Merge master into staging-next

nixos/modules/services/networking/jitsi-videobridge.nix

@@ -156,7 +156,7 @@ in
         default = null;
         example = "192.168.1.42";
         description = ''
-          Local address when running behind NAT.
+          Local address to assume when running behind NAT.
         '';
       };
 
@@ -165,7 +165,25 @@ in
         default = null;
         example = "1.2.3.4";
         description = ''
-          Public address when running behind NAT.
+          Public address to assume when running behind NAT.
+        '';
+      };
+
+      harvesterAddresses = lib.mkOption {
+        type = listOf str;
+        default = [
+          "stunserver.stunprotocol.org:3478"
+          "stun.framasoft.org:3478"
+          "meet-jit-si-turnrelay.jitsi.net:443"
+        ];
+        example = [];
+        description = ''
+          Addresses of public STUN services to use to automatically find
+          the public and local addresses of this Jitsi-Videobridge instance
+          without the need for manual configuration.
+
+          This option is ignored if {option}`services.jitsi-videobridge.nat.localAddress`
+          and {option}`services.jitsi-videobridge.nat.publicAddress` are set.
         '';
       };
     };
@@ -199,10 +217,13 @@ in
   config = lib.mkIf cfg.enable {
     users.groups.jitsi-meet = {};
 
-    services.jitsi-videobridge.extraProperties = lib.optionalAttrs (cfg.nat.localAddress != null) {
-      "org.ice4j.ice.harvest.NAT_HARVESTER_LOCAL_ADDRESS" = cfg.nat.localAddress;
-      "org.ice4j.ice.harvest.NAT_HARVESTER_PUBLIC_ADDRESS" = cfg.nat.publicAddress;
-    };
+    services.jitsi-videobridge.extraProperties =
+      if (cfg.nat.localAddress != null) then {
+        "org.ice4j.ice.harvest.NAT_HARVESTER_LOCAL_ADDRESS" = cfg.nat.localAddress;
+        "org.ice4j.ice.harvest.NAT_HARVESTER_PUBLIC_ADDRESS" = cfg.nat.publicAddress;
+      } else {
+        "org.ice4j.ice.harvest.STUN_MAPPING_HARVESTER_ADDRESSES" = lib.concatStringsSep "," cfg.nat.harvesterAddresses;
+      };
 
     systemd.services.jitsi-videobridge2 = let
       jvbProps = {

nixos/modules/services/web-apps/jitsi-meet.md

@@ -19,6 +19,13 @@ A minimal configuration using Let's Encrypt for TLS certificates looks like this
 }
 ```
 
+Jitsi Meet depends on the Prosody XMPP server only for message passing from
+the web browser while the default Prosody configuration is intended for use
+with standalone XMPP clients and XMPP federation. If you only use Prosody as
+a backend for Jitsi Meet it is therefore recommended to also enable
+{option}`services.jitsi-meet.prosody.lockdown` option to disable unnecessary
+Prosody features such as federation or the file proxy.
+
 ## Configuration {#module-services-jitsi-configuration}
 
 Here is the minimal configuration with additional configurations:
@@ -27,6 +34,7 @@ Here is the minimal configuration with additional configurations:
   services.jitsi-meet = {
     enable = true;
     hostName = "jitsi.example.com";
+    prosody.lockdown = true;
     config = {
       enableWelcomePage = false;
       prejoinPageEnabled = true;

nixos/modules/services/web-apps/jitsi-meet.nix

@@ -175,11 +175,26 @@ in
     prosody.enable = mkOption {
       type = bool;
       default = true;
+      example = false;
       description = ''
         Whether to configure Prosody to relay XMPP messages between Jitsi Meet components. Turn this
         off if you want to configure it manually.
       '';
     };
+    prosody.lockdown = mkOption {
+      type = bool;
+      default = false;
+      example = true;
+      description = ''
+        Whether to disable Prosody features not needed by Jitsi Meet.
+
+        The default Prosody configuration assumes that it will be used as a
+        general-purpose XMPP server rather than as a companion service for
+        Jitsi Meet. This option reconfigures Prosody to only listen on
+        localhost without support for TLS termination, XMPP federation or
+        the file transfer proxy.
+      '';
+    };
 
     excalidraw.enable = mkEnableOption "Excalidraw collaboration backend for Jitsi";
     excalidraw.port = mkOption {
@@ -211,7 +226,10 @@ in
         smacks = mkDefault true;
         tls = mkDefault true;
         websocket = mkDefault true;
+        proxy65 = mkIf cfg.prosody.lockdown (mkDefault false);
       };
+      httpInterfaces = mkIf cfg.prosody.lockdown (mkDefault [ "127.0.0.1" ]);
+      httpsPorts = mkIf cfg.prosody.lockdown (mkDefault []);
       muc = [
         {
           domain = "conference.${cfg.hostName}";
@@ -232,7 +250,7 @@ in
           extraConfig = ''
             restrict_room_creation = true
             storage = "memory"
-            admins = { "focus@auth.${cfg.hostName}" }
+            admins = { "focus@auth.${cfg.hostName}", "jvb@auth.${cfg.hostName}" }
           '';
         }
         {
@@ -300,7 +318,7 @@ in
             muc_component = "conference.${cfg.hostName}"
             breakout_rooms_component = "breakout.${cfg.hostName}"
         '')
-        (mkBefore ''
+        (mkBefore (''
           muc_mapper_domain_base = "${cfg.hostName}"
 
           cross_domain_websocket = true;
@@ -310,7 +328,10 @@ in
             "focus@auth.${cfg.hostName}",
             "jvb@auth.${cfg.hostName}"
           }
-        '')
+        '' + optionalString cfg.prosody.lockdown ''
+          c2s_interfaces = { "127.0.0.1" };
+          modules_disabled = { "s2s" };
+        ''))
       ];
       virtualHosts.${cfg.hostName} = {
         enabled = true;
@@ -444,7 +465,29 @@ in
         Type = "simple";
         ExecStart = "${pkgs.jitsi-excalidraw}/bin/jitsi-excalidraw-backend";
         Restart = "on-failure";
+
+        DynamicUser = true;
         Group = "jitsi-meet";
+        CapabilityBoundingSet = "";
+        NoNewPrivileges = true;
+        ProtectSystem = "strict";
+        ProtectClock = true;
+        ProtectHome = true;
+        ProtectProc = true;
+        ProtectKernelLogs = true;
+        PrivateTmp = true;
+        PrivateDevices = true;
+        PrivateUsers = true;
+        ProtectHostname = true;
+        ProtectKernelTunables = true;
+        ProtectKernelModules = true;
+        ProtectControlGroups = true;
+        RestrictAddressFamilies = [ "AF_INET" "AF_INET6" ];
+        RestrictNamespaces = true;
+        LockPersonality = true;
+        RestrictRealtime = true;
+        RestrictSUIDSGID = true;
+        SystemCallFilter = [ "@system-service @pkey" "~@privileged" ];
       };
     };
 
@@ -513,7 +556,11 @@ in
             cp ${overrideJs "${pkgs.jitsi-meet}/interface_config.js" "interfaceConfig" cfg.interfaceConfig ""} $out/interface_config.js
             cp ./libs/external_api.min.js $out/external_api.js
           '';
-        in ''
+        in (optionalString cfg.excalidraw.enable ''
+          handle /socket.io/ {
+            reverse_proxy 127.0.0.1:${toString cfg.excalidraw.port}
+          }
+        '') + ''
           handle /http-bind {
             header Host ${cfg.hostName}
             reverse_proxy 127.0.0.1:5280

pkgs/applications/networking/browsers/firefox/packages.nix

@@ -5,10 +5,10 @@
 {
   firefox = buildMozillaMach rec {
     pname = "firefox";
-    version = "130.0.1";
+    version = "131.0";
     src = fetchurl {
       url = "mirror://mozilla/firefox/releases/${version}/source/firefox-${version}.source.tar.xz";
-      sha512 = "163d1ce9f671a4716686955c43ff23d9f200f6c52dfdabcbb93af6a326c24aa5096404f42447b02b5a3ad02e2f60d17271783638fe027d24865aebb3e70e97fe";
+      sha512 = "324cbaadff4d19a18d56ca01ae7212ac8362e3f5933f3017a19b64c35d58606ace8bba3672790ecb48d4a849619cdc95701440701725e8eb2859d55f1e8d8e3c";
     };
 
     extraPatches = [
@@ -96,10 +96,10 @@
 
   firefox-esr-128 = buildMozillaMach rec {
     pname = "firefox";
-    version = "128.2.0esr";
+    version = "128.3.0esr";
     src = fetchurl {
       url = "mirror://mozilla/firefox/releases/${version}/source/firefox-${version}.source.tar.xz";
-      sha512 = "9a689929f6f86d795ea2c0318bb78f77f72a552f40715a1108dbd6361b0dedc3aaf049f1883424012459899607067d5a8374d895564591ec6679a1ce80708d7d";
+      sha512 = "3c6ef272c0fb653d030fe3f7f72aa0e1097b1c6759556166815cde15465330f988b3bc23df4b4eb753daee930edbb1ef72145273cb29d0952bd9d7c547050f9b";
     };
 
     meta = {
@@ -125,11 +125,11 @@
 
   firefox-esr-115 = (buildMozillaMach rec {
     pname = "firefox-esr-115";
-    version = "115.15.0esr";
+    version = "115.16.0esr";
     applicationName = "Mozilla Firefox ESR";
     src = fetchurl {
       url = "mirror://mozilla/firefox/releases/${version}/source/firefox-${version}.source.tar.xz";
-      sha512 = "0df4c498c99cce08903004d2e0f9e977a19f7de86240aa82dba179b60f1d67ca3021eb474f56bddc38035e773eeb5d99bb3e1b0756d9f7583dc8e1f747f477ba";
+      sha512 = "b6f93ec3d6acac5df177253c65b833c017e65ed6e78e96ff029098443928d291f6f67164aedb83d80aa28ee9dee305086597798238d3330e35183030e53e3550";
     };
 
     meta = {

pkgs/applications/networking/cluster/terraform/default.nix

@@ -165,8 +165,8 @@ rec {
   mkTerraform = attrs: pluggable (generic attrs);
 
   terraform_1 = mkTerraform {
-    version = "1.9.6";
-    hash = "sha256-rlqpqiMlLcn2LqqKRU9iFaVqUz/QQtpiiZ39h5ZvpbI=";
+    version = "1.9.7";
+    hash = "sha256-L0F0u96et18IlqAUsc0HK+cLeav2OqN4kxs58hPNMIM=";
     vendorHash = "sha256-tH9KQF4oHcQh34ikB9Bx6fij/iLZN+waxv5ZilqGGlU=";
     patches = [ ./provider-path-0_15.patch ];
     passthru = {

pkgs/applications/science/logic/lean4/default.nix

@@ -10,13 +10,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "lean4";
-  version = "4.9.1";
+  version = "4.10.0";
 
   src = fetchFromGitHub {
     owner = "leanprover";
     repo = "lean4";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-C3N56f3mT+5f149T1BIYQil2UleAWmnRYLqUq4zcLgs=";
+    hash = "sha256-lNWr84aeVpI/p/oxkNAUlUMUROGGzHAkb2D9q8BzHeA=";
   };
 
   postPatch = ''

pkgs/applications/virtualization/docker/default.nix

@@ -14,7 +14,7 @@ rec {
       , makeWrapper, installShellFiles, pkg-config, glibc
       , go-md2man, go, containerd, runc, tini, libtool
       , sqlite, iproute2, docker-buildx, docker-compose, docker-sbom
-      , iptables, e2fsprogs, xz, util-linux, xfsprogs, git
+      , iptables, e2fsprogs, xz, util-linux, xfsprogs, gitMinimal
       , procps, rootlesskit, slirp4netns, fuse-overlayfs, nixosTests
       , clientOnly ? !stdenv.hostPlatform.isLinux, symlinkJoin
       , withSystemd ? lib.meta.availableOn stdenv.hostPlatform systemd, systemd
@@ -95,7 +95,7 @@ rec {
         ++ lib.optional withSystemd systemd
         ++ lib.optional withSeccomp libseccomp;
 
-      extraPath = lib.optionals stdenv.hostPlatform.isLinux (lib.makeBinPath [ iproute2 iptables e2fsprogs xz xfsprogs procps util-linux git ]);
+      extraPath = lib.optionals stdenv.hostPlatform.isLinux (lib.makeBinPath [ iproute2 iptables e2fsprogs xz xfsprogs procps util-linux gitMinimal ]);
 
       extraUserPath = lib.optionals (stdenv.hostPlatform.isLinux && !clientOnly) (lib.makeBinPath [ rootlesskit slirp4netns fuse-overlayfs ]);
 

pkgs/by-name/gg/gg-jj/package.nix

@@ -0,0 +1,80 @@
+{
+  rustPlatform,
+  callPackage,
+  pkg-config,
+  lib,
+  fetchFromGitHub,
+  libayatana-appindicator,
+  openssl,
+  webkitgtk_4_1,
+}:
+
+rustPlatform.buildRustPackage rec {
+  pname = "gg-jj";
+  version = "0.20.0";
+
+  src = fetchFromGitHub {
+    owner = "gulbanana";
+    repo = "gg";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-xOi/AUlH0FeenTXz3hsDYixCEl+yr22PGy6Ow4TKxY0=";
+  };
+
+  sourceRoot = "${src.name}/src-tauri";
+
+  webui = callPackage ./webui.nix {
+    inherit
+      src
+      pname
+      version
+      meta
+      ;
+  };
+
+  env = {
+    OPENSSL_NO_VENDOR = 1;
+  };
+
+  buildInputs = [
+    webkitgtk_4_1
+    openssl
+  ];
+
+  nativeBuildInputs = [
+    pkg-config
+  ];
+
+  cargoHash = "sha256-u3SkRA7327ZwqEnB+Xq2JDbI0k5HfeKzV17dvQ8B6xk=";
+
+  postPatch = ''
+    buildRoot=$(pwd)
+    pushd $cargoDepsCopy/libappindicator-sys
+    oldHash=$(sha256sum src/lib.rs | cut -d " " -f 1)
+    substituteInPlace src/lib.rs \
+      --replace-fail "libayatana-appindicator3.so.1" "${libayatana-appindicator}/lib/libayatana-appindicator3.so.1"
+    substituteInPlace .cargo-checksum.json \
+      --replace-fail $oldHash $(sha256sum src/lib.rs | cut -d " " -f 1)
+    popd
+
+    pushd $cargoDepsCopy/jj-cli
+    oldHash=$(sha256sum build.rs | cut -d " " -f 1)
+    substituteInPlace build.rs \
+      --replace-fail 'let path = std::env::var("CARGO_MANIFEST_DIR").unwrap();' "let path = \"$buildRoot\";"
+    substituteInPlace .cargo-checksum.json \
+      --replace-fail $oldHash $(sha256sum build.rs | cut -d " " -f 1)
+    popd
+
+    substituteInPlace ./tauri.conf.json \
+      --replace-fail '"frontendDist": "../dist"' '"frontendDist": "${webui}"' \
+      --replace-fail '"beforeBuildCommand": "npm run build"' '"beforeBuildCommand": ""'
+  '';
+
+  meta = {
+    homepage = "https://github.com/gulbanana/gg";
+    changelog = "https://github.com/gulbanana/gg/releases/tag/v${version}";
+    description = "GUI for jj users";
+    maintainers = with lib.maintainers; [ bot-wxt1221 ];
+    mainProgram = "gg";
+    license = lib.licenses.apsl20;
+  };
+}

pkgs/by-name/gg/gg-jj/webui.nix

@@ -0,0 +1,31 @@
+{
+  version,
+  src,
+  pname,
+  pnpm,
+  meta,
+  buildNpmPackage,
+}:
+
+buildNpmPackage {
+  inherit version src meta;
+  pname = "${pname}-webui";
+
+  npmDepsHash = "sha256-oHBFuX65D/FgnGa03jjpIKAdH8Q4c2NrpD64bhfe720=";
+
+  buildPhase = ''
+    runHook preBuild
+
+    node --max_old_space_size=1024000 ./node_modules/vite/bin/vite.js build
+
+    runHook postBuild
+  '';
+
+  installPhase = ''
+    runHook preInstall
+
+    cp -r dist $out
+
+    runHook postInstall
+  '';
+}

pkgs/by-name/ju/jujutsu/package.nix

@@ -21,7 +21,7 @@
 }:
 
 let
-  version = "0.21.0";
+  version = "0.22.0";
 in
 
 rustPlatform.buildRustPackage {
@@ -32,10 +32,10 @@ rustPlatform.buildRustPackage {
     owner = "martinvonz";
     repo = "jj";
     rev = "v${version}";
-    hash = "sha256-uZsfHhcYpobatWaDQczuc9Z3BWHN5VO0qr/8mu5kEio=";
+    hash = "sha256-GbKmX1Ev/8di3A1XT5ZIRjzn2zP6DMye2NpA26PGVIs=";
   };
 
-  cargoHash = "sha256-BOO1jP1Y5CNbE97zj+tpariiBdcuxKb1wyvI7i/VpYI=";
+  cargoHash = "sha256-+3oO2M2293Nba6P8bejgZD5OxgCpkIRdcPICDswJyEU=";
 
   nativeBuildInputs = [
     installShellFiles

pkgs/by-name/la/lammps/package.nix

@@ -49,14 +49,14 @@
 stdenv.mkDerivation (finalAttrs: {
   # LAMMPS has weird versioning convention. Updates should go smoothly with:
   # nix-update --commit lammps --version-regex 'stable_(.*)'
-  version = "29Aug2024";
+  version = "29Aug2024_update1";
   pname = "lammps";
 
   src = fetchFromGitHub {
     owner = "lammps";
     repo = "lammps";
     rev = "stable_${finalAttrs.version}";
-    hash = "sha256-UySWbJPubl318IA2MeTrz3Ya+9YyVOeR/Fs4aYI1R2o=";
+    hash = "sha256-B2oMs9bVYO+G3yL1DGJVK/INIfANMDREV7AtC4kH3H8=";
   };
   preConfigure = ''
     cd cmake

pkgs/by-name/lu/luaformatter/package.nix

@@ -1,9 +1,17 @@
-{ lib, stdenv, fetchFromGitHub, substituteAll, antlr4_9, libargs, catch2, cmake, yaml-cpp }:
-
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  substituteAll,
+  antlr4_9,
+  libargs,
+  catch2,
+  cmake,
+  yaml-cpp,
+}:
 let
   antlr4 = antlr4_9;
 in
-
 stdenv.mkDerivation rec {
   pname = "luaformatter";
   version = "1.3.6";
@@ -25,7 +33,14 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ cmake ];
 
-  buildInputs = [ antlr4.runtime.cpp yaml-cpp ];
+  buildInputs = [
+    antlr4.runtime.cpp
+    yaml-cpp
+  ];
+
+  env.NIX_CFLAGS_COMPILE = lib.optionalString (
+    stdenv.isDarwin && stdenv.isx86_64
+  ) "-D_LIBCPP_HAS_NO_LIBRARY_ALIGNED_ALLOCATION=1";
 
   meta = with lib; {
     description = "Code formatter for Lua";

pkgs/by-name/mo/mongodb-compass/package.nix

@@ -34,7 +34,7 @@
 }:
 
 let
-  version = "1.44.3";
+  version = "1.44.4";
 
   rpath = lib.makeLibraryPath [
     alsa-lib
@@ -84,7 +84,7 @@ let
     if stdenv.hostPlatform.system == "x86_64-linux" then
       fetchurl {
         url = "https://downloads.mongodb.com/compass/mongodb-compass_${version}_amd64.deb";
-        hash = "sha256-3w9alnv51KNyc1pCqCtG022YI7LNrkTihn4Ldacc01M=";
+        hash = "sha256-0b0bdKRw+l4m144OVaH/KHB+UtAZ0zIA7KlP9zOE7A8=";
       }
     else
       throw "MongoDB compass is not supported on ${stdenv.hostPlatform.system}";

pkgs/by-name/ol/ollama/package.nix

@@ -218,9 +218,7 @@ goBuild {
         service-cuda = nixosTests.ollama-cuda;
         service-rocm = nixosTests.ollama-rocm;
       };
-
-    updateScript = nix-update-script { };
-  };
+  } // lib.optionalAttrs (!enableRocm && !enableCuda) { updateScript = nix-update-script { }; };
 
   meta = {
     description =

pkgs/by-name/qu/quarkus/package.nix

@@ -7,11 +7,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "quarkus-cli";
-  version = "3.14.4";
+  version = "3.15.1";
 
   src = fetchurl {
     url = "https://github.com/quarkusio/quarkus/releases/download/${finalAttrs.version}/quarkus-cli-${finalAttrs.version}.tar.gz";
-    hash = "sha256-N0NLP8VvUvr/oi3U1McD+jyV8UXGXCwuITRbwudw1Q0=";
+    hash = "sha256-cvZ1jEIeEQOgmAiQba6AYob+84ozM0AQcnVpgRLSIIc=";
   };
 
   nativeBuildInputs = [ makeWrapper ];

pkgs/by-name/re/realvnc-vnc-viewer/darwin.nix

@@ -11,7 +11,7 @@ stdenvNoCC.mkDerivation (finalAttrs: {
   src = fetchurl rec {
       name = "VNC-Viewer-${finalAttrs.version}-MacOSX-universal.dmg";
       url = "https://downloads.realvnc.com/download/file/viewer.files/${name}";
-      hash = "sha256-haD2QsBF9Dps1V/2tkkALAc7+kUY3PSNj7BjTIqnNcU=";
+      hash = "sha256-SiBlw9ihKDLDWBPUxn3cfM0jbUaWDxQ9JDaeDNczQ7c=";
   };
   sourceRoot = ".";
 

pkgs/by-name/re/realvnc-vnc-viewer/linux.nix

@@ -16,7 +16,7 @@ stdenv.mkDerivation (finalAttrs: {
     "x86_64-linux" = fetchurl rec {
       name = "VNC-Viewer-${finalAttrs.version}-Linux-x64.rpm";
       url = "https://downloads.realvnc.com/download/file/viewer.files/${name}";
-      hash = "sha256-KJZbH3mfxuyUslkYvB/RKquEsB7ayJSv6yNqfLmAsGI=";
+      hash = "sha256-fwMfQdOyLnYVfdBj80JHWT+CnKpq/9oM5oNF3aP+jgo=";
     };
   }.${stdenv.system} or (throw "Unsupported system: ${stdenv.hostPlatform.system}");
 

pkgs/by-name/re/realvnc-vnc-viewer/package.nix

@@ -4,7 +4,7 @@
 }:
 let
   pname = "realvnc-vnc-viewer";
-  version = "7.12.0";
+  version = "7.12.1";
 
   meta = {
     description = "VNC remote desktop client software by RealVNC";

pkgs/by-name/st/stevenblack-blocklist/package.nix

@@ -6,13 +6,13 @@
 }:
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "stevenblack-blocklist";
-  version = "3.14.112";
+  version = "3.14.115";
 
   src = fetchFromGitHub {
     owner = "StevenBlack";
     repo = "hosts";
     rev = "refs/tags/${finalAttrs.version}";
-    hash = "sha256-ESgu1n7Fa9UrR/OJkMsldcyqV7R3Bdq3GRouTn3GIrw=";
+    hash = "sha256-Iw3NUY0rWF+/lbGcO6zn96oNnRWRH33+8gs4e5yA1vM=";
   };
 
   outputs = [

pkgs/desktops/xfce/applications/xfce4-dict/default.nix

@@ -10,9 +10,9 @@
 mkXfceDerivation {
   category = "apps";
   pname = "xfce4-dict";
-  version = "0.8.7";
+  version = "0.8.8";
 
-  sha256 = "sha256-1xjprnQG2P+LYAhEGxdu1wpoP/+C+udmNqb/3zEojr0=";
+  sha256 = "sha256-nVpEeOSSfXCIxuIj0qie+oi8FVRiVUmDMPZZwIZ9L/k=";
 
   buildInputs = [
     glib

pkgs/development/compilers/chicken/5/overrides.nix

@@ -132,6 +132,7 @@ in
       addToNativeBuildInputs pkgs.taglib old
     );
   uuid-lib = addToBuildInputs pkgs.libuuid;
+  webview = addToBuildInputsWithPkgConfig pkgs.webkitgtk;
   ws-client = addToBuildInputs pkgs.zlib;
   xlib = addToPropagatedBuildInputs pkgs.xorg.libX11;
   yaml = addToBuildInputs pkgs.libyaml;
@@ -224,7 +225,6 @@ in
   svn-client = broken;
   system = broken;
   tokyocabinet = broken;
-  webview = broken;
 
   # mark broken darwin
 

pkgs/development/compilers/sbcl/default.nix

@@ -10,15 +10,18 @@
 
 let
   versionMap = {
+    # Necessary for Nyxt
     "2.4.6" = {
       sha256 = "sha256-pImQeELa4JoXJtYphb96VmcKrqLz7KH7cCO8pnw/MJE=";
     };
-    "2.4.7" = {
-      sha256 = "sha256-aFRNJQNjWs0BXVNMzJsq6faJltQptakGP9Iv8JJQEdI=";
-    };
+    # By unofficial and very loose convention we keep the latest version of
+    # SBCL, and the previous one in case someone quickly needs to roll back.
     "2.4.8" = {
       sha256 = "sha256-/G7NzFOOgKFKmY1TDMw4SkF5D09Pxs1//oyxJqZ3aUw=";
     };
+    "2.4.9" = {
+      sha256 = "sha256-mXDk68XWlD3GTXyh9S2bXNn8lM75TSMyE9eOx182BeI=";
+    };
   };
   # Collection of pre-built SBCL binaries for platforms that need them for
   # bootstrapping. Ideally these are to be avoided.  If ECL (or any other

pkgs/development/ocaml-modules/uuseg/default.nix

@@ -1,5 +1,5 @@
 { lib, stdenv, fetchurl, ocaml, findlib, ocamlbuild, topkg, uucp, uutf, cmdliner
-, version ? if lib.versionAtLeast ocaml.version "4.14" then "15.1.0" else "15.0.0"
+, version ? if lib.versionAtLeast ocaml.version "4.14" then "16.0.0" else "15.0.0"
 , cmdlinerSupport ? lib.versionAtLeast cmdliner.version "1.1"
 }:
 
@@ -16,7 +16,7 @@ stdenv.mkDerivation rec {
   src = fetchurl {
     url = "${webpage}/releases/${pname}-${version}.tbz";
     hash = {
-      "15.1.0" = "sha256-IPI3Wd51HzX4n+uGcgc04us29jMjnKbGgVEAdp0CVMU=";
+      "16.0.0" = "sha256-WAP9uyofhtw6ag6/U4GQAanIFoKWvyA4NgeVweTs/iQ=";
       "15.0.0" = "sha256-q8x3bia1QaKpzrWFxUmLWIraKqby7TuPNGvbSjkY4eM=";
     }."${version}";
   };

pkgs/development/python-modules/mhcflurry/default.nix

@@ -21,14 +21,14 @@
 
 buildPythonPackage rec {
   pname = "mhcflurry";
-  version = "2.1.3";
+  version = "2.1.4";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "openvax";
     repo = "mhcflurry";
     rev = "refs/tags/v${version}";
-    hash = "sha256-Xz3Myd+pifNQMTH1BC2qsQEy7UorYNQNj+7ysMVmCOs=";
+    hash = "sha256-dxCGCPnk1IFKg8ZVqMJsojQL0KlNirKlHJoaaOYIzMU=";
   };
 
   # keras and tensorflow are not in the official setup.py requirements but are required for the CLI utilities to run.

pkgs/development/tools/profiling/pprof/default.nix

@@ -5,13 +5,13 @@
 
 buildGoModule rec {
   pname = "pprof";
-  version = "0-unstable-2024-07-10";
+  version = "0-unstable-2024-09-25";
 
   src = fetchFromGitHub {
     owner = "google";
     repo = "pprof";
-    rev = "f6c9dda6c6da638264f96f1097bce50fd82b4927";
-    hash = "sha256-jxPl3e9aYRWyR7vkz+15aZiG331WnrNkMW8vwbcldfY=";
+    rev = "fa3061bff0bcf0d611f07dbdba73665bd2bbac97";
+    hash = "sha256-wUHCbgmJI3YTettVVrLnRPIexaHuAQDmbnHXPTLBBYM=";
   };
 
   postPatch = ''

pkgs/servers/web-apps/jitsi-meet/default.nix

@@ -18,7 +18,8 @@ stdenv.mkDerivation rec {
     runHook postInstall
   '';
 
-  passthru.tests = {
+  # Test requires running Jitsi Videobridge and Jicofo which are Linux-only
+  passthru.tests = lib.optionalAttrs stdenv.isLinux {
     single-host-smoke-test = nixosTests.jitsi-meet;
   };
 

pkgs/tools/filesystems/moosefs/default.nix

@@ -10,13 +10,13 @@
 
 stdenv.mkDerivation rec {
   pname = "moosefs";
-  version = "3.0.118";
+  version = "4.56.6";
 
   src = fetchFromGitHub {
     owner = pname;
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-Sm32VwKlE0V5HZj+VXr66gYKS+fcU1+UVQELiZ64DpU=";
+    sha256 = "sha256-/ZvOwPE8SIwAbGITggzYwGuU1nAFIv0zF1IYu6FHGN8=";
   };
 
   nativeBuildInputs = [

pkgs/top-level/all-packages.nix

@@ -18061,8 +18061,6 @@ with pkgs;
 
   lttv = callPackage ../development/tools/misc/lttv { };
 
-  luaformatter = callPackage ../development/tools/luaformatter { };
-
   lurk = callPackage ../development/tools/lurk { };
 
   maizzle = callPackage ../development/tools/maizzle { };
@@ -19160,7 +19158,7 @@ with pkgs;
 
   niv = lib.getBin (haskell.lib.compose.justStaticExecutables haskellPackages.niv);
 
-  ormolu = haskellPackages.ormolu.bin;
+  ormolu = lib.getBin (haskell.lib.compose.justStaticExecutables haskellPackages.ormolu);
 
   capnproto = callPackage ../development/libraries/capnproto { };
 
@@ -24089,17 +24087,17 @@ with pkgs;
     faslExt = "fasl";
     flags = [ "--dynamic-space-size" "3000" ];
   };
-  sbcl_2_4_7 = wrapLisp {
-    pkg = callPackage ../development/compilers/sbcl { version = "2.4.7"; };
-    faslExt = "fasl";
-    flags = [ "--dynamic-space-size" "3000" ];
-  };
   sbcl_2_4_8 = wrapLisp {
     pkg = callPackage ../development/compilers/sbcl { version = "2.4.8"; };
     faslExt = "fasl";
     flags = [ "--dynamic-space-size" "3000" ];
   };
-  sbcl = sbcl_2_4_8;
+  sbcl_2_4_9 = wrapLisp {
+    pkg = callPackage ../development/compilers/sbcl { version = "2.4.9"; };
+    faslExt = "fasl";
+    flags = [ "--dynamic-space-size" "3000" ];
+  };
+  sbcl = sbcl_2_4_9;
 
   sbclPackages = recurseIntoAttrs sbcl.pkgs;