Merge staging-next into staging

.github/CODEOWNERS

@@ -11,11 +11,14 @@
 # This also holds true for GitHub teams. Since almost none of our teams have write
 # permissions, you need to list all members of the team with commit access individually.
 
-# GitHub actions
+# CI
 /.github/workflows @NixOS/Security @Mic92 @zowoq
+/.github/workflows/check-nix-format.yml @infinisil
+/ci @infinisil
 
-# EditorConfig
+# Develompent support
 /.editorconfig @Mic92 @zowoq
+/shell.nix @infinisil @NixOS/Security
 
 # Libraries
 /lib                        @infinisil

.github/workflows/backport.yml

@@ -20,7 +20,7 @@ jobs:
     if: github.repository_owner == 'NixOS' && github.event.pull_request.merged == true && (github.event_name != 'labeled' || startsWith('backport', github.event.label.name))
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@44c2b7a8a4ea60a981eaca3cf939b5f4305c123b # v4.1.5
+      - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
         with:
           ref: ${{ github.event.pull_request.head.sha }}
       - name: Create backport PRs

.github/workflows/basic-eval.yml

@@ -18,7 +18,7 @@ jobs:
     runs-on: ubuntu-latest
     # we don't limit this action to only NixOS repo since the checks are cheap and useful developer feedback
     steps:
-    - uses: actions/checkout@44c2b7a8a4ea60a981eaca3cf939b5f4305c123b # v4.1.5
+    - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
     - uses: cachix/install-nix-action@8887e596b4ee1134dae06b98d573bd674693f47c # v26
     - uses: cachix/cachix-action@ad2ddac53f961de1989924296a1f236fcfbaa4fc # v15
       with:

.github/workflows/check-by-name.yml

@@ -81,7 +81,7 @@ jobs:
           else
             echo "The PR cannot be merged, it has a merge conflict, skipping the rest.."
           fi
-      - uses: actions/checkout@44c2b7a8a4ea60a981eaca3cf939b5f4305c123b # v4.1.5
+      - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
         if: env.mergedSha
         with:
           # pull_request_target checks out the base branch by default

.github/workflows/check-cherry-picks.yml

@@ -13,7 +13,7 @@ jobs:
     runs-on: ubuntu-latest
     if: github.repository_owner == 'NixOS'
     steps:
-    - uses: actions/checkout@44c2b7a8a4ea60a981eaca3cf939b5f4305c123b # v4.1.5
+    - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
       with:
         fetch-depth: 0
         filter: blob:none

.github/workflows/check-maintainers-sorted.yaml

@@ -12,7 +12,7 @@ jobs:
     runs-on: ubuntu-latest
     if: github.repository_owner == 'NixOS'
     steps:
-      - uses: actions/checkout@44c2b7a8a4ea60a981eaca3cf939b5f4305c123b # v4.1.5
+      - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
         with:
           # pull_request_target checks out the base branch by default
           ref: refs/pull/${{ github.event.pull_request.number }}/merge

.github/workflows/check-nix-format.yml

@@ -15,17 +15,22 @@ jobs:
     runs-on: ubuntu-latest
     if: github.repository_owner == 'NixOS'
     steps:
-      - uses: actions/checkout@44c2b7a8a4ea60a981eaca3cf939b5f4305c123b # v4.1.5
+      - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
         with:
           # pull_request_target checks out the base branch by default
           ref: refs/pull/${{ github.event.pull_request.number }}/merge
+      - name: Get Nixpkgs revision for nixfmt
+        run: |
+          # pin to a commit from nixpkgs-unstable to avoid e.g. building nixfmt
+          # from staging
+          # This should not be a URL, because it would allow PRs to run arbitrary code in CI!
+          rev=$(jq -r .rev ci/pinned-nixpkgs.json)
+          echo "url=https://github.com/NixOS/nixpkgs/archive/$rev.tar.gz" >> "$GITHUB_ENV"
       - uses: cachix/install-nix-action@8887e596b4ee1134dae06b98d573bd674693f47c # v26
         with:
           # explicitly enable sandbox
           extra_nix_config: sandbox = true
-          # fix a commit from nixpkgs-unstable to avoid e.g. building nixfmt
+          nix_path: nixpkgs=${{ env.url }}
-          # from staging
-          nix_path: nixpkgs=https://github.com/NixOS/nixpkgs/archive/4b455dc2048f73a79eb3713f342369ff58f93e0b.tar.gz
       - name: Install nixfmt
         run: "nix-env -f '<nixpkgs>' -iAP nixfmt-rfc-style"
       - name: Check that Nix files are formatted according to the RFC style
@@ -35,14 +40,14 @@ jobs:
           NIX_FMT_PATHS_BSD: pkgs/os-specific/bsd
           NIX_FMT_PATHS_MPVSCRIPTS: pkgs/applications/video/mpv/scripts
           # Format paths related to the Nixpkgs CUDA ecosystem.
-          NIX_FMT_PATHS_CUDA: |
+          NIX_FMT_PATHS_CUDA: |-
             pkgs/development/cuda-modules
             pkgs/test/cuda
             pkgs/top-level/cuda-packages.nix
-          NIX_FMT_PATHS_MAINTAINERS: |
+          NIX_FMT_PATHS_MAINTAINERS: |-
             maintainers/maintainer-list.nix
             maintainers/team-list.nix
-          NIX_FMT_PATHS_K3S: |
+          NIX_FMT_PATHS_K3S: |-
             nixos/modules/services/cluster/k3s
             nixos/tests/k3s
             pkgs/applications/networking/cluster/k3s
@@ -51,6 +56,7 @@ jobs:
           NIX_FMT_PATHS_BUILD_SUPPORT_PHP: pkgs/build-support/php
         # Iterate over all environment variables beginning with NIX_FMT_PATHS_.
         run: |
+          unformattedPaths=()
           for env_var in "${!NIX_FMT_PATHS_@}"; do
             readarray -t paths <<< "${!env_var}"
             if [[ "${paths[*]}" == "" ]]; then
@@ -59,7 +65,12 @@ jobs:
             fi
             echo "Checking paths: ${paths[@]}"
             if ! nixfmt --check "${paths[@]}"; then
-              echo "Error: nixfmt failed."
+              unformattedPaths+=("${paths[@]}")
-              exit 1
             fi
           done
+          if (( "${#unformattedPaths[@]}" > 0 )); then
+            echo "Some required Nix files are not properly formatted"
+            echo "Please run the following in \`nix-shell\`:"
+            echo "nixfmt ${unformattedPaths[*]@Q}"
+            exit 1
+          fi

.github/workflows/check-shell.yml

@@ -0,0 +1,29 @@
+name: "Check shell"
+
+on:
+  pull_request_target:
+
+permissions: {}
+
+jobs:
+  x86_64-linux:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
+        with:
+          # pull_request_target checks out the base branch by default
+          ref: refs/pull/${{ github.event.pull_request.number }}/merge
+      - uses: cachix/install-nix-action@8887e596b4ee1134dae06b98d573bd674693f47c # v26
+      - name: Build shell
+        run: nix-build shell.nix
+
+  aarch64-darwin:
+    runs-on: macos-latest
+    steps:
+      - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
+        with:
+          # pull_request_target checks out the base branch by default
+          ref: refs/pull/${{ github.event.pull_request.number }}/merge
+      - uses: cachix/install-nix-action@8887e596b4ee1134dae06b98d573bd674693f47c # v26
+      - name: Build shell
+        run: nix-build shell.nix

.github/workflows/editorconfig.yml

@@ -24,7 +24,7 @@ jobs:
     - name: print list of changed files
       run: |
         cat "$HOME/changed_files"
-    - uses: actions/checkout@44c2b7a8a4ea60a981eaca3cf939b5f4305c123b # v4.1.5
+    - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
       with:
         # pull_request_target checks out the base branch by default
         ref: refs/pull/${{ github.event.pull_request.number }}/merge

.github/workflows/manual-nixos.yml

@@ -14,7 +14,7 @@ jobs:
     runs-on: ubuntu-latest
     if: github.repository_owner == 'NixOS'
     steps:
-      - uses: actions/checkout@44c2b7a8a4ea60a981eaca3cf939b5f4305c123b # v4.1.5
+      - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
         with:
           # pull_request_target checks out the base branch by default
           ref: refs/pull/${{ github.event.pull_request.number }}/merge

.github/workflows/manual-nixpkgs.yml

@@ -16,7 +16,7 @@ jobs:
     runs-on: ubuntu-latest
     if: github.repository_owner == 'NixOS'
     steps:
-      - uses: actions/checkout@44c2b7a8a4ea60a981eaca3cf939b5f4305c123b # v4.1.5
+      - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
         with:
           # pull_request_target checks out the base branch by default
           ref: refs/pull/${{ github.event.pull_request.number }}/merge

.github/workflows/nix-parse.yml

@@ -24,7 +24,7 @@ jobs:
         if [[ -s "$HOME/changed_files" ]]; then
           echo "CHANGED_FILES=$HOME/changed_files" > "$GITHUB_ENV"
         fi
-    - uses: actions/checkout@44c2b7a8a4ea60a981eaca3cf939b5f4305c123b # v4.1.5
+    - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
       with:
         # pull_request_target checks out the base branch by default
         ref: refs/pull/${{ github.event.pull_request.number }}/merge

.github/workflows/periodic-merge-24h.yml

@@ -45,7 +45,7 @@ jobs:
             into: staging-24.05
     name: ${{ matrix.pairs.from }} → ${{ matrix.pairs.into }}
     steps:
-      - uses: actions/checkout@44c2b7a8a4ea60a981eaca3cf939b5f4305c123b # v4.1.5
+      - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
 
       - name: ${{ matrix.pairs.from }} → ${{ matrix.pairs.into }}
         uses: devmasx/merge-branch@854d3ac71ed1e9deb668e0074781b81fdd6e771f # 1.4.0

.github/workflows/periodic-merge-6h.yml

@@ -39,7 +39,7 @@ jobs:
             into: staging
     name: ${{ matrix.pairs.from }} → ${{ matrix.pairs.into }}
     steps:
-      - uses: actions/checkout@44c2b7a8a4ea60a981eaca3cf939b5f4305c123b # v4.1.5
+      - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
 
       - name: ${{ matrix.pairs.from }} → ${{ matrix.pairs.into }}
         uses: devmasx/merge-branch@854d3ac71ed1e9deb668e0074781b81fdd6e771f # 1.4.0

.github/workflows/update-terraform-providers.yml

@@ -16,7 +16,7 @@ jobs:
     if: github.repository_owner == 'NixOS' && github.ref == 'refs/heads/master' # ensure workflow_dispatch only runs on master
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@44c2b7a8a4ea60a981eaca3cf939b5f4305c123b # v4.1.5
+      - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
       - uses: cachix/install-nix-action@8887e596b4ee1134dae06b98d573bd674693f47c # v26
         with:
           nix_path: nixpkgs=channel:nixpkgs-unstable

ci/README.md

@@ -0,0 +1,12 @@
+# CI support files
+
+This directory contains files to support CI, such as [GitHub Actions](https://github.com/NixOS/nixpkgs/tree/master/.github/workflows) and [Ofborg](https://github.com/nixos/ofborg).
+This is in contrast with [`maintainers/scripts`](`../maintainers/scripts`) which is for human use instead.
+
+## Pinned Nixpkgs
+
+CI may need certain packages from Nixpkgs.
+In order to ensure that the needed packages are generally available without building,
+[`pinned-nixpkgs.json`](./pinned-nixpkgs.json) contains a pinned Nixpkgs version tested by Hydra.
+
+Run [`update-pinned-nixpkgs.sh`](./update-pinned-nixpkgs.sh) to update it.

ci/pinned-nixpkgs.json

@@ -0,0 +1,4 @@
+{
+  "rev": "cfb89a95f19bea461fc37228dc4d07b22fe617c2",
+  "sha256": "1yhsacvry6j8r02lk70p9dphjpi8lpzgq2qay8hiy4nqlys0mrch"
+}

ci/update-pinned-nixpkgs.sh

@@ -0,0 +1,16 @@
+#!/usr/bin/env nix-shell
+#!nix-shell -i bash -p jq
+
+set -euo pipefail
+
+# https://stackoverflow.com/a/246128
+SCRIPT_DIR=$( cd -- "$( dirname -- "${BASH_SOURCE[0]}" )" &> /dev/null && pwd )
+
+repo=https://github.com/nixos/nixpkgs
+branch=nixpkgs-unstable
+file=$SCRIPT_DIR/pinned-nixpkgs.json
+
+rev=$(git ls-remote "$repo" refs/heads/"$branch" | cut -f1)
+sha256=$(nix-prefetch-url --unpack "$repo/archive/$rev.tar.gz" --name source)
+
+jq -n --arg rev "$rev" --arg sha256 "$sha256" '$ARGS.named' | tee /dev/stderr > $file

lib/systems/default.nix

@@ -84,20 +84,21 @@ let
       useLLVM = final.isFreeBSD || final.isOpenBSD;
 
       libc =
-        /**/ if final.isDarwin              then "libSystem"
+        /**/ if final.isDarwin                then "libSystem"
-        else if final.isMinGW               then "msvcrt"
+        else if final.isMinGW                 then "msvcrt"
-        else if final.isWasi                then "wasilibc"
+        else if final.isWasi                  then "wasilibc"
-        else if final.isRedox               then "relibc"
+        else if final.isWasm && !final.isWasi then null
-        else if final.isMusl                then "musl"
+        else if final.isRedox                 then "relibc"
-        else if final.isUClibc              then "uclibc"
+        else if final.isMusl                  then "musl"
-        else if final.isAndroid             then "bionic"
+        else if final.isUClibc                then "uclibc"
-        else if final.isLinux /* default */ then "glibc"
+        else if final.isAndroid               then "bionic"
-        else if final.isFreeBSD             then "fblibc"
+        else if final.isLinux  /* default */  then "glibc"
-        else if final.isOpenBSD             then "oblibc"
+        else if final.isFreeBSD               then "fblibc"
-        else if final.isNetBSD              then "nblibc"
+        else if final.isOpenBSD               then "oblibc"
-        else if final.isAvr                 then "avrlibc"
+        else if final.isNetBSD                then "nblibc"
-        else if final.isGhcjs               then null
+        else if final.isAvr                   then "avrlibc"
-        else if final.isNone                then "newlib"
+        else if final.isGhcjs                 then null
+        else if final.isNone                  then "newlib"
         # TODO(@Ericson2314) think more about other operating systems
         else                                     "native/impure";
       # Choose what linker we wish to use by default. Someday we might also
@@ -179,6 +180,7 @@ let
         (isAndroid || isGnu || isMusl                                  # Linux (allows multiple libcs)
          || isDarwin || isSunOS || isOpenBSD || isFreeBSD || isNetBSD  # BSDs
          || isCygwin || isMinGW                                        # Windows
+         || isWasm                                                     # WASM
         ) && !isStatic;
 
       # The difference between `isStatic` and `hasSharedLibraries` is mainly the
@@ -187,7 +189,7 @@ let
       # don't support dynamic linking, but don't get the `staticMarker`.
       # `pkgsStatic` sets `isStatic=true`, so `pkgsStatic.hostPlatform` always
       # has the `staticMarker`.
-      isStatic = final.isWasm || final.isRedox;
+      isStatic = final.isWasi || final.isRedox;
 
       # Just a guess, based on `system`
       inherit
@@ -337,7 +339,8 @@ let
                     if isList f then f else [ f ]
                 )
               else optional final.isUnix "unix"
-                   ++ optional final.isWindows "windows";
+                   ++ optional final.isWindows "windows"
+                   ++ optional final.isWasm "wasm";
 
             # https://doc.rust-lang.org/reference/conditional-compilation.html#target_vendor
             vendor = let

lib/systems/examples.nix

@@ -356,6 +356,12 @@ rec {
     useLLVM = true;
   };
 
+  wasm32-unknown-none = {
+    config = "wasm32-unknown-none";
+    rust.rustcTarget = "wasm32-unknown-unknown";
+    useLLVM = true;
+  };
+
   # Ghcjs
   ghcjs = {
     # This triple is special to GHC/Cabal/GHCJS and not recognized by autotools

lib/systems/parse.nix

@@ -466,11 +466,12 @@ rec {
       }
       # cpu-vendor-os
       else if elemAt l 1 == "apple" ||
-              elem (elemAt l 2) [ "wasi" "redox" "mmixware" "ghcjs" "mingw32" ] ||
+              elem (elemAt l 2) [ "redox" "mmixware" "ghcjs" "mingw32" ] ||
               hasPrefix "freebsd" (elemAt l 2) ||
               hasPrefix "netbsd" (elemAt l 2) ||
               hasPrefix "openbsd" (elemAt l 2) ||
-              hasPrefix "genode" (elemAt l 2)
+              hasPrefix "genode" (elemAt l 2) ||
+              hasPrefix "wasm32" (elemAt l 0)
       then {
         cpu    = elemAt l 0;
         vendor = elemAt l 1;

maintainers/maintainer-list.nix

@@ -6659,6 +6659,12 @@
     githubId = 1109959;
     name = "Florian Jacob";
   };
+  floriansanderscc = {
+    email = "florian.sanders+nixos@clever-cloud.com";
+    github = "florian-sanders-cc";
+    githubId = 100240294;
+    name = "Florian Sanders";
+  };
   flosse = {
     email = "mail@markus-kohlhase.de";
     github = "flosse";
@@ -8418,6 +8424,12 @@
     email = "astrid@astrid.tech";
     name = "ifd3f";
   };
+  if-loop69420 = {
+    github = "if-loop69420";
+    githubId = 81078181;
+    email = "j.sztavi@pm.me";
+    name = "Jeremy Sztavinovszki";
+  };
   iFreilicht = {
     github = "iFreilicht";
     githubId = 9742635;
@@ -8976,6 +8988,11 @@
     githubId = 3874017;
     name = "Jappie Klooster";
   };
+  jaredmontoya = {
+    name = "Jared Montoya";
+    github = "jaredmontoya";
+    githubId = 49511278;
+  };
   jasoncarr = {
     email = "jcarr250@gmail.com";
     github = "jasoncarr0";

maintainers/team-list.nix

@@ -141,6 +141,13 @@ with lib.maintainers;
     enableFeatureFreezePing = true;
   };
 
+  clevercloud = {
+    members = [ floriansanderscc ];
+    scope = "Maintain Clever Cloud related packages.";
+    shortName = "CleverCloud";
+    githubTeams = [ "CleverCloud" ];
+  };
+
   cloudposse = {
     members = [ dudymas ];
     scope = "Maintain atmos and applications made by the Cloud Posse team.";

nixos/doc/manual/release-notes/rl-2411.section.md

@@ -23,6 +23,8 @@
 
 - [wg-access-server](https://github.com/freifunkMUC/wg-access-server/), an all-in-one WireGuard VPN solution with a web ui for connecting devices. Available at [services.wg-access-server](#opt-services.wg-access-server.enable).
 
+- [Playerctld](https://github.com/altdesktop/playerctl), a daemon to track media player activity. Available as [services.playerctld](option.html#opt-services.playerctld).
+
 ## Backward Incompatibilities {#sec-release-24.11-incompatibilities}
 
 - `transmission` package has been aliased with a `trace` warning to `transmission_3`. Since [Transmission 4 has been released last year](https://github.com/transmission/transmission/releases/tag/4.0.0), and Transmission 3 will eventually go away, it was decided perform this warning alias to make people aware of the new version. The `services.transmission.package` defaults to `transmission_3` as well because the upgrade can cause data loss in certain specific usage patterns (examples: [#5153](https://github.com/transmission/transmission/issues/5153), [#6796](https://github.com/transmission/transmission/issues/6796)). Please make sure to back up to your data directory per your usage:
@@ -45,6 +47,8 @@
   - For convenience, the top-level `clang-tools` attribute remains and is now bound to `llvmPackages.clang-tools`.
   - Top-level `clang_tools_<version>` attributes are now aliases; these will be removed in a future release.
 
+- `buildbot` was updated to 4.0, the AngularJS frontend has been replaced by a React frontend, see the [upstream release notes](https://docs.buildbot.net/current/manual/upgrading/4.0-upgrade.html).
+
 - `nginx` package no longer includes `gd` and `geoip` dependencies. For enabling it, override `nginx` package with the optionals `withImageFilter` and `withGeoIP`.
 
 - `openssh` and `openssh_hpn` are now compiled without Kerberos 5 / GSSAPI support in an effort to reduce the attack surface of the components for the majority of users. Users needing this support can
@@ -156,6 +160,11 @@
   The derivation now installs "impl" headers selectively instead of by a wildcard.
   Use `imgui.src` if you just want to access the unpacked sources.
 
+- Cinnamon has been updated to 6.2.
+  - Following Mint 22 defaults, the Cinnamon module no longer ships geary and hexchat by default.
+  - Nemo is now built with gtk-layer-shell support, note that for now it will be expected to see nemo-desktop
+    listed as a regular entry in Cinnamon Wayland session's window list applet.
+
 - Support for *runner registration tokens* has been [deprecated](https://gitlab.com/gitlab-org/gitlab/-/issues/380872)
   in `gitlab-runner` 15.6 and is expected to be removed in `gitlab-runner` 18.0. Configuration of existing runners
   should be changed to using *runner authentication tokens* by configuring

nixos/modules/module-list.nix

@@ -487,6 +487,7 @@
   ./services/desktops/espanso.nix
   ./services/desktops/flatpak.nix
   ./services/desktops/geoclue2.nix
+  ./services/desktops/playerctld.nix
   ./services/desktops/gnome/at-spi2-core.nix
   ./services/desktops/gnome/evolution-data-server.nix
   ./services/desktops/gnome/glib-networking.nix

nixos/modules/services/desktops/playerctld.nix

@@ -0,0 +1,32 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+let
+  cfg = config.services.playerctld;
+in
+{
+  options.services.playerctld = {
+    enable = lib.mkEnableOption "the playerctld daemon";
+
+    package = lib.mkPackageOption pkgs "playerctl" { };
+  };
+
+  config = lib.mkIf cfg.enable {
+    environment.systemPackages = [ cfg.package ];
+    systemd.user.services.playerctld = {
+      description = "Playerctld daemon to track media player activity";
+      wantedBy = [ "default.target" ];
+
+      serviceConfig = {
+        Type = "exec";
+        ExecStart = "${cfg.package}/bin/playerctld";
+      };
+    };
+  };
+
+  meta.maintainers = with lib.maintainers; [ aacebedo ];
+}

nixos/modules/services/monitoring/smartd.nix

@@ -10,6 +10,7 @@ let
   opt = options.services.smartd;
 
   nm = cfg.notifications.mail;
+  ns = cfg.notifications.systembus-notify;
   nw = cfg.notifications.wall;
   nx = cfg.notifications.x11;
 
@@ -28,6 +29,12 @@ let
       ${pkgs.smartmontools}/sbin/smartctl -a -d "$SMARTD_DEVICETYPE" "$SMARTD_DEVICE"
       } | ${nm.mailer} -i "${nm.recipient}"
     ''}
+    ${optionalString ns.enable ''
+      ${pkgs.dbus}/bin/dbus-send --system \
+        / net.nuetzlich.SystemNotifications.Notify \
+        "string:Problem detected with disk: $SMARTD_DEVICESTRING" \
+        "string:Warning message from smartd is: $SMARTD_MESSAGE"
+    ''}
     ${optionalString nw.enable ''
       {
       ${pkgs.coreutils}/bin/cat << EOF
@@ -159,6 +166,24 @@ in
           };
         };
 
+        systembus-notify = {
+          enable = mkOption {
+            default = false;
+            type = types.bool;
+            description = ''
+              Whenever to send systembus-notify notifications.
+
+              WARNING: enabling this option (while convenient) should *not* be done on a
+              machine where you do not trust the other users as it allows any other
+              local user to DoS your session by spamming notifications.
+
+              To actually see the notifications in your GUI session, you need to have
+              `systembus-notify` running as your user, which this
+              option handles by enabling {option}`services.systembus-notify`.
+            '';
+          };
+        };
+
         wall = {
           enable = mkOption {
             default = true;
@@ -247,6 +272,8 @@ in
       serviceConfig.ExecStart = "${pkgs.smartmontools}/sbin/smartd ${lib.concatStringsSep " " cfg.extraOptions} --no-fork --configfile=${smartdConf}";
     };
 
+    services.systembus-notify.enable = mkDefault ns.enable;
+
   };
 
 }

nixos/modules/services/networking/oink.nix

@@ -77,6 +77,7 @@ in
   config = mkIf cfg.enable {
     systemd.services.oink = {
       description = "Dynamic DNS client for Porkbun";
+      after = [ "network.target" ];
       wantedBy = [ "multi-user.target" ];
       script = "${cfg.package}/bin/oink -c ${oinkConfig}";
     };

nixos/modules/services/ttys/kmscon.nix

@@ -41,6 +41,12 @@ in {
           }; in nullOr (nonEmptyListOf fontType);
       };
 
+      useXkbConfig = mkOption {
+        description = "Configure keymap from xserver keyboard settings.";
+        type = types.bool;
+        default = false;
+      };
+
       extraConfig = mkOption {
         description = "Extra contents of the kmscon.conf file.";
         type = types.lines;
@@ -91,9 +97,15 @@ in {
 
     services.kmscon.extraConfig =
       let
+        xkb = optionals cfg.useXkbConfig
+          lib.mapAttrsToList (n: v: "xkb-${n}=${v}") (
+            lib.filterAttrs
+              (n: v: builtins.elem n ["layout" "model" "options" "variant"] && v != "")
+              config.services.xserver.xkb
+          );
         render = optionals cfg.hwRender [ "drm" "hwaccel" ];
         fonts = optional (cfg.fonts != null) "font-name=${lib.concatMapStringsSep ", " (f: f.name) cfg.fonts}";
-      in lib.concatStringsSep "\n" (render ++ fonts);
+      in lib.concatStringsSep "\n" (xkb ++ render ++ fonts);
 
     hardware.graphics.enable = mkIf cfg.hwRender true;
 

nixos/modules/virtualisation/virtualbox-host.nix

@@ -89,7 +89,7 @@ in
         Enable KVM support for VirtualBox. This increases compatibility with Linux kernel versions, because the VirtualBox kernel modules
         are not required.
 
-        This option is incompatible with `enableHardening` and `addNetworkInterface`.
+        This option is incompatible with `addNetworkInterface`.
 
         Note: This is experimental. Please check https://github.com/cyberus-technology/virtualbox-kvm/issues.
       '';
@@ -136,18 +136,6 @@ in
         assertion = !cfg.addNetworkInterface;
         message = "VirtualBox KVM only supports standard NAT networking for VMs. Please turn off virtualisation.virtualbox.host.addNetworkInterface.";
       }
-
-      {
-        assertion = !cfg.enableHardening;
-        message = "VirtualBox KVM is not compatible with hardening: Please turn off virtualisation.virtualbox.host.enableHardening.";
-      }
-    ];
-
-    warnings = [
-      ''
-        KVM support in VirtualBox is experimental. Not all security features are available yet.
-        See: https://github.com/cyberus-technology/virtualbox-kvm/issues/12
-      ''
     ];
   }) (mkIf (!cfg.enableKvm) {
     boot.kernelModules = [ "vboxdrv" "vboxnetadp" "vboxnetflt" ];

nixos/tests/buildbot.nix

@@ -14,7 +14,7 @@ import ./make-test-python.nix ({ pkgs, ... }: {
           "steps.ShellCommand(command=['bash', 'fakerepo.sh'])"
         ];
         changeSource = [
-          "changes.GitPoller('git://gitrepo/fakerepo.git', workdir='gitpoller-workdir', branch='master', pollinterval=300)"
+          "changes.GitPoller('git://gitrepo/fakerepo.git', workdir='gitpoller-workdir', branch='master', pollInterval=300)"
         ];
       };
       networking.firewall.allowedTCPPorts = [ 8010 8011 9989 ];

nixos/tests/lomiri.nix

@@ -230,7 +230,7 @@ in {
 
         # morph-browser has a separate VM test, there isn't anything new we could test here
 
-        # Keep it running, we're using it to check content-hub communication from LSS
+        machine.send_key("alt-f4")
 
     # LSS provides DE settings
     with subtest("system settings open"):
@@ -282,9 +282,7 @@ in {
         # Testing any more would require more applications & setup, the fact that it's already being attempted is a good sign
         machine.send_key("esc")
 
-        machine.send_key("alt-f4") # LSS
+        machine.send_key("alt-f4")
-        machine.sleep(2) # focus is slow to switch to second window, closing it *really* helps with OCR afterwards
-        machine.send_key("alt-f4") # Morph
 
     # The ayatana indicators are an important part of the experience, and they hold the only graphical way of exiting the session.
     # There's a test app we could use that also displays their contents, but it's abit inconsistent.

pkgs/applications/audio/mympd/default.nix

@@ -16,13 +16,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "mympd";
-  version = "15.0.2";
+  version = "16.0.0";
 
   src = fetchFromGitHub {
     owner = "jcorporation";
     repo = "myMPD";
     rev = "v${finalAttrs.version}";
-    sha256 = "sha256-Yz6gL87Vc8iFTRgKhyUgLL1ool+oinvwq2W9OjFl/OQ=";
+    sha256 = "sha256-LYD1qjSlwv9wGBrZUaYz6Zcvl2n6cLi2aGycr4ZJWdY=";
   };
 
   nativeBuildInputs = [

pkgs/applications/audio/qpwgraph/default.nix

@@ -13,14 +13,14 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "qpwgraph";
-  version = "0.7.2";
+  version = "0.7.4";
 
   src = fetchFromGitLab {
     domain = "gitlab.freedesktop.org";
     owner = "rncbc";
     repo = "qpwgraph";
     rev = "v${finalAttrs.version}";
-    sha256 = "sha256-aXZsAOsdp0x7J0T9B9C1Qm2qDkhRNHRWUmPafdHRrOQ=";
+    sha256 = "sha256-1YExpvhCHIdRqFCvOmiG3G7k/qs7q1ITwtZXGMc/SRk=";
   };
 
   nativeBuildInputs = [ cmake pkg-config wrapQtAppsHook ];

pkgs/applications/audio/reaper/default.nix

@@ -28,13 +28,13 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "reaper";
-  version = "7.16";
+  version = "7.17";
 
   src = fetchurl {
     url = url_for_platform version stdenv.hostPlatform.qemuArch;
-    hash = if stdenv.isDarwin then "sha256-UMliD9tk8VDpeQ4tBC31peemv7HAKHW0xtqoSkzYG4Y=" else {
+    hash = if stdenv.isDarwin then "sha256-4+8MhvQ1LhfyhFCOMBgD4HHt0Oaj25y2U04++JuXxCM=" else {
-      x86_64-linux = "sha256-sK0GVK29SGkLBILeWcFjcvQ956NCPb1HvqmXLeLbgP8=";
+      x86_64-linux = "sha256-q3oTKcFSNec10kT1FlDaf2GS967y38VLq9GsquwN2Lg=";
-      aarch64-linux = "sha256-mJ/UtrWaPq3Oar8rMvRFm8iafK1I7bL42deIQyiHVMk=";
+      aarch64-linux = "sha256-5mxVkppm1SjC0C0SFI7uEdPWewNZXlrNAxbaFcNzzbU=";
     }.${stdenv.hostPlatform.system};
   };
 

pkgs/applications/blockchains/alfis/default.nix

@@ -1,62 +1,71 @@
-{ stdenv
+{
-, lib
+  stdenv,
-, rustPlatform
+  lib,
-, fetchFromGitHub
+  rustPlatform,
-, pkg-config
+  fetchFromGitHub,
-, makeWrapper
+  pkg-config,
-, webkitgtk
+  makeWrapper,
-, zenity
+  webkitgtk,
-, Cocoa
+  zenity,
-, Security
+  Cocoa,
-, WebKit
+  Security,
-, withGui ? true
+  WebKit,
+  withGui ? true,
 }:
 
 rustPlatform.buildRustPackage rec {
   pname = "alfis";
-  version = "0.8.4";
+  version = "0.8.4-unstable-2024-03-08";
 
   src = fetchFromGitHub {
     owner = "Revertron";
     repo = "Alfis";
-    rev = "v${version}";
+    rev = "28431ec0530405782038e7c02c2dedc3086bd7c9";
-    sha256 = "sha256-BNpz4SjWeZ20CxjyEIaFI43X7P3uoyWqOQssFb38Gv8=";
+    hash = "sha256-HL4RRGXE8PIcD+zTF1xZSyOpKMhKF75Mxm6KLGsR4Hc=";
   };
 
   cargoLock = {
     lockFile = ./Cargo.lock;
     outputHashes = {
-      "web-view-0.7.3" = "sha256-8C/2bXAbxP5tdo9RLvNn89krzy08+yKy3kERfz31HJE=";
+      "ecies-ed25519-ng-0.5.2" = "sha256-E+jVbgKKK1DnJWAJN+xGZPCV2n7Gxp2t7XXkDNDnPN4=";
+      "ureq-2.9.1" = "sha256-ATT2wJ9kmY/Jjw6FEbxqM9pDytKFLmu/ZqH/pJpZTu8=";
+      "web-view-0.7.3" = "sha256-eVMcpMRZHwOdWhfV6Z1uGUNOmhB41YZPaiz1tRQvhrI=";
     };
   };
 
+  nativeBuildInputs = [
+    pkg-config
+    makeWrapper
+  ];
+  buildInputs =
+    lib.optional stdenv.isDarwin Security
+    ++ lib.optional (withGui && stdenv.isLinux) webkitgtk
+    ++ lib.optionals (withGui && stdenv.isDarwin) [
+      Cocoa
+      WebKit
+    ];
+
+  buildNoDefaultFeatures = true;
+  buildFeatures = [ "doh" ] ++ lib.optional withGui "webgui";
+
   checkFlags = [
     # these want internet access, disable them
     "--skip=dns::client::tests::test_tcp_client"
     "--skip=dns::client::tests::test_udp_client"
   ];
 
-  nativeBuildInputs = [ pkg-config makeWrapper ];
-  buildInputs = lib.optional stdenv.isDarwin Security
-    ++ lib.optional (withGui && stdenv.isLinux) webkitgtk
-    ++ lib.optionals (withGui && stdenv.isDarwin) [ Cocoa WebKit ];
-
-  buildNoDefaultFeatures = true;
-  buildFeatures = [
-    "doh"
-  ] ++ lib.optional withGui "webgui";
-
   postInstall = lib.optionalString (withGui && stdenv.isLinux) ''
     wrapProgram $out/bin/alfis \
       --prefix PATH : ${lib.makeBinPath [ zenity ]}
   '';
 
-  meta = with lib; {
+  meta = {
     description = "Alternative Free Identity System";
     homepage = "https://alfis.name";
-    license = licenses.agpl3Only;
+    license = lib.licenses.agpl3Only;
-    maintainers = with maintainers; [ misuzu ];
+    maintainers = with lib.maintainers; [ misuzu ];
-    platforms = platforms.unix;
+    platforms = lib.platforms.unix;
     mainProgram = "alfis";
+    broken = withGui && stdenv.isDarwin;
   };
 }

pkgs/applications/editors/emacs/elisp-packages/manual-packages/lsp-bridge/default.nix

@@ -16,7 +16,7 @@
 }:
 
 let
-  rev = "4bfbbe4e6c44d80b15cb501fa3444ad03dba2824";
+  rev = "9e88e660d717ba597d9fe9366cf4278674734410";
   python = python3.withPackages (ps: with ps; [
     epc
     orjson
@@ -28,13 +28,13 @@ let
 in
 melpaBuild {
   pname = "lsp-bridge";
-  version = "20240622.236";
+  version = "20240629.1404";
 
   src = fetchFromGitHub {
     owner = "manateelazycat";
     repo = "lsp-bridge";
     inherit rev;
-    hash = "sha256-rzaUtUYDEZAuRjSgThHKxrQ7U8ZIO0k750aH08VpA08=";
+    hash = "sha256-qpetTKZDQjoofp8ggothYALQBpwLjuNxCq46Pe4oZZA=";
   };
 
   commit = rev;

pkgs/applications/editors/neovim/utils.nix

@@ -7,7 +7,6 @@
 , ruby
 , lua
 , python3Packages
-, writeText
 , wrapNeovimUnstable
 , runCommand
 }:
@@ -78,7 +77,7 @@ let
         ++ (extraPython3Packages ps)
         ++ (lib.concatMap (f: f ps) pluginPython3Packages));
 
-      luaEnv = neovim-unwrapped.lua.withPackages(extraLuaPackages);
+      luaEnv = neovim-unwrapped.lua.withPackages extraLuaPackages;
 
       # as expected by packdir
       packpathDirs.myNeovimPackages = myVimPackage;
@@ -101,13 +100,13 @@ let
           "--prefix" "LUA_CPATH" ";" (neovim-unwrapped.lua.pkgs.luaLib.genLuaCPathAbsStr luaEnv)
         ];
 
-      manifestRc = vimUtils.vimrcContent ({ customRC = ""; }) ;
+      manifestRc = vimUtils.vimrcContent { customRC = ""; };
       # we call vimrcContent without 'packages' to avoid the init.vim generation
-      neovimRcContent = vimUtils.vimrcContent ({
+      neovimRcContent = vimUtils.vimrcContent {
         beforePlugins = "";
         customRC = lib.concatStringsSep "\n" (pluginRC ++ [customRC]);
         packages = null;
-      });
+      };
     in
 
     builtins.removeAttrs args ["plugins"] // {
@@ -225,8 +224,25 @@ let
         } // grammar.meta;
       }
       ''
-        mkdir -p $out/parser
+        mkdir -p "$out/parser"
-        ln -s ${grammar}/parser $out/parser/${name}.so
+        ln -s "${grammar}/parser" "$out/parser/${name}.so"
+
+        mkdir -p "$out/queries/${name}"
+        if [ -d "${grammar}/queries/${name}" ]; then
+          echo "moving queries from neovim queries dir"
+          for file in "${grammar}/queries/${name}"*; do
+            ln -s "$file" "$out/queries/${name}/$(basename "$file")"
+          done
+        else
+          if [ -d "${grammar}/queries" ]; then
+            echo "moving queries from standard queries dir"
+            for file in "${grammar}/queries/"*; do
+              ln -s "$file" "$out/queries/${name}/$(basename "$file")"
+            done
+          else
+            echo "missing queries for ${name}"
+          fi
+        fi
       '');
 
   /*

pkgs/applications/editors/vim/plugins/generated.nix

@@ -10147,14 +10147,14 @@ final: prev:
 
   specs-nvim = buildVimPlugin {
     pname = "specs.nvim";
-    version = "2022-09-20";
+    version = "2024-05-19";
     src = fetchFromGitHub {
-      owner = "edluffy";
+      owner = "cxwx";
       repo = "specs.nvim";
-      rev = "2743e412bbe21c9d73954c403d01e8de7377890d";
+      rev = "dd82496f538b688cedf98429f89fef47ecb0625e";
-      sha256 = "1ycqvxrn13bfimf9k03bmm1baml8gyq5lxqjxh1fya44s2bg714r";
+      sha256 = "0427fx6iw3i2y9ny3sz1na32bxcj8i93dbm93ckxf3bii8zqjs0s";
     };
-    meta.homepage = "https://github.com/edluffy/specs.nvim/";
+    meta.homepage = "https://github.com/cxwx/specs.nvim/";
   };
 
   spellsitter-nvim = buildVimPlugin {

pkgs/applications/editors/vim/plugins/vim-plugin-names

@@ -853,7 +853,7 @@ https://github.com/chikatoike/sourcemap.vim/,,
 https://github.com/liuchengxu/space-vim/,,
 https://github.com/ctjhoa/spacevim/,,
 https://github.com/chrisgeo/sparkup/,,
-https://github.com/edluffy/specs.nvim/,,
+https://github.com/cxwx/specs.nvim/,HEAD,
 https://github.com/lewis6991/spellsitter.nvim/,HEAD,
 https://github.com/stsewd/sphinx.nvim/,,
 https://github.com/sjl/splice.vim/,,

pkgs/applications/editors/vscode/extensions/default.nix

@@ -1540,8 +1540,8 @@ let
           # semver scheme, contrary to preview versions which are listed on
           # the VSCode Marketplace and use a calver scheme. We should avoid
           # using preview versions, because they expire after two weeks.
-          version = "14.9.0";
+          version = "15.1.0";
-          hash = "sha256-Z6KeIUw1SLZ4tUgs7sU9IJO/6diozPxQuTbXr6DayHA=";
+          hash = "sha256-xGgm/WNJDIh/Bs11fLYwHQ9ULiZBWbKw4QYl/l4KYJ4=";
         };
         meta = {
           changelog = "https://marketplace.visualstudio.com/items/eamodio.gitlens/changelog";
@@ -3086,8 +3086,8 @@ let
         mktplcRef = {
           name = "compare-folders";
           publisher = "moshfeu";
-          version = "0.24.2";
+          version = "0.24.3";
-          hash = "sha256-EiGuYRMN8bXq+Cya38U+dCX2W0wzIeP0yb39WBJaX1U=";
+          hash = "sha256-eaumF2BIqEYoyL7LQ0Wx3+gkkFGpWKQoN3AisI8wTQY=";
         };
 
         meta = {

pkgs/applications/editors/vscode/extensions/ms-dotnettools.csdevkit/default.nix

@@ -14,7 +14,7 @@ let
     {
       x86_64-linux = {
         arch = "linux-x64";
-        hash = "sha256-7m85Zl9oV40le3nkNPzoKu/AAf8XhQpI8sBMsQXmBg8=";
+        hash = "sha256-lpMwA5jMr10uV4uIjq9VNOKjqduxXuDZVIIszVIXSGw=";
         binaries = [
           "components/vs-green-server/platforms/linux-x64/node_modules/@microsoft/servicehub-controller-net60.linux-x64/Microsoft.ServiceHub.Controller"
           "components/vs-green-server/platforms/linux-x64/node_modules/@microsoft/visualstudio-code-servicehost.linux-x64/Microsoft.VisualStudio.Code.ServiceHost"
@@ -24,7 +24,7 @@ let
       };
       aarch64-linux = {
         arch = "linux-arm64";
-        hash = "sha256-39D55EdwE4baDYbHc9GD/1XoxGbQkUkS1H2uysJHlxw=";
+        hash = "sha256-OaA3uNvKwbRGqMQqg6YozQF6AXxisO9ndDAFBj7wUEM=";
         binaries = [
           "components/vs-green-server/platforms/linux-arm64/node_modules/@microsoft/servicehub-controller-net60.linux-arm64/Microsoft.ServiceHub.Controller"
           "components/vs-green-server/platforms/linux-arm64/node_modules/@microsoft/visualstudio-code-servicehost.linux-arm64/Microsoft.VisualStudio.Code.ServiceHost"
@@ -34,7 +34,7 @@ let
       };
       x86_64-darwin = {
         arch = "darwin-x64";
-        hash = "sha256-gfhJX07R+DIw9FbzaEE0JZwEmDeifiq4vHyMHZZ1udM=";
+        hash = "sha256-o6B6eA4LqoLw1aGvUI95aK3pChyFXK3jUOH5Fpp4/IM=";
         binaries = [
           "components/vs-green-server/platforms/darwin-x64/node_modules/@microsoft/servicehub-controller-net60.darwin-x64/Microsoft.ServiceHub.Controller"
           "components/vs-green-server/platforms/darwin-x64/node_modules/@microsoft/visualstudio-code-servicehost.darwin-x64/Microsoft.VisualStudio.Code.ServiceHost"
@@ -44,7 +44,7 @@ let
       };
       aarch64-darwin = {
         arch = "darwin-arm64";
-        hash = "sha256-vogstgCWvI9csNF9JfJ41XPR1POy842g2yhWqIDoHLw=";
+        hash = "sha256-cDv1l57C73UEtSJhTO+xb2sSX8xwepzJYxYuGsNq+r4=";
         binaries = [
           "components/vs-green-server/platforms/darwin-arm64/node_modules/@microsoft/servicehub-controller-net60.darwin-arm64/Microsoft.ServiceHub.Controller"
           "components/vs-green-server/platforms/darwin-arm64/node_modules/@microsoft/visualstudio-code-servicehost.darwin-arm64/Microsoft.VisualStudio.Code.ServiceHost"
@@ -59,7 +59,7 @@ buildVscodeMarketplaceExtension {
   mktplcRef = {
     name = "csdevkit";
     publisher = "ms-dotnettools";
-    version = "1.4.28";
+    version = "1.7.27";
     inherit (extInfo) hash arch;
   };
   sourceRoot = "extension"; # This has more than one folder.

pkgs/applications/editors/vscode/extensions/ms-dotnettools.csharp/default.nix

@@ -29,22 +29,22 @@ let
     {
       x86_64-linux = {
         arch = "linux-x64";
-        hash = "sha256-si4HKGVIHu44QNlNI2WEnMff9+QZOMWiBfWQaaFGyQE=";
+        hash = "sha256-Y+Re3tDX8HQrWo045JxdX8Jt4jomm1/C9T+BU2/hE+g=";
         binaries = linuxBins;
       };
       aarch64-linux = {
         arch = "linux-arm64";
-        hash = "sha256-1IXkSRgCHOLD4VeCdqyy54MXCBUX5RDDb3pf7GQH5jA=";
+        hash = "sha256-nFCFK2GVLljMqmxJnlma6kAXHc9qN/DnnRiWrkjmLmo=";
         binaries = linuxBins;
       };
       x86_64-darwin = {
         arch = "darwin-x64";
-        hash = "sha256-AAbYjZ+YYyGEXSLkiFfluLf7P4OzPhmHzK44N5XT9UI=";
+        hash = "sha256-hC1ZJdBKJR3om9xuxEBhaBtQXEin1R0t7BFVdOUu6X8=";
         binaries = darwinBins;
       };
       aarch64-darwin = {
         arch = "darwin-arm64";
-        hash = "sha256-1m47kX0Jo+UvthNfgdoPdBBOcDyCA8DfP+zRk3SicR0=";
+        hash = "sha256-mIZJXgACvJmhrJzOtKcF2DKeBkLSjKehE1xEwtp1X+E=";
         binaries = darwinBins ++ [
           ".debugger/arm64/vsdbg-ui"
           ".debugger/arm64/vsdbg"
@@ -57,7 +57,7 @@ buildVscodeMarketplaceExtension {
   mktplcRef = {
     name = "csharp";
     publisher = "ms-dotnettools";
-    version = "2.22.3";
+    version = "2.34.12";
     inherit (extInfo) hash arch;
   };
 

pkgs/applications/emulators/retroarch/hashes.json

@@ -5,10 +5,10 @@
         "src": {
             "owner": "libretro",
             "repo": "libretro-2048",
-            "rev": "331c1de588ed8f8c370dcbc488e5434a3c09f0f2",
+            "rev": "5474ed1ab880b3296c9860d0943d7de1970c79dd",
-            "hash": "sha256-gPrAmoBnfuTnW6t699pqS43vE6t0ca3jZcqTNRaJipA="
+            "hash": "sha256-i6bbxsLpSicDDGYKAxTMCMioHHfvBzVokun3PNYgDsc="
         },
-        "version": "unstable-2023-02-20"
+        "version": "unstable-2024-06-28"
     },
     "atari800": {
         "fetcher": "fetchFromGitHub",

pkgs/applications/emulators/wine/sources.nix

@@ -69,9 +69,9 @@ in rec {
 
   unstable = fetchurl rec {
     # NOTE: Don't forget to change the hash for staging as well.
-    version = "9.11";
+    version = "9.12";
     url = "https://dl.winehq.org/wine/source/9.x/wine-${version}.tar.xz";
-    hash = "sha256-36AMJk6nEWnQKoSagz5Iyudh+whCKgDfhkTr1nv4ckA=";
+    hash = "sha256-CRRa5yCy+fGBh5cLoGQLvzztWujceK8dfVf1B37CavY=";
     inherit (stable) patches;
 
     ## see http://wiki.winehq.org/Gecko
@@ -88,9 +88,9 @@ in rec {
 
     ## see http://wiki.winehq.org/Mono
     mono = fetchurl rec {
-      version = "9.1.0";
+      version = "9.2.0";
       url = "https://dl.winehq.org/wine/wine-mono/${version}/wine-mono-${version}-x86.msi";
-      hash = "sha256-igoeaDe0lN9Jkn5ddZscaQjom4ovjjrQJeHCiBiCR24=";
+      hash = "sha256-/VgpJE2SmFuKQEdFrd21jDqbC7ttVMpMbq+G6kZnNfk=";
     };
 
     updateScript = writeShellScript "update-wine-unstable" ''
@@ -117,7 +117,7 @@ in rec {
   staging = fetchFromGitLab rec {
     # https://gitlab.winehq.org/wine/wine-staging
     inherit (unstable) version;
-    hash = "sha256-vqlikMatRlGxvWJ6BJu2HyBclV4x+vzNPNe8py7jKqo=";
+    hash = "sha256-lvjuohEo4pwCAd1KmLjUBakS5gSN+Ic6+QQ18sS3axw=";
     domain = "gitlab.winehq.org";
     owner = "wine";
     repo = "wine-staging";

pkgs/applications/graphics/azpainter/default.nix

@@ -9,13 +9,13 @@
 
 stdenv.mkDerivation rec {
   pname = "azpainter";
-  version = "3.0.7";
+  version = "3.0.8";
 
   src = fetchFromGitLab {
     owner = "azelpg";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-RlsiN9pefpTYUh4M8j4Ty/Ipi9StoVcNcICd7QDirhI=";
+    hash = "sha256-NiQYX/Dcl/t30Jx08DKr6EP5ODS00pyEGKh/qiNT5t4=";
   };
 
   nativeBuildInputs = [

pkgs/applications/graphics/krita/default.nix

@@ -1,7 +1,7 @@
 { callPackage, ... }:
 
 callPackage ./generic.nix {
-  version = "5.2.2";
+  version = "5.2.3";
   kde-channel = "stable";
-  hash = "sha256-wdLko219iqKW0CHlK+STzGedP+Xoqk/BPENNM+gVTOI=";
+  hash = "sha256-RmpG7bk8PjetZSB8+WAjSJCnJ0Tg9E8shV3kx9iCXMA=";
 }

pkgs/applications/graphics/krita/generic.nix

@@ -28,12 +28,6 @@ mkDerivation rec {
       url = "https://invent.kde.org/graphics/krita/-/commit/2d71c47661d43a4e3c1ab0c27803de980bdf2bb2.diff";
       hash = "sha256-U3E44nj4vra++PJV20h4YHjES78kgrJtr4ktNeQfOdA=";
     })
-    # Fixes build with libjxl 0.9.0
-    (fetchpatch {
-      name = "fix-build-with-libjxl-0.9.0.patch";
-      url = "https://invent.kde.org/graphics/krita/-/commit/ace7edcca6ad322581ab39620f21ccf3ffbd3b5a.diff";
-      hash = "sha256-dXk4+HNS0+Ie/8V4+Oj4rBJrJbNHG57gIzPymXLEc9M=";
-    })
   ];
 
   nativeBuildInputs = [ cmake extra-cmake-modules pkg-config python3Packages.sip ];

pkgs/applications/graphics/pineapple-pictures/default.nix

@@ -11,13 +11,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "pineapple-pictures";
-  version = "0.7.4";
+  version = "0.8.0";
 
   src = fetchFromGitHub {
     owner = "BLumia";
     repo = "pineapple-pictures";
     rev = finalAttrs.version;
-    hash = "sha256-aiQlcTID8mfrT4MEx4s5K+QmMHBlHOu2HfsValiH5qU=";
+    hash = "sha256-/0+zIPvQFwQYX1jtu0U8rKLFAbHP0lk5RYHxVUZhebA=";
   };
 
   nativeBuildInputs = [

pkgs/applications/graphics/yed/default.nix

@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "yEd";
-  version = "3.23.2";
+  version = "3.24";
 
   src = fetchzip {
     url = "https://www.yworks.com/resources/yed/demo/${pname}-${version}.zip";
-    sha256 = "sha256-u83OmIzq9VygKbfa886mj6BIa/9ET1btry2nR/wxeyI=";
+    sha256 = "sha256-4aotsOippuKUucweWERtqm/5pz2gwW1Sue48KPisQ0I=";
   };
 
   nativeBuildInputs = [ makeWrapper unzip wrapGAppsHook3 ];

pkgs/applications/misc/gallery-dl/default.nix

@@ -9,13 +9,13 @@
 
 buildPythonApplication rec {
   pname = "gallery-dl";
-  version = "1.27.0";
+  version = "1.27.1";
   format = "setuptools";
 
   src = fetchPypi {
     inherit version;
     pname = "gallery_dl";
-    hash = "sha256-zMimHjaXgwOSt8HbSec4o0y3e9Xf6tFFiI4KzsrP850=";
+    hash = "sha256-S1RF0FNJ/oKTwq9SXXIOnqBIViGIYBVuxPjV/6fbeV8=";
   };
 
   propagatedBuildInputs = [

pkgs/applications/misc/j4-dmenu-desktop/default.nix

@@ -31,6 +31,6 @@ stdenv.mkDerivation (finalAttrs: {
     license = licenses.gpl3Only;
     mainProgram = "j4-dmenu-desktop";
     maintainers = with maintainers; [ ericsagnes ];
-    platforms = platforms.unix;
+    platforms = platforms.linux;
   };
 })

pkgs/applications/misc/mobilecoin-wallet/default.nix

@@ -2,10 +2,10 @@
 
 let
   pname = "mobilecoin-wallet";
-  version = "1.8.0";
+  version = "1.9.1";
   src = fetchurl {
     url = "https://github.com/mobilecoinofficial/desktop-wallet/releases/download/v${version}/MobileCoin.Wallet-${version}.AppImage";
-    hash = "sha256-XGU/xxsMhOBAh+MeMtL2S707yH8HnoO9w5l7zqjO6rs=";
+    hash = "sha256-UCBQRcGFHMQlLGvChrrMmM0MYv7AZtlkngFK4ptIPU0=";
   };
   appimageContents = appimageTools.extractType2 { inherit pname version src; };
 

pkgs/applications/misc/pdfarranger/default.nix

@@ -9,14 +9,14 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "pdfarranger";
-  version = "1.10.1";
+  version = "1.11.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "pdfarranger";
     repo = "pdfarranger";
     rev = "refs/tags/${version}";
-    hash = "sha256-l//DeaIqUl6FdGFxM8yTKcTjVNvYMllorcoXoK33Iy4=";
+    hash = "sha256-bHV6EluA7xp+HyejnSWJwfRBDcTuZq5Gzz0KWIs0qhA=";
   };
 
   nativeBuildInputs = [

pkgs/applications/misc/rtfm/default.nix

@@ -18,14 +18,14 @@ let
 in
 crystal.buildCrystalPackage rec {
   pname = "rtfm";
-  version = "0.4.1";
+  version = "0.5.0";
 
   src = fetchFromGitHub {
     owner = "hugopl";
     repo = "rtfm";
     rev = "v${version}";
     name = "rtfm";
-    hash = "sha256-cloaGlHjtwrjuPGzAG55B58w307R+TO+MixAWTw2ags=";
+    hash = "sha256-+s7KXl3+j/BaneOBqVAMJJhmrG6xtcGaHhYnMvUfiVA=";
   };
 
   patches = [

pkgs/applications/networking/browsers/microsoft-edge/default.nix

@@ -1,20 +1,20 @@
 {
   beta = import ./browser.nix {
     channel = "beta";
-    version = "126.0.2592.53";
+    version = "126.0.2592.68";
     revision = "1";
-    hash = "sha256-d1zqZUhk5C/jrdZngQQlGplrSssE/LUR3/AybStNavE=";
+    hash = "sha256-ThWtnWF7iL0OEq7+yA7vCowGZrjeiLx+d+Nff4Bwl4s=";
   };
   dev = import ./browser.nix {
     channel = "dev";
-    version = "127.0.2638.2";
+    version = "127.0.2651.2";
     revision = "1";
-    hash = "sha256-Bv0X30ilcNBI9pblnrO1QA7ElTPMO5/JmIZIjhldO7Y=";
+    hash = "sha256-eYCxGMIjclqFxOy6AyLKN5DJnplq/Vf3ClYbYWV3HAw=";
   };
   stable = import ./browser.nix {
     channel = "stable";
-    version = "125.0.2535.92";
+    version = "126.0.2592.68";
     revision = "1";
-    hash = "sha256-DuVz6+BzGTWZJ4smizIK2dV1OTmv0uTIQpD+yclHDN8=";
+    hash = "sha256-btpUMmgZ9SQL4WGKynGA/dL/8Ve9hdjoDNsBNxG531Y=";
   };
 }

pkgs/applications/networking/browsers/qutebrowser/default.nix

@@ -26,7 +26,7 @@ let
     stripRoot = false;
   };
 
-  version = "3.2.0";
+  version = "3.2.1";
 in
 
 python3.pkgs.buildPythonApplication {
@@ -34,7 +34,7 @@ python3.pkgs.buildPythonApplication {
   inherit version;
   src = fetchurl {
     url = "https://github.com/qutebrowser/qutebrowser/releases/download/v${version}/qutebrowser-${version}.tar.gz";
-    hash = "sha256-4eGRG5VWI2rKpZ0NGYbWFHlvs2Zz0TljwhZYzWSh8DM=";
+    hash = "sha256-AqevKmxds42HsiWwuEEsgNmDgzXzLQ6KOPbX+804iX0=";
   };
 
   # Needs tox

pkgs/applications/networking/browsers/vivaldi/default.nix

@@ -24,7 +24,7 @@ let
   vivaldiName = if isSnapshot then "vivaldi-snapshot" else "vivaldi";
 in stdenv.mkDerivation rec {
   pname = "vivaldi";
-  version = "6.7.3329.41";
+  version = "6.8.3381.46";
 
   suffix = {
     aarch64-linux = "arm64";
@@ -34,8 +34,8 @@ in stdenv.mkDerivation rec {
   src = fetchurl {
     url = "https://downloads.vivaldi.com/${branch}/vivaldi-${branch}_${version}-1_${suffix}.deb";
     hash = {
-      aarch64-linux = "sha256-jDAairYILLLiMssBvct+hZ1D2sqTsvV43IxF1UdlwpQ=";
+      aarch64-linux = "sha256-OR79+Y2z9b8aE5WecIlbJsJx6wdMDnlWjCE9HYmOfn0=";
-      x86_64-linux = "sha256-nipvNDc+iHIupUdl2kQIDJhUyVP/dFAUJiAN5jBY38M=";
+      x86_64-linux = "sha256-F8HibI1fWI0nPWaXDNgrSHcp2iTuC9LZhble877zrMg=";
     }.${stdenv.hostPlatform.system} or (throw "Unsupported system: ${stdenv.hostPlatform.system}");
   };
 

pkgs/applications/networking/browsers/vivaldi/ffmpeg-codecs.nix

@@ -4,11 +4,11 @@
 # downloads at https://vivaldi.com/download/
 stdenv.mkDerivation rec {
   pname = "chromium-codecs-ffmpeg-extra";
-  version = "114023";
+  version = "115541";
 
   src = fetchurl {
-    url = "https://api.snapcraft.io/api/v1/snaps/download/XXzVIXswXKHqlUATPqGCj2w2l7BxosS8_37.snap";
+    url = "https://api.snapcraft.io/api/v1/snaps/download/XXzVIXswXKHqlUATPqGCj2w2l7BxosS8_41.snap";
-    hash = "sha256-l1eHTAJvpkWof7Yj7M5uaa3YdLWw9F+/QvIUAfBx3ow=";
+    hash = "sha256-a1peHhku+OaGvPyChvLdh6/7zT+v8OHNwt60QUq7VvU=";
   };
 
   buildInputs = [ squashfsTools ];

pkgs/applications/networking/cloudflared/default.nix

@@ -7,13 +7,13 @@
 
 buildGoModule rec {
   pname = "cloudflared";
-  version = "2024.4.1";
+  version = "2024.6.1";
 
   src = fetchFromGitHub {
     owner = "cloudflare";
     repo = "cloudflared";
     rev = "refs/tags/${version}";
-    hash = "sha256-rDw25kFiD16xma/LozGjlc/Tm6hoRYzHs8spTk6HU6Y=";
+    hash = "sha256-hgZ9+ltS7y5nOPdGFnql4KzgBXh5zgAfXLJy8REOY8o=";
   };
 
   vendorHash = null;

pkgs/applications/networking/cluster/atmos/default.nix

@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "atmos";
-  version = "1.81.0";
+  version = "1.83.0";
 
   src = fetchFromGitHub {
     owner = "cloudposse";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-drreGXCYpjF1UD1OUzuGh2rezEhHw7Zq0Y6JujLsMMk=";
+    sha256 = "sha256-FIl+SWYK8+OLuynhma7IG2fozekhGZKK/t5RgD+eTtA=";
   };
 
-  vendorHash = "sha256-ojl+dGrj+zmE2lqlclq3jA0K6AXdi9Ofhd4GA6nVrDo=";
+  vendorHash = "sha256-dklmWu+PHSEeQM2MWBkYMiyw5rX9S8SI3l86nst6v9E=";
 
   ldflags = [ "-s" "-w" "-X github.com/cloudposse/atmos/cmd.Version=v${version}" ];
 

pkgs/applications/networking/cluster/cilium/default.nix

@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "cilium-cli";
-  version = "0.16.10";
+  version = "0.16.11";
 
   src = fetchFromGitHub {
     owner = "cilium";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-SgAqq9tT4Rtg1AvoUsDvR5cCLIOuHwNUFN2NOheciYw=";
+    hash = "sha256-muIVjT6ssNejp5O8ju06h9e7ZVcfwXyHgQIa0IEP4Xg=";
   };
 
   vendorHash = null;

pkgs/applications/networking/cluster/k3s/1_29/versions.nix

@@ -1,14 +1,14 @@
 {
-  k3sVersion = "1.29.5+k3s1";
+  k3sVersion = "1.29.6+k3s1";
-  k3sCommit = "4e53a32306759581f4ed938bcd18b6fa20b83230";
+  k3sCommit = "83ae095ab9197f168a6bd3f6bd355f89bce39a9c";
-  k3sRepoSha256 = "169hzl23chs4qblicmqj3j10jg1xdq8s9717bd3pzx7wzz9s9mqw";
+  k3sRepoSha256 = "0gv7xh08mhgc2cyzpsvdi69xknifcpdy6znbim6r3r4lbcw2bkl9";
-  k3sVendorHash = "sha256-QreiB4JMtfBjHlkAyflQAW2rnfgay62UD6emx8TgUpM=";
+  k3sVendorHash = "sha256-OiZLUjQUCwso+NHg3aOrXx6/HSFOfwtzwVmLr/Fjfpw=";
   chartVersions = import ./chart-versions.nix;
   k3sRootVersion = "0.13.0";
   k3sRootSha256 = "1jq5f0lm08abx5ikarf92z56fvx4kjpy2nmzaazblb34lajw87vj";
   k3sCNIVersion = "1.4.0-k3s2";
   k3sCNISha256 = "17dg6jgjx18nrlyfmkv14dhzxsljz4774zgwz5dchxcf38bvarqa";
-  containerdVersion = "1.7.15-k3s1";
+  containerdVersion = "1.7.17-k3s1";
-  containerdSha256 = "18hlj4ixjk7wvamfd66xyc0cax2hs9s7yjvlx52afxdc73194y0f";
+  containerdSha256 = "1j61mbgx346ydvnjd8b07wf7nmvvplx28wi5jjdzi1k688r2hxpf";
   criCtlVersion = "1.29.0-k3s1";
 }

pkgs/applications/networking/instant-messengers/signal-desktop/signal-desktop-beta.nix

@@ -2,7 +2,7 @@
 callPackage ./generic.nix { } rec {
   pname = "signal-desktop-beta";
   dir = "Signal Beta";
-  version = "7.14.0-beta.1";
+  version = "7.15.0-beta.1";
   url = "https://updates.signal.org/desktop/apt/pool/s/signal-desktop-beta/signal-desktop-beta_${version}_amd64.deb";
-  hash = "sha256-SC7CCqylPkc/qmlSYlXJcVWGi1+hvRQ9qBGR6wqo6sk=";
+  hash = "sha256-RnaYRd7hKTazh0dEX3wv0fFsdbYv0aqNJtswv8/f+YU=";
 }

pkgs/applications/networking/instant-messengers/signal-desktop/signal-desktop.nix

@@ -2,7 +2,7 @@
 callPackage ./generic.nix { } rec {
   pname = "signal-desktop";
   dir = "Signal";
-  version = "7.13.0";
+  version = "7.14.0";
   url = "https://updates.signal.org/desktop/apt/pool/s/signal-desktop/signal-desktop_${version}_amd64.deb";
-  hash = "sha256-lwo5O8UAjjMuaeM8J804oN+y72uYZBL+eP/NwpnD4H0=";
+  hash = "sha256-nRvGpAKRIPgXStrVu4qSMoW01SACV/wW/c05lLncCW8=";
 }

pkgs/applications/networking/instant-messengers/telegram/kotatogram-desktop/default.nix

@@ -220,7 +220,5 @@ stdenv.mkDerivation rec {
     homepage = "https://kotatogram.github.io";
     changelog = "https://github.com/kotatogram/kotatogram-desktop/releases/tag/k{version}";
     maintainers = with maintainers; [ ilya-fedin ];
-    # never built on aarch64-darwin since first introduction in nixpkgs
-    broken = stdenv.isDarwin && stdenv.isAarch64;
   };
 }

pkgs/applications/networking/iroh/default.nix

@@ -7,16 +7,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "iroh";
-  version = "0.17.0";
+  version = "0.19.0";
 
   src = fetchFromGitHub {
     owner = "n0-computer";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-CemVlw0S4UmKFopWSh1Hv2znMRN3guIBx303esK/gLw=";
+    hash = "sha256-mTa+vdYSBcXTYlcDGJWktGVRC6NPBGcjb+syr/A1QIQ=";
   };
 
-  cargoHash = "sha256-LgA6gdBRLsow98nv9A5rYb/v/FGzu/LPQwftyeuKHk4=";
+  cargoHash = "sha256-xTPx4P9SbOyC3YjZNxNFh65pSfiPjMKV+wgZtT00Me0=";
 
   buildInputs = lib.optionals stdenv.isDarwin (
     with darwin.apple_sdk.frameworks; [

pkgs/applications/networking/mumble/default.nix

@@ -27,6 +27,7 @@ let
 
     cmakeFlags = [
       "-D g15=OFF"
+      "-D CMAKE_CXX_STANDARD=17" # protobuf >22 requires C++ 17
     ] ++ (overrides.configureFlags or [ ]);
 
     preConfigure = ''

pkgs/applications/networking/nextcloud-client/default.nix

@@ -26,7 +26,7 @@
 
 stdenv.mkDerivation rec {
   pname = "nextcloud-client";
-  version = "3.13.0";
+  version = "3.13.1";
 
   outputs = [ "out" "dev" ];
 
@@ -34,7 +34,7 @@ stdenv.mkDerivation rec {
     owner = "nextcloud";
     repo = "desktop";
     rev = "v${version}";
-    hash = "sha256-i4vQGH9NSxIrLaPdCEh+WN6i6NQilH6uO4dSk/mhLi8=";
+    hash = "sha256-Ux0zbOribIbrABQQtUbp6NK96YYaHgREQUmgm9/MQaI=";
   };
 
   patches = [

pkgs/applications/office/beancount/beancount_share.nix

@@ -25,5 +25,7 @@ python3.pkgs.buildPythonApplication rec {
     description = "Beancount plugin to share expenses with external partners within one ledger";
     license = licenses.agpl3Plus;
     maintainers = with maintainers; [ matthiasbeyer ];
+    broken = true; # At 2024-06-29, missing unpacked dependency
+                   # https://hydra.nixos.org/build/262800507/nixlog/1
   };
 }

pkgs/applications/office/libreoffice/darwin/default.nix

@@ -44,7 +44,7 @@ stdenvNoCC.mkDerivation {
     cp -R . $out/Applications/${appName}
     cat > $out/bin/${scriptName} << EOF
     #!${stdenvNoCC.shell}
-    open -na $out/Applications/${appName} --args "$@"
+    open -na $out/Applications/${appName} --args "\$@"
     EOF
     chmod +x $out/bin/${scriptName}
     runHook postInstall

pkgs/applications/office/morgen/default.nix

@@ -3,11 +3,11 @@
 
 stdenv.mkDerivation rec {
   pname = "morgen";
-  version = "3.4.5";
+  version = "3.5.1";
 
   src = fetchurl {
     url = "https://dl.todesktop.com/210203cqcj00tw1/versions/${version}/linux/deb";
-    hash = "sha256-5oBIw9PVbEGF1e47GeYNF6gJFm5z3M9KeJ1711cAg2s=";
+    hash = "sha256-YvgVCviqAuGlT61ANktztzqRYBtROsVrScGMxY6IeEs=";
   };
 
   nativeBuildInputs = [

pkgs/applications/radio/cloudlog/default.nix

@@ -8,13 +8,13 @@
 
 stdenvNoCC.mkDerivation rec {
   pname = "cloudlog";
-  version = "2.6.14";
+  version = "2.6.15";
 
   src = fetchFromGitHub {
     owner = "magicbug";
     repo = "Cloudlog";
     rev = version;
-    hash = "sha256-nsn/pvlFRDGUnm/X5pyzlKWgP6OlfVn3Mdj6vOJZMWQ=";
+    hash = "sha256-G+PnzyOG/HZ8I66BHdtK0GOUF7ATrTYpzM9sVaSjMDQ=";
   };
 
   postPatch = ''

pkgs/applications/radio/gnuradio/3.9.nix

@@ -154,6 +154,7 @@ let
       pythonRuntime = with python.pkgs; [
         scipy
         pyqtgraph
+        pyqt5
       ];
     };
     gr-analog = {

pkgs/applications/radio/gnuradio/default.nix

@@ -156,6 +156,7 @@ let
       pythonRuntime = with python.pkgs; [
         scipy
         pyqtgraph
+        pyqt5
       ];
     };
     gr-analog = {

pkgs/applications/radio/quisk/default.nix

@@ -8,11 +8,11 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "quisk";
-  version = "4.2.34";
+  version = "4.2.35";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-PwBQmL6CnDp55eLhXr3vpJXf4DcKAwzFSCnzxt5Nob4=";
+    sha256 = "sha256-2QCFUV7FpNiqGPHLXAMHJcnCn9FOk1mx12P9ZDtvVvg=";
   };
 
   buildInputs = [

pkgs/applications/science/biology/gatk/default.nix

@@ -2,10 +2,10 @@
 
 stdenv.mkDerivation rec {
   pname = "gatk";
-  version = "4.5.0.0";
+  version = "4.6.0.0";
   src = fetchzip {
     url = "https://github.com/broadinstitute/gatk/releases/download/${version}/gatk-${version}.zip";
-    sha256 = "sha256-c3YZsSCjZY75jooiqtc8x/xsWTvYm9labUcOydDlSRQ=";
+    sha256 = "sha256-AwGRkgVbG2gA4K1JG0WPr4v18JHG5YzYUKdJ2EJZX+Y=";
   };
 
   nativeBuildInputs = [ makeWrapper ];

pkgs/applications/science/biology/picard-tools/default.nix

@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "picard-tools";
-  version = "3.1.1";
+  version = "3.2.0";
 
   src = fetchurl {
     url = "https://github.com/broadinstitute/picard/releases/download/${version}/picard.jar";
-    sha256 = "sha256-FcefUf0KwAEEn53XubrB2991ncsCMKicf20fJG6LurQ=";
+    sha256 = "sha256-4lj6Lj9fphzWeZ7I4HP0mpX73OrxY9imCXGyYZuG+kE=";
   };
 
   nativeBuildInputs = [ makeWrapper ];

pkgs/applications/science/logic/cbmc/default.nix

@@ -13,13 +13,13 @@
 
 stdenv.mkDerivation rec {
   pname = "cbmc";
-  version = "6.0.0";
+  version = "6.0.1";
 
   src = fetchFromGitHub {
     owner = "diffblue";
     repo = pname;
     rev = "${pname}-${version}";
-    sha256 = "sha256-mPRkkKN7Hz9Qi6a3fEwVFh7a9OaBFcksNw9qwNOarao=";
+    sha256 = "sha256-7syRpCNL7TRZoJaNrmAdahNy7IyovyniYyOwD/lzhuw=";
   };
 
   nativeBuildInputs = [

pkgs/applications/science/math/fricas/default.nix

@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "fricas";
-  version = "1.3.10";
+  version = "1.3.11";
 
   src = fetchFromGitHub {
     owner = "fricas";
     repo = "fricas";
     rev = version;
-    sha256 = "sha256-T1xDndDnHq/hmhTWWO3Eu0733u8+C8sJMCF6pbLU2GI=";
+    sha256 = "sha256-EX/boSs6rK4RrJ5W6Rd0TSHsbQsNiFI1evFuNPBMeu8=";
   };
 
   buildInputs = [ sbcl libX11 libXpm libICE libSM libXt libXau libXdmcp ];

pkgs/applications/search/doodle/default.nix

@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "doodle";
-  version = "0.7.2";
+  version = "0.7.3";
 
   buildInputs = [ libextractor gettext ];
 
   src = fetchurl {
     url = "https://grothoff.org/christian/doodle/download/doodle-${version}.tar.gz";
-    sha256 = "sha256-dtRPfUjhBNgN+5zHMYmszISmBv1+K6yjKsbQBiAXWRA=";
+    sha256 = "sha256-qodp2epYyolg38MNhBV+/NMLmfXjhsn2X9uKTUniv2s=";
   };
 
   meta = {

pkgs/applications/video/shotcut/default.nix

@@ -21,13 +21,13 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "shotcut";
-  version = "24.06.02";
+  version = "24.06.26";
 
   src = fetchFromGitHub {
     owner = "mltframework";
     repo = "shotcut";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-zqP3xGaNx6z3DdEyKZTauXGTY16dZPL/2+gKtgdx4Y8=";
+    hash = "sha256-9eQF3s4BAUK81/94z7cMkd2NWdNLVMraP08qsDmuAI8=";
   };
 
   nativeBuildInputs = [ pkg-config cmake wrapQtAppsHook ];

pkgs/applications/virtualization/docker/default.nix

@@ -314,4 +314,18 @@ rec {
     tiniHash = "sha256-ZDKu/8yE5G0RYFJdhgmCdN3obJNyRWv6K/Gd17zc1sI=";
   };
 
+  docker_27 = callPackage dockerGen rec {
+    version = "27.0.2";
+    cliRev = "v${version}";
+    cliHash = "sha256-6Occc3jZNS5N76bxLA+WBJuIzF8GJeaXWOMHfFjikIM=";
+    mobyRev = "v${version}";
+    mobyHash = "sha256-v5uhFQPbBIpfnKtAkmbq4w+TbaG01tqTSWNBE3NvPKU=";
+    runcRev = "v1.1.13";
+    runcHash = "sha256-RQsM8Q7HogDVGbNpen3wxXNGR9lfqmNhkXTRoC+LBk8=";
+    containerdRev = "v1.7.18";
+    containerdHash = "sha256-IlK5IwniaBhqMgxQzV8btQcbdJkNEQeUMoh6aOsBOHQ=";
+    tiniRev = "v0.19.0";
+    tiniHash = "sha256-ZDKu/8yE5G0RYFJdhgmCdN3obJNyRWv6K/Gd17zc1sI=";
+  };
+
 }

pkgs/applications/virtualization/virtualbox/default.nix

@@ -22,9 +22,6 @@
 , extraConfigureFlags ? ""
 }:
 
-# See https://github.com/cyberus-technology/virtualbox-kvm/issues/12
-assert enableKvm -> !enableHardening;
-
 # The web services use Java infrastructure.
 assert enableWebService -> javaBindings;
 
@@ -35,8 +32,8 @@ let
   virtualboxVersion = "7.0.18";
   virtualboxSha256 = "d999513533631674a024762668de999411d8197060c51e68c5faf0a2c0eea1a5";
 
-  kvmPatchVersion = "20240515";
+  kvmPatchVersion = "20240617";
-  kvmPatchHash = "sha256-Kh/tlPScdf7CbEEpL54iqMpeUIdmnJL2r/mxnlEzLd0=";
+  kvmPatchHash = "sha256-bOcM9xA1SXB1uTwljpw2vevVeSdHa3omCRon/8DoAUk=";
 
   # The KVM build is not compatible to VirtualBox's kernel modules. So don't export
   # modsrc at all.

pkgs/build-support/kernel/make-initrd.nix

@@ -56,7 +56,7 @@ in
 , prepend ? []
 
 # Whether to wrap the initramfs in a u-boot image.
-, makeUInitrd ? stdenvNoCC.hostPlatform.linux-kernel.target == "uImage"
+, makeUInitrd ? stdenvNoCC.hostPlatform.linux-kernel.target or "dummy" == "uImage"
 
 # If generating a u-boot image, the architecture to use. The default
 # guess may not align with u-boot's nomenclature correctly, so it can
@@ -75,11 +75,9 @@ let
   toValidStoreName = x: with builtins;
     lib.concatStringsSep "-" (filter (x: !(isList x)) (split "[^a-zA-Z0-9_=.?-]+" x));
 
-in stdenvNoCC.mkDerivation rec {
+in stdenvNoCC.mkDerivation (rec {
   inherit name makeUInitrd extension uInitrdArch prepend;
 
-  ${if makeUInitrd then "uInitrdCompression" else null} = uInitrdCompression;
-
   builder = ./make-initrd.sh;
 
   nativeBuildInputs = [ perl libarchive ]
@@ -110,4 +108,6 @@ in stdenvNoCC.mkDerivation rec {
       contents
       (lib.range 0 (lib.length contents - 1));
   pathsFromGraph = ./paths-from-graph.pl;
-}
+} // lib.optionalAttrs makeUInitrd {
+  uInitrdCompression = uInitrdCompression;
+})

pkgs/build-support/rust/build-rust-crate/build-crate.nix

@@ -1,5 +1,5 @@
 { lib, stdenv
-, mkRustcDepArgs, mkRustcFeatureArgs, needUnstableCLI
+, mkRustcDepArgs, mkRustcFeatureArgs, needUnstableCLI, rustc
 }:
 
 { crateName,
@@ -27,6 +27,10 @@
       # since rustc 1.42 the "proc_macro" crate is part of the default crate prelude
       # https://github.com/rust-lang/cargo/commit/4d64eb99a4#diff-7f98585dbf9d30aa100c8318e2c77e79R1021-R1022
       ++ lib.optional (lib.elem "proc-macro" crateType) "--extern proc_macro"
+      ++ lib.optional (stdenv.hostPlatform.linker == "lld") # Needed when building for targets that use lld. e.g. 'wasm32-unknown-unknown'
+        "-C linker=${rustc.llvmPackages.lld}/bin/lld"
+      ++ lib.optional (stdenv.hasCC && stdenv.hostPlatform.linker != "lld")
+        "-C linker=${stdenv.cc}/bin/${stdenv.cc.targetPrefix}cc"
     ;
     rustcMeta = "-C metadata=${metadata} -C extra-filename=-${metadata}";
 
@@ -39,10 +43,7 @@
       ++ (map (x: "--crate-type ${x}") crateType)
     );
 
-    binRustcOpts = lib.concatStringsSep " " (
+    binRustcOpts = lib.concatStringsSep " " baseRustcOpts;
-      [ "-C linker=${stdenv.cc}/bin/${stdenv.cc.targetPrefix}cc" ] ++
-      baseRustcOpts
-    );
 
     build_bin = if buildTests then "build_bin_test" else "build_bin";
   in ''

pkgs/build-support/rust/build-rust-crate/default.nix

@@ -16,6 +16,16 @@
 }:
 
 let
+  # Returns a true if the builder's rustc was built with support for the target.
+  targetAlreadyIncluded = lib.elem stdenv.hostPlatform.rust.rustcTarget
+    (lib.splitString "," (lib.removePrefix "--target=" (
+      lib.elemAt (lib.filter (f: lib.hasPrefix "--target=" f) pkgsBuildBuild.rustc.unwrapped.configureFlags) 0)
+    ));
+
+  # If the build's rustc was built with support for the target then reuse it. (Avoids uneeded compilation for targets like `wasm32-unknown-unknown`)
+  rustc' = if targetAlreadyIncluded then pkgsBuildBuild.rustc else rustc;
+  cargo' = if targetAlreadyIncluded then pkgsBuildBuild.cargo else cargo;
+
   # Create rustc arguments to link against the given list of dependencies
   # and renames.
   #
@@ -77,6 +87,7 @@ let
 
   buildCrate = import ./build-crate.nix {
     inherit lib stdenv mkRustcDepArgs mkRustcFeatureArgs needUnstableCLI;
+    rustc = rustc';
   };
 
   installCrate = import ./install-crate.nix { inherit stdenv; };
@@ -274,7 +285,8 @@ crate_: lib.makeOverridable
       name = "rust_${crate.crateName}-${crate.version}${lib.optionalString buildTests_ "-test"}";
       version = crate.version;
       depsBuildBuild = [ pkgsBuildBuild.stdenv.cc ];
-      nativeBuildInputs = [ rust stdenv.cc cargo jq ]
+      nativeBuildInputs = [ rustc' cargo' jq ]
+        ++ lib.optionals stdenv.hasCC [ stdenv.cc ]
         ++ lib.optionals stdenv.buildPlatform.isDarwin [ libiconv ]
         ++ (crate.nativeBuildInputs or [ ]) ++ nativeBuildInputs_;
       buildInputs = lib.optionals stdenv.isDarwin [ libiconv ] ++ (crate.buildInputs or [ ]) ++ buildInputs_;
@@ -380,7 +392,7 @@ crate_: lib.makeOverridable
     )
   )
 {
-  rust = rustc;
+  rust = rustc';
   release = crate_.release or true;
   verbose = crate_.verbose or true;
   extraRustcOpts = [ ];

pkgs/build-support/rust/build-rust-crate/test/default.nix

@@ -8,6 +8,7 @@
 , stdenv
 , symlinkJoin
 , writeTextFile
+, pkgsCross
 }:
 
 let
@@ -120,7 +121,10 @@ let
 
        `name` is used as part of the derivation name that performs the checking.
 
-       `crateArgs` is passed to `mkHostCrate` to build the crate with `buildRustCrate`.
+       `mkCrate` can be used to override the `mkCrate` call/implementation to use to
+       override the `buildRustCrate`, useful for cross compilation. Uses `mkHostCrate` by default.
+
+       `crateArgs` is passed to `mkCrate` to build the crate with `buildRustCrate`
 
        `expectedFiles` contains a list of expected file paths in the output. E.g.
        `[ "./bin/my_binary" ]`.
@@ -129,13 +133,13 @@ let
        output is used but e.g. `output = "lib";` will cause the lib output
        to be checked instead. You do not need to specify any directories.
      */
-    assertOutputs = { name, crateArgs, expectedFiles, output? null }:
+    assertOutputs = { name, mkCrate ? mkHostCrate, crateArgs, expectedFiles, output? null, }:
       assert (builtins.isString name);
       assert (builtins.isAttrs crateArgs);
       assert (builtins.isList expectedFiles);
 
       let
-        crate = mkHostCrate (builtins.removeAttrs crateArgs ["expectedTestOutput"]);
+        crate = mkCrate (builtins.removeAttrs crateArgs ["expectedTestOutput"]);
         crateOutput = if output == null then crate else crate."${output}";
         expectedFilesFile = writeTextFile {
           name = "expected-files-${name}";
@@ -155,7 +159,7 @@ let
       ''
       # sed out the hash because it differs per platform
       + ''
-        | sed -E -e 's/-[0-9a-fA-F]{10}\.rlib/-HASH.rlib/g' \
+        | sed 's/-${crate.metadata}//g' \
         > "$actualFiles"
       diff -q ${expectedFilesFile} "$actualFiles" > /dev/null || {
         echo -e "\033[0;1;31mERROR: Difference in expected output files in ${crateOutput} \033[0m" >&2
@@ -651,7 +655,7 @@ let
       };
       expectedFiles = [
         "./nix-support/propagated-build-inputs"
-        "./lib/libtest_lib-HASH.rlib"
+        "./lib/libtest_lib.rlib"
         "./lib/link"
       ];
     };
@@ -668,7 +672,24 @@ let
       };
       expectedFiles = [
         "./nix-support/propagated-build-inputs"
-        "./lib/libtest_lib-HASH.rlib"
+        "./lib/libtest_lib.rlib"
+        "./lib/link"
+      ];
+    };
+
+    crateLibOutputsWasm32 = assertOutputs {
+      name = "wasm32-crate-lib";
+      output = "lib";
+      mkCrate = mkCrate pkgsCross.wasm32-unknown-none.buildRustCrate;
+      crateArgs = {
+        libName = "test_lib";
+        type = [ "cdylib" ];
+        libPath = "src/lib.rs";
+        src = mkLib "src/lib.rs";
+      };
+      expectedFiles = [
+        "./nix-support/propagated-build-inputs"
+        "./lib/test_lib.wasm"
         "./lib/link"
       ];
     };

pkgs/by-name/ar/arc-browser/package.nix

@@ -9,11 +9,11 @@
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "arc-browser";
-  version = "1.48.2-51225";
+  version = "1.49.0-51346";
 
   src = fetchurl {
     url = "https://releases.arc.net/release/Arc-${finalAttrs.version}.dmg";
-    hash = "sha256-8VukOTt94nstaGRuTQg32HNPEaGBQtJGqRYgKLSD/TY=";
+    hash = "sha256-XrFDYzRUGCSyM8E+zHK/OZMKWYI9kCxUQ2TI98htPWk=";
   };
 
   nativeBuildInputs = [ undmg ];

pkgs/by-name/at/atlauncher/package.nix

@@ -4,10 +4,10 @@
 , lib
 , makeDesktopItem
 , makeWrapper
-, stdenv
+, stdenvNoCC
 
-, gamemodeSupport ? stdenv.isLinux
+, gamemodeSupport ? stdenvNoCC.isLinux
-, textToSpeechSupport ? stdenv.isLinux
+, textToSpeechSupport ? stdenvNoCC.isLinux
 , additionalLibs ? [ ]
 
 , # dependencies
@@ -19,7 +19,7 @@
 , xorg
 }:
 
-stdenv.mkDerivation (finalAttrs: {
+stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "atlauncher";
   version = "3.4.36.9";
 

pkgs/by-name/bi/bilibili/package.nix

@@ -8,10 +8,10 @@
 
 stdenv.mkDerivation rec {
   pname = "bilibili";
-  version = "1.13.6-2";
+  version = "1.14.0-1";
   src = fetchurl {
     url = "https://github.com/msojocs/bilibili-linux/releases/download/v${version}/io.github.msojocs.bilibili_${version}_amd64.deb";
-    hash = "sha256-SVN3iw3o3QGLY0XWd48+kpNPYoK5V8oPOA10VyDgDMo=";
+    hash = "sha256-4+DGL/DNR3wLFUff17OquAM6dOkcsXFNeCqA7ITtCaI=";
   };
 
   unpackPhase = ''

pkgs/by-name/ch/chow-kick/package.nix

@@ -37,13 +37,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "chow-kick";
-  version = "1.1.1";
+  version = "1.2.0";
 
   src = fetchFromGitHub {
     owner = "Chowdhury-DSP";
     repo = "ChowKick";
     rev = "v${finalAttrs.version}";
-    sha256 = "0amnp0p7ckbbr9dcbdnld1ryv46kvza2dj8m6hzmi7c1s4df8x5q";
+    sha256 = "sha256-YYcNiJGGw21aVY03tyQLu3wHCJhxYiDNJZ+LWNbQdj4=";
     fetchSubmodules = true;
   };
 

pkgs/by-name/cl/clever-tools/package.nix

@@ -0,0 +1,44 @@
+{ lib
+, buildNpmPackage
+, fetchFromGitHub
+, nodejs_18
+, installShellFiles
+}:
+
+buildNpmPackage rec {
+  pname = "clever-tools";
+
+  version = "3.7.0";
+
+  nodejs = nodejs_18;
+
+  src = fetchFromGitHub {
+    owner = "CleverCloud";
+    repo = "clever-tools";
+    rev = version;
+    hash = "sha256-Ce7lk+zTbyj3HmtIFui9ZA1FThZEytovrPCrmjMyX38=";
+  };
+
+  npmDepsHash = "sha256-VQXljlIHAE2o10cXQlsyhTvBSp3/ycQOJydQGNMiWuk=";
+
+  dontNpmBuild = true;
+
+  nativeBuildInputs = [ installShellFiles ];
+
+  postInstall = ''
+    installShellCompletion --cmd clever \
+      --bash <($out/bin/clever --bash-autocomplete-script) \
+      --zsh <($out/bin/clever --zsh-autocomplete-script)
+    rm $out/bin/install-clever-completion
+    rm $out/bin/uninstall-clever-completion
+  '';
+
+  meta = with lib; {
+    homepage = "https://github.com/CleverCloud/clever-tools";
+    changelog = "https://github.com/CleverCloud/clever-tools/blob/${version}/CHANGELOG.md";
+    description = "Deploy on Clever Cloud and control your applications, add-ons, services from command line";
+    license = licenses.asl20;
+    mainProgram = "clever";
+    maintainers = teams.clevercloud.members;
+  };
+}

pkgs/by-name/cy/cyclonedds-cxx/package.nix

@@ -7,7 +7,7 @@
 
 stdenv.mkDerivation rec {
   pname = "cyclonedds-cxx";
-  version = "0.10.4";
+  version = "0.10.5";
 
   outputs = ["out" "dev"];
 
@@ -15,7 +15,7 @@ stdenv.mkDerivation rec {
     owner = "eclipse-cyclonedds";
     repo = "cyclonedds-cxx";
     rev = version;
-    hash = "sha256-/Bb4lhDeJFCZpsf+EfKSJpX5Xv5mFms5miw36be1goQ=";
+    hash = "sha256-whFVEQec/Ca+dr6R7z9mMrNg315z3oIWchVT+vQ36So=";
   };
 
   nativeBuildInputs = [ cmake ];

pkgs/by-name/do/dorion/package.nix

@@ -13,11 +13,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "dorion";
-  version = "4.3.0";
+  version = "5.0.1";
 
   src = fetchurl {
     url = "https://github.com/SpikeHD/Dorion/releases/download/v${finalAttrs.version }/Dorion_${finalAttrs.version}_amd64.deb";
-    hash = "sha256-bVanhJqHQxe3imP07EsRuDu0Isj9rf4VoIjmoAPfaQk=";
+    hash = "sha256-cCZikTZ+IU3mq/FkJfeggXLyWIsWG+a2qu1GbgW93WQ=";
   };
 
   unpackCmd = ''

pkgs/by-name/du/dumbpipe/package.nix

@@ -7,16 +7,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "dumbpipe";
-  version = "0.10.0";
+  version = "0.11.0";
 
   src = fetchFromGitHub {
     owner = "n0-computer";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-Pv7GySqKD3G1eryq6YwVL159XuuWB8DmQ0d1fPuFcmc=";
+    hash = "sha256-T/EFy89CZyBthfxGlCJtovDmcR1ntYFkgAOA/sg3GWs=";
   };
 
-  cargoHash = "sha256-MKJCpSdf9MzpBmgWImYO5+uSVN9uTLaLl4khizVGoig=";
+  cargoHash = "sha256-nF8govoQILX6ft5iJWHAMQA/UgeNrkdUNulO+sX2jXo=";
 
   buildInputs = lib.optionals stdenv.isDarwin (
     with darwin.apple_sdk.frameworks; [

pkgs/by-name/ea/ear2ctl/package.nix

@@ -0,0 +1,28 @@
+{ lib, rustPlatform, fetchFromGitLab, pkg-config, dbus }:
+
+rustPlatform.buildRustPackage rec {
+  pname = "ear2ctl";
+  version = "0.1.0";
+
+  src = fetchFromGitLab {
+    owner = "bharadwaj-raju";
+    repo = "ear2ctl";
+    rev = version;
+    hash = "sha256-xaxl4opLMw9KEDpmNcgR1fBGUqO4BP5a/U52Kz+GAvc=";
+  };
+
+  cargoHash = "sha256-ax+/lvdEOjLnwE3Gvji7aaeF9KXjoOXdlTvxYDo8wGI=";
+
+  nativeBuildInputs = [ pkg-config ];
+
+  buildInputs = [ dbus ];
+
+  meta = {
+    description = "Linux controller for the Nothing Ear (2)";
+    homepage = "https://gitlab.com/bharadwaj-raju/ear2ctl";
+    maintainers = with lib.maintainers; [ jaredmontoya ];
+    license = lib.licenses.gpl3Plus;
+    platforms = lib.platforms.linux;
+    mainProgram = "ear2ctl";
+  };
+}

pkgs/by-name/fc/fcitx5-pinyin-minecraft/package.nix

@@ -0,0 +1,35 @@
+{
+  lib,
+  fetchurl,
+  nix-update-script,
+  stdenvNoCC,
+}:
+stdenvNoCC.mkDerivation (finalAttrs: {
+  pname = "fcitx5-pinyin-minecraft";
+  version = "0.1.20240629";
+
+  src = fetchurl {
+    url = "https://github.com/oldherl/fcitx5-pinyin-minecraft/releases/download/${finalAttrs.version}/minecraft-cn.dict";
+    hash = "sha256-uD/ADL+JGdSYiNz6XIqJB0Y0IU6Jf56q5g7xG2o3a+E=";
+  };
+
+  dontUnpack = true;
+
+  installPhase = ''
+    runHook preInstall
+
+    install -Dm644 $src $out/share/fcitx5/pinyin/dictionaries/minecraft.dict
+
+    runHook postInstall
+  '';
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "Fcitx 5 pinyin dictionary from zh.minecraft.wiki";
+    homepage = "https://github.com/oldherl/fcitx5-pinyin-minecraft";
+    license = with lib.licenses; [ unlicense cc-by-nc-sa-30 ];
+    maintainers = with lib.maintainers; [ Guanran928 ];
+    platforms = lib.platforms.all;
+  };
+})

pkgs/by-name/fc/fcitx5-pinyin-moegirl/package.nix

@@ -0,0 +1,35 @@
+{
+  lib,
+  fetchurl,
+  nix-update-script,
+  stdenvNoCC,
+}:
+stdenvNoCC.mkDerivation (finalAttrs: {
+  pname = "fcitx5-pinyin-moegirl";
+  version = "20240609";
+
+  src = fetchurl {
+    url = "https://github.com/outloudvi/mw2fcitx/releases/download/${finalAttrs.version}/moegirl.dict";
+    hash = "sha256-dXFV0kVr8hgT17Jmr28PiYTiELm8kS/KM71igHXA6hs=";
+  };
+
+  dontUnpack = true;
+
+  installPhase = ''
+    runHook preInstall
+
+    install -Dm644 $src $out/share/fcitx5/pinyin/dictionaries/moegirl.dict
+
+    runHook postInstall
+  '';
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "Fcitx 5 pinyin dictionary from zh.moegirl.org.cn";
+    homepage = "https://github.com/outloudvi/mw2fcitx";
+    license = with lib.licenses; [ unlicense cc-by-nc-sa-30 ];
+    maintainers = with lib.maintainers; [ Guanran928 ];
+    platforms = lib.platforms.all;
+  };
+})