Merge branch 'master' into haskell-updates

.github/PULL_REQUEST_TEMPLATE.md

@@ -21,7 +21,7 @@ For new packages please briefly describe the package or provide a link to its ho
   - [NixOS test(s)](https://nixos.org/manual/nixos/unstable/index.html#sec-nixos-tests) (look inside [nixos/tests](https://github.com/NixOS/nixpkgs/blob/master/nixos/tests))
   - and/or [package tests](https://github.com/NixOS/nixpkgs/blob/master/pkgs/README.md#package-tests)
   - or, for functions and "core" functionality, tests in [lib/tests](https://github.com/NixOS/nixpkgs/blob/master/lib/tests) or [pkgs/test](https://github.com/NixOS/nixpkgs/blob/master/pkgs/test)
-  - made sure NixOS tests are [linked](https://nixos.org/manual/nixpkgs/unstable/#ssec-nixos-tests-linking) to the relevant packages
+  - made sure NixOS tests are [linked](https://github.com/NixOS/nixpkgs/blob/master/pkgs/README.md#linking-nixos-module-tests-to-a-package) to the relevant packages
 - [ ] Tested compilation of all packages that depend on this change using `nix-shell -p nixpkgs-review --run "nixpkgs-review rev HEAD"`. Note: all changes have to be committed, also see [nixpkgs-review usage](https://github.com/Mic92/nixpkgs-review#usage)
 - [ ] Tested basic functionality of all binary files (usually in `./result/bin/`)
 - [24.11 Release Notes](https://github.com/NixOS/nixpkgs/blob/master/nixos/doc/manual/release-notes/rl-2411.section.md) (or backporting [23.11](https://github.com/NixOS/nixpkgs/blob/master/nixos/doc/manual/release-notes/rl-2311.section.md) and [24.05](https://github.com/NixOS/nixpkgs/blob/master/nixos/doc/manual/release-notes/rl-2405.section.md) Release notes)

doc/build-helpers/trivial-build-helpers.chapter.md

@@ -3,32 +3,122 @@
 Nixpkgs provides a variety of wrapper functions that help build commonly useful derivations.
 Like [`stdenv.mkDerivation`](#sec-using-stdenv), each of these build helpers creates a derivation, but the arguments passed are different (usually simpler) from those required by `stdenv.mkDerivation`.
 
-## `runCommand` {#trivial-builder-runCommand}
 
-`runCommand :: String -> AttrSet -> String -> Derivation`
+## `runCommandWith` {#trivial-builder-runCommandWith}
 
-The result of `runCommand name drvAttrs buildCommand` is a derivation that is built by running the specified shell commands.
+The function `runCommandWith` returns a derivation built using the specified command(s), in a specified environment.
 
-By default `runCommand` runs in a stdenv with no compiler environment, whereas [`runCommandCC`](#trivial-builder-runCommandCC) uses the default stdenv, `pkgs.stdenv`.
+It is the underlying base function of  all [`runCommand*` variants].
+The general behavior is controlled via a single attribute set passed
+as the first argument, and allows specifying `stdenv` freely.
 
-`name :: String`
-:   The name that Nix will append to the store path in the same way that `stdenv.mkDerivation` uses its `name` attribute.
+The following [`runCommand*` variants] exist: `runCommand`, `runCommandCC`, and `runCommandLocal`.
 
-`drvAttr :: AttrSet`
-:   Attributes to pass to the underlying call to [`stdenv.mkDerivation`](#chap-stdenv).
+[`runCommand*` variants]: #trivial-builder-runCommand
 
-`buildCommand :: String`
+### Type {#trivial-builder-runCommandWith-Type}
+
+```
+runCommandWith :: {
+  name :: name;
+  stdenv? :: Derivation;
+  runLocal? :: Bool;
+  derivationArgs? :: { ... };
+} -> String -> Derivation
+```
+
+### Inputs {#trivial-builder-runCommandWith-Inputs}
+
+`name` (String)
+:   The derivation's name, which Nix will append to the store path; see [`mkDerivation`](#sec-using-stdenv).
+
+`runLocal` (Boolean)
+:   If set to `true` this forces the derivation to be built locally, not using [substitutes] nor remote builds.
+    This is intended for very cheap commands (<1s execution time) which can be sped up by avoiding the network round-trip(s).
+    Its effect is to set [`preferLocalBuild = true`][preferLocalBuild] and [`allowSubstitutes = false`][allowSubstitutes].
+
+   ::: {.note}
+   This prevents the use of [substituters][substituter], so only set `runLocal` (or use `runCommandLocal`) when certain the user will
+   always have a builder for the `system` of the derivation. This should be true for most trivial use cases
+   (e.g., just copying some files to a different location or adding symlinks) because there the `system`
+   is usually the same as `builtins.currentSystem`.
+   :::
+
+`stdenv` (Derivation)
+:   The [standard environment](#chap-stdenv) to use, defaulting to `pkgs.stdenv`
+
+`derivationArgs` (Attribute set)
+:   Additional arguments for [`mkDerivation`](#sec-using-stdenv).
+
+`buildCommand` (String)
 :   Shell commands to run in the derivation builder.
 
     ::: {.note}
     You have to create a file or directory `$out` for Nix to be able to run the builder successfully.
     :::
 
+[allowSubstitutes]: https://nixos.org/nix/manual/#adv-attr-allowSubstitutes
+[preferLocalBuild]: https://nixos.org/nix/manual/#adv-attr-preferLocalBuild
+[substituter]: https://nix.dev/manual/nix/latest/glossary#gloss-substituter
+[substitutes]: https://nix.dev/manual/nix/2.23/glossary#gloss-substitute
+
+::: {.example #ex-runcommandwith}
+# Invocation of `runCommandWith`
+
+```nix
+runCommandWith {
+  name = "example";
+  derivationArgs.nativeBuildInputs = [ cowsay ];
+} ''
+  cowsay > $out <<EOMOO
+  'runCommandWith' is a bit cumbersome,
+  so we have more ergonomic wrappers.
+  EOMOO
+''
+```
+
+:::
+
+
+## `runCommand` and `runCommandCC` {#trivial-builder-runCommand}
+
+The function `runCommand` returns a derivation built using the specified command(s), in the `stdenvNoCC` environment.
+
+`runCommandCC` is similar but uses the default compiler environment. To minimize dependencies, `runCommandCC`
+should only be used when the build command needs a C compiler.
+
+`runCommandLocal` is also similar to `runCommand`, but forces the derivation to be built locally.
+See the note on [`runCommandWith`] about `runLocal`.
+
+[`runCommandWith`]: #trivial-builder-runCommandWith
+
+### Type {#trivial-builder-runCommand-Type}
+
+```
+runCommand      :: String -> AttrSet -> String -> Derivation
+runCommandCC    :: String -> AttrSet -> String -> Derivation
+runCommandLocal :: String -> AttrSet -> String -> Derivation
+```
+
+### Input {#trivial-builder-runCommand-Input}
+
+While the type signature(s) differ from [`runCommandWith`], individual arguments with the same name will have the same type and meaning:
+
+`name` (String)
+:   The derivation's name
+
+`derivationArgs` (Attribute set)
+:   Additional parameters passed to [`mkDerivation`]
+
+`buildCommand` (String)
+:   The command(s) run to build the derivation.
+
+
 ::: {.example #ex-runcommand-simple}
 # Invocation of `runCommand`
 
 ```nix
-(import <nixpkgs> {}).runCommand "my-example" {} ''
+runCommand "my-example" {} ''
   echo My example command is running
 
   mkdir $out
@@ -49,18 +139,24 @@ By default `runCommand` runs in a stdenv with no compiler environment, whereas [
 ```
 :::
 
-## `runCommandCC` {#trivial-builder-runCommandCC}
-
-This works just like `runCommand`. The only difference is that it also provides a C compiler in `buildCommand`'s environment. To minimize your dependencies, you should only use this if you are sure you will need a C compiler as part of running your command.
-
-## `runCommandLocal` {#trivial-builder-runCommandLocal}
-
-Variant of `runCommand` that forces the derivation to be built locally, it is not substituted. This is intended for very cheap commands (<1s execution time). It saves on the network round-trip and can speed up a build.
-
 ::: {.note}
-This sets [`allowSubstitutes` to `false`](https://nixos.org/nix/manual/#adv-attr-allowSubstitutes), so only use `runCommandLocal` if you are certain the user will always have a builder for the `system` of the derivation. This should be true for most trivial use cases (e.g., just copying some files to a different location or adding symlinks) because there the `system` is usually the same as `builtins.currentSystem`.
+`runCommand name derivationArgs buildCommand` is equivalent to
+```nix
+runCommandWith {
+  inherit name derivationArgs;
+  stdenv = stdenvNoCC;
+} buildCommand
+```
+
+Likewise, `runCommandCC name derivationArgs buildCommand` is equivalent to
+```nix
+runCommandWith {
+  inherit name derivationArgs;
+} buildCommand
+```
 :::
 
+
 ## Writing text files {#trivial-builder-text-writing}
 
 Nixpkgs provides the following functions for producing derivations which write text files or executable scripts into the Nix store.

doc/languages-frameworks/vim.section.md

@@ -232,6 +232,14 @@ To add a new plugin, run `nix-shell -p vimPluginsUpdater --run 'vim-plugins-upda
 
 Finally, there are some plugins that are also packaged in nodePackages because they have Javascript-related build steps, such as running webpack. Those plugins are not listed in `vim-plugin-names` or managed by `vimPluginsUpdater` at all, and are included separately in `overrides.nix`. Currently, all these plugins are related to the `coc.nvim` ecosystem of the Language Server Protocol integration with Vim/Neovim.
 
+### Plugin optional configuration {#vim-plugin-required-snippet}
+
+Some plugins require specific configuration to work. We choose not to
+patch those plugins but expose the necessary configuration under
+`PLUGIN.passthru.initLua` for neovim plugins. For instance, the `unicode-vim` plugin
+needs the path towards a unicode database so we expose the following snippet `vim.g.Unicode_data_directory="${self.unicode-vim}/autoload/unicode"` under `vimPlugins.unicode-vim.passthru.initLua`.
+
+
 ## Updating plugins in nixpkgs {#updating-plugins-in-nixpkgs}
 
 Run the update script with a GitHub API token that has at least `public_repo` access. Running the script without the token is likely to result in rate-limiting (429 errors). For steps on creating an API token, please refer to [GitHub's token documentation](https://docs.github.com/en/free-pro-team@latest/github/authenticating-to-github/creating-a-personal-access-token).

lib/types.nix

@@ -219,7 +219,7 @@ rec {
     else "(${t.description})";
 
   # When adding new types don't forget to document them in
-  # nixos/doc/manual/development/option-types.xml!
+  # nixos/doc/manual/development/option-types.section.md!
   types = rec {
 
     raw = mkOptionType {

maintainers/maintainer-list.nix

@@ -963,6 +963,12 @@
     matrix = "@alexshpilkin:matrix.org";
     name = "Alexander Shpilkin";
   };
+  AlexSKaye = {
+    email = "AlexSKaye@proton.me";
+    github = "AlexSKaye";
+    githubId = 3017212;
+    name = "Alex S. Kaye";
+  };
   alexvorobiev = {
     email = "alexander.vorobiev@gmail.com";
     github = "alexvorobiev";
@@ -10097,6 +10103,12 @@
     githubId = 15893072;
     name = "Josh van Leeuwen";
   };
+  jovandeginste = {
+    email = "jo.vandeginste@gmail.com";
+    github = "jovandeginste";
+    githubId = 3170771;
+    name = "Jo Vandeginste";
+  };
   jpagex = {
     name = "Jérémy Pagé";
     email = "contact@jeremypage.me";
@@ -14429,6 +14441,12 @@
     githubId = 2287221;
     name = "Andreas Zweili";
   };
+  nebunebu = {
+    email = "neb.nebuchadnezzar@gmail.com";
+    github = "nebunebu";
+    githubId = 87451010;
+    name = "nebu";
+  };
   Necior = {
     email = "adrian@sadlocha.eu";
     github = "Necior";
@@ -15210,6 +15228,12 @@
     githubId = 7397786;
     name = "Odysseas Georgoudis";
   };
+  ofalvai = {
+    email = "ofalvai@gmail.com";
+    github = "ofalvai";
+    githubId = 1694986;
+    name = "Olivér Falvai";
+  };
   ofek = {
     email = "oss@ofek.dev";
     github = "ofek";
@@ -15463,6 +15487,12 @@
     github = "OlivierNicole";
     githubId = 14031333;
   };
+  ottoblep = {
+    name = "Severin Lochschmidt";
+    email = "seviron53@gmail.com";
+    github = "ottoblep";
+    githubId = 57066925;
+  };
   otwieracz = {
     email = "slawek@otwiera.cz";
     github = "otwieracz";

nixos/doc/manual/release-notes/rl-2411.section.md

@@ -87,6 +87,9 @@
 
 - [Proton Mail bridge](https://proton.me/mail/bridge), a desktop application that runs in the background, encrypting and decrypting messages as they enter and leave your computer. It lets you add your Proton Mail account to your favorite email client via IMAP/SMTP by creating a local email server on your computer.
 
+- [chromadb](https://www.trychroma.com/), an open-source AI application
+  database. Batteries included. Available as [services.chromadb](options.html#opt-services.chromadb.enable).
+
 ## Backward Incompatibilities {#sec-release-24.11-incompatibilities}
 
 - `transmission` package has been aliased with a `trace` warning to `transmission_3`. Since [Transmission 4 has been released last year](https://github.com/transmission/transmission/releases/tag/4.0.0), and Transmission 3 will eventually go away, it was decided perform this warning alias to make people aware of the new version. The `services.transmission.package` defaults to `transmission_3` as well because the upgrade can cause data loss in certain specific usage patterns (examples: [#5153](https://github.com/transmission/transmission/issues/5153), [#6796](https://github.com/transmission/transmission/issues/6796)). Please make sure to back up to your data directory per your usage:

nixos/modules/module-list.nix

@@ -458,6 +458,7 @@
   ./services/continuous-integration/woodpecker/server.nix
   ./services/databases/aerospike.nix
   ./services/databases/cassandra.nix
+  ./services/databases/chromadb.nix
   ./services/databases/clickhouse.nix
   ./services/databases/cockroachdb.nix
   ./services/databases/couchdb.nix

nixos/modules/services/databases/chromadb.nix

@@ -0,0 +1,107 @@
+{
+  config,
+  pkgs,
+  lib,
+  ...
+}:
+
+let
+  cfg = config.services.chromadb;
+  inherit (lib)
+    mkEnableOption
+    mkOption
+    mkIf
+    types
+    literalExpression
+    ;
+in
+{
+
+  meta.maintainers = with lib.maintainers; [ drupol ];
+
+  options = {
+    services.chromadb = {
+      enable = mkEnableOption "ChromaDB, an open-source AI application database.";
+
+      package = mkOption {
+        type = types.package;
+        example = literalExpression "pkgs.python3Packages.chromadb";
+        default = pkgs.python3Packages.chromadb;
+        defaultText = "pkgs.python3Packages.chromadb";
+        description = "ChromaDB package to use.";
+      };
+
+      host = mkOption {
+        type = types.str;
+        default = "127.0.0.1";
+        description = ''
+          Defines the IP address by which ChromaDB will be accessible.
+        '';
+      };
+
+      port = mkOption {
+        type = types.port;
+        default = 8000;
+        description = ''
+          Defined the port number to listen.
+        '';
+      };
+
+      logFile = mkOption {
+        type = types.path;
+        default = "/var/log/chromadb/chromadb.log";
+        description = ''
+          Specifies the location of file for logging output.
+        '';
+      };
+
+      dbpath = mkOption {
+        type = types.str;
+        default = "/var/lib/chromadb";
+        description = "Location where ChromaDB stores its files";
+      };
+
+      openFirewall = mkOption {
+        type = types.bool;
+        default = false;
+        description = ''
+          Whether to automatically open the specified TCP port in the firewall.
+        '';
+      };
+    };
+  };
+
+  config = mkIf cfg.enable {
+    systemd.services.chromadb = {
+      description = "ChromaDB";
+      after = [ "network.target" ];
+      wantedBy = [ "multi-user.target" ];
+      serviceConfig = {
+        Type = "simple";
+        StateDirectory = "chromadb";
+        WorkingDirectory = "/var/lib/chromadb";
+        LogsDirectory = "chromadb";
+        ExecStart = "${lib.getExe cfg.package} run --path ${cfg.dbpath} --host ${cfg.host} --port ${toString cfg.port} --log-path ${cfg.logFile}";
+        Restart = "on-failure";
+        ProtectHome = true;
+        ProtectSystem = "strict";
+        PrivateTmp = true;
+        PrivateDevices = true;
+        ProtectHostname = true;
+        ProtectClock = true;
+        ProtectKernelTunables = true;
+        ProtectKernelModules = true;
+        ProtectKernelLogs = true;
+        ProtectControlGroups = true;
+        NoNewPrivileges = true;
+        RestrictRealtime = true;
+        RestrictSUIDSGID = true;
+        RemoveIPC = true;
+        PrivateMounts = true;
+        DynamicUser = true;
+      };
+    };
+
+    networking.firewall.allowedTCPPorts = lib.optionals cfg.openFirewall [ cfg.port ];
+  };
+}

nixos/modules/services/networking/cgit.nix

@@ -6,6 +6,7 @@ let
   cfgs = config.services.cgit;
 
   settingType = with types; oneOf [ bool int str ];
+  repeatedSettingType = with types; oneOf [ settingType (listOf settingType) ];
 
   genAttrs' = names: f: listToAttrs (map f names);
 
@@ -44,12 +45,20 @@ let
       toString value
   }";
 
+  # list value as multiple lines (for "readme" for example)
+  cgitrcEntry = name: value:
+    if isList value then
+      map (cgitrcLine name) value
+    else
+      [ (cgitrcLine name value) ];
+
   mkCgitrc = cfg: pkgs.writeText "cgitrc" ''
     # global settings
     ${concatStringsSep "\n" (
-        mapAttrsToList
-          cgitrcLine
+        flatten (mapAttrsToList
+          cgitrcEntry
           ({ virtual-root = cfg.nginx.location; } // cfg.settings)
+        )
       )
     }
     ${optionalString (cfg.scanPath != null) (cgitrcLine "scan-path" cfg.scanPath)}
@@ -125,7 +134,7 @@ in
 
           settings = mkOption {
             description = "cgit configuration, see cgitrc(5)";
-            type = types.attrsOf settingType;
+            type = types.attrsOf repeatedSettingType;
             default = {};
             example = literalExpression ''
               {

nixos/modules/services/web-apps/mastodon.nix

@@ -775,7 +775,7 @@ in {
       '' +  lib.optionalString (!databaseActuallyCreateLocally) ''
         unset PGPASSWORD
       '';
-      path = [ cfg.package pkgs.postgresql ];
+      path = [ cfg.package config.services.postgresql.package ];
       environment = env // lib.optionalAttrs (!databaseActuallyCreateLocally) {
         PGHOST = cfg.database.host;
         PGPORT = toString cfg.database.port;

nixos/modules/services/web-apps/weblate.nix

@@ -42,9 +42,10 @@ let
       SESSION_COOKIE_SECURE = ENABLE_HTTPS
       DATA_DIR = "${dataDir}"
       CACHE_DIR = f"{DATA_DIR}/cache"
-      STATIC_ROOT = "${finalPackage.static}/static"
+      STATIC_ROOT = "${finalPackage.static}"
       MEDIA_ROOT = "/var/lib/weblate/media"
-      COMPRESS_ROOT = "${finalPackage.static}/compressor-cache"
+      COMPRESS_ROOT = "${finalPackage.static}"
+      COMPRESS_OFFLINE = True
       DEBUG = False
 
       DATABASES = {
@@ -86,6 +87,13 @@ let
 
       VCS_BACKENDS = ("weblate.vcs.git.GitRepository",)
 
+      SITE_URL = "https://{}".format(SITE_DOMAIN)
+
+      # WebAuthn
+      OTP_WEBAUTHN_RP_NAME = SITE_TITLE
+      OTP_WEBAUTHN_RP_ID = SITE_DOMAIN.split(":")[0]
+      OTP_WEBAUTHN_ALLOWED_ORIGINS = [SITE_URL]
+
     ''
     + lib.optionalString cfg.smtp.enable ''
       ADMINS = (("Weblate Admin", "${cfg.smtp.user}"),)
@@ -205,8 +213,7 @@ in
 
         locations = {
           "= /favicon.ico".alias = "${finalPackage}/${python.sitePackages}/weblate/static/favicon.ico";
-          "/static/".alias = "${finalPackage.static}/static/";
-          "/static/CACHE/".alias = "${finalPackage.static}/compressor-cache/CACHE/";
+          "/static/".alias = "${finalPackage.static}/";
           "/media/".alias = "/var/lib/weblate/media/";
           "/".proxyPass = "http://unix:///run/weblate.socket";
         };

nixos/modules/system/boot/systemd.nix

@@ -53,7 +53,6 @@ let
       "debug-shell.service"
 
       # Udev.
-      "systemd-tmpfiles-setup-dev-early.service"
       "systemd-udevd-control.socket"
       "systemd-udevd-kernel.socket"
       "systemd-udevd.service"

nixos/modules/system/boot/systemd/initrd.nix

@@ -67,8 +67,6 @@ let
     "systemd-poweroff.service"
     "systemd-reboot.service"
     "systemd-sysctl.service"
-    "systemd-tmpfiles-setup-dev.service"
-    "systemd-tmpfiles-setup.service"
     "timers.target"
     "tpm2.target"
     "umount.target"
@@ -103,8 +101,17 @@ let
   initrdBinEnv = pkgs.buildEnv {
     name = "initrd-bin-env";
     paths = map getBin cfg.initrdBin;
-    pathsToLink = ["/bin"];
-    postBuild = concatStringsSep "\n" (mapAttrsToList (n: v: "ln -sf '${v}' $out/bin/'${n}'") cfg.extraBin);
+    pathsToLink = ["/bin" "/sbin"];
+
+    # Make sure sbin and bin have the same contents, and add extraBin
+    postBuild = ''
+      find $out/bin -maxdepth 1 -type l -print0 | xargs --null cp --no-dereference --no-clobber -t $out/sbin/
+      find $out/sbin -maxdepth 1 -type l -print0 | xargs --null cp --no-dereference --no-clobber -t $out/bin/
+      ${concatStringsSep "\n" (mapAttrsToList (n: v: ''
+        ln -sf '${v}' $out/bin/'${n}'
+        ln -sf '${v}' $out/sbin/'${n}'
+      '') cfg.extraBin)}
+    '';
   };
 
   initialRamdisk = pkgs.makeInitrdNG {
@@ -226,8 +233,8 @@ in {
     emergencyAccess = mkOption {
       type = with types; oneOf [ bool (nullOr (passwdEntry str)) ];
       description = ''
-        Set to true for unauthenticated emergency access, and false for
-        no emergency access.
+        Set to true for unauthenticated emergency access, and false or
+        null for no emergency access.
 
         Can also be set to a hashed super user password to allow
         authenticated access to the emergency mode.
@@ -408,7 +415,7 @@ in {
         fsck = "${cfg.package.util-linux}/bin/fsck";
       };
 
-      managerEnvironment.PATH = "/bin";
+      managerEnvironment.PATH = "/bin:/sbin";
 
       contents = {
         "/tmp/.keep".text = "systemd requires the /tmp mount point in the initrd cpio archive";
@@ -417,7 +424,7 @@ in {
 
         "/etc/systemd/system.conf".text = ''
           [Manager]
-          DefaultEnvironment=PATH=/bin
+          DefaultEnvironment=PATH=/bin:/sbin
           ${cfg.extraConfig}
           ManagerEnvironment=${lib.concatStringsSep " " (lib.mapAttrsToList (n: v: "${n}=${lib.escapeShellArg v}") cfg.managerEnvironment)}
         '';
@@ -429,12 +436,17 @@ in {
         # We can use either ! or * to lock the root account in the
         # console, but some software like OpenSSH won't even allow you
         # to log in with an SSH key if you use ! so we use * instead
-        "/etc/shadow".text = "root:${if isBool cfg.emergencyAccess then optionalString (!cfg.emergencyAccess) "*" else cfg.emergencyAccess}:::::::";
+        "/etc/shadow".text = let
+          ea = cfg.emergencyAccess;
+          access = ea != null && !(isBool ea && !ea);
+          passwd = if isString ea then ea else "";
+        in
+          "root:${if access then passwd else "*"}:::::::";
 
         "/bin".source = "${initrdBinEnv}/bin";
-        "/sbin".source = "${initrdBinEnv}/bin";
+        "/sbin".source = "${initrdBinEnv}/sbin";
 
-        "/etc/sysctl.d/nixos.conf".text = "kernel.modprobe = /bin/modprobe";
+        "/etc/sysctl.d/nixos.conf".text = "kernel.modprobe = /sbin/modprobe";
         "/etc/modprobe.d/systemd.conf".source = "${cfg.package}/lib/modprobe.d/systemd.conf";
         "/etc/modprobe.d/ubuntu.conf".source = pkgs.runCommand "initrd-kmod-blacklist-ubuntu" { } ''
           ${pkgs.buildPackages.perl}/bin/perl -0pe 's/## file: iwlwifi.conf(.+?)##/##/s;' $src > $out
@@ -509,8 +521,6 @@ in {
                      (v: let n = escapeSystemdPath v.where;
                          in nameValuePair "${n}.automount" (automountToUnit v)) cfg.automounts);
 
-      # make sure all the /dev nodes are set up
-      services.systemd-tmpfiles-setup-dev.wantedBy = ["sysinit.target"];
 
       services.initrd-nixos-activation = {
         after = [ "initrd-fs.target" ];

nixos/modules/system/boot/systemd/tmpfiles.nix

@@ -1,10 +1,121 @@
-{ config, lib, pkgs, utils, ... }:
+{ config, lib, pkgs, ... }:
 
 with lib;
 
 let
   cfg = config.systemd.tmpfiles;
+  initrdCfg = config.boot.initrd.systemd.tmpfiles;
   systemd = config.systemd.package;
+
+  settingsOption = {
+    description = ''
+      Declare systemd-tmpfiles rules to create, delete, and clean up volatile
+      and temporary files and directories.
+
+      Even though the service is called `*tmp*files` you can also create
+      persistent files.
+    '';
+    example = {
+      "10-mypackage" = {
+        "/var/lib/my-service/statefolder".d = {
+          mode = "0755";
+          user = "root";
+          group = "root";
+        };
+      };
+    };
+    default = {};
+    type = types.attrsOf (types.attrsOf (types.attrsOf (types.submodule ({ name, config, ... }: {
+      options.type = mkOption {
+        type = types.str;
+        default = name;
+        example = "d";
+        description = ''
+          The type of operation to perform on the file.
+
+          The type consists of a single letter and optionally one or more
+          modifier characters.
+
+          Please see the upstream documentation for the available types and
+          more details:
+          <https://www.freedesktop.org/software/systemd/man/tmpfiles.d>
+        '';
+      };
+      options.mode = mkOption {
+        type = types.str;
+        default = "-";
+        example = "0755";
+        description = ''
+          The file access mode to use when creating this file or directory.
+        '';
+      };
+      options.user = mkOption {
+        type = types.str;
+        default = "-";
+        example = "root";
+        description = ''
+          The user of the file.
+
+          This may either be a numeric ID or a user/group name.
+
+          If omitted or when set to `"-"`, the user and group of the user who
+          invokes systemd-tmpfiles is used.
+        '';
+      };
+      options.group = mkOption {
+        type = types.str;
+        default = "-";
+        example = "root";
+        description = ''
+          The group of the file.
+
+          This may either be a numeric ID or a user/group name.
+
+          If omitted or when set to `"-"`, the user and group of the user who
+          invokes systemd-tmpfiles is used.
+        '';
+      };
+      options.age = mkOption {
+        type = types.str;
+        default = "-";
+        example = "10d";
+        description = ''
+          Delete a file when it reaches a certain age.
+
+          If a file or directory is older than the current time minus the age
+          field, it is deleted.
+
+          If set to `"-"` no automatic clean-up is done.
+        '';
+      };
+      options.argument = mkOption {
+        type = types.str;
+        default = "";
+        example = "";
+        description = ''
+          An argument whose meaning depends on the type of operation.
+
+          Please see the upstream documentation for the meaning of this
+          parameter in different situations:
+          <https://www.freedesktop.org/software/systemd/man/tmpfiles.d>
+        '';
+      };
+    }))));
+  };
+
+  # generates a single entry for a tmpfiles.d rule
+  settingsEntryToRule = path: entry: ''
+    '${entry.type}' '${path}' '${entry.mode}' '${entry.user}' '${entry.group}' '${entry.age}' ${entry.argument}
+  '';
+
+  # generates a list of tmpfiles.d rules from the attrs (paths) under tmpfiles.settings.<name>
+  pathsToRules = mapAttrsToList (path: types:
+    concatStrings (
+      mapAttrsToList (_type: settingsEntryToRule path) types
+    )
+  );
+
+  mkRuleFileContent = paths: concatStrings (pathsToRules paths);
 in
 {
   options = {
@@ -20,101 +131,16 @@ in
       '';
     };
 
-    systemd.tmpfiles.settings = mkOption {
+    systemd.tmpfiles.settings = mkOption settingsOption;
+
+    boot.initrd.systemd.tmpfiles.settings = mkOption (settingsOption // {
       description = ''
-        Declare systemd-tmpfiles rules to create, delete, and clean up volatile
-        and temporary files and directories.
+        Similar to {option}`systemd.tmpfiles.settings` but the rules are
+        only applied by systemd-tmpfiles before `initrd-switch-root.target`.
 
-        Even though the service is called `*tmp*files` you can also create
-        persistent files.
+        See {manpage}`bootup(7)`.
       '';
-      example = {
-        "10-mypackage" = {
-          "/var/lib/my-service/statefolder".d = {
-            mode = "0755";
-            user = "root";
-            group = "root";
-          };
-        };
-      };
-      default = {};
-      type = types.attrsOf (types.attrsOf (types.attrsOf (types.submodule ({ name, config, ... }: {
-        options.type = mkOption {
-          type = types.str;
-          default = name;
-          example = "d";
-          description = ''
-            The type of operation to perform on the file.
-
-            The type consists of a single letter and optionally one or more
-            modifier characters.
-
-            Please see the upstream documentation for the available types and
-            more details:
-            <https://www.freedesktop.org/software/systemd/man/tmpfiles.d>
-          '';
-        };
-        options.mode = mkOption {
-          type = types.str;
-          default = "-";
-          example = "0755";
-          description = ''
-            The file access mode to use when creating this file or directory.
-          '';
-        };
-        options.user = mkOption {
-          type = types.str;
-          default = "-";
-          example = "root";
-          description = ''
-            The user of the file.
-
-            This may either be a numeric ID or a user/group name.
-
-            If omitted or when set to `"-"`, the user and group of the user who
-            invokes systemd-tmpfiles is used.
-          '';
-        };
-        options.group = mkOption {
-          type = types.str;
-          default = "-";
-          example = "root";
-          description = ''
-            The group of the file.
-
-            This may either be a numeric ID or a user/group name.
-
-            If omitted or when set to `"-"`, the user and group of the user who
-            invokes systemd-tmpfiles is used.
-          '';
-        };
-        options.age = mkOption {
-          type = types.str;
-          default = "-";
-          example = "10d";
-          description = ''
-            Delete a file when it reaches a certain age.
-
-            If a file or directory is older than the current time minus the age
-            field, it is deleted.
-
-            If set to `"-"` no automatic clean-up is done.
-          '';
-        };
-        options.argument = mkOption {
-          type = types.str;
-          default = "";
-          example = "";
-          description = ''
-            An argument whose meaning depends on the type of operation.
-
-            Please see the upstream documentation for the meaning of this
-            parameter in different situations:
-            <https://www.freedesktop.org/software/systemd/man/tmpfiles.d>
-          '';
-        };
-      }))));
-    };
+    });
 
     systemd.tmpfiles.packages = mkOption {
       type = types.listOf types.package;
@@ -140,8 +166,9 @@ in
     systemd.additionalUpstreamSystemUnits = [
       "systemd-tmpfiles-clean.service"
       "systemd-tmpfiles-clean.timer"
-      "systemd-tmpfiles-setup.service"
+      "systemd-tmpfiles-setup-dev-early.service"
       "systemd-tmpfiles-setup-dev.service"
+      "systemd-tmpfiles-setup.service"
     ];
 
     systemd.additionalUpstreamUserUnits = [
@@ -236,11 +263,7 @@ in
         '';
       })
     ] ++ (mapAttrsToList (name: paths:
-      pkgs.writeTextDir "lib/tmpfiles.d/${name}.conf" (concatStrings (mapAttrsToList (path: types:
-        concatStrings (mapAttrsToList (_type: entry: ''
-          '${entry.type}' '${path}' '${entry.mode}' '${entry.user}' '${entry.group}' '${entry.age}' ${entry.argument}
-        '') types)
-      ) paths ))
+      pkgs.writeTextDir "lib/tmpfiles.d/${name}.conf" (mkRuleFileContent paths)
     ) cfg.settings);
 
     systemd.tmpfiles.rules = [
@@ -256,5 +279,62 @@ in
       "R! /nix/var/nix/gcroots/tmp           -    -    -    - -"
       "R! /nix/var/nix/temproots             -    -    -    - -"
     ];
+
+    boot.initrd.systemd = {
+      additionalUpstreamUnits = [
+        "systemd-tmpfiles-setup-dev-early.service"
+        "systemd-tmpfiles-setup-dev.service"
+        "systemd-tmpfiles-setup.service"
+      ];
+
+      # override to exclude the prefix /sysroot, because it is not necessarily set up when the unit starts
+      services.systemd-tmpfiles-setup.serviceConfig = {
+        ExecStart = [
+          ""
+          "systemd-tmpfiles --create --remove --boot --exclude-prefix=/dev --exclude-prefix=/sysroot"
+        ];
+      };
+
+      # sets up files under the prefix /sysroot, after the hierarchy is available and before nixos activation
+      services.systemd-tmpfiles-setup-sysroot = {
+        description = "Create Volatile Files and Directories in the Real Root";
+        after = [ "initrd-fs.target" ];
+        before = [
+          "initrd-nixos-activation.service"
+          "shutdown.target" "initrd-switch-root.target"
+        ];
+        conflicts = [ "shutdown.target" "initrd-switch-root.target" ];
+        wantedBy = [ "initrd.target" ];
+        serviceConfig = {
+          Type = "oneshot";
+          RemainAfterExit = true;
+          ExecStart = "systemd-tmpfiles --create --remove --boot --exclude-prefix=/dev --prefix=/sysroot";
+          SuccessExitStatus = [ "DATAERR CANTCREAT" ];
+          ImportCredential = [
+            "tmpfiles.*"
+            "login.motd"
+            "login.issue"
+            "network.hosts"
+            "ssh.authorized_keys.root"
+          ];
+        };
+        unitConfig = {
+          DefaultDependencies = false;
+          RefuseManualStop = true;
+        };
+
+      };
+
+      contents."/etc/tmpfiles.d" = mkIf (initrdCfg.settings != { }) {
+        source = pkgs.linkFarm "initrd-tmpfiles.d" (
+          mapAttrsToList
+            (name: paths: {
+              name = "${name}.conf";
+              path = pkgs.writeText "${name}.conf" (mkRuleFileContent paths);
+            }
+            )
+            initrdCfg.settings);
+      };
+    };
   };
 }

nixos/tests/all-tests.nix

@@ -192,6 +192,7 @@ in {
   cfssl = handleTestOn ["aarch64-linux" "x86_64-linux"] ./cfssl.nix {};
   cgit = handleTest ./cgit.nix {};
   charliecloud = handleTest ./charliecloud.nix {};
+  chromadb = runTest ./chromadb.nix;
   chromium = (handleTestOn ["aarch64-linux" "x86_64-linux"] ./chromium.nix {}).stable or {};
   chrony = handleTestOn ["aarch64-linux" "x86_64-linux"] ./chrony.nix {};
   chrony-ptp = handleTestOn ["aarch64-linux" "x86_64-linux"] ./chrony-ptp.nix {};

nixos/tests/cgit.nix

@@ -27,6 +27,12 @@ in {
             desc = "some-repo description";
           };
         };
+        settings = {
+          readme = [
+            ":README.md"
+            ":date.txt"
+          ];
+        };
       };
 
       environment.systemPackages = [ pkgs.git ];
@@ -56,18 +62,42 @@ in {
       git init -b master reference
       cd reference
       git remote add origin /tmp/git/some-repo
-      date > date.txt
+      { echo -n "cgit NixOS Test at "; date; } > date.txt
       git add date.txt
       git -c user.name=test -c user.email=test@localhost commit -m 'add date'
       git push -u origin master
     ''}")
 
+    # test web download
     server.succeed(
         "curl -fsS 'http://localhost/%28c%29git/some-repo/plain/date.txt?id=master' | diff -u reference/date.txt -"
     )
 
+    # test http clone
     server.succeed(
        "git clone http://localhost/%28c%29git/some-repo && diff -u reference/date.txt some-repo/date.txt"
     )
+
+    # test list settings by greping for the fallback readme
+    server.succeed(
+        "curl -fsS 'http://localhost/%28c%29git/some-repo/about/' | grep -F 'cgit NixOS Test at'"
+    )
+
+    # add real readme
+    server.succeed("sudo -u cgit ${pkgs.writeShellScript "cgit-commit-readme" ''
+      set -e
+      echo '# cgit NixOS test README' > reference/README.md
+      git -C reference add README.md
+      git -C reference -c user.name=test -c user.email=test@localhost commit -m 'add readme'
+      git -C reference push
+    ''}")
+
+    # test list settings by greping for the real readme
+    server.succeed(
+        "curl -fsS 'http://localhost/%28c%29git/some-repo/about/' | grep -F '# cgit NixOS test README'"
+    )
+    server.fail(
+        "curl -fsS 'http://localhost/%28c%29git/some-repo/about/' | grep -F 'cgit NixOS Test at'"
+    )
   '';
 })

nixos/tests/chromadb.nix

@@ -0,0 +1,26 @@
+{ lib, pkgs, ... }:
+
+let
+  lib = pkgs.lib;
+
+in
+{
+  name = "chromadb";
+  meta.maintainers = [ lib.maintainers.drupol ];
+
+  nodes = {
+    machine =
+      { pkgs, ... }:
+      {
+        services.chromadb = {
+          enable = true;
+        };
+      };
+  };
+
+  testScript = ''
+    machine.start()
+    machine.wait_for_unit("chromadb.service")
+    machine.wait_for_open_port(8000)
+  '';
+}

nixos/tests/systemd-boot.nix

@@ -269,9 +269,9 @@ in
     '';
   };
 
-  memtest86 = makeTest {
+  memtest86 = with pkgs.lib; optionalAttrs (meta.availableOn { inherit system; } pkgs.memtest86plus) (makeTest {
     name = "systemd-boot-memtest86";
-    meta.maintainers = with pkgs.lib.maintainers; [ julienmalka ];
+    meta.maintainers = with maintainers; [ julienmalka ];
 
     nodes.machine = { pkgs, lib, ... }: {
       imports = [ common ];
@@ -282,7 +282,7 @@ in
       machine.succeed("test -e /boot/loader/entries/memtest86.conf")
       machine.succeed("test -e /boot/efi/memtest86/memtest.efi")
     '';
-  };
+  });
 
   netbootxyz = makeTest {
     name = "systemd-boot-netbootxyz";

nixos/tests/web-apps/mastodon/remote-databases.nix

@@ -10,6 +10,9 @@ let
     192.168.2.103 mastodon.local
   '';
 
+  postgresqlPassword = "thisisnotasecret";
+  redisPassword = "thisisnotasecrettoo";
+
 in
 {
   name = "mastodon-remote-postgresql";
@@ -19,9 +22,7 @@ in
     databases = { config, ... }: {
       environment = {
         etc = {
-          "redis/password-redis-db".text = ''
-            ogjhJL8ynrP7MazjYOF6
-          '';
+          "redis/password-redis-db".text = redisPassword;
         };
       };
       networking = {
@@ -46,16 +47,19 @@ in
 
       services.postgresql = {
         enable = true;
-        # TODO remove once https://github.com/NixOS/nixpkgs/pull/266270 is resolved.
-        package = pkgs.postgresql_14;
         enableTCPIP = true;
         authentication = ''
-          hostnossl mastodon_local mastodon_test 192.168.2.201/32 md5
+          hostnossl mastodon mastodon 192.168.2.201/32 md5
         '';
+        ensureDatabases = [ "mastodon" ];
+        ensureUsers = [
+          {
+            name = "mastodon";
+            ensureDBOwnership = true;
+          }
+        ];
         initialScript = pkgs.writeText "postgresql_init.sql" ''
-          CREATE ROLE mastodon_test LOGIN PASSWORD 'SoDTZcISc3f1M1LJsRLT';
-          CREATE DATABASE mastodon_local TEMPLATE template0 ENCODING UTF8;
-          GRANT ALL PRIVILEGES ON DATABASE mastodon_local TO mastodon_test;
+          CREATE ROLE mastodon LOGIN PASSWORD '${postgresqlPassword}';
         '';
       };
     };
@@ -100,12 +104,8 @@ in
 
       environment = {
         etc = {
-          "mastodon/password-redis-db".text = ''
-            ogjhJL8ynrP7MazjYOF6
-          '';
-          "mastodon/password-posgressql-db".text = ''
-            SoDTZcISc3f1M1LJsRLT
-          '';
+          "mastodon/password-redis-db".text = redisPassword;
+          "mastodon/password-posgressql-db".text = postgresqlPassword;
         };
       };
 
@@ -138,8 +138,8 @@ in
           createLocally = false;
           host = "192.168.2.102";
           port = 5432;
-          name = "mastodon_local";
-          user = "mastodon_test";
+          name = "mastodon";
+          user = "mastodon";
           passwordFile = "/etc/mastodon/password-posgressql-db";
         };
         smtp = {

nixos/tests/web-apps/mastodon/standard.nix

@@ -34,9 +34,6 @@ in
         pki.certificateFiles = [ "${cert pkgs}/cert.pem" ];
       };
 
-      # TODO remove once https://github.com/NixOS/nixpkgs/pull/266270 is resolved.
-      services.postgresql.package = pkgs.postgresql_14;
-
       services.mastodon = {
         enable = true;
         configureNginx = true;

pkgs/applications/audio/picard/default.nix

@@ -1,7 +1,5 @@
 { lib
-# Python 3.12 demonstrates a peculiar segmentation fault with pyqt5. Using
-# pyqt6 with Python 3.12 should work, but this is not released yet.
-, python311Packages
+, python312Packages
 , fetchFromGitHub
 
 , chromaprint
@@ -13,7 +11,7 @@
 }:
 
 let
-  pythonPackages = python311Packages;
+  pythonPackages = python312Packages;
   pyqt5 =
     if enablePlayback then
       pythonPackages.pyqt5-multimedia
@@ -23,19 +21,20 @@ in
 pythonPackages.buildPythonApplication rec {
   pname = "picard";
   # nix-update --commit picard --version-regex 'release-(.*)'
-  version = "2.12";
+  version = "2.12.1";
   format = "setuptools";
 
   src = fetchFromGitHub {
     owner = "metabrainz";
     repo = "picard";
     rev = "refs/tags/release-${version}";
-    hash = "sha256-+++NDJzXw4tA5eQd24r+l3UK3YS8Jy1t9WNiEU9sH0Q=";
+    hash = "sha256-wKPE4lj3DIlY+X5A/MqhnwyrhPTXGjmUnLK1VWXUOas=";
   };
 
   nativeBuildInputs = [
     gettext
     qt5.wrapQtAppsHook
+    pythonPackages.pytestCheckHook
   ] ++ lib.optionals (pyqt5.multimediaEnabled) [
     gst_all_1.gst-libav
     gst_all_1.gst-plugins-base
@@ -68,6 +67,7 @@ pythonPackages.buildPythonApplication rec {
   preCheck = ''
     export HOME=$(mktemp -d)
   '';
+  doCheck = true;
 
   # In order to spare double wrapping, we use:
   preFixup = ''
@@ -76,12 +76,13 @@ pythonPackages.buildPythonApplication rec {
     makeWrapperArgs+=(--prefix GST_PLUGIN_SYSTEM_PATH_1_0 : "$GST_PLUGIN_SYSTEM_PATH_1_0")
   '';
 
-  meta = with lib; {
+  meta = {
     homepage = "https://picard.musicbrainz.org";
     changelog = "https://picard.musicbrainz.org/changelog";
     description = "Official MusicBrainz tagger";
     mainProgram = "picard";
-    license = licenses.gpl2Plus;
-    platforms = platforms.all;
+    license = lib.licenses.gpl2Plus;
+    platforms = lib.platforms.all;
+    maintainers = with lib.maintainers; [ doronbehar ];
   };
 }

pkgs/applications/audio/vcv-rack/default.nix

@@ -36,8 +36,8 @@ let
   pffft-source = fetchFromBitbucket {
     owner = "jpommier";
     repo = "pffft";
-    rev = "38946c766c1afecfa4c5945af77913e38b3cec31";
-    sha256 = "1w6g9v9fy7bavqacb6qw1nxhcik2w36cvl2d7b0bh68w0pd70j5q";
+    rev = "fbc4058602803f40dc554b8a5d2bcc694c005f2f";
+    sha256 = "16biji3115232cr1j975hpxw68lfybajlspnhfjcwg8jz2d8ybrf";
   };
   fuzzysearchdatabase-source = fetchFromBitbucket {
     owner = "j_norberg";
@@ -64,28 +64,28 @@ let
     sha256 = "1d3058x6wgzw7b0wai792flk7s6ffw0z4n9sl016v91yjwv7ds3a";
   };
   oui-blendish-source = fetchFromGitHub {
-    owner = "AndrewBelt";
+    owner = "VCVRack";
     repo = "oui-blendish";
     rev = "2fc6405883f8451944ed080547d073c8f9f31898";
-    sha256 = "/QZFZuI5kSsEvSfMJlcqB1HiZ9Vcf3vqLqWIMEgxQK8=";
+    sha256 = "1bs0654312555vm7nzswsmky4l8759bjdk17pl22p49rw9k4a1px";
   };
   simde-source = fetchFromGitHub {
     owner = "simd-everywhere";
     repo = "simde";
-    rev = "b309d8951997201e493380a2fd09198c09ae1b4e";
-    sha256 = "1hz8mfbhbiafvim4qrkyvh1yndlhydqkxwhls7cfqa48wkpxfip8";
+    rev = "416091ebdb9e901b29d026633e73167d6353a0b0";
+    sha256 = "064ygc6c737yjx04rydwwhkr4n4s4rbvj27swxwyzvp1h8nka6xf";
   };
   tinyexpr-source = fetchFromGitHub {
     owner = "codeplea";
     repo = "tinyexpr";
-    rev = "74804b8c5d296aad0866bbde6c27e2bc1d85e5f2";
-    sha256 = "0z3r7wfw7p2wwl6wls2nxacirppr2147yz29whxmjaxy89ic1744";
+    rev = "9907207e5def0fabdb60c443517b0d9e9d521393";
+    sha256 = "0xbpd09zvrk2ppm1qm1skk6p50mqr9mzjixv3s0biqq6jpabs88l";
   };
   fundamental-source = fetchFromGitHub {
     owner = "VCVRack";
     repo = "Fundamental";
-    rev = "962547d7651260fb6a04f4d8aafd7c27f0221bee"; # tip of branch v2
-    sha256 = "066gcjkni8ba98vv0di59x3f9piir0vyy5sb53cqrbrl51x853cg";
+    rev = "5ed79544161e0fa9a55faa7c0a5f299e828e12ab"; # tip of branch v2
+    sha256 = "0c6qpigyr0ppvra20hcy1fdcmqa212jckb9wkx4f6fgdby7565wv";
   };
   vcv-rtaudio = stdenv.mkDerivation rec {
     pname = "vcv-rtaudio";
@@ -112,7 +112,7 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "vcv-rack";
-  version = "2.4.1";
+  version = "2.5.1";
 
   desktopItems = [
     (makeDesktopItem {
@@ -132,7 +132,7 @@ stdenv.mkDerivation rec {
     owner = "VCVRack";
     repo = "Rack";
     rev = "v${version}";
-    hash = "sha256-Gn/sFltLXX2mLv4dDqmr/UPd+JBXVkIZGwMI6Rm0Ih4=";
+    sha256 = "1q2bwjfn6crk9lyd6m3py0v754arw1xgpv5kkj6ka1bc2yz839qh";
   };
 
   patches = [

pkgs/applications/editors/emacs/elisp-packages/manual-packages/tsc/Cargo.lock

@@ -0,0 +1,285 @@
+# This file is automatically @generated by Cargo.
+# It is not intended for manual editing.
+version = 3
+
+[[package]]
+name = "aho-corasick"
+version = "0.7.18"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1e37cfd5e7657ada45f742d6e99ca5788580b5c529dc78faf11ece6dc702656f"
+dependencies = [
+ "memchr",
+]
+
+[[package]]
+name = "anyhow"
+version = "1.0.51"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8b26702f315f53b6071259e15dd9d64528213b44d61de1ec926eca7715d62203"
+
+[[package]]
+name = "cc"
+version = "1.0.72"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "22a9137b95ea06864e018375b72adfb7db6e6f68cfc8df5a04d00288050485ee"
+
+[[package]]
+name = "cfg-if"
+version = "1.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "baf1de4339761588bc0619e3cbc0120ee582ebb74b53b4efbf79117bd2da40fd"
+
+[[package]]
+name = "ctor"
+version = "0.1.21"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ccc0a48a9b826acdf4028595adc9db92caea352f7af011a3034acd172a52a0aa"
+dependencies = [
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "darling"
+version = "0.10.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0d706e75d87e35569db781a9b5e2416cff1236a47ed380831f959382ccd5f858"
+dependencies = [
+ "darling_core",
+ "darling_macro",
+]
+
+[[package]]
+name = "darling_core"
+version = "0.10.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f0c960ae2da4de88a91b2d920c2a7233b400bc33cb28453a2987822d8392519b"
+dependencies = [
+ "fnv",
+ "ident_case",
+ "proc-macro2",
+ "quote",
+ "strsim",
+ "syn",
+]
+
+[[package]]
+name = "darling_macro"
+version = "0.10.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d9b5a2f4ac4969822c62224815d069952656cadc7084fdca9751e6d959189b72"
+dependencies = [
+ "darling_core",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "emacs"
+version = "0.18.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6797a940189d353de79bec32abe717aeeecd79a08236e84404c888354e040665"
+dependencies = [
+ "anyhow",
+ "ctor",
+ "emacs-macros",
+ "emacs_module",
+ "once_cell",
+ "rustc_version",
+ "thiserror",
+]
+
+[[package]]
+name = "emacs-macros"
+version = "0.17.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "69656fdfe7c2608b87164964db848b5c3795de7302e3130cce7131552c6be161"
+dependencies = [
+ "darling",
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "emacs-tree-sitter"
+version = "0.18.0"
+dependencies = [
+ "emacs",
+ "libloading",
+ "once_cell",
+ "tree-sitter",
+]
+
+[[package]]
+name = "emacs_module"
+version = "0.18.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b3067bc974045ed2c6db333bd4fc30d3bdaafa6421a9a889fa7b2826b6f7f2fa"
+
+[[package]]
+name = "fnv"
+version = "1.0.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3f9eec918d3f24069decb9af1554cad7c880e2da24a9afd88aca000531ab82c1"
+
+[[package]]
+name = "ident_case"
+version = "1.0.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b9e0384b61958566e926dc50660321d12159025e767c18e043daf26b70104c39"
+
+[[package]]
+name = "libloading"
+version = "0.7.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "afe203d669ec979b7128619bae5a63b7b42e9203c1b29146079ee05e2f604b52"
+dependencies = [
+ "cfg-if",
+ "winapi",
+]
+
+[[package]]
+name = "memchr"
+version = "2.4.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "308cc39be01b73d0d18f82a0e7b2a3df85245f84af96fdddc5d202d27e47b86a"
+
+[[package]]
+name = "once_cell"
+version = "1.8.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "692fcb63b64b1758029e0a96ee63e049ce8c5948587f2f7208df04625e5f6b56"
+
+[[package]]
+name = "proc-macro2"
+version = "1.0.33"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fb37d2df5df740e582f28f8560cf425f52bb267d872fe58358eadb554909f07a"
+dependencies = [
+ "unicode-xid",
+]
+
+[[package]]
+name = "quote"
+version = "1.0.10"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "38bc8cc6a5f2e3655e0899c1b848643b2562f853f114bfec7be120678e3ace05"
+dependencies = [
+ "proc-macro2",
+]
+
+[[package]]
+name = "regex"
+version = "1.5.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d07a8629359eb56f1e2fb1652bb04212c072a87ba68546a04065d525673ac461"
+dependencies = [
+ "aho-corasick",
+ "memchr",
+ "regex-syntax",
+]
+
+[[package]]
+name = "regex-syntax"
+version = "0.6.25"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f497285884f3fcff424ffc933e56d7cbca511def0c9831a7f9b5f6153e3cc89b"
+
+[[package]]
+name = "rustc_version"
+version = "0.2.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "138e3e0acb6c9fb258b19b67cb8abd63c00679d2851805ea151465464fe9030a"
+dependencies = [
+ "semver",
+]
+
+[[package]]
+name = "semver"
+version = "0.9.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1d7eb9ef2c18661902cc47e535f9bc51b78acd254da71d375c2f6720d9a40403"
+dependencies = [
+ "semver-parser",
+]
+
+[[package]]
+name = "semver-parser"
+version = "0.7.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "388a1df253eca08550bef6c72392cfe7c30914bf41df5269b68cbd6ff8f570a3"
+
+[[package]]
+name = "strsim"
+version = "0.9.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6446ced80d6c486436db5c078dde11a9f73d42b57fb273121e160b84f63d894c"
+
+[[package]]
+name = "syn"
+version = "1.0.82"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8daf5dd0bb60cbd4137b1b587d2fc0ae729bc07cf01cd70b36a1ed5ade3b9d59"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "unicode-xid",
+]
+
+[[package]]
+name = "thiserror"
+version = "1.0.30"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "854babe52e4df1653706b98fcfc05843010039b406875930a70e4d9644e5c417"
+dependencies = [
+ "thiserror-impl",
+]
+
+[[package]]
+name = "thiserror-impl"
+version = "1.0.30"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "aa32fd3f627f367fe16f893e2597ae3c05020f8bba2666a4e6ea73d377e5714b"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "tree-sitter"
+version = "0.20.0"
+source = "git+https://github.com/ubolonton/tree-sitter?branch=improve-text-provider#475b822f47bdc58d832533448b6f6d9818554f37"
+dependencies = [
+ "cc",
+ "regex",
+]
+
+[[package]]
+name = "unicode-xid"
+version = "0.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8ccb82d61f80a663efe1f787a51b16b5a51e3314d6ac365b08639f52387b33f3"
+
+[[package]]
+name = "winapi"
+version = "0.3.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5c839a674fcd7a98952e593242ea400abe93992746761e38641405d28b00f419"
+dependencies = [
+ "winapi-i686-pc-windows-gnu",
+ "winapi-x86_64-pc-windows-gnu",
+]
+
+[[package]]
+name = "winapi-i686-pc-windows-gnu"
+version = "0.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ac3b87c63620426dd9b991e5ce0329eff545bccbbb34f3be09ff6fb6ab51b7b6"
+
+[[package]]
+name = "winapi-x86_64-pc-windows-gnu"
+version = "0.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "712e227841d057c1ee1cd2fb22fa7e5a5461ae8e48fa2ca79ec42cfc1931183f"

pkgs/applications/editors/emacs/elisp-packages/manual-packages/tsc/package.nix

@@ -1,70 +1,52 @@
 { lib
-, symlinkJoin
 , melpaBuild
 , fetchFromGitHub
 , rustPlatform
-
-, runtimeShell
-, writeScript
-, python3
-, nix-prefetch-github
-, nix
+, stdenv
+, nix-update-script
 }:
 
 let
+  libExt = stdenv.hostPlatform.extensions.sharedLibrary;
 
-  srcMeta = lib.importJSON ./src.json;
-  inherit (srcMeta) version;
-
-  src = fetchFromGitHub srcMeta.src;
-
-  tsc = melpaBuild {
-    inherit src;
-    inherit version;
-
-    pname = "tsc";
-
-    sourceRoot = "${src.name}/core";
-  };
-
-  tsc-dyn = rustPlatform.buildRustPackage {
-    inherit version;
-    inherit src;
-
+  tsc-dyn = rustPlatform.buildRustPackage rec {
     pname = "tsc-dyn";
+    version = "0.18.0";
+
+    src = fetchFromGitHub {
+      owner = "emacs-tree-sitter";
+      repo = "emacs-tree-sitter";
+      rev = version;
+      hash = "sha256-LrakDpP3ZhRQqz47dPcyoQnu5lROdaNlxGaQfQT6u+k=";
+    };
+
+    cargoLock = {
+      lockFile = ./Cargo.lock;
+      outputHashes = {
+        "tree-sitter-0.20.0" = "sha256-hGiJZFrQpO+xHXosbEKV2k64e2D8auNGEtdrFk2SsOU=";
+      };
+    };
 
-    nativeBuildInputs = [ rustPlatform.bindgenHook ];
     sourceRoot = "${src.name}/core";
 
     postInstall = ''
-      LIB=($out/lib/libtsc_dyn.*)
-      TSC_PATH=$out/share/emacs/site-lisp/elpa/tsc-${version}
-      install -d $TSC_PATH
-      install -m444 $out/lib/libtsc_dyn.* $TSC_PATH/''${LIB/*libtsc_/tsc-}
-      echo -n $version > $TSC_PATH/DYN-VERSION
-      rm -r $out/lib
+      pushd $out/lib
+      mv --verbose libtsc_dyn${libExt} tsc-dyn${libExt}
+      echo -n $version > DYN-VERSION
+      popd
     '';
-
-    inherit (srcMeta) cargoHash;
   };
+in melpaBuild {
+  pname = "tsc";
+  inherit (tsc-dyn) version src;
 
-in symlinkJoin {
-  name = "tsc-${version}";
-  paths = [ tsc tsc-dyn ];
+  files = ''("core/*.el" "${tsc-dyn}/lib/*")'';
+
+  ignoreCompilationError = false;
 
   passthru = {
-    updateScript = let
-      pythonEnv = python3.withPackages(ps: [ ps.requests ]);
-    in writeScript "tsc-update" ''
-      #!${runtimeShell}
-      set -euo pipefail
-      export PATH=${lib.makeBinPath [
-        nix-prefetch-github
-        nix
-        pythonEnv
-      ]}:$PATH
-      exec python3 ${builtins.toString ./update.py} ${builtins.toString ./.}
-    '';
+    inherit tsc-dyn;
+    updateScript = nix-update-script { attrPath = "emacsPackages.tsc.tsc-dyn"; };
   };
 
   meta = {

pkgs/applications/editors/emacs/elisp-packages/manual-packages/tsc/src.json

@@ -1,10 +0,0 @@
-{
-  "src": {
-    "owner": "emacs-tree-sitter",
-    "repo": "elisp-tree-sitter",
-    "rev": "909717c685ff5a2327fa2ca8fb8a25216129361c",
-    "hash": "sha256-LrakDpP3ZhRQqz47dPcyoQnu5lROdaNlxGaQfQT6u+k="
-  },
-  "version": "0.18.0",
-  "cargoHash": "sha256-IRCZqszBkGF8anF/kpcPOzHdOP4lAtJBAp6FS5tAOx8="
-}

pkgs/applications/editors/emacs/elisp-packages/manual-packages/tsc/update.py

@@ -1,123 +0,0 @@
-#!/usr/bin/env python3
-from textwrap import dedent
-from os.path import (
-    abspath,
-    dirname,
-    join,
-)
-from typing import (
-    Dict,
-    Any,
-)
-import subprocess
-import tempfile
-import json
-import sys
-import re
-
-import requests
-
-
-def eval_drv(nixpkgs: str, expr: str) -> Any:
-    expr = "\n".join(
-        (
-            "with (import %s {});" % nixpkgs,
-            expr,
-        )
-    )
-
-    with tempfile.NamedTemporaryFile(mode="w") as f:
-        f.write(dedent(expr))
-        f.flush()
-        p = subprocess.run(
-            ["nix-instantiate", "--json", f.name], stdout=subprocess.PIPE, check=True
-        )
-
-    return p.stdout.decode().strip()
-
-
-def get_src(tag_name: str) -> Dict[str, str]:
-    p = subprocess.run(
-        [
-            "nix-prefetch-github",
-            "--rev",
-            tag_name,
-            "--json",
-            "emacs-tree-sitter",
-            "elisp-tree-sitter",
-        ],
-        stdout=subprocess.PIPE,
-        check=True,
-    )
-    src = json.loads(p.stdout)
-
-    fields = ["owner", "repo", "rev", "hash"]
-
-    return {f: src[f] for f in fields}
-
-
-def get_cargo_hash(drv_path: str):
-    # Note: No check=True since we expect this command to fail
-    p = subprocess.run(["nix-store", "-r", drv_path], stderr=subprocess.PIPE)
-
-    stderr = p.stderr.decode()
-    lines = iter(stderr.split("\n"))
-
-    for l in lines:
-        if l.startswith("error: hash mismatch in fixed-output derivation"):
-            break
-    else:
-        raise ValueError("Did not find expected hash mismatch message")
-
-    for l in lines:
-        m = re.match(r"\s+got:\s+(.+)$", l)
-        if m:
-            return m.group(1)
-
-    raise ValueError("Could not extract actual hash: ", stderr)
-
-
-if __name__ == "__main__":
-    cwd = sys.argv[1]
-
-    # This should point to the root default.nix of Nixpkgs tree
-    nixpkgs = abspath(join(cwd, "../../../../../../.."))
-
-    tag_name = requests.get(
-        "https://api.github.com/repos/emacs-tree-sitter/elisp-tree-sitter/releases/latest"
-    ).json()["tag_name"]
-
-    src = get_src(tag_name)
-
-    with tempfile.NamedTemporaryFile(mode="w") as f:
-        json.dump(src, f)
-        f.flush()
-
-        drv_path = eval_drv(
-            nixpkgs,
-            """
-        rustPlatform.buildRustPackage rec {
-          pname = "tsc-dyn";
-          version = "%s";
-          nativeBuildInputs = [ clang ];
-          src = fetchFromGitHub (lib.importJSON %s);
-          sourceRoot = "${src.name}/core";
-          cargoHash = lib.fakeHash;
-        }
-        """
-            % (tag_name, f.name),
-        )
-
-    cargo_hash = get_cargo_hash(drv_path)
-
-    with open(join(cwd, "src.json"), mode="w") as f:
-        json.dump(
-            {
-                "src": src,
-                "version": tag_name,
-                "cargoHash": cargo_hash,
-            },
-            f,
-            indent=2,
-        )
-        f.write("\n")

pkgs/applications/editors/lapce/default.nix

@@ -39,28 +39,27 @@ let
 in
 rustPlatform.buildRustPackage rec {
   pname = "lapce";
-  version = "0.4.0";
+  version = "0.4.1";
 
   src = fetchFromGitHub {
     owner = "lapce";
     repo = "lapce";
     rev = "refs/tags/v${version}";
-    sha256 = "sha256-x/EObvrMZ3bkdHk5SbfQEarXA7jcQ9rEFZINQrHjcl4=";
+    sha256 = "sha256-Bwo6twEi9m3T5OybWkWGAyTRumusCWW7mkx/OAJkfXs=";
   };
 
   cargoLock = {
     lockFile = ./Cargo.lock;
     outputHashes = {
-      "floem-0.1.1" = "sha256-/RUsi0LUJ/LjDj8xjoiF+f4MeUjFASL0TDS0eDUEHio=";
+      "alacritty_terminal-0.24.1-dev" = "sha256-aVB1CNOLjNh6AtvdbomODNrk00Md8yz8QzldzvDo1LI=";
+      "floem-0.1.1" = "sha256-zV2nk3cvmw8lzqL4Xx5SCTX156tiN6sUAEdfy0dJvDY=";
       "human-sort-0.2.2" = "sha256-tebgIJGXOY7pwWRukboKAzXY47l4Cn//0xMKQTaGu8w=";
+      "locale_config-0.3.1-alpha.0" = "sha256-cCEO+dmU05TKkpH6wVK6tiH94b7k2686xyGxlhkcmAM=";
       "lsp-types-0.95.1" = "sha256-+tWqDBM5x/gvQOG7V3m2tFBZB7smgnnZHikf9ja2FfE=";
       "psp-types-0.1.0" = "sha256-/oFt/AXxCqBp21hTSYrokWsbFYTIDCrHMUBuA2Nj5UU=";
       "regalloc2-0.9.3" = "sha256-tzXFXs47LDoNBL1tSkLCqaiHDP5vZjvh250hz0pbEJs=";
-      "structdesc-0.1.0" = "sha256-gMTnRudc3Tp9JRa+Cob5Ke23aqajP8lSun5CnT13+eQ=";
+      "structdesc-0.1.0" = "sha256-KiR0R2YWZ7BucXIIeziu2FPJnbP7WNSQrxQhcNlpx2Q=";
       "tracing-0.2.0" = "sha256-31jmSvspNstOAh6VaWie+aozmGu4RpY9Gx2kbBVD+CI=";
-      "tree-sitter-bash-0.19.0" = "sha256-gTsA874qpCI/N5tmBI5eT8KDaM25gXM4VbcCbUU2EeI=";
-      "tree-sitter-md-0.1.2" = "sha256-gKbjAcY/x9sIxiG7edolAQp2JWrx78mEGeCpayxFOuE=";
-      "tree-sitter-yaml-0.0.1" = "sha256-bQ/APnFpes4hQLv37lpoADyjXDBY7J4Zg+rLyUtbra4=";
       "wasi-experimental-http-wasmtime-0.10.0" = "sha256-FuF3Ms1bT9bBasbLK+yQ2xggObm/lFDRyOvH21AZnQI=";
     };
   };

pkgs/applications/editors/vim/plugins/overrides.nix

@@ -783,7 +783,7 @@
     '';
   };
 
-  fzf-hoogle-vim = super.fzf-hoogle-vim.overrideAttrs {
+  fzf-hoogle-vim = super.fzf-hoogle-vim.overrideAttrs (oa: {
     # add this to your lua config to prevent the plugin from trying to write in the
     # nix store:
     # vim.g.hoogle_fzf_cache_file = vim.fn.stdpath('cache')..'/hoogle_cache.json'
@@ -792,7 +792,11 @@
       gawk
     ];
     dependencies = with self; [ fzf-vim ];
-  };
+    passthru = oa.passthru // {
+
+      initLua = "vim.g.hoogle_fzf_cache_file = vim.fn.stdpath('cache')..'/hoogle_cache.json";
+    };
+  });
 
   fzf-lua = super.fzf-lua.overrideAttrs {
     propagatedBuildInputs = [ fzf ];
@@ -1506,7 +1510,7 @@
     meta.homepage = "https://github.com/ackyshake/Spacegray.vim/";
   };
 
-  sqlite-lua = super.sqlite-lua.overrideAttrs {
+  sqlite-lua = super.sqlite-lua.overrideAttrs (oa: {
     postPatch =
       let
         libsqlite = "${sqlite.out}/lib/libsqlite3${stdenv.hostPlatform.extensions.sharedLibrary}";
@@ -1515,7 +1519,11 @@
         substituteInPlace lua/sqlite/defs.lua \
           --replace "path = vim.g.sqlite_clib_path" "path = vim.g.sqlite_clib_path or ${lib.escapeShellArg libsqlite}"
       '';
-  };
+
+      passthru = oa.passthru // {
+        initLua = ''vim.g.sqlite_clib_path = "${sqlite.out}/lib/libsqlite3${stdenv.hostPlatform.extensions.sharedLibrary}"'';
+      };
+  });
 
   ssr = super.ssr-nvim.overrideAttrs {
     dependencies = with self; [ nvim-treesitter ];
@@ -1699,14 +1707,19 @@
         sha256 = "16b0jzvvzarnlxdvs2izd5ia0ipbd87md143dc6lv6xpdqcs75s9";
       };
     in
-    super.unicode-vim.overrideAttrs {
+    super.unicode-vim.overrideAttrs (oa: {
       # redirect to /dev/null else changes terminal color
       buildPhase = ''
         cp "${unicode-data}" autoload/unicode/UnicodeData.txt
         echo "Building unicode cache"
         ${vim}/bin/vim --cmd ":set rtp^=$PWD" -c 'ru plugin/unicode.vim' -c 'UnicodeCache' -c ':echohl Normal' -c ':q' > /dev/null
       '';
-    };
+
+      passthru = oa.passthru // {
+
+        initLua = ''vim.g.Unicode_data_directory="${self.unicode-vim}/autoload/unicode"'';
+      };
+    });
 
   unison = super.unison.overrideAttrs {
     # Editor stuff isn't at top level

pkgs/applications/gis/qgis/unwrapped-ltr.nix

@@ -78,14 +78,14 @@ let
     urllib3
   ];
 in mkDerivation rec {
-  version = "3.34.9";
+  version = "3.34.10";
   pname = "qgis-ltr-unwrapped";
 
   src = fetchFromGitHub {
     owner = "qgis";
     repo = "QGIS";
     rev = "final-${lib.replaceStrings [ "." ] [ "_" ] version}";
-    hash = "sha256-4ZgCvg3VSa1LJQ8yr45nY4ZI7tyVVdW7WPK/jwBI+HU=";
+    hash = "sha256-E2Ak14h1kWdGq+JNbCeh5YJkr/S9g/0HD834MtgACSA=";
   };
 
   passthru = {

pkgs/applications/gis/qgis/unwrapped.nix

@@ -79,14 +79,14 @@ let
     urllib3
   ];
 in mkDerivation rec {
-  version = "3.38.1";
+  version = "3.38.2";
   pname = "qgis-unwrapped";
 
   src = fetchFromGitHub {
     owner = "qgis";
     repo = "QGIS";
     rev = "final-${lib.replaceStrings [ "." ] [ "_" ] version}";
-    hash = "sha256-8fwLn77CK8w4srJNUilfJumDt2wCcQLs9D5/4tzpzPA=";
+    hash = "sha256-lArwRtHR/KAsgjpjid6YnPA9BkcG1Mg/KeIIOWN75Kg=";
   };
 
   passthru = {

pkgs/applications/misc/xmrig/moneroocean.nix

@@ -5,13 +5,13 @@
 
 xmrig.overrideAttrs (oldAttrs: rec {
   pname = "xmrig-mo";
-  version = "6.22.0-mo1";
+  version = "6.22.0-mo3";
 
   src = fetchFromGitHub {
     owner = "MoneroOcean";
     repo = "xmrig";
     rev = "v${version}";
-    hash = "sha256-sojzyMC4+x6SyhcaWNzS+IFpqobrzpQB6Kwc2ybO5Dk=";
+    hash = "sha256-3KFyCs9Kf0i7IkG1piP/DRj1jTj1VmXbAk/U3Wt4jh0=";
   };
 
   meta = with lib; {

pkgs/applications/networking/instant-messengers/element/element-web.nix

@@ -67,7 +67,7 @@ stdenv.mkDerivation (finalAttrs: builtins.removeAttrs pinData [ "hashes" ] // {
     runHook preInstall
 
     cp -R webapp $out
-    cp ${jitsi-meet}/libs/external_api.min.js $out/jitsi_external_api.min.js
+    tar --extract --to-stdout --file ${jitsi-meet.src} jitsi-meet/libs/external_api.min.js > $out/jitsi_external_api.min.js
     echo "${finalAttrs.version}" > "$out/version"
     jq -s '.[0] * $conf' "config.sample.json" --argjson "conf" '${builtins.toJSON noPhoningHome}' > "$out/config.json"
 

pkgs/applications/networking/instant-messengers/jackline/default.nix

@@ -23,6 +23,7 @@ buildDunePackage rec {
   buildInputs = [
     erm_xmpp
     tls
+    tls-lwt
     mirage-crypto-pk
     x509
     domain-name

pkgs/applications/networking/instant-messengers/pidgin/pidgin-plugins/purple-hangouts/default.nix

@@ -20,6 +20,6 @@ stdenv.mkDerivation {
     description = "Native Hangouts support for pidgin";
     license = licenses.gpl3;
     platforms = platforms.linux;
-    maintainers = with maintainers; [ ralith ];
+    maintainers = [ ];
   };
 }

pkgs/applications/networking/instant-messengers/wire-desktop/default.nix

@@ -136,6 +136,10 @@ let
       libdbusmenu
     ];
 
+    preFixup = ''
+      gappsWrapperArgs+=(--add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--ozone-platform-hint=auto --ozone-platform=wayland --enable-features=WaylandWindowDecorations}}")
+    '';
+
     postFixup = ''
       makeWrapper $out/opt/Wire/wire-desktop $out/bin/wire-desktop \
         "''${gappsWrapperArgs[@]}"

pkgs/applications/office/paperless-ngx/default.nix

@@ -21,6 +21,7 @@
 , pango
 , pkg-config
 , nltk-data
+, xorg
 }:
 
 let
@@ -121,6 +122,7 @@ python.pkgs.buildPythonApplication rec {
 
   nativeBuildInputs = [
     gettext
+    xorg.lndir
   ];
 
   propagatedBuildInputs = with python.pkgs; [
@@ -194,9 +196,9 @@ python.pkgs.buildPythonApplication rec {
   in ''
     runHook preInstall
 
-    mkdir -p $out/lib/paperless-ngx
+    mkdir -p $out/lib/paperless-ngx/static/frontend
     cp -r {src,static,LICENSE,gunicorn.conf.py} $out/lib/paperless-ngx
-    ln -s ${frontend}/lib/paperless-ui/frontend $out/lib/paperless-ngx/static/
+    lndir -silent ${frontend}/lib/paperless-ui/frontend $out/lib/paperless-ngx/static/frontend
     chmod +x $out/lib/paperless-ngx/src/manage.py
     makeWrapper $out/lib/paperless-ngx/src/manage.py $out/bin/paperless-ngx \
       --prefix PYTHONPATH : "${pythonPath}" \

pkgs/applications/science/misc/simgrid/default.nix

@@ -12,10 +12,6 @@
 , withoutBin ? false
 }:
 
-let
-  optionOnOff = option: if option then "on" else "off";
-in
-
 stdenv.mkDerivation rec {
   pname = "simgrid";
   version = "3.35";
@@ -42,31 +38,32 @@ stdenv.mkDerivation rec {
 
   # "Release" does not work. non-debug mode is Debug compiled with optimization
   cmakeBuildType = "Debug";
-  cmakeFlags = [
-    "-Denable_documentation=${optionOnOff buildDocumentation}"
-    "-Denable_java=${optionOnOff buildJavaBindings}"
-    "-Denable_python=${optionOnOff buildPythonBindings}"
-    "-DSIMGRID_PYTHON_LIBDIR=./" # prevents CMake to install in ${python3} dir
-    "-Denable_msg=${optionOnOff buildJavaBindings}"
-    "-Denable_fortran=${optionOnOff fortranSupport}"
-    "-Denable_model-checking=${optionOnOff modelCheckingSupport}"
-    "-Denable_ns3=off"
-    "-Denable_lua=off"
-    "-Denable_lib_in_jar=off"
-    "-Denable_maintainer_mode=off"
-    "-Denable_mallocators=on"
-    "-Denable_debug=on"
-    "-Denable_smpi=on"
-    "-Dminimal-bindings=${optionOnOff minimalBindings}"
-    "-Denable_smpi_ISP_testsuite=${optionOnOff moreTests}"
-    "-Denable_smpi_MPICH3_testsuite=${optionOnOff moreTests}"
-    "-Denable_compile_warnings=off"
-    "-Denable_compile_optimizations=${optionOnOff optimize}"
-    "-Denable_lto=${optionOnOff optimize}"
 
+  cmakeFlags = [
+    (lib.cmakeBool "enable_documentation" buildDocumentation)
+    (lib.cmakeBool "enable_java" buildJavaBindings)
+    (lib.cmakeBool "enable_python" buildPythonBindings)
+    (lib.cmakeFeature "SIMGRID_PYTHON_LIBDIR" "./") # prevents CMake to install in ${python3} dir
+    (lib.cmakeBool "enable_msg" buildJavaBindings)
+    (lib.cmakeBool "enable_fortran" fortranSupport)
+    (lib.cmakeBool "enable_model-checking" modelCheckingSupport)
+    (lib.cmakeBool "enable_ns3" false)
+    (lib.cmakeBool "enable_lua" false)
+    (lib.cmakeBool "enable_lib_in_jar" false)
+    (lib.cmakeBool "enable_maintainer_mode" false)
+    (lib.cmakeBool "enable_mallocators" true)
+    (lib.cmakeBool "enable_debug" true)
+    (lib.cmakeBool "enable_smpi" true)
+    (lib.cmakeBool "minimal-bindings" minimalBindings)
+    (lib.cmakeBool "enable_smpi_ISP_testsuite" moreTests)
+    (lib.cmakeBool "enable_smpi_MPICH3_testsuite" moreTests)
+    (lib.cmakeBool "enable_compile_warnings" false)
+    (lib.cmakeBool "enable_compile_optimizations" optimize)
+    (lib.cmakeBool "enable_lto" optimize)
     # RPATH of binary /nix/store/.../bin/... contains a forbidden reference to /build/
-    "-DCMAKE_SKIP_BUILD_RPATH=ON"
+    (lib.cmakeBool "CMAKE_SKIP_BUILD_RPATH" optimize)
   ];
+
   makeFlags = lib.optional debug "VERBOSE=1";
 
   # needed to run tests and to ensure correct shabangs in output scripts

pkgs/applications/system/coolercontrol/coolercontrol-gui.nix

@@ -4,10 +4,10 @@
 , dbus
 , freetype
 , gtk3
-, libsoup
+, libsoup_3
 , openssl
 , pkg-config
-, webkitgtk
+, webkitgtk_4_1
 , libappindicator
 , makeWrapper
 , coolercontrol
@@ -23,12 +23,7 @@ rustPlatform.buildRustPackage {
   inherit version src;
   sourceRoot = "${src.name}/coolercontrol-ui/src-tauri";
 
-  cargoLock = {
-    lockFile = ./Cargo.lock;
-    outputHashes = {
-      "tauri-plugin-localhost-0.1.0" = "sha256-Mf2/cnKotd751ZcSHfiSLNe2nxBfo4dMBdoCwQhe7yI=";
-    };
-  };
+  cargoHash = "sha256-0Ud5S4T5+5eBuvD5N64NAvbK0+tTozKsPhsNziCEu3I=";
 
   buildFeatures = [ "custom-protocol" ];
 
@@ -41,9 +36,9 @@ rustPlatform.buildRustPackage {
     dbus
     openssl
     freetype
-    libsoup
+    libsoup_3
     gtk3
-    webkitgtk
+    webkitgtk_4_1
     libappindicator
   ];
 
@@ -54,7 +49,7 @@ rustPlatform.buildRustPackage {
   postPatch = ''
     mkdir -p ui-build
     cp -R ${coolercontrol.coolercontrol-ui-data}/* ui-build/
-    substituteInPlace tauri.conf.json --replace '"distDir": "../dist"' '"distDir": "ui-build"'
+    substituteInPlace tauri.conf.json --replace '"frontendDist": "../dist"' '"frontendDist": "ui-build"'
   '';
 
   postInstall = ''

pkgs/applications/system/coolercontrol/coolercontrol-ui-data.nix

@@ -11,7 +11,7 @@ buildNpmPackage {
   inherit version src;
   sourceRoot = "${src.name}/coolercontrol-ui";
 
-  npmDepsHash = "sha256-gnJvNQCbqFfPfsqi008HW4kBTpxiVpN7eHyn9bU6if8=";
+  npmDepsHash = "sha256-PpX9lk+yEG1auvBv5JBdMh7rjWoM0oTYJx6Nme5ij8s=";
 
   postBuild = ''
     cp -r dist $out

pkgs/applications/system/coolercontrol/coolercontrold.nix

@@ -1,6 +1,7 @@
 { rustPlatform
 , buildNpmPackage
 , testers
+, libdrm
 , coolercontrol
 , runtimeShell
 }:
@@ -15,7 +16,16 @@ rustPlatform.buildRustPackage {
   inherit version src;
   sourceRoot = "${src.name}/coolercontrold";
 
-  cargoHash = "sha256-CuA8r54O33csmSY67/AOlQQqUniAWkgWSewIBdeq7X4=";
+  cargoLock = {
+    lockFile = ./Cargo.lock;
+    outputHashes = {
+      "nvml-wrapper-0.10.0" = "sha256-pMiULWT+nJXcDfLDeACG/DaPF5+AbzpoIUWWWz8mQ+0=";
+    };
+  };
+
+  buildInputs = [
+    libdrm
+  ];
 
   postPatch = ''
     # copy the frontend static resources to a directory for embedding

pkgs/applications/system/coolercontrol/default.nix

@@ -4,13 +4,13 @@
 }:
 
 let
-  version = "1.3.0";
+  version = "1.4.0";
 
   src = fetchFromGitLab {
     owner = "coolercontrol";
     repo = "coolercontrol";
     rev = version;
-    hash = "sha256-0NYDPJNX0kWIBHv+b4GuK6efgHCBNDu3rBXaQ/iSxFk=";
+    hash = "sha256-jsgso9MHt5Szzp9YkuXz8qysdN0li/zD2R/vSZ2Lw5M=";
   };
 
   meta = with lib; {

pkgs/applications/version-management/git-radar/default.nix

@@ -1,4 +1,4 @@
-{lib, stdenv, fetchFromGitHub}:
+{ coreutils-prefixed, lib, makeWrapper, stdenv, fetchFromGitHub }:
 
 stdenv.mkDerivation rec {
   pname = "git-radar";
@@ -11,12 +11,17 @@ stdenv.mkDerivation rec {
     sha256 = "0c3zp8s4w7m4s71qgwk1jyfc8yzw34f2hi43x1w437ypgabwg81j";
   };
 
+  nativeBuildInputs = [ makeWrapper ];
+
   dontBuild = true;
 
   installPhase = ''
     mkdir -p $out/bin
     cp git-radar fetch.sh prompt.bash prompt.zsh radar-base.sh $out
     ln -s $out/git-radar $out/bin
+    ${lib.optionalString stdenv.isDarwin ''
+      wrapProgram $out/git-radar --prefix PATH : ${lib.makeBinPath [ coreutils-prefixed ]}
+    ''}
   '';
 
   meta = with lib; {

pkgs/applications/video/ccextractor/default.nix

@@ -1,71 +0,0 @@
-{ lib
-, stdenv
-, fetchFromGitHub
-, pkg-config
-, cmake
-, libiconv
-, zlib
-, enableOcr ? true
-, makeWrapper
-, tesseract4
-, leptonica
-, ffmpeg_4
-}:
-
-stdenv.mkDerivation rec {
-  pname = "ccextractor";
-  version = "0.93";
-
-  src = fetchFromGitHub {
-    owner = "CCExtractor";
-    repo = pname;
-    rev = "v${version}";
-    sha256 = "sha256-usVAKBkdd8uz9cD5eLd0hnwGonOJLscRdc+iWDlNXVc=";
-  };
-
-  postPatch = ''
-    # https://github.com/CCExtractor/ccextractor/issues/1467
-    sed -i '/allheaders.h/a#include <leptonica/pix_internal.h>' src/lib_ccx/ocr.c
-  '' + lib.optionalString stdenv.isDarwin ''
-    substituteInPlace src/CMakeLists.txt \
-    --replace 'add_definitions(-DGPAC_CONFIG_LINUX)' 'add_definitions(-DGPAC_CONFIG_DARWIN)'
-  '';
-
-  cmakeDir = "../src";
-
-  nativeBuildInputs = [ pkg-config cmake makeWrapper ];
-
-  buildInputs = [ zlib ]
-    ++ lib.optional (!stdenv.isLinux) libiconv
-    ++ lib.optionals enableOcr [ leptonica tesseract4 ffmpeg_4 ];
-
-  cmakeFlags = [
-    # file RPATH_CHANGE could not write new RPATH:
-    "-DCMAKE_SKIP_BUILD_RPATH=ON"
-  ] ++ lib.optionals enableOcr [ "-DWITH_OCR=on" "-DWITH_HARDSUBX=on" ];
-
-  postInstall = lib.optionalString enableOcr ''
-    wrapProgram "$out/bin/ccextractor" \
-      --set TESSDATA_PREFIX "${tesseract4}/share/"
-  '';
-
-  meta = with lib; {
-    homepage = "https://www.ccextractor.org";
-    description = "Tool that produces subtitles from closed caption data in videos";
-    longDescription = ''
-      A tool that analyzes video files and produces independent subtitle files from
-      closed captions data. CCExtractor is portable, small, and very fast.
-      It works on Linux, Windows, and OSX.
-    '';
-    platforms = platforms.unix;
-    # undefined reference to `png_do_expand_palette_rgba8_neon'
-    # undefined reference to `png_riffle_palette_neon'
-    # undefined reference to `png_do_expand_palette_rgb8_neon'
-    # undefined reference to `png_init_filter_functions_neon'
-    # during Linking C executable ccextractor
-    broken = stdenv.isAarch64;
-    license = licenses.gpl2Only;
-    maintainers = [ ];
-    mainProgram = "ccextractor";
-  };
-}

pkgs/applications/virtualization/pods/default.nix

@@ -19,26 +19,19 @@
 
 stdenv.mkDerivation rec {
   pname = "pods";
-  version = "2.0.0";
+  version = "2.0.1-unstable-2024-08-11";
 
   src = fetchFromGitHub {
     owner = "marhkb";
     repo = pname;
-    rev = "v${version}";
-    sha256 = "sha256-jSN4WmyzYARhDkwAtTYD4iXNTM1QQbAAwQ/ICHg7k3k=";
+    rev = "146a85b4860375ac0a5be8d7be57fb12753a3c42";
+    sha256 = "sha256-KaS38XC+V3jRPPTnI4UqMc9KGAC7INHMu47LVo9YP44=";
   };
 
   cargoDeps = rustPlatform.importCargoLock {
     lockFile = ./Cargo.lock;
     outputHashes = {
-      "ashpd-0.6.0" = "sha256-kLacOwMZ4MQlFYCx5J4kI4J+a9fVRF5Ii/AkWOL/TNQ=";
-      "cairo-rs-0.19.0" = "sha256-8s+ngacR7d2wb1FKYf0pycxMQbgW63zMKpMgaUs2e+c=";
-      "gdk4-0.8.0" = "sha256-o9HC4VX6ntPk0JXAX5Whhu0qlUdpPky/1PNrRd9zjdk=";
-      "libadwaita-0.6.0" = "sha256-3Kge7SIE+vex/uOIt7hjmU68jidkBjrW96o24hu3e/U=";
-      "libpanel-0.3.0" = "sha256-LA8ynd+7imEdQwvLslmKw+pPNbAEle9fZ2sFuyRY/jU=";
       "podman-api-0.10.0" = "sha256-nbxK/U5G+PlbytpHdr63x/C69hBgedPXBFfgdzT9fdc=";
-      "sourceview5-0.8.0" = "sha256-+f+mm682H4eRC7Xzx5wukecDZq+hMpJQ3+3xHzG00Go=";
-      "vte4-0.8.0" = "sha256-KZBpfSAngbp5czAXdKA7Au5uYqs2L5MyNsnXcBH77lo=";
     };
   };
 

pkgs/build-support/compress-drv/default.nix

@@ -9,6 +9,12 @@
 
   : List of file extensions to compress. Example: `["txt" "svg" "xml"]`.
 
+  `extraFindOperands` (String)
+
+  : Extra command line parameters to pass to the find command.
+    This can be used to exclude certain files.
+    For example: `-not -iregex ".*(\/apps\/.*\/l10n\/).*"`
+
   `compressors` ( { ${fileExtension} :: String })
 
   : Map a desired extension (e.g. `gz`) to a compress program.
@@ -47,7 +53,11 @@
   :::
 */
 drv:
-{ formats, compressors }:
+{
+  formats,
+  compressors,
+  extraFindOperands ? "",
+}:
 let
   validProg =
     ext: prog:
@@ -61,18 +71,22 @@ let
     ext: prog:
     assert validProg ext prog;
     ''
-      find -L $out -type f -regextype posix-extended -iregex '.*\.(${formatsPipe})' -print0 \
+      find -L $out -type f -regextype posix-extended -iregex '.*\.(${formatsPipe})' ${extraFindOperands} -print0 \
         | xargs -0 -P$NIX_BUILD_CORES -I{} ${prog}
     '';
-  formatsPipe = builtins.concatStringsSep "|" formats;
+  formatsPipe = lib.concatStringsSep "|" formats;
 in
-runCommand "${drv.name}-compressed" { } ''
-  mkdir $out
+runCommand "${drv.name}-compressed"
+  (
+    (lib.optionalAttrs (drv ? pname) { inherit (drv) pname; })
+    // (lib.optionalAttrs (drv ? version) { inherit (drv) version; })
+  )
+  ''
+    mkdir $out
 
-  # cannot use lndir here, because it also symlinks directories,
-  # which we do not need; we only need to symlink files.
-  (cd ${drv}; find -L -type d -exec mkdir -p $out/{} ';')
-  (cd ${drv}; find -L -type f -exec ln -s ${drv}/{} $out/{} ';')
+    # cannot use lndir here, because it stop recursing at symlinks that point to directories
+    (cd ${drv}; find -L -type d -exec mkdir -p $out/{} ';')
+    (cd ${drv}; find -L -type f -exec ln -s ${drv}/{} $out/{} ';')
 
-  ${lib.concatStringsSep "\n\n" (lib.mapAttrsToList mkCmd compressors)}
-''
+    ${lib.concatStringsSep "\n\n" (lib.mapAttrsToList mkCmd compressors)}
+  ''

pkgs/build-support/compress-drv/web.nix

@@ -1,7 +1,9 @@
 {
-  zopfli,
   brotli,
   compressDrv,
+  lib,
+  zopfli,
+  zstd,
 }:
 /**
   compressDrvWeb compresses a derivation for common web server use.
@@ -17,6 +19,10 @@
 
     Defaults to common formats that compress well.
 
+  `extraFindOperands` (String)
+
+  : See compressDrv for details.
+
   `extraFormats` ([ String ])
 
   : Extra extensions to compress in addition to `formats`.
@@ -108,24 +114,32 @@ drv:
 {
   formats ? [
     "css"
+    "eot"
+    "htm"
+    "html"
     "js"
+    "json"
+    "map"
+    "otf"
     "svg"
     "ttf"
-    "eot"
     "txt"
-    "xml"
-    "map"
-    "html"
-    "json"
     "webmanifest"
+    "xml"
   ],
   extraFormats ? [ ],
   compressors ? {
-    "gz" = "${zopfli}/bin/zopfli --keep {}";
-    "br" = "${brotli}/bin/brotli --keep --no-copy-stat {}";
+    br = "${lib.getExe brotli} --keep --no-copy-stat {}";
+    gz = "${lib.getExe zopfli} --keep {}";
+    # --force is required to not fail on symlinks
+    # for details on the compression level see
+    # https://github.com/NixOS/nixpkgs/pull/332752#issuecomment-2275110390
+    zstd = "${lib.getExe zstd} --force --keep --quiet -19 {}";
   },
+  extraFindOperands ? "",
 }:
 compressDrv drv {
   formats = formats ++ extraFormats;
   compressors = compressors;
+  inherit extraFindOperands;
 }

pkgs/build-support/make-startupitem/default.nix

@@ -29,7 +29,7 @@ stdenv.mkDerivation {
     target=${name}.desktop
     cp ${package}/share/applications/${srcPrefix}${name}.desktop $target
     ${lib.optionalString (prependExtraArgs != [] || appendExtraArgs != []) ''
-      sed -i -r "s/(Exec=)([^ ]*) (.*)/\1\2 ${prependArgs}\3${appendArgs}/" $target
+      sed -i -r "s/(Exec=)([^ \n]*) *(.*)/\1\2 ${prependArgs}\3${appendArgs}/" $target
     ''}
     chmod +rw $target
     echo "X-KDE-autostart-phase=${phase}" >> $target

pkgs/build-support/trivial-builders/default.nix

@@ -36,17 +36,8 @@ rec {
   # `runCommandCCLocal` left out on purpose.
   # We shouldn’t force the user to have a cc in scope.
 
-  # TODO: Move documentation for runCommandWith to the Nixpkgs manual
-  /*
-    Generalized version of the `runCommand`-variants
-    which does customized behavior via a single
-    attribute set passed as the first argument
-    instead of having a lot of variants like
-    `runCommand*`. Additionally it allows changing
-    the used `stdenv` freely and has a more explicit
-    approach to changing the arguments passed to
-    `stdenv.mkDerivation`.
-   */
+  # Docs in doc/build-helpers/trivial-build-helpers.chapter.md
+  # See https://nixos.org/manual/nixpkgs/unstable/#trivial-builder-runCommandWith
   runCommandWith =
     let
       # prevent infinite recursion for the default stdenv value

pkgs/by-name/am/amd-ucodegen/package.nix

@@ -0,0 +1,60 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  fetchpatch,
+  nix-update-script,
+  callPackage,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "amd-ucodegen";
+  version = "0-unstable-2017-06-07";
+
+  src = fetchFromGitHub {
+    owner = "AndyLavr";
+    repo = "amd-ucodegen";
+    rev = "0d34b54e396ef300d0364817e763d2c7d1ffff02";
+    hash = "sha256-pgmxzd8tLqdQ8Kmmhl05C5tMlCByosSrwx2QpBu3UB0=";
+  };
+
+  strictDeps = true;
+
+  patches = [
+    # Extract get_family function and validate processor family
+    # instead of processor ID
+    (fetchpatch {
+      name = "validate-family-not-id.patch";
+      url = "https://github.com/AndyLavr/amd-ucodegen/compare/0d34b54e396ef300d0364817e763d2c7d1ffff02...dobo90:amd-ucodegen:7a3c51e821df96910ecb05b22f3e4866b4fb85b2.patch";
+      hash = "sha256-jvsvu9QgXikwsxjPiTaRff+cOg/YQmKg1MYKyBoMRQI=";
+    })
+  ];
+
+  installPhase = ''
+    runHook preInstall
+
+    install -Dm755 amd-ucodegen $out/bin/amd-ucodegen
+
+    runHook postInstall
+  '';
+
+  passthru = {
+    updateScript = nix-update-script { extraArgs = [ "--version=branch" ]; };
+    tests.platomav = callPackage ./test-platomav.nix { amd-ucodegen = finalAttrs.finalPackage; };
+  };
+
+  meta = {
+    description = "Tool to generate AMD microcode files";
+    longDescription = ''
+      This tool can be used to generate AMD microcode containers as used by the
+      Linux kernel. It accepts raw AMD microcode files such as those generated
+      by [MCExtractor](https://github.com/platomav/MCExtractor.git) as input.
+      The generated output file can be installed in /lib/firmware/amd-ucode.
+    '';
+    homepage = "https://github.com/AndyLavr/amd-ucodegen";
+    license = lib.licenses.gpl2Only;
+    platforms = lib.platforms.unix;
+    mainProgram = "amd-ucodegen";
+    maintainers = with lib.maintainers; [ d-brasher ];
+  };
+})

pkgs/by-name/am/amd-ucodegen/test-platomav.nix

@@ -0,0 +1,40 @@
+{
+  stdenvNoCC,
+  fetchFromGitHub,
+  amd-ucodegen,
+}:
+
+stdenvNoCC.mkDerivation {
+  name = "amd-ucodegen-test-platomav";
+  meta.timeout = 60;
+
+  # Repository of dumped CPU microcodes
+  src = fetchFromGitHub {
+    owner = "platomav";
+    repo = "CPUMicrocodes";
+    rev = "dfc37d654cbe294acb0ec0274763321507dd7838";
+    hash = "sha256-Va+ErKID5iyKEee61tlrZwSpujxwMYPC+MAgZKUkrrM=";
+  };
+
+  nativeBuildInputs = [ amd-ucodegen ];
+  buildPhase = ''
+    runHook preBuild
+
+    echo -n "Test normal behavior with single input... "
+    [ "$(amd-ucodegen AMD/cpu00B40F40_ver0B40401A_2024-06-14_544DFCB8.bin)" \
+      == "CPU type 0xb40f40 [0xb440], file AMD/cpu00B40F40_ver0B40401A_2024-06-14_544DFCB8.bin" ]
+    echo "OK"
+    echo -n "Check output hash... "
+    [ "$(sha256sum microcode_amd_fam1ah.bin)" \
+      == "17f25ec78fa677803684e77ce01a21344b4b33463a964f61bae51b173543b190  microcode_amd_fam1ah.bin" ]
+    echo "OK"
+    echo -n "Ensure fail when bad processor ID... "
+    [ "$(amd-ucodegen AMD/cpu00000F00_ver02000008_2007-06-14_C3A923BB.bin 2>&1)" \
+      == "Bad processor ID 0x0n" ]
+    echo "OK"
+
+    touch $out
+
+    runHook postBuild
+  '';
+}

pkgs/by-name/am/amdvlk/package.nix

@@ -1,78 +1,89 @@
-{ stdenv
-, callPackage
-, lib
-, fetchRepoProject
-, writeScript
-, cmake
-, directx-shader-compiler
-, glslang
-, ninja
-, patchelf
-, perl
-, pkg-config
-, python3
-, expat
-, libdrm
-, ncurses
-, openssl
-, wayland
-, xorg
-, zlib
+{
+  stdenv,
+  callPackage,
+  lib,
+  fetchRepoProject,
+  writeScript,
+  cmake,
+  directx-shader-compiler,
+  glslang,
+  ninja,
+  patchelf,
+  perl,
+  pkg-config,
+  python3,
+  expat,
+  libdrm,
+  ncurses,
+  openssl,
+  wayland,
+  xorg,
+  zlib,
 }:
 let
 
   suffix = if stdenv.system == "x86_64-linux" then "64" else "32";
 
-in stdenv.mkDerivation rec {
+in
+stdenv.mkDerivation (finalAttrs: {
   pname = "amdvlk";
   version = "2024.Q3.1";
 
   src = fetchRepoProject {
-    name = "${pname}-src";
+    name = "amdvlk-src";
     manifest = "https://github.com/GPUOpen-Drivers/AMDVLK.git";
-    rev = "refs/tags/v-${version}";
+    rev = "refs/tags/v-${finalAttrs.version}";
     sha256 = "IZYv9ZfpIllYUhJ3f7AOFmSl7OfWWY8doaG8pe3GE+4=";
   };
 
-  buildInputs = [
-    expat
-    libdrm
-    ncurses
-    openssl
-    wayland
-    xorg.libX11
-    xorg.libxcb
-    xorg.xcbproto
-    xorg.libXext
-    xorg.libXrandr
-    xorg.libXft
-    xorg.libxshmfence
-    zlib
-  ];
+  buildInputs =
+    [
+      expat
+      libdrm
+      ncurses
+      openssl
+      wayland
+      zlib
+    ]
+    ++ (with xorg; [
+      libX11
+      libxcb
+      xcbproto
+      libXext
+      libXrandr
+      libXft
+      libxshmfence
+    ]);
 
-  nativeBuildInputs = [
-    cmake
-    directx-shader-compiler
-    glslang
-    ninja
-    patchelf
-    perl
-    pkg-config
-    python3
-  ] ++ (with python3.pkgs; [
-    jinja2
-    ruamel-yaml
-  ]);
+  nativeBuildInputs =
+    [
+      cmake
+      directx-shader-compiler
+      glslang
+      ninja
+      patchelf
+      perl
+      pkg-config
+      python3
+    ]
+    ++ (with python3.pkgs; [
+      jinja2
+      ruamel-yaml
+    ]);
 
-  rpath = lib.makeLibraryPath [
-    libdrm
-    openssl
-    stdenv.cc.cc.lib
-    xorg.libX11
-    xorg.libxcb
-    xorg.libxshmfence
-    zlib
-  ];
+  rpath = lib.makeLibraryPath (
+    [
+      libdrm
+      openssl
+      stdenv.cc.cc.lib
+      zlib
+    ]
+    ++ (with xorg; [
+      libX11
+      libxcb
+      libxshmfence
+    ])
+  );
 
   cmakeDir = "../drivers/xgl";
 
@@ -95,26 +106,33 @@ in stdenv.mkDerivation rec {
     #!/usr/bin/env nix-shell
     #!nix-shell -i bash -p coreutils curl gnused jq common-updater-scripts
 
+    packagePath="pkgs/by-name/am/amdvlk/package.nix"
+
     function setHash() {
-      sed -i "pkgs/development/libraries/amdvlk/default.nix" -e 's,sha256 = "[^'"'"'"]*",sha256 = "'"$1"'",'
+      sed -i $packagePath -e 's,sha256 = "[^'"'"'"]*",sha256 = "'"$1"'",'
     }
 
     version="$(curl -sL "https://api.github.com/repos/GPUOpen-Drivers/AMDVLK/releases?per_page=1" | jq '.[0].tag_name | split("-") | .[1]' --raw-output)"
-    sed -i "pkgs/development/libraries/amdvlk/default.nix" -e 's/version = "[^'"'"'"]*"/version = "'"$version"'"/'
+    sed -i $packagePath -e 's/version = "[^'"'"'"]*"/version = "'"$version"'"/'
 
     setHash "$(nix-instantiate --eval -A lib.fakeSha256 | xargs echo)"
     hash="$(nix to-base64 $(nix-build -A amdvlk 2>&1 | tail -n3 | grep 'got:' | cut -d: -f2- | xargs echo || true))"
     setHash "$hash"
   '';
 
-  passthru.impureTests = { amdvlk = callPackage ./test.nix {}; };
+  passthru.impureTests = {
+    amdvlk = callPackage ./test.nix { };
+  };
 
-  meta = with lib; {
+  meta = {
     description = "AMD Open Source Driver For Vulkan";
     homepage = "https://github.com/GPUOpen-Drivers/AMDVLK";
-    changelog = "https://github.com/GPUOpen-Drivers/AMDVLK/releases/tag/v-${version}";
-    license = licenses.mit;
-    platforms = [ "x86_64-linux" "i686-linux" ];
-    maintainers = with maintainers; [ Flakebi ];
+    changelog = "https://github.com/GPUOpen-Drivers/AMDVLK/releases/tag/v-${finalAttrs.version}";
+    license = lib.licenses.mit;
+    platforms = [
+      "x86_64-linux"
+      "i686-linux"
+    ];
+    maintainers = with lib.maintainers; [ Flakebi ];
   };
-}
+})

pkgs/by-name/an/antimatter-dimensions/package.nix

@@ -18,12 +18,12 @@ let
 in
 buildNpmPackage rec {
   pname = "antimatter-dimensions";
-  version = "0-unstable-2024-06-28";
+  version = "0-unstable-2024-08-12";
   src = fetchFromGitHub {
     owner = "IvarK";
     repo = "AntimatterDimensionsSourceCode";
-    rev = "aeaa7a358f605073172ec9eaa28ff6544edca5a5";
-    hash = "sha256-rXFXoSOtYeLIBQzJ/J+FMSp9CKHOCzq3HxQMd2Bpm3E=";
+    rev = "af840eef45bb2120bff4dcebb9b11c181067f9a8";
+    hash = "sha256-qlgu/Sw3LMn/ZSXJFi0DW6vYAZyF2D3cCpKmXhID3s4=";
   };
   nativeBuildInputs = [
     copyDesktopItems

pkgs/by-name/az/azure-cli/extensions-manual.nix

@@ -60,6 +60,16 @@
     meta.maintainers = with lib.maintainers; [ obreitwi ];
   };
 
+  storage-preview = mkAzExtension rec {
+    pname = "storage-preview";
+    version = "1.0.0b2";
+    url = "https://azcliprod.blob.core.windows.net/cli-extensions/storage_preview-${version}-py2.py3-none-any.whl";
+    sha256 = "2de8fa421622928a308bb70048c3fdf40400bad3b34afd601d0b3afcd8b82764";
+    description = "Provides a preview for upcoming storage features";
+    propagatedBuildInputs = with python3Packages; [ azure-core ];
+    meta.maintainers = with lib.maintainers; [ katexochen ];
+  };
+
   # Removed extensions
   blockchain = throw "The 'blockchain' extension for azure-cli was deprecated upstream"; # Added 2024-04-26
   vm-repair = throw "The 'vm-repair' extension for azure-cli was deprecated upstream"; # Added 2024-08-06

pkgs/by-name/be/beidconnect/package.nix

@@ -0,0 +1,86 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  pcsclite,
+  boost,
+  pkg-config,
+  testers,
+  beidconnect,
+}:
+stdenv.mkDerivation (finalAttrs: {
+  pname = "beidconnect";
+  version = "2.10";
+
+  src = fetchFromGitHub {
+    owner = "Fedict";
+    repo = "fts-beidconnect";
+    rev = finalAttrs.version;
+    hash = "sha256-xkBldXOlgLMgrvzm7ajXzJ92mpXrxHD1RX4DeBxU3kk=";
+  };
+
+  nativeBuildInputs = [ pkg-config ];
+
+  buildInputs = [
+    pcsclite.dev
+    boost
+  ];
+
+  strictDeps = true;
+
+  postPatch = ''
+    substituteInPlace Makefile \
+      --replace-fail '$(DESTDIR)/usr/bin' '$(DESTDIR)/bin'
+  '';
+
+  makeFlags = [ "DESTDIR=$(out)" ];
+  sourceRoot = "${finalAttrs.src.name}/linux";
+
+  postInstall = ''
+    install -d \
+      $out/etc/chromium/native-messaging-hosts \
+      $out/etc/opt/chrome/native-messaging-hosts/ \
+      $out/etc/opt/edge/native-messaging-hosts/ \
+      $out/etc/opt/vivaldi/native-messaging-hosts/ \
+      $out/etc/opt/brave/native-messaging-hosts/ \
+      $out/lib/mozilla/native-messaging-hosts \
+
+    $out/bin/beidconnect -setup $out/bin \
+      $out/etc/chromium/native-messaging-hosts \
+      $out/lib/mozilla/native-messaging-hosts
+
+    # Chrome
+    install $out/etc/chromium/native-messaging-hosts/be.bosa.beidconnect.json $out/etc/opt/chrome/native-messaging-hosts/
+
+    # Edge
+    install $out/etc/chromium/native-messaging-hosts/be.bosa.beidconnect.json $out/etc/opt/edge/native-messaging-hosts/
+
+    # Vivaldi
+    install $out/etc/chromium/native-messaging-hosts/be.bosa.beidconnect.json $out/etc/opt/vivaldi/native-messaging-hosts/
+
+    # Brave
+    install $out/etc/chromium/native-messaging-hosts/be.bosa.beidconnect.json $out/etc/opt/brave/native-messaging-hosts/
+  '';
+
+  passthru.tests.version = testers.testVersion {
+    package = beidconnect;
+    command = "${beidconnect}/bin/beidconnect -version";
+  };
+
+  meta = {
+    description = "BeIDConnect native messaging component";
+    longDescription = ''
+      The beidconnect is a program to help implementing digital signing services
+      and/or an identity service using the Belgian eID card. It provides
+      services to webbrowsers to read data from cards, and is intended to work
+      together with a WebExtension in the browser.
+
+      This package contains the native code. For the WebExtension, see your
+      webbrowser's extension store.
+    '';
+    homepage = "https://github.com/Fedict/fts-beidconnect/";
+    license = lib.licenses.mit;
+    maintainers = [ lib.maintainers.jovandeginste ];
+    platforms = lib.platforms.linux;
+  };
+})

pkgs/by-name/bi/bitrise/package.nix

@@ -0,0 +1,39 @@
+{
+  lib,
+  buildGoModule,
+  fetchFromGitHub,
+  nix-update-script,
+}:
+buildGoModule rec {
+  pname = "bitrise";
+  version = "2.19.0";
+
+  src = fetchFromGitHub {
+    owner = "bitrise-io";
+    repo = "bitrise";
+    rev = version;
+    hash = "sha256-VjuDeRl/rqA7bdhn9REdxdjRon5WxHkFIveOYNpQqa8=";
+  };
+
+  # many tests rely on writable $HOME/.bitrise and require network access
+  doCheck = false;
+
+  vendorHash = null;
+  ldflags = [
+    "-X github.com/bitrise-io/bitrise/version.Commit=${src.rev}"
+    "-X github.com/bitrise-io/bitrise/version.BuildNumber=0"
+  ];
+  CGO_ENABLED = 0;
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    changelog = "https://github.com/bitrise-io/bitrise/releases";
+    description = "CLI for running your Workflows from Bitrise on your local machine";
+    homepage = "https://bitrise.io/cli";
+    license = lib.licenses.mit;
+    platforms = lib.platforms.unix;
+    mainProgram = "bitrise";
+    maintainers = with lib.maintainers; [ ofalvai ];
+  };
+}

pkgs/by-name/cb/cbtemulator/package.nix

@@ -8,18 +8,22 @@
 
 buildGoModule rec {
   pname = "cbtemulator";
-  version = "1.22.0";
+  version = "1.29.0";
 
-  # There's a go.{mod,sum} in the root and in the "bigtable" subdir.
-  # We only ever use things in that subdir.
-  src = (fetchFromGitHub {
+  src = fetchFromGitHub {
     owner = "googleapis";
     repo = "google-cloud-go";
     rev = "bigtable/v${version}";
-    hash = "sha256-eOi4QFthnmZb5ry/5L7wzr4Fy1pF/H07BzxOnXtmSu4=";
-  }) + "/bigtable";
+    hash = "sha256-prDwy65pxWDrIJOURe2JHo4sY4yP8IE1Rp1pLUL/IAA=";
+  };
+
+  # There's a go.{mod,sum} in the root and in the "bigtable" subdir.
+  # We only ever use things in that subdir.
+  sourceRoot = "${src.name}/bigtable";
+  env.GOWORK = "off";
+
+  vendorHash = "sha256-EDfxT56LKEu/iXPp5RJXb4UIRV2jFFNxh3ZINPbwKTM=";
 
-  vendorHash = "sha256-7M7YZfl0usjN9hLGozqJV2bGh+M1ec4PZRGYUhEckpY=";
   subPackages = [ "cmd/emulator" ];
 
   postInstall = ''
@@ -57,7 +61,7 @@ buildGoModule rec {
 
   meta = with lib; {
     description = "In-memory Google Cloud Bigtable server";
-    homepage = "https://github.com/googleapis/google-cloud-go/blob/bigtable/v1.22.0/bigtable/cmd/emulator/cbtemulator.go";
+    homepage = "https://github.com/googleapis/google-cloud-go/blob/bigtable/v${version}/bigtable/cmd/emulator/cbtemulator.go";
     license = licenses.asl20;
     maintainers = [ maintainers.flokli ];
     mainProgram = "cbtemulator";

pkgs/by-name/cc/ccextractor/package.nix

@@ -0,0 +1,157 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  writeTextFile,
+
+  pkg-config,
+  cmake,
+  ninja,
+  cargo,
+  rustc,
+  corrosion,
+  rustPlatform,
+
+  gpac,
+  protobufc,
+  libpng,
+  zlib,
+  utf8proc,
+  freetype,
+  ffmpeg_7,
+  libarchive,
+  curl,
+  libiconv,
+
+  enableOcr ? true,
+  leptonica,
+  tesseract,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "ccextractor";
+  version = "0.94-unstable-2024-08-12";
+
+  src = fetchFromGitHub {
+    owner = "CCExtractor";
+    repo = "ccextractor";
+    rev = "92f2ce0fa026b01fb07db6751210e6bd8c8944d3";
+    hash = "sha256-bp7T9uJK4bauR2Co4lKqqnM6oGa3WZ+1toEKmzOx4mI=";
+  };
+
+  patches = [
+    ./remove-default-commit-hash.patch
+    ./remove-vendored-libraries.patch
+  ] ++ finalAttrs.cargoDeps.patches;
+
+  cmakeDir = "../src";
+
+  cargoRoot = "src/rust";
+
+  cargoDeps = rustPlatform.fetchCargoTarball {
+    inherit (finalAttrs) src;
+    sourceRoot = "${finalAttrs.src.name}/${finalAttrs.cargoRoot}";
+    patches = [ ./use-rsmpeg-0.15.patch ];
+    patchFlags = [ "-p3" ];
+    hash = "sha256-jh8hHKAad+tCJGwuGdoJp/TMm/IsMrZmz8aag9lj0BA=";
+  };
+
+  nativeBuildInputs = [
+    pkg-config
+    cmake
+    ninja
+    cargo
+    rustc
+    corrosion
+    rustPlatform.cargoSetupHook
+    rustPlatform.bindgenHook
+  ];
+
+  buildInputs =
+    [
+      gpac
+      protobufc
+      libpng
+      zlib
+      utf8proc
+      freetype
+      ffmpeg_7
+      libarchive
+      curl
+      libiconv
+    ]
+    ++ lib.optionals enableOcr [
+      leptonica
+      tesseract
+    ];
+
+  cmakeFlags =
+    [
+      # The tests are all part of one `cargo test` invocation, so let’s
+      # get the output from it.
+      (lib.cmakeFeature "CMAKE_CTEST_ARGUMENTS" "--verbose")
+
+      # TODO: This (and the corresponding patch) should probably be
+      # removed for the next stable release.
+      (lib.cmakeFeature "GIT_COMMIT_HASH" finalAttrs.src.rev)
+    ]
+    ++ lib.optionals enableOcr [
+      (lib.cmakeBool "WITH_OCR" true)
+      (lib.cmakeBool "WITH_HARDSUBX" true)
+    ];
+
+  env = {
+    FFMPEG_INCLUDE_DIR = "${lib.getDev ffmpeg_7}/include";
+
+    # Upstream’s FFmpeg binding crate needs an explicit path to a shared
+    # object to do dynamic linking. The key word is *an* explicit path;
+    # they don’t support passing more than one. This linker script hack
+    # pulls in all the FFmpeg libraries they bind to.
+    #
+    # See: <https://github.com/CCExtractor/rusty_ffmpeg/pull/69>
+    FFMPEG_DLL_PATH =
+      let
+        ffmpegLibNames = [
+          "avcodec"
+          "avdevice"
+          "avfilter"
+          "avformat"
+          "avutil"
+          "swresample"
+          "swscale"
+        ];
+        ffmpegLibDir = "${lib.getLib ffmpeg_7}/lib";
+        ffmpegLibExt = stdenv.hostPlatform.extensions.library;
+        ffmpegLibPath = ffmpegLibName: "${ffmpegLibDir}/lib${ffmpegLibName}.${ffmpegLibExt}";
+        ffmpegLinkerScript = writeTextFile {
+          name = "ccextractor-ffmpeg-linker-script";
+          destination = "/lib/ffmpeg.ld";
+          text = "INPUT(${lib.concatMapStringsSep " " ffmpegLibPath ffmpegLibNames})";
+        };
+      in
+      "${ffmpegLinkerScript}/lib/ffmpeg.ld";
+  };
+
+  doCheck = true;
+
+  postPatch = lib.optionalString enableOcr ''
+    substituteInPlace src/lib_ccx/ocr.c \
+      --replace-fail 'getenv("TESSDATA_PREFIX")' '"${tesseract}/share"'
+  '';
+
+  meta = {
+    homepage = "https://www.ccextractor.org/";
+    changelog = "${finalAttrs.src.meta.homepage}/blob/${finalAttrs.src.rev}/docs/CHANGES.TXT";
+    description = "Tool that produces subtitles from closed caption data in videos";
+    longDescription = ''
+      A tool that analyzes video files and produces independent subtitle files from
+      closed captions data. CCExtractor is portable, small, and very fast.
+      It works on Linux, Windows, and OSX.
+    '';
+    platforms = lib.platforms.unix;
+    sourceProvenance = [ lib.sourceTypes.fromSource ];
+    license = lib.licenses.gpl2Only;
+    maintainers = [ lib.maintainers.emily ];
+    mainProgram = "ccextractor";
+  };
+})

pkgs/by-name/cc/ccextractor/remove-default-commit-hash.patch

@@ -0,0 +1,14 @@
+diff --git a/src/CMakeLists.txt b/src/CMakeLists.txt
+index d7fdda02e3...2738cab631 100644
+--- a/src/CMakeLists.txt
++++ b/src/CMakeLists.txt
+@@ -24,9 +24,6 @@
+             OUTPUT_VARIABLE GIT_COMMIT_HASH
+             OUTPUT_STRIP_TRAILING_WHITESPACE
+     )
+-ELSE(EXISTS "${BASE_PROJ_DIR}/.git")
+-    set(GIT_BRANCH "Unknown")
+-    set(GIT_COMMIT_HASH "Unknown")
+ ENDIF(EXISTS "${BASE_PROJ_DIR}/.git")
+ 
+ #Get the date

pkgs/by-name/cc/ccextractor/remove-vendored-libraries.patch

@@ -0,0 +1,187 @@
+diff --git a/src/CMakeLists.txt b/src/CMakeLists.txt
+index 2738cab631...5bb2b7d17a 100644
+--- a/src/CMakeLists.txt
++++ b/src/CMakeLists.txt
+@@ -48,93 +48,20 @@
+ include_directories(${PROJECT_SOURCE_DIR})
+ include_directories(${PROJECT_SOURCE_DIR}/lib_ccx)
+ include_directories(${PROJECT_SOURCE_DIR}/lib_ccx/zvbi)
+-include_directories(${PROJECT_SOURCE_DIR}/thirdparty)
+-include_directories(${PROJECT_SOURCE_DIR}/thirdparty/protobuf-c)
+ include_directories(${PROJECT_SOURCE_DIR}/thirdparty/lib_hash)
+-include_directories(${PROJECT_SOURCE_DIR}/thirdparty/libpng)
+ 
+-# Check if the operating system is macOS (Darwin)
+-if (${CMAKE_SYSTEM_NAME} MATCHES "Darwin")
+-  if(${CMAKE_HOST_SYSTEM_PROCESSOR} MATCHES "arm64")
+-    # ARM Macs
+-    include_directories("/opt/homebrew/include")
+-    include_directories(${PROJECT_SOURCE_DIR}/thirdparty/libpng/arm)
+-    aux_source_directory(${PROJECT_SOURCE_DIR}/thirdparty/libpng/arm SOURCEFILE)
+-  else()
+-    include_directories("/usr/local/include")
+-  endif()
+-endif()
+-
+-include_directories(${PROJECT_SOURCE_DIR}/thirdparty/zlib)
+-include_directories(${PROJECT_SOURCE_DIR}/thirdparty/freetype/include)
+ aux_source_directory(${PROJECT_SOURCE_DIR}/thirdparty/lib_hash/ SOURCEFILE)
+-aux_source_directory(${PROJECT_SOURCE_DIR}/thirdparty/libpng/ SOURCEFILE)
+-aux_source_directory(${PROJECT_SOURCE_DIR}/thirdparty/protobuf-c/ SOURCEFILE)
+-aux_source_directory(${PROJECT_SOURCE_DIR}/thirdparty/zlib/ SOURCEFILE)
+ aux_source_directory(${PROJECT_SOURCE_DIR}/lib_ccx/zvbi/ SOURCEFILE)
+ 
+-set(UTF8PROC_SOURCE ${PROJECT_SOURCE_DIR}/thirdparty/utf8proc/utf8proc.c)
++set(UTF8PROC_SOURCE)
+ 
+-set(FREETYPE_SOURCE
+-        ${PROJECT_SOURCE_DIR}/thirdparty/freetype/autofit/autofit.c
+-        ${PROJECT_SOURCE_DIR}/thirdparty/freetype/base/ftbase.c
+-        ${PROJECT_SOURCE_DIR}/thirdparty/freetype/base/ftbbox.c
+-        ${PROJECT_SOURCE_DIR}/thirdparty/freetype/base/ftbdf.c
+-        ${PROJECT_SOURCE_DIR}/thirdparty/freetype/base/ftbitmap.c
+-        ${PROJECT_SOURCE_DIR}/thirdparty/freetype/base/ftcid.c
+-        ${PROJECT_SOURCE_DIR}/thirdparty/freetype/base/ftfntfmt.c
+-        ${PROJECT_SOURCE_DIR}/thirdparty/freetype/base/ftfstype.c
+-        ${PROJECT_SOURCE_DIR}/thirdparty/freetype/base/ftgasp.c
+-        ${PROJECT_SOURCE_DIR}/thirdparty/freetype/base/ftglyph.c
+-        ${PROJECT_SOURCE_DIR}/thirdparty/freetype/base/ftgxval.c
+-        ${PROJECT_SOURCE_DIR}/thirdparty/freetype/base/ftinit.c
+-        ${PROJECT_SOURCE_DIR}/thirdparty/freetype/base/ftlcdfil.c
+-        ${PROJECT_SOURCE_DIR}/thirdparty/freetype/base/ftmm.c
+-        ${PROJECT_SOURCE_DIR}/thirdparty/freetype/base/ftotval.c
+-        ${PROJECT_SOURCE_DIR}/thirdparty/freetype/base/ftpatent.c
+-        ${PROJECT_SOURCE_DIR}/thirdparty/freetype/base/ftpfr.c
+-        ${PROJECT_SOURCE_DIR}/thirdparty/freetype/base/ftstroke.c
+-        ${PROJECT_SOURCE_DIR}/thirdparty/freetype/base/ftsynth.c
+-        ${PROJECT_SOURCE_DIR}/thirdparty/freetype/base/ftsystem.c
+-        ${PROJECT_SOURCE_DIR}/thirdparty/freetype/base/fttype1.c
+-        ${PROJECT_SOURCE_DIR}/thirdparty/freetype/base/ftwinfnt.c
+-        ${PROJECT_SOURCE_DIR}/thirdparty/freetype/bdf/bdf.c
+-        ${PROJECT_SOURCE_DIR}/thirdparty/freetype/bzip2/ftbzip2.c
+-        ${PROJECT_SOURCE_DIR}/thirdparty/freetype/cache/ftcache.c
+-        ${PROJECT_SOURCE_DIR}/thirdparty/freetype/cff/cff.c
+-        ${PROJECT_SOURCE_DIR}/thirdparty/freetype/cid/type1cid.c
+-        ${PROJECT_SOURCE_DIR}/thirdparty/freetype/gzip/ftgzip.c
+-        ${PROJECT_SOURCE_DIR}/thirdparty/freetype/lzw/ftlzw.c
+-        ${PROJECT_SOURCE_DIR}/thirdparty/freetype/pcf/pcf.c
+-        ${PROJECT_SOURCE_DIR}/thirdparty/freetype/pfr/pfr.c
+-        ${PROJECT_SOURCE_DIR}/thirdparty/freetype/psaux/psaux.c
+-        ${PROJECT_SOURCE_DIR}/thirdparty/freetype/pshinter/pshinter.c
+-        ${PROJECT_SOURCE_DIR}/thirdparty/freetype/psnames/psnames.c
+-        ${PROJECT_SOURCE_DIR}/thirdparty/freetype/raster/raster.c
+-        ${PROJECT_SOURCE_DIR}/thirdparty/freetype/sfnt/sfnt.c
+-        ${PROJECT_SOURCE_DIR}/thirdparty/freetype/smooth/smooth.c
+-        ${PROJECT_SOURCE_DIR}/thirdparty/freetype/truetype/truetype.c
+-        ${PROJECT_SOURCE_DIR}/thirdparty/freetype/type1/type1.c
+-        ${PROJECT_SOURCE_DIR}/thirdparty/freetype/type42/type42.c
+-        ${PROJECT_SOURCE_DIR}/thirdparty/freetype/winfonts/winfnt.c
+-        )
++set(FREETYPE_SOURCE)
+ #Windows specific libraries and linker flags
+ if(WIN32)
+     include_directories ("${PROJECT_SOURCE_DIR}/thirdparty/win_spec_incld/")
+     include_directories ("${PROJECT_SOURCE_DIR}/thirdparty/win_iconv/")
+     aux_source_directory ("${PROJECT_SOURCE_DIR}/thirdparty/win_iconv/" SOURCEFILE)
+     set (EXTRA_LIBS ${EXTRA_LIBS} ws2_32 winmm Bcrypt)
+-else (WIN32)
+-    # Adding some platform specific library path
+-    if(UNIX AND NOT APPLE)
+-        link_directories (/usr/local/lib)
+-    endif()
+-
+-    if(APPLE)
+-        # Homebrew library paths
+-        link_directories(/usr/local/lib)
+-        link_directories(/opt/homebrew/lib)
+-    endif()
+ endif(WIN32)
+ 
+ if(MSVC)
+@@ -212,9 +139,6 @@
+   pkg_check_modules (NANOMSG REQUIRED libnanomsg)
+   set (EXTRA_LIBS ${EXTRA_LIBS} ${NANOMSG_STATIC_LIBRARIES})
+ 
+-  include_directories ("${PROJECT_SOURCE_DIR}/thirdparty/protobuf-c/")
+-  aux_source_directory ("${PROJECT_SOURCE_DIR}/thirdparty/protobuf-c/" SOURCEFILE)
+-
+   set (CMAKE_C_FLAGS "${CMAKE_C_FLAGS} -DENABLE_SHARING")
+ endif (PKG_CONFIG_FOUND AND WITH_SHARING)
+ 
+diff --git a/src/lib_ccx/CMakeLists.txt b/src/lib_ccx/CMakeLists.txt
+index 4f329bcaab...a334d20c4d 100644
+--- a/src/lib_ccx/CMakeLists.txt
++++ b/src/lib_ccx/CMakeLists.txt
+@@ -13,9 +13,39 @@
+ find_package(PkgConfig)
+ pkg_check_modules (GPAC REQUIRED gpac)
+ 
++set (REQUIRES_PRIVATE "libpng libprotobuf-c")
++
++if (WITH_FFMPEG)
++  set (REQUIRES_PRIVATE "${REQUIRES_PRIVATE} libavutil")
++endif (WITH_FFMPEG)
++
++if (WITH_HARDSUBX)
++  set (REQUIRES_PRIVATE "${REQUIRES_PRIVATE} libavcodec libavformat libswscale tesseract lept")
++endif (WITH_HARDSUBX)
++
+ set (EXTRA_INCLUDES ${EXTRA_INCLUDES} ${GPAC_INCLUDE_DIRS})
+ set (EXTRA_LIBS ${EXTRA_LIBS} ${GPAC_LIBRARIES})
+ 
++pkg_check_modules (PROTOBUFC REQUIRED libprotobuf-c)
++set (EXTRA_LIBS ${EXTRA_LIBS} ${PROTOBUFC_LIBRARIES})
++set (EXTRA_INCLUDES ${EXTRA_INCLUDES} ${PROTOBUFC_INCLUDE_DIRS}/protobuf-c)
++
++pkg_check_modules (LIBPNG REQUIRED libpng)
++set (EXTRA_LIBS ${EXTRA_LIBS} ${LIBPNG_LIBRARIES})
++set (EXTRA_INCLUDES ${EXTRA_INCLUDES} ${LIBPNG_INCLUDE_DIRS})
++
++pkg_check_modules (ZLIB REQUIRED zlib)
++set (EXTRA_LIBS ${EXTRA_LIBS} ${ZLIB_LIBRARIES})
++set (EXTRA_INCLUDES ${EXTRA_INCLUDES} ${ZLIB_INCLUDE_DIRS})
++
++pkg_check_modules (UTF8PROC REQUIRED libutf8proc)
++set (EXTRA_LIBS ${EXTRA_LIBS} ${UTF8PROC_LIBRARIES})
++set (EXTRA_INCLUDES ${EXTRA_INCLUDES} ${UTF8PROC_INCLUDE_DIRS})
++
++pkg_check_modules (FREETYPE REQUIRED freetype2)
++set (EXTRA_LIBS ${EXTRA_LIBS} ${FREETYPE_LIBRARIES})
++set (EXTRA_INCLUDES ${EXTRA_INCLUDES} ${FREETYPE_INCLUDE_DIRS})
++
+ if (WITH_FFMPEG)
+     find_package(PkgConfig)
+ 
+@@ -94,7 +124,7 @@
+     set (CMAKE_C_FLAGS "${CMAKE_C_FLAGS} -DDISABLE_RUST")
+ endif (WITHOUT_RUST)
+ 
+-file (GLOB HeaderFiles *.h)
++file (GLOB_RECURSE HeaderFiles *.h)
+ file (WRITE ccx.pc "prefix=${CMAKE_INSTALL_PREFIX}\n"
+                   "includedir=\${prefix}/include\n"
+                   "libdir=\${prefix}/lib\n\n"
+@@ -102,8 +132,8 @@
+                   "Description: Closed Caption Extraction library\n"
+                   "Version: 0.75\n"
+                   "Cflags: -I\${includedir}/\n"
+-                  "Libs: -L\${libdir} -lccx -lpng\n"
+-                  "Libs.private: -lpng\n"
++                  "Libs: -L\${libdir} -lccx\n"
++                  "Requires.private: ${REQUIRES_PRIVATE}\n"
+                   )
+ 
+ install (TARGETS ccx DESTINATION lib)
+diff --git a/src/lib_ccx/params.c b/src/lib_ccx/params.c
+index eb1562e50c...984070a285 100644
+--- a/src/lib_ccx/params.c
++++ b/src/lib_ccx/params.c
+@@ -14,7 +14,7 @@
+ #include "../lib_hash/sha2.h"
+ #include <string.h>
+ #include <stdio.h>
+-#include <utf8proc/utf8proc.h>
++#include <utf8proc.h>
+ 
+ #ifdef ENABLE_OCR
+ #include <tesseract/capi.h>

pkgs/by-name/cc/ccextractor/use-rsmpeg-0.15.patch

@@ -0,0 +1,43 @@
+diff --git a/src/rust/Cargo.lock b/src/rust/Cargo.lock
+index 5c49573775..3e855aa637 100644
+--- a/src/rust/Cargo.lock
++++ b/src/rust/Cargo.lock
+@@ -665,11 +665,10 @@
+ 
+ [[package]]
+ name = "rsmpeg"
+-version = "0.14.2+ffmpeg.6.1"
++version = "0.15.1+ffmpeg.7.0"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "927012cd6ae43519f519741f4a69602ce3a47cf84750784da124dffd03527cc0"
++checksum = "d3ffbead667d06e0c77c4363f83d49a3481cc3838bc9a61882aa07b01e3f63e1"
+ dependencies = [
+- "libc",
+  "paste",
+  "rusty_ffmpeg",
+  "thiserror",
+@@ -711,9 +710,9 @@
+ 
+ [[package]]
+ name = "rusty_ffmpeg"
+-version = "0.13.3+ffmpeg.6.1"
++version = "0.14.1+ffmpeg.7.0"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "716adffa5f909c8533611b1dab9ab5666bece35687845865b75ed6a990fc239c"
++checksum = "40f4db8e3e23d4a3044d53a41aba5324eae70d3e7fe82375ce833521533bc315"
+ dependencies = [
+  "bindgen 0.69.4",
+  "camino",
+diff --git a/src/rust/Cargo.toml b/src/rust/Cargo.toml
+index 4c1e73dcf0..68502915dc 100644
+--- a/src/rust/Cargo.toml
++++ b/src/rust/Cargo.toml
+@@ -15,7 +15,7 @@
+ env_logger = "0.8.4"
+ iconv = "0.1.1"
+ palette = "0.6.0"
+-rsmpeg = { version = "0.14.1", optional = true, features = [
++rsmpeg = { version = "0.15.1", optional = true, features = [
+     "link_system_ffmpeg",
+ ] }
+ tesseract-sys = { version = "0.5.14", optional = true, default-features = false }

pkgs/by-name/cs/csv-tui/package.nix

@@ -0,0 +1,27 @@
+{
+  lib,
+  rustPlatform,
+  fetchFromGitHub,
+}:
+
+rustPlatform.buildRustPackage rec {
+  pname = "csv-tui";
+  version = "1.1";
+
+  src = fetchFromGitHub {
+    owner = "nathangavin";
+    repo = "csv-tui";
+    rev = "v${version}";
+    hash = "sha256-IRXLwZ2FHcCDmDVJ0xnV/4q+X2AFXPX/+Ph4Xxo3DyM=";
+  };
+
+  cargoHash = "sha256-wgeVcX0zSXffAuvKw2eKXC846WlC8F9UGMoxP3IXoLE=";
+
+  meta = {
+    description = "Terminal based csv editor which is designed to be memory efficient but still useful";
+    homepage = "https://github.com/nathangavin/csv-tui";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ ottoblep ];
+    mainProgram = "csv_tui";
+  };
+}

pkgs/by-name/db/dbeaver-bin/package.nix

@@ -8,6 +8,9 @@
   gnused,
   autoPatchelfHook,
   wrapGAppsHook3,
+  gtk3,
+  swt,
+  glib,
 }:
 
 stdenvNoCC.mkDerivation (finalAttrs: {
@@ -59,7 +62,15 @@ stdenvNoCC.mkDerivation (finalAttrs: {
         cp -r * $out/opt/dbeaver
         makeWrapper $out/opt/dbeaver/dbeaver $out/bin/dbeaver \
           --prefix PATH : "${openjdk17}/bin" \
-          --set JAVA_HOME "${openjdk17.home}"
+          --set JAVA_HOME "${openjdk17.home}" \
+          --prefix CLASSPATH : "$out/dbeaver/plugins/*:${swt}/jars/swt.jar" \
+          --prefix LD_LIBRARY_PATH : "$out/lib:${
+            lib.makeLibraryPath [
+              swt
+              gtk3
+              glib
+            ]
+          }"
 
         mkdir -p $out/share/icons/hicolor/256x256/apps
         ln -s $out/opt/dbeaver/dbeaver.png $out/share/icons/hicolor/256x256/apps/dbeaver.png

pkgs/by-name/ek/eksctl/package.nix

@@ -6,16 +6,16 @@
 
 buildGoModule rec {
   pname = "eksctl";
-  version = "0.188.0";
+  version = "0.189.0";
 
   src = fetchFromGitHub {
     owner = "weaveworks";
     repo = pname;
     rev = version;
-    hash = "sha256-ZEMTPvmRhUFqaugtvgWv9EbuE6sF489ay0C3QUuAxfo=";
+    hash = "sha256-YG1p7T2K1b3LO2MiTkCC88ZpgCpVTSCBUoCEcJK+V7I=";
   };
 
-  vendorHash = "sha256-xz+hEgLNplXJIfqyNE10Zc5SwSdedLAL3tHuh6875+A=";
+  vendorHash = "sha256-W7tAdImEsPWSQkK8FnXgx5ADZ2JOdVc2xNBkNM11FOw=";
 
   doCheck = false;
 

pkgs/by-name/fl/fluent-bit/package.nix

@@ -14,13 +14,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "fluent-bit";
-  version = "3.1.5";
+  version = "3.1.6";
 
   src = fetchFromGitHub {
     owner = "fluent";
     repo = "fluent-bit";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-3pHqKBRMxPdgicxRN0H2OT3qp8+p0tp4ej83OWEh5OQ=";
+    hash = "sha256-l33DDS7rk/uLCGTU5WTGvQH0JUEarKo3cxMrXn5eefc=";
   };
 
   # optional only to avoid linux rebuild

pkgs/by-name/go/goflow2/package.nix

@@ -4,7 +4,7 @@
   fetchFromGitHub,
 }:
 let
-  version = "2.1.5";
+  version = "2.2.0";
 in
 buildGoModule {
   pname = "goflow2";
@@ -14,7 +14,7 @@ buildGoModule {
     owner = "netsampler";
     repo = "goflow2";
     rev = "v${version}";
-    hash = "sha256-Xo0SG9s39fPBGkPaVUbfWrHVVqZ7gQvjp4PJE/Z/jog=";
+    hash = "sha256-kqoHYNuyzT1gsBR00KuMe/+D0YT3ZvXOvoceWGKg7G8=";
   };
 
   ldflags = [
@@ -23,7 +23,7 @@ buildGoModule {
     "-X=main.version=${version}"
   ];
 
-  vendorHash = "sha256-6Wuf6trx8Epyv3FWAtEyAjGBM4OQyK0C8bpRWX0NUdo=";
+  vendorHash = "sha256-4I4gIRJ80x9lmPpbJraSo1OD9CzT6povZDUAr1ZZEa0=";
 
   meta = {
     description = "High performance sFlow/IPFIX/NetFlow Collector";

pkgs/by-name/go/google-chrome/package.nix

@@ -164,11 +164,11 @@ let
 
   linux = stdenv.mkDerivation (finalAttrs: {
     inherit pname meta passthru;
-    version = "127.0.6533.99";
+    version = "127.0.6533.119";
 
     src = fetchurl {
       url = "https://dl.google.com/linux/chrome/deb/pool/main/g/google-chrome-stable/google-chrome-stable_${finalAttrs.version}-1_amd64.deb";
-      hash = "sha256-pMGLSai4C/XifFkRmUoTRG/3dETGJXWhJbewtb/szVg=";
+      hash = "sha256-k9rsELAtOFdLSi1dOTV4Lr7E2Uu5sR1/GOL9BWDqZl4=";
     };
 
     # With strictDeps on, some shebangs were not being patched correctly
@@ -256,11 +256,11 @@ let
 
   darwin = stdenvNoCC.mkDerivation (finalAttrs: {
     inherit pname meta passthru;
-    version = "127.0.6533.100";
+    version = "127.0.6533.120";
 
     src = fetchurl {
-      url = "http://dl.google.com/release2/chrome/knybzo7stwsgi7z5xw6krwtnym_127.0.6533.100/GoogleChrome-127.0.6533.100.dmg";
-      hash = "sha256-slZ1FHXZqCCgWEStfnVTU4ykQBqa3H35KTVuqTXSHQs=";
+      url = "http://dl.google.com/release2/chrome/adqui4t7hzlljw2m2mmu2dvb6tmq_127.0.6533.120/GoogleChrome-127.0.6533.120.dmg";
+      hash = "sha256-kfUCTu8BIGcZTMaby0iylOCFxI+pLXcq9fKo2ow6HrM=";
     };
 
     dontPatch = true;

pkgs/by-name/gr/graphite-cli/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@withgraphite/graphite-cli",
-  "version": "1.4.1",
+  "version": "1.4.2",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@withgraphite/graphite-cli",
-      "version": "1.4.1",
+      "version": "1.4.2",
       "hasInstallScript": true,
       "license": "None",
       "dependencies": {

pkgs/by-name/gr/graphite-cli/package.nix

@@ -7,14 +7,14 @@
 
 buildNpmPackage rec {
   pname = "graphite-cli";
-  version = "1.4.1";
+  version = "1.4.2";
 
   src = fetchurl {
     url = "https://registry.npmjs.org/@withgraphite/graphite-cli/-/graphite-cli-${version}.tgz";
-    hash = "sha256-aYxNV50TVIu9/Xe3s5/SwI3Tf0ywo1KFhX8/uBOQ5ac=";
+    hash = "sha256-bh5BSpzmxSMgr1wKOCrOTQSpsSdgaVtBcw9jiE4IzI8=";
   };
 
-  npmDepsHash = "sha256-pxDj67W8bvi954C4UPuR7xQixoZ1CQGJO8NIHU5JOvM=";
+  npmDepsHash = "sha256-gluPxs1NPVjv5K64FtED7b4zWmOXufVquuBHqz1JUzU=";
 
   postPatch = ''
     ln -s ${./package-lock.json} package-lock.json

pkgs/by-name/gt/gtfocli/package.nix

@@ -6,16 +6,16 @@
 
 buildGoModule rec {
   pname = "gtfocli";
-  version = "0.0.4";
+  version = "0.0.5";
 
   src = fetchFromGitHub {
     owner = "cmd-tools";
     repo = "gtfocli";
     rev = "refs/tags/${version}";
-    hash = "sha256-fSk/OyeUffYZOkHXM1m/a9traDxdllYBieMEfsv910Q=";
+    hash = "sha256-yvL9H9yOiYTaWtm5cj9A8y+kKXLQgLqUMu9JMnm1llI=";
   };
 
-  vendorHash = "sha256-yhN2Ve4mBw1HoC3zXYz+M8+2CimLGduG9lGTXi+rPNw=";
+  vendorHash = "sha256-M1/XTY4ihkPNDiCv87I+kPgsTPU+sCqdnRoP09iVFu4=";
 
   ldflags = [
     "-s"

pkgs/by-name/h2/h2/package.nix

@@ -9,7 +9,7 @@
 
 maven.buildMavenPackage rec {
   pname = "h2";
-  version = "2.3.230";
+  version = "2.3.232";
 
   outputs = [
     "out"
@@ -20,7 +20,7 @@ maven.buildMavenPackage rec {
     owner = "h2database";
     repo = "h2database";
     rev = "refs/tags/version-${version}";
-    hash = "sha256-zF33xqsTIXSdOSqBeX/uuEdi36btn6gS/fmbxcgsSpg=";
+    hash = "sha256-voqQ4JqYkHRxVdxMGsHmKirQXMP7s44rTXeasWWW2Jw=";
   };
 
   mvnParameters = "-f h2/pom.xml";

pkgs/by-name/ha/hatch/package.nix

@@ -1,29 +1,36 @@
-{ lib
-, stdenv
-, fetchPypi
-, python3
-, cargo
-, git
-, uv
+{
+  lib,
+  python3,
+  fetchFromGitHub,
+  uv,
+  git,
+  cargo,
+  stdenv,
+  darwin,
+  nix-update-script,
+  testers,
+  hatch,
 }:
 
 python3.pkgs.buildPythonApplication rec {
   pname = "hatch";
   version = "1.12.0";
-  format = "pyproject";
+  pyproject = true;
 
-  src = fetchPypi {
-    inherit pname version;
-    hash = "sha256-roBHjRAxLfK0TWWck7wu1NM67N3OS3Y3gjG9+ByL9q0=";
+  src = fetchFromGitHub {
+    owner = "pypa";
+    repo = "hatch";
+    rev = "refs/tags/hatch-v${version}";
+    hash = "sha256-HW2vDVsFrdFRRaPNuGDg9DZpJd8OuYDIqA3KQRa3m9o=";
   };
 
-  nativeBuildInputs = with python3.pkgs; [
+  build-system = with python3.pkgs; [
     hatchling
     hatch-vcs
     uv
   ];
 
-  propagatedBuildInputs = with python3.pkgs; [
+  dependencies = with python3.pkgs; [
     click
     hatchling
     httpx
@@ -41,51 +48,88 @@ python3.pkgs.buildPythonApplication rec {
     zstandard
   ];
 
-  nativeCheckInputs = [
-    cargo
-  ] ++ (with python3.pkgs; [
-    binary
-    git
-    pytestCheckHook
-    pytest-mock
-    pytest-xdist
-    setuptools
-  ]);
+  nativeCheckInputs =
+    with python3.pkgs;
+    [
+      binary
+      git
+      pytestCheckHook
+      pytest-mock
+      pytest-xdist
+      setuptools
+    ]
+    ++ [ cargo ]
+    ++ lib.optionals stdenv.isDarwin [
+      darwin.ps
+    ];
 
   preCheck = ''
     export HOME=$(mktemp -d);
   '';
 
-  disabledTests = [
-    # AssertionError: assert (1980, 1, 2, 0, 0, 0) == (2020, 2, 2, 0, 0, 0)
-    "test_default"
-    # Loosen hatchling runtime version dependency
-    "test_core"
-    # New failing
-    "test_guess_variant"
-    "test_open"
-    "test_no_open"
-    "test_uv_env"
-    "test_pyenv"
-    "test_pypirc"
-  ] ++ lib.optionals stdenv.isDarwin [
-    # https://github.com/NixOS/nixpkgs/issues/209358
-    "test_scripts_no_environment"
+  disabledTests =
+    [
+      # AssertionError: assert (1980, 1, 2, 0, 0, 0) == (2020, 2, 2, 0, 0, 0)
+      "test_default"
+      "test_editable_default"
+      "test_editable_default_extra_dependencies"
+      "test_editable_default_force_include"
+      "test_editable_default_force_include_option"
+      "test_editable_default_symlink"
+      "test_editable_exact"
+      "test_editable_exact_extra_dependencies"
+      "test_editable_exact_force_include"
+      "test_editable_exact_force_include_build_data_precedence"
+      "test_editable_exact_force_include_option"
+      "test_editable_pth"
+      "test_explicit_path"
 
-    # This test assumes it is running on macOS with a system shell on the PATH.
-    # It is not possible to run it in a nix build using a /nix/store shell.
-    # See https://github.com/pypa/hatch/pull/709 for the relevant code.
-    "test_populate_default_popen_kwargs_executable"
-  ] ++ lib.optionals stdenv.isAarch64 [
-    "test_resolve"
+      # Loosen hatchling runtime version dependency
+      "test_core"
+      # New failing
+      "test_guess_variant"
+      "test_open"
+      "test_no_open"
+      "test_uv_env"
+      "test_pyenv"
+      "test_pypirc"
+    ]
+    ++ lib.optionals stdenv.isDarwin [
+      # https://github.com/NixOS/nixpkgs/issues/209358
+      "test_scripts_no_environment"
+
+      # This test assumes it is running on macOS with a system shell on the PATH.
+      # It is not possible to run it in a nix build using a /nix/store shell.
+      # See https://github.com/pypa/hatch/pull/709 for the relevant code.
+      "test_populate_default_popen_kwargs_executable"
+
+      # Those tests fail because the final wheel is named '...2-macosx_11_0_arm64.whl' instead of
+      # '...2-macosx_14_0_arm64.whl'
+      "test_macos_archflags"
+      "test_macos_max_compat"
+    ]
+    ++ lib.optionals stdenv.isAarch64 [ "test_resolve" ];
+
+  disabledTestPaths = lib.optionals stdenv.isDarwin [
+    # AssertionError: assert [call('test h...2p32/bin/sh')] == [call('test h..., shell=True)]
+    # At index 0 diff:
+    #    call('test hatch-test.py3.10', shell=True, executable='/nix/store/b34ianga4diikh0kymkpqwmvba0mmzf7-bash-5.2p32/bin/sh')
+    # != call('test hatch-test.py3.10', shell=True)
+    "tests/cli/fmt/test_fmt.py"
+    "tests/cli/test/test_test.py"
   ];
 
-  meta = with lib; {
+  passthru = {
+    tests.version = testers.testVersion { package = hatch; };
+    updateScript = nix-update-script { };
+  };
+
+  meta = {
     description = "Modern, extensible Python project manager";
-    mainProgram = "hatch";
     homepage = "https://hatch.pypa.io/latest/";
     changelog = "https://github.com/pypa/hatch/blob/hatch-v${version}/docs/history/hatch.md";
-    license = licenses.mit;
-    maintainers = with maintainers; [ onny ];
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ onny ];
+    mainProgram = "hatch";
   };
 }

pkgs/by-name/he/heptabase/package.nix

@@ -0,0 +1,39 @@
+{
+  lib,
+  appimageTools,
+  fetchurl,
+}:
+let
+  pname = "heptabase";
+  version = "1.35.3";
+  src = fetchurl {
+    url = "https://github.com/heptameta/project-meta/releases/download/v${version}/Heptabase-${version}.AppImage";
+    hash = "sha256-2HEBQI+C/LKrIUb+6qNmm+xjvTOxS+vk5WTsOZKz3+s=";
+  };
+
+  appimageContents = appimageTools.extractType2 { inherit pname version src; };
+in
+appimageTools.wrapType2 {
+  inherit pname version src;
+
+  extraInstallCommands = ''
+    install -Dm444 ${appimageContents}/project-meta.desktop -T $out/share/applications/heptabase.desktop
+    install -m 444 -D ${appimageContents}/usr/share/icons/hicolor/0x0/apps/project-meta.png $out/share/icons/hicolor/512x512/apps/${pname}.png
+
+    substituteInPlace $out/share/applications/heptabase.desktop \
+      --replace-fail 'Exec=AppRun --no-sandbox %U' 'Exec=heptabase %U' \
+      --replace-fail 'Icon=project-meta' 'Icon=${pname}'
+
+  '';
+
+  meta = {
+    changelog = "https://github.com/heptameta/project-meta/releases/tag/v${version}";
+    description = "A visual note-taking tool for learning complex topics";
+    homepage = "https://heptabase.com/";
+    license = lib.licenses.unfree;
+    maintainers = with lib.maintainers; [ luftmensch-luftmensch ];
+    mainProgram = "heptabase";
+    platforms = [ "x86_64-linux" ];
+    sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
+  };
+}

pkgs/by-name/ir/irrd/package.nix

@@ -14,13 +14,16 @@ let
     self = py;
     packageOverrides = final: prev: {
       # sqlalchemy 1.4.x or 2.x are not supported
-      sqlalchemy = prev.sqlalchemy.overridePythonAttrs (oldAttrs: rec {
+      sqlalchemy = prev.sqlalchemy_1_4.overridePythonAttrs (oldAttrs: rec {
         version = "1.3.24";
         src = fetchPypi {
           pname = "SQLAlchemy";
           inherit version;
           hash = "sha256-67t3fL+TEjWbiXv4G6ANrg9ctp+6KhgmXcwYpvXvdRk=";
         };
+        postPatch = ''
+          sed -i '/tag_build = dev/d' setup.cfg
+        '';
         doCheck = false;
       });
       alembic = prev.alembic.overridePythonAttrs (lib.const {

pkgs/by-name/ki/kiwitalk/Cargo.lock

@@ -2678,6 +2678,12 @@ dependencies = [
  "zeroize",
 ]
 
+[[package]]
+name = "num-conv"
+version = "0.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "51d515d32fb182ee37cda2ccdcb92950d6a3c2893aa280e540671c2cd0f3b1d9"
+
 [[package]]
 name = "num-integer"
 version = "0.1.45"
@@ -4606,13 +4612,14 @@ dependencies = [
 
 [[package]]
 name = "time"
-version = "0.3.30"
+version = "0.3.36"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c4a34ab300f2dee6e562c10a046fc05e358b29f9bf92277f30c3c8d82275f6f5"
+checksum = "5dfd88e563464686c916c7e46e623e520ddc6d79fa6641390f2e3fa86e83e885"
 dependencies = [
  "deranged",
  "itoa 1.0.9",
  "libc",
+ "num-conv",
  "num_threads",
  "powerfmt",
  "serde",
@@ -4628,10 +4635,11 @@ checksum = "ef927ca75afb808a4d64dd374f00a2adf8d0fcff8e7b184af886c3c87ec4a3f3"
 
 [[package]]
 name = "time-macros"
-version = "0.2.15"
+version = "0.2.18"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4ad70d68dba9e1f8aceda7aa6711965dfec1cac869f311a51bd08b3a2ccbce20"
+checksum = "3f252a68540fde3a3877aeea552b832b40ab9a69e318efd078774a01ddee1ccf"
 dependencies = [
+ "num-conv",
  "time-core",
 ]
 

pkgs/by-name/ki/kiwitalk/package.nix

@@ -28,7 +28,8 @@ stdenv.mkDerivation (finalAttrs: {
 
   postPatch = ''
     substituteInPlace $cargoDepsCopy/libappindicator-sys-*/src/lib.rs \
-      --replace "libayatana-appindicator3.so.1" "${libayatana-appindicator}/lib/libayatana-appindicator3.so.1"
+      --replace-warn "libayatana-appindicator3.so.1" "${libayatana-appindicator}/lib/libayatana-appindicator3.so.1"
+    ln -sf ${./Cargo.lock} Cargo.lock
   '';
 
   pnpmDeps = pnpm.fetchDeps {

pkgs/by-name/li/lint-staged/package.nix

@@ -2,16 +2,16 @@
 
 buildNpmPackage rec {
   pname = "lint-staged";
-  version = "15.2.8";
+  version = "15.2.9";
 
   src = fetchFromGitHub {
     owner = "okonet";
     repo = "lint-staged";
     rev = "v${version}";
-    hash = "sha256-N1mPtF23YP1yeVNUPIxCAFK3ozOCMKV3ZTt+axIWFmQ=";
+    hash = "sha256-qEqjB6GBzKx4zRqumMPSRxFnWQ4j+sBKWTspaeorL6Q=";
   };
 
-  npmDepsHash = "sha256-ivlbaTCvVbs7k4zpP7fFbMdWuO5rOcT/5451PQh2CKs=";
+  npmDepsHash = "sha256-VQ8UDdPIrhiLvDfpAWLMvCtBIhW/LtRj/CC1j2yEm5o=";
 
   dontNpmBuild = true;
 

pkgs/by-name/lo/local-ai/package.nix

@@ -17,6 +17,10 @@
 , buildGoModule
 , makeWrapper
 , ncurses
+, which
+
+, enable_upx ? true
+, upx
 
   # apply feature parameter names according to
   # https://github.com/NixOS/rfcs/pull/169
@@ -115,8 +119,8 @@ let
     src = fetchFromGitHub {
       owner = "ggerganov";
       repo = "llama.cpp";
-      rev = "cb5fad4c6c2cbef92e9b8b63449e1cb7664e4846";
-      hash = "sha256-cIJuDC+MFLd5hkA1kUxuaw2dZagHqn5fi5Q2XKvDEII=";
+      rev = "ed9d2854c9de4ae1f448334294e61167b04bec2a";
+      hash = "sha256-Xu2h9Zu+Q9utfFFmDWBOEu/EXth4xWRNoTMvPF5Fo/A=";
       fetchSubmodules = true;
     };
     postPatch = prev.postPatch + ''
@@ -269,8 +273,8 @@ let
     src = fetchFromGitHub {
       owner = "ggerganov";
       repo = "whisper.cpp";
-      rev = "b29b3b29240aac8b71ce8e5a4360c1f1562ad66f";
-      hash = "sha256-vSd+AP9AexbG4wvdkk6wjxYQBZdKWGK2Ix7c86MUfB8=";
+      rev = "6739eb83c3ca5cf40d24c6fe8442a761a1eb6248";
+      hash = "sha256-1yDdJVjIwYDJKn93zn4xOJXMoDTqaG2TvakjdHIMCxk=";
     };
 
     nativeBuildInputs = [ cmake pkg-config ]
@@ -388,58 +392,67 @@ let
       stdenv;
 
   pname = "local-ai";
-  version = "2.18.1";
+  version = "2.19.4";
   src = fetchFromGitHub {
     owner = "go-skynet";
     repo = "LocalAI";
     rev = "v${version}";
-    hash = "sha256-hRrbGUUawQV4fqxAn3eFBvn4/lZ+NrKhxnGHqpljrec=";
+    hash = "sha256-aKq6/DI+4+BvIEw6eONqPr3mZXuz7rMFN+FBypVj0Gc=";
   };
 
+  prepare-sources =
+    let
+      cp = "cp -r --no-preserve=mode,ownership";
+    in
+    ''
+      mkdir sources
+      ${cp} ${go-llama} sources/go-llama.cpp
+      ${cp} ${gpt4all} sources/gpt4all
+      ${cp} ${if with_tts then go-piper else go-piper.src} sources/go-piper
+      ${cp} ${go-rwkv} sources/go-rwkv.cpp
+      ${cp} ${whisper-cpp.src} sources/whisper.cpp
+      cp ${whisper-cpp}/lib/lib*.a sources/whisper.cpp
+      ${cp} ${go-bert} sources/go-bert.cpp
+      ${cp} ${if with_stablediffusion then go-stable-diffusion else go-stable-diffusion.src} sources/go-stable-diffusion
+      ${cp} ${if with_tinydream then go-tiny-dream else go-tiny-dream.src} sources/go-tiny-dream
+    '';
+
   self = buildGoModule.override { stdenv = effectiveStdenv; } {
     inherit pname version src;
 
-    vendorHash = "sha256-uvko1PQWW5P+6cgmwVKocKBm5GndszqCsSbxlXANqJs=";
+    vendorHash = "sha256-HEKE75+ixuNbM+KEuhbQQ/NYYEzVlGYOttPavftWKhk=";
 
     env.NIX_CFLAGS_COMPILE = lib.optionalString with_stablediffusion " -isystem ${opencv}/include/opencv4";
 
-    postPatch =
-      let
-        cp = "cp -r --no-preserve=mode,ownership";
-      in
-      ''
-        sed -i Makefile \
-          -e 's;git clone.*go-llama\.cpp$;${cp} ${go-llama} sources/go-llama\.cpp;' \
-          -e 's;git clone.*gpt4all$;${cp} ${gpt4all} sources/gpt4all;' \
-          -e 's;git clone.*go-piper$;${cp} ${if with_tts then go-piper else go-piper.src} sources/go-piper;' \
-          -e 's;git clone.*go-rwkv\.cpp$;${cp} ${go-rwkv} sources/go-rwkv\.cpp;' \
-          -e 's;git clone.*whisper\.cpp$;${cp} ${whisper-cpp.src} sources/whisper\.cpp;' \
-          -e 's;git clone.*go-bert\.cpp$;${cp} ${go-bert} sources/go-bert\.cpp;' \
-          -e 's;git clone.*diffusion$;${cp} ${if with_stablediffusion then go-stable-diffusion else go-stable-diffusion.src} sources/go-stable-diffusion;' \
-          -e 's;git clone.*go-tiny-dream$;${cp} ${if with_tinydream then go-tiny-dream else go-tiny-dream.src} sources/go-tiny-dream;' \
-          -e 's, && git checkout.*,,g' \
-          -e '/mod download/ d' \
-          -e '/^ALL_GRPC_BACKENDS+=backend-assets\/grpc\/llama-cpp-fallback/ d' \
-          -e '/^ALL_GRPC_BACKENDS+=backend-assets\/grpc\/llama-cpp-avx/ d' \
-          -e '/^ALL_GRPC_BACKENDS+=backend-assets\/grpc\/llama-cpp-cuda/ d' \
+    postPatch = ''
+      sed -i Makefile \
+        -e '/mod download/ d' \
+        -e '/^ALL_GRPC_BACKENDS+=backend-assets\/grpc\/llama-cpp-fallback/ d' \
+        -e '/^ALL_GRPC_BACKENDS+=backend-assets\/grpc\/llama-cpp-avx/ d' \
+        -e '/^ALL_GRPC_BACKENDS+=backend-assets\/grpc\/llama-cpp-cuda/ d' \
 
-      '' + lib.optionalString with_cublas ''
-        sed -i Makefile \
-          -e '/^CGO_LDFLAGS_WHISPER?=/ s;$;-L${libcufft}/lib -L${cuda_cudart}/lib;'
-      '';
+    '' + lib.optionalString with_cublas ''
+      sed -i Makefile \
+        -e '/^CGO_LDFLAGS_WHISPER?=/ s;$;-L${libcufft}/lib -L${cuda_cudart}/lib;'
+    '';
 
-    postConfigure = ''
+    postConfigure = prepare-sources + ''
       shopt -s extglob
       mkdir -p backend-assets/grpc
       cp ${llama-cpp-grpc}/bin/grpc-server backend-assets/grpc/llama-cpp-avx2
       cp ${llama-cpp-rpc}/bin/grpc-server backend-assets/grpc/llama-cpp-grpc
 
+      mkdir -p backend/cpp/llama/llama.cpp
+
       mkdir -p backend-assets/util
       cp ${llama-cpp-rpc}/bin/llama-rpc-server backend-assets/util/llama-cpp-rpc-server
+
+      # avoid rebuild of prebuilt make targets
+      touch backend-assets/grpc/* backend-assets/util/* sources/**/lib*.a
     '';
 
     buildInputs = [ ]
-      ++ lib.optionals with_cublas [ libcublas ]
+      ++ lib.optionals with_cublas [ cuda_cudart libcublas libcufft ]
       ++ lib.optionals with_clblas [ clblast ocl-icd opencl-headers ]
       ++ lib.optionals with_openblas [ openblas.dev ]
       ++ lib.optionals with_stablediffusion go-stable-diffusion.buildInputs
@@ -451,14 +464,15 @@ let
       protoc-gen-go-grpc
       makeWrapper
       ncurses # tput
+      which
     ]
+    ++ lib.optional enable_upx upx
     ++ lib.optionals with_cublas [ cuda_nvcc ];
 
     enableParallelBuilding = false;
 
-    modBuildPhase = ''
-      mkdir sources
-      make prepare-sources protogen-go
+    modBuildPhase = prepare-sources + ''
+      make protogen-go
       go mod tidy -v
     '';
 
@@ -478,12 +492,6 @@ let
     buildPhase = ''
       runHook preBuild
 
-      mkdir sources
-      make prepare-sources
-      # avoid rebuild of prebuilt libraries
-      touch sources/**/lib*.a
-      cp ${whisper-cpp}/lib/static/lib*.a sources/whisper.cpp
-
       local flagsArray=(
         ''${enableParallelBuilding:+-j''${NIX_BUILD_CORES}}
         SHELL=$SHELL
@@ -518,7 +526,8 @@ let
         ]
           ++ lib.optionals with_clblas [ clblast ocl-icd ]
           ++ lib.optionals with_openblas [ openblas ]
-          ++ lib.optionals with_tts [ piper-phonemize ];
+          ++ lib.optionals with_tts [ piper-phonemize ]
+          ++ lib.optionals (with_tts && enable_upx) [ fmt spdlog ];
       in
       ''
         wrapProgram $out/bin/${pname} \

pkgs/by-name/lo/local-ai/tests.nix

@@ -101,17 +101,16 @@ in
 
       # https://localai.io/advanced/#full-config-model-file-reference
       model-configs.${model} = rec {
-        context_size = 8192;
+        context_size = 16 * 1024; # 128kb is possible, but needs 16GB RAM
         backend = "llama-cpp";
         parameters = {
-          # https://huggingface.co/lmstudio-community/Meta-Llama-3-8B-Instruct-GGUF
-          # https://ai.meta.com/blog/meta-llama-3/
+          # https://ai.meta.com/blog/meta-llama-3-1/
           model = fetchurl {
-            url = "https://huggingface.co/lmstudio-community/Meta-Llama-3-8B-Instruct-GGUF/resolve/main/Meta-Llama-3-8B-Instruct-Q4_K_M.gguf";
-            sha256 = "ab9e4eec7e80892fd78f74d9a15d0299f1e22121cea44efd68a7a02a3fe9a1da";
+            url = "https://huggingface.co/lmstudio-community/Meta-Llama-3.1-8B-Instruct-GGUF/resolve/main/Meta-Llama-3.1-8B-Instruct-Q4_K_M.gguf";
+            sha256 = "f2be3e1a239c12c9f3f01a962b11fb2807f8032fdb63b0a5502ea42ddef55e44";
           };
           # defaults from:
-          # https://deepinfra.com/meta-llama/Meta-Llama-3-8B-Instruct
+          # https://deepinfra.com/meta-llama/Meta-Llama-3.1-8B-Instruct
           temperature = 0.7;
           top_p = 0.9;
           top_k = 0;
@@ -135,7 +134,9 @@ in
 
             {{.Content}}${builtins.head stopwords}'';
 
-          chat = "<|begin_of_text|>{{.Input}}<|start_header_id|>assistant<|end_header_id|>";
+          chat = "{{.Input}}<|start_header_id|>assistant<|end_header_id|>";
+
+          completion = "{{.Input}}";
         };
       };
 
@@ -185,7 +186,7 @@ in
           machine.succeed("curl -f http://localhost:${port}/v1/chat/completions --json @${writers.writeJSON "request-chat-completions.json" requests.chat-completions} --output chat-completions.json")
           machine.copy_from_vm("chat-completions.json")
           machine.succeed("${jq}/bin/jq --exit-status 'debug | .object == \"chat.completion\"' chat-completions.json")
-          machine.succeed("${jq}/bin/jq --exit-status 'debug | .choices | first.message.content | tonumber == 3' chat-completions.json")
+          machine.succeed("${jq}/bin/jq --exit-status 'debug | .choices | first.message.content | split(\" \") | last | tonumber == 3' chat-completions.json")
 
           machine.succeed("curl -f http://localhost:${port}/v1/edits --json @${writers.writeJSON "request-edit-completions.json" requests.edit-completions} --output edit-completions.json")
           machine.copy_from_vm("edit-completions.json")

pkgs/by-name/ma/maa-cli/package.nix

@@ -15,13 +15,13 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "maa-cli";
-  version = "0.4.10";
+  version = "0.4.11";
 
   src = fetchFromGitHub {
     owner = "MaaAssistantArknights";
     repo = "maa-cli";
     rev = "v${version}";
-    hash = "sha256-qCIA+VN7mSfeLwN+O2wm0CYDQMCUQzZrj5RxpDEEKQk=";
+    hash = "sha256-ycX2enTMcBwXXz5khLJEIFcX6pPzsoq5rKpOQIUg1rg=";
   };
 
   nativeBuildInputs = [
@@ -44,7 +44,7 @@ rustPlatform.buildRustPackage rec {
   buildNoDefaultFeatures = true;
   buildFeatures = [ "git2" ];
 
-  cargoHash = "sha256-exLXowD2QTW4IZHIO3PDv6cf0O0deNPuqrCIcTnnJQA=";
+  cargoHash = "sha256-Eftr/IxOGD4HCFgePguoZTg99yx1itBH28MHXrHKv8Y=";
 
   # maa-cli would only seach libMaaCore.so and resources in itself's path
   # https://github.com/MaaAssistantArknights/maa-cli/issues/67

pkgs/by-name/me/meteor-git/package.nix

@@ -0,0 +1,27 @@
+{
+  lib,
+  fetchFromGitHub,
+  buildGoModule,
+}:
+
+buildGoModule rec {
+  pname = "meteor-git";
+  version = "0.22.0";
+
+  src = fetchFromGitHub {
+    owner = "stefanlogue";
+    repo = "meteor";
+    rev = "v${version}";
+    hash = "sha256-aY/gOKvcKtOnL4FI2SM339LU4HoWYCq0W9mK2GyMqso=";
+  };
+
+  vendorHash = "sha256-jKd/eJwp5SZvTrP3RN7xT7ibAB0PQondGR3RT+HQXIo=";
+
+  meta = {
+    description = "CLI tool for writing conventional commits";
+    mainProgram = "meteor";
+    homepage = "https://github.com/stefanlogue/meteor";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ nebunebu ];
+  };
+}

pkgs/by-name/mi/miru/darwin.nix

@@ -19,7 +19,7 @@ stdenvNoCC.mkDerivation rec {
 
   src = fetchurl {
     url = "https://github.com/ThaUnknown/miru/releases/download/v${version}/mac-Miru-${version}-mac.zip";
-    hash = "sha256-1Qfd5lYcT6tUSQD46yOIus/esOrvAVfn7VeHm9t0OLg=";
+    hash = "sha256-4PUi/q9Dtyp6c++hmwfoW5cluzolZYANnKXtiMqlMGo=";
   };
 
   sourceRoot = ".";

pkgs/by-name/mi/miru/linux.nix

@@ -19,7 +19,7 @@ appimageTools.wrapType2 rec {
   src = fetchurl {
     url = "https://github.com/ThaUnknown/miru/releases/download/v${version}/linux-Miru-${version}.AppImage";
     name = "${pname}-${version}.AppImage";
-    hash = "sha256-c0Rf+mny6yURfONUw4TmSzgE6i0y7kd+F4T7V+BfJsY=";
+    hash = "sha256-NjsuI9GFMVJ6+E03UDPq6xrzlO0Vs1nfYsOE6TDVwY0=";
   };
 
   extraInstallCommands =

pkgs/by-name/mi/miru/package.nix

@@ -5,7 +5,7 @@
 }:
 let
   pname = "miru";
-  version = "5.2.14";
+  version = "5.3.1";
   meta = with lib; {
     description = "Stream anime torrents, real-time with no waiting for downloads";
     homepage = "https://miru.watch";

pkgs/by-name/mo/mollysocket/package.nix

@@ -11,16 +11,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "mollysocket";
-  version = "1.4.0";
+  version = "1.4.1";
 
   src = fetchFromGitHub {
     owner = "mollyim";
     repo = "mollysocket";
     rev = version;
-    hash = "sha256-wZIP4mmIrg8D70C8jLjPC/+TlOT+gP7YOkM1Ey44Tvk=";
+    hash = "sha256-vE5J4BKYmVqtowfxDDTOwFKws7phYRm9xKFPiDNuNn4=";
   };
 
-  cargoHash = "sha256-3yTbwbgOIm69Nf8stPMMhgR6g0sfenycx07by8AM01M=";
+  cargoHash = "sha256-s/EhX5o6XuUqcrqhXY274MyWhRukgetfIZKQ4XNlq6Y=";
 
   nativeBuildInputs = [
     pkg-config

pkgs/by-name/na/nawk/package.nix

@@ -1,30 +1,31 @@
-{ lib
-, stdenv
-, fetchFromGitHub
-, bison
-, buildPackages
-, installShellFiles
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  bison,
+  buildPackages,
+  installShellFiles,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "nawk";
-  version = "20240422";
+  version = "20240728";
 
   src = fetchFromGitHub {
     owner = "onetrueawk";
     repo = "awk";
     rev = finalAttrs.version;
-    hash = "sha256-wsRkSXCLtK2jk4gW/Lpg/14NiOUANfmCrYqeKZW6CLY=";
+    hash = "sha256-LA7fdbMP3aKJ1QljoKWizqVg3ys3hd8tGaRsQnIO+Hc=";
   };
 
   depsBuildBuild = [ buildPackages.stdenv.cc ];
 
-  nativeBuildInputs = [
-    bison
-    installShellFiles
-  ];
+  nativeBuildInputs = [ bison installShellFiles ];
 
-  outputs = [ "out" "man" ];
+  outputs = [
+    "out"
+    "man"
+  ];
 
   makeFlags = [
     "CC=${stdenv.cc.targetPrefix}cc"
@@ -50,7 +51,10 @@ stdenv.mkDerivation (finalAttrs: {
     changelog = "https://github.com/onetrueawk/awk/blob/${finalAttrs.src.rev}/ChangeLog";
     license = lib.licenses.mit;
     mainProgram = "nawk";
-    maintainers = with lib.maintainers; [ AndersonTorres konimex ];
+    maintainers = with lib.maintainers; [
+      AndersonTorres
+      konimex
+    ];
     platforms = lib.platforms.all;
   };
 })

pkgs/by-name/op/openvas-scanner/package.nix

@@ -31,13 +31,13 @@
 
 stdenv.mkDerivation rec {
   pname = "openvas-scanner";
-  version = "23.8.4";
+  version = "23.8.5";
 
   src = fetchFromGitHub {
     owner = "greenbone";
     repo = "openvas-scanner";
     rev = "refs/tags/v${version}";
-    hash = "sha256-Bxna9ylQ9MZf/YWLIVI61tRjU5H4Ipqkiz+z21qiaGg=";
+    hash = "sha256-0zVhrnDimmSg5auIT1NQaNRsilASkkXK6tVimoWsXn8=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/po/portablemc/package.nix

@@ -43,7 +43,7 @@ let
 in
 python3Packages.buildPythonApplication rec {
   pname = "portablemc";
-  version = "4.3.0";
+  version = "4.4.0";
   pyproject = true;
 
   disabled = python3Packages.pythonOlder "3.8";
@@ -51,8 +51,8 @@ python3Packages.buildPythonApplication rec {
   src = fetchFromGitHub {
     owner = "mindstorm38";
     repo = "portablemc";
-    rev = "v${version}";
-    hash = "sha256-jCv4ncXUWbkWlBZr3P1hNeVpdQzY9HtrFz+pmKknL0I=";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-JDosvjbpoDC+xJ15ejcMJd+jA09RLR+whVZblMu+ljk=";
   };
 
   patches = [

pkgs/by-name/ry/ryujinx/package.nix

@@ -26,13 +26,13 @@
 
 buildDotnetModule rec {
   pname = "ryujinx";
-  version = "1.1.1373"; # Based off of the official github actions builds: https://github.com/Ryujinx/Ryujinx/actions/workflows/release.yml
+  version = "1.1.1376"; # Based off of the official github actions builds: https://github.com/Ryujinx/Ryujinx/actions/workflows/release.yml
 
   src = fetchFromGitHub {
     owner = "Ryujinx";
     repo = "Ryujinx";
-    rev = "8d8983049ea23af0600e077b6389e2cd5de74c38";
-    sha256 = "0qhrhc05br4y15kn1spl2s5j1qs1x7jlh7g6sfxhnbhpxzkzghqf";
+    rev = "0137c9e6353b7866153daf2859c48715a5c39349";
+    sha256 = "0rpm2sni7nj9pkw9kwqfgns8g0vgbdfnsxpn40xylz2i7n3b7nn1";
   };
 
   dotnet-sdk = dotnetCorePackages.sdk_8_0;

pkgs/by-name/sp/spade/package.nix

@@ -1,10 +1,12 @@
-{ lib
-, rustPlatform
-, fetchFromGitLab
-, stdenv
-, nix-update
-, writeScript
-, git
+{
+  lib,
+  rustPlatform,
+  fetchFromGitLab,
+  stdenv,
+  nix-update,
+  writeScript,
+  git,
+  python312,
 }:
 
 rustPlatform.buildRustPackage rec {
@@ -39,14 +41,20 @@ rustPlatform.buildRustPackage rec {
     '')
   ];
 
+  buildInputs = lib.optionals stdenv.isDarwin [ python312 ];
+  env.NIX_CFLAGS_LINK = lib.optionals stdenv.isDarwin "-L${python312}/lib/python3.12/config-3.12-darwin -lpython3.12";
+
   meta = with lib; {
     description = "Better hardware description language";
     homepage = "https://gitlab.com/spade-lang/spade";
     changelog = "https://gitlab.com/spade-lang/spade/-/blob/${src.rev}/CHANGELOG.md";
     # compiler is eupl12, spade-lang stdlib is both asl20 and mit
-    license = with licenses; [ eupl12 asl20 mit ];
+    license = with licenses; [
+      eupl12
+      asl20
+      mit
+    ];
     maintainers = with maintainers; [ pbsds ];
     mainProgram = "spade";
-    broken = stdenv.isDarwin; # ld: symbol(s) not found for architecture ${system}
   };
 }

pkgs/by-name/tr/troubadix/package.nix

@@ -7,14 +7,14 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "troubadix";
-  version = "24.7.4";
+  version = "24.8.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "greenbone";
     repo = "troubadix";
     rev = "refs/tags/v${version}";
-    hash = "sha256-WYl2i6ZpFvzRCb47ynnzwn9cS2WE7SjD3/JsMU3/xBM=";
+    hash = "sha256-hH2U+ScR3OspFzbVO4CcQFb/1mn7vRTpvhVeLlAxluM=";
   };
 
   pythonRelaxDeps = [ "validators" ];

pkgs/by-name/wa/walker/package.nix

@@ -12,16 +12,16 @@
 
 buildGoModule rec {
   pname = "walker";
-  version = "0.6.7";
+  version = "0.7.6";
 
   src = fetchFromGitHub {
     owner = "abenz1267";
     repo = "walker";
     rev = "v${version}";
-    hash = "sha256-BuqxodieG5RUSXPkU1tFXiKtweM4uyJV71aIjh7GbVs=";
+    hash = "sha256-cVWBpe+quzZweZkklFgw10CN7/KrhvqPvFpzbuLILzw=";
   };
 
-  vendorHash = "sha256-2t6WXQ5XoDtnlhzc96KeJ2cx+8sVS1oy2z3tsIRGq1Y=";
+  vendorHash = "sha256-xLhpHrggOGq5VLjQO7OvH/Ei5YivJJhTsy2ek2AudRs=";
   subPackages = [ "cmd/walker.go" ];
 
   passthru.updateScript = nix-update-script { };

pkgs/by-name/we/weblate/package.nix

@@ -34,7 +34,7 @@ let
 in
 python.pkgs.buildPythonApplication rec {
   pname = "weblate";
-  version = "5.6.2";
+  version = "5.7";
 
   pyproject = true;
 
@@ -47,7 +47,7 @@ python.pkgs.buildPythonApplication rec {
     owner = "WeblateOrg";
     repo = "weblate";
     rev = "weblate-${version}";
-    sha256 = "sha256-t/hnigsKjdWCkUd8acNWhYVFmZ7oGn74+12347MkFgM=";
+    sha256 = "sha256-h5+0lOMD+H0ehtZ0bngA9bI5va1I5KjZH9boaEtXJPo=";
   };
 
   patches = [
@@ -55,27 +55,15 @@ python.pkgs.buildPythonApplication rec {
     ./cache.lock.patch
   ];
 
-  # Relax dependency constraints
-  # mistletoe: https://github.com/WeblateOrg/weblate/commit/50df46a25dda2b7b39de86d4c65ecd7a685f62e6
-  # borgbackup: https://github.com/WeblateOrg/weblate/commit/355c81c977c59948535a98a35a5c05d7e6909703
-  # django-crispy-forms: https://github.com/WeblateOrg/weblate/commit/7b341c523ed9b3b41ecfbc5c92dd6156992e4f32
-  postPatch = ''
-    substituteInPlace pyproject.toml \
-      --replace '"mistletoe>=1.3.0,<1.4"' '"mistletoe>=1.3.0,<1.5"' \
-      --replace '"borgbackup>=1.2.5,<1.3"' '"borgbackup>=1.2.5,<1.5"' \
-      --replace '"django-crispy-forms>=2.1,<2.3"' '"django-crispy-forms>=2.1,<2.4"'
-  '';
-
   build-system = with python.pkgs; [ setuptools ];
 
   # Build static files into a separate output
   postBuild =
     let
       staticSettings = writeText "static_settings.py" ''
-        STATIC_ROOT = os.environ["static"] + "/static"
-        COMPRESS_ENABLED = True
+        DEBUG = False
+        STATIC_ROOT = os.environ["static"]
         COMPRESS_OFFLINE = True
-        COMPRESS_ROOT = os.environ["static"] + "/compressor-cache"
         # So we don't need postgres dependencies
         DATABASES = {}
       '';
@@ -99,6 +87,7 @@ python.pkgs.buildPythonApplication rec {
     cryptography
     cssselect
     cython
+    cyrtranslit
     diff-match-patch
     django-appconf
     django-celery-beat
@@ -107,6 +96,8 @@ python.pkgs.buildPythonApplication rec {
     django-crispy-forms
     django-filter
     django-redis
+    django-otp
+    django-otp-webauthn
     django
     djangorestframework
     filelock
@@ -117,7 +108,6 @@ python.pkgs.buildPythonApplication rec {
     iniparse
     jsonschema
     lxml
-    misaka
     mistletoe
     nh3
     openpyxl
@@ -131,6 +121,7 @@ python.pkgs.buildPythonApplication rec {
     pyparsing
     python-dateutil
     python-redis-lock
+    qrcode
     rapidfuzz
     redis
     requests

pkgs/by-name/we/wechat-uos/package.nix

@@ -63,6 +63,11 @@
   uosLicense ? null
 }:
 let
+  # zerocallusedregs hardening breaks WeChat
+  glibcWithoutHardening = stdenv.cc.libc.overrideAttrs (old: {
+    hardeningDisable = (old.hardeningDisable or [ ]) ++ [ "zerocallusedregs" ];
+  });
+
   wechat-uos-env = stdenvNoCC.mkDerivation {
     meta.priority = 1;
     name = "wechat-uos-env";
@@ -108,6 +113,9 @@ let
   };
 
   wechat-uos-runtime = with xorg; [
+    # Make sure our glibc without hardening gets picked up first
+    (lib.hiPrio glibcWithoutHardening)
+
     stdenv.cc.cc
     stdenv.cc.libc
     pango
@@ -240,7 +248,7 @@ let
         license = licenses.unfree;
         platforms = [ "x86_64-linux" "aarch64-linux" "loongarch64-linux" ];
         sourceProvenance = with sourceTypes; [ binaryNativeCode ];
-        maintainers = with maintainers; [ pokon548 ];
+        maintainers = with maintainers; [ pokon548 xddxdd ];
         mainProgram = "wechat-uos";
       };
     };

pkgs/by-name/xe/xen-guest-agent/package.nix

@@ -20,17 +20,25 @@ rustPlatform.buildRustPackage rec {
   cargoHash = "sha256-E6QKh4FFr6sLAByU5n6sLppFwPHSKtKffhQ7FfdXAu4=";
 
   nativeBuildInputs = [
+    rustPlatform.bindgenHook
     llvmPackages.clang
     pkg-config
   ];
 
   buildInputs = [ xen-slim ];
 
-  env.LIBCLANG_PATH = "${llvmPackages.libclang.lib}/lib";
+  postInstall =
+    # Install the sample systemd service.
+    ''
+      mkdir --parents $out/lib/systemd/system
+      cp $src/startup/xen-guest-agent.service $out/lib/systemd/system
+      substituteInPlace $out/lib/systemd/system/xen-guest-agent.service \
+        --replace-fail "/usr/sbin/xen-guest-agent" "$out/bin/xen-guest-agent"
+    '';
 
-  postFixup = ''
-    patchelf $out/bin/xen-guest-agent --add-rpath ${xen-slim.out}/lib
-  '';
+  postFixup =
+    # Add the Xen libraries in the runpath so the guest agent can find libxenstore.
+    "patchelf $out/bin/xen-guest-agent --add-rpath ${xen-slim.out}/lib";
 
   meta = {
     description = "Xen agent running in Linux/BSDs (POSIX) VMs";

pkgs/by-name/ze/zerotierone/Cargo.lock

@@ -2855,9 +2855,9 @@ dependencies = [
 
 [[package]]
 name = "time"
-version = "0.3.34"
+version = "0.3.36"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c8248b6521bb14bc45b4067159b9b6ad792e2d6d754d6c41fb50e29fefe38749"
+checksum = "5dfd88e563464686c916c7e46e623e520ddc6d79fa6641390f2e3fa86e83e885"
 dependencies = [
  "deranged",
  "itoa",
@@ -2876,9 +2876,9 @@ checksum = "ef927ca75afb808a4d64dd374f00a2adf8d0fcff8e7b184af886c3c87ec4a3f3"
 
 [[package]]
 name = "time-macros"
-version = "0.2.17"
+version = "0.2.18"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7ba3a3ef41e6672a2f0f001392bb5dcd3ff0a9992d618ca761a11c3121547774"
+checksum = "3f252a68540fde3a3877aeea552b832b40ab9a69e318efd078774a01ddee1ccf"
 dependencies = [
  "num-conv",
  "time-core",

pkgs/by-name/ze/zerotierone/package.nix

@@ -44,7 +44,10 @@ in stdenv.mkDerivation {
     })
     ./0001-darwin-disable-link-time-optimization.patch
   ];
-  postPatch = "cp ${./Cargo.lock} Cargo.lock";
+  postPatch = ''
+    cp ${./Cargo.lock} Cargo.lock
+    cp ${./Cargo.lock} rustybits/Cargo.lock
+  '';
 
 
   preConfigure = ''