Merge master into haskell-updates

maintainers/maintainer-list.nix

@@ -12662,6 +12662,12 @@
     githubId = 1711539;
     name = "matklad";
   };
+  matko = {
+    email = "maren.van.otterdijk@gmail.com";
+    github = "matko";
+    githubId = 155603;
+    name = "Maren van Otterdijk";
+  };
   matrss = {
     name = "Matthias Riße";
     email = "matthias.risze@t-online.de";
@@ -13327,6 +13333,12 @@
     name = "midchildan";
     keys = [ { fingerprint = "FEF0 AE2D 5449 3482 5F06  40AA 186A 1EDA C5C6 3F83"; } ];
   };
+  midirhee12 = {
+    email = "midirhee@proton.me";
+    github = "midirhee12";
+    githubId = 38054771;
+    name = "midirhee12";
+  };
   mig4ng = {
     email = "mig4ng@gmail.com";
     github = "mig4ng";
@@ -15164,6 +15176,12 @@
     githubId = 848535;
     name = "Oleg Lebedev";
   };
+  oleina = {
+    email = "antholeinik@gmail.com";
+    github = "antholeole";
+    githubId = 48811365;
+    name = "Anthony Oleinik";
+  };
   olejorgenb = {
     email = "olejorgenb@yahoo.no";
     github = "olejorgenb";
@@ -17184,6 +17202,13 @@
     githubId = 801525;
     name = "rembo10";
   };
+  remcoschrijver = {
+    email = "info@writerit.nl";
+    matrix = "@remcoschrijver:tchncs.de";
+    github = "remcoschrijver";
+    githubId = 45097990;
+    name = "Remco Schrijver";
+  };
   remexre = {
     email = "nathan+nixpkgs@remexre.com";
     github = "remexre";

maintainers/scripts/bootstrap-files/refresh-tarballs.bash

@@ -95,6 +95,7 @@ CROSS_TARGETS=(
     powerpc64-unknown-linux-gnuabielfv2
     powerpc64le-unknown-linux-gnu
     riscv64-unknown-linux-gnu
+    s390x-unknown-linux-gnu
     x86_64-unknown-freebsd
 )
 

nixos/doc/manual/release-notes/rl-2411.section.md

@@ -72,6 +72,8 @@
 
 - [OpenGFW](https://github.com/apernet/OpenGFW), an implementation of the Great Firewall on Linux. Available as [services.opengfw](#opt-services.opengfw.enable).
 
+- [Rathole](https://github.com/rapiz1/rathole), a lightweight and high-performance reverse proxy for NAT traversal. Available as [services.rathole](#opt-services.rathole.enable).
+
 ## Backward Incompatibilities {#sec-release-24.11-incompatibilities}
 
 - `transmission` package has been aliased with a `trace` warning to `transmission_3`. Since [Transmission 4 has been released last year](https://github.com/transmission/transmission/releases/tag/4.0.0), and Transmission 3 will eventually go away, it was decided perform this warning alias to make people aware of the new version. The `services.transmission.package` defaults to `transmission_3` as well because the upgrade can cause data loss in certain specific usage patterns (examples: [#5153](https://github.com/transmission/transmission/issues/5153), [#6796](https://github.com/transmission/transmission/issues/6796)). Please make sure to back up to your data directory per your usage:
@@ -179,6 +181,10 @@
   and `nodePackages.vscode-json-languageserver-bin` were dropped due to an unmaintained upstream.
   The `vscode-langservers-extracted` package is a maintained drop-in replacement.
 
+- `fetchNextcloudApp` has been rewritten to use `fetchurl` rather than
+  `fetchzip`. This invalidates all existing hashes but you can restore the old
+  behavior by passing it `unpack = true`.
+
 - `haskell.lib.compose.justStaticExecutables` now disallows references to GHC in the
   output by default, to alert users to closure size issues caused by
   [#164630](https://github.com/NixOS/nixpkgs/issues/164630). See ["Packaging

nixos/modules/module-list.nix

@@ -1165,6 +1165,7 @@
   ./services/networking/r53-ddns.nix
   ./services/networking/radicale.nix
   ./services/networking/radvd.nix
+  ./services/networking/rathole.nix
   ./services/networking/rdnssd.nix
   ./services/networking/realm.nix
   ./services/networking/redsocks.nix

nixos/modules/services/misc/ananicy.nix

@@ -1,85 +1,119 @@
-{ config, lib, pkgs, ... }:
+{
-
+  config,
-with lib;
+  lib,
+  pkgs,
+  ...
+}:
 
 let
   cfg = config.services.ananicy;
-  configFile = pkgs.writeText "ananicy.conf" (generators.toKeyValue { } cfg.settings);
+  configFile = pkgs.writeText "ananicy.conf" (lib.generators.toKeyValue { } cfg.settings);
-  extraRules = pkgs.writeText "extraRules" (concatMapStringsSep "\n" (l: builtins.toJSON l) cfg.extraRules);
+  extraRules = pkgs.writeText "extraRules" (
-  extraTypes = pkgs.writeText "extraTypes" (concatMapStringsSep "\n" (l: builtins.toJSON l) cfg.extraTypes);
+    lib.concatMapStringsSep "\n" (l: builtins.toJSON l) cfg.extraRules
-  extraCgroups = pkgs.writeText "extraCgroups" (concatMapStringsSep "\n" (l: builtins.toJSON l) cfg.extraCgroups);
+  );
-  servicename = if ((lib.getName cfg.package) == (lib.getName pkgs.ananicy-cpp)) then "ananicy-cpp" else "ananicy";
+  extraTypes = pkgs.writeText "extraTypes" (
+    lib.concatMapStringsSep "\n" (l: builtins.toJSON l) cfg.extraTypes
+  );
+  extraCgroups = pkgs.writeText "extraCgroups" (
+    lib.concatMapStringsSep "\n" (l: builtins.toJSON l) cfg.extraCgroups
+  );
+  servicename =
+    if ((lib.getName cfg.package) == (lib.getName pkgs.ananicy-pp)) then "ananicy-cpp" else "ananicy";
+  # Ananicy-CPP with BPF is not supported on hardened kernels https://github.com/NixOS/nixpkgs/issues/327382
+  finalPackage =
+    if (servicename == "ananicy-cpp" && config.boot.kernelPackages.isHardened) then
+      (cfg.package { withBpf = false; })
+    else
+      cfg.package;
 in
 {
-  options = {
+  options.services.ananicy = {
-    services.ananicy = {
+    enable = lib.mkEnableOption "Ananicy, an auto nice daemon";
-      enable = mkEnableOption "Ananicy, an auto nice daemon";
 
-      package = mkPackageOption pkgs "ananicy" {
+    package = lib.mkPackageOption pkgs "ananicy" { example = "ananicy-cpp"; };
-        example = "ananicy-cpp";
-      };
 
-      rulesProvider = mkPackageOption pkgs "ananicy" {
+    rulesProvider = lib.mkPackageOption pkgs "ananicy" { example = "ananicy-cpp"; } // {
-        example = "ananicy-cpp";
+      description = ''
-      } // {
+        Which package to copy default rules,types,cgroups from.
-        description = ''
+      '';
-          Which package to copy default rules,types,cgroups from.
+    };
-        '';
-      };
 
-      settings = mkOption {
+    settings = lib.mkOption {
-        type = with types; attrsOf (oneOf [ int bool str ]);
+      type =
-        default = { };
+        with lib.types;
-        example = {
+        attrsOf (oneOf [
-          apply_nice = false;
+          int
-        };
+          bool
-        description = ''
+          str
-          See <https://github.com/Nefelim4ag/Ananicy/blob/master/ananicy.d/ananicy.conf>
+        ]);
-        '';
+      default = { };
+      example = {
+        apply_nice = false;
       };
+      description = ''
+        See <https://github.com/Nefelim4ag/Ananicy/blob/master/ananicy.d/ananicy.conf>
+      '';
+    };
 
-      extraRules = mkOption {
+    extraRules = lib.mkOption {
-        type = with types; listOf attrs;
+      type = with lib.types; listOf attrs;
-        default = [ ];
+      default = [ ];
-        description = ''
+      description = ''
-          Rules to write in 'nixRules.rules'. See:
+        Rules to write in 'nixRules.rules'. See:
-          <https://github.com/Nefelim4ag/Ananicy#configuration>
+        <https://github.com/Nefelim4ag/Ananicy#configuration>
-          <https://gitlab.com/ananicy-cpp/ananicy-cpp/#global-configuration>
+        <https://gitlab.com/ananicy-cpp/ananicy-cpp/#global-configuration>
-        '';
+      '';
-        example = [
+      example = [
-          { name = "eog"; type = "Image-Viewer"; }
+        {
-          { name = "fdupes"; type = "BG_CPUIO"; }
+          name = "eog";
-        ];
+          type = "Image-Viewer";
-      };
+        }
-      extraTypes = mkOption {
+        {
-        type = with types; listOf attrs;
+          name = "fdupes";
-        default = [ ];
+          type = "BG_CPUIO";
-        description = ''
+        }
-          Types to write in 'nixTypes.types'. See:
+      ];
-          <https://gitlab.com/ananicy-cpp/ananicy-cpp/#types>
+    };
-        '';
+    extraTypes = lib.mkOption {
-        example = [
+      type = with lib.types; listOf attrs;
-          { type = "my_type"; nice = 19; other_parameter = "value"; }
+      default = [ ];
-          { type = "compiler"; nice = 19; sched = "batch"; ioclass = "idle"; }
+      description = ''
-        ];
+        Types to write in 'nixTypes.types'. See:
-      };
+        <https://gitlab.com/ananicy-cpp/ananicy-cpp/#types>
-      extraCgroups = mkOption {
+      '';
-        type = with types; listOf attrs;
+      example = [
-        default = [ ];
+        {
-        description = ''
+          type = "my_type";
-          Cgroups to write in 'nixCgroups.cgroups'. See:
+          nice = 19;
-          <https://gitlab.com/ananicy-cpp/ananicy-cpp/#cgroups>
+          other_parameter = "value";
-        '';
+        }
-        example = [
+        {
-          { cgroup = "cpu80"; CPUQuota = 80; }
+          type = "compiler";
-        ];
+          nice = 19;
-      };
+          sched = "batch";
+          ioclass = "idle";
+        }
+      ];
+    };
+    extraCgroups = lib.mkOption {
+      type = with lib.types; listOf attrs;
+      default = [ ];
+      description = ''
+        Cgroups to write in 'nixCgroups.cgroups'. See:
+        <https://gitlab.com/ananicy-cpp/ananicy-cpp/#cgroups>
+      '';
+      example = [
+        {
+          cgroup = "cpu80";
+          CPUQuota = 80;
+        }
+      ];
     };
   };
 
-  config = mkIf cfg.enable {
+  config = lib.mkIf cfg.enable {
     environment = {
-      systemPackages = [ cfg.package ];
+      systemPackages = [ finalPackage ];
       etc."ananicy.d".source = pkgs.runCommandLocal "ananicyfiles" { } ''
         mkdir -p $out
         # ananicy-cpp does not include rules or settings on purpose
@@ -92,16 +126,16 @@ in
         # configured through .setings
         rm -f $out/ananicy.conf
         cp ${configFile} $out/ananicy.conf
-        ${optionalString (cfg.extraRules != [ ]) "cp ${extraRules} $out/nixRules.rules"}
+        ${lib.optionalString (cfg.extraRules != [ ]) "cp ${extraRules} $out/nixRules.rules"}
-        ${optionalString (cfg.extraTypes != [ ]) "cp ${extraTypes} $out/nixTypes.types"}
+        ${lib.optionalString (cfg.extraTypes != [ ]) "cp ${extraTypes} $out/nixTypes.types"}
-        ${optionalString (cfg.extraCgroups != [ ]) "cp ${extraCgroups} $out/nixCgroups.cgroups"}
+        ${lib.optionalString (cfg.extraCgroups != [ ]) "cp ${extraCgroups} $out/nixCgroups.cgroups"}
       '';
     };
 
     # ananicy and ananicy-cpp have different default settings
     services.ananicy.settings =
       let
-        mkOD = mkOptionDefault;
+        mkOD = lib.mkOptionDefault;
       in
       {
         cgroup_load = mkOD true;
@@ -113,26 +147,30 @@ in
         apply_sched = mkOD true;
         apply_oom_score_adj = mkOD true;
         apply_cgroup = mkOD true;
-      } // (if ((lib.getName cfg.package) == (lib.getName pkgs.ananicy-cpp)) then {
+      }
-        # https://gitlab.com/ananicy-cpp/ananicy-cpp/-/blob/master/src/config.cpp#L12
+      // (
-        loglevel = mkOD "warn"; # default is info but its spammy
+        if servicename == "ananicy-cpp" then
-        cgroup_realtime_workaround = true;
+          {
-        log_applied_rule = mkOD false;
+            # https://gitlab.com/ananicy-cpp/ananicy-cpp/-/blob/master/src/config.cpp#L12
-      } else {
+            loglevel = mkOD "warn"; # default is info but its spammy
-        # https://github.com/Nefelim4ag/Ananicy/blob/master/ananicy.d/ananicy.conf
+            cgroup_realtime_workaround = true;
-        check_disks_schedulers = mkOD true;
+            log_applied_rule = mkOD false;
-        check_freq = mkOD 5;
+          }
-      });
+        else
+          {
+            # https://github.com/Nefelim4ag/Ananicy/blob/master/ananicy.d/ananicy.conf
+            check_disks_schedulers = mkOD true;
+            check_freq = mkOD 5;
+          }
+      );
 
     systemd = {
-      packages = [ cfg.package ];
+      packages = [ finalPackage ];
       services."${servicename}" = {
         wantedBy = [ "default.target" ];
       };
     };
   };
 
-  meta = {
+  meta.maintainers = with lib.maintainers; [ artturin ];
-    maintainers = with maintainers; [ artturin ];
-  };
 }

nixos/modules/services/networking/rathole.nix

@@ -0,0 +1,165 @@
+{
+  pkgs,
+  lib,
+  config,
+  ...
+}:
+
+let
+  cfg = config.services.rathole;
+  settingsFormat = pkgs.formats.toml { };
+  py-toml-merge =
+    pkgs.writers.writePython3Bin "py-toml-merge"
+      {
+        libraries = with pkgs.python3Packages; [
+          tomli-w
+          mergedeep
+        ];
+      }
+      ''
+        import argparse
+        from pathlib import Path
+        from typing import Any
+
+        import tomli_w
+        import tomllib
+        from mergedeep import merge
+
+        parser = argparse.ArgumentParser(description="Merge multiple TOML files")
+        parser.add_argument(
+            "files",
+            type=Path,
+            nargs="+",
+            help="List of TOML files to merge",
+        )
+
+        args = parser.parse_args()
+        merged: dict[str, Any] = {}
+
+        for file in args.files:
+            with open(file, "rb") as fh:
+                loaded_toml = tomllib.load(fh)
+                merged = merge(merged, loaded_toml)
+
+        print(tomli_w.dumps(merged))
+      '';
+in
+
+{
+  options = {
+    services.rathole = {
+      enable = lib.mkEnableOption "Rathole";
+
+      package = lib.mkPackageOption pkgs "rathole" { };
+
+      role = lib.mkOption {
+        type = lib.types.enum [
+          "server"
+          "client"
+        ];
+        description = ''
+          Select whether rathole needs to be run as a `client` or a `server`.
+          Server is a machine with a public IP and client is a device behind NAT,
+          but running some services that need to be exposed to the Internet.
+        '';
+      };
+
+      credentialsFile = lib.mkOption {
+        type = lib.types.path;
+        default = "/dev/null";
+        description = ''
+          Path to a TOML file to be merged with the settings.
+          Useful to set secret config parameters like tokens, which
+          should not appear in the Nix Store.
+        '';
+        example = "/var/lib/secrets/rathole/config.toml";
+      };
+
+      settings = lib.mkOption {
+        type = settingsFormat.type;
+        default = { };
+        description = ''
+          Rathole configuration, for options reference
+          see the [example](https://github.com/rapiz1/rathole?tab=readme-ov-file#configuration) on GitHub.
+          Both server and client configurations can be specified at the same time, regardless of the selected role.
+        '';
+        example = {
+          server = {
+            bind_addr = "0.0.0.0:2333";
+            services.my_nas_ssh = {
+              token = "use_a_secret_that_only_you_know";
+              bind_addr = "0.0.0.0:5202";
+            };
+          };
+        };
+      };
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    systemd.services.rathole = {
+      requires = [ "network.target" ];
+      after = [ "network.target" ];
+      wantedBy = [ "multi-user.target" ];
+      description = "Rathole ${cfg.role} Service";
+
+      serviceConfig =
+        let
+          name = "rathole";
+          configFile = settingsFormat.generate "${name}.toml" cfg.settings;
+          runtimeDir = "/run/${name}";
+          ratholePrestart =
+            "+"
+            + (pkgs.writeShellScript "rathole-prestart" ''
+              DYNUSER_UID=$(stat -c %u ${runtimeDir})
+              DYNUSER_GID=$(stat -c %g ${runtimeDir})
+              ${lib.getExe py-toml-merge} ${configFile} '${cfg.credentialsFile}' |
+                install -m 600 -o $DYNUSER_UID -g $DYNUSER_GID /dev/stdin ${runtimeDir}/${mergedConfigName}
+            '');
+          mergedConfigName = "merged.toml";
+        in
+        {
+          Type = "simple";
+          Restart = "on-failure";
+          RestartSec = 5;
+          ExecStartPre = ratholePrestart;
+          ExecStart = "${lib.getExe cfg.package} --${cfg.role} ${runtimeDir}/${mergedConfigName}";
+          DynamicUser = true;
+          LimitNOFILE = "1048576";
+          RuntimeDirectory = name;
+          RuntimeDirectoryMode = "0700";
+          # Hardening
+          AmbientCapabilities = "CAP_NET_BIND_SERVICE";
+          CapabilityBoundingSet = "CAP_NET_BIND_SERVICE";
+          LockPersonality = true;
+          MemoryDenyWriteExecute = true;
+          PrivateDevices = true;
+          PrivateMounts = true;
+          PrivateTmp = true;
+          # PrivateUsers=true breaks AmbientCapabilities=CAP_NET_BIND_SERVICE
+          ProcSubset = "pid";
+          ProtectClock = true;
+          ProtectControlGroups = true;
+          ProtectHome = true;
+          ProtectHostname = true;
+          ProtectKernelLogs = true;
+          ProtectKernelModules = true;
+          ProtectKernelTunables = true;
+          ProtectProc = "invisible";
+          ProtectSystem = "strict";
+          RemoveIPC = true;
+          RestrictAddressFamilies = [
+            "AF_INET"
+            "AF_INET6"
+          ];
+          RestrictNamespaces = true;
+          RestrictRealtime = true;
+          RestrictSUIDSGID = true;
+          SystemCallArchitectures = "native";
+          UMask = "0066";
+        };
+    };
+  };
+
+  meta.maintainers = with lib.maintainers; [ xokdvium ];
+}

nixos/modules/services/web-apps/pretix.nix

@@ -538,6 +538,7 @@ in
           TimeoutStartSec = "15min";
           ExecStart = "${getExe' pythonEnv "gunicorn"} --bind unix:/run/pretix/pretix.sock ${cfg.gunicorn.extraArgs} pretix.wsgi";
           RuntimeDirectory = "pretix";
+          Restart = "on-failure";
         };
       };
 
@@ -559,7 +560,10 @@ in
           "postgresql.service"
         ];
         wantedBy = [ "multi-user.target" ];
-        serviceConfig.ExecStart = "${getExe' pythonEnv "celery"} -A pretix.celery_app worker ${cfg.celery.extraArgs}";
+        serviceConfig = {
+          ExecStart = "${getExe' pythonEnv "celery"} -A pretix.celery_app worker ${cfg.celery.extraArgs}";
+          Restart = "on-failure";
+        };
       };
 
       nginx.serviceConfig.SupplementaryGroups = mkIf cfg.nginx.enable [ "pretix" ];

nixos/modules/system/boot/loader/systemd-boot/systemd-boot-builder.py

@@ -29,6 +29,7 @@ DISTRO_NAME = "@distroName@"
 NIX = "@nix@"
 SYSTEMD = "@systemd@"
 CONFIGURATION_LIMIT = int("@configurationLimit@")
+REBOOT_FOR_BITLOCKER = bool("@rebootForBitlocker@")
 CAN_TOUCH_EFI_VARIABLES = "@canTouchEfiVariables@"
 GRACEFUL = "@graceful@"
 COPY_EXTRA_FILES = "@copyExtraFiles@"
@@ -189,6 +190,8 @@ def write_loader_conf(profile: str | None) -> None:
             f.write("default nixos-generation-*\n")
         if not EDITOR:
             f.write("editor 0\n")
+        if REBOOT_FOR_BITLOCKER:
+            f.write("reboot-for-bitlocker yes\n");
         f.write(f"console-mode {CONSOLE_MODE}\n")
         f.flush()
         os.fsync(f.fileno())

nixos/modules/system/boot/loader/systemd-boot/systemd-boot.nix

@@ -40,7 +40,7 @@ let
 
     configurationLimit = if cfg.configurationLimit == null then 0 else cfg.configurationLimit;
 
-    inherit (cfg) consoleMode graceful editor;
+    inherit (cfg) consoleMode graceful editor rebootForBitlocker;
 
     inherit (efi) efiSysMountPoint canTouchEfiVariables;
 
@@ -333,6 +333,22 @@ in {
       };
     };
 
+    rebootForBitlocker = mkOption {
+      default = false;
+
+      type = types.bool;
+
+      description = ''
+        Enable *EXPERIMENTAL* BitLocker support.
+
+        Try to detect BitLocker encrypted drives along with an active
+        TPM. If both are found and Windows Boot Manager is selected in
+        the boot menu, set the "BootNext" EFI variable and restart the
+        system. The firmware will then start Windows Boot Manager
+        directly, leaving the TPM PCRs in expected states so that
+        Windows can unseal the encryption key.
+      '';
+    };
   };
 
   config = mkIf cfg.enable {

nixos/modules/system/boot/systemd/initrd.nix

@@ -103,7 +103,7 @@ let
   initrdBinEnv = pkgs.buildEnv {
     name = "initrd-bin-env";
     paths = map getBin cfg.initrdBin;
-    pathsToLink = ["/bin" "/sbin"];
+    pathsToLink = ["/bin"];
     postBuild = concatStringsSep "\n" (mapAttrsToList (n: v: "ln -sf '${v}' $out/bin/'${n}'") cfg.extraBin);
   };
 
@@ -408,7 +408,7 @@ in {
         fsck = "${cfg.package.util-linux}/bin/fsck";
       };
 
-      managerEnvironment.PATH = "/bin:/sbin";
+      managerEnvironment.PATH = "/bin";
 
       contents = {
         "/tmp/.keep".text = "systemd requires the /tmp mount point in the initrd cpio archive";
@@ -417,7 +417,7 @@ in {
 
         "/etc/systemd/system.conf".text = ''
           [Manager]
-          DefaultEnvironment=PATH=/bin:/sbin
+          DefaultEnvironment=PATH=/bin
           ${cfg.extraConfig}
           ManagerEnvironment=${lib.concatStringsSep " " (lib.mapAttrsToList (n: v: "${n}=${lib.escapeShellArg v}") cfg.managerEnvironment)}
         '';
@@ -432,9 +432,9 @@ in {
         "/etc/shadow".text = "root:${if isBool cfg.emergencyAccess then optionalString (!cfg.emergencyAccess) "*" else cfg.emergencyAccess}:::::::";
 
         "/bin".source = "${initrdBinEnv}/bin";
-        "/sbin".source = "${initrdBinEnv}/sbin";
+        "/sbin".source = "${initrdBinEnv}/bin";
 
-        "/etc/sysctl.d/nixos.conf".text = "kernel.modprobe = /sbin/modprobe";
+        "/etc/sysctl.d/nixos.conf".text = "kernel.modprobe = /bin/modprobe";
         "/etc/modprobe.d/systemd.conf".source = "${cfg.package}/lib/modprobe.d/systemd.conf";
         "/etc/modprobe.d/ubuntu.conf".source = pkgs.runCommand "initrd-kmod-blacklist-ubuntu" { } ''
           ${pkgs.buildPackages.perl}/bin/perl -0pe 's/## file: iwlwifi.conf(.+?)##/##/s;' $src > $out

nixos/release-small.nix

@@ -32,7 +32,7 @@ let
 in rec {
 
   nixos = {
-    inherit (nixos') channel manual options iso_minimal amazonImage dummy;
+    inherit (nixos') channel manual options iso_minimal dummy;
     tests = {
       inherit (nixos'.tests)
         acme
@@ -116,7 +116,6 @@ in rec {
       (map onSupported [
         "nixos.dummy"
         "nixos.iso_minimal"
-        "nixos.amazonImage"
         "nixos.manual"
         "nixos.tests.acme"
         "nixos.tests.boot.uefiCdrom"

nixos/tests/all-tests.nix

@@ -830,6 +830,7 @@ in {
   radicle = runTest ./radicle.nix;
   ragnarwm = handleTest ./ragnarwm.nix {};
   rasdaemon = handleTest ./rasdaemon.nix {};
+  rathole = handleTest ./rathole.nix {};
   readarr = handleTest ./readarr.nix {};
   realm = handleTest ./realm.nix {};
   redis = handleTest ./redis.nix {};

nixos/tests/rathole.nix

@@ -0,0 +1,89 @@
+import ./make-test-python.nix (
+  { pkgs, lib, ... }:
+
+  let
+    successMessage = "Success 3333115147933743662";
+  in
+  {
+    name = "rathole";
+    meta.maintainers = with lib.maintainers; [ xokdvium ];
+    nodes = {
+      server = {
+        networking = {
+          useNetworkd = true;
+          useDHCP = false;
+          firewall.enable = false;
+        };
+
+        systemd.network.networks."01-eth1" = {
+          name = "eth1";
+          networkConfig.Address = "10.0.0.1/24";
+        };
+
+        services.rathole = {
+          enable = true;
+          role = "server";
+          settings = {
+            server = {
+              bind_addr = "0.0.0.0:2333";
+              services = {
+                success-message = {
+                  bind_addr = "0.0.0.0:80";
+                  token = "hunter2";
+                };
+              };
+            };
+          };
+        };
+      };
+
+      client = {
+        networking = {
+          useNetworkd = true;
+          useDHCP = false;
+        };
+
+        systemd.network.networks."01-eth1" = {
+          name = "eth1";
+          networkConfig.Address = "10.0.0.2/24";
+        };
+
+        services.nginx = {
+          enable = true;
+          virtualHosts."127.0.0.1" = {
+            root = pkgs.writeTextDir "success-message.txt" successMessage;
+          };
+        };
+
+        services.rathole = {
+          enable = true;
+          role = "client";
+          credentialsFile = pkgs.writeText "rathole-credentials.toml" ''
+            [client.services.success-message]
+            token = "hunter2"
+          '';
+          settings = {
+            client = {
+              remote_addr = "10.0.0.1:2333";
+              services.success-message = {
+                local_addr = "127.0.0.1:80";
+              };
+            };
+          };
+        };
+      };
+    };
+
+    testScript = ''
+      start_all()
+      server.wait_for_unit("rathole.service")
+      server.wait_for_open_port(2333)
+      client.wait_for_unit("rathole.service")
+      server.wait_for_open_port(80)
+      response = server.succeed("curl http://127.0.0.1/success-message.txt")
+      assert "${successMessage}" in response, "Got invalid response"
+      response = client.succeed("curl http://10.0.0.1/success-message.txt")
+      assert "${successMessage}" in response, "Got invalid response"
+    '';
+  }
+)

nixos/tests/web-apps/pretix.nix

@@ -20,6 +20,7 @@
         plugins = with pkgs.pretix.plugins; [
           passbook
           pages
+          zugferd
         ];
         settings = {
           pretix = {

pkgs/applications/blockchains/taproot-assets/default.nix

@@ -5,13 +5,13 @@
 
 buildGoModule rec {
   pname = "taproot-assets";
-  version = "0.4.0";
+  version = "0.4.1";
 
   src = fetchFromGitHub {
     owner = "lightninglabs";
     repo = "taproot-assets";
     rev = "v${version}";
-    hash = "sha256-sTLimar8cDWFl9lwQHYlKFL3CuNcy3p8CVbRjhrH+Dw=";
+    hash = "sha256-aQYVPSDudLK4ZBcBN/wNjVoF/9inOaJRbcyTP6VMdA0=";
   };
 
   vendorHash = "sha256-IFzYW5vAtBoUC2ebFYnxS/TojQR4kXxQACNbyn2ZkCs=";

pkgs/applications/editors/emacs/elisp-packages/manual-packages/consult-gh/package.nix

@@ -12,13 +12,13 @@
 
 melpaBuild {
   pname = "consult-gh";
-  version = "0.12-unstable-2024-04-23";
+  version = "1.0-unstable-2024-08-02";
 
   src = fetchFromGitHub {
     owner = "armindarvish";
     repo = "consult-gh";
-    rev = "3a07139a1f7e38b959ce177a122c8f47c401d7fa";
+    rev = "e12b24e68116ac6c171d628c547c017458d6aa2b";
-    hash = "sha256-BZloG5RuQzC2RwCfvqPPhGcbsCabQWBnRHdU62rwNdo=";
+    hash = "sha256-skZkpYUWncGUf9k0IfEq3LAqDXHIfCJJ3p3b3ey+Rks=";
   };
 
   packageRequires = [

pkgs/applications/editors/emacs/elisp-packages/manual-packages/font-lock-plus/package.nix

@@ -8,13 +8,13 @@
 melpaBuild {
   pname = "font-lock-plus";
   ename = "font-lock+";
-  version = "208-unstable-2018-01-01";
+  version = "208-unstable-2022-04-02";
 
   src = fetchFromGitHub {
     owner = "emacsmirror";
     repo = "font-lock-plus";
-    rev = "f2c1ddcd4c9d581bd32be88fad026b49f98b6541";
+    rev = "aa1c82d05c9222b09099a0ccd7468e955497940c";
-    hash = "sha256-lFmdVMXIIXZ9ZohAJw5rhxpTv017qIyzmpuKOWDdeJ4=";
+    hash = "sha256-er+knxqAejgKAtOnhqHfsGN286biHFdeMIUlbW7JyYw=";
   };
 
   passthru.updateScript = unstableGitUpdater { };

pkgs/applications/editors/emacs/elisp-packages/manual-packages/voicemacs/package.nix

@@ -19,13 +19,13 @@
 
 melpaBuild {
   pname = "voicemacs";
-  version = "0-unstable-2022-02-16";
+  version = "0-unstable-2024-01-03";
 
   src = fetchFromGitHub {
     owner = "jcaw";
     repo = "voicemacs";
-    rev = "d91de2a31c68ab083172ade2451419d6bd7bb389";
+    rev = "d93f15d855d61f78827d78c9ca3508766266366c";
-    hash = "sha256-/MBB2R9/V0aYZp15e0vx+67ijCPp2iPlgxe262ldmtc=";
+    hash = "sha256-D/5+3SgECEb7A8qQqsAV1TQr+lA8EyOjf6NesnV2gos=";
   };
 
   patches = [

pkgs/applications/editors/jetbrains/bin/ides.json

@@ -1,4 +1,15 @@
 {
+  "aqua": {
+    "product": "Aqua",
+    "wmClass": "jetbrains-aqua",
+    "meta": {
+      "isOpenSource": false,
+      "description": "Test automation IDE from JetBrains",
+      "maintainers": [ "remcoschrijver" ],
+      "longDescription": "Aqua is a test automation IDE from jetbrains that can deal with many languages and frameworks to improve your test workflows. Has support for popular testing frameworks like Selenium, Cypress, and Playwright.",
+      "homepage": "https://www.jetbrains.com/aqua/"
+    }
+  },
   "clion": {
     "product": "CLion",
     "wmClass": "jetbrains-clion",

pkgs/applications/editors/jetbrains/bin/versions.json

@@ -1,5 +1,13 @@
 {
   "x86_64-linux": {
+    "aqua": {
+      "update-channel": "Aqua EAP licensing:EAP",
+      "url-template": "https://download.jetbrains.com/aqua/aqua-{version}.tar.gz",
+      "version": "2024.1 Public Preview",
+      "sha256": "027cac4bfab747ef97f055b63eff8a69cefc32751fcca9510c3eccaf7c36b2be",
+      "url": "https://download.jetbrains.com/aqua/aqua-241.15989.28.tar.gz",
+      "build_number": "241.15989.28"
+    },
     "clion": {
       "update-channel": "CLion RELEASE",
       "url-template": "https://download.jetbrains.com/cpp/CLion-{version}.tar.gz",
@@ -131,6 +139,14 @@
     }
   },
   "aarch64-linux": {
+    "aqua": {
+      "update-channel": "Aqua EAP licensing:EAP",
+      "url-template": "https://download.jetbrains.com/aqua/aqua-{version}-aarch64.tar.gz",
+      "version": "2024.1 Public Preview",
+      "sha256": "ec59ff6e259ce0f03441e30a9d8bce8334d11c3ae858705d2f17375565adb80c",
+      "url": "https://download.jetbrains.com/aqua/aqua-241.15989.28-aarch64.tar.gz",
+      "build_number": "241.15989.28"
+    },
     "clion": {
       "update-channel": "CLion RELEASE",
       "url-template": "https://download.jetbrains.com/cpp/CLion-{version}-aarch64.tar.gz",
@@ -262,6 +278,14 @@
     }
   },
   "x86_64-darwin": {
+    "aqua": {
+      "update-channel": "Aqua EAP licensing:EAP",
+      "url-template": "https://download.jetbrains.com/aqua/aqua-{version}.dmg",
+      "version": "2024.1 Public Preview",
+      "sha256": "e90b3cc44efcabd3f31025bae506ec87da138f0a06f5cd4eaf7f96bb57db123a",
+      "url": "https://download.jetbrains.com/aqua/aqua-241.15989.28.dmg",
+      "build_number": "241.15989.28"
+    },
     "clion": {
       "update-channel": "CLion RELEASE",
       "url-template": "https://download.jetbrains.com/cpp/CLion-{version}.dmg",
@@ -393,6 +417,14 @@
     }
   },
   "aarch64-darwin": {
+    "aqua": {
+      "update-channel": "Aqua EAP licensing:EAP",
+      "url-template": "https://download.jetbrains.com/aqua/aqua-{version}-aarch64.dmg",
+      "version": "2024.1 Public Preview",
+      "sha256": "29b975e6845b62ed466d26920fec4c9e5e74588b5ff5cf384d672b98bb602549",
+      "url": "https://download.jetbrains.com/aqua/aqua-241.15989.28-aarch64.dmg",
+      "build_number": "241.15989.28"
+    },
     "clion": {
       "update-channel": "CLion RELEASE",
       "url-template": "https://download.jetbrains.com/cpp/CLion-{version}-aarch64.dmg",

pkgs/applications/editors/jetbrains/default.nix

@@ -100,6 +100,8 @@ in
 rec {
   # Sorted alphabetically
 
+  aqua = mkJetBrainsProduct { pname = "aqua"; extraBuildInputs = [ stdenv.cc.cc lldb ]; };
+
   clion = (mkJetBrainsProduct {
     pname = "clion";
     extraBuildInputs = lib.optionals (stdenv.isLinux) [

pkgs/applications/editors/kakoune/plugins/overrides.nix

@@ -2,6 +2,7 @@
 , buildKakounePluginFrom2Nix
 , kakoune-lsp, parinfer-rust, rep
 , fzf, git, guile, kakoune-unwrapped, lua5_3, plan9port
+, rustPlatform
 }:
 
 self: super: {
@@ -131,6 +132,41 @@ declare-option -hidden str ansi_filter %{'"$out"'/bin/kak-ansi-filter}
     '';
   });
 
+  hop-kak = rustPlatform.buildRustPackage rec {
+    pname = "hop-kak";
+    version = "0.2.0";
+
+    src = fetchgit {
+      url = "https://git.sr.ht/~hadronized/hop.kak";
+      rev = "7314ec64809a69e0044ba7ec57a18b43e3b5f005";
+      sha256 = "stmGZQU0tp+5xxrexKMzwSwHj5F/F4HzDO9BorNWC3w=";
+
+      # this package uses git to put the commit hash in the
+      # help dialog, so leave the .git folder so the command
+      # succeeds.
+      leaveDotGit = true;
+    };
+
+    nativeBuildInputs = [
+      git
+    ];
+
+    cargoHash = "sha256-EjSj/+BysGwJBxK6Ccg2+pXHdB2Lg3dxIURRsSVTHVY=";
+
+    postInstall = ''
+      mkdir -p $out/share/kak/bin
+      mv $out/bin/hop-kak $out/share/kak/bin/
+    '';
+
+    meta = with lib; {
+      description = "hinting brought to Kakoune selections";
+      homepage = "https://git.sr.ht/~hadronized/hop.kak/";
+      license = licenses.bsd3;
+      maintainers = with maintainers; [ oleina ];
+      platforms = platforms.all;
+    };
+  };
+
   quickscope-kak = buildKakounePluginFrom2Nix rec {
     pname = "quickscope-kak";
     version = "1.0.0";

pkgs/applications/editors/kakoune/wrapper.nix

@@ -14,10 +14,17 @@ in
     paths = [ kakoune ] ++ requestedPlugins;
 
     postBuild = ''
+      # create a directory for bins that kakoune needs
+      # access to, without polluting the users path by adding
+      # that binary nested with this symlinkJoin.
+      mkdir -p $out/share/kak/bin
+
       # location of kak binary is used to find ../share/kak/autoload,
       # unless explicitly overriden with KAKOUNE_RUNTIME
       rm "$out/bin/kak"
-      makeWrapper "${kakoune}/bin/kak" "$out/bin/kak" --set KAKOUNE_RUNTIME "$out/share/kak"
+      makeWrapper "${kakoune}/bin/kak" "$out/bin/kak" \
+        --set KAKOUNE_RUNTIME "$out/share/kak" \
+        --set PATH "$PATH:$out/share/kak/bin"
 
       # currently kakoune ignores doc files if they are symlinks, so workaround by
       # copying doc files over, so they become regular files...

pkgs/applications/editors/leo-editor/default.nix

@@ -2,13 +2,13 @@
 
 mkDerivation rec {
   pname = "leo-editor";
-  version = "6.7.8";
+  version = "6.8.1";
 
   src = fetchFromGitHub {
     owner = "leo-editor";
     repo = "leo-editor";
     rev = version;
-    sha256 = "sha256-cawcfEz9QpsjfgJzG5oA5TY2EpT8hLDw5QIjwdKPW6Y=";
+    sha256 = "sha256-YhZSmk2n/Tg0zx1xuy0LtABNiBB3LmXYlhXoK7/b2tQ=";
   };
 
   dontBuild = true;

pkgs/applications/editors/vscode/extensions/ms-vscode.cpptools/default.nix

@@ -38,24 +38,27 @@
 
 let
   gdbDefaultsTo = if gdbUseFixed then "${gdb}/bin/gdb" else "gdb";
+  isx86Linux = stdenv.hostPlatform.system == "x86_64-linux";
   supported = {
     x86_64-linux = {
-      hash = "sha256-arTBt3UWA5zoo0dL044Sx/NT1LUS76XfGIS96NOMvJk=";
+      hash = "sha256-jibImnpRtshbHu21JeS4VxL1jETm3Ein8S/M73UXc2w=";
       arch = "linux-x64";
     };
     aarch64-linux = {
-      hash = "sha256-oVuDxx117bVd/jDqn9KivTwR5T2X5UZMHk/nZ/e/IOg=";
+      hash = "sha256-7UagRO7qHyT1JIvvTSx9+USYrnDRXJ2wnXPLaBHRc3k=";
       arch = "linux-arm64";
     };
   };
 
-  base = supported.${stdenv.system} or (throw "unsupported platform ${stdenv.system}");
+  base =
+    supported.${stdenv.hostPlatform.system}
+      or (throw "unsupported platform ${stdenv.hostPlatform.system}");
 in
 vscode-utils.buildVscodeMarketplaceExtension {
   mktplcRef = base // {
     name = "cpptools";
     publisher = "ms-vscode";
-    version = "1.20.5";
+    version = "1.21.4";
   };
 
   nativeBuildInputs = [
@@ -71,35 +74,40 @@ vscode-utils.buildVscodeMarketplaceExtension {
     stdenv.cc.cc.lib
   ];
 
-  dontAutoPatchelf = true;
+  dontAutoPatchelf = isx86Linux;
 
-  postPatch = ''
+  postPatch =
-    mv ./package.json ./package_orig.json
-
-    # 1. Add activation events so that the extension is functional. This listing is empty when unpacking the extension but is filled at runtime.
-    # 2. Patch `package.json` so that nix's *gdb* is used as default value for `miDebuggerPath`.
-    cat ./package_orig.json | \
-      jq --slurpfile actEvts ${./package-activation-events.json} '(.activationEvents) = $actEvts[0]' | \
-      jq '(.contributes.debuggers[].configurationAttributes | .attach , .launch | .properties.miDebuggerPath | select(. != null) | select(.default == "/usr/bin/gdb") | .default) = "${gdbDefaultsTo}"' > \
-      ./package.json
-
-    # Prevent download/install of extensions
-    touch "./install.lock"
-
-    # Clang-format from nix package.
-    rm -rf ./LLVM
-    mkdir "./LLVM/"
-    find "${clang-tools}" -mindepth 1 -maxdepth 1 | xargs ln -s -t "./LLVM"
-
-    # Patching binaries
-    chmod +x bin/cpptools bin/cpptools-srv bin/cpptools-wordexp bin/libc.so debugAdapters/bin/OpenDebugAD7
-    patchelf --replace-needed liblttng-ust.so.0 liblttng-ust.so.1 ./debugAdapters/bin/libcoreclrtraceptprovider.so
-  '';
-
-  postFixup =
     ''
-      autoPatchelf $out/share/vscode/extensions/ms-vscode.cpptools/debugAdapters
+      mv ./package.json ./package_orig.json
 
+      # 1. Add activation events so that the extension is functional. This listing is empty when unpacking the extension but is filled at runtime.
+      # 2. Patch `package.json` so that nix's *gdb* is used as default value for `miDebuggerPath`.
+      cat ./package_orig.json | \
+        jq --slurpfile actEvts ${./package-activation-events.json} '(.activationEvents) = $actEvts[0]' | \
+        jq '(.contributes.debuggers[].configurationAttributes | .attach , .launch | .properties.miDebuggerPath | select(. != null) | select(.default == "/usr/bin/gdb") | .default) = "${gdbDefaultsTo}"' > \
+        ./package.json
+
+      # Prevent download/install of extensions
+      touch "./install.lock"
+
+      # Clang-format from nix package.
+      rm -rf ./LLVM
+      mkdir "./LLVM/"
+      find "${clang-tools}" -mindepth 1 -maxdepth 1 | xargs ln -s -t "./LLVM"
+
+      # Patching binaries
+      chmod +x bin/cpptools bin/cpptools-srv bin/cpptools-wordexp debugAdapters/bin/OpenDebugAD7
+      patchelf --replace-needed liblttng-ust.so.0 liblttng-ust.so.1 ./debugAdapters/bin/libcoreclrtraceptprovider.so
+    ''
+    + lib.optionalString isx86Linux ''
+      chmod +x bin/libc.so
+    '';
+
+  # On aarch64 the binaries are statically linked
+  # but on x86 they are not.
+  postFixup =
+    lib.optionalString isx86Linux ''
+      autoPatchelf $out/share/vscode/extensions/ms-vscode.cpptools/debugAdapters
       # cpptools* are distributed by the extension and need to be run through the distributed musl interpretter
       patchelf --set-interpreter $out/share/vscode/extensions/ms-vscode.cpptools/bin/libc.so $out/share/vscode/extensions/ms-vscode.cpptools/bin/cpptools
       patchelf --set-interpreter $out/share/vscode/extensions/ms-vscode.cpptools/bin/libc.so $out/share/vscode/extensions/ms-vscode.cpptools/bin/cpptools-srv

pkgs/applications/graphics/lightburn/default.nix

@@ -6,7 +6,7 @@
 
 stdenv.mkDerivation rec {
   pname = "lightburn";
-  version = "1.6.03";
+  version = "1.6.04";
 
   nativeBuildInputs = [
     p7zip
@@ -15,7 +15,7 @@ stdenv.mkDerivation rec {
 
   src = fetchurl {
     url = "https://github.com/LightBurnSoftware/deployment/releases/download/${version}/LightBurn-Linux64-v${version}.7z";
-    sha256 = "sha256-yMxCe9Bu5llAUrTLG8R+1HX65rs9fhhoVG79vxDzeWY=";
+    sha256 = "sha256-3dvLUfOczysRC8Ou6aQHzzmJs2rwtKAvfrwpQ4VMB/M=";
   };
 
   buildInputs = [

pkgs/applications/misc/dialect/default.nix

@@ -20,7 +20,7 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "dialect";
-  version = "2.4.1";
+  version = "2.4.2";
   pyproject = false; # built with meson
 
   src = fetchFromGitHub {
@@ -28,7 +28,7 @@ python3.pkgs.buildPythonApplication rec {
     repo = "dialect";
     rev = version;
     fetchSubmodules = true;
-    hash = "sha256-WEeTdUdhDSfStu+rBYcuk6miuh5e0AsodbyF93Mg4mo=";
+    hash = "sha256-DAhzvia5ut806rTc2iMuMrVKyYBSaAiMyC4rEOyU4x0=";
   };
 
   nativeBuildInputs = [

pkgs/applications/misc/gallery-dl/default.nix

@@ -9,13 +9,13 @@
 
 buildPythonApplication rec {
   pname = "gallery-dl";
-  version = "1.27.1";
+  version = "1.27.2";
   format = "setuptools";
 
   src = fetchPypi {
     inherit version;
     pname = "gallery_dl";
-    hash = "sha256-S1RF0FNJ/oKTwq9SXXIOnqBIViGIYBVuxPjV/6fbeV8=";
+    hash = "sha256-CTc6CBAFIxOX5Bd/hy3e65MbWyI2wFn+a6hj4ktuBjo=";
   };
 
   propagatedBuildInputs = [

pkgs/applications/misc/golden-cheetah/default.nix

@@ -16,13 +16,13 @@ let
   };
 in mkDerivation rec {
   pname = "golden-cheetah";
-  version = "3.7-DEV2404";
+  version = "3.7-DEV2408";
 
   src = fetchFromGitHub {
     owner = "GoldenCheetah";
     repo = "GoldenCheetah";
     rev = "refs/tags/v${version}";
-    hash = "sha256-u2igcnOulgJGZT46/Z3vSsce9mr3VsxkD3mTeQPvUOg=";
+    hash = "sha256-6JAdnYaKULJsc/zdcTMbCkbOCbiVtnJivEazDKL721c=";
   };
 
   buildInputs = [

pkgs/applications/misc/obsidian/default.nix

@@ -11,7 +11,6 @@
 , commandLineArgs ? ""
 }:
 let
-  inherit (stdenv.hostPlatform) system;
   pname = "obsidian";
   version = "1.6.7";
   appname = "Obsidian";
@@ -19,6 +18,7 @@ let
     description = "Powerful knowledge base that works on top of a local folder of plain text Markdown files";
     homepage = "https://obsidian.md";
     downloadPage = "https://github.com/obsidianmd/obsidian-releases/releases";
+    mainProgram = "obsidian";
     license = licenses.obsidian;
     maintainers = with maintainers; [ atila conradmearns zaninime qbit kashw2 w-lfchen ];
   };

pkgs/applications/networking/browsers/firefox-bin/update.nix

@@ -27,7 +27,7 @@ in writeScript "update-${pname}" ''
   HOME=`mktemp -d`
   export GNUPGHOME=`mktemp -d`
 
-  gpg --receive-keys ADD7079479700DCADFDD5337E36D3B13F3D93274
+  curl https://keys.openpgp.org/vks/v1/by-fingerprint/14F26682D0916CDD81E37B6D61B7B526D98F0353 | gpg --import -
 
   tmpfile=`mktemp`
   url=${baseUrl}

pkgs/applications/networking/browsers/firefox/packages.nix

@@ -35,11 +35,11 @@
 
   firefox-beta = buildMozillaMach rec {
     pname = "firefox-beta";
-    version = "128.0b3";
+    version = "129.0b9";
     applicationName = "Mozilla Firefox Beta";
     src = fetchurl {
       url = "mirror://mozilla/firefox/releases/${version}/source/firefox-${version}.source.tar.xz";
-      sha512 = "d2519052244dd6d5cad39afcf78e86b17e5f1520f3f182db123997f8d126b048cd6862e92558c8f112224c951f706ccf1ccb2cb19b5221d4a47bc7154f562ab2";
+      sha512 = "f4f9efb640c7db12301b1b7d23b417e6786a9072f617d2e8a1bdbcaaa4d50d6a4d49d06566d3fff7b066b32ad39aeb0dcd003721c110c2add77dbd3d68df6a0c";
     };
 
     meta = {
@@ -64,13 +64,13 @@
 
   firefox-devedition = buildMozillaMach rec {
     pname = "firefox-devedition";
-    version = "128.0b3";
+    version = "129.0b9";
     applicationName = "Mozilla Firefox Developer Edition";
     requireSigning = false;
     branding = "browser/branding/aurora";
     src = fetchurl {
       url = "mirror://mozilla/devedition/releases/${version}/source/firefox-${version}.source.tar.xz";
-      sha512 = "b1313d35218adac5b81059f605b788188454f064c3192a6bb91a7c7b361fb2e087ac49177c48f23de517551b563489adfc7486bc4e6b95e5ae4aeac49aa5ac97";
+      sha512 = "225c7abd58b7dd1e6c54e4a5172b7dc4ea19f9f90930d6823d15f2f80524f4f910eb4cb7cf3f863722490447ac8f146654ab129ee89766306b4a6992e2706b20";
     };
 
     meta = {

pkgs/applications/networking/cluster/kube-router/default.nix

@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "kube-router";
-  version = "2.1.3";
+  version = "2.2.0";
 
   src = fetchFromGitHub {
     owner = "cloudnativelabs";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-H+jPHf7sMrMlqLWa3L34U8nbBgqeX+MqChiuSsVdx6A=";
+    hash = "sha256-tEeqenOJVpwFGBS3iYlVdedNo02NV9/jtGsgrquV+0I=";
   };
 
-  vendorHash = "sha256-BrpjG9DhDQSsbeJ+1MRAwXyKVULK3KHjvLydduTb024=";
+  vendorHash = "sha256-sIWRODIV3iJ5FdVjVwesqfbYivOlqZAvPSYa38vhCMA=";
 
   CGO_ENABLED = 0;
 

pkgs/applications/networking/cluster/rke2/latest/versions.nix

@@ -1,14 +1,14 @@
 {
-  rke2Version = "1.30.1+rke2r1";
+  rke2Version = "1.30.3+rke2r1";
-  rke2RepoSha256 = "0jrvvpj9fnlbykyr06w1f92ay708xzaizg8dhg1z4bsq1cdgs33k";
+  rke2RepoSha256 = "1ix7mm11j9ir9xz0yypznja5mcbizibclh314sgcsfxhg39w4a70";
-  rke2Commit = "e7f87c6dd56fdd76a7dab58900aeea8946b2c008";
+  rke2Commit = "e742dc53b463d205773cfb25633309671ce6777c";
-  rke2VendorHash = "sha256-QqV8mSbqa8A5zABHQoVB2jht/eYCoqTZ/WoAqIl9oZY=";
+  rke2VendorHash = "sha256-6ma0t0ElZ13VTS/aK5AknJ00F45kZXn36b5sePK2wh0=";
-  k8sVersion = "v1.30.1";
+  k8sVersion = "v1.30.3";
-  k8sImageTag = "v1.30.1-rke2r1-build20240515";
+  k8sImageTag = "v1.30.3-rke2r1-build20240717";
-  etcdVersion = "v3.5.9-k3s1";
+  etcdVersion = "v3.5.13-k3s1";
   pauseVersion = "3.6";
-  ccmVersion = "v1.29.3-build20240412";
+  ccmVersion = "v1.29.3-build20240515";
-  dockerizedVersion = "v1.30.1-rke2r1";
+  dockerizedVersion = "v1.30.3-dev.";
-  golangVersion = "go1.22.2";
+  golangVersion = "go1.22.5";
   eol = "2025-06-28";
 }

pkgs/applications/networking/cluster/rke2/stable/versions.nix

@@ -1,14 +1,14 @@
 {
-  rke2Version = "1.28.10+rke2r1";
+  rke2Version = "1.28.11+rke2r1";
-  rke2RepoSha256 = "1pbanikvrl6rqrplrpvjc9ym8qq1yrs621gwy99shp0prfw5zvsx";
+  rke2RepoSha256 = "1mkl7mnlsq2j9n610jnr9545hq6ilr5sdg8jxjxjbk9lnmmbvrm1";
-  rke2Commit = "b0d0d687d98f4fa015e7b30aaf2807b50edcc5d7";
+  rke2Commit = "6b12d7a783238b72da8450fa1b6ec587cebb79ed";
-  rke2VendorHash = "sha256-iidkTSrrHyW5ZEouzHAWUwCC9nplGz1v/E9bM2lMPeM=";
+  rke2VendorHash = "sha256-VenNSaa86nbhrFYzXPbj0fxbDlrIu6pxqMo+HPDuUxs=";
-  k8sVersion = "v1.28.10";
+  k8sVersion = "v1.28.11";
-  k8sImageTag = "v1.28.10-rke2r1-build20240514";
+  k8sImageTag = "v1.28.11-rke2r1-build20240619";
-  etcdVersion = "v3.5.9-k3s1";
+  etcdVersion = "v3.5.13-k3s1";
   pauseVersion = "3.6";
-  ccmVersion = "v1.29.3-build20240412";
+  ccmVersion = "v1.29.3-build20240515";
-  dockerizedVersion = "v1.28.10-rke2r1";
+  dockerizedVersion = "v1.28.11-rke2r1";
-  golangVersion = "go1.21.9";
+  golangVersion = "go1.21.11";
   eol = "2024-10-28";
 }

pkgs/applications/networking/cluster/rke2/testing/versions.nix

@@ -1,14 +1,14 @@
 {
-  rke2Version = "1.30.1-rc3+rke2r1";
+  rke2Version = "1.30.3-rc5+rke2r1";
-  rke2RepoSha256 = "0jrvvpj9fnlbykyr06w1f92ay708xzaizg8dhg1z4bsq1cdgs33k";
+  rke2RepoSha256 = "1ix7mm11j9ir9xz0yypznja5mcbizibclh314sgcsfxhg39w4a70";
-  rke2Commit = "e7f87c6dd56fdd76a7dab58900aeea8946b2c008";
+  rke2Commit = "e742dc53b463d205773cfb25633309671ce6777c";
-  rke2VendorHash = "sha256-QqV8mSbqa8A5zABHQoVB2jht/eYCoqTZ/WoAqIl9oZY=";
+  rke2VendorHash = "sha256-6ma0t0ElZ13VTS/aK5AknJ00F45kZXn36b5sePK2wh0=";
-  k8sVersion = "v1.30.1";
+  k8sVersion = "v1.30.3";
-  k8sImageTag = "v1.30.1-rke2r1-build20240515";
+  k8sImageTag = "v1.30.3-rke2r1-build20240717";
-  etcdVersion = "v3.5.9-k3s1";
+  etcdVersion = "v3.5.13-k3s1";
   pauseVersion = "3.6";
-  ccmVersion = "v1.29.3-build20240412";
+  ccmVersion = "v1.29.3-build20240515";
-  dockerizedVersion = "v1.30.1-rc3-rke2r1";
+  dockerizedVersion = "v1.30.3-dev.";
-  golangVersion = "go1.22.2";
+  golangVersion = "go1.22.5";
   eol = "2025-06-28";
 }

pkgs/applications/networking/instant-messengers/discord/darwin.nix

@@ -1,8 +1,21 @@
-{ pname, version, src, meta, stdenv, binaryName, desktopName, lib, undmg, makeWrapper, writeScript
+{ pname, version, src, meta, stdenv, binaryName, desktopName, lib, undmg, makeWrapper, writeScript, python3, runCommand
 , branch
 , withOpenASAR ? false, openasar
 , withVencord ? false, vencord }:
 
+let
+  disableBreakingUpdates = runCommand "disable-breaking-updates.py"
+    {
+      pythonInterpreter = "${python3.interpreter}";
+      configDirName = lib.toLower binaryName;
+      meta.mainProgram = "disable-breaking-updates.py";
+    } ''
+    mkdir -p $out/bin
+    cp ${./disable-breaking-updates.py} $out/bin/disable-breaking-updates.py
+    substituteAllInPlace $out/bin/disable-breaking-updates.py
+    chmod +x $out/bin/disable-breaking-updates.py
+  '';
+in
 stdenv.mkDerivation {
   inherit pname version src meta;
 
@@ -18,7 +31,8 @@ stdenv.mkDerivation {
 
     # wrap executable to $out/bin
     mkdir -p $out/bin
-    makeWrapper "$out/Applications/${desktopName}.app/Contents/MacOS/${binaryName}" "$out/bin/${binaryName}"
+    makeWrapper "$out/Applications/${desktopName}.app/Contents/MacOS/${binaryName}" "$out/bin/${binaryName}" \
+      --run ${lib.getExe disableBreakingUpdates}
 
     runHook postInstall
   '';
@@ -33,6 +47,8 @@ stdenv.mkDerivation {
   '';
 
   passthru = {
+    # make it possible to run disableBreakingUpdates standalone
+    inherit disableBreakingUpdates;
     updateScript = writeScript "discord-update-script" ''
       #!/usr/bin/env nix-shell
       #!nix-shell -i bash -p curl gnugrep common-updater-scripts

pkgs/applications/networking/instant-messengers/discord/disable-breaking-updates.py

@@ -17,12 +17,19 @@ import os
 import sys
 from pathlib import Path
 
-XDG_CONFIG_HOME = os.environ.get("XDG_CONFIG_HOME") or os.path.join(
+config_home = {
-    os.path.expanduser("~"), ".config"
+    "darwin": os.path.join(os.path.expanduser("~"), "Library", "Application Support"),
-)
+    "linux": os.environ.get("XDG_CONFIG_HOME") or os.path.join(os.path.expanduser("~"), ".config")
+}.get(sys.platform, None)
 
-settings_path = Path(f"{XDG_CONFIG_HOME}/@configDirName@/settings.json")
+if config_home is None:
-settings_path_temp = Path(f"{XDG_CONFIG_HOME}/@configDirName@/settings.json.tmp")
+    print("[Nix] Unsupported operating system.")
+    sys.exit(1)
+
+config_dir_name = "@configDirName@".replace(" ", "") if sys.platform == "darwin" else "@configDirName@"
+
+settings_path = Path(f"{config_home}/{config_dir_name}/settings.json")
+settings_path_temp = Path(f"{config_home}/{config_dir_name}/settings.json.tmp")
 
 if os.path.exists(settings_path):
     with settings_path.open(encoding="utf-8") as settings_file:

pkgs/applications/networking/instant-messengers/signalbackup-tools/default.nix

@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "signalbackup-tools";
-  version = "20240724";
+  version = "20240805-1";
 
   src = fetchFromGitHub {
     owner = "bepaald";
     repo = pname;
     rev = version;
-    hash = "sha256-fWvmQb8qxuwwShSCQrQnBQuDM2/3lvzsWxXmLq0vXdY=";
+    hash = "sha256-n1mFIyrZ8d9h2m6rUzIVSt9Xdw1VlBLlXY15JLoIaVA=";
   };
 
   postPatch = ''

pkgs/applications/networking/instant-messengers/wire-desktop/default.nix

@@ -30,7 +30,7 @@ let
   in {
     inherit x86_64-darwin;
     aarch64-darwin = x86_64-darwin;
-    x86_64-linux = "3.35.3348";
+    x86_64-linux = "3.36.3462";
   }.${system} or throwSystem;
 
   hash = let
@@ -38,7 +38,7 @@ let
   in {
     inherit x86_64-darwin;
     aarch64-darwin = x86_64-darwin;
-    x86_64-linux = "sha256-KtDUuAzD53mFJ0+yywp0Q2/hx9MGsOhFjRLWsZAd+h0=";
+    x86_64-linux = "sha256-tlX15AT4PcrmD2Vna99TGqo0b/8xv2YOAt03aCqSeXg=";
   }.${system} or throwSystem;
 
   meta = with lib; {

pkgs/applications/networking/sniffnet/default.nix

@@ -15,16 +15,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "sniffnet";
-  version = "1.3.0";
+  version = "1.3.1";
 
   src = fetchFromGitHub {
     owner = "gyulyvgc";
     repo = "sniffnet";
     rev = "refs/tags/v${version}";
-    hash = "sha256-3OvzMzlaSwT7fOJATi+2QsSWln+SLkXNr2kYlQGClwA=";
+    hash = "sha256-wepy56LOhliU6t0ZRPviEbZtsWNqrtUnpUXsEdkRDqI=";
   };
 
-  cargoHash = "sha256-PdlST5n8YaKkByPOvFAg5CqRxVkqRgLeVHW6CJOKioY=";
+  cargoHash = "sha256-cV3WhidnH2CBlmHa3IVHTQfTuPdSHwwY0XhgNPyLDN4=";
 
   nativeBuildInputs = [ pkg-config ];
 

pkgs/applications/networking/trayscale/default.nix

@@ -11,16 +11,16 @@
 
 buildGoModule rec {
   pname = "trayscale";
-  version = "0.12.6";
+  version = "0.13.0";
 
   src = fetchFromGitHub {
     owner = "DeedleFake";
     repo = "trayscale";
     rev = "v${version}";
-    hash = "sha256-4zjT5GrGOYaKD61EWG7gxAMwf2ZQivWlzaKH0h4jLGU=";
+    hash = "sha256-uaHForU+0dAkLPczHr6ZBpNZ6iirvsje+6i8rHrNXdQ=";
   };
 
-  vendorHash = "sha256-h5FdXlDvvorP9iOsKXxc6q3HwyB44faZGvw/Ew3LkkQ=";
+  vendorHash = "sha256-RvGKPIXdkeTdpFraxie76xrtfqRsIpzpBricEQZNFYc=";
 
   subPackages = [ "cmd/trayscale" ];
 

pkgs/applications/networking/xpipe/default.nix

@@ -33,14 +33,14 @@ let
   }.${system} or throwSystem;
 
   hash = {
-    x86_64-linux = "sha256-u5vVM8qLm9m6VMmCV2Q3VrsqorIyOPrFCPXNh1s5mgY=";
+    x86_64-linux = "sha256-KLOI0lG0rZbLS2uiONNlgyCkohzQhytRovAfrjnGuDI=";
   }.${system} or throwSystem;
 
   displayname = "XPipe";
 
 in stdenvNoCC.mkDerivation rec {
   pname = "xpipe";
-  version = "10.0.4";
+  version = "10.2.2";
 
   src = fetchzip {
     url = "https://github.com/xpipe-io/xpipe/releases/download/${version}/xpipe-portable-linux-${arch}.tar.gz";

pkgs/applications/office/mendeley/default.nix

@@ -7,13 +7,13 @@
 
 let
   pname = "mendeley";
-  version = "2.118.0";
+  version = "2.120.0";
 
   executableName = "${pname}-reference-manager";
 
   src = fetchurl {
     url = "https://static.mendeley.com/bin/desktop/mendeley-reference-manager-${version}-x86_64.AppImage";
-    hash = "sha256-JzA6JmjxqZC2K51NozlYeTmZkzT5OTRF3WVGY4Wrfgo=";
+    hash = "sha256-yKHrTcIiNhsLMfwNQNSLE2mAQLsDFxhTYdper3a8oM8=";
   };
 
   appimageContents = appimageTools.extractType2 {

pkgs/applications/office/qownnotes/default.nix

@@ -8,7 +8,6 @@
 , qtsvg
 , qtwayland
 , qtwebsockets
-, qt5compat
 , makeWrapper
 , wrapQtAppsHook
 , botan2
@@ -21,14 +20,14 @@
 let
   pname = "qownnotes";
   appname = "QOwnNotes";
-  version = "24.8.2";
+  version = "24.8.3";
 in
 stdenv.mkDerivation {
   inherit pname version;
 
   src = fetchurl {
     url = "https://github.com/pbek/QOwnNotes/releases/download/v${version}/qownnotes-${version}.tar.xz";
-    hash = "sha256-aNsfDpO11VaT0SpGxc8V+8cgsPKrBKDKociIgZd3SdA=";
+    hash = "sha256-lbNJT6IbIgTYLpsMWK6Nk0XXhw1De+wZgrH4DE1vDKg=";
   };
 
   nativeBuildInputs = [
@@ -45,7 +44,6 @@ stdenv.mkDerivation {
     qtdeclarative
     qtsvg
     qtwebsockets
-    qt5compat
     botan2
   ] ++ lib.optionals stdenv.isLinux [ qtwayland ];
 

pkgs/applications/science/biology/last/default.nix

@@ -9,13 +9,13 @@
 
 stdenv.mkDerivation rec {
   pname = "last";
-  version = "1548";
+  version = "1550";
 
   src = fetchFromGitLab {
     owner = "mcfrith";
     repo = "last";
     rev = "refs/tags/${version}";
-    hash = "sha256-6mLPnyEAuRvCeV8pv3avsm6CKDrBPgX8xSxGO2kvTrM=";
+    hash = "sha256-kvI3m2FIPscU/a3GEH+O3yx5TgdNHdYP6OW3/mI2roM=";
   };
 
   nativeBuildInputs = [

pkgs/applications/science/robotics/qgroundcontrol/default.nix

@@ -4,7 +4,7 @@
 
 stdenv.mkDerivation rec {
   pname = "qgroundcontrol";
-  version = "4.4.0";
+  version = "4.4.1";
 
   propagatedBuildInputs = [
     qtbase qtcharts qtlocation qtserialport qtsvg qtquickcontrols2
@@ -67,7 +67,7 @@ stdenv.mkDerivation rec {
     owner = "mavlink";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-LKERjHoIgJ4cF1MjB5nVW3FB/DrmKP4Xj58avsDobhc=";
+    hash = "sha256-FdF9QQYCF7HbmjvUQgV6HytJo2Aje2OEDPO2GSl1dqE=";
     fetchSubmodules = true;
   };
 

pkgs/applications/version-management/git-codereview/default.nix

@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "git-codereview";
-  version = "1.11.0";
+  version = "1.12.0";
 
   src = fetchFromGitHub {
     owner = "golang";
     repo = "review";
     rev = "v${version}";
-    hash = "sha256-fIvNaMfgwnMBUNo6kr37zhKiBgKNzT2E0dLLtqaVBvI=";
+    hash = "sha256-s3Re+LD3B8TAjamOSu66AfhaiIdcBoTjxEWxHEWSLPA=";
   };
 
   vendorHash = null;

pkgs/applications/video/mpv/scripts/modernx-zydezu.nix

@@ -7,14 +7,14 @@
 }:
 buildLua (finalAttrs: {
   pname = "modernx-zydezu";
-  version = "0.3.6";
+  version = "0.3.6.6";
 
   scriptPath = "modernx.lua";
   src = fetchFromGitHub {
     owner = "zydezu";
     repo = "ModernX";
     rev = finalAttrs.version;
-    hash = "sha256-QGi7saDQzYZWf+pVlfwYhqC2CVMtQy/Elkjm+ToOm2o=";
+    hash = "sha256-Jt3Y/4no3dUOopjvbS/dBGU0vw9Lq4o5inb4efuyYBM=";
   };
 
   postInstall = ''
@@ -31,11 +31,12 @@ buildLua (finalAttrs: {
 
   passthru.updateScript = nix-update-script { };
 
-  meta = with lib; {
+  meta = {
     description = "Modern OSC UI replacement for MPV that retains the functionality of the default OSC";
+    changelog = "https://github.com/zydezu/ModernX/releases/tag/${finalAttrs.version}";
     homepage = "https://github.com/zydezu/ModernX";
-    license = licenses.lgpl21Plus;
+    license = lib.licenses.lgpl21Plus;
-    maintainers = with maintainers; [
+    maintainers = with lib.maintainers; [
       luftmensch-luftmensch
       Guanran928
     ];

pkgs/applications/video/mpv/scripts/mpv-playlistmanager.nix

@@ -8,13 +8,13 @@
 
 buildLua rec {
   pname = "mpv-playlistmanager";
-  version = "0-unstable-2024-02-26";
+  version = "0-unstable-2024-07-28";
 
   src = fetchFromGitHub {
     owner = "jonniek";
     repo = "mpv-playlistmanager";
-    rev = "1911dc053951169c98cfcfd9f44ef87d9122ca80";
+    rev = "54ed4421f9db5df22524d37e565fe4bb2d12117e";
-    hash = "sha256-pcdOMhkivLF5B86aNuHrqj77DuYLAFGlwFwY7jxkDkE=";
+    hash = "sha256-RAIyPgqDjKkKcBAzIehpqxCNkWt0Gyxvfo8ycXkjAe0=";
   };
   passthru.updateScript = unstableGitUpdater { };
 

pkgs/applications/virtualization/docker/buildx.nix

@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "docker-buildx";
-  version = "0.16.1";
+  version = "0.16.2";
 
   src = fetchFromGitHub {
     owner = "docker";
     repo = "buildx";
     rev = "v${version}";
-    hash = "sha256-pD4drDX9jS6X6S2q/GaxODL1zVG++xGerDQiioONHII=";
+    hash = "sha256-s4VLuOLPNZGThnvr20EBddxKkreWf3B4D0RRx9OwJiw=";
   };
 
   doCheck = false;

pkgs/build-support/bintools-wrapper/default.nix

@@ -120,6 +120,7 @@ let
     else if targetPlatform.libc == "nblibc"           then "${sharedLibraryLoader}/libexec/ld.elf_so"
     else if targetPlatform.system == "i686-linux"     then "${sharedLibraryLoader}/lib/ld-linux.so.2"
     else if targetPlatform.system == "x86_64-linux"   then "${sharedLibraryLoader}/lib/ld-linux-x86-64.so.2"
+    else if targetPlatform.system == "s390x-linux"    then "${sharedLibraryLoader}/lib/ld64.so.1"
     # ELFv1 (.1) or ELFv2 (.2) ABI
     else if targetPlatform.isPower64                  then "${sharedLibraryLoader}/lib/ld64.so.*"
     # ARM with a wildcard, which can be "" or "-armhf".

pkgs/build-support/compress-drv/default.nix

@@ -4,39 +4,54 @@
   runCommand,
 }:
 /**
-  #  compressDrv compresses files in a given derivation.
+  Compresses files of a given derivation, and returns a new derivation with
+  compressed files
 
-  ## Inputs:
+  # Inputs
 
   `formats` ([String])
 
   : List of file extensions to compress. Example: `["txt" "svg" "xml"]`.
 
-  `compressors` (String -> String)
+  `compressors` ( { ${fileExtension} :: String })
 
   : Map a desired extension (e.g. `gz`) to a compress program.
 
-  The compressor program that will be executed to get the `COMPRESSOR` extension.
+    The compressor program that will be executed to get the `COMPRESSOR` extension.
-  The program should have a single " {}", which will be the replaced with the
+    The program should have a single " {}", which will be the replaced with the
-  target filename.
+    target filename.
 
-  Compressor must:
+    Compressor must:
-  - read symlinks (thus --force is needed to gzip, zstd, xz).
-  - keep the original file in place (--keep).
 
-  Example:
+    - read symlinks (thus --force is needed to gzip, zstd, xz).
+    - keep the original file in place (--keep).
+
+  # Type
 
   ```
-  {
+  compressDrv :: Derivation -> { formats :: [ String ]; compressors :: { ${fileExtension} :: String; } } -> Derivation
-    xz = "${xz}/bin/xz --force --keep {}";
+  ```
+
+  # Examples
+  :::{.example}
+  ## `pkgs.compressDrv` usage example
+  ```
+  compressDrv pkgs.spdx-license-list-data.json {
+    formats = ["json"];
+    compressors = {
+      "json" = "${zopfli}/bin/zopfli --keep {}";
+    };
   }
+  =>
+  «derivation /nix/store/...-spdx-license-list-data-3.24.0-compressed.drv»
   ```
 
-  See compressDrvWeb, which is a wrapper on top of compressDrv, for broader use
+  See also pkgs.compressDrvWeb, which is a wrapper on top of compressDrv, for broader usage
   examples.
+  :::
 */
 drv:
-{ formats, compressors, ... }:
+{ formats, compressors }:
 let
   validProg =
     ext: prog:

pkgs/build-support/compress-drv/web.nix

@@ -4,76 +4,105 @@
   compressDrv,
 }:
 /**
-  # compressDrvWeb compresses a derivation for common web server use.
+  compressDrvWeb compresses a derivation for common web server use.
 
   Useful when one wants to pre-compress certain static assets and pass them to
-  the web server. For example, `pkgs.gamja` creates this derivation:
+  the web server.
 
-      /nix/store/2wn1qbk8gp4y2m8xvafxv1b2dcdqj8fz-gamja-1.0.0-beta.9/
+  # Inputs
-      ├── index.2fd01148.js
-      ├── index.2fd01148.js.map
-      ├── index.37aa9a8a.css
-      ├── index.37aa9a8a.css.map
-      ├── index.html
-      └── manifest.webmanifest
 
-  `pkgs.compressDrvWeb pkgs.gamja`:
+  `formats` ([String])
 
-      /nix/store/f5ryid7zrw2hid7h9kil5g5j29q5r2f7-gamja-1.0.0-beta.9-compressed
+  : List of file extensions to compress.
-      ├── index.2fd01148.js -> /nix/store/2wn1qbk8gp4y2m8xvafxv1b2dcdqj8fz-gamja-1.0.0-beta.9/index.2fd01148.js
-      ├── index.2fd01148.js.br
-      ├── index.2fd01148.js.gz
-      ├── index.2fd01148.js.map -> /nix/store/2wn1qbk8gp4y2m8xvafxv1b2dcdqj8fz-gamja-1.0.0-beta.9/index.2fd01148.js.map
-      ├── index.2fd01148.js.map.br
-      ├── index.2fd01148.js.map.gz
-      ├── index.37aa9a8a.css -> /nix/store/2wn1qbk8gp4y2m8xvafxv1b2dcdqj8fz-gamja-1.0.0-beta.9/index.37aa9a8a.css
-      ├── index.37aa9a8a.css.br
-      ├── index.37aa9a8a.css.gz
-      ├── index.37aa9a8a.css.map -> /nix/store/2wn1qbk8gp4y2m8xvafxv1b2dcdqj8fz-gamja-1.0.0-beta.9/index.37aa9a8a.css.map
-      ├── index.37aa9a8a.css.map.br
-      ├── index.37aa9a8a.css.map.gz
-      ├── index.html -> /nix/store/2wn1qbk8gp4y2m8xvafxv1b2dcdqj8fz-gamja-1.0.0-beta.9/index.html
-      ├── index.html.br
-      ├── index.html.gz
-      ├── manifest.webmanifest -> /nix/store/2wn1qbk8gp4y2m8xvafxv1b2dcdqj8fz-gamja-1.0.0-beta.9/manifest.webmanifest
-      ├── manifest.webmanifest.br
-      └── manifest.webmanifest.gz
 
-  When this `-compressed` directory is passed to a properly configured web
+    Defaults to common formats that compress well.
-  server, it will serve those pre-compressed files:
 
-      $ curl -I -H 'Accept-Encoding: br' https://irc.example.org/
+  `extraFormats` ([ String ])
-      <...>
+
-      content-encoding: br
+  : Extra extensions to compress in addition to `formats`.
-      <...>
+
+  `compressors` ( { ${fileExtension} :: String })
+
+  : Map a desired extension (e.g. `gz`) to a compress program.
+
+  # Type
+
+  ```
+  compressDrvWeb :: Derivation -> { formats :: [ String ]; extraFormats :: [ String ]; compressors :: { ${fileExtension} :: String; } } -> Derivation
+  ```
+
+  # Examples
+  :::{.example}
+  ## `pkgs.compressDrvWeb` full usage example with `pkgs.gamja` and a webserver
+  ```nix
+
+  For example, building `pkgs.gamja` produces the following output:
+
+    /nix/store/2wn1qbk8gp4y2m8xvafxv1b2dcdqj8fz-gamja-1.0.0-beta.9/
+    ├── index.2fd01148.js
+    ├── index.2fd01148.js.map
+    ├── index.37aa9a8a.css
+    ├── index.37aa9a8a.css.map
+    ├── index.html
+    └── manifest.webmanifest
+
+  With `pkgs.compressDrvWeb`, one can compress these files:
+
+  ```nix
+  pkgs.compressDrvWeb pkgs.gamja {}
+  =>
+  «derivation /nix/store/...-gamja-compressed.drv»
+  ```
+
+  ```bash
+  /nix/store/f5ryid7zrw2hid7h9kil5g5j29q5r2f7-gamja-1.0.0-beta.9-compressed
+  ├── index.2fd01148.js -> /nix/store/2wn1qbk8gp4y2m8xvafxv1b2dcdqj8fz-gamja-1.0.0-beta.9/index.2fd01148.js
+  ├── index.2fd01148.js.br
+  ├── index.2fd01148.js.gz
+  ├── index.2fd01148.js.map -> /nix/store/2wn1qbk8gp4y2m8xvafxv1b2dcdqj8fz-gamja-1.0.0-beta.9/index.2fd01148.js.map
+  ├── index.2fd01148.js.map.br
+  ├── index.2fd01148.js.map.gz
+  ├── index.37aa9a8a.css -> /nix/store/2wn1qbk8gp4y2m8xvafxv1b2dcdqj8fz-gamja-1.0.0-beta.9/index.37aa9a8a.css
+  ├── index.37aa9a8a.css.br
+  ├── index.37aa9a8a.css.gz
+  ├── index.37aa9a8a.css.map -> /nix/store/2wn1qbk8gp4y2m8xvafxv1b2dcdqj8fz-gamja-1.0.0-beta.9/index.37aa9a8a.css.map
+  ├── index.37aa9a8a.css.map.br
+  ├── index.37aa9a8a.css.map.gz
+  ├── index.html -> /nix/store/2wn1qbk8gp4y2m8xvafxv1b2dcdqj8fz-gamja-1.0.0-beta.9/index.html
+  ├── index.html.br
+  ├── index.html.gz
+  ├── manifest.webmanifest -> /nix/store/2wn1qbk8gp4y2m8xvafxv1b2dcdqj8fz-gamja-1.0.0-beta.9/manifest.webmanifest
+  ├── manifest.webmanifest.br
+  └── manifest.webmanifest.gz
+  ```
+
+  When the `-compressed` derivation is passed to a properly configured web server,
+  it enables direct serving of the pre-compressed files.
+
+  ```shell-session
+  $ curl -I -H 'Accept-Encoding: br' https://irc.example.org/
+  <...>
+  content-encoding: br
+  <...>
+  ```
 
   For example, a caddy configuration snippet for gamja to serve
   the static assets (JS, CSS files) pre-compressed:
 
-      virtualHosts."irc.example.org".extraConfig = ''
+  ```nix
-        root * ${pkgs.compressDrvWeb pkgs.gamja {}}
+  {
-        file_server browse {
+    virtualHosts."irc.example.org".extraConfig = ''
-            precompressed br gzip
+      root * ${pkgs.compressDrvWeb pkgs.gamja {}}
-        }
+      file_server browse {
-      '';
+          precompressed br gzip
+      }
+    '';
+  }
+  ```
 
   This feature is also available in nginx via `ngx_brotli` and
   `ngx_http_gzip_static_module`.
-
+  :::
-  ## Inputs
-
-  `formats` ([String])
-
-  : List of file extensions to compress. Default is common formats that compress
-  well. The list may be expanded.
-
-  `extraFormats` ([String])
-
-  : Extra extensions to compress in addition to `formats`.
-
-  `compressors` (String -> String)
-
-  : See parameter `compressors` of compressDrv.
 */
 drv:
 {
@@ -95,7 +124,6 @@ drv:
     "gz" = "${zopfli}/bin/zopfli --keep {}";
     "br" = "${brotli}/bin/brotli --keep --no-copy-stat {}";
   },
-  ...
 }:
 compressDrv drv {
   formats = formats ++ extraFormats;

pkgs/build-support/fetchnextcloudapp/default.nix

@@ -8,7 +8,7 @@
 , patches ? [ ]
 , description ? null
 , homepage ? null
-, unpack ? true # whether to use fetchzip rather than fetchurl
+, unpack ? false # whether to use fetchzip rather than fetchurl
 }:
 applyPatches ({
   inherit patches;

pkgs/by-name/ar/art/package.nix

@@ -26,13 +26,13 @@
 
 stdenv.mkDerivation rec {
   pname = "art";
-  version = "1.22.1";
+  version = "1.23";
 
   src = fetchFromBitbucket {
     owner = "agriggio";
     repo = "art";
     rev = version;
-    hash = "sha256-f6SnTvMelJaPGNeGboI34RvWXcJatEi1G6vfAdDFy8A=";
+    hash = "sha256-OB/Rr4rHNJc40o6esNPDRbhN4EPGf2zhlzzM+mBpUUU=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/aw/awscli2/package.nix

@@ -59,14 +59,14 @@ let
 in
 py.pkgs.buildPythonApplication rec {
   pname = "awscli2";
-  version = "2.17.13"; # N.B: if you change this, check if overrides are still up-to-date
+  version = "2.17.18"; # N.B: if you change this, check if overrides are still up-to-date
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "aws";
     repo = "aws-cli";
     rev = "refs/tags/${version}";
-    hash = "sha256-hnD+2NE7gqbe99UQmRlHoPGdWZj0o2Buvk3kRR15tgI=";
+    hash = "sha256-HxFtMFeGR6XAMsP5LM0tvJ/ECWVpveIhWRTKvf8uYA0=";
   };
 
   postPatch = ''

pkgs/by-name/bm/bmake/package.nix

@@ -11,11 +11,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "bmake";
-  version = "20240711";
+  version = "20240722";
 
   src = fetchurl {
     url = "https://www.crufty.net/ftp/pub/sjg/bmake-${finalAttrs.version}.tar.gz";
-    hash = "sha256-z+2sCduQhqytVeejoNIkBo90tMARxbZK1x8dhoCHjOA=";
+    hash = "sha256-FlS9DK0oQ2CElmmh6amTGB/tE3iWqsJpS4LqmjX3CeQ=";
   };
 
   patches = [

pkgs/by-name/br/bruno/package.nix

@@ -28,13 +28,13 @@ let
 in
 buildNpmPackage' rec {
   pname = "bruno";
-  version = "1.23.0";
+  version = "1.23.1";
 
   src = fetchFromGitHub {
     owner = "usebruno";
     repo = "bruno";
     rev = "v${version}";
-    hash = "sha256-zbQlmxrvA2rZLEGmhj7MkVP5SmJdhhL9F3wRrB97DJs=";
+    hash = "sha256-uQe+j7EH62SH64z9mTpsR/tiYm4vSMDbAkYRhfkjf68=";
 
     postFetch = ''
       ${lib.getExe npm-lockfile-fix} $out/package-lock.json

pkgs/by-name/ci/cinny-unwrapped/package.nix

@@ -1,23 +1,18 @@
-{ lib
+{
-, buildNpmPackage
+  lib,
-, fetchFromGitHub
+  buildNpmPackage,
-, writeText
+  fetchFromGitHub,
-, jq
+  python3,
-, python3
+  pkg-config,
-, pkg-config
+  pixman,
-, pixman
+  cairo,
-, cairo
+  pango,
-, pango
+  stdenv,
-, stdenv
+  darwin,
-, darwin
-, conf ? { }
 }:
 
-let
-  configOverrides = writeText "cinny-config-overrides.json" (builtins.toJSON conf);
-in
 buildNpmPackage rec {
-  pname = "cinny";
+  pname = "cinny-unwrapped";
   version = "4.0.3";
 
   src = fetchFromGitHub {
@@ -35,7 +30,6 @@ buildNpmPackage rec {
   ) "-D_LIBCPP_HAS_NO_LIBRARY_ALIGNED_ALLOCATION=1";
 
   nativeBuildInputs = [
-    jq
     python3
     pkg-config
   ];
@@ -44,15 +38,12 @@ buildNpmPackage rec {
     pixman
     cairo
     pango
-  ] ++ lib.optionals stdenv.isDarwin [
+  ] ++ lib.optionals stdenv.isDarwin [ darwin.apple_sdk.frameworks.CoreText ];
-    darwin.apple_sdk.frameworks.CoreText
-  ];
 
   installPhase = ''
     runHook preInstall
 
     cp -r dist $out
-    jq -s '.[0] * .[1]' "config.json" "${configOverrides}" > "$out/config.json"
 
     runHook postInstall
   '';

pkgs/by-name/ci/cinny/package.nix

@@ -0,0 +1,32 @@
+{
+  cinny-unwrapped,
+  jq,
+  stdenvNoCC,
+  writeText,
+  conf ? { },
+}:
+let
+  configOverrides = writeText "cinny-config-overrides.json" (builtins.toJSON conf);
+in
+if (conf == { }) then
+  cinny-unwrapped
+else
+  stdenvNoCC.mkDerivation {
+    pname = "cinny";
+    inherit (cinny-unwrapped) version meta;
+
+    dontUnpack = true;
+
+    nativeBuildInputs = [ jq ];
+
+    installPhase = ''
+      runHook preInstall
+
+      mkdir -p $out
+      ln -s ${cinny-unwrapped}/* $out
+      rm $out/config.json
+      jq -s '.[0] * .[1]' "${cinny-unwrapped}/config.json" "${configOverrides}" > "$out/config.json"
+
+      runHook postInstall
+    '';
+  }

pkgs/by-name/co/comet-gog/package.nix

@@ -10,19 +10,19 @@
 let
   inherit (darwin.apple_sdk.frameworks) CoreFoundation SystemConfiguration;
 in
-rustPlatform.buildRustPackage {
+rustPlatform.buildRustPackage rec {
   pname = "comet-gog";
-  version = "0-unstable-2024-05-25";
+  version = "0.1.2";
 
   src = fetchFromGitHub {
     owner = "imLinguin";
     repo = "comet";
-    rev = "378ec2abdc2498e7c0c12aa50b71f6d94c3e8e3c";
+    rev = "refs/tags/v${version}";
-    hash = "sha256-r7ZPpJLy2fZsyNijl0+uYWQN941TCbv+Guv3wzD83IQ=";
+    hash = "sha256-TdIqdNn5HnIED7LMn4qAzKPHlA5t/Q1Dn+W+ulx5qOU=";
     fetchSubmodules = true;
   };
 
-  cargoHash = "sha256-dXNAGMVayzgT96ETrph9eCbQv28EK/OOxIRV8ewpVvs=";
+  cargoHash = "sha256-gAGCpcVjOkUZa/CobOjOt07WMHpvE5/q1bw+z4yBeNE=";
 
   # error: linker `aarch64-linux-gnu-gcc` not found
   postPatch = ''
@@ -37,6 +37,7 @@ rustPlatform.buildRustPackage {
   ];
 
   meta = {
+    changelog = "https://github.com/imLinguin/comet/releases/tag/v${version}";
     description = "Open Source implementation of GOG Galaxy's Communication Service";
     homepage = "https://github.com/imLinguin/comet";
     license = lib.licenses.gpl3Plus;

pkgs/by-name/co/concurrently/package.nix

@@ -0,0 +1,77 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  fetchpatch2,
+  makeWrapper,
+  nodejs,
+  pnpm_8,
+}:
+
+let
+  pnpm = pnpm_8;
+in
+stdenv.mkDerivation (finalAttrs: {
+  pname = "concurrently";
+  version = "8.2.2";
+
+  src = fetchFromGitHub {
+    owner = "open-cli-tools";
+    repo = "concurrently";
+    rev = "refs/tags/v${finalAttrs.version}";
+    hash = "sha256-VoyVYBOBMguFKnG2VItk1L5BbF72nO7bYJpb7adqICs=";
+  };
+
+  pnpmDeps = pnpm.fetchDeps {
+    inherit (finalAttrs)
+      pname
+      version
+      src
+      patches
+      ;
+    hash = "sha256-F1teWIABkK0mqZcK3RdGNKmexI/C59QWSrrD1jYbHt0=";
+  };
+
+  patches = [
+    (fetchpatch2 {
+      name = "use-pnpm-8.patch";
+      url = "https://github.com/open-cli-tools/concurrently/commit/0b67a1a5a335396340f4347886fb9d0968a57555.patch";
+      hash = "sha256-mxid2Yl9S6+mpN7OLUCrJ1vS0bQ/UwNiGJ0DL6Zn//Q=";
+    })
+  ];
+
+  nativeBuildInputs = [
+    makeWrapper
+    nodejs
+    pnpm.configHook
+  ];
+
+  buildPhase = ''
+    runHook preBuild
+
+    pnpm build
+
+    runHook postBuild
+  '';
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p "$out/bin" "$out/lib/concurrently"
+    cp -r dist node_modules "$out/lib/concurrently"
+    makeWrapper "${lib.getExe nodejs}" "$out/bin/concurrently" \
+      --add-flags "$out/lib/concurrently/dist/bin/concurrently.js"
+    ln -s "$out/bin/concurrently" "$out/bin/con"
+
+    runHook postInstall
+  '';
+
+  meta = {
+    changelog = "https://github.com/open-cli-tools/concurrently/releases/tag/v${finalAttrs.version}";
+    description = "Run commands concurrently";
+    homepage = "https://github.com/open-cli-tools/concurrently";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ jpetrucciani ];
+    mainProgram = "concurrently";
+  };
+})

pkgs/by-name/da/davis/package.nix

@@ -6,16 +6,16 @@
 
 php.buildComposerProject (finalAttrs: {
   pname = "davis";
-  version = "4.4.3";
+  version = "4.4.4";
 
   src = fetchFromGitHub {
     owner = "tchapi";
     repo = "davis";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-0Km4bLQVfbkr5BL8XY5tM147Sje8hcFOjhCRnXq+4d4=";
+    hash = "sha256-nQkyNs718Zrc2BiTNXSXPY23aiviJKoBJeuoSm5ISOI=";
   };
 
-  vendorHash = "sha256-NOb6rc9jVsf+/RVOW7SLBAJk9SihcRxoepUEGBGLi2w=";
+  vendorHash = "sha256-zZlDonCwb9tJyckounv96eF4cx6Z/LBoAdB/r600HM4=";
 
   postInstall = ''
     # Only include the files needed for runtime in the derivation

pkgs/by-name/ek/eksctl/package.nix

@@ -6,16 +6,16 @@
 
 buildGoModule rec {
   pname = "eksctl";
-  version = "0.187.0";
+  version = "0.188.0";
 
   src = fetchFromGitHub {
     owner = "weaveworks";
     repo = pname;
     rev = version;
-    hash = "sha256-EZYKRkxU2KcjiANUA2tXOk7Kp60O0iOGXRIjmSa61SY=";
+    hash = "sha256-ZEMTPvmRhUFqaugtvgWv9EbuE6sF489ay0C3QUuAxfo=";
   };
 
-  vendorHash = "sha256-aOLZQKhBy5uBmOhJPfk3ZDHp/YbZw9oN4DaAu1NFcvA=";
+  vendorHash = "sha256-xz+hEgLNplXJIfqyNE10Zc5SwSdedLAL3tHuh6875+A=";
 
   doCheck = false;
 

pkgs/by-name/fa/fast-float/package.nix

@@ -1,28 +1,31 @@
-{ lib
+{
-, stdenv
+  lib,
-, fetchFromGitHub
+  stdenv,
-, cmake
+  fetchFromGitHub,
+  cmake,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "fast-float";
-  version = "6.1.2";
+  version = "6.1.3";
 
   src = fetchFromGitHub {
     owner = "fastfloat";
     repo = "fast_float";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-1QH9XvY981nSKCjb2nK3tDFHkJy9N1zGNX0dACRjTxE=";
+    hash = "sha256-CMPk2RNbfPT+Pe2L9nS/i1JNXM0giuX+lOuF1g9tn9s=";
   };
 
-  nativeBuildInputs = [
+  nativeBuildInputs = [ cmake ];
-    cmake
-  ];
 
   meta = {
     description = "Fast and exact implementation of the C++ from_chars functions for number types";
     homepage = "https://github.com/fastfloat/fast_float";
-    license = with lib.licenses; [ asl20 boost mit ];
+    license = with lib.licenses; [
+      asl20
+      boost
+      mit
+    ];
     maintainers = with lib.maintainers; [ wegank ];
     platforms = lib.platforms.all;
   };

pkgs/by-name/fa/fastfetch/package.nix

@@ -1,62 +1,65 @@
-{ lib
+{
-, stdenv
+  lib,
-, fetchFromGitHub
+  stdenv,
-, chafa
+  fetchFromGitHub,
-, cmake
+  chafa,
-, darwin
+  cmake,
-, dbus
+  darwin,
-, dconf
+  dbus,
-, ddcutil
+  dconf,
-, glib
+  ddcutil,
-, hwdata
+  glib,
-, imagemagick_light
+  hwdata,
-, libXrandr
+  imagemagick_light,
-, libdrm
+  libXrandr,
-, libglvnd
+  libdrm,
-, libpulseaudio
+  libglvnd,
-, libselinux
+  libpulseaudio,
-, libsepol
+  libselinux,
-, libxcb
+  libsepol,
-, makeBinaryWrapper
+  libxcb,
-, networkmanager
+  makeBinaryWrapper,
-, nix-update-script
+  nix-update-script,
-, ocl-icd
+  ocl-icd,
-, opencl-headers
+  opencl-headers,
-, overrideSDK
+  overrideSDK,
-, pcre
+  pcre,
-, pcre2
+  pcre2,
-, pkg-config
+  pkg-config,
-, python3
+  python3,
-, rpm
+  rpm,
-, sqlite
+  sqlite,
-, testers
+  testers,
-, util-linux
+  util-linux,
-, vulkan-loader
+  vulkan-loader,
-, wayland
+  wayland,
-, xfce
+  xfce,
-, xorg
+  xorg,
-, yyjson
+  yyjson,
-, zlib
+  zlib,
-, rpmSupport ? false
+  rpmSupport ? false,
-, vulkanSupport ? true
+  vulkanSupport ? true,
-, waylandSupport ? true
+  waylandSupport ? true,
-, x11Support ? true
+  x11Support ? true,
 }:
 let
   stdenv' = if stdenv.isDarwin then overrideSDK stdenv "11.0" else stdenv;
 in
 stdenv'.mkDerivation (finalAttrs: {
   pname = "fastfetch";
-  version = "2.20.0";
+  version = "2.21.0";
 
   src = fetchFromGitHub {
     owner = "fastfetch-cli";
     repo = "fastfetch";
     rev = finalAttrs.version;
-    hash = "sha256-8N2BG9eTZpAvnc1wiG6p7GJSCPfZ+NTbz8kLGPRg5HU=";
+    hash = "sha256-1bWWwMzbzECWARhl3ULMVF5QhbvrV5ShVT382BnRGg8=";
   };
 
-  outputs = [ "out" "man" ];
+  outputs = [
+    "out"
+    "man"
+  ];
 
   nativeBuildInputs = [
     cmake
@@ -65,79 +68,83 @@ stdenv'.mkDerivation (finalAttrs: {
     python3
   ];
 
-  buildInputs = [
+  buildInputs =
-    chafa
+    [
-    imagemagick_light
+      chafa
-    pcre
+      imagemagick_light
-    pcre2
+      pcre
-    sqlite
+      pcre2
-    yyjson
+      sqlite
-  ] ++ lib.optionals stdenv.isLinux [
+      yyjson
-    dbus
+    ]
-    dconf
+    ++ lib.optionals stdenv.isLinux [
-    ddcutil
+      dbus
-    glib
+      dconf
-    hwdata
+      ddcutil
-    libdrm
+      glib
-    libpulseaudio
+      hwdata
-    libselinux
+      libdrm
-    libsepol
+      libpulseaudio
-    networkmanager
+      libselinux
-    ocl-icd
+      libsepol
-    opencl-headers
+      ocl-icd
-    util-linux
+      opencl-headers
-    zlib
+      util-linux
-  ] ++ lib.optionals rpmSupport [
+      zlib
-    rpm
+    ]
-  ] ++ lib.optionals vulkanSupport [
+    ++ lib.optionals rpmSupport [ rpm ]
-    vulkan-loader
+    ++ lib.optionals vulkanSupport [ vulkan-loader ]
-  ] ++ lib.optionals waylandSupport [
+    ++ lib.optionals waylandSupport [ wayland ]
-    wayland
+    ++ lib.optionals x11Support [
-  ] ++ lib.optionals x11Support [
+      libXrandr
-    libXrandr
+      libglvnd
-    libglvnd
+      libxcb
-    libxcb
+      xorg.libXau
-    xorg.libXau
+      xorg.libXdmcp
-    xorg.libXdmcp
+      xorg.libXext
-    xorg.libXext
+    ]
-  ] ++ lib.optionals (x11Support && (!stdenv.isDarwin)) [
+    ++ lib.optionals (x11Support && (!stdenv.isDarwin)) [ xfce.xfconf ]
-    xfce.xfconf
+    ++ lib.optionals stdenv.isDarwin (
-  ] ++ lib.optionals stdenv.isDarwin (with darwin.apple_sdk_11_0.frameworks; [
+      with darwin.apple_sdk_11_0.frameworks;
-    Apple80211
+      [
-    AppKit
+        Apple80211
-    AVFoundation
+        AppKit
-    Cocoa
+        AVFoundation
-    CoreDisplay
+        Cocoa
-    CoreVideo
+        CoreDisplay
-    CoreWLAN
+        CoreVideo
-    DisplayServices
+        CoreWLAN
-    IOBluetooth
+        DisplayServices
-    MediaRemote
+        IOBluetooth
-    OpenCL
+        MediaRemote
-    SystemConfiguration
+        OpenCL
-    darwin.moltenvk
+        SystemConfiguration
-  ]);
+        darwin.moltenvk
+      ]
+    );
 
-  cmakeFlags = [
+  cmakeFlags =
-    (lib.cmakeOptionType "filepath" "CMAKE_INSTALL_SYSCONFDIR" "${placeholder "out"}/etc")
+    [
-    (lib.cmakeBool "ENABLE_DIRECTX_HEADERS" false)
+      (lib.cmakeOptionType "filepath" "CMAKE_INSTALL_SYSCONFDIR" "${placeholder "out"}/etc")
-    (lib.cmakeBool "ENABLE_DRM" false)
+      (lib.cmakeBool "ENABLE_DIRECTX_HEADERS" false)
-    (lib.cmakeBool "ENABLE_IMAGEMAGICK6" false)
+      (lib.cmakeBool "ENABLE_DRM" false)
-    (lib.cmakeBool "ENABLE_OSMESA" false)
+      (lib.cmakeBool "ENABLE_IMAGEMAGICK6" false)
-    (lib.cmakeBool "ENABLE_SYSTEM_YYJSON" true)
+      (lib.cmakeBool "ENABLE_OSMESA" false)
-    (lib.cmakeBool "ENABLE_GLX" x11Support)
+      (lib.cmakeBool "ENABLE_SYSTEM_YYJSON" true)
-    (lib.cmakeBool "ENABLE_RPM" rpmSupport)
+      (lib.cmakeBool "ENABLE_GLX" x11Support)
-    (lib.cmakeBool "ENABLE_VULKAN" x11Support)
+      (lib.cmakeBool "ENABLE_RPM" rpmSupport)
-    (lib.cmakeBool "ENABLE_WAYLAND" waylandSupport)
+      (lib.cmakeBool "ENABLE_VULKAN" x11Support)
-    (lib.cmakeBool "ENABLE_X11" x11Support)
+      (lib.cmakeBool "ENABLE_WAYLAND" waylandSupport)
-    (lib.cmakeBool "ENABLE_XCB" x11Support)
+      (lib.cmakeBool "ENABLE_X11" x11Support)
-    (lib.cmakeBool "ENABLE_XCB_RANDR" x11Support)
+      (lib.cmakeBool "ENABLE_XCB" x11Support)
-    (lib.cmakeBool "ENABLE_XFCONF" (x11Support && (!stdenv.isDarwin)))
+      (lib.cmakeBool "ENABLE_XCB_RANDR" x11Support)
-    (lib.cmakeBool "ENABLE_XRANDR" x11Support)
+      (lib.cmakeBool "ENABLE_XFCONF" (x11Support && (!stdenv.isDarwin)))
-  ] ++ lib.optionals stdenv.isLinux [
+      (lib.cmakeBool "ENABLE_XRANDR" x11Support)
-    (lib.cmakeOptionType "filepath" "CUSTOM_PCI_IDS_PATH" "${hwdata}/share/hwdata/pci.ids")
+    ]
-    (lib.cmakeOptionType "filepath" "CUSTOM_AMDGPU_IDS_PATH" "${libdrm}/share/libdrm/amdgpu.ids")
+    ++ lib.optionals stdenv.isLinux [
-  ];
+      (lib.cmakeOptionType "filepath" "CUSTOM_PCI_IDS_PATH" "${hwdata}/share/hwdata/pci.ids")
+      (lib.cmakeOptionType "filepath" "CUSTOM_AMDGPU_IDS_PATH" "${libdrm}/share/libdrm/amdgpu.ids")
+    ];
 
   postPatch = ''
     substituteInPlace completions/fastfetch.fish --replace-fail python3 '${python3.interpreter}'
@@ -162,8 +169,12 @@ stdenv'.mkDerivation (finalAttrs: {
   meta = {
     description = "Like neofetch, but much faster because written in C";
     homepage = "https://github.com/fastfetch-cli/fastfetch";
+    changelog = "https://github.com/fastfetch-cli/fastfetch/releases/tag/${finalAttrs.version}";
     license = lib.licenses.mit;
-    maintainers = with lib.maintainers; [ khaneliman ];
+    maintainers = with lib.maintainers; [
+      luftmensch-luftmensch
+      khaneliman
+    ];
     platforms = lib.platforms.all;
     mainProgram = "fastfetch";
   };

pkgs/by-name/fw/fwupd/package.nix

@@ -120,7 +120,7 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "fwupd";
-  version = "1.9.22";
+  version = "1.9.23";
 
   # libfwupd goes to lib
   # daemon, plug-ins and libfwupdplugin go to out
@@ -131,7 +131,7 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "fwupd";
     repo = "fwupd";
     rev = finalAttrs.version;
-    hash = "sha256-skmfTejj9cPdihwPIbsyoSI8ekVNcUXUNMcpPs9uSNo=";
+    hash = "sha256-SLwRATYUSnHN6r5KyVGXbdAFjHCfykItbBTsl5/s8fA=";
   };
 
   patches = [

pkgs/by-name/ga/gamescope/package.nix

@@ -27,6 +27,7 @@
 , stb
 , wlroots
 , libdecor
+, lcms
 , lib
 , makeBinaryWrapper
 , patchelfUnstable
@@ -44,14 +45,14 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "gamescope";
-  version = "3.14.24";
+  version = "3.14.26";
 
   src = fetchFromGitHub {
     owner = "ValveSoftware";
     repo = "gamescope";
     rev = "refs/tags/${finalAttrs.version}";
     fetchSubmodules = true;
-    hash = "sha256-+8uojnfx8V8BiYAeUsOaXTXrlcST83z6Eld7qv1oboE=";
+    hash = "sha256-vCPKySLB1D9oKgCrYrXqt/s0hV+/ocuWOrcDUzKbdKI=";
   };
 
   patches = [
@@ -132,6 +133,7 @@ stdenv.mkDerivation (finalAttrs: {
     pixman
     libcap
     stb
+    lcms
   ]);
 
   postInstall = lib.optionalString enableExecutable ''

pkgs/by-name/gf/gfortran/package.nix

@@ -0,0 +1,11 @@
+{ wrapCC, gcc }:
+# Use the same GCC version as the one from stdenv by default
+wrapCC (
+  gcc.cc.override {
+    name = "gfortran";
+    langFortran = true;
+    langCC = false;
+    langC = false;
+    profiledCompiler = false;
+  }
+)

pkgs/by-name/gf/gfortran10/package.nix

@@ -0,0 +1,10 @@
+{ wrapCC, gcc10 }:
+wrapCC (
+  gcc10.cc.override {
+    name = "gfortran";
+    langFortran = true;
+    langCC = false;
+    langC = false;
+    profiledCompiler = false;
+  }
+)

pkgs/by-name/gf/gfortran11/package.nix

@@ -0,0 +1,10 @@
+{ wrapCC, gcc11 }:
+wrapCC (
+  gcc11.cc.override {
+    name = "gfortran";
+    langFortran = true;
+    langCC = false;
+    langC = false;
+    profiledCompiler = false;
+  }
+)

pkgs/by-name/gf/gfortran12/package.nix

@@ -0,0 +1,10 @@
+{ wrapCC, gcc12 }:
+wrapCC (
+  gcc12.cc.override {
+    name = "gfortran";
+    langFortran = true;
+    langCC = false;
+    langC = false;
+    profiledCompiler = false;
+  }
+)

pkgs/by-name/gf/gfortran13/package.nix

@@ -0,0 +1,10 @@
+{ wrapCC, gcc13 }:
+wrapCC (
+  gcc13.cc.override {
+    name = "gfortran";
+    langFortran = true;
+    langCC = false;
+    langC = false;
+    profiledCompiler = false;
+  }
+)

pkgs/by-name/gf/gfortran14/package.nix

@@ -0,0 +1,10 @@
+{ wrapCC, gcc14 }:
+wrapCC (
+  gcc14.cc.override {
+    name = "gfortran";
+    langFortran = true;
+    langCC = false;
+    langC = false;
+    profiledCompiler = false;
+  }
+)

pkgs/by-name/gf/gfortran48/package.nix

@@ -0,0 +1,10 @@
+{ wrapCC, gcc48 }:
+wrapCC (
+  gcc48.cc.override {
+    name = "gfortran";
+    langFortran = true;
+    langCC = false;
+    langC = false;
+    profiledCompiler = false;
+  }
+)

pkgs/by-name/gf/gfortran49/package.nix

@@ -0,0 +1,10 @@
+{ wrapCC, gcc49 }:
+wrapCC (
+  gcc49.cc.override {
+    name = "gfortran";
+    langFortran = true;
+    langCC = false;
+    langC = false;
+    profiledCompiler = false;
+  }
+)

pkgs/by-name/gf/gfortran6/package.nix

@@ -0,0 +1,10 @@
+{ wrapCC, gcc6 }:
+wrapCC (
+  gcc6.cc.override {
+    name = "gfortran";
+    langFortran = true;
+    langCC = false;
+    langC = false;
+    profiledCompiler = false;
+  }
+)

pkgs/by-name/gf/gfortran7/package.nix

@@ -0,0 +1,10 @@
+{ wrapCC, gcc7 }:
+wrapCC (
+  gcc7.cc.override {
+    name = "gfortran";
+    langFortran = true;
+    langCC = false;
+    langC = false;
+    profiledCompiler = false;
+  }
+)

pkgs/by-name/gf/gfortran8/package.nix

@@ -0,0 +1,10 @@
+{ wrapCC, gcc8 }:
+wrapCC (
+  gcc8.cc.override {
+    name = "gfortran";
+    langFortran = true;
+    langCC = false;
+    langC = false;
+    profiledCompiler = false;
+  }
+)

pkgs/by-name/gf/gfortran9/package.nix

@@ -0,0 +1,10 @@
+{ wrapCC, gcc9 }:
+wrapCC (
+  gcc9.cc.override {
+    name = "gfortran";
+    langFortran = true;
+    langCC = false;
+    langC = false;
+    profiledCompiler = false;
+  }
+)

pkgs/by-name/gi/gickup/package.nix

@@ -7,16 +7,16 @@
 
 buildGoModule rec {
   pname = "gickup";
-  version = "0.10.30";
+  version = "0.10.31";
 
   src = fetchFromGitHub {
     owner = "cooperspencer";
     repo = "gickup";
     rev = "refs/tags/v${version}";
-    hash = "sha256-knnc4FAzGk1hV/Pzoc+klm4dt1cFrn4BYZx1lY7iLp8=";
+    hash = "sha256-6du9x5QQN1VJzAABJ+8Fm3YscfoRwKVYZO9tTMz22AQ=";
   };
 
-  vendorHash = "sha256-XxDsEmi945CduurQRsH7rjFAEu/SMX3rSd63Dwq2r8A=";
+  vendorHash = "sha256-Nmt7T6sDWVHQZuINvON24Mq638Q04r5bpOBnz2vp4vM=";
 
   ldflags = [ "-X main.version=${version}" ];
 

pkgs/by-name/go/godns/package.nix

@@ -9,19 +9,19 @@
 
 buildGoModule rec {
   pname = "godns";
-  version = "3.1.6";
+  version = "3.1.7";
 
   src = fetchFromGitHub {
     owner = "TimothyYe";
     repo = "godns";
     rev = "refs/tags/v${version}";
-    hash = "sha256-Kr+zMmjpHR2JtCaDyLMcQwOUXlPJeisu94zHRpEYV/I=";
+    hash = "sha256-aTCYnjv9DTlCohdESGAjMz7JQG0BsLTNMiknyB6Ut50=";
   };
 
   vendorHash = "sha256-E15h5p4ppRb91EUoz5dyWNFl745rt419NMCSurMLxis=";
   npmDeps = fetchNpmDeps {
     src = "${src}/web";
-    hash = "sha256-2yeqLly0guU/kpX+yH/QOoDGzyJTxkTaCt8EleJhybU=";
+    hash = "sha256-gnAUI3lLDhjZ+nLap41COq765ymR6a8FgVY/aqqidTQ=";
   };
 
   npmRoot = "web";

pkgs/by-name/go/gowall/package.nix

@@ -0,0 +1,41 @@
+{
+  lib,
+  stdenv,
+  buildGoModule,
+  fetchFromGitHub,
+  installShellFiles,
+}:
+
+buildGoModule rec {
+  pname = "gowall";
+  version = "0.1.5";
+
+  src = fetchFromGitHub {
+    owner = "Achno";
+    repo = "gowall";
+    rev = "v${version}";
+    hash = "sha256-4h7vRu1aqCGccKx2UiLSFNloqf22QUml4BHkKzzdwYA=";
+  };
+
+  vendorHash = "sha256-jNx4ehew+IBx7M6ey/rT0vb53+9OBVYSEDJv8JWfZIw=";
+
+  nativeBuildInputs = [ installShellFiles ];
+  postInstall = lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
+    installShellCompletion --cmd gowall \
+      --bash <($out/bin/gowall completion bash) \
+      --fish <($out/bin/gowall completion fish) \
+      --zsh <($out/bin/gowall completion zsh)
+  '';
+
+  meta = {
+    changelog = "https://github.com/Achno/gowall/releases/tag/v${version}";
+    description = "Tool to convert a Wallpaper's color scheme / palette";
+    homepage = "https://github.com/Achno/gowall";
+    license = lib.licenses.mit;
+    mainProgram = "gowall";
+    maintainers = with lib.maintainers; [
+      crem
+      emilytrau
+    ];
+  };
+}

pkgs/by-name/ig/ignite-cli/package.nix

@@ -8,13 +8,13 @@
 
 buildGoModule rec {
   pname = "ignite-cli";
-  version = "28.5.0";
+  version = "28.5.1";
 
   src = fetchFromGitHub {
     repo = "cli";
     owner = "ignite";
     rev = "v${version}";
-    hash = "sha256-s8RKlqIL1AjsqO+sOrWnAfHCpP1G7BFxnr5aHVe7Np4=";
+    hash = "sha256-JgcLW+CoxLaz9WKGkSDpUEZJtEeP35LveW0B3arnNw0=";
   };
 
   vendorHash = "sha256-NEjva9KDPz7rykqcKcTOwSKBR3n4oFSYARX/BQzhgqY=";

pkgs/by-name/in/inter-nerdfont/package.nix

@@ -0,0 +1,44 @@
+{
+  lib,
+  fontforge,
+  nerd-font-patcher,
+  stdenvNoCC,
+  fetchzip,
+}:
+
+stdenvNoCC.mkDerivation (finalAttrs: {
+  pname = "inter-nerdfont";
+  version = "4.0";
+
+  src = fetchzip {
+    url = "https://github.com/rsms/inter/releases/download/v${finalAttrs.version}/Inter-${finalAttrs.version}.zip";
+    stripRoot = false;
+    hash = "sha256-hFK7xFJt69n+98+juWgMvt+zeB9nDkc8nsR8vohrFIc=";
+  };
+
+  nativeBuildInputs = [
+    fontforge
+    nerd-font-patcher
+  ];
+
+  buildPhase = ''
+    runHook preBuild
+    nerd-font-patcher Inter.ttc
+    runHook postBuild
+  '';
+
+  installPhase = ''
+    runHook preInstall
+    install -Dm444 'Inter Nerd Font.ttc' $out/share/fonts/truetype/InterNerdFont.ttc
+    cp *.ttf $out/share/fonts/truetype
+    runHook postInstall
+  '';
+
+  meta = {
+    homepage = "https://gitlab.com/mid_os/inter-nerdfont";
+    description = "NerdFont patch of the Inter font";
+    license = lib.licenses.ofl;
+    platforms = lib.platforms.all;
+    maintainers = [ lib.maintainers.midirhee12 ];
+  };
+})

pkgs/by-name/la/labelle/package.nix

@@ -8,14 +8,14 @@
 }:
 python3Packages.buildPythonApplication rec {
   pname = "labelle";
-  version = "1.2.2";
+  version = "1.2.3";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "labelle-org";
     repo = "labelle";
     rev = "refs/tags/v${version}";
-    hash = "sha256-Im1mZ9kJB+0uPAmEXpUWoOYBooejes05vTGLDqPCAN4=";
+    hash = "sha256-nGWffQAXlnKiWBUnSo/IKGdWsLdwLr9N4jAURcVGfj8=";
   };
 
   postPatch = ''

pkgs/by-name/ma/mapcache/package.nix

@@ -0,0 +1,81 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  cmake,
+  pkg-config,
+  apacheHttpd,
+  apr,
+  aprutil,
+  curl,
+  db,
+  fcgi,
+  gdal,
+  geos,
+  libgeotiff,
+  libjpeg,
+  libpng,
+  libtiff,
+  pcre2,
+  pixman,
+  proj,
+  sqlite,
+  zlib,
+}:
+
+stdenv.mkDerivation rec {
+  pname = "mapcache";
+  version = "1.14.1";
+
+  src = fetchFromGitHub {
+    owner = "MapServer";
+    repo = "mapcache";
+    rev = "rel-${lib.replaceStrings [ "." ] [ "-" ] version}";
+    hash = "sha256-AwdZdOEq9SZ5VzuBllg4U1gdVxZ9IVdqiDrn3QuRdCk=";
+  };
+
+  nativeBuildInputs = [
+    cmake
+    pkg-config
+  ];
+
+  buildInputs = [
+    apacheHttpd
+    apr
+    aprutil
+    curl
+    db
+    fcgi
+    gdal
+    geos
+    libgeotiff
+    libjpeg
+    libpng
+    libtiff
+    pcre2
+    pixman
+    proj
+    sqlite
+    zlib
+  ];
+
+  cmakeFlags = [
+    (lib.cmakeBool "WITH_BERKELEY_DB" true)
+    (lib.cmakeBool "WITH_MEMCACHE" true)
+    (lib.cmakeBool "WITH_TIFF" true)
+    (lib.cmakeBool "WITH_GEOTIFF" true)
+    (lib.cmakeBool "WITH_PCRE2" true)
+    (lib.cmakeFeature "APACHE_MODULE_DIR" "${placeholder "out"}/modules")
+  ];
+
+  env.NIX_CFLAGS_COMPILE = lib.optionalString stdenv.isDarwin "-std=c99";
+
+  meta = {
+    description = "Server that implements tile caching to speed up access to WMS layers";
+    homepage = "https://mapserver.org/mapcache/";
+    changelog = "https://www.mapserver.org/development/changelog/mapcache/";
+    license = lib.licenses.mit;
+    maintainers = lib.teams.geospatial.members;
+    platforms = lib.platforms.unix;
+  };
+}

pkgs/by-name/ma/mapserver/package.nix

@@ -1,29 +1,53 @@
-{ lib, stdenv, fetchFromGitHub, cmake, pkg-config
+{
-, cairo, curl, fcgi, freetype, fribidi, gdal, geos, giflib, harfbuzz
+  lib,
-, libjpeg, libpng, librsvg, libxml2, postgresql, proj, protobufc, zlib
+  stdenv,
-, withPython ? true, swig, python3
+  fetchFromGitHub,
+
+  withPython ? true,
+
+  cairo,
+  cmake,
+  curl,
+  fcgi,
+  freetype,
+  fribidi,
+  gdal,
+  geos,
+  giflib,
+  harfbuzz,
+  libjpeg,
+  libpng,
+  librsvg,
+  libxml2,
+  pkg-config,
+  postgresql,
+  proj,
+  protobufc,
+  python3,
+  swig,
+  zlib,
 }:
 
 stdenv.mkDerivation rec {
   pname = "mapserver";
-  version = "8.0.1";
+  version = "8.2.1";
 
   src = fetchFromGitHub {
     owner = "MapServer";
     repo = "MapServer";
     rev = "rel-${lib.replaceStrings [ "." ] [ "-" ] version}";
-    sha256 = "sha256-fAf4kOe/6bQW0i46+EZbD/6iWI2Bjkn2no6XeR/+mg4=";
+    sha256 = "sha256-kZEDC89yoQP0ma5avp6r+Hz8JMpErGlBVQkhlHO6UFw=";
   };
 
-  patches = [
+  nativeBuildInputs =
-    # drop this patch for version 8.0.2
+    [
-    ./fix-build-w-libxml2-12.patch
+      cmake
-  ];
+      pkg-config
-
+    ]
-  nativeBuildInputs = [
+    ++ lib.optionals withPython [
-    cmake
+      swig
-    pkg-config
+      python3.pkgs.setuptools
-  ] ++ lib.optionals withPython [ swig python3.pkgs.setuptools ];
+    ];
 
   buildInputs = [
     cairo
@@ -38,7 +62,7 @@ stdenv.mkDerivation rec {
     libjpeg
     libpng
     librsvg
-    libxml2
+    (libxml2.override { enableHttp = true; })
     postgresql
     proj
     protobufc

pkgs/by-name/mi/minijinja/package.nix

@@ -2,16 +2,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "minijinja";
-  version = "2.1.0";
+  version = "2.1.1";
 
   src = fetchFromGitHub {
     owner = "mitsuhiko";
     repo = "minijinja";
     rev = version;
-    hash = "sha256-R+OY5RIKX5AkP/sRkU1SoFAeFpFPjiMOuow9nEG30W0=";
+    hash = "sha256-21PPIh4xu5EFXdtvmmvoSRPdYiSEwswkACNys32kjXY=";
   };
 
-  cargoHash = "sha256-PiR7uq8VnD3vrYHeUh6QJ+yx4UxIq7pr17TNXpksfiA=";
+  cargoHash = "sha256-lPHM/pEXt4VLTTRxVxQTt/IAKhOxmzYkq71x10LFZ0w=";
 
   # The tests relies on the presence of network connection
   doCheck = false;

pkgs/by-name/mi/miru/darwin.nix

@@ -19,7 +19,7 @@ stdenvNoCC.mkDerivation rec {
 
   src = fetchurl {
     url = "https://github.com/ThaUnknown/miru/releases/download/v${version}/mac-Miru-${version}-mac.zip";
-    hash = "sha256-N4+WDXhu62QUFqdCcPPfYEOd2OImg/Moj+UT0xK2oGE=";
+    hash = "sha256-6QK9A+xy7Z66YDC9eJ5vFjtW8frjtYy9yoax7z6sWsg=";
   };
 
   sourceRoot = ".";

pkgs/by-name/mi/miru/linux.nix

@@ -19,7 +19,7 @@ appimageTools.wrapType2 rec {
   src = fetchurl {
     url = "https://github.com/ThaUnknown/miru/releases/download/v${version}/linux-Miru-${version}.AppImage";
     name = "${pname}-${version}.AppImage";
-    hash = "sha256-wnqCKnZKt0Fj8TasdRVzI558W7aIB5FLkcDEiZfz3ZQ=";
+    hash = "sha256-J632TswcRC6CnK5ppqdbY97V3Q1ADDNgX0joxC5ybmM=";
   };
 
   extraInstallCommands =

pkgs/by-name/mi/miru/package.nix

@@ -5,7 +5,7 @@
 }:
 let
   pname = "miru";
-  version = "5.1.6";
+  version = "5.2.7";
   meta = with lib; {
     description = "Stream anime torrents, real-time with no waiting for downloads";
     homepage = "https://miru.watch";

pkgs/by-name/mu/museum/package.nix

@@ -7,7 +7,7 @@
 
 buildGoModule rec {
 
-  version = "photos-v0.9.5";
+  version = "photos-v0.9.16";
   pname = "museum";
 
   src = fetchFromGitHub {
@@ -15,7 +15,7 @@ buildGoModule rec {
     repo = "ente";
     sparseCheckout = [ "server" ];
     rev = version;
-    hash = "sha256-U+3k6uIJWDw7QxF1GRF+f6ZXdmCwSkOJ/F60rU1PXRM=";
+    hash = "sha256-ZtlwDV3Iksi2QNzoAsAtbN7B/n0UKubU4nlXx4N0l+E=";
   };
 
   sourceRoot = "${src.name}/server";

pkgs/by-name/mu/music-assistant/ffmpeg.patch

@@ -1,8 +1,8 @@
 diff --git a/music_assistant/server/helpers/audio.py b/music_assistant/server/helpers/audio.py
-index 42011923..1e5dc112 100644
+index 6b7b5c8e..ec3b92d7 100644
 --- a/music_assistant/server/helpers/audio.py
 +++ b/music_assistant/server/helpers/audio.py
-@@ -218,7 +218,7 @@ async def crossfade_pcm_parts(
+@@ -214,7 +214,7 @@ async def crossfade_pcm_parts(
          await outfile.write(fade_out_part)
      args = [
          # generic args
@@ -11,7 +11,7 @@ index 42011923..1e5dc112 100644
          "-hide_banner",
          "-loglevel",
          "quiet",
-@@ -281,7 +281,7 @@ async def strip_silence(
+@@ -277,7 +277,7 @@ async def strip_silence(
  ) -> bytes:
      """Strip silence from begin or end of pcm audio using ffmpeg."""
      fmt = ContentType.from_bit_depth(bit_depth)
@@ -20,16 +20,16 @@ index 42011923..1e5dc112 100644
      args += [
          "-acodec",
          fmt.name.lower(),
-@@ -823,7 +823,7 @@ async def get_ffmpeg_stream(
+@@ -824,7 +824,7 @@ async def get_ffmpeg_stream(
  async def check_audio_support() -> tuple[bool, bool, str]:
      """Check if ffmpeg is present (with/without libsoxr support)."""
      # check for FFmpeg presence
--    returncode, output = await check_output("ffmpeg -version")
+-    returncode, output = await check_output("ffmpeg", "-version")
-+    returncode, output = await check_output("@ffmpeg@ -version")
++    returncode, output = await check_output("@ffmpeg@", "-version")
      ffmpeg_present = returncode == 0 and "FFmpeg" in output.decode()
  
      # use globals as in-memory cache
-@@ -877,7 +877,7 @@ async def get_silence(
+@@ -878,7 +878,7 @@ async def get_silence(
          return
      # use ffmpeg for all other encodings
      args = [
@@ -38,7 +38,7 @@ index 42011923..1e5dc112 100644
          "-hide_banner",
          "-loglevel",
          "quiet",
-@@ -971,7 +971,7 @@ def get_ffmpeg_args(
+@@ -972,7 +972,7 @@ def get_ffmpeg_args(
  
      # generic args
      generic_args = [
@@ -48,10 +48,10 @@ index 42011923..1e5dc112 100644
          "-loglevel",
          loglevel,
 diff --git a/music_assistant/server/helpers/tags.py b/music_assistant/server/helpers/tags.py
-index dc38e4c0..f4f3e2fe 100644
+index d17b55f6..b7b56c04 100644
 --- a/music_assistant/server/helpers/tags.py
 +++ b/music_assistant/server/helpers/tags.py
-@@ -368,7 +368,7 @@ async def parse_tags(
+@@ -380,7 +380,7 @@ async def parse_tags(
      file_path = input_file if isinstance(input_file, str) else "-"
  
      args = (
@@ -60,7 +60,7 @@ index dc38e4c0..f4f3e2fe 100644
          "-hide_banner",
          "-loglevel",
          "fatal",
-@@ -440,7 +440,7 @@ async def get_embedded_image(input_file: str | AsyncGenerator[bytes, None]) -> b
+@@ -471,7 +471,7 @@ async def get_embedded_image(input_file: str | AsyncGenerator[bytes, None]) -> b
      """
      file_path = input_file if isinstance(input_file, str) else "-"
      args = (

pkgs/by-name/mu/music-assistant/frontend.nix

@@ -6,12 +6,12 @@
 
 buildPythonPackage rec {
   pname = "music-assistant-frontend";
-  version = "2.5.15";
+  version = "2.7.0";
   pyproject = true;
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-D8VFdXgaVXSxk7c24kvb9TflFztS1zLwW4qGqV32nLo=";
+    hash = "sha256-KrloxxdqIwQ5NsxAGm28D5StHnw9LTqDDtcchD5X5Qk=";
   };
 
   postPatch = ''

pkgs/by-name/mu/music-assistant/package.nix

@@ -11,6 +11,19 @@ let
   python = python3.override {
     self = python;
     packageOverrides = self: super: {
+      aiojellyfin = super.aiojellyfin.overridePythonAttrs rec {
+        version = "0.9.2";
+
+        src = fetchFromGitHub {
+          owner = "jc2k";
+          repo = "aiojellyfin";
+          rev = "refs/tags/v${version}";
+          hash = "sha256-q+b1tKr46qq3PULPkCaQk2VoC1aaNxPK/E1Kj4PABfI=";
+        };
+
+        doCheck = false;
+      };
+
       music-assistant-frontend = self.callPackage ./frontend.nix { };
     };
   };
@@ -24,14 +37,14 @@ in
 
 python.pkgs.buildPythonApplication rec {
   pname = "music-assistant";
-  version = "2.0.7";
+  version = "2.1.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "music-assistant";
     repo = "server";
-    rev = version;
+    rev = "refs/tags/${version}";
-    hash = "sha256-JtdlZ3hH4fRU5TjmMUlrdSSCnLrIGCuSwSSrnLgjYEs=";
+    hash = "sha256-ALsl2xfAFYejDEhR5/ZpeIxoHFgvz471tb4OP5xQAUE=";
   };
 
   patches = [
@@ -43,8 +56,6 @@ python.pkgs.buildPythonApplication rec {
   ];
 
   postPatch = ''
-    sed -i "/--cov/d" pyproject.toml
-
     substituteInPlace pyproject.toml \
       --replace-fail "0.0.0" "${version}"
   '';
@@ -71,6 +82,7 @@ python.pkgs.buildPythonApplication rec {
       certifi
       colorlog
       cryptography
+      eyed3
       faust-cchardet
       ifaddr
       mashumaro
@@ -87,10 +99,13 @@ python.pkgs.buildPythonApplication rec {
   };
 
   nativeCheckInputs = with python.pkgs; [
-    ffmpeg-headless
+    aiojellyfin
     pytest-aiohttp
+    pytest-cov-stub
     pytestCheckHook
-  ] ++ lib.flatten (lib.attrValues optional-dependencies);
+    syrupy
+  ]
+  ++ lib.flatten (lib.attrValues optional-dependencies);
 
   pythonImportsCheck = [ "music_assistant" ];
 

pkgs/by-name/mu/music-assistant/providers.nix

@@ -1,10 +1,12 @@
 # Do not edit manually, run ./update-providers.py
 
 {
-  version = "2.0.7";
+  version = "2.1.1";
   providers = {
     airplay = [
     ];
+    apple_music = [
+    ]; # missing pywidevine
     builtin = [
     ];
     chromecast = ps: with ps; [
@@ -29,8 +31,9 @@
     ]; # missing hass-client
     hass_players = [
     ];
-    jellyfin = [
+    jellyfin = ps: with ps; [
-    ]; # missing jellyfin_apiclient_python
+      aiojellyfin
+    ];
     musicbrainz = [
     ];
     opensubsonic = ps: with ps; [
@@ -48,6 +51,7 @@
       aioslimproto
     ];
     snapcast = ps: with ps; [
+      bidict
       snapcast
     ];
     sonos = ps: with ps; [
@@ -71,8 +75,8 @@
     ugp = [
     ];
     ytmusic = ps: with ps; [
-      pytube
+      yt-dlp
       ytmusicapi
-    ];
+    ]; # missing yt-dlp-youtube-accesstoken
   };
 }