Merge staging-next into staging

maintainers/maintainer-list.nix

···
     githubId = 36667224;
     name = "Yingchi Long";
   };
+  IncredibleLaser = {
+    github = "IncredibleLaser";
+    githubId = 45564436;
+    matrix = "@incrediblelaser:tchncs.de";
+    name = "Gereon Schomber";
+  };
   indexyz = {
     email = "[e-mail]";
     github = "5aaee9";
···
     githubId = 65046942;
     name = "Marcin Mikuła";
     keys = [ { fingerprint = "5547 2A56 AC30 69C9 15C8  B98D 997F 71FA 1D74 6E37"; } ];
-  };
-  milahu = {
-    email = "[e-mail]";
-    github = "milahu";
-    githubId = 12958815;
-    name = "Milan Hauth";
   };
   milesbreslin = {
     email = "[e-mail]";

nixos/doc/manual/release-notes/rl-2505.section.md

···
 
 - [waagent](https://github.com/Azure/WALinuxAgent), the Microsoft Azure Linux Agent (waagent) manages Linux provisioning and VM interaction with the Azure Fabric Controller. Available with [services.waagent](options.html#opt-services.waagent.enable).
 
+- [duckdns](https://www.duckdns.org), free dynamic DNS. Available with [services.duckdns](options.html#opt-services.duckdns.enable)
+
 - [nostr-rs-relay](https://git.sr.ht/~gheartsfield/nostr-rs-relay/), This is a nostr relay, written in Rust. Available as [services.nostr-rs-relay](options.html#opt-services.nostr-rs-relay.enable).
 
 - [Actual Budget](https://actualbudget.org/), a local-first personal finance app. Available as [services.actual](#opt-services.actual.enable).
···
   If you set custom Caddy options for a DokuWiki site, migrate these options by removing `http://` from `services.caddy.virtualHosts."http://example.com"`.
 
 - `vscode-utils.buildVscodeExtension` now requires pname as an argument
+
+- The behavior of `services.hostapd.radios.<name>.networks.<name>.authentication.enableRecommendedPairwiseCiphers` was changed to not include `CCMP-256` anymore.
+  Since all configured pairwise ciphers have to be supported by the radio, this caused startup failures on many devices which is hard to debug in hostapd.
 
 - `nerdfonts` has been separated into individual font packages under the namespace `nerd-fonts`. The directories for font
   files have changed from `$out/share/fonts/{opentype,truetype}/NerdFonts` to

nixos/modules/module-list.nix

···
   ./services/misc/disnix.nix
   ./services/misc/docker-registry.nix
   ./services/misc/domoticz.nix
+  ./services/misc/duckdns.nix
   ./services/misc/duckling.nix
   ./services/misc/dwm-status.nix
   ./services/misc/dysnomia.nix

nixos/modules/services/networking/hostapd.nix

···
     attrNames
     attrValues
     concatLists
-    concatMap
     concatMapStrings
     concatStringsSep
     count
···
     mkOption
     mkPackageOption
     mkRemovedOptionModule
-    optional
     optionalAttrs
     optionalString
     optionals
-    singleton
     stringLength
     toLower
     types
···
 
                     pairwiseCiphers = mkOption {
                       default = ["CCMP"];
-                      example = ["CCMP-256" "GCMP-256"];
+                      example = ["GCMP" "GCMP-256"];
                       type = types.listOf types.str;
                       description = ''
                         Set of accepted cipher suites (encryption algorithms) for pairwise keys (unicast packets).
···
 
                         Please refer to the hostapd documentation for allowed values. Generally, only
                         CCMP or GCMP modes should be considered safe options. Most devices support CCMP while
-                        GCMP is often only available with devices supporting WiFi 5 (IEEE 802.11ac) or higher.
+                        GCMP and GCMP-256 is often only available with devices supporting WiFi 5 (IEEE 802.11ac) or higher.
+                        CCMP-256 support is rare.
                       '';
                     };
 
···
                   bssCfg = bssSubmod.config;
                   pairwiseCiphers =
                     concatStringsSep " " (unique (bssCfg.authentication.pairwiseCiphers
-                      ++ optionals bssCfg.authentication.enableRecommendedPairwiseCiphers ["CCMP" "CCMP-256" "GCMP" "GCMP-256"]));
+                      ++ optionals bssCfg.authentication.enableRecommendedPairwiseCiphers ["CCMP" "GCMP" "GCMP-256"]));
                 in {
                   settings = {
                     ssid = bssCfg.ssid;

nixos/modules/services/web-apps/dolibarr.nix

···
-{ config, pkgs, lib, ... }:
+{
+  config,
+  pkgs,
+  lib,
+  ...
+}:
 let
-  inherit (lib) any boolToString concatStringsSep isBool isString mapAttrsToList mkDefault mkEnableOption mkIf mkMerge mkOption optionalAttrs types mkPackageOption;
+  inherit (lib)
+    any
+    boolToString
+    concatStringsSep
+    isBool
+    isString
+    mapAttrsToList
+    mkDefault
+    mkEnableOption
+    mkIf
+    mkMerge
+    mkOption
+    optionalAttrs
+    types
+    mkPackageOption
+    ;
 
   package = cfg.package.override { inherit (cfg) stateDir; };
 
   cfg = config.services.dolibarr;
   vhostCfg = lib.optionalAttrs (cfg.nginx != null) config.services.nginx.virtualHosts."${cfg.domain}";
 
-  mkConfigFile = filename: settings:
+  mkConfigFile =
+    filename: settings:
     let
       # hack in special logic for secrets so we read them from a separate file avoiding the nix store
-      secretKeys = [ "force_install_databasepass" "dolibarr_main_db_pass" "dolibarr_main_instance_unique_id" ];
+      secretKeys = [
+        "force_install_databasepass"
+        "dolibarr_main_db_pass"
+        "dolibarr_main_instance_unique_id"
+      ];
 
-      toStr = k: v:
-        if (any (str: k == str) secretKeys) then v
-        else if isString v then "'${v}'"
-        else if isBool v then boolToString v
-        else if v == null then "null"
-        else toString v
-      ;
+      toStr =
+        k: v:
+        if (any (str: k == str) secretKeys) then
+          v
+        else if isString v then
+          "'${v}'"
+        else if isBool v then
+          boolToString v
+        else if v == null then
+          "null"
+        else
+          toString v;
     in
-      pkgs.writeText filename ''
-        <?php
-        ${concatStringsSep "\n" (mapAttrsToList (k: v: "\$${k} = ${toStr k v};") settings)}
-      '';
+    pkgs.writeText filename ''
+      <?php
+      ${concatStringsSep "\n" (mapAttrsToList (k: v: "\$${k} = ${toStr k v};") settings)}
+    '';
 
   # see https://github.com/Dolibarr/dolibarr/blob/develop/htdocs/install/install.forced.sample.php for all possible values
-  install = {
-    force_install_noedit = 2;
-    force_install_main_data_root = "${cfg.stateDir}/documents";
-    force_install_nophpinfo = true;
-    force_install_lockinstall = "444";
-    force_install_distrib = "nixos";
-    force_install_type = "mysqli";
-    force_install_dbserver = cfg.database.host;
-    force_install_port = toString cfg.database.port;
-    force_install_database = cfg.database.name;
-    force_install_databaselogin = cfg.database.user;
+  install =
+    {
+      force_install_noedit = 2;
+      force_install_main_data_root = "${cfg.stateDir}/documents";
+      force_install_nophpinfo = true;
+      force_install_lockinstall = "444";
+      force_install_distrib = "nixos";
+      force_install_type = "mysqli";
+      force_install_dbserver = cfg.database.host;
+      force_install_port = toString cfg.database.port;
+      force_install_database = cfg.database.name;
+      force_install_databaselogin = cfg.database.user;
 
-    force_install_mainforcehttps = vhostCfg.forceSSL or false;
-    force_install_createuser = false;
-    force_install_dolibarrlogin = null;
-  } // optionalAttrs (cfg.database.passwordFile != null) {
-    force_install_databasepass = ''file_get_contents("${cfg.database.passwordFile}")'';
-  };
+      force_install_mainforcehttps = vhostCfg.forceSSL or false;
+      force_install_createuser = false;
+      force_install_dolibarrlogin = null;
+    }
+    // optionalAttrs (cfg.database.passwordFile != null) {
+      force_install_databasepass = ''file_get_contents("${cfg.database.passwordFile}")'';
+    };
 in
 {
   # interface
···
     };
 
     settings = mkOption {
-      type = with types; (attrsOf (oneOf [ bool int str ]));
+      type =
+        with types;
+        (attrsOf (oneOf [
+          bool
+          int
+          str
+        ]));
       default = { };
       description = "Dolibarr settings, see <https://github.com/Dolibarr/dolibarr/blob/develop/htdocs/conf/conf.php.example> for details.";
     };
 
     nginx = mkOption {
-      type = types.nullOr (types.submodule (
-        lib.recursiveUpdate
-          (import ../web-servers/nginx/vhost-options.nix { inherit config lib; })
-          {
+      type = types.nullOr (
+        types.submodule (
+          lib.recursiveUpdate (import ../web-servers/nginx/vhost-options.nix { inherit config lib; }) {
             # enable encryption by default,
             # as sensitive login and Dolibarr (ERP) data should not be transmitted in clear text.
             options.forceSSL.default = true;
             options.enableACME.default = true;
           }
-      ));
+        )
+      );
       default = null;
       example = lib.literalExpression ''
         {
···
         }
       '';
       description = ''
-          With this option, you can customize an nginx virtual host which already has sensible defaults for Dolibarr.
-          Set to {} if you do not need any customization to the virtual host.
-          If enabled, then by default, the {option}`serverName` is
-          `''${domain}`,
-          SSL is active, and certificates are acquired via ACME.
-          If this is set to null (the default), no nginx virtualHost will be configured.
+        With this option, you can customize an nginx virtual host which already has sensible defaults for Dolibarr.
+        Set to {} if you do not need any customization to the virtual host.
+        If enabled, then by default, the {option}`serverName` is
+        `''${domain}`,
+        SSL is active, and certificates are acquired via ACME.
+        If this is set to null (the default), no nginx virtualHost will be configured.
       '';
     };
 
     poolConfig = mkOption {
-      type = with types; attrsOf (oneOf [ str int bool ]);
+      type =
+        with types;
+        attrsOf (oneOf [
+          str
+          int
+          bool
+        ]);
       default = {
         "pm" = "dynamic";
         "pm.max_children" = 32;
···
   config = mkIf cfg.enable (mkMerge [
     {
 
-    assertions = [
-      { assertion = cfg.database.createLocally -> cfg.database.user == cfg.user;
-        message = "services.dolibarr.database.user must match services.dolibarr.user if the database is to be automatically provisioned";
-      }
-    ];
+      assertions = [
+        {
+          assertion = cfg.database.createLocally -> cfg.database.user == cfg.user;
+          message = "services.dolibarr.database.user must match services.dolibarr.user if the database is to be automatically provisioned";
+        }
+      ];
 
-    services.dolibarr.settings = {
-      dolibarr_main_url_root = "https://${cfg.domain}";
-      dolibarr_main_document_root = "${package}/htdocs";
-      dolibarr_main_url_root_alt = "/custom";
-      dolibarr_main_data_root = "${cfg.stateDir}/documents";
+      services.dolibarr.settings = {
+        dolibarr_main_url_root = "https://${cfg.domain}";
+        dolibarr_main_document_root = "${package}/htdocs";
+        dolibarr_main_url_root_alt = "/custom";
+        dolibarr_main_data_root = "${cfg.stateDir}/documents";
 
-      dolibarr_main_db_host = cfg.database.host;
-      dolibarr_main_db_port = toString cfg.database.port;
-      dolibarr_main_db_name = cfg.database.name;
-      dolibarr_main_db_prefix = "llx_";
-      dolibarr_main_db_user = cfg.database.user;
-      dolibarr_main_db_pass = mkIf (cfg.database.passwordFile != null) ''
-        file_get_contents("${cfg.database.passwordFile}")
-      '';
-      dolibarr_main_db_type = "mysqli";
-      dolibarr_main_db_character_set = mkDefault "utf8";
-      dolibarr_main_db_collation = mkDefault "utf8_unicode_ci";
+        dolibarr_main_db_host = cfg.database.host;
+        dolibarr_main_db_port = toString cfg.database.port;
+        dolibarr_main_db_name = cfg.database.name;
+        dolibarr_main_db_prefix = "llx_";
+        dolibarr_main_db_user = cfg.database.user;
+        dolibarr_main_db_pass = mkIf (cfg.database.passwordFile != null) ''
+          file_get_contents("${cfg.database.passwordFile}")
+        '';
+        dolibarr_main_db_type = "mysqli";
+        dolibarr_main_db_character_set = mkDefault "utf8";
+        dolibarr_main_db_collation = mkDefault "utf8_unicode_ci";
 
-      # Authentication settings
-      dolibarr_main_authentication = mkDefault "dolibarr";
-
-      # Security settings
-      dolibarr_main_prod = true;
-      dolibarr_main_force_https = vhostCfg.forceSSL or false;
-      dolibarr_main_restrict_os_commands = "${pkgs.mariadb}/bin/mysqldump, ${pkgs.mariadb}/bin/mysql";
-      dolibarr_nocsrfcheck = false;
-      dolibarr_main_instance_unique_id = ''
-        file_get_contents("${cfg.stateDir}/dolibarr_main_instance_unique_id")
-      '';
-      dolibarr_mailing_limit_sendbyweb = false;
-    };
+        # Authentication settings
+        dolibarr_main_authentication = mkDefault "dolibarr";
 
-    systemd.tmpfiles.rules = [
-      "d '${cfg.stateDir}' 0750 ${cfg.user} ${cfg.group}"
-      "d '${cfg.stateDir}/documents' 0750 ${cfg.user} ${cfg.group}"
-      "f '${cfg.stateDir}/conf.php' 0660 ${cfg.user} ${cfg.group}"
-      "L '${cfg.stateDir}/install.forced.php' - ${cfg.user} ${cfg.group} - ${mkConfigFile "install.forced.php" install}"
-    ];
+        # Security settings
+        dolibarr_main_prod = true;
+        dolibarr_main_force_https = vhostCfg.forceSSL or false;
+        dolibarr_main_restrict_os_commands = "${pkgs.mariadb}/bin/mysqldump, ${pkgs.mariadb}/bin/mysql";
+        dolibarr_nocsrfcheck = false;
+        dolibarr_main_instance_unique_id = ''
+          file_get_contents("${cfg.stateDir}/dolibarr_main_instance_unique_id")
+        '';
+        dolibarr_mailing_limit_sendbyweb = false;
+      };
 
-    services.mysql = mkIf cfg.database.createLocally {
-      enable = mkDefault true;
-      package = mkDefault pkgs.mariadb;
-      ensureDatabases = [ cfg.database.name ];
-      ensureUsers = [
-        { name = cfg.database.user;
-          ensurePermissions = { "${cfg.database.name}.*" = "ALL PRIVILEGES"; };
-        }
+      systemd.tmpfiles.rules = [
+        "d '${cfg.stateDir}' 0750 ${cfg.user} ${cfg.group}"
+        "d '${cfg.stateDir}/documents' 0750 ${cfg.user} ${cfg.group}"
+        "f '${cfg.stateDir}/conf.php' 0660 ${cfg.user} ${cfg.group}"
+        "L '${cfg.stateDir}/install.forced.php' - ${cfg.user} ${cfg.group} - ${mkConfigFile "install.forced.php" install}"
       ];
-    };
 
-    services.nginx.enable = mkIf (cfg.nginx != null) true;
-    services.nginx.virtualHosts."${cfg.domain}" = mkIf (cfg.nginx != null) (lib.mkMerge [
-      cfg.nginx
-      ({
-        root = lib.mkForce "${package}/htdocs";
-        locations."/".index = "index.php";
-        locations."~ [^/]\\.php(/|$)" = {
+      services.mysql = mkIf cfg.database.createLocally {
+        enable = mkDefault true;
+        package = mkDefault pkgs.mariadb;
+        ensureDatabases = [ cfg.database.name ];
+        ensureUsers = [
+          {
+            name = cfg.database.user;
+            ensurePermissions = {
+              "${cfg.database.name}.*" = "ALL PRIVILEGES";
+            };
+          }
+        ];
+      };
+
+      services.nginx.enable = mkIf (cfg.nginx != null) true;
+      services.nginx.virtualHosts."${cfg.domain}" = mkIf (cfg.nginx != null) (
+        lib.mkMerge [
+          cfg.nginx
+          ({
+            root = lib.mkForce "${package}/htdocs";
+            locations."/".index = "index.php";
+            locations."~ [^/]\\.php(/|$)" = {
+              extraConfig = ''
+                fastcgi_split_path_info ^(.+?\.php)(/.*)$;
+                fastcgi_pass unix:${config.services.phpfpm.pools.dolibarr.socket};
+              '';
+            };
+          })
+        ]
+      );
+
+      systemd.services."phpfpm-dolibarr".after = mkIf cfg.database.createLocally [ "mysql.service" ];
+      services.phpfpm.pools.dolibarr = {
+        inherit (cfg) user group;
+        phpPackage = pkgs.php.buildEnv {
+          extensions = { enabled, all }: enabled ++ [ all.calendar ];
+          # recommended by dolibarr web application
           extraConfig = ''
-            fastcgi_split_path_info ^(.+?\.php)(/.*)$;
-            fastcgi_pass unix:${config.services.phpfpm.pools.dolibarr.socket};
+            session.use_strict_mode = 1
+            session.cookie_samesite = "Lax"
+            ; open_basedir = "${package}/htdocs, ${cfg.stateDir}"
+            allow_url_fopen = 0
+            disable_functions = "pcntl_alarm, pcntl_fork, pcntl_waitpid, pcntl_wait, pcntl_wifexited, pcntl_wifstopped, pcntl_wifsignaled, pcntl_wifcontinued, pcntl_wexitstatus, pcntl_wtermsig, pcntl_wstopsig, pcntl_signal, pcntl_signal_get_handler, pcntl_signal_dispatch, pcntl_get_last_error, pcntl_strerror, pcntl_sigprocmask, pcntl_sigwaitinfo, pcntl_sigtimedwait, pcntl_exec, pcntl_getpriority, pcntl_setpriority, pcntl_async_signals"
           '';
         };
-      })
-    ]);
 
-    systemd.services."phpfpm-dolibarr".after = mkIf cfg.database.createLocally [ "mysql.service" ];
-    services.phpfpm.pools.dolibarr = {
-      inherit (cfg) user group;
-      phpPackage = pkgs.php.buildEnv {
-        extensions = { enabled, all }: enabled ++ [ all.calendar ];
-        # recommended by dolibarr web application
-        extraConfig = ''
-          session.use_strict_mode = 1
-          session.cookie_samesite = "Lax"
-          ; open_basedir = "${package}/htdocs, ${cfg.stateDir}"
-          allow_url_fopen = 0
-          disable_functions = "pcntl_alarm, pcntl_fork, pcntl_waitpid, pcntl_wait, pcntl_wifexited, pcntl_wifstopped, pcntl_wifsignaled, pcntl_wifcontinued, pcntl_wexitstatus, pcntl_wtermsig, pcntl_wstopsig, pcntl_signal, pcntl_signal_get_handler, pcntl_signal_dispatch, pcntl_get_last_error, pcntl_strerror, pcntl_sigprocmask, pcntl_sigwaitinfo, pcntl_sigtimedwait, pcntl_exec, pcntl_getpriority, pcntl_setpriority, pcntl_async_signals"
-        '';
+        settings = {
+          "listen.mode" = "0660";
+          "listen.owner" = cfg.user;
+          "listen.group" = cfg.group;
+        } // cfg.poolConfig;
       };
 
-      settings = {
-        "listen.mode" = "0660";
-        "listen.owner" = cfg.user;
-        "listen.group" = cfg.group;
-      } // cfg.poolConfig;
-    };
+      # there are several challenges with dolibarr and NixOS which we can address here
+      # - the dolibarr installer cannot be entirely automated, though it can partially be by including a file called install.forced.php
+      # - the dolibarr installer requires write access to its config file during installation, though not afterwards
+      # - the dolibarr config file generally holds secrets generated by the installer, though the config file is a php file so we can read and write these secrets from an external file
+      systemd.services.dolibarr-config = {
+        description = "dolibarr configuration file management via NixOS";
+        wantedBy = [ "multi-user.target" ];
 
-    # there are several challenges with dolibarr and NixOS which we can address here
-    # - the dolibarr installer cannot be entirely automated, though it can partially be by including a file called install.forced.php
-    # - the dolibarr installer requires write access to its config file during installation, though not afterwards
-    # - the dolibarr config file generally holds secrets generated by the installer, though the config file is a php file so we can read and write these secrets from an external file
-    systemd.services.dolibarr-config = {
-      description = "dolibarr configuration file management via NixOS";
-      wantedBy = [ "multi-user.target" ];
+        script = ''
+          # extract the 'main instance unique id' secret that the dolibarr installer generated for us, store it in a file for use by our own NixOS generated configuration file
+          ${pkgs.php}/bin/php -r "include '${cfg.stateDir}/conf.php'; file_put_contents('${cfg.stateDir}/dolibarr_main_instance_unique_id', \$dolibarr_main_instance_unique_id);"
 
-      script = ''
-        # extract the 'main instance unique id' secret that the dolibarr installer generated for us, store it in a file for use by our own NixOS generated configuration file
-        ${pkgs.php}/bin/php -r "include '${cfg.stateDir}/conf.php'; file_put_contents('${cfg.stateDir}/dolibarr_main_instance_unique_id', \$dolibarr_main_instance_unique_id);"
+          # replace configuration file generated by installer with the NixOS generated configuration file
+          install -m 440 ${mkConfigFile "conf.php" cfg.settings} '${cfg.stateDir}/conf.php'
+        '';
 
-        # replace configuration file generated by installer with the NixOS generated configuration file
-        install -m 644 ${mkConfigFile "conf.php" cfg.settings} '${cfg.stateDir}/conf.php'
-      '';
+        serviceConfig = {
+          Type = "oneshot";
+          User = cfg.user;
+          Group = cfg.group;
+          RemainAfterExit = "yes";
+        };
 
-      serviceConfig = {
-        Type = "oneshot";
-        User = cfg.user;
-        Group = cfg.group;
-        RemainAfterExit = "yes";
+        unitConfig = {
+          ConditionFileNotEmpty = "${cfg.stateDir}/conf.php";
+        };
       };
 
-      unitConfig = {
-        ConditionFileNotEmpty = "${cfg.stateDir}/conf.php";
+      users.users.dolibarr = mkIf (cfg.user == "dolibarr") {
+        isSystemUser = true;
+        group = cfg.group;
       };
-    };
 
-    users.users.dolibarr = mkIf (cfg.user == "dolibarr" ) {
-      isSystemUser = true;
-      group = cfg.group;
-    };
-
-    users.groups = optionalAttrs (cfg.group == "dolibarr") {
-      dolibarr = { };
-    };
-  }
-  (mkIf (cfg.nginx != null) {
-    users.users."${config.services.nginx.group}".extraGroups = mkIf (cfg.nginx != null) [ cfg.group ];
-  })
-]);
+      users.groups = optionalAttrs (cfg.group == "dolibarr") {
+        dolibarr = { };
+      };
+    }
+    (mkIf (cfg.nginx != null) {
+      users.users."${config.services.nginx.group}".extraGroups = mkIf (cfg.nginx != null) [ cfg.group ];
+    })
+  ]);
 }

pkgs/applications/maui/booth.nix

···
     mainProgram = "booth";
     homepage = "https://invent.kde.org/maui/booth";
     license = licenses.gpl3Plus;
-    maintainers = with maintainers; [ milahu ];
+    maintainers = with maintainers; [ ];
   };
 }

pkgs/by-name/ho/home-manager/package.nix

···
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "home-manager";
-  version = "0-unstable-2024-12-12";
+  version = "0-unstable-2024-12-23";
 
   src = fetchFromGitHub {
     name = "home-manager-source";
     owner = "nix-community";
     repo = "home-manager";
-    rev = "3066cc58f552421a2c5414e78407fa5603405b1e";
-    hash = "sha256-e9YAMReFV1fDPcZLFC2pa4k/8TloSXeX0z2VysNMAoA=";
+    rev = "f1b1786ea77739dcd181b920d430e30fb1608b8a";
+    hash = "sha256-f9UyHMTb+BwF6RDZ8eO9HOkSlKeeSPBlcYhMmV1UNIk=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/ko/koboldcpp/package.nix

···
   fetchFromGitHub,
   stdenv,
   makeWrapper,
-  gitUpdater,
   python3Packages,
   tk,
   addDriverRunpath,
 
   apple-sdk_12,
+  darwinMinVersionHook,
 
   koboldLiteSupport ? true,
 
   config,
   cudaPackages ? { },
-
-  openblasSupport ? !stdenv.hostPlatform.isDarwin,
-  openblas,
 
   cublasSupport ? config.cudaSupport,
   # You can find a full list here: https://arnon.dk/matching-sm-architectures-arch-and-gencode-for-various-nvidia-cards/
-  # For example if you're on an GTX 1080 that means you're using "Pascal" and you need to pass "sm_60"
+  # For example if you're on an RTX 3060 that means you're using "Ampere" and you need to pass "sm_86"
   cudaArches ? cudaPackages.cudaFlags.realArches or [ ],
 
   clblastSupport ? stdenv.hostPlatform.isLinux,
   clblast,
   ocl-icd,
 
-  vulkanSupport ? true,
+  vulkanSupport ? (!stdenv.hostPlatform.isDarwin),
   vulkan-loader,
   metalSupport ? stdenv.hostPlatform.isDarwin,
   nix-update-script,
···
 in
 effectiveStdenv.mkDerivation (finalAttrs: {
   pname = "koboldcpp";
-  version = "1.79.1";
+  version = "1.80.1";
 
   src = fetchFromGitHub {
     owner = "LostRuins";
     repo = "koboldcpp";
     rev = "refs/tags/v${finalAttrs.version}";
-    hash = "sha256-RHeEI6mJklGF7BQXxLwxSr1xD6GsI9+fio888UxKru0=";
+    hash = "sha256-CgJzYF8FnHk0zKdysGJWLnNo/MND24AbQdjRbDtv0II=";
   };
 
   enableParallelBuilding = true;
···
   buildInputs =
     [ tk ]
     ++ finalAttrs.pythonInputs
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [ apple-sdk_12 ]
-    ++ lib.optionals openblasSupport [ openblas ]
+    ++ lib.optionals stdenv.hostPlatform.isDarwin [
+      apple-sdk_12
+      (darwinMinVersionHook "10.15")
+    ]
     ++ lib.optionals cublasSupport [
       cudaPackages.libcublas
       cudaPackages.cuda_nvcc
···
   pythonPath = finalAttrs.pythonInputs;
 
   makeFlags = [
-    (makeBool "LLAMA_OPENBLAS" openblasSupport)
     (makeBool "LLAMA_CUBLAS" cublasSupport)
     (makeBool "LLAMA_CLBLAST" clblastSupport)
     (makeBool "LLAMA_VULKAN" vulkanSupport)

pkgs/by-name/ma/managarr/package.nix

···
+{
+  lib,
+  fetchFromGitHub,
+  rustPlatform,
+  perl,
+}:
+
+rustPlatform.buildRustPackage rec {
+  pname = "managarr";
+  version = "0.4.2";
+
+  src = fetchFromGitHub {
+    owner = "Dark-Alex-17";
+    repo = "managarr";
+    tag = "v${version}";
+    hash = "sha256-OxGFubtMsGnR8cWDKkeAgryY095uydA3LzE5SS0dspQ=";
+  };
+
+  cargoHash = "sha256-bws4LwpJGfq0hCA2Fq51uCMvr0arbayppq1jvDrILZI=";
+
+  nativeBuildInputs = [ perl ];
+
+  meta = {
+    description = "TUI and CLI to manage your Servarrs";
+    homepage = "https://github.com/Dark-Alex-17/managarr";
+    license = lib.licenses.mit;
+    maintainers = [ lib.maintainers.IncredibleLaser ];
+    mainProgram = "managarr";
+  };
+}

pkgs/by-name/sq/sqlitestudio/package.nix

···
 }:
 stdenv.mkDerivation rec {
   pname = "sqlitestudio";
-  version = "3.4.10";
+  version = "3.4.12";
 
   src = fetchFromGitHub {
     owner = "pawelsalawa";
     repo = "sqlitestudio";
     rev = version;
-    hash = "sha256-M0k+DpHXl0UA7uGRlAz3ksUk5qI2olz9dd+jmuBZuXU=";
+    hash = "sha256-KPHiJTAxRQ3ZNnkKpfj877vTHEPRKNwy7wHfseftukQ=";
   };
 
   nativeBuildInputs =

pkgs/by-name/st/structorizer/package.nix

···
 
 stdenv.mkDerivation rec {
   pname = "structorizer";
-  version = "3.32-23";
+  version = "3.32-24";
 
   desktopItems = [
     (makeDesktopItem {
···
     owner = "fesch";
     repo = "Structorizer.Desktop";
     rev = version;
-    hash = "sha256-fqvQH4DRl+R0laGOnfWgFz67JSAdUzrws4k7gmQ3S7A=";
+    hash = "sha256-bzo8lUdjCPf22AF++Q9YnvuQp89M2T1cLixuEDHWX6U=";
   };
 
   patches = [

pkgs/by-name/ub/ubports-click/package.nix

···
+{
+  fetchFromGitLab,
+  fetchpatch,
+  gitUpdater,
+  lib,
+  stdenv,
+  testers,
+  autoreconfHook,
+  dbus,
+  dbus-test-runner,
+  dpkg,
+  getopt,
+  glib,
+  gobject-introspection,
+  json-glib,
+  libgee,
+  perl,
+  pkg-config,
+  properties-cpp,
+  python3Packages,
+  vala,
+  wrapGAppsHook3,
+}:
+
+let
+  self = python3Packages.buildPythonApplication rec {
+    pname = "click";
+    version = "0.5.2";
+    format = "other";
+
+    src = fetchFromGitLab {
+      owner = "ubports";
+      repo = "development/core/click";
+      rev = version;
+      hash = "sha256-AV3n6tghvpV/6Ew6Lokf8QAGBIMbHFAnp6G4pefVn+8=";
+    };
+
+    patches = [
+      # Remove when version > 0.5.2
+      (fetchpatch {
+        name = "0001-click-fix-Wimplicit-function-declaration.patch";
+        url = "https://gitlab.com/ubports/development/core/click/-/commit/8f654978a12e6f9a0b6ff64296ec5565e3ff5cd0.patch";
+        hash = "sha256-kio+DdtuagUNYEosyQY3q3H+dJM3cLQRW9wUKUcpUTY=";
+      })
+
+      # Remove when version > 0.5.2
+      (fetchpatch {
+        name = "0002-click-Add-uid_t-and-gid_t-to-the-ctypes-_typemap.patch";
+        url = "https://gitlab.com/ubports/development/core/click/-/commit/cbcd23b08b02fa122434e1edd69c2b3dcb6a8793.patch";
+        hash = "sha256-QaWRhxO61wAzULVqPLdJrLuBCr3+NhKmQlEPuYq843I=";
+      })
+    ];
+
+    postPatch = ''
+      # These should be proper Requires, using the header needs their headers
+      substituteInPlace lib/click/click-*.pc.in \
+        --replace-fail 'Requires.private' 'Requires'
+
+      # Don't completely override PKG_CONFIG_PATH
+      substituteInPlace click_package/tests/Makefile.am \
+        --replace-fail 'PKG_CONFIG_PATH=$(top_builddir)/lib/click' 'PKG_CONFIG_PATH=$(top_builddir)/lib/click:$(PKG_CONFIG_PATH)'
+
+      patchShebangs bin/click
+    '';
+
+    strictDeps = true;
+
+    pkgsBuildBuild = [
+      pkg-config
+    ];
+
+    nativeBuildInputs = [
+      autoreconfHook
+      dbus-test-runner # Always checking for this
+      getopt
+      gobject-introspection
+      perl
+      pkg-config
+      vala
+      wrapGAppsHook3
+    ];
+
+    buildInputs = [
+      glib
+      json-glib
+      libgee
+      properties-cpp
+    ];
+
+    propagatedBuildInputs = with python3Packages; [
+      python-debian
+      pygobject3
+      setuptools
+    ];
+
+    nativeCheckInputs = [
+      dbus
+      dpkg
+      python3Packages.unittestCheckHook
+    ];
+
+    checkInputs = with python3Packages; [
+      python-apt
+      six
+    ];
+
+    preConfigure = ''
+      export click_cv_perl_vendorlib=$out/${perl.libPrefix}
+      export PYTHON_INSTALL_FLAGS="--prefix=$out"
+    '';
+
+    configureFlags = [
+      "--with-systemdsystemunitdir=${placeholder "out"}/lib/systemd/system"
+      "--with-systemduserunitdir=${placeholder "out"}/lib/systemd/user"
+    ];
+
+    enableParallelBuilding = true;
+
+    doCheck = stdenv.buildPlatform.canExecute stdenv.hostPlatform;
+
+    disabledTestPaths = [
+      # From apt: Unable to determine a suitable packaging system type
+      "click_package/tests/integration/test_signatures.py"
+      "click_package/tests/test_build.py"
+      "click_package/tests/test_install.py"
+      "click_package/tests/test_scripts.py"
+    ];
+
+    preCheck = ''
+      export HOME=$TMP
+
+      # tests recompile some files for loaded predefines, doesn't use any optimisation level for it
+      # makes test output harder to read, so make the warning go away
+      export NIX_CFLAGS_COMPILE+=" -U_FORTIFY_SOURCE"
+
+      # Haven'tbeen able to get them excluded via disabledTest{s,Paths}, just deleting them
+      for path in $disabledTestPaths; do
+        rm -v $path
+      done
+    '';
+
+    preFixup = ''
+      makeWrapperArgs+=(
+        --prefix LD_LIBRARY_PATH : "$out/lib"
+      )
+    '';
+
+    passthru = {
+      updateScript = gitUpdater { };
+    };
+
+    meta = {
+      description = "Tool to build click packages, mainly used for Ubuntu Touch";
+      homepage = "https://gitlab.com/ubports/development/core/click";
+      changelog = "https://gitlab.com/ubports/development/core/click/-/blob/${version}/ChangeLog";
+      license = lib.licenses.gpl3Only;
+      mainProgram = "click";
+      maintainers =
+        with lib.maintainers;
+        [
+          ilyakooo0
+        ]
+        ++ lib.teams.lomiri.members;
+      platforms = lib.platforms.linux;
+      pkgConfigModules = [
+        "click-0.4"
+      ];
+    };
+  };
+in
+self
+// {
+  passthru = self.passthru // {
+    tests.pkg-config = testers.hasPkgConfigModules {
+      package = self;
+    };
+  };
+}

pkgs/by-name/wa/waymore/package.nix

···
+{
+  lib,
+  fetchFromGitHub,
+  python3Packages,
+  waymore,
+  testers,
+}:
+
+python3Packages.buildPythonApplication rec {
+  pname = "waymore";
+  version = "4.7";
+
+  src = fetchFromGitHub {
+    owner = "xnl-h4ck3r";
+    repo = "waymore";
+    tag = "v${version}";
+    hash = "sha256-oaswuXQPdAl2XExwEWnSN15roqNj9OVUr1Y1vsX461o=";
+  };
+
+  preBuild = ''
+    export HOME=$(mktemp -d)
+  '';
+
+  build-system = with python3Packages; [
+    setuptools
+  ];
+
+  dependencies = with python3Packages; [
+    requests
+    termcolor
+    pyyaml
+    psutil
+    uritools
+    tldextract
+  ];
+
+  passthru.tests.version = testers.testVersion {
+    package = waymore;
+    command = "waymore --version";
+    version = "Waymore - v${version}";
+  };
+
+  meta = {
+    description = "Find way more from the Wayback Machine";
+    homepage = "https://github.com/xnl-h4ck3r/waymore";
+    changelog = "https://github.com/xnl-h4ck3r/waymore/releases/tag/v${version}";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ genga898 ];
+    mainProgram = "waymore";
+  };
+}

pkgs/desktops/deepin/apps/deepin-editor/default.nix

···
 
 stdenv.mkDerivation rec {
   pname = "deepin-editor";
-  version = "6.5.2";
+  version = "6.5.8";
 
   src = fetchFromGitHub {
     owner = "linuxdeepin";
     repo = pname;
     rev = version;
-    hash = "sha256-Z3fsnjo4Pcu1e8lKvWdWBhpoOFFy0dSrI2HehRYKJ0k=";
+    hash = "sha256-QMq7DIggMhY4EseIa7/tvgxGwZn07OitOm1YjrzMFHg=";
   };
 
   nativeBuildInputs = [

pkgs/development/libraries/qt-6/modules/qtbase/default.nix

···
       lgpl3Plus
     ];
     maintainers = with maintainers; [
-      milahu
       nickcao
       LunNova
     ];

pkgs/development/libraries/qt-6/modules/qtwebengine/default.nix

···
   bootstrap_cmds,
   cctools,
   xcbuild,
+  fetchpatch,
 }:
 
 qtModule {
···
 
     # Override locales install path so they go to QtWebEngine's $out
     ./locales-path.patch
+
+    # Fix build of vendored xnnpack on aarch64/gcc14
+    # FIXME: remove when upstream updates
+    (fetchpatch {
+      url = "https://github.com/google/XNNPACK/commit/1b11a8b0620afe8c047304273674c4c57c289755.patch";
+      stripLen = 1;
+      extraPrefix = "src/3rdparty/chromium/third_party/xnnpack/src/";
+      hash = "sha256-GUESVNR88I1K2V5xr0e09ec4j2eselMhNN06+PCcINM=";
+    })
   ];
 
   postPatch =

pkgs/development/libraries/qt-6/qtModule.nix

···
         lgpl3Plus
       ];
       maintainers = with maintainers; [
-        milahu
         nickcao
       ];
       platforms = platforms.unix;

pkgs/development/python-modules/flask-security/default.nix

···
     hash = "sha256-RGRwgrDFe+0v8NYyajMikdoi1DQf1I+B5y8KJyF+cZs=";
   };
 
+  patches = [
+    # https://github.com/pallets-eco/flask-security/pull/1040
+    ./fix_test_basic.patch
+  ];
+
   build-system = [ flit-core ];
 
   # flask-login>=0.6.2 not satisfied by version 0.7.0.dev0

pkgs/development/python-modules/flask-security/fix_test_basic.patch

···
+diff --git a/tests/test_basic.py b/tests/test_basic.py
+index d52be429..09dfa8e4 100644
+--- a/tests/test_basic.py
++++ b/tests/test_basic.py
+@@ -157,6 +157,8 @@ def test_authenticate_with_subdomain_next(app, client, get_message):
+ 
+ @pytest.mark.settings(subdomain="auth")
+ def test_authenticate_with_root_domain_next(app, client, get_message):
++    # As of Flask 3.1 this must be explicitly set.
++    app.subdomain_matching = True
+     app.config["SERVER_NAME"] = "lp.com"
+     app.config["SECURITY_REDIRECT_ALLOW_SUBDOMAINS"] = True
+     data = dict(email="[e-mail]", password="password")

pkgs/development/python-modules/httpx-oauth/default.nix

···
 
 buildPythonPackage rec {
   pname = "httpx-oauth";
-  version = "0.16.0";
+  version = "0.16.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "frankie567";
     repo = "httpx-oauth";
     tag = "v${version}";
-    hash = "sha256-KM+GaBC3jOhMsTVdUixsEjm47j28qeFmFKbI7fnVSG4=";
+    hash = "sha256-/2IBAEZrK0Do7t9g+MWsKuIlcg0ANCfOoagVwTbBso8=";
   };
 
   build-system = [

pkgs/development/python-modules/kserve/default.nix

···
 
 buildPythonPackage rec {
   pname = "kserve";
-  version = "0.14.0";
+  version = "0.14.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "kserve";
     repo = "kserve";
-    rev = "refs/tags/v${version}";
-    hash = "sha256-N/IgiTiyBNw7WQWxcUJlXU+Q9o3UUaduD9ZBKwu0uRE=";
+    tag = "v${version}";
+    hash = "sha256-VwuUXANjshV4fN0i54Fs0zubHY81UtQcCV14JwMpXwA=";
   };
 
   sourceRoot = "${src.name}/python/kserve";
···
   pythonRelaxDeps = [
     "fastapi"
     "httpx"
+    "numpy"
     "prometheus-client"
     "protobuf"
     "uvicorn"

pkgs/development/python-modules/libuuu/default.nix

···
 
 buildPythonPackage rec {
   pname = "libuuu";
-  version = "1.5.182";
+  version = "1.5.182.post1";
   pyproject = true;
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-k6JwGxYeFbGNl7zcuKN6SbRq8Z4yD1dXXL3ORyGqhYE=";
+    hash = "sha256-Hf0GwhrzKQL5w+OXQ39yuG4xmbk/1HgCCdCulIORSU8=";
   };
 
   build-system = [

pkgs/development/python-modules/slugid/default.nix

···
     description = "URL-safe base64 UUID encoder for generating 22 character slugs";
     homepage = "https://github.com/taskcluster/slugid.py";
     license = licenses.mpl20;
-    maintainers = with maintainers; [ milahu ];
+    maintainers = with maintainers; [ ];
   };
 }

pkgs/development/tools/click/dbus-test-runner.patch

···
-diff --git a/click_package/Makefile.am b/click_package/Makefile.am
-index 4981d74..9df9e79 100644
---- a/click_package/Makefile.am
-+++ b/click_package/Makefile.am
-@@ -1,5 +1,3 @@
--SUBDIRS = tests
--
- noinst_SCRIPTS = paths.py
- CLEANFILES = $(noinst_SCRIPTS)
- 
-diff --git a/configure.ac b/configure.ac
-index 8f4dc9e..adbd366 100644
---- a/configure.ac
-+++ b/configure.ac
-@@ -52,8 +52,6 @@ PKG_CHECK_MODULES([SERVICE], [
- AC_SUBST([SERVICE_CFLAGS])
- AC_SUBST([SERVICE_LIBS])
- 
--AC_CHECK_PROG(DBUS_TEST_RUNNER_CHECK,dbus-test-runner,yes)
--AS_IF([test "${DBUS_TEST_RUNNER_CHECK}" != "yes"], [AC_MSG_ERROR([dbus-test-runner not found])])
- AC_CHECK_PROG(GDBUS_CHECK,gdbus,yes)
- AS_IF([test "${GDBUS_CHECK}" != "yes"], [AC_MSG_ERROR([gdbus (glib) not found])])
- 

pkgs/development/tools/click/default.nix

···
-{
-  lib,
-  fetchFromGitLab,
-  buildPythonApplication,
-  autoreconfHook,
-  python-debian,
-  perl,
-  vala,
-  pkg-config,
-  libgee,
-  json-glib,
-  properties-cpp,
-  gobject-introspection,
-  getopt,
-  setuptools,
-  pygobject3,
-  wrapGAppsHook3,
-}:
-
-buildPythonApplication {
-  pname = "click";
-  version = "unstable-2023-02-22";
-  format = "other";
-
-  src = fetchFromGitLab {
-    owner = "ubports";
-    repo = "development/core/click";
-    rev = "aaf2735e8e6cbeaf2e429c70136733513a81718a";
-    hash = "sha256-pNu995/w3tbz15QQVdVYBnWnAoZmqWj1DN/5PZZ0iZw=";
-  };
-
-  postPatch = ''
-    # These should be proper Requires, using the header needs their headers
-    substituteInPlace lib/click/click-*.pc.in \
-      --replace 'Requires.private' 'Requires'
-  '';
-
-  configureFlags = [
-    "--with-systemdsystemunitdir=${placeholder "out"}/lib/systemd/system"
-    "--with-systemduserunitdir=${placeholder "out"}/lib/systemd/user"
-  ];
-
-  preFixup = ''
-    makeWrapperArgs+=(
-      --prefix LD_LIBRARY_PATH : "$out/lib"
-    )
-  '';
-
-  preConfigure = ''
-    export click_cv_perl_vendorlib=$out/${perl.libPrefix}
-    export PYTHON_INSTALL_FLAGS="--prefix=$out"
-  '';
-
-  nativeBuildInputs = [
-    autoreconfHook
-    perl
-    pkg-config
-    gobject-introspection
-    vala
-    getopt
-    wrapGAppsHook3
-  ];
-
-  # Tests were omitted for time constraint reasons
-  doCheck = false;
-
-  enableParallelBuilding = true;
-
-  patches = [
-    # dbus-test-runner not packaged yet, otherwise build-time dependency even when not running tests
-    ./dbus-test-runner.patch
-  ];
-
-  buildInputs = [
-    libgee
-    json-glib
-    properties-cpp
-  ];
-
-  propagatedBuildInputs = [
-    python-debian
-    pygobject3
-    setuptools
-  ];
-
-  meta = {
-    description = "Tool to build click packages. Mainly used for Ubuntu Touch";
-    homepage = "https://gitlab.com/ubports/development/core/click";
-    license = lib.licenses.gpl3Only;
-    maintainers = with lib.maintainers; [
-      ilyakooo0
-      OPNA2608
-    ];
-    platforms = lib.platforms.linux;
-  };
-}

pkgs/top-level/all-packages.nix

···
     llvmPackages = llvmPackages_18;
   };
 
-  ubports-click = python3Packages.callPackage ../development/tools/click { };
-
   urweb = callPackage ../development/compilers/urweb {
     icu = icu67;
   };