Merge remote-tracking branch 'origin/staging-next' into staging

Conflicts:
- pkgs/applications/misc/blender/default.nix
- pkgs/development/web/nodejs/nodejs.nix

.envrc

@@ -0,0 +1 @@
+use nix

.git-blame-ignore-revs

@@ -135,3 +135,6 @@ f8c4a98e8e138e21353a2c33b90db3359f539b37
 acd0e3898feb321cb9a71a0fd376f1157d0f4553
 1b28414d2886c57343864326dbb745a634d3e37d
 6afb255d976f85f3359e4929abd6f5149c323a02
+
+# azure-cli: move to by-name, nixfmt #325950
+96cd538b68bd1d0a0a37979356d669abbba32ebc

.github/CODEOWNERS

@@ -19,6 +19,7 @@
 # Develompent support
 /.editorconfig @Mic92 @zowoq
 /shell.nix @infinisil @NixOS/Security
+/.envrc @infinisil @NixOS/Security
 
 # Libraries
 /lib                        @infinisil

.github/labeler.yml

@@ -74,6 +74,13 @@
         - lib/systems/flake-systems.nix
         - nixos/modules/config/nix-flakes.nix
 
+"6.topic: flutter":
+  - any:
+    - changed-files:
+      - any-glob-to-any-file:
+        - pkgs/build-support/flutter/*.nix
+        - pkgs/development/compilers/flutter/**/*.nix
+
 "6.topic: GNOME":
   - any:
     - changed-files:
@@ -149,7 +156,7 @@
   - any:
     - changed-files:
       - any-glob-to-any-file:
-        - pkgs/development/compilers/llvm/*
+        - pkgs/development/compilers/llvm/**/*
 
 "6.topic: lua":
   - any:

.gitignore

@@ -19,6 +19,7 @@ tags
 /doc/manual.pdf
 /source/
 .version-suffix
+.direnv
 
 .DS_Store
 .mypy_cache

doc/languages-frameworks/index.md

@@ -90,6 +90,7 @@ qt.section.md
 r.section.md
 ruby.section.md
 rust.section.md
+scheme.section.md
 swift.section.md
 texlive.section.md
 titanium.section.md

doc/languages-frameworks/scheme.section.md

@@ -0,0 +1,35 @@
+# Scheme {#sec-scheme}
+
+## Package Management {#sec-scheme-package-management}
+
+### Akku {#sec-scheme-package-management-akku}
+
+About two hundred R6RS & R7RS libraries from [Akku](https://akkuscm.org/)
+(which also mirrors [snow-fort](https://snow-fort.org/pkg))
+are available inside the `akkuPackages` attrset, and the Akku executable
+itself is at the top level as `akku`. The packages could be used
+in a derivation's `buildInputs`, work inside of `nix-shell`, and
+are tested using [Chez](https://www.scheme.com/) &
+[Chibi](https://synthcode.com/wiki/chibi-scheme)
+Scheme during build time.
+
+Including a package as a build input is done in the typical Nix fashion.
+For example, to include
+[a bunch of SRFIs](https://akkuscm.org/packages/chez-srfi/)
+primarily for Chez Scheme in a derivation, one might write:
+
+```nix
+{
+  buildInputs = [
+    chez
+    akkuPackages.chez-srfi
+  ];
+}
+
+```
+
+The package index is located in `pkgs/tools/package-management/akku`
+as `deps.toml`, and should be updated occasionally by running `./update.sh`
+in the directory. Doing so will pull the source URLs for new packages and
+more recent versions, then write them to the TOML.
+

doc/stdenv/stdenv.chapter.md

@@ -1527,7 +1527,11 @@ The following flags are disabled by default and should be enabled with `hardenin
 
 #### `pie` {#pie}
 
-This flag is disabled by default for normal `glibc` based NixOS package builds, but enabled by default for `musl` based package builds.
+This flag is disabled by default for normal `glibc` based NixOS package builds, but enabled by default for
+
+  - `musl`-based package builds, except on Aarch64 and Aarch32, where there are issues.
+
+  - Statically-linked for OpenBSD builds, where it appears to be required to get a working binary.
 
 Adds the `-fPIE` compiler and `-pie` linker options. Position Independent Executables are needed to take advantage of Address Space Layout Randomization, supported by modern kernel versions. While ASLR can already be enforced for data areas in the stack and heap (brk and mmap), the code areas must be compiled as position-independent. Shared libraries already do this with the `pic` flag, so they gain ASLR automatically, but binary .text regions need to be build with `pie` to gain ASLR. When this happens, ROP attacks are much harder since there are no static locations to bounce off of during a memory corruption attack.
 

lib/systems/default.nix

@@ -323,6 +323,7 @@ let
             os =
               /**/ if rust ? platform then rust.platform.os or "none"
               else if final.isDarwin then "macos"
+              else if final.isWasm && !final.isWasi then "unknown" # Needed for {wasm32,wasm64}-unknown-unknown.
               else final.parsed.kernel.name;
 
             # https://doc.rust-lang.org/reference/conditional-compilation.html#target_family

maintainers/maintainer-list.nix

@@ -71,6 +71,12 @@
     github = "0b11stan";
     githubId = 27831931;
   };
+  _0david0mp = {
+    email = "davidmrpr@proton.me";
+    github = "0david0mp";
+    githubId = 54892055;
+    name = "David mp";
+  };
   _0nyr = {
     email = "onyr.maintainer@gmail.com";
     github = "0nyr";
@@ -227,6 +233,12 @@
     githubId = 12578560;
     name = "Quinn Bohner";
   };
+  _71zenith = {
+    email = "71zenith@proton.me";
+    github = "71zenith";
+    githubId = 92977828;
+    name = "Mori Zen";
+  };
   _8aed = {
     email = "8aed@riseup.net";
     github = "8aed";
@@ -5333,6 +5345,12 @@
     githubId = 6199462;
     name = "Dmytro Rets";
   };
+  dretyuiop = {
+    email = "chewch03@gmail.com";
+    github = "dretyuiop";
+    githubId = 81854406;
+    name = "Chew Cheng Hong";
+  };
   drewrisinger = {
     email = "drisinger+nixpkgs@gmail.com";
     github = "drewrisinger";
@@ -8200,6 +8218,12 @@
     githubId = 25618740;
     name = "Vincent Cui";
   };
+  hornwall = {
+    email = "hannes@hornwall.me";
+    github = "hornwall";
+    githubId = 1064477;
+    name = "Hannes Hornwall";
+  };
   hoverbear = {
     email = "operator+nix@hoverbear.org";
     matrix = "@hoverbear:matrix.org";
@@ -15389,6 +15413,12 @@
     githubId = 49961859;
     name = "Pavel Sobolev";
   };
+  pawelchcki = {
+    email = "pawel.chcki@gmail.com";
+    github = "pawelchcki";
+    githubId = 812891;
+    name = "Paweł Chojnacki";
+  };
   pawelpacana = {
     email = "pawel.pacana@gmail.com";
     github = "pawelpacana";
@@ -15464,6 +15494,12 @@
     githubId = 817039;
     name = "Paulo Casaretto";
   };
+  pcboy = {
+    email = "david@joynetiks.com";
+    github = "pcboy";
+    githubId = 943430;
+    name = "David Hagege";
+  };
   pedrohlc = {
     email = "root@pedrohlc.com";
     github = "PedroHLC";
@@ -16496,6 +16532,12 @@
     githubId = 39039420;
     name = "Quinn Dougherty";
   };
+  quodlibetor = {
+    email = "quodlibetor@gmail.com";
+    github = "quodlibetor";
+    githubId = 277161;
+    name = "Brandon W Maister";
+  };
   qusic = {
     email = "qusicx@gmail.com";
     github = "Qusic";
@@ -18482,6 +18524,14 @@
     githubId = 53050011;
     name = "Yohann Boniface";
   };
+  sigmasquadron = {
+    name = "Fernando Rodrigues";
+    email = "alpha@sigmasquadron.net";
+    matrix = "@sigmasquadron:matrix.org";
+    github = "SigmaSquadron";
+    githubId = 174749595;
+    keys = [ { fingerprint = "E3CD E225 47C6 2DB6 6CCD  BC06 CC3A E2EA 0000 0000"; } ];
+  };
   sikmir = {
     email = "sikmir@disroot.org";
     matrix = "@sikmir:matrix.org";
@@ -18913,11 +18963,6 @@
     githubId = 10437171;
     keys = [ { fingerprint = "75F0 AB7C FE01 D077 AEE6  CAFD 353E 4A18 EE0F AB72"; } ];
   };
-  spacefault = {
-    github = "spacefault";
-    githubId = 74156492;
-    name = "spacefault";
-  };
   spacefrogg = {
     email = "spacefrogg-nixos@meterriblecrew.net";
     github = "spacefrogg";
@@ -19768,6 +19813,12 @@
     githubId = 1755789;
     name = "Robert Irelan";
   };
+  tembleking = {
+    name = "Fede Barcelona";
+    email = "fede_rico_94@hotmail.com";
+    github = "tembleking";
+    githubId = 2988780;
+  };
   tengkuizdihar = {
     name = "Tengku Izdihar";
     email = "tengkuizdihar@gmail.com";
@@ -19913,6 +19964,14 @@
     githubId = 34945377;
     name = "John Smith";
   };
+  theCapypara = {
+    name = "Marco Köpcke";
+    email = "hello@capypara.de";
+    matrix = "@capypara:matrix.org";
+    github = "theCapypara";
+    githubId = 3512122;
+    keys = [ { fingerprint = "5F29 132D EFA8 5DA0 B598  5BF2 5941 754C 1CDE 33BB"; } ];
+  };
   thedavidmeister = {
     email = "thedavidmeister@gmail.com";
     github = "thedavidmeister";

maintainers/scripts/luarocks-packages.csv

@@ -6,6 +6,7 @@ argparse,,,,,,
 basexx,,,,,,
 binaryheap,,,,,,vcunat
 busted,,,,,,
+busted-htest,,,,,,mrcjkb
 cassowary,,,,,,alerque
 cldr,,,,,,alerque
 compat53,,,,,,vcunat

nixos/doc/manual/installation/installing.chapter.md

@@ -174,8 +174,6 @@ commands:
 OK
 > set_network 0 psk "mypassword"
 OK
-> set_network 0 key_mgmt WPA-PSK
-OK
 > enable_network 0
 OK
 ```
@@ -191,8 +189,6 @@ OK
 OK
 > set_network 0 password "mypassword"
 OK
-> set_network 0 key_mgmt WPA-EAP
-OK
 > enable_network 0
 OK
 ```

nixos/doc/manual/release-notes/rl-2411.section.md

@@ -20,6 +20,8 @@
 
 - [Flood](https://flood.js.org/), a beautiful WebUI for various torrent clients. Available as [services.flood](options.html#opt-services.flood).
 
+- [QGroundControl], a ground station support and configuration manager for the PX4 and APM Flight Stacks. Available as [programs.qgroundcontrol](options.html#opt-programs.qgroundcontrol.enable).
+
 - [Eintopf](https://eintopf.info), community event and calendar web application. Available as [services.eintopf](options.html#opt-services.eintopf).
 
 - [Renovate](https://github.com/renovatebot/renovate), a dependency updating tool for various git forges and language ecosystems. Available as [services.renovate](#opt-services.renovate.enable).
@@ -30,6 +32,8 @@
 
 - [Playerctld](https://github.com/altdesktop/playerctl), a daemon to track media player activity. Available as [services.playerctld](option.html#opt-services.playerctld).
 
+- [Glance](https://github.com/glanceapp/glance), a self-hosted dashboard that puts all your feeds in one place. Available as [services.glance](option.html#opt-services.glance).
+
 ## Backward Incompatibilities {#sec-release-24.11-incompatibilities}
 
 - `transmission` package has been aliased with a `trace` warning to `transmission_3`. Since [Transmission 4 has been released last year](https://github.com/transmission/transmission/releases/tag/4.0.0), and Transmission 3 will eventually go away, it was decided perform this warning alias to make people aware of the new version. The `services.transmission.package` defaults to `transmission_3` as well because the upgrade can cause data loss in certain specific usage patterns (examples: [#5153](https://github.com/transmission/transmission/issues/5153), [#6796](https://github.com/transmission/transmission/issues/6796)). Please make sure to back up to your data directory per your usage:

nixos/modules/config/shells-environment.nix

@@ -42,8 +42,10 @@ in
         strings.  The latter is concatenated, interspersed with colon
         characters.
       '';
-      type = with types; attrsOf (oneOf [ (listOf (oneOf [ float int str ])) float int str path ]);
-      apply = mapAttrs (n: v: if isList v then concatMapStringsSep ":" toString v else toString v);
+      type = with types; attrsOf (oneOf [ (listOf (oneOf [ int str path ])) int str path ]);
+      apply = let
+        toStr = v: if isPath v then "${v}" else toString v;
+      in mapAttrs (n: v: if isList v then concatMapStringsSep ":" toStr v else toStr v);
     };
 
     environment.profiles = mkOption {

nixos/modules/config/update-users-groups.pl

@@ -234,7 +234,7 @@ foreach my $u (@{$spec->{users}}) {
 
     # Ensure home directory incl. ownership and permissions.
     if ($u->{createHome} and !$is_dry) {
-        make_path($u->{home}, { mode => oct($u->{homeMode}) }) if ! -e $u->{home};
+        make_path($u->{home}, { mode => 0755 }) if ! -e $u->{home};
         chown $u->{uid}, $u->{gid}, $u->{home};
         chmod oct($u->{homeMode}), $u->{home};
     }

nixos/modules/image/repart-image.nix

@@ -69,7 +69,7 @@ let
     patchShebangs --build $out
 
     black --check --diff $out
-    ruff --line-length 88 $out
+    ruff check --line-length 88 $out
     mypy --strict $out
   '';
 

nixos/modules/module-list.nix

@@ -258,6 +258,7 @@
   ./programs/projecteur.nix
   ./programs/proxychains.nix
   ./programs/qdmr.nix
+  ./programs/qgroundcontrol.nix
   ./programs/qt5ct.nix
   ./programs/quark-goldleaf.nix
   ./programs/regreet.nix
@@ -1380,6 +1381,7 @@
   ./services/web-apps/freshrss.nix
   ./services/web-apps/galene.nix
   ./services/web-apps/gerrit.nix
+  ./services/web-apps/glance.nix
   ./services/web-apps/gotify-server.nix
   ./services/web-apps/gotosocial.nix
   ./services/web-apps/grocy.nix

nixos/modules/profiles/qemu-guest.nix

@@ -5,5 +5,5 @@
 
 {
   boot.initrd.availableKernelModules = [ "virtio_net" "virtio_pci" "virtio_mmio" "virtio_blk" "virtio_scsi" "9p" "9pnet_virtio" ];
-  boot.initrd.kernelModules = [ "virtio_balloon" "virtio_console" "virtio_rng" ];
+  boot.initrd.kernelModules = [ "virtio_balloon" "virtio_console" "virtio_rng" "virtio_gpu" ];
 }

nixos/modules/programs/qgroundcontrol.nix

@@ -0,0 +1,53 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+let
+  cfg = config.programs.qgroundcontrol;
+in
+{
+
+  options = {
+    programs.qgroundcontrol = {
+      enable = lib.mkEnableOption "qgroundcontrol";
+
+      package = lib.mkPackageOption pkgs "qgroundcontrol" {};
+
+      blacklistModemManagerFromTTYUSB = lib.mkOption {
+        type = lib.types.bool;
+        default = true;
+        description = ''
+          Disallow ModemManager from interfering with serial connections that QGroundControl might use.
+
+          Note that if you use a modem that's connected via USB, you might want to disable this option.
+        '';
+      };
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    # ModemManager is known to interfere with serial connections;
+    # QGC recommends disabling it, but we don't want to if we can avoid it
+    # Instead, we blacklist tty devices using udev rules, which is a more targeted approach
+    services.udev = lib.mkIf cfg.blacklistModemManagerFromTTYUSB {
+      enable = true;
+      extraRules = ''
+        # nixos/qgroundcontrol: Blacklist ttyUSB devices from ModemManager
+        SUBSYSTEM=="tty", KERNEL=="ttyUSB*", ENV{ID_MM_DEVICE_IGNORE}="1"
+      '';
+    };
+
+    # Security wrapper
+    security.wrappers.qgroundcontrol = {
+      source = lib.getExe cfg.package;
+      owner = "root"; # Sensible default; not setuid so this is not a security risk
+      group = "tty";
+      setgid = true;
+    };
+  };
+
+  meta.maintainers = pkgs.qgroundcontrol.meta.maintainers;
+}

nixos/modules/programs/tsm-client.nix

@@ -22,7 +22,7 @@ let
   serverOptions = { name, config, ... }: {
     freeformType = attrsOf (either scalarType (listOf scalarType));
     # Client system-options file directives are explained here:
-    # https://www.ibm.com/docs/en/storage-protect/8.1.22?topic=commands-processing-options
+    # https://www.ibm.com/docs/en/storage-protect/8.1.23?topic=commands-processing-options
     options.servername = mkOption {
       type = servernameType;
       default = name;

nixos/modules/services/backup/duplicity.nix

@@ -42,6 +42,28 @@ in
       '';
     };
 
+    includeFileList = mkOption {
+      type = types.nullOr types.path;
+      default = null;
+      example = /path/to/fileList.txt;
+      description = ''
+        File containing newline-separated list of paths to include into the
+        backups. See the FILE SELECTION section in {manpage}`duplicity(1)` for
+        details on the syntax.
+      '';
+    };
+
+    excludeFileList = mkOption {
+      type = types.nullOr types.path;
+      default = null;
+      example = /path/to/fileList.txt;
+      description = ''
+        File containing newline-separated list of paths to exclude into the
+        backups. See the FILE SELECTION section in {manpage}`duplicity(1)` for
+        details on the syntax.
+      '';
+    };
+
     targetUrl = mkOption {
       type = types.str;
       example = "s3://host:port/prefix";
@@ -154,6 +176,8 @@ in
             ${lib.optionalString (cfg.cleanup.maxIncr != null) "${dup} remove-all-inc-of-but-n-full ${toString cfg.cleanup.maxIncr} ${target} --force ${extra}"}
             exec ${dup} ${if cfg.fullIfOlderThan == "always" then "full" else "incr"} ${lib.escapeShellArgs (
               [ cfg.root cfg.targetUrl ]
+              ++ lib.optionals (cfg.includeFileList != null) [ "--include-filelist" cfg.includeFileList ]
+              ++ lib.optionals (cfg.excludeFileList != null) [ "--exclude-filelist" cfg.excludeFileList ]
               ++ concatMap (p: [ "--include" p ]) cfg.include
               ++ concatMap (p: [ "--exclude" p ]) cfg.exclude
               ++ (lib.optionals (cfg.fullIfOlderThan != "never" && cfg.fullIfOlderThan != "always") [ "--full-if-older-than" cfg.fullIfOlderThan ])

nixos/modules/services/backup/tsm.nix

@@ -90,7 +90,7 @@ in
       environment.HOME = "/var/lib/tsm-backup";
       serviceConfig = {
         # for exit status description see
-        # https://www.ibm.com/docs/en/storage-protect/8.1.22?topic=clients-client-return-codes
+        # https://www.ibm.com/docs/en/storage-protect/8.1.23?topic=clients-client-return-codes
         SuccessExitStatus = "4 8";
         # The `-se` option must come after the command.
         # The `-optfile` option suppresses a `dsm.opt`-not-found warning.

nixos/modules/services/desktop-managers/lomiri.nix

@@ -22,6 +22,7 @@ in {
         libusermetrics
         lomiri
         lomiri-calculator-app
+        lomiri-clock-app
         lomiri-download-manager
         lomiri-filemanager-app
         lomiri-polkit-agent
@@ -37,7 +38,7 @@ in {
         morph-browser
         qtmir # not having its desktop file for Xwayland available causes any X11 application to crash the session
         suru-icon-theme
-        # telephony-service # currently broken: https://github.com/NixOS/nixpkgs/pull/314043
+        telephony-service
       ]);
       variables = {
         # To override the keyboard layouts in Lomiri
@@ -86,7 +87,7 @@ in {
       ] ++ lib.optionals (config.hardware.pulseaudio.enable || config.services.pipewire.pulse.enable) [
         ayatana-indicator-sound
       ]) ++ (with pkgs.lomiri; [
-        # telephony-service # currently broken: https://github.com/NixOS/nixpkgs/pull/314043
+        telephony-service
       ] ++ lib.optionals config.networking.networkmanager.enable [
         lomiri-indicator-network
       ]);

nixos/modules/services/monitoring/prometheus/exporters.nix

@@ -29,6 +29,7 @@ let
     "blackbox"
     "buildkite-agent"
     "collectd"
+    "deluge"
     "dmarc"
     "dnsmasq"
     "dnssec"
@@ -408,6 +409,14 @@ in
         Please ensure you have either `services.prometheus.exporters.idrac.configuration'
           or `services.prometheus.exporters.idrac.configurationPath' set!
       '';
+    } {
+      assertion = cfg.deluge.enable -> (
+        (cfg.deluge.delugePassword == null) != (cfg.deluge.delugePasswordFile == null)
+      );
+      message = ''
+        Please ensure you have either `services.prometheus.exporters.deluge.delugePassword'
+          or `services.prometheus.exporters.deluge.delugePasswordFile' set!
+      '';
     } ] ++ (flip map (attrNames exporterOpts) (exporter: {
       assertion = cfg.${exporter}.firewallFilter != null -> cfg.${exporter}.openFirewall;
       message = ''
@@ -437,6 +446,13 @@ in
     hardware.rtl-sdr.enable = mkDefault true;
   })] ++ [(mkIf config.services.postfix.enable {
     services.prometheus.exporters.postfix.group = mkDefault config.services.postfix.setgidGroup;
+  })] ++ [(mkIf config.services.prometheus.exporters.deluge.enable {
+    system.activationScripts = {
+      deluge-exported.text = ''
+      mkdir -p /etc/deluge-exporter
+      echo "DELUGE_PASSWORD=$(cat ${config.services.prometheus.exporters.deluge.delugePasswordFile})" > /etc/deluge-exporter/password
+      '';
+    };
   })] ++ (mapAttrsToList (name: conf:
     mkExporterConf {
       inherit name;

nixos/modules/services/monitoring/prometheus/exporters/deluge.nix

@@ -0,0 +1,85 @@
+{ config, lib, pkgs, ... }:
+
+let
+  cfg = config.services.prometheus.exporters.deluge;
+  inherit (lib) mkOption types concatStringsSep;
+in
+{
+  port = 9354;
+
+  extraOpts = {
+    delugeHost = mkOption {
+      type = types.str;
+      default = "localhost";
+      description = ''
+        Hostname where deluge server is running.
+      '';
+    };
+
+    delugePort = mkOption {
+      type = types.port;
+      default = 58846;
+      description = ''
+        Port where deluge server is listening.
+      '';
+    };
+
+    delugeUser = mkOption {
+      type = types.str;
+      default = "localclient";
+      description = ''
+        User to connect to deluge server.
+      '';
+    };
+
+    delugePassword = mkOption {
+      type = types.nullOr types.str;
+      default = null;
+      description = ''
+        Password to connect to deluge server.
+
+        This stores the password unencrypted in the nix store and is thus considered unsafe. Prefer
+        using the delugePasswordFile option.
+      '';
+    };
+
+    delugePasswordFile = mkOption {
+      type = types.nullOr types.path;
+      default = null;
+      description = ''
+        File containing the password to connect to deluge server.
+      '';
+    };
+
+    exportPerTorrentMetrics = mkOption {
+      type = types.bool;
+      default = false;
+      description = ''
+        Enable per-torrent metrics.
+
+        This may significantly increase the number of time series depending on the number of
+        torrents in your Deluge instance.
+      '';
+    };
+  };
+  serviceOpts = {
+    serviceConfig = {
+      ExecStart = ''
+        ${pkgs.prometheus-deluge-exporter}/bin/deluge-exporter
+      '';
+      Environment = [
+        "LISTEN_PORT=${toString cfg.port}"
+        "LISTEN_ADDRESS=${toString cfg.listenAddress}"
+
+        "DELUGE_HOST=${cfg.delugeHost}"
+        "DELUGE_USER=${cfg.delugeUser}"
+        "DELUGE_PORT=${toString cfg.delugePort}"
+      ] ++ lib.optionals (cfg.delugePassword != null) [
+        "DELUGE_PASSWORD=${cfg.delugePassword}"
+      ] ++ lib.optionals cfg.exportPerTorrentMetrics [
+        "PER_TORRENT_METRICS=1"
+      ];
+      EnvironmentFile = lib.optionalString (cfg.delugePasswordFile != null) "/etc/deluge-exporter/password";
+    };
+  };
+}

nixos/modules/services/networking/deconz.nix

@@ -122,6 +122,7 @@ in
         RuntimeDirectory = name;
         RuntimeDirectoryMode = "0700";
         StateDirectory = name;
+        SuccessExitStatus = [ 143 ];
         WorkingDirectory = stateDir;
         # For access to /dev/ttyACM0 (ConBee).
         SupplementaryGroups = [ "dialout" ];

nixos/modules/services/networking/nebula.nix

@@ -51,8 +51,8 @@ in
             };
 
             key = mkOption {
-              type = types.path;
-              description = "Path to the host key.";
+              type = types.oneOf [types.nonEmptyStr types.path];
+              description = "Path or reference to the host key.";
               example = "/etc/nebula/host.key";
             };
 
@@ -241,7 +241,7 @@ in
               ProtectKernelModules = true;
               ProtectKernelTunables = true;
               ProtectProc = "invisible";
-              ProtectSystem = "strict";
+              ProtectSystem = true;
               RestrictNamespaces = true;
               RestrictSUIDSGID = true;
               User = networkId;
@@ -269,4 +269,6 @@ in
       ${nameToId netName} = {};
     }) enabledNetworks);
   };
+
+  meta.maintainers = [ numinit ];
 }

nixos/modules/services/networking/scion/scion-control.nix

@@ -3,8 +3,10 @@
 with lib;
 
 let
+  globalCfg = config.services.scion;
   cfg = config.services.scion.scion-control;
   toml = pkgs.formats.toml { };
+  connectionDir = if globalCfg.stateless then "/run" else "/var/lib";
   defaultConfig = {
     general = {
       id = "cs";
@@ -12,13 +14,13 @@ let
       reconnect_to_dispatcher = true;
     };
     beacon_db = {
-      connection = "/run/scion-control/control.beacon.db";
+      connection = "${connectionDir}/scion-control/control.beacon.db";
     };
     path_db = {
-      connection = "/run/scion-control/control.path.db";
+      connection = "${connectionDir}/scion-control/control.path.db";
     };
     trust_db = {
-      connection = "/run/scion-control/control.trust.db";
+      connection = "${connectionDir}/scion-control/control.trust.db";
     };
     log.console = {
       level = "info";
@@ -62,7 +64,7 @@ in
         DynamicUser = true;
         Restart = "on-failure";
         BindPaths = [ "/dev/shm:/run/shm" ];
-        RuntimeDirectory = "scion-control";
+        ${if globalCfg.stateless then "RuntimeDirectory" else "StateDirectory"} = "scion-control";
       };
     };
   };

nixos/modules/services/networking/scion/scion-daemon.nix

@@ -3,8 +3,10 @@
 with lib;
 
 let
+  globalCfg = config.services.scion;
   cfg = config.services.scion.scion-daemon;
   toml = pkgs.formats.toml { };
+  connectionDir = if globalCfg.stateless then "/run" else "/var/lib";
   defaultConfig = {
     general = {
       id = "sd";
@@ -12,10 +14,10 @@ let
       reconnect_to_dispatcher = true;
     };
     path_db = {
-      connection = "/run/scion-daemon/sd.path.db";
+      connection = "${connectionDir}/scion-daemon/sd.path.db";
     };
     trust_db = {
-      connection = "/run/scion-daemon/sd.trust.db";
+      connection = "${connectionDir}/scion-daemon/sd.trust.db";
     };
     log.console = {
       level = "info";
@@ -57,7 +59,7 @@ in
         ExecStart = "${pkgs.scion}/bin/scion-daemon --config ${configFile}";
         Restart = "on-failure";
         DynamicUser = true;
-        RuntimeDirectory = "scion-daemon";
+        ${if globalCfg.stateless then "RuntimeDirectory" else "StateDirectory"} = "scion-daemon";
       };
     };
   };

nixos/modules/services/networking/scion/scion-dispatcher.nix

@@ -3,6 +3,7 @@
 with lib;
 
 let
+  globalCfg = config.services.scion;
   cfg = config.services.scion.scion-dispatcher;
   toml = pkgs.formats.toml { };
   defaultConfig = {
@@ -66,7 +67,7 @@ in
         ExecStartPre = "${pkgs.coreutils}/bin/rm -rf /run/shm/dispatcher";
         ExecStart = "${pkgs.scion}/bin/scion-dispatcher --config ${configFile}";
         Restart = "on-failure";
-        RuntimeDirectory = "scion-dispatcher";
+        ${if globalCfg.stateless then "RuntimeDirectory" else "StateDirectory"} = "scion-dispatcher";
       };
     };
   };

nixos/modules/services/networking/scion/scion-router.nix

@@ -3,6 +3,7 @@
 with lib;
 
 let
+  globalCfg = config.services.scion;
   cfg = config.services.scion.scion-router;
   toml = pkgs.formats.toml { };
   defaultConfig = {
@@ -42,7 +43,7 @@ in
         ExecStart = "${pkgs.scion}/bin/scion-router --config ${configFile}";
         Restart = "on-failure";
         DynamicUser = true;
-        RuntimeDirectory = "scion-router";
+        ${if globalCfg.stateless then "RuntimeDirectory" else "StateDirectory"} = "scion-router";
       };
     };
   };

nixos/modules/services/networking/scion/scion.nix

@@ -8,6 +8,22 @@ in
 {
   options.services.scion = {
     enable = mkEnableOption "all of the scion components and services";
+    stateless = mkOption {
+      type = types.bool;
+      default = true;
+      description = ''
+        Setting this value to false (stateful) can lead to improved caching and
+        performance.
+
+        This option decides whether to persist the SCION path sqlite databases
+        on disk or not. Persisting this data can lead to database corruption in
+        extreme cases such as power outage, meaning SCION fails to work on the
+        next boot. This is being investigated.
+
+        If true, /run/scion-* is used for data
+        If false, use /var/lib/scion-* is used for data
+      '';
+    };
     bypassBootstrapWarning = mkOption {
       type = types.bool;
       default = false;

nixos/modules/services/security/clamav.nix

@@ -5,7 +5,6 @@ let
   stateDir = "/var/lib/clamav";
   clamavGroup = clamavUser;
   cfg = config.services.clamav;
-  pkg = pkgs.clamav;
 
   toKeyValue = generators.toKeyValue {
     mkKeyValue = generators.mkKeyValueDefault { } " ";
@@ -27,6 +26,7 @@ in
 
   options = {
     services.clamav = {
+      package = mkPackageOption pkgs "clamav" { };
       daemon = {
         enable = mkEnableOption "ClamAV clamd daemon";
 
@@ -125,7 +125,7 @@ in
   };
 
   config = mkIf (cfg.updater.enable || cfg.daemon.enable) {
-    environment.systemPackages = [ pkg ];
+    environment.systemPackages = [ cfg.package ];
 
     users.users.${clamavUser} = {
       uid = config.ids.uids.clamav;
@@ -172,7 +172,7 @@ in
       restartTriggers = [ clamdConfigFile ];
 
       serviceConfig = {
-        ExecStart = "${pkg}/bin/clamd";
+        ExecStart = "${cfg.package}/bin/clamd";
         ExecReload = "${pkgs.coreutils}/bin/kill -USR2 $MAINPID";
         User = clamavUser;
         Group = clamavGroup;
@@ -201,7 +201,7 @@ in
 
       serviceConfig = {
         Type = "oneshot";
-        ExecStart = "${pkg}/bin/freshclam";
+        ExecStart = "${cfg.package}/bin/freshclam";
         SuccessExitStatus = "1"; # if databases are up to date
         StateDirectory = "clamav";
         User = clamavUser;
@@ -274,7 +274,7 @@ in
 
       serviceConfig = {
         Type = "oneshot";
-        ExecStart = "${pkg}/bin/clamdscan --multiscan --fdpass --infected --allmatch ${lib.concatStringsSep " " cfg.scanner.scanDirectories}";
+        ExecStart = "${cfg.package}/bin/clamdscan --multiscan --fdpass --infected --allmatch ${lib.concatStringsSep " " cfg.scanner.scanDirectories}";
       };
     };
   };

nixos/modules/services/web-apps/glance.md

@@ -0,0 +1,39 @@
+# Glance {#module-services-glance}
+
+Glance is a self-hosted dashboard that puts all your feeds in one place.
+
+Visit [the Glance project page](https://github.com/glanceapp/glance) to learn
+more about it.
+
+## Quickstart {#module-services-glance-quickstart}
+
+Checkout the [configuration docs](https://github.com/glanceapp/glance/blob/main/docs/configuration.md) to learn more.
+Use the following configuration to start a public instance of Glance locally:
+
+```nix
+{
+  services.glance = {
+    enable = true;
+    settings = {
+      pages = [
+        {
+          name = "Home";
+          columns = [
+            {
+              size = "full";
+              widgets = [
+                { type = "calendar"; }
+                {
+                  type = "weather";
+                  location = "Nivelles, Belgium";
+                }
+              ];
+            }
+          ];
+        }
+      ];
+    };
+    openFirewall = true;
+  };
+}
+```

nixos/modules/services/web-apps/glance.nix

@@ -0,0 +1,141 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+let
+  cfg = config.services.glance;
+
+  inherit (lib)
+    mkEnableOption
+    mkPackageOption
+    mkOption
+    mkIf
+    getExe
+    types
+    ;
+
+  settingsFormat = pkgs.formats.yaml { };
+in
+{
+  options.services.glance = {
+    enable = mkEnableOption "glance";
+    package = mkPackageOption pkgs "glance" { };
+
+    settings = mkOption {
+      type = types.submodule {
+        freeformType = settingsFormat.type;
+        options = {
+          server = {
+            host = mkOption {
+              description = "Glance bind address";
+              default = "127.0.0.1";
+              example = "0.0.0.0";
+              type = types.str;
+            };
+            port = mkOption {
+              description = "Glance port to listen on";
+              default = 8080;
+              example = 5678;
+              type = types.port;
+            };
+          };
+          pages = mkOption {
+            type = settingsFormat.type;
+            description = ''
+              List of pages to be present on the dashboard.
+
+              See <https://github.com/glanceapp/glance/blob/main/docs/configuration.md#pages--columns>
+            '';
+            default = [
+              {
+                name = "Calendar";
+                columns = [
+                  {
+                    size = "full";
+                    widgets = [ { type = "calendar"; } ];
+                  }
+                ];
+              }
+            ];
+            example = [
+              {
+                name = "Home";
+                columns = [
+                  {
+                    size = "full";
+                    widgets = [
+                      { type = "calendar"; }
+                      {
+                        type = "weather";
+                        location = "Nivelles, Belgium";
+                      }
+                    ];
+                  }
+                ];
+              }
+            ];
+          };
+        };
+      };
+      default = { };
+      description = ''
+        Configuration written to a yaml file that is read by glance. See
+        <https://github.com/glanceapp/glance/blob/main/docs/configuration.md>
+        for more.
+      '';
+    };
+
+    openFirewall = mkOption {
+      type = types.bool;
+      default = false;
+      description = ''
+        Whether to open the firewall for Glance.
+        This adds `services.glance.settings.server.port` to `networking.firewall.allowedTCPPorts`.
+      '';
+    };
+  };
+
+  config = mkIf cfg.enable {
+    systemd.services.glance = {
+      description = "Glance feed dashboard server";
+      wantedBy = [ "multi-user.target" ];
+      after = [ "network.target" ];
+
+      serviceConfig = {
+        ExecStart =
+          let
+            glance-yaml = settingsFormat.generate "glance.yaml" cfg.settings;
+          in
+          "${getExe cfg.package} --config ${glance-yaml}";
+        WorkingDirectory = "/var/lib/glance";
+        StateDirectory = "glance";
+        RuntimeDirectory = "glance";
+        RuntimeDirectoryMode = "0755";
+        PrivateTmp = true;
+        DynamicUser = true;
+        DevicePolicy = "closed";
+        LockPersonality = true;
+        MemoryDenyWriteExecute = true;
+        PrivateUsers = true;
+        ProtectHome = true;
+        ProtectHostname = true;
+        ProtectKernelLogs = true;
+        ProtectKernelModules = true;
+        ProtectKernelTunables = true;
+        ProtectControlGroups = true;
+        ProcSubset = "pid";
+        RestrictNamespaces = true;
+        RestrictRealtime = true;
+        SystemCallArchitectures = "native";
+        UMask = "0077";
+      };
+    };
+
+    networking.firewall = mkIf cfg.openFirewall { allowedTCPPorts = [ cfg.settings.server.port ]; };
+  };
+
+  meta.doc = ./glance.md;
+  meta.maintainers = [ lib.maintainers.drupol ];
+}

nixos/modules/services/web-apps/jitsi-meet.nix

@@ -398,30 +398,29 @@ in
       before = [ "jicofo.service" "jitsi-videobridge2.service" ] ++ (optional cfg.prosody.enable "prosody.service") ++ (optional cfg.jigasi.enable "jigasi.service");
       serviceConfig = {
         Type = "oneshot";
+        UMask = "027";
+        User = "root";
+        Group = "jitsi-meet";
+        WorkingDirectory = "/var/lib/jitsi-meet";
       };
 
       script = let
         secrets = [ "jicofo-component-secret" "jicofo-user-secret" "jibri-auth-secret" "jibri-recorder-secret" ] ++ (optionals cfg.jigasi.enable [ "jigasi-user-secret" "jigasi-component-secret" ]) ++ (optional (cfg.videobridge.passwordFile == null) "videobridge-secret");
       in
       ''
-        cd /var/lib/jitsi-meet
         ${concatMapStringsSep "\n" (s: ''
           if [ ! -f ${s} ]; then
             tr -dc a-zA-Z0-9 </dev/urandom | head -c 64 > ${s}
-            chown root:jitsi-meet ${s}
-            chmod 640 ${s}
           fi
         '') secrets}
 
         # for easy access in prosody
         echo "JICOFO_COMPONENT_SECRET=$(cat jicofo-component-secret)" > secrets-env
         echo "JIGASI_COMPONENT_SECRET=$(cat jigasi-component-secret)" >> secrets-env
-        chown root:jitsi-meet secrets-env
-        chmod 640 secrets-env
       ''
       + optionalString cfg.prosody.enable ''
         # generate self-signed certificates
-        if [ ! -f /var/lib/jitsi-meet.crt ]; then
+        if [ ! -f /var/lib/jitsi-meet/jitsi-meet.crt ]; then
           ${getBin pkgs.openssl}/bin/openssl req \
             -x509 \
             -newkey rsa:4096 \
@@ -430,8 +429,7 @@ in
             -days 36500 \
             -nodes \
             -subj '/CN=${cfg.hostName}/CN=auth.${cfg.hostName}'
-          chmod 640 /var/lib/jitsi-meet/jitsi-meet.{crt,key}
-          chown root:jitsi-meet /var/lib/jitsi-meet/jitsi-meet.{crt,key}
+          chmod 640 /var/lib/jitsi-meet/jitsi-meet.key
         fi
       '';
     };

nixos/modules/services/web-apps/onlyoffice.nix

@@ -1,24 +1,22 @@
 { lib, config, pkgs, ... }:
 
-with lib;
-
 let
   cfg = config.services.onlyoffice;
 in
 {
   options.services.onlyoffice = {
-    enable = mkEnableOption "OnlyOffice DocumentServer";
+    enable = lib.mkEnableOption "OnlyOffice DocumentServer";
 
-    enableExampleServer = mkEnableOption "OnlyOffice example server";
+    enableExampleServer = lib.mkEnableOption "OnlyOffice example server";
 
-    hostname = mkOption {
-      type = types.str;
+    hostname = lib.mkOption {
+      type = lib.types.str;
       default = "localhost";
-      description = "FQDN for the onlyoffice instance.";
+      description = "FQDN for the OnlyOffice instance.";
     };
 
-    jwtSecretFile = mkOption {
-      type = types.nullOr types.str;
+    jwtSecretFile = lib.mkOption {
+      type = lib.types.nullOr lib.types.str;
       default = null;
       description = ''
         Path to a file that contains the secret to sign web requests using JSON Web Tokens.
@@ -26,34 +24,34 @@ in
       '';
     };
 
-    package = mkPackageOption pkgs "onlyoffice-documentserver" { };
+    package = lib.mkPackageOption pkgs "onlyoffice-documentserver" { };
 
-    port = mkOption {
-      type = types.port;
+    port = lib.mkOption {
+      type = lib.types.port;
       default = 8000;
-      description = "Port the OnlyOffice DocumentServer should listens on.";
+      description = "Port the OnlyOffice document server should listen on.";
     };
 
-    examplePort = mkOption {
-      type = types.port;
+    examplePort = lib.mkOption {
+      type = lib.types.port;
       default = null;
-      description = "Port the OnlyOffice Example server should listens on.";
+      description = "Port the OnlyOffice example server should listen on.";
     };
 
-    postgresHost = mkOption {
-      type = types.str;
+    postgresHost = lib.mkOption {
+      type = lib.types.str;
       default = "/run/postgresql";
       description = "The Postgresql hostname or socket path OnlyOffice should connect to.";
     };
 
-    postgresName = mkOption {
-      type = types.str;
+    postgresName = lib.mkOption {
+      type = lib.types.str;
       default = "onlyoffice";
-      description = "The name of database OnlyOffice should user.";
+      description = "The name of database OnlyOffice should use.";
     };
 
-    postgresPasswordFile = mkOption {
-      type = types.nullOr types.str;
+    postgresPasswordFile = lib.mkOption {
+      type = lib.types.nullOr lib.types.str;
       default = null;
       description = ''
         Path to a file that contains the password OnlyOffice should use to connect to Postgresql.
@@ -61,8 +59,8 @@ in
       '';
     };
 
-    postgresUser = mkOption {
-      type = types.str;
+    postgresUser = lib.mkOption {
+      type = lib.types.str;
       default = "onlyoffice";
       description = ''
         The username OnlyOffice should use to connect to Postgresql.
@@ -70,8 +68,8 @@ in
       '';
     };
 
-    rabbitmqUrl = mkOption {
-      type = types.str;
+    rabbitmqUrl = lib.mkOption {
+      type = lib.types.str;
       default = "amqp://guest:guest@localhost:5672";
       description = "The Rabbitmq in amqp URI style OnlyOffice should connect to.";
     };
@@ -80,10 +78,10 @@ in
   config = lib.mkIf cfg.enable {
     services = {
       nginx = {
-        enable = mkDefault true;
+        enable = lib.mkDefault true;
         # misses text/csv, font/ttf, application/x-font-ttf, application/rtf, application/wasm
-        recommendedGzipSettings = mkDefault true;
-        recommendedProxySettings = mkDefault true;
+        recommendedGzipSettings = lib.mkDefault true;
+        recommendedProxySettings = lib.mkDefault true;
 
         upstreams = {
           # /etc/nginx/includes/http-common.conf

nixos/tests/all-tests.nix

@@ -323,6 +323,7 @@ in {
   firefox-devedition = handleTest ./firefox.nix { firefoxPackage = pkgs.firefox-devedition; };
   firefox-esr    = handleTest ./firefox.nix { firefoxPackage = pkgs.firefox-esr; }; # used in `tested` job
   firefox-esr-115 = handleTest ./firefox.nix { firefoxPackage = pkgs.firefox-esr-115; };
+  firefox-esr-128 = handleTest ./firefox.nix { firefoxPackage = pkgs.firefox-esr-128; };
   firefoxpwa = handleTest ./firefoxpwa.nix {};
   firejail = handleTest ./firejail.nix {};
   firewall = handleTest ./firewall.nix { nftables = false; };
@@ -363,6 +364,7 @@ in {
   gitlab = runTest ./gitlab.nix;
   gitolite = handleTest ./gitolite.nix {};
   gitolite-fcgiwrap = handleTest ./gitolite-fcgiwrap.nix {};
+  glance = runTest ./glance.nix;
   glusterfs = handleTest ./glusterfs.nix {};
   gnome = handleTest ./gnome.nix {};
   gnome-extensions = handleTest ./gnome-extensions.nix {};
@@ -525,6 +527,7 @@ in {
   #logstash = handleTest ./logstash.nix {};
   lomiri = handleTest ./lomiri.nix {};
   lomiri-calculator-app = runTest ./lomiri-calculator-app.nix;
+  lomiri-clock-app = runTest ./lomiri-clock-app.nix;
   lomiri-filemanager-app = runTest ./lomiri-filemanager-app.nix;
   lomiri-system-settings = handleTest ./lomiri-system-settings.nix {};
   lorri = handleTest ./lorri/default.nix {};

nixos/tests/ayatana-indicators.nix

@@ -35,7 +35,7 @@ in {
         ayatana-indicator-sound
       ] ++ (with pkgs.lomiri; [
         lomiri-indicator-network
-        # telephony-service # currently broken: https://github.com/NixOS/nixpkgs/pull/314043
+        telephony-service
       ]);
     };
 

nixos/tests/glance.nix

@@ -0,0 +1,36 @@
+{ lib, ... }:
+
+{
+  name = "glance";
+
+  nodes = {
+    machine_default =
+      { pkgs, ... }:
+      {
+        services.glance = {
+          enable = true;
+        };
+      };
+
+    machine_custom_port =
+      { pkgs, ... }:
+      {
+        services.glance = {
+          enable = true;
+          settings.server.port = 5678;
+        };
+      };
+  };
+
+  testScript = ''
+    machine_default.start()
+    machine_default.wait_for_unit("glance.service")
+    machine_default.wait_for_open_port(8080)
+
+    machine_custom_port.start()
+    machine_custom_port.wait_for_unit("glance.service")
+    machine_custom_port.wait_for_open_port(5678)
+  '';
+
+  meta.maintainers = [ lib.maintainers.drupol ];
+}

nixos/tests/lomiri-clock-app.nix

@@ -0,0 +1,48 @@
+{ pkgs, lib, ... }:
+{
+  name = "lomiri-clock-app-standalone";
+  meta.maintainers = lib.teams.lomiri.members;
+
+  nodes.machine =
+    { config, pkgs, ... }:
+    {
+      imports = [ ./common/x11.nix ];
+
+      services.xserver.enable = true;
+
+      environment = {
+        systemPackages = with pkgs.lomiri; [
+          suru-icon-theme
+          lomiri-clock-app
+        ];
+        variables = {
+          UITK_ICON_THEME = "suru";
+        };
+      };
+
+      i18n.supportedLocales = [ "all" ];
+
+      fonts.packages = with pkgs; [
+        # Intended font & helps with OCR
+        ubuntu_font_family
+      ];
+    };
+
+  enableOCR = true;
+
+  testScript = ''
+    machine.wait_for_x()
+
+    with subtest("lomiri clock launches"):
+        machine.execute("lomiri-clock-app >&2 &")
+        machine.wait_for_text(r"(clock.ubports|City|Alarms)")
+        machine.screenshot("lomiri-clock_open")
+
+    machine.succeed("pkill -f lomiri-clock-app")
+
+    with subtest("lomiri clock localisation works"):
+        machine.execute("env LANG=de_DE.UTF-8 lomiri-clock-app >&2 &")
+        machine.wait_for_text(r"(Stadt|Weckzeiten)")
+        machine.screenshot("lomiri-clock_localised")
+  '';
+}

nixos/tests/prometheus-exporters.nix

@@ -209,6 +209,34 @@ let
         '';
     };
 
+    deluge = {
+      exporterConfig = {
+        enable = true;
+        port = 1234;
+        listenAddress = "127.0.0.1";
+
+        delugeUser = "user";
+        delugePort = 2345;
+        delugePasswordFile = pkgs.writeText "password" "weak_password";
+      };
+      metricProvider = {
+        services.deluge.enable = true;
+        services.deluge.declarative = true;
+        services.deluge.config.daemon_port = 2345;
+        services.deluge.authFile = pkgs.writeText "authFile" ''
+        localclient:abcdef:10
+        user:weak_password:10
+        '';
+      };
+      exporterTest = ''
+        wait_for_unit("deluged.service")
+        wait_for_open_port(2345)
+        wait_for_unit("prometheus-deluge-exporter.service")
+        wait_for_open_port(1234)
+        succeed("curl -sSf http://localhost:1234 | grep 'deluge_torrents'")
+      '';
+    };
+
     dnsmasq = {
       exporterConfig = {
         enable = true;

nixos/tests/systemd-boot-ovmf-broken-fat-driver.patch

@@ -1,25 +0,0 @@
-From d87a7513c6f2f2824203032ef27caeb84892ed7e Mon Sep 17 00:00:00 2001
-From: Will Fancher <elvishjerricco@gmail.com>
-Date: Tue, 30 May 2023 16:53:20 -0400
-Subject: [PATCH] Intentionally break the fat driver
-
----
- FatPkg/EnhancedFatDxe/ReadWrite.c | 5 +++++
- 1 file changed, 5 insertions(+)
-
-diff --git a/FatPkg/EnhancedFatDxe/ReadWrite.c b/FatPkg/EnhancedFatDxe/ReadWrite.c
-index 8f525044d1f1..32c62ff7817b 100644
---- a/FatPkg/EnhancedFatDxe/ReadWrite.c
-+++ b/FatPkg/EnhancedFatDxe/ReadWrite.c
-@@ -216,6 +216,11 @@ FatIFileAccess (
-   Volume = OFile->Volume;
-   Task   = NULL;
- 
-+  if (*BufferSize > (10U * 1024U * 1024U)) {
-+    IFile->Position += 10U * 1024U * 1024U;
-+    return EFI_BAD_BUFFER_SIZE;
-+  }
-+
-   //
-   // Write to a directory is unsupported
-   //

nixos/tests/systemd-boot.nix

@@ -239,7 +239,7 @@ in
 
   memtest86 = makeTest {
     name = "systemd-boot-memtest86";
-    meta.maintainers = with pkgs.lib.maintainers; [ Enzime julienmalka ];
+    meta.maintainers = with pkgs.lib.maintainers; [ julienmalka ];
 
     nodes.machine = { pkgs, lib, ... }: {
       imports = [ common ];
@@ -254,7 +254,7 @@ in
 
   netbootxyz = makeTest {
     name = "systemd-boot-netbootxyz";
-    meta.maintainers = with pkgs.lib.maintainers; [ Enzime julienmalka ];
+    meta.maintainers = with pkgs.lib.maintainers; [ julienmalka ];
 
     nodes.machine = { pkgs, lib, ... }: {
       imports = [ common ];
@@ -269,7 +269,7 @@ in
 
   memtestSortKey = makeTest {
     name = "systemd-boot-memtest-sortkey";
-    meta.maintainers = with pkgs.lib.maintainers; [ Enzime julienmalka ];
+    meta.maintainers = with pkgs.lib.maintainers; [ julienmalka ];
 
     nodes.machine = { pkgs, lib, ... }: {
       imports = [ common ];
@@ -307,7 +307,7 @@ in
 
   extraEntries = makeTest {
     name = "systemd-boot-extra-entries";
-    meta.maintainers = with pkgs.lib.maintainers; [ Enzime julienmalka ];
+    meta.maintainers = with pkgs.lib.maintainers; [ julienmalka ];
 
     nodes.machine = { pkgs, lib, ... }: {
       imports = [ common ];
@@ -326,7 +326,7 @@ in
 
   extraFiles = makeTest {
     name = "systemd-boot-extra-files";
-    meta.maintainers = with pkgs.lib.maintainers; [ Enzime julienmalka ];
+    meta.maintainers = with pkgs.lib.maintainers; [ julienmalka ];
 
     nodes.machine = { pkgs, lib, ... }: {
       imports = [ common ];
@@ -343,7 +343,7 @@ in
 
   switch-test = makeTest {
     name = "systemd-boot-switch-test";
-    meta.maintainers = with pkgs.lib.maintainers; [ Enzime julienmalka ];
+    meta.maintainers = with pkgs.lib.maintainers; [ julienmalka ];
 
     nodes = {
       inherit common;
@@ -428,32 +428,6 @@ in
       '';
   };
 
-  # Some UEFI firmwares fail on large reads. Now that systemd-boot loads initrd
-  # itself, systems with such firmware won't boot without this fix
-  uefiLargeFileWorkaround = makeTest {
-    name = "uefi-large-file-workaround";
-    meta.maintainers = with pkgs.lib.maintainers; [ julienmalka ];
-    nodes.machine = { pkgs, ... }: {
-      imports = [common];
-      virtualisation.efi.OVMF = pkgs.OVMF.overrideAttrs (old: {
-        # This patch deliberately breaks the FAT driver in EDK2 to
-        # exhibit (part of) the firmware bug that we are testing
-        # for. Files greater than 10MiB will fail to be read in a
-        # single Read() call, so systemd-boot will fail to load the
-        # initrd without a workaround. The number 10MiB was chosen
-        # because if it were smaller than the kernel size, even the
-        # LoadImage call would fail, which is not the failure mode
-        # we're testing for. It needs to be between the kernel size
-        # and the initrd size.
-        patches = old.patches or [] ++ [ ./systemd-boot-ovmf-broken-fat-driver.patch ];
-      });
-    };
-
-    testScript = ''
-      machine.wait_for_unit("multi-user.target")
-    '';
-  };
-
   no-bootspec = makeTest
     {
       name = "systemd-boot-no-bootspec";

nixos/tests/user-home-mode.nix

@@ -12,6 +12,12 @@ import ./make-test-python.nix ({ lib, ... }: {
       isNormalUser = true;
       homeMode = "750";
     };
+    users.users.carol = {
+      initialPassword = "pass3";
+      isNormalUser = true;
+      createHome = true;
+      home = "/users/carol";
+    };
   };
 
   testScript = ''
@@ -23,5 +29,7 @@ import ./make-test-python.nix ({ lib, ... }: {
     machine.send_chars("pass1\n")
     machine.succeed('[ "$(stat -c %a /home/alice)" == "700" ]')
     machine.succeed('[ "$(stat -c %a /home/bob)" == "750" ]')
+    machine.succeed('[ "$(stat -c %a /users)" == "755" ]')
+    machine.succeed('[ "$(stat -c %a /users/carol)" == "700" ]')
   '';
 })

nixos/tests/vaultwarden.nix

@@ -209,7 +209,6 @@ builtins.mapAttrs (k: v: makeVaultwardenTest k v) {
           server.succeed('[ -f "/var/lib/vaultwarden/backups/db.sqlite3" ]')
           server.succeed('[ -d "/var/lib/vaultwarden/backups/attachments" ]')
           server.succeed('[ -f "/var/lib/vaultwarden/backups/rsa_key.pem" ]')
-          server.succeed('[ -f "/var/lib/vaultwarden/backups/rsa_key.pub.pem" ]')
           # Ensure only the db backed up with the backup command exists and not the other db files.
           server.succeed('[ ! -f "/var/lib/vaultwarden/backups/db.sqlite3-shm" ]')
     '';

nixos/tests/vscode-remote-ssh.nix

@@ -14,7 +14,7 @@ import ./make-test-python.nix ({ lib, ... }@args: let
   inherit (pkgs.vscode.passthru) rev vscodeServer;
 in {
   name = "vscode-remote-ssh";
-  meta.maintainers = with lib.maintainers; [ Enzime ];
+  meta.maintainers = with lib.maintainers; [ ];
 
   nodes = let
     serverAddress = "192.168.0.2";

pkgs/applications/audio/audacious/default.nix

@@ -1,26 +1,28 @@
 { lib
 , stdenv
 , audacious-plugins
-, fetchurl
-, gettext
+, fetchFromGitHub
 , meson
 , ninja
 , pkg-config
 , qtbase
+, qtsvg
+, qtwayland
 , wrapQtAppsHook
 }:
 
 stdenv.mkDerivation rec {
   pname = "audacious";
-  version = "4.3.1";
+  version = "4.4";
 
-  src = fetchurl {
-    url = "http://distfiles.audacious-media-player.org/audacious-${version}.tar.bz2";
-    sha256 = "sha256-heniaEFQW1HjQu5yotBfGb74lPVnoCnrs/Pgwa20IEI=";
+  src = fetchFromGitHub {
+    owner = "audacious-media-player";
+    repo = "audacious";
+    rev = "${pname}-${version}";
+    hash = "sha256-qAJztvNI3uGmQfECJJ7tJ/xLLgMU5OiW0O3ZSJhvt0k=";
   };
 
   nativeBuildInputs = [
-    gettext
     meson
     ninja
     pkg-config
@@ -29,6 +31,8 @@ stdenv.mkDerivation rec {
 
   buildInputs = [
     qtbase
+    qtsvg
+    qtwayland
   ];
 
   mesonFlags = [
@@ -41,12 +45,14 @@ stdenv.mkDerivation rec {
     ln -s ${audacious-plugins}/share/audacious/Skins $out/share/audacious/
   '';
 
-  meta = with lib; {
+  meta = {
     description = "Lightweight and versatile audio player";
-    homepage = "https://audacious-media-player.org/";
-    maintainers = with maintainers; [ eelco ramkromberg ttuegel thiagokokada ];
-    platforms = with platforms; linux;
-    license = with licenses; [
+    homepage = "https://audacious-media-player.org";
+    downloadPage = "https://github.com/audacious-media-player/audacious";
+    mainProgram = "audacious";
+    maintainers = with lib.maintainers; [ eelco ramkromberg ttuegel thiagokokada ];
+    platforms = lib.platforms.linux;
+    license = with lib.licenses; [
       bsd2
       bsd3 #https://github.com/audacious-media-player/audacious/blob/master/COPYING
       gpl2

pkgs/applications/audio/audacious/plugins.nix

@@ -1,5 +1,5 @@
 { stdenv
-, fetchurl
+, fetchFromGitHub
 , alsa-lib
 , audacious
 , curl
@@ -8,7 +8,6 @@
 , flac
 , fluidsynth
 , gdk-pixbuf
-, gettext
 , lame
 , libbs2b
 , libcddb
@@ -39,7 +38,7 @@
 , pipewire
 , qtbase
 , qtmultimedia
-, qtx11extras
+, qtwayland
 , soxr
 , vgmstream
 , wavpack
@@ -47,17 +46,18 @@
 
 stdenv.mkDerivation rec {
   pname = "audacious-plugins";
-  version = "4.3.1";
+  version = "4.4";
 
-  src = fetchurl {
-    url = "http://distfiles.audacious-media-player.org/audacious-plugins-${version}.tar.bz2";
-    sha256 = "sha256-Leom469YOi1oTfJAsnsrKTK81lPfTbUAqF9P5dX9yKY=";
+  src = fetchFromGitHub {
+    owner = "audacious-media-player";
+    repo = "audacious-plugins";
+    rev = "${pname}-${version}";
+    hash = "sha256-J9jgBl8J4W9Yvrlg1KlzYgGTmdxUZM9L11rCftKFSlE=";
   };
 
   patches = [ ./0001-Set-plugindir-to-PREFIX-lib-audacious.patch ];
 
   nativeBuildInputs = [
-    gettext
     meson
     ninja
     pkg-config
@@ -98,7 +98,7 @@ stdenv.mkDerivation rec {
     pipewire
     qtbase
     qtmultimedia
-    qtx11extras
+    qtwayland
     soxr
     wavpack
     libopenmpt
@@ -116,5 +116,6 @@ stdenv.mkDerivation rec {
 
   meta = audacious.meta // {
     description = "Plugins for Audacious music player";
+    downloadPage = "https://github.com/audacious-media-player/audacious-plugins";
   };
 }

pkgs/applications/audio/mopidy/spotify.nix

@@ -1,35 +1,62 @@
-{ lib, fetchFromGitHub, pythonPackages, mopidy, unstableGitUpdater }:
+{
+  lib,
+  fetchFromGitHub,
+  pythonPackages,
+  mopidy,
+  nix-update-script,
+}:
 
 pythonPackages.buildPythonApplication rec {
   pname = "mopidy-spotify";
-  version = "4.1.1-unstable-2024-02-27";
+  version = "5.0.0a2";
+  pyproject = true;
 
   src = fetchFromGitHub {
     owner = "mopidy";
     repo = "mopidy-spotify";
-    rev = "112d4abbb3f5b6477dab796f2824fa42196bfa0a";
-    hash = "sha256-RkXDzAbOOll3uCNZ2mFRnjqMkT/NkXOGjywLRTC9i60=";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-QeABG9rQKJ8sIoK38R74N0s5rRG+zws7AZR0xPysdcY=";
   };
 
-  propagatedBuildInputs = [
+  build-system = [ pythonPackages.setuptools ];
+
+  dependencies = [
     mopidy
-    pythonPackages.responses
+    pythonPackages.pykka
+    pythonPackages.requests
   ];
 
-  nativeBuildInputs = [
-    pythonPackages.pytestCheckHook
-  ];
+  optional-dependencies = {
+    lint = with pythonPackages; [
+      black
+      check-manifest
+      flake8
+      flake8-bugbear
+      isort
+    ];
+
+    test = with pythonPackages; [
+      pytest
+      pytest-cov
+      responses
+    ];
+
+    dev = optional-dependencies.lint ++ optional-dependencies.test ++ [ pythonPackages.tox ];
+  };
+
+  nativeCheckInputs = [ pythonPackages.pytestCheckHook ] ++ optional-dependencies.test;
 
   pythonImportsCheck = [ "mopidy_spotify" ];
 
-  passthru.updateScript = unstableGitUpdater {
-    tagPrefix = "v";
+  passthru = {
+    updateScript = nix-update-script { };
   };
 
-  meta = with lib; {
-    homepage = "https://github.com/mopidy/mopidy-spotify";
+  meta = {
     description = "Mopidy extension for playing music from Spotify";
-    license = licenses.asl20;
-    maintainers = with maintainers; [ ];
+    homepage = "https://github.com/mopidy/mopidy-spotify";
+    changelog = "https://github.com/mopidy/mopidy-spotify/releases/tag/v${version}";
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ getchoo ];
   };
 }

pkgs/applications/audio/mopidy/youtube.nix

@@ -1,8 +1,10 @@
-{ lib
-, fetchFromGitHub
-, python3
-, mopidy
-, extraPkgs ? pkgs: []
+{
+  lib,
+  fetchFromGitHub,
+  python3,
+  mopidy,
+  yt-dlp,
+  extraPkgs ? pkgs: [ ],
 }:
 
 python3.pkgs.buildPythonApplication rec {
@@ -17,22 +19,36 @@ python3.pkgs.buildPythonApplication rec {
     hash = "sha256-iFt7r8Ljymc+grNJiOClTHkZOeo7AcYpcNc8tLMPROk=";
   };
 
-  propagatedBuildInputs = with python3.pkgs; [
-    beautifulsoup4
-    cachetools
-    pykka
-    requests
-    youtube-dl
-    ytmusicapi
-  ] ++ [
-    mopidy
-  ] ++ extraPkgs pkgs;
+  propagatedBuildInputs =
+    with python3.pkgs;
+    [
+      beautifulsoup4
+      cachetools
+      pykka
+      requests
+      ytmusicapi
+    ]
+    ++ [
+      mopidy
+      yt-dlp
+    ]
+    ++ extraPkgs pkgs;
 
   nativeCheckInputs = with python3.pkgs; [
     vcrpy
     pytestCheckHook
   ];
 
+  postPatch = ''
+    substituteInPlace mopidy_youtube/youtube.py \
+      --replace-fail 'youtube_dl_package = "youtube_dl"' 'youtube_dl_package = "yt_dlp"'
+    substituteInPlace tests/conftest.py \
+      --replace-fail 'import youtube_dl' 'import yt_dlp' \
+      --replace-fail 'patcher = mock.patch.object(youtube, "youtube_dl", spec=youtube_dl)' \
+      'patcher = mock.patch.object(youtube, "youtube_dl", spec=yt_dlp)' \
+      --replace-fail '"youtube_dl_package": "youtube_dl",' '"youtube_dl_package": "yt_dlp",'
+  '';
+
   disabledTests = [
     # Test requires a YouTube API key
     "test_get_default_config"
@@ -45,9 +61,7 @@ python3.pkgs.buildPythonApplication rec {
     "tests/test_youtube.py"
   ];
 
-  pythonImportsCheck = [
-    "mopidy_youtube"
-  ];
+  pythonImportsCheck = [ "mopidy_youtube" ];
 
   meta = with lib; {
     description = "Mopidy extension for playing music from YouTube";

pkgs/applications/audio/musikcube/default.nix

@@ -1,94 +0,0 @@
-{ asio
-, cmake
-, curl
-, fetchFromGitHub
-, ffmpeg
-, gnutls
-, lame
-, lib
-, libev
-, game-music-emu
-, libmicrohttpd
-, libopenmpt
-, mpg123
-, ncurses
-, pkg-config
-, portaudio
-, stdenv
-, taglib
-# Linux Dependencies
-, alsa-lib
-, pipewireSupport ? !stdenv.hostPlatform.isDarwin, pipewire
-, pulseaudio
-, sndioSupport ? true, sndio
-, systemd
-, systemdSupport ? lib.meta.availableOn stdenv.hostPlatform systemd
-# Darwin Dependencies
-, Cocoa
-, SystemConfiguration
-, coreaudioSupport ? stdenv.hostPlatform.isDarwin, CoreAudio
-}:
-
-stdenv.mkDerivation rec {
-  pname = "musikcube";
-  version = "3.0.2";
-
-  src = fetchFromGitHub {
-    owner = "clangen";
-    repo = pname;
-    rev = version;
-    hash = "sha512-IakZy6XsAE39awjzQI+R11JCPeQSaibx6+uX8Iea5WdlCundeovnPwSAi6RzzZl9dr2UftzzEiF4Aun8VMtqVA==";
-  };
-
-  outputs = [ "out" "dev" ];
-
-  nativeBuildInputs = [
-    cmake
-    pkg-config
-  ];
-
-  buildInputs = [
-    asio
-    curl
-    ffmpeg
-    gnutls
-    lame
-    libev
-    game-music-emu
-    libmicrohttpd
-    libopenmpt
-    mpg123
-    ncurses
-    portaudio
-    taglib
-  ] ++ lib.optionals systemdSupport [
-    systemd
-  ] ++ lib.optionals stdenv.isLinux [
-    alsa-lib pulseaudio
-  ] ++ lib.optionals stdenv.isDarwin [
-    Cocoa SystemConfiguration
-  ] ++ lib.optionals coreaudioSupport [
-    CoreAudio
-  ] ++ lib.optionals sndioSupport [
-    sndio
-  ] ++ lib.optionals pipewireSupport [
-    pipewire
-  ];
-
-  cmakeFlags = [
-    "-DDISABLE_STRIP=true"
-  ];
-
-  postFixup = lib.optionalString stdenv.isDarwin ''
-    install_name_tool -add_rpath $out/share/${pname} $out/share/${pname}/${pname}
-    install_name_tool -add_rpath $out/share/${pname} $out/share/${pname}/${pname}d
-  '';
-
-  meta = {
-    description = "Terminal-based music player, library, and streaming audio server";
-    homepage = "https://musikcube.com/";
-    maintainers = with lib.maintainers; [ aanderse afh ];
-    license = lib.licenses.bsd3;
-    platforms = lib.platforms.all;
-  };
-}

pkgs/applications/audio/sfxr-qt/default.nix

@@ -1,41 +1,29 @@
 { lib
 , mkDerivation
 , fetchFromGitHub
-, fetchpatch
 , cmake
 , extra-cmake-modules
 , qtbase
 , qtquickcontrols2
 , SDL
 , python3
-, catch2
+, catch2_3
 , callPackage
 , nixosTests
 }:
 
 mkDerivation rec {
   pname = "sfxr-qt";
-  version = "1.5.0";
+  version = "1.5.1";
 
   src = fetchFromGitHub {
     owner = "agateau";
     repo = "sfxr-qt";
     rev = version;
-    sha256 = "sha256-Ce5NJe1f+C4pPmtenHYvtkxste+nPuxJoB+N7K2nyRo=";
+    sha256 = "sha256-JAWDk7mGkPtQ5yaA6UT9hlAy770MHrTBhBP9G8UqFKg=";
     fetchSubmodules = true;
   };
 
-  postPatch = ''
-    cp ${catch2}/include/catch2/catch.hpp 3rdparty/catch2/single_include/catch2/catch.hpp
-  '';
-
-  # Remove on next release
-  patches = [(fetchpatch {
-    name = "sfxr-qr-missing-qpainterpath-include";
-    url = "https://github.com/agateau/sfxr-qt/commit/ef051f473654052112b647df987eb263e38faf47.patch";
-    sha256 = "sha256-bqMnxHUzdS5oG/2hfr5MvkpwrtZW+GTN5fS2WpV2W2c=";
-  })];
-
   nativeBuildInputs = [
     cmake
     extra-cmake-modules
@@ -48,6 +36,14 @@ mkDerivation rec {
     SDL
   ];
 
+  checkInputs = [
+    catch2_3
+  ];
+
+  cmakeFlags = [
+    (lib.cmakeBool "USE_SYSTEM_CATCH2" true)
+  ];
+
   doCheck = true;
 
   passthru.tests = {

pkgs/applications/audio/snd/default.nix

@@ -5,11 +5,11 @@
 
 stdenv.mkDerivation rec {
   pname = "snd";
-  version = "24.4";
+  version = "24.5";
 
   src = fetchurl {
     url = "mirror://sourceforge/snd/snd-${version}.tar.gz";
-    sha256 = "sha256-nP4ngNUQvveSQBEqXlzYdaqD0SGzTDPwIiWhSabRu+8=";
+    sha256 = "sha256-Y497KAlUXtWhkrCd1QrqJkvWGwnzZfYRKaALiEo/7EI=";
   };
 
   nativeBuildInputs = [ pkg-config ];

pkgs/applications/audio/soundsource/default.nix

@@ -29,7 +29,7 @@ stdenvNoCC.mkDerivation (finalAttrs: {
     homepage = "https://rogueamoeba.com/soundsource";
     license = licenses.unfree;
     sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
-    maintainers = with maintainers; [ emilytrau Enzime ];
+    maintainers = with maintainers; [ emilytrau ];
     platforms = platforms.darwin;
   };
 })

pkgs/applications/audio/spotify-player/default.nix

@@ -24,6 +24,7 @@
 , withImage ? true
 , withNotify ? true
 , withSixel ? true
+, withFuzzy ? true
 , stdenv
 , darwin
 , makeBinaryWrapper
@@ -33,16 +34,16 @@ assert lib.assertOneOf "withAudioBackend" withAudioBackend [ "" "alsa" "pulseaud
 
 rustPlatform.buildRustPackage rec {
   pname = "spotify-player";
-  version = "0.18.2";
+  version = "0.19.1";
 
   src = fetchFromGitHub {
     owner = "aome510";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-bLUPQgqSsE9tF5YiFj5B+Ylyy96DhWFNjwqXbQ9H8uc=";
+    hash = "sha256-R8F7s8FPnCe+shNUN/u0qcxFy3IbyfVo2xZ5/E/qwaw=";
   };
 
-  cargoHash = "sha256-rptGA7J63rHdmxuPIguhZYYs8tZbpidJ0fXroBBoEIM=";
+  cargoHash = "sha256-7vximGisIIXBrwHXSWQjO08OraaweG7ZT6v+gVdYGVc=";
 
   nativeBuildInputs = [
     pkg-config
@@ -83,7 +84,8 @@ rustPlatform.buildRustPackage rec {
     ++ lib.optionals withDaemon [ "daemon" ]
     ++ lib.optionals withNotify [ "notify" ]
     ++ lib.optionals withStreaming [ "streaming" ]
-    ++ lib.optionals withSixel [ "sixel" ];
+    ++ lib.optionals withSixel [ "sixel" ]
+    ++ lib.optionals withFuzzy [ "fzf" ];
 
   # sixel-sys is dynamically linked to libsixel
   postInstall = lib.optionals (stdenv.isDarwin && withSixel) ''
@@ -97,6 +99,6 @@ rustPlatform.buildRustPackage rec {
     changelog = "https://github.com/aome510/spotify-player/releases/tag/v${version}";
     mainProgram = "spotify_player";
     license = lib.licenses.mit;
-    maintainers = with lib.maintainers; [ dit7ya xyven1 ];
+    maintainers = with lib.maintainers; [ dit7ya xyven1 _71zenith ];
   };
 }

pkgs/applications/audio/spotify/darwin.nix

@@ -36,6 +36,6 @@ stdenv.mkDerivation {
   '';
 
   meta = meta // {
-    maintainers = with lib.maintainers; [ Enzime ];
+    maintainers = with lib.maintainers; [ matteopacini ];
   };
 }

pkgs/applications/backup/ludusavi/default.nix

@@ -23,16 +23,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "ludusavi";
-  version = "0.24.1";
+  version = "0.24.3";
 
   src = fetchFromGitHub {
     owner = "mtkennerly";
     repo = "ludusavi";
     rev = "v${version}";
-    hash = "sha256-nRNXVJJcpZmAfZwDEBaEFlry1gbITWEw0khtsXnMdm0=";
+    hash = "sha256-FtLLj5uFcKuRTCSsSuyj0XGzFMVWQvVk4dTmBCmzfNs=";
   };
 
-  cargoHash = "sha256-E5TaE4TlRA0wmRUiwFqivs18X6oiBCmeXrPI1GxKFBI=";
+  cargoHash = "sha256-xC6HiXt8cfrDtno9IrOe8SP7WBL79paLI223fjxPsbg=";
 
   nativeBuildInputs = [
     cmake

pkgs/applications/blockchains/go-ethereum/default.nix

@@ -9,17 +9,17 @@ let
 
 in buildGoModule rec {
   pname = "go-ethereum";
-  version = "1.14.5";
+  version = "1.14.6";
 
   src = fetchFromGitHub {
     owner = "ethereum";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-IY0BKoDRMVRZTIysdUgqhTFQx0Pz+kl61vbPbhSdT8k=";
+    sha256 = "sha256-X9XwVZpRnkp7oVKwyvQbs8ZaWwLkuLEEHNfV5BvfVvI=";
   };
 
   proxyVendor = true;
-  vendorHash = "sha256-vzxtoLlD1RjmKBpMPqcH/AAzk2l/NifpRl4Sp4qBYLg=";
+  vendorHash = "sha256-UP+bQM8ydfbILlVhuNPVIKLyXZFTzGmHizn2hYgNE4Y=";
 
   doCheck = false;
 

pkgs/applications/blockchains/haven-cli/default.nix

@@ -8,13 +8,13 @@
 
 stdenv.mkDerivation rec {
   pname = "haven-cli";
-  version = "3.3.4";
+  version = "4.0.0";
 
   src = fetchFromGitHub {
     owner = "haven-protocol-org";
     repo = "haven-main";
     rev = "v${version}";
-    sha256 = "sha256-jKeLFWJDwS8WWRynkDgBjvjq2EDpTEJadwkNsANQXws=";
+    sha256 = "sha256-craPgQtavSatoVzduIQCWuakIBeXWFWa9E0ALau4AcI=";
     fetchSubmodules = true;
   };
 

pkgs/applications/blockchains/polkadot/default.nix

@@ -17,13 +17,13 @@ let
 in
 rustPlatform.buildRustPackage rec {
   pname = "polkadot";
-  version = "1.13.0";
+  version = "1.14.0";
 
   src = fetchFromGitHub {
     owner = "paritytech";
     repo = "polkadot-sdk";
     rev = "polkadot-v${version}";
-    hash = "sha256-9ZjiKv+05//Kf6q3mL1P5kOCOm1KCGmQIZkrD54pyeI=";
+    hash = "sha256-IKKhGjWHyHUrDVGJo1d1JXzagkydgdfd/u6jk76qxHU=";
 
     # the build process of polkadot requires a .git folder in order to determine
     # the git commit hash that is being built and add it to the version string.

pkgs/applications/editors/cpeditor/default.nix

@@ -29,6 +29,7 @@ stdenv.mkDerivation rec {
 
   postPatch = ''
     substituteInPlace src/Core/Runner.cpp --replace-fail "/bin/bash" "${runtimeShell}"
+    substituteInPlace dist/linux/cpeditor.desktop --replace-fail 'Exec=/usr/bin/cpeditor' "Exec=cpeditor"
   '';
 
   meta = with lib; {

pkgs/applications/editors/emacs/elisp-packages/recipes-archive-melpa.json

@@ -91627,11 +91627,11 @@
   "repo": "ksqsf/org-xlatex",
   "unstable": {
    "version": [
-    20230820,
-    2133
+    20240707,
+    1343
    ],
-   "commit": "f3cac5ea904e78ae2b47723fdce96e8e87edbe7c",
-   "sha256": "06y7lapsp4s9h07hdsd8wigmy6r5l36qiqwmz7j1n8zp3r8xg0pw"
+   "commit": "8f25ba5e4784b3f12f5ac5c69b1a1d0695c53b8e",
+   "sha256": "1cg11gqisigpa9prkm05z7wlajffzmhjiymg7frbibhrskhfhrp0"
   }
  },
  {

pkgs/applications/editors/jetbrains/plugins/plugins.json

@@ -511,6 +511,37 @@
       },
       "name": "visual-studio-keymap"
     },
+    "14004": {
+      "compatible": [
+        "clion",
+        "datagrip",
+        "goland",
+        "idea-community",
+        "idea-ultimate",
+        "mps",
+        "phpstorm",
+        "pycharm-community",
+        "pycharm-professional",
+        "rider",
+        "ruby-mine",
+        "rust-rover",
+        "webstorm"
+      ],
+      "builds": {
+        "233.13135.1068": null,
+        "241.17011.169": "https://plugins.jetbrains.com/files/14004/523287/protoeditor-241.15989.49.zip",
+        "241.17890.14": "https://plugins.jetbrains.com/files/14004/523287/protoeditor-241.15989.49.zip",
+        "241.17890.24": "https://plugins.jetbrains.com/files/14004/523287/protoeditor-241.15989.49.zip",
+        "241.18034.45": "https://plugins.jetbrains.com/files/14004/523287/protoeditor-241.15989.49.zip",
+        "241.18034.50": "https://plugins.jetbrains.com/files/14004/523287/protoeditor-241.15989.49.zip",
+        "241.18034.61": "https://plugins.jetbrains.com/files/14004/523287/protoeditor-241.15989.49.zip",
+        "241.18034.62": "https://plugins.jetbrains.com/files/14004/523287/protoeditor-241.15989.49.zip",
+        "241.18034.63": "https://plugins.jetbrains.com/files/14004/523287/protoeditor-241.15989.49.zip",
+        "241.18034.69": "https://plugins.jetbrains.com/files/14004/523287/protoeditor-241.15989.49.zip",
+        "241.18034.76": "https://plugins.jetbrains.com/files/14004/523287/protoeditor-241.15989.49.zip"
+      },
+      "name": "protocol-buffers"
+    },
     "14059": {
       "compatible": [
         "clion",
@@ -661,6 +692,7 @@
     "https://plugins.jetbrains.com/files/13017/445774/keymap-visualStudio-233.11799.165.zip": "sha256-Nb2tSxL+mAY1qJ3waipgV8ep+0R/BaYnzz7zfwtLHmk=",
     "https://plugins.jetbrains.com/files/13017/508253/keymap-visualStudio-241.14494.150.zip": "sha256-tNgt0vIkdCB/LcaSj58mT6cNlw4lytRo0cZSt7sIERU=",
     "https://plugins.jetbrains.com/files/14059/82616/darcula-pitch-black.jar": "sha256-eXInfAqY3yEZRXCAuv3KGldM1pNKEioNwPB0rIGgJFw=",
+    "https://plugins.jetbrains.com/files/14004/523287/protoeditor-241.15989.49.zip": "sha256-cltbHY5OOvf29otDNsF9Q2shJHDdW6UMbzDdZ6OATtI=",
     "https://plugins.jetbrains.com/files/164/546759/IdeaVim-2.12.0-signed.zip": "sha256-6ibo1vdwO4olQTCWpWAefT3QCwgtzTo1ojilDes8Rvg=",
     "https://plugins.jetbrains.com/files/17718/561438/github-copilot-intellij-1.5.11.5872.zip": "sha256-4bYtBaLvcXZv8eVfG09ywSbcP+7SUb4j+NZ5mb2aluE=",
     "https://plugins.jetbrains.com/files/18444/165585/NetBeans6.5Keymap.zip": "sha256-KrzZTKZMQqoEMw+vDUv2jjs0EX0leaPBkU8H/ecq/oI=",

pkgs/applications/editors/quartus-prime/quartus.nix

@@ -102,6 +102,6 @@ in stdenv.mkDerivation rec {
     sourceProvenance = with sourceTypes; [ binaryNativeCode ];
     license = licenses.unfree;
     platforms = [ "x86_64-linux" ];
-    maintainers = with maintainers; [ kwohlfahrt ];
+    maintainers = with maintainers; [ bjornfor kwohlfahrt ];
   };
 }

pkgs/applications/editors/vim/plugins/generated.nix

@@ -6035,6 +6035,18 @@ final: prev:
     meta.homepage = "https://github.com/chentoast/marks.nvim/";
   };
 
+  markview-nvim = buildVimPlugin {
+    pname = "markview.nvim";
+    version = "2024-06-28";
+    src = fetchFromGitHub {
+      owner = "OXY2DEV";
+      repo = "markview.nvim";
+      rev = "f60219dce7283192d549f21847fcf8537bf6d260";
+      sha256 = "E1lHSjbnOOIeieaFJ+INvxJHCbfVS3mwbQ6wrlKeGSQ=";
+    };
+    meta.homepage = "https://github.com/OXY2DEV/markview.nvim";
+  };
+
   mason-lspconfig-nvim = buildVimPlugin {
     pname = "mason-lspconfig.nvim";
     version = "2024-06-12";
@@ -9280,6 +9292,18 @@ final: prev:
     meta.homepage = "https://github.com/nvim-lua/popup.nvim/";
   };
 
+  precognition-nvim = buildVimPlugin {
+    pname = "precognition.nvim";
+    version = "2024-06-25";
+    src = fetchFromGitHub {
+      owner = "tris203";
+      repo = "precognition.nvim";
+      rev = "2a566f03eb06859298eff837f3a6686dfa5304a5";
+      sha256 = "XLcyRB4ow5nPoQ0S29bx0utV9Z/wogg7c3rozYSqlWE=";
+    };
+    meta.homepage = "https://github.com/tris203/precognition.nvim";
+  };
+
   presence-nvim = buildVimPlugin {
     pname = "presence.nvim";
     version = "2023-01-29";
@@ -9640,6 +9664,18 @@ final: prev:
     meta.homepage = "https://github.com/filipdutescu/renamer.nvim/";
   };
 
+  render-markdown = buildVimPlugin {
+    pname = "render-markdown";
+    version = "2024-07-07";
+    src = fetchFromGitHub {
+      owner = "MeanderingProgrammer";
+      repo = "markdown.nvim";
+      rev = "0dfd0203e0125f959f28f03932495d0d82443b65";
+      sha256 = "08fnyg1cnar5v9jw26xqq0k9qmyk2ir3snr74bps4scpjzb8cg6j";
+    };
+    meta.homepage = "https://github.com/MeanderingProgrammer/markdown.nvim/";
+  };
+
   replacer-nvim = buildVimPlugin {
     pname = "replacer.nvim";
     version = "2023-07-29";

pkgs/applications/editors/vim/plugins/overrides.nix

@@ -408,12 +408,12 @@
 
   codesnap-nvim =
     let
-      version = "1.4.1";
+      version = "1.5.2";
       src = fetchFromGitHub {
         owner = "mistricky";
         repo = "codesnap.nvim";
         rev = "refs/tags/v${version}";
-        hash = "sha256-KttvOfMieO+lBEgvkrBztWg7pUm/gFxYaTVXAQv15IM=";
+        hash = "sha256-r6/2pbojfzBdMoZHphE6BX5cEiCAmOWurPBptI6jjcw=";
       };
       codesnap-lib = rustPlatform.buildRustPackage {
         pname = "codesnap-lib";
@@ -421,7 +421,7 @@
 
         sourceRoot = "${src.name}/generator";
 
-        cargoHash = "sha256-IZtWfyDZEaFSuj3uXBhBuGPi4IN1Dwt0ZkMSoxAum5c=";
+        cargoHash = "sha256-E8EywpyRSoknXSebnvqP178ZgAIahJeD5siD46KM/Mc=";
 
         nativeBuildInputs = [
           pkg-config

pkgs/applications/editors/vim/plugins/vim-plugin-names

@@ -502,9 +502,11 @@ https://github.com/nvim-neorocks/lz.n/,,
 https://github.com/WhiteBlackGoose/magma-nvim-goose/,HEAD,
 https://github.com/winston0410/mark-radar.nvim/,HEAD,
 https://github.com/iamcco/markdown-preview.nvim/,,
+https://github.com/MeanderingProgrammer/markdown.nvim/,,render-markdown
 https://github.com/tadmccorkle/markdown.nvim/,HEAD,
 https://github.com/David-Kunz/markid/,HEAD,
 https://github.com/chentoast/marks.nvim/,,
+https://github.com/OXY2DEV/markview.nvim/,HEAD,
 https://github.com/williamboman/mason-lspconfig.nvim/,HEAD,
 https://github.com/WhoIsSethDaniel/mason-tool-installer.nvim/,HEAD,
 https://github.com/williamboman/mason.nvim/,HEAD,
@@ -779,6 +781,7 @@ https://github.com/olivercederborg/poimandres.nvim/,HEAD,
 https://github.com/dleonard0/pony-vim-syntax/,,
 https://github.com/RishabhRD/popfix/,,
 https://github.com/nvim-lua/popup.nvim/,,
+https://github.com/tris203/precognition.nvim/,HEAD,
 https://github.com/andweeb/presence.nvim/,,
 https://github.com/sotte/presenting.vim/,,
 https://github.com/ewilazarus/preto/,HEAD,

pkgs/applications/editors/vscode/extensions/default.nix

@@ -2176,7 +2176,7 @@ let
           downloadPage = "https://marketplace.visualstudio.com/items?itemName=GraphQL.vscode-graphql";
           homepage = "https://github.com/graphql/graphiql/tree/main/packages/vscode-graphql";
           license = lib.licenses.mit;
-          maintainers = [ lib.maintainers.Enzime ];
+          maintainers = [ ];
         };
       };
 
@@ -2192,7 +2192,7 @@ let
           downloadPage = "https://marketplace.visualstudio.com/items?itemName=GraphQL.vscode-graphql-syntax";
           homepage = "https://github.com/graphql/graphiql/tree/main/packages/vscode-graphql-syntax";
           license = lib.licenses.mit;
-          maintainers = [ lib.maintainers.Enzime ];
+          maintainers = [ ];
         };
       };
 

pkgs/applications/editors/vscode/extensions/ms-python.vscode-pylance/default.nix

@@ -8,8 +8,8 @@ vscode-utils.buildVscodeMarketplaceExtension {
   mktplcRef = {
     name = "vscode-pylance";
     publisher = "MS-python";
-    version = "2024.6.1";
-    hash = "sha256-NOx0WJC32MUm6TmLkiN67FHKwBmB0S3feFVIQNxR2PQ=";
+    version = "2024.7.1";
+    hash = "sha256-hheuv4S399Kn/HNvaFZ8ynbR90eR4Z+NxNef0T9rGq0=";
   };
 
   buildInputs = [ pyright ];

pkgs/applications/editors/vscode/extensions/ms-toolsai.jupyter/default.nix

@@ -9,8 +9,8 @@ vscode-utils.buildVscodeMarketplaceExtension {
   mktplcRef = {
     name = "jupyter";
     publisher = "ms-toolsai";
-    version = "2024.5.0";
-    hash = "sha256-bGHXbqv+YXC8NUXIY+bxFsMvoV6h8E2/2F6Ku4bJwT0=";
+    version = "2024.6.0";
+    hash = "sha256-T+8K/NbuWYnJk+cXekiDpmpnZAJ7jl/nqPQgWQ49mco=";
   };
 
   nativeBuildInputs = [

pkgs/applications/editors/vscode/extensions/myriad-dreamin.tinymist/default.nix

@@ -11,7 +11,7 @@ vscode-utils.buildVscodeMarketplaceExtension {
     name = "tinymist";
     publisher = "myriad-dreamin";
     inherit (tinymist) version;
-    hash = "sha256-e/7HAvaohATDet7ynYc34e5cbOzBL5Rcjvimggs68c4=";
+    hash = "sha256-byylRSPfuMBsZsnV/cUJFKrPWiLZFPKGB20Stpe6b0Y=";
   };
 
   nativeBuildInputs = [

pkgs/applications/editors/vscode/vscode.nix

@@ -97,7 +97,7 @@ in
       homepage = "https://code.visualstudio.com/";
       downloadPage = "https://code.visualstudio.com/Updates";
       license = licenses.unfree;
-      maintainers = with maintainers; [ eadwu synthetica bobby285271 Enzime ];
+      maintainers = with maintainers; [ eadwu synthetica bobby285271 johnrtitor ];
       platforms = [ "x86_64-linux" "x86_64-darwin" "aarch64-darwin" "aarch64-linux" "armv7l-linux" ];
     };
   }

pkgs/applications/editors/your-editor/default.nix

@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "your-editor";
-  version = "1506";
+  version = "1600";
 
   src = fetchFromGitHub {
     owner = "your-editor";
     repo = "yed";
     rev = version;
-    sha256 = "sha256-QmUquXoDGhoan+Y1kdkTirdkIvYPBkeAEkMLkaE9QKk=";
+    sha256 = "sha256-bSW0ZAPIBDh3+VhAJlp16W1z4fEIPUkI73grJE/KUx4=";
   };
 
   installPhase = ''

pkgs/applications/emulators/retroarch/hashes.json

@@ -85,10 +85,10 @@
         "src": {
             "owner": "libretro",
             "repo": "beetle-psx-libretro",
-            "rev": "6f0ef7be0a023842b98ab5a8e7c7b5e4b2c31573",
-            "hash": "sha256-5jYDNuW0XjWTHTEEUkxK0DnQgvH2dZLUot/lmix05hk="
+            "rev": "a90ceba8339c73abc2f28ff20ec65fce16904816",
+            "hash": "sha256-8e2Qw34+Y1cRxQWATj4F7+SzZEVlwk0Uoo9GHYOM8l4="
         },
-        "version": "unstable-2024-06-29"
+        "version": "unstable-2024-07-05"
     },
     "beetle-saturn": {
         "fetcher": "fetchFromGitHub",
@@ -155,20 +155,20 @@
         "src": {
             "owner": "libretro",
             "repo": "bluemsx-libretro",
-            "rev": "df29d437204af0a5158b6ecb2d6b68296f8d979a",
-            "hash": "sha256-ULDnLHbEQ1+VR3axfbVaH4Kkuq/UDBA9JGuW9beraZ4="
+            "rev": "1f6b5b393df17e746bec118902b1d1f6ed3e4109",
+            "hash": "sha256-yndOlTf4OKUP98L1EN+LW4mwtl6LWQ95ILYo8Y+2Geg="
         },
-        "version": "unstable-2024-05-20"
+        "version": "unstable-2024-06-28"
     },
     "bsnes": {
         "fetcher": "fetchFromGitHub",
         "src": {
             "owner": "libretro",
             "repo": "bsnes-libretro",
-            "rev": "c5963607b59c8d56d28bb4de3f7ac555e004c69e",
-            "hash": "sha256-YmOy2iaQYqaIp4u4cIQx8Z8jUqaIhPdJZTFgSETQprs="
+            "rev": "83591216128368943c509f028d06bc0277c5752d",
+            "hash": "sha256-7y7ZmEigiOIGFKCNJFLWQFT8Tp4oXe3lbVOrprfLzR8="
         },
-        "version": "unstable-2024-06-21"
+        "version": "unstable-2024-07-05"
     },
     "bsnes-hd": {
         "fetcher": "fetchFromGitHub",
@@ -246,10 +246,10 @@
         "src": {
             "owner": "schellingb",
             "repo": "dosbox-pure",
-            "rev": "00e3ed7e361afbab03363e493f5aa643e0bb2577",
-            "hash": "sha256-w57U5W4m8AZFujiY3L2uUFZQ7NsRzMU9NRPUerJk/9A="
+            "rev": "bcb46c4a8803028d5f64935e80433338464dfc0f",
+            "hash": "sha256-ce3QcKonKsuGolB2RhKlWYtHI2Et54/ITG27UkWgQn8="
         },
-        "version": "unstable-2024-06-29"
+        "version": "unstable-2024-07-07"
     },
     "easyrpg": {
         "fetcher": "fetchFromGitHub",
@@ -287,31 +287,31 @@
         "src": {
             "owner": "libretro",
             "repo": "fbneo",
-            "rev": "634d207adade213bbe83684be2a183d158f56e52",
-            "hash": "sha256-hmnb7euH2VfGnF8ztGFhXYmqaCY49APDG0Y3s4ku7Ac="
+            "rev": "b63598f8120f280db24c3af5433274c6a2eb6d91",
+            "hash": "sha256-2fD2+VhibQGZM7twN2JHc1K4/502v1ZzmmZrE8ODLYk="
         },
-        "version": "unstable-2024-06-02"
+        "version": "unstable-2024-07-08"
     },
     "fceumm": {
         "fetcher": "fetchFromGitHub",
         "src": {
             "owner": "libretro",
             "repo": "libretro-fceumm",
-            "rev": "9e685cda1372204048d831ef5976972dfb2dc541",
-            "hash": "sha256-O+FEHPuXybyMCMdvm9UdrZvl5K1yiFx2HIyhN3AuyVo="
+            "rev": "d2557ae061d7251bf3fff69ec943077d1711ad16",
+            "hash": "sha256-wGbmdSSRc9lZ+K89q/cS8AvSLpfZbVsXByojdnoVSqo="
         },
-        "version": "unstable-2024-06-28"
+        "version": "unstable-2024-07-05"
     },
     "flycast": {
         "fetcher": "fetchFromGitHub",
         "src": {
             "owner": "flyinghead",
             "repo": "flycast",
-            "rev": "7d645541f8f8b7f4550eabe9157d8fb82b43c1a7",
-            "hash": "sha256-/RLh6FO3lk6L1yhTMGLt7sjY/vwlb1y2XxmtgO5+uOk=",
+            "rev": "c6f50fad9d4bb735f02444fddb14f53cfb6bacfc",
+            "hash": "sha256-okcCxM8lyaVAMAVzcuGEWAeQvwh9IqOqFpqQYJ6gReY=",
             "fetchSubmodules": true
         },
-        "version": "unstable-2024-06-23"
+        "version": "unstable-2024-07-05"
     },
     "fmsx": {
         "fetcher": "fetchFromGitHub",
@@ -328,20 +328,20 @@
         "src": {
             "owner": "libretro",
             "repo": "freeintv",
-            "rev": "85bf25a39a34bbc39fe36677175d87c2b597dbe7",
-            "hash": "sha256-4cU/YRZZb7EWNBJX8M91Lb+bCCIlks6xX2Cf6Iq/g9g="
+            "rev": "6bd91d0d83d896e66b9fd7e5e239f93f00e4ad87",
+            "hash": "sha256-P3devj/aAa0e/QpV68kQkLAvhrVGO8O8ijkUAobgUb0="
         },
-        "version": "unstable-2023-04-17"
+        "version": "unstable-2024-06-28"
     },
     "fuse": {
         "fetcher": "fetchFromGitHub",
         "src": {
             "owner": "libretro",
             "repo": "fuse-libretro",
-            "rev": "9fc41a5f153e1f2fa2dbcfdd215c7ec97d98a29c",
-            "hash": "sha256-eEgPnSIpKC7s+4JoEHDGPlwYPa5Y8EpoxmNhyOIIcU8="
+            "rev": "4d511d7fc3faa7714fa5de2e824793d35d5f4da8",
+            "hash": "sha256-mfCv7PvroPqzJ/nXCa74h0c7lHlbTVnJM3rNIj3UvQI="
         },
-        "version": "unstable-2024-06-16"
+        "version": "unstable-2024-06-28"
     },
     "gambatte": {
         "fetcher": "fetchFromGitHub",
@@ -398,31 +398,31 @@
         "src": {
             "owner": "libretro",
             "repo": "hatari",
-            "rev": "a4c9eb0bb79e47a2870c12b04566c1f8d25e4bf3",
-            "hash": "sha256-mHz2nB9Vr/PVifd6w+kz7ZCH+N8igmcS8InvevZoSpE="
+            "rev": "c10a21dbe99277b06ccf7de10eceb74f5d57e921",
+            "hash": "sha256-R5N7EUVUKJ1GXQtnlCCE33DlDsxMzpPp6pYUHJJ/5Ig="
         },
-        "version": "unstable-2023-09-29"
+        "version": "unstable-2024-06-28"
     },
     "mame": {
         "fetcher": "fetchFromGitHub",
         "src": {
             "owner": "libretro",
             "repo": "mame",
-            "rev": "db65a583bd2da39514a544c58362a6ac170179ac",
-            "hash": "sha256-FTsoLsx7IhyAw/pdaGAeNzysc7vZ3CcyXKWcBJ0pOb8=",
+            "rev": "1e31f3a77644341e0ff9065aff3bc249fb024978",
+            "hash": "sha256-NqSPyyGRK1knL/RZ1Md8JjT3W6gRBpomgZiIH2Mp3co=",
             "fetchSubmodules": true
         },
-        "version": "unstable-2024-06-13"
+        "version": "unstable-2024-07-07"
     },
     "mame2000": {
         "fetcher": "fetchFromGitHub",
         "src": {
             "owner": "libretro",
             "repo": "mame2000-libretro",
-            "rev": "905808fbcc3adf8c610c1c60f0e41ce4b35db1c5",
-            "hash": "sha256-2J3QGlSb4YhDZND4T0wmt9zzDjOuNiscsMxn9zA1TtI="
+            "rev": "2ec60f6e1078cf9ba173e80432cc28fd4eea200f",
+            "hash": "sha256-AYZj7bvO9oc7wmEBbj6DPRzpQFHl8diIcunSSpD4Vok="
         },
-        "version": "unstable-2024-05-07"
+        "version": "unstable-2024-07-01"
     },
     "mame2003": {
         "fetcher": "fetchFromGitHub",
@@ -439,10 +439,10 @@
         "src": {
             "owner": "libretro",
             "repo": "mame2003-plus-libretro",
-            "rev": "015fbd88bfd92c3847749fee01e8725f53c007ef",
-            "hash": "sha256-6wzi/r9bBKzxMmXQ4mHSzlnI5D9l87BuhHwM7HTvGr4="
+            "rev": "85edcf558832f0e0e0fcf61ebe0b8d041ef6a0c1",
+            "hash": "sha256-AlscqXw8sV3yrMNPOjtwW8BjBKhXtfNYaLpEMZexq5g="
         },
-        "version": "unstable-2024-06-30"
+        "version": "unstable-2024-07-08"
     },
     "mame2010": {
         "fetcher": "fetchFromGitHub",
@@ -529,11 +529,11 @@
         "src": {
             "owner": "Javanaise",
             "repo": "mrboom-libretro",
-            "rev": "a7af125dc9ef65c9a1b43136a75374bbac5458ee",
-            "hash": "sha256-hPJ8MpJOPGkckB0rj1uQ9BmY+0//Lj9jfNA9hfpdu3o=",
+            "rev": "22765ce7176d236d846f504318a51c448d2b469b",
+            "hash": "sha256-hzdc4PM/EARNEtpeATo4VohXtkeBra6rCz3tdIgBfVw=",
             "fetchSubmodules": true
         },
-        "version": "unstable-2024-05-19"
+        "version": "unstable-2024-07-01"
     },
     "mupen64plus": {
         "fetcher": "fetchFromGitHub",
@@ -611,10 +611,10 @@
         "src": {
             "owner": "libretro",
             "repo": "parallel-n64",
-            "rev": "dfc8d55686a364cad85411dabb76c7fb94acd730",
+            "rev": "334998e6129debe50f7ef9c5cd1e995460ae2da8",
             "hash": "sha256-ngENgmBQFHUYRp9DBnQLWapvfhnFra/B+jeegm8+rtE="
         },
-        "version": "unstable-2024-06-18"
+        "version": "unstable-2024-06-29"
     },
     "pcsx2": {
         "fetcher": "fetchFromGitHub",
@@ -663,11 +663,11 @@
         "src": {
             "owner": "hrydgard",
             "repo": "ppsspp",
-            "rev": "c737eca1a7a0628523bcf710e2fa0a4288c31352",
-            "hash": "sha256-RSPyxhw27qL7FMgNqoGLGRiVue+BPB/huA2SvMMES+w=",
+            "rev": "0b76d443e2c6992107666111d6c0ab994a39451d",
+            "hash": "sha256-PMt8zqDbGhVUeHIA2uvBvQAfsaCwZzVcnLT8fJ6Fexo=",
             "fetchSubmodules": true
         },
-        "version": "unstable-2024-06-29"
+        "version": "unstable-2024-07-02"
     },
     "prboom": {
         "fetcher": "fetchFromGitHub",
@@ -704,10 +704,10 @@
         "src": {
             "owner": "libretro",
             "repo": "QuickNES_Core",
-            "rev": "cd73f021be7dd5b1a21b71155a320364c02de4ac",
-            "hash": "sha256-fmTAK32ASA8M5nxUUUilm/yMNkmqSAG/gauB7fy1Kbc="
+            "rev": "89d649a544e7d37a5cdbc77c811e88753fa23131",
+            "hash": "sha256-OPZVYQVbtIfmmKmuLQ5eVqZf+41ovyoa17YHvjKgd6w="
         },
-        "version": "unstable-2024-02-01"
+        "version": "unstable-2024-06-28"
     },
     "same_cdi": {
         "fetcher": "fetchFromGitHub",
@@ -754,10 +754,10 @@
         "src": {
             "owner": "snes9xgit",
             "repo": "snes9x",
-            "rev": "d514d135a7d3521e16e9ea599690e36e95c5c1aa",
-            "hash": "sha256-qk73jA8J6QD9Fp1tjqEf3eDLhJxp206gsku42ICjqPY="
+            "rev": "921f9f7b83660eb44ad263022a57a4a029057c37",
+            "hash": "sha256-trKxGE1WDG7JM7qbhd4o9nvSW6noYobU7nZ/Nz2NeS8="
         },
-        "version": "unstable-2024-06-18"
+        "version": "unstable-2024-07-07"
     },
     "snes9x2002": {
         "fetcher": "fetchFromGitHub",
@@ -784,10 +784,10 @@
         "src": {
             "owner": "libretro",
             "repo": "snes9x2010",
-            "rev": "d8b10c4cd7606ed58f9c562864c986bc960faaaf",
-            "hash": "sha256-7FmteYrAYr+pGNXGg9CBC4NFlijGRf7GdtJfiNjmonU="
+            "rev": "84b963a2f627bbc41198e357430619f34bbebc8a",
+            "hash": "sha256-s358pyMH4vIQt1f0Mgw1U5gwUW0aSqVtwyeyoL/4Ok8="
         },
-        "version": "unstable-2023-02-20"
+        "version": "unstable-2024-06-28"
     },
     "stella": {
         "fetcher": "fetchFromGitHub",
@@ -814,20 +814,20 @@
         "src": {
             "owner": "libretro",
             "repo": "swanstation",
-            "rev": "8a999111ff3b8e40dd093c214dd56ba1596e1115",
-            "hash": "sha256-H9NWRbtqc+Zx/cBtS6LAbL6DsTLeDGGXhRRBD5W5tHg="
+            "rev": "365e29cf5869a196070d73a9b2a2e2c80ac8f0ad",
+            "hash": "sha256-TiVGzLwK1FJlpHl70lj2Yc4q2i5KQ9WRsbMvGWy5IU0="
         },
-        "version": "unstable-2024-06-29"
+        "version": "unstable-2024-07-08"
     },
     "tgbdual": {
         "fetcher": "fetchFromGitHub",
         "src": {
             "owner": "libretro",
             "repo": "tgbdual-libretro",
-            "rev": "a6f3018e6a23030afc1873845ee54d4b2d8ec9d3",
-            "hash": "sha256-MBUgYXX/Pc+TkwoS7OwbXSPssKUf6lwWx/bKhvwDkHs="
+            "rev": "fba7d50b136abef0692b434091a9d735f7ad28b2",
+            "hash": "sha256-f6PGtUkIOyUHQbbJdgQiWmw2armjyuP1CTcWfRbx9uE="
         },
-        "version": "unstable-2022-08-06"
+        "version": "unstable-2024-07-01"
     },
     "thepowdertoy": {
         "fetcher": "fetchFromGitHub",

pkgs/applications/gis/grass/default.nix

@@ -23,7 +23,7 @@
 , pkg-config
 , postgresql
 , proj
-, python3Packages
+, python311Packages
 , readline
 , sqlite
 , wxGTK32
@@ -31,6 +31,9 @@
 , zstd
 }:
 
+let
+  pyPackages = python311Packages;
+in
 stdenv.mkDerivation (finalAttrs: {
   pname = "grass";
   version = "8.3.2";
@@ -53,7 +56,7 @@ stdenv.mkDerivation (finalAttrs: {
     libmysqlclient # for `mysql_config`
     netcdf # for `nc-config`
     pkg-config
-  ] ++ (with python3Packages; [ python-dateutil numpy wxpython ]);
+  ] ++ (with pyPackages; [ python-dateutil numpy wxpython ]);
 
   buildInputs = [
     blas
@@ -86,7 +89,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   # Correct mysql_config query
   postPatch = ''
-      substituteInPlace configure --replace "--libmysqld-libs" "--libs"
+    substituteInPlace configure --replace "--libmysqld-libs" "--libs"
   '';
 
   configureFlags = [
@@ -127,7 +130,7 @@ stdenv.mkDerivation (finalAttrs: {
   postInstall = ''
     wrapProgram $out/bin/grass \
     --set PYTHONPATH $PYTHONPATH \
-    --set GRASS_PYTHON ${python3Packages.python.interpreter} \
+    --set GRASS_PYTHON ${pyPackages.python.interpreter} \
     --suffix LD_LIBRARY_PATH ':' '${gdal}/lib'
     ln -s $out/grass*/lib $out/lib
     ln -s $out/grass*/include $out/include

pkgs/applications/gis/qgis/unwrapped-ltr.nix

@@ -29,7 +29,7 @@
 , postgresql
 , proj
 , protobuf
-, python3
+, python311
 , qca-qt5
 , qscintilla
 , qt3d
@@ -48,7 +48,7 @@
 }:
 
 let
-  py = python3.override {
+  py = python311.override {
     packageOverrides = self: super: {
       pyqt5 = super.pyqt5.override {
         withLocation = true;

pkgs/applications/gis/qgis/unwrapped.nix

@@ -29,7 +29,7 @@
 , postgresql
 , proj
 , protobuf
-, python3
+, python311
 , qca-qt5
 , qscintilla
 , qt3d
@@ -48,7 +48,7 @@
 }:
 
 let
-  py = python3.override {
+  py = python311.override {
     packageOverrides = self: super: {
       pyqt5 = super.pyqt5.override {
         withLocation = true;

pkgs/applications/graphics/batik/default.nix

@@ -1,24 +0,0 @@
-{lib, stdenv, fetchurl}:
-
-stdenv.mkDerivation rec {
-  pname = "batik";
-  version = "1.17";
-
-  src = fetchurl {
-    url = "mirror://apache/xmlgraphics/batik/binaries/batik-bin-${version}.tar.gz";
-    sha256 = "sha256-sEJphF3grlwZCEt3gHHm4JF8RpvKKBLLvKXf2lu/dhA=";
-  };
-
-  meta = with lib; {
-    description = "Java based toolkit for handling SVG";
-    homepage = "https://xmlgraphics.apache.org/batik";
-    license = licenses.asl20;
-    platforms = platforms.unix;
-    sourceProvenance = with sourceTypes; [ binaryBytecode ];
-  };
-
-  installPhase = ''
-    mkdir $out
-    cp -r * $out/
-  '';
-}

pkgs/applications/graphics/hydrus/default.nix

@@ -6,6 +6,7 @@
 , enableSwftools ? false
 , swftools
 , python3Packages
+, pythonOlder
 , qtbase
 , qtcharts
 , makeDesktopItem
@@ -14,14 +15,14 @@
 
 python3Packages.buildPythonPackage rec {
   pname = "hydrus";
-  version = "580";
+  version = "581";
   format = "other";
 
   src = fetchFromGitHub {
     owner = "hydrusnetwork";
     repo = "hydrus";
     rev = "refs/tags/v${version}";
-    hash = "sha256-QdRItwbgVYgA6PU9Ybimk+/sBe1CHV79ssTrIturVpg=";
+    hash = "sha256-Q/EdqwIMCjeDtFAPlYd04NMpEgC6xUDGK5LwxDCiI9Y=";
   };
 
   nativeBuildInputs = [
@@ -81,6 +82,9 @@ python3Packages.buildPythonPackage rec {
     twisted
   ];
 
+  # tests rely on nose
+  doCheck = pythonOlder "3.12";
+
   nativeCheckInputs = with python3Packages; [
     nose
     mock

pkgs/applications/misc/appcleaner/default.nix

@@ -29,7 +29,7 @@ stdenvNoCC.mkDerivation (finalAttrs: {
     homepage = "https://freemacsoft.net/appcleaner";
     license = licenses.unfree;
     sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
-    maintainers = with maintainers; [ emilytrau Enzime ];
+    maintainers = with maintainers; [ emilytrau ];
     platforms = platforms.darwin;
   };
 })

pkgs/applications/misc/ausweisapp/default.nix

@@ -15,13 +15,13 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "ausweisapp";
-  version = "2.1.1";
+  version = "2.2.0";
 
   src = fetchFromGitHub {
     owner = "Governikus";
     repo = "AusweisApp2";
     rev = finalAttrs.version;
-    hash = "sha256-YRRm8/yDwQIUjzqYzlqij8h2ri39Q7L8jVh5fgrZbGs=";
+    hash = "sha256-YOsKAWc6z39OPzc4eWc/9RhRoOD+J5xHve4Low1UX+Q=";
   };
 
   nativeBuildInputs = [

pkgs/applications/misc/bemenu/default.nix

@@ -7,13 +7,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "bemenu";
-  version = "0.6.21";
+  version = "0.6.22";
 
   src = fetchFromGitHub {
     owner = "Cloudef";
     repo = finalAttrs.pname;
     rev = finalAttrs.version;
-    hash = "sha256-E/5wN7HpdBt//jFe9yAB8fuHKiFJ7D1UAJEvG8KBJ6k=";
+    hash = "sha256-wdOrVX4AgGXySlwmqFRp9OWoSkEYBIZumBGTrFfyNpg=";
   };
 
   strictDeps = true;

pkgs/applications/misc/blender/default.nix

@@ -16,9 +16,9 @@
   config,
   cudaPackages,
   cudaSupport ? config.cudaSupport,
-  darwin,
   dbus,
   embree,
+  fetchpatch,
   fetchurl,
   fetchzip,
   ffmpeg,
@@ -54,7 +54,6 @@
   libxkbcommon,
   llvmPackages,
   makeWrapper,
-  materialx,
   mesa,
   ocl-icd,
   openal,
@@ -71,7 +70,7 @@
   pkg-config,
   potrace,
   pugixml,
-  python311Packages, # must use instead of python3.pkgs, see https://github.com/NixOS/nixpkgs/issues/211340
+  python3Packages, # must use instead of python3.pkgs, see https://github.com/NixOS/nixpkgs/issues/211340
   rocmPackages, # comes with a significantly larger closure size
   runCommand,
   spaceNavSupport ? stdenv.isLinux,
@@ -86,7 +85,6 @@
 }:
 
 let
-  python3Packages = python311Packages;
   python3 = python3Packages.python;
   pyPkgsOpenusd = python3Packages.openusd.override { withOsl = false; };
 
@@ -111,7 +109,13 @@ stdenv.mkDerivation (finalAttrs: {
     hash = "sha256-T7s69k0/hN9ccQN0hFQibBiFwawu1Tc9DOoegOgsCEg=";
   };
 
-  patches = [ ./draco.patch ] ++ lib.optional stdenv.isDarwin ./darwin.patch;
+  patches = [
+    ./draco.patch
+    (fetchpatch {
+      url = "https://projects.blender.org/blender/blender/commit/ae35b5758791bebb21741f9b505b9fca347ae50e.patch";
+      hash = "sha256-xUi55+7aiwEjtjqOi8to1YxdPlsBUThCCkCa5T6LIQc=";
+    })
+  ] ++ lib.optional stdenv.isDarwin ./darwin.patch;
 
   postPatch =
     (
@@ -121,7 +125,7 @@ stdenv.mkDerivation (finalAttrs: {
           substituteInPlace source/creator/CMakeLists.txt \
             --replace-fail '${"$"}{LIBDIR}/python' \
                       '${python3}' \
-            --replace-fail '${"$"}{LIBDIR}/materialx/' '${materialx}/'
+            --replace-fail '${"$"}{LIBDIR}/materialx/' '${python3Packages.materialx}/'
           substituteInPlace build_files/cmake/platform/platform_apple.cmake \
             --replace-fail '${"$"}{LIBDIR}/brotli/lib/libbrotlicommon-static.a' \
                       '${lib.getLib brotli}/lib/libbrotlicommon.dylib' \
@@ -154,7 +158,7 @@ stdenv.mkDerivation (finalAttrs: {
       "-DWITH_FFTW3=ON"
       "-DWITH_IMAGE_OPENJPEG=ON"
       "-DWITH_INSTALL_PORTABLE=OFF"
-      "-DMaterialX_DIR=${materialx}/lib/cmake/MaterialX"
+      "-DMaterialX_DIR=${python3Packages.materialx}/lib/cmake/MaterialX"
       "-DWITH_MOD_OCEANSIM=ON"
       "-DWITH_OPENCOLLADA=${if colladaSupport then "ON" else "OFF"}"
       "-DWITH_OPENCOLORIO=ON"
@@ -177,7 +181,9 @@ stdenv.mkDerivation (finalAttrs: {
       "-DWITH_GHOST_WAYLAND_DYNLOAD=OFF"
       "-DWITH_GHOST_WAYLAND_LIBDECOR=ON"
     ]
-    ++ lib.optionals (stdenv.hostPlatform.isAarch64 && stdenv.hostPlatform.isLinux) [ "-DWITH_CYCLES_EMBREE=OFF" ]
+    ++ lib.optionals (stdenv.hostPlatform.isAarch64 && stdenv.hostPlatform.isLinux) [
+      "-DWITH_CYCLES_EMBREE=OFF"
+    ]
     ++ lib.optionals stdenv.isDarwin [
       "-DLIBDIR=/does-not-exist"
       "-DWITH_CYCLES_OSL=OFF" # causes segfault on aarch64-darwin
@@ -225,7 +231,6 @@ stdenv.mkDerivation (finalAttrs: {
       libsndfile
       libtiff
       libwebp
-      materialx
       opencolorio
       openexr
       openimageio
@@ -236,6 +241,7 @@ stdenv.mkDerivation (finalAttrs: {
       potrace
       pugixml
       python3
+      python3Packages.materialx
       tbb
       zlib
       zstd
@@ -291,7 +297,7 @@ stdenv.mkDerivation (finalAttrs: {
       ps = python3Packages;
     in
     [
-      materialx
+      ps.materialx
       ps.numpy
       ps.requests
       ps.zstandard
@@ -320,15 +326,16 @@ stdenv.mkDerivation (finalAttrs: {
 
   # Set RUNPATH so that libcuda and libnvrtc in /run/opengl-driver(-32)/lib can be
   # found. See the explanation in libglvnd.
-  postFixup = lib.optionalString cudaSupport ''
-    for program in $out/bin/blender $out/bin/.blender-wrapped; do
-      isELF "$program" || continue
-      addDriverRunpath "$program"
-    done
-  ''
-  + lib.optionalString stdenv.isDarwin ''
-    makeWrapper $out/Applications/Blender.app/Contents/MacOS/Blender $out/bin/blender
-  '';
+  postFixup =
+    lib.optionalString cudaSupport ''
+      for program in $out/bin/blender $out/bin/.blender-wrapped; do
+        isELF "$program" || continue
+        addDriverRunpath "$program"
+      done
+    ''
+    + lib.optionalString stdenv.isDarwin ''
+      makeWrapper $out/Applications/Blender.app/Contents/MacOS/Blender $out/bin/blender
+    '';
 
   passthru = {
     python = python3;
@@ -342,9 +349,7 @@ stdenv.mkDerivation (finalAttrs: {
       };
 
     tests = {
-      render = runCommand "${finalAttrs.pname}-test" {
-        nativeBuildInputs = [ mesa.llvmpipeHook ];
-      } ''
+      render = runCommand "${finalAttrs.pname}-test" { nativeBuildInputs = [ mesa.llvmpipeHook ]; } ''
         set -euo pipefail
         cat <<'PYTHON' > scene-config.py
         import bpy
@@ -396,7 +401,9 @@ stdenv.mkDerivation (finalAttrs: {
     # They comment two licenses: GPLv2 and Blender License, but they
     # say: "We've decided to cancel the BL offering for an indefinite period."
     # OptiX, enabled with cudaSupport, is non-free.
-    license = with lib.licenses; [ gpl2Plus ] ++ lib.optional cudaSupport (unfree // { shortName = "NVidia OptiX EULA"; });
+    license =
+      with lib.licenses;
+      [ gpl2Plus ] ++ lib.optional cudaSupport (unfree // { shortName = "NVidia OptiX EULA"; });
 
     platforms = [
       "aarch64-linux"

pkgs/applications/misc/calibre/default.nix

@@ -33,11 +33,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "calibre";
-  version = "7.12.0";
+  version = "7.13.0";
 
   src = fetchurl {
     url = "https://download.calibre-ebook.com/${finalAttrs.version}/calibre-${finalAttrs.version}.tar.xz";
-    hash = "sha256-XHkORTUx3+O+i2vbTiZAHI/0hY3xPIXvvNAVuXy4wzk=";
+    hash = "sha256-t0nSLsT3X5MoYHhLjbRpqyKbV6NdAqNurSjbcik/n7Q=";
   };
 
   patches = [

pkgs/applications/misc/cotp/default.nix

@@ -8,16 +8,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "cotp";
-  version = "1.7.1";
+  version = "1.7.2";
 
   src = fetchFromGitHub {
     owner = "replydev";
     repo = "cotp";
     rev = "v${version}";
-    hash = "sha256-6FriNAwxo+YnJWmCrScyafUEkJvEJz3O9Zoj9yerpSI=";
+    hash = "sha256-U+rOwBxT3on1hUlkb93sgdYIpPTOHb42x1cibueGDn0=";
   };
 
-  cargoHash = "sha256-/CW0CGhPjKd5oU2LYW4lPWKMATn9aJdjIy44yZJyU/E=";
+  cargoHash = "sha256-mdcQSmTLU2bj+wEyzgqFJpjBEesD7zPDVHziNkTIR+s=";
 
   buildInputs = lib.optionals stdenv.isLinux [ libxcb ]
     ++ lib.optionals stdenv.isDarwin [ AppKit ];

pkgs/applications/misc/dmenu/default.nix

@@ -1,7 +1,7 @@
-{ lib, stdenv, fetchurl, libX11, libXinerama, libXft, zlib, patches ? null
-# update script dependencies
-, gitUpdater
-}:
+{ lib, stdenv, fetchurl, libX11, libXinerama, libXft, zlib, writeText
+, conf ? null, patches ? null
+  # update script dependencies
+, gitUpdater }:
 
 stdenv.mkDerivation rec {
   pname = "dmenu";
@@ -16,9 +16,15 @@ stdenv.mkDerivation rec {
 
   inherit patches;
 
-  postPatch = ''
+  postPatch = let
+    configFile = if lib.isDerivation conf || builtins.isPath conf then
+      conf
+    else
+      writeText "config.def.h" conf;
+  in ''
     sed -ri -e 's!\<(dmenu|dmenu_path|stest)\>!'"$out/bin"'/&!g' dmenu_run
     sed -ri -e 's!\<stest\>!'"$out/bin"'/&!g' dmenu_path
+    ${lib.optionalString (conf != null) "cp ${configFile} config.def.h"}
   '';
 
   preConfigure = ''
@@ -27,15 +33,14 @@ stdenv.mkDerivation rec {
 
   makeFlags = [ "CC:=$(CC)" ];
 
-  passthru.updateScript = gitUpdater {
-    url = "git://git.suckless.org/dmenu";
-  };
+  passthru.updateScript = gitUpdater { url = "git://git.suckless.org/dmenu"; };
 
   meta = with lib; {
-    description = "Generic, highly customizable, and efficient menu for the X Window System";
+    description =
+      "Generic, highly customizable, and efficient menu for the X Window System";
     homepage = "https://tools.suckless.org/dmenu";
     license = licenses.mit;
-    maintainers = with maintainers; [ pSub globin qusic ];
+    maintainers = with maintainers; [ pSub globin qusic _0david0mp ];
     platforms = platforms.all;
     mainProgram = "dmenu";
   };

pkgs/applications/misc/ff2mpv/default.nix

@@ -29,7 +29,7 @@ stdenv.mkDerivation rec {
     description = "Native Messaging Host for ff2mpv firefox addon";
     homepage = "https://github.com/woodruffw/ff2mpv";
     license = lib.licenses.mit;
-    maintainers = with lib.maintainers; [ Enzime ];
+    maintainers = with lib.maintainers; [ ];
     mainProgram = "ff2mpv.py";
   };
 }

pkgs/applications/misc/googleearth-pro/default.nix

@@ -35,11 +35,11 @@ let
 in
 mkDerivation rec {
   pname = "googleearth-pro";
-  version = "7.3.4.8248";
+  version = "7.3.6.9796";
 
   src = fetchurl {
     url = "https://dl.google.com/linux/earth/deb/pool/main/g/google-earth-pro-stable/google-earth-pro-stable_${version}-r0_${arch}.deb";
-    sha256 = "1pbapi267snlrjari5k93y6kbrjsqhqxgkxxqaqv4r25az00dx6d";
+    sha256 = "sha256-Wv2jPGN7LC5T32WdX3W1BfGYrcXTNWTI1Wv+PmD0gNM=";
   };
 
   nativeBuildInputs = [ dpkg makeWrapper autoPatchelfHook ];
@@ -72,7 +72,7 @@ mkDerivation rec {
   unpackPhase = ''
     # deb file contains a setuid binary, so 'dpkg -x' doesn't work here
     mkdir deb
-    dpkg --fsys-tarfile ${src} | tar --extract -C deb
+    dpkg --fsys-tarfile $src | tar --extract -C deb
   '';
 
   installPhase =''
@@ -118,7 +118,7 @@ mkDerivation rec {
     homepage = "https://www.google.com/earth/";
     sourceProvenance = with sourceTypes; [ binaryNativeCode ];
     license = licenses.unfree;
-    maintainers = with maintainers; [ shamilton ];
+    maintainers = with maintainers; [ shamilton xddxdd ];
     platforms = platforms.linux;
     knownVulnerabilities = [ "Includes vulnerable versions of bundled libraries: openssl, ffmpeg, gdal, and proj." ];
   };

pkgs/applications/misc/harsh/default.nix

@@ -5,13 +5,13 @@
 
 buildGoModule rec {
   pname = "harsh";
-  version = "0.10.0";
+  version = "0.10.2";
 
   src = fetchFromGitHub {
     owner = "wakatara";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-SF5SvVllAXaALSasVt+wqiywYltAuzaPoc9IohwYmss=";
+    hash = "sha256-XkOdW6ewout69A1ovth1iQR36nRtkdsbDI9CWibSHXs=";
   };
 
   vendorHash = "sha256-4Sa8/mVD7t4uR8Wq4n+fvot7LZfraphFobrG6rteQeI=";

pkgs/applications/misc/hubstaff/default.nix

@@ -1,12 +1,12 @@
 { lib, stdenv, fetchurl, unzip, makeWrapper, libX11, zlib, libSM, libICE
 , libXext , freetype, libXrender, fontconfig, libXft, libXinerama
 , libXfixes, libXScrnSaver, libnotify, glib , gtk3, libappindicator-gtk3
-, curl, writeShellScript, common-updater-scripts }:
+, curl, writeShellScript, common-updater-scripts, xmlstarlet }:
 
 let
-  url = "https://hubstaff-production.s3.amazonaws.com/downloads/HubstaffClient/Builds/Release/1.6.13-269829b4/Hubstaff-1.6.13-269829b4.sh";
-  version = "1.6.13-269829b4";
-  sha256 = "0i05d8kivm09hqsc1z6vn7w0bbc3l9dawssqpqsm7kqdyaq0l304";
+  url = "https://app.hubstaff.com/download/7473-standard-linux-1-6-24-release";
+  version = "1.6.24-094b0af9";
+  sha256 = "sha256:1jwyl51lljxn6hnkp07bvgw60bqmq3gb0rdgvxmd7r8x3y3xshx1";
 
   rpath = lib.makeLibraryPath
     [ libX11 zlib libSM libICE libXext freetype libXrender fontconfig libXft
@@ -36,9 +36,9 @@ stdenv.mkDerivation {
   dontBuild = true;
 
   installPhase = ''
-    # TODO: handle 32-bit arch?
-    rm -r x86
-    rm -r x86_64/lib64
+    # remove files for 32-bit arch to skip building for this arch
+    # but add -f flag to not fail if files were not found (new versions dont provide 32-bit arch)
+    rm -rf x86 x86_64/lib64
 
     opt=$out/opt/hubstaff
     mkdir -p $out/bin $opt
@@ -55,16 +55,25 @@ stdenv.mkDerivation {
     ln -s $opt/data/resources $opt/x86_64/resources
   '';
 
+  # to test run:
+  # nix-shell maintainers/scripts/update.nix --argstr package hubstaff
+  # nix-build -A pkgs.hubstaff
   passthru.updateScript = writeShellScript "hubstaff-updater" ''
     set -eu -o pipefail
 
-    installation_script_url=$(curl --fail --head --location --silent --output /dev/null --write-out %{url_effective} https://app.hubstaff.com/download/linux)
+    # Create a temporary file
+    temp_file=$(mktemp)
 
-    version=$(echo "$installation_script_url" | sed -r 's/^https:\/\/hubstaff\-production\.s3\.amazonaws\.com\/downloads\/HubstaffClient\/Builds\/Release\/([^\/]+)\/Hubstaff.+$/\1/')
+    # Fetch the appcast.xml and save it to the temporary file
+    curl --silent --output "$temp_file" https://app.hubstaff.com/appcast.xml
+
+    # Extract the latest release URL for Linux using xmlstarlet
+    installation_script_url=$(${xmlstarlet}/bin/xmlstarlet sel -t -v '//enclosure[@sparkle:os="linux"]/@url' "$temp_file")
+    version=$(${xmlstarlet}/bin/xmlstarlet sel -t -v '//enclosure[@sparkle:os="linux"]/@sparkle:version' "$temp_file")
 
     sha256=$(nix-prefetch-url "$installation_script_url")
 
-    ${common-updater-scripts}/bin/update-source-version hubstaff "$version" "$sha256" "$installation_script_url"
+    ${common-updater-scripts}/bin/update-source-version hubstaff "$version" "sha256:$sha256" "$installation_script_url"
   '';
 
   meta = with lib; {

pkgs/applications/misc/mob/default.nix

@@ -9,13 +9,13 @@
 
 buildGoModule rec {
   pname = "mob";
-  version = "5.0.0";
+  version = "5.0.1";
 
   src = fetchFromGitHub {
     owner = "remotemobprogramming";
     repo = "mob";
     rev = "v${version}";
-    hash = "sha256-+pN+FGZCW5sPWpUNIYTFn26KBpHre+9PPBQwEcBNJWI=";
+    hash = "sha256-CUD4gcQrLzYsD6zX6I4C59lHGKOaE5ggjbIVyznBNEg=";
   };
 
   vendorHash = null;

pkgs/applications/misc/octoprint/default.nix

@@ -1,273 +1,278 @@
-{ pkgs
-, stdenv
-, callPackage
-, lib
-, fetchFromGitHub
-, fetchPypi
-, python3
-, substituteAll
-, nix-update-script
-, nixosTests
+{
+  pkgs,
+  stdenv,
+  callPackage,
+  lib,
+  fetchFromGitHub,
+  fetchPypi,
+  python3,
+  substituteAll,
+  nix-update-script,
+  nixosTests,
   # To include additional plugins, pass them here as an overlay.
-, packageOverrides ? self: super: { }
+  packageOverrides ? self: super: { },
 }:
 let
 
   py = python3.override {
     self = py;
-    packageOverrides = lib.foldr lib.composeExtensions (self: super: { }) (
-      [
-        (
-          # Due to flask > 2.3 the login will not work
-          self: super: {
-            werkzeug = super.werkzeug.overridePythonAttrs (oldAttrs: rec {
-              version = "2.2.3";
-              format = "setuptools";
-              src = fetchPypi {
-                pname = "Werkzeug";
-                inherit version;
-                hash = "sha256-LhzMlBfU2jWLnebxdOOsCUOR6h1PvvLWZ4ZdgZ39Cv4=";
-              };
-              doCheck = false;
-            });
-            flask = super.flask.overridePythonAttrs (oldAttrs: rec {
-              version = "2.2.5";
-              format = "setuptools";
-              src = fetchPypi {
-                pname = "Flask";
-                inherit version;
-                hash = "sha256-7e6bCn/yZiG9WowQ/0hK4oc3okENmbC7mmhQx/uXeqA=";
-              };
-            });
-
-            netaddr = super.netaddr.overridePythonAttrs (oldAttrs: rec {
-              version = "0.9.0";
-
-              src = fetchPypi {
-                pname = "netaddr";
-                inherit version;
-                hash = "sha256-e0b6mxotcf1d6eSjeE7zOXAKU6CMgEDwi69fEZTaASg=";
-              };
-            });
-          }
-        )
-
-        # Built-in dependency
-        (
-          self: super: {
-            octoprint-filecheck = self.buildPythonPackage rec {
-              pname = "OctoPrint-FileCheck";
-              version = "2021.2.23";
-
-              src = fetchFromGitHub {
-                owner = "OctoPrint";
-                repo = "OctoPrint-FileCheck";
-                rev = version;
-                sha256 = "sha256-e/QGEBa9+pjOdrZq3Zc6ifbSMClIyeTOi0Tji0YdVmI=";
-              };
-              doCheck = false;
+    packageOverrides = lib.foldr lib.composeExtensions (self: super: { }) ([
+      (
+        # Due to flask > 2.3 the login will not work
+        self: super: {
+          werkzeug = super.werkzeug.overridePythonAttrs (oldAttrs: rec {
+            version = "2.2.3";
+            format = "setuptools";
+            src = fetchPypi {
+              pname = "Werkzeug";
+              inherit version;
+              hash = "sha256-LhzMlBfU2jWLnebxdOOsCUOR6h1PvvLWZ4ZdgZ39Cv4=";
             };
-          }
-        )
-
-        # Built-in dependency
-        (
-          self: super: {
-            octoprint-firmwarecheck = self.buildPythonPackage rec {
-              pname = "OctoPrint-FirmwareCheck";
-              version = "2021.10.11";
-
-              src = fetchFromGitHub {
-                owner = "OctoPrint";
-                repo = "OctoPrint-FirmwareCheck";
-                rev = version;
-                hash = "sha256-wqbD82bhJDrDawJ+X9kZkoA6eqGxqJc1Z5dA0EUwgEI=";
-              };
-              doCheck = false;
+            doCheck = false;
+          });
+          flask = super.flask.overridePythonAttrs (oldAttrs: rec {
+            version = "2.2.5";
+            format = "setuptools";
+            src = fetchPypi {
+              pname = "Flask";
+              inherit version;
+              hash = "sha256-7e6bCn/yZiG9WowQ/0hK4oc3okENmbC7mmhQx/uXeqA=";
             };
-          }
-        )
-
-        (
-          self: super: {
-            octoprint-pisupport = self.buildPythonPackage rec {
-              pname = "OctoPrint-PiSupport";
-              version = "2023.5.24";
-              format = "setuptools";
-
-              src = fetchFromGitHub {
-                owner = "OctoPrint";
-                repo = "OctoPrint-PiSupport";
-                rev = version;
-                hash = "sha256-KfkZXJ2f02G2ee+J1w+YQRKz+LSWwxVIIwmdevDGhew=";
-              };
-
-              # requires octoprint itself during tests
-              doCheck = false;
-              postPatch = ''
-                substituteInPlace octoprint_pi_support/__init__.py \
-                  --replace /usr/bin/vcgencmd ${self.pkgs.libraspberrypi}/bin/vcgencmd
-              '';
+            doCheck = false;
+          });
+          flask-login = super.flask-login.overridePythonAttrs (oldAttrs: rec {
+            version = "0.6.3";
+            src = fetchPypi {
+              pname = "Flask-Login";
+              inherit version;
+              hash = "sha256-XiPRSmB+8SgGxplZC4nQ8ODWe67sWZ11lHv5wUczAzM=";
             };
-          }
-        )
+            build-system = [ self.setuptools ];
+            doCheck = false; # DeprecationWarnings
+          });
 
-        (
-          self: super: {
-            octoprint = self.buildPythonPackage rec {
-              pname = "OctoPrint";
-              version = "1.10.2";
+          netaddr = super.netaddr.overridePythonAttrs (oldAttrs: rec {
+            version = "0.9.0";
 
-              src = fetchFromGitHub {
-                owner = "OctoPrint";
-                repo = "OctoPrint";
-                rev = version;
-                hash = "sha256-vISMps2v18A7MkF24SyIcK5yOQsTxBQLnKybVd8R2FU=";
-              };
-
-              propagatedBuildInputs = with self; [
-                argon2-cffi
-                blinker
-                cachelib
-                click
-                colorlog
-                emoji
-                feedparser
-                filetype
-                flask
-                flask-babel
-                flask-assets
-                flask-login
-                flask-limiter
-                frozendict
-                future
-                itsdangerous
-                immutabledict
-                jinja2
-                markdown
-                markupsafe
-                netaddr
-                netifaces
-                octoprint-filecheck
-                octoprint-firmwarecheck
-                passlib
-                pathvalidate
-                pkginfo
-                pip
-                psutil
-                pylru
-                pyserial
-                pyyaml
-                regex
-                requests
-                rsa
-                sarge
-                semantic-version
-                sentry-sdk
-                setuptools
-                tornado
-                unidecode
-                watchdog
-                websocket-client
-                werkzeug
-                wrapt
-                zeroconf
-                zipstream-ng
-                class-doc
-                pydantic_1
-              ] ++ lib.optionals stdenv.isDarwin [
-                py.pkgs.appdirs
-              ] ++ lib.optionals (!stdenv.isDarwin) [
-                octoprint-pisupport
-              ];
-
-              nativeCheckInputs = with self; [
-                ddt
-                mock
-                pytestCheckHook
-              ];
-
-              patches = [
-                # substitute pip and let it find out, that it can't write anywhere
-                (substituteAll {
-                  src = ./pip-path.patch;
-                  pip = "${self.pip}/bin/pip";
-                })
-
-                # hardcore path to ffmpeg and hide related settings
-                (substituteAll {
-                  src = ./ffmpeg-path.patch;
-                  ffmpeg = "${pkgs.ffmpeg}/bin/ffmpeg";
-                })
-              ];
-
-              postPatch =
-                let
-                  ignoreVersionConstraints = [
-                    "cachelib"
-                    "colorlog"
-                    "emoji"
-                    "immutabledict"
-                    "PyYAML"
-                    "sarge"
-                    "sentry-sdk"
-                    "watchdog"
-                    "wrapt"
-                    "zeroconf"
-                    "Flask-Login"
-                    "werkzeug"
-                    "flask"
-                    "Flask-Limiter"
-                    "blinker"
-                  ];
-                in
-                ''
-                    sed -r -i \
-                      ${lib.concatStringsSep "\n" (
-                    map (
-                      e:
-                        ''-e 's@${e}[<>=]+.*@${e}",@g' \''
-                    ) ignoreVersionConstraints
-                  )}
-                      setup.py
-                '';
-
-              dontUseSetuptoolsCheck = true;
-
-              preCheck = ''
-                export HOME=$(mktemp -d)
-                rm pytest.ini
-              '';
-
-              disabledTests = [
-                "test_check_setup" # Why should it be able to call pip?
-              ] ++ lib.optionals stdenv.isDarwin [
-                "test_set_external_modification"
-              ];
-
-              passthru = {
-                inherit (self) python;
-                updateScript = nix-update-script { };
-                tests = {
-                  plugins = (callPackage ./plugins.nix { }) super self;
-                  inherit (nixosTests) octoprint;
-                };
-              };
-
-              meta = with lib; {
-                homepage = "https://octoprint.org/";
-                description = "Snappy web interface for your 3D printer";
-                mainProgram = "octoprint";
-                license = licenses.agpl3Only;
-                maintainers = with maintainers; [ abbradar gebner WhittlesJr gador ];
-              };
+            src = fetchPypi {
+              pname = "netaddr";
+              inherit version;
+              hash = "sha256-e0b6mxotcf1d6eSjeE7zOXAKU6CMgEDwi69fEZTaASg=";
             };
-          }
-        )
-        (callPackage ./plugins.nix { })
-        packageOverrides
-      ]
-    );
+          });
+        })
+
+      # Built-in dependency
+      (self: super: {
+        octoprint-filecheck = self.buildPythonPackage rec {
+          pname = "OctoPrint-FileCheck";
+          version = "2021.2.23";
+
+          src = fetchFromGitHub {
+            owner = "OctoPrint";
+            repo = "OctoPrint-FileCheck";
+            rev = version;
+            sha256 = "sha256-e/QGEBa9+pjOdrZq3Zc6ifbSMClIyeTOi0Tji0YdVmI=";
+          };
+          doCheck = false;
+        };
+      })
+
+      # Built-in dependency
+      (self: super: {
+        octoprint-firmwarecheck = self.buildPythonPackage rec {
+          pname = "OctoPrint-FirmwareCheck";
+          version = "2021.10.11";
+
+          src = fetchFromGitHub {
+            owner = "OctoPrint";
+            repo = "OctoPrint-FirmwareCheck";
+            rev = version;
+            hash = "sha256-wqbD82bhJDrDawJ+X9kZkoA6eqGxqJc1Z5dA0EUwgEI=";
+          };
+          doCheck = false;
+        };
+      })
+
+      (self: super: {
+        octoprint-pisupport = self.buildPythonPackage rec {
+          pname = "OctoPrint-PiSupport";
+          version = "2023.5.24";
+          format = "setuptools";
+
+          src = fetchFromGitHub {
+            owner = "OctoPrint";
+            repo = "OctoPrint-PiSupport";
+            rev = version;
+            hash = "sha256-KfkZXJ2f02G2ee+J1w+YQRKz+LSWwxVIIwmdevDGhew=";
+          };
+
+          # requires octoprint itself during tests
+          doCheck = false;
+          postPatch = ''
+            substituteInPlace octoprint_pi_support/__init__.py \
+              --replace /usr/bin/vcgencmd ${self.pkgs.libraspberrypi}/bin/vcgencmd
+          '';
+        };
+      })
+
+      (self: super: {
+        octoprint = self.buildPythonPackage rec {
+          pname = "OctoPrint";
+          version = "1.10.2";
+
+          src = fetchFromGitHub {
+            owner = "OctoPrint";
+            repo = "OctoPrint";
+            rev = version;
+            hash = "sha256-vISMps2v18A7MkF24SyIcK5yOQsTxBQLnKybVd8R2FU=";
+          };
+
+          propagatedBuildInputs =
+            with self;
+            [
+              argon2-cffi
+              blinker
+              cachelib
+              click
+              colorlog
+              emoji
+              feedparser
+              filetype
+              flask
+              flask-babel
+              flask-assets
+              flask-login
+              flask-limiter
+              frozendict
+              future
+              itsdangerous
+              immutabledict
+              jinja2
+              markdown
+              markupsafe
+              netaddr
+              netifaces
+              octoprint-filecheck
+              octoprint-firmwarecheck
+              passlib
+              pathvalidate
+              pkginfo
+              pip
+              psutil
+              pylru
+              pyserial
+              pyyaml
+              regex
+              requests
+              rsa
+              sarge
+              semantic-version
+              sentry-sdk
+              setuptools
+              tornado
+              unidecode
+              watchdog
+              websocket-client
+              werkzeug
+              wrapt
+              zeroconf
+              zipstream-ng
+              class-doc
+              pydantic_1
+            ]
+            ++ lib.optionals stdenv.isDarwin [ py.pkgs.appdirs ]
+            ++ lib.optionals (!stdenv.isDarwin) [ octoprint-pisupport ];
+
+          nativeCheckInputs = with self; [
+            ddt
+            mock
+            pytestCheckHook
+          ];
+
+          patches = [
+            # substitute pip and let it find out, that it can't write anywhere
+            (substituteAll {
+              src = ./pip-path.patch;
+              pip = "${self.pip}/bin/pip";
+            })
+
+            # hardcore path to ffmpeg and hide related settings
+            (substituteAll {
+              src = ./ffmpeg-path.patch;
+              ffmpeg = "${pkgs.ffmpeg}/bin/ffmpeg";
+            })
+          ];
+
+          postPatch =
+            let
+              ignoreVersionConstraints = [
+                "cachelib"
+                "colorlog"
+                "emoji"
+                "immutabledict"
+                "PyYAML"
+                "sarge"
+                "sentry-sdk"
+                "watchdog"
+                "wrapt"
+                "zeroconf"
+                "Flask-Login"
+                "werkzeug"
+                "flask"
+                "Flask-Limiter"
+                "blinker"
+              ];
+            in
+            ''
+              sed -r -i \
+                ${
+                  lib.concatStringsSep "\n" (map (e: ''-e 's@${e}[<>=]+.*@${e}",@g' \'') ignoreVersionConstraints)
+                }
+                setup.py
+            '';
+
+          dontUseSetuptoolsCheck = true;
+
+          preCheck = ''
+            export HOME=$(mktemp -d)
+            rm pytest.ini
+          '';
+
+          disabledTests = [
+            "test_check_setup" # Why should it be able to call pip?
+          ] ++ lib.optionals stdenv.isDarwin [ "test_set_external_modification" ];
+          disabledTestPaths = [
+            "tests/test_octoprint_setuptools.py" # fails due to distutils and python3.12
+          ];
+
+          passthru = {
+            inherit (self) python;
+            updateScript = nix-update-script { };
+            tests = {
+              plugins = (callPackage ./plugins.nix { }) super self;
+              inherit (nixosTests) octoprint;
+            };
+          };
+
+          meta = with lib; {
+            homepage = "https://octoprint.org/";
+            description = "Snappy web interface for your 3D printer";
+            mainProgram = "octoprint";
+            license = licenses.agpl3Only;
+            maintainers = with maintainers; [
+              abbradar
+              gebner
+              WhittlesJr
+              gador
+            ];
+          };
+        };
+      })
+      (callPackage ./plugins.nix { })
+      packageOverrides
+    ]);
   };
 in
-with py.pkgs; toPythonApplication octoprint
+with py.pkgs;
+toPythonApplication octoprint

pkgs/applications/misc/p2pool/default.nix

@@ -19,13 +19,13 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "p2pool";
-  version = "3.10";
+  version = "4.0";
 
   src = fetchFromGitHub {
     owner = "SChernykh";
     repo = "p2pool";
     rev = "v${version}";
-    sha256 = "sha256-IDOtwrIKzP/pbwqIespvZtNS1VdR3246uXxgxR3V6VI=";
+    sha256 = "sha256-UAKEyJFdgwJ4Jz3lTG6vmxEkIVLSikWOEBjYV6o72nQ=";
     fetchSubmodules = true;
   };
 
@@ -35,6 +35,10 @@ stdenv.mkDerivation rec {
 
   cmakeFlags = ["-DWITH_LTO=OFF"];
 
+  env.NIX_CFLAGS_COMPILE = toString (lib.optionals (stdenv.isDarwin && lib.versionOlder stdenv.hostPlatform.darwinMinVersion "10.13") [
+    "-faligned-allocation"
+  ]);
+
   installPhase = ''
     runHook preInstall
 
@@ -53,5 +57,6 @@ stdenv.mkDerivation rec {
     license = licenses.gpl3Only;
     maintainers = with maintainers; [ ratsclub ];
     mainProgram = "p2pool";
+    platforms = platforms.all;
   };
 }

pkgs/applications/misc/qcad/default.nix

@@ -18,14 +18,14 @@
 
 mkDerivation rec {
   pname = "qcad";
-  version = "3.30.1.1";
+  version = "3.30.1.3";
 
   src = fetchFromGitHub {
     name = "qcad-${version}-src";
     owner = "qcad";
     repo = "qcad";
     rev = "v${version}";
-    hash = "sha256-hZe1rTRkvdKC/row0Li6hsmOcLKkMULo9ScOvvjmWCA=";
+    hash = "sha256-bGSXFX1LuNZzs981t0GZxnMPzyJ+bddB4m/wkLMsfg0=";
   };
 
   patches = [

pkgs/applications/misc/spotify-tray/default.nix

@@ -28,7 +28,7 @@ stdenv.mkDerivation rec {
     description = "Adds a tray icon to the Spotify Linux client application";
     license = licenses.gpl3Only;
     platforms = platforms.linux;
-    maintainers = with maintainers; [ Enzime ];
+    maintainers = with maintainers; [ ];
     mainProgram = "spotify-tray";
   };
 }

pkgs/applications/misc/tuba/default.nix

@@ -13,14 +13,17 @@
 , json-glib
 , glib
 , glib-networking
+, gnome
 , gobject-introspection
 , gtksourceview5
 , libxml2
 , libgee
+, librsvg
 , libsoup_3
 , libsecret
 , libwebp
 , libspelling
+, webp-pixbuf-loader
 , icu
 , gst_all_1
 , clapper
@@ -86,12 +89,23 @@ stdenv.mkDerivation rec {
     updateScript = nix-update-script { };
   };
 
+  # Pull in WebP support for avatars from Misskey instances.
+  # In postInstall to run before gappsWrapperArgsHook.
+  postInstall = ''
+    export GDK_PIXBUF_MODULE_FILE="${gnome._gdkPixbufCacheBuilder_DO_NOT_USE {
+      extraLoaders = [
+        librsvg
+        webp-pixbuf-loader
+      ];
+    }}"
+  '';
+
   meta = {
     description = "Browse the Fediverse";
     homepage = "https://tuba.geopjr.dev/";
     mainProgram = "dev.geopjr.Tuba";
     license = lib.licenses.gpl3Only;
     changelog = "https://github.com/GeopJr/Tuba/releases/tag/v${version}";
-    maintainers = with lib.maintainers; [ chuangzhu aleksana ];
+    maintainers = with lib.maintainers; [ chuangzhu aleksana donovanglover ];
   };
 }

pkgs/applications/misc/valent/default.nix

@@ -15,20 +15,21 @@
 , libadwaita
 , libpeas2
 , libportal-gtk4
+, pipewire
 , pulseaudio
 , sqlite
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "valent";
-  version = "0-unstable-2024-02-12";
+  version = "1.0.0.alpha.45";
 
   src = fetchFromGitHub {
     owner = "andyholmes";
     repo = "valent";
-    rev = "70ef1aa42eb2df5e9c3aa4faa014c8d539450018";
+    rev = "v${finalAttrs.version}";
+    hash = "sha256-hOVWvk4U6VoWAvXNHK1vTm/am69EFqDmSb0NofWVQj8=";
     fetchSubmodules = true;
-    hash = "sha256-JdrkAtn21NoX+SI6PNWMdE8HLKhLc3HKFhwKydENkvg=";
   };
 
   nativeBuildInputs = [
@@ -50,6 +51,7 @@ stdenv.mkDerivation rec {
     libadwaita
     libpeas2
     libportal-gtk4
+    pipewire
     pulseaudio
     sqlite
   ];
@@ -81,9 +83,9 @@ stdenv.mkDerivation rec {
       ```
     '';
     homepage = "https://valent.andyholmes.ca";
-    changelog = "https://github.com/andyholmes/valent/blob/${src.rev}/CHANGELOG.md";
+    changelog = "https://github.com/andyholmes/valent/blob/${finalAttrs.src.rev}/CHANGELOG.md";
     license = with lib.licenses; [ gpl3Plus cc0 cc-by-sa-30 ];
     maintainers = with lib.maintainers; [ aleksana ];
     platforms = lib.platforms.linux;
   };
-}
+})

pkgs/applications/misc/wmenu/default.nix

@@ -1,6 +1,6 @@
 { lib
 , stdenv
-, fetchFromSourcehut
+, fetchFromGitea
 , pkg-config
 , meson
 , ninja
@@ -15,15 +15,16 @@
 
 stdenv.mkDerivation rec {
   pname = "wmenu";
-  version = "0.1.8";
+  version = "0.1.9";
 
   strictDeps = true;
 
-  src = fetchFromSourcehut {
-    owner = "~adnano";
+  src = fetchFromGitea {
+    domain = "codeberg.org";
+    owner = "adnano";
     repo = "wmenu";
     rev = version;
-    hash = "sha256-gVoqRHQ5bcY58LTgKxpPM1PnZJrLRoSOJUiYYqc/vRI=";
+    hash = "sha256-TF5BvgThvTOqxyfz5Zt/Z1cqjFJwvla+dgdyvz7Zhrg=";
   };
 
   nativeBuildInputs = [ pkg-config meson ninja wayland-scanner ];
@@ -31,7 +32,7 @@ stdenv.mkDerivation rec {
 
   meta = with lib; {
     description = "Efficient dynamic menu for Sway and wlroots based Wayland compositors";
-    homepage = "https://git.sr.ht/~adnano/wmenu";
+    homepage = "https://codeberg.org/adnano/wmenu";
     license = licenses.mit;
     platforms = platforms.linux;
     maintainers = with maintainers; [ eken ];