Merge staging-next into staging

maintainers/maintainer-list.nix

@@ -9012,6 +9012,12 @@
     githubId = 1769386;
     name = "Liam Diprose";
   };
+  liberatys = {
+    email = "liberatys@hey.com";
+    name = "Nick Anthony Flueckiger";
+    github = "liberatys";
+    githubId = 35100156;
+  };
   libjared = {
     email = "jared@perrycode.com";
     github = "libjared";

nixos/modules/installer/cd-dvd/installation-cd-base.nix

@@ -21,9 +21,6 @@ with lib;
   # ISO naming.
   isoImage.isoName = "${config.isoImage.isoBaseName}-${config.system.nixos.label}-${pkgs.stdenv.hostPlatform.system}.iso";
 
-  # BIOS booting
-  isoImage.makeBiosBootable = true;
-
   # EFI booting
   isoImage.makeEfiBootable = true;
 

nixos/modules/installer/cd-dvd/iso-image.nix

@@ -442,9 +442,6 @@ let
       fsck.vfat -vn "$out"
     ''; # */
 
-  # Syslinux (and isolinux) only supports x86-based architectures.
-  canx86BiosBoot = pkgs.stdenv.hostPlatform.isx86;
-
 in
 
 {
@@ -543,7 +540,17 @@ in
     };
 
     isoImage.makeBiosBootable = mkOption {
-      default = false;
+      # Before this option was introduced, images were BIOS-bootable if the
+      # hostPlatform was x86-based. This option is enabled by default for
+      # backwards compatibility.
+      #
+      # Also note that syslinux package currently cannot be cross-compiled from
+      # non-x86 platforms, so the default is false on non-x86 build platforms.
+      default = pkgs.stdenv.buildPlatform.isx86 && pkgs.stdenv.hostPlatform.isx86;
+      defaultText = lib.literalMD ''
+        `true` if both build and host platforms are x86-based architectures,
+        e.g. i686 and x86_64.
+      '';
       type = lib.types.bool;
       description = lib.mdDoc ''
         Whether the ISO image should be a BIOS-bootable disk.
@@ -704,6 +711,11 @@ in
 
   config = {
     assertions = [
+      {
+        # Syslinux (and isolinux) only supports x86-based architectures.
+        assertion = config.isoImage.makeBiosBootable -> pkgs.stdenv.hostPlatform.isx86;
+        message = "BIOS boot is only supported on x86-based architectures.";
+      }
       {
         assertion = !(stringLength config.isoImage.volumeID > 32);
         # https://wiki.osdev.org/ISO_9660#The_Primary_Volume_Descriptor
@@ -722,7 +734,7 @@ in
     boot.loader.grub.enable = false;
 
     environment.systemPackages =  [ grubPkgs.grub2 grubPkgs.grub2_efi ]
-      ++ optional (config.isoImage.makeBiosBootable && canx86BiosBoot) pkgs.syslinux
+      ++ optional (config.isoImage.makeBiosBootable) pkgs.syslinux
     ;
 
     # In stage 1 of the boot, mount the CD as the root FS by label so
@@ -773,7 +785,7 @@ in
         { source = pkgs.writeText "version" config.system.nixos.label;
           target = "/version.txt";
         }
-      ] ++ optionals (config.isoImage.makeBiosBootable && canx86BiosBoot) [
+      ] ++ optionals (config.isoImage.makeBiosBootable) [
         { source = config.isoImage.splashImage;
           target = "/isolinux/background.png";
         }
@@ -800,7 +812,7 @@ in
         { source = config.isoImage.efiSplashImage;
           target = "/EFI/boot/efi-background.png";
         }
-      ] ++ optionals (config.boot.loader.grub.memtest86.enable && config.isoImage.makeBiosBootable && canx86BiosBoot) [
+      ] ++ optionals (config.boot.loader.grub.memtest86.enable && config.isoImage.makeBiosBootable) [
         { source = "${pkgs.memtest86plus}/memtest.bin";
           target = "/boot/memtest.bin";
         }
@@ -815,10 +827,10 @@ in
     # Create the ISO image.
     system.build.isoImage = pkgs.callPackage ../../../lib/make-iso9660-image.nix ({
       inherit (config.isoImage) isoName compressImage volumeID contents;
-      bootable = config.isoImage.makeBiosBootable && canx86BiosBoot;
+      bootable = config.isoImage.makeBiosBootable;
       bootImage = "/isolinux/isolinux.bin";
-      syslinux = if config.isoImage.makeBiosBootable && canx86BiosBoot then pkgs.syslinux else null;
-    } // optionalAttrs (config.isoImage.makeUsbBootable && config.isoImage.makeBiosBootable && canx86BiosBoot) {
+      syslinux = if config.isoImage.makeBiosBootable then pkgs.syslinux else null;
+    } // optionalAttrs (config.isoImage.makeUsbBootable && config.isoImage.makeBiosBootable) {
       usbBootable = true;
       isohybridMbrImage = "${pkgs.syslinux}/share/syslinux/isohdpfx.bin";
     } // optionalAttrs config.isoImage.makeEfiBootable {

nixos/modules/services/continuous-integration/hercules-ci-agent/common.nix

@@ -10,171 +10,18 @@
 let
   inherit (lib)
     filterAttrs
-    literalMD
     literalExpression
     mkIf
     mkOption
     mkRemovedOptionModule
     mkRenamedOptionModule
     types
+
     ;
 
-  cfg =
-    config.services.hercules-ci-agent;
+  cfg = config.services.hercules-ci-agent;
 
-  format = pkgs.formats.toml { };
-
-  settingsModule = { config, ... }: {
-    freeformType = format.type;
-    options = {
-      apiBaseUrl = mkOption {
-        description = lib.mdDoc ''
-          API base URL that the agent will connect to.
-
-          When using Hercules CI Enterprise, set this to the URL where your
-          Hercules CI server is reachable.
-        '';
-        type = types.str;
-        default = "https://hercules-ci.com";
-      };
-      baseDirectory = mkOption {
-        type = types.path;
-        default = "/var/lib/hercules-ci-agent";
-        description = lib.mdDoc ''
-          State directory (secrets, work directory, etc) for agent
-        '';
-      };
-      concurrentTasks = mkOption {
-        description = lib.mdDoc ''
-          Number of tasks to perform simultaneously.
-
-          A task is a single derivation build, an evaluation or an effect run.
-          At minimum, you need 2 concurrent tasks for `x86_64-linux`
-          in your cluster, to allow for import from derivation.
-
-          `concurrentTasks` can be around the CPU core count or lower if memory is
-          the bottleneck.
-
-          The optimal value depends on the resource consumption characteristics of your workload,
-          including memory usage and in-task parallelism. This is typically determined empirically.
-
-          When scaling, it is generally better to have a double-size machine than two machines,
-          because each split of resources causes inefficiencies; particularly with regards
-          to build latency because of extra downloads.
-        '';
-        type = types.either types.ints.positive (types.enum [ "auto" ]);
-        default = "auto";
-      };
-      labels = mkOption {
-        description = lib.mdDoc ''
-          A key-value map of user data.
-
-          This data will be available to organization members in the dashboard and API.
-
-          The values can be of any TOML type that corresponds to a JSON type, but arrays
-          can not contain tables/objects due to limitations of the TOML library. Values
-          involving arrays of non-primitive types may not be representable currently.
-        '';
-        type = format.type;
-        defaultText = literalExpression ''
-          {
-            agent.source = "..."; # One of "nixpkgs", "flake", "override"
-            lib.version = "...";
-            pkgs.version = "...";
-          }
-        '';
-      };
-      workDirectory = mkOption {
-        description = lib.mdDoc ''
-          The directory in which temporary subdirectories are created for task state. This includes sources for Nix evaluation.
-        '';
-        type = types.path;
-        default = config.baseDirectory + "/work";
-        defaultText = literalExpression ''baseDirectory + "/work"'';
-      };
-      staticSecretsDirectory = mkOption {
-        description = lib.mdDoc ''
-          This is the default directory to look for statically configured secrets like `cluster-join-token.key`.
-
-          See also `clusterJoinTokenPath` and `binaryCachesPath` for fine-grained configuration.
-        '';
-        type = types.path;
-        default = config.baseDirectory + "/secrets";
-        defaultText = literalExpression ''baseDirectory + "/secrets"'';
-      };
-      clusterJoinTokenPath = mkOption {
-        description = lib.mdDoc ''
-          Location of the cluster-join-token.key file.
-
-          You can retrieve the contents of the file when creating a new agent via
-          <https://hercules-ci.com/dashboard>.
-
-          As this value is confidential, it should not be in the store, but
-          installed using other means, such as agenix, NixOps
-          `deployment.keys`, or manual installation.
-
-          The contents of the file are used for authentication between the agent and the API.
-        '';
-        type = types.path;
-        default = config.staticSecretsDirectory + "/cluster-join-token.key";
-        defaultText = literalExpression ''staticSecretsDirectory + "/cluster-join-token.key"'';
-      };
-      binaryCachesPath = mkOption {
-        description = lib.mdDoc ''
-          Path to a JSON file containing binary cache secret keys.
-
-          As these values are confidential, they should not be in the store, but
-          copied over using other means, such as agenix, NixOps
-          `deployment.keys`, or manual installation.
-
-          The format is described on <https://docs.hercules-ci.com/hercules-ci-agent/binary-caches-json/>.
-        '';
-        type = types.path;
-        default = config.staticSecretsDirectory + "/binary-caches.json";
-        defaultText = literalExpression ''staticSecretsDirectory + "/binary-caches.json"'';
-      };
-      secretsJsonPath = mkOption {
-        description = lib.mdDoc ''
-          Path to a JSON file containing secrets for effects.
-
-          As these values are confidential, they should not be in the store, but
-          copied over using other means, such as agenix, NixOps
-          `deployment.keys`, or manual installation.
-
-          The format is described on <https://docs.hercules-ci.com/hercules-ci-agent/secrets-json/>.
-        '';
-        type = types.path;
-        default = config.staticSecretsDirectory + "/secrets.json";
-        defaultText = literalExpression ''staticSecretsDirectory + "/secrets.json"'';
-      };
-    };
-  };
-
-  # TODO (roberth, >=2022) remove
-  checkNix =
-    if !cfg.checkNix
-    then ""
-    else if lib.versionAtLeast config.nix.package.version "2.3.10"
-    then ""
-    else
-      pkgs.stdenv.mkDerivation {
-        name = "hercules-ci-check-system-nix-src";
-        inherit (config.nix.package) src patches;
-        dontConfigure = true;
-        buildPhase = ''
-          echo "Checking in-memory pathInfoCache expiry"
-          if ! grep 'PathInfoCacheValue' src/libstore/store-api.hh >/dev/null; then
-            cat 1>&2 <<EOF
-
-            You are deploying Hercules CI Agent on a system with an incompatible
-            nix-daemon. Please make sure nix.package is set to a Nix version of at
-            least 2.3.10 or a master version more recent than Mar 12, 2020.
-          EOF
-            exit 1
-          fi
-        '';
-        installPhase = "touch $out";
-      };
+  inherit (import ./settings.nix { inherit pkgs lib; }) format settingsModule;
 
 in
 {
@@ -198,15 +45,6 @@ in
         Support is available at [help@hercules-ci.com](mailto:help@hercules-ci.com).
       '';
     };
-    checkNix = mkOption {
-      type = types.bool;
-      default = true;
-      description = lib.mdDoc ''
-        Whether to make sure that the system's Nix (nix-daemon) is compatible.
-
-        If you set this to false, please keep up with the change log.
-      '';
-    };
     package = mkOption {
       description = lib.mdDoc ''
         Package containing the bin/hercules-ci-agent executable.
@@ -235,7 +73,7 @@ in
     tomlFile = mkOption {
       type = types.path;
       internal = true;
-      defaultText = literalMD "generated `hercules-ci-agent.toml`";
+      defaultText = lib.literalMD "generated `hercules-ci-agent.toml`";
       description = lib.mdDoc ''
         The fully assembled config file.
       '';
@@ -243,7 +81,27 @@ in
   };
 
   config = mkIf cfg.enable {
-    nix.extraOptions = lib.addContextFrom checkNix ''
+    # Make sure that nix.extraOptions does not override trusted-users
+    assertions = [
+      {
+        assertion =
+          (cfg.settings.nixUserIsTrusted or false) ->
+          builtins.match ".*(^|\n)[ \t]*trusted-users[ \t]*=.*" config.nix.extraOptions == null;
+        message = ''
+          hercules-ci-agent: Please do not set `trusted-users` in `nix.extraOptions`.
+
+          The hercules-ci-agent module by default relies on `nix.settings.trusted-users`
+          to be effectful, but a line like `trusted-users = ...` in `nix.extraOptions`
+          will override the value set in `nix.settings.trusted-users`.
+
+          Instead of setting `trusted-users` in the `nix.extraOptions` string, you should
+          set an option with additive semantics, such as
+           - the NixOS option `nix.settings.trusted-users`, or
+           - the Nix option in the `extraOptions` string, `extra-trusted-users`
+        '';
+      }
+    ];
+    nix.extraOptions = ''
       # A store path that was missing at first may well have finished building,
       # even shortly after the previous lookup. This *also* applies to the daemon.
       narinfo-cache-negative-ttl = 0
@@ -251,14 +109,9 @@ in
     services.hercules-ci-agent = {
       tomlFile =
         format.generate "hercules-ci-agent.toml" cfg.settings;
-
-      settings.labels = {
-        agent.source =
-          if options.services.hercules-ci-agent.package.highestPrio == (lib.modules.mkOptionDefault { }).priority
-          then "nixpkgs"
-          else lib.mkOptionDefault "override";
-        pkgs.version = pkgs.lib.version;
-        lib.version = lib.version;
+      settings.config._module.args = {
+        packageOption = options.services.hercules-ci-agent.package;
+        inherit pkgs;
       };
     };
   };

nixos/modules/services/continuous-integration/hercules-ci-agent/default.nix

@@ -36,8 +36,14 @@ in
         Restart = "on-failure";
         RestartSec = 120;
 
-        LimitSTACK = 256 * 1024 * 1024;
+        # If a worker goes OOM, don't kill the main process. It needs to
+        # report the failure and it's unlikely to be part of the problem.
         OOMPolicy = "continue";
+
+        # Work around excessive stack use by libstdc++ regex
+        # https://gcc.gnu.org/bugzilla/show_bug.cgi?id=86164
+        # A 256 MiB stack allows between 400 KiB and 1.5 MiB file to be matched by ".*".
+        LimitSTACK = 256 * 1024 * 1024;
       };
     };
 

nixos/modules/services/continuous-integration/hercules-ci-agent/settings.nix

@@ -0,0 +1,153 @@
+# Not a module
+{ pkgs, lib }:
+let
+  inherit (lib)
+    types
+    literalExpression
+    mkOption
+    ;
+
+  format = pkgs.formats.toml { };
+
+  settingsModule = { config, packageOption, pkgs, ... }: {
+    freeformType = format.type;
+    options = {
+      apiBaseUrl = mkOption {
+        description = lib.mdDoc ''
+          API base URL that the agent will connect to.
+
+          When using Hercules CI Enterprise, set this to the URL where your
+          Hercules CI server is reachable.
+        '';
+        type = types.str;
+        default = "https://hercules-ci.com";
+      };
+      baseDirectory = mkOption {
+        type = types.path;
+        default = "/var/lib/hercules-ci-agent";
+        description = lib.mdDoc ''
+          State directory (secrets, work directory, etc) for agent
+        '';
+      };
+      concurrentTasks = mkOption {
+        description = lib.mdDoc ''
+          Number of tasks to perform simultaneously.
+
+          A task is a single derivation build, an evaluation or an effect run.
+          At minimum, you need 2 concurrent tasks for `x86_64-linux`
+          in your cluster, to allow for import from derivation.
+
+          `concurrentTasks` can be around the CPU core count or lower if memory is
+          the bottleneck.
+
+          The optimal value depends on the resource consumption characteristics of your workload,
+          including memory usage and in-task parallelism. This is typically determined empirically.
+
+          When scaling, it is generally better to have a double-size machine than two machines,
+          because each split of resources causes inefficiencies; particularly with regards
+          to build latency because of extra downloads.
+        '';
+        type = types.either types.ints.positive (types.enum [ "auto" ]);
+        default = "auto";
+        defaultText = lib.literalMD ''
+          `"auto"`, meaning equal to the number of CPU cores.
+        '';
+      };
+      labels = mkOption {
+        description = lib.mdDoc ''
+          A key-value map of user data.
+
+          This data will be available to organization members in the dashboard and API.
+
+          The values can be of any TOML type that corresponds to a JSON type, but arrays
+          can not contain tables/objects due to limitations of the TOML library. Values
+          involving arrays of non-primitive types may not be representable currently.
+        '';
+        type = format.type;
+        defaultText = literalExpression ''
+          {
+            agent.source = "..."; # One of "nixpkgs", "flake", "override"
+            lib.version = "...";
+            pkgs.version = "...";
+          }
+        '';
+      };
+      workDirectory = mkOption {
+        description = lib.mdDoc ''
+          The directory in which temporary subdirectories are created for task state. This includes sources for Nix evaluation.
+        '';
+        type = types.path;
+        default = config.baseDirectory + "/work";
+        defaultText = literalExpression ''baseDirectory + "/work"'';
+      };
+      staticSecretsDirectory = mkOption {
+        description = lib.mdDoc ''
+          This is the default directory to look for statically configured secrets like `cluster-join-token.key`.
+
+          See also `clusterJoinTokenPath` and `binaryCachesPath` for fine-grained configuration.
+        '';
+        type = types.path;
+        default = config.baseDirectory + "/secrets";
+        defaultText = literalExpression ''baseDirectory + "/secrets"'';
+      };
+      clusterJoinTokenPath = mkOption {
+        description = lib.mdDoc ''
+          Location of the cluster-join-token.key file.
+
+          You can retrieve the contents of the file when creating a new agent via
+          <https://hercules-ci.com/dashboard>.
+
+          As this value is confidential, it should not be in the store, but
+          installed using other means, such as agenix, NixOps
+          `deployment.keys`, or manual installation.
+
+          The contents of the file are used for authentication between the agent and the API.
+        '';
+        type = types.path;
+        default = config.staticSecretsDirectory + "/cluster-join-token.key";
+        defaultText = literalExpression ''staticSecretsDirectory + "/cluster-join-token.key"'';
+      };
+      binaryCachesPath = mkOption {
+        description = lib.mdDoc ''
+          Path to a JSON file containing binary cache secret keys.
+
+          As these values are confidential, they should not be in the store, but
+          copied over using other means, such as agenix, NixOps
+          `deployment.keys`, or manual installation.
+
+          The format is described on <https://docs.hercules-ci.com/hercules-ci-agent/binary-caches-json/>.
+        '';
+        type = types.path;
+        default = config.staticSecretsDirectory + "/binary-caches.json";
+        defaultText = literalExpression ''staticSecretsDirectory + "/binary-caches.json"'';
+      };
+      secretsJsonPath = mkOption {
+        description = lib.mdDoc ''
+          Path to a JSON file containing secrets for effects.
+
+          As these values are confidential, they should not be in the store, but
+          copied over using other means, such as agenix, NixOps
+          `deployment.keys`, or manual installation.
+
+          The format is described on <https://docs.hercules-ci.com/hercules-ci-agent/secrets-json/>.
+        '';
+        type = types.path;
+        default = config.staticSecretsDirectory + "/secrets.json";
+        defaultText = literalExpression ''staticSecretsDirectory + "/secrets.json"'';
+      };
+    };
+    config = {
+      labels = {
+        agent.source =
+          if packageOption.highestPrio == (lib.modules.mkOptionDefault { }).priority
+          then "nixpkgs"
+          else lib.mkOptionDefault "override";
+        pkgs.version = pkgs.lib.version;
+        lib.version = lib.version;
+      };
+    };
+  };
+in
+{
+  inherit format settingsModule;
+}

nixos/modules/services/web-apps/outline.nix

@@ -586,7 +586,7 @@ in
 
       # Create an outline-sequalize wrapper (a wrapper around the wrapper) that
       # has the config file's path baked in. This is necessary because there is
-      # at least one occurrence of outline calling this from its own code.
+      # at least two occurrences of outline calling this from its own code.
       sequelize = pkgs.writeShellScriptBin "outline-sequelize" ''
         exec ${cfg.package}/bin/outline-sequelize \
           --config $RUNTIME_DIRECTORY/database.json \
@@ -687,21 +687,18 @@ in
           openssl rand -hex 32 > ${lib.escapeShellArg cfg.utilsSecretFile}
         fi
 
-        # The config file is required for the CLI, the DATABASE_URL environment
-        # variable is read by the app.
+        # The config file is required for the sequelize CLI.
         ${if (cfg.databaseUrl == "local") then ''
           cat <<EOF > $RUNTIME_DIRECTORY/database.json
           {
-            "production": {
-              "dialect": "postgres",
+            "production-ssl-disabled": {
               "host": "/run/postgresql",
               "username": null,
-              "password": null
+              "password": null,
+              "dialect": "postgres"
             }
           }
           EOF
-          export DATABASE_URL=${lib.escapeShellArg localPostgresqlUrl}
-          export PGSSLMODE=disable
         '' else ''
           cat <<EOF > $RUNTIME_DIRECTORY/database.json
           {
@@ -720,11 +717,7 @@ in
             }
           }
           EOF
-          export DATABASE_URL=${lib.escapeShellArg cfg.databaseUrl}
         ''}
-
-        cd $RUNTIME_DIRECTORY
-        ${sequelize}/bin/outline-sequelize db:migrate
       '';
 
       script = ''
@@ -781,7 +774,7 @@ in
         RuntimeDirectoryMode = "0750";
         # This working directory is required to find stuff like the set of
         # onboarding files:
-        WorkingDirectory = "${cfg.package}/share/outline/build";
+        WorkingDirectory = "${cfg.package}/share/outline";
       };
     };
   };

nixos/tests/all-tests.nix

@@ -555,6 +555,7 @@ in {
   openstack-image-userdata = (handleTestOn ["x86_64-linux"] ./openstack-image.nix {}).userdata or {};
   opentabletdriver = handleTest ./opentabletdriver.nix {};
   owncast = handleTest ./owncast.nix {};
+  outline = handleTest ./outline.nix {};
   image-contents = handleTest ./image-contents.nix {};
   openvscode-server = handleTest ./openvscode-server.nix {};
   orangefs = handleTest ./orangefs.nix {};

nixos/tests/outline.nix

@@ -0,0 +1,54 @@
+import ./make-test-python.nix ({ pkgs, lib, ... }:
+let
+  accessKey = "BKIKJAA5BMMU2RHO6IBB";
+  secretKey = "V7f1CwQqAcwo80UEIJEjc5gVQUSSx5ohQ9GSrr12";
+  secretKeyFile = pkgs.writeText "outline-secret-key" ''
+    ${secretKey}
+  '';
+  rootCredentialsFile = pkgs.writeText "minio-credentials-full" ''
+    MINIO_ROOT_USER=${accessKey}
+    MINIO_ROOT_PASSWORD=${secretKey}
+  '';
+in
+{
+  name = "outline";
+
+  meta.maintainers = with lib.maintainers; [ xanderio ];
+
+  nodes = {
+    outline = { pkgs, config, ... }: {
+      nixpkgs.config.allowUnfree = true;
+      environment.systemPackages = [ pkgs.minio-client ];
+      services.outline = {
+        enable = true;
+        forceHttps = false;
+        storage = {
+          inherit accessKey secretKeyFile;
+          uploadBucketUrl = "http://localhost:9000";
+          uploadBucketName = "outline";
+          region = config.services.minio.region;
+        };
+      };
+      services.minio = {
+        enable = true;
+        inherit rootCredentialsFile;
+      };
+    };
+  };
+
+  testScript =
+    ''
+      machine.wait_for_unit("minio.service")
+      machine.wait_for_open_port(9000)
+
+      # Create a test bucket on the server
+      machine.succeed(
+          "mc config host add minio http://localhost:9000 ${accessKey} ${secretKey} --api s3v4"
+      )
+      machine.succeed("mc mb minio/outline")
+
+      outline.wait_for_unit("outline.service")
+      outline.wait_for_open_port(3000)
+      outline.succeed("curl --fail http://localhost:3000/")
+    '';
+})

pkgs/applications/audio/bespokesynth/default.nix

@@ -30,10 +30,12 @@
 , pcre
 , mount
 , gnome
+, Accelerate
 , Cocoa
 , WebKit
 , CoreServices
 , CoreAudioKit
+, IOBluetooth
   # It is not allowed to distribute binaries with the VST2 SDK plugin without a license
   # (the author of Bespoke has such a licence but not Nix). VST3 should work out of the box.
   # Read more in https://github.com/NixOS/nixpkgs/issues/145607
@@ -102,10 +104,12 @@ stdenv.mkDerivation rec {
     pcre
     mount
   ] ++ lib.optionals stdenv.hostPlatform.isDarwin [
+    Accelerate
     Cocoa
     WebKit
     CoreServices
     CoreAudioKit
+    IOBluetooth
   ];
 
   env.NIX_CFLAGS_COMPILE = lib.optionalString stdenv.hostPlatform.isDarwin (toString [

pkgs/applications/audio/dexed/default.nix

@@ -11,6 +11,7 @@
 , freetype
 , alsa-lib
 , libjack2
+, Accelerate
 , Cocoa
 , WebKit
 , MetalKit
@@ -52,6 +53,7 @@ stdenv.mkDerivation rec {
     alsa-lib
     libjack2
   ] ++ lib.optionals stdenv.hostPlatform.isDarwin [
+    Accelerate
     Cocoa
     WebKit
     MetalKit

pkgs/applications/audio/fire/default.nix

@@ -11,6 +11,7 @@
 , libXcursor
 , freetype
 , alsa-lib
+, Accelerate
 , Cocoa
 , WebKit
 , CoreServices
@@ -76,6 +77,7 @@ stdenv.mkDerivation rec {
     freetype
     alsa-lib
   ] ++ lib.optionals stdenv.hostPlatform.isDarwin [
+    Accelerate
     Cocoa
     WebKit
     CoreServices

pkgs/applications/audio/mopidy/mopidy.nix

@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchFromGitHub, pythonPackages, wrapGAppsHook
+{ lib, stdenv, fetchFromGitHub, pythonPackages, wrapGAppsNoGuiHook
 , gst_all_1, glib-networking, gobject-introspection
 }:
 
@@ -13,7 +13,7 @@ pythonPackages.buildPythonApplication rec {
     sha256 = "sha256-IUQe5WH2vsrAOgokhTNVVM3lnJXphT2xNGu27hWBLSo=";
   };
 
-  nativeBuildInputs = [ wrapGAppsHook ];
+  nativeBuildInputs = [ wrapGAppsNoGuiHook ];
 
   buildInputs = with gst_all_1; [
     glib-networking
@@ -45,10 +45,7 @@ pythonPackages.buildPythonApplication rec {
 
   meta = with lib; {
     homepage = "https://www.mopidy.com/";
-    description = ''
-      An extensible music server that plays music from local disk, Spotify,
-      SoundCloud, and more
-    '';
+    description = "An extensible music server that plays music from local disk, Spotify, SoundCloud, and more";
     license = licenses.asl20;
     maintainers = [ maintainers.fpletz ];
     hydraPlatforms = [];

pkgs/desktops/xfce/core/libxfce4ui/default.nix

@@ -4,9 +4,9 @@
 mkXfceDerivation {
   category = "xfce";
   pname = "libxfce4ui";
-  version = "4.18.3";
+  version = "4.18.4";
 
-  sha256 = "sha256-Wb1nq744HDO4erJ2nJdFD0OMHVh14810TngN3FLFWIA=";
+  sha256 = "sha256-HnLmZftvFvQAvmQ7jZCaYAQ5GB0YMjzhqZkILzvifoE=";
 
   nativeBuildInputs = [ gobject-introspection vala ];
   buildInputs =  [ gtk3 libstartup_notification libgtop libepoxy xfconf ];

pkgs/desktops/xfce/core/xfce4-panel/default.nix

@@ -16,9 +16,9 @@
 mkXfceDerivation {
   category = "xfce";
   pname = "xfce4-panel";
-  version = "4.18.3";
+  version = "4.18.4";
 
-  sha256 = "sha256-NSy0MTphzGth0w+Kn93hWvsjLw6qR8SqjYYc1Z2SWIs=";
+  sha256 = "sha256-OEU9NzvgWn6zJGdK9Te2qBbARlwvRrLHuaUocNyGd/g=";
 
   nativeBuildInputs = [
     gobject-introspection

pkgs/development/coq-modules/coqeal/default.nix

@@ -8,6 +8,7 @@
 
   inherit version;
   defaultVersion = with lib.versions; lib.switch [ coq.version mathcomp.version ]  [
+      { cases = [ (range "8.15" "8.17") (isGe "1.15.0") ]; out = "1.1.3"; }
       { cases = [ (range "8.13" "8.17") (isGe "1.13.0") ]; out = "1.1.1"; }
       { cases = [ (range "8.10" "8.15") (isGe "1.12.0") ]; out = "1.1.0"; }
       { cases = [ (isGe "8.10") (range "1.11.0" "1.12.0") ]; out = "1.0.5"; }
@@ -15,6 +16,7 @@
       { cases = [ (isGe "8.7") "1.10.0" ]; out = "1.0.3"; }
     ] null;
 
+  release."1.1.3".sha256 = "sha256-xhqWpg86xbU1GbDtXXInNCTArjjPnWZctWiiasq1ScU=";
   release."1.1.1".sha256 = "sha256-ExAdC3WuArNxS+Sa1r4x5aT7ylbCvP/BZXfkdQNAvZ8=";
   release."1.1.0".sha256 = "1vyhfna5frkkq2fl1fkg2mwzpg09k3sbzxxpyp14fjay81xajrxr";
   release."1.0.6".sha256 = "0lqkyfj4qbq8wr3yk8qgn7mclw582n3fjl9l19yp8cnchspzywx0";

pkgs/development/coq-modules/coquelicot/default.nix

@@ -7,11 +7,13 @@ mkCoqDerivation {
   domain = "gitlab.inria.fr";
   inherit version;
   defaultVersion = with lib.versions; lib.switch coq.coq-version [
+    { case = range "8.12" "8.17"; out = "3.3.1"; }
     { case = range "8.12" "8.17"; out = "3.3.0"; }
     { case = range "8.8" "8.16"; out = "3.2.0"; }
     { case = range "8.8" "8.13"; out = "3.1.0"; }
     { case = range "8.5" "8.9";  out = "3.0.2"; }
   ] null;
+  release."3.3.1".sha256 = "sha256-YCvd4aIt2BxLKBYSWzN7aqo0AuY7z8oADmKvybhYBQI=";
   release."3.3.0".sha256 = "sha256-bh9qP/EhWrHpTe2GMGG3S2vgBSSK088mFfhAIGejVoU=";
   release."3.2.0".sha256 = "07w7dbl8x7xxnbr2q39wrdh054gvi3daqjpdn1jm53crsl1fjxm4";
   release."3.1.0".sha256 = "02i0djar13yk01hzaqprcldhhscn9843x9nf6x3jkv4wv1jwnx9f";

pkgs/development/coq-modules/mathcomp/default.nix

@@ -19,8 +19,9 @@ let
   owner = "math-comp";
   withDoc = single && (args.withDoc or false);
   defaultVersion = with versions; lib.switch coq.coq-version [
-      { case = range "8.13" "8.17"; out = "1.16.0"; }
+      { case = isGe "8.15"; out = "1.17.0"; }
       { case = range "8.16" "8.17"; out = "2.0.0"; }
+      { case = range "8.13" "8.17"; out = "1.16.0"; }
       { case = range "8.14" "8.16"; out = "1.15.0"; }
       { case = range "8.11" "8.15"; out = "1.14.0"; }
       { case = range "8.11" "8.15"; out = "1.13.0"; }
@@ -33,7 +34,8 @@ let
       { case = range "8.5" "8.7";   out = "1.6.4";  }
     ] null;
   release = {
-    "2.0.0".sha256 = "sha256-dpOmrHYUXBBS9kmmz7puzufxlbNpIZofpcTvJFLG5DI=";
+    "2.0.0".sha256  = "sha256-dpOmrHYUXBBS9kmmz7puzufxlbNpIZofpcTvJFLG5DI=";
+    "1.17.0".sha256 = "sha256-bUfoSTMiW/GzC1jKFay6DRqGzKPuLOSUsO6/wPSFwNg=";
     "1.16.0".sha256 = "sha256-gXTKhRgSGeRBUnwdDezMsMKbOvxdffT+kViZ9e1gEz0=";
     "1.15.0".sha256 = "1bp0jxl35ms54s0mdqky15w9af03f3i0n06qk12k4gw1xzvwqv21";
     "1.14.0".sha256 = "07yamlp1c0g5nahkd2gpfhammcca74ga2s6qr7a3wm6y6j5pivk9";

pkgs/development/coq-modules/multinomials/default.nix

@@ -9,6 +9,7 @@
 
   inherit version;
   defaultVersion =  with lib.versions; lib.switch [ coq.version mathcomp.version ] [
+      { cases = [ (isGe "8.15") (isGe "1.15.0") ];      out = "1.6.0"; }
       { cases = [ (isGe "8.10") (isGe "1.13.0") ];      out = "1.5.6"; }
       { cases = [ (range "8.10" "8.16") (range "1.12.0" "1.15.0") ]; out = "1.5.5"; }
       { cases = [ (range "8.10" "8.12") "1.12.0" ];             out = "1.5.3"; }
@@ -18,6 +19,7 @@
       { cases = [ "8.6"                 (range "1.6" "1.7") ];  out = "1.1"; }
     ] null;
   release = {
+    "1.6.0".sha256 = "sha256-lEM+sjqajIOm1c3lspHqcSIARgMR9RHbTQH4veHLJfU=";
     "1.5.6".sha256 = "sha256-cMixgc34T9Ic6v+tYmL49QUNpZpPV5ofaNuHqblX6oY=";
     "1.5.5".sha256 = "sha256-VdXA51vr7DZl/wT/15YYMywdD7Gh91dMP9t7ij47qNQ=";
     "1.5.4".sha256 = "0s4sbh4y88l125hdxahr56325hdhxxdmqmrz7vv8524llyv3fciq";

pkgs/development/libraries/gbenchmark/default.nix

@@ -8,13 +8,13 @@
 
 stdenv.mkDerivation rec {
   pname = "gbenchmark";
-  version = "1.7.1";
+  version = "1.8.0";
 
   src = fetchFromGitHub {
     owner = "google";
     repo = "benchmark";
     rev = "v${version}";
-    sha256 = "sha256-gg3g/0Ki29FnGqKv9lDTs5oA9NjH23qQ+hTdVtSU+zo=";
+    sha256 = "sha256-pUW9YVaujs/y00/SiPqDgK4wvVsaM7QUp/65k0t7Yr0=";
   };
 
   nativeBuildInputs = [ cmake ];

pkgs/development/python-modules/msgspec/default.nix

@@ -8,7 +8,7 @@
 
 buildPythonPackage rec {
   pname = "msgspec";
-  version = "0.15.0";
+  version = "0.15.1";
   format = "setuptools";
 
   disabled = pythonOlder "3.8";
@@ -17,7 +17,7 @@ buildPythonPackage rec {
     owner = "jcrist";
     repo = pname;
     rev = "refs/tags/${version}";
-    hash = "sha256-pyGmzG2oy+1Ip4w+pyjASvVyZDEjDylBZfbxLPFzSoU=";
+    hash = "sha256-U3mCnp7MojWcw1pZExG6pYAToVjzGXqc2TeDyhm39TY=";
   };
 
   # Requires libasan to be accessible

pkgs/development/python-modules/requests-pkcs12/default.nix

@@ -8,7 +8,7 @@
 
 buildPythonPackage rec {
   pname = "requests-pkcs12";
-  version = "1.15";
+  version = "1.16";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -17,7 +17,7 @@ buildPythonPackage rec {
     owner = "m-click";
     repo = "requests_pkcs12";
     rev = version;
-    hash = "sha256-xk8+oERonZWzxKEmZutfvovzVOz9ZP5O83cMDTz9i3Y=";
+    hash = "sha256-Uva9H2ToL7qpcXH/gmiBPKw+2gfmOxMKwxh4b43xFcA=";
   };
 
   propagatedBuildInputs = [

pkgs/development/tools/continuous-integration/hercules-ci-agent/default.nix

@@ -1,8 +1,21 @@
-{ gnutar, gzip, git, haskell, haskellPackages, lib, makeWrapper, nixos, runc, stdenv }:
+{
+  git,
+  gnutar,
+  gzip,
+  haskell,
+  haskellPackages,
+  lib,
+  makeBinaryWrapper,
+  nixos,
+  openssh,
+  runc,
+  stdenv,
+  testers,
+}:
 let
   inherit (haskell.lib.compose) overrideCabal addBuildTools justStaticExecutables;
   inherit (lib) makeBinPath;
-  bundledBins = [ gnutar gzip git ] ++ lib.optional stdenv.isLinux runc;
+  bundledBins = [ gnutar gzip git openssh ] ++ lib.optional stdenv.isLinux runc;
 
   pkg =
     # justStaticExecutables is needed due to https://github.com/NixOS/nix/issues/2990
@@ -15,17 +28,45 @@ let
           makeWrapper $out/libexec/hercules-ci-agent $out/bin/hercules-ci-agent --prefix PATH : ${lib.escapeShellArg (makeBinPath bundledBins)}
         '';
       })
-      (addBuildTools [ makeWrapper ] (justStaticExecutables haskellPackages.hercules-ci-agent));
-in pkg.overrideAttrs (o: {
+      (addBuildTools [ makeBinaryWrapper ] (justStaticExecutables haskellPackages.hercules-ci-agent));
+in pkg.overrideAttrs (finalAttrs: o: {
     meta = o.meta // {
       position = toString ./default.nix + ":1";
     };
     passthru = o.passthru // {
-      # Does not test the package, but evaluation of the related NixOS module.
-      tests.nixos-minimal-config = nixos {
-        boot.loader.grub.enable = false;
-        fileSystems."/".device = "bogus";
-        services.hercules-ci-agent.enable = true;
+      tests = {
+        version = testers.testVersion {
+          package = finalAttrs.finalPackage;
+          command = "hercules-ci-agent --help";
+        };
+      } // lib.optionalAttrs (stdenv.isLinux) {
+        # Does not test the package, but evaluation of the related NixOS module.
+        nixos-simple-config = (nixos {
+          boot.loader.grub.enable = false;
+          fileSystems."/".device = "bogus";
+          services.hercules-ci-agent.enable = true;
+          # Dummy value for testing only.
+          system.stateVersion = lib.trivial.release; # TEST ONLY
+        }).config.system.build.toplevel;
+
+        nixos-many-options-config = (nixos ({ pkgs, ... }: {
+          boot.loader.grub.enable = false;
+          fileSystems."/".device = "bogus";
+          services.hercules-ci-agent = {
+            enable = true;
+            package = pkgs.hercules-ci-agent;
+            settings = {
+              workDirectory = "/var/tmp/hci";
+              binaryCachesPath = "/var/keys/binary-caches.json";
+              labels.foo.bar.baz = "qux";
+              labels.qux = ["q" "u"];
+              apiBaseUrl = "https://hci.dev.biz.example.com";
+              concurrentTasks = 42;
+            };
+          };
+          # Dummy value for testing only.
+          system.stateVersion = lib.trivial.release; # TEST ONLY
+        })).config.system.build.toplevel;
       };
     };
   })

pkgs/development/tools/fermyon-spin/default.nix

@@ -0,0 +1,57 @@
+{ lib
+, stdenv
+, fetchzip
+, autoPatchelfHook
+, gcc-unwrapped
+, zlib
+}:
+
+let
+  system = stdenv.hostPlatform.system;
+
+  platform = {
+    x86_64-linux = "linux-amd64";
+    aarch64-linux = "linux-aarch64";
+    x86_64-darwin = "macos-amd64";
+    aarch64-darwin = "macos-aarch64";
+  }.${system} or (throw "Unsupported system: ${system}");
+
+  packageHash = {
+    x86_64-linux = "sha256-Fp1h1X5UFOHLqgaAcXXl3oSioCMVLJLaOURHd3uu8sA=";
+    aarch64-linux = "sha256-F6/h98qZvzImuxPOMYr1cGWBjr1qWGvoYztvZzw2GRg=";
+    x86_64-darwin = "sha256-WegiHPHi9Qw4PPTEB2a9AdIgMlyOzzSpTRdJH43IEjM=";
+    aarch64-darwin = "sha256-BJER3Fp4AItqtLNYh6pH/tNB98H3iTARr3fKyTXGcP8=";
+  }.${system} or (throw "Unsupported system: ${system}");
+
+in stdenv.mkDerivation rec {
+  pname = "fermyon-spin";
+  version = "1.2.1";
+
+  src = fetchzip {
+    url = "https://github.com/fermyon/spin/releases/download/v${version}/spin-v${version}-${platform}.tar.gz";
+    stripRoot = false;
+    sha256 = packageHash;
+  };
+
+  nativeBuildInputs = [
+    autoPatchelfHook
+  ];
+
+  buildInputs = [
+    gcc-unwrapped.lib
+    zlib
+  ];
+
+  installPhase = ''
+    mkdir -p $out/bin
+    cp $src/* $out/bin
+  '';
+
+  meta = with lib; {
+    description = "Framework for building, deploying, and running fast, secure, and composable cloud microservices with WebAssembly.";
+    homepage = "https://github.com/fermyon/spin";
+    license = with licenses; [ asl20 ];
+    maintainers = with maintainers; [ mglolenstine ];
+    platforms = platforms.linux ++ platforms.darwin;
+  };
+}

pkgs/development/tools/misc/sccache/default.nix

@@ -1,17 +1,17 @@
 { lib, fetchFromGitHub, rustPlatform, pkg-config, openssl, stdenv, Security }:
 
 rustPlatform.buildRustPackage rec {
-  version = "0.4.2";
+  version = "0.5.0";
   pname = "sccache";
 
   src = fetchFromGitHub {
     owner = "mozilla";
     repo = "sccache";
     rev = "v${version}";
-    sha256 = "sha256-OXCR052syGpqeIHviKAqS5LEAt8epdlFFarkVdmfa0I=";
+    sha256 = "sha256-WAIF+X+kwab/my7bineBsWImnHXKne1Suw+b8VM3xUg=";
   };
 
-  cargoSha256 = "sha256-hYNnzVhw0yCqgRcRJCZusuY+g+MZn1DD5pfDTJlTv+w=";
+  cargoSha256 = "sha256-3+KxoSrZzrn/H4ZWB+jlZTMPo3EkKv/Z/gvBap1sMyg=";
 
   nativeBuildInputs = [ pkg-config ];
   buildInputs = [ openssl ] ++ lib.optional stdenv.isDarwin Security;

pkgs/development/tools/rust/rust-analyzer/default.nix

@@ -13,14 +13,14 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "rust-analyzer-unwrapped";
-  version = "2023-05-15";
-  cargoSha256 = "sha256-UnyhgSTvgfMN/jUrr9PcmwxViRnD17tXjcf/wcS75kk=";
+  version = "2023-05-22";
+  cargoSha256 = "sha256-44UNNHOegP2Q1THPnEa37etedwstQbnB2Gr3dF39ZXU=";
 
   src = fetchFromGitHub {
     owner = "rust-lang";
     repo = "rust-analyzer";
     rev = version;
-    sha256 = "sha256-epmeDLdze4RtOgS/7yQvK5ZImJ51OMBcEeLiR5aaVr0=";
+    sha256 = "sha256-xDUpgRcACQQREemfVQnft6AImqF2+dbxmHupw6gzSho=";
   };
 
   cargoBuildFlags = [ "--bin" "rust-analyzer" "--bin" "rust-analyzer-proc-macro-srv" ];

pkgs/development/tools/sem/default.nix

@@ -0,0 +1,31 @@
+{ lib, buildGoModule, fetchFromGitHub }:
+
+buildGoModule rec {
+  pname = "sem";
+  version = "0.28.1";
+
+  src = fetchFromGitHub {
+    owner = "semaphoreci";
+    repo = "cli";
+    rev = "v${version}";
+    sha256 = "sha256-pyin05mPIAq5dJebLehsCYDaIf5eGCcGzF5uz8egJV8=";
+  };
+
+  vendorSha256 = "sha256-kuLN3r6CGL/fGQ5ggSLZWNC4AVvvGn6znTFGqkS4AXg=";
+  subPackages = [ "." ];
+
+  ldflags = [ "-X main.version=${version}" "-X main.buildSource=nix" ];
+
+  postInstall = ''
+    install -m755 $out/bin/cli $out/bin/sem
+  '';
+
+  meta = with lib; {
+    description = "A cli to operate on semaphore ci (2.0)";
+    homepage = "https://github.com/semaphoreci/cli";
+    changelog = "https://github.com/semaphoreci/cli/releases/tag/v${version}";
+    license = licenses.asl20;
+    maintainers = with maintainers; [ liberatys ];
+    platforms = platforms.linux;
+  };
+}

pkgs/development/web/csslint/default.nix

@@ -1,35 +0,0 @@
-{ lib, stdenv, fetchurl, nodejs }:
-
-stdenv.mkDerivation rec {
-  version = "0.10.0";
-  pname = "csslint";
-
-  src = fetchurl {
-    url = "https://registry.npmjs.org/csslint/-/${pname}-${version}.tgz";
-    sha256 = "1gq2x0pf2p4jhccvn3y3kjhm1lmb4jsfdbzjdh924w8m3sr9jdid";
-  };
-
-  # node is the interpreter used to run this script
-  buildInputs = [ nodejs ];
-
-  installPhase = ''
-    sed -i "s/path\.join/path\.resolve/g" cli.js # fixes csslint issue #167
-    mkdir -p $out/bin;
-    cp -r * $out/bin
-    mv $out/bin/cli.js $out/bin/csslint
-  '';
-
-  meta = with lib; {
-    description = "Checks CSS for syntax errors and other problems";
-    longDescription = ''
-      CSSLint is a tool to help point out problems with your CSS
-      code. It does basic syntax checking as well as applying a set of
-      rules to the code that look for problematic patterns or signs of
-      inefficiency. The rules are all pluggable, so you can easily
-      write your own or omit ones you don't want. '';
-    homepage = "https://nodejs.org";
-    license = licenses.bsd2;
-    maintainers = [ maintainers.goibhniu ];
-    platforms = platforms.linux;
-  };
-}

pkgs/servers/matrix-synapse/default.nix

@@ -12,20 +12,20 @@ in
 with python3.pkgs;
 buildPythonApplication rec {
   pname = "matrix-synapse";
-  version = "1.83.0";
+  version = "1.84.0";
   format = "pyproject";
 
   src = fetchFromGitHub {
     owner = "matrix-org";
     repo = "synapse";
     rev = "v${version}";
-    hash = "sha256-7LMNLXTBkY7ib9DWpwccVrHxulUW8ScFr37hSGO72GM=";
+    hash = "sha256-CN/TCyQLlGRNDvsojGltP+GQ4UJiWQZkgQinD/w9Lfc=";
   };
 
   cargoDeps = rustPlatform.fetchCargoTarball {
     inherit src;
     name = "${pname}-${version}";
-    hash = "sha256-tzkJtkAbZ9HmOQq2O7QAbRb5pYS/WoU3k1BJhZAE6OU=";
+    hash = "sha256-MikdIo1YghDAvpVX2vUHFmz8WgupUi/TbMPIvYgGFRA=";
   };
 
   postPatch = ''

pkgs/servers/web-apps/outline/default.nix

@@ -5,24 +5,25 @@
 , nodejs
 , yarn
 , yarn2nix-moretea
+, nixosTests
 }:
 
 stdenv.mkDerivation rec {
   pname = "outline";
-  version = "0.68.1";
+  version = "0.69.2";
 
   src = fetchFromGitHub {
     owner = "outline";
     repo = "outline";
     rev = "v${version}";
-    sha256 = "sha256-pln3cdozZPEodfXeUtTbBvhHb5yqE4uu0VKA95Zv6ro=";
+    hash = "sha256-XevrCUvPmAbPTysJ/o7i2xAZTQ+UFYtVal/aZKvt+Ls=";
   };
 
   nativeBuildInputs = [ makeWrapper yarn2nix-moretea.fixup_yarn_lock ];
   buildInputs = [ yarn nodejs ];
 
-  # Replace the inline call to yarn with our sequalize wrapper. This should be
-  # the only occurrence:
+  # Replace the inline calls to yarn with our sequalize wrapper. These should be
+  # the two occurrences:
   # https://github.com/outline/outline/search?l=TypeScript&q=yarn
   patches = [ ./sequelize-command.patch ];
 
@@ -43,12 +44,10 @@ stdenv.mkDerivation rec {
       --frozen-lockfile \
       --ignore-engines --ignore-scripts
     patchShebangs node_modules/
+    # apply upstream patches with `patch-package`
+    yarn run postinstall
     yarn build
 
-    pushd server
-    cp -r config migrations onboarding ../build/server/
-    popd
-
     runHook postBuild
   '';
 
@@ -56,16 +55,11 @@ stdenv.mkDerivation rec {
     runHook preInstall
 
     mkdir -p $out/bin $out/share/outline
-    mv public node_modules build $out/share/outline/
+    mv build server public node_modules $out/share/outline/
 
     node_modules=$out/share/outline/node_modules
     build=$out/share/outline/build
-
-    # On NixOS the WorkingDirectory is set to the build directory, as
-    # this contains files needed in the onboarding process. This folder
-    # must also contain the `public` folder for mail notifications to
-    # work, as it contains the mail templates.
-    ln -s $out/share/outline/public $build/public
+    server=$out/share/outline/server
 
     makeWrapper ${nodejs}/bin/node $out/bin/outline-server \
       --add-flags $build/server/index.js \
@@ -74,21 +68,25 @@ stdenv.mkDerivation rec {
 
     makeWrapper ${nodejs}/bin/node $out/bin/outline-sequelize \
       --add-flags $node_modules/.bin/sequelize \
-      --add-flags "--migrations-path $build/server/migrations" \
-      --add-flags "--models-path $build/server/models" \
-      --add-flags "--seeders-path $build/server/models/fixtures" \
+      --add-flags "--migrations-path $server/migrations" \
+      --add-flags "--models-path $server/models" \
+      --add-flags "--seeders-path $server/models/fixtures" \
       --set NODE_ENV production \
       --set NODE_PATH $node_modules
 
     runHook postInstall
   '';
 
+  passthru.tests = {
+    basic-functionality = nixosTests.outline;
+  };
+
   meta = with lib; {
     description = "The fastest wiki and knowledge base for growing teams. Beautiful, feature rich, and markdown compatible";
     homepage = "https://www.getoutline.com/";
     changelog = "https://github.com/outline/outline/releases";
     license = licenses.bsl11;
-    maintainers = with maintainers; [ cab404 yrd ];
+    maintainers = with maintainers; [ cab404 yrd xanderio ];
     platforms = platforms.linux;
   };
 }

pkgs/servers/web-apps/outline/sequelize-command.patch

@@ -1,15 +1,22 @@
 diff --git a/server/utils/startup.ts b/server/utils/startup.ts
-index 7554b854..6641f805 100644
+index 444de475..b883f71a 100644
 --- a/server/utils/startup.ts
 +++ b/server/utils/startup.ts
-@@ -8,9 +8,7 @@ import Team from "@server/models/Team";
- export function checkPendingMigrations() {
-   try {
-     const commandResult = execSync(
--      `yarn sequelize db:migrate:status${
--        env.PGSSLMODE === "disable" ? " --env=production-ssl-disabled" : ""
--      }`
-+      "outline-sequelize db:migrate:status"
-     );
-     const commandResultArray = Buffer.from(commandResult)
-       .toString("utf-8")
+@@ -8,7 +8,7 @@ import Team from "@server/models/Team";
+ 
+ function getPendingMigrations() {
+   const commandResult = execSync(
+-    `yarn sequelize db:migrate:status${
++    `outline-sequelize db:migrate:status${
+       env.PGSSLMODE === "disable" ? " --env=production-ssl-disabled" : ""
+     }`
+   );
+@@ -26,7 +26,7 @@ function getPendingMigrations() {
+ function runMigrations() {
+   Logger.info("database", "Running migrations...");
+   const cmdResult = execSync(
+-    `yarn db:migrate${
++    `outline-sequelize db:migrate${
+       env.PGSSLMODE === "disable" ? " --env=production-ssl-disabled" : ""
+     }`
+   );

pkgs/tools/filesystems/xfsprogs/default.nix

@@ -5,11 +5,11 @@
 
 stdenv.mkDerivation rec {
   pname = "xfsprogs";
-  version = "6.2.0";
+  version = "6.3.0";
 
   src = fetchurl {
     url = "mirror://kernel/linux/utils/fs/xfs/xfsprogs/${pname}-${version}.tar.xz";
-    hash = "sha256-1n3LpaKOCQS2CIa25fdSvHycOlxwlhU4VbWtyp24bFE=";
+    hash = "sha256-7Jh8nwvLLbKZG/+4DTUxULOJw6K3m2gwQR9wQq32mQw=";
   };
 
   outputs = [ "bin" "dev" "out" "doc" ];

pkgs/tools/misc/blahaj/default.nix

@@ -5,13 +5,13 @@
 
 crystal.buildCrystalPackage rec {
   pname = "blahaj";
-  version = "2.0.1";
+  version = "2.0.2";
 
   src = fetchFromGitHub {
     owner = "GeopJr";
     repo = "BLAHAJ";
     rev = "v${version}";
-    hash = "sha256-g38a3mUt2bkwFH/Mwr2D3zEZczM/gdWObUOeeIJGHZ4=";
+    hash = "sha256-drdC507lIYanHS7fneW9Xwqmyr6f1oGF1+xeYQ2DzKA=";
   };
 
   meta = with lib; {

pkgs/tools/misc/direnv/default.nix

@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "direnv";
-  version = "2.32.2";
+  version = "2.32.3";
 
   src = fetchFromGitHub {
     owner = "direnv";
     repo = "direnv";
     rev = "v${version}";
-    sha256 = "sha256-Ql/Q9SoCNy2JKt/32RIMx08rbGvrthdgTpFIFx4m1p4=";
+    sha256 = "sha256-TDr2eL7Jft1r2IMm6CToVCEhiNo+Rj1H/Skoe+wx1MM=";
   };
 
   vendorSha256 = "sha256-eQaQ77pOYC8q+IA26ArEhHQ0DCU093TbzaYhdV3UydE=";

pkgs/top-level/all-packages.nix

@@ -7619,6 +7619,8 @@ with pkgs;
 
   feedgnuplot = callPackage ../tools/graphics/feedgnuplot { };
 
+  fermyon-spin = callPackage ../development/tools/fermyon-spin { };
+
   fbcat = callPackage ../tools/misc/fbcat { };
 
   fbv = callPackage ../tools/graphics/fbv { };
@@ -18166,7 +18168,7 @@ with pkgs;
 
   csmith = callPackage ../development/tools/misc/csmith { };
 
-  csslint = callPackage ../development/web/csslint { };
+  inherit (nodePackages) csslint;
 
   css-html-js-minify = with python3Packages; toPythonApplication css-html-js-minify;
 
@@ -19170,6 +19172,8 @@ with pkgs;
 
   selendroid = callPackage ../development/tools/selenium/selendroid { };
 
+  sem = callPackage ../development/tools/sem { };
+
   semver-tool = callPackage ../development/tools/misc/semver-tool { };
 
   semantik = libsForQt5.callPackage ../applications/office/semantik { };
@@ -25700,7 +25704,7 @@ with pkgs;
   outline = callPackage ../servers/web-apps/outline (lib.fix (super: {
     yarn2nix-moretea = yarn2nix-moretea.override { inherit (super) nodejs yarn; };
     yarn = yarn.override { inherit (super) nodejs; };
-    nodejs = nodejs_16;
+    nodejs = nodejs_18;
   }));
 
   openbgpd = callPackage ../servers/openbgpd { };
@@ -29449,7 +29453,7 @@ with pkgs;
   berry = callPackage ../applications/window-managers/berry { };
 
   bespokesynth = callPackage ../applications/audio/bespokesynth {
-    inherit (darwin.apple_sdk.frameworks) Cocoa WebKit CoreServices CoreAudioKit;
+    inherit (darwin.apple_sdk.frameworks) Accelerate Cocoa WebKit CoreServices CoreAudioKit IOBluetooth;
   };
 
   bespokesynth-with-vst2 = bespokesynth.override {
@@ -30028,7 +30032,7 @@ with pkgs;
   denemo = callPackage ../applications/audio/denemo { };
 
   dexed = darwin.apple_sdk_11_0.callPackage ../applications/audio/dexed {
-    inherit (darwin.apple_sdk_11_0.frameworks) Cocoa WebKit MetalKit DiscRecording CoreAudioKit;
+    inherit (darwin.apple_sdk_11_0.frameworks) Accelerate Cocoa WebKit MetalKit DiscRecording CoreAudioKit;
     inherit (darwin.apple_sdk_11_0.libs) simd;
   };
 
@@ -30666,7 +30670,7 @@ with pkgs;
   filezilla = callPackage ../applications/networking/ftp/filezilla { };
 
   fire = darwin.apple_sdk_11_0.callPackage ../applications/audio/fire {
-    inherit (darwin.apple_sdk_11_0.frameworks) Cocoa WebKit CoreServices DiscRecording CoreAudioKit MetalKit;
+    inherit (darwin.apple_sdk_11_0.frameworks) Accelerate Cocoa WebKit CoreServices DiscRecording CoreAudioKit MetalKit;
     inherit (darwin.apple_sdk_11_0.libs) simd;
   };