Merge staging-next into staging

nixos/doc/manual/release-notes/rl-2111.section.md

···
 - [opensnitch](https://github.com/evilsocket/opensnitch), an application firewall. Available as [services.opensnitch](#opt-services.opensnitch.enable).
 
 - [snapraid](https://www.snapraid.it/), a backup program for disk arrays.
-  Available as [snapraid](#opt-snapraid.enable).
+  Available as [snapraid](#opt-services.snapraid.enable).
 
 - [Hockeypuck](https://github.com/hockeypuck/hockeypuck), a OpenPGP Key Server. Available as [services.hockeypuck](#opt-services.hockeypuck.enable).
 

nixos/doc/manual/release-notes/rl-2311.section.md

···
 - When using [split parity files](https://www.snapraid.it/manual#7.1) in `snapraid`,
   the snapraid-sync systemd service will no longer fail to run.
 
+- `wpa_supplicant`'s configuration file cannot be read by non-root users, and
+  secrets (such as Pre-Shared Keys) can safely be passed via
+  `networking.wireless.environmentFile`.
+
+  The configuration file could previously be read, when `userControlled.enable` (non-default),
+  by users who are in both `wheel` and `userControlled.group` (defaults to `wheel`)
+
+
 ## Nixpkgs Library {#sec-release-23.11-nixpkgs-lib}
 
 ### Breaking Changes {#sec-release-23.11-lib-breaking}

nixos/modules/module-list.nix

···
   ./services/backup/mysql-backup.nix
   ./services/backup/postgresql-backup.nix
   ./services/backup/postgresql-wal-receiver.nix
+  ./services/backup/snapraid.nix
   ./services/backup/restic-rest-server.nix
   ./services/backup/restic.nix
   ./services/backup/rsnapshot.nix
···
   ./tasks/network-interfaces.nix
   ./tasks/powertop.nix
   ./tasks/scsi-link-power-management.nix
-  ./tasks/snapraid.nix
   ./tasks/stratis.nix
   ./tasks/swraid.nix
   ./tasks/trackpoint.nix

nixos/modules/programs/wayland/river.nix

···
 
         # To make a river session available if a display manager like SDDM is enabled:
         services.xserver.displayManager.sessionPackages = optionals (cfg.package != null) [ cfg.package ];
+
+        # https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1050913
+        xdg.portal.config.river.default = mkDefault [ "wlr" "gtk" ];
       }
       (import ./wayland-session.nix { inherit lib pkgs; })
     ]);

nixos/modules/services/hardware/udev.nix

···
         description = lib.mdDoc ''
           Packages added to the {env}`PATH` environment variable when
           executing programs from Udev rules.
+
+          coreutils, gnu{sed,grep}, util-linux and config.systemd.package are
+          automatically included.
         '';
       };
 

nixos/modules/services/matrix/synapse.md

···
 
 ## Synapse Homeserver {#module-services-matrix-synapse}
 
-[Synapse](https://github.com/matrix-org/synapse) is
+[Synapse](https://github.com/element-hq/synapse) is
 the reference homeserver implementation of Matrix from the core development
 team at matrix.org. The following configuration example will set up a
 synapse server for the `example.org` domain, served from
 the host `myhostname.example.org`. For more information,
 please refer to the
-[installation instructions of Synapse](https://matrix-org.github.io/synapse/latest/setup/installation.html) .
+[installation instructions of Synapse](https://element-hq.github.io/synapse/latest/setup/installation.html) .
 ```
 { pkgs, lib, config, ... }:
 let
···
         # the domain (i.e. example.org from @foo:example.org) and the federation port
         # is 8448.
         # Further reference can be found in the docs about delegation under
-        # https://matrix-org.github.io/synapse/latest/delegate.html
+        # https://element-hq.github.io/synapse/latest/delegate.html
         locations."= /.well-known/matrix/server".extraConfig = mkWellKnown serverConfig;
         # This is usually needed for homeserver discovery (from e.g. other Matrix clients).
         # Further reference can be found in the upstream docs at
···
 ::: {.note}
 It's also possible to user alternative authentication mechanism such as
 [LDAP (via `matrix-synapse-ldap3`)](https://github.com/matrix-org/matrix-synapse-ldap3)
-or [OpenID](https://matrix-org.github.io/synapse/latest/openid.html).
+or [OpenID](https://element-hq.github.io/synapse/latest/openid.html).
 :::
 
 ## Element (formerly known as Riot) Web Client {#module-services-matrix-element-web}

nixos/modules/services/matrix/synapse.nix

···
         default = { };
         description = mdDoc ''
           The primary synapse configuration. See the
-          [sample configuration](https://github.com/matrix-org/synapse/blob/v${pkgs.matrix-synapse-unwrapped.version}/docs/sample_config.yaml)
+          [sample configuration](https://github.com/element-hq/synapse/blob/v${pkgs.matrix-synapse-unwrapped.version}/docs/sample_config.yaml)
           for possible values.
 
           Secrets should be passed in by using the `extraConfigFiles` option.
···
                     by the module, but in practice it broke on runtime and as a result, no URL
                     preview worked anywhere if this was set.
 
-                    See https://matrix-org.github.io/synapse/latest/usage/configuration/config_documentation.html#url_preview_url_blacklist
+                    See https://element-hq.github.io/synapse/latest/usage/configuration/config_documentation.html#url_preview_url_blacklist
                     on how to configure it properly.
                   ''))
                   (types.attrsOf types.str));
···
                 Redis configuration for synapse.
 
                 See the
-                [upstream documentation](https://github.com/matrix-org/synapse/blob/v${pkgs.matrix-synapse-unwrapped.version}/usage/configuration/config_documentation.md#redis)
+                [upstream documentation](https://github.com/element-hq/synapse/blob/v${pkgs.matrix-synapse-unwrapped.version}/docs/usage/configuration/config_documentation.md#redis)
                 for available options.
               '';
             };
···
         description = lib.mdDoc ''
           Options for configuring workers. Worker support will be enabled if at least one worker is configured here.
 
-          See the [worker documention](https://matrix-org.github.io/synapse/latest/workers.html#worker-configuration)
+          See the [worker documention](https://element-hq.github.io/synapse/latest/workers.html#worker-configuration)
           for possible options for each worker. Worker-specific options overriding the shared homeserver configuration can be
           specified here for each worker.
 
···
             using [`services.matrix-synapse.configureRedisLocally`](#opt-services.matrix-synapse.configureRedisLocally).
 
             Workers also require a proper reverse proxy setup to direct incoming requests to the appropriate process. See
-            the [reverse proxy documentation](https://matrix-org.github.io/synapse/latest/reverse_proxy.html) for a
+            the [reverse proxy documentation](https://element-hq.github.io/synapse/latest/reverse_proxy.html) for a
             general reverse proxying setup and
-            the [worker documentation](https://matrix-org.github.io/synapse/latest/workers.html#available-worker-applications)
+            the [worker documentation](https://element-hq.github.io/synapse/latest/workers.html#available-worker-applications)
             for the available endpoints per worker application.
           :::
         '';
···
                 The file for log configuration.
 
                 See the [python documentation](https://docs.python.org/3/library/logging.config.html#configuration-dictionary-schema)
-                for the schema and the [upstream repository](https://github.com/matrix-org/synapse/blob/v${pkgs.matrix-synapse-unwrapped.version}/docs/sample_log_config.yaml)
+                for the schema and the [upstream repository](https://github.com/element-hq/synapse/blob/v${pkgs.matrix-synapse-unwrapped.version}/docs/sample_log_config.yaml)
                 for an example.
               '';
             };

nixos/modules/services/networking/vdirsyncer.nix

···
     else
       pkgs.writeText "vdirsyncer-${name}.conf" (toIniJson (
         {
-          general = cfg'.config.general // (lib.optionalAttrs (cfg'.config.statusPath == null) {
-            status_path = "/var/lib/vdirsyncer/${name}";
-          });
+          general = cfg'.config.general // {
+            status_path = if cfg'.config.statusPath == null
+                          then "/var/lib/vdirsyncer/${name}"
+                          else cfg'.config.statusPath;
+          };
         } // (
           mapAttrs' (name: nameValuePair "pair ${name}") cfg'.config.pairs
         ) // (

nixos/modules/services/networking/wpa_supplicant.nix

···
       stopIfChanged = false;
 
       path = [ package ];
+      # if `userControl.enable`, the supplicant automatically changes the permissions
+      #  and owning group of the runtime dir; setting `umask` ensures the generated
+      #  config file isn't readable (except to root);  see nixpkgs#267693
+      serviceConfig.UMask = "066";
       serviceConfig.RuntimeDirectory = "wpa_supplicant";
       serviceConfig.RuntimeDirectoryMode = "700";
       serviceConfig.EnvironmentFile = mkIf (cfg.environmentFile != null)

nixos/modules/tasks/snapraid.nix nixos/modules/services/backup/snapraid.nix

···
 
 with lib;
 
-let cfg = config.snapraid;
+let cfg = config.services.snapraid;
 in
 {
-  options.snapraid = with types; {
+  imports = [
+    # Should have never been on the top-level.
+    (mkRenamedOptionModule [ "snapraid" ] [ "services" "snapraid" ])
+  ];
+
+  options.services.snapraid = with types; {
     enable = mkEnableOption (lib.mdDoc "SnapRAID");
     dataDisks = mkOption {
       default = { };

nixos/tests/ceph-single-node.nix

···
     monA.wait_until_succeeds("ceph -s | grep 'mgr: ${cfg.monA.name}(active,'")
     monA.wait_until_succeeds("ceph -s | grep 'HEALTH_OK'")
 
+    # This test has been commented out due to the upstream issue with pyo3
+    # that has broken this dashboard
+    # Reference: https://www.spinics.net/lists/ceph-users/msg77812.html
     # Enable the dashboard and recheck health
-    monA.succeed(
-        "ceph mgr module enable dashboard",
-        "ceph config set mgr mgr/dashboard/ssl false",
-        # default is 8080 but it's better to be explicit
-        "ceph config set mgr mgr/dashboard/server_port 8080",
-    )
-    monA.wait_for_open_port(8080)
-    monA.wait_until_succeeds("curl -q --fail http://localhost:8080")
-    monA.wait_until_succeeds("ceph -s | grep 'HEALTH_OK'")
+    # monA.succeed(
+    #     "ceph mgr module enable dashboard",
+    #     "ceph config set mgr mgr/dashboard/ssl false",
+    #     # default is 8080 but it's better to be explicit
+    #     "ceph config set mgr mgr/dashboard/server_port 8080",
+    # )
+    # monA.wait_for_open_port(8080)
+    # monA.wait_until_succeeds("curl -q --fail http://localhost:8080")
+    # monA.wait_until_succeeds("ceph -s | grep 'HEALTH_OK'")
   '';
 in {
   name = "basic-single-node-ceph-cluster";

pkgs/applications/graphics/pdfcpu/default.nix

···
 
 buildGoModule rec {
   pname = "pdfcpu";
-  version = "0.5.0";
+  version = "0.6.0";
 
   src = fetchFromGitHub {
     owner = "pdfcpu";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-dEAlOKjNXL7zqlll6lqGmbopjdplDR3ewMMNu9TMsmw=";
+    hash = "sha256-New0+pWtKdEx/k69pNisNKYj6p998HoEjAhQEDugP/g=";
+    # Apparently upstream requires that the compiled executable will know the
+    # commit hash and the date of the commit. This information is also presented
+    # in the output of `pdfcpu version` which we use as a sanity check in the
+    # installCheckPhase. This was discussed upstream in:
+    #
+    # - https://github.com/pdfcpu/pdfcpu/issues/751
+    # - https://github.com/pdfcpu/pdfcpu/pull/752
+    #
+    # The trick used here is to write that information into files in `src`'s
+    # `$out`, and then read them into the `ldflags`. We also delete the `.git`
+    # directories in `src`'s $out afterwards, imitating what's done if
+    # `leaveDotGit = false;` See also:
+    # https://github.com/NixOS/nixpkgs/issues/8567
+    leaveDotGit = true;
+    postFetch = ''
+      cd "$out"
+      git rev-parse HEAD > $out/COMMIT
+      git log -1 --pretty=%cd --date=format:'%Y-%m-%dT%H:%M:%SZ' > $out/SOURCE_DATE
+      find "$out" -name .git -print0 | xargs -0 rm -rf
+    '';
   };
 
-  vendorHash = "sha256-WZsm2wiKedMP0miwnzhnSrF7Qw+jqd8dnpcehlsdMCA=";
+  vendorHash = "sha256-jVX/CFf9dd9qD3gyGVDjbfINtPLCsgdjWFix4BCpDZ0=";
+
+  ldflags = [
+    "-s"
+    "-w"
+    "-X main.version=v${version}"
+  ];
+
+  # ldflags based on metadata from git and source
+  preBuild = ''
+    ldflags+=" -X main.commit=$(cat COMMIT)"
+    ldflags+=" -X main.date=$(cat SOURCE_DATE)"
+  '';
+
 
   # No tests
   doCheck = false;
···
     export HOME=$(mktemp -d)
     echo checking the version print of pdfcpu
     $out/bin/pdfcpu version | grep ${version}
+    $out/bin/pdfcpu version | grep $(cat COMMIT | cut -c1-8)
+    $out/bin/pdfcpu version | grep $(cat SOURCE_DATE)
   '';
 
   subPackages = [ "cmd/pdfcpu" ];

pkgs/applications/networking/cluster/terragrunt/default.nix

···
 
 buildGoModule rec {
   pname = "terragrunt";
-  version = "0.54.1";
+  version = "0.54.3";
 
   src = fetchFromGitHub {
     owner = "gruntwork-io";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-BbJ8XJ2zdKm1awDEkWZIZMDku/NWN3Y+nl/GtBBHgBQ=";
+    hash = "sha256-ZtBWp121+Gvt1BMLUAjtMW7fgVlqRjXXspeHmbEWGOU=";
   };
 
   vendorHash = "sha256-OIkrDvNk4XD11j/+BdOkzbw86cYUj0Vz7pZ5/vIZopY=";

pkgs/applications/networking/coreth/default.nix

···
 
 buildGoModule rec {
   pname = "coreth";
-  version = "0.12.6";
+  version = "0.12.7";
 
   src = fetchFromGitHub {
     owner = "ava-labs";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-AmlDOtV6uQtrscvIgK5kz6PldA7a1XrVuwO4DCFZeno=";
+    hash = "sha256-voNUnQ0CWM0aGiVkIucn6eRJCp0ajz7hYKBFkYsKPu0=";
   };
 
   # go mod vendor has a bug, see: golang/go#57529
   proxyVendor = true;
 
-  vendorHash = "sha256-v1DoRZuv6k6UIgPirXMbvunttn1aBLbTc+GdtdKquDk=";
+  vendorHash = "sha256-adxPB3JPnAf6AxUZjgciK7nJguQWyeYy2/qfePVUouE=";
 
   ldflags = [
     "-s"

pkgs/applications/networking/discordo/default.nix

···
 
 buildGoModule rec {
   pname = "discordo";
-  version = "unstable-2023-12-11";
+  version = "unstable-2023-12-12";
 
   src = fetchFromGitHub {
     owner = "ayn2op";
     repo = pname;
-    rev = "9c9ea0dc2fdd4ca18c68b08585bcc5b276388d62";
-    hash = "sha256-6gGbro4OsPh+HK9GR01uOUN80lgwMd7oLq9ASWtpNoY=";
+    rev = "320ec7753d552974d4d5ede3fcf6fb3c0d52b6e4";
+    hash = "sha256-LVWOXw8+GbCE6N6kVSXDjjNqOcq7PS4KU7LXoowhBdQ=";
   };
 
   vendorHash = "sha256-8qr1erKGyJvR4LDKHkZf7nR0tQOcvUHQyJt7OlqNS44=";

pkgs/applications/networking/diswall/default.nix

···
 in
 rustPlatform.buildRustPackage rec {
   pname = "diswall";
-  version = "0.4.2";
+  version = "0.4.3";
 
   src = fetchFromGitHub {
     owner = "dis-works";
     repo = "diswall-rs";
     rev = "v${version}";
-    sha256 = "sha256-uWGpSpT8TyEkF5OI2enZwbcsyoHIemC0Dm1LExi+AC8=";
+    sha256 = "sha256-RchpdIS5RKe6Ck2kYQHeq5Dl+ZBWdO/+ZHuFyfYmyMc=";
   };
 
   buildInputs = lib.optionals stdenv.isDarwin [
     Security
   ];
 
-  cargoHash = "sha256-Te2mqrBKHDKbFaO0ZNV2C6AHz07v1jWCMm05YiXg+w0=";
+  cargoHash = "sha256-AUDTPFRntxk84o9f4wfai04tBMFM2ItNGc3W9lcZ1as=";
 
   doCheck = false;
 

pkgs/applications/networking/instant-messengers/beeper/default.nix

···
 }:
 let
   pname = "beeper";
-  version = "3.89.3";
+  version = "3.90.11";
   name = "${pname}-${version}";
   src = fetchurl {
-    url = "https://download.todesktop.com/2003241lzgn20jd/beeper-3.89.3-build-231206totezhepd.AppImage";
-    hash = "sha256-o4mD2LcWnlw9EIuv0v//51uByaAAxKcJNz9mKjp/Jp8=";
+    url = "https://download.todesktop.com/2003241lzgn20jd/beeper-3.90.11-build-2312112f0wxx20y.AppImage";
+    hash = "sha256-ZYv0PUvZiw8pcszCVCd7mHE/+VHb+I25OPu5R7vI1j4=";
   };
   appimage = appimageTools.wrapType2 {
     inherit version pname src;

pkgs/applications/networking/nali/default.nix

···
 
 buildGoModule rec {
   pname = "nali";
-  version = "0.8.0";
+  version = "0.8.1";
 
   src = fetchFromGitHub {
     owner = "zu1k";
     repo = "nali";
     rev = "v${version}";
-    hash = "sha256-JIP0QX1okCfDj2Y6wZ5TaV3QH0WP3oU3JjaKK6vMfWY=";
+    hash = "sha256-5AI8TAKYFqjgLVKob9imrf7yVmXmAPq/zHh1bDfC5r0=";
   };
 
   vendorHash = "sha256-wIp/ShUddz+RIcsEuKWUfxsV/wNB2X1jZtIltBZ0ROM=";

pkgs/applications/office/paperless-ngx/default.nix

···
 }:
 
 let
-  version = "2.1.1";
+  version = "2.1.2";
 
   src = fetchFromGitHub {
     owner = "paperless-ngx";
     repo = "paperless-ngx";
     rev = "refs/tags/v${version}";
-    hash = "sha256-/f0al6OyYo8FTOWiNFoKUYWpY0nz3qFOB00QKIvS3Dk=";
+    hash = "sha256-jD0dRgU/9gtNZUuTV+zkjqWb8gBnvD/AOTPucdaVKwE=";
   };
 
   python = python3;

pkgs/applications/science/math/eigenmath/default.nix

···
 
 stdenv.mkDerivation rec {
   pname = "eigenmath";
-  version = "unstable-2023-12-11";
+  version = "unstable-2023-12-12";
 
   src = fetchFromGitHub {
     owner = "georgeweigt";
     repo = pname;
-    rev = "a493ce81dc1b8801bb4d853af903bb084da0d17e";
-    hash = "sha256-Ej5cJrwJiTkEKJGNlfb+KBH13ISP89cYqDVNq8Iy0Gg=";
+    rev = "bec2c9bd0750ec7970f6c701e619565c9d348e84";
+    hash = "sha256-+VohU8mkFjZ0zhjmri0KY1kTzPLn2q5Au4nEBdXcR+8=";
   };
 
   checkPhase = let emulator = stdenv.hostPlatform.emulator buildPackages; in ''

pkgs/applications/video/droidcam/default.nix

···
 
 stdenv.mkDerivation rec {
   pname = "droidcam";
-  version = "2.1.0";
+  version = "2.1.1";
 
   src = fetchFromGitHub {
     owner = "aramg";
     repo = "droidcam";
     rev = "v${version}";
-    sha256 = "sha256-1VEaUm1194gF1/0zrK31SkI7POhi5eK6yYC0Cw/W4Ao=";
+    sha256 = "sha256-NdVnls1DvcaI/bVrc5gN96+KQZDgt0M8zkNn93QJYG0=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/ek/eksctl/package.nix

···
 
 buildGoModule rec {
   pname = "eksctl";
-  version = "0.164.0";
+  version = "0.165.0";
 
   src = fetchFromGitHub {
     owner = "weaveworks";
     repo = pname;
     rev = version;
-    hash = "sha256-ENlMcwk4bMbIzV353vt+EG776+/ajrg5la3JeA81QS4=";
+    hash = "sha256-Gx8HobnE7qAfX79ZSLaN8fki+TQYz6XLyxnoSpvFOyk=";
   };
 
-  vendorHash = "sha256-NOhssVWEkvoXpmnsCVVT7Li0ePGWDSGIlB2MyFtMnpI=";
+  vendorHash = "sha256-niULedV/9r3PFI69AenGfk3oCTvKE/h6edjW5sgHg3Q=";
 
   doCheck = false;
 

pkgs/by-name/of/offpunk/package.nix

···
 in
 python3Packages.buildPythonPackage rec {
   pname = "offpunk";
-  version = "2.0";
+  version = "2.1";
   format = "pyproject";
 
   disabled = python3Packages.pythonOlder "3.7";
···
     owner = "~lioploum";
     repo = "offpunk";
     rev = "v${version}";
-    hash = "sha256-6ftc2goCNgvXf5kszvjeSHn24Hn73jq26Irl5jiN6pk=";
+    hash = "sha256-IFqasTI2dZCauLUAq6/rvwkfraVK7SGUXpHCPEgSPGk=";
   };
 
   nativeBuildInputs = [ python3Packages.hatchling installShellFiles ];
···
   postInstall = ''
     installManPage man/*.1
   '';
+
+  passthru.tests.version = testers.testVersion { package = offpunk; };
 
   meta = with lib; {
     description = "An Offline-First browser for the smolnet ";

pkgs/by-name/ve/vesktop/package.nix

···
 , pipewire
 , libpulseaudio
 , libicns
+, libnotify
 , jq
 , moreutils
 , cacert
···
       # this is mainly required for venmic
       libPath = lib.makeLibraryPath [
         libpulseaudio
+        libnotify
         pipewire
         gcc13Stdenv.cc.cc.lib
       ];

pkgs/data/misc/clash-geoip/default.nix

···
 
 stdenvNoCC.mkDerivation rec {
   pname = "clash-geoip";
-  version = "20231112";
+  version = "20231212";
 
   src = fetchurl {
     url = "https://github.com/Dreamacro/maxmind-geoip/releases/download/${version}/Country.mmdb";
-    sha256 = "sha256-CTygf2/CbxNO/9e8OfxeGZFaSrKXdlQdvUgywZX1U9o=";
+    sha256 = "sha256-h6EojfOWfDwD5Akvb8NrSvg3xyQZhOUrKhUxlWwio8A=";
   };
 
   dontUnpack = true;

pkgs/desktops/deepin/core/dde-launchpad/default.nix

···
 
 stdenv.mkDerivation rec {
   pname = "dde-launchpad";
-  version = "0.2.1";
+  version = "0.3.0";
 
   src = fetchFromGitHub {
     owner = "linuxdeepin";
     repo = pname;
     rev = version;
-    hash = "sha256-o9YKmtaqa4ykoR75V2OpXm4GRPWHI6WKbxWAzY1b8I0=";
+    hash = "sha256-8m0DjQYih3hB/n2VHuJgUYBe8tpGwBU0NdkLxr1OsFc=";
   };
 
   nativeBuildInputs = [

pkgs/desktops/gnome/extensions/extensionRenames.nix

···
   "[e-mail]" = "azan-islamic-prayer-times";
   "[e-mail]" = null;
 
-  # That extension is broken because of https://github.com/NixOS/nixpkgs/issues/118612
-  "[e-mail]" = null;
-
   # ############################################################################
   # Overrides for extensions that were manually packaged in the past but are gradually
   # being replaced by automatic packaging where possible.

pkgs/desktops/pantheon/apps/elementary-files/default.nix

···
 , libhandy
 , granite
 , pango
-, elementary-dock
 , bamf
 , sqlite
 , zeitgeist
···
 
 stdenv.mkDerivation rec {
   pname = "elementary-files";
-  version = "6.5.2";
+  version = "6.5.3";
 
   outputs = [ "out" "dev" ];
 
···
     owner = "elementary";
     repo = "files";
     rev = version;
-    sha256 = "sha256-YwXyqZ0exwQ3Qx+VWWyTTmhqCVr6be8tqzS1k3Luo8o=";
+    sha256 = "sha256-geJLHRo1Bd2oFT+UtirHj9FVSFTFMK/v/5h+NF9woFo=";
   };
 
   nativeBuildInputs = [
···
 
   buildInputs = [
     bamf
-    elementary-dock
     glib
     granite
     gtk3

pkgs/development/python-modules/alembic/default.nix

···
     description = "A database migration tool for SQLAlchemy";
     license = licenses.mit;
     maintainers = with maintainers; [ ];
+    mainProgram = "alembic";
   };
 }

pkgs/development/python-modules/b2sdk/default.nix

···
 
 buildPythonPackage rec {
   pname = "b2sdk";
-  version = "1.24.1";
+  version = "1.29.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-Tp9RjtybqCSxB1gFZXrjwNJ4mmwl+OWTzVyHd250Jas=";
+    hash = "sha256-h/pXLGpQ2+ENxWqIb9yteroaudsS8Hz+sraON+65TMw=";
   };
 
   nativeBuildInputs = [
···
   propagatedBuildInputs = [
     logfury
     requests
-    tqdm
   ] ++ lib.optionals (pythonOlder "3.8") [
     importlib-metadata
   ] ++ lib.optionals (pythonOlder "3.12") [
···
     "test_raw_api"
     "test_files_headers"
     "test_large_file"
+    "test_file_info_b2_attributes"
   ];
 
   pythonImportsCheck = [

pkgs/development/python-modules/gunicorn/default.nix

···
     description = "gunicorn 'Green Unicorn' is a WSGI HTTP Server for UNIX, fast clients and sleepy applications";
     license = licenses.mit;
     maintainers = with maintainers; [ ];
+    mainProgram = "gunicorn";
   };
 }

pkgs/development/python-modules/jupyter-server/default.nix

···
 
 buildPythonPackage rec {
   pname = "jupyter-server";
-  version = "2.10.1";
+  version = "2.12.1";
   format = "pyproject";
   disabled = pythonOlder "3.8";
 
   src = fetchPypi {
     pname = "jupyter_server";
     inherit version;
-    hash = "sha256-5tomV6lUp4ee7SjMCOCBewH/2B1+q4Y0ZgOXtV+SZHI=";
+    hash = "sha256-3He33MX8BUesuisoRPAXmACGZyAe6ifGMZ/5JX1wCm0=";
   };
 
   nativeBuildInputs = [

pkgs/development/python-modules/weasel/default.nix

···
 , fetchFromGitHub
 , setuptools
 , wheel
-, black
 , cloudpathlib
 , confection
-, isort
-, mypy
 , packaging
-, pre-commit
 , pydantic
-, pytest
 , requests
-, ruff
 , smart-open
 , srsly
 , typer
-, types-requests
-, types-setuptools
 , wasabi
 , pytestCheckHook
 }:
···
   ];
 
   propagatedBuildInputs = [
-    black
     cloudpathlib
     confection
-    isort
-    mypy
     packaging
-    pre-commit
     pydantic
-    pytest
     requests
-    ruff
     smart-open
     srsly
     typer
-    types-requests
-    types-setuptools
     wasabi
   ];
 

pkgs/development/tools/analysis/codeql/default.nix

···
 
 stdenv.mkDerivation rec {
   pname = "codeql";
-  version = "2.15.1";
+  version = "2.15.4";
 
   dontConfigure = true;
   dontBuild = true;
···
 
   src = fetchzip {
     url = "https://github.com/github/codeql-cli-binaries/releases/download/v${version}/codeql.zip";
-    hash = "sha256-ksWf5z0PM5osMxnR5XeEyZw4g7UbHUCqnpw2FB5M6kU=";
+    hash = "sha256-aFkaylIgryFYPhY5/OGCRHJMR7EJqNg83c34a2+WMX4=";
   };
 
   nativeBuildInputs = [

pkgs/development/tools/backblaze-b2/default.nix

···
 
 python3Packages.buildPythonApplication rec {
   pname = "backblaze-b2";
-  version = "3.9.0";
+  version = "3.15.0";
   format = "setuptools";
 
   src = fetchPypi {
     inherit version;
     pname = "b2";
-    hash = "sha256-Z9LQapWl0zblcAyMOfKhn5/O1H6+tmgiPQfAB241jqU=";
+    hash = "sha256-10c2zddALy7+CGxhjUC6tMLQcZ3WmLeRY1bNKWunAys=";
   };
 
   postPatch = ''
···
     arrow
     b2sdk
     phx-class-registry
-    setuptools
     docutils
     rst2ansi
     tabulate
     tqdm
+    platformdirs
+    packaging
   ];
 
   nativeCheckInputs = with python3Packages; [
···
 
     # it's hard to make it work on nix
     "test/integration/test_autocomplete.py"
+    "test/unit/console_tool"
   ];
 
   postInstall = ''

pkgs/development/tools/conftest/default.nix

···
 
 buildGoModule rec {
   pname = "conftest";
-  version = "0.46.0";
+  version = "0.47.0";
 
   src = fetchFromGitHub {
     owner = "open-policy-agent";
     repo = "conftest";
     rev = "refs/tags/v${version}";
-    hash = "sha256-51OGcic3clPYjj4bmiRVmViqJUEuwzkTtNl9U3OPAdI=";
+    hash = "sha256-nWcwy998ivz6ftr1zkN2JlLxHLMB47OZS/vnaYkoZHI=";
   };
-  vendorHash = "sha256-nDRg1gF6igE2FJ+s39j5EQ5/h9QkuSF2Bo9zxR3WkBE=";
+  vendorHash = "sha256-puAchYXCLE8yenqcCrclNqCqHP3WyFDQhzWgFv4yFUs=";
 
   ldflags = [
     "-s"

pkgs/development/tools/container2wasm/default.nix

···
 
 buildGoModule rec {
   pname = "container2wasm";
-  version = "0.5.1";
+  version = "0.5.2";
 
   src = fetchFromGitHub {
     owner = "ktock";
     repo = "container2wasm";
     rev = "refs/tags/v${version}";
-    hash = "sha256-ba40Nu2tVrRSvVeGxlrn0Bw+xQqWeli40lwBWOXSNTA=";
+    hash = "sha256-P/9RbNEpQTpbbWpfN0AThWfYaXCy8SeFvsFQFqdk+Zo=";
   };
 
-  vendorHash = "sha256-tyfLWmxAzFc0JuSem8L0HPG4wy9Gxdp8F/J3DyOx6rQ=";
+  vendorHash = "sha256-aY1/oOCaREXObi6RQ3nhQbYWpzOsJzDiiIRJ6CneB8c=";
 
   ldflags = [
     "-s"

pkgs/development/tools/cpm-cmake/default.nix

···
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "cpm-cmake";
-  version = "0.38.6";
+  version = "0.38.7";
 
   src = fetchFromGitHub {
     owner = "cpm-cmake";
     repo = "cpm.cmake";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-6y3kZyhY1WKHLw3ekZMQeoSGUgxhBu8dPl58ZnCDa+E=";
+    hash = "sha256-tvqoGLGBvsPtIbPWG/5DH4IMzQTci3sjmF9dpInncWc=";
   };
 
   dontConfigure = true;

pkgs/development/tools/crd2pulumi/default.nix

···
 
 buildGoModule rec {
   pname = "crd2pulumi";
-  version = "1.2.5";
+  version = "1.3.0";
 
   src = fetchFromGitHub {
     owner = "pulumi";
     repo = "crd2pulumi";
     rev = "v${version}";
-    sha256 = "sha256-Km9zL9QQgQjmIaAILzJy8oSd9GyZn/MnmBYTRMFtXlE=";
+    sha256 = "sha256-UBfb6PI+Ivk6JxSBIHw4tN09BHN1J+un04mnR3ByDfc=";
   };
 
-  vendorHash = "sha256-iWFZ20U4S2utIqhoXgLtT4pp5e9h8IpbveIKHPe0AAw=";
+  vendorHash = "sha256-Fs43ITqfZYEcuRzm5bTTgmG/tWGIX9k8gdYBHmO4tMQ=";
 
   ldflags = [ "-s" "-w" "-X github.com/pulumi/crd2pulumi/gen.Version=${src.rev}" ];
 

pkgs/development/tools/godot/4/default.nix

···
 in
 stdenv.mkDerivation rec {
   pname = "godot";
-  version = "4.2.0-stable";
-  commitHash = "46dc277917a93cbf601bbcf0d27d00f6feeec0d5";
+  version = "4.2.1-stable";
+  commitHash = "b09f793f564a6c95dc76acc654b390e68441bd01";
 
   src = fetchFromGitHub {
     owner = "godotengine";
     repo = "godot";
     rev = commitHash;
-    hash = "sha256-eon9GOmOafOcPjyBqnrAUXwVBUOnYFBQy8o5dnumDDs=";
+    hash = "sha256-Q6Og1H4H2ygOryMPyjm6kzUB6Su6T9mJIp0alNAxvjQ=";
   };
 
   nativeBuildInputs = [

pkgs/development/tools/qtcreator/default.nix

···
 
 stdenv.mkDerivation rec {
   pname = "qtcreator";
-  version = "12.0.0";
+  version = "12.0.1";
 
   src = fetchurl {
     url = "https://download.qt.io/official_releases/${pname}/${lib.versions.majorMinor version}/${version}/qt-creator-opensource-src-${version}.tar.xz";
-    hash = "sha256-OZrg3O+jvZ4Bo/BouT2r6LOfm1ZGbDidFEblyEyPe58=";
+    hash = "sha256-ZvuSws7QkoKeMyHFoJEeLemDCdAxDnq5SaOaUCOOA/M=";
   };
 
   nativeBuildInputs = [

pkgs/development/tools/rust/cargo-about/default.nix

···
 
 rustPlatform.buildRustPackage rec {
   pname = "cargo-about";
-  version = "0.5.7";
+  version = "0.6.0";
 
   src = fetchFromGitHub {
     owner = "EmbarkStudios";
     repo = "cargo-about";
     rev = version;
-    sha256 = "sha256-AROT/Q/C0lbkeoMYmY2Tzt0+yRVA8ESRo5mPM1h0HJs=";
+    sha256 = "sha256-srJ5NyO+kySFCcqyF0i99Zvh2XsNAyFvTUcks/kt0qs=";
   };
 
-  cargoSha256 = "sha256-9HkaCUGo6jpzQn851ACM7kcBCkyMJJ/bb/qtV4Hp0lI=";
+  cargoHash = "sha256-eO4dBXVBjuN68cTvw8LzzJEedu5+dizOMu4QFEOzKK8=";
 
   nativeBuildInputs = [ pkg-config ];
 

pkgs/development/tools/rust/duckscript/default.nix

···
 
 rustPlatform.buildRustPackage rec {
   pname = "duckscript_cli";
-  version = "0.9.1";
+  version = "0.9.2";
 
   src = fetchCrate {
     inherit pname version;
-    hash = "sha256-jpAZpx8VooYapSLApWWMLTj7c3wqw/S1w1zHN3OGzMs=";
+    hash = "sha256-qvocz/7Fx2YkgPcOYQha5iHQmoU40joGamj/SMiYx+4=";
   };
 
   nativeBuildInputs = [ pkg-config ];
···
   buildInputs = [ openssl ]
     ++ lib.optionals stdenv.isDarwin [ Security SystemConfiguration libiconv ];
 
-  cargoHash = "sha256-n40V75yIuSC1abq4/cYFqj9JqGj/uJ36ZSz8APovE6o=";
+  cargoHash = "sha256-SW3Q/+EhdMNLbhGQPpiIXuJv3ttyeCpjjvbVCrJzXlY=";
 
   meta = with lib; {
     description = "Simple, extendable and embeddable scripting language.";

pkgs/games/warzone2100/default.nix

···
 
 stdenv.mkDerivation rec {
   inherit pname;
-  version  = "4.4.1";
+  version  = "4.4.2";
 
   src = fetchurl {
     url = "mirror://sourceforge/project/warzone2100/releases/${version}/warzone2100_src.tar.xz";
-    hash = "sha256-8vbwO4PXEOyZqGiSz1yqhe8jfe4E4iv908mc+8xuH8I=";
+    hash = "sha256-O5Yqxqp1vKYr8uvAZ1SdsI/kocOzg0KRCirCqqvLrN4=";
   };
 
   buildInputs = [

pkgs/os-specific/darwin/utm/default.nix

···
 
 stdenvNoCC.mkDerivation rec {
   pname = "utm";
-  version = "4.4.4";
+  version = "4.4.5";
 
   src = fetchurl {
     url = "https://github.com/utmapp/UTM/releases/download/v${version}/UTM.dmg";
-    hash = "sha256-SyrqkNWRUKQS3D17XYsC/dcCKlPLGNNsG5obEiHE1Lk=";
+    hash = "sha256-FlIPSWqY2V1akd/InS6BPEBfc8pomJ8jgDns7wvaOm8=";
   };
 
   nativeBuildInputs = [ undmg makeWrapper ];

pkgs/os-specific/linux/batman-adv/default.nix

···
     homepage = "https://www.open-mesh.org/projects/batman-adv/wiki/Wiki";
     description = "B.A.T.M.A.N. routing protocol in a linux kernel module for layer 2";
     license = lib.licenses.gpl2;
-    maintainers = with lib.maintainers; [ fpletz hexa ];
+    maintainers = with lib.maintainers; [ fpletz hexa philiptaron ];
     platforms = with lib.platforms; linux;
   };
 }

pkgs/os-specific/linux/batman-adv/version.nix

···
 {
-  version = "2023.2";
+  version = "2023.3";
 
+  # To get these, run:
+  #
+  # ```
+  # for tool in alfred batctl batman-adv; do
+  #   nix-prefetch-url https://downloads.open-mesh.org/batman/releases/batman-adv-2023.3/$tool-2023.3.tar.gz --type sha256 | xargs nix hash to-sri --type sha256
+  # done
+  # ```
   sha256 = {
-    batman-adv = "sha256-OQfc1X4sW/2dQHE5YLlAK/HaT4DFm1/wN3ifu7vY+iU=";
-    alfred = "sha256-qSBgKFZPieW/t3FK4piDoWEPYr4+YcCW4f6zYgBxjg4=";
-    batctl = "sha256-cLX5MfpjYyVpe9829tE0oDxJBvTBfLdlCjxxSQFDbsg=";
+    alfred = "sha256-rVrUFJ+uz351MCpXeqpnOxz8lAXSAksrSpFjuscMjk8=";
+    batctl = "sha256-mswxFwkwwXl8OHY7h73/iAVMNNHwEvu4EAaCc/7zEhI=";
+    batman-adv = "sha256-98bFPlk0PBYmQsubRPEBZ2XUv1E+A5ACvmEremweo2w=";
   };
 }

pkgs/os-specific/linux/libnvme/default.nix

···
       url = "https://github.com/linux-nvme/libnvme/commit/ff742e792725c316ba6de0800188bf36751bd1d1.patch";
       hash = "sha256-IUjPUBmGQC4oAKFFlBrjonqD2YdyNPC9siK4t/t2slE=";
     })
+    # included in next release
+    (fetchpatch {
+      url = "https://github.com/linux-nvme/libnvme/commit/a2b8e52e46cfd888ac5a48d8ce632bd70a5caa93.patch";
+      hash = "sha256-AVSWraFriErfz7dA2CjU8+ehJtAmuLxBZyBALygmrf0=";
+    })
+    # included in next release
+    (fetchpatch {
+      url = "https://github.com/linux-nvme/libnvme/commit/68c6ffb11d40a427fc1fd70ac2ac97fd01952913.patch";
+      hash = "sha256-dvc1sjgCFU31/LornvJ/aRVYtPOsewkas0jS+/AwFuU=";
+    })
   ];
 
   postPatch = ''

pkgs/os-specific/linux/nixos-rebuild/nixos-rebuild.8

···
 .Op Fl -show-trace
 .Op Fl I Va NIX_PATH
 .Op Fl -verbose | v
+.Op Fl -accept-flake-config
 .Op Fl -impure
 .Op Fl -max-jobs | j Va number
 .Op Fl -keep-failed | K
···
 .Fl -max-jobs Ns ,
 .Fl j Ns ,
 .Fl I Ns ,
+.Fl -accept-flake-config Ns ,
 .Fl -show-trace Ns ,
 .Fl -keep-failed Ns ,
 .Fl -keep-going Ns ,

pkgs/os-specific/linux/nixos-rebuild/nixos-rebuild.sh

···
         j="$1"; shift 1
         extraBuildFlags+=("$i" "$j")
         ;;
-      -j*|--quiet|--print-build-logs|-L|--no-build-output|-Q| --show-trace|--keep-going|-k|--keep-failed|-K|--fallback|--refresh|--repair|--impure|--offline|--no-net)
+      --accept-flake-config|-j*|--quiet|--print-build-logs|-L|--no-build-output|-Q| --show-trace|--keep-going|-k|--keep-failed|-K|--fallback|--refresh|--repair|--impure|--offline|--no-net)
         extraBuildFlags+=("$i")
         ;;
       --verbose|-v|-vv|-vvv|-vvvv|-vvvvv)

pkgs/servers/mail/mailpit/default.nix

···
 }:
 
 let
-  version = "1.10.4";
+  version = "1.11.0";
 
   src = fetchFromGitHub {
     owner = "axllent";
     repo = "mailpit";
     rev = "v${version}";
-    hash = "sha256-DEeE562E+G/Qfpqc1kr9bklG6109OZENpglWmHj0Tpo=";
+    hash = "sha256-+PtyoItn9Dwf7HU3OjzldqfYgdu0LatPmijXK3gAKYY=";
   };
 
   # Separate derivation, because if we mix this in buildGoModule, the separate
···
 
     npmDeps = fetchNpmDeps {
       inherit src;
-      hash = "sha256-FEwaWHf5Ic2t933xSacmc+T0RydZOPCK1yQxTRZ0u38=";
+      hash = "sha256-zx6B6kDVdKJMQQPONC/KWRXK2i+4l5w9hzrAqatrKTE=";
     };
 
     env = lib.optionalAttrs (stdenv.isDarwin && stdenv.isx86_64) {
···
   pname = "mailpit";
   inherit src version;
 
-  vendorHash = "sha256-oBkdC4Qx9vuz9rvNxk27TM6vkQokOcFQ4hEZCxlT8xo=";
+  vendorHash = "sha256-UQms3YWXJRP1u1ERlsFNpo6ei86qaH6pgfvCLnB3AAk=";
 
   CGO_ENABLED = 0;
 
···
   '';
 
   passthru.tests.version = testers.testVersion {
-    inherit version;
     package = mailpit;
     command = "mailpit version";
   };

pkgs/servers/matrix-synapse/default.nix

···
   format = "pyproject";
 
   src = fetchFromGitHub {
-    owner = "matrix-org";
+    owner = "element-hq";
     repo = "synapse";
     rev = "v${version}";
     hash = "sha256-irPExb8rwQjkPp0b3x5hJG4Ay6OnITWIGRPxBSoP/Dk=";
···
 
   postPatch = ''
     # Remove setuptools_rust from runtime dependencies
-    # https://github.com/matrix-org/synapse/blob/v1.69.0/pyproject.toml#L177-L185
+    # https://github.com/element-hq/synapse/blob/v1.69.0/pyproject.toml#L177-L185
     sed -i '/^setuptools_rust =/d' pyproject.toml
 
     # Remove version pin on build dependencies. Upstream does this on purpose to
···
 
     # high parallelisem makes test suite unstable
     # upstream uses 2 cores but 4 seems to be also stable
-    # https://github.com/matrix-org/synapse/blob/develop/.github/workflows/latest_deps.yml#L103
+    # https://github.com/element-hq/synapse/blob/develop/.github/workflows/latest_deps.yml#L103
     if (( $NIX_BUILD_CORES > 4)); then
       NIX_BUILD_CORES=4
     fi
···
 
   meta = with lib; {
     homepage = "https://matrix.org";
-    changelog = "https://github.com/matrix-org/synapse/releases/tag/v${version}";
+    changelog = "https://github.com/element-hq/synapse/releases/tag/v${version}";
     description = "Matrix reference homeserver";
-    license = licenses.asl20;
+    license = licenses.agpl3Plus;
     maintainers = teams.matrix.members;
   };
 }

pkgs/servers/matrix-synapse/tools/synadm.nix

···
     longDescription = ''
       A CLI tool to help admins of Matrix Synapse homeservers
       conveniently issue commands available via its admin API's
-      (matrix-org/synapse@master/docs/admin_api)
+      (element-hq/synapse@master/docs/admin_api)
     '';
     changelog = "https://github.com/JOJ0/synadm/releases/tag/v${version}";
     homepage = "https://github.com/JOJ0/synadm";

pkgs/servers/matrix-synapse/wrapper.nix

···
 let
   extraPackages = lib.concatMap (extra: matrix-synapse-unwrapped.optional-dependencies.${extra}) (lib.unique extras);
 
-  pluginsEnv = matrix-synapse-unwrapped.python.buildEnv.override {
-    extraLibs = plugins;
+  pythonEnv = matrix-synapse-unwrapped.python.buildEnv.override {
+    extraLibs = extraPackages ++ plugins;
   };
 
-  searchPath = lib.makeSearchPathOutput "lib" matrix-synapse-unwrapped.python.sitePackages (extraPackages ++ [ pluginsEnv ]);
+  searchPath = "${pythonEnv}/${matrix-synapse-unwrapped.python.sitePackages}";
 in
 stdenv.mkDerivation {
   name = (lib.appendToName "wrapped" matrix-synapse-unwrapped).name;

pkgs/tools/admin/copilot-cli/default.nix

···
 
 buildGoModule rec {
   pname = "copilot-cli";
-  version = "1.32.0";
+  version = "1.32.1";
 
   src = fetchFromGitHub {
     owner = "aws";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-w63mNGDUc5YrlBrqsXRyy4SPC35kNKWhiHe6Sfc30tI=";
+    hash = "sha256-OdzycH+52F6lfCErKlsVFiPE2gxU22ySV5uPA6zBXUg=";
   };
 
-  vendorHash = "sha256-8hZFsYMZQ8RxImEG2t0kfukbRjAJMEDSYF+ryLOZelc=";
+  vendorHash = "sha256-5Nlo5Ol4YdO3XI5RhpFfBgprVUV5DUkySvCXeFZqulk=";
 
   nativeBuildInputs = [ installShellFiles ];
 

pkgs/tools/admin/credhub-cli/default.nix

···
 
 buildGoModule rec {
   pname = "credhub-cli";
-  version = "2.9.22";
+  version = "2.9.24";
 
   src = fetchFromGitHub {
     owner = "cloudfoundry-incubator";
     repo = "credhub-cli";
     rev = version;
-    sha256 = "sha256-snQLZ/bHYDdC62Ti1E4zUmBHR8TtrKCx0BC2i6GAfdE=";
+    sha256 = "sha256-9SEdMK9KECte9QEfosju0PHxlDWwbQkn4QKi/XgFVuY=";
   };
 
   # these tests require network access that we're not going to give them

pkgs/tools/filesystems/ceph/default.nix

···
 , doxygen
 , gperf
 , graphviz
+, gnugrep
 , gtest
 , icu
+, kmod
 , libcap
 , libcap_ng
 , libnl
···
 
     pythonPath = [ ceph-python-env "${placeholder "out"}/${ceph-python-env.sitePackages}" ];
 
+    # replace /sbin and /bin based paths with direct nix store paths
+    # increase the `command` buffer size since 2 nix store paths cannot fit within 128 characters
     preConfigure =''
-      substituteInPlace src/common/module.c --replace "/sbin/modinfo"  "modinfo"
-      substituteInPlace src/common/module.c --replace "/sbin/modprobe" "modprobe"
-      substituteInPlace src/common/module.c --replace "/bin/grep" "grep"
+      substituteInPlace src/common/module.c \
+        --replace "char command[128];" "char command[256];" \
+        --replace "/sbin/modinfo"  "${kmod}/bin/modinfo" \
+        --replace "/sbin/modprobe" "${kmod}/bin/modprobe" \
+        --replace "/bin/grep" "${gnugrep}/bin/grep"
 
       # install target needs to be in PYTHONPATH for "*.pth support" check to succeed
       # set PYTHONPATH, so the build system doesn't silently skip installing ceph-volume and others

pkgs/tools/security/bitwarden/default.nix

···
 , cargo
 , copyDesktopItems
 , dbus
-, electron_26
+, electron_27
 , fetchFromGitHub
 , fetchpatch2
 , glib
···
 let
   description = "A secure and free password manager for all of your devices";
   icon = "bitwarden";
-  electron = electron_26;
+  electron = electron_27;
 in buildNpmPackage rec {
   pname = "bitwarden";
-  version = "2023.12.0"; # TODO add back Electron version check below
+  version = "2023.12.0";
 
   src = fetchFromGitHub {
     owner = "bitwarden";
···
       url = "https://github.com/solopasha/bitwarden_flatpak/raw/daec07b067b9cec5e260b44a53216fc65866ba1d/wayland-clipboard.patch";
       hash = "sha256-hcaRa9Nl7MYaTNwmB5Qdm65Mtufv3z+IPwLDPiO3pcw=";
     })
+    # Workaround Electron 25 EOL and 26 has https://github.com/bitwarden/clients/issues/6560
+    ./electron-27.patch
   ];
 
   nodejs = nodejs_18;
 
   makeCacheWritable = true;
   npmWorkspace = "apps/desktop";
-  npmDepsHash = "sha256-bnYpvHO9Pnob+MbrSshv03mSwXCADH/2xw33nLVKMdg=";
+  npmDepsHash = "sha256-QwG+D0M94HN1AyQlmzKeScZyksiUr5A9igEaox9DYN4=";
 
   cargoDeps = rustPlatform.fetchCargoTarball {
     name = "${pname}-${version}";
···
     libsecret
   ];
 
-  # FIXME add back once upstream moves to Electron >= 26
-  # we use electron_26 because electron_25 is EOL
-  /*preBuild = ''
+  preBuild = ''
     if [[ $(jq --raw-output '.devDependencies.electron' < package.json | grep -E --only-matching '^[0-9]+') != ${lib.escapeShellArg (lib.versions.major electron.version)} ]]; then
       echo 'ERROR: electron version mismatch'
       exit 1
     fi
-  '';*/
+  '';
 
   postBuild = ''
     pushd apps/desktop

pkgs/tools/security/bitwarden/electron-27.patch

···
+From e2c15e826fe9d4d2d12868ef5409e423e3191b58 Mon Sep 17 00:00:00 2001
+From: Daniel James Smith <[e-mail]>
+Date: Fri, 8 Dec 2023 13:07:46 +0100
+Subject: [PATCH] Bump electron to v27.1.3 (#7134)
+
+Co-authored-by: Daniel James Smith <[e-mail]>
+
+(cherry picked from commit d76602343f36d8e17a9b0204e0290488456c96d5)
+---
+ apps/desktop/electron-builder.json | 2 +-
+ package-lock.json                  | 8 ++++----
+ package.json                       | 2 +-
+ 3 files changed, 6 insertions(+), 6 deletions(-)
+
+diff --git a/apps/desktop/electron-builder.json b/apps/desktop/electron-builder.json
+index 69d1c0074f..a12870bd96 100644
+--- a/apps/desktop/electron-builder.json
++++ b/apps/desktop/electron-builder.json
+@@ -19,7 +19,7 @@
+     "**/node_modules/@bitwarden/desktop-native/index.js",
+     "**/node_modules/@bitwarden/desktop-native/desktop_native.${platform}-${arch}*.node"
+   ],
+-  "electronVersion": "25.9.1",
++  "electronVersion": "27.1.3",
+   "generateUpdatesFilesForAllChannels": true,
+   "publish": {
+     "provider": "generic",
+diff --git a/package-lock.json b/package-lock.json
+index 3f0afde95b..9b7b2dbcd9 100644
+--- a/package-lock.json
++++ b/package-lock.json
+@@ -125,7 +125,7 @@
+         "cross-env": "7.0.3",
+         "css-loader": "6.8.1",
+         "del": "6.1.1",
+-        "electron": "25.9.1",
++        "electron": "27.1.3",
+         "electron-builder": "23.6.0",
+         "electron-log": "5.0.0",
+         "electron-reload": "2.0.0-alpha.1",
+@@ -20173,9 +20173,9 @@
+       }
+     },
+     "node_modules/electron": {
+-      "version": "25.9.1",
+-      "resolved": "https://registry.npmjs.org/electron/-/electron-25.9.1.tgz",
+-      "integrity": "sha512-Uo/Fh7igjoUXA/f90iTATZJesQEArVL1uLA672JefNWTLymdKSZkJKiCciu/Xnd0TS6qvdIOUGuJFSTQnKskXQ==",
++      "version": "27.1.3",
++      "resolved": "https://registry.npmjs.org/electron/-/electron-27.1.3.tgz",
++      "integrity": "sha512-7eD8VMhhlL5J531OOawn00eMthUkX1e3qN5Nqd7eMK8bg5HxQBrn8bdPlvUEnCano9KhrVwaDnGeuzWoDOGpjQ==",
+       "dev": true,
+       "hasInstallScript": true,
+       "dependencies": {
+diff --git a/package.json b/package.json
+index 9ee884b31d..4a5c3513fd 100644
+--- a/package.json
++++ b/package.json
+@@ -88,7 +88,7 @@
+     "cross-env": "7.0.3",
+     "css-loader": "6.8.1",
+     "del": "6.1.1",
+-    "electron": "25.9.1",
++    "electron": "27.1.3",
+     "electron-builder": "23.6.0",
+     "electron-log": "5.0.0",
+     "electron-reload": "2.0.0-alpha.1",
+-- 
+2.42.0
+

pkgs/tools/security/cyclonedx-gomod/default.nix

···
 
 buildGoModule rec {
   pname = "cyclonedx-gomod";
-  version = "1.4.1";
+  version = "1.5.0";
 
   src = fetchFromGitHub {
     owner = "CycloneDX";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-JczDfNBYT/Ap2lDucEvuT8NAwuQgmavOUvtznI6Q+Zc=";
+    hash = "sha256-whAHZDUQBJaYu+OZiqcYzWxOru1GXDQ4FMDCj+ngCDs=";
   };
 
-  vendorHash = "sha256-5Mn+f+oVwbn2qGaZct5+9f6tOBXfsB/I72yD7fHUrC8=";
+  vendorHash = "sha256-FpsZonGJSzbAsnM00qq/qiTJLUN4q08dR+6rhTKvX0I=";
 
   # Tests require network access and cyclonedx executable
   doCheck = false;

pkgs/tools/text/chroma/default.nix

···
     description = "A general purpose syntax highlighter in pure Go";
     license = licenses.mit;
     maintainers = [ maintainers.sternenseemann ];
+    mainProgram = "chroma";
   };
 }

pkgs/top-level/all-packages.nix

···
   };
 
   stdenvNoLibs =
-    if stdenv.hostPlatform != stdenv.buildPlatform && (stdenv.hostPlatform.isDarwin || stdenv.hostPlatform.isDarwin.useLLVM or false)
+    if stdenv.hostPlatform != stdenv.buildPlatform && (stdenv.hostPlatform.isDarwin || stdenv.hostPlatform.useLLVM or false)
     then
       # We cannot touch binutils or cc themselves, because that will cause
       # infinite recursion. So instead, we just choose a libc based on the
···
 
   endless-sky = callPackage ../games/endless-sky { };
 
-  extremetuxracer = callPackage ../games/extremetuxracer {
-    libpng = libpng12;
-  };
+  extremetuxracer = callPackage ../games/extremetuxracer { };
 
   exult = callPackage ../games/exult { };