Merge remote-tracking branch 'origin/staging-next' into staging

doc/languages-frameworks/java.section.md

@@ -33,8 +33,7 @@ stdenv.mkDerivation {
 ```
 
 Note that `jdk` is an alias for the OpenJDK (self-built where available,
-or pre-built via Zulu). Platforms with OpenJDK not (yet) in Nixpkgs
-(`Aarch32`, `Aarch64`) point to the (unfree) `oraclejdk`.
+or pre-built via Zulu).
 
 Also note that not using `stripJavaArchivesHook` will likely cause the
 generated `.jar` files to be non-deterministic, which is not optimal.

maintainers/maintainer-list.nix

@@ -4368,6 +4368,12 @@
     githubId = 18414241;
     name = "Andreas Erdes";
   };
+  computerdane = {
+    email = "danerieber@gmail.com";
+    github = "computerdane";
+    githubId = 6487079;
+    name = "Dane Rieber";
+  };
   confus = {
     email = "con-f-use@gmx.net";
     github = "con-f-use";
@@ -4766,12 +4772,6 @@
     githubId = 24708079;
     name = "Dan Eads";
   };
-  danerieber = {
-    email = "danerieber@gmail.com";
-    github = "danerieber";
-    githubId = 6487079;
-    name = "Dane Rieber";
-  };
   danid3v = {
     email = "sch220233@spengergasse.at";
     github = "DaniD3v";
@@ -15580,6 +15580,12 @@
     githubId = 3159451;
     name = "Nicolas Schneider";
   };
+  nipeharefa = {
+    name = "Nipe Harefa";
+    email = "nipeharefa@gmail.com";
+    github = "nipeharefa";
+    githubId = 12620257;
+  };
   NIS = {
     name = "NSC IT Solutions";
     github = "dev-nis";

nixos/doc/manual/release-notes/rl-2411.section.md

@@ -333,6 +333,11 @@
   This change requires granting access to the repositories to this user or
   setting the appropriate one through `services.cgit.some-instance.user`.
 
+- All Oracle JDKs and JREs (`oraclejdk`, `oraclejdk8`, `oraclejre`, `oraclejre8`,
+  `jrePlugin`, `jre8Plugin`, `jdkdistro`, `oraclejdk8distro`, and `oraclejdk11`)
+  were dropped due to being unmaintained and heavily insecure. OpenJDK provides
+  compatible replacements for JDKs and JREs.
+
 - `gradle_6` was removed due to being [unsupported upstream as of 10 Feb 2023](https://endoflife.date/gradle).
   Additionally, it had numerous security vulnerabilities that were only patched
   in later versions, such as [CVE-2021-29429](https://nvd.nist.gov/vuln/detail/CVE-2021-32751),
@@ -342,6 +347,9 @@
   nvimpager settings: user commands in `-c` and `--cmd` now override the
   respective default settings because they are executed later.
 
+- `javacard-devkit` was dropped due to having a dependency on the Oracle JDK,
+  as well as being several years out-of-date.
+
 - Kubernetes `featureGates` have changed from a `listOf str` to `attrsOf bool`.
   This refactor makes it possible to also disable feature gates, without having
   to use `extraOpts` flags.
@@ -388,6 +396,9 @@
 
 - `services.pgbouncer` systemd service is configured with `Type=notify-reload` and allows reloading configuration without process restart. PgBouncer configuration options were moved to the free-form type option named [`services.pgbouncer.settings`](#opt-services.pgbouncer.settings) according to the NixOS RFC 0042.
 
+- Docear was removed because it was unmaintained upstream.
+  JabRef, Zotero, or Mendeley are potential replacements.
+
 - `nodePackages.coc-metals` was removed due to being deprecated upstream.
   `vimPlugins.nvim-metals` is its official replacement.
 
@@ -492,6 +503,9 @@
 
 - PPD files for Utax printers got renamed (spaces replaced by underscores) in newest `foomatic-db` package; users of Utax printers might need to adapt their `hardware.printers.ensurePrinters.*.model` value.
 
+- `sqldeveloper` was dropped due to being severely out-of-date and having a dependency on
+  JavaFX for Java 8, which we do not support.
+
 - The `kvdo` kernel module package was removed, because it was upstreamed in kernel version 6.9, where it is called `dm-vdo`.
 
 - `libe57format` has been updated to `>= 3.0.0`, which contains some backward-incompatible API changes. See the [release note](https://github.com/asmaloney/libE57Format/releases/tag/v3.0.0) for more details.
@@ -663,6 +677,15 @@
   lists by default. Backwards-compatible behavior can be enabled with
   `atomsCoercedToLists`.
 
+- Atlassian Server products have been removed, as support for the Atlassian Server
+  products ended in February 2024 and there was insufficient interest in
+  maintaining the Atlassian Data Center replacements:
+  - The `atlassian-bamboo` package
+  - The `atlassian-confluence` package and its `services.confluence` NixOS module
+  - The `atlassian-crowd` package and its `services.crowd` NixOS module
+  - The `atlassian-jira` package and its `services.jira` NixOS module
+
+
 - `python3Packages.nose` has been removed, as it has been deprecated and unmaintained for almost a decade and does not work on Python 3.12.
   Please switch to `pytest` or another test runner/framework.
 
@@ -790,6 +813,11 @@
 
 - `iproute2` now has libbpf support.
 
+- `postgresql` is now [hardened by default](#module-services-postgres-hardening) using the common `systemd` settings for that.
+
+  If you use extensions that are not packaged in nixpkgs, please review whether it still works
+  with the current settings and adjust accordingly if needed.
+
 - `nix.channel.enable = false` no longer implies `nix.settings.nix-path = []`.
   Since Nix 2.13, a `nix-path` set in `nix.conf` cannot be overridden by the `NIX_PATH` configuration variable.
 

nixos/modules/module-list.nix

@@ -1390,9 +1390,6 @@
   ./services/web-apps/alps.nix
   ./services/web-apps/anuko-time-tracker.nix
   ./services/web-apps/artalk.nix
-  ./services/web-apps/atlassian/confluence.nix
-  ./services/web-apps/atlassian/crowd.nix
-  ./services/web-apps/atlassian/jira.nix
   ./services/web-apps/audiobookshelf.nix
   ./services/web-apps/bluemap.nix
   ./services/web-apps/bookstack.nix

nixos/modules/rename.nix

@@ -62,7 +62,9 @@ in
     (mkRemovedOptionModule [ "services" "beegfsEnable" ] "The BeeGFS module has been removed")
     (mkRemovedOptionModule [ "services" "cgmanager" "enable"] "cgmanager was deprecated by lxc and therefore removed from nixpkgs.")
     (mkRemovedOptionModule [ "services" "chronos" ] "The corresponding package was removed from nixpkgs.")
+    (mkRemovedOptionModule [ "services" "confluence" ] "Atlassian software has been removed, as support for the Atlassian Server products ended in February 2024 and there was insufficient interest in maintaining the Atlassian Data Center replacements")
     (mkRemovedOptionModule [ "services" "couchpotato" ] "The corresponding package was removed from nixpkgs.")
+    (mkRemovedOptionModule [ "services" "crowd" ] "Atlassian software has been removed, as support for the Atlassian Server products ended in February 2024 and there was insufficient interest in maintaining the Atlassian Data Center replacements")
     (mkRemovedOptionModule [ "services" "dd-agent" ] "dd-agent was removed from nixpkgs in favor of the newer datadog-agent.")
     (mkRemovedOptionModule [ "services" "dnscrypt-proxy" ] "Use services.dnscrypt-proxy2 instead")
     (mkRemovedOptionModule [ "services" "dnscrypt-wrapper" ] ''
@@ -82,6 +84,7 @@ in
     (mkRemovedOptionModule [ "services" "homeassistant-satellite"] "The `services.homeassistant-satellite` module has been replaced by `services.wyoming-satellite`.")
     (mkRemovedOptionModule [ "services" "hydron" ] "The `services.hydron` module has been removed as the project has been archived upstream since 2022 and is affected by a severe remote code execution vulnerability.")
     (mkRemovedOptionModule [ "services" "ihatemoney" ] "The ihatemoney module has been removed for lack of downstream maintainer")
+    (mkRemovedOptionModule [ "services" "jira" ] "Atlassian software has been removed, as support for the Atlassian Server products ended in February 2024 and there was insufficient interest in maintaining the Atlassian Data Center replacements")
     (mkRemovedOptionModule [ "services" "kippo" ] "The corresponding package was removed from nixpkgs.")
     (mkRemovedOptionModule [ "services" "lshd" ] "The corresponding package was removed from nixpkgs as it had no maintainer in Nixpkgs and hasn't seen an upstream release in over a decades.")
     (mkRemovedOptionModule [ "services" "mailpile" ] "The corresponding package was removed from nixpkgs.")

nixos/modules/services/databases/postgresql.md

@@ -364,6 +364,24 @@ postgresql.withJIT.pname
 
 evaluates to `"foobar"`.
 
+## Service hardening {#module-services-postgres-hardening}
+
+The service created by the [`postgresql`-module](#opt-services.postgresql.enable) uses
+several common hardening options from `systemd`, most notably:
+
+* Memory pages must not be both writable and executable (this only applies to non-JIT setups).
+* A system call filter (see {manpage}`systemd.exec(5)` for details on `@system-service`).
+* A stricter default UMask (`0027`).
+* Only sockets of type `AF_INET`/`AF_INET6`/`AF_NETLINK`/`AF_UNIX` allowed.
+* Restricted filesystem access (private `/tmp`, most of the file-system hierachy is mounted read-only, only process directories in `/proc` that are owned by the same user).
+
+The NixOS module also contains necessary adjustments for extensions from `nixpkgs`
+if these are enabled. If an extension or a postgresql feature from `nixpkgs` breaks
+with hardening, it's considered a bug.
+
+When using extensions that are not packaged in `nixpkgs`, hardening adjustments may
+become necessary.
+
 ## Notable differences to upstream {#module-services-postgres-upstream-deviation}
 
 - To avoid circular dependencies between default and -dev outputs, the output of the `pg_config` system view has been removed.

nixos/modules/services/databases/postgresql.nix

@@ -623,7 +623,46 @@ in
             TimeoutSec = 120;
 
             ExecStart = "${postgresql}/bin/postgres";
+
+            # Hardening
+            CapabilityBoundingSet = [ "" ];
+            DevicePolicy = "closed";
+            PrivateTmp = true;
+            ProtectHome = true;
+            ProtectSystem = "strict";
+            MemoryDenyWriteExecute = lib.mkDefault (cfg.settings.jit == "off");
+            NoNewPrivileges = true;
+            LockPersonality = true;
+            PrivateDevices = true;
+            PrivateMounts = true;
+            ProcSubset = "pid";
+            ProtectClock = true;
+            ProtectControlGroups = true;
+            ProtectHostname = true;
+            ProtectKernelLogs = true;
+            ProtectKernelModules = true;
+            ProtectKernelTunables = true;
+            ProtectProc = "invisible";
+            RemoveIPC = true;
+            RestrictAddressFamilies = [
+              "AF_INET"
+              "AF_INET6"
+              "AF_NETLINK" # used for network interface enumeration
+              "AF_UNIX"
+            ];
+            RestrictNamespaces = true;
+            RestrictRealtime = true;
+            RestrictSUIDSGID = true;
+            SystemCallArchitectures = "native";
+            SystemCallFilter = [
+              "@system-service"
+              "~@privileged @resources"
+            ];
+            UMask = if groupAccessAvailable then "0027" else "0077";
           }
+          (mkIf (cfg.dataDir != "/var/lib/postgresql") {
+            ReadWritePaths = [ cfg.dataDir ];
+          })
           (mkIf (cfg.dataDir == "/var/lib/postgresql/${cfg.package.psqlSchema}") {
             StateDirectory = "postgresql postgresql/${cfg.package.psqlSchema}";
             StateDirectoryMode = if groupAccessAvailable then "0750" else "0700";

nixos/modules/services/web-apps/atlassian/confluence.nix

@@ -1,224 +0,0 @@
-{ config, lib, pkgs, ... }:
-
-with lib;
-
-let
-
-  cfg = config.services.confluence;
-
-  pkg = cfg.package.override (optionalAttrs cfg.sso.enable {
-    enableSSO = cfg.sso.enable;
-  });
-
-  crowdProperties = pkgs.writeText "crowd.properties" ''
-    application.name                        ${cfg.sso.applicationName}
-    application.password                    ${if cfg.sso.applicationPassword != null then cfg.sso.applicationPassword else "@NIXOS_CONFLUENCE_CROWD_SSO_PWD@"}
-    application.login.url                   ${cfg.sso.crowd}/console/
-
-    crowd.server.url                        ${cfg.sso.crowd}/services/
-    crowd.base.url                          ${cfg.sso.crowd}/
-
-    session.isauthenticated                 session.isauthenticated
-    session.tokenkey                        session.tokenkey
-    session.validationinterval              ${toString cfg.sso.validationInterval}
-    session.lastvalidation                  session.lastvalidation
-  '';
-
-in
-
-{
-  options = {
-    services.confluence = {
-      enable = mkEnableOption "Atlassian Confluence service";
-
-      user = mkOption {
-        type = types.str;
-        default = "confluence";
-        description = "User which runs confluence.";
-      };
-
-      group = mkOption {
-        type = types.str;
-        default = "confluence";
-        description = "Group which runs confluence.";
-      };
-
-      home = mkOption {
-        type = types.str;
-        default = "/var/lib/confluence";
-        description = "Home directory of the confluence instance.";
-      };
-
-      listenAddress = mkOption {
-        type = types.str;
-        default = "127.0.0.1";
-        description = "Address to listen on.";
-      };
-
-      listenPort = mkOption {
-        type = types.port;
-        default = 8090;
-        description = "Port to listen on.";
-      };
-
-      catalinaOptions = mkOption {
-        type = types.listOf types.str;
-        default = [];
-        example = [ "-Xms1024m" "-Xmx2048m" "-Dconfluence.disable.peopledirectory.all=true" ];
-        description = "Java options to pass to catalina/tomcat.";
-      };
-
-      proxy = {
-        enable = mkEnableOption "proxy support";
-
-        name = mkOption {
-          type = types.str;
-          example = "confluence.example.com";
-          description = "Virtual hostname at the proxy";
-        };
-
-        port = mkOption {
-          type = types.port;
-          default = 443;
-          example = 80;
-          description = "Port used at the proxy";
-        };
-
-        scheme = mkOption {
-          type = types.str;
-          default = "https";
-          example = "http";
-          description = "Protocol used at the proxy.";
-        };
-      };
-
-      sso = {
-        enable = mkEnableOption "SSO with Atlassian Crowd";
-
-        crowd = mkOption {
-          type = types.str;
-          example = "http://localhost:8095/crowd";
-          description = "Crowd Base URL without trailing slash";
-        };
-
-        applicationName = mkOption {
-          type = types.str;
-          example = "jira";
-          description = "Exact name of this Confluence instance in Crowd";
-        };
-
-        applicationPassword = mkOption {
-          type = types.nullOr types.str;
-          default = null;
-          description = "Application password of this Confluence instance in Crowd";
-        };
-
-        applicationPasswordFile = mkOption {
-          type = types.nullOr types.str;
-          default = null;
-          description = "Path to the application password for Crowd of Confluence.";
-        };
-
-        validationInterval = mkOption {
-          type = types.int;
-          default = 2;
-          example = 0;
-          description = ''
-            Set to 0, if you want authentication checks to occur on each
-            request. Otherwise set to the number of minutes between request
-            to validate if the user is logged in or out of the Crowd SSO
-            server. Setting this value to 1 or higher will increase the
-            performance of Crowd's integration.
-          '';
-        };
-      };
-
-      package = mkPackageOption pkgs "atlassian-confluence" { };
-
-      jrePackage = mkPackageOption pkgs "oraclejre8" {
-        extraDescription = ''
-        ::: {.note }
-        Atlassian only supports the Oracle JRE (JRASERVER-46152).
-        :::
-        '';
-      };
-    };
-  };
-
-  config = mkIf cfg.enable {
-    users.users.${cfg.user} = {
-      isSystemUser = true;
-      group = cfg.group;
-    };
-
-    assertions = [
-      { assertion = cfg.sso.enable -> ((cfg.sso.applicationPassword == null) != (cfg.sso.applicationPasswordFile));
-        message = "Please set either applicationPassword or applicationPasswordFile";
-      }
-    ];
-
-    warnings = mkIf (cfg.sso.enable && cfg.sso.applicationPassword != null) [
-      "Using `services.confluence.sso.applicationPassword` is deprecated! Use `applicationPasswordFile` instead!"
-    ];
-
-    users.groups.${cfg.group} = {};
-
-    systemd.tmpfiles.rules = [
-      "d '${cfg.home}' - ${cfg.user} - - -"
-      "d /run/confluence - - - - -"
-
-      "L+ /run/confluence/home - - - - ${cfg.home}"
-      "L+ /run/confluence/logs - - - - ${cfg.home}/logs"
-      "L+ /run/confluence/temp - - - - ${cfg.home}/temp"
-      "L+ /run/confluence/work - - - - ${cfg.home}/work"
-      "L+ /run/confluence/server.xml - - - - ${cfg.home}/server.xml"
-    ];
-
-    systemd.services.confluence = {
-      description = "Atlassian Confluence";
-
-      wantedBy = [ "multi-user.target" ];
-      requires = [ "postgresql.service" ];
-      after = [ "postgresql.service" ];
-
-      path = [ cfg.jrePackage pkgs.bash ];
-
-      environment = {
-        CONF_USER = cfg.user;
-        JAVA_HOME = "${cfg.jrePackage}";
-        CATALINA_OPTS = concatStringsSep " " cfg.catalinaOptions;
-        JAVA_OPTS = mkIf cfg.sso.enable "-Dcrowd.properties=${cfg.home}/crowd.properties";
-      };
-
-      preStart = ''
-        mkdir -p ${cfg.home}/{logs,work,temp,deploy}
-
-        sed -e 's,port="8090",port="${toString cfg.listenPort}" address="${cfg.listenAddress}",' \
-        '' + (lib.optionalString cfg.proxy.enable ''
-          -e 's,protocol="org.apache.coyote.http11.Http11NioProtocol",protocol="org.apache.coyote.http11.Http11NioProtocol" proxyName="${cfg.proxy.name}" proxyPort="${toString cfg.proxy.port}" scheme="${cfg.proxy.scheme}",' \
-        '') + ''
-          ${pkg}/conf/server.xml.dist > ${cfg.home}/server.xml
-
-        ${optionalString cfg.sso.enable ''
-          install -m660 ${crowdProperties} ${cfg.home}/crowd.properties
-          ${optionalString (cfg.sso.applicationPasswordFile != null) ''
-            ${pkgs.replace-secret}/bin/replace-secret \
-              '@NIXOS_CONFLUENCE_CROWD_SSO_PWD@' \
-              ${cfg.sso.applicationPasswordFile} \
-              ${cfg.home}/crowd.properties
-          ''}
-        ''}
-      '';
-
-      serviceConfig = {
-        User = cfg.user;
-        Group = cfg.group;
-        PrivateTmp = true;
-        Restart = "on-failure";
-        RestartSec = "10";
-        ExecStart = "${pkg}/bin/start-confluence.sh -fg";
-        ExecStop = "${pkg}/bin/stop-confluence.sh";
-      };
-    };
-  };
-}

nixos/modules/services/web-apps/atlassian/crowd.nix

@@ -1,193 +0,0 @@
-{ config, lib, pkgs, ... }:
-
-with lib;
-
-let
-
-  cfg = config.services.crowd;
-
-  pkg = cfg.package.override {
-    home = cfg.home;
-    port = cfg.listenPort;
-    openidPassword = cfg.openidPassword;
-  } // (optionalAttrs cfg.proxy.enable {
-    proxyUrl = "${cfg.proxy.scheme}://${cfg.proxy.name}:${toString cfg.proxy.port}";
-  });
-
-  crowdPropertiesFile = pkgs.writeText "crowd.properties" ''
-    application.name                        crowd-openid-server
-    application.password @NIXOS_CROWD_OPENID_PW@
-    application.base.url                    http://localhost:${toString cfg.listenPort}/openidserver
-    application.login.url                   http://localhost:${toString cfg.listenPort}/openidserver
-    application.login.url.template          http://localhost:${toString cfg.listenPort}/openidserver?returnToUrl=''${RETURN_TO_URL}
-
-    crowd.server.url                        http://localhost:${toString cfg.listenPort}/crowd/services/
-
-    session.isauthenticated                 session.isauthenticated
-    session.tokenkey                        session.tokenkey
-    session.validationinterval              0
-    session.lastvalidation                  session.lastvalidation
-  '';
-
-in
-
-{
-  options = {
-    services.crowd = {
-      enable = mkEnableOption "Atlassian Crowd service";
-
-      user = mkOption {
-        type = types.str;
-        default = "crowd";
-        description = "User which runs Crowd.";
-      };
-
-      group = mkOption {
-        type = types.str;
-        default = "crowd";
-        description = "Group which runs Crowd.";
-      };
-
-      home = mkOption {
-        type = types.str;
-        default = "/var/lib/crowd";
-        description = "Home directory of the Crowd instance.";
-      };
-
-      listenAddress = mkOption {
-        type = types.str;
-        default = "127.0.0.1";
-        description = "Address to listen on.";
-      };
-
-      listenPort = mkOption {
-        type = types.port;
-        default = 8092;
-        description = "Port to listen on.";
-      };
-
-      openidPassword = mkOption {
-        type = types.str;
-        default = "WILL_NEVER_BE_SET";
-        description = "Application password for OpenID server.";
-      };
-
-      openidPasswordFile = mkOption {
-        type = types.nullOr types.str;
-        default = null;
-        description = "Path to the file containing the application password for OpenID server.";
-      };
-
-      catalinaOptions = mkOption {
-        type = types.listOf types.str;
-        default = [];
-        example = [ "-Xms1024m" "-Xmx2048m" ];
-        description = "Java options to pass to catalina/tomcat.";
-      };
-
-      proxy = {
-        enable = mkEnableOption "reverse proxy support";
-
-        name = mkOption {
-          type = types.str;
-          example = "crowd.example.com";
-          description = "Virtual hostname at the proxy";
-        };
-
-        port = mkOption {
-          type = types.port;
-          default = 443;
-          example = 80;
-          description = "Port used at the proxy";
-        };
-
-        scheme = mkOption {
-          type = types.str;
-          default = "https";
-          example = "http";
-          description = "Protocol used at the proxy.";
-        };
-
-        secure = mkOption {
-          type = types.bool;
-          default = true;
-          description = "Whether the connections to the proxy should be considered secure.";
-        };
-      };
-
-      package = mkPackageOption pkgs "atlassian-crowd" { };
-
-      jrePackage = mkPackageOption pkgs "oraclejre8" {
-        extraDescription = ''
-        ::: {.note }
-        Atlassian only supports the Oracle JRE (JRASERVER-46152).
-        :::
-        '';
-      };
-    };
-  };
-
-  config = mkIf cfg.enable {
-    users.users.${cfg.user} = {
-      isSystemUser = true;
-      group = cfg.group;
-    };
-
-    users.groups.${cfg.group} = {};
-
-    systemd.tmpfiles.rules = [
-      "d '${cfg.home}' - ${cfg.user} ${cfg.group} - -"
-      "d /run/atlassian-crowd - - - - -"
-
-      "L+ /run/atlassian-crowd/database - - - - ${cfg.home}/database"
-      "L+ /run/atlassian-crowd/logs - - - - ${cfg.home}/logs"
-      "L+ /run/atlassian-crowd/work - - - - ${cfg.home}/work"
-      "L+ /run/atlassian-crowd/server.xml - - - - ${cfg.home}/server.xml"
-    ];
-
-    systemd.services.atlassian-crowd = {
-      description = "Atlassian Crowd";
-
-      wantedBy = [ "multi-user.target" ];
-      requires = [ "postgresql.service" ];
-      after = [ "postgresql.service" ];
-
-      path = [ cfg.jrePackage ];
-
-      environment = {
-        JAVA_HOME = "${cfg.jrePackage}";
-        CATALINA_OPTS = concatStringsSep " " cfg.catalinaOptions;
-        CATALINA_TMPDIR = "/tmp";
-        JAVA_OPTS = mkIf (cfg.openidPasswordFile != null) "-Dcrowd.properties=${cfg.home}/crowd.properties";
-      };
-
-      preStart = ''
-        rm -rf ${cfg.home}/work
-        mkdir -p ${cfg.home}/{logs,database,work}
-
-        sed -e 's,port="8095",port="${toString cfg.listenPort}" address="${cfg.listenAddress}",' \
-        '' + (lib.optionalString cfg.proxy.enable ''
-          -e 's,compression="on",compression="off" protocol="HTTP/1.1" proxyName="${cfg.proxy.name}" proxyPort="${toString cfg.proxy.port}" scheme="${cfg.proxy.scheme}" secure="${boolToString cfg.proxy.secure}",' \
-        '') + ''
-          ${pkg}/apache-tomcat/conf/server.xml.dist > ${cfg.home}/server.xml
-
-        ${optionalString (cfg.openidPasswordFile != null) ''
-          install -m660 ${crowdPropertiesFile} ${cfg.home}/crowd.properties
-          ${pkgs.replace-secret}/bin/replace-secret \
-            '@NIXOS_CROWD_OPENID_PW@' \
-            ${cfg.openidPasswordFile} \
-            ${cfg.home}/crowd.properties
-        ''}
-      '';
-
-      serviceConfig = {
-        User = cfg.user;
-        Group = cfg.group;
-        PrivateTmp = true;
-        Restart = "on-failure";
-        RestartSec = "10";
-        ExecStart = "${pkg}/start_crowd.sh -fg";
-      };
-    };
-  };
-}

nixos/modules/services/web-apps/atlassian/jira.nix

@@ -1,219 +0,0 @@
-{ config, lib, pkgs, ... }:
-
-with lib;
-
-let
-
-  cfg = config.services.jira;
-
-  pkg = cfg.package.override (optionalAttrs cfg.sso.enable {
-    enableSSO = cfg.sso.enable;
-  });
-
-  crowdProperties = pkgs.writeText "crowd.properties" ''
-    application.name                        ${cfg.sso.applicationName}
-    application.password                    @NIXOS_JIRA_CROWD_SSO_PWD@
-    application.login.url                   ${cfg.sso.crowd}/console/
-
-    crowd.server.url                        ${cfg.sso.crowd}/services/
-    crowd.base.url                          ${cfg.sso.crowd}/
-
-    session.isauthenticated                 session.isauthenticated
-    session.tokenkey                        session.tokenkey
-    session.validationinterval              ${toString cfg.sso.validationInterval}
-    session.lastvalidation                  session.lastvalidation
-  '';
-
-in
-
-{
-  options = {
-    services.jira = {
-      enable = mkEnableOption "Atlassian JIRA service";
-
-      user = mkOption {
-        type = types.str;
-        default = "jira";
-        description = "User which runs JIRA.";
-      };
-
-      group = mkOption {
-        type = types.str;
-        default = "jira";
-        description = "Group which runs JIRA.";
-      };
-
-      home = mkOption {
-        type = types.str;
-        default = "/var/lib/jira";
-        description = "Home directory of the JIRA instance.";
-      };
-
-      listenAddress = mkOption {
-        type = types.str;
-        default = "127.0.0.1";
-        description = "Address to listen on.";
-      };
-
-      listenPort = mkOption {
-        type = types.port;
-        default = 8091;
-        description = "Port to listen on.";
-      };
-
-      catalinaOptions = mkOption {
-        type = types.listOf types.str;
-        default = [];
-        example = [ "-Xms1024m" "-Xmx2048m" ];
-        description = "Java options to pass to catalina/tomcat.";
-      };
-
-      proxy = {
-        enable = mkEnableOption "reverse proxy support";
-
-        name = mkOption {
-          type = types.str;
-          example = "jira.example.com";
-          description = "Virtual hostname at the proxy";
-        };
-
-        port = mkOption {
-          type = types.port;
-          default = 443;
-          example = 80;
-          description = "Port used at the proxy";
-        };
-
-        scheme = mkOption {
-          type = types.str;
-          default = "https";
-          example = "http";
-          description = "Protocol used at the proxy.";
-        };
-
-        secure = mkOption {
-          type = types.bool;
-          default = true;
-          description = "Whether the connections to the proxy should be considered secure.";
-        };
-      };
-
-      sso = {
-        enable = mkEnableOption "SSO with Atlassian Crowd";
-
-        crowd = mkOption {
-          type = types.str;
-          example = "http://localhost:8095/crowd";
-          description = "Crowd Base URL without trailing slash";
-        };
-
-        applicationName = mkOption {
-          type = types.str;
-          example = "jira";
-          description = "Exact name of this JIRA instance in Crowd";
-        };
-
-        applicationPasswordFile = mkOption {
-          type = types.str;
-          description = "Path to the file containing the application password of this JIRA instance in Crowd";
-        };
-
-        validationInterval = mkOption {
-          type = types.int;
-          default = 2;
-          example = 0;
-          description = ''
-            Set to 0, if you want authentication checks to occur on each
-            request. Otherwise set to the number of minutes between request
-            to validate if the user is logged in or out of the Crowd SSO
-            server. Setting this value to 1 or higher will increase the
-            performance of Crowd's integration.
-          '';
-        };
-      };
-
-      package = mkPackageOption pkgs "atlassian-jira" { };
-
-      jrePackage = mkPackageOption pkgs "oraclejre8" {
-        extraDescription = ''
-        ::: {.note }
-        Atlassian only supports the Oracle JRE (JRASERVER-46152).
-        :::
-        '';
-      };
-    };
-  };
-
-  config = mkIf cfg.enable {
-    users.users.${cfg.user} = {
-      isSystemUser = true;
-      group = cfg.group;
-      home = cfg.home;
-    };
-
-    users.groups.${cfg.group} = {};
-
-    systemd.tmpfiles.rules = [
-      "d '${cfg.home}' - ${cfg.user} - - -"
-      "d /run/atlassian-jira - - - - -"
-
-      "L+ /run/atlassian-jira/home - - - - ${cfg.home}"
-      "L+ /run/atlassian-jira/logs - - - - ${cfg.home}/logs"
-      "L+ /run/atlassian-jira/work - - - - ${cfg.home}/work"
-      "L+ /run/atlassian-jira/temp - - - - ${cfg.home}/temp"
-      "L+ /run/atlassian-jira/server.xml - - - - ${cfg.home}/server.xml"
-    ];
-
-    systemd.services.atlassian-jira = {
-      description = "Atlassian JIRA";
-
-      wantedBy = [ "multi-user.target" ];
-      requires = [ "postgresql.service" ];
-      after = [ "postgresql.service" ];
-
-      path = [ cfg.jrePackage pkgs.bash ];
-
-      environment = {
-        JIRA_USER = cfg.user;
-        JIRA_HOME = cfg.home;
-        JAVA_HOME = "${cfg.jrePackage}";
-        CATALINA_OPTS = concatStringsSep " " cfg.catalinaOptions;
-        JAVA_OPTS = mkIf cfg.sso.enable "-Dcrowd.properties=${cfg.home}/crowd.properties";
-      };
-
-      preStart = ''
-        mkdir -p ${cfg.home}/{logs,work,temp,deploy}
-
-        sed -e 's,port="8080",port="${toString cfg.listenPort}" address="${cfg.listenAddress}",' \
-        '' + (lib.optionalString cfg.proxy.enable ''
-          -e 's,protocol="HTTP/1.1",protocol="HTTP/1.1" proxyName="${cfg.proxy.name}" proxyPort="${toString cfg.proxy.port}" scheme="${cfg.proxy.scheme}" secure="${toString cfg.proxy.secure}",' \
-        '') + ''
-          ${pkg}/conf/server.xml.dist > ${cfg.home}/server.xml
-
-        ${optionalString cfg.sso.enable ''
-          install -m660 ${crowdProperties} ${cfg.home}/crowd.properties
-          ${pkgs.replace-secret}/bin/replace-secret \
-            '@NIXOS_JIRA_CROWD_SSO_PWD@' \
-            ${cfg.sso.applicationPasswordFile} \
-            ${cfg.home}/crowd.properties
-        ''}
-      '';
-
-      serviceConfig = {
-        User = cfg.user;
-        Group = cfg.group;
-        PrivateTmp = true;
-        Restart = "on-failure";
-        RestartSec = "10";
-        ExecStart = "${pkg}/bin/start-jira.sh -fg";
-        ExecStop = "${pkg}/bin/stop-jira.sh";
-      };
-    };
-  };
-
-  imports = [
-    (mkRemovedOptionModule [ "services" "jira" "sso" "applicationPassword" ] ''
-      Use `applicationPasswordFile` instead!
-    '')
-  ];
-}

nixos/modules/tasks/filesystems/zfs.nix

@@ -221,7 +221,7 @@ in
         type = lib.types.package;
         default = pkgs.zfs;
         defaultText = lib.literalExpression "pkgs.zfs";
-        description = "Configured ZFS userland tools package, use `pkgs.zfs_unstable` if you want to track the latest staging ZFS branch.";
+        description = "Configured ZFS userland tools package.";
       };
 
       modulePackage = lib.mkOption {

nixos/tests/postgresql-wal-receiver.nix

@@ -22,8 +22,8 @@ let
       replicationUser = "wal_receiver_user";
       replicationSlot = "wal_receiver_slot";
       replicationConn = "postgresql://${replicationUser}@localhost";
-      baseBackupDir = "/tmp/pg_basebackup";
-      walBackupDir = "/tmp/pg_wal";
+      baseBackupDir = "/var/cache/wals/pg_basebackup";
+      walBackupDir = "/var/cache/wals/pg_wal";
 
       recoveryFile = pkgs.writeTextDir "recovery.signal" "";
 
@@ -32,6 +32,10 @@ let
       meta.maintainers = with lib.maintainers; [ pacien ];
 
       nodes.machine = { ... }: {
+        systemd.tmpfiles.rules = [
+          "d /var/cache/wals 0750 postgres postgres - -"
+        ];
+
         services.postgresql = {
           package = pkg;
           enable = true;
@@ -60,6 +64,7 @@ let
         # This is only to speedup test, it isn't time racing. Service is set to autorestart always,
         # default 60sec is fine for real system, but is too much for a test
         systemd.services.postgresql-wal-receiver-main.serviceConfig.RestartSec = lib.mkForce 5;
+        systemd.services.postgresql.serviceConfig.ReadWritePaths = [ "/var/cache/wals" ];
       };
 
       testScript = ''

nixos/tests/postgresql.nix

@@ -126,6 +126,8 @@ let
       with subtest("Initdb works"):
           machine.succeed("sudo -u postgres initdb -D /tmp/testpostgres2")
 
+      machine.log(machine.execute("systemd-analyze security postgresql.service | grep -v ✓")[1])
+
       machine.shutdown()
     '';
 

pkgs/applications/audio/easyaudiosync/0001-fix-project-name.patch

@@ -1,5 +1,5 @@
 diff --git a/CMakeLists.txt b/CMakeLists.txt
-index 7065538..b2716e1 100644
+index 34f3094..b161ba8 100644
 --- a/CMakeLists.txt
 +++ b/CMakeLists.txt
 @@ -4,7 +4,7 @@ if (VCPKG)
@@ -8,6 +8,6 @@ index 7065538..b2716e1 100644
  
 -project("Easy Audio Sync"
 +project("easyaudiosync"
-   VERSION 1.1.1
+   VERSION 1.1.2
    DESCRIPTION "Audio library syncing and conversion utility"
    HOMEPAGE_URL "https://github.com/complexlogic/EasyAudioSync"

pkgs/applications/audio/easyaudiosync/0002-fix-qt67-deprecated-methods.patch

@@ -1,21 +0,0 @@
-diff --git a/src/CMakeLists.txt b/src/CMakeLists.txt
-index e7befae..8689f13 100644
---- a/src/CMakeLists.txt
-+++ b/src/CMakeLists.txt
-@@ -43,11 +43,14 @@ configure_file("${PROJECT_SOURCE_DIR}/translations/languages.hpp.in" "${PROJECT_
- 
- # Make lupdate target for Qt 6
- if (${QT_VERSION} VERSION_GREATER_EQUAL "6")
--  qt_add_lupdate(${EXECUTABLE_NAME}
-+  qt_add_lupdate(
-     TS_FILES ${TS_FILES} "${PROJECT_SOURCE_DIR}/translations/source.ts"
-+    SOURCE_TARGETS ${EXECUTABLE_NAME}
-   )
- endif ()
--qt_add_translation(QM_FILES "${TS_FILES}")
-+qt_add_translations(
-+  ${EXECUTABLE_NAME} 
-+)
- foreach (FILE ${QM_FILES})
-   get_filename_component(BASENAME ${FILE} NAME)
-   string(APPEND TRANSLATION_FILES "    <file>${BASENAME}</file>\n")

pkgs/applications/audio/easyaudiosync/default.nix

@@ -15,18 +15,17 @@
 
 stdenv.mkDerivation rec {
   pname = "easyaudiosync";
-  version = "1.1.1";
+  version = "1.1.2";
 
   src = fetchFromGitHub {
     owner = "complexlogic";
     repo = "EasyAudioSync";
     rev = "v${version}";
-    hash = "sha256-w98tj9BuixPhuDgwn74EYY0gvKH6kbfQmtg030RWRU0=";
+    hash = "sha256-UCOL4DzynKjNDvS0HZ4/K+Wn5lOqHZ0bNop0zqJl5kc=";
   };
 
   patches = [
     ./0001-fix-project-name.patch
-    ./0002-fix-qt67-deprecated-methods.patch
     ./0003-fix-darwin-app.patch
     ./0004-force-qt6.patch
   ];

pkgs/applications/audio/grandorgue/darwin-fixes.patch

@@ -0,0 +1,13 @@
+diff --git a/resources/CMakeLists.txt b/resources/CMakeLists.txt
+index d231e3d1..73f389a2 100644
+--- a/resources/CMakeLists.txt
++++ b/resources/CMakeLists.txt
+@@ -62,7 +62,7 @@ if(WIN32)
+ 		     DEPENDS "${CMAKE_SOURCE_DIR}/resources/GrandOrgue.manifest")
+   LIST(APPEND DEPLIST "${RESOURCEDIR}/GOIcon.ico" "${RESOURCEDIR}/GrandOrgue.rc" "${RESOURCEDIR}/GrandOrgue.manifest")
+ elseif(APPLE)
+-   ADD_CUSTOM_COMMAND(OUTPUT "${RESOURCEDIR}/GrandOrgue.icns" COMMAND iconutil -c icns --output "${RESOURCEDIR}/GrandOrgue.icns" ${GENERATED_ICONS_DIR} DEPENDS ${GENERATED_ICONS})
++   ADD_CUSTOM_COMMAND(OUTPUT "${RESOURCEDIR}/GrandOrgue.icns" COMMAND png2icns "${RESOURCEDIR}/GrandOrgue.icns" ${GENERATED_ICONS_DIR}/*{16,32,128,256,512,1024}.png DEPENDS ${GENERATED_ICONS})
+    INSTALL(FILES "${RESOURCEDIR}/GrandOrgue.icns" DESTINATION "${RESOURCEINSTDIR}")
+    LIST(APPEND DEPLIST "${RESOURCEDIR}/GrandOrgue.icns")
+ elseif(UNIX)

pkgs/applications/audio/grandorgue/default.nix

@@ -21,22 +21,17 @@
 
 stdenv.mkDerivation rec {
   pname = "grandorgue";
-  version = "3.15.1-1";
+  version = "3.15.2-1";
 
   src = fetchFromGitHub {
     owner = "GrandOrgue";
     repo = "grandorgue";
     rev = version;
     fetchSubmodules = true;
-    hash = "sha256-5uAA878OBc04PkUgCwoRtc6lIASivq3YcfFffTae6uM=";
+    hash = "sha256-U0DAWCzhXqdL2klSFQjnLiWp7yTdw/n0dmNUJSAg/5c=";
   };
 
-  postPatch = ''
-    substituteInPlace resources/CMakeLists.txt \
-      --replace \
-        "iconutil -c icns \''${GENERATED_ICONS_DIR}" \
-        "png2icns \''${GENERATED_ICONS_DIR}/../GrandOrgue.icns \''${GENERATED_ICONS_DIR}/*{16,32,128,256,512,1024}.png" \
-  '';
+  patches = [ ./darwin-fixes.patch ];
 
   nativeBuildInputs = [ cmake pkg-config imagemagick libicns makeWrapper ];
 

pkgs/applications/audio/mympd/default.nix

@@ -17,13 +17,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "mympd";
-  version = "18.0.0";
+  version = "18.1.2";
 
   src = fetchFromGitHub {
     owner = "jcorporation";
     repo = "myMPD";
     rev = "v${finalAttrs.version}";
-    sha256 = "sha256-h88wqKwkxY/5uOU0SQp8vb4ri3Ndi3ezHPTDFJGVE2Q=";
+    sha256 = "sha256-4BGW7jDeqwhbAi1LODeiFrmBIzv0qAMKT3IVRgYn87E=";
   };
 
   nativeBuildInputs = [

pkgs/applications/audio/r128gain/default.nix

@@ -9,13 +9,13 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "r128gain";
-  version = "1.0.3";
+  version = "1.0.7";
 
   src = fetchFromGitHub {
     owner = "desbma";
     repo = "r128gain";
     rev = version;
-    sha256 = "0w2i2szajv1vcmc96w0fczdr8xc28ijcf1gdg180f21gi6yh96sc";
+    sha256 = "sha256-JyKacDqjIKTNl2GjbJPkgbakF8HR4Jd4czAtOaemDH8=";
   };
 
   patches = [

pkgs/applications/audio/r128gain/ffmpeg-location.patch

@@ -1,29 +1,31 @@
---- i/r128gain/__init__.py
-+++ w/r128gain/__init__.py
-@@ -78,7 +78,7 @@ def get_ffmpeg_lib_versions(ffmpeg_path=None):
-   Example: 0x3040100 for FFmpeg 3.4.1
-   """
-   r = collections.OrderedDict()
--  cmd = (ffmpeg_path or "ffmpeg", "-version")
-+  cmd = (ffmpeg_path or "@ffmpeg@/bin/ffmpeg", "-version")
-   output = subprocess.run(cmd,
-                           check=True,
-                           stdout=subprocess.PIPE,
-@@ -156,7 +156,7 @@ def get_r128_loudness(audio_filepaths, *, calc_peak=True, enable_ffmpeg_threadin
-                                      os.devnull,
-                                      **additional_ffmpeg_args,
-                                      f="null").global_args("-hide_banner", "-nostats"),
--                       cmd=ffmpeg_path or "ffmpeg")
-+                       cmd=ffmpeg_path or "@ffmpeg@/bin/ffmpeg")
+diff --git a/r128gain/__init__.py b/r128gain/__init__.py
+index 79a5cbd..d8f13ba 100755
+--- a/r128gain/__init__.py
++++ b/r128gain/__init__.py
+@@ -86,7 +86,7 @@ def get_ffmpeg_lib_versions(ffmpeg_path: Optional[str] = None) -> Dict[str, int]
+     Example: 0x3040100 for FFmpeg 3.4.1
+     """
+     r = collections.OrderedDict()
+-    cmd = (ffmpeg_path or "ffmpeg", "-version")
++    cmd = (ffmpeg_path or "@ffmpeg@/bin/ffmpeg", "-version")
+     output_str = subprocess.run(cmd, check=True, stdout=subprocess.PIPE, universal_newlines=True).stdout
+     output_lines = output_str.splitlines()
+     lib_version_regex = re.compile(r"^\s*(lib[a-z]+)\s+([0-9]+).\s*([0-9]+).\s*([0-9]+)\s+")
+@@ -194,7 +194,7 @@ def get_r128_loudness(  # noqa: C901
+         ffmpeg.output(*output_streams, os.devnull, **additional_ffmpeg_args, f="null").global_args(
+             "-hide_banner", "-nostats"
+         ),
+-        cmd=ffmpeg_path or "ffmpeg",
++        cmd=ffmpeg_path or "@ffmpeg@/bin/ffmpeg",
+     )
  
-   # run
-   logger().debug(cmd_to_string(cmd))
-@@ -740,7 +740,7 @@ def cl_main():
-                           help="Maximum number of tracks to scan in parallel. If not specified, autodetect CPU count")
-   arg_parser.add_argument("-f",
-                           "--ffmpeg-path",
--                          default=shutil.which("ffmpeg"),
-+                          default="@ffmpeg@/bin/ffmpeg",
-                           help="""Full file path of ffmpeg executable (only needed if not in PATH).
-                                   If not specified, autodetect""")
-   arg_parser.add_argument("-d",
+     # run
+@@ -885,7 +885,7 @@ def cl_main() -> None:
+     arg_parser.add_argument(
+         "-f",
+         "--ffmpeg-path",
+-        default=shutil.which("ffmpeg"),
++        default="@ffmpeg@/bin/ffmpeg",
+         help="""Full file path of ffmpeg executable (only needed if not in PATH).
+                 If not specified, autodetect""",
+     )

pkgs/applications/audio/shortwave/default.nix

@@ -1,87 +0,0 @@
-{ stdenv
-, lib
-, fetchFromGitLab
-, cargo
-, dbus
-, desktop-file-utils
-, gdk-pixbuf
-, gettext
-, gitMinimal
-, glib
-, gst_all_1
-, gtk4
-, libadwaita
-, meson
-, ninja
-, openssl
-, pkg-config
-, rustPlatform
-, rustc
-, sqlite
-, wrapGAppsHook4
-, cmake
-, libshumate
-}:
-
-stdenv.mkDerivation rec {
-  pname = "shortwave";
-  version = "3.2.0";
-
-  src = fetchFromGitLab {
-    domain = "gitlab.gnome.org";
-    owner = "World";
-    repo = "Shortwave";
-    rev = version;
-    sha256 = "sha256-ESZ1yD1IuBar8bv83xMczZbtPtHbWRpe2yMVyr7K5gQ=";
-  };
-
-  cargoDeps = rustPlatform.fetchCargoTarball {
-    inherit src;
-    name = "${pname}-${version}";
-    hash = "sha256-8W46bGAitR2YbZbnsigAZMW5pSFTkDAe5JNaNOH5JfA=";
-  };
-
-  nativeBuildInputs = [
-    desktop-file-utils
-    gettext
-    gitMinimal
-    glib # for glib-compile-schemas
-    meson
-    ninja
-    pkg-config
-    cargo
-    rustPlatform.cargoSetupHook
-    rustc
-    wrapGAppsHook4
-    cmake
-  ];
-
-  buildInputs = [
-    dbus
-    gdk-pixbuf
-    glib
-    gtk4
-    libadwaita
-    openssl
-    sqlite
-    libshumate
-  ] ++ (with gst_all_1; [
-    gstreamer
-    gst-plugins-base
-    gst-plugins-good
-    gst-plugins-bad
-  ]);
-
-  meta = with lib; {
-    homepage = "https://gitlab.gnome.org/World/Shortwave";
-    description = "Find and listen to internet radio stations";
-    mainProgram = "shortwave";
-    longDescription = ''
-      Shortwave is a streaming audio player designed for the GNOME
-      desktop. It is the successor to the older Gradio application.
-    '';
-    maintainers = with maintainers; [ lasandell ];
-    license = licenses.gpl3Plus;
-    platforms = platforms.linux;
-  };
-}

pkgs/applications/editors/mg/default.nix

@@ -1,6 +1,6 @@
-{ lib, stdenv, fetchFromGitHub, pkg-config, ncurses, buildPackages }:
+{ lib, stdenv, fetchFromGitHub, pkg-config, ncurses, buildPackages, darwin }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation {
   pname = "mg";
   version = "7.3-unstable-2024-06-04";
 
@@ -25,7 +25,7 @@ stdenv.mkDerivation rec {
   '';
   nativeBuildInputs = [ pkg-config ];
 
-  buildInputs = [ ncurses ];
+  buildInputs = [ ncurses ] ++ lib.optional stdenv.isDarwin [ darwin.libutil ];
 
   meta = with lib; {
     description = "Micro GNU/emacs, a portable version of the mg maintained by the OpenBSD team";

pkgs/applications/editors/vscode/extensions/default.nix

@@ -1122,8 +1122,8 @@ let
         mktplcRef = {
           name = "dbclient-jdbc";
           publisher = "cweijan";
-          version = "1.3.4";
-          hash = "sha256-qknooeedRhTvEWSuGXFoO/BczGanYCdMr7WWjthxG+k=";
+          version = "1.3.6";
+          hash = "sha256-CETB2hLaXD7DuNmop/DHjpI8NgHfMGyMMZyfw/Bt1yc=";
         };
         meta = {
           description = "JDBC Adapter For Database Client";
@@ -1724,8 +1724,8 @@ let
         mktplcRef = {
           name = "vsc-material-theme-icons";
           publisher = "Equinusocio";
-          version = "3.5.0";
-          hash = "sha256-XqtyZVlsPaPkKB9HdigKSXjCwqXe9wzJWeRcPpS6EVM=";
+          version = "3.8.8";
+          hash = "sha256-el2hQaq1gZBn2PZ+f+S1fHM/g3V0sX7Chyre04sds8k=";
         };
         meta = {
           description = "Material Theme Icons, the most epic icons theme for Visual Studio Code and Material Theme";
@@ -1852,8 +1852,8 @@ let
         mktplcRef = {
           name = "vscode-jest-runner";
           publisher = "firsttris";
-          version = "0.4.72";
-          hash = "sha256-1nUpOXdteWsyFYJ2uATCcr1SUbeusmbpa09Bkw9/TZM=";
+          version = "0.4.74";
+          hash = "sha256-35Ix6B/vkYQIky9KYsMsxgmRh1LYzBoRs9pMe8M5/rI=";
         };
         meta = {
           description = "Simple way to run or debug a single (or multiple) tests from context-menu";
@@ -2262,8 +2262,8 @@ let
         mktplcRef = {
           name = "HCL";
           publisher = "HashiCorp";
-          version = "0.3.2";
-          hash = "sha256-cxF3knYY29PvT3rkRS8SGxMn9vzt56wwBXpk2PqO0mo=";
+          version = "0.6.0";
+          hash = "sha256-Za2ODrsHR/y0X/FOhVEtbg6bNs439G6rlBHW84EZS60=";
         };
         meta = {
           description = "HashiCorp HCL syntax";
@@ -3972,8 +3972,8 @@ let
         mktplcRef = {
           name = "ansible";
           publisher = "redhat";
-          version = "2.12.143";
-          hash = "sha256-NEV7sVYJJvapZjk5sylkzijH8qLZ7xzmBzHI7qcj2Ok=";
+          version = "24.10.0";
+          hash = "sha256-NDIGyVCo3Az6oncnKR9PXXnZ4ynwF7HBeIiNyiGTPko=";
         };
         meta = {
           description = "Ansible language support";
@@ -4564,8 +4564,8 @@ let
         mktplcRef = {
           name = "vscode-stylelint";
           publisher = "stylelint";
-          version = "1.3.0";
-          hash = "sha256-JoCa2d0ayBEuCcQi3Z/90GJ4AIECVz8NCpd+i+9uMeA=";
+          version = "1.4.0";
+          hash = "sha256-CsQBRoVDtNLlkHa6NLmOspkswB/JUMfMuU2dMYDlDnc=";
         };
         meta = {
           description = "Official Stylelint extension for Visual Studio Code";
@@ -5053,8 +5053,8 @@ let
         mktplcRef = {
           name = "intellicode-api-usage-examples";
           publisher = "VisualStudioExptTeam";
-          version = "0.2.8";
-          hash = "sha256-aXAS3QX+mrX0kJqf1LUsvguqRxxC0o+jj1bKQteXPNA=";
+          version = "0.2.9";
+          hash = "sha256-8xBD+WLBaxYt8v3+8lvV2SiqV89iE4jeQod2kH7LNHU=";
         };
         meta = {
           description = "See relevant code examples from GitHub for over 100K different APIs right in your editor";
@@ -5069,8 +5069,8 @@ let
         mktplcRef = {
           name = "vscodeintellicode";
           publisher = "VisualStudioExptTeam";
-          version = "1.2.30";
-          hash = "sha256-f2Gn+W0QHN8jD5aCG+P93Y+JDr/vs2ldGL7uQwBK4lE=";
+          version = "1.3.2";
+          hash = "sha256-2zexyX1YKD5jgtsvDx7/z3luh5We71ys+XRlVcNywfs=";
         };
         meta = {
           description = "AI-assisted development";
@@ -5172,8 +5172,8 @@ let
         mktplcRef = {
           name = "vscode-java-pack";
           publisher = "vscjava";
-          version = "0.25.2023121402";
-          hash = "sha256-JhVJK2gZe3R6dpynon+9wauSAWPdW4LmG9oRWylCexM=";
+          version = "0.29.2024091906";
+          hash = "sha256-A0WHSqqYVkRN1C3WI7Gd7DZJFDJPYDVsEygDCG67GoQ=";
         };
         meta = {
           description = "Popular extensions for Java development that provides Java IntelliSense, debugging, testing, Maven/Gradle support, project management and more";

pkgs/applications/file-managers/lf/default.nix

@@ -7,16 +7,16 @@
 
 buildGoModule rec {
   pname = "lf";
-  version = "32";
+  version = "33";
 
   src = fetchFromGitHub {
     owner = "gokcehan";
     repo = "lf";
     rev = "r${version}";
-    hash = "sha256-rFK1M15NcshVY2vtXcMWZhB9Rd/DRC8JyKE5u4wjh2I=";
+    hash = "sha256-aKvTf2tqAUbB3plOemvgJJ7qYdGfQoXhsGVE7Y9wuMo=";
   };
 
-  vendorHash = "sha256-r1Kq6CYGNbxTTue3sb3CKMsWZJDzX2dKX7QHQ73nZ8g=";
+  vendorHash = "sha256-E6uZVsQAiwy3uGXp9COvtJSlgXhXxfS7vOfhM5uBPQw=";
 
   nativeBuildInputs = [ installShellFiles ];
 

pkgs/applications/misc/comodoro/default.nix

@@ -39,7 +39,7 @@ rustPlatform.buildRustPackage rec {
 
   meta = with lib; {
     description = "CLI to manage your time";
-    homepage = "https://pimalaya.org/comodoro/";
+    homepage = "https://github.com/pimalaya/comodoro";
     changelog = "https://github.com/soywod/comodoro/blob/v${version}/CHANGELOG.md";
     license = licenses.mit;
     maintainers = with maintainers; [ soywod ];

pkgs/applications/misc/lyx/default.nix

@@ -13,12 +13,12 @@
 }:
 
 mkDerivation rec {
-  version = "2.4.1";
+  version = "2.4.2.1";
   pname = "lyx";
 
   src = fetchurl {
     url = "ftp://ftp.lyx.org/pub/lyx/stable/2.4.x/${pname}-${version}.tar.xz";
-    hash = "sha256-dN4ooH7zeqlHG8mWLbGCFSolMQx9H0f2drubxj2XE8U=";
+    hash = "sha256-HSscer45Hi+0kQneLI4Tp9/mBfJ99o9om/lH36/HpNk=";
   };
 
   # LaTeX is used from $PATH, as people often want to have it with extra pkgs

pkgs/applications/misc/notesnook/default.nix

@@ -2,7 +2,7 @@
 
 let
   pname = "notesnook";
-  version = "3.0.16";
+  version = "3.0.19";
 
   inherit (stdenv.hostPlatform) system;
   throwSystem = throw "Unsupported system: ${system}";
@@ -16,9 +16,9 @@ let
   src = fetchurl {
     url = "https://github.com/streetwriters/notesnook/releases/download/v${version}/notesnook_${suffix}";
     hash = {
-      x86_64-linux = "sha256-HywWk3MAWdRVaQyimlQJCFsgydXdE0VSLWliZT7f8w0=";
-      x86_64-darwin = "sha256-GgZVVt1Gm95/kyI/q99fZ9BIN+5kpxumcSJ9BexfARc=";
-      aarch64-darwin = "sha256-ldg+bVROm/XzACCmiMapMQf3f6le9FHzt18QcaH8TxA=";
+      x86_64-linux = "sha256-yCzREyFyGoAPXVVnNX6GUrr83oaPtoNOgZOOd6vJD1Q=";
+      x86_64-darwin = "sha256-WciEpt0vUuXS6YeZkbyFGqQaotXoZkWnkkn5B6/JXwE=";
+      aarch64-darwin = "sha256-iP3Xd/otYEVwU85U2dlFcX9QjDq2CbIqHmcDYVxzqzI=";
     }.${system} or throwSystem;
   };
 

pkgs/applications/misc/toot/default.nix

@@ -1,36 +0,0 @@
-{ lib, fetchFromGitHub, python3Packages, nixosTests }:
-
-python3Packages.buildPythonApplication rec {
-  pname = "toot";
-  version = "0.42.0";
-
-  src = fetchFromGitHub {
-    owner  = "ihabunek";
-    repo   = "toot";
-    rev = "refs/tags/${version}";
-    sha256 = "sha256-FxA/loJzb/DBI1vWC71IFqdFcwjwIezhBJCGNeBzRoU=";
-  };
-
-  nativeCheckInputs = with python3Packages; [ pytest ];
-
-  propagatedBuildInputs = with python3Packages;
-  [
-    requests beautifulsoup4 future wcwidth
-    urwid urwidgets psycopg2 tomlkit click
-  ];
-
-  checkPhase = ''
-    py.test
-  '';
-
-  passthru.tests.toot = nixosTests.pleroma;
-
-  meta = with lib; {
-    description = "Mastodon CLI interface";
-    mainProgram = "toot";
-    homepage    = "https://github.com/ihabunek/toot";
-    license     = licenses.gpl3;
-    maintainers = [ maintainers.matthiasbeyer ];
-  };
-
-}

pkgs/applications/misc/xca/default.nix

@@ -12,13 +12,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "xca";
-  version = "2.7.0";
+  version = "2.8.0";
 
   src = fetchFromGitHub {
     owner = "chris2511";
     repo = "xca";
     rev = "RELEASE.${finalAttrs.version}";
-    hash = "sha256-Ty6j0Fl2smMGxp+1nnD3Fu83bn19gqtRKSA1wDgNZes=";
+    hash = "sha256-2TqqHTutG+5YU2mJNTS3pvtEqV7qKVB+j/dipdmEkIk=";
   };
 
   buildInputs = [ openssl qtbase ];
@@ -36,6 +36,13 @@ stdenv.mkDerivation (finalAttrs: {
 
   enableParallelBuilding = true;
 
+  dontWrapQtApps = stdenv.hostPlatform.isDarwin;
+
+  postInstall = lib.optionalString stdenv.hostPlatform.isDarwin ''
+    mkdir -p "$out/Applications"
+    mv "$out/xca.app" "$out/Applications/xca.app"
+  '';
+
   meta = with lib; {
     description = "X509 certificate generation tool, handling RSA, DSA and EC keys, certificate signing requests (PKCS#10) and CRLs";
     mainProgram = "xca";

pkgs/applications/networking/browsers/chromium/upstream-info.nix

@@ -1,11 +1,11 @@
 {
   stable = {
     chromedriver = {
-      hash_darwin = "sha256-SZfl93TcaD9j59zGflPFmHgIP5NaS8bgDi3l3SRRFiI=";
+      hash_darwin = "sha256-4uE34f99fTiG5FJq0xnEodqQvNT2Aa8kesYOxY44xXA=";
       hash_darwin_aarch64 =
-        "sha256-wLX63aA8l+23ehdBHPcXtoZ2WEhrmYVKzqUDBbrhSRw=";
-      hash_linux = "sha256-kP6N7fM+7+S3JwT2JvqfWDRCfAQiNc/rQlHxjJ8DNuo=";
-      version = "130.0.6723.69";
+        "sha256-gDrfR5EgBx3YRxf3/08gayOhmEqSw4G/QcuNtfHmRHk=";
+      hash_linux = "sha256-qMlM6ilsIqm8G5KLE4uGVb/s2bNyZSyQmxsq+EHKX/c=";
+      version = "130.0.6723.91";
     };
     deps = {
       gn = {
@@ -15,8 +15,8 @@
         version = "2024-09-09";
       };
     };
-    hash = "sha256-k0epbUw9D3Vx7ELNDXIFEnsML+cYvDnHZFOW0kz4Kq8=";
-    version = "130.0.6723.69";
+    hash = "sha256-qXCcHas3l3viszDtY5d5JEToPo2hHTaBmi+pJlKQr4M=";
+    version = "130.0.6723.91";
   };
   ungoogled-chromium = {
     deps = {
@@ -27,11 +27,11 @@
         version = "2024-09-09";
       };
       ungoogled-patches = {
-        hash = "sha256-usNlX/ol8Zn3lQTvp311DuyYbSHF/HN0r7k8qeUIJmU=";
-        rev = "130.0.6723.69-1";
+        hash = "sha256-LhCrwOwPmEn5xlBLTgp2NMfQLxYbSg0pdZxshoqQAGw=";
+        rev = "130.0.6723.91-1";
       };
     };
-    hash = "sha256-k0epbUw9D3Vx7ELNDXIFEnsML+cYvDnHZFOW0kz4Kq8=";
-    version = "130.0.6723.69";
+    hash = "sha256-qXCcHas3l3viszDtY5d5JEToPo2hHTaBmi+pJlKQr4M=";
+    version = "130.0.6723.91";
   };
 }

pkgs/applications/networking/browsers/microsoft-edge/browser.nix

@@ -1,197 +0,0 @@
-{ channel, version, revision, hash }:
-
-{ stdenv
-, fetchurl
-, lib
-, makeWrapper
-
-, binutils-unwrapped
-, xz
-, gnutar
-, file
-
-, glibc
-, glib
-, nss
-, nspr
-, atk
-, at-spi2-atk
-, xorg
-, cups
-, dbus
-, expat
-, libdrm
-, libxkbcommon
-, pipewire
-, gtk3
-, pango
-, cairo
-, gdk-pixbuf
-, mesa
-, alsa-lib
-, at-spi2-core
-, libuuid
-, systemd
-, wayland
-, libGL
-
-# command line arguments which are always set e.g "--disable-gpu"
-, commandLineArgs ? ""
-}:
-
-let
-
-  baseName = "microsoft-edge";
-
-  shortName = if channel == "stable"
-              then "msedge"
-              else "msedge-" + channel;
-
-  longName = if channel == "stable"
-             then baseName
-             else baseName + "-" + channel;
-
-  iconSuffix = lib.optionalString (channel != "stable") "_${channel}";
-
-  desktopSuffix = lib.optionalString (channel != "stable") "-${channel}";
-in
-
-stdenv.mkDerivation rec {
-  pname="${baseName}-${channel}";
-  inherit version;
-
-  src = fetchurl {
-    url = "https://packages.microsoft.com/repos/edge/pool/main/m/${baseName}-${channel}/${baseName}-${channel}_${version}-${revision}_amd64.deb";
-    inherit hash;
-  };
-
-  nativeBuildInputs = [
-    makeWrapper
-  ];
-
-  unpackCmd = "${binutils-unwrapped}/bin/ar p $src data.tar.xz | ${xz}/bin/xz -dc | ${gnutar}/bin/tar -xf -";
-  sourceRoot = ".";
-
-  dontPatch = true;
-  dontConfigure = true;
-  dontPatchELF = true;
-
-  buildPhase = let
-    libPath = {
-      msedge = lib.makeLibraryPath [
-        glibc glib nss nspr atk at-spi2-atk xorg.libX11
-        xorg.libxcb cups.lib dbus.lib expat libdrm
-        xorg.libXcomposite xorg.libXdamage xorg.libXext
-        xorg.libXfixes xorg.libXrandr libxkbcommon
-        pipewire gtk3 pango cairo gdk-pixbuf mesa
-        alsa-lib at-spi2-core xorg.libxshmfence systemd wayland
-      ];
-      naclHelper = lib.makeLibraryPath [
-        glib nspr atk libdrm xorg.libxcb mesa xorg.libX11
-        xorg.libXext dbus.lib libxkbcommon
-      ];
-      libwidevinecdm = lib.makeLibraryPath [
-        glib nss nspr
-      ];
-      libGLESv2 = lib.makeLibraryPath [
-        xorg.libX11 xorg.libXext xorg.libxcb wayland libGL
-      ];
-      liboneauth = lib.makeLibraryPath [
-        libuuid xorg.libX11
-      ];
-    };
-  in ''
-    patchelf \
-      --set-interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" \
-      --set-rpath "${libPath.msedge}" \
-      opt/microsoft/${shortName}/msedge
-
-    patchelf \
-      --set-interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" \
-      opt/microsoft/${shortName}/msedge-sandbox
-
-    patchelf \
-      --set-interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" \
-      opt/microsoft/${shortName}/msedge_crashpad_handler
-
-    patchelf \
-      --set-rpath "${libPath.libwidevinecdm}" \
-      opt/microsoft/${shortName}/WidevineCdm/_platform_specific/linux_x64/libwidevinecdm.so
-
-    patchelf \
-      --set-rpath "${libPath.libGLESv2}" \
-      opt/microsoft/${shortName}/libGLESv2.so
-
-    patchelf \
-      --set-rpath "${libPath.liboneauth}" \
-      opt/microsoft/${shortName}/liboneauth.so
-  '' + lib.optionalString (lib.versionOlder version "121") ''
-    patchelf \
-      --set-interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" \
-      --set-rpath "${libPath.naclHelper}" \
-      opt/microsoft/${shortName}/nacl_helper
-  '';
-
-  installPhase = ''
-    mkdir -p $out
-    cp -R opt usr/bin usr/share $out
-
-    ${if channel == "stable"
-      then "ln -sf $out/bin/${longName} $out/bin/${baseName}-${channel}"
-      else "ln -sf $out/opt/microsoft/${shortName}/${baseName}-${channel} $out/opt/microsoft/${shortName}/${baseName}"}
-
-    ln -sf $out/opt/microsoft/${shortName}/${longName} $out/bin/${longName}
-
-    rm -rf $out/share/doc
-    rm -rf $out/opt/microsoft/${shortName}/cron
-
-    for icon in '16' '24' '32' '48' '64' '128' '256'
-    do
-      ${ "icon_source=$out/opt/microsoft/${shortName}/product_logo_\${icon}${iconSuffix}.png" }
-      ${ "icon_target=$out/share/icons/hicolor/\${icon}x\${icon}/apps" }
-      mkdir -p $icon_target
-      cp $icon_source $icon_target/microsoft-edge${desktopSuffix}.png
-    done
-
-    substituteInPlace $out/share/applications/${longName}.desktop \
-      --replace /usr/bin/${baseName}-${channel} $out/bin/${longName}
-
-    substituteInPlace $out/share/gnome-control-center/default-apps/${longName}.xml \
-      --replace /opt/microsoft/${shortName} $out/opt/microsoft/${shortName}
-
-    substituteInPlace $out/share/menu/${longName}.menu \
-      --replace /opt/microsoft/${shortName} $out/opt/microsoft/${shortName}
-
-    substituteInPlace $out/opt/microsoft/${shortName}/xdg-mime \
-      --replace "\''${XDG_DATA_DIRS:-/usr/local/share:/usr/share}" "\''${XDG_DATA_DIRS:-/run/current-system/sw/share}" \
-      --replace "xdg_system_dirs=/usr/local/share/:/usr/share/" "xdg_system_dirs=/run/current-system/sw/share/" \
-      --replace /usr/bin/file ${file}/bin/file
-
-    substituteInPlace $out/opt/microsoft/${shortName}/default-app-block \
-      --replace /opt/microsoft/${shortName} $out/opt/microsoft/${shortName}
-
-    substituteInPlace $out/opt/microsoft/${shortName}/xdg-settings \
-      --replace "\''${XDG_DATA_DIRS:-/usr/local/share:/usr/share}" "\''${XDG_DATA_DIRS:-/run/current-system/sw/share}" \
-      --replace "\''${XDG_CONFIG_DIRS:-/etc/xdg}" "\''${XDG_CONFIG_DIRS:-/run/current-system/sw/etc/xdg}"
-  '';
-
-  postFixup = ''
-    wrapProgram "$out/bin/${longName}" \
-      --prefix XDG_DATA_DIRS : "${gtk3}/share/gsettings-schemas/${gtk3.pname}-${gtk3.version}" \
-      --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--ozone-platform-hint=auto --enable-features=WaylandWindowDecorations}}" \
-      --add-flags ${lib.escapeShellArg commandLineArgs}
-  '';
-
-  # We only want automatic updates for stable, beta and dev will get updated by the same script
-  # and are only used for testing.
-  passthru = lib.optionalAttrs (channel == "stable") { updateScript = ./update.py; };
-
-  meta = with lib; {
-    homepage = "https://www.microsoft.com/en-us/edge";
-    description = "Web browser from Microsoft";
-    license = licenses.unfree;
-    sourceProvenance = with sourceTypes; [ binaryNativeCode ];
-    platforms = [ "x86_64-linux" ];
-    maintainers = with maintainers; [ zanculmarktum kuwii rhysmdnz ];
-  };
-}

pkgs/applications/networking/browsers/microsoft-edge/default.nix

@@ -1,20 +0,0 @@
-{
-  beta = import ./browser.nix {
-    channel = "beta";
-    version = "130.0.2849.5";
-    revision = "1";
-    hash = "sha256-chvB84+zu6/xgRHyUk33aicc44QJLxxdOOu0ngqmsFM=";
-  };
-  dev = import ./browser.nix {
-    channel = "dev";
-    version = "130.0.2849.1";
-    revision = "1";
-    hash = "sha256-JObqtaaUR6J4rZ90WWw7Ku5Ntl/QBWHo23T7Ohu5p1s=";
-  };
-  stable = import ./browser.nix {
-    channel = "stable";
-    version = "129.0.2792.65";
-    revision = "1";
-    hash = "sha256-xuCtHptE2CG4aiY7gu2sWW3Km4qfB0E/L/PBACIaKOc=";
-  };
-}

pkgs/applications/networking/cluster/arkade/default.nix

@@ -6,13 +6,13 @@
 
 buildGoModule rec {
   pname = "arkade";
-  version = "0.11.27";
+  version = "0.11.29";
 
   src = fetchFromGitHub {
     owner = "alexellis";
     repo = "arkade";
     rev = version;
-    hash = "sha256-5/QAtaAAiIzpvOl43A4OqnIcKlfdxehGjmCREFRKXTs=";
+    hash = "sha256-B5MgBX8GPjBsfOCa1OoZRhQAUQxKH7GXYKMaH6TsUV4=";
   };
 
   CGO_ENABLED = 0;

pkgs/applications/networking/cluster/kubecm/default.nix

@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "kubecm";
-  version = "0.31.0";
+  version = "0.32.0";
 
   src = fetchFromGitHub {
     owner = "sunny0826";
     repo = "kubecm";
     rev = "v${version}";
-    hash = "sha256-Go2lroa8lq1XjIzvdA5ZL/lOjTAyDKopBepqgWzsUII=";
+    hash = "sha256-wwAJha576P5Gt70Ys83IS4Pe1qAKvq46ucnjAcRKEKA=";
   };
 
-  vendorHash = "sha256-BrSYfxftrnNOcPgG/rsTF3OukDd+VlOvE7OJcos7vW4=";
+  vendorHash = "sha256-7NW6j5GzOCP0Eb6IVeC9NRtMJl4ujXPWoWu/NvkMxYA=";
   ldflags = [ "-s" "-w" "-X github.com/sunny0826/kubecm/version.Version=${version}"];
 
   doCheck = false;

pkgs/applications/networking/instant-messengers/telegram/kotatogram-desktop/default.nix

@@ -1,49 +1,34 @@
 { lib
 , stdenv
 , fetchFromGitHub
+, fetchpatch
 , callPackage
-, pkg-config
-, cmake
-, ninja
-, clang
-, lld
-, python3
-, wrapQtAppsHook
-, removeReferencesTo
-, qtbase
-, qtimageformats
-, qtsvg
-, qtwayland
-, kcoreaddons
-, lz4
-, xxHash
-, ffmpeg
-, openalSoft
-, minizip
-, libopus
-, alsa-lib
-, libpulseaudio
-, range-v3
-, tl-expected
-, hunspell
-, gobject-introspection
-, jemalloc
-, rnnoise
-, microsoft-gsl
-, boost
-, libicns
-, darwin
+, libsForQt5
+, yasm
 }:
 
-let
-  tg_owt = callPackage ./tg_owt.nix {
+(libsForQt5.callPackage ../telegram-desktop/default.nix {
+  inherit stdenv;
+
+  tg_owt = (callPackage ../telegram-desktop/tg_owt.nix {
     # tg_owt should use the same compiler
     inherit stdenv;
-  };
+  }).overrideAttrs(oldAttrs: {
+    version = "0-unstable-2024-06-15";
 
-  mainProgram = if stdenv.hostPlatform.isLinux then "kotatogram-desktop" else "Kotatogram";
-in
-stdenv.mkDerivation rec {
+    src = fetchFromGitHub {
+      owner = "desktop-app";
+      repo = "tg_owt";
+      rev = "c9cc4390ab951f2cbc103ff783a11f398b27660b";
+      hash = "sha256-FfWmSYaeryTDbsGJT3R7YK1oiyJcrR7YKKBOF+9PmpY=";
+      fetchSubmodules = true;
+    };
+
+    nativeBuildInputs = oldAttrs.nativeBuildInputs ++ [ yasm ];
+  });
+
+  withWebKitGTK = false;
+}).overrideAttrs {
   pname = "kotatogram-desktop";
   version = "1.4.9-unstable-2024-09-27";
 
@@ -59,128 +44,15 @@ stdenv.mkDerivation rec {
     ./macos.patch
     ./macos-opengl.patch
     ./macos-qt5.patch
+    (fetchpatch {
+      url = "https://gitlab.com/mnauw/cppgir/-/commit/c8bb1c6017a6f7f2e47bd10543aea6b3ec69a966.patch";
+      stripLen = 1;
+      extraPrefix = "cmake/external/glib/cppgir/";
+      hash = "sha256-8B4h3BTG8dIlt3+uVgBI569E9eCebcor9uohtsrZpnI=";
+    })
   ];
 
-  postPatch = lib.optionalString stdenv.hostPlatform.isLinux ''
-    substituteInPlace Telegram/ThirdParty/libtgvoip/os/linux/AudioInputALSA.cpp \
-      --replace-fail '"libasound.so.2"' '"${alsa-lib}/lib/libasound.so.2"'
-    substituteInPlace Telegram/ThirdParty/libtgvoip/os/linux/AudioOutputALSA.cpp \
-      --replace-fail '"libasound.so.2"' '"${alsa-lib}/lib/libasound.so.2"'
-    substituteInPlace Telegram/ThirdParty/libtgvoip/os/linux/AudioPulse.cpp \
-      --replace-fail '"libpulse.so.0"' '"${libpulseaudio}/lib/libpulse.so.0"'
-  '' + lib.optionalString stdenv.hostPlatform.isDarwin ''
-    substituteInPlace Telegram/lib_webrtc/webrtc/platform/mac/webrtc_environment_mac.mm \
-      --replace-fail kAudioObjectPropertyElementMain kAudioObjectPropertyElementMaster
-  '';
-
-  # Wrapping the inside of the app bundles, avoiding double-wrapping
-  dontWrapQtApps = stdenv.hostPlatform.isDarwin;
-
-  nativeBuildInputs = [
-    pkg-config
-    cmake
-    ninja
-    python3
-    wrapQtAppsHook
-    removeReferencesTo
-  ] ++ lib.optionals stdenv.hostPlatform.isLinux [
-    # to build bundled libdispatch
-    clang
-    gobject-introspection
-  ] ++ lib.optionals stdenv.hostPlatform.isDarwin [
-    lld
-  ];
-
-  buildInputs = [
-    qtbase
-    qtimageformats
-    qtsvg
-    lz4
-    xxHash
-    ffmpeg
-    openalSoft
-    minizip
-    libopus
-    range-v3
-    tl-expected
-    rnnoise
-    tg_owt
-    microsoft-gsl
-    boost
-  ] ++ lib.optionals stdenv.hostPlatform.isLinux [
-    qtwayland
-    kcoreaddons
-    alsa-lib
-    libpulseaudio
-    hunspell
-    jemalloc
-  ] ++ lib.optionals stdenv.hostPlatform.isDarwin (with darwin.apple_sdk_11_0.frameworks; [
-    Cocoa
-    CoreFoundation
-    CoreServices
-    CoreText
-    CoreGraphics
-    CoreMedia
-    OpenGL
-    AudioUnit
-    ApplicationServices
-    Foundation
-    AGL
-    Security
-    SystemConfiguration
-    Carbon
-    AudioToolbox
-    VideoToolbox
-    VideoDecodeAcceleration
-    AVFoundation
-    CoreAudio
-    CoreVideo
-    CoreMediaIO
-    QuartzCore
-    AppKit
-    CoreWLAN
-    WebKit
-    IOKit
-    GSS
-    MediaPlayer
-    IOSurface
-    Metal
-    NaturalLanguage
-    libicns
-  ]);
-
-  enableParallelBuilding = true;
-
-  env = lib.optionalAttrs stdenv.hostPlatform.isDarwin {
-    NIX_CFLAGS_LINK = "-fuse-ld=lld";
-  };
-
-  cmakeFlags = [
-    "-DTDESKTOP_API_TEST=ON"
-  ];
-
-  installPhase = lib.optionalString stdenv.hostPlatform.isDarwin ''
-    mkdir -p $out/Applications
-    cp -r ${mainProgram}.app $out/Applications
-    ln -s $out/{Applications/${mainProgram}.app/Contents/MacOS,bin}
-  '';
-
-  preFixup = ''
-    remove-references-to -t ${stdenv.cc.cc} $out/bin/${mainProgram}
-    remove-references-to -t ${microsoft-gsl} $out/bin/${mainProgram}
-    remove-references-to -t ${tg_owt.dev} $out/bin/${mainProgram}
-  '';
-
-  postFixup = lib.optionalString stdenv.hostPlatform.isDarwin ''
-    wrapQtApp $out/Applications/${mainProgram}.app/Contents/MacOS/${mainProgram}
-  '';
-
-  passthru = {
-    inherit tg_owt;
-  };
-
   meta = with lib; {
-    inherit mainProgram;
     description = "Kotatogram – experimental Telegram Desktop fork";
     longDescription = ''
       Unofficial desktop client for the Telegram messenger, based on Telegram Desktop.
@@ -192,5 +64,6 @@ stdenv.mkDerivation rec {
     homepage = "https://kotatogram.github.io";
     changelog = "https://github.com/kotatogram/kotatogram-desktop/releases/tag/k{version}";
     maintainers = with maintainers; [ ilya-fedin ];
+    mainProgram = if stdenv.hostPlatform.isLinux then "kotatogram-desktop" else "Kotatogram";
   };
 }

pkgs/applications/networking/instant-messengers/telegram/kotatogram-desktop/tg_owt.nix

@@ -1,115 +0,0 @@
-{ lib
-, stdenv
-, fetchFromGitHub
-, fetchpatch2
-, pkg-config
-, cmake
-, ninja
-, yasm
-, libjpeg
-, openssl
-, libopus
-, ffmpeg
-, protobuf
-, openh264
-, crc32c
-, libvpx
-, libX11
-, libXtst
-, libXcomposite
-, libXdamage
-, libXext
-, libXrender
-, libXrandr
-, libXi
-, glib
-, abseil-cpp
-, pipewire
-, mesa
-, libdrm
-, libGL
-, darwin
-}:
-
-stdenv.mkDerivation {
-  pname = "tg_owt";
-  version = "0-unstable-2024-06-15";
-
-  src = fetchFromGitHub {
-    owner = "desktop-app";
-    repo = "tg_owt";
-    rev = "c9cc4390ab951f2cbc103ff783a11f398b27660b";
-    sha256 = "sha256-FfWmSYaeryTDbsGJT3R7YK1oiyJcrR7YKKBOF+9PmpY=";
-    fetchSubmodules = true;
-  };
-
-  patches = [
-    # Remove usage of AVCodecContext::reordered_opaque
-    (fetchpatch2 {
-      name = "webrtc-ffmpeg-7.patch";
-      url = "https://webrtc.googlesource.com/src/+/e7d10047096880feb5e9846375f2da54aef91202%5E%21/?format=TEXT";
-      decode = "base64 -d";
-      stripLen = 1;
-      extraPrefix = "src/";
-      hash = "sha256-EdwHeVko8uDsP5GTw2ryWiQgRVCAdPc1me6hySdiwMU=";
-    })
-  ];
-
-  postPatch = lib.optionalString stdenv.hostPlatform.isLinux ''
-    substituteInPlace src/modules/desktop_capture/linux/wayland/egl_dmabuf.cc \
-      --replace '"libEGL.so.1"' '"${libGL}/lib/libEGL.so.1"' \
-      --replace '"libGL.so.1"' '"${libGL}/lib/libGL.so.1"' \
-      --replace '"libgbm.so.1"' '"${mesa}/lib/libgbm.so.1"' \
-      --replace '"libdrm.so.2"' '"${libdrm}/lib/libdrm.so.2"'
-  '';
-
-  outputs = [ "out" "dev" ];
-
-  nativeBuildInputs = [ pkg-config cmake ninja yasm ];
-
-  propagatedBuildInputs = [
-    libjpeg
-    openssl
-    libopus
-    ffmpeg
-    protobuf
-    openh264
-    crc32c
-    libvpx
-    abseil-cpp
-  ] ++ lib.optionals stdenv.hostPlatform.isLinux [
-    libX11
-    libXtst
-    libXcomposite
-    libXdamage
-    libXext
-    libXrender
-    libXrandr
-    libXi
-    glib
-    pipewire
-    mesa
-    libdrm
-    libGL
-  ] ++ lib.optionals stdenv.hostPlatform.isDarwin (with darwin.apple_sdk.frameworks; [
-    Cocoa
-    AppKit
-    IOKit
-    IOSurface
-    Foundation
-    AVFoundation
-    CoreMedia
-    VideoToolbox
-    CoreGraphics
-    CoreVideo
-    OpenGL
-    Metal
-    MetalKit
-    CoreFoundation
-    ApplicationServices
-  ]);
-
-  enableParallelBuilding = true;
-
-  meta.license = lib.licenses.bsd3;
-}

pkgs/applications/networking/instant-messengers/telegram/kotatogram-desktop/with-webkit.nix

@@ -1,4 +1,4 @@
-{ stdenv, lib, kotatogram-desktop, glib-networking, webkitgtk_6_0, makeWrapper }:
+{ stdenv, lib, kotatogram-desktop, glib-networking, webkitgtk_4_1, makeWrapper }:
 
 stdenv.mkDerivation {
   pname = "${kotatogram-desktop.pname}-with-webkit";
@@ -8,12 +8,13 @@ stdenv.mkDerivation {
   installPhase = ''
     mkdir -p $out
     cp -r ${kotatogram-desktop}/share $out
+    substituteInPlace $out/share/dbus-1/services/* --replace-fail ${kotatogram-desktop} $out
   '';
   postFixup = ''
     mkdir -p $out/bin
     makeWrapper ${kotatogram-desktop}/bin/kotatogram-desktop $out/bin/kotatogram-desktop \
       --prefix GIO_EXTRA_MODULES : ${glib-networking}/lib/gio/modules \
-      --prefix LD_LIBRARY_PATH : ${lib.makeLibraryPath [ webkitgtk_6_0 ]}
+      --prefix LD_LIBRARY_PATH : ${lib.makeLibraryPath [ webkitgtk_4_1 ]}
   '';
   meta = kotatogram-desktop.meta // {
     platforms = lib.platforms.linux;

pkgs/applications/networking/instant-messengers/telegram/telegram-desktop/default.nix

@@ -1,48 +1,44 @@
 { lib
+, stdenv
 , fetchFromGitHub
 , callPackage
 , pkg-config
 , cmake
 , ninja
+, clang
+, lld
 , python3
-, gobject-introspection
-, wrapGAppsHook3
 , wrapQtAppsHook
-, extra-cmake-modules
+, tg_owt ? callPackage ./tg_owt.nix { inherit stdenv; }
 , qtbase
-, qtwayland
-, qtsvg
 , qtimageformats
-, gtk3
-, glib-networking
-, boost
-, fmt
-, libdbusmenu
+, qtsvg
+, qtwayland
+, kcoreaddons
 , lz4
 , xxHash
 , ffmpeg
+, protobuf
 , openalSoft
 , minizip
 , libopus
 , alsa-lib
 , libpulseaudio
-, pipewire
 , range-v3
 , tl-expected
 , hunspell
-, webkitgtk_6_0
+, gobject-introspection
 , jemalloc
 , rnnoise
-, protobuf
-, abseil-cpp
-, xdg-utils
 , microsoft-gsl
-, rlottie
+, boost
 , ada
-, stdenv
-, darwin
-, lld
+, withWebKitGTK ? true
+, wrapGAppsHook3
+, glib-networking
+, webkitgtk_4_1
 , libicns
+, darwin
 , nix-update-script
 }:
 
@@ -53,14 +49,6 @@
 # - https://git.alpinelinux.org/aports/tree/testing/telegram-desktop/APKBUILD
 # - https://github.com/void-linux/void-packages/blob/master/srcpkgs/telegram-desktop/template
 
-let
-  tg_owt = callPackage ./tg_owt.nix {
-    inherit stdenv;
-    abseil-cpp = abseil-cpp.override {
-      cxxStandard = "20";
-    };
-  };
-in
 stdenv.mkDerivation (finalAttrs: {
   pname = "telegram-desktop";
   version = "5.6.3";
@@ -75,10 +63,6 @@ stdenv.mkDerivation (finalAttrs: {
 
   patches = [
     ./macos.patch
-    # the generated .desktop files contains references to unwrapped tdesktop, breaking scheme handling
-    # and the scheme handler is already registered in the packaged .desktop file, rendering this unnecessary
-    # see https://github.com/NixOS/nixpkgs/issues/218370
-    ./scheme.patch
   ];
 
   postPatch = lib.optionalString stdenv.hostPlatform.isLinux ''
@@ -88,16 +72,19 @@ stdenv.mkDerivation (finalAttrs: {
       --replace-fail '"libasound.so.2"' '"${alsa-lib}/lib/libasound.so.2"'
     substituteInPlace Telegram/ThirdParty/libtgvoip/os/linux/AudioPulse.cpp \
       --replace-fail '"libpulse.so.0"' '"${libpulseaudio}/lib/libpulse.so.0"'
+  '' + lib.optionalString (stdenv.hostPlatform.isLinux && withWebKitGTK) ''
     substituteInPlace Telegram/lib_webview/webview/platform/linux/webview_linux_webkitgtk_library.cpp \
-      --replace-fail '"libwebkitgtk-6.0.so.4"' '"${webkitgtk_6_0}/lib/libwebkitgtk-6.0.so.4"'
+      --replace-fail '"libwebkit2gtk-4.1.so.0"' '"${webkitgtk_4_1}/lib/libwebkit2gtk-4.1.so.0"'
   '' + lib.optionalString stdenv.hostPlatform.isDarwin ''
     substituteInPlace Telegram/lib_webrtc/webrtc/platform/mac/webrtc_environment_mac.mm \
       --replace-fail kAudioObjectPropertyElementMain kAudioObjectPropertyElementMaster
   '';
 
-  # We want to run wrapProgram manually (with additional parameters)
+  # Avoid double-wrapping
   dontWrapGApps = true;
-  dontWrapQtApps = true;
+
+  # Wrapping the inside of the app bundles, avoiding double-wrapping
+  dontWrapQtApps = stdenv.hostPlatform.isDarwin;
 
   nativeBuildInputs = [
     pkg-config
@@ -106,18 +93,19 @@ stdenv.mkDerivation (finalAttrs: {
     python3
     wrapQtAppsHook
   ] ++ lib.optionals stdenv.hostPlatform.isLinux [
+    # to build bundled libdispatch
+    clang
     gobject-introspection
+  ] ++ lib.optionals (stdenv.hostPlatform.isLinux && withWebKitGTK) [
     wrapGAppsHook3
-    extra-cmake-modules
   ] ++ lib.optionals stdenv.hostPlatform.isDarwin [
     lld
   ];
 
   buildInputs = [
     qtbase
-    qtsvg
     qtimageformats
-    boost
+    qtsvg
     lz4
     xxHash
     ffmpeg
@@ -127,23 +115,21 @@ stdenv.mkDerivation (finalAttrs: {
     range-v3
     tl-expected
     rnnoise
-    protobuf
     tg_owt
     microsoft-gsl
-    rlottie
+    boost
     ada
   ] ++ lib.optionals stdenv.hostPlatform.isLinux [
+    protobuf
     qtwayland
-    gtk3
-    glib-networking
-    fmt
-    libdbusmenu
+    kcoreaddons
     alsa-lib
     libpulseaudio
-    pipewire
     hunspell
-    webkitgtk_6_0
     jemalloc
+  ] ++ lib.optionals (stdenv.hostPlatform.isLinux && withWebKitGTK) [
+    glib-networking
+    webkitgtk_4_1
   ] ++ lib.optionals stdenv.hostPlatform.isDarwin (with darwin.apple_sdk_11_0.frameworks; [
     Cocoa
     CoreFoundation
@@ -185,33 +171,22 @@ stdenv.mkDerivation (finalAttrs: {
   };
 
   cmakeFlags = [
-    (lib.cmakeBool "DESKTOP_APP_DISABLE_AUTOUPDATE" true)
     # We're allowed to used the API ID of the Snap package:
     (lib.cmakeFeature "TDESKTOP_API_ID" "611335")
     (lib.cmakeFeature "TDESKTOP_API_HASH" "d524b414d21f4d37f08684c1df41ac9c")
-    # See: https://github.com/NixOS/nixpkgs/pull/130827#issuecomment-885212649
-    (lib.cmakeBool "DESKTOP_APP_USE_PACKAGED_FONTS" false)
   ];
 
-  preBuild = ''
-    # for cppgir to locate gir files
-    export GI_GIR_PATH="$XDG_DATA_DIRS"
-  '';
-
   installPhase = lib.optionalString stdenv.hostPlatform.isDarwin ''
     mkdir -p $out/Applications
     cp -r ${finalAttrs.meta.mainProgram}.app $out/Applications
     ln -s $out/{Applications/${finalAttrs.meta.mainProgram}.app/Contents/MacOS,bin}
   '';
 
-  postFixup = lib.optionalString stdenv.hostPlatform.isLinux ''
-    # This is necessary to run Telegram in a pure environment.
-    # We also use gappsWrapperArgs from wrapGAppsHook.
-    wrapProgram $out/bin/${finalAttrs.meta.mainProgram} \
-      "''${gappsWrapperArgs[@]}" \
-      "''${qtWrapperArgs[@]}" \
-      --suffix PATH : ${lib.makeBinPath [ xdg-utils ]}
-  '' + lib.optionalString stdenv.hostPlatform.isDarwin ''
+  preFixup = lib.optionalString (stdenv.hostPlatform.isLinux && withWebKitGTK) ''
+    qtWrapperArgs+=("''${gappsWrapperArgs[@]}")
+  '';
+
+  postFixup = lib.optionalString stdenv.hostPlatform.isDarwin ''
     wrapQtApp $out/Applications/${finalAttrs.meta.mainProgram}.app/Contents/MacOS/${finalAttrs.meta.mainProgram}
   '';
 

pkgs/applications/networking/instant-messengers/telegram/telegram-desktop/scheme.patch

@@ -1,12 +0,0 @@
-diff --git a/Telegram/SourceFiles/core/application.cpp b/Telegram/SourceFiles/core/application.cpp
-index e3e0de6c6..d5851bd6e 100644
---- a/Telegram/SourceFiles/core/application.cpp
-+++ b/Telegram/SourceFiles/core/application.cpp
-@@ -421,7 +421,6 @@ void Application::run() {
- 
- void Application::autoRegisterUrlScheme() {
- 	if (!OptionSkipUrlSchemeRegister.value()) {
--		InvokeQueued(this, [] { RegisterUrlScheme(); });
- 	}
- }
- 

pkgs/applications/networking/instant-messengers/telegram/telegram-desktop/tg_owt.nix

@@ -5,29 +5,31 @@
   fetchpatch2,
   pkg-config,
   cmake,
-  crc32c,
+  ninja,
   python3,
   libjpeg,
   openssl,
   libopus,
   ffmpeg,
   openh264,
+  crc32c,
   libvpx,
-  libXi,
-  libXfixes,
+  libX11,
   libXtst,
   libXcomposite,
   libXdamage,
   libXext,
   libXrender,
   libXrandr,
+  libXi,
   glib,
   abseil-cpp,
   pipewire,
   mesa,
+  libdrm,
   libGL,
-  unstableGitUpdater,
   darwin,
+  unstableGitUpdater,
 }:
 
 stdenv.mkDerivation {
@@ -38,7 +40,7 @@ stdenv.mkDerivation {
     owner = "desktop-app";
     repo = "tg_owt";
     rev = "dc17143230b5519f3c1a8da0079e00566bd4c5a8";
-    sha256 = "sha256-7j7hBIOXEdNJDnDSVUqy234nkTCaeZ9tDAzqvcuaq0o=";
+    hash = "sha256-7j7hBIOXEdNJDnDSVUqy234nkTCaeZ9tDAzqvcuaq0o=";
     fetchSubmodules = true;
   };
 
@@ -54,36 +56,50 @@ stdenv.mkDerivation {
     })
   ];
 
+  postPatch = lib.optionalString stdenv.hostPlatform.isLinux ''
+    substituteInPlace src/modules/desktop_capture/linux/wayland/egl_dmabuf.cc \
+      --replace-fail '"libEGL.so.1"' '"${lib.getLib libGL}/lib/libEGL.so.1"' \
+      --replace-fail '"libGL.so.1"' '"${lib.getLib libGL}/lib/libGL.so.1"' \
+      --replace-fail '"libgbm.so.1"' '"${lib.getLib mesa}/lib/libgbm.so.1"' \
+      --replace-fail '"libdrm.so.2"' '"${lib.getLib libdrm}/lib/libdrm.so.2"'
+  '';
+
   outputs = [
     "out"
     "dev"
   ];
 
   nativeBuildInputs = [
-    cmake
     pkg-config
+    cmake
+    ninja
     python3
   ];
 
-  buildInputs =
+  propagatedBuildInputs =
     [
-      openssl
       libjpeg
+      openssl
       libopus
       ffmpeg
+      openh264
+      crc32c
+      libvpx
+      abseil-cpp
     ]
     ++ lib.optionals stdenv.hostPlatform.isLinux [
-      glib
-      libXi
+      libX11
+      libXtst
       libXcomposite
       libXdamage
       libXext
-      libXfixes
       libXrender
       libXrandr
-      libXtst
+      libXi
+      glib
       pipewire
       mesa
+      libdrm
       libGL
     ]
     ++ lib.optionals stdenv.hostPlatform.isDarwin (
@@ -99,6 +115,7 @@ stdenv.mkDerivation {
         VideoToolbox
         CoreGraphics
         CoreVideo
+        OpenGL
         Metal
         MetalKit
         CoreFoundation
@@ -106,18 +123,6 @@ stdenv.mkDerivation {
       ]
     );
 
-  propagatedBuildInputs = [
-    abseil-cpp
-    crc32c
-    openh264
-    libvpx
-  ];
-
-  cmakeFlags = [
-    # Building as a shared library isn't officially supported and may break at any time.
-    (lib.cmakeBool "BUILD_SHARED_LIBS" false)
-  ];
-
   passthru.updateScript = unstableGitUpdater { };
 
   meta = {

pkgs/applications/networking/irc/srain/default.nix

@@ -21,13 +21,13 @@
 
 stdenv.mkDerivation rec {
   pname = "srain";
-  version = "1.7.0";
+  version = "1.8.0";
 
   src = fetchFromGitHub {
     owner = "SrainApp";
     repo = "srain";
     rev = version;
-    hash = "sha256-mhnlHnF23+VZvSPNuTYYUVcA6Md4y2AGqEuJphY1/IY=";
+    hash = "sha256-c5dy5dD5Eb/MVNCpLqIGNuafsrmgLjEfRfSxKVxu5wY=";
   };
 
   nativeBuildInputs = [

pkgs/applications/office/docear/default.nix

@@ -1,45 +0,0 @@
-{lib, stdenv, fetchurl, runtimeShell, makeWrapper
-, oraclejre
-, antialiasFont ? true
-}:
-
-stdenv.mkDerivation {
-  pname = "docear";
-  version = "1.2";
-
-  src = fetchurl {
-    url = "http://docear.org/downloads/docear_linux.tar.gz";
-    sha256 = "1g5n7r2x4gas6dl2fbyh7v9yxdcb6bzml8n3ldmpzv1rncgjcdp4";
-  };
-
-  nativeBuildInputs = [ makeWrapper ];
-  buildInputs = [ oraclejre ];
-
-  buildPhase = "";
-  installPhase = ''
-    mkdir -p $out/bin
-    mkdir -p $out/share
-    cp -R * $out/share
-    chmod 0755 $out/share/ -R
-
-    # The wrapper ensures oraclejre is used
-    makeWrapper ${runtimeShell} $out/bin/docear \
-      --set _JAVA_OPTIONS "${lib.optionalString antialiasFont "-Dswing.aatext=TRUE -Dawt.useSystemAAFontSettings=on"}" \
-      --set JAVA_HOME ${oraclejre.home} \
-      --add-flags "$out/share/docear.sh"
-
-    chmod 0755 $out/bin/docear
-    '';
-
-  meta = with lib; {
-    description = "Unique solution to academic literature management";
-    homepage = "http://www.docear.org/";
-    # Licenses at: http://www.docear.org/software/download/
-    license = with licenses; [
-      gpl2 # for the main software and some dependencies
-      bsd3 # for one of its dependencies
-    ];
-    maintainers = with maintainers; [ unode ];
-    platforms = platforms.all;
-  };
-}

pkgs/applications/office/libreoffice/default.nix

@@ -99,7 +99,7 @@
 , libetonyek
 , liborcus
 , libpng
-, langs ? [ "ar" "ca" "cs" "da" "de" "en-GB" "en-US" "eo" "es" "fi" "fr" "hu" "it" "ja" "ko" "nl" "pl" "pt" "pt-BR" "ro" "ru" "sk" "sl" "tr" "uk" "zh-CN" ]
+, langs ? [ "ar" "ca" "cs" "da" "de" "en-GB" "en-US" "eo" "es" "fi" "fr" "hu" "it" "ja" "ko" "nl" "pl" "pt" "pt-BR" "ro" "ru" "sk" "sl" "tr" "uk" "zh-CN" "zh-TW" ]
 , withFonts ? false
 , withHelp ? true
 , kdeIntegration ? false

pkgs/applications/science/biology/seqkit/default.nix

@@ -5,16 +5,16 @@
 
 buildGoModule rec {
   pname = "seqkit";
-  version = "2.8.2";
+  version = "2.9.0";
 
   src = fetchFromGitHub {
     owner = "shenwei356";
     repo = "seqkit";
     rev = "v${version}";
-    sha256 = "sha256-jCzd36ds9YVBpnyR3gDJSX3CCVXzC9WkQWmkcDiDWfM=";
+    sha256 = "sha256-xPlqS0tYx077YD/MIxGFn8Bdy4h25dY8idhypIj28rI=";
   };
 
-  vendorHash = "sha256-0//kySYhNmfiwiys/Ku0/8RzKpnxO0+byD8pcIkvDY0=";
+  vendorHash = "sha256-EzEomz9GVcirx+Uk1Ygmmb1/GkdUS9aBStLxuNzjHAU=";
 
   meta = with lib; {
     description = "cross-platform and ultrafast toolkit for FASTA/Q file manipulation";

pkgs/applications/science/logic/surelog/default.nix

@@ -12,6 +12,7 @@
 , antlr4
 , capnproto
 , nlohmann_json
+, darwin
 }:
 
 stdenv.mkDerivation (finalAttrs: {
@@ -45,7 +46,7 @@ stdenv.mkDerivation (finalAttrs: {
     capnproto
     antlr4.runtime.cpp
     nlohmann_json
-  ];
+  ] ++ lib.optional stdenv.isDarwin [ darwin.libutil ];
 
   cmakeFlags = [
     "-DSURELOG_USE_HOST_CAPNP=On"

pkgs/applications/science/logic/uhdm/default.nix

@@ -5,6 +5,7 @@
 , python3
 , capnproto
 , gtest
+, darwin
 }:
 
 stdenv.mkDerivation (finalAttrs: {
@@ -28,6 +29,8 @@ stdenv.mkDerivation (finalAttrs: {
 
   buildInputs = [
     capnproto
+  ] ++ lib.optionals stdenv.hostPlatform.isDarwin [
+    darwin.libutil
   ];
 
   cmakeFlags = [

pkgs/applications/science/math/clp/default.nix

@@ -1,13 +1,13 @@
 { lib, stdenv, fetchFromGitHub, pkg-config, coin-utils, zlib, osi }:
 
 stdenv.mkDerivation rec {
-  version = "1.17.9";
+  version = "1.17.10";
   pname = "clp";
   src = fetchFromGitHub {
     owner = "coin-or";
     repo = "Clp";
     rev = "releases/${version}";
-    hash = "sha256-kHCDji+yIf5mCoxKB2b/HaATGmwwIAPEV74tthIMeMY=";
+    hash = "sha256-9IlBT6o1aHAaYw2/39XrUis72P9fesmG3B6i/e+v3mM=";
   };
 
   nativeBuildInputs = [ pkg-config ];

pkgs/applications/science/math/pari/gp2c.nix

@@ -7,11 +7,11 @@
 
 stdenv.mkDerivation rec {
   pname = "gp2c";
-  version = "0.0.13";
+  version = "0.0.14";
 
   src = fetchurl {
     url = "https://pari.math.u-bordeaux.fr/pub/pari/GP2C/${pname}-${version}.tar.gz";
-    hash = "sha256-JhN07Kc+vXbBEqlZPcootkgSqnYlYf2lpLLCzXmmnTY=";
+    hash = "sha256-r2ESzAKUBFfiOdpEM9Gg2Npg7u8p98xyL2TNSsALezA=";
   };
 
   buildInputs = [

pkgs/applications/system/glances/default.nix

@@ -5,20 +5,15 @@
   isPyPy,
   lib,
   defusedxml,
-  future,
-  ujson,
   packaging,
   psutil,
   setuptools,
-  pydantic,
   # Optional dependencies:
   fastapi,
   jinja2,
-  orjson,
   pysnmp,
   hddtemp,
   netifaces, # IP module
-  py-cpuinfo,
   uvicorn,
   requests,
   prometheus-client,
@@ -26,16 +21,20 @@
 
 buildPythonApplication rec {
   pname = "glances";
-  version = "4.1.2.1";
+  version = "4.2.0";
+  pyproject = true;
+
   disabled = isPyPy;
 
   src = fetchFromGitHub {
     owner = "nicolargo";
     repo = "glances";
     rev = "refs/tags/v${version}";
-    hash = "sha256-SlKt+wjzI9QRmMVvbIERuhQuCCaOh7L89WuNUXNhkuI=";
+    hash = "sha256-liyrMaqBgK7UZjWIKIgIFbskTGaWfyrK8L74DKmaDmY=";
   };
 
+  build-system = [ setuptools ];
+
   # On Darwin this package segfaults due to mismatch of pure and impure
   # CoreFoundation. This issues was solved for binaries but for interpreted
   # scripts a workaround below is still required.
@@ -46,27 +45,27 @@ buildPythonApplication rec {
     "/System/Library/Frameworks"
   ];
 
-  doCheck = true;
-  preCheck = lib.optionalString stdenv.hostPlatform.isDarwin ''
-    export DYLD_FRAMEWORK_PATH=/System/Library/Frameworks
+  # some tests fail in darwin sandbox
+  doCheck = !stdenv.hostPlatform.isDarwin;
+
+  checkPhase = ''
+    runHook preCheck
+
+    python unittest-core.py
+
+    runHook postCheck
   '';
 
-  propagatedBuildInputs = [
+  dependencies = [
     defusedxml
-    future
-    ujson
     netifaces
     packaging
     psutil
     pysnmp
-    setuptools
-    py-cpuinfo
-    pydantic
     fastapi
     uvicorn
     requests
     jinja2
-    orjson
     prometheus-client
   ] ++ lib.optional stdenv.hostPlatform.isLinux hddtemp;
 

pkgs/applications/version-management/fnc/default.nix

@@ -1,4 +1,4 @@
-{ lib, fetchurl, stdenv, zlib, ncurses, libiconv }:
+{ lib, fetchurl, stdenv, zlib, ncurses, libiconv, darwin }:
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "fnc";
@@ -9,7 +9,9 @@ stdenv.mkDerivation (finalAttrs: {
     hash = "sha256-npS+sOxF0S/9TuFjtEFlev0HpIOsaP6zmcfopPNUehk=";
   };
 
-  buildInputs = [ libiconv ncurses zlib ];
+  buildInputs = [ libiconv ncurses zlib ] ++ lib.optionals stdenv.hostPlatform.isDarwin [
+    darwin.libutil
+  ];
 
   makeFlags = [ "PREFIX=$(out)" ];
 

pkgs/applications/version-management/gql/default.nix

@@ -9,16 +9,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "gql";
-  version = "0.28.0";
+  version = "0.29.1";
 
   src = fetchFromGitHub {
     owner = "AmrDeveloper";
     repo = "GQL";
     rev = version;
-    hash = "sha256-BA94Q8nRf4NptVBHSMYLMEklB9vHaXRU1+o7shXhkZQ=";
+    hash = "sha256-Py2wTWuUfr6Poxtab4JikG4D7Iv6mBocLEbn0zgz+k8=";
   };
 
-  cargoHash = "sha256-L+o0ZhTI7x01DpGuhWrvzvSZDYHc++31svWTJ41qx90=";
+  cargoHash = "sha256-BAaHnBkTmk58uAnZyZ7id1WmKz/HiOKSvdZApmgk6rs=";
 
   nativeBuildInputs = [
     pkg-config

pkgs/applications/video/go-chromecast/default.nix

@@ -1,25 +0,0 @@
-{ lib, buildGoModule, fetchFromGitHub }:
-
-buildGoModule rec {
-  pname = "go-chromecast";
-  version = "0.3.1";
-
-  src = fetchFromGitHub {
-    owner = "vishen";
-    repo = pname;
-    rev = "v${version}";
-    hash = "sha256-Kzo8iWj4mtnX1Jxm2sLsnmEOmpzScxWHZ/sLYYm3vQI=";
-  };
-
-  vendorHash = "sha256-cEUlCR/xtPJJSWplV1COwV6UfzSmVArF4V0pJRk+/Og=";
-
-  ldflags = [ "-s" "-w" "-X main.version=${version}" "-X main.commit=${src.rev}" "-X main.date=unknown" ];
-
-  meta = with lib; {
-    homepage = "https://github.com/vishen/go-chromecast";
-    description = "CLI for Google Chromecast, Home devices and Cast Groups";
-    license = licenses.asl20;
-    maintainers = [ ];
-    mainProgram = "go-chromecast";
-  };
-}

pkgs/applications/video/kodi/addons/youtube/default.nix

@@ -3,13 +3,13 @@
 buildKodiAddon rec {
   pname = "youtube";
   namespace = "plugin.video.youtube";
-  version = "7.1.0";
+  version = "7.1.0.1";
 
   src = fetchFromGitHub {
     owner = "anxdpanic";
     repo = "plugin.video.youtube";
     rev = "v${version}";
-    hash = "sha256-I3dSGcPQVVhn4RO8CHtn3FG2dheSv4XiDO7w+MtTjRU=";
+    hash = "sha256-5tctuY2vYEfkkNVjprnUPJ/crwmMGCEdcRxUQR5EQxw=";
   };
 
   propagatedBuildInputs = [

pkgs/applications/video/mlv-app/aarch64-flags.patch

@@ -2,12 +2,12 @@ diff --git a/platform/qt/MLVApp.pro b/platform/qt/MLVApp.pro
 index ebdc552..3e37573 100644
 --- a/platform/qt/MLVApp.pro
 +++ b/platform/qt/MLVApp.pro
-@@ -84,7 +84,7 @@ win32{
+@@ -120,7 +120,7 @@ win32{
 
  # Linux
  linux-g++*{
--    QMAKE_CFLAGS += -O3 -fopenmp -msse4.1 -mssse3 -msse3 -msse2 -msse -std=c99
-+    QMAKE_CFLAGS += -O3 -fopenmp -std=c99
-     QMAKE_CXXFLAGS += -fopenmp
+-    QMAKE_CFLAGS += -O3 -fopenmp -msse4.1 -mssse3 -msse3 -msse2 -msse -std=c99 -ftree-vectorize
++    QMAKE_CFLAGS += -O3 -fopenmp -std=c99 -ftree-vectorize
+     QMAKE_CXXFLAGS += -fopenmp -std=c++11 -ftree-vectorize
      LIBS += -lgomp
  }

pkgs/applications/video/mlv-app/default.nix

@@ -18,7 +18,10 @@ mkDerivation rec {
     sha256 = "sha256-RfZXHmWSjZBxNFwQ/bzHppsLS0LauURIdnkAzxAIBcU=";
   };
 
-  patches = if stdenv.hostPlatform.isAarch64 then ./aarch64-flags.patch else null;
+  patches = lib.optionals stdenv.hostPlatform.isAarch64 [
+    # remove optimization flags with x86 only instruction sets
+    ./aarch64-flags.patch
+  ];
 
   installPhase = ''
     runHook preInstall

pkgs/applications/virtualization/distrobox/default.nix

@@ -2,13 +2,13 @@
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "distrobox";
-  version = "1.7.2.1";
+  version = "1.8.0";
 
   src = fetchFromGitHub {
     owner = "89luca89";
     repo = "distrobox";
     rev = finalAttrs.version;
-    hash = "sha256-H2jeKs0h4ZAcP33HB5jptlubq62cwnjPK2wSlEIfFWA=";
+    hash = "sha256-e9oSTk+UlkrkRSipqjjMqwtxEvEZffVBmlSTmsIT7cU=";
   };
 
   dontConfigure = true;
@@ -16,12 +16,14 @@ stdenvNoCC.mkDerivation (finalAttrs: {
 
   nativeBuildInputs = [ makeWrapper ];
 
+  patches = [
+    # https://github.com/89luca89/distrobox/issues/408
+    ./relative-default-icon.patch
+  ];
+
   installPhase = ''
     runHook preInstall
 
-    # https://github.com/89luca89/distrobox/issues/408
-    substituteInPlace ./distrobox-generate-entry \
-      --replace-fail 'icon_default="''${HOME}/.local' "icon_default=\"$out"
     ./install -P $out
 
     runHook postInstall

pkgs/applications/virtualization/distrobox/relative-default-icon.patch

@@ -0,0 +1,26 @@
+diff --git a/distrobox-generate-entry b/distrobox-generate-entry
+index 65fcea0..8d57e4e 100755
+--- a/distrobox-generate-entry
++++ b/distrobox-generate-entry
+@@ -51,7 +51,7 @@ container_manager="autodetect"
+ container_name_default="my-distrobox"
+ delete=0
+ icon="auto"
+-icon_default="${XDG_DATA_HOME:-${HOME}/.local/share}/icons/terminal-distrobox-icon.svg"
++icon_default="terminal-distrobox-icon"
+ verbose=0
+ online=0
+ version="1.8.0"
+@@ -335,12 +335,6 @@ if [ "${icon}" = "auto" ]; then
+ 
+ 	icon_url="$(echo "${DISTRO_ICON_MAP}" | grep "${container_distro}:" | cut -d':' -f2-)"
+ 
+-	# Distro not found in our map, fallback to generic icon
+-	if [ -z "${icon_url}" ]; then
+-		icon_url="https://raw.githubusercontent.com/89luca89/distrobox/main/icons/terminal-distrobox-icon.svg"
+-		container_distro="terminal-distrobox-icon"
+-	fi
+-
+ 	if [ -n "${icon_url}" ] && [ "${download}" != "null" ]; then
+ 		icon_extension="${icon_url##*.}"
+ 

pkgs/build-support/setup-hooks/mpi-check-hook/mpi-check-hook.sh

@@ -6,7 +6,6 @@ setupMpiCheck() {
   # Find out which MPI implementation we are using
   # and set safe defaults that are guaranteed to run
   # on any build machine
-
   mpiType="NONE"
 
   # OpenMPI signature
@@ -41,6 +40,10 @@ setupMpiCheck() {
       export OMPI_MCA_rmaps_base_oversubscribe=1
       export PRTE_MCA_rmaps_default_mapping_policy=node:oversubscribe
 
+      # Make sure we do not need openssh in the checkPhase
+      export OMPI_MCA_plm_ssh_agent=false
+      export PRRTE_MCA_plm_ssh_agent=false
+
       # Disable CPU pinning
       export OMPI_MCA_hwloc_base_binding_policy=none
       export PRTE_MCA_hwloc_default_binding_policy=none

pkgs/build-support/trivial-builders/default.nix

@@ -82,6 +82,7 @@ rec {
     , destination ? ""
     , checkPhase ? ""
     , meta ? { }
+    , passthru ? { }
     , allowSubstitutes ? false
     , preferLocalBuild ? true
     , derivationArgs ? { }
@@ -105,7 +106,8 @@ rec {
           {
             mainProgram = lib.head matches;
           } // meta // derivationArgs.meta or {};
-      } // removeAttrs derivationArgs [ "passAsFile" "meta" ])
+        passthru = passthru // derivationArgs.passthru or {};
+      } // removeAttrs derivationArgs [ "passAsFile" "meta" "passthru" ])
       ''
         target=$out${lib.escapeShellArg destination}
         mkdir -p "$(dirname "$target")"
@@ -220,6 +222,12 @@ rec {
          Type: AttrSet
        */
       meta ? { },
+      /*
+         `stdenv.mkDerivation`'s `passthru` argument.
+
+         Type: AttrSet
+       */
+      passthru ? { },
       /*
          The `checkPhase` to run. Defaults to `shellcheck` on supported
          platforms and `bash -n`.
@@ -263,7 +271,7 @@ rec {
       derivationArgs ? { },
     }:
     writeTextFile {
-      inherit name meta derivationArgs;
+      inherit name meta passthru derivationArgs;
       executable = true;
       destination = "/bin/${name}";
       allowSubstitutes = true;
@@ -366,9 +374,10 @@ rec {
     , destination ? ""   # relative path appended to $out eg "/bin/foo"
     , checkPhase ? ""    # syntax checks, e.g. for scripts
     , meta ? { }
+    , passthru ? { }
     }:
     runCommandLocal name
-      { inherit files executable checkPhase meta destination; }
+      { inherit files executable checkPhase meta passthru destination; }
       ''
         file=$out$destination
         mkdir -p "$(dirname "$file")"

pkgs/by-name/_6/_64gram/package.nix

@@ -28,6 +28,7 @@ telegram-desktop.overrideAttrs (old: rec {
   ];
 
   cmakeFlags = (old.cmakeFlags or []) ++ [
+    (lib.cmakeBool "DESKTOP_APP_DISABLE_AUTOUPDATE" true)
     (lib.cmakeBool "disable_autoupdate" true)
   ];
 

pkgs/by-name/ae/aerogramme/package.nix

@@ -50,5 +50,6 @@ rustPlatform.buildRustPackage rec {
     maintainers = with lib.maintainers; [ supinie ];
     mainProgram = "aerogramme";
     platforms = lib.platforms.linux;
+    broken = true; # https://github.com/rust-lang/rust/issues/129811
   };
 }

pkgs/by-name/ai/aiken/package.nix

@@ -10,16 +10,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "aiken";
-  version = "1.1.4";
+  version = "1.1.5";
 
   src = fetchFromGitHub {
     owner = "aiken-lang";
     repo = "aiken";
     rev = "v${version}";
-    hash = "sha256-PTC7qn8Z1PGcBTNK5MtMvThIEhmAqTj23B/cHHhiDFE=";
+    hash = "sha256-cspIIuH+0LJItTz9wk6mChwEMFP3GDpI+KKg0FWM9bQ=";
   };
 
-  cargoHash = "sha256-p//1TZJ6sJUUDPPpxRBKL7w7MBTUQppbQedj2x4T17w=";
+  cargoHash = "sha256-aylmZFb+UaK3OEpJLOf4NuT4uMLRhdUg+cSjzxRo7t8=";
 
   buildInputs =
     [ openssl ]

pkgs/by-name/an/ansel/package.nix

@@ -77,13 +77,13 @@ let
 in
 stdenv.mkDerivation {
   pname = "ansel";
-  version = "0-unstable-2024-08-13";
+  version = "0-unstable-2024-09-29";
 
   src = fetchFromGitHub {
     owner = "aurelienpierreeng";
     repo = "ansel";
-    rev = "85f2b8b15fe2081634c6f2c3f96b5d430e045bf0";
-    hash = "sha256-w2DziVBoCy1NpH4AoIFmKdjqufopqUeYjAwqkOhxHBc=";
+    rev = "0e942648c4f9b1fd89fee8ca91d6e9bd5e06344c";
+    hash = "sha256-gzIZwbTdGE0+uLScV/JfGW0ZxXIbnnSrYO1OxPS5Xz0=";
     fetchSubmodules = true;
   };
 

pkgs/by-name/az/azure-cli/commit-update-hunks.sh

@@ -1,19 +0,0 @@
-#!/usr/bin/env bash
-
-# Just a tiny imperfect helper script to commit generated updates.
-#
-# First, ensure that that `git add -p extensions-generated.nix` only
-# returns a series of clean update hunks, where each hunk updates a
-# single package version. All additions/removals must be committed
-# by hand.
-# The script will then commit the remaining hunks with fitting commit messages.
-
-while true; do
-  echo -e "y\nq" | git add -p extensions-generated.nix || break
-  pname=$(git diff --no-ext-diff --cached | grep "pname =" | cut -d'"' -f2 | head -n1) || break
-  versions=$(git diff --no-ext-diff --cached | grep "version =" | cut -d'"' -f2) || break
-  oldver=$(echo "$versions" | head -n1) || break
-  newver=$(echo "$versions" | tail -n1) || break
-  commitmsg="azure-cli-extensions.${pname}: ${oldver} -> ${newver}"
-  git commit -m "$commitmsg"
-done

pkgs/by-name/az/azure-cli/extensions-manual.nix

@@ -18,7 +18,7 @@
     pname = "application-insights";
     version = "1.2.1";
     url = "https://azcliprod.blob.core.windows.net/cli-extensions/application_insights-${version}-py2.py3-none-any.whl";
-    sha256 = "e1fa824eb587e2bec7f4cb4d1c4ce1033ab3d3fac65af42dd6218f673b019cee";
+    hash = "sha256-4fqCTrWH4r7H9MtNHEzhAzqz0/rGWvQt1iGPZzsBnO4=";
     description = "Support for managing Application Insights components and querying metrics, events, and logs from such components";
     propagatedBuildInputs = with python3Packages; [ isodate ];
     meta.maintainers = with lib.maintainers; [ andreasvoss ];
@@ -28,7 +28,7 @@
     pname = "azure-devops";
     version = "1.0.1";
     url = "https://github.com/Azure/azure-devops-cli-extension/releases/download/20240206.1/azure_devops-${version}-py2.py3-none-any.whl";
-    sha256 = "658a2854d8c80f874f9382d421fa45abf6a38d00334737dda006f8dec64cf70a";
+    hash = "sha256-ZYooVNjID4dPk4LUIfpFq/ajjQAzRzfdoAb43sZM9wo=";
     description = "Tools for managing Azure DevOps";
     propagatedBuildInputs = with python3Packages; [ distro ];
     meta.maintainers = with lib.maintainers; [ katexochen ];
@@ -39,7 +39,7 @@
     description = "The Azure IoT extension for Azure CLI.";
     version = "0.25.0";
     url = "https://github.com/Azure/azure-iot-cli-extension/releases/download/v${version}/azure_iot-${version}-py3-none-any.whl";
-    sha256 = "7db4bc07667efa8472513d9e121fb2551fcaeae68255c7bc0768ad4177c1b1c6";
+    hash = "sha256-fbS8B2Z++oRyUT2eEh+yVR/K6uaCVce8B2itQXfBscY=";
     propagatedBuildInputs = (
       with python3Packages;
       [
@@ -65,7 +65,7 @@
     pname = "confcom";
     version = "1.0.0";
     url = "https://azcliprod.blob.core.windows.net/cli-extensions/confcom-${version}-py3-none-any.whl";
-    sha256 = "73823e10958a114b4aca84c330b4debcc650c4635e74c568679b6c32c356411d";
+    hash = "sha256-c4I+EJWKEUtKyoTDMLTevMZQxGNedMVoZ5tsMsNWQR0=";
     description = "Microsoft Azure Command-Line Tools Confidential Container Security Policy Generator Extension";
     nativeBuildInputs = [ autoPatchelfHook ];
     buildInputs = [ openssl_1_1 ];
@@ -85,7 +85,7 @@
     pname = "containerapp";
     version = "1.0.0b1";
     url = "https://azcliprod.blob.core.windows.net/cli-extensions/containerapp-${version}-py2.py3-none-any.whl";
-    sha256 = "d80b83b0e22770925c24bca150c84182376b7b0aff9b6f28498d769dc8618b45";
+    hash = "sha256-2AuDsOIncJJcJLyhUMhBgjdrewr/m28oSY12nchhi0U=";
     description = "Microsoft Azure Command-Line Tools Containerapp Extension";
     propagatedBuildInputs = with python3Packages; [
       docker
@@ -98,7 +98,7 @@
     pname = "rdbms-connect";
     version = "1.0.6";
     url = "https://azcliprod.blob.core.windows.net/cli-extensions/rdbms_connect-${version}-py2.py3-none-any.whl";
-    sha256 = "49cbe8d9b7ea07a8974a29ad90247e864ed798bed5f28d0e3a57a4b37f5939e7";
+    hash = "sha256-Scvo2bfqB6iXSimtkCR+hk7XmL7V8o0OOleks39ZOec=";
     description = "Support for testing connection to Azure Database for MySQL & PostgreSQL servers";
     propagatedBuildInputs =
       (with python3Packages; [
@@ -115,7 +115,7 @@
     pname = "ssh";
     version = "2.0.5";
     url = "https://azcliprod.blob.core.windows.net/cli-extensions/ssh-${version}-py3-none-any.whl";
-    sha256 = "80c98b10d7bf1ce4005b7694aedd05c47355456775ba6125308be65fb0fefc93";
+    hash = "sha256-gMmLENe/HOQAW3aUrt0FxHNVRWd1umElMIvmX7D+/JM=";
     description = "SSH into Azure VMs using RBAC and AAD OpenSSH Certificates";
     propagatedBuildInputs = with python3Packages; [
       oras
@@ -128,7 +128,7 @@
     pname = "storage-preview";
     version = "1.0.0b2";
     url = "https://azcliprod.blob.core.windows.net/cli-extensions/storage_preview-${version}-py2.py3-none-any.whl";
-    sha256 = "2de8fa421622928a308bb70048c3fdf40400bad3b34afd601d0b3afcd8b82764";
+    hash = "sha256-Lej6QhYikoowi7cASMP99AQAutOzSv1gHQs6/Ni4J2Q=";
     description = "Provides a preview for upcoming storage features";
     propagatedBuildInputs = with python3Packages; [ azure-core ];
     meta.maintainers = with lib.maintainers; [ katexochen ];

pkgs/by-name/az/azure-cli/extensions-tool.py

@@ -0,0 +1,319 @@
+#!/usr/bin/env python
+
+import argparse
+import base64
+import datetime
+import json
+import logging
+import os
+import sys
+from dataclasses import asdict, dataclass, replace
+from pathlib import Path
+from typing import Any, Dict, Iterable, List, Optional, Set, Tuple
+from urllib.request import Request, urlopen
+
+import git
+from packaging.version import Version, parse
+
+INDEX_URL = "https://azcliextensionsync.blob.core.windows.net/index1/index.json"
+
+logger = logging.getLogger(__name__)
+
+
+@dataclass(frozen=True)
+class Ext:
+    pname: str
+    version: Version
+    url: str
+    hash: str
+    description: str
+
+
+def _read_cached_index(path: Path) -> Tuple[datetime.datetime, Any]:
+    with open(path, "r") as f:
+        data = f.read()
+
+    j = json.loads(data)
+    cache_date_str = j["cache_date"]
+    if cache_date_str:
+        cache_date = datetime.datetime.fromisoformat(cache_date_str)
+    else:
+        cache_date = datetime.datetime.min
+    return cache_date, data
+
+
+def _write_index_to_cache(data: Any, path: Path):
+    j = json.loads(data)
+    j["cache_date"] = datetime.datetime.now().isoformat()
+    with open(path, "w") as f:
+        json.dump(j, f, indent=2)
+
+
+def _fetch_remote_index():
+    r = Request(INDEX_URL)
+    with urlopen(r) as resp:
+        return resp.read()
+
+
+def get_extension_index(cache_dir: Path) -> Set[Ext]:
+    index_file = cache_dir / "index.json"
+    os.makedirs(cache_dir, exist_ok=True)
+
+    try:
+        index_cache_date, index_data = _read_cached_index(index_file)
+    except FileNotFoundError:
+        logger.info("index has not been cached, downloading from source")
+        logger.info("creating index cache in %s", index_file)
+        _write_index_to_cache(_fetch_remote_index(), index_file)
+        return get_extension_index(cache_dir)
+
+    if (
+        index_cache_date
+        and datetime.datetime.now() - index_cache_date > datetime.timedelta(days=1)
+    ):
+        logger.info(
+            "cache is outdated (%s), refreshing",
+            datetime.datetime.now() - index_cache_date,
+        )
+        _write_index_to_cache(_fetch_remote_index(), index_file)
+        return get_extension_index(cache_dir)
+
+    logger.info("using index cache from %s", index_file)
+    return json.loads(index_data)
+
+
+def _read_extension_set(extensions_generated: Path) -> Set[Ext]:
+    with open(extensions_generated, "r") as f:
+        data = f.read()
+
+    parsed_exts = {Ext(**json_ext) for _pname, json_ext in json.loads(data).items()}
+    parsed_exts_with_ver = set()
+    for ext in parsed_exts:
+        ext2 = replace(ext, version=parse(ext.version))
+        parsed_exts_with_ver.add(ext2)
+
+    return parsed_exts_with_ver
+
+
+def _write_extension_set(extensions_generated: Path, extensions: Set[Ext]) -> None:
+    set_without_ver = {replace(ext, version=str(ext.version)) for ext in extensions}
+    ls = list(set_without_ver)
+    ls.sort(key=lambda e: e.pname)
+    with open(extensions_generated, "w") as f:
+        json.dump({ext.pname: asdict(ext) for ext in ls}, f, indent=2)
+
+
+def _convert_hash_digest_from_hex_to_b64_sri(s: str) -> str:
+    try:
+        b = bytes.fromhex(s)
+    except ValueError as err:
+        logger.error("not a hex value: %s", str(err))
+        raise err
+
+    return f"sha256-{base64.b64encode(b).decode('utf-8')}"
+
+
+def _commit(repo: git.Repo, message: str, files: List[Path]) -> None:
+    repo.index.add([str(f.resolve()) for f in files])
+    if repo.index.diff("HEAD"):
+        logger.info(f'committing to nixpkgs "{message}"')
+        repo.index.commit(message)
+    else:
+        logger.warning("no changes in working tree to commit")
+
+
+def _filter_invalid(o: Dict[str, Any]) -> bool:
+    if "metadata" not in o:
+        logger.warning("extension without metadata")
+        return False
+    metadata = o["metadata"]
+    if "name" not in metadata:
+        logger.warning("extension without name")
+        return False
+    if "version" not in metadata:
+        logger.warning(f"{metadata['name']} without version")
+        return False
+    if "azext.minCliCoreVersion" not in metadata:
+        logger.warning(
+            f"{metadata['name']} {metadata['version']} does not have azext.minCliCoreVersion"
+        )
+        return False
+    if "summary" not in metadata:
+        logger.info(f"{metadata['name']} {metadata['version']} without summary")
+        return False
+    if "downloadUrl" not in o:
+        logger.warning(f"{metadata['name']} {metadata['version']} without downloadUrl")
+        return False
+    if "sha256Digest" not in o:
+        logger.warning(f"{metadata['name']} {metadata['version']} without sha256Digest")
+        return False
+
+    return True
+
+
+def _filter_compatible(o: Dict[str, Any], cli_version: Version) -> bool:
+    minCliVersion = parse(o["metadata"]["azext.minCliCoreVersion"])
+    return cli_version >= minCliVersion
+
+
+def _transform_dict_to_obj(o: Dict[str, Any]) -> Ext:
+    m = o["metadata"]
+    return Ext(
+        pname=m["name"],
+        version=parse(m["version"]),
+        url=o["downloadUrl"],
+        hash=_convert_hash_digest_from_hex_to_b64_sri(o["sha256Digest"]),
+        description=m["summary"].rstrip("."),
+    )
+
+
+def _get_latest_version(versions: dict) -> dict:
+    return max(versions, key=lambda e: parse(e["metadata"]["version"]), default=None)
+
+
+def processExtension(
+    extVersions: dict,
+    cli_version: Version,
+    ext_name: Optional[str] = None,
+    requirements: bool = False,
+) -> Optional[Ext]:
+    versions = filter(_filter_invalid, extVersions)
+    versions = filter(lambda v: _filter_compatible(v, cli_version), versions)
+    latest = _get_latest_version(versions)
+    if not latest:
+        return None
+    if ext_name and latest["metadata"]["name"] != ext_name:
+        return None
+    if not requirements and "run_requires" in latest["metadata"]:
+        return None
+
+    return _transform_dict_to_obj(latest)
+
+
+def _diff_sets(
+    set_local: Set[Ext], set_remote: Set[Ext]
+) -> Tuple[Set[Ext], Set[Ext], Set[Tuple[Ext, Ext]]]:
+    local_exts = {ext.pname: ext for ext in set_local}
+    remote_exts = {ext.pname: ext for ext in set_remote}
+    only_local = local_exts.keys() - remote_exts.keys()
+    only_remote = remote_exts.keys() - local_exts.keys()
+    both = remote_exts.keys() & local_exts.keys()
+    return (
+        {local_exts[pname] for pname in only_local},
+        {remote_exts[pname] for pname in only_remote},
+        {(local_exts[pname], remote_exts[pname]) for pname in both},
+    )
+
+
+def _filter_updated(e: Tuple[Ext, Ext]) -> bool:
+    prev, new = e
+    return prev != new
+
+
+def main() -> None:
+    sh = logging.StreamHandler(sys.stderr)
+    sh.setFormatter(
+        logging.Formatter(
+            "[%(asctime)s] [%(levelname)8s] --- %(message)s (%(filename)s:%(lineno)s)",
+            "%Y-%m-%d %H:%M:%S",
+        )
+    )
+    logging.basicConfig(level=logging.INFO, handlers=[sh])
+
+    parser = argparse.ArgumentParser(
+        prog="azure-cli.extensions-tool",
+        description="Script to handle Azure CLI extension updates",
+    )
+    parser.add_argument(
+        "--cli-version", type=str, help="version of azure-cli (required)"
+    )
+    parser.add_argument("--extension", type=str, help="name of extension to query")
+    parser.add_argument(
+        "--cache-dir",
+        type=Path,
+        help="path where to cache the extension index",
+        default=Path(os.getenv("XDG_CACHE_HOME", Path.home() / ".cache"))
+        / "azure-cli-extensions-tool",
+    )
+    parser.add_argument(
+        "--requirements",
+        action=argparse.BooleanOptionalAction,
+        help="whether to list extensions that have requirements",
+    )
+    parser.add_argument(
+        "--commit",
+        action=argparse.BooleanOptionalAction,
+        help="whether to commit changes to git",
+    )
+    args = parser.parse_args()
+
+    repo = git.Repo(Path(".").resolve(), search_parent_directories=True)
+
+    index = get_extension_index(args.cache_dir)
+    assert index["formatVersion"] == "1"  # only support formatVersion 1
+    extensions_remote = index["extensions"]
+
+    cli_version = parse(args.cli_version)
+
+    extensions_remote_filtered = set()
+    for _ext_name, extension in extensions_remote.items():
+        extension = processExtension(extension, cli_version, args.extension)
+        if extension:
+            extensions_remote_filtered.add(extension)
+
+    extension_file = (
+        Path(repo.working_dir) / "pkgs/by-name/az/azure-cli/extensions-generated.json"
+    )
+    extensions_local = _read_extension_set(extension_file)
+    extensions_local_filtered = set()
+    if args.extension:
+        extensions_local_filtered = filter(
+            lambda ext: args.extension == ext.pname, extensions_local
+        )
+    else:
+        extensions_local_filtered = extensions_local
+
+    removed, init, updated = _diff_sets(
+        extensions_local_filtered, extensions_remote_filtered
+    )
+    updated = set(filter(_filter_updated, updated))
+
+    logger.info("initialized extensions:")
+    for ext in init:
+        logger.info(f"  {ext.pname} {ext.version}")
+    logger.info("removed extensions:")
+    for ext in removed:
+        logger.info(f"  {ext.pname} {ext.version}")
+    logger.info("updated extensions:")
+    for prev, new in updated:
+        logger.info(f"  {prev.pname} {prev.version} -> {new.version}")
+
+    for ext in removed:
+        extensions_local.remove(ext)
+        # TODO: Add additional check why this is removed
+        # TODO: Add an alias to extensions manual?
+        commit_msg = f"azure-cli-extensions.{ext.pname}: remove"
+        _write_extension_set(extension_file, extensions_local)
+        if args.commit:
+            _commit(repo, commit_msg, [extension_file])
+
+    for ext in init:
+        extensions_local.add(ext)
+        commit_msg = f"azure-cli-extensions.{ext.pname}: init at {ext.version}"
+        _write_extension_set(extension_file, extensions_local)
+        if args.commit:
+            _commit(repo, commit_msg, [extension_file])
+
+    for prev, new in updated:
+        extensions_local.remove(prev)
+        extensions_local.add(new)
+        commit_msg = (
+            f"azure-cli-extension.{prev.pname}: {prev.version} -> {new.version}"
+        )
+        _write_extension_set(extension_file, extensions_local)
+        if args.commit:
+            _commit(repo, commit_msg, [extension_file])
+
+
+if __name__ == "__main__":
+    main()

pkgs/by-name/az/azure-cli/package.nix

@@ -10,6 +10,11 @@
   python3,
   writeScriptBin,
 
+  black,
+  isort,
+  mypy,
+  makeWrapper,
+
   # Whether to include patches that enable placing certain behavior-defining
   # configuration files in the Nix store.
   withImmutableConfig ? true,
@@ -41,14 +46,14 @@ let
       pname,
       version,
       url,
-      sha256,
+      hash,
       description,
       ...
     }@args:
     python3.pkgs.buildPythonPackage (
       {
         format = "wheel";
-        src = fetchurl { inherit url sha256; };
+        src = fetchurl { inherit url hash; };
         meta = {
           inherit description;
           inherit (azure-cli.meta) platforms maintainers;
@@ -60,18 +65,20 @@ let
       }
       // (removeAttrs args [
         "url"
-        "sha256"
+        "hash"
         "description"
         "meta"
       ])
     );
 
-  extensions =
-    callPackages ./extensions-generated.nix { inherit mkAzExtension; }
-    // callPackages ./extensions-manual.nix {
-      inherit mkAzExtension;
-      python3Packages = python3.pkgs;
-    };
+  extensions-generated = lib.mapAttrs (name: ext: mkAzExtension ext) (
+    builtins.fromJSON (builtins.readFile ./extensions-generated.json)
+  );
+  extensions-manual = callPackages ./extensions-manual.nix {
+    inherit mkAzExtension;
+    python3Packages = python3.pkgs;
+  };
+  extensions = extensions-generated // extensions-manual;
 
   extensionDir = stdenvNoCC.mkDerivation {
     name = "azure-cli-extensions";
@@ -376,17 +383,42 @@ py.pkgs.toPythonApplication (
       };
 
       generate-extensions = writeScriptBin "${pname}-update-extensions" ''
-        export FILE=extensions-generated.nix
-        echo "# This file is automatically generated. DO NOT EDIT! Read README.md" > $FILE
-        echo "{ mkAzExtension }:" >> $FILE
-        echo "{" >> $FILE
-        ${./query-extension-index.sh} --requirements=false --download --nix --cli-version=${version} \
-          | xargs -n1 -d '\n' echo " " >> $FILE
-        echo "" >> $FILE
-        echo "}" >> $FILE
-        echo "Extension was saved to \"extensions-generated.nix\" file."
-        echo "Move it to \"{nixpkgs}/pkgs/by-name/az/azure-cli/extensions-generated.nix\"."
+        ${lib.getExe azure-cli.extensions-tool} --cli-version ${azure-cli.version} --commit
       '';
+
+      extensions-tool =
+        runCommand "azure-cli-extensions-tool"
+          {
+            src = ./extensions-tool.py;
+            nativeBuildInputs = [
+              black
+              isort
+              makeWrapper
+              mypy
+              python3
+            ];
+            meta.mainProgram = "extensions-tool";
+          }
+          ''
+            black --check --diff $src
+            # mypy --strict $src
+            isort --profile=black --check --diff $src
+
+            install -Dm755 $src $out/bin/extensions-tool
+
+            patchShebangs --build $out
+            wrapProgram $out/bin/extensions-tool \
+              --set PYTHONPATH "${
+                python3.pkgs.makePythonPath (
+                  with python3.pkgs;
+                  [
+                    packaging
+                    semver
+                    gitpython
+                  ]
+                )
+              }"
+          '';
     };
 
     meta = {

pkgs/by-name/az/azure-cli/query-extension-index.sh

@@ -1,163 +0,0 @@
-#!/usr/bin/env bash
-
-set -euo pipefail
-
-function usage() {
-    {
-        echo "${0} - query Azure CLI extension index"
-        echo
-        echo "The Azure CLI extension index contains all versions of all extensions. This"
-        echo "script queries the index for the latest version of an extensions that is"
-        echo "compatible with the specified version of the Azure CLI. Data for that extension"
-        echo "is filtered for fields relevant to package the extension in Nix."
-        echo
-        echo "Usage:"
-        echo "  --cli-version=<version>      version of azure-cli (required)"
-        echo "  --extension=<name>           name of extension to query"
-        echo "  --file=<path>                path to extension index file"
-        echo "  --download                   download extension index file"
-        echo "  --nix                        output Nix expression"
-        echo "  --requirements=<true/false>  filter for extensions with/without requirements"
-    } >&2
-}
-
-for arg in "$@"; do
-    case "$arg" in
-        --cli-version=*)
-            cliVer="${arg#*=}"
-            shift
-            ;;
-        --extension=*)
-            extName="${arg#*=}"
-            shift
-            ;;
-        --file=*)
-            extensionFile="${arg#*=}"
-            shift
-            ;;
-        --download)
-            download=true
-            shift
-            ;;
-        --nix)
-            nix=true
-            shift
-            ;;
-        --requirements=*)
-            requirements="${arg#*=}"
-            shift
-            ;;
-        --help)
-            usage
-            exit 0
-            ;;
-        *)
-            echo "Unknown argument: $arg" >&2
-            exit 1
-            ;;
-    esac
-done
-
-if [[ -z "${cliVer:-}" ]]; then
-    echo "Missing --cli-version argument" >&2
-    exit 1
-fi
-if [[ -z "${extensionFile:-}" && -z "${download:-}" ]]; then
-    echo "Either --file or --download must be specified" >&2
-    exit 1
-fi
-if [[ -n "${extName:-}" && -n "${requirements:-}" ]]; then
-    echo "--requirements can only be used when listing all extensions" >&2
-    exit 1
-fi
-
-if [[ "${download:-}" == true ]]; then
-    extensionFile="$(mktemp)"
-    echo "Downloading extensions index to ${extensionFile}" >&2
-    curl -fsSL "https://azcliextensionsync.blob.core.windows.net/index1/index.json" > "${extensionFile}"
-fi
-
-# shellcheck disable=SC2016
-jqProgram='
-    def opt(f):
-        . as $in | try f catch $in
-        ;
-
-    def version_to_array:
-        sub("\\+.*$"; "")
-        | capture("^(?<v>[^a-z-]+)(?:(?<p>.*))?") | [.v, .p // empty]
-        | map(split(".")
-        | map(opt(tonumber)))
-        | flatten
-        ;
-
-    def version_le($contstraint):
-        version_to_array as $v
-        | $contstraint | version_to_array as $c
-        | $v[0] < $c[0] or
-          ($v[0] == $c[0] and $v[1] < $c[1]) or
-          ($v[0] == $c[0] and $v[1] == $c[1] and $v[2] < $c[2]) or
-          ($v[0] == $c[0] and $v[1] == $c[1] and $v[2] == $c[2] and $v[3] <= $c[3])
-        ;
-
-    def max_constrained_version($constraint):
-        [
-            .[] | select(.metadata."azext.minCliCoreVersion" // "0.0.0" | version_le($cliVer))
-        ]
-        | sort_by(.metadata.version | version_to_array)
-        | last
-        ;
-
-    def translate_struct:
-        {
-            pname : .metadata.name,
-            description: .metadata.summary,
-            version: .metadata.version,
-            url: .downloadUrl,
-            sha256: .sha256Digest,
-            license: .metadata.license,
-            requires: .metadata.run_requires.[0].requires
-        }
-        ;
-
-    def to_nix:
-        [.].[] as $in
-        | .version as $version
-        | .description as $description
-        | .url | sub($version;"${version}") as $url
-        | $description |rtrimstr(".") as $description
-        | $in.pname + " = mkAzExtension rec {\n" +
-        "  pname = \"" + $in.pname + "\";\n" +
-        "  version = \"" + $in.version + "\";\n" +
-        "  url = \"" + $url + "\";\n" +
-        "  sha256 = \"" + $in.sha256 + "\";\n" +
-        "  description = \"" + $description + "\";\n" +
-        "};"
-        ;
-
-    def main:
-        .extensions
-        | map(max_constrained_version($cliVer))
-        | .[]
-        | translate_struct
-        | if $extName  != "" then
-            select(.pname == $extName)
-        elif $requirements == "false" then
-            select(.requires == null)
-        elif $requirements == "true" then
-            select(.requires != null)
-        end
-        | if $nix == "true" then
-            to_nix
-        end
-        ;
-
-    main
-'
-
-jq -r \
-    --arg cliVer "${cliVer}" \
-    --arg extName "${extName:-}" \
-    --arg nix "${nix:-}" \
-    --arg requirements "${requirements:-}" \
-    "$jqProgram" "${extensionFile}"

pkgs/by-name/ba/baidupcs-go/package.nix

@@ -0,0 +1,33 @@
+{
+  buildGo122Module,
+  lib,
+  fetchFromGitHub,
+  versionCheckHook,
+}:
+buildGo122Module rec {
+  pname = "baidupcs-go";
+  version = "3.9.5";
+  src = fetchFromGitHub {
+    owner = "qjfoidnh";
+    repo = "BaiduPCS-Go";
+    rev = "v${version}";
+    hash = "sha256-zNodRQzflOOB3hAeq4KbjRFlHQwknVy+4ucipUcoufY=";
+  };
+
+  vendorHash = "sha256-msTlXtidxLTe3xjxTOWCqx/epFT0XPdwGPantDJUGpc=";
+  doCheck = false;
+
+  nativeInstallCheckInputs = [
+    versionCheckHook
+  ];
+  doInstallCheck = true;
+  versionCheckProgram = "${placeholder "out"}/bin/${meta.mainProgram}";
+
+  meta = {
+    maintainers = with lib.maintainers; [ xddxdd ];
+    description = "Baidu Netdisk commandline client, mimicking Linux shell file handling commands";
+    homepage = "https://github.com/qjfoidnh/BaiduPCS-Go";
+    license = lib.licenses.asl20;
+    mainProgram = "BaiduPCS-Go";
+  };
+}

pkgs/by-name/bo/boxbuddy/package.nix

@@ -9,16 +9,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "boxbuddy";
-  version = "2.2.13";
+  version = "2.3.1";
 
   src = fetchFromGitHub {
     owner = "Dvlv";
     repo = "BoxBuddyRS";
     rev = version;
-    hash = "sha256-47LOwBm7ql3Nvx6PZ2+x5aR9LSpzc8xuixdvKGdNS94=";
+    hash = "sha256-s0StSMpLNRwiI+T78ySfW2DQ3s5A9kuclC9f32UDkiI=";
   };
 
-  cargoHash = "sha256-W4W2tnnNgBcGD0/t5pobj4ca/YrRkHE1l5dIVe21KPU=";
+  cargoHash = "sha256-WJ35lxo4h91xtcfUuevLsWNBvulxq5ZaAVE3u9BbtzI=";
 
   # The software assumes it is installed either in flatpak or in the home directory
   # so the xdg data path needs to be patched here

pkgs/by-name/ch/chezmoi/package.nix

@@ -8,16 +8,16 @@
 let
   argset = {
     pname = "chezmoi";
-    version = "2.52.3";
+    version = "2.53.1";
 
     src = fetchFromGitHub {
       owner = "twpayne";
       repo = "chezmoi";
       rev = "v${argset.version}";
-      hash = "sha256-OoVf0Gxyd+hTlM4VOei1atNEZYL2ZF3eKAHyUqRkRzs=";
+      hash = "sha256-E7kr2fKBabbFVmtVRjgYy5TWhvQYb/RjhiNEcXYXL0E=";
     };
 
-    vendorHash = "sha256-QJkTscj3MvmscanEqA9Md2OZPYoNtxIJsAd2J6E9zHk=";
+    vendorHash = "sha256-wOdDG/J/JYGNUGSUCPVCNtO+5TFkt5O5kFYniQgcN7A=";
 
     nativeBuildInputs = [
       installShellFiles

pkgs/by-name/cl/clever-tools/package.nix

@@ -4,13 +4,14 @@
   fetchFromGitHub,
   nodejs_18,
   installShellFiles,
+  makeWrapper,
   stdenv,
 }:
 
 buildNpmPackage rec {
   pname = "clever-tools";
 
-  version = "3.8.3";
+  version = "3.9.0";
 
   nodejs = nodejs_18;
 
@@ -18,27 +19,32 @@ buildNpmPackage rec {
     owner = "CleverCloud";
     repo = "clever-tools";
     rev = version;
-    hash = "sha256-70wyu8+Jb9kR5lIucBZG9UWIufMhsgMBMkT2ohGvE50=";
+    hash = "sha256-nSTcJIZO/CMliAYFUGu/oA+VdtONDPwyj6vCr5Ry6ac=";
   };
 
-  npmDepsHash = "sha256-LljwS6Rd/8WnGpxSHwCr87KWLaRR2i7sMdUuuprYiOE=";
+  npmDepsHash = "sha256-+3/zSsO5+s1MUome3CQ1p1tN3OtWp+XE9Z6GSdDiRh8=";
 
-  dontNpmBuild = true;
+  nativeBuildInputs = [
+    installShellFiles
+    makeWrapper
+  ];
 
-  nativeBuildInputs = [ installShellFiles ];
+  installPhase = ''
+    mkdir -p $out/bin $out/lib/clever-tools
+    cp build/clever.cjs $out/lib/clever-tools/clever.cjs
 
-  makeWrapperArgs = [ "--set NO_UPDATE_NOTIFIER true" ];
+    makeWrapper ${nodejs}/bin/node $out/bin/clever \
+      --add-flags "$out/lib/clever-tools/clever.cjs" \
+      --set NO_UPDATE_NOTIFIER true
 
-  postInstall =
-    lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
-      installShellCompletion --cmd clever \
-        --bash <($out/bin/clever --bash-autocomplete-script $out/bin/clever) \
-        --zsh <($out/bin/clever --zsh-autocomplete-script $out/bin/clever)
-    ''
-    + ''
-      rm $out/bin/install-clever-completion
-      rm $out/bin/uninstall-clever-completion
-    '';
+    runHook postInstall
+  '';
+
+  postInstall = lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
+    installShellCompletion --cmd clever \
+      --bash <($out/bin/clever --bash-autocomplete-script $out/bin/clever) \
+      --zsh <($out/bin/clever --zsh-autocomplete-script $out/bin/clever)
+  '';
 
   meta = with lib; {
     homepage = "https://github.com/CleverCloud/clever-tools";

pkgs/by-name/co/code-cursor/package.nix

@@ -8,11 +8,11 @@
 }:
 let
   pname = "cursor";
-  version = "0.42.3";
+  version = "0.42.4";
   appKey = "230313mzl4w4u92";
   src = fetchurl {
-    url = "https://download.todesktop.com/230313mzl4w4u92/cursor-0.42.3-build-241016kxu9umuir-x86_64.AppImage";
-    hash = "sha256-GWkilBlpXube//jbxRjmKJjYcmB42nhMY8K0OgkvtwA=";
+    url = "https://download.todesktop.com/230313mzl4w4u92/cursor-0.42.4-build-2410291z3bdg1dy-x86_64.AppImage";
+    hash = "sha256-CD6bQ4T8DhJidiOxNRgRDL4obfEZx7hnO0VotVb6lDc=";
   };
   appimageContents = appimageTools.extractType2 { inherit version pname src; };
 in

pkgs/by-name/co/conduwuit/package.nix

@@ -6,7 +6,8 @@
   bzip2,
   zstd,
   stdenv,
-  darwin,
+  apple-sdk_15,
+  darwinMinVersionHook,
   rocksdb,
   nix-update-script,
   testers,
@@ -63,7 +64,9 @@ rustPlatform.buildRustPackage rec {
     ++ lib.optional enableJemalloc rust-jemalloc-sys'
     ++ lib.optional enableLiburing liburing
     ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      darwin.apple_sdk.frameworks.Security
+      apple-sdk_15
+      # aws-lc-sys requires CryptoKit's CommonCrypto, which is available on macOS 10.15+
+      (darwinMinVersionHook "10.15")
     ];
 
   env = {

pkgs/by-name/cp/cp2k/package.nix

@@ -18,7 +18,6 @@
   mpi,
   gsl,
   scalapack,
-  openssh,
   makeWrapper,
   libxsmm,
   spglib,
@@ -83,7 +82,6 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [
     python3
     which
-    openssh
     makeWrapper
     pkg-config
   ] ++ lib.optional (gpuBackend == "cuda") cudaPackages.cuda_nvcc;
@@ -225,7 +223,6 @@ stdenv.mkDerivation rec {
 
   nativeCheckInputs = [
     mpiCheckPhaseHook
-    openssh
   ];
 
   checkPhase = ''

pkgs/by-name/db/dbip-asn-lite/package.nix

@@ -5,11 +5,11 @@
 }:
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "dbip-asn-lite";
-  version = "2024-10";
+  version = "2024-11";
 
   src = fetchurl {
     url = "https://download.db-ip.com/free/dbip-asn-lite-${finalAttrs.version}.mmdb.gz";
-    hash = "sha256-zfBRxZ6xwIrOC6MrmtbfKrIK7jxMD/1EMOgQDON6nPw=";
+    hash = "sha256-uqtn3Dy8GYjRHX3LNky0DUAc+MxEph41AKShxsPdJJM=";
   };
 
   dontUnpack = true;

pkgs/by-name/db/dbip-city-lite/package.nix

@@ -5,11 +5,11 @@
 }:
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "dbip-city-lite";
-  version = "2024-10";
+  version = "2024-11";
 
   src = fetchurl {
     url = "https://download.db-ip.com/free/dbip-city-lite-${finalAttrs.version}.mmdb.gz";
-    hash = "sha256-sPjtO0WRdMxGiTySFO3vA1mL3RHxDnhLFzQ1fq2LNUw=";
+    hash = "sha256-w/Dl89AdhIfsfNu4IvVMEVKqZtQcqg0UAjB7HJxq/OE=";
   };
 
   dontUnpack = true;

pkgs/by-name/db/dbip-country-lite/package.nix

@@ -5,11 +5,11 @@
 }:
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "dbip-country-lite";
-  version = "2024-10";
+  version = "2024-11";
 
   src = fetchurl {
     url = "https://download.db-ip.com/free/dbip-country-lite-${finalAttrs.version}.mmdb.gz";
-    hash = "sha256-MeAhfDY2jdX2WDsNGNjvH/JeCo9C1hx3PWyk8am9Ut0=";
+    hash = "sha256-Ua4hm0duKHAD/cgtOaDqAYT/4lWsuoIdPnM7K0Lqecw=";
   };
 
   dontUnpack = true;

pkgs/by-name/de/deepsource/package.nix

@@ -0,0 +1,62 @@
+{
+  lib,
+  stdenv,
+  installShellFiles,
+  buildGoModule,
+  fetchFromGitHub,
+  versionCheckHook,
+}:
+
+buildGoModule rec {
+  pname = "deepsource";
+  version = "0.8.6";
+
+  src = fetchFromGitHub {
+    owner = "DeepSourceCorp";
+    repo = "cli";
+    rev = "v${version}";
+    hash = "sha256-6uNb4cQVerrlW/eUkjmlO1i1YKYX3qaVdo0i5cczt+I=";
+  };
+
+  nativeBuildInputs = [ installShellFiles ];
+
+  doCheck = true;
+
+  checkFlags =
+    let
+      # Skip tests that require network access
+      skippedTests = [
+        "TestReportKeyValueWorkflow"
+        "TestReportAnalyzerTypeWorkflow"
+        "TestReportKeyValueFileWorkflow"
+      ];
+    in
+    [ "-skip=^${builtins.concatStringsSep "$|^" skippedTests}$" ];
+
+  vendorHash = "sha256-SsMq4ngq3sSOL28ysHTxTF4CT9sIcCIW7yIhBxIPrNs=";
+
+  ldflags = [
+    "-s"
+    "-w"
+    "-X=main.version=${version}"
+  ];
+
+  postInstall = lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
+    installShellCompletion --cmd deepsource \
+      --bash <($out/bin/deepsource completion bash) \
+      --fish <($out/bin/deepsource completion fish) \
+      --zsh <($out/bin/deepsource completion zsh)
+  '';
+
+  nativeInstallCheckInputs = [
+    versionCheckHook
+  ];
+
+  meta = {
+    description = "Command line interface to DeepSource, the code health platform";
+    mainProgram = "deepsource";
+    homepage = "https://github.com/DeepSourceCorp/cli";
+    license = lib.licenses.bsd2;
+    maintainers = with lib.maintainers; [ nipeharefa ];
+  };
+}

pkgs/by-name/ea/earlyoom/package.nix

@@ -58,7 +58,7 @@ stdenv.mkDerivation (finalAttrs: {
     '';
     license = lib.licenses.mit;
     mainProgram = "earlyoom";
-    maintainers = with lib.maintainers; [ AndersonTorres ];
+    maintainers = with lib.maintainers; [ ];
     platforms = lib.platforms.linux;
   };
 })

pkgs/by-name/ed/edopro/deps.nix

@@ -4,11 +4,8 @@
   assets-hash = "sha256-vZhkWJ1ZoNEwdc5kM1S0hyXnWmupiTOanCi9DCuqw/k=";
   edopro-version = "40.1.4";
   edopro-rev = "c713e23491a1e55c9d8e91257e5f2b5873696b9b";
-  edopro-hash = "sha256-2E1cjG0FONu/fbr67/3qRCKQ1W/wPznClEWsMa1FAzo=";
+  edopro-hash = "sha256-mj0xEJsFcnY//za0uJosAPOPbU/jlduNX0YSNmvduLE=";
   irrlicht-version = "1.9.0-unstable-2023-02-18";
   irrlicht-rev = "7edde28d4f8c0c3589934c398a3a441286bb7c22";
   irrlicht-hash = "sha256-Q2tNiYE/enZPqA5YhUe+Tkvmqtmmz2E0OqTRUDnt+UA=";
-  ocgcore-version = "0-unstable-2022-09-15";
-  ocgcore-rev = "4a872ad7686e0d00ee4c1c051e90fc07c40613d4";
-  ocgcore-hash = "sha256-s3DOHrZilRUy6fbXObNiLRinxpdHY99vDOmS/ZfOI78=";
 }

pkgs/by-name/ed/edopro/ocgcore-lua-symbols.patch

@@ -1,29 +0,0 @@
-From 41e750142b44465f3af197b7e2f0d6f54fc48c2d Mon Sep 17 00:00:00 2001
-From: OPNA2608 <opna2608@protonmail.com>
-Date: Mon, 21 Oct 2024 17:42:24 +0200
-Subject: [PATCH] Mark Lua symbols as C symbols
-
-Otherwise linking against our Lua built by a C-compiler fails due to the symbols being resolved as C++ symbols.
----
- interpreter.h | 2 ++
- 1 file changed, 2 insertions(+)
-
-diff --git a/interpreter.h b/interpreter.h
-index 6c405a1..c471ecb 100644
---- a/interpreter.h
-+++ b/interpreter.h
-@@ -9,9 +9,11 @@
- #define INTERPRETER_H_
- 
- // Due to longjmp behaviour, we must build Lua as C++ to avoid UB
-+extern "C" {
- #include <lua.h>
- #include <lualib.h>
- #include <lauxlib.h>
-+}
- 
- #include "common.h"
- #include <unordered_map>
--- 
-2.44.1
-

pkgs/by-name/ed/edopro/package.nix

@@ -15,6 +15,7 @@
   # Use fmt 10+ after release 40.1.4+
   fmt_9,
   freetype,
+  irrlicht,
   libevent,
   libgit2,
   libGL,
@@ -25,7 +26,6 @@
   libX11,
   libxkbcommon,
   libXxf86vm,
-  lua5_3,
   mono,
   nlohmann_json,
   openal,
@@ -50,6 +50,11 @@ let
     .${stdenv.hostPlatform.system}
       or (throw "${stdenv.hostPlatform.system} is an unsupported arch label for edopro");
 
+  maintainers = with lib.maintainers; [
+    OPNA2608
+    redhawk
+  ];
+
   deps = import ./deps.nix;
 in
 let
@@ -78,9 +83,7 @@ let
     ];
 
     enableParallelBuilding = true;
-    buildFlags = [
-      "NDEBUG=1"
-    ];
+    buildFlags = [ "NDEBUG=1" ];
     makeFlags = [
       "-C"
       "source/Irrlicht"
@@ -89,57 +92,18 @@ let
     installPhase = ''
       runHook preInstall
 
-      mkdir -p $out/{bin,include}
-      cp lib/Linux/libIrrlicht.a $out/bin
-      cp -r include/* $out/include
+      install -Dm644 -t $out/lib lib/Linux/libIrrlicht.a
+      cp -r include $out/include
 
       runHook postInstall
     '';
-  };
 
-  ocgcore = stdenv.mkDerivation {
-    pname = "ygopro-core";
-    version = deps.ocgcore-version;
-
-    src = fetchFromGitHub {
-      owner = "edo9300";
-      repo = "ygopro-core";
-      rev = deps.ocgcore-rev;
-      hash = deps.ocgcore-hash;
-      fetchSubmodules = true;
+    meta = {
+      inherit (irrlicht.meta) description platforms;
+      homepage = "https://github.com/edo9300/irrlicht1-8-4";
+      license = lib.licenses.agpl3Plus;
+      inherit maintainers;
     };
-
-    patches = [
-      ./ocgcore-lua-symbols.patch
-    ];
-
-    nativeBuildInputs = [ premake5 ];
-
-    buildInputs = [ lua5_3 ];
-
-    preBuild = ''
-      premake5 gmake2 \
-        --lua-path="${lua5_3}"
-    '';
-
-    enableParallelBuilding = true;
-    buildFlags = [
-      "verbose=true"
-      "config=release"
-      "ocgcoreshared"
-    ];
-    makeFlags = [
-      "-C"
-      "build"
-    ];
-
-    installPhase = ''
-      runHook preInstall
-
-      install -Dm644 -t $out/lib bin/release/libocgcore${stdenv.hostPlatform.extensions.sharedLibrary}
-
-      runHook postInstall
-    '';
   };
 
   edopro = stdenv.mkDerivation {
@@ -151,7 +115,6 @@ let
       repo = "edopro";
       rev = deps.edopro-rev;
       hash = deps.edopro-hash;
-      fetchSubmodules = true;
     };
 
     nativeBuildInputs = [
@@ -171,9 +134,7 @@ let
       libjpeg
       libpng
       libvorbis
-      lua5_3
       nlohmann_json
-      ocgcore
       openal
       SDL2
       sqlite
@@ -183,6 +144,8 @@ let
     postPatch = ''
       substituteInPlace premake5.lua \
         --replace-fail 'flags "LinkTimeOptimization"' 'removeflags "LinkTimeOptimization"'
+
+      touch ocgcore/premake5.lua
     '';
 
     preBuild = ''
@@ -191,7 +154,7 @@ let
         --covers=\"${covers_url}\" \
         --fields=\"${fields_url}\" \
         --pics=\"${pics_url}\" \
-        --prebuilt-core="${lib.getLib ocgcore}/lib" \
+        --no-core \
         --sound=sfml
     '';
 
@@ -205,7 +168,7 @@ let
     buildFlags = [
       "verbose=true"
       "config=release_${archLabel}"
-      "ygopro"
+      "ygoprodll"
     ];
     makeFlags = [
       "-C"
@@ -216,8 +179,8 @@ let
       runHook preInstall
 
       mkdir -p $out/bin
-      cp bin/${archLabel}/release/ygopro $out/bin
-      wrapProgram $out/bin/ygopro \
+      cp bin/${archLabel}/release/ygoprodll $out/bin
+      wrapProgram $out/bin/ygoprodll \
         --prefix PATH : ${lib.makeBinPath [ mono ]} \
         --prefix LD_LIBRARY_PATH : ${
           lib.makeLibraryPath [
@@ -233,12 +196,30 @@ let
 
       runHook postInstall
     '';
+
+    meta = {
+      description = "Bleeding-edge automatic duel simulator, a fork of the YGOPro client";
+      homepage = "https://projectignis.github.io";
+      changelog = "https://github.com/edo9300/edopro/releases";
+      license = lib.licenses.agpl3Plus;
+      mainProgram = "ygoprodll";
+      # This is likely a very easy app to port if you're interested.
+      # We just have no way to test on other platforms.
+      platforms = [
+        "x86_64-linux"
+        # Currently offline mode does not work, the problem is that the core is updated whenever it is needed.
+        # So in our method we would have to update the client if it's statically linked as well.
+        # It is possible but we have decided against it for now.  In theory if we added more logic to the update script it could work.
+        "aarch64-linux"
+      ];
+      inherit maintainers;
+    };
   };
 
   edopro-script =
     let
       assetsToCopy = lib.concatStringsSep "," [
-        # Needed if we download files from ProjectIgnis' website or any https only website.
+        # Needed if we download files from ProjectIgnis' website or any https-only website.
         "cacert.pem"
         "config"
         "deck"
@@ -267,17 +248,18 @@ let
           rm $EDOPRO_DIR/config/io.github.edo9300.EDOPro.desktop.in
       fi
 
-      exec ${edopro}/bin/ygopro -C $EDOPRO_DIR $@
+      exec ${lib.getExe edopro} -C $EDOPRO_DIR $@
     '';
 
   edopro-desktop = runCommandLocal "io.github.edo9300.EDOPro.desktop" { } ''
-    cp ${assets}/config/io.github.edo9300.EDOPro.desktop.in desktop-template
+    mkdir -p $out/share/applications
 
-    sed '/Path=/d' -i desktop-template
-    sed 's/Exec=.*/Exec=EDOPro/' -i desktop-template
-    sed 's/Icon=.*/Icon=EDOPro/' -i desktop-template
-
-    install -D desktop-template $out/share/applications/io.github.edo9300.EDOPro.desktop
+    sed ${assets}/config/io.github.edo9300.EDOPro.desktop.in \
+      -e '/Path=/d' \
+      -e 's/Exec=.*/Exec=edopro/' \
+      -e 's/Icon=.*/Icon=edopro/' \
+      -e 's/StartupWMClass=.*/StartupWMClass=edopro/' \
+      >$out/share/applications/io.github.edo9300.EDOPro.desktop
   '';
 in
 symlinkJoin {
@@ -289,30 +271,28 @@ symlinkJoin {
   ];
 
   postBuild = ''
-    mkdir -p $out/share/icons/hicolor/256x256/apps/
-    ${imagemagick}/bin/magick \
-        ${assets}/textures/AppIcon.png \
-        -resize 256x256 \
-        $out/share/icons/hicolor/256x256/apps/EDOPro.png
+    for size in 16 32 48 64 128 256 512 1024; do
+      res="$size"x"$size"
+      mkdir -p $out/share/icons/hicolor/"$res"/apps/
+      ${imagemagick}/bin/magick \
+          ${assets}/textures/AppIcon.png \
+          -resize "$res" \
+          $out/share/icons/hicolor/"$res"/apps/edopro.png
+    done
   '';
 
   passthru.updateScript = ./update.py;
 
   meta = {
-    description = "Bleeding-edge automatic duel simulator, a fork of the YGOPro client";
-    homepage = "https://projectignis.github.io";
-    changelog = "https://github.com/edo9300/edopro/releases";
-    license = lib.licenses.agpl3Plus;
-    maintainers = with lib.maintainers; [
-      OPNA2608
-      redhawk
-    ];
+    inherit (edopro.meta)
+      description
+      homepage
+      changelog
+      license
+      platforms
+      maintainers
+      ;
+    # To differenciate it from the original YGOPro
     mainProgram = "edopro";
-    # This is likely a very easy app to port if you're interested.
-    # We just have no way to test on other platforms.
-    platforms = [
-      "x86_64-linux"
-      "aarch64-linux"
-    ];
   };
 }

pkgs/by-name/ed/edopro/update.py

@@ -15,14 +15,6 @@ DEPS_PATH: str = "./pkgs/by-name/ed/edopro/deps.nix"
 with GitHub(UnauthAuthStrategy()) as github:
     edopro: Tag = github.rest.repos.list_tags("edo9300", "edopro").parsed_data[0]
 
-    ocgcore_submodule: ContentSubmodule = github.rest.repos.get_content(
-        "edo9300", "edopro", "ocgcore"
-    ).parsed_data
-
-    ocgcore: Commit = github.rest.repos.get_commit(
-        "edo9300", "ygopro-core", ocgcore_submodule.sha
-    ).parsed_data
-
     # This dep is not versioned in anyway and is why we check below to see if this is a new version.
     irrlicht: Commit = github.rest.repos.list_commits(
         "edo9300", "irrlicht1-8-4"
@@ -64,8 +56,7 @@ def get_hash(owner: str, repo: str, rev: str, submodule: bool = False) -> str:
     return out_json["hash"]
 
 
-edopro_hash = get_hash("edo9300", "edopro", edopro.commit.sha, submodule=True)
-ocgcore_hash = get_hash("edo9300", "ygopro-core", ocgcore.sha)
+edopro_hash = get_hash("edo9300", "edopro", edopro.commit.sha)
 irrlicht_hash = get_hash("edo9300", "irrlicht1-8-4", irrlicht.sha)
 
 asset_legacy_hash: str = (
@@ -110,9 +101,6 @@ with open(DEPS_PATH, "w") as file:
   irrlicht-version = "{"1.9.0-unstable-" + irrlicht.commit.committer.date.split("T")[0]}";
   irrlicht-rev = "{irrlicht.sha}";
   irrlicht-hash = "{irrlicht_hash}";
-  ocgcore-version = "{"0-unstable-" + ocgcore.commit.committer.date.split("T")[0]}";
-  ocgcore-rev = "{ocgcore.sha}";
-  ocgcore-hash = "{ocgcore_hash}";
 }}
 """
 

pkgs/by-name/ev/evillimiter/package.nix

@@ -1,28 +1,26 @@
-{ lib
-, buildPythonApplication
-, fetchFromGitHub
-, colorama
-, iproute2
-, iptables
-, netaddr
-, netifaces
-, scapy
-, terminaltables
-, tqdm
+{
+  lib,
+  fetchFromGitHub,
+  iproute2,
+  iptables,
+  python3Packages,
 }:
 
-buildPythonApplication rec {
+python3Packages.buildPythonApplication rec {
   pname = "evillimiter";
   version = "1.5.0";
+  pyproject = true;
 
   src = fetchFromGitHub {
     owner = "bitbrute";
-    repo = pname;
-    rev = "v${version}";
-    sha256 = "1l0acd4a36wzz1gyc6mcw3zpagyi2mc425c6d4c6anq3jxwm3847";
+    repo = "evillimiter";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-h6BReZcDW2UYaYYVQVgV0T91/+CsGuZf+J+boUhjCtA=";
   };
 
-  propagatedBuildInputs = [
+  build-system = with python3Packages; [ setuptools-scm ];
+
+  dependencies = with python3Packages; [
     colorama
     iproute2
     iptables
@@ -33,14 +31,11 @@ buildPythonApplication rec {
     tqdm
   ];
 
-  # no tests present
+  # Project has no tests
   doCheck = false;
 
-  pythonImportsCheck = [ "evillimiter.evillimiter" ];
-
-  meta = with lib; {
+   meta = with lib; {
     description = "Tool that monitors, analyzes and limits the bandwidth";
-    mainProgram = "evillimiter";
     longDescription = ''
       A tool to monitor, analyze and limit the bandwidth (upload/download) of
       devices on your local network without physical or administrative access.
@@ -48,7 +43,8 @@ buildPythonApplication rec {
       bandwidth of hosts on the network.
     '';
     homepage = "https://github.com/bitbrute/evillimiter";
-    license = with licenses; [ mit ];
+    license = licenses.mit;
     maintainers = with maintainers; [ fab ];
+    mainProgram = "evillimiter";
   };
 }

pkgs/by-name/ex/exodus/package.nix

@@ -28,12 +28,12 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "exodus";
-  version = "24.19.4";
+  version = "24.41.3";
 
   src = requireFile {
     name = "exodus-linux-x64-${finalAttrs.version}.zip";
     url = "https://downloads.exodus.com/releases/exodus-linux-x64-${finalAttrs.version}.zip";
-    hash = "sha256-+g7DdDrSVmBl1wCSCoJcO2gmbWQBnJUYqjT+GuDlCYw=";
+    hash = "sha256-cq8vHE/wAGRu20F3N3q9F+JXLV8VgGbo5JE9Q2OFuMw=";
   };
 
   nativeBuildInputs = [ unzip ];

pkgs/by-name/fa/factorio/versions.json

@@ -3,25 +3,25 @@
     "alpha": {
       "experimental": {
         "candidateHashFilenames": [
-          "factorio_linux_2.0.11.tar.xz"
+          "factorio_linux_2.0.14.tar.xz"
         ],
-        "name": "factorio_alpha_x64-2.0.11.tar.xz",
+        "name": "factorio_alpha_x64-2.0.14.tar.xz",
         "needsAuth": true,
-        "sha256": "84cc76d9197c274ee73f05f1ceb1895c7c2423ccc3452ac0bdf73cdbfcd4f44e",
+        "sha256": "8853ce1cdea0c142f78c3ebb3b7d51420f9eb28e9113f2be08a12d4e476dcadc",
         "tarDirectory": "x64",
-        "url": "https://factorio.com/get-download/2.0.11/alpha/linux64",
-        "version": "2.0.11"
+        "url": "https://factorio.com/get-download/2.0.14/alpha/linux64",
+        "version": "2.0.14"
       },
       "stable": {
         "candidateHashFilenames": [
-          "factorio_linux_2.0.11.tar.xz"
+          "factorio_linux_2.0.13.tar.xz"
         ],
-        "name": "factorio_alpha_x64-2.0.11.tar.xz",
+        "name": "factorio_alpha_x64-2.0.13.tar.xz",
         "needsAuth": true,
-        "sha256": "84cc76d9197c274ee73f05f1ceb1895c7c2423ccc3452ac0bdf73cdbfcd4f44e",
+        "sha256": "25fc4c8b0c0b63d8024e1e76efda50e6f8348e967e03c2770eb8a867494b9c98",
         "tarDirectory": "x64",
-        "url": "https://factorio.com/get-download/2.0.11/alpha/linux64",
-        "version": "2.0.11"
+        "url": "https://factorio.com/get-download/2.0.13/alpha/linux64",
+        "version": "2.0.13"
       }
     },
     "demo": {
@@ -51,51 +51,51 @@
     "expansion": {
       "experimental": {
         "candidateHashFilenames": [
-          "factorio-space-age_linux_2.0.11.tar.xz"
+          "factorio-space-age_linux_2.0.14.tar.xz"
         ],
-        "name": "factorio_expansion_x64-2.0.11.tar.xz",
+        "name": "factorio_expansion_x64-2.0.14.tar.xz",
         "needsAuth": true,
-        "sha256": "6d7754718bd980b27469e2298655abfe3d6ad7d6bd22b765f75bbf23770ab179",
+        "sha256": "7878444d65dc12815d7ce4d2c941441b8b7e05605e3f0bd69d45d02b3aa8f81a",
         "tarDirectory": "x64",
-        "url": "https://factorio.com/get-download/2.0.11/expansion/linux64",
-        "version": "2.0.11"
+        "url": "https://factorio.com/get-download/2.0.14/expansion/linux64",
+        "version": "2.0.14"
       },
       "stable": {
         "candidateHashFilenames": [
-          "factorio-space-age_linux_2.0.11.tar.xz"
+          "factorio-space-age_linux_2.0.13.tar.xz"
         ],
-        "name": "factorio_expansion_x64-2.0.11.tar.xz",
+        "name": "factorio_expansion_x64-2.0.13.tar.xz",
         "needsAuth": true,
-        "sha256": "6d7754718bd980b27469e2298655abfe3d6ad7d6bd22b765f75bbf23770ab179",
+        "sha256": "5834dc11791aa24c0edc6ecfdd223f80af9c6842c39be0fb8c3b188463ec0f54",
         "tarDirectory": "x64",
-        "url": "https://factorio.com/get-download/2.0.11/expansion/linux64",
-        "version": "2.0.11"
+        "url": "https://factorio.com/get-download/2.0.13/expansion/linux64",
+        "version": "2.0.13"
       }
     },
     "headless": {
       "experimental": {
         "candidateHashFilenames": [
-          "factorio-headless_linux_2.0.11.tar.xz",
-          "factorio_headless_x64_2.0.11.tar.xz"
+          "factorio-headless_linux_2.0.14.tar.xz",
+          "factorio_headless_x64_2.0.14.tar.xz"
         ],
-        "name": "factorio_headless_x64-2.0.11.tar.xz",
+        "name": "factorio_headless_x64-2.0.14.tar.xz",
         "needsAuth": false,
-        "sha256": "7848f2d8b2b32a0efeb8a401657459486eda9b8072c221d0f9c0b450290da0d6",
+        "sha256": "5a4bc4c3b2a97ed1fc58eb796321e848dcc64435bd91013dd9c78a14a8ce8815",
         "tarDirectory": "x64",
-        "url": "https://factorio.com/get-download/2.0.11/headless/linux64",
-        "version": "2.0.11"
+        "url": "https://factorio.com/get-download/2.0.14/headless/linux64",
+        "version": "2.0.14"
       },
       "stable": {
         "candidateHashFilenames": [
-          "factorio-headless_linux_2.0.11.tar.xz",
-          "factorio_headless_x64_2.0.11.tar.xz"
+          "factorio-headless_linux_2.0.13.tar.xz",
+          "factorio_headless_x64_2.0.13.tar.xz"
         ],
-        "name": "factorio_headless_x64-2.0.11.tar.xz",
+        "name": "factorio_headless_x64-2.0.13.tar.xz",
         "needsAuth": false,
-        "sha256": "7848f2d8b2b32a0efeb8a401657459486eda9b8072c221d0f9c0b450290da0d6",
+        "sha256": "27b36901a39e593adf28418c0286142c6c7a9f83d156963c7369bd405a25c7d1",
         "tarDirectory": "x64",
-        "url": "https://factorio.com/get-download/2.0.11/headless/linux64",
-        "version": "2.0.11"
+        "url": "https://factorio.com/get-download/2.0.13/headless/linux64",
+        "version": "2.0.13"
       }
     }
   }

pkgs/by-name/ge/geoserver/extensions.nix

@@ -29,325 +29,325 @@ in
 {
   app-schema = mkGeoserverExtension {
     name = "app-schema";
-    version = "2.25.3"; # app-schema
-    hash = "sha256-IvcJAu62wXAh5OQkG3cTUB/X7dc/2q6Le7GSwfJL/sA="; # app-schema
+    version = "2.26.0"; # app-schema
+    hash = "sha256-HOjhM9WI7lsqUNrozLB2oI6szqm+Cb7VqC0Hy9NlNMU="; # app-schema
   };
 
   authkey = mkGeoserverExtension {
     name = "authkey";
-    version = "2.25.3"; # authkey
-    hash = "sha256-4tEu9JOomMN/ntDHLqEwrn9lPrJ4LjTM/VuMsjARbF0="; # authkey
+    version = "2.26.0"; # authkey
+    hash = "sha256-34U3zq/SKm21fZV80+04N/0ygqShdYVMeQNuqtMSXgQ="; # authkey
   };
 
   cas = mkGeoserverExtension {
     name = "cas";
-    version = "2.25.3"; # cas
-    hash = "sha256-Am8tgF5APKuTa7XI7aI9Oq9jAiDPfJhGCXErtyPpDS8="; # cas
+    version = "2.26.0"; # cas
+    hash = "sha256-mosawsZkCKOm03CFg9poJ+XwbbGhvNt8AsxnegW59H4="; # cas
   };
 
   charts = mkGeoserverExtension {
     name = "charts";
-    version = "2.25.3"; # charts
-    hash = "sha256-0Vu9ldBYWe4vFQ6ftEO/WsmNz3Sf3W8iPS7t9W/+5fY="; # charts
+    version = "2.26.0"; # charts
+    hash = "sha256-rPnY9zYgdRoud2I2hcxnODDE/2gsBTMgTPrGAwDdrbM="; # charts
   };
 
   control-flow = mkGeoserverExtension {
     name = "control-flow";
-    version = "2.25.3"; # control-flow
-    hash = "sha256-zH+Hz7SySKRdrrmMBukXkaCziszIwOqzSmGYXWZGxs4="; # control-flow
+    version = "2.26.0"; # control-flow
+    hash = "sha256-4Kl0SgKW8MifMVY1+Aa9Ve0WufjHFQejobhQfnwGwbw="; # control-flow
   };
 
   css = mkGeoserverExtension {
     name = "css";
-    version = "2.25.3"; # css
-    hash = "sha256-c3VDxTGZebGCPfYhwUyENoGiDmVa1zttJEi/879RPsc="; # css
+    version = "2.26.0"; # css
+    hash = "sha256-CUG5cBxW/PyP/M2I5/1wC1UndzWSIg8aKeETtUnrH5A="; # css
   };
 
   csw = mkGeoserverExtension {
     name = "csw";
-    version = "2.25.3"; # csw
-    hash = "sha256-8G7GY5n0bV/xvwUkTijHLnsXBD4MczIastdeGmFcfSc="; # csw
+    version = "2.26.0"; # csw
+    hash = "sha256-ABNFf6grpU97nd81H/s8Gfd1G9mxMwVdUduubLWrsRE="; # csw
   };
 
   csw-iso = mkGeoserverExtension {
     name = "csw-iso";
-    version = "2.25.3"; # csw-iso
-    hash = "sha256-cSY981K9QiY3YJJR1zBCQArJESZO+80oIa/uj+qTsTM="; # csw-iso
+    version = "2.26.0"; # csw-iso
+    hash = "sha256-dKyVP5FuJ0Tl2z4veMeIJO66dBucfZo6qH+WvSBQ1Es="; # csw-iso
   };
 
   db2 = mkGeoserverExtension {
     name = "db2";
-    version = "2.25.3"; # db2
-    hash = "sha256-0eRiLoPIWv5Bddi9RxRkxAVMSolZCpv1kKEK7FkQrXs="; # db2
+    version = "2.26.0"; # db2
+    hash = "sha256-L0Xrc0MuSiezKk7l4P4lm3phRou79neQds4Yu2VG5DY="; # db2
   };
 
   # Needs wps extension.
   dxf = mkGeoserverExtension {
     name = "dxf";
-    version = "2.25.3"; # dxf
-    hash = "sha256-0i2F9343IhN6LZMdTj/dSP5k5QXd7Si/8ZWbxmkcdD4="; # dxf
+    version = "2.26.0"; # dxf
+    hash = "sha256-OtpYej/MxqeoMBw17Ltr9l5iOGUa91L30hgBz6ZbD+Y="; # dxf
   };
 
   excel = mkGeoserverExtension {
     name = "excel";
-    version = "2.25.3"; # excel
-    hash = "sha256-N7OCXq1HRwV1poPImct7T9ZWdbWWYprSBMarGXx33OI="; # excel
+    version = "2.26.0"; # excel
+    hash = "sha256-UHIVJnUJnzPDJWsrQw9YasUedpLujKr9s3VJtSgESHY="; # excel
   };
 
   feature-pregeneralized = mkGeoserverExtension {
     name = "feature-pregeneralized";
-    version = "2.25.3"; # feature-pregeneralized
-    hash = "sha256-R1jv7GPT3f7D18gQoWcLXqhtULtUvA3wEeXC2Q0+eQg="; # feature-pregeneralized
+    version = "2.26.0"; # feature-pregeneralized
+    hash = "sha256-WT1TsHcYoxJK0LWsF4h8VdUGxIecx9SuIqWoA9JjZfA="; # feature-pregeneralized
   };
 
   # Note: The extension name ("gdal") clashes with pkgs.gdal.
   gdal = mkGeoserverExtension {
     name = "gdal";
-    version = "2.25.3"; # gdal
+    version = "2.26.0"; # gdal
     buildInputs = [ pkgs.gdal ];
-    hash = "sha256-n6B/FHpul29MTYuBsg0XNfTTANBXw/cSEolzIabhHA8="; # gdal
+    hash = "sha256-lGyBxRCz5DvDQUNQmsk1+DfArwx3kcMoSgQq+O/DqZc="; # gdal
   };
 
   # Throws "java.io.FileNotFoundException: URL [jar:file:/nix/store/.../WEB-INF/lib/gs-geofence-server-2.24.1.jar!/geofence-default-override.properties] cannot be resolved to absolute file path because it does not reside in the file system: jar:file:/nix/store/.../WEB-INF/lib/gs-geofence-server-2.24.1.jar!/geofence-default-override.properties" but seems to work out of the box.
   #geofence = mkGeoserverExtension {
   #  name = "geofence";
-  #  version = "2.25.3"; # geofence
-  #  hash = "sha256-298rEz0JmFhXxfv0tpdsDOrFLyS7GcuFwp/tX/m+SyI="; # geofence
+  #  version = "2.26.0"; # geofence
+  #  hash = "sha256-Io71mNpUu15klMWFHCaFfRmxPUGGTASZE7MZWyv2TDQ="; # geofence
   #};
 
   #geofence-server = mkGeoserverExtension {
   #  name = "geofence-server";
-  #  version = "2.25.3"; # geofence-server
-  #  hash = "sha256-PHP6OmulBbUJ1Q7qliYXX6fAA2C8q4h4i7qCXJpVUCQ="; # geofence-server
+  #  version = "2.26.0"; # geofence-server
+  #  hash = "sha256-UPRupgj9La/JWAneGeM+UdCvnkcW3ZTe7c1bYZRURGI="; # geofence-server
   #};
 
   #geofence-wps = mkGeoserverExtension {
   #  name = "geofence-wps";
-  #  version = "2.25.3"; # geofence-wps
-  #  hash = "sha256-vH7gQsjfAEcpcM+JVRfbw5sH4eJz+051FBrmoS7MyYo="; # geofence-wps
+  #  version = "2.26.0"; # geofence-wps
+  #  hash = "sha256-SA7nWTyawzDZVsOATRLW/MQQfyXWhHQif3/4MdVogBM="; # geofence-wps
   #};
 
   geopkg-output = mkGeoserverExtension {
     name = "geopkg-output";
-    version = "2.25.3"; # geopkg-output
-    hash = "sha256-frcNjS+phsyuRo4PlmcSUu2Ylp3kHA8OYm+WCBAU/UI="; # geopkg-output
+    version = "2.26.0"; # geopkg-output
+    hash = "sha256-SKIInEC9TI2FBtduGHi3apZip5ubA4/ip58+w0O1a38="; # geopkg-output
   };
 
   grib = mkGeoserverExtension {
     name = "grib";
-    version = "2.25.3"; # grib
-    hash = "sha256-uQ7xe3sokrE89QTfTLynHSHE0W6LmiICO3XKkWKEJBU="; # grib
+    version = "2.26.0"; # grib
+    hash = "sha256-5Hn6LUxsCP5YvVsMgh6m/oMBJuIo2Y9XdbSRQAJm+vI="; # grib
     buildInputs = [ netcdf ];
   };
 
   gwc-s3 = mkGeoserverExtension {
     name = "gwc-s3";
-    version = "2.25.3"; # gwc-s3
-    hash = "sha256-1cc3JywXaCCQUojnTVYmkq9Gz5Y1atBJmd0GDhyGAIE="; # gwc-s3
+    version = "2.26.0"; # gwc-s3
+    hash = "sha256-www+MTFlkmJ6GeGd3v8uGTYV7PYVg5pIS9/2s1D6YeU="; # gwc-s3
   };
 
   h2 = mkGeoserverExtension {
     name = "h2";
-    version = "2.25.3"; # h2
-    hash = "sha256-Cp/3qrjNSKztAaMrxPoZo2YfGBEezLQp6/ZGOehkixM="; # h2
+    version = "2.26.0"; # h2
+    hash = "sha256-+Y7pILmnz51c5eO+OdqHGLD05fEqaM3vkFU7s0UiA2g="; # h2
   };
 
   iau = mkGeoserverExtension {
     name = "iau";
-    version = "2.25.3"; # iau
-    hash = "sha256-MV/XYF61rQjuOJSU6n0ADauFYJGF0cZk4lMSoHs9drg="; # iau
+    version = "2.26.0"; # iau
+    hash = "sha256-5oM3JxD6HKVhq1/IxXWck1MtQ8KwsLtf+LQACpvdKMA="; # iau
   };
 
   importer = mkGeoserverExtension {
     name = "importer";
-    version = "2.25.3"; # importer
-    hash = "sha256-T6PGv3zfiwA8DE2XZ2CusaQ0vRGZ75mO4nxONsCQU+g="; # importer
+    version = "2.26.0"; # importer
+    hash = "sha256-HFBIEB8pgVaCMF34Z0Clp3+nk2h4Va0xV2ptSZUSx9I="; # importer
   };
 
   inspire = mkGeoserverExtension {
     name = "inspire";
-    version = "2.25.3"; # inspire
-    hash = "sha256-A4BBd0Q8NVjPLI6e8HTCg5zd4QOLQ6Ho3/2hnRXCeTM="; # inspire
+    version = "2.26.0"; # inspire
+    hash = "sha256-uIryr4WQbWdAMjqATGf0txp1sZWWABSMv8o2xiKaWiI="; # inspire
   };
 
   # Needs Kakadu plugin from
   # https://github.com/geosolutions-it/imageio-ext
   #jp2k = mkGeoserverExtension {
   #  name = "jp2k";
-  #  version = "2.25.3"; # jp2k
-  #  hash = "sha256-0df5vPLYqxPAxqINwdWZ5RRJQVm/79sUcj8fB4RwMKY="; # jp2k
+  #  version = "2.26.0"; # jp2k
+  #  hash = "sha256-gPipm6hnkIyEU3a8NbSCm5QUSF+IKNHgt5DNFsvC++c="; # jp2k
   #};
 
   libjpeg-turbo = mkGeoserverExtension {
     name = "libjpeg-turbo";
-    version = "2.25.3"; # libjpeg-turbo
-    hash = "sha256-vQjeYuB6JY+bMlxRXZ7HqgS2hEtmEJJvowfwhWmYkY4="; # libjpeg-turbo
+    version = "2.26.0"; # libjpeg-turbo
+    hash = "sha256-I1Ojsgd+gRjSJJkx9wSfzJfVq5z3vgxA4zynZvVd4jU="; # libjpeg-turbo
     buildInputs = [ libjpeg.out ];
   };
 
   mapml = mkGeoserverExtension {
     name = "mapml";
-    version = "2.25.3"; # mapml
-    hash = "sha256-3BMCWeAFn52Uiob53eer5OqBLOgQaMTmHPFTLs51mEg="; # mapml
+    version = "2.26.0"; # mapml
+    hash = "sha256-VGg/3cB+KUwZtbKQUoU4NURDjcANzQpPv4ZWeCzwkq0="; # mapml
   };
 
   mbstyle = mkGeoserverExtension {
     name = "mbstyle";
-    version = "2.25.3"; # mbstyle
-    hash = "sha256-SJAI4ssMZZL75gx1h7gwf+4YwXP/CNEm9BTtA/JNRW4="; # mbstyle
+    version = "2.26.0"; # mbstyle
+    hash = "sha256-Z5CNKP2fqMcw6prP/b84tOAPYwlLiFsbV26VdVnqFns="; # mbstyle
   };
 
   metadata = mkGeoserverExtension {
     name = "metadata";
-    version = "2.25.3"; # metadata
-    hash = "sha256-Gst1cctv/oKTS+jD0y8fHFrEBJyn77fEafV+QzspQVc="; # metadata
+    version = "2.26.0"; # metadata
+    hash = "sha256-6E9Z6WqCQxlDL3w1FiI+gOzjQ4ZyS5oucj1/02W4k4Y="; # metadata
   };
 
   mongodb = mkGeoserverExtension {
     name = "mongodb";
-    version = "2.25.3"; # mongodb
-    hash = "sha256-LVejtipIRZy3g5GKs8RkOqKHNRskf8YSD11fiFvBF3w="; # mongodb
+    version = "2.26.0"; # mongodb
+    hash = "sha256-thfgMeDrDb2rPh9h9R2AgYYWPBHcEG/sI4UhNBb/DfQ="; # mongodb
   };
 
   monitor = mkGeoserverExtension {
     name = "monitor";
-    version = "2.25.3"; # monitor
-    hash = "sha256-+FlKgoESE0j6JXM0yozYMyz6U2TshYNd6WHsKg9frAs="; # monitor
+    version = "2.26.0"; # monitor
+    hash = "sha256-vgeqZXzb8nz7daAeur1JMLS0Rospgyx+v9n687000EE="; # monitor
   };
 
   mysql = mkGeoserverExtension {
     name = "mysql";
-    version = "2.25.3"; # mysql
-    hash = "sha256-gfU67lID2YSNbi1aB8m1b+zGqtVnChi56HrtcBE6Aqw="; # mysql
+    version = "2.26.0"; # mysql
+    hash = "sha256-PCNCyqJwOK6P6sDWVMdV6gGXgHJOPw97cqkjaixZxwQ="; # mysql
   };
 
   netcdf = mkGeoserverExtension {
     name = "netcdf";
-    version = "2.25.3"; # netcdf
-    hash = "sha256-aMykYIBMwH46apDudKnApNba454Yep5HZeYPqEXoqcI="; # netcdf
+    version = "2.26.0"; # netcdf
+    hash = "sha256-0i/zmiIE+xjec6dOd237MdIBrCspZEL+8h1c/g0h7oU="; # netcdf
     buildInputs = [ netcdf ];
   };
 
   netcdf-out = mkGeoserverExtension {
     name = "netcdf-out";
-    version = "2.25.3"; # netcdf-out
-    hash = "sha256-3gGzgC7IbwpettwSf4+b8HeJRuvkUfDu0xre9wyVap4="; # netcdf-out
+    version = "2.26.0"; # netcdf-out
+    hash = "sha256-xl2mY9QYSVeC2k43H2GFz2D56rajCT9FlpP47Q8aOe8="; # netcdf-out
     buildInputs = [ netcdf ];
   };
 
   ogr-wfs = mkGeoserverExtension {
     name = "ogr-wfs";
-    version = "2.25.3"; # ogr-wfs
+    version = "2.26.0"; # ogr-wfs
     buildInputs = [ pkgs.gdal ];
-    hash = "sha256-4rcUvN1py62JMQy51rxvNfV2AQIptXuRen7tvbrno6s="; # ogr-wfs
+    hash = "sha256-LiB+BE2Q3a2US7HJkBWT0Z9AMZ3A3M584qbEV1uhhEM="; # ogr-wfs
   };
 
   # Needs ogr-wfs extension.
   ogr-wps = mkGeoserverExtension {
     name = "ogr-wps";
-    version = "2.25.3"; # ogr-wps
+    version = "2.26.0"; # ogr-wps
     # buildInputs = [ pkgs.gdal ];
-    hash = "sha256-RA1dxzjhOt7lQCu6SVSM8HiXYwtFbUfj0hdk831QE5g="; # ogr-wps
+    hash = "sha256-0o4cD8wv1Km5pljxAlokVRVEfMbklXgkYhxFZqPdROk="; # ogr-wps
   };
 
   oracle = mkGeoserverExtension {
     name = "oracle";
-    version = "2.25.3"; # oracle
-    hash = "sha256-fKJwLh4T445da1AWPzFpp++LGWiiKhN339VWt1N0s5Q="; # oracle
+    version = "2.26.0"; # oracle
+    hash = "sha256-mxc46ctIh7imjQgTI2zZ9gwtgDF6GkE/b5IogUktF9Y="; # oracle
   };
 
   params-extractor = mkGeoserverExtension {
     name = "params-extractor";
-    version = "2.25.3"; # params-extractor
-    hash = "sha256-zO9OwH7NCUILnxRqz1z/QJdfgsx9gfpf2R7rIsgTIr8="; # params-extractor
+    version = "2.26.0"; # params-extractor
+    hash = "sha256-dLzEdnNy+Nrxkc4aBCGTESuReW6mkgXEpXDo9rDzsBU="; # params-extractor
   };
 
   printing = mkGeoserverExtension {
     name = "printing";
-    version = "2.25.3"; # printing
-    hash = "sha256-QAy53/p+/mjCTXreKsVSRcpYgfAs7W9f+ZwE4Z6Gnx8="; # printing
+    version = "2.26.0"; # printing
+    hash = "sha256-31T/tizxkmzYbxR1eLiY3DanwlFVdeZvFOESgBnuG1A="; # printing
   };
 
   pyramid = mkGeoserverExtension {
     name = "pyramid";
-    version = "2.25.3"; # pyramid
-    hash = "sha256-kFTNQrxibatVZzPSC6Rv/SzU3FUJYQJ3dHZ5AfR3kD8="; # pyramid
+    version = "2.26.0"; # pyramid
+    hash = "sha256-lpDexw5nd1jm9cDFsQ/qXdwbX5vTD0RXKIAOg6dKQqE="; # pyramid
   };
 
   querylayer = mkGeoserverExtension {
     name = "querylayer";
-    version = "2.25.3"; # querylayer
-    hash = "sha256-TgQiroYcnVCe5QVIcEa8gsgYELqM2jS7RveGyetWokU="; # querylayer
+    version = "2.26.0"; # querylayer
+    hash = "sha256-ajrNJ0eG0pp+v/f4N5kxcUzYOyXuLhMRzvdfdiJh0Vk="; # querylayer
   };
 
   sldservice = mkGeoserverExtension {
     name = "sldservice";
-    version = "2.25.3"; # sldservice
-    hash = "sha256-5E410iNaZVEBKzRGSBcW3JNISap2NrcFtXAuP1+cVt0="; # sldservice
+    version = "2.26.0"; # sldservice
+    hash = "sha256-xxpKSDghK+Xz8buPU5lzEa7eiG5A0rPgzCaIO9GKCMY="; # sldservice
   };
 
   sqlserver = mkGeoserverExtension {
     name = "sqlserver";
-    version = "2.25.3"; # sqlserver
-    hash = "sha256-TNeyegWOz/a7uFsn1hBhOgpV0vnFncwQ+U9VqyY62+g="; # sqlserver
+    version = "2.26.0"; # sqlserver
+    hash = "sha256-UwZ4ho+HG+ocwri+N4ebTATGcT4tukAxwvx84rP0VWk="; # sqlserver
   };
 
   vectortiles = mkGeoserverExtension {
     name = "vectortiles";
-    version = "2.25.3"; # vectortiles
-    hash = "sha256-RQGeGhfixKrwRuzgmkZ/JDWaPZyDy8fAfGe0iXZfKdY="; # vectortiles
+    version = "2.26.0"; # vectortiles
+    hash = "sha256-rlQcWLEPvaKDT6JZ0RuZtaHz1bgtsblFOybKOVqDSVM="; # vectortiles
   };
 
   wcs2_0-eo = mkGeoserverExtension {
     name = "wcs2_0-eo";
-    version = "2.25.3"; # wcs2_0-eo
-    hash = "sha256-+li0zBzyHaq0an7qHAdSXKDpvpOZProHnCoHXjyVY7Y="; # wcs2_0-eo
+    version = "2.26.0"; # wcs2_0-eo
+    hash = "sha256-Ky+unKH+WBMvo/rlNPv2Uca3X610yXZvCy0/5KEN6wk="; # wcs2_0-eo
   };
 
   web-resource = mkGeoserverExtension {
     name = "web-resource";
-    version = "2.25.3"; # web-resource
-    hash = "sha256-m9+t3Q2yD+xqvuBvkc5jYWwtGqJit00xiHyDSLX8euE="; # web-resource
+    version = "2.26.0"; # web-resource
+    hash = "sha256-S7Wu4wGo2j8PcBC8VS7EECBlr7NN1hALC1VOM5b6Wk0="; # web-resource
   };
 
   wmts-multi-dimensional = mkGeoserverExtension {
     name = "wmts-multi-dimensional";
-    version = "2.25.3"; # wmts-multi-dimensional
-    hash = "sha256-b/16463iotuADA/bIwTutYCiRZYusMf/yB1xEMPZe9U="; # wmts-multi-dimensional
+    version = "2.26.0"; # wmts-multi-dimensional
+    hash = "sha256-BNigZB16d1BKRTl/UJs1oWYFKn/cFk5WX1fBwvC046I="; # wmts-multi-dimensional
   };
 
   wps = mkGeoserverExtension {
     name = "wps";
-    version = "2.25.3"; # wps
-    hash = "sha256-4WqZqfc80Qy3AACOb3MhDjocM02vKUEk9x8YfX5onyg="; # wps
+    version = "2.26.0"; # wps
+    hash = "sha256-HVTDMqG23Ign7qottKRo1PtQNr6606nV34SRopAMO1Q="; # wps
   };
 
   # Needs hazelcast (https://github.com/hazelcast/hazelcast (?)) which is not
   # available in nixpgs as of 2024/01.
   #wps-cluster-hazelcast = mkGeoserverExtension {
   #  name = "wps-cluster-hazelcast";
-  #  version = "2.25.3"; # wps-cluster-hazelcast
-  #  hash = "sha256-EDSSNVCZdcmv8ZfB3Gj80xm/ghlWNZwpTYhEwIoegM0="; # wps-cluster-hazelcast
+  #  version = "2.26.0"; # wps-cluster-hazelcast
+  #  hash = "sha256-R0Btbf6BNwGKC2TQ6BmSte612Sel7NspOX9KU+zsHBc="; # wps-cluster-hazelcast
   #};
 
   wps-download = mkGeoserverExtension {
     name = "wps-download";
-    version = "2.25.3"; # wps-download
-    hash = "sha256-70vw5PHh1hLLAocFKlzPKDZWMjQmwUbv/L4yCJGrDQ4="; # wps-download
+    version = "2.26.0"; # wps-download
+    hash = "sha256-sVbAi0y8n2shox6TX0Y4Hg5GhYakv5+tgloMix6Wbfg="; # wps-download
   };
 
   # Needs Postrgres configuration or similar.
   # See https://docs.geoserver.org/main/en/user/extensions/wps-jdbc/index.html
   wps-jdbc = mkGeoserverExtension {
     name = "wps-jdbc";
-    version = "2.25.3"; # wps-jdbc
-    hash = "sha256-5d+txy1gw36G7hXfOf5qH+bSPIRw3XeLeMCTw6yHp/M="; # wps-jdbc
+    version = "2.26.0"; # wps-jdbc
+    hash = "sha256-iJk24m4UDwK1PrU0PiCDPGj0eK7EEQajUFyl+9aIGpE="; # wps-jdbc
   };
 
   ysld = mkGeoserverExtension {
     name = "ysld";
-    version = "2.25.3"; # ysld
-    hash = "sha256-lbjfJPv9v4HUV31Hp5ZAEOe7IceRCxN7xtUxvOi2CYU="; # ysld
+    version = "2.26.0"; # ysld
+    hash = "sha256-/qbtfaIE/4haGeS6U+FML1JI/AyXWFyKOd8tGaYFCmw="; # ysld
   };
 
 }

pkgs/by-name/ge/geoserver/package.nix

@@ -9,11 +9,11 @@
 }:
 stdenv.mkDerivation (finalAttrs: rec {
   pname = "geoserver";
-  version = "2.25.3";
+  version = "2.26.0";
 
   src = fetchurl {
     url = "mirror://sourceforge/geoserver/GeoServer/${version}/geoserver-${version}-bin.zip";
-    hash = "sha256-EmW3i0qi7P48AftCz7tqI2Wtvdy3cpyR57+s42dYwt8=";
+    hash = "sha256-WeItL0j50xWYXIFmH4EFhHjxv9Xr6rG0YO8re1jUnNM=";
   };
 
   patches = [

pkgs/by-name/ge/gepetto-viewer-corba/package.nix

@@ -14,14 +14,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "gepetto-viewer-corba";
-  version = "5.8.0";
-  pyproject = false; # CMake
+  version = "5.8.1";
 
   src = fetchFromGitHub {
     owner = "gepetto";
     repo = "gepetto-viewer-corba";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-/bpAs4ca/+QjWEGuHhuDT8Ts2Ggg+DZWETZfjho6E0w=";
+    hash = "sha256-C7xrODoKCcyLPZr0+zZSZ/o5i5EeNsxCPXp2WrP28A4=";
   };
 
   outputs = [
@@ -29,12 +28,6 @@ stdenv.mkDerivation (finalAttrs: {
     "doc"
   ];
 
-  postPatch = ''
-    substituteInPlace src/CMakeLists.txt \
-      --replace-fail "ARGUMENTS $" "ARGUMENTS -p${python3Packages.omniorbpy}/${python3Packages.python.sitePackages} $" \
-      --replace-fail '$'{CMAKE_SOURCE_DIR}/cmake '$'{JRL_CMAKE_MODULES}
-  '';
-
   buildInputs = [ libsForQt5.qtbase ];
 
   nativeBuildInputs = [

pkgs/by-name/ge/gepetto-viewer/package.nix

@@ -4,7 +4,6 @@
   darwin,
   doxygen,
   fetchFromGitHub,
-  fetchpatch,
   fontconfig,
   lib,
   jrl-cmakemodules,
@@ -21,28 +20,15 @@
 let
   gepetto-viewer = stdenv.mkDerivation (finalAttrs: {
     pname = "gepetto-viewer";
-    version = "5.1.0";
+    version = "5.2.0";
 
     src = fetchFromGitHub {
       owner = "gepetto";
       repo = "gepetto-viewer";
       rev = "v${finalAttrs.version}";
-      hash = "sha256-A2J3HidG+OHJO8LpLiOEvORxDtViTdeVD85AmKkkOg8=";
+      hash = "sha256-kAQPi7bO48H0CZKz1bxfkvMiNy8RsXvRvpDK0KF7XLM=";
     };
 
-    patches = [
-      # fix use of CMAKE_INSTALL_BINDIR for $bin output
-      (fetchpatch {
-        url = "https://github.com/Gepetto/gepetto-viewer/pull/230/commits/9b1b3a61da016934c3e766e6b491c1d6f3fc80d6.patch";
-        hash = "sha256-dpviEkOyCZpTYntZ4sCG1AvobljJphPQxg7gA6JxfWs=";
-      })
-      # fix use of CMAKE_INSTALL_FULL_INCLUDEDIR for $dev output
-      (fetchpatch {
-        url = "https://github.com/Gepetto/gepetto-viewer/pull/230/commits/4e1c2bbe063db20b605e51495e9f9eca40138cca.patch";
-        hash = "sha256-HrecvW1ulCSt9+DUaQVBOoDkilGRqU2+GUx7NUw7hqc=";
-      })
-    ];
-
     cmakeFlags = [
       (lib.cmakeBool "BUILD_PY_QCUSTOM_PLOT" (!stdenv.hostPlatform.isDarwin))
       (lib.cmakeBool "BUILD_PY_QGV" (!stdenv.hostPlatform.isDarwin))

pkgs/by-name/gn/gnome-maps/package.nix

@@ -5,7 +5,6 @@
   meson,
   ninja,
   gettext,
-  python3,
   pkg-config,
   gnome,
   glib,
@@ -75,8 +74,8 @@ stdenv.mkDerivation (finalAttrs: {
     # entry point to the wrapped binary we get back to a wrapped
     # binary.
     substituteInPlace "data/org.gnome.Maps.service.in" \
-        --replace "Exec=@pkgdatadir@/@app-id@" \
-                  "Exec=$out/bin/gnome-maps"
+      --replace-fail "Exec=@pkgdatadir@/@app-id@" \
+                     "Exec=$out/bin/gnome-maps"
   '';
 
   preCheck = ''
@@ -97,6 +96,12 @@ stdenv.mkDerivation (finalAttrs: {
     rm $out/lib/gnome-maps/libgnome-maps.so.0
   '';
 
+  preFixup = ''
+    substituteInPlace "$out/share/applications/org.gnome.Maps.desktop" \
+      --replace-fail "Exec=gapplication launch org.gnome.Maps" \
+                     "Exec=gnome-maps"
+  '';
+
   passthru = {
     updateScript = gnome.updateScript { packageName = "gnome-maps"; };
   };

pkgs/by-name/go/go-chromecast/package.nix

@@ -0,0 +1,58 @@
+{
+  lib,
+  buildGo122Module,
+  fetchFromGitHub,
+  installShellFiles,
+  stdenvNoCC,
+  versionCheckHook,
+}:
+
+# "go test" fails with go 1.23
+buildGo122Module rec {
+  pname = "go-chromecast";
+  version = "0.3.1";
+
+  src = fetchFromGitHub {
+    owner = "vishen";
+    repo = "go-chromecast";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-Kzo8iWj4mtnX1Jxm2sLsnmEOmpzScxWHZ/sLYYm3vQI=";
+  };
+
+  vendorHash = "sha256-cEUlCR/xtPJJSWplV1COwV6UfzSmVArF4V0pJRk+/Og=";
+
+  CGO_ENABLED = 0;
+
+  ldflags = [
+    "-s"
+    "-w"
+    "-X=main.version=${version}"
+    "-X=main.commit=${src.rev}"
+    "-X=main.date=unknown"
+  ];
+
+  doInstallCheck = true;
+
+  nativeBuildInputs = [ installShellFiles ];
+
+  nativeInstallCheckInputs = [
+    versionCheckHook
+  ];
+
+  versionCheckProgramArg = "--version";
+
+  postInstall = lib.optionalString (stdenvNoCC.buildPlatform.canExecute stdenvNoCC.hostPlatform) ''
+    installShellCompletion --cmd go-chromecast \
+      --bash <($out/bin/go-chromecast completion bash) \
+      --fish <($out/bin/go-chromecast completion fish) \
+      --zsh <($out/bin/go-chromecast completion zsh)
+  '';
+
+  meta = {
+    homepage = "https://github.com/vishen/go-chromecast";
+    description = "CLI for Google Chromecast, Home devices and Cast Groups";
+    license = lib.licenses.asl20;
+    maintainers = [ lib.maintainers.zi3m5f ];
+    mainProgram = "go-chromecast";
+  };
+}

pkgs/by-name/gr/graphicsmagick/package.nix

@@ -26,11 +26,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "graphicsmagick";
-  version = "1.3.43";
+  version = "1.3.45";
 
   src = fetchurl {
     url = "mirror://sourceforge/graphicsmagick/GraphicsMagick-${finalAttrs.version}.tar.xz";
-    hash = "sha256-K4hYBzLNfkCdniLGEWI4vvSuBvzaEUUb8z0ln5y/OZ8=";
+    hash = "sha256-3OpRZ0FPfIBVV94tekepsxR7y/YXuR9fD0r+XmVDAms=";
   };
 
   outputs = [ "out" "man" ];

pkgs/by-name/hu/hugo/package.nix

@@ -12,13 +12,13 @@
 
 buildGoModule rec {
   pname = "hugo";
-  version = "0.136.4";
+  version = "0.136.5";
 
   src = fetchFromGitHub {
     owner = "gohugoio";
     repo = "hugo";
     rev = "refs/tags/v${version}";
-    hash = "sha256-wCv0lZqvJNOwL/naFuGb6k0Xyk58NpgH1mkhoNnkSno=";
+    hash = "sha256-NluV9/tqWTRfs2u9g4cHC1TyrxOXx3ghOZ4GDx7OZFo=";
   };
 
   vendorHash = "sha256-KqDsa7MlSONyn7AYOepQ95q1CEM83AhWk23iYSQ4twU=";

pkgs/by-name/hy/hyprgui/package.nix

@@ -0,0 +1,52 @@
+{
+  lib,
+  fetchFromGitHub,
+  rustPlatform,
+  pkg-config,
+  glib,
+  pango,
+  cairo,
+  gtk4,
+  wrapGAppsHook4,
+}:
+
+rustPlatform.buildRustPackage rec {
+  pname = "hyprgui";
+  version = "0.1.6";
+
+  src = fetchFromGitHub {
+    owner = "hyprutils";
+    repo = "hyprgui";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-n/poyVDBnMb4vw2YEymxxdjscGmu76qQ/BbS5BJOknM=";
+  };
+
+  cargoHash = "sha256-w+Bfjv7usyYfgTKW+KHqskNPco17QSjwn96cG/6yVoU=";
+
+  strictDeps = true;
+
+  nativeBuildInputs = [
+    pkg-config
+    wrapGAppsHook4
+  ];
+  buildInputs = [
+    glib
+    cairo
+    pango
+    gtk4
+  ];
+
+  postInstall = ''
+    install -Dm644 -t $out/usr/share/icons hyprgui.png
+    install -Dm644 -t $out/usr/share/applications hyprgui.desktop
+  '';
+
+  meta = {
+    description = "GUI for configuring Hyprland written in Rust";
+    homepage = "https://github.com/hyprutils/hyprgui";
+    license = lib.licenses.gpl2Only;
+    maintainers = with lib.maintainers; [ fccapria ];
+    badPlatforms = lib.platforms.darwin;
+    mainProgram = "hyprgui";
+  };
+}