Merge master into staging-next

.github/labeler-no-sync.yml

···
 # This file is used by .github/workflows/labels.yml
 # This version uses `sync-labels: false`, meaning that a non-match will NOT remove the label
 
+# keep-sorted start case=no numeric=yes newline_separated=yes skip_lines=1
+
+"6.topic: policy discussion":
+  - any:
+    - changed-files:
+      - any-glob-to-any-file:
+        - .github/**/*
+        - CONTRIBUTING.md
+        - pkgs/README.md
+        - nixos/README.md
+        - maintainers/README.md
+        - lib/README.md
+        - doc/README.md
+
+"8.has: documentation":
+  - any:
+    - changed-files:
+      - any-glob-to-any-file:
+        - doc/**/*
+        - nixos/doc/**/*
+
 "backport release-24.11":
   - any:
     - changed-files:
···
         - pkgs/kde/gear/falkon/**/*
         - pkgs/kde/gear/konqueror/**/*
 
-"6.topic: policy discussion":
-  - any:
-    - changed-files:
-      - any-glob-to-any-file:
-        - .github/**/*
-        - CONTRIBUTING.md
-        - pkgs/README.md
-        - nixos/README.md
-        - maintainers/README.md
-        - lib/README.md
-        - doc/README.md
-
-"8.has: documentation":
-  - any:
-    - changed-files:
-      - any-glob-to-any-file:
-        - doc/**/*
-        - nixos/doc/**/*
+# keep-sorted end

.github/labeler.yml

···
 # This file is used by .github/workflows/labels.yml
 # This version uses `sync-labels: true`, meaning that a non-match will remove the label
 
+# keep-sorted start case=no numeric=yes newline_separated=yes skip_lines=1
+
 # NOTE: bsd, darwin and cross-compilation labels are handled by ofborg
 "6.topic: agda":
   - any:
···
       - any-glob-to-any-file:
         - pkgs/os-specific/linux/musl/**/*
 
+"6.topic: nim":
+  - any:
+    - changed-files:
+      - any-glob-to-any-file:
+        - doc/languages-frameworks/nim.section.md
+        - pkgs/build-support/build-nim-package.nix
+        - pkgs/build-support/build-nim-sbom.nix
+        - pkgs/by-name/ni/nim*
+        - pkgs/top-level/nim-overrides.nix
+
 "6.topic: nixos":
   - any:
     - changed-files:
···
       - any-glob-to-any-file:
         - nixos/modules/virtualisation/nixos-containers.nix
         - pkgs/tools/virtualization/nixos-container/**/*
-
-"6.topic: nim":
-  - any:
-    - changed-files:
-      - any-glob-to-any-file:
-        - doc/languages-frameworks/nim.section.md
-        - pkgs/build-support/build-nim-package.nix
-        - pkgs/build-support/build-nim-sbom.nix
-        - pkgs/by-name/ni/nim*
-        - pkgs/top-level/nim-overrides.nix
 
 "6.topic: nodejs":
   - any:
···
       - any-glob-to-any-file:
           - maintainers/team-list.nix
 
-"6.topic: TeX":
-  - any:
-    - changed-files:
-      - any-glob-to-any-file:
-        - doc/languages-frameworks/texlive.section.md
-        - pkgs/test/texlive/**
-        - pkgs/tools/typesetting/tex/**/*
-
 "6.topic: testing":
   - any:
     - changed-files:
···
         - nixos/lib/testing-python.nix      # legacy
         - nixos/tests/make-test-python.nix  # legacy
         # lib/debug.nix has a test framework (runTests) but it's not the main focus
+
+"6.topic: TeX":
+  - any:
+    - changed-files:
+      - any-glob-to-any-file:
+        - doc/languages-frameworks/texlive.section.md
+        - pkgs/test/texlive/**
+        - pkgs/tools/typesetting/tex/**/*
 
 "6.topic: updaters":
   - any:
···
       - any-glob-to-any-file:
         - nixos/doc/manual/release-notes/**/*
 
-"8.has: module (update)":
+"8.has: maintainer-list (update)":
   - any:
     - changed-files:
       - any-glob-to-any-file:
-        - nixos/modules/**/*
-"8.has: maintainer-list (update)":
+        - maintainers/maintainer-list.nix
+
+"8.has: module (update)":
   - any:
     - changed-files:
       - any-glob-to-any-file:
-        - maintainers/maintainer-list.nix
+        - nixos/modules/**/*
+
+# keep-sorted end

nixos/modules/config/i18n.nix

···
 }:
 let
   aggregatedLocales =
-    builtins.map
+    (builtins.map
       (l: (lib.replaceStrings [ "utf8" "utf-8" "UTF8" ] [ "UTF-8" "UTF-8" "UTF-8" ] l) + "/UTF-8")
       (
         [ config.i18n.defaultLocale ]
-        ++ config.i18n.extraLocales
+        ++ (lib.optionals (builtins.isList config.i18n.extraLocales) config.i18n.extraLocales)
         ++ (lib.attrValues (lib.filterAttrs (n: v: n != "LANGUAGE") config.i18n.extraLocaleSettings))
-      );
+      )
+    )
+    ++ (lib.optional (builtins.isString config.i18n.extraLocales) config.i18n.extraLocales);
 in
 {
   ###### interface
···
       };
 
       extraLocales = lib.mkOption {
-        type = lib.types.listOf lib.types.str;
+        type = lib.types.either (lib.types.listOf lib.types.str) (lib.types.enum [ "all" ]);
         default = [ ];
         example = [ "nl_NL.UTF-8" ];
         description = ''
           Additional locales that the system should support, besides the ones
           configured with {option}`i18n.defaultLocale` and
           {option}`i18n.extraLocaleSettings`.
+          Set this to `"all"` to install all available locales.
         '';
       };
 
···
 
   config = {
     warnings =
-      lib.optional ((lib.subtractLists config.i18n.supportedLocales aggregatedLocales) != [ ])
+      lib.optional
+        (
+          !(
+            (lib.subtractLists config.i18n.supportedLocales aggregatedLocales) == [ ]
+            || lib.any (x: x == "all") config.i18n.supportedLocales
+          )
+        )
         ''
           `i18n.supportedLocales` is deprecated in favor of `i18n.extraLocales`,
           and it seems you are using `i18n.supportedLocales` and forgot to

nixos/modules/i18n/input-method/default.nix

···
           The input method method package.
         '';
       };
+
+      enableGtk2 = lib.mkEnableOption "Gtk2 support";
+
+      enableGtk3 = lib.mkEnableOption "Gtk3 support" // {
+        default = true;
+      };
     };
   };
 
···
     warnings =
       lib.optional (cfg.enabled != null)
         "i18n.inputMethod.enabled will be removed in a future release. Please use .type, and .enable = true instead";
-    environment.systemPackages = [
-      cfg.package
-      gtk2_cache
-      gtk3_cache
-    ];
+    environment.systemPackages =
+      [
+        cfg.package
+      ]
+      ++ lib.optional cfg.enableGtk2 gtk2_cache
+      ++ lib.optional cfg.enableGtk3 gtk3_cache;
   };
 
   meta = {

nixos/modules/module-list.nix

···
 [
+  # keep-sorted start case=no numeric=yes
   ./config/appstream.nix
   ./config/console.nix
   ./config/debug-info.nix
···
   ./config/malloc.nix
   ./config/mysql.nix
   ./config/networking.nix
-  ./config/nix.nix
   ./config/nix-channel.nix
   ./config/nix-flakes.nix
   ./config/nix-remote-build.nix
+  ./config/nix.nix
   ./config/nsswitch.nix
   ./config/power-management.nix
   ./config/qt.nix
···
   ./hardware/coral.nix
   ./hardware/corectrl.nix
   ./hardware/cpu/amd-microcode.nix
-  ./hardware/cpu/amd-sev.nix
   ./hardware/cpu/amd-ryzen-smu.nix
+  ./hardware/cpu/amd-sev.nix
   ./hardware/cpu/intel-microcode.nix
   ./hardware/cpu/intel-sgx.nix
   ./hardware/cpu/x86-msr.nix
···
   ./hardware/video/webcam/ipu6.nix
   ./hardware/wooting.nix
   ./hardware/xone.nix
-  ./hardware/xpadneo.nix
   ./hardware/xpad-noone.nix
+  ./hardware/xpadneo.nix
   ./i18n/input-method/default.nix
   ./i18n/input-method/fcitx5.nix
   ./i18n/input-method/hime.nix
···
   ./misc/mandoc.nix
   ./misc/meta.nix
   ./misc/nixops-autoluks.nix
-  ./misc/nixpkgs.nix
   ./misc/nixpkgs-flake.nix
+  ./misc/nixpkgs.nix
   ./misc/passthru.nix
   ./misc/version.nix
   ./misc/wordlist.nix
···
   ./programs/bash/blesh.nix
   ./programs/bash/ls-colors.nix
   ./programs/bash/undistract-me.nix
-  ./programs/bazecor.nix
   ./programs/bat.nix
+  ./programs/bazecor.nix
   ./programs/bcc.nix
   ./programs/benchexec.nix
   ./programs/browserpass.nix
···
   ./programs/chromium.nix
   ./programs/clash-verge.nix
   ./programs/cnping.nix
-  ./programs/cpu-energy-meter.nix
   ./programs/command-not-found/command-not-found.nix
   ./programs/coolercontrol.nix
   ./programs/corefreq.nix
+  ./programs/cpu-energy-meter.nix
   ./programs/criu.nix
   ./programs/darling.nix
   ./programs/dconf.nix
···
   ./programs/gdk-pixbuf.nix
   ./programs/geary.nix
   ./programs/ghidra.nix
-  ./programs/git.nix
   ./programs/git-worktree-switcher.nix
+  ./programs/git.nix
   ./programs/gnome-disks.nix
   ./programs/gnome-terminal.nix
   ./programs/gnupg.nix
···
   ./programs/haguichi.nix
   ./programs/hamster.nix
   ./programs/htop.nix
+  ./programs/i3lock.nix
   ./programs/iay.nix
   ./programs/iftop.nix
-  ./programs/i3lock.nix
   ./programs/iio-hyprland.nix
   ./programs/immersed.nix
   ./programs/iotop.nix
   ./programs/java.nix
   ./programs/joycond-cemuhook.nix
   ./programs/k3b.nix
-  ./programs/kde-pim.nix
   ./programs/k40-whisperer.nix
   ./programs/kbdlight.nix
   ./programs/kclock.nix
+  ./programs/kde-pim.nix
   ./programs/kdeconnect.nix
+  ./programs/kubeswitch.nix
   ./programs/ladybird.nix
   ./programs/lazygit.nix
-  ./programs/kubeswitch.nix
   ./programs/less.nix
   ./programs/liboping.nix
   ./programs/light.nix
···
   ./programs/npm.nix
   ./programs/ns-usbloader.nix
   ./programs/oblogout.nix
+  ./programs/obs-studio.nix
   ./programs/oddjobd.nix
   ./programs/opengamepadui.nix
   ./programs/openvpn3.nix
-  ./programs/obs-studio.nix
   ./programs/partition-manager.nix
   ./programs/pay-respects.nix
   ./programs/plotinus.nix
···
   ./programs/rush.nix
   ./programs/rust-motd.nix
   ./programs/ryzen-monitor-ng.nix
-  ./programs/screen.nix
   ./programs/schroot.nix
+  ./programs/screen.nix
   ./programs/seahorse.nix
   ./programs/sedutil.nix
   ./programs/shadow.nix
···
   ./programs/vivid.nix
   ./programs/wavemon.nix
   ./programs/wayland/cardboard.nix
-  ./programs/wayland/hyprlock.nix
   ./programs/wayland/hyprland.nix
+  ./programs/wayland/hyprlock.nix
   ./programs/wayland/labwc.nix
   ./programs/wayland/miracle-wm.nix
   ./programs/wayland/niri.nix
···
   ./programs/weylus.nix
   ./programs/winbox.nix
   ./programs/wireshark.nix
-  ./programs/xastir.nix
   ./programs/wshowkeys.nix
+  ./programs/xastir.nix
   ./programs/xfconf.nix
   ./programs/xfs_quota.nix
   ./programs/xonsh.nix
···
   ./security/rngd.nix
   ./security/rtkit.nix
   ./security/soteria.nix
-  ./security/sudo.nix
   ./security/sudo-rs.nix
+  ./security/sudo.nix
   ./security/systemd-confinement.nix
   ./security/tpm2.nix
   ./security/wrappers/default.nix
···
   ./services/backup/mysql-backup.nix
   ./services/backup/postgresql-backup.nix
   ./services/backup/postgresql-wal-receiver.nix
-  ./services/backup/snapraid.nix
   ./services/backup/restic-rest-server.nix
   ./services/backup/restic.nix
   ./services/backup/rsnapshot.nix
   ./services/backup/sanoid.nix
+  ./services/backup/snapraid.nix
   ./services/backup/syncoid.nix
   ./services/backup/tarsnap.nix
   ./services/backup/tsm.nix
···
   ./services/databases/firebird.nix
   ./services/databases/foundationdb.nix
   ./services/databases/hbase-standalone.nix
-  ./services/databases/influxdb.nix
   ./services/databases/influxdb2.nix
+  ./services/databases/influxdb.nix
   ./services/databases/lldap.nix
   ./services/databases/memcached.nix
   ./services/databases/monetdb.nix
···
   ./services/desktops/blueman.nix
   ./services/desktops/bonsaid.nix
   ./services/desktops/cpupower-gui.nix
-  ./services/desktops/deepin/deepin-anything.nix
-  ./services/desktops/deepin/dde-api.nix
   ./services/desktops/deepin/app-services.nix
+  ./services/desktops/deepin/dde-api.nix
   ./services/desktops/deepin/dde-daemon.nix
+  ./services/desktops/deepin/deepin-anything.nix
   ./services/desktops/dleyna.nix
   ./services/desktops/espanso.nix
   ./services/desktops/flatpak.nix
   ./services/desktops/geoclue2.nix
-  ./services/desktops/playerctld.nix
   ./services/desktops/gnome/at-spi2-core.nix
   ./services/desktops/gnome/evolution-data-server.nix
   ./services/desktops/gnome/glib-networking.nix
···
   ./services/desktops/neard.nix
   ./services/desktops/pipewire/pipewire.nix
   ./services/desktops/pipewire/wireplumber.nix
+  ./services/desktops/playerctld.nix
   ./services/desktops/profile-sync-daemon.nix
   ./services/desktops/seatd.nix
-  ./services/desktops/system-config-printer.nix
   ./services/desktops/system76-scheduler.nix
+  ./services/desktops/system-config-printer.nix
   ./services/desktops/telepathy.nix
   ./services/desktops/tumbler.nix
   ./services/desktops/wlock.nix
···
   ./services/development/rstudio-server/default.nix
   ./services/development/vsmartcard-vpcd.nix
   ./services/development/zammad.nix
-  ./services/display-managers/default.nix
   ./services/display-managers/cosmic-greeter.nix
+  ./services/display-managers/default.nix
   ./services/display-managers/greetd.nix
-  ./services/display-managers/sddm.nix
   ./services/display-managers/ly.nix
+  ./services/display-managers/sddm.nix
   ./services/editors/emacs.nix
   ./services/editors/haste.nix
   ./services/editors/infinoted.nix
···
   ./services/hardware/irqbalance.nix
   ./services/hardware/joycond.nix
   ./services/hardware/kanata.nix
+  ./services/hardware/keyd.nix
   ./services/hardware/kmonad.nix
   ./services/hardware/lcd.nix
   ./services/hardware/libinput.nix
   ./services/hardware/lirc.nix
-  ./services/hardware/nvidia-container-toolkit
   ./services/hardware/monado.nix
+  ./services/hardware/nvidia-container-toolkit
   ./services/hardware/nvidia-optimus.nix
   ./services/hardware/openrgb.nix
   ./services/hardware/pcscd.nix
···
   ./services/hardware/usbmuxd.nix
   ./services/hardware/usbrelayd.nix
   ./services/hardware/vdr.nix
-  ./services/hardware/keyd.nix
   ./services/home-automation/ebusd.nix
   ./services/home-automation/esphome.nix
   ./services/home-automation/evcc.nix
···
   ./services/home-automation/wyoming/piper.nix
   ./services/home-automation/wyoming/satellite.nix
   ./services/home-automation/zigbee2mqtt.nix
-  ./services/home-automation/zwave-js.nix
   ./services/home-automation/zwave-js-ui.nix
-  ./services/logging/SystemdJournal2Gelf.nix
+  ./services/home-automation/zwave-js.nix
   ./services/logging/awstats.nix
   ./services/logging/filebeat.nix
   ./services/logging/fluentd.nix
···
   ./services/logging/rsyslogd.nix
   ./services/logging/syslog-ng.nix
   ./services/logging/syslogd.nix
+  ./services/logging/SystemdJournal2Gelf.nix
+  ./services/logging/ulogd.nix
   ./services/logging/vector.nix
-  ./services/logging/ulogd.nix
   ./services/mail/automx2.nix
   ./services/mail/clamsmtp.nix
   ./services/mail/cyrus-imap.nix
···
   ./services/mail/protonmail-bridge.nix
   ./services/mail/public-inbox.nix
   ./services/mail/roundcube.nix
-  ./services/mail/rspamd.nix
   ./services/mail/rspamd-trainer.nix
+  ./services/mail/rspamd.nix
   ./services/mail/rss2email.nix
   ./services/mail/schleuder.nix
   ./services/mail/spamassassin.nix
···
   ./services/matrix/mjolnir.nix
   ./services/matrix/mx-puppet-discord.nix
   ./services/matrix/pantalaimon.nix
-  ./services/matrix/synapse.nix
   ./services/matrix/synapse-auto-compressor.nix
+  ./services/matrix/synapse.nix
   ./services/misc/airsonic.nix
   ./services/misc/amazon-ssm-agent.nix
   ./services/misc/ananicy.nix
···
   ./services/misc/redlib.nix
   ./services/misc/redmine.nix
   ./services/misc/renovate.nix
-  ./services/misc/rmfakecloud.nix
   ./services/misc/rkvm.nix
+  ./services/misc/rmfakecloud.nix
   ./services/misc/rshim.nix
   ./services/misc/safeeyes.nix
   ./services/misc/sdrplay.nix
···
   ./services/misc/sysprof.nix
   ./services/misc/tabby.nix
   ./services/misc/tandoor-recipes.nix
-  ./services/misc/taskserver
   ./services/misc/taskchampion-sync-server.nix
+  ./services/misc/taskserver
   ./services/misc/tautulli.nix
   ./services/misc/tiddlywiki.nix
   ./services/misc/tp-auto-kbbl.nix
+  ./services/misc/transfer-sh.nix
   ./services/misc/turn-rs.nix
   ./services/misc/tuxclocker.nix
-  ./services/misc/transfer-sh.nix
   ./services/misc/tzupdate.nix
   ./services/misc/uhub.nix
   ./services/misc/wastebin.nix
···
   ./services/network-filesystems/drbd.nix
   ./services/network-filesystems/eris-server.nix
   ./services/network-filesystems/glusterfs.nix
+  ./services/network-filesystems/ipfs-cluster.nix
   ./services/network-filesystems/kbfs.nix
   ./services/network-filesystems/kubo.nix
   ./services/network-filesystems/litestream/default.nix
   ./services/network-filesystems/moosefs.nix
-  ./services/network-filesystems/ipfs-cluster.nix
   ./services/network-filesystems/netatalk.nix
   ./services/network-filesystems/nfsd.nix
   ./services/network-filesystems/openafs/client.nix
···
   ./services/networking/cjdns.nix
   ./services/networking/clatd.nix
   ./services/networking/cloudflare-dyndns.nix
-  ./services/networking/cloudflared.nix
   ./services/networking/cloudflare-warp.nix
+  ./services/networking/cloudflared.nix
   ./services/networking/cntlm.nix
   ./services/networking/connman.nix
   ./services/networking/consul.nix
···
   ./services/networking/croc.nix
   ./services/networking/dae.nix
   ./services/networking/dante.nix
-  ./services/networking/deconz.nix
   ./services/networking/ddclient.nix
   ./services/networking/ddns-updater.nix
+  ./services/networking/deconz.nix
   ./services/networking/dhcpcd.nix
   ./services/networking/dnscache.nix
   ./services/networking/dnscrypt-proxy2.nix
···
   ./services/networking/ferm.nix
   ./services/networking/firefox-syncserver.nix
   ./services/networking/fireqos.nix
-  ./services/networking/firewall.nix
   ./services/networking/firewall-iptables.nix
   ./services/networking/firewall-nftables.nix
+  ./services/networking/firewall.nix
   ./services/networking/firezone/gateway.nix
   ./services/networking/firezone/gui-client.nix
   ./services/networking/firezone/headless-client.nix
···
   ./services/networking/freeradius.nix
   ./services/networking/frp.nix
   ./services/networking/frr.nix
+  ./services/networking/g3proxy.nix
   ./services/networking/gateone.nix
   ./services/networking/gdomap.nix
   ./services/networking/ghostunnel.nix
···
   ./services/networking/go-neb.nix
   ./services/networking/go-shadowsocks2.nix
   ./services/networking/gobgpd.nix
-  ./services/networking/gokapi.nix
   ./services/networking/godns.nix
+  ./services/networking/gokapi.nix
   ./services/networking/gvpe.nix
   ./services/networking/hans.nix
-  ./services/networking/harmonia.nix
   ./services/networking/haproxy.nix
+  ./services/networking/harmonia.nix
   ./services/networking/headscale.nix
   ./services/networking/hickory-dns.nix
   ./services/networking/hostapd.nix
···
   ./services/networking/lxd-image-server.nix
   ./services/networking/magic-wormhole-mailbox-server.nix
   ./services/networking/matterbridge.nix
-  ./services/networking/mptcpd.nix
   ./services/networking/microsocks.nix
   ./services/networking/mihomo.nix
   ./services/networking/minidlna.nix
···
   ./services/networking/morty.nix
   ./services/networking/mosquitto.nix
   ./services/networking/mozillavpn.nix
+  ./services/networking/mptcpd.nix
   ./services/networking/mstpd.nix
   ./services/networking/mtprotoproxy.nix
   ./services/networking/mtr-exporter.nix
···
   ./services/networking/mycelium.nix
   ./services/networking/namecoind.nix
   ./services/networking/nar-serve.nix
-  ./services/networking/nat.nix
   ./services/networking/nat-iptables.nix
   ./services/networking/nat-nftables.nix
+  ./services/networking/nat.nix
   ./services/networking/nats.nix
   ./services/networking/nbd.nix
   ./services/networking/ncdns.nix
···
   ./services/networking/nix-serve.nix
   ./services/networking/nix-store-gcs-proxy.nix
   ./services/networking/nixops-dns.nix
+  ./services/networking/nm-file-secret-agent.nix
   ./services/networking/nncp.nix
   ./services/networking/nntp-proxy.nix
-  ./services/networking/nm-file-secret-agent.nix
   ./services/networking/nomad.nix
   ./services/networking/nsd.nix
   ./services/networking/ntopng.nix
   ./services/networking/ntp/chrony.nix
-  ./services/networking/ntp/ntpd.nix
   ./services/networking/ntp/ntpd-rs.nix
+  ./services/networking/ntp/ntpd.nix
   ./services/networking/ntp/openntpd.nix
   ./services/networking/nullidentdmod.nix
   ./services/networking/nylon.nix
···
   ./services/networking/openvpn.nix
   ./services/networking/ostinato.nix
   ./services/networking/owamp.nix
-  ./services/networking/pyload.nix
   ./services/networking/pdns-recursor.nix
   ./services/networking/pdnsd.nix
   ./services/networking/peroxide.nix
···
   ./services/networking/pptpd.nix
   ./services/networking/privoxy.nix
   ./services/networking/prosody.nix
+  ./services/networking/pyload.nix
   ./services/networking/quassel.nix
   ./services/networking/quicktun.nix
   ./services/networking/quorum.nix
···
   ./services/networking/rpcbind.nix
   ./services/networking/rxe.nix
   ./services/networking/sabnzbd.nix
-  ./services/networking/scion/scion.nix
   ./services/networking/scion/scion-control.nix
   ./services/networking/scion/scion-daemon.nix
   ./services/networking/scion/scion-dispatcher.nix
-  ./services/networking/scion/scion-router.nix
   ./services/networking/scion/scion-ip-gateway.nix
+  ./services/networking/scion/scion-router.nix
+  ./services/networking/scion/scion.nix
   ./services/networking/seafile.nix
   ./services/networking/searx.nix
   ./services/networking/shadowsocks.nix
   ./services/networking/shairport-sync.nix
   ./services/networking/shellhub-agent.nix
-  ./services/networking/shorewall.nix
   ./services/networking/shorewall6.nix
+  ./services/networking/shorewall.nix
   ./services/networking/sing-box.nix
   ./services/networking/sitespeed-io.nix
   ./services/networking/skydns.nix
···
   ./services/networking/spacecookie.nix
   ./services/networking/spiped.nix
   ./services/networking/squid.nix
-  ./services/networking/g3proxy.nix
   ./services/networking/ssh/sshd.nix
   ./services/networking/sslh.nix
   ./services/networking/strongswan-swanctl/module.nix
···
   ./services/networking/syncplay.nix
   ./services/networking/syncthing-relay.nix
   ./services/networking/syncthing.nix
-  ./services/networking/tailscale.nix
   ./services/networking/tailscale-auth.nix
   ./services/networking/tailscale-derper.nix
+  ./services/networking/tailscale.nix
   ./services/networking/tayga.nix
   ./services/networking/tcpcrypt.nix
   ./services/networking/teamspeak3.nix
···
   ./services/networking/uptermd.nix
   ./services/networking/v2ray.nix
   ./services/networking/v2raya.nix
-  ./services/networking/veilid.nix
   ./services/networking/vdirsyncer.nix
+  ./services/networking/veilid.nix
   ./services/networking/vsftpd.nix
   ./services/networking/vwifi.nix
   ./services/networking/wasabibackend.nix
+  ./services/networking/webhook.nix
   ./services/networking/websockify.nix
   ./services/networking/wg-access-server.nix
   ./services/networking/wg-netmanager.nix
-  ./services/networking/whoogle-search.nix
-  ./services/networking/wvdial.nix
-  ./services/networking/webhook.nix
   ./services/networking/wg-quick.nix
   ./services/networking/wgautomesh.nix
+  ./services/networking/whoogle-search.nix
+  ./services/networking/wireguard-networkd.nix
   ./services/networking/wireguard.nix
-  ./services/networking/wireguard-networkd.nix
   ./services/networking/wpa_supplicant.nix
   ./services/networking/wstunnel.nix
+  ./services/networking/wvdial.nix
   ./services/networking/x2goserver.nix
   ./services/networking/xandikos.nix
   ./services/networking/xinetd.nix
   ./services/networking/xl2tpd.nix
   ./services/networking/xray.nix
   ./services/networking/xrdp.nix
+  ./services/networking/yggdrasil-jumper.nix
   ./services/networking/yggdrasil.nix
   ./services/networking/zapret.nix
-  ./services/networking/yggdrasil-jumper.nix
-  ./services/networking/zerobin.nix
   ./services/networking/zenohd.nix
+  ./services/networking/zerobin.nix
   ./services/networking/zeronet.nix
-  ./services/networking/zerotierone.nix
   ./services/networking/zeronsd.nix
+  ./services/networking/zerotierone.nix
   ./services/networking/znc/default.nix
+  ./services/printing/cups-pdf.nix
   ./services/printing/cupsd.nix
   ./services/printing/ipp-usb.nix
-  ./services/printing/cups-pdf.nix
   ./services/scheduling/atd.nix
   ./services/scheduling/cron.nix
   ./services/scheduling/fcron.nix
···
   ./services/security/kanidm.nix
   ./services/security/munge.nix
   ./services/security/nginx-sso.nix
-  ./services/security/oauth2-proxy.nix
   ./services/security/oauth2-proxy-nginx.nix
+  ./services/security/oauth2-proxy.nix
   ./services/security/openbao.nix
   ./services/security/opensnitch.nix
   ./services/security/paretosecurity.nix
···
   ./services/security/torify.nix
   ./services/security/torsocks.nix
   ./services/security/usbguard.nix
-  ./services/security/vault.nix
   ./services/security/vault-agent.nix
+  ./services/security/vault.nix
   ./services/security/vaultwarden/default.nix
   ./services/security/yubikey-agent.nix
   ./services/system/automatic-timezoned.nix
···
   ./services/torrent/opentracker.nix
   ./services/torrent/peerflix.nix
   ./services/torrent/rtorrent.nix
-  ./services/torrent/transmission.nix
   ./services/torrent/torrentstream.nix
+  ./services/torrent/transmission.nix
   ./services/tracing/tempo.nix
   ./services/ttys/getty.nix
   ./services/ttys/gpm.nix
   ./services/ttys/kmscon.nix
   ./services/video/epgstation/default.nix
+  ./services/video/frigate.nix
   ./services/video/go2rtc/default.nix
-  ./services/video/frigate.nix
+  ./services/video/mediamtx.nix
   ./services/video/mirakurun.nix
   ./services/video/photonvision.nix
-  ./services/video/mediamtx.nix
   ./services/video/ustreamer.nix
   ./services/video/v4l2-relayd.nix
   ./services/video/wivrn.nix
   ./services/wayland/cage.nix
   ./services/wayland/hypridle.nix
   ./services/web-apps/actual.nix
-  ./services/web-apps/akkoma.nix
   ./services/web-apps/agorakit.nix
+  ./services/web-apps/akkoma.nix
   ./services/web-apps/alps.nix
   ./services/web-apps/anuko-time-tracker.nix
   ./services/web-apps/archtika.nix
···
   ./services/web-apps/c2fmzq-server.nix
   ./services/web-apps/calibre-web.nix
   ./services/web-apps/castopod.nix
-  ./services/web-apps/coder.nix
   ./services/web-apps/changedetection-io.nix
   ./services/web-apps/chatgpt-retrieval-plugin.nix
   ./services/web-apps/cloudlog.nix
   ./services/web-apps/code-server.nix
+  ./services/web-apps/coder.nix
   ./services/web-apps/collabora-online.nix
   ./services/web-apps/commafeed.nix
   ./services/web-apps/convos.nix
   ./services/web-apps/cook-cli.nix
   ./services/web-apps/crabfit.nix
-  ./services/web-apps/davis.nix
   ./services/web-apps/cryptpad.nix
   ./services/web-apps/dashy.nix
+  ./services/web-apps/davis.nix
   ./services/web-apps/dependency-track.nix
   ./services/web-apps/dex.nix
   ./services/web-apps/discourse.nix
···
   ./services/web-apps/ethercalc.nix
   ./services/web-apps/fider.nix
   ./services/web-apps/filesender.nix
-  ./services/web-apps/firefly-iii.nix
   ./services/web-apps/firefly-iii-data-importer.nix
+  ./services/web-apps/firefly-iii.nix
   ./services/web-apps/flarum.nix
   ./services/web-apps/fluidd.nix
   ./services/web-apps/freshrss.nix
···
   ./services/web-apps/gerrit.nix
   ./services/web-apps/glance.nix
   ./services/web-apps/glitchtip.nix
+  ./services/web-apps/goatcounter.nix
   ./services/web-apps/gotify-server.nix
   ./services/web-apps/gotosocial.nix
   ./services/web-apps/grav.nix
   ./services/web-apps/grocy.nix
-  ./services/web-apps/part-db.nix
-  ./services/web-apps/pixelfed.nix
-  ./services/web-apps/goatcounter.nix
   ./services/web-apps/guacamole-client.nix
   ./services/web-apps/guacamole-server.nix
   ./services/web-apps/hatsu.nix
···
   ./services/web-apps/icingaweb2/icingaweb2.nix
   ./services/web-apps/icingaweb2/module-monitoring.nix
   ./services/web-apps/ifm.nix
-  ./services/web-apps/immich.nix
   ./services/web-apps/immich-public-proxy.nix
+  ./services/web-apps/immich.nix
   ./services/web-apps/invidious.nix
   ./services/web-apps/invoiceplane.nix
   ./services/web-apps/isso.nix
   ./services/web-apps/jirafeau.nix
   ./services/web-apps/jitsi-meet.nix
+  ./services/web-apps/kanboard.nix
   ./services/web-apps/karakeep.nix
   ./services/web-apps/kasmweb/default.nix
-  ./services/web-apps/kanboard.nix
   ./services/web-apps/kavita.nix
   ./services/web-apps/keycloak.nix
   ./services/web-apps/kimai.nix
···
   ./services/web-apps/matomo.nix
   ./services/web-apps/mattermost.nix
   ./services/web-apps/mealie.nix
+  ./services/web-apps/mediagoblin.nix
   ./services/web-apps/mediawiki.nix
   ./services/web-apps/meme-bingo-web.nix
   ./services/web-apps/microbin.nix
   ./services/web-apps/miniflux.nix
   ./services/web-apps/misskey.nix
+  ./services/web-apps/mobilizon.nix
   ./services/web-apps/monica.nix
   ./services/web-apps/moodle.nix
   ./services/web-apps/movim.nix
   ./services/web-apps/netbox.nix
-  ./services/web-apps/nextcloud.nix
   ./services/web-apps/nextcloud-notify_push.nix
   ./services/web-apps/nextcloud-whiteboard-server.nix
+  ./services/web-apps/nextcloud.nix
   ./services/web-apps/nextjs-ollama-llm-ui.nix
   ./services/web-apps/nexus.nix
   ./services/web-apps/nifi.nix
   ./services/web-apps/node-red.nix
   ./services/web-apps/nostr-rs-relay.nix
   ./services/web-apps/ocis.nix
+  ./services/web-apps/olivetin.nix
   ./services/web-apps/onlyoffice.nix
-  ./services/web-apps/openvscode-server.nix
-  ./services/web-apps/mediagoblin.nix
   ./services/web-apps/open-web-calendar.nix
-  ./services/web-apps/mobilizon.nix
-  ./services/web-apps/olivetin.nix
+  ./services/web-apps/openvscode-server.nix
   ./services/web-apps/openwebrx.nix
   ./services/web-apps/outline.nix
+  ./services/web-apps/part-db.nix
   ./services/web-apps/pds.nix
   ./services/web-apps/peering-manager.nix
   ./services/web-apps/peertube.nix
   ./services/web-apps/pgpkeyserver-lite.nix
-  ./services/web-apps/phylactery.nix
   ./services/web-apps/photoprism.nix
+  ./services/web-apps/phylactery.nix
   ./services/web-apps/pict-rs.nix
   ./services/web-apps/pingvin-share.nix
+  ./services/web-apps/pixelfed.nix
   ./services/web-apps/plantuml-server.nix
   ./services/web-apps/plausible.nix
   ./services/web-apps/porn-vault/default.nix
···
   ./services/web-apps/pretix.nix
   ./services/web-apps/privatebin.nix
   ./services/web-apps/prosody-filer.nix
+  ./services/web-apps/readeck.nix
   ./services/web-apps/reposilite.nix
   ./services/web-apps/rimgo.nix
+  ./services/web-apps/rss-bridge.nix
   ./services/web-apps/rutorrent.nix
   ./services/web-apps/screego.nix
-  ./services/web-apps/sftpgo.nix
-  ./services/web-apps/strfry.nix
-  ./services/web-apps/suwayomi-server.nix
-  ./services/web-apps/readeck.nix
-  ./services/web-apps/rss-bridge.nix
   ./services/web-apps/selfoss.nix
+  ./services/web-apps/sftpgo.nix
   ./services/web-apps/shiori.nix
   ./services/web-apps/silverbullet.nix
   ./services/web-apps/simplesamlphp.nix
   ./services/web-apps/slskd.nix
   ./services/web-apps/snipe-it.nix
   ./services/web-apps/sogo.nix
+  ./services/web-apps/stash.nix
   ./services/web-apps/stirling-pdf.nix
-  ./services/web-apps/stash.nix
+  ./services/web-apps/strfry.nix
+  ./services/web-apps/suwayomi-server.nix
   ./services/web-apps/trilium.nix
   ./services/web-apps/tt-rss.nix
   ./services/web-apps/vikunja.nix
···
   ./services/x11/xserver.nix
   ./system/activation/activatable-system.nix
   ./system/activation/activation-script.nix
+  ./system/activation/bootspec.nix
   ./system/activation/pre-switch-check.nix
   ./system/activation/specialisation.nix
   ./system/activation/switchable-system.nix
-  ./system/activation/bootspec.nix
   ./system/activation/top-level.nix
   ./system/boot/binfmt.nix
   ./system/boot/clevis.nix
···
   ./system/boot/kernel.nix
   ./system/boot/kexec.nix
   ./system/boot/loader/efi.nix
+  ./system/boot/loader/external/external.nix
   ./system/boot/loader/generations-dir/generations-dir.nix
   ./system/boot/loader/generic-extlinux-compatible
   ./system/boot/loader/grub/grub.nix
   ./system/boot/loader/grub/ipxe.nix
   ./system/boot/loader/grub/memtest.nix
-  ./system/boot/loader/external/external.nix
   ./system/boot/loader/init-script/init-script.nix
   ./system/boot/loader/limine/limine.nix
   ./system/boot/loader/loader.nix
   ./system/boot/loader/systemd-boot/systemd-boot.nix
   ./system/boot/luksroot.nix
-  ./system/boot/stratisroot.nix
   ./system/boot/modprobe.nix
   ./system/boot/networkd.nix
-  ./system/boot/uki.nix
-  ./system/boot/unl0kr.nix
   ./system/boot/plymouth.nix
   ./system/boot/resolved.nix
   ./system/boot/shutdown.nix
   ./system/boot/stage-1.nix
   ./system/boot/stage-2.nix
+  ./system/boot/stratisroot.nix
   ./system/boot/systemd.nix
   ./system/boot/systemd/coredump.nix
   ./system/boot/systemd/dm-verity.nix
   ./system/boot/systemd/fido2.nix
+  ./system/boot/systemd/homed.nix
   ./system/boot/systemd/initrd-secrets.nix
   ./system/boot/systemd/initrd.nix
-  ./system/boot/systemd/journald.nix
   ./system/boot/systemd/journald-gateway.nix
   ./system/boot/systemd/journald-remote.nix
   ./system/boot/systemd/journald-upload.nix
+  ./system/boot/systemd/journald.nix
   ./system/boot/systemd/logind.nix
   ./system/boot/systemd/nspawn.nix
   ./system/boot/systemd/oomd.nix
···
   ./system/boot/systemd/tpm2.nix
   ./system/boot/systemd/user.nix
   ./system/boot/systemd/userdbd.nix
-  ./system/boot/systemd/homed.nix
   ./system/boot/timesyncd.nix
   ./system/boot/tmp.nix
+  ./system/boot/uki.nix
+  ./system/boot/unl0kr.nix
   ./system/boot/uvesafb.nix
   ./system/etc/etc-activation.nix
   ./tasks/auto-upgrade.nix
···
   ./tasks/filesystems/ntfs.nix
   ./tasks/filesystems/overlayfs.nix
   ./tasks/filesystems/reiserfs.nix
-  ./tasks/filesystems/sshfs.nix
   ./tasks/filesystems/squashfs.nix
+  ./tasks/filesystems/sshfs.nix
   ./tasks/filesystems/unionfs-fuse.nix
   ./tasks/filesystems/vboxsf.nix
   ./tasks/filesystems/vfat.nix
···
   ./virtualisation/docker.nix
   ./virtualisation/ecs-agent.nix
   ./virtualisation/hyperv-guest.nix
-  ./virtualisation/incus.nix
   ./virtualisation/incus-agent.nix
+  ./virtualisation/incus.nix
   ./virtualisation/kvmgt.nix
   ./virtualisation/libvirtd.nix
   ./virtualisation/lxc.nix
   ./virtualisation/lxcfs.nix
-  ./virtualisation/lxd.nix
   ./virtualisation/lxd-agent.nix
+  ./virtualisation/lxd.nix
   ./virtualisation/multipass.nix
   ./virtualisation/nixos-containers.nix
   ./virtualisation/oci-containers.nix
-  ./virtualisation/openstack-options.nix
   ./virtualisation/oci-options.nix
+  ./virtualisation/openstack-options.nix
   ./virtualisation/openvswitch.nix
   ./virtualisation/parallels-guest.nix
   ./virtualisation/podman/default.nix
···
   ./virtualisation/waydroid.nix
   ./virtualisation/xe-guest-utilities.nix
   ./virtualisation/xen-dom0.nix
+  # keep-sorted end
   {
     documentation.nixos.extraModules = [
       ./virtualisation/qemu-vm.nix

nixos/modules/services/misc/paperless.nix

···
         description = "Settings to pass to the document exporter as CLI arguments.";
       };
     };
+
+    configureTika = lib.mkOption {
+      type = lib.types.bool;
+      default = false;
+      description = ''
+        Whether to configure Tika and Gotenberg to process Office and e-mail files with OCR.
+      '';
+    };
   };
 
   config = lib.mkIf cfg.enable (
···
           ];
         };
 
-        services.paperless.settings = lib.mkIf cfg.database.createLocally {
-          PAPERLESS_DBENGINE = "postgresql";
-          PAPERLESS_DBHOST = "/run/postgresql";
-          PAPERLESS_DBNAME = "paperless";
-          PAPERLESS_DBUSER = "paperless";
-        };
+        services.paperless.settings = lib.mkMerge [
+          (lib.mkIf cfg.database.createLocally {
+            PAPERLESS_DBENGINE = "postgresql";
+            PAPERLESS_DBHOST = "/run/postgresql";
+            PAPERLESS_DBNAME = "paperless";
+            PAPERLESS_DBUSER = "paperless";
+          })
+          (lib.mkIf cfg.configureTika {
+            PAPERLESS_GOTENBERG_ENABLED = true;
+            PAPERLESS_TIKA_ENABLED = true;
+          })
+        ];
 
         systemd.slices.system-paperless = {
           description = "Paperless Document Management System Slice";
···
           groups.${defaultUser} = {
             gid = config.ids.gids.paperless;
           };
+        };
+
+        services.gotenberg = lib.mkIf cfg.configureTika {
+          enable = true;
+          # https://github.com/paperless-ngx/paperless-ngx/blob/v2.15.3/docker/compose/docker-compose.sqlite-tika.yml#L64-L69
+          chromium.disableJavascript = true;
+          extraArgs = [ "--chromium-allow-list=file:///tmp/.*" ];
+        };
+
+        services.tika = lib.mkIf cfg.configureTika {
+          enable = true;
+          enableOcr = true;
         };
       }
 

nixos/modules/services/monitoring/graphite.nix

···
           serviceConfig = {
             Slice = "system-graphite.slice";
             RuntimeDirectory = name;
-            ExecStart = "${pkgs.python3Packages.twisted}/bin/twistd ${carbonOpts name}";
+            ExecStart = "${lib.getExe' pkgs.python3Packages.twisted "twistd"} ${carbonOpts name}";
             User = "graphite";
             Group = "graphite";
             PermissionsStartOnly = true;
···
           serviceConfig = {
             Slice = "system-graphite.slice";
             RuntimeDirectory = name;
-            ExecStart = "${pkgs.python3Packages.twisted}/bin/twistd ${carbonOpts name}";
+            ExecStart = "${lib.getExe' pkgs.python3Packages.twisted "twistd"} ${carbonOpts name}";
             User = "graphite";
             Group = "graphite";
             PIDFile = "/run/${name}/${name}.pid";
···
           serviceConfig = {
             Slice = "system-graphite.slice";
             RuntimeDirectory = name;
-            ExecStart = "${pkgs.python3Packages.twisted}/bin/twistd ${carbonOpts name}";
+            ExecStart = "${lib.getExe' pkgs.python3Packages.twisted "twistd"} ${carbonOpts name}";
             User = "graphite";
             Group = "graphite";
             PIDFile = "/run/${name}/${name}.pid";
···
         };
         serviceConfig = {
           ExecStart = ''
-            ${pkgs.python3Packages.waitress-django}/bin/waitress-serve-django \
+            ${lib.getExe pkgs.python3Packages.waitress-django} \
               --host=${cfg.web.listenAddress} --port=${toString cfg.web.port}
           '';
           User = "graphite";
···
             mkdir -p ${dataDir}/{whisper/,log/webapp/}
             chmod 0700 ${dataDir}/{whisper/,log/webapp/}
 
-            ${pkgs.python3Packages.django}/bin/django-admin.py migrate --noinput
+            ${lib.getExe' pkgs.python3Packages.django "django-admin"} migrate --noinput
 
             chown -R graphite:graphite ${dataDir}
 
···
           # Only collect static files when graphite_web changes.
           if ! [ "${dataDir}/current_graphite_web" -ef "${pkgs.python3Packages.graphite-web}" ]; then
             mkdir -p ${staticDir}
-            ${pkgs.python3Packages.django}/bin/django-admin.py collectstatic  --noinput --clear
+            ${lib.getExe' pkgs.python3Packages.django "django-admin"} collectstatic  --noinput --clear
             chown -R graphite:graphite ${staticDir}
             ln -sfT "${pkgs.python3Packages.graphite-web}" "${dataDir}/current_graphite_web"
           fi
···
         ];
         environment = seyrenConfig;
         serviceConfig = {
-          ExecStart = "${pkgs.seyren}/bin/seyren -httpPort ${toString cfg.seyren.port}";
+          ExecStart = "${lib.getExe pkgs.seyren} -httpPort ${toString cfg.seyren.port}";
           WorkingDirectory = dataDir;
           User = "graphite";
           Group = "graphite";

pkgs/by-name/cp/cpu_features/package.nix

···
 
 stdenv.mkDerivation rec {
   pname = "cpu_features";
-  version = "0.9.0";
+  version = "0.10.0";
 
   outputs = [
     "out"
···
     owner = "google";
     repo = "cpu_features";
     rev = "v${version}";
-    hash = "sha256-uXN5crzgobNGlLpbpuOxR+9QVtZKrWhxC/UjQEakJwk=";
+    hash = "sha256-YnNcNzlFVTHKCxfmhTDhOxluxK2VCBuEi7VZGgUB4VU=";
   };
 
   nativeBuildInputs = [ cmake ];

pkgs/by-name/el/element-call/missing-hashes.json

···
+{
+  "@esbuild/aix-ppc64@npm:0.25.1": "6de3a364b7f79f21f66d606d4d29c72ef81c741d71ab4bb941c4eabe7b6a809b1340f4dd5c943827005e421912880741320b9617d17fce762d204cfb94175223",
+  "@esbuild/android-arm64@npm:0.25.1": "716c98ad3220c71cbaedcfa34aa7c877a3fae911938c3776a66600d7f65980e384799a6832a1b9aea96c6d5a8880610f54744bd0813e743c511d44056ef528d6",
+  "@esbuild/android-arm@npm:0.25.1": "d2c9e95dd2027f6e14250a90a11136d9ce73a2157a8d104df4a9dd199d3c50cd91f25813536b4776630acb78596bd5a025976962c6d624df7594c32f2d9c1395",
+  "@esbuild/android-x64@npm:0.25.1": "92f1bec801b414ecdc4b73adfbb4482f4f2cfba423d33296914fa59ffdafb81facc445a7f65d1eea813c078220a0606f4be02252843bb9039ceb2755f643387c",
+  "@esbuild/darwin-arm64@npm:0.25.1": "9c4cd09c0bd8479e27e04e2397edccebae928184c463684490137d2b7ea3171051b66596db229af2ad3e6a911c1c8a9d10b8aed30d11d0aa155ac0d309fd5dd6",
+  "@esbuild/darwin-x64@npm:0.25.1": "31b64c02be9438e175e8b343c52e0bbc7964f08a1b44e0adbfa2a1b229ccd0ad0184cdb8313272b4590298833ea0b197d82a909466caffe90105f8acb30402d0",
+  "@esbuild/freebsd-arm64@npm:0.25.1": "e04018ffd760dd101a5931e0248751bdfca98e3f29be9b41051d55278907f52a3e5ab80c32168e208c2ff287510d6d5b765d3adc841bfd621af7930c10a547e6",
+  "@esbuild/freebsd-x64@npm:0.25.1": "438215bea2dc716d2c9ffe9b921bbde06e77d96ec0c837fd79f46bc6e195aa50e5f55490228f7433df7aa47810eec5c602a9d9cf956c1794778018632b196f34",
+  "@esbuild/linux-arm64@npm:0.25.1": "c839788b6db471f144bc2627a117083c9a50402c76cde2f0e5411faaeb3a5cde4972bb7336b87de67cd0a65d4d5b00759668407a03b5d4ed3130d4984837429a",
+  "@esbuild/linux-arm@npm:0.25.1": "ecf9fd9028d2166619b9a45161a987eebb6ef3dcb0159a2607ab164c58c26a15cf274e0b1088834c07ef9166349276d595fdad5c42bce8d03a55cb213d947efa",
+  "@esbuild/linux-ia32@npm:0.25.1": "36f208e10a4b778a28a9002338872e52d24dfc18e25d3b41dc53892279c3ee842d76c7b608a30620f128d85344acac0dc86f203f5de7082a21fa2e908c96b68c",
+  "@esbuild/linux-loong64@npm:0.25.1": "75d95e6ee995c9f2abb202ca430685e5d58fbe9b0b5b01a69b498c9b360d309026d15bae7831de9c0c4f02e45028a92ffb169117c3b56dd1ac7ea8c6ef50628d",
+  "@esbuild/linux-mips64el@npm:0.25.1": "7fc22eb8a7dc9ee743113cb327eef3591bced4753f416f8dd722794a198a053ab6e120b3b13c1bb6cc89cbd02ea502187b1a3c9ebe8187407665c78995153740",
+  "@esbuild/linux-ppc64@npm:0.25.1": "84f914a776774bf209c5f96a3708e52477e1966b689a880c0256530063bc581125b5cc04b9700f4aa892e7770ba47c5a950a4be9f1bb3ccbe60a500383602156",
+  "@esbuild/linux-riscv64@npm:0.25.1": "97f47cd5695686254b58f950ca973df1fcecfebf3bd585629121a65323ffaa7f95cf821392011ee069da492b46fdff771be332c699a438cf123351610e12d621",
+  "@esbuild/linux-s390x@npm:0.25.1": "10760a999d432d092a8ebe5f09752ee7e8ea77a1afa5f1adfe7f9ccb5bbf77d6e0da6dce5d1a4a7cd731d89b6075723c2bc0328f446ed129c4b63c6441ba22ae",
+  "@esbuild/linux-x64@npm:0.25.1": "4cdb1625726580eb42432878912d5480a0321559ef2c6425c1db55f89f3fe1c35fb03b3adec92c3f52a4db751d7535f23086b80ed7b219d1edbb254ffbe96e68",
+  "@esbuild/netbsd-arm64@npm:0.25.1": "f2427b094e072d2db7944b1d2a988dd9f17627976a395b941f225aec2d0565da2ea110a845eafae960af08e3eea74eb327e5eb9dbe06dc1e14f4439596c3b47c",
+  "@esbuild/netbsd-x64@npm:0.25.1": "c8347ecc18b175923a3cbdaef61b64815ffe0cf2cc285f4034337c2df83e78a118ebfdf2ac3a46a8d8a19ce6a0e0605d27d11570d1758ab90074c99047b82fc0",
+  "@esbuild/openbsd-arm64@npm:0.25.1": "719812786b4f3ab4471a306c930ab1bf31e9d92f933ea2a34566f07d6269df5058e7d48408127daa197e6fdb21e30697303127d259b76b18936d534619a3eb15",
+  "@esbuild/openbsd-x64@npm:0.25.1": "21590cbeda028e9b9f8131c54c36bab65a5d5bd5dd4e6bd9f80438045a655e9ac634bb3535a8650b694db267fe23bd2318a59cdec2fae1ba389ed1a00cc0bbe7",
+  "@esbuild/sunos-x64@npm:0.25.1": "e20ce3891d8717fe2cb885d92d16e9409802316eaa91071be5c7d75164d23dbc5a502be3691039051843d94192e8cf43ade61014a8bce298cfc13a8d3ddd85b0",
+  "@esbuild/win32-arm64@npm:0.25.1": "749a211eae6a47e5ceb71898df668d083bdec2ed762116fea7772824281f793aceb0487946e20ff604d7e102d1fc8538a73f15b476ca36e07f7ddfb601f6dfa1",
+  "@esbuild/win32-ia32@npm:0.25.1": "bb45fd889d858678ec68114bfc398965ed8d44e46a9517fcd9f7b397101c2cf94d78938a2640f6f2a1fe65de4ae8830fd426cd21a28302bb92333913b3c16c85",
+  "@esbuild/win32-x64@npm:0.25.1": "e33291b9834095e6460bd20bb15c49361758bf66d28ccffe0c06a1565211c91f668d9cfc0cbd5bd7a5def693fe7272dbe290b08d4eadba29e750c8a9c739f564",
+  "@parcel/watcher-android-arm64@npm:2.5.1": "f99d569e4f6cf78a1b0097fb9d4682cb201a74370ae440c531da4e1d5021e46141bfcdf8ef708b51a5b9cb1c30f78eea933ce75216d5eeb7b969a2ad27c68e4a",
+  "@parcel/watcher-darwin-arm64@npm:2.5.1": "973c7ef3c94608da9cd1b20b18b9a7de2fb46fe44553731fe372b640de524491976150d0845f3d5953b74ed8ea469cb8d18a48651d0e5fb82f549a6b46b54f79",
+  "@parcel/watcher-darwin-x64@npm:2.5.1": "848c5516aed9c36e14751200dbbf57e83c0bd46cdab0932df33db120e66b9596de18eeb98980e319efde84014f67d9e7924d7555383d8ffcefe35c501166b84b",
+  "@parcel/watcher-freebsd-x64@npm:2.5.1": "cbd2b7884bc92422edabc0c74c3fbc06512bb7300fc137aaff2e96f46f61e5272265a0b5d230acc82a0e777b0c11661f0b8b7f89a9342c0920b752436dd2c750",
+  "@parcel/watcher-linux-arm-glibc@npm:2.5.1": "f2e1ec14dbb0f85a84a75f55fd7721598694976ba3ad439832b57e558b0d9240cc80ff83053fb8cf7caffb0592d51bb39d325112763ec1734924b49d4ba9c144",
+  "@parcel/watcher-linux-arm-musl@npm:2.5.1": "83344c7ecda2e79db59d711bcee0c3fa26922989139c031bd762cf3d5bfb191797e22e9ed6072690b822dfd62629623ba4e7eedb3c41930a987fc3d4106000e1",
+  "@parcel/watcher-linux-arm64-glibc@npm:2.5.1": "562231feb159a294752378bebecc69a2d33366a9d877835844578799f8536398006e0e570849f9e2db04085a3ea82131459cd10fd6b42dea10cd73bd0c9ca13e",
+  "@parcel/watcher-linux-arm64-musl@npm:2.5.1": "f62db52a90ebbaa29ca9900e6b9bd3fc6e5c650741bbde9a2742cbc332c678b753fc6a596d67659394fd9262aa826463ea667d18cc554bcaaac9e8da1a2a29d0",
+  "@parcel/watcher-linux-x64-glibc@npm:2.5.1": "425e557991fde5092d6a9e20be71810600415e5fa157dca0b39bd8db86653d3ee7b037305261c8782d1a065f2a64d235e17b57876b26f5bb0dd7a9bdbe364690",
+  "@parcel/watcher-linux-x64-musl@npm:2.5.1": "4dbb066ba9478c8b8de39e3c1083cbb74f86f03eaf4445603e69909d6c072134644316faa20a2445419b9fe1a8063ade7b5331a5766d807ee0b15b8a70c59a2d",
+  "@parcel/watcher-win32-arm64@npm:2.5.1": "e015314d6b9b727cbe25eedf963ca8b23bf6d4e78d3c28008bd0d2657940ad54a271330486df3a93a5f1a30f2b8d052d14415b85cc7e7b747c6c73b5dc055628",
+  "@parcel/watcher-win32-ia32@npm:2.5.1": "920b6ad6a2095aeb9c2d329c5118472a3c14669fa93eaa99aa8050c76c5c2d3d76d92677167ed748c2ac5487c568d5df16d5d94f4bc7c354094fccd8e0d6350c",
+  "@parcel/watcher-win32-x64@npm:2.5.1": "8f1c8e41ec9f86e4dcd0d4db0a077742d5dcc853f15ea888387183e34e2efcff09fd1cc9ec46fc1121b9ad4ddc0e221283f2ffb23cfd7dbcbb8b03060b461963",
+  "@rollup/rollup-android-arm-eabi@npm:4.37.0": "137cc44b5452772bc857f3a9b113dc89a95b0d529963e91a49ac1b336302f37931da052a5d07c294da6060d07251c0251c7d363fd2be1775b59afd84a4c2ec67",
+  "@rollup/rollup-android-arm64@npm:4.37.0": "a6856efb422e0e9ab62f407e0e73908fe78d42fbb2730aeeba3d8b3f034449ef248a0fb596b5af3e87f7054e00328aa4322525a375508f492dbc7c2478aa0e49",
+  "@rollup/rollup-darwin-arm64@npm:4.37.0": "ac29a2a8eb0e40c54a1685c868436658682293cacde10b7cbf587845902e4e95ec4b84e4eefbf7ac6a4b6330b47fe4094dbeeb90f22c0ee130ff984b8d3a1cb9",
+  "@rollup/rollup-darwin-x64@npm:4.37.0": "037115d7f3b9ceab60df8ea12a48762a6c4051da7008a6b5d47174d9980759c392d7c6e4e79e2989744f0a16d1fb78ae97a9abd309fb1c41b07b65fab1700338",
+  "@rollup/rollup-freebsd-arm64@npm:4.37.0": "8ac2a91f628962633cf33aa462e567b1fc09b4ea09bf7a882ebb7ebf7adf4530d5f9d1b2dfa50ef64ddfa4b820e1eea324041f4c847298ddbe48d7491a944016",
+  "@rollup/rollup-freebsd-x64@npm:4.37.0": "855b528e935ad21de0297112b2b73ea4ca7db94278606811f2d61011cf8f8042e4b7127f7993859320876fba585a00c5e7e11c7b50ce23af4ccca3679a69754f",
+  "@rollup/rollup-linux-arm-gnueabihf@npm:4.37.0": "dc126fb662d1a645ab41680033a987908ed0565b4ea9d414a9a46a61c06e9b136c010d1f28b1c34ffb101375a5279f18ee70d0d9b4ff1f2db80a54a05af3071d",
+  "@rollup/rollup-linux-arm-musleabihf@npm:4.37.0": "206cf3b319948b5d2d5ada18c698f16350c4cb64b53ad754fad91c1fe403c5fc110b3d3d2436433c5fd9ed1e1cec3535ed184902a6986f8bc0ae9770360e3c0b",
+  "@rollup/rollup-linux-arm64-gnu@npm:4.37.0": "f96da93f09aad5145f6fcfd69eccb6a2d407754e13f168d161dd2280991b7e4a3a514009b8a796767e5bd85ca0e4f81e2aea19781bb027d3ec59cf01768e2e1c",
+  "@rollup/rollup-linux-arm64-musl@npm:4.37.0": "c31f0c0aeefd18b59212f845aacac5a5a614ce0101db27dcc53884ae4d4e766d399d816104a10f4ee8c4c28e2045abb2d6a778c00bd30a430b3f34be4445cb1c",
+  "@rollup/rollup-linux-loongarch64-gnu@npm:4.37.0": "d69b456caaa8c12c2936a6836dc2dd3b9169ebfc2d888c904d3407fb2c53ba99a3323bfd36d447c17ff0b9e31b4709defaf72cafb32c23c773fbffdee50bc7fc",
+  "@rollup/rollup-linux-powerpc64le-gnu@npm:4.37.0": "abc5b4e7960965f01948dbf7e956695643cf6ab78ef1d14f2bc34b93cbb85a9ccb9c005dfbf948a80145cd808078a34d216c9d4e801570e2ca638a563ecd0ae2",
+  "@rollup/rollup-linux-riscv64-gnu@npm:4.37.0": "a9a5fe6a24955dae476c9ab5fb22d5f807e0ff916ff1ec289c8050e6688695e9c434dfdb130282712dd3657bf883af4544ed1ebc77b68530ccb8e33af484a41e",
+  "@rollup/rollup-linux-riscv64-musl@npm:4.37.0": "e6cd70f709a59037f496d1086f34148ef2ba92bbf1813e07ccd52b3643822486fa95671a6ed4a3397b9ef23e3a4dea20926f9e1a26b00a06173202627cf2f0ce",
+  "@rollup/rollup-linux-s390x-gnu@npm:4.37.0": "a6704bd605db0a99a60947a6a69ad6d1dbf712f57d4bcaba24a122cc062b2513319726e8211410d5d9d2bc1face3b153c45c4c9209ead6a25f87cf6e79828864",
+  "@rollup/rollup-linux-x64-gnu@npm:4.37.0": "fb0ee05c300d73fb05e5584418c41cd616aca8ccb4c4397b56ada769b4e3655223cdea2ce136c3ff3ed3efb9f74800acbd4801135afc3fbd49b29fff092ebd8c",
+  "@rollup/rollup-linux-x64-musl@npm:4.37.0": "c502057b9ef77bb43df6337eb02c5bbb8f7aabb2780f3de8256048ade427d319e4d5cca4e4238c3076ddddfd9749d9854e8fbc7f6e50cec84e778da6dafe90b7",
+  "@rollup/rollup-win32-arm64-msvc@npm:4.37.0": "4a6a5c2fb0c520edd3f67deb773ff600698a665ac5a4ba4ac8147836aa054be0f3fab54c841f3eef2b638224dd432a62b5f48b3704f5d3dd37ec7fcfc6a70591",
+  "@rollup/rollup-win32-ia32-msvc@npm:4.37.0": "439f4339c26c104333b3f55a34ef1a2280b22eec165362eee1816548a0b93f0440a6e3982af9263d1a4158d665a6ecba68c64bf12a786eae69db232399598321",
+  "@rollup/rollup-win32-x64-msvc@npm:4.37.0": "0c85f06fddfc73dd4457a6c6ec841e52d0fb81179fe63754bd3c02c4795ec338685bd14ff49672ddfb3767aecf4f01f4a5da5730b0cf62be318753390027de37",
+  "@sentry/cli-darwin@npm:2.42.2": "3df1b8774a2dffba2a413420b573d0ddb94a51ab530cfcf719736cac37fb9b6ff835516b4b783771f003659436a00d3ee5ea201fb2510c1ea517d7256c619b50",
+  "@sentry/cli-linux-arm64@npm:2.42.2": "17ab90626910c137925aa307bfb4b2f5790a756eaec9bbfa1066b1c2265ec1981ae3d7c8b2014071da9dd3a604cf150ba9a8d93a16e0da155831c7c8a524f956",
+  "@sentry/cli-linux-arm@npm:2.42.2": "2d31e7d2603f124e2a36626e91dd8c50a0eba27386b94a7076115022e50193140d7f613850adf64740ee46102cec99845750df05430dd16ea50f01607ead6d2d",
+  "@sentry/cli-linux-i686@npm:2.42.2": "e5c52d65f507393c786373aaff873d6522f9ab26ef3cea498268ef63d053dc9f4e806c3295c22b48c5dd1f7ecf0c47bfaa0f7545424ef81a3cd51914de2af2bc",
+  "@sentry/cli-linux-x64@npm:2.42.2": "62ed35b355b7673c8cc1d1542c21d1fb908022c2cc951eda47ee4a55c3e53499c1eca08b93408b547adf9ffe7bcb6d43efa50f185f6fa66155a13373ea79d5f3",
+  "@sentry/cli-win32-i686@npm:2.42.2": "3876d8d3f6139d984714ed5fed8ef124d32af8f5d7cd6968adc8e910727e12eb39d85dcc6304a5e249dce7d8e93e11f8bcfde83545835d959f260bf4b1914d00",
+  "@sentry/cli-win32-x64@npm:2.42.2": "16e6deb7f0faaed1a88c121463b3ef727726351ec04afe3308ff3775d26e1d7b990a3fd65b216d7fc2ac4f6967c625f14e6dbc2dab99fcc9d7a625ec80422ab8"
+}

pkgs/by-name/el/element-call/package.nix

···
   stdenv,
   fetchFromGitHub,
   fetchYarnDeps,
+  git,
+  yarn-berry,
   yarnConfigHook,
-  yarnBuildHook,
   nodejs,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "element-call";
-  version = "0.9.0";
+  version = "0.10.0";
 
   src = fetchFromGitHub {
     owner = "element-hq";
     repo = "element-call";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-BugR5aXDxIQ9WOhaqXEoo0FdZHnYSvoqDoRJLDd4PUk=";
+    hash = "sha256-hKlzp6dDYRp1fM6soho84nP0phkQkaGJEGUf0MqzQGc=";
+  };
+
+  matrixJsSdkRevision = "19b1b901f575755d29d1fe03ca48cbf7c1cae05c";
+  matrixJsSdkOfflineCache = fetchYarnDeps {
+    yarnLock = "${finalAttrs.offlineCache}/checkouts/${finalAttrs.matrixJsSdkRevision}/yarn.lock";
+    hash = "sha256-pi2MW+58DCkHJDOxMWeXzF+v+5JhJFGQcUgsRsYjNvw=";
   };
 
-  offlineCache = fetchYarnDeps {
-    yarnLock = "${finalAttrs.src}/yarn.lock";
-    hash = "sha256-7dUSt1k/5N6BaYrT272J6xxDGgloAsDw1dCFh327Itc=";
+  dontYarnInstallDeps = true;
+  preConfigure = ''
+    cp -r $offlineCache writable
+    chmod u+w -R writable
+    pushd writable/checkouts/${finalAttrs.matrixJsSdkRevision}/
+    mkdir -p .git/{refs,objects}
+    echo ${finalAttrs.matrixJsSdkRevision} > .git/HEAD
+    SKIP_YARN_COREPACK_CHECK=1 offlineCache=$matrixJsSdkOfflineCache yarnConfigHook
+    popd
+    offlineCache=writable
+  '';
+
+  missingHashes = ./missing-hashes.json;
+  offlineCache = yarn-berry.fetchYarnBerryDeps {
+    inherit (finalAttrs) src missingHashes;
+    hash = "sha256-Pv9ioa6F5gNx+8oMJvvRI/LTJGJ4ALrIQFvoH++szuo=";
   };
 
   nativeBuildInputs = [
+    git
+    yarn-berry.yarnBerryConfigHook
     yarnConfigHook
-    yarnBuildHook
     nodejs
   ];
+
+  buildPhase = ''
+    runHook preBuild
+    ${lib.getExe yarn-berry} build
+    runHook postBuild
+  '';
 
   installPhase = ''
     runHook preInstall

pkgs/by-name/fe/ferron/package.nix

···
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "ferron";
-  version = "1.0.0";
+  version = "1.2.0";
 
   src = fetchFromGitHub {
     owner = "ferronweb";
     repo = "ferron";
     tag = finalAttrs.version;
-    hash = "sha256-kw2Ffl5KB3urg5h/ejbW+WxYLpNrxIjPy0levZPgRoo=";
+    hash = "sha256-FK3LdDkTtY5UsYc/wR8cAyh2GHs9oTvN2K3N0tn+eOM=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-uPzEz72/3huigY8moYX5ztRZ0Uaye+GN7V8vKKklPkY=";
+  cargoHash = "sha256-/OhIsP3okvCVwGP0Txjm8feOumaJXxoJdCY/CE0Tu6Y=";
 
   nativeBuildInputs = [
     pkg-config
···
   meta = {
     description = "Fast, memory-safe web server written in Rust";
     homepage = "https://github.com/ferronweb/ferron";
+    changelog = "https://github.com/ferronweb/ferron/releases/tag/${finalAttrs.version}";
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [ GaetanLepage ];
     mainProgram = "ferron";

pkgs/by-name/gi/git-mit/libgit2-update.patch

···
+From 3e82a4f5017972c7d28151a468bb71fe7d2279e0 Mon Sep 17 00:00:00 2001
+From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com>
+Date: Mon, 13 Jan 2025 01:45:12 +0000
+Subject: [PATCH] fix(deps): update rust crate git2 to 0.20.0
+
+---
+ Cargo.lock                          | 8 ++++----
+ git-mit-config/Cargo.toml           | 2 +-
+ git-mit-install/Cargo.toml          | 2 +-
+ git-mit-relates-to/Cargo.toml       | 2 +-
+ git-mit/Cargo.toml                  | 2 +-
+ mit-commit-message-lints/Cargo.toml | 2 +-
+ mit-commit-msg/Cargo.toml           | 2 +-
+ mit-hook-test-helper/Cargo.toml     | 2 +-
+ mit-pre-commit/Cargo.toml           | 2 +-
+ mit-prepare-commit-msg/Cargo.toml   | 2 +-
+ 10 files changed, 13 insertions(+), 13 deletions(-)
+
+diff --git a/Cargo.lock b/Cargo.lock
+index 11c858e8..db9e01dd 100644
+--- a/Cargo.lock
++++ b/Cargo.lock
+@@ -783,9 +783,9 @@ dependencies = [
+ 
+ [[package]]
+ name = "git2"
+-version = "0.19.0"
++version = "0.20.0"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "b903b73e45dc0c6c596f2d37eccece7c1c8bb6e4407b001096387c63d0d93724"
++checksum = "3fda788993cc341f69012feba8bf45c0ba4f3291fcc08e214b4d5a7332d88aff"
+ dependencies = [
+  "bitflags 2.7.0",
+  "libc",
+@@ -1075,9 +1075,9 @@ checksum = "b5aba8db14291edd000dfcc4d620c7ebfb122c613afb886ca8803fa4e128a20a"
+ 
+ [[package]]
+ name = "libgit2-sys"
+-version = "0.17.0+1.8.1"
++version = "0.18.0+1.9.0"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+-checksum = "10472326a8a6477c3c20a64547b0059e4b0d086869eee31e6d7da728a8eb7224"
++checksum = "e1a117465e7e1597e8febea8bb0c410f1c7fb93b1e1cddf34363f8390367ffec"
+ dependencies = [
+  "cc",
+  "libc",
+diff --git a/git-mit-config/Cargo.toml b/git-mit-config/Cargo.toml
+index aa1fd61e..3ec0cd93 100644
+--- a/git-mit-config/Cargo.toml
++++ b/git-mit-config/Cargo.toml
+@@ -15,7 +15,7 @@ mit-lint = "3.2.9"
+ shell-words = "1.1.0"
+ thiserror = "1.0.69"
+ miette = { version = "7.4.0", features = [ "fancy" ] }
+-git2 = "0.19.0"
++git2 = "0.20.0"
+ openssl = { version = "0.10.68", optional = true }
+ clap_complete = "4.5.42"
+ clap = { version = "4.5.26", features = ["derive", "cargo", "wrap_help", "env", "unicode" ] }
+diff --git a/git-mit-install/Cargo.toml b/git-mit-install/Cargo.toml
+index a7611272..96f58672 100644
+--- a/git-mit-install/Cargo.toml
++++ b/git-mit-install/Cargo.toml
+@@ -18,7 +18,7 @@ clap_complete = "4.5.42"
+ clap = { version = "4.5.26", features = ["derive", "cargo", "wrap_help", "env", "unicode" ] }
+ 
+ 
+-git2 = "0.19.0"
++git2 = "0.20.0"
+ openssl = { version = "0.10.68", optional = true }
+ 
+ indoc = "2.0.5"
+diff --git a/git-mit-relates-to/Cargo.toml b/git-mit-relates-to/Cargo.toml
+index d50d2aa9..c6676bf8 100644
+--- a/git-mit-relates-to/Cargo.toml
++++ b/git-mit-relates-to/Cargo.toml
+@@ -17,7 +17,7 @@ thiserror = "1.0.69"
+ miette = { version = "7.4.0", features = [ "fancy" ] }
+ clap_complete = "4.5.42"
+ clap = { version = "4.5.26", features = ["derive", "cargo", "wrap_help", "env", "unicode" ] }
+-git2 = "0.19.0"
++git2 = "0.20.0"
+ openssl = { version = "0.10.68", optional = true }
+ 
+ 
+diff --git a/git-mit/Cargo.toml b/git-mit/Cargo.toml
+index ce108e96..fdda0c55 100644
+--- a/git-mit/Cargo.toml
++++ b/git-mit/Cargo.toml
+@@ -17,7 +17,7 @@ thiserror = "1.0.69"
+ miette = { version = "7.4.0", features = [ "fancy" ] }
+ clap_complete = "4.5.42"
+ clap = { version = "4.5.26", features = ["derive", "cargo", "wrap_help", "env", "unicode" ] }
+-git2 = "0.19.0"
++git2 = "0.20.0"
+ openssl = { version = "0.10.68", optional = true }
+ 
+ 
+diff --git a/mit-commit-message-lints/Cargo.toml b/mit-commit-message-lints/Cargo.toml
+index 623b120b..042d71b6 100644
+--- a/mit-commit-message-lints/Cargo.toml
++++ b/mit-commit-message-lints/Cargo.toml
+@@ -18,7 +18,7 @@ time = { version = "0.3.37", features = ["local-offset"] }
+ glob = "0.3.2"
+ thiserror = "1.0.69"
+ miette = { version = "7.4.0", features = [ "fancy" ] }
+-git2 = "0.19.0"
++git2 = "0.20.0"
+ openssl = { version = "0.10.68", optional = true }
+ regex = "1.11.1"
+ serde_yaml = "0.9.34"
+diff --git a/mit-commit-msg/Cargo.toml b/mit-commit-msg/Cargo.toml
+index 3b8c626e..2c5e1a4f 100644
+--- a/mit-commit-msg/Cargo.toml
++++ b/mit-commit-msg/Cargo.toml
+@@ -16,7 +16,7 @@ tokio = { version = "1.43.0", features = ["full"] }
+ mit-lint = "3.2.9"
+ clap_complete = "4.5.42"
+ clap = { version = "4.5.26", features = ["derive", "cargo", "wrap_help", "env", "unicode" ] }
+-git2 = "0.19.0"
++git2 = "0.20.0"
+ openssl = { version = "0.10.68", optional = true }
+ miette = { version = "7.4.0", features = [ "fancy" ] }
+ mit-commit = "3.2.1"
+diff --git a/mit-hook-test-helper/Cargo.toml b/mit-hook-test-helper/Cargo.toml
+index 44131375..bccd79ab 100644
+--- a/mit-hook-test-helper/Cargo.toml
++++ b/mit-hook-test-helper/Cargo.toml
+@@ -14,7 +14,7 @@ description = "Testing help tools for git-mit"
+ 
+ [dependencies]
+ tempfile = "3.15.0"
+-git2 = "0.19.0"
++git2 = "0.20.0"
+ openssl = { version = "0.10.68", optional = true }
+ 
+ 
+diff --git a/mit-pre-commit/Cargo.toml b/mit-pre-commit/Cargo.toml
+index 40ff8a0f..4ce23ff7 100644
+--- a/mit-pre-commit/Cargo.toml
++++ b/mit-pre-commit/Cargo.toml
+@@ -16,7 +16,7 @@ thiserror = "1.0.69"
+ miette = { version = "7.4.0", features = [ "fancy" ] }
+ clap_complete = "4.5.42"
+ clap = { version = "4.5.26", features = ["derive", "cargo", "wrap_help", "env", "unicode" ] }
+-git2 = "0.19.0"
++git2 = "0.20.0"
+ openssl = { version = "0.10.68", optional = true }
+ mit-commit = "3.2.1"
+ 
+diff --git a/mit-prepare-commit-msg/Cargo.toml b/mit-prepare-commit-msg/Cargo.toml
+index fcbbcd14..2aa93263 100644
+--- a/mit-prepare-commit-msg/Cargo.toml
++++ b/mit-prepare-commit-msg/Cargo.toml
+@@ -19,7 +19,7 @@ miette = { version = "7.4.0", features = [ "fancy" ] }
+ shell-words = "1.1.0"
+ clap_complete = "4.5.42"
+ clap = { version = "4.5.26", features = ["derive", "cargo", "wrap_help", "env", "unicode" ] }
+-git2 = "0.19.0"
++git2 = "0.20.0"
+ openssl = { version = "0.10.68", optional = true }
+ mit-commit = "3.2.1"
+ 

pkgs/by-name/gi/git-mit/package.nix

···
   useFetchCargoVendor = true;
 
   cargoPatches = [
-    (fetchpatch {
-      name = "libgit2-update.patch";
-      url = "https://github.com/PurpleBooth/git-mit/pull/1543/commits/3e82a4f5017972c7d28151a468bb71fe7d2279e0.patch";
-      hash = "sha256-M9RpZHjOpZZqdHQe57LwMZ9zX6/4BNg3ymz8H3qupFk=";
-    })
+    # https://github.com/PurpleBooth/git-mit/pull/1543
+    ./libgit2-update.patch
   ];
 
   cargoHash = "sha256-uoS6vmHmOVkHS81mrsbbXqP/dAC/FNHAlpTDHSa632k=";

pkgs/by-name/jw/jwx/package.nix

···
   fetchFromGitHub,
 }:
 
-buildGoModule rec {
+buildGoModule (finalAttrs: {
   pname = "jwx";
-  version = "2.1.5";
+  version = "3.0.1";
 
   src = fetchFromGitHub {
     owner = "lestrrat-go";
-    repo = pname;
-    rev = "v${version}";
-    hash = "sha256-JDv1lqfhE16v3hJhf9OD2P2IS1KeLyewHxNlS7Ci2bk=";
+    repo = "jwx";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-ZVI32z1hUquDUWdaLZGtI0PncboVHx2FJ3BB4MAhX0w=";
   };
 
-  vendorHash = "sha256-ZS7xliFymXTE8hlc3GEMNonP5sJTZGirw5YQNzPCl3Y=";
+  vendorHash = "sha256-vyqsUZ7IxXI6LZKrSOPxheE/IISKRC0wXB7+xj51xLM=";
 
-  sourceRoot = "${src.name}/cmd/jwx";
+  sourceRoot = "${finalAttrs.src.name}/cmd/jwx";
 
-  meta = with lib; {
+  meta = {
     description = " Implementation of various JWx (Javascript Object Signing and Encryption/JOSE) technologies";
     mainProgram = "jwx";
     homepage = "https://github.com/lestrrat-go/jwx";
-    license = licenses.mit;
-    maintainers = with maintainers; [
+    changelog = "https://github.com/lestrrat-go/jwx/blob/v${finalAttrs.version}/Changes";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [
       arianvp
       flokli
     ];
   };
-}
+})

pkgs/by-name/kr/krita-plugin-gmic/package.nix

···
   nativeBuildInputs = [
     cmake
     extra-cmake-modules
+    libsForQt5.qttools
   ];
 
   buildInputs = [
     fftw
     krita.unwrapped
     libsForQt5.kcoreaddons
-    libsForQt5.qttools
   ];
+
+  strictDeps = true;
 
   cmakeFlags = [
     (lib.cmakeFeature "GMIC_QT_HOST" "krita-plugin")

pkgs/by-name/po/postfix/package.nix

···
 in
 stdenv.mkDerivation rec {
   pname = "postfix";
-  version = "3.10.1";
+  version = "3.10.2";
 
   src = fetchurl {
     url = "https://de.postfix.org/ftpmirror/official/postfix-${version}.tar.gz";
-    hash = "sha256-dYaNt6jtJSzToUwTo844Pd1CVjFgwCAn0GEgLuNnmb8=";
+    hash = "sha256-vMpWQTLUz1+cnONU2rndNe6OniGQCGRiPIFdrBa/vCc=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/vi/vice/package.nix

···
   wrapGAppsHook3,
   xdg-utils,
   libevdev,
+  pulseaudio,
 }:
 
 stdenv.mkDerivation rec {
···
     xa
     xdg-utils
     libevdev
+    pulseaudio
   ];
   dontDisableStatic = true;
   configureFlags = [

pkgs/by-name/vi/video-downloader/package.nix

···
 
 python3Packages.buildPythonApplication rec {
   pname = "video-downloader";
-  version = "0.12.24";
+  version = "0.12.25";
   pyproject = false; # Built with meson
 
   src = fetchFromGitHub {
     owner = "Unrud";
     repo = "video-downloader";
     tag = "v${version}";
-    hash = "sha256-lgHAO4/dqwwp/PiIFHCBRfDNUw0GfomMvfaobakxFdA=";
+    hash = "sha256-1riIOYXtiC06n2M/eFjsydqrkCvBtrGkHKEJWiTJ8/8=";
   };
 
   propagatedBuildInputs = with python3Packages; [

pkgs/by-name/zw/zwave-js-ui/package.nix

···
 
 buildNpmPackage rec {
   pname = "zwave-js-ui";
-  version = "10.3.0";
+  version = "10.3.3";
 
   src = fetchFromGitHub {
     owner = "zwave-js";
     repo = "zwave-js-ui";
     tag = "v${version}";
-    hash = "sha256-RfjjGpQhjpRV/+Uqh/uki9GRQQ3IrkyPkYY9hWUGWoA=";
+    hash = "sha256-SZIGwv/9aCA5/cZk8n32tkI/vu0oLw/t3dOJgf+km7c=";
   };
-  npmDepsHash = "sha256-vjHqL3t5FiBWlh2lEeRr31Ynyu4peHyMC82zHsBbQ8E=";
+  npmDepsHash = "sha256-i3ug7syt4ElLiHV/kdwoaNvPYDsTdjlIg4XQbkB+Q4A=";
 
   passthru.tests.zwave-js-ui = nixosTests.zwave-js-ui;
 

pkgs/development/haskell-modules/configuration-common.nix

···
   feed = dontCheck super.feed;
 
   spacecookie = overrideCabal (old: {
+    # Security relevant patch update
+    version = "1.0.0.3";
+    sha256 = "1kzzbq22dk277jcx04w154y4vwa92zmnf40jcbgiihkz5rvisix0";
+
     buildTools = (old.buildTools or [ ]) ++ [ pkgs.buildPackages.installShellFiles ];
     # let testsuite discover the resulting binary
     preCheck =

pkgs/development/haskell-modules/configuration-darwin.nix

···
       __darwinAllowLocalNetworking = true;
     });
 
+    spacecookie = super.spacecookie.overrideAttrs (_: {
+      __darwinAllowLocalNetworking = true;
+    });
+
     streaming-commons = super.streaming-commons.overrideAttrs (_: {
       __darwinAllowLocalNetworking = true;
     });

pkgs/development/libraries/qt-6/modules/qtwebengine/default.nix

···
 
     # Fix build with Pipewire 1.4
     ./pipewire-1.4.patch
+    # Reproducibility QTBUG-136068
+    ./gn-object-sorted.patch
   ];
 
   postPatch =

pkgs/development/libraries/qt-6/modules/qtwebengine/gn-object-sorted.patch

···
+diff --git a/gn/src/gn/rsp_target_writer.cc b/gn/src/gn/rsp_target_writer.cc
+index 6c1c687e99d..097b84b317e 100644
+--- a/src/3rdparty/gn/src/gn/rsp_target_writer.cc
++++ b/src/3rdparty/gn/src/gn/rsp_target_writer.cc
+@@ -117,8 +117,7 @@ void RspTargetWriter::Run() {
+       PathOutput path_output(settings->build_settings()->build_dir(),
+                              settings->build_settings()->root_path_utf8(),
+                              ESCAPE_NONE);
+-      std::vector<SourceFile> object_files;
+-      object_files.reserve(target_->sources().size());
++      std::set<SourceFile> object_files;
+ 
+       for (const auto& source : target_->sources()) {
+         const char* tool_type = nullptr;
+@@ -128,7 +127,7 @@ void RspTargetWriter::Run() {
+             other_files.push_back(source);
+           continue;  // No output for this source.
+         }
+-        object_files.push_back(
++        object_files.insert(
+             tool_outputs[0].AsSourceFile(settings->build_settings()));
+       }
+       if (target_->config_values().has_precompiled_headers()) {
+@@ -137,7 +136,7 @@ void RspTargetWriter::Run() {
+         if (tool_cxx && tool_cxx->precompiled_header_type() == CTool::PCH_MSVC) {
+           GetPCHOutputFiles(target_, CTool::kCToolCxx, &tool_outputs);
+           if (!tool_outputs.empty())
+-            object_files.push_back(
++            object_files.insert(
+                 tool_outputs[0].AsSourceFile(settings->build_settings()));
+         }
+       }

pkgs/development/python-modules/nbsphinx/default.nix

···
 {
   lib,
   buildPythonPackage,
+  fetchpatch,
   fetchPypi,
   setuptools,
   docutils,
···
     inherit pname version;
     hash = "sha256-q9KYpobVX6iU72l8UdRPJOU6oxLa2uOOgpIPJQpUVv4=";
   };
+  patches = [
+    (fetchpatch {
+      url = "https://github.com/spatialaudio/nbsphinx/commit/a921973a5d8ecc39c6e02184572b79ab72c9978c.patch";
+      hash = "sha256-uxfSaOESWn8uVcUm+1ADzQgMQDEqaTs0TbfNYsS+E6I=";
+    })
+  ];
 
   build-system = [ setuptools ];
 

pkgs/development/tools/build-managers/gradle/default.nix

···
   # https://docs.gradle.org/current/userguide/compatibility.html
 
   gradle_8 = gen {
-    version = "8.13";
-    hash = "sha256-IPGxF2I3JUpvwgTYQ0GW+hGkz7OHVnUZxhVW6HEK7Xg=";
+    version = "8.14";
+    hash = "sha256-Ya0xDTx9Pl2hMbdrvyK1pMB4bp2JLa6MFljUtITePKo=";
     defaultJava = jdk21;
   };
 

pkgs/games/pokerth/default.nix

···
   qtbase,
   SDL,
   SDL_mixer,
-  boost,
+  boost181,
   curl,
   gsasl,
   libgcrypt,
···
   tinyxml2,
   target ? "client",
 }:
+
+let
+  boost = boost181;
+in
 
 mkDerivation rec {
   pname = "pokerth-${target}";

pkgs/tools/misc/screen/default.nix

···
   ];
 
   # We need _GNU_SOURCE so that mallocmock_reset() is defined: https://savannah.gnu.org/bugs/?66416
-  NIX_CFLAGS_COMPILE = lib.optionalString (stdenv.cc.isGNU) "-D_GNU_SOURCE=1 -Wno-int-conversion -Wno-incompatible-pointer-types";
+  NIX_CFLAGS_COMPILE = "-D_GNU_SOURCE=1 -Wno-int-conversion -Wno-incompatible-pointer-types";
 
   patches = [
     # GNU Screen 5.0 uses strncpy incorrectly in SendCmdMessage
···
   ];
 
   # The test suite seems to have some glibc malloc hooks that don't exist/link on macOS
-  doCheck = !stdenv.hostPlatform.isDarwin;
+  # With pkgsLLVM: tests/test-winmsgcond.c:53: assertion 'wmc_end(&wmc, pos + 1, &chg) == pos' failed
+  doCheck = !stdenv.hostPlatform.isDarwin && !stdenv.hostPlatform.useLLVM;
 
   meta = with lib; {
     homepage = "https://www.gnu.org/software/screen/";