Merge master into staging-next

lib/tests/misc.nix

···
     };
     expected = "c";
   };
+
+  testMergeTypesSimple =
+    let
+      mergedType = types.mergeTypes types.str types.str;
+    in
+  {
+    expr = mergedType.name;
+    expected = "str";
+  };
+
+  testMergeTypesFail =
+    let
+      mergedType = types.mergeTypes types.str types.int;
+    in
+  {
+    expr = types.isType "merge-error" mergedType;
+    expected = true;
+  };
+
+  testMergeTypesEnum =
+    let
+      enumAB = lib.types.enum ["A" "B"];
+      enumXY = lib.types.enum ["X" "Y"];
+      merged = lib.types.mergeTypes enumAB enumXY; # -> enum [ "A" "B" "X" "Y" ]
+    in
+  {
+    expr = {
+      checkA = merged.check "A";
+      checkB = merged.check "B";
+      checkX = merged.check "X";
+      checkY = merged.check "Y";
+      checkC = merged.check "C";
+    };
+    expected = {
+      checkA = true;
+      checkB = true;
+      checkX = true;
+      checkY = true;
+      checkC = false;
+    };
+  };
 }

lib/types.nix

···
     addCheck = elemType: check: elemType // { check = x: elemType.check x && check x; };
 
   };
+
+  /**
+    Merges two option types together.
+
+    :::{.note}
+    Uses the type merge function of the first type, to merge it with the second type.
+
+    Usually types can only be merged if they are of the same type
+    :::
+
+    # Inputs
+
+    : `a` (option type): The first option type.
+    : `b` (option type): The second option type.
+
+    # Returns
+
+    - The merged option type.
+    - `{ _type = "merge-error"; error = "Cannot merge types"; }` if the types can't be merged.
+
+    # Examples
+    :::{.example}
+    ## `lib.types.mergeTypes` usage example
+    ```nix
+    let
+      enumAB = lib.types.enum ["A" "B"];
+      enumXY = lib.types.enum ["X" "Y"];
+      # This operation could be notated as: [ A ] | [ B ] -> [ A B ]
+      merged = lib.types.mergeTypes enumAB enumXY; # -> enum [ "A" "B" "X" "Y" ]
+    in
+      assert merged.check "A"; # true
+      assert merged.check "B"; # true
+      assert merged.check "X"; # true
+      assert merged.check "Y"; # true
+      merged.check "C" # false
+    ```
+    :::
+  */
+  mergeTypes = a: b:
+    assert isOptionType a && isOptionType b;
+    let
+      merged = a.typeMerge b.functor;
+    in
+    if merged == null then
+      setType "merge-error" { error = "Cannot merge types"; }
+    else
+      merged;
 };
 
 in outer_types // outer_types.types

maintainers/scripts/luarocks-packages.csv

···
 nlua,,,,,,teto
 nui.nvim,,,,,,mrcjkb
 nvim-cmp,https://raw.githubusercontent.com/hrsh7th/nvim-cmp/main/nvim-cmp-scm-1.rockspec,,,,,
+nvim-dbee,,,,,,perchun
 nvim-nio,,,,,,mrcjkb
 orgmode,,,,,,
 papis-nvim,,,,,,GaetanLepage

nixos/doc/manual/release-notes/rl-2505.section.md

···
 
 - [waagent](https://github.com/Azure/WALinuxAgent), the Microsoft Azure Linux Agent (waagent) manages Linux provisioning and VM interaction with the Azure Fabric Controller. Available with [services.waagent](options.html#opt-services.waagent.enable).
 
+- [nfc-nci](https://github.com/StarGate01/ifdnfc-nci), an alternative NFC stack and PC/SC driver for the NXP PN54x chipset, commonly found in Lenovo systems as NXP1001 (NPC300). Available as [hardware.nfc-nci](#opt-hardware.nfc-nci.enable).
+
 - [duckdns](https://www.duckdns.org), free dynamic DNS. Available with [services.duckdns](options.html#opt-services.duckdns.enable)
 
 - [nostr-rs-relay](https://git.sr.ht/~gheartsfield/nostr-rs-relay/), This is a nostr relay, written in Rust. Available as [services.nostr-rs-relay](options.html#opt-services.nostr-rs-relay.enable).

nixos/modules/hardware/nfc-nci.nix

···
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+let
+  cfg = config.hardware.nfc-nci;
+
+  # To understand these settings in more detail, refer to the upstream configuration templates
+  # available at https://github.com/NXPNFCLinux/linux_libnfc-nci/tree/master/conf .
+  # Settings in curly braces are NCI commands, the "NFC Controller Interface Specification"
+  # as well as the "NFC Digital Protocol Technical Specification" can be found online.
+  # These default settings have been specifically engineered for the Lenovo NXP1001 (NPC300) chipset.
+  defaultSettings = {
+    # This block will be emitted into /etc/libnfc-nci.conf
+    nci = {
+      # Set up general logging
+      APPL_TRACE_LEVEL = "0x01";
+      PROTOCOL_TRACE_LEVEL = "0x01";
+      # Set up which NFC technologies are enabled (due to e.g. local regulation or patent law)
+      HOST_LISTEN_TECH_MASK = "0x07";
+      POLLING_TECH_MASK = "0xEF";
+      P2P_LISTEN_TECH_MASK = "0xC5";
+    };
+    # This block will be emitted into /etc/libnfc-nxp-init.conf
+    init = {
+      # Setup logging of the individual userland library components
+      NXPLOG_GLOBAL_LOGLEVEL = "0x01";
+      NXPLOG_EXTNS_LOGLEVEL = "0x01";
+      NXPLOG_NCIHAL_LOGLEVEL = "0x01";
+      NXPLOG_NCIX_LOGLEVEL = "0x01";
+      NXPLOG_NCIR_LOGLEVEL = "0x01";
+      NXPLOG_FWDNLD_LOGLEVEL = "0x00";
+      NXPLOG_TML_LOGLEVEL = "0x01";
+      # Where to find the kernel device node
+      NXP_NFC_DEV_NODE = ''"/dev/pn544"'';
+      # Enable the NXP proprietary features of the chip
+      NXP_ACT_PROP_EXTN = "{2F, 02, 00}";
+      # Configure the NFC Forum profile:
+      # 0xA0 0x44: POLL_PROFILE_SEL_CFG = 0x00 (Use NFC Forum profile default configuration values. Specifically, not EMVCo.)
+      NXP_NFC_PROFILE_EXTN = ''
+        {20, 02, 05, 01,
+          A0, 44, 01, 00
+        }
+      '';
+      # Enable chip standby mode
+      NXP_CORE_STANDBY = "{2F, 00, 01, 01}";
+      # Enable NCI packet fragmentation on the I2C bus
+      NXP_I2C_FRAGMENTATION_ENABLED = "0x01";
+    };
+    # This block will be emitted into /etc/libnfc-nxp-pn547.conf as well as /etc/libnfc-nxp-pn548.conf
+    # Which file is actually used is decided by the library at runtime depending on chip variant, both files are required.
+    pn54x = {
+      # Enable Mifare Classic reader functionality
+      MIFARE_READER_ENABLE = "0x01";
+      # Configure clock source - use XTAL (hardware crystal) instead of PLL (synthetic clock)
+      NXP_SYS_CLK_SRC_SEL = "0x01";
+      NXP_SYS_CLK_FREQ_SEL = "0x00";
+      NXP_SYS_CLOCK_TO_CFG = "0x01";
+      # Configure the non-propriety NCI settings in EEPROM:
+      # 0x28: PN_NFC_DEP_SPEED = 0x00 (Data exchange: Highest Available Bit Rates)
+      # 0x21: PI_BIT_RATE = 0x00 (Maximum allowed bit rate: 106 Kbit/s)
+      # 0x30: LA_BIT_FRAME_SDD = 0x08 (Bit Frame SDD value to be sent in Byte 1 of SENS_RES)
+      # 0x31: LA_PLATFORM_CONFIG = 0x03 (Platform Configuration value to be sent in Byte 2 of SENS_RES)
+      # 0x33: LA_NFCID1 = [ 0x04 0x03 0x02 0x01 ] ("Unique" NFCID1 ID in SENS_RES)
+      # 0x54: LF_CON_BITR_F = 0x06 (Bit rates to listen for: Both)
+      # 0x50: LF_PROTOCOL_TYPE = 0x02 (Protocols supported in Listen Mode for NFC-F: NFC-DEP)
+      # 0x5B: LI_BIT_RATE = 0x00 (Maximum supported bit rate: 106 Kbit/s)
+      # 0x60: LN_WT = 0x0E (Waiting Time NFC-DEP WT_MAX default for Initiator)
+      # 0x80: RF_FIELD_INFO = 0x01 (Chip is allowed to emit RF Field Information Notifications)
+      # 0x81: RF_NFCEE_ACTION = 0x01 (Chip should send trigger notification for the default set of NFCEE actions)
+      # 0x82: NFCDEP_OP = 0x0E (NFC-DEP protocol behavior: Default flags, but also enable RTOX requests)
+      # 0x18: PF_BIT_RATE = 0x01 (NFC-F discovery polling initial bit rate: 106 Kbit/s)
+      NXP_CORE_CONF = ''
+        {20, 02, 2B, 0D,
+          28, 01, 00,
+          21, 01, 00,
+          30, 01, 08,
+          31, 01, 03,
+          33, 04, 04, 03, 02, 01,
+          54, 01, 06,
+          50, 01, 02,
+          5B, 01, 00,
+          60, 01, 0E,
+          80, 01, 01,
+          81, 01, 01,
+          82, 01, 0E,
+          18, 01, 01
+        }
+      '';
+      # Configure the proprietary NXP extension to the NCI standard in EEPROM:
+      # 0xA0 0x5E: JEWEL_RID_CFG = 0x01 (Enable sending RID to T1T on RF)
+      # 0xA0 0x40: TAG_DETECTOR_CFG = 0x00 (Tag detector: Disable both AGC based detection and trace mode)
+      # 0xA0 0x43: TAG_DETECTOR_FALLBACK_CNT_CFG = 0x00 (Tag detector: Disable hybrid mode, only use LPCD to initiate polling)
+      # 0xA0 0x0F: DH_EEPROM_AREA_1 = [ 32 bytes of opaque Lenovo data ] (Custom configuration for the Lenovo customized chip firmware)
+      # See also https://github.com/nfc-tools/libnfc/issues/455#issuecomment-2221979571
+      NXP_CORE_CONF_EXTN = ''
+        {20, 02, 30, 04,
+          A0, 5E, 01, 01,
+          A0, 40, 01, 00,
+          A0, 43, 01, 00,
+          A0, 0F, 20,
+          00, 03, 1D, 01, 03, 00, 02, 00,
+          01, 00, 01, 00, 00, 00, 00, 00,
+          00, 00, 00, 00, 00, 00, 00, 00,
+          00, 00, 00, 00, 00, 00, 00, 00
+        }
+      '';
+      # Firmware-specific protocol configuration parameters (one byte per protocol)
+      NXP_NFC_PROPRIETARY_CFG = "{05:FF:FF:06:81:80:70:FF:FF}";
+      # Configure power supply of chip, use Lenovo driver configuration, which deviates a bit from the spec:
+      # 0xA0 0x0E: PMU_CFG = [ 0x16, 0x09, 0x00 ] (VBAT1 connected to 5V, TVDD monitoring: 3.6V, TxLDO Voltage in reader and card mode: 3.3V)
+      NXP_EXT_TVDD_CFG = "0x01";
+      NXP_EXT_TVDD_CFG_1 = ''
+        {20, 02, 07, 01,
+          A0, 0E, 03, 16, 09, 00
+        }
+      '';
+      # Use the default for NFA_EE_MAX_EE_SUPPORTED stack size (concerns HCI)
+      NXP_NFC_MAX_EE_SUPPORTED = "0x00";
+    };
+  };
+
+  generateSettings =
+    cfgName:
+    let
+      toKeyValueLines =
+        obj: builtins.concatStringsSep "\n" (map (key: "${key}=${obj.${key}}") (builtins.attrNames obj));
+    in
+    toKeyValueLines (defaultSettings.${cfgName} // (cfg.settings.${cfgName} or { }));
+in
+{
+  options.hardware.nfc-nci = {
+    enable = lib.mkEnableOption "PN5xx kernel module with udev rules, libnfc-nci userland, and optional ifdnfc-nci PC/SC driver";
+
+    settings = lib.mkOption {
+      default = defaultSettings;
+      description = ''
+        Configuration to be written to the libncf-nci configuration files.
+        To understand the configuration format, refer to https://github.com/NXPNFCLinux/linux_libnfc-nci/tree/master/conf.
+      '';
+      type = lib.types.attrs;
+    };
+
+    enableIFD = lib.mkOption {
+      type = lib.types.bool;
+      default = true;
+      description = ''
+        Register ifdnfc-nci as a serial reader with pcscd.
+      '';
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    environment.systemPackages =
+      [
+        pkgs.libnfc-nci
+      ]
+      ++ lib.optionals cfg.enableIFD [
+        pkgs.ifdnfc-nci
+      ];
+
+    environment.etc = {
+      "libnfc-nci.conf".text = generateSettings "nci";
+      "libnfc-nxp-init.conf".text = generateSettings "init";
+      "libnfc-nxp-pn547.conf".text = generateSettings "pn54x";
+      "libnfc-nxp-pn548.conf".text = generateSettings "pn54x";
+    };
+
+    services.udev.packages = [
+      config.boot.kernelPackages.nxp-pn5xx
+    ];
+
+    boot.blacklistedKernelModules = [
+      "nxp_nci_i2c"
+      "nxp_nci"
+    ];
+
+    boot.extraModulePackages = [
+      config.boot.kernelPackages.nxp-pn5xx
+    ];
+
+    boot.kernelModules = [
+      "nxp-pn5xx"
+    ];
+
+    services.pcscd.readerConfigs = lib.mkIf cfg.enableIFD [
+      ''
+        FRIENDLYNAME "NFC NCI"
+        LIBPATH      ${pkgs.ifdnfc-nci}/lib/libifdnfc-nci.so
+        CHANNELID    0
+      ''
+    ];
+
+    # NFC chip looses power when system goes to sleep / hibernate,
+    # and needs to be re-initialized upon wakeup
+    powerManagement.resumeCommands = lib.mkIf cfg.enableIFD ''
+      systemctl restart pcscd.service
+    '';
+  };
+
+  meta.maintainers = with lib.maintainers; [ stargate01 ];
+}

nixos/modules/module-list.nix

···
   ./hardware/network/eg25-manager.nix
   ./hardware/network/intel-2200bg.nix
   ./hardware/new-lg4ff.nix
+  ./hardware/nfc-nci.nix
   ./hardware/nitrokey.nix
   ./hardware/onlykey/default.nix
   ./hardware/openrazer.nix

nixos/modules/services/hardware/pcscd.nix

···
-{ config, lib, pkgs, ... }:
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
 let
   cfg = config.services.pcscd;
-  cfgFile = pkgs.writeText "reader.conf" config.services.pcscd.readerConfig;
+  cfgFile = pkgs.writeText "reader.conf" (
+    builtins.concatStringsSep "\n\n" config.services.pcscd.readerConfigs
+  );
 
-  package = if config.security.polkit.enable
-              then pkgs.pcscliteWithPolkit
-              else pkgs.pcsclite;
+  package = if config.security.polkit.enable then pkgs.pcscliteWithPolkit else pkgs.pcsclite;
 
   pluginEnv = pkgs.buildEnv {
     name = "pcscd-plugins";
···
 
 in
 {
+  imports = [
+    (lib.mkChangedOptionModule
+      [ "services" "pcscd" "readerConfig" ]
+      [ "services" "pcscd" "readerConfigs" ]
+      (
+        config:
+        let
+          readerConfig = lib.getAttrFromPath [ "services" "pcscd" "readerConfig" ] config;
+        in
+        [ readerConfig ]
+      )
+    )
+  ];
+
   options.services.pcscd = {
     enable = lib.mkEnableOption "PCSC-Lite daemon, to access smart cards using SCard API (PC/SC)";
 
···
       description = "Plugin packages to be used for PCSC-Lite.";
     };
 
-    readerConfig = lib.mkOption {
-      type = lib.types.lines;
-      default = "";
-      example = ''
-        FRIENDLYNAME      "Some serial reader"
-        DEVICENAME        /dev/ttyS0
-        LIBPATH           /path/to/serial_reader.so
-        CHANNELID         1
-      '';
+    readerConfigs = lib.mkOption {
+      type = lib.types.listOf lib.types.lines;
+      default = [ ];
+      example = [
+        ''
+          FRIENDLYNAME      "Some serial reader"
+          DEVICENAME        /dev/ttyS0
+          LIBPATH           /path/to/serial_reader.so
+          CHANNELID         1
+        ''
+      ];
       description = ''
         Configuration for devices that aren't hotpluggable.
 
···
       # around it, we force the path to the cfgFile.
       #
       # https://github.com/NixOS/nixpkgs/issues/121088
-      serviceConfig.ExecStart = [ "" "${lib.getExe package} -f -x -c ${cfgFile} ${lib.escapeShellArgs cfg.extraArgs}" ];
+      serviceConfig.ExecStart = [
+        ""
+        "${lib.getExe package} -f -x -c ${cfgFile} ${lib.escapeShellArgs cfg.extraArgs}"
+      ];
     };
   };
 }

nixos/tests/vaultwarden.nix

···
 
               driver.find_element(By.XPATH, "//button[contains(., 'Continue')]").click()
 
-              driver.find_element(By.CSS_SELECTOR, 'input#login_input_master-password').send_keys(
+              driver.find_element(By.XPATH, '//input[@type="password"]').send_keys(
                   '${userPassword}'
               )
-              driver.find_element(By.XPATH, "//button[contains(., 'Log in')]").click()
+              driver.find_element(By.XPATH, "//button[contains(., 'Log in with master password')]").click()
 
-              wait.until(EC.title_contains("Vaults"))
-
-              driver.find_element(By.XPATH, "//button[contains(., 'New item')]").click()
+              wait.until(EC.presence_of_element_located((By.CSS_SELECTOR, 'button#newItemDropdown'))).click()
+              driver.find_element(By.XPATH, "//button[contains(., 'Item')]").click()
 
               driver.find_element(By.CSS_SELECTOR, 'input#name').send_keys(
                   'secrets'

pkgs/applications/editors/neovim/tests/default.nix

···
       ${pkgs.perl}/bin/perl -pe "s|\Q$NIX_STORE\E/[a-z0-9]{32}-|$NIX_STORE/eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee-|g" < "$luarc" > "$luarcGeneric"
     '' + buildCommand);
 
+  nvim_with_rocks_nvim = (
+    wrapNeovimUnstable neovim-unwrapped {
+      extraName = "with-rocks-nvim";
+      wrapperArgs = "--set NVIM_APPNAME test-rocks-nvim";
+      plugins = [ vimPlugins.rocks-nvim ];
+    }
+  );
 in
   pkgs.recurseIntoAttrs (rec {
 
···
   can_require_transitive_deps =
     runTest nvim-with-luasnip ''
     ${nvim-with-luasnip}/bin/nvim -i NONE --cmd "lua require'jsregexp'" -e +quitall!
+  '';
+
+  inherit nvim_with_rocks_nvim;
+  rocks_install_plenary = runTest nvim_with_rocks_nvim ''
+    ${nvim_with_rocks_nvim}/bin/nvim -V3log.txt -i NONE +'Rocks install plenary.nvim' +quit! -e
   '';
 
   inherit (vimPlugins) corePlugins;

pkgs/applications/editors/vim/plugins/overrides.nix

···
     passthru.python3Dependencies = [ python3.pkgs.mwclient ];
   };
 
-  nvim-dbee = super.nvim-dbee.overrideAttrs (
-    oa:
-    let
-      dbee-go = buildGoModule {
-        name = "nvim-dbee";
-        src = "${oa.src}/dbee";
-        vendorHash = "sha256-U/3WZJ/+Bm0ghjeNUILsnlZnjIwk3ySaX3Rd4L9Z62A=";
-        buildInputs = [
-          arrow-cpp
-          duckdb
-        ];
-      };
-    in
-    {
-      dependencies = [ self.nui-nvim ];
-
-      # nvim-dbee looks for the go binary in paths returned bu M.dir() and M.bin() defined in lua/dbee/install/init.lua
-      postPatch = ''
-        substituteInPlace lua/dbee/install/init.lua \
-          --replace-fail 'return vim.fn.stdpath("data") .. "/dbee/bin"' 'return "${dbee-go}/bin"'
-      '';
-
-      preFixup = ''
-        mkdir $target/bin
-        ln -s ${dbee-go}/bin/dbee $target/bin/dbee
-      '';
-
-      meta.platforms = lib.platforms.linux;
-    }
-  );
-
-  nvim-impairative = super.nvim-impairative.overrideAttrs {
-  };
-
   nvim-navic = super.nvim-navic.overrideAttrs {
     dependencies = [ self.nvim-lspconfig ];
   };
···
       "neotest"
       "nui-nvim"
       "nvim-cmp"
+      "nvim-dbee"
       "nvim-nio"
       "orgmode"
       "papis-nvim"
       "rest-nvim"
       "rocks-config-nvim"
-      "rocks-nvim"
       "rtp-nvim"
       "telescope-manix"
       "telescope-nvim"
···
   in
   lib.genAttrs luarocksPackageNames toVimPackage
 )
+// {
+
+  rocks-nvim =
+    (neovimUtils.buildNeovimPlugin {
+      luaAttr = luaPackages.rocks-nvim;
+    }).overrideAttrs
+      (oa: {
+        passthru = oa.passthru // {
+          initLua = ''
+            vim.g.rocks_nvim = {
+              luarocks_binary = "${neovim-unwrapped.lua.pkgs.luarocks_bootstrap}/bin/luarocks"
+              }
+          '';
+        };
+
+      });
+}

pkgs/applications/misc/electrum/default.nix

···
 
   postPatch =
     ''
+      # fix compatibility with recent aiorpcx version
+      # (remove as soon as https://github.com/spesmilo/electrum/commit/171aa5ee5ad4e25b9da10f757d9d398e905b4945 is included in source tarball)
+      substituteInPlace ./contrib/requirements/requirements.txt \
+        --replace-fail "aiorpcx>=0.22.0,<0.24" "aiorpcx>=0.22.0,<0.25"
+      substituteInPlace ./run_electrum \
+        --replace-fail "if not ((0, 22, 0) <= aiorpcx._version < (0, 24)):" "if not ((0, 22, 0) <= aiorpcx._version < (0, 25)):" \
+        --replace-fail "aiorpcX version {aiorpcx._version} does not match required: 0.22.0<=ver<0.24" "aiorpcX version {aiorpcx._version} does not match required: 0.22.0<=ver<0.25"
+      substituteInPlace ./electrum/electrum \
+        --replace-fail "if not ((0, 22, 0) <= aiorpcx._version < (0, 24)):" "if not ((0, 22, 0) <= aiorpcx._version < (0, 25)):" \
+        --replace-fail "aiorpcX version {aiorpcx._version} does not match required: 0.22.0<=ver<0.24" "aiorpcX version {aiorpcx._version} does not match required: 0.22.0<=ver<0.25"
+
       # make compatible with protobuf4 by easing dependencies ...
       substituteInPlace ./contrib/requirements/requirements.txt \
-        --replace "protobuf>=3.20,<4" "protobuf>=3.20"
+        --replace-fail "protobuf>=3.20,<4" "protobuf>=3.20"
       # ... and regenerating the paymentrequest_pb2.py file
       protoc --python_out=. electrum/paymentrequest.proto
 
       substituteInPlace ./electrum/ecc_fast.py \
-        --replace ${libsecp256k1_name} ${secp256k1}/lib/libsecp256k1${stdenv.hostPlatform.extensions.sharedLibrary}
+        --replace-fail ${libsecp256k1_name} ${secp256k1}/lib/libsecp256k1${stdenv.hostPlatform.extensions.sharedLibrary}
     ''
     + (
       if enableQt then
         ''
           substituteInPlace ./electrum/qrscanner.py \
-            --replace ${libzbar_name} ${zbar.lib}/lib/libzbar${stdenv.hostPlatform.extensions.sharedLibrary}
+            --replace-fail ${libzbar_name} ${zbar.lib}/lib/libzbar${stdenv.hostPlatform.extensions.sharedLibrary}
         ''
       else
         ''
···
 
   postInstall = lib.optionalString stdenv.hostPlatform.isLinux ''
     substituteInPlace $out/share/applications/electrum.desktop \
-      --replace 'Exec=sh -c "PATH=\"\\$HOME/.local/bin:\\$PATH\"; electrum %u"' \
-                "Exec=$out/bin/electrum %u" \
-      --replace 'Exec=sh -c "PATH=\"\\$HOME/.local/bin:\\$PATH\"; electrum --testnet %u"' \
-                "Exec=$out/bin/electrum --testnet %u"
+      --replace-fail "Exec=electrum %u" "Exec=$out/bin/electrum %u" \
+      --replace-fail "Exec=electrum --testnet %u" "Exec=$out/bin/electrum --testnet %u"
   '';
 
   postFixup = lib.optionalString enableQt ''

pkgs/by-name/am/amdvlk/package.nix

···
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "amdvlk";
-  version = "2024.Q4.3";
+  version = "2025.Q1.1";
 
   src = fetchRepoProject {
     name = "amdvlk-src";
     manifest = "https://github.com/GPUOpen-Drivers/AMDVLK.git";
     rev = "refs/tags/v-${finalAttrs.version}";
-    hash = "sha256-PQxTRCSOk8E6y7pXyqxt1QKtRsqnrj/9dQZ8NjnUbhA=";
+    hash = "sha256-snwNyi/8voptLhZkXLK0QNh7pKo4SFx1iQojNzVr1Ms=";
   };
 
   buildInputs =

pkgs/by-name/au/autobrr/package.nix

···
 {
   lib,
+  stdenv,
   buildGoModule,
   fetchFromGitHub,
   stdenvNoCC,
···
 
 let
   pname = "autobrr";
-  version = "1.57.0";
+  version = "1.58.0";
   src = fetchFromGitHub {
     owner = "autobrr";
     repo = "autobrr";
     tag = "v${version}";
-    hash = "sha256-RVkeSrL3ZfEz+oCICi8JFJ6AaOBBumi5mnnQYE5Gjt8=";
+    hash = "sha256-NH3BVD/wZH5L6x6GcXZrynKFiirLRC6u434EBYQs4qQ=";
   };
 
   autobrr-web = stdenvNoCC.mkDerivation {
···
         src
         sourceRoot
         ;
-      hash = "sha256-mABHRuZfjq9qNanfGGv+xDhs3bSufaWRecJypic8SWo=";
+      hash = "sha256-ESMrd+2oqytC1dQDQvncoqHGAvIFlH/1sTLrUTuSyDg=";
     };
 
     postBuild = ''
···
     src
     ;
 
-  vendorHash = "sha256-rCtUE2/IwR6AnXQNgeH0TQ0BL7g6vi9L128xP0PwOXc=";
+  vendorHash = "sha256-ifi4KFectr4UC1e+VJKnAWsx0f19XN2T3Paf2ud2/To=";
 
   preBuild = ''
     cp -r ${autobrr-web}/* web/dist
···
     "-X main.commit=${src.tag}"
   ];
 
-  doInstallCheck = true;
+  # In darwin, tests try to access /etc/protocols, which is not permitted.
+  doCheck = !stdenv.hostPlatform.isDarwin;
+  doInstallCheck = !stdenv.hostPlatform.isDarwin;
+
   nativeInstallCheckInputs = [
     versionCheckHook
   ];

pkgs/by-name/er/erofs-utils/package.nix

···
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "erofs-utils";
-  version = "1.8.4";
+  version = "1.8.5";
   outputs = [
     "out"
     "man"
···
 
   src = fetchurl {
     url = "https://git.kernel.org/pub/scm/linux/kernel/git/xiang/erofs-utils.git/snapshot/erofs-utils-${finalAttrs.version}.tar.gz";
-    hash = "sha256-eRWHqgdLufn6IYx2LMH2CwFeL1G8ss6R9oLwQ4VqtJQ=";
+    hash = "sha256-zYYRJw6chv4GL2RxA8pq2p7XEORDD91ZYNUUd3kZIA0=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/fl/flintlock/package.nix

···
 
 buildGoModule rec {
   pname = "flintlock";
-  version = "0.8.0";
+  version = "0.8.1";
 
   src = fetchFromGitHub {
     owner = "weaveworks";
     repo = "flintlock";
     rev = "v${version}";
-    sha256 = "sha256-dBwuguOSIc4+cdxfW91kdyprayYu2m2WjBg3qBnVM98=";
+    sha256 = "sha256-Kbk94sqj0aPsVonPsiu8kbjhIOURB1kX9Lt3NURL+jk=";
   };
 
   vendorHash = "sha256-Iv1qHEQLgw6huCA/6PKNmm+dS2yHgOvY/oy2fKjwEpY=";

pkgs/by-name/h2/h2o/package.nix

···
       toastal
       thoughtpolice
     ];
+    mainProgram = "h2o";
     platforms = platforms.linux;
   };
 })

pkgs/by-name/if/ifdnfc-nci/package.nix

···
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  pkg-config,
+  cmake,
+  pcsclite,
+  libnfc-nci,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "ifdnfc-nci";
+  version = "0.2.1";
+
+  src = fetchFromGitHub {
+    owner = "StarGate01";
+    repo = "ifdnfc-nci";
+    tag = "v${finalAttrs.version}";
+    sha256 = "sha256-I2MNzmaxQUh4bN3Uytf2bQRthByEaFWM7c79CKZJQZA=";
+  };
+
+  nativeBuildInputs = [
+    cmake
+    pkg-config
+  ];
+
+  buildInputs = [
+    pcsclite
+    libnfc-nci
+  ];
+
+  meta = {
+    description = "PC/SC IFD Handler based on linux_libnfc-nci";
+    homepage = "https://github.com/StarGate01/ifdnfc-nci";
+    license = lib.licenses.gpl3Only;
+    platforms = lib.platforms.linux;
+    maintainers = with lib.maintainers; [ stargate01 ];
+  };
+})

pkgs/by-name/im/immich-public-proxy/package.nix

···
 }:
 buildNpmPackage rec {
   pname = "immich-public-proxy";
-  version = "1.6.3";
+  version = "1.7.2";
   src = fetchFromGitHub {
     owner = "alangrainger";
     repo = "immich-public-proxy";
     tag = "v${version}";
-    hash = "sha256-nhVU3CVexXV+WCUP8E1tGvwwjy+PCTL9v3/3KI1tDus=";
+    hash = "sha256-G08xucggEdO+iwW7m1D53nr4Rah9D/qD4xlyLwWwBq0=";
   };
 
   sourceRoot = "${src.name}/app";
 
-  npmDepsHash = "sha256-NQgxAHNMPp2eDoiMqjqBOZ3364XjW3WtvrK/ciqg1DI=";
+  npmDepsHash = "sha256-aXTdKGlF2mK8I+vQMd+V6JNTG49S4jJd1kTNBai6sZE=";
 
   # patch in absolute nix store paths so the process doesn't need to cwd in $out
   postPatch = ''

pkgs/by-name/je/jefferson/package.nix

···
     lzallright
   ];
 
+  pythonRelaxDeps = [ "cstruct" ];
+
   pythonImportsCheck = [
     "jefferson"
   ];

pkgs/by-name/ku/kubernetes-controller-tools/package.nix

···
 
 buildGoModule rec {
   pname = "controller-tools";
-  version = "0.17.1";
+  version = "0.17.2";
 
   src = fetchFromGitHub {
     owner = "kubernetes-sigs";
-    repo = pname;
-    rev = "v${version}";
-    sha256 = "sha256-6tqUWsI8SJsBOUO9i+czilOJWlflZ8Sj/rdnZaLJeSQ=";
+    repo = "controller-tools";
+    tag = "v${version}";
+    sha256 = "sha256-AUYduzIEWCJDskoChXmQViR5ON4YZr4MKvFys03hBkY=";
   };
 
-  vendorHash = "sha256-NX4e//77G+jTL2309x6+UEmFarsNWO/n0Pex2pJ+S/s=";
+  vendorHash = "sha256-Y7xYmD3fxAIo/NyLzBuSdbHIrduJ33SpK2I6LfOzNac=";
 
   ldflags = [
     "-s"

pkgs/by-name/li/libnfc-nci/package.nix

···
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  autoreconfHook,
+  pkg-config,
+  config,
+  debug ? config.libnfc-nci.debug or false,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "libnfc-nci";
+  version = "2.4.1-unstable-2024-08-05";
+
+  src = fetchFromGitHub {
+    owner = "StarGate01";
+    repo = "linux_libnfc-nci";
+    rev = "7ce9c8aad0e37850a49b6d8dcc22ae5c783268e7";
+    sha256 = "sha256-iSvDiae+A2hUok426Lj5TMn3Q9G+vH1G0jajP48PehQ=";
+  };
+
+  buildInputs = [
+    pkg-config
+    autoreconfHook
+  ];
+
+  configureFlags =
+    [
+      "--enable-i2c"
+    ]
+    ++ lib.optionals debug [
+      "--enable-debug"
+    ];
+  dontStrip = debug;
+
+  postInstall = ''
+    rm -rf $out/etc
+  '';
+
+  meta = {
+    description = "Linux NFC stack for NCI based NXP NFC Controllers";
+    homepage = "https://github.com/NXPNFCLinux/linux_libnfc-nci";
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ stargate01 ];
+    platforms = lib.platforms.linux;
+  };
+})

pkgs/by-name/lp/lprobe/package.nix

···
 
 buildGoModule rec {
   pname = "lprobe";
-  version = "0.1.4";
+  version = "0.1.5";
 
   src = fetchFromGitHub {
     owner = "fivexl";
     repo = "lprobe";
     tag = "v${version}";
-    hash = "sha256-WC0MDTyd5tRtSQ1LQsYJgV9CwJwtvnIO6tQnPrjpfcY=";
+    hash = "sha256-1VoZIZQDEYVQg8cMacpHPRUffu+1+bAt7O3MZSi6+2A=";
   };
 
-  vendorHash = "sha256-Ot9eePv/bjOZJfOjTCOJGXCaM8hoO4ZUPrpec8lT/JY=";
+  vendorHash = "sha256-wrxIHb296YOszgK9GnCTpSHz2kSd89zT/90/CrPely8=";
 
   buildInputs = [
     libpcap

pkgs/by-name/ne/nezha-theme-nazhua/package.nix

···
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "nezha-theme-nazhua";
-  version = "0.5.6";
+  version = "0.5.7";
 
   src = fetchFromGitHub {
     owner = "hi2shark";
     repo = "nazhua";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-HqNiXkj3GLw5MlQu2fREwUYpT35txopli9SZcFCM90w=";
+    hash = "sha256-DkM+BV0Qw8vpSjxiHFcYUauP9SaiSDhAgKz+13tEsDI=";
   };
 
   yarnOfflineCache = fetchYarnDeps {

pkgs/by-name/tr/trunk/package.nix

···
 
 rustPlatform.buildRustPackage rec {
   pname = "trunk";
-  version = "0.21.5";
+  version = "0.21.7";
 
   src = fetchFromGitHub {
     owner = "trunk-rs";
     repo = "trunk";
     rev = "v${version}";
-    hash = "sha256-AHW686xPGCMLISrOLLfDR5g+2XpMJ+zfmWGn3fMfKbA=";
+    hash = "sha256-VAAGHM2GDrvZvOTRPkxSFs6pzDQGhi6vPpprKJSZKUw=";
   };
 
   nativeBuildInputs = [ pkg-config ];
···
   checkFlags = [ "--skip=tools::tests::download_and_install_binaries" ];
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-MkH0khm4b/xumrzwBfwq4CbBgqeL71iag9WTOoi/IOw=";
+  cargoHash = "sha256-IiKb8MD5QdGMkdX2dbcPkW1cUJq82+uDK1Ru+/otErc=";
 
   meta = with lib; {
     homepage = "https://github.com/trunk-rs/trunk";

pkgs/development/haskell-modules/configuration-nix.nix

···
           pkgs.nodePackages."@tailwindcss/line-clamp"
           pkgs.nodePackages."@tailwindcss/typography"
         ];
+        # Added a shim for the `tailwindcss` CLI entry point
+        nativeBuildInputs = (oa.nativeBuildInputs or []) ++ [ pkgs.buildPackages.makeBinaryWrapper ];
+        postInstall = (oa.postInstall or "") + ''
+          nodePath=""
+          for p in "$out" "${pkgs.nodePackages.postcss}" $plugins; do
+            nodePath="$nodePath''${nodePath:+:}$p/lib/node_modules"
+          done
+          makeWrapper "$out/bin/tailwindcss" "$out/bin/tailwind" --prefix NODE_PATH : "$nodePath"
+          unset nodePath
+        '';
       })) super.tailwind;
 
   emanote = addBuildDepend pkgs.stork super.emanote;

pkgs/development/lua-modules/generated-packages.nix

···
   };
 }) {};
 
+nvim-dbee = callPackage({ buildLuarocksPackage, fetchurl, fetchzip, luaOlder, nui-nvim }:
+buildLuarocksPackage {
+  pname = "nvim-dbee";
+  version = "0.1.9-1";
+  knownRockspec = (fetchurl {
+    url    = "mirror://luarocks/nvim-dbee-0.1.9-1.rockspec";
+    sha256 = "1lmzy6ivnwvhzclkfbcswj2mznrpc4i8s3ivdrc78rr86i49mvpg";
+  }).outPath;
+  src = fetchzip {
+    url    = "https://github.com/kndndrj/nvim-dbee/archive/v0.1.9.zip";
+    sha256 = "10xplksglyd8af8q1cl2lxcpn52b766g87gva9fd3l66idxsds00";
+  };
+
+  disabled = luaOlder "5.1";
+  propagatedBuildInputs = [ nui-nvim ];
+
+  meta = {
+    homepage = "https://github.com/kndndrj/nvim-dbee";
+    description = "Interactive database client for neovim";
+    license.fullName = "GPL-3.0";
+  };
+}) {};
+
 nvim-nio = callPackage({ buildLuarocksPackage, fetchurl, fetchzip, luaOlder }:
 buildLuarocksPackage {
   pname = "nvim-nio";

pkgs/development/ocaml-modules/janestreet/0.15.nix

···
     buildInputs = [ jst-config ];
     propagatedBuildInputs = [ textutils ];
     checkInputs = [ ounit ];
+    doCheck = false; # Does not build with GCC 14
   };
 
   shexp = janePackage {

pkgs/development/ocaml-modules/janestreet/0.16.nix

···
     version = "0.16.1";
     pname = "async_ssl";
     hash = "sha256-83YKxvVb/JwBnQG4R/R1Ztik9T/hO4cbiNTfFnErpG4=";
+    patches = fetchpatch {
+      url = "https://raw.githubusercontent.com/ocaml/opam-source-archives/d7f046579bfc7cfe77ce12f57fd11c206e7e9f30/patches/async_ssl/no-incompatible-pointer-types-0161.patch";
+      hash = "sha256-NcQX9eZ97kaQCOVAuYgR8NlFD3ZrGbT/2QqCjYf9Xnw=";
+    };
     meta.description = "Async wrappers for SSL";
     buildInputs = [ dune-configurator ];
     propagatedBuildInputs = [

pkgs/development/python-modules/amaranth-boards/default.nix

···
 
 buildPythonPackage rec {
   pname = "amaranth-boards";
-  version = "0-unstable-2024-12-21";
+  version = "0-unstable-2025-02-07";
   pyproject = true;
   # from `pdm show`
   realVersion =
···
   src = fetchFromGitHub {
     owner = "amaranth-lang";
     repo = "amaranth-boards";
-    rev = "9d97c4816288c9c2cc304d9280c2c63178d50d2f";
+    rev = "6e01882eefd62cf19f5740406144632fe2d21947";
     # these files change depending on git branch status
     postFetch = "rm -f $out/.git_archival.txt $out/.gitattributes";
-    hash = "sha256-c+LUWNik95PO5oPM/Bjdxu8j9TD2Q8YSGtdNq1E+i4o=";
+    hash = "sha256-U/+5v4wN+HfpWHnT9E9hf4XYpzqQQ7Tgq6Z09nEIBeE=";
   };
 
   build-system = [ pdm-backend ];

pkgs/development/python-modules/jax-cuda12-pjrt/default.nix

···
   # When upgrading, you can get these hashes from jaxlib/prefetch.sh. See
   # https://github.com/google/jax/issues/12879 as to why this specific URL is the correct index.
 
-  # upstream does not distribute jax-cuda12-pjrt 0.4.38 binaries for aarch64-linux
+  # upstream does not distribute jax-cuda12-pjrt binaries for aarch64-linux
   srcs = {
     "x86_64-linux" = fetchurl {
       url = "https://storage.googleapis.com/jax-releases/cuda12_plugin/jax_cuda12_pjrt-${version}-py3-none-manylinux2014_x86_64.whl";
       hash = "sha256-0jgzwbiF2WwnZAAOlQUvK1gnx31JLqaPZ+kDoTJlbbs=";
     };
-    "aarch64-linux" = fetchurl {
-      url = "https://storage.googleapis.com/jax-releases/cuda12_plugin/jax_cuda12_pjrt-${version}-py3-none-manylinux2014_aarch64.whl";
-      hash = "sha256-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=";
-    };
+    # "aarch64-linux" = fetchurl {
+    #   url = "https://storage.googleapis.com/jax-releases/cuda12_plugin/jax_cuda12_pjrt-${version}-py3-none-manylinux2014_aarch64.whl";
+    #   hash = "sha256-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=";
+    # };
   };
 in
 buildPythonPackage {

pkgs/development/python-modules/mitmproxy/default.nix

···
   pythonRelaxDeps = [
     "passlib"
     "protobuf"
+    "pyparsing"
+    "ruamel.yaml"
     "urwid"
   ];
 

pkgs/development/python-modules/nixpkgs-updaters-library/default.nix

···
 }:
 buildPythonPackage rec {
   pname = "nixpkgs-updaters-library";
-  version = "1.0.2";
+  version = "1.1.0";
   pyproject = true;
 
   disabled = pythonOlder "3.12";
···
     owner = "PerchunPak";
     repo = "nixpkgs-updaters-library";
     tag = "v${version}";
-    hash = "sha256-SzGbsHy3Pwpr92512y/R3JLtC01jAveFavRGOYyr81U=";
+    hash = "sha256-gg+y3w0d2GKJ56XZ4Xw9OYTJ5GwqGkTZ/fRXwDhTEDE=";
   };
 
   postPatch = ''

pkgs/development/python-modules/tensorflow/bin.nix

···
       cuda = lib.optionalString cudaSupport (if isCudaJetson then "_jetson" else "_gpu");
       key = "${platform}_${pyVerNoDot}${cuda}";
     in
-    fetchurl (packages.${key} or (throw "tensoflow-bin: unsupported configuration: ${key}"));
+    fetchurl (packages.${key} or (throw "tensorflow-bin: unsupported configuration: ${key}"));
 
   buildInputs = [ llvmPackages.openmp ];
 

pkgs/development/tools/tailwindcss/default.nix

···
     }
     .${system} or throwSystem;
 in
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "tailwindcss";
   version = "3.4.17";
 
   src = fetchurl {
-    url = "https://github.com/tailwindlabs/tailwindcss/releases/download/v${version}/tailwindcss-${plat}";
+    url = "https://github.com/tailwindlabs/tailwindcss/releases/download/v${finalAttrs.version}/tailwindcss-${plat}";
     inherit hash;
   };
 
···
   dontFixup = true;
 
   installPhase = ''
+    runHook preInstall
     mkdir -p $out/bin
-    cp ${src} $out/bin/tailwindcss
+    cp ${finalAttrs.src} $out/bin/tailwindcss
     chmod 755 $out/bin/tailwindcss
+    runHook postInstall
   '';
 
   passthru.tests.helptext = runCommand "tailwindcss-test-helptext" { } ''
-    ${tailwindcss}/bin/tailwindcss --help > $out
+    ${lib.getExe finalAttrs.finalPackage} --help > $out
   '';
   passthru.updateScript = ./update.sh;
 
···
     mainProgram = "tailwindcss";
     platforms = platforms.darwin ++ platforms.linux;
   };
-}
+})

pkgs/os-specific/linux/nxp-pn5xx/default.nix

···
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  kernel,
+  kernelModuleMakeFlags,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "nxp-pn5xx";
+  version = "0.4-unstable-2025-02-08-${kernel.version}";
+
+  src = fetchFromGitHub {
+    owner = "jr64";
+    repo = "nxp-pn5xx";
+    rev = "07411e0ce3445e7dcb970df1837f0ad74b7b0a7a";
+    hash = "sha256-jVkcvURFlihKW2vFvAaqzKdtexPXywRa2LkPkIhmdeU=";
+  };
+
+  nativeBuildInputs = kernel.moduleBuildDependencies;
+
+  makeFlags = kernelModuleMakeFlags ++ [
+    "KERNELRELEASE=${kernel.modDirVersion}"
+    "BUILD_KERNEL_PATH=${kernel.dev}/lib/modules/${kernel.modDirVersion}/build"
+    "INSTALL_MOD_PATH=$(out)/lib/modules/${kernel.modDirVersion}"
+  ];
+
+  postInstall = ''
+    mkdir -p $out/etc/udev/rules.d
+    echo 'SUBSYSTEM=="misc", KERNEL=="pn544", MODE="0666", GROUP="dialout"' > $out/etc/udev/rules.d/99-nxp-pn5xx.rules
+  '';
+
+  meta = {
+    description = "NXP's NFC Open Source Kernel mode driver with ACPI configuration support";
+    homepage = "https://github.com/jr64/nxp-pn5xx";
+    license = lib.licenses.gpl2Only;
+    maintainers = with lib.maintainers; [ stargate01 ];
+    platforms = lib.platforms.linux;
+  };
+})

pkgs/tools/security/vaultwarden/default.nix

···
 
 rustPlatform.buildRustPackage rec {
   pname = "vaultwarden";
-  version = "1.33.1";
+  version = "1.33.2";
 
   src = fetchFromGitHub {
     owner = "dani-garcia";
     repo = "vaultwarden";
     rev = version;
-    hash = "sha256-p5SgXqeafEqPQmSKEtcPCHvxODxrEX4gNmpb2ybmpO4=";
+    hash = "sha256-Lu3/qVTi5Eedcm+3XlHAAJ1nPHm9hW4HZncQKmzDdoo=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-B9RztnkIbYVWdx85p1WEskwTdFrUruD0UJ7qFIg8vy8=";
+  cargoHash = "sha256-T/ehLSPJmEuQYhotK12iqXQSe5Ke8+dkr9PVDe4Kmis=";
 
   # used for "Server Installed" version in admin panel
   env.VW_VERSION = version;

pkgs/top-level/linux-kernels.nix

···
     nvidia_x11_stable_open       = nvidiaPackages.stable.open;
     nvidia_x11_vulkan_beta_open  = nvidiaPackages.vulkan_beta.open;
 
+    nxp-pn5xx = callPackage ../os-specific/linux/nxp-pn5xx { };
+
     openrazer = callPackage ../os-specific/linux/openrazer/driver.nix { };
 
     ply = callPackage ../os-specific/linux/ply { };