7d0e53124d9618320f3c115d90654509d";
-    hash = "sha256-nR2Px7VYjAktUsueEyBAV2392+/dX6JYIy7YSMh05c0=";
+    rev = "0e85ddfd79337cdc30b7d29922b1d790600bb6b4";
+    hash = "sha256-FGqo/c74JN000w/iRnvYUejqnYGDzHNZu9pEmR7yR3s=";
   };
 
   buildInputs = [ flac libmad libvorbis mpg123 ]

pkgs/applications/blockchains/miniscript/default.nix

@@ -1,16 +1,31 @@
-{ stdenv, lib, fetchFromGitHub }:
+{
+  stdenv,
+  lib,
+  fetchFromGitHub,
+}:
 
 stdenv.mkDerivation rec {
   pname = "miniscript";
-  version = "unstable-2022-07-19";
+  version = "unstable-2023-03-16";
 
   src = fetchFromGitHub {
     owner = "sipa";
     repo = pname;
-    rev = "ca675488c4aa9605f6ae70c0e68a148a6fb277b4";
-    sha256 = "sha256-kzLIJ0os6UnC0RPEybfw6wGrZpgmRCgj3zifmZjieoU=";
+    rev = "6806dfb15a1fafabf7dd28aae3c9d2bc49db01f1";
+    sha256 = "sha256-qkYDzsl2Y4WEDDXs9cE/jIXm01jclkYUQbDGe1S0wYs=";
   };
 
+    postPatch = lib.optionalString stdenv.isDarwin ''
+    # Replace hardcoded g++ with c++ so clang can be used
+    # on darwin
+    #
+    # lto must be disabled on darwin as well due to
+    # https://github.com/NixOS/nixpkgs/issues/19098
+    substituteInPlace Makefile \
+        --replace-fail 'g++' 'c++' \
+        --replace-fail '-flto' ""
+  '';
+
   installPhase = ''
     runHook preInstall
     mkdir -p $out/bin
@@ -19,12 +34,14 @@ stdenv.mkDerivation rec {
   '';
 
   meta = with lib; {
-    description     = "Compiler and inspector for the miniscript Bitcoin policy language";
+    description = "Compiler and inspector for the miniscript Bitcoin policy language";
     longDescription = "Miniscript is a language for writing (a subset of) Bitcoin Scripts in a structured way, enabling analysis, composition, generic signing and more.";
-    homepage        = "https://bitcoin.sipa.be/miniscript/";
-    license         = licenses.mit;
-    platforms       = platforms.linux;
-    maintainers     = with maintainers; [ RaghavSood jb55 ];
+    homepage = "https://bitcoin.sipa.be/miniscript/";
+    license = licenses.mit;
+    maintainers = with maintainers; [
+      RaghavSood
+      jb55
+    ];
     mainProgram = "miniscript";
   };
 }

pkgs/applications/blockchains/mycrypto/default.nix

@@ -1,5 +1,4 @@
-{ lib, appimageTools, fetchurl, makeDesktopItem
-}:
+{ lib, appimageTools, fetchurl, makeDesktopItem }:
 
 let
   pname = "MyCrypto";
@@ -24,12 +23,9 @@ let
     categories = [ "Finance" ];
   };
 
-in appimageTools.wrapType2 rec {
+in appimageTools.wrapType2 {
   inherit pname version src;
 
-  multiArch = false; # no p32bit needed
-  extraPkgs = appimageTools.defaultFhsEnvArgs.multiPkgs;
-
   extraInstallCommands = ''
     mkdir -p $out/share
     cp -rt $out/share ${desktopItem}/share/applications ${appimageContents}/usr/share/icons

pkgs/applications/blockchains/wasabiwallet/default.nix

@@ -25,11 +25,11 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "wasabiwallet";
-  version = "2.0.7.1";
+  version = "2.0.7.2";
 
   src = fetchurl {
     url = "https://github.com/zkSNACKs/WalletWasabi/releases/download/v${version}/Wasabi-${version}.tar.gz";
-    sha256 = "sha256-u/QDdGLdD5+8j3r8pZQwcG3iTToFJEvzzV7Rl4ggvtM=";
+    sha256 = "sha256-s/rzjlPsOylbuQx7gDnctvl1tms95RqErk0vVlzhouw=";
   };
 
   dontBuild = true;

pkgs/applications/editors/vim/plugins/overrides.nix

@@ -839,6 +839,10 @@
     dependencies = with self; [ plenary-nvim ];
   };
 
+  luasnip = super.luasnip.overrideAttrs {
+    dependencies = with self; [ luaPackages.jsregexp ];
+  };
+
   magma-nvim-goose = buildVimPlugin {
     pname = "magma-nvim-goose";
     version = "2023-03-13";

pkgs/applications/editors/vscode/extensions/ms-python.python/default.nix

@@ -21,8 +21,8 @@ vscode-utils.buildVscodeMarketplaceExtension rec {
   mktplcRef = {
     name = "python";
     publisher = "ms-python";
-    version = "2023.1.10091012";
-    hash = "sha256-JosFv6ngJmw1XRILwTZMVxlGIdWFLFQjj4olfnVwAIM=";
+    version = "2024.5.11021008";
+    hash = "sha256-UnI0leRKqCtFLBdGS/UvLuCcxQhibyY0ChmzQ9uytoY=";
   };
 
   buildInputs = [ icu ];
@@ -37,11 +37,11 @@ vscode-utils.buildVscodeMarketplaceExtension rec {
   postPatch =
     ''
       # remove bundled python deps and use libs from nixpkgs
-      rm -r pythonFiles/lib
-      mkdir -p pythonFiles/lib/python/
-      ln -s ${python3.pkgs.debugpy}/lib/*/site-packages/debugpy pythonFiles/lib/python/
+      rm -r python_files/lib
+      mkdir -p python_files/lib/python/
+      ln -s ${python3.pkgs.debugpy}/lib/*/site-packages/debugpy python_files/lib/python/
       buildPythonPath "$propagatedBuildInputs"
-      for i in pythonFiles/*.py; do
+      for i in python_files/*.py; do
         patchPythonScript "$i"
       done
     ''

pkgs/applications/emulators/flycast/default.nix

@@ -17,13 +17,13 @@
 
 stdenv.mkDerivation rec {
   pname = "flycast";
-  version = "2.3";
+  version = "2.3.2";
 
   src = fetchFromGitHub {
     owner = "flyinghead";
     repo = "flycast";
     rev = "v${version}";
-    sha256 = "sha256-o1Xnyts2+A3ZkzVN0o8E5nGPo2c2vYltMlHF4LZMppU=";
+    sha256 = "sha256-YFLSUaEikwLPglHh3t8sHiKHRn5cchKzzkJlZDdgVsU=";
     fetchSubmodules = true;
   };
 

pkgs/applications/graphics/cq-editor/default.nix

@@ -1,63 +0,0 @@
-{ lib
-, mkDerivationWith
-, python3Packages
-, fetchFromGitHub
-, wrapQtAppsHook
-}:
-
-mkDerivationWith python3Packages.buildPythonApplication rec {
-  pname = "cq-editor";
-  version = "0.1.1";
-
-  src = fetchFromGitHub {
-    owner = "CadQuery";
-    repo = "CQ-editor";
-    rev = version;
-    sha256 = "1970izjaa60r5cg9i35rzz9lk5c5d8q1vw1rh2skvfbf63z1hnzv";
-  };
-
-  patches = [
-    ./spyder4.patch
-  ];
-
-  propagatedBuildInputs = with python3Packages; [
-    cadquery
-    logbook
-    pyqt5
-    pyparsing
-    pyqtgraph
-    spyder
-    path
-    qtconsole
-    requests
-  ];
-
-  nativeBuildInputs = [ wrapQtAppsHook ];
-  preFixup = ''
-    makeWrapperArgs+=("''${qtWrapperArgs[@]}")
-  '';
-
-  nativeCheckInputs = with python3Packages; [
-    pytest
-    pytest-xvfb
-    pytest-mock
-    pytest-cov
-    pytest-repeat
-    pytest-qt
-  ];
-
-  checkPhase = ''
-    pytest --no-xvfb
-  '';
-
-  # requires X server
-  doCheck = false;
-
-  meta = with lib; {
-    description = "CadQuery GUI editor based on PyQT";
-    homepage = "https://github.com/CadQuery/CQ-editor";
-    license = licenses.asl20;
-    maintainers = with maintainers; [ costrouc marcus7070 ];
-  };
-
-}

pkgs/applications/graphics/upscayl/default.nix

@@ -18,7 +18,7 @@ in
   appimageTools.wrapType2 {
     inherit pname version src;
 
-    extraPkgs = pkgs: with pkgs; [vulkan-headers vulkan-loader];
+    extraPkgs = pkgs: [ pkgs.vulkan-headers pkgs.vulkan-loader ];
 
     extraInstallCommands = ''
       mkdir -p $out/share/{applications,pixmaps}

pkgs/applications/misc/bazecor/default.nix

@@ -28,9 +28,7 @@ appimageTools.wrapAppImage rec {
   # taken from
   # https://github.com/Dygmalab/Bazecor/blob/v1.3.11/src/main/utils/udev.ts#L6
 
-  extraPkgs = p: (appimageTools.defaultFhsEnvArgs.multiPkgs p) ++ [
-    p.glib
-  ];
+  extraPkgs = pkgs: [ pkgs.glib ];
 
   # Also expose the udev rules here, so it can be used as:
   #   services.udev.packages = [ pkgs.bazecor ];

pkgs/applications/misc/blender/darwin.patch

@@ -1,27 +1,25 @@
-diff --git a/CMakeLists.txt b/CMakeLists.txt
---- a/CMakeLists.txt
-+++ b/CMakeLists.txt
-@@ -1894,7 +1894,7 @@ if(WITH_COMPILER_SHORT_FILE_MACRO)
-   ADD_CHECK_CXX_COMPILER_FLAG(CXX_PREFIX_MAP_FLAGS CXX_MACRO_PREFIX_MAP -fmacro-prefix-map=foo=bar)
+--- a/CMakeLists.txt	2024-03-01 08:08:05
++++ b/CMakeLists.txt	2024-04-24 15:45:30
+@@ -2134,7 +2134,7 @@
+   )
    if(C_MACRO_PREFIX_MAP AND CXX_MACRO_PREFIX_MAP)
      if(APPLE)
 -      if(XCODE AND ${XCODE_VERSION} VERSION_LESS 12.0)
 +      if(FALSE)
        # Developers may have say LLVM Clang-10.0.1 toolchain (which supports the flag)
        # with Xcode-11 (the Clang of which doesn't support the flag).
-         message(WARNING
-diff --git a/build_files/cmake/platform/platform_apple.cmake b/build_files/cmake/platform/platform_apple.cmake
---- a/build_files/cmake/platform/platform_apple.cmake
-+++ b/build_files/cmake/platform/platform_apple.cmake
-@@ -60,7 +60,6 @@ else()
-   message(STATUS "Using pre-compiled LIBDIR: ${LIBDIR}")
+         message(
+--- a/build_files/cmake/platform/platform_apple.cmake	2024-02-22 15:31:36
++++ b/build_files/cmake/platform/platform_apple.cmake	2024-04-24 16:06:13
+@@ -55,7 +55,6 @@
+   endif()
  endif()
- if(NOT EXISTS "${LIBDIR}/")
+ if(NOT EXISTS "${LIBDIR}/.git")
 -  message(FATAL_ERROR "Mac OSX requires pre-compiled libs at: '${LIBDIR}'")
  endif()
- 
- # Prefer lib directory paths
-@@ -98,10 +97,6 @@ if(WITH_CODEC_SNDFILE)
+ if(FIRST_RUN)
+   message(STATUS "Using pre-compiled LIBDIR: ${LIBDIR}")
+@@ -115,10 +114,6 @@
    find_library(_sndfile_VORBIS_LIBRARY NAMES vorbis HINTS ${LIBDIR}/ffmpeg/lib)
    find_library(_sndfile_VORBISENC_LIBRARY NAMES vorbisenc HINTS ${LIBDIR}/ffmpeg/lib)
    list(APPEND LIBSNDFILE_LIBRARIES
@@ -32,44 +30,26 @@ diff --git a/build_files/cmake/platform/platform_apple.cmake b/build_files/cmake
    )
  
    print_found_status("SndFile libraries" "${LIBSNDFILE_LIBRARIES}")
-@@ -118,7 +113,7 @@ if(WITH_PYTHON)
-     # Normally cached but not since we include them with blender.
-     set(PYTHON_INCLUDE_DIR "${LIBDIR}/python/include/python${PYTHON_VERSION}")
-     set(PYTHON_EXECUTABLE "${LIBDIR}/python/bin/python${PYTHON_VERSION}")
--    set(PYTHON_LIBRARY ${LIBDIR}/python/lib/libpython${PYTHON_VERSION}.a)
-+    set(PYTHON_LIBRARY ${LIBDIR}/python/lib/libpython${PYTHON_VERSION}.dylib)
-     set(PYTHON_LIBPATH "${LIBDIR}/python/lib/python${PYTHON_VERSION}")
-   else()
-     # Module must be compiled against Python framework.
-@@ -147,7 +142,7 @@ endif()
- 
- # FreeType compiled with Brotli compression for woff2.
- find_package(Freetype REQUIRED)
--list(APPEND FREETYPE_LIBRARIES
-+message(TRACE APPEND FREETYPE_LIBRARIES
-   ${LIBDIR}/brotli/lib/libbrotlicommon-static.a
-   ${LIBDIR}/brotli/lib/libbrotlidec-static.a)
- 
-@@ -159,9 +154,7 @@ if(WITH_CODEC_FFMPEG)
+@@ -162,9 +157,7 @@
    set(FFMPEG_ROOT_DIR ${LIBDIR}/ffmpeg)
    set(FFMPEG_FIND_COMPONENTS
      avcodec avdevice avformat avutil
 -    mp3lame ogg opus swresample swscale
 -    theora theoradec theoraenc vorbis vorbisenc
--    vorbisfile vpx x264 xvidcore)
-+    swresample swscale)
+-    vorbisfile vpx x264)
++   swresample swscale)
    if(EXISTS ${LIBDIR}/ffmpeg/lib/libaom.a)
      list(APPEND FFMPEG_FIND_COMPONENTS aom)
    endif()
-@@ -273,7 +266,6 @@ if(WITH_BOOST)
- endif()
+@@ -275,7 +268,6 @@
+ add_bundled_libraries(boost/lib)
  
  if(WITH_INTERNATIONAL OR WITH_CODEC_FFMPEG)
 -  string(APPEND PLATFORM_LINKFLAGS " -liconv") # boost_locale and ffmpeg needs it !
  endif()
  
  if(WITH_PUGIXML)
-@@ -402,7 +394,7 @@ endif()
+@@ -350,7 +342,7 @@
  
  # CMake FindOpenMP doesn't know about AppleClang before 3.12, so provide custom flags.
  if(WITH_OPENMP)
@@ -78,3 +58,12 @@ diff --git a/build_files/cmake/platform/platform_apple.cmake b/build_files/cmake
      # Use OpenMP from our precompiled libraries.
      message(STATUS "Using ${LIBDIR}/openmp for OpenMP")
      set(OPENMP_CUSTOM ON)
+@@ -427,7 +419,7 @@
+   " -Wl,-unexported_symbols_list,'${PLATFORM_SYMBOLS_MAP}'"
+ )
+ 
+-if(${XCODE_VERSION} VERSION_GREATER_EQUAL 15.0)
++if(FALSE)
+   if("${CMAKE_OSX_ARCHITECTURES}" STREQUAL "x86_64")
+     # Silence "no platform load command found in <static library>, assuming: macOS".
+     string(APPEND PLATFORM_LINKFLAGS " -Wl,-ld_classic")

pkgs/applications/misc/blender/default.nix

@@ -8,12 +8,14 @@
   addOpenGLRunpath,
   alembic,
   boost,
+  brotli,
   callPackage,
   cmake,
   colladaSupport ? true,
   config,
   cudaPackages,
   cudaSupport ? config.cudaSupport,
+  darwin,
   dbus,
   embree,
   fetchurl,
@@ -51,6 +53,7 @@
   libxkbcommon,
   llvmPackages,
   makeWrapper,
+  materialx,
   mesa,
   ocl-icd,
   openal,
@@ -71,6 +74,7 @@
   rocmPackages, # comes with a significantly larger closure size
   runCommand,
   spaceNavSupport ? stdenv.isLinux,
+  sse2neon,
   stdenv,
   tbb,
   wayland,
@@ -114,15 +118,14 @@ stdenv.mkDerivation (finalAttrs: {
         ''
           : > build_files/cmake/platform/platform_apple_xcode.cmake
           substituteInPlace source/creator/CMakeLists.txt \
-            --replace '${"$"}{LIBDIR}/python' \
-                      '${python3}'
-          substituteInPlace build_files/cmake/platform/platform_apple.cmake \
-            --replace '${"$"}{LIBDIR}/python' \
+            --replace-fail '${"$"}{LIBDIR}/python' \
                       '${python3}' \
-            --replace '${"$"}{LIBDIR}/opencollada' \
-                      '${opencollada}' \
-            --replace '${"$"}{PYTHON_LIBPATH}/site-packages/numpy' \
-                      '${python3Packages.numpy}/${python3.sitePackages}/numpy'
+            --replace-fail '${"$"}{LIBDIR}/materialx/' '${materialx}/'
+          substituteInPlace build_files/cmake/platform/platform_apple.cmake \
+            --replace-fail '${"$"}{LIBDIR}/brotli/lib/libbrotlicommon-static.a' \
+                      '${lib.getLib brotli}/lib/libbrotlicommon.dylib' \
+            --replace-fail '${"$"}{LIBDIR}/brotli/lib/libbrotlidec-static.a' \
+                      '${lib.getLib brotli}/lib/libbrotlidec.dylib'
         ''
       else
         ''
@@ -150,6 +153,7 @@ stdenv.mkDerivation (finalAttrs: {
       "-DWITH_FFTW3=ON"
       "-DWITH_IMAGE_OPENJPEG=ON"
       "-DWITH_INSTALL_PORTABLE=OFF"
+      "-DMaterialX_DIR=${materialx}/lib/cmake/MaterialX"
       "-DWITH_MOD_OCEANSIM=ON"
       "-DWITH_OPENCOLLADA=${if colladaSupport then "ON" else "OFF"}"
       "-DWITH_OPENCOLORIO=ON"
@@ -164,7 +168,7 @@ stdenv.mkDerivation (finalAttrs: {
 
       # Blender supplies its own FindAlembic.cmake (incompatible with the Alembic-supplied config file)
       "-DALEMBIC_INCLUDE_DIR=${lib.getDev alembic}/include"
-      "-DALEMBIC_LIBRARY=${lib.getLib alembic}/lib/libAlembic.so"
+      "-DALEMBIC_LIBRARY=${lib.getLib alembic}/lib/libAlembic${stdenv.hostPlatform.extensions.sharedLibrary}"
     ]
     ++ lib.optionals waylandSupport [
       "-DWITH_GHOST_WAYLAND=ON"
@@ -172,11 +176,12 @@ stdenv.mkDerivation (finalAttrs: {
       "-DWITH_GHOST_WAYLAND_DYNLOAD=OFF"
       "-DWITH_GHOST_WAYLAND_LIBDECOR=ON"
     ]
-    ++ lib.optionals stdenv.hostPlatform.isAarch64 [ "-DWITH_CYCLES_EMBREE=OFF" ]
+    ++ lib.optionals (stdenv.hostPlatform.isAarch64 && stdenv.hostPlatform.isLinux) [ "-DWITH_CYCLES_EMBREE=OFF" ]
     ++ lib.optionals stdenv.isDarwin [
       "-DLIBDIR=/does-not-exist"
-      "-DWITH_CYCLES_OSL=OFF" # requires LLVM
-      "-DWITH_OPENVDB=OFF" # OpenVDB currently doesn't build on darwin
+      "-DWITH_CYCLES_OSL=OFF" # causes segfault on aarch64-darwin
+      "-DSSE2NEON_INCLUDE_DIR=${sse2neon}/lib"
+      "-DWITH_USD=OFF" # currently fails on darwin
     ]
     ++ lib.optional stdenv.cc.isClang "-DPYTHON_LINKFLAGS=" # Clang doesn't support "-export-dynamic"
     ++ lib.optional jackaudioSupport "-DWITH_JACK=ON"
@@ -219,21 +224,22 @@ stdenv.mkDerivation (finalAttrs: {
       libsndfile
       libtiff
       libwebp
+      materialx
       opencolorio
       openexr
       openimageio
       openjpeg
       openpgl
       (opensubdiv.override { inherit cudaSupport; })
+      openvdb
       potrace
       pugixml
-      pyPkgsOpenusd
       python3
       tbb
       zlib
       zstd
     ]
-    ++ lib.optionals (!stdenv.isAarch64) [
+    ++ lib.optionals (!stdenv.isAarch64 && stdenv.isLinux) [
       embree
       (openimagedenoise.override { inherit cudaSupport; })
     ]
@@ -248,8 +254,8 @@ stdenv.mkDerivation (finalAttrs: {
           libXrender
           libXxf86vm
           openal
-          openvdb # OpenVDB currently doesn't build on darwin
           openxr-loader
+          pyPkgsOpenusd
         ]
       else
         [
@@ -259,7 +265,11 @@ stdenv.mkDerivation (finalAttrs: {
           OpenAL
           OpenGL
           SDL
+          brotli
+          embree
           llvmPackages.openmp
+          (openimagedenoise.override { inherit cudaSupport; })
+          sse2neon
         ]
     )
     ++ lib.optionals cudaSupport [ cudaPackages.cuda_cudart ]
@@ -280,11 +290,12 @@ stdenv.mkDerivation (finalAttrs: {
       ps = python3Packages;
     in
     [
+      materialx
       ps.numpy
       ps.requests
       ps.zstandard
-      pyPkgsOpenusd
-    ];
+    ]
+    ++ lib.optionals (!stdenv.isDarwin) [ pyPkgsOpenusd ];
 
   blenderExecutable =
     placeholder "out"
@@ -295,8 +306,10 @@ stdenv.mkDerivation (finalAttrs: {
       mkdir $out/Applications
       mv $out/Blender.app $out/Applications
     ''
-    + ''
+    + lib.optionalString stdenv.isLinux ''
       mv $out/share/blender/${lib.versions.majorMinor finalAttrs.version}/python{,-ext}
+    ''
+    + ''
       buildPythonPath "$pythonPath"
       wrapProgram $blenderExecutable \
         --prefix PATH : $program_PATH \
@@ -311,6 +324,9 @@ stdenv.mkDerivation (finalAttrs: {
       isELF "$program" || continue
       addOpenGLRunpath "$program"
     done
+  ''
+  + lib.optionalString stdenv.isDarwin ''
+    makeWrapper $out/Applications/Blender.app/Contents/MacOS/Blender $out/bin/blender
   '';
 
   passthru = {
@@ -327,15 +343,13 @@ stdenv.mkDerivation (finalAttrs: {
     tests = {
       render = runCommand "${finalAttrs.pname}-test" { } ''
         set -euo pipefail
-
         export LIBGL_DRIVERS_PATH=${mesa.drivers}/lib/dri
         export __EGL_VENDOR_LIBRARY_FILENAMES=${mesa.drivers}/share/glvnd/egl_vendor.d/50_mesa.json
-
         cat <<'PYTHON' > scene-config.py
         import bpy
         bpy.context.scene.eevee.taa_render_samples = 32
         bpy.context.scene.cycles.samples = 32
-        if ${if stdenv.isAarch64 then "True" else "False"}:
+        if ${if (stdenv.isAarch64 && stdenv.isLinux) then "True" else "False"}:
             bpy.context.scene.cycles.use_denoising = False
         bpy.context.scene.render.resolution_x = 100
         bpy.context.scene.render.resolution_y = 100
@@ -347,7 +361,7 @@ stdenv.mkDerivation (finalAttrs: {
         for engine in BLENDER_EEVEE CYCLES; do
           echo "Rendering with $engine..."
           # Beware that argument order matters
-          ${finalAttrs.finalPackage}/bin/blender \
+          ${lib.getExe finalAttrs.finalPackage} \
             --background \
             -noaudio \
             --factory-startup \
@@ -372,8 +386,10 @@ stdenv.mkDerivation (finalAttrs: {
       "aarch64-linux"
       "x86_64-darwin"
       "x86_64-linux"
+      "aarch64-darwin"
     ];
-    broken = stdenv.isDarwin;
+    # the current apple sdk is too old (currently 11_0) and fails to build "metal" on x86_64-darwin
+    broken = stdenv.hostPlatform.system == "x86_64-darwin";
     maintainers = with lib.maintainers; [
       goibhniu
       veprbl

pkgs/applications/misc/firefly-desktop/default.nix

@@ -12,7 +12,7 @@ let
 in appimageTools.wrapType2 {
   inherit pname version src;
 
-  extraPkgs = pkgs: (appimageTools.defaultFhsEnvArgs.multiPkgs pkgs) ++ [ pkgs.libsecret ];
+  extraPkgs = pkgs: [ pkgs.libsecret ];
 
   extraInstallCommands = ''
     mkdir -p $out/share/applications $out/share/pixmaps

pkgs/applications/misc/golden-cheetah-bin/default.nix

@@ -14,7 +14,7 @@ in
 appimageTools.wrapType2 {
   inherit pname src version;
 
-  extraPkgs = pkgs: with pkgs; [ R zlib libusb-compat-0_1 ];
+  extraPkgs = pkgs: [ pkgs.R pkgs.zlib pkgs.libusb-compat-0_1 ];
 
   extraInstallCommands = ''
     mv $out/bin/${pname} $out/bin/GoldenCheetah

pkgs/applications/misc/gxkb/default.nix

@@ -1,16 +1,16 @@
-{ lib, stdenv, fetchFromGitHub, autoreconfHook, pkg-config, gtk3, libwnck, libxklavier
+{ lib, stdenv, fetchFromGitHub, fetchurl, git, autoreconfHook, pkg-config, gtk3, libwnck, libxklavier
 , appindicatorSupport ? true, libayatana-appindicator
 }:
 
 stdenv.mkDerivation rec {
   pname = "gxkb";
-  version = "0.9.3";
+  version = "0.9.5";
 
   src = fetchFromGitHub {
     owner = "zen-tools";
     repo = "gxkb";
     rev = "v${version}";
-    sha256 = "sha256-9r1eZl7PgIt2ZpK+QQHaa460imIHT3Lh5mpzcFglyWc=";
+    sha256 = "sha256-oBIBIkj4p6HlF0PRQtI/K5dhLs7pbPxN7Cgr/YZaI1s=";
   };
 
   nativeBuildInputs = [ pkg-config autoreconfHook ];
@@ -19,6 +19,18 @@ stdenv.mkDerivation rec {
   configureFlags = lib.optional appindicatorSupport "--enable-appindicator=yes";
   outputs = [ "out" "man" ];
 
+  # This patch restore data which was wiped by upstream without any technical reasons
+  # https://github.com/omgbebebe/gxkb/commit/727ec8b595a91dbb540e6087750f43b85d0dfbc0
+  # NOTE: the `patch` hook cannot be used here due to lack of support for git binary patches
+  p1 = fetchurl {
+       url = "https://github.com/omgbebebe/gxkb/commit/727ec8b595a91dbb540e6087750f43b85d0dfbc0.patch";
+       hash = "sha256-x7x3MHHrOnPivvlzOFqgFAA5BDB2LOXMlalPYbwM/1Q=";
+  };
+
+  postPatch = ''
+    ${git}/bin/git apply ${p1}
+  '';
+
   meta = with lib; {
     description = "X11 keyboard indicator and switcher";
     homepage = "https://zen-tools.github.io/gxkb/";

pkgs/applications/misc/joplin-desktop/default.nix

@@ -49,8 +49,6 @@ let
       export LC_ALL=C.UTF-8
     '';
 
-    multiArch = false; # no 32bit needed
-    extraPkgs = appimageTools.defaultFhsEnvArgs.multiPkgs;
     extraInstallCommands = ''
       source "${makeWrapper}/nix-support/setup-hook"
       wrapProgram $out/bin/${pname} \

pkgs/applications/misc/marktext/default.nix

@@ -20,11 +20,7 @@ appimageTools.wrapType2 rec {
     export LC_ALL=C.UTF-8
   '';
 
-  multiArch = false; # no 32bit needed
-  extraPkgs = p: (appimageTools.defaultFhsEnvArgs.multiPkgs p) ++ [
-    p.libsecret
-    p.xorg.libxkbfile
-  ];
+  extraPkgs = pkgs: [ pkgs.libsecret pkgs.xorg.libxkbfile  ];
 
   extraInstallCommands = ''
     install -m 444 -D ${appimageContents}/marktext.desktop $out/share/applications/marktext.desktop

pkgs/applications/misc/mobilecoin-wallet/default.nix

@@ -13,7 +13,7 @@ let
 in appimageTools.wrapType2 {
   inherit name src;
 
-  extraPkgs = pkgs: (appimageTools.defaultFhsEnvArgs.multiPkgs pkgs) ++ [ pkgs.libsecret ];
+  extraPkgs = pkgs: [ pkgs.libsecret ];
 
   extraInstallCommands = ''
     mv $out/bin/${name} $out/bin/${pname}

pkgs/applications/misc/neo4j-desktop/default.nix

@@ -12,7 +12,7 @@ let
 in appimageTools.wrapType2 {
   inherit pname version src;
 
-  extraPkgs = pkgs: with pkgs; [ libsecret ];
+  extraPkgs = pkgs: [ pkgs.libsecret ];
 
   extraInstallCommands = ''
     install -m 444 -D ${appimageContents}/${pname}.desktop -t $out/share/applications

pkgs/applications/misc/notable/default.nix

@@ -13,8 +13,6 @@ let
   appimageContents = appimageTools.extract {
     inherit pname version src;
   };
-
-  nativeBuildInputs = [ makeWrapper ];
 in
 appimageTools.wrapType2 rec {
 
@@ -24,8 +22,8 @@ appimageTools.wrapType2 rec {
     export LC_ALL=C.UTF-8
   '';
 
-  multiArch = false; # no 32bit needed
-  extraPkgs = p: (appimageTools.defaultFhsEnvArgs.multiPkgs p) ++ [ p.at-spi2-atk p.at-spi2-core ];
+  extraPkgs = pkgs: [ pkgs.at-spi2-atk pkgs.at-spi2-core ];
+
   extraInstallCommands = ''
     install -m 444 -D ${appimageContents}/notable.desktop $out/share/applications/notable.desktop
     install -m 444 -D ${appimageContents}/usr/share/icons/hicolor/1024x1024/apps/notable.png \

pkgs/applications/misc/notesnook/default.nix

@@ -48,8 +48,6 @@ let
       export LC_ALL=C.UTF-8
     '';
 
-    multiPkgs = null; # no 32bit needed
-    extraPkgs = appimageTools.defaultFhsEnvArgs.multiPkgs;
     extraInstallCommands = ''
       install -Dm444 ${appimageContents}/notesnook.desktop -t $out/share/applications
       install -Dm444 ${appimageContents}/notesnook.png -t $out/share/pixmaps

pkgs/applications/misc/pgmodeler/default.nix

@@ -13,13 +13,13 @@
 
 stdenv.mkDerivation rec {
   pname = "pgmodeler";
-  version = "1.1.2";
+  version = "1.1.3";
 
   src = fetchFromGitHub {
     owner = "pgmodeler";
     repo = "pgmodeler";
     rev = "v${version}";
-    sha256 = "sha256-urKAsuYmK8dsXhP+I7p27PXXYRapPtkI8FqARfLwnEw=";
+    sha256 = "sha256-LDgRv7Todyy2pnE21Z0O5JQ6mE4ZO3THv6rfEWU66Cc=";
   };
 
   nativeBuildInputs = [ pkg-config qmake wrapQtAppsHook ];

pkgs/applications/misc/todoist-electron/default.nix

@@ -22,9 +22,7 @@ in appimageTools.wrapAppImage {
   inherit pname version;
   src = appimageContents;
 
-  extraPkgs = { pkgs, ... }@args: [
-    pkgs.hidapi
-  ] ++ appimageTools.defaultFhsEnvArgs.multiPkgs args;
+  extraPkgs = pkgs: [ pkgs.hidapi ];
 
   extraInstallCommands = ''
     # Add desktop convencience stuff

pkgs/applications/misc/zettlr/default.nix

@@ -1,6 +1,6 @@
-{ callPackage, texliveMedium }:
+{ callPackage }:
 
-builtins.mapAttrs (pname: attrs: callPackage ./generic.nix (attrs // { inherit pname; inherit texliveMedium; })) {
+builtins.mapAttrs (pname: attrs: callPackage ./generic.nix (attrs // { inherit pname; })) {
   zettlr = {
     version = "3.0.2";
     hash = "sha256-xwBq+kLmTth15uLiYWJOhi/YSPZVJNO6JTrKFojSDXA=";

pkgs/applications/misc/zettlr/generic.nix

@@ -4,8 +4,6 @@
 , appimageTools
 , lib
 , fetchurl
-, texliveMedium
-, pandoc
 }:
 
 # Based on https://gist.github.com/msteen/96cb7df66a359b827497c5269ccbbf94 and joplin-desktop nixpkgs.
@@ -21,8 +19,8 @@ in
 appimageTools.wrapType2 rec {
   inherit pname version src;
 
-  multiArch = false; # no 32bit needed
-  extraPkgs = pkgs: (appimageTools.defaultFhsEnvArgs.multiPkgs pkgs) ++ [ texliveMedium pandoc ];
+  extraPkgs = pkgs: [ pkgs.texliveMedium pkgs.pandoc ];
+
   extraInstallCommands = ''
     install -m 444 -D ${appimageContents}/Zettlr.desktop $out/share/applications/Zettlr.desktop
     install -m 444 -D ${appimageContents}/Zettlr.png $out/share/icons/hicolor/512x512/apps/Zettlr.png

pkgs/applications/networking/Sylk/default.nix

@@ -17,9 +17,6 @@ appimageTools.wrapType2 rec {
     export LC_ALL=C.UTF-8
   '';
 
-  multiArch = false; # no 32bit needed
-  extraPkgs = appimageTools.defaultFhsEnvArgs.multiPkgs;
-
   meta = with lib; {
     description = "Sylk WebRTC client";
     homepage = "https://sylkserver.com/";

pkgs/applications/networking/browsers/firefox/packages.nix

@@ -3,10 +3,10 @@
 {
   firefox = buildMozillaMach rec {
     pname = "firefox";
-    version = "125.0.3";
+    version = "126.0";
     src = fetchurl {
       url = "mirror://mozilla/firefox/releases/${version}/source/firefox-${version}.source.tar.xz";
-      sha512 = "18e705a3093290311ccb5f27f01e43fe243ece94c1769a9ccc4fa53d370e32a1ec6a107cdeb531e9468b9aca1a1fe668161adb7acc1ec65fd383837882c7d484";
+      sha512 = "56025b051d544ca294911a1d6a66f09945f71012131881b64313dafb579730810a4b091950c90a21d4fd3f393ba23670d8409086e1677d80d0bbbe347c303527";
     };
 
     extraPatches = [
@@ -94,11 +94,11 @@
 
   firefox-esr-115 = buildMozillaMach rec {
     pname = "firefox-esr-115";
-    version = "115.10.0esr";
+    version = "115.11.0esr";
     applicationName = "Mozilla Firefox ESR";
     src = fetchurl {
       url = "mirror://mozilla/firefox/releases/${version}/source/firefox-${version}.source.tar.xz";
-      sha512 = "0626e2c68ce43f24dfc2b9216e2565537ad8781daf4195d53420e1b78d57d0f6360fbe56b0ddbedae3818546c72472c85c1ff2b208c123d32a0543e666f42b65";
+      sha512 = "0f3a87c99fb008088afd509d9259f893fdd44ea6bf6a5e69806fefb8d355415e81b9e8832a392acb9d0c1c50e4add7f1362a4aaadc35e1d9c2e55baf7136aed8";
     };
 
     meta = {

pkgs/applications/networking/browsers/polypane/default.nix

@@ -16,8 +16,7 @@ let
 in appimageTools.wrapType2 {
   inherit pname src version;
 
-  multiArch = false;
-  extraPkgs = pkgs: appimageTools.defaultFhsEnvArgs.multiPkgs pkgs ++ [ pkgs.bash ];
+  extraPkgs = pkgs: [ pkgs.bash ];
 
   extraInstallCommands = ''
     install -m 444 -D ${appimageContents}/${pname}.desktop $out/share/applications/${pname}.desktop

pkgs/applications/networking/cluster/glooctl/default.nix

@@ -6,13 +6,13 @@
 
 buildGoModule rec {
   pname = "glooctl";
-  version = "1.16.10";
+  version = "1.16.11";
 
   src = fetchFromGitHub {
     owner = "solo-io";
     repo = "gloo";
     rev = "v${version}";
-    hash = "sha256-GC0/HGPO/sbkyf2bLY0A+pQrPYqMv6BP0zNUHENpQjg=";
+    hash = "sha256-3GTSIZRELj8Pdm02SUKSCk6/Q7Hkuggvq+XjJAH9qU0=";
   };
 
   vendorHash = "sha256-UyzqKpF2WBj25Bm4MtkF6yjl87A61vGsteBNCjJV178=";

pkgs/applications/networking/cluster/hubble/default.nix

@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "hubble";
-  version = "0.13.3";
+  version = "0.13.4";
 
   src = fetchFromGitHub {
     owner = "cilium";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-tHkLUoccOUcUjODecy1QyeuDb/aXv67sK8JHJ1IspC8=";
+    sha256 = "sha256-YordxRIZtlYQprAYnH9Qn5ha6y7D52sjEOaRTcd0Z8g=";
   };
 
   vendorHash = null;

pkgs/applications/networking/cluster/istioctl/default.nix

@@ -2,15 +2,15 @@
 
 buildGoModule rec {
   pname = "istioctl";
-  version = "1.21.2";
+  version = "1.22.0";
 
   src = fetchFromGitHub {
     owner = "istio";
     repo = "istio";
     rev = version;
-    hash = "sha256-U0SCjozy968pcXMGyUgM47VGYYNwPq8wOzTnKp49ZY4=";
+    hash = "sha256-xiIuCwzERvy7HFx9CZHen1tz1nwsTMryq5hB0om2dyo=";
   };
-  vendorHash = "sha256-23t1xJPRip0ojXmUl1qlk6QJsYHT+9EAS080m6c0d6U=";
+  vendorHash = "sha256-de9cPm2MuflsOhFZfZmvZpLYiwt3UBgW+MO1Z2QB4F4=";
 
   nativeBuildInputs = [ installShellFiles ];
 

pkgs/applications/networking/cluster/k3s/1_30/chart-versions.nix

@@ -0,0 +1,10 @@
+{
+  traefik-crd = {
+    url = "https://k3s.io/k3s-charts/assets/traefik-crd/traefik-crd-25.0.3+up25.0.0.tgz";
+    sha256 = "1z693i4kd3jyf26ccnb0sxjyxadipl6k13n7jyg5v4y93fv1rpdw";
+  };
+  traefik = {
+    url = "https://k3s.io/k3s-charts/assets/traefik/traefik-25.0.3+up25.0.0.tgz";
+    sha256 = "1a24qlp7c6iri72ka1i37l1lzn13xibrd26dy295z2wzr55gg7if";
+  };
+}

pkgs/applications/networking/cluster/k3s/1_30/versions.nix

@@ -0,0 +1,14 @@
+{
+  k3sVersion = "1.30.0+k3s1";
+  k3sCommit = "14549535f13c63fc239ba055d36d590e68b01503";
+  k3sRepoSha256 = "1dph6clzzanlx7dbdzpamnw7gpw98j850my28lcb3zdzhvhsc74b";
+  k3sVendorHash = "sha256-YBWiIf8F71ibR7sCiYtmsAcY1MsvkhTD/K45tOHQC5w=";
+  chartVersions = import ./chart-versions.nix;
+  k3sRootVersion = "0.13.0";
+  k3sRootSha256 = "1jq5f0lm08abx5ikarf92z56fvx4kjpy2nmzaazblb34lajw87vj";
+  k3sCNIVersion = "1.4.0-k3s2";
+  k3sCNISha256 = "17dg6jgjx18nrlyfmkv14dhzxsljz4774zgwz5dchxcf38bvarqa";
+  containerdVersion = "1.7.15-k3s1";
+  containerdSha256 = "18hlj4ixjk7wvamfd66xyc0cax2hs9s7yjvlx52afxdc73194y0f";
+  criCtlVersion = "1.29.0-k3s1";
+}

pkgs/applications/networking/cluster/k3s/default.nix

@@ -54,4 +54,15 @@ in
       ];
     }
   ) extraArgs;
+
+  # 1_30 can be built with the same builder as 1_26
+  k3s_1_30 = common (
+    (import ./1_30/versions.nix)
+    // {
+      updateScript = [
+        ./update-script.sh
+        "30"
+      ];
+    }
+  ) extraArgs;
 }

pkgs/applications/networking/cluster/krane/Gemfile.lock

@@ -14,7 +14,7 @@ GEM
     addressable (2.8.6)
       public_suffix (>= 2.0.2, < 6.0)
     base64 (0.2.0)
-    bigdecimal (3.1.7)
+    bigdecimal (3.1.8)
     colorize (0.8.1)
     concurrent-ruby (1.2.3)
     connection_pool (2.4.1)
@@ -48,13 +48,13 @@ GEM
     http-cookie (1.0.5)
       domain_name (~> 0.5)
     http-form_data (2.3.0)
-    i18n (1.14.4)
+    i18n (1.14.5)
       concurrent-ruby (~> 1.0)
     jsonpath (1.1.5)
       multi_json
     jwt (2.8.1)
       base64
-    krane (3.5.2)
+    krane (3.5.3)
       activesupport (>= 5.0)
       colorize (~> 0.8)
       concurrent-ruby (~> 1.1)
@@ -75,7 +75,7 @@ GEM
       rake (~> 13.0)
     mime-types (3.5.2)
       mime-types-data (~> 3.2015)
-    mime-types-data (3.2024.0305)
+    mime-types-data (3.2024.0507)
     minitest (5.22.3)
     multi_json (1.15.0)
     mutex_m (0.2.0)
@@ -109,4 +109,4 @@ DEPENDENCIES
   krane
 
 BUNDLED WITH
-   2.5.7
+   2.5.9

pkgs/applications/networking/cluster/krane/gemset.nix

@@ -36,10 +36,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0cq1c29zbkcxgdihqisirhcw76xc768z2zpd5vbccpq0l1lv76g7";
+      sha256 = "1gi7zqgmqwi5lizggs1jhc3zlwaqayy9rx2ah80sxy24bbnng558";
       type = "gem";
     };
-    version = "3.1.7";
+    version = "3.1.8";
   };
   colorize = {
     groups = ["default"];
@@ -214,10 +214,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0lbm33fpb3w06wd2231sg58dwlwgjsvym93m548ajvl6s3mfvpn7";
+      sha256 = "1ffix518y7976qih9k1lgnc17i3v6yrlh0a3mckpxdb4wc2vrp16";
       type = "gem";
     };
-    version = "1.14.4";
+    version = "1.14.5";
   };
   jsonpath = {
     dependencies = ["multi_json"];
@@ -247,10 +247,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1s2xc5igk3yg3jpl3abakvrsf4xl6hljhgyddjsrp2g05sksa9x6";
+      sha256 = "11jj5fpfsb1sfwgc356xv1vxl8yq65wbbshmawpagk555y0pzbpb";
       type = "gem";
     };
-    version = "3.5.2";
+    version = "3.5.3";
   };
   kubeclient = {
     dependencies = ["http" "jsonpath" "recursive-open-struct" "rest-client"];
@@ -290,10 +290,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "00x7w5xqsj9m33v3vkmy23wipkkysafksib53ypzn27p5g81w455";
+      sha256 = "0kybw1a6f7d1ipyawnpi5cwiy05rkz9qwglgfvhmd1z0l2gcigmm";
       type = "gem";
     };
-    version = "3.2024.0305";
+    version = "3.2024.0507";
   };
   minitest = {
     groups = ["default"];

pkgs/applications/networking/cluster/lens/linux.nix

@@ -1,4 +1,4 @@
-{ lib, stdenv, pname, version, src, meta, appimageTools, makeWrapper, nss_latest }:
+{ pname, version, src, meta, appimageTools, makeWrapper }:
 let
 
   name = "${pname}-${version}";
@@ -25,5 +25,5 @@ appimageTools.wrapType2 {
         --replace 'Exec=AppRun' 'Exec=${pname}'
     '';
 
-  extraPkgs = _: [ nss_latest ];
+  extraPkgs = pkgs: [ pkgs.nss_latest ];
 }

pkgs/applications/networking/cluster/minikube/default.nix

@@ -15,9 +15,9 @@
 
 buildGoModule rec {
   pname = "minikube";
-  version = "1.33.0";
+  version = "1.33.1";
 
-  vendorHash = "sha256-eFIo9C9AEZksQolMlWKPJR2WWpU7Yu4eJb1OBwdqGhI=";
+  vendorHash = "sha256-VHl6CKPWqahX70GHbZE6SVa8XPfiC912DvsOteH2B0w=";
 
   doCheck = false;
 
@@ -25,7 +25,7 @@ buildGoModule rec {
     owner = "kubernetes";
     repo = "minikube";
     rev = "v${version}";
-    sha256 = "sha256-4OSChPgUD1oYnChAi7r2jgZpplR9ZaHpHPiTS6jSpME=";
+    sha256 = "sha256-z0wNngEzddxpeeLyQVA2yRC5SfYvU5G66V95sVmW6bA=";
   };
   postPatch =
     (

pkgs/applications/networking/cluster/nova/default.nix

@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "nova";
-  version = "3.8.0";
+  version = "3.9.0";
 
   src = fetchFromGitHub {
     owner = "FairwindsOps";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-3bSxMb/JFIy3b6N/94cXfGlUbPIm046O9m2KPan8YIs=";
+    hash = "sha256-9ccWH0bh67LCwzKmyaE32j+qeKfNauclSMjpRwdblH8=";
   };
 
-  vendorHash = "sha256-c30B8Wjvwp4NnB1P8h4/raGiGAX/cbTZ/KQqh/qeNhA=";
+  vendorHash = "sha256-Vt2yUYm2i1NHzW7GxDRqBpaFS4dLfODNEMPO+CTwrLY=";
 
   ldflags = [ "-X main.version=${version}" "-s" "-w" ];
 

pkgs/applications/networking/gnmic/default.nix

@@ -8,16 +8,16 @@
 
 buildGoModule rec {
   pname = "gnmic";
-  version = "0.36.2";
+  version = "0.37.0";
 
   src = fetchFromGitHub {
     owner = "openconfig";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-PUOIKPkzM6riiXR8R1Io0QI/qr6HaexfFgbp2Hx2SOo=";
+    hash = "sha256-PktDdwtdCHLgLVpCRLi+Rna7dO2JeAAT6myFesIhpYc=";
   };
 
-  vendorHash = "sha256-zrG/rNoYtfVNN50g41txLQIcBAKi1yE5p1TODrDiXzU=";
+  vendorHash = "sha256-gxtVvh39VqJgS5VetnLpUyKJE8DcUZgn4MA8zdD/ccU=";
 
   ldflags = [
     "-s" "-w"

pkgs/applications/networking/instant-messengers/beeper/default.nix

@@ -2,7 +2,6 @@
 , stdenvNoCC
 , fetchurl
 , appimageTools
-, libsecret
 , makeWrapper
 , writeShellApplication
 , curl
@@ -19,7 +18,7 @@ let
   };
   appimage = appimageTools.wrapType2 {
     inherit version pname src;
-    extraPkgs = pkgs: with pkgs; [ libsecret ];
+    extraPkgs = pkgs: [ pkgs.libsecret ];
   };
   appimageContents = appimageTools.extractType2 {
     inherit version pname src;

pkgs/applications/networking/instant-messengers/caprine-bin/build-from-appimage.nix

@@ -1,5 +1,4 @@
-{ lib
-, fetchurl
+{ fetchurl
 , appimageTools
 , xorg
 , pname
@@ -27,8 +26,6 @@ in
     export LC_ALL=C.UTF-8
   '';
 
-  extraPkgs = pkgs: appimageTools.defaultFhsEnvArgs.multiPkgs pkgs;
-
   extraInstallCommands = ''
     mkdir -p $out/share
     "${xorg.lndir}/bin/lndir" -silent "${extracted}/usr/share" "$out/share"

pkgs/applications/networking/instant-messengers/cinny/default.nix

@@ -29,6 +29,11 @@ buildNpmPackage rec {
 
   npmDepsHash = "sha256-4R+To2LhcnEM9x1noo6MhCckyBKgPWiAi7zgDqAmaN0=";
 
+  # Fix error: no member named 'aligned_alloc' in the global namespace
+  env.NIX_CFLAGS_COMPILE = lib.optionalString (
+    stdenv.isDarwin && lib.versionOlder stdenv.hostPlatform.darwinSdkVersion "11.0"
+  ) "-D_LIBCPP_HAS_NO_LIBRARY_ALIGNED_ALLOCATION=1";
+
   nativeBuildInputs = [
     jq
     python3

pkgs/applications/networking/instant-messengers/rambox/default.nix

@@ -2,11 +2,11 @@
 
 let
   pname = "rambox";
-  version = "2.3.1";
+  version = "2.3.2";
 
   src = fetchurl {
     url = "https://github.com/ramboxapp/download/releases/download/v${version}/Rambox-${version}-linux-x64.AppImage";
-    hash = "sha256-fSj/AX1uCUAC3Vg5+rtGF3IDPFTHRAgJ8CPVL8BYc+E=";
+    hash = "sha256-9AGzhj4UL2rEe67qvkX5VYhQEMETGYSDWv5XOgABSEE=";
   };
 
   desktopItem = (makeDesktopItem {
@@ -30,7 +30,7 @@ appimageTools.wrapType2 {
     install -Dm644 ${desktopItem}/share/applications/* $out/share/applications
   '';
 
-  extraPkgs = pkgs: with pkgs; [ procps ];
+  extraPkgs = pkgs: [ pkgs.procps ];
 
   meta = with lib; {
     description = "Workspace Simplifier - a cross-platform application organizing web services into Workspaces similar to browser profiles";

pkgs/applications/networking/instant-messengers/signal-desktop/default.nix

@@ -1,6 +1,13 @@
-{ hostPlatform, callPackage }: {
-  signal-desktop = if hostPlatform.system == "aarch64-linux"
-    then callPackage ./signal-desktop-aarch64.nix { }
-    else callPackage ./signal-desktop.nix { };
-  signal-desktop-beta = callPackage ./signal-desktop-beta.nix{ };
+{ hostPlatform, callPackage }:
+{
+  signal-desktop =
+    if hostPlatform.system == "aarch64-linux" then
+      callPackage ./signal-desktop-aarch64.nix { }
+    else
+      callPackage ./signal-desktop.nix { };
+  signal-desktop-beta = (callPackage ./signal-desktop-beta.nix { }).overrideAttrs (old: {
+    meta = old.meta // {
+      platforms = [ "x86_64-linux" ];
+    };
+  });
 }

pkgs/applications/networking/instant-messengers/signalbackup-tools/default.nix

@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "signalbackup-tools";
-  version = "20240506";
+  version = "20240509-1";
 
   src = fetchFromGitHub {
     owner = "bepaald";
     repo = pname;
     rev = version;
-    hash = "sha256-rPM5Qz1n9bTOF//sqpT+LvEjBSCT2BjyQBIxjV6CkGU=";
+    hash = "sha256-GUh/OTeJNBg3TDij/8jIEXfw9ox1wvq6tRq61JbMiZg=";
   };
 
   postPatch = ''

pkgs/applications/networking/irc/irccloud/default.nix

@@ -16,7 +16,7 @@ let
 in appimageTools.wrapType2 {
   inherit pname version src;
 
-  extraPkgs = pkgs: with pkgs; [ at-spi2-core ];
+  extraPkgs = pkgs: [ pkgs.at-spi2-core ];
 
   extraInstallCommands = ''
     install -m 444 -D ${appimageContents}/irccloud.desktop $out/share/applications/irccloud.desktop

pkgs/applications/networking/mailreaders/electron-mail/default.nix

@@ -1,4 +1,4 @@
-{ appimageTools, lib, fetchurl, libsecret }:
+{ appimageTools, lib, fetchurl }:
 
 let
   pname = "electron-mail";
@@ -20,9 +20,9 @@ in appimageTools.wrapType2 {
     cp -r ${appimageContents}/usr/share/icons $out/share
   '';
 
-  extraPkgs = pkgs: with pkgs; [
-    libsecret
-    libappindicator-gtk3
+  extraPkgs = pkgs: [
+    pkgs.libsecret
+    pkgs.libappindicator-gtk3
   ];
 
   meta = with lib; {

pkgs/applications/networking/mailreaders/tutanota-desktop/default.nix

@@ -12,7 +12,7 @@ appimageTools.wrapType2 rec {
     hash = "sha256-D7qWwIFuCJmBvfdgf4Dsd2/jvi39tbAttaHOwLND4DY=";
   };
 
-  extraPkgs = pkgs: (appimageTools.defaultFhsEnvArgs.multiPkgs pkgs) ++ [ pkgs.libsecret ];
+  extraPkgs = pkgs: [ pkgs.libsecret ];
 
   extraInstallCommands =
     let appimageContents = appimageTools.extract { inherit pname version src; };

pkgs/applications/networking/remote/xrdp/default.nix

@@ -19,22 +19,11 @@
 , lame
 , pixman
 , libjpeg_turbo
+, _experimental-update-script-combinators
+, gitUpdater
 }:
 
 let
-  version = "0.9.25.1";
-  patchedXrdpSrc = applyPatches {
-    patches = [ ./dynamic_config.patch ];
-    name = "xrdp-patched-${version}";
-    src = fetchFromGitHub {
-      owner = "neutrinolabs";
-      repo = "xrdp";
-      rev = "v${version}";
-      fetchSubmodules = true;
-      hash = "sha256-oAs0oWkCyj3ObdJuHLfT25ZzkTrxNAXDiFU64OOP4Ow=";
-    };
-  };
-
   xorgxrdp = stdenv.mkDerivation rec {
     pname = "xorgxrdp";
     version = "0.9.20";
@@ -62,16 +51,29 @@ let
 
     preConfigure = "./bootstrap";
 
-    configureFlags = [ "XRDP_CFLAGS=-I${patchedXrdpSrc}/common"  ];
+    configureFlags = [ "XRDP_CFLAGS=-I${xrdp.src}/common"  ];
 
     enableParallelBuilding = true;
+
+    passthru.updateScript = gitUpdater { rev-prefix = "v"; };
   };
 
-  xrdp = stdenv.mkDerivation {
-    inherit version;
+  xrdp = stdenv.mkDerivation rec {
     pname = "xrdp";
+    version = "0.9.25.1";
 
-    src = patchedXrdpSrc;
+    src = applyPatches {
+      inherit version;
+      patches = [ ./dynamic_config.patch ];
+      name = "xrdp-patched-${version}";
+      src = fetchFromGitHub {
+        owner = "neutrinolabs";
+        repo = "xrdp";
+        rev = "v${version}";
+        fetchSubmodules = true;
+        hash = "sha256-oAs0oWkCyj3ObdJuHLfT25ZzkTrxNAXDiFU64OOP4Ow=";
+      };
+    };
 
     nativeBuildInputs = [ pkg-config autoconf automake which libtool nasm perl ];
 
@@ -150,6 +152,15 @@ let
 
     enableParallelBuilding = true;
 
+    passthru = {
+      inherit xorgxrdp;
+      updateScript = _experimental-update-script-combinators.sequence (map (item: item.command) [
+        (gitUpdater { rev-prefix = "v"; attrPath = "xrdp.src"; ignoredVersions = [ "beta" ]; })
+        { command = ["rm" "update-git-commits.txt"]; }
+        (gitUpdater { rev-prefix = "v"; attrPath = "xrdp.xorgxrdp"; })
+      ]);
+    };
+
     meta = with lib; {
       description = "An open source RDP server";
       homepage = "https://github.com/neutrinolabs/xrdp";

pkgs/applications/networking/remote/xrdp/pulseaudio-module-xrdp/default.nix

@@ -1,11 +1,11 @@
 { stdenv
 , fetchFromGitHub
 , lib
-, nix-update-script
 , pulseaudio
 , autoreconfHook
 , pkg-config
 , nixosTests
+, gitUpdater
 }:
 
 stdenv.mkDerivation rec {
@@ -47,7 +47,7 @@ stdenv.mkDerivation rec {
   ];
 
   passthru = {
-    updateScript = nix-update-script { };
+    updateScript = gitUpdater { rev-prefix = "v"; };
     tests = {
       inherit (nixosTests) xrdp-with-audio-pulseaudio;
     };

pkgs/applications/networking/station/default.nix

@@ -19,8 +19,6 @@ in appimageTools.wrapType2 rec {
     export LC_ALL=C.UTF-8
   '';
 
-  multiArch = false;
-  extraPkgs = appimageTools.defaultFhsEnvArgs.multiPkgs;
   extraInstallCommands = ''
     install -m 444 -D ${appimageContents}/browserx.desktop $out/share/applications/browserx.desktop
     install -m 444 -D ${appimageContents}/usr/share/icons/hicolor/512x512/apps/browserx.png \

pkgs/applications/networking/syncplay/default.nix

@@ -2,7 +2,6 @@
 , stdenv
 , fetchFromGitHub
 , buildPythonApplication
-, fetchpatch
 , pem
 , pyside6
 , twisted
@@ -14,7 +13,7 @@
 
 buildPythonApplication rec {
   pname = "syncplay";
-  version = "1.7.0";
+  version = "1.7.2";
 
   format = "other";
 
@@ -22,15 +21,10 @@ buildPythonApplication rec {
     owner = "Syncplay";
     repo = "syncplay";
     rev = "v${version}";
-    sha256 = "sha256-Te81yOv3D6M6aMfC5XrM6/I6BlMdlY1yRk1RRJa9Mxg=";
+    sha256 = "sha256-PERPE6141LXmb8fmW17Vu54Unpf9vEK+ahm6q1byRTU=";
   };
 
   patches = [
-    (fetchpatch {
-      name = "fix-typeerror.patch";
-      url = "https://github.com/Syncplay/syncplay/commit/b62b038cdf58c54205987dfc52ebf228505ad03b.patch";
-      hash = "sha256-pSP33Qn1I+nJBW8T1E1tSJKRh5OnZMRsbU+jr5z4u7c=";
-    })
     ./trusted_certificates.patch
   ];
 
@@ -52,6 +46,6 @@ buildPythonApplication rec {
     description = "Free software that synchronises media players";
     license = licenses.asl20;
     platforms = platforms.linux ++ platforms.darwin;
-    maintainers = with maintainers; [ Enzime ];
+    maintainers = with maintainers; [ assistant Enzime ];
   };
 }

pkgs/applications/networking/wgnord/default.nix

@@ -62,5 +62,6 @@ resholve.mkDerivation rec {
     maintainers = with lib.maintainers; [ urandom ];
     license = licenses.mit;
     mainProgram = "wgnord";
+    platforms = platforms.linux;
   };
 }

pkgs/applications/office/gnucash/0005-disable-test-lots.patch

@@ -0,0 +1,11 @@
+--- a/libgnucash/engine/test/CMakeLists.txt	2024-02-23 09:05:19.000000000 +0900
++++ b/libgnucash/engine/test/CMakeLists.txt	2024-05-08 22:08:04.572060359 +0900
+@@ -57,7 +57,6 @@
+ 
+ add_engine_test(test-account-object test-account-object.cpp)
+ add_engine_test(test-group-vs-book test-group-vs-book.cpp)
+-add_engine_test(test-lots test-lots.cpp)
+ add_engine_test(test-querynew test-querynew.c)
+ add_engine_test(test-query test-query.cpp)
+ add_engine_test(test-split-vs-account test-split-vs-account.cpp)
+

pkgs/applications/office/gnucash/default.nix

@@ -76,6 +76,9 @@ stdenv.mkDerivation rec {
     ./0003-remove-valgrind.patch
     # this patch makes gnucash exec the Finance::Quote wrapper directly
     ./0004-exec-fq-wrapper.patch
+    # this patch disables a flaky test
+    # see https://bugs.gnucash.org/show_bug.cgi?id=799289
+    ./0005-disable-test-lots.patch
     # Fix importing QIF by backporting a fix. remove on next release
     # https://bugs.gnucash.org/show_bug.cgi?id=799262
     (fetchpatch {

pkgs/applications/office/homebank/default.nix

@@ -3,10 +3,10 @@
 
 stdenv.mkDerivation rec {
   pname = "homebank";
-  version = "5.7.4";
+  version = "5.8";
   src = fetchurl {
     url = "https://www.gethomebank.org/public/sources/homebank-${version}.tar.gz";
-    hash = "sha256-Qs5xRsh16gyjyTORtqm/RxTbRiHGP0oJTcxviYW7VOQ=";
+    hash = "sha256-tgjcz4znnw++5lBoJDWtHKpRFENfM0xBpyhGf8nAACw=";
   };
 
   nativeBuildInputs = [ pkg-config wrapGAppsHook3 intltool ];

pkgs/applications/office/planify/default.nix

@@ -10,6 +10,7 @@
 , evolution-data-server
 , glib
 , glib-networking
+, gst_all_1
 , gtk4
 , gtksourceview5
 , gxml
@@ -49,6 +50,9 @@ stdenv.mkDerivation rec {
     evolution-data-server
     glib
     glib-networking
+    # Needed for GtkMediaStream creation with success.ogg, see #311295.
+    gst_all_1.gst-plugins-base
+    gst_all_1.gst-plugins-good
     gtk4
     gtksourceview5
     gxml

pkgs/applications/office/timeular/default.nix

@@ -1,7 +1,6 @@
 { lib
 , fetchurl
 , appimageTools
-, libsecret
 }:
 
 let
@@ -19,9 +18,7 @@ let
 in appimageTools.wrapType2 rec {
   inherit pname version src;
 
-  extraPkgs = pkgs: with pkgs; [
-    libsecret
-  ];
+  extraPkgs = pkgs: [ pkgs.libsecret ];
 
   extraInstallCommands = ''
     install -m 444 -D ${appimageContents}/timeular.desktop $out/share/applications/timeular.desktop

pkgs/applications/office/tusk/default.nix

@@ -31,8 +31,6 @@ in appimageTools.wrapType2 rec {
     export LC_ALL=C.UTF-8
   '';
 
-  multiArch = false; # no 32bit needed
-  extraPkgs = appimageTools.defaultFhsEnvArgs.multiPkgs;
   extraInstallCommands = ''
     mkdir "$out/share"
     ln -s "${desktopItem}/share/applications" "$out/share/"

pkgs/applications/radio/chirp/default.nix

@@ -10,13 +10,13 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "chirp";
-  version = "0.4.0-unstable-2024-05-03";
+  version = "0.4.0-unstable-2024-05-10";
 
   src = fetchFromGitHub {
     owner = "kk7ds";
     repo = "chirp";
-    rev = "e95140ff433b805ca16df04cba501b7332a9ec95";
-    hash = "sha256-UU3Ve6Yb7UK2nOLTfJasrlMX4iu1cpLBLScvhRhTUJ0=";
+    rev = "d5dc5c8e053dbcf87c8b0ccf03109c0870c22bfb";
+    hash = "sha256-Tqq1dTjtzHTgaHUAio5B8V4Bo+P8EPa3s/kG181TrCc=";
   };
   buildInputs = [
     glib

pkgs/applications/radio/cloudlog/default.nix

@@ -8,13 +8,13 @@
 
 stdenvNoCC.mkDerivation rec {
   pname = "cloudlog";
-  version = "2.6.10";
+  version = "2.6.11";
 
   src = fetchFromGitHub {
     owner = "magicbug";
     repo = "Cloudlog";
     rev = version;
-    hash = "sha256-VPiv/Df4dasiYUBA6UHrxBczmGAqzhQkPrknzSYJxAE=";
+    hash = "sha256-9JGhMCypoKOh1Gy1DdK7nrma+L4sJsYN/iuNhBPmHPA=";
   };
 
   postPatch = ''

pkgs/applications/science/biology/conglomerate/default.nix

@@ -1,20 +1,47 @@
-{ lib, stdenv, fetchFromGitHub, cmake, coreutils, perlPackages, bicpl, libminc, zlib, minc_tools,
-  makeWrapper }:
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  cmake,
+  coreutils,
+  perlPackages,
+  bicpl,
+  libminc,
+  zlib,
+  minc_tools,
+  makeWrapper,
+}:
 
 stdenv.mkDerivation rec {
   pname = "conglomerate";
-  version = "unstable-2017-09-10";
+  version = "unstable-2023-01-19";
 
   src = fetchFromGitHub {
-    owner  = "BIC-MNI";
-    repo   = pname;
-    rev    = "7343238bc6215942c7ecc885a224f24433a291b0";
-    sha256 = "1mlqgmy3jc13bv7d01rjwldxq0p4ayqic85xcl222hhifi3w2prr";
+    owner = "BIC-MNI";
+    repo = pname;
+    rev = "6fb26084f2871a85044e2e4afc868982702b40ed";
+    hash = "sha256-Inr4b2bxguzkcRQBURObsQQ0Rb3H/Zz6hEzNRd+IX3w=";
   };
 
-  nativeBuildInputs = [ cmake makeWrapper ];
-  buildInputs = [ libminc zlib bicpl ];
-  propagatedBuildInputs = [ coreutils minc_tools ] ++ (with perlPackages; [ perl GetoptTabular MNI-Perllib ]);
+  nativeBuildInputs = [
+    cmake
+    makeWrapper
+  ];
+  buildInputs = [
+    libminc
+    zlib
+    bicpl
+  ];
+  propagatedBuildInputs =
+    [
+      coreutils
+      minc_tools
+    ]
+    ++ (with perlPackages; [
+      perl
+      GetoptTabular
+      MNI-Perllib
+    ]);
 
   cmakeFlags = [
     "-DLIBMINC_DIR=${libminc}/lib/cmake"
@@ -23,15 +50,20 @@ stdenv.mkDerivation rec {
 
   postFixup = ''
     for p in $out/bin/*; do
-      wrapProgram $p --prefix PERL5LIB : $PERL5LIB --set PATH "${lib.makeBinPath [ coreutils minc_tools ]}";
+      wrapProgram $p --prefix PERL5LIB : $PERL5LIB --set PATH "${
+        lib.makeBinPath [
+          coreutils
+          minc_tools
+        ]
+      }";
     done
   '';
 
-  meta = with lib; {
+  meta = {
     homepage = "https://github.com/BIC-MNI/conglomerate";
     description = "More command-line utilities for working with MINC files";
-    maintainers = with maintainers; [ bcdarwin ];
-    platforms = platforms.unix;
-    license   = licenses.hpndUc;
+    maintainers = with lib.maintainers; [ bcdarwin ];
+    platforms = lib.platforms.unix;
+    license = lib.licenses.hpndUc;
   };
 }

pkgs/applications/science/logic/alt-ergo/default.nix

@@ -2,11 +2,11 @@
 
 let
   pname = "alt-ergo";
-  version = "2.5.3";
+  version = "2.5.4";
 
   src = fetchurl {
     url = "https://github.com/OCamlPro/alt-ergo/releases/download/v${version}/alt-ergo-${version}.tbz";
-    hash = "sha256-tmWLZBLfdmfYlCQq+zcUneeueDAE6AJeZMy8kfNCC04=";
+    hash = "sha256-AsHok5i62vqJ5hK8XRiD8hM6JQaFv3dMxZAcVYEim6w=";
   };
 in
 

pkgs/applications/science/math/eigenmath/default.nix

@@ -7,13 +7,13 @@
 
 stdenv.mkDerivation rec {
   pname = "eigenmath";
-  version = "0-unstable-2024-05-03";
+  version = "0-unstable-2024-05-12";
 
   src = fetchFromGitHub {
     owner = "georgeweigt";
     repo = pname;
-    rev = "69ebfbaa7f328ddc9d97b7c404369818a5febe4a";
-    hash = "sha256-lHxVyUXIY9+YIStA6202Bhy/b0xaxJbW/VPI7FbNJk0=";
+    rev = "978b3bd582a90c8e82079f2e4e4a3a5038cbbe08";
+    hash = "sha256-DoGX8nUcWcioTq8ymB+HLsCnt9V6HTKSX4Zs2CQz78Q=";
   };
 
   checkPhase = let emulator = stdenv.hostPlatform.emulator buildPackages; in ''

pkgs/applications/version-management/gh/default.nix

@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "gh";
-  version = "2.49.1";
+  version = "2.49.2";
 
   src = fetchFromGitHub {
     owner = "cli";
     repo = "cli";
     rev = "v${version}";
-    hash = "sha256-9Qr1goFmHV4rNEB849dF9+qEEMOWanCyAcNpXwuQxOo=";
+    hash = "sha256-RevdHBF/7etEstUhsTO9KVK45KTiJnhAhAZAamuEUwk=";
   };
 
-  vendorHash = "sha256-FztCYs6db6f3niAru/vPpcze84nqwzspoJsdqmdkJmk=";
+  vendorHash = "sha256-9Rv1zPrtaxd00lbA3WrPIzIZ9IiKqZa/ppn37jqMP4M=";
 
   nativeBuildInputs = [ installShellFiles ];
 

pkgs/applications/version-management/git-cola/default.nix

@@ -10,14 +10,14 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "git-cola";
-  version = "4.7.0";
+  version = "4.7.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "git-cola";
     repo = "git-cola";
     rev = "v${version}";
-    hash = "sha256-BiSs3vWJacCtGthHi/nFJm4Hqt0uO6XXZi/Zqvjb928=";
+    hash = "sha256-93aayGGMgkSghTpx8M5Cfbxf2szAwrSzuoWK6GCTqZ8=";
   };
 
   buildInputs = lib.optionals stdenv.isLinux [

pkgs/applications/version-management/gitsign/default.nix

@@ -2,15 +2,15 @@
 
 buildGoModule rec {
   pname = "gitsign";
-  version = "0.10.1";
+  version = "0.10.2";
 
   src = fetchFromGitHub {
     owner = "sigstore";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-WaiGkbjqty/MsTWPvx5DmmaNwWTJAEFKwVqArt2oZZc=";
+    hash = "sha256-JNCz5MVqn8PeTfYUVowIVZwtpfD+Gx9yBckter6PfXA=";
   };
-  vendorHash = "sha256-p2E010k7uozpLvl9VpfG5/JyQR4mVUBKv2p78UdFlac=";
+  vendorHash = "sha256-QW+ZWYEXkhSQR4HvmPLENzY/VEfjEX43mBPhmhsEBMI=";
 
   subPackages = [
     "."

pkgs/applications/video/kodi/addons/visualization-projectm/default.nix

@@ -3,13 +3,13 @@
 buildKodiBinaryAddon rec {
   pname = "visualization-projectm";
   namespace = "visualization.projectm";
-  version = "20.2.0";
+  version = "21.0.1";
 
   src = fetchFromGitHub {
     owner = "xbmc";
     repo = namespace;
     rev = "${version}-${rel}";
-    hash = "sha256-Kcl1ep+RJlofFmxkrGT3T+XXdwiCofq1hggwU0PAd0E=";
+    hash = "sha256-wjSQmOtQb4KjY3iH3Xh7AdQwE6ked+cpW6/gdNYS+NA=";
   };
 
   extraBuildInputs = [ pkg-config libGL projectm ];

pkgs/applications/video/lbry/default.nix

@@ -15,9 +15,7 @@ appimageTools.wrapAppImage rec {
   };
 
   # At runtime, Lbry likes to have access to Ffmpeg
-  extraPkgs = pkgs: with pkgs; [
-    ffmpeg
-  ];
+  extraPkgs = pkgs: [ pkgs.ffmpeg ];
 
   # General fixup
   extraInstallCommands = ''

pkgs/applications/video/losslesscut-bin/build-from-appimage.nix

@@ -29,8 +29,6 @@ appimageTools.wrapType2 {
     export LC_ALL=C.UTF-8
   '';
 
-  extraPkgs = ps: appimageTools.defaultFhsEnvArgs.multiPkgs ps;
-
   extraInstallCommands = ''
     (
       mkdir -p $out/share

pkgs/applications/virtualization/podman/default.nix

@@ -19,11 +19,10 @@
 , symlinkJoin
 , substituteAll
 , extraPackages ? [ ]
-, runc
 , crun
-, gvisor
-, youki
+, runc
 , conmon
+, extraRuntimes ? lib.optionals stdenv.isLinux [ runc ]  # e.g.: runc, gvisor, youki
 , slirp4netns
 , fuse-overlayfs
 , util-linux
@@ -59,7 +58,9 @@ let
       netavark
       slirp4netns
       passt
-    ];
+      conmon
+      crun
+    ] ++ extraRuntimes;
   };
 in
 buildGoModule rec {
@@ -74,13 +75,13 @@ buildGoModule rec {
   };
 
   patches = [
-    # we intentionally don't build and install the helper so we shouldn't display messages to users about it
-    ./rm-podman-mac-helper-msg.patch
-  ] ++ lib.optionals stdenv.isLinux [
     (substituteAll {
       src = ./hardcode-paths.patch;
-      inherit crun runc gvisor youki conmon;
+      bin_path = helpersBin;
     })
+
+    # we intentionally don't build and install the helper so we shouldn't display messages to users about it
+    ./rm-podman-mac-helper-msg.patch
   ];
 
   vendorHash = null;

pkgs/applications/virtualization/podman/hardcode-paths.patch

@@ -1,8 +1,8 @@
 diff --git a/vendor/github.com/containers/common/pkg/config/default.go b/vendor/github.com/containers/common/pkg/config/default.go
-index 19c4bb6bf..2743de4b2 100644
+index 3a6d804ad..5628e2bf6 100644
 --- a/vendor/github.com/containers/common/pkg/config/default.go
 +++ b/vendor/github.com/containers/common/pkg/config/default.go
-@@ -364,75 +364,34 @@ func defaultEngineConfig() (*EngineConfig, error) {
+@@ -366,75 +366,34 @@ func defaultEngineConfig() (*EngineConfig, error) {
  	c.Retry = 3
  	c.OCIRuntimes = map[string][]string{
  		"crun": {
@@ -13,7 +13,7 @@ index 19c4bb6bf..2743de4b2 100644
 -			"/sbin/crun",
 -			"/bin/crun",
 -			"/run/current-system/sw/bin/crun",
-+			"@crun@/bin/crun",
++			"@bin_path@/bin/crun",
  		},
  		"crun-vm": {
 -			"/usr/bin/crun-vm",
@@ -22,7 +22,7 @@ index 19c4bb6bf..2743de4b2 100644
 -			"/sbin/crun-vm",
 -			"/bin/crun-vm",
 -			"/run/current-system/sw/bin/crun-vm",
-+			// TODO: "@crun-vm@/bin/crun-vm",
++			"@bin_path@/bin/crun-vm",
  		},
  		"crun-wasm": {
 -			"/usr/bin/crun-wasm",
@@ -32,7 +32,7 @@ index 19c4bb6bf..2743de4b2 100644
 -			"/sbin/crun-wasm",
 -			"/bin/crun-wasm",
 -			"/run/current-system/sw/bin/crun-wasm",
-+			// TODO: "@crun-wasm@/bin/crun-wasm",
++			"@bin_path@/bin/crun-wasm",
  		},
  		"runc": {
 -			"/usr/bin/runc",
@@ -43,11 +43,11 @@ index 19c4bb6bf..2743de4b2 100644
 -			"/bin/runc",
 -			"/usr/lib/cri-o-runc/sbin/runc",
 -			"/run/current-system/sw/bin/runc",
-+			"@runc@/bin/runc",
++			"@bin_path@/bin/runc",
  		},
  		"runj": {
 -			"/usr/local/bin/runj",
-+			// TODO: "@runj@/bin/runj",
++			"@bin_path@/bin/runj",
  		},
  		"kata": {
 -			"/usr/bin/kata-runtime",
@@ -58,7 +58,7 @@ index 19c4bb6bf..2743de4b2 100644
 -			"/bin/kata-runtime",
 -			"/usr/bin/kata-qemu",
 -			"/usr/bin/kata-fc",
-+			// TODO: "@kata@/bin/kata",
++			"@bin_path@/bin/kata-runtime",
  		},
  		"runsc": {
 -			"/usr/bin/runsc",
@@ -68,27 +68,27 @@ index 19c4bb6bf..2743de4b2 100644
 -			"/bin/runsc",
 -			"/sbin/runsc",
 -			"/run/current-system/sw/bin/runsc",
-+			"@gvisor@/bin/runsc",
++			"@bin_path@/bin/runsc",
  		},
  		"youki": {
 -			"/usr/local/bin/youki",
 -			"/usr/bin/youki",
 -			"/bin/youki",
 -			"/run/current-system/sw/bin/youki",
-+			"@youki@/bin/youki",
++			"@bin_path@/bin/youki",
  		},
  		"krun": {
 -			"/usr/bin/krun",
 -			"/usr/local/bin/krun",
-+			// TODO: "@krun@/bin/krun",
++			"@bin_path@/bin/krun",
  		},
  		"ocijail": {
 -			"/usr/local/bin/ocijail",
-+			// TODO: "@ocijail@/bin/ocijail",
++			"@bin_path@/bin/ocijail",
  		},
  	}
  	c.PlatformToOCIRuntime = map[string]string{
-@@ -443,16 +402,9 @@ func defaultEngineConfig() (*EngineConfig, error) {
+@@ -445,26 +404,12 @@ func defaultEngineConfig() (*EngineConfig, error) {
  	// Needs to be called after populating c.OCIRuntimes.
  	c.OCIRuntime = c.findRuntime()
  
@@ -103,7 +103,18 @@ index 19c4bb6bf..2743de4b2 100644
 -		"/usr/local/bin/conmon",
 -		"/usr/local/sbin/conmon",
 -		"/run/current-system/sw/bin/conmon",
-+		"@conmon@/bin/conmon",
++		"@bin_path@/bin/conmon",
  	})
  	c.ConmonRsPath.Set([]string{
- 		"/usr/libexec/podman/conmonrs",
+-		"/usr/libexec/podman/conmonrs",
+-		"/usr/local/libexec/podman/conmonrs",
+-		"/usr/local/lib/podman/conmonrs",
+-		"/usr/bin/conmonrs",
+-		"/usr/sbin/conmonrs",
+-		"/usr/local/bin/conmonrs",
+-		"/usr/local/sbin/conmonrs",
+-		"/run/current-system/sw/bin/conmonrs",
++		"@bin_path@/bin/conmonrs",
+ 	})
+ 	c.PullPolicy = DefaultPullPolicy
+ 	c.RuntimeSupportsJSON.Set([]string{

pkgs/applications/window-managers/hyprwm/hyprland/default.nix

@@ -81,6 +81,7 @@ stdenv.mkDerivation (finalAttrs: {
   ];
 
   nativeBuildInputs = [
+    hwdata
     jq
     makeWrapper
     meson
@@ -114,7 +115,6 @@ stdenv.mkDerivation (finalAttrs: {
     pciutils
     tomlplusplus
     # for subproject wlroots-hyprland
-    hwdata
     seatd
     libliftoff
     libdisplay-info

pkgs/build-support/appimage/default.nix

@@ -40,7 +40,7 @@ rec {
 
   wrapAppImage = args@{
     src,
-    extraPkgs,
+    extraPkgs ? pkgs: [ ],
     meta ? {},
     ...
   }: buildFHSEnv

pkgs/by-name/ad/adafruit-nrfutil/package.nix

@@ -19,11 +19,17 @@ python3Packages.buildPythonApplication rec {
   patches = [
     # Pull a patch which fixes the tests, but is not yet released in a new version:
     # https://github.com/adafruit/Adafruit_nRF52_nrfutil/pull/38
+    # https://github.com/adafruit/Adafruit_nRF52_nrfutil/pull/42
     (fetchpatch {
       name = "fix-tests.patch";
       url = "https://github.com/adafruit/Adafruit_nRF52_nrfutil/commit/e5fbcc8ee5958041db38c04139ba686bf7d1b845.patch";
       sha256 = "sha256-0tbJldGtYcDdUzA3wZRv0lenXVn6dqV016U9nMpQ6/w=";
     })
+    (fetchpatch {
+      name = "fix-test-test_get_vk_pem.patch";
+      url = "https://github.com/adafruit/Adafruit_nRF52_nrfutil/commit/f42cee3c2d7c8d0911f27ba24d6a140083cb85cf.patch";
+      sha256 = "sha256-7WoRqPKc8O5EYK7Fj1WrMJREwhueiVpkEizIfVnEPBU=";
+    })
   ];
 
   nativeBuildInputs = with python3Packages; [

pkgs/by-name/ad/adwsteamgtk/package.nix

@@ -12,7 +12,7 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "adwsteamgtk";
-  version = "0.6.10";
+  version = "0.6.11";
   # built with meson, not a python format
   format = "other";
 
@@ -20,7 +20,7 @@ python3Packages.buildPythonApplication rec {
     owner = "Foldex";
     repo = "AdwSteamGtk";
     rev = "refs/tags/v${version}";
-    hash = "sha256-sh4FLXG78i20Bt8pCCbhO6Sx815stjAZRLCD+X5Zk40=";
+    hash = "sha256-f7+2gTpG5Ntgq+U2AkQihzSTrO+oMsLWxgxe4dVyz8A=";
   };
 
   buildInputs = [

pkgs/by-name/an/ananicy-rules-cachyos/package.nix

@@ -2,6 +2,7 @@
   lib,
   stdenvNoCC,
   fetchFromGitHub,
+  unstableGitUpdater,
 }:
 
 stdenvNoCC.mkDerivation {
@@ -26,6 +27,10 @@ stdenvNoCC.mkDerivation {
     runHook postInstall
   '';
 
+  passthru.updateScript = unstableGitUpdater {
+    hardcodeZeroVersion = true;
+  };
+
   meta = {
     homepage = "https://github.com/CachyOS/ananicy-rules";
     description = "CachyOS' ananicy-rules meant to be used with ananicy-cpp";