Merge master into haskell-updates

.github/CODEOWNERS

@@ -232,10 +232,12 @@ pkgs/development/python-modules/buildcatrust/ @ajs124 @lukegb @mweinelt
 /nixos/modules/services/networking/babeld.nix @mweinelt
 /nixos/modules/services/networking/kea.nix @mweinelt
 /nixos/modules/services/networking/knot.nix @mweinelt
+nixos/modules/services/networking/networkmanager.nix @Janik-Haag
 /nixos/modules/services/monitoring/prometheus/exporters/kea.nix @mweinelt
 /nixos/tests/babeld.nix @mweinelt
 /nixos/tests/kea.nix @mweinelt
 /nixos/tests/knot.nix @mweinelt
+/nixos/tests/networking/* @Janik-Haag
 
 # Web servers
 /doc/packages/nginx.section.md @raitobezarius

maintainers/maintainer-list.nix

@@ -2726,6 +2726,12 @@
     github = "bmwalters";
     githubId = 4380777;
   };
+  bnlrnz = {
+    github = "bnlrnz";
+    githubId = 11310385;
+    name = "Ben Lorenz";
+    email = "bnlrnz@gmail.com";
+  };
   bobakker = {
     email = "bobakk3r@gmail.com";
     github = "bobakker";
@@ -8432,6 +8438,12 @@
     github = "Icy-Thought";
     githubId = 53710398;
   };
+  id3v1669 = {
+    name = "id3v1669";
+    email = "id3v1669@gmail.com";
+    github = "id3v1669";
+    githubId = 57532211;
+  };
   idlip = {
     name = "Dilip";
     email = "igoldlip@gmail.com";
@@ -14755,6 +14767,12 @@
     githubId = 16027994;
     name = "Nathan Viets";
   };
+  nyadiia = {
+    email = "nyadiia@pm.me";
+    github = "nyadiia";
+    githubId = 43252360;
+    name = "Nadia";
+  };
   nyanbinary = {
     email = "nyanbinary@keemail.me";
     matrix = "@niko:conduit.rs";
@@ -17336,6 +17354,11 @@
     githubId = 19433256;
     name = "Radoslaw Sniezek";
   };
+  rster2002 = {
+    name = "Bjørn";
+    github = "rster2002";
+    githubId = 26026518;
+  };
   rsynnest = {
     email = "contact@rsynnest.com";
     github = "rsynnest";
@@ -19494,6 +19517,12 @@
       fingerprint = "6866 981C 4992 4D64 D154  E1AC 19E5 A2D8 B1E4 3F19";
     }];
   };
+  t4sm5n = {
+    email = "t4sm5n@gmail.com";
+    github = "t4sm5n";
+    githubId = 28858039;
+    name = "Tuomas Mäkinen";
+  };
   tadeokondrak = {
     email = "me@tadeo.ca";
     github = "tadeokondrak";

maintainers/team-list.nix

@@ -518,6 +518,7 @@ with lib.maintainers; {
       cpages
       dschrempf
       edwtjo
+      kazenyuk
       minijackson
       peterhoeg
       sephalon

nixos/doc/manual/release-notes/rl-2405.section.md

@@ -189,7 +189,7 @@ The pre-existing [services.ankisyncd](#opt-services.ankisyncd.enable) has been m
 
 - `k3s`: was updated to version [v1.29](https://github.com/k3s-io/k3s/releases/tag/v1.29.1%2Bk3s2), all previous versions (k3s_1_26, k3s_1_27, k3s_1_28) will be removed. See [changelog and upgrade notes](https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.29.md#urgent-upgrade-notes) for more information.
 
-- `himalaya` was updated to `v1.0.0-beta.3`, which introduces breaking changes. Check out the [release note](https://github.com/soywod/himalaya/releases/tag/v1.0.0-beta.3) for details.
+- `himalaya` was updated to `v1.0.0-beta.4`, which introduces breaking changes. Check out the [release note](https://github.com/soywod/himalaya/releases/tag/v1.0.0-beta.4) for details.
 
 - The `power.ups` module now generates `upsd.conf`, `upsd.users` and `upsmon.conf` automatically from a set of new configuration options. This breaks compatibility with existing `power.ups` setups where these files were created manually. Back up these files before upgrading NixOS.
 
@@ -573,6 +573,8 @@ The pre-existing [services.ankisyncd](#opt-services.ankisyncd.enable) has been m
   and `services.kavita.settings.IpAddresses`. The file at `services.kavita.tokenKeyFile` now needs to contain a secret with
   512+ bits instead of 128+ bits.
 
+- `kavita` has been updated to 0.8.0, requiring a manual forced library scan on all libraries for migration. Refer to upstream's [release notes](https://github.com/Kareadita/Kavita/releases/tag/v0.8.0) for details.
+
 - The `krb5` module has been rewritten and moved to `security.krb5`, moving all options but `security.krb5.enable` and `security.krb5.package` into `security.krb5.settings`.
 
 - `services.soju` now has a wrapper for the `sojuctl` command, pointed at the service config file. It also has the new option `adminSocket.enable`, which creates a unix admin socket at `/run/soju/admin`.
@@ -587,6 +589,8 @@ The pre-existing [services.ankisyncd](#opt-services.ankisyncd.enable) has been m
 
 - The `hardware.pulseaudio` module now sets permission of pulse user home directory to 755 when running in "systemWide" mode. It fixes [issue 114399](https://github.com/NixOS/nixpkgs/issues/114399).
 
+- The `services.networkmanager.extraConfig` was renamed to `services.networkmanager.settings` and was changed to use the ini type instead of using a multiline string.
+
 - The module `services.github-runner` has been removed. To configure a single GitHub Actions Runner refer to `services.github-runners.*`. Note that this will trigger a new runner registration.
 
 - The `services.slskd` has been refactored to include more configuation options in

nixos/modules/module-list.nix

@@ -1166,6 +1166,7 @@
   ./services/networking/syncthing-relay.nix
   ./services/networking/syncthing.nix
   ./services/networking/tailscale.nix
+  ./services/networking/tailscale-auth.nix
   ./services/networking/tayga.nix
   ./services/networking/tcpcrypt.nix
   ./services/networking/teamspeak3.nix

nixos/modules/programs/tsm-client.nix

@@ -22,7 +22,7 @@ let
   serverOptions = { name, config, ... }: {
     freeformType = attrsOf (either scalarType (listOf scalarType));
     # Client system-options file directives are explained here:
-    # https://www.ibm.com/docs/en/storage-protect/8.1.21?topic=commands-processing-options
+    # https://www.ibm.com/docs/en/storage-protect/8.1.22?topic=commands-processing-options
     options.servername = mkOption {
       type = servernameType;
       default = name;

nixos/modules/services/backup/tsm.nix

@@ -90,7 +90,7 @@ in
       environment.HOME = "/var/lib/tsm-backup";
       serviceConfig = {
         # for exit status description see
-        # https://www.ibm.com/docs/en/storage-protect/8.1.21?topic=clients-client-return-codes
+        # https://www.ibm.com/docs/en/storage-protect/8.1.22?topic=clients-client-return-codes
         SuccessExitStatus = "4 8";
         # The `-se` option must come after the command.
         # The `-optfile` option suppresses a `dsm.opt`-not-found warning.

nixos/modules/services/desktop-managers/lomiri.nix

@@ -38,6 +38,8 @@ in {
       ]);
     };
 
+    networking.networkmanager.enable = lib.mkDefault true;
+
     systemd.packages = with pkgs.lomiri; [
       hfd-service
       lomiri-download-manager
@@ -73,6 +75,8 @@ in {
         ayatana-indicator-session
       ]) ++ (with pkgs.lomiri; [
         telephony-service
+      ] ++ lib.optionals config.networking.networkmanager.enable [
+        lomiri-indicator-network
       ]);
     };
 
@@ -111,6 +115,8 @@ in {
       "/share/lomiri-app-launch"
       # TODO Try to get maliit stuff working
       "/share/maliit/plugins"
+      # At least the network indicator is still under the unity name, due to leftover Unity-isms
+      "/share/unity"
       # Data
       "/share/locale" # TODO LUITK hardcoded default locale path, fix individual apps to not rely on it
       "/share/sounds"

nixos/modules/services/misc/docker-registry.nix

@@ -41,8 +41,7 @@ let
     };
   };
 
-  configFile = pkgs.writeText "docker-registry-config.yml" (builtins.toJSON (recursiveUpdate registryConfig cfg.extraConfig));
+  configFile = cfg.configFile;
-
 in {
   options.services.dockerRegistry = {
     enable = mkEnableOption "Docker Registry";
@@ -106,6 +105,17 @@ in {
       type = types.attrs;
     };
 
+    configFile = lib.mkOption {
+      default = pkgs.writeText "docker-registry-config.yml" (builtins.toJSON (recursiveUpdate registryConfig cfg.extraConfig));
+      defaultText = literalExpression ''pkgs.writeText "docker-registry-config.yml" "# my custom docker-registry-config.yml ..."'';
+      description = ''
+       Path to CNCF distribution config file.
+
+       Setting this option will override any configuration applied by the extraConfig option.
+      '';
+      type =  types.path;
+    };
+
     enableGarbageCollect = mkEnableOption "garbage collect";
 
     garbageCollectDates = mkOption {

nixos/modules/services/networking/dnscrypt-proxy2.nix

@@ -49,12 +49,12 @@ in
         passAsFile = [ "json" ];
       } ''
         ${if cfg.upstreamDefaults then ''
-          ${pkgs.remarshal}/bin/toml2json ${pkgs.dnscrypt-proxy.src}/dnscrypt-proxy/example-dnscrypt-proxy.toml > example.json
+          ${pkgs.buildPackages.remarshal}/bin/toml2json ${pkgs.dnscrypt-proxy.src}/dnscrypt-proxy/example-dnscrypt-proxy.toml > example.json
-          ${pkgs.jq}/bin/jq --slurp add example.json $jsonPath > config.json # merges the two
+          ${pkgs.buildPackages.jq}/bin/jq --slurp add example.json $jsonPath > config.json # merges the two
         '' else ''
           cp $jsonPath config.json
         ''}
-        ${pkgs.remarshal}/bin/json2toml < config.json > $out
+        ${pkgs.buildPackages.remarshal}/bin/json2toml < config.json > $out
       '';
       defaultText = literalMD "TOML file generated from {option}`services.dnscrypt-proxy2.settings`";
     };

nixos/modules/services/networking/networkmanager.nix

@@ -10,49 +10,31 @@ let
 
   enableIwd = cfg.wifi.backend == "iwd";
 
-  mkValue = v:
+  configAttrs = lib.recursiveUpdate {
-    if v == true then "yes"
+    main = {
-    else if v == false then "no"
-    else if lib.isInt v then toString v
-    else v;
-
-  mkSection = name: attrs: ''
-    [${name}]
-    ${
-      lib.concatStringsSep "\n"
-        (lib.mapAttrsToList
-          (k: v: "${k}=${mkValue v}")
-          (lib.filterAttrs
-            (k: v: v != null)
-            attrs))
-    }
-  '';
-
-  configFile = pkgs.writeText "NetworkManager.conf" (lib.concatStringsSep "\n" [
-    (mkSection "main" {
       plugins = "keyfile";
       inherit (cfg) dhcp dns;
       # If resolvconf is disabled that means that resolv.conf is managed by some other module.
       rc-manager =
         if config.networking.resolvconf.enable then "resolvconf"
         else "unmanaged";
-    })
+    };
-    (mkSection "keyfile" {
+    keyfile = {
       unmanaged-devices =
-        if cfg.unmanaged == [ ] then null
+      if cfg.unmanaged == [ ] then null
-        else lib.concatStringsSep ";" cfg.unmanaged;
+      else lib.concatStringsSep ";" cfg.unmanaged;
-    })
+    };
-    (mkSection "logging" {
+    logging = {
       audit = config.security.audit.enable;
       level = cfg.logLevel;
-    })
+    };
-    (mkSection "connection" cfg.connectionConfig)
+    connection = cfg.connectionConfig;
-    (mkSection "device" {
+    device = {
-      "wifi.scan-rand-mac-address" = cfg.wifi.scanRandMacAddress;
+        "wifi.scan-rand-mac-address" = cfg.wifi.scanRandMacAddress;
-      "wifi.backend" = cfg.wifi.backend;
+        "wifi.backend" = cfg.wifi.backend;
-    })
+    };
-    cfg.extraConfig
+  } cfg.settings;
-  ]);
+  configFile = ini.generate "NetworkManager.conf" configAttrs;
 
   /*
     [network-manager]
@@ -145,7 +127,7 @@ in
 {
 
   meta = {
-    maintainers = teams.freedesktop.members;
+    maintainers = teams.freedesktop.members ++ [ lib.maintainers.janik ];
   };
 
   ###### interface
@@ -185,11 +167,11 @@ in
         '';
       };
 
-      extraConfig = mkOption {
+      settings = mkOption {
-        type = types.lines;
+        type = ini.type;
-        default = "";
+        default = {};
         description = ''
-          Configuration appended to the generated NetworkManager.conf.
+          Configuration added to the generated NetworkManager.conf, note that you can overwrite settings with this.
           Refer to
           [
             https://developer.gnome.org/NetworkManager/stable/NetworkManager.conf.html
@@ -471,8 +453,28 @@ in
   imports = [
     (mkRenamedOptionModule
       [ "networking" "networkmanager" "packages" ]
-      [ "networking" "networkmanager" "plugins" ])
+      [ "networking" "networkmanager" "plugins" ]
-    (mkRenamedOptionModule [ "networking" "networkmanager" "useDnsmasq" ] [ "networking" "networkmanager" "dns" ])
+    )
+    (mkRenamedOptionModule
+      [ "networking" "networkmanager" "useDnsmasq" ]
+      [ "networking" "networkmanager" "dns" ]
+    )
+    (mkRemovedOptionModule [ "networking" "networkmanager" "extraConfig" ] ''
+      This option was removed in favour of `networking.networkmanager.settings`,
+      which accepts structured nix-code equivalent to the ini
+      and allows for overriding settings.
+      Example patch:
+      ```patch
+         networking.networkmanager = {
+      -    extraConfig = '''
+      -      [main]
+      -      no-auto-default=*
+      -    '''
+      +    extraConfig.main.no-auto-default = "*";
+         };
+      ```
+    ''
+    )
     (mkRemovedOptionModule [ "networking" "networkmanager" "enableFccUnlock" ] ''
       This option was removed, because using bundled FCC unlock scripts is risky,
       might conflict with vendor-provided unlock scripts, and should

nixos/modules/services/networking/tailscale-auth.nix

@@ -0,0 +1,104 @@
+{ config, lib, pkgs, ... }:
+
+let
+  inherit (lib)
+    getExe
+    maintainers
+    mkEnableOption
+    mkPackageOption
+    mkIf
+    mkOption
+    types
+    ;
+  cfg = config.services.tailscaleAuth;
+in
+{
+  options.services.tailscaleAuth = {
+    enable = mkEnableOption "Enable tailscale.nginx-auth, to authenticate users via tailscale.";
+
+    package = mkPackageOption pkgs "tailscale-nginx-auth" {};
+
+    user = mkOption {
+      type = types.str;
+      default = "tailscale-nginx-auth";
+      description = "User which runs tailscale-nginx-auth";
+    };
+
+    group = mkOption {
+      type = types.str;
+      default = "tailscale-nginx-auth";
+      description = "Group which runs tailscale-nginx-auth";
+    };
+
+    socketPath = mkOption {
+      default = "/run/tailscale-nginx-auth/tailscale-nginx-auth.sock";
+      type = types.path;
+      description = ''
+        Path of the socket listening to authorization requests.
+      '';
+    };
+  };
+
+  config = mkIf cfg.enable {
+    services.tailscale.enable = true;
+
+    users.users.${cfg.user} = {
+      isSystemUser = true;
+      inherit (cfg) group;
+    };
+    users.groups.${cfg.group} = { };
+
+    systemd.sockets.tailscale-nginx-auth = {
+      description = "Tailscale NGINX Authentication socket";
+      partOf = [ "tailscale-nginx-auth.service" ];
+      wantedBy = [ "sockets.target" ];
+      listenStreams = [ cfg.socketPath ];
+      socketConfig = {
+        SocketMode = "0660";
+        SocketUser = cfg.user;
+        SocketGroup = cfg.group;
+      };
+    };
+
+    systemd.services.tailscale-nginx-auth = {
+      description = "Tailscale NGINX Authentication service";
+      requires = [ "tailscale-nginx-auth.socket" ];
+
+      serviceConfig = {
+        ExecStart = getExe cfg.package;
+        RuntimeDirectory = "tailscale-nginx-auth";
+        User = cfg.user;
+        Group = cfg.group;
+
+        BindPaths = [ "/run/tailscale/tailscaled.sock" ];
+
+        CapabilityBoundingSet = "";
+        DeviceAllow = "";
+        LockPersonality = true;
+        MemoryDenyWriteExecute = true;
+        PrivateDevices = true;
+        PrivateUsers = true;
+        ProtectClock = true;
+        ProtectControlGroups = true;
+        ProtectHome = true;
+        ProtectHostname = true;
+        ProtectKernelLogs = true;
+        ProtectKernelModules = true;
+        ProtectKernelTunables = true;
+        RestrictNamespaces = true;
+        RestrictAddressFamilies = [ "AF_UNIX" ];
+        RestrictRealtime = true;
+        RestrictSUIDSGID = true;
+
+        SystemCallArchitectures = "native";
+        SystemCallErrorNumber = "EPERM";
+        SystemCallFilter = [
+          "@system-service"
+          "~@cpu-emulation" "~@debug" "~@keyring" "~@memlock" "~@obsolete" "~@privileged" "~@setuid"
+        ];
+      };
+    };
+  };
+
+  meta.maintainers = with maintainers; [ dan-theriault phaer ];
+}

nixos/modules/services/security/oauth2_proxy_nginx.nix

@@ -28,7 +28,8 @@ in
       type = types.listOf types.str;
       default = [];
       description = ''
-        A list of nginx virtual hosts to put behind the oauth2 proxy
+        A list of nginx virtual hosts to put behind the oauth2 proxy.
+        You can exclude specific locations by setting `auth_request off;` in the locations extraConfig setting.
       '';
     };
   };
@@ -50,18 +51,27 @@ in
   ] ++ optional (cfg.virtualHosts != []) {
     recommendedProxySettings = true; # needed because duplicate headers
   } ++ (map (vhost: {
-    virtualHosts.${vhost}.locations = {
+    virtualHosts.${vhost} = {
-      "/oauth2/auth" = {
+      locations = {
-        proxyPass = cfg.proxy;
+        "/oauth2/auth" = {
-        extraConfig = ''
+          proxyPass = cfg.proxy;
-          proxy_set_header X-Scheme         $scheme;
+          extraConfig = ''
-          # nginx auth_request includes headers but not body
+            auth_request off;
-          proxy_set_header Content-Length   "";
+            proxy_set_header X-Scheme         $scheme;
-          proxy_pass_request_body           off;
+            # nginx auth_request includes headers but not body
-        '';
+            proxy_set_header Content-Length   "";
+            proxy_pass_request_body           off;
+          '';
+        };
+        "@redirectToAuth2ProxyLogin" = {
+          return = "307 https://${cfg.domain}/oauth2/start?rd=$scheme://$host$request_uri";
+          extraConfig = ''
+            auth_request off;
+          '';
+        };
       };
-      "@redirectToAuth2ProxyLogin".return = "307 https://${cfg.domain}/oauth2/start?rd=$scheme://$host$request_uri";
+
-      "/".extraConfig = ''
+      extraConfig = ''
         auth_request /oauth2/auth;
         error_page 401 = @redirectToAuth2ProxyLogin;
 

nixos/modules/services/web-servers/nginx/tailscale-auth.nix

@@ -1,28 +1,29 @@
 { config, lib, pkgs, ... }:
 
-with lib;
-
 let
+  inherit (lib)
+    genAttrs
+    maintainers
+    mkAliasOptionModule
+    mkEnableOption
+    mkIf
+    mkOption
+    types
+    ;
   cfg = config.services.nginx.tailscaleAuth;
+  cfgAuth = config.services.tailscaleAuth;
 in
 {
+  imports = [
+    (mkAliasOptionModule [ "services" "nginx" "tailscaleAuth" "package" ] [ "services" "tailscaleAuth" "package" ])
+    (mkAliasOptionModule [ "services" "nginx" "tailscaleAuth" "user" ] [ "services" "tailscaleAuth" "user" ])
+    (mkAliasOptionModule [ "services" "nginx" "tailscaleAuth" "group" ] [ "services" "tailscaleAuth" "group" ])
+    (mkAliasOptionModule [ "services" "nginx" "tailscaleAuth" "socketPath" ] [ "services" "tailscaleAuth" "socketPath" ])
+  ];
+
   options.services.nginx.tailscaleAuth = {
     enable = mkEnableOption "Enable tailscale.nginx-auth, to authenticate nginx users via tailscale.";
 
-    package = lib.mkPackageOptionMD pkgs "tailscale-nginx-auth" {};
-
-    user = mkOption {
-      type = types.str;
-      default = "tailscale-nginx-auth";
-      description = "User which runs tailscale-nginx-auth";
-    };
-
-    group = mkOption {
-      type = types.str;
-      default = "tailscale-nginx-auth";
-      description = "Group which runs tailscale-nginx-auth";
-    };
-
     expectedTailnet = mkOption {
       default = "";
       type = types.nullOr types.str;
@@ -33,14 +34,6 @@ in
       '';
     };
 
-    socketPath = mkOption {
-      default = "/run/tailscale-nginx-auth/tailscale-nginx-auth.sock";
-      type = types.path;
-      description = ''
-        Path of the socket listening to nginx authorization requests.
-      '';
-    };
-
     virtualHosts = mkOption {
       type = types.listOf types.str;
       default = [];
@@ -51,67 +44,14 @@ in
   };
 
   config = mkIf cfg.enable {
-    services.tailscale.enable = true;
+    services.tailscaleAuth.enable = true;
     services.nginx.enable = true;
 
-    users.users.${cfg.user} = {
+    users.users.${config.services.nginx.user}.extraGroups = [ cfgAuth.group ];
-      isSystemUser = true;
-      inherit (cfg) group;
-    };
-    users.groups.${cfg.group} = { };
-    users.users.${config.services.nginx.user}.extraGroups = [ cfg.group ];
-    systemd.sockets.tailscale-nginx-auth = {
-      description = "Tailscale NGINX Authentication socket";
-      partOf = [ "tailscale-nginx-auth.service" ];
-      wantedBy = [ "sockets.target" ];
-      listenStreams = [ cfg.socketPath ];
-      socketConfig = {
-        SocketMode = "0660";
-        SocketUser = cfg.user;
-        SocketGroup = cfg.group;
-      };
-    };
-
 
     systemd.services.tailscale-nginx-auth = {
-      description = "Tailscale NGINX Authentication service";
       after = [ "nginx.service" ];
       wants = [ "nginx.service" ];
-      requires = [ "tailscale-nginx-auth.socket" ];
-
-      serviceConfig = {
-        ExecStart = "${lib.getExe cfg.package}";
-        RuntimeDirectory = "tailscale-nginx-auth";
-        User = cfg.user;
-        Group = cfg.group;
-
-        BindPaths = [ "/run/tailscale/tailscaled.sock" ];
-
-        CapabilityBoundingSet = "";
-        DeviceAllow = "";
-        LockPersonality = true;
-        MemoryDenyWriteExecute = true;
-        PrivateDevices = true;
-        PrivateUsers = true;
-        ProtectClock = true;
-        ProtectControlGroups = true;
-        ProtectHome = true;
-        ProtectHostname = true;
-        ProtectKernelLogs = true;
-        ProtectKernelModules = true;
-        ProtectKernelTunables = true;
-        RestrictNamespaces = true;
-        RestrictAddressFamilies = [ "AF_UNIX" ];
-        RestrictRealtime = true;
-        RestrictSUIDSGID = true;
-
-        SystemCallArchitectures = "native";
-        SystemCallErrorNumber = "EPERM";
-        SystemCallFilter = [
-          "@system-service"
-          "~@cpu-emulation" "~@debug" "~@keyring" "~@memlock" "~@obsolete" "~@privileged" "~@setuid"
-        ];
-      };
     };
 
     services.nginx.virtualHosts = genAttrs
@@ -121,7 +61,7 @@ in
           extraConfig = ''
             internal;
 
-            proxy_pass http://unix:${cfg.socketPath};
+            proxy_pass http://unix:${cfgAuth.socketPath};
             proxy_pass_request_body off;
 
             # Upstream uses $http_host here, but we are using gixy to check nginx configurations

nixos/modules/virtualisation/lxd-virtual-machine.nix

@@ -45,6 +45,10 @@ in {
 
     boot.kernelParams = ["console=tty1" "console=${serialDevice}"];
 
+    services.udev.extraRules = ''
+      SUBSYSTEM=="cpu", CONST{arch}=="x86-64", TEST=="online", ATTR{online}=="0", ATTR{online}="1"
+    '';
+
     virtualisation.lxd.agent.enable = lib.mkDefault true;
   };
 }

nixos/tests/all-tests.nix

@@ -599,6 +599,7 @@ in {
   netdata = handleTest ./netdata.nix {};
   networking.scripted = handleTest ./networking/networkd-and-scripted.nix { networkd = false; };
   networking.networkd = handleTest ./networking/networkd-and-scripted.nix { networkd = true; };
+  networking.networkmanager = handleTest ./networking/networkmanager.nix {};
   netbox_3_6 = handleTest ./web-apps/netbox.nix { netbox = pkgs.netbox_3_6; };
   netbox_3_7 = handleTest ./web-apps/netbox.nix { netbox = pkgs.netbox_3_7; };
   netbox-upgrade = handleTest ./web-apps/netbox-upgrade.nix {};

nixos/tests/docker-registry.nix

@@ -3,7 +3,7 @@
 import ./make-test-python.nix ({ pkgs, ...} : {
   name = "docker-registry";
   meta = with pkgs.lib.maintainers; {
-    maintainers = [ globin ironpinguin ];
+    maintainers = [ globin ironpinguin cafkafk ];
   };
 
   nodes = {

nixos/tests/incus/virtual-machine.nix

@@ -57,5 +57,14 @@ in
 
     with subtest("lxd-agent has a valid path"):
         machine.succeed("incus exec ${instance-name} -- bash -c 'true'")
+
+    with subtest("guest supports cpu hotplug"):
+        machine.succeed("incus config set ${instance-name} limits.cpu=1")
+        count = int(machine.succeed("incus exec ${instance-name} -- nproc").strip())
+        assert count == 1, f"Wrong number of CPUs reported, want: 1, got: {count}"
+
+        machine.succeed("incus config set ${instance-name} limits.cpu=2")
+        count = int(machine.succeed("incus exec ${instance-name} -- nproc").strip())
+        assert count == 2, f"Wrong number of CPUs reported, want: 2, got: {count}"
   '';
 })

nixos/tests/lomiri.nix

@@ -253,22 +253,35 @@ in {
     with subtest("ayatana indicators work"):
         open_starter()
         machine.send_chars("Indicators\n")
-        machine.wait_for_text(r"(Indicators|Client|List|datetime|session)")
+        machine.wait_for_text(r"(Indicators|Client|List|network|datetime|session)")
         machine.screenshot("indicators_open")
 
         # Element tab order within the indicator menus is not fully deterministic
         # Only check that the indicators are listed & their items load
 
+        with subtest("lomiri indicator network works"):
+            # Select indicator-network
+            machine.send_key("tab")
+            # Don't go further down, first entry
+            machine.send_key("ret")
+            machine.wait_for_text(r"(Flight|Wi-Fi)")
+            machine.screenshot("indicators_network")
+
+        machine.send_key("shift-tab")
+        machine.send_key("ret")
+        machine.wait_for_text(r"(Indicators|Client|List|network|datetime|session)")
+
         with subtest("ayatana indicator datetime works"):
             # Select ayatana-indicator-datetime
             machine.send_key("tab")
+            machine.send_key("down")
             machine.send_key("ret")
             machine.wait_for_text("Time and Date Settings")
             machine.screenshot("indicators_timedate")
 
         machine.send_key("shift-tab")
         machine.send_key("ret")
-        machine.wait_for_text(r"(Indicators|Client|List|datetime|session)")
+        machine.wait_for_text(r"(Indicators|Client|List|network|datetime|session)")
 
         with subtest("ayatana indicator session works"):
             # Select ayatana-indicator-session

nixos/tests/networking/networkmanager.nix

@@ -0,0 +1,172 @@
+{ system ? builtins.currentSystem
+, config ? {}
+, pkgs ? import ../.. { inherit system config; }
+}:
+
+with import ../../lib/testing-python.nix { inherit system pkgs; };
+
+let
+  lib = pkgs.lib;
+  # this is intended as a client test since you shouldn't use NetworkManager for a router or server
+  # so using systemd-networkd for the router vm is fine in these tests.
+  router = import ./router.nix { networkd = true; };
+  qemu-common = import ../../lib/qemu-common.nix { inherit (pkgs) lib pkgs; };
+  clientConfig = extraConfig: lib.recursiveUpdate {
+    networking.useDHCP = false;
+
+    # Make sure that only NetworkManager configures the interface
+    networking.interfaces = lib.mkForce {
+      eth1 = {};
+    };
+    networking.networkmanager = {
+      enable = true;
+      # this is needed so NM doesn't generate 'Wired Connection' profiles and instead uses the default one
+      settings.main.no-auto-default = "*";
+      ensureProfiles.profiles.default = {
+        connection = {
+          id = "default";
+          type = "ethernet";
+          interface-name = "eth1";
+          autoconnect = true;
+        };
+      };
+    };
+  } extraConfig;
+  testCases = {
+    static = {
+      name = "static";
+      nodes = {
+        inherit router;
+        client = clientConfig {
+          networking.networkmanager.ensureProfiles.profiles.default = {
+            ipv4.method = "manual";
+            ipv4.addresses = "192.168.1.42/24";
+            ipv4.gateway = "192.168.1.1";
+            ipv6.method = "manual";
+            ipv6.addresses = "fd00:1234:5678:1::42/64";
+            ipv6.gateway = "fd00:1234:5678:1::1";
+          };
+        };
+      };
+      testScript = ''
+        start_all()
+        router.systemctl("start network-online.target")
+        router.wait_for_unit("network-online.target")
+        client.wait_for_unit("NetworkManager.service")
+
+        with subtest("Wait until we have an ip address on each interface"):
+            client.wait_until_succeeds("ip addr show dev eth1 | grep -q '192.168.1'")
+            client.wait_until_succeeds("ip addr show dev eth1 | grep -q 'fd00:1234:5678:1:'")
+
+        with subtest("Test if icmp echo works"):
+            client.wait_until_succeeds("ping -c 1 192.168.3.1")
+            client.wait_until_succeeds("ping -c 1 fd00:1234:5678:3::1")
+            router.wait_until_succeeds("ping -c 1 192.168.1.42")
+            router.wait_until_succeeds("ping -c 1 fd00:1234:5678:1::42")
+      '';
+    };
+    auto = {
+      name = "auto";
+      nodes = {
+        inherit router;
+        client = clientConfig {
+          networking.networkmanager.ensureProfiles.profiles.default = {
+            ipv4.method = "auto";
+            ipv6.method = "auto";
+          };
+        };
+      };
+      testScript = ''
+        start_all()
+        router.systemctl("start network-online.target")
+        router.wait_for_unit("network-online.target")
+        client.wait_for_unit("NetworkManager.service")
+
+        with subtest("Wait until we have an ip address on each interface"):
+            client.wait_until_succeeds("ip addr show dev eth1 | grep -q '192.168.1'")
+            client.wait_until_succeeds("ip addr show dev eth1 | grep -q 'fd00:1234:5678:1:'")
+
+        with subtest("Test if icmp echo works"):
+            client.wait_until_succeeds("ping -c 1 192.168.1.1")
+            client.wait_until_succeeds("ping -c 1 fd00:1234:5678:1::1")
+            router.wait_until_succeeds("ping -c 1 192.168.1.2")
+            router.wait_until_succeeds("ping -c 1 fd00:1234:5678:1::2")
+      '';
+    };
+    dns = {
+      name = "dns";
+      nodes = {
+        inherit router;
+        dynamic = clientConfig {
+          networking.networkmanager.ensureProfiles.profiles.default = {
+            ipv4.method = "auto";
+          };
+        };
+        static = clientConfig {
+          networking.networkmanager.ensureProfiles.profiles.default = {
+            ipv4 = {
+              method = "auto";
+              ignore-auto-dns = "true";
+              dns = "10.10.10.10";
+              dns-search = "";
+            };
+          };
+        };
+      };
+      testScript = ''
+        start_all()
+        router.systemctl("start network-online.target")
+        router.wait_for_unit("network-online.target")
+        dynamic.wait_for_unit("NetworkManager.service")
+        static.wait_for_unit("NetworkManager.service")
+
+        dynamic.wait_until_succeeds("cat /etc/resolv.conf | grep -q '192.168.1.1'")
+        static.wait_until_succeeds("cat /etc/resolv.conf | grep -q '10.10.10.10'")
+        static.wait_until_fails("cat /etc/resolv.conf | grep -q '192.168.1.1'")
+      '';
+    };
+    dispatcherScripts = {
+      name = "dispatcherScripts";
+      nodes.client = clientConfig {
+        networking.networkmanager.dispatcherScripts = [{
+          type = "pre-up";
+          source = pkgs.writeText "testHook" ''
+            touch /tmp/dispatcher-scripts-are-working
+          '';
+        }];
+      };
+      testScript = ''
+        start_all()
+        client.wait_for_unit("NetworkManager.service")
+        client.wait_until_succeeds("stat /tmp/dispatcher-scripts-are-working")
+      '';
+    };
+    envsubst = {
+      name = "envsubst";
+      nodes.client = let
+        # you should never write secrets in to your nixos configuration, please use tools like sops-nix or agenix
+        secretFile = pkgs.writeText "my-secret.env" ''
+          MY_SECRET_IP=fd00:1234:5678:1::23/64
+        '';
+      in clientConfig {
+        networking.networkmanager.ensureProfiles.environmentFiles = [ secretFile ];
+        networking.networkmanager.ensureProfiles.profiles.default = {
+          ipv6.method = "manual";
+          ipv6.addresses = "$MY_SECRET_IP";
+        };
+      };
+      testScript = ''
+        start_all()
+        client.wait_for_unit("NetworkManager.service")
+        client.wait_until_succeeds("ip addr show dev eth1 | grep -q 'fd00:1234:5678:1:'")
+        client.wait_until_succeeds("ping -c 1 fd00:1234:5678:1::23")
+      '';
+    };
+  };
+in lib.mapAttrs (lib.const (attrs: makeTest (attrs // {
+  name = "${attrs.name}-Networking-NetworkManager";
+  meta = {
+    maintainers = with lib.maintainers; [ janik ];
+  };
+
+}))) testCases

pkgs/applications/audio/gbsplay/default.nix

@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "gbsplay";
-  version = "0.0.96";
+  version = "0.0.97";
 
   src = fetchFromGitHub {
     owner = "mmitch";
     repo = "gbsplay";
     rev = version;
-    sha256 = "sha256-2sYPP+urcSP67mHzbjRiL9BYgkIpONr7fPPbGQmBOqU=";
+    sha256 = "sha256-O4t5OzXcrGoxzSXr0nzc01bItjcp1LvFeWnbdSUDwFU=";
   };
 
   configureFlags = [

pkgs/applications/audio/waylyrics/default.nix

@@ -9,13 +9,13 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "waylyrics";
-  version = "0.2.15";
+  version = "0.2.19";
 
   src = fetchFromGitHub {
     owner = "poly000";
     repo = "waylyrics";
     rev = "v${version}";
-    hash = "sha256-dGtotQfS5Ve3rl6iSsqOzs0/dOePfoRZ9Wlg9zHCXSY=";
+    hash = "sha256-y8FBZ/BvCj7CBfQlNE1Ay2nuP41WC14dfTeOJhTbHYs=";
   };
 
   cargoLock = {

pkgs/applications/editors/pixelorama/default.nix

@@ -26,13 +26,13 @@ let
     else throw "unsupported platform";
 in stdenv.mkDerivation (finalAttrs: {
   pname = "pixelorama";
-  version = "0.11.3";
+  version = "0.11.4";
 
   src = fetchFromGitHub {
     owner = "Orama-Interactive";
     repo = "Pixelorama";
     rev = "v${finalAttrs.version}";
-    sha256 = "sha256-+bQRUTEJluhcs5P87It9/oJOzrCcNFzDJVpixoQKXQc=";
+    sha256 = "sha256-VEQjZ9kDqXz1hoT4PrsBtzoi1TYWyN+YcPMyf9qJMRE=";
   };
 
   nativeBuildInputs = [

pkgs/applications/editors/vim/plugins/generated.nix

@@ -5062,6 +5062,18 @@ final: prev:
     meta.homepage = "https://github.com/neoclide/jsonc.vim/";
   };
 
+  jsonfly-nvim = buildVimPlugin {
+    pname = "jsonfly.nvim";
+    version = "2024-04-12";
+    src = fetchFromGitHub {
+      owner = "Myzel394";
+      repo = "jsonfly.nvim";
+      rev = "539a0b79a5ea75d201e1e90cebfe9367154d04fc";
+      sha256 = "1v1i4x2px0zs65rxkf2yhnxn6clx33vdr54r9gaqq713qj5ddlfm";
+    };
+    meta.homepage = "https://github.com/Myzel394/jsonfly.nvim/";
+  };
+
   julia-vim = buildVimPlugin {
     pname = "julia-vim";
     version = "2023-12-15";
@@ -17201,5 +17213,17 @@ final: prev:
     meta.homepage = "https://github.com/jhradilek/vim-snippets/";
   };
 
+  gitignore-nvim = buildVimPlugin {
+    pname = "gitignore-nvim";
+    version = "2024-03-25";
+    src = fetchFromGitHub {
+      owner = "wintermute-cell";
+      repo = "gitignore.nvim";
+      rev = "2455191ec94da8ed222806a4fe3aa358eac1e558";
+      sha256 = "sha256-p6k0NP3Vne6Kl98YodzSruVmJwxyrXziJj8N7u79o1w=";
+    };
+    meta.homepage = "https://github.com/wintermute-cell/gitignore.nvim/";
+  };
+
 
 }

pkgs/applications/editors/vim/plugins/vim-plugin-names

@@ -338,6 +338,7 @@ https://github.com/f-person/git-blame.nvim/,,
 https://github.com/akinsho/git-conflict.nvim/,HEAD,
 https://github.com/rhysd/git-messenger.vim/,,
 https://github.com/ThePrimeagen/git-worktree.nvim/,,
+https://github.com/wintermute-cell/gitignore.nvim/,HEAD,
 https://github.com/vim-scripts/gitignore.vim/,,
 https://github.com/ruifm/gitlinker.nvim/,,
 https://github.com/lewis6991/gitsigns.nvim/,,
@@ -424,6 +425,7 @@ https://github.com/nanotech/jellybeans.vim/,,
 https://github.com/HiPhish/jinja.vim/,HEAD,
 https://github.com/vito-c/jq.vim/,,
 https://github.com/neoclide/jsonc.vim/,,
+https://github.com/Myzel394/jsonfly.nvim/,HEAD,
 https://github.com/JuliaEditorSupport/julia-vim/,,
 https://github.com/GCBallesteros/jupytext.nvim/,HEAD,
 https://github.com/rebelot/kanagawa.nvim/,,

pkgs/applications/editors/vscode/extensions/default.nix

@@ -1049,8 +1049,8 @@ let
         mktplcRef = {
           name = "vscode-markdownlint";
           publisher = "DavidAnson";
-          version = "0.54.0";
+          version = "0.55.0";
-          hash = "sha256-BrPFFRspJIz1U08hPbLziCmRUeZv2NhRrTCx6qvhOJw=";
+          hash = "sha256-slfHfRPcuRu+649n6kAr2bv9H6J+DvYVN/ysq1QpPQM=";
         };
         meta = {
           changelog = "https://marketplace.visualstudio.com/items/DavidAnson.vscode-markdownlint/changelog";
@@ -2352,6 +2352,23 @@ let
         };
       };
 
+      k--kato.intellij-idea-keybindings = buildVscodeMarketplaceExtension {
+        mktplcRef = {
+          name = "intellij-idea-keybindings";
+          publisher = "k--kato";
+          version = "1.7.0";
+          hash = "sha256-mIcSZANZlj5iO2oLiJBUHn08rXVhu/9SKsRhlu/hcvI=";
+        };
+        meta = {
+          changelog = "https://marketplace.visualstudio.com/items/k--kato.intellij-idea-keybindings/changelog";
+          description = "Visual Studio Code extension for IntelliJ IDEA keybindings";
+          downloadPage = "https://marketplace.visualstudio.com/items?itemName=k--kato.intellij-idea-keybindings";
+          homepage = "https://github.com/kasecato/vscode-intellij-idea-keybindings";
+          license = lib.licenses.mit;
+          maintainers = [ lib.maintainers.t4sm5n ];
+        };
+      };
+
       kahole.magit = buildVscodeMarketplaceExtension {
         mktplcRef = {
           name = "magit";

pkgs/applications/editors/vscode/extensions/ms-python.vscode-pylance/default.nix

@@ -1,6 +1,6 @@
 {
   lib,
-  nodePackages,
+  pyright,
   vscode-utils,
 }:
 
@@ -12,7 +12,7 @@ vscode-utils.buildVscodeMarketplaceExtension {
     hash = "sha256-xJU/j5r/Idp/0VorEfciT4SFKRBpMCv9Z0LKO/++1Gk=";
   };
 
-  buildInputs = [ nodePackages.pyright ];
+  buildInputs = [ pyright ];
 
   meta = {
     changelog = "https://marketplace.visualstudio.com/items/ms-python.vscode-pylance/changelog";

pkgs/applications/misc/bazecor/default.nix

@@ -5,13 +5,13 @@
 
 appimageTools.wrapAppImage rec {
   pname = "bazecor";
-  version = "1.3.9";
+  version = "1.3.11";
 
   src = appimageTools.extract {
     inherit pname version;
     src = fetchurl {
       url = "https://github.com/Dygmalab/Bazecor/releases/download/v${version}/Bazecor-${version}-x64.AppImage";
-      hash = "sha256-qve5xxhhyVej8dPDkZ7QQdeDUmqGO4pHJTykbS4RhAk=";
+      hash = "sha256-iMurQDF0CBMnJnjmEgNIKYd8C5B4FguMi4Jqa3dHr3o=";
     };
 
     # Workaround for https://github.com/Dygmalab/Bazecor/issues/370
@@ -26,7 +26,7 @@ appimageTools.wrapAppImage rec {
 
   # also make sure to update the udev rules in ./10-dygma.rules; most recently
   # taken from
-  # https://github.com/Dygmalab/Bazecor/blob/v1.3.9/src/main/utils/udev.ts#L6
+  # https://github.com/Dygmalab/Bazecor/blob/v1.3.11/src/main/utils/udev.ts#L6
 
   extraPkgs = p: (appimageTools.defaultFhsEnvArgs.multiPkgs p) ++ [
     p.glib

pkgs/applications/misc/metadata-cleaner/default.nix

@@ -18,7 +18,7 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "metadata-cleaner";
-  version = "2.5.4";
+  version = "2.5.5";
 
   format = "other";
 
@@ -26,7 +26,7 @@ python3.pkgs.buildPythonApplication rec {
     owner = "rmnvgr";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-2+ZY+ca/CTIdCiFrBOkMWKflzKjSYJ8yfwFkULNg7Xk=";
+    hash = "sha256-0DaQvVG19X9mMYZeYBz0t/DEx4MACLMjTOGMkUv9OQg=";
   };
 
   nativeBuildInputs = [

pkgs/applications/misc/pdfpc/default.nix

@@ -41,9 +41,15 @@ stdenv.mkDerivation rec {
       url = "https://github.com/pdfpc/pdfpc/commit/d38edfac63bec54173b4b31eae5c7fb46cd8f714.diff";
       hash = "sha256-KC2oyzcwU2fUmxaed8qAsKcePwR5KcXgpVdstJg8KmU=";
     })
+    # Allow compiling with markdown3
+    # https://github.com/pdfpc/pdfpc/pull/716
+    (fetchpatch {
+      url = "https://github.com/pdfpc/pdfpc/commit/08e66b9d432e9598c1ee9a78b2355728036ae1a1.patch";
+      hash = "sha256-SKH2GQ5/6Is36xOFmSs89Yw/w7Fnma3FrNqwjOlUQKM=";
+    })
   ];
 
-  cmakeFlags = lib.optional stdenv.isDarwin "-DMOVIES=OFF";
+  cmakeFlags = lib.optional stdenv.isDarwin (lib.cmakeBool "MOVIES" false);
 
   meta = with lib; {
     description = "A presenter console with multi-monitor support for PDF files";

pkgs/applications/networking/browsers/chromium/common.nix

@@ -102,7 +102,14 @@ let
     "flac"
     "libjpeg"
     "libpng"
+  ] ++ lib.optionals (!chromiumVersionAtLeast "124") [
+    # Use the vendored libwebp for M124+ until we figure out how to solve:
+    # Running phase: configurePhase
+    # ERROR Unresolved dependencies.
+    # //third_party/libavif:libavif_enc(//build/toolchain/linux/unbundle:default)
+    #   needs //third_party/libwebp:libwebp_sharpyuv(//build/toolchain/linux/unbundle:default)
     "libwebp"
+  ] ++ [
     "libxslt"
     # "opus"
   ];
@@ -241,6 +248,15 @@ let
       # Partial revert of https://github.com/chromium/chromium/commit/3687976b0c6d36cf4157419a24a39f6770098d61
       # allowing us to use our rustc and our clang.
       ./patches/chromium-121-rust.patch
+    ] ++ lib.optionals (chromiumVersionAtLeast "124" && !chromiumVersionAtLeast "125") [
+      # M124 shipped with broken --ozone-platform-hint flag handling, which we rely on
+      # for our NIXOS_OZONE_WL (wayland) environment variable.
+      # See <https://issues.chromium.org/issues/329678163>.
+      # This is the commit for the fix that landed in M125, which applies clean on M124.
+      (githubPatch {
+        commit = "c7f4c58f896a651eba80ad805ebdb49d19ebdbd4";
+        hash = "sha256-6nYWT2zN+j73xAIXLdGYT2eC71vGnGfiLCB0OwT0CAI=";
+      })
     ];
 
     postPatch = ''

pkgs/applications/networking/browsers/chromium/upstream-info.nix

@@ -9,15 +9,15 @@
     };
     deps = {
       gn = {
-        hash = "sha256-JvilCnnb4laqwq69fay+IdAujYC1EHD7uWpkF/C8tBw=";
+        hash = "sha256-aEL1kIhgPAFqdb174dG093HoLhCJ07O1Kpqfu7r14wQ=";
-        rev = "d4f94f9a6c25497b2ce0356bb99a8d202c8c1d32";
+        rev = "22581fb46c0c0c9530caa67149ee4dd8811063cf";
         url = "https://gn.googlesource.com/gn";
-        version = "2024-02-19";
+        version = "2024-03-14";
       };
     };
-    hash = "sha256-7H7h621AHPyhFYbaVFO892TtS+SP3Qu7cYUVk3ICL14=";
+    hash = "sha256-apEniFKhIxPo4nhp9gCU+WpiV/EB40qif4RfE7Uniog=";
-    hash_deb_amd64 = "sha256-tNkO1mPZg1xltBfoWeNhLekITtZV/WNgu//i2DJb17c=";
+    hash_deb_amd64 = "sha256-rSbigG5/xbL32d1ntOn6gnZyxSpgrg1h7lb/RD4YROI=";
-    version = "123.0.6312.122";
+    version = "124.0.6367.60";
   };
   ungoogled-chromium = {
     deps = {

pkgs/applications/networking/cluster/civo/default.nix

@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "civo";
-  version = "1.0.80";
+  version = "1.0.81";
 
   src = fetchFromGitHub {
     owner  = "civo";
     repo   = "cli";
     rev    = "v${version}";
-    sha256 = "sha256-jzz9mny59YM5PLcQvcus3gHuRSbl/OISAOjDoS/4Y78=";
+    sha256 = "sha256-YdrJbT9Ozp1vlvQBYQNjJX6n3vIXYj3dmKhAsBPrvi8=";
   };
 
-  vendorHash = "sha256-Uh2/4qdJQfqQdjXbOBkUVv2nF1AN+QRKRI0+yta+G5Q=";
+  vendorHash = "sha256-YNbxV79XQBmd7oTanwLOMdmt2ds4ttX1ttr8vUycVzg=";
 
   nativeBuildInputs = [ installShellFiles ];
 

pkgs/applications/networking/twingate/default.nix

@@ -13,11 +13,11 @@
 
 stdenv.mkDerivation rec {
   pname = "twingate";
-  version = "2024.63.115357";
+  version = "2024.98.119300";
 
   src = fetchurl {
     url = "https://binaries.twingate.com/client/linux/DEB/x86_64/${version}/twingate-amd64.deb";
-    hash = "sha256-VSm9gnHfo9LPwUvNwLeX7OjqMYgFUgGYSxx/qDndfwo=";
+    hash = "sha256-N0cabYHaF5H1EeriQRQL7bN5UM85oOGrm9pxGr1AlEk=";
   };
 
   buildInputs = [

pkgs/applications/office/super-productivity/default.nix

@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "super-productivity";
-  version = "8.0.1";
+  version = "8.0.5";
 
   src = fetchurl {
     url = "https://github.com/johannesjo/super-productivity/releases/download/v${version}/superProductivity-${version}.AppImage";
-    sha256 = "sha256-BW/4jP4lh3leAcdy3JHET/PUybN+0Cy9wxMSi57dAcw=";
+    sha256 = "sha256-nH7dCrXBhkAYbvb9CPc4zhslFiYtA1ChuYPoHMdBBwQ=";
     name = "${pname}-${version}.AppImage";
   };
 

pkgs/applications/science/biology/iqtree/default.nix

@@ -10,13 +10,13 @@
 
 stdenv.mkDerivation rec {
   pname = "iqtree";
-  version = "2.3.1";
+  version = "2.3.2";
 
   src = fetchFromGitHub {
     owner = "iqtree";
     repo = "iqtree2";
     rev = "v${version}";
-    hash = "sha256-GaNumiTGa6mxvFifv730JFgKrRxG41gJN+ci3imDbzs=";
+    hash = "sha256-hAJs48PhIyZSKSRZjQJKQwoJlt6DPRQwaDsuZ00VZII=";
     fetchSubmodules = true;
   };
 

pkgs/applications/version-management/forgejo/default.nix

@@ -39,14 +39,14 @@ let
 in
 buildGoModule rec {
   pname = "forgejo";
-  version = "1.21.10-0";
+  version = "1.21.11-0";
 
   src = fetchFromGitea {
     domain = "codeberg.org";
     owner = "forgejo";
     repo = "forgejo";
     rev = "v${version}";
-    hash = "sha256-uCRAT9RiU9S+tP9alNshSQwbUgLmU9wE5HIQ4FPmXVE=";
+    hash = "sha256-Cp+dN4nTIboin42NJR/YUkVXbBC7uufH8EE7NgIVFzY=";
     # Forgejo has multiple different version strings that need to be provided
     # via ldflags.  main.ForgejoVersion for example is a combination of a
     # hardcoded gitea compatibility version string (in the Makefile) and
@@ -65,7 +65,7 @@ buildGoModule rec {
     '';
   };
 
-  vendorHash = "sha256-pgUSmM2CxYO8DralWoeR2groQxpxo9WtRcToYeaHXGk=";
+  vendorHash = "sha256-OuWNF+muWM6xqwkFxLIUsn/huqXj2VKg8BN9+JHVw58=";
 
   subPackages = [ "." ];
 

pkgs/applications/video/kodi/default.nix

@@ -1,14 +1,18 @@
 { callPackage, ... } @ args:
 let
   unwrapped = callPackage ./unwrapped.nix (removeAttrs args [ "callPackage" ]);
-  kodiPackages = callPackage ../../../top-level/kodi-packages.nix { kodi = unwrapped; };
 in
   unwrapped.overrideAttrs (oldAttrs: {
-    passthru = oldAttrs.passthru // {
+    passthru =
-      packages = kodiPackages;
+      let
-      withPackages = func: callPackage ./wrapper.nix {
+        finalKodi = oldAttrs.passthru.kodi;
-        kodi = unwrapped;
+        kodiPackages = callPackage ../../../top-level/kodi-packages.nix { kodi = finalKodi; };
-        addons = kodiPackages.requiredKodiAddons (func kodiPackages);
+      in
-      };
+        oldAttrs.passthru // {
-    };
+          packages = kodiPackages;
+          withPackages = func: callPackage ./wrapper.nix {
+            kodi = finalKodi;
+            addons = kodiPackages.requiredKodiAddons (func kodiPackages);
+          };
+        };
   })

pkgs/applications/video/kodi/unwrapped.nix

@@ -28,6 +28,7 @@
 , rtmpSupport ? true, rtmpdump
 , sambaSupport ? true, samba
 , udevSupport ? true, udev
+, opticalSupport ? true
 , usbSupport  ? false, libusb-compat-0_1
 , vdpauSupport ? true, libvdpau
 , waylandSupport ? false, wayland, wayland-protocols
@@ -40,10 +41,6 @@ assert usbSupport -> !udevSupport; # libusb-compat-0_1 won't be used if udev is
 assert gbmSupport || waylandSupport || x11Support;
 
 let
-  kodiReleaseDate = "20240405";
-  kodiVersion = "21.0";
-  rel = "Omega";
-
   # see https://github.com/xbmc/xbmc/blob/${kodiVersion}-${rel}/tools/depends/target/ to get suggested versions for all dependencies
 
   # We can build these externally but FindLibDvd.cmake forces us to build it
@@ -70,17 +67,17 @@ let
   };
 
   groovy = fetchzip {
-    url = "https://archive.apache.org/dist/groovy/4.0.16/distribution/apache-groovy-binary-4.0.16.zip";
+    url = "mirror://apache/groovy/4.0.16/distribution/apache-groovy-binary-4.0.16.zip";
     sha256 = "sha256-OfZBiMVrhw6VqHRHCSC7ZV3FiZ26n4+F8hsskk+L6yU=";
   };
 
   apache_commons_lang = fetchzip {
-    url = "https://dlcdn.apache.org//commons/lang/binaries/commons-lang3-3.14.0-bin.zip";
+    url = "mirror://apache/commons/lang/binaries/commons-lang3-3.14.0-bin.zip";
     sha512 = "sha512-eKF1IQ6PDtifb4pMHWQ2SYHIh0HbMi3qpc92lfbOo3uSsFJVR3n7JD0AdzrG17tLJQA4z5PGDhwyYw0rLeLsXw==";
   };
 
   apache_commons_text = fetchzip {
-    url = "https://dlcdn.apache.org//commons/text/binaries/commons-text-1.11.0-bin.zip";
+    url = "mirror://apache/commons/text/binaries/commons-text-1.11.0-bin.zip";
     sha512 = "sha512-P2IvnrHSYRF70LllTMI8aev43h2oe8lq6rrMYw450PEhEa7OuuCjh1Krnc/A4OqENUcidVAAX5dK1RAsZHh8Dg==";
   };
 
@@ -88,17 +85,23 @@ let
     ++ lib.optional waylandSupport "wayland"
     ++ lib.optional x11Support "x11";
 
-in stdenv.mkDerivation {
+in stdenv.mkDerivation (finalAttrs: {
     pname = "kodi";
-    version = kodiVersion;
+    version = "21.0";
+    kodiReleaseName = "Omega";
 
     src = fetchFromGitHub {
       owner = "xbmc";
-      repo = "xbmc";
+      repo  = "xbmc";
-      rev = "${kodiVersion}-${rel}";
+      rev   = "${finalAttrs.version}-${finalAttrs.kodiReleaseName}";
-      hash = "sha256-xrFWqgwTkurEwt3/+/e4SCM6Uk9nxuW62SrCFWWqZO0=";
+      hash  = "sha256-xrFWqgwTkurEwt3/+/e4SCM6Uk9nxuW62SrCFWWqZO0=";
     };
 
+    # make  derivations declared in the let binding available here, so
+    # they can be overridden
+    inherit libdvdcss libdvdnav libdvdread groovy
+            apache_commons_lang apache_commons_text;
+
     buildInputs = [
       gnutls libidn2 libtasn1 nasm p11-kit
       libxml2 python3Packages.python
@@ -168,17 +171,20 @@ in stdenv.mkDerivation {
 
     cmakeFlags = [
       "-DAPP_RENDER_SYSTEM=${if gbmSupport then "gles" else "gl"}"
-      "-Dlibdvdcss_URL=${libdvdcss}"
+      "-Dlibdvdcss_URL=${finalAttrs.libdvdcss}"
-      "-Dlibdvdnav_URL=${libdvdnav}"
+      "-Dlibdvdnav_URL=${finalAttrs.libdvdnav}"
-      "-Dlibdvdread_URL=${libdvdread}"
+      "-Dlibdvdread_URL=${finalAttrs.libdvdread}"
-      "-Dgroovy_SOURCE_DIR=${groovy}"
+      "-Dgroovy_SOURCE_DIR=${finalAttrs.groovy}"
-      "-Dapache-commons-lang_SOURCE_DIR=${apache_commons_lang}"
+      "-Dapache-commons-lang_SOURCE_DIR=${finalAttrs.apache_commons_lang}"
-      "-Dapache-commons-text_SOURCE_DIR=${apache_commons_text}"
+      "-Dapache-commons-text_SOURCE_DIR=${finalAttrs.apache_commons_text}"
-      "-DGIT_VERSION=${kodiReleaseDate}"
+      # Upstream derives this from the git HEADs hash and date.
+      # LibreElec (minimal distro for kodi) uses the equivalent to this.
+      "-DGIT_VERSION=${finalAttrs.version}-${finalAttrs.kodiReleaseName}"
       "-DENABLE_EVENTCLIENTS=ON"
       "-DENABLE_INTERNAL_CROSSGUID=OFF"
       "-DENABLE_INTERNAL_RapidJSON=OFF"
-      "-DENABLE_OPTICAL=ON"
+      "-DENABLE_OPTICAL=${if opticalSupport then "ON" else "OFF"}"
+      "-DENABLE_VDPAU=${if vdpauSupport then "ON" else "OFF"}"
       "-DLIRC_DEVICE=/run/lirc/lircd"
       "-DSWIG_EXECUTABLE=${buildPackages.swig}/bin/swig"
       "-DFLATBUFFERS_FLATC_EXECUTABLE=${buildPackages.flatbuffers}/bin/flatc"
@@ -221,7 +227,8 @@ in stdenv.mkDerivation {
           --prefix PATH ":" "${lib.makeBinPath ([ python3Packages.python glxinfo ]
             ++ lib.optional x11Support xdpyinfo ++ lib.optional sambaSupport samba)}" \
           --prefix LD_LIBRARY_PATH ":" "${lib.makeLibraryPath
-              ([ curl systemd libmad libvdpau libcec libcec_platform libass ]
+              ([ curl systemd libmad libcec libcec_platform libass ]
+                 ++ lib.optional vdpauSupport libvdpau
                  ++ lib.optional nfsSupport libnfs
                  ++ lib.optional rtmpSupport rtmpdump)}"
       done
@@ -240,6 +247,7 @@ in stdenv.mkDerivation {
     passthru = {
       pythonPackages = python3Packages;
       ffmpeg = ffmpeg;
+      kodi = finalAttrs.finalPackage;
     };
 
     meta = with lib; {
@@ -249,4 +257,4 @@ in stdenv.mkDerivation {
       platforms   = platforms.linux;
       maintainers = teams.kodi.members;
     };
-}
+})

pkgs/applications/virtualization/podman/default.nix

@@ -64,13 +64,13 @@ let
 in
 buildGoModule rec {
   pname = "podman";
-  version = "5.0.1";
+  version = "5.0.2";
 
   src = fetchFromGitHub {
     owner = "containers";
     repo = "podman";
     rev = "v${version}";
-    hash = "sha256-XgLrPLswLmaB9FYXKEMLP+7KT/OY50z3JKz8DvMLrEE=";
+    hash = "sha256-8Swqwyzu/WI9mG21bLF81Kk4kS2Ltg0GV9G3EcG/FnU=";
   };
 
   patches = [

pkgs/build-support/bintools-wrapper/default.nix

@@ -8,7 +8,8 @@
 { name ? ""
 , lib
 , stdenvNoCC
-, bintools ? null, libc ? null, coreutils ? null, shell ? stdenvNoCC.shell, gnugrep ? null
+, runtimeShell
+, bintools ? null, libc ? null, coreutils ? null, gnugrep ? null
 , netbsd ? null, netbsdCross ? null
 , sharedLibraryLoader ?
   if libc == null then
@@ -28,7 +29,7 @@
 , isGNU ? bintools.isGNU or false
 , isLLVM ? bintools.isLLVM or false
 , isCCTools ? bintools.isCCTools or false
-, buildPackages ? {}
+, expand-response-params
 , targetPackages ? {}
 , useMacosReexportHack ? false
 , wrapGas ? false
@@ -83,8 +84,7 @@ let
     replaceStrings
     ;
 
-  stdenv = stdenvNoCC;
+  inherit (stdenvNoCC) hostPlatform targetPlatform;
-  inherit (stdenv) hostPlatform targetPlatform;
 
   # Prefix for binaries. Customarily ends with a dash separator.
   #
@@ -132,13 +132,9 @@ let
     else if hasSuffix "pc-gnu" targetPlatform.config then "ld.so.1"
     else "";
 
-  expand-response-params =
-    optionalString (buildPackages ? stdenv && buildPackages.stdenv.hasCC && buildPackages.stdenv.cc != "/dev/null")
-    (import ../expand-response-params { inherit (buildPackages) stdenv; });
-
 in
 
-stdenv.mkDerivation {
+stdenvNoCC.mkDerivation {
   pname = targetPrefix
     + (if name != "" then name else "${bintoolsName}-wrapper");
   version = optionalString (bintools != null) bintoolsVersion;
@@ -346,7 +342,7 @@ stdenv.mkDerivation {
       done
     ''
 
-    + optionalString stdenv.targetPlatform.isDarwin ''
+    + optionalString targetPlatform.isDarwin ''
       echo "-arch ${targetPlatform.darwinArch}" >> $out/nix-support/libc-ldflags
     ''
 
@@ -363,7 +359,7 @@ stdenv.mkDerivation {
     ###
     ### Remove certain timestamps from final binaries
     ###
-    + optionalString (stdenv.targetPlatform.isDarwin && !(bintools.isGNU or false)) ''
+    + optionalString (targetPlatform.isDarwin && !(bintools.isGNU or false)) ''
       echo "export ZERO_AR_DATE=1" >> $out/nix-support/setup-hook
     ''
 
@@ -380,9 +376,9 @@ stdenv.mkDerivation {
     ###
     ### Ensure consistent LC_VERSION_MIN_MACOSX
     ###
-    + optionalString stdenv.targetPlatform.isDarwin (
+    + optionalString targetPlatform.isDarwin (
       let
-        inherit (stdenv.targetPlatform)
+        inherit (targetPlatform)
           darwinPlatform darwinSdkVersion
           darwinMinVersion darwinMinVersionVariable;
       in ''
@@ -419,8 +415,10 @@ stdenv.mkDerivation {
 
   env = {
     # for substitution in utils.bash
+    # TODO(@sternenseemann): invent something cleaner than passing in "" in case of absence
     expandResponseParams = "${expand-response-params}/bin/expand-response-params";
-    shell = getBin shell + shell.shellPath or "";
+    # TODO(@sternenseemann): rename env var via stdenv rebuild
+    shell = (getBin runtimeShell + runtimeShell.shellPath or "");
     gnugrep_bin = optionalString (!nativeTools) gnugrep;
     wrapperName = "BINTOOLS_WRAPPER";
     inherit dynamicLinker targetPrefix suffixSalt coreutils_bin;

pkgs/build-support/cc-wrapper/default.nix

@@ -8,14 +8,15 @@
 { name ? ""
 , lib
 , stdenvNoCC
-, cc ? null, libc ? null, bintools, coreutils ? null, shell ? stdenvNoCC.shell
+, runtimeShell
+, cc ? null, libc ? null, bintools, coreutils ? null
 , zlib ? null
 , nativeTools, noLibc ? false, nativeLibc, nativePrefix ? ""
 , propagateDoc ? cc != null && cc ? man
 , extraTools ? [], extraPackages ? [], extraBuildCommands ? ""
 , nixSupport ? {}
 , isGNU ? false, isClang ? cc.isClang or false, isCcache ? cc.isCcache or false, gnugrep ? null
-, buildPackages ? {}
+, expand-response-params
 , libcxx ? null
 
 # Whether or not to add `-B` and `-L` to `nix-support/cc-{c,ld}flags`
@@ -82,9 +83,7 @@ let
     versionAtLeast
     ;
 
-  inherit (stdenv) hostPlatform targetPlatform;
+  inherit (stdenvNoCC) hostPlatform targetPlatform;
-
-  stdenv = stdenvNoCC;
 
   includeFortifyHeaders' = if includeFortifyHeaders != null
     then includeFortifyHeaders
@@ -114,15 +113,12 @@ let
   # unstable implementation detail, however.
   suffixSalt = replaceStrings ["-" "."] ["_" "_"] targetPlatform.config;
 
-  expand-response-params =
-    optionalString ((buildPackages.stdenv.hasCC or false) && buildPackages.stdenv.cc != "/dev/null") (import ../expand-response-params { inherit (buildPackages) stdenv; });
-
   useGccForLibs = useCcForLibs
     && libcxx == null
-    && !stdenv.targetPlatform.isDarwin
+    && !targetPlatform.isDarwin
-    && !(stdenv.targetPlatform.useLLVM or false)
+    && !(targetPlatform.useLLVM or false)
-    && !(stdenv.targetPlatform.useAndroidPrebuilt or false)
+    && !(targetPlatform.useAndroidPrebuilt or false)
-    && !(stdenv.targetPlatform.isiOS or false)
+    && !(targetPlatform.isiOS or false)
     && gccForLibs != null;
   gccForLibs_solib = getLib gccForLibs
     + optionalString (targetPlatform != hostPlatform) "/${targetPlatform.config}";
@@ -249,17 +245,17 @@ let
     then cc.hardeningUnsupportedFlagsByTargetPlatform targetPlatform
     else (cc.hardeningUnsupportedFlags or []);
 
-  darwinPlatformForCC = optionalString stdenv.targetPlatform.isDarwin (
+  darwinPlatformForCC = optionalString targetPlatform.isDarwin (
     if (targetPlatform.darwinPlatform == "macos" && isGNU) then "macosx"
     else targetPlatform.darwinPlatform
   );
 
-  darwinMinVersion = optionalString stdenv.targetPlatform.isDarwin (
+  darwinMinVersion = optionalString targetPlatform.isDarwin (
-    stdenv.targetPlatform.darwinMinVersion
+    targetPlatform.darwinMinVersion
   );
 
-  darwinMinVersionVariable = optionalString stdenv.targetPlatform.isDarwin
+  darwinMinVersionVariable = optionalString targetPlatform.isDarwin
-    stdenv.targetPlatform.darwinMinVersionVariable;
+    targetPlatform.darwinMinVersionVariable;
 in
 
 assert includeFortifyHeaders' -> fortify-headers != null;
@@ -272,7 +268,7 @@ assert nativeTools == bintools.nativeTools;
 assert nativeLibc == bintools.nativeLibc;
 assert nativePrefix == bintools.nativePrefix;
 
-stdenv.mkDerivation {
+stdenvNoCC.mkDerivation {
   pname = targetPrefix
     + (if name != "" then name else "${ccName}-wrapper");
   version = optionalString (cc != null) ccVersion;
@@ -299,6 +295,9 @@ stdenv.mkDerivation {
         '(${concatStringsSep " " (map (pkg: "\"${pkg}\"") pkgs)}))
     '';
 
+    # Expose expand-response-params we are /actually/ using. In stdenv
+    # bootstrapping, expand-response-params usually comes from an earlier stage,
+    # so it is important to expose this for reference checking.
     inherit expand-response-params;
 
     inherit nixSupport;
@@ -426,7 +425,7 @@ stdenv.mkDerivation {
     ../setup-hooks/role.bash
   ] ++ optional (cc.langC or true) ./setup-hook.sh
     ++ optional (cc.langFortran or false) ./fortran-hook.sh
-    ++ optional (targetPlatform.isWindows) (stdenv.mkDerivation {
+    ++ optional (targetPlatform.isWindows) (stdenvNoCC.mkDerivation {
       name = "win-dll-hook.sh";
       dontUnpack = true;
       installPhase = ''
@@ -479,8 +478,8 @@ stdenv.mkDerivation {
     # break `useLLVM` into.)
     + optionalString (isClang
                       && targetPlatform.isLinux
-                      && !(stdenv.targetPlatform.useAndroidPrebuilt or false)
+                      && !(targetPlatform.useAndroidPrebuilt or false)
-                      && !(stdenv.targetPlatform.useLLVM or false)
+                      && !(targetPlatform.useLLVM or false)
                       && gccForLibs != null) (''
       echo "--gcc-toolchain=${gccForLibs}" >> $out/nix-support/cc-cflags
 
@@ -689,7 +688,7 @@ stdenv.mkDerivation {
       done
     ''
 
-    + optionalString stdenv.targetPlatform.isDarwin ''
+    + optionalString targetPlatform.isDarwin ''
         echo "-arch ${targetPlatform.darwinArch}" >> $out/nix-support/cc-cflags
     ''
 
@@ -740,8 +739,10 @@ stdenv.mkDerivation {
     inherit isClang;
 
     # for substitution in utils.bash
+    # TODO(@sternenseemann): invent something cleaner than passing in "" in case of absence
     expandResponseParams = "${expand-response-params}/bin/expand-response-params";
-    shell = getBin shell + shell.shellPath or "";
+    # TODO(@sternenseemann): rename env var via stdenv rebuild
+    shell = getBin runtimeShell + runtimeShell.shellPath or "";
     gnugrep_bin = optionalString (!nativeTools) gnugrep;
     # stdenv.cc.cc should not be null and we have nothing better for now.
     # if the native impure bootstrap is gotten rid of this can become `inherit cc;` again.

pkgs/build-support/expand-response-params/default.nix

@@ -1,4 +1,4 @@
-{ stdenv }:
+{ stdenv, lib }:
 
 # A "response file" is a sequence of arguments that is passed via a
 # file, rather than via argv[].
@@ -25,4 +25,18 @@ stdenv.mkDerivation {
     mkdir -p $prefix/bin
     mv expand-response-params $prefix/bin/
   '';
+
+  meta = {
+    description = "Internal tool used by the nixpkgs wrapper scripts for processing response files";
+    longDescription = ''
+      expand-response-params is a tool that allows for obtaining a full list of all
+      arguments passed in a given compiler command line including those passed via
+      so-called response files. The nixpkgs wrapper scripts for bintools and C
+      compilers use it for processing compiler flags. As it is developed in
+      conjunction with the nixpkgs wrapper scripts, it should be considered as
+      unstable and subject to change.
+    '';
+    license = lib.licenses.mit;
+    platforms = lib.platforms.all;
+  };
 }

pkgs/by-name/ar/arc-browser/package.nix

@@ -0,0 +1,54 @@
+{ lib
+, stdenvNoCC
+, fetchurl
+, undmg
+, writeShellApplication
+, curl
+, common-updater-scripts
+}:
+
+stdenvNoCC.mkDerivation (finalAttrs: {
+  pname = "arc-browser";
+  version = "1.38.0-48670";
+
+  src = fetchurl {
+    url = "https://releases.arc.net/release/Arc-${finalAttrs.version}.dmg";
+    hash = "sha256-6LJEIkr1NA8HHxbLWtd/OTlPPErh05UTjVhjuZVcmTg=";
+  };
+
+  nativeBuildInputs = [ undmg ];
+
+  sourceRoot = "Arc.app";
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p $out/Applications/Arc.app
+    cp -R . $out/Applications/Arc.app
+
+    runHook postInstall
+  '';
+
+  passthru.updateScript = lib.getExe (writeShellApplication {
+    name = "arc-browser-update-script";
+    runtimeInputs = [ curl common-updater-scripts ];
+    text = ''
+      set -euo pipefail
+      redirect_url="$(curl -s -L -f "https://releases.arc.net/release/Arc-latest.dmg" -o /dev/null -w '%{url_effective}')"
+      # The url scheme is: https://releases.arc.net/release/Arc-1.23.4-56789.dmg
+      # We strip everything before 'Arc-' and after '.dmg'
+      version="''${redirect_url##*/Arc-}"
+      version="''${version%.dmg}"
+      update-source-version arc-browser "$version" --file=./pkgs/by-name/ar/arc-browser/package.nix
+    '';
+  });
+
+  meta = {
+    description = "Arc from The Browser Company";
+    homepage = "https://arc.net/";
+    license = lib.licenses.unfree;
+    maintainers = with lib.maintainers; [ donteatoreo ];
+    platforms = [ "aarch64-darwin" "x86_64-darwin" ];
+    sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
+  };
+})

pkgs/by-name/co/codeium/package.nix

@@ -13,10 +13,10 @@ let
   }.${system} or throwSystem;
 
   hash = {
-    x86_64-linux = "sha256-AHjR6lHszYqZ2yC/uY2DmB67xMUFZliqI29Ptes2SoY=";
+    x86_64-linux = "sha256-6sIYDI6+1/p54Af+E/GmRAFlfDYJVwxhn0qF47ZH+Zg=";
-    aarch64-linux = "sha256-2NYlec6gpVMJwZctEqwn5rQiTrb5PmaxEz3lQxF1qmk=";
+    aarch64-linux = "sha256-1ImcjAqCZm5KZZYHWhG1eO7ipAdrP4Qjj2eBxTst++s=";
-    x86_64-darwin = "sha256-OeMbO2lDK6XUF3ht+09ZWOL7UsEEVTrKyXOfhny8DhM=";
+    x86_64-darwin = "sha256-yHthItxZYFejJlwJJ7BrM2csnLsZXjy/IbzF1iaCCyI=";
-    aarch64-darwin = "sha256-4CQvJkd3kI7XJz46QsSUBtWLmxDu7AcAJwRS3amv0SM=";
+    aarch64-darwin = "sha256-GIx0yABISj/rH/yVkkx6NBs5qF0P8nhpMyvnzXJ92mA=";
   }.${system} or throwSystem;
 
   bin = "$out/bin/codeium_language_server";
@@ -24,7 +24,7 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "codeium";
-  version = "1.8.22";
+  version = "1.8.25";
   src = fetchurl {
     name = "${finalAttrs.pname}-${finalAttrs.version}.gz";
     url = "https://github.com/Exafunction/codeium/releases/download/language-server-v${finalAttrs.version}/language_server_${plat}.gz";

pkgs/by-name/co/converseen/package.nix

@@ -10,13 +10,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "converseen";
-  version = "0.12.1.0";
+  version = "0.12.2.2";
 
   src = fetchFromGitHub {
     owner = "Faster3ck";
     repo = "Converseen";
     rev = "refs/tags/v${finalAttrs.version}";
-    hash = "sha256-WGOmnaO9IAcsOg5W2kJ1dxOk1ndn6InCVVN4FTehKTk=";
+    hash = "sha256-nAX5o+rqQCwBTizqwLPewmhlYQbxlPj158U+v3Z08fQ=";
   };
 
   strictDeps = true;

pkgs/by-name/em/emacs-lsp-booster/package.nix

@@ -6,16 +6,16 @@
 }:
 rustPlatform.buildRustPackage rec {
   pname = "emacs-lsp-booster";
-  version = "0.2.0";
+  version = "0.2.1";
 
   src = fetchFromGitHub {
     owner = "blahgeek";
     repo = "emacs-lsp-booster";
     rev = "v${version}";
-    hash = "sha256-DmEnuAR/OtTdKApEWCdOPAJplT29kuM6ZSHeOnQVo/c=";
+    hash = "sha256-uP/xJfXQtk8oaG5Zk+dw+C2fVFdjpUZTDASFuj1+eYs=";
   };
 
-  cargoHash = "sha256-2wXsPkBl4InjbdYUiiQ+5fZFanLA88t5ApGZ4psfDqk=";
+  cargoHash = "sha256-CvIJ56QrIzQULFeXYQXTpX9PoGx1/DWtgwzfJ+mljEI=";
 
   nativeCheckInputs = [emacs]; # tests/bytecode_test
 

pkgs/by-name/fz/fzf-make/package.nix

@@ -10,16 +10,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "fzf-make";
-  version = "0.27.0";
+  version = "0.28.0";
 
   src = fetchFromGitHub {
     owner = "kyu08";
     repo = "fzf-make";
     rev = "v${version}";
-    hash = "sha256-OgvPUk5q7DB9hakZzCUM2dlXMQzE/CGpg4pMDQCk7k0=";
+    hash = "sha256-USBK3In/1Uor33wrab1iTt0akQTcjuHd7I86XfERzzg=";
   };
 
-  cargoHash = "sha256-MTOafmrlaW8WNUqsG2c/WnbG9ZKbq9zdou6buB4Qo/k=";
+  cargoHash = "sha256-zEcll6X0iclDap40bQ1CXuVBQnVin8VwjpErm+/B0ZY=";
 
   nativeBuildInputs = [ makeBinaryWrapper ];
 

pkgs/by-name/gh/ghunt/package.nix

@@ -38,7 +38,8 @@ python3.pkgs.buildPythonApplication rec {
     python-dateutil
     rich
     trio
-  ];
+    packaging
+  ] ++ httpx.optional-dependencies.http2;
 
   # Project has no tests
   doCheck = false;

pkgs/by-name/hi/himalaya/package.nix

@@ -3,9 +3,7 @@
 , fetchFromGitHub
 , stdenv
 , pkg-config
-, AppKit
+, darwin
-, Cocoa
-, Security
 , installShellFiles
 , installShellCompletions ? stdenv.hostPlatform == stdenv.buildPlatform
 , installManPages ? stdenv.hostPlatform == stdenv.buildPlatform
@@ -16,26 +14,34 @@
 }:
 
 rustPlatform.buildRustPackage rec {
+  # Learn more about available cargo features at:
+  #  - <https://pimalaya.org/himalaya/cli/latest/installation.html#cargo>
   inherit buildNoDefaultFeatures buildFeatures;
 
   pname = "himalaya";
-  version = "1.0.0-beta.3";
+  version = "1.0.0-beta.4";
 
   src = fetchFromGitHub {
     owner = "soywod";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-B7eswDq4tKyg881i3pLd6h+HsObK0c2dQnYuvPAGJHk=";
+    hash = "sha256-NrWBg0sjaz/uLsNs8/T4MkUgHOUvAWRix1O5usKsw6o=";
   };
 
-  cargoSha256 = "jOzuCXsrtXp8dmJTBqrEq4nog6smEPbdsFAy+ruPtY8=";
+  cargoSha256 = "YS8IamapvmdrOPptQh2Ef9Yold0IK1XIeGs0kDIQ5b8=";
 
-  nativeBuildInputs = [ ]
+  NIX_LDFLAGS = lib.optionals stdenv.isDarwin [
+    "-F${darwin.apple_sdk.frameworks.AppKit}/Library/Frameworks"
+    "-framework"
+    "AppKit"
+  ];
+
+  nativeBuildInputs = [ pkg-config ]
     ++ lib.optional (builtins.elem "pgp-gpg" buildFeatures) pkg-config
     ++ lib.optional (installManPages || installShellCompletions) installShellFiles;
 
   buildInputs = [ ]
-    ++ lib.optionals stdenv.isDarwin [ AppKit Cocoa Security ]
+    ++ lib.optionals stdenv.isDarwin (with darwin.apple_sdk.frameworks; [ AppKit Cocoa Security ])
     ++ lib.optional (builtins.elem "notmuch" buildFeatures) notmuch
     ++ lib.optional (builtins.elem "pgp-gpg" buildFeatures) gpgme;
 

pkgs/by-name/i2/i2p/package.nix

@@ -13,16 +13,17 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "i2p";
-  version = "2.4.0";
+  version = "2.5.0";
 
   src = fetchzip {
-    urls = map (mirror: "${mirror}${finalAttrs.version}/i2psource_${finalAttrs.version}.tar.bz2") [
+    urls = [
-      "https://github.com/i2p/i2p.i2p/releases/download/i2p-"
+      "https://github.com/i2p/i2p.i2p/archive/i2p-${finalAttrs.version}.tar.gz"
+    ] ++ (map (mirror: "${mirror}${finalAttrs.version}/i2psource_${finalAttrs.version}.tar.bz2") [
       "https://download.i2p2.de/releases/"
       "https://files.i2p-projekt.de/"
       "https://download.i2p2.no/releases/"
-    ];
+    ]);
-    hash = "sha256-RESN1qA/SD9MajUSJyXssNZnph2XZge7xr2kTgOp5V4=";
+    hash = "sha256-mGBt2BrHU2ETV3jRay5tEpMJEO3b3K6BlBjYZNedtEA=";
   };
 
   strictDeps = true;

pkgs/by-name/ig/igir/package.nix

@@ -10,16 +10,16 @@
 
 buildNpmPackage rec {
   pname = "igir";
-  version = "2.6.2";
+  version = "2.6.3";
 
   src = fetchFromGitHub {
     owner = "emmercm";
     repo = "igir";
     rev = "v${version}";
-    hash = "sha256-bJPUGB9fyeOb5W9EzQldh4rRJQBat58MgjjfS1qh66w=";
+    hash = "sha256-0WA+7qw5ZuELHc8P0yizV+kEwSmoUBmgReM8ZosGnqs=";
   };
 
-  npmDepsHash = "sha256-q8gpx5zwiO/7ZBB/YruhCUgukp71sfJju8nmF6SwTrc=";
+  npmDepsHash = "sha256-UfTq7/da1V9ubHh2wGvktP/SiWfyL8yF9iuCOq8Hxwg=";
 
   # I have no clue why I have to do this
   postPatch = ''

pkgs/by-name/li/littlefs-fuse/package.nix

@@ -2,12 +2,12 @@
 
 stdenv.mkDerivation rec {
   pname = "littlefs-fuse";
-  version = "2.7.6";
+  version = "2.7.7";
   src = fetchFromGitHub {
     owner = "littlefs-project";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-iN6Ny1H7CyBzBRJyYKbXuzkap7+u+6tVkXo7Vnp1WV8=";
+    hash = "sha256-MCmi0CBs3RLuYn+1BsS6pIeR/tHS1lGNyV3ZwlsnQCA=";
   };
   buildInputs = [ fuse ];
   installPhase = ''

pkgs/by-name/li/livekit/package.nix

@@ -5,16 +5,16 @@
 
 buildGoModule rec {
   pname = "livekit";
-  version = "1.5.3";
+  version = "1.6.0";
 
   src = fetchFromGitHub {
     owner = "livekit";
     repo = "livekit";
     rev = "v${version}";
-    hash = "sha256-2MooX+wy7KetxEBgQoVoL4GuVkm+SbTzYgfWyLL7KU8=";
+    hash = "sha256-tgoVHRv8hnDkjFYShZ/3lieknhIobHv27RVvQOCtEWU=";
   };
 
-  vendorHash = "sha256-8YR0Bl+sQsqpFtD+1GeYaydBdHeM0rRL2NbgAh9kCj0=";
+  vendorHash = "sha256-TZ435gu5naFi/JLz6B/1fpvGA3diJp4JIWL1zgNlb4Q=";
 
   subPackages = [ "cmd/server" ];
 

pkgs/by-name/ma/makima/package.nix

@@ -7,16 +7,16 @@
 
 rustPlatform.buildRustPackage rec{
   pname = "makima";
-  version = "0.4.4";
+  version = "0.5.2";
 
   src = fetchFromGitHub {
     owner = "cyber-sushi";
     repo = "makima";
     rev = "v${version}";
-    hash = "sha256-3S4J4fdCn/eqgT9g0WmS5kQHr7LysBn03RzHvagm5jg=";
+    hash = "sha256-x8vjTXB6kFJ9o6EGCtlX6eT/VrzLF17fIA2gDLFumzY=";
   };
 
-  cargoHash = "sha256-YCs37IYiYxjh2uBZvHliDZRu68J4mXCCYpWlPHtw+0Q=";
+  cargoHash = "sha256-p4oMeDL7T/a9OCgMdriGtgHkZq8tZVzPspEsU4IPfAo=";
 
   nativeBuildInputs = [ pkg-config ];
   buildInputs = [ udev ];

pkgs/by-name/ma/markdown-oxide/package.nix

@@ -5,13 +5,13 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "markdown-oxide";
-  version = "0.0.16";
+  version = "0.0.17";
 
   src = fetchFromGitHub {
     owner = "Feel-ix-343";
     repo = "markdown-oxide";
     rev = "v${version}";
-    hash = "sha256-RCoyiEkaTDbLtkMWSCM9nOHURHw5D7vsnr/yl91CuVQ=";
+    hash = "sha256-bJlyzBnxUw1OyWLbVEFXgPc/YjmfyyQjfeGAA7G1QlY=";
   };
 
   cargoLock = {

pkgs/by-name/mc/mcap-cli/package.nix

@@ -1,7 +1,7 @@
 { lib, buildGoModule, fetchFromGitHub, nix-update-script
 }:
 let
-  version = "0.0.42";
+  version = "0.0.43";
 in
 buildGoModule {
 
@@ -13,10 +13,10 @@ buildGoModule {
     repo = "mcap";
     owner = "foxglove";
     rev = "releases/mcap-cli/v${version}";
-    hash = "sha256-9fjzMUMWn5j8AJJq+tK+Hq0o8d3HpacitJZ5CfLiaLw=";
+    hash = "sha256-AWmPqymnNZxKbhxiQOO9djQXbP56mNh9Ucmty2jd+4Q=";
   };
 
-  vendorHash = "sha256-Gl0zLBTWscKGtVOS6rPRL/r8KHYHpZwoUDbEyCL4Ijk=";
+  vendorHash = "sha256-YFbfrqu2H7yU6vANH56MnxipDxaJLT76qZkvqLCFTTg=";
 
   modRoot = "go/cli/mcap";
 

pkgs/by-name/mp/mpris-notifier/package.nix

@@ -0,0 +1,32 @@
+{ lib
+, rustPlatform
+, fetchFromGitHub
+, stdenv
+, darwin
+}:
+
+rustPlatform.buildRustPackage rec {
+  pname = "mpris-notifier";
+  version = "0.1.7";
+
+  src = fetchFromGitHub {
+    owner = "l1na-forever";
+    repo = "mpris-notifier";
+    rev = "v${version}";
+    hash = "sha256-B1nfVsn95oe2FlHFjb9O4tfL/EqsZZ4JGF0mbJcCg2Y=";
+  };
+
+  cargoHash = "sha256-8WzG712/soPgooyR35L8aFIRfPC2MvV3vCcPbkTgoF0=";
+
+  buildInputs = lib.optionals stdenv.isDarwin [
+    darwin.apple_sdk.frameworks.Security
+  ];
+
+  meta = with lib; {
+    description = "Dependency-light, highly-customizable, XDG desktop notification generator for MPRIS status changes";
+    homepage = "https://github.com/l1na-forever/mpris-notifier";
+    license = licenses.mit;
+    maintainers = with maintainers; [ leixb ];
+    mainProgram = "mpris-notifier";
+  };
+}

pkgs/by-name/my/myxer/package.nix

@@ -0,0 +1,44 @@
+{ lib
+, rustPlatform
+, fetchFromGitHub
+, pkg-config
+, wrapGAppsHook
+, libpulseaudio
+, glib
+, pango
+, gtk3
+}:
+
+rustPlatform.buildRustPackage rec {
+  pname = "myxer";
+  version = "1.3.0";
+
+  src = fetchFromGitHub {
+    owner = "Aurailus";
+    repo = "myxer";
+    rev = version;
+    hash = "sha256-c5SHjnhWLp0jMdmDlupMTA0hWphub5DFY1vOI6NW8E0=";
+  };
+
+  cargoHash = "sha256-IH+SLIHO/wu+przH+mgOEnH9m+iAE5s/BJhh0UUHR/0=";
+
+  nativeBuildInputs = [ pkg-config wrapGAppsHook ];
+
+  buildInputs = [ libpulseaudio glib pango gtk3 ];
+
+  postInstall = ''
+    install -Dm644 Myxer.desktop $out/share/applications/Myxer.desktop
+  '';
+
+  # Currently no tests are implemented, so we avoid building the package twice
+  doCheck = false;
+
+  meta = with lib; {
+    description = "A modern Volume Mixer for PulseAudio";
+    homepage = "https://github.com/Aurailus/Myxer";
+    license = licenses.gpl3Only;
+    maintainers = with maintainers; [ erin rster2002 ];
+    mainProgram = "myxer";
+    platforms = platforms.linux;
+  };
+}

pkgs/by-name/ne/nezha-agent/package.nix

@@ -7,16 +7,16 @@
 }:
 buildGoModule rec {
   pname = "nezha-agent";
-  version = "0.16.4";
+  version = "0.16.5";
 
   src = fetchFromGitHub {
     owner = "nezhahq";
     repo = "agent";
     rev = "v${version}";
-    hash = "sha256-xXv2FVPsl8BR51VMrFreaS3UQLEJwfObY4OeMMb8pms=";
+    hash = "sha256-WRHYI3/6qrVZRa4ANA6VBBJCaINP1N8Xjy0GWO4LqgA=";
   };
 
-  vendorHash = "sha256-ZlheRFgl3vsUXVx8PKZQ59kme2NC31OQAL6EaNhbf70=";
+  vendorHash = "sha256-AtcRfvYBgTZJz9dpsMgacnV8RNi2Ph7QgUrcE6zzTo8=";
 
   ldflags = [
     "-s"
@@ -40,6 +40,6 @@ buildGoModule rec {
     description = "Agent of Nezha Monitoring";
     homepage = "https://github.com/nezhahq/agent";
     license = licenses.asl20;
-    maintainers = with maintainers; [moraxyc];
+    maintainers = with maintainers; [ moraxyc ];
   };
 }

pkgs/by-name/no/nom/package.nix

@@ -1,16 +1,17 @@
-{ lib
+{
-, buildGoModule
+  lib,
-, fetchFromGitHub
+  buildGoModule,
+  fetchFromGitHub,
 }:
 buildGoModule rec {
   pname = "nom";
-  version = "2.1.4";
+  version = "2.1.6";
 
   src = fetchFromGitHub {
     owner = "guyfedwards";
     repo = "nom";
     rev = "v${version}";
-    hash = "sha256-W0vfYAEQYixbnOQhA59sj2uSAcbqoS/OMiB3TfXsv/Y=";
+    hash = "sha256-NOPzznopH+PeSEMzO1vMHOSbmy9/v2yT4VC4kAsdbGw";
   };
 
   vendorHash = "sha256-fP6yxfIQoVaBC9hYcrCyo3YP3ntEVDbDTwKMO9TdyDI=";

pkgs/by-name/or/orchard/package.nix

@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "orchard";
-  version = "0.16.1";
+  version = "0.17.0";
 
   src = fetchFromGitHub {
     owner = "cirruslabs";
     repo = pname;
     rev = version;
-    hash = "sha256-wuLlxyCyMgtKBW5MD7HJM3q+tsXOBTjGyNYuV9jDbEg=";
+    hash = "sha256-mOlAMlvWEdkPxvhqrt7PHJjmtUBRsFwsSchHRQtaACc=";
     # populate values that require us to use git. By doing this in postFetch we
     # can delete .git afterwards and maintain better reproducibility of the src.
     leaveDotGit = true;

pkgs/by-name/pr/proton-ge-bin/package.nix

@@ -5,11 +5,11 @@
 }:
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "proton-ge-bin";
-  version = "GE-Proton9-2";
+  version = "GE-Proton9-4";
 
   src = fetchzip {
     url = "https://github.com/GloriousEggroll/proton-ge-custom/releases/download/${finalAttrs.version}/${finalAttrs.version}.tar.gz";
-    hash = "sha256-NqBzKonCYH+hNpVZzDhrVf+r2i6EwLG/IFBXjE2mC7s=";
+    hash = "sha256-OR4SUqm5Xsycv/KVBW2Ug/lz4Xr6IQBp8gXacorRe3U=";
   };
 
   outputs = [ "out" "steamcompattool" ];

pkgs/by-name/py/pyright/package-lock.json

@@ -0,0 +1,193 @@
+{
+  "name": "pyright-root",
+  "lockfileVersion": 2,
+  "requires": true,
+  "packages": {
+    "": {
+      "name": "pyright-root",
+      "hasInstallScript": true,
+      "dependencies": {
+        "glob": "^7.2.3",
+        "jsonc-parser": "^3.2.1"
+      }
+    },
+    "node_modules/balanced-match": {
+      "version": "1.0.2",
+      "resolved": "https://registry.npmjs.org/balanced-match/-/balanced-match-1.0.2.tgz",
+      "integrity": "sha512-3oSeUO0TMV67hN1AmbXsK4yaqU7tjiHlbxRDZOpH0KW9+CeX4bRAaX0Anxt0tx2MrpRpWwQaPwIlISEJhYU5Pw=="
+    },
+    "node_modules/brace-expansion": {
+      "version": "1.1.11",
+      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.11.tgz",
+      "integrity": "sha512-iCuPHDFgrHX7H2vEI/5xpz07zSHB00TpugqhmYtVmMO6518mCuRMoOYFldEBl0g187ufozdaHgWKcYFb61qGiA==",
+      "dependencies": {
+        "balanced-match": "^1.0.0",
+        "concat-map": "0.0.1"
+      }
+    },
+    "node_modules/concat-map": {
+      "version": "0.0.1",
+      "resolved": "https://registry.npmjs.org/concat-map/-/concat-map-0.0.1.tgz",
+      "integrity": "sha512-/Srv4dswyQNBfohGpz9o6Yb3Gz3SrUDqBH5rTuhGR7ahtlbYKnVxw2bCFMRljaA7EXHaXZ8wsHdodFvbkhKmqg=="
+    },
+    "node_modules/fs.realpath": {
+      "version": "1.0.0",
+      "resolved": "https://registry.npmjs.org/fs.realpath/-/fs.realpath-1.0.0.tgz",
+      "integrity": "sha512-OO0pH2lK6a0hZnAdau5ItzHPI6pUlvI7jMVnxUQRtw4owF2wk8lOSabtGDCTP4Ggrg2MbGnWO9X8K1t4+fGMDw=="
+    },
+    "node_modules/glob": {
+      "version": "7.2.3",
+      "resolved": "https://registry.npmjs.org/glob/-/glob-7.2.3.tgz",
+      "integrity": "sha512-nFR0zLpU2YCaRxwoCJvL6UvCH2JFyFVIvwTLsIf21AuHlMskA1hhTdk+LlYJtOlYt9v6dvszD2BGRqBL+iQK9Q==",
+      "dependencies": {
+        "fs.realpath": "^1.0.0",
+        "inflight": "^1.0.4",
+        "inherits": "2",
+        "minimatch": "^3.1.1",
+        "once": "^1.3.0",
+        "path-is-absolute": "^1.0.0"
+      },
+      "engines": {
+        "node": "*"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/isaacs"
+      }
+    },
+    "node_modules/inflight": {
+      "version": "1.0.6",
+      "resolved": "https://registry.npmjs.org/inflight/-/inflight-1.0.6.tgz",
+      "integrity": "sha512-k92I/b08q4wvFscXCLvqfsHCrjrF7yiXsQuIVvVE7N82W3+aqpzuUdBbfhWcy/FZR3/4IgflMgKLOsvPDrGCJA==",
+      "dependencies": {
+        "once": "^1.3.0",
+        "wrappy": "1"
+      }
+    },
+    "node_modules/inherits": {
+      "version": "2.0.4",
+      "resolved": "https://registry.npmjs.org/inherits/-/inherits-2.0.4.tgz",
+      "integrity": "sha512-k/vGaX4/Yla3WzyMCvTQOXYeIHvqOKtnqBduzTHpzpQZzAskKMhZ2K+EnBiSM9zGSoIFeMpXKxa4dYeZIQqewQ=="
+    },
+    "node_modules/jsonc-parser": {
+      "version": "3.2.1",
+      "resolved": "https://registry.npmjs.org/jsonc-parser/-/jsonc-parser-3.2.1.tgz",
+      "integrity": "sha512-AilxAyFOAcK5wA1+LeaySVBrHsGQvUFCDWXKpZjzaL0PqW+xfBOttn8GNtWKFWqneyMZj41MWF9Kl6iPWLwgOA=="
+    },
+    "node_modules/minimatch": {
+      "version": "3.1.2",
+      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-3.1.2.tgz",
+      "integrity": "sha512-J7p63hRiAjw1NDEww1W7i37+ByIrOWO5XQQAzZ3VOcL0PNybwpfmV/N05zFAzwQ9USyEcX6t3UO+K5aqBQOIHw==",
+      "dependencies": {
+        "brace-expansion": "^1.1.7"
+      },
+      "engines": {
+        "node": "*"
+      }
+    },
+    "node_modules/once": {
+      "version": "1.4.0",
+      "resolved": "https://registry.npmjs.org/once/-/once-1.4.0.tgz",
+      "integrity": "sha512-lNaJgI+2Q5URQBkccEKHTQOPaXdUxnZZElQTZY0MFUAuaEqe1E+Nyvgdz/aIyNi6Z9MzO5dv1H8n58/GELp3+w==",
+      "dependencies": {
+        "wrappy": "1"
+      }
+    },
+    "node_modules/path-is-absolute": {
+      "version": "1.0.1",
+      "resolved": "https://registry.npmjs.org/path-is-absolute/-/path-is-absolute-1.0.1.tgz",
+      "integrity": "sha512-AVbw3UJ2e9bq64vSaS9Am0fje1Pa8pbGqTTsmXfaIiMpnr5DlDhfJOuLj9Sf95ZPVDAUerDfEk88MPmPe7UCQg==",
+      "engines": {
+        "node": ">=0.10.0"
+      }
+    },
+    "node_modules/wrappy": {
+      "version": "1.0.2",
+      "resolved": "https://registry.npmjs.org/wrappy/-/wrappy-1.0.2.tgz",
+      "integrity": "sha512-l4Sp/DRseor9wL6EvV2+TuQn63dMkPjZ/sp9XkghTEbV9KlPS1xUsZ3u7/IQO4wxtcFB4bgpQPRcR3QCvezPcQ=="
+    }
+  },
+  "dependencies": {
+    "balanced-match": {
+      "version": "1.0.2",
+      "resolved": "https://registry.npmjs.org/balanced-match/-/balanced-match-1.0.2.tgz",
+      "integrity": "sha512-3oSeUO0TMV67hN1AmbXsK4yaqU7tjiHlbxRDZOpH0KW9+CeX4bRAaX0Anxt0tx2MrpRpWwQaPwIlISEJhYU5Pw=="
+    },
+    "brace-expansion": {
+      "version": "1.1.11",
+      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.11.tgz",
+      "integrity": "sha512-iCuPHDFgrHX7H2vEI/5xpz07zSHB00TpugqhmYtVmMO6518mCuRMoOYFldEBl0g187ufozdaHgWKcYFb61qGiA==",
+      "requires": {
+        "balanced-match": "^1.0.0",
+        "concat-map": "0.0.1"
+      }
+    },
+    "concat-map": {
+      "version": "0.0.1",
+      "resolved": "https://registry.npmjs.org/concat-map/-/concat-map-0.0.1.tgz",
+      "integrity": "sha512-/Srv4dswyQNBfohGpz9o6Yb3Gz3SrUDqBH5rTuhGR7ahtlbYKnVxw2bCFMRljaA7EXHaXZ8wsHdodFvbkhKmqg=="
+    },
+    "fs.realpath": {
+      "version": "1.0.0",
+      "resolved": "https://registry.npmjs.org/fs.realpath/-/fs.realpath-1.0.0.tgz",
+      "integrity": "sha512-OO0pH2lK6a0hZnAdau5ItzHPI6pUlvI7jMVnxUQRtw4owF2wk8lOSabtGDCTP4Ggrg2MbGnWO9X8K1t4+fGMDw=="
+    },
+    "glob": {
+      "version": "7.2.3",
+      "resolved": "https://registry.npmjs.org/glob/-/glob-7.2.3.tgz",
+      "integrity": "sha512-nFR0zLpU2YCaRxwoCJvL6UvCH2JFyFVIvwTLsIf21AuHlMskA1hhTdk+LlYJtOlYt9v6dvszD2BGRqBL+iQK9Q==",
+      "requires": {
+        "fs.realpath": "^1.0.0",
+        "inflight": "^1.0.4",
+        "inherits": "2",
+        "minimatch": "^3.1.1",
+        "once": "^1.3.0",
+        "path-is-absolute": "^1.0.0"
+      }
+    },
+    "inflight": {
+      "version": "1.0.6",
+      "resolved": "https://registry.npmjs.org/inflight/-/inflight-1.0.6.tgz",
+      "integrity": "sha512-k92I/b08q4wvFscXCLvqfsHCrjrF7yiXsQuIVvVE7N82W3+aqpzuUdBbfhWcy/FZR3/4IgflMgKLOsvPDrGCJA==",
+      "requires": {
+        "once": "^1.3.0",
+        "wrappy": "1"
+      }
+    },
+    "inherits": {
+      "version": "2.0.4",
+      "resolved": "https://registry.npmjs.org/inherits/-/inherits-2.0.4.tgz",
+      "integrity": "sha512-k/vGaX4/Yla3WzyMCvTQOXYeIHvqOKtnqBduzTHpzpQZzAskKMhZ2K+EnBiSM9zGSoIFeMpXKxa4dYeZIQqewQ=="
+    },
+    "jsonc-parser": {
+      "version": "3.2.1",
+      "resolved": "https://registry.npmjs.org/jsonc-parser/-/jsonc-parser-3.2.1.tgz",
+      "integrity": "sha512-AilxAyFOAcK5wA1+LeaySVBrHsGQvUFCDWXKpZjzaL0PqW+xfBOttn8GNtWKFWqneyMZj41MWF9Kl6iPWLwgOA=="
+    },
+    "minimatch": {
+      "version": "3.1.2",
+      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-3.1.2.tgz",
+      "integrity": "sha512-J7p63hRiAjw1NDEww1W7i37+ByIrOWO5XQQAzZ3VOcL0PNybwpfmV/N05zFAzwQ9USyEcX6t3UO+K5aqBQOIHw==",
+      "requires": {
+        "brace-expansion": "^1.1.7"
+      }
+    },
+    "once": {
+      "version": "1.4.0",
+      "resolved": "https://registry.npmjs.org/once/-/once-1.4.0.tgz",
+      "integrity": "sha512-lNaJgI+2Q5URQBkccEKHTQOPaXdUxnZZElQTZY0MFUAuaEqe1E+Nyvgdz/aIyNi6Z9MzO5dv1H8n58/GELp3+w==",
+      "requires": {
+        "wrappy": "1"
+      }
+    },
+    "path-is-absolute": {
+      "version": "1.0.1",
+      "resolved": "https://registry.npmjs.org/path-is-absolute/-/path-is-absolute-1.0.1.tgz",
+      "integrity": "sha512-AVbw3UJ2e9bq64vSaS9Am0fje1Pa8pbGqTTsmXfaIiMpnr5DlDhfJOuLj9Sf95ZPVDAUerDfEk88MPmPe7UCQg=="
+    },
+    "wrappy": {
+      "version": "1.0.2",
+      "resolved": "https://registry.npmjs.org/wrappy/-/wrappy-1.0.2.tgz",
+      "integrity": "sha512-l4Sp/DRseor9wL6EvV2+TuQn63dMkPjZ/sp9XkghTEbV9KlPS1xUsZ3u7/IQO4wxtcFB4bgpQPRcR3QCvezPcQ=="
+    }
+  }
+}

pkgs/by-name/py/pyright/package.nix

@@ -0,0 +1,75 @@
+{ lib, buildNpmPackage, fetchFromGitHub, runCommand, jq }:
+
+let
+  version = "1.1.359";
+
+  src = fetchFromGitHub {
+    owner = "Microsoft";
+    repo = "pyright";
+    rev = "${version}";
+    hash = "sha256-gqMAfmYjYO6D9sRu+uJv4yJ/+csioFAwsUPBDF29VDs=";
+  };
+
+  patchedPackageJSON = runCommand "package.json" { } ''
+    ${jq}/bin/jq '
+      .devDependencies |= with_entries(select(.key == "glob" or .key == "jsonc-parser"))
+      | .scripts =  {  }
+      ' ${src}/package.json > $out
+  '';
+
+  pyright-root = buildNpmPackage {
+    pname = "pyright-root";
+    inherit version src;
+    npmDepsHash = "sha256-63kUhKrxtJhwGCRBnxBfOFXs2ARCNn+OOGu6+fSJey4=";
+    dontNpmBuild = true;
+    postPatch = ''
+      cp ${patchedPackageJSON} ./package.json
+      cp ${./package-lock.json} ./package-lock.json
+    '';
+    installPhase = ''
+      runHook preInstall
+      cp -r . "$out"
+      runHook postInstall
+    '';
+  };
+
+  pyright-internal = buildNpmPackage {
+    pname = "pyright-internal";
+    inherit version src;
+    sourceRoot = "${src.name}/packages/pyright-internal";
+    npmDepsHash = "sha256-p2KamNFJ3sJHmJm0MEPhI8L/8zAVzfc9NYy24rAdFcQ=";
+    dontNpmBuild = true;
+    installPhase = ''
+      runHook preInstall
+      cp -r . "$out"
+      runHook postInstall
+    '';
+  };
+in
+buildNpmPackage rec {
+  pname = "pyright";
+  inherit version src;
+
+  sourceRoot = "${src.name}/packages/pyright";
+  npmDepsHash = "sha256-U7WdMIYg9U4fJ8YtDruMzloRS2BQAa2QWExle9uwPbU=";
+
+  postPatch = ''
+    chmod +w ../../
+    ln -s ${pyright-root}/node_modules ../../node_modules
+    chmod +w ../pyright-internal
+    ln -s ${pyright-internal}/node_modules ../pyright-internal/node_modules
+  '';
+
+  dontNpmBuild = true;
+
+  passthru.updateScript = ./update.sh;
+
+  meta = {
+    changelog = "https://github.com/Microsoft/pyright/releases/tag/${version}";
+    description = "Type checker for the Python language";
+    homepage = "https://github.com/Microsoft/pyright";
+    license = lib.licenses.mit;
+    mainProgram = "pyright";
+    maintainers = with lib.maintainers; [ kalekseev ];
+  };
+}

pkgs/by-name/py/pyright/update.sh

@@ -0,0 +1,44 @@
+#!/usr/bin/env nix-shell
+#!nix-shell -i bash -p curl gnused common-updater-scripts jq prefetch-npm-deps
+set -euo pipefail
+
+version=$(curl ${GITHUB_TOKEN:+" -u \":$GITHUB_TOKEN\""} -s https://api.github.com/repos/microsoft/pyright/releases/latest | jq -r '.tag_name | sub("^v"; "")')
+
+update-source-version pyright "$version"
+
+root="$(dirname "$(readlink -f "$0")")"
+FILE_PATH="$root/package.nix"
+REPO_URL_PREFIX="https://github.com/microsoft/pyright/raw"
+TEMP_DIR=$(mktemp -d)
+
+trap 'rm -rf "$TEMP_DIR"' EXIT
+
+# Function to download `package-lock.json` for a given source path and update hash
+update_hash() {
+    local source_root_path="$1"
+    local existing_hash="$2"
+
+    # Formulate download URL
+    local download_url="${REPO_URL_PREFIX}/${version}${source_root_path}/package-lock.json"
+
+    # Download package-lock.json to temporary directory
+    curl -fsSL -o "${TEMP_DIR}/package-lock.json" "$download_url"
+
+    # Calculate the new hash
+    local new_hash
+    new_hash=$(prefetch-npm-deps "${TEMP_DIR}/package-lock.json")
+
+    # Update npmDepsHash in the original file
+    sed -i "s|$existing_hash|${new_hash}|" "$FILE_PATH"
+}
+
+while IFS= read -r source_root_line; do
+    [[ "$source_root_line" =~ sourceRoot ]] || continue
+    source_root_path=$(echo "$source_root_line" | sed -e 's/^.*"${src.name}\(.*\)";.*$/\1/')
+
+    # Extract the current npmDepsHash for this sourceRoot
+    existing_hash=$(grep -A1 "$source_root_line" "$FILE_PATH" | grep 'npmDepsHash' | sed -e 's/^.*npmDepsHash = "\(.*\)";$/\1/')
+
+    # Call the function to download and update the hash
+    update_hash "$source_root_path" "$existing_hash"
+done < "$FILE_PATH"

pkgs/by-name/ri/rippkgs/package.nix

@@ -0,0 +1,36 @@
+{ lib
+, rustPlatform
+, fetchFromGitHub
+, pkg-config
+, sqlite
+}:
+
+rustPlatform.buildRustPackage rec {
+  pname = "rippkgs";
+  version = "1.1.0";
+
+  src = fetchFromGitHub {
+    owner = "replit";
+    repo = "rippkgs";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-qQZnD9meczfsQv1R68IiUfPq730I2IyesurrOhtA3es=";
+  };
+
+  cargoHash = "sha256-hGSHgJ2HVCNqTBsTQIZlSE89FKqdMifuJyAGl3utF2I=";
+
+  nativeBuildInputs = [
+    pkg-config
+  ];
+
+  buildInputs = [
+    sqlite
+  ];
+
+  meta = {
+    description = "A CLI for indexing and searching packages in Nix expressions";
+    homepage = "https://github.com/replit/rippkgs";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ eclairevoyant ];
+    mainProgram = "rippkgs";
+  };
+}

pkgs/by-name/sn/snapcraft/lxd-socket-path.patch

@@ -0,0 +1,13 @@
+diff --git a/snapcraft_legacy/internal/build_providers/_lxd/_lxd.py b/snapcraft_legacy/internal/build_providers/_lxd/_lxd.py
+index 5fa4f898..41264ebb 100644
+--- a/snapcraft_legacy/internal/build_providers/_lxd/_lxd.py
++++ b/snapcraft_legacy/internal/build_providers/_lxd/_lxd.py
+@@ -142,7 +142,7 @@ class LXD(Provider):
+             build_provider_flags=build_provider_flags,
+         )
+         # This endpoint is hardcoded everywhere lxc/lxd-pkg-snap#33
+-        lxd_socket_path = "/var/snap/lxd/common/lxd/unix.socket"
++        lxd_socket_path = "/var/lib/lxd/unix.socket"
+         endpoint = "http+unix://{}".format(urllib.parse.quote(lxd_socket_path, safe=""))
+         try:
+             self._lxd_client: pylxd.Client = pylxd.Client(endpoint=endpoint)

pkgs/by-name/sn/snapcraft/os-platform.patch

@@ -0,0 +1,21 @@
+diff --git a/snapcraft/utils.py b/snapcraft/utils.py
+index 511effe2..4af5a029 100644
+--- a/snapcraft/utils.py
++++ b/snapcraft/utils.py
+@@ -15,6 +15,7 @@
+ # along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ 
+ """Utilities for snapcraft."""
++
+ import multiprocessing
+ import os
+ import pathlib
+@@ -91,7 +92,7 @@ def get_os_platform(
+     release = platform.release()
+     machine = platform.machine()
+ 
+-    if system == "Linux":
++    if system == "Linux" and "NixOS" not in platform.version():
+         try:
+             with filepath.open("rt", encoding="utf-8") as release_file:
+                 lines = release_file.readlines()

pkgs/by-name/sn/snapcraft/package.nix

@@ -0,0 +1,188 @@
+{
+  fetchFromGitHub,
+  git,
+  glibc,
+  lib,
+  makeWrapper,
+  nix-update-script,
+  python3Packages,
+  squashfsTools,
+  stdenv,
+}:
+python3Packages.buildPythonApplication rec {
+  pname = "snapcraft";
+  version = "8.2.0";
+
+  pyproject = true;
+
+  # Somewhere deep in the dependency tree is 'versioningit', which depends
+  # on pydantic 2. Snapcraft will soon migrate to pydantic 2, and disabling
+  # this doesn't seem to affect the functionality of the application.
+  catchConflicts = false;
+
+  src = fetchFromGitHub {
+    owner = "canonical";
+    repo = "snapcraft";
+    rev = "refs/tags/${version}";
+    hash = "sha256-uRapRL+492FOju83o3OBsYK52hwOOG6b4EbdMVpAlBs=";
+  };
+
+  patches = [
+    # Snapcraft is only officially distributed as a snap, as is LXD. The socket
+    # path for LXD must be adjusted so that it's at the correct location for LXD
+    # on NixOS. This patch will likely never be accepted upstream.
+    ./lxd-socket-path.patch
+    # In certain places, Snapcraft expects an /etc/os-release file to determine
+    # host info which doesn't exist in our test environment. This is a
+    # relatively naive patch which helps the test suite pass - without it *many*
+    # of the tests fail. This patch will likely never be accepted upstream.
+    ./os-platform.patch
+    # Snapcraft will try to inject itself as a snap *from the host system* into
+    # the build system. This patch short-circuits that logic and ensures that
+    # Snapcraft is installed on the build system from the snap store - because
+    # there is no snapd on NixOS hosts that can be used for the injection. This
+    # patch will likely never be accepted upstream.
+    ./set-channel-for-nix.patch
+    # Certain paths (for extensions, schemas) are packaged in the snap by the
+    # upstream, so the paths are well-known, except here where Snapcraft is
+    # *not* in a snap, so this patch changes those paths to point to the correct
+    # place in the Nix store. This patch will likely never be accepted upstream.
+    ./snapcraft-data-dirs.patch
+  ];
+
+  postPatch = ''
+    substituteInPlace setup.py \
+      --replace-fail 'version=determine_version()' 'version="${version}"' \
+      --replace-fail 'gnupg' 'python-gnupg'
+
+    substituteInPlace requirements.txt \
+      --replace-fail 'gnupg==2.3.1' 'python-gnupg'
+
+    substituteInPlace snapcraft/__init__.py \
+      --replace-fail '__version__ = _get_version()' '__version__ = "${version}"'
+
+    substituteInPlace snapcraft_legacy/__init__.py \
+      --replace-fail '__version__ = _get_version()' '__version__ = "${version}"'
+
+    substituteInPlace snapcraft/elf/elf_utils.py \
+      --replace-fail 'arch_linker_path = Path(arch_config.dynamic_linker)' \
+      'return str(Path("${glibc}/lib/ld-linux-x86-64.so.2"))'
+  '';
+
+  buildInputs = [ makeWrapper ];
+
+  propagatedBuildInputs = with python3Packages; [
+    attrs
+    catkin-pkg
+    click
+    craft-application
+    craft-archives
+    craft-cli
+    craft-grammar
+    craft-parts
+    craft-providers
+    craft-store
+    debian
+    docutils
+    jsonschema
+    launchpadlib
+    lazr-restfulclient
+    lxml
+    macaroonbakery
+    mypy-extensions
+    progressbar
+    pyelftools
+    pygit2
+    pylxd
+    python-apt
+    python-gnupg
+    raven
+    requests-toolbelt
+    simplejson
+    snap-helpers
+    tabulate
+    tinydb
+  ];
+
+  nativeBuildInputs = with python3Packages; [
+    pythonRelaxDepsHook
+    setuptools
+  ];
+
+  pythonRelaxDeps = [
+    "docutils"
+    "jsonschema"
+    "pygit2"
+    "urllib3"
+  ];
+
+  postInstall = ''
+    wrapProgram $out/bin/snapcraft --prefix PATH : ${squashfsTools}/bin
+  '';
+
+  nativeCheckInputs = with python3Packages; [
+    pytest-check
+    pytest-cov
+    pytest-mock
+    pytest-subprocess
+    pytestCheckHook
+    responses
+  ] ++ [
+    git
+    squashfsTools
+  ];
+
+  preCheck = ''
+    mkdir -p check-phase
+    export HOME="$(pwd)/check-phase"
+  '';
+
+  pytestFlagsArray = [ "tests/unit" ];
+
+  disabledTests = [
+    "test_bin_echo"
+    "test_classic_linter_filter"
+    "test_classic_linter"
+    "test_complex_snap_yaml"
+    "test_get_base_configuration_snap_channel"
+    "test_get_base_configuration_snap_instance_name_default"
+    "test_get_base_configuration_snap_instance_name_not_running_as_snap"
+    "test_get_extensions_data_dir"
+    "test_get_os_platform_alternative_formats"
+    "test_get_os_platform_linux"
+    "test_get_os_platform_windows"
+    "test_lifecycle_pack_components_with_output"
+    "test_lifecycle_pack_components"
+    "test_lifecycle_write_component_metadata"
+    "test_parse_info_integrated"
+    "test_patch_elf"
+    "test_remote_builder_init"
+    "test_setup_assets_remote_icon"
+    "test_snap_command_fallback"
+    "test_validate_architectures_supported"
+    "test_validate_architectures_unsupported"
+  ] ++ lib.optionals stdenv.isAarch64 [
+    "test_load_project"
+  ];
+
+  disabledTestPaths = [
+    "tests/unit/commands/test_remote.py"
+    "tests/unit/elf"
+    "tests/unit/linters/test_classic_linter.py"
+    "tests/unit/linters/test_library_linter.py"
+    "tests/unit/parts/test_parts.py"
+    "tests/unit/services"
+  ];
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    mainProgram = "snapcraft";
+    description = "Build and publish Snap packages";
+    homepage = "https://github.com/canonical/snapcraft";
+    changelog = "https://github.com/canonical/snapcraft/releases/tag/${version}";
+    license = lib.licenses.gpl3Only;
+    maintainers = with lib.maintainers; [ jnsgruk ];
+    platforms = lib.platforms.linux;
+  };
+}

pkgs/by-name/sn/snapcraft/set-channel-for-nix.patch

@@ -0,0 +1,30 @@
+diff --git a/snapcraft/providers.py b/snapcraft/providers.py
+index a999537a..dcd290a7 100644
+--- a/snapcraft/providers.py
++++ b/snapcraft/providers.py
+@@ -21,6 +21,7 @@ import sys
+ from pathlib import Path
+ from textwrap import dedent
+ from typing import Dict, Optional
++import platform
+ 
+ from craft_cli import emit
+ from craft_providers import Provider, ProviderError, bases, executor
+@@ -178,14 +179,14 @@ def get_base_configuration(
+     # injecting a snap on a non-linux system is not supported, so default to
+     # install snapcraft from the store's stable channel
+     snap_channel = get_managed_environment_snap_channel()
+-    if sys.platform != "linux" and not snap_channel:
++    if snap_channel is None and (sys.platform != "linux" or "NixOS" in platform.version()):
+         emit.progress(
+-            "Using snapcraft from snap store channel 'latest/stable' in instance "
++            "Using snapcraft from snap store channel 'latest/beta' in instance "
+             "because snap injection is only supported on Linux hosts.",
+             permanent=True,
+         )
+         snap_name = "snapcraft"
+-        snap_channel = "stable"
++        snap_channel = "beta"
+     elif is_snapcraft_running_from_snap():
+         # Use SNAP_INSTANCE_NAME for snapcraft's snap name, as it may not be
+         # 'snapcraft' if the '--name' parameter was used to install snapcraft.

pkgs/by-name/sn/snapcraft/snapcraft-data-dirs.patch

@@ -0,0 +1,26 @@
+diff --git a/snapcraft_legacy/internal/common.py b/snapcraft_legacy/internal/common.py
+index 6017b405..aacd99a5 100644
+--- a/snapcraft_legacy/internal/common.py
++++ b/snapcraft_legacy/internal/common.py
+@@ -34,14 +34,17 @@ from snaphelpers import SnapConfigOptions, SnapCtlError
+ 
+ from snapcraft_legacy.internal import errors
+ 
++# Get the path to the Nix store entry for Snapcraft at runtime
++drv = os.path.realpath(__file__).split("/")[3]
++
+ SNAPCRAFT_FILES = ["parts", "stage", "prime"]
+-_DEFAULT_PLUGINDIR = os.path.join(sys.prefix, "share", "snapcraft", "plugins")
++_DEFAULT_PLUGINDIR = os.path.join(os.sep, "nix", "store", drv, "share", "snapcraft", "plugins")
+ _plugindir = _DEFAULT_PLUGINDIR
+-_DEFAULT_SCHEMADIR = os.path.join(sys.prefix, "share", "snapcraft", "schema")
++_DEFAULT_SCHEMADIR = os.path.join(os.sep, "nix", "store", drv, "share", "snapcraft", "schema")
+ _schemadir = _DEFAULT_SCHEMADIR
+-_DEFAULT_EXTENSIONSDIR = os.path.join(sys.prefix, "share", "snapcraft", "extensions")
++_DEFAULT_EXTENSIONSDIR = os.path.join(os.sep, "nix", "store", drv, "share", "snapcraft", "extensions")
+ _extensionsdir = _DEFAULT_EXTENSIONSDIR
+-_DEFAULT_KEYRINGSDIR = os.path.join(sys.prefix, "share", "snapcraft", "keyrings")
++_DEFAULT_KEYRINGSDIR = os.path.join(os.sep, "nix", "store", drv, "share", "snapcraft", "keyrings")
+ _keyringsdir = _DEFAULT_KEYRINGSDIR
+ 
+ _DOCKERENV_FILE = "/.dockerenv"

pkgs/by-name/so/solitaire-tui/package.nix

@@ -0,0 +1,28 @@
+{ lib
+, fetchFromGitHub
+, buildGoModule
+}:
+
+buildGoModule {
+  pname = "solitaire-tui";
+  version = "0-unstable-2023-04-20";
+
+  src = fetchFromGitHub {
+    owner = "brianstrauch";
+    repo = "solitaire-tui";
+    rev = "45fffc4b13dbf1056f25a01c612dd835ddab5501";
+    hash = "sha256-xbqKtqFVvL+1x/SDoMEJ1LgnTy31LmZ/Je8K/bhP2bI=";
+  };
+
+  vendorHash = "sha256-jFbxT0ekimBNjIHGgMmCUrwZTS3Sdop/MFQMVdBF/38=";
+
+  ldflags = [ "-s" "-w" ];
+
+  meta = with lib; {
+    homepage = "https://github.com/brianstrauch/solitaire-tui";
+    description = "Klondike solitaire for the terminal";
+    mainProgram = "solitaire-tui";
+    maintainers = with maintainers; [ nyadiia ];
+    license = licenses.asl20;
+  };
+}

pkgs/by-name/ss/ssimulacra2/package.nix

@@ -0,0 +1,49 @@
+{ lib
+, stdenv
+, fetchFromGitHub
+, ninja
+, cmake
+, libpng
+, libhwy
+, lcms2
+, giflib
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "ssimulacra2";
+  version = "2.1";
+
+  src = fetchFromGitHub {
+    owner = "cloudinary";
+    repo = "ssimulacra2";
+    hash = "sha256-gOo8WCWMdXOSmny0mQSzCvHgURQTCNBFD4G4sxfmXik=";
+    rev = "tags/v${finalAttrs.version}";
+  };
+
+  nativeBuildInputs = [
+    ninja
+    cmake
+  ];
+
+  buildInputs = [
+    libpng
+    libhwy
+    lcms2
+    giflib
+  ];
+
+  sourceRoot = "${finalAttrs.src.name}/src";
+
+  installPhase = ''
+    runHook preInstall
+    install -m 755 -D ssimulacra2 -t $out/bin/
+    runHook postInstall
+  '';
+
+  meta = with lib; {
+    homepage = "https://github.com/cloudinary/ssimulacra2";
+    maintainers = [ maintainers.viraptor ];
+    license = licenses.bsd3;
+    description = "Perceptual image comparison tool";
+  };
+})

pkgs/by-name/su/supersonic/package.nix

@@ -20,16 +20,16 @@ assert waylandSupport -> stdenv.isLinux;
 
 buildGoModule rec {
   pname = "supersonic" + lib.optionalString waylandSupport "-wayland";
-  version = "0.9.1";
+  version = "0.10.0";
 
   src = fetchFromGitHub {
     owner = "dweymouth";
     repo = "supersonic";
     rev = "v${version}";
-    hash = "sha256-R9Bn+xFq8pBSuGX1okA3l/7ralKodKDxcpGov9diuxw=";
+    hash = "sha256-sleXZnJ/JPlyCMf6Js+Yym1RhtfZT7Q+qYAWLCavZFA=";
   };
 
-  vendorHash = "sha256-4Un1twPfjRfLVl91GqYJsyY8GbKgYoMIsdNESpumH5M=";
+  vendorHash = "sha256-JKihU597ZBq1VygpWB73V2m9NN/GDrquX9hNzBdszSQ=";
 
   nativeBuildInputs = [
     copyDesktopItems

pkgs/by-name/su/surrealist/package.nix

@@ -24,15 +24,38 @@
 , webkitgtk
 }:
 
-stdenv.mkDerivation (finalAttrs: {
+let
+
+  esbuild-18-20 = let version = "0.18.20";
+  in esbuild.override {
+    buildGoModule = args:
+      buildGoModule (args // {
+        inherit version;
+        src = fetchFromGitHub {
+          owner = "evanw";
+          repo = "esbuild";
+          rev = "v${version}";
+          hash = "sha256-mED3h+mY+4H465m02ewFK/BgA1i/PQ+ksUNxBlgpUoI=";
+        };
+        vendorHash = "sha256-+BfxCyg0KkDQpHt/wycy/8CTG6YBA/VJvJFhhzUnSiQ=";
+      });
+  };
+
+  wasm-bindgen-cli-2-92 = wasm-bindgen-cli.override {
+    version = "0.2.92";
+    hash = "sha256-1VwY8vQy7soKEgbki4LD+v259751kKxSxmo/gqE6yV0=";
+    cargoHash = "sha256-aACJ+lYNEU8FFBs158G1/JG8sc6Rq080PeKCMnwdpH0=";
+  };
+
+in stdenv.mkDerivation (finalAttrs: {
   pname = "surrealist";
-  version = "1.11.5";
+  version = "1.11.7";
 
   src = fetchFromGitHub {
     owner = "StarlaneStudios";
     repo = "Surrealist";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-9hm45bTvOhDHYYFUs7nTdOkHOsDJUiqDv8F6wQqEdFs=";
+    hash = "sha256-1jTvbr7jFo2GOB79ClwtBVVnNQlSEkqY2eqbiZxWG74=";
   };
 
   sourceRoot = "${finalAttrs.src.name}/src-tauri";
@@ -47,7 +70,7 @@ stdenv.mkDerivation (finalAttrs: {
     cargoDeps = rustPlatform.fetchCargoTarball {
       inherit (finalAttrs) src;
       sourceRoot = "${finalAttrs.src.name}/src-embed";
-      hash = "sha256-sf1sn3lOKvUu5MXxdMohS1DJ8jP9icZGftJKhrWA/JE=";
+      hash = "sha256-0cAhaeoP8EPcE1230CyznQZZIKRs0lrI8XOXECgb8pg=";
     };
 
     nativeBuildInputs = [
@@ -56,7 +79,7 @@ stdenv.mkDerivation (finalAttrs: {
       llvmPackages_15.clangNoLibc
       llvmPackages_15.lld
       rustPlatform.cargoSetupHook
-      wasm-bindgen-cli
+      wasm-bindgen-cli-2-92
     ];
 
     postBuild = ''
@@ -103,20 +126,7 @@ stdenv.mkDerivation (finalAttrs: {
     pname = "${finalAttrs.pname}-ui";
     dontFixup = true;
 
-    ESBUILD_BINARY_PATH = let version = "0.18.20";
+    ESBUILD_BINARY_PATH = "${lib.getExe esbuild-18-20}";
-    in "${lib.getExe (esbuild.override {
-      buildGoModule = args:
-        buildGoModule (args // {
-          inherit version;
-          src = fetchFromGitHub {
-            owner = "evanw";
-            repo = "esbuild";
-            rev = "v${version}";
-            hash = "sha256-mED3h+mY+4H465m02ewFK/BgA1i/PQ+ksUNxBlgpUoI=";
-          };
-          vendorHash = "sha256-+BfxCyg0KkDQpHt/wycy/8CTG6YBA/VJvJFhhzUnSiQ=";
-        });
-    })}";
 
     nativeBuildInputs = [ nodePackages.pnpm ];
 

pkgs/by-name/sw/swww/package.nix

@@ -10,16 +10,21 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "swww";
-  version = "0.9.1";
+  version = "0.9.4";
 
   src = fetchFromGitHub {
     owner = "LGFae";
     repo = "swww";
     rev = "refs/tags/v${version}";
-    hash = "sha256-JtwNrdXZbmR7VZeRiXcLEEOq1z7bF8idjp2D1Zpf3Z4=";
+    hash = "sha256-LvSPKg8cWlwKu4a+P/G0dOqV+aPsUq3axI1QqnLj4U8=";
   };
 
-  cargoHash = "sha256-FC3HeqWAMOTm2Tmzg+Sn/j0ZXyd8nsYH64MlwQwr8W0=";
+  cargoLock = {
+    lockFile = ./Cargo.lock;
+    outputHashes = {
+      "bitcode-0.6.0" = "sha256-D1Jv9k9m6m7dXjU8s4YMEMC39FOUN7Ix9SvLKhM1yh0=";
+    };
+  };
 
   buildInputs = [
     lz4

pkgs/by-name/sy/symfony-cli/package.nix

@@ -10,14 +10,14 @@
 
 buildGoModule rec {
   pname = "symfony-cli";
-  version = "5.8.14";
+  version = "5.8.15";
-  vendorHash = "sha256-OBXurPjyB2/JCQBna+tk0p3+n8gPoNLXCppXkII3ZUc=";
+  vendorHash = "sha256-rkvQhZSoKZIl/gFgekLUelem2FGbRL9gp1LEzYN88Dc=";
 
   src = fetchFromGitHub {
     owner = "symfony-cli";
     repo = "symfony-cli";
     rev = "v${version}";
-    hash = "sha256-rwcULDbdYHZ1yFrGEGsJOZQG7Z29m0MOd79yalFIdkQ=";
+    hash = "sha256-HbBg2oCsogY3X4jgjknqwNe2bszXjylvE+h5/iyg2pM=";
   };
 
   ldflags = [

pkgs/by-name/te/tenki/package.nix

@@ -4,16 +4,16 @@
 }:
 rustPlatform.buildRustPackage rec {
   pname = "tenki";
-  version = "1.6.0";
+  version = "1.7.0";
 
   src = fetchFromGitHub {
     owner = "ckaznable";
     repo = "tenki";
     rev = "v${version}";
-    hash = "sha256-l2MDO0LIL+uSPiXA3+WVpan43lWJbaY9XSdQbwacRqQ=";
+    hash = "sha256-FlygsPvlftlCrAuViB/MpI9m10o1iVtfJ8djn5ycHa4=";
   };
 
-  cargoHash = "sha256-8tabXFijgq+E6YVY1J2nAhDHFahWx7QC8S401KNy2Jc=";
+  cargoHash = "sha256-mWxdZilKbC7+OygCmPB09kZJdtGbUqrGpaEZG/Bn5QQ=";
 
   meta = with lib; {
     description = "tty-clock with weather effect";

pkgs/by-name/ug/ugm/package.nix

@@ -2,17 +2,18 @@
 , buildGoModule
 , fetchFromGitHub
 , makeWrapper
+, nix-update-script
 }:
 
 buildGoModule rec {
   pname = "ugm";
-  version = "1.4.0";
+  version = "1.5.0";
 
   src = fetchFromGitHub {
     owner = "ariasmn";
     repo = "ugm";
     rev = "v${version}";
-    hash = "sha256-Co8JN0WEc1I08My9m7iyAshtEO4aszN8/sCvoGFJv2A=";
+    hash = "sha256-Ui/JYU/ZbMP8E20vWHah1GFFVu5E4xf0RaVv9X0QnR4=";
   };
 
   vendorHash = "sha256-34D9fQnmKnOyUqshduLmFiVgcVKi7mDKBs3X5ZQxsuw=";
@@ -25,6 +26,8 @@ buildGoModule rec {
         --set RUNEWIDTH_EASTASIAN 0
   '';
 
+  passthru.updateScript = nix-update-script {};
+
   meta = with lib; {
     description = "A terminal based UNIX user and group browser";
     homepage = "https://github.com/ariasmn/ugm";

pkgs/by-name/vo/voidmap/package.nix

@@ -0,0 +1,29 @@
+{ lib, fetchFromGitHub, rustPlatform }:
+
+rustPlatform.buildRustPackage rec {
+  pname = "voidmap";
+  version = "1.1.5-unstable-2023-09-13";
+
+  src = fetchFromGitHub {
+    owner = "void-rs";
+    repo = "void";
+    rev = "ab32290632fa9477a7e59b884bdfa69fb4b91906";
+    hash = "sha256-+P83psu+BYzgC/I/Ul7vrbZ99KIybd410/ycsIY1pGI=";
+  };
+
+  cargoHash = "sha256-+UhqGl7w2jtGBFgX4u/g8tGO0NJTkDAJdNfwe8RobPQ=";
+
+  checkFlags = [
+    # The test utilizes a redirect stdout to file with dup2 and breaks sandbox assumptions
+    "--skip=screen::qc_input_events_dont_crash_void"
+  ];
+
+  meta = {
+    description = "A terminal-based personal organizer";
+    homepage = "https://github.com/void-rs/void";
+    license = lib.licenses.gpl3Only;
+    mainProgram = "void";
+    maintainers = with lib.maintainers; [ poptart ];
+    platforms = lib.platforms.linux;
+  };
+}

pkgs/by-name/wh/where-is-my-sddm-theme/package.nix

@@ -33,13 +33,13 @@ lib.checkListOfEnum "where-is-my-sddm-theme: variant" validVariants variants
 
 stdenvNoCC.mkDerivation rec {
   pname = "where-is-my-sddm-theme";
-  version = "1.9.0";
+  version = "1.9.1";
 
   src = fetchFromGitHub {
     owner = "stepanzubkov";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-eIqSS+Kzf543HiY8WItyZ2vO1SHp7y9yOAD9hIzFPfg=";
+    hash = "sha256-o9SpzSmHygHix3BUaMQRwLvgy2BdDsBXmiLDU+9u/6Q=";
   };
 
   propagatedUserEnvPkgs =

pkgs/by-name/wl/wlr-layout-ui/package.nix

@@ -0,0 +1,48 @@
+{ lib
+, python3
+, fetchFromGitHub
+}:
+
+python3.pkgs.buildPythonApplication rec {
+  pname = "wlr-layout-ui";
+  version = "1.4.7";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "fdev31";
+    repo = "wlr-layout-ui";
+    rev = "${version}";
+    hash = "sha256-3NV02/Lk43h3r17jwmSAqx7wofaHFJKDh+vaWwU17Gw=";
+  };
+
+  postPatch = ''
+    # The hyprland default.nix patches the version.h of hyprland so that the
+    # version info moves to the commit key.
+    substituteInPlace src/wlr_layout_ui/screens.py \
+      --replace 'json.loads(subprocess.getoutput("hyprctl -j version"))["tag"]'\
+                'json.loads(subprocess.getoutput("hyprctl -j version"))["commit"]'
+  '';
+
+  nativeBuildInputs = [
+    python3.pkgs.poetry-core
+  ];
+
+  propagatedBuildInputs = with python3.pkgs; [
+    pyglet
+    tomli
+    tomli-w
+  ];
+
+  postInstall = ''
+    install -Dm644 files/wlr-layout-ui.desktop $out/share/applications/wlr-layout-ui.desktop
+  '';
+
+  meta = with lib; {
+    description = "A simple GUI to setup the screens layout on wlroots based systems";
+    homepage = "https://github.com/fdev31/wlr-layout-ui/";
+    maintainers = with maintainers; [ bnlrnz ];
+    license = licenses.mit;
+    mainProgram = "wlrlui";
+    platforms = subtractLists platforms.darwin platforms.unix;
+  };
+}

pkgs/by-name/wo/workout-tracker/package.nix

@@ -8,13 +8,13 @@
 
 buildGoModule rec {
   pname = "workout-tracker";
-  version = "0.12.0";
+  version = "0.13.4";
 
   src = fetchFromGitHub {
     owner = "jovandeginste";
     repo = "workout-tracker";
     rev = "refs/tags/v${version}";
-    hash = "sha256-INEo8jRJP0Jdsl28pLyrJEWAFwq5HpiOJIpwxOJ1vhU=";
+    hash = "sha256-wBDLf4UfE3YXH2naub9Z//z5HWaTBuz6MyCQovZcsFI=";
   };
 
   vendorHash = null;

pkgs/by-name/ya/yamlscript/package.nix

@@ -2,11 +2,11 @@
 
 buildGraalvmNativeImage rec {
   pname = "yamlscript";
-  version = "0.1.52";
+  version = "0.1.56";
 
   src = fetchurl {
     url = "https://github.com/yaml/yamlscript/releases/download/${version}/yamlscript.cli-${version}-standalone.jar";
-    hash = "sha256-VBb+mZXTzcP0oVjm3TWM38J3fSacQZwQ4WVVDgldHV4=";
+    hash = "sha256-4ZjQYl4NdqbzyeEWDthBA8fWJFlIuMRtvHLtdlVYQmw=";
   };
 
   executable = "ys";

pkgs/by-name/za/zapzap/package.nix

@@ -6,14 +6,14 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "zapzap";
-  version = "5.2.1";
+  version = "5.3";
   format = "setuptools";
 
   src = fetchFromGitHub {
     owner = "zapzap-linux";
     repo = "zapzap";
     rev = "refs/tags/${version}";
-    hash = "sha256-Jswt/SWsrrXdJtaT3FAOuOCkrwlpy+lSJa6/gquMiwY=";
+    hash = "sha256-KUWkpdT0v4Y85ga8NsF3fbiSjfhWXC+WpHESTPCW+oE=";
   };
 
   nativeBuildInputs = with python3Packages; [

pkgs/data/fonts/fira-code/default.nix

@@ -1,11 +1,11 @@
-{ lib, stdenvNoCC, fetchzip }:
+{ lib, stdenvNoCC, fetchzip, useVariableFont ? true }:
 
-stdenvNoCC.mkDerivation rec {
+stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "fira-code";
   version = "6.2";
 
   src = fetchzip {
-    url = "https://github.com/tonsky/FiraCode/releases/download/${version}/Fira_Code_v${version}.zip";
+    url = "https://github.com/tonsky/FiraCode/releases/download/${finalAttrs.version}/Fira_Code_v${finalAttrs.version}.zip";
     stripRoot = false;
     hash = "sha256-UHOwZL9WpCHk6vZaqI/XfkZogKgycs5lWg1p0XdQt0A=";
   };
@@ -14,7 +14,7 @@ stdenvNoCC.mkDerivation rec {
   installPhase = ''
     runHook preInstall
 
-    install -Dm644 variable_ttf/*-VF.ttf -t $out/share/fonts/truetype
+    install -Dm644 -t $out/share/fonts/truetype ${if useVariableFont then "variable_ttf/*-VF.ttf" else "ttf/*.ttf"}
 
     runHook postInstall
   '';
@@ -31,4 +31,4 @@ stdenvNoCC.mkDerivation rec {
     maintainers = [ maintainers.rycee ];
     platforms = platforms.all;
   };
-}
+})

pkgs/data/fonts/nasin-nanpa/default.nix

@@ -2,29 +2,18 @@
 
 stdenvNoCC.mkDerivation rec {
   pname = "nasin-nanpa";
-  version = "2.5.1";
+  version = "3.1.0";
 
-  srcs = [
+  src = fetchurl {
-    (fetchurl {
+    url = "https://github.com/ETBCOR/nasin-nanpa/releases/download/n${version}/nasin-nanpa-${version}.otf";
-      name = "nasin-nanpa.otf";
+    hash = "sha256-remTvvOt7kpvTdq9H8tFI2yU+BtqePXlDDLQv/jtETU=";
-      url = "https://github.com/ETBCOR/nasin-nanpa/releases/download/n${version}/nasin-nanpa-${version}.otf";
+  };
-      hash = "sha256-++uOrqFzQ6CB/OPEmBivpjMfAtFk3PSsCNpFBjOtGEg=";
-    })
-    (fetchurl {
-      name = "nasin-nanpa-lasina-kin.otf";
-      url = "https://github.com/ETBCOR/nasin-nanpa/releases/download/n${version}/nasin-nanpa-${version}-lasina-kin.otf";
-      hash = "sha256-4WIX74y2O4NaKi/JQrgTbOxlKDQKJ/F9wkQuoOdWuTI=";
-    })
-  ];
 
   dontUnpack = true;
 
   installPhase = ''
     mkdir -p $out/share/fonts/opentype
-    for src in $srcs; do
+    cp $src $out/share/fonts/opentype/nasin-nanpa.otf
-        file=$(stripHash $src)
-        cp $src $out/share/fonts/opentype/$file
-    done
   '';
 
   meta = with lib; {

pkgs/data/icons/numix-icon-theme-square/default.nix

@@ -2,13 +2,13 @@
 
 stdenvNoCC.mkDerivation rec {
   pname = "numix-icon-theme-square";
-  version = "24.03.12";
+  version = "24.04.16";
 
   src = fetchFromGitHub {
     owner = "numixproject";
     repo = pname;
     rev = version;
-    sha256 = "sha256-dMPbu23e8ZCDZCYpbfoRwbtDMcy/+IImjGV17Sb5DBk=";
+    sha256 = "sha256-PYsGP0Snn9A5cJ5CG+RyjC+TJwAqJOFQdnYIUkugnq0=";
   };
 
   nativeBuildInputs = [ gtk3 ];

pkgs/data/misc/nixos-artwork/icons.nix

@@ -1,25 +1,39 @@
 { stdenv
+, lib
 , fetchFromGitHub
 , imagemagick
 }:
 
-stdenv.mkDerivation {
+stdenv.mkDerivation (finalAttrs: {
   pname = "nixos-icons";
-  version = "2021-02-24";
+  version = "0-unstable-2024-04-10";
 
   src = fetchFromGitHub {
     owner = "NixOS";
     repo = "nixos-artwork";
-    rev = "488c22aad523c709c44169d3e88d34b4691c20dc";
+    rev = "f84c13adae08e860a7c3f76ab3a9bef916d276cc";
-    sha256 = "ZoanCzn4pqGB1fyMzMyGQVT0eIhNdL7ZHJSn1VZWVRs=";
+    hash = "sha256-lO/2dLGK2f9pzLHudRIs4PUcGUliy7kfyt9r4CbhbVg=";
   };
 
+  sourceRoot = "${finalAttrs.src.name}/icons";
+
+  strictDeps = true;
+
   nativeBuildInputs = [
     imagemagick
   ];
 
   makeFlags = [
-    "DESTDIR=${placeholder "out"}"
+    "prefix=${placeholder "out"}"
-    "prefix="
   ];
-}
+
+  enableParallelBuilding = true;
+
+  meta = with lib; {
+    description = "Icons of the Nix logo, in Freedesktop Icon Directory Layout";
+    homepage = "https://github.com/NixOS/nixos-artwork";
+    license = licenses.cc-by-40;
+    maintainers = with maintainers; [];
+    platforms = platforms.all;
+  };
+})

pkgs/data/themes/catppuccin-gtk/default.nix

@@ -1,7 +1,6 @@
 { lib
 , stdenvNoCC
 , fetchFromGitHub
-, fetchpatch
 , gtk3
 , colloid-gtk-theme
 , gnome-themes-extra
@@ -30,27 +29,19 @@ lib.checkListOfEnum "${pname}: tweaks" validTweaks tweaks
 
 stdenvNoCC.mkDerivation rec {
   inherit pname;
-  version = "0.7.2";
+  version = "0.7.3";
 
   src = fetchFromGitHub {
     owner = "catppuccin";
     repo = "gtk";
     rev = "v${version}";
-    hash = "sha256-7EvKcyh9gH/QbiXKlyAKMSBXMF3DmbHD+wJD3Sq39DE=";
+    hash = "sha256-pGL8vaE63ss2ZT2FoNDfDkeuCxjcbl02RmwwfHC/Vxg=";
   };
 
   nativeBuildInputs = [ gtk3 sassc ];
 
   patches = [
     ./colloid-src-git-reset.patch
-
-    # Can be removed next release
-    # Adds compatibility with the 2.x.x versions of the catppuccin python package
-    (fetchpatch {
-      name = "catppuccin-python-compatibility.patch";
-      url = "https://github.com/catppuccin/gtk/commit/355e12387f73b27cf4734a6a3eb431554fabb74f.patch";
-      hash = "sha256-4vgZbNeGMtsQEitIWDCVb5o4fAjhVu3iIUttUYqtHPc=";
-    })
   ];
 
   buildInputs = [

pkgs/data/themes/orchis-theme/default.nix

@@ -26,13 +26,13 @@ lib.checkListOfEnum "${pname}: theme tweaks" validTweaks tweaks
 stdenvNoCC.mkDerivation
 rec {
   inherit pname;
-  version = "2024-04-01";
+  version = "2024-04-18";
 
   src = fetchFromGitHub {
     repo = "Orchis-theme";
     owner = "vinceliuice";
     rev = version;
-    hash = "sha256-gszyUZGWlgrBTQnaz6Ws7jzfTN5KAfX5SjVwmVrP9QE=";
+    hash = "sha256-Kvafbvw1q8F0+l47WshFHPfZEQhFXPPXuI0RjBJnP4s=";
   };
 
   nativeBuildInputs = [ gtk3 sassc ];

pkgs/desktops/gnome/games/gnome-mahjongg/default.nix

@@ -19,11 +19,11 @@
 
 stdenv.mkDerivation rec {
   pname = "gnome-mahjongg";
-  version = "3.40.0";
+  version = "3.40.1";
 
   src = fetchurl {
     url = "mirror://gnome/sources/gnome-mahjongg/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "WorIbXY8VmDdkCX3vAgxC5IjRvp+Lfe2SMmJTa4/GD8=";
+    hash = "sha256-jtVO7K3jawgzaQb9jmyQKg1ve7u7Z2U8I5Vqa2MSI/Y=";
   };
 
   nativeBuildInputs = [

pkgs/desktops/lomiri/services/lomiri-indicator-network/default.nix

@@ -47,11 +47,10 @@ stdenv.mkDerivation (finalAttrs: {
   ];
 
   postPatch = ''
-    # Queried via pkg-config, would need to override a prefix variable
+    # Override original prefixes
-    # Needs CMake 3.28 or higher to do as part of the call, https://github.com/NixOS/nixpkgs/pull/275284
     substituteInPlace data/CMakeLists.txt \
-      --replace 'pkg_get_variable(DBUS_SESSION_BUS_SERVICES_DIR dbus-1 session_bus_services_dir)' 'set(DBUS_SESSION_BUS_SERVICES_DIR "''${CMAKE_INSTALL_SYSCONFDIR}/dbus-1/services")' \
+      --replace-fail 'pkg_get_variable(DBUS_SESSION_BUS_SERVICES_DIR dbus-1 session_bus_services_dir)' 'pkg_get_variable(DBUS_SESSION_BUS_SERVICES_DIR dbus-1 session_bus_services_dir DEFINE_VARIABLES datadir=''${CMAKE_INSTALL_FULL_SYSCONFDIR})' \
-      --replace 'pkg_get_variable(SYSTEMD_USER_DIR systemd systemduserunitdir)' 'set(SYSTEMD_USER_DIR "''${CMAKE_INSTALL_PREFIX}/lib/systemd/user")'
+      --replace-fail 'pkg_get_variable(SYSTEMD_USER_DIR systemd systemduserunitdir)' 'pkg_get_variable(SYSTEMD_USER_DIR systemd systemduserunitdir DEFINE_VARIABLES prefix=''${CMAKE_INSTALL_PREFIX})'
   '';
 
   strictDeps = true;

pkgs/development/cuda-modules/backend-stdenv.nix

@@ -1,11 +1,9 @@
 {
+  cudaVersion,
   lib,
   nvccCompatibilities,
-  cudaVersion,
   pkgs,
-  overrideCC,
   stdenv,
-  wrapCCWith,
   stdenvAdapters,
 }:
 

pkgs/development/cuda-modules/cuda-library-samples/extension.nix

@@ -1,5 +1,7 @@
-{ hostPlatform, lib }:
+{ lib, stdenv }:
 let
+  inherit (stdenv) hostPlatform;
+
   # Samples are built around the CUDA Toolkit, which is not available for
   # aarch64. Check for both CUDA version and platform.
   platformIsSupported = hostPlatform.isx86_64 && hostPlatform.isLinux;

pkgs/development/cuda-modules/cuda-library-samples/generic.nix

@@ -76,7 +76,7 @@ in
       # CUTENSOR_ROOT is double escaped
       postPatch = ''
         substituteInPlace CMakeLists.txt \
-          --replace "\''${CUTENSOR_ROOT}/include" "${cutensor.dev}/include"
+          --replace-fail "\''${CUTENSOR_ROOT}/include" "${cutensor.dev}/include"
       '';
 
       CUTENSOR_ROOT = cutensor;

pkgs/development/cuda-modules/cuda-samples/extension.nix

@@ -1,7 +1,7 @@
 {
   cudaVersion,
-  hostPlatform,
   lib,
+  stdenv,
 }:
 let
   cudaVersionToHash = {
@@ -23,6 +23,8 @@ let
     "12.3" = "sha256-fjVp0G6uRCWxsfe+gOwWTN+esZfk0O5uxS623u0REAk=";
   };
 
+  inherit (stdenv) hostPlatform;
+
   # Samples are built around the CUDA Toolkit, which is not available for
   # aarch64. Check for both CUDA version and platform.
   cudaVersionIsSupported = cudaVersionToHash ? ${cudaVersion};