Merge master into haskell-updates

.github/CODEOWNERS

@@ -131,13 +131,13 @@ nixos/modules/installer/tools/nix-fallback-paths.nix  @raitobezarius @ma27
 /pkgs/development/interpreters/python/hooks                 @FRidh @jonringer
 
 # Haskell
-/doc/languages-frameworks/haskell.section.md  @cdepillabout @sternenseemann @maralorn @ncfavier
+/doc/languages-frameworks/haskell.section.md  @sternenseemann @maralorn @ncfavier
-/maintainers/scripts/haskell                  @cdepillabout @sternenseemann @maralorn @ncfavier
+/maintainers/scripts/haskell                  @sternenseemann @maralorn @ncfavier
-/pkgs/development/compilers/ghc               @cdepillabout @sternenseemann @maralorn @ncfavier
+/pkgs/development/compilers/ghc               @sternenseemann @maralorn @ncfavier
-/pkgs/development/haskell-modules             @cdepillabout @sternenseemann @maralorn @ncfavier
+/pkgs/development/haskell-modules             @sternenseemann @maralorn @ncfavier
-/pkgs/test/haskell                            @cdepillabout @sternenseemann @maralorn @ncfavier
+/pkgs/test/haskell                            @sternenseemann @maralorn @ncfavier
-/pkgs/top-level/release-haskell.nix           @cdepillabout @sternenseemann @maralorn @ncfavier
+/pkgs/top-level/release-haskell.nix           @sternenseemann @maralorn @ncfavier
-/pkgs/top-level/haskell-packages.nix          @cdepillabout @sternenseemann @maralorn @ncfavier
+/pkgs/top-level/haskell-packages.nix          @sternenseemann @maralorn @ncfavier
 
 # Perl
 /pkgs/development/interpreters/perl @stigtsp @zakame @dasJ

doc/build-helpers/images.md

@@ -6,7 +6,6 @@ This chapter describes tools for creating various types of images.
 images/appimagetools.section.md
 images/dockertools.section.md
 images/ocitools.section.md
-images/snaptools.section.md
 images/portableservice.section.md
 images/makediskimage.section.md
 images/binarycache.section.md

doc/build-helpers/images/snaptools.section.md

@@ -1,71 +0,0 @@
-# pkgs.snapTools {#sec-pkgs-snapTools}
-
-`pkgs.snapTools` is a set of functions for creating Snapcraft images. Snap and Snapcraft is not used to perform these operations.
-
-## The makeSnap Function {#ssec-pkgs-snapTools-makeSnap-signature}
-
-`makeSnap` takes a single named argument, `meta`. This argument mirrors [the upstream `snap.yaml` format](https://docs.snapcraft.io/snap-format) exactly.
-
-The `base` should not be specified, as `makeSnap` will force set it.
-
-Currently, `makeSnap` does not support creating GUI stubs.
-
-## Build a Hello World Snap {#ssec-pkgs-snapTools-build-a-snap-hello}
-
-The following expression packages GNU Hello as a Snapcraft snap.
-
-``` {#ex-snapTools-buildSnap-hello .nix}
-let
-  inherit (import <nixpkgs> { }) snapTools hello;
-in snapTools.makeSnap {
-  meta = {
-    name = "hello";
-    summary = hello.meta.description;
-    description = hello.meta.longDescription;
-    architectures = [ "amd64" ];
-    confinement = "strict";
-    apps.hello.command = "${hello}/bin/hello";
-  };
-}
-```
-
-`nix-build` this expression and install it with `snap install ./result --dangerous`. `hello` will now be the Snapcraft version of the package.
-
-## Build a Graphical Snap {#ssec-pkgs-snapTools-build-a-snap-firefox}
-
-Graphical programs require many more integrations with the host. This example uses Firefox as an example because it is one of the most complicated programs we could package.
-
-``` {#ex-snapTools-buildSnap-firefox .nix}
-let
-  inherit (import <nixpkgs> { }) snapTools firefox;
-in snapTools.makeSnap {
-  meta = {
-    name = "nix-example-firefox";
-    summary = firefox.meta.description;
-    architectures = [ "amd64" ];
-    apps.nix-example-firefox = {
-      command = "${firefox}/bin/firefox";
-      plugs = [
-        "pulseaudio"
-        "camera"
-        "browser-support"
-        "avahi-observe"
-        "cups-control"
-        "desktop"
-        "desktop-legacy"
-        "gsettings"
-        "home"
-        "network"
-        "mount-observe"
-        "removable-media"
-        "x11"
-      ];
-    };
-    confinement = "strict";
-  };
-}
-```
-
-`nix-build` this expression and install it with `snap install ./result --dangerous`. `nix-example-firefox` will now be the Snapcraft version of the Firefox package.
-
-The specific meaning behind plugs can be looked up in the [Snapcraft interface documentation](https://docs.snapcraft.io/supported-interfaces).

lib/deprecated.nix

@@ -1,14 +1,37 @@
 { lib }:
+
 let
-    inherit (builtins) head tail isList isAttrs isInt attrNames;
+  inherit (lib)
+    and
+    any
+    attrByPath
+    attrNames
+    compare
+    concat
+    concatMap
+    elem
+    filter
+    foldl
+    foldr
+    genericClosure
+    head
+    imap1
+    init
+    isAttrs
+    isFunction
+    isInt
+    isList
+    lists
+    listToAttrs
+    mapAttrs
+    mergeAttrs
+    meta
+    nameValuePair
+    tail
+    toList
+    ;
 
-in
+  inherit (lib.attrsets) removeAttrs;
-
-with lib.lists;
-with lib.attrsets;
-with lib.strings;
-
-rec {
 
   # returns default if env var is not set
   maybeEnv = name: default:
@@ -26,7 +49,7 @@ rec {
         base = (setAttrMerge "passthru" {} (f arg)
                         ( z: z // {
                             function = foldArgs merger f arg;
-                            args = (lib.attrByPath ["passthru" "args"] {} z) // x;
+                            args = (attrByPath ["passthru" "args"] {} z) // x;
                           } ));
         withStdOverrides = base // {
           override = base.passthru.function;
@@ -77,11 +100,11 @@ rec {
   # Output : are reqs satisfied? It's asserted.
   checkReqs = attrSet: argList: condList:
   (
-    foldr lib.and true
+    foldr and true
       (map (x: let name = (head x); in
 
         ((checkFlag attrSet name) ->
-        (foldr lib.and true
+        (foldr and true
         (map (y: let val=(getValue attrSet argList y); in
                 (val!=null) && (val!=false))
         (tail x))))) condList));
@@ -159,11 +182,11 @@ rec {
 
   closePropagationSlow = list: (uniqList {inputList = (innerClosePropagation [] list);});
 
-  # This is an optimisation of lib.closePropagation which avoids the O(n^2) behavior
+  # This is an optimisation of closePropagation which avoids the O(n^2) behavior
   # Using a list of derivations, it generates the full closure of the propagatedXXXBuildInputs
   # The ordering / sorting / comparison is done based on the `outPath`
   # attribute of each derivation.
-  # On some benchmarks, it performs up to 15 times faster than lib.closePropagation.
+  # On some benchmarks, it performs up to 15 times faster than closePropagation.
   # See https://github.com/NixOS/nixpkgs/pull/194391 for details.
   closePropagationFast = list:
     builtins.map (x: x.val) (builtins.genericClosure {
@@ -250,10 +273,10 @@ rec {
   # foldArgs, composedArgsAndFun or applyAndFun. Example: composableDerivation in all-packages.nix
   mergeAttrByFunc = x: y:
     let
-          mergeAttrBy2 = { mergeAttrBy = lib.mergeAttrs; }
+          mergeAttrBy2 = { mergeAttrBy = mergeAttrs; }
                       // (maybeAttr "mergeAttrBy" {} x)
                       // (maybeAttr "mergeAttrBy" {} y); in
-    foldr lib.mergeAttrs {} [
+    foldr mergeAttrs {} [
       x y
       (mapAttrs ( a: v: # merge special names using given functions
           if x ? ${a}
@@ -273,9 +296,9 @@ rec {
 
   # sane defaults (same name as attr name so that inherit can be used)
   mergeAttrBy = # { buildInputs = concatList; [...]; passthru = mergeAttr; [..]; }
-    listToAttrs (map (n: nameValuePair n lib.concat)
+    listToAttrs (map (n: nameValuePair n concat)
       [ "nativeBuildInputs" "buildInputs" "propagatedBuildInputs" "configureFlags" "prePhases" "postAll" "patches" ])
-    // listToAttrs (map (n: nameValuePair n lib.mergeAttrs) [ "passthru" "meta" "cfg" "flags" ])
+    // listToAttrs (map (n: nameValuePair n mergeAttrs) [ "passthru" "meta" "cfg" "flags" ])
     // listToAttrs (map (n: nameValuePair n (a: b: "${a}\n${b}") ) [ "preConfigure" "postInstall" ])
   ;
 
@@ -283,7 +306,7 @@ rec {
       if isAttrs x then
           if x ? outPath then "derivation"
           else "attrs"
-      else if lib.isFunction x then "function"
+      else if isFunction x then "function"
       else if isList x then "list"
       else if x == true then "bool"
       else if x == false then "bool"
@@ -304,4 +327,47 @@ rec {
   fakeHash = "sha256-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=";
   fakeSha256 = "0000000000000000000000000000000000000000000000000000000000000000";
   fakeSha512 = "00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000";
+
+in
+
+# Everything in this attrset is the public interface of the file.
+{
+  inherit
+    checkFlag
+    checkReqs
+    closePropagation
+    closePropagationFast
+    closePropagationSlow
+    condConcat
+    defaultMerge
+    defaultMergeArg
+    fakeHash
+    fakeSha256
+    fakeSha512
+    foldArgs
+    getValue
+    ifEnable
+    imap
+    innerClosePropagation
+    innerModifySumArgs
+    lazyGenericClosure
+    mapAttrsFlatten
+    maybeAttr
+    maybeAttrNullable
+    maybeEnv
+    mergeAttrBy
+    mergeAttrByFunc
+    mergeAttrsByFuncDefaults
+    mergeAttrsByFuncDefaultsClean
+    mergeAttrsConcatenateValues
+    mergeAttrsNoOverride
+    mergeAttrsWithFunc
+    modifySumArgs
+    nixType
+    nvs
+    setAttr
+    setAttrMerge
+    uniqList
+    uniqListExt
+    ;
 }

lib/kernel.nix

@@ -1,6 +1,8 @@
 { lib }:
 
-with lib;
+let
+  inherit (lib) mkIf versionAtLeast versionOlder;
+in
 {
 
 

maintainers/maintainer-list.nix

@@ -6267,16 +6267,6 @@
     githubId = 541748;
     name = "Felipe Espinoza";
   };
-  federicoschonborn = {
-    name = "Federico Damián Schonborn";
-    email = "fdschonborn@gmail.com";
-    github = "FedericoSchonborn";
-    githubId = 62166915;
-    matrix = "@FedericoDSchonborn:matrix.org";
-    keys = [
-      { fingerprint = "517A 8A6A 09CA A11C 9667  CEE3 193F 70F1 5C9A B0A0"; }
-    ];
-  };
   fedx-sudo = {
     email = "fedx-sudo@pm.me";
     github = "FedX-sudo";
@@ -7060,6 +7050,12 @@
     github = "getpsyched";
     githubId = 43472218;
   };
+  getreu = {
+    email = "getreu@web.de";
+    github = "getreu";
+    githubId = 579082;
+    name = "Jens Getreu";
+  };
   gfrascadorio = {
     email = "gfrascadorio@tutanota.com";
     github = "gfrascadorio";
@@ -17625,15 +17621,6 @@
     matrix = "@shamrocklee:matrix.org";
     name = "Yueh-Shun Li";
   };
-  shanesveller = {
-    email = "shane@sveller.dev";
-    github = "shanesveller";
-    githubId = 831;
-    keys = [{
-      fingerprint = "F83C 407C ADC4 5A0F 1F2F  44E8 9210 C218 023C 15CD";
-    }];
-    name = "Shane Sveller";
-  };
   shard7 = {
     email = "sh7user@gmail.com";
     github = "shard77";
@@ -19958,6 +19945,12 @@
       fingerprint = "E631 8869 586F 99B4 F6E6  D785 5942 58F0 389D 2802";
     }];
   };
+  twitchy0 = {
+    email = "code@nitinpassa.com";
+    github = "twitchy0";
+    githubId = 131159000;
+    name = "Nitin Passa";
+  };
   twitchyliquid64 = {
     name = "Tom";
     email = "twitchyliquid64@ciphersink.net";

maintainers/scripts/luarocks-packages.csv

@@ -116,6 +116,7 @@ stdlib,,,,41.2.2,,vyp
 teal-language-server,,,http://luarocks.org/dev,,,
 telescope.nvim,,,,,5.1,
 telescope-manix,,,,,,
+tiktoken_core,,,,,,natsukium
 tl,,,,,,mephistophiles
 toml,,,,,,mrcjkb
 toml-edit,,,,,5.1,mrcjkb

maintainers/team-list.nix

@@ -96,6 +96,14 @@ with lib.maintainers; {
     shortName = "Blockchains";
   };
 
+  budgie = {
+    members = [
+      bobby285271
+    ];
+    scope = "Maintain Budgie desktop environment";
+    shortName = "Budgie";
+  };
+
   buildbot = {
     members = [
       lopsided98

nixos/doc/manual/release-notes/rl-2405.section.md

@@ -123,14 +123,14 @@ The pre-existing [services.ankisyncd](#opt-services.ankisyncd.enable) has been m
 
 <!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->
 
+- `k3s`: was updated to version [v1.29](https://github.com/k3s-io/k3s/releases/tag/v1.29.1%2Bk3s2), all previous versions (k3s_1_26, k3s_1_27, k3s_1_28) will be removed. See [changelog and upgrade notes](https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.29.md#urgent-upgrade-notes) for more information.
+
 - `himalaya` was updated to `v1.0.0-beta.3`, which introduces breaking changes. Check out the [release note](https://github.com/soywod/himalaya/releases/tag/v1.0.0-beta.3) for details.
 
 - The `power.ups` module now generates `upsd.conf`, `upsd.users` and `upsmon.conf` automatically from a set of new configuration options. This breaks compatibility with existing `power.ups` setups where these files were created manually. Back up these files before upgrading NixOS.
 
 - `unrar` was updated to v7. See [changelog](https://www.rarlab.com/unrar7notes.htm) for more information.
 
-- `k3s` was updated to [v1.29](https://github.com/k3s-io/k3s/releases/tag/v1.29.1%2Bk3s2). See [changelog and upgrade notes](https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.29.md#urgent-upgrade-notes) for more information.
-
 - `k9s` was updated to v0.31. There have been various breaking changes in the config file format,
   check out the changelog of [v0.29](https://github.com/derailed/k9s/releases/tag/v0.29.0),
   [v0.30](https://github.com/derailed/k9s/releases/tag/v0.30.0) and

nixos/modules/services/web-apps/nextcloud.nix

@@ -14,7 +14,6 @@ let
     expose_php = "Off";
     error_reporting = "E_ALL & ~E_DEPRECATED & ~E_STRICT";
     display_errors = "stderr";
-    "opcache.enable_cli" = "1";
     "opcache.interned_strings_buffer" = "8";
     "opcache.max_accelerated_files" = "10000";
     "opcache.memory_consumption" = "128";

nixos/tests/budgie.nix

@@ -1,7 +1,7 @@
 import ./make-test-python.nix ({ pkgs, lib, ... }: {
   name = "budgie";
 
-  meta.maintainers = [ lib.maintainers.federicoschonborn ];
+  meta.maintainers = lib.teams.budgie.members;
 
   nodes.machine = { ... }: {
     imports = [

nixos/tests/systemd-machinectl.nix

@@ -42,8 +42,18 @@ import ./make-test-python.nix ({ pkgs, ... }:
 
       virtualisation.additionalPaths = [ containerSystem ];
 
-      # not needed, but we want to test the nspawn file generation
+      systemd.tmpfiles.rules = [
-      systemd.nspawn.${containerName} = { };
+        "d /var/lib/machines/shared-decl 0755 root root - -"
+      ];
+      systemd.nspawn.shared-decl = {
+        execConfig = {
+          Boot = false;
+          Parameters = "${containerSystem}/init";
+        };
+        filesConfig = {
+          BindReadOnly = "/nix/store";
+        };
+      };
 
       systemd.services."systemd-nspawn@${containerName}" = {
         serviceConfig.Environment = [
@@ -52,14 +62,33 @@ import ./make-test-python.nix ({ pkgs, ... }:
         ];
         overrideStrategy = "asDropin";
       };
+
+      # open DHCP for container
+      networking.firewall.extraCommands = ''
+        ${pkgs.iptables}/bin/iptables -A nixos-fw -i ve-+ -p udp -m udp --dport 67 -j nixos-fw-accept
+      '';
     };
 
     testScript = ''
       start_all()
       machine.wait_for_unit("default.target");
 
-      # Install container
+      # Test machinectl start stop of shared-decl
+      machine.succeed("machinectl start shared-decl");
+      machine.wait_until_succeeds("systemctl -M shared-decl is-active default.target");
+      machine.succeed("machinectl stop shared-decl");
+
+      # create containers root
       machine.succeed("mkdir -p ${containerRoot}");
+
+      # start container with shared nix store by using same arguments as for systemd-nspawn@.service
+      machine.succeed("systemd-run systemd-nspawn --machine=${containerName} --network-veth -U --bind-ro=/nix/store ${containerSystem}/init")
+      machine.wait_until_succeeds("systemctl -M ${containerName} is-active default.target");
+
+      # Test machinectl stop
+      machine.succeed("machinectl stop ${containerName}");
+
+      # Install container
       # Workaround for nixos-install
       machine.succeed("chmod o+rx /var/lib/machines");
       machine.succeed("nixos-install --root ${containerRoot} --system ${containerSystem} --no-channel-copy --no-root-passwd");
@@ -77,6 +106,12 @@ import ./make-test-python.nix ({ pkgs, ... }:
       # Test nss_mymachines via nscd
       machine.succeed("getent hosts ${containerName}");
 
+      # Test systemd-nspawn network configuration to container
+      machine.succeed("networkctl --json=short status ve-${containerName} | ${pkgs.jq}/bin/jq -e '.OperationalState == \"routable\"'");
+
+      # Test systemd-nspawn network configuration to host
+      machine.succeed("machinectl shell ${containerName} /run/current-system/sw/bin/networkctl --json=short status host0 | ${pkgs.jq}/bin/jq -r '.OperationalState == \"routable\"'");
+
       # Test systemd-nspawn network configuration
       machine.succeed("ping -n -c 1 ${containerName}");
 

pkgs/applications/audio/gtkpod/default.nix

@@ -1,40 +0,0 @@
-{ lib, stdenv, fetchurl, pkg-config, wrapGAppsHook, intltool, libgpod, libxml2, curl, flac
-, gnome, gtk3, gettext, perlPackages, flex, libid3tag, gdl
-, libvorbis, gdk-pixbuf
-}:
-
-stdenv.mkDerivation rec {
-  version = "2.1.5";
-  pname = "gtkpod";
-
-  src = fetchurl {
-    url = "mirror://sourceforge/gtkpod/${pname}-${version}.tar.gz";
-    sha256 = "0xisrpx069f7bjkyc8vqxb4k0480jmx1wscqxr6cpq1qj6pchzd5";
-  };
-  postPatch = ''
-    sed -i 's/which/type -P/' scripts/*.sh
-  '';
-
-  nativeBuildInputs = [ pkg-config wrapGAppsHook intltool ];
-  buildInputs = [
-    curl gettext
-    flex libgpod libid3tag flac libvorbis libxml2 gtk3 gdk-pixbuf
-    gdl gnome.adwaita-icon-theme gnome.anjuta
-  ] ++ (with perlPackages; [ perl XMLParser ]);
-
-  # Workaround build failure on -fno-common toolchains like upstream
-  # gcc-10. Otherwise build fails as:
-  #   ld: .libs/autodetection.o:/build/gtkpod-2.1.5/libgtkpod/gtkpod_app_iface.h:248: multiple definition of
-  #       `gtkpod_app'; .libs/gtkpod_app_iface.o:/build/gtkpod-2.1.5/libgtkpod/gtkpod_app_iface.h:248: first defined here
-  env.NIX_CFLAGS_COMPILE = "-fcommon";
-
-  enableParallelBuilding = true;
-
-  meta = with lib; {
-    description = "GTK Manager for an Apple ipod";
-    homepage = "https://sourceforge.net/projects/gtkpod/";
-    license = licenses.gpl2Plus;
-    platforms = platforms.linux;
-    maintainers = [ ];
-  };
-}

pkgs/applications/blockchains/lighthouse/default.nix

@@ -12,9 +12,9 @@
 , postgresql
 , protobuf
 , rustPlatform
+, rust-jemalloc-sys
 , Security
 , sqlite
-, rust-jemalloc-sys
 , stdenv
 , SystemConfiguration
 , testers
@@ -23,7 +23,7 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "lighthouse";
-  version = "4.5.0";
+  version = "4.6.0";
 
   # lighthouse/common/deposit_contract/build.rs
   depositContractSpecVersion = "0.12.1";
@@ -33,11 +33,12 @@ rustPlatform.buildRustPackage rec {
     owner = "sigp";
     repo = "lighthouse";
     rev = "v${version}";
-    hash = "sha256-UUOvTxOQXT1zfhDYEL/J6moHAyejZn7GyGS/XBmXxRQ=";
+    hash = "sha256-uMrVnVvYXcY2Axn3ycsf+Pwur3HYGoOYjjUkGS5c3l4=";
   };
 
   patches = [
     ./use-system-sqlite.patch
+    ./use-c-kzg-from-crates-io.patch
   ];
 
   postPatch = ''
@@ -48,14 +49,11 @@ rustPlatform.buildRustPackage rec {
     lockFile = ./Cargo.lock;
     outputHashes = {
       "amcl-0.3.0" = "sha256-kc8k/ls4W0TwFBsRcyyotyz8ZBEjsZXHeJnJtsnW/LM=";
-      "anvil-rpc-0.1.0" = "sha256-L38OioxnWEn94g3GJT4j3U1cJZ8jQDHp8d1QOHaVEuU=";
+      "discv5-0.4.0" = "sha256-GKAk9Du6fy0ldeBEwPueDbVPhyNxdKNROKpMJvR/OTc=";
-      "beacon-api-client-0.1.0" = "sha256-Z0CoPxZzl2bjb8vgmHWxq2orMawhMMs7beKGopilKjE=";
+      "futures-bounded-0.2.3" = "sha256-/LbD+je9P1lPnXMJVDqRQHJziQPXPvSDmQadTfsQ5I8=";
-      "ethereum-consensus-0.1.1" = "sha256-biTrw3yMJUo9+56QK5RGWXLCoPPZEWp18SCs+Y9QWg4=";
       "libmdbx-0.1.4" = "sha256-NMsR/Wl1JIj+YFPyeMMkrJFfoS07iEAKEQawO89a+/Q=";
       "lmdb-rkv-0.14.0" = "sha256-sxmguwqqcyOlfXOZogVz1OLxfJPo+Q0+UjkROkbbOCk=";
-      "mev-rs-0.3.0" = "sha256-LCO0GTvWTLcbPt7qaSlLwlKmAjt3CIHVYTT/JRXpMEo=";
+      "warp-0.3.6" = "sha256-knDt2aw/PJ0iabhKg+okwwnEzCY+vQVhE7HKCTM6QbE=";
-      "testcontainers-0.14.0" = "sha256-mSsp21G7MLEtFROWy88Et5s07PO0tjezovCGIMh+/oQ=";
-      "warp-0.3.5" = "sha256-d5e6ASdL7+Dl3KsTNOb9B5RHpStrupOKsbGWsdu9Jfk=";
     };
   };
 
@@ -70,8 +68,8 @@ rustPlatform.buildRustPackage rec {
   ];
 
   buildInputs = [
-    sqlite
     rust-jemalloc-sys
+    sqlite
   ] ++ lib.optionals stdenv.isDarwin [
     CoreFoundation
     Security
@@ -102,11 +100,12 @@ rustPlatform.buildRustPackage rec {
   # All of these tests require network access and/or docker
   cargoTestFlags = [
     "--workspace"
-    "--exclude beacon_node"
     "--exclude beacon_chain"
+    "--exclude beacon_node"
     "--exclude http_api"
     "--exclude lighthouse"
     "--exclude lighthouse_network"
+    "--exclude network"
     "--exclude slashing_protection"
     "--exclude watch"
     "--exclude web3signer_tests"
@@ -147,11 +146,17 @@ rustPlatform.buildRustPackage rec {
     updateScript = nix-update-script { };
   };
 
+  enableParallelBuilding = true;
+
+  # This is needed by the unit tests.
+  FORK_NAME = "capella";
+
   meta = with lib; {
     description = "Ethereum consensus client in Rust";
     homepage = "https://lighthouse.sigmaprime.io/";
     license = licenses.asl20;
     maintainers = with maintainers; [ centromere pmw ];
     mainProgram = "lighthouse";
+    broken = stdenv.hostPlatform.isDarwin;
   };
 }

pkgs/applications/blockchains/lighthouse/use-c-kzg-from-crates-io.patch

@@ -0,0 +1,11 @@
+diff --git a/crypto/kzg/Cargo.toml b/crypto/kzg/Cargo.toml
+index 7b70166f9..857fa4ee1 100644
+--- a/crypto/kzg/Cargo.toml
++++ b/crypto/kzg/Cargo.toml
+@@ -16,4 +16,4 @@ serde = { workspace = true }
+ ethereum_serde_utils = { workspace = true }
+ hex = { workspace = true }
+ ethereum_hashing = { workspace = true }
+-c-kzg = { git = "https://github.com/ethereum/c-kzg-4844", rev = "748283cced543c486145d5f3f38684becdfe3e1b"}
+\ No newline at end of file
++c-kzg = "0.4.0"

pkgs/applications/blockchains/lighthouse/use-system-sqlite.patch

@@ -1,10 +1,10 @@
 diff --git a/Cargo.toml b/Cargo.toml
-index 62c0e7bd2..a089e3c5b 100644
+index ca55d00d4..76514b545 100644
 --- a/Cargo.toml
 +++ b/Cargo.toml
-@@ -138,7 +138,7 @@ rayon = "1.7"
+@@ -139,7 +139,7 @@ rayon = "1.7"
  regex = "1"
- reqwest = { version = "0.11", default-features = false, features = ["blocking", "json", "stream", "rustls-tls"] }
+ reqwest = { version = "0.11", default-features = false, features = ["blocking", "json", "stream", "rustls-tls", "native-tls-vendored"] }
  ring = "0.16"
 -rusqlite = { version = "0.28", features = ["bundled"] }
 +rusqlite = { version = "0.28" }

pkgs/applications/editors/rehex/default.nix

@@ -20,13 +20,13 @@
 
 stdenv.mkDerivation rec {
   pname = "rehex";
-  version = "0.61.0";
+  version = "0.61.1";
 
   src = fetchFromGitHub {
     owner = "solemnwarning";
     repo = pname;
     rev = version;
-    hash = "sha256-NBBBeTy15q6G30XR2PVd/xdIg41U2pWSPtqpdQX/+9o=";
+    hash = "sha256-/m4s5BW33I9g9hi5j3Vtui271w8Jv91+rQrI3qpO5Og=";
   };
 
   nativeBuildInputs = [ pkg-config which zip ]

pkgs/applications/editors/vscode/extensions/ms-dotnettools.csharp/default.nix

@@ -1,72 +1,63 @@
 { lib
-, fetchurl
 , vscode-utils
 , patchelf
 , icu
 , stdenv
 , openssl
 , coreutils
+,
 }:
 let
   inherit (stdenv.hostPlatform) system;
+  inherit (vscode-utils) buildVscodeMarketplaceExtension;
 
-  version = "1.25.4";
+  extInfo =
-
-  vsixInfo =
     let
-      linuxDebuggerBins = [
+      baseBins = [
+        ".roslyn/Microsoft.CodeAnalysis.LanguageServer"
+        ".razor/rzls"
+      ];
+      linuxBins = baseBins ++ [
         ".debugger/vsdbg-ui"
         ".debugger/vsdbg"
       ];
-      darwinX86DebuggerBins = [
+      darwinBins = baseBins ++ [
         ".debugger/x86_64/vsdbg-ui"
         ".debugger/x86_64/vsdbg"
       ];
-      darwinAarch64DebuggerBins = [
-        ".debugger/arm64/vsdbg-ui"
-        ".debugger/arm64/vsdbg"
-      ];
-      omniSharpBins = [
-        ".omnisharp/1.39.4-net6.0/OmniSharp"
-      ];
-      razorBins = [
-        ".razor/createdump"
-        ".razor/rzls"
-      ];
     in
       {
         x86_64-linux = {
-          url = "https://github.com/OmniSharp/omnisharp-vscode/releases/download/v${version}/csharp-${version}-linux-x64.vsix";
+          arch = "linux-x64";
-          sha256 = "08k0wxyj8wz8npw1yqrkdpbvwbnrdnsngdkrd2p5ayn3v608ifc2";
+          sha256 = "sha256-si4HKGVIHu44QNlNI2WEnMff9+QZOMWiBfWQaaFGyQE=";
-          binaries = linuxDebuggerBins ++ omniSharpBins ++ razorBins;
+          binaries = linuxBins;
         };
         aarch64-linux = {
-          url = "https://github.com/OmniSharp/omnisharp-vscode/releases/download/v${version}/csharp-${version}-linux-arm64.vsix";
+          arch = "linux-arm64";
-          sha256 = "09r2d463dk35905f2c3msqzxa7ylcf0ynhbp3n6d12y3x1200pr2";
+          sha256 = "sha256-1IXkSRgCHOLD4VeCdqyy54MXCBUX5RDDb3pf7GQH5jA=";
-          binaries = linuxDebuggerBins ++ omniSharpBins ++ razorBins;
+          binaries = linuxBins;
         };
         x86_64-darwin = {
-          url = "https://github.com/OmniSharp/omnisharp-vscode/releases/download/v${version}/csharp-${version}-darwin-x64.vsix";
+          arch = "darwin-x64";
-          sha256 = "0mp550kq33zwmlvrhymwnixl4has62imw3ia5z7a01q7mp0w9wpn";
+          sha256 = "sha256-AAbYjZ+YYyGEXSLkiFfluLf7P4OzPhmHzK44N5XT9UI=";
-          binaries = darwinX86DebuggerBins ++ omniSharpBins ++ razorBins;
+          binaries = darwinBins;
         };
         aarch64-darwin = {
-          url = "https://github.com/OmniSharp/omnisharp-vscode/releases/download/v${version}/csharp-${version}-darwin-arm64.vsix";
+          arch = "darwin-arm64";
-          sha256 = "08406xz2raal8f10bmnkz1mwdfprsbkjxzc01v0i4sax1hr2a2yl";
+          sha256 = "sha256-1m47kX0Jo+UvthNfgdoPdBBOcDyCA8DfP+zRk3SicR0=";
-          binaries = darwinAarch64DebuggerBins ++ darwinX86DebuggerBins ++ omniSharpBins ++ razorBins;
+          binaries = darwinBins ++ [
+            ".debugger/arm64/vsdbg-ui"
+            ".debugger/arm64/vsdbg"
+          ];
         };
       }.${system} or (throw "Unsupported system: ${system}");
 in
-vscode-utils.buildVscodeMarketplaceExtension rec {
+buildVscodeMarketplaceExtension {
   mktplcRef = {
     name = "csharp";
     publisher = "ms-dotnettools";
-    inherit version;
+    version = "2.22.3";
-  };
+    inherit (extInfo) sha256 arch;
-
-  vsix = fetchurl {
-    name = "${mktplcRef.publisher}-${mktplcRef.name}.zip";
-    inherit (vsixInfo) url sha256;
   };
 
   nativeBuildInputs = [
@@ -74,63 +65,47 @@ vscode-utils.buildVscodeMarketplaceExtension rec {
   ];
 
   postPatch = ''
-    declare ext_unique_id
+      patchelf_add_icu_as_needed() {
-    # See below as to why we cannot take the whole basename.
+        declare elf="''${1?}"
-    ext_unique_id="$(basename "$out" | head -c 32)"
+        declare icu_major_v="${
+        lib.head (lib.splitVersion (lib.getVersion icu.name))
+      }"
 
-    # Fix 'Unable to connect to debuggerEventsPipeName .. exceeds the maximum length 107.' when
+        for icu_lib in icui18n icuuc icudata; do
-    # attempting to launch a specific test in debug mode. The extension attemps to open
+          patchelf --add-needed "lib''${icu_lib}.so.$icu_major_v" "$elf"
-    # a pipe in extension dir which would fail anyway. We change to target file path
+        done
-    # to a path in tmp dir with a short name based on the unique part of the nix store path.
+      }
-    # This is however a brittle patch as we're working on minified code.
-    # Hence the attempt to only hold on stable names.
-    # However, this really would better be fixed upstream.
-    sed -i \
-      -E -e 's/(this\._pipePath=[a-zA-Z0-9_]+\.join\()([a-zA-Z0-9_]+\.getExtensionPath\(\)[^,]*,)/\1require("os").tmpdir(), "'"$ext_unique_id"'"\+/g' \
-      "$PWD/dist/extension.js"
 
-    # Fix reference to uname
+      patchelf_common() {
-    sed -i \
+        declare elf="''${1?}"
-      -E -e 's_uname -m_${coreutils}/bin/uname -m_g' \
-      "$PWD/dist/extension.js"
 
-    patchelf_add_icu_as_needed() {
+        patchelf_add_icu_as_needed "$elf"
-      declare elf="''${1?}"
+        patchelf --add-needed "libssl.so" "$elf"
-      declare icu_major_v="${
+        patchelf --set-interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" \
-      lib.head (lib.splitVersion (lib.getVersion icu.name))
+          --set-rpath "${lib.makeLibraryPath [stdenv.cc.cc openssl icu.out]}:\$ORIGIN" \
-    }"
+          "$elf"
+      }
 
-      for icu_lib in icui18n icuuc icudata; do
+      substituteInPlace dist/extension.js \
-        patchelf --add-needed "lib''${icu_lib}.so.$icu_major_v" "$elf"
+        --replace 'uname -m' '${lib.getExe' coreutils "uname"} -m'
-      done
-    }
 
-    patchelf_common() {
+    ''
-      declare elf="''${1?}"
+    + (lib.concatStringsSep "\n" (map
-
+      (bin: ''
-      patchelf_add_icu_as_needed "$elf"
+        chmod +x "${bin}"
-      patchelf --add-needed "libssl.so" "$elf"
+      '')
-      patchelf --set-interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" \
+      extInfo.binaries))
-        --set-rpath "${lib.makeLibraryPath [ stdenv.cc.cc openssl icu.out ]}:\$ORIGIN" \
+    + lib.optionalString stdenv.isLinux (lib.concatStringsSep "\n" (map
-        "$elf"
+      (bin: ''
-    }
+        patchelf_common "${bin}"
-
+      '')
-  '' + (lib.concatStringsSep "\n" (map
+      extInfo.binaries));
-    (bin: ''
-      chmod +x "${bin}"
-    '')
-    vsixInfo.binaries))
-  + lib.optionalString stdenv.isLinux (lib.concatStringsSep "\n" (map
-    (bin: ''
-      patchelf_common "${bin}"
-    '')
-    vsixInfo.binaries));
 
   meta = {
-    description = "C# for Visual Studio Code (powered by OmniSharp)";
+    description = "Official C# support for Visual Studio Code";
-    homepage = "https://github.com/OmniSharp/omnisharp-vscode";
+    homepage = "https://github.com/dotnet/vscode-csharp";
     license = lib.licenses.mit;
-    maintainers = [ lib.maintainers.jraygauthier ];
+    maintainers = with lib.maintainers; [ ggg ];
     platforms = [ "x86_64-linux" "aarch64-linux" "x86_64-darwin" "aarch64-darwin" ];
   };
 }

pkgs/applications/editors/vscode/vscode.nix

@@ -30,21 +30,21 @@ let
   archive_fmt = if stdenv.isDarwin then "zip" else "tar.gz";
 
   sha256 = {
-    x86_64-linux = "1sasd183cf264a8am93ck35b485p5vl2bfzzxzpf65rvcmvhn7fh";
+    x86_64-linux = "11brsgksn3bl3px0hwa83vr22gb2k19pn8hcn7xwn6zzcgf7rsf2";
-    x86_64-darwin = "01nfh5izc53sxfw27i0byn0l6q4qwp7y9zs0g9a3rx3qglm47qr8";
+    x86_64-darwin = "1ai7jmiq37zpicc5p387nvbx5122fp7c3qh2k596jq7l7k0iyfzd";
-    aarch64-linux = "183583xnjv18ksy8bbkjfkxx3zy22anj14hi8bavhgix9bzk3wrb";
+    aarch64-linux = "0psjz56h8asgdh0m6insfysw1f6d00hifvb0rfsi8qv0wca72wb4";
-    aarch64-darwin = "1whjm4z922qq1yh4vliiab777n0la6sc45n2qf7q9pvxjj1f83wj";
+    aarch64-darwin = "0jskk6dvjg290mvw8hcs4hrhy7m3ridsj5w9lxs6kn74fdvg1byb";
-    armv7l-linux = "171diqiv9yb9c5klihndsgk7qp7y80cc6bq8r4hnw1b834k0ywfp";
+    armv7l-linux = "0rz26xw312s0larjvkrf8np9c0yccppadiqmj69j47vavg78274c";
   }.${system} or throwSystem;
 in
   callPackage ./generic.nix rec {
     # Please backport all compatible updates to the stable release.
     # This is important for the extension ecosystem.
-    version = "1.87.1";
+    version = "1.87.2";
     pname = "vscode" + lib.optionalString isInsiders "-insiders";
 
     # This is used for VS Code - Remote SSH test
-    rev = "1e790d77f81672c49be070e04474901747115651";
+    rev = "863d2581ecda6849923a2118d93a088b0745d9d6";
 
     executableName = "code" + lib.optionalString isInsiders "-insiders";
     longName = "Visual Studio Code" + lib.optionalString isInsiders " - Insiders";
@@ -68,7 +68,7 @@ in
       src = fetchurl {
         name = "vscode-server-${rev}.tar.gz";
         url = "https://update.code.visualstudio.com/commit:${rev}/server-linux-x64/stable";
-        sha256 = "19k2n1zlfvy1dczrslrdzhvpa27nc0mcg2x4bmp5yvvv5bpv3bbd";
+        sha256 = "1hdny44f93qzpm9vgx14wk1myrnsv5qcj25rqcy2jb5kspnq6813";
       };
     };
 

pkgs/applications/graphics/lightburn/default.nix

@@ -6,7 +6,7 @@
 
 stdenv.mkDerivation rec {
   pname = "lightburn";
-  version = "1.5.02";
+  version = "1.5.03";
 
   nativeBuildInputs = [
     p7zip
@@ -15,7 +15,7 @@ stdenv.mkDerivation rec {
 
   src = fetchurl {
     url = "https://github.com/LightBurnSoftware/deployment/releases/download/${version}/LightBurn-Linux64-v${version}.7z";
-    sha256 = "sha256-1gmiPWrNk3T8WJ9u/4UzrhwxOcPUKyWIqtwqJiXA4c4=";
+    sha256 = "sha256-p1vbpxRrcNInftBkVVhIckVsrZQRvlk/323D5zIjXJ8=";
   };
 
   buildInputs = [

pkgs/applications/graphics/opentoonz/default.nix

@@ -36,6 +36,7 @@ in stdenv.mkDerivation rec {
 
   cmakeDir = "../sources";
   cmakeFlags = [
+    "-DCMAKE_SKIP_BUILD_RPATH=ON"
     "-DTIFF_INCLUDE_DIR=${libtiff.dev}/include"
     "-DTIFF_LIBRARY=${libtiff.out}/lib/libtiff.so"
   ];

pkgs/applications/graphics/opentoonz/source.nix

@@ -3,7 +3,7 @@
 
 { fetchFromGitHub, }: rec {
   versions = {
-    opentoonz = "1.5.0";
+    opentoonz = "1.7.1";
     libtiff = "4.0.3";  # The version in thirdparty/tiff-*
   };
 
@@ -11,6 +11,6 @@
     owner = "opentoonz";
     repo = "opentoonz";
     rev = "v${versions.opentoonz}";
-    sha256 = "1rw30ksw3zjph1cwxkfvqj0330v8wd4333gn0fdf3cln1w0549lk";
+    hash = "sha256-5iXOvh4QTv+G0fjEHU62u7QCee+jbvKhK0+fQXbdJis=";
   };
 }

pkgs/applications/graphics/photoqt/default.nix

@@ -20,16 +20,17 @@
 , qtmultimedia
 , qtpositioning
 , qtsvg
+, zxing-cpp
 , qtwayland
 }:
 
 stdenv.mkDerivation rec {
   pname = "photoqt";
-  version = "4.2";
+  version = "4.3";
 
   src = fetchurl {
     url = "https://photoqt.org/pkgs/photoqt-${version}.tar.gz";
-    hash = "sha256-OUqsyvmv6ccJDzcWAeS1OOmK2eXOCEgGktz6GEUzoA8=";
+    hash = "sha256-B0ZubvWIEZFnD2v74bpPv+/wr7vaHS9QP4//9/afjzQ=";
   };
 
   nativeBuildInputs = [
@@ -55,20 +56,19 @@ stdenv.mkDerivation rec {
     qtmultimedia
     qtpositioning
     qtsvg
+    zxing-cpp
   ] ++ lib.optionals stdenv.isLinux [
     qtwayland
   ];
 
   cmakeFlags = [
-    "-DDEVIL=OFF"
+    (lib.cmakeBool "DEVIL" false)
-    "-DCHROMECAST=OFF"
+    (lib.cmakeBool "CHROMECAST" false)
-    "-DFREEIMAGE=OFF"
+    (lib.cmakeBool "FREEIMAGE" false)
-    "-DIMAGEMAGICK=OFF"
+    (lib.cmakeBool "IMAGEMAGICK" false)
   ];
 
-  preConfigure = ''
+  env.MAGICK_LOCATION = "${graphicsmagick}/include/GraphicsMagick";
-    export MAGICK_LOCATION="${graphicsmagick}/include/GraphicsMagick"
-  '';
 
   postInstall = lib.optionalString stdenv.isDarwin ''
     mkdir -p $out/Applications

pkgs/applications/misc/chatblade/default.nix

@@ -2,12 +2,12 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "chatblade";
-  version = "0.3.4";
+  version = "0.4.0";
   format = "setuptools";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-ODC8n4JS7IOfAJMn7CPzJcBNMhfD5A3eEqVUK1e4mZY=";
+    sha256 = "sha256-AjE+1MkSkZOtEUPKEPBKQ3n+aOB8cwsorBpL5skNskU=";
   };
 
   doCheck = false; # there are no tests

pkgs/applications/misc/hcl2json/default.nix

@@ -5,16 +5,16 @@
 
 buildGoModule rec {
   pname = "hcl2json";
-  version = "0.6.1";
+  version = "0.6.2";
 
   src = fetchFromGitHub {
     owner = "tmccombs";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-6DCxpnTizTg3uhHIIze2IyA8IKcjIv44XoId7exdQZI=";
+    sha256 = "sha256-lnmWIyS1byXvShR1/ej8PAuo+WJBEBykQwJ79439Fus=";
   };
 
-  vendorHash = "sha256-Ay6Sgdm7X+NxtLkFM0AT8aoWLdASjUhcidRUiV2K+us=";
+  vendorHash = "sha256-HbdectUQgyQZ9qcfBarwRTF3VjzSqaM2vhVekThv2+k=";
 
   subPackages = [ "." ];
 

pkgs/applications/misc/inlyne/default.nix

@@ -6,6 +6,8 @@
 , pkg-config
 , fontconfig
 , xorg
+, libxkbcommon
+, wayland
 , libGL
 , openssl
 , darwin
@@ -13,16 +15,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "inlyne";
-  version = "0.3.2";
+  version = "0.4.0";
 
   src = fetchFromGitHub {
     owner = "trimental";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-DSi6iS1ySdvGf6FxZpsDOAFpAKx/APcZjxA3Qy0gQBU=";
+    hash = "sha256-dDGTy5WOCyeWYfemVtv+YswNyHSqDL4C7MbHsKgRwLk=";
   };
 
-  cargoHash = "sha256-UzegSJGAOBUDN8WluN7fLWS7NfHhm9YY0Zuq6DCIqHo=";
+  cargoHash = "sha256-GDy7/FooHD77X5dZmlLX+isRKr2WjadKPKyVD55M9ZE=";
 
   nativeBuildInputs = [
     installShellFiles
@@ -36,6 +38,8 @@ rustPlatform.buildRustPackage rec {
     xorg.libXi
     xorg.libXrandr
     xorg.libxcb
+    wayland
+    libxkbcommon
     openssl
   ] ++ lib.optionals stdenv.isDarwin [
     darwin.apple_sdk_11_0.frameworks.AppKit

pkgs/applications/misc/valent/default.nix

@@ -82,7 +82,7 @@ stdenv.mkDerivation rec {
     homepage = "https://valent.andyholmes.ca";
     changelog = "https://github.com/andyholmes/valent/blob/${src.rev}/CHANGELOG.md";
     license = with licenses; [ gpl3Plus cc0 cc-by-sa-30 ];
-    maintainers = with maintainers; [ federicoschonborn aleksana ];
+    maintainers = with maintainers; [ aleksana ];
     platforms = platforms.linux;
   };
 }

pkgs/applications/misc/whalebird/default.nix

@@ -1,38 +1,54 @@
-{ lib, stdenv, fetchurl
+{ lib
-, autoPatchelfHook, makeDesktopItem, copyDesktopItems, makeWrapper, gnugrep, asar
+, stdenv
-, electron, python3, alsa-lib, gtk3, libdbusmenu, libxshmfence, mesa, nss
+, fetchFromGitHub
+, makeDesktopItem
+, copyDesktopItems
+, makeWrapper
+, electron
+, cacert
+, gitMinimal
+, yarn
 }:
-
 stdenv.mkDerivation rec {
   pname = "whalebird";
-  version = "5.0.7";
+  version = "6.0.4";
 
-  src = let
+  src = fetchFromGitHub {
-    downloads = "https://github.com/h3poteto/whalebird-desktop/releases/download/v${version}";
+    owner = "h3poteto";
-  in
+    repo = "whalebird-desktop";
-    if stdenv.system == "x86_64-linux" then
+    rev = "v${version}";
-      fetchurl {
+    hash = "sha256-Yx0GEEPJ+d4/RvCbqZdKR6iE2iUNbOJr+RuboqjT8z8=";
-        url = downloads + "/Whalebird-${version}-linux-x64.tar.bz2";
+  };
-        hash = "sha256-eufP038REwF2VwAxxI8R0S3fE8oJ+SX/CES5ozuut2w=";
+  # we cannot use fetchYarnDeps because that doesn't support yarn 2/berry lockfiles
-      }
+  offlineCache = stdenv.mkDerivation {
-    else if stdenv.system == "aarch64-linux" then
+    name = "whalebird-${version}-offline-cache";
-      fetchurl {
+    inherit src;
-        url = downloads + "/Whalebird-${version}-linux-arm64.tar.bz2";
+
-        hash = "sha256-U0xVTUUm6wsRxYc1w4vfNtVE6o8dNzXTSi+IX4mgDEE=";
+    nativeBuildInputs = [
-      }
+      cacert # needed for git
-    else
+      gitMinimal # needed to download git dependencies
-      throw "Whalebird is not supported for ${stdenv.system}";
+      yarn
+    ];
+
+    buildPhase = ''
+      export HOME=$(mktemp -d)
+      yarn config set enableTelemetry 0
+      yarn config set cacheFolder $out
+      yarn config set --json supportedArchitectures.os '[ "linux" ]'
+      yarn config set --json supportedArchitectures.cpu '[ "arm64", "x64" ]'
+      yarn
+    '';
+
+    outputHashMode = "recursive";
+    outputHash = "sha256-RjTGAgHRRQ4O3eTYpmTrl+KXafDZkWf1NH6lzdozVAA=";
+  };
 
   nativeBuildInputs = [
-    autoPatchelfHook
     makeWrapper
     copyDesktopItems
-    gnugrep
+    yarn
-    asar
   ];
 
-  buildInputs = [ alsa-lib gtk3 libdbusmenu libxshmfence mesa nss ];
-
   desktopItems = [
     (makeDesktopItem {
       desktopName = "Whalebird";
@@ -44,28 +60,21 @@ stdenv.mkDerivation rec {
     })
   ];
 
-  unpackPhase = ''
+  ELECTRON_SKIP_BINARY_DOWNLOAD = "1";
-    mkdir -p opt
-    tar -xf ${src} -C opt
-    # remove the version/target suffix from the untar'd directory
-    mv opt/Whalebird-* opt/Whalebird
-  '';
 
   buildPhase = ''
     runHook preBuild
 
-    # Necessary steps to find the tray icon
+    export HOME=$(mktemp -d)
-    # For aarch64-linux, we need to overwrite this symlink first as it points to
+    yarn config set enableTelemetry 0
-    # /usr/bin/python3
+    yarn config set cacheFolder ${offlineCache}
-    if [ "${stdenv.system}" = "aarch64-linux" ]
+
-    then ln -sf ${python3}/bin/python3 \
+    yarn --immutable-cache
-      opt/Whalebird/resources/app.asar.unpacked/node_modules/better-sqlite3/build/node_gyp_bins/python3
+    yarn run nextron build --no-pack
-    fi
+    yarn run electron-builder --dir \
-    asar extract opt/Whalebird/resources/app.asar "$TMP/work"
+      --config electron-builder.yml \
-    substituteInPlace "$TMP/work/dist/electron/main.js" \
+      -c.electronDist="${electron}/libexec/electron" \
-      --replace "$(grep -oE '.{2},"tray_icon.png"' "$TMP/work/dist/electron/main.js")" \
+      -c.electronVersion=${electron.version}
-        "\"$out/opt/Whalebird/resources/build/icons/tray_icon.png\""
-    asar pack --unpack='{*.node,*.ftz,rect-overlay}' "$TMP/work" opt/Whalebird/resources/app.asar
 
     runHook postBuild
   '';
@@ -73,26 +82,29 @@ stdenv.mkDerivation rec {
   installPhase = ''
     runHook preInstall
 
-    mkdir $out
+    mkdir -p $out/opt
-    mv opt $out
+    cp -r ./dist/linux-unpacked $out/opt/Whalebird
 
-    # install icons
+    # Install icons
-    for icon in $out/opt/Whalebird/resources/build/icons/*.png; do
+    # Taken from https://aur.archlinux.org/cgit/aur.git/tree/PKGBUILD?h=whalebird#n41
-      mkdir -p "$out/share/icons/hicolor/$(basename $icon .png)/apps"
+    for i in 16 32 128 256 512; do
-      ln -s "$icon" "$out/share/icons/hicolor/$(basename $icon .png)/apps/whalebird.png"
+      install -Dm644 "resources/icons/icon.iconset/icon_$i"x"$i.png" \
+        "$out/share/icons/hicolor/$i"x"$i/apps/whalebird.png"
     done
+    install -Dm644 "resources/icons/icon.iconset/icon_32x32@2x.png" \
+      "$out/share/icons/hicolor/64x64/apps/whalebird.png"
 
-    makeWrapper ${electron}/bin/electron $out/bin/whalebird \
+    makeWrapper "${electron}/bin/electron" "$out/bin/whalebird" \
-      --add-flags $out/opt/Whalebird/resources/app.asar \
+      --add-flags "$out/opt/Whalebird/resources/app.asar" \
       --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--ozone-platform-hint=auto --enable-features=WaylandWindowDecorations}}"
 
     runHook postInstall
   '';
 
   meta = with lib; {
-    description = "Electron based Mastodon, Pleroma and Misskey client for Windows, Mac and Linux";
+    description = "Single-column Fediverse client for desktop";
     homepage = "https://whalebird.social";
-    sourceProvenance = with sourceTypes; [ binaryNativeCode ];
+    sourceProvenance = with sourceTypes; [ fromSource ];
     license = licenses.gpl3Only;
     maintainers = with maintainers; [ wolfangaukang colinsane weathercold ];
     platforms = [ "x86_64-linux" "aarch64-linux" ];

pkgs/applications/networking/browsers/brave/default.nix

@@ -94,11 +94,11 @@ in
 
 stdenv.mkDerivation rec {
   pname = "brave";
-  version = "1.63.169";
+  version = "1.63.174";
 
   src = fetchurl {
     url = "https://github.com/brave/brave-browser/releases/download/v${version}/brave-browser_${version}_amd64.deb";
-    hash = "sha256-K8zbsxwKcYuhW7m7ijrAOeHHpC2AhM4Kr2M7SwGlV70=";
+    hash = "sha256-COy1XwooN0agp5dLDVUAfhpFvgubbClaGrUQ5PFgTJk=";
   };
 
   dontConfigure = true;

pkgs/applications/networking/browsers/chromium/upstream-info.nix

@@ -28,12 +28,12 @@
         version = "2024-01-22";
       };
       ungoogled-patches = {
-        hash = "sha256-7c4VQLotLHmSFKfzzXrlwXKB3XPFpyRTnuATrS9RfEw=";
+        hash = "sha256-YIJysusNifUPN3Ii2tCUSvHEe63RWlTrTdOt5KBVyK4=";
-        rev = "122.0.6261.111-1";
+        rev = "122.0.6261.128-1";
       };
     };
-    hash = "sha256-43h11bx/k78W7fEPZz4LwxNVExwGSSt74mlbiUYf5ig=";
+    hash = "sha256-BzLSwDQrmKavh4s2uOSfP935NnB5+Hw7oD7YDbSWp2g=";
-    hash_deb_amd64 = "sha256-juwTFdJB1hgAA14aabNIrql5aaP1JWQy7nOsoTF2Vto=";
+    hash_deb_amd64 = "sha256-SxdYfWhV3ZpiGWmagOM6JUfjAmU9pzFGDQDinXrweas=";
-    version = "122.0.6261.111";
+    version = "122.0.6261.128";
   };
 }

pkgs/applications/networking/browsers/polypane/default.nix

@@ -2,12 +2,12 @@
 
 let
   pname = "polypane";
-  version = "18.0.0";
+  version = "18.0.4";
 
   src = fetchurl {
     url = "https://github.com/firstversionist/${pname}/releases/download/v${version}/${pname}-${version}.AppImage";
     name = "${pname}-${version}.AppImage";
-    sha256 = "sha256-d2A+edQJKyChNCA7QH+YjlcIlHYVghX3UP60ZZBtP1s=";
+    sha256 = "sha256-FqaXLoFgkKHzOvy7f9R36uIDnv2c6HrVF6T3VK5Aw3c=";
   };
 
   appimageContents = appimageTools.extractType2 {

pkgs/applications/networking/cluster/glooctl/default.nix

@@ -6,13 +6,13 @@
 
 buildGoModule rec {
   pname = "glooctl";
-  version = "1.16.6";
+  version = "1.16.7";
 
   src = fetchFromGitHub {
     owner = "solo-io";
     repo = "gloo";
     rev = "v${version}";
-    hash = "sha256-vn04bNkg0De46kLcyuaWt9watBXFIGI+4X8SBW3XNyg=";
+    hash = "sha256-046zHSvJY9kl/vY8TL62TUYkg+otvchq0DIyDsro/+U=";
   };
 
   vendorHash = "sha256-UyzqKpF2WBj25Bm4MtkF6yjl87A61vGsteBNCjJV178=";

pkgs/applications/networking/cluster/helm/default.nix

@@ -2,15 +2,15 @@
 
 buildGoModule rec {
   pname = "kubernetes-helm";
-  version = "3.14.2";
+  version = "3.14.3";
 
   src = fetchFromGitHub {
     owner = "helm";
     repo = "helm";
     rev = "v${version}";
-    sha256 = "sha256-7Cd5lxPSXXCvYLLh334qnDmd9zbF1LMxTNoZEBpzHS4=";
+    sha256 = "sha256-GC9rkB35m+a/9pEvD7aNjE4z3qrv33NES842crrzD3I=";
   };
-  vendorHash = "sha256-pYB9J7Zf6MApGpFL7HzqIDcC/vERiVE4z8SsipIeJ7c=";
+  vendorHash = "sha256-f5tLyq9tP5tdE73Mlee9vAUSHqkUAtAJkwjZP/K6wPM=";
 
   subPackages = [ "cmd/helm" ];
   ldflags = [

pkgs/applications/networking/cluster/k3s/1_24/chart-versions.nix

@@ -1,10 +0,0 @@
-{
-    traefik-crd  = {
-        url = "https://k3s.io/k3s-charts/assets/traefik-crd/traefik-crd-20.3.1+up20.3.0.tgz";
-        sha256 = "1775vjldvqvhzdbzanxhbaqbmkih09yb91im651q8bc7z5sb9ckn";
-    };
-    traefik = {
-        url = "https://k3s.io/k3s-charts/assets/traefik/traefik-20.3.1+up20.3.0.tgz";
-        sha256 = "1rj0f0n0vgjcbzfwzhqmsd501i2f6vw145w9plbp8gwdyzmg2nc6";
-    };
-}

pkgs/applications/networking/cluster/k3s/1_24/default.nix

@@ -1,332 +0,0 @@
-{ stdenv
-, lib
-, makeWrapper
-, socat
-, iptables
-, iproute2
-, ipset
-, bridge-utils
-, btrfs-progs
-, conntrack-tools
-, buildGoModule
-, runc
-, rsync
-, kmod
-, libseccomp
-, pkg-config
-, ethtool
-, util-linux
-, fetchFromGitHub
-, fetchurl
-, fetchzip
-, fetchgit
-, zstd
-, yq-go
-, sqlite
-, nixosTests
-, k3s
-, pkgsBuildBuild
-}:
-
-# k3s is a kinda weird derivation. One of the main points of k3s is the
-# simplicity of it being one binary that can perform several tasks.
-# However, when you have a good package manager (like nix), that doesn't
-# actually make much of a difference; you don't really care if it's one binary
-# or 10 since with a good package manager, installing and running it is
-# identical.
-# Since upstream k3s packages itself as one large binary with several
-# "personalities" (in the form of subcommands like 'k3s agent' and 'k3s
-# kubectl'), it ends up being easiest to mostly mimic upstream packaging, with
-# some exceptions.
-# K3s also carries patches to some packages (such as containerd and cni
-# plugins), so we intentionally use the k3s versions of those binaries for k3s,
-# even if the upstream version of those binaries exist in nixpkgs already. In
-# the end, that means we have a thick k3s binary that behaves like the upstream
-# one for the most part.
-# However, k3s also bundles several pieces of unpatched software, from the
-# strongswan vpn software, to iptables, to socat, conntrack, busybox, etc.
-# Those pieces of software we entirely ignore upstream's handling of, and just
-# make sure they're in the path if desired.
-let
-  k3sVersion = "1.24.10+k3s1";     # k3s git tag
-  k3sCommit = "546a94e9ae1c3be6f9c0dcde32a6e6672b035bc8"; # k3s git commit at the above version
-  k3sRepoSha256 = "sha256-HfkGb3GtR2wQkVIze26aFh6A6W0fegr8ovpSel7oujQ=";
-  k3sVendorHash = "sha256-YAerisDr/knlKPaO2fVMZA4FUpwshFmkpi3mJAmLqKM=";
-
-  # Based on the traefik charts here: https://github.com/k3s-io/k3s/blob/v1.24.10%2Bk3s1/scripts/download#L29-L32
-  # see also https://github.com/k3s-io/k3s/blob/v1.24.10%2Bk3s1/manifests/traefik.yaml#L8-L16
-  # At the time of writing, there are two traefik charts, and that's it
-  charts = import ./chart-versions.nix;
-
-  # taken from ./scripts/version.sh VERSION_ROOT https://github.com/k3s-io/k3s/blob/v1.24.10%2Bk3s1/scripts/version.sh#L56
-  k3sRootVersion = "0.12.1";
-  k3sRootSha256 = "sha256-xCXbarWztnvW2xn3cGa84hie3OevVZeGEDWh+Uf3RBw=";
-
-  # taken from ./scripts/version.sh VERSION_CNIPLUGINS https://github.com/k3s-io/k3s/blob/v1.24.10%2Bk3s1/scripts/version.sh#L49
-  k3sCNIVersion = "1.1.1-k3s1";
-  k3sCNISha256 = "14mb3zsqibj1sn338gjmsyksbm0mxv9p016dij7zidccx2rzn6nl";
-
-  # taken from go.mod, the 'github.com/containerd/containerd' line
-  # run `grep github.com/containerd/containerd go.mod | head -n1 | awk '{print $4}'`
-  # https://github.com/k3s-io/k3s/blob/v1.24.10%2Bk3s1/go.mod#L10
-  containerdVersion = "1.5.16-k3s1";
-  containerdSha256 = "sha256-dxC44qE1A20Hd2j77Ir9Sla8xncttswWIuGGM/5FWi8=";
-
-  # run `grep github.com/kubernetes-sigs/cri-tools go.mod | head -n1 | awk '{print $4}'` in the k3s repo at the tag
-  # https://github.com/k3s-io/k3s/blob/v1.24.10%2Bk3s1/go.mod#L18
-  criCtlVersion = "1.24.0-k3s1";
-
-  baseMeta = k3s.meta;
-
-  # https://github.com/k3s-io/k3s/blob/5fb370e53e0014dc96183b8ecb2c25a61e891e76/scripts/build#L19-L40
-  versionldflags = [
-    "-X github.com/rancher/k3s/pkg/version.Version=v${k3sVersion}"
-    "-X github.com/rancher/k3s/pkg/version.GitCommit=${lib.substring 0 8 k3sCommit}"
-    "-X k8s.io/client-go/pkg/version.gitVersion=v${k3sVersion}"
-    "-X k8s.io/client-go/pkg/version.gitCommit=${k3sCommit}"
-    "-X k8s.io/client-go/pkg/version.gitTreeState=clean"
-    "-X k8s.io/client-go/pkg/version.buildDate=1970-01-01T01:01:01Z"
-    "-X k8s.io/component-base/version.gitVersion=v${k3sVersion}"
-    "-X k8s.io/component-base/version.gitCommit=${k3sCommit}"
-    "-X k8s.io/component-base/version.gitTreeState=clean"
-    "-X k8s.io/component-base/version.buildDate=1970-01-01T01:01:01Z"
-    "-X github.com/kubernetes-sigs/cri-tools/pkg/version.Version=v${criCtlVersion}"
-    "-X github.com/containerd/containerd/version.Version=v${containerdVersion}"
-    "-X github.com/containerd/containerd/version.Package=github.com/k3s-io/containerd"
-  ];
-
-  # bundled into the k3s binary
-  traefikChart = fetchurl charts.traefik;
-  traefik-crdChart = fetchurl charts.traefik-crd;
-
-  # so, k3s is a complicated thing to package
-  # This derivation attempts to avoid including any random binaries from the
-  # internet. k3s-root is _mostly_ binaries built to be bundled in k3s (which
-  # we don't care about doing, we can add those as build or runtime
-  # dependencies using a real package manager).
-  # In addition to those binaries, it's also configuration though (right now
-  # mostly strongswan configuration), and k3s does use those files.
-  # As such, we download it in order to grab 'etc' and bundle it into the final
-  # k3s binary.
-  k3sRoot = fetchzip {
-    # Note: marked as apache 2.0 license
-    url = "https://github.com/k3s-io/k3s-root/releases/download/v${k3sRootVersion}/k3s-root-amd64.tar";
-    sha256 = k3sRootSha256;
-    stripRoot = false;
-  };
-  k3sCNIPlugins = buildGoModule rec {
-    pname = "k3s-cni-plugins";
-    version = k3sCNIVersion;
-    vendorHash = null;
-
-    subPackages = [ "." ];
-
-    src = fetchFromGitHub {
-      owner = "rancher";
-      repo = "plugins";
-      rev = "v${version}";
-      sha256 = k3sCNISha256;
-    };
-
-    postInstall = ''
-      mv $out/bin/plugins $out/bin/cni
-    '';
-
-    meta = baseMeta // {
-      description = "CNI plugins, as patched by rancher for k3s";
-    };
-  };
-  # Grab this separately from a build because it's used by both stages of the
-  # k3s build.
-  k3sRepo = fetchgit {
-    url = "https://github.com/k3s-io/k3s";
-    rev = "v${k3sVersion}";
-    sha256 = k3sRepoSha256;
-  };
-  # Stage 1 of the k3s build:
-  # Let's talk about how k3s is structured.
-  # One of the ideas of k3s is that there's the single "k3s" binary which can
-  # do everything you need, from running a k3s server, to being a worker node,
-  # to running kubectl.
-  # The way that actually works is that k3s is a single go binary that contains
-  # a bunch of bindata that it unpacks at runtime into directories (either the
-  # user's home directory or /var/lib/rancher if run as root).
-  # This bindata includes both binaries and configuration.
-  # In order to let nixpkgs do all its autostripping/patching/etc, we split this into two derivations.
-  # First, we build all the binaries that get packed into the thick k3s binary
-  # (and output them from one derivation so they'll all be suitably patched up).
-  # Then, we bundle those binaries into our thick k3s binary and use that as
-  # the final single output.
-  # This approach was chosen because it ensures the bundled binaries all are
-  # correctly built to run with nix (we can lean on the existing buildGoModule
-  # stuff), and we can again lean on that tooling for the final k3s binary too.
-  # Other alternatives would be to manually run the
-  # strip/patchelf/remove-references step ourselves in the installPhase of the
-  # derivation when we've built all the binaries, but haven't bundled them in
-  # with generated bindata yet.
-
-  k3sServer = buildGoModule rec {
-    pname = "k3s-server";
-    version = k3sVersion;
-
-    src = k3sRepo;
-    vendorHash = k3sVendorHash;
-
-    nativeBuildInputs = [ pkg-config ];
-    buildInputs = [ libseccomp sqlite.dev ];
-
-    subPackages = [ "cmd/server" ];
-    ldflags = versionldflags;
-
-    tags = [ "libsqlite3" "linux" ];
-
-    # create the multicall symlinks for k3s
-    postInstall = ''
-      mv $out/bin/server $out/bin/k3s
-      pushd $out
-      # taken verbatim from https://github.com/k3s-io/k3s/blob/v1.24.10%2Bk3s1/scripts/build#L123-L131
-      ln -s k3s ./bin/k3s-agent
-      ln -s k3s ./bin/k3s-server
-      ln -s k3s ./bin/k3s-etcd-snapshot
-      ln -s k3s ./bin/k3s-secrets-encrypt
-      ln -s k3s ./bin/k3s-certificate
-      ln -s k3s ./bin/k3s-completion
-      ln -s k3s ./bin/kubectl
-      ln -s k3s ./bin/crictl
-      ln -s k3s ./bin/ctr
-      popd
-    '';
-
-    meta = baseMeta // {
-      description = "The various binaries that get packaged into the final k3s binary";
-    };
-  };
-  k3sContainerd = buildGoModule {
-    pname = "k3s-containerd";
-    version = containerdVersion;
-    src = fetchFromGitHub {
-      owner = "k3s-io";
-      repo = "containerd";
-      rev = "v${containerdVersion}";
-      sha256 = containerdSha256;
-    };
-    vendorHash = null;
-    buildInputs = [ btrfs-progs ];
-    subPackages = [ "cmd/containerd" "cmd/containerd-shim-runc-v2" ];
-    ldflags = versionldflags;
-  };
-in
-buildGoModule rec {
-  pname = "k3s";
-  version = k3sVersion;
-
-  src = k3sRepo;
-  vendorHash = k3sVendorHash;
-
-  postPatch = ''
-    # Nix prefers dynamically linked binaries over static binary.
-
-    substituteInPlace scripts/package-cli \
-      --replace '"$LDFLAGS $STATIC" -o' \
-                '"$LDFLAGS" -o' \
-      --replace "STATIC=\"-extldflags \'-static\'\"" \
-                ""
-
-    # Upstream codegen fails with trimpath set. Removes "trimpath" for 'go generate':
-
-    substituteInPlace scripts/package-cli \
-      --replace '"''${GO}" generate' \
-                'GOFLAGS="" \
-                 GOOS="${pkgsBuildBuild.go.GOOS}" \
-                 GOARCH="${pkgsBuildBuild.go.GOARCH}" \
-                 CC="${pkgsBuildBuild.stdenv.cc}/bin/cc" \
-                 "''${GO}" generate'
-  '';
-
-  # Important utilities used by the kubelet, see
-  # https://github.com/kubernetes/kubernetes/issues/26093#issuecomment-237202494
-  # Note the list in that issue is stale and some aren't relevant for k3s.
-  k3sRuntimeDeps = [
-    kmod
-    socat
-    iptables
-    iproute2
-    ipset
-    bridge-utils
-    ethtool
-    util-linux # kubelet wants 'nsenter' from util-linux: https://github.com/kubernetes/kubernetes/issues/26093#issuecomment-705994388
-    conntrack-tools
-  ];
-
-  buildInputs = k3sRuntimeDeps;
-
-  nativeBuildInputs = [
-    makeWrapper
-    rsync
-    yq-go
-    zstd
-  ];
-
-  # embedded in the final k3s cli
-  propagatedBuildInputs = [
-    k3sCNIPlugins
-    k3sContainerd
-    k3sServer
-    runc
-  ];
-
-  # We override most of buildPhase due to peculiarities in k3s's build.
-  # Specifically, it has a 'go generate' which runs part of the package. See
-  # this comment:
-  # https://github.com/NixOS/nixpkgs/pull/158089#discussion_r799965694
-  # So, why do we use buildGoModule at all? For the `vendorHash` / `go mod download` stuff primarily.
-  buildPhase = ''
-    patchShebangs ./scripts/package-cli ./scripts/download ./scripts/build-upload
-
-    # copy needed 'go generate' inputs into place
-    mkdir -p ./bin/aux
-    rsync -a --no-perms ${k3sServer}/bin/ ./bin/
-    ln -vsf ${runc}/bin/runc ./bin/runc
-    ln -vsf ${k3sCNIPlugins}/bin/cni ./bin/cni
-    ln -vsf ${k3sContainerd}/bin/* ./bin/
-    rsync -a --no-perms --chmod u=rwX ${k3sRoot}/etc/ ./etc/
-    mkdir -p ./build/static/charts
-
-    cp ${traefikChart} ./build/static/charts
-    cp ${traefik-crdChart} ./build/static/charts
-
-    export ARCH=$GOARCH
-    export DRONE_TAG="v${k3sVersion}"
-    export DRONE_COMMIT="${k3sCommit}"
-    # use ./scripts/package-cli to run 'go generate' + 'go build'
-
-    ./scripts/package-cli
-    mkdir -p $out/bin
-  '';
-
-  # Otherwise it depends on 'getGoDirs', which is normally set in buildPhase
-  doCheck = false;
-
-  installPhase = ''
-    # wildcard to match the arm64 build too
-    install -m 0755 dist/artifacts/k3s* -D $out/bin/k3s
-    wrapProgram $out/bin/k3s \
-      --prefix PATH : ${lib.makeBinPath k3sRuntimeDeps} \
-      --prefix PATH : "$out/bin"
-    ln -s $out/bin/k3s $out/bin/kubectl
-    ln -s $out/bin/k3s $out/bin/crictl
-    ln -s $out/bin/k3s $out/bin/ctr
-  '';
-
-  doInstallCheck = true;
-  installCheckPhase = ''
-    $out/bin/k3s --version | grep -F "v${k3sVersion}" >/dev/null
-  '';
-
-  # Fix-Me: Needs to be adapted specifically for 1.24
-  # passthru.updateScript = ./update.sh;
-
-  passthru.tests = k3s.passthru.mkTests k3sVersion;
-
-  meta = baseMeta;
-}

pkgs/applications/networking/cluster/k3s/1_25/0001-script-download-strip-downloading-just-package-CRD.patch

@@ -1,41 +0,0 @@
-From 6f53bd36a40da4c71486e3b79f6e32d53d6eea5d Mon Sep 17 00:00:00 2001
-From: Euan Kemp <euank@euank.com>
-Date: Thu, 3 Feb 2022 23:50:40 -0800
-Subject: [PATCH 2/2] scrips/download: strip downloading, just package CRD
-
-The CRD packaging is a complicated set of commands, so let's reuse it.
----
- scripts/download | 10 ++--------
- 1 file changed, 2 insertions(+), 8 deletions(-)
-
-diff --git a/scripts/download b/scripts/download
-index 5effc0562a..82361803ee 100755
---- a/scripts/download
-+++ b/scripts/download
-@@ -24,12 +24,6 @@ rm -rf ${CONTAINERD_DIR}
- mkdir -p ${CHARTS_DIR}
- mkdir -p ${DATA_DIR}
- 
--curl --compressed -sfL https://github.com/k3s-io/k3s-root/releases/download/${VERSION_ROOT}/k3s-root-${ARCH}.tar | tar xf - --exclude=bin/socat
--
--git clone --single-branch --branch=${VERSION_RUNC} --depth=1 https://github.com/opencontainers/runc ${RUNC_DIR}
--
--git clone --single-branch --branch=${VERSION_CONTAINERD} --depth=1 https://github.com/k3s-io/containerd ${CONTAINERD_DIR}
--
- setup_tmp() {
-     TMP_DIR=$(mktemp -d --tmpdir=${CHARTS_DIR})
-     cleanup() {
-@@ -44,8 +38,8 @@ setup_tmp() {
- 
- download_and_package_traefik () {
-   echo "Downloading Traefik Helm chart from ${TRAEFIK_URL}"
--  curl -sfL ${TRAEFIK_URL} -o ${TMP_DIR}/${TRAEFIK_FILE}
--  code=$?
-+  # nixpkgs: copy in our known traefik chart instead
-+  cp $TRAEFIK_CHART_FILE ${TMP_DIR}/${TRAEFIK_FILE}
- 
-   if [ $code -ne 0 ]; then
-     echo "Error: Failed to download Traefik Helm chart!"
--- 
-2.34.1
-

pkgs/applications/networking/cluster/k3s/1_25/default.nix

@@ -1,336 +0,0 @@
-{ stdenv
-, lib
-, makeWrapper
-, socat
-, iptables
-, iproute2
-, ipset
-, bridge-utils
-, btrfs-progs
-, conntrack-tools
-, buildGoModule
-, runc
-, rsync
-, kmod
-, libseccomp
-, pkg-config
-, ethtool
-, util-linux
-, fetchFromGitHub
-, fetchurl
-, fetchzip
-, fetchgit
-, zstd
-, yq-go
-, sqlite
-, nixosTests
-, pkgsBuildBuild
-, k3s
-}:
-
-# k3s is a kinda weird derivation. One of the main points of k3s is the
-# simplicity of it being one binary that can perform several tasks.
-# However, when you have a good package manager (like nix), that doesn't
-# actually make much of a difference; you don't really care if it's one binary
-# or 10 since with a good package manager, installing and running it is
-# identical.
-# Since upstream k3s packages itself as one large binary with several
-# "personalities" (in the form of subcommands like 'k3s agent' and 'k3s
-# kubectl'), it ends up being easiest to mostly mimic upstream packaging, with
-# some exceptions.
-# K3s also carries patches to some packages (such as containerd and cni
-# plugins), so we intentionally use the k3s versions of those binaries for k3s,
-# even if the upstream version of those binaries exist in nixpkgs already. In
-# the end, that means we have a thick k3s binary that behaves like the upstream
-# one for the most part.
-# However, k3s also bundles several pieces of unpatched software, from the
-# strongswan vpn software, to iptables, to socat, conntrack, busybox, etc.
-# Those pieces of software we entirely ignore upstream's handling of, and just
-# make sure they're in the path if desired.
-let
-  k3sVersion = "1.25.3+k3s1";     # k3s git tag
-  k3sCommit = "f2585c1671b31b4b34bddbb3bf4e7d69662b0821"; # k3s git commit at the above version
-  k3sRepoSha256 = "0zwf3iwjcidx14zw36s1hr0q8wmmbfc0rfqwd7fmpjq597h8zkms";
-  k3sVendorHash = "sha256-U67tJRGqPFk5AfRe7I50zKGC9HJ2oh+iI/C7qF/76BQ=";
-
-  # taken from ./manifests/traefik.yaml, extracted from '.spec.chart' https://github.com/k3s-io/k3s/blob/v1.23.3%2Bk3s1/scripts/download#L9
-  # The 'patch' and 'minor' versions are currently hardcoded as single digits only, so ignore the trailing two digits. Weird, I know.
-  traefikChartVersion = "12.0.0";
-  traefikChartSha256 = "1sqmi71fi3ad5dh5fmsp9mv80x6pkgqwi4r9fr8l6i9sdnai6f1a";
-
-  # taken from ./scripts/version.sh VERSION_ROOT https://github.com/k3s-io/k3s/blob/v1.23.3%2Bk3s1/scripts/version.sh#L47
-  k3sRootVersion = "0.11.0";
-  k3sRootSha256 = "016n56vi09xkvjph7wgzb2m86mhd5x65fs4d11pmh20hl249r620";
-
-  # taken from ./scripts/version.sh VERSION_CNIPLUGINS https://github.com/k3s-io/k3s/blob/v1.23.3%2Bk3s1/scripts/version.sh#L45
-  k3sCNIVersion = "1.1.1-k3s1";
-  k3sCNISha256 = "14mb3zsqibj1sn338gjmsyksbm0mxv9p016dij7zidccx2rzn6nl";
-
-  # taken from go.mod, the 'github.com/containerd/containerd' line
-  # run `grep github.com/containerd/containerd go.mod | head -n1 | awk '{print $4}'`
-  containerdVersion = "1.5.13-k3s2";
-  containerdSha256 = "1pfr2ji4aij9js90gf4a3hqnhyw5hshcjdccm62l700j68gs5z97";
-
-  # run `grep github.com/kubernetes-sigs/cri-tools go.mod | head -n1 | awk '{print $4}'` in the k3s repo at the tag
-  criCtlVersion = "1.25.0-k3s1";
-
-  baseMeta = k3s.meta;
-
-  # https://github.com/k3s-io/k3s/blob/5fb370e53e0014dc96183b8ecb2c25a61e891e76/scripts/build#L19-L40
-  versionldflags = [
-    "-X github.com/rancher/k3s/pkg/version.Version=v${k3sVersion}"
-    "-X github.com/rancher/k3s/pkg/version.GitCommit=${lib.substring 0 8 k3sCommit}"
-    "-X k8s.io/client-go/pkg/version.gitVersion=v${k3sVersion}"
-    "-X k8s.io/client-go/pkg/version.gitCommit=${k3sCommit}"
-    "-X k8s.io/client-go/pkg/version.gitTreeState=clean"
-    "-X k8s.io/client-go/pkg/version.buildDate=1970-01-01T01:01:01Z"
-    "-X k8s.io/component-base/version.gitVersion=v${k3sVersion}"
-    "-X k8s.io/component-base/version.gitCommit=${k3sCommit}"
-    "-X k8s.io/component-base/version.gitTreeState=clean"
-    "-X k8s.io/component-base/version.buildDate=1970-01-01T01:01:01Z"
-    "-X github.com/kubernetes-sigs/cri-tools/pkg/version.Version=v${criCtlVersion}"
-    "-X github.com/containerd/containerd/version.Version=v${containerdVersion}"
-    "-X github.com/containerd/containerd/version.Package=github.com/k3s-io/containerd"
-  ];
-
-  # bundled into the k3s binary
-  traefikChart = fetchurl {
-    url = "https://helm.traefik.io/traefik/traefik-${traefikChartVersion}.tgz";
-    sha256 = traefikChartSha256;
-  };
-  # so, k3s is a complicated thing to package
-  # This derivation attempts to avoid including any random binaries from the
-  # internet. k3s-root is _mostly_ binaries built to be bundled in k3s (which
-  # we don't care about doing, we can add those as build or runtime
-  # dependencies using a real package manager).
-  # In addition to those binaries, it's also configuration though (right now
-  # mostly strongswan configuration), and k3s does use those files.
-  # As such, we download it in order to grab 'etc' and bundle it into the final
-  # k3s binary.
-  k3sRoot = fetchzip {
-    # Note: marked as apache 2.0 license
-    url = "https://github.com/k3s-io/k3s-root/releases/download/v${k3sRootVersion}/k3s-root-amd64.tar";
-    sha256 = k3sRootSha256;
-    stripRoot = false;
-  };
-  k3sCNIPlugins = buildGoModule rec {
-    pname = "k3s-cni-plugins";
-    version = k3sCNIVersion;
-    vendorHash = null;
-
-    subPackages = [ "." ];
-
-    src = fetchFromGitHub {
-      owner = "rancher";
-      repo = "plugins";
-      rev = "v${version}";
-      sha256 = k3sCNISha256;
-    };
-
-    postInstall = ''
-      mv $out/bin/plugins $out/bin/cni
-    '';
-
-    meta = baseMeta // {
-      description = "CNI plugins, as patched by rancher for k3s";
-    };
-  };
-  # Grab this separately from a build because it's used by both stages of the
-  # k3s build.
-  k3sRepo = fetchgit {
-    url = "https://github.com/k3s-io/k3s";
-    rev = "v${k3sVersion}";
-    sha256 = k3sRepoSha256;
-  };
-  # Stage 1 of the k3s build:
-  # Let's talk about how k3s is structured.
-  # One of the ideas of k3s is that there's the single "k3s" binary which can
-  # do everything you need, from running a k3s server, to being a worker node,
-  # to running kubectl.
-  # The way that actually works is that k3s is a single go binary that contains
-  # a bunch of bindata that it unpacks at runtime into directories (either the
-  # user's home directory or /var/lib/rancher if run as root).
-  # This bindata includes both binaries and configuration.
-  # In order to let nixpkgs do all its autostripping/patching/etc, we split this into two derivations.
-  # First, we build all the binaries that get packed into the thick k3s binary
-  # (and output them from one derivation so they'll all be suitably patched up).
-  # Then, we bundle those binaries into our thick k3s binary and use that as
-  # the final single output.
-  # This approach was chosen because it ensures the bundled binaries all are
-  # correctly built to run with nix (we can lean on the existing buildGoModule
-  # stuff), and we can again lean on that tooling for the final k3s binary too.
-  # Other alternatives would be to manually run the
-  # strip/patchelf/remove-references step ourselves in the installPhase of the
-  # derivation when we've built all the binaries, but haven't bundled them in
-  # with generated bindata yet.
-
-  k3sServer = buildGoModule rec {
-    pname = "k3s-server";
-    version = k3sVersion;
-
-    src = k3sRepo;
-    vendorHash = k3sVendorHash;
-
-    nativeBuildInputs = [ pkg-config ];
-    buildInputs = [ libseccomp sqlite.dev ];
-
-    subPackages = [ "cmd/server" ];
-    ldflags = versionldflags;
-
-    tags = [ "libsqlite3" "linux" ];
-
-    # create the multicall symlinks for k3s
-    postInstall = ''
-      mv $out/bin/server $out/bin/k3s
-      pushd $out
-      # taken verbatim from https://github.com/k3s-io/k3s/blob/v1.23.3%2Bk3s1/scripts/build#L105-L113
-      ln -s k3s ./bin/k3s-agent
-      ln -s k3s ./bin/k3s-server
-      ln -s k3s ./bin/k3s-etcd-snapshot
-      ln -s k3s ./bin/k3s-secrets-encrypt
-      ln -s k3s ./bin/k3s-certificate
-      ln -s k3s ./bin/kubectl
-      ln -s k3s ./bin/crictl
-      ln -s k3s ./bin/ctr
-      popd
-    '';
-
-    meta = baseMeta // {
-      description = "The various binaries that get packaged into the final k3s binary";
-    };
-  };
-  k3sContainerd = buildGoModule {
-    pname = "k3s-containerd";
-    version = containerdVersion;
-    src = fetchFromGitHub {
-      owner = "k3s-io";
-      repo = "containerd";
-      rev = "v${containerdVersion}";
-      sha256 = containerdSha256;
-    };
-    vendorHash = null;
-    buildInputs = [ btrfs-progs ];
-    subPackages = [ "cmd/containerd" "cmd/containerd-shim-runc-v2" ];
-    ldflags = versionldflags;
-  };
-in
-buildGoModule rec {
-  pname = "k3s";
-  version = k3sVersion;
-
-  src = k3sRepo;
-  vendorHash = k3sVendorHash;
-
-  patches = [
-    ./0001-script-download-strip-downloading-just-package-CRD.patch
-  ];
-
-  postPatch = ''
-    # Nix prefers dynamically linked binaries over static binary.
-
-    substituteInPlace scripts/package-cli \
-      --replace '"$LDFLAGS $STATIC" -o' \
-                '"$LDFLAGS" -o' \
-      --replace "STATIC=\"-extldflags \'-static\'\"" \
-                ""
-
-    # Upstream codegen fails with trimpath set. Removes "trimpath" for 'go generate':
-
-    substituteInPlace scripts/package-cli \
-      --replace '"''${GO}" generate' \
-                'GOFLAGS="" \
-                 GOOS="${pkgsBuildBuild.go.GOOS}" \
-                 GOARCH="${pkgsBuildBuild.go.GOARCH}" \
-                 CC="${pkgsBuildBuild.stdenv.cc}/bin/cc" \
-                 "''${GO}" generate'
-  '';
-
-  # Important utilities used by the kubelet, see
-  # https://github.com/kubernetes/kubernetes/issues/26093#issuecomment-237202494
-  # Note the list in that issue is stale and some aren't relevant for k3s.
-  k3sRuntimeDeps = [
-    kmod
-    socat
-    iptables
-    iproute2
-    ipset
-    bridge-utils
-    ethtool
-    util-linux # kubelet wants 'nsenter' from util-linux: https://github.com/kubernetes/kubernetes/issues/26093#issuecomment-705994388
-    conntrack-tools
-  ];
-
-  buildInputs = k3sRuntimeDeps;
-
-  nativeBuildInputs = [
-    makeWrapper
-    rsync
-    yq-go
-    zstd
-  ];
-
-  # embedded in the final k3s cli
-  propagatedBuildInputs = [
-    k3sCNIPlugins
-    k3sContainerd
-    k3sServer
-    runc
-  ];
-
-  # We override most of buildPhase due to peculiarities in k3s's build.
-  # Specifically, it has a 'go generate' which runs part of the package. See
-  # this comment:
-  # https://github.com/NixOS/nixpkgs/pull/158089#discussion_r799965694
-  # So, why do we use buildGoModule at all? For the `vendorHash` / `go mod download` stuff primarily.
-  buildPhase = ''
-    patchShebangs ./scripts/package-cli ./scripts/download ./scripts/build-upload
-
-    # copy needed 'go generate' inputs into place
-    mkdir -p ./bin/aux
-    rsync -a --no-perms ${k3sServer}/bin/ ./bin/
-    ln -vsf ${runc}/bin/runc ./bin/runc
-    ln -vsf ${k3sCNIPlugins}/bin/cni ./bin/cni
-    ln -vsf ${k3sContainerd}/bin/* ./bin/
-    rsync -a --no-perms --chmod u=rwX ${k3sRoot}/etc/ ./etc/
-    mkdir -p ./build/static/charts
-    # Note, upstream's chart has a 00 suffix. This seems to not matter though, so we're ignoring that naming detail.
-    export TRAEFIK_CHART_FILE=${traefikChart}
-    # place the traefik chart using their code since it's complicated
-    # We trim the actual download, see patches
-    ./scripts/download
-
-    export ARCH=$GOARCH
-    export DRONE_TAG="v${k3sVersion}"
-    export DRONE_COMMIT="${k3sCommit}"
-    # use ./scripts/package-cli to run 'go generate' + 'go build'
-
-    ./scripts/package-cli
-    mkdir -p $out/bin
-  '';
-
-  # Otherwise it depends on 'getGoDirs', which is normally set in buildPhase
-  doCheck = false;
-
-  installPhase = ''
-    # wildcard to match the arm64 build too
-    install -m 0755 dist/artifacts/k3s* -D $out/bin/k3s
-    wrapProgram $out/bin/k3s \
-      --prefix PATH : ${lib.makeBinPath k3sRuntimeDeps} \
-      --prefix PATH : "$out/bin"
-    ln -s $out/bin/k3s $out/bin/kubectl
-    ln -s $out/bin/k3s $out/bin/crictl
-    ln -s $out/bin/k3s $out/bin/ctr
-  '';
-
-  doInstallCheck = true;
-  installCheckPhase = ''
-    $out/bin/k3s --version | grep -F "v${k3sVersion}" >/dev/null
-  '';
-
-  # Fix-Me: Needs to be adapted specifically for 1.25
-  # passthru.updateScript = ./update.sh;
-
-  passthru.tests = k3s.passthru.mkTests k3sVersion;
-
-  meta = baseMeta;
-}

pkgs/applications/networking/cluster/k8sgpt/default.nix

@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "k8sgpt";
-  version = "0.3.27";
+  version = "0.3.28";
 
   src = fetchFromGitHub {
     owner = "k8sgpt-ai";
     repo = "k8sgpt";
     rev = "v${version}";
-    hash = "sha256-HWcEcufn0NM+7AF4/M29bsUoQYlVA1nbrkCKt9F1g6k=";
+    hash = "sha256-VDVCkGTLoAZZyTX+zn43KisnUV9XQ9xo9ZIQf3AwDcY=";
   };
 
-  vendorHash = "sha256-b8Y95BDOR5HI6QMU4XLn5FmSHFD9fntc80r84KgmkuY=";
+  vendorHash = "sha256-NOXySV9sQl4Q1eDbcGMk0msMSosjyxYyJfhu7hd/4gw=";
 
   CGO_ENABLED = 0;
 

pkgs/applications/networking/cluster/kube-router/default.nix

@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "kube-router";
-  version = "2.0.1";
+  version = "2.1.0";
 
   src = fetchFromGitHub {
     owner = "cloudnativelabs";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-Iwo+I1EfclkF4FL8QM3xGkIFxakmelI+hSUepLwfFSw=";
+    hash = "sha256-5aOAQ5kRnNsCn5EH9RKoeEfcFB3g59eqYIdSNjQxdjM=";
   };
 
-  vendorHash = "sha256-VjPesQ27GcwnFQrNI+VYzJ4/aahcjASbfMi//Zs/KLM=";
+  vendorHash = "sha256-5aGcDO+dV9XinH0vw6uNB0mnWuFQcyLhRB7zYr+sRfg=";
 
   CGO_ENABLED = 0;
 

pkgs/applications/networking/cluster/roxctl/default.nix

@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "roxctl";
-  version = "4.3.4";
+  version = "4.3.5";
 
   src = fetchFromGitHub {
     owner = "stackrox";
     repo = "stackrox";
     rev = version;
-    sha256 = "sha256-5UMU3oKi3QhREum2YevOzwF5OOi8quPWgt+kgGjkeFQ=";
+    sha256 = "sha256-zTZ03Qtb3ndBf1MunhYS8rzPReExzEPGxCh1JexkwuA=";
   };
 
-  vendorHash = "sha256-Jzv4ozR8RJiwkgVGGq6dlV/7rbBLq8hFe/Pm4SJZCkU=";
+  vendorHash = "sha256-Sl5eIK8PWeGi2V7q/Qm5Gfjj1A9nQPtM0BGdO6inPxk=";
 
   nativeBuildInputs = [ installShellFiles ];
 

pkgs/applications/networking/cluster/terraform/default.nix

@@ -167,9 +167,9 @@ rec {
   mkTerraform = attrs: pluggable (generic attrs);
 
   terraform_1 = mkTerraform {
-    version = "1.7.4";
+    version = "1.7.5";
-    hash = "sha256-LF8lFDZtDowHqa0z/TCVKznxn15Msha/af8p/w0bI1k=";
+    hash = "sha256-k/ugXlHK7lEKfOpSBXQNUdcq26rVVdjo53U+7ChJLIc=";
-    vendorHash = "sha256-DI4YTjdFFvfby8ExEY3KoK4J9YKK5LPpMbelzFMDVVs=";
+    vendorHash = "sha256-5sCf65gFpI3y+qwDYvD08OZHNsDMg2IuDL65NMsLQ4Y=";
     patches = [ ./provider-path-0_15.patch ];
     passthru = {
       inherit plugins;

pkgs/applications/networking/deck/default.nix

@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "deck";
-  version = "1.35.0";
+  version = "1.36.0";
 
   src = fetchFromGitHub {
     owner = "Kong";
     repo = "deck";
     rev = "v${version}";
-    hash = "sha256-Cng1T/TjhPttLFcI3if0Ea/M2edXDnrMVAFzAZmNAD8=";
+    hash = "sha256-bbHJilMh7qnGvYuid8/PmIg5m42jddqOOuMd7mzQmCo=";
   };
 
   nativeBuildInputs = [ installShellFiles ];
@@ -21,7 +21,7 @@ buildGoModule rec {
   ];
 
   proxyVendor = true; # darwin/linux hash mismatch
-  vendorHash = "sha256-tv/wI4AN10io9x1wl2etKC+MB2vz+6FkmT/eJSsT4VI=";
+  vendorHash = "sha256-Er9m8G020SKEN8jMIhEYiKvF27YY4dZvG0noYaH3bPU=";
 
   postInstall = ''
     installShellCompletion --cmd deck \

pkgs/applications/networking/instant-messengers/beeper/default.nix

@@ -11,11 +11,11 @@
 }:
 let
   pname = "beeper";
-  version = "3.99.22";
+  version = "3.99.23";
   name = "${pname}-${version}";
   src = fetchurl {
-    url = "https://download.todesktop.com/2003241lzgn20jd/beeper-3.99.22-build-240307lufv3wsra-x86_64.AppImage";
+    url = "https://download.todesktop.com/2003241lzgn20jd/beeper-3.99.23-build-240309svrjfqia1-x86_64.AppImage";
-    hash = "sha256-T3MABc11rWRjCU+4fvbpYDVq4XjSVfEeBrS03ITw8x8=";
+    hash = "sha256-8kZk5tEJCcSPKgpsVKrHB5twujZF2LdepW7HIJsb52E=";
   };
   appimage = appimageTools.wrapType2 {
     inherit version pname src;

pkgs/applications/networking/instant-messengers/element/pin.nix

@@ -1,9 +1,9 @@
 {
-  "version" = "1.11.59";
+  "version" = "1.11.60";
   "hashes" = {
-    "desktopSrcHash" = "sha256-dasRfLsa8Jc6Vyay02f6IytjvYs3xbSFB2fU5bxi79E=";
+    "desktopSrcHash" = "sha256-r4Kcf8iBACHSiUceHq5T2BswGqgVkMBm/5ANq0smA20=";
-    "desktopYarnHash" = "00jvid2li68ji1xkbbpdiy39fzvhmw7ypnr3x82wbqqafkc5vil6";
+    "desktopYarnHash" = "16psxfai8dyckm4xwrg5czv6l4163x2nlqqcdgly6axabllgacj1";
-    "webSrcHash" = "sha256-UpRRTPrNiFsqXKD072jXVIqS8ZiuKt/BUzx1oja90VA=";
+    "webSrcHash" = "sha256-k+jtTUuLaux2HSDsLT2ktcShQTNNnDe0e3Icoa31WdE=";
-    "webYarnHash" = "1s9lp2dd3slpp70rrbmsbmzphm6fwglnrqwk9fgylzqa1ds8nfjd";
+    "webYarnHash" = "0rgdfdkri7mxs7rvp3rwbnijbcs5chc02smw1kbb00j6qzf6k3dj";
   };
 }

pkgs/applications/networking/instant-messengers/zoom-us/default.nix

@@ -48,23 +48,23 @@ let
   # and often with different versions.  We write them on three lines
   # like this (rather than using {}) so that the updater script can
   # find where to edit them.
-  versions.aarch64-darwin = "5.17.10.30974";
+  versions.aarch64-darwin = "5.17.11.31580";
-  versions.x86_64-darwin = "5.17.10.30974";
+  versions.x86_64-darwin = "5.17.11.31580";
-  versions.x86_64-linux = "5.17.10.3512";
+  versions.x86_64-linux = "5.17.11.3835";
 
   srcs = {
     aarch64-darwin = fetchurl {
       url = "https://zoom.us/client/${versions.aarch64-darwin}/zoomusInstallerFull.pkg?archType=arm64";
       name = "zoomusInstallerFull.pkg";
-      hash = "sha256-JWGy8je6hFDTSKPx4GAUDMJdi5/zKoj4KK5w6E0pcsI=";
+      hash = "sha256-oCCZksH5sgfPVxh6I7ZpIMvkMX0+HnL1R9voNRjTUP4=";
     };
     x86_64-darwin = fetchurl {
       url = "https://zoom.us/client/${versions.x86_64-darwin}/zoomusInstallerFull.pkg";
-      hash = "sha256-lO0fyW5catdgKZ7cAQhdAbfQW+EewdCjTne+ZC3UW3w=";
+      hash = "sha256-6bIUfS6bZWh7fEq2xY++nIbnmE5DJxte6sjyoSKUMzU=";
     };
     x86_64-linux = fetchurl {
       url = "https://zoom.us/client/${versions.x86_64-linux}/zoom_x86_64.pkg.tar.xz";
-      hash = "sha256-dXpfgouZjd+0YyHz1c/7VL3a1SATAX8BpkR4KBeEDbc=";
+      hash = "sha256-eIa8ESoYi0gPbJbqahqKKvnM7rGPT+WeMIYCyFEWHGE=";
     };
   };
 

pkgs/applications/networking/remote/citrix-workspace/default.nix

@@ -1,7 +1,7 @@
 { lib, callPackage }:
 
 # For detailed information about the Citrix source-tarball, please refer to the OEM
-# reference guide: https://developer-docs.citrix.com/projects/workspace-app-for-linux-oem-guide/en/latest/
+# reference guide: https://developer-docs.citrix.com/en-us/citrix-workspace-app-for-linux/citrix-workspace-app-for-linux-oem-reference-guide
 
 let
   inherit (callPackage ./sources.nix { }) supportedVersions unsupportedVersions;
@@ -13,7 +13,7 @@ let
       Citrix Workspace at version ${x} is not supported anymore!
 
       Actively supported releases are listed here:
-      https://www.citrix.com/support/product-lifecycle/milestones/receiver.html
+      https://www.citrix.com/support/product-lifecycle/workspace-app.html
     '')) unsupportedVersions
   );
 

pkgs/applications/networking/remote/citrix-workspace/generic.nix

@@ -196,7 +196,7 @@ stdenv.mkDerivation rec {
 
     ${mkWrappers copyCert extraCerts}
 
-    # See https://developer-docs.citrix.com/projects/workspace-app-for-linux-oem-guide/en/latest/reference-information/#library-files
+    # See https://developer-docs.citrix.com/en-us/citrix-workspace-app-for-linux/citrix-workspace-app-for-linux-oem-reference-guide/reference-information/#library-files
     # Those files are fallbacks to support older libwekit.so and libjpeg.so
     rm $out/opt/citrix-icaclient/lib/ctxjpeg_fb_8.so || true
     rm $out/opt/citrix-icaclient/lib/UIDialogLibWebKit.so || true
@@ -238,7 +238,7 @@ stdenv.mkDerivation rec {
     license = licenses.unfree;
     description = "Citrix Workspace";
     sourceProvenance = with sourceTypes; [ binaryNativeCode ];
-    platforms = platforms.linux;
+    platforms = [ "x86_64-linux" ] ++ optional (versionOlder version "24") "i686-linux";
     maintainers = with maintainers; [ michaeladler ];
     inherit homepage;
   };

pkgs/applications/networking/remote/citrix-workspace/sources.nix

@@ -12,30 +12,8 @@ let
   # for Linux.
   #
   # The latest versions can be found at https://www.citrix.com/downloads/workspace-app/linux/
+  # x86 is unsupported past 23.11, see https://docs.citrix.com/en-us/citrix-workspace-app-for-linux/deprecation
   supportedVersions = lib.mapAttrs mkVersionInfo {
-
-    "23.02.0" = {
-      major     = "23";
-      minor     = "2";
-      patch     = "0";
-      x64hash   = "d0030a4782ba4b2628139635a12a7de044a4eb36906ef1eadb05b6ea77c1a7bc";
-      x86hash   = "39228fc8dd69adca4e56991c1ebc0832fec183c3ab5abd2d65c66b39b634391b";
-      x64suffix = "10";
-      x86suffix = "10";
-      homepage  = "https://www.citrix.com/downloads/workspace-app/legacy-workspace-app-for-linux/workspace-app-for-linux-latest6.html";
-    };
-
-    "23.07.0" = {
-      major     = "23";
-      minor     = "7";
-      patch     = "0";
-      x64hash   = "d4001226e79b5353fc74da4c8ed4f6295c1859fe18142cb5de345a3c7ae48168";
-      x86hash   = "4a7da238286ae28d7baf0fefa1e7e09d077c8bc56c2bf7bec00da42c331bee59";
-      x64suffix = "17";
-      x86suffix = "17";
-      homepage  = "https://www.citrix.com/downloads/workspace-app/legacy-workspace-app-for-linux/workspace-app-for-linux-latest21.html";
-    };
-
     "23.09.0" = {
       major     = "23";
       minor     = "9";
@@ -55,17 +33,27 @@ let
       x86hash   = "65b8c144e51b5bd78b98ae69e0fa76d6c020a857d74fd5254be49492527072b6";
       x64suffix = "82";
       x86suffix = "82";
-      homepage  = "https://www.citrix.com/downloads/workspace-app/linux/workspace-app-for-linux-latest.html";
+      homepage  = "https://www.citrix.com/downloads/workspace-app/legacy-workspace-app-for-linux/workspace-app-for-linux-latest10.html";
     };
 
+    "24.02.0" = {
+      major     = "24";
+      minor     = "2";
+      patch     = "0";
+      x64hash   = "eaeb5d3bd079d4e5c9707da67f5f7a25cb765e19c36d01861290655dbf2aaee4";
+      x86hash   = "";
+      x64suffix = "65";
+      x86suffix = "";
+      homepage  = "https://www.citrix.com/downloads/workspace-app/linux/workspace-app-for-linux-latest.html";
+    };
   };
 
   # Retain attribute-names for abandoned versions of Citrix workspace to
   # provide a meaningful error-message if it's attempted to use such an old one.
   #
   # The lifespans of Citrix products can be found here:
-  # https://www.citrix.com/support/product-lifecycle/milestones/receiver.html
+  # https://www.citrix.com/support/product-lifecycle/workspace-app.html
-  unsupportedVersions = [ ];
+  unsupportedVersions = [ "23.02.0" "23.07.0" ];
 in {
   inherit supportedVersions unsupportedVersions;
 }

pkgs/applications/networking/remote/xrdp/default.nix

@@ -22,7 +22,7 @@
 }:
 
 let
-  version = "0.9.25";
+  version = "0.9.25.1";
   patchedXrdpSrc = applyPatches {
     patches = [ ./dynamic_config.patch ];
     name = "xrdp-patched-${version}";
@@ -31,7 +31,7 @@ let
       repo = "xrdp";
       rev = "v${version}";
       fetchSubmodules = true;
-      hash = "sha256-XVaNN+sBEACh/yGnCLn9GHszoofWbcyA+Mr6KZMVFB0=";
+      hash = "sha256-oAs0oWkCyj3ObdJuHLfT25ZzkTrxNAXDiFU64OOP4Ow=";
     };
   };
 

pkgs/applications/office/fava/default.nix

@@ -2,12 +2,12 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "fava";
-  version = "1.27.2";
+  version = "1.27.3";
   format = "pyproject";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-kLQAWFHDmzsBjVMm/ZUn+TFkM52W0h0jg0wSp1tmPZQ=";
+    hash = "sha256-GsnXZaazEiOhyjbIinHRD1fdoqlAp3d5csrmtydxmGM=";
   };
 
   nativeBuildInputs = with python3.pkgs; [ setuptools-scm ];

pkgs/applications/office/timeular/default.nix

@@ -5,12 +5,12 @@
 }:
 
 let
-  version = "6.7.3";
+  version = "6.7.5";
   pname = "timeular";
 
   src = fetchurl {
     url = "https://s3.amazonaws.com/timeular-desktop-packages/linux/production/Timeular-${version}.AppImage";
-    hash = "sha256-VnjCTf2x3GzmKW9EfNWGsN/aK7DKjTo8DZOF2qqGJ0Q=";
+    hash = "sha256-b/I34f8fGgPr4+fZJ+2cb+Xi/AvotxNHYg7IaLTByPk=";
   };
 
   appimageContents = appimageTools.extractType2 {

pkgs/applications/science/electronics/systemc/default.nix

@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchFromGitHub, autoreconfHook }:
+{ lib, stdenv, fetchFromGitHub, cmake }:
 
 stdenv.mkDerivation rec {
   pname = "systemc";
@@ -11,16 +11,21 @@ stdenv.mkDerivation rec {
     sha256 = "0sj8wlkp68cjhmkd9c9lvm3lk3sckczpz7w9vby64inc1f9fnf0b";
   };
 
-  enableParallelBuilding = true;
+  nativeBuildInputs = [ cmake ];
-  nativeBuildInputs = [ autoreconfHook ];
 
-  configureFlags = [ "--with-unix-layout" ];
+  cmakeFlags = [
+    # Undefined reference to the sc_core::sc_api_version_2_3_4_XXX
+    # https://github.com/accellera-official/systemc/issues/21
+    "-DCMAKE_CXX_STANDARD=17"
+  ];
+
+  doCheck = stdenv.buildPlatform.canExecute stdenv.hostPlatform;
 
   meta = with lib; {
     description = "The language for System-level design, modeling and verification";
     homepage    = "https://systemc.org/";
     license     = licenses.asl20;
-    platforms   = platforms.linux;
+    platforms   = platforms.unix;
     maintainers = with maintainers; [ victormignot amiloradovsky ];
   };
 }

pkgs/applications/science/electronics/verilator/default.nix

@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchFromGitHub, perl, flex, bison, python3, autoconf,
+{ lib, stdenv, fetchFromGitHub, fetchpatch, perl, flex, bison, python3, autoconf,
   which, cmake, ccache, help2man, makeWrapper, glibcLocales,
   systemc, git, numactl }:
 
@@ -13,6 +13,15 @@ stdenv.mkDerivation rec {
     hash = "sha256-Ya3lqK8BfvMVLZUrD2Et6OmptteWXp5VmZb2x2G/V/E=";
   };
 
+  patches = [
+    (fetchpatch {
+      # Fix try-lock spuriously fail in V3ThreadPool destructor
+      # https://github.com/verilator/verilator/pull/4938
+      url = "https://github.com/verilator/verilator/commit/4b9cce4369c78423779238e585ed693c456d464e.patch";
+      hash = "sha256-sGrk/pxqZqUcmJdzQoPlzXMmYqHCOmd9Y2n6ieVNg1U=";
+    })
+  ];
+
   enableParallelBuilding = true;
   buildInputs = [ perl python3 systemc ];  # ccache
   nativeBuildInputs = [ makeWrapper flex bison autoconf help2man git ];
@@ -37,6 +46,11 @@ stdenv.mkDerivation rec {
     done
   '';
 
+  env = {
+    SYSTEMC_INCLUDE = "${lib.getDev systemc}/include";
+    SYSTEMC_LIBDIR = "${lib.getLib systemc}/lib";
+  };
+
   meta = with lib; {
     description = "Fast and robust (System)Verilog simulator/compiler and linter";
     homepage    = "https://www.veripool.org/verilator";

pkgs/applications/science/misc/foldingathome/client.nix

@@ -3,18 +3,23 @@
 , fetchFromGitHub
 , ocl-icd
 , openssl
+, re2
+, libevent
+, git
+, zlib
+, expat
 , scons
 , stdenv
 , extraPkgs ? [ ]
 }:
 let
-  version = "8.3.1";
+  version = "8.3.7";
 
   cbangSrc = fetchFromGitHub {
     owner = "cauldrondevelopmentllc";
     repo = "cbang";
     rev = "bastet-v${version}";
-    hash = "sha256-cuyfJG5aDJ6e2SllxwKTViG0j8FWHvjcTaaBBtkgEdU=";
+    sha256 = "sha256-acAImItdkgo6PBFL6Vu/caIdcnvp/3VEW2lgVDgKy9g=";
   };
 
   fah-client = stdenv.mkDerivation {
@@ -25,10 +30,10 @@ let
       owner = "FoldingAtHome";
       repo = "fah-client-bastet";
       rev = "v${version}";
-      hash = "sha256-Ztc2im4Xmk8f6GotGRgA5zDkcyQFnodUvroJVl+ApT4=";
+      sha256 = "sha256-d+LY/R4TAko+2e2W76KEBQ8fXj0hzzmBOm+c4tksXMA=";
     };
 
-    nativeBuildInputs = [ scons ];
+    nativeBuildInputs = [ scons re2 libevent git ];
 
     buildInputs = [ openssl ];
 
@@ -63,7 +68,7 @@ in
 buildFHSEnv {
   name = fah-client.name;
 
-  targetPkgs = _: [ fah-client ocl-icd ] ++ extraPkgs;
+  targetPkgs = _: [ fah-client ocl-icd zlib expat ] ++ extraPkgs;
 
   runScript = "/bin/fah-client";
 

pkgs/applications/terminal-emulators/kitty/default.nix

@@ -18,37 +18,39 @@
 , libpng
 , python3
 , zlib
+, simde
 , bashInteractive
 , zsh
 , fish
 , nixosTests
-, go
+, go_1_22
-, buildGoModule
+, buildGo122Module
 , nix-update-script
 }:
 
 with python3Packages;
 buildPythonApplication rec {
   pname = "kitty";
-  version = "0.32.2";
+  version = "0.33.0";
   format = "other";
 
   src = fetchFromGitHub {
     owner = "kovidgoyal";
     repo = "kitty";
     rev = "refs/tags/v${version}";
-    hash = "sha256-CgL+XXVTGLbNXm7DLenrkCZAfspyNubGOAPUZmKiq2c=";
+    hash = "sha256-0bdDolaFbVI3CqcOtKFrvRqrKXIiSIfH5rxJgK5XssI=";
   };
 
-  goModules = (buildGoModule {
+  goModules = (buildGo122Module {
     pname = "kitty-go-modules";
     inherit src version;
-    vendorHash = "sha256-Ve8s4vgDmByfvyJL8a36+7g3QErkhqVXGCSu6vHFFx0=";
+    vendorHash = "sha256-7301wHGCXUdfPFOhgLEJILmYxNohNm6H2zXGd9W11Wk=";
   }).goModules;
 
   buildInputs = [
     harfbuzz
     ncurses
+    simde
     lcms2
     librsync
     openssl.dev
@@ -78,7 +80,7 @@ buildPythonApplication rec {
     sphinx-copybutton
     sphinxext-opengraph
     sphinx-inline-tabs
-    go
+    go_1_22
   ] ++ lib.optionals stdenv.isDarwin [
     imagemagick
     libicns  # For the png2icns tool.
@@ -232,7 +234,9 @@ buildPythonApplication rec {
   '';
 
   passthru = {
-    tests.test = nixosTests.terminal-emulators.kitty;
+    tests = lib.mkIf stdenv.isLinux {
+      default = nixosTests.terminal-emulators.kitty;
+    };
     updateScript = nix-update-script {};
   };
 

pkgs/applications/terminal-emulators/rio/default.nix

@@ -51,16 +51,16 @@ let
 in
 rustPlatform.buildRustPackage rec {
   pname = "rio";
-  version = "0.0.35";
+  version = "0.0.36";
 
   src = fetchFromGitHub {
     owner = "raphamorim";
     repo = "rio";
     rev = "v${version}";
-    hash = "sha256-e+GiNwvjwIi5wCyI+IQ0BZ8IR8by5RUq8dk1JO50mjU=";
+    hash = "sha256-QCQFFnlKD5olaGjRwDlj5/EBV6Qy/bFAZOQRtCSPamc=";
   };
 
-  cargoHash = "sha256-voQQjouCOwVLzOKtDUCa1lZLgx0JB7mvCqOY4BhmMr4=";
+  cargoHash = "sha256-Ea0scCbM9mfxC1YL3HCoBk93eVW20bj2mJyauyDSzT8=";
 
   nativeBuildInputs = [
     ncurses

pkgs/applications/version-management/gfold/default.nix

@@ -39,7 +39,7 @@ rustPlatform.buildRustPackage {
       "CLI tool to help keep track of your Git repositories, written in Rust";
     homepage = "https://github.com/nickgerace/gfold";
     license = licenses.asl20;
-    maintainers = [ maintainers.shanesveller ];
+    maintainers = [];
     platforms = platforms.unix;
     mainProgram = "gfold";
   };

pkgs/applications/version-management/got/default.nix

@@ -16,11 +16,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "got";
-  version = "0.96";
+  version = "0.97";
 
   src = fetchurl {
     url = "https://gameoftrees.org/releases/portable/got-portable-${finalAttrs.version}.tar.gz";
-    hash = "sha256-/R7r6IJtgkuNQwoLxys/1HcXW+l3PVkjnPXphFpAFTs=";
+    hash = "sha256-4HpIlKRYUDoymCBH8GS8DDXaY0nYiVvotpBkwglOO3I=";
   };
 
   nativeBuildInputs = [ pkg-config bison ]
@@ -35,7 +35,7 @@ stdenv.mkDerivation (finalAttrs: {
     # The configure script assumes dependencies on Darwin are installed via
     # Homebrew or MacPorts and hardcodes assumptions about the paths of
     # dependencies which fails the nixpkgs configurePhase.
-    substituteInPlace configure --replace 'xdarwin' 'xhomebrew'
+    substituteInPlace configure --replace-fail 'xdarwin' 'xhomebrew'
   '';
 
   env.NIX_CFLAGS_COMPILE = toString (lib.optionals stdenv.isDarwin [
@@ -49,11 +49,12 @@ stdenv.mkDerivation (finalAttrs: {
 
   installCheckPhase = ''
     runHook preInstallCheck
-    test "$($out/bin/got --version)" = "${finalAttrs.pname} ${finalAttrs.version}"
+    test "$($out/bin/got --version)" = "got ${finalAttrs.version}"
     runHook postInstallCheck
   '';
 
-  meta = with lib; {
+  meta = {
+    changelog = "https://gameoftrees.org/releases/CHANGES";
     description = "A version control system which prioritizes ease of use and simplicity over flexibility";
     longDescription = ''
       Game of Trees (Got) is a version control system which prioritizes
@@ -65,9 +66,9 @@ stdenv.mkDerivation (finalAttrs: {
       on the same repository.
     '';
     homepage = "https://gameoftrees.org";
-    changelog = "https://gameoftrees.org/releases/CHANGES";
+    license = lib.licenses.isc;
-    license = licenses.isc;
+    maintainers = with lib.maintainers; [ abbe afh ];
-    platforms = platforms.linux ++ platforms.darwin;
+    mainProgram = "got";
-    maintainers = with maintainers; [ abbe afh ];
+    platforms = with lib.platforms; darwin ++ linux;
   };
 })

pkgs/applications/version-management/josh/default.nix

@@ -11,36 +11,24 @@
 , darwin
 }:
 
+let
+  # josh-ui requires javascript dependencies, haven't tried to figure it out yet
+  cargoFlags = [ "--workspace" "--exclude" "josh-ui" ];
+in
+
 rustPlatform.buildRustPackage rec {
   pname = "josh";
-  version = "23.02.14";
+  version = "23.12.04";
   JOSH_VERSION = "r${version}";
 
   src = fetchFromGitHub {
     owner = "esrlabs";
     repo = "josh";
     rev = JOSH_VERSION;
-    sha256 = "1sqa8xi5d55zshky7gicac02f67vp944hclkdsmwy0bczk9hgssr";
+    sha256 = "10fspcafqnv6if5c1h8z9pf9140jvvlrch88w62wsg4w2vhaii0v";
   };
 
-  patches = [
+  cargoSha256 = "1j0vl3h6f65ldg80bgryh1mz423lcrcdkn8rmajya1850pfxk3w3";
-    # Unreleased patch allowing compilation from the GitHub tarball download
-    (fetchpatch {
-      name = "josh-version-without-git.patch";
-      url = "https://github.com/josh-project/josh/commit/13e7565ab029206598881391db4ddc6dface692b.patch";
-      sha256 = "1l5syqj51sn7kcqvffwl6ggn5sq8wfkpviga860agghnw5dpf7ns";
-    })
-
-    # Merged upstream, fixes builds with newer rustc
-    (fetchpatch {
-      name = "josh-fix-builds-with-rust-173.patch";
-      url = "https://github.com/josh-project/josh/commit/7b8259b81a9acabb528ddebc4ab30fc712f756fb.patch";
-      sha256 = "sha256-YfrVlH6Ox05ZbmB/15HVaFlOyRTOFbYflq0edi6/X9k=";
-      includes = [ "josh-proxy/src/bin/josh-proxy.rs" ];
-    })
-  ];
-
-  cargoSha256 = "0f6cvz2s8qs53b2g6xja38m24hafqla61s4r5za0a1dyndgms7sl";
 
   nativeBuildInputs = [
     pkg-config
@@ -54,11 +42,8 @@ rustPlatform.buildRustPackage rec {
     darwin.Security
   ];
 
-  cargoBuildFlags = [
+  cargoBuildFlags = cargoFlags;
-    "-p" "josh"
+  cargoTestFlags = cargoFlags;
-    "-p" "josh-proxy"
-    # TODO: josh-ui
-  ];
 
   postInstall = ''
     wrapProgram "$out/bin/josh-proxy" --prefix PATH : "${git}/bin"

pkgs/applications/video/obs-studio/default.nix

@@ -53,6 +53,7 @@
 , libdatachannel
 , libvpl
 , qrcodegencpp
+, nix-update-script
 }:
 
 let
@@ -61,13 +62,13 @@ in
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "obs-studio";
-  version = "30.0.2";
+  version = "30.1.0";
 
   src = fetchFromGitHub {
     owner = "obsproject";
     repo = finalAttrs.pname;
     rev = finalAttrs.version;
-    sha256 = "sha256-8pX1kqibrtDIaE1+/Pey1A5bu6MwFTXLrBOah4rsF+4=";
+    sha256 = "sha256-9rf3UGazEL5Obd6tqDwM5LOC6D1X6HNzs5sn5z1tOCA=";
     fetchSubmodules = true;
   };
 
@@ -76,25 +77,6 @@ stdenv.mkDerivation (finalAttrs: {
     ./Enable-file-access-and-universal-access-for-file-URL.patch
     ./fix-nix-plugin-path.patch
 
-    # Backport ffmpeg 6.1 / GCC 13 build fixes
-    # FIXME: remove in next release
-    (fetchpatch {
-      url = "https://github.com/obsproject/obs-studio/commit/cd784644f5e82b9988043f229c19603289c6d32c.patch";
-      hash = "sha256-S4JE5kgr4x3uMHY2GRh0GBJpb7o/wYZb/v0CDITFNnQ=";
-    })
-    (fetchpatch {
-      url = "https://github.com/obsproject/obs-studio/commit/758b47d4ed9a25b8d64ad481d8d039990b9e57c9.patch";
-      hash = "sha256-jYpjwhx6e+dhN3kzbd6FcdjQ+WhIX0/BOu9PSkt+2yI=";
-    })
-    (fetchpatch {
-      url = "https://github.com/obsproject/obs-studio/commit/4b5be75c7e4b8cee908ed4a02fe0078285b4e8c9.patch";
-      hash = "sha256-tuOevhyxchwG42ilrplbiWoiDAKaY4HgzShlvp4VSQI=";
-    })
-    (fetchpatch {
-      url = "https://github.com/obsproject/obs-studio/commit/6e080a68067b27fe5463f0f4eee7df690451f3d7.patch";
-      hash = "sha256-nbn/q3uszoHaDvaW8Et1MS1sgQzMsJRmjGSMHzUxV70=";
-    })
-
     # Fix libobs.pc for plugins on non-x86 systems
     (fetchpatch {
       name = "fix-arm64-cmake.patch";
@@ -175,6 +157,10 @@ stdenv.mkDerivation (finalAttrs: {
     (lib.cmakeBool "ENABLE_PIPEWIRE" pipewireSupport)
   ];
 
+  env.NIX_CFLAGS_COMPILE = toString [
+    "-Wno-error=sign-compare" # https://github.com/obsproject/obs-studio/issues/10200
+  ];
+
   dontWrapGApps = true;
   preFixup = let
     wrapperLibraries = [
@@ -202,6 +188,8 @@ stdenv.mkDerivation (finalAttrs: {
     ln -s ${libcef}/lib/* $out/lib/obs-plugins/
   '';
 
+  passthru.updateScript = nix-update-script { };
+
   meta = with lib; {
     description = "Free and open source software for video recording and live streaming";
     longDescription = ''

pkgs/applications/video/vdr/nopacity/default.nix

@@ -1,12 +1,12 @@
 { stdenv, lib, fetchFromGitLab, vdr, graphicsmagick }:
 stdenv.mkDerivation rec {
   pname = "vdr-skin-nopacity";
-  version = "1.1.16";
+  version = "1.1.17";
 
   src = fetchFromGitLab {
     repo = "SkinNopacity";
     owner = "kamel5";
-    sha256 = "sha256-5TTilBKlNsFBm5BaCoRV1LzZgpad2lOIQGyk94jGYls=";
+    hash = "sha256-QJKlh5my7e+H5R4E0fCWB/PtwIAXCXw4drQEQzhzfag=";
     rev = version;
   };
 

pkgs/applications/virtualization/docker/default.nix

@@ -279,20 +279,6 @@ rec {
 
   # Get revisions from
   # https://github.com/moby/moby/tree/${version}/hack/dockerfile/install/*
-  docker_20_10 = callPackage dockerGen rec {
-    version = "20.10.26";
-    cliRev = "v${version}";
-    cliHash = "sha256-EPhsng0kLnweVbC8ZnH0NK1/yHlYSA5Sred4rWJX/Gs=";
-    mobyRev = "v${version}";
-    mobyHash = "sha256-IJ7m2mQnsLiom0EuZLpuLY6fYEko7rEy35igJv1AY04=";
-    runcRev = "v1.1.8";
-    runcHash = "sha256-rDJYEc64KW4Qa3Eg2oUjJqIKrg6THb5hxQFFbvb9Zp4=";
-    containerdRev = "v1.6.22";
-    containerdHash = "sha256-In7OkK3xm7Cz3H1jzG9b4tsZbmo44QCq8pNU+PPy8dY=";
-    tiniRev = "v0.19.0";
-    tiniHash = "sha256-ZDKu/8yE5G0RYFJdhgmCdN3obJNyRWv6K/Gd17zc1sI=";
-  };
-
   docker_24 = callPackage dockerGen rec {
     version = "24.0.5";
     cliRev = "v${version}";

pkgs/applications/virtualization/imgcrypt/default.nix

@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "imgcrypt";
-  version = "1.1.9";
+  version = "1.1.10";
 
   src = fetchFromGitHub {
     owner = "containerd";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-EStyi6RDK1G6kuaDGumZaHB4OrSrhhx/F5GsLe0amyA=";
+    hash = "sha256-81jfoWHYYenGQFcQI9kk8uPnv6FcyOtcJjpo1ykdtOI=";
   };
 
   vendorHash = null;

pkgs/applications/window-managers/wayfire/wf-shell.nix

@@ -16,14 +16,14 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "wf-shell";
-  version = "0.8.0";
+  version = "0.8.1";
 
   src = fetchFromGitHub {
     owner = "WayfireWM";
     repo = "wf-shell";
     rev = "v${finalAttrs.version}";
     fetchSubmodules = true;
-    hash = "sha256-K5g9DfFlqZyPHDUswx3vtzh0D9ogOQ1p87ZrqyH35vs=";
+    hash = "sha256-/ajFPIk8VJnlu2DzvSyGD3bC4r/pxALTkZeLNvs9dTw=";
   };
 
   nativeBuildInputs = [

pkgs/build-support/lib/cmake.nix

@@ -0,0 +1,30 @@
+{ stdenv, lib }:
+
+let
+  inherit (lib) findFirst isString optional optionals;
+
+  makeCMakeFlags = { cmakeFlags ? [], ... }:
+    cmakeFlags
+    ++ optionals (stdenv.hostPlatform != stdenv.buildPlatform) ([
+      "-DCMAKE_SYSTEM_NAME=${findFirst isString "Generic" (optional (!stdenv.hostPlatform.isRedox) stdenv.hostPlatform.uname.system)}"
+    ] ++ optionals (stdenv.hostPlatform.uname.processor != null) [
+      "-DCMAKE_SYSTEM_PROCESSOR=${stdenv.hostPlatform.uname.processor}"
+    ] ++ optionals (stdenv.hostPlatform.uname.release != null) [
+      "-DCMAKE_SYSTEM_VERSION=${stdenv.hostPlatform.uname.release}"
+    ] ++ optionals (stdenv.hostPlatform.isDarwin) [
+      "-DCMAKE_OSX_ARCHITECTURES=${stdenv.hostPlatform.darwinArch}"
+    ] ++ optionals (stdenv.buildPlatform.uname.system != null) [
+      "-DCMAKE_HOST_SYSTEM_NAME=${stdenv.buildPlatform.uname.system}"
+    ] ++ optionals (stdenv.buildPlatform.uname.processor != null) [
+      "-DCMAKE_HOST_SYSTEM_PROCESSOR=${stdenv.buildPlatform.uname.processor}"
+    ] ++ optionals (stdenv.buildPlatform.uname.release != null) [
+      "-DCMAKE_HOST_SYSTEM_VERSION=${stdenv.buildPlatform.uname.release}"
+    ] ++ optionals (stdenv.buildPlatform.canExecute stdenv.hostPlatform) [
+      "-DCMAKE_CROSSCOMPILING_EMULATOR=env"
+    ] ++ optionals stdenv.hostPlatform.isStatic [
+      "-DCMAKE_LINK_SEARCH_START_STATIC=ON"
+    ]);
+in
+{
+  inherit makeCMakeFlags;
+}

pkgs/build-support/lib/meson.nix

@@ -0,0 +1,35 @@
+{ stdenv, lib }:
+
+let
+  inherit (lib) boolToString optionals;
+
+  # See https://mesonbuild.com/Reference-tables.html#cpu-families
+  cpuFamily = platform: with platform;
+    /**/ if isAarch32 then "arm"
+    else if isx86_32  then "x86"
+    else platform.uname.processor;
+
+  makeMesonFlags = { mesonFlags ? [], ... }:
+    let
+      crossFile = builtins.toFile "cross-file.conf" ''
+        [properties]
+        bindgen_clang_arguments = ['-target', '${stdenv.targetPlatform.config}']
+        needs_exe_wrapper = ${boolToString (!stdenv.buildPlatform.canExecute stdenv.hostPlatform)}
+
+        [host_machine]
+        system = '${stdenv.targetPlatform.parsed.kernel.name}'
+        cpu_family = '${cpuFamily stdenv.targetPlatform}'
+        cpu = '${stdenv.targetPlatform.parsed.cpu.name}'
+        endian = ${if stdenv.targetPlatform.isLittleEndian then "'little'" else "'big'"}
+
+        [binaries]
+        llvm-config = 'llvm-config-native'
+        rust = ['rustc', '--target', '${stdenv.targetPlatform.rust.rustcTargetSpec}']
+      '';
+      crossFlags = optionals (stdenv.hostPlatform != stdenv.buildPlatform) [ "--cross-file=${crossFile}" ];
+    in crossFlags ++ mesonFlags;
+
+in
+{
+  inherit makeMesonFlags;
+}

pkgs/build-support/node/build-npm-package/hooks/npm-install-hook.sh

@@ -12,7 +12,7 @@ npmInstallHook() {
         local dest="$packageOut/$(dirname "$file")"
         mkdir -p "$dest"
         cp "${npmWorkspace-.}/$file" "$dest"
-    done < <(@jq@ --raw-output '.[0].files | map(.path) | join("\n")' <<< "$(npm_config_cache="$HOME/.npm" npm pack --json --dry-run --loglevel=warn --no-foreground-scripts ${npmWorkspace+--workspace=$npmWorkspace} $npmPackFlags "${npmPackFlagsArray[@]}" $npmFlags "${npmFlagsArray[@]}")")
+    done < <(@jq@ --raw-output '.[0].files | map(.path | select(. | startswith("node_modules/") | not)) | join("\n")' <<< "$(npm_config_cache="$HOME/.npm" npm pack --json --dry-run --loglevel=warn --no-foreground-scripts ${npmWorkspace+--workspace=$npmWorkspace} $npmPackFlags "${npmPackFlagsArray[@]}" $npmFlags "${npmFlagsArray[@]}")")
 
     # Based on code from Python's buildPythonPackage wrap.sh script, for
     # supporting both the case when makeWrapperArgs is an array and a

pkgs/build-support/php/hooks/php-script-utils.bash

@@ -21,6 +21,10 @@ checkComposerValidate() {
             echo -e '\e[31mThe validation of the composer.json failed.\e[0m'
             echo -e '\e[31mMake sure that the file composer.json is valid.\e[0m'
             echo
+            echo -e '\e[31mTo address the issue efficiently, follow one of these steps:\e[0m'
+            echo -e '\e[31m  1. File an issue in the project'\''s issue tracker with detailed information, and apply any available remote patches as a temporary solution '\('with fetchpatch'\)'.\e[0m'
+            echo -e '\e[31m  2. If an immediate fix is needed or if reporting upstream isn'\''t suitable, develop a temporary local patch.\e[0m'
+            echo
             exit 1
         else
             echo
@@ -29,6 +33,10 @@ checkComposerValidate() {
             echo -e '\e[33mThe validation of the composer.json failed.\e[0m'
             echo -e '\e[33mMake sure that the file composer.json is valid.\e[0m'
             echo
+            echo -e '\e[33mTo address the issue efficiently, follow one of these steps:\e[0m'
+            echo -e '\e[33m  1. File an issue in the project'\''s issue tracker with detailed information, and apply any available remote patches as a temporary solution with '\('with fetchpatch'\)'.\e[0m'
+            echo -e '\e[33m  2. If an immediate fix is needed or if reporting upstream isn'\''t suitable, develop a temporary local patch.\e[0m'
+            echo
             echo -e '\e[33mThis check is not blocking, but it is recommended to fix the issue.\e[0m'
             echo
         fi
@@ -42,6 +50,12 @@ checkComposerValidate() {
             echo -e '\e[31mThe validation of the composer.json and composer.lock failed.\e[0m'
             echo -e '\e[31mMake sure that the file composer.lock is consistent with composer.json.\e[0m'
             echo
+            echo -e '\e[31mThis often indicates an issue with the upstream project, which can typically be resolved by reporting the issue to the relevant project maintainers.\e[0m'
+            echo
+            echo -e '\e[31mTo address the issue efficiently, follow one of these steps:\e[0m'
+            echo -e '\e[31m  1. File an issue in the project'\''s issue tracker with detailed information '\('run '\''composer update --lock --no-install'\'' to fix the issue'\)', and apply any available remote patches as a temporary solution with '\('with fetchpatch'\)'.\e[0m'
+            echo -e '\e[31m  2. If an immediate fix is needed or if reporting upstream isn'\''t suitable, develop a temporary local patch.\e[0m'
+            echo
             exit 1
         else
             echo
@@ -50,6 +64,12 @@ checkComposerValidate() {
             echo -e '\e[33mThe validation of the composer.json and composer.lock failed.\e[0m'
             echo -e '\e[33mMake sure that the file composer.lock is consistent with composer.json.\e[0m'
             echo
+            echo -e '\e[33mThis often indicates an issue with the upstream project, which can typically be resolved by reporting the issue to the relevant project maintainers.\e[0m'
+            echo
+            echo -e '\e[33mTo address the issue efficiently, follow one of these steps:\e[0m'
+            echo -e '\e[33m  1. File an issue in the project'\''s issue tracker with detailed information '\('run '\''composer update --lock --no-install'\'' to fix the issue'\)', and apply any available remote patches as a temporary solution with '\('with fetchpatch'\)'.\e[0m'
+            echo -e '\e[33m  2. If an immediate fix is needed or if reporting upstream isn'\''t suitable, develop a temporary local patch.\e[0m'
+            echo
             echo -e '\e[33mThis check is not blocking, but it is recommended to fix the issue.\e[0m'
             echo
         fi

pkgs/build-support/snap/default.nix

@@ -1,4 +0,0 @@
-{ callPackage, hello }:
-{
-  makeSnap = callPackage ./make-snap.nix { };
-}

pkgs/build-support/snap/make-snap.nix

@@ -1,84 +0,0 @@
-{
-  runCommand, squashfsTools, closureInfo, lib, jq, writeText
-}:
-
-{
-  # The meta parameter is the contents of the `snap.yaml`, NOT the
-  # `snapcraft.yaml`.
-  #
-  # - `snap.yaml` is what is inside of the final Snap,
-  # - `snapcraft.yaml` is used by `snapcraft` to build snaps
-  #
-  # Since we skip the `snapcraft` tool, we skip the `snapcraft.yaml`
-  # file. For more information:
-  #
-  #   https://docs.snapcraft.io/snap-format
-  #
-  # Note: unsquashfs'ing an existing snap from the store can be helpful
-  # for determining what you you're missing.
-  #
-  meta
-}: let
-    snap_yaml = let
-      # Validate the snap's meta contains a name.
-      # Also: automatically set the `base` parameter and the layout for
-      # the `/nix` bind.
-      validate = { name, ... } @ args:
-        args // {
-          # Combine the provided arguments with the required options.
-
-          # base: built from https://github.com/NixOS/snapd-nix-base
-          # and published as The NixOS Foundation on the Snapcraft store.
-          base = "nix-base";
-          layout = (args.layout or {}) // {
-            # Bind mount the Snap's root nix directory to `/nix` in the
-            # execution environment's filesystem namespace.
-            "/nix".bind = "$SNAP/nix";
-          };
-        };
-    in writeText "snap.yaml"
-      (builtins.toJSON (validate meta));
-
-  # These are specifically required by snapd, so don't change them
-  # unless you've verified snapcraft / snapd can handle them. Best bet
-  # is to just mirror this list against how snapcraft creates images.
-  # from: https://github.com/snapcore/snapcraft/blob/b88e378148134383ffecf3658e3a940b67c9bcc9/snapcraft/internal/lifecycle/_packer.py#L96-L98
-  mksquashfs_args = [
-    "-noappend" "-comp" "xz" "-no-xattrs" "-no-fragments"
-
-    # Note: We want -all-root every time, since all the files are
-    # owned by root anyway. This is true for Nix, but not true for
-    # other builds.
-    # from: https://github.com/snapcore/snapcraft/blob/b88e378148134383ffecf3658e3a940b67c9bcc9/snapcraft/internal/lifecycle/_packer.py#L100
-    "-all-root"
-  ];
-
-in runCommand "squashfs.img" {
-  nativeBuildInputs = [ squashfsTools jq ];
-
-  closureInfo = closureInfo {
-    rootPaths = [ snap_yaml ];
-  };
-} ''
-  root=$PWD/root
-  mkdir $root
-
-  (
-    # Put the snap.yaml in to `/meta/snap.yaml`, setting the version
-    # to the hash part of the store path
-    mkdir $root/meta
-    version=$(echo $out | cut -d/ -f4 | cut -d- -f1)
-    cat ${snap_yaml} | jq  ". + { version: \"$version\" }" \
-      > $root/meta/snap.yaml
-  )
-
-  (
-    # Copy the store closure in to the root
-    mkdir -p $root/nix/store
-    cat $closureInfo/store-paths | xargs -I{} cp -r {} $root/nix/store/
-  )
-
-  # Generate the squashfs image.
-  mksquashfs $root $out \
-    ${lib.concatStringsSep " " mksquashfs_args}
-''

pkgs/by-name/ad/ad-miner/package.nix

@@ -5,14 +5,14 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "ad-miner";
-  version = "1.1.0";
+  version = "1.2.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "Mazars-Tech";
     repo = "AD_Miner";
     rev = "refs/tags/v${version}";
-    hash = "sha256-eAcnGS0HLrTqc/WVKNNwYA89GK233QZj4Gfggt4S8R8=";
+    hash = "sha256-o1RXuyX2dV0fQwXEeTgmeMYKXiKAqrl+fV8zi1J16Ic=";
   };
 
   # All requirements are pinned

pkgs/by-name/ar/arxiv-latex-cleaner/package.nix

@@ -5,13 +5,13 @@
 }:
 python3Packages.buildPythonApplication rec {
   pname = "arxiv-latex-cleaner";
-  version = "1.0.4";
+  version = "1.0.5";
 
   src = fetchFromGitHub {
     owner = "google-research";
     repo = "arxiv-latex-cleaner";
     rev = "refs/tags/v${version}";
-    hash = "sha256-Dr0GyivoPjQwVYzvN1JIWhuLz60TQtz4MBB8n1hm6Lo=";
+    hash = "sha256-Yxp8XtlISVZfEjCEJ/EXsIGMCHDPOwPcjkJxECeXvYk=";
   };
 
   propagatedBuildInputs = with python3Packages; [

pkgs/by-name/au/audion/package.nix

@@ -0,0 +1,27 @@
+{ lib
+, fetchFromGitHub
+, rustPlatform
+}:
+
+rustPlatform.buildRustPackage rec {
+  pname = "audion";
+  version = "0.2.0";
+
+  src = fetchFromGitHub {
+    owner = "audiusGmbH";
+    repo = "audion";
+    rev = "refs/tags/${version}";
+    hash = "sha256-j8sQCeHpxrpzyY75DypWI9z+JBWq7aaaXPnZh7ksRjc=";
+  };
+
+  cargoHash = "sha256-/x2gjLz73uPY+ouQOxLN2ViET+V/s9jgkgw97yzVj24=";
+
+  meta = with lib; {
+    description = "Ping the host continuously and write results to a file";
+    homepage = "https://github.com/audiusGmbH/audion";
+    changelog = "https://github.com/audiusGmbH/audion/releases/tag/${version}";
+    license = licenses.mit;
+    maintainers = with maintainers; [ fab ];
+    mainProgram = "audion";
+  };
+}

pkgs/by-name/bo/boxbuddy/package.nix

@@ -9,16 +9,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "boxbuddy";
-  version = "2.1.3";
+  version = "2.1.4";
 
   src = fetchFromGitHub {
     owner = "Dvlv";
     repo = "BoxBuddyRS";
     rev = version;
-    hash = "sha256-Jl9WhMqb40Olub5eV7Meu5DJi+bzWhPf3DCRPe4CMfo=";
+    hash = "sha256-954jMFWSIDDqtMitgc8456SMcQLzi6LhLbVvOC45fxQ=";
   };
 
-  cargoHash = "sha256-HN+yGODTRXRa3AsBOuRVOnnU2pxBZfy0zlnCWs2oQCI=";
+  cargoHash = "sha256-08d0mPSGYySxw2uq16MNOu2Y39kjqyfZ8rJ2yTOL3/w=";
 
   # The software assumes it is installed either in flatpak or in the home directory
   # so the xdg data path needs to be patched here

pkgs/by-name/br/bruno/package.nix

@@ -14,24 +14,33 @@
 , cairo
 , pango
 , npm-lockfile-fix
+, overrideSDK
+, darwin
 }:
 
-buildNpmPackage rec {
+let
+  # fix for: https://github.com/NixOS/nixpkgs/issues/272156
+  buildNpmPackage' =
+    buildNpmPackage.override {
+      stdenv = if stdenv.isDarwin then overrideSDK stdenv "11.0" else stdenv;
+    };
+in
+buildNpmPackage' rec {
   pname = "bruno";
-  version = "1.8.0";
+  version = "1.10.0";
 
   src = fetchFromGitHub {
     owner = "usebruno";
     repo = "bruno";
     rev = "v${version}";
-    hash = "sha256-STWGZzFtU3UpctgNz3m96JyfSRzHy2ZZQPr8R+zpDgM=";
+    hash = "sha256-wxQaKewKIfN93Wvb7WmOSuflTgfk1XKvHAA1UIVyMqk=";
 
     postFetch = ''
       ${lib.getExe npm-lockfile-fix} $out/package-lock.json
     '';
   };
 
-  npmDepsHash = "sha256-0Uac4Q3EYiTkg6RFuwR+saXiVm7jISyZBjkN30uYnnE=";
+  npmDepsHash = "sha256-IXFFOegzJbDcQejqQsAg11jDnhSKi27Olm8m3qr7bqw=";
   npmFlags = [ "--legacy-peer-deps" ];
 
   nativeBuildInputs = [
@@ -46,6 +55,8 @@ buildNpmPackage rec {
     pixman
     cairo
     pango
+  ] ++ lib.optionals stdenv.isDarwin [
+    darwin.apple_sdk_11_0.frameworks.CoreText
   ];
 
   desktopItems = [

pkgs/by-name/ci/cimg/package.nix

@@ -7,13 +7,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "cimg";
-  version = "3.3.4";
+  version = "3.3.5";
 
   src = fetchFromGitHub {
     owner = "GreycLab";
     repo = "CImg";
     rev = "v.${finalAttrs.version}";
-    hash = "sha256-qo/k5NpTqu+o2WUEOThozuBJVPMMy8OvIMo2DfJUE8g=";
+    hash = "sha256-QdQhMEY6Zl3qdvRIeDv/12TL4HMrNJSAQ66vQymOrBU=";
   };
 
   outputs = [ "out" "doc" ];

pkgs/by-name/cl/clash-verge-rev/package.nix

@@ -5,11 +5,11 @@
 
 clash-verge.overrideAttrs (old: rec {
   pname = "clash-verge-rev";
-  version = "1.5.7";
+  version = "1.5.8";
 
   src = fetchurl {
     url = "https://github.com/clash-verge-rev/clash-verge-rev/releases/download/v${version}/clash-verge_${version}_amd64.deb";
-    hash = "sha256-w6qKS+uHWGrY1f4Db7rgM/1jECHz3k9vXWdxhDmDX1A=";
+    hash = "sha256-cB42pnGgXyIT9H2qTeLAHi37Eij3CrJxgsp4zXRcrx8=";
   };
 
   meta = old.meta // (with lib; {

pkgs/by-name/cl/clash-verge/package.nix

@@ -9,6 +9,7 @@
 , webkitgtk
 , udev
 , libayatana-appindicator
+, nix-update-script
 }:
 
 stdenv.mkDerivation rec {
@@ -51,6 +52,8 @@ stdenv.mkDerivation rec {
     ln -sf ${lib.getExe clash-meta} $out/bin/${clash-meta.meta.mainProgram}
   '';
 
+  passthru.updateScript = nix-update-script { };
+
   meta = with lib; {
     description = "A Clash GUI based on tauri";
     homepage = "https://github.com/zzzgydi/clash-verge";

pkgs/by-name/cr/crosswords/package.nix

@@ -0,0 +1,50 @@
+{ lib
+, stdenv
+, fetchFromGitLab
+, meson
+, ninja
+, pkg-config
+, wrapGAppsHook4
+, desktop-file-utils
+, libadwaita
+, isocodes
+, json-glib
+, libipuz
+}:
+
+stdenv.mkDerivation rec {
+  pname = "crosswords";
+  version = "0.3.12";
+
+  src = fetchFromGitLab {
+    domain = "gitlab.gnome.org";
+    owner = "jrb";
+    repo = "crosswords";
+    rev = version;
+    hash = "sha256-3RL2LJdIHmDAjXaxqsE0n5UQMsuBJWEMoyAEoSBemR0=";
+  };
+
+  nativeBuildInputs = [
+    meson
+    ninja
+    pkg-config
+    wrapGAppsHook4
+    desktop-file-utils
+  ];
+
+  buildInputs = [
+    libadwaita
+    isocodes
+    json-glib
+    libipuz
+  ];
+
+  meta = with lib; {
+    description = "A Crossword player and editor for GNOME";
+    homepage = "https://gitlab.gnome.org/jrb/crosswords";
+    license = licenses.gpl3Plus;
+    mainProgram = "crosswords";
+    maintainers = with maintainers; [ aleksana ];
+    platforms = platforms.unix;
+  };
+}

pkgs/by-name/de/dep-scan/package.nix

@@ -5,21 +5,19 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "dep-scan";
-  version = "5.2.11";
+  version = "5.2.12";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "owasp-dep-scan";
     repo = "dep-scan";
     rev = "refs/tags/v${version}";
-    hash = "sha256-BEvuCdQcr35jWe9r9KR4Uov1zNVxfPSnENNPgy4N+nc=";
+    hash = "sha256-UoppQAokiWBcgTcSmwfoqrDKt/QHYd2NBR3CpNOqI4k=";
   };
 
   postPatch = ''
     substituteInPlace pytest.ini \
       --replace " --cov-append --cov-report term --cov depscan" ""
-    substituteInPlace pyproject.toml \
-      --replace "oras==0.1.26" "oras~=0.1.26"
   '';
 
   nativeBuildInputs = with python3.pkgs; [

pkgs/by-name/dm/dmarc-report-converter/package.nix

@@ -7,13 +7,13 @@
 
 buildGoModule rec {
   pname = "dmarc-report-converter";
-  version = "0.7.0";
+  version = "0.7.1";
 
   src = fetchFromGitHub {
     owner = "tierpod";
     repo = "dmarc-report-converter";
     rev = "v${version}";
-    hash = "sha256-doipM3SZmU/QUglN0UA2IpRgrhdMnuCmMPRs0OWRxPE=";
+    hash = "sha256-cP96tiBpMFNEHuIF0sovi+Q4yW8wMUqr138RyMOFoho=";
   };
 
   vendorHash = null;

pkgs/by-name/do/doublecmd/package.nix

@@ -13,13 +13,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "doublecmd";
-  version = "1.1.10";
+  version = "1.1.11";
 
   src = fetchFromGitHub {
     owner = "doublecmd";
     repo = "doublecmd";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-vRB4qUws3kqCf7gp8Lzt8e9p68FaAfQyFHj4oJS9QtI=";
+    hash = "sha256-8kxaJp9mSJ6fHOgVD5iFjecUU0Kt10KCAVSYMQt+bSw=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/fr/fretboard/package.nix

@@ -1,6 +1,7 @@
 { lib
 , blueprint-compiler
 , cargo
+, darwin
 , desktop-file-utils
 , fetchFromGitHub
 , glib
@@ -17,19 +18,19 @@
 
 stdenv.mkDerivation rec {
   pname = "fretboard";
-  version = "5.3";
+  version = "5.4";
 
   src = fetchFromGitHub {
     owner = "bragefuglseth";
-    repo = pname;
+    repo = "fretboard";
     rev = "v${version}";
-    hash = "sha256-wwq4Xq6IVLF2hICk9HfCpfxpWer8PNWywD8p3wQdp6U=";
+    hash = "sha256-GqnwAB7hmg2QLwSWqrZtTp6+FybK8/v4GZx/lMi0dGY=";
   };
 
   cargoDeps = rustPlatform.fetchCargoTarball {
     inherit src;
     name = "${pname}-${version}";
-    hash = "sha256-H/dAKaYHxRmldny8EoasrcDROZhLo5UbHPAoMicDehA=";
+    hash = "sha256-sGvb1+HKIqNSgCV9UzkCrkGrpjA34Pe9eq2/w3K/w/E=";
   };
 
   nativeBuildInputs = [
@@ -48,8 +49,14 @@ stdenv.mkDerivation rec {
     glib
     gtk4
     libadwaita
+  ] ++ lib.optionals stdenv.isDarwin [
+    darwin.apple_sdk.frameworks.Foundation
   ];
 
+  env.NIX_CFLAGS_COMPILE = toString (lib.optionals stdenv.cc.isClang [
+    "-Wno-error=incompatible-function-pointer-types"
+  ]);
+
   meta = with lib; {
     description = "Look up guitar chords";
     homepage = "https://github.com/bragefuglseth/fretboard";
@@ -57,6 +64,6 @@ stdenv.mkDerivation rec {
     license = licenses.gpl3Plus;
     maintainers = with maintainers; [ michaelgrahamevans ];
     mainProgram = "fretboard";
-    platforms = platforms.linux;
+    platforms = platforms.unix;
   };
 }

pkgs/by-name/fw/fwupd/package.nix

@@ -120,7 +120,7 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "fwupd";
-  version = "1.9.14";
+  version = "1.9.15";
 
   # libfwupd goes to lib
   # daemon, plug-ins and libfwupdplugin go to out
@@ -131,7 +131,7 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "fwupd";
     repo = "fwupd";
     rev = finalAttrs.version;
-    hash = "sha256-pG4pRksHw8p8rz99UnLURP+ROE+P+ySt4IlfmyRc1CQ=";
+    hash = "sha256-w0egw5FKNAOnIYjp2RUx74taivnClQmRfhaFHdKOGZc=";
   };
 
   patches = [

pkgs/by-name/g3/g3kb-switch/package.nix

@@ -0,0 +1,33 @@
+{ lib
+, stdenv
+, cmake
+, pkg-config
+, glib
+, fetchFromGitHub
+}:
+stdenv.mkDerivation rec {
+  pname = "g3kb-switch";
+  version = "1.4";
+  src = fetchFromGitHub {
+    owner = "lyokha";
+    repo = "g3kb-switch";
+    rev = version;
+    sha256 = "sha256-mcZduHcteZ+nS0YEZG5DfmpA8xrnLhwxumq6hLuLPIs=";
+  };
+
+  nativeBuildInputs = [
+    cmake
+    pkg-config
+  ];
+  buildInputs = [
+    glib
+  ];
+
+  meta = with lib; {
+    homepage = "https://github.com/lyokha/g3kb-switch";
+    description = "CLI keyboard layout switcher for GNOME Shell";
+    license = licenses.bsd2;
+    maintainers = with maintainers; [ Freed-Wu ];
+    platforms = platforms.unix;
+  };
+}

pkgs/by-name/gi/git-instafix/package.nix

@@ -0,0 +1,42 @@
+{ git
+, lib
+, libgit2
+, makeWrapper
+, rustPlatform
+, stdenv
+, fetchFromGitHub
+}:
+let
+  inherit
+    (lib)
+    licenses
+    maintainers
+    ;
+
+  version = "0.2.1";
+in
+rustPlatform.buildRustPackage {
+  pname = "git-instafix";
+  inherit version;
+
+  src = fetchFromGitHub {
+    owner = "quodlibetor";
+    repo = "git-instafix";
+    rev = "v${version}";
+    hash = "sha256-rWHiaZji3GECsiMqvEGC/tF+K29ZLlY6+TCNxtixHQo=";
+  };
+
+  cargoHash = "sha256-t5vlr3YxjRPqMHwPqVjWul4RdSg0hiTWUQxcJmGKiTQ=";
+
+  buildInputs = [ libgit2 ];
+  nativeCheckInputs = [ git ];
+
+  meta = {
+    description = "Quickly fix up an old commit using your currently-staged changes";
+    homepage = "https://github.com/quodlibetor/git-instafix";
+    license = with licenses; [ mit asl20 ];
+    maintainers = with maintainers; [ mightyiam ];
+    changelog = "https://github.com/quodlibetor/git-instafix/releases/tag/v${version}";
+    broken = stdenv.isDarwin;
+  };
+}

pkgs/by-name/gi/gitu/package.nix

@@ -12,16 +12,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "gitu";
-  version = "0.5.4";
+  version = "0.6.2";
 
   src = fetchFromGitHub {
     owner = "altsem";
     repo = "gitu";
     rev = "v${version}";
-    hash = "sha256-a4hNgEizxanYE3XuHSCmbV6CkOqhXkznP3Sp0KLFFQs=";
+    hash = "sha256-ymAggfyLPpXp4aQPHp1R+olKeCZwrcwu1GldM8yJVtQ=";
   };
 
-  cargoHash = "sha256-+CA3UG32oZedzRbt7b0wOlhH/subuym4BCL5SMNzrr8=";
+  cargoHash = "sha256-pIA9AnJoauT5nLxSgzR2Lk3wSo30fXAepAJlMahSuCA=";
 
   nativeBuildInputs = [
     pkg-config

pkgs/by-name/gm/gmic/package.nix

@@ -26,7 +26,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "gmic";
-  version = "3.3.1";
+  version = "3.3.5";
 
   outputs = [ "out" "lib" "dev" "man" ];
 
@@ -34,15 +34,15 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "GreycLab";
     repo = "gmic";
     rev = "v.${finalAttrs.version}";
-    hash = "sha256-HagGabJ1jkg5SkMlr0Y5rGFw64jPW8QLuR0I2idM1N0=";
+    hash = "sha256-881+o6Wz4yNf92JNNLQn9x44SSjXAp/cZLkBGCfM6DY=";
   };
 
   # TODO: build this from source
-  # Reference: src/Makefile, directive gmic_stdlib.h
+  # Reference: src/Makefile, directive gmic_stdlib_community.h
   gmic_stdlib = fetchurl {
-    name = "gmic_stdlib.h";
+    name = "gmic_stdlib_community.h";
-    url = "http://gmic.eu/gmic_stdlib${lib.replaceStrings ["."] [""] finalAttrs.version}.h";
+    url = "http://gmic.eu/gmic_stdlib_community${lib.replaceStrings ["."] [""] finalAttrs.version}.h";
-    hash = "sha256-7JzFU4HvAtC5Nz5vusKCnJ8VMuKfSi1yFmjj0Hh+vA4=";
+    hash = "sha256-UZzCAs+x9dVMeaeEvPgyVZ5S6UO0yhJWVMgBvBiW2ME=";
   };
 
   nativeBuildInputs = [
@@ -71,10 +71,7 @@ stdenv.mkDerivation (finalAttrs: {
   ];
 
   postPatch = ''
-    cp -r ${finalAttrs.gmic_stdlib} src/gmic_stdlib.h
+    cp -r ${finalAttrs.gmic_stdlib} src/gmic_stdlib_community.h
-
-    # CMake build files were moved to subdirectory.
-    mv resources/CMakeLists.txt resources/cmake .
   ''
   + lib.optionalString stdenv.isDarwin ''
     substituteInPlace CMakeLists.txt \

pkgs/by-name/he/helix-gpt/pin.json

@@ -1,7 +1,7 @@
 {
-  "version": "0.28",
+  "version": "0.31",
-  "srcHash": "sha256-vOXY8B5CRCEQX/NnBVNwmyRKSeDSliurClRPiJIAD3Y=",
+  "srcHash": "sha256-wDVeX1tHw9pTxYLRkr8BJlF5XIee0/e0f5hzes4ui/o=",
   "x86_64-linux": "sha256-h6wGkOfSbB8Rwm7eFvcowDdH1RdS6eFaxgf+SdYvYt8=",
-  "x86_64-darwin": "sha256-lkURZs6nQpsZ7SGX+eLoBEXa9VdTQP795iHAGYyRaVs=",
+  "x86_64-darwin": "sha256-Sjt/JkyPRCzRpAqJOmBKCBAGWSeV7RYOOokCLYCqg+8=",
-  "aarch64-darwin": "sha256-lkURZs6nQpsZ7SGX+eLoBEXa9VdTQP795iHAGYyRaVs="
+  "aarch64-darwin": "sha256-Sjt/JkyPRCzRpAqJOmBKCBAGWSeV7RYOOokCLYCqg+8="
 }

pkgs/by-name/km/kminion/package.nix

@@ -0,0 +1,31 @@
+{ lib
+, stdenv
+, fetchFromGitHub
+, buildGoModule
+}:
+
+buildGoModule rec {
+  pname = "kafka-minion";
+  version = "2.2.7";
+
+  src = fetchFromGitHub {
+    owner = "redpanda-data";
+    repo = "kminion";
+    rev = "0c90d4301ed4600d1aaf3345b6f16587d2f282fc";
+    hash = "sha256-CWjX46Sfc9Xj+R7+CZeMuTY0iUStzyZXI4FotwqR44M=";
+  };
+
+  vendorHash = "sha256-6yfQVoY/bHMA4s0IN5ltnQdHWnE3kIKza36uEcGa11U=";
+
+  doCheck = false;
+
+  passthru.updateScript = ./update.sh;
+
+  meta = with lib; {
+    description = "KMinion is a feature-rich Prometheus exporter for Apache Kafka written in Go";
+    license = licenses.mit;
+    platforms = platforms.linux;
+    maintainers = with maintainers; [ cafkafk ];
+    mainProgram = "kminion";
+  };
+}

pkgs/by-name/km/kminion/update.sh

@@ -0,0 +1,4 @@
+#!/usr/bin/env nix-shell
+#!nix-shell -i bash -p nix-update
+
+nix-update kminion

pkgs/by-name/le/lefthook/package.nix

@@ -6,7 +6,7 @@
 
 let
   pname = "lefthook";
-  version = "1.6.5";
+  version = "1.6.6";
 in
 buildGoModule {
   inherit pname version;
@@ -15,10 +15,10 @@ buildGoModule {
     owner = "evilmartians";
     repo = "lefthook";
     rev = "v${version}";
-    hash = "sha256-C76yQ9F4QSywGdihDbNh8KwSL2U+rUjb8VpWRByxzVk=";
+    hash = "sha256-upt6N6t2ogCaRrHwvw/grTbhr0QXVQCtxMd34XmK030=";
   };
 
-  vendorHash = "sha256-yWT7IX1n8CQSyXAzoncyYHzvYvIr8WzolyvC8/Cuhlo=";
+  vendorHash = "sha256-b+1Y75CG4ayDmnhYfPwpzMFrHCPmZ0FMbMsLiToac5c=";
 
   nativeBuildInputs = [ installShellFiles ];
 

pkgs/by-name/li/libipuz/package.nix

@@ -0,0 +1,42 @@
+{ lib
+, stdenv
+, fetchFromGitLab
+, meson
+, ninja
+, pkg-config
+, glib
+, json-glib
+}:
+
+stdenv.mkDerivation rec {
+  pname = "libipuz";
+  version = "0.4.5";
+
+  src = fetchFromGitLab {
+    domain = "gitlab.gnome.org";
+    owner = "jrb";
+    repo = "libipuz";
+    rev = version;
+    hash = "sha256-psC2cFqSTlToCtCxwosXyJbmX/96AEI0xqzXtlc/HQE=";
+  };
+
+  nativeBuildInputs = [
+    meson
+    ninja
+    pkg-config
+    glib
+  ];
+
+  buildInputs = [
+    glib
+    json-glib
+  ];
+
+  meta = with lib; {
+    description = "Library for parsing .ipuz puzzle files";
+    homepage = "https://gitlab.gnome.org/jrb/libipuz";
+    license = licenses.lgpl21Plus;
+    maintainers = with maintainers; [ aleksana ];
+    platforms = platforms.unix;
+  };
+}

pkgs/by-name/lu/lubelogger/package.nix

@@ -6,13 +6,13 @@
 
 buildDotnetModule rec {
   pname = "lubelogger";
-  version = "1.2.5";
+  version = "1.2.6";
 
   src = fetchFromGitHub {
     owner = "hargata";
     repo = "lubelog";
     rev = "v${version}";
-    hash = "sha256-wMsIcmHNNpgfYtQNQX8D7umdAGnlv0v5PIcI4Q5mRos=";
+    hash = "sha256-ZFFTkRCwcoYBjdzlkeAl2MCokF1dXuRV56WpGo2oaiA=";
   };
 
   projectFile = "CarCareTracker.sln";

pkgs/by-name/mb/mbpoll/package.nix

@@ -8,13 +8,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "mbpoll";
-  version = "1.5";
+  version = "1.5.2";
 
   src = fetchFromGitHub {
     owner = "epsilonrt";
     repo = "mbpoll";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-rHjLDgfKtpREemttWt0pr7VtBjwZCSplUR4OWNBVW0c=";
+    hash = "sha256-rO3j/p7MABlxcwRAZm26u7wgODGFTtetSDhPWPzTuEA=";
   };
 
   buildInputs = [ libmodbus ];

pkgs/by-name/ni/nickel/package.nix

@@ -8,29 +8,21 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "nickel";
-  version = "1.4.1";
+  version = "1.5.0";
 
   src = fetchFromGitHub {
     owner = "tweag";
     repo = "nickel";
     rev = "refs/tags/${version}";
-    hash = "sha256-VltrIGo4jXV6lDIqj+hTQQ46PJH1v9CVFOZopyi9tbM=";
+    hash = "sha256-tb0nIBj/5nb0WbkceL7Rt1Rs0Qjy5/2leSOofF4zhTY=";
   };
 
   cargoLock = {
     lockFile = ./Cargo.lock;
     outputHashes = {
-      "topiary-0.3.0" = "sha256-1leQLRohX0iDiOOO96ETM2L3yOElW8OwR5IcrsoxfOo=";
+      "topiary-core-0.3.0" = "sha256-2oVdtBcH1hF+p3PixBOljHXvGX2YCoRzA/vlBDvN7fE=";
-      "tree-sitter-bash-0.20.4" = "sha256-+Mpks0FyQLl26TX63J6WhaAl/QDUR1k9wSUY5SFwL+w=";
+      "topiary-queries-0.3.0" = "sha256-1leQLRohX0iDiOOO96ETM2L3yOElW8OwR5IcrsoxfOo=";
-      "tree-sitter-facade-0.9.3" = "sha256-M/npshnHJkU70pP3I4WMXp3onlCSWM5mMIqXP45zcUs=";
-      "tree-sitter-json-0.20.1" = "sha256-Msnct7JzPBIR9+PIBZCJTRdVMUzhaDTKkl3JaDUKAgo=";
       "tree-sitter-nickel-0.1.0" = "sha256-HyHdameEgET5UXKMgw7EJvZsJxToc9Qz26XHvc5qmU0=";
-      "tree-sitter-ocaml-0.20.4" = "sha256-ycmjIKfrsVSVHmPP3HCxfk5wcBIF/JFH8OnU8mY1Cc8=";
-      "tree-sitter-ocamllex-0.20.2" = "sha256-YhmEE7I7UF83qMuldHqc/fD/no/7YuZd6CaAIaZ1now=";
-      "tree-sitter-query-0.1.0" = "sha256-5N7FT0HTK3xzzhAlk3wBOB9xlEpKSNIfakgFnsxEi18=";
-      "tree-sitter-rust-0.20.4" = "sha256-egTxBuliboYbl+5N6Jdt960EMLByVmLqSmQLps3rEok=";
-      "tree-sitter-toml-0.5.1" = "sha256-5nLNBxFeOGE+gzbwpcrTVnuL1jLUA0ZLBVw2QrOLsDQ=";
-      "web-tree-sitter-sys-1.3.0" = "sha256-9rKB0rt0y9TD/HLRoB9LjEP9nO4kSWR9ylbbOXo2+2M=";
     };
   };
 

pkgs/by-name/op/openapi-tui/package.nix

@@ -0,0 +1,28 @@
+{ lib
+, rustPlatform
+, fetchFromGitHub
+, pkg-config
+}:
+
+rustPlatform.buildRustPackage rec {
+  pname = "openapi-tui";
+  version = "0.4.0";
+
+  src = fetchFromGitHub {
+    owner = "zaghaghi";
+    repo = "openapi-tui";
+    rev = version;
+    hash = "sha256-7xkjlX3+/hdVN2PXoiXbouSoMLy0Qe8uMRlPHWJO5Ts=";
+  };
+
+  cargoHash = "sha256-U8TOms8C7vV64OKKdJhMAoOha9s2lBqfBWU7pyZ0h/s=";
+
+  meta = with lib; {
+    description = "Terminal UI to list, browse and run APIs defined with openapi spec";
+    homepage = "https://github.com/zaghaghi/openapi-tui";
+    license = licenses.mit;
+    maintainers = with maintainers; [ matthiasbeyer ];
+    mainProgram = "openapi-tui";
+  };
+}
+