Merge master into haskell-updates

.github/PULL_REQUEST_TEMPLATE.md

@@ -1,6 +1,7 @@
-## Description of changes
 
 <!--
+^ Please summarise the changes you have done and explain why they are necessary here ^
+
 For package updates please link to a changelog or describe changes, this helps your fellow maintainers discover breaking updates.
 For new packages please briefly describe the package or provide a link to its homepage.
 -->

.github/workflows/backport.yml

@@ -20,7 +20,7 @@ jobs:
     if: github.repository_owner == 'NixOS' && github.event.pull_request.merged == true && (github.event_name != 'labeled' || startsWith('backport', github.event.label.name))
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
+      - uses: actions/checkout@d632683dd7b4114ad314bca15554477dd762a938 # v4.2.0
         with:
           ref: ${{ github.event.pull_request.head.sha }}
       - name: Create backport PRs

.github/workflows/basic-eval.yml

@@ -19,8 +19,8 @@ jobs:
     runs-on: ubuntu-latest
     # we don't limit this action to only NixOS repo since the checks are cheap and useful developer feedback
     steps:
-    - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
-    - uses: cachix/install-nix-action@ba0dd844c9180cbf77aa72a116d6fbc515d0e87b # v27
+    - uses: actions/checkout@d632683dd7b4114ad314bca15554477dd762a938 # v4.2.0
+    - uses: cachix/install-nix-action@9f70348d77d0422624097c4b7a75563948901306 # v29
     - uses: cachix/cachix-action@ad2ddac53f961de1989924296a1f236fcfbaa4fc # v15
       with:
         # This cache is for the nixpkgs repo checks and should not be trusted or used elsewhere.

.github/workflows/check-cherry-picks.yml

@@ -14,7 +14,7 @@ jobs:
     runs-on: ubuntu-latest
     if: github.repository_owner == 'NixOS'
     steps:
-    - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
+    - uses: actions/checkout@d632683dd7b4114ad314bca15554477dd762a938 # v4.2.0
       with:
         fetch-depth: 0
         filter: blob:none

.github/workflows/check-maintainers-sorted.yaml

@@ -13,7 +13,7 @@ jobs:
     runs-on: ubuntu-latest
     if: github.repository_owner == 'NixOS'
     steps:
-      - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
+      - uses: actions/checkout@d632683dd7b4114ad314bca15554477dd762a938 # v4.2.0
         with:
           # pull_request_target checks out the base branch by default
           ref: refs/pull/${{ github.event.pull_request.number }}/merge
@@ -21,7 +21,7 @@ jobs:
           sparse-checkout: |
             lib
             maintainers
-      - uses: cachix/install-nix-action@ba0dd844c9180cbf77aa72a116d6fbc515d0e87b # v27
+      - uses: cachix/install-nix-action@9f70348d77d0422624097c4b7a75563948901306 # v29
         with:
           # explicitly enable sandbox
           extra_nix_config: sandbox = true

.github/workflows/check-nix-format.yml

@@ -18,7 +18,7 @@ jobs:
     runs-on: ubuntu-latest
     if: "!contains(github.event.pull_request.title, '[skip treewide]')"
     steps:
-      - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
+      - uses: actions/checkout@d632683dd7b4114ad314bca15554477dd762a938 # v4.2.0
         with:
           # pull_request_target checks out the base branch by default
           ref: refs/pull/${{ github.event.pull_request.number }}/merge
@@ -38,7 +38,7 @@ jobs:
           # This should not be a URL, because it would allow PRs to run arbitrary code in CI!
           rev=$(jq -r .rev ci/pinned-nixpkgs.json)
           echo "url=https://github.com/NixOS/nixpkgs/archive/$rev.tar.gz" >> "$GITHUB_ENV"
-      - uses: cachix/install-nix-action@ba0dd844c9180cbf77aa72a116d6fbc515d0e87b # v27
+      - uses: cachix/install-nix-action@9f70348d77d0422624097c4b7a75563948901306 # v29
         with:
           # explicitly enable sandbox
           extra_nix_config: sandbox = true

.github/workflows/check-nixf-tidy.yml

@@ -12,7 +12,7 @@ jobs:
     runs-on: ubuntu-latest
     if: "!contains(github.event.pull_request.title, '[skip treewide]')"
     steps:
-      - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
+      - uses: actions/checkout@d632683dd7b4114ad314bca15554477dd762a938 # v4.2.0
         with:
           # pull_request_target checks out the base branch by default
           ref: refs/pull/${{ github.event.pull_request.number }}/merge
@@ -32,7 +32,7 @@ jobs:
           # This should not be a URL, because it would allow PRs to run arbitrary code in CI!
           rev=$(jq -r .rev ci/pinned-nixpkgs.json)
           echo "url=https://github.com/NixOS/nixpkgs/archive/$rev.tar.gz" >> "$GITHUB_ENV"
-      - uses: cachix/install-nix-action@ba0dd844c9180cbf77aa72a116d6fbc515d0e87b # v27
+      - uses: cachix/install-nix-action@9f70348d77d0422624097c4b7a75563948901306 # v29
         with:
           # explicitly enable sandbox
           extra_nix_config: sandbox = true

.github/workflows/check-shell.yml

@@ -10,11 +10,11 @@ jobs:
     name: shell-check-x86_64-linux
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
+      - uses: actions/checkout@d632683dd7b4114ad314bca15554477dd762a938 # v4.2.0
         with:
           # pull_request_target checks out the base branch by default
           ref: refs/pull/${{ github.event.pull_request.number }}/merge
-      - uses: cachix/install-nix-action@ba0dd844c9180cbf77aa72a116d6fbc515d0e87b # v27
+      - uses: cachix/install-nix-action@9f70348d77d0422624097c4b7a75563948901306 # v29
       - name: Build shell
         run: nix-build shell.nix
 
@@ -22,10 +22,10 @@ jobs:
     name: shell-check-aarch64-darwin
     runs-on: macos-latest
     steps:
-      - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
+      - uses: actions/checkout@d632683dd7b4114ad314bca15554477dd762a938 # v4.2.0
         with:
           # pull_request_target checks out the base branch by default
           ref: refs/pull/${{ github.event.pull_request.number }}/merge
-      - uses: cachix/install-nix-action@ba0dd844c9180cbf77aa72a116d6fbc515d0e87b # v27
+      - uses: cachix/install-nix-action@9f70348d77d0422624097c4b7a75563948901306 # v29
       - name: Build shell
         run: nix-build shell.nix

.github/workflows/editorconfig.yml

@@ -25,11 +25,11 @@ jobs:
     - name: print list of changed files
       run: |
         cat "$HOME/changed_files"
-    - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
+    - uses: actions/checkout@d632683dd7b4114ad314bca15554477dd762a938 # v4.2.0
       with:
         # pull_request_target checks out the base branch by default
         ref: refs/pull/${{ github.event.pull_request.number }}/merge
-    - uses: cachix/install-nix-action@ba0dd844c9180cbf77aa72a116d6fbc515d0e87b # v27
+    - uses: cachix/install-nix-action@9f70348d77d0422624097c4b7a75563948901306 # v29
       with:
         # nixpkgs commit is pinned so that it doesn't break
         # editorconfig-checker 2.4.0

.github/workflows/manual-nixos.yml

@@ -15,11 +15,11 @@ jobs:
     runs-on: ubuntu-latest
     if: github.repository_owner == 'NixOS'
     steps:
-      - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
+      - uses: actions/checkout@d632683dd7b4114ad314bca15554477dd762a938 # v4.2.0
         with:
           # pull_request_target checks out the base branch by default
           ref: refs/pull/${{ github.event.pull_request.number }}/merge
-      - uses: cachix/install-nix-action@ba0dd844c9180cbf77aa72a116d6fbc515d0e87b # v27
+      - uses: cachix/install-nix-action@9f70348d77d0422624097c4b7a75563948901306 # v29
         with:
           # explicitly enable sandbox
           extra_nix_config: sandbox = true

.github/workflows/manual-nixpkgs.yml

@@ -17,11 +17,11 @@ jobs:
     runs-on: ubuntu-latest
     if: github.repository_owner == 'NixOS'
     steps:
-      - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
+      - uses: actions/checkout@d632683dd7b4114ad314bca15554477dd762a938 # v4.2.0
         with:
           # pull_request_target checks out the base branch by default
           ref: refs/pull/${{ github.event.pull_request.number }}/merge
-      - uses: cachix/install-nix-action@ba0dd844c9180cbf77aa72a116d6fbc515d0e87b # v27
+      - uses: cachix/install-nix-action@9f70348d77d0422624097c4b7a75563948901306 # v29
         with:
           # explicitly enable sandbox
           extra_nix_config: sandbox = true

.github/workflows/nix-parse.yml

@@ -25,12 +25,12 @@ jobs:
         if [[ -s "$HOME/changed_files" ]]; then
           echo "CHANGED_FILES=$HOME/changed_files" > "$GITHUB_ENV"
         fi
-    - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
+    - uses: actions/checkout@d632683dd7b4114ad314bca15554477dd762a938 # v4.2.0
       with:
         # pull_request_target checks out the base branch by default
         ref: refs/pull/${{ github.event.pull_request.number }}/merge
       if: ${{ env.CHANGED_FILES && env.CHANGED_FILES != '' }}
-    - uses: cachix/install-nix-action@ba0dd844c9180cbf77aa72a116d6fbc515d0e87b # v27
+    - uses: cachix/install-nix-action@9f70348d77d0422624097c4b7a75563948901306 # v29
       with:
         nix_path: nixpkgs=channel:nixpkgs-unstable
     - name: Parse all changed or added nix files

.github/workflows/nixpkgs-vet.yml

@@ -72,7 +72,7 @@ jobs:
           else
             echo "The PR cannot be merged, it has a merge conflict, skipping the rest.."
           fi
-      - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
+      - uses: actions/checkout@d632683dd7b4114ad314bca15554477dd762a938 # v4.2.0
         if: env.mergedSha
         with:
           # pull_request_target checks out the base branch by default
@@ -85,7 +85,7 @@ jobs:
           base=$(mktemp -d)
           git worktree add "$base" "$(git rev-parse HEAD^1)"
           echo "base=$base" >> "$GITHUB_ENV"
-      - uses: cachix/install-nix-action@ba0dd844c9180cbf77aa72a116d6fbc515d0e87b # v27
+      - uses: cachix/install-nix-action@9f70348d77d0422624097c4b7a75563948901306 # v29
         if: env.mergedSha
       - name: Fetching the pinned tool
         if: env.mergedSha

.github/workflows/periodic-merge-24h.yml

@@ -41,7 +41,7 @@ jobs:
             into: staging-24.05
     name: ${{ matrix.pairs.from }} → ${{ matrix.pairs.into }}
     steps:
-      - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
+      - uses: actions/checkout@d632683dd7b4114ad314bca15554477dd762a938 # v4.2.0
 
       - name: ${{ matrix.pairs.from }} → ${{ matrix.pairs.into }}
         uses: devmasx/merge-branch@854d3ac71ed1e9deb668e0074781b81fdd6e771f # 1.4.0

.github/workflows/periodic-merge-6h.yml

@@ -39,7 +39,7 @@ jobs:
             into: staging
     name: ${{ matrix.pairs.from }} → ${{ matrix.pairs.into }}
     steps:
-      - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
+      - uses: actions/checkout@d632683dd7b4114ad314bca15554477dd762a938 # v4.2.0
 
       - name: ${{ matrix.pairs.from }} → ${{ matrix.pairs.into }}
         uses: devmasx/merge-branch@854d3ac71ed1e9deb668e0074781b81fdd6e771f # 1.4.0

.github/workflows/update-terraform-providers.yml

@@ -16,8 +16,8 @@ jobs:
     if: github.repository_owner == 'NixOS' && github.ref == 'refs/heads/master' # ensure workflow_dispatch only runs on master
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
-      - uses: cachix/install-nix-action@ba0dd844c9180cbf77aa72a116d6fbc515d0e87b # v27
+      - uses: actions/checkout@d632683dd7b4114ad314bca15554477dd762a938 # v4.2.0
+      - uses: cachix/install-nix-action@9f70348d77d0422624097c4b7a75563948901306 # v29
         with:
           nix_path: nixpkgs=channel:nixpkgs-unstable
       - name: setup

doc/hooks/index.md

@@ -30,6 +30,7 @@ postgresql-test-hook.section.md
 premake.section.md
 python.section.md
 scons.section.md
+tauri.section.md
 tetex-tex-live.section.md
 unzip.section.md
 validatePkgConfig.section.md

doc/hooks/tauri.section.md

@@ -0,0 +1,108 @@
+# cargo-tauri.hook {#tauri-hook}
+
+[Tauri](https://tauri.app/) is a framework for building smaller, faster, and
+more secure desktop applications with a web frontend.
+
+In Nixpkgs, `cargo-tauri.hook` overrides the default build and install phases.
+
+## Example code snippet {#tauri-hook-example-code-snippet}
+
+```nix
+{
+  lib,
+  stdenv,
+  rustPlatform,
+  fetchNpmDeps,
+  cargo-tauri,
+  darwin,
+  glib-networking,
+  libsoup,
+  nodejs,
+  npmHooks,
+  openssl,
+  pkg-config,
+  webkitgtk,
+  wrapGAppsHook3,
+}:
+
+rustPlatform.buildRustPackage rec {
+  # . . .
+
+  cargoHash = "...";
+
+  # Assuming our app's frontend uses `npm` as a package manager
+  npmDeps = fetchNpmDeps {
+    name = "${pname}-npm-deps-${version}";
+    inherit src;
+    hash = "...";
+  };
+
+  nativeBuildInputs = [
+    # Pull in our main hook
+    cargo-tauri.hook
+
+    # Setup npm
+    nodejs
+    npmHooks.npmConfigHook
+
+    # Make sure we can find our libraries
+    pkg-config
+    wrapGAppsHook3
+  ];
+
+  buildInputs =
+    [ openssl ]
+    ++ lib.optionals stdenv.isLinux [
+      glib-networking # Most Tauri apps need networking
+      libsoup
+      webkitgtk
+    ]
+    ++ lib.optionals stdenv.isDarwin (
+      with darwin.apple_sdk.frameworks;
+      [
+        AppKit
+        CoreServices
+        Security
+        WebKit
+      ]
+    );
+
+  # Set our Tauri source directory
+  cargoRoot = "src-tauri";
+  # And make sure we build there too
+  buildAndTestSubdir = cargoRoot;
+
+  # . . .
+}
+```
+
+## Variables controlling cargo-tauri {#tauri-hook-variables-controlling}
+
+### Tauri Exclusive Variables {#tauri-hook-exclusive-variables}
+
+#### `tauriBuildFlags` {#tauri-build-flags}
+
+Controls the flags passed to `cargo tauri build`.
+
+#### `tauriBundleType` {#tauri-bundle-type}
+
+The [bundle type](https://tauri.app/v1/guides/building/) to build.
+
+#### `dontTauriBuild` {#dont-tauri-build}
+
+Disables using `tauriBuildHook`.
+
+#### `dontTauriInstall` {#dont-tauri-install}
+
+Disables using `tauriInstallPostBuildHook` and `tauriInstallHook`.
+
+### Honored Variables {#tauri-hook-honored-variables}
+
+Along with those found in [](#compiling-rust-applications-with-cargo), the
+following variables used by `cargoBuildHook` and `cargoInstallHook` are honored
+by the cargo-tauri setup hook.
+
+- `buildAndTestSubdir`
+- `cargoBuildType`
+- `cargoBuildNoDefaultFeatures`
+- `cargoBuildFeatures`

flake.nix

@@ -16,10 +16,44 @@
       });
     in
     {
+      /**
+        `nixpkgs.lib` is a combination of the [Nixpkgs library](https://nixos.org/manual/nixpkgs/unstable/#id-1.4), and other attributes
+        that are _not_ part of the Nixpkgs library, but part of the Nixpkgs flake:
+
+        - `lib.nixosSystem` for creating a NixOS system configuration
+
+        - `lib.nixos` for other NixOS-provided functionality, such as [`runTest`](https://nixos.org/manual/nixos/unstable/#sec-call-nixos-test-outside-nixos)
+      */
       lib = lib.extend (final: prev: {
 
+        /**
+          Other NixOS-provided functionality, such as [`runTest`](https://nixos.org/manual/nixos/unstable/#sec-call-nixos-test-outside-nixos).
+          See also `lib.nixosSystem`.
+        */
         nixos = import ./nixos/lib { lib = final; };
 
+        /**
+          Create a NixOS system configuration.
+
+          Example:
+
+              lib.nixosSystem {
+                modules = [ ./configuration.nix ];
+              }
+
+          Inputs:
+
+          - `modules` (list of paths or inline modules): The NixOS modules to include in the system configuration.
+
+          - `specialArgs` (attribute set): Extra arguments to pass to all modules, that are available in `imports` but can not be extended or overridden by the `modules`.
+
+          - `modulesLocation` (path): A default location for modules that aren't passed by path, used for error messages.
+
+          Legacy inputs:
+
+          - `system`: Legacy alias for `nixpkgs.hostPlatform`, but this is already set in the generated `hardware-configuration.nix`, included by `configuration.nix`.
+          - `pkgs`: Legacy alias for `nixpkgs.pkgs`; use `nixpkgs.pkgs` and `nixosModules.readOnlyPkgs` instead.
+        */
         nixosSystem = args:
           import ./nixos/lib/eval-config.nix (
             {
@@ -78,28 +112,56 @@
       };
 
       devShells = forAllSystems (system: {
+        /** A shell to get tooling for Nixpkgs development. See nixpkgs/shell.nix. */
         default = import ./shell.nix { inherit system; };
       });
 
-      # The "legacy" in `legacyPackages` doesn't imply that the packages exposed
-      # through this attribute are "legacy" packages. Instead, `legacyPackages`
-      # is used here as a substitute attribute name for `packages`. The problem
-      # with `packages` is that it makes operations like `nix flake show
-      # nixpkgs` unusably slow due to the sheer number of packages the Nix CLI
-      # needs to evaluate. But when the Nix CLI sees a `legacyPackages`
-      # attribute it displays `omitted` instead of evaluating all packages,
-      # which keeps `nix flake show` on Nixpkgs reasonably fast, though less
-      # information rich.
+      /**
+        A nested structure of [packages](https://nix.dev/manual/nix/latest/glossary#package-attribute-set) and other values.
+
+        The "legacy" in `legacyPackages` doesn't imply that the packages exposed
+        through this attribute are "legacy" packages. Instead, `legacyPackages`
+        is used here as a substitute attribute name for `packages`. The problem
+        with `packages` is that it makes operations like `nix flake show
+        nixpkgs` unusably slow due to the sheer number of packages the Nix CLI
+        needs to evaluate. But when the Nix CLI sees a `legacyPackages`
+        attribute it displays `omitted` instead of evaluating all packages,
+        which keeps `nix flake show` on Nixpkgs reasonably fast, though less
+        information rich.
+
+        The reason why finding the tree structure of `legacyPackages` is slow,
+        is that for each attribute in the tree, it is necessary to check whether
+        the attribute value is a package or a package set that needs further
+        evaluation. Evaluating the attribute value tends to require a significant
+        amount of computation, even considering lazy evaluation.
+      */
       legacyPackages = forAllSystems (system:
         (import ./. { inherit system; }).extend (final: prev: {
           lib = prev.lib.extend libVersionInfoOverlay;
         })
       );
 
+      /**
+        Optional modules that can be imported into a NixOS configuration.
+
+        Example:
+
+            # flake.nix
+            outputs = { nixpkgs, ... }: {
+              nixosConfigurations = {
+                foo = nixpkgs.lib.nixosSystem {
+                  modules = [
+                    ./foo/configuration.nix
+                    nixpkgs.nixosModules.notDetected
+                  ];
+                };
+              };
+            };
+        */
       nixosModules = {
         notDetected = ./nixos/modules/installer/scan/not-detected.nix;
 
-        /*
+        /**
           Make the `nixpkgs.*` configuration read-only. Guarantees that `pkgs`
           is the way you initialize it.
 

lib/modules.nix

@@ -354,12 +354,7 @@ let
           else if m._type == "if" || m._type == "override" then
             loadModule args fallbackFile fallbackKey { config = m; }
           else
-            throw (
-              "Could not load a value as a module, because it is of type ${lib.strings.escapeNixString m._type}"
-              + optionalString (fallbackFile != unknownModule) ", in file ${toString fallbackFile}."
-              + optionalString (m._type == "configuration") " If you do intend to import this configuration, please only import the modules that make up the configuration. You may have to create a `let` binding, file or attribute to give yourself access to the relevant modules.\nWhile loading a configuration into the module system is a very sensible idea, it can not be done cleanly in practice."
-               # Extended explanation: That's because a finalized configuration is more than just a set of modules. For instance, it has its own `specialArgs` that, by the nature of `specialArgs` can't be loaded through `imports` or the the `modules` argument. So instead, we have to ask you to extract the relevant modules and use those instead. This way, we keep the module system comparatively simple, and hopefully avoid a bad surprise down the line.
-            )
+            throw (messages.not_a_module { inherit fallbackFile; value = m; _type = m._type; expectedClass = class; })
         else if isList m then
           let defs = [{ file = fallbackFile; value = m; }]; in
           throw "Module imports can't be nested lists. Perhaps you meant to remove one level of lists? Definitions: ${showDefs defs}"
@@ -1450,6 +1445,110 @@ let
       collectModules = collectModules null;
     };
 
+  /**
+    Error messages produced by the module system.
+
+    We factor these out to improve the flow when reading the code.
+
+    Functions in `messages` that produce error messages are spelled in
+    lower_snake_case. This goes against the convention in order to make the
+    error message implementation more readable, and to visually distinguish
+    them from other functions in the module system.
+   */
+  messages = let
+    inherit (lib.strings) concatMapStringsSep escapeNixString trim;
+    /** "" or ", in file FOO" */
+    into_fallback_file_maybe = file:
+      optionalString
+        (file != null && file != unknownModule)
+        ", while trying to load a module into ${toString file}";
+
+    /** Format text with one line break between each list item. */
+    lines = concatMapStringsSep "\n" trim;
+
+    /** Format text with two line break between each list item. */
+    paragraphs = concatMapStringsSep "\n\n" trim;
+
+    /**
+      ```
+      optionalMatch
+        { foo = "Foo result";
+          bar = "Bar result";
+        } "foo"
+        ==  [ "Foo result" ]
+
+      optionalMatch { foo = "Foo"; } "baz"  ==  [ ]
+
+      optionalMatch { foo = "Foo"; } true   ==  [ ]
+      ```
+     */
+    optionalMatch = cases: value:
+      if isString value && cases?${value}
+      then [ cases.${value} ]
+      else [];
+
+    # esc = builtins.fromJSON "\"\\u001b\"";
+    esc = builtins.fromJSON "\"\\u001b\"";
+    # Bold purple for warnings
+    warn = s: "${esc}[1;35m${s}${esc}[0m";
+    # Bold green for suggestions
+    good = s: "${esc}[1;32m${s}${esc}[0m";
+    # Bold, default color for code
+    code = s: "${esc}[1m${s}${esc}[0m";
+
+  in {
+
+    /** When load a value with a (wrong) _type as a module  */
+    not_a_module = { fallbackFile, value, _type, expectedClass ? null }:
+      paragraphs (
+        [ ''
+            Expected a module, but found a value of type ${warn (escapeNixString _type)}${into_fallback_file_maybe fallbackFile}.
+            A module is typically loaded by adding it the ${code "imports = [ ... ];"} attribute of an existing module, or in the ${code "modules = [ ... ];"} argument of various functions.
+            Please make sure that each of the list items is a module, and not a different kind of value.
+          ''
+        ]
+        ++ (optionalMatch
+          {
+            "configuration" = trim ''
+              If you really mean to import this configuration, instead please only import the modules that make up the configuration.
+              You may have to create a `let` binding, file or attribute to give yourself access to the relevant modules.
+              While loading a configuration into the module system is a very sensible idea, it can not be done cleanly in practice.
+            '';
+            # ^^ Extended explanation: That's because a finalized configuration is more than just a set of modules. For instance, it has its own `specialArgs` that, by the nature of `specialArgs` can't be loaded through `imports` or the the `modules` argument. So instead, we have to ask you to extract the relevant modules and use those instead. This way, we keep the module system comparatively simple, and hopefully avoid a bad surprise down the line.
+
+            "flake" = lines
+              ([(trim ''
+                Perhaps you forgot to select an attribute name?
+                Instead of, for example,
+                    ${warn "inputs.someflake"}
+                you need to write something like
+                    ${warn "inputs.someflake"}${
+                      if expectedClass == null
+                      then good ".modules.someApp.default"
+                      else good ".modules.${expectedClass}.default"
+
+                    }
+            '')]
+            ++ optionalMatch
+              { # We'll no more than 5 custom suggestions here.
+                # Please switch to `.modules.${class}` in your Module System application.
+                "nixos" = trim ''
+                  or
+                      ${warn "inputs.someflake"}${good ".nixosModules.default"}
+                '';
+                "darwin" = trim ''
+                  or
+                      ${warn "inputs.someflake"}${good ".darwinModules.default"}
+                '';
+              }
+              expectedClass
+            );
+          }
+          _type
+        )
+      );
+  };
+
 in
 private //
 {

lib/systems/default.nix

@@ -384,8 +384,17 @@ let
             }.${cpu.name} or cpu.name;
             vendor_ = final.rust.platform.vendor;
           # TODO: deprecate args.rustc in favour of args.rust after 23.05 is EOL.
-          in args.rust.rustcTarget or args.rustc.config
-            or "${cpu_}-${vendor_}-${kernel.name}${optionalString (abi.name != "unknown") "-${abi.name}"}";
+          in
+            args.rust.rustcTarget or
+            args.rustc.config or (
+              # Rust uses `wasm32-wasip?` rather than `wasm32-unknown-wasi`.
+              # We cannot know which subversion does the user want, and
+              # currently use WASI 0.1 as default for compatibility. Custom
+              # users can set `rust.rustcTarget` to override it.
+              if final.isWasi
+              then "${cpu_}-wasip1"
+              else "${cpu_}-${vendor_}-${kernel.name}${optionalString (abi.name != "unknown") "-${abi.name}"}"
+            );
 
           # The name of the rust target if it is standard, or the json file
           # containing the custom target spec.

lib/systems/examples.nix

@@ -256,7 +256,7 @@ rec {
   iphone64 = {
     config = "aarch64-apple-ios";
     # config = "aarch64-apple-darwin14";
-    sdkVer = "14.3";
+    darwinSdkVersion = "14.3";
     xcodeVer = "12.3";
     xcodePlatform = "iPhoneOS";
     useiOSPrebuilt = true;
@@ -265,7 +265,7 @@ rec {
   iphone32 = {
     config = "armv7a-apple-ios";
     # config = "arm-apple-darwin10";
-    sdkVer = "14.3";
+    darwinSdkVersion = "14.3";
     xcodeVer = "12.3";
     xcodePlatform = "iPhoneOS";
     useiOSPrebuilt = true;
@@ -274,7 +274,7 @@ rec {
   iphone64-simulator = {
     config = "x86_64-apple-ios";
     # config = "x86_64-apple-darwin14";
-    sdkVer = "14.3";
+    darwinSdkVersion = "14.3";
     xcodeVer = "12.3";
     xcodePlatform = "iPhoneSimulator";
     darwinPlatform = "ios-simulator";
@@ -284,7 +284,7 @@ rec {
   iphone32-simulator = {
     config = "i686-apple-ios";
     # config = "i386-apple-darwin11";
-    sdkVer = "14.3";
+    darwinSdkVersion = "14.3";
     xcodeVer = "12.3";
     xcodePlatform = "iPhoneSimulator";
     darwinPlatform = "ios-simulator";

lib/tests/modules.sh

@@ -534,9 +534,10 @@ checkConfigError 'The module .*/module-class-is-darwin.nix was imported into nix
 checkConfigError 'A submoduleWith option is declared multiple times with conflicting class values "darwin" and "nixos".' config.sub.mergeFail.config ./class-check.nix
 
 # _type check
-checkConfigError 'Could not load a value as a module, because it is of type "flake", in file .*/module-imports-_type-check.nix' config.ok.config ./module-imports-_type-check.nix
+checkConfigError 'Expected a module, but found a value of type .*"flake".*, while trying to load a module into .*/module-imports-_type-check.nix' config.ok.config ./module-imports-_type-check.nix
 checkConfigOutput '^true$' "$@" config.enable ./declare-enable.nix ./define-enable-with-top-level-mkIf.nix
-checkConfigError 'Could not load a value as a module, because it is of type "configuration", in file .*/import-configuration.nix.*please only import the modules that make up the configuration.*' config ./import-configuration.nix
+checkConfigError 'Expected a module, but found a value of type .*"configuration".*, while trying to load a module into .*/import-configuration.nix.' config ./import-configuration.nix
+checkConfigError 'please only import the modules that make up the configuration' config ./import-configuration.nix
 
 # doRename works when `warnings` does not exist.
 checkConfigOutput '^1234$' config.c.d.e ./doRename-basic.nix

maintainers/maintainer-list.nix

@@ -8479,6 +8479,11 @@
     githubId = 15121114;
     name = "Tom Herbers";
   };
+  herschenglime = {
+    github = "Herschenglime";
+    githubId = 69494718;
+    name = "Herschenglime";
+  };
   hexa = {
     email = "hexa@darmstadt.ccc.de";
     matrix = "@hexa:lossy.network";
@@ -11380,6 +11385,12 @@
     githubId = 787421;
     name = "Kevin Quick";
   };
+  kraanzu = {
+    name = "Murli Tawari";
+    email = "kraanzu@gmail.com";
+    github = "kraanzu";
+    githubId = 97718086;
+  };
   kradalby = {
     name = "Kristoffer Dalby";
     email = "kristoffer@dalby.cc";
@@ -14159,6 +14170,12 @@
     githubId = 754512;
     name = "Mogria";
   };
+  mohe2015 = {
+    name = "Moritz Hedtke";
+    email = "Moritz.Hedtke@t-online.de";
+    github = "mohe2015";
+    githubId = 13287984;
+  };
   momeemt = {
     name = "Mutsuha Asada";
     email = "me@momee.mt";
@@ -15224,6 +15241,11 @@
     github = "noaccOS";
     githubId = 24324352;
   };
+  noahgitsham = {
+    name = "Noah Gitsham";
+    github = "noahgitsham";
+    githubId = 73707948;
+  };
   nobbz = {
     name = "Norbert Melzer";
     email = "timmelzer+nixpkgs@gmail.com";
@@ -15749,12 +15771,6 @@
     github = "ony";
     githubId = 11265;
   };
-  oo-infty = {
-    name = "Justin Chen";
-    email = "oo-infty@outlook.com";
-    github = "oo-infty";
-    githubId = 42143810;
-  };
   ooliver1 = {
     name = "Oliver Wilkes";
     email = "oliverwilkes2006@icloud.com";
@@ -15762,6 +15778,12 @@
     githubId = 34910574;
     keys = [ { fingerprint = "D055 8A23 3947 B7A0 F966  B07F 0B41 0348 9833 7273"; } ];
   };
+  oosquare = {
+    name = "Justin Chen";
+    email = "oosquare@outlook.com";
+    github = "oosquare";
+    githubId = 42143810;
+  };
   opeik = {
     email = "sandro@stikic.com";
     github = "opeik";
@@ -18958,6 +18980,12 @@
     githubId = 11320;
     name = "Sergiu Ivanov";
   };
+  scraptux = {
+    email = "git@thomasjasny.de";
+    github = "scraptux";
+    githubId = 12714892;
+    name = "Thomas Jasny";
+  };
   screendriver = {
     email = "nix@echooff.de";
     github = "screendriver";

nixos/doc/manual/release-notes/rl-2411.section.md

@@ -84,6 +84,8 @@
   alos create normal users and change passwords. Available as
   [services.userborn](#opt-services.userborn.enable)
 
+- [Hatsu](https://github.com/importantimport/hatsu), a self-hosted bridge that interacts with Fediverse on behalf of your static site. Available as [services.hatsu](options.html#opt-services.hatsu).
+
 - [Flood](https://flood.js.org/), a beautiful WebUI for various torrent clients. Available as [services.flood](options.html#opt-services.flood).
 
 - [Firefly-iii Data Importer](https://github.com/firefly-iii/data-importer), a data importer for Firefly-III. Available as [services.firefly-iii-data-importer](options.html#opt-services.firefly-iii-data-importer)
@@ -297,6 +299,12 @@
 
 - `tests.overriding` has its `passthru.tests` restructured as an attribute set instead of a list, making individual tests accessible by their names.
 
+- Package `skk-dict` was split into multiple packages under `skkDictionaries`.
+  If in doubt, try `skkDictionaries.l`. As part of this change, the dictionaries
+  were moved from `$out/share` to `$out/share/skk`. Also, the dictionaries won't
+  be converted to UTF-8 unless the `useUtf8` package option is enabled. UTF-8
+  converted dictionaries will have the .utf8 suffix appended to its filename.
+
 - `vaultwarden` lost the capability to bind to privileged ports. If you rely on
    this behavior, override the systemd unit to allow `CAP_NET_BIND_SERVICE` in
    your local configuration.
@@ -533,6 +541,16 @@
 
 - The kubelet configuration file can now be amended with arbitrary additional content using the `services.kubernetes.kubelet.extraConfig` option.
 
+- The `services.seafile` module was updated to major version 11.
+  - As part of this upgrade, the database backend will be migrated to MySQL.
+    This process should be automatic, but in case of a botched migration,
+    old sqlite files are not removed and can be used to manually migrate the database.
+  - Additionally, the updated CSRF protection may prevent some users from logging in.
+    Specific origin addresses can be whitelisted using the `services.seafile.seahubExtraConf` option
+    (e.g. `services.seafile.seahubExtraConf = ''CSRF_TRUSTED_ORIGINS = ["https://example.com"]'';`).
+    Note that first solution of the [official FAQ answer](https://cloud.seatable.io/dtable/external-links/7b976c85f504491cbe8e/?tid=0000&vid=0000&row-id=BQhH-2HSQs68Nq2EW91DBA)
+    is not allowed by the `services.nginx` module's config-checker.
+
 - To facilitate dependency injection, the `imgui` package now builds a static archive using vcpkg' CMake rules.
   The derivation now installs "impl" headers selectively instead of by a wildcard.
   Use `imgui.src` if you just want to access the unpacked sources.
@@ -548,6 +566,8 @@
 - `security.pam.u2f` now follows RFC42.
   All module options are now settable through the freeform `.settings`.
 
+- Mikutter was removed because the package was broken and had no maintainers.
+
 - Gollum was upgraded to major version 6. Read their [migration notes](https://github.com/gollum/gollum/wiki/6.0-Release-Notes).
 
 - The hooks `yarnConfigHook` and `yarnBuildHook` were added. These should replace `yarn2nix.mkYarnPackage` and other `yarn2nix` related tools. The motivation to get rid of `yarn2nix` tools is the fact that they are too complex and hard to maintain, and they rely upon too much Nix evaluation which is problematic if import-from-derivation is not allowed (see more details at [#296856](https://github.com/NixOS/nixpkgs/issues/296856). The transition from `mkYarnPackage` to `yarn{Config,Build}Hook` is tracked at [#324246](https://github.com/NixOS/nixpkgs/issues/324246).
@@ -569,6 +589,11 @@
 
 - `restic` module now has an option for inhibiting system sleep while backups are running, defaulting to off (not inhibiting sleep), available as [`services.restic.backups.<name>.inhibitsSleep`](#opt-services.restic.backups._name_.inhibitsSleep).
 
+- The arguments from [](#opt-services.postgresql.initdbArgs) now get shell-escaped.
+
+- `cargo-tauri.hook` was introduced to help users build [Tauri](https://tauri.app/) projects. It is meant to be used alongside
+  `rustPlatform.buildRustPackage` and Node hooks such as `npmConfigHook`, `pnpm.configHook`, and the new `yarnConfig`
+
 - Support for *runner registration tokens* has been [deprecated](https://gitlab.com/gitlab-org/gitlab/-/issues/380872)
   in `gitlab-runner` 15.6 and is expected to be removed in `gitlab-runner` 18.0. Configuration of existing runners
   should be changed to using *runner authentication tokens* by configuring

nixos/modules/module-list.nix

@@ -1385,6 +1385,7 @@
   ./services/web-apps/atlassian/crowd.nix
   ./services/web-apps/atlassian/jira.nix
   ./services/web-apps/audiobookshelf.nix
+  ./services/web-apps/bluemap.nix
   ./services/web-apps/bookstack.nix
   ./services/web-apps/c2fmzq-server.nix
   ./services/web-apps/calibre-web.nix
@@ -1426,6 +1427,7 @@
   ./services/web-apps/goatcounter.nix
   ./services/web-apps/guacamole-client.nix
   ./services/web-apps/guacamole-server.nix
+  ./services/web-apps/hatsu.nix
   ./services/web-apps/healthchecks.nix
   ./services/web-apps/hedgedoc.nix
   ./services/web-apps/hledger-web.nix
@@ -1516,7 +1518,6 @@
   ./services/web-apps/zitadel.nix
   ./services/web-servers/agate.nix
   ./services/web-servers/apache-httpd/default.nix
-  ./services/web-servers/bluemap.nix
   ./services/web-servers/caddy/default.nix
   ./services/web-servers/darkhttpd.nix
   ./services/web-servers/fcgiwrap.nix

nixos/modules/programs/wayland/cardboard.nix

@@ -19,6 +19,6 @@ in
       # To make a cardboard session available for certain DMs like SDDM
       services.displayManager.sessionPackages = [ cfg.package ];
     }
-    (import ./wayland-session.nix { inherit lib; })
+    (import ./wayland-session.nix { inherit lib pkgs; })
   ]);
 }

nixos/modules/programs/wayland/hyprland.nix

@@ -70,7 +70,7 @@ in
     }
 
     (import ./wayland-session.nix {
-      inherit lib;
+      inherit lib pkgs;
       enableXWayland = cfg.xwayland.enable;
       enableWlrPortal = lib.mkDefault false; # Hyprland has its own portal, wlr is not needed
     })

nixos/modules/programs/wayland/labwc.nix

@@ -20,6 +20,6 @@ in
       # To make a labwc session available for certain DMs like SDDM
       services.displayManager.sessionPackages = [ cfg.package ];
     }
-    (import ./wayland-session.nix { inherit lib; })
+    (import ./wayland-session.nix { inherit lib pkgs; })
   ]);
 }

nixos/modules/programs/wayland/miracle-wm.nix

@@ -30,11 +30,12 @@ in
       }
 
       (import ./wayland-session.nix {
-        inherit lib;
+        inherit lib pkgs;
         # Hardcoded path in Mir, not really possible to disable
         enableXWayland = true;
         # No portal support yet: https://github.com/mattkae/miracle-wm/issues/164
         enableWlrPortal = false;
+        enableGtkPortal = false;
       })
     ]
   );

nixos/modules/programs/wayland/river.nix

@@ -56,7 +56,7 @@ in
     }
 
     (import ./wayland-session.nix {
-      inherit lib;
+      inherit lib pkgs;
       enableXWayland = cfg.xwayland.enable;
     })
   ]);

nixos/modules/programs/wayland/sway.nix

@@ -148,7 +148,7 @@ in
     }
 
     (import ./wayland-session.nix {
-      inherit lib;
+      inherit lib pkgs;
       enableXWayland = cfg.xwayland.enable;
     })
   ]);

nixos/modules/programs/wayland/wayfire.nix

@@ -63,7 +63,7 @@ in
           };
         }
         (import ./wayland-session.nix {
-          inherit lib;
+          inherit lib pkgs;
           enableXWayland = cfg.xwayland.enable;
         })
       ]

nixos/modules/programs/wayland/wayland-session.nix

@@ -1,7 +1,9 @@
 {
   lib,
+  pkgs,
   enableXWayland ? true,
   enableWlrPortal ? true,
+  enableGtkPortal ? true,
 }:
 
 {
@@ -18,6 +20,9 @@
   services.graphical-desktop.enable = true;
 
   xdg.portal.wlr.enable = enableWlrPortal;
+  xdg.portal.extraPortals = lib.mkIf enableGtkPortal [
+    pkgs.xdg-desktop-portal-gtk
+  ];
 
   # Window manager only sessions (unlike DEs) don't handle XDG
   # autostart files, so force them to run the service

nixos/modules/services/databases/postgresql.md

@@ -187,7 +187,7 @@ $ nix-instantiate --eval -A postgresql_13.psqlSchema
 ```
 For an upgrade, a script like this can be used to simplify the process:
 ```nix
-{ config, pkgs, ... }:
+{ config, lib, pkgs, ... }:
 {
   environment.systemPackages = [
     (let
@@ -211,7 +211,7 @@ For an upgrade, a script like this can be used to simplify the process:
 
       install -d -m 0700 -o postgres -g postgres "$NEWDATA"
       cd "$NEWDATA"
-      sudo -u postgres $NEWBIN/initdb -D "$NEWDATA" ${builtins.concatStringsSep " " cfg.initdbArgs}
+      sudo -u postgres $NEWBIN/initdb -D "$NEWDATA" ${lib.escapeShellArgs cfg.initdbArgs}
 
       sudo -u postgres $NEWBIN/pg_upgrade \
         --old-datadir "$OLDDATA" --new-datadir "$NEWDATA" \

nixos/modules/services/databases/postgresql.nix

@@ -7,6 +7,7 @@ let
     concatStringsSep
     const
     elem
+    escapeShellArgs
     filterAttrs
     isString
     literalExpression
@@ -545,7 +546,7 @@ in
               rm -f ${cfg.dataDir}/*.conf
 
               # Initialise the database.
-              initdb -U ${cfg.superUser} ${concatStringsSep " " cfg.initdbArgs}
+              initdb -U ${cfg.superUser} ${escapeShellArgs cfg.initdbArgs}
 
               # See postStart!
               touch "${cfg.dataDir}/.first_startup"

nixos/modules/services/logging/logrotate.nix

@@ -261,6 +261,7 @@ in
         CapabilityBoundingSet = [
           "CAP_CHOWN"
           "CAP_DAC_OVERRIDE"
+          "CAP_KILL"
           "CAP_SETUID"
           "CAP_SETGID"
         ];
@@ -285,9 +286,9 @@ in
         RestrictSUIDSGID = false; # can create sgid directories
         SystemCallArchitectures = "native";
         SystemCallFilter = [
-          "@system-service @setuid"
+          "@system-service"
           "~@privileged @resources"
-          "@chown"
+          "@chown @setuid"
         ];
         UMask = "0027";
       } // lib.optionalAttrs (!cfg.allowNetworking) {

nixos/modules/services/misc/fstrim.nix

@@ -8,7 +8,9 @@ in {
   options = {
 
     services.fstrim = {
-      enable = lib.mkEnableOption "periodic SSD TRIM of mounted partitions in background";
+      enable = (lib.mkEnableOption "periodic SSD TRIM of mounted partitions in background" // {
+        default = true;
+      });
 
       interval = lib.mkOption {
         type = lib.types.str;

nixos/modules/services/misc/open-webui.nix

@@ -93,6 +93,7 @@ in
         DATA_DIR = ".";
         HF_HOME = ".";
         SENTENCE_TRANSFORMERS_HOME = ".";
+        WEBUI_URL = "http://localhost:${toString cfg.port}";
       } // cfg.environment;
 
       serviceConfig = {

nixos/modules/services/networking/freeradius.nix

@@ -74,7 +74,7 @@ in
         /*uid = config.ids.uids.radius;*/
         description = "Radius daemon user";
         isSystemUser = true;
-        groups = "radius";
+        group = "radius";
       };
       groups.radius = {};
     };

nixos/modules/services/networking/seafile.nix

@@ -1,19 +1,42 @@
-{ config, lib, pkgs, ... }:
-with lib;
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
 let
   cfg = config.services.seafile;
   settingsFormat = pkgs.formats.ini { };
 
-  ccnetConf = settingsFormat.generate "ccnet.conf" cfg.ccnetSettings;
+  ccnetConf = settingsFormat.generate "ccnet.conf" (
+    lib.attrsets.recursiveUpdate {
+      Database = {
+        ENGINE = "mysql";
+        UNIX_SOCKET = "/var/run/mysqld/mysqld.sock";
+        DB = "ccnet_db";
+        CONNECTION_CHARSET = "utf8";
+      };
+    } cfg.ccnetSettings
+  );
 
-  seafileConf = settingsFormat.generate "seafile.conf" cfg.seafileSettings;
+  seafileConf = settingsFormat.generate "seafile.conf" (
+    lib.attrsets.recursiveUpdate {
+      database = {
+        type = "mysql";
+        unix_socket = "/var/run/mysqld/mysqld.sock";
+        db_name = "seafile_db";
+        connection_charset = "utf8";
+      };
+    } cfg.seafileSettings
+  );
 
   seahubSettings = pkgs.writeText "seahub_settings.py" ''
     FILE_SERVER_ROOT = '${cfg.ccnetSettings.General.SERVICE_URL}/seafhttp'
     DATABASES = {
         'default': {
-            'ENGINE': 'django.db.backends.sqlite3',
-            'NAME': '${seahubDir}/seahub.db',
+            'ENGINE': 'django.db.backends.mysql',
+            'NAME' : 'seahub_db',
+            'HOST' : '/var/run/mysqld/mysqld.sock',
         }
     }
     MEDIA_ROOT = '${seahubDir}/media/'
@@ -21,23 +44,25 @@ let
 
     SERVICE_URL = '${cfg.ccnetSettings.General.SERVICE_URL}'
 
+    CSRF_TRUSTED_ORIGINS = ["${cfg.ccnetSettings.General.SERVICE_URL}"]
+
     with open('${seafRoot}/.seahubSecret') as f:
         SECRET_KEY = f.readline().rstrip()
 
     ${cfg.seahubExtraConf}
   '';
 
-  seafRoot = "/var/lib/seafile"; # hardcode it due to dynamicuser
+  seafRoot = "/var/lib/seafile";
   ccnetDir = "${seafRoot}/ccnet";
-  dataDir = "${seafRoot}/data";
   seahubDir = "${seafRoot}/seahub";
+  defaultUser = "seafile";
 
 in
 {
 
   ###### Interface
 
-  options.services.seafile = {
+  options.services.seafile = with lib; {
     enable = mkEnableOption "Seafile server";
 
     ccnetSettings = mkOption {
@@ -47,7 +72,7 @@ in
         options = {
           General = {
             SERVICE_URL = mkOption {
-              type = types.str;
+              type = types.singleLineStr;
               example = "https://www.example.com";
               description = ''
                 Seahub public URL.
@@ -78,11 +103,17 @@ in
               '';
             };
             host = mkOption {
-              type = types.str;
-              default = "127.0.0.1";
-              example = "0.0.0.0";
+              type = types.singleLineStr;
+              default = "ipv4:127.0.0.1";
+              example = "unix:/run/seafile/server.sock";
               description = ''
-                The binding address used by seafile fileserver.
+                The bind address used by seafile fileserver.
+
+                The addr can be defined as one of the following:
+                - ipv6:<ipv6addr> for binding to an IPv6 address.
+                - unix:<named pipe> for binding to a unix named socket
+                - ipv4:<ipv4addr> for binding to an ipv4 address
+                Otherwise the addr is assumed to be ipv4.
               '';
             };
           };
@@ -96,6 +127,19 @@ in
       '';
     };
 
+    seahubAddress = mkOption {
+      type = types.singleLineStr;
+      default = "unix:/run/seahub/gunicorn.sock";
+      example = "[::1]:8083";
+      description = ''
+        Which address to bind the seahub server to, of the form:
+        - HOST
+        - HOST:PORT
+        - unix:PATH.
+        IPv6 HOSTs must be wrapped in brackets.
+      '';
+    };
+
     workers = mkOption {
       type = types.int;
       default = 4;
@@ -107,7 +151,7 @@ in
 
     adminEmail = mkOption {
       example = "john@example.com";
-      type = types.str;
+      type = types.singleLineStr;
       description = ''
         Seafile Seahub Admin Account Email.
       '';
@@ -115,17 +159,79 @@ in
 
     initialAdminPassword = mkOption {
       example = "someStrongPass";
-      type = types.str;
+      type = types.singleLineStr;
       description = ''
         Seafile Seahub Admin Account initial password.
-        Should be change via Seahub web front-end.
+        Should be changed via Seahub web front-end.
       '';
     };
 
-    seafilePackage = mkPackageOption pkgs "seafile-server" { };
+    seahubPackage = mkPackageOption pkgs "seahub" { };
+
+    user = mkOption {
+      type = types.singleLineStr;
+      default = defaultUser;
+      description = "User account under which seafile runs.";
+    };
+
+    group = mkOption {
+      type = types.singleLineStr;
+      default = defaultUser;
+      description = "Group under which seafile runs.";
+    };
+
+    dataDir = mkOption {
+      type = types.path;
+      default = "${seafRoot}/data";
+      description = "Path in which to store user data";
+    };
+
+    gc = {
+      enable = mkEnableOption "automatic garbage collection on stored data blocks";
+
+      dates = mkOption {
+        type = types.listOf types.singleLineStr;
+        default = [ "Sun 03:00:00" ];
+        description = ''
+          When to run garbage collection on stored data blocks.
+          The time format is described in {manpage}`systemd.time(7)`.
+        '';
+      };
+
+      randomizedDelaySec = mkOption {
+        default = "0";
+        type = types.singleLineStr;
+        example = "45min";
+        description = ''
+          Add a randomized delay before each garbage collection.
+          The delay will be chosen between zero and this value.
+          This value must be a time span in the format specified by
+          {manpage}`systemd.time(7)`
+        '';
+      };
+
+      persistent = mkOption {
+        default = true;
+        type = types.bool;
+        example = false;
+        description = ''
+          Takes a boolean argument. If true, the time when the service
+          unit was last triggered is stored on disk. When the timer is
+          activated, the service unit is triggered immediately if it
+          would have been triggered at least once during the time when
+          the timer was inactive. Such triggering is nonetheless
+          subject to the delay imposed by RandomizedDelaySec=. This is
+          useful to catch up on missed runs of the service when the
+          system was powered down.
+        '';
+      };
+    };
 
     seahubExtraConf = mkOption {
       default = "";
+      example = ''
+        CSRF_TRUSTED_ORIGINS = ["https://example.com"]
+      '';
       type = types.lines;
       description = ''
         Extra config to append to `seahub_settings.py` file.
@@ -137,12 +243,40 @@ in
 
   ###### Implementation
 
-  config = mkIf cfg.enable {
+  config = lib.mkIf cfg.enable {
+    services.mysql = {
+      enable = true;
+      package = lib.mkDefault pkgs.mariadb;
+      ensureDatabases = [
+        "ccnet_db"
+        "seafile_db"
+        "seahub_db"
+      ];
+      ensureUsers = [
+        {
+          name = cfg.user;
+          ensurePermissions = {
+            "ccnet_db.*" = "ALL PRIVILEGES";
+            "seafile_db.*" = "ALL PRIVILEGES";
+            "seahub_db.*" = "ALL PRIVILEGES";
+          };
+        }
+      ];
+    };
 
     environment.etc."seafile/ccnet.conf".source = ccnetConf;
     environment.etc."seafile/seafile.conf".source = seafileConf;
     environment.etc."seafile/seahub_settings.py".source = seahubSettings;
 
+    users.users = lib.optionalAttrs (cfg.user == defaultUser) {
+      "${defaultUser}" = {
+        group = cfg.group;
+        isSystemUser = true;
+      };
+    };
+
+    users.groups = lib.optionalAttrs (cfg.group == defaultUser) { "${defaultUser}" = { }; };
+
     systemd.targets.seafile = {
       wantedBy = [ "multi-user.target" ];
       description = "Seafile components";
@@ -150,10 +284,12 @@ in
 
     systemd.services =
       let
-        securityOptions = {
+        serviceOptions = {
           ProtectHome = true;
           PrivateUsers = true;
           PrivateDevices = true;
+          PrivateTmp = true;
+          ProtectSystem = "strict";
           ProtectClock = true;
           ProtectHostname = true;
           ProtectProc = "invisible";
@@ -162,36 +298,49 @@ in
           ProtectKernelLogs = true;
           ProtectControlGroups = true;
           RestrictNamespaces = true;
+          RemoveIPC = true;
           LockPersonality = true;
           RestrictRealtime = true;
           RestrictSUIDSGID = true;
+          NoNewPrivileges = true;
           MemoryDenyWriteExecute = true;
           SystemCallArchitectures = "native";
-          RestrictAddressFamilies = [ "AF_UNIX" "AF_INET" ];
+          RestrictAddressFamilies = [
+            "AF_UNIX"
+            "AF_INET"
+          ];
+
+          User = cfg.user;
+          Group = cfg.group;
+          StateDirectory = "seafile";
+          RuntimeDirectory = "seafile";
+          LogsDirectory = "seafile";
+          ConfigurationDirectory = "seafile";
+          ReadWritePaths = lib.lists.optional (cfg.dataDir != "${seafRoot}/data") cfg.dataDir;
         };
       in
       {
         seaf-server = {
           description = "Seafile server";
           partOf = [ "seafile.target" ];
-          after = [ "network.target" ];
+          unitConfig.RequiresMountsFor = lib.lists.optional (cfg.dataDir != "${seafRoot}/data") cfg.dataDir;
+          requires = [ "mysql.service" ];
+          after = [
+            "network.target"
+            "mysql.service"
+          ];
           wantedBy = [ "seafile.target" ];
-          restartTriggers = [ ccnetConf seafileConf ];
-          path = [ pkgs.sqlite ];
-          serviceConfig = securityOptions // {
-            User = "seafile";
-            Group = "seafile";
-            DynamicUser = true;
-            StateDirectory = "seafile";
-            RuntimeDirectory = "seafile";
-            LogsDirectory = "seafile";
-            ConfigurationDirectory = "seafile";
+          restartTriggers = [
+            ccnetConf
+            seafileConf
+          ];
+          serviceConfig = serviceOptions // {
             ExecStart = ''
-              ${cfg.seafilePackage}/bin/seaf-server \
+              ${lib.getExe cfg.seahubPackage.seafile-server} \
               --foreground \
               -F /etc/seafile \
               -c ${ccnetDir} \
-              -d ${dataDir} \
+              -d ${cfg.dataDir} \
               -l /var/log/seafile/server.log \
               -P /run/seafile/server.pid \
               -p /run/seafile
@@ -199,100 +348,201 @@ in
           };
           preStart = ''
             if [ ! -f "${seafRoot}/server-setup" ]; then
-                mkdir -p ${dataDir}/library-template
-                mkdir -p ${ccnetDir}/{GroupMgr,misc,OrgMgr,PeerMgr}
-                sqlite3 ${ccnetDir}/GroupMgr/groupmgr.db ".read ${cfg.seafilePackage}/share/seafile/sql/sqlite/groupmgr.sql"
-                sqlite3 ${ccnetDir}/misc/config.db ".read ${cfg.seafilePackage}/share/seafile/sql/sqlite/config.sql"
-                sqlite3 ${ccnetDir}/OrgMgr/orgmgr.db ".read ${cfg.seafilePackage}/share/seafile/sql/sqlite/org.sql"
-                sqlite3 ${ccnetDir}/PeerMgr/usermgr.db ".read ${cfg.seafilePackage}/share/seafile/sql/sqlite/user.sql"
-                sqlite3 ${dataDir}/seafile.db ".read ${cfg.seafilePackage}/share/seafile/sql/sqlite/seafile.sql"
-                echo "${cfg.seafilePackage.version}-sqlite" > "${seafRoot}"/server-setup
+                mkdir -p ${cfg.dataDir}/library-template
+                # Load schema on first install
+                ${pkgs.mariadb.client}/bin/mysql --database=ccnet_db < ${cfg.seahubPackage.seafile-server}/share/seafile/sql/mysql/ccnet.sql
+                ${pkgs.mariadb.client}/bin/mysql --database=seafile_db < ${cfg.seahubPackage.seafile-server}/share/seafile/sql/mysql/seafile.sql
+                echo "${cfg.seahubPackage.seafile-server.version}-mysql" > "${seafRoot}"/server-setup
+                echo Loaded MySQL schemas for first install
             fi
             # checking for upgrades and handling them
             installedMajor=$(cat "${seafRoot}/server-setup" | cut -d"-" -f1 | cut -d"." -f1)
             installedMinor=$(cat "${seafRoot}/server-setup" | cut -d"-" -f1 | cut -d"." -f2)
-            pkgMajor=$(echo "${cfg.seafilePackage.version}" | cut -d"." -f1)
-            pkgMinor=$(echo "${cfg.seafilePackage.version}" | cut -d"." -f2)
+            pkgMajor=$(echo "${cfg.seahubPackage.seafile-server.version}" | cut -d"." -f1)
+            pkgMinor=$(echo "${cfg.seahubPackage.seafile-server.version}" | cut -d"." -f2)
 
             if [[ $installedMajor == $pkgMajor && $installedMinor == $pkgMinor ]]; then
                :
-            elif [[ $installedMajor == 8 && $installedMinor == 0 && $pkgMajor == 9 && $pkgMinor == 0 ]]; then
-                # Upgrade from 8.0 to 9.0
-                sqlite3 ${dataDir}/seafile.db ".read ${pkgs.seahub}/scripts/upgrade/sql/9.0.0/sqlite3/seafile.sql"
-                echo "${cfg.seafilePackage.version}-sqlite" > "${seafRoot}"/server-setup
-            elif [[ $installedMajor == 9 && $installedMinor == 0 && $pkgMajor == 10 && $pkgMinor == 0 ]]; then
-                # Upgrade from 9.0 to 10.0
-                sqlite3 ${dataDir}/seafile.db ".read ${pkgs.seahub}/scripts/upgrade/sql/10.0.0/sqlite3/seafile.sql"
-                echo "${cfg.seafilePackage.version}-sqlite" > "${seafRoot}"/server-setup
+            elif [[ $installedMajor == 10 && $installedMinor == 0 && $pkgMajor == 11 && $pkgMinor == 0 ]]; then
+                # Upgrade from 10.0 to 11.0: migrate to mysql
+                echo Migrating from version 10 to 11
+
+                # From https://github.com/haiwen/seahub/blob/e12f941bfef7191795d8c72a7d339c01062964b2/scripts/sqlite2mysql.sh
+
+                echo Migrating ccnet database to MySQL
+                ${lib.getExe pkgs.sqlite} ${ccnetDir}/PeerMgr/usermgr.db ".dump" | \
+                  ${lib.getExe cfg.seahubPackage.python3} ${cfg.seahubPackage}/scripts/sqlite2mysql.py > ${ccnetDir}/ccnet.sql
+                ${lib.getExe pkgs.sqlite} ${ccnetDir}/GroupMgr/groupmgr.db ".dump" | \
+                  ${lib.getExe cfg.seahubPackage.python3} ${cfg.seahubPackage}/scripts/sqlite2mysql.py >> ${ccnetDir}/ccnet.sql
+                sed 's/ctime INTEGER/ctime BIGINT/g' -i ${ccnetDir}/ccnet.sql
+                sed 's/email TEXT, role TEXT/email VARCHAR(255), role TEXT/g' -i ${ccnetDir}/ccnet.sql
+                ${pkgs.mariadb.client}/bin/mysql --database=ccnet_db < ${ccnetDir}/ccnet.sql
+
+                echo Migrating seafile database to MySQL
+                ${lib.getExe pkgs.sqlite} ${cfg.dataDir}/seafile.db ".dump" | \
+                  ${lib.getExe cfg.seahubPackage.python3} ${cfg.seahubPackage}/scripts/sqlite2mysql.py > ${cfg.dataDir}/seafile.sql
+                sed 's/owner_id TEXT/owner_id VARCHAR(255)/g' -i ${cfg.dataDir}/seafile.sql
+                sed 's/user_name TEXT/user_name VARCHAR(255)/g' -i ${cfg.dataDir}/seafile.sql
+                ${pkgs.mariadb.client}/bin/mysql --database=seafile_db < ${cfg.dataDir}/seafile.sql
+
+                echo Migrating seahub database to MySQL
+                echo 'SET FOREIGN_KEY_CHECKS=0;' > ${seahubDir}/seahub.sql
+                ${lib.getExe pkgs.sqlite} ${seahubDir}/seahub.db ".dump" | \
+                  ${lib.getExe cfg.seahubPackage.python3} ${cfg.seahubPackage}/scripts/sqlite2mysql.py >> ${seahubDir}/seahub.sql
+                sed 's/`permission` , `reporter` text NOT NULL/`permission` longtext NOT NULL/g' -i ${seahubDir}/seahub.sql
+                sed 's/varchar(256) NOT NULL UNIQUE/varchar(255) NOT NULL UNIQUE/g' -i ${seahubDir}/seahub.sql
+                sed 's/,    UNIQUE (`user_email`, `contact_email`)//g' -i ${seahubDir}/seahub.sql
+                sed '/INSERT INTO `base_dirfileslastmodifiedinfo`/d' -i ${seahubDir}/seahub.sql
+                sed '/INSERT INTO `notifications_usernotification`/d' -i ${seahubDir}/seahub.sql
+                sed 's/DEFERRABLE INITIALLY DEFERRED//g' -i ${seahubDir}/seahub.sql
+                ${pkgs.mariadb.client}/bin/mysql --database=seahub_db < ${seahubDir}/seahub.sql
+
+                echo "${cfg.seahubPackage.seafile-server.version}-mysql" > "${seafRoot}"/server-setup
+                echo Migration complete
             else
-                echo "Unsupported upgrade" >&2
+                echo "Unsupported upgrade: $installedMajor.$installedMinor to $pkgMajor.$pkgMinor" >&2
                 exit 1
             fi
           '';
+
+          # Fix unix socket permissions
+          postStart = (
+            lib.strings.optionalString (lib.strings.hasPrefix "unix:" cfg.seafileSettings.fileserver.host) ''
+              while [[ ! -S "${lib.strings.removePrefix "unix:" cfg.seafileSettings.fileserver.host}" ]]; do
+                sleep 1
+              done
+              chmod 666 "${lib.strings.removePrefix "unix:" cfg.seafileSettings.fileserver.host}"
+            ''
+          );
         };
 
         seahub = {
           description = "Seafile Server Web Frontend";
           wantedBy = [ "seafile.target" ];
           partOf = [ "seafile.target" ];
-          after = [ "network.target" "seaf-server.service" ];
-          requires = [ "seaf-server.service" ];
+          unitConfig.RequiresMountsFor = lib.lists.optional (cfg.dataDir != "${seafRoot}/data") cfg.dataDir;
+          requires = [
+            "mysql.service"
+            "seaf-server.service"
+          ];
+          after = [
+            "network.target"
+            "mysql.service"
+            "seaf-server.service"
+          ];
           restartTriggers = [ seahubSettings ];
           environment = {
-            PYTHONPATH = "${pkgs.seahub.pythonPath}:${pkgs.seahub}/thirdpart:${pkgs.seahub}";
+            PYTHONPATH = "${cfg.seahubPackage.pythonPath}:${cfg.seahubPackage}/thirdpart:${cfg.seahubPackage}";
             DJANGO_SETTINGS_MODULE = "seahub.settings";
             CCNET_CONF_DIR = ccnetDir;
-            SEAFILE_CONF_DIR = dataDir;
+            SEAFILE_CONF_DIR = cfg.dataDir;
             SEAFILE_CENTRAL_CONF_DIR = "/etc/seafile";
             SEAFILE_RPC_PIPE_PATH = "/run/seafile";
             SEAHUB_LOG_DIR = "/var/log/seafile";
           };
-          serviceConfig = securityOptions // {
-            User = "seafile";
-            Group = "seafile";
-            DynamicUser = true;
+          serviceConfig = serviceOptions // {
             RuntimeDirectory = "seahub";
-            StateDirectory = "seafile";
-            LogsDirectory = "seafile";
-            ConfigurationDirectory = "seafile";
             ExecStart = ''
-              ${pkgs.seahub.python.pkgs.gunicorn}/bin/gunicorn seahub.wsgi:application \
+              ${lib.getExe cfg.seahubPackage.python3.pkgs.gunicorn} seahub.wsgi:application \
               --name seahub \
               --workers ${toString cfg.workers} \
               --log-level=info \
               --preload \
               --timeout=1200 \
               --limit-request-line=8190 \
-              --bind unix:/run/seahub/gunicorn.sock
+              --bind ${cfg.seahubAddress}
             '';
           };
           preStart = ''
             mkdir -p ${seahubDir}/media
             # Link all media except avatars
-            for m in `find ${pkgs.seahub}/media/ -maxdepth 1 -not -name "avatars"`; do
+            for m in `find ${cfg.seahubPackage}/media/ -maxdepth 1 -not -name "avatars"`; do
               ln -sf $m ${seahubDir}/media/
             done
             if [ ! -e "${seafRoot}/.seahubSecret" ]; then
-                ${pkgs.seahub.python}/bin/python ${pkgs.seahub}/tools/secret_key_generator.py > ${seafRoot}/.seahubSecret
-                chmod 400 ${seafRoot}/.seahubSecret
+                (
+                  umask 377 &&
+                  ${lib.getExe cfg.seahubPackage.python3} ${cfg.seahubPackage}/tools/secret_key_generator.py > ${seafRoot}/.seahubSecret
+                )
             fi
             if [ ! -f "${seafRoot}/seahub-setup" ]; then
                 # avatars directory should be writable
-                install -D -t ${seahubDir}/media/avatars/ ${pkgs.seahub}/media/avatars/default.png
-                install -D -t ${seahubDir}/media/avatars/groups ${pkgs.seahub}/media/avatars/groups/default.png
+                install -D -t ${seahubDir}/media/avatars/ ${cfg.seahubPackage}/media/avatars/default.png
+                install -D -t ${seahubDir}/media/avatars/groups ${cfg.seahubPackage}/media/avatars/groups/default.png
                 # init database
-                ${pkgs.seahub}/manage.py migrate
+                ${cfg.seahubPackage}/manage.py migrate
                 # create admin account
-                ${pkgs.expect}/bin/expect -c 'spawn ${pkgs.seahub}/manage.py createsuperuser --email=${cfg.adminEmail}; expect "Password: "; send "${cfg.initialAdminPassword}\r"; expect "Password (again): "; send "${cfg.initialAdminPassword}\r"; expect "Superuser created successfully."'
-                echo "${pkgs.seahub.version}-sqlite" > "${seafRoot}/seahub-setup"
+                ${lib.getExe pkgs.expect} -c 'spawn ${cfg.seahubPackage}/manage.py createsuperuser --email=${cfg.adminEmail}; expect "Password: "; send "${cfg.initialAdminPassword}\r"; expect "Password (again): "; send "${cfg.initialAdminPassword}\r"; expect "Superuser created successfully."'
+                echo "${cfg.seahubPackage.version}-mysql" > "${seafRoot}/seahub-setup"
             fi
             if [ $(cat "${seafRoot}/seahub-setup" | cut -d"-" -f1) != "${pkgs.seahub.version}" ]; then
-                # update database
-                ${pkgs.seahub}/manage.py migrate
-                echo "${pkgs.seahub.version}-sqlite" > "${seafRoot}/seahub-setup"
+                # run django migrations
+                ${cfg.seahubPackage}/manage.py migrate
+                echo "${cfg.seahubPackage.version}-mysql" > "${seafRoot}/seahub-setup"
             fi
           '';
         };
+
+        seaf-gc = {
+          description = "Seafile storage garbage collection";
+          conflicts = [
+            "seaf-server.service"
+            "seahub.service"
+          ];
+          after = [
+            "seaf-server.service"
+            "seahub.service"
+          ];
+          unitConfig.RequiresMountsFor = lib.lists.optional (cfg.dataDir != "${seafRoot}/data") cfg.dataDir;
+          onSuccess = [
+            "seaf-server.service"
+            "seahub.service"
+          ];
+          onFailure = [
+            "seaf-server.service"
+            "seahub.service"
+          ];
+          startAt = lib.lists.optionals cfg.gc.enable cfg.gc.dates;
+          serviceConfig = serviceOptions // {
+            Type = "oneshot";
+          };
+          script = ''
+            if [ ! -f "${seafRoot}/server-setup" ]; then
+                echo "Server not setup yet, GC not needed" >&2
+                exit
+            fi
+
+            # checking for pending upgrades
+            installedMajor=$(cat "${seafRoot}/server-setup" | cut -d"-" -f1 | cut -d"." -f1)
+            installedMinor=$(cat "${seafRoot}/server-setup" | cut -d"-" -f1 | cut -d"." -f2)
+            pkgMajor=$(echo "${cfg.seahubPackage.seafile-server.version}" | cut -d"." -f1)
+            pkgMinor=$(echo "${cfg.seahubPackage.seafile-server.version}" | cut -d"." -f2)
+
+            if [[ $installedMajor != $pkgMajor || $installedMinor != $pkgMinor ]]; then
+                echo "Server not upgraded yet" >&2
+                exit
+            fi
+
+            # Clean up user-deleted blocks and libraries
+            ${cfg.seahubPackage.seafile-server}/bin/seafserv-gc \
+              -F /etc/seafile \
+              -c ${ccnetDir} \
+              -d ${cfg.dataDir} \
+              --rm-fs
+          '';
+        };
       };
+
+    systemd.timers.seaf-gc = lib.mkIf cfg.gc.enable {
+      timerConfig = {
+        randomizedDelaySec = cfg.gc.randomizedDelaySec;
+        Persistent = cfg.gc.persistent;
+      };
+    };
   };
+
+  meta.maintainers = with lib.maintainers; [
+    greizgh
+    schmittlauch
+  ];
 }

nixos/modules/services/web-apps/hatsu.md

@@ -0,0 +1,23 @@
+# Hatsu {#module-services-hatsu}
+
+[Hatsu](https://github.com/importantimport/hatsu) is an fully-automated ActivityPub bridge for static sites.
+
+## Quickstart {#module-services-hatsu-quickstart}
+
+the minimum configuration to start hatsu server would look like this:
+
+```nix
+{
+  services.hatsu = {
+    enable = true;
+    settings = {
+      HATSU_DOMAIN = "hatsu.local";
+      HATSU_PRIMARY_ACCOUNT = "example.com";
+    };
+  };
+}
+```
+
+this will start the hatsu server on port 3939 and save the database in `/var/lib/hatsu/hatsu.sqlite3`.
+
+Please refer to the [Hatsu Documentation](https://hatsu.cli.rs) for additional configuration options.

nixos/modules/services/web-apps/hatsu.nix

@@ -0,0 +1,97 @@
+{
+  lib,
+  pkgs,
+  config,
+  ...
+}:
+let
+  cfg = config.services.hatsu;
+in
+{
+  meta.doc = ./hatsu.md;
+  meta.maintainers = with lib.maintainers; [ kwaa ];
+
+  options.services.hatsu = {
+    enable = lib.mkEnableOption "Self-hosted and fully-automated ActivityPub bridge for static sites";
+
+    package = lib.mkPackageOption pkgs "hatsu" { };
+
+    settings = lib.mkOption {
+      type = lib.types.submodule {
+        freeformType =
+          with lib.types;
+          attrsOf (
+            nullOr (oneOf [
+              bool
+              int
+              port
+              str
+            ])
+          );
+
+        options = {
+          HATSU_DATABASE_URL = lib.mkOption {
+            type = lib.types.str;
+            default = "sqlite:///var/lib/hatsu/hatsu.sqlite?mode=rwc";
+            example = "postgres://username:password@host/database";
+            description = "Database URL.";
+          };
+
+          HATSU_DOMAIN = lib.mkOption {
+            type = lib.types.str;
+            description = "The domain name of your instance (eg 'hatsu.local').";
+          };
+
+          HATSU_LISTEN_HOST = lib.mkOption {
+            type = lib.types.str;
+            default = "127.0.0.1";
+            description = "Host where hatsu should listen for incoming requests.";
+          };
+
+          HATSU_LISTEN_PORT = lib.mkOption {
+            type = lib.types.port;
+            apply = toString;
+            default = 3939;
+            description = "Port where hatsu should listen for incoming requests.";
+          };
+
+          HATSU_PRIMARY_ACCOUNT = lib.mkOption {
+            type = lib.types.str;
+            description = "The primary account of your instance (eg 'example.com').";
+          };
+        };
+      };
+
+      default = { };
+
+      description = ''
+        Configuration for Hatsu, see
+        <link xlink:href="https://hatsu.cli.rs/admins/environments.html"/>
+        for supported values.
+      '';
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    systemd.services.hatsu = {
+      environment = cfg.settings;
+
+      description = "Hatsu server";
+      documentation = [ "https://hatsu.cli.rs/" ];
+
+      after = [ "network-online.target" ];
+      wants = [ "network-online.target" ];
+
+      wantedBy = [ "multi-user.target" ];
+
+      serviceConfig = {
+        DynamicUser = true;
+        ExecStart = "${lib.getExe cfg.package}";
+        Restart = "on-failure";
+        StateDirectory = "hatsu";
+        Type = "simple";
+        WorkingDirectory = "%S/hatsu";
+      };
+    };
+  };
+}

nixos/modules/services/web-servers/garage.nix

@@ -1,4 +1,9 @@
-{ config, lib, pkgs, ... }:
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
 
 with lib;
 
@@ -6,11 +11,18 @@ let
   cfg = config.services.garage;
   toml = pkgs.formats.toml { };
   configFile = toml.generate "garage.toml" cfg.settings;
+
+  anyHasPrefix =
+    prefix: strOrList:
+    if isString strOrList then
+      hasPrefix prefix strOrList
+    else
+      any ({ path, ... }: hasPrefix prefix path) strOrList;
 in
 {
   meta = {
     doc = ./garage.md;
-    maintainers = [ ];
+    maintainers = [ maintainers.mjm ];
   };
 
   options.services.garage = {
@@ -20,7 +32,9 @@ in
       type = types.attrsOf types.str;
       description = "Extra environment variables to pass to the Garage server.";
       default = { };
-      example = { RUST_BACKTRACE = "yes"; };
+      example = {
+        RUST_BACKTRACE = "yes";
+      };
     };
 
     environmentFile = mkOption {
@@ -30,7 +44,13 @@ in
     };
 
     logLevel = mkOption {
-      type = types.enum ([ "error" "warn" "info" "debug" "trace" ]);
+      type = types.enum ([
+        "error"
+        "warn"
+        "info"
+        "debug"
+        "trace"
+      ]);
       default = "info";
       example = "debug";
       description = "Garage log level, see <https://garagehq.deuxfleurs.fr/documentation/quick-start/#launching-the-garage-server> for examples.";
@@ -49,10 +69,12 @@ in
 
           data_dir = mkOption {
             default = "/var/lib/garage/data";
-            example = [ {
-              path = "/var/lib/garage/data";
-              capacity = "2T";
-            } ];
+            example = [
+              {
+                path = "/var/lib/garage/data";
+                capacity = "2T";
+              }
+            ];
             type = with types; either path (listOf attrs);
             description = ''
               The directory in which Garage will store the data blocks of objects. This folder can be placed on an HDD.
@@ -83,7 +105,9 @@ in
       # These assertions can be removed in NixOS 24.11, when all users have been
       # warned once.
       {
-        assertion = (cfg.settings ? replication_factor || cfg.settings ? replication_mode) || lib.versionOlder cfg.package.version "1.0.0";
+        assertion =
+          (cfg.settings ? replication_factor || cfg.settings ? replication_mode)
+          || lib.versionOlder cfg.package.version "1.0.0";
         message = ''
           Garage 1.0.0 requires an explicit replication factor to be set.
           Please set replication_factor to 1 explicitly to preserve the previous behavior.
@@ -129,14 +153,25 @@ in
 
     systemd.services.garage = {
       description = "Garage Object Storage (S3 compatible)";
-      after = [ "network.target" "network-online.target" ];
-      wants = [ "network.target" "network-online.target" ];
+      after = [
+        "network.target"
+        "network-online.target"
+      ];
+      wants = [
+        "network.target"
+        "network-online.target"
+      ];
       wantedBy = [ "multi-user.target" ];
-      restartTriggers = [ configFile ] ++ (lib.optional (cfg.environmentFile != null) cfg.environmentFile);
+      restartTriggers = [
+        configFile
+      ] ++ (lib.optional (cfg.environmentFile != null) cfg.environmentFile);
       serviceConfig = {
         ExecStart = "${cfg.package}/bin/garage server";
 
-        StateDirectory = mkIf (hasPrefix "/var/lib/garage" cfg.settings.data_dir || hasPrefix "/var/lib/garage" cfg.settings.metadata_dir) "garage";
+        StateDirectory = mkIf (
+          anyHasPrefix "/var/lib/garage" cfg.settings.data_dir
+          || hasPrefix "/var/lib/garage" cfg.settings.metadata_dir
+        ) "garage";
         DynamicUser = lib.mkDefault true;
         ProtectHome = true;
         NoNewPrivileges = true;

nixos/modules/system/boot/networkd.nix

@@ -855,6 +855,7 @@ let
           "UseGateway"
           "UseRoutes"
           "UseTimezone"
+          "IPv6OnlyMode"
           "ClientIdentifier"
           "VendorClassIdentifier"
           "UserClass"
@@ -888,6 +889,7 @@ let
         (assertValueOneOf "UseGateway" boolValues)
         (assertValueOneOf "UseRoutes" boolValues)
         (assertValueOneOf "UseTimezone" boolValues)
+        (assertValueOneOf "IPv6OnlyMode" boolValues)
         (assertValueOneOf "ClientIdentifier" ["mac" "duid" "duid-only"])
         (assertInt "IAID")
         (assertValueOneOf "RequestBroadcast" boolValues)

nixos/tests/open-webui.nix

@@ -31,6 +31,7 @@ in
 
   testScript = ''
     import json
+    import xml.etree.ElementTree as xml
 
     machine.start()
 
@@ -45,5 +46,18 @@ in
 
     # Check that the name was overridden via the environmentFile option.
     assert webui_config["name"] == "${webuiName} (Open WebUI)"
+
+    webui_opensearch_xml = machine.succeed("curl http://127.0.0.1:${mainPort}/opensearch.xml")
+    webui_opensearch = xml.fromstring(webui_opensearch_xml)
+
+    webui_opensearch_url = webui_opensearch.find(
+        ".//{http://a9.com/-/spec/opensearch/1.1/}Url"
+    )
+    assert (
+        webui_opensearch_url is not None
+    ), f"no url tag found in {webui_opensearch_xml}"
+    assert (
+        webui_opensearch_url.get("template") == "http://localhost:8080/?q={searchTerms}"
+    ), "opensearch url doesn't match the configured port"
   '';
 }

nixos/tests/seafile.nix

@@ -14,6 +14,7 @@ import ./make-test-python.nix ({ pkgs, ... }:
         services.seafile = {
           enable = true;
           ccnetSettings.General.SERVICE_URL = "http://server";
+          seafileSettings.fileserver.host = "unix:/run/seafile/server.sock";
           adminEmail = "admin@example.com";
           initialAdminPassword = "seafile_password";
         };
@@ -22,7 +23,7 @@ import ./make-test-python.nix ({ pkgs, ... }:
           virtualHosts."server" = {
             locations."/".proxyPass = "http://unix:/run/seahub/gunicorn.sock";
             locations."/seafhttp" = {
-              proxyPass = "http://127.0.0.1:8082";
+              proxyPass = "http://unix:/run/seafile/server.sock";
               extraConfig = ''
                 rewrite ^/seafhttp(.*)$ $1 break;
                 client_max_body_size 0;

nixos/tests/web-apps/healthchecks.nix

@@ -24,7 +24,7 @@ import ../make-test-python.nix ({ lib, pkgs, ... }: {
 
     with subtest("Home screen loads"):
         machine.succeed(
-            "curl -sSfL http://localhost:8000 | grep '<title>Sign In'"
+            "curl -sSfL http://localhost:8000 | grep '<title>Log In'"
         )
 
     with subtest("Setting SITE_NAME via freeform option works"):

pkgs/README.md

@@ -745,7 +745,7 @@ stdenv.mkDerivation {
 Nixpkgs periodically tries to update all packages that have a `passthru.updateScript` attribute.
 
 > [!Note]
-> A common pattern is to use the [`nix-update-script`](../pkgs/common-updater/nix-update.nix) attribute provided in Nixpkgs, which runs [`nix-update`](https://github.com/Mic92/nix-update):
+> A common pattern is to use the [`nix-update-script`](../pkgs/by-name/ni/nix-update/nix-update-script.nix) attribute provided in Nixpkgs, which runs [`nix-update`](https://github.com/Mic92/nix-update):
 >
 > ```nix
 > { stdenv, nix-update-script }:
@@ -755,7 +755,7 @@ Nixpkgs periodically tries to update all packages that have a `passthru.updateSc
 > }
 > ```
 >
-> For simple packages, this is often enough, and will ensure that the package is updated automatically by [`nixpkgs-update`](https://ryantm.github.io/nixpkgs-update) when a new version is released.
+> For simple packages, this is often enough, and will ensure that the package is updated automatically by [`nixpkgs-update`](https://github.com/nix-community/nixpkgs-update) when a new version is released.
 > The [update bot](https://nix-community.org/update-bot) runs periodically to attempt to automatically update packages, and will run `passthru.updateScript` if set.
 > While not strictly necessary if the project is listed on [Repology](https://repology.org), using `nix-update-script` allows the package to update via many more sources (e.g. GitHub releases).
 

pkgs/applications/audio/ncmpcpp/default.nix

@@ -39,7 +39,7 @@ stdenv.mkDerivation rec {
   configureFlags = [
     "BOOST_LIB_SUFFIX="
     (lib.enableFeature outputsSupport "outputs")
-    (lib.enableFeature visualizerSupport "enable-visualizer")
+    (lib.enableFeature visualizerSupport "visualizer")
     (lib.withFeature visualizerSupport "fftw")
     (lib.enableFeature clockSupport "clock")
     (lib.withFeature taglibSupport "taglib")

pkgs/applications/blockchains/lighthouse/default.nix

@@ -6,7 +6,7 @@
 , lighthouse
 , nix-update-script
 , nodePackages
-, perl
+, openssl
 , pkg-config
 , postgresql
 , protobuf
@@ -57,7 +57,6 @@ rustPlatform.buildRustPackage rec {
   nativeBuildInputs = [
     rustPlatform.bindgenHook
     cmake
-    perl
     pkg-config
     protobuf
   ];
@@ -65,6 +64,8 @@ rustPlatform.buildRustPackage rec {
   buildInputs = [
     rust-jemalloc-sys
     sqlite
+  ] ++ lib.optionals (!stdenv.hostPlatform.isDarwin) [
+    openssl
   ] ++ lib.optionals stdenv.hostPlatform.isDarwin [
     CoreFoundation
     Security
@@ -84,6 +85,8 @@ rustPlatform.buildRustPackage rec {
   LIGHTHOUSE_DEPOSIT_CONTRACT_SPEC_URL = "file://${depositContractSpec}";
   LIGHTHOUSE_DEPOSIT_CONTRACT_TESTNET_URL = "file://${testnetDepositContractSpec}";
 
+  OPENSSL_NO_VENDOR = true;
+
   cargoBuildFlags = [
     "--package lighthouse"
   ];

pkgs/applications/editors/ox/default.nix

@@ -1,17 +1,19 @@
-{ lib, fetchFromGitHub, rustPlatform }:
+{ lib, stdenv, fetchFromGitHub, rustPlatform, darwin }:
 
 rustPlatform.buildRustPackage rec {
   pname = "ox";
-  version = "0.3.0";
+  version = "0.6.1";
 
   src = fetchFromGitHub {
     owner = "curlpipe";
     repo = pname;
     rev = version;
-    hash = "sha256-g5M/d6pts4Y17CpWJAsWFL5KCq1YFaACJq6n6BQw7mo=";
+    hash = "sha256-37o8Ak+8LPeGny7JBLc2STpRjfWBCwOrRyP3HJbD25o=";
   };
 
-  cargoHash = "sha256-6+W/guijsb9+ip1cvke8JLVa4h1nU2zQJCrLv64vsa0=";
+  cargoHash = "sha256-c7XhMYfhMCxyidZJemnu5f9KwQmPmbun6mrI3v2EpZ4=";
+
+  buildInputs = lib.optionals stdenv.hostPlatform.isDarwin [ darwin.apple_sdk.frameworks.AppKit ];
 
   meta = with lib; {
     description = "Independent Rust text editor that runs in your terminal";

pkgs/applications/editors/vscode/extensions/chenglou92.rescript-vscode/default.nix

@@ -5,7 +5,7 @@
   callPackage,
 }:
 let
-  version = "1.54.0";
+  version = "1.58.0";
   rescript-editor-analysis = callPackage ./rescript-editor-analysis.nix { inherit version; };
   arch =
     if stdenv.hostPlatform.isLinux then
@@ -21,7 +21,7 @@ vscode-utils.buildVscodeMarketplaceExtension rec {
     name = "rescript-vscode";
     publisher = "chenglou92";
     inherit version;
-    hash = "sha256-c7TJED5YpHRwn7Ooq8sG+N99b7tH6TOgeC9TTYdb4JA=";
+    hash = "sha256-EuEBbtdCaS4l8ykkxyLLMjEnUMs0IsXoc994a8Pw1Ws=";
   };
   postPatch = ''
     rm -r ${analysisDir}

pkgs/applications/editors/vscode/extensions/chenglou92.rescript-vscode/rescript-editor-analysis.nix

@@ -16,7 +16,7 @@ stdenv.mkDerivation {
     owner = "rescript-lang";
     repo = "rescript-vscode";
     rev = version;
-    hash = "sha256-+Ht8qWwxtFWHFMiV/aoZIs2S3SxkOWgdwSKN+akp/LU=";
+    hash = "sha256-v+qCVge57wvA97mtzbxAX9Fvi7ruo6ZyIC14O8uWl9Y=";
   };
 
   nativeBuildInputs = [
@@ -25,16 +25,12 @@ stdenv.mkDerivation {
     ocamlPackages.cppo
   ];
 
-  # Skip testing phases because they need to download and install node modules
-  postPatch = ''
-    cd analysis
-    substituteInPlace Makefile \
-      --replace "build: build-analysis-binary build-reanalyze build-tests" "build: build-analysis-binary" \
-      --replace "test: test-analysis-binary test-reanalyze" "test: test-analysis-binary"
+  buildPhase = ''
+    dune build -p analysis
   '';
 
   installPhase = ''
-    install -D -m0555 rescript-editor-analysis.exe $out/bin/rescript-editor-analysis.exe
+    install -D -m0555 _build/default/analysis/bin/main.exe $out/bin/rescript-editor-analysis.exe
   '';
 
   meta = {

pkgs/applications/editors/vscode/extensions/default.nix

@@ -406,8 +406,8 @@ let
         mktplcRef = {
           name = "vscode-neovim";
           publisher = "asvetliakov";
-          version = "1.18.11";
-          hash = "sha256-j1igEItS4TT1WxSxK3tFG29McTTo8ojEs6TJShGZiGI=";
+          version = "1.18.12";
+          hash = "sha256-3Nmk0MFIMFYQHrRyZ7ioFk9KfHSk0CSF7FwNaEJbsyg=";
         };
         meta = {
           changelog = "https://marketplace.visualstudio.com/items/asvetliakov.vscode-neovim/changelog";
@@ -2119,8 +2119,8 @@ let
         mktplcRef = {
           name = "gitlab-workflow";
           publisher = "gitlab";
-          version = "5.6.0";
-          hash = "sha256-K4oCMQBH5jrt61f/C3DDZC61RuDvOApnPEF3AsOrE20=";
+          version = "5.13.0";
+          hash = "sha256-A9QFW6Vk+g0pJfpXmZdUWJ/+WJBFXG79NXpCBuTjjok=";
         };
         meta = {
           description = "GitLab extension for Visual Studio Code";
@@ -4166,6 +4166,23 @@ let
         };
       };
 
+      sas.sas-lsp = buildVscodeMarketplaceExtension {
+        mktplcRef = {
+          name = "sas-lsp";
+          publisher = "SAS";
+          version = "1.10.2";
+          hash = "sha256-mf0q80UX4FxqHAHJBQlhkF/nqvTnfgTR8GuYBoWSswU=";
+        };
+        meta = {
+          changelog = "https://marketplace.visualstudio.com/items/SAS.sas-lsp/changelog";
+          description = "Official SAS Language Extension";
+          downloadPage = "https://marketplace.visualstudio.com/items?itemName=SAS.sas-lsp";
+          homepage = "https://github.com/sassoftware/vscode-sas-extension";
+          license = lib.licenses.asl20;
+          maintainers = [ lib.maintainers.scraptux ];
+        };
+      };
+
       scala-lang.scala = buildVscodeMarketplaceExtension {
         mktplcRef = {
           name = "scala";

pkgs/applications/editors/vscode/extensions/myriad-dreamin.tinymist/default.nix

@@ -11,7 +11,7 @@ vscode-utils.buildVscodeMarketplaceExtension {
     name = "tinymist";
     publisher = "myriad-dreamin";
     inherit (tinymist) version;
-    hash = "sha256-m5wq1F2sjiBacdyTFtLoqrJ/B6nwoaUjiNbc+zfpJoU=";
+    hash = "sha256-XkpoSf2UO3OoEMMpXBMkY1peQPR/4QoQ4LrY81IsHT0=";
   };
 
   nativeBuildInputs = [

pkgs/applications/file-managers/browsr/default.nix

@@ -32,9 +32,9 @@ python3.pkgs.buildPythonApplication rec {
     rich-pixels
     textual
     textual-universal-directorytree
-  ] ++ lib.attrVals extras passthru.optional-dependencies;
+  ] ++ lib.attrVals extras optional-dependencies;
 
-  passthru.optional-dependencies = with python3.pkgs; {
+  optional-dependencies = with python3.pkgs; {
     all = [
       pyarrow
       textual-universal-directorytree.optional-dependencies.remote

pkgs/applications/gis/gmt/default.nix

@@ -1,59 +1,98 @@
-{ lib, stdenv, fetchurl, cmake, curl, Accelerate, CoreGraphics, CoreVideo
-, fftwSinglePrec, netcdf, pcre, gdal, blas, lapack, glibc, ghostscript, dcw-gmt
-, gshhg-gmt }:
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  cmake,
+  curl,
+  Accelerate,
+  CoreGraphics,
+  CoreVideo,
+  fftwSinglePrec,
+  netcdf,
+  libxml2,
+  pcre,
+  gdal,
+  blas,
+  lapack,
+  glibc,
+  ghostscript,
+  dcw-gmt,
+  gshhg-gmt,
+}:
 
-/* The onus is on the user to also install:
-    - ffmpeg for webm or mp4 output
-    - graphicsmagick for gif output
+/*
+  The onus is on the user to also install:
+   - ffmpeg for webm or mp4 output
+   - graphicsmagick for gif output
 */
 
-stdenv.mkDerivation rec {
+let
+  # Certainly not an ideal situation, See:
+  # https://github.com/NixOS/nixpkgs/pull/340707#issuecomment-2361894717
+  netcdf' = netcdf.override {
+    libxml2 = libxml2.override {
+      enableHttp = true;
+    };
+  };
+in stdenv.mkDerivation (finalAttrs: {
   pname = "gmt";
-  version = "6.4.0";
-  src = fetchurl {
-    url = "https://github.com/GenericMappingTools/gmt/releases/download/${version}/gmt-${version}-src.tar.gz";
-    sha256 = "sha256-0mfAx9b7MMnqfgKe8n2tsm/9e5LLS0cD+aO6Do85Ohs=";
+  version = "6.5.0";
+  src = fetchFromGitHub {
+    owner = "GenericMappingTools";
+    repo = "gmt";
+    rev = "refs/tags/${finalAttrs.version}";
+    hash = "sha256-KKIYhljCtk9t9CuvTLsSGvUkUwazWTm9ymBB3wLwSoI=";
   };
 
-  nativeBuildInputs = [ cmake ];
+  nativeBuildInputs = [
+    cmake
+  ];
 
-  buildInputs = [ curl gdal netcdf pcre dcw-gmt gshhg-gmt ]
-    ++ (if stdenv.hostPlatform.isDarwin then [
-      Accelerate
-      CoreGraphics
-      CoreVideo
-    ] else [
-      glibc
-      fftwSinglePrec
-      blas
-      lapack
-    ]);
+  buildInputs =
+    [
+      curl
+      gdal
+      netcdf'
+      pcre
+      dcw-gmt
+      gshhg-gmt
+    ]
+    ++ (
+      if stdenv.hostPlatform.isDarwin then
+        [
+          Accelerate
+          CoreGraphics
+          CoreVideo
+        ]
+      else
+        [
+          glibc
+          fftwSinglePrec
+          blas
+          lapack
+        ]
+    );
 
-  propagatedBuildInputs = [ ghostscript ];
+  propagatedBuildInputs = [
+    ghostscript
+  ];
 
-  cmakeFlags = [
-    "-DGMT_DOCDIR=share/doc/gmt"
-    "-DGMT_MANDIR=share/man"
-    "-DGMT_LIBDIR=lib"
-    "-DCOPY_GSHHG:BOOL=FALSE"
-    "-DGSHHG_ROOT=${gshhg-gmt.out}/share/gshhg-gmt"
-    "-DCOPY_DCW:BOOL=FALSE"
-    "-DDCW_ROOT=${dcw-gmt.out}/share/dcw-gmt"
-    "-DGDAL_ROOT=${gdal.out}"
-    "-DNETCDF_ROOT=${netcdf.out}"
-    "-DPCRE_ROOT=${pcre.out}"
-    "-DGMT_INSTALL_TRADITIONAL_FOLDERNAMES:BOOL=FALSE"
-    "-DGMT_ENABLE_OPENMP:BOOL=TRUE"
-    "-DGMT_INSTALL_MODULE_LINKS:BOOL=FALSE"
-    "-DLICENSE_RESTRICTED=LGPL" # "GPL" and "no" also valid
-  ] ++ (with stdenv;
-    lib.optionals (!isDarwin) [
-      "-DFFTW3_ROOT=${fftwSinglePrec.dev}"
-      "-DLAPACK_LIBRARY=${lapack}/lib/liblapack.so"
-      "-DBLAS_LIBRARY=${blas}/lib/libblas.so"
-    ]);
+  cmakeFlags =
+    [
+      "-DGMT_DOCDIR=share/doc/gmt"
+      "-DGMT_MANDIR=share/man"
+      "-DGMT_LIBDIR=lib"
+      "-DCOPY_GSHHG:BOOL=FALSE"
+      "-DGSHHG_ROOT=${gshhg-gmt.out}/share/gshhg-gmt"
+      "-DCOPY_DCW:BOOL=FALSE"
+      "-DDCW_ROOT=${dcw-gmt.out}/share/dcw-gmt"
+      "-DGMT_INSTALL_TRADITIONAL_FOLDERNAMES:BOOL=FALSE"
+      "-DGMT_ENABLE_OPENMP:BOOL=TRUE"
+      "-DGMT_INSTALL_MODULE_LINKS:BOOL=FALSE"
+      "-DLICENSE_RESTRICTED=LGPL" # "GPL" and "no" also valid
+    ];
 
-  meta = with lib; {
+  meta = {
     homepage = "https://www.generic-mapping-tools.org";
     description = "Tools for manipulating geographic and cartesian data sets";
     longDescription = ''
@@ -65,9 +104,9 @@ stdenv.mkDerivation rec {
       transformations and includes supporting data such as coastlines, rivers,
       and political boundaries and optionally country polygons.
     '';
-    platforms = [ "x86_64-linux" "x86_64-darwin" ];
-    license = licenses.lgpl3Plus;
-    maintainers = with maintainers; [ tviti ];
+    platforms = lib.platforms.unix;
+    license = lib.licenses.lgpl3Plus;
+    maintainers = with lib.maintainers; [ tviti ];
   };
 
-}
+})

pkgs/applications/misc/dbx/default.nix

@@ -52,7 +52,7 @@ python.pkgs.buildPythonApplication rec {
       watchdog
     ];
 
-  passthru.optional-dependencies = with python3.pkgs; {
+  optional-dependencies = with python3.pkgs; {
     aws = [ boto3 ];
     azure = [
       azure-storage-blob

pkgs/applications/misc/gallery-dl/default.nix

@@ -10,13 +10,13 @@
 
 buildPythonApplication rec {
   pname = "gallery-dl";
-  version = "1.27.4";
+  version = "1.27.5";
   format = "setuptools";
 
   src = fetchPypi {
     inherit version;
     pname = "gallery_dl";
-    hash = "sha256-28y5sU9onPHIqlTIYzIQ+J2KElJocbuwKQN/E50JGI8=";
+    hash = "sha256-q/byWRvbzrV6KjPIDjJJWl0fkrluGEcvrISPKz8SJ+4=";
   };
 
   propagatedBuildInputs = [

pkgs/applications/misc/insulator2/default.nix

@@ -1,5 +1,4 @@
 { lib
-, cmake
 , dbus
 , fetchFromGitHub
 , fetchYarnDeps
@@ -13,12 +12,14 @@
 , cyrus_sasl
 , stdenv
 , fixup_yarn_lock
-, yarn
+, yarnConfigHook
 , nodejs-slim
 , cargo-tauri
 , cargo
 , rustPlatform
 , rustc
+, jq
+, moreutils
 }:
 
 stdenv.mkDerivation rec {
@@ -32,6 +33,11 @@ stdenv.mkDerivation rec {
     hash = "sha256-Bi9GCQr7yox5Plc7o0svRKYi1XoK/HDGj1VbW1z4jac=";
   };
 
+  # Yarn *really* wants us to use corepack if this is set
+  postPatch = ''
+    jq 'del(.packageManager)' package.json | sponge package.json
+  '';
+
   yarnOfflineCache = fetchYarnDeps {
     yarnLock = "${src}/yarn.lock";
     hash = "sha256-ih5NSOvYje981SkVfPHm/u2sS1B36kgxpfe9LmQaxdo=";
@@ -47,37 +53,22 @@ stdenv.mkDerivation rec {
     };
   };
 
-  configurePhase = ''
-    export HOME=$(mktemp -d)
-    yarn config --offline set yarn-offline-mirror ${yarnOfflineCache}
-    fixup_yarn_lock yarn.lock
-    yarn install --offline --frozen-lockfile --ignore-scripts --no-progress --non-interactive
-    patchShebangs node_modules/
-    yarn run postinstall --offline
-  '';
-
-  preBuild = ''
-    yarn tauri build -b deb
-  '';
-
   cargoRoot = "backend/";
-
-  preInstall = ''
-    mv backend/target/release/bundle/deb/*/data/usr/ "$out"
-  '';
+  buildAndTestDir = cargoRoot;
 
   nativeBuildInputs = [
-    cmake
     pkg-config
     perl
     rustPlatform.cargoSetupHook
     cargo
     rustc
-    cargo-tauri
+    cargo-tauri.hook
     fixup_yarn_lock
-    yarn
+    yarnConfigHook
     nodejs-slim
     cyrus_sasl
+    jq
+    moreutils # for sponge
   ];
 
   buildInputs = [

pkgs/applications/misc/meerk40t/default.nix

@@ -36,9 +36,9 @@ python3Packages.buildPythonApplication rec {
     setuptools
     wxpython
   ]
-  ++ lib.flatten (lib.attrValues passthru.optional-dependencies);
+  ++ lib.flatten (lib.attrValues optional-dependencies);
 
-  passthru.optional-dependencies = with python3Packages; {
+  optional-dependencies = with python3Packages; {
     cam = [
       opencv4
     ];

pkgs/applications/misc/mob/default.nix

@@ -9,13 +9,13 @@
 
 buildGoModule rec {
   pname = "mob";
-  version = "5.2.0";
+  version = "5.3.1";
 
   src = fetchFromGitHub {
     owner = "remotemobprogramming";
     repo = "mob";
     rev = "v${version}";
-    hash = "sha256-LktA7GMOWAl12PRLgX8VTyYZ00sh6AHsgw9NdyjAJ64=";
+    hash = "sha256-+zNlxIvIvPyz0vA9IPaMzP8wfEXwNyRcvp45ohzoxQQ=";
   };
 
   vendorHash = null;

pkgs/applications/misc/ulauncher/default.nix

@@ -121,6 +121,7 @@ python3Packages.buildPythonApplication rec {
     homepage = "https://ulauncher.io/";
     license = licenses.gpl3;
     platforms = platforms.linux;
+    mainProgram = "ulauncher";
     maintainers = with maintainers; [ aaronjanse sebtm ];
   };
 }

pkgs/applications/misc/veracrypt/default.nix

@@ -1,64 +0,0 @@
-{ lib
-, stdenv
-, fetchurl
-, pkg-config
-, makeself
-, yasm
-, fuse
-, wxGTK
-, lvm2
-, substituteAll
-, e2fsprogs
-, exfat
-, ntfs3g
-, btrfs-progs
-, pcsclite
-, wrapGAppsHook3
-}:
-
-stdenv.mkDerivation rec {
-  pname = "veracrypt";
-  version = "1.26.7";
-
-  src = fetchurl {
-    url = "https://launchpad.net/${pname}/trunk/${lib.toLower version}/+download/VeraCrypt_${version}_Source.tar.bz2";
-    sha256 = "sha256-920nsYJBTg1P2ba1n76iiyXbb6afK7z/ouwmmxqGX2U=";
-  };
-
-  patches = [
-    (substituteAll {
-      src = ./fix-paths.patch;
-      ext2 = "${e2fsprogs}/bin/mkfs.ext2";
-      ext3 = "${e2fsprogs}/bin/mkfs.ext3";
-      ext4 = "${e2fsprogs}/bin/mkfs.ext4";
-      exfat = "${exfat}/bin/mkfs.exfat";
-      ntfs = "${ntfs3g}/bin/mkfs.ntfs";
-      btrfs = "${btrfs-progs}/bin/mkfs.btrfs";
-    })
-  ];
-
-  sourceRoot = "src";
-
-  nativeBuildInputs = [ makeself pkg-config yasm wrapGAppsHook3 ];
-  buildInputs = [ fuse lvm2 wxGTK pcsclite ];
-
-  enableParallelBuilding = true;
-
-  installPhase = ''
-    install -Dm 755 Main/${pname} "$out/bin/${pname}"
-    install -Dm 444 Resources/Icons/VeraCrypt-256x256.xpm "$out/share/pixmaps/${pname}.xpm"
-    install -Dm 444 License.txt -t "$out/share/doc/${pname}/"
-    install -d $out/share/applications
-    substitute Setup/Linux/${pname}.desktop $out/share/applications/${pname}.desktop \
-      --replace "Exec=/usr/bin/veracrypt" "Exec=$out/bin/veracrypt" \
-      --replace "Icon=veracrypt" "Icon=veracrypt.xpm"
-  '';
-
-  meta = with lib; {
-    description = "Free Open-Source filesystem on-the-fly encryption";
-    homepage = "https://www.veracrypt.fr/";
-    license = with licenses; [ asl20 /* and */ unfree /* TrueCrypt License version 3.0 */ ];
-    maintainers = with maintainers; [ dsferruzza ];
-    platforms = platforms.linux;
-  };
-}

pkgs/applications/networking/browsers/microsoft-edge/default.nix

@@ -1,20 +1,20 @@
 {
   beta = import ./browser.nix {
     channel = "beta";
-    version = "129.0.2792.52";
+    version = "130.0.2849.5";
     revision = "1";
-    hash = "sha256-KurkG/OxoKOcBcFXj9xhQVSidc2L6bzrDY8c2OmSQro=";
+    hash = "sha256-chvB84+zu6/xgRHyUk33aicc44QJLxxdOOu0ngqmsFM=";
   };
   dev = import ./browser.nix {
     channel = "dev";
-    version = "130.0.2835.2";
+    version = "130.0.2849.1";
     revision = "1";
-    hash = "sha256-szxMnqw7tUvASsxsYacrQ3StofUJHBWHIhF3EfGIVAs=";
+    hash = "sha256-JObqtaaUR6J4rZ90WWw7Ku5Ntl/QBWHo23T7Ohu5p1s=";
   };
   stable = import ./browser.nix {
     channel = "stable";
-    version = "129.0.2792.52";
+    version = "129.0.2792.65";
     revision = "1";
-    hash = "sha256-tiq6PwDrH8ZctfyDza9W3WOsj7NArv4XyMPGWU7fW7A=";
+    hash = "sha256-xuCtHptE2CG4aiY7gu2sWW3Km4qfB0E/L/PBACIaKOc=";
   };
 }

pkgs/applications/networking/browsers/vivaldi/default.nix

@@ -24,7 +24,7 @@ let
   vivaldiName = if isSnapshot then "vivaldi-snapshot" else "vivaldi";
 in stdenv.mkDerivation rec {
   pname = "vivaldi";
-  version = "6.9.3447.46";
+  version = "6.9.3447.48";
 
   suffix = {
     aarch64-linux = "arm64";
@@ -34,8 +34,8 @@ in stdenv.mkDerivation rec {
   src = fetchurl {
     url = "https://downloads.vivaldi.com/${branch}/vivaldi-${branch}_${version}-1_${suffix}.deb";
     hash = {
-      aarch64-linux = "sha256-r0u7u5R0lMI65zsTxIU0y5A+swJYLAj42ptJWVvFdxs=";
-      x86_64-linux = "sha256-hIdgyh6c+SbeeT6uY1aN7OCPY+U2GGX6V7eHdwgyuzc=";
+      aarch64-linux = "sha256-pl6vZwIPqfYi/nO/PDEwUyi4CdVP9ciTAbVg0d+DX1w=";
+      x86_64-linux = "sha256-mhJCCYXP9eyA8YquSZsnm5o04VmY5NRwVM5vKqbdkZs=";
     }.${stdenv.hostPlatform.system} or (throw "Unsupported system: ${stdenv.hostPlatform.system}");
   };
 

pkgs/applications/networking/cluster/kubecolor/default.nix

@@ -1,4 +1,4 @@
-{ lib, buildGoModule, fetchFromGitHub }:
+{ lib, stdenv, buildGoModule, fetchFromGitHub, kubectl, installShellFiles }:
 
 buildGoModule rec {
   pname = "kubecolor";
@@ -19,6 +19,26 @@ buildGoModule rec {
     "."
   ];
 
+  nativeBuildInputs = [ installShellFiles ];
+
+  postInstall = lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
+    # kubecolor re-uses the completions of kubectl for its own executable
+
+    installShellCompletion --cmd kubecolor \
+      --bash <(${lib.getExe kubectl} completion bash) \
+      --fish <(${lib.getExe kubectl} completion fish) \
+      --zsh <(${lib.getExe kubectl} completion zsh)
+
+    # https://kubecolor.github.io/setup/shells/bash/
+    echo 'complete -o default -F __start_kubectl kubecolor' >> $out/share/bash-completion/completions/kubecolor.bash
+
+    # https://kubecolor.github.io/setup/shells/fish/
+    echo -e 'function kubecolor --wraps kubectl\n  command kubecolor $argv\nend' >> $out/share/fish/vendor_completions.d/kubecolor.fish
+
+    # https://kubecolor.github.io/setup/shells/zsh/
+    echo 'compdef kubecolor=kubectl' >> $out/share/zsh/site-functions/_kubecolor
+  '';
+
   meta = with lib; {
     description = "Colorizes kubectl output";
     mainProgram = "kubecolor";

pkgs/applications/networking/cluster/roxctl/default.nix

@@ -8,7 +8,7 @@ buildGoModule rec {
     owner = "stackrox";
     repo = "stackrox";
     rev = version;
-    sha256 = "sha256-dJtqUYH6TUEb3IMSzVg3NBi1UYGvUPDQUaQ9h19a3NY=";
+    sha256 = "sha256-H6pgPo2/RIpYnNOxP6PgIZhij1I45bm9DVkV2sNcW3A=";
   };
 
   vendorHash = "sha256-qDSi1Jk6erSCwPiLubdVlqOT6PQygMQghS8leieJ78s=";

pkgs/applications/networking/feedreaders/newsboat/default.nix

@@ -1,71 +0,0 @@
-{ lib, stdenv, rustPlatform, fetchFromGitHub, stfl, sqlite, curl, gettext, pkg-config, libxml2, json_c, ncurses
-, asciidoctor, libiconv, Security, Foundation, makeWrapper, nix-update-script }:
-
-rustPlatform.buildRustPackage rec {
-  pname = "newsboat";
-  version = "2.36";
-
-  src = fetchFromGitHub {
-    owner = "newsboat";
-    repo = "newsboat";
-    rev = "r${version}";
-    hash = "sha256-RnDnyRAZ71aE5st5wUcUKjFFGY288oFpiyDXAno15MQ=";
-  };
-
-  cargoHash = "sha256-0z3G8j0Qk0HEDUKA7fmjFfNW956rRtzKO+0ltNQR4es=";
-
-  # TODO: Check if that's still needed
-  postPatch = lib.optionalString stdenv.hostPlatform.isDarwin ''
-    # Allow other ncurses versions on Darwin
-    substituteInPlace config.sh \
-      --replace "ncurses5.4" "ncurses"
-  '';
-
-  nativeBuildInputs = [
-    pkg-config
-    asciidoctor
-    gettext
-  ] ++ lib.optionals stdenv.hostPlatform.isDarwin [ makeWrapper ncurses ];
-
-  buildInputs = [ stfl sqlite curl libxml2 json_c ncurses ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [ Security Foundation libiconv gettext ];
-
-  postBuild = ''
-    make -j $NIX_BUILD_CORES prefix="$out"
-  '';
-
-  # https://github.com/NixOS/nixpkgs/pull/98471#issuecomment-703100014 . We set
-  # these for all platforms, since upstream's gettext crate behavior might
-  # change in the future.
-  GETTEXT_LIB_DIR = "${lib.getLib gettext}/lib";
-  GETTEXT_INCLUDE_DIR = "${lib.getDev gettext}/include";
-  GETTEXT_BIN_DIR = "${lib.getBin gettext}/bin";
-
-  doCheck = true;
-
-  preCheck = ''
-    make -j $NIX_BUILD_CORES test
-  '';
-
-  postInstall = ''
-    make -j $NIX_BUILD_CORES prefix="$out" install
-  '' + lib.optionalString stdenv.hostPlatform.isDarwin ''
-    for prog in $out/bin/*; do
-      wrapProgram "$prog" --prefix DYLD_LIBRARY_PATH : "${stfl}/lib"
-    done
-  '';
-
-  passthru = {
-    updateScript = nix-update-script { };
-  };
-
-  meta = {
-    homepage    = "https://newsboat.org/";
-    changelog   = "https://github.com/newsboat/newsboat/blob/${src.rev}/CHANGELOG.md";
-    description = "Fork of Newsbeuter, an RSS/Atom feed reader for the text console";
-    maintainers = with lib.maintainers; [ dotlambda nicknovitski ];
-    license     = lib.licenses.mit;
-    platforms   = lib.platforms.unix;
-    mainProgram = "newsboat";
-  };
-}

pkgs/applications/networking/instant-messengers/mikutter/default.nix

@@ -1,159 +0,0 @@
-{ lib
-, stdenv
-, fetchurl
-, bundlerEnv
-, alsa-utils
-, atk
-, copyDesktopItems
-, gobject-introspection
-, gtk2
-, ruby
-, libicns
-, libnotify
-, makeDesktopItem
-, which
-, wrapGAppsHook3
-, writeText
-}:
-
-let
-  # NOTE: $out may have different values depending on context
-  mikutterPaths = rec {
-    optPrefixDir = "$out/opt/mikutter";
-    appPrefixDir = "$out/Applications/mikutter.app/Contents";
-    appBinDir = "${appPrefixDir}/MacOS";
-    appResourceDir = "${appPrefixDir}/Resources";
-    iconPath = "${optPrefixDir}/core/skin/data/icon.png";
-  };
-
-  gems = bundlerEnv {
-    name = "mikutter-gems"; # leave the version out to enable package reuse
-    gemdir = ./deps;
-    groups = [ "default" "plugin" ];
-    inherit ruby;
-
-    # Avoid the following error:
-    # > `<module:Moneta>': uninitialized constant Moneta::Builder (NameError)
-    #
-    # Related:
-    # https://github.com/NixOS/nixpkgs/pull/76510
-    # https://github.com/NixOS/nixpkgs/pull/76765
-    # https://github.com/NixOS/nixpkgs/issues/83442
-    # https://github.com/NixOS/nixpkgs/issues/106545
-    copyGemFiles = true;
-  };
-
-  mkDesktopItem = { description }:
-    makeDesktopItem {
-      name = "mikutter";
-      desktopName = "mikutter";
-      exec = "mikutter";
-      icon = "mikutter";
-      categories = [ "Network" ];
-      comment = description;
-      keywords = [ "Mastodon" ];
-    };
-
-  mkInfoPlist = { version }:
-    writeText "Info.plist" (lib.generators.toPlist { } {
-      CFBundleName = "mikutter";
-      CFBundleDisplayName = "mikutter";
-      CFBundleExecutable = "mikutter";
-      CFBundleIconFile = "mikutter";
-      CFBundleIdentifier = "net.hachune.mikutter";
-      CFBundleInfoDictionaryVersion = "6.0";
-      CFBundlePackageType = "APPL";
-      CFBundleVersion = version;
-      CFBundleShortVersionString = version;
-    });
-
-  inherit (gems) wrappedRuby;
-in
-with mikutterPaths; stdenv.mkDerivation rec {
-  pname = "mikutter";
-  version = "4.1.4";
-
-  src = fetchurl {
-    url = "https://mikutter.hachune.net/bin/mikutter-${version}.tar.gz";
-    sha256 = "05253nz4i1lmnq6czj48qdab2ny4vx2mznj6nsn2l1m2z6zqkwk3";
-  };
-
-  nativeBuildInputs = [ copyDesktopItems wrapGAppsHook3 gobject-introspection ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [ libicns ];
-  buildInputs = [
-    atk
-    gtk2
-    libnotify
-    which # some plugins use it at runtime
-    wrappedRuby
-  ] ++ lib.optionals stdenv.hostPlatform.isLinux [ alsa-utils ];
-
-  scriptPath = lib.makeBinPath (
-    [ wrappedRuby libnotify which ]
-    ++ lib.optionals stdenv.hostPlatform.isLinux [ alsa-utils ]
-  );
-
-  postUnpack = ''
-    rm -rf vendor
-  '';
-
-  installPhase = ''
-    runHook preInstall
-
-    mkdir -p $out/bin ${optPrefixDir}
-
-    install -Dm644 README $out/share/doc/mikutter/README
-    install -Dm644 LICENSE $out/share/doc/mikutter/LICENSE
-    rm -r README LICENSE deployment
-
-    cp -r . ${optPrefixDir}
-
-    gappsWrapperArgsHook # FIXME: currently runs at preFixup
-    wrapGApp ${optPrefixDir}/mikutter.rb \
-      --prefix PATH : "${scriptPath}" \
-      --set DISABLE_BUNDLER_SETUP 1
-    mv ${optPrefixDir}/mikutter.rb $out/bin/mikutter
-
-    install -Dm644 ${iconPath} $out/share/icons/hicolor/256x256/apps/mikutter.png
-
-    runHook postInstall
-  '';
-
-  postInstall =
-    let
-      infoPlist = mkInfoPlist { inherit version; };
-    in
-    lib.optionalString stdenv.hostPlatform.isDarwin ''
-      mkdir -p ${appBinDir} ${appResourceDir}
-      install -Dm644 ${infoPlist} ${appPrefixDir}/Info.plist
-      ln -s $out/bin/mikutter ${appBinDir}/mikutter
-      png2icns ${appResourceDir}/mikutter.icns ${iconPath}
-    '';
-
-  installCheckPhase = ''
-    runHook preInstallCheck
-
-    testDir="$(mktemp -d)"
-    install -Dm644 ${./test_plugin.rb} "$testDir/plugin/test_plugin/test_plugin.rb"
-
-    $out/bin/mikutter --confroot="$testDir" --plugin=test_plugin --debug
-
-    runHook postInstallCheck
-  '';
-
-  desktopItems = [
-    (mkDesktopItem { inherit (meta) description; })
-  ];
-
-  doInstallCheck = true;
-  dontWrapGApps = true; # the target is placed outside of bin/
-
-  passthru.updateScript = [ ./update.sh version (toString ./.) ];
-
-  meta = with lib; {
-    description = "An extensible Mastodon client";
-    homepage = "https://mikutter.hachune.net";
-    platforms = ruby.meta.platforms;
-    license = licenses.mit;
-  };
-}

pkgs/applications/networking/instant-messengers/mikutter/deps/Gemfile

@@ -1,39 +0,0 @@
-alias __source_distinct__ source
-def source(url)
-  @loaded ||= {}
-  unless @loaded[url]
-    @loaded[url] = true
-    __source_distinct__(url) end end
-
-source 'https://rubygems.org'
-
-ruby '>= 2.5.0'
-
-group :default do
-  gem 'addressable','>= 2.7.0', '< 2.8'
-  gem 'delayer','>= 1.1.2', '< 2.0'
-  gem 'delayer-deferred','>= 2.2.0', '< 3.0'
-  gem 'diva','>= 1.0.2', '< 2.0'
-  gem 'memoist','>= 0.16.2', '< 0.17'
-  gem 'oauth','>= 0.5.4'
-  gem 'pluggaloid','>= 1.5.0', '< 2.0'
-  gem 'typed-array','>= 0.1.2', '< 0.2'
-end
-
-group :test do
-  gem 'test-unit','>= 3.3.4', '< 4.0'
-  gem 'rake','>= 13.0.1'
-  gem 'mocha','>= 1.11.1'
-  gem 'webmock','>= 3.7.6'
-  gem 'ruby-prof','>= 1.1.0'
-end
-
-
-group :plugin do
-  Dir.glob(File.expand_path(File.join(__dir__, 'plugin/*/Gemfile'))){ |path|
-    eval File.open(path).read
-  }
-  Dir.glob(File.join(File.expand_path(ENV['MIKUTTER_CONFROOT'] || '~/.mikutter'), 'plugin/*/Gemfile')){ |path|
-    eval File.open(path).read
-  }
-end

pkgs/applications/networking/instant-messengers/mikutter/deps/Gemfile.lock

@@ -1,101 +0,0 @@
-GEM
-  remote: https://rubygems.org/
-  specs:
-    addressable (2.7.0)
-      public_suffix (>= 2.0.2, < 5.0)
-    atk (3.4.1)
-      glib2 (= 3.4.1)
-    cairo (1.17.5)
-      native-package-installer (>= 1.0.3)
-      pkg-config (>= 1.2.2)
-      red-colors
-    cairo-gobject (3.4.1)
-      cairo (>= 1.16.2)
-      glib2 (= 3.4.1)
-    crack (0.4.5)
-      rexml
-    delayer (1.2.0)
-    delayer-deferred (2.2.0)
-      delayer (>= 1.1.2, < 2.0)
-    diva (1.0.2)
-      addressable (>= 2.5.2, < 2.8)
-    gdk_pixbuf2 (3.4.1)
-      gio2 (= 3.4.1)
-    gettext (3.3.7)
-      locale (>= 2.0.5)
-      text (>= 1.3.0)
-    gio2 (3.4.1)
-      gobject-introspection (= 3.4.1)
-    glib2 (3.4.1)
-      native-package-installer (>= 1.0.3)
-      pkg-config (>= 1.3.5)
-    gobject-introspection (3.4.1)
-      glib2 (= 3.4.1)
-    gtk2 (3.4.1)
-      atk (= 3.4.1)
-      gdk_pixbuf2 (= 3.4.1)
-      pango (= 3.4.1)
-    hashdiff (1.0.1)
-    httpclient (2.8.3)
-    instance_storage (1.0.0)
-    locale (2.1.3)
-    memoist (0.16.2)
-    mini_portile2 (2.5.0)
-    mocha (1.12.0)
-    moneta (1.4.1)
-    native-package-installer (1.1.1)
-    nokogiri (1.11.3)
-      mini_portile2 (~> 2.5.0)
-      racc (~> 1.4)
-    oauth (0.5.6)
-    pango (3.4.1)
-      cairo-gobject (= 3.4.1)
-      gobject-introspection (= 3.4.1)
-    pkg-config (1.4.6)
-    pluggaloid (1.5.0)
-      delayer (>= 1.1.0, < 2.0)
-      instance_storage (>= 1.0.0, < 2.0.0)
-    power_assert (2.0.0)
-    public_suffix (4.0.6)
-    racc (1.5.2)
-    rake (13.0.3)
-    red-colors (0.1.1)
-    rexml (3.2.5)
-    ruby-prof (1.4.3)
-    test-unit (3.4.0)
-      power_assert
-    text (1.3.1)
-    typed-array (0.1.2)
-    webmock (3.12.2)
-      addressable (>= 2.3.6)
-      crack (>= 0.3.2)
-      hashdiff (>= 0.4.0, < 2.0.0)
-
-PLATFORMS
-  ruby
-
-DEPENDENCIES
-  addressable (>= 2.7.0, < 2.8)
-  delayer (>= 1.1.2, < 2.0)
-  delayer-deferred (>= 2.2.0, < 3.0)
-  diva (>= 1.0.2, < 2.0)
-  gettext (>= 3.3.5, < 3.4)
-  gtk2 (= 3.4.1)
-  httpclient
-  memoist (>= 0.16.2, < 0.17)
-  mocha (>= 1.11.1)
-  moneta
-  nokogiri
-  oauth (>= 0.5.4)
-  pluggaloid (>= 1.5.0, < 2.0)
-  rake (>= 13.0.1)
-  ruby-prof (>= 1.1.0)
-  test-unit (>= 3.3.4, < 4.0)
-  typed-array (>= 0.1.2, < 0.2)
-  webmock (>= 3.7.6)
-
-RUBY VERSION
-   ruby 2.6.6p146
-
-BUNDLED WITH
-   2.1.4

pkgs/applications/networking/instant-messengers/mikutter/deps/gemset.nix

@@ -1,410 +0,0 @@
-{
-  addressable = {
-    dependencies = ["public_suffix"];
-    groups = ["default" "test"];
-    platforms = [];
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "1fvchp2rhp2rmigx7qglf69xvjqvzq7x0g49naliw29r2bz656sy";
-      type = "gem";
-    };
-    version = "2.7.0";
-  };
-  atk = {
-    dependencies = ["glib2"];
-    groups = ["default" "plugin"];
-    platforms = [];
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "0a8q9a1f6x4gy55p8cf52a22bnpjgn18ad9n959x0f4gybbhs948";
-      type = "gem";
-    };
-    version = "3.4.1";
-  };
-  cairo = {
-    dependencies = ["native-package-installer" "pkg-config" "red-colors"];
-    groups = ["default" "plugin"];
-    platforms = [];
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "0vbj9szp2xbnxqan8hppip8vm9fxpcmpx745y5fvg2scdh9f0p7s";
-      type = "gem";
-    };
-    version = "1.17.5";
-  };
-  cairo-gobject = {
-    dependencies = ["cairo" "glib2"];
-    groups = ["default" "plugin"];
-    platforms = [];
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "0gkxdfslcvrwrs48giilji3bgxd5bwijwq33p9h00r10jzfg2028";
-      type = "gem";
-    };
-    version = "3.4.1";
-  };
-  crack = {
-    dependencies = ["rexml"];
-    groups = ["default" "test"];
-    platforms = [];
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "1cr1kfpw3vkhysvkk3wg7c54m75kd68mbm9rs5azdjdq57xid13r";
-      type = "gem";
-    };
-    version = "0.4.5";
-  };
-  delayer = {
-    groups = ["default"];
-    platforms = [];
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "0iqf4i18i8rk3x7qgvkhbiqskf0xzdf733fjimrq6xkag2mq60bl";
-      type = "gem";
-    };
-    version = "1.2.0";
-  };
-  delayer-deferred = {
-    dependencies = ["delayer"];
-    groups = ["default"];
-    platforms = [];
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "0i2das3ncssacpqdgaf4as77vrxm7jfiizaja884fqv4rzv6s2sv";
-      type = "gem";
-    };
-    version = "2.2.0";
-  };
-  diva = {
-    dependencies = ["addressable"];
-    groups = ["default"];
-    platforms = [];
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "05wl4wg57vvng4nrp4lzjq148v908xzq092kq93phwvyxs7jnw2g";
-      type = "gem";
-    };
-    version = "1.0.2";
-  };
-  gdk_pixbuf2 = {
-    dependencies = ["gio2"];
-    groups = ["default" "plugin"];
-    platforms = [];
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "0194gzn0kialfh0j7crllvp808r64sg6dh297x69b0av21ar5pam";
-      type = "gem";
-    };
-    version = "3.4.1";
-  };
-  gettext = {
-    dependencies = ["locale" "text"];
-    groups = ["default" "plugin"];
-    platforms = [];
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "1fqlwq7i8ck1fjyhn19q3skvgrbz44q7gq51mlr0qym5rkj5f6rn";
-      type = "gem";
-    };
-    version = "3.3.7";
-  };
-  gio2 = {
-    dependencies = ["gobject-introspection"];
-    groups = ["default" "plugin"];
-    platforms = [];
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "1l3jpgbdvb55xhcmpkcqgwx5068dfyi8kijfvzhbqh96ng0p1m7g";
-      type = "gem";
-    };
-    version = "3.4.1";
-  };
-  glib2 = {
-    dependencies = ["native-package-installer" "pkg-config"];
-    groups = ["default" "plugin"];
-    platforms = [];
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "18clyn0fp0h5alnkf9i2bqd6wvl78h468pdbzs1csqnba8vw4q1c";
-      type = "gem";
-    };
-    version = "3.4.1";
-  };
-  gobject-introspection = {
-    dependencies = ["glib2"];
-    groups = ["default" "plugin"];
-    platforms = [];
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "1a3x8qiisbax3x0izj8l5w66r53ba5ma53ax2jhdbhbvaxx3d02n";
-      type = "gem";
-    };
-    version = "3.4.1";
-  };
-  gtk2 = {
-    dependencies = ["atk" "gdk_pixbuf2" "pango"];
-    groups = ["plugin"];
-    platforms = [];
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "17az8g0n1yzz90kdbjg2hpabi04qccda7v6lin76bs637ivfg2md";
-      type = "gem";
-    };
-    version = "3.4.1";
-  };
-  hashdiff = {
-    groups = ["default" "test"];
-    platforms = [];
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "1nynpl0xbj0nphqx1qlmyggq58ms1phf5i03hk64wcc0a17x1m1c";
-      type = "gem";
-    };
-    version = "1.0.1";
-  };
-  httpclient = {
-    groups = ["plugin"];
-    platforms = [];
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "19mxmvghp7ki3klsxwrlwr431li7hm1lczhhj8z4qihl2acy8l99";
-      type = "gem";
-    };
-    version = "2.8.3";
-  };
-  instance_storage = {
-    groups = ["default"];
-    platforms = [];
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "08nf5fhq9dckq9lmaklxydq0hrlfi7phk66gr3bggxg45zd687pl";
-      type = "gem";
-    };
-    version = "1.0.0";
-  };
-  locale = {
-    groups = ["default" "plugin"];
-    platforms = [];
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "0997465kxvpxm92fiwc2b16l49mngk7b68g5k35ify0m3q0yxpdn";
-      type = "gem";
-    };
-    version = "2.1.3";
-  };
-  memoist = {
-    groups = ["default"];
-    platforms = [];
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "0i9wpzix3sjhf6d9zw60dm4371iq8kyz7ckh2qapan2vyaim6b55";
-      type = "gem";
-    };
-    version = "0.16.2";
-  };
-  mini_portile2 = {
-    groups = ["default" "plugin"];
-    platforms = [];
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "1hdbpmamx8js53yk3h8cqy12kgv6ca06k0c9n3pxh6b6cjfs19x7";
-      type = "gem";
-    };
-    version = "2.5.0";
-  };
-  mocha = {
-    groups = ["test"];
-    platforms = [];
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "05yw6rwgjppq116jgqfg4pv4bql3ci4r2fmmg0m2c3sqib1bq41a";
-      type = "gem";
-    };
-    version = "1.12.0";
-  };
-  moneta = {
-    groups = ["plugin"];
-    platforms = [];
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "0z25b4yysvnf2hi9jxnsiv3fvnicnzr2m70ci231av5093jfknc6";
-      type = "gem";
-    };
-    version = "1.4.1";
-  };
-  native-package-installer = {
-    groups = ["default" "plugin"];
-    platforms = [];
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "1ww1mq41q7rda975byjmq5dk8k13v8dawvm33370pbkrymd8syp8";
-      type = "gem";
-    };
-    version = "1.1.1";
-  };
-  nokogiri = {
-    dependencies = ["mini_portile2" "racc"];
-    groups = ["plugin"];
-    platforms = [];
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "19d78mdg2lbz9jb4ph6nk783c9jbsdm8rnllwhga6pd53xffp6x0";
-      type = "gem";
-    };
-    version = "1.11.3";
-  };
-  oauth = {
-    groups = ["default"];
-    platforms = [];
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "1zwd6v39yqfdrpg1p3d9jvzs9ljg55ana2p06m0l7qn5w0lgx1a0";
-      type = "gem";
-    };
-    version = "0.5.6";
-  };
-  pango = {
-    dependencies = ["cairo-gobject" "gobject-introspection"];
-    groups = ["default" "plugin"];
-    platforms = [];
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "1d0cn50qgpifrcv8qx72wi6l9xalw3ryngbfmm9xpg9vx5rl1qbp";
-      type = "gem";
-    };
-    version = "3.4.1";
-  };
-  pkg-config = {
-    groups = ["default" "plugin"];
-    platforms = [];
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "1mjjy1grxr64znkffxsvprcckbrrnm40b6gbllnbm7jxslbr3gjl";
-      type = "gem";
-    };
-    version = "1.4.6";
-  };
-  pluggaloid = {
-    dependencies = ["delayer" "instance_storage"];
-    groups = ["default"];
-    platforms = [];
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "0m3f940lf1bg01jin22by7hg9hs43y995isgcyqb6vbvlv51zj11";
-      type = "gem";
-    };
-    version = "1.5.0";
-  };
-  power_assert = {
-    groups = ["default" "test"];
-    platforms = [];
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "172qfmzwxdf82bmwgcb13hnz9i3p6i2s2nijxnx6r63kn3drjppr";
-      type = "gem";
-    };
-    version = "2.0.0";
-  };
-  public_suffix = {
-    groups = ["default" "test"];
-    platforms = [];
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "1xqcgkl7bwws1qrlnmxgh8g4g9m10vg60bhlw40fplninb3ng6d9";
-      type = "gem";
-    };
-    version = "4.0.6";
-  };
-  racc = {
-    groups = ["default" "plugin"];
-    platforms = [];
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "178k7r0xn689spviqzhvazzvxfq6fyjldxb3ywjbgipbfi4s8j1g";
-      type = "gem";
-    };
-    version = "1.5.2";
-  };
-  rake = {
-    groups = ["test"];
-    platforms = [];
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "1iik52mf9ky4cgs38fp2m8r6skdkq1yz23vh18lk95fhbcxb6a67";
-      type = "gem";
-    };
-    version = "13.0.3";
-  };
-  red-colors = {
-    groups = ["default" "plugin"];
-    platforms = [];
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "0ar2k7zvhr1215jx5di29hkg5h1798f1gypmq6v0sy9v35w6ijca";
-      type = "gem";
-    };
-    version = "0.1.1";
-  };
-  rexml = {
-    groups = ["default" "test"];
-    platforms = [];
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "08ximcyfjy94pm1rhcx04ny1vx2sk0x4y185gzn86yfsbzwkng53";
-      type = "gem";
-    };
-    version = "3.2.5";
-  };
-  ruby-prof = {
-    groups = ["test"];
-    platforms = [];
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "1r3xalp91l07m0cwllcxjzg6nkviiqnxkcbgg5qnzsdji6rgy65m";
-      type = "gem";
-    };
-    version = "1.4.3";
-  };
-  test-unit = {
-    dependencies = ["power_assert"];
-    groups = ["test"];
-    platforms = [];
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "1h0c323zfn4hdida4g58h8wnlh4kax438gyxlw20dd78kcp01i8m";
-      type = "gem";
-    };
-    version = "3.4.0";
-  };
-  text = {
-    groups = ["default" "plugin"];
-    platforms = [];
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "1x6kkmsr49y3rnrin91rv8mpc3dhrf3ql08kbccw8yffq61brfrg";
-      type = "gem";
-    };
-    version = "1.3.1";
-  };
-  typed-array = {
-    groups = ["default"];
-    platforms = [];
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "0qlv2rnkin9rwkgjx3k5qvc17m0m7jf5cdirw3wxbjnw5kga27w9";
-      type = "gem";
-    };
-    version = "0.1.2";
-  };
-  webmock = {
-    dependencies = ["addressable" "crack" "hashdiff"];
-    groups = ["test"];
-    platforms = [];
-    source = {
-      remotes = ["https://rubygems.org"];
-      sha256 = "038igpmkpmn0nw0k7s4db8x88af1nwcy7wzh9m9c9q4p74h7rii0";
-      type = "gem";
-    };
-    version = "3.12.2";
-  };
-}

pkgs/applications/networking/instant-messengers/mikutter/deps/plugin/gtk/Gemfile

@@ -1,4 +0,0 @@
-source 'https://rubygems.org'
-
-gem 'gtk2', '3.4.1'
-

pkgs/applications/networking/instant-messengers/mikutter/deps/plugin/image_file_cache/Gemfile

@@ -1 +0,0 @@
-gem 'moneta'

pkgs/applications/networking/instant-messengers/mikutter/deps/plugin/photo_support/Gemfile

@@ -1,4 +0,0 @@
-source 'https://rubygems.org'
-
-gem 'nokogiri'
-gem 'httpclient'

pkgs/applications/networking/instant-messengers/mikutter/deps/plugin/uitranslator/Gemfile

@@ -1,5 +0,0 @@
-source 'https://rubygems.org'
-
-group :default do
-  gem 'gettext', '>= 3.3.5', '< 3.4'
-end

pkgs/applications/networking/instant-messengers/mikutter/test_plugin.rb

@@ -1,10 +0,0 @@
-# Tests mikutter's event system.
-
-Plugin.create(:test_plugin) do
-  require 'logger'
-  Delayer.new do
-    log = Logger.new(STDOUT)
-    log.info("loaded test_plugin")
-    exit
-  end
-end

pkgs/applications/networking/instant-messengers/mikutter/update.sh

@@ -1,51 +0,0 @@
-#!/usr/bin/env nix-shell
-#!nix-shell -i bash -p bundler bundix curl jq common-updater-scripts
-# shellcheck shell=bash
-
-set -euo pipefail
-
-main() {
-    local currentVer="$1"
-    local scriptDir="$2"
-    local latestVer
-    local srcDir
-
-    if [[ -z "$UPDATE_NIX_ATTR_PATH" ]]; then
-        echo "[ERROR] Please run the following instead:" >&2
-        echo >&2
-        echo "    % nix-shell maintainers/scripts/update.nix --argstr path mikutter" >&2
-        exit 1
-    fi
-
-    latestVer="$(queryLatestVersion)"
-    if [[ "$currentVer" == "$latestVer" ]]; then
-        echo "[INFO] mikutter is already up to date" >&2
-        exit
-    fi
-
-    update-source-version "$UPDATE_NIX_ATTR_PATH" "$latestVer"
-
-    cd "$scriptDir"
-
-    rm -rf deps
-    mkdir deps
-    cd deps
-
-    srcDir="$(nix-build ../../../../../.. --no-out-link -A mikutter.src)"
-    tar xvf "$srcDir" --strip-components=1
-    find . -not -name Gemfile -exec rm {} \;
-    find . -type d -exec rmdir -p --ignore-fail-on-non-empty {} \; || true
-
-    bundle lock
-    bundix
-}
-
-queryLatestVersion() {
-    curl -sS 'https://mikutter.hachune.net/download.json?count=1' \
-        | jq -r '.[].version_string' \
-        | head -n1
-}
-
-main "$@"
-
-# vim:set ft=bash:

pkgs/applications/networking/instant-messengers/signalbackup-tools/default.nix

@@ -14,13 +14,13 @@
 
 stdenv.mkDerivation rec {
   pname = "signalbackup-tools";
-  version = "20240924-2";
+  version = "20240929";
 
   src = fetchFromGitHub {
     owner = "bepaald";
     repo = "signalbackup-tools";
     rev = version;
-    hash = "sha256-YnblQjZpKsnphbaRQ6FyHhssnns7U5VoNe/r3goQ0g8=";
+    hash = "sha256-OXn/RMc2v099S8/atQTYz1YwSH0sD7o7ZImlrBmUlSE=";
   };
 
   nativeBuildInputs = [

pkgs/applications/networking/ktailctl/default.nix

@@ -23,13 +23,13 @@
 }:
 
 let
-  version = "0.18.0";
+  version = "0.18.1";
 
   src = fetchFromGitHub {
     owner = "f-koehler";
     repo = "KTailctl";
     rev = "v${version}";
-    hash = "sha256-tZnwn94qZyQ8JAC6Y1dDTmc7Cob+kMZnEaP7+EytbH8=";
+    hash = "sha256-hlpxim4Vm/C37ts+Q/t9swCejKEE97R1QlP+Y2jNWoM=";
   };
 
   goDeps = (buildGo123Module {

pkgs/applications/networking/mailreaders/betterbird/default.nix

@@ -112,6 +112,8 @@ in ((buildMozillaMach {
   webrtcSupport = false;
 
   pgoSupport = false; # console.warn: feeds: "downloadFeed: network connection unavailable"
+
+  inherit (thunderbird-unwrapped.passthru) icu73;
 }).overrideAttrs (oldAttrs: {
   postInstall = oldAttrs.postInstall or "" + ''
     mv $out/lib/thunderbird/* $out/lib/betterbird

pkgs/applications/networking/mailreaders/thunderbird/packages.nix

@@ -1,6 +1,17 @@
-{ stdenv, lib, buildMozillaMach, callPackage, fetchurl, fetchpatch, nixosTests, icu73, fetchpatch2, config }:
+{ stdenv, lib, buildMozillaMach, callPackage, fetchurl, icu73, fetchpatch2, config }:
 
 let
+  icu73' = icu73.overrideAttrs (attrs: {
+    # standardize vtzone output
+    # Work around ICU-22132 https://unicode-org.atlassian.net/browse/ICU-22132
+    # https://bugzilla.mozilla.org/show_bug.cgi?id=1790071
+    patches = attrs.patches ++ [(fetchpatch2 {
+      url = "https://hg.mozilla.org/mozilla-central/raw-file/fb8582f80c558000436922fb37572adcd4efeafc/intl/icu-patches/bug-1790071-ICU-22132-standardize-vtzone-output.diff";
+      stripLen = 3;
+      hash = "sha256-MGNnWix+kDNtLuACrrONDNcFxzjlUcLhesxwVZFzPAM=";
+    })];
+  });
+
   common = { version, sha512, updateScript }: (buildMozillaMach rec {
     pname = "thunderbird";
     inherit version updateScript;
@@ -16,6 +27,10 @@ let
       ./no-buildconfig.patch
     ];
 
+    extraPassthru = {
+      icu73 = icu73';
+    };
+
     meta = with lib; {
       changelog = "https://www.thunderbird.net/en-US/thunderbird/${version}/releasenotes/";
       description = "Full-featured e-mail client";
@@ -34,16 +49,7 @@ let
 
     pgoSupport = false; # console.warn: feeds: "downloadFeed: network connection unavailable"
 
-    icu73 = icu73.overrideAttrs (attrs: {
-      # standardize vtzone output
-      # Work around ICU-22132 https://unicode-org.atlassian.net/browse/ICU-22132
-      # https://bugzilla.mozilla.org/show_bug.cgi?id=1790071
-      patches = attrs.patches ++ [(fetchpatch2 {
-        url = "https://hg.mozilla.org/mozilla-central/raw-file/fb8582f80c558000436922fb37572adcd4efeafc/intl/icu-patches/bug-1790071-ICU-22132-standardize-vtzone-output.diff";
-        stripLen = 3;
-        hash = "sha256-MGNnWix+kDNtLuACrrONDNcFxzjlUcLhesxwVZFzPAM=";
-      })];
-    });
+    icu73 = icu73';
   };
 
 in rec {

pkgs/applications/networking/nextcloud-client/default.nix

@@ -26,7 +26,7 @@
 
 stdenv.mkDerivation rec {
   pname = "nextcloud-client";
-  version = "3.14.0";
+  version = "3.14.1";
 
   outputs = [ "out" "dev" ];
 
@@ -34,7 +34,7 @@ stdenv.mkDerivation rec {
     owner = "nextcloud-releases";
     repo = "desktop";
     rev = "refs/tags/v${version}";
-    hash = "sha256-/jRD0swNs59xugsXLbesGcTtyGdc/y/iwiDVoErW+d4=";
+    hash = "sha256-bUqHegW38NQJn4TnEQt9wRJFqR6fbLpvQvmWF3akekc=";
   };
 
   patches = [

pkgs/applications/office/gnote/default.nix

@@ -19,11 +19,11 @@
 
 stdenv.mkDerivation rec {
   pname = "gnote";
-  version = "46.1";
+  version = "47.0";
 
   src = fetchurl {
     url = "mirror://gnome/sources/${pname}/${lib.versions.major version}/${pname}-${version}.tar.xz";
-    hash = "sha256-47v3A6WPgI3Fd9WiVsF3wYkHC5KPS9WSltDA3SXz2pk=";
+    hash = "sha256-vrNcreIMYOQxVRbyCsfr7p37wrgPAHy+2LxaUlIuRC4=";
   };
 
   buildInputs = [

pkgs/applications/science/logic/alt-ergo/default.nix

@@ -2,11 +2,11 @@
 
 let
   pname = "alt-ergo";
-  version = "2.5.4";
+  version = "2.6.0";
 
   src = fetchurl {
     url = "https://github.com/OCamlPro/alt-ergo/releases/download/v${version}/alt-ergo-${version}.tbz";
-    hash = "sha256-AsHok5i62vqJ5hK8XRiD8hM6JQaFv3dMxZAcVYEim6w=";
+    hash = "sha256-EmkxGvJSeKRmiSuoeMyIi6WfF39T3QPxKixiOwP8834=";
   };
 in
 
@@ -14,7 +14,17 @@ let alt-ergo-lib = ocamlPackages.buildDunePackage rec {
   pname = "alt-ergo-lib";
   inherit version src;
   buildInputs = with ocamlPackages; [ ppx_blob ];
-  propagatedBuildInputs = with ocamlPackages; [ camlzip dolmen_loop dune-build-info fmt ocplib-simplex seq stdlib-shims zarith ];
+  propagatedBuildInputs = with ocamlPackages; [
+    camlzip
+    dolmen_loop
+    dune-build-info
+    fmt
+    ocplib-simplex
+    ppx_deriving
+    seq
+    stdlib-shims
+    zarith
+  ];
 }; in
 
 let alt-ergo-parsers = ocamlPackages.buildDunePackage rec {
@@ -29,7 +39,17 @@ ocamlPackages.buildDunePackage {
   inherit pname version src;
 
   nativeBuildInputs = [ ocamlPackages.menhir ] ++ lib.optionals stdenv.hostPlatform.isDarwin [ darwin.sigtool ];
-  buildInputs = [ alt-ergo-parsers ] ++ (with ocamlPackages; [ cmdliner dune-site ]);
+  propagatedBuildInputs = [ alt-ergo-parsers ] ++ (with ocamlPackages; [ cmdliner dune-site ppxlib ]);
+
+  outputs = [ "bin" "out" ];
+
+  installPhase = ''
+    runHook preInstall
+    dune install --prefix $bin ${pname}
+    mkdir -p $out/lib/ocaml/${ocamlPackages.ocaml.version}/site-lib
+    mv $bin/lib/alt-ergo $out/lib/ocaml/${ocamlPackages.ocaml.version}/site-lib/
+    runHook postInstall
+  '';
 
   meta = {
     description = "High-performance theorem prover and SMT solver";

pkgs/applications/science/logic/dafny/default.nix

@@ -8,13 +8,13 @@
 
 buildDotnetModule rec {
   pname = "Dafny";
-  version = "4.7.0";
+  version = "4.8.0";
 
   src = fetchFromGitHub {
     owner = "dafny-lang";
     repo = "dafny";
     rev = "v${version}";
-    hash = "sha256-XoSk08TVv17YyuTsRJ25e6bwSwKIF2+HjF5nFaul8+M=";
+    hash = "sha256-x/fX4o+R72Pl02u1Zsr80Rh/4Wb/aKw90fhAGmsfFUI=";
   };
 
   postPatch =

pkgs/applications/science/logic/dafny/deps.nix

@@ -2,181 +2,174 @@
 # Please dont edit it manually, your changes might get overwritten!
 
 { fetchNuGet }: [
-  (fetchNuGet { pname = "Boogie"; version = "3.1.3"; sha256 = "0xzc7s0rjb8dhdkdf71g6pdsnyhbl534xpwd8gbx6g16a87iqx6i"; })
-  (fetchNuGet { pname = "Boogie.AbstractInterpretation"; version = "3.1.6"; sha256 = "1c6z13dz0sbkmk4ay64aihy7s7xlfdvhpcknxhw1m1b0yly5qj6b"; })
-  (fetchNuGet { pname = "Boogie.BaseTypes"; version = "3.1.6"; sha256 = "1hxcpc45f32g3jpaw7mg6k9qsppcb3p20wxv4d4dc3nz0r52lrmr"; })
-  (fetchNuGet { pname = "Boogie.CodeContractsExtender"; version = "3.1.6"; sha256 = "1qk7w7c40fpkvvarbgi1bkdcxpn12r0lqngpwwjw8i7nk84ni5gl"; })
-  (fetchNuGet { pname = "Boogie.Concurrency"; version = "3.1.6"; sha256 = "11981gfa0n4s214yilnxqhh1clr4l78iqlws6gv01z1n6rxgbyla"; })
-  (fetchNuGet { pname = "Boogie.Core"; version = "3.1.6"; sha256 = "0sgj6i1hvp90g2zfqs1aly500xnv3fq9d4cfgii5kpza8vgm7w4g"; })
-  (fetchNuGet { pname = "Boogie.ExecutionEngine"; version = "3.1.6"; sha256 = "08vxxwcnkykcngihkp0bvfwkgwxb3nnqjp5f1vz4bnw708xs0ydg"; })
-  (fetchNuGet { pname = "Boogie.Graph"; version = "3.1.6"; sha256 = "0fzj65pnky8i83jj2h9nszij25a46z68fy2sm3pxwlg678nmx2jz"; })
-  (fetchNuGet { pname = "Boogie.Houdini"; version = "3.1.6"; sha256 = "0lfljb9brnr79hp1f0ff6fcy51ml66pjj102jk4pqpmsjwvcjx43"; })
-  (fetchNuGet { pname = "Boogie.Model"; version = "3.1.6"; sha256 = "0546b27mxv97v7qilb1carbwip0q7sz9zz7sxizpww6yc3j8w8if"; })
-  (fetchNuGet { pname = "Boogie.Provers.LeanAuto"; version = "3.1.6"; sha256 = "1x1f35g0kxzhxvw4icmbvkik16py47j6h04gj0ckwbny9qmglaby"; })
-  (fetchNuGet { pname = "Boogie.Provers.SMTLib"; version = "3.1.6"; sha256 = "0mqlpwfxgv9dd773254rrbgbjb5mpa3xkvlq32ml752h36j8m2r9"; })
-  (fetchNuGet { pname = "Boogie.VCExpr"; version = "3.1.6"; sha256 = "0p7axpjn4qg191bs7b33zf9l336bdznvxp3305z2ssnkakjx247h"; })
-  (fetchNuGet { pname = "Boogie.VCGeneration"; version = "3.1.6"; sha256 = "05z2lr92hbllikv65gh7m3i879fnn6pjn2acf133sijx9b1jixdb"; })
-  (fetchNuGet { pname = "CocoR"; version = "2014.12.24"; sha256 = "0ps8h7aawkcc1910qnh13llzb01pvgsjmg862pxp0p4wca2dn7a2"; })
-  (fetchNuGet { pname = "JetBrains.Annotations"; version = "2021.1.0"; sha256 = "07pnhxxlgx8spmwmakz37nmbvgyb6yjrbrhad5rrn6y767z5r1gb"; })
-  (fetchNuGet { pname = "MediatR"; version = "8.1.0"; sha256 = "0cqx7yfh998xhsfk5pr6229lcjcs1jxxyqz7dwskc9jddl6a2akp"; })
-  (fetchNuGet { pname = "Microsoft.Bcl.AsyncInterfaces"; version = "1.1.1"; sha256 = "0a1ahssqds2ympr7s4xcxv5y8jgxs7ahd6ah6fbgglj4rki1f1vw"; })
-  (fetchNuGet { pname = "Microsoft.Bcl.AsyncInterfaces"; version = "6.0.0"; sha256 = "15gqy2m14fdlvy1g59207h5kisznm355kbw010gy19vh47z8gpz3"; })
-  (fetchNuGet { pname = "Microsoft.CodeAnalysis.Analyzers"; version = "3.0.0"; sha256 = "0bbl0jpqywqmzz2gagld1p2gvdfldjfjmm25hil9wj2nq1zc4di8"; })
-  (fetchNuGet { pname = "Microsoft.CodeAnalysis.Common"; version = "3.7.0"; sha256 = "0882492nx6x68b0pkh3q5xaawz0b2l5x35r40722ignyjnvjydph"; })
-  (fetchNuGet { pname = "Microsoft.CodeAnalysis.CSharp"; version = "3.7.0"; sha256 = "0adw6rcag8wxydzyiyhls2mxaqkay5qlz25z1fxrlv5qnchqn0n5"; })
-  (fetchNuGet { pname = "Microsoft.DotNet.PlatformAbstractions"; version = "2.0.4"; sha256 = "1fdzln4im9hb55agzwchbfgm3vmngigmbpci5j89b0gqcxixmv8j"; })
-  (fetchNuGet { pname = "Microsoft.Extensions.Configuration"; version = "2.0.0"; sha256 = "0yssxq9di5h6xw2cayp5hj3l9b2p0jw9wcjz73rwk4586spac9s9"; })
-  (fetchNuGet { pname = "Microsoft.Extensions.Configuration"; version = "5.0.0"; sha256 = "01m9vzlq0vg0lhckj2dimwq42niwny8g3lm13c9a401hlyg90z1p"; })
-  (fetchNuGet { pname = "Microsoft.Extensions.Configuration.Abstractions"; version = "2.0.0"; sha256 = "1ilz2yrgg9rbjyhn6a5zh9pr51nmh11z7sixb4p7vivgydj9gxwf"; })
-  (fetchNuGet { pname = "Microsoft.Extensions.Configuration.Abstractions"; version = "5.0.0"; sha256 = "0fqxkc9pjxkqylsdf26s9q21ciyk56h1w33pz3v1v4wcv8yv1v6k"; })
-  (fetchNuGet { pname = "Microsoft.Extensions.Configuration.Binder"; version = "2.0.0"; sha256 = "1prvdbma6r18n5agbhhabv6g357p1j70gq4m9g0vs859kf44nrgc"; })
-  (fetchNuGet { pname = "Microsoft.Extensions.Configuration.CommandLine"; version = "5.0.0"; sha256 = "084hnz5l0vr15ay23rksqipslqnz3pp30w9hsirpx1iqdm5688mc"; })
-  (fetchNuGet { pname = "Microsoft.Extensions.Configuration.FileExtensions"; version = "5.0.0"; sha256 = "1wq229r3xcmm9wh9sqdpvmfv4qpbp2zms9x6xk7g7sbb8h32hnz3"; })
-  (fetchNuGet { pname = "Microsoft.Extensions.Configuration.Json"; version = "5.0.0"; sha256 = "0hq5i483bjbvprp1la9l3si82x1ydxbvkpfc7r3s7zgxg957fyp9"; })
-  (fetchNuGet { pname = "Microsoft.Extensions.DependencyInjection"; version = "2.0.0"; sha256 = "018izzgykaqcliwarijapgki9kp2c560qv8qsxdjywr7byws5apq"; })
-  (fetchNuGet { pname = "Microsoft.Extensions.DependencyInjection"; version = "5.0.0"; sha256 = "15sdwcyzz0qlybwbdq854bn3jk6kx7awx28gs864c4shhbqkppj4"; })
-  (fetchNuGet { pname = "Microsoft.Extensions.DependencyInjection.Abstractions"; version = "2.0.0"; sha256 = "1pwrfh9b72k9rq6mb2jab5qhhi225d5rjalzkapiayggmygc8nhz"; })
-  (fetchNuGet { pname = "Microsoft.Extensions.DependencyInjection.Abstractions"; version = "5.0.0"; sha256 = "17cz6s80va0ch0a6nqa1wbbbp3p8sqxb96lj4qcw67ivkp2yxiyj"; })
-  (fetchNuGet { pname = "Microsoft.Extensions.DependencyModel"; version = "2.0.4"; sha256 = "041i1vlcibpzgalxxzdk81g5pgmqvmz2g61k0rqa2sky0wpvijx9"; })
-  (fetchNuGet { pname = "Microsoft.Extensions.FileProviders.Abstractions"; version = "5.0.0"; sha256 = "01ahgd0b2z2zycrr2lcsq2cl59fn04bh51hdwdp9dcsdkpvnasj1"; })
-  (fetchNuGet { pname = "Microsoft.Extensions.FileProviders.Physical"; version = "5.0.0"; sha256 = "00vii8148a6pk12l9jl0rhjp7apil5q5qcy7v1smnv17lj4p8szd"; })
-  (fetchNuGet { pname = "Microsoft.Extensions.FileSystemGlobbing"; version = "5.0.0"; sha256 = "0lm6n9vbyjh0l17qcc2y9qwn1cns3dyjmkvbxjp0g9sll32kjpmb"; })
-  (fetchNuGet { pname = "Microsoft.Extensions.Logging"; version = "2.0.0"; sha256 = "1jkwjcq1ld9znz1haazk8ili2g4pzfdp6i7r7rki4hg3jcadn386"; })
-  (fetchNuGet { pname = "Microsoft.Extensions.Logging"; version = "5.0.0"; sha256 = "1qa1l18q2jh9azya8gv1p8anzcdirjzd9dxxisb4911i9m1648i3"; })
-  (fetchNuGet { pname = "Microsoft.Extensions.Logging.Abstractions"; version = "5.0.0"; sha256 = "1yza38675dbv1qqnnhqm23alv2bbaqxp0pb7zinjmw8j2mr5r6wc"; })
-  (fetchNuGet { pname = "Microsoft.Extensions.Options"; version = "2.0.0"; sha256 = "0g4zadlg73f507krilhaaa7h0jdga216syrzjlyf5fdk25gxmjqh"; })
-  (fetchNuGet { pname = "Microsoft.Extensions.Options"; version = "5.0.0"; sha256 = "1rdmgpg770x8qwaaa6ryc27zh93p697fcyvn5vkxp0wimlhqkbay"; })
-  (fetchNuGet { pname = "Microsoft.Extensions.Options.ConfigurationExtensions"; version = "2.0.0"; sha256 = "1isc3rjbzz60f7wbmgcwslx5d10hm5hisnk7v54vfi2bz7132gll"; })
-  (fetchNuGet { pname = "Microsoft.Extensions.Primitives"; version = "2.0.0"; sha256 = "1xppr5jbny04slyjgngxjdm0maxdh47vq481ps944d7jrfs0p3mb"; })
-  (fetchNuGet { pname = "Microsoft.Extensions.Primitives"; version = "5.0.0"; sha256 = "0swqcknyh87ns82w539z1mvy804pfwhgzs97cr3nwqk6g5s42gd6"; })
-  (fetchNuGet { pname = "Microsoft.NETCore.Platforms"; version = "1.0.1"; sha256 = "01al6cfxp68dscl15z7rxfw9zvhm64dncsw09a1vmdkacsa2v6lr"; })
-  (fetchNuGet { pname = "Microsoft.NETCore.Platforms"; version = "1.1.0"; sha256 = "08vh1r12g6ykjygq5d3vq09zylgb84l63k49jc4v8faw9g93iqqm"; })
-  (fetchNuGet { pname = "Microsoft.NETCore.Platforms"; version = "2.1.2"; sha256 = "1507hnpr9my3z4w1r6xk5n0s1j3y6a2c2cnynj76za7cphxi1141"; })
-  (fetchNuGet { pname = "Microsoft.NETCore.Platforms"; version = "3.0.0"; sha256 = "1bk8r4r3ihmi6322jmcag14jmw11mjqys202azqjzglcx59pxh51"; })
-  (fetchNuGet { pname = "Microsoft.NETCore.Targets"; version = "1.0.1"; sha256 = "0ppdkwy6s9p7x9jix3v4402wb171cdiibq7js7i13nxpdky7074p"; })
-  (fetchNuGet { pname = "Microsoft.NETCore.Targets"; version = "1.1.0"; sha256 = "193xwf33fbm0ni3idxzbr5fdq3i2dlfgihsac9jj7whj0gd902nh"; })
-  (fetchNuGet { pname = "Microsoft.TestPlatform.Extensions.TrxLogger"; version = "17.9.0"; sha256 = "0wn38vj9i4gjw5zsl4wcivpqrmp1h5n6m1zxcfwj7yjn9hf45rz9"; })
-  (fetchNuGet { pname = "Microsoft.TestPlatform.ObjectModel"; version = "17.9.0"; sha256 = "1kgsl9w9fganbm9wvlkqgk0ag9hfi58z88rkfybc6kvg78bx89ca"; })
-  (fetchNuGet { pname = "Microsoft.TestPlatform.TestHost"; version = "17.9.0"; sha256 = "19ffh31a1jxzn8j69m1vnk5hyfz3dbxmflq77b8x82zybiilh5nl"; })
-  (fetchNuGet { pname = "Microsoft.VisualStudio.Threading"; version = "16.7.56"; sha256 = "13x0xrsjxd86clf9cjjwmpzlyp8pkrf13riya7igs8zy93zw2qap"; })
-  (fetchNuGet { pname = "Microsoft.VisualStudio.Threading.Analyzers"; version = "16.7.56"; sha256 = "04v9df0k7bsc0rzgkw4mnvi43pdrh42vk6xdcwn9m6im33m0nnz2"; })
-  (fetchNuGet { pname = "Microsoft.VisualStudio.Validation"; version = "15.5.31"; sha256 = "1ah99rn922qa0sd2k3h64m324f2r32pw8cn4cfihgvwx4qdrpmgw"; })
-  (fetchNuGet { pname = "Microsoft.Win32.Primitives"; version = "4.3.0"; sha256 = "0j0c1wj4ndj21zsgivsc24whiya605603kxrbiw6wkfdync464wq"; })
-  (fetchNuGet { pname = "Microsoft.Win32.Registry"; version = "4.6.0"; sha256 = "0i4y782yrqqyx85pg597m20gm0v126w0j9ddk5z7xb3crx4z9f2s"; })
-  (fetchNuGet { pname = "Microsoft.Win32.SystemEvents"; version = "6.0.0"; sha256 = "0c6pcj088g1yd1vs529q3ybgsd2vjlk5y1ic6dkmbhvrp5jibl9p"; })
-  (fetchNuGet { pname = "Nerdbank.Streams"; version = "2.6.81"; sha256 = "06wihcaga8537ibh0mkj28m720m6vzkqk562zkynhca85nd236yi"; })
-  (fetchNuGet { pname = "Newtonsoft.Json"; version = "11.0.2"; sha256 = "1784xi44f4k8v1fr696hsccmwpy94bz7kixxqlri98zhcxn406b2"; })
-  (fetchNuGet { pname = "Newtonsoft.Json"; version = "13.0.1"; sha256 = "0fijg0w6iwap8gvzyjnndds0q4b8anwxxvik7y8vgq97dram4srb"; })
-  (fetchNuGet { pname = "OmniSharp.Extensions.JsonRpc"; version = "0.19.5"; sha256 = "0ilcv3cxcvjkd8ngiydi69pzll07rhqdv5nq9yjnhyj142ynw2cb"; })
-  (fetchNuGet { pname = "OmniSharp.Extensions.JsonRpc.Generators"; version = "0.19.5"; sha256 = "1mac4yx29ld8fyirg7n0vqn81hzdvcrl8w0l9w5xhnnm6bcd42v8"; })
-  (fetchNuGet { pname = "OmniSharp.Extensions.LanguageProtocol"; version = "0.19.5"; sha256 = "1clgrbw6dlh46iiiqhavwh15xqar41az352mb5r4ln8ql3wnmk1i"; })
-  (fetchNuGet { pname = "OmniSharp.Extensions.LanguageServer"; version = "0.19.5"; sha256 = "0cvxmc0r4ajnaah7lsppik61qickq7i0df4jwqaj6c6axiizhqlm"; })
-  (fetchNuGet { pname = "OmniSharp.Extensions.LanguageServer.Shared"; version = "0.19.5"; sha256 = "0cczmmsmn3pj74wpasgfhjay1a817sd0zgzgqvvnckxxzq3n463h"; })
-  (fetchNuGet { pname = "RangeTree"; version = "3.0.1"; sha256 = "19si88v2r0rc7kai1avwhigcvh3x3c916vrvqlyb59sn4f27pbm2"; })
-  (fetchNuGet { pname = "runtime.any.System.Collections"; version = "4.3.0"; sha256 = "0bv5qgm6vr47ynxqbnkc7i797fdi8gbjjxii173syrx14nmrkwg0"; })
-  (fetchNuGet { pname = "runtime.any.System.Diagnostics.Tracing"; version = "4.3.0"; sha256 = "00j6nv2xgmd3bi347k00m7wr542wjlig53rmj28pmw7ddcn97jbn"; })
-  (fetchNuGet { pname = "runtime.any.System.Globalization"; version = "4.3.0"; sha256 = "1daqf33hssad94lamzg01y49xwndy2q97i2lrb7mgn28656qia1x"; })
-  (fetchNuGet { pname = "runtime.any.System.IO"; version = "4.3.0"; sha256 = "0l8xz8zn46w4d10bcn3l4yyn4vhb3lrj2zw8llvz7jk14k4zps5x"; })
-  (fetchNuGet { pname = "runtime.any.System.Reflection"; version = "4.3.0"; sha256 = "02c9h3y35pylc0zfq3wcsvc5nqci95nrkq0mszifc0sjx7xrzkly"; })
-  (fetchNuGet { pname = "runtime.any.System.Reflection.Extensions"; version = "4.3.0"; sha256 = "0zyri97dfc5vyaz9ba65hjj1zbcrzaffhsdlpxc9bh09wy22fq33"; })
-  (fetchNuGet { pname = "runtime.any.System.Reflection.Primitives"; version = "4.3.0"; sha256 = "0x1mm8c6iy8rlxm8w9vqw7gb7s1ljadrn049fmf70cyh42vdfhrf"; })
-  (fetchNuGet { pname = "runtime.any.System.Resources.ResourceManager"; version = "4.3.0"; sha256 = "03kickal0iiby82wa5flar18kyv82s9s6d4xhk5h4bi5kfcyfjzl"; })
-  (fetchNuGet { pname = "runtime.any.System.Runtime"; version = "4.3.0"; sha256 = "1cqh1sv3h5j7ixyb7axxbdkqx6cxy00p4np4j91kpm492rf4s25b"; })
-  (fetchNuGet { pname = "runtime.any.System.Runtime.Handles"; version = "4.3.0"; sha256 = "0bh5bi25nk9w9xi8z23ws45q5yia6k7dg3i4axhfqlnj145l011x"; })
-  (fetchNuGet { pname = "runtime.any.System.Runtime.InteropServices"; version = "4.3.0"; sha256 = "0c3g3g3jmhlhw4klrc86ka9fjbl7i59ds1fadsb2l8nqf8z3kb19"; })
-  (fetchNuGet { pname = "runtime.any.System.Text.Encoding"; version = "4.3.0"; sha256 = "0aqqi1v4wx51h51mk956y783wzags13wa7mgqyclacmsmpv02ps3"; })
-  (fetchNuGet { pname = "runtime.any.System.Text.Encoding.Extensions"; version = "4.3.0"; sha256 = "0lqhgqi0i8194ryqq6v2gqx0fb86db2gqknbm0aq31wb378j7ip8"; })
-  (fetchNuGet { pname = "runtime.any.System.Threading.Tasks"; version = "4.3.0"; sha256 = "03mnvkhskbzxddz4hm113zsch1jyzh2cs450dk3rgfjp8crlw1va"; })
-  (fetchNuGet { pname = "runtime.debian.8-x64.runtime.native.System.Security.Cryptography.OpenSsl"; version = "4.3.0"; sha256 = "16rnxzpk5dpbbl1x354yrlsbvwylrq456xzpsha1n9y3glnhyx9d"; })
-  (fetchNuGet { pname = "runtime.fedora.23-x64.runtime.native.System.Security.Cryptography.OpenSsl"; version = "4.3.0"; sha256 = "0hkg03sgm2wyq8nqk6dbm9jh5vcq57ry42lkqdmfklrw89lsmr59"; })
-  (fetchNuGet { pname = "runtime.fedora.24-x64.runtime.native.System.Security.Cryptography.OpenSsl"; version = "4.3.0"; sha256 = "0c2p354hjx58xhhz7wv6div8xpi90sc6ibdm40qin21bvi7ymcaa"; })
-  (fetchNuGet { pname = "runtime.native.System"; version = "4.0.0"; sha256 = "1ppk69xk59ggacj9n7g6fyxvzmk1g5p4fkijm0d7xqfkig98qrkf"; })
-  (fetchNuGet { pname = "runtime.native.System"; version = "4.3.0"; sha256 = "15hgf6zaq9b8br2wi1i3x0zvmk410nlmsmva9p0bbg73v6hml5k4"; })
-  (fetchNuGet { pname = "runtime.native.System.Security.Cryptography.OpenSsl"; version = "4.3.0"; sha256 = "18pzfdlwsg2nb1jjjjzyb5qlgy6xjxzmhnfaijq5s2jw3cm3ab97"; })
-  (fetchNuGet { pname = "runtime.opensuse.13.2-x64.runtime.native.System.Security.Cryptography.OpenSsl"; version = "4.3.0"; sha256 = "0qyynf9nz5i7pc26cwhgi8j62ps27sqmf78ijcfgzab50z9g8ay3"; })
-  (fetchNuGet { pname = "runtime.opensuse.42.1-x64.runtime.native.System.Security.Cryptography.OpenSsl"; version = "4.3.0"; sha256 = "1klrs545awhayryma6l7g2pvnp9xy4z0r1i40r80zb45q3i9nbyf"; })
-  (fetchNuGet { pname = "runtime.osx.10.10-x64.runtime.native.System.Security.Cryptography.OpenSsl"; version = "4.3.0"; sha256 = "0zcxjv5pckplvkg0r6mw3asggm7aqzbdjimhvsasb0cgm59x09l3"; })
-  (fetchNuGet { pname = "runtime.rhel.7-x64.runtime.native.System.Security.Cryptography.OpenSsl"; version = "4.3.0"; sha256 = "0vhynn79ih7hw7cwjazn87rm9z9fj0rvxgzlab36jybgcpcgphsn"; })
-  (fetchNuGet { pname = "runtime.ubuntu.14.04-x64.runtime.native.System.Security.Cryptography.OpenSsl"; version = "4.3.0"; sha256 = "160p68l2c7cqmyqjwxydcvgw7lvl1cr0znkw8fp24d1by9mqc8p3"; })
-  (fetchNuGet { pname = "runtime.ubuntu.16.04-x64.runtime.native.System.Security.Cryptography.OpenSsl"; version = "4.3.0"; sha256 = "15zrc8fgd8zx28hdghcj5f5i34wf3l6bq5177075m2bc2j34jrqy"; })
-  (fetchNuGet { pname = "runtime.ubuntu.16.10-x64.runtime.native.System.Security.Cryptography.OpenSsl"; version = "4.3.0"; sha256 = "1p4dgxax6p7rlgj4q73k73rslcnz4wdcv8q2flg1s8ygwcm58ld5"; })
-  (fetchNuGet { pname = "runtime.unix.Microsoft.Win32.Primitives"; version = "4.3.0"; sha256 = "0y61k9zbxhdi0glg154v30kkq7f8646nif8lnnxbvkjpakggd5id"; })
-  (fetchNuGet { pname = "runtime.unix.System.Diagnostics.Debug"; version = "4.3.0"; sha256 = "1lps7fbnw34bnh3lm31gs5c0g0dh7548wfmb8zz62v0zqz71msj5"; })
-  (fetchNuGet { pname = "runtime.unix.System.IO.FileSystem"; version = "4.3.0"; sha256 = "14nbkhvs7sji5r1saj2x8daz82rnf9kx28d3v2qss34qbr32dzix"; })
-  (fetchNuGet { pname = "runtime.unix.System.Private.Uri"; version = "4.3.0"; sha256 = "1jx02q6kiwlvfksq1q9qr17fj78y5v6mwsszav4qcz9z25d5g6vk"; })
-  (fetchNuGet { pname = "runtime.unix.System.Runtime.Extensions"; version = "4.3.0"; sha256 = "0pnxxmm8whx38dp6yvwgmh22smknxmqs5n513fc7m4wxvs1bvi4p"; })
-  (fetchNuGet { pname = "Serilog"; version = "2.12.0"; sha256 = "0lqxpc96qcjkv9pr1rln7mi4y7n7jdi4vb36c2fv3845w1vswgr4"; })
-  (fetchNuGet { pname = "Serilog.Extensions.Logging"; version = "3.0.1"; sha256 = "069qy7dm5nxb372ij112ppa6m99b4iaimj3sji74m659fwrcrl9a"; })
-  (fetchNuGet { pname = "Serilog.Settings.Configuration"; version = "3.1.0"; sha256 = "1cj5am4n073331gbfm2ylqb9cadl4q3ppzgwmm5c8m1drxpiwkb5"; })
-  (fetchNuGet { pname = "Serilog.Sinks.Debug"; version = "2.0.0"; sha256 = "1i7j870l47gan3gpnnlzkccn5lbm7518cnkp25a3g5gp9l0dbwpw"; })
-  (fetchNuGet { pname = "Serilog.Sinks.File"; version = "5.0.0"; sha256 = "097rngmgcrdfy7jy8j7dq3xaq2qky8ijwg0ws6bfv5lx0f3vvb0q"; })
-  (fetchNuGet { pname = "System.AppContext"; version = "4.1.0"; sha256 = "0fv3cma1jp4vgj7a8hqc9n7hr1f1kjp541s6z0q1r6nazb4iz9mz"; })
-  (fetchNuGet { pname = "System.Buffers"; version = "4.3.0"; sha256 = "0fgns20ispwrfqll4q1zc1waqcmylb3zc50ys9x8zlwxh9pmd9jy"; })
-  (fetchNuGet { pname = "System.Collections"; version = "4.3.0"; sha256 = "19r4y64dqyrq6k4706dnyhhw7fs24kpp3awak7whzss39dakpxk9"; })
-  (fetchNuGet { pname = "System.Collections.Immutable"; version = "1.7.0"; sha256 = "1gik4sn9jsi1wcy1pyyp0r4sn2g17cwrsh24b2d52vif8p2h24zx"; })
-  (fetchNuGet { pname = "System.Collections.Immutable"; version = "1.7.1"; sha256 = "1nh4nlxfc7lbnbl86wwk1a3jwl6myz5j6hvgh5sp4krim9901hsq"; })
-  (fetchNuGet { pname = "System.CommandLine"; version = "2.0.0-beta4.22272.1"; sha256 = "1iy5hwwgvx911g3yq65p4zsgpy08w4qz9j3h0igcf7yci44vw8yd"; })
-  (fetchNuGet { pname = "System.Configuration.ConfigurationManager"; version = "6.0.0"; sha256 = "0sqapr697jbb4ljkq46msg0xx1qpmc31ivva6llyz2wzq3mpmxbw"; })
-  (fetchNuGet { pname = "System.Diagnostics.Debug"; version = "4.3.0"; sha256 = "00yjlf19wjydyr6cfviaph3vsjzg3d5nvnya26i2fvfg53sknh3y"; })
-  (fetchNuGet { pname = "System.Diagnostics.Tracing"; version = "4.3.0"; sha256 = "1m3bx6c2s958qligl67q7grkwfz3w53hpy7nc97mh6f7j5k168c4"; })
-  (fetchNuGet { pname = "System.Drawing.Common"; version = "6.0.0"; sha256 = "02n8rzm58dac2np8b3xw8ychbvylja4nh6938l5k2fhyn40imlgz"; })
-  (fetchNuGet { pname = "System.Dynamic.Runtime"; version = "4.0.11"; sha256 = "1pla2dx8gkidf7xkciig6nifdsb494axjvzvann8g2lp3dbqasm9"; })
-  (fetchNuGet { pname = "System.Globalization"; version = "4.0.11"; sha256 = "070c5jbas2v7smm660zaf1gh0489xanjqymkvafcs4f8cdrs1d5d"; })
-  (fetchNuGet { pname = "System.Globalization"; version = "4.3.0"; sha256 = "1cp68vv683n6ic2zqh2s1fn4c2sd87g5hpp6l4d4nj4536jz98ki"; })
-  (fetchNuGet { pname = "System.IO"; version = "4.1.0"; sha256 = "1g0yb8p11vfd0kbkyzlfsbsp5z44lwsvyc0h3dpw6vqnbi035ajp"; })
-  (fetchNuGet { pname = "System.IO"; version = "4.3.0"; sha256 = "05l9qdrzhm4s5dixmx68kxwif4l99ll5gqmh7rqgw554fx0agv5f"; })
-  (fetchNuGet { pname = "System.IO.FileSystem"; version = "4.0.1"; sha256 = "0kgfpw6w4djqra3w5crrg8xivbanh1w9dh3qapb28q060wb9flp1"; })
-  (fetchNuGet { pname = "System.IO.FileSystem.Primitives"; version = "4.3.0"; sha256 = "0j6ndgglcf4brg2lz4wzsh1av1gh8xrzdsn9f0yznskhqn1xzj9c"; })
-  (fetchNuGet { pname = "System.IO.Pipelines"; version = "4.7.3"; sha256 = "0djp59x56klidi04xx8p5jc1nchv5zvd1d59diphqxwvgny3aawy"; })
-  (fetchNuGet { pname = "System.Linq"; version = "4.1.0"; sha256 = "1ppg83svb39hj4hpp5k7kcryzrf3sfnm08vxd5sm2drrijsla2k5"; })
-  (fetchNuGet { pname = "System.Linq.Async"; version = "6.0.1"; sha256 = "10ira8hmv0i54yp9ggrrdm1c06j538sijfjpn1kmnh9j2xk5yzmq"; })
-  (fetchNuGet { pname = "System.Linq.Expressions"; version = "4.1.0"; sha256 = "1gpdxl6ip06cnab7n3zlcg6mqp7kknf73s8wjinzi4p0apw82fpg"; })
-  (fetchNuGet { pname = "System.Memory"; version = "4.5.4"; sha256 = "14gbbs22mcxwggn0fcfs1b062521azb9fbb7c113x0mq6dzq9h6y"; })
-  (fetchNuGet { pname = "System.Net.WebSockets"; version = "4.3.0"; sha256 = "1gfj800078kggcgl0xyl00a6y5k4wwh2k2qm69rjy22wbmq7fy4p"; })
-  (fetchNuGet { pname = "System.ObjectModel"; version = "4.0.12"; sha256 = "1sybkfi60a4588xn34nd9a58png36i0xr4y4v4kqpg8wlvy5krrj"; })
-  (fetchNuGet { pname = "System.Private.Uri"; version = "4.3.0"; sha256 = "04r1lkdnsznin0fj4ya1zikxiqr0h6r6a1ww2dsm60gqhdrf0mvx"; })
-  (fetchNuGet { pname = "System.Reactive"; version = "4.4.1"; sha256 = "0gx8jh3hny2y5kijz5k9pxiqw481d013787c04zlhps21ygklw4a"; })
-  (fetchNuGet { pname = "System.Reflection"; version = "4.1.0"; sha256 = "1js89429pfw79mxvbzp8p3q93il6rdff332hddhzi5wqglc4gml9"; })
-  (fetchNuGet { pname = "System.Reflection"; version = "4.3.0"; sha256 = "0xl55k0mw8cd8ra6dxzh974nxif58s3k1rjv1vbd7gjbjr39j11m"; })
-  (fetchNuGet { pname = "System.Reflection.Emit"; version = "4.0.1"; sha256 = "0ydqcsvh6smi41gyaakglnv252625hf29f7kywy2c70nhii2ylqp"; })
-  (fetchNuGet { pname = "System.Reflection.Emit.ILGeneration"; version = "4.0.1"; sha256 = "1pcd2ig6bg144y10w7yxgc9d22r7c7ww7qn1frdfwgxr24j9wvv0"; })
-  (fetchNuGet { pname = "System.Reflection.Emit.Lightweight"; version = "4.0.1"; sha256 = "1s4b043zdbx9k39lfhvsk68msv1nxbidhkq6nbm27q7sf8xcsnxr"; })
-  (fetchNuGet { pname = "System.Reflection.Extensions"; version = "4.0.1"; sha256 = "0m7wqwq0zqq9gbpiqvgk3sr92cbrw7cp3xn53xvw7zj6rz6fdirn"; })
-  (fetchNuGet { pname = "System.Reflection.Metadata"; version = "1.6.0"; sha256 = "1wdbavrrkajy7qbdblpbpbalbdl48q3h34cchz24gvdgyrlf15r4"; })
-  (fetchNuGet { pname = "System.Reflection.Primitives"; version = "4.0.1"; sha256 = "1bangaabhsl4k9fg8khn83wm6yial8ik1sza7401621jc6jrym28"; })
-  (fetchNuGet { pname = "System.Reflection.Primitives"; version = "4.3.0"; sha256 = "04xqa33bld78yv5r93a8n76shvc8wwcdgr1qvvjh959g3rc31276"; })
-  (fetchNuGet { pname = "System.Reflection.TypeExtensions"; version = "4.1.0"; sha256 = "1bjli8a7sc7jlxqgcagl9nh8axzfl11f4ld3rjqsyxc516iijij7"; })
-  (fetchNuGet { pname = "System.Resources.ResourceManager"; version = "4.0.1"; sha256 = "0b4i7mncaf8cnai85jv3wnw6hps140cxz8vylv2bik6wyzgvz7bi"; })
-  (fetchNuGet { pname = "System.Resources.ResourceManager"; version = "4.3.0"; sha256 = "0sjqlzsryb0mg4y4xzf35xi523s4is4hz9q4qgdvlvgivl7qxn49"; })
-  (fetchNuGet { pname = "System.Runtime"; version = "4.1.0"; sha256 = "02hdkgk13rvsd6r9yafbwzss8kr55wnj8d5c7xjnp8gqrwc8sn0m"; })
-  (fetchNuGet { pname = "System.Runtime"; version = "4.3.0"; sha256 = "066ixvgbf2c929kgknshcxqj6539ax7b9m570cp8n179cpfkapz7"; })
-  (fetchNuGet { pname = "System.Runtime.Caching"; version = "6.0.0"; sha256 = "0wh98a77cby4i3h2mar241k01105x661kh03vlyd399shxkfk60a"; })
-  (fetchNuGet { pname = "System.Runtime.CompilerServices.Unsafe"; version = "4.4.0"; sha256 = "0a6ahgi5b148sl5qyfpyw383p3cb4yrkm802k29fsi4mxkiwir29"; })
-  (fetchNuGet { pname = "System.Runtime.CompilerServices.Unsafe"; version = "4.7.0"; sha256 = "16r6sn4czfjk8qhnz7bnqlyiaaszr0ihinb7mq9zzr1wba257r54"; })
-  (fetchNuGet { pname = "System.Runtime.CompilerServices.Unsafe"; version = "4.7.1"; sha256 = "119br3pd85lq8zcgh4f60jzmv1g976q1kdgi3hvqdlhfbw6siz2j"; })
-  (fetchNuGet { pname = "System.Runtime.Extensions"; version = "4.1.0"; sha256 = "0rw4rm4vsm3h3szxp9iijc3ksyviwsv6f63dng3vhqyg4vjdkc2z"; })
-  (fetchNuGet { pname = "System.Runtime.Extensions"; version = "4.3.0"; sha256 = "1ykp3dnhwvm48nap8q23893hagf665k0kn3cbgsqpwzbijdcgc60"; })
-  (fetchNuGet { pname = "System.Runtime.Handles"; version = "4.0.1"; sha256 = "1g0zrdi5508v49pfm3iii2hn6nm00bgvfpjq1zxknfjrxxa20r4g"; })
-  (fetchNuGet { pname = "System.Runtime.Handles"; version = "4.3.0"; sha256 = "0sw2gfj2xr7sw9qjn0j3l9yw07x73lcs97p8xfc9w1x9h5g5m7i8"; })
-  (fetchNuGet { pname = "System.Runtime.InteropServices"; version = "4.1.0"; sha256 = "01kxqppx3dr3b6b286xafqilv4s2n0gqvfgzfd4z943ga9i81is1"; })
-  (fetchNuGet { pname = "System.Runtime.InteropServices"; version = "4.3.0"; sha256 = "00hywrn4g7hva1b2qri2s6rabzwgxnbpw9zfxmz28z09cpwwgh7j"; })
-  (fetchNuGet { pname = "System.Runtime.InteropServices.RuntimeInformation"; version = "4.0.0"; sha256 = "0glmvarf3jz5xh22iy3w9v3wyragcm4hfdr17v90vs7vcrm7fgp6"; })
-  (fetchNuGet { pname = "System.Runtime.Numerics"; version = "4.3.0"; sha256 = "19rav39sr5dky7afygh309qamqqmi9kcwvz3i0c5700v0c5cg61z"; })
-  (fetchNuGet { pname = "System.Security.AccessControl"; version = "4.6.0"; sha256 = "1wl1dyghi0qhpap1vgfhg2ybdyyhy9vc2a7dpm1xb30vfgmlkjmf"; })
-  (fetchNuGet { pname = "System.Security.AccessControl"; version = "6.0.0"; sha256 = "0a678bzj8yxxiffyzy60z2w1nczzpi8v97igr4ip3byd2q89dv58"; })
-  (fetchNuGet { pname = "System.Security.Cryptography.ProtectedData"; version = "6.0.0"; sha256 = "05kd3a8w7658hjxq9vvszxip30a479fjmfq4bq1r95nrsvs4hbss"; })
-  (fetchNuGet { pname = "System.Security.Permissions"; version = "6.0.0"; sha256 = "0jsl4xdrkqi11iwmisi1r2f2qn5pbvl79mzq877gndw6ans2zhzw"; })
-  (fetchNuGet { pname = "System.Security.Principal.Windows"; version = "4.6.0"; sha256 = "1jmfzfz1n8hp63s5lja5xxpzkinbp6g59l3km9h8avjiisdrg5wm"; })
-  (fetchNuGet { pname = "System.Text.Encoding"; version = "4.0.11"; sha256 = "1dyqv0hijg265dwxg6l7aiv74102d6xjiwplh2ar1ly6xfaa4iiw"; })
-  (fetchNuGet { pname = "System.Text.Encoding"; version = "4.3.0"; sha256 = "1f04lkir4iladpp51sdgmis9dj4y8v08cka0mbmsy0frc9a4gjqr"; })
-  (fetchNuGet { pname = "System.Text.Encoding.CodePages"; version = "4.5.1"; sha256 = "1z21qyfs6sg76rp68qdx0c9iy57naan89pg7p6i3qpj8kyzn921w"; })
-  (fetchNuGet { pname = "System.Text.Encoding.Extensions"; version = "4.3.0"; sha256 = "11q1y8hh5hrp5a3kw25cb6l00v5l5dvirkz8jr3sq00h1xgcgrxy"; })
-  (fetchNuGet { pname = "System.Threading"; version = "4.0.11"; sha256 = "19x946h926bzvbsgj28csn46gak2crv2skpwsx80hbgazmkgb1ls"; })
-  (fetchNuGet { pname = "System.Threading"; version = "4.3.0"; sha256 = "0rw9wfamvhayp5zh3j7p1yfmx9b5khbf4q50d8k5rk993rskfd34"; })
-  (fetchNuGet { pname = "System.Threading.Channels"; version = "4.7.1"; sha256 = "038fyrriypwzsj5fwgnkw79hm5ya0x63r724yizgahbxf512chr2"; })
-  (fetchNuGet { pname = "System.Threading.Tasks"; version = "4.0.11"; sha256 = "0nr1r41rak82qfa5m0lhk9mp0k93bvfd7bbd9sdzwx9mb36g28p5"; })
-  (fetchNuGet { pname = "System.Threading.Tasks"; version = "4.3.0"; sha256 = "134z3v9abw3a6jsw17xl3f6hqjpak5l682k2vz39spj4kmydg6k7"; })
-  (fetchNuGet { pname = "System.Threading.Tasks.Extensions"; version = "4.5.3"; sha256 = "0g7r6hm572ax8v28axrdxz1gnsblg6kszq17g51pj14a5rn2af7i"; })
-  (fetchNuGet { pname = "System.Windows.Extensions"; version = "6.0.0"; sha256 = "1wy9pq9vn1bqg5qnv53iqrbx04yzdmjw4x5yyi09y3459vaa1sip"; })
-  (fetchNuGet { pname = "Tomlyn"; version = "0.16.2"; sha256 = "1i928q6a7l65mk7wj2vvfclyvxamdjxg4dbj3g6g95inrfgvidah"; })
+  (fetchNuGet { pname = "Boogie"; version = "3.1.3"; hash = "sha256-0XQcD1ImPNPXQ43fTkahC3qr2zUvHNdmgw0tmYE+7Hc="; })
+  (fetchNuGet { pname = "Boogie.AbstractInterpretation"; version = "3.2.3"; hash = "sha256-SwJ5D3tOU+qcyQdNITIM15ujMEC++aXHOsUSovWbsC4="; })
+  (fetchNuGet { pname = "Boogie.BaseTypes"; version = "3.2.3"; hash = "sha256-cIUdpGGjMKn70Z0nD8rvva8UbFSoLDUrBprC+TMG/EA="; })
+  (fetchNuGet { pname = "Boogie.CodeContractsExtender"; version = "3.2.3"; hash = "sha256-L+phJ66oHNINliPkabU3vO4Vl9Lkv+nug+DWC8VmFlc="; })
+  (fetchNuGet { pname = "Boogie.Concurrency"; version = "3.2.3"; hash = "sha256-w+5B+uyfKCf8j8hP0G/SSPUd2lT2T8A4Lkg0tsxniBg="; })
+  (fetchNuGet { pname = "Boogie.Core"; version = "3.2.3"; hash = "sha256-qqoeLAdpRRaTISdgxyE3iFqhrmezxISaE5bm02rXVyE="; })
+  (fetchNuGet { pname = "Boogie.ExecutionEngine"; version = "3.2.3"; hash = "sha256-8EKwiBnoMFGxeK2+IuG5p6BtnPlR0CCekXi4PBFLEbU="; })
+  (fetchNuGet { pname = "Boogie.Graph"; version = "3.2.3"; hash = "sha256-7XjrCHSnvEL7eMmma2vKA7r8YGJe8Oo4E8U9Wja/al0="; })
+  (fetchNuGet { pname = "Boogie.Houdini"; version = "3.2.3"; hash = "sha256-g7i0yF/89IWXElTi0onOgvPaesqlPGl3qINMCePHGA8="; })
+  (fetchNuGet { pname = "Boogie.Model"; version = "3.2.3"; hash = "sha256-gRMZQQFMjQEQasg3A3iZ9/0KUWCxAoUPiHPZHbWXUs4="; })
+  (fetchNuGet { pname = "Boogie.Provers.LeanAuto"; version = "3.2.3"; hash = "sha256-kMLvTTnvKWjggSby7D4jkaRmdvvOum0ZlfM6yU2760Q="; })
+  (fetchNuGet { pname = "Boogie.Provers.SMTLib"; version = "3.2.3"; hash = "sha256-SCfEJCRueTE66ZZbHX8FHpD50SrBDQne8725uiKjbvM="; })
+  (fetchNuGet { pname = "Boogie.VCExpr"; version = "3.2.3"; hash = "sha256-U6Rc5P0dUtNZ1IGDBU4hggwreVxSZqu6cZSKcWLpq/o="; })
+  (fetchNuGet { pname = "Boogie.VCGeneration"; version = "3.2.3"; hash = "sha256-snbFiueD508B1GLqIC8cQdT9jW2jkRyhmYxPTlfnyrQ="; })
+  (fetchNuGet { pname = "CocoR"; version = "2014.12.25"; hash = "sha256-qxTcnqh7jziriMHwos5/YArRYUG2+3nNoYYmFyPo8E0="; })
+  (fetchNuGet { pname = "JetBrains.Annotations"; version = "2021.1.0"; hash = "sha256-64Vc/jHHG5tzaQrmlaU3y7+9qj3jT1V5vRr1R3uH9h4="; })
+  (fetchNuGet { pname = "MediatR"; version = "8.1.0"; hash = "sha256-dyqhDG1NJjY1b+dj37sMmklGkxAm3zKdhh2lBJ0/HTM="; })
+  (fetchNuGet { pname = "Microsoft.Bcl.AsyncInterfaces"; version = "1.1.1"; hash = "sha256-fAcX4sxE0veWM1CZBtXR/Unky+6sE33yrV7ohrWGKig="; })
+  (fetchNuGet { pname = "Microsoft.Bcl.AsyncInterfaces"; version = "6.0.0"; hash = "sha256-49+H/iFwp+AfCICvWcqo9us4CzxApPKC37Q5Eqrw+JU="; })
+  (fetchNuGet { pname = "Microsoft.DotNet.PlatformAbstractions"; version = "2.0.4"; hash = "sha256-Eu3aY2f4gZWQLJHdVV98tu5Rn1uQ8f9UKQumGomlv7k="; })
+  (fetchNuGet { pname = "Microsoft.Extensions.Configuration"; version = "2.0.0"; hash = "sha256-SSemrjaokMnzOF8ynrgEV6xEh4TlesUE7waW2BLuWns="; })
+  (fetchNuGet { pname = "Microsoft.Extensions.Configuration"; version = "5.0.0"; hash = "sha256-N3yQnqcwAKISG6HS8ZC3PFpBMK+xCTkZpOBtgOnfqQY="; })
+  (fetchNuGet { pname = "Microsoft.Extensions.Configuration.Abstractions"; version = "2.0.0"; hash = "sha256-jveXZPNvx30uWT3q80OA1YaSb4K/KGOhlyun97IXn8Y="; })
+  (fetchNuGet { pname = "Microsoft.Extensions.Configuration.Abstractions"; version = "5.0.0"; hash = "sha256-0+ywPdqMkx32+HcMHqAp00cWBE7aCNc09Xh2eRObHTs="; })
+  (fetchNuGet { pname = "Microsoft.Extensions.Configuration.Binder"; version = "2.0.0"; hash = "sha256-7GVLiJupIL3BS5XgB44M95TxzF4KwvVUsShko+pqO98="; })
+  (fetchNuGet { pname = "Microsoft.Extensions.Configuration.CommandLine"; version = "5.0.0"; hash = "sha256-rCJkSm04hn5z1DBxMO4d32Kqb8R65iG8KiFvQMu3kCA="; })
+  (fetchNuGet { pname = "Microsoft.Extensions.Configuration.FileExtensions"; version = "5.0.0"; hash = "sha256-41soBkRr6fPO7KYnXb+462KyXd23YZ0gT7WyPnISAvM="; })
+  (fetchNuGet { pname = "Microsoft.Extensions.Configuration.Json"; version = "5.0.0"; hash = "sha256-6Xp3Snr9/aNHPszduVdvPnSBoh40KRpuvnvJNRCJBUM="; })
+  (fetchNuGet { pname = "Microsoft.Extensions.DependencyInjection"; version = "2.0.0"; hash = "sha256-+KqiuV8ncy9b1xhtDExh4s4U57tKxqx4pAyr6d//EQU="; })
+  (fetchNuGet { pname = "Microsoft.Extensions.DependencyInjection"; version = "5.0.0"; hash = "sha256-RN478YJQE0YM0g+JztXp00w57CIF4bb48hSD/z3jTZc="; })
+  (fetchNuGet { pname = "Microsoft.Extensions.DependencyInjection.Abstractions"; version = "2.0.0"; hash = "sha256-H1rEnq/veRWvmp8qmUsrQkQIcVlKilUNzmmKsxJ0md8="; })
+  (fetchNuGet { pname = "Microsoft.Extensions.DependencyInjection.Abstractions"; version = "5.0.0"; hash = "sha256-0sfuxZ07HsMZJpKatDrW6I671uJBYWsUgAyoDZA2n50="; })
+  (fetchNuGet { pname = "Microsoft.Extensions.DependencyModel"; version = "2.0.4"; hash = "sha256-qcu4Lwd+aqFwBjOYJ37duL5bXkCz/d6pev+uyOgOMRA="; })
+  (fetchNuGet { pname = "Microsoft.Extensions.FileProviders.Abstractions"; version = "5.0.0"; hash = "sha256-QWpl951Ns5Zu4w2GAhcB1qVCmcCaUZEz8198sUB7UAU="; })
+  (fetchNuGet { pname = "Microsoft.Extensions.FileProviders.Physical"; version = "5.0.0"; hash = "sha256-7Wt0iaQnbFt12MczXHCh8apzJcyAykRFmNcoRAKKcQM="; })
+  (fetchNuGet { pname = "Microsoft.Extensions.FileSystemGlobbing"; version = "5.0.0"; hash = "sha256-q145xaBUpweu7GvPKn0b2rJgOU5eMIZPoABKv3ayplI="; })
+  (fetchNuGet { pname = "Microsoft.Extensions.Logging"; version = "2.0.0"; hash = "sha256-Bg3bFJPjQRJnPvlEc5v7lzwRaUTzKwXDtz81GjCTfMo="; })
+  (fetchNuGet { pname = "Microsoft.Extensions.Logging"; version = "5.0.0"; hash = "sha256-IyJiQk0xhESWjr231L7MsbFvFbphP6T8VwlKgVGgQeE="; })
+  (fetchNuGet { pname = "Microsoft.Extensions.Logging.Abstractions"; version = "5.0.0"; hash = "sha256-jJtcchUS8Spt/GddcDtWa4lN1RAVQ2sxDnu1cgwa6vs="; })
+  (fetchNuGet { pname = "Microsoft.Extensions.Options"; version = "2.0.0"; hash = "sha256-EMvaXxGzueI8lT97bYJQr0kAj1IK0pjnAcWN82hTnzw="; })
+  (fetchNuGet { pname = "Microsoft.Extensions.Options"; version = "5.0.0"; hash = "sha256-Xq2JIa2Rg9vnLnZ75k4ydyT4j2A+G6UUx6iDc959teU="; })
+  (fetchNuGet { pname = "Microsoft.Extensions.Options.ConfigurationExtensions"; version = "2.0.0"; hash = "sha256-lD4xwvlLRLdJ2WdaHWGpEIRWOtWcvbr4ccD8v2QeTMc="; })
+  (fetchNuGet { pname = "Microsoft.Extensions.Primitives"; version = "2.0.0"; hash = "sha256-q44LtMvyNEKSvgERvA+BrasKapP92Sc91QR4u2TJ9/Y="; })
+  (fetchNuGet { pname = "Microsoft.Extensions.Primitives"; version = "5.0.0"; hash = "sha256-pj1BdHlmYm5HZifp/yB3lwDkdw0/jcIF0vYg6O1kmGs="; })
+  (fetchNuGet { pname = "Microsoft.NETCore.Platforms"; version = "1.0.1"; hash = "sha256-mZotlGZqtrqDSoBrZhsxFe6fuOv5/BIo0w2Z2x0zVAU="; })
+  (fetchNuGet { pname = "Microsoft.NETCore.Platforms"; version = "1.1.0"; hash = "sha256-FeM40ktcObQJk4nMYShB61H/E8B7tIKfl9ObJ0IOcCM="; })
+  (fetchNuGet { pname = "Microsoft.NETCore.Platforms"; version = "3.0.0"; hash = "sha256-ocB+U+mMvi/xVwII7bGsIfAqSXiKVSnEMLHCODLJaK4="; })
+  (fetchNuGet { pname = "Microsoft.NETCore.Targets"; version = "1.0.1"; hash = "sha256-lxxw/Gy32xHi0fLgFWNj4YTFBSBkjx5l6ucmbTyf7V4="; })
+  (fetchNuGet { pname = "Microsoft.NETCore.Targets"; version = "1.1.0"; hash = "sha256-0AqQ2gMS8iNlYkrD+BxtIg7cXMnr9xZHtKAuN4bjfaQ="; })
+  (fetchNuGet { pname = "Microsoft.TestPlatform.Extensions.TrxLogger"; version = "17.9.0"; hash = "sha256-6edCHExW+iO5Y/2HamyB4daM746ME6p/4fKRmORGw3I="; })
+  (fetchNuGet { pname = "Microsoft.TestPlatform.ObjectModel"; version = "17.9.0"; hash = "sha256-iiXUFzpvT8OWdzMj9FGJDqanwHx40s1TXVY9l3ii+s0="; })
+  (fetchNuGet { pname = "Microsoft.TestPlatform.TestHost"; version = "17.9.0"; hash = "sha256-1BZIY1z+C9TROgdTV/tq4zsPy7Q71GQksr/LoMKAzqU="; })
+  (fetchNuGet { pname = "Microsoft.VisualStudio.Threading"; version = "16.7.56"; hash = "sha256-V2HB/0j+I/3iUT7mEVyeF11P/61cSpYcZQa1LnXuoI8="; })
+  (fetchNuGet { pname = "Microsoft.VisualStudio.Threading.Analyzers"; version = "16.7.56"; hash = "sha256-4lsL6hg1mposZ62buQWBud1B4raV8Pl+BkyvM4FraRM="; })
+  (fetchNuGet { pname = "Microsoft.VisualStudio.Validation"; version = "15.5.31"; hash = "sha256-/NWbGyad7wejY8QyxK8YWTgiRiUGjimaBgoLkWxOCao="; })
+  (fetchNuGet { pname = "Microsoft.Win32.Primitives"; version = "4.3.0"; hash = "sha256-mBNDmPXNTW54XLnPAUwBRvkIORFM7/j0D0I2SyQPDEg="; })
+  (fetchNuGet { pname = "Microsoft.Win32.Registry"; version = "4.6.0"; hash = "sha256-Wrj0Sc9srH5+ma0lCbgRYYP6gKgnlXcL6h7j7AU6nkQ="; })
+  (fetchNuGet { pname = "Microsoft.Win32.SystemEvents"; version = "6.0.0"; hash = "sha256-N9EVZbl5w1VnMywGXyaVWzT9lh84iaJ3aD48hIBk1zA="; })
+  (fetchNuGet { pname = "Nerdbank.Streams"; version = "2.6.81"; hash = "sha256-0Zshmi1IMWj9/MKUieffpgJxKhJyVgBXPKMg9RSDkRs="; })
+  (fetchNuGet { pname = "Newtonsoft.Json"; version = "11.0.2"; hash = "sha256-YhlAbGfwoxQzxb3Hef4iyV9eGdPQJJNd2GgSR0jsBJ0="; })
+  (fetchNuGet { pname = "Newtonsoft.Json"; version = "13.0.1"; hash = "sha256-K2tSVW4n4beRPzPu3rlVaBEMdGvWSv/3Q1fxaDh4Mjo="; })
+  (fetchNuGet { pname = "OmniSharp.Extensions.JsonRpc"; version = "0.19.5"; hash = "sha256-iwluvSBBemilT9iW3TDMB1D6bzKx+fgsalNu1tnYjEY="; })
+  (fetchNuGet { pname = "OmniSharp.Extensions.JsonRpc.Generators"; version = "0.19.5"; hash = "sha256-aAvS2DLVWtgLTxRwRDPb7cOALN7Anpejd6jRJLonTNU="; })
+  (fetchNuGet { pname = "OmniSharp.Extensions.LanguageProtocol"; version = "0.19.5"; hash = "sha256-Mcxq+aAYWUpyWVWU8VUgWeFeAuRbQRxjNATSZvjKj7I="; })
+  (fetchNuGet { pname = "OmniSharp.Extensions.LanguageServer"; version = "0.19.5"; hash = "sha256-lWL4Y+zKMCMV5pK4BuLBk0UczIz3anqgUlYqkgGrfTM="; })
+  (fetchNuGet { pname = "OmniSharp.Extensions.LanguageServer.Shared"; version = "0.19.5"; hash = "sha256-cBhiB/69T2b3xu+/D5o+AanglYTuaXU5OfIOW3WtnzE="; })
+  (fetchNuGet { pname = "RangeTree"; version = "3.0.1"; hash = "sha256-oq57hCNWp7I8xTtvExIbfcDNXoR8qxDVPCyDLDZCUac="; })
+  (fetchNuGet { pname = "runtime.any.System.Collections"; version = "4.3.0"; hash = "sha256-4PGZqyWhZ6/HCTF2KddDsbmTTjxs2oW79YfkberDZS8="; })
+  (fetchNuGet { pname = "runtime.any.System.Diagnostics.Tracing"; version = "4.3.0"; hash = "sha256-dsmTLGvt8HqRkDWP8iKVXJCS+akAzENGXKPV18W2RgI="; })
+  (fetchNuGet { pname = "runtime.any.System.Globalization"; version = "4.3.0"; hash = "sha256-PaiITTFI2FfPylTEk7DwzfKeiA/g/aooSU1pDcdwWLU="; })
+  (fetchNuGet { pname = "runtime.any.System.IO"; version = "4.3.0"; hash = "sha256-vej7ySRhyvM3pYh/ITMdC25ivSd0WLZAaIQbYj/6HVE="; })
+  (fetchNuGet { pname = "runtime.any.System.Reflection"; version = "4.3.0"; hash = "sha256-ns6f++lSA+bi1xXgmW1JkWFb2NaMD+w+YNTfMvyAiQk="; })
+  (fetchNuGet { pname = "runtime.any.System.Reflection.Extensions"; version = "4.3.0"; hash = "sha256-Y2AnhOcJwJVYv7Rp6Jz6ma0fpITFqJW+8rsw106K2X8="; })
+  (fetchNuGet { pname = "runtime.any.System.Reflection.Primitives"; version = "4.3.0"; hash = "sha256-LkPXtiDQM3BcdYkAm5uSNOiz3uF4J45qpxn5aBiqNXQ="; })
+  (fetchNuGet { pname = "runtime.any.System.Resources.ResourceManager"; version = "4.3.0"; hash = "sha256-9EvnmZslLgLLhJ00o5MWaPuJQlbUFcUF8itGQNVkcQ4="; })
+  (fetchNuGet { pname = "runtime.any.System.Runtime"; version = "4.3.0"; hash = "sha256-qwhNXBaJ1DtDkuRacgHwnZmOZ1u9q7N8j0cWOLYOELM="; })
+  (fetchNuGet { pname = "runtime.any.System.Runtime.Handles"; version = "4.3.0"; hash = "sha256-PQRACwnSUuxgVySO1840KvqCC9F8iI9iTzxNW0RcBS4="; })
+  (fetchNuGet { pname = "runtime.any.System.Runtime.InteropServices"; version = "4.3.0"; hash = "sha256-Kaw5PnLYIiqWbsoF3VKJhy7pkpoGsUwn4ZDCKscbbzA="; })
+  (fetchNuGet { pname = "runtime.any.System.Text.Encoding"; version = "4.3.0"; hash = "sha256-Q18B9q26MkWZx68exUfQT30+0PGmpFlDgaF0TnaIGCs="; })
+  (fetchNuGet { pname = "runtime.any.System.Text.Encoding.Extensions"; version = "4.3.0"; hash = "sha256-6MYj0RmLh4EVqMtO/MRqBi0HOn5iG4x9JimgCCJ+EFM="; })
+  (fetchNuGet { pname = "runtime.any.System.Threading.Tasks"; version = "4.3.0"; hash = "sha256-agdOM0NXupfHbKAQzQT8XgbI9B8hVEh+a/2vqeHctg4="; })
+  (fetchNuGet { pname = "runtime.debian.8-x64.runtime.native.System.Security.Cryptography.OpenSsl"; version = "4.3.0"; hash = "sha256-LXUPLX3DJxsU1Pd3UwjO1PO9NM2elNEDXeu2Mu/vNps="; })
+  (fetchNuGet { pname = "runtime.fedora.23-x64.runtime.native.System.Security.Cryptography.OpenSsl"; version = "4.3.0"; hash = "sha256-qeSqaUI80+lqw5MK4vMpmO0CZaqrmYktwp6L+vQAb0I="; })
+  (fetchNuGet { pname = "runtime.fedora.24-x64.runtime.native.System.Security.Cryptography.OpenSsl"; version = "4.3.0"; hash = "sha256-SrHqT9wrCBsxILWtaJgGKd6Odmxm8/Mh7Kh0CUkZVzA="; })
+  (fetchNuGet { pname = "runtime.native.System"; version = "4.0.0"; hash = "sha256-bmaM0ovT4X4aqDJOR255Yda/u3fmHZskU++lMnsy894="; })
+  (fetchNuGet { pname = "runtime.native.System"; version = "4.3.0"; hash = "sha256-ZBZaodnjvLXATWpXXakFgcy6P+gjhshFXmglrL5xD5Y="; })
+  (fetchNuGet { pname = "runtime.native.System.Security.Cryptography.OpenSsl"; version = "4.3.0"; hash = "sha256-Jy01KhtcCl2wjMpZWH+X3fhHcVn+SyllWFY8zWlz/6I="; })
+  (fetchNuGet { pname = "runtime.opensuse.13.2-x64.runtime.native.System.Security.Cryptography.OpenSsl"; version = "4.3.0"; hash = "sha256-wyv00gdlqf8ckxEdV7E+Ql9hJIoPcmYEuyeWb5Oz3mM="; })
+  (fetchNuGet { pname = "runtime.opensuse.42.1-x64.runtime.native.System.Security.Cryptography.OpenSsl"; version = "4.3.0"; hash = "sha256-zi+b4sCFrA9QBiSGDD7xPV27r3iHGlV99gpyVUjRmc4="; })
+  (fetchNuGet { pname = "runtime.osx.10.10-x64.runtime.native.System.Security.Cryptography.OpenSsl"; version = "4.3.0"; hash = "sha256-gybQU6mPgaWV3rBG2dbH6tT3tBq8mgze3PROdsuWnX0="; })
+  (fetchNuGet { pname = "runtime.rhel.7-x64.runtime.native.System.Security.Cryptography.OpenSsl"; version = "4.3.0"; hash = "sha256-VsP72GVveWnGUvS/vjOQLv1U80H2K8nZ4fDAmI61Hm4="; })
+  (fetchNuGet { pname = "runtime.ubuntu.14.04-x64.runtime.native.System.Security.Cryptography.OpenSsl"; version = "4.3.0"; hash = "sha256-4yKGa/IrNCKuQ3zaDzILdNPD32bNdy6xr5gdJigyF5g="; })
+  (fetchNuGet { pname = "runtime.ubuntu.16.04-x64.runtime.native.System.Security.Cryptography.OpenSsl"; version = "4.3.0"; hash = "sha256-HmdJhhRsiVoOOCcUvAwdjpMRiyuSwdcgEv2j9hxi+Zc="; })
+  (fetchNuGet { pname = "runtime.ubuntu.16.10-x64.runtime.native.System.Security.Cryptography.OpenSsl"; version = "4.3.0"; hash = "sha256-pVFUKuPPIx0edQKjzRon3zKq8zhzHEzko/lc01V/jdw="; })
+  (fetchNuGet { pname = "runtime.unix.Microsoft.Win32.Primitives"; version = "4.3.0"; hash = "sha256-LZb23lRXzr26tRS5aA0xyB08JxiblPDoA7HBvn6awXg="; })
+  (fetchNuGet { pname = "runtime.unix.System.Diagnostics.Debug"; version = "4.3.0"; hash = "sha256-ReoazscfbGH+R6s6jkg5sIEHWNEvjEoHtIsMbpc7+tI="; })
+  (fetchNuGet { pname = "runtime.unix.System.IO.FileSystem"; version = "4.3.0"; hash = "sha256-Pf4mRl6YDK2x2KMh0WdyNgv0VUNdSKVDLlHqozecy5I="; })
+  (fetchNuGet { pname = "runtime.unix.System.Private.Uri"; version = "4.3.0"; hash = "sha256-c5tXWhE/fYbJVl9rXs0uHh3pTsg44YD1dJvyOA0WoMs="; })
+  (fetchNuGet { pname = "runtime.unix.System.Runtime.Extensions"; version = "4.3.0"; hash = "sha256-l8S9gt6dk3qYG6HYonHtdlYtBKyPb29uQ6NDjmrt3V4="; })
+  (fetchNuGet { pname = "Serilog"; version = "2.12.0"; hash = "sha256-JD+ud+CFoLGdYGasTWKTxx5PYj2W5pBv2lMybBK7HVM="; })
+  (fetchNuGet { pname = "Serilog.Extensions.Logging"; version = "3.0.1"; hash = "sha256-KtHMMnepmEpOlHrIGlUkK6Vq1L0iBBnFGavbUtvxOBk="; })
+  (fetchNuGet { pname = "Serilog.Settings.Configuration"; version = "3.1.0"; hash = "sha256-ZU0eb88tVMRKrfz9ewcmtCmWFqZeVLdeGGMcYElVRbI="; })
+  (fetchNuGet { pname = "Serilog.Sinks.Debug"; version = "2.0.0"; hash = "sha256-/PLVAE33lTdUEXdahkI5ddFiGZufWnvfsOodQsFB8sQ="; })
+  (fetchNuGet { pname = "Serilog.Sinks.File"; version = "5.0.0"; hash = "sha256-GKy9hwOdlu2W0Rw8LiPyEwus+sDtSOTl8a5l9uqz+SQ="; })
+  (fetchNuGet { pname = "System.AppContext"; version = "4.1.0"; hash = "sha256-v6YfyfrKmhww+EYHUq6cwYUMj00MQ6SOfJtcGVRlYzs="; })
+  (fetchNuGet { pname = "System.Buffers"; version = "4.3.0"; hash = "sha256-XqZWb4Kd04960h4U9seivjKseGA/YEIpdplfHYHQ9jk="; })
+  (fetchNuGet { pname = "System.Collections"; version = "4.3.0"; hash = "sha256-afY7VUtD6w/5mYqrce8kQrvDIfS2GXDINDh73IjxJKc="; })
+  (fetchNuGet { pname = "System.Collections.Immutable"; version = "1.7.0"; hash = "sha256-/RMBxUUublGaWERAnTk74QmrSQbX+xs84yFqmawmM74="; })
+  (fetchNuGet { pname = "System.Collections.Immutable"; version = "1.7.1"; hash = "sha256-WMMAUqoxT3J1gW9DI8v31VAuhwqTc4Posose5jq1BNo="; })
+  (fetchNuGet { pname = "System.CommandLine"; version = "2.0.0-beta4.22272.1"; hash = "sha256-zSO+CYnMH8deBHDI9DHhCPj79Ce3GOzHCyH1/TiHxcc="; })
+  (fetchNuGet { pname = "System.Configuration.ConfigurationManager"; version = "6.0.0"; hash = "sha256-fPV668Cfi+8pNWrvGAarF4fewdPVEDwlJWvJk0y+Cms="; })
+  (fetchNuGet { pname = "System.Diagnostics.Debug"; version = "4.3.0"; hash = "sha256-fkA79SjPbSeiEcrbbUsb70u9B7wqbsdM9s1LnoKj0gM="; })
+  (fetchNuGet { pname = "System.Diagnostics.Tracing"; version = "4.3.0"; hash = "sha256-hCETZpHHGVhPYvb4C0fh4zs+8zv4GPoixagkLZjpa9Q="; })
+  (fetchNuGet { pname = "System.Drawing.Common"; version = "6.0.0"; hash = "sha256-/9EaAbEeOjELRSMZaImS1O8FmUe8j4WuFUw1VOrPyAo="; })
+  (fetchNuGet { pname = "System.Dynamic.Runtime"; version = "4.0.11"; hash = "sha256-qWqFVxuXioesVftv2RVJZOnmojUvRjb7cS3Oh3oTit4="; })
+  (fetchNuGet { pname = "System.Globalization"; version = "4.0.11"; hash = "sha256-rbSgc2PIEc2c2rN6LK3qCREAX3DqA2Nq1WcLrZYsDBw="; })
+  (fetchNuGet { pname = "System.Globalization"; version = "4.3.0"; hash = "sha256-caL0pRmFSEsaoeZeWN5BTQtGrAtaQPwFi8YOZPZG5rI="; })
+  (fetchNuGet { pname = "System.IO"; version = "4.1.0"; hash = "sha256-V6oyQFwWb8NvGxAwvzWnhPxy9dKOfj/XBM3tEC5aHrw="; })
+  (fetchNuGet { pname = "System.IO"; version = "4.3.0"; hash = "sha256-ruynQHekFP5wPrDiVyhNiRIXeZ/I9NpjK5pU+HPDiRY="; })
+  (fetchNuGet { pname = "System.IO.FileSystem"; version = "4.0.1"; hash = "sha256-4VKXFgcGYCTWVXjAlniAVq0dO3o5s8KHylg2wg2/7k0="; })
+  (fetchNuGet { pname = "System.IO.FileSystem.Primitives"; version = "4.3.0"; hash = "sha256-LMnfg8Vwavs9cMnq9nNH8IWtAtSfk0/Fy4s4Rt9r1kg="; })
+  (fetchNuGet { pname = "System.IO.Pipelines"; version = "4.7.3"; hash = "sha256-nis1vH2bdwxvbKm00PYvGzIbmCwX9U5AbJFOU3oqVzY="; })
+  (fetchNuGet { pname = "System.Linq"; version = "4.1.0"; hash = "sha256-ZQpFtYw5N1F1aX0jUK3Tw+XvM5tnlnshkTCNtfVA794="; })
+  (fetchNuGet { pname = "System.Linq.Async"; version = "6.0.1"; hash = "sha256-uH5fZhcyQVtnsFc6GTUaRRrAQm05v5euJyWCXSFSOYI="; })
+  (fetchNuGet { pname = "System.Linq.Expressions"; version = "4.1.0"; hash = "sha256-7zqB+FXgkvhtlBzpcZyd81xczWP0D3uWssyAGw3t7b4="; })
+  (fetchNuGet { pname = "System.Net.WebSockets"; version = "4.3.0"; hash = "sha256-l3h3cF1cCC9zMhWLKSDnZBZvFADUd0Afe2+iAwBA0r0="; })
+  (fetchNuGet { pname = "System.ObjectModel"; version = "4.0.12"; hash = "sha256-MudZ/KYcvYsn2cST3EE049mLikrNkmE7QoUoYKKby+s="; })
+  (fetchNuGet { pname = "System.Private.Uri"; version = "4.3.0"; hash = "sha256-fVfgcoP4AVN1E5wHZbKBIOPYZ/xBeSIdsNF+bdukIRM="; })
+  (fetchNuGet { pname = "System.Reactive"; version = "4.4.1"; hash = "sha256-inA6nw9CX0g/AeygMwJoARGOY79pli/jLF54CweUqD8="; })
+  (fetchNuGet { pname = "System.Reflection"; version = "4.1.0"; hash = "sha256-idZHGH2Yl/hha1CM4VzLhsaR8Ljo/rV7TYe7mwRJSMs="; })
+  (fetchNuGet { pname = "System.Reflection"; version = "4.3.0"; hash = "sha256-NQSZRpZLvtPWDlvmMIdGxcVuyUnw92ZURo0hXsEshXY="; })
+  (fetchNuGet { pname = "System.Reflection.Emit"; version = "4.0.1"; hash = "sha256-F1MvYoQWHCY89/O4JBwswogitqVvKuVfILFqA7dmuHk="; })
+  (fetchNuGet { pname = "System.Reflection.Emit.ILGeneration"; version = "4.0.1"; hash = "sha256-YG+eJBG5P+5adsHiw/lhJwvREnvdHw6CJyS8ZV4Ujd0="; })
+  (fetchNuGet { pname = "System.Reflection.Emit.Lightweight"; version = "4.0.1"; hash = "sha256-uVvNOnL64CPqsgZP2OLqNmxdkZl6Q0fTmKmv9gcBi+g="; })
+  (fetchNuGet { pname = "System.Reflection.Extensions"; version = "4.0.1"; hash = "sha256-NsfmzM9G/sN3H8X2cdnheTGRsh7zbRzvegnjDzDH/FQ="; })
+  (fetchNuGet { pname = "System.Reflection.Metadata"; version = "1.6.0"; hash = "sha256-JJfgaPav7UfEh4yRAQdGhLZF1brr0tUWPl6qmfNWq/E="; })
+  (fetchNuGet { pname = "System.Reflection.Primitives"; version = "4.0.1"; hash = "sha256-SFSfpWEyCBMAOerrMCOiKnpT+UAWTvRcmoRquJR6Vq0="; })
+  (fetchNuGet { pname = "System.Reflection.Primitives"; version = "4.3.0"; hash = "sha256-5ogwWB4vlQTl3jjk1xjniG2ozbFIjZTL9ug0usZQuBM="; })
+  (fetchNuGet { pname = "System.Reflection.TypeExtensions"; version = "4.1.0"; hash = "sha256-R0YZowmFda+xzKNR4kKg7neFoE30KfZwp/IwfRSKVK4="; })
+  (fetchNuGet { pname = "System.Resources.ResourceManager"; version = "4.0.1"; hash = "sha256-cZ2/3/fczLjEpn6j3xkgQV9ouOVjy4Kisgw5xWw9kSw="; })
+  (fetchNuGet { pname = "System.Resources.ResourceManager"; version = "4.3.0"; hash = "sha256-idiOD93xbbrbwwSnD4mORA9RYi/D/U48eRUsn/WnWGo="; })
+  (fetchNuGet { pname = "System.Runtime"; version = "4.1.0"; hash = "sha256-FViNGM/4oWtlP6w0JC0vJU+k9efLKZ+yaXrnEeabDQo="; })
+  (fetchNuGet { pname = "System.Runtime"; version = "4.3.0"; hash = "sha256-51813WXpBIsuA6fUtE5XaRQjcWdQ2/lmEokJt97u0Rg="; })
+  (fetchNuGet { pname = "System.Runtime.Caching"; version = "6.0.0"; hash = "sha256-CpjpZoc6pdE83QPAGYzpBYQAZiAiqyrgiMQvdo5CCXI="; })
+  (fetchNuGet { pname = "System.Runtime.CompilerServices.Unsafe"; version = "4.4.0"; hash = "sha256-SeTI4+yVRO2SmAKgOrMni4070OD+Oo8L1YiEVeKDyig="; })
+  (fetchNuGet { pname = "System.Runtime.CompilerServices.Unsafe"; version = "4.7.1"; hash = "sha256-UvyoDV8O0oY3HPG1GbA56YVdvwTGEfjYR5gW1O7IK4U="; })
+  (fetchNuGet { pname = "System.Runtime.Extensions"; version = "4.1.0"; hash = "sha256-X7DZ5CbPY7jHs20YZ7bmcXs9B5Mxptu/HnBUvUnNhGc="; })
+  (fetchNuGet { pname = "System.Runtime.Extensions"; version = "4.3.0"; hash = "sha256-wLDHmozr84v1W2zYCWYxxj0FR0JDYHSVRaRuDm0bd/o="; })
+  (fetchNuGet { pname = "System.Runtime.Handles"; version = "4.0.1"; hash = "sha256-j2QgVO9ZOjv7D1het98CoFpjoYgxjupuIhuBUmLLH7w="; })
+  (fetchNuGet { pname = "System.Runtime.Handles"; version = "4.3.0"; hash = "sha256-KJ5aXoGpB56Y6+iepBkdpx/AfaJDAitx4vrkLqR7gms="; })
+  (fetchNuGet { pname = "System.Runtime.InteropServices"; version = "4.1.0"; hash = "sha256-QceAYlJvkPRJc/+5jR+wQpNNI3aqGySWWSO30e/FfQY="; })
+  (fetchNuGet { pname = "System.Runtime.InteropServices"; version = "4.3.0"; hash = "sha256-8sDH+WUJfCR+7e4nfpftj/+lstEiZixWUBueR2zmHgI="; })
+  (fetchNuGet { pname = "System.Runtime.InteropServices.RuntimeInformation"; version = "4.0.0"; hash = "sha256-5j53amb76A3SPiE3B0llT2XPx058+CgE7OXL4bLalT4="; })
+  (fetchNuGet { pname = "System.Runtime.Numerics"; version = "4.3.0"; hash = "sha256-P5jHCgMbgFMYiONvzmaKFeOqcAIDPu/U8bOVrNPYKqc="; })
+  (fetchNuGet { pname = "System.Security.AccessControl"; version = "4.6.0"; hash = "sha256-rspJ63MbjNVDve0owXby0Pu2vHjQvR2uuhCDCJ9vgfI="; })
+  (fetchNuGet { pname = "System.Security.AccessControl"; version = "6.0.0"; hash = "sha256-qOyWEBbNr3EjyS+etFG8/zMbuPjA+O+di717JP9Cxyg="; })
+  (fetchNuGet { pname = "System.Security.Cryptography.ProtectedData"; version = "6.0.0"; hash = "sha256-Wi9I9NbZlpQDXgS7Kl06RIFxY/9674S7hKiYw5EabRY="; })
+  (fetchNuGet { pname = "System.Security.Permissions"; version = "6.0.0"; hash = "sha256-/MMvtFWGN/vOQfjXdOhet1gsnMgh6lh5DCHimVsnVEs="; })
+  (fetchNuGet { pname = "System.Security.Principal.Windows"; version = "4.6.0"; hash = "sha256-lZeXm45RboVgqnPQVJ65y8b5b+9FSVr0MBciG777rso="; })
+  (fetchNuGet { pname = "System.Text.Encoding"; version = "4.0.11"; hash = "sha256-PEailOvG05CVgPTyKLtpAgRydlSHmtd5K0Y8GSHY2Lc="; })
+  (fetchNuGet { pname = "System.Text.Encoding"; version = "4.3.0"; hash = "sha256-GctHVGLZAa/rqkBNhsBGnsiWdKyv6VDubYpGkuOkBLg="; })
+  (fetchNuGet { pname = "System.Text.Encoding.Extensions"; version = "4.3.0"; hash = "sha256-vufHXg8QAKxHlujPHHcrtGwAqFmsCD6HKjfDAiHyAYc="; })
+  (fetchNuGet { pname = "System.Threading"; version = "4.0.11"; hash = "sha256-mob1Zv3qLQhQ1/xOLXZmYqpniNUMCfn02n8ZkaAhqac="; })
+  (fetchNuGet { pname = "System.Threading"; version = "4.3.0"; hash = "sha256-ZDQ3dR4pzVwmaqBg4hacZaVenQ/3yAF/uV7BXZXjiWc="; })
+  (fetchNuGet { pname = "System.Threading.Channels"; version = "4.7.1"; hash = "sha256-IkMmQnF9QfV+9EScPEwHypcK0+HTPu6K1J9fH3P2Dg0="; })
+  (fetchNuGet { pname = "System.Threading.Tasks"; version = "4.0.11"; hash = "sha256-5SLxzFg1df6bTm2t09xeI01wa5qQglqUwwJNlQPJIVs="; })
+  (fetchNuGet { pname = "System.Threading.Tasks"; version = "4.3.0"; hash = "sha256-Z5rXfJ1EXp3G32IKZGiZ6koMjRu0n8C1NGrwpdIen4w="; })
+  (fetchNuGet { pname = "System.Threading.Tasks.Extensions"; version = "4.5.3"; hash = "sha256-8TglbC6KBHlDeSfgr6d5dGn7wu8td4XERl2JUyo0+Tw="; })
+  (fetchNuGet { pname = "System.Windows.Extensions"; version = "6.0.0"; hash = "sha256-N+qg1E6FDJ9A9L50wmVt3xPQV8ZxlG1xeXgFuxO+yfM="; })
+  (fetchNuGet { pname = "Tomlyn"; version = "0.16.2"; hash = "sha256-ULW4n8s2lvTMG3I18rpsVfXtKXN7C8nPrMXQowxGIsU="; })
 ]

pkgs/applications/terminal-emulators/kitty/default.nix

@@ -25,28 +25,28 @@
 , zsh
 , fish
 , nixosTests
-, go
-, buildGoModule
+, go_1_23
+, buildGo123Module
 , nix-update-script
 }:
 
 with python3Packages;
 buildPythonApplication rec {
   pname = "kitty";
-  version = "0.36.1";
+  version = "0.36.4";
   format = "other";
 
   src = fetchFromGitHub {
     owner = "kovidgoyal";
     repo = "kitty";
     rev = "refs/tags/v${version}";
-    hash = "sha256-7+MxxgQQlAje7klfJvvEWe8CfxyN0oTGQJ/QOORFUsY=";
+    hash = "sha256-nN0y2VKK5UNaozpHQNPN7AYkto9z6rJNpYRJhvLPtVQ=";
   };
 
-  goModules = (buildGoModule {
+  goModules = (buildGo123Module {
     pname = "kitty-go-modules";
     inherit src version;
-    vendorHash = "sha256-YN4sSdDNDIVgtcykg60H0bZEryRHJJfZ5rXWUMYXGr4=";
+    vendorHash = "sha256-8hsQH7OdsxeVG6pomuxdmTXNmQYBROoUUxoC10LeLFo=";
   }).goModules;
 
   buildInputs = [
@@ -82,7 +82,7 @@ buildPythonApplication rec {
     sphinx-copybutton
     sphinxext-opengraph
     sphinx-inline-tabs
-    go
+    go_1_23
     fontconfig
   ] ++ lib.optionals stdenv.hostPlatform.isDarwin [
     imagemagick

pkgs/applications/version-management/fnc/default.nix

@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "fnc";
-  version = "0.16";
+  version = "0.18";
 
   src = fetchurl {
     url = "https://fnc.bsdbox.org/tarball/${finalAttrs.version}/fnc-${finalAttrs.version}.tar.gz";
-    hash = "sha256-6I6wtSMHaKdnlUK4pYiaybJeODGu2P+smYW8lQDIWGM=";
+    hash = "sha256-npS+sOxF0S/9TuFjtEFlev0HpIOsaP6zmcfopPNUehk=";
   };
 
   buildInputs = [ libiconv ncurses zlib ];

pkgs/applications/video/mpv/scripts/quality-menu.nix

@@ -8,13 +8,13 @@
 
 buildLua rec {
   pname = "mpv-quality-menu";
-  version = "4.1.1";
+  version = "4.1.2";
 
   src = fetchFromGitHub {
     owner = "christoph-heinrich";
     repo = "mpv-quality-menu";
     rev = "v${version}";
-    hash = "sha256-yrcTxqpLnOI1Tq3khhflO3wzhyeTPuvKifyH5/P57Ns=";
+    hash = "sha256-W7N8H+kq/bhF917TutyilfT8FBbWmbSFUrHd8a8k5Jg=";
   };
   passthru.updateScript = gitUpdater { rev-prefix = "v"; };
 

pkgs/applications/window-managers/hyprwm/xdg-desktop-portal-hyprland/default.nix

@@ -27,13 +27,13 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "xdg-desktop-portal-hyprland";
-  version = "1.3.5";
+  version = "1.3.6";
 
   src = fetchFromGitHub {
     owner = "hyprwm";
     repo = "xdg-desktop-portal-hyprland";
     rev = "refs/tags/v${finalAttrs.version}";
-    hash = "sha256-xTqnMoJsEojuvqJLuM+U7EZ7q71efaj3pbvjutq4TXc=";
+    hash = "sha256-1DGktDtSWIJpnDbVoj/qpvJSH5zg6JbOfuh6xqZMap0=";
   };
 
   depsBuildBuild = [

pkgs/build-support/fetchbzr/default.nix

@@ -1,15 +1,16 @@
-{ stdenvNoCC, breezy }:
-{ url, rev, sha256 }:
+{ lib, stdenvNoCC, breezy }:
+lib.fetchers.withNormalizedHash { } (
+  { url, rev, outputHash, outputHashAlgo }:
 
-stdenvNoCC.mkDerivation {
-  name = "bzr-export";
+  stdenvNoCC.mkDerivation {
+    name = "bzr-export";
 
-  builder = ./builder.sh;
-  nativeBuildInputs = [ breezy ];
+    builder = ./builder.sh;
+    nativeBuildInputs = [ breezy ];
 
-  outputHashAlgo = "sha256";
-  outputHashMode = "recursive";
-  outputHash = sha256;
+    inherit outputHash outputHashAlgo;
+    outputHashMode = "recursive";
 
-  inherit url rev;
-}
+    inherit url rev;
+  }
+)

pkgs/build-support/fetchbzr/nix-prefetch-bzr

@@ -9,7 +9,7 @@ if test -z "$hashType"; then
     hashType=sha256
 fi
 if test -z "$hashFormat"; then
-    hashFormat=--base32
+    hashFormat=--sri
 fi
 
 if test -z "$url"; then

pkgs/build-support/fetchcvs/default.nix

@@ -6,17 +6,18 @@
 {stdenvNoCC, cvs, openssh, lib}:
 
 lib.makeOverridable (
-{cvsRoot, module, tag ? null, date ? null, sha256}:
+  lib.fetchers.withNormalizedHash { } (
+    {cvsRoot, module, tag ? null, date ? null, outputHash, outputHashAlgo}:
 
-stdenvNoCC.mkDerivation {
-  name = "cvs-export";
-  builder = ./builder.sh;
-  nativeBuildInputs = [cvs openssh];
+    stdenvNoCC.mkDerivation {
+      name = "cvs-export";
+      builder = ./builder.sh;
+      nativeBuildInputs = [cvs openssh];
 
-  outputHashAlgo = "sha256";
-  outputHashMode = "recursive";
-  outputHash = sha256;
+      inherit outputHash outputHashAlgo;
+      outputHashMode = "recursive";
 
-  inherit cvsRoot module sha256 tag date;
-}
+      inherit cvsRoot module tag date;
+    }
+  )
 )

pkgs/build-support/fetchcvs/nix-prefetch-cvs

@@ -59,7 +59,7 @@ if test -z "$finalPath"; then
     (cd "$tmpPath" && cvs -f -z0 -d $cvsRoot export "${args[*]}" -d cvs-export $module >&2)
 
     # Compute the hash.
-    hash=$(nix-hash --type $hashType $hashFormat $tmpFile)
+    hash=$(nix-hash --type $hashType ${hashFormat:-"--sri"} $tmpFile)
     if ! test -n "$QUIET"; then echo "hash is $hash" >&2; fi
 
     # Add the downloaded file to the Nix store.

pkgs/build-support/fetchdarcs/default.nix

@@ -1,21 +1,23 @@
 {stdenvNoCC, darcs, cacert, lib}:
 
 lib.makeOverridable (
-{ url
-, rev ? null
-, context ? null
-, sha256 ? ""
-, name ? "fetchdarcs"
-}:
+  lib.fetchers.withNormalizedHash { } (
+    { url
+    , rev ? null
+    , context ? null
+    , outputHash ? lib.fakeHash
+    , outputHashAlgo ? null
+    , name ? "fetchdarcs"
+    }:
 
-stdenvNoCC.mkDerivation {
-  builder = ./builder.sh;
-  nativeBuildInputs = [cacert darcs];
+    stdenvNoCC.mkDerivation {
+      builder = ./builder.sh;
+      nativeBuildInputs = [cacert darcs];
 
-  outputHashAlgo = "sha256";
-  outputHashMode = "recursive";
-  outputHash = sha256;
+      inherit outputHash outputHashAlgo;
+      outputHashMode = "recursive";
 
-  inherit url rev context name;
-}
+      inherit url rev context name;
+    }
+  )
 )

pkgs/build-support/fetchfossil/default.nix

@@ -1,33 +1,26 @@
 {stdenv, lib, fossil, cacert}:
 
-{ name ? null
-, url
-, rev
-, sha256 ? ""
-, hash ? ""
-}:
+lib.fetchers.withNormalizedHash { } (
+  { name ? null
+  , url
+  , rev
+  , outputHash ? lib.fakeHash
+  , outputHashAlgo ? null
+  }:
 
-if hash != "" && sha256 != "" then
-  throw "Only one of sha256 or hash can be set"
-else
-stdenv.mkDerivation {
-  name = "fossil-archive" + (lib.optionalString (name != null) "-${name}");
-  builder = ./builder.sh;
-  nativeBuildInputs = [fossil cacert];
+  stdenv.mkDerivation {
+    name = "fossil-archive" + (lib.optionalString (name != null) "-${name}");
+    builder = ./builder.sh;
+    nativeBuildInputs = [fossil cacert];
 
-  # Envvar docs are hard to find. A link for the future:
-  # https://www.fossil-scm.org/index.html/doc/trunk/www/env-opts.md
-  impureEnvVars = [ "http_proxy" ];
+    # Envvar docs are hard to find. A link for the future:
+    # https://www.fossil-scm.org/index.html/doc/trunk/www/env-opts.md
+    impureEnvVars = [ "http_proxy" ];
 
-  outputHashAlgo = if hash != "" then null else "sha256";
-  outputHashMode = "recursive";
-  outputHash = if hash != "" then
-    hash
-  else if sha256 != "" then
-    sha256
-  else
-    lib.fakeSha256;
+    inherit outputHash outputHashAlgo;
+    outputHashMode = "recursive";
 
-  inherit url rev;
-  preferLocalBuild = true;
-}
+    inherit url rev;
+    preferLocalBuild = true;
+  }
+)