Merge pull request #306913 from hacker1024/fix/pystemd-lxml

python3Packages.pystemd: Move runtime dependencies to propagatedBuildInputs

.github/CODEOWNERS

@@ -13,7 +13,6 @@
 
 # GitHub actions
 /.github/workflows @NixOS/Security @Mic92 @zowoq
-/.github/workflows/merge-staging @FRidh
 
 # EditorConfig
 /.editorconfig @Mic92 @zowoq
@@ -125,10 +124,8 @@ nixos/modules/installer/tools/nix-fallback-paths.nix  @raitobezarius @ma27
 /pkgs/common-updater/scripts/update-source-version    @jtojnar
 
 # Python-related code and docs
-/maintainers/scripts/update-python-libraries	              @FRidh
-/pkgs/development/interpreters/python                       @FRidh
-/doc/languages-frameworks/python.section.md                 @FRidh @mweinelt
-/pkgs/development/interpreters/python/hooks                 @FRidh @jonringer
+/doc/languages-frameworks/python.section.md                 @mweinelt
+/pkgs/development/interpreters/python/hooks                 @jonringer
 
 # Haskell
 /doc/languages-frameworks/haskell.section.md  @sternenseemann @maralorn @ncfavier

doc/languages-frameworks/python.section.md

@@ -878,7 +878,6 @@ buildPythonPackage rec {
     homepage = "https://github.com/pytoolz/toolz";
     description = "List processing tools and functional utilities";
     license = lib.licenses.bsd3;
-    maintainers = with lib.maintainers; [ fridh ];
   };
 }
 ```
@@ -1013,7 +1012,6 @@ buildPythonPackage rec {
     homepage = "https://github.com/ContinuumIO/datashape";
     description = "A data description language";
     license = lib.licenses.bsd2;
-    maintainers = with lib.maintainers; [ fridh ];
   };
 }
 ```
@@ -1134,7 +1132,6 @@ buildPythonPackage rec {
     description = "A pythonic wrapper around FFTW, the FFT library, presenting a unified interface for all the supported transforms";
     homepage = "http://hgomersall.github.com/pyFFTW";
     license = with lib.licenses; [ bsd2 bsd3 ];
-    maintainers = with lib.maintainers; [ fridh ];
   };
 }
 ```
@@ -1494,7 +1491,6 @@ buildPythonPackage rec {
     homepage = "https://github.com/pytoolz/toolz/";
     description = "List processing tools and functional utilities";
     license = lib.licenses.bsd3;
-    maintainers = with lib.maintainers; [ fridh ];
   };
 }
 ```

lib/licenses.nix

@@ -1168,6 +1168,11 @@ in mkLicense lset) ({
     # channel and NixOS images.
   };
 
+  unicode-30 = {
+    spdxId = "Unicode-3.0";
+    fullName = "Unicode License v3";
+  };
+
   unicode-dfs-2015 = {
     spdxId = "Unicode-DFS-2015";
     fullName = "Unicode License Agreement - Data Files and Software (2015)";

maintainers/maintainer-list.nix

@@ -1086,12 +1086,6 @@
     githubId = 153175;
     name = "Andrew Marshall";
   };
-  amaxine = {
-    email = "max@ine.dev";
-    github = "amaxine";
-    githubId = 35892750;
-    name = "Maxine Aubrey";
-  };
   ambroisie = {
     email = "bruno.nixpkgs@belanyi.fr";
     github = "ambroisie";
@@ -1247,12 +1241,6 @@
     githubId = 962885;
     name = "Andrew Chambers";
   };
-  andrew-d = {
-    email = "andrew@du.nham.ca";
-    github = "andrew-d";
-    githubId = 1079173;
-    name = "Andrew Dunham";
-  };
   andrewrk = {
     email = "superjoe30@gmail.com";
     github = "andrewrk";
@@ -1803,11 +1791,6 @@
       fingerprint = "409D 201E 9450 8732 A49E  D0FC 6BDA F874 0068 08DF";
     }];
   };
-  ashvith-shetty = {
-    github = "Ashvith10";
-    githubId = 113123021;
-    name = "Ashvith Shetty";
-  };
   asininemonkey = {
     email = "nixpkgs@asininemonkey.com";
     github = "asininemonkey";
@@ -3563,12 +3546,6 @@
     githubId = 1118859;
     name = "Scott Worley";
   };
-  ChlorideCull = {
-    email = "nixrelated@chcl.se";
-    github = "ChlorideCull";
-    githubId = 4977063;
-    name = "Sebastian Johansson";
-  };
   choochootrain = {
     email = "hurshal@imap.cc";
     github = "choochootrain";
@@ -5957,12 +5934,6 @@
     name = "Zhenbo Li";
     matrix = "@zhenbo:matrix.org";
   };
-  endocrimes = {
-    email = "dani@builds.terrible.systems";
-    github = "endocrimes";
-    githubId = 1330683;
-    name = "Danielle Lancashire";
-  };
   enorris = {
     name = "Eric Norris";
     email = "erictnorris@gmail.com";
@@ -7377,12 +7348,6 @@
     githubId = 104317939;
     name = "gilice";
   };
-  gilligan = {
-    email = "tobias.pflug@gmail.com";
-    github = "gilligan";
-    githubId = 27668;
-    name = "Tobias Pflug";
-  };
   gin66 = {
     email = "jochen@kiemes.de";
     github = "gin66";
@@ -10822,6 +10787,12 @@
     githubId = 2037002;
     name = "Konstantinos";
   };
+  kotatsuyaki = {
+    email = "kotatsuyaki@mail.kotatsu.dev";
+    github = "kotatsuyaki";
+    githubId = 17219127;
+    name = "kotatsuyaki";
+  };
   kouyk = {
     email = "skykinetic@stevenkou.xyz";
     github = "kouyk";
@@ -13611,12 +13582,6 @@
     githubId = 20026143;
     name = "Katona László";
   };
-  MP2E = {
-    email = "MP2E@archlinux.us";
-    github = "MP2E";
-    githubId = 167708;
-    name = "Cray Elliott";
-  };
   mpcsh = {
     email = "m@mpc.sh";
     github = "mpcsh";
@@ -13732,15 +13697,6 @@
     githubId = 3856390;
     email = "mschwaig+nixpkgs@eml.cc";
   };
-  msfjarvis = {
-    github = "msfjarvis";
-    githubId = 13348378;
-    name = "Harsh Shandilya";
-    email = "nixos@msfjarvis.dev";
-    keys = [{
-      fingerprint = "8F87 050B 0F9C B841 1515  7399 B784 3F82 3355 E9B9";
-    }];
-  };
   msiedlarek = {
     email = "mikolaj@siedlarek.pl";
     github = "msiedlarek";
@@ -14660,12 +14616,6 @@
     githubId = 126072875;
     name = "nova madeline";
   };
-  novenary = {
-    email = "streetwalkermc@gmail.com";
-    github = "9ary";
-    githubId = 1155030;
-    name = "novenary";
-  };
   novoxd = {
     email = "radnovox@gmail.com";
     github = "novoxd";
@@ -16357,6 +16307,12 @@
     githubId = 5636;
     name = "Steve Purcell";
   };
+  purrpurrn = {
+    email = "scrcpynovideoaudiocodecraw+nixpkgs@gmail.com";
+    github = "purrpurrn";
+    githubId = 142632643;
+    name = "purrpurrn";
+  };
   putchar = {
     email = "slim.cadoux@gmail.com";
     matrix = "@putch4r:matrix.org";
@@ -22515,12 +22471,6 @@
     githubId = 51886259;
     name = "Zokre Zyl";
   };
-  zombiezen = {
-    name = "Ross Light";
-    email = "ross@zombiezen.com";
-    github = "zombiezen";
-    githubId = 181535;
-  };
   zookatron = {
     email = "tim@zookatron.com";
     github = "zookatron";

maintainers/team-list.nix

@@ -32,7 +32,6 @@ with lib.maintainers; {
   acme = {
     members = [
       aanderse
-      andrew-d
       arianvp
       emily
       flokli
@@ -376,7 +375,6 @@ with lib.maintainers; {
       krav
       talyz
       yayayayaka
-      yuka
     ];
     scope = "Maintain gitlab packages.";
     shortName = "gitlab";
@@ -404,7 +402,6 @@ with lib.maintainers; {
       hedning
       jtojnar
       dasj19
-      amaxine
     ];
     githubTeams = [
       "gnome"
@@ -527,7 +524,6 @@ with lib.maintainers; {
     members = [
       aanderse
       edwtjo
-      MP2E
       thiagokokada
     ];
     scope = "Maintain Libretro, RetroArch and related packages.";
@@ -829,7 +825,6 @@ with lib.maintainers; {
 
   python = {
     members = [
-      fridh
       hexa
       jonringer
       tjni

nixos/doc/manual/configuration/abstractions.section.md

@@ -35,7 +35,7 @@ in
 {
   services.httpd.virtualHosts =
     { "blog.example.org" = (commonConfig // { documentRoot = "/webroot/blog.example.org"; });
-      "wiki.example.org" = (commonConfig // { documentRoot = "/webroot/wiki.example.com"; });
+      "wiki.example.org" = (commonConfig // { documentRoot = "/webroot/wiki.example.org"; });
     };
 }
 ```

nixos/doc/manual/configuration/profiles/graphical.section.md

@@ -6,5 +6,5 @@ graphical installation CD.
 It sets [](#opt-services.xserver.enable),
 [](#opt-services.displayManager.sddm.enable),
 [](#opt-services.xserver.desktopManager.plasma5.enable),
-and [](#opt-services.xserver.libinput.enable) to true. It also
+and [](#opt-services.libinput.enable) to true. It also
 includes glxinfo and firefox in the system packages list.

nixos/doc/manual/configuration/x-windows.chapter.md

@@ -207,7 +207,7 @@ Latitude series) can be enabled as follows:
 
 ```nix
 {
-  services.xserver.libinput.enable = true;
+  services.libinput.enable = true;
 }
 ```
 
@@ -216,7 +216,7 @@ For instance, the following disables tap-to-click behavior:
 
 ```nix
 {
-  services.xserver.libinput.touchpad.tapping = false;
+  services.libinput.touchpad.tapping = false;
 }
 ```
 

nixos/doc/manual/release-notes/rl-2405.section.md

@@ -191,6 +191,8 @@ The pre-existing [services.ankisyncd](#opt-services.ankisyncd.enable) has been m
 
 - [prometheus-nats-exporter](https://github.com/nats-io/prometheus-nats-exporter), a Prometheus exporter for NATS. Available as [services.prometheus.exporters.nats](#opt-services.prometheus.exporters.nats.enable).
 
+- [isolate](https://github.com/ioi/isolate), a sandbox for securely executing untrusted programs. Available as [security.isolate](#opt-security.isolate.enable).
+
 ## Backward Incompatibilities {#sec-release-24.05-incompatibilities}
 
 <!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->
@@ -199,6 +201,20 @@ The pre-existing [services.ankisyncd](#opt-services.ankisyncd.enable) has been m
 
 - `himalaya` was updated to v1.0.0-beta.4, which introduces breaking changes. Check out the [release note](https://github.com/soywod/himalaya/releases/tag/v1.0.0-beta.4) for details.
 
+- `security.pam.enableSSHAgentAuth` was replaced by the `sshAgentAuth` attrset, and **only**
+  `authorized_keys` files listed in [`sshAgentAuth.authorizedKeysFiles`] are trusted,
+  defaulting to `/etc/ssh/authorized_keys.d/%u`.
+  ::: {.warning}
+  Users of {manpage}`pam_ssh_agent_auth(8)` must take care that the pubkeys they use (for instance with `sudo`)
+  are listed in [`sshAgentAuth.authorizedKeysFiles`]..
+  :::
+  ::: {.note}
+  Previously, all `services.openssh.authorizedKeysFiles` were trusted, including `~/.ssh/authorized_keys`,
+  which results in an **insecure** configuration; see [#31611](https://github.com/NixOS/nixpkgs/issues/31611).
+  :::
+
+[`sshAgentAuth.authorizedKeysFiles`]: #opt-security.pam.sshAgentAuth.authorizedKeysFiles
+
 - The `power.ups` module now generates `upsd.conf`, `upsd.users` and `upsmon.conf` automatically from a set of new configuration options. This breaks compatibility with existing `power.ups` setups where these files were created manually. Back up these files before upgrading NixOS.
 
 - `programs.nix-ld.libraries` no longer sets `baseLibraries` via the option's default but in config and now merges any additional libraries with the default ones.
@@ -277,6 +293,8 @@ The pre-existing [services.ankisyncd](#opt-services.ankisyncd.enable) has been m
 
 - `network-interfaces.target` system target was removed as it has been deprecated for a long time. Use `network.target` instead.
 
+- `services.redis.vmOverCommit` now defaults to `true` and no longer enforces Transparent Hugepages (THP) to be disabled. Redis only works with THP configured to `madvise` which is the kernel's default.
+
 - `azure-cli` now has extension support. For example, to install the `aks-preview` extension, use
 
   ```nix
@@ -303,6 +321,10 @@ The pre-existing [services.ankisyncd](#opt-services.ankisyncd.enable) has been m
 
 - `services.vikunja.setupNginx` setting has been removed. Users now need to setup the webserver configuration on their own with a proxy pass to the vikunja service.
 
+- `services.vmagent` module deprecates `dataDir`, `group` and `user` setting in favor of systemd provided CacheDirectory and DynamicUser.
+
+- `services.vmagent.remoteWriteUrl` setting has been renamed to `services.vmagent.remoteWrite.url` and now defaults to `null`.
+
 - `woodpecker-*` packages have been updated to v2 which includes [breaking changes](https://woodpecker-ci.org/docs/next/migrations#200).
 
 - `services.nginx` will no longer advertise HTTP/3 availability automatically. This must now be manually added, preferably to each location block.
@@ -570,10 +592,6 @@ The pre-existing [services.ankisyncd](#opt-services.ankisyncd.enable) has been m
 
 - `mockgen` package source has changed to the [go.uber.org/mock](https://github.com/uber-go/mock) fork because [the original repository is no longer maintained](https://github.com/golang/mock#gomock).
 
-- `security.pam.enableSSHAgentAuth` was renamed to `security.pam.sshAgentAuth.enable` and an `authorizedKeysFiles`
-  option was added, to control which `authorized_keys` files are trusted.  It defaults to the previous behaviour,
-  **which is insecure**: see [#31611](https://github.com/NixOS/nixpkgs/issues/31611).
-
 - [](#opt-boot.kernel.sysctl._net.core.wmem_max_) changed from a string to an integer because of the addition of a custom merge option (taking the highest value defined to avoid conflicts between 2 services trying to set that value), just as [](#opt-boot.kernel.sysctl._net.core.rmem_max_) since 22.11.
 
 - [TODO: reword to place an attribute at the front] A new top-level package set, `pkgsExtraHardening` is added. This is a set of packages built with stricter hardening flags - those that have not yet received enough testing to be applied universally, those that are more likely to cause build failures or those that have drawbacks to their use (e.g. performance or required hardware features).

nixos/modules/installer/tools/tools.nix

@@ -185,7 +185,7 @@ in
         # };
 
         # Enable touchpad support (enabled default in most desktopManager).
-        # services.xserver.libinput.enable = true;
+        # services.libinput.enable = true;
 
         # Define a user account. Don't forget to set a password with ‘passwd’.
         # users.users.alice = {

nixos/modules/module-list.nix

@@ -325,6 +325,7 @@
   ./security/duosec.nix
   ./security/google_oslogin.nix
   ./security/ipa.nix
+  ./security/isolate.nix
   ./security/krb5
   ./security/lock-kernel-modules.nix
   ./security/misc.nix
@@ -558,6 +559,7 @@
   ./services/hardware/joycond.nix
   ./services/hardware/kanata.nix
   ./services/hardware/lcd.nix
+  ./services/hardware/libinput.nix
   ./services/hardware/lirc.nix
   ./services/hardware/nvidia-container-toolkit
   ./services/hardware/monado.nix
@@ -1472,7 +1474,6 @@
   ./services/x11/gdk-pixbuf.nix
   ./services/x11/hardware/cmt.nix
   ./services/x11/hardware/digimend.nix
-  ./services/x11/hardware/libinput.nix
   ./services/x11/hardware/synaptics.nix
   ./services/x11/hardware/wacom.nix
   ./services/x11/imwheel.nix

nixos/modules/profiles/graphical.nix

@@ -7,10 +7,12 @@
   services.xserver = {
     enable = true;
     desktopManager.plasma5.enable = true;
-    libinput.enable = true; # for touchpad support on many laptops
   };
 
-  services.displayManager.sddm.enable = true;
+  services = {
+    displayManager.sddm.enable = true;
+    libinput.enable = true; # for touchpad support on many laptops
+  };
 
   # Enable sound in virtualbox appliances.
   hardware.pulseaudio.enable = true;

nixos/modules/security/isolate.nix

@@ -0,0 +1,133 @@
+{ config, lib, pkgs, ... }:
+
+let
+  inherit (lib) mkEnableOption mkPackageOption mkOption types mkIf maintainers;
+
+  cfg = config.security.isolate;
+  configFile = pkgs.writeText "isolate-config.cf" ''
+    box_root=${cfg.boxRoot}
+    lock_root=${cfg.lockRoot}
+    cg_root=${cfg.cgRoot}
+    first_uid=${toString cfg.firstUid}
+    first_gid=${toString cfg.firstGid}
+    num_boxes=${toString cfg.numBoxes}
+    restricted_init=${if cfg.restrictedInit then "1" else "0"}
+    ${cfg.extraConfig}
+  '';
+  isolate = pkgs.symlinkJoin {
+    name = "isolate-wrapped-${pkgs.isolate.version}";
+
+    paths = [ pkgs.isolate ];
+
+    nativeBuildInputs = [ pkgs.makeWrapper ];
+
+    postBuild = ''
+      wrapProgram $out/bin/isolate \
+        --set ISOLATE_CONFIG_FILE ${configFile}
+
+      wrapProgram $out/bin/isolate-cg-keeper \
+        --set ISOLATE_CONFIG_FILE ${configFile}
+    '';
+  };
+in
+{
+  options.security.isolate = {
+    enable = mkEnableOption ''
+      Sandbox for securely executing untrusted programs
+    '';
+
+    package = mkPackageOption pkgs "isolate-unwrapped" { };
+
+    boxRoot = mkOption {
+      type = types.path;
+      default = "/var/lib/isolate/boxes";
+      description = ''
+        All sandboxes are created under this directory.
+        To avoid symlink attacks, this directory and all its ancestors
+        must be writeable only by root.
+      '';
+    };
+
+    lockRoot = mkOption {
+      type = types.path;
+      default = "/run/isolate/locks";
+      description = ''
+        Directory where lock files are created.
+      '';
+    };
+
+    cgRoot = mkOption {
+      type = types.str;
+      default = "auto:/run/isolate/cgroup";
+      description = ''
+        Control group which subgroups are placed under.
+        Either an explicit path to a subdirectory in cgroupfs, or "auto:file" to read
+        the path from "file", where it is put by `isolate-cg-helper`.
+      '';
+    };
+
+    firstUid = mkOption {
+      type = types.numbers.between 1000 65533;
+      default = 60000;
+      description = ''
+        Start of block of UIDs reserved for sandboxes.
+      '';
+    };
+
+    firstGid = mkOption {
+      type = types.numbers.between 1000 65533;
+      default = 60000;
+      description = ''
+        Start of block of GIDs reserved for sandboxes.
+      '';
+    };
+
+    numBoxes = mkOption {
+      type = types.numbers.between 1000 65533;
+      default = 1000;
+      description = ''
+        Number of UIDs and GIDs to reserve, starting from
+        {option}`firstUid` and {option}`firstGid`.
+      '';
+    };
+
+    restrictedInit = mkOption {
+      type = types.bool;
+      default = false;
+      description = ''
+        If true, only root can create sandboxes.
+      '';
+    };
+
+    extraConfig = mkOption {
+      type = types.str;
+      default = "";
+      description = ''
+        Extra configuration to append to the configuration file.
+      '';
+    };
+  };
+
+  config = mkIf cfg.enable {
+    environment.systemPackages = [
+      isolate
+    ];
+
+    systemd.services.isolate = {
+      description = "Isolate control group hierarchy daemon";
+      wantedBy = [ "multi-user.target" ];
+      serviceConfig = {
+        Type = "notify";
+        ExecStart = "${isolate}/bin/isolate-cg-keeper";
+        Slice = "isolate.slice";
+        Delegate = true;
+      };
+    };
+
+    systemd.slices.isolate = {
+      description = "Isolate sandbox slice";
+    };
+
+    meta.maintainers = with maintainers; [ virchau13 ];
+  };
+}

nixos/modules/security/pam.nix

@@ -1044,9 +1044,7 @@ in
           See [issue #31611](https://github.com/NixOS/nixpkgs/issues/31611)
           :::
         '';
-        example = [ "/etc/ssh/authorized_keys.d/%u" ];
-        default = config.services.openssh.authorizedKeysFiles;
-        defaultText = literalExpression "config.services.openssh.authorizedKeysFiles";
+        default = [ "/etc/ssh/authorized_keys.d/%u" ];
       };
     };
 

nixos/modules/services/databases/redis.nix

@@ -57,9 +57,9 @@ in {
       package = mkPackageOption pkgs "redis" { };
 
       vmOverCommit = mkEnableOption ''
-        setting of vm.overcommit_memory to 1
+        set `vm.overcommit_memory` sysctl to 1
         (Suggested for Background Saving: <https://redis.io/docs/get-started/faq/>)
-      '';
+      '' // { default = true; };
 
       servers = mkOption {
         type = with types; attrsOf (submodule ({ config, name, ... }: {
@@ -312,10 +312,9 @@ in {
       '';
     }) enabledServers);
 
-    boot.kernel.sysctl = mkMerge [
-      { "vm.nr_hugepages" = "0"; }
-      ( mkIf cfg.vmOverCommit { "vm.overcommit_memory" = "1"; } )
-    ];
+    boot.kernel.sysctl = mkIf cfg.vmOverCommit {
+      "vm.overcommit_memory" = "1";
+    };
 
     networking.firewall.allowedTCPPorts = concatMap (conf:
       optional conf.openFirewall conf.port

nixos/modules/services/desktop-managers/plasma6.nix

@@ -238,7 +238,7 @@ in {
     services.system-config-printer.enable = mkIf config.services.printing.enable (mkDefault true);
     services.udisks2.enable = true;
     services.upower.enable = config.powerManagement.enable;
-    services.xserver.libinput.enable = mkDefault true;
+    services.libinput.enable = mkDefault true;
 
     # Extra UDEV rules used by Solid
     services.udev.packages = [

nixos/modules/services/desktops/pipewire/wireplumber.nix

@@ -1,18 +1,40 @@
 { config, lib, pkgs, ... }:
 
 let
-  inherit (builtins) attrNames concatMap length;
+  inherit (builtins) concatMap;
   inherit (lib) maintainers;
-  inherit (lib.attrsets) attrByPath filterAttrs;
+  inherit (lib.attrsets) attrByPath mapAttrsToList;
   inherit (lib.lists) flatten optional;
   inherit (lib.modules) mkIf;
   inherit (lib.options) literalExpression mkOption;
-  inherit (lib.strings) hasPrefix;
-  inherit (lib.types) bool listOf package;
+  inherit (lib.strings) concatStringsSep makeSearchPath;
+  inherit (lib.types) bool listOf attrsOf package lines;
+  inherit (lib.path) subpath;
 
   pwCfg = config.services.pipewire;
   cfg = pwCfg.wireplumber;
   pwUsedForAudio = pwCfg.audio.enable;
+
+  json = pkgs.formats.json { };
+
+  configSectionsToConfFile = path: value:
+    pkgs.writeTextDir
+      path
+      (concatStringsSep "\n" (
+        mapAttrsToList
+          (section: content: "${section} = " + (builtins.toJSON content))
+          value
+      ));
+
+  mapConfigToFiles = config:
+    mapAttrsToList
+      (name: value: configSectionsToConfFile "share/wireplumber/wireplumber.conf.d/${name}.conf" value)
+      config;
+
+  mapScriptsToFiles = scripts:
+    mapAttrsToList
+      (relativePath: value: pkgs.writeTextDir (subpath.join ["share/wireplumber/scripts" relativePath]) value)
+      scripts;
 in
 {
   meta.maintainers = [ maintainers.k900 ];
@@ -33,6 +55,114 @@ in
         description = "The WirePlumber derivation to use.";
       };
 
+      extraConfig = mkOption {
+        # Two layer attrset is necessary before using JSON, because of the whole
+        # config file not being a JSON object, but a concatenation of JSON objects
+        # in sections.
+        type = attrsOf (attrsOf json.type);
+        default = { };
+        example = literalExpression ''{
+          "log-level-debug" = {
+            "context.properties" = {
+              # Output Debug log messages as opposed to only the default level (Notice)
+              "log.level" = "D";
+            };
+          };
+          "wh-1000xm3-ldac-hq" = {
+            "monitor.bluez.rules" = [
+              {
+                matches = [
+                  {
+                    # Match any bluetooth device with ids equal to that of a WH-1000XM3
+                    "device.name" = "~bluez_card.*";
+                    "device.product.id" = "0x0cd3";
+                    "device.vendor.id" = "usb:054c";
+                  }
+                ];
+                actions = {
+                  update-props = {
+                    # Set quality to high quality instead of the default of auto
+                    "bluez5.a2dp.ldac.quality" = "hq";
+                  };
+                };
+              }
+            ];
+          };
+        }'';
+        description = ''
+          Additional configuration for the WirePlumber daemon when run in
+          single-instance mode (the default in nixpkgs and currently the only
+          supported way to run WirePlumber configured via `extraConfig`).
+
+          See also:
+          - [The configuration file][docs-the-conf-file]
+          - [Modifying configuration][docs-modifying-config]
+          - [Locations of files][docs-file-locations]
+          - and the [configuration section][docs-config-section] of the docs in general
+
+          Note that WirePlumber (and PipeWire) use dotted attribute names like
+          `device.product.id`. These are not nested, but flat objects for WirePlumber/PipeWire,
+          so to write these in nix expressions, remember to quote them like `"device.product.id"`.
+          Have a look at the example for this.
+
+          [docs-the-conf-file]: https://pipewire.pages.freedesktop.org/wireplumber/daemon/configuration/conf_file.html
+          [docs-modifying-config]: https://pipewire.pages.freedesktop.org/wireplumber/daemon/configuration/modifying_configuration.html
+          [docs-file-locations]: https://pipewire.pages.freedesktop.org/wireplumber/daemon/configuration/locations.html
+          [docs-config-section]: https://pipewire.pages.freedesktop.org/wireplumber/daemon/configuration.html
+        '';
+      };
+
+      extraScripts = mkOption {
+        type = attrsOf lines;
+        default = { };
+        example = {
+          "test/hello-world.lua" = ''
+            print("Hello, world!")
+          '';
+        };
+        description = ''
+          Additional scripts for WirePlumber to be used by configuration files.
+
+          Every item in this attrset becomes a separate lua file with the path
+          relative to the `scripts` directory specified in the name of the item.
+          The scripts get passed to the WirePlumber service via the `XDG_DATA_DIRS`
+          variable. Scripts specified here are preferred over those shipped with
+          WirePlumber if they occupy the same relative path.
+
+          For a script to be loaded, it needs to be specified as part of a component,
+          and that component needs to be required by an active profile (e.g. `main`).
+          Components can be defined in config files either via `extraConfig` or `configPackages`.
+
+          For the hello-world example, you'd have to add the following `extraConfig`:
+          ```nix
+            services.pipewire.wireplumber.extraConfig."99-hello-world" = {
+              "wireplumber.components" = [
+                {
+                  name = "test/hello-world.lua";
+                  type = "script/lua";
+                  provides = "custom.hello-world";
+                }
+              ];
+
+              "wireplumber.profiles" = {
+                main = {
+                  "custom.hello-world" = "required";
+                };
+              };
+            };
+          ```
+
+          See also:
+          - [Location of scripts][docs-file-locations-scripts]
+          - [Components & Profiles][docs-components-profiles]
+          - [Migration - Loading custom scripts][docs-migration-loading-custom-scripts]
+
+          [docs-file-locations-scripts]: https://pipewire.pages.freedesktop.org/wireplumber/daemon/locations.html#location-of-scripts
+          [docs-components-profiles]: https://pipewire.pages.freedesktop.org/wireplumber/daemon/configuration/components_and_profiles.html
+          [docs-migration-loading-custom-scripts]: https://pipewire.pages.freedesktop.org/wireplumber/daemon/configuration/migration.html#loading-custom-scripts
+        '';
+      };
+
       configPackages = mkOption {
         type = listOf package;
         default = [ ];
@@ -57,7 +187,7 @@ in
 
       extraLv2Packages = mkOption {
         type = listOf package;
-        default = [];
+        default = [ ];
         example = literalExpression "[ pkgs.lsp-plugins ]";
         description = ''
           List of packages that provide LV2 plugins in `lib/lv2` that should
@@ -96,9 +226,22 @@ in
         }
       '';
 
+      extraConfigPkg = pkgs.buildEnv {
+        name = "wireplumber-extra-config";
+        paths = mapConfigToFiles cfg.extraConfig;
+        pathsToLink = [ "/share/wireplumber/wireplumber.conf.d" ];
+      };
+
+      extraScriptsPkg = pkgs.buildEnv {
+        name = "wireplumber-extra-scrips";
+        paths = mapScriptsToFiles cfg.extraScripts;
+        pathsToLink = [ "/share/wireplumber/scripts" ];
+      };
+
       configPackages = cfg.configPackages
-          ++ optional (!pwUsedForAudio) pwNotForAudioConfigPkg
-          ++ optional pwCfg.systemWide systemwideConfigPkg;
+        ++ [ extraConfigPkg extraScriptsPkg ]
+        ++ optional (!pwUsedForAudio) pwNotForAudioConfigPkg
+        ++ optional pwCfg.systemWide systemwideConfigPkg;
 
       configs = pkgs.buildEnv {
         name = "wireplumber-configs";
@@ -110,7 +253,7 @@ in
         (
           concatMap
             (p:
-              attrByPath ["passthru" "requiredLv2Packages"] [] p
+              attrByPath [ "passthru" "requiredLv2Packages" ] [ ] p
             )
             configPackages
         );
@@ -127,24 +270,10 @@ in
           assertion = !config.hardware.bluetooth.hsphfpd.enable;
           message = "Using WirePlumber conflicts with hsphfpd, as it provides the same functionality. `hardware.bluetooth.hsphfpd.enable` needs be set to false";
         }
-        {
-          assertion = length
-            (attrNames
-              (
-                filterAttrs
-                  (name: value:
-                    hasPrefix "wireplumber/" name || name == "wireplumber"
-                  )
-                  config.environment.etc
-              )) == 1;
-          message = "Using `environment.etc.\"wireplumber<...>\"` directly is no longer supported in 24.05. Use `services.pipewire.wireplumber.configPackages` instead.";
-        }
       ];
 
       environment.systemPackages = [ cfg.package ];
 
-      environment.etc.wireplumber.source = "${configs}/share/wireplumber";
-
       systemd.packages = [ cfg.package ];
 
       systemd.services.wireplumber.enable = pwCfg.systemWide;
@@ -156,10 +285,16 @@ in
       systemd.services.wireplumber.environment = mkIf pwCfg.systemWide {
         # Force WirePlumber to use system dbus.
         DBUS_SESSION_BUS_ADDRESS = "unix:path=/run/dbus/system_bus_socket";
+
+        # Make WirePlumber find our config/script files and lv2 plugins required by those
+        # (but also the configs/scripts shipped with WirePlumber)
+        XDG_DATA_DIRS = makeSearchPath "share" [ configs cfg.package ];
         LV2_PATH = "${lv2Plugins}/lib/lv2";
       };
 
-      systemd.user.services.wireplumber.environment.LV2_PATH =
-        mkIf (!pwCfg.systemWide) "${lv2Plugins}/lib/lv2";
+      systemd.user.services.wireplumber.environment = mkIf (!pwCfg.systemWide) {
+        XDG_DATA_DIRS = makeSearchPath "share" [ configs cfg.package ];
+        LV2_PATH = "${lv2Plugins}/lib/lv2";
+      };
     };
 }

nixos/modules/services/display-managers/sddm.nix

@@ -111,8 +111,8 @@ let
       let
         westonIni = (pkgs.formats.ini { }).generate "weston.ini" {
           libinput = {
-            enable-tap = xcfg.libinput.mouse.tapping;
-            left-handed = xcfg.libinput.mouse.leftHanded;
+            enable-tap = config.services.libinput.mouse.tapping;
+            left-handed = config.services.libinput.mouse.leftHanded;
           };
           keyboard = {
             keymap_model = xcfg.xkb.model;

nixos/modules/services/hardware/libinput.nix

@@ -2,7 +2,7 @@
 
 with lib;
 
-let cfg = config.services.xserver.libinput;
+let cfg = config.services.libinput;
 
     xorgBool = v: if v then "on" else "off";
 
@@ -223,7 +223,7 @@ let cfg = config.services.xserver.libinput;
 in {
 
   imports =
-    (map (option: mkRenamedOptionModule ([ "services" "xserver" "libinput" option ]) [ "services" "xserver" "libinput" "touchpad" option ]) [
+    (map (option: mkRenamedOptionModule ([ "services" "xserver" "libinput" option ]) [ "services" "libinput" "touchpad" option ]) [
       "accelProfile"
       "accelSpeed"
       "buttonMapping"
@@ -242,11 +242,15 @@ in {
       "transformationMatrix"
       "disableWhileTyping"
       "additionalOptions"
-    ]);
+    ]) ++ [
+      (mkRenamedOptionModule [ "services" "xserver" "libinput" "enable" ]   [ "services" "libinput" "enable" ])
+      (mkRenamedOptionModule [ "services" "xserver" "libinput" "mouse" ]    [ "services" "libinput" "mouse" ])
+      (mkRenamedOptionModule [ "services" "xserver" "libinput" "touchpad" ] [ "services" "libinput" "touchpad" ])
+    ];
 
   options = {
 
-    services.xserver.libinput = {
+    services.libinput = {
       enable = mkEnableOption "libinput" // {
         default = config.services.xserver.enable;
         defaultText = lib.literalExpression "config.services.xserver.enable";

nixos/modules/services/matrix/appservice-irc.nix

@@ -214,8 +214,9 @@ in {
         RestrictRealtime = true;
         PrivateMounts = true;
         SystemCallFilter = [
-          "@system-service @pkey @chown"
+          "@system-service @pkey"
           "~@privileged @resources"
+          "@chown"
         ];
         SystemCallArchitectures = "native";
         # AF_UNIX is required to connect to a postgres socket.

nixos/modules/services/monitoring/vmagent.nix

@@ -1,63 +1,62 @@
 { config, pkgs, lib, ... }:
-with lib;
+
 let
   cfg = config.services.vmagent;
   settingsFormat = pkgs.formats.json { };
 in {
+  imports = [
+    (lib.mkRemovedOptionModule [ "services" "vmagent" "dataDir" ] "dataDir has been deprecated in favor of systemd provided CacheDirectory")
+    (lib.mkRemovedOptionModule [ "services" "vmagent" "user" ] "user has been deprecated in favor of systemd DynamicUser")
+    (lib.mkRemovedOptionModule [ "services" "vmagent" "group" ] "group has been deprecated in favor of systemd DynamicUser")
+    (lib.mkRenamedOptionModule [ "services" "vmagent" "remoteWriteUrl" ] [ "services" "vmagent" "remoteWrite" "url" ])
+  ];
+
   options.services.vmagent = {
-    enable = mkEnableOption "vmagent";
+    enable = lib.mkEnableOption "vmagent";
 
-    user = mkOption {
-      default = "vmagent";
-      type = types.str;
-      description = ''
-        User account under which vmagent runs.
-      '';
+    package = lib.mkPackageOption pkgs "vmagent" { };
+
+    remoteWrite = {
+      url = lib.mkOption {
+        default = null;
+        type = lib.types.nullOr lib.types.str;
+        description = ''
+          Endpoint for prometheus compatible remote_write
+        '';
+      };
+      basicAuthUsername = lib.mkOption {
+        default = null;
+        type = lib.types.nullOr lib.types.str;
+        description = ''
+          Basic Auth username used to connect to remote_write endpoint
+        '';
+      };
+      basicAuthPasswordFile = lib.mkOption {
+        default = null;
+        type = lib.types.nullOr lib.types.str;
+        description = ''
+          File that contains the Basic Auth password used to connect to remote_write endpoint
+        '';
+      };
     };
 
-    group = mkOption {
-      type = types.str;
-      default = "vmagent";
-      description = ''
-        Group under which vmagent runs.
-      '';
-    };
-
-    package = mkPackageOption pkgs "vmagent" { };
-
-    dataDir = mkOption {
-      type = types.str;
-      default = "/var/lib/vmagent";
-      description = ''
-        The directory where vmagent stores its data files.
-      '';
-    };
-
-    remoteWriteUrl = mkOption {
-      default = "http://localhost:8428/api/v1/write";
-      type = types.str;
-      description = ''
-        The storage endpoint such as VictoriaMetrics
-      '';
-    };
-
-    prometheusConfig = mkOption {
+    prometheusConfig = lib.mkOption {
       type = lib.types.submodule { freeformType = settingsFormat.type; };
       description = ''
         Config for prometheus style metrics
       '';
     };
 
-    openFirewall = mkOption {
-      type = types.bool;
+    openFirewall = lib.mkOption {
+      type = lib.types.bool;
       default = false;
       description = ''
         Whether to open the firewall for the default ports.
       '';
     };
 
-    extraArgs = mkOption {
-      type = types.listOf types.str;
+    extraArgs = lib.mkOption {
+      type = lib.types.listOf lib.types.str;
       default = [];
       description = ''
         Extra args to pass to `vmagent`. See the docs:
@@ -67,37 +66,36 @@ in {
     };
   };
 
-  config = mkIf cfg.enable {
-    users.groups = mkIf (cfg.group == "vmagent") { vmagent = { }; };
-
-    users.users = mkIf (cfg.user == "vmagent") {
-      vmagent = {
-        group = cfg.group;
-        description = "vmagent daemon user";
-        home = cfg.dataDir;
-        isSystemUser = true;
-      };
-    };
-
-    networking.firewall.allowedTCPPorts = mkIf cfg.openFirewall [ 8429 ];
+  config = lib.mkIf cfg.enable {
+    networking.firewall.allowedTCPPorts = lib.mkIf cfg.openFirewall [ 8429 ];
 
     systemd.services.vmagent = let
       prometheusConfig = settingsFormat.generate "prometheusConfig.yaml" cfg.prometheusConfig;
+      startCommandLine = lib.concatStringsSep " " ([
+        "${cfg.package}/bin/vmagent"
+        "-promscrape.config=${prometheusConfig}"
+      ] ++ cfg.extraArgs
+        ++ lib.optionals (cfg.remoteWrite.url != null) [
+        "-remoteWrite.url=${cfg.remoteWrite.url}"
+        "-remoteWrite.tmpDataPath=%C/vmagent/remote_write_tmp"
+      ] ++ lib.optional (cfg.remoteWrite.basicAuthUsername != null) "-remoteWrite.basicAuth.username=${cfg.remoteWrite.basicAuthUsername}"
+        ++ lib.optional (cfg.remoteWrite.basicAuthPasswordFile != null) "-remoteWrite.basicAuth.passwordFile=\${CREDENTIALS_DIRECTORY}/remote_write_basic_auth_password");
     in {
       wantedBy = [ "multi-user.target" ];
       after = [ "network.target" ];
       description = "vmagent system service";
       serviceConfig = {
-        User = cfg.user;
-        Group = cfg.group;
+        DynamicUser = true;
+        User = "vmagent";
+        Group = "vmagent";
         Type = "simple";
         Restart = "on-failure";
-        WorkingDirectory = cfg.dataDir;
-        ExecStart = "${cfg.package}/bin/vmagent -remoteWrite.url=${cfg.remoteWriteUrl} -promscrape.config=${prometheusConfig} ${escapeShellArgs cfg.extraArgs}";
+        CacheDirectory = "vmagent";
+        ExecStart = startCommandLine;
+        LoadCredential = lib.optional (cfg.remoteWrite.basicAuthPasswordFile != null) [
+          "remote_write_basic_auth_password:${cfg.remoteWrite.basicAuthPasswordFile}"
+        ];
       };
     };
-
-    systemd.tmpfiles.rules =
-      [ "d '${cfg.dataDir}' 0755 ${cfg.user} ${cfg.group} -" ];
   };
 }

nixos/modules/services/networking/knot.nix

@@ -226,7 +226,7 @@ in {
       };
 
       settings = mkOption {
-        type = types.submodule { freeformType = types.attrs; };
+        type = (pkgs.formats.yaml {}).type;
         default = {};
         description = ''
           Extra configuration as nix values.

nixos/modules/services/web-apps/movim.nix

@@ -103,22 +103,20 @@ let
           lib.concatStringsSep "\n" [
             (lib.optionalString brotli.enable ''
               echo -n "Precompressing static files with Brotli …"
-              find ${appDir}/public -type f ${findTextFileNames} \
-                | ${lib.getExe pkgs.parallel} ${lib.escapeShellArgs [
-                    "--will-cite"
-                    "-j $NIX_BUILD_CORES"
-                    "${lib.getExe brotli.package} --keep --quality=${builtins.toString brotli.compressionLevel} --output={}.br {}"
-                   ]}
+              find ${appDir}/public -type f ${findTextFileNames} -print0 \
+                | xargs -0 -n 1 -P $NIX_BUILD_CORES ${pkgs.writeShellScript "movim_precompress_broti" ''
+                    file="$1"
+                    ${lib.getExe brotli.package} --keep --quality=${builtins.toString brotli.compressionLevel} --output=$file.br $file
+                  ''}
               echo " done."
             '')
             (lib.optionalString gzip.enable ''
               echo -n "Precompressing static files with Gzip …"
-              find ${appDir}/public -type f ${findTextFileNames} \
-                | ${lib.getExe pkgs.parallel} ${lib.escapeShellArgs [
-                    "--will-cite"
-                    "-j $NIX_BUILD_CORES"
-                    "${lib.getExe gzip.package} -c -${builtins.toString gzip.compressionLevel} {} > {}.gz"
-                   ]}
+              find ${appDir}/public -type f ${findTextFileNames} -print0 \
+                | xargs -0 -n 1 -P $NIX_BUILD_CORES ${pkgs.writeShellScript "movim_precompress_broti" ''
+                    file="$1"
+                    ${lib.getExe gzip.package} -c -${builtins.toString gzip.compressionLevel} $file > $file.gz
+                  ''}
               echo " done."
             '')
           ];

nixos/modules/services/x11/desktop-managers/budgie.nix

@@ -214,7 +214,7 @@ in {
 
     services.geoclue2.enable = mkDefault true; # for BCC's Privacy > Location Services panel.
     services.upower.enable = config.powerManagement.enable; # for Budgie's Status Indicator and BCC's Power panel.
-    services.xserver.libinput.enable = mkDefault true; # for BCC's Mouse panel.
+    services.libinput.enable = mkDefault true; # for BCC's Mouse panel.
     services.colord.enable = mkDefault true; # for BCC's Color panel.
     services.gnome.at-spi2-core.enable = mkDefault true; # for BCC's A11y panel.
     services.accounts-daemon.enable = mkDefault true; # for BCC's Users panel.

nixos/modules/services/x11/desktop-managers/cinnamon.nix

@@ -116,7 +116,7 @@ in
       services.touchegg.enable = mkDefault true;
       services.udisks2.enable = true;
       services.upower.enable = mkDefault config.powerManagement.enable;
-      services.xserver.libinput.enable = mkDefault true;
+      services.libinput.enable = mkDefault true;
       services.xserver.updateDbusEnvironment = true;
       networking.networkmanager.enable = mkDefault true;
 

nixos/modules/services/x11/desktop-managers/deepin.nix

@@ -61,7 +61,7 @@ in
       services.gnome.gnome-keyring.enable = mkDefault true;
       services.bamf.enable = mkDefault true;
 
-      services.xserver.libinput.enable = mkDefault true;
+      services.libinput.enable = mkDefault true;
       services.udisks2.enable = true;
       services.upower.enable = mkDefault config.powerManagement.enable;
       networking.networkmanager.enable = mkDefault true;

nixos/modules/services/x11/desktop-managers/enlightenment.nix

@@ -96,7 +96,7 @@ in
 
     services.udisks2.enable = true;
     services.upower.enable = config.powerManagement.enable;
-    services.xserver.libinput.enable = mkDefault true;
+    services.libinput.enable = mkDefault true;
 
     services.dbus.packages = [ e.efl ];
 

nixos/modules/services/x11/desktop-managers/gnome.nix

@@ -339,7 +339,7 @@ in
       # services.packagekit.enable = mkDefault true;
       services.udisks2.enable = true;
       services.upower.enable = config.powerManagement.enable;
-      services.xserver.libinput.enable = mkDefault true; # for controlling touchpad settings via gnome control center
+      services.libinput.enable = mkDefault true; # for controlling touchpad settings via gnome control center
 
       # Explicitly enabled since GNOME will be severely broken without these.
       xdg.mime.enable = true;

nixos/modules/services/x11/desktop-managers/lxqt.nix

@@ -69,7 +69,7 @@ in
 
     services.upower.enable = config.powerManagement.enable;
 
-    services.xserver.libinput.enable = mkDefault true;
+    services.libinput.enable = mkDefault true;
 
     xdg.portal.lxqt.enable = mkDefault true;
 

nixos/modules/services/x11/desktop-managers/mate.nix

@@ -88,7 +88,7 @@ in
       services.udev.packages = [ pkgs.mate.mate-settings-daemon ];
       services.gvfs.enable = true;
       services.upower.enable = config.powerManagement.enable;
-      services.xserver.libinput.enable = mkDefault true;
+      services.libinput.enable = mkDefault true;
 
       security.pam.services.mate-screensaver.unixAuth = true;
 

nixos/modules/services/x11/desktop-managers/pantheon.nix

@@ -159,7 +159,7 @@ in
       services.gsignond.plugins = with pkgs.gsignondPlugins; [ lastfm mail oauth ];
       services.udisks2.enable = true;
       services.upower.enable = config.powerManagement.enable;
-      services.xserver.libinput.enable = mkDefault true;
+      services.libinput.enable = mkDefault true;
       services.xserver.updateDbusEnvironment = true;
       services.zeitgeist.enable = mkDefault true;
       services.geoclue2.enable = mkDefault true;

nixos/modules/services/x11/desktop-managers/plasma5.nix

@@ -348,7 +348,7 @@ in
       services.system-config-printer.enable = mkIf config.services.printing.enable (mkDefault true);
       services.udisks2.enable = true;
       services.upower.enable = config.powerManagement.enable;
-      services.xserver.libinput.enable = mkDefault true;
+      services.libinput.enable = mkDefault true;
 
       # Extra UDEV rules used by Solid
       services.udev.packages = [

nixos/modules/services/x11/desktop-managers/xfce.nix

@@ -164,7 +164,7 @@ in
     services.gvfs.enable = true;
     services.tumbler.enable = true;
     services.system-config-printer.enable = (mkIf config.services.printing.enable (mkDefault true));
-    services.xserver.libinput.enable = mkDefault true; # used in xfce4-settings-manager
+    services.libinput.enable = mkDefault true; # used in xfce4-settings-manager
 
     # Enable default programs
     programs.dconf.enable = true;

nixos/modules/services/x11/hardware/cmt.nix

@@ -46,10 +46,10 @@ in {
 
     assertions = [
       {
-        assertion = !config.services.xserver.libinput.enable;
+        assertion = !config.services.libinput.enable;
         message = ''
           cmt and libinput are incompatible, meaning you cannot enable them both.
-          To use cmt you need to disable libinput with `services.xserver.libinput.enable = false`
+          To use cmt you need to disable libinput with `services.libinput.enable = false`
           If you haven't enabled it in configuration.nix, it's enabled by default on a
           different xserver module.
         '';

nixos/modules/services/x11/hardware/synaptics.nix

@@ -30,7 +30,7 @@ in {
       enable = mkOption {
         type = types.bool;
         default = false;
-        description = "Whether to enable touchpad support. Deprecated: Consider services.xserver.libinput.enable.";
+        description = "Whether to enable touchpad support. Deprecated: Consider services.libinput.enable.";
       };
 
       dev = mkOption {
@@ -207,8 +207,8 @@ in {
 
     assertions = [
       {
-        assertion = !config.services.xserver.libinput.enable;
-        message = "Synaptics and libinput are incompatible, you cannot enable both (in services.xserver).";
+        assertion = !config.services.libinput.enable;
+        message = "Synaptics and libinput are incompatible, you cannot enable both.";
       }
     ];
 

nixos/modules/system/boot/loader/systemd-boot/systemd-boot.nix

@@ -7,8 +7,20 @@ let
 
   efi = config.boot.loader.efi;
 
+  # We check the source code in a derivation that does not depend on the
+  # system configuration so that most users don't have to redo the check and require
+  # the necessary dependencies.
+  checkedSource = pkgs.runCommand "systemd-boot" { } ''
+    install -m755 -D ${./systemd-boot-builder.py} $out
+    ${lib.getExe pkgs.buildPackages.mypy} \
+      --no-implicit-optional \
+      --disallow-untyped-calls \
+      --disallow-untyped-defs \
+      $out
+  '';
+
   systemdBootBuilder = pkgs.substituteAll rec {
-    src = ./systemd-boot-builder.py;
+    src = checkedSource;
 
     isExecutable = true;
 
@@ -66,19 +78,9 @@ let
     '';
   };
 
-  checkedSystemdBootBuilder = pkgs.runCommand "systemd-boot" { } ''
-    mkdir -p $out/bin
-    install -m755 ${systemdBootBuilder} $out/bin/systemd-boot-builder
-    ${lib.getExe pkgs.buildPackages.mypy} \
-      --no-implicit-optional \
-      --disallow-untyped-calls \
-      --disallow-untyped-defs \
-      $out/bin/systemd-boot-builder
-  '';
-
   finalSystemdBootBuilder = pkgs.writeScript "install-systemd-boot.sh" ''
     #!${pkgs.runtimeShell}
-    ${checkedSystemdBootBuilder}/bin/systemd-boot-builder "$@"
+    ${systemdBootBuilder} "$@"
     ${cfg.extraInstallCommands}
   '';
 in {

nixos/tests/all-tests.nix

@@ -399,6 +399,7 @@ in {
   honk = runTest ./honk.nix;
   installed-tests = pkgs.recurseIntoAttrs (handleTest ./installed-tests {});
   invidious = handleTest ./invidious.nix {};
+  isolate = handleTest ./isolate.nix {};
   livebook-service = handleTest ./livebook-service.nix {};
   pyload = handleTest ./pyload.nix {};
   oci-containers = handleTestOn ["aarch64-linux" "x86_64-linux"] ./oci-containers.nix {};

nixos/tests/gvisor.nix

@@ -3,7 +3,7 @@
 import ./make-test-python.nix ({ pkgs, ... }: {
   name = "gvisor";
   meta = with pkgs.lib.maintainers; {
-    maintainers = [ andrew-d ];
+    maintainers = [ ];
   };
 
   nodes = {

nixos/tests/isolate.nix

@@ -0,0 +1,38 @@
+import ./make-test-python.nix ({ lib, ... }:
+{
+  name = "isolate";
+  meta.maintainers = with lib.maintainers; [ virchau13 ];
+
+  nodes.machine =
+    { ... }:
+    {
+      security.isolate = {
+        enable = true;
+      };
+    };
+
+  testScript = ''
+    bash_path = machine.succeed('realpath $(which bash)').strip()
+    sleep_path = machine.succeed('realpath $(which sleep)').strip()
+    def sleep_test(walltime, sleeptime):
+        return f'isolate --no-default-dirs --wall-time {walltime} ' + \
+            f'--dir=/box={box_path} --dir=/nix=/nix --run -- ' + \
+            f"{bash_path} -c 'exec -a sleep {sleep_path} {sleeptime}'"
+
+    def sleep_test_cg(walltime, sleeptime):
+        return f'isolate --cg --no-default-dirs --wall-time {walltime} ' + \
+            f'--dir=/box={box_path} --dir=/nix=/nix --processes=2 --run -- ' + \
+            f"{bash_path} -c '( exec -a sleep {sleep_path} {sleeptime} )'"
+
+    with subtest("without cgroups"):
+        box_path = machine.succeed('isolate --init').strip()
+        machine.succeed(sleep_test(1, 0.5))
+        machine.fail(sleep_test(0.5, 1))
+        machine.succeed('isolate --cleanup')
+    with subtest("with cgroups"):
+        box_path = machine.succeed('isolate --cg --init').strip()
+        machine.succeed(sleep_test_cg(1, 0.5))
+        machine.fail(sleep_test_cg(0.5, 1))
+        machine.succeed('isolate --cg --cleanup')
+  '';
+})

nixos/tests/libinput.nix

@@ -12,7 +12,7 @@ import ./make-test-python.nix ({ ... }:
 
       test-support.displayManager.auto.user = "alice";
 
-      services.xserver.libinput = {
+      services.libinput = {
         enable = true;
         mouse = {
           naturalScrolling = true;

pkgs/applications/audio/spot/default.nix

@@ -78,7 +78,7 @@ stdenv.mkDerivation rec {
     mainProgram = "spot";
     homepage = "https://github.com/xou816/spot";
     license = licenses.mit;
-    maintainers = with maintainers; [ msfjarvis ];
+    maintainers = with maintainers; [ ];
     platforms = platforms.linux;
   };
 }

pkgs/applications/editors/android-studio/common.nix

@@ -245,9 +245,9 @@ in runCommand
       # source-code itself).
       platforms = [ "x86_64-linux" ];
       maintainers = with maintainers; rec {
-        stable = [ alapshin msfjarvis ];
-        beta = [ alapshin msfjarvis ];
-        canary = [ alapshin msfjarvis ];
+        stable = [ alapshin ];
+        beta = [ alapshin ];
+        canary = [ alapshin ];
         dev = canary;
       }."${channel}";
       mainProgram = pname;

pkgs/applications/editors/emacs/elisp-packages/manual-packages/xapian-lite/default.nix

@@ -29,7 +29,7 @@ stdenv.mkDerivation (finalAttrs: {
   meta = {
     homepage = "https://git.sr.ht/~casouri/xapian-lite";
     description = "A minimal Emacs dynamic module for Xapian";
-    maintainers = [ ];
+    maintainers = [ lib.maintainers.kotatsuyaki ];
     license = lib.licenses.gpl3Plus;
     inherit (emacs.meta) platforms;
   };

pkgs/applications/editors/kile/default.nix

@@ -1,68 +1,47 @@
-{ mkDerivation
-, lib
+{ lib
+, stdenv
 , fetchurl
-, extra-cmake-modules
-, kdoctools
-, wrapGAppsHook
-, qtscript
-, kconfig
-, kcrash
-, kdbusaddons
-, kdelibs4support
-, kguiaddons
-, kiconthemes
-, kinit
-, khtml
-, konsole
-, kparts
-, ktexteditor
-, kwindowsystem
-, okular
-, poppler
+, cmake
+, kdePackages
+, qt6
 }:
 
-mkDerivation rec {
+stdenv.mkDerivation rec {
   pname = "kile";
-  version = "2.9.93";
+  version = "2.9.94";
 
   src = fetchurl {
     url = "mirror://sourceforge/kile/kile-${version}.tar.bz2";
-    sha256 = "BEmSEv/LJPs6aCkUmnyuTGrV15WYXwgIANbfcviMXfA=";
+    sha256 = "U8Z0K9g/sJXL3ImLA/344Vq2gKgWk8yvnFB2uTrRo8o=";
   };
 
   nativeBuildInputs = [
-    extra-cmake-modules
-    wrapGAppsHook
-    kdoctools
+    cmake
+    kdePackages.extra-cmake-modules
+    qt6.wrapQtAppsHook
+    kdePackages.kdoctools
   ];
 
   buildInputs = [
-    kconfig
-    kcrash
-    kdbusaddons
-    kdelibs4support
-    kguiaddons
-    kiconthemes
-    kinit
-    khtml
-    kparts
-    ktexteditor
-    kwindowsystem
-    okular
-    poppler
-    qtscript
+    qt6.qtbase
+    qt6.qtdeclarative
+    qt6.qt5compat
+    kdePackages.kconfig
+    kdePackages.kcrash
+    kdePackages.kdbusaddons
+    kdePackages.kguiaddons
+    kdePackages.kiconthemes
+    kdePackages.konsole
+    kdePackages.kparts
+    kdePackages.ktexteditor
+    kdePackages.kwindowsystem
+    kdePackages.okular
+    kdePackages.poppler
   ];
-  dontWrapGApps = true;
-  preFixup = ''
-    makeWrapperArgs+=("''${gappsWrapperArgs[@]}")
-  '';
-
-  propagatedUserEnvPkgs = [ konsole ];
 
   meta = {
     description = "User-friendly TeX/LaTeX authoring tool for the KDE desktop environment";
     homepage = "https://www.kde.org/applications/office/kile/";
-    maintainers = with lib.maintainers; [ fridh ];
     license = lib.licenses.gpl2Plus;
     mainProgram = "kile";
   };

pkgs/applications/editors/vscode/extensions/default.nix

@@ -1911,7 +1911,7 @@ let
           downloadPage = "https://marketplace.visualstudio.com/items?itemName=Gleam.gleam";
           homepage = "https://github.com/gleam-lang/vscode-gleam#readme";
           license = lib.licenses.asl20;
-          maintainers = [ lib.maintainers.msfjarvis ];
+          maintainers = [ ];
         };
       };
 

pkgs/applications/editors/vscode/extensions/myriad-dreamin.tinymist/default.nix

@@ -12,8 +12,8 @@ vscode-utils.buildVscodeMarketplaceExtension {
     publisher = "myriad-dreamin";
     # Please update the corresponding binary (tinymist) when updating
     # this extension.
-    version = "0.11.5";
-    hash = "sha256-p97RREGKhTeXO5s4jP8qUsLtYxOj91ddQhsk6Q+50jc=";
+    version = "0.11.6";
+    hash = "sha256-qS+QY9RmJYXWRcohMcorF3SxoniBPE8SFcg0Ka1vvOE=";
   };
 
   nativeBuildInputs = [

pkgs/applications/emulators/dolphin-emu/default.nix

@@ -202,7 +202,6 @@ stdenv.mkDerivation rec {
     license = licenses.gpl2Plus;
     platforms = platforms.unix;
     maintainers = with maintainers; [
-      MP2E
       ashkitten
       ivar
     ];

pkgs/applications/emulators/dolphin-emu/primehack.nix

@@ -143,7 +143,7 @@ stdenv.mkDerivation rec {
     homepage = "https://github.com/shiiion/dolphin";
     description = "Gamecube/Wii/Triforce emulator for x86_64 and ARMv8";
     license = licenses.gpl2Plus;
-    maintainers = with maintainers; [ MP2E ashkitten Madouura ];
+    maintainers = with maintainers; [ ashkitten Madouura ];
     broken = stdenv.isDarwin;
     platforms = platforms.unix;
   };

pkgs/applications/graphics/drawio/default.nix

@@ -14,14 +14,14 @@
 
 stdenv.mkDerivation rec {
   pname = "drawio";
-  version = "24.1.0";
+  version = "24.2.5";
 
   src = fetchFromGitHub {
     owner = "jgraph";
     repo = "drawio-desktop";
     rev = "v${version}";
     fetchSubmodules = true;
-    hash = "sha256-vwytqlPv8LfOceuBs/MNPxzO1ZYv1hwjIRyBh/wuVEU=";
+    hash = "sha256-8Cs+uME6uXWIWeuS9cgKnlYJG/m13l2BIVNDG0bqEmc=";
   };
 
   # `@electron/fuses` tries to run `codesign` and fails. Disable and use autoSignDarwinBinariesHook instead
@@ -31,7 +31,7 @@ stdenv.mkDerivation rec {
 
   offlineCache = fetchYarnDeps {
     yarnLock = src + "/yarn.lock";
-    hash = "sha256-mRnGsfxrdfzk6+z07174zZ7pcS68Zut6inuBPZkLtWQ=";
+    hash = "sha256-tQFcdZc+4N6TYY6MDAwUgpaIvqYkU681DbuYCQhvJ1c=";
   };
 
   nativeBuildInputs = [

pkgs/applications/graphics/xournalpp/default.nix

@@ -68,7 +68,7 @@ stdenv.mkDerivation rec {
     homepage    = "https://xournalpp.github.io/";
     changelog   = "https://github.com/xournalpp/xournalpp/blob/v${version}/CHANGELOG.md";
     license     = licenses.gpl2Plus;
-    maintainers = with maintainers; [ andrew-d sikmir ];
+    maintainers = with maintainers; [ sikmir ];
     platforms   = platforms.unix;
     mainProgram = "xournalpp";
   };

pkgs/applications/kde/filelight.nix

@@ -20,7 +20,7 @@ mkDerivation {
     mainProgram = "filelight";
     homepage = "https://apps.kde.org/filelight/";
     license = with lib.licenses; [ gpl2 ];
-    maintainers = with lib.maintainers; [ fridh vcunat ];
+    maintainers = with lib.maintainers; [ vcunat ];
   };
   nativeBuildInputs = [ extra-cmake-modules kdoctools ];
   propagatedBuildInputs = [

pkgs/applications/kde/kcalc.nix

@@ -12,7 +12,6 @@ mkDerivation {
     description = "Scientific calculator";
     mainProgram = "kcalc";
     license = with lib.licenses; [ gpl2 ];
-    maintainers = [ lib.maintainers.fridh ];
   };
   nativeBuildInputs = [ extra-cmake-modules kdoctools ];
   buildInputs = [

pkgs/applications/kde/kdeconnect-kde.nix

@@ -77,7 +77,6 @@ mkDerivation {
     description = "KDE Connect provides several features to integrate your phone and your computer";
     homepage = "https://community.kde.org/KDEConnect";
     license = with licenses; [ gpl2 ];
-    maintainers = with maintainers; [ fridh ];
     mainProgram = "kdeconnect-app";
   };
 }

pkgs/applications/kde/kolourpaint.nix

@@ -20,7 +20,6 @@ mkDerivation {
     homepage = "https://apps.kde.org/kolourpaint/";
     description = "Paint program";
     mainProgram = "kolourpaint";
-    maintainers = [ lib.maintainers.fridh ];
     license = with lib.licenses; [ gpl2 ];
   };
 }

pkgs/applications/kde/kwalletmanager.nix

@@ -19,7 +19,6 @@ mkDerivation {
     description = "KDE wallet management tool";
     mainProgram = "kwalletmanager5";
     license = with lib.licenses; [ gpl2 ];
-    maintainers = with lib.maintainers; [ fridh ];
   };
   nativeBuildInputs = [ extra-cmake-modules kdoctools ];
   buildInputs = [

pkgs/applications/kde/yakuake.nix

@@ -29,7 +29,6 @@ mkDerivation {
     homepage = "https://yakuake.kde.org";
     description = "Quad-style terminal emulator for KDE";
     mainProgram = "yakuake";
-    maintainers = with lib.maintainers; [ fridh ];
     license = lib.licenses.gpl2;
   };
 }

pkgs/applications/misc/1password-gui/default.nix

@@ -59,7 +59,7 @@ let
     homepage = "https://1password.com/";
     sourceProvenance = with sourceTypes; [ binaryNativeCode ];
     license = licenses.unfree;
-    maintainers = with maintainers; [ timstott savannidgerinel amaxine sebtm ];
+    maintainers = with maintainers; [ timstott savannidgerinel sebtm ];
     platforms = builtins.attrNames sources.${channel};
     mainProgram = "1password";
   };

pkgs/applications/misc/confclerk/default.nix

@@ -2,11 +2,11 @@
 
 mkDerivation rec {
   pname = "confclerk";
-  version = "0.7.1";
+  version = "0.7.2";
 
   src = fetchurl {
     url = "https://www.toastfreeware.priv.at/tarballs/confclerk/confclerk-${version}.tar.gz";
-    sha256 = "0l5i4d6lymh0k6gzihs41x4i8v1dz0mrwpga096af0vchpvlcarg";
+    sha256 = "sha256-GgWvPHcQnQrK9SOC8U9F2P8kuPCn8I2EhoWEEMtKBww=";
   };
 
   buildInputs = [ qtbase ];

pkgs/applications/misc/gpsprune/default.nix

@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "gpsprune";
-  version = "23.2";
+  version = "24";
 
   src = fetchurl {
     url = "https://activityworkshop.net/software/gpsprune/gpsprune_${version}.jar";
-    sha256 = "sha256-r2iw1vINWgqxoW0Zc8Sloa+wN/GUbUQfJ0e2BSP9vxM=";
+    sha256 = "sha256-gMwTdwYjYJt1j5MpHw6UD1wqmF7q3ikzjVSOGakIP30=";
   };
 
   dontUnpack = true;

pkgs/applications/misc/gremlin-console/default.nix

@@ -2,10 +2,10 @@
 
 stdenv.mkDerivation rec {
   pname = "gremlin-console";
-  version = "3.7.1";
+  version = "3.7.2";
   src = fetchzip {
     url = "https://downloads.apache.org/tinkerpop/${version}/apache-tinkerpop-gremlin-console-${version}-bin.zip";
-    sha256 = "sha256-uiJy4kfcTFUymyE0DxP6GlMX7ONogLFrx6K9IcgwTSE=";
+    sha256 = "sha256-lIrqMvI/sYGu36X3jNptoIz7mPVomk8YCIR/6y8mpEc=";
   };
 
   nativeBuildInputs = [ makeWrapper ];

pkgs/applications/misc/remnote/default.nix

@@ -6,11 +6,11 @@ stdenv.mkDerivation (finalAttrs: let
 in
 {
   pname = "remnote";
-  version = "1.15.4";
+  version = "1.16.4";
 
   src = fetchurl {
     url = "https://download.remnote.io/remnote-desktop/RemNote-${version}.AppImage";
-    hash = "sha256-6WBdTOj/seinx1wJGb/4if3PzCPmtzHyNAFmQwmsrvE=";
+    hash = "sha256-dgbQ0cbPq7BSQ9VwwH6+GoAxb85HDxRixfjeDJBtOrg=";
   };
 
   appexec = appimageTools.wrapType2 {

pkgs/applications/misc/rofi-rbw/default.nix

@@ -17,14 +17,14 @@
 
 buildPythonApplication rec {
   pname = "rofi-rbw";
-  version = "1.3.0";
+  version = "1.4.0";
   format = "pyproject";
 
   src = fetchFromGitHub {
     owner = "fdw";
     repo = "rofi-rbw";
     rev = "refs/tags/${version}";
-    hash = "sha256-aTMKwb4BLupY0UmvPC86RnElZ9DFep8sApaMrlGbJ0M=";
+    hash = "sha256-1xbdZlZa3YPz+33AMgvhiMO12vc/ej0RybypQUzEn+8=";
   };
 
   nativeBuildInputs = [

pkgs/applications/misc/swaynotificationcenter/default.nix

@@ -12,9 +12,11 @@
 , gobject-introspection
 , gtk-layer-shell
 , gtk3
+, gvfs
 , json-glib
 , libgee
 , libhandy
+, libnotify
 , libpulseaudio
 , librsvg
 , meson
@@ -65,9 +67,11 @@ stdenv.mkDerivation (finalAttrs: rec {
     glib
     gtk-layer-shell
     gtk3
+    gvfs
     json-glib
     libgee
     libhandy
+    libnotify
     libpulseaudio
     librsvg
     pantheon.granite

pkgs/applications/misc/tui-journal/default.nix

@@ -11,16 +11,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "tui-journal";
-  version = "0.8.2";
+  version = "0.8.3";
 
   src = fetchFromGitHub {
     owner = "AmmarAbouZor";
     repo = "tui-journal";
     rev = "v${version}";
-    hash = "sha256-qHNB+jRLQoiHPuTblpCHg2+6e5j8W6YPsuygRlTidtE=";
+    hash = "sha256-G8p1eaHebUH2lFNyC2njUzZacE6rayApCb7PBFcpKLk=";
   };
 
-  cargoHash = "sha256-T+fXSca1u9+c305yuKOF+soxnSZ1YbBs57wco5TLpQw=";
+  cargoHash = "sha256-iM5PsgCUxBbjeWGEIohZwMiCIdXqj/bhFoL0GtVKKq4=";
 
   nativeBuildInputs = [
     pkg-config

pkgs/applications/misc/volnoti/default.nix

@@ -33,6 +33,6 @@ stdenv.mkDerivation {
     homepage = "https://github.com/davidbrazdil/volnoti";
     license = licenses.gpl3;
     platforms = platforms.linux;
-    maintainers = [ maintainers.gilligan ];
+    maintainers = [];
   };
 }

pkgs/applications/networking/browsers/chromium/upstream-info.nix

@@ -1,11 +1,11 @@
 {
   stable = {
     chromedriver = {
-      hash_darwin = "sha256-PmLV++FK6aCvdhNNhb2ZAmRLumr+VRFvN+7IByieEZk=";
+      hash_darwin = "sha256-RGOChK4JhrFUgVY/5YqgE0KFLRl6a7X2llw1ZfhiPXY=";
       hash_darwin_aarch64 =
-        "sha256-6Ys1EMSLmJNNaWdPeQiCT+bC0H7ABInVNzwXorGavn4=";
-      hash_linux = "sha256-iimq37dcEcY2suW73a6lhgHuNaoqtzbAZCHkQP9ro/Y=";
-      version = "123.0.6312.122";
+        "sha256-K1jFXmWtXrS43UJg2mQ39Kae6tv7E9Fxm6LUWg+uwLo=";
+      hash_linux = "sha256-xwaRNh7sllyNaq8+aLAZDQ3uDg06cu3KYqc02LWPSyw=";
+      version = "124.0.6367.91";
     };
     deps = {
       gn = {
@@ -15,9 +15,9 @@
         version = "2024-03-14";
       };
     };
-    hash = "sha256-apEniFKhIxPo4nhp9gCU+WpiV/EB40qif4RfE7Uniog=";
-    hash_deb_amd64 = "sha256-rSbigG5/xbL32d1ntOn6gnZyxSpgrg1h7lb/RD4YROI=";
-    version = "124.0.6367.60";
+    hash = "sha256-tajZtdiXgs5lRLTmDmgNTM2vD+N+LuWpBS0dYzxUsMA=";
+    hash_deb_amd64 = "sha256-CyCbZQ5ce8WLTt2JVSqbDkLDboE4BloiZ8pJff3dmSY=";
+    version = "124.0.6367.91";
   };
   ungoogled-chromium = {
     deps = {
@@ -28,12 +28,12 @@
         version = "2024-03-14";
       };
       ungoogled-patches = {
-        hash = "sha256-zgkt0stU/H5Mji429tigVbjOq27Op8UppHTjG6neoeA=";
-        rev = "124.0.6367.60-1";
+        hash = "sha256-1/J3BhUlef8CH/jZ5P5fWGXnWxTiuB0Ep+AWrMrv9cE=";
+        rev = "124.0.6367.91-1";
       };
     };
-    hash = "sha256-apEniFKhIxPo4nhp9gCU+WpiV/EB40qif4RfE7Uniog=";
-    hash_deb_amd64 = "sha256-rSbigG5/xbL32d1ntOn6gnZyxSpgrg1h7lb/RD4YROI=";
-    version = "124.0.6367.60";
+    hash = "sha256-tajZtdiXgs5lRLTmDmgNTM2vD+N+LuWpBS0dYzxUsMA=";
+    hash_deb_amd64 = "sha256-CyCbZQ5ce8WLTt2JVSqbDkLDboE4BloiZ8pJff3dmSY=";
+    version = "124.0.6367.91";
   };
 }

pkgs/applications/networking/browsers/firefox/common.nix

@@ -298,9 +298,6 @@ buildStdenv.mkDerivation {
   setOutputFlags = false; # `./mach configure` doesn't understand `--*dir=` flags.
 
   preConfigure = ''
-    # remove distributed configuration files
-    rm -f configure js/src/configure .mozconfig*
-
     # Runs autoconf through ./mach configure in configurePhase
     configureScript="$(realpath ./mach) configure"
 
@@ -308,8 +305,8 @@ buildStdenv.mkDerivation {
     export MOZ_BUILD_DATE=$(head -n1 sourcestamp.txt)
 
     # Set predictable directories for build and state
-    export MOZ_OBJDIR=$(pwd)/mozobj
-    export MOZBUILD_STATE_PATH=$(pwd)/mozbuild
+    export MOZ_OBJDIR=$(pwd)/objdir
+    export MOZBUILD_STATE_PATH=$TMPDIR/mozbuild
 
     # Don't try to send libnotify notifications during build
     export MOZ_NOSPAM=1
@@ -353,7 +350,7 @@ buildStdenv.mkDerivation {
       # since the profiling build has not been installed to $out
       ''
         OLD_LDFLAGS="$LDFLAGS"
-        LDFLAGS="-Wl,-rpath,$(pwd)/mozobj/dist/${binaryName}"
+        LDFLAGS="-Wl,-rpath,$(pwd)/objdir/dist/${binaryName}"
       ''}
     fi
   '' + lib.optionalString googleAPISupport ''
@@ -510,7 +507,7 @@ buildStdenv.mkDerivation {
   '';
 
   preBuild = ''
-    cd mozobj
+    cd objdir
   '';
 
   postBuild = ''
@@ -535,9 +532,9 @@ buildStdenv.mkDerivation {
   preInstall = lib.optionalString crashreporterSupport ''
     ./mach buildsymbols
     mkdir -p $symbols/
-    cp mozobj/dist/*.crashreporter-symbols.zip $symbols/
+    cp objdir/dist/*.crashreporter-symbols.zip $symbols/
   '' + ''
-    cd mozobj
+    cd objdir
   '';
 
   postInstall = ''

pkgs/applications/networking/browsers/microsoft-edge/default.nix

@@ -1,20 +1,20 @@
 {
   beta = import ./browser.nix {
     channel = "beta";
-    version = "124.0.2478.51";
+    version = "124.0.2478.67";
     revision = "1";
-    hash = "sha256-qQTRPkQBLRZhOqBT8U0PGcmmR2zNRxJiFl3N2UPwoSo=";
+    hash = "sha256-EywgM3G0Yph3dofullSVZpXSvT2MHc4uPyGAoaXCgN8=";
   };
   dev = import ./browser.nix {
     channel = "dev";
-    version = "125.0.2518.0";
+    version = "125.0.2535.6";
     revision = "1";
-    hash = "sha256-q4TVpO0SxSSLMv/NtmJIOzClT2WqUss2qfE5vgj4O7E=";
+    hash = "sha256-iD/e7AuPG0uNZY20wFQRbvAaKmaUw2RKeRJADU1MFRI=";
   };
   stable = import ./browser.nix {
     channel = "stable";
-    version = "124.0.2478.51";
+    version = "124.0.2478.67";
     revision = "1";
-    hash = "sha256-dAiTS+KvKVwL6tNp4YsQfH4wdNIJoBJngcLBXgHArjE=";
+    hash = "sha256-PRL2aiebCoK0eGJWlvI+Gsk14FltV+GaQdojLuDFimU=";
   };
 }

pkgs/applications/networking/browsers/palemoon/bin.nix

@@ -20,7 +20,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "palemoon-bin";
-  version = "33.0.2";
+  version = "33.1.0";
 
   src = finalAttrs.passthru.sources."gtk${if withGTK3 then "3" else "2"}";
 
@@ -158,11 +158,11 @@ stdenv.mkDerivation (finalAttrs: {
     in {
       gtk3 = fetchzip {
         urls = urlRegionVariants "gtk3";
-        hash = "sha256-Kahnwlj9PIWB24lvH6h9cZK459NW2Vo2g6ckuv0Ax48=";
+        hash = "sha256-qjztSvNL7KNFG3sszgk5qH77do0HFQ8YTrgjFi2ZM00=";
       };
       gtk2 = fetchzip {
         urls = urlRegionVariants "gtk2";
-        hash = "sha256-XOiLGmU8O96clUpnp/OkzXmWR1PJ2AdzbVFj6adbcvY=";
+        hash = "sha256-q4zAmnCN9SHGb8PthjAx7d5FKq/oAQ8c0R+U1SWqjAA=";
       };
     };
 

pkgs/applications/networking/cluster/acorn/default.nix

@@ -1,32 +0,0 @@
-{ lib, buildGoModule, fetchFromGitHub }:
-
-buildGoModule rec {
-  pname = "acorn";
-  version = "0.10.1";
-
-  src = fetchFromGitHub {
-    owner = "acorn-io";
-    repo = pname;
-    rev = "v${version}";
-    hash = "sha256-Zw/OqN4d5iukh9oUXjczMvNKYkcGSUoDEwfti7uzZXQ=";
-  };
-
-  vendorHash = "sha256-d/1Rqh00THUwcMBWloevfKbScaWhVG5r/32Q4zYUaJg=";
-
-  ldflags = [
-    "-s"
-    "-w"
-    "-X github.com/acorn-io/acorn/pkg/version.Tag=v${version}"
-  ];
-
-  # integration tests require network and kubernetes master
-  doCheck = false;
-
-  meta = with lib; {
-    homepage = "https://docs.acorn.io";
-    changelog = "https://github.com/acorn-io/${pname}/releases/tag/v${version}";
-    description = "A simple application deployment framework for Kubernetes";
-    license = licenses.asl20;
-    maintainers = with maintainers; [ urandom ];
-  };
-}

pkgs/applications/networking/cluster/helm/chart-testing/default.nix

@@ -13,16 +13,16 @@
 
 buildGoModule rec {
   pname = "chart-testing";
-  version = "3.10.1";
+  version = "3.11.0";
 
   src = fetchFromGitHub {
     owner = "helm";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-btrnfL9U8k7jwo6ltVfbiSJFCX52zjfgf4E+IsWTYi4=";
+    hash = "sha256-eiU8omDEGDJVmumHwZkNix7qMVkoR6Irg0x9dTBzadA=";
   };
 
-  vendorHash = "sha256-E+7ndvXWzsU896/eWyupbvqkLed2ly91osptZKT79fk=";
+  vendorHash = "sha256-o9oZnQPztrK6HvclPt33Y05GQFWDsnUYti5x8R7aWS8=";
 
   postPatch = ''
     substituteInPlace pkg/config/config.go \

pkgs/applications/networking/cluster/kubedb-cli/default.nix

@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "kubedb-cli";
-  version = "0.44.0";
+  version = "0.45.0";
 
   src = fetchFromGitHub {
     owner = "kubedb";
     repo = "cli";
     rev = "v${version}";
-    sha256 = "sha256-ppsGSzgJvAHRGs6PGPNgE7nDbK8SPYBPNbAlGwocAZs=";
+    sha256 = "sha256-4kmXz8dTxCaGbuAo3zK27BhUrecInwJCu9XOuiQY48A=";
   };
 
   vendorHash = null;

pkgs/applications/networking/cluster/kuttl/default.nix

@@ -2,17 +2,17 @@
 
 buildGoModule rec {
   pname = "kuttl";
-  version = "0.15.0";
+  version = "0.16.0";
   cli = "kubectl-kuttl";
 
   src = fetchFromGitHub {
     owner = "kudobuilder";
     repo = "kuttl";
     rev = "v${version}";
-    sha256 = "sha256-u+j1ulM6B238qXvLMJZwLqglr9CGk81MsnBYiNiZVJQ=";
+    sha256 = "sha256-Kz8+RsLpKwXk4f3k/kBqSFGB9AvA/D6kYBtPEl6aSH8=";
   };
 
-  vendorHash = "sha256-taJAQPa0EA0Ph9OpCs7jzLqBV61kVstZrWyNEYc/GBk=";
+  vendorHash = "sha256-IgfPXT4BhfZZVOa7eO1wKUKiDVMcN8vmH11qdWfvFww=";
 
   subPackages = [ "cmd/kubectl-kuttl" ];
 

pkgs/applications/networking/cluster/nomad/default.nix

@@ -41,7 +41,7 @@ let
         description = "A Distributed, Highly Available, Datacenter-Aware Scheduler";
         mainProgram = "nomad";
         inherit license;
-        maintainers = with maintainers; [ rushmorem pradeepchhetri endocrimes amaxine techknowlogick cottand ];
+        maintainers = with maintainers; [ rushmorem pradeepchhetri techknowlogick cottand ];
       };
     } // attrs');
 in

pkgs/applications/networking/cluster/terraform/default.nix

@@ -58,7 +58,6 @@ let
           Chili-Man
           babariviere
           kalbasit
-          amaxine
           timstott
           zimbatm
           zowoq

pkgs/applications/networking/flexget/default.nix

@@ -6,7 +6,7 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "flexget";
-  version = "3.11.29";
+  version = "3.11.30";
   pyproject = true;
 
   # Fetch from GitHub in order to use `requirements.in`
@@ -14,7 +14,7 @@ python3.pkgs.buildPythonApplication rec {
     owner = "Flexget";
     repo = "Flexget";
     rev = "refs/tags/v${version}";
-    hash = "sha256-rtLn3QkcVwCh2DfJmtkKvZQcFL/zlZCh7VTUpWtQErw=";
+    hash = "sha256-msvNZ3kE48dNnhtUWLGxulb2iZ78hhyg7fVL2OSOdyY=";
   };
 
   postPatch = ''

pkgs/applications/networking/instant-messengers/chatterino2/default.nix

@@ -2,12 +2,12 @@
 
 stdenv.mkDerivation rec {
   pname = "chatterino2";
-  version = "2.5.0";
+  version = "2.5.1";
   src = fetchFromGitHub {
     owner = "Chatterino";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-uR2X0NNSLyOx5n3mZcp6+wW/7L7rHHH2MlOF+c0Uzm0=";
+    sha256 = "sha256-c3Vhzes54xLjKV0Of7D1eFpQvIWJwcUBXvLT2p6VwBE=";
     fetchSubmodules = true;
   };
   nativeBuildInputs = [ cmake pkg-config qt6.wrapQtAppsHook ];

pkgs/applications/networking/instant-messengers/discord/default.nix

@@ -2,14 +2,14 @@
 let
   versions =
     if stdenv.isLinux then {
-      stable = "0.0.50";
-      ptb = "0.0.80";
-      canary = "0.0.357";
+      stable = "0.0.51";
+      ptb = "0.0.81";
+      canary = "0.0.369";
       development = "0.0.17";
     } else {
-      stable = "0.0.301";
-      ptb = "0.0.109";
-      canary = "0.0.477";
+      stable = "0.0.302";
+      ptb = "0.0.110";
+      canary = "0.0.486";
       development = "0.0.39";
     };
   version = versions.${branch};
@@ -17,15 +17,15 @@ let
     x86_64-linux = {
       stable = fetchurl {
         url = "https://dl.discordapp.net/apps/linux/${version}/discord-${version}.tar.gz";
-        hash = "sha256-6VXdVLk7Z8NGQMiSdgBRd8NIueUktkId6BXYKNABb+4=";
+        hash = "sha256-w8zLeaqJXdbI67X/UDxSLQxZei5eraa/BkMZa+GDpYk=";
       };
       ptb = fetchurl {
         url = "https://dl-ptb.discordapp.net/apps/linux/${version}/discord-ptb-${version}.tar.gz";
-        hash = "sha256-y/ntnHIYcY35Jszh0PrFy395eJ5dBWwLNpzHMoSZuNA=";
+        hash = "sha256-/kM23y4Hx/0HwIOQvd+4Y429s/6Q+coa27hgI2U3EcU=";
       };
       canary = fetchurl {
         url = "https://dl-canary.discordapp.net/apps/linux/${version}/discord-canary-${version}.tar.gz";
-        hash = "sha256-sDwC5kPzAfvQmsrq6M/GPFtUaT9pNAEB4uGI5Mn3oXs=";
+        hash = "sha256-Ohfp5ypvdmjr5rYR1usdVoEuVwOALRozysIjT/v75Qs=";
       };
       development = fetchurl {
         url = "https://dl-development.discordapp.net/apps/linux/${version}/discord-development-${version}.tar.gz";
@@ -35,15 +35,15 @@ let
     x86_64-darwin = {
       stable = fetchurl {
         url = "https://dl.discordapp.net/apps/osx/${version}/Discord.dmg";
-        hash = "sha256-h7C1wCKtUGcMFUhoKVdD7Vq9TGUaXfmjlVhwmRdhqYw=";
+        hash = "sha256-Xt0ef+ogGlPA4ebxuAsGQKeMVDoTB58jCRcyM1fHjYE=";
       };
       ptb = fetchurl {
         url = "https://dl-ptb.discordapp.net/apps/osx/${version}/DiscordPTB.dmg";
-        hash = "sha256-xxLnzELuI0X2r/weP1K2Bb51uRh1JjR72p7cXzy12Kc=";
+        hash = "sha256-hkRO/4YD1j4gsp+r3+md3ND/xtNmdutJiXlY3UIecIY=";
       };
       canary = fetchurl {
         url = "https://dl-canary.discordapp.net/apps/osx/${version}/DiscordCanary.dmg";
-        hash = "sha256-xEDtEtZNhOTtz+zRLLQBSeLbntlVAVQsocAGyAaVePM=";
+        hash = "sha256-c7KNWsV+pultD+HqRNonSOW9PCGx1AajCfnc94Dokwc=";
       };
       development = fetchurl {
         url = "https://dl-development.discordapp.net/apps/osx/${version}/DiscordDevelopment.dmg";
@@ -60,7 +60,7 @@ let
     downloadPage = "https://discordapp.com/download";
     sourceProvenance = with sourceTypes; [ binaryNativeCode ];
     license = licenses.unfree;
-    maintainers = with maintainers; [ MP2E Scrumplex artturin infinidoge jopejoe1 ];
+    maintainers = with maintainers; [ Scrumplex artturin infinidoge jopejoe1 ];
     platforms = [ "x86_64-linux" "x86_64-darwin" "aarch64-darwin" ];
     mainProgram = "discord";
   };

pkgs/applications/networking/instant-messengers/profanity/default.nix

@@ -20,7 +20,7 @@
 , sqlite
 , autoAwaySupport ? true,       libXScrnSaver, libX11
 , notifySupport ? true,         libnotify, gdk-pixbuf
-, omemoSupport ? true,          libsignal-protocol-c, libgcrypt
+, omemoSupport ? true,          libsignal-protocol-c, libgcrypt, qrencode
 , pgpSupport ? true,            gpgme
 , pythonPluginSupport ? true,   python3
 , traySupport ? true,           gtk3
@@ -66,7 +66,7 @@ stdenv.mkDerivation rec {
     sqlite
   ] ++ lib.optionals autoAwaySupport     [ libXScrnSaver libX11 ]
     ++ lib.optionals notifySupport       [ libnotify gdk-pixbuf ]
-    ++ lib.optionals omemoSupport        [ libsignal-protocol-c libgcrypt ]
+    ++ lib.optionals omemoSupport        [ libsignal-protocol-c libgcrypt qrencode ]
     ++ lib.optionals pgpSupport          [ gpgme ]
     ++ lib.optionals pythonPluginSupport [ python3 ]
     ++ lib.optionals traySupport         [ gtk3 ];

pkgs/applications/networking/instant-messengers/rambox/default.nix

@@ -17,7 +17,7 @@ let
     categories = [ "Network" ];
   });
 
-  appimageContents = appimageTools.extractType2 {
+  appimageContents = appimageTools.extract {
     inherit pname version src;
   };
 in
@@ -26,7 +26,6 @@ appimageTools.wrapType2 {
 
   extraInstallCommands = ''
     mkdir -p $out/share/applications $out/share/icons/hicolor/256x256/apps
-    ln -sf rambox-${version} $out/bin/${pname}
     install -Dm644 ${appimageContents}/usr/share/icons/hicolor/256x256/apps/rambox*.png $out/share/icons/hicolor/256x256/apps/${pname}.png
     install -Dm644 ${desktopItem}/share/applications/* $out/share/applications
   '';

pkgs/applications/networking/instant-messengers/slack/default.nix

@@ -84,7 +84,7 @@ let
     changelog = "https://slack.com/release-notes";
     sourceProvenance = with sourceTypes; [ binaryNativeCode ];
     license = licenses.unfree;
-    maintainers = with maintainers; [ mmahut amaxine ];
+    maintainers = with maintainers; [ mmahut ];
     platforms = [ "x86_64-darwin" "x86_64-linux" "aarch64-darwin" ];
     mainProgram = "slack";
   };

pkgs/applications/networking/maestral-qt/default.nix

@@ -10,14 +10,14 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "maestral-qt";
-  version = "1.9.2";
+  version = "1.9.3";
   disabled = python3.pythonOlder "3.7";
 
   src = fetchFromGitHub {
     owner = "SamSchott";
     repo = "maestral-qt";
     rev = "refs/tags/v${version}";
-    hash = "sha256-dgiVSwCTNDncbPJ+f0grjtq822TvtG0PhC9gDOKhwRI=";
+    hash = "sha256-7Lt0Neobtofd1JDoz8BhGn+nFKaMLbM/6z0QQmtEKpA=";
   };
 
   format = "pyproject";

pkgs/applications/networking/p2p/flood/default.nix

@@ -5,16 +5,16 @@
 
 buildNpmPackage rec {
   pname = "flood";
-  version = "unstable-2023-06-03";
+  version = "4.8.0";
 
   src = fetchFromGitHub {
     owner = "jesec";
     repo = pname;
-    rev = "2b652f8148dab7134eeeb201b9d81dd6b8bda074";
-    hash = "sha256-wI6URPGUZUbydSgNaHN2C5IA2x/HHjBWIRT6H6iZU/0=";
+    rev = "v${version}";
+    hash = "sha256-hth8tk2DHuBGNAXdjknbdQinuwWJ//QF0e23neeTExw=";
   };
 
-  npmDepsHash = "sha256-XmDnvq+ni5TOf3UQFc4JvGI3LiGpjbrLAocRvrW8qgk=";
+  npmDepsHash = "sha256-WlQ/u7yIbuFETsmbW7ddAOO7OVrNPOXR3ja3N0aFWRE=";
 
   meta = with lib; {
     description = "Modern web UI for various torrent clients with a Node.js backend and React frontend";

pkgs/applications/networking/syncthing/default.nix

@@ -66,7 +66,7 @@ let
         description = "Open Source Continuous File Synchronization";
         changelog = "https://github.com/syncthing/syncthing/releases/tag/v${version}";
         license = licenses.mpl20;
-        maintainers = with maintainers; [ joko peterhoeg andrew-d ];
+        maintainers = with maintainers; [ joko peterhoeg ];
         mainProgram = target;
         platforms = platforms.unix;
       };

pkgs/applications/networking/taler/default.nix

@@ -1,147 +0,0 @@
-{ lib, stdenv, fetchgit, curl, gnunet, jansson, libgcrypt, libmicrohttpd
-, qrencode, libsodium, libtool, libunistring, pkg-config, postgresql
-, autoreconfHook, python3, recutils, wget, jq, gettext, texinfo
-}:
-
-let
-  version = "0.10.1";
-
-  taler-wallet-core = fetchgit {
-    url = "https://git.taler.net/wallet-core.git";
-    rev = "v${version}";
-    hash = "sha256-sgiJd1snN9JDqS7IUeORKL60Gcm7XwL/JCX3sNRDTdY=";
-  };
-
-  taler-exchange = stdenv.mkDerivation {
-    pname = "taler-exchange";
-    inherit version;
-
-    src = fetchgit {
-      url = "https://git.taler.net/exchange.git";
-      rev = "v${version}";
-      fetchSubmodules = true;
-      hash = "sha256-SKnMep8bMQaJt4r3u0SrzwYSuFbzv4RnflbutSqwtPg=";
-
-      # When fetching submodules without the .git folder we get the following error:
-      # "Server does not allow request for unadvertised object"
-      leaveDotGit = true;
-      postFetch = ''
-        rm -rf $out/.git
-      '';
-    };
-
-    nativeBuildInputs = [
-      autoreconfHook
-      pkg-config
-    ];
-    buildInputs = [
-      libgcrypt
-      libmicrohttpd
-      jansson
-      libsodium
-      postgresql
-      curl
-      recutils
-      gettext
-      texinfo # Fix 'makeinfo' is missing on your system.
-      libunistring
-      python3.pkgs.jinja2
-      # jq is necessary for some tests and is checked by configure script
-      jq
-    ];
-    propagatedBuildInputs = [ gnunet ];
-
-    # From ./bootstrap
-    preAutoreconf = ''
-      ./contrib/gana-generate.sh
-      pushd contrib
-      find wallet-core/aml-backoffice/ -type f -printf '  %p \\\n' | sort > Makefile.am.ext
-      truncate -s -2 Makefile.am.ext
-      cat Makefile.am.in Makefile.am.ext >> Makefile.am
-      popd
-    '';
-
-    enableParallelBuilding = true;
-
-    nativeCheckInputs = [ wget curl ];
-    doInstallCheck = true;
-    checkTarget = "check";
-
-    meta = with lib; {
-      description = ''
-        Taler is an electronic payment system providing the ability to pay
-        anonymously using digital cash.  Taler consists of a network protocol
-        definition (using a RESTful API over HTTP), a Exchange (which creates
-        digital coins), a Wallet (which allows customers to manage, store and
-        spend digital coins), and a Merchant website which allows customers to
-        spend their digital coins.  Naturally, each Merchant is different, but
-        Taler includes code examples to help Merchants integrate Taler as a
-        payment system.
-      '';
-      homepage = "https://taler.net/";
-      license = licenses.agpl3Plus;
-      maintainers = with maintainers; [ astro ];
-      platforms = platforms.linux;
-    };
-  };
-
-  taler-merchant = stdenv.mkDerivation {
-    pname = "taler-merchant";
-    inherit version;
-
-    src = fetchgit {
-      url = "https://git.taler.net/merchant.git";
-      rev = "v${version}";
-      fetchSubmodules = true;
-      hash = "sha256-8VpoyloLpd/HckSIRU6IclWUXQyEHqlcNdoJI9U3t0Y=";
-    };
-    postUnpack = ''
-      ln -s ${taler-wallet-core}/spa.html $sourceRoot/contrib/
-    '';
-
-    nativeBuildInputs = [ pkg-config autoreconfHook ];
-    buildInputs = taler-exchange.buildInputs ++ [
-      qrencode
-      taler-exchange
-      # for ltdl.h
-      libtool
-    ];
-    propagatedBuildInputs = [ gnunet ];
-
-    # From ./bootstrap
-    preAutoreconf = ''
-      pushd contrib
-      find wallet-core/backoffice/ -type f -printf '  %p \\\n' | sort > Makefile.am.ext
-      truncate -s -2 Makefile.am.ext
-      cat Makefile.am.in Makefile.am.ext >> Makefile.am
-      popd
-    '';
-    configureFlags = [
-      "--with-gnunet=${gnunet}"
-      "--with-exchange=${taler-exchange}"
-    ];
-
-    enableParallelBuilding = true;
-
-    nativeCheckInputs = [ jq ];
-    doInstallCheck = true;
-    checkTarget = "check";
-
-    meta = with lib; {
-      description = ''
-        This is the GNU Taler merchant backend. It provides the logic that should run
-        at every GNU Taler merchant.  The GNU Taler merchant is a RESTful backend that
-        can be used to setup orders and process payments.  This component allows
-        merchants to receive payments without invading the customers' privacy. Of
-        course, this applies mostly for digital goods, as the merchant does not need
-        to know the customer's physical address.
-      '';
-      homepage = "https://taler.net/";
-      license = licenses.agpl3Plus;
-      maintainers = with maintainers; [ astro ];
-      platforms = platforms.linux;
-    };
-  };
-in {
-  inherit taler-exchange taler-merchant;
-}

pkgs/applications/networking/xpipe/default.nix

@@ -33,14 +33,14 @@ let
   }.${system} or throwSystem;
 
   hash = {
-    x86_64-linux = "sha256-s/1XyEXOyvAQNf32ckKotQ4jYdlo/Y+O9PY3wIUs80A=";
+    x86_64-linux = "sha256-3KMmMDoaYYMKuuqLof/LfdCs1d4I70L2TDxmzvx4Vq0=";
   }.${system} or throwSystem;
 
   displayname = "XPipe";
 
 in stdenvNoCC.mkDerivation rec {
   pname = "xpipe";
-  version = "8.6";
+  version = "9.0";
 
   src = fetchzip {
     url = "https://github.com/xpipe-io/xpipe/releases/download/${version}/xpipe-portable-linux-${arch}.tar.gz";

pkgs/applications/printing/pappl/default.nix

@@ -59,6 +59,6 @@ stdenv.mkDerivation rec {
     homepage = "https://github.com/michaelrsweet/pappl";
     license = licenses.asl20;
     platforms = platforms.linux; # should also work for darwin, but requires additional work
-    maintainers = with maintainers; [ jonringer ChlorideCull ];
+    maintainers = with maintainers; [ jonringer ];
   };
 }

pkgs/applications/radio/dsd/default.nix

@@ -33,7 +33,7 @@ stdenv.mkDerivation rec {
     homepage = "https://github.com/szechyjs/dsd";
     license = licenses.gpl2;
     platforms = platforms.unix;
-    maintainers = with maintainers; [ andrew-d ];
+    maintainers = with maintainers; [ ];
     mainProgram = "dsd";
   };
 }

pkgs/applications/radio/gnuradio/default.nix

@@ -45,11 +45,11 @@
 # If one wishes to use a different src or name for a very custom build
 , overrideSrc ? {}
 , pname ? "gnuradio"
-, version ? "3.10.9.2"
+, version ? "3.10.10.0"
 }:
 
 let
-  sourceSha256 = "sha256-SMalZwIvATZ3rqAAqeSmf8/RJ1d9pp7NvoWO/YP0BMc=";
+  sourceSha256 = "sha256-pEVWhXDjOevrduDbZQbiDbODZY8PpsGY4O8yxrwlCcs=";
   featuresInfo = {
     # Needed always
     basic = {

pkgs/applications/science/biology/mafft/default.nix

@@ -1,14 +1,20 @@
-{ lib, stdenv, fetchFromGitLab }:
+{
+  lib,
+  stdenv,
+  fetchFromGitLab,
+  runCommand,
+  mafft,
+}:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "mafft";
-  version = "7.525";
+  version = "7.526";
 
   src = fetchFromGitLab {
     owner = "sysimm";
-    repo = pname;
-    rev = "v${version}";
-    sha256 = "sha256-ckBmvFssYAmYcBHAEftjQqBV0MB0theGfemaPx3XUws=";
+    repo = "mafft";
+    rev = "v${finalAttrs.version}";
+    hash = "sha256-VNe00r12qEkLEbpZdJCe5xZ73JA3uAmuAeG+eSeRDI0=";
   };
 
   preBuild = ''
@@ -16,14 +22,34 @@ stdenv.mkDerivation rec {
     make clean
   '';
 
-  makeFlags = [ "CC=${stdenv.cc.targetPrefix}cc" "PREFIX=$(out)" ];
+  makeFlags = [
+    "CC=${stdenv.cc.targetPrefix}cc"
+    "PREFIX=$(out)"
+  ];
 
-  meta = with lib;
-    {
-      description = "Multiple alignment program for amino acid or nucleotide sequences";
-      homepage = "https://mafft.cbrc.jp/alignment/software/";
-      license = licenses.bsd3;
-      maintainers = with maintainers; [ natsukium ];
-      platforms = platforms.unix;
-    };
-}
+  passthru.tests = {
+    simple = runCommand "${finalAttrs.pname}-test" { } ''
+      mkdir $out
+      cd ${finalAttrs.src}/test
+      ${lib.getExe mafft} sample > $out/test.fftns2
+      ${lib.getExe mafft} --maxiterate 100  sample > $out/test.fftnsi
+      ${lib.getExe mafft} --globalpair sample > $out/test.gins1
+      ${lib.getExe mafft} --globalpair --maxiterate 100  sample > $out/test.ginsi
+      ${lib.getExe mafft} --localpair sample > $out/test.lins1
+      ${lib.getExe mafft} --localpair --maxiterate 100  sample > $out/test.linsi
+      diff $out/test.fftns2 sample.fftns2
+      diff $out/test.fftnsi sample.fftnsi
+      diff $out/test.gins1 sample.gins1
+      diff $out/test.ginsi sample.ginsi
+      diff $out/test.lins1 sample.lins1
+    '';
+  };
+
+  meta = with lib; {
+    description = "Multiple alignment program for amino acid or nucleotide sequences";
+    homepage = "https://mafft.cbrc.jp/alignment/software/";
+    license = licenses.bsd3;
+    maintainers = with maintainers; [ natsukium ];
+    platforms = platforms.unix;
+  };
+})

pkgs/applications/science/electronics/kicad/versions.nix

@@ -3,23 +3,23 @@
 {
   "kicad" = {
     kicadVersion = {
-      version =			"8.0.1";
+      version =			"8.0.2";
       src = {
-        rev =			"20421d65e5a7ede894345d337ab47b469f5ba154";
-        sha256 =		"096kvmm96ccxir1rspgzzjkp6y2j80l3w2vphg9iv3drxmjp7qjv";
+        rev =			"55a4d4f5e2f54be6ccf74a8919d04684c9df4c50";
+        sha256 =		"069ycii9zvdxwxd73afd6bp975r1555yvifi9zdb77qyvn0d9nr9";
       };
     };
     libVersion = {
-      version =			"8.0.1";
+      version =			"8.0.2";
       libSources = {
-        symbols.rev =		"d6aff3948edfca2bacf36900ff080f6b3f65fe4c";
-        symbols.sha256 =	"00xnvikmqd1zkg9p1f89kvryvkybl5f20baij6babqyc29nbzkwy";
-        templates.rev =		"0a6c4f798a68a5c639d54b4d3093460ab9267816";
-        templates.sha256 =	"0m9bggz3cm27kqpjjwxy19mqzk0c69bywcjkqcni7kafr21c6k4z";
-        footprints.rev =	"226b4f3d5c10a4126d88b895188bdab629fe60b0";
-        footprints.sha256 =	"1bb3mb2a7vkridgmqqm9ib3hv2m4zx1i14mglb11sribypy0ma5p";
-        packages3d.rev =	"49c1cd4017499b8a7f6dedbe7ede834d1713eb28";
-        packages3d.sha256 =	"0b5jwr5bbd0kzb75nj3028knjrv0872dk54sbsnxaz669q8zaxap";
+        symbols.rev =		"099ac0c8ac402a685fde00b1369e34a116e29661";
+        symbols.sha256 =	"0w333f89yw2m0zlpkg0k6hfwlj10snm8laihdjnsb22asyz4pbhn";
+        templates.rev =		"2e2da58e02707d327d59d4101c401a82dc9a26f6";
+        templates.sha256 =	"073a6cyvzzy0vmkj3ip4ziq7b7pcizs70nm5acw838dxghjfyv3v";
+        footprints.rev =	"e8c30550cde4945cbe1bf30cccf0b3c1e2bda6c6";
+        footprints.sha256 =	"10j8qjljc1fv8k4zp3zn0da33g57hn6pgrgmbgp18dsa539xvxcz";
+        packages3d.rev =	"249f7947587529026e1676cd70c8d7493a8d8162";
+        packages3d.sha256 =	"04gvfb54jhnww2qwrxc27wpyrvmjasdc4xhr0ridl7dglh4qcp35";
       };
     };
   };

pkgs/applications/science/electronics/simulide/default.nix

@@ -1,36 +1,33 @@
-{ lib
-, fetchbzr
-, mkDerivation
-, qmake
-, qtserialport
-, qtmultimedia
-, qttools
-, qtscript
+{
+  lib,
+  fetchbzr,
+  mkDerivation,
+  qmake,
+  qtserialport,
+  qtmultimedia,
+  qttools,
+  qtscript,
 }:
 
 let
   generic =
-    { version
-    , release
-    , branch
-    , rev
-    , sha256
-    , extraPostPatch ? ""
-    , extraBuildInputs ? [ ]
-    , iconPath ? "resources/icons/simulide.png"
-    , installFiles ? ''
+    {
+      version,
+      release,
+      rev,
+      src,
+      extraPostPatch ? "",
+      extraBuildInputs ? [ ],
+      iconPath ? "resources/icons/simulide.png",
+      installFiles ? ''
         cp -r data examples $out/share/simulide
         cp simulide $out/bin/simulide
-      ''
+      '',
     }:
     mkDerivation {
       pname = "simulide";
       version = "${version}-${release}";
-
-      src = fetchbzr {
-        url = "https://code.launchpad.net/~arcachofo/simulide/${branch}";
-        inherit rev sha256;
-      };
+      inherit src;
 
       postPatch = ''
         sed -i resources/simulide.desktop \
@@ -51,9 +48,7 @@ let
         cd build_XX
       '';
 
-      nativeBuildInputs = [
-        qmake
-      ];
+      nativeBuildInputs = [ qmake ];
 
       buildInputs = [
         qtserialport
@@ -85,18 +80,25 @@ let
         homepage = "https://simulide.com/";
         license = lib.licenses.gpl3Only;
         mainProgram = "simulide";
-        maintainers = with lib.maintainers; [ carloscraveiro tomasajt ];
+        maintainers = with lib.maintainers; [
+          carloscraveiro
+          tomasajt
+        ];
         platforms = [ "x86_64-linux" ];
       };
     };
 in
 {
-  simulide_0_4_15 = generic {
+  simulide_0_4_15 = generic rec {
     version = "0.4.15";
     release = "SR10";
-    branch = "simulide_0.4.14"; # the branch name does not mach the version for some reason
     rev = "291";
-    sha256 = "sha256-BBoZr/S2pif0Jft5wrem8y00dXl08jq3kFiIUtOr3LM=";
+    src = fetchbzr {
+      # the branch name does not mach the version for some reason
+      url = "https://code.launchpad.net/~arcachofo/simulide/simulide_0.4.14";
+      sha256 = "sha256-BBoZr/S2pif0Jft5wrem8y00dXl08jq3kFiIUtOr3LM=";
+      inherit rev;
+    };
     extraPostPatch = ''
       # GCC 13 needs the <cstdint> header explicitly included
       sed -i src/gpsim/value.h -e '1i #include <cstdint>'
@@ -110,20 +112,26 @@ in
     '';
   };
 
-  simulide_1_0_0 = generic {
+  simulide_1_0_0 = generic rec {
     version = "1.0.0";
     release = "SR2";
-    branch = "1.0.0";
     rev = "1449";
-    sha256 = "sha256-rJWZvnjVzaKXU2ktbde1w8LSNvu0jWkDIk4dq2l7t5g=";
+    src = fetchbzr {
+      url = "https://code.launchpad.net/~arcachofo/simulide/1.0.0";
+      sha256 = "sha256-rJWZvnjVzaKXU2ktbde1w8LSNvu0jWkDIk4dq2l7t5g=";
+      inherit rev;
+    };
     extraBuildInputs = [ qtscript ];
   };
 
-  simulide_1_1_0 = generic {
+  simulide_1_1_0 = generic rec {
     version = "1.1.0";
     release = "SR0";
-    branch = "1.1.0";
     rev = "1917";
-    sha256 = "sha256-qNBaGWl89Le9uC1VFK+xYhrLzIvOIWjkQbutnrAmZ2M=";
+    src = fetchbzr {
+      url = "https://code.launchpad.net/~arcachofo/simulide/1.1.0";
+      sha256 = "sha256-qNBaGWl89Le9uC1VFK+xYhrLzIvOIWjkQbutnrAmZ2M=";
+      inherit rev;
+    };
   };
 }

pkgs/applications/science/logic/why3/default.nix

@@ -1,6 +1,6 @@
 { callPackage, fetchurl, lib, stdenv
 , ocamlPackages, coqPackages, rubber, hevea, emacs
-, version ? "1.7.1"
+, version ? "1.7.2"
 , ideSupport ? true
 , wrapGAppsHook
 }:
@@ -12,7 +12,7 @@ stdenv.mkDerivation rec {
   src = fetchurl {
     url = "https://why3.gitlabpages.inria.fr/releases/${pname}-${version}.tar.gz";
     hash = {
-      "1.7.1" = "sha256-rG1hcxFhQ2PlE9RTz9ELliDjCuSzLnJ1togRY637cU4=";
+      "1.7.2" = "sha256-VaSG/FiO2MDdSSFXGJJrIylQx0LPwtT8AF7TpPVZhCQ=";
       "1.6.0" = "sha256-hFvM6kHScaCtcHCc6Vezl9CR7BFbiKPoTEh7kj0ZJxw=";
     }."${version}";
   };

pkgs/applications/science/math/eigenmath/default.nix

@@ -7,13 +7,13 @@
 
 stdenv.mkDerivation rec {
   pname = "eigenmath";
-  version = "unstable-2024-04-19";
+  version = "unstable-2024-04-26";
 
   src = fetchFromGitHub {
     owner = "georgeweigt";
     repo = pname;
-    rev = "5d5a538e7c378e9e2d9fabdf88fa2c6dd6d13e2c";
-    hash = "sha256-vPj3YKNJAZgdhw/VVrJIo2P7IyHrt7hVpnUQCUCZmR8=";
+    rev = "14a55ff60d078b752033b4ae29d332b04b6e8912";
+    hash = "sha256-p7wcLmssTqs3LCkZWB9rhCXEc4IVgZJNBvRhS51oH5E=";
   };
 
   checkPhase = let emulator = stdenv.hostPlatform.emulator buildPackages; in ''

pkgs/applications/science/misc/snakemake/default.nix

@@ -6,14 +6,14 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "snakemake";
-  version = "8.10.7";
+  version = "8.11.0";
   format = "setuptools";
 
   src = fetchFromGitHub {
     owner = "snakemake";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-tRjyv7pTTTDj3LrcIP3OWOX+9FldHV6rtbPdOYr70E4=";
+    hash = "sha256-bAzhQMGI4t/ftcZnz6h/PmlDlGgMU8vFVHb9QXED/Hw=";
     # https://github.com/python-versioneer/python-versioneer/issues/217
     postFetch = ''
       sed -i "$out"/snakemake/_version.py -e 's#git_refnames = ".*"#git_refnames = " (tag: v${version})"#'

pkgs/applications/version-management/gg/default.nix

@@ -59,6 +59,5 @@ in buildGoModule {
     homepage = "https://gg-scm.io/";
     changelog = "https://github.com/gg-scm/gg/blob/v${version}/CHANGELOG.md";
     license = licenses.asl20;
-    maintainers = with maintainers; [ zombiezen ];
   };
 }

pkgs/applications/version-management/ghorg/default.nix

@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "ghorg";
-  version = "1.9.10";
+  version = "1.9.11";
 
   src = fetchFromGitHub {
     owner = "gabrie30";
     repo = "ghorg";
     rev = "v${version}";
-    sha256 = "sha256-UU8iOpfM5RMwlDceDXofs3Nzyy93zcsUOuTGw/kzVe8=";
+    sha256 = "sha256-22/HM/DYkNh8V1v09fca6/3TLwzYudpH/VNbh+3+iyE=";
   };
 
   doCheck = false;

pkgs/applications/version-management/git-backup/default.nix

@@ -28,7 +28,7 @@ rustPlatform.buildRustPackage rec {
     homepage = "https://github.com/jsdw/git-backup";
     description = "A tool to help you backup your git repositories from services like GitHub";
     license = licenses.mit;
-    maintainers = [ ];
+    maintainers = with maintainers; [ cafkafk ];
     mainProgram = "git-backup";
   };
 }

pkgs/applications/version-management/git-branchless/default.nix

@@ -71,6 +71,6 @@ rustPlatform.buildRustPackage rec {
     homepage = "https://github.com/arxanas/git-branchless";
     license = licenses.gpl2Only;
     mainProgram = "git-branchless";
-    maintainers = with maintainers; [ msfjarvis nh2 hmenke ];
+    maintainers = with maintainers; [ nh2 hmenke ];
   };
 }

pkgs/applications/version-management/git-gone/default.nix

@@ -32,7 +32,7 @@ rustPlatform.buildRustPackage rec {
     homepage = "https://github.com/swsnr/git-gone";
     changelog = "https://github.com/swsnr/git-gone/raw/v${version}/CHANGELOG.md";
     license = licenses.asl20;
-    maintainers = [ ];
+    maintainers = with maintainers; [ cafkafk ];
     mainProgram = "git-gone";
   };
 }