Merge staging-next into staging

2024-10-24 12:06:21 +00:00 · 2024-10-24 12:06:21 +00:00 · 31c26ff594
commit 31c26ff594
parent 06411c3c48 e60fd6d56f
259 changed files with 9785 additions and 2966 deletions
--- a/doc/build-helpers/trivial-build-helpers.chapter.md
+++ b/doc/build-helpers/trivial-build-helpers.chapter.md
@ -732,7 +732,7 @@ writeShellApplication {

 ## `symlinkJoin` {#trivial-builder-symlinkJoin}

-This can be used to put many derivations into the same directory structure. It works by creating a new derivation and adding symlinks to each of the paths listed. It expects two arguments, `name`, and `paths`. `name` is the name used in the Nix store path for the created derivation. `paths` is a list of paths that will be symlinked. These paths can be to Nix store derivations or any other subdirectory contained within.
+This can be used to put many derivations into the same directory structure. It works by creating a new derivation and adding symlinks to each of the paths listed. It expects two arguments, `name`, and `paths`. `name` (or alternatively `pname` and `version`) is the name used in the Nix store path for the created derivation. `paths` is a list of paths that will be symlinked. These paths can be to Nix store derivations or any other subdirectory contained within.
 Here is an example:
 ```nix
 # adds symlinks of hello and stack to current build and prints "links added"
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@ -9431,6 +9431,13 @@
    github = "istoph";
    githubId = 114227790;
  };
+  itepastra = {
+    name = "Noa Aarts";
+    github = "itepastra";
+    githubId = 27058689;
+    email = "itepastra@gmail.com";
+    keys = [ { fingerprint = "E681 4CAF 06AE B076 D55D  3E32 A16C DCBF 1472 541F"; } ];
+  };
  ius = {
    email = "j.de.gram@gmail.com";
    name = "Joerie de Gram";
@ -14484,7 +14491,7 @@
  };
  moraxyc = {
    name = "Moraxyc Xu";
-    email = "nix@qaq.li";
+    email = "i@qaq.li";
    github = "Moraxyc";
    githubId = 69713071;
  };
@ -19604,10 +19611,11 @@
  };
  shadowrz = {
    email = "shadowrz+nixpkgs@disroot.org";
-    matrix = "@ShadowRZ:matrixim.cc";
+    matrix = "@shadowrz:nixos.dev";
    github = "ShadowRZ";
    githubId = 23130178;
    name = "夜坂雅";
+    keys = [ { fingerprint = "3237 D49E 8F81 5A45 2133  64EA 4FF3 5790 F405 53A9"; } ];
  };
  shahrukh330 = {
    email = "shahrukh330@gmail.com";
--- a/nixos/doc/manual/configuration/adding-custom-packages.section.md
+++ b/nixos/doc/manual/configuration/adding-custom-packages.section.md
@ -90,16 +90,30 @@ Hello, world!

 Most pre-built executables will not work on NixOS. There are two notable
 exceptions: flatpaks and AppImages. For flatpaks see the [dedicated
-section](#module-services-flatpak). AppImages will not run "as-is" on NixOS.
-First you need to install `appimage-run`: add to `/etc/nixos/configuration.nix`
+section](#module-services-flatpak). AppImages can run "as-is" on NixOS.
+
+First you need to enable AppImage support: add to `/etc/nixos/configuration.nix`

 ```nix
 {
-  environment.systemPackages = [ pkgs.appimage-run ];
+  programs.appimage.enable = true;
+  programs.appimage.binfmt = true;
 }
 ```

-Then instead of running the AppImage "as-is", run `appimage-run foo.appimage`.
+Then you can run the AppImage "as-is" or with `appimage-run foo.appimage`.
+
+If there are shared libraries missing add them with
+
+```nix
+{
+  programs.appimage.package = pkgs.appimage-run.override {
+    extraPkgs = pkgs: [
+      # missing libraries here, e.g.: `pkgs.libepoxy`
+    ];
+  }
+}
+```

 To make other pre-built executables work on NixOS, you need to package them
 with Nix and special helpers like `autoPatchelfHook` or `buildFHSEnv`. See
--- a/nixos/doc/manual/release-notes/rl-2411.section.md
+++ b/nixos/doc/manual/release-notes/rl-2411.section.md
@ -108,6 +108,8 @@

 - [Flood](https://flood.js.org/), a beautiful WebUI for various torrent clients. Available as [services.flood](options.html#opt-services.flood).

+- [Niri](https://github.com/YaLTeR/niri), a scrollable-tiling Wayland compositor. Available as [programs.niri](options.html#opt-programs.niri.enable).
+
 - [Firefly-iii Data Importer](https://github.com/firefly-iii/data-importer), a data importer for Firefly-III. Available as [services.firefly-iii-data-importer](options.html#opt-services.firefly-iii-data-importer)

 - [QGroundControl], a ground station support and configuration manager for the PX4 and APM Flight Stacks. Available as [programs.qgroundcontrol](options.html#opt-programs.qgroundcontrol.enable).
@ -192,7 +194,7 @@

 - [Fedimint](https://github.com/fedimint/fedimint), a module based system for building federated applications (Federated E-Cash Mint). Available as [services.fedimintd](#opt-services.fedimintd).

- [Zapret](https://github.com/bol-van/zapret), a DPI bypass tool. Available as [services.zapret](option.html#opt-services.zapret).
+- [Zapret](https://github.com/bol-van/zapret), a DPI bypass tool. Available as [services.zapret](options.html#opt-services.zapret).

 - [tiny-dfr](https://github.com/WhatAmISupposedToPutHere/tiny-dfr), a dynamic function row daemon for the Touch Bar found on some Apple laptops. Available as [hardware.apple.touchBar.enable](options.html#opt-hardware.apple.touchBar.enable).

@ -719,6 +721,9 @@

 - Mikutter was removed because the package was broken and had no maintainers.

+- The new option `services.getty.autologinOnce` was added to limit the automatic login to once per boot and on the first tty only.
+  When using full disk encryption, this option allows to unlock the system without retyping the passphrase while keeping the other ttys protected.
+
 - Gollum was upgraded to major version 6. Read their [migration notes](https://github.com/gollum/gollum/wiki/6.0-Release-Notes).

 - The hooks `yarnConfigHook` and `yarnBuildHook` were added. These should replace `yarn2nix.mkYarnPackage` and other `yarn2nix` related tools. The motivation to get rid of `yarn2nix` tools is the fact that they are too complex and hard to maintain, and they rely upon too much Nix evaluation which is problematic if import-from-derivation is not allowed (see more details at [#296856](https://github.com/NixOS/nixpkgs/issues/296856). The transition from `mkYarnPackage` to `yarn{Config,Build}Hook` is tracked at [#324246](https://github.com/NixOS/nixpkgs/issues/324246).
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@ -312,6 +312,7 @@
  ./programs/wayland/hyprland.nix
  ./programs/wayland/labwc.nix
  ./programs/wayland/miracle-wm.nix
+  ./programs/wayland/niri.nix
  ./programs/wayland/river.nix
  ./programs/wayland/sway.nix
  ./programs/wayland/uwsm.nix
--- a/nixos/modules/programs/wayland/niri.nix
+++ b/nixos/modules/programs/wayland/niri.nix
@ -0,0 +1,55 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+let
+  cfg = config.programs.niri;
+in
+{
+  options.programs.niri = {
+    enable = lib.mkEnableOption "Niri, a scrollable-tiling Wayland compositor";
+
+    package = lib.mkPackageOption pkgs "niri" { };
+  };
+
+  config = lib.mkIf cfg.enable (
+    lib.mkMerge [
+      {
+        environment.systemPackages = [ cfg.package ];
+
+        services = {
+          displayManager.sessionPackages = [ cfg.package ];
+
+          # Recommended by upstream
+          # https://github.com/YaLTeR/niri/wiki/Important-Software#portals
+          gnome.gnome-keyring.enable = lib.mkDefault true;
+        };
+
+        systemd.packages = [ cfg.package ];
+
+        xdg.portal = {
+          enable = lib.mkDefault true;
+
+          configPackages = [ cfg.package ];
+
+          # Recommended by upstream, required for screencast support
+          # https://github.com/YaLTeR/niri/wiki/Important-Software#portals
+          extraPortals = [ pkgs.xdg-desktop-portal-gnome ];
+        };
+      }
+
+      (import ./wayland-session.nix {
+        inherit lib pkgs;
+        enableWlrPortal = false;
+        enableXWayland = false;
+      })
+    ]
+  );
+
+  meta.maintainers = with lib.maintainers; [
+    getchoo
+    sodiboo
+  ];
+}
--- a/nixos/modules/services/games/factorio.nix
+++ b/nixos/modules/services/games/factorio.nix
@ -36,7 +36,9 @@ let
  } // cfg.extraSettings;
  serverSettingsString = builtins.toJSON (lib.filterAttrsRecursive (n: v: v != null) serverSettings);
  serverSettingsFile = pkgs.writeText "server-settings.json" serverSettingsString;
-  serverAdminsFile = pkgs.writeText "server-adminlist.json" (builtins.toJSON cfg.admins);
+  playerListOption = name: list:
+    lib.optionalString (list != [])
+      "--${name}=${pkgs.writeText "${name}.json" (builtins.toJSON list)}";
  modDir = pkgs.factorio-utils.mkModDirDrv cfg.mods cfg.mods-dat;
 in
 {
@ -59,6 +61,30 @@ in
        '';
      };

+      allowedPlayers = lib.mkOption {
+        # I would personally prefer for `allowedPlayers = []` to mean "no-one
+        # can connect" but Factorio seems to ignore empty whitelists (even with
+        # --use-server-whitelist) so we can't implement that behaviour, so we
+        # might as well match theirs.
+        type = lib.types.listOf lib.types.str;
+        default = [];
+        example = [ "Rseding91" "Oxyd" ];
+        description = ''
+          If non-empty, only these player names are allowed to connect. The game
+          will not be able to save any changes made in-game with the /whitelist
+          console command, though they will still take effect until the server
+          is restarted.
+
+          If empty, the whitelist defaults to open, but can be managed with the
+          in-game /whitelist console command (see: /help whitelist), which will
+          cause changes to be saved to the game's state directory (see also:
+          `stateDirName`).
+        '';
+      };
+      # Opting not to include the banlist in addition the the whitelist because:
+      # - banlists are not as often known in advance,
+      # - losing banlist changes on restart seems much more of a headache.
+
      admins = lib.mkOption {
        type = lib.types.listOf lib.types.str;
        default = [];
@ -177,7 +203,7 @@ in
      extraSettings = lib.mkOption {
        type = lib.types.attrs;
        default = {};
-        example = { admins = [ "username" ];};
+        example = { max_players = 64; };
        description = ''
          Extra game configuration that will go into server-settings.json
        '';
@ -298,7 +324,9 @@ in
          }"
          (lib.optionalString cfg.loadLatestSave "--start-server-load-latest")
          (lib.optionalString (cfg.mods != []) "--mod-directory=${modDir}")
-          (lib.optionalString (cfg.admins != []) "--server-adminlist=${serverAdminsFile}")
+          (playerListOption "server-adminlist" cfg.admins)
+          (playerListOption "server-whitelist" cfg.allowedPlayers)
+          (lib.optionalString (cfg.allowedPlayers != []) "--use-server-whitelist")
        ];

        # Sandboxing
--- a/nixos/modules/services/networking/supplicant.nix
+++ b/nixos/modules/services/networking/supplicant.nix
@ -26,12 +26,15 @@ let
      ifaceArg = concatStringsSep " -N " (map (i: "-i${i}") (splitString " " iface));
      driverArg = optionalString (suppl.driver != null) "-D${suppl.driver}";
      bridgeArg = optionalString (suppl.bridge!="") "-b${suppl.bridge}";
-      confFileArg = optionalString (suppl.configFile.path!=null) "-c${suppl.configFile.path}";
      extraConfFile = pkgs.writeText "supplicant-extra-conf-${replaceStrings [" "] ["-"] iface}" ''
        ${optionalString suppl.userControlled.enable "ctrl_interface=DIR=${suppl.userControlled.socketDir} GROUP=${suppl.userControlled.group}"}
        ${optionalString suppl.configFile.writable "update_config=1"}
        ${suppl.extraConf}
      '';
+      confArgs = escapeShellArgs
+        (if suppl.configFile.path == null
+         then [ "-c${extraConfFile}" ]
+         else [ "-c${suppl.configFile.path}" "-I${extraConfFile}" ]);
    in
      { description = "Supplicant ${iface}${optionalString (iface=="WLAN"||iface=="LAN") " %I"}";
        wantedBy = [ "multi-user.target" ] ++ deps;
@ -51,7 +54,7 @@ let
          ''}
        '';

-        serviceConfig.ExecStart = "${pkgs.wpa_supplicant}/bin/wpa_supplicant -s ${driverArg} ${confFileArg} -I${extraConfFile} ${bridgeArg} ${suppl.extraCmdArgs} ${if (iface=="WLAN"||iface=="LAN") then "-i%I" else (if (iface=="DBUS") then "-u" else ifaceArg)}";
+        serviceConfig.ExecStart = "${pkgs.wpa_supplicant}/bin/wpa_supplicant -s ${driverArg} ${confArgs} ${bridgeArg} ${suppl.extraCmdArgs} ${if (iface=="WLAN"||iface=="LAN") then "-i%I" else (if (iface=="DBUS") then "-u" else ifaceArg)}";

      };

--- a/nixos/modules/services/ttys/getty.nix
+++ b/nixos/modules/services/ttys/getty.nix
@ -7,14 +7,26 @@ let

  baseArgs = [
    "--login-program" "${cfg.loginProgram}"
-  ] ++ optionals (cfg.autologinUser != null) [
+  ] ++ optionals (cfg.autologinUser != null && !cfg.autologinOnce) [
    "--autologin" cfg.autologinUser
  ] ++ optionals (cfg.loginOptions != null) [
    "--login-options" cfg.loginOptions
  ] ++ cfg.extraArgs;

  gettyCmd = args:
-    "@${pkgs.util-linux}/sbin/agetty agetty ${escapeShellArgs baseArgs} ${args}";
+    "${lib.getExe' pkgs.util-linux "agetty"} ${escapeShellArgs baseArgs} ${args}";
+
+  autologinScript = ''
+    otherArgs="--noclear --keep-baud $TTY 115200,38400,9600 $TERM";
+    ${lib.optionalString cfg.autologinOnce ''
+      autologged="/run/agetty.autologged"
+      if test "$TTY" = tty1 && ! test -f "$autologged"; then
+        touch "$autologged"
+        exec ${gettyCmd "$otherArgs --autologin ${cfg.autologinUser}"}
+      fi
+    ''}
+    exec ${gettyCmd "$otherArgs"}
+  '';

 in

@ -40,6 +52,16 @@ in
        '';
      };

+      autologinOnce = mkOption {
+        type = types.bool;
+        default = false;
+        description = ''
+          If enabled the automatic login will only happen in the first tty
+          once per boot. This can be useful to avoid retyping the account
+          password on systems with full disk encrypted.
+        '';
+      };
+
      loginProgram = mkOption {
        type = types.path;
        default = "${pkgs.shadow}/bin/login";
@ -106,9 +128,11 @@ in

    systemd.services."getty@" =
      { serviceConfig.ExecStart = [
-          "" # override upstream default with an empty ExecStart
-          (gettyCmd "--noclear --keep-baud %I 115200,38400,9600 $TERM")
+          # override upstream default with an empty ExecStart
+          ""
+          (pkgs.writers.writeDash "getty" autologinScript)
        ];
+        environment.TTY = "%I";
        restartIfChanged = false;
      };

--- a/nixos/modules/services/web-apps/immich.nix
+++ b/nixos/modules/services/web-apps/immich.nix
@ -282,6 +282,7 @@ in
        ExecStart = lib.getExe cfg.package;
        EnvironmentFile = mkIf (cfg.secretsFile != null) cfg.secretsFile;
        StateDirectory = "immich";
+        SyslogIdentifier = "immich";
        RuntimeDirectory = "immich";
        User = cfg.user;
        Group = cfg.group;
--- a/nixos/modules/services/web-servers/nginx/default.nix
+++ b/nixos/modules/services/web-servers/nginx/default.nix
@ -1218,6 +1218,7 @@ in
      ++ lib.optional cfg.recommendedZstdSettings pkgs.nginxModules.zstd;

    services.nginx.virtualHosts.localhost = mkIf cfg.statusPage {
+      serverAliases = [ "127.0.0.1" ] ++ lib.optional config.networking.enableIPv6 "[::1]";
      listenAddresses = lib.mkDefault ([
        "0.0.0.0"
      ] ++ lib.optional enableIPv6 "[::]");
--- a/nixos/tests/amazon-init-shell.nix
+++ b/nixos/tests/amazon-init-shell.nix
@ -18,16 +18,21 @@ makeTest {
  meta = with maintainers; {
    maintainers = [ urbas ];
  };
-  nodes.machine = { ... }:
+  nodes.machine = { lib, pkgs, ... }:
  {
    imports = [ ../modules/profiles/headless.nix ../modules/virtualisation/amazon-init.nix ];
    services.openssh.enable = true;
+    system.switch.enable = true;
    networking.hostName = "";
    environment.etc."ec2-metadata/user-data" = {
      text = ''
        #!/usr/bin/bash

        echo successful > /tmp/evidence
+
+        # Emulate running nixos-rebuild switch, just without any building.
+        # https://github.com/nixos/nixpkgs/blob/4c62505847d88f16df11eff3c81bf9a453a4979e/nixos/modules/virtualisation/amazon-init.nix#L55
+        /run/current-system/bin/switch-to-configuration test
      '';
    };
  };
--- a/pkgs/applications/audio/cava/default.nix
+++ b/pkgs/applications/audio/cava/default.nix
@ -1,61 +0,0 @@
-{ lib
-, stdenv
-, fetchFromGitHub
-, autoreconfHook
-, autoconf-archive
-, alsa-lib
-, fftw
-, iniparser
-, libpulseaudio
-, pipewire
-, ncurses
-, pkgconf
-, SDL2
-, libGL
-, withSDL2 ? false
-, withPipewire ? true
-}:
-
-stdenv.mkDerivation rec {
-  pname = "cava";
-  version = "0.10.2";
-
-  src = fetchFromGitHub {
-    owner = "karlstav";
-    repo = "cava";
-    rev = version;
-    hash = "sha256-y6RslsU/zmr0Ai/rnr73N3OtjuBcWa3JCwh9P5GkNss=";
-  };
-
-  buildInputs = [
-    alsa-lib
-    fftw
-    libpulseaudio
-    ncurses
-    iniparser
-  ] ++ lib.optionals withSDL2 [
-    SDL2
-    libGL
-  ] ++ lib.optionals withPipewire [
-    pipewire
-  ];
-
-  nativeBuildInputs = [
-    autoreconfHook
-    autoconf-archive
-    pkgconf
-  ];
-
-  preAutoreconf = ''
-    echo ${version} > version
-  '';
-
-  meta = with lib; {
-    description = "Console-based Audio Visualizer for Alsa";
-    homepage = "https://github.com/karlstav/cava";
-    license = licenses.mit;
-    maintainers = with maintainers; [ offline mirrexagon ];
-    platforms = platforms.linux;
-    mainProgram = "cava";
-  };
-}
--- a/pkgs/applications/audio/psst/Cargo.lock
+++ b/pkgs/applications/audio/psst/Cargo.lock
--- a/pkgs/applications/audio/psst/default.nix
+++ b/pkgs/applications/audio/psst/default.nix
@ -16,13 +16,13 @@ let
 in
 rustPlatform.buildRustPackage rec {
  pname = "psst";
-  version = "unstable-2024-08-19";
+  version = "unstable-2024-10-07";

  src = fetchFromGitHub {
    owner = "jpochyla";
    repo = pname;
-    rev = "11bef15e66a3c9b0b991207d09a67c071b3dda02";
-    hash = "sha256-lKxWIUDouUUul7CpuTy30z/cLJAjFE9e0J1zyZ/PnIo=";
+    rev = "38d1c75d59848c54cb88896a93e05da3c71c7df4";
+    hash = "sha256-iMtrZ1Mto3j4lFXI2Sm2R85+m8LpR7V1WoJ3X5JyF60=";
  };

  cargoLock = {
--- a/pkgs/applications/audio/psst/make-build-reproducible.patch
+++ b/pkgs/applications/audio/psst/make-build-reproducible.patch
@ -1,9 +1,9 @@
 diff --git a/psst-core/build.rs b/psst-core/build.rs
 deleted file mode 100644
-index e05191d..0000000
+index cac2c23..0000000
 --- a/psst-core/build.rs
 +++ /dev/null
-@@ -1,39 +0,0 @@
+@@ -1,41 +0,0 @@
 -use std::{env, fs, io::Write};
 -
 -fn main() {
@ -13,12 +13,14 @@ index e05191d..0000000
 -    let mut fh = fs::File::create(outfile).unwrap();
 -    write!(fh, r#""{}""#, chrono::Local::now()).ok();
 -
-    let git_config = gix_config::File::from_git_dir("../.git/".into()).expect("Git Config not found!");
+-    let git_config =
+-        gix_config::File::from_git_dir("../.git/".into()).expect("Git Config not found!");
 -    // Get Git's 'Origin' URL
 -    let mut remote_url = git_config
-        .raw_value("remote", Some("origin".as_ref()), "url")
+-        .raw_value("remote.origin.url")
 -        .expect("Couldn't extract origin url!")
 -        .to_string();
+-
 -    // Check whether origin is accessed via ssh
 -    if remote_url.contains('@') {
 -        // If yes, strip the `git@` prefix and split the domain and path
@ -44,7 +46,7 @@ index e05191d..0000000
 -    write!(file, r#""{}""#, remote_url).ok();
 -}
 diff --git a/psst-core/src/lib.rs b/psst-core/src/lib.rs
-index fcbd491..8f6e6f0 100644
+index 2faa317..7d7501d 100644
 --- a/psst-core/src/lib.rs
 +++ b/psst-core/src/lib.rs
@@ -2,9 +2,9 @@
@ -54,7 +56,7 @@ index fcbd491..8f6e6f0 100644
 -pub const GIT_VERSION: &str = git_version!();
 -pub const BUILD_TIME: &str = include!(concat!(env!("OUT_DIR"), "/build-time.txt"));
 -pub const REMOTE_URL: &str = include!(concat!(env!("OUT_DIR"), "/remote-url.txt"));
-+pub const GIT_VERSION: &str = "11bef15e66a3c9b0b991207d09a67c071b3dda02";
+pub const GIT_VERSION: &str = "38d1c75d59848c54cb88896a93e05da3c71c7df4";
 +pub const BUILD_TIME: &str = "1970-01-01 00:00:00";
 +pub const REMOTE_URL: &str = "https://github.com/jpochyla/psst";
 
--- a/pkgs/applications/audio/puredata/default.nix
+++ b/pkgs/applications/audio/puredata/default.nix
@ -49,8 +49,7 @@ stdenv.mkDerivation rec {
  '';

  meta = with lib; {
-    description = ''A real-time graphical programming environment for
-                    audio, video, and graphical processing'';
+    description = ''A real-time graphical programming environment for audio, video, and graphical processing'';
    homepage = "http://puredata.info";
    license = licenses.bsd3;
    platforms = platforms.linux ++ platforms.darwin;
--- a/pkgs/applications/audio/setbfree/default.nix
+++ b/pkgs/applications/audio/setbfree/default.nix
@ -36,10 +36,12 @@ stdenv.mkDerivation  rec {

  doInstallCheck = true;

-  installCheckPhase = ''(
-    set -x
-    test -e $out/bin/setBfreeUI
-  )'';
+  installCheckPhase = ''
+    (
+      set -x;
+      test -e $out/bin/setBfreeUI
+    )
+  '';

  enableParallelBuilding = true;

--- a/pkgs/applications/audio/vorbis-tools/default.nix
+++ b/pkgs/applications/audio/vorbis-tools/default.nix
@ -20,6 +20,13 @@ stdenv.mkDerivation rec {
    })
  ];

+  # ld64 on darwin doesn't support nested archives and as the nested lib
+  # (libbase64.a) is not required to build so leave it out
+  postPatch = lib.optionalString stdenv.hostPlatform.isDarwin ''
+    substituteInPlace share/Makefile.am \
+      --replace-fail libpicture_a_LIBADD '#libpicture_a_LIBADD'
+  '';
+
  nativeBuildInputs = [ autoreconfHook pkg-config ];
  buildInputs = [ libogg libvorbis libao curl speex flac ]
    ++ lib.optionals stdenv.hostPlatform.isDarwin [ libiconv ];
--- a/pkgs/applications/blockchains/optimism/default.nix
+++ b/pkgs/applications/blockchains/optimism/default.nix
@ -6,19 +6,19 @@

 buildGoModule rec {
  pname = "optimism";
-  version = "1.9.1";
+  version = "1.9.4";

  src = fetchFromGitHub {
    owner = "ethereum-optimism";
    repo = "optimism";
    rev = "op-node/v${version}";
-    hash = "sha256-PlwpN8P1t0NNIU+Ys50dIXmfUQFIY9e1tLABiVK0JQo=";
+    hash = "sha256-pAmstWA6up0CvHEQW5RnDYumdwKP0i6fpz59EYTBsmU=";
    fetchSubmodules = true;
  };

  subPackages = [ "op-node/cmd" "op-proposer/cmd" "op-batcher/cmd" ];

-  vendorHash = "sha256-n1uJ/dkEjjsTdmL7TeHU4PKnBhiRrqCNtcGxK70Q0c4=";
+  vendorHash = "sha256-Sr9OECXbRa4SPe3owMto2EbnAIygeIEmZv73hvA6iww=";

  buildInputs = [
    libpcap
--- a/pkgs/applications/editors/libresprite/default.nix
+++ b/pkgs/applications/editors/libresprite/default.nix
@ -99,8 +99,8 @@ stdenv.mkDerivation (finalAttrs: {
    homepage = "https://libresprite.github.io/";
    description = "Animated sprite editor & pixel art tool, fork of Aseprite";
    license = licenses.gpl2Only;
-    longDescription =
-      ''LibreSprite is a program to create animated sprites. Its main features are:
+    longDescription = ''
+        LibreSprite is a program to create animated sprites. Its main features are:

          - Sprites are composed by layers & frames (as separated concepts).
          - Supported color modes: RGBA, Indexed (palettes up to 256 colors), and Grayscale.
--- a/pkgs/applications/editors/texmacs/common.nix
+++ b/pkgs/applications/editors/texmacs/common.nix
@ -43,25 +43,25 @@ rec {

  meta = {
    description = "WYSIWYW editing platform with special features for scientists";
-    longDescription =
-    '' GNU TeXmacs is a free wysiwyw (what you see is what you want)
-    editing platform with special features for scientists.  The software
-    aims to provide a unified and user friendly framework for editing
-    structured documents with different types of content (text,
-    graphics, mathematics, interactive content, etc.).  The rendering
-    engine uses high-quality typesetting algorithms so as to produce
-    professionally looking documents, which can either be printed out or
-    presented from a laptop.
+    longDescription = ''
+      GNU TeXmacs is a free wysiwyw (what you see is what you want)
+      editing platform with special features for scientists.  The software
+      aims to provide a unified and user friendly framework for editing
+      structured documents with different types of content (text,
+      graphics, mathematics, interactive content, etc.).  The rendering
+      engine uses high-quality typesetting algorithms so as to produce
+      professionally looking documents, which can either be printed out or
+      presented from a laptop.

-    The software includes a text editor with support for mathematical
-    formulas, a small technical picture editor and a tool for making
-    presentations from a laptop.  Moreover, TeXmacs can be used as an
-    interface for many external systems for computer algebra, numerical
-    analysis, statistics, etc.  New presentation styles can be written
-    by the user and new features can be added to the editor using the
-    Scheme extension language.  A native spreadsheet and tools for
-    collaborative authoring are planned for later.
-  '';
+      The software includes a text editor with support for mathematical
+      formulas, a small technical picture editor and a tool for making
+      presentations from a laptop.  Moreover, TeXmacs can be used as an
+      interface for many external systems for computer algebra, numerical
+      analysis, statistics, etc.  New presentation styles can be written
+      by the user and new features can be added to the editor using the
+      Scheme extension language.  A native spreadsheet and tools for
+      collaborative authoring are planned for later.
+    '';
    homepage = "http://texmacs.org/";
    license = lib.licenses.gpl2Plus;
  };
--- a/pkgs/applications/editors/vim/plugins/generated.nix
+++ b/pkgs/applications/editors/vim/plugins/generated.nix
@ -18756,5 +18756,17 @@ final: prev:
    meta.homepage = "https://github.com/jhradilek/vim-snippets/";
  };

+  NotebookNavigator-nvim = buildVimPlugin {
+    pname = "NotebookNavigator.nvim";
+    version = "2024-05-23";
+    src = fetchFromGitHub {
+      owner = "GCBallesteros";
+      repo = "NotebookNavigator.nvim";
+      rev = "20cb6f72939194e32eb3060578b445e5f2e7ae8b";
+      sha256 = "sha256-+FLHJ1tfIplXhO/6kajdcDBTIsNYN9kCOR9IdhXL6d4=";
+    };
+    meta.homepage = "https://github.com/GCBallesteros/NotebookNavigator.nvim";
+  };
+

 }
--- a/pkgs/applications/editors/vim/plugins/overrides.nix
+++ b/pkgs/applications/editors/vim/plugins/overrides.nix
@ -1527,6 +1527,10 @@ in
    nvimRequireCheck = "null-ls";
  };

+  NotebookNavigator-nvim = super.NotebookNavigator-nvim.overrideAttrs {
+    nvimRequireCheck = "notebook-navigator";
+  };
+
  null-ls-nvim = super.null-ls-nvim.overrideAttrs {
    dependencies = with self; [ plenary-nvim ];
    nvimRequireCheck = "null-ls";
--- a/pkgs/applications/editors/vim/plugins/vim-plugin-names
+++ b/pkgs/applications/editors/vim/plugins/vim-plugin-names
@ -19,6 +19,7 @@ https://github.com/Yggdroot/LeaderF/,,
 https://github.com/Valloric/MatchTagAlways/,,
 https://github.com/numToStr/Navigator.nvim/,,
 https://github.com/overcache/NeoSolarized/,,
+https://github.com/GCBallesteros/NotebookNavigator.nvim/,HEAD,
 https://github.com/chrisbra/NrrwRgn/,,
 https://github.com/vim-scripts/PreserveNoEOL/,,
 https://github.com/henriklovhaug/Preview.nvim/,HEAD,
--- a/pkgs/applications/editors/vscode/extensions/visualjj.visualjj/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/visualjj.visualjj/default.nix
@ -7,28 +7,28 @@
 }:

 let
-  version = "0.11.8";
+  version = "0.12.0";

  sources = {
    "x86_64-linux" = {
      arch = "linux-x64";
      url = "https://download.visualjj.com/visualjj-linux-x64-${version}.vsix";
-      hash = "sha256-L46ORW4iZnZ1GNQSU4opp1bTIh036j9JNmkATjTt/qM=";
+      hash = "sha256-7zIe5yTSpAhkG4S+k2SAnp4ZOrbbSsdxExpRfMG5EAo=";
    };
    "x86_64-darwin" = {
      arch = "darwin-x64";
      url = "https://download.visualjj.com/visualjj-darwin-x64-${version}.vsix";
-      hash = "sha256-h15HMZiV/bCVgoajEBe8XLSmFD7EsU2JVlpqiN6ntjQ=";
+      hash = "sha256-0mBNcrfDUqdPfQyc38/Z8YppFP8u9tbxpOLWrQriviE=";
    };
    "aarch64-linux" = {
      arch = "linux-arm64";
      url = "https://download.visualjj.com/visualjj-linux-arm64-${version}.vsix";
-      hash = "sha256-1h/xBMFXtHn/QA0FpZcuUFKxU65AMvaqds6Q9aNaW3s=";
+      hash = "sha256-YvKTs+kA4PghQkduq3aIx20bnGv1VnCtMqLmkLADfbE=";
    };
    "aarch64-darwin" = {
      arch = "darwin-arm64";
      url = "https://download.visualjj.com/visualjj-darwin-arm64-${version}.vsix";
-      hash = "sha256-9SagMPdkB8d2GeGR/R1EmH5y6VNZtYydst9S82kAQlA=";
+      hash = "sha256-gV8VKwPBsgUCDd/A02ASNozuBl/tt5FW0xKOgVKVgAM=";
    };
  };
 in
--- a/pkgs/applications/graphics/ocrad/default.nix
+++ b/pkgs/applications/graphics/ocrad/default.nix
@ -16,18 +16,18 @@ stdenv.mkDerivation rec {

  meta = with lib; {
    description = "Optical character recognition (OCR) program & library";
-    longDescription =
-      '' GNU Ocrad is an OCR (Optical Character Recognition) program based on
-         a feature extraction method.  It reads images in pbm (bitmap), pgm
-         (greyscale) or ppm (color) formats and produces text in byte (8-bit)
-         or UTF-8 formats.
+    longDescription = ''
+      GNU Ocrad is an OCR (Optical Character Recognition) program based on
+      a feature extraction method.  It reads images in pbm (bitmap), pgm
+      (greyscale) or ppm (color) formats and produces text in byte (8-bit)
+      or UTF-8 formats.

-         Also includes a layout analyser able to separate the columns or
-         blocks of text normally found on printed pages.
+      Also includes a layout analyser able to separate the columns or
+      blocks of text normally found on printed pages.

-         Ocrad can be used as a stand-alone console application, or as a
-         backend to other programs.
-      '';
+      Ocrad can be used as a stand-alone console application, or as a
+      backend to other programs.
+    '';

    license = licenses.gpl3Plus;
    maintainers = with maintainers; [ pSub ];
--- a/pkgs/applications/graphics/viewnior/default.nix
+++ b/pkgs/applications/graphics/viewnior/default.nix
@ -55,13 +55,13 @@ stdenv.mkDerivation rec {

  meta = with lib; {
    description = "Fast and simple image viewer";
-    longDescription =
-      '' Viewnior is insipred by big projects like Eye of Gnome, because of it's
-         usability and richness,and by GPicView, because of it's lightweight design and
-         minimal interface. So here comes Viewnior - small and light, with no compromise
-         with the quality of it's functions. The program is made with better integration
-         in mind (follows Gnome HIG2).
-      '';
+    longDescription = ''
+      Viewnior is insipred by big projects like Eye of Gnome, because of it's
+      usability and richness,and by GPicView, because of it's lightweight design and
+      minimal interface. So here comes Viewnior - small and light, with no compromise
+      with the quality of it's functions. The program is made with better integration
+      in mind (follows Gnome HIG2).
+    '';
    license = licenses.gpl3;
    homepage = "https://siyanpanayotov.com/project/viewnior/";
    maintainers = with maintainers; [ smironov artturin ];
--- a/pkgs/applications/kde/picmi.nix
+++ b/pkgs/applications/kde/picmi.nix
@ -9,9 +9,10 @@ mkDerivation {
    homepage = "https://apps.kde.org/picmi/";
    description = "Nonogram game";
    mainProgram = "picmi";
-    longDescription = ''The goal is to reveal the hidden pattern in the board by coloring or
+    longDescription = ''
+      The goal is to reveal the hidden pattern in the board by coloring or
      leaving blank the cells in a grid according to numbers given at the side of the grid.
-      '';
+    '';
    maintainers = with maintainers; [ freezeboy ];
    license = licenses.gpl2Plus;
    platforms = platforms.linux;
--- a/pkgs/applications/misc/1password-gui/default.nix
+++ b/pkgs/applications/misc/1password-gui/default.nix
@ -67,6 +67,7 @@ let
    sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
    license = lib.licenses.unfree;
    maintainers = with lib.maintainers; [
+      khaneliman
      timstott
      savannidgerinel
      sebtm
--- a/pkgs/applications/misc/1password/default.nix
+++ b/pkgs/applications/misc/1password/default.nix
@ -73,7 +73,10 @@ stdenv.mkDerivation {
    description = "1Password command-line tool";
    homepage = "https://developer.1password.com/docs/cli/";
    downloadPage = "https://app-updates.agilebits.com/product_history/CLI2";
-    maintainers = with maintainers; [ joelburget ];
+    maintainers = with maintainers; [
+      joelburget
+      khaneliman
+    ];
    sourceProvenance = with sourceTypes; [ binaryNativeCode ];
    license = licenses.unfree;
    inherit mainProgram platforms;
--- a/pkgs/applications/misc/makehuman/default.nix
+++ b/pkgs/applications/misc/makehuman/default.nix
@ -18,13 +18,13 @@ let
 in
 stdenv.mkDerivation rec {
  pname = "makehuman";
-  version = "1.2.0";
+  version = "1.3.0";

  source = fetchFromGitHub {
    owner = "makehumancommunity";
    repo = "makehuman";
    rev = "v${version}";
-    hash = "sha256-mCv6H0B7b4uxozpNHkKsG+Is2H0QYEJnnzKCHixhBpY=";
+    hash = "sha256-x0v/SkwtOl1lkVi2TRuIgx2Xgz4JcWD3He7NhU44Js4=";
    name = "${pname}-source";
  };

@ -36,39 +36,6 @@ stdenv.mkDerivation rec {
    name = "${pname}-assets-source";
  };

-  patches = [
-    # work with numpy>=1.24
-    (fetchpatch {
-      name = "fix-compile_targets.py-when-using-numpy-1.24.0-or-newer";
-      url = "https://patch-diff.githubusercontent.com/raw/makehumancommunity/makehuman/pull/220.patch";
-      hash = "sha256-ip7U83cCBrl+4gM1GZ2QQIER5Qur6HRu3a/TnHqk//g=";
-    })
-    # crash related to collections.Callable -> collections.abc.Callable
-    (fetchpatch {
-      name = "remove-unnecessary-compatibility-test";
-      url = "https://patch-diff.githubusercontent.com/raw/makehumancommunity/makehuman/pull/188.patch";
-      hash = "sha256-HGrk3n7rhV4YgK8mNUdfHwQl8dFT8yuzjxorvwfMmJw=";
-    })
-    # some OpenGL issue causing blank windows on recent Qt
-    (fetchpatch {
-      name = "qt-opengl-update-from-qglwidget-to-qopenglwidget-to-fix-blank";
-      url = "https://patch-diff.githubusercontent.com/raw/makehumancommunity/makehuman/pull/197.patch";
-      hash = "sha256-fEqBwg1Jd36nKWIT9XPr6Buj1N3AmTQg2LBaoX3eTxw=";
-    })
-    # multisampling issue
-    (fetchpatch {
-      name = "switch-default-for-multisampling-and-disable-sample-buffers";
-      url = "https://github.com/makehumancommunity/makehuman/commit/c47b884028a24eb190d097e7523a3059e439cb6f.patch";
-      hash = "sha256-tknQHX9qQYH15gyOLNhxfO3bsFVIv3Z1F7ZXD1IT1h4=";
-    })
-    # PyQt >= 5.12
-    (fetchpatch {
-      name = "fix-scrolling-issue-on-pyqt5>=5.12";
-      url = "https://github.com/makehumancommunity/makehuman/commit/02c4269a2d4c57f68159fe8f437a8b1978b99099.patch";
-      hash = "sha256-yR5tZcELX0N83PW/vS6yB5xKoZcHhVp48invlu7quWM=";
-    })
-  ];
-
  srcs = [
    source
    assets
--- a/pkgs/applications/misc/opentrack/default.nix
+++ b/pkgs/applications/misc/opentrack/default.nix
@ -1,4 +1,5 @@
 {
+  pkgs,
  mkDerivation,
  lib,
  callPackage,
@ -17,15 +18,17 @@
  libevdev,
  makeDesktopItem,
  fetchurl,
+  fetchpatch,
+  wineWowPackages,
 }: let
-  version = "2022.3.0";
+  version = "2023.3.0";

  aruco = callPackage ./aruco.nix {};

  # license.txt inside the zip file is MIT
  xplaneSdk = fetchzip {
-    url = "https://developer.x-plane.com/wp-content/plugins/code-sample-generation/sample_templates/XPSDK303.zip";
-    sha256 = "11wqjsr996c5qhiv2djsd55gc373a9qcq30dvc6rhzm0fys42zba";
+    url = "https://developer.x-plane.com/wp-content/plugins/code-sample-generation/sdk_zip_files/XPSDK401.zip";
+    hash = "sha256-tUT9yV1949QVr5VebU/7esg7wwWkyak2TSA/kQSrbeo=";
  };
 in
  mkDerivation {
@ -36,19 +39,30 @@ in
      owner = "opentrack";
      repo = "opentrack";
      rev = "opentrack-${version}";
-      sha256 = "sha256-8gpNORTJclYUYp57Vw/0YO3XC9Idurt0a79fhqx0+mo=";
+      hash = "sha256-C0jLS55DcLJh/e5yM8kLG7fhhKvBNllv5HkfCWRIfc4=";
    };

+    patches = [
+      # https://github.com/opentrack/opentrack/pull/1754
+      (fetchpatch {
+        url = "https://github.com/opentrack/opentrack/commit/d501d7e0b237ed0c305525788b423d842ffa356d.patch";
+        hash = "sha256-XMGHV78vt/Xn3hS+4V//pqtsdBQCfJPjIXxfwtdXX+Q=";
+      })
+    ];
+
    nativeBuildInputs = [cmake pkg-config ninja copyDesktopItems];
-    buildInputs = [qtbase qttools opencv4 procps eigen libXdmcp libevdev aruco];
+    buildInputs = [qtbase qttools opencv4 procps eigen libXdmcp libevdev aruco]
+      ++ lib.optionals pkgs.stdenv.targetPlatform.isx86_64 [ wineWowPackages.stable ];

    env.NIX_CFLAGS_COMPILE = "-Wall -Wextra -Wpedantic -ffast-math -O3";
    dontWrapQtApps = true;

    cmakeFlags = [
+      "-GNinja"
+      "-DCMAKE_BUILD_TYPE=Release"
      "-DSDK_ARUCO_LIBPATH=${aruco}/lib/libaruco.a"
      "-DSDK_XPLANE=${xplaneSdk}"
-    ];
+    ] ++ lib.optionals pkgs.stdenv.targetPlatform.isx86_64 [ "-DSDK_WINE=ON" ];

    postInstall = ''
      wrapQtApp $out/bin/opentrack
@ -60,7 +74,7 @@ in
        exec = "opentrack";
        icon = fetchurl {
          url = "https://github.com/opentrack/opentrack/raw/opentrack-${version}/gui/images/opentrack.png";
-          sha256 = "0d114zk78f7nnrk89mz4gqn7yk3k71riikdn29w6sx99h57f6kgn";
+          hash = "sha256-9k3jToEpdW14ErbNGHM4c0x/LH7k14RmtvY4dOYnITQ=";
        };
        desktopName = name;
        genericName = "Head tracking software";
--- a/pkgs/applications/misc/visidata/default.nix
+++ b/pkgs/applications/misc/visidata/default.nix
@ -116,7 +116,7 @@ buildPythonApplication rec {
  ];

  # check phase uses the output bin, which is not possible when cross-compiling
-  doCheck = stdenv.buildPlatform == stdenv.hostPlatform;
+  doCheck = stdenv.buildPlatform.canExecute stdenv.hostPlatform;

  checkPhase = ''
    runHook preCheck
--- a/pkgs/applications/misc/wordnet/default.nix
+++ b/pkgs/applications/misc/wordnet/default.nix
@ -34,16 +34,16 @@ stdenv.mkDerivation rec {
  meta = {
    description = "Lexical database for the English language";

-    longDescription =
-      '' WordNet® is a large lexical database of English.  Nouns, verbs,
-         adjectives and adverbs are grouped into sets of cognitive synonyms
-         (synsets), each expressing a distinct concept.  Synsets are
-         interlinked by means of conceptual-semantic and lexical relations.
-         The resulting network of meaningfully related words and concepts can
-         be navigated with the browser.  WordNet is also freely and publicly
-         available for download.  WordNet's structure makes it a useful tool
-         for computational linguistics and natural language processing.
-      '';
+    longDescription = ''
+      WordNet® is a large lexical database of English.  Nouns, verbs,
+      adjectives and adverbs are grouped into sets of cognitive synonyms
+      (synsets), each expressing a distinct concept.  Synsets are
+      interlinked by means of conceptual-semantic and lexical relations.
+      The resulting network of meaningfully related words and concepts can
+      be navigated with the browser.  WordNet is also freely and publicly
+      available for download.  WordNet's structure makes it a useful tool
+      for computational linguistics and natural language processing.
+    '';

    homepage = "https://wordnet.princeton.edu/";
    license = {
--- a/pkgs/applications/networking/appgate-sdp/default.nix
+++ b/pkgs/applications/networking/appgate-sdp/default.nix
@ -86,11 +86,11 @@ let
 in
 stdenv.mkDerivation rec {
  pname = "appgate-sdp";
-  version = "6.3.2";
+  version = "6.4.0";

  src = fetchurl {
    url = "https://bin.appgate-sdp.com/${lib.versions.majorMinor version}/client/appgate-sdp_${version}_amd64.deb";
-    sha256 = "sha256-7W2iUilSK4awrtgZc/c40oivzlyz3RN5U5TUicqavsc=";
+    sha256 = "sha256-0h6Mz3B7fADGL5tGbrKNYpVIAvRu7Xx0n9OvjOeVCds=";
  };

  # just patch interpreter
--- a/pkgs/applications/networking/browsers/chromium/common.nix
+++ b/pkgs/applications/networking/browsers/chromium/common.nix
@ -1,7 +1,6 @@
 { stdenv, lib, fetchpatch
 , recompressTarball
 , buildPackages
-, buildPlatform
 , pkgsBuildBuild
 # Channel data:
 , channel, upstream-info
--- a/pkgs/applications/networking/cluster/kaniko/default.nix
+++ b/pkgs/applications/networking/cluster/kaniko/default.nix
@ -29,7 +29,7 @@ buildGoModule rec {

  doCheck = false; # requires docker, container-diff (unpackaged yet)

-  postInstall = lib.optionalString (stdenv.hostPlatform == stdenv.buildPlatform) ''
+  postInstall = lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
    for shell in bash fish zsh; do
      $out/bin/executor completion $shell > executor.$shell
      installShellCompletion executor.$shell
--- a/pkgs/applications/networking/cluster/kubeshark/default.nix
+++ b/pkgs/applications/networking/cluster/kubeshark/default.nix
@ -29,7 +29,7 @@ buildGoModule rec {
  '';
  doCheck = true;

-  postInstall = lib.optionalString (stdenv.hostPlatform == stdenv.buildPlatform) ''
+  postInstall = lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
    installShellCompletion --cmd kubeshark \
      --bash <($out/bin/kubeshark completion bash) \
      --fish <($out/bin/kubeshark completion fish) \
--- a/pkgs/applications/networking/cluster/kubevela/default.nix
+++ b/pkgs/applications/networking/cluster/kubevela/default.nix
@ -40,7 +40,7 @@ buildGoModule rec {
  '';

  nativeBuildInputs = [ installShellFiles ];
-  postInstall = lib.optionalString (stdenv.hostPlatform == stdenv.buildPlatform) ''
+  postInstall = lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
    installShellCompletion --cmd vela \
      --bash <($out/bin/vela completion bash) \
      --zsh <($out/bin/vela completion zsh)
--- a/pkgs/applications/networking/cluster/opentofu/default.nix
+++ b/pkgs/applications/networking/cluster/opentofu/default.nix
@ -14,13 +14,13 @@
 let
  package =  buildGoModule rec {
    pname = "opentofu";
-    version = "1.8.3";
+    version = "1.8.4";

    src = fetchFromGitHub {
      owner = "opentofu";
      repo = "opentofu";
      rev = "v${version}";
-      hash = "sha256-+1ctvUz1Prhon+w5fGO+IQCYl7uEMZwAYMfQut7fmO4=";
+      hash = "sha256-YUN+JBYn8Bq4glZNBdlr++WJgGpGSKK1PjWqaduF8bg=";
    };

    vendorHash = "sha256-cM2DSP2ss3vleUhPBIdyxKeWJxtHpdjL5b5HVS/iC6o=";
--- a/pkgs/applications/networking/instant-messengers/pidgin/default.nix
+++ b/pkgs/applications/networking/instant-messengers/pidgin/default.nix
@ -117,7 +117,7 @@ let
        --prefix GST_PLUGIN_SYSTEM_PATH_1_0 : "$GST_PLUGIN_SYSTEM_PATH_1_0"
    '';

-    doInstallCheck = stdenv.hostPlatform == stdenv.buildPlatform;
+    doInstallCheck = stdenv.buildPlatform.canExecute stdenv.hostPlatform;
    # In particular, this detects missing python imports in some of the tools.
    postFixup = let
      # TODO: python is a script, so it doesn't work as interpreter on darwin
--- a/pkgs/applications/networking/instant-messengers/signal-desktop/default.nix
+++ b/pkgs/applications/networking/instant-messengers/signal-desktop/default.nix
@ -1,9 +1,9 @@
-{ hostPlatform, callPackage }:
+{ stdenv, callPackage }:
 {
  signal-desktop =
-    if hostPlatform.system == "aarch64-linux" then
+    if stdenv.hostPlatform.system == "aarch64-linux" then
      callPackage ./signal-desktop-aarch64.nix { }
-    else if hostPlatform.isDarwin then
+    else if stdenv.hostPlatform.isDarwin then
      callPackage ./signal-desktop-darwin.nix { }
    else
      callPackage ./signal-desktop.nix { };
--- a/pkgs/applications/networking/instant-messengers/utox/default.nix
+++ b/pkgs/applications/networking/instant-messengers/utox/default.nix
@ -30,7 +30,7 @@ stdenv.mkDerivation rec {
    "-DENABLE_TESTS=${if doCheck then "ON" else "OFF"}"
  ];

-  doCheck = stdenv.hostPlatform == stdenv.buildPlatform;
+  doCheck = stdenv.buildPlatform.canExecute stdenv.hostPlatform;
  nativeCheckInputs = [ check ];

  meta = with lib; {
--- a/pkgs/applications/office/kmymoney/default.nix
+++ b/pkgs/applications/office/kmymoney/default.nix
@ -59,7 +59,7 @@ stdenv.mkDerivation rec {
      "kmymoney/plugins/woob/interface/kmymoneywoob.py"
  '';

-  doInstallCheck = stdenv.hostPlatform == stdenv.buildPlatform;
+  doInstallCheck = stdenv.buildPlatform.canExecute stdenv.hostPlatform;
  nativeInstallCheckInputs = [ xvfb-run ];
  installCheckPhase =
    lib.optionalString doInstallCheck ''
--- a/pkgs/applications/radio/xlog/default.nix
+++ b/pkgs/applications/radio/xlog/default.nix
@ -16,14 +16,14 @@ stdenv.mkDerivation rec {

  meta = with lib; {
    description = "Amateur radio logging program";
-    longDescription =
-      '' Xlog is an amateur radio logging program.
-         It supports cabrillo, ADIF, trlog (format also used by tlf),
-         and EDI (ARRL VHF/UHF contest format) and can import twlog, editest and OH1AA logbook files.
-         Xlog is able to do DXCC lookups and will display country information, CQ and ITU zone,
-         location in latitude and longitude and distance and heading in kilometers or miles,
-         both for short and long path.
-      '';
+    longDescription = ''
+      Xlog is an amateur radio logging program.
+      It supports cabrillo, ADIF, trlog (format also used by tlf),
+      and EDI (ARRL VHF/UHF contest format) and can import twlog, editest and OH1AA logbook files.
+      Xlog is able to do DXCC lookups and will display country information, CQ and ITU zone,
+      location in latitude and longitude and distance and heading in kilometers or miles,
+      both for short and long path.
+    '';
    homepage = "https://www.nongnu.org/xlog";
    maintainers = [ maintainers.mafo ];
    license = licenses.gpl3;
--- a/pkgs/applications/science/astronomy/xearth/default.nix
+++ b/pkgs/applications/science/astronomy/xearth/default.nix
@ -19,11 +19,11 @@ stdenv.mkDerivation rec {
    description = "sets the X root window to an image of the Earth";
    mainProgram = "xearth";
    homepage = "https://xearth.org";
-    longDescription =
-      '' Xearth  sets  the X root window to an image of the Earth, as seen from your favorite vantage point in space,
-         correctly shaded for the current position of the Sun.
-         By default, xearth updates the displayed image every  five  minutes.
-      '';
+    longDescription = ''
+      Xearth  sets  the X root window to an image of the Earth, as seen from your favorite vantage point in space,
+      correctly shaded for the current position of the Sun.
+      By default, xearth updates the displayed image every  five  minutes.
+    '';
    maintainers = [ maintainers.mafo ];
    license  = {
      fullName = "xearth license";
--- a/pkgs/applications/science/biology/blast/default.nix
+++ b/pkgs/applications/science/biology/blast/default.nix
@ -96,8 +96,7 @@ stdenv.mkDerivation rec {
  doCheck = false;

  meta = with lib; {
-    description = ''Basic Local Alignment Search Tool (BLAST) finds regions of
-    similarity between biological sequences'';
+    description = ''Basic Local Alignment Search Tool (BLAST) finds regions of similarity between biological sequences'';
    homepage = "https://blast.ncbi.nlm.nih.gov/Blast.cgi";
    license = licenses.publicDomain;

--- a/pkgs/applications/science/biology/cmtk/default.nix
+++ b/pkgs/applications/science/biology/cmtk/default.nix
@ -43,9 +43,11 @@ stdenv.mkDerivation (finalAttrs: {
  meta = with lib; {
    description = "Computational Morphometry Toolkit";
    mainProgram = "cmtk";
-    longDescription = ''A software toolkit for computational morphometry of
+    longDescription = ''
+      A software toolkit for computational morphometry of
      biomedical images, CMTK comprises a set of command line tools and a
-      back-end general-purpose library for processing and I/O'';
+      back-end general-purpose library for processing and I/O
+    '';
    maintainers = with maintainers; [ tbenst ];
    platforms = platforms.all;
    license = licenses.gpl3Plus;
--- a/pkgs/applications/science/biology/emboss/default.nix
+++ b/pkgs/applications/science/biology/emboss/default.nix
@ -19,11 +19,13 @@ stdenv.mkDerivation rec {

  meta = {
    description = "European Molecular Biology Open Software Suite";
-    longDescription = ''EMBOSS is a free Open Source software analysis package
-    specially developed for the needs of the molecular biology (e.g. EMBnet)
-    user community, including libraries. The software automatically copes with
-    data in a variety of formats and even allows transparent retrieval of
-    sequence data from the web.'';
+    longDescription = ''
+      EMBOSS is a free Open Source software analysis package
+      specially developed for the needs of the molecular biology (e.g. EMBnet)
+      user community, including libraries. The software automatically copes with
+      data in a variety of formats and even allows transparent retrieval of
+      sequence data from the web.
+    '';
    license = lib.licenses.gpl2;
    homepage = "https://emboss.sourceforge.net/";
  };
--- a/pkgs/applications/science/misc/tulip/default.nix
+++ b/pkgs/applications/science/misc/tulip/default.nix
@ -33,13 +33,13 @@ stdenv.mkDerivation rec {
  meta = {
    description = "Visualization framework for the analysis and visualization of relational data";

-    longDescription =
-      '' Tulip is an information visualization framework dedicated to the
-         analysis and visualization of relational data.  Tulip aims to
-         provide the developer with a complete library, supporting the design
-         of interactive information visualization applications for relational
-         data that can be tailored to the problems he or she is addressing.
-      '';
+    longDescription = ''
+      Tulip is an information visualization framework dedicated to the
+      analysis and visualization of relational data.  Tulip aims to
+      provide the developer with a complete library, supporting the design
+      of interactive information visualization applications for relational
+      data that can be tailored to the problems he or she is addressing.
+    '';

    homepage = "http://tulip.labri.fr/";

--- a/pkgs/applications/version-management/fossil/default.nix
+++ b/pkgs/applications/version-management/fossil/default.nix
@ -36,7 +36,7 @@ stdenv.mkDerivation (finalAttrs: {

  enableParallelBuilding = true;

-  doCheck = stdenv.hostPlatform == stdenv.buildPlatform;
+  doCheck = stdenv.buildPlatform.canExecute stdenv.hostPlatform;

  configureFlags =
    lib.optional (!withInternalSqlite) "--disable-internal-sqlite"
--- a/pkgs/applications/version-management/gitkraken/default.nix
+++ b/pkgs/applications/version-management/gitkraken/default.nix
@ -57,24 +57,24 @@

 let
  pname = "gitkraken";
-  version = "10.4.0";
+  version = "10.4.1";

  throwSystem = throw "Unsupported system: ${stdenv.hostPlatform.system}";

  srcs = {
    x86_64-linux = fetchzip {
      url = "https://release.axocdn.com/linux/GitKraken-v${version}.tar.gz";
-      hash = "sha256-JGWDOAkJEnhvUyQOFsmoeW9Izj0IuHNpYGlYAMiWPj0=";
+      hash = "sha256-ZvLDGhBnWjjWqzwqJOz91X8hr94jkXtMA8CL2hh9mlI=";
    };

    x86_64-darwin = fetchzip {
      url = "https://release.axocdn.com/darwin/GitKraken-v${version}.zip";
-      hash = "sha256-yCDE6QJMgU2Mgr/kUDnbKwQ3MpgVcdjAK7fnTAjSL54=";
+      hash = "sha256-21VwDFw2dyySoc4NC/RR3k/VtksqaZ5vkdx0z5MKqLc=";
    };

    aarch64-darwin = fetchzip {
      url = "https://release.axocdn.com/darwin-arm64/GitKraken-v${version}.zip";
-      hash = "sha256-nh+tO++QvPx9jyZuxNrH7rHFXZqVnu5jyiki3oWdw7E=";
+      hash = "sha256-N8WMbJFC74tIeJ6Yyk58nT+sIBYN/7PNLdYNxGSB2yM=";
    };
  };

--- a/pkgs/applications/version-management/rcs/default.nix
+++ b/pkgs/applications/version-management/rcs/default.nix
@ -26,13 +26,13 @@ stdenv.mkDerivation rec {
  meta = {
    homepage = "https://www.gnu.org/software/rcs/";
    description = "Revision control system";
-    longDescription =
-      '' The GNU Revision Control System (RCS) manages multiple revisions of
-         files. RCS automates the storing, retrieval, logging,
-         identification, and merging of revisions.  RCS is useful for text
-         that is revised frequently, including source code, programs,
-         documentation, graphics, papers, and form letters.
-      '';
+    longDescription = ''
+      The GNU Revision Control System (RCS) manages multiple revisions of
+      files. RCS automates the storing, retrieval, logging,
+      identification, and merging of revisions.  RCS is useful for text
+      that is revised frequently, including source code, programs,
+      documentation, graphics, papers, and form letters.
+    '';

    license = lib.licenses.gpl3Plus;
    maintainers = [ ];
--- a/pkgs/applications/video/mpv/default.nix
+++ b/pkgs/applications/video/mpv/default.nix
@ -7,7 +7,6 @@
  buildPackages,
  callPackage,
  config,
-  darwin,
  docutils,
  fetchFromGitHub,
  ffmpeg,
@ -15,15 +14,11 @@
  freetype,
  lcms2,
  libGL,
-  libGLU,
  libX11,
  libXScrnSaver,
  libXext,
-  libXinerama,
  libXpresent,
  libXrandr,
-  libXv,
-  libXxf86vm,
  libarchive,
  libass,
  libbluray,
@ -33,19 +28,17 @@
  libcdio-paranoia,
  libdrm,
  libdvdnav,
-  libiconv,
  libjack2,
  libplacebo,
-  libpng,
  libpthreadstubs,
  libpulseaudio,
  libsixel,
-  libtheora,
  libuchardet,
  libva,
  libvdpau,
  libxkbcommon,
  lua,
+  makeWrapper,
  mesa,
  meson,
  mujs,
@ -58,7 +51,6 @@
  python3,
  rubberband,
  shaderc, # instead of spirv-cross
-  speex,
  stdenv,
  swift,
  testers,
@ -68,7 +60,6 @@
  wayland,
  wayland-protocols,
  wayland-scanner,
-  xcbuild,
  zimg,

  # Boolean
@ -81,59 +72,28 @@
  cmsSupport ? true,
  drmSupport ? stdenv.hostPlatform.isLinux,
  dvbinSupport ? stdenv.hostPlatform.isLinux,
-  dvdnavSupport ? stdenv.hostPlatform.isLinux,
+  dvdnavSupport ? true,
  jackaudioSupport ? false,
  javascriptSupport ? true,
-  libpngSupport ? true,
  openalSupport ? true,
-  pipewireSupport ? stdenv.hostPlatform.isLinux,
-  pulseSupport ? config.pulseaudio or stdenv.hostPlatform.isLinux,
+  pipewireSupport ? !stdenv.hostPlatform.isDarwin,
+  pulseSupport ? config.pulseaudio or (!stdenv.hostPlatform.isDarwin),
  rubberbandSupport ? true,
-  screenSaverSupport ? true,
-  sdl2Support ? !stdenv.hostPlatform.isDarwin,
+  sdl2Support ? false,
  sixelSupport ? false,
-  speexSupport ? true,
-  swiftSupport ? stdenv.hostPlatform.isDarwin,
-  theoraSupport ? true,
-  vaapiSupport ? x11Support || waylandSupport,
+  vaapiSupport ? !stdenv.hostPlatform.isDarwin && (x11Support || waylandSupport),
  vapoursynthSupport ? false,
  vdpauSupport ? true,
-  vulkanSupport ? stdenv.hostPlatform.isLinux,
-  waylandSupport ? stdenv.hostPlatform.isLinux,
-  x11Support ? stdenv.hostPlatform.isLinux,
-  xineramaSupport ? stdenv.hostPlatform.isLinux,
-  xvSupport ? stdenv.hostPlatform.isLinux,
+  vulkanSupport ? true,
+  waylandSupport ? !stdenv.hostPlatform.isDarwin,
+  x11Support ? !stdenv.hostPlatform.isDarwin,
  zimgSupport ? true,
 }:

 let
-  inherit (darwin.apple_sdk_11_0.frameworks)
-    AVFoundation
-    Accelerate
-    Cocoa
-    CoreAudio
-    CoreFoundation
-    CoreMedia
-    MediaPlayer
-    VideoToolbox
-    ;
  luaEnv = lua.withPackages (ps: with ps; [ luasocket ]);
-
-  overrideSDK =
-    platform: version:
-    platform // lib.optionalAttrs (platform ? darwinMinVersion) { darwinMinVersion = version; };
-
-  stdenv' =
-    if swiftSupport && stdenv.hostPlatform.isDarwin && stdenv.hostPlatform.isx86_64 then
-      stdenv.override (old: {
-        buildPlatform = overrideSDK old.buildPlatform "11.0";
-        hostPlatform = overrideSDK old.hostPlatform "11.0";
-        targetPlatform = overrideSDK old.targetPlatform "11.0";
-      })
-    else
-      stdenv;
 in
-stdenv'.mkDerivation (finalAttrs: {
+stdenv.mkDerivation (finalAttrs: {
  pname = "mpv";
  version = "0.39.0";

@ -151,18 +111,13 @@ stdenv'.mkDerivation (finalAttrs: {
    hash = "sha256-BOGh+QBTO7hrHohh+RqjSF8eHQH8jVBPjG/k4eyFaaM=";
  };

-  patches = [
-    # Fix build with Darwin SDK 11
-    ./0001-fix-darwin-build.patch
-  ];
-
  postPatch = lib.concatStringsSep "\n" [
    # Don't reference compile time dependencies or create a build outputs cycle
    # between out and dev
    ''
      substituteInPlace meson.build \
        --replace-fail "conf_data.set_quoted('CONFIGURATION', configuration)" \
-                       "conf_data.set_quoted('CONFIGURATION', '<ommited>')"
+                       "conf_data.set_quoted('CONFIGURATION', '<omitted>')"
    ''
    # A trick to patchShebang everything except mpv_identify.sh
    ''
@ -174,30 +129,16 @@ stdenv'.mkDerivation (finalAttrs: {
    ''
  ];

-  # Ensure we reference 'lib' (not 'out') of Swift.
-  preConfigure = lib.optionalString swiftSupport ''
-    export SWIFT_LIB_DYNAMIC="${lib.getLib swift.swift}/lib/swift/macosx"
-  '';
-
-  mesonFlags =
-    [
-      (lib.mesonOption "default_library" "shared")
-      (lib.mesonBool "libmpv" true)
-      (lib.mesonEnable "libarchive" archiveSupport)
-      (lib.mesonEnable "manpage-build" true)
-      (lib.mesonEnable "cdda" cddaSupport)
-      (lib.mesonEnable "dvbin" dvbinSupport)
-      (lib.mesonEnable "dvdnav" dvdnavSupport)
-      (lib.mesonEnable "openal" openalSupport)
-      (lib.mesonEnable "sdl2" sdl2Support)
-      # Disable whilst Swift isn't supported
-      (lib.mesonEnable "swift-build" swiftSupport)
-      (lib.mesonEnable "macos-cocoa-cb" swiftSupport)
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      # Toggle explicitly because it fails on darwin
-      (lib.mesonEnable "videotoolbox-pl" vulkanSupport)
-    ];
+  mesonFlags = [
+    (lib.mesonOption "default_library" "shared")
+    (lib.mesonBool "libmpv" true)
+    (lib.mesonEnable "manpage-build" true)
+    (lib.mesonEnable "cdda" cddaSupport)
+    (lib.mesonEnable "dvbin" dvbinSupport)
+    (lib.mesonEnable "dvdnav" dvdnavSupport)
+    (lib.mesonEnable "openal" openalSupport)
+    (lib.mesonEnable "sdl2" sdl2Support)
+  ];

  mesonAutoFeatures = "auto";

@ -211,9 +152,9 @@ stdenv'.mkDerivation (finalAttrs: {
    ]
    ++ lib.optionals stdenv.hostPlatform.isDarwin [
      buildPackages.darwin.sigtool
-      xcbuild.xcrun
+      swift
+      makeWrapper
    ]
-    ++ lib.optionals swiftSupport [ swift ]
    ++ lib.optionals waylandSupport [ wayland-scanner ];

  buildInputs =
@ -248,16 +189,12 @@ stdenv'.mkDerivation (finalAttrs: {
    ]
    ++ lib.optionals jackaudioSupport [ libjack2 ]
    ++ lib.optionals javascriptSupport [ mujs ]
-    ++ lib.optionals libpngSupport [ libpng ]
    ++ lib.optionals openalSupport [ openalSoft ]
    ++ lib.optionals pipewireSupport [ pipewire ]
    ++ lib.optionals pulseSupport [ libpulseaudio ]
    ++ lib.optionals rubberbandSupport [ rubberband ]
-    ++ lib.optionals screenSaverSupport [ libXScrnSaver ]
    ++ lib.optionals sdl2Support [ SDL2 ]
    ++ lib.optionals sixelSupport [ libsixel ]
-    ++ lib.optionals speexSupport [ speex ]
-    ++ lib.optionals theoraSupport [ libtheora ]
    ++ lib.optionals vaapiSupport [ libva ]
    ++ lib.optionals vapoursynthSupport [ vapoursynth ]
    ++ lib.optionals vdpauSupport [ libvdpau ]
@ -274,29 +211,13 @@ stdenv'.mkDerivation (finalAttrs: {
    ++ lib.optionals x11Support [
      libX11
      libXext
-      libGLU
      libGL
-      libXxf86vm
      libXrandr
      libXpresent
+      libXScrnSaver
    ]
-    ++ lib.optionals xineramaSupport [ libXinerama ]
-    ++ lib.optionals xvSupport [ libXv ]
    ++ lib.optionals zimgSupport [ zimg ]
-    ++ lib.optionals stdenv.hostPlatform.isLinux [ nv-codec-headers-11 ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [ libiconv ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      Accelerate
-      CoreFoundation
-      Cocoa
-      CoreAudio
-      MediaPlayer
-      VideoToolbox
-    ]
-    ++ lib.optionals (stdenv.hostPlatform.isDarwin && swiftSupport) [
-      AVFoundation
-      CoreMedia
-    ];
+    ++ lib.optionals stdenv.hostPlatform.isLinux [ nv-codec-headers-11 ];

  postBuild = lib.optionalString stdenv.hostPlatform.isDarwin ''
    pushd .. # Must be run from the source dir because it uses relative paths
@ -325,6 +246,13 @@ stdenv'.mkDerivation (finalAttrs: {
    + lib.optionalString stdenv.hostPlatform.isDarwin ''
      mkdir -p $out/Applications
      cp -r mpv.app $out/Applications
+
+      # On macOS, many things won’t work properly unless `mpv(1)` is
+      # executed from the app bundle, such as spatial audio with
+      # `--ao=avfoundation`. This wrapper ensures that those features
+      # work reliably and also avoids shipping two copies of the entire
+      # `mpv` executable.
+      makeWrapper $out/Applications/mpv.app/Contents/MacOS/mpv $out/bin/mpv
    '';

  # Set RUNPATH so that libcuda in /run/opengl-driver(-32)/lib can be found.
--- a/pkgs/applications/virtualization/arion/default.nix
+++ b/pkgs/applications/virtualization/arion/default.nix
@ -49,7 +49,7 @@ let
    # feature, but rather to make the program more robustly self-
    # contained.

-    postInstall = ''${o.postInstall or ""}
+    postInstall = o.postInstall or "" + ''
      mkdir -p $out/libexec
      mv $out/bin/arion $out/libexec
      makeWrapper $out/libexec/arion $out/bin/arion \
--- a/pkgs/applications/virtualization/rust-hypervisor-firmware/default.nix
+++ b/pkgs/applications/virtualization/rust-hypervisor-firmware/default.nix
@ -1,11 +1,11 @@
 { lib
 , fetchFromGitHub
-, hostPlatform
+, stdenv
 , lld
 }:

 let
-  arch = hostPlatform.qemuArch;
+  arch = stdenv.hostPlatform.qemuArch;

  target = ./. + "/${arch}-unknown-none.json";

@ -15,7 +15,7 @@ assert lib.assertMsg (builtins.pathExists target) "Target spec not found";

 let
  cross = import ../../../.. {
-    system = hostPlatform.system;
+    system = stdenv.hostPlatform.system;
    crossSystem = lib.systems.examples."${arch}-embedded" // {
      rust.rustcTarget = "${arch}-unknown-none";
      rust.platform = lib.importJSON target;
--- a/pkgs/applications/window-managers/hyprwm/hyprpaper/default.nix
+++ b/pkgs/applications/window-managers/hyprwm/hyprpaper/default.nix
@ -86,7 +86,11 @@ stdenv.mkDerivation (finalAttrs: {
    inherit (finalAttrs.src.meta) homepage;
    description = "Blazing fast wayland wallpaper utility";
    license = licenses.bsd3;
-    maintainers = with maintainers; [ wozeparrot fufexan ];
+    maintainers = with maintainers; [
+      fufexan
+      khaneliman
+      wozeparrot
+    ];
    inherit (wayland.meta) platforms;
    broken = stdenv.hostPlatform.isDarwin;
    mainProgram = "hyprpaper";
--- a/pkgs/applications/window-managers/hyprwm/hyprpicker/default.nix
+++ b/pkgs/applications/window-managers/hyprwm/hyprpicker/default.nix
@ -61,7 +61,10 @@ stdenv.mkDerivation (finalAttrs: {
    description = "Wlroots-compatible Wayland color picker that does not suck";
    homepage = "https://github.com/hyprwm/hyprpicker";
    license = lib.licenses.bsd3;
-    maintainers = with lib.maintainers; [ fufexan ];
+    maintainers = with lib.maintainers; [
+      fufexan
+      khaneliman
+    ];
    platforms = wayland.meta.platforms;
    mainProgram = "hyprpicker";
  };
--- a/pkgs/applications/window-managers/hyprwm/xdg-desktop-portal-hyprland/default.nix
+++ b/pkgs/applications/window-managers/hyprwm/xdg-desktop-portal-hyprland/default.nix
@ -91,7 +91,10 @@ stdenv.mkDerivation (finalAttrs: {
    changelog = "https://github.com/hyprwm/xdg-desktop-portal-hyprland/releases/tag/v${finalAttrs.version}";
    mainProgram = "hyprland-share-picker";
    license = lib.licenses.bsd3;
-    maintainers = with lib.maintainers; [ fufexan ];
+    maintainers = with lib.maintainers; [
+      fufexan
+      khaneliman
+    ];
    platforms = lib.platforms.linux;
  };
 })
--- a/pkgs/build-support/fetchgit/nix-prefetch-git
+++ b/pkgs/build-support/fetchgit/nix-prefetch-git
@ -412,6 +412,7 @@ remove_tmpPath() {
 }

 remove_tmpHomePath() {
+    chmod -R u+w "$tmpHomePath"
    rm -rf "$tmpHomePath"
 }

--- a/pkgs/build-support/fetchurl/builder.sh
+++ b/pkgs/build-support/fetchurl/builder.sh
@ -19,7 +19,8 @@ curl=(
    --user-agent "curl/$curlVersion Nixpkgs/$nixpkgsVersion"
 )

-if ! [ -f "$SSL_CERT_FILE" ]; then
+# Default fallback value defined in pkgs/build-support/fetchurl/default.nix
+if [ "$SSL_CERT_FILE" == "/no-cert-file.crt" ]; then
    curl+=(--insecure)
 fi

--- a/pkgs/build-support/fetchurl/default.nix
+++ b/pkgs/build-support/fetchurl/default.nix
@ -220,20 +220,26 @@ stdenvNoCC.mkDerivation (
    # New-style output content requirements.
    inherit (hash_) outputHashAlgo outputHash;

-    # Disable TLS verification only when we know the hash and no credentials are
-    # needed to access the resource
    SSL_CERT_FILE =
-      if
+      let
+        nixSSLCertFile = builtins.getEnv "NIX_SSL_CERT_FILE";
+      in
+      if nixSSLCertFile != "" then
+        nixSSLCertFile
+      else if
        (
          hash_.outputHash == ""
          || hash_.outputHash == lib.fakeSha256
          || hash_.outputHash == lib.fakeSha512
          || hash_.outputHash == lib.fakeHash
+          # Make sure we always enforce TLS verification when credentials
+          # are needed to access the resource
          || netrcPhase != null
        )
      then
        "${cacert}/etc/ssl/certs/ca-bundle.crt"
      else
+        # Fallback to stdenv default, see pkgs/stdenv/generic/setup.sh
        "/no-cert-file.crt";

    outputHashMode = if (recursiveHash || executable) then "recursive" else "flat";
--- a/pkgs/build-support/go/package.nix
+++ b/pkgs/build-support/go/package.nix
@ -289,6 +289,7 @@ lib.warnIf (buildFlags != "" || buildFlagsArray != "")
  "`buildFlags`/`buildFlagsArray` are deprecated and will be removed in the 24.11 release. Use the `ldflags` and/or `tags` attributes instead"
 lib.warnIf (builtins.elem "-buildid=" ldflags) "`-buildid=` is set by default as ldflag by buildGoModule"
 lib.warnIf (builtins.elem "-trimpath" GOFLAGS) "`-trimpath` is added by default to GOFLAGS by buildGoModule when allowGoReference isn't set to true"
-lib.warn '''buildGoPackage' is deprecated and will be removed for the 25.05 release.
-Please use 'buildGoModule' instead. Tips for migration can be found in the Go section of the nixpkgs manual.''
+lib.warn ''
+  'buildGoPackage' is deprecated and will be removed for the 25.05 release.
+  Please use 'buildGoModule' instead. Tips for migration can be found in the Go section of the nixpkgs manual.''
  package
--- a/pkgs/build-support/make-pkgconfigitem/default.nix
+++ b/pkgs/build-support/make-pkgconfigitem/default.nix
@ -51,9 +51,7 @@ let
    lib.pipe attrs [
      (lib.mapAttrsToList renderFunc)
      (builtins.filter (v: v != ""))
-      (builtins.concatStringsSep "\n")
-      (section: ''${section}
-      '')
+      (lib.concatLines)
    ];

  variablesSectionRendered = renderSomething renderVariable variables;
--- a/pkgs/build-support/release/nix-build.nix
+++ b/pkgs/build-support/release/nix-build.nix
@ -160,7 +160,8 @@ stdenv.mkDerivation (
       # Build out of source tree and make the source tree read-only.  This
       # helps catch violations of the GNU Coding Standards (info
       # "(standards) Configuration"), like `make distcheck' does.
-       '' mkdir "../build"
+       ''
+          mkdir "../build"
          cd "../build"
          configureScript="../$sourceRoot/configure"
          chmod -R a-w "../$sourceRoot"
--- a/pkgs/build-support/trivial-builders/default.nix
+++ b/pkgs/build-support/trivial-builders/default.nix
@ -469,7 +469,11 @@ rec {
    as a easy way to build multiple derivations at once.
   */
  symlinkJoin =
-    args_@{ name
+    args_@{
+      name ?
+        assert lib.assertMsg (args_ ? pname && args_ ? version)
+          "symlinkJoin requires either a `name` OR `pname` and `version`";
+        "${args_.pname}-${args_.version}"
    , paths
    , preferLocalBuild ? true
    , allowSubstitutes ? false
--- a/pkgs/by-name/ai/aider-chat/package.nix
+++ b/pkgs/by-name/ai/aider-chat/package.nix
@ -12,7 +12,7 @@ let
    self = python3;
    packageOverrides = _: super: { tree-sitter = super.tree-sitter_0_21; };
  };
-  version = "0.59.0";
+  version = "0.60.0";
 in
 python3.pkgs.buildPythonApplication {
  pname = "aider-chat";
@ -20,60 +20,100 @@ python3.pkgs.buildPythonApplication {
  pyproject = true;

  src = fetchFromGitHub {
-    owner = "paul-gauthier";
+    owner = "Aider-AI";
    repo = "aider";
    rev = "refs/tags/v${version}";
-    hash = "sha256-20LicYj1j5gGzhF+SxPUKu858nHZgwDF1JxXeHRtYe0=";
+    hash = "sha256-0jAdUcGGJzxvTKY/56an0oLEghZHz6fdNLg8cPer1Qc=";
  };

  pythonRelaxDeps = true;

  build-system = with python3.pkgs; [ setuptools-scm ];

-  dependencies =
-    with python3.pkgs;
-    [
-      aiohappyeyeballs
-      backoff
-      beautifulsoup4
-      configargparse
-      diff-match-patch
-      diskcache
-      flake8
-      gitpython
-      grep-ast
-      importlib-resources
-      json5
-      jsonschema
-      jiter
-      litellm
-      networkx
-      numpy
-      packaging
-      pathspec
-      pexpect
-      pillow
-      playwright
-      prompt-toolkit
-      ptyprocess
-      pypager
-      pypandoc
-      pyperclip
-      pyyaml
-      psutil
-      rich
-      scipy
-      sounddevice
-      soundfile
-      streamlit
-      tokenizers
-      watchdog
-      pydub
-    ]
-    ++ lib.optionals (!tensorflow.meta.broken) [
-      llama-index-core
-      llama-index-embeddings-huggingface
-    ];
+  dependencies = with python3.pkgs; [
+    aiohappyeyeballs
+    aiohttp
+    aiosignal
+    annotated-types
+    anyio
+    attrs
+    backoff
+    beautifulsoup4
+    certifi
+    cffi
+    charset-normalizer
+    click
+    configargparse
+    diff-match-patch
+    diskcache
+    distro
+    filelock
+    flake8
+    frozenlist
+    fsspec
+    gitdb
+    gitpython
+    grep-ast
+    h11
+    httpcore
+    httpx
+    huggingface-hub
+    idna
+    importlib-resources
+    jinja2
+    jiter
+    json5
+    jsonschema
+    jsonschema-specifications
+    litellm
+    markdown-it-py
+    markupsafe
+    mccabe
+    mdurl
+    multidict
+    networkx
+    numpy
+    openai
+    packaging
+    pathspec
+    pexpect
+    pillow
+    prompt-toolkit
+    psutil
+    ptyprocess
+    pycodestyle
+    pycparser
+    pydantic
+    pydantic-core
+    pydub
+    pyflakes
+    pygments
+    pypandoc
+    pyperclip
+    python-dotenv
+    pyyaml
+    referencing
+    regex
+    requests
+    rich
+    rpds-py
+    scipy
+    smmap
+    sniffio
+    sounddevice
+    soundfile
+    soupsieve
+    tiktoken
+    tokenizers
+    tqdm
+    tree-sitter
+    tree-sitter-languages
+    typing-extensions
+    urllib3
+    wcwidth
+    yarl
+    zipp
+  ];

  buildInputs = [ portaudio ];

--- a/pkgs/by-name/an/anyrun/package.nix
+++ b/pkgs/by-name/an/anyrun/package.nix
@ -68,7 +68,10 @@ rustPlatform.buildRustPackage rec {
    description = "Wayland-native, highly customizable runner";
    homepage = "https://github.com/kirottu/anyrun";
    license = lib.licenses.gpl3Only;
-    maintainers = with lib.maintainers; [ NotAShelf ];
+    maintainers = with lib.maintainers; [
+      khaneliman
+      NotAShelf
+    ];
    mainProgram = "anyrun";
  };
 }
--- a/pkgs/by-name/ba/baresip/package.nix
+++ b/pkgs/by-name/ba/baresip/package.nix
@ -86,9 +86,11 @@ stdenv.mkDerivation rec {

  enableParallelBuilding = true;

-  env.NIX_CFLAGS_COMPILE = '' -I${librem}/include/rem -I${gsm}/include/gsm
+  env.NIX_CFLAGS_COMPILE = ''
+    -I${librem}/include/rem -I${gsm}/include/gsm
    -DHAVE_INTTYPES_H -D__GLIBC__
-    -D__need_timeval -D__need_timespec -D__need_time_t '';
+    -D__need_timeval -D__need_timespec -D__need_time_t
+  '';

  doInstallCheck = true;
  # CMake feature detection is prone to breakage between upgrades:
--- a/pkgs/by-name/bo/bombsquad/package.nix
+++ b/pkgs/by-name/bo/bombsquad/package.nix
@ -1,7 +1,6 @@
 {
  lib,
  stdenv,
-  targetPlatform,
  fetchurl,
  python312,
  SDL2,
@ -30,7 +29,7 @@ let
        hash = "sha256-o1Yg0C5k07NZzc9jQrHXR+kkQl8HZ55U9/fqcpe3Iyw=";
      };
    }
-    .${targetPlatform.system} or (throw "${targetPlatform.system} is unsupported.");
+    .${stdenv.targetPlatform.system} or (throw "${stdenv.targetPlatform.system} is unsupported.");
 in
 stdenv.mkDerivation (finalAttrs: {
  pname = "bombsquad";
--- a/pkgs/by-name/ca/caprine/package.nix
+++ b/pkgs/by-name/ca/caprine/package.nix
@ -84,7 +84,10 @@ buildNpmPackage rec {
    description = "Elegant Facebook Messenger desktop app";
    homepage = "https://github.com/sindresorhus/caprine";
    license = lib.licenses.mit;
-    maintainers = with lib.maintainers; [ astronaut0212 ];
+    maintainers = with lib.maintainers; [
+      astronaut0212
+      khaneliman
+    ];
    inherit (electron.meta) platforms;
  };
 }
--- a/pkgs/by-name/ca/cargo-rdme/package.nix
+++ b/pkgs/by-name/ca/cargo-rdme/package.nix
@ -2,18 +2,18 @@

 rustPlatform.buildRustPackage rec {
  pname = "cargo-rdme";
-  version = "1.4.4";
+  version = "1.4.5";

  src = fetchCrate {
    inherit pname version;
-    hash = "sha256-AARkXr6qOq9u/nmcmCnA4P+Q+MPPChCXoRaYiLwCNPs=";
+    hash = "sha256-IB+n9abFeWLgJLdo3NjffcGrIxXhNdZ2moyfIG+gMoc=";
  };

  buildInputs = lib.optionals stdenv.hostPlatform.isDarwin [
    Security
  ];

-  cargoHash = "sha256-myTh+zOtAt9h/irld7OHSXKMv0V+LAR4h/afYKvXeXg=";
+  cargoHash = "sha256-mD95+Q6xaL0LFk5841LBrQqzFU7KFJbUgHB96zXy2KU=";

  meta = with lib; {
    description = "Cargo command to create the README.md from your crate's documentation";
--- a/pkgs/by-name/ca/cava/package.nix
+++ b/pkgs/by-name/ca/cava/package.nix
@ -0,0 +1,80 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  autoreconfHook,
+  autoconf-archive,
+  alsa-lib,
+  fftw,
+  iniparser,
+  libGL,
+  libpulseaudio,
+  libtool,
+  ncurses,
+  pipewire,
+  pkgconf,
+  portaudio,
+  SDL2,
+  versionCheckHook,
+  withSDL2 ? false,
+  withPipewire ? stdenv.hostPlatform.isLinux,
+}:
+
+stdenv.mkDerivation rec {
+  pname = "cava";
+  version = "0.10.2";
+
+  src = fetchFromGitHub {
+    owner = "karlstav";
+    repo = "cava";
+    rev = version;
+    hash = "sha256-y6RslsU/zmr0Ai/rnr73N3OtjuBcWa3JCwh9P5GkNss=";
+  };
+
+  buildInputs =
+    [
+      fftw
+      iniparser
+      libpulseaudio
+      libtool
+      ncurses
+    ]
+    ++ lib.optionals stdenv.hostPlatform.isLinux [
+      alsa-lib
+    ]
+    ++ lib.optionals stdenv.hostPlatform.isDarwin [
+      portaudio
+    ]
+    ++ lib.optionals withSDL2 [
+      libGL
+      SDL2
+    ]
+    ++ lib.optionals withPipewire [
+      pipewire
+    ];
+
+  nativeBuildInputs = [
+    autoreconfHook
+    autoconf-archive
+    pkgconf
+    versionCheckHook
+  ];
+  doInstallCheck = true;
+  versionCheckProgramArg = "-v";
+
+  preAutoreconf = ''
+    echo ${version} > version
+  '';
+
+  meta = with lib; {
+    description = "Console-based Audio Visualizer for Alsa";
+    homepage = "https://github.com/karlstav/cava";
+    license = licenses.mit;
+    maintainers = with maintainers; [
+      offline
+      mirrexagon
+    ];
+    platforms = platforms.unix;
+    mainProgram = "cava";
+  };
+}
--- a/pkgs/by-name/cc/ccid/package.nix
+++ b/pkgs/by-name/cc/ccid/package.nix
@ -5,6 +5,8 @@
  flex,
  gitUpdater,
  libusb1,
+  meson,
+  ninja,
  pcsclite,
  perl,
  pkg-config,
@ -22,14 +24,13 @@ stdenv.mkDerivation rec {

  postPatch = ''
    patchShebangs .
-    substituteInPlace src/Makefile.am --replace-fail /bin/echo echo
+    substituteInPlace meson.build --replace-fail \
+      "pcsc_dep.get_variable('usbdropdir')" \
+      "'$out/pcsc/drivers'"
  '';

-  configureFlags = [
-    "--enable-twinserial"
-    "--enable-serialconfdir=${placeholder "out"}/etc/reader.conf.d"
-    "--enable-ccidtwindir=${placeholder "out"}/pcsc/drivers/serial"
-    "--enable-usbdropdir=${placeholder "out"}/pcsc/drivers"
+  mesonFlags = [
+    (lib.mesonBool "serial" true)
  ];

  # error: call to undeclared function 'InterruptRead';
@ -42,6 +43,8 @@ stdenv.mkDerivation rec {
    flex
    perl
    pkg-config
+    meson
+    ninja
  ];

  buildInputs = [
@ -51,7 +54,7 @@ stdenv.mkDerivation rec {
  ];

  postInstall = ''
-    install -Dm 0444 -t $out/lib/udev/rules.d src/92_pcscd_ccid.rules
+    install -Dm 0444 -t $out/lib/udev/rules.d ../src/92_pcscd_ccid.rules
    substituteInPlace $out/lib/udev/rules.d/92_pcscd_ccid.rules \
      --replace-fail "/usr/sbin/pcscd" "${pcsclite}/bin/pcscd"
  '';
@ -64,6 +67,14 @@ stdenv.mkDerivation rec {
    url = "https://salsa.debian.org/rousseau/CCID.git";
  };

+  installCheckPhase = ''
+    [ -f $out/etc/reader.conf.d/libccidtwin ]
+    [ -f $out/lib/udev/rules.d/92_pcscd_ccid.rules ]
+    [ -f $out/pcsc/drivers/ifd-ccid.bundle/Contents/Info.plist ]
+    [ -f $out/pcsc/drivers/ifd-ccid.bundle/Contents/Linux/libccid.so ]
+    [ -f $out/pcsc/drivers/serial/libccidtwin.so ]
+  '';
+
  meta = with lib; {
    description = "PC/SC driver for USB CCID smart card readers";
    homepage = "https://ccid.apdu.fr/";
--- a/pkgs/by-name/cl/clang-uml/package.nix
+++ b/pkgs/by-name/cl/clang-uml/package.nix
@ -11,6 +11,7 @@
  yaml-cpp,
  elfutils,
  libunwind,
+  versionCheckHook,
  enableLibcxx ? false,
  debug ? false,
 }:
@ -43,6 +44,7 @@ stdenv.mkDerivation (finalAttrs: {

  cmakeFlags = [
    "-DCUSTOM_COMPILE_OPTIONS=-Wno-error=sign-compare"
+    "-DGIT_VERSION=${finalAttrs.version}"
  ];

  buildInputs = [
@ -72,6 +74,10 @@ stdenv.mkDerivation (finalAttrs: {
  dontFixup = debug;
  dontStrip = debug;

+  nativeInstallCheckInputs = [ versionCheckHook ];
+  doInstallCheck = true;
+  versionCheckProgramArg = "--version";
+
  meta = {
    description = "Customizable automatic UML diagram generator for C++ based on Clang";
    longDescription = ''
@ -84,5 +90,6 @@ stdenv.mkDerivation (finalAttrs: {
    homepage = "https://clang-uml.github.io/";
    license = lib.licenses.asl20;
    platforms = lib.platforms.all;
+    mainProgram = "clang-uml";
  };
 })
--- a/pkgs/by-name/cl/cliqr/package.nix
+++ b/pkgs/by-name/cl/cliqr/package.nix
@ -0,0 +1,33 @@
+{
+  lib,
+  buildGoModule,
+  fetchFromGitHub,
+}:
+
+buildGoModule rec {
+  pname = "cliqr";
+  version = "0.1.25";
+
+  src = fetchFromGitHub {
+    owner = "paepckehh";
+    repo = "cliqr";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-iPNI92kCNFXRiV5NV7Yj0gznwNeFoW02yh6QLrkBYO0=";
+  };
+
+  vendorHash = null;
+
+  ldflags = [
+    "-s"
+    "-w"
+  ];
+
+  meta = {
+    changelog = "https://github.com/paepckehh/cliqr/releases/tag/v${version}";
+    homepage = "https://paepcke.de/cliqr";
+    description = "Transfer, share data & secrets via console qr codes";
+    license = lib.licenses.bsd3;
+    mainProgram = "cliqr";
+    maintainers = with lib.maintainers; [ paepcke ];
+  };
+}
--- a/pkgs/by-name/co/code-cursor/package.nix
+++ b/pkgs/by-name/co/code-cursor/package.nix
@ -8,11 +8,11 @@
 }:
 let
  pname = "cursor";
-  version = "0.41.3";
+  version = "0.42.3";
  appKey = "230313mzl4w4u92";
  src = fetchurl {
-    url = "https://download.todesktop.com/230313mzl4w4u92/cursor-0.41.3-build-240925fkhcqg263-x86_64.AppImage";
-    hash = "sha256-WtfyiNGnUn8g1HR0TQPyn3SMJmjqe+otAYeyokMIO+w=";
+    url = "https://download.todesktop.com/230313mzl4w4u92/cursor-0.42.3-build-241016kxu9umuir-x86_64.AppImage";
+    hash = "sha256-GWkilBlpXube//jbxRjmKJjYcmB42nhMY8K0OgkvtwA=";
  };
  appimageContents = appimageTools.extractType2 { inherit version pname src; };
 in
--- a/pkgs/by-name/ei/eiwd/package.nix
+++ b/pkgs/by-name/ei/eiwd/package.nix
@ -54,7 +54,7 @@ stdenv.mkDerivation (finalAttrs: {
  enableParallelBuilding = true;

  # override this to false if you don't want to build python3
-  doCheck = stdenv.hostPlatform == stdenv.buildPlatform;
+  doCheck = stdenv.buildPlatform.canExecute stdenv.hostPlatform;

  # prevent the `install-data-local` Makefile rule from running;
  # all it does is attempt to `mkdir` the `localstatedir`.
--- a/pkgs/by-name/fa/factorio/versions.json
+++ b/pkgs/by-name/fa/factorio/versions.json
@ -3,14 +3,14 @@
    "alpha": {
      "experimental": {
        "candidateHashFilenames": [
-          "factorio_linux_2.0.9.tar.xz"
+          "factorio_linux_2.0.10.tar.xz"
        ],
-        "name": "factorio_alpha_x64-2.0.9.tar.xz",
+        "name": "factorio_alpha_x64-2.0.10.tar.xz",
        "needsAuth": true,
-        "sha256": "34c21cd3cbe91b65483786ccb4467b5d4766c748cbbddd2ce3b30d319d163e3b",
+        "sha256": "07508fc5112f95ef5d5afedea66863ea326e039bd872b772b934ed08545c399b",
        "tarDirectory": "x64",
-        "url": "https://factorio.com/get-download/2.0.9/alpha/linux64",
-        "version": "2.0.9"
+        "url": "https://factorio.com/get-download/2.0.10/alpha/linux64",
+        "version": "2.0.10"
      },
      "stable": {
        "candidateHashFilenames": [
@ -51,14 +51,14 @@
    "expansion": {
      "experimental": {
        "candidateHashFilenames": [
-          "factorio-space-age_linux_2.0.9.tar.xz"
+          "factorio-space-age_linux_2.0.10.tar.xz"
        ],
-        "name": "factorio_expansion_x64-2.0.9.tar.xz",
+        "name": "factorio_expansion_x64-2.0.10.tar.xz",
        "needsAuth": true,
-        "sha256": "6369d23550a7a721d3de1d34253e8321ee601fa759d1fb5efac9abc28aa7509d",
+        "sha256": "f7d346578c812314be8b72fbf6fd291c53d23ecc2dc6556a8948d26b3b95d71e",
        "tarDirectory": "x64",
-        "url": "https://factorio.com/get-download/2.0.9/expansion/linux64",
-        "version": "2.0.9"
+        "url": "https://factorio.com/get-download/2.0.10/expansion/linux64",
+        "version": "2.0.10"
      },
      "stable": {
        "candidateHashFilenames": [
@ -75,15 +75,15 @@
    "headless": {
      "experimental": {
        "candidateHashFilenames": [
-          "factorio-headless_linux_2.0.9.tar.xz",
-          "factorio_headless_x64_2.0.9.tar.xz"
+          "factorio-headless_linux_2.0.10.tar.xz",
+          "factorio_headless_x64_2.0.10.tar.xz"
        ],
-        "name": "factorio_headless_x64-2.0.9.tar.xz",
+        "name": "factorio_headless_x64-2.0.10.tar.xz",
        "needsAuth": false,
-        "sha256": "f499077b3e2c1313452c350f1faf17db31cae2a0fa738f69166e97c3caa3c86d",
+        "sha256": "2d7dd212fa6f715218a5e33bad7d593af8998fa7bf7ce727343159ee1f8c23f4",
        "tarDirectory": "x64",
-        "url": "https://factorio.com/get-download/2.0.9/headless/linux64",
-        "version": "2.0.9"
+        "url": "https://factorio.com/get-download/2.0.10/headless/linux64",
+        "version": "2.0.10"
      },
      "stable": {
        "candidateHashFilenames": [
--- a/pkgs/by-name/gl/glab/package.nix
+++ b/pkgs/by-name/gl/glab/package.nix
@ -28,7 +28,7 @@ buildGo123Module rec {

  nativeBuildInputs = [ installShellFiles ];

-  postInstall = lib.optionalString (stdenv.hostPlatform == stdenv.buildPlatform) ''
+  postInstall = lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
    make manpage
    installManPage share/man/man1/*
    installShellCompletion --cmd glab \
--- a/pkgs/by-name/gr/grimblast/package.nix
+++ b/pkgs/by-name/gr/grimblast/package.nix
@ -11,6 +11,7 @@
 , libnotify
 , slurp
 , wl-clipboard
+, bash
 }:

 stdenvNoCC.mkDerivation (finalAttrs: {
@ -31,6 +32,8 @@ stdenvNoCC.mkDerivation (finalAttrs: {
    scdoc
  ];

+  buildInputs = [ bash ];
+
  makeFlags = [
    "PREFIX=$(out)"
  ];
--- a/pkgs/by-name/gu/guile-goblins/package.nix
+++ b/pkgs/by-name/gu/guile-goblins/package.nix
@ -10,11 +10,11 @@
 }:
 stdenv.mkDerivation rec {
  pname = "guile-goblins";
-  version = "0.13.0";
+  version = "0.14.0";

  src = fetchurl {
    url = "https://spritely.institute/files/releases/guile-goblins/guile-goblins-${version}.tar.gz";
-    hash = "sha256-efmyOtPAz1ZPdMCuVaGALR6e0lg7gcjt81BUMBVUKug=";
+    hash = "sha256-jR+pWk7NXvOF0CvDwa1rYg0yu5ktyq440qyRgivqHr8=";
  };

  strictDeps = true;
--- a/pkgs/by-name/hy/hypridle/package.nix
+++ b/pkgs/by-name/hy/hypridle/package.nix
@ -43,7 +43,10 @@ stdenv.mkDerivation (finalAttrs: {
    description = "Hyprland's idle daemon";
    homepage = "https://github.com/hyprwm/hypridle";
    license = lib.licenses.bsd3;
-    maintainers = with lib.maintainers; [ iogamaster ];
+    maintainers = with lib.maintainers; [
+      iogamaster
+      khaneliman
+    ];
    mainProgram = "hypridle";
    platforms = [
      "aarch64-linux"
--- a/pkgs/by-name/hy/hyprland/package.nix
+++ b/pkgs/by-name/hy/hyprland/package.nix
@ -207,6 +207,7 @@ customStdenv.mkDerivation (finalAttrs: {
    maintainers = with lib.maintainers; [
      fufexan
      johnrtitor
+      khaneliman
      wozeparrot
    ];
    mainProgram = "Hyprland";
--- a/pkgs/by-name/hy/hyprshot/package.nix
+++ b/pkgs/by-name/hy/hyprshot/package.nix
@ -7,6 +7,8 @@
 , slurp
 , wl-clipboard
 , libnotify
+, withFreeze ? true
+, hyprpicker
 , makeWrapper
 }:

@ -28,9 +30,9 @@ stdenvNoCC.mkDerivation (finalAttrs: {

    install -Dm755 hyprshot -t "$out/bin"
    wrapProgram "$out/bin/hyprshot" \
-      --prefix PATH ":" ${lib.makeBinPath [
+      --prefix PATH ":" ${lib.makeBinPath ([
          hyprland jq grim slurp wl-clipboard libnotify
-        ]}
+        ] ++ lib.optionals withFreeze [ hyprpicker ])}

    runHook postInstall
  '';
--- a/pkgs/by-name/i2/i2p/package.nix
+++ b/pkgs/by-name/i2/i2p/package.nix
@ -13,7 +13,7 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "i2p";
-  version = "2.6.1";
+  version = "2.7.0";

  src = fetchzip {
    urls = [
@ -23,7 +23,7 @@ stdenv.mkDerivation (finalAttrs: {
      "https://files.i2p-projekt.de/"
      "https://download.i2p2.no/releases/"
    ]);
-    hash = "sha256-ntjTXdpgcTReEVxzDEoq9r3NAqS7q4m+rlJXp7is1k0=";
+    hash = "sha256-gw1i6jrmTfz9CZlCjtOUdH5R4vD57ysDeQxyyWifieg=";
  };

  strictDeps = true;
--- a/pkgs/by-name/ka/kakoune-lsp/package.nix
+++ b/pkgs/by-name/ka/kakoune-lsp/package.nix
@ -12,18 +12,18 @@

 rustPlatform.buildRustPackage rec {
  pname = "kakoune-lsp";
-  version = "17.1.2";
+  version = "18.0.2";

  src = fetchFromGitHub {
    owner = "kakoune-lsp";
    repo = "kakoune-lsp";
    rev = "v${version}";
-    hash = "sha256-NZDp98Ne6z7DlJ2vZiqGzw5ukusOkEjb+eyvmxB+IKI=";
+    hash = "sha256-nfPc0ccEk+szaTJby56iMmydcDKDq/t1o8tw24c7MfY=";
  };

  patches = [ (replaceVars ./Hardcode-perl.patch { inherit perl; }) ];

-  cargoHash = "sha256-QonOqdcdp1vbxzLnF46X0DLVay2Up1LvHZ/ZZ04LqlE=";
+  cargoHash = "sha256-nISlApNLitwLhRovjPDep6ObOfZ1bk5QWJ/j2xjJxuU=";

  buildInputs = lib.optionals stdenv.hostPlatform.isDarwin [
    CoreServices
--- a/pkgs/by-name/ka/kanidm/package.nix
+++ b/pkgs/by-name/ka/kanidm/package.nix
@ -61,8 +61,8 @@ rustPlatform.buildRustPackage rec {
    ''
      cp ${format profile} libs/profiles/${KANIDM_BUILD_PROFILE}.toml
      substituteInPlace libs/profiles/${KANIDM_BUILD_PROFILE}.toml \
-        --replace '@htmx_ui_pkg_path@' "${placeholder "out"}/ui/hpkg" \
-        --replace '@web_ui_pkg_path@' "${placeholder "out"}/ui/pkg"
+        --replace-fail '@htmx_ui_pkg_path@' "$out/ui/hpkg" \
+        --replace-fail '@web_ui_pkg_path@' "$out/ui/pkg"
    '';

  nativeBuildInputs = [
@ -87,8 +87,10 @@ rustPlatform.buildRustPackage rec {
    cp -r server/core/static $out/ui/hpkg
  '';

-  # Otherwise build breaks on some unused code
-  env.RUSTFLAGS = "-A dead_code";
+  # Upstream runs with the Rust equivalent of -Werror,
+  # which breaks when we upgrade to new Rust before them.
+  # Just allow warnings. It's fine, really.
+  env.RUSTFLAGS = "--cap-lints warn";

  # Not sure what pathological case it hits when compiling tests with LTO,
  # but disabling it takes the total `cargo check` time from 40 minutes to
--- a/pkgs/by-name/ko/koboldcpp/package.nix
+++ b/pkgs/by-name/ko/koboldcpp/package.nix
@ -141,6 +141,10 @@ effectiveStdenv.mkDerivation (finalAttrs: {
    cp *.so "$out/bin"
    cp *.embd "$out/bin"

+    ${lib.optionalString metalSupport ''
+      cp *.metal "$out/bin"
+    ''}
+
    ${lib.optionalString (!koboldLiteSupport) ''
      rm "$out/bin/kcpp_docs.embd"
      rm "$out/bin/klite.embd"
--- a/pkgs/applications/graphics/komikku/default.nix
+++ b/pkgs/applications/graphics/komikku/default.nix
@ -1,25 +1,29 @@
-{ lib
-, fetchFromGitea
-, desktop-file-utils
-, gettext
-, glib
-, gobject-introspection
-, blueprint-compiler
-, gtk4
-, libadwaita
-, libnotify
-, webkitgtk_6_0
-, meson
-, ninja
-, pkg-config
-, python3
-, wrapGAppsHook4
-, nix-update-script
+{
+  lib,
+  fetchFromGitea,
+  desktop-file-utils,
+  gettext,
+  glib,
+  gobject-introspection,
+  blueprint-compiler,
+  gtk4,
+  libadwaita,
+  libnotify,
+  webkitgtk_6_0,
+  meson,
+  ninja,
+  pkg-config,
+  python3,
+  wrapGAppsHook4,
+  librsvg,
+  gnome,
+  webp-pixbuf-loader,
+  nix-update-script,
 }:

 python3.pkgs.buildPythonApplication rec {
  pname = "komikku";
-  version = "1.57.0";
+  version = "1.58.0";

  format = "other";

@ -28,7 +32,7 @@ python3.pkgs.buildPythonApplication rec {
    owner = "valos";
    repo = "Komikku";
    rev = "v${version}";
-    hash = "sha256-b2XoywPnrYnuehR6xHH8BvhbMZFB1AeBN0khFfaLGn0=";
+    hash = "sha256-21ZtzWjyUC+/iPv+R1DUzCHITR8GVhN+6iepcTIRy0Y=";
  };

  nativeBuildInputs = [
@ -74,6 +78,19 @@ python3.pkgs.buildPythonApplication rec {
  # Tests require network
  doCheck = false;

+  # Pull in WebP support for manga pics of some servers.
+  # In postInstall to run before gappsWrapperArgsHook.
+  postInstall = ''
+    export GDK_PIXBUF_MODULE_FILE="${
+      gnome._gdkPixbufCacheBuilder_DO_NOT_USE {
+        extraLoaders = [
+          librsvg
+          webp-pixbuf-loader
+        ];
+      }
+    }"
+  '';
+
  # Prevent double wrapping.
  dontWrapGApps = true;

@ -87,12 +104,15 @@ python3.pkgs.buildPythonApplication rec {
    updateScript = nix-update-script { };
  };

-  meta = with lib; {
+  meta = {
    description = "Manga reader for GNOME";
    mainProgram = "komikku";
    homepage = "https://apps.gnome.org/Komikku/";
-    license = licenses.gpl3Plus;
+    license = lib.licenses.gpl3Plus;
    changelog = "https://codeberg.org/valos/Komikku/releases/tag/v${version}";
-    maintainers = with maintainers; [ chuangzhu infinitivewitch ];
+    maintainers = with lib.maintainers; [
+      chuangzhu
+      infinitivewitch
+    ];
  };
 }
--- a/pkgs/by-name/la/lazygit/package.nix
+++ b/pkgs/by-name/la/lazygit/package.nix
@ -34,6 +34,7 @@ buildGoModule rec {
    maintainers = with maintainers; [
      Br1ght0ne
      equirosa
+      khaneliman
      paveloom
      starsep
    ];
--- a/pkgs/by-name/ma/mangal/package.nix
+++ b/pkgs/by-name/ma/mangal/package.nix
@ -26,7 +26,7 @@ buildGoModule rec {

  nativeBuildInputs = [ installShellFiles ];

-  postInstall = lib.optionalString (stdenv.hostPlatform == stdenv.buildPlatform) ''
+  postInstall = lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
    # Mangal creates a config file in the folder ~/.config/mangal and fails if not possible
    export HOME=$(mktemp -d)
    installShellCompletion --cmd mangal \
--- a/pkgs/by-name/mo/moltenvk/package.nix
+++ b/pkgs/by-name/mo/moltenvk/package.nix
@ -108,6 +108,10 @@ stdenv.mkDerivation (finalAttrs: {
      "-isystem ${lib.getDev libcxx}/include/c++/v1"
      "-I${lib.getDev spirv-cross}/include/spirv_cross"
      "-I${lib.getDev spirv-headers}/include/spirv/unified1"
+
+      # MoltenVK prints a lot of verbose output to the console out of
+      # the box; we adjust this to match Homebrew’s default log level.
+      "-DMVK_CONFIG_LOG_LEVEL=MVK_CONFIG_LOG_LEVEL_NONE"
    ]
    ++ lib.optional enablePrivateAPIUsage "-DMVK_USE_METAL_PRIVATE_API=1"
  );
--- a/pkgs/by-name/mt/mtdutils/package.nix
+++ b/pkgs/by-name/mt/mtdutils/package.nix
@ -50,7 +50,7 @@ stdenv.mkDerivation rec {

  makeFlags = [ "AR:=$(AR)" ];

-  doCheck = stdenv.hostPlatform == stdenv.buildPlatform;
+  doCheck = stdenv.buildPlatform.canExecute stdenv.hostPlatform;

  outputs = [
    "out"
--- a/pkgs/by-name/op/opengv/package.nix
+++ b/pkgs/by-name/op/opengv/package.nix
@ -27,14 +27,16 @@ stdenv.mkDerivation (finalAttrs: {
    description = "Collection of computer vision methods for solving geometric vision problems";
    homepage = "https://github.com/laurentkneip/opengv";
    license = lib.licenses.bsd2;
-    longDescription = ''OpenGV is a collection of computer vision methods for solving
+    longDescription = ''
+        OpenGV is a collection of computer vision methods for solving
        geometric vision problems. It contains absolute-pose, relative-pose,
        triangulation, and point-cloud alignment methods for the calibrated
        case. All problems can be solved with central or non-central cameras,
        and embedded into a random sample consensus or nonlinear optimization
        context. Matlab and Python interfaces are implemented as well. The link
        to the above pages also shows links to precompiled Matlab mex-libraries.
-        Please consult the documentation for more information.'';
+        Please consult the documentation for more information.
+    '';
    maintainers = [ lib.maintainers.locochoco ];
    platforms = lib.platforms.all;
  };
--- a/pkgs/by-name/op/opnborg/package.nix
+++ b/pkgs/by-name/op/opnborg/package.nix
@ -0,0 +1,32 @@
+{
+  lib,
+  buildGoModule,
+  fetchFromGitHub,
+}:
+buildGoModule rec {
+  pname = "opnborg";
+  version = "0.1.2";
+
+  src = fetchFromGitHub {
+    owner = "paepckehh";
+    repo = "opnborg";
+    rev = "v${version}";
+    hash = "sha256-R8yl7dI+VNeY1OVoBo+CN88+2eSePjlzet/Zowj0cQs=";
+  };
+
+  vendorHash = "sha256-REXJryUcu+/AdVx1aK0nJ98Wq/EdhrZqL24kC1wK6mc=";
+
+  ldflags = [
+    "-s"
+    "-w"
+  ];
+
+  meta = {
+    changelog = "https://github.com/paepckehh/opnborg/releases/tag/v${version}";
+    homepage = "https://paepcke.de/opnborg";
+    description = "Sefhosted OPNSense Appliance Backup & Configuration Management Portal";
+    license = lib.licenses.bsd3;
+    mainProgram = "opnborg";
+    maintainers = with lib.maintainers; [ paepcke ];
+  };
+}
--- a/pkgs/by-name/or/orchard/package.nix
+++ b/pkgs/by-name/or/orchard/package.nix
@ -2,13 +2,13 @@

 buildGoModule rec {
  pname = "orchard";
-  version = "0.24.0";
+  version = "0.24.1";

  src = fetchFromGitHub {
    owner = "cirruslabs";
    repo = pname;
    rev = version;
-    hash = "sha256-N54wkqe05Hm9o+kQmWTJREoU+0GnivaVTJngtBDL8+U=";
+    hash = "sha256-6w/UcifseoajAOKZnn0GJiUzXAmLNGKLDCZkeZLK8NI=";
    # populate values that require us to use git. By doing this in postFetch we
    # can delete .git afterwards and maintain better reproducibility of the src.
    leaveDotGit = true;
--- a/pkgs/by-name/os/oscar/package.nix
+++ b/pkgs/by-name/os/oscar/package.nix
@ -7,13 +7,13 @@
 }:
 stdenv.mkDerivation rec {
  pname = "oscar";
-  version = "1.5.1";
+  version = "1.5.3";

  src = fetchFromGitLab {
    owner = "pholy";
    repo = "OSCAR-code";
-    rev = "v${version}";
-    hash = "sha256-FBHbPtMZeIgcR1pQflfEWK2FS8bquctXaeY/yaZofHg=";
+    rev = "${version}";
+    hash = "sha256-ukd2pni4qEwWxG4lr8KUliZO/R2eziTTuSvDo8uigxQ=";
  };

  buildInputs = [
--- a/pkgs/by-name/pa/patch-package/package.nix
+++ b/pkgs/by-name/pa/patch-package/package.nix
@ -0,0 +1,45 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  fetchYarnDeps,
+  yarnConfigHook,
+  yarnBuildHook,
+  yarnInstallHook,
+  nodejs,
+  nix-update-script,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "patch-package";
+  version = "8.0.0";
+
+  src = fetchFromGitHub {
+    owner = "ds300";
+    repo = "patch-package";
+    rev = "v${finalAttrs.version}";
+    hash = "sha256-QuCgdQGqy27wyLUI6w6p8EWLn1XA7QbkjpLJwFXSex8=";
+  };
+
+  yarnOfflineCache = fetchYarnDeps {
+    yarnLock = "${finalAttrs.src}/yarn.lock";
+    hash = "sha256-WF9gJkj4wyrBeGPIzTOw3nG6Se7tFb0YLcAM8Uv9YNI=";
+  };
+
+  nativeBuildInputs = [
+    yarnConfigHook
+    yarnBuildHook
+    yarnInstallHook
+    nodejs
+  ];
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "Fix broken node modules instantly";
+    mainProgram = "patch-package";
+    homepage = "https://github.com/ds300/patch-package";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ pyrox0 ];
+  };
+})
--- a/Show More
+++ b/Show More