Merge staging-next into staging

.github/workflows/backport.yml

···
     steps:
       # Use a GitHub App to create the PR so that CI gets triggered
       # The App is scoped to Repository > Contents and Pull Requests: write for Nixpkgs
-      - uses: actions/create-github-app-token@5d869da34e18e7287c1daad50e0b8ea0f506ce69 # v1.11.0
+      - uses: actions/create-github-app-token@c1a285145b9d317df6ced56c09f525b5c2b6f755 # v1.11.1
         id: app-token
         with:
           app-id: ${{ vars.BACKPORT_APP_ID }}

.github/workflows/codeowners-v2.yml

···
     - name: Build codeowners validator
       run: nix-build base/ci -A codeownersValidator
 
-    - uses: actions/create-github-app-token@5d869da34e18e7287c1daad50e0b8ea0f506ce69 # v1.11.0
+    - uses: actions/create-github-app-token@c1a285145b9d317df6ced56c09f525b5c2b6f755 # v1.11.1
       id: app-token
       with:
         app-id: ${{ vars.OWNER_RO_APP_ID }}
···
     # This is intentional, because we need to request the review of owners as declared in the base branch.
     - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
 
-    - uses: actions/create-github-app-token@5d869da34e18e7287c1daad50e0b8ea0f506ce69 # v1.11.0
+    - uses: actions/create-github-app-token@c1a285145b9d317df6ced56c09f525b5c2b6f755 # v1.11.1
       id: app-token
       with:
         app-id: ${{ vars.OWNER_APP_ID }}

lib/generators.nix

···
     split
     toJSON
     typeOf
+    escapeXML
     ;
 
   ## -- HELPER FUNCTIONS & DEFAULTS --
···
 
     # Inputs
 
-    Options
-    : Empty set, there may be configuration options in the future
+    Structured function argument
+
+    : escape (optional, default: `false`)
+      : If this option is true, XML special characters are escaped in string values and keys
 
     Value
       : The value to be converted to Plist
   */
-  toPlist = {}: v: let
+  toPlist = {
+    escape ? false
+  }: v: let
     expr = ind: x:
       if x == null  then "" else
       if isBool x   then bool ind x else
···
 
     literal = ind: x: ind + x;
 
+    maybeEscapeXML = if escape then escapeXML else x: x;
+
     bool = ind: x: literal ind  (if x then "<true/>" else "<false/>");
     int = ind: x: literal ind "<integer>${toString x}</integer>";
-    str = ind: x: literal ind "<string>${x}</string>";
-    key = ind: x: literal ind "<key>${x}</key>";
+    str = ind: x: literal ind "<string>${maybeEscapeXML x}</string>";
+    key = ind: x: literal ind "<key>${maybeEscapeXML x}</key>";
     float = ind: x: literal ind "<real>${toString x}</real>";
 
     indent = ind: expr "\t${ind}";
···
       (expr "\t${ind}" value)
     ]) x));
 
-  in ''<?xml version="1.0" encoding="UTF-8"?>
+  in
+  # TODO: As discussed in #356502, deprecated functionality should be removed sometime after 25.11.
+  lib.warnIf (!escape && lib.oldestSupportedReleaseIsAtLeast 2505) "Using `lib.generators.toPlist` without `escape = true` is deprecated"
+  ''<?xml version="1.0" encoding="UTF-8"?>
 <!DOCTYPE plist PUBLIC "-//Apple Computer//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
 <plist version="1.0">
 ${expr "" v}

lib/tests/misc.nix

···
     expected  = "«foo»";
   };
 
-  testToPlist = {
+  testToPlistUnescaped = {
     expr = mapAttrs (const (generators.toPlist { })) {
       value = {
         nested.values = {
···
           emptylist = [];
           attrs = { foo = null; "foo b/ar" = "baz"; };
           emptyattrs = {};
+          "keys are not <escaped>" = "and < neither are string values";
         };
       };
     };
-    expected = { value = builtins.readFile ./test-to-plist-expected.plist; };
+    expected = { value = builtins.readFile ./test-to-plist-unescaped-expected.plist; };
+  };
+
+  testToPlistEscaped = {
+    expr = mapAttrs (const (generators.toPlist { escape = true; })) {
+      value = {
+        nested.values = {
+          int = 42;
+          float = 0.1337;
+          bool = true;
+          emptystring = "";
+          string = "fn\${o}\"r\\d";
+          newlinestring = "\n";
+          path = /. + "/foo";
+          null_ = null;
+          list = [ 3 4 "test" ];
+          emptylist = [];
+          attrs = { foo = null; "foo b/ar" = "baz"; };
+          emptyattrs = {};
+          "keys are <escaped>" = "and < so are string values";
+        };
+      };
+    };
+    expected = { value = builtins.readFile ./test-to-plist-escaped-expected.plist; };
   };
 
   testToLuaEmptyAttrSet = {

lib/tests/test-to-plist-escaped-expected.plist

···
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple Computer//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+	<key>nested</key>
+	<dict>
+		<key>values</key>
+		<dict>
+			<key>attrs</key>
+			<dict>
+				<key>foo b/ar</key>
+				<string>baz</string>
+			</dict>
+			<key>bool</key>
+			<true/>
+			<key>emptyattrs</key>
+			<dict>
+
+			</dict>
+			<key>emptylist</key>
+			<array>
+
+			</array>
+			<key>emptystring</key>
+			<string></string>
+			<key>float</key>
+			<real>0.133700</real>
+			<key>int</key>
+			<integer>42</integer>
+			<key>keys are &lt;escaped&gt;</key>
+			<string>and &lt; so are string values</string>
+			<key>list</key>
+			<array>
+				<integer>3</integer>
+				<integer>4</integer>
+				<string>test</string>
+			</array>
+			<key>newlinestring</key>
+			<string>
+</string>
+			<key>path</key>
+			<string>/foo</string>
+			<key>string</key>
+			<string>fn${o}&quot;r\d</string>
+		</dict>
+	</dict>
+</dict>
+</plist>

lib/tests/test-to-plist-expected.plist lib/tests/test-to-plist-unescaped-expected.plist

···
 			<real>0.133700</real>
 			<key>int</key>
 			<integer>42</integer>
+			<key>keys are not <escaped></key>
+			<string>and < neither are string values</string>
 			<key>list</key>
 			<array>
 				<integer>3</integer>

nixos/doc/manual/release-notes/rl-2505.section.md

···
 
 - Cinnamon has been updated to 6.4, please check the [upstream announcement](https://www.linuxmint.com/rel_xia_whatsnew.php) for more details.
   - Following [changes in Mint 22](https://github.com/linuxmint/mintupgrade/commit/f239cde908288b8c250f938e7311c7ffbc16bd59) we are no longer overriding Qt application styles. You can still restore the previous default with `qt.style = "gtk2"` and `qt.platformTheme = "gtk2"`.
+  - Following [changes in Mint 20](https://github.com/linuxmint/mintupgrade-legacy/commit/ce15d946ed9a8cb8444abd25088edd824bfb18f6) we are replacing xplayer with celluloid since xplayer is no longer maintained.
 
 - Xfce has been updated to 4.20, please check the [upstream feature tour](https://www.xfce.org/about/tour420) for more details.
   - Wayland session is still [experimental](https://wiki.xfce.org/releng/wayland_roadmap) and requires opt-in using `enableWaylandSession` option.

nixos/modules/services/network-filesystems/moosefs.nix

···
-{ config, lib, pkgs, ... }:
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
 let
   cfg = config.services.moosefs;
 
   mfsUser = if cfg.runAsUser then "moosefs" else "root";
 
-  settingsFormat = let
-    listSep = " ";
-    allowedTypes = with lib.types; [ bool int float str ];
-    valueToString = val:
-        if lib.isList val then lib.concatStringsSep listSep (map (x: valueToString x) val)
-        else if lib.isBool val then (if val then "1" else "0")
-        else toString val;
+  settingsFormat =
+    let
+      listSep = " ";
+      allowedTypes = with lib.types; [
+        bool
+        int
+        float
+        str
+      ];
+      valueToString =
+        val:
+        if lib.isList val then
+          lib.concatStringsSep listSep (map (x: valueToString x) val)
+        else if lib.isBool val then
+          (if val then "1" else "0")
+        else
+          toString val;
 
-    in {
-      type = with lib.types; let
-        valueType = oneOf ([
-          (listOf valueType)
-        ] ++ allowedTypes) // {
-          description = "Flat key-value file";
-        };
-      in attrsOf valueType;
+    in
+    {
+      type =
+        with lib.types;
+        let
+          valueType =
+            oneOf (
+              [
+                (listOf valueType)
+              ]
+              ++ allowedTypes
+            )
+            // {
+              description = "Flat key-value file";
+            };
+        in
+        attrsOf valueType;
 
-      generate = name: value:
-        pkgs.writeText name ( lib.concatStringsSep "\n" (
-          lib.mapAttrsToList (key: val: "${key} = ${valueToString val}") value ));
+      generate =
+        name: value:
+        pkgs.writeText name (
+          lib.concatStringsSep "\n" (lib.mapAttrsToList (key: val: "${key} = ${valueToString val}") value)
+        );
     };
 
   # Manual initialization tool
···
   systemdService = name: extraConfig: configFile: {
     wantedBy = [ "multi-user.target" ];
     wants = [ "network-online.target" ];
-    after = [ "network.target" "network-online.target" ];
+    after = [
+      "network.target"
+      "network-online.target"
+    ];
 
     serviceConfig = {
       Type = "forking";
-      ExecStart  = "${pkgs.moosefs}/bin/mfs${name} -c ${configFile} start";
-      ExecStop   = "${pkgs.moosefs}/bin/mfs${name} -c ${configFile} stop";
+      ExecStart = "${pkgs.moosefs}/bin/mfs${name} -c ${configFile} start";
+      ExecStop = "${pkgs.moosefs}/bin/mfs${name} -c ${configFile} stop";
       ExecReload = "${pkgs.moosefs}/bin/mfs${name} -c ${configFile} reload";
       PIDFile = "${cfg."${name}".settings.DATA_PATH}/.mfs${name}.lock";
     } // extraConfig;
   };
 
-in {
+in
+{
   ###### interface
   options = {
     services.moosefs = {
···
           type = with lib.types; listOf str;
           default = null;
           description = "Mount points used by chunkserver for data storage (see mfshdd.cfg).";
-          example = [ "/mnt/hdd1" "/mnt/hdd2" ];
+          example = [
+            "/mnt/hdd1"
+            "/mnt/hdd2"
+          ];
         };
 
         settings = lib.mkOption {
···
               };
             };
           };
-          default = {};
+          default = { };
           description = "CGI server configuration options.";
         };
       };
···
   };
 
   ###### implementation
-  config = lib.mkIf (cfg.client.enable || cfg.master.enable || cfg.metalogger.enable || cfg.chunkserver.enable || cfg.cgiserver.enable) {
-    warnings = [ ( lib.mkIf (!cfg.runAsUser) "Running MooseFS services as root is not recommended.") ];
+  config =
+    lib.mkIf
+      (
+        cfg.client.enable
+        || cfg.master.enable
+        || cfg.metalogger.enable
+        || cfg.chunkserver.enable
+        || cfg.cgiserver.enable
+      )
+      {
+        warnings = [ (lib.mkIf (!cfg.runAsUser) "Running MooseFS services as root is not recommended.") ];
 
-    services.moosefs = {
-      master.settings = lib.mkIf cfg.master.enable (lib.mkMerge [
-        {
-          WORKING_USER = mfsUser;
-          EXPORTS_FILENAME = toString ( pkgs.writeText "mfsexports.cfg"
-            (lib.concatStringsSep "\n" cfg.master.exports));
-        }
-        (lib.mkIf cfg.cgiserver.enable {
-          MFSCGISERV = toString cfg.cgiserver.settings.PORT;
-        })
-      ]);
+        services.moosefs = {
+          master.settings = lib.mkIf cfg.master.enable (
+            lib.mkMerge [
+              {
+                WORKING_USER = mfsUser;
+                EXPORTS_FILENAME = toString (
+                  pkgs.writeText "mfsexports.cfg" (lib.concatStringsSep "\n" cfg.master.exports)
+                );
+              }
+              (lib.mkIf cfg.cgiserver.enable {
+                MFSCGISERV = toString cfg.cgiserver.settings.PORT;
+              })
+            ]
+          );
 
-      metalogger.settings = lib.mkIf cfg.metalogger.enable {
-        WORKING_USER = mfsUser;
-        MASTER_HOST = cfg.masterHost;
-      };
+          metalogger.settings = lib.mkIf cfg.metalogger.enable {
+            WORKING_USER = mfsUser;
+            MASTER_HOST = cfg.masterHost;
+          };
 
-      chunkserver.settings = lib.mkIf cfg.chunkserver.enable {
-        WORKING_USER = mfsUser;
-        MASTER_HOST = cfg.masterHost;
-        HDD_CONF_FILENAME = toString ( pkgs.writeText "mfshdd.cfg"
-          (lib.concatStringsSep "\n" cfg.chunkserver.hdds));
-      };
-    };
+          chunkserver.settings = lib.mkIf cfg.chunkserver.enable {
+            WORKING_USER = mfsUser;
+            MASTER_HOST = cfg.masterHost;
+            HDD_CONF_FILENAME = toString (
+              pkgs.writeText "mfshdd.cfg" (lib.concatStringsSep "\n" cfg.chunkserver.hdds)
+            );
+          };
+        };
 
-    users = lib.mkIf ( cfg.runAsUser && ( cfg.master.enable || cfg.metalogger.enable || cfg.chunkserver.enable || cfg.cgiserver.enable ) ) {
-      users.moosefs = {
-        isSystemUser = true;
-        description = "MooseFS daemon user";
-        group = "moosefs";
-      };
-      groups.moosefs = {};
-    };
+        users =
+          lib.mkIf
+            (
+              cfg.runAsUser
+              && (cfg.master.enable || cfg.metalogger.enable || cfg.chunkserver.enable || cfg.cgiserver.enable)
+            )
+            {
+              users.moosefs = {
+                isSystemUser = true;
+                description = "MooseFS daemon user";
+                group = "moosefs";
+              };
+              groups.moosefs = { };
+            };
 
-    environment.systemPackages =
-      (lib.optional cfg.client.enable pkgs.moosefs) ++
-      (lib.optional cfg.master.enable initTool);
+        environment.systemPackages =
+          (lib.optional cfg.client.enable pkgs.moosefs) ++ (lib.optional cfg.master.enable initTool);
 
-    networking.firewall.allowedTCPPorts = lib.mkMerge [
-      (lib.optionals cfg.master.openFirewall [ 9419 9420 9421 ])
-      (lib.optional cfg.chunkserver.openFirewall 9422)
-      (lib.optional (cfg.cgiserver.enable && cfg.cgiserver.openFirewall) cfg.cgiserver.settings.PORT)
-    ];
+        networking.firewall.allowedTCPPorts = lib.mkMerge [
+          (lib.optionals cfg.master.openFirewall [
+            9419
+            9420
+            9421
+          ])
+          (lib.optional cfg.chunkserver.openFirewall 9422)
+          (lib.optional (cfg.cgiserver.enable && cfg.cgiserver.openFirewall) cfg.cgiserver.settings.PORT)
+        ];
 
-    systemd.tmpfiles.rules = [
-      # Master directories
-      (lib.optionalString cfg.master.enable
-        "d ${cfg.master.settings.DATA_PATH} 0700 ${mfsUser} ${mfsUser} -")
+        systemd.tmpfiles.rules =
+          [
+            # Master directories
+            (lib.optionalString cfg.master.enable "d ${cfg.master.settings.DATA_PATH} 0700 ${mfsUser} ${mfsUser} -")
 
-      # Metalogger directories
-      (lib.optionalString cfg.metalogger.enable
-        "d ${cfg.metalogger.settings.DATA_PATH} 0700 ${mfsUser} ${mfsUser} -")
+            # Metalogger directories
+            (lib.optionalString cfg.metalogger.enable "d ${cfg.metalogger.settings.DATA_PATH} 0700 ${mfsUser} ${mfsUser} -")
 
-      # Chunkserver directories
-      (lib.optionalString cfg.chunkserver.enable
-        "d ${cfg.chunkserver.settings.DATA_PATH} 0700 ${mfsUser} ${mfsUser} -")
-    ] ++ lib.optionals (cfg.chunkserver.enable && cfg.chunkserver.hdds != null)
-        (map (dir: "d ${dir} 0755 ${mfsUser} ${mfsUser} -") cfg.chunkserver.hdds);
+            # Chunkserver directories
+            (lib.optionalString cfg.chunkserver.enable "d ${cfg.chunkserver.settings.DATA_PATH} 0700 ${mfsUser} ${mfsUser} -")
+          ]
+          ++ lib.optionals (cfg.chunkserver.enable && cfg.chunkserver.hdds != null) (
+            map (dir: "d ${dir} 0755 ${mfsUser} ${mfsUser} -") cfg.chunkserver.hdds
+          );
 
-    systemd.services = lib.mkMerge [
-      (lib.mkIf cfg.master.enable {
-        mfs-master = (lib.mkMerge [
-          (systemdService "master" {
-            TimeoutStartSec = 1800;
-            TimeoutStopSec = 1800;
-            Restart = "on-failure";
-            User = mfsUser;
-          } masterCfg)
-          {
-            preStart = lib.mkIf cfg.master.autoInit "${initTool}/bin/mfsmaster-init";
-          }
-        ]);
-      })
+        systemd.services = lib.mkMerge [
+          (lib.mkIf cfg.master.enable {
+            mfs-master = (
+              lib.mkMerge [
+                (systemdService "master" {
+                  TimeoutStartSec = 1800;
+                  TimeoutStopSec = 1800;
+                  Restart = "on-failure";
+                  User = mfsUser;
+                } masterCfg)
+                {
+                  preStart = lib.mkIf cfg.master.autoInit "${initTool}/bin/mfsmaster-init";
+                }
+              ]
+            );
+          })
 
-      (lib.mkIf cfg.metalogger.enable {
-        mfs-metalogger = systemdService "metalogger" {
-          Restart = "on-abnormal";
-          User = mfsUser;
-        } metaloggerCfg;
-      })
+          (lib.mkIf cfg.metalogger.enable {
+            mfs-metalogger = systemdService "metalogger" {
+              Restart = "on-abnormal";
+              User = mfsUser;
+            } metaloggerCfg;
+          })
 
-      (lib.mkIf cfg.chunkserver.enable {
-        mfs-chunkserver = systemdService "chunkserver" {
-          Restart = "on-abnormal";
-          User = mfsUser;
-        } chunkserverCfg;
-      })
+          (lib.mkIf cfg.chunkserver.enable {
+            mfs-chunkserver = systemdService "chunkserver" {
+              Restart = "on-abnormal";
+              User = mfsUser;
+            } chunkserverCfg;
+          })
 
-      (lib.mkIf cfg.cgiserver.enable {
-        mfs-cgiserv = {
-          description = "MooseFS CGI Server";
-          wantedBy = [ "multi-user.target" ];
-          after = [ "mfs-master.service" ];
+          (lib.mkIf cfg.cgiserver.enable {
+            mfs-cgiserv = {
+              description = "MooseFS CGI Server";
+              wantedBy = [ "multi-user.target" ];
+              after = [ "mfs-master.service" ];
 
-          serviceConfig = {
-            Type = "simple";
-            ExecStart = "${pkgs.moosefs}/bin/mfscgiserv -D /var/lib/mfs -f start";
-            ExecStop = "${pkgs.moosefs}/bin/mfscgiserv -D /var/lib/mfs stop";
-            Restart = "on-failure";
-            RestartSec = "30s";
-            User = mfsUser;
-            Group = mfsUser;
-            WorkingDirectory = "/var/lib/mfs";
-          };
-        };
-      })
-    ];
-  };
+              serviceConfig = {
+                Type = "simple";
+                ExecStart = "${pkgs.moosefs}/bin/mfscgiserv -D /var/lib/mfs -f start";
+                ExecStop = "${pkgs.moosefs}/bin/mfscgiserv -D /var/lib/mfs stop";
+                Restart = "on-failure";
+                RestartSec = "30s";
+                User = mfsUser;
+                Group = mfsUser;
+                WorkingDirectory = "/var/lib/mfs";
+              };
+            };
+          })
+        ];
+      };
 }

nixos/modules/services/x11/desktop-managers/cinnamon.nix

···
         xviewer
         xreader
         xed-editor
-        xplayer
         pix
 
         # external apps shipped with linux-mint
+        celluloid
         gnome-calculator
         gnome-calendar
         gnome-screenshot

nixos/tests/xfce-wayland.nix

···
 
         services.xserver.desktopManager.xfce.enable = true;
         services.xserver.desktopManager.xfce.enableWaylandSession = true;
-        # https://gitlab.xfce.org/apps/xfce4-screensaver/-/merge_requests/28
-        services.xserver.desktopManager.xfce.enableScreensaver = false;
         environment.systemPackages = [ pkgs.wlrctl ];
       };
 

pkgs/applications/backup/timeshift/unwrapped.nix

···
     xapp
   ];
 
+  env = lib.optionalAttrs stdenv.cc.isGNU {
+    NIX_CFLAGS_COMPILE = "-Wno-error=implicit-function-declaration";
+  };
+
   meta = with lib; {
     description = "System restore tool for Linux";
     longDescription = ''

pkgs/applications/editors/vim/plugins/overrides.nix

···
 
   blink-cmp = callPackage ./non-generated/blink-cmp { };
 
+  blink-cmp-copilot = super.blink-cmp-copilot.overrideAttrs {
+    dependencies = [ self.copilot-lua ];
+  };
+
   bluloco-nvim = super.bluloco-nvim.overrideAttrs {
     dependencies = [ self.lush-nvim ];
   };
···
       "lazyvim.plugins.extras.lang.svelte"
       "lazyvim.plugins.extras.lang.typescript"
       "lazyvim.plugins.init"
+      "lazyvim.plugins.ui"
       "lazyvim.plugins.xtras"
     ];
   };
···
     vimCommandCheck = "TealBuild";
   };
 
+  nvim-tree-lua = super.nvim-tree-lua.overrideAttrs {
+    nvimSkipModule = [
+      # Meta can't be required
+      "nvim-tree._meta.api"
+      "nvim-tree._meta.api_decorator"
+    ];
+  };
+
   nvim-treesitter = super.nvim-treesitter.overrideAttrs (
     callPackage ./nvim-treesitter/overrides.nix { } self super
   );
···
     nvimSkipModule = [
       # Requires setup call first
       "snacks.dashboard"
+      "snacks.debug"
+      "snacks.dim"
       "snacks.git"
+      "snacks.indent"
+      "snacks.input"
       "snacks.lazygit"
       "snacks.notifier"
+      "snacks.scratch"
+      "snacks.scroll"
       "snacks.terminal"
       "snacks.win"
       "snacks.words"
-      "snacks.debug"
-      "snacks.scratch"
+      "snacks.zen"
       # Optional trouble integration
       "trouble.sources.profiler"
     ];

pkgs/applications/networking/cluster/k3s/1_29/images-versions.json

···
 {
   "airgap-images-amd64": {
-    "url": "https://github.com/k3s-io/k3s/releases/download/v1.29.11%2Bk3s1/k3s-airgap-images-amd64.tar.zst",
-    "sha256": "0i62dg60090wmiqi2wzqa4jx45dag71y0936hhy00402wdcylmj7"
+    "url": "https://github.com/k3s-io/k3s/releases/download/v1.29.12%2Bk3s1/k3s-airgap-images-amd64.tar.zst",
+    "sha256": "0p3d0k4ckzrbd3xd4v9vb8rhw9jcl4ilx9ch94yhf8kxnnblgzyb"
   },
   "airgap-images-arm": {
-    "url": "https://github.com/k3s-io/k3s/releases/download/v1.29.11%2Bk3s1/k3s-airgap-images-arm.tar.zst",
-    "sha256": "0v9wazqiypzpxpc31vi0x3w1jwsny8xcnv67bcjwj5xlwpjlsjz9"
+    "url": "https://github.com/k3s-io/k3s/releases/download/v1.29.12%2Bk3s1/k3s-airgap-images-arm.tar.zst",
+    "sha256": "0j9ajjz201w319gfryx2q7jnmyi8gg805v7jsdmy4xkyl8ki80jw"
   },
   "airgap-images-arm64": {
-    "url": "https://github.com/k3s-io/k3s/releases/download/v1.29.11%2Bk3s1/k3s-airgap-images-arm64.tar.zst",
-    "sha256": "07145gdpgqy49pvinnx0pal9mzsljysgd5zfq565fx5smfxzvbyn"
+    "url": "https://github.com/k3s-io/k3s/releases/download/v1.29.12%2Bk3s1/k3s-airgap-images-arm64.tar.zst",
+    "sha256": "1yc1yafr16mli1jk9xc4vgp6q36zk9z5p4rjmdng42dp0j6kvj0w"
   },
   "images-list": {
-    "url": "https://github.com/k3s-io/k3s/releases/download/v1.29.11%2Bk3s1/k3s-images.txt",
-    "sha256": "05229bfg174pvy525dcy7rvmgv9i9v1nnz5ngq80n7zkxj9cp8m8"
+    "url": "https://github.com/k3s-io/k3s/releases/download/v1.29.12%2Bk3s1/k3s-images.txt",
+    "sha256": "1gqiaszfw49hsbn7xkkadykaf028vys13ykqvpkqar0f7hwwbja6"
   }
 }

pkgs/applications/networking/cluster/k3s/1_29/versions.nix

···
 {
-  k3sVersion = "1.29.11+k3s1";
-  k3sCommit = "666b590a7512c0baab01c93bf81222fa22565c45";
-  k3sRepoSha256 = "0w9lldvzkd3rrq0gypqnyjmjr73bxay44q2vfcj4my0ryc3bajf4";
-  k3sVendorHash = "sha256-FaOBeUONkeG2CfGUN4VRUzpQl0C6b06kKCnb6ICYHzo=";
+  k3sVersion = "1.29.12+k3s1";
+  k3sCommit = "ab3818c6169fb022c1fb74b8646d8d724a0f6030";
+  k3sRepoSha256 = "10lmva3wwpzymm5lf65gg7ixbz5vdbpagb1ghbc4r8v50ack0cvf";
+  k3sVendorHash = "sha256-s49GPwMPkF38NTj/aZ1aMliT/Msa1BMS9fmfqcp0//s=";
   chartVersions = import ./chart-versions.nix;
   imagesVersions = builtins.fromJSON (builtins.readFile ./images-versions.json);
   k3sRootVersion = "0.14.1";

pkgs/applications/networking/cluster/k3s/1_30/images-versions.json

···
 {
   "airgap-images-amd64": {
-    "url": "https://github.com/k3s-io/k3s/releases/download/v1.30.7%2Bk3s1/k3s-airgap-images-amd64.tar.zst",
-    "sha256": "09czfci3c37phn89zzqnsxgxwclmzf03mxlh88v0d7fk4qjlqa4i"
+    "url": "https://github.com/k3s-io/k3s/releases/download/v1.30.8%2Bk3s1/k3s-airgap-images-amd64.tar.zst",
+    "sha256": "12vvc79jy1nyvcpsr2bi6w1zf28rqx99vh7anjm13snzsk7kzqc2"
   },
   "airgap-images-arm": {
-    "url": "https://github.com/k3s-io/k3s/releases/download/v1.30.7%2Bk3s1/k3s-airgap-images-arm.tar.zst",
-    "sha256": "1wdnfc0f17rjz5gd1gfngax9ghjxv4gpzq73gyd745j53f64wv7n"
+    "url": "https://github.com/k3s-io/k3s/releases/download/v1.30.8%2Bk3s1/k3s-airgap-images-arm.tar.zst",
+    "sha256": "0mhn1ilh830m403yg1y3nqzjcakhs3i6hgdq2s8w2spyz2kdrgv1"
   },
   "airgap-images-arm64": {
-    "url": "https://github.com/k3s-io/k3s/releases/download/v1.30.7%2Bk3s1/k3s-airgap-images-arm64.tar.zst",
-    "sha256": "04i8j4x26bia3sqc5ra23p0nyy1ncd57mifwakm8nrk8dayigm8d"
+    "url": "https://github.com/k3s-io/k3s/releases/download/v1.30.8%2Bk3s1/k3s-airgap-images-arm64.tar.zst",
+    "sha256": "0jdxf36dksypjvgil23wn8ins5rp0achmlavmv12vhijfllkqnn5"
   },
   "images-list": {
-    "url": "https://github.com/k3s-io/k3s/releases/download/v1.30.7%2Bk3s1/k3s-images.txt",
-    "sha256": "05229bfg174pvy525dcy7rvmgv9i9v1nnz5ngq80n7zkxj9cp8m8"
+    "url": "https://github.com/k3s-io/k3s/releases/download/v1.30.8%2Bk3s1/k3s-images.txt",
+    "sha256": "1gqiaszfw49hsbn7xkkadykaf028vys13ykqvpkqar0f7hwwbja6"
   }
 }

pkgs/applications/networking/cluster/k3s/1_30/versions.nix

···
 {
-  k3sVersion = "1.30.7+k3s1";
-  k3sCommit = "00f901803ada2af4adb0439804f98b6fb6379992";
-  k3sRepoSha256 = "0jvbd4g1kisyjs2hrz4aqwrg08b13pvdf10dyyavvw1bmzki26ih";
-  k3sVendorHash = "sha256-3kLD2oyeo1cC0qRD48sFbsARuD034wilcNQpGRa65aQ=";
+  k3sVersion = "1.30.8+k3s1";
+  k3sCommit = "b43a365f27d8372336fea7b0984a571109d742ca";
+  k3sRepoSha256 = "1fkpvx25aw59vvyfq9pbnph3kgyr4ykxg2dkkjdmqjdgwza04c47";
+  k3sVendorHash = "sha256-q/cRKuqXuzPcLEYD+BH82ZAc+ZgGIqKWLsM1E4uQsok=";
   chartVersions = import ./chart-versions.nix;
   imagesVersions = builtins.fromJSON (builtins.readFile ./images-versions.json);
   k3sRootVersion = "0.14.1";

pkgs/applications/networking/cluster/k3s/builder.nix

···
   libseccomp,
   makeWrapper,
   nixosTests,
+  overrideBundleAttrs ? { }, # An attrSet/function to override the `k3sBundle` derivation.
+  overrideCniPluginsAttrs ? { }, # An attrSet/function to override the `k3sCNIPlugins` derivation.
+  overrideContainerdAttrs ? { }, # An attrSet/function to override the `k3sContainerd` derivation.
   pkg-config,
   pkgsBuildBuild,
   procps,
   rsync,
-  runc,
   runCommand,
+  runc,
   socat,
   sqlite,
   stdenv,
···
     sha256 = k3sRootSha256;
     stripRoot = false;
   };
-  k3sCNIPlugins = buildGoModule rec {
-    pname = "k3s-cni-plugins";
-    version = k3sCNIVersion;
-    vendorHash = null;
+  k3sCNIPlugins =
+    (buildGoModule rec {
+      pname = "k3s-cni-plugins";
+      version = k3sCNIVersion;
+      vendorHash = null;
 
-    subPackages = [ "." ];
+      subPackages = [ "." ];
 
-    src = fetchFromGitHub {
-      owner = "rancher";
-      repo = "plugins";
-      rev = "v${version}";
-      sha256 = k3sCNISha256;
-    };
+      src = fetchFromGitHub {
+        owner = "rancher";
+        repo = "plugins";
+        rev = "v${version}";
+        sha256 = k3sCNISha256;
+      };
 
-    postInstall = ''
-      mv $out/bin/plugins $out/bin/cni
-    '';
+      postInstall = ''
+        mv $out/bin/plugins $out/bin/cni
+      '';
 
-    meta = baseMeta // {
-      description = "CNI plugins, as patched by rancher for k3s";
-    };
-  };
+      meta = baseMeta // {
+        description = "CNI plugins, as patched by rancher for k3s";
+      };
+    }).overrideAttrs
+      overrideCniPluginsAttrs;
   # Grab this separately from a build because it's used by both stages of the
   # k3s build.
   k3sRepo = fetchgit {
···
   # derivation when we've built all the binaries, but haven't bundled them in
   # with generated bindata yet.
 
-  k3sServer = buildGoModule {
-    pname = "k3s-server";
-    version = k3sVersion;
+  k3sBundle =
+    (buildGoModule {
+      pname = "k3s-bin";
+      version = k3sVersion;
 
-    src = k3sRepo;
-    vendorHash = k3sVendorHash;
+      src = k3sRepo;
+      vendorHash = k3sVendorHash;
 
-    nativeBuildInputs = [ pkg-config ];
-    buildInputs = [
-      libseccomp
-      sqlite.dev
-    ];
+      nativeBuildInputs = [ pkg-config ];
+      buildInputs = [
+        libseccomp
+        sqlite.dev
+      ];
 
-    subPackages = [ "cmd/server" ];
-    ldflags = versionldflags;
+      subPackages = [ "cmd/server" ];
+      ldflags = versionldflags;
 
-    tags = [
-      "ctrd"
-      "libsqlite3"
-      "linux"
-    ];
+      tags = [
+        "ctrd"
+        "libsqlite3"
+        "linux"
+      ];
 
-    # create the multicall symlinks for k3s
-    postInstall = ''
-      mv $out/bin/server $out/bin/k3s
-      pushd $out
-      # taken verbatim from https://github.com/k3s-io/k3s/blob/v1.23.3%2Bk3s1/scripts/build#L105-L113
-      ln -s k3s ./bin/containerd
-      ln -s k3s ./bin/crictl
-      ln -s k3s ./bin/ctr
-      ln -s k3s ./bin/k3s-agent
-      ln -s k3s ./bin/k3s-certificate
-      ln -s k3s ./bin/k3s-completion
-      ln -s k3s ./bin/k3s-etcd-snapshot
-      ln -s k3s ./bin/k3s-secrets-encrypt
-      ln -s k3s ./bin/k3s-server
-      ln -s k3s ./bin/k3s-token
-      ln -s k3s ./bin/kubectl
-      popd
-    '';
+      # create the multicall symlinks for k3s
+      postInstall = ''
+        mv $out/bin/server $out/bin/k3s
+        pushd $out
+        # taken verbatim from https://github.com/k3s-io/k3s/blob/v1.23.3%2Bk3s1/scripts/build#L105-L113
+        ln -s k3s ./bin/containerd
+        ln -s k3s ./bin/crictl
+        ln -s k3s ./bin/ctr
+        ln -s k3s ./bin/k3s-agent
+        ln -s k3s ./bin/k3s-certificate
+        ln -s k3s ./bin/k3s-completion
+        ln -s k3s ./bin/k3s-etcd-snapshot
+        ln -s k3s ./bin/k3s-secrets-encrypt
+        ln -s k3s ./bin/k3s-server
+        ln -s k3s ./bin/k3s-token
+        ln -s k3s ./bin/kubectl
+        popd
+      '';
 
-    meta = baseMeta // {
-      description = "Various binaries that get packaged into the final k3s binary";
-    };
-  };
+      meta = baseMeta // {
+        description = "Various binaries that get packaged into the final k3s binary";
+      };
+    }).overrideAttrs
+      overrideBundleAttrs;
   # Only used for the shim since
   # https://github.com/k3s-io/k3s/blob/v1.27.2%2Bk3s1/scripts/build#L153
-  k3sContainerd = buildGoModule {
-    pname = "k3s-containerd";
-    version = containerdVersion;
-    src = fetchFromGitHub {
-      owner = "k3s-io";
-      repo = "containerd";
-      rev = "v${containerdVersion}";
-      sha256 = containerdSha256;
-    };
-    vendorHash = null;
-    buildInputs = [ btrfs-progs ];
-    subPackages = [ "cmd/containerd-shim-runc-v2" ];
-    ldflags = versionldflags;
-  };
+  k3sContainerd =
+    (buildGoModule {
+      pname = "k3s-containerd";
+      version = containerdVersion;
+      src = fetchFromGitHub {
+        owner = "k3s-io";
+        repo = "containerd";
+        rev = "v${containerdVersion}";
+        sha256 = containerdSha256;
+      };
+      vendorHash = null;
+      buildInputs = [ btrfs-progs ];
+      subPackages = [ "cmd/containerd-shim-runc-v2" ];
+      ldflags = versionldflags;
+    }).overrideAttrs
+      overrideContainerdAttrs;
 in
 buildGoModule rec {
   pname = "k3s";
···
   propagatedBuildInputs = [
     k3sCNIPlugins
     k3sContainerd
-    k3sServer
+    k3sBundle
   ];
 
   # We override most of buildPhase due to peculiarities in k3s's build.
···
 
     # copy needed 'go generate' inputs into place
     mkdir -p ./bin/aux
-    rsync -a --no-perms ${k3sServer}/bin/ ./bin/
+    rsync -a --no-perms ${k3sBundle}/bin/ ./bin/
     ln -vsf ${k3sCNIPlugins}/bin/cni ./bin/cni
     ln -vsf ${k3sContainerd}/bin/containerd-shim-runc-v2 ./bin
     rsync -a --no-perms --chmod u=rwX ${k3sRoot}/etc/ ./etc/
···
       k3sContainerd = k3sContainerd;
       k3sRepo = k3sRepo;
       k3sRoot = k3sRoot;
-      k3sServer = k3sServer;
+      k3sBundle = k3sBundle;
       mkTests =
         version:
         let

pkgs/by-name/ca/caribou/package.nix

···
     substituteInPlace libcaribou/Makefile.am --replace "--shared-library=libcaribou.so.0" "--shared-library=$out/lib/libcaribou.so.0"
   '';
 
+  env = lib.optionalAttrs stdenv.cc.isGNU {
+    # This really should be done by latest Vala, but we are using
+    # release tarball here, which dists generated C code.
+    # https://gitlab.gnome.org/GNOME/vala/-/merge_requests/369
+    NIX_CFLAGS_COMPILE = "-Wno-error=incompatible-pointer-types";
+  };
+
   passthru = {
     updateScript = gnome.updateScript { packageName = "caribou"; };
   };

pkgs/by-name/ci/cinnamon-common/package.nix

···
 # TODO (after 25.05 branch-off): Rename to pkgs.cinnamon
 stdenv.mkDerivation rec {
   pname = "cinnamon-common";
-  version = "6.4.2";
+  version = "6.4.3";
 
   src = fetchFromGitHub {
     owner = "linuxmint";
     repo = "cinnamon";
     rev = version;
-    hash = "sha256-r5cSm/a+xtHwwAHQmdgviDAN3nnMAnXGY/p+ER1/gbk=";
+    hash = "sha256-Nq4CFLmvgyPFg+mALE1UYauWAR7ZjtJGJOSChbIjm4g=";
   };
 
   patches = [

pkgs/by-name/dp/dpdk/package.nix

···
 , pkg-config, meson, ninja, makeWrapper
 , libbsd, numactl, libbpf, zlib, elfutils, jansson, openssl, libpcap, rdma-core
 , doxygen, python3, pciutils
+, fetchpatch
 , withExamples ? []
 , shared ? false
 , machine ? (
···
     rdma-core
     # Requested by pkg-config.
     libbsd
+  ];
+
+  patches = [
+    (fetchpatch {
+      name = "CVE-2024-11614.patch";
+      url = "https://git.dpdk.org/dpdk-stable/patch/?id=fdf13ea6fede07538fbe5e2a46fa6d4b2368fa81";
+      hash = "sha256-lD2mhPm5r1tWZb4IpzHa2SeK1DyQ3rwjzArRTpAgZAY=";
+    })
   ];
 
   postPatch = ''

pkgs/by-name/ei/eigenmath/package.nix

···
 
 stdenv.mkDerivation rec {
   pname = "eigenmath";
-  version = "3.35-unstable-2024-12-11";
+  version = "337-unstable-2024-12-20";
 
   src = fetchFromGitHub {
     owner = "georgeweigt";
     repo = pname;
-    rev = "8aeb901425aae6dc27b00040dee38cf51fd81a5e";
-    hash = "sha256-fhQHxdbecDAcMylMU50FHPGWf6XgwBgPBaP4v3ntOmc=";
+    rev = "571412786696680e1e04909e90e77d9d39b10b2a";
+    hash = "sha256-7/5UsU5TSW++MROWuUTsAptkv7gcqhvcqaRHYzXswB8=";
   };
 
   checkPhase =

pkgs/by-name/fa/fanbox-dl/package.nix

···
 
 buildGoModule rec {
   pname = "fanbox-dl";
-  version = "0.27.1";
+  version = "0.27.2";
 
   src = fetchFromGitHub {
     owner = "hareku";
     repo = "fanbox-dl";
     rev = "v${version}";
-    hash = "sha256-2fxptsETjWyQxQv/VDx2A5UMZ3oLgC298YY/To3qaqk=";
+    hash = "sha256-qsuYsAXlMuNvGxtrisqqr2E9OgiXsYneBx+CnVOyU2g=";
   };
 
   vendorHash = "sha256-l/mgjCqRzidJ1QxH8bKGa7ZnRZVOqkuNifgEyFVU7fA=";

pkgs/by-name/gl/glaze/package.nix

···
 
 stdenv.mkDerivation (final: {
   pname = "glaze";
-  version = "4.0.2";
+  version = "4.2.2";
 
   src = fetchFromGitHub {
     owner = "stephenberry";
     repo = "glaze";
     rev = "v${final.version}";
-    hash = "sha256-fNarN2VFgfZDmY62EoLsiMdW60XPbi71wbiSe/ftaFc=";
+    hash = "sha256-P6hrwSpeQXHhag7HV28EVXsEwd2ZJEad3GRclCiOz8w=";
   };
 
   nativeBuildInputs = [ cmake ];

pkgs/by-name/ka/kanidm/1_3.nix

···
 import ./generic.nix {
   version = "1.3.3";
   hash = "sha256-W5G7osV4du6w/BfyY9YrDzorcLNizRsoz70RMfO2AbY=";
-  cargoHash = "sha256-gJrzOK6vPPBgsQFkKrbMql00XSfKGjgpZhYJLTURxoI=";
+  cargoHash = "sha256-iziTHr0gvv319Rzgkze9J1H4UzPR7WxMmCkiGVsb33k=";
+  patchDir = ./patches/1_3;
   extraMeta = {
     knownVulnerabilities = [
       ''

pkgs/by-name/ka/kanidm/1_4.nix

···
 import ./generic.nix {
   version = "1.4.5";
   hash = "sha256-0nn/ZyjkLXWXBZasNhbeEynEN52cmZQAcgg3hLmRpdo=";
-  cargoHash = "sha256-sLz1EdczSj0/ACLUpWex3i8ZUhNeyU/RVwuAqccLIz8=";
+  cargoHash = "sha256-9ZB9PwVnqoCRMFXOY7ejh76hmOg7cjVpnjgJfh8aXGI=";
+  patchDir = ./patches/1_4;
 }

pkgs/by-name/ka/kanidm/generic.nix

···
   version,
   hash,
   cargoHash,
+  patchDir,
   extraMeta ? { },
 }:
 
···
   arch = if stdenv.hostPlatform.isx86_64 then "x86_64" else "generic";
 in
 rustPlatform.buildRustPackage rec {
-  pname = "kanidm";
+  pname = "kanidm" + (lib.optionalString enableSecretProvisioning "-with-secret-provisioning");
   inherit version cargoHash;
+  cargoDepsName = "kanidm";
 
   src = fetchFromGitHub {
     owner = pname;
···
   KANIDM_BUILD_PROFILE = "release_nixos_${arch}";
 
   patches = lib.optionals enableSecretProvisioning [
-    ./patches/oauth2-basic-secret-modify.patch
-    ./patches/recover-account.patch
+    "${patchDir}/oauth2-basic-secret-modify.patch"
+    "${patchDir}/recover-account.patch"
   ];
 
   postPatch =

pkgs/by-name/ka/kanidm/patches/1_3/oauth2-basic-secret-modify.patch

···
+From 44dfbc2b9dccce86c7d7e7b54db4c989344b8c56 Mon Sep 17 00:00:00 2001
+From: oddlama <[e-mail]>
+Date: Mon, 12 Aug 2024 23:17:25 +0200
+Subject: [PATCH 1/2] oauth2 basic secret modify
+
+---
+ server/core/src/actors/v1_write.rs | 42 ++++++++++++++++++++++++++++++
+ server/core/src/https/v1.rs        |  6 ++++-
+ server/core/src/https/v1_oauth2.rs | 29 +++++++++++++++++++++
+ server/lib/src/constants/acp.rs    |  6 +++++
+ 4 files changed, 82 insertions(+), 1 deletion(-)
+
+diff --git a/server/core/src/actors/v1_write.rs b/server/core/src/actors/v1_write.rs
+index e00a969fb..1cacc67b8 100644
+--- a/server/core/src/actors/v1_write.rs
++++ b/server/core/src/actors/v1_write.rs
+@@ -315,20 +315,62 @@ impl QueryServerWriteV1 {
+         };
+ 
+         trace!(?del, "Begin delete event");
+ 
+         idms_prox_write
+             .qs_write
+             .delete(&del)
+             .and_then(|_| idms_prox_write.commit().map(|_| ()))
+     }
+ 
++    #[instrument(
++        level = "info",
++        skip_all,
++        fields(uuid = ?eventid)
++    )]
++    pub async fn handle_oauth2_basic_secret_write(
++        &self,
++        client_auth_info: ClientAuthInfo,
++        filter: Filter<FilterInvalid>,
++        new_secret: String,
++        eventid: Uuid,
++    ) -> Result<(), OperationError> {
++        // Given a protoEntry, turn this into a modification set.
++        let ct = duration_from_epoch_now();
++        let mut idms_prox_write = self.idms.proxy_write(ct).await;
++        let ident = idms_prox_write
++            .validate_client_auth_info_to_ident(client_auth_info, ct)
++            .map_err(|e| {
++                admin_error!(err = ?e, "Invalid identity");
++                e
++            })?;
++
++        let modlist = ModifyList::new_purge_and_set(
++            Attribute::OAuth2RsBasicSecret,
++            Value::SecretValue(new_secret),
++        );
++
++        let mdf =
++            ModifyEvent::from_internal_parts(ident, &modlist, &filter, &idms_prox_write.qs_write)
++                .map_err(|e| {
++                admin_error!(err = ?e, "Failed to begin modify during handle_oauth2_basic_secret_write");
++                e
++            })?;
++
++        trace!(?mdf, "Begin modify event");
++
++        idms_prox_write
++            .qs_write
++            .modify(&mdf)
++            .and_then(|_| idms_prox_write.commit())
++    }
++
+     #[instrument(
+         level = "info",
+         skip_all,
+         fields(uuid = ?eventid)
+     )]
+     pub async fn handle_reviverecycled(
+         &self,
+         client_auth_info: ClientAuthInfo,
+         filter: Filter<FilterInvalid>,
+         eventid: Uuid,
+diff --git a/server/core/src/https/v1.rs b/server/core/src/https/v1.rs
+index 8aba83bb2..f1f815026 100644
+--- a/server/core/src/https/v1.rs
++++ b/server/core/src/https/v1.rs
+@@ -1,17 +1,17 @@
+ //! The V1 API things!
+ 
+ use axum::extract::{Path, State};
+ use axum::http::{HeaderMap, HeaderValue};
+ use axum::middleware::from_fn;
+ use axum::response::{IntoResponse, Response};
+-use axum::routing::{delete, get, post, put};
++use axum::routing::{delete, get, post, put, patch};
+ use axum::{Extension, Json, Router};
+ use axum_extra::extract::cookie::{Cookie, CookieJar, SameSite};
+ use compact_jwt::{Jwk, Jws, JwsSigner};
+ use kanidm_proto::constants::uri::V1_AUTH_VALID;
+ use std::net::IpAddr;
+ use uuid::Uuid;
+ 
+ use kanidm_proto::internal::{
+     ApiToken, AppLink, CUIntentToken, CURequest, CUSessionToken, CUStatus, CreateRequest,
+     CredentialStatus, DeleteRequest, IdentifyUserRequest, IdentifyUserResponse, ModifyRequest,
+@@ -3119,20 +3119,24 @@ pub(crate) fn route_setup(state: ServerState) -> Router<ServerState> {
+         )
+         .route(
+             "/v1/oauth2/:rs_name/_image",
+             post(super::v1_oauth2::oauth2_id_image_post)
+                 .delete(super::v1_oauth2::oauth2_id_image_delete),
+         )
+         .route(
+             "/v1/oauth2/:rs_name/_basic_secret",
+             get(super::v1_oauth2::oauth2_id_get_basic_secret),
+         )
++        .route(
++            "/v1/oauth2/:rs_name/_basic_secret",
++            patch(super::v1_oauth2::oauth2_id_patch_basic_secret),
++        )
+         .route(
+             "/v1/oauth2/:rs_name/_scopemap/:group",
+             post(super::v1_oauth2::oauth2_id_scopemap_post)
+                 .delete(super::v1_oauth2::oauth2_id_scopemap_delete),
+         )
+         .route(
+             "/v1/oauth2/:rs_name/_sup_scopemap/:group",
+             post(super::v1_oauth2::oauth2_id_sup_scopemap_post)
+                 .delete(super::v1_oauth2::oauth2_id_sup_scopemap_delete),
+         )
+diff --git a/server/core/src/https/v1_oauth2.rs b/server/core/src/https/v1_oauth2.rs
+index 5e481afab..a771aed04 100644
+--- a/server/core/src/https/v1_oauth2.rs
++++ b/server/core/src/https/v1_oauth2.rs
+@@ -144,20 +144,49 @@ pub(crate) async fn oauth2_id_get_basic_secret(
+ ) -> Result<Json<Option<String>>, WebError> {
+     let filter = oauth2_id(&rs_name);
+     state
+         .qe_r_ref
+         .handle_oauth2_basic_secret_read(client_auth_info, filter, kopid.eventid)
+         .await
+         .map(Json::from)
+         .map_err(WebError::from)
+ }
+ 
++#[utoipa::path(
++    patch,
++    path = "/v1/oauth2/{rs_name}/_basic_secret",
++    request_body=ProtoEntry,
++    responses(
++        DefaultApiResponse,
++    ),
++    security(("token_jwt" = [])),
++    tag = "v1/oauth2",
++    operation_id = "oauth2_id_patch_basic_secret"
++)]
++/// Overwrite the basic secret for a given OAuth2 Resource Server.
++#[instrument(level = "info", skip(state, new_secret))]
++pub(crate) async fn oauth2_id_patch_basic_secret(
++    State(state): State<ServerState>,
++    Extension(kopid): Extension<KOpId>,
++    VerifiedClientInformation(client_auth_info): VerifiedClientInformation,
++    Path(rs_name): Path<String>,
++    Json(new_secret): Json<String>,
++) -> Result<Json<()>, WebError> {
++    let filter = oauth2_id(&rs_name);
++    state
++        .qe_w_ref
++        .handle_oauth2_basic_secret_write(client_auth_info, filter, new_secret, kopid.eventid)
++        .await
++        .map(Json::from)
++        .map_err(WebError::from)
++}
++
+ #[utoipa::path(
+     patch,
+     path = "/v1/oauth2/{rs_name}",
+     request_body=ProtoEntry,
+     responses(
+         DefaultApiResponse,
+     ),
+     security(("token_jwt" = [])),
+     tag = "v1/oauth2",
+     operation_id = "oauth2_id_patch"
+diff --git a/server/lib/src/constants/acp.rs b/server/lib/src/constants/acp.rs
+index f3409649d..42e407b7d 100644
+--- a/server/lib/src/constants/acp.rs
++++ b/server/lib/src/constants/acp.rs
+@@ -645,34 +645,36 @@ lazy_static! {
+             Attribute::Image,
+         ],
+         modify_present_attrs: vec![
+             Attribute::Description,
+             Attribute::DisplayName,
+             Attribute::OAuth2RsName,
+             Attribute::OAuth2RsOrigin,
+             Attribute::OAuth2RsOriginLanding,
+             Attribute::OAuth2RsSupScopeMap,
+             Attribute::OAuth2RsScopeMap,
++            Attribute::OAuth2RsBasicSecret,
+             Attribute::OAuth2AllowInsecureClientDisablePkce,
+             Attribute::OAuth2JwtLegacyCryptoEnable,
+             Attribute::OAuth2PreferShortUsername,
+             Attribute::Image,
+         ],
+         create_attrs: vec![
+             Attribute::Class,
+             Attribute::Description,
+             Attribute::DisplayName,
+             Attribute::OAuth2RsName,
+             Attribute::OAuth2RsOrigin,
+             Attribute::OAuth2RsOriginLanding,
+             Attribute::OAuth2RsSupScopeMap,
+             Attribute::OAuth2RsScopeMap,
++            Attribute::OAuth2RsBasicSecret,
+             Attribute::OAuth2AllowInsecureClientDisablePkce,
+             Attribute::OAuth2JwtLegacyCryptoEnable,
+             Attribute::OAuth2PreferShortUsername,
+             Attribute::Image,
+         ],
+         create_classes: vec![
+             EntryClass::Object,
+             EntryClass::OAuth2ResourceServer,
+             EntryClass::OAuth2ResourceServerBasic,
+             EntryClass::OAuth2ResourceServerPublic,
+@@ -739,36 +741,38 @@ lazy_static! {
+             Attribute::Image,
+         ],
+         modify_present_attrs: vec![
+             Attribute::Description,
+             Attribute::DisplayName,
+             Attribute::OAuth2RsName,
+             Attribute::OAuth2RsOrigin,
+             Attribute::OAuth2RsOriginLanding,
+             Attribute::OAuth2RsSupScopeMap,
+             Attribute::OAuth2RsScopeMap,
++            Attribute::OAuth2RsBasicSecret,
+             Attribute::OAuth2AllowInsecureClientDisablePkce,
+             Attribute::OAuth2JwtLegacyCryptoEnable,
+             Attribute::OAuth2PreferShortUsername,
+             Attribute::OAuth2AllowLocalhostRedirect,
+             Attribute::OAuth2RsClaimMap,
+             Attribute::Image,
+         ],
+         create_attrs: vec![
+             Attribute::Class,
+             Attribute::Description,
+             Attribute::DisplayName,
+             Attribute::OAuth2RsName,
+             Attribute::OAuth2RsOrigin,
+             Attribute::OAuth2RsOriginLanding,
+             Attribute::OAuth2RsSupScopeMap,
+             Attribute::OAuth2RsScopeMap,
++            Attribute::OAuth2RsBasicSecret,
+             Attribute::OAuth2AllowInsecureClientDisablePkce,
+             Attribute::OAuth2JwtLegacyCryptoEnable,
+             Attribute::OAuth2PreferShortUsername,
+             Attribute::OAuth2AllowLocalhostRedirect,
+             Attribute::OAuth2RsClaimMap,
+             Attribute::Image,
+         ],
+         create_classes: vec![
+             EntryClass::Object,
+             EntryClass::OAuth2ResourceServer,
+@@ -840,36 +844,38 @@ lazy_static! {
+             Attribute::Image,
+         ],
+         modify_present_attrs: vec![
+             Attribute::Description,
+             Attribute::DisplayName,
+             Attribute::Name,
+             Attribute::OAuth2RsOrigin,
+             Attribute::OAuth2RsOriginLanding,
+             Attribute::OAuth2RsSupScopeMap,
+             Attribute::OAuth2RsScopeMap,
++            Attribute::OAuth2RsBasicSecret,
+             Attribute::OAuth2AllowInsecureClientDisablePkce,
+             Attribute::OAuth2JwtLegacyCryptoEnable,
+             Attribute::OAuth2PreferShortUsername,
+             Attribute::OAuth2AllowLocalhostRedirect,
+             Attribute::OAuth2RsClaimMap,
+             Attribute::Image,
+         ],
+         create_attrs: vec![
+             Attribute::Class,
+             Attribute::Description,
+             Attribute::Name,
+             Attribute::OAuth2RsName,
+             Attribute::OAuth2RsOrigin,
+             Attribute::OAuth2RsOriginLanding,
+             Attribute::OAuth2RsSupScopeMap,
+             Attribute::OAuth2RsScopeMap,
++            Attribute::OAuth2RsBasicSecret,
+             Attribute::OAuth2AllowInsecureClientDisablePkce,
+             Attribute::OAuth2JwtLegacyCryptoEnable,
+             Attribute::OAuth2PreferShortUsername,
+             Attribute::OAuth2AllowLocalhostRedirect,
+             Attribute::OAuth2RsClaimMap,
+             Attribute::Image,
+         ],
+         create_classes: vec![
+             EntryClass::Object,
+             EntryClass::Account,
+-- 
+2.45.2
+

pkgs/by-name/ka/kanidm/patches/1_3/recover-account.patch

···
+From cc8269489b56755714f07eee4671f8aa2659c014 Mon Sep 17 00:00:00 2001
+From: oddlama <[e-mail]>
+Date: Mon, 12 Aug 2024 23:17:42 +0200
+Subject: [PATCH 2/2] recover account
+
+---
+ server/core/src/actors/internal.rs |  3 ++-
+ server/core/src/admin.rs           |  6 +++---
+ server/daemon/src/main.rs          | 14 +++++++++++++-
+ server/daemon/src/opt.rs           |  4 ++++
+ 4 files changed, 22 insertions(+), 5 deletions(-)
+
+diff --git a/server/core/src/actors/internal.rs b/server/core/src/actors/internal.rs
+index 40c18777f..40d553b40 100644
+--- a/server/core/src/actors/internal.rs
++++ b/server/core/src/actors/internal.rs
+@@ -153,25 +153,26 @@ impl QueryServerWriteV1 {
+     }
+ 
+     #[instrument(
+         level = "info",
+         skip(self, eventid),
+         fields(uuid = ?eventid)
+     )]
+     pub(crate) async fn handle_admin_recover_account(
+         &self,
+         name: String,
++        password: Option<String>,
+         eventid: Uuid,
+     ) -> Result<String, OperationError> {
+         let ct = duration_from_epoch_now();
+         let mut idms_prox_write = self.idms.proxy_write(ct).await;
+-        let pw = idms_prox_write.recover_account(name.as_str(), None)?;
++        let pw = idms_prox_write.recover_account(name.as_str(), password.as_deref())?;
+ 
+         idms_prox_write.commit().map(|()| pw)
+     }
+ 
+     #[instrument(
+         level = "info",
+         skip_all,
+         fields(uuid = ?eventid)
+     )]
+     pub(crate) async fn handle_domain_raise(&self, eventid: Uuid) -> Result<u32, OperationError> {
+diff --git a/server/core/src/admin.rs b/server/core/src/admin.rs
+index 90ccb1927..85e31ddef 100644
+--- a/server/core/src/admin.rs
++++ b/server/core/src/admin.rs
+@@ -17,21 +17,21 @@ use tokio_util::codec::{Decoder, Encoder, Framed};
+ use tracing::{span, Instrument, Level};
+ use uuid::Uuid;
+ 
+ pub use kanidm_proto::internal::{
+     DomainInfo as ProtoDomainInfo, DomainUpgradeCheckReport as ProtoDomainUpgradeCheckReport,
+     DomainUpgradeCheckStatus as ProtoDomainUpgradeCheckStatus,
+ };
+ 
+ #[derive(Serialize, Deserialize, Debug)]
+ pub enum AdminTaskRequest {
+-    RecoverAccount { name: String },
++    RecoverAccount { name: String, password: Option<String> },
+     ShowReplicationCertificate,
+     RenewReplicationCertificate,
+     RefreshReplicationConsumer,
+     DomainShow,
+     DomainUpgradeCheck,
+     DomainRaise,
+     DomainRemigrate { level: Option<u32> },
+ }
+ 
+ #[derive(Serialize, Deserialize, Debug)]
+@@ -302,22 +302,22 @@ async fn handle_client(
+     let mut reqs = Framed::new(sock, ServerCodec);
+ 
+     trace!("Waiting for requests ...");
+     while let Some(Ok(req)) = reqs.next().await {
+         // Setup the logging span
+         let eventid = Uuid::new_v4();
+         let nspan = span!(Level::INFO, "handle_admin_client_request", uuid = ?eventid);
+ 
+         let resp = async {
+             match req {
+-                AdminTaskRequest::RecoverAccount { name } => {
+-                    match server_rw.handle_admin_recover_account(name, eventid).await {
++                AdminTaskRequest::RecoverAccount { name, password } => {
++                    match server_rw.handle_admin_recover_account(name, password, eventid).await {
+                         Ok(password) => AdminTaskResponse::RecoverAccount { password },
+                         Err(e) => {
+                             error!(err = ?e, "error during recover-account");
+                             AdminTaskResponse::Error
+                         }
+                     }
+                 }
+                 AdminTaskRequest::ShowReplicationCertificate => match repl_ctrl_tx.as_mut() {
+                     Some(ctrl_tx) => show_replication_certificate(ctrl_tx).await,
+                     None => {
+diff --git a/server/daemon/src/main.rs b/server/daemon/src/main.rs
+index 577995615..a967928c9 100644
+--- a/server/daemon/src/main.rs
++++ b/server/daemon/src/main.rs
+@@ -894,27 +894,39 @@ async fn kanidm_main(
+             } else {
+                 let output_mode: ConsoleOutputMode = commonopts.output_mode.to_owned().into();
+                 submit_admin_req(
+                     config.adminbindpath.as_str(),
+                     AdminTaskRequest::RefreshReplicationConsumer,
+                     output_mode,
+                 )
+                 .await;
+             }
+         }
+-        KanidmdOpt::RecoverAccount { name, commonopts } => {
++        KanidmdOpt::RecoverAccount { name, from_environment, commonopts } => {
+             info!("Running account recovery ...");
+             let output_mode: ConsoleOutputMode = commonopts.output_mode.to_owned().into();
++            let password = if *from_environment {
++                match std::env::var("KANIDM_RECOVER_ACCOUNT_PASSWORD") {
++                    Ok(val) => Some(val),
++                    _ => {
++                        error!("Environment variable KANIDM_RECOVER_ACCOUNT_PASSWORD not set");
++                        return ExitCode::FAILURE;
++                    }
++                }
++            } else {
++                None
++            };
+             submit_admin_req(
+                 config.adminbindpath.as_str(),
+                 AdminTaskRequest::RecoverAccount {
+                     name: name.to_owned(),
++                    password,
+                 },
+                 output_mode,
+             )
+             .await;
+         }
+         KanidmdOpt::Database {
+             commands: DbCommands::Reindex(_copt),
+         } => {
+             info!("Running in reindex mode ...");
+             reindex_server_core(&config).await;
+diff --git a/server/daemon/src/opt.rs b/server/daemon/src/opt.rs
+index f1b45a5b3..9c013e32e 100644
+--- a/server/daemon/src/opt.rs
++++ b/server/daemon/src/opt.rs
+@@ -229,20 +229,24 @@ enum KanidmdOpt {
+     /// Create a self-signed ca and tls certificate in the locations listed from the
+     /// configuration. These certificates should *not* be used in production, they
+     /// are for testing and evaluation only!
+     CertGenerate(CommonOpt),
+     #[clap(name = "recover-account")]
+     /// Recover an account's password
+     RecoverAccount {
+         #[clap(value_parser)]
+         /// The account name to recover credentials for.
+         name: String,
++        /// Use the password given in the environment variable
++        /// `KANIDM_RECOVER_ACCOUNT_PASSWORD` instead of generating one.
++        #[clap(long = "from-environment")]
++        from_environment: bool,
+         #[clap(flatten)]
+         commonopts: CommonOpt,
+     },
+     /// Display this server's replication certificate
+     ShowReplicationCertificate {
+         #[clap(flatten)]
+         commonopts: CommonOpt,
+     },
+     /// Renew this server's replication certificate
+     RenewReplicationCertificate {
+-- 
+2.45.2
+

pkgs/by-name/li/libmpd/package.nix

···
     cp -r doc/html $devdoc/share/devhelp/libmpd/doxygen
   '';
 
+  # Fix GCC 14 build
+  # https://hydra.nixos.org/build/281958201/nixlog/3
+  env.NIX_CFLAGS_COMPILE = "-Wno-error=int-conversion";
+
   meta = with lib; {
     description = "Higher level access to MPD functions";
     homepage = "https://www.musicpd.org/download/libmpd/";

pkgs/by-name/lv/lv/package.nix

···
 {
   lib,
   stdenv,
-  fetchurl,
+  fetchFromGitHub,
   ncurses,
+  unstableGitUpdater,
+  autoreconfHook,
 }:
 
 stdenv.mkDerivation rec {
   pname = "lv";
-  version = "4.51";
+  version = "4.51-unstable-2020-08-03";
 
-  src = fetchurl {
-    url = "mirror://debian/pool/main/l/${pname}/${pname}_${version}.orig.tar.gz";
-    sha256 = "0yf3idz1qspyff1if41xjpqqcaqa8q8icslqlnz0p9dj36gmm5l3";
+  src = fetchFromGitHub {
+    owner = "ttdoda";
+    repo = "lv";
+    rev = "1fb214d4136334a1f6cd932b99f85c74609e1f23";
+    hash = "sha256-mUFiWzTTM6nAKQgXA0sYIUm1MwN7HBHD8LWBgzu3ZUk=";
   };
 
   makeFlags = [ "prefix=${placeholder "out"}" ];
 
+  nativeBuildInputs = [ autoreconfHook ];
   buildInputs = [ ncurses ];
+
+  preAutoreconf = "cd src";
+  postAutoreconf = "cd ..";
 
   configurePhase = ''
     mkdir -p build
···
     mkdir -p $out/bin
   '';
 
+  passthru.updateScript = unstableGitUpdater {
+    tagPrefix = "v";
+  };
+
   meta = with lib; {
     description = "Powerful multi-lingual file viewer / grep";
-    homepage = "https://web.archive.org/web/20160310122517/www.ff.iij4u.or.jp/~nrt/lv/";
+    homepage = "https://github.com/ttdoda/lv";
     license = licenses.gpl2Plus;
     platforms = with platforms; linux ++ darwin;
     maintainers = with maintainers; [ kayhide ];

pkgs/by-name/me/mesa-demos/package.nix

···
   libGLU,
   libX11,
   libXext,
+  libgbm,
   mesa,
   meson,
   ninja,
···
     libXext
     libGL
     libGLU
-    mesa
+    libgbm
     wayland
     wayland-protocols
     vulkan-loader

pkgs/by-name/mi/microsoft-gsl/package.nix

···
   ];
   buildInputs = [ gtest ];
 
-  # error: unsafe buffer access
-  env.NIX_CFLAGS_COMPILE = lib.optionalString stdenv.cc.isClang "-Wno-unsafe-buffer-usage";
+  # negate the `-Werror` flag as Microsoft doesn't build with clang
+  env.NIX_CFLAGS_COMPILE = lib.optionalString stdenv.cc.isClang "-Wno-error";
 
   patches = [
     # nvcc doesn't recognize the "gsl" attribute namespace (microsoft/onnxruntime#13573)

pkgs/by-name/mi/mint-l-icons/package.nix

···
 
 stdenvNoCC.mkDerivation rec {
   pname = "mint-l-icons";
-  version = "1.7.3";
+  version = "1.7.4";
 
   src = fetchFromGitHub {
     owner = "linuxmint";
     repo = pname;
     # They don't really do tags, this is just a named commit.
-    rev = "f1900facf915715623ef0ca2874ae4dd04039e81";
-    hash = "sha256-UpVuhzZdw0Ri6X20N/yGFMmwEymMvLr78DwYaHD+CNY=";
+    rev = "b442277c822c92f7bb68282cb82c7d1a98e3fd37";
+    hash = "sha256-vPDEribE/CZwoAK1C9fjbWQEO/NWMWCKCUO/Xw/SxZ0=";
   };
 
   propagatedBuildInputs = [

pkgs/by-name/mi/mint-themes/package.nix

···
 
 stdenvNoCC.mkDerivation rec {
   pname = "mint-themes";
-  version = "2.2.1";
+  version = "2.2.2";
 
   src = fetchFromGitHub {
     owner = "linuxmint";
     repo = pname;
     rev = version;
-    hash = "sha256-vKIAIaMW1iY85/IeoYeXT1Po+3o+Q6D6RcoA0kpjJoI=";
+    hash = "sha256-97H2gVSZh0azl2ui4iWsNqgKzkBXRo6Daza2XtRdqII=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/mu/muffin/package.nix

···
   libXdamage,
   libxkbcommon,
   libXtst,
-  libgbm,
+  mesa,
   meson,
   ninja,
   pipewire,
···
 
   nativeBuildInputs = [
     desktop-file-utils
-    libgbm
     meson
     ninja
     pkg-config
···
     json-glib
     libXtst
     graphene
+    mesa # actually uses eglmesaext
   ];
 
   mesonFlags = [

pkgs/by-name/op/openmpi/package.nix

···
       zlib
       libevent
       hwloc
+      prrte
     ]
     ++ lib.optionals stdenv.hostPlatform.isLinux [
       libnl
···
       pmix
       ucx
       ucc
-      prrte
     ]
     ++ lib.optionals cudaSupport [ cudaPackages.cuda_cudart ]
     ++ lib.optionals (stdenv.hostPlatform.isLinux || stdenv.hostPlatform.isFreeBSD) [ rdma-core ]
···
     "--with-pmix=${lib.getDev pmix}"
     "--with-pmix-libdir=${lib.getLib pmix}/lib"
     # Puts a "default OMPI_PRTERUN" value to mpirun / mpiexec executables
-    (lib.withFeatureAs stdenv.hostPlatform.isLinux "prrte" (lib.getBin prrte))
+    (lib.withFeatureAs true "prrte" (lib.getBin prrte))
     (lib.withFeature enableSGE "sge")
     (lib.enableFeature enablePrefix "mpirun-prefix-by-default")
     # TODO: add UCX support, which is recommended to use with cuda for the most robust OpenMPI build

pkgs/by-name/pr/prrte/package.nix

···
     homepage = "https://docs.prrte.org/";
     license = lib.licenses.bsd3;
     maintainers = with lib.maintainers; [ markuskowa ];
-    platforms = lib.platforms.linux;
+    platforms = lib.platforms.unix;
   };
 }

pkgs/by-name/ro/rocksdb/package.nix

···
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "rocksdb";
-  version = "9.7.4";
+  version = "9.8.4";
 
   src = fetchFromGitHub {
     owner = "facebook";
     repo = "rocksdb";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-u5uuShM2SxHc9/zL4UU56IhCcR/ZQbzde0LgOYS44bM=";
+    hash = "sha256-A6Gx4FqoGlxITUUz9k6tkDjUcLtMUBK9JS8vuAS96H0=";
   };
 
   patches = lib.optional (

pkgs/by-name/si/signal-desktop/signal-desktop-aarch64.nix

···
 callPackage ./generic.nix { } rec {
   pname = "signal-desktop";
   dir = "Signal";
-  version = "7.34.0";
+  version = "7.36.0";
   url = "https://github.com/0mniteck/Signal-Desktop-Mobian/raw/${version}/builds/release/signal-desktop_${version}_arm64.deb";
-  hash = "sha256-feNjNhKGIJsV6LH2mKAXd7TEnmvcKXheXmqJZEBqXvE=";
+  hash = "sha256-nmAqFDw35pdZg5tiq9MUlqXnbRLRkSOX9SWhccnE2Xw=";
 }

pkgs/by-name/si/signal-desktop/signal-desktop-darwin.nix

···
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "signal-desktop";
-  version = "7.35.0";
+  version = "7.36.0";
 
   src = fetchurl {
     url = "https://updates.signal.org/desktop/signal-desktop-mac-universal-${finalAttrs.version}.dmg";
-    hash = "sha256-+ZzZp3/koitwtHyUmcgltcYo91KfDfQzOjnOzTJJu6c=";
+    hash = "sha256-hHgobx4q+nWtsq6uplVWY5ie0qu5ZoeFxYZNflza/CM=";
   };
   sourceRoot = ".";
 

pkgs/by-name/si/signal-desktop/signal-desktop.nix

···
 callPackage ./generic.nix { } rec {
   pname = "signal-desktop";
   dir = "Signal";
-  version = "7.35.0";
+  version = "7.36.0";
   url = "https://updates.signal.org/desktop/apt/pool/s/signal-desktop/signal-desktop_${version}_amd64.deb";
-  hash = "sha256-cQ7bwgRjlI2idnHtl7EZyBfjcPz52s8+E7UpLxn4FEg=";
+  hash = "sha256-5p9Vnxj53jOZbEirWamwv4Fkm/fMLeLfV93GDrV8XuA=";
 }

pkgs/by-name/si/simple-live-app/package.nix

···
   libpulseaudio,
   libcaca,
   libdrm,
-  mesa,
+  libgbm,
   libXScrnSaver,
   nv-codec-headers-11,
   libXpresent,
···
     libpulseaudio
     libcaca
     libdrm
-    mesa
+    libgbm
     libXScrnSaver
     libXpresent
     nv-codec-headers-11

pkgs/by-name/sy/syft/package.nix

···
 
 buildGoModule rec {
   pname = "syft";
-  version = "1.18.0";
+  version = "1.18.1";
 
   src = fetchFromGitHub {
     owner = "anchore";
     repo = "syft";
     rev = "refs/tags/v${version}";
-    hash = "sha256-cxBZs4H557Sc1k3jftbxjv1DcPM9GZb/2QGtuuA/D2I=";
+    hash = "sha256-ot4qdCxF9Kg657IFzUIxGsmRCDag1a4Ipq1qj2RPW0E=";
     # populate values that require us to use git. By doing this in postFetch we
     # can delete .git afterwards and maintain better reproducibility of the src.
     leaveDotGit = true;
···
   # hash mismatch with darwin
   proxyVendor = true;
 
-  vendorHash = "sha256-hilxZidIIwrqd6motWDlicCPepU4gyZvqk/Fzry98UE=";
+  vendorHash = "sha256-3GvOWu+h1d5qUxUd7yxE/YReeuXteVV/4ZrnMgGRZi0=";
 
   nativeBuildInputs = [ installShellFiles ];
 

pkgs/by-name/ti/tiledb/package.nix

···
     ./FindMagic_EP.cmake.patch
   ];
 
-  postPatch = ''
-    # copy pre-fetched external project to directory where it is expected to be
-    mkdir -p build/externals/src
-    cp -a ${ep-file-windows} build/externals/src/ep_magic
-    chmod -R u+w build/externals/src/ep_magic
+  postPatch =
+    ''
+      # copy pre-fetched external project to directory where it is expected to be
+      mkdir -p build/externals/src
+      cp -a ${ep-file-windows} build/externals/src/ep_magic
+      chmod -R u+w build/externals/src/ep_magic
 
-    # add openssl on path
-    sed -i '49i list(APPEND OPENSSL_PATHS "${openssl.dev}" "${openssl.out}")' \
-      cmake/Modules/FindOpenSSL_EP.cmake
-  '';
+      # add openssl on path
+      sed -i '49i list(APPEND OPENSSL_PATHS "${openssl.dev}" "${openssl.out}")' \
+        cmake/Modules/FindOpenSSL_EP.cmake
+    ''
+    # libcxx (as of llvm-19) does not yet support `stop_token` and `jthread`
+    # without the -fexperimental-library flag. Tiledb adds its own
+    # implementations in the std namespace which conflict with libcxx. This
+    # test can be re-enabled once libcxx supports stop_token and jthread.
+    + lib.optionalString (stdenv.cc.libcxx != null) ''
+      truncate -s0 tiledb/stdx/test/CMakeLists.txt
+    '';
 
   # upstream will hopefully fix this in some newer release
   env.CXXFLAGS = "-include random";

pkgs/by-name/xp/xplayer/package.nix

···
     patchPythonScript $out/lib/xplayer/plugins/dbus/dbusservice.py
   '';
 
+  env = lib.optionalAttrs stdenv.cc.isGNU {
+    NIX_CFLAGS_COMPILE = toString [
+      "-Wno-error=incompatible-pointer-types"
+      "-Wno-error=return-mismatch"
+    ];
+  };
+
   meta = with lib; {
     description = "Generic media player from Linux Mint";
     license = with licenses; [

pkgs/by-name/ze/zenoh/package.nix

···
     "zenoh-ext-examples"
   ];
 
-  checkFlags = [
-    # thread 'test_liveliness_query_clique' panicked at zenoh/tests/liveliness.rs:103:43:
-    # called `Result::unwrap()` on an `Err` value: Can not create a new TCP listener bound to tcp/localhost:47448...
-    "--skip test_liveliness_query_clique"
-    # thread 'test_liveliness_subscriber_double_client_history_middle' panicked at zenoh/tests/liveliness.rs:845:43:
-    # called `Result::unwrap()` on an `Err` value: Can not create a new TCP listener bound to tcp/localhost:47456...
-    "--skip test_liveliness_subscriber_double_client_history_middle"
-    # thread 'zenoh_matching_status_remote' panicked at zenoh/tests/matching.rs:155:5:
-    # assertion failed: received_status.ok().flatten().map(|s|
-    #             s.matching_subscribers()).eq(&Some(true))
-    "--skip zenoh_matching_status_remote"
-    # thread 'qos_pubsub' panicked at zenoh/tests/qos.rs:50:18:
-    # called `Result::unwrap()` on an `Err` value: Elapsed(())
-    "--skip qos_pubsub"
-    # never ending tests
-    "--skip router_linkstate"
-    "--skip three_node_combination"
-    "--skip three_node_combination_multicast"
-    # Error: Timeout at zenoh/tests/routing.rs:453.
-    "--skip gossip"
-    # thread 'zenoh_session_multicast' panicked at zenoh/tests/session.rs:85:49:
-    # called `Result::unwrap()` on an `Err` value: Can not create a new UDP link bound to udp/224.0.0.1:17448...
-    "--skip zenoh_session_multicast"
-    # thread 'tests::transport_multicast_compression_udp_only' panicked at io/zenoh-transport/tests/multicast_compression.rs:170:86:
-    # called `Result::unwrap()` on an `Err` value: Can not create a new UDP link bound to udp/224.24.220.245:21000...
-    "--skip tests::transport_multicast_compression_udp_only"
-    # thread 'tests::transport_multicast_udp_only' panicked at io/zenoh-transport/tests/multicast_transport.rs:167:86:
-    # called `Result::unwrap()` on an `Err` value: Can not create a new UDP link bound to udp/224.52.216.110:20000...
-    "--skip tests::transport_multicast_udp_only"
-    # thread 'openclose_tcp_only_connect_with_interface_restriction' panicked at io/zenoh-transport/tests/unicast_openclose.rs:764:63:
-    # index out of bounds: the len is 0 but the index is 0
-    "--skip openclose_tcp_only_connect_with_interface_restriction"
-    # thread 'openclose_udp_only_listen_with_interface_restriction' panicked at io/zenoh-transport/tests/unicast_openclose.rs:820:72:
-    # index out of bounds: the len is 0 but the index is 0
-    "--skip openclose_tcp_only_listen_with_interface_restriction"
-    # thread 'openclose_tcp_only_listen_with_interface_restriction' panicked at io/zenoh-transport/tests/unicast_openclose.rs:783:72:
-    # index out of bounds: the len is 0 but the index is 0
-    "--skip openclose_udp_only_connect_with_interface_restriction"
-    # thread 'openclose_udp_only_connect_with_interface_restriction' panicked at io/zenoh-transport/tests/unicast_openclose.rs:802:63:
-    # index out of bounds: the len is 0 but the index is 0
-    "--skip openclose_udp_only_listen_with_interface_restriction"
-
-    # These tests require a network interface and fail in the sandbox
-    "--skip openclose_quic_only_listen_with_interface_restriction"
-    "--skip openclose_quic_only_connect_with_interface_restriction"
-    "--skip openclose_tls_only_connect_with_interface_restriction"
-    "--skip openclose_tls_only_listen_with_interface_restriction"
-
-    # This test fails on Hydra
-    "--skip authenticator_quic"
-  ];
+  doCheck = false;
 
   passthru.tests.version = testers.testVersion {
     package = zenoh;

pkgs/desktops/xfce/applications/xfce4-screensaver/default.nix

···
   python3,
   systemd,
   xfconf,
+  xfdesktop,
   lib,
 }:
 
···
 mkXfceDerivation {
   category = "apps";
   pname = "xfce4-screensaver";
-  version = "4.18.3";
+  version = "4.18.4";
 
-  sha256 = "sha256-hOhWJoiKoeRgkhXaR8rnDpcJpStMD4BBdll4nwSA+EQ=";
+  sha256 = "sha256-vkxkryi7JQg1L/JdWnO9qmW6Zx6xP5Urq4kXMe7Iiyc=";
 
   nativeBuildInputs = [
     gobject-introspection
···
   configureFlags = [ "--without-console-kit" ];
 
   makeFlags = [ "DBUS_SESSION_SERVICE_DIR=$(out)/etc" ];
+
+  preFixup = ''
+    # For default wallpaper.
+    gappsWrapperArgs+=(--prefix XDG_DATA_DIRS : "${xfdesktop}/share")
+  '';
 
   meta = with lib; {
     description = "Screensaver for Xfce";

pkgs/development/libraries/clutter-gst/default.nix

···
   gnome,
   gdk-pixbuf,
   gobject-introspection,
+  gst_all_1,
 }:
 
 stdenv.mkDerivation rec {
···
     glib
     cogl
     gdk-pixbuf
+    gst_all_1.gstreamer
+    gst_all_1.gst-plugins-base
   ];
 
   postBuild = "rm -rf $out/share/gtk-doc";

pkgs/development/python-modules/hahomematic/default.nix

···
 
 buildPythonPackage rec {
   pname = "hahomematic";
-  version = "2024.12.0";
+  version = "2024.12.5";
   pyproject = true;
 
   disabled = pythonOlder "3.12";
···
     owner = "danielperna84";
     repo = "hahomematic";
     rev = "refs/tags/${version}";
-    hash = "sha256-RLgJiapsRM8dMA4+T2S6DkSFjo+YBmVVpo1mOVKJ7EI=";
+    hash = "sha256-jC9IXkl80pspqc9m0U6mspp5QSGG6u9Y6ANMK8WAG5s=";
   };
 
   __darwinAllowLocalNetworking = true;

pkgs/development/python-modules/mlx/default.nix

···
 in
 buildPythonPackage rec {
   pname = "mlx";
-  version = "0.18.0";
+  version = "0.21.1";
 
   src = fetchFromGitHub {
     owner = "ml-explore";
     repo = "mlx";
     rev = "refs/tags/v${version}";
-    hash = "sha256-eFKjCrutqrmhZKzRrLq5nYl0ieqLvoXpbnTxA1NEhWo=";
+    hash = "sha256-wxv9bA9e8VyFv/FMh63sUTTNgkXHGQJNQhLuVynczZA=";
   };
 
   pyproject = true;
···
     changelog = "https://github.com/ml-explore/mlx/releases/tag/v${version}";
     license = licenses.mit;
     platforms = [ "aarch64-darwin" ];
-    maintainers = with maintainers; [ viraptor ];
+    maintainers = with maintainers; [
+      viraptor
+      Gabriella439
+    ];
   };
 }

pkgs/development/python-modules/nanobind/default.nix

···
 }:
 buildPythonPackage rec {
   pname = "nanobind";
-  version = "2.2.0";
+  version = "2.4.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "wjakob";
     repo = "nanobind";
-    rev = "refs/tags/v${version}";
-    hash = "sha256-HtZfpMVz/7VMVrFg48IkitK6P3tA+swOeaLLiKguXXk=";
+    tag = "v${version}";
+    hash = "sha256-9OpDsjFEeJGtbti4Q9HHl78XaGf8M3lG4ukvHCMzyMU=";
     fetchSubmodules = true;
   };
 
···
 
   meta = {
     homepage = "https://github.com/wjakob/nanobind";
-    changelog = "https://github.com/wjakob/nanobind/blob/${src.rev}/docs/changelog.rst";
+    changelog = "https://github.com/wjakob/nanobind/blob/${src.tag}/docs/changelog.rst";
     description = "Tiny and efficient C++/Python bindings";
     longDescription = ''
       nanobind is a small binding library that exposes C++ types in Python and

pkgs/servers/home-assistant/custom-components/homematicip_local/package.nix

···
 buildHomeAssistantComponent rec {
   owner = "danielperna84";
   domain = "homematicip_local";
-  version = "1.73.0";
+  version = "1.75.0";
 
   src = fetchFromGitHub {
     owner = "danielperna84";
     repo = "custom_homematic";
     rev = "refs/tags/${version}";
-    hash = "sha256-1ssmaX6G03i9KYgjCRMZqOG2apEZ0069fQnmVy2BVhA=";
+    hash = "sha256-H5Gf09C9/s2JYVTjgiYNe28mV18mqTiJ0ZDR6rnuojo=";
   };
 
   postPatch = ''

pkgs/servers/web-apps/freshrss/default.nix

···
 
 stdenvNoCC.mkDerivation rec {
   pname = "FreshRSS";
-  version = "1.24.3";
+  version = "1.25.0";
 
   src = fetchFromGitHub {
     owner = "FreshRSS";
     repo = "FreshRSS";
     rev = version;
-    hash = "sha256-JgniYjw+Fk5EaXrXVjelBYBP1JOZarAF07iToiwnkdY=";
+    hash = "sha256-jBIU8xxXsl/67sebo8MS59Q0dWBTe0tO+xpVf1/uo0c=";
   };
 
   postPatch = ''

pkgs/servers/x11/xorg/generate-expr-from-tarballs.pl

···
 $pcMap{"libudev"} = "udev";
 $pcMap{"gl"} = "libGL";
 $pcMap{"GL"} = "libGL";
-$pcMap{"gbm"} = "mesa";
+$pcMap{"gbm"} = "libgbm";
 $pcMap{"hwdata"} = "hwdata";
 $pcMap{"\$PIXMAN"} = "pixman";
 $pcMap{"\$RENDERPROTO"} = "xorgproto";