Merge remote-tracking branch 'origin/master' into staging-next

.github/workflows/backport.yml

@@ -20,7 +20,7 @@ jobs:
     if: github.repository_owner == 'NixOS' && github.event.pull_request.merged == true && (github.event_name != 'labeled' || startsWith('backport', github.event.label.name))
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
+      - uses: actions/checkout@9bb56186c3b09b4f86b1c65136769dd318469633 # v4.1.2
         with:
           ref: ${{ github.event.pull_request.head.sha }}
       - name: Create backport PRs

.github/workflows/basic-eval.yml

@@ -18,7 +18,7 @@ jobs:
     runs-on: ubuntu-latest
     # we don't limit this action to only NixOS repo since the checks are cheap and useful developer feedback
     steps:
-    - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
+    - uses: actions/checkout@9bb56186c3b09b4f86b1c65136769dd318469633 # v4.1.2
     - uses: cachix/install-nix-action@8887e596b4ee1134dae06b98d573bd674693f47c # v26
     - uses: cachix/cachix-action@18cf96c7c98e048e10a83abd92116114cd8504be # v14
       with:

.github/workflows/check-by-name.yml

@@ -87,7 +87,7 @@ jobs:
             exit 1
           fi
           echo "mergedSha=$mergedSha" >> "$GITHUB_ENV"
-      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
+      - uses: actions/checkout@9bb56186c3b09b4f86b1c65136769dd318469633 # v4.1.2
         with:
           # pull_request_target checks out the base branch by default
           ref: ${{ env.mergedSha }}

.github/workflows/check-maintainers-sorted.yaml

@@ -12,7 +12,7 @@ jobs:
     runs-on: ubuntu-latest
     if: github.repository_owner == 'NixOS'
     steps:
-      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
+      - uses: actions/checkout@9bb56186c3b09b4f86b1c65136769dd318469633 # v4.1.2
         with:
           # pull_request_target checks out the base branch by default
           ref: refs/pull/${{ github.event.pull_request.number }}/merge

.github/workflows/editorconfig.yml

@@ -24,7 +24,7 @@ jobs:
     - name: print list of changed files
       run: |
         cat "$HOME/changed_files"
-    - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
+    - uses: actions/checkout@9bb56186c3b09b4f86b1c65136769dd318469633 # v4.1.2
       with:
         # pull_request_target checks out the base branch by default
         ref: refs/pull/${{ github.event.pull_request.number }}/merge

.github/workflows/manual-nixos.yml

@@ -14,7 +14,7 @@ jobs:
     runs-on: ubuntu-latest
     if: github.repository_owner == 'NixOS'
     steps:
-      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
+      - uses: actions/checkout@9bb56186c3b09b4f86b1c65136769dd318469633 # v4.1.2
         with:
           # pull_request_target checks out the base branch by default
           ref: refs/pull/${{ github.event.pull_request.number }}/merge

.github/workflows/manual-nixpkgs.yml

@@ -15,7 +15,7 @@ jobs:
     runs-on: ubuntu-latest
     if: github.repository_owner == 'NixOS'
     steps:
-      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
+      - uses: actions/checkout@9bb56186c3b09b4f86b1c65136769dd318469633 # v4.1.2
         with:
           # pull_request_target checks out the base branch by default
           ref: refs/pull/${{ github.event.pull_request.number }}/merge

.github/workflows/nix-parse.yml

@@ -24,7 +24,7 @@ jobs:
         if [[ -s "$HOME/changed_files" ]]; then
           echo "CHANGED_FILES=$HOME/changed_files" > "$GITHUB_ENV"
         fi
-    - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
+    - uses: actions/checkout@9bb56186c3b09b4f86b1c65136769dd318469633 # v4.1.2
       with:
         # pull_request_target checks out the base branch by default
         ref: refs/pull/${{ github.event.pull_request.number }}/merge

.github/workflows/periodic-merge-24h.yml

@@ -41,7 +41,7 @@ jobs:
             into: staging-23.11
     name: ${{ matrix.pairs.from }} → ${{ matrix.pairs.into }}
     steps:
-      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
+      - uses: actions/checkout@9bb56186c3b09b4f86b1c65136769dd318469633 # v4.1.2
 
       - name: ${{ matrix.pairs.from }} → ${{ matrix.pairs.into }}
         uses: devmasx/merge-branch@854d3ac71ed1e9deb668e0074781b81fdd6e771f # 1.4.0

.github/workflows/periodic-merge-6h.yml

@@ -39,7 +39,7 @@ jobs:
             into: staging
     name: ${{ matrix.pairs.from }} → ${{ matrix.pairs.into }}
     steps:
-      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
+      - uses: actions/checkout@9bb56186c3b09b4f86b1c65136769dd318469633 # v4.1.2
 
       - name: ${{ matrix.pairs.from }} → ${{ matrix.pairs.into }}
         uses: devmasx/merge-branch@854d3ac71ed1e9deb668e0074781b81fdd6e771f # 1.4.0

.github/workflows/update-terraform-providers.yml

@@ -16,7 +16,7 @@ jobs:
     if: github.repository_owner == 'NixOS' && github.ref == 'refs/heads/master' # ensure workflow_dispatch only runs on master
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
+      - uses: actions/checkout@9bb56186c3b09b4f86b1c65136769dd318469633 # v4.1.2
       - uses: cachix/install-nix-action@8887e596b4ee1134dae06b98d573bd674693f47c # v26
         with:
           nix_path: nixpkgs=channel:nixpkgs-unstable
@@ -46,7 +46,7 @@ jobs:
         run: |
           git clean -f
       - name: create PR
-        uses: peter-evans/create-pull-request@a4f52f8033a6168103c2538976c07b467e8163bc # v6.0.1
+        uses: peter-evans/create-pull-request@70a41aba780001da0a30141984ae2a0c95d8704e # v6.0.2
         with:
           body: |
             Automatic update by [update-terraform-providers](https://github.com/NixOS/nixpkgs/blob/master/.github/workflows/update-terraform-providers.yml) action.

doc/languages-frameworks/javascript.section.md

@@ -315,10 +315,10 @@ buildPhase = ''
 '';
 ```
 
-The dist phase is also trying to build a binary, the only way to override it is with:
+The `distPhase` is packing the package's dependencies in a tarball using `yarn pack`. You can disable it using:
 
 ```nix
-distPhase = "true";
+doDist = false;
 ```
 
 The configure phase can sometimes fail because it makes many assumptions which may not always apply. One common override is:

lib/generators.nix

@@ -14,15 +14,58 @@
  * Documentation in the manual, #sec-generators
  */
 { lib }:
-with (lib).trivial;
+
 let
-  libStr = lib.strings;
-  libAttr = lib.attrsets;
+  inherit (lib)
+    addErrorContext
+    assertMsg
+    attrNames
+    concatLists
+    concatMapStringsSep
+    concatStrings
+    concatStringsSep
+    const
+    elem
+    escape
+    filter
+    flatten
+    foldl
+    functionArgs  # Note: not the builtin; considers `__functor` in attrsets.
+    gvariant
+    hasInfix
+    head
+    id
+    init
+    isAttrs
+    isBool
+    isDerivation
+    isFloat
+    isFunction    # Note: not the builtin; considers `__functor` in attrsets.
+    isInt
+    isList
+    isPath
+    isString
+    last
+    length
+    mapAttrs
+    mapAttrsToList
+    optionals
+    recursiveUpdate
+    replaceStrings
+    reverseList
+    splitString
+    tail
+    toList
+    ;
 
-  inherit (lib) isFunction;
-in
-
-rec {
+  inherit (lib.strings)
+    escapeNixIdentifier
+    floatToString
+    match
+    split
+    toJSON
+    typeOf
+    ;
 
   ## -- HELPER FUNCTIONS & DEFAULTS --
 
@@ -30,13 +73,13 @@ rec {
    * The builtin `toString` function has some strange defaults,
    * suitable for bash scripts but not much else.
    */
-  mkValueStringDefault = {}: v: with builtins;
+  mkValueStringDefault = {}: v:
     let err = t: v: abort
           ("generators.mkValueStringDefault: " +
            "${t} not supported: ${toPretty {} v}");
     in   if isInt      v then toString v
     # convert derivations to store paths
-    else if lib.isDerivation v then toString v
+    else if isDerivation v then toString v
     # we default to not quoting strings
     else if isString   v then v
     # isString returns "1", which is not a good default
@@ -53,7 +96,7 @@ rec {
     # Floats currently can't be converted to precise strings,
     # condition warning on nix version once this isn't a problem anymore
     # See https://github.com/NixOS/nix/pull/3480
-    else if isFloat    v then libStr.floatToString v
+    else if isFloat    v then floatToString v
     else err "this value is" (toString v);
 
 
@@ -69,7 +112,7 @@ rec {
   mkKeyValueDefault = {
     mkValueString ? mkValueStringDefault {}
   }: sep: k: v:
-    "${libStr.escape [sep] k}${sep}${mkValueString v}";
+    "${escape [sep] k}${sep}${mkValueString v}";
 
 
   ## -- FILE FORMAT GENERATORS --
@@ -86,9 +129,9 @@ rec {
   }:
   let mkLine = k: v: indent + mkKeyValue k v + "\n";
       mkLines = if listsAsDuplicateKeys
-        then k: v: map (mkLine k) (if lib.isList v then v else [v])
+        then k: v: map (mkLine k) (if isList v then v else [v])
         else k: v: [ (mkLine k v) ];
-  in attrs: libStr.concatStrings (lib.concatLists (libAttr.mapAttrsToList mkLines attrs));
+  in attrs: concatStrings (concatLists (mapAttrsToList mkLines attrs));
 
 
   /* Generate an INI-style config file from an
@@ -113,7 +156,7 @@ rec {
    */
   toINI = {
     # apply transformations (e.g. escapes) to section names
-    mkSectionName ? (name: libStr.escape [ "[" "]" ] name),
+    mkSectionName ? (name: escape [ "[" "]" ] name),
     # format a setting line from key and value
     mkKeyValue    ? mkKeyValueDefault {} "=",
     # allow lists as values for duplicate keys
@@ -122,8 +165,8 @@ rec {
     let
         # map function to string for each key val
         mapAttrsToStringsSep = sep: mapFn: attrs:
-          libStr.concatStringsSep sep
-            (libAttr.mapAttrsToList mapFn attrs);
+          concatStringsSep sep
+            (mapAttrsToList mapFn attrs);
         mkSection = sectName: sectValues: ''
           [${mkSectionName sectName}]
         '' + toKeyValue { inherit mkKeyValue listsAsDuplicateKeys; } sectValues;
@@ -164,7 +207,7 @@ rec {
    */
   toINIWithGlobalSection = {
     # apply transformations (e.g. escapes) to section names
-    mkSectionName ? (name: libStr.escape [ "[" "]" ] name),
+    mkSectionName ? (name: escape [ "[" "]" ] name),
     # format a setting line from key and value
     mkKeyValue    ? mkKeyValueDefault {} "=",
     # allow lists as values for duplicate keys
@@ -195,12 +238,11 @@ rec {
    *>   name = "edolstra"
    */
   toGitINI = attrs:
-    with builtins;
     let
       mkSectionName = name:
         let
-          containsQuote = libStr.hasInfix ''"'' name;
-          sections = libStr.splitString "." name;
+          containsQuote = hasInfix ''"'' name;
+          sections = splitString "." name;
           section = head sections;
           subsections = tail sections;
           subsection = concatStringsSep "." subsections;
@@ -220,19 +262,19 @@ rec {
       # generation for multiple ini values
       mkKeyValue = k: v:
         let mkKeyValue = mkKeyValueDefault { inherit mkValueString; } " = " k;
-        in concatStringsSep "\n" (map (kv: "\t" + mkKeyValue kv) (lib.toList v));
+        in concatStringsSep "\n" (map (kv: "\t" + mkKeyValue kv) (toList v));
 
       # converts { a.b.c = 5; } to { "a.b".c = 5; } for toINI
       gitFlattenAttrs = let
         recurse = path: value:
-          if isAttrs value && !lib.isDerivation value then
-            lib.mapAttrsToList (name: value: recurse ([ name ] ++ path) value) value
+          if isAttrs value && !isDerivation value then
+            mapAttrsToList (name: value: recurse ([ name ] ++ path) value) value
           else if length path > 1 then {
-            ${concatStringsSep "." (lib.reverseList (tail path))}.${head path} = value;
+            ${concatStringsSep "." (reverseList (tail path))}.${head path} = value;
           } else {
             ${head path} = value;
           };
-      in attrs: lib.foldl lib.recursiveUpdate { } (lib.flatten (recurse [ ] attrs));
+      in attrs: foldl recursiveUpdate { } (flatten (recurse [ ] attrs));
 
       toINI_ = toINI { inherit mkKeyValue mkSectionName; };
     in
@@ -240,25 +282,12 @@ rec {
 
   # mkKeyValueDefault wrapper that handles dconf INI quirks.
   # The main differences of the format is that it requires strings to be quoted.
-  mkDconfKeyValue = mkKeyValueDefault { mkValueString = v: toString (lib.gvariant.mkValue v); } "=";
+  mkDconfKeyValue = mkKeyValueDefault { mkValueString = v: toString (gvariant.mkValue v); } "=";
 
   # Generates INI in dconf keyfile style. See https://help.gnome.org/admin/system-admin-guide/stable/dconf-keyfiles.html.en
   # for details.
   toDconfINI = toINI { mkKeyValue = mkDconfKeyValue; };
 
-  /* Generates JSON from an arbitrary (non-function) value.
-    * For more information see the documentation of the builtin.
-    */
-  toJSON = {}: builtins.toJSON;
-
-
-  /* YAML has been a strict superset of JSON since 1.2, so we
-    * use toJSON. Before it only had a few differences referring
-    * to implicit typing rules, so it should work with older
-    * parsers as well.
-    */
-  toYAML = toJSON;
-
   withRecursion =
     {
       /* If this option is not null, the given value will stop evaluating at a certain depth */
@@ -266,7 +295,7 @@ rec {
       /* If this option is true, an error will be thrown, if a certain given depth is exceeded */
     , throwOnDepthLimit ? true
     }:
-      assert builtins.isInt depthLimit;
+      assert isInt depthLimit;
       let
         specialAttrs = [
           "__functor"
@@ -275,7 +304,7 @@ rec {
           "__pretty"
         ];
         stepIntoAttr = evalNext: name:
-          if builtins.elem name specialAttrs
+          if elem name specialAttrs
             then id
             else evalNext;
         transform = depth:
@@ -284,7 +313,7 @@ rec {
               then throw "Exceeded maximum eval-depth limit of ${toString depthLimit} while trying to evaluate with `generators.withRecursion'!"
               else const "<unevaluated>"
           else id;
-        mapAny = with builtins; depth: v:
+        mapAny = depth: v:
           let
             evalNext = x: mapAny (depth + 1) (transform (depth + 1) x);
           in
@@ -311,9 +340,8 @@ rec {
     indent ? ""
   }:
     let
-    go = indent: v: with builtins;
-    let     isPath   = v: typeOf v == "path";
-            introSpace = if multiline then "\n${indent}  " else " ";
+    go = indent: v:
+    let     introSpace = if multiline then "\n${indent}  " else " ";
             outroSpace = if multiline then "\n${indent}" else " ";
     in if   isInt      v then toString v
     # toString loses precision on floats, so we use toJSON instead. This isn't perfect
@@ -322,16 +350,16 @@ rec {
     else if isFloat    v then builtins.toJSON v
     else if isString   v then
       let
-        lines = filter (v: ! isList v) (builtins.split "\n" v);
-        escapeSingleline = libStr.escape [ "\\" "\"" "\${" ];
-        escapeMultiline = libStr.replaceStrings [ "\${" "''" ] [ "''\${" "'''" ];
+        lines = filter (v: ! isList v) (split "\n" v);
+        escapeSingleline = escape [ "\\" "\"" "\${" ];
+        escapeMultiline = replaceStrings [ "\${" "''" ] [ "''\${" "'''" ];
         singlelineResult = "\"" + concatStringsSep "\\n" (map escapeSingleline lines) + "\"";
         multilineResult = let
           escapedLines = map escapeMultiline lines;
           # The last line gets a special treatment: if it's empty, '' is on its own line at the "outer"
           # indentation level. Otherwise, '' is appended to the last line.
-          lastLine = lib.last escapedLines;
-        in "''" + introSpace + concatStringsSep introSpace (lib.init escapedLines)
+          lastLine = last escapedLines;
+        in "''" + introSpace + concatStringsSep introSpace (init escapedLines)
                 + (if lastLine == "" then outroSpace else introSpace + lastLine) + "''";
       in
         if multiline && length lines > 1 then multilineResult else singlelineResult
@@ -342,11 +370,11 @@ rec {
     else if isList     v then
       if v == [] then "[ ]"
       else "[" + introSpace
-        + libStr.concatMapStringsSep introSpace (go (indent + "  ")) v
+        + concatMapStringsSep introSpace (go (indent + "  ")) v
         + outroSpace + "]"
     else if isFunction v then
-      let fna = lib.functionArgs v;
-          showFnas = concatStringsSep ", " (libAttr.mapAttrsToList
+      let fna = functionArgs v;
+          showFnas = concatStringsSep ", " (mapAttrsToList
                        (name: hasDefVal: if hasDefVal then name + "?" else name)
                        fna);
       in if fna == {}    then "<function>"
@@ -359,10 +387,10 @@ rec {
       else if v ? type && v.type == "derivation" then
         "<derivation ${v.name or "???"}>"
       else "{" + introSpace
-          + libStr.concatStringsSep introSpace (libAttr.mapAttrsToList
+          + concatStringsSep introSpace (mapAttrsToList
               (name: value:
-                "${libStr.escapeNixIdentifier name} = ${
-                  builtins.addErrorContext "while evaluating an attribute `${name}`"
+                "${escapeNixIdentifier name} = ${
+                  addErrorContext "while evaluating an attribute `${name}`"
                     (go (indent + "  ") value)
                 };") v)
         + outroSpace + "}"
@@ -371,9 +399,7 @@ rec {
 
   # PLIST handling
   toPlist = {}: v: let
-    isFloat = builtins.isFloat or (x: false);
-    isPath = x: builtins.typeOf x == "path";
-    expr = ind: x:  with builtins;
+    expr = ind: x:
       if x == null  then "" else
       if isBool x   then bool ind x else
       if isInt x    then int ind x else
@@ -394,23 +420,23 @@ rec {
 
     indent = ind: expr "\t${ind}";
 
-    item = ind: libStr.concatMapStringsSep "\n" (indent ind);
+    item = ind: concatMapStringsSep "\n" (indent ind);
 
-    list = ind: x: libStr.concatStringsSep "\n" [
+    list = ind: x: concatStringsSep "\n" [
       (literal ind "<array>")
       (item ind x)
       (literal ind "</array>")
     ];
 
-    attrs = ind: x: libStr.concatStringsSep "\n" [
+    attrs = ind: x: concatStringsSep "\n" [
       (literal ind "<dict>")
       (attr ind x)
       (literal ind "</dict>")
     ];
 
     attr = let attrFilter = name: value: name != "_module" && value != null;
-    in ind: x: libStr.concatStringsSep "\n" (lib.flatten (lib.mapAttrsToList
-      (name: value: lib.optionals (attrFilter name value) [
+    in ind: x: concatStringsSep "\n" (flatten (mapAttrsToList
+      (name: value: optionals (attrFilter name value) [
       (key "\t${ind}" name)
       (expr "\t${ind}" value)
     ]) x));
@@ -426,11 +452,10 @@ ${expr "" v}
    * the Natural type.
   */
   toDhall = { }@args: v:
-    with builtins;
-    let concatItems = lib.strings.concatStringsSep ", ";
+    let concatItems = concatStringsSep ", ";
     in if isAttrs v then
       "{ ${
-        concatItems (lib.attrsets.mapAttrsToList
+        concatItems (mapAttrsToList
           (key: value: "${key} = ${toDhall args value}") v)
       } }"
     else if isList v then
@@ -444,7 +469,7 @@ ${expr "" v}
     else if v == null then
       abort "generators.toDhall: cannot convert a null to Dhall"
     else
-      builtins.toJSON v;
+      toJSON v;
 
   /*
    Translate a simple Nix expression to Lua representation with occasional
@@ -488,7 +513,6 @@ ${expr "" v}
     /* Interpret as variable bindings */
     asBindings ? false,
   }@args: v:
-    with builtins;
     let
       innerIndent = "${indent}  ";
       introSpace = if multiline then "\n${innerIndent}" else " ";
@@ -501,9 +525,9 @@ ${expr "" v}
       isLuaInline = { _type ? null, ... }: _type == "lua-inline";
 
       generatedBindings =
-          assert lib.assertMsg (badVarNames == []) "Bad Lua var names: ${toPretty {} badVarNames}";
-          libStr.concatStrings (
-            lib.attrsets.mapAttrsToList (key: value: "${indent}${key} = ${toLua innerArgs value}\n") v
+          assert assertMsg (badVarNames == []) "Bad Lua var names: ${toPretty {} badVarNames}";
+          concatStrings (
+            mapAttrsToList (key: value: "${indent}${key} = ${toLua innerArgs value}\n") v
             );
 
       # https://en.wikibooks.org/wiki/Lua_Programming/variable#Variable_names
@@ -515,7 +539,7 @@ ${expr "" v}
     else if v == null then
       "nil"
     else if isInt v || isFloat v || isString v || isBool v then
-      builtins.toJSON v
+      toJSON v
     else if isList v then
       (if v == [ ] then "{}" else
       "{${introSpace}${concatItems (map (value: "${toLua innerArgs value}") v)}${outroSpace}}")
@@ -525,11 +549,11 @@ ${expr "" v}
           "(${v.expr})"
         else if v == { } then
           "{}"
-        else if libAttr.isDerivation v then
+        else if isDerivation v then
           ''"${toString v}"''
         else
           "{${introSpace}${concatItems (
-            lib.attrsets.mapAttrsToList (key: value: "[${builtins.toJSON key}] = ${toLua innerArgs value}") v
+            mapAttrsToList (key: value: "[${toJSON key}] = ${toLua innerArgs value}") v
             )}${outroSpace}}"
       )
     else
@@ -542,4 +566,37 @@ ${expr "" v}
      mkLuaInline :: String -> AttrSet
   */
   mkLuaInline = expr: { _type = "lua-inline"; inherit expr; };
+
+in
+
+# Everything in this attrset is the public interface of the file.
+{
+  inherit
+    mkDconfKeyValue
+    mkKeyValueDefault
+    mkLuaInline
+    mkValueStringDefault
+    toDconfINI
+    toDhall
+    toGitINI
+    toINI
+    toINIWithGlobalSection
+    toKeyValue
+    toLua
+    toPlist
+    toPretty
+    withRecursion
+    ;
+
+  /* Generates JSON from an arbitrary (non-function) value.
+    * For more information see the documentation of the builtin.
+    */
+  toJSON = {}: toJSON;
+
+  /* YAML has been a strict superset of JSON since 1.2, so we
+    * use toJSON. Before it only had a few differences referring
+    * to implicit typing rules, so it should work with older
+    * parsers as well.
+    */
+  toYAML = {}: toJSON;
 }

lib/tests/misc.nix

@@ -13,9 +13,96 @@ Alternatively, to run all `lib` tests:
 
   [nixpkgs]$ nix-build lib/tests/release.nix
 */
-with import ../default.nix;
 
 let
+  lib = import ../default.nix;
+
+  inherit (lib)
+    allUnique
+    and
+    attrNames
+    attrsets
+    attrsToList
+    bitAnd
+    bitOr
+    bitXor
+    boolToString
+    callPackagesWith
+    callPackageWith
+    cartesianProductOfSets
+    cli
+    composeExtensions
+    composeManyExtensions
+    concatLines
+    concatMapAttrs
+    concatMapStrings
+    concatStrings
+    concatStringsSep
+    const
+    escapeXML
+    evalModules
+    filter
+    fix
+    fold
+    foldAttrs
+    foldl
+    foldl'
+    foldlAttrs
+    foldr
+    functionArgs
+    generators
+    genList
+    getExe
+    getExe'
+    groupBy
+    groupBy'
+    hasAttrByPath
+    hasInfix
+    id
+    isStorePath
+    lazyDerivation
+    lists
+    listToAttrs
+    makeExtensible
+    makeOverridable
+    mapAttrs
+    matchAttrs
+    mergeAttrs
+    meta
+    mkOption
+    mod
+    nameValuePair
+    optionalDrvAttr
+    optionAttrSetToDocList
+    overrideExisting
+    packagesFromDirectoryRecursive
+    pipe
+    range
+    recursiveUpdateUntil
+    removePrefix
+    replicate
+    runTests
+    setFunctionArgs
+    showAttrPath
+    sort
+    sortOn
+    stringLength
+    strings
+    stringToCharacters
+    systems
+    tail
+    take
+    testAllTrue
+    toBaseDigits
+    toHexString
+    toInt
+    toIntBase10
+    toShellVars
+    types
+    updateManyAttrsByPath
+    versions
+    ;
+
   testingThrow = expr: {
     expr = (builtins.tryEval (builtins.seq expr "didn't throw"));
     expected = { success = false; value = false; };

nixos/modules/services/desktops/pipewire/wireplumber.nix

@@ -56,24 +56,28 @@ in
 
   config =
     let
-      pwNotForAudioConfigPkg = pkgs.writeTextDir "share/wireplumber/main.lua.d/80-pw-not-for-audio.lua" ''
-        -- PipeWire is not used for audio, so prevent it from grabbing audio devices
-        alsa_monitor.enable = function() end
+      pwNotForAudioConfigPkg = pkgs.writeTextDir "share/wireplumber/wireplumber.conf.d/90-nixos-no-audio.conf" ''
+        # PipeWire is not used for audio, so WirePlumber should not be handling it
+        wireplumber.profiles = {
+          main = {
+            hardware.audio = disabled
+            hardware.bluetooth = disabled
+          }
+        }
       '';
-      systemwideConfigPkg = pkgs.writeTextDir "share/wireplumber/main.lua.d/80-systemwide.lua" ''
-        -- When running system-wide, these settings need to be disabled (they
-        -- use functions that aren't available on the system dbus).
-        alsa_monitor.properties["alsa.reserve"] = false
-        default_access.properties["enable-flatpak-portal"] = false
-      '';
-      systemwideBluetoothConfigPkg = pkgs.writeTextDir "share/wireplumber/bluetooth.lua.d/80-systemwide.lua" ''
-        -- When running system-wide, logind-integration needs to be disabled.
-        bluez_monitor.properties["with-logind"] = false
+
+      systemwideConfigPkg = pkgs.writeTextDir "share/wireplumber/wireplumber.conf.d/90-nixos-systemwide.conf" ''
+        # When running system-wide, we don't have logind to call ReserveDevice
+        wireplumber.profiles = {
+          main = {
+            support.reserve-device = disabled
+          }
+        }
       '';
 
       configPackages = cfg.configPackages
           ++ lib.optional (!pwUsedForAudio) pwNotForAudioConfigPkg
-          ++ lib.optionals config.services.pipewire.systemWide [ systemwideConfigPkg systemwideBluetoothConfigPkg ];
+          ++ lib.optional config.services.pipewire.systemWide systemwideConfigPkg;
 
       configs = pkgs.buildEnv {
         name = "wireplumber-configs";

nixos/modules/services/monitoring/scrutiny.nix

@@ -195,6 +195,8 @@ in
       systemd = {
         services.scrutiny-collector = {
           description = "Scrutiny Collector Service";
+          after = lib.optional cfg.enable "scrutiny.service";
+          wants = lib.optional cfg.enable "scrutiny.service";
           environment = {
             COLLECTOR_VERSION = "1";
             COLLECTOR_API_ENDPOINT = cfg.collector.settings.api.endpoint;

nixos/modules/services/web-apps/engelsystem.nix

@@ -3,8 +3,6 @@
 let
   inherit (lib) mkDefault mkEnableOption mkIf mkOption types mkPackageOption;
   cfg = config.services.engelsystem;
-  phpExt = pkgs.php.withExtensions
-    ({ enabled, all }: with all; [ filter mysqlnd mysqli pdo pdo_mysql mbstring ] ++ enabled);
 in {
   options = {
     services.engelsystem = {
@@ -101,7 +99,6 @@ in {
       '';
 
     services.phpfpm.pools.engelsystem = {
-      phpPackage = phpExt;
       user = "engelsystem";
       settings = {
         "listen.owner" = config.services.nginx.user;

nixos/modules/system/boot/systemd/initrd.nix

@@ -518,7 +518,7 @@ in {
               case $o in
                   init=*)
                       IFS== read -r -a initParam <<< "$o"
-                      closure="$(dirname "''${initParam[1]}")"
+                      closure="''${initParam[1]}"
                       ;;
               esac
           done
@@ -529,6 +529,13 @@ in {
             exit 1
           fi
 
+          # Resolve symlinks in the init parameter. We need this for some boot loaders
+          # (e.g. boot.loader.generationsDir).
+          closure="$(chroot /sysroot ${pkgs.coreutils}/bin/realpath "$closure")"
+
+          # Assume the directory containing the init script is the closure.
+          closure="$(dirname "$closure")"
+
           # If we are not booting a NixOS closure (e.g. init=/bin/sh),
           # we don't know what root to prepare so we don't do anything
           if ! [ -x "/sysroot$(readlink "/sysroot$closure/prepare-root" || echo "$closure/prepare-root")" ]; then

nixos/modules/system/boot/timesyncd.nix

@@ -21,6 +21,9 @@ with lib;
         type = types.listOf types.str;
         description = lib.mdDoc ''
           The set of NTP servers from which to synchronise.
+          Note if this is set to an empty list, the defaults systemd itself is
+          compiled with ({0..4}.nixos.pool.ntp.org) apply,
+          In case you want to disable timesyncd altogether, use the `enable` option.
         '';
       };
       extraConfig = mkOption {

pkgs/applications/editors/vim/plugins/overrides.nix

@@ -668,6 +668,10 @@
     dependencies = with self; [ guard-collection ];
   };
 
+  hardhat-nvim = super.hardhat-nvim.overrideAttrs {
+    dependencies = with self; [ plenary-nvim ];
+  };
+
   harpoon = super.harpoon.overrideAttrs {
     dependencies = with self; [ plenary-nvim ];
   };
@@ -947,6 +951,10 @@
     dependencies = with self; [ plenary-nvim ];
   };
 
+  neotest-gradle = super.neotest-gradle.overrideAttrs {
+    dependencies = with self; [ plenary-nvim ];
+  };
+
   neo-tree-nvim = super.neo-tree-nvim.overrideAttrs {
     dependencies = with self; [ plenary-nvim nui-nvim ];
   };

pkgs/applications/emulators/cdemu/vhba.nix

@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "vhba";
-  version = "20211218";
+  version = "20240202";
 
   src  = fetchurl {
     url = "mirror://sourceforge/cdemu/vhba-module-${version}.tar.xz";
-    sha256 = "sha256-csWowcRSgF5M74yv787MLSXOGXrkxnODCCgC5a3Nd7Y=";
+    sha256 = "sha256-v1hQ1Lj1AiHKh9c0OpKe2oexkfb1roxhQXRUO1ut3oM=";
   };
 
   makeFlags = kernel.makeFlags ++ [ "KDIR=${kernel.dev}/lib/modules/${kernel.modDirVersion}/build" "INSTALL_MOD_PATH=$(out)" ];

pkgs/applications/misc/copyq/default.nix

@@ -1,7 +1,6 @@
 { lib
 , stdenv
 , fetchFromGitHub
-, fetchpatch2
 , cmake
 , ninja
 , extra-cmake-modules
@@ -14,32 +13,24 @@
 , qtwayland
 , wayland
 , wrapQtAppsHook
+, kdePackages
 }:
 
 stdenv.mkDerivation rec {
   pname = "CopyQ";
-  version = "7.1.0";
+  version = "8.0.0";
 
   src = fetchFromGitHub {
     owner = "hluk";
     repo = "CopyQ";
     rev = "v${version}";
-    hash = "sha256-aAmpFKIIFZLPWUaOcf4V1d/wVQ7xRcnXFsqFjROsabg=";
+    hash = "sha256-Ewunl4k9f0aDjilhKAsVxwR3S6uSZ1xwtu6ccNsNOgk=";
   };
 
-  patches = [
-    # itemfakevim: fix build with qt 6.6.0
-    # https://github.com/hluk/CopyQ/pull/2508
-    (fetchpatch2 {
-      url = "https://github.com/hluk/CopyQ/commit/a20bfff0d78296b334ff8cabb047ab5d842b7311.patch";
-      hash = "sha256-F/6cQ8+O1Ttd4EFFxQas5ES6U+qxWdmYqUWRQLsVMa4=";
-    })
-  ];
-
   nativeBuildInputs = [
     cmake
     ninja
-    extra-cmake-modules
+    kdePackages.extra-cmake-modules
     wrapQtAppsHook
   ];
 
@@ -52,6 +43,9 @@ stdenv.mkDerivation rec {
     libXtst
     qtwayland
     wayland
+    kdePackages.kconfig
+    kdePackages.kstatusnotifieritem
+    kdePackages.knotifications
   ];
 
   postPatch = ''

pkgs/applications/misc/corectrl/default.nix

@@ -9,6 +9,8 @@
 , glxinfo
 , polkit
 , procps
+, pugixml
+, spdlog
 , util-linux
 , vulkan-tools
 , qtbase
@@ -23,13 +25,13 @@
 
 stdenv.mkDerivation rec{
   pname = "corectrl";
-  version = "1.3.11";
+  version = "1.4.0";
 
   src = fetchFromGitLab {
     owner = "corectrl";
     repo = "corectrl";
     rev = "v${version}";
-    sha256 = "sha256-yca9qzYJlOQak6IMNewgUe+KSUUypj/lLUGGw6R90Ws=";
+    sha256 = "sha256-zTH7iSPN7VIhXvWFndOulvGnfUZ+uGWnW53WcnSW+e4=";
   };
   patches = [
     ./polkit-dir.patch
@@ -47,6 +49,8 @@ stdenv.mkDerivation rec{
     glxinfo
     polkit
     procps
+    pugixml
+    spdlog
     util-linux
     vulkan-tools
     qtbase

pkgs/applications/video/qmplay2/default.nix

@@ -26,14 +26,14 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "qmplay2";
-  version = "23.10.22";
+  version = "24.03.16";
 
   src = fetchFromGitHub {
     owner = "zaps166";
     repo = "QMPlay2";
     rev = finalAttrs.version;
     fetchSubmodules = true;
-    hash = "sha256-yDymUXuILgT4AFTt302GniPi/WNwrTCOuOfdUiKOIyk=";
+    hash = "sha256-yIBQBRdmaY7qaBirANxMqfm5vn3T4usokJUxwSYUHjQ=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/au/audiobookshelf/source.json

@@ -1,9 +1,9 @@
 {
   "owner": "advplyr",
   "repo": "audiobookshelf",
-  "rev": "85fecbd1b9fc424d8bfd1b63cbae45b8b23a7d34",
-  "hash": "sha256-GWaaoVa1UJptbYAZ99LbrzfKEksSqK0GSsl3Vh2xKKs=",
-  "version": "2.8.0",
-  "depsHash": "sha256-vznd+ZKn0nx0Q7/lsMfWRUZUsK2LtxQor/3C4fQc0Ss=",
-  "clientDepsHash": "sha256-oqINZO4v5WeRRiLQnnChrnK8VeIzLg1MRhG/gEjkv58="
+  "rev": "166454ef43e3cdb42c644cdccdacddd3a880cd89",
+  "hash": "sha256-QrGzlSGK7WDlRemS13CmHdg563HFv9QhOpCF+XRxXsg=",
+  "version": "2.8.1",
+  "depsHash": "sha256-CzlwpgSgsQZGuRWTA/IkCyaryCSurH74WR5Rhm5faEk=",
+  "clientDepsHash": "sha256-s7/Rlj3DrYjUkxAN82bTpWe+D4HdVOc1mrqKgqcJuI4="
 }

pkgs/by-name/ip/iplan/package.nix

@@ -0,0 +1,55 @@
+{ lib
+, stdenv
+, fetchFromGitHub
+, cargo
+, meson
+, ninja
+, pkg-config
+, rustPlatform
+, rustc
+, wrapGAppsHook4
+, desktop-file-utils
+, libadwaita
+}:
+
+stdenv.mkDerivation rec {
+  pname = "iplan";
+  version = "1.9.2";
+
+  src = fetchFromGitHub {
+    owner = "iman-salmani";
+    repo = "iplan";
+    rev = "v${version}";
+    hash = "sha256-BIoxaE8c3HmvPjgj4wcZK9YFTZ0wr9338AIdYEoAiqs=";
+  };
+
+  cargoDeps = rustPlatform.fetchCargoTarball {
+    inherit src;
+    name = "${pname}-${version}";
+    hash = "sha256-p8ETWWvjtP9f/lc347ORPqTai5p/TWQCCMRe+c0FyFk=";
+  };
+
+  nativeBuildInputs = [
+    cargo
+    meson
+    ninja
+    pkg-config
+    rustPlatform.cargoSetupHook
+    rustc
+    wrapGAppsHook4
+    desktop-file-utils
+  ];
+
+  buildInputs = [
+    libadwaita
+  ];
+
+  meta = with lib; {
+    description = "Your plan for improving personal life and workflow";
+    homepage = "https://github.com/iman-salmani/iplan";
+    license = licenses.gpl3Plus;
+    mainProgram = "iplan";
+    maintainers = with maintainers; [ aleksana ];
+    platforms = platforms.linux;
+  };
+}

pkgs/by-name/le/lefthook/package.nix

@@ -6,7 +6,7 @@
 
 let
   pname = "lefthook";
-  version = "1.6.6";
+  version = "1.6.7";
 in
 buildGoModule {
   inherit pname version;
@@ -15,7 +15,7 @@ buildGoModule {
     owner = "evilmartians";
     repo = "lefthook";
     rev = "v${version}";
-    hash = "sha256-upt6N6t2ogCaRrHwvw/grTbhr0QXVQCtxMd34XmK030=";
+    hash = "sha256-4nbAT4g5tnq0bL7i9PsUKbSGoeaWHdApARYE4oWuwNk=";
   };
 
   vendorHash = "sha256-b+1Y75CG4ayDmnhYfPwpzMFrHCPmZ0FMbMsLiToac5c=";

pkgs/by-name/ll/llama-cpp/package.nix

@@ -69,13 +69,13 @@ let
 in
 effectiveStdenv.mkDerivation (finalAttrs: {
   pname = "llama-cpp";
-  version = "2424";
+  version = "2454";
 
   src = fetchFromGitHub {
     owner = "ggerganov";
     repo = "llama.cpp";
     rev = "refs/tags/b${finalAttrs.version}";
-    hash = "sha256-nzO6qL7X8PwGgy3fZAwQHoPBWLXorWf9kBeEWZCm1ZM=";
+    hash = "sha256-eZvApj2yLFCbS/TWaHeXJIVQ4PXbPlrxxu/eiov2T8k=";
   };
 
   postPatch = ''

pkgs/by-name/my/mystmd/package.nix

@@ -2,16 +2,16 @@
 
 buildNpmPackage rec {
   pname = "mystmd";
-  version = "1.1.46";
+  version = "1.1.47";
 
   src = fetchFromGitHub {
     owner = "executablebooks";
     repo = "mystmd";
     rev = "mystmd@${version}";
-    hash = "sha256-rMmq2xArkbVIZRFGCYSl9D65LxUdyiZMR6CbYJbKNSw=";
+    hash = "sha256-gF3IGkdMM4pbtHOVnhk35nxPBLqUSc/IzrXvg+duQa4=";
   };
 
-  npmDepsHash = "sha256-cwuKexK0S3pW0rJpjfbAHu7/MLSs8axbyX6BWJq2Ieo=";
+  npmDepsHash = "sha256-63QS+vnIwkdMES2UrWvHeytWp5NuEf5uKpHA0m1XTHU=";
 
   dontNpmInstall = true;
 

pkgs/by-name/wa/warp-terminal/update.sh

@@ -1,5 +1,5 @@
 #!/usr/bin/env nix-shell
-#!nix-shell -i bash -p curl jq moreutils nix-prefetch
+#!nix-shell -i bash -p cacert curl jq nix moreutils --pure
 #shellcheck shell=bash
 set -eu -o pipefail
 
@@ -7,6 +7,7 @@ dirname="$(dirname "$0")"
 
 err() {
     echo "$*" >&2
+    exit 1
 }
 
 json_get() {
@@ -31,7 +32,6 @@ resolve_url() {
             ;;
         *)
             err "Unexpected download type: $1"
-            exit 1
             ;;
     esac
     url="https://app.warp.dev/download?package=${pkg}"
@@ -40,7 +40,7 @@ resolve_url() {
         url=$(curl -s -o /dev/null -w '%{redirect_url}' "${url}")
         [[ ${url} != *.${sfx} ]] || break
     done
-    ((i < max_redirects)) || { err "too many redirects"; exit 1; }
+    ((i < max_redirects)) || { err "too many redirects"; }
     echo "${url}"
 }
 
@@ -48,13 +48,27 @@ get_version() {
     echo "$1" | grep -oP -m 1 '(?<=/v)[\d.\w]+(?=/)'
 }
 
+# nix-prefect-url seems to be uncompressing the archive then taking the hash
+# so just get the hash from fetchurl
+sri_get() {
+    local ouput sri
+    output=$(nix-build  --expr \
+        'with import <nixpkgs>{};
+         fetchurl {
+           url = "'"$1"'";
+         }' 2>&1 || true)
+    sri=$(echo "$output" | awk '/^\s+got:\s+/{ print $2 }')
+    [[ -z "$sri" ]] && err "$output"
+    echo "$sri"
+}
+
+
 for sys in darwin linux; do
     url=$(resolve_url ${sys})
     version=$(get_version "${url}")
-    if [[ ${version} != "$(json_get ".${sys}.version")" ]];
-        then
-            sri=$(nix hash to-sri --type sha256 "$(nix-prefetch-url --type sha256 "${url}")")
-            json_set ".${sys}.version" "${version}"
-            json_set ".${sys}.hash" "${sri}"
+    if [[ ${version} != "$(json_get ".${sys}.version")" ]]; then
+        sri=$(sri_get "${url}")
+        json_set ".${sys}.version" "${version}"
+        json_set ".${sys}.hash" "${sri}"
     fi
 done

pkgs/data/themes/catppuccin/default.nix

@@ -1,5 +1,5 @@
 let
-  validThemes = [ "bat" "bottom" "btop" "grub" "hyprland" "k9s" "kvantum" "lazygit" "plymouth" "qt5ct" "refind" "rofi" "starship" "waybar" ];
+  validThemes = [ "bat" "bottom" "btop" "grub" "hyprland" "k9s" "kvantum" "lazygit" "plymouth" "qt5ct" "refind" "rofi" "starship" "thunderbird" "waybar" ];
 in
 { fetchFromGitHub
 , lib
@@ -20,8 +20,8 @@ let
       name = "bat";
       owner = "catppuccin";
       repo = "bat";
-      rev = "ba4d16880d63e656acced2b7d4e034e4a93f74b1";
-      hash = "sha256-6WVKQErGdaqb++oaXnY3i6/GuH2FhTgK0v4TN4Y0Wbw=";
+      rev = "2bafe4454d8db28491e9087ff3a1382c336e7d27";
+      hash = "sha256-yHt3oIjUnljARaihalcWSNldtaJfVDfmfiecYfbzGs0=";
     };
 
     bottom = fetchFromGitHub {
@@ -60,8 +60,8 @@ let
       name = "k9s";
       owner = "catppuccin";
       repo = "k9s";
-      rev = "516f44dd1a6680357cb30d96f7e656b653aa5059";
-      hash = "sha256-PtBJRBNbLkj7D2ko7ebpEjbfK9Ywjs7zbE+Y8FQVEfA=";
+      rev = "590a762110ad4b6ceff274265f2fe174c576ce96";
+      hash = "sha256-EBDciL3F6xVFXvND+5duT+OiVDWKkFMWbOOSruQ0lus=";
     };
 
     kvantum = fetchFromGitHub {
@@ -76,16 +76,16 @@ let
       name = "lazygit";
       owner = "catppuccin";
       repo = "lazygit";
-      rev = "0543c28e8af1a935f8c512ad9451facbcc17d8a8";
-      hash = "sha256-OVihY5E+elPKag2H4RyWiSv+MdIqHtfGNM3/1u2ik6U=";
+      rev = "v2.0.0";
+      hash = "sha256-gM0HplHhcpvtpmIVdlX/p59h0v+ihKEidS1imqPYlBg=";
     };
 
     plymouth = fetchFromGitHub {
       name = "plymouth";
       owner = "catppuccin";
       repo = "plymouth";
-      rev = "d4105cf336599653783c34c4a2d6ca8c93f9281c";
-      hash = "sha256-quBSH8hx3gD7y1JNWAKQdTk3CmO4t1kVo4cOGbeWlNE=";
+      rev = "67759fbe15eb9490d096ef8014d9f92fc5748fe7";
+      hash = "sha256-IzoyVOi44Uay7DTfzR9RdRLSjORsdBM4pPrgeXk5YMI=";
     };
 
     qt5ct = fetchFromGitHub {
@@ -120,6 +120,14 @@ let
       hash = "sha256-nsRuxQFKbQkyEI4TXgvAjcroVdG+heKX5Pauq/4Ota0=";
     };
 
+    thunderbird = fetchFromGitHub {
+      name = "thunderbird";
+      owner = "catppuccin";
+      repo = "thunderbird";
+      rev = "d61882ad9fd35909a75da6bb95fca38db552135c";
+      hash = "sha256-wn8//8lHScbbB1nEiDY8DphnLUMKZBFMc1GPaTRjTOY=";
+    };
+
     waybar = fetchFromGitHub {
       name = "waybar";
       owner = "catppuccin";
@@ -135,7 +143,7 @@ lib.checkListOfEnum "${pname}: themes" validThemes themeList
 
 stdenvNoCC.mkDerivation {
   inherit pname;
-  version = "unstable-2023-10-09";
+  version = "unstable-2024-03-12";
 
   srcs = selectedSources;
 
@@ -154,7 +162,7 @@ stdenvNoCC.mkDerivation {
 
   '' + lib.optionalString (lib.elem "bat" themeList) ''
     mkdir -p $out/bat
-    cp "${sources.bat}/Catppuccin-${variant}.tmTheme" "$out/bat/"
+    cp "${sources.bat}/themes/Catppuccin "$capitalizedVariant".tmTheme" "$out/bat/"
 
   '' + lib.optionalString (lib.elem "btop" themeList) ''
     mkdir -p $out/btop
@@ -174,7 +182,8 @@ stdenvNoCC.mkDerivation {
 
   '' + lib.optionalString (lib.elem "k9s" themeList) ''
     mkdir -p $out/k9s
-    cp "${sources.k9s}/dist/${variant}.yml" "$out/k9s/"
+    cp "${sources.k9s}/dist/catppuccin-${variant}.yaml" "$out/k9s/"
+    cp "${sources.k9s}/dist/catppuccin-${variant}-transparent.yaml" "$out/k9s/"
 
   '' + lib.optionalString (lib.elem "kvantum" themeList) ''
     mkdir -p $out/share/Kvantum
@@ -182,8 +191,8 @@ stdenvNoCC.mkDerivation {
 
   '' + lib.optionalString (lib.elem "lazygit" themeList) ''
     mkdir -p $out/lazygit/{themes,themes-mergable}
-    cp "${sources.lazygit}/themes/${variant}/${variant}-${accent}.yml" "$out/lazygit/themes/"
-    cp "${sources.lazygit}/themes-mergable/${variant}/${variant}-${accent}.yml" "$out/lazygit/themes-mergable/"
+    cp "${sources.lazygit}/themes/${variant}/${accent}.yml" "$out/lazygit/themes/"
+    cp "${sources.lazygit}/themes-mergable/${variant}/${accent}.yml" "$out/lazygit/themes-mergable/"
 
   '' + lib.optionalString (lib.elem "plymouth" themeList) ''
     mkdir -p $out/share/plymouth/themes/catppuccin-${variant}
@@ -207,6 +216,10 @@ stdenvNoCC.mkDerivation {
     mkdir -p $out/starship
     cp ${sources.starship}/palettes/${variant}.toml $out/starship/
 
+  '' + lib.optionalString (lib.elem "thunderbird" themeList) ''
+    mkdir -p $out/thunderbird
+    cp ${sources.thunderbird}/themes/${variant}/${variant}-${accent}.xpi $out/thunderbird/
+
   '' + lib.optionalString (lib.elem "waybar" themeList) ''
     mkdir -p $out/waybar
     cp ${sources.waybar}/${variant}.css $out/waybar/

pkgs/development/libraries/ngtcp2/gnutls.nix

@@ -6,13 +6,13 @@
 
 stdenv.mkDerivation rec {
   pname = "ngtcp2";
-  version = "1.3.0";
+  version = "1.4.0";
 
   src = fetchFromGitHub {
     owner = "ngtcp2";
     repo = "ngtcp2";
     rev = "v${version}";
-    hash = "sha256-KKfr5AjaC56yUNdk928H1PyP79GnQJ2pIZcZQTgLhEQ=";
+    hash = "sha256-C1Rk0KzTvFpwCz8vXvhSqGjYmGyLZxmnzZhPLZiL97M=";
   };
 
   outputs = [ "out" "dev" ];

pkgs/development/libraries/pipewire/wireplumber.nix

@@ -24,7 +24,7 @@
 
 stdenv.mkDerivation rec {
   pname = "wireplumber";
-  version = "0.4.17";
+  version = "0.5.0";
 
   outputs = [ "out" "dev" ] ++ lib.optional enableDocs "doc";
 
@@ -33,7 +33,7 @@ stdenv.mkDerivation rec {
     owner = "pipewire";
     repo = "wireplumber";
     rev = version;
-    hash = "sha256-vhpQT67+849WV1SFthQdUeFnYe/okudTQJoL3y+wXwI=";
+    hash = "sha256-zcYZvyGsGuiwuL9nOD5mW6RFwa9cPB9HvoQqdw2jlmY=";
   };
 
   nativeBuildInputs = [

pkgs/development/python-modules/aioapns/default.nix

@@ -10,14 +10,14 @@
 
 buildPythonPackage rec {
   pname = "aioapns";
-  version = "3.1";
+  version = "3.2";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-BUSRIDAxeVKlZteYgGZZkMcUn6hAo1fWCbuZcHZXUhU=";
+    hash = "sha256-QPayQogW97saMmaPUP5x0CiXd6Qptg/OROigi5ASNQg=";
   };
 
   nativeBuildInputs = [

pkgs/development/python-modules/azure-mgmt-compute/default.nix

@@ -10,14 +10,14 @@
 
 buildPythonPackage rec {
   pname = "azure-mgmt-compute";
-  version = "30.5.0";
+  version = "30.6.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-7T6jS3mdsNUu5V4vGrSw8J+koI814GHsuarZ+1ohiEQ=";
+    hash = "sha256-TYDXI+xtTLlYNhfr7AcW59dLJzKsuu0CPtLjzHBT0A4=";
   };
 
   propagatedBuildInputs = [

pkgs/development/python-modules/diffusers/default.nix

@@ -39,7 +39,7 @@
 
 buildPythonPackage rec {
   pname = "diffusers";
-  version = "0.26.3";
+  version = "0.27.0";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -48,7 +48,7 @@ buildPythonPackage rec {
     owner = "huggingface";
     repo = "diffusers";
     rev = "refs/tags/v${version}";
-    hash = "sha256-1pIe1OU+vIrHM6KIZtHRMXklBZrugDV+I/OBNQYqvXI=";
+    hash = "sha256-h7IdukvQr+B/Au70nK0Qc4FpkDiCMsIZuPAWsiCdnUo=";
   };
 
   nativeBuildInputs = [

pkgs/development/python-modules/editdistpy/default.nix

@@ -0,0 +1,45 @@
+{ lib
+, buildPythonPackage
+, fetchFromGitHub
+
+, pythonOlder
+
+, setuptools
+, cython_3
+}:
+
+buildPythonPackage rec {
+  pname = "editdistpy";
+  version = "0.1.3";
+  pyproject = true;
+
+  disabled = pythonOlder "3.6";
+
+  src = fetchFromGitHub {
+    owner = "mammothb";
+    repo = "editdistpy";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-4CtKadKpFmlZnz10NG0404oFl9DkdQwWwRSWgUPdh94=";
+  };
+
+  build-system = [
+    setuptools
+    cython_3
+  ];
+
+  # for tests need symspellpy package, symspellpy is not in nixpkgs...
+  doCheck = false;
+
+  pythonImportsCheck = [
+    "editdistpy"
+  ];
+
+  meta = with lib;
+    {
+      description = "Fast Levenshtein and Damerau optimal string alignment algorithms";
+      homepage = "https://github.com/mammothb/editdistpy";
+      changelog = "https://github.com/mammothb/editdistpy/releases/tag/v${version}";
+      license = licenses.mit;
+      maintainers = with maintainers; [ vizid ];
+    };
+}

pkgs/development/python-modules/google-cloud-bigquery/default.nix

@@ -28,14 +28,14 @@
 
 buildPythonPackage rec {
   pname = "google-cloud-bigquery";
-  version = "3.18.0";
+  version = "3.19.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-dPD8bwupR3+AjSWSTcigUsVffKkQZOg+FtPuX7fKd6s=";
+    hash = "sha256-jjEdrkl2jhUB/NxekWv/S34WlHHlcHkZ9Kb3igKztaY=";
   };
 
   propagatedBuildInputs = [

pkgs/development/python-modules/khanaa/default.nix

@@ -0,0 +1,46 @@
+{ lib
+, buildPythonPackage
+, fetchFromGitHub
+
+, pythonOlder
+
+, unittestCheckHook
+
+, setuptools
+}:
+
+buildPythonPackage rec {
+  pname = "khanaa";
+  version = "0.0.6";
+  pyproject = true;
+
+  disabled = pythonOlder "3.7";
+
+  src = fetchFromGitHub {
+    owner = "cakimpei";
+    repo = "khanaa";
+    rev = "refs/tags/v${version}";
+    hash = "sha256-BzxNHYMkp5pdJYQ80EI5jlP654yX9woW7wz1jArCln4=";
+  };
+
+  build-system = [
+    setuptools
+  ];
+
+  nativeCheckInputs = [
+    unittestCheckHook
+  ];
+
+  unittestFlagsArray = [ "-s" "tests" ];
+
+  pythonImportsCheck = [ "khanaa" ];
+
+  meta = with lib;
+    {
+      description = "A tool to make spelling Thai more convenient";
+      homepage = "https://github.com/cakimpei/khanaa";
+      changelog = "https://github.com/cakimpei/khanaa/blob/main/CHANGELOG.md";
+      license = licenses.mit;
+      maintainers = with maintainers; [ vizid ];
+    };
+}

pkgs/development/python-modules/langsmith/default.nix

@@ -15,7 +15,7 @@
 
 buildPythonPackage rec {
   pname = "langsmith";
-  version = "0.1.26";
+  version = "0.1.27";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -24,7 +24,7 @@ buildPythonPackage rec {
     owner = "langchain-ai";
     repo = "langsmith-sdk";
     rev = "refs/tags/v${version}";
-    hash = "sha256-bvG4B7xUESbj3iX/SjsManv4itR2kkfixzxkKuZgPfw=";
+    hash = "sha256-Nakcio+GMiMH4kztFCaypaafo4VZkK+pECcQCX9TkA8=";
   };
 
   sourceRoot = "${src.name}/python";

pkgs/development/python-modules/oras/default.nix

@@ -10,7 +10,7 @@
 
 buildPythonPackage rec {
   pname = "oras";
-  version = "0.1.27";
+  version = "0.1.28";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
@@ -19,7 +19,7 @@ buildPythonPackage rec {
     owner = "oras-project";
     repo = "oras-py";
     rev = "refs/tags/${version}";
-    hash = "sha256-T2zuflew91UsEjhPKPjNxPBN+C//S1vWvXKVT602EVI=";
+    hash = "sha256-yka4TypKqGczW+NugmCGa8PgtaSJeaQ4sPphPsIPLow=";
   };
 
   nativeBuildInputs = [

pkgs/development/python-modules/parsley/default.nix

@@ -4,10 +4,11 @@
 }:
 
 buildPythonPackage rec {
-  pname = "Parsley";
+  pname = "parsley";
   version = "1.3";
   src = fetchPypi {
-    inherit pname version;
+    pname = "Parsley";
+    inherit version;
     sha256 = "0hcd41bl07a8sx7nmx12p16xprnblc4phxkawwmmy78n8y6jfi4l";
   };
   # Tests fail although the package works just fine.  Unfortunately

pkgs/development/python-modules/pygetwindow/default.nix

@@ -4,11 +4,12 @@
 , pyrect
 }:
 buildPythonPackage rec {
-  pname = "PyGetWindow";
+  pname = "pygetwindow";
   version = "0.0.9";
 
   src = fetchPypi {
-    inherit pname version;
+    pname = "PyGetWindow";
+    inherit version;
     hash = "sha256-F4lDVefSswXNgy1xdwg4QBfBaYqQziT29/vwJC3Qpog=";
   };
 

pkgs/development/python-modules/ring-doorbell/default.nix

@@ -18,7 +18,7 @@
 
 buildPythonPackage rec {
   pname = "ring-doorbell";
-  version = "0.8.7";
+  version = "0.8.8";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -26,7 +26,7 @@ buildPythonPackage rec {
   src = fetchPypi {
     pname = "ring_doorbell";
     inherit version;
-    hash = "sha256-Awi0Wa/ayzhpecTCKWRt+2bQvvvDxbjN+bIKAdorETs=";
+    hash = "sha256-Rz12Qpawi4/u14ywJGt9Yw7IqjYP4bg6zNr9oN3iQxQ=";
   };
 
   nativeBuildInputs = [

pkgs/development/tools/rust/cargo-nextest/default.nix

@@ -2,16 +2,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "cargo-nextest";
-  version = "0.9.67";
+  version = "0.9.68";
 
   src = fetchFromGitHub {
     owner = "nextest-rs";
     repo = "nextest";
     rev = "cargo-nextest-${version}";
-    hash = "sha256-M2WkgECTAKux+sq+1rYt2rg/LP4ctMMprY3MsBO5cn4=";
+    hash = "sha256-LC+0s38ufmMrhNaKSn13jka/M7PG1+gJnqZCXJ7ef6I=";
   };
 
-  cargoHash = "sha256-hJAsmT8T3YGSWjishSQeVMFty6HmdNewRR9nr66fRN0=";
+  cargoHash = "sha256-E/bsVbSdFr1LMrIewsh15Vuk4Dt5UwETLCIhE7TT3kA=";
 
   buildInputs = lib.optionals stdenv.isDarwin [
     darwin.apple_sdk.frameworks.SystemConfiguration

pkgs/os-specific/linux/kernel/generic.nix

@@ -15,7 +15,7 @@
 , nixosTests
 }:
 
-{ # The kernel source tarball.
+lib.makeOverridable ({ # The kernel source tarball.
   src
 
 , # The kernel version.
@@ -240,4 +240,4 @@ kernel.overrideAttrs (finalAttrs: previousAttrs: {
     in [ (nixosTests.kernel-generic.passthru.testsForKernel overridableKernel) ] ++ kernelTests;
   };
 
-})
+}))

pkgs/servers/radicale/3.x.nix

@@ -1,34 +1,29 @@
 { lib
 , python3
 , fetchFromGitHub
-, fetchpatch
 , nixosTests
 }:
 
 python3.pkgs.buildPythonApplication rec {
   pname = "radicale";
-  version = "3.1.8";
+  version = "3.1.9";
+  pyproject = true;
 
   src = fetchFromGitHub {
     owner = "Kozea";
     repo = "Radicale";
     rev = "v${version}";
-    hash = "sha256-V0nqgxGUxcTRAYFuxpKUEVB/g/Mbvw+9OIcvAexXwuM=";
+    hash = "sha256-i4NQ1+ltRE0g8AoyGKKVcgZgSmLeppnobu6bf2+XmWY=";
   };
 
-  patches = [
-    # https://github.com/Kozea/Radicale/pull/1328
-    (fetchpatch {
-      name = "fix-python3.11-tests.patch";
-      url = "https://github.com/Kozea/Radicale/commit/110ec3a7885f523ce894a8c0e336c1a081dcd092.patch";
-      hash = "sha256-WEiwzJ+Vzv8PXmZUi1X7Qzs+oE6qgmpvHqm/xiOMrt0=";
-    })
-  ];
-
   postPatch = ''
     sed -i '/addopts/d' setup.cfg
   '';
 
+  nativeBuildInputs = with python3.pkgs; [
+    setuptools
+  ];
+
   propagatedBuildInputs = with python3.pkgs; [
     defusedxml
     passlib
@@ -55,6 +50,7 @@ python3.pkgs.buildPythonApplication rec {
 
   meta = with lib; {
     homepage = "https://radicale.org/v3.html";
+    changelog = "https://github.com/Kozea/Radicale/blob/${src.rev}/CHANGELOG.md";
     description = "CalDAV and CardDAV server";
     license = licenses.gpl3Plus;
     maintainers = with maintainers; [ dotlambda erictapen ];

pkgs/servers/web-apps/engelsystem/default.nix

@@ -1,9 +1,11 @@
-{ lib, stdenv, fetchzip, php, writeText, nixosTests }:
+{ lib
+, fetchzip
+, nixosTests
+, php
+, stdenv
+, writeText
+}:
 
-let
-  phpExt = php.withExtensions
-    ({ enabled, all }: with all; [ filter mysqlnd mysqli pdo pdo_mysql mbstring ] ++ enabled);
-in
 stdenv.mkDerivation rec {
   pname = "engelsystem";
   version = "3.5.0";
@@ -13,7 +15,7 @@ stdenv.mkDerivation rec {
     hash = "sha256-RbzAHBZN02u14WaLtq5EOh4XwIdHKvzX7NhDBhn/CaU=";
   };
 
-  buildInputs = [ phpExt ];
+  buildInputs = [ php ];
 
   installPhase = ''
     runHook preInstall
@@ -30,7 +32,7 @@ stdenv.mkDerivation rec {
 
     echo $(command -v php)
     # The patchShebangAuto function always used the php without extensions, so path the shebang manually
-    sed -i -e "1 s|.*|#\!${phpExt}/bin/php|" "$out/share/engelsystem/bin/migrate"
+    sed -i -e "1 s|.*|#\!${lib.getExe php}|" "$out/share/engelsystem/bin/migrate"
     ln -s "$out/share/engelsystem/bin/migrate" "$out/bin/migrate"
 
     runHook postInstall
@@ -39,13 +41,13 @@ stdenv.mkDerivation rec {
   passthru.tests = nixosTests.engelsystem;
 
   meta = with lib; {
+    changelog = "https://github.com/engelsystem/engelsystem/releases/tag/v${version}";
     description =
       "Coordinate your volunteers in teams, assign them to work shifts or let them decide for themselves when and where they want to help with what";
     homepage = "https://engelsystem.de";
-    changelog = "https://github.com/engelsystem/engelsystem/releases/tag/v${version}";
     license = licenses.gpl2;
-    maintainers = with maintainers; [ kloenk ];
     mainProgram = "migrate";
+    maintainers = with maintainers; [ ];
     platforms = platforms.all;
   };
 }

pkgs/tools/networking/ddns-go/default.nix

@@ -5,13 +5,13 @@
 
 buildGoModule rec {
   pname = "ddns-go";
-  version = "6.2.1";
+  version = "6.2.2";
 
   src = fetchFromGitHub {
     owner = "jeessy2";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-KfSOhUmV81Z8qp8MrqwJLtQ5SZgiEPbdkA1NacqpNRc=";
+    hash = "sha256-MwDwYoX1OT4TKMD2g+RBAlGfs8cz42dEFnV2b8Xzup8=";
   };
 
   vendorHash = "sha256-zUqsuph0fn1x4dwvBY0W0+S6SzS086SHya2ViNpDXGU=";

pkgs/tools/security/gopass/default.nix

@@ -13,7 +13,7 @@
 
 buildGoModule rec {
   pname = "gopass";
-  version = "1.15.11";
+  version = "1.15.12";
 
   nativeBuildInputs = [ installShellFiles makeWrapper ];
 
@@ -21,10 +21,10 @@ buildGoModule rec {
     owner = "gopasspw";
     repo = "gopass";
     rev = "v${version}";
-    hash = "sha256-wgrZkRRMEWA9Lk9eW+iGi+dZNYfDVhRu1phimZC079c=";
+    hash = "sha256-sg3I/h0mkkWmK4GD1yoX14gM2oqwRjMXpX3KULHFJsg=";
   };
 
-  vendorHash = "sha256-TvohrwSFVv5ylVRd6jPdRDyRRhqqWa0xey9KN9vtyY8=";
+  vendorHash = "sha256-jbwtxOfBL/5aXdWcsXZ5HQi83Oy00SSnLcvuWeCPBug=";
 
   subPackages = [ "." ];
 

pkgs/tools/security/gopass/git-credential.nix

@@ -2,21 +2,30 @@
 , makeWrapper
 , buildGoModule
 , fetchFromGitHub
+, fetchpatch
 , gopass
 }:
 
 buildGoModule rec {
   pname = "git-credential-gopass";
-  version = "1.15.11";
+  version = "1.15.12";
 
   src = fetchFromGitHub {
     owner = "gopasspw";
     repo = "git-credential-gopass";
     rev = "v${version}";
-    hash = "sha256-qnWgrpcj3DZQu5haP/5xqoO7eogkRjBmc8XpgFFNT6I=";
+    hash = "sha256-5j5+so4LT3x+epEZf9OVn/kLNHBk2ENQxxRrzbziEA4=";
   };
 
-  vendorHash = "sha256-bit4+YgQ+Y/TA2q7KdZwYTE3ZKBwL6tUam+tHzBMiQw=";
+  patches = [
+    # go mod tidy. Remove with next release
+    (fetchpatch {
+      url = "https://github.com/gopasspw/git-credential-gopass/commit/88d11d2b1b49f00b7fba9a917cf90f7ea14c9d1b.patch";
+      hash = "sha256-mXxI9GXan0zYL8msL83VLqxOp4oAOwMyCOFaUOLAg5E=";
+    })
+  ];
+
+  vendorHash = "sha256-y1PH0+tt/kcHw2I4LWD2XfLud3JtsYqrRd/yVRPdaTA=";
 
   subPackages = [ "." ];
 

pkgs/tools/security/gopass/hibp.nix

@@ -2,21 +2,30 @@
 , makeWrapper
 , buildGoModule
 , fetchFromGitHub
+, fetchpatch
 , gopass
 }:
 
 buildGoModule rec {
   pname = "gopass-hibp";
-  version = "1.15.11";
+  version = "1.15.12";
 
   src = fetchFromGitHub {
     owner = "gopasspw";
     repo = "gopass-hibp";
     rev = "v${version}";
-    hash = "sha256-2XhvUIa8RxQ6CAKPGpL8/rBiJSX/WsSGtIpaHLIBM1E=";
+    hash = "sha256-5BnCaxF2XZ4f26KsTbapcZ2+Ii58nR/14pCj0c0QLKE=";
   };
 
-  vendorHash = "sha256-i9PUqircNf+jz5gcr3rVIR4tD9/bkV2h6LiDFhjiLaw=";
+  patches = [
+    # go mod tidy. Remove with next release
+    (fetchpatch {
+      url = "https://github.com/gopasspw/gopass-hibp/commit/cdfdbc6da154874c74d7c8fc83bb11a98dd8fd81.patch";
+      hash = "sha256-jCzg3c8EizhoRYvWUZCys6/q2ChVWy/psPofNGIYdxs=";
+    })
+  ];
+
+  vendorHash = "sha256-GLqtwUg3fa1okdPoQBkF+ygpm8GLmDyIyUiC7/TTTaE=";
 
   subPackages = [ "." ];
 

pkgs/tools/security/gopass/jsonapi.nix

@@ -2,22 +2,31 @@
 , makeWrapper
 , buildGoModule
 , fetchFromGitHub
+, fetchpatch
 , installShellFiles
 , gopass
 }:
 
 buildGoModule rec {
   pname = "gopass-jsonapi";
-  version = "1.15.11";
+  version = "1.15.12";
 
   src = fetchFromGitHub {
     owner = "gopasspw";
     repo = "gopass-jsonapi";
     rev = "v${version}";
-    hash = "sha256-wJlnm+sgFg55LW4RWGjcT538DgNhJtFjwgwgqwLWH50=";
+    hash = "sha256-sR+48MRBHj3XpKLp/AOGf2H4ltZD1fHlIA2HPYSHdp0=";
   };
 
-  vendorHash = "sha256-qRmPO2WM9RD43twl5a47IT3xC1LGFwNF99ojIU2xg6A=";
+  patches = [
+    # go mod tidy. Remove with next release
+    (fetchpatch {
+      url = "https://github.com/gopasspw/gopass-jsonapi/commit/cab33faab113d0c9702ebaa14cde13e5ccd465d2.patch";
+      hash = "sha256-IoxU5r1k0Y6N+PKAZH8LEO/fXHjryx5y58RRFeHP7Bc=";
+    })
+  ];
+
+  vendorHash = "sha256-2JADTyBgAK2j524G+ksKLJC255PmvMViFFCwmgtXZzA=";
 
   subPackages = [ "." ];
 

pkgs/tools/security/gopass/summon.nix

@@ -2,21 +2,30 @@
 , makeWrapper
 , buildGoModule
 , fetchFromGitHub
+, fetchpatch
 , gopass
 }:
 
 buildGoModule rec {
   pname = "gopass-summon-provider";
-  version = "1.15.11";
+  version = "1.15.12";
 
   src = fetchFromGitHub {
     owner = "gopasspw";
     repo = "gopass-summon-provider";
     rev = "v${version}";
-    hash = "sha256-rbfzmr6HtGUBCjO9jkocSghTAN+aNXTsSsMC38HqgW0=";
+    hash = "sha256-gvgHqeVB+4d8UJhMv3CYYidttCcaRPkgI7PXasv7pCI=";
   };
 
-  vendorHash = "sha256-bit4+YgQ+Y/TA2q7KdZwYTE3ZKBwL6tUam+tHzBMiQw=";
+  patches = [
+    # go mod tidy. Remove with next release
+    (fetchpatch {
+      url = "https://github.com/gopasspw/gopass-summon-provider/commit/b3085cab14588cb6a5a383033947d9266fe0cd56.patch";
+      hash = "sha256-8mvJqejqmuOloj9mW9zzsE/Xr0DtPhJeDItzVFVv4+c=";
+    })
+  ];
+
+  vendorHash = "sha256-y1PH0+tt/kcHw2I4LWD2XfLud3JtsYqrRd/yVRPdaTA=";
 
   subPackages = [ "." ];
 

pkgs/top-level/all-packages.nix

@@ -4026,15 +4026,25 @@ with pkgs;
 
   go-audit = callPackage ../tools/system/go-audit { };
 
-  gopass = callPackage ../tools/security/gopass { };
+  gopass = callPackage ../tools/security/gopass {
+    buildGoModule = buildGo122Module;
+  };
 
-  gopass-hibp = callPackage ../tools/security/gopass/hibp.nix { };
+  gopass-hibp = callPackage ../tools/security/gopass/hibp.nix {
+    buildGoModule = buildGo122Module;
+  };
 
-  gopass-jsonapi = callPackage ../tools/security/gopass/jsonapi.nix { };
+  gopass-jsonapi = callPackage ../tools/security/gopass/jsonapi.nix {
+    buildGoModule = buildGo122Module;
+  };
 
-  git-credential-gopass = callPackage ../tools/security/gopass/git-credential.nix { };
+  git-credential-gopass = callPackage ../tools/security/gopass/git-credential.nix {
+    buildGoModule = buildGo122Module;
+  };
 
-  gopass-summon-provider = callPackage ../tools/security/gopass/summon.nix { };
+  gopass-summon-provider = callPackage ../tools/security/gopass/summon.nix {
+    buildGoModule = buildGo122Module;
+  };
 
   gosh = callPackage ../tools/security/gosh { };
 

pkgs/top-level/python-packages.nix

@@ -3636,6 +3636,8 @@ self: super: with self; {
   editdistance = callPackage ../development/python-modules/editdistance { };
 
   editdistance-s = callPackage ../development/python-modules/editdistance-s { };
+  
+  editdistpy = callPackage ../development/python-modules/editdistpy { };
 
   editor = callPackage ../development/python-modules/editor { };
 
@@ -6259,6 +6261,8 @@ self: super: with self; {
     inherit (pkgs) keyutils;
   };
 
+  khanaa = callPackage ../development/python-modules/khanaa {};
+
   kicad = toPythonModule (pkgs.kicad.override {
     python3 = python;
   }).src;