Merge release-24.11 into staging-next-24.11

.github/workflows/eval.yml

@@ -0,0 +1,141 @@
+name: Eval
+
+on: pull_request_target
+
+permissions:
+  contents: read
+
+jobs:
+  attrs:
+    name: Attributes
+    runs-on: ubuntu-latest
+    outputs:
+      mergedSha: ${{ steps.merged.outputs.mergedSha }}
+      systems: ${{ steps.systems.outputs.systems }}
+    steps:
+      # Important: Because of `pull_request_target`, this doesn't check out the PR,
+      # but rather the base branch of the PR, which is needed so we don't run untrusted code
+      - name: Check out the ci directory of the base branch
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          path: base
+          sparse-checkout: ci
+      - name: Check if the PR can be merged and get the test merge commit
+        id: merged
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          if mergedSha=$(base/ci/get-merge-commit.sh ${{ github.repository }} ${{ github.event.number }}); then
+            echo "Checking the merge commit $mergedSha"
+            echo "mergedSha=$mergedSha" >> "$GITHUB_OUTPUT"
+          else
+            # Skipping so that no notifications are sent
+            echo "Skipping the rest..."
+          fi
+          rm -rf base
+      - name: Check out the PR at the test merge commit
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        # Add this to _all_ subsequent steps to skip them
+        if: steps.merged.outputs.mergedSha
+        with:
+          ref: ${{ steps.merged.outputs.mergedSha }}
+          path: nixpkgs
+
+      - name: Install Nix
+        uses: cachix/install-nix-action@08dcb3a5e62fa31e2da3d490afc4176ef55ecd72 # v30
+        if: steps.merged.outputs.mergedSha
+
+      - name: Evaluate the list of all attributes and get the systems matrix
+        id: systems
+        if: steps.merged.outputs.mergedSha
+        run: |
+          nix-build nixpkgs/ci -A eval.attrpathsSuperset
+          echo "systems=$(<result/systems.json)" >> "$GITHUB_OUTPUT"
+
+      - name: Upload the list of all attributes
+        uses: actions/upload-artifact@b4b15b8c7c6ac21ea08fcf65892d2ee8f75cf882 # v4.4.3
+        if: steps.merged.outputs.mergedSha
+        with:
+          name: paths
+          path: result/*
+
+  outpaths:
+    name: Outpaths
+    runs-on: ubuntu-latest
+    needs: attrs
+    # Skip this and future steps if the PR can't be merged
+    if: needs.attrs.outputs.mergedSha
+    strategy:
+      matrix:
+        system: ${{ fromJSON(needs.attrs.outputs.systems) }}
+    steps:
+      - name: Download the list of all attributes
+        uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4.1.8
+        with:
+          name: paths
+          path: paths
+
+      - name: Check out the PR at the test merge commit
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          ref: ${{ needs.attrs.outputs.mergedSha }}
+          path: nixpkgs
+
+      - name: Install Nix
+        uses: cachix/install-nix-action@08dcb3a5e62fa31e2da3d490afc4176ef55ecd72 # v30
+
+      - name: Evaluate the ${{ matrix.system }} output paths for all derivation attributes
+        env:
+          MATRIX_SYSTEM: ${{ matrix.system }}
+        run: |
+          nix-build nixpkgs/ci -A eval.singleSystem \
+            --argstr evalSystem "$MATRIX_SYSTEM" \
+            --arg attrpathFile ./paths/paths.json \
+            --arg chunkSize 10000
+          # If it uses too much memory, slightly decrease chunkSize
+
+      - name: Upload the output paths and eval stats
+        uses: actions/upload-artifact@b4b15b8c7c6ac21ea08fcf65892d2ee8f75cf882 # v4.4.3
+        if: needs.attrs.outputs.mergedSha
+        with:
+          name: intermediate-${{ matrix.system }}
+          path: result/*
+
+  process:
+    name: Process
+    runs-on: ubuntu-latest
+    needs: [ outpaths, attrs ]
+    steps:
+      - name: Download output paths and eval stats for all systems
+        uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4.1.8
+        with:
+          pattern: intermediate-*
+          path: intermediate
+
+      - name: Check out the PR at the test merge commit
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          ref: ${{ needs.attrs.outputs.mergedSha }}
+          path: nixpkgs
+
+      - name: Install Nix
+        uses: cachix/install-nix-action@08dcb3a5e62fa31e2da3d490afc4176ef55ecd72 # v30
+
+      - name: Combine all output paths and eval stats
+        run: |
+          nix-build nixpkgs/ci -A eval.combine \
+            --arg resultsDir ./intermediate
+
+      - name: Upload the combined results
+        uses: actions/upload-artifact@b4b15b8c7c6ac21ea08fcf65892d2ee8f75cf882 # v4.4.3
+        with:
+          name: result
+          path: result/*
+
+
+      # TODO: Run this workflow also on `push` (on at least the main development branches)
+      # Then add an extra step here that waits for the base branch (not the merge base, because that could be very different)
+      # to have completed the eval, then use
+      # gh api --method GET /repos/NixOS/nixpkgs/actions/workflows/eval.yml/runs -f head_sha=<BASE>
+      # and follow it to the artifact results, where you can then download the outpaths.json from the base branch
+      # That can then be used to compare the number of changed paths, get evaluation stats and ping appropriate reviewers

ci/OWNERS

@@ -14,7 +14,7 @@
 # Processing of this file is implemented in workflows/codeowners-v2.yml
 
 # CI
-/.github/workflows @NixOS/Security @Mic92 @zowoq
+/.github/workflows @NixOS/Security @Mic92 @zowoq @infinisil
 /.github/workflows/check-nix-format.yml @infinisil
 /.github/workflows/nixpkgs-vet.yml @infinisil @philiptaron
 /.github/workflows/codeowners-v2.yml @infinisil

ci/default.nix

@@ -26,4 +26,5 @@ in
   inherit pkgs;
   requestReviews = pkgs.callPackage ./request-reviews { };
   codeownersValidator = pkgs.callPackage ./codeowners-validator { };
+  eval = pkgs.callPackage ./eval { };
 }

ci/eval/README.md

@@ -0,0 +1,19 @@
+# Nixpkgs CI evaluation
+
+The code in this directory is used by the [eval.yml](../../.github/workflows/eval.yml) GitHub Actions workflow to evaluate the majority of Nixpkgs for all PRs, effectively making sure that when the development branches are processed by Hydra, no evaluation failures are encountered.
+
+Furthermore it also allows local evaluation using
+```
+nix-build ci -A eval.full \
+  --max-jobs 4
+  --cores 2
+  --arg chunkSize 10000
+```
+
+- `--max-jobs`: The maximum number of derivations to run at the same time. Only each [supported system](../supportedSystems.nix) gets a separate derivation, so it doesn't make sense to set this higher than that number.
+- `--cores`: The number of cores to use for each job. Recommended to set this to the amount of cores on your system divided by `--max-jobs`.
+- `chunkSize`: The number of attributes that are evaluated simultaneously on a single core. Lowering this decreases memory usage at the cost of increased evaluation time. If this is too high, there won't be enough chunks to process them in parallel, and will also increase evaluation time.
+
+A good default is to set `chunkSize` to 10000, which leads to about 3.6GB max memory usage per core, so suitable for fully utilising machines with 4 cores and 16GB memory, 8 cores and 32GB memory or 16 cores and 64GB memory.
+
+Note that 16GB memory is the recommended minimum, while with less than 8GB memory evaluation time suffers greatly.

ci/eval/default.nix

@@ -0,0 +1,273 @@
+{
+  lib,
+  runCommand,
+  writeShellScript,
+  linkFarm,
+  time,
+  procps,
+  nix,
+  jq,
+  sta,
+}:
+
+let
+  nixpkgs =
+    with lib.fileset;
+    toSource {
+      root = ../..;
+      fileset = unions (
+        map (lib.path.append ../..) [
+          "default.nix"
+          "doc"
+          "lib"
+          "maintainers"
+          "nixos"
+          "pkgs"
+          ".version"
+          "ci/supportedSystems.nix"
+        ]
+      );
+    };
+
+  supportedSystems = import ../supportedSystems.nix;
+
+  attrpathsSuperset =
+    runCommand "attrpaths-superset.json"
+      {
+        src = nixpkgs;
+        nativeBuildInputs = [
+          nix
+          time
+        ];
+        env.supportedSystems = builtins.toJSON supportedSystems;
+        passAsFile = [ "supportedSystems" ];
+      }
+      ''
+        export NIX_STATE_DIR=$(mktemp -d)
+        mkdir $out
+        export GC_INITIAL_HEAP_SIZE=4g
+        command time -v \
+          nix-instantiate --eval --strict --json --show-trace \
+          $src/pkgs/top-level/release-attrpaths-superset.nix -A paths \
+          --arg enableWarnings false > $out/paths.json
+        mv "$supportedSystemsPath" $out/systems.json
+      '';
+
+  singleSystem =
+    {
+      # The system to evaluate.
+      # Note that this is intentionally not called `system`,
+      # because `--argstr system` would only be passed to the ci/default.nix file!
+      evalSystem,
+      # The path to the `paths.json` file from `attrpathsSuperset`
+      attrpathFile,
+      # The number of attributes per chunk, see ./README.md for more info.
+      chunkSize,
+      checkMeta ? true,
+      includeBroken ? true,
+      # Whether to just evaluate a single chunk for quick testing
+      quickTest ? false,
+    }:
+    let
+      singleChunk = writeShellScript "single-chunk" ''
+        set -euo pipefail
+        chunkSize=$1
+        myChunk=$2
+        system=$3
+        outputDir=$4
+
+        export NIX_SHOW_STATS=1
+        export NIX_SHOW_STATS_PATH="$outputDir/stats/$myChunk"
+        echo "Chunk $myChunk on $system start"
+        set +e
+        command time -f "Chunk $myChunk on $system done [%MKB max resident, %Es elapsed] %C" \
+          nix-env -f "${nixpkgs}/pkgs/top-level/release-attrpaths-parallel.nix" \
+          --query --available \
+          --no-name --attr-path --out-path \
+          --show-trace \
+          --arg chunkSize "$chunkSize" \
+          --arg myChunk "$myChunk" \
+          --arg attrpathFile "${attrpathFile}" \
+          --arg systems "[ \"$system\" ]" \
+          --arg checkMeta ${lib.boolToString checkMeta} \
+          --arg includeBroken ${lib.boolToString includeBroken} \
+          > "$outputDir/result/$myChunk"
+        exitCode=$?
+        set -e
+        if (( exitCode != 0 )); then
+          echo "Evaluation failed with exit code $exitCode"
+          # This immediately halts all xargs processes
+          kill $PPID
+        fi
+      '';
+    in
+    runCommand "nixpkgs-eval-${evalSystem}"
+      {
+        nativeBuildInputs = [
+          nix
+          time
+          procps
+          jq
+        ];
+        env = {
+          inherit evalSystem chunkSize;
+        };
+      }
+      ''
+        export NIX_STATE_DIR=$(mktemp -d)
+        nix-store --init
+
+        echo "System: $evalSystem"
+        cores=$NIX_BUILD_CORES
+        echo "Cores: $cores"
+        attrCount=$(jq length "${attrpathFile}")
+        echo "Attribute count: $attrCount"
+        echo "Chunk size: $chunkSize"
+        # Same as `attrCount / chunkSize` but rounded up
+        chunkCount=$(( (attrCount - 1) / chunkSize + 1 ))
+        echo "Chunk count: $chunkCount"
+
+        mkdir $out
+
+        # Record and print stats on free memory and swap in the background
+        (
+          while true; do
+            availMemory=$(free -b | grep Mem | awk '{print $7}')
+            freeSwap=$(free -b | grep Swap | awk '{print $4}')
+            echo "Available memory: $(( availMemory / 1024 / 1024 )) MiB, free swap: $(( freeSwap / 1024 / 1024 )) MiB"
+
+            if [[ ! -f "$out/min-avail-memory" ]] || (( availMemory < $(<$out/min-avail-memory) )); then
+              echo "$availMemory" > $out/min-avail-memory
+            fi
+            if [[ ! -f $out/min-free-swap ]] || (( availMemory < $(<$out/min-free-swap) )); then
+              echo "$freeSwap" > $out/min-free-swap
+            fi
+            sleep 4
+          done
+        ) &
+
+        seq_end=$(( chunkCount - 1 ))
+
+        ${lib.optionalString quickTest ''
+          seq_end=0
+        ''}
+
+        chunkOutputDir=$(mktemp -d)
+        mkdir "$chunkOutputDir"/{result,stats}
+
+        seq -w 0 "$seq_end" |
+          command time -f "%e" -o "$out/total-time" \
+          xargs -I{} -P"$cores" \
+          ${singleChunk} "$chunkSize" {} "$evalSystem" "$chunkOutputDir"
+
+        if (( chunkSize * chunkCount != attrCount )); then
+          # A final incomplete chunk would mess up the stats, don't include it
+          rm "$chunkOutputDir"/stats/"$seq_end"
+        fi
+
+        # Make sure the glob doesn't break when there's no files
+        shopt -s nullglob
+        cat "$chunkOutputDir"/result/* > $out/paths
+        cat "$chunkOutputDir"/stats/* > $out/stats.jsonstream
+      '';
+
+  combine =
+    {
+      resultsDir,
+    }:
+    runCommand "combined-result"
+      {
+        nativeBuildInputs = [
+          jq
+          sta
+        ];
+      }
+      ''
+        mkdir -p $out
+
+        # Transform output paths to JSON
+        cat ${resultsDir}/*/paths |
+          jq --sort-keys --raw-input --slurp '
+            split("\n") |
+            map(select(. != "") | split(" ") | map(select(. != ""))) |
+            map(
+              {
+                key: .[0],
+                value: .[1] | split(";") | map(split("=") |
+                  if length == 1 then
+                    { key: "out", value: .[0] }
+                  else
+                    { key: .[0], value: .[1] }
+                  end) | from_entries}
+            ) | from_entries
+          ' > $out/outpaths.json
+
+        # Computes min, mean, error, etc. for a list of values and outputs a JSON from that
+        statistics() {
+          local stat=$1
+          sta --transpose |
+            jq --raw-input --argjson stat "$stat" -n '
+              [
+                inputs |
+                  split("\t") |
+                  { key: .[0], value: (.[1] | fromjson) }
+              ] |
+                from_entries |
+                {
+                  key: ($stat | join(".")),
+                  value: .
+                }'
+        }
+
+        # Gets all available number stats (without .sizes because those are constant and not interesting)
+        readarray -t stats < <(jq -cs '.[0] | del(.sizes) | paths(type == "number")' ${resultsDir}/*/stats.jsonstream)
+
+        # Combines the statistics from all evaluations
+        {
+          echo "{ \"key\": \"minAvailMemory\", \"value\": $(cat ${resultsDir}/*/min-avail-memory | sta --brief --min) }"
+          echo "{ \"key\": \"minFreeSwap\", \"value\": $(cat ${resultsDir}/*/min-free-swap | sta --brief --min) }"
+          cat ${resultsDir}/*/total-time | statistics '["totalTime"]'
+          for stat in "''${stats[@]}"; do
+            cat ${resultsDir}/*/stats.jsonstream |
+              jq --argjson stat "$stat" 'getpath($stat)' |
+              statistics "$stat"
+          done
+        } |
+          jq -s from_entries > $out/stats.json
+      '';
+
+  full =
+    {
+      # Whether to evaluate just a single system, by default all are evaluated
+      evalSystem ? if quickTest then "x86_64-linux" else null,
+      # The number of attributes per chunk, see ./README.md for more info.
+      chunkSize,
+      quickTest ? false,
+    }:
+    let
+      systems = if evalSystem == null then supportedSystems else [ evalSystem ];
+      results = linkFarm "results" (
+        map (evalSystem: {
+          name = evalSystem;
+          path = singleSystem {
+            inherit quickTest evalSystem chunkSize;
+            attrpathFile = attrpathsSuperset + "/paths.json";
+          };
+        }) systems
+      );
+    in
+    combine {
+      resultsDir = results;
+    };
+
+in
+{
+  inherit
+    attrpathsSuperset
+    singleSystem
+    combine
+    # The above three are used by separate VMs in a GitHub workflow,
+    # while the below is intended for testing on a single local machine
+    full
+    ;
+}

ci/supportedSystems.nix

@@ -0,0 +1,6 @@
+[
+  "aarch64-linux"
+  "aarch64-darwin"
+  "x86_64-linux"
+  "x86_64-darwin"
+]

lib/tests/release.nix

@@ -14,19 +14,5 @@ let
 in
   pkgs.symlinkJoin {
     name = "nixpkgs-lib-tests";
-    paths = map testWithNix nixVersions ++
-
-      #
-      # TEMPORARY MIGRATION MECHANISM
-      #
-      # This comment and the expression which follows it should be
-      # removed as part of resolving this issue:
-      #
-      #   https://github.com/NixOS/nixpkgs/issues/272591
-      #
-      [(import ../../pkgs/test/release {
-        inherit pkgs lib nix;
-      })]
-    ;
-
+    paths = map testWithNix nixVersions;
   }

maintainers/maintainer-list.nix

@@ -13060,6 +13060,13 @@
     githubId = 30698906;
     name = "Luna D Dragon";
   };
+  luNeder = {
+    email = "luana@luana.dev.br";
+    matrix = "@luana:catgirl.cloud";
+    github = "LuNeder";
+    githubId = 19750714;
+    name = "Luana Neder";
+  };
   lunik1 = {
     email = "ch.nixpkgs@themaw.xyz";
     matrix = "@lunik1:lunik.one";

nixos/doc/manual/release-notes/rl-2411.section.md

@@ -34,6 +34,9 @@
 
 - The `moonlight-qt` package (for [Moonlight game streaming](https://moonlight-stream.org/)) now has HDR support on Linux systems.
 
+- [Sched-ext](https://github.com/sched-ext/scx), a Linux kernel feature to run schedulers in userspace, is now available [`services.scx`](options.html#opt-services.scx.enable).
+  Requires Linux kernel version 6.12 or later.
+
 - PostgreSQL now defaults to major version 16.
 
 - GNOME has been updated to version 47. Refer to the [release notes](https://release.gnome.org/47/) for more details.
@@ -84,6 +87,8 @@
 
 ## New Modules {#sec-release-24.11-new-modules}
 
+- [Coral](https://coral.ai/), hardware support for Coral.ai Edge TPU devices. Available as [hardware.coral.usb.enable](#opt-hardware.coral.usb.enable) and [hardware.coral.pcie.enable](#opt-hardware.coral.pcie.enable).
+
 - [Cyrus IMAP](https://github.com/cyrusimap/cyrus-imapd), an email, contacts and calendar server. Available as [services.cyrus-imap](#opt-services.cyrus-imap.enable) service.
 
 - [TaskChampion Sync-Server](https://github.com/GothenburgBitFactory/taskchampion-sync-server), a [Taskwarrior 3](https://taskwarrior.org/docs/upgrade-3/) sync server. Available as [services.taskchampion-sync-server](#opt-services.taskchampion-sync-server.enable).
@@ -437,6 +442,9 @@
 
 - `gitea` no longer supports the opt-in feature [PAM (Pluggable Authentication Module)](https://docs.gitea.com/usage/authentication#pam-pluggable-authentication-module).
 
+- `vuze` was removed because it is unmaintained upstream and insecure (CVE-2018-13417).
+  BiglyBT is a maintained fork.
+
 - `services.ddclient.use` has been deprecated: `ddclient` now supports separate IPv4 and IPv6 configuration. Use `services.ddclient.usev4` and `services.ddclient.usev6` instead.
 
 - `services.pgbouncer` systemd service is now configured with `Type=notify-reload` and allows reloading configuration without process restart. PgBouncer configuration options were moved to the freeform type option under [`services.pgbouncer.settings`](#opt-services.pgbouncer.settings).

nixos/modules/hardware/coral.nix

@@ -0,0 +1,38 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+let
+  inherit (lib)
+    mkEnableOption
+    mkIf
+    mkMerge
+    ;
+
+  cfg = config.hardware.coral;
+in
+
+{
+  options.hardware.coral = {
+    usb.enable = mkEnableOption "Coral USB support";
+    pcie.enable = mkEnableOption "Coral PCIe support";
+  };
+
+  config = mkMerge [
+    (mkIf (cfg.usb.enable || cfg.pcie.enable) {
+      users.groups.coral = { };
+    })
+    (mkIf cfg.usb.enable {
+      services.udev.packages = with pkgs; [ libedgetpu ];
+    })
+    (mkIf cfg.pcie.enable {
+      boot.extraModulePackages = with config.boot.kernelPackages; [ gasket ];
+      services.udev.extraRules = ''
+        SUBSYSTEM=="apex",MODE="0660",GROUP="coral"
+      '';
+    })
+  ];
+}

nixos/modules/module-list.nix

@@ -52,6 +52,7 @@
   ./hardware/bladeRF.nix
   ./hardware/brillo.nix
   ./hardware/ckb-next.nix
+  ./hardware/coral.nix
   ./hardware/corectrl.nix
   ./hardware/cpu/amd-microcode.nix
   ./hardware/cpu/amd-sev.nix
@@ -1238,6 +1239,7 @@
   ./services/networking/sunshine.nix
   ./services/networking/supplicant.nix
   ./services/networking/supybot.nix
+  ./services/networking/suricata/default.nix
   ./services/networking/syncplay.nix
   ./services/networking/syncthing-relay.nix
   ./services/networking/syncthing.nix
@@ -1300,6 +1302,7 @@
   ./services/scheduling/atd.nix
   ./services/scheduling/cron.nix
   ./services/scheduling/fcron.nix
+  ./services/scheduling/scx.nix
   ./services/search/elasticsearch-curator.nix
   ./services/search/elasticsearch.nix
   ./services/search/hound.nix
@@ -1314,6 +1317,7 @@
   ./services/security/aesmd.nix
   ./services/security/authelia.nix
   ./services/security/bitwarden-directory-connector-cli.nix
+  ./services/security/canaille.nix
   ./services/security/certmgr.nix
   ./services/security/cfssl.nix
   ./services/security/clamav.nix
@@ -1490,6 +1494,7 @@
   ./services/web-apps/onlyoffice.nix
   ./services/web-apps/openvscode-server.nix
   ./services/web-apps/mediagoblin.nix
+  ./services/web-apps/open-web-calendar.nix
   ./services/web-apps/mobilizon.nix
   ./services/web-apps/openwebrx.nix
   ./services/web-apps/outline.nix
@@ -1502,6 +1507,7 @@
   ./services/web-apps/pingvin-share.nix
   ./services/web-apps/plantuml-server.nix
   ./services/web-apps/plausible.nix
+  ./services/web-apps/porn-vault/default.nix
   ./services/web-apps/powerdns-admin.nix
   ./services/web-apps/pretalx.nix
   ./services/web-apps/pretix.nix
@@ -1613,6 +1619,7 @@
   ./services/x11/xserver.nix
   ./system/activation/activatable-system.nix
   ./system/activation/activation-script.nix
+  ./system/activation/pre-switch-check.nix
   ./system/activation/specialisation.nix
   ./system/activation/switchable-system.nix
   ./system/activation/bootspec.nix

nixos/modules/services/databases/postgresql.md

@@ -290,11 +290,11 @@ postgresql_15.pkgs.pg_partman        postgresql_15.pkgs.pgroonga
 ...
 ```
 
-To add plugins via NixOS configuration, set `services.postgresql.extraPlugins`:
+To add plugins via NixOS configuration, set `services.postgresql.extensions`:
 ```nix
 {
   services.postgresql.package = pkgs.postgresql_17;
-  services.postgresql.extraPlugins = ps: with ps; [
+  services.postgresql.extensions = ps: with ps; [
     pg_repack
     postgis
   ];

nixos/modules/services/hardware/handheld-daemon.nix

@@ -11,6 +11,11 @@ in
     enable = mkEnableOption "Handheld Daemon";
     package = mkPackageOption pkgs "handheld-daemon" { };
 
+    ui = {
+      enable = mkEnableOption "Handheld Daemon UI";
+      package = mkPackageOption pkgs "handheld-daemon-ui" { };
+    };
+
     user = mkOption {
       type = types.str;
       description = ''
@@ -20,7 +25,10 @@ in
   };
 
   config = mkIf cfg.enable {
-    environment.systemPackages = [ cfg.package ];
+    services.handheld-daemon.ui.enable = mkDefault true;
+    environment.systemPackages = [
+      cfg.package
+    ] ++ lib.optional cfg.ui.enable cfg.ui.package;
     services.udev.packages = [ cfg.package ];
     systemd.packages = [ cfg.package ];
 
@@ -31,6 +39,11 @@ in
 
       restartIfChanged = true;
 
+      path = mkIf cfg.ui.enable [
+        cfg.ui.package
+        pkgs.lsof
+      ];
+
       serviceConfig = {
         ExecStart = "${ lib.getExe cfg.package } --user ${ cfg.user }";
         Nice = "-12";

nixos/modules/services/misc/etesync-dav.nix

@@ -20,7 +20,7 @@ in
 
       apiUrl = lib.mkOption {
         type = lib.types.str;
-        default = "https://api.etesync.com/";
+        default = "https://api.etebase.com/partner/etesync/";
         description = "The url to the etesync API.";
       };
 

nixos/modules/services/monitoring/mackerel-agent.nix

@@ -98,7 +98,7 @@ in {
         RuntimeDirectory = "mackerel-agent";
         StateDirectory = "mackerel-agent";
         ExecStart = "${pkgs.mackerel-agent}/bin/mackerel-agent supervise";
-        ExecStopPost = mkIf cfg.autoRetirement "${pkg.mackerel-agent}/bin/mackerel-agent retire -force";
+        ExecStopPost = mkIf cfg.autoRetirement "${pkgs.mackerel-agent}/bin/mackerel-agent retire -force";
         ExecReload = "${pkgs.coreutils}/bin/kill -HUP $MAINPID";
         LimitNOFILE = mkDefault 65536;
         LimitNPROC = mkDefault 65536;

nixos/modules/services/monitoring/prometheus/alertmanager.nix

@@ -51,6 +51,9 @@ in {
         default = null;
         description = ''
           Alertmanager configuration as nix attribute set.
+
+          The contents of the resulting config file are processed using envsubst.
+          `$` needs to be escaped as `$$` to be preserved.
         '';
       };
 
@@ -62,6 +65,9 @@ in {
           defines the text that is written to alertmanager.yml. If null, the
           contents of alertmanager.yml is generated from the structured config
           options.
+
+          The contents of the resulting config file are processed using envsubst.
+          `$` needs to be escaped as `$$` to be preserved.
         '';
       };
 

nixos/modules/services/networking/suricata/settings.nix

@@ -31,21 +31,96 @@ in
               type = (
                 types.submodule {
                   options = {
-                    HOME_NET = mkOption { default = "[192.168.0.0/16,10.0.0.0/8,172.16.0.0/12]"; };
-                    EXTERNAL_NET = mkOption { default = "!$HOME_NET"; };
-                    HTTP_SERVERS = mkOption { default = "$HOME_NET"; };
-                    SMTP_SERVERS = mkOption { default = "$HOME_NET"; };
-                    SQL_SERVERS = mkOption { default = "$HOME_NET"; };
-                    DNS_SERVERS = mkOption { default = "$HOME_NET"; };
-                    TELNET_SERVERS = mkOption { default = "$HOME_NET"; };
-                    AIM_SERVERS = mkOption { default = "$EXTERNAL_NET"; };
-                    DC_SERVERS = mkOption { default = "$HOME_NET"; };
-                    DNP3_SERVER = mkOption { default = "$HOME_NET"; };
-                    DNP3_CLIENT = mkOption { default = "$HOME_NET"; };
-                    MODBUS_CLIENT = mkOption { default = "$HOME_NET"; };
-                    MODBUS_SERVER = mkOption { default = "$HOME_NET"; };
-                    ENIP_CLIENT = mkOption { default = "$HOME_NET"; };
-                    ENIP_SERVER = mkOption { default = "$HOME_NET"; };
+                    HOME_NET = mkOption {
+                      default = "[192.168.0.0/16,10.0.0.0/8,172.16.0.0/12]";
+                      description = ''
+                        HOME_NET variable.
+                      '';
+                    };
+                    EXTERNAL_NET = mkOption {
+                      default = "!$HOME_NET";
+                      description = ''
+                        EXTERNAL_NET variable.
+                      '';
+                    };
+                    HTTP_SERVERS = mkOption {
+                      default = "$HOME_NET";
+                      description = ''
+                        HTTP_SERVERS variable.
+                      '';
+                    };
+                    SMTP_SERVERS = mkOption {
+                      default = "$HOME_NET";
+                      description = ''
+                        SMTP_SERVERS variable.
+                      '';
+                    };
+                    SQL_SERVERS = mkOption {
+                      default = "$HOME_NET";
+                      description = ''
+                        SQL_SERVERS variable.
+                      '';
+                    };
+                    DNS_SERVERS = mkOption {
+                      default = "$HOME_NET";
+                      description = ''
+                        DNS_SERVERS variable.
+                      '';
+                    };
+                    TELNET_SERVERS = mkOption {
+                      default = "$HOME_NET";
+                      description = ''
+                        TELNET_SERVERS variable.
+                      '';
+                    };
+                    AIM_SERVERS = mkOption {
+                      default = "$EXTERNAL_NET";
+                      description = ''
+                        AIM_SERVERS variable.
+                      '';
+                    };
+                    DC_SERVERS = mkOption {
+                      default = "$HOME_NET";
+                      description = ''
+                        DC_SERVERS variable.
+                      '';
+                    };
+                    DNP3_SERVER = mkOption {
+                      default = "$HOME_NET";
+                      description = ''
+                        DNP3_SERVER variable.
+                      '';
+                    };
+                    DNP3_CLIENT = mkOption {
+                      default = "$HOME_NET";
+                      description = ''
+                        DNP3_CLIENT variable.
+                      '';
+                    };
+                    MODBUS_CLIENT = mkOption {
+                      default = "$HOME_NET";
+                      description = ''
+                        MODBUS_CLIENT variable
+                      '';
+                    };
+                    MODBUS_SERVER = mkOption {
+                      default = "$HOME_NET";
+                      description = ''
+                        MODBUS_SERVER variable.
+                      '';
+                    };
+                    ENIP_CLIENT = mkOption {
+                      default = "$HOME_NET";
+                      description = ''
+                        ENIP_CLIENT variable.
+                      '';
+                    };
+                    ENIP_SERVER = mkOption {
+                      default = "$HOME_NET";
+                      description = ''
+                        ENIP_SERVER variable.
+                      '';
+                    };
                   };
                 }
               );
@@ -97,6 +172,9 @@ in
         }
       );
       default = { }; # add default values to config
+      description = ''
+        Variables to be used within the suricata rules.
+      '';
     };
 
     stats = mkOption {
@@ -142,13 +220,16 @@ in
           };
         });
       default = null; # do not add to config unless specified
+      description = ''
+        Engine statistics such as packet counters, memory use counters and others can be logged in several ways. A separate text log 'stats.log' and an EVE record type 'stats' are enabled by default.
+      '';
     };
 
     plugins = mkOption {
       type = with types; nullOr (listOf path);
       default = null;
       description = ''
-        Plugins -- Experimental -- specify the filename for each plugin shared object
+        Plugins -- Experimental -- specify the filename for each plugin shared object.
       '';
     };
 
@@ -282,7 +363,7 @@ in
             ];
             default = "info";
             description = ''
-              Loglevel for logs written to the logfile
+              Loglevel for logs written to the logfile.
             '';
           };
 
@@ -290,7 +371,7 @@ in
             type = types.str;
             default = "suricata.log";
             description = ''
-              Filename of the logfile
+              Filename of the logfile.
             '';
           };
 
@@ -298,7 +379,7 @@ in
             type = types.nullOr types.str;
             default = null;
             description = ''
-              Logformat for logs written to the logfile
+              Logformat for logs written to the logfile.
             '';
           };
 
@@ -306,7 +387,7 @@ in
             type = types.nullOr types.str;
             default = null;
             description = ''
-              Type of logfile
+              Type of logfile.
             '';
           };
         };
@@ -317,7 +398,7 @@ in
             type = types.str;
             default = "local5";
             description = ''
-              Facility to log to
+              Facility to log to.
             '';
           };
 
@@ -325,7 +406,7 @@ in
             type = types.nullOr types.str;
             default = null;
             description = ''
-              Logformat for logs send to syslog
+              Logformat for logs send to syslog.
             '';
           };
 
@@ -333,7 +414,7 @@ in
             type = types.nullOr types.str;
             default = null;
             description = ''
-              Type of logs send to syslog
+              Type of logs send to syslog.
             '';
           };
         };
@@ -350,13 +431,16 @@ in
               interface = mkOption {
                 type = types.str;
                 default = null;
+                description = ''
+                  af-packet capture interface, see [upstream docs reagrding tuning](https://docs.suricata.io/en/latest/performance/tuning-considerations.html#af-packet).
+                '';
               };
             };
           })
         );
       default = null;
       description = ''
-        Linux high speed capture support
+        Linux high speed capture support.
       '';
     };
 
@@ -370,6 +454,9 @@ in
               interface = mkOption {
                 type = types.str;
                 default = null;
+                description = ''
+                  af-xdp capture interface, see [upstream docs](https://docs.suricata.io/en/latest/capture-hardware/af-xdp.html).
+                '';
               };
             };
           })
@@ -377,7 +464,7 @@ in
       default = null;
       description = ''
         Linux high speed af-xdp capture support, see
-        [docs/capture-hardware/af-xdp](https://docs.suricata.io/en/suricata-7.0.3/capture-hardware/af-xdp.html)
+        [docs/capture-hardware/af-xdp](https://docs.suricata.io/en/suricata-7.0.3/capture-hardware/af-xdp.html).
       '';
     };
 
@@ -389,6 +476,9 @@ in
             eal-params.proc-type = mkOption {
               type = with types; nullOr str;
               default = null;
+              description = ''
+                dpdk eal-params.proc-type, see [data plane development kit docs](https://doc.dpdk.org/guides/linux_gsg/linux_eal_parameters.html#multiprocessing-related-options).
+              '';
             };
             interfaces = mkOption {
               type =
@@ -400,18 +490,26 @@ in
                       interface = mkOption {
                         type = types.str;
                         default = null;
+                        description = ''
+                          See upstream docs: [docs/capture-hardware/dpdk](https://docs.suricata.io/en/suricata-7.0.7/capture-hardware/dpdk.html) and [docs/configuration/suricata-yaml.html#data-plane-development-kit-dpdk](https://docs.suricata.io/en/suricata-7.0.7/configuration/suricata-yaml.html#data-plane-development-kit-dpdk).
+                        '';
                       };
                     };
                   })
                 );
               default = null;
+              description = ''
+                See upstream docs: [docs/capture-hardware/dpdk](https://docs.suricata.io/en/suricata-7.0.7/capture-hardware/dpdk.html) and [docs/configuration/suricata-yaml.html#data-plane-development-kit-dpdk](https://docs.suricata.io/en/suricata-7.0.7/configuration/suricata-yaml.html#data-plane-development-kit-dpdk).
+              '';
             };
           };
         });
       default = null;
       description = ''
-        DPDK capture support, see
-        [docs/capture-hardware/dpdk](https://docs.suricata.io/en/suricata-7.0.3/capture-hardware/dpdk.html)
+        Data Plane Development Kit is a framework for fast packet processing in data plane applications running on a wide variety of CPU architectures. DPDK's Environment Abstraction Layer (EAL) provides a generic interface to low-level resources. It is a unique way how DPDK libraries access NICs. EAL creates an API for an application to access NIC resources from the userspace level. In DPDK, packets are not retrieved via interrupt handling. Instead, the application polls the NIC for newly received packets.
+
+        DPDK allows the user space application to directly access memory where the NIC stores the packets. As a result, neither DPDK nor the application copies the packets for the inspection. The application directly processes packets via passed packet descriptors.
+        See [docs/capture-hardware/dpdk](https://docs.suricata.io/en/suricata-7.0.7/capture-hardware/dpdk.html) and [docs/configuration/suricata-yaml.html#data-plane-development-kit-dpdk](https://docs.suricata.io/en/suricata-7.0.7/configuration/suricata-yaml.html#data-plane-development-kit-dpdk).
       '';
     };
 
@@ -425,13 +523,16 @@ in
               interface = mkOption {
                 type = types.str;
                 default = null;
+                description = ''
+                  pcap capture interface, see [upstream docs](https://docs.suricata.io/en/latest/manpages/suricata.html).
+                '';
               };
             };
           })
         );
       default = null;
       description = ''
-        Cross platform libpcap capture support
+        Cross platform libpcap capture support.
       '';
     };
 
@@ -448,7 +549,7 @@ in
         - no: checksum validation is disabled
         - auto: Suricata uses a statistical approach to detect when
         checksum off-loading is used. (default)
-        Warning: 'checksum-validation' must be set to yes to have checksum tested
+        Warning: 'checksum-validation' must be set to yes to have checksum tested.
       '';
     };
 
@@ -498,22 +599,28 @@ in
                   })
                 );
               default = null;
+              description = ''
+                app-layer protocols, see [upstream docs](https://docs.suricata.io/en/latest/rules/app-layer.html).
+              '';
             };
           };
         });
       default = null; # do not add to config unless specified
+      description = ''
+        app-layer configuration, see [upstream docs](https://docs.suricata.io/en/latest/rules/app-layer.html).
+      '';
     };
 
     "run-as" = {
       user = mkOption {
         type = types.str;
         default = "suricata";
-        description = "Run Suricata with a specific user-id";
+        description = "Run Suricata with a specific user-id.";
       };
       group = mkOption {
         type = types.str;
         default = "suricata";
-        description = "Run Suricata with a specific group-id";
+        description = "Run Suricata with a specific group-id.";
       };
     };
 
@@ -540,10 +647,16 @@ in
             enabled = mkOption {
               type = types.either types.bool (types.enum [ "auto" ]);
               default = "auto";
+              description = ''
+                Enable unix-command socket.
+              '';
             };
             filename = mkOption {
               type = types.path;
               default = "/run/suricata/suricata-command.socket";
+              description = ''
+                Filename for unix-command socket.
+              '';
             };
           };
         });
@@ -585,31 +698,33 @@ in
     "default-rule-path" = mkOption {
       type = types.path;
       default = "/var/lib/suricata/rules";
-      description = "Path in which suricata-update managed rules are stored by default";
+      description = "Path in which suricata-update managed rules are stored by default.";
     };
 
     "rule-files" = mkOption {
       type = types.listOf types.str;
       default = [ "suricata.rules" ];
-      description = "Files to load suricata-update managed rules, relative to 'default-rule-path'";
+      description = "Files to load suricata-update managed rules, relative to 'default-rule-path'.";
     };
 
     "classification-file" = mkOption {
       type = types.str;
       default = "/var/lib/suricata/rules/classification.config";
-      description = "Suricata classification configuration file";
+      description = "Suricata classification configuration file.";
     };
 
     "reference-config-file" = mkOption {
       type = types.str;
       default = "${cfg.package}/etc/suricata/reference.config";
-      description = "Suricata reference configuration file";
+      defaultText = "\${config.services.suricata.package}/etc/suricata/reference.config";
+      description = "Suricata reference configuration file.";
     };
 
     "threshold-file" = mkOption {
       type = types.str;
       default = "${cfg.package}/etc/suricata/threshold.config";
-      description = "Suricata threshold configuration file";
+      defaultText = "\${config.services.suricata.package}/etc/suricata/threshold.config";
+      description = "Suricata threshold configuration file.";
     };
 
     includes = mkOption {

nixos/modules/services/scheduling/scx.nix

@@ -0,0 +1,110 @@
+{
+  lib,
+  pkgs,
+  config,
+  ...
+}:
+let
+  cfg = config.services.scx;
+in
+{
+  options.services.scx = {
+    enable = lib.mkEnableOption null // {
+      description = ''
+        Whether to enable SCX service, a daemon to run schedulers from userspace.
+
+        ::: {.note}
+        This service requires a kernel with the Sched-ext feature.
+        Generally, kernel version 6.12 and later are supported.
+        :::
+      '';
+    };
+
+    package = lib.mkOption {
+      type = lib.types.package;
+      default = pkgs.scx.full;
+      defaultText = lib.literalExpression "pkgs.scx.full";
+      example = lib.literalExpression "pkgs.scx.rustscheds";
+      description = ''
+        `scx` package to use. `scx.full`, which includes all schedulers, is the default.
+        You may choose a minimal package, such as `pkgs.scx.rustscheds`.
+
+        ::: {.note}
+        Overriding this does not change the default scheduler; you should set `services.scx.scheduler` for it.
+        :::
+      '';
+    };
+
+    scheduler = lib.mkOption {
+      type = lib.types.enum [
+        "scx_bpfland"
+        "scx_central"
+        "scx_flatcg"
+        "scx_lavd"
+        "scx_layered"
+        "scx_nest"
+        "scx_pair"
+        "scx_qmap"
+        "scx_rlfifo"
+        "scx_rustland"
+        "scx_rusty"
+        "scx_simple"
+        "scx_userland"
+      ];
+      default = "scx_rustland";
+      example = "scx_bpfland";
+      description = ''
+        Which scheduler to use. See [SCX documentation](https://github.com/sched-ext/scx/tree/main/scheds)
+        for details on each scheduler and guidance on selecting the most suitable one.
+      '';
+    };
+
+    extraArgs = lib.mkOption {
+      type = lib.types.listOf lib.types.singleLineStr;
+      example = [
+        "--slice-us 5000"
+        "--verbose"
+      ];
+      description = ''
+        Parameters passed to the chosen scheduler at runtime.
+
+        ::: {.note}
+        Run `chosen-scx-scheduler --help` to see the available options. Generally,
+        each scheduler has its own set of options, and they are incompatible with each other.
+        :::
+      '';
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    environment.systemPackages = [ cfg.package ];
+
+    systemd.services.scx = {
+      description = "SCX scheduler daemon";
+
+      # SCX service should be started only if the kernel supports sched-ext
+      unitConfig.ConditionPathIsDirectory = "/sys/kernel/sched_ext";
+
+      startLimitIntervalSec = 30;
+      startLimitBurst = 2;
+
+      serviceConfig = {
+        Type = "simple";
+        ExecStart = "${lib.getExe' cfg.package cfg.scheduler} ${lib.concatStringsSep " " cfg.extraArgs}";
+        Restart = "on-failure";
+        StandardError = "journal";
+      };
+
+      wantedBy = [ "multi-user.target" ];
+    };
+
+    assertions = [
+      {
+        assertion = lib.versionAtLeast config.boot.kernelPackages.kernel.version "6.12";
+        message = "SCX is only supported on kernel version >= 6.12.";
+      }
+    ];
+  };
+
+  meta.maintainers = with lib.maintainers; [ johnrtitor ];
+}

nixos/modules/services/search/meilisearch.nix

@@ -112,7 +112,7 @@ in
       environment = {
         MEILI_DB_PATH = "/var/lib/meilisearch";
         MEILI_HTTP_ADDR = "${cfg.listenAddress}:${toString cfg.listenPort}";
-        MEILI_NO_ANALYTICS = toString cfg.noAnalytics;
+        MEILI_NO_ANALYTICS = boolToString cfg.noAnalytics;
         MEILI_ENV = cfg.environment;
         MEILI_DUMP_DIR = "/var/lib/meilisearch/dumps";
         MEILI_LOG_LEVEL = cfg.logLevel;

nixos/modules/services/security/canaille.nix

@@ -0,0 +1,390 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+let
+  cfg = config.services.canaille;
+
+  inherit (lib)
+    mkOption
+    mkIf
+    mkEnableOption
+    mkPackageOption
+    types
+    getExe
+    optional
+    converge
+    filterAttrsRecursive
+    ;
+
+  dataDir = "/var/lib/canaille";
+  secretsDir = "${dataDir}/secrets";
+
+  settingsFormat = pkgs.formats.toml { };
+
+  # Remove null values, so we can document optional/forbidden values that don't end up in the generated TOML file.
+  filterConfig = converge (filterAttrsRecursive (_: v: v != null));
+
+  finalPackage = cfg.package.overridePythonAttrs (old: {
+    dependencies =
+      old.dependencies
+      ++ old.optional-dependencies.front
+      ++ old.optional-dependencies.oidc
+      ++ old.optional-dependencies.ldap
+      ++ old.optional-dependencies.sentry
+      ++ old.optional-dependencies.postgresql;
+    makeWrapperArgs = (old.makeWrapperArgs or [ ]) ++ [
+      "--set CONFIG /etc/canaille/config.toml"
+      "--set SECRETS_DIR \"${secretsDir}\""
+    ];
+  });
+  inherit (finalPackage) python;
+  pythonEnv = python.buildEnv.override {
+    extraLibs = with python.pkgs; [
+      (toPythonModule finalPackage)
+      celery
+    ];
+  };
+
+  commonServiceConfig = {
+    WorkingDirectory = dataDir;
+    User = "canaille";
+    Group = "canaille";
+    StateDirectory = "canaille";
+    StateDirectoryMode = "0750";
+    PrivateTmp = true;
+  };
+
+  postgresqlHost = "postgresql://localhost/canaille?host=/run/postgresql";
+  createLocalPostgresqlDb = cfg.settings.CANAILLE_SQL.DATABASE_URI == postgresqlHost;
+in
+{
+
+  options.services.canaille = {
+    enable = mkEnableOption "Canaille";
+    package = mkPackageOption pkgs "canaille" { };
+    secretKeyFile = mkOption {
+      description = ''
+        File containing the Flask secret key. Its content is going to be
+        provided to Canaille as `SECRET_KEY`. Make sure it has appropriate
+        permissions. For example, copy the output of this to the specified
+        file:
+
+        ```
+        python3 -c 'import secrets; print(secrets.token_hex())'
+        ```
+      '';
+      type = types.path;
+    };
+    smtpPasswordFile = mkOption {
+      description = ''
+        File containing the SMTP password. Make sure it has appropriate permissions.
+      '';
+      default = null;
+      type = types.nullOr types.path;
+    };
+    jwtPrivateKeyFile = mkOption {
+      description = ''
+        File containing the JWT private key. Make sure it has appropriate permissions.
+
+        You can generate one using
+        ```
+        openssl genrsa -out private.pem 4096
+        openssl rsa -in private.pem -pubout -outform PEM -out public.pem
+        ```
+      '';
+      default = null;
+      type = types.nullOr types.path;
+    };
+    ldapBindPasswordFile = mkOption {
+      description = ''
+        File containing the LDAP bind password.
+      '';
+      default = null;
+      type = types.nullOr types.path;
+    };
+    settings = mkOption {
+      default = { };
+      description = "Settings for Canaille. See [the documentation](https://canaille.readthedocs.io/en/latest/references/configuration.html) for details.";
+      type = types.submodule {
+        freeformType = settingsFormat.type;
+        options = {
+          SECRET_KEY = mkOption {
+            readOnly = true;
+            description = ''
+              Flask Secret Key. Can't be set and must be provided through
+              `services.canaille.settings.secretKeyFile`.
+            '';
+            default = null;
+            type = types.nullOr types.str;
+          };
+          SERVER_NAME = mkOption {
+            description = "The domain name on which canaille will be served.";
+            example = "auth.example.org";
+            type = types.str;
+          };
+          PREFERRED_URL_SCHEME = mkOption {
+            description = "The url scheme by which canaille will be served.";
+            default = "https";
+            type = types.enum [
+              "http"
+              "https"
+            ];
+          };
+
+          CANAILLE = {
+            ACL = mkOption {
+              default = null;
+              description = ''
+                Access Control Lists.
+
+                See also [the documentation](https://canaille.readthedocs.io/en/latest/references/configuration.html#canaille.core.configuration.ACLSettings).
+              '';
+              type = types.nullOr (
+                types.submodule {
+                  freeformType = settingsFormat.type;
+                  options = { };
+                }
+              );
+            };
+            SMTP = mkOption {
+              default = null;
+              example = { };
+              description = ''
+                SMTP configuration. By default, sending emails is not enabled.
+
+                Set to an empty attrs to send emails from localhost without
+                authentication.
+
+                See also [the documentation](https://canaille.readthedocs.io/en/latest/references/configuration.html#canaille.core.configuration.SMTPSettings).
+              '';
+              type = types.nullOr (
+                types.submodule {
+                  freeformType = settingsFormat.type;
+                  options = {
+                    PASSWORD = mkOption {
+                      readOnly = true;
+                      description = ''
+                        SMTP Password. Can't be set and has to be provided using
+                        `services.canaille.smtpPasswordFile`.
+                      '';
+                      default = null;
+                      type = types.nullOr types.str;
+                    };
+                  };
+                }
+              );
+            };
+
+          };
+          CANAILLE_OIDC = mkOption {
+            default = null;
+            description = ''
+              OpenID Connect settings. See [the documentation](https://canaille.readthedocs.io/en/latest/references/configuration.html#canaille.oidc.configuration.OIDCSettings).
+            '';
+            type = types.nullOr (
+              types.submodule {
+                freeformType = settingsFormat.type;
+                options = {
+                  JWT.PRIVATE_KEY = mkOption {
+                    readOnly = true;
+                    description = ''
+                      JWT private key. Can't be set and has to be provided using
+                      `services.canaille.jwtPrivateKeyFile`.
+                    '';
+                    default = null;
+                    type = types.nullOr types.str;
+                  };
+                };
+              }
+            );
+          };
+          CANAILLE_LDAP = mkOption {
+            default = null;
+            description = ''
+              Configuration for the LDAP backend. This storage backend is not
+              yet supported by the module, so use at your own risk!
+            '';
+            type = types.nullOr (
+              types.submodule {
+                freeformType = settingsFormat.type;
+                options = {
+                  BIND_PW = mkOption {
+                    readOnly = true;
+                    description = ''
+                      The LDAP bind password. Can't be set and has to be provided using
+                      `services.canaille.ldapBindPasswordFile`.
+                    '';
+                    default = null;
+                    type = types.nullOr types.str;
+                  };
+                };
+              }
+            );
+          };
+          CANAILLE_SQL = {
+            DATABASE_URI = mkOption {
+              description = ''
+                The SQL server URI. Will configure a local PostgreSQL db if
+                left to default. Please note that the NixOS module only really
+                supports PostgreSQL for now. Change at your own risk!
+              '';
+              default = postgresqlHost;
+              type = types.str;
+            };
+          };
+        };
+      };
+    };
+  };
+
+  config = mkIf cfg.enable {
+    # We can use some kind of fix point for the config anyways, and
+    # /etc/canaille is recommended by upstream. The alternative would be to use
+    # a double wrapped canaille executable, to avoid having to rebuild Canaille
+    # on every config change.
+    environment.etc."canaille/config.toml" = {
+      source = settingsFormat.generate "config.toml" (filterConfig cfg.settings);
+      user = "canaille";
+      group = "canaille";
+    };
+
+    # Secrets management is unfortunately done in a semi stateful way, due to these constraints:
+    # - Canaille uses Pydantic, which currently only accepts an env file or a single
+    #   directory (SECRETS_DIR) for loading settings from files.
+    # - The canaille user needs access to secrets, as it needs to run the CLI
+    #   for e.g. user creation. Therefore specifying the SECRETS_DIR as systemd's
+    #   CREDENTIALS_DIRECTORY is not an option.
+    #
+    # See this for how Pydantic maps file names/env vars to config settings:
+    # https://docs.pydantic.dev/latest/concepts/pydantic_settings/#parsing-environment-variable-values
+    systemd.tmpfiles.rules =
+      [
+        "Z  ${secretsDir} 700 canaille canaille - -"
+        "L+ ${secretsDir}/SECRET_KEY - - - - ${cfg.secretKeyFile}"
+      ]
+      ++ optional (
+        cfg.smtpPasswordFile != null
+      ) "L+ ${secretsDir}/CANAILLE_SMTP__PASSWORD - - - - ${cfg.smtpPasswordFile}"
+      ++ optional (
+        cfg.jwtPrivateKeyFile != null
+      ) "L+ ${secretsDir}/CANAILLE_OIDC__JWT__PRIVATE_KEY - - - - ${cfg.jwtPrivateKeyFile}"
+      ++ optional (
+        cfg.ldapBindPasswordFile != null
+      ) "L+ ${secretsDir}/CANAILLE_LDAP__BIND_PW - - - - ${cfg.ldapBindPasswordFile}";
+
+    # This is not a migration, just an initial setup of schemas
+    systemd.services.canaille-install = {
+      # We want this on boot, not on socket activation
+      wantedBy = [ "multi-user.target" ];
+      after = optional createLocalPostgresqlDb "postgresql.service";
+      serviceConfig = commonServiceConfig // {
+        Type = "oneshot";
+        ExecStart = "${getExe finalPackage} install";
+      };
+    };
+
+    systemd.services.canaille = {
+      description = "Canaille";
+      documentation = [ "https://canaille.readthedocs.io/en/latest/tutorial/deployment.html" ];
+      after = [
+        "network.target"
+        "canaille-install.service"
+      ] ++ optional createLocalPostgresqlDb "postgresql.service";
+      requires = [
+        "canaille-install.service"
+        "canaille.socket"
+      ];
+      environment = {
+        PYTHONPATH = "${pythonEnv}/${python.sitePackages}/";
+        CONFIG = "/etc/canaille/config.toml";
+        SECRETS_DIR = secretsDir;
+      };
+      serviceConfig = commonServiceConfig // {
+        Restart = "on-failure";
+        ExecStart =
+          let
+            gunicorn = python.pkgs.gunicorn.overridePythonAttrs (old: {
+              # Allows Gunicorn to set a meaningful process name
+              dependencies = (old.dependencies or [ ]) ++ old.optional-dependencies.setproctitle;
+            });
+          in
+          ''
+            ${getExe gunicorn} \
+              --name=canaille \
+              --bind='unix:///run/canaille.socket' \
+              'canaille:create_app()'
+          '';
+      };
+      restartTriggers = [ "/etc/canaille/config.toml" ];
+    };
+
+    systemd.sockets.canaille = {
+      before = [ "nginx.service" ];
+      wantedBy = [ "sockets.target" ];
+      socketConfig = {
+        ListenStream = "/run/canaille.socket";
+        SocketUser = "canaille";
+        SocketGroup = "canaille";
+        SocketMode = "770";
+      };
+    };
+
+    services.nginx.enable = true;
+    services.nginx.recommendedGzipSettings = true;
+    services.nginx.recommendedProxySettings = true;
+    services.nginx.virtualHosts."${cfg.settings.SERVER_NAME}" = {
+      forceSSL = true;
+      enableACME = true;
+      # Config from https://canaille.readthedocs.io/en/latest/tutorial/deployment.html#nginx
+      extraConfig = ''
+        charset utf-8;
+        client_max_body_size 10M;
+
+        add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;
+        add_header X-Frame-Options                      "SAMEORIGIN"    always;
+        add_header X-XSS-Protection                     "1; mode=block" always;
+        add_header X-Content-Type-Options               "nosniff"       always;
+        add_header Referrer-Policy                      "same-origin"   always;
+      '';
+      locations = {
+        "/".proxyPass = "http://unix:///run/canaille.socket";
+        "/static" = {
+          root = "${finalPackage}/${python.sitePackages}/canaille";
+        };
+        "~* ^/static/.+\\.(?:css|cur|js|jpe?g|gif|htc|ico|png|html|xml|otf|ttf|eot|woff|woff2|svg)$" = {
+          root = "${finalPackage}/${python.sitePackages}/canaille";
+          extraConfig = ''
+            access_log off;
+            expires 30d;
+            more_set_headers Cache-Control public;
+          '';
+        };
+      };
+    };
+
+    services.postgresql = mkIf createLocalPostgresqlDb {
+      enable = true;
+      ensureUsers = [
+        {
+          name = "canaille";
+          ensureDBOwnership = true;
+        }
+      ];
+      ensureDatabases = [ "canaille" ];
+    };
+
+    users.users.canaille = {
+      isSystemUser = true;
+      group = "canaille";
+      packages = [ finalPackage ];
+    };
+
+    users.groups.canaille.members = [ config.services.nginx.user ];
+  };
+
+  meta.maintainers = with lib.maintainers; [ erictapen ];
+}

nixos/modules/services/video/frigate.nix

@@ -6,19 +6,28 @@
 
 let
   inherit (lib)
-    literalExpression
+    any
+    attrValues
+    converge
+    elem
+    filterAttrsRecursive
+    hasPrefix
+    makeLibraryPath
+    match
     mkDefault
     mkEnableOption
     mkPackageOption
     mkIf
     mkOption
+    optionalAttrs
+    optionals
     types;
 
   cfg = config.services.frigate;
 
   format = pkgs.formats.yaml { };
 
-  filteredConfig = lib.converge (lib.filterAttrsRecursive (_: v: ! lib.elem v [ null ])) cfg.settings;
+  filteredConfig = converge (filterAttrsRecursive (_: v: ! elem v [ null ])) cfg.settings;
 
   cameraFormat = with types; submodule {
     freeformType = format.type;
@@ -94,6 +103,15 @@ let
     proxy_connect_timeout 360;
   '';
 
+  # Discover configured detectors for acceleration support
+  detectors = attrValues cfg.settings.detectors or {};
+  withCoralUSB = any (d: d.type == "edgetpu" && hasPrefix "usb" d.device or "") detectors;
+  withCoralPCI =  any (d: d.type == "edgetpu" && hasPrefix "pci" d.device or "") detectors;
+  withCoral = withCoralPCI || withCoralUSB;
+
+  # Provide ffmpeg-full for NVIDIA hardware acceleration
+  ffmpegArgs = cfg.settings.ffmpeg.hwaccel_args or "";
+  ffmpeg' = if match "/nvidia/" ffmpegArgs != null then pkgs.ffmpeg-full else pkgs.ffmpeg-headless;
 in
 
 {
@@ -114,6 +132,27 @@ in
       '';
     };
 
+    vaapiDriver = mkOption {
+      type = nullOr (enum [ "i965" "iHD" "nouveau" "vdpau" "nvidia" "radeonsi" ]);
+      default = null;
+      example = "radeonsi";
+      description = ''
+        Force usage of a particular VA-API driver for video acceleration. Use together with `settings.ffmpeg.hwaccel_args`.
+
+        Setting this *is not required* for VA-API to work, but it can help steer VA-API towards the correct card if you have multiple.
+
+        :::{.note}
+        For VA-API to work you must enable {option}`hardware.graphics.enable` (sufficient for AMDGPU) and pass for example
+        `pkgs.intel-media-driver` (required for Intel 5th Gen. and newer) into {option}`hardware.graphics.extraPackages`.
+        :::
+
+        See also:
+
+        - https://docs.frigate.video/configuration/hardware_acceleration
+        - https://docs.frigate.video/configuration/ffmpeg_presets#hwaccel-presets
+      '';
+    };
+
     settings = mkOption {
       type = submodule {
         freeformType = format.type;
@@ -171,7 +210,6 @@ in
         set-misc
         vod
       ];
-      recommendedProxySettings = mkDefault true;
       recommendedGzipSettings = mkDefault true;
       mapHashBucketSize = mkDefault 128;
       upstreams = {
@@ -202,6 +240,7 @@ in
           # auth_location.conf
           "/auth" = {
             proxyPass = "http://frigate-api/auth";
+            recommendedProxySettings = true;
             extraConfig = ''
               internal;
 
@@ -306,11 +345,13 @@ in
           };
           "/ws" = {
             proxyPass = "http://frigate-mqtt-ws/";
+            recommendedProxySettings = true;
             proxyWebsockets = true;
             extraConfig = nginxAuthRequest + nginxProxySettings;
           };
           "/live/jsmpeg" = {
             proxyPass = "http://frigate-jsmpeg/";
+            recommendedProxySettings = true;
             proxyWebsockets = true;
             extraConfig = nginxAuthRequest + nginxProxySettings;
           };
@@ -318,6 +359,7 @@ in
           "/live/mse/api/ws" = {
             proxyPass = "http://frigate-go2rtc/api/ws";
             proxyWebsockets = true;
+            recommendedProxySettings = true;
             extraConfig = nginxAuthRequest + nginxProxySettings + ''
               limit_except GET {
                   deny  all;
@@ -327,6 +369,7 @@ in
           "/live/webrtc/api/ws" = {
             proxyPass = "http://frigate-go2rtc/api/ws";
             proxyWebsockets = true;
+            recommendedProxySettings = true;
             extraConfig = nginxAuthRequest + nginxProxySettings + ''
               limit_except GET {
                   deny  all;
@@ -336,6 +379,7 @@ in
           # pass through go2rtc player
           "/live/webrtc/webrtc.html" = {
             proxyPass = "http://frigate-go2rtc/webrtc.html";
+            recommendedProxySettings = true;
             extraConfig = nginxAuthRequest + nginxProxySettings + ''
               limit_except GET {
                   deny  all;
@@ -345,6 +389,7 @@ in
           # frontend uses this to fetch the version
           "/api/go2rtc/api" = {
             proxyPass = "http://frigate-go2rtc/api";
+            recommendedProxySettings = true;
             extraConfig = nginxAuthRequest + nginxProxySettings + ''
               limit_except GET {
                   deny  all;
@@ -355,6 +400,7 @@ in
           "/api/go2rtc/webrtc" = {
             proxyPass = "http://frigate-go2rtc/api/webrtc";
             proxyWebsockets = true;
+            recommendedProxySettings = true;
             extraConfig = nginxAuthRequest + nginxProxySettings + ''
               limit_except GET {
                   deny  all;
@@ -363,12 +409,14 @@ in
           };
           "~* /api/.*\.(jpg|jpeg|png|webp|gif)$" = {
             proxyPass = "http://frigate-api";
+            recommendedProxySettings = true;
             extraConfig = nginxAuthRequest + nginxProxySettings + ''
               rewrite ^/api/(.*)$ $1 break;
             '';
           };
           "/api/" = {
             proxyPass = "http://frigate-api/";
+            recommendedProxySettings = true;
             extraConfig = nginxAuthRequest + nginxProxySettings + ''
               add_header Cache-Control "no-store";
               expires off;
@@ -492,6 +540,11 @@ in
       "frigate"
     ];
 
+    hardware.coral = {
+      usb.enable = mkDefault withCoralUSB;
+      pcie.enable = mkDefault withCoralPCI;
+    };
+
     users.users.frigate = {
       isSystemUser = true;
       group = "frigate";
@@ -510,26 +563,35 @@ in
         CONFIG_FILE = format.generate "frigate.yml" filteredConfig;
         HOME = "/var/lib/frigate";
         PYTHONPATH = cfg.package.pythonPath;
+      } // optionalAttrs (cfg.vaapiDriver != null) {
+        LIBVA_DRIVER_NAME = cfg.vaapiDriver;
+      } // optionalAttrs withCoral {
+        LD_LIBRARY_PATH = makeLibraryPath (with pkgs; [ libedgetpu ]);
       };
       path = with pkgs; [
         # unfree:
         # config.boot.kernelPackages.nvidiaPackages.latest.bin
-        ffmpeg-headless
+        ffmpeg'
         libva-utils
         procps
         radeontop
-      ] ++ lib.optionals (!stdenv.hostPlatform.isAarch64) [
+      ] ++ optionals (!stdenv.hostPlatform.isAarch64) [
         # not available on aarch64-linux
         intel-gpu-tools
       ];
       serviceConfig = {
-        ExecStartPre = "-rm /var/cache/frigate/*.mp4";
+        ExecStartPre = pkgs.writeShellScript "frigate-clear-cache" ''
+          rm --recursive --force /var/cache/frigate/*
+        '';
         ExecStart = "${cfg.package.python.interpreter} -m frigate";
         Restart = "on-failure";
         SyslogIdentifier = "frigate";
 
         User = "frigate";
         Group = "frigate";
+        SupplementaryGroups = [ "render" ] ++ optionals withCoral [ "coral" ];
+
+        AmbientCapabilities = optionals (elem cfg.vaapiDriver [ "i965" "iHD" ]) [ "CAP_PERFMON" ]; # for intel_gpu_top
 
         UMask = "0027";
 

nixos/modules/services/web-apps/open-web-calendar.nix

@@ -0,0 +1,162 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+let
+  inherit (lib)
+    mkIf
+    mkOption
+    mkEnableOption
+    mkPackageOption
+    mkDefault
+    types
+    concatMapStringsSep
+    generators
+    ;
+  cfg = config.services.open-web-calendar;
+
+  nixosSpec = calendarSettingsFormat.generate "nixos_specification.json" cfg.calendarSettings;
+  finalPackage = cfg.package.override {
+    # The calendarSettings need to be merged with the default_specification.yml
+    # in the source. This way we use upstreams default values but keep everything overridable.
+    defaultSpecificationFile = pkgs.runCommand "custom-default_specification.yml" { } ''
+      ${pkgs.yq}/bin/yq -s '.[0] * .[1]' ${cfg.package}/${cfg.package.defaultSpecificationPath} ${nixosSpec} > $out
+    '';
+  };
+
+  inherit (finalPackage) python;
+  pythonEnv = python.buildEnv.override {
+    extraLibs = [
+      (python.pkgs.toPythonModule finalPackage)
+      # Allows Gunicorn to set a meaningful process name
+      python.pkgs.gunicorn.optional-dependencies.setproctitle
+    ];
+  };
+
+  settingsFormat = pkgs.formats.keyValue { };
+  calendarSettingsFormat = pkgs.formats.json { };
+in
+{
+  options.services.open-web-calendar = {
+
+    enable = mkEnableOption "OpenWebCalendar service";
+
+    package = mkPackageOption pkgs "open-web-calendar" { };
+
+    domain = mkOption {
+      type = types.str;
+      description = "The domain under which open-web-calendar is made available";
+      example = "open-web-calendar.example.org";
+    };
+
+    settings = mkOption {
+      type = types.submodule {
+        freeformType = settingsFormat.type;
+        options = {
+          ALLOWED_HOSTS = mkOption {
+            type = types.str;
+            readOnly = true;
+            description = ''
+              The hosts that the Open Web Calendar permits. This is required to
+              mitigate the Host Header Injection vulnerability.
+
+              We always set this to the empty list, as Nginx already checks the Host header.
+            '';
+            default = "";
+          };
+        };
+      };
+      default = { };
+      description = ''
+        Configuration for the server. These are set as environment variables to the gunicorn/flask service.
+
+        See the documentation options in <https://open-web-calendar.quelltext.eu/host/configure/#configuring-the-server>.
+      '';
+    };
+
+    calendarSettings = mkOption {
+      type = types.submodule {
+        freeformType = calendarSettingsFormat.type;
+        options = { };
+      };
+      default = { };
+      description = ''
+        Configure the default calendar.
+
+        See the documentation options in <https://open-web-calendar.quelltext.eu/host/configure/#configuring-the-default-calendar> and <https://github.com/niccokunzmann/open-web-calendar/blob/master/open_web_calendar/default_specification.yml>.
+
+        Individual calendar instances can be further configured outside this module, by specifying the `specification_url` parameter.
+      '';
+    };
+
+  };
+
+  config = mkIf cfg.enable {
+
+    assertions = [
+      {
+        assertion = !cfg.settings ? "PORT";
+        message = ''
+          services.open-web-calendar.settings.PORT can't be set, as the service uses a unix socket.
+        '';
+      }
+    ];
+
+    systemd.sockets.open-web-calendar = {
+      before = [ "nginx.service" ];
+      wantedBy = [ "sockets.target" ];
+      socketConfig = {
+        ListenStream = "/run/open-web-calendar/socket";
+        SocketUser = "open-web-calendar";
+        SocketGroup = "open-web-calendar";
+        SocketMode = "770";
+      };
+    };
+
+    systemd.services.open-web-calendar = {
+      description = "Open Web Calendar";
+      after = [ "network.target" ];
+      environment.PYTHONPATH = "${pythonEnv}/${python.sitePackages}/";
+      serviceConfig = {
+        Type = "notify";
+        NotifyAccess = "all";
+        ExecStart = ''
+          ${pythonEnv.pkgs.gunicorn}/bin/gunicorn \
+            --name=open-web-calendar \
+            --bind='unix:///run/open-web-calendar/socket' \
+            open_web_calendar.app:app
+        '';
+        EnvironmentFile = settingsFormat.generate "open-web-calendar.env" cfg.settings;
+        ExecReload = "kill -s HUP $MAINPID";
+        KillMode = "mixed";
+        PrivateTmp = true;
+        RuntimeDirectory = "open-web-calendar";
+        User = "open-web-calendar";
+        Group = "open-web-calendar";
+      };
+    };
+
+    users.users.open-web-calendar = {
+      isSystemUser = true;
+      group = "open-web-calendar";
+    };
+
+    services.nginx = {
+      enable = true;
+      virtualHosts."${cfg.domain}" = {
+        forceSSL = mkDefault true;
+        enableACME = mkDefault true;
+        locations."/".proxyPass = "http://unix:///run/open-web-calendar/socket";
+      };
+    };
+
+    users.groups.open-web-calendar.members = [ config.services.nginx.user ];
+
+  };
+
+  meta.maintainers = with lib.maintainers; [ erictapen ];
+
+}

nixos/modules/services/web-apps/porn-vault/default-config.nix

@@ -0,0 +1,158 @@
+# See https://gitlab.com/porn-vault/porn-vault/-/blob/dev/config.example.json
+{
+  auth = {
+    password = null;
+  };
+  binaries = {
+    ffmpeg = "ffmpeg";
+    ffprobe = "ffprobe";
+    izzyPort = 8000;
+    imagemagick = {
+      convertPath = "convert";
+      montagePath = "montage";
+      identifyPath = "identify";
+    };
+  };
+  import = {
+    images = [
+      {
+        path = "/media/porn-vault/images";
+        include = [ ];
+        exclude = [ ];
+        extensions = [
+          ".jpg"
+          ".jpeg"
+          ".png"
+          ".gif"
+        ];
+        enable = true;
+      }
+    ];
+    videos = [
+      {
+        path = "/media/porn-vault/videos";
+        include = [ ];
+        exclude = [ ];
+        extensions = [
+          ".mp4"
+          ".mov"
+          ".webm"
+        ];
+        enable = true;
+      }
+    ];
+    scanInterval = 10800000;
+  };
+  log = {
+    level = "debug";
+    maxSize = "20m";
+    maxFiles = "5";
+    writeFile = [
+      {
+        level = "debug";
+        prefix = "errors-";
+        silent = false;
+      }
+    ];
+  };
+  matching = {
+    applyActorLabels = [
+      "event:actor:create"
+      "event:actor:find-unmatched-scenes"
+      "plugin:actor:create"
+      "event:scene:create"
+      "plugin:scene:create"
+      "event:image:create"
+      "plugin:marker:create"
+      "event:marker:create"
+    ];
+    applySceneLabels = true;
+    applyStudioLabels = [
+      "event:studio:create"
+      "event:studio:find-unmatched-scenes"
+      "plugin:studio:create"
+      "event:scene:create"
+      "plugin:scene:create"
+    ];
+    extractSceneActorsFromFilepath = true;
+    extractSceneLabelsFromFilepath = true;
+    extractSceneMoviesFromFilepath = true;
+    extractSceneStudiosFromFilepath = true;
+    matcher = {
+      type = "word";
+      options = {
+        ignoreSingleNames = false;
+        ignoreDiacritics = true;
+        enableWordGroups = true;
+        wordSeparatorFallback = true;
+        camelCaseWordGroups = true;
+        overlappingMatchPreference = "longest";
+        groupSeparators = [
+          "[\\s',()[\\]{}*\\.]"
+        ];
+        wordSeparators = [
+          "[-_]"
+        ];
+        filepathSeparators = [
+          "[/\\\\&]"
+        ];
+      };
+    };
+    matchCreatedActors = true;
+    matchCreatedStudios = true;
+    matchCreatedLabels = true;
+  };
+  persistence = {
+    backup = {
+      enable = true;
+      maxAmount = 10;
+    };
+    libraryPath = "/media/porn-vault/lib";
+  };
+  plugins = {
+    allowActorThumbnailOverwrite = false;
+    allowMovieThumbnailOverwrite = false;
+    allowSceneThumbnailOverwrite = false;
+    allowStudioThumbnailOverwrite = false;
+    createMissingActors = false;
+    createMissingLabels = false;
+    createMissingMovies = false;
+    createMissingStudios = false;
+    events = {
+      actorCreated = [ ];
+      actorCustom = [ ];
+      sceneCreated = [ ];
+      sceneCustom = [ ];
+      movieCustom = [ ];
+      studioCreated = [ ];
+      studioCustom = [ ];
+    };
+    register = { };
+    markerDeduplicationThreshold = 5;
+  };
+  processing = {
+    generatePreviews = true;
+    readImagesOnImport = false;
+    generateImageThumbnails = true;
+  };
+  server = {
+    https = {
+      certificate = "";
+      enable = false;
+      key = "";
+    };
+  };
+  transcode = {
+    hwaDriver = null;
+    vaapiDevice = "/dev/dri/renderD128";
+    h264 = {
+      preset = "veryfast";
+      crf = 23;
+    };
+    webm = {
+      deadline = "realtime";
+      cpuUsed = 3;
+      crf = 31;
+    };
+  };
+}

nixos/modules/services/web-apps/porn-vault/default.nix

@@ -0,0 +1,110 @@
+{
+  config,
+  pkgs,
+  lib,
+  ...
+}:
+
+let
+  cfg = config.services.porn-vault;
+  configFormat = pkgs.formats.json { };
+  defaultConfig = import ./default-config.nix;
+  inherit (lib)
+    mkIf
+    mkEnableOption
+    mkPackageOption
+    mkOption
+    getExe
+    literalExpression
+    types
+    ;
+in
+{
+  options = {
+    services.porn-vault = {
+      enable = lib.mkEnableOption "Porn-Vault";
+
+      package = lib.mkPackageOption pkgs "porn-vault" { };
+
+      autoStart = lib.mkOption {
+        type = lib.types.bool;
+        default = true;
+        description = ''
+          Whether to start porn-vault automatically.
+        '';
+      };
+
+      port = lib.mkOption {
+        type = lib.types.port;
+        default = 3000;
+        description = ''
+          Which port Porn-Vault will use.
+        '';
+      };
+
+      openFirewall = lib.mkOption {
+        type = lib.types.bool;
+        default = false;
+        description = ''
+          Whether to open the Porn-Vault port in the firewall.
+        '';
+      };
+
+      settings = mkOption {
+        type = configFormat.type;
+        description = ''
+          Configuration for Porn-Vault. The attributes are serialized to JSON in config.json.
+
+          See https://gitlab.com/porn-vault/porn-vault/-/blob/dev/config.example.json
+        '';
+        default = defaultConfig;
+        apply = lib.recursiveUpdate defaultConfig;
+      };
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    environment.systemPackages = [ cfg.package ];
+
+    systemd.services.porn-vault = {
+      description = "Porn-Vault server";
+      environment = {
+        PV_CONFIG_FOLDER = "/etc/porn-vault";
+        NODE_ENV = "production";
+        DATABASE_NAME = "production";
+        PORT = toString cfg.port;
+      };
+      serviceConfig = {
+        ExecStart = getExe cfg.package;
+        CacheDirectory = "porn-vault";
+        # Hardening options
+        CapabilityBoundingSet = [ "CAP_SYS_NICE" ];
+        AmbientCapabilities = [ "CAP_SYS_NICE" ];
+        LockPersonality = true;
+        NoNewPrivileges = true;
+        PrivateTmp = true;
+        ProtectControlGroups = true;
+        ProtectKernelLogs = true;
+        ProtectKernelModules = true;
+        ProtectKernelTunables = true;
+        ProtectSystem = true;
+        RestrictNamespaces = true;
+        RestrictSUIDSGID = true;
+        Restart = "on-failure";
+        RestartSec = 5;
+      };
+      wantedBy = mkIf cfg.autoStart [ "multi-user.target" ];
+      wants = [ "network.target" ];
+    };
+
+    environment.etc = {
+      "porn-vault/config.json".source = configFormat.generate "config.json" cfg.settings;
+    };
+
+    networking.firewall = lib.mkIf cfg.openFirewall {
+      allowedTCPPorts = [ cfg.port ];
+    };
+  };
+
+  meta.maintainers = [ lib.maintainers.luNeder ];
+}

nixos/modules/system/activation/pre-switch-check.nix

@@ -0,0 +1,44 @@
+{ lib, pkgs, ... }:
+let
+  preSwitchCheckScript =
+    set:
+    lib.concatLines (
+      lib.mapAttrsToList (name: text: ''
+        # pre-switch check ${name}
+        (
+          ${text}
+        )
+        if [[ $? != 0 ]]; then
+          echo "Pre-switch check '${name}' failed"
+          exit 1
+        fi
+      '') set
+    );
+in
+{
+  options.system.preSwitchChecks = lib.mkOption {
+    default = { };
+    example = lib.literalExpression ''
+      { failsEveryTime =
+        '''
+          false
+        ''';
+      }
+    '';
+
+    description = ''
+      A set of shell script fragments that are executed before the switch to a
+      new NixOS system configuration. A failure in any of these fragments will
+      cause the switch to fail and exit early.
+    '';
+
+    type = lib.types.attrsOf lib.types.str;
+
+    apply =
+      set:
+      set
+      // {
+        script = pkgs.writeShellScript "pre-switch-checks" (preSwitchCheckScript set);
+      };
+  };
+}

nixos/modules/system/activation/switch-to-configuration.pl

@@ -78,10 +78,11 @@ if ("@localeArchive@" ne "") {
     $ENV{LOCALE_ARCHIVE} = "@localeArchive@";
 }
 
-if (!defined($action) || ($action ne "switch" && $action ne "boot" && $action ne "test" && $action ne "dry-activate")) {
+if (!defined($action) || ($action ne "switch" && $action ne "boot" && $action ne "test" && $action ne "dry-activate" && $action ne "check")) {
     print STDERR <<"EOF";
-Usage: $0 [switch|boot|test|dry-activate]
+Usage: $0 [check|switch|boot|test|dry-activate]
 
+check:        run pre-switch checks and exit
 switch:       make the configuration the boot default and activate now
 boot:         make the configuration the boot default
 test:         activate the configuration, but don\'t make it the boot default
@@ -101,6 +102,17 @@ open(my $stc_lock, '>>', '/run/nixos/switch-to-configuration.lock') or die "Coul
 flock($stc_lock, LOCK_EX) or die "Could not acquire lock - $!";
 openlog("nixos", "", LOG_USER);
 
+# run pre-switch checks
+if (($ENV{"NIXOS_NO_CHECK"} // "") ne "1") {
+    chomp(my $pre_switch_checks = <<'EOFCHECKS');
+@preSwitchCheck@
+EOFCHECKS
+    system("$pre_switch_checks $out") == 0 or exit 1;
+    if ($action eq "check") {
+        exit 0;
+    }
+}
+
 # Install or update the bootloader.
 if ($action eq "switch" || $action eq "boot") {
     chomp(my $install_boot_loader = <<'EOFBOOTLOADER');

nixos/modules/system/activation/switchable-system.nix

@@ -61,6 +61,7 @@ in
           --subst-var-by coreutils "${pkgs.coreutils}" \
           --subst-var-by distroId ${lib.escapeShellArg config.system.nixos.distroId} \
           --subst-var-by installBootLoader ${lib.escapeShellArg config.system.build.installBootLoader} \
+          --subst-var-by preSwitchCheck ${lib.escapeShellArg config.system.preSwitchChecks.script} \
           --subst-var-by localeArchive "${config.i18n.glibcLocales}/lib/locale/locale-archive" \
           --subst-var-by perl "${perlWrapped}" \
           --subst-var-by shell "${pkgs.bash}/bin/sh" \
@@ -93,6 +94,7 @@ in
             --set TOPLEVEL ''${!toplevelVar} \
             --set DISTRO_ID ${lib.escapeShellArg config.system.nixos.distroId} \
             --set INSTALL_BOOTLOADER ${lib.escapeShellArg config.system.build.installBootLoader} \
+            --set PRE_SWITCH_CHECK ${lib.escapeShellArg config.system.preSwitchChecks.script} \
             --set LOCALE_ARCHIVE ${config.i18n.glibcLocales}/lib/locale/locale-archive \
             --set SYSTEMD ${config.systemd.package}
         )

nixos/modules/system/activation/top-level.nix

@@ -342,6 +342,7 @@ in
       perl = pkgs.perl.withPackages (p: with p; [ ConfigIniFiles FileSlurp ]);
       # End if legacy environment variables
 
+      preSwitchCheck = config.system.preSwitchChecks.script;
 
       # Not actually used in the builder. `passedChecks` is just here to create
       # the build dependencies. Checks are similar to build dependencies in the

nixos/modules/virtualisation/disk-size-option.nix

@@ -16,7 +16,7 @@ in
     virtualisation.diskSize = lib.mkOption {
       type = t.either (t.enum [ "auto" ]) t.ints.positive;
       default = if config.virtualisation.diskSizeAutoSupported then "auto" else 1024;
-      defaultText = "\"auto\" if diskSizeAutoSupported, else 1024";
+      defaultText = lib.literalExpression "if virtualisation.diskSizeAutoSupported then \"auto\" else 1024";
       description = ''
         The disk size in megabytes of the virtual machine.
       '';

nixos/modules/virtualisation/nixos-containers.nix

@@ -705,7 +705,7 @@ in
             allowedDevices = mkOption {
               type = with types; listOf (submodule allowedDeviceOpts);
               default = [];
-              example = [ { node = "/dev/net/tun"; modifier = "rw"; } ];
+              example = [ { node = "/dev/net/tun"; modifier = "rwm"; } ];
               description = ''
                 A list of device nodes to which the containers has access to.
               '';
@@ -835,7 +835,7 @@ in
             optionalAttrs cfg.enableTun
               {
                 allowedDevices = cfg.allowedDevices
-                  ++ [ { node = "/dev/net/tun"; modifier = "rw"; } ];
+                  ++ [ { node = "/dev/net/tun"; modifier = "rwm"; } ];
                 additionalCapabilities = cfg.additionalCapabilities
                   ++ [ "CAP_NET_ADMIN" ];
               }

nixos/tests/all-tests.nix

@@ -182,6 +182,7 @@ in {
   cagebreak = handleTest ./cagebreak.nix {};
   calibre-web = handleTest ./calibre-web.nix {};
   calibre-server = handleTest ./calibre-server.nix {};
+  canaille = handleTest ./canaille.nix {};
   castopod = handleTest ./castopod.nix {};
   cassandra_3_0 = handleTest ./cassandra.nix { testPackage = pkgs.cassandra_3_0; };
   cassandra_3_11 = handleTest ./cassandra.nix { testPackage = pkgs.cassandra_3_11; };
@@ -746,6 +747,7 @@ in {
   openstack-image-userdata = (handleTestOn ["x86_64-linux"] ./openstack-image.nix {}).userdata or {};
   opentabletdriver = handleTest ./opentabletdriver.nix {};
   opentelemetry-collector = handleTest ./opentelemetry-collector.nix {};
+  open-web-calendar = handleTest ./web-apps/open-web-calendar.nix {};
   ocsinventory-agent = handleTestOn [ "x86_64-linux" "aarch64-linux" ] ./ocsinventory-agent.nix {};
   owncast = handleTest ./owncast.nix {};
   outline = handleTest ./outline.nix {};

nixos/tests/canaille.nix

@@ -0,0 +1,62 @@
+import ./make-test-python.nix (
+  { pkgs, ... }:
+  let
+    certs = import ./common/acme/server/snakeoil-certs.nix;
+    inherit (certs) domain;
+  in
+  {
+    name = "canaille";
+    meta.maintainers = with pkgs.lib.maintainers; [ erictapen ];
+
+    nodes.server =
+      { pkgs, lib, ... }:
+      {
+        services.canaille = {
+          enable = true;
+          secretKeyFile = pkgs.writeText "canaille-secret-key" ''
+            this is not a secret key
+          '';
+          settings = {
+            SERVER_NAME = domain;
+          };
+        };
+
+        services.nginx.virtualHosts."${domain}" = {
+          enableACME = lib.mkForce false;
+          sslCertificate = certs."${domain}".cert;
+          sslCertificateKey = certs."${domain}".key;
+        };
+
+        networking.hosts."::1" = [ "${domain}" ];
+        networking.firewall.allowedTCPPorts = [
+          80
+          443
+        ];
+
+        users.users.canaille.shell = pkgs.bashInteractive;
+
+        security.pki.certificateFiles = [ certs.ca.cert ];
+      };
+
+    nodes.client =
+      { nodes, ... }:
+      {
+        networking.hosts."${nodes.server.networking.primaryIPAddress}" = [ "${domain}" ];
+        security.pki.certificateFiles = [ certs.ca.cert ];
+      };
+
+    testScript =
+      { ... }:
+      ''
+        import json
+
+        start_all()
+        server.wait_for_unit("canaille.socket")
+        server.wait_until_succeeds("curl -f https://${domain}")
+        server.succeed("sudo -iu canaille -- canaille create user --user-name admin --password adminpass --emails admin@${domain}")
+        json_str = server.succeed("sudo -iu canaille -- canaille get user")
+        assert json.loads(json_str)[0]["user_name"] == "admin"
+        server.succeed("sudo -iu canaille -- canaille check")
+      '';
+  }
+)

nixos/tests/suricata.nix

@@ -6,11 +6,6 @@ import ./make-test-python.nix (
 
     nodes = {
       ids = {
-        imports = [
-          ../modules/profiles/minimal.nix
-          ../modules/services/networking/suricata/default.nix
-        ];
-
         networking.interfaces.eth1 = {
           useDHCP = false;
           ipv4.addresses = [

nixos/tests/switch-test.nix

@@ -612,6 +612,10 @@ in {
     other = {
       system.switch.enable = true;
       users.mutableUsers = true;
+      specialisation.failingCheck.configuration.system.preSwitchChecks.failEveryTime = ''
+        echo this will fail
+        false
+      '';
     };
   };
 
@@ -684,6 +688,11 @@ in {
 
     boot_loader_text = "Warning: do not know how to make this configuration bootable; please enable a boot loader."
 
+    with subtest("pre-switch checks"):
+        machine.succeed("${stderrRunner} ${otherSystem}/bin/switch-to-configuration check")
+        out = switch_to_specialisation("${otherSystem}", "failingCheck", action="check", fail=True)
+        assert_contains(out, "this will fail")
+
     with subtest("actions"):
         # boot action
         out = switch_to_specialisation("${machine}", "simpleService", action="boot")

nixos/tests/web-apps/open-web-calendar.nix

@@ -0,0 +1,51 @@
+import ../make-test-python.nix (
+  { pkgs, ... }:
+
+  let
+    certs = import ../common/acme/server/snakeoil-certs.nix;
+
+    serverDomain = certs.domain;
+  in
+  {
+    name = "open-web-calendar";
+    meta.maintainers = with pkgs.lib.maintainers; [ erictapen ];
+
+    nodes.server =
+      { pkgs, lib, ... }:
+      {
+        services.open-web-calendar = {
+          enable = true;
+          domain = serverDomain;
+          calendarSettings.title = "My custom title";
+        };
+
+        services.nginx.virtualHosts."${serverDomain}" = {
+          enableACME = lib.mkForce false;
+          sslCertificate = certs."${serverDomain}".cert;
+          sslCertificateKey = certs."${serverDomain}".key;
+        };
+
+        security.pki.certificateFiles = [ certs.ca.cert ];
+
+        networking.hosts."::1" = [ "${serverDomain}" ];
+        networking.firewall.allowedTCPPorts = [
+          80
+          443
+        ];
+      };
+
+    nodes.client =
+      { pkgs, nodes, ... }:
+      {
+        networking.hosts."${nodes.server.networking.primaryIPAddress}" = [ "${serverDomain}" ];
+
+        security.pki.certificateFiles = [ certs.ca.cert ];
+      };
+
+    testScript = ''
+      start_all()
+      server.wait_for_unit("open-web-calendar.socket")
+      server.wait_until_succeeds("curl -f https://${serverDomain}/ | grep 'My custom title'")
+    '';
+  }
+)

pkgs/applications/audio/mopidy/mopidy.nix

@@ -30,6 +30,7 @@ pythonPackages.buildPythonApplication rec {
     gst-plugins-good
     gst-plugins-ugly
     gst-plugins-rs
+    pipewire
   ];
 
   propagatedBuildInputs =
@@ -56,12 +57,6 @@ pythonPackages.buildPythonApplication rec {
   # There are no tests
   doCheck = false;
 
-  preFixup = ''
-    gappsWrapperArgs+=(
-      --prefix GST_PLUGIN_SYSTEM_PATH_1_0 : "${pipewire}/lib/gstreamer-1.0"
-    )
-  '';
-
   meta = with lib; {
     homepage = "https://www.mopidy.com/";
     description = "Extensible music server that plays music from local disk, Spotify, SoundCloud, and more";

pkgs/applications/audio/patchance/default.nix

@@ -25,7 +25,7 @@ buildPythonApplication rec {
   installFlags = [ "PREFIX=$(out)" ];
 
   makeWrapperArgs = [
-    "--prefix" "LD_LIBRARY_PATH" ":" (lib.makeLibraryPath [ libjack2 ])
+    "--suffix" "LD_LIBRARY_PATH" ":" (lib.makeLibraryPath [ libjack2 ])
   ];
 
   preFixup = ''

pkgs/applications/audio/raysession/default.nix

@@ -32,7 +32,7 @@ buildPythonApplication rec {
   installFlags = [ "PREFIX=$(out)" ];
 
   makeWrapperArgs = [
-    "--prefix" "LD_LIBRARY_PATH" ":" (lib.makeLibraryPath [ libjack2 ])
+    "--suffix" "LD_LIBRARY_PATH" ":" (lib.makeLibraryPath [ libjack2 ])
   ];
 
   postFixup = ''

pkgs/applications/editors/vim/plugins/generated.nix

@@ -16020,12 +16020,12 @@ final: prev:
 
   vim-nixhash = buildVimPlugin {
     pname = "vim-nixhash";
-    version = "2023-01-09";
+    version = "2024-11-20";
     src = fetchFromGitHub {
       owner = "symphorien";
       repo = "vim-nixhash";
-      rev = "71676294bcb22c52d372bd8850b1bd3d7173bfac";
-      sha256 = "14chq3c5dhkvllkmrrnpd8lbmlbm8ji1gqxn686bnh0d1w2r9hyk";
+      rev = "3b4d3f2742b168decc2281033b9c5c2c700c9ceb";
+      sha256 = "04208x1q846ddh61dcdgxylnqxmbkh1vh3qizwq0i5mb55pdrxpc";
     };
     meta.homepage = "https://github.com/symphorien/vim-nixhash/";
   };

pkgs/applications/editors/vscode/extensions/default.nix

@@ -3116,7 +3116,7 @@ let
           hash = "sha256-sHeaMMr5hmQ0kAFZxxMiRk6f0mfjkg2XMnA4Gf+DHwA=";
         };
         meta = {
-          license = lib.licenses.mit;
+          license = lib.licenses.unfree;
         };
       };
 

pkgs/applications/misc/bambu-studio/patches/meshboolean-const.patch

@@ -1,21 +0,0 @@
-Fix build with cgal 5.6.1+
-
-diff --git a/src/libslic3r/MeshBoolean.cpp b/src/libslic3r/MeshBoolean.cpp
-index 50bbc099..b05245d3 100644
---- a/src/libslic3r/MeshBoolean.cpp
-+++ b/src/libslic3r/MeshBoolean.cpp
-@@ -200,12 +200,12 @@ indexed_triangle_set cgal_to_indexed_triangle_set(const _Mesh &cgalmesh)
-     const auto &vertices = cgalmesh.vertices();
-     int vsize = int(vertices.size());
-
--    for (auto &vi : vertices) {
-+    for (const auto &vi : vertices) {
-         auto &v = cgalmesh.point(vi); // Don't ask...
-         its.vertices.emplace_back(to_vec3f(v));
-     }
-
--    for (auto &face : faces) {
-+    for (const auto &face : faces) {
-         auto vtc = cgalmesh.vertices_around_face(cgalmesh.halfedge(face));
-
-         int i = 0;

pkgs/applications/networking/instant-messengers/element/element-desktop.nix

@@ -8,7 +8,7 @@
 , nodejs
 , fetchYarnDeps
 , jq
-, electron
+, electron_33
 , element-web
 , sqlcipher
 , callPackage
@@ -27,6 +27,7 @@ let
   executableName = "element-desktop";
   keytar = callPackage ./keytar { inherit Security AppKit; };
   seshat = callPackage ./seshat { inherit CoreServices; };
+  electron = electron_33;
 in
 stdenv.mkDerivation (finalAttrs: builtins.removeAttrs pinData [ "hashes" ] // {
   pname = "element-desktop";

pkgs/applications/networking/instant-messengers/element/pin.nix

@@ -1,9 +1,9 @@
 {
-  "version" = "1.11.85";
+  "version" = "1.11.86";
   "hashes" = {
-    "desktopSrcHash" = "sha256-KNt7UgQBKoieV3IV/qFjk6PKYlgjHk4tLA8cZZlYtIw=";
-    "desktopYarnHash" = "1wh867yw7ic3nx623c5dknn9wk4zgq9b000p9mdf79spfp57lqlw";
-    "webSrcHash" = "sha256-JR7kA2thttBle+BT/zH8QjIjp5mJPsRMYx8nd/I3IEw=";
-    "webYarnHash" = "0f38gizj9cnb7dqj10wljxkbjfabznh3s407n9vsl7ig0hm91zf9";
+    "desktopSrcHash" = "sha256-GP5KnXL63J0076cVu0OpodlNT7Ypeso4iGrQNKq/17M=";
+    "desktopYarnHash" = "0bcq89nmx03h106hp875mv482d4r1xahdsimw3cs5c592zl50kx2";
+    "webSrcHash" = "sha256-cqB77ffTbFLoNsGjXUOb2tdlXhSIS3X1/oDXOzOn99s=";
+    "webYarnHash" = "1cwj77a997lb4229ngry0b6kip1ggs82b9v126rzfgzavvwh9k1v";
   };
 }

pkgs/applications/networking/instant-messengers/signal-desktop/default.nix

@@ -7,9 +7,4 @@
       callPackage ./signal-desktop-darwin.nix { }
     else
       callPackage ./signal-desktop.nix { };
-  signal-desktop-beta = (callPackage ./signal-desktop-beta.nix { }).overrideAttrs (old: {
-    meta = old.meta // {
-      platforms = [ "x86_64-linux" ];
-    };
-  });
 }

pkgs/applications/networking/instant-messengers/signal-desktop/update.sh

@@ -33,12 +33,6 @@ signal-desktop)
     --override-filename "$SCRIPT_DIR/signal-desktop-darwin.nix" \
     signal-desktop
   ;;
-signal-desktop-beta)
-  latestTagBeta=$(curl_github https://api.github.com/repos/signalapp/Signal-Desktop/releases | jq -r ".[0].tag_name")
-  latestVersionBeta="$(expr "$latestTagBeta" : 'v\(.*\)')"
-  echo "Updating signal-desktop-beta for x86_64-linux"
-  nix-update --version "$latestVersionBeta" --system x86_64-linux --override-filename "$SCRIPT_DIR/signal-desktop-beta.nix" signal-desktop-beta
-  ;;
 *)
   echo "Unknown attr path $UPDATE_NIX_ATTR_PATH"
   ;;

pkgs/applications/networking/instant-messengers/telegram/telegram-desktop/unwrapped.nix

@@ -46,14 +46,14 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "telegram-desktop-unwrapped";
-  version = "5.7.1";
+  version = "5.8.2";
 
   src = fetchFromGitHub {
     owner = "telegramdesktop";
     repo = "tdesktop";
     rev = "v${finalAttrs.version}";
     fetchSubmodules = true;
-    hash = "sha256-MPVm9WfAjF11sy0hyhDTI/mM2OsENSMavnVrOwXTGUk=";
+    hash = "sha256-zgvyxhQDF1JcGe/fpputvPrAFh1Z+EGaynSXHDk9k/8=";
   };
 
   postPatch = lib.optionalString stdenv.hostPlatform.isLinux ''

pkgs/applications/networking/p2p/vuze/default.nix

@@ -1,33 +0,0 @@
-{ lib, stdenv, fetchsvn, jdk, jre, ant, swt, makeWrapper }:
-
-stdenv.mkDerivation rec {
-  pname = "vuze";
-  version = "5750";
-
-  src = fetchsvn {
-    url = "http://svn.vuze.com/public/client/tags/RELEASE_${version}";
-    sha256 = "07w6ipyiy8hi88d6yxbbf3vkv26mj7dcz9yr8141hb2ig03v0h0p";
-  };
-
-  nativeBuildInputs = [ makeWrapper ];
-  buildInputs = [ jdk ant ];
-
-  buildPhase = "ant";
-
-  installPhase = ''
-    install -D dist/Vuze_0000-00.jar $out/share/java/Vuze_${version}-00.jar
-    makeWrapper ${jre}/bin/java $out/bin/vuze \
-      --add-flags "-Xmx256m -Djava.library.path=${swt}/lib -cp $out/share/java/Vuze_${version}-00.jar:${swt}/jars/swt.jar org.gudy.azureus2.ui.swt.Main"
-  '';
-
-  meta = with lib; {
-    description = "Torrent client";
-    homepage = "http://www.vuze.com";
-    license = licenses.unfree;
-    platforms = platforms.all;
-    maintainers = [ ];
-    # Doesn't launch, gives java related incompatibilities errors. Probably
-    # related to swt. Same error happens with swt_jdk8
-    broken = true;
-  };
-}

pkgs/by-name/au/autofs5/package.nix

@@ -1,6 +1,6 @@
 { lib, stdenv, fetchurl, flex, bison, linuxHeaders, libtirpc, mount, umount, nfs-utils, e2fsprogs
 , libxml2, libkrb5, kmod, openldap, sssd, cyrus_sasl, openssl, rpcsvc-proto, pkgconf
-, fetchpatch
+, fetchpatch, libnsl
 }:
 
 stdenv.mkDerivation rec {
@@ -48,9 +48,9 @@ stdenv.mkDerivation rec {
   '';
 
   buildInputs = [ linuxHeaders libtirpc libxml2 libkrb5 kmod openldap sssd
-                  openssl cyrus_sasl rpcsvc-proto ];
+                  openssl cyrus_sasl rpcsvc-proto libnsl ];
 
-  nativeBuildInputs = [ flex bison pkgconf ];
+  nativeBuildInputs = [ flex bison pkgconf libnsl.dev ];
 
   meta = {
     description = "Kernel-based automounter";

pkgs/by-name/ba/bambu-studio/package.nix

@@ -8,11 +8,12 @@
   wrapGAppsHook3,
   boost180,
   cereal,
-  cgal_5,
+  cgal,
   curl,
   dbus,
   eigen,
   expat,
+  ffmpeg,
   gcc-unwrapped,
   glew,
   glfw,
@@ -55,13 +56,13 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "bambu-studio";
-  version = "01.09.07.52";
+  version = "01.10.01.50";
 
   src = fetchFromGitHub {
     owner = "bambulab";
     repo = "BambuStudio";
     rev = "v${version}";
-    hash = "sha256-fhH4N29P/ysdHHbZt+FnBl3+QtTNhbVE3j4ZnFJyJH0=";
+    hash = "sha256-7mkrPl2CQSfc1lRjl1ilwxdYcK5iRU//QGKmdCicK30=";
   };
 
   nativeBuildInputs = [
@@ -74,11 +75,12 @@ stdenv.mkDerivation rec {
     binutils
     boost180
     cereal
-    cgal_5
+    cgal
     curl
     dbus
     eigen
     expat
+    ffmpeg
     gcc-unwrapped
     glew
     glfw
@@ -109,8 +111,6 @@ stdenv.mkDerivation rec {
   patches = [
     # Fix for webkitgtk linking
     ./patches/0001-not-for-upstream-CMakeLists-Link-against-webkit2gtk-.patch
-    # Fix build with cgal-5.6.1+
-    ./patches/meshboolean-const.patch
     # Fix an issue with
     ./patches/dont-link-opencv-world-bambu.patch
   ];
@@ -149,6 +149,9 @@ stdenv.mkDerivation rec {
     "-DSLIC3R_FHS=1"
     "-DSLIC3R_GTK=3"
 
+    # Skips installing ffmpeg, since we BYO.
+    "-DFLATPAK=1"
+
     # BambuStudio-specific
     "-DBBL_RELEASE_TO_PUBLIC=1"
     "-DBBL_INTERNAL_TESTING=0"

pkgs/by-name/ba/bant/package.nix

@@ -40,8 +40,8 @@ buildBazelPackage rec {
   fetchAttrs = {
     hash =
       {
-        aarch64-linux = "sha256-K+uGH3ox49taSPZ1aLYPrOLNRO3aLQeOSdrkmTC444U=";
-        x86_64-linux = "sha256-yNwD3n7exyG5LbhR2GuKIvoul6UQnyk3+8pLpnDzjFw=";
+        aarch64-linux = "sha256-E4VHjDa0qkHmKUNpTBfJi7dhMLcd1z5he+p31/XvUl8=";
+        x86_64-linux = "sha256-M7xhAIhTcVLCUkmy4giGxbr7DgHrXbg0e8D/bL6yZWU=";
       }
       .${system} or (throw "No hash for system: ${system}");
   };

pkgs/by-name/ca/canaille/package.nix

@@ -0,0 +1,118 @@
+{
+  lib,
+  python3,
+  fetchFromGitLab,
+  openldap,
+  nixosTests,
+}:
+
+let
+  python = python3;
+in
+python.pkgs.buildPythonApplication rec {
+  pname = "canaille";
+  version = "0.0.56";
+  pyproject = true;
+
+  disabled = python.pythonOlder "3.10";
+
+  src = fetchFromGitLab {
+    owner = "yaal";
+    repo = "canaille";
+    rev = "refs/tags/${version}";
+    hash = "sha256-cLsLwttUDxMKVqtVDCY5A22m1YY1UezeZQh1j74WzgU=";
+  };
+
+  build-system = with python.pkgs; [
+    hatchling
+    babel
+    setuptools
+  ];
+
+  dependencies =
+    with python.pkgs;
+    [
+      flask
+      flask-wtf
+      pydantic-settings
+      wtforms
+    ]
+    ++ sentry-sdk.optional-dependencies.flask;
+
+  nativeCheckInputs =
+    with python.pkgs;
+    [
+      pytestCheckHook
+      coverage
+      flask-webtest
+      pyquery
+      pytest-cov
+      pytest-httpserver
+      pytest-lazy-fixtures
+      pytest-smtpd
+      pytest-xdist
+      slapd
+      toml
+      faker
+      time-machine
+    ]
+    ++ optional-dependencies.front
+    ++ optional-dependencies.oidc
+    ++ optional-dependencies.ldap
+    ++ optional-dependencies.postgresql;
+
+  postInstall = ''
+    mkdir -p $out/etc/schema
+    cp $out/${python.sitePackages}/canaille/backends/ldap/schemas/* $out/etc/schema/
+  '';
+
+  preCheck = ''
+    # Needed by tests to setup a mockup ldap server.
+    export BIN="${openldap}/bin"
+    export SBIN="${openldap}/bin"
+    export SLAPD="${openldap}/libexec/slapd"
+    export SCHEMA="${openldap}/etc/schema"
+
+    # Just use their example config for testing
+    export CONFIG=canaille/config.sample.toml
+  '';
+
+  optional-dependencies = with python.pkgs; {
+    front = [
+      email-validator
+      flask-babel
+      flask-themer
+      pycountry
+      pytz
+      toml
+      zxcvbn-rs-py
+    ];
+    oidc = [ authlib ];
+    ldap = [ python-ldap ];
+    sentry = [ sentry-sdk ];
+    postgresql = [
+      passlib
+      sqlalchemy
+      sqlalchemy-json
+      sqlalchemy-utils
+    ] ++ sqlalchemy.optional-dependencies.postgresql;
+  };
+
+  passthru = {
+    inherit python;
+    tests = {
+      inherit (nixosTests) canaille;
+    };
+  };
+
+  meta = with lib; {
+    description = "Lightweight Identity and Authorization Management";
+    homepage = "https://canaille.readthedocs.io/en/latest/index.html";
+    changelog = "https://gitlab.com/yaal/canaille/-/blob/${src.rev}/CHANGES.rst";
+    license = licenses.mit;
+    platforms = platforms.linux;
+    maintainers = with maintainers; [ erictapen ];
+    mainProgram = "canaille";
+  };
+
+}

pkgs/by-name/ca/cargo-gra/package.nix

@@ -6,20 +6,20 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "cargo-gra";
-  version = "0.6.0";
+  version = "0.6.2";
 
   src = fetchCrate {
     inherit pname version;
-    hash = "sha256-cli7qaIVYvoZpDml/QAxm2vjvh/g28zlDSpU9IIUBfw=";
+    hash = "sha256-JbBcpp/E3WlQrwdxMsbSdmIEnDTQj/1XDwAWJsniRu0=";
   };
 
-  cargoHash = "sha256-xsaavcpDaiDDbL3Dl+7NLcfB5U6vuYsVPoIuA/KXCvI=";
+  cargoHash = "sha256-wfMiqWcEsL6/d6XFnEFm/lCbelU7BHC7JKdHREnynAU=";
 
   meta = {
-    license = lib.licenses.gpl3Plus;
+    description = "gtk-rust-app cli for building flatpak apps with ease";
     homepage = "https://gitlab.com/floers/gtk-stuff/cargo-gra/";
+    license = lib.licenses.gpl3Plus;
     maintainers = with lib.maintainers; [ bot-wxt1221 ];
     platforms = lib.platforms.unix;
-    description = "gtk-rust-app cli for building flatpak apps with ease";
   };
 }

pkgs/by-name/cb/cbmc-viewer/package.nix

@@ -0,0 +1,30 @@
+{
+  lib,
+  python3Packages,
+  fetchPypi,
+}:
+
+python3Packages.buildPythonApplication rec {
+  pname = "cbmc-viewer";
+  version = "3.8";
+  pyproject = true;
+
+  src = fetchPypi {
+    inherit pname version;
+    hash = "sha256-JFL06z7lJWZxTALovDBVwNJWenWPUQV9J0qZz3Ek6gI=";
+  };
+
+  propagatedBuildInputs = with python3Packages; [
+    setuptools
+    jinja2
+    voluptuous
+  ];
+
+  meta = {
+    description = "Produces browsable summary of CBMC model checker output";
+    homepage = "https://github.com/model-checking/cbmc-viewer";
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ jacg ];
+    mainProgram = "cbmc-viewer";
+  };
+}

pkgs/by-name/cl/clanlib/package.nix

@@ -12,27 +12,21 @@
   fontconfig,
   alsa-lib,
   libXrender,
+  libXinerama,
+  nix-update-script,
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "clanlib";
-  version = "4.1.0";
+  version = "4.2.0";
 
   src = fetchFromGitHub {
     repo = "ClanLib";
     owner = "sphair";
-    rev = "v${version}";
-    sha256 = "sha256-SVsLWcTP+PCIGDWLkadMpJPj4coLK9dJrW4sc2+HotE=";
+    rev = "refs/tags/v${finalAttrs.version}";
+    hash = "sha256-sRHRkT8NiKVfa9YgP6DYV9WzCZoH7f0phHpoYMnCk98=";
   };
 
-  patches = [
-    (fetchpatch {
-      name = "clanlib-add-support-for-riscv.patch";
-      url = "https://github.com/sphair/ClanLib/commit/f5f694205054b66dc800135c9b01673f69a7a671.patch";
-      hash = "sha256-/1XLFaTZDQAlT2mG9P6SJzXtTg7IWYGQ18Sx0e9zh0s=";
-    })
-  ];
-
   nativeBuildInputs = [
     pkg-config
     autoreconfHook
@@ -46,8 +40,11 @@ stdenv.mkDerivation rec {
     fontconfig
     alsa-lib
     libXrender
+    libXinerama
   ];
 
+  passthru.updateScript = nix-update-script { };
+
   meta = {
     homepage = "https://github.com/sphair/ClanLib";
     description = "Cross platform toolkit library with a primary focus on game creation";
@@ -55,4 +52,4 @@ stdenv.mkDerivation rec {
     maintainers = with lib.maintainers; [ nixinator ];
     platforms = with lib.platforms; lib.intersectLists linux (x86 ++ arm ++ aarch64 ++ riscv);
   };
-}
+})

pkgs/by-name/fi/finamp/package.nix

@@ -1,5 +1,5 @@
 { lib
-, flutter324
+, flutter327
 , mpv-unwrapped
 , xdg-user-dirs
 , patchelf
@@ -8,16 +8,16 @@
 , makeDesktopItem
 }:
 let
-  version = "0.9.11-beta";
+  version = "0.9.12-beta";
 in
-flutter324.buildFlutterApplication {
+flutter327.buildFlutterApplication {
   inherit version;
   pname = "finamp";
   src = fetchFromGitHub {
     owner = "jmshrv";
     repo = "finamp";
     rev = version;
-    hash = "sha256-ruHjLM68c/k+Q64eeoezj5gmmniLBAOt3PEmmaO81xo=";
+    hash = "sha256-hY+1BMQEACrpjKZnVwPqWY5M4m4U/Ys/bcqhGMeCE6U=";
   };
   pubspecLock = lib.importJSON ./pubspec.lock.json;
 

pkgs/by-name/fi/finamp/pubspec.lock.json

@@ -4,21 +4,27 @@
       "dependency": "transitive",
       "description": {
         "name": "_fe_analyzer_shared",
-        "sha256": "0b2f2bd91ba804e53a61d757b986f89f1f9eaed5b11e4b2f5a2468d86d6c9fc7",
+        "sha256": "f256b0c0ba6c7577c15e2e4e114755640a875e885099367bf6e012b19314c834",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "67.0.0"
+      "version": "72.0.0"
+    },
+    "_macros": {
+      "dependency": "transitive",
+      "description": "dart",
+      "source": "sdk",
+      "version": "0.3.2"
     },
     "analyzer": {
-      "dependency": "transitive",
+      "dependency": "direct overridden",
       "description": {
         "name": "analyzer",
-        "sha256": "37577842a27e4338429a1cbc32679d508836510b056f1eedf0c8d20e39c1383d",
+        "sha256": "b652861553cd3990d8ed361f7979dc6d7053a9ac8843fa73820ab68ce5410139",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "6.4.1"
+      "version": "6.7.0"
     },
     "analyzer_plugin": {
       "dependency": "transitive",
@@ -34,11 +40,11 @@
       "dependency": "direct main",
       "description": {
         "name": "app_set_id",
-        "sha256": "455b04bc03fd9b1b66a50bbca74278d973ac4e6f2c03d5dd4707bb071613a7e5",
+        "sha256": "362d61e013f400666c6e0f57d56ab9d32505e011e4ca4dfb779fd80c9d9505b0",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "1.2.0"
+      "version": "1.2.1"
     },
     "archive": {
       "dependency": "transitive",
@@ -134,11 +140,11 @@
       "dependency": "direct main",
       "description": {
         "name": "background_downloader",
-        "sha256": "6a945db1a1c7727a4bc9c1d7c882cfb1a819f873b77e01d5e5dd6a3fb231cb28",
+        "sha256": "91448c0fcb41af14ede14485c33b8ca684fcd6c0ac0a439be9f83fa964753e13",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "8.5.5"
+      "version": "8.6.0"
     },
     "balanced_text": {
       "dependency": "direct main",
@@ -155,11 +161,11 @@
       "dependency": "direct main",
       "description": {
         "name": "battery_plus",
-        "sha256": "ccc1322fee1153a0f89e663e0eac2f64d659da506454cf24dcad75eb08ae138b",
+        "sha256": "220c8f1961efb01d6870493b5ac5a80afaeaffc8757f7a11ed3025a8570d29e7",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "6.0.2"
+      "version": "6.2.0"
     },
     "battery_plus_platform_interface": {
       "dependency": "transitive",
@@ -235,21 +241,21 @@
       "dependency": "direct dev",
       "description": {
         "name": "build_runner",
-        "sha256": "644dc98a0f179b872f612d3eb627924b578897c629788e858157fa5e704ca0c7",
+        "sha256": "028819cfb90051c6b5440c7e574d1896f8037e3c96cf17aaeb054c9311cfbf4d",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "2.4.11"
+      "version": "2.4.13"
     },
     "build_runner_core": {
       "dependency": "transitive",
       "description": {
         "name": "build_runner_core",
-        "sha256": "e3c79f69a64bdfcd8a776a3c28db4eb6e3fb5356d013ae5eb2e52007706d5dbe",
+        "sha256": "f8126682b87a7282a339b871298cc12009cb67109cfa1614d6436fb0289193e0",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "7.3.1"
+      "version": "7.3.2"
     },
     "built_collection": {
       "dependency": "transitive",
@@ -295,21 +301,21 @@
       "dependency": "direct main",
       "description": {
         "name": "chopper",
-        "sha256": "6b2f5681f2bdca65a1fe2372922e797303fa058b6ead765afa88e40e0fd61071",
+        "sha256": "40899b729fb6d8969d967264b189efaf2452bc3ccf6ed0782d00f1d8a6161c31",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "8.0.2"
+      "version": "8.0.3"
     },
     "chopper_generator": {
       "dependency": "direct dev",
       "description": {
         "name": "chopper_generator",
-        "sha256": "7d25ad17062a9b671020f96082ed5f8ee85e18137beb74aca4620137ae6ea523",
+        "sha256": "de438569cba1e2a2888e8d91e3c2ac60106574eea7f36823ed0334e96146328a",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "8.0.2"
+      "version": "8.0.3"
     },
     "ci": {
       "dependency": "transitive",
@@ -455,11 +461,11 @@
       "dependency": "transitive",
       "description": {
         "name": "dart_style",
-        "sha256": "99e066ce75c89d6b29903d788a7bb9369cf754f7b24bf70bf4b6d6d6b26853b9",
+        "sha256": "7856d364b589d1f08986e140938578ed36ed948581fbc3bc9aef1805039ac5ab",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "2.3.6"
+      "version": "2.3.7"
     },
     "dartx": {
       "dependency": "transitive",
@@ -485,11 +491,11 @@
       "dependency": "direct main",
       "description": {
         "name": "device_info_plus",
-        "sha256": "a7fd703482b391a87d60b6061d04dfdeab07826b96f9abd8f5ed98068acc0074",
+        "sha256": "c4af09051b4f0508f6c1dc0a5c085bf014d5c9a4a0678ce1799c2b4d716387a0",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "10.1.2"
+      "version": "11.1.0"
     },
     "device_info_plus_platform_interface": {
       "dependency": "transitive",
@@ -515,11 +521,11 @@
       "dependency": "transitive",
       "description": {
         "name": "fading_edge_scrollview",
-        "sha256": "c25c2231652ce774cc31824d0112f11f653881f43d7f5302c05af11942052031",
+        "sha256": "1f84fe3ea8e251d00d5735e27502a6a250e4aa3d3b330d3fdcb475af741464ef",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "3.0.0"
+      "version": "4.1.1"
     },
     "fake_async": {
       "dependency": "transitive",
@@ -555,11 +561,11 @@
       "dependency": "direct main",
       "description": {
         "name": "file_picker",
-        "sha256": "825aec673606875c33cd8d3c4083f1a3c3999015a84178b317b7ef396b7384f3",
+        "sha256": "aac85f20436608e01a6ffd1fdd4e746a7f33c93a2c83752e626bdfaea139b877",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "8.0.7"
+      "version": "8.1.3"
     },
     "file_sizes": {
       "dependency": "direct main",
@@ -601,11 +607,11 @@
       "dependency": "direct main",
       "description": {
         "name": "flutter_cache_manager",
-        "sha256": "8207f27539deb83732fdda03e259349046a39a4c767269285f449ade355d54ba",
+        "sha256": "400b6592f16a4409a7f2bb929a9a7e38c72cceb8ffb99ee57bbf2cb2cecf8386",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "3.3.1"
+      "version": "3.4.1"
     },
     "flutter_gen_core": {
       "dependency": "transitive",
@@ -631,21 +637,21 @@
       "dependency": "direct dev",
       "description": {
         "name": "flutter_launcher_icons",
-        "sha256": "526faf84284b86a4cb36d20a5e45147747b7563d921373d4ee0559c54fcdbcea",
+        "sha256": "619817c4b65b322b5104b6bb6dfe6cda62d9729bd7ad4303ecc8b4e690a67a77",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "0.13.1"
+      "version": "0.14.1"
     },
     "flutter_lints": {
       "dependency": "direct dev",
       "description": {
         "name": "flutter_lints",
-        "sha256": "3f41d009ba7172d5ff9be5f6e6e6abb4300e263aab8866d2a0842ed2a70f8f0c",
+        "sha256": "5398f14efa795ffb7a33e9b6a08798b26a180edac4ad7db3f231e40f82ce11e1",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "4.0.0"
+      "version": "5.0.0"
     },
     "flutter_localizations": {
       "dependency": "direct main",
@@ -667,21 +673,21 @@
       "dependency": "direct main",
       "description": {
         "name": "flutter_riverpod",
-        "sha256": "0f1974eff5bbe774bf1d870e406fc6f29e3d6f1c46bd9c58e7172ff68a785d7d",
+        "sha256": "9532ee6db4a943a1ed8383072a2e3eeda041db5657cdf6d2acecf3c21ecbe7e1",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "2.5.1"
+      "version": "2.6.1"
     },
     "flutter_rust_bridge": {
       "dependency": "transitive",
       "description": {
         "name": "flutter_rust_bridge",
-        "sha256": "e12415c3bce49bcbc3fed383f0ea41ad7d828f6cf0eccba0588ffa5a812fe522",
+        "sha256": "0ad5079de35d317650fec59b26cb4d0c116ebc2ce703a29f9367513b8a91c287",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "1.82.1"
+      "version": "2.5.0"
     },
     "flutter_staggered_grid_view": {
       "dependency": "transitive",
@@ -697,21 +703,31 @@
       "dependency": "direct main",
       "description": {
         "name": "flutter_sticky_header",
-        "sha256": "017f398fbb45a589e01491861ca20eb6570a763fd9f3888165a978e11248c709",
+        "sha256": "7f76d24d119424ca0c95c146b8627a457e8de8169b0d584f766c2c545db8f8be",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "0.6.5"
+      "version": "0.7.0"
+    },
+    "flutter_svg": {
+      "dependency": "direct main",
+      "description": {
+        "name": "flutter_svg",
+        "sha256": "7b4ca6cf3304575fe9c8ec64813c8d02ee41d2afe60bcfe0678bcb5375d596a2",
+        "url": "https://pub.dev"
+      },
+      "source": "hosted",
+      "version": "2.0.10+1"
     },
     "flutter_tabler_icons": {
       "dependency": "direct main",
       "description": {
         "name": "flutter_tabler_icons",
-        "sha256": "08581b2d87e41c86e3acb7cf48482f1a1775e4ed37febc02ca1b99a221836580",
+        "sha256": "657c2201e12fa9121a12ddb4edb74d69290f803868eb6526f04102e6d49ec882",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "1.40.0"
+      "version": "1.43.0"
     },
     "flutter_test": {
       "dependency": "direct dev",
@@ -958,12 +974,11 @@
     "isar_generator": {
       "dependency": "direct dev",
       "description": {
-        "path": "packages/isar_generator",
-        "ref": "70a5abd2b36d265a2eef0141f98f312a8710e60c",
-        "resolved-ref": "70a5abd2b36d265a2eef0141f98f312a8710e60c",
-        "url": "https://github.com/ndelanou/isar.git"
+        "name": "isar_generator",
+        "sha256": "76c121e1295a30423604f2f819bc255bc79f852f3bc8743a24017df6068ad133",
+        "url": "https://pub.dev"
       },
-      "source": "git",
+      "source": "hosted",
       "version": "3.1.0+1"
     },
     "js": {
@@ -1000,21 +1015,21 @@
       "dependency": "direct main",
       "description": {
         "name": "just_audio",
-        "sha256": "d8e8aaf417d33e345299c17f6457f72bd4ba0c549dc34607abb5183a354edc4d",
+        "sha256": "b41646a8241688f1d99c2e69c4da2bb26aa4b3a99795f6ff205c2a165e033fda",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "0.9.40"
+      "version": "0.9.41"
     },
     "just_audio_media_kit": {
       "dependency": "direct main",
       "description": {
         "name": "just_audio_media_kit",
-        "sha256": "7f57d317fafa04cb3e70b924e8f632ffb7eca7a97a369e1e44738ed89fbd5da1",
+        "sha256": "9f3517213dfc7bbaf6980656feb66c35600f114c7efc0b5b3f4476cd5c18b45e",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "2.0.5"
+      "version": "2.0.6"
     },
     "just_audio_platform_interface": {
       "dependency": "transitive",
@@ -1030,11 +1045,11 @@
       "dependency": "transitive",
       "description": {
         "name": "just_audio_web",
-        "sha256": "b163878529d9b028c53a6972fcd58cae2405bcd11cbfcea620b6fb9f151429d6",
+        "sha256": "9a98035b8b24b40749507687520ec5ab404e291d2b0937823ff45d92cb18d448",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "0.4.12"
+      "version": "0.4.13"
     },
     "leak_tracker": {
       "dependency": "transitive",
@@ -1070,11 +1085,11 @@
       "dependency": "transitive",
       "description": {
         "name": "lints",
-        "sha256": "976c774dd944a42e83e2467f4cc670daef7eed6295b10b36ae8c85bcbf828235",
+        "sha256": "3315600f3fb3b135be672bf4a178c55f274bebe368325ae18462c89ac1e3b413",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "4.0.0"
+      "version": "5.0.0"
     },
     "locale_names": {
       "dependency": "direct main",
@@ -1090,21 +1105,31 @@
       "dependency": "direct main",
       "description": {
         "name": "logging",
-        "sha256": "623a88c9594aa774443aa3eb2d41807a48486b5613e67599fb4c41c0ad47c340",
+        "sha256": "c8245ada5f1717ed44271ed1c26b8ce85ca3228fd2ffdb75468ab01979309d61",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "1.2.0"
+      "version": "1.3.0"
+    },
+    "macros": {
+      "dependency": "transitive",
+      "description": {
+        "name": "macros",
+        "sha256": "0acaed5d6b7eab89f63350bccd82119e6c602df0f391260d0e32b5e23db79536",
+        "url": "https://pub.dev"
+      },
+      "source": "hosted",
+      "version": "0.1.2-main.4"
     },
     "marquee": {
       "dependency": "direct main",
       "description": {
         "name": "marquee",
-        "sha256": "4b5243d2804373bdc25fc93d42c3b402d6ec1f4ee8d0bb72276edd04ae7addb8",
+        "sha256": "a87e7e80c5d21434f90ad92add9f820cf68be374b226404fe881d2bba7be0862",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "2.2.3"
+      "version": "2.3.0"
     },
     "matcher": {
       "dependency": "transitive",
@@ -1177,16 +1202,6 @@
       "source": "hosted",
       "version": "1.0.6"
     },
-    "mini_music_visualizer": {
-      "dependency": "direct main",
-      "description": {
-        "name": "mini_music_visualizer",
-        "sha256": "779a957424ce9a09cc00989a8cf9b7541ec22316d9781a43e701afa6acacf274",
-        "url": "https://pub.dev"
-      },
-      "source": "hosted",
-      "version": "1.1.4"
-    },
     "msix": {
       "dependency": "direct dev",
       "description": {
@@ -1468,25 +1483,15 @@
       "source": "hosted",
       "version": "1.3.0"
     },
-    "puppeteer": {
-      "dependency": "transitive",
-      "description": {
-        "name": "puppeteer",
-        "sha256": "871140cbcc1bcbc6d8e4c2c6ca8fdeed5fae66dfef1efc4c271160a96e0823f9",
-        "url": "https://pub.dev"
-      },
-      "source": "hosted",
-      "version": "3.14.0"
-    },
     "qs_dart": {
       "dependency": "transitive",
       "description": {
         "name": "qs_dart",
-        "sha256": "8dddeaf1d32fe407e253840b2c25c9ab5bf347d2761d82cb4ce010096565c9ff",
+        "sha256": "be73d060d29c0716ded88380ba32e87ce8105f0ba234edb3edefa0d74d47d64b",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "1.2.3"
+      "version": "1.2.4"
     },
     "recursive_regex": {
       "dependency": "transitive",
@@ -1502,51 +1507,51 @@
       "dependency": "transitive",
       "description": {
         "name": "riverpod",
-        "sha256": "f21b32ffd26a36555e501b04f4a5dca43ed59e16343f1a30c13632b2351dfa4d",
+        "sha256": "59062512288d3056b2321804332a13ffdd1bf16df70dcc8e506e411280a72959",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "2.5.1"
+      "version": "2.6.1"
     },
     "riverpod_analyzer_utils": {
       "dependency": "transitive",
       "description": {
         "name": "riverpod_analyzer_utils",
-        "sha256": "8b71f03fc47ae27d13769496a1746332df4cec43918aeba9aff1e232783a780f",
+        "sha256": "0dcb0af32d561f8fa000c6a6d95633c9fb08ea8a8df46e3f9daca59f11218167",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "0.5.1"
+      "version": "0.5.6"
     },
     "riverpod_annotation": {
       "dependency": "direct main",
       "description": {
         "name": "riverpod_annotation",
-        "sha256": "e5e796c0eba4030c704e9dae1b834a6541814963292839dcf9638d53eba84f5c",
+        "sha256": "e14b0bf45b71326654e2705d462f21b958f987087be850afd60578fcd502d1b8",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "2.3.5"
+      "version": "2.6.1"
     },
     "riverpod_generator": {
       "dependency": "direct dev",
       "description": {
         "name": "riverpod_generator",
-        "sha256": "d451608bf17a372025fc36058863737636625dfdb7e3cbf6142e0dfeb366ab22",
+        "sha256": "851aedac7ad52693d12af3bf6d92b1626d516ed6b764eb61bf19e968b5e0b931",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "2.4.0"
+      "version": "2.6.1"
     },
     "riverpod_lint": {
       "dependency": "direct dev",
       "description": {
         "name": "riverpod_lint",
-        "sha256": "3c67c14ccd16f0c9d53e35ef70d06cd9d072e2fb14557326886bbde903b230a5",
+        "sha256": "0684c21a9a4582c28c897d55c7b611fa59a351579061b43f8c92c005804e63a8",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "2.3.10"
+      "version": "2.6.1"
     },
     "rxdart": {
       "dependency": "direct main",
@@ -1572,11 +1577,51 @@
       "dependency": "transitive",
       "description": {
         "name": "screen_retriever",
-        "sha256": "6ee02c8a1158e6dae7ca430da79436e3b1c9563c8cf02f524af997c201ac2b90",
+        "sha256": "570dbc8e4f70bac451e0efc9c9bb19fa2d6799a11e6ef04f946d7886d2e23d0c",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "0.1.9"
+      "version": "0.2.0"
+    },
+    "screen_retriever_linux": {
+      "dependency": "transitive",
+      "description": {
+        "name": "screen_retriever_linux",
+        "sha256": "f7f8120c92ef0784e58491ab664d01efda79a922b025ff286e29aa123ea3dd18",
+        "url": "https://pub.dev"
+      },
+      "source": "hosted",
+      "version": "0.2.0"
+    },
+    "screen_retriever_macos": {
+      "dependency": "transitive",
+      "description": {
+        "name": "screen_retriever_macos",
+        "sha256": "71f956e65c97315dd661d71f828708bd97b6d358e776f1a30d5aa7d22d78a149",
+        "url": "https://pub.dev"
+      },
+      "source": "hosted",
+      "version": "0.2.0"
+    },
+    "screen_retriever_platform_interface": {
+      "dependency": "transitive",
+      "description": {
+        "name": "screen_retriever_platform_interface",
+        "sha256": "ee197f4581ff0d5608587819af40490748e1e39e648d7680ecf95c05197240c0",
+        "url": "https://pub.dev"
+      },
+      "source": "hosted",
+      "version": "0.2.0"
+    },
+    "screen_retriever_windows": {
+      "dependency": "transitive",
+      "description": {
+        "name": "screen_retriever_windows",
+        "sha256": "449ee257f03ca98a57288ee526a301a430a344a161f9202b4fcc38576716fe13",
+        "url": "https://pub.dev"
+      },
+      "source": "hosted",
+      "version": "0.2.0"
     },
     "scroll_to_index": {
       "dependency": "direct main",
@@ -1592,21 +1637,21 @@
       "dependency": "direct main",
       "description": {
         "name": "share_plus",
-        "sha256": "ef3489a969683c4f3d0239010cc8b7a2a46543a8d139e111c06c558875083544",
+        "sha256": "3af2cda1752e5c24f2fc04b6083b40f013ffe84fb90472f30c6499a9213d5442",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "9.0.0"
+      "version": "10.1.1"
     },
     "share_plus_platform_interface": {
       "dependency": "transitive",
       "description": {
         "name": "share_plus_platform_interface",
-        "sha256": "0f9e4418835d1b2c3ae78fdb918251959106cefdbc4dd43526e182f80e82f6d4",
+        "sha256": "c57c0bbfec7142e3a0f55633be504b796af72e60e3c791b44d5a017b985f7a48",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "4.0.0"
+      "version": "5.0.1"
     },
     "shelf": {
       "dependency": "transitive",
@@ -1618,16 +1663,6 @@
       "source": "hosted",
       "version": "1.4.1"
     },
-    "shelf_static": {
-      "dependency": "transitive",
-      "description": {
-        "name": "shelf_static",
-        "sha256": "c87c3875f91262785dade62d135760c2c69cb217ac759485334c5857ad89f6e3",
-        "url": "https://pub.dev"
-      },
-      "source": "hosted",
-      "version": "1.1.3"
-    },
     "shelf_web_socket": {
       "dependency": "transitive",
       "description": {
@@ -1668,11 +1703,11 @@
       "dependency": "direct main",
       "description": {
         "name": "smtc_windows",
-        "sha256": "799bbe0f8e4436da852c5dcc0be482c97b8ae0f504f65c6b750cd239b4835aa0",
+        "sha256": "80f7c10867da485ffdf87f842bf27e6763589933c18c11af5dc1cd1e158c3154",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "0.1.2"
+      "version": "1.0.0"
     },
     "source_gen": {
       "dependency": "transitive",
@@ -1715,25 +1750,35 @@
       "source": "git",
       "version": "3.2.1"
     },
+    "sprintf": {
+      "dependency": "transitive",
+      "description": {
+        "name": "sprintf",
+        "sha256": "1fc9ffe69d4df602376b52949af107d8f5703b77cda567c4d7d86a0693120f23",
+        "url": "https://pub.dev"
+      },
+      "source": "hosted",
+      "version": "7.0.0"
+    },
     "sqflite": {
       "dependency": "transitive",
       "description": {
         "name": "sqflite",
-        "sha256": "a43e5a27235518c03ca238e7b4732cf35eabe863a369ceba6cbefa537a66f16d",
+        "sha256": "ff5a2436ef8ebdfda748fbfe957f9981524cb5ff11e7bafa8c42771840e8a788",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "2.3.3+1"
+      "version": "2.3.3+2"
     },
     "sqflite_common": {
       "dependency": "transitive",
       "description": {
         "name": "sqflite_common",
-        "sha256": "3da423ce7baf868be70e2c0976c28a1bb2f73644268b7ffa7d2e08eab71f16a4",
+        "sha256": "2d8e607db72e9cb7748c9c6e739e2c9618320a5517de693d5a24609c4671b1a4",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "2.5.4"
+      "version": "2.5.4+4"
     },
     "stack_trace": {
       "dependency": "transitive",
@@ -1789,11 +1834,11 @@
       "dependency": "transitive",
       "description": {
         "name": "synchronized",
-        "sha256": "539ef412b170d65ecdafd780f924e5be3f60032a1128df156adad6c5b373d558",
+        "sha256": "69fe30f3a8b04a0be0c15ae6490fc859a78ef4c43ae2dd5e8a623d45bfcf9225",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "3.1.0+1"
+      "version": "3.3.0+3"
     },
     "term_glyph": {
       "dependency": "transitive",
@@ -1835,16 +1880,6 @@
       "source": "hosted",
       "version": "1.0.1"
     },
-    "tuple": {
-      "dependency": "transitive",
-      "description": {
-        "name": "tuple",
-        "sha256": "a97ce2013f240b2f3807bcbaf218765b6f301c3eff91092bcfa23a039e7dd151",
-        "url": "https://pub.dev"
-      },
-      "source": "hosted",
-      "version": "2.0.2"
-    },
     "typed_data": {
       "dependency": "transitive",
       "description": {
@@ -1899,21 +1934,21 @@
       "dependency": "direct main",
       "description": {
         "name": "url_launcher",
-        "sha256": "21b704ce5fa560ea9f3b525b43601c678728ba46725bab9b01187b4831377ed3",
+        "sha256": "9d06212b1362abc2f0f0d78e6f09f726608c74e3b9462e8368bb03314aa8d603",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "6.3.0"
+      "version": "6.3.1"
     },
     "url_launcher_android": {
       "dependency": "transitive",
       "description": {
         "name": "url_launcher_android",
-        "sha256": "f0c73347dfcfa5b3db8bc06e1502668265d39c08f310c29bff4e28eea9699f79",
+        "sha256": "e35a698ac302dd68e41f73250bd9517fe3ab5fa4f18fe4647a0872db61bacbab",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "6.3.9"
+      "version": "6.3.10"
     },
     "url_launcher_ios": {
       "dependency": "transitive",
@@ -1939,11 +1974,11 @@
       "dependency": "transitive",
       "description": {
         "name": "url_launcher_macos",
-        "sha256": "9a1a42d5d2d95400c795b2914c36fdcb525870c752569438e4ebb09a2b5d90de",
+        "sha256": "769549c999acdb42b8bcfa7c43d72bf79a382ca7441ab18a808e101149daf672",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "3.2.0"
+      "version": "3.2.1"
     },
     "url_launcher_platform_interface": {
       "dependency": "transitive",
@@ -1979,21 +2014,31 @@
       "dependency": "direct main",
       "description": {
         "name": "uuid",
-        "sha256": "648e103079f7c64a36dc7d39369cabb358d377078a051d6ae2ad3aa539519313",
+        "sha256": "a5be9ef6618a7ac1e964353ef476418026db906c4facdedaa299b7a2e71690ff",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "3.0.7"
+      "version": "4.5.1"
     },
     "value_layout_builder": {
       "dependency": "transitive",
       "description": {
         "name": "value_layout_builder",
-        "sha256": "98202ec1807e94ac72725b7f0d15027afde513c55c69ff3f41bcfccb950831bc",
+        "sha256": "c02511ea91ca5c643b514a33a38fa52536f74aa939ec367d02938b5ede6807fa",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "0.3.1"
+      "version": "0.4.0"
+    },
+    "vector_graphics": {
+      "dependency": "transitive",
+      "description": {
+        "name": "vector_graphics",
+        "sha256": "32c3c684e02f9bc0afb0ae0aa653337a2fe022e8ab064bcd7ffda27a74e288e3",
+        "url": "https://pub.dev"
+      },
+      "source": "hosted",
+      "version": "1.1.11+1"
     },
     "vector_graphics_codec": {
       "dependency": "transitive",
@@ -2089,51 +2134,51 @@
       "dependency": "transitive",
       "description": {
         "name": "web",
-        "sha256": "97da13628db363c635202ad97068d47c5b8aa555808e7a9411963c533b449b27",
+        "sha256": "cd3543bd5798f6ad290ea73d210f423502e71900302dde696f8bff84bf89a1cb",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "0.5.1"
+      "version": "1.1.0"
     },
     "web_socket_channel": {
       "dependency": "transitive",
       "description": {
         "name": "web_socket_channel",
-        "sha256": "58c6666b342a38816b2e7e50ed0f1e261959630becd4c879c4f26bfa14aa5a42",
+        "sha256": "d88238e5eac9a42bb43ca4e721edba3c08c6354d4a53063afaa568516217621b",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "2.4.5"
+      "version": "2.4.0"
     },
     "win32": {
       "dependency": "transitive",
       "description": {
         "name": "win32",
-        "sha256": "68d1e89a91ed61ad9c370f9f8b6effed9ae5e0ede22a270bdfa6daf79fc2290a",
+        "sha256": "4d45dc9069dba4619dc0ebd93c7cec5e66d8482cb625a370ac806dcc8165f2ec",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "5.5.4"
+      "version": "5.5.5"
     },
     "win32_registry": {
       "dependency": "transitive",
       "description": {
         "name": "win32_registry",
-        "sha256": "723b7f851e5724c55409bb3d5a32b203b3afe8587eaf5dafb93a5fed8ecda0d6",
+        "sha256": "21ec76dfc731550fd3e2ce7a33a9ea90b828fdf19a5c3bcf556fa992cfa99852",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "1.1.4"
+      "version": "1.1.5"
     },
     "window_manager": {
       "dependency": "direct main",
       "description": {
         "name": "window_manager",
-        "sha256": "8699323b30da4cdbe2aa2e7c9de567a6abd8a97d9a5c850a3c86dcd0b34bbfbf",
+        "sha256": "732896e1416297c63c9e3fb95aea72d0355f61390263982a47fd519169dc5059",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "0.3.9"
+      "version": "0.4.3"
     },
     "xdg_directories": {
       "dependency": "transitive",
@@ -2159,11 +2204,11 @@
       "dependency": "transitive",
       "description": {
         "name": "xxh3",
-        "sha256": "a92b30944a9aeb4e3d4f3c3d4ddb3c7816ca73475cd603682c4f8149690f56d7",
+        "sha256": "cbeb0e1d10f4c6bf67b650f395eac0cc689425b5efc2ba0cc3d3e069a0beaeec",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "1.0.1"
+      "version": "1.1.0"
     },
     "yaml": {
       "dependency": "transitive",
@@ -2177,7 +2222,7 @@
     }
   },
   "sdks": {
-    "dart": ">=3.4.0 <4.0.0",
-    "flutter": ">=3.22.0"
+    "dart": ">=3.5.0 <4.0.0",
+    "flutter": ">=3.24.0"
   }
 }

pkgs/by-name/fr/frigate/package.nix

@@ -29,6 +29,12 @@ let
     };
   };
 
+  # Tensorflow audio model
+  tflite_audio_model = fetchurl {
+    url = "https://www.kaggle.com/api/v1/models/google/yamnet/tfLite/classification-tflite/1/download";
+    hash = "sha256-G5cbITJ2AnOl+49dxQToZ4OyeFO7MTXVVa4G8eHjZfM=";
+  };
+
   # Tensorflow Lite models
   # https://github.com/blakeblackshear/frigate/blob/v0.13.0/docker/main/Dockerfile#L96-L97
   tflite_cpu_model = fetchurl {
@@ -72,14 +78,22 @@ python.pkgs.buildPythonApplication rec {
     substituteInPlace frigate/detectors/detector_config.py \
       --replace-fail "/labelmap.txt" "${placeholder "out"}/share/frigate/labelmap.txt"
 
+    substituteInPlace frigate/output/birdseye.py \
+      --replace-fail "/opt/frigate/" "${placeholder "out"}/${python.sitePackages}/"
+
     # work around onvif-zeep idiosyncrasy
     substituteInPlace frigate/ptz/onvif.py \
       --replace-fail dist-packages site-packages
 
+    # provide default paths for models and maps that are shipped with frigate
     substituteInPlace frigate/config.py \
       --replace-fail "/cpu_model.tflite" "${tflite_cpu_model}" \
       --replace-fail "/edgetpu_model.tflite" "${tflite_edgetpu_model}"
 
+    substituteInPlace frigate/events/audio.py \
+      --replace-fail "/cpu_audio_model.tflite" "${placeholder "out"}/share/frigate/cpu_audio_model.tflite" \
+      --replace-fail "/audio-labelmap.txt" "${placeholder "out"}/share/frigate/audio-labelmap.txt"
+
     substituteInPlace frigate/test/test_config.py \
       --replace-fail "(MODEL_CACHE_DIR" "('/build/model_cache'" \
       --replace-fail "/config/model_cache" "/build/model_cache"
@@ -131,7 +145,10 @@ python.pkgs.buildPythonApplication rec {
     cp -R frigate/* $out/${python.sitePackages}/frigate/
 
     mkdir -p $out/share/frigate
-    cp -R {migrations,labelmap.txt} $out/share/frigate/
+    cp -R {migrations,labelmap.txt,audio-labelmap.txt} $out/share/frigate/
+
+    tar --extract --gzip --file ${tflite_audio_model}
+    cp --no-preserve=mode ./1.tflite $out/share/frigate/cpu_audio_model.tflite
 
     cp --no-preserve=mode ${openvino_model} $out/share/frigate/coco_91cl_bkgr.txt
     sed -i 's/truck/car/g' $out/share/frigate/coco_91cl_bkgr.txt

pkgs/by-name/gi/github-runner/deps.nix

@@ -2,43 +2,41 @@
 # Please dont edit it manually, your changes might get overwritten!
 
 { fetchNuGet }: [
-  (fetchNuGet { pname = "Azure.Core"; version = "1.36.0"; hash = "sha256-lokfjW2wvgFu6bALLzNmDhXIz3HXoPuGX0WfGb9hmpI="; })
-  (fetchNuGet { pname = "Azure.Storage.Blobs"; version = "12.19.1"; hash = "sha256-E7QHJrhQjQjGhFq4GoQpyVGR6uKfA91NGcyziRfdr2U="; })
-  (fetchNuGet { pname = "Azure.Storage.Common"; version = "12.18.1"; hash = "sha256-M10Ov1bBV1/U8R3Sp05apS3qFHONQRmAQakQsd17X8I="; })
-  (fetchNuGet { pname = "Castle.Core"; version = "4.4.0"; hash = "sha256-7hLBAHnB+drr2yU4w3o05eMX2ADy/rXN3XRPBn1d7GY="; })
-  (fetchNuGet { pname = "Microsoft.AspNet.WebApi.Client"; version = "5.2.9"; hash = "sha256-CCytWp0v8C6NZa+o4cRXvA2u/ZOEA3TiG9+luszAwes="; })
-  (fetchNuGet { pname = "Microsoft.Bcl.AsyncInterfaces"; version = "1.1.1"; hash = "sha256-fAcX4sxE0veWM1CZBtXR/Unky+6sE33yrV7ohrWGKig="; })
-  (fetchNuGet { pname = "Microsoft.CodeCoverage"; version = "17.2.0"; hash = "sha256-ckbeFz5ArvZUE7w3EYiciBIGlmbmjwpxqWeAOEKgHgU="; })
-  (fetchNuGet { pname = "Microsoft.CSharp"; version = "4.0.1"; hash = "sha256-0huoqR2CJ3Z9Q2peaKD09TV3E6saYSqDGZ290K8CrH8="; })
-  (fetchNuGet { pname = "Microsoft.IdentityModel.Logging"; version = "5.2.1"; hash = "sha256-b1wK8yssiKQxsFO7FFNQAffEu9r8c3YPcIY+UWVS874="; })
-  (fetchNuGet { pname = "Microsoft.IdentityModel.Tokens"; version = "5.2.1"; hash = "sha256-APBQ+v+2RvfE98sHXzEIjujGYvMzut4RtpGHvAsJZg8="; })
-  (fetchNuGet { pname = "Microsoft.NET.Test.Sdk"; version = "17.2.0"; hash = "sha256-IXyc+oc7EwalDaq+UkkWx3bhZC/H+SZ8rTHMi87Allk="; })
-  (fetchNuGet { pname = "Microsoft.NETCore.Platforms"; version = "1.0.1"; hash = "sha256-mZotlGZqtrqDSoBrZhsxFe6fuOv5/BIo0w2Z2x0zVAU="; })
+  (fetchNuGet { pname = "Azure.Core"; version = "1.44.1"; hash = "sha256-0su/ylZ68+FDZ6mgfp3qsm7qpfPtD5SW75HXbVhs5qk="; })
+  (fetchNuGet { pname = "Azure.Storage.Blobs"; version = "12.23.0"; hash = "sha256-SMSelOQaPwRTv4qrgM1oIW0122KaMt4nBhHW1EzQg7Q="; })
+  (fetchNuGet { pname = "Azure.Storage.Common"; version = "12.22.0"; hash = "sha256-mgE5u4uqEN/qxSE2K6d/nr3uIW9ZBXFkBKBUKWJwzwM="; })
+  (fetchNuGet { pname = "Castle.Core"; version = "5.1.1"; hash = "sha256-oVkQB+ON7S6Q27OhXrTLaxTL0kWB58HZaFFuiw4iTrE="; })
+  (fetchNuGet { pname = "Microsoft.AspNet.WebApi.Client"; version = "6.0.0"; hash = "sha256-lNL5C4W7/p8homWooO/3ZKDZQ2M0FUTDixJwqWBPVbo="; })
+  (fetchNuGet { pname = "Microsoft.Bcl.AsyncInterfaces"; version = "6.0.0"; hash = "sha256-49+H/iFwp+AfCICvWcqo9us4CzxApPKC37Q5Eqrw+JU="; })
+  (fetchNuGet { pname = "Microsoft.CodeCoverage"; version = "17.8.0"; hash = "sha256-cv/wAXfTNS+RWEsHWNKqRDHC7LOQSSdFJ1a9cZuSfJw="; })
+  (fetchNuGet { pname = "Microsoft.IdentityModel.Abstractions"; version = "7.5.1"; hash = "sha256-q4Q9HtdGbjfih1QegppYaJh1ZrzCzQ56NXM7lQ9ZvU0="; })
+  (fetchNuGet { pname = "Microsoft.IdentityModel.JsonWebTokens"; version = "7.5.1"; hash = "sha256-/Xuu3mzeicfMP4elmXkJvBLsoAye7c57sX+fRmE9yds="; })
+  (fetchNuGet { pname = "Microsoft.IdentityModel.Logging"; version = "7.5.1"; hash = "sha256-Tro3KKW/WjAnVoaMcOwvLybp+/Mm8GCObS7DPbrNCv4="; })
+  (fetchNuGet { pname = "Microsoft.IdentityModel.Tokens"; version = "7.5.1"; hash = "sha256-gf0QQMx+/n8AMoH5Yrq17ndbAeFkN95qGVRxmI7J0pE="; })
+  (fetchNuGet { pname = "Microsoft.NET.Test.Sdk"; version = "17.8.0"; hash = "sha256-uz7QvW+NsVRsp8FR1wjnGEOkUaPX4JyieywvCN6g2+s="; })
   (fetchNuGet { pname = "Microsoft.NETCore.Platforms"; version = "1.0.1-rc2-24027"; hash = "sha256-qNPzjQvYz+X3OGuN/cn3vHGVFkUH1lEPJtlRjbYrHKg="; })
   (fetchNuGet { pname = "Microsoft.NETCore.Platforms"; version = "1.1.0"; hash = "sha256-FeM40ktcObQJk4nMYShB61H/E8B7tIKfl9ObJ0IOcCM="; })
   (fetchNuGet { pname = "Microsoft.NETCore.Platforms"; version = "1.1.1"; hash = "sha256-8hLiUKvy/YirCWlFwzdejD2Db3DaXhHxT7GSZx/znJg="; })
-  (fetchNuGet { pname = "Microsoft.NETCore.Platforms"; version = "2.0.0"; hash = "sha256-IEvBk6wUXSdyCnkj6tHahOJv290tVVT8tyemYcR0Yro="; })
+  (fetchNuGet { pname = "Microsoft.NETCore.Platforms"; version = "5.0.0"; hash = "sha256-LIcg1StDcQLPOABp4JRXIs837d7z0ia6+++3SF3jl1c="; })
   (fetchNuGet { pname = "Microsoft.NETCore.Runtime"; version = "1.0.2-rc2-24027"; hash = "sha256-EO7lnnodbx7XgVWRtqQbYFwwbSFxGB9FRDSgYYJt90Y="; })
   (fetchNuGet { pname = "Microsoft.NETCore.Runtime.CoreCLR"; version = "1.0.2-rc2-24027"; hash = "sha256-vZCfpwHH4vrzj9WPVJt4FeTjsjJf81op0D9Rt82XwBc="; })
   (fetchNuGet { pname = "Microsoft.NETCore.Runtime.Native"; version = "1.0.2-rc2-24027"; hash = "sha256-VOuY8bICze650uP6BzrUc5j/saFidG304VMvaetaF4Y="; })
-  (fetchNuGet { pname = "Microsoft.NETCore.Targets"; version = "1.0.1"; hash = "sha256-lxxw/Gy32xHi0fLgFWNj4YTFBSBkjx5l6ucmbTyf7V4="; })
   (fetchNuGet { pname = "Microsoft.NETCore.Targets"; version = "1.0.1-rc2-24027"; hash = "sha256-sv12e7PuIV06abQV2ms4fotpQCyuufMsIOWoqSUqJMg="; })
   (fetchNuGet { pname = "Microsoft.NETCore.Targets"; version = "1.1.0"; hash = "sha256-0AqQ2gMS8iNlYkrD+BxtIg7cXMnr9xZHtKAuN4bjfaQ="; })
   (fetchNuGet { pname = "Microsoft.NETCore.Targets"; version = "1.1.3"; hash = "sha256-WLsf1NuUfRWyr7C7Rl9jiua9jximnVvzy6nk2D2bVRc="; })
   (fetchNuGet { pname = "Microsoft.NETCore.Windows.ApiSets"; version = "1.0.1-rc2-24027"; hash = "sha256-HezmYiv8wL03Ok3FFBtAULe2yOUjjXfj9wPHE8hNlQw="; })
-  (fetchNuGet { pname = "Microsoft.TestPlatform.ObjectModel"; version = "17.2.0"; hash = "sha256-OwtuyH4rBS2S2mp1rlUQcVxFPS04OWBcUa59+VjVBVA="; })
-  (fetchNuGet { pname = "Microsoft.TestPlatform.TestHost"; version = "17.2.0"; hash = "sha256-ty2fxo3mQESh+cpsGfhSpMCEqmvPdzZE0EK8BkeHaIg="; })
+  (fetchNuGet { pname = "Microsoft.TestPlatform.ObjectModel"; version = "17.8.0"; hash = "sha256-9TwGrjVvbtyetw67Udp3EMK5MX8j0RFRjduxPCs9ESw="; })
+  (fetchNuGet { pname = "Microsoft.TestPlatform.TestHost"; version = "17.8.0"; hash = "sha256-+CTYFu631uovLCO47RKe86YaAqfoLA4r73vKORJUsjg="; })
   (fetchNuGet { pname = "Microsoft.Win32.Primitives"; version = "4.0.1-rc2-24027"; hash = "sha256-4M7HIA69KI8l00CxLC7+UQiXnNiaxG73qltPos0Ba+c="; })
   (fetchNuGet { pname = "Microsoft.Win32.Primitives"; version = "4.3.0"; hash = "sha256-mBNDmPXNTW54XLnPAUwBRvkIORFM7/j0D0I2SyQPDEg="; })
-  (fetchNuGet { pname = "Microsoft.Win32.Registry"; version = "4.4.0"; hash = "sha256-ZumsykAAIYKmVtP4QI5kZ0J10n2zcOZZ69PmAK0SEiE="; })
+  (fetchNuGet { pname = "Microsoft.Win32.Registry"; version = "5.0.0"; hash = "sha256-9kylPGfKZc58yFqNKa77stomcoNnMeERXozWJzDcUIA="; })
   (fetchNuGet { pname = "Minimatch"; version = "2.0.0"; hash = "sha256-oG/s4O/iBEtWsTTe4wvUPfJiYt3oRlsGtALj8FfABM0="; })
-  (fetchNuGet { pname = "Moq"; version = "4.11.0"; hash = "sha256-/JzL3LDxMGV/hKaU85PcWfCMWX6oKrnatFhKpgGadiE="; })
+  (fetchNuGet { pname = "Moq"; version = "4.20.70"; hash = "sha256-O+Ed1Hv8fK8MKaRh7qFGbsSPaTAj4O+yaLQ/W/ju7ks="; })
   (fetchNuGet { pname = "NETStandard.Library"; version = "1.5.0-rc2-24027"; hash = "sha256-lddIyqj8Y3IexOm5I1hsE5w1/dOoOaNDHoUPI1vkX80="; })
-  (fetchNuGet { pname = "NETStandard.Library"; version = "1.6.1"; hash = "sha256-iNan1ix7RtncGWC9AjAZ2sk70DoxOsmEOgQ10fXm4Pw="; })
+  (fetchNuGet { pname = "Newtonsoft.Json"; version = "13.0.1"; hash = "sha256-K2tSVW4n4beRPzPu3rlVaBEMdGvWSv/3Q1fxaDh4Mjo="; })
   (fetchNuGet { pname = "Newtonsoft.Json"; version = "13.0.3"; hash = "sha256-hy/BieY4qxBWVVsDqqOPaLy1QobiIapkbrESm6v2PHc="; })
-  (fetchNuGet { pname = "Newtonsoft.Json"; version = "9.0.1"; hash = "sha256-mYCBrgUhIJFzRuLLV9SIiIFHovzfR8Uuqfg6e08EnlU="; })
-  (fetchNuGet { pname = "Newtonsoft.Json.Bson"; version = "1.0.1"; hash = "sha256-qofIFqViDsdBOE/X0IvzfGUklSrULaH8MoZQ+YrcMOQ="; })
-  (fetchNuGet { pname = "NuGet.Frameworks"; version = "5.11.0"; hash = "sha256-n+hxcrf+sXM80Tv9YH9x4+hwTslVidFq4tjBNPAzYnM="; })
+  (fetchNuGet { pname = "Newtonsoft.Json.Bson"; version = "1.0.2"; hash = "sha256-ZUj6YFSMZp5CZtXiamw49eZmbp1iYBuNsIKNnjxcRzA="; })
+  (fetchNuGet { pname = "NuGet.Frameworks"; version = "6.5.0"; hash = "sha256-ElqfN4CcKxT3hP2qvxxObb4mnBlYG89IMxO0Sm5oZ2g="; })
   (fetchNuGet { pname = "runtime.any.System.Collections"; version = "4.3.0"; hash = "sha256-4PGZqyWhZ6/HCTF2KddDsbmTTjxs2oW79YfkberDZS8="; })
   (fetchNuGet { pname = "runtime.any.System.Diagnostics.Tools"; version = "4.3.0"; hash = "sha256-8yLKFt2wQxkEf7fNfzB+cPUCjYn2qbqNgQ1+EeY2h/I="; })
   (fetchNuGet { pname = "runtime.any.System.Diagnostics.Tracing"; version = "4.3.0"; hash = "sha256-dsmTLGvt8HqRkDWP8iKVXJCS+akAzENGXKPV18W2RgI="; })
@@ -64,7 +62,6 @@
   (fetchNuGet { pname = "runtime.fedora.24-x64.runtime.native.System.Security.Cryptography.OpenSsl"; version = "4.3.2"; hash = "sha256-g9Uiikrl+M40hYe0JMlGHe/lrR0+nN05YF64wzLmBBA="; })
   (fetchNuGet { pname = "runtime.native.System"; version = "4.3.0"; hash = "sha256-ZBZaodnjvLXATWpXXakFgcy6P+gjhshFXmglrL5xD5Y="; })
   (fetchNuGet { pname = "runtime.native.System.IO.Compression"; version = "4.1.0-rc2-24027"; hash = "sha256-K6EYoo5ETbRJmpJpJv8XtPIlnIIHT8tJZgj9rFcBzeI="; })
-  (fetchNuGet { pname = "runtime.native.System.IO.Compression"; version = "4.3.0"; hash = "sha256-DWnXs4vlKoU6WxxvCArTJupV6sX3iBbZh8SbqfHace8="; })
   (fetchNuGet { pname = "runtime.native.System.Net.Http"; version = "4.3.0"; hash = "sha256-c556PyheRwpYhweBjSfIwEyZHnAUB8jWioyKEcp/2dg="; })
   (fetchNuGet { pname = "runtime.native.System.Security.Cryptography.Apple"; version = "4.3.0"; hash = "sha256-2IhBv0i6pTcOyr8FFIyfPEaaCHUmJZ8DYwLUwJ+5waw="; })
   (fetchNuGet { pname = "runtime.native.System.Security.Cryptography.OpenSsl"; version = "4.3.0"; hash = "sha256-Jy01KhtcCl2wjMpZWH+X3fhHcVn+SyllWFY8zWlz/6I="; })
@@ -93,171 +90,112 @@
   (fetchNuGet { pname = "runtime.unix.System.Private.Uri"; version = "4.3.0"; hash = "sha256-c5tXWhE/fYbJVl9rXs0uHh3pTsg44YD1dJvyOA0WoMs="; })
   (fetchNuGet { pname = "runtime.unix.System.Runtime.Extensions"; version = "4.3.0"; hash = "sha256-l8S9gt6dk3qYG6HYonHtdlYtBKyPb29uQ6NDjmrt3V4="; })
   (fetchNuGet { pname = "System.AppContext"; version = "4.1.0-rc2-24027"; hash = "sha256-Tym1nDr/5+VQUa1041eqtfIGF2FJ911V5L8oEZ4eHTA="; })
-  (fetchNuGet { pname = "System.AppContext"; version = "4.3.0"; hash = "sha256-yg95LNQOwFlA1tWxXdQkVyJqT4AnoDc+ACmrNvzGiZg="; })
   (fetchNuGet { pname = "System.Buffers"; version = "4.0.0-rc2-24027"; hash = "sha256-V2pNSn3VniEXZmQzgqU3FTQSqitOEpTGgbHPe5BXFtc="; })
   (fetchNuGet { pname = "System.Buffers"; version = "4.3.0"; hash = "sha256-XqZWb4Kd04960h4U9seivjKseGA/YEIpdplfHYHQ9jk="; })
   (fetchNuGet { pname = "System.Buffers"; version = "4.5.1"; hash = "sha256-wws90sfi9M7kuCPWkv1CEYMJtCqx9QB/kj0ymlsNaxI="; })
-  (fetchNuGet { pname = "System.Collections"; version = "4.0.11"; hash = "sha256-puoFMkx4Z55C1XPxNw3np8nzNGjH+G24j43yTIsDRL0="; })
+  (fetchNuGet { pname = "System.ClientModel"; version = "1.1.0"; hash = "sha256-FiueWJawZGar++OztDFWxU2nQE5Vih9iYsc3uEx0thM="; })
   (fetchNuGet { pname = "System.Collections"; version = "4.0.11-rc2-24027"; hash = "sha256-GCoP5iuHXa1T8fJjqfK1X1OwdFeZHTFS3qwOH497V0Y="; })
   (fetchNuGet { pname = "System.Collections"; version = "4.3.0"; hash = "sha256-afY7VUtD6w/5mYqrce8kQrvDIfS2GXDINDh73IjxJKc="; })
   (fetchNuGet { pname = "System.Collections.Concurrent"; version = "4.0.12-rc2-24027"; hash = "sha256-BCPzxT4h6f9tV0sqxE5uwlDsGrkpZ19ZWjutTQ4uDHo="; })
   (fetchNuGet { pname = "System.Collections.Concurrent"; version = "4.3.0"; hash = "sha256-KMY5DfJnDeIsa13DpqvyN8NkReZEMAFnlmNglVoFIXI="; })
-  (fetchNuGet { pname = "System.Collections.NonGeneric"; version = "4.3.0"; hash = "sha256-8/yZmD4jjvq7m68SPkJZLBQ79jOTOyT5lyzX4SCYAx8="; })
-  (fetchNuGet { pname = "System.Collections.Specialized"; version = "4.3.0"; hash = "sha256-QNg0JJNx+zXMQ26MJRPzH7THdtqjrNtGLUgaR1SdvOk="; })
-  (fetchNuGet { pname = "System.ComponentModel"; version = "4.3.0"; hash = "sha256-i00uujMO4JEDIEPKLmdLY3QJ6vdSpw6Gh9oOzkFYBiU="; })
-  (fetchNuGet { pname = "System.ComponentModel.Primitives"; version = "4.3.0"; hash = "sha256-IOMJleuIBppmP4ECB3uftbdcgL7CCd56+oAD/Sqrbus="; })
-  (fetchNuGet { pname = "System.ComponentModel.TypeConverter"; version = "4.3.0"; hash = "sha256-PSDiPYt8PgTdTUBz+GH6lHCaM1YgfObneHnZsc8Fz54="; })
   (fetchNuGet { pname = "System.Console"; version = "4.0.0-rc2-24027"; hash = "sha256-AYG01PY+ZNvGfvHZADPxbQR27gH4ZpGvY0WDrUYYVRw="; })
-  (fetchNuGet { pname = "System.Console"; version = "4.3.0"; hash = "sha256-Xh3PPBZr0pDbDaK8AEHbdGz7ePK6Yi1ZyRWI1JM6mbo="; })
-  (fetchNuGet { pname = "System.Diagnostics.Debug"; version = "4.0.11"; hash = "sha256-P+rSQJVoN6M56jQbs76kZ9G3mAWFdtF27P/RijN8sj4="; })
   (fetchNuGet { pname = "System.Diagnostics.Debug"; version = "4.0.11-rc2-24027"; hash = "sha256-CiEy6bAdvVz9/rgpOoPRK8SjaJ+6yoKYT3yR+dsEP4c="; })
   (fetchNuGet { pname = "System.Diagnostics.Debug"; version = "4.3.0"; hash = "sha256-fkA79SjPbSeiEcrbbUsb70u9B7wqbsdM9s1LnoKj0gM="; })
   (fetchNuGet { pname = "System.Diagnostics.DiagnosticSource"; version = "4.3.0"; hash = "sha256-OFJRb0ygep0Z3yDBLwAgM/Tkfs4JCDtsNhwDH9cd1Xw="; })
   (fetchNuGet { pname = "System.Diagnostics.DiagnosticSource"; version = "6.0.1"; hash = "sha256-Xi8wrUjVlioz//TPQjFHqcV/QGhTqnTfUcltsNlcCJ4="; })
-  (fetchNuGet { pname = "System.Diagnostics.Tools"; version = "4.0.1"; hash = "sha256-vSBqTbmWXylvRa37aWyktym+gOpsvH43mwr6A962k6U="; })
+  (fetchNuGet { pname = "System.Diagnostics.EventLog"; version = "6.0.0"; hash = "sha256-zUXIQtAFKbiUMKCrXzO4mOTD5EUphZzghBYKXprowSM="; })
+  (fetchNuGet { pname = "System.Diagnostics.EventLog"; version = "8.0.0"; hash = "sha256-rt8xc3kddpQY4HEdghlBeOK4gdw5yIj4mcZhAVtk2/Y="; })
   (fetchNuGet { pname = "System.Diagnostics.Tools"; version = "4.0.1-rc2-24027"; hash = "sha256-ZbujsDeNv/Vj9EqqLxB01AjC+p9Xx2P+n27ewAxqDyA="; })
-  (fetchNuGet { pname = "System.Diagnostics.Tools"; version = "4.3.0"; hash = "sha256-gVOv1SK6Ape0FQhCVlNOd9cvQKBvMxRX9K0JPVi8w0Y="; })
-  (fetchNuGet { pname = "System.Diagnostics.TraceSource"; version = "4.3.0"; hash = "sha256-xpxwaXsRcgso8Gj0cqY4+Hvvz6vZkmEMh5/J204j3M8="; })
   (fetchNuGet { pname = "System.Diagnostics.Tracing"; version = "4.1.0-rc2-24027"; hash = "sha256-pkKcVfskyL57QvM2VyqsS2jYz6bE1NL2gsB6VCkRDCg="; })
   (fetchNuGet { pname = "System.Diagnostics.Tracing"; version = "4.3.0"; hash = "sha256-hCETZpHHGVhPYvb4C0fh4zs+8zv4GPoixagkLZjpa9Q="; })
-  (fetchNuGet { pname = "System.Dynamic.Runtime"; version = "4.0.11"; hash = "sha256-qWqFVxuXioesVftv2RVJZOnmojUvRjb7cS3Oh3oTit4="; })
-  (fetchNuGet { pname = "System.Dynamic.Runtime"; version = "4.3.0"; hash = "sha256-k75gjOYimIQtLBD5NDzwwi3ZMUBPRW3jmc3evDMMJbU="; })
-  (fetchNuGet { pname = "System.Globalization"; version = "4.0.11"; hash = "sha256-rbSgc2PIEc2c2rN6LK3qCREAX3DqA2Nq1WcLrZYsDBw="; })
+  (fetchNuGet { pname = "System.Formats.Asn1"; version = "5.0.0"; hash = "sha256-9nL3dN4w/dZ49W1pCkTjRqZm6Dh0mMVExNungcBHrKs="; })
+  (fetchNuGet { pname = "System.Formats.Asn1"; version = "8.0.0"; hash = "sha256-AVMl6N3SG2AqAcQHFruf2QDQeQIC3CICxID+Sh0vBxI="; })
   (fetchNuGet { pname = "System.Globalization"; version = "4.0.11-rc2-24027"; hash = "sha256-9sLqNlbC6lG30dwyGI62ZeLsKJjLnfVd+1UXlGkwgXo="; })
   (fetchNuGet { pname = "System.Globalization"; version = "4.3.0"; hash = "sha256-caL0pRmFSEsaoeZeWN5BTQtGrAtaQPwFi8YOZPZG5rI="; })
   (fetchNuGet { pname = "System.Globalization.Calendars"; version = "4.0.1-rc2-24027"; hash = "sha256-s3z6l6fJhYcUijzFKOcBxsQONAZBnxGYj8eUliMWGXI="; })
   (fetchNuGet { pname = "System.Globalization.Calendars"; version = "4.3.0"; hash = "sha256-uNOD0EOVFgnS2fMKvMiEtI9aOw00+Pfy/H+qucAQlPc="; })
   (fetchNuGet { pname = "System.Globalization.Extensions"; version = "4.3.0"; hash = "sha256-mmJWA27T0GRVuFP9/sj+4TrR4GJWrzNIk2PDrbr7RQk="; })
-  (fetchNuGet { pname = "System.IdentityModel.Tokens.Jwt"; version = "5.2.1"; hash = "sha256-XWOX7wuuQyUoMZG5Fnk64g7KoVP9y8shxUZE/Wz6wSI="; })
-  (fetchNuGet { pname = "System.IO"; version = "4.1.0"; hash = "sha256-V6oyQFwWb8NvGxAwvzWnhPxy9dKOfj/XBM3tEC5aHrw="; })
+  (fetchNuGet { pname = "System.IdentityModel.Tokens.Jwt"; version = "7.5.1"; hash = "sha256-1pBDkT0aL2xiPg55728rA0FHIqyCNnrv1TYLjuLnMV8="; })
   (fetchNuGet { pname = "System.IO"; version = "4.1.0-rc2-24027"; hash = "sha256-RMvF7LpD7bgXYXUIew2ipUHNVJuY57FsD4K+QY6tmGc="; })
   (fetchNuGet { pname = "System.IO"; version = "4.3.0"; hash = "sha256-ruynQHekFP5wPrDiVyhNiRIXeZ/I9NpjK5pU+HPDiRY="; })
   (fetchNuGet { pname = "System.IO.Compression"; version = "4.1.0-rc2-24027"; hash = "sha256-MqoONpuEllR/UxNmrxa5DN70PvdidVnBbh3GwVv/RR8="; })
-  (fetchNuGet { pname = "System.IO.Compression"; version = "4.3.0"; hash = "sha256-f5PrQlQgj5Xj2ZnHxXW8XiOivaBvfqDao9Sb6AVinyA="; })
   (fetchNuGet { pname = "System.IO.Compression.ZipFile"; version = "4.0.1-rc2-24027"; hash = "sha256-Qo8rUJidNubr1C4HFSJmmCDm852maI81+Fo5m5Pb5lo="; })
-  (fetchNuGet { pname = "System.IO.Compression.ZipFile"; version = "4.3.0"; hash = "sha256-WQl+JgWs+GaRMeiahTFUbrhlXIHapzcpTFXbRvAtvvs="; })
-  (fetchNuGet { pname = "System.IO.FileSystem"; version = "4.0.1"; hash = "sha256-4VKXFgcGYCTWVXjAlniAVq0dO3o5s8KHylg2wg2/7k0="; })
   (fetchNuGet { pname = "System.IO.FileSystem"; version = "4.0.1-rc2-24027"; hash = "sha256-ZhqSoNHIoBGF9nkRF+0XTg849hLVM2ppoGmzZbUe/EI="; })
   (fetchNuGet { pname = "System.IO.FileSystem"; version = "4.3.0"; hash = "sha256-vNIYnvlayuVj0WfRfYKpDrhDptlhp1pN8CYmlVd2TXw="; })
-  (fetchNuGet { pname = "System.IO.FileSystem.AccessControl"; version = "4.4.0"; hash = "sha256-e77Nud0sKDdkAFSrCbQAV3rwzn3iHZ131CSqspdQVoc="; })
-  (fetchNuGet { pname = "System.IO.FileSystem.Primitives"; version = "4.0.1"; hash = "sha256-IpigKMomqb6pmYWkrlf0ZdpILtRluX2cX5sOKVW0Feg="; })
+  (fetchNuGet { pname = "System.IO.FileSystem.AccessControl"; version = "5.0.0"; hash = "sha256-c9MlDKJfj63YRvl7brRBNs59olrmbL+G1A6oTS8ytEc="; })
   (fetchNuGet { pname = "System.IO.FileSystem.Primitives"; version = "4.0.1-rc2-24027"; hash = "sha256-rLcU9Nc9AhGvEX7RMsq+3hlrFu109cp0evHh7nLXAxM="; })
   (fetchNuGet { pname = "System.IO.FileSystem.Primitives"; version = "4.3.0"; hash = "sha256-LMnfg8Vwavs9cMnq9nNH8IWtAtSfk0/Fy4s4Rt9r1kg="; })
   (fetchNuGet { pname = "System.IO.Hashing"; version = "6.0.0"; hash = "sha256-gSxLJ/ujWthLknylguRv40mwMl/qNcqnFI9SNjQY6lE="; })
-  (fetchNuGet { pname = "System.Linq"; version = "4.1.0"; hash = "sha256-ZQpFtYw5N1F1aX0jUK3Tw+XvM5tnlnshkTCNtfVA794="; })
   (fetchNuGet { pname = "System.Linq"; version = "4.1.0-rc2-24027"; hash = "sha256-RFhAtAGpWDdUfsdIqal/E7LmrN1SjE8ZZOoAvIHXi0U="; })
   (fetchNuGet { pname = "System.Linq"; version = "4.3.0"; hash = "sha256-R5uiSL3l6a3XrXSSL6jz+q/PcyVQzEAByiuXZNSqD/A="; })
-  (fetchNuGet { pname = "System.Linq.Expressions"; version = "4.1.0"; hash = "sha256-7zqB+FXgkvhtlBzpcZyd81xczWP0D3uWssyAGw3t7b4="; })
-  (fetchNuGet { pname = "System.Linq.Expressions"; version = "4.3.0"; hash = "sha256-+3pvhZY7rip8HCbfdULzjlC9FPZFpYoQxhkcuFm2wk8="; })
-  (fetchNuGet { pname = "System.Memory.Data"; version = "1.0.2"; hash = "sha256-XiVrVQZQIz4NgjiK/wtH8iZhhOZ9MJ+X2hL2/8BrGN0="; })
-  (fetchNuGet { pname = "System.Net.Http"; version = "4.3.0"; hash = "sha256-UoBB7WPDp2Bne/fwxKF0nE8grJ6FzTMXdT/jfsphj8Q="; })
+  (fetchNuGet { pname = "System.Memory"; version = "4.5.5"; hash = "sha256-EPQ9o1Kin7KzGI5O3U3PUQAZTItSbk9h/i4rViN3WiI="; })
+  (fetchNuGet { pname = "System.Memory.Data"; version = "6.0.0"; hash = "sha256-83/bxn3vyv17dQDDqH1L3yDpluhOxIS5XR27f4OnCEo="; })
   (fetchNuGet { pname = "System.Net.Http"; version = "4.3.4"; hash = "sha256-FMoU0K7nlPLxoDju0NL21Wjlga9GpnAoQjsFhFYYt00="; })
   (fetchNuGet { pname = "System.Net.NameResolution"; version = "4.3.0"; hash = "sha256-eGZwCBExWsnirWBHyp2sSSSXp6g7I6v53qNmwPgtJ5c="; })
   (fetchNuGet { pname = "System.Net.Primitives"; version = "4.0.11-rc2-24027"; hash = "sha256-dUdzPk1YHcPavC0U+5b4/r0cICwAcOZOTMOksRgRm5s="; })
   (fetchNuGet { pname = "System.Net.Primitives"; version = "4.3.0"; hash = "sha256-MY7Z6vOtFMbEKaLW9nOSZeAjcWpwCtdO7/W1mkGZBzE="; })
   (fetchNuGet { pname = "System.Net.Sockets"; version = "4.1.0-rc2-24027"; hash = "sha256-GgOSOyyZzXQw6ubXl5iZeQ8Rx3ZTWdlZ5dCeUPdaUxg="; })
-  (fetchNuGet { pname = "System.Net.Sockets"; version = "4.3.0"; hash = "sha256-il7dr5VT/QWDg/0cuh+4Es2u8LY//+qqiY9BZmYxSus="; })
   (fetchNuGet { pname = "System.Numerics.Vectors"; version = "4.5.0"; hash = "sha256-qdSTIFgf2htPS+YhLGjAGiLN8igCYJnCCo6r78+Q+c8="; })
-  (fetchNuGet { pname = "System.ObjectModel"; version = "4.0.12"; hash = "sha256-MudZ/KYcvYsn2cST3EE049mLikrNkmE7QoUoYKKby+s="; })
   (fetchNuGet { pname = "System.ObjectModel"; version = "4.0.12-rc2-24027"; hash = "sha256-clMUSdm6joAqjATtOdNPbfrrJj8aQwLGmulHx1VCtxg="; })
-  (fetchNuGet { pname = "System.ObjectModel"; version = "4.3.0"; hash = "sha256-gtmRkWP2Kwr3nHtDh0yYtce38z1wrGzb6fjm4v8wN6Q="; })
-  (fetchNuGet { pname = "System.Private.DataContractSerialization"; version = "4.3.0"; hash = "sha256-vNlHUKkaFvhiVnTY0JNsNT5E6TW9CFRzTqVcufGN0hk="; })
   (fetchNuGet { pname = "System.Private.Uri"; version = "4.3.0"; hash = "sha256-fVfgcoP4AVN1E5wHZbKBIOPYZ/xBeSIdsNF+bdukIRM="; })
-  (fetchNuGet { pname = "System.Reflection"; version = "4.1.0"; hash = "sha256-idZHGH2Yl/hha1CM4VzLhsaR8Ljo/rV7TYe7mwRJSMs="; })
   (fetchNuGet { pname = "System.Reflection"; version = "4.1.0-rc2-24027"; hash = "sha256-IkIon2wBRzj7FKhdVQtW10K5qZoQaDa/eClwhiPyJxw="; })
   (fetchNuGet { pname = "System.Reflection"; version = "4.3.0"; hash = "sha256-NQSZRpZLvtPWDlvmMIdGxcVuyUnw92ZURo0hXsEshXY="; })
-  (fetchNuGet { pname = "System.Reflection.Emit"; version = "4.0.1"; hash = "sha256-F1MvYoQWHCY89/O4JBwswogitqVvKuVfILFqA7dmuHk="; })
-  (fetchNuGet { pname = "System.Reflection.Emit"; version = "4.3.0"; hash = "sha256-5LhkDmhy2FkSxulXR+bsTtMzdU3VyyuZzsxp7/DwyIU="; })
-  (fetchNuGet { pname = "System.Reflection.Emit.ILGeneration"; version = "4.0.1"; hash = "sha256-YG+eJBG5P+5adsHiw/lhJwvREnvdHw6CJyS8ZV4Ujd0="; })
-  (fetchNuGet { pname = "System.Reflection.Emit.ILGeneration"; version = "4.3.0"; hash = "sha256-mKRknEHNls4gkRwrEgi39B+vSaAz/Gt3IALtS98xNnA="; })
-  (fetchNuGet { pname = "System.Reflection.Emit.Lightweight"; version = "4.0.1"; hash = "sha256-uVvNOnL64CPqsgZP2OLqNmxdkZl6Q0fTmKmv9gcBi+g="; })
-  (fetchNuGet { pname = "System.Reflection.Emit.Lightweight"; version = "4.3.0"; hash = "sha256-rKx4a9yZKcajloSZHr4CKTVJ6Vjh95ni+zszPxWjh2I="; })
-  (fetchNuGet { pname = "System.Reflection.Extensions"; version = "4.0.1"; hash = "sha256-NsfmzM9G/sN3H8X2cdnheTGRsh7zbRzvegnjDzDH/FQ="; })
   (fetchNuGet { pname = "System.Reflection.Extensions"; version = "4.0.1-rc2-24027"; hash = "sha256-Z1vlqmgENByTMp4/hJdmNWArg5vtwRPUVVuA1Tg//1E="; })
-  (fetchNuGet { pname = "System.Reflection.Extensions"; version = "4.3.0"; hash = "sha256-mMOCYzUenjd4rWIfq7zIX9PFYk/daUyF0A8l1hbydAk="; })
   (fetchNuGet { pname = "System.Reflection.Metadata"; version = "1.6.0"; hash = "sha256-JJfgaPav7UfEh4yRAQdGhLZF1brr0tUWPl6qmfNWq/E="; })
-  (fetchNuGet { pname = "System.Reflection.Primitives"; version = "4.0.1"; hash = "sha256-SFSfpWEyCBMAOerrMCOiKnpT+UAWTvRcmoRquJR6Vq0="; })
   (fetchNuGet { pname = "System.Reflection.Primitives"; version = "4.0.1-rc2-24027"; hash = "sha256-6F/rGfa8Z7BXelXI59xP1SeP/nSScYRpcsnohKLkS/Y="; })
   (fetchNuGet { pname = "System.Reflection.Primitives"; version = "4.3.0"; hash = "sha256-5ogwWB4vlQTl3jjk1xjniG2ozbFIjZTL9ug0usZQuBM="; })
-  (fetchNuGet { pname = "System.Reflection.TypeExtensions"; version = "4.3.0"; hash = "sha256-4U4/XNQAnddgQIHIJq3P2T80hN0oPdU2uCeghsDTWng="; })
-  (fetchNuGet { pname = "System.Reflection.TypeExtensions"; version = "4.4.0"; hash = "sha256-sGgfV4pG9Kr+PLAR/DyRGiTP09Tkvol9U/WLSwkPOVk="; })
-  (fetchNuGet { pname = "System.Resources.ResourceManager"; version = "4.0.1"; hash = "sha256-cZ2/3/fczLjEpn6j3xkgQV9ouOVjy4Kisgw5xWw9kSw="; })
+  (fetchNuGet { pname = "System.Reflection.TypeExtensions"; version = "4.7.0"; hash = "sha256-GEtCGXwtOnkYejSV+Tfl+DqyGq5jTUaVyL9eMupMHBM="; })
   (fetchNuGet { pname = "System.Resources.ResourceManager"; version = "4.0.1-rc2-24027"; hash = "sha256-shu9/tOiZVjniS0YzQq+qe2+sCuqXRtTUJZNCcvEkxo="; })
   (fetchNuGet { pname = "System.Resources.ResourceManager"; version = "4.3.0"; hash = "sha256-idiOD93xbbrbwwSnD4mORA9RYi/D/U48eRUsn/WnWGo="; })
-  (fetchNuGet { pname = "System.Runtime"; version = "4.1.0"; hash = "sha256-FViNGM/4oWtlP6w0JC0vJU+k9efLKZ+yaXrnEeabDQo="; })
   (fetchNuGet { pname = "System.Runtime"; version = "4.1.0-rc2-24027"; hash = "sha256-z1c95ZkPupGWen++eWisSr2+5I9cszS++9Ki5XyEr7w="; })
   (fetchNuGet { pname = "System.Runtime"; version = "4.3.0"; hash = "sha256-51813WXpBIsuA6fUtE5XaRQjcWdQ2/lmEokJt97u0Rg="; })
   (fetchNuGet { pname = "System.Runtime"; version = "4.3.1"; hash = "sha256-R9T68AzS1PJJ7v6ARz9vo88pKL1dWqLOANg4pkQjkA0="; })
   (fetchNuGet { pname = "System.Runtime.CompilerServices.Unsafe"; version = "6.0.0"; hash = "sha256-bEG1PnDp7uKYz/OgLOWs3RWwQSVYm+AnPwVmAmcgp2I="; })
-  (fetchNuGet { pname = "System.Runtime.Extensions"; version = "4.1.0"; hash = "sha256-X7DZ5CbPY7jHs20YZ7bmcXs9B5Mxptu/HnBUvUnNhGc="; })
   (fetchNuGet { pname = "System.Runtime.Extensions"; version = "4.1.0-rc2-24027"; hash = "sha256-14jHFNeSD1ldMvMqmwlaoClRSwGJnPU4Y7eFoaNhZCY="; })
   (fetchNuGet { pname = "System.Runtime.Extensions"; version = "4.3.0"; hash = "sha256-wLDHmozr84v1W2zYCWYxxj0FR0JDYHSVRaRuDm0bd/o="; })
-  (fetchNuGet { pname = "System.Runtime.Handles"; version = "4.0.1"; hash = "sha256-j2QgVO9ZOjv7D1het98CoFpjoYgxjupuIhuBUmLLH7w="; })
   (fetchNuGet { pname = "System.Runtime.Handles"; version = "4.0.1-rc2-24027"; hash = "sha256-WDiJSk/d8B6YPe/kSBbR8+Dl6xar96Jk3FD5rF5VhFM="; })
   (fetchNuGet { pname = "System.Runtime.Handles"; version = "4.3.0"; hash = "sha256-KJ5aXoGpB56Y6+iepBkdpx/AfaJDAitx4vrkLqR7gms="; })
-  (fetchNuGet { pname = "System.Runtime.InteropServices"; version = "4.1.0"; hash = "sha256-QceAYlJvkPRJc/+5jR+wQpNNI3aqGySWWSO30e/FfQY="; })
   (fetchNuGet { pname = "System.Runtime.InteropServices"; version = "4.1.0-rc2-24027"; hash = "sha256-dCm1Ff2hQlzgpJB080eiCU0xGoRmbTcCDs1kf3yDt2w="; })
   (fetchNuGet { pname = "System.Runtime.InteropServices"; version = "4.3.0"; hash = "sha256-8sDH+WUJfCR+7e4nfpftj/+lstEiZixWUBueR2zmHgI="; })
   (fetchNuGet { pname = "System.Runtime.InteropServices.PInvoke"; version = "4.0.0-rc2-24027"; hash = "sha256-mYxrkfrMRtcDNQ4T1rvjdWl9Mr3lErPoonTfa/LmT2M="; })
   (fetchNuGet { pname = "System.Runtime.InteropServices.RuntimeInformation"; version = "4.0.0-rc2-24027"; hash = "sha256-wg61j8juezMl2W1R6aAG6fmsv9UINJ39i/s5qN7C7w4="; })
-  (fetchNuGet { pname = "System.Runtime.InteropServices.RuntimeInformation"; version = "4.3.0"; hash = "sha256-MYpl6/ZyC6hjmzWRIe+iDoldOMW1mfbwXsduAnXIKGA="; })
   (fetchNuGet { pname = "System.Runtime.Loader"; version = "4.3.0"; hash = "sha256-syG1GTFjYbwX146BD/L7t55j+DZqpHDc6z28kdSNzx0="; })
   (fetchNuGet { pname = "System.Runtime.Numerics"; version = "4.0.1-rc2-24027"; hash = "sha256-8BUhfRa4wI+l/nqHEy7MTQooekJYlNSaCKtWL+1hc74="; })
   (fetchNuGet { pname = "System.Runtime.Numerics"; version = "4.3.0"; hash = "sha256-P5jHCgMbgFMYiONvzmaKFeOqcAIDPu/U8bOVrNPYKqc="; })
-  (fetchNuGet { pname = "System.Runtime.Serialization.Primitives"; version = "4.1.1"; hash = "sha256-80B05oxJbPLGq2pGOSl6NlZvintX9A1CNpna2aN0WRA="; })
-  (fetchNuGet { pname = "System.Runtime.Serialization.Primitives"; version = "4.3.0"; hash = "sha256-zu5m1M9usend+i9sbuD6Xbizdo8Z6N5PEF9DAtEVewc="; })
-  (fetchNuGet { pname = "System.Runtime.Serialization.Xml"; version = "4.3.0"; hash = "sha256-0bp8xtv2cP/IuxaBF8xkyYYD8N6w1wVX8wzpAwXtTKw="; })
-  (fetchNuGet { pname = "System.Security.AccessControl"; version = "4.4.0"; hash = "sha256-J3T2ECVdL0JiBA999CUz77az545CVOYB11/NPA/huEc="; })
+  (fetchNuGet { pname = "System.Security.AccessControl"; version = "5.0.0"; hash = "sha256-ueSG+Yn82evxyGBnE49N4D+ngODDXgornlBtQ3Omw54="; })
   (fetchNuGet { pname = "System.Security.Claims"; version = "4.3.0"; hash = "sha256-Fua/rDwAqq4UByRVomAxMPmDBGd5eImRqHVQIeSxbks="; })
   (fetchNuGet { pname = "System.Security.Cryptography.Algorithms"; version = "4.3.0"; hash = "sha256-tAJvNSlczYBJ3Ed24Ae27a55tq/n4D3fubNQdwcKWA8="; })
-  (fetchNuGet { pname = "System.Security.Cryptography.Cng"; version = "4.3.0"; hash = "sha256-u17vy6wNhqok91SrVLno2M1EzLHZm6VMca85xbVChsw="; })
-  (fetchNuGet { pname = "System.Security.Cryptography.Cng"; version = "4.4.0"; hash = "sha256-FpDJap32xOUDZTRLxL0QoeYFYSaY+JIzQ2VUgFpML78="; })
+  (fetchNuGet { pname = "System.Security.Cryptography.Cng"; version = "5.0.0"; hash = "sha256-nOJP3vdmQaYA07TI373OvZX6uWshETipvi5KpL7oExo="; })
   (fetchNuGet { pname = "System.Security.Cryptography.Csp"; version = "4.3.0"; hash = "sha256-oefdTU/Z2PWU9nlat8uiRDGq/PGZoSPRgkML11pmvPQ="; })
   (fetchNuGet { pname = "System.Security.Cryptography.Encoding"; version = "4.3.0"; hash = "sha256-Yuge89N6M+NcblcvXMeyHZ6kZDfwBv3LPMDiF8HhJss="; })
   (fetchNuGet { pname = "System.Security.Cryptography.OpenSsl"; version = "4.3.0"; hash = "sha256-DL+D2sc2JrQiB4oAcUggTFyD8w3aLEjJfod5JPe+Oz4="; })
-  (fetchNuGet { pname = "System.Security.Cryptography.Pkcs"; version = "4.4.0"; hash = "sha256-8I/RIdEP3BFCrgs2IUvpZLNwz86NwNs+Jimx+5lox64="; })
+  (fetchNuGet { pname = "System.Security.Cryptography.Pkcs"; version = "8.0.0"; hash = "sha256-yqfIIeZchsII2KdcxJyApZNzxM/VKknjs25gDWlweBI="; })
   (fetchNuGet { pname = "System.Security.Cryptography.Primitives"; version = "4.3.0"; hash = "sha256-fnFi7B3SnVj5a+BbgXnbjnGNvWrCEU6Hp/wjsjWz318="; })
-  (fetchNuGet { pname = "System.Security.Cryptography.ProtectedData"; version = "4.4.0"; hash = "sha256-Ri53QmFX8I8UH0x4PikQ1ZA07ZSnBUXStd5rBfGWFOE="; })
+  (fetchNuGet { pname = "System.Security.Cryptography.ProtectedData"; version = "8.0.0"; hash = "sha256-fb0pa9sQxN+mr0vnXg1Igbx49CaOqS+GDkTfWNboUvs="; })
   (fetchNuGet { pname = "System.Security.Cryptography.X509Certificates"; version = "4.3.0"; hash = "sha256-MG3V/owDh273GCUPsGGraNwaVpcydupl3EtPXj6TVG0="; })
   (fetchNuGet { pname = "System.Security.Principal"; version = "4.3.0"; hash = "sha256-rjudVUHdo8pNJg2EVEn0XxxwNo5h2EaYo+QboPkXlYk="; })
   (fetchNuGet { pname = "System.Security.Principal.Windows"; version = "4.3.0"; hash = "sha256-mbdLVUcEwe78p3ZnB6jYsizNEqxMaCAWI3tEQNhRQAE="; })
-  (fetchNuGet { pname = "System.Security.Principal.Windows"; version = "4.4.0"; hash = "sha256-lwNBM33EW45j6o8bM4hKWirEUZCvep0VYFchc50JOYc="; })
-  (fetchNuGet { pname = "System.ServiceProcess.ServiceController"; version = "4.4.0"; hash = "sha256-hkItmfxIVKNAfR3T4k2T0xIAeXpSvbUqEFCypf2W0UM="; })
-  (fetchNuGet { pname = "System.Text.Encoding"; version = "4.0.11"; hash = "sha256-PEailOvG05CVgPTyKLtpAgRydlSHmtd5K0Y8GSHY2Lc="; })
+  (fetchNuGet { pname = "System.Security.Principal.Windows"; version = "5.0.0"; hash = "sha256-CBOQwl9veFkrKK2oU8JFFEiKIh/p+aJO+q9Tc2Q/89Y="; })
+  (fetchNuGet { pname = "System.ServiceProcess.ServiceController"; version = "8.0.0"; hash = "sha256-mq/Qm8JeMUvitHf32/F8uvw1YJGx4prGnEI/VzdaFAI="; })
   (fetchNuGet { pname = "System.Text.Encoding"; version = "4.0.11-rc2-24027"; hash = "sha256-ben6VIUK1kGIM+oyrI1/uWiWbDkQkLQeipU3A1ajamI="; })
   (fetchNuGet { pname = "System.Text.Encoding"; version = "4.3.0"; hash = "sha256-GctHVGLZAa/rqkBNhsBGnsiWdKyv6VDubYpGkuOkBLg="; })
-  (fetchNuGet { pname = "System.Text.Encoding.CodePages"; version = "4.4.0"; hash = "sha256-zD24blG8xhAcL9gC4UTGKetd8c3LO0nv22nKTp2Vfx0="; })
-  (fetchNuGet { pname = "System.Text.Encoding.Extensions"; version = "4.0.11"; hash = "sha256-+kf7J3dEhgCbnCM5vHYlsTm5/R/Ud0Jr6elpHm922iI="; })
+  (fetchNuGet { pname = "System.Text.Encoding.CodePages"; version = "8.0.0"; hash = "sha256-fjCLQc1PRW0Ix5IZldg0XKv+J1DqPSfu9pjMyNBp7dE="; })
   (fetchNuGet { pname = "System.Text.Encoding.Extensions"; version = "4.0.11-rc2-24027"; hash = "sha256-RuPjac8RkzhLsw53CvNzauxEg1ZFwL5A0Yh4B+FgsQs="; })
   (fetchNuGet { pname = "System.Text.Encoding.Extensions"; version = "4.3.0"; hash = "sha256-vufHXg8QAKxHlujPHHcrtGwAqFmsCD6HKjfDAiHyAYc="; })
-  (fetchNuGet { pname = "System.Text.Encodings.Web"; version = "4.7.2"; hash = "sha256-CUZOulSeRy1CGBm7mrNrTumA9od9peKiIDR/Nb1B4io="; })
-  (fetchNuGet { pname = "System.Text.Json"; version = "4.7.2"; hash = "sha256-xA8PZwxX9iOJvPbfdi7LWjM2RMVJ7hmtEqS9JvgNsoM="; })
-  (fetchNuGet { pname = "System.Text.RegularExpressions"; version = "4.1.0"; hash = "sha256-x6OQN6MCN7S0fJ6EFTfv4rczdUWjwuWE9QQ0P6fbh9c="; })
-  (fetchNuGet { pname = "System.Text.RegularExpressions"; version = "4.3.0"; hash = "sha256-VLCk1D1kcN2wbAe3d0YQM/PqCsPHOuqlBY1yd2Yo+K0="; })
+  (fetchNuGet { pname = "System.Text.Encodings.Web"; version = "6.0.0"; hash = "sha256-UemDHGFoQIG7ObQwRluhVf6AgtQikfHEoPLC6gbFyRo="; })
+  (fetchNuGet { pname = "System.Text.Json"; version = "6.0.10"; hash = "sha256-UijYh0dxFjFinMPSTJob96oaRkNm+Wsa+7Ffg6mRnsc="; })
   (fetchNuGet { pname = "System.Text.RegularExpressions"; version = "4.3.1"; hash = "sha256-DxsEZ0nnPozyC1W164yrMUXwnAdHShS9En7ImD/GJMM="; })
-  (fetchNuGet { pname = "System.Threading"; version = "4.0.11"; hash = "sha256-mob1Zv3qLQhQ1/xOLXZmYqpniNUMCfn02n8ZkaAhqac="; })
   (fetchNuGet { pname = "System.Threading"; version = "4.0.11-rc2-24027"; hash = "sha256-OJJ4f+gNzCZruuOvhnZG9uOU3whSVEKafMoTVbH6RCk="; })
   (fetchNuGet { pname = "System.Threading"; version = "4.3.0"; hash = "sha256-ZDQ3dR4pzVwmaqBg4hacZaVenQ/3yAF/uV7BXZXjiWc="; })
-  (fetchNuGet { pname = "System.Threading.Channels"; version = "4.5.0"; hash = "sha256-34I/eRNA/R8tazesCaE0yzYf80n3iEN3UQIeFSUf31g="; })
-  (fetchNuGet { pname = "System.Threading.Tasks"; version = "4.0.11"; hash = "sha256-5SLxzFg1df6bTm2t09xeI01wa5qQglqUwwJNlQPJIVs="; })
+  (fetchNuGet { pname = "System.Threading.Channels"; version = "8.0.0"; hash = "sha256-c5TYoLNXDLroLIPnlfyMHk7nZ70QAckc/c7V199YChg="; })
   (fetchNuGet { pname = "System.Threading.Tasks"; version = "4.0.11-rc2-24027"; hash = "sha256-ADtupyd4h9YLTqIE9t/30CrUka0+CFI9C9KP2ttvTzs="; })
   (fetchNuGet { pname = "System.Threading.Tasks"; version = "4.3.0"; hash = "sha256-Z5rXfJ1EXp3G32IKZGiZ6koMjRu0n8C1NGrwpdIen4w="; })
-  (fetchNuGet { pname = "System.Threading.Tasks.Extensions"; version = "4.0.0"; hash = "sha256-+YdcPkMhZhRbMZHnfsDwpNbUkr31X7pQFGxXYcAPZbE="; })
   (fetchNuGet { pname = "System.Threading.Tasks.Extensions"; version = "4.0.0-rc2-24027"; hash = "sha256-z9+gWBZBjNoG7P5F0RHMVA4VxAw8Farnf0a94S9uGoE="; })
-  (fetchNuGet { pname = "System.Threading.Tasks.Extensions"; version = "4.3.0"; hash = "sha256-X2hQ5j+fxcmnm88Le/kSavjiGOmkcumBGTZKBLvorPc="; })
-  (fetchNuGet { pname = "System.Threading.Tasks.Extensions"; version = "4.5.1"; hash = "sha256-3NeBC+r7eTVz3f+cEm1NkVhxSr7LrYGX/NdUwje9ecY="; })
   (fetchNuGet { pname = "System.Threading.Tasks.Extensions"; version = "4.5.4"; hash = "sha256-owSpY8wHlsUXn5xrfYAiu847L6fAKethlvYx97Ri1ng="; })
   (fetchNuGet { pname = "System.Threading.ThreadPool"; version = "4.3.0"; hash = "sha256-wW0QdvssRoaOfQLazTGSnwYTurE4R8FxDx70pYkL+gg="; })
   (fetchNuGet { pname = "System.Threading.Timer"; version = "4.0.1-rc2-24027"; hash = "sha256-B3qiX7GvZ6wU9lyg4BEQhspVq0LGcF/W4H+4RwWJfBo="; })
-  (fetchNuGet { pname = "System.Threading.Timer"; version = "4.3.0"; hash = "sha256-pmhslmhQhP32TWbBzoITLZ4BoORBqYk25OWbru04p9s="; })
-  (fetchNuGet { pname = "System.Xml.ReaderWriter"; version = "4.0.11"; hash = "sha256-haZAFFQ9Sl2DhfvEbdx2YRqKEoxNMU5STaqpMmXw0zA="; })
   (fetchNuGet { pname = "System.Xml.ReaderWriter"; version = "4.0.11-rc2-24027"; hash = "sha256-jYxZjqyHIpC4g3QngWbA3joMg0DQBRWeyWviauJ73G8="; })
-  (fetchNuGet { pname = "System.Xml.ReaderWriter"; version = "4.3.0"; hash = "sha256-QQ8KgU0lu4F5Unh+TbechO//zaAGZ4MfgvW72Cn1hzA="; })
-  (fetchNuGet { pname = "System.Xml.XDocument"; version = "4.0.11"; hash = "sha256-KPz1kxe0RUBM+aoktJ/f9p51GudMERU8Pmwm//HdlFg="; })
   (fetchNuGet { pname = "System.Xml.XDocument"; version = "4.0.11-rc2-24027"; hash = "sha256-P9yCIlkbOAhF03mTF/T+iLKEXSIcncoVDbgbplykb+c="; })
-  (fetchNuGet { pname = "System.Xml.XDocument"; version = "4.3.0"; hash = "sha256-rWtdcmcuElNOSzCehflyKwHkDRpiOhJJs8CeQ0l1CCI="; })
-  (fetchNuGet { pname = "System.Xml.XmlDocument"; version = "4.3.0"; hash = "sha256-kbuV4Y7rVJkfMp2Kgoi8Zvdatm9CZNmlKB3GZgANvy4="; })
-  (fetchNuGet { pname = "System.Xml.XmlSerializer"; version = "4.3.0"; hash = "sha256-IqTGPENWYoI06x2NHFPVtHlLEq9tazbom32bFLom6h4="; })
   (fetchNuGet { pname = "xunit"; version = "2.7.1"; hash = "sha256-cf9vLYPIOvBGiUoUept+1NJfuhpSSdCFQSr6+XFde6E="; })
   (fetchNuGet { pname = "xunit.abstractions"; version = "2.0.3"; hash = "sha256-0D1y/C34iARI96gb3bAOG8tcGPMjx+fMabTPpydGlAM="; })
   (fetchNuGet { pname = "xunit.analyzers"; version = "1.12.0"; hash = "sha256-ZqbNShkNckXsZTght1ZlzkJyfd/e8oPtjSMDsJwqGuo="; })
@@ -265,6 +203,6 @@
   (fetchNuGet { pname = "xunit.core"; version = "2.7.1"; hash = "sha256-3+w1MZ/USIUqQbnyQT4ocgYfghpSoxawZN3E5EhtJ9M="; })
   (fetchNuGet { pname = "xunit.extensibility.core"; version = "2.7.1"; hash = "sha256-6AUG4c+cKswwoR2RMz+rrBjhdkIlGiRNxfLPkqKY8gI="; })
   (fetchNuGet { pname = "xunit.extensibility.execution"; version = "2.7.1"; hash = "sha256-3LEbfaJ2Uu/PWQW4NGONPr5SxZwy3Sj5yCWO6gy7IOk="; })
-  (fetchNuGet { pname = "xunit.runner.visualstudio"; version = "2.4.1"; hash = "sha256-Fm5DjFXZJzTJuApib0thPGUD0w0eavfBfSh9FOYtljo="; })
+  (fetchNuGet { pname = "xunit.runner.visualstudio"; version = "2.5.8"; hash = "sha256-71EXxeR3yiZTAWCVnjIx9o4Lme6MVY04KXch9qZETQU="; })
   (fetchNuGet { pname = "YamlDotNet.Signed"; version = "5.3.0"; hash = "sha256-K/aWN3NDNkfIxBvxcr8+4AJ/bVBZ2LWC2ef9L5Qq174="; })
 ]

pkgs/by-name/gi/github-runner/package.nix

@@ -23,13 +23,13 @@ assert builtins.all (x: builtins.elem x [ "node20" ]) nodeRuntimes;
 
 buildDotnetModule rec {
   pname = "github-runner";
-  version = "2.320.0";
+  version = "2.321.0";
 
   src = fetchFromGitHub {
     owner = "actions";
     repo = "runner";
     rev = "v${version}";
-    hash = "sha256-mVi/Z89R2nbxQAyEkpbcaU3Pc3wK6989QojHew9ad4g=";
+    hash = "sha256-KZ072v5kYlD78RGQl13Aj05DGzj2+r2akzyZ1aJn93A=";
     leaveDotGit = true;
     postFetch = ''
       git -C $out rev-parse --short HEAD > $out/.git-revision
@@ -80,19 +80,16 @@ buildDotnetModule rec {
       url = "https://github.com/actions/runner/commit/5ff0ce1.patch";
       hash = "sha256-2Vg3cKZK3cE/OcPDZkdN2Ro2WgvduYTTwvNGxwCfXas=";
     })
+    # Fix source path discovery in tests
+    ./patches/test-getsrcpath.patch
   ];
 
-  postPatch =
-    ''
-      # Ignore changes to src/Runner.Sdk/BuildConstants.cs
-      substituteInPlace src/dir.proj \
-        --replace 'git update-index --assume-unchanged ./Runner.Sdk/BuildConstants.cs' \
-                  'true'
-    ''
-    + lib.optionalString (nodeRuntimes == [ "node20" ]) ''
-      substituteInPlace src/Runner.Common/Util/NodeUtil.cs \
-        --replace-fail '_defaultNodeVersion = "node16"' '_defaultNodeVersion = "node20"'
-    '';
+  postPatch = ''
+    # Ignore changes to src/Runner.Sdk/BuildConstants.cs
+    substituteInPlace src/dir.proj \
+      --replace-fail 'git update-index --assume-unchanged ./Runner.Sdk/BuildConstants.cs' \
+                     'true'
+  '';
 
   DOTNET_SYSTEM_GLOBALIZATION_INVARIANT = isNull glibcLocales;
   LOCALE_ARCHIVE = lib.optionalString (
@@ -121,8 +118,8 @@ buildDotnetModule rec {
 
   buildInputs = [ (lib.getLib stdenv.cc.cc) ];
 
-  dotnet-sdk = dotnetCorePackages.sdk_6_0;
-  dotnet-runtime = dotnetCorePackages.runtime_6_0;
+  dotnet-sdk = dotnetCorePackages.sdk_8_0;
+  dotnet-runtime = dotnetCorePackages.runtime_8_0;
 
   dotnetFlags = [
     "-p:PackageRuntime=${dotnetCorePackages.systemToDotnetRid stdenv.hostPlatform.system}"
@@ -206,8 +203,6 @@ buildDotnetModule rec {
       "GitHub.Runner.Common.Tests.Worker.VariablesL0.Constructor_SetsOrdinalIgnoreCaseComparer"
       "GitHub.Runner.Common.Tests.Worker.WorkerL0.DispatchCancellation"
       "GitHub.Runner.Common.Tests.Worker.WorkerL0.DispatchRunNewJob"
-    ]
-    ++ lib.optionals (!lib.elem "node16" nodeRuntimes) [
       "GitHub.Runner.Common.Tests.ProcessExtensionL0.SuccessReadProcessEnv"
     ];
 

pkgs/by-name/gi/github-runner/patches/test-getsrcpath.patch

@@ -0,0 +1,11 @@
+--- a/src/Test/L0/TestUtil.cs
++++ b/src/Test/L0/TestUtil.cs
+@@ -29,7 +29,7 @@
+         {
+             string L0dir = Path.GetDirectoryName(GetTestFilePath());
+             string testDir = Path.GetDirectoryName(L0dir);
+-            string srcDir = Path.GetDirectoryName(testDir);
++            string srcDir = "/build/src" + Path.GetDirectoryName(testDir).Substring(2);
+             ArgUtil.Directory(srcDir, nameof(srcDir));
+             Assert.Equal(Src, Path.GetFileName(srcDir));
+             return srcDir;

pkgs/by-name/gl/glfw3/package.nix

@@ -1,24 +1,25 @@
-{ stdenv
-, lib
-, fetchFromGitHub
-, cmake
-, pkg-config
-, libGL
-, vulkan-loader
-, libXrandr
-, libXinerama
-, libXcursor
-, libX11
-, libXi
-, libXext
-, darwin
-, fixDarwinDylibNames
-, wayland
-, wayland-scanner
-, wayland-protocols
-, libxkbcommon
-, libdecor
-, withMinecraftPatch ? false
+{
+  stdenv,
+  lib,
+  fetchFromGitHub,
+  cmake,
+  pkg-config,
+  libGL,
+  vulkan-loader,
+  libXrandr,
+  libXinerama,
+  libXcursor,
+  libX11,
+  libXi,
+  libXext,
+  libXxf86vm,
+  fixDarwinDylibNames,
+  wayland,
+  wayland-scanner,
+  wayland-protocols,
+  libxkbcommon,
+  libdecor,
+  withMinecraftPatch ? false,
 }:
 let
   version = "3.4";
@@ -35,59 +36,75 @@ stdenv.mkDerivation {
   };
 
   # Fix linkage issues on X11 (https://github.com/NixOS/nixpkgs/issues/142583)
-  patches = [
-    ./x11.patch
-  ] ++ lib.optionals withMinecraftPatch [
-    ./0009-Defer-setting-cursor-position-until-the-cursor-is-lo.patch
-  ];
+  patches =
+    [
+      ./x11.patch
+    ]
+    ++ lib.optionals withMinecraftPatch [
+      ./0009-Defer-setting-cursor-position-until-the-cursor-is-lo.patch
+    ];
 
   propagatedBuildInputs = lib.optionals (!stdenv.hostPlatform.isWindows) [ libGL ];
 
-  nativeBuildInputs = [ cmake pkg-config ]
+  nativeBuildInputs =
+    [
+      cmake
+      pkg-config
+    ]
     ++ lib.optionals stdenv.hostPlatform.isDarwin [ fixDarwinDylibNames ]
     ++ lib.optionals stdenv.hostPlatform.isLinux [ wayland-scanner ];
 
-  buildInputs =
-    lib.optionals stdenv.hostPlatform.isDarwin (with darwin.apple_sdk.frameworks; [ Carbon Cocoa Kernel ])
-    ++ lib.optionals stdenv.hostPlatform.isLinux [
-      wayland
-      wayland-protocols
-      libxkbcommon
-      libX11
-      libXrandr
-      libXinerama
-      libXcursor
-      libXi
-      libXext
-    ];
-
-  cmakeFlags = [
-    "-DBUILD_SHARED_LIBS=ON"
-  ] ++ lib.optionals (!stdenv.hostPlatform.isDarwin && !stdenv.hostPlatform.isWindows) [
-    "-DCMAKE_C_FLAGS=-D_GLFW_GLX_LIBRARY='\"${lib.getLib libGL}/lib/libGL.so.1\"'"
-    "-DCMAKE_C_FLAGS=-D_GLFW_EGL_LIBRARY='\"${lib.getLib libGL}/lib/libEGL.so.1\"'"
-    "-DCMAKE_C_FLAGS=-D_GLFW_VULKAN_LIBRARY='\"${lib.getLib vulkan-loader}/lib/libvulkan.so.1\"'"
+  buildInputs = lib.optionals stdenv.hostPlatform.isLinux [
+    wayland
+    wayland-protocols
+    libxkbcommon
+    libX11
+    libXrandr
+    libXinerama
+    libXcursor
+    libXi
+    libXext
+    libXxf86vm
   ];
 
   postPatch = lib.optionalString stdenv.hostPlatform.isLinux ''
     substituteInPlace src/wl_init.c \
-      --replace-fail "libxkbcommon.so.0" "${lib.getLib libxkbcommon}/lib/libxkbcommon.so.0" \
-      --replace-fail "libdecor-0.so.0" "${lib.getLib libdecor}/lib/libdecor-0.so.0" \
-      --replace-fail "libwayland-client.so.0" "${lib.getLib wayland}/lib/libwayland-client.so.0" \
-      --replace-fail "libwayland-cursor.so.0" "${lib.getLib wayland}/lib/libwayland-cursor.so.0" \
-      --replace-fail "libwayland-egl.so.1" "${lib.getLib wayland}/lib/libwayland-egl.so.1"
+      --replace-fail '"libdecor-0.so.0"' '"${lib.getLib libdecor}/lib/libdecor-0.so.0"' \
+      --replace-fail '"libwayland-client.so.0"' '"${lib.getLib wayland}/lib/libwayland-client.so.0"' \
+      --replace-fail '"libwayland-cursor.so.0"' '"${lib.getLib wayland}/lib/libwayland-cursor.so.0"' \
+      --replace-fail '"libwayland-egl.so.1"' '"${lib.getLib wayland}/lib/libwayland-egl.so.1"' \
+      --replace-fail '"libxkbcommon.so.0"' '"${lib.getLib libxkbcommon}/lib/libxkbcommon.so.0"'
   '';
 
-  # glfw may dlopen libwayland-client.so:
-  postFixup = lib.optionalString stdenv.hostPlatform.isLinux ''
-    patchelf ''${!outputLib}/lib/libglfw.so --add-rpath ${lib.getLib wayland}/lib
-  '';
+  cmakeFlags = [
+    # Static linking isn't supported
+    (lib.cmakeBool "BUILD_SHARED_LIBS" true)
+  ];
 
-  meta = with lib; {
+  env = lib.optionalAttrs (!stdenv.hostPlatform.isDarwin && !stdenv.hostPlatform.isWindows) {
+    NIX_CFLAGS_COMPILE = toString [
+      "-D_GLFW_GLX_LIBRARY=\"${lib.getLib libGL}/lib/libGLX.so.0\""
+      "-D_GLFW_EGL_LIBRARY=\"${lib.getLib libGL}/lib/libEGL.so.1\""
+      "-D_GLFW_OPENGL_LIBRARY=\"${lib.getLib libGL}/lib/libGL.so.1\""
+      "-D_GLFW_GLESV1_LIBRARY=\"${lib.getLib libGL}/lib/libGLESv1_CM.so.1\""
+      "-D_GLFW_GLESV2_LIBRARY=\"${lib.getLib libGL}/lib/libGLESv2.so.2\""
+      "-D_GLFW_VULKAN_LIBRARY=\"${lib.getLib vulkan-loader}/lib/libvulkan.so.1\""
+      # This currently omits _GLFW_OSMESA_LIBRARY. Is it even used?
+    ];
+  };
+
+  strictDeps = true;
+  __structuredAttrs = true;
+
+  meta = {
     description = "Multi-platform library for creating OpenGL contexts and managing input, including keyboard, mouse, joystick and time";
     homepage = "https://www.glfw.org/";
-    license = licenses.zlib;
-    maintainers = with maintainers; [ marcweber Scrumplex twey ];
-    platforms = platforms.unix ++ platforms.windows;
+    license = lib.licenses.zlib;
+    maintainers = with lib.maintainers; [
+      marcweber
+      Scrumplex
+      twey
+    ];
+    platforms = lib.platforms.unix ++ lib.platforms.windows;
   };
 }

pkgs/by-name/gl/glfw3/x11.patch

@@ -2,17 +2,20 @@ diff --git a/src/CMakeLists.txt b/src/CMakeLists.txt
 index a0be580e..ba143851 100644
 --- a/src/CMakeLists.txt
 +++ b/src/CMakeLists.txt
-@@ -219,6 +219,13 @@ if (GLFW_BUILD_X11)
+@@ -219,6 +219,16 @@ if (GLFW_BUILD_X11)
      if (NOT X11_Xshape_INCLUDE_PATH)
          message(FATAL_ERROR "X Shape headers not found; install libxext development package")
      endif()
 +
 +    target_link_libraries(glfw PRIVATE ${X11_Xrandr_LIB}
 +                                       ${X11_Xinerama_LIB}
++                                       ${X11_X11_xcb_LIB}
++                                       ${X11_Xrender_LIB}
 +                                       ${X11_Xkb_LIB}
 +                                       ${X11_Xcursor_LIB}
 +                                       ${X11_Xi_LIB}
-+                                       ${X11_Xshape_LIB})
++                                       ${X11_Xxf86vm_LIB}
++                                       ${X11_Xext_LIB})
  endif()
  
  if (UNIX AND NOT APPLE)

pkgs/by-name/gp/gpauth/package.nix

@@ -49,5 +49,9 @@ rustPlatform.buildRustPackage rec {
       binary-eater
       m1dugh
     ];
+    platforms = [
+      "aarch64-linux"
+      "x86_64-linux"
+    ];
   };
 }

pkgs/by-name/ha/handheld-daemon-ui/package.nix

@@ -0,0 +1,42 @@
+{
+  lib,
+  appimageTools,
+  fetchurl,
+}:
+let
+  pname = "handheld-daemon-ui";
+  version = "3.2.3";
+
+  src = fetchurl {
+    url = "https://github.com/hhd-dev/hhd-ui/releases/download/v${version}/hhd-ui.Appimage";
+    hash = "sha256-VhJrOvE+BebJIAeQlwOOsPfqSrvBnJQavGT7glTrG2o=";
+  };
+  extractedFiles = appimageTools.extractType2 { inherit pname version src; };
+in
+appimageTools.wrapType2 {
+  inherit pname version src;
+
+  extraInstallCommands = ''
+    # Handheld-daemon expects the UI binary to be called hhd-ui
+    mv $out/bin/${pname}* $out/bin/hhd-ui
+
+    mkdir -p $out/share/applications
+    substitute ${extractedFiles}/hhd-ui.desktop \
+      $out/share/applications/hhd-ui.desktop \
+      --replace-fail "Exec=AppRun" "Exec=hhd-ui" \
+      --replace-fail "Categories=game;" "Categories=Game;"
+    iconDir=$out/share/icons/hicolor/512x512/apps
+    mkdir -p $iconDir
+    cp ${extractedFiles}/hhd-ui.png $iconDir
+  '';
+
+  meta = {
+    description = "UI for the Handheld Daemon";
+    homepage = "https://github.com/hhd-dev/hhd-ui";
+    license = lib.licenses.gpl3Only;
+    maintainers = with lib.maintainers; [ toast ];
+    mainProgram = "hhd-ui";
+    platforms = [ "x86_64-linux" ];
+    sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
+  };
+}

pkgs/by-name/js/json2ts/package.nix

@@ -2,6 +2,7 @@
   buildNpmPackage,
   fetchFromGitHub,
   lib,
+  jq,
 }:
 buildNpmPackage {
   name = "json2ts";
@@ -12,8 +13,17 @@ buildNpmPackage {
     rev = "118d6a8e7a5a9397d1d390ce297f127ae674a623";
     hash = "sha256-ldAFfw3E0A0lIJyDSsshgPRPR7OmV/FncPsDhC3waT8=";
   };
+
+  nativeBuildInputs = [ jq ];
   npmDepsHash = "sha256-kLKau4SBxI9bMAd7X8/FQfCza2sYl/+0bg2LQcOQIJo=";
 
+  # forceConsistentCasingInFileNames: false is needed for typescript on darwin
+  # https://www.typescriptlang.org/tsconfig/#forceConsistentCasingInFileNames
+  postConfigure = ''
+    jq '.compilerOptions.forceConsistentCasingInFileNames = false' tsconfig.json > temp.json
+    mv temp.json tsconfig.json
+  '';
+
   meta = with lib; {
     mainProgram = "json2ts";
     description = "Compile JSON Schema to TypeScript type declarations";

pkgs/by-name/ka/kanidm/package.nix

@@ -28,16 +28,16 @@ let
 in
 rustPlatform.buildRustPackage rec {
   pname = "kanidm";
-  version = "1.4.2";
+  version = "1.4.3";
 
   src = fetchFromGitHub {
     owner = pname;
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-vKllSbJ44cO3FFIaf8rkhvKAVa2NG1Ps06VTzpi9xj0=";
+    hash = "sha256-zI+IPwpkkF67/JSl3Uu+Q1giUN49r/hjvY+/QLqB5eM=";
   };
 
-  cargoHash = "sha256-1mZm39l11eUjAGe0Oi9Mz94cb7DurfvUjCH5+GnA2Z0=";
+  cargoHash = "sha256-l4UNdVvPteqs46Fm7yVgkgplANvkAmb4fooLigXRqZM=";
 
   KANIDM_BUILD_PROFILE = "release_nixos_${arch}";
 

pkgs/by-name/ka/karlender/package.nix

@@ -11,30 +11,20 @@
   nix-update-script,
   dbus,
   cargo-gra,
-  fetchpatch,
 }:
 
 rustPlatform.buildRustPackage rec {
   pname = "karlender";
-  version = "0.10.4";
+  version = "0.10.11";
 
   src = fetchFromGitLab {
     owner = "floers";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-W+s1RCPwy7ZiK514AaQLwV9y+VJ58oMGlrS5cdoFKIg=";
+    hash = "sha256-PwXSJq4uBtgIA2aQ5AZawEMmHoVS2Z9haVHyJ2oyXUs=";
   };
 
-  cargoPatches = [
-    # https://gitlab.com/floers/calendar-stuff/karlender/-/merge_requests/43
-    # Remove it when it is merged and released.
-    (fetchpatch {
-      url = "https://gitlab.com/floers/calendar-stuff/karlender/-/commit/ce50c68323a834a0ee2cbff88ed285a971dfd91e.patch";
-      hash = "sha256-0hGgJPwnSNGTO/eiooQkQlBJ4brbaWVKRY6MT1PZApg=";
-    })
-  ];
-
-  cargoHash = "sha256-CeHIx6oUtAcr6tBdqmIDTLuYcesaA6G72L3HwHDLY7Y=";
+  cargoHash = "sha256-R/oQvyZCcTImOA8FB5bECTj5VGFElImoQwIRX75PtOs=";
 
   nativeBuildInputs = [
     pkg-config
@@ -79,9 +69,9 @@ rustPlatform.buildRustPackage rec {
 
   meta = {
     description = "Mobile-friendly GTK calendar application";
-    mainProgram = "karlender";
     homepage = "https://gitlab.com/floers/karlender";
     license = lib.licenses.gpl3Plus;
+    mainProgram = "karlender";
     maintainers = with lib.maintainers; [
       chuangzhu
       bot-wxt1221

pkgs/by-name/ko/koboldcpp/package.nix

@@ -5,11 +5,10 @@
   makeWrapper,
   gitUpdater,
   python3Packages,
-  python311Packages ? null, # Ignored. Kept for compatibility with the release
   tk,
   addDriverRunpath,
 
-  darwin,
+  apple-sdk_12,
 
   koboldLiteSupport ? true,
 
@@ -30,10 +29,8 @@
 
   vulkanSupport ? true,
   vulkan-loader,
-
-  metalSupport ? stdenv.hostPlatform.isDarwin && stdenv.hostPlatform.isAarch64,
-  march ? "",
-  mtune ? "",
+  metalSupport ? stdenv.hostPlatform.isDarwin,
+  nix-update-script,
 }:
 
 let
@@ -43,12 +40,6 @@ let
     --prefix LD_LIBRARY_PATH : "${lib.makeLibraryPath [ addDriverRunpath.driverLink ]}"
   '';
 
-  darwinFrameworks =
-    if (stdenv.hostPlatform.isDarwin && stdenv.hostPlatform.isx86_64) then
-      darwin.apple_sdk.frameworks
-    else
-      darwin.apple_sdk_11_0.frameworks;
-
   effectiveStdenv = if cublasSupport then cudaPackages.backendStdenv else stdenv;
 in
 effectiveStdenv.mkDerivation (finalAttrs: {
@@ -74,17 +65,7 @@ effectiveStdenv.mkDerivation (finalAttrs: {
   buildInputs =
     [ tk ]
     ++ finalAttrs.pythonInputs
-    ++ lib.optionals effectiveStdenv.hostPlatform.isDarwin [
-      darwinFrameworks.Accelerate
-      darwinFrameworks.CoreVideo
-      darwinFrameworks.CoreGraphics
-      darwinFrameworks.CoreServices
-    ]
-    ++ lib.optionals metalSupport [
-      darwinFrameworks.MetalKit
-      darwinFrameworks.Foundation
-      darwinFrameworks.MetalPerformanceShaders
-    ]
+    ++ lib.optionals stdenv.hostPlatform.isDarwin [ apple-sdk_12 ]
     ++ lib.optionals openblasSupport [ openblas ]
     ++ lib.optionals cublasSupport [
       cudaPackages.libcublas
@@ -100,29 +81,6 @@ effectiveStdenv.mkDerivation (finalAttrs: {
 
   pythonPath = finalAttrs.pythonInputs;
 
-  darwinLdFlags = lib.optionals stdenv.hostPlatform.isDarwin [
-    "-F${darwinFrameworks.CoreServices}/Library/Frameworks"
-    "-F${darwinFrameworks.Accelerate}/Library/Frameworks"
-    "-framework CoreServices"
-    "-framework Accelerate"
-  ];
-  metalLdFlags = lib.optionals metalSupport [
-    "-F${darwinFrameworks.Foundation}/Library/Frameworks"
-    "-F${darwinFrameworks.Metal}/Library/Frameworks"
-    "-framework Foundation"
-    "-framework Metal"
-  ];
-
-  env.NIX_LDFLAGS = lib.concatStringsSep " " (finalAttrs.darwinLdFlags ++ finalAttrs.metalLdFlags);
-
-  env.NIX_CFLAGS_COMPILE =
-    lib.optionalString (march != "") (
-      lib.warn "koboldcpp: the march argument is only kept for compatibility; use overrideAttrs intead" "-march=${march}"
-    )
-    + lib.optionalString (mtune != "") (
-      lib.warn "koboldcpp: the mtune argument is only kept for compatibility; use overrideAttrs intead" "-mtune=${mtune}"
-    );
-
   makeFlags = [
     (makeBool "LLAMA_OPENBLAS" openblasSupport)
     (makeBool "LLAMA_CUBLAS" cublasSupport)
@@ -153,19 +111,13 @@ effectiveStdenv.mkDerivation (finalAttrs: {
     runHook postInstall
   '';
 
-  # Remove an unused argument, mainly intended for Darwin to reduce warnings
-  postPatch = ''
-    substituteInPlace Makefile \
-      --replace-warn " -s " " "
-  '';
-
   postFixup = ''
     wrapPythonProgramsIn "$out/bin" "$pythonPath"
     makeWrapper "$out/bin/koboldcpp.unwrapped" "$out/bin/koboldcpp" \
       --prefix PATH : ${lib.makeBinPath [ tk ]} ${libraryPathWrapperArgs}
   '';
 
-  passthru.updateScript = gitUpdater { rev-prefix = "v"; };
+  passthru.updateScript = nix-update-script { };
 
   meta = {
     changelog = "https://github.com/LostRuins/koboldcpp/releases/tag/v${finalAttrs.version}";

pkgs/by-name/la/lager/package.nix

@@ -29,7 +29,9 @@ stdenv.mkDerivation (finalAttrs: {
   cmakeFlags = [
     "-Dlager_BUILD_EXAMPLES=OFF"
   ];
-
+  preConfigure = ''
+    rm BUILD
+  '';
   meta = {
     homepage = "https://github.com/arximboldi/lager";
     description = "C++ library for value-oriented design using the unidirectional data-flow architecture — Redux for C++";

pkgs/by-name/le/lektor/package.nix

@@ -2,6 +2,7 @@
 , fetchFromGitHub
 , fetchNpmDeps
 , fetchPypi
+, fetchpatch
 , nodejs
 , npmHooks
 , python3
@@ -38,6 +39,16 @@ python.pkgs.buildPythonApplication rec {
     hash = "sha256-y0/fYuiIB/O5tsYKjzOPnCafOIZCn4Z5OITPMcnHd/M=";
   };
 
+  patches = [
+    # Fixes test_thumbnail.py with Pillow 11.0
+    # see lektor/lektor #1202
+    (fetchpatch {
+      name = "lektor-pillow-11.patch";
+      url = "https://github.com/lektor/lektor/commit/af99ea4265e05227d7452977949475196a58edfa.patch";
+      hash = "sha256-PmSmX9Ku5rAzN2FzLwvXYeUqN683opLRt9J35w56cfg=";
+    })
+  ];
+
   npmDeps = fetchNpmDeps {
     src = "${src}/${npmRoot}";
     hash = "sha256-LXe5/u4nAGig8RSu6r8Qsr3p3Od8eoMxukW8Z4HkJ44=";

pkgs/by-name/li/libedgetpu/package.nix

@@ -43,6 +43,12 @@ stdenv.mkDerivation {
     })
   ];
 
+  postPatch = ''
+    # Use dedicated group for coral devices
+    substituteInPlace debian/edgetpu-accelerator.rules \
+      --replace-fail "plugdev" "coral"
+  '';
+
   makeFlags = [
     "-f"
     "makefile_build/Makefile"

pkgs/by-name/ln/lnav/package.nix

@@ -11,17 +11,18 @@
 , automake
 , curl
 , buildPackages
+, nix-update-script
 }:
 
 stdenv.mkDerivation rec {
   pname = "lnav";
-  version = "0.12.2";
+  version = "0.12.3";
 
   src = fetchFromGitHub {
     owner = "tstack";
     repo = "lnav";
     rev = "v${version}";
-    sha256 = "sha256-grEW3J50osKJzulNQFN7Gir5+wk1qFPc/YaT+EZMAqs=";
+    sha256 = "sha256-m0r7LAo9pYFpS+oimVCNCipojxPzMMsLLjhjkitEwow=";
   };
 
   enableParallelBuilding = true;
@@ -47,6 +48,8 @@ stdenv.mkDerivation rec {
     ./autogen.sh
   '';
 
+  passthru.updateScript = nix-update-script { };
+
   meta = with lib; {
     homepage = "https://github.com/tstack/lnav";
     description = "Logfile Navigator";

pkgs/by-name/me/methane/package.nix

@@ -1,39 +1,43 @@
-{ lib
-, stdenv
-, fetchFromGitHub
-, pkg-config
-, SDL2
-, SDL2_image
-, SDL2_mixer
-, fontconfig
-, freealut
-, libglut
-, gettext
-, libGL
-, libGLU
-, openal
-, quesoglc
-, clanlib
-, libXrender
-, libmikmod
-, alsa-lib
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  pkg-config,
+  SDL2,
+  SDL2_image,
+  SDL2_mixer,
+  fontconfig,
+  freealut,
+  libglut,
+  gettext,
+  libGL,
+  libGLU,
+  openal,
+  quesoglc,
+  clanlib,
+  libXrender,
+  libmikmod,
+  alsa-lib,
+  nix-update-script,
+  libXinerama,
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs:{
   pname = "methane";
-  version = "2.0.1";
+  version = "2.1.0";
 
   src = fetchFromGitHub {
     repo = "methane";
     owner = "rombust";
-    rev = "v${version}";
-    sha256 = "sha256-STS2+wfZ8E1jpr0PYQOBQsztxhJU0Dt3IhWBE3sjdWE=";
+    rev = "refs/tags/v${finalAttrs.version}";
+    hash = "sha256-rByJqkhYsRuv0gTug+vP2qgkRY8TnX+Qx4/MbAmPTOU=";
   };
 
   nativeBuildInputs = [
     gettext
     pkg-config
   ];
+
   buildInputs = [
     SDL2
     SDL2_image
@@ -47,11 +51,12 @@ stdenv.mkDerivation rec {
     quesoglc
     clanlib
     libXrender
+    libXinerama
     libmikmod
     alsa-lib
   ];
 
-  installPhase  = ''
+  installPhase = ''
     runHook preInstall
     mkdir -p $out/bin/ $out/share/methane/ $out/share/docs/
     cp methane $out/bin
@@ -60,12 +65,14 @@ stdenv.mkDerivation rec {
     runHook postInstall
   '';
 
-  meta = with lib; {
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
     homepage = "https://github.com/rombust/methane";
     description = "Clone of Taito's Bubble Bobble arcade game released for Amiga in 1993 by Apache Software";
     mainProgram = "methane";
-    license = licenses.gpl2Only;
-    maintainers = with maintainers; [ nixinator ];
+    license = lib.licenses.gpl2Only;
+    maintainers = with lib.maintainers; [ nixinator ];
     platforms = [ "x86_64-linux" ];
   };
-}
+})

pkgs/by-name/mo/moonlight-qt/package.nix

@@ -19,6 +19,7 @@
   libxkbcommon,
   wayland,
   libdrm,
+  apple-sdk_11,
   nix-update-script,
 }:
 
@@ -69,6 +70,9 @@ stdenv.mkDerivation (finalAttrs: {
       qt6.qtwayland
       wayland
       libdrm
+    ]
+    ++ lib.optionals stdenv.hostPlatform.isDarwin [
+      apple-sdk_11
     ];
 
   qmakeFlags = [ "CONFIG+=disable-prebuilts" ];

pkgs/by-name/n8/n8n/package.nix

@@ -18,18 +18,18 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "n8n";
-  version = "1.61.0";
+  version = "1.65.1";
 
   src = fetchFromGitHub {
     owner = "n8n-io";
     repo = "n8n";
     rev = "n8n@${finalAttrs.version}";
-    hash = "sha256-9hIwpid/uly7wUcrBgLkSw+Aah8OQ66MgrMQbs/5v1Y=";
+    hash = "sha256-3fGsghGzqLb9B0qrqPuJV2pypd3kJVUrYohMe9quqG4=";
   };
 
   pnpmDeps = pnpm.fetchDeps {
     inherit (finalAttrs) pname version src;
-    hash = "sha256-lZLWqlR6xq7DYpnydgJK8gL7WdfZcRU+8Autzh6e7kY=";
+    hash = "sha256-n+A7SGfjzvB9NOt8kqi7DswKSjCTef5SJItWtFzNpwA=";
   };
 
   nativeBuildInputs = [
@@ -89,7 +89,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   dontStrip = true;
 
-  meta = with lib; {
+  meta = {
     description = "Free and source-available fair-code licensed workflow automation tool";
     longDescription = ''
       Free and source-available fair-code licensed workflow automation tool.
@@ -97,12 +97,11 @@ stdenv.mkDerivation (finalAttrs: {
     '';
     homepage = "https://n8n.io";
     changelog = "https://github.com/n8n-io/n8n/releases/tag/${finalAttrs.src.rev}";
-    maintainers = with maintainers; [
-      freezeboy
+    maintainers = with lib.maintainers; [
       gepbird
     ];
-    license = licenses.sustainableUse;
+    license = lib.licenses.sustainableUse;
     mainProgram = "n8n";
-    platforms = platforms.unix;
+    platforms = lib.platforms.unix;
   };
 })

pkgs/by-name/n9/n98-magerun2/package.nix

@@ -15,7 +15,7 @@ php.buildComposerProject2 (finalAttrs: {
     hash = "sha256-OPvyZ0r7Zt4PC+rmRtBm9EkbaE4PeovnUHrhzXUqT8E=";
   };
 
-  vendorHash = "sha256-E2V5ARNCmGOmGGctfcjpW49cxFBcWyJEodBNjHhKQ+w=";
+  vendorHash = "sha256-604n3Z4R2+zca+NN75Y7afa2Y6Y6ussxE+MEQsDLWsg=";
 
   meta = {
     changelog = "https://magerun.net/category/magerun/";

pkgs/by-name/np/nph/package.nix

@@ -1,10 +1,16 @@
 {
   lib,
-  buildNimPackage,
   fetchFromGitHub,
+  buildNimPackage,
+  nim-2_0,
 }:
-
-buildNimPackage (finalAttrs: {
+let
+  buildNimPackage' = buildNimPackage.override {
+    # Do not build with Nim-2.2.x.
+    nim2 = nim-2_0;
+  };
+in
+buildNimPackage' (finalAttrs: {
   pname = "nph";
   version = "0.6.0";
 

pkgs/by-name/op/open-web-calendar/package.nix

@@ -0,0 +1,90 @@
+{
+  lib,
+  python3,
+  fetchPypi,
+  nixosTests,
+
+  defaultSpecificationFile ? null,
+}:
+
+let
+  python = python3;
+in
+python.pkgs.buildPythonApplication rec {
+  pname = "open-web-calendar";
+  version = "1.41";
+  pyproject = true;
+
+  disabled = python.pythonOlder "3.9";
+
+  src = fetchPypi {
+    inherit version;
+    pname = "open_web_calendar";
+    hash = "sha256-3D1bGAioKCD1XZQVwtMVXi67VzzdJQnRLS6RF+dJNL4=";
+  };
+
+  # The Pypi tarball doesn't contain open_web_calendars/features
+  postPatch = ''
+    ln -s $PWD/features open_web_calendar/features
+  '';
+
+  postInstall = lib.optionalString (defaultSpecificationFile != null) ''
+    install -D ${defaultSpecificationFile} $out/$defaultSpecificationPath
+  '';
+
+  build-system = with python.pkgs; [
+    hatchling
+    hatch-vcs
+  ];
+
+  dependencies =
+    with python.pkgs;
+    [
+      flask-caching
+      flask-allowed-hosts
+      flask
+      icalendar
+      requests
+      pyyaml
+      recurring-ical-events
+      gunicorn
+      lxml
+      beautifulsoup4
+      lxml-html-clean
+      pytz
+    ]
+    ++ requests.optional-dependencies.socks;
+
+  nativeCheckInputs = with python.pkgs; [ pytestCheckHook ];
+
+  pytestFlagsArray = [ "open_web_calendar/test" ];
+
+  pythonImportsCheck = [ "open_web_calendar.app" ];
+
+  defaultSpecificationPath = "${python.sitePackages}/open_web_calendar/default_specification.yml";
+
+  passthru = {
+    inherit python;
+    tests = {
+      inherit (nixosTests) open-web-calendar;
+    };
+  };
+
+  meta = with lib; {
+    description = "Highly customizable web calendar that can be embedded into websites using ICal source links";
+    homepage = "https://open-web-calendar.quelltext.eu";
+    changelog =
+      let
+        v = builtins.replaceStrings [ "." ] [ "" ] version;
+      in
+      "https://open-web-calendar.quelltext.eu/changelog/#v${v}";
+    license = with licenses; [
+      gpl2Only
+      cc-by-sa-40
+      cc0
+    ];
+    platforms = platforms.linux;
+    maintainers = with maintainers; [ erictapen ];
+    mainProgram = "open-web-calendar";
+  };
+}

pkgs/by-name/op/opencomposite/package.nix

@@ -11,6 +11,7 @@
   vulkan-headers,
   vulkan-loader,
   xorg,
+  openxr-loader,
 }:
 
 stdenv.mkDerivation {
@@ -61,5 +62,7 @@ stdenv.mkDerivation {
     homepage = "https://gitlab.com/znixian/OpenOVR";
     license = with lib.licenses; [ gpl3Only ];
     maintainers = with lib.maintainers; [ Scrumplex ];
+    # This can realistically only work on systems that support OpenXR Loader
+    inherit (openxr-loader.meta) platforms;
   };
 }

pkgs/by-name/or/orca-slicer/package.nix

@@ -18,7 +18,6 @@ bambu-studio.overrideAttrs (
     patches = [
       # Fix for webkitgtk linking
       ./patches/0001-not-for-upstream-CMakeLists-Link-against-webkit2gtk-.patch
-
       ./patches/dont-link-opencv-world-orca.patch
     ];
 

pkgs/by-name/or/orca-slicer/patches/0001-not-for-upstream-CMakeLists-Link-against-webkit2gtk-.patch

@@ -0,0 +1,34 @@
+From 7eed499898226222a949a792e0400ec10db4a1c9 Mon Sep 17 00:00:00 2001
+From: Zhaofeng Li <hello@zhaofeng.li>
+Date: Tue, 22 Nov 2022 13:00:39 -0700
+Subject: [PATCH] [not for upstream] CMakeLists: Link against webkit2gtk in
+ libslic3r_gui
+
+WebView.cpp uses symbols from webkitgtk directly. Upstream setup
+links wxGTK statically so webkitgtk is already pulled in.
+
+> /nix/store/039g378vc3pc3dvi9dzdlrd0i4q93qwf-binutils-2.39/bin/ld: slic3r/liblibslic3r_gui.a(WebView.cpp.o): undefined reference to symbol 'webkit_web_view_run_javascript_finish'
+> /nix/store/039g378vc3pc3dvi9dzdlrd0i4q93qwf-binutils-2.39/bin/ld: /nix/store/8yvy428jy2nwq4dhmrcs7gj5r27a2pv6-webkitgtk-2.38.2+abi=4.0/lib/libwebkit2gtk-4.0.so.37: error adding symbols: DSO missing from command line
+---
+ src/CMakeLists.txt | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/src/CMakeLists.txt b/src/CMakeLists.txt
+index 9c5cb96..e92a0e3 100644
+--- a/src/CMakeLists.txt
++++ b/src/CMakeLists.txt
+@@ -175,6 +175,11 @@ if (WIN32)
+     target_link_libraries(BambuStudio_app_gui PRIVATE boost_headeronly)
+ endif ()
+ 
++# We link against webkit2gtk symbols in src/slic3r/GUI/Widgets/WebView.cpp
++if (CMAKE_SYSTEM_NAME STREQUAL "Linux")
++    target_link_libraries(libslic3r_gui "-lwebkit2gtk-4.0")
++endif ()
++
+ # Link the resources dir to where Slic3r GUI expects it
+ set(output_dlls_Release "")
+ set(output_dlls_Debug "")
+-- 
+2.38.1
+

pkgs/by-name/or/orcania/package.nix

@@ -16,6 +16,12 @@ stdenv.mkDerivation rec {
 
   cmakeFlags = [ "-DBUILD_ORCANIA_TESTING=on" ];
 
+  env.NIX_CFLAGS_COMPILE = toString (
+    lib.optionals stdenv.cc.isClang [
+      "-Wno-error=constant-conversion"
+    ]
+  );
+
   doCheck = true;
 
   meta = with lib; {

pkgs/by-name/pa/payload-dumper-go/package.nix

@@ -6,16 +6,16 @@
 
 buildGoModule rec {
   pname = "payload-dumper-go";
-  version = "1.2.2";
+  version = "1.3.0";
 
   src = fetchFromGitHub {
     owner = "ssut";
     repo = "payload-dumper-go";
     rev = "refs/tags/${version}";
-    hash = "sha256-P20/Nd2YOW9A9/OkpavVRBAi/ueYp812zZvVLnwX67Y=";
+    hash = "sha256-TFnBWylOoyleuBx3yYfHl1kWO6jVBiqsi8AMYLMuuk0=";
   };
 
-  vendorHash = "sha256-CqIZFMDN/kK9bT7b/32yQ9NJAQnkI8gZUMKa6MJCaec=";
+  vendorHash = "sha256-XeD47PsFjDT9777SNE8f2LbKZ1cnL5HNPr3Eg7UIpJ0=";
 
   buildInputs = [ xz ];
 

pkgs/by-name/pe/perf_data_converter/package.nix

@@ -38,8 +38,8 @@ buildBazelPackage rec {
   fetchAttrs = {
     hash =
       {
-        aarch64-linux = "sha256-gSRSkLGZhHe8o3byZVFsUxXPM+xzetOPhfzkAVTGAUs=";
-        x86_64-linux = "sha256-ZYjFpdH0oYrJguw16DSJWiXjhfJusG+inShbx/BOrcY=";
+        aarch64-linux = "sha256-F4fYZfdCmDzJRR+z1rCLsculP9y9B8H8WHNQbFZEv+s=";
+        x86_64-linux = "sha256-rjlquK0WcB7Te2uUKKVOrL7+6PtcWQImUWTVafIsbHY=";
       }
       .${system} or (throw "No hash for system: ${system}");
   };

pkgs/by-name/po/porn-vault/allow-use-of-systemd-temp-path.patch

@@ -0,0 +1,109 @@
+diff --git a/server/binaries/ffmpeg.ts b/server/binaries/ffmpeg.ts
+index abb4de4f..cdcc0a02 100644
+--- a/server/binaries/ffmpeg.ts
++++ b/server/binaries/ffmpeg.ts
+@@ -8,6 +8,7 @@ import { getConfig } from "../config";
+ import { mkdirpAsync, rimrafAsync, statAsync } from "../utils/fs/async";
+ import { formatMessage, handleError, logger } from "../utils/logger";
+ import { generateTimestampsAtIntervals } from "../utils/misc";
++import { tempPath } from "server/utils/path";
+ 
+ export async function takeScreenshot(
+   inPath: string,
+@@ -112,7 +113,7 @@ export async function generatePreview(
+ ): Promise<void> {
+   logger.debug(`Creating 100 small previews for ${sceneId}.`);
+ 
+-  const tmpFolder = resolve("tmp", "preview", sceneId);
++  const tmpFolder = resolve(tempPath, "preview", sceneId);
+ 
+   const timestamps = generateTimestampsAtIntervals(PREVIEW_COUNT, durationSecs * 1000, {
+     startPercentage: 2,
+diff --git a/server/database/index.ts b/server/database/index.ts
+index 80ff6432..c6feb11d 100755
+--- a/server/database/index.ts
++++ b/server/database/index.ts
+@@ -15,7 +15,7 @@ import Studio from "../types/studio";
+ import SceneView from "../types/watch";
+ import { mkdirpSync } from "../utils/fs/async";
+ import { logger } from "../utils/logger";
+-import { libraryPath } from "../utils/path";
++import { libraryPath, tempPath } from "../utils/path";
+ import { Izzy } from "./internal";
+ 
+ export function formatCollectionName(name: string) {
+@@ -261,11 +261,11 @@ export async function loadStore<T extends { _id: string }>(
+ }
+ 
+ export async function loadStores(): Promise<void> {
+-  if (!existsSync("tmp")) {
+-    logger.info("Creating temporary directory 'tmp'");
+-    mkdirpSync("tmp/");
++  if (!existsSync(tempPath)) {
++    logger.info(`Creating temporary directory '${tempPath}'`);
++    mkdirpSync(tempPath);
+   } else {
+-    logger.debug("Temporary directory 'tmp' already exists");
++    logger.debug(`Temporary directory '${tempPath}' already exists`);
+   }
+ 
+   const crossReferencePath = libraryPath("cross_references.db");
+diff --git a/server/graphql/mutations/image.ts b/server/graphql/mutations/image.ts
+index 6554f145..a7853eea 100644
+--- a/server/graphql/mutations/image.ts
++++ b/server/graphql/mutations/image.ts
+@@ -20,7 +20,7 @@ import Studio from "../../types/studio";
+ import { mapAsync } from "../../utils/async";
+ import { copyFileAsync, statAsync, unlinkAsync } from "../../utils/fs/async";
+ import { logger } from "../../utils/logger";
+-import { getFolderPartition, libraryPath } from "../../utils/path";
++import { getFolderPartition, libraryPath, tempPath } from "../../utils/path";
+ import { getExtension, normalizeName } from "../../utils/string";
+ import { Dictionary, isBoolean, isNumber, isString } from "../../utils/types";
+ import { clearCaches } from "../datasources";
+@@ -110,7 +110,7 @@ export default {
+ 
+     const image = new Image(imageName);
+ 
+-    const outPath = `tmp/${image._id}${ext}`;
++    const outPath = resolve(tempPath, `${image._id}${ext}`);
+ 
+     logger.debug(`Getting file...`);
+ 
+diff --git a/server/routes/scene.ts b/server/routes/scene.ts
+index 601de160..fe8b8de5 100644
+--- a/server/routes/scene.ts
++++ b/server/routes/scene.ts
+@@ -16,7 +16,7 @@ import Scene from "../types/scene";
+ import { mkdirpAsync, readFileAsync, rimrafAsync } from "../utils/fs/async";
+ import { handleError, logger } from "../utils/logger";
+ import { generateTimestampsAtIntervals } from "../utils/misc";
+-import { getFolderPartition, libraryPath } from "../utils/path";
++import { getFolderPartition, libraryPath, tempPath } from "../utils/path";
+ import { IMAGE_CACHE_CONTROL } from "./media";
+ 
+ /* function streamTranscode(
+@@ -94,7 +94,7 @@ export async function attachScenePreviewGrid(scene: Scene): Promise<string | nul
+     return null;
+   }
+ 
+-  const gridFolder = path.resolve("tmp", "grid");
++  const gridFolder = path.resolve(tempPath, "grid");
+   const tmpFolder = path.resolve(gridFolder, "thumbs", randomUUID());
+   await mkdirpAsync(tmpFolder);
+ 
+diff --git a/server/utils/path.ts b/server/utils/path.ts
+index 05619e93..64964de8 100644
+--- a/server/utils/path.ts
++++ b/server/utils/path.ts
+@@ -5,6 +5,7 @@ import { getConfig } from "../config";
+ import { mkdirpSync } from "./fs/async";
+ 
+ const configFolder = process.env.PV_CONFIG_FOLDER || process.cwd();
++export const tempPath = process.env.CACHE_DIRECTORY ?? "tmp";
+ 
+ export function libraryPath(str: string): string {
+   return resolve(getConfig().persistence.libraryPath, "library", str);
+-- 
+2.47.0
+

pkgs/by-name/po/porn-vault/package.nix

@@ -0,0 +1,114 @@
+{
+  fetchFromGitLab,
+  fetchurl,
+  rustPlatform,
+  lib,
+  pnpm_9,
+  stdenvNoCC,
+  nodejs_22,
+  ffmpeg,
+  imagemagick,
+  makeWrapper,
+  autoPatchelfHook,
+  writeShellApplication,
+}:
+let
+  izzy = rustPlatform.buildRustPackage rec {
+    pname = "izzy";
+    version = "2.0.1";
+
+    src = fetchFromGitLab {
+      owner = "porn-vault";
+      repo = "izzy";
+      rev = version;
+      hash = "sha256-UauA5mZi5a5QF7d17pKSzvyaWbeSuFjBrXEAxR3wNkk=";
+    };
+
+    postPatch = ''
+      ln -s ${./Cargo.lock} Cargo.lock
+    '';
+
+    cargoLock.lockFile = ./Cargo.lock;
+
+    meta = {
+      description = "Rust In-Memory K-V Store with Redis-Style File Persistence and Secondary Indices";
+      homepage = "https://gitlab.com/porn-vault/izzy";
+      license = lib.licenses.gpl3Plus;
+      maintainers = [ lib.maintainers.luNeder ];
+      mainProgram = "izzy";
+    };
+  };
+  pnpm = pnpm_9;
+  nodejs = nodejs_22;
+in
+stdenvNoCC.mkDerivation (finalAttrs: {
+  pname = "porn-vault";
+  version = "0.30.0-rc.11";
+
+  src = fetchFromGitLab {
+    owner = "porn-vault";
+    repo = "porn-vault";
+    rev = "4c6182c5825d85193cf67cb7cd927da2feaaecdb";
+    hash = "sha256-wQ3dqLc0l2BmLGDYrbWxX2mPwO/Tqz0fY/fOQTEUv24=";
+  };
+
+  pnpmDeps = pnpm.fetchDeps {
+    inherit (finalAttrs) pname version src;
+    hash = "sha256-Xr9tRiP1hW+aFs9FnPvPkeJ0/LtJI57cjWY5bZQaRTQ=";
+  };
+
+  nativeBuildInputs = [
+    nodejs
+    pnpm.configHook
+    makeWrapper
+  ];
+
+  patches = [
+    ./allow-use-of-systemd-temp-path.patch
+  ];
+
+  postPatch = ''
+    substituteInPlace server/binaries/izzy.ts \
+      --replace-fail 'chmodSync(izzyPath, "111");' ""
+  '';
+
+  buildPhase = ''
+    runHook preBuild
+
+    pnpm build
+
+    runHook postBuild
+  '';
+
+  installPhase = ''
+    runHook preInstall
+
+    install -Dm644 package.json config.example.json remix.config.js -t $out/share/porn-vault
+    cp -R public dist build node_modules graphql locale -t $out/share/porn-vault
+
+    runHook postInstall
+  '';
+
+  preFixup = ''
+    makeWrapper "${lib.getExe nodejs}" "$out/bin/porn-vault" \
+      --chdir "$out/share/porn-vault" \
+      --add-flags "dist/index.js" \
+      --set-default IZZY_PATH "${lib.getExe izzy}" \
+      --prefix PATH : "${
+        lib.makeBinPath [
+          ffmpeg
+          imagemagick
+          izzy
+        ]
+      }"
+  '';
+
+  meta = {
+    description = "Porn-Vault is a self hosted organizer for adult videos and imagery.";
+    homepage = "https://gitlab.com/porn-vault/porn-vault";
+    license = lib.licenses.gpl3Plus;
+    maintainers = [ lib.maintainers.luNeder ];
+    inherit (nodejs.meta) platforms;
+    mainProgram = "porn-vault";
+  };
+})

pkgs/by-name/qi/qidi-slicer-bin/package.nix

@@ -0,0 +1,48 @@
+{
+  appimageTools,
+  fetchurl,
+  webkitgtk_4_1,
+  libsoup_3,
+  lib,
+  hicolor-icon-theme,
+}:
+let
+  pname = "qidi-slicer";
+  version = "1.2.0";
+
+  src = fetchurl {
+    url = "https://github.com/QIDITECH/QIDISlicer/releases/download/V${version}/QIDISlicer_${version}_Linux_x64_newer.AppImage";
+    hash = "sha256-WMurkt9VJTlFnx66ByQq+WVtx37q5P4mA4cxF/UzC50=";
+  };
+
+  appimageContents = appimageTools.extract {
+    inherit version pname src;
+  };
+in
+appimageTools.wrapType2 {
+  inherit pname version src;
+  extraPkgs = pkgs: [
+    webkitgtk_4_1
+    libsoup_3
+  ];
+
+  extraInstallCommands = ''
+    ln -s "$out/bin/qidi-slicer" "$out/bin/qidi-gcodeviewer"
+    install -m 444 -D ${appimageContents}/QIDISlicer.desktop $out/share/applications/QIDISlicer.desktop
+    install -m 444 -D ${appimageContents}/usr/bin/resources/icons/QIDISlicer.svg $out/share/icons/hicolor/scalable/apps/QIDISlicer.svg
+  '';
+
+  meta = {
+    description = "Slicer for QIDI 3D Printers, based on PrusaSlicer";
+    longDescription = ''
+      QIDISlicer is a 3D printer slicing software that works with all QIDI Technology printers and filaments.
+      It is easy to use and has all the functions you need to learn 3D printing.
+    '';
+    homepage = "https://github.com/QIDITECH/QIDISlicer";
+    license = lib.licenses.agpl3Plus;
+    maintainers = with lib.maintainers; [ j0hax ];
+    mainProgram = "qidi-slicer";
+    platforms = [ "x86_64-linux" ];
+    sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
+  };
+}

pkgs/by-name/re/rep-gtk/package.nix

@@ -29,6 +29,13 @@ stdenv.mkDerivation (finalAttrs: {
 
   strictDeps = true;
 
+  env.NIX_CFLAGS_COMPILE = toString (
+    lib.optionals stdenv.cc.isClang [
+      "-Wno-error=implicit-function-declaration"
+      "-Wno-error=int-conversion"
+    ]
+  );
+
   patchPhase = ''
     sed -e 's|installdir=$(repexecdir)|installdir=$(libdir)/rep|g' -i Makefile.in
   '';

pkgs/by-name/se/selinux-python/package.nix

@@ -15,7 +15,11 @@ stdenv.mkDerivation rec {
 
   strictDeps = true;
 
-  nativeBuildInputs = [ python3 python3.pkgs.wrapPython ];
+  nativeBuildInputs = [
+    python3
+    python3.pkgs.distutils
+    python3.pkgs.wrapPython
+  ];
   buildInputs = [ libsepol ];
   propagatedBuildInputs = [ libselinux libsemanage setools python3.pkgs.ipy ];
 

pkgs/by-name/sw/switch-to-configuration-ng/src/src/main.rs

@@ -79,6 +79,7 @@ const DRY_RELOAD_BY_ACTIVATION_LIST_FILE: &str = "/run/nixos/dry-activation-relo
 #[derive(Debug, Clone, PartialEq)]
 enum Action {
     Switch,
+    Check,
     Boot,
     Test,
     DryActivate,
@@ -93,6 +94,7 @@ impl std::str::FromStr for Action {
             "boot" => Self::Boot,
             "test" => Self::Test,
             "dry-activate" => Self::DryActivate,
+            "check" => Self::Check,
             _ => bail!("invalid action {s}"),
         })
     }
@@ -105,6 +107,7 @@ impl Into<&'static str> for &Action {
             Action::Boot => "boot",
             Action::Test => "test",
             Action::DryActivate => "dry-activate",
+            Action::Check => "check",
         }
     }
 }
@@ -129,6 +132,28 @@ fn parse_os_release() -> Result<HashMap<String, String>> {
         }))
 }
 
+fn do_pre_switch_check(command: &str, toplevel: &Path) -> Result<()> {
+    let mut cmd_split = command.split_whitespace();
+    let Some(argv0) = cmd_split.next() else {
+        bail!("missing first argument in install bootloader commands");
+    };
+
+    match std::process::Command::new(argv0)
+        .args(cmd_split.collect::<Vec<&str>>())
+        .arg(toplevel)
+        .spawn()
+        .map(|mut child| child.wait())
+    {
+        Ok(Ok(status)) if status.success() => {}
+        _ => {
+            eprintln!("Pre-switch checks failed");
+            die()
+        }
+    }
+
+    Ok(())
+}
+
 fn do_install_bootloader(command: &str, toplevel: &Path) -> Result<()> {
     let mut cmd_split = command.split_whitespace();
     let Some(argv0) = cmd_split.next() else {
@@ -939,7 +964,8 @@ fn do_user_switch(parent_exe: String) -> anyhow::Result<()> {
 
 fn usage(argv0: &str) -> ! {
     eprintln!(
-        r#"Usage: {} [switch|boot|test|dry-activate]
+        r#"Usage: {} [check|switch|boot|test|dry-activate]
+check:        run pre-switch checks and exit
 switch:       make the configuration the boot default and activate now
 boot:         make the configuration the boot default
 test:         activate the configuration, but don't make it the boot default
@@ -955,6 +981,7 @@ fn do_system_switch(action: Action) -> anyhow::Result<()> {
     let out = PathBuf::from(required_env("OUT")?);
     let toplevel = PathBuf::from(required_env("TOPLEVEL")?);
     let distro_id = required_env("DISTRO_ID")?;
+    let pre_switch_check = required_env("PRE_SWITCH_CHECK")?;
     let install_bootloader = required_env("INSTALL_BOOTLOADER")?;
     let locale_archive = required_env("LOCALE_ARCHIVE")?;
     let new_systemd = PathBuf::from(required_env("SYSTEMD")?);
@@ -1013,6 +1040,18 @@ fn do_system_switch(action: Action) -> anyhow::Result<()> {
         bail!("Failed to initialize logger");
     }
 
+    if std::env::var("NIXOS_NO_CHECK")
+        .as_deref()
+        .unwrap_or_default()
+        != "1"
+    {
+        do_pre_switch_check(&pre_switch_check, &toplevel)?;
+    }
+
+    if *action == Action::Check {
+        return Ok(());
+    }
+
     // Install or update the bootloader.
     if matches!(action, Action::Switch | Action::Boot) {
         do_install_bootloader(&install_bootloader, &toplevel)?;

pkgs/by-name/ta/taizen/package.nix

@@ -1,6 +1,7 @@
 { lib
 , rustPlatform
 , fetchFromGitHub
+, fetchpatch2
 , pkg-config
 , ncurses
 , openssl
@@ -19,7 +20,16 @@ rustPlatform.buildRustPackage rec {
     hash = "sha256-pGcD3+3Ds3U8NuNySaDnz0zzAvZlSDte1jRPdM5qrZA=";
   };
 
-  cargoHash = "sha256-2X9ZhqaQ6Y+mwXTMbvBQWLR24+KYYqjIqQy/8XqGi18=";
+  cargoPatches = [
+    # update cargo dependencies upstreamed: https://github.com/oppiliappan/taizen/pull/27
+    (fetchpatch2 {
+      name = "update-cargo-lock.patch";
+      url = "https://github.com/oppiliappan/taizen/commit/104a1663268623e9ded45afaf2fe98c9c42b7b21.patch";
+      hash = "sha256-ujsr7MjZWEu+2mijVH1aqtTJXKZC4m5vl73Jre9XHbU=";
+    })
+  ];
+
+  cargoHash = "sha256-bE7GZOQgAg4XdWCmnicPK4H4Y+T1snISCe/uGjoQATo=";
 
   nativeBuildInputs = [ pkg-config ];
 

pkgs/by-name/te/television/package.nix

@@ -0,0 +1,49 @@
+{
+  lib,
+  rustPlatform,
+  fetchFromGitHub,
+  testers,
+  television,
+  nix-update-script,
+}:
+rustPlatform.buildRustPackage rec {
+  pname = "television";
+  version = "0.5.0";
+
+  src = fetchFromGitHub {
+    owner = "alexpasmantier";
+    repo = "television";
+    rev = "refs/tags/" + version;
+    hash = "sha256-yi8lPm3zkmamN6gPlGfojNlIXM1cgSr1zL2zMNni5f0=";
+  };
+
+  cargoHash = "sha256-1SdyVtMjkfXH9iGew9i8xpx8WlUly4vIcKY3weeW3LQ=";
+
+  passthru = {
+    tests.version = testers.testVersion {
+      package = television;
+      command = "XDG_DATA_HOME=$TMPDIR tv --version";
+    };
+    updateScript = nix-update-script { };
+  };
+
+  meta = {
+    description = "Television is a blazingly fast general purpose fuzzy finder";
+
+    longDescription = ''
+      Television is a blazingly fast general purpose fuzzy finder TUI written
+      in Rust. It is inspired by the neovim telescope plugin and is designed
+      to be fast, efficient, simple to use and easily extensible. It is built
+      on top of tokio, ratatui and the nucleo matcher used by the helix editor.
+    '';
+
+    homepage = "https://github.com/alexpasmantier/television";
+    changelog = "https://github.com/alexpasmantier/television/releases/tag/${version}";
+    license = lib.licenses.mit;
+    mainProgram = "tv";
+    maintainers = with lib.maintainers; [
+      louis-thevenet
+      getchoo
+    ];
+  };
+}

pkgs/by-name/tp/tplay/package.nix

@@ -13,16 +13,16 @@
 }:
 rustPlatform.buildRustPackage rec {
   pname = "tplay";
-  version = "0.5.0";
+  version = "0.6.0";
 
   src = fetchFromGitHub {
     owner = "maxcurzi";
     repo = "tplay";
     rev = "v${version}";
-    hash = "sha256-/3ui0VOxf+kYfb0JQXPVbjAyXPph2LOg2xB0DGmAbwc=";
+    hash = "sha256-SRn7kg5FdSimKMFowKNUIan+MrojtNO0apeehIRTzfw=";
   };
 
-  cargoHash = "sha256-zRkIEH37pvxHUbnfg25GW1Z7od9XMkRmP2Qvs64uUjg=";
+  cargoHash = "sha256-ztWs20Vl+fX0enL12pybiM6lhFh0/EFa1aSTRpzz64g=";
   checkFlags = [
     # requires network access
     "--skip=pipeline::image_pipeline::tests::test_process"

pkgs/by-name/wa/warp-terminal/versions.json

@@ -1,14 +1,14 @@
 {
   "darwin": {
-    "hash": "sha256-AtKLtEhibD5sHNcjmScxykLd2si5dwGDTFd0NldbHFQ=",
-    "version": "0.2024.10.29.08.02.stable_02"
+    "hash": "sha256-zvM7CcWYFXMN9dLoJqXnQlENmWDGYRKXQACtUQnXmmE=",
+    "version": "0.2024.11.19.08.02.stable_01"
   },
   "linux_x86_64": {
-    "hash": "sha256-jKk80+9XKLzM68a9YQFIddxzRLzVc8vmPmnS3ZJ+9s8=",
-    "version": "0.2024.10.29.08.02.stable_02"
+    "hash": "sha256-4uYVA+6NI11X/rYwEzHeTiPnDyntpZcBBBCiZkc9ik8=",
+    "version": "0.2024.11.19.08.02.stable_01"
   },
   "linux_aarch64": {
-    "hash": "sha256-k1OkiK3reedJQINK8vZYP7G2Mm9KnWV+RuvHZZJYHqI=",
-    "version": "0.2024.10.29.08.02.stable_02"
+    "hash": "sha256-3Tx/NcWV0zyTRp5FVqWTfnhXoxrW3ph/Ytc2tjfNhcs=",
+    "version": "0.2024.11.19.08.02.stable_01"
   }
 }

pkgs/by-name/wa/wayclip/package.nix

@@ -0,0 +1,46 @@
+{
+  lib,
+  stdenv,
+  fetchFromSourcehut,
+  nix-update-script,
+  wayland,
+  wayland-scanner,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "wayclip";
+  version = "0.4.2";
+
+  outputs = [
+    "out"
+    "man"
+  ];
+
+  src = fetchFromSourcehut {
+    owner = "~noocsharp";
+    repo = "wayclip";
+    rev = finalAttrs.version;
+    hash = "sha256-/xii/FF8JPv6KbMMxzww9AYqYJrpKYowsxQ5Bz7m+/M=";
+  };
+
+  strictDeps = true;
+
+  nativeBuildInputs = [ wayland-scanner ];
+
+  buildInputs = [ wayland ];
+
+  makeFlags = [ "PREFIX=${placeholder "out"}" ];
+
+  passthru = {
+    updateScript = nix-update-script { };
+  };
+
+  meta = {
+    description = "Wayland clipboard utility";
+    homepage = "https://sr.ht/~noocsharp/wayclip/";
+    license = lib.licenses.isc;
+    maintainers = with lib.maintainers; [ getchoo ];
+    mainProgram = "waycopy";
+    inherit (wayland.meta) platforms;
+  };
+})

pkgs/by-name/wc/wchisp/package.nix

@@ -34,14 +34,14 @@ rustPlatform.buildRustPackage rec {
     };
   };
 
-  meta = with lib; {
+  meta = {
     description = "A command-line implementation of WCHISPTool, for flashing ch32 MCUs";
     homepage = "https://ch32-rs.github.io/wchisp/";
     changelog = "https://github.com/ch32-rs/wchisp/releases/tag/v${version}";
-    license = with licenses; [ gpl2Only ];
-    platforms = with platforms; linux ++ darwin ++ windows;
+    license = with lib.licenses; [ gpl2Only ];
+    platforms = with lib.platforms; linux ++ darwin ++ windows;
     broken = !stdenv.hostPlatform.isLinux;
-    maintainers = with maintainers; [ jwillikers ];
+    maintainers = with lib.maintainers; [ jwillikers ];
     mainProgram = "wchisp";
   };
 }