Merge staging-next into staging

CONTRIBUTING.md

@@ -313,6 +313,7 @@ Container system, boot system and library changes are some examples of the pull
 
 To streamline automated updates, leverage the nixpkgs-merge-bot by simply commenting `@NixOS/nixpkgs-merge-bot merge`. The bot will verify if the following conditions are met, refusing to merge otherwise:
 
+- the PR author should be @r-ryantm;
 - the commenter that issued the command should be among the package maintainers;
 - the package should reside in `pkgs/by-name`.
 

ci/OWNERS

@@ -226,10 +226,10 @@ pkgs/development/python-modules/buildcatrust/ @ajs124 @lukegb @mweinelt
 /maintainers/scripts/kde @K900 @NickCao @SuperSandro2000 @ttuegel
 
 # PostgreSQL and related stuff
-/pkgs/servers/sql/postgresql @thoughtpolice
-/nixos/modules/services/databases/postgresql.md @thoughtpolice
-/nixos/modules/services/databases/postgresql.nix @thoughtpolice
-/nixos/tests/postgresql.nix @thoughtpolice
+/pkgs/servers/sql/postgresql @NixOS/postgres
+/nixos/modules/services/databases/postgresql.md @NixOS/postgres
+/nixos/modules/services/databases/postgresql.nix @NixOS/postgres
+/nixos/tests/postgresql.nix @NixOS/postgres
 
 # Hardened profile & related modules
 /nixos/modules/profiles/hardened.nix @joachifm

maintainers/team-list.nix

@@ -846,9 +846,14 @@ with lib.maintainers;
   };
 
   postgres = {
-    members = [ thoughtpolice ];
+    members = [
+      thoughtpolice
+      ma27
+      wolfgangwalther
+    ];
     scope = "Maintain the PostgreSQL package and plugins along with the NixOS module.";
     shortName = "PostgreSQL";
+    enableFeatureFreezePing = true;
   };
 
   python = {

nixos/doc/manual/release-notes/rl-2411.section.md

@@ -575,6 +575,11 @@
 
 - `/share/vim-plugins` now only gets linked if `programs.vim.enable` is enabled
 
+- The `services.guix` module now manages trusted substitute servers
+  declaratively. Instead of `guix archive --authorize`, list keys with
+  `services.guix.substituters.authorizedKeys`. Default substitute servers can be
+  set via `services.guix.substituters.urls`.
+
 - The `tracy` package no longer works on X11, since it's moved to Wayland
   support, which is the intended default behavior by Tracy maintainers.
   X11 users have to switch to the new package `tracy-x11`.

nixos/modules/services/home-automation/home-assistant.nix

@@ -6,17 +6,21 @@ let
   cfg = config.services.home-assistant;
   format = pkgs.formats.yaml {};
 
-  # Render config attribute sets to YAML
-  # Values that are null will be filtered from the output, so this is one way to have optional
-  # options shown in settings.
-  # We post-process the result to add support for YAML functions, like secrets or includes, see e.g.
+  # Post-process YAML output to add support for YAML functions, like
+  # secrets or includes, by naively unquoting strings with leading bangs
+  # and at least one space-separated parameter.
   # https://www.home-assistant.io/docs/configuration/secrets/
-  filteredConfig = lib.converge (lib.filterAttrsRecursive (_: v: ! elem v [ null ])) (lib.recursiveUpdate customLovelaceModulesResources (cfg.config or {}));
-  configFile = pkgs.runCommandLocal "configuration.yaml" { } ''
-    cp ${format.generate "configuration.yaml" filteredConfig} $out
+  renderYAMLFile = fn: yaml: pkgs.runCommandLocal fn { } ''
+    cp ${format.generate fn yaml} $out
     sed -i -e "s/'\!\([a-z_]\+\) \(.*\)'/\!\1 \2/;s/^\!\!/\!/;" $out
   '';
-  lovelaceConfigFile = format.generate "ui-lovelace.yaml" cfg.lovelaceConfig;
+
+  # Filter null values from the configuration, so that we can still advertise
+  # optional options in the config attribute.
+  filteredConfig = lib.converge (lib.filterAttrsRecursive (_: v: ! elem v [ null ])) (lib.recursiveUpdate customLovelaceModulesResources (cfg.config or {}));
+  configFile = renderYAMLFile "configuration.yaml" filteredConfig;
+
+  lovelaceConfigFile = renderYAMLFile "ui-lovelace.yaml" cfg.lovelaceConfig;
 
   # Components advertised by the home-assistant package
   availableComponents = cfg.package.availableComponents;

nixos/modules/services/misc/guix/default.nix

@@ -46,6 +46,17 @@ let
     GUIX_LOCPATH = "${cfg.stateDir}/guix/profiles/per-user/root/guix-profile/lib/locale";
     LC_ALL = "C.UTF-8";
   };
+
+  # Currently, this is just done the lazy way with the official Guix script. A
+  # more "formal" way would be creating our own Guix script to handle and
+  # generate the ACL file ourselves.
+  aclFile = pkgs.runCommandLocal "guix-acl" { } ''
+    export GUIX_CONFIGURATION_DIRECTORY=./
+    for official_server_keys in ${lib.concatStringsSep " " cfg.substituters.authorizedKeys}; do
+      ${lib.getExe' cfg.package "guix"} archive --authorize < "$official_server_keys"
+    done
+    install -Dm0600 ./acl "$out"
+  '';
 in
 {
   meta.maintainers = with lib.maintainers; [ foo-dogsquared ];
@@ -118,6 +129,57 @@ in
       example = "/gnu/var";
     };
 
+    substituters = {
+      urls = lib.mkOption {
+        type = with lib.types; listOf str;
+        default = [
+          "https://ci.guix.gnu.org"
+          "https://bordeaux.guix.gnu.org"
+          "https://berlin.guix.gnu.org"
+        ];
+        example = lib.literalExpression ''
+          options.services.guix.substituters.urls.default ++ [
+            "https://guix.example.com"
+            "https://guix.example.org"
+          ]
+        '';
+        description = ''
+          A list of substitute servers' URLs for the Guix daemon to download
+          substitutes from.
+        '';
+      };
+
+      authorizedKeys = lib.mkOption {
+        type = with lib.types; listOf path;
+        default = [
+          "${cfg.package}/share/guix/ci.guix.gnu.org.pub"
+          "${cfg.package}/share/guix/bordeaux.guix.gnu.org.pub"
+          "${cfg.package}/share/guix/berlin.guix.gnu.org.pub"
+        ];
+        defaultText = ''
+          The packaged signing keys from {option}`services.guix.package`.
+        '';
+        example = lib.literalExpression ''
+          options.services.guix.substituters.authorizedKeys.default ++ [
+            (builtins.fetchurl {
+              url = "https://guix.example.com/signing-key.pub";
+            })
+
+            (builtins.fetchurl {
+              url = "https://guix.example.org/static/signing-key.pub";
+            })
+          ]
+        '';
+        description = ''
+          A list of signing keys for each substitute server to be authorized as
+          a source of substitutes. Without this, the listed substitute servers
+          from {option}`services.guix.substituters.urls` would be ignored [with
+          some
+          exceptions](https://guix.gnu.org/manual/en/html_node/Substitute-Authentication.html).
+        '';
+      };
+    };
+
     publish = {
       enable = mkEnableOption "substitute server for your Guix store directory";
 
@@ -215,6 +277,8 @@ in
         script = ''
           ${lib.getExe' package "guix-daemon"} \
             --build-users-group=${cfg.group} \
+            ${lib.optionalString (cfg.substituters.urls != [ ])
+              "--substitute-urls='${lib.concatStringsSep " " cfg.substituters.urls}'"} \
             ${lib.escapeShellArgs cfg.extraArgs}
         '';
         serviceConfig = {
@@ -254,11 +318,7 @@ in
 
       # Make transferring files from one store to another easier with the usual
       # case being of most substitutes from the official Guix CI instance.
-      system.activationScripts.guix-authorize-keys = ''
-        for official_server_keys in ${package}/share/guix/*.pub; do
-          ${lib.getExe' package "guix"} archive --authorize < $official_server_keys
-        done
-      '';
+      environment.etc."guix/acl".source = aclFile;
 
       # Link the usual Guix profiles to the home directory. This is useful in
       # ephemeral setups where only certain part of the filesystem is
@@ -270,8 +330,8 @@ in
         in ''
           [ -d "${userProfile}" ] && ln -sfn "${userProfile}" "${location}"
         '';
-        linkProfileToPath = acc: profile: location: let
-          in acc + (linkProfile profile location);
+        linkProfileToPath = acc: profile: location:
+          acc + (linkProfile profile location);
 
         # This should contain export-only Guix user profiles. The rest of it is
         # handled manually in the activation script.
@@ -387,7 +447,7 @@ in
           Type = "oneshot";
 
           PrivateDevices = true;
-          PrivateNetworks = true;
+          PrivateNetwork = true;
           ProtectControlGroups = true;
           ProtectHostname = true;
           ProtectKernelTunables = true;

nixos/modules/services/web-apps/snipe-it.nix

@@ -331,7 +331,7 @@ in {
       APP_CONFIG_CACHE = "/run/snipe-it/cache/config.php";
       APP_ROUTES_CACHE = "/run/snipe-it/cache/routes-v7.php";
       APP_EVENTS_CACHE = "/run/snipe-it/cache/events.php";
-      SESSION_SECURE_COOKIE = tlsEnabled;
+      SECURE_COOKIES = tlsEnabled;
     };
 
     services.mysql = mkIf db.createLocally {

nixos/tests/guix/publish.nix

@@ -47,12 +47,12 @@ in {
       services.guix = {
         enable = true;
 
-        extraArgs = [
         # Force to only get all substitutes from the local server. We don't
         # have anything in the Guix store directory and we cannot get
         # anything from the official substitute servers anyways.
-          "--substitute-urls='http://server.local:${toString publishPort}'"
+        substituters.urls = [ "http://server.local:${toString publishPort}" ];
 
+        extraArgs = [
           # Enable autodiscovery of the substitute servers in the local
           # network. This machine shouldn't need to import the signing key from
           # the substitute server since it is automatically done anyways.

pkgs/applications/editors/vscode/extensions/default.nix

@@ -4531,8 +4531,8 @@ let
         mktplcRef = {
           name = "code-spell-checker";
           publisher = "streetsidesoftware";
-          version = "4.0.7";
-          hash = "sha256-y+xD8rOa/ljavAF7tdEpaOKEd4gUzfH15WBwMHyW7z4=";
+          version = "4.0.14";
+          hash = "sha256-b87sBCprMMfxsP8lyMM3yI82YvKZd5Jc+Z/x7uflnL0=";
         };
         meta = {
           changelog = "https://marketplace.visualstudio.com/items/streetsidesoftware.code-spell-checker/changelog";

pkgs/applications/networking/cluster/linkerd/edge.nix

@@ -2,7 +2,7 @@
 
 (callPackage ./generic.nix { }) {
   channel = "edge";
-  version = "24.10.3";
-  sha256 = "1xsimk3kjniy59sw56q52cmnpg1vb1l1zbaj6nrj44pl57vkp9cp";
-  vendorHash = "sha256-JVXhZjUdU1CrWzrh7INhAd3kRP/tcdsYzlre9SB9gOQ=";
+  version = "24.10.4";
+  sha256 = "0n1fcl2mi3q3g44bd5x7wgnx91769051dwaxmvc4yapkbsbwnr6g";
+  vendorHash = "sha256-AGFuNFwZjWnu+FcXGpTxDQysgSGmYbfEtERaGjCOnUA=";
 }

pkgs/applications/networking/instant-messengers/fractal/default.nix

@@ -21,25 +21,26 @@
 , wrapGAppsHook4
 , sqlite
 , xdg-desktop-portal
+, libseccomp
 }:
 
 stdenv.mkDerivation rec {
   pname = "fractal";
-  version = "8";
+  version = "9";
 
   src = fetchFromGitLab {
     domain = "gitlab.gnome.org";
     owner = "World";
     repo = "fractal";
     rev = "refs/tags/${version}";
-    hash = "sha256-a77+lPH2eqWTLFrYfcBXSvbyyYC52zSo+Rh/diqKYx4=";
+    hash = "sha256-3UI727LUYw7wUKbGRCtgpkF9NNw4XuZ3tl3KV3Ku9r4=";
   };
 
   cargoDeps = rustPlatform.importCargoLock {
     lockFile = ./Cargo.lock;
     outputHashes = {
-      "matrix-sdk-0.7.1" = "sha256-ZlkxGXGrmZ8VQV7UY7A7BBfcqFCAB9Ep7l65irx4Dy8=";
-      "ruma-0.10.1" = "sha256-C/GJ0hDWJ9/grfjMuPSatJq2SrVkV0jxQlAAASkUWqg=";
+      "matrix-sdk-0.7.1" = "sha256-AmODDuNLpI6gXuu+oPl3MqcOnywqR8lqJ0bVOIiz02E=";
+      "ruma-0.10.1" = "sha256-6U2LKMYyY7SLOh2jJcVuDBsfcidNoia1XU+JsmhMHGY=";
     };
   };
 
@@ -68,6 +69,7 @@ stdenv.mkDerivation rec {
     libshumate
     sqlite
     xdg-desktop-portal
+    libseccomp
   ] ++ (with gst_all_1; [
     gstreamer
     gst-plugins-base

pkgs/applications/networking/instant-messengers/telegram/kotatogram-desktop/default.nix

@@ -1,22 +1,17 @@
-{ lib
-, stdenv
-, fetchFromGitHub
-, fetchpatch
-, callPackage
-, libsForQt5
-, yasm
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  fetchpatch,
+  libsForQt5,
+  yasm,
+  withWebkit ? true,
 }:
 
 let
+  telegram-desktop = libsForQt5.callPackage ../telegram-desktop { inherit stdenv; };
   version = "1.4.9";
-in
-(libsForQt5.callPackage ../telegram-desktop/default.nix {
-  inherit stdenv;
-
-  tg_owt = (callPackage ../telegram-desktop/tg_owt.nix {
-    # tg_owt should use the same compiler
-    inherit stdenv;
-  }).overrideAttrs(oldAttrs: {
+  tg_owt = telegram-desktop.tg_owt.overrideAttrs (oldAttrs: {
     version = "0-unstable-2024-06-15";
 
     src = fetchFromGitHub {
@@ -27,7 +22,7 @@ in
       fetchSubmodules = true;
     };
 
-    patches = (oldAttrs.patches or []) ++ [
+    patches = (oldAttrs.patches or [ ]) ++ [
       (fetchpatch {
         url = "https://webrtc.googlesource.com/src/+/e7d10047096880feb5e9846375f2da54aef91202%5E%21/?format=TEXT";
         decode = "base64 -d";
@@ -39,10 +34,12 @@ in
 
     nativeBuildInputs = oldAttrs.nativeBuildInputs ++ [ yasm ];
   });
-
-  withWebKitGTK = false;
-}).overrideAttrs {
+in
+telegram-desktop.override {
   pname = "kotatogram-desktop";
+  inherit withWebkit;
+  unwrapped = (telegram-desktop.unwrapped.override { inherit tg_owt; }).overrideAttrs {
+    pname = "kotatogram-desktop-unwrapped";
     version = "${version}-unstable-2024-09-27";
 
     src = fetchFromGitHub {
@@ -77,4 +74,5 @@ in
       maintainers = with maintainers; [ ilya-fedin ];
       mainProgram = if stdenv.hostPlatform.isLinux then "kotatogram-desktop" else "Kotatogram";
     };
+  };
 }

pkgs/applications/networking/instant-messengers/telegram/kotatogram-desktop/with-webkit.nix

@@ -1,23 +0,0 @@
-{ stdenv, lib, kotatogram-desktop, glib-networking, webkitgtk_4_1, makeBinaryWrapper }:
-
-stdenv.mkDerivation {
-  pname = "${kotatogram-desktop.pname}-with-webkit";
-  version = kotatogram-desktop.version;
-  nativeBuildInputs = [ makeBinaryWrapper ];
-  dontUnpack = true;
-  installPhase = ''
-    mkdir -p $out
-    cp -r ${kotatogram-desktop}/share $out
-    substituteInPlace $out/share/dbus-1/services/* --replace-fail ${kotatogram-desktop} $out
-  '';
-  postFixup = ''
-    mkdir -p $out/bin
-    makeBinaryWrapper {${kotatogram-desktop},$out}/bin/${kotatogram-desktop.meta.mainProgram} \
-      --inherit-argv0 \
-      --prefix GIO_EXTRA_MODULES : ${glib-networking}/lib/gio/modules \
-      --prefix LD_LIBRARY_PATH : ${lib.makeLibraryPath [ webkitgtk_4_1 ]}
-  '';
-  meta = kotatogram-desktop.meta // {
-    platforms = lib.platforms.linux;
-  };
-}

pkgs/applications/networking/instant-messengers/telegram/telegram-desktop/default.nix

@@ -1,169 +1,73 @@
-{ lib
-, stdenv
-, fetchFromGitHub
-, callPackage
-, pkg-config
-, cmake
-, ninja
-, clang
-, python3
-, wrapQtAppsHook
-, tg_owt ? callPackage ./tg_owt.nix { inherit stdenv; }
-, qtbase
-, qtimageformats
-, qtsvg
-, qtwayland
-, kcoreaddons
-, lz4
-, xxHash
-, ffmpeg
-, protobuf
-, openalSoft
-, minizip
-, libopus
-, alsa-lib
-, libpulseaudio
-, range-v3
-, tl-expected
-, hunspell
-, gobject-introspection
-, jemalloc
-, rnnoise
-, microsoft-gsl
-, boost
-, ada
-, withWebKitGTK ? true
-, wrapGAppsHook3
-, glib-networking
-, webkitgtk_4_1
-, libicns
-, apple-sdk_15
-, nix-update-script
+{
+  callPackage,
+  lib,
+  stdenv,
+  pname ? "telegram-desktop",
+  unwrapped ? callPackage ./unwrapped.nix { inherit stdenv; },
+  qtbase,
+  qtimageformats,
+  qtsvg,
+  qtwayland,
+  wrapGAppsHook3,
+  wrapQtAppsHook,
+  glib-networking,
+  webkitgtk_4_1,
+  withWebkit ? true,
 }:
-
-# Main reference:
-# - This package was originally based on the Arch package but all patches are now upstreamed:
-#   https://git.archlinux.org/svntogit/community.git/tree/trunk/PKGBUILD?h=packages/telegram-desktop
-# Other references that could be useful:
-# - https://git.alpinelinux.org/aports/tree/testing/telegram-desktop/APKBUILD
-# - https://github.com/void-linux/void-packages/blob/master/srcpkgs/telegram-desktop/template
-
 stdenv.mkDerivation (finalAttrs: {
-  pname = "telegram-desktop";
-  version = "5.6.3";
+  inherit pname;
+  inherit (unwrapped) version meta passthru;
 
-  src = fetchFromGitHub {
-    owner = "telegramdesktop";
-    repo = "tdesktop";
-    rev = "v${finalAttrs.version}";
-    fetchSubmodules = true;
-    hash = "sha256-frz425V5eRulNVxCf457TWQAzU/f9/szD/sx3/LYQ2Y=";
-  };
+  inherit unwrapped;
 
-  postPatch = lib.optionalString stdenv.hostPlatform.isLinux ''
-    substituteInPlace Telegram/ThirdParty/libtgvoip/os/linux/AudioInputALSA.cpp \
-      --replace-fail '"libasound.so.2"' '"${alsa-lib}/lib/libasound.so.2"'
-    substituteInPlace Telegram/ThirdParty/libtgvoip/os/linux/AudioOutputALSA.cpp \
-      --replace-fail '"libasound.so.2"' '"${alsa-lib}/lib/libasound.so.2"'
-    substituteInPlace Telegram/ThirdParty/libtgvoip/os/linux/AudioPulse.cpp \
-      --replace-fail '"libpulse.so.0"' '"${libpulseaudio}/lib/libpulse.so.0"'
-  '' + lib.optionalString (stdenv.hostPlatform.isLinux && withWebKitGTK) ''
-    substituteInPlace Telegram/lib_webview/webview/platform/linux/webview_linux_webkitgtk_library.cpp \
-      --replace-fail '"libwebkit2gtk-4.1.so.0"' '"${webkitgtk_4_1}/lib/libwebkit2gtk-4.1.so.0"'
-  '' + lib.optionalString stdenv.hostPlatform.isDarwin ''
-    substituteInPlace Telegram/lib_webrtc/webrtc/platform/mac/webrtc_environment_mac.mm \
-      --replace-fail kAudioObjectPropertyElementMain kAudioObjectPropertyElementMaster
-  '';
-
-  # Avoid double-wrapping
-  dontWrapGApps = true;
-
-  # Wrapping the inside of the app bundles, avoiding double-wrapping
-  dontWrapQtApps = stdenv.hostPlatform.isDarwin;
-
-  nativeBuildInputs = [
-    pkg-config
-    cmake
-    ninja
-    python3
+  nativeBuildInputs =
+    [
       wrapQtAppsHook
-  ] ++ lib.optionals stdenv.hostPlatform.isLinux [
-    # to build bundled libdispatch
-    clang
-    gobject-introspection
-  ] ++ lib.optionals (stdenv.hostPlatform.isLinux && withWebKitGTK) [
+    ]
+    ++ lib.optionals withWebkit [
       wrapGAppsHook3
     ];
 
-  buildInputs = [
+  buildInputs =
+    [
       qtbase
       qtimageformats
       qtsvg
-    lz4
-    xxHash
-    ffmpeg
-    openalSoft
-    minizip
-    libopus
-    range-v3
-    tl-expected
-    rnnoise
-    tg_owt
-    microsoft-gsl
-    boost
-    ada
-  ] ++ lib.optionals stdenv.hostPlatform.isLinux [
-    protobuf
+    ]
+    ++ lib.optionals stdenv.hostPlatform.isLinux [
       qtwayland
-    kcoreaddons
-    alsa-lib
-    libpulseaudio
-    hunspell
-    jemalloc
-  ] ++ lib.optionals (stdenv.hostPlatform.isLinux && withWebKitGTK) [
+    ]
+    ++ lib.optionals withWebkit [
       glib-networking
-    webkitgtk_4_1
-  ] ++ lib.optionals stdenv.hostPlatform.isDarwin [
-    apple-sdk_15
-    libicns
     ];
 
-  cmakeFlags = [
-    # We're allowed to used the API ID of the Snap package:
-    (lib.cmakeFeature "TDESKTOP_API_ID" "611335")
-    (lib.cmakeFeature "TDESKTOP_API_HASH" "d524b414d21f4d37f08684c1df41ac9c")
+  qtWrapperArgs = lib.optionals (stdenv.hostPlatform.isLinux && withWebkit) [
+    "--prefix"
+    "LD_LIBRARY_PATH"
+    ":"
+    (lib.makeLibraryPath [ webkitgtk_4_1 ])
   ];
 
-  installPhase = lib.optionalString stdenv.hostPlatform.isDarwin ''
-    mkdir -p $out/Applications
-    cp -r ${finalAttrs.meta.mainProgram}.app $out/Applications
-    ln -s $out/{Applications/${finalAttrs.meta.mainProgram}.app/Contents/MacOS,bin}
+  dontUnpack = true;
+  dontWrapGApps = true;
+  dontWrapQtApps = stdenv.hostPlatform.isDarwin;
+
+  installPhase = ''
+    runHook preInstall
+    cp -r "$unwrapped" "$out"
+    runHook postInstall
   '';
 
-  preFixup = lib.optionalString (stdenv.hostPlatform.isLinux && withWebKitGTK) ''
+  preFixup = lib.optionalString (stdenv.hostPlatform.isLinux && withWebkit) ''
     qtWrapperArgs+=("''${gappsWrapperArgs[@]}")
   '';
 
-  postFixup = lib.optionalString stdenv.hostPlatform.isDarwin ''
-    wrapQtApp $out/Applications/${finalAttrs.meta.mainProgram}.app/Contents/MacOS/${finalAttrs.meta.mainProgram}
+  postFixup =
+    lib.optionalString stdenv.hostPlatform.isDarwin ''
+      wrapQtApp "$out/Applications/${finalAttrs.meta.mainProgram}.app/Contents/MacOS/${finalAttrs.meta.mainProgram}"
+    ''
+    + lib.optionalString stdenv.hostPlatform.isLinux ''
+      substituteInPlace $out/share/dbus-1/services/* \
+        --replace-fail "$unwrapped" "$out"
     '';
-
-  passthru = {
-    inherit tg_owt;
-    updateScript = nix-update-script { };
-  };
-
-  meta = {
-    description = "Telegram Desktop messaging app";
-    longDescription = ''
-      Desktop client for the Telegram messenger, based on the Telegram API and
-      the MTProto secure protocol.
-    '';
-    license = lib.licenses.gpl3Only;
-    platforms = lib.platforms.all;
-    homepage = "https://desktop.telegram.org/";
-    changelog = "https://github.com/telegramdesktop/tdesktop/releases/tag/v${finalAttrs.version}";
-    maintainers = with lib.maintainers; [ nickcao ];
-    mainProgram = if stdenv.hostPlatform.isLinux then "telegram-desktop" else "Telegram";
-  };
 })

pkgs/applications/networking/instant-messengers/telegram/telegram-desktop/tg_owt.nix

@@ -9,7 +9,7 @@
   libjpeg,
   openssl,
   libopus,
-  ffmpeg,
+  ffmpeg_6,
   openh264,
   crc32c,
   libvpx,
@@ -68,7 +68,7 @@ stdenv.mkDerivation {
       libjpeg
       openssl
       libopus
-      ffmpeg
+      ffmpeg_6
       openh264
       crc32c
       libvpx

pkgs/applications/networking/instant-messengers/telegram/telegram-desktop/unwrapped.nix

@@ -0,0 +1,150 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  callPackage,
+  pkg-config,
+  cmake,
+  ninja,
+  clang,
+  python3,
+  tg_owt ? callPackage ./tg_owt.nix { inherit stdenv; },
+  qtbase,
+  qtimageformats,
+  qtsvg,
+  qtwayland,
+  kcoreaddons,
+  lz4,
+  xxHash,
+  ffmpeg_6,
+  protobuf,
+  openalSoft,
+  minizip,
+  libopus,
+  alsa-lib,
+  libpulseaudio,
+  range-v3,
+  tl-expected,
+  hunspell,
+  gobject-introspection,
+  jemalloc,
+  rnnoise,
+  microsoft-gsl,
+  boost,
+  ada,
+  libicns,
+  apple-sdk_15,
+  nix-update-script,
+}:
+
+# Main reference:
+# - This package was originally based on the Arch package but all patches are now upstreamed:
+#   https://git.archlinux.org/svntogit/community.git/tree/trunk/PKGBUILD?h=packages/telegram-desktop
+# Other references that could be useful:
+# - https://git.alpinelinux.org/aports/tree/testing/telegram-desktop/APKBUILD
+# - https://github.com/void-linux/void-packages/blob/master/srcpkgs/telegram-desktop/template
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "telegram-desktop-unwrapped";
+  version = "5.7.1";
+
+  src = fetchFromGitHub {
+    owner = "telegramdesktop";
+    repo = "tdesktop";
+    rev = "v${finalAttrs.version}";
+    fetchSubmodules = true;
+    hash = "sha256-MPVm9WfAjF11sy0hyhDTI/mM2OsENSMavnVrOwXTGUk=";
+  };
+
+  postPatch = lib.optionalString stdenv.hostPlatform.isLinux ''
+    substituteInPlace Telegram/ThirdParty/libtgvoip/os/linux/AudioInputALSA.cpp \
+      --replace-fail '"libasound.so.2"' '"${lib.getLib alsa-lib}/lib/libasound.so.2"'
+    substituteInPlace Telegram/ThirdParty/libtgvoip/os/linux/AudioOutputALSA.cpp \
+      --replace-fail '"libasound.so.2"' '"${lib.getLib alsa-lib}/lib/libasound.so.2"'
+    substituteInPlace Telegram/ThirdParty/libtgvoip/os/linux/AudioPulse.cpp \
+      --replace-fail '"libpulse.so.0"' '"${lib.getLib libpulseaudio}/lib/libpulse.so.0"'
+  '';
+
+  nativeBuildInputs =
+    [
+      pkg-config
+      cmake
+      ninja
+      python3
+    ]
+    ++ lib.optionals stdenv.hostPlatform.isLinux [
+      # to build bundled libdispatch
+      clang
+      gobject-introspection
+    ];
+
+  buildInputs =
+    [
+      qtbase
+      qtimageformats
+      qtsvg
+      lz4
+      xxHash
+      ffmpeg_6
+      openalSoft
+      minizip
+      libopus
+      range-v3
+      tl-expected
+      rnnoise
+      tg_owt
+      microsoft-gsl
+      boost
+      ada
+    ]
+    ++ lib.optionals stdenv.hostPlatform.isLinux [
+      protobuf
+      qtwayland
+      kcoreaddons
+      alsa-lib
+      libpulseaudio
+      hunspell
+      jemalloc
+    ]
+    ++ lib.optionals stdenv.hostPlatform.isDarwin [
+      apple-sdk_15
+      libicns
+    ];
+
+  dontWrapQtApps = true;
+
+  cmakeFlags = [
+    # We're allowed to used the API ID of the Snap package:
+    (lib.cmakeFeature "TDESKTOP_API_ID" "611335")
+    (lib.cmakeFeature "TDESKTOP_API_HASH" "d524b414d21f4d37f08684c1df41ac9c")
+  ];
+
+  installPhase = lib.optionalString stdenv.hostPlatform.isDarwin ''
+    runHook preInstall
+
+    mkdir -p $out/Applications
+    cp -r ${finalAttrs.meta.mainProgram}.app $out/Applications
+    ln -sr $out/{Applications/${finalAttrs.meta.mainProgram}.app/Contents/MacOS,bin}
+
+    runHook postInstall
+  '';
+
+  passthru = {
+    inherit tg_owt;
+    updateScript = nix-update-script { };
+  };
+
+  meta = {
+    description = "Telegram Desktop messaging app";
+    longDescription = ''
+      Desktop client for the Telegram messenger, based on the Telegram API and
+      the MTProto secure protocol.
+    '';
+    license = lib.licenses.gpl3Only;
+    platforms = lib.platforms.all;
+    homepage = "https://desktop.telegram.org/";
+    changelog = "https://github.com/telegramdesktop/tdesktop/releases/tag/v${finalAttrs.version}";
+    maintainers = with lib.maintainers; [ nickcao ];
+    mainProgram = if stdenv.hostPlatform.isLinux then "telegram-desktop" else "Telegram";
+  };
+})

pkgs/applications/networking/p2p/transmission/4.nix

@@ -113,6 +113,10 @@ stdenv.mkDerivation (finalAttrs: {
       cmake/FindUtfCpp.cmake
     # Upstream uses different config file name.
     substituteInPlace CMakeLists.txt --replace 'find_package(UtfCpp)' 'find_package(utf8cpp)'
+
+    # Use gettext even on Darwin
+    substituteInPlace libtransmission/utils.h \
+      --replace-fail '#if defined(HAVE_GETTEXT) && !defined(__APPLE__)' '#if defined(HAVE_GETTEXT)'
   '';
 
   nativeBuildInputs = [
@@ -145,8 +149,7 @@ stdenv.mkDerivation (finalAttrs: {
   ++ optionals enableQt6 (with qt6Packages; [ qttools qtbase qtsvg ])
   ++ optionals enableGTK3 [ gtkmm3 xorg.libpthreadstubs ]
   ++ optionals enableSystemd [ systemd ]
-  ++ optionals stdenv.hostPlatform.isLinux [ inotify-tools ]
-  ++ optionals stdenv.hostPlatform.isDarwin [ libiconv Foundation ];
+  ++ optionals stdenv.hostPlatform.isLinux [ inotify-tools ];
 
   postInstall = ''
     mkdir $apparmor

pkgs/applications/terminal-emulators/alacritty/default.nix

@@ -21,14 +21,7 @@
 , wayland
 , xdg-utils
 
-  # Darwin Frameworks
-, AppKit
-, CoreGraphics
-, CoreServices
-, CoreText
-, Foundation
-, libiconv
-, OpenGL
+, apple-sdk_11
 }:
 let
   rpathLibs = [
@@ -72,13 +65,7 @@ rustPlatform.buildRustPackage rec {
 
   buildInputs = rpathLibs
     ++ lib.optionals stdenv.hostPlatform.isDarwin [
-    AppKit
-    CoreGraphics
-    CoreServices
-    CoreText
-    Foundation
-    libiconv
-    OpenGL
+    apple-sdk_11
   ];
 
   outputs = [ "out" "terminfo" ];

pkgs/applications/video/obs-studio/plugins/obs-move-transition.nix

@@ -7,13 +7,13 @@
 
 stdenv.mkDerivation rec {
   pname = "obs-move-transition";
-  version = "3.1.0";
+  version = "3.1.1";
 
   src = fetchFromGitHub {
     owner = "exeldro";
     repo = "obs-move-transition";
     rev = version;
-    sha256 = "sha256-ZmxopTv6YuAZ/GykvMRcP2PQwQk08ObmqZ9kBcR0UH4=";
+    sha256 = "sha256-kCiRgfpcFdxoK6e8jtrtzkBD4w5B/ilO1YyBHCG13gg=";
   };
 
   nativeBuildInputs = [ cmake ];

pkgs/applications/video/wf-recorder/default.nix

@@ -14,6 +14,7 @@
   libpulseaudio,
   pipewire,
   mesa, # for libgbm
+  fetchpatch,
 }:
 
 stdenv.mkDerivation rec {
@@ -27,6 +28,14 @@ stdenv.mkDerivation rec {
     hash = "sha256-7/fQOkfAw5v3irD5blJOdq88j0VBrPVQQufdt9wsACk=";
   };
 
+  patches = [
+    # compile fixes from upstream, remove when they stop applying
+    (fetchpatch {
+      url = "https://github.com/ammen99/wf-recorder/commit/560bb92d3ddaeb31d7af77d22d01b0050b45bebe.diff";
+      sha256 = "sha256-7jbX5k8dh4dWfolMkZXiERuM72zVrkarsamXnd+1YoI=";
+    })
+  ];
+
   nativeBuildInputs = [
     meson
     ninja

pkgs/applications/virtualization/docker/buildx.nix

@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "docker-buildx";
-  version = "0.17.1";
+  version = "0.18.0";
 
   src = fetchFromGitHub {
     owner = "docker";
     repo = "buildx";
     rev = "v${version}";
-    hash = "sha256-+d0yaosNoOOuo/A7aC6pfy2xGJU718nBBNMMok2Ofv0=";
+    hash = "sha256-mw66AF+JwavuB8r2qzo50rguqZaUfzCVmyYI6yk7ig8=";
   };
 
   doCheck = false;

pkgs/build-support/build-fhsenv-bubblewrap/buildFHSEnv.nix

@@ -33,18 +33,15 @@
 # follows:
 # /lib32 will include 32bit libraries from multiPkgs
 # /lib64 will include 64bit libraries from multiPkgs and targetPkgs
-# /lib will link to /lib32
+# /lib will link to /lib64
 
 let
-  inherit (stdenv.hostPlatform) is64bit;
-
   name = if (args ? pname && args ? version)
     then "${args.pname}-${args.version}"
     else args.name;
 
   # "use of glibc_multi is only supported on x86_64-linux"
   isMultiBuild = multiArch && stdenv.system == "x86_64-linux";
-  isTargetBuild = !isMultiBuild;
 
   # list of packages (usually programs) which match the host's architecture
   # (which includes stuff from multiPkgs)
@@ -60,7 +57,7 @@ let
   baseTargetPaths = with pkgs; [
     glibcLocales
     (if isMultiBuild then glibc_multi else glibc)
-    (toString gcc.cc.lib)
+    gcc.cc.lib
     bashInteractiveFHS
     coreutils
     less
@@ -77,7 +74,7 @@ let
     xz
   ];
   baseMultiPaths = with pkgsi686Linux; [
-    (toString gcc.cc.lib)
+    gcc.cc.lib
   ];
 
   ldconfig = writeShellScriptBin "ldconfig" ''
@@ -85,7 +82,10 @@ let
     exec ${if isMultiBuild then pkgsi686Linux.glibc.bin else pkgs.glibc.bin}/bin/ldconfig -f /etc/ld.so.conf -C /etc/ld.so.cache "$@"
   '';
 
-  etcProfile = writeText "profile" ''
+  etcProfile = pkgs.writeTextFile {
+    name = "${name}-fhsenv-profile";
+    destination = "/etc/profile";
+    text = ''
       export PS1='${name}-fhsenv:\u@\h:\w\$ '
       export LOCALE_ARCHIVE='/usr/lib/locale/locale-archive'
       export PATH="/run/wrappers/bin:/usr/bin:/usr/sbin:$PATH"
@@ -123,152 +123,98 @@ let
 
       ${profile}
     '';
+  };
 
-  # Compose /etc for the fhs environment
-  etcPkg = runCommandLocal "${name}-fhs-etc" { } ''
-    mkdir -p $out/etc
-    pushd $out/etc
+  ensureGsettingsSchemasIsDirectory = runCommandLocal "fhsenv-ensure-gsettings-schemas-directory" {} ''
+    mkdir -p $out/share/glib-2.0/schemas
+    touch $out/share/glib-2.0/schemas/.keep
+  '';
 
-    # environment variables
-    ln -s ${etcProfile} profile
+  # Shamelessly stolen (and cleaned up) from original buildEnv.
+  # Should be semantically equivalent, except we also take
+  # a list of default extra outputs that will be installed
+  # for derivations that don't explicitly specify one.
+  # Note that this is not the same as `extraOutputsToInstall`,
+  # as that will apply even to derivations with an output
+  # explicitly specified, so this does change the behavior
+  # very slightly for that particular edge case.
+  pickOutputs = let
+    pickOutputsOne = outputs: drv:
+      let
+        isSpecifiedOutput = drv.outputSpecified or false;
+        outputsToInstall = drv.meta.outputsToInstall or null;
+        pickedOutputs = if isSpecifiedOutput || outputsToInstall == null
+          then [ drv ]
+          else map (out: drv.${out} or null) (outputsToInstall ++ outputs);
+        extraOutputs = map (out: drv.${out} or null) extraOutputsToInstall;
+        cleanOutputs = lib.filter (o: o != null) (pickedOutputs ++ extraOutputs);
+      in {
+        paths = cleanOutputs;
+        priority = drv.meta.priority or lib.meta.defaultPriority;
+      };
+  in paths: outputs: map (pickOutputsOne outputs) paths;
+
+  paths = let
+    basePaths = [
+      etcProfile
+      # ldconfig wrapper must come first so it overrides the original ldconfig
+      ldconfig
+      # magic package that just creates a directory, to ensure that
+      # the entire directory can't be a symlink, as we will write
+      # compiled schemas to it
+      ensureGsettingsSchemasIsDirectory
+    ] ++ baseTargetPaths ++ targetPaths;
+  in pickOutputs basePaths ["out" "lib" "bin"];
+
+  paths32 = lib.optionals isMultiBuild (
+    let
+      basePaths = baseMultiPaths ++ multiPaths;
+    in pickOutputs basePaths ["out" "lib"]
+  );
+
+  allPaths = paths ++ paths32;
+
+  rootfs-builder = pkgs.rustPlatform.buildRustPackage {
+    name = "fhs-rootfs-bulder";
+    src = ./rootfs-builder;
+    cargoLock.lockFile = ./rootfs-builder/Cargo.lock;
+    doCheck = false;
+  };
+
+  rootfs = pkgs.runCommand "${name}-fhsenv-rootfs" {
+    __structuredAttrs = true;
+    exportReferencesGraph.graph = lib.concatMap (p: p.paths) allPaths;
+    inherit paths paths32 isMultiBuild includeClosures;
+    nativeBuildInputs = [ pkgs.jq ];
+  } ''
+    ${rootfs-builder}/bin/rootfs-builder
+
+    # create a bunch of symlinks for usrmerge
+    ln -s /usr/bin $out/bin
+    ln -s /usr/sbin $out/sbin
+    ln -s /usr/lib $out/lib
+    ln -s /usr/lib32 $out/lib32
+    ln -s /usr/lib64 $out/lib64
+    ln -s /usr/lib64 $out/usr/lib
+
+    # symlink 32-bit ld-linux so it's visible in /lib
+    if [ -e $out/usr/lib32/ld-linux.so.2 ]; then
+      ln -s /usr/lib32/ld-linux.so.2 $out/usr/lib64/ld-linux.so.2
+    fi
 
     # symlink /etc/mtab -> /proc/mounts (compat for old userspace progs)
-    ln -s /proc/mounts mtab
-  '';
+    ln -s /proc/mounts $out/etc/mtab
 
-  # Composes a /usr-like directory structure
-  staticUsrProfileTarget = buildEnv {
-    name = "${name}-usr-target";
-    # ldconfig wrapper must come first so it overrides the original ldconfig
-    paths = [ etcPkg ldconfig ] ++ baseTargetPaths ++ targetPaths;
-    extraOutputsToInstall = [ "out" "lib" "bin" ] ++ extraOutputsToInstall;
-    ignoreCollisions = true;
-    postBuild = ''
-      if [[ -d  $out/share/gsettings-schemas/ ]]; then
-          # Recreate the standard schemas directory if its a symlink to make it writable
-          if [[ -L $out/share/glib-2.0 ]]; then
-              target=$(readlink $out/share/glib-2.0)
-              rm $out/share/glib-2.0
-              mkdir $out/share/glib-2.0
-              ln -fsr $target/* $out/share/glib-2.0
-          fi
-
-          if [[ -L $out/share/glib-2.0/schemas ]]; then
-              target=$(readlink $out/share/glib-2.0/schemas)
-              rm $out/share/glib-2.0/schemas
-              mkdir $out/share/glib-2.0/schemas
-              ln -fsr $target/* $out/share/glib-2.0/schemas
-          fi
-
-          mkdir -p $out/share/glib-2.0/schemas
-
-          for d in $out/share/gsettings-schemas/*; do
+    if [[ -d $out/usr/share/gsettings-schemas/ ]]; then
+      for d in $out/usr/share/gsettings-schemas/*; do
         # Force symlink, in case there are duplicates
-              ln -fsr $d/glib-2.0/schemas/*.xml $out/share/glib-2.0/schemas
-              ln -fsr $d/glib-2.0/schemas/*.gschema.override $out/share/glib-2.0/schemas
+        ln -fsr $d/glib-2.0/schemas/*.xml $out/usr/share/glib-2.0/schemas
+        ln -fsr $d/glib-2.0/schemas/*.gschema.override $out/usr/share/glib-2.0/schemas
       done
-
-          # and compile them
-          ${pkgs.glib.dev}/bin/glib-compile-schemas $out/share/glib-2.0/schemas
-      fi
-    '';
-    inherit includeClosures;
-  };
-
-  staticUsrProfileMulti = buildEnv {
-    name = "${name}-usr-multi";
-    paths = baseMultiPaths ++ multiPaths;
-    extraOutputsToInstall = [ "out" "lib" ] ++ extraOutputsToInstall;
-    ignoreCollisions = true;
-    inherit includeClosures;
-  };
-
-  # setup library paths only for the targeted architecture
-  setupLibDirsTarget = ''
-    # link content of targetPaths
-    cp -rsHf ${staticUsrProfileTarget}/lib lib
-    ln -s lib lib${if is64bit then "64" else "32"}
-  '';
-
-  # setup /lib, /lib32 and /lib64
-  setupLibDirsMulti = ''
-    mkdir -m0755 lib32
-    mkdir -m0755 lib64
-    ln -s lib64 lib
-
-    # copy glibc stuff
-    cp -rsHf ${staticUsrProfileTarget}/lib/32/* lib32/
-    chmod u+w -R lib32/
-
-    # copy content of multiPaths (32bit libs)
-    if [ -d ${staticUsrProfileMulti}/lib ]; then
-      cp -rsHf ${staticUsrProfileMulti}/lib/* lib32/
-      chmod u+w -R lib32/
+      ${pkgs.glib.dev}/bin/glib-compile-schemas $out/usr/share/glib-2.0/schemas
     fi
 
-    # copy content of targetPaths (64bit libs)
-    cp -rsHf ${staticUsrProfileTarget}/lib/* lib64/
-    chmod u+w -R lib64/
-
-    # symlink 32-bit ld-linux.so
-    ln -Lsf ${staticUsrProfileTarget}/lib/32/ld-linux.so.2 lib/
-  '';
-
-  setupLibDirs = if isTargetBuild
-                 then setupLibDirsTarget
-                 else setupLibDirsMulti;
-
-  # the target profile is the actual profile that will be used for the fhs
-  setupTargetProfile = ''
-    mkdir -m0755 usr
-    pushd usr
-
-    ${setupLibDirs}
-
-    '' + lib.optionalString isMultiBuild ''
-    if [ -d "${staticUsrProfileMulti}/share" ]; then
-      cp -rLf ${staticUsrProfileMulti}/share share
-    fi
-    '' + ''
-    if [ -d "${staticUsrProfileTarget}/share" ]; then
-      if [ -d share ]; then
-        chmod -R 755 share
-        cp -rLTf ${staticUsrProfileTarget}/share share
-      else
-        cp -rsHf ${staticUsrProfileTarget}/share share
-      fi
-    fi
-    for i in bin sbin include; do
-      if [ -d "${staticUsrProfileTarget}/$i" ]; then
-        cp -rsHf "${staticUsrProfileTarget}/$i" "$i"
-      fi
-    done
-    cd ..
-
-    for i in etc opt; do
-      if [ -d "${staticUsrProfileTarget}/$i" ]; then
-        cp -rsHf "${staticUsrProfileTarget}/$i" "$i"
-      fi
-    done
-    for i in usr/{bin,sbin,lib,lib32,lib64}; do
-      if [ -d "$i" ]; then
-        ln -s "$i"
-      fi
-    done
-
-    popd
-  '';
-
-in runCommandLocal "${name}-fhs" {
-  inherit nativeBuildInputs;
-  passthru = {
-    inherit args baseTargetPaths targetPaths baseMultiPaths ldconfig isMultiBuild;
-  };
-} ''
-  mkdir -p $out
-  pushd $out
-
-  ${setupTargetProfile}
     ${extraBuildCommands}
     ${lib.optionalString isMultiBuild extraBuildCommandsMulti}
-''
+  '';
+in rootfs

pkgs/build-support/build-fhsenv-bubblewrap/rootfs-builder/Cargo.lock

@@ -0,0 +1,249 @@
+# This file is automatically @generated by Cargo.
+# It is not intended for manual editing.
+version = 3
+
+[[package]]
+name = "anyhow"
+version = "1.0.91"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c042108f3ed77fd83760a5fd79b53be043192bb3b9dba91d8c574c0ada7850c8"
+
+[[package]]
+name = "goblin"
+version = "0.9.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "53ab3f32d1d77146981dea5d6b1e8fe31eedcb7013e5e00d6ccd1259a4b4d923"
+dependencies = [
+ "log",
+ "plain",
+ "scroll",
+]
+
+[[package]]
+name = "itoa"
+version = "1.0.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "49f1f14873335454500d59611f1cf4a4b0f786f9ac11f4312a78e4cf2566695b"
+
+[[package]]
+name = "log"
+version = "0.4.22"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a7a70ba024b9dc04c27ea2f0c0548feb474ec5c54bba33a7f72f873a39d07b24"
+
+[[package]]
+name = "memchr"
+version = "2.7.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "78ca9ab1a0babb1e7d5695e3530886289c18cf2f87ec19a575a0abdce112e3a3"
+
+[[package]]
+name = "plain"
+version = "0.2.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b4596b6d070b27117e987119b4dac604f3c58cfb0b191112e24771b2faeac1a6"
+
+[[package]]
+name = "proc-macro2"
+version = "1.0.89"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f139b0662de085916d1fb67d2b4169d1addddda1919e696f3252b740b629986e"
+dependencies = [
+ "unicode-ident",
+]
+
+[[package]]
+name = "quote"
+version = "1.0.37"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b5b9d34b8991d19d98081b46eacdd8eb58c6f2b201139f7c5f643cc155a633af"
+dependencies = [
+ "proc-macro2",
+]
+
+[[package]]
+name = "rootfs-builder"
+version = "0.1.0"
+dependencies = [
+ "anyhow",
+ "goblin",
+ "serde",
+ "serde_json",
+ "walkdir",
+]
+
+[[package]]
+name = "ryu"
+version = "1.0.18"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f3cb5ba0dc43242ce17de99c180e96db90b235b8a9fdc9543c96d2209116bd9f"
+
+[[package]]
+name = "same-file"
+version = "1.0.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "93fc1dc3aaa9bfed95e02e6eadabb4baf7e3078b0bd1b4d7b6b0b68378900502"
+dependencies = [
+ "winapi-util",
+]
+
+[[package]]
+name = "scroll"
+version = "0.12.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6ab8598aa408498679922eff7fa985c25d58a90771bd6be794434c5277eab1a6"
+dependencies = [
+ "scroll_derive",
+]
+
+[[package]]
+name = "scroll_derive"
+version = "0.12.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7f81c2fde025af7e69b1d1420531c8a8811ca898919db177141a85313b1cb932"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "serde"
+version = "1.0.213"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3ea7893ff5e2466df8d720bb615088341b295f849602c6956047f8f80f0e9bc1"
+dependencies = [
+ "serde_derive",
+]
+
+[[package]]
+name = "serde_derive"
+version = "1.0.213"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7e85ad2009c50b58e87caa8cd6dac16bdf511bbfb7af6c33df902396aa480fa5"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "serde_json"
+version = "1.0.132"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d726bfaff4b320266d395898905d0eba0345aae23b54aee3a737e260fd46db03"
+dependencies = [
+ "itoa",
+ "memchr",
+ "ryu",
+ "serde",
+]
+
+[[package]]
+name = "syn"
+version = "2.0.85"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5023162dfcd14ef8f32034d8bcd4cc5ddc61ef7a247c024a33e24e1f24d21b56"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "unicode-ident",
+]
+
+[[package]]
+name = "unicode-ident"
+version = "1.0.13"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e91b56cd4cadaeb79bbf1a5645f6b4f8dc5bde8834ad5894a8db35fda9efa1fe"
+
+[[package]]
+name = "walkdir"
+version = "2.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "29790946404f91d9c5d06f9874efddea1dc06c5efe94541a7d6863108e3a5e4b"
+dependencies = [
+ "same-file",
+ "winapi-util",
+]
+
+[[package]]
+name = "winapi-util"
+version = "0.1.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cf221c93e13a30d793f7645a0e7762c55d169dbb0a49671918a2319d289b10bb"
+dependencies = [
+ "windows-sys",
+]
+
+[[package]]
+name = "windows-sys"
+version = "0.59.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1e38bc4d79ed67fd075bcc251a1c39b32a1776bbe92e5bef1f0bf1f8c531853b"
+dependencies = [
+ "windows-targets",
+]
+
+[[package]]
+name = "windows-targets"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9b724f72796e036ab90c1021d4780d4d3d648aca59e491e6b98e725b84e99973"
+dependencies = [
+ "windows_aarch64_gnullvm",
+ "windows_aarch64_msvc",
+ "windows_i686_gnu",
+ "windows_i686_gnullvm",
+ "windows_i686_msvc",
+ "windows_x86_64_gnu",
+ "windows_x86_64_gnullvm",
+ "windows_x86_64_msvc",
+]
+
+[[package]]
+name = "windows_aarch64_gnullvm"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "32a4622180e7a0ec044bb555404c800bc9fd9ec262ec147edd5989ccd0c02cd3"
+
+[[package]]
+name = "windows_aarch64_msvc"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "09ec2a7bb152e2252b53fa7803150007879548bc709c039df7627cabbd05d469"
+
+[[package]]
+name = "windows_i686_gnu"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8e9b5ad5ab802e97eb8e295ac6720e509ee4c243f69d781394014ebfe8bbfa0b"
+
+[[package]]
+name = "windows_i686_gnullvm"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0eee52d38c090b3caa76c563b86c3a4bd71ef1a819287c19d586d7334ae8ed66"
+
+[[package]]
+name = "windows_i686_msvc"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "240948bc05c5e7c6dabba28bf89d89ffce3e303022809e73deaefe4f6ec56c66"
+
+[[package]]
+name = "windows_x86_64_gnu"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "147a5c80aabfbf0c7d901cb5895d1de30ef2907eb21fbbab29ca94c5b08b1a78"
+
+[[package]]
+name = "windows_x86_64_gnullvm"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "24d5b23dc417412679681396f2b49f3de8c1473deb516bd34410872eff51ed0d"
+
+[[package]]
+name = "windows_x86_64_msvc"
+version = "0.52.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "589f6da84c646204747d1270a2a5661ea66ed1cced2631d546fdfb155959f9ec"

pkgs/build-support/build-fhsenv-bubblewrap/rootfs-builder/Cargo.toml

@@ -0,0 +1,11 @@
+[package]
+name = "rootfs-builder"
+version = "0.1.0"
+edition = "2021"
+
+[dependencies]
+anyhow = "*"
+serde = { version = "*", features = ["derive"] }
+serde_json = "*"
+walkdir = "*"
+goblin = "*"

pkgs/build-support/build-fhsenv-bubblewrap/rootfs-builder/src/main.rs

@@ -0,0 +1,293 @@
+#![deny(clippy::pedantic)]
+
+use std::{
+    collections::{hash_map::Entry, HashMap},
+    env,
+    fs::{self, File},
+    io::{BufReader, Read},
+    os::unix::fs as ufs,
+    path::{Path, PathBuf},
+};
+
+use anyhow::{anyhow, Context};
+use goblin::{Hint, Object};
+use serde::Deserialize;
+use walkdir::WalkDir;
+
+#[derive(Debug, Deserialize)]
+struct RefGraphNode {
+    path: PathBuf,
+    references: Vec<PathBuf>,
+}
+
+#[derive(Debug, Deserialize)]
+struct InputDrv {
+    paths: Vec<PathBuf>,
+    priority: i64,
+}
+
+#[derive(Debug, Deserialize)]
+#[serde(rename_all = "camelCase")]
+struct StructuredAttrsRoot {
+    graph: Vec<RefGraphNode>,
+    paths: Vec<InputDrv>,
+    paths32: Vec<InputDrv>,
+    include_closures: bool,
+}
+
+#[derive(Copy, Clone, Debug, PartialEq, Eq, PartialOrd, Ord)]
+struct PriorityKey {
+    implicit: bool,
+    group_priority: i64,
+    priority: i64,
+    root_index: usize,
+}
+
+fn build_reference_map(refs: Vec<RefGraphNode>) -> HashMap<PathBuf, Vec<PathBuf>> {
+    refs.into_iter()
+        .map(|mut gn| {
+            gn.references.retain_mut(|x| x != &gn.path);
+            (gn.path, gn.references)
+        })
+        .collect()
+}
+
+fn build_priority_keys(roots: &[InputDrv], group_priority: i64) -> HashMap<PathBuf, PriorityKey> {
+    let mut roots_map = HashMap::new();
+
+    for (idx, path) in roots.iter().enumerate() {
+        for subpath in &path.paths {
+            let priority = PriorityKey {
+                group_priority,
+                priority: path.priority,
+                root_index: idx,
+                implicit: false,
+            };
+
+            roots_map.entry(subpath.clone()).or_insert(priority);
+        }
+    }
+
+    roots_map
+}
+
+fn extend_to_closure(
+    roots: HashMap<PathBuf, PriorityKey>,
+    refs: &HashMap<PathBuf, Vec<PathBuf>>,
+) -> anyhow::Result<HashMap<PathBuf, PriorityKey>> {
+    let mut path_map = HashMap::new();
+
+    for (root, priority) in roots {
+        path_map.insert(root.clone(), priority);
+
+        let mut priority = priority;
+        priority.implicit = true;
+
+        let mut stack = vec![root.clone()];
+
+        while let Some(next) = stack.pop() {
+            match path_map.entry(next.clone()) {
+                Entry::Occupied(mut occupied_entry) => {
+                    let old_priority: &PriorityKey = occupied_entry.get();
+                    if old_priority > &priority {
+                        occupied_entry.insert(priority);
+                    }
+                }
+                Entry::Vacant(vacant_entry) => {
+                    vacant_entry.insert(priority);
+                }
+            }
+
+            stack.extend_from_slice(refs.get(&next).ok_or(anyhow!("encountered unknown path"))?);
+        }
+    }
+
+    Ok(path_map)
+}
+
+#[derive(Clone, Debug)]
+struct CandidatePath {
+    root: PathBuf,
+    relative: PathBuf,
+    priority: PriorityKey,
+}
+
+fn collect_candidate_paths(
+    paths: HashMap<PathBuf, PriorityKey>,
+    mapper: impl Fn(&Path, &Path) -> Option<PathBuf>,
+) -> anyhow::Result<HashMap<PathBuf, Vec<CandidatePath>>> {
+    let mut candidates: HashMap<_, Vec<_>> = HashMap::new();
+
+    for (path, priority) in paths {
+        for entry in WalkDir::new(&path).follow_links(true) {
+            let entry: PathBuf = match entry {
+                Ok(ent) => {
+                    // we don't care about directory structure
+                    if ent.file_type().is_dir() {
+                        continue;
+                    }
+
+                    ent.path().into()
+                }
+                Err(e) => {
+                    match e.io_error() {
+                        // could be a broken symlink, that's fine, we still want to handle those
+                        Some(_) => e
+                            .path()
+                            .ok_or_else(|| anyhow!("I/O error when walking {path:?}"))?
+                            .into(),
+                        None => {
+                            // symlink loop
+                            continue;
+                        }
+                    }
+                }
+            };
+
+            let relative = entry.strip_prefix(&path)?.to_owned();
+            if let Some(mapped) = mapper(&path, &relative) {
+                candidates.entry(mapped).or_default().push(CandidatePath {
+                    root: path.clone(),
+                    relative,
+                    priority,
+                });
+            }
+        }
+    }
+
+    Ok(candidates)
+}
+
+fn remap_native_path(root: &Path, p: &Path) -> Option<PathBuf> {
+    if p.starts_with("bin/") || p.starts_with("sbin/") {
+        return Some(PathBuf::from("usr/").join(p));
+    }
+
+    // glibc-multilib special case
+    if let Ok(no_lib32) = p.strip_prefix("lib/32/") {
+        return Some(PathBuf::from("usr/lib32/").join(no_lib32));
+    }
+
+    remap_multilib_path(root, p)
+}
+
+fn is_32_bit(path: &Path) -> bool {
+    // Be as pessimistic as possible, at least for now.
+    let Ok(mut f) = File::open(path) else {
+        return false;
+    };
+
+    let Ok(Hint::Elf(hint)) = goblin::peek(&mut f) else {
+        return false;
+    };
+
+    if let Some(is64) = hint.is_64 {
+        return !is64;
+    }
+
+    let mut buf = vec![];
+    let Ok(_) = f.read_to_end(&mut buf) else {
+        return false;
+    };
+
+    let Ok(Object::Elf(e)) = goblin::Object::parse(&buf) else {
+        return false;
+    };
+
+    !e.is_64
+}
+
+fn remap_multilib_path(root: &Path, p: &Path) -> Option<PathBuf> {
+    if let Ok(no_lib) = p.strip_prefix("lib/") {
+        let full = root.join(p);
+
+        let libdir = if is_32_bit(&full) { "lib32" } else { "lib64" };
+
+        return Some(PathBuf::from("usr/").join(libdir).join(no_lib));
+    }
+
+    if p.starts_with("etc/") || p.starts_with("opt/") {
+        return Some(p.into());
+    }
+
+    if p.starts_with("share/") || p.starts_with("include/") {
+        return Some(PathBuf::from("usr/").join(p));
+    }
+
+    None
+}
+
+fn build_plan(
+    paths: HashMap<PathBuf, PriorityKey>,
+    paths32: HashMap<PathBuf, PriorityKey>,
+) -> anyhow::Result<HashMap<PathBuf, PathBuf>> {
+    let candidates_native = collect_candidate_paths(paths, remap_native_path)?;
+    let candidates_32 = collect_candidate_paths(paths32, remap_multilib_path)?;
+
+    let mut all_candidates: HashMap<_, Vec<_>> = HashMap::new();
+
+    for map in [candidates_native, candidates_32] {
+        for (path, candidates) in map {
+            all_candidates
+                .entry(path)
+                .or_default()
+                .extend_from_slice(&candidates);
+        }
+    }
+
+    let mut final_plan: HashMap<PathBuf, PathBuf> = HashMap::new();
+    for (path, candidates) in all_candidates {
+        let best = candidates
+            .into_iter()
+            .min_by_key(|&CandidatePath { priority, .. }| priority)
+            .ok_or(anyhow!("candidate list empty"))?;
+        final_plan.insert(path, best.root.join(best.relative));
+    }
+
+    Ok(final_plan)
+}
+
+fn build_env(out: &Path, plan: HashMap<PathBuf, PathBuf>) -> anyhow::Result<()> {
+    fs::create_dir_all(out)?;
+
+    for (dest, src) in plan {
+        let full_dest = out.join(&dest);
+        let dest_dir = full_dest
+            .parent()
+            .ok_or(anyhow!("destination directory is root"))
+            .with_context(|| {
+                format!("When trying to determine destination directory for {full_dest:?}")
+            })?;
+        fs::create_dir_all(dest_dir)
+            .with_context(|| format!("When trying to create directory {dest_dir:?}"))?;
+        ufs::symlink(&src, &full_dest)
+            .with_context(|| format!("When symlinking {src:?} to {full_dest:?}"))?;
+    }
+
+    Ok(())
+}
+
+fn main() -> anyhow::Result<()> {
+    let filename = env::var("NIX_ATTRS_JSON_FILE")?;
+
+    let reader = File::open(filename)?;
+    let buf_reader = BufReader::new(reader);
+
+    let attrs: StructuredAttrsRoot = serde_json::from_reader(buf_reader)?;
+
+    let mut paths = build_priority_keys(&attrs.paths, 1);
+    let mut paths32 = build_priority_keys(&attrs.paths32, 2);
+
+    if attrs.include_closures {
+        let refs = build_reference_map(attrs.graph);
+
+        paths = extend_to_closure(paths, &refs)?;
+        paths32 = extend_to_closure(paths32, &refs)?;
+    };
+
+    let plan = build_plan(paths, paths32)?;
+
+    let out_dir = env::var("out")?;
+
+    build_env(&PathBuf::from(out_dir), plan)
+}

pkgs/by-name/_6/_64gram/package.nix

@@ -1,25 +1,28 @@
-{ lib
-, stdenv
-, fetchFromGitHub
-, fetchpatch
-, telegram-desktop
-, nix-update-script
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  fetchpatch,
+  telegram-desktop,
+  withWebkit ? true,
 }:
 
-telegram-desktop.overrideAttrs (old: rec {
+telegram-desktop.override {
   pname = "64gram";
-  version = "1.1.43";
+  inherit withWebkit;
+  unwrapped = telegram-desktop.unwrapped.overrideAttrs (old: rec {
+    pname = "64gram-unwrapped";
+    version = "1.1.45";
 
     src = fetchFromGitHub {
       owner = "TDesktop-x64";
       repo = "tdesktop";
       rev = "v${version}";
-
+      hash = "sha256-bDe4tmJRWnussa5QrBh2oStvIF7R5/nbPfljb3us3nk=";
       fetchSubmodules = true;
-    hash = "sha256-vRiAIGY3CU5+hsdn8xiNbgvSM3eGRVwnvsSmSoaDN/k=";
     };
 
-  patches = (old.patches or []) ++ [
+    patches = (old.patches or [ ]) ++ [
       (fetchpatch {
         url = "https://github.com/TDesktop-x64/tdesktop/commit/c996ccc1561aed089c8b596f6ab3844335bbf1df.patch";
         revert = true;
@@ -27,20 +30,19 @@ telegram-desktop.overrideAttrs (old: rec {
       })
     ];
 
-  cmakeFlags = (old.cmakeFlags or []) ++ [
+    cmakeFlags = (old.cmakeFlags or [ ]) ++ [
       (lib.cmakeBool "DESKTOP_APP_DISABLE_AUTOUPDATE" true)
       (lib.cmakeBool "disable_autoupdate" true)
     ];
 
-  passthru.updateScript = nix-update-script {};
-
-  meta = with lib; {
+    meta = {
       description = "Unofficial Telegram Desktop providing Windows 64bit build and extra features";
-    license = licenses.gpl3Only;
-    platforms = platforms.all;
+      license = lib.licenses.gpl3Only;
+      platforms = lib.platforms.all;
       homepage = "https://github.com/TDesktop-x64/tdesktop";
       changelog = "https://github.com/TDesktop-x64/tdesktop/releases/tag/v${version}";
-    maintainers = with maintainers; [ clot27 ];
+      maintainers = with lib.maintainers; [ clot27 ];
       mainProgram = if stdenv.hostPlatform.isLinux then "telegram-desktop" else "Telegram";
     };
-})
+  });
+}

pkgs/by-name/ar/ark-pixel-font/package.nix

@@ -1,9 +1,21 @@
-{ lib
-, python312Packages
-, fetchFromGitHub
-, nix-update-script
+{
+  lib,
+  python312Packages,
+  fetchFromGitHub,
+  nix-update-script,
+  fetchPypi,
 }:
 
+let
+  pixel-font-builder-compat = python312Packages.pixel-font-builder.overrideAttrs rec {
+    version = "0.0.26";
+    src = fetchPypi {
+      inherit version;
+      pname = "pixel_font_builder";
+      hash = "sha256-bgs2FbOA5tcUXe5+KuVztWGAv5yFxQNBaiZMeZ+ic+8=";
+    };
+  };
+in
 python312Packages.buildPythonPackage rec {
   pname = "ark-pixel-font";
   version = "2024.05.12";
@@ -18,7 +30,7 @@ python312Packages.buildPythonPackage rec {
   format = "other";
 
   nativeBuildInputs = with python312Packages; [
-    pixel-font-builder
+    pixel-font-builder-compat
     unidata-blocks
     character-encoding-utils
     pypng

pkgs/by-name/br/brave/make-brave.nix

@@ -16,6 +16,7 @@
 , gsettings-desktop-schemas
 , gtk3
 , gtk4
+, qt6
 , libX11
 , libXScrnSaver
 , libXcomposite
@@ -83,7 +84,7 @@ let
     libxkbcommon libXScrnSaver libXcomposite libXcursor libXdamage
     libXext libXfixes libXi libXrandr libXrender libxshmfence
     libXtst libuuid mesa nspr nss pango pipewire udev wayland
-    xorg.libxcb zlib snappy libkrb5
+    xorg.libxcb zlib snappy libkrb5 qt6.qtbase
   ]
     ++ optional pulseSupport libpulseaudio
     ++ optional libvaSupport libva;

pkgs/by-name/by/byedpi/package.nix

@@ -6,13 +6,13 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "byedpi";
-  version = "0.14.1";
+  version = "0.15";
 
   src = fetchFromGitHub {
     owner = "hufrea";
     repo = "byedpi";
     rev = "refs/tags/v${finalAttrs.version}";
-    hash = "sha256-JdL+3ETNxaEtOLUhgLSABL9C8w/EM4Ay37OXU5jLCFA=";
+    hash = "sha256-jsQFfIvWvpJRBewUSS5bhDGocfPTvtG6LiejUxdqk28=";
   };
 
   installPhase = ''

pkgs/by-name/cc/cctools/package.nix

@@ -170,7 +170,7 @@ stdenv.mkDerivation (finalAttrs: {
       apple-psl20
       gpl2 # GNU as
     ];
-    maintainers = with lib.maintainers; [ reckenrode ];
+    maintainers = lib.teams.darwin.members;
     platforms = lib.platforms.darwin;
   };
 })

pkgs/by-name/co/connectome-workbench/package.nix

@@ -10,13 +10,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "connectome-workbench";
-  version = "2.0.0";
+  version = "2.0.1";
 
   src = fetchFromGitHub {
     owner = "Washington-University";
     repo = "workbench";
     rev = "refs/tags/v${finalAttrs.version}";
-    hash = "sha256-d0J5bXp6mJlUQBmInxPXPkd5P5H+3F6fE9fc8pD1fUc=";
+    hash = "sha256-M5iverVDhBI/ijbgwfa6gHrthY4wrUi+/2A/443jBqg=";
   };
 
   sourceRoot = "${finalAttrs.src.name}/src";
@@ -40,6 +40,8 @@ stdenv.mkDerivation (finalAttrs: {
   # ld: ../Brain/libBrain.a(BrainOpenGLVolumeObliqueSliceDrawing.cxx.o): undefined reference to symbol 'glGetFloatv'
   # ld: /nix/store/a5vcvrkh1c2ng5kr584g3zw3991vnhks-libGL-1.7.0/lib/libGL.so.1: error adding symbols: DSO missing from command line
 
+  env.NIX_CFLAGS_COMPILE = "-fpermissive";
+
   nativeBuildInputs = [
     cmake
     libsForQt5.wrapQtAppsHook

pkgs/by-name/de/detect-it-easy/0001-remove-hard-coded-paths-in-xoptions.patch

@@ -1,14 +1,14 @@
 diff --git a/XOptions/xoptions.cpp b/XOptions/xoptions.cpp
-index ca5723e..30574a5 100755
+index 8c887c3..36cdbc3 100755
 --- a/XOptions/xoptions.cpp
 +++ b/XOptions/xoptions.cpp
-@@ -1531,14 +1531,7 @@ bool XOptions::checkNative(const QString &sIniFileName)
+@@ -1754,14 +1754,7 @@ bool XOptions::checkNative(const QString &sIniFileName)
  #if defined(Q_OS_MAC)
      bResult = true;
  #elif defined(Q_OS_LINUX) || defined(Q_OS_FREEBSD)
 -    QString sApplicationDirPath = qApp->applicationDirPath();
 -
--    if ((sApplicationDirPath == "/bin") || (sApplicationDirPath == "/usr/bin") || (sApplicationDirPath == "/usr/local/bin") ||
+-    if ((sApplicationDirPath == "/bin") || (sApplicationDirPath == "/usr/bin") || (sApplicationDirPath == "/usr/local/bin") || (sApplicationDirPath == "/app/bin") ||
 -        (sApplicationDirPath.contains("/usr/local/bin$")) || isAppImage()) {
 -        bResult = true;
 -    } else {
@@ -18,7 +18,7 @@ index ca5723e..30574a5 100755
  #elif defined(Q_OS_WIN)
      QString sApplicationDirPath = qApp->applicationDirPath();
  
-@@ -1565,22 +1558,7 @@ QString XOptions::getApplicationDataPath()
+@@ -1788,22 +1781,7 @@ QString XOptions::getApplicationDataPath()
  #ifdef Q_OS_MAC
      sResult = sApplicationDirPath + "/../Resources";
  #elif defined(Q_OS_LINUX)

pkgs/by-name/de/detect-it-easy/package.nix

@@ -13,14 +13,14 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "detect-it-easy";
-  version = "3.09";
+  version = "3.10";
 
   src = fetchFromGitHub {
     owner = "horsicq";
     repo = "DIE-engine";
     rev = finalAttrs.version;
     fetchSubmodules = true;
-    hash = "sha256-A9YZBlGf3j+uSefPiDhrS1Qtu6vaLm4Yodt7BioGD2Q=";
+    hash = "sha256-yHgxYig5myY2nExweUk2muKbJTKN3SiwOLgQcMIY/BQ=";
   };
 
   patches = [ ./0001-remove-hard-coded-paths-in-xoptions.patch ];
@@ -53,7 +53,6 @@ stdenv.mkDerivation (finalAttrs: {
 
   # clean up wrongly created dirs in `install.sh` and broken .desktop file
   postInstall = ''
-    rm -r $out/lib/{bin,share}
     grep -v "Version=#VERSION#" $src/LINUX/die.desktop > $out/share/applications/die.desktop
   '';
 
@@ -61,6 +60,7 @@ stdenv.mkDerivation (finalAttrs: {
     description = "Program for determining types of files for Windows, Linux and MacOS.";
     mainProgram = "die";
     homepage = "https://github.com/horsicq/Detect-It-Easy";
+    changelog = "https://github.com/horsicq/Detect-It-Easy/blob/master/changelog.txt";
     maintainers = with lib.maintainers; [ ivyfanchiang ];
     platforms = [ "x86_64-linux" ];
     license = lib.licenses.mit;

pkgs/by-name/di/dissent/package.nix

@@ -1,4 +1,5 @@
 { buildGoModule
+, fetchFromGitLab
 , fetchFromGitHub
 , gobject-introspection
 , gst_all_1
@@ -12,6 +13,19 @@
 , wrapGAppsHook4
 }:
 
+let
+  libspelling_2_1 = libspelling.overrideAttrs {
+    version = "0.2.1";
+
+    src = fetchFromGitLab {
+      domain = "gitlab.gnome.org";
+      owner = "GNOME";
+      repo = "libspelling";
+      rev = "refs/tags/0.2.1";
+      hash = "sha256-0OGcwPGWtYYf0XmvzXEaQgebBOW/6JWcDuF4MlQjCZQ=";
+    };
+  };
+in
 buildGoModule rec {
   pname = "dissent";
   version = "0.0.30";
@@ -39,7 +53,9 @@ buildGoModule rec {
     libadwaita
     libcanberra-gtk3
     sound-theme-freedesktop
-    libspelling
+    # gotk4-spelling fails to build with libspelling >= 0.3.0
+    # https://github.com/diamondburned/gotk4-spelling/issues/1
+    libspelling_2_1
     gtksourceview5
   ];
 

pkgs/by-name/ed/edge-runtime/librusty_v8.nix

@@ -0,0 +1,28 @@
+{
+  lib,
+  stdenv,
+  fetchurl,
+}:
+
+let
+  fetch_librusty_v8 =
+    args:
+    fetchurl {
+      name = "librusty_v8-${args.version}";
+      url = "https://github.com/denoland/rusty_v8/releases/download/v${args.version}/librusty_v8_release_${stdenv.hostPlatform.rust.rustcTarget}.a.gz";
+      hash = args.shas.${stdenv.hostPlatform.system};
+      meta = {
+        inherit (args) version;
+        sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
+      };
+    };
+in
+fetch_librusty_v8 {
+  version = "0.97.1";
+  shas = {
+    x86_64-linux = "sha256-wQBEi2Vs5ruhSkq0n3z8WWjls6V3th2cm+O6s4LDB8k=";
+    aarch64-linux = "sha256-U0PCUNcshm7AaBuUgwQQ1Qn9dr1iL2Okodl6BI/nZR8=";
+    x86_64-darwin = "sha256-cGXOstCOdqaOpU2LcOT5A0JfnkoDvUHhOcCJ9vsS7CM=";
+    aarch64-darwin = "sha256-9TmAON0KUVRQISTudyryIhf4VC/Dc4caq69iquDdrTU=";
+  };
+}

pkgs/by-name/ed/edge-runtime/package.nix

@@ -1,17 +1,18 @@
-{ stdenv
-, lib
-, callPackage
-, fetchFromGitHub
-, rustPlatform
-, nix-update-script
-, darwin
-, openssl
-, pkg-config
+{
+  stdenv,
+  lib,
+  callPackage,
+  fetchFromGitHub,
+  rustPlatform,
+  nix-update-script,
+  darwin,
+  openssl,
+  pkg-config,
 }:
 
 let
   pname = "edge-runtime";
-  version = "1.53.4";
+  version = "1.60.1";
 in
 rustPlatform.buildRustPackage {
   inherit pname version;
@@ -20,21 +21,34 @@ rustPlatform.buildRustPackage {
     owner = "supabase";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-sDgGfQiAUuI+JaF0BRB5lwvjbWWIoTV/k/tbQsBBc4E=";
+    hash = "sha256-w0iSKHT6aIixKh1bHg1lOQNEw/emKK7R2iLzWjb2Pnk=";
     fetchSubmodules = true;
   };
 
   cargoLock = {
     lockFile = ./Cargo.lock;
     outputHashes = {
-      "ort-2.0.0-rc.0" = "sha256-j3g9ES2ZLmAAcPYgszBGDG16HiFJTnohwxSvXypFGTw=";
+      "deno_core-0.293.0" = "sha256-5WBORHokzWPdro9rmBijcsx/j81YFaEfMIK276bfI1o=";
+      "eszip-0.72.2" = "sha256-lzJeapA5NTWBnBaQY8i82OeYN2DIukJZKoRAXFG4qVA=";
+      "ort-2.0.0-rc.2" = "sha256-jOKeulnW/m+q1xf77jaNzLT+In/AFcSDDbz7xF23x5g=";
     };
   };
 
-  nativeBuildInputs = [ pkg-config rustPlatform.bindgenHook ];
+  nativeBuildInputs = [
+    pkg-config
+    rustPlatform.bindgenHook
+  ];
 
-  buildInputs = lib.optionals stdenv.hostPlatform.isLinux [ openssl ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin (with darwin.apple_sdk.frameworks; [ Security CoreFoundation SystemConfiguration ]);
+  buildInputs =
+    lib.optionals stdenv.hostPlatform.isLinux [ openssl ]
+    ++ lib.optionals stdenv.hostPlatform.isDarwin (
+      with darwin.apple_sdk.frameworks;
+      [
+        Security
+        CoreFoundation
+        SystemConfiguration
+      ]
+    );
 
   # The v8 package will try to download a `librusty_v8.a` release at build time to our read-only filesystem
   # To avoid this we pre-download the file and export it via RUSTY_V8_ARCHIVE

pkgs/by-name/fo/forgejo-runner/package.nix

@@ -8,17 +8,17 @@
 
 buildGoModule rec {
   pname = "forgejo-runner";
-  version = "3.5.1";
+  version = "4.0.1";
 
   src = fetchFromGitea {
     domain = "code.forgejo.org";
     owner = "forgejo";
     repo = "runner";
     rev = "v${version}";
-    hash = "sha256-LRMkwSrBU5/IPXMhRT05pE487nmSffXvmfbwBiqpyj8=";
+    hash = "sha256-hG8gCohf+U8T9A9Abqey9upErJklbCp8HuzHQKFcu3E=";
   };
 
-  vendorHash = "sha256-XLDtWYFHwBqbkzj4yRyr3uC1FnpS0bn1ia8i6m+CTBM=";
+  vendorHash = "sha256-yRXI9/LVj4f7qFdScqfpL5WCsK+lJXa6yQmdbUhfrKY=";
 
   ldflags = [
     "-s"

pkgs/by-name/ka/kapacitor/0001-fix-build.patch

@@ -0,0 +1,190 @@
+From 3a5c573079f427dcda47176137747806200551cb Mon Sep 17 00:00:00 2001
+From: wxt <3264117476@qq.com>
+Date: Fri, 27 Sep 2024 21:25:14 +0800
+Subject: [PATCH] fix build
+
+---
+ flux-core/src/semantic/flatbuffers/types.rs |  6 +++---
+ flux-core/src/semantic/nodes.rs             |  5 ++---
+ flux-core/src/semantic/sub.rs               | 24 ++++++++++-----------
+ flux-core/src/semantic/types.rs             |  5 +++--
+ go/libflux/buildinfo.gen.go                 |  9 ++++----
+ 5 files changed, 25 insertions(+), 24 deletions(-)
+
+diff --git a/flux-core/src/semantic/flatbuffers/types.rs b/flux-core/src/semantic/flatbuffers/types.rs
+index c3eecf0..e7e1c95 100644
+--- a/flux-core/src/semantic/flatbuffers/types.rs
++++ b/flux-core/src/semantic/flatbuffers/types.rs
+@@ -108,7 +108,7 @@ impl From<fb::PolyType<'_>> for Option<PolyType> {
+         for value in c.iter() {
+             let constraint: Option<(Tvar, Kind)> = value.into();
+             let (tv, kind) = constraint?;
+-            cons.entry(tv).or_insert_with(Vec::new).push(kind);
++            cons.entry(tv).or_default().push(kind);
+         }
+         Some(PolyType {
+             vars,
+@@ -345,9 +345,9 @@ where
+     builder.finished_data()
+ }
+ 
+-pub fn deserialize<'a, T: 'a, S>(buf: &'a [u8]) -> S
++pub fn deserialize<'a, T, S>(buf: &'a [u8]) -> S
+ where
+-    T: flatbuffers::Follow<'a> + flatbuffers::Verifiable,
++    T: flatbuffers::Follow<'a> + flatbuffers::Verifiable + 'a,
+     S: std::convert::From<T::Inner>,
+ {
+     flatbuffers::root::<T>(buf).unwrap().into()
+diff --git a/flux-core/src/semantic/nodes.rs b/flux-core/src/semantic/nodes.rs
+index 3213991..f64dbd4 100644
+--- a/flux-core/src/semantic/nodes.rs
++++ b/flux-core/src/semantic/nodes.rs
+@@ -822,9 +822,8 @@ impl VariableAssgn {
+         //
+         // Note these variables are fixed after generalization
+         // and so it is safe to update these nodes in place.
+-        self.vars = p.vars.clone();
+-        self.cons = p.cons.clone();
+-
++	self.vars.clone_from(&p.vars);
++        self.cons.clone_from(&p.cons);
+         // Update the type environment
+         infer.env.add(self.id.name.clone(), p);
+         Ok(())
+diff --git a/flux-core/src/semantic/sub.rs b/flux-core/src/semantic/sub.rs
+index 2ca73e0..1431565 100644
+--- a/flux-core/src/semantic/sub.rs
++++ b/flux-core/src/semantic/sub.rs
+@@ -481,7 +481,7 @@ where
+ }
+ 
+ #[allow(clippy::too_many_arguments, clippy::type_complexity)]
+-pub(crate) fn merge4<A: ?Sized, B: ?Sized, C: ?Sized, D: ?Sized>(
++pub(crate) fn merge4<A, B, C, D>(
+     a_original: &A,
+     a: Option<A::Owned>,
+     b_original: &B,
+@@ -492,10 +492,10 @@ pub(crate) fn merge4<A: ?Sized, B: ?Sized, C: ?Sized, D: ?Sized>(
+     d: Option<D::Owned>,
+ ) -> Option<(A::Owned, B::Owned, C::Owned, D::Owned)>
+ where
+-    A: ToOwned,
+-    B: ToOwned,
+-    C: ToOwned,
+-    D: ToOwned,
++    A: ToOwned + ?Sized,
++    B: ToOwned + ?Sized,
++    C: ToOwned + ?Sized,
++    D: ToOwned + ?Sized,
+ {
+     let a_b_c = merge3(a_original, a, b_original, b, c_original, c);
+     merge_fn(
+@@ -515,7 +515,7 @@ where
+     .map(|((a, b, c), d)| (a, b, c, d))
+ }
+ 
+-pub(crate) fn merge3<A: ?Sized, B: ?Sized, C: ?Sized>(
++pub(crate) fn merge3<A, B, C>(
+     a_original: &A,
+     a: Option<A::Owned>,
+     b_original: &B,
+@@ -524,9 +524,9 @@ pub(crate) fn merge3<A: ?Sized, B: ?Sized, C: ?Sized>(
+     c: Option<C::Owned>,
+ ) -> Option<(A::Owned, B::Owned, C::Owned)>
+ where
+-    A: ToOwned,
+-    B: ToOwned,
+-    C: ToOwned,
++    A: ToOwned + ?Sized,
++    B: ToOwned + ?Sized,
++    C: ToOwned + ?Sized,
+ {
+     let a_b = merge(a_original, a, b_original, b);
+     merge_fn(
+@@ -542,15 +542,15 @@ where
+ 
+ /// Merges two values using `f` if either or both them is `Some(..)`.
+ /// If both are `None`, `None` is returned.
+-pub(crate) fn merge<A: ?Sized, B: ?Sized>(
++pub(crate) fn merge<A, B>(
+     a_original: &A,
+     a: Option<A::Owned>,
+     b_original: &B,
+     b: Option<B::Owned>,
+ ) -> Option<(A::Owned, B::Owned)>
+ where
+-    A: ToOwned,
+-    B: ToOwned,
++    A: ToOwned + ?Sized,
++    B: ToOwned + ?Sized,
+ {
+     merge_fn(a_original, A::to_owned, a, b_original, B::to_owned, b)
+ }
+diff --git a/flux-core/src/semantic/types.rs b/flux-core/src/semantic/types.rs
+index 6a0e292..685475a 100644
+--- a/flux-core/src/semantic/types.rs
++++ b/flux-core/src/semantic/types.rs
+@@ -1327,7 +1327,7 @@ fn collect_record(record: &Record) -> (RefMonoTypeVecMap<'_, RecordLabel>, Optio
+ 
+     let mut fields = record.fields();
+     for field in &mut fields {
+-        a.entry(&field.k).or_insert_with(Vec::new).push(&field.v);
++        a.entry(&field.k).or_default().push(&field.v);
+     }
+     (a, fields.tail())
+ }
+@@ -1812,7 +1812,7 @@ impl PartialEq<&str> for Label {
+ 
+ impl PartialOrd for Label {
+     fn partial_cmp(&self, other: &Self) -> Option<std::cmp::Ordering> {
+-        self.0.name().partial_cmp(other.0.name())
++        Some(self.cmp(other))
+     }
+ }
+ 
+@@ -2198,6 +2198,7 @@ impl Function {
+ pub(crate) trait TypeLike {
+     type Error;
+     fn typ(&self) -> &MonoType;
++    #[allow(dead_code)]
+     fn into_type(self) -> MonoType;
+     fn error(&self, error: Error) -> Self::Error;
+ }
+diff --git a/go/libflux/buildinfo.gen.go b/go/libflux/buildinfo.gen.go
+index 2d13f4a..266f493 100644
+--- a/go/libflux/buildinfo.gen.go
++++ b/go/libflux/buildinfo.gen.go
+@@ -10,6 +10,7 @@ package libflux
+ // and forces the cgo library to rebuild and relink
+ // the sources. This is because non-C/C++ sources
+ // are not tracked by Go's build system.'
++//
+ //lint:ignore U1000 generated code
+ var sourceHashes = map[string]string{
+ 	"libflux/Cargo.lock":                                                                          "ec8537d38afbe08ecf451990b8c0a84ee4b30ee66d440d6525832c769764e44e",
+@@ -41,17 +42,17 @@ var sourceHashes = map[string]string{
+ 	"libflux/flux-core/src/semantic/env.rs":                                                       "8da036aa5f0e09f94fd2461687e97131068e56c762bef8cd98cfd91f36ef3e98",
+ 	"libflux/flux-core/src/semantic/flatbuffers/mod.rs":                                           "270671ffdcb1eb5308f9bbab0431c9464df264070a2deb05c526d182a6ec5585",
+ 	"libflux/flux-core/src/semantic/flatbuffers/semantic_generated.rs":                            "beaaa6b08d8b56dba81153a58e440bbdc430b4eca0201a3431e90b793f1adbce",
+-	"libflux/flux-core/src/semantic/flatbuffers/types.rs":                                         "029d51104eb4a0bbfc8d82a470e0f2915a27d7cb00c08a3f35e638b5a3105fc2",
++	"libflux/flux-core/src/semantic/flatbuffers/types.rs":                                         "c378f78c87464d9ecd4dc86b4808c0268e3968adf3def0170c77ce78bb0200c9",
+ 	"libflux/flux-core/src/semantic/formatter/mod.rs":                                             "8dd34520750a39ad242adfbb68c38a170d56bad82d5ccf80b165f0977ea68289",
+ 	"libflux/flux-core/src/semantic/fresh.rs":                                                     "97238fbc317e7c51836a6ba3441d641d9f4f8c7f637bde4bccbd0e09146129d0",
+ 	"libflux/flux-core/src/semantic/fs.rs":                                                        "f7f609bc8149769d99b737150e184a2d54029c0b768365dbcf08ff193b0e1f6f",
+ 	"libflux/flux-core/src/semantic/import.rs":                                                    "184e955211db1ceb1be782b4daf75584b86907b1428e50015497909cfc2dd89a",
+ 	"libflux/flux-core/src/semantic/infer.rs":                                                     "9d4293f2471a90cc89c1e45cdc72082e0da1a484981b803aea05856e6b4d722f",
+ 	"libflux/flux-core/src/semantic/mod.rs":                                                       "a70c32d73f0053e4a3eda7ad23626252cf6420b5db8b440a7351c2f62aa7a948",
+-	"libflux/flux-core/src/semantic/nodes.rs":                                                     "23ee2dec99b71f0fe81987528b3dfbd95e89d77a274ccc8a0baa146dea89ad51",
+-	"libflux/flux-core/src/semantic/sub.rs":                                                       "a989e50c113ca899fe02f8d49a4744a420580a3f803f656db25beb2d0c2a247b",
++	"libflux/flux-core/src/semantic/nodes.rs":                                                     "d5bff77bcb3de0e730b2a3f6d1245a12c718dfe3b8ecf937532330d2579ab53f",
++	"libflux/flux-core/src/semantic/sub.rs":                                                       "618713f4d14e9e2674204a9d293600692213327e77842cbe973c7b1715e23f24",
+ 	"libflux/flux-core/src/semantic/symbols.rs":                                                   "ddbceca632ca384c6bb461a660e02781c43295025f2dd10f1ea997131dd5eb30",
+-	"libflux/flux-core/src/semantic/types.rs":                                                     "ed414b695e925f18f74984ec88bba652ef8dd8c9e905cb9e8fa19b101a4601b4",
++	"libflux/flux-core/src/semantic/types.rs":                                                     "ae9cdcff357d217c0f744769a95b9f3bf55083f923df0c235f52de2b40be8f74",
+ 	"libflux/flux-core/src/semantic/vectorize.rs":                                                 "6ce2dc4e6ff572abc0146a220291322ea88557ce674ae16220a2d67420e9fa0d",
+ 	"libflux/flux-core/src/semantic/walk/_walk.rs":                                                "c3d04e72cfbe595d4919b84f4df4bc6c55297516cf8e12e6cb691f48be648291",
+ 	"libflux/flux-core/src/semantic/walk/mod.rs":                                                  "f71aac086dd1d7b730e24bac690a3e47a9bfe575cd6cba499af67db9b920c726",
+-- 
+2.46.0
+

pkgs/by-name/ka/kapacitor/package.nix

@@ -1,22 +1,23 @@
-{ stdenv
-, lib
-, rustPlatform
-, fetchFromGitHub
-, fetchpatch
-, libiconv
-, buildGoModule
-, pkg-config
+{
+  stdenv,
+  lib,
+  rustPlatform,
+  fetchFromGitHub,
+  fetchpatch,
+  libiconv,
+  buildGoModule,
+  pkg-config,
 }:
 
 let
   libflux_version = "0.171.0";
   flux = rustPlatform.buildRustPackage rec {
     pname = "libflux";
-    version = "v${libflux_version}";
+    version = "${libflux_version}";
     src = fetchFromGitHub {
       owner = "influxdata";
       repo = "flux";
-      rev = "v${libflux_version}";
+      rev = "refs/tags/v${libflux_version}";
       hash = "sha256-v9MUR+PcxAus91FiHYrMN9MbNOTWewh7MT6/t/QWQcM=";
     };
     patches = [
@@ -29,6 +30,8 @@ let
       # Can be removed as soon as kapacitor depends on a newer version of `libflux`, cf:
       # https://github.com/influxdata/kapacitor/blob/v1.7.0/go.mod#L26
       ./fix-linting-error-on-unneeded-clone.patch
+      # https://github.com/influxdata/flux/commit/68c831c40b396f0274f6a9f97d77707c39970b02
+      ./0001-fix-build.patch
 
       # https://github.com/influxdata/flux/pull/5273
       # fix compile error with Rust 1.64
@@ -40,7 +43,7 @@ let
       })
     ];
     sourceRoot = "${src.name}/libflux";
-    cargoHash = "sha256-oAMoGGdR0QEjSzZ0/J5J9s/ekSlryCcRBSo5N2r70Ko=";
+    cargoHash = "sha256-yIYeJvLe+L72ZyuQ2AK6l4HGSF/tgCyGQsXEOWUXDn0=";
     nativeBuildInputs = [ rustPlatform.bindgenHook ];
     buildInputs = lib.optional stdenv.hostPlatform.isDarwin libiconv;
     pkgcfg = ''
@@ -51,28 +54,30 @@ let
       Libs: -L/out/lib -lflux -lpthread
     '';
     passAsFile = [ "pkgcfg" ];
-    postInstall = ''
+    postInstall =
+      ''
         mkdir -p $out/include $out/pkgconfig
         cp -r $NIX_BUILD_TOP/source/libflux/include/influxdata $out/include
         substitute $pkgcfgPath $out/pkgconfig/flux.pc \
-        --replace /out $out
-    '' + lib.optionalString stdenv.hostPlatform.isDarwin ''
+          --replace-fail /out $out
+      ''
+      + lib.optionalString stdenv.hostPlatform.isDarwin ''
         install_name_tool -id $out/lib/libflux.dylib $out/lib/libflux.dylib
       '';
   };
 in
 buildGoModule rec {
   pname = "kapacitor";
-  version = "1.7.0";
+  version = "1.7.5";
 
   src = fetchFromGitHub {
     owner = "influxdata";
     repo = "kapacitor";
-    rev = "v${version}";
-    hash = "sha256-vDluZZrct1x+OMVU8MNO56YBZq7JNlpW68alOrAGYSM=";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-vxaLfJq0NFAJst0/AEhNJUl9dAaZY3blZAFthseMSX0=";
   };
 
-  vendorHash = "sha256-OX4QAthg15lwMyhOPyLTS++CMvGI5Um+FSd025PhW3E=";
+  vendorHash = "sha256-myToEgta8R5R4v2/nZqtQQvNdy1kWgwklbQeFxzIdgs=";
 
   nativeBuildInputs = [ pkg-config ];
 
@@ -90,20 +95,34 @@ buildGoModule rec {
   # Remove failing server tests
   preCheck = ''
     rm server/server_test.go
+    rm pipeline/tick/*test.go
   '';
 
+  checkFlags =
+    let
+      skippedTests = [
+        "TestBatch_KapacitorLoopback"
+      ];
+    in
+    [
+      "-skip=^${builtins.concatStringsSep "$|^" skippedTests}$"
+    ];
+
   # Tests start http servers which need to bind to local addresses,
   # but that fails in the Darwin sandbox by default unless this option is turned on
   # Error is: panic: httptest: failed to listen on a port: listen tcp6 [::1]:0: bind: operation not permitted
   # See also https://github.com/NixOS/nix/pull/1646
   __darwinAllowLocalNetworking = true;
 
-  meta = with lib; {
+  meta = {
     description = "Open source framework for processing, monitoring, and alerting on time series data";
     homepage = "https://influxdata.com/time-series-platform/kapacitor/";
     downloadPage = "https://github.com/influxdata/kapacitor/releases";
-    license = licenses.mit;
+    license = lib.licenses.mit;
     changelog = "https://github.com/influxdata/kapacitor/blob/master/CHANGELOG.md";
-    maintainers = with maintainers; [ offline totoroot ];
+    maintainers = with lib.maintainers; [
+      offline
+      totoroot
+    ];
   };
 }

pkgs/by-name/ld/ld64/package.nix

@@ -226,7 +226,7 @@ stdenv.mkDerivation (finalAttrs: {
     homepage = "https://opensource.apple.com/releases/";
     license = lib.licenses.apple-psl20;
     mainProgram = "ld";
-    maintainers = with lib.maintainers; [ reckenrode ];
+    maintainers = lib.teams.darwin.members;
     platforms = lib.platforms.darwin; # Porting to other platforms is incomplete. Support only Darwin for now.
   };
 })

pkgs/by-name/ma/materialgram/package.nix

@@ -1,19 +1,24 @@
 {
-  telegram-desktop,
   lib,
+  telegram-desktop,
   fetchFromGitHub,
+  withWebkit ? true,
 }:
-telegram-desktop.overrideAttrs (
-  finalAttrs: previousAttrs: {
+
+telegram-desktop.override {
   pname = "materialgram";
-    version = "5.6.1.1";
+  inherit withWebkit;
+  unwrapped = telegram-desktop.unwrapped.overrideAttrs (
+    finalAttrs: previousAttrs: {
+      pname = "materialgram-unwrapped";
+      version = "5.7.0.1";
 
       src = fetchFromGitHub {
         owner = "kukuruzka165";
         repo = "materialgram";
         rev = "refs/tags/v${finalAttrs.version}";
+        hash = "sha256-YdLUwXMATla64KSYnXLXwLl0KktNoB/IuHIIY44R1VY=";
         fetchSubmodules = true;
-      hash = "sha256-e2ZLUooPMs0qB97BDyCiOUeD7cc+MuF5of65mEeJr04=";
       };
 
       meta = previousAttrs.meta // {
@@ -31,4 +36,5 @@ telegram-desktop.overrideAttrs (
         mainProgram = "materialgram";
       };
     }
-)
+  );
+}

pkgs/by-name/ot/oterm/package.nix

@@ -6,14 +6,14 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "oterm";
-  version = "0.4.2";
+  version = "0.6.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "ggozad";
     repo = "oterm";
     rev = "refs/tags/${version}";
-    hash = "sha256-0wiUqpjCHGHOuJJaDzpmMGtCBgUI5Sk29DrOgbLj018=";
+    hash = "sha256-kIuWDu7CpLLRyGPcCQYNaAiZ5F/WEatDmf2XbvLedsI=";
   };
 
   pythonRelaxDeps = [
@@ -26,8 +26,7 @@ python3Packages.buildPythonApplication rec {
     "typer"
   ];
 
-  build-system = with python3Packages; [ poetry-core ];
-
+  build-system = with python3Packages; [ hatchling ];
 
   dependencies = with python3Packages; [
     aiohttp

pkgs/by-name/re/redmine/Gemfile

@@ -2,7 +2,7 @@ source 'https://rubygems.org'
 
 ruby '>= 2.7.0', '< 3.3.0'
 
-gem 'rails', '6.1.7.8'
+gem 'rails', '6.1.7.10'
 gem 'rouge', '~> 4.2.0'
 gem 'request_store', '~> 1.5.0'
 gem 'mini_mime', '~> 1.1.0'

pkgs/by-name/re/redmine/Gemfile.lock

@@ -1,28 +1,28 @@
 GEM
   remote: https://rubygems.org/
   specs:
-    actioncable (6.1.7.8)
-      actionpack (= 6.1.7.8)
-      activesupport (= 6.1.7.8)
+    actioncable (6.1.7.10)
+      actionpack (= 6.1.7.10)
+      activesupport (= 6.1.7.10)
       nio4r (~> 2.0)
       websocket-driver (>= 0.6.1)
-    actionmailbox (6.1.7.8)
-      actionpack (= 6.1.7.8)
-      activejob (= 6.1.7.8)
-      activerecord (= 6.1.7.8)
-      activestorage (= 6.1.7.8)
-      activesupport (= 6.1.7.8)
+    actionmailbox (6.1.7.10)
+      actionpack (= 6.1.7.10)
+      activejob (= 6.1.7.10)
+      activerecord (= 6.1.7.10)
+      activestorage (= 6.1.7.10)
+      activesupport (= 6.1.7.10)
       mail (>= 2.7.1)
-    actionmailer (6.1.7.8)
-      actionpack (= 6.1.7.8)
-      actionview (= 6.1.7.8)
-      activejob (= 6.1.7.8)
-      activesupport (= 6.1.7.8)
+    actionmailer (6.1.7.10)
+      actionpack (= 6.1.7.10)
+      actionview (= 6.1.7.10)
+      activejob (= 6.1.7.10)
+      activesupport (= 6.1.7.10)
       mail (~> 2.5, >= 2.5.4)
       rails-dom-testing (~> 2.0)
-    actionpack (6.1.7.8)
-      actionview (= 6.1.7.8)
-      activesupport (= 6.1.7.8)
+    actionpack (6.1.7.10)
+      actionview (= 6.1.7.10)
+      activesupport (= 6.1.7.10)
       rack (~> 2.0, >= 2.0.9)
       rack-test (>= 0.6.3)
       rails-dom-testing (~> 2.0)
@@ -30,34 +30,34 @@ GEM
     actionpack-xml_parser (2.0.1)
       actionpack (>= 5.0)
       railties (>= 5.0)
-    actiontext (6.1.7.8)
-      actionpack (= 6.1.7.8)
-      activerecord (= 6.1.7.8)
-      activestorage (= 6.1.7.8)
-      activesupport (= 6.1.7.8)
+    actiontext (6.1.7.10)
+      actionpack (= 6.1.7.10)
+      activerecord (= 6.1.7.10)
+      activestorage (= 6.1.7.10)
+      activesupport (= 6.1.7.10)
       nokogiri (>= 1.8.5)
-    actionview (6.1.7.8)
-      activesupport (= 6.1.7.8)
+    actionview (6.1.7.10)
+      activesupport (= 6.1.7.10)
       builder (~> 3.1)
       erubi (~> 1.4)
       rails-dom-testing (~> 2.0)
       rails-html-sanitizer (~> 1.1, >= 1.2.0)
-    activejob (6.1.7.8)
-      activesupport (= 6.1.7.8)
+    activejob (6.1.7.10)
+      activesupport (= 6.1.7.10)
       globalid (>= 0.3.6)
-    activemodel (6.1.7.8)
-      activesupport (= 6.1.7.8)
-    activerecord (6.1.7.8)
-      activemodel (= 6.1.7.8)
-      activesupport (= 6.1.7.8)
-    activestorage (6.1.7.8)
-      actionpack (= 6.1.7.8)
-      activejob (= 6.1.7.8)
-      activerecord (= 6.1.7.8)
-      activesupport (= 6.1.7.8)
+    activemodel (6.1.7.10)
+      activesupport (= 6.1.7.10)
+    activerecord (6.1.7.10)
+      activemodel (= 6.1.7.10)
+      activesupport (= 6.1.7.10)
+    activestorage (6.1.7.10)
+      actionpack (= 6.1.7.10)
+      activejob (= 6.1.7.10)
+      activerecord (= 6.1.7.10)
+      activesupport (= 6.1.7.10)
       marcel (~> 1.0)
       mini_mime (>= 1.1.0)
-    activesupport (6.1.7.8)
+    activesupport (6.1.7.10)
       concurrent-ruby (~> 1.0, >= 1.0.2)
       i18n (>= 1.6, < 2)
       minitest (>= 5.1)
@@ -84,7 +84,7 @@ GEM
     css_parser (1.19.1)
       addressable
     csv (3.2.9)
-    date (3.3.4)
+    date (3.4.0)
     deckar01-task_list (2.3.2)
       html-pipeline
     docile (1.4.1)
@@ -98,7 +98,7 @@ GEM
     htmlentities (4.3.4)
     i18n (1.14.6)
       concurrent-ruby (~> 1.0)
-    json (2.7.4)
+    json (2.7.5)
     language_server-protocol (3.17.0.3)
     listen (3.9.0)
       rb-fsevent (~> 0.10, >= 0.10.3)
@@ -137,7 +137,7 @@ GEM
       mini_portile2 (~> 2.8.2)
       racc (~> 1.4)
     parallel (1.26.3)
-    parser (3.3.5.0)
+    parser (3.3.5.1)
       ast (~> 2.4.1)
       racc
     pg (1.5.9)
@@ -148,20 +148,20 @@ GEM
     rack (2.2.10)
     rack-test (2.1.0)
       rack (>= 1.3)
-    rails (6.1.7.8)
-      actioncable (= 6.1.7.8)
-      actionmailbox (= 6.1.7.8)
-      actionmailer (= 6.1.7.8)
-      actionpack (= 6.1.7.8)
-      actiontext (= 6.1.7.8)
-      actionview (= 6.1.7.8)
-      activejob (= 6.1.7.8)
-      activemodel (= 6.1.7.8)
-      activerecord (= 6.1.7.8)
-      activestorage (= 6.1.7.8)
-      activesupport (= 6.1.7.8)
+    rails (6.1.7.10)
+      actioncable (= 6.1.7.10)
+      actionmailbox (= 6.1.7.10)
+      actionmailer (= 6.1.7.10)
+      actionpack (= 6.1.7.10)
+      actiontext (= 6.1.7.10)
+      actionview (= 6.1.7.10)
+      activejob (= 6.1.7.10)
+      activemodel (= 6.1.7.10)
+      activerecord (= 6.1.7.10)
+      activestorage (= 6.1.7.10)
+      activesupport (= 6.1.7.10)
       bundler (>= 1.15.0)
-      railties (= 6.1.7.8)
+      railties (= 6.1.7.10)
       sprockets-rails (>= 2.0.0)
     rails-dom-testing (2.2.0)
       activesupport (>= 5.0.0)
@@ -170,9 +170,9 @@ GEM
     rails-html-sanitizer (1.6.0)
       loofah (~> 2.21)
       nokogiri (~> 1.14)
-    railties (6.1.7.8)
-      actionpack (= 6.1.7.8)
-      activesupport (= 6.1.7.8)
+    railties (6.1.7.10)
+      actionpack (= 6.1.7.10)
+      activesupport (= 6.1.7.10)
       method_source
       rake (>= 12.2)
       thor (~> 1.0)
@@ -213,7 +213,7 @@ GEM
       rubocop-ast (>= 1.28.1, < 2.0)
       ruby-progressbar (~> 1.7)
       unicode-display_width (>= 2.4.0, < 3.0)
-    rubocop-ast (1.32.3)
+    rubocop-ast (1.33.1)
       parser (>= 3.3.1.0)
     rubocop-performance (1.19.1)
       rubocop (>= 1.7.0, < 2.0)
@@ -229,7 +229,7 @@ GEM
     sanitize (6.1.3)
       crass (~> 1.0.2)
       nokogiri (>= 1.12.0)
-    selenium-webdriver (4.25.0)
+    selenium-webdriver (4.26.0)
       base64 (~> 0.2)
       logger (~> 1.4)
       rexml (~> 3.2, >= 3.2.5)
@@ -255,7 +255,7 @@ GEM
     tzinfo (2.0.6)
       concurrent-ruby (~> 1.0)
     unicode-display_width (2.6.0)
-    webrick (1.8.2)
+    webrick (1.9.0)
     websocket (1.2.11)
     websocket-driver (0.7.6)
       websocket-extensions (>= 0.1.0)
@@ -295,7 +295,7 @@ DEPENDENCIES
   nokogiri (~> 1.15.2)
   pg (~> 1.5.3)
   puma
-  rails (= 6.1.7.8)
+  rails (= 6.1.7.10)
   rails-dom-testing
   rbpdf (~> 1.21.3)
   redcarpet (~> 3.6.0)

pkgs/by-name/re/redmine/gemset.nix

@@ -5,10 +5,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1gxw5sxfj6i9q68yv0aq8jn0rzfypqbsidvj8pin8i7kpd636f9d";
+      sha256 = "0a2rn3ygh50d7p29zvd0yfcd0q7kf4c2n2kf1kjgxf3qlyi5036h";
       type = "gem";
     };
-    version = "6.1.7.8";
+    version = "6.1.7.10";
   };
   actionmailbox = {
     dependencies = ["actionpack" "activejob" "activerecord" "activestorage" "activesupport" "mail"];
@@ -16,10 +16,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "02ffqgzvlx4gjmxs474q5xfvl4c5ykdgj0y9whkrm0si6xpzajn0";
+      sha256 = "19f6kc470ahwmnrpc302wdkw8c6yw15q442g6cq4wccmkdarflz9";
       type = "gem";
     };
-    version = "6.1.7.8";
+    version = "6.1.7.10";
   };
   actionmailer = {
     dependencies = ["actionpack" "actionview" "activejob" "activesupport" "mail" "rails-dom-testing"];
@@ -27,10 +27,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0icpi06ibsi9xmcy2p0c33wh8p7rl2j26r6rmbhknp9jw3rlga9s";
+      sha256 = "1nyzqnl6wz7qxynbwwra7vlajm6hi5swfk52zrp6x1c62zj4blrd";
       type = "gem";
     };
-    version = "6.1.7.8";
+    version = "6.1.7.10";
   };
   actionpack = {
     dependencies = ["actionview" "activesupport" "rack" "rack-test" "rails-dom-testing" "rails-html-sanitizer"];
@@ -38,10 +38,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1plks83m7pbvxg8dp7aw8706kv5rxsxgpmcxdzwz57gsqkirvc7w";
+      sha256 = "0vnmynck11qwzzza8knx63a8djsrz0f2cibdnk463nr19ghjdmbx";
       type = "gem";
     };
-    version = "6.1.7.8";
+    version = "6.1.7.10";
   };
   actionpack-xml_parser = {
     dependencies = ["actionpack" "railties"];
@@ -60,10 +60,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1ki290ng0xkbjhr5sgrd98p4ysvbjdgxv4aqrafabcs0axgfibkx";
+      sha256 = "1r2bdsbm6zl85fy9kaqspq34cfh4da69hxag5ahbncq5cicdvpn0";
       type = "gem";
     };
-    version = "6.1.7.8";
+    version = "6.1.7.10";
   };
   actionview = {
     dependencies = ["activesupport" "builder" "erubi" "rails-dom-testing" "rails-html-sanitizer"];
@@ -71,10 +71,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "16diw7arrvrxlk04c6h46qzyyikl1jf18z5sgixvcqzz8sfqp7g0";
+      sha256 = "1hmw0ymn4f0x4yxb1wrbycjan0z72x1wgq9g9ljfmv3fd66a7dr3";
       type = "gem";
     };
-    version = "6.1.7.8";
+    version = "6.1.7.10";
   };
   activejob = {
     dependencies = ["activesupport" "globalid"];
@@ -82,10 +82,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "06r93sgvbyqlv6sjy97qqlpa671lni4cvb5gd208m6215xk7ds71";
+      sha256 = "1k0nmq5djwmhk61px5749x9i9m5cginz6z4kzz6ncifhmrc0q47i";
       type = "gem";
     };
-    version = "6.1.7.8";
+    version = "6.1.7.10";
   };
   activemodel = {
     dependencies = ["activesupport"];
@@ -93,10 +93,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "13562p4p9wra5k07jxi9g1v0l0plkkavr0z5jr1iznf7yizms8nq";
+      sha256 = "132bbnhkax3fqxx26yswrr60fgizn506bkf7gr1m1x4p0lfrnban";
       type = "gem";
     };
-    version = "6.1.7.8";
+    version = "6.1.7.10";
   };
   activerecord = {
     dependencies = ["activemodel" "activesupport"];
@@ -104,10 +104,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0x0nym941dhgh5q5p293y2jk2b4baxmcgs6xkc5vrsqf164jmq9p";
+      sha256 = "06mkkxbcqsyahmqc775niyc8bfbxvashy7davjx3fm1s8kpij5yv";
       type = "gem";
     };
-    version = "6.1.7.8";
+    version = "6.1.7.10";
   };
   activestorage = {
     dependencies = ["actionpack" "activejob" "activerecord" "activesupport" "marcel" "mini_mime"];
@@ -115,10 +115,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0i6vr1vng0pdb1dy8g1yvsfi90ji4bw02d06i6jyfvy9jb66amh7";
+      sha256 = "1p6l6nk7krnvn7gz15v40w3m71d9avf5sw1n38xl2r95s3zy4fjv";
       type = "gem";
     };
-    version = "6.1.7.8";
+    version = "6.1.7.10";
   };
   activesupport = {
     dependencies = ["concurrent-ruby" "i18n" "minitest" "tzinfo" "zeitwerk"];
@@ -126,10 +126,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "09krayvf764y868qm0sy0ssmcjx5a7iksnbi7zx284jjggc574ry";
+      sha256 = "0w6l6fzi4nin364hfr5qbjrr70mgf3phk9cvjmjzgyvvg9w1z3iz";
       type = "gem";
     };
-    version = "6.1.7.8";
+    version = "6.1.7.10";
   };
   addressable = {
     dependencies = ["public_suffix"];
@@ -249,10 +249,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "149jknsq999gnhy865n33fkk22s0r447k76x9pmcnnwldfv2q7wp";
+      sha256 = "04d7l3xdmkybrd20gayf8s38pgfld0hf8m726lz9np32xnnsszrf";
       type = "gem";
     };
-    version = "3.3.4";
+    version = "3.4.0";
   };
   deckar01-task_list = {
     dependencies = ["html-pipeline"];
@@ -353,10 +353,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1klf2mnfilzjqwcjdi5qb1zl3ghrifz1amcnvwjvsfnx9a5jb9ly";
+      sha256 = "0pkcvzvarzs5y87srla1m6rgng8mm7y4gnshlpawddsci3rlhd7b";
       type = "gem";
     };
-    version = "2.7.4";
+    version = "2.7.5";
   };
   language_server-protocol = {
     groups = ["default" "test"];
@@ -609,10 +609,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1cqs31cyg2zp8yx2zzm3zkih0j93q870wasbviy2w343nxqvn3pk";
+      sha256 = "0rbc2ggfw9cwscv1f9dl39a85vl5gysy7sprfagxlanxp01l8k5p";
       type = "gem";
     };
-    version = "3.3.5.0";
+    version = "3.3.5.1";
   };
   pg = {
     groups = ["default"];
@@ -690,10 +690,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "0cj4sr7fw01ycfkqmpz6zr90zyfxl8yw9s6m0df47a71m56hjb21";
+      sha256 = "1lc8j6b4nvsxa5m86nxw4ydv3h21xw1m5rk0n43i9zlixjrr55l0";
       type = "gem";
     };
-    version = "6.1.7.8";
+    version = "6.1.7.10";
   };
   rails-dom-testing = {
     dependencies = ["activesupport" "minitest" "nokogiri"];
@@ -723,10 +723,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "04k6y7balxm5d1sq53rb613lm1bwxmmzavmxg1h9z6dnds2djylb";
+      sha256 = "02szdqfif0s34k2lwfj9pm06m2h6dkhc5ni021s2q5val4c7lvny";
       type = "gem";
     };
-    version = "6.1.7.8";
+    version = "6.1.7.10";
   };
   rainbow = {
     groups = ["default" "test"];
@@ -911,10 +911,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "03zywfpm4540q6hw8srhi8pzp0gg51w65ir8jkaw58vk3j31w820";
+      sha256 = "0dvmlnmz173xwvcijgmkibga4viwz8xnm36j6lnxp6nik5pphm47";
       type = "gem";
     };
-    version = "1.32.3";
+    version = "1.33.1";
   };
   rubocop-performance = {
     dependencies = ["rubocop" "rubocop-ast"];
@@ -985,10 +985,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "1md0sixm8dq8a7riv50x4q1z273q47b5jvcbv5hxympxn3ran4by";
+      sha256 = "1406irn0zgxasqha9l64w7h2kjxivys7hagdlnk40n8fwpzjc15v";
       type = "gem";
     };
-    version = "4.25.0";
+    version = "4.26.0";
   };
   simplecov = {
     dependencies = ["docile" "simplecov-html" "simplecov_json_formatter"];
@@ -1108,10 +1108,10 @@
     platforms = [];
     source = {
       remotes = ["https://rubygems.org"];
-      sha256 = "089gy5494j560b242vi173wnbj2913hwlwnjkpzld58r96ilc5s3";
+      sha256 = "0r79mir4phdmcx0l4yqfwfzdy8vgvrl4ym07585rd2b401bhrrcy";
       type = "gem";
     };
-    version = "1.8.2";
+    version = "1.9.0";
   };
   websocket = {
     groups = ["default" "test"];

pkgs/by-name/re/redmine/package.nix

@@ -1,7 +1,7 @@
 { lib, stdenv, fetchurl, bundlerEnv, ruby_3_2, makeWrapper, nixosTests }:
 
 let
-  version = "5.1.3";
+  version = "5.1.4";
   rubyEnv = bundlerEnv {
     name = "redmine-env-${version}";
 
@@ -16,7 +16,7 @@ in
 
     src = fetchurl {
       url = "https://www.redmine.org/releases/redmine-${version}.tar.gz";
-      hash = "sha256-iiIyD9nJQOZZjzrV+3o5MxlchgaO7plLpvzcIsXOy1k=";
+      hash = "sha256-9XONahB/IxuPSwrlQQ4MRXQtdeDvMMSzGifArJ2v1Rw=";
     };
 
     nativeBuildInputs = [ makeWrapper ];

pkgs/by-name/xd/xdg-desktop-portal-cosmic/package.nix

@@ -12,16 +12,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "xdg-desktop-portal-cosmic";
-  version = "1.0.0-alpha.2";
+  version = "1.0.0-alpha.3";
 
   src = fetchFromGitHub {
     owner = "pop-os";
-    repo = pname;
+    repo = "xdg-desktop-portal-cosmic";
     rev = "epoch-${version}";
-    hash = "sha256-MbcktIXkiH3uxQLduXF76ZGn2aoTd/D6xKeUM4M/btM=";
+    hash = "sha256-IlMcgzhli61QWjdovj5BpOxOebV3RytBeHPhxzWNXqg=";
   };
 
-  env.VERGEN_GIT_COMMIT_DATE = "2024-09-24";
+  env.VERGEN_GIT_COMMIT_DATE = "2024-10-10";
   env.VERGEN_GIT_SHA = src.rev;
 
   cargoLock = {
@@ -30,11 +30,11 @@ rustPlatform.buildRustPackage rec {
       "accesskit-0.12.2" = "sha256-1UwgRyUe0PQrZrpS7574oNLi13fg5HpgILtZGW6JNtQ=";
       "atomicwrites-0.4.2" = "sha256-QZSuGPrJXh+svMeFWqAXoqZQxLq/WfIiamqvjJNVhxA=";
       "clipboard_macos-0.1.0" = "sha256-cG5vnkiyDlQnbEfV2sPbmBYKv1hd3pjJrymfZb8ziKk=";
-      "cosmic-bg-config-0.1.0" = "sha256-lAFAZBo5FnXgJV3MrZhaYmBxqtH1E7+Huj53ho/hPik=";
+      "cosmic-bg-config-0.1.0" = "sha256-bmcMZIURozlptsR4si62NTmexqaCX1Yj5bYj49GDehQ=";
       "cosmic-client-toolkit-0.1.0" = "sha256-1XtyEvednEMN4MApxTQid4eed19dEN5ZBDt/XRjuda0=";
-      "cosmic-config-0.1.0" = "sha256-gXrMEoAN+7nYAEcs4w6wROhQTjMCxkGn+muJutktLyk=";
-      "cosmic-files-0.1.0" = "sha256-rBR6IPpMgOltyaRPPZ5V8tYH/xtQphgrPWci/kvlgEg=";
-      "cosmic-settings-daemon-0.1.0" = "sha256-6cEgFfkBxEpIo8LsvKDR2khMdhEz/dp2oYJXXBiC9zg=";
+      "cosmic-config-0.1.0" = "sha256-XXT92zsdwkzx9dajSYlK6p/XPp6ajq9xJT504T1L4qU=";
+      "cosmic-files-0.1.0" = "sha256-eP6uLHxXpx+nNkEcROlqi0t3qRtU8vYITyt4JXtd7vw=";
+      "cosmic-settings-daemon-0.1.0" = "sha256-mklNPKVMO6iFrxki2DwiL5K78KiWpGxksisYldaASIE=";
       "cosmic-text-0.12.1" = "sha256-u2Tw+XhpIKeFg8Wgru/sjGw6GUZ2m50ZDmRBJ1IM66w=";
       "d3d12-0.19.0" = "sha256-usrxQXWLGJDjmIdw1LBXtBvX+CchZDvE8fHC0LjvhD4=";
       "fs_extra-1.3.0" = "sha256-ftg5oanoqhipPnbUsqnA4aZcyHqn9XsINJdrStIPLoE=";

pkgs/by-name/ya/yabai/package.nix

@@ -1,55 +1,33 @@
 {
   lib,
   stdenv,
-  overrideSDK,
   fetchFromGitHub,
   fetchzip,
-  installShellFiles,
-  testers,
-  writeShellScript,
+  apple-sdk_15,
   common-updater-scripts,
   curl,
-  darwin,
+  installShellFiles,
   jq,
-  xcodebuild,
+  versionCheckHook,
+  writeShellScript,
   xxd,
-  yabai,
 }:
-let
-  inherit (darwin.apple_sdk_11_0.frameworks)
-    Carbon
-    Cocoa
-    ScriptingBridge
-    SkyLight
-    ;
-
-  stdenv' = if stdenv.hostPlatform.isDarwin then overrideSDK stdenv "11.0" else stdenv;
-in
-stdenv'.mkDerivation (finalAttrs: {
+stdenv.mkDerivation (finalAttrs: {
   pname = "yabai";
-  version = "7.1.4";
+  version = "7.1.5";
 
   src =
     finalAttrs.passthru.sources.${stdenv.hostPlatform.system}
       or (throw "Unsupported system: ${stdenv.hostPlatform.system}");
 
-  env = {
-    # silence service.h error
-    NIX_CFLAGS_COMPILE = "-Wno-implicit-function-declaration";
-  };
-
   nativeBuildInputs =
     [ installShellFiles ]
     ++ lib.optionals stdenv.hostPlatform.isx86_64 [
-      xcodebuild
       xxd
     ];
 
   buildInputs = lib.optionals stdenv.hostPlatform.isx86_64 [
-    Carbon
-    Cocoa
-    ScriptingBridge
-    SkyLight
+    apple-sdk_15
   ];
 
   dontConfigure = true;
@@ -74,35 +52,27 @@ stdenv'.mkDerivation (finalAttrs: {
         # aarch64 code is compiled on all targets, which causes our Apple SDK headers to error out.
         # Since multilib doesn't work on darwin i dont know of a better way of handling this.
         substituteInPlace makefile \
-        --replace "-arch arm64e" "" \
-        --replace "-arch arm64" "" \
-        --replace "clang" "${stdenv.cc.targetPrefix}clang"
-
-        # `NSScreen::safeAreaInsets` is only available on macOS 12.0 and above, which frameworks aren't packaged.
-        # When a lower OS version is detected upstream just returns 0, so we can hardcode that at compile time.
-        # https://github.com/koekeishiya/yabai/blob/v4.0.2/src/workspace.m#L109
-        substituteInPlace src/workspace.m \
-        --replace 'return screen.safeAreaInsets.top;' 'return 0;'
+        --replace-fail "-arch arm64e" "" \
+        --replace-fail "-arch arm64" ""
       '';
 
-  passthru = {
-    tests.version = testers.testVersion {
-      package = yabai;
-      version = "yabai-v${finalAttrs.version}";
-    };
+  nativeInstallCheckInputs = [ versionCheckHook ];
+  versionCheckProgramArg = "--version";
+  doInstallCheck = true;
 
+  passthru = {
     sources = {
       # Unfortunately compiling yabai from source on aarch64-darwin is a bit complicated. We use the precompiled binary instead for now.
       # See the comments on https://github.com/NixOS/nixpkgs/pull/188322 for more information.
       "aarch64-darwin" = fetchzip {
         url = "https://github.com/koekeishiya/yabai/releases/download/v${finalAttrs.version}/yabai-v${finalAttrs.version}.tar.gz";
-        hash = "sha256-DAHZwEhPIBIfR2V+jTKje1msB8OMKzwGYgYnDql8zb0=";
+        hash = "sha256-o+9Z3Kxo1ff1TZPmmE6ptdOSsruQzxZm59bdYvhRo3c=";
       };
       "x86_64-darwin" = fetchFromGitHub {
         owner = "koekeishiya";
         repo = "yabai";
         rev = "v${finalAttrs.version}";
-        hash = "sha256-i/UqmBNTLBYY4ORI1Y7FWr+LZK0f/qMdWLPPuTb9+2w=";
+        hash = "sha256-6HBWJvjVWagtHrfjWaYSRcnQOuwTBVeVxo3wc+jSlyE=";
       };
     };
 

pkgs/desktops/gnome/extensions/gsconnect/default.nix

@@ -22,7 +22,7 @@
 
 stdenv.mkDerivation rec {
   pname = "gnome-shell-extension-gsconnect";
-  version = "57";
+  version = "58";
 
   outputs = [ "out" "installedTests" ];
 
@@ -30,7 +30,7 @@ stdenv.mkDerivation rec {
     owner = "GSConnect";
     repo = "gnome-shell-extension-gsconnect";
     rev = "v${version}";
-    hash = "sha256-0o5CEkdFPL7bZkHIA/zFWB8sY1OYROl4P3rl24+lze0=";
+    hash = "sha256-bpy4G+f3NJ2iVsycPluV+98at0G2wlp7t5cPEMGM90s=";
   };
 
   patches = [

pkgs/development/interpreters/ruby/default.nix

@@ -307,8 +307,8 @@ in {
   };
 
   ruby_3_2 = generic {
-    version = rubyVersion "3" "2" "4" "";
-    hash = "sha256-xys8XDBILcoYsPhoyQdfP0fYFo6vYm1OaCzltZyFhpI=";
+    version = rubyVersion "3" "2" "5" "";
+    hash = "sha256-7wYQtJj2D7XP13tRrbPBD0yo7ZoXy4fGHlvqMUrDShY=";
     cargoHash = "sha256-6du7RJo0DH+eYMOoh3L31F3aqfR5+iG1iKauSV1uNcQ=";
   };
 

pkgs/development/libraries/openvdb/default.nix

@@ -3,7 +3,7 @@
 stdenv.mkDerivation rec
 {
   pname = "openvdb";
-  version = "11.0.0";
+  version = "12.0.0";
 
   outputs = [ "out" "dev" ];
 
@@ -11,7 +11,7 @@ stdenv.mkDerivation rec
     owner = "AcademySoftwareFoundation";
     repo = "openvdb";
     rev = "v${version}";
-    sha256 = "sha256-wDDjX0nKZ4/DIbEX33PoxR43dJDj2NF3fm+Egug62GQ=";
+    sha256 = "sha256-S2uvzDCrTxAmvUMJr5PChcYTqhIHvRZbOfQLtUvzypI=";
   };
 
   nativeBuildInputs = [ cmake ];

pkgs/development/python-modules/django-haystack/default.nix

@@ -12,6 +12,7 @@
   requests,
   setuptools-scm,
   setuptools,
+  stdenv,
   whoosh,
 }:
 
@@ -41,6 +42,9 @@ buildPythonPackage rec {
     elasticsearch = [ elasticsearch ];
   };
 
+  # tests fail and get stuck on darwin
+  doCheck = !stdenv.hostPlatform.isDarwin;
+
   nativeCheckInputs = [
     geopy
     pysolr

pkgs/development/python-modules/easy-thumbnails/default.nix

@@ -2,42 +2,63 @@
   lib,
   buildPythonPackage,
   django,
-  fetchPypi,
+  fetchFromGitHub,
   pillow,
   pythonOlder,
   reportlab,
   svglib,
+  pytestCheckHook,
+  pytest-django,
+  setuptools,
+  testfixtures,
 }:
 
 buildPythonPackage rec {
   pname = "easy-thumbnails";
-  version = "2.10";
-  format = "setuptools";
+  version = "2.10.0";
+  pyproject = true;
 
-  disabled = pythonOlder "3.6";
+  disabled = pythonOlder "3.9";
 
-  src = fetchPypi {
-    inherit pname version;
-    hash = "sha256-0AlGL815Ht8kluXtRtBEcS4aBrfUYA5M8oEgAumQTvU=";
+  src = fetchFromGitHub {
+    owner = "SmileyChris";
+    repo = "easy-thumbnails";
+    rev = "refs/tags/${version}";
+    hash = "sha256-8JTHYQIBbu/4fknK2ZEQeDSgaxKGDfflxumcFMpaGQk=";
   };
 
-  propagatedBuildInputs = [
+  build-system = [ setuptools ];
+
+  dependencies = [
     django
     pillow
-    svglib
     reportlab
+    svglib
   ];
 
-  # Tests require a Django instance which is setup
-  doCheck = false;
+  nativeCheckInputs = [
+    pytestCheckHook
+    pytest-django
+  ];
+
+  checkInputs = [ testfixtures ];
+
+  disabledTests = [
+    # AssertionError: 'ERROR' != 'INFO'
+    "test_postprocessor"
+  ];
+
+  preCheck = ''
+    export DJANGO_SETTINGS_MODULE="easy_thumbnails.tests.settings"
+  '';
 
   pythonImportsCheck = [ "easy_thumbnails" ];
 
-  meta = with lib; {
+  meta = {
     description = "Easy thumbnails for Django";
     homepage = "https://github.com/SmileyChris/easy-thumbnails";
     changelog = "https://github.com/SmileyChris/easy-thumbnails/blob/${version}/CHANGES.rst";
-    license = licenses.bsd3;
-    maintainers = [ ];
+    license = lib.licenses.bsd3;
+    maintainers = [ lib.maintainers.onny ];
   };
 }

pkgs/development/python-modules/httpie/default.nix

@@ -24,14 +24,14 @@
 
 buildPythonPackage rec {
   pname = "httpie";
-  version = "3.2.3";
+  version = "3.2.4";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "httpie";
     repo = "httpie";
     rev = "refs/tags/${version}";
-    hash = "sha256-ogUqhMVY1fm+hKCMFYqfYsqHX+Gj6y8CMOUsxA3q29g=";
+    hash = "sha256-uZKkUUrPPnLHPHL8YrZgfsyCsSOR0oZ2eFytiV0PIUY=";
   };
 
   pythonRelaxDeps = [

pkgs/development/python-modules/mando/default.nix

@@ -10,7 +10,7 @@
 
 buildPythonPackage rec {
   pname = "mando";
-  version = "0.7.1";
+  version = "0.8.2";
 
   pyproject = true;
 
@@ -18,7 +18,7 @@ buildPythonPackage rec {
     owner = "rubik";
     repo = "mando";
     rev = "v${version}";
-    hash = "sha256-Ylrrfo57jqGuWEqCa5RyTT9AagBpUvAfviHkyJPFv08=";
+    hash = "sha256-FuQZ53ojrQO++0TN0C3hk0LXH+mcfRqtGq8VvfYDufg=";
   };
 
   nativeBuildInputs = [ setuptools ];

pkgs/development/python-modules/tencentcloud-sdk-python/default.nix

@@ -10,7 +10,7 @@
 
 buildPythonPackage rec {
   pname = "tencentcloud-sdk-python";
-  version = "3.0.1257";
+  version = "3.0.1259";
   pyproject = true;
 
   disabled = pythonOlder "3.9";
@@ -19,7 +19,7 @@ buildPythonPackage rec {
     owner = "TencentCloud";
     repo = "tencentcloud-sdk-python";
     rev = "refs/tags/${version}";
-    hash = "sha256-HjOU8gn1T6TXnAd0fM8dgc3tz8hUgyHzsQjgISYD1qE=";
+    hash = "sha256-4jjUgUnZrCMDiGbV2keZGIRhqI9BD7BZqfYNWMnZX4E=";
   };
 
   build-system = [ setuptools ];

pkgs/development/python-modules/typed-settings/default.nix

@@ -6,6 +6,7 @@
   click,
   click-option-group,
   fetchPypi,
+  hatch-vcs,
   hatchling,
   hypothesis,
   jinja2,
@@ -15,7 +16,6 @@
   tomli,
   typing-extensions,
 }:
-
 buildPythonPackage rec {
   pname = "typed-settings";
   version = "24.5.0";
@@ -53,6 +53,8 @@ buildPythonPackage rec {
     pydantic = [ pydantic ];
   };
 
+  nativeBuildInputs = [ hatch-vcs ];
+
   nativeCheckInputs = [
     hypothesis
     pytestCheckHook

pkgs/development/python-modules/uamqp/clang-fix-incompatible-function-pointer-conversion.patch

@@ -1,13 +0,0 @@
-diff --git a/src/message_receiver.pyx b/src/message_receiver.pyx
-index b99647c..479cc9c 100644
---- a/src/message_receiver.pyx
-+++ b/src/message_receiver.pyx
-@@ -120,7 +120,7 @@ cdef class cMessageReceiver(StructBase):
- 
- #### Callbacks (context is a MessageReceiver instance)
- 
--cdef void on_message_receiver_state_changed(void* context, c_message_receiver.MESSAGE_RECEIVER_STATE_TAG new_state, c_message_receiver.MESSAGE_RECEIVER_STATE_TAG previous_state):
-+cdef void on_message_receiver_state_changed(const void* context, c_message_receiver.MESSAGE_RECEIVER_STATE_TAG new_state, c_message_receiver.MESSAGE_RECEIVER_STATE_TAG previous_state):
-     if context != NULL:
-         context_pyobj = <PyObject*>context
-         if context_pyobj.ob_refcnt == 0: # context is being garbage collected, skip the callback

pkgs/development/python-modules/uamqp/darwin-azure-c-shared-utility-corefoundation.patch

@@ -1,37 +0,0 @@
-From 52ab2095649b5951e6af77f68954209473296983 Mon Sep 17 00:00:00 2001
-From: Sandro <sandro.jaeckel@gmail.com>
-Date: Sat, 16 Jan 2021 15:54:05 +0100
-Subject: [PATCH] Fix finding apple libraries
-
----
- CMakeLists.txt | 5 +++--
- 1 file changed, 3 insertions(+), 2 deletions(-)
- 
-
-(rejected by upstream in https://github.com/Azure/azure-c-shared-utility/pull/499,
-seems problem it's solving is nixpkgs-specific)
-
-diff --git a/src/vendor/azure-uamqp-c/deps/azure-c-shared-utility/CMakeLists.txt b/src/vendor/azure-uamqp-c/deps/azure-c-shared-utility/CMakeLists.txt
-index 7bbfa6f3f..3567b18bc 100644
---- a/src/vendor/azure-uamqp-c/deps/azure-c-shared-utility/CMakeLists.txt
-+++ b/src/vendor/azure-uamqp-c/deps/azure-c-shared-utility/CMakeLists.txt
-@@ -120,8 +120,9 @@ endif()
- 
- if(${use_applessl})
-     # MACOSX only has native tls and open ssl, so use the native apple tls
--    find_library(cf_foundation Foundation)
-+    find_library(cf_foundation CoreFoundation)
-     find_library(cf_network CFNetwork)
-+    find_library(cf_security Security)
- endif()
- 
- if(${no_logging})
-@@ -581,7 +582,7 @@ endif()
- 
- 
- if(${use_applessl})
--    set(aziotsharedutil_target_libs ${aziotsharedutil_target_libs} ${cf_foundation} ${cf_network})
-+    set(aziotsharedutil_target_libs ${aziotsharedutil_target_libs} ${cf_foundation} ${cf_network} ${cf_security})
- endif()
- 
- if(WIN32)

pkgs/development/python-modules/uamqp/default.nix

@@ -3,8 +3,9 @@
   stdenv,
   buildPythonPackage,
   fetchFromGitHub,
-  fetchpatch,
-  cython_0,
+  fetchpatch2,
+  setuptools,
+  cython,
   certifi,
   CFNetwork,
   cmake,
@@ -17,40 +18,22 @@
 
 buildPythonPackage rec {
   pname = "uamqp";
-  version = "1.6.9";
-  format = "setuptools";
+  version = "1.6.11";
+  pyproject = true;
 
   src = fetchFromGitHub {
     owner = "Azure";
     repo = "azure-uamqp-python";
     rev = "refs/tags/v${version}";
-    hash = "sha256-sDRIM41zey1F6/x1ZioJJBAQCVyf1NKzhS82Ew08pgM=";
+    hash = "sha256-HTIOHheCrvyI7DwA/UcUXk/fbesd29lvUvJ9TAeG3CE=";
   };
 
-  patches =
-    lib.optionals (stdenv.hostPlatform.isDarwin && stdenv.hostPlatform.isx86_64) [
-      ./darwin-azure-c-shared-utility-corefoundation.patch
-    ]
-    ++ [
-      (fetchpatch {
-        name = "CVE-2024-25110.patch";
-        url = "https://github.com/Azure/azure-uamqp-c/commit/30865c9ccedaa32ddb036e87a8ebb52c3f18f695.patch";
-        stripLen = 1;
-        extraPrefix = "src/vendor/azure-uamqp-c/";
-        hash = "sha256-igzZqTLUUyuNcpCUbYHI4RXmWxg+7EC/yyD4DBurR2M=";
+  patches = [
+    (fetchpatch2 {
+      name = "fix-clang16-compatibility.patch";
+      url = "https://github.com/Azure/azure-uamqp-python/commit/bd6d9ef5a8bca3873e1e66218fd09ca787b8064e.patch";
+      hash = "sha256-xtnIVjB71EPJp/QjLQWctcSDds5s6n4ut+gnvp3VMlM=";
     })
-      (fetchpatch {
-        name = "CVE-2024-27099.patch";
-        url = "https://github.com/Azure/azure-uamqp-c/commit/2ca42b6e4e098af2d17e487814a91d05f6ae4987.patch";
-        stripLen = 1;
-        extraPrefix = "src/vendor/azure-uamqp-c/";
-        # other files are just tests which aren't run from the python
-        # builder anyway
-        includes = [ "src/vendor/azure-uamqp-c/src/link.c" ];
-        hash = "sha256-EqDfG1xAz5CG8MssSSrz8Yrje5qwF8ri1Kdw+UUu5ms=";
-      })
-      # Fix incompatible function pointer conversion error with clang 16.
-      ./clang-fix-incompatible-function-pointer-conversion.patch
   ];
 
   postPatch = lib.optionalString (stdenv.hostPlatform.isDarwin && !stdenv.hostPlatform.isx86_64) ''
@@ -69,9 +52,13 @@ buildPythonPackage rec {
       src/vendor/azure-uamqp-c/deps/azure-c-shared-utility/CMakeLists.txt
   '';
 
+  build-system = [
+    cython
+    setuptools
+  ];
+
   nativeBuildInputs = [
     cmake
-    cython_0
   ];
 
   buildInputs =
@@ -82,7 +69,7 @@ buildPythonPackage rec {
       Security
     ];
 
-  propagatedBuildInputs = [ certifi ];
+  dependencies = [ certifi ];
 
   dontUseCmakeConfigure = true;
 

pkgs/development/python-modules/xmlschema/default.nix

@@ -12,7 +12,7 @@
 
 buildPythonPackage rec {
   pname = "xmlschema";
-  version = "3.4.2";
+  version = "3.4.3";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
@@ -21,7 +21,7 @@ buildPythonPackage rec {
     owner = "sissaschool";
     repo = "xmlschema";
     rev = "refs/tags/v${version}";
-    hash = "sha256-0x8nk8F+kg5SSDQI4dOnv67ilyN4z2MZ5phPC3PW4WQ=";
+    hash = "sha256-7RA9lQwuty8aZghwTKNbU+oL+BATH2FVIRQBe9fIpHI=";
   };
 
   build-system = [ setuptools ];

pkgs/development/tools/analysis/checkstyle/default.nix

@@ -1,12 +1,12 @@
 { lib, stdenvNoCC, fetchurl, makeBinaryWrapper, jre }:
 
 stdenvNoCC.mkDerivation rec {
-  version = "10.18.2";
+  version = "10.20.0";
   pname = "checkstyle";
 
   src = fetchurl {
     url = "https://github.com/checkstyle/checkstyle/releases/download/checkstyle-${version}/checkstyle-${version}-all.jar";
-    sha256 = "sha256-VRbCJ+XYJLBrD90tMkJmevOu07t7K8LvcZ96NSjflb4=";
+    sha256 = "sha256-WvC5UyLxW1WHlVRs0Ll2kGwXM/9Z98qdYtjKaG2w5is=";
   };
 
   nativeBuildInputs = [ makeBinaryWrapper ];

pkgs/development/tools/build-managers/conan/default.nix

@@ -10,14 +10,14 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "conan";
-  version = "2.5.0";
+  version = "2.9.1";
   format = "setuptools";
 
   src = fetchFromGitHub {
     owner = "conan-io";
     repo = "conan";
     rev = "refs/tags/${version}";
-    hash = "sha256-4GCLmPEoCX1Cw+H6Bo1KA4+9GX35HgONAmMF/WNX6ag=";
+    hash = "sha256-1KKXOvoSAemzafWvBoYFtxqgSObHcXe3GVPgG25VNm0=";
   };
 
   nativeBuildInputs = with python3.pkgs; [
@@ -88,9 +88,8 @@ python3.pkgs.buildPythonApplication rec {
 
   disabledTestPaths = [
     # Requires cmake, meson, autotools, apt-get, etc.
-    "test/functional/command/new_test.py"
+    "test/functional/command/runner_test.py"
     "test/functional/command/test_install_deploy.py"
-    "test/functional/graph/test_transitive_build_scripts.py"
     "test/functional/layout/test_editable_cmake.py"
     "test/functional/layout/test_editable_cmake_components.py"
     "test/functional/layout/test_in_subfolder.py"
@@ -102,7 +101,6 @@ python3.pkgs.buildPythonApplication rec {
     "test/functional/tools/system/package_manager_test.py"
     "test/functional/tools_versions_test.py"
     "test/functional/util/test_cmd_args_to_string.py"
-    "test/integration/command/runner_test.py"
     "test/integration/command/user_test.py"
     "test/integration/command_v2/list_test.py"
     "test/performance/test_large_graph.py"

pkgs/development/tools/build-managers/gn/default.nix

@@ -1,4 +1,4 @@
-{ callPackage, ... } @ args:
+{ callPackage, ... }@args:
 
 callPackage ./generic.nix args {
   # Note: Please use the recommended version for Chromium stabe, i.e. from

pkgs/development/tools/build-managers/gn/generic.nix

@@ -1,9 +1,22 @@
-{ stdenv, lib, fetchgit, fetchpatch, cctools, darwin, writeText
-, ninja, python3
-, ...
+{
+  stdenv,
+  lib,
+  fetchgit,
+  fetchpatch,
+  cctools,
+  darwin,
+  writeText,
+  ninja,
+  python3,
+  ...
 }:
 
-{ rev, revNum, version, sha256 }:
+{
+  rev,
+  revNum,
+  version,
+  sha256,
+}:
 
 let
   revShort = builtins.substring 0 7 rev;
@@ -17,7 +30,8 @@ let
     #endif  // OUT_LAST_COMMIT_POSITION_H_
   '';
 
-in stdenv.mkDerivation {
+in
+stdenv.mkDerivation {
   pname = "gn-unstable";
   inherit version;
 
@@ -36,8 +50,14 @@ in stdenv.mkDerivation {
     })
   ];
 
-  nativeBuildInputs = [ ninja python3 ];
-  buildInputs = lib.optionals stdenv.hostPlatform.isDarwin (with darwin; with apple_sdk.frameworks; [
+  nativeBuildInputs = [
+    ninja
+    python3
+  ];
+  buildInputs = lib.optionals stdenv.hostPlatform.isDarwin (
+    with darwin;
+    with apple_sdk.frameworks;
+    [
       libobjc
       cctools
 
@@ -45,7 +65,8 @@ in stdenv.mkDerivation {
       ApplicationServices
       Foundation
       AppKit
-  ]);
+    ]
+  );
 
   env.NIX_CFLAGS_COMPILE = "-Wno-error";
 
@@ -67,6 +88,10 @@ in stdenv.mkDerivation {
     homepage = "https://gn.googlesource.com/gn";
     license = licenses.bsd3;
     platforms = platforms.unix;
-    maintainers = with maintainers; [ stesie matthewbauer primeos ];
+    maintainers = with maintainers; [
+      stesie
+      matthewbauer
+      primeos
+    ];
   };
 }

pkgs/development/tools/build-managers/gn/rev1924.nix

@@ -1,8 +0,0 @@
-{ callPackage, ... } @ args:
-
-callPackage ./generic.nix args {
-  rev = "24e2f7df92641de0351a96096fb2c490b2436bb8";
-  revNum = "1924"; # git describe HEAD --match initial-commit | cut -d- -f3
-  version = "2021-08-08";
-  sha256 = "1lwkyhfhw0zd7daqz466n7x5cddf0danr799h4jg3s0yvd4galjl";
-}

pkgs/development/web/edge-runtime/librusty_v8.nix

@@ -1,22 +0,0 @@
-{ lib, stdenv, fetchurl }:
-
-let
-  fetch_librusty_v8 = args: fetchurl {
-    name = "librusty_v8-${args.version}";
-    url = "https://github.com/denoland/rusty_v8/releases/download/v${args.version}/librusty_v8_release_${stdenv.hostPlatform.rust.rustcTarget}.a";
-    sha256 = args.shas.${stdenv.hostPlatform.system};
-    meta = {
-      inherit (args) version;
-      sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
-    };
-  };
-in
-fetch_librusty_v8 {
-  version = "0.83.2";
-  shas = {
-    x86_64-linux = "sha256-RJNdy5jRZK3dTgrHsWuZZAHUyy1EogyNNuBekZ3Arrk=";
-    aarch64-linux = "sha256-mpOmuqtd7ob6xvrgH4P/6GLa/hXTS/ok0WOYo7+7ZhI=";
-    x86_64-darwin = "sha256-2o8CvJ3r5+4PLNGTySqPPDTqbU0piX4D1UtZMscMdHU=";
-    aarch64-darwin = "sha256-WHeITWSHjZxfQJndxcjsp4yIERKrKXSHFZ0UBc43p8o=";
-  };
-}

pkgs/kde/misc/oxygen-icons/default.nix

@@ -5,11 +5,11 @@
 }:
 mkKdeDerivation rec {
   pname = "oxygen-icons";
-  version = "6.0.0";
+  version = "6.1.0";
 
   src = fetchurl {
     url = "mirror://kde/stable/oxygen-icons/oxygen-icons-${version}.tar.xz";
-    hash = "sha256-KOwYKHXcwV2SePRc7RECaqOSR28fRUhxueLINwCOV3Q=";
+    hash = "sha256-FsqXEHnFBnxFB8q/G2GdyH3Wsyb9XC3Z9dQ4EPIXTWg=";
   };
 
   dontStrip = true;

pkgs/kde/misc/pulseaudio-qt/default.nix

@@ -7,11 +7,11 @@
 }:
 mkKdeDerivation rec {
   pname = "pulseaudio-qt";
-  version = "1.6.0";
+  version = "1.6.1";
 
   src = fetchurl {
     url = "mirror://kde/stable/pulseaudio-qt/pulseaudio-qt-${version}.tar.xz";
-    hash = "sha256-G+y62ss2qdakMaDJPNtCj49n83zy0jdoZ1mDMYwK3oQ=";
+    hash = "sha256-8hvzDy/z5nDSBG+WYGncI/XmU/9Wus24kgwTdCZMvB4=";
   };
 
   extraNativeBuildInputs = [ pkg-config ];

pkgs/misc/logging/pacemaker/default.nix

@@ -29,13 +29,13 @@
 
 stdenv.mkDerivation rec {
   pname = "pacemaker";
-  version = "2.1.8";
+  version = "2.1.9";
 
   src = fetchFromGitHub {
     owner = "ClusterLabs";
     repo = pname;
     rev = "Pacemaker-${version}";
-    sha256 = "sha256-J57+NSs4cL3BlEjSaXAoUTEhbMMxhWy8sUZ/K3x2nRM=";
+    sha256 = "sha256-L/LQS5XLps0pqTfMAh1ZiR00SVltrNxMl6DXQhXBw1Q=";
   };
 
   nativeBuildInputs = [

pkgs/os-specific/bsd/freebsd/patches/14.1/bsd-lib-mk-force-static.patch

@@ -0,0 +1,81 @@
+From 197b10de54b53a089ad549f2e00787b4fa719210 Mon Sep 17 00:00:00 2001
+From: Artemis Tosini <me@artem.ist>
+Date: Sat, 2 Nov 2024 07:50:13 +0000
+Subject: [PATCH] HACK: bsd.lib.mk: Treat empty SHLIB_NAME as nonexistant
+
+Unsetting SHLIB_NAME in nix package definitions is a pain
+but we can easily set it to be empty. This is useful when
+building static libraries without unneeded static libraries.
+---
+ share/mk/bsd.lib.mk | 14 +++++++-------
+ 1 file changed, 7 insertions(+), 7 deletions(-)
+
+diff --git a/share/mk/bsd.lib.mk b/share/mk/bsd.lib.mk
+index 5f328d5378ca..89d16dc6fa41 100644
+--- a/share/mk/bsd.lib.mk
++++ b/share/mk/bsd.lib.mk
+@@ -242,7 +242,7 @@ PO_FLAG=-pg
+ _LIBDIR:=${LIBDIR}
+ _SHLIBDIR:=${SHLIBDIR}
+ 
+-.if defined(SHLIB_NAME)
++.if defined(SHLIB_NAME) && !empty(SHLIB_NAME)
+ .if ${MK_DEBUG_FILES} != "no"
+ SHLIB_NAME_FULL=${SHLIB_NAME}.full
+ # Use ${DEBUGDIR} for base system debug files, else .debug subdirectory
+@@ -277,7 +277,7 @@ LDFLAGS+=	-Wl,--undefined-version
+ .endif
+ .endif
+ 
+-.if defined(LIB) && !empty(LIB) || defined(SHLIB_NAME)
++.if defined(LIB) && !empty(LIB) || (defined(SHLIB_NAME) && !empty(SHLIB_NAME))
+ OBJS+=		${SRCS:N*.h:${OBJS_SRCS_FILTER:ts:}:S/$/.o/}
+ BCOBJS+=	${SRCS:N*.[hsS]:N*.asm:${OBJS_SRCS_FILTER:ts:}:S/$/.bco/g}
+ LLOBJS+=	${SRCS:N*.[hsS]:N*.asm:${OBJS_SRCS_FILTER:ts:}:S/$/.llo/g}
+@@ -320,14 +320,14 @@ lib${LIB_PRIVATE}${LIB}.ll: ${LLOBJS}
+ CLEANFILES+=	lib${LIB_PRIVATE}${LIB}.bc lib${LIB_PRIVATE}${LIB}.ll
+ .endif
+ 
+-.if defined(SHLIB_NAME) || \
++.if (defined(SHLIB_NAME) && !empty(SHLIB_NAME)) || \
+     defined(INSTALL_PIC_ARCHIVE) && defined(LIB) && !empty(LIB)
+ SOBJS+=		${OBJS:.o=.pico}
+ DEPENDOBJS+=	${SOBJS}
+ CLEANFILES+=	${SOBJS}
+ .endif
+ 
+-.if defined(SHLIB_NAME)
++.if defined(SHLIB_NAME) && !empty(SHLIB_NAME)
+ _LIBS+=		${SHLIB_NAME}
+ 
+ SOLINKOPTS+=	-shared -Wl,-x
+@@ -435,7 +435,7 @@ all: all-man
+ CLEANFILES+=	${_LIBS}
+ 
+ _EXTRADEPEND:
+-.if !defined(NO_EXTRADEPEND) && defined(SHLIB_NAME)
++.if !defined(NO_EXTRADEPEND) && defined(SHLIB_NAME) && !empty(SHLIB_NAME)
+ .if defined(DPADD) && !empty(DPADD)
+ 	echo ${SHLIB_NAME_FULL}: ${DPADD} >> ${DEPENDFILE}
+ .endif
+@@ -501,7 +501,7 @@ _libinstall:
+ 	    ${_INSTALLFLAGS} lib${LIB_PRIVATE}${LIB}_p.a ${DESTDIR}${_LIBDIR}/
+ .endif
+ .endif
+-.if defined(SHLIB_NAME)
++.if defined(SHLIB_NAME) && !empty(SHLIB_NAME)
+ 	${INSTALL} ${TAG_ARGS} ${STRIP} -o ${LIBOWN} -g ${LIBGRP} -m ${LIBMODE} \
+ 	    ${_INSTALLFLAGS} ${_SHLINSTALLFLAGS} \
+ 	    ${SHLIB_NAME} ${DESTDIR}${_SHLIBDIR}/
+@@ -588,7 +588,7 @@ OBJS_DEPEND_GUESS+= ${SRCS:M*.h}
+ OBJS_DEPEND_GUESS.${_S:${OBJS_SRCS_FILTER:ts:}}.po+=	${_S}
+ .endfor
+ .endif
+-.if defined(SHLIB_NAME) || \
++.if (defined(SHLIB_NAME) && !empty(SHLIB_NAME)) || \
+     defined(INSTALL_PIC_ARCHIVE) && defined(LIB) && !empty(LIB)
+ .for _S in ${SRCS:N*.[hly]}
+ OBJS_DEPEND_GUESS.${_S:${OBJS_SRCS_FILTER:ts:}}.pico+=	${_S}
+-- 
+2.46.1
+

pkgs/os-specific/bsd/freebsd/pkgs/init.nix

@@ -1,7 +1,9 @@
-{ mkDerivation }:
+{ mkDerivation, stdenv }:
 mkDerivation {
   path = "sbin/init";
   extraPaths = [ "sbin/mount" ];
   NO_FSCHG = "yes";
   MK_TESTS = "no";
+
+  meta.broken = !stdenv.hostPlatform.isStatic;
 }

pkgs/os-specific/bsd/freebsd/pkgs/libc/package.nix

@@ -116,6 +116,13 @@ mkDerivation {
         --replace '/usr/share/i18n' '${builtins.placeholder "out"}/share/i18n'
   '';
 
+  # NIX_CFLAGS_LINK is empty at this point except when building static,
+  # in which case the stdenv adapter adds the `-static` flag.
+  # Building with `-static` set causes linker errors.
+  postConfigure = ''
+    export NIX_CFLAGS_LINK=
+  '';
+
   nativeBuildInputs = [
     bsdSetupHook
     freebsdSetupHook
@@ -194,7 +201,7 @@ mkDerivation {
       make -C $BSDSRCDIR/lib/libgcc_eh $makeFlags
       make -C $BSDSRCDIR/lib/libgcc_eh $makeFlags install
 
-      ln -s $BSDSRCDIR/lib/libc/libc.so.7 $BSDSRCDIR/lib/libc/libc.so  # not sure
+      ln -s $BSDSRCDIR/lib/libc/libc.so.7 $BSDSRCDIR/lib/libc/libc.so  # otherwise these dynamic libraries try to link with libc.a
       mkdir $BSDSRCDIR/lib/libgcc_s/i386 $BSDSRCDIR/lib/libgcc_s/cpu_model
       make -C $BSDSRCDIR/lib/libgcc_s $makeFlags
       make -C $BSDSRCDIR/lib/libgcc_s $makeFlags install
@@ -266,6 +273,13 @@ mkDerivation {
       make -C $BSDSRCDIR/libexec/rtld-elf $makeFlags install
       rm -f $out/libexec/ld-elf.so.1
       mv $out/bin/ld-elf.so.1 $out/libexec
+    ''
+    + lib.optionalString (!stdenv.hostPlatform.isStatic) ''
+      mkdir $out/lib/keep_static
+      mv $out/lib/*_nonshared.a $out/lib/libgcc*.a $out/lib/libcompiler_rt.a $out/lib/keep_static
+      rm $out/lib/*.a
+      mv $out/lib/keep_static/* $out/lib
+      rmdir $out/lib/keep_static
     '';
 
   # libc should not be allowed to refer to anything other than itself

pkgs/os-specific/bsd/freebsd/pkgs/libcxxrt.nix

@@ -1,4 +1,8 @@
-{ mkDerivation }:
+{
+  mkDerivation,
+  stdenv,
+  lib,
+}:
 # this package is quite different from stock libcxxrt.
 # as of FreeBSD 14.0, it is vendored from APPROXIMATELY libcxxrt
 # 5d8a15823a103bbc27f1bfdcf2b5aa008fab57dd, though the vendoring mechanism is
@@ -8,9 +12,12 @@ mkDerivation {
   pname = "libcxxrt";
   path = "lib/libcxxrt";
   extraPaths = [ "contrib/libcxxrt" ];
-  outputs = [
+  outputs =
+    [
       "out"
       "dev"
+    ]
+    ++ lib.optionals (!stdenv.hostPlatform.isStatic) [
       "debug"
     ];
   noLibcxx = true;

pkgs/os-specific/bsd/freebsd/pkgs/mkDerivation.nix

@@ -58,9 +58,12 @@ lib.makeOverridable (
 
       HOST_SH = stdenv'.shell;
 
-      makeFlags = [
+      makeFlags =
+        [
           "STRIP=-s" # flag to install, not command
-      ] ++ lib.optional (!stdenv'.hostPlatform.isFreeBSD) "MK_WERROR=no";
+        ]
+        ++ lib.optional (!stdenv'.hostPlatform.isFreeBSD) "MK_WERROR=no"
+        ++ lib.optional stdenv.hostPlatform.isStatic "SHLIB_NAME=";
 
       # amd64 not x86_64 for this on unlike NetBSD
       MACHINE_ARCH = freebsd-lib.mkBsdArch stdenv';

pkgs/servers/sql/postgresql/generic.nix

@@ -321,7 +321,7 @@ let
       description = "Powerful, open source object-relational database system";
       license     = licenses.postgresql;
       changelog   = "https://www.postgresql.org/docs/release/${finalAttrs.version}/";
-      maintainers = with maintainers; [ thoughtpolice danbst globin ivan ma27 wolfgangwalther ];
+      maintainers = with maintainers; [ globin ivan ] ++ teams.postgres.members;
       pkgConfigModules = [ "libecpg" "libecpg_compat" "libpgtypes" "libpq" ];
       platforms   = platforms.unix;
 

pkgs/servers/x11/xorg/overrides.nix

@@ -171,6 +171,9 @@ self: super:
   libAppleWM = super.libAppleWM.overrideAttrs (attrs: {
     nativeBuildInputs = attrs.nativeBuildInputs ++ [ autoreconfHook ];
     buildInputs =  attrs.buildInputs ++ [ xorg.utilmacros ];
+    meta = attrs.meta // {
+      platforms = lib.platforms.darwin;
+    };
   });
 
   libXau = super.libXau.overrideAttrs (attrs: {

pkgs/shells/bash/5.nix

@@ -79,8 +79,8 @@ stdenv.mkDerivation rec {
     "bash_cv_getcwd_malloc=yes"
     # This check cannot be performed when cross compiling. The "yes"
     # default is fine for static linking on Linux (weak symbols?) but
-    # not with OpenBSD, when it does clash with the regular `getenv`.
-    "bash_cv_getenv_redef=${if !(with stdenv.hostPlatform; isStatic && isOpenBSD) then "yes" else "no"}"
+    # not with BSDs, when it does clash with the regular `getenv`.
+    "bash_cv_getenv_redef=${if !(with stdenv.hostPlatform; isStatic && (isOpenBSD || isFreeBSD)) then "yes" else "no"}"
   ] ++ lib.optionals stdenv.hostPlatform.isCygwin [
     "--without-libintl-prefix"
     "--without-libiconv-prefix"

pkgs/tools/text/xurls/default.nix

@@ -1,19 +1,26 @@
-{ buildGoModule, lib, fetchFromGitHub }:
+{
+  buildGoModule,
+  lib,
+  fetchFromGitHub,
+}:
 
-buildGoModule rec {
+buildGoModule {
   pname = "xurls";
-  version = "2.5.0";
+  version = "2.5.0-unstable-2024-11-03";
 
   src = fetchFromGitHub {
     owner = "mvdan";
     repo = "xurls";
-    rev = "v${version}";
-    sha256 = "sha256-9hPXZ/t15+LG9fji1gyeWhUrYOr6eGyKYg3a1SmHJpQ=";
+    rev = "7c973a26c7bd6ecd8d86bb435d93ff98df2710fa";
+    sha256 = "sha256-jZmlM9rs+N0ks7msmb3eJ96aTYp0qUo/1bgLAgHnvSo=";
   };
 
-  vendorHash = "sha256-eVK7qU+NWsarBsEpg6aGow/urmhIpU3Z9RwoTvSymXo=";
+  vendorHash = "sha256-W6Z1E6a+qBdOuyHoiT6YA+CAJHBJ0FTYH8AntiKvVBY=";
 
-  ldflags = [ "-s" "-w" ];
+  ldflags = [
+    "-s"
+    "-w"
+  ];
 
   meta = with lib; {
     description = "Extract urls from text";

pkgs/tools/typesetting/hayagriva/default.nix

@@ -5,14 +5,14 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "hayagriva";
-  version = "0.6.0";
+  version = "0.8.0";
 
   src = fetchCrate {
     inherit pname version;
-    hash = "sha256-ic1ohp0zmiFgfNSfI6XRL/3CJ2p+afW4IAEz2l4CL8Q=";
+    hash = "sha256-B0q5jwJVDpxywTuSspsfDameDfEkok5oTz/Oty9LkOI=";
   };
 
-  cargoHash = "sha256-G3rBvFzlp3Dg/k6BILNH6xNX+i9mEv9muZOiGkcad38=";
+  cargoHash = "sha256-N+3W4x5p5qas47uwVT0NrJNe9udE+0rQLx/ypo1pbR4=";
 
   buildFeatures = [ "cli" ];
 

pkgs/top-level/aliases.nix

@@ -473,6 +473,7 @@ mapAliases {
   gnuradio3_9 = throw "gnuradio3_9 has been removed because it is not compatible with the latest volk and it had no dependent packages which justified it's distribution"; # Added 2024-07-28
   gnuradio3_9Minimal = throw "gnuradio3_9Minimal has been removed because it is not compatible with the latest volk and it had no dependent packages which justified it's distribution"; # Added 2024-07-28
   gnuradio3_9Packages = throw "gnuradio3_9Minimal has been removed because it is not compatible with the latest volk and it had no dependent packages which justified it's distribution"; # Added 2024-07-28
+  gn1924 = throw "gn1924 has been removed because it was broken and no longer used by envoy."; # Added 2024-11-03
   gobby5 = throw "'gobby5' has been renamed to/replaced by 'gobby'"; # Converted to throw 2024-10-17
   gradle_6 = throw "Gradle 6 has been removed, as it is end-of-life (https://endoflife.date/gradle) and has many vulnerabilities that are not resolved until Gradle 7."; # Added 2024-10-30
   gradle_6-unwrapped = throw "Gradle 6 has been removed, as it is end-of-life (https://endoflife.date/gradle) and has many vulnerabilities that are not resolved until Gradle 7."; # Added 2024-10-30

pkgs/top-level/all-packages.nix

@@ -597,8 +597,6 @@ with pkgs;
     inherit (darwin.apple_sdk.frameworks) CoreServices Security;
   };
 
-  edge-runtime = callPackage ../development/web/edge-runtime { };
-
   efficient-compression-tool = callPackage ../tools/compression/efficient-compression-tool { };
 
   eludris = callPackage ../tools/misc/eludris {
@@ -2791,9 +2789,7 @@ with pkgs;
 
   ### APPLICATIONS/TERMINAL-EMULATORS
 
-  alacritty = callPackage ../applications/terminal-emulators/alacritty {
-    inherit (darwin.apple_sdk_11_0.frameworks) AppKit CoreGraphics CoreServices CoreText Foundation OpenGL;
-  };
+  alacritty = callPackage ../applications/terminal-emulators/alacritty { };
 
   blackbox-terminal = callPackage ../applications/terminal-emulators/blackbox-terminal { };
 
@@ -5261,8 +5257,6 @@ with pkgs;
 
   jwx = callPackage ../tools/security/jwx { } ;
 
-  kapacitor = callPackage ../servers/monitoring/kapacitor { };
-
   karma = callPackage ../servers/monitoring/karma { };
 
   kaldi = callPackage ../tools/audio/kaldi {
@@ -17893,7 +17887,6 @@ with pkgs;
   nimbo = with python3Packages; callPackage ../applications/misc/nimbo { };
 
   gn = callPackage ../development/tools/build-managers/gn { };
-  gn1924 = callPackage ../development/tools/build-managers/gn/rev1924.nix { };
 
   nixbang = callPackage ../development/tools/misc/nixbang {
     pythonPackages = python3Packages;
@@ -30201,8 +30194,6 @@ with pkgs;
 
   kotatogram-desktop = callPackage ../applications/networking/instant-messengers/telegram/kotatogram-desktop { };
 
-  kotatogram-desktop-with-webkit = callPackage ../applications/networking/instant-messengers/telegram/kotatogram-desktop/with-webkit.nix { };
-
   kpt = callPackage ../applications/networking/cluster/kpt { };
 
   krabby = callPackage ../applications/misc/krabby { };