Merge branch 'staging-next' into staging

Merge conflict in `pkgs/by-name/en/envision/package.nix` between efb2d2b815fe9f7d12f4aab42c83e759db5ec716 (staging) and b9d59c4515ea7cd4595d342c9d87877b544e6dbd+de7a60960219b303cc44ad446f9e7ddaf23b9944 (staging-next).

nixos/doc/manual/release-notes/rl-2505.section.md

···
 
 - The default Elixir version has been updated to 1.18.
 
+- `services.dex` now restarts upon changes to the `.environmentFile` or entries in `.settings.staticClients[].secretFile` when the entry is a `path` type.
+
 - `nixos-rebuild-ng`, a full rewrite of `nixos-rebuild` in Python, is available for testing. You can enable it by setting [system.rebuild.enableNg](options.html#opt-system.rebuild.enableNg) in your configuration (this will replace the old `nixos-rebuild`), or by adding `nixos-rebuild-ng` to your `environment.systemPackages` (in this case, it will live side-by-side with `nixos-rebuild` as `nixos-rebuild-ng`). It is expected that the next major version of NixOS (25.11) will enable `system.rebuild.enableNg` by default.
 - A `nixos-rebuild build-image` sub-command has been added.
 
···
 - [Whoogle Search](https://github.com/benbusby/whoogle-search), a self-hosted, ad-free, privacy-respecting metasearch engine. Available as [services.whoogle-search](options.html#opt-services.whoogle-search.enable).
 
 - [agorakit](https://github.com/agorakit/agorakit), an organization tool for citizens' collectives. Available with [services.agorakit](options.html#opt-services.agorakit.enable).
+
+- [vivid](https://github.com/sharkdp/vivid), a generator for LS_COLOR. Available as [programs.vivid](#opt-programs.vivid.enable).
 
 - [waagent](https://github.com/Azure/WALinuxAgent), the Microsoft Azure Linux Agent (waagent) manages Linux provisioning and VM interaction with the Azure Fabric Controller. Available with [services.waagent](options.html#opt-services.waagent.enable).
 
···
 - `minetest` has been renamed to `luanti` to match the upstream name change but aliases have been added. The new name hasn't resulted in many changes as of yet but older references to minetest should be sunset. See the [new name announcement](https://blog.minetest.net/2024/10/13/Introducing-Our-New-Name/) for more details.
 
 - `racket_7_9` has been removed, as it is insecure. It is recommended to use Racket 8 instead.
+
+- `rofi` has been updated from 1.7.5 to 1.7.6 which introduces some breaking changes to binary plugins, and also contains a lot of new features and bug fixes. This is highlighted because the patch version bump does not indicate the volume of changes by itself. See the [upstream release notes](https://github.com/davatorium/rofi/releases/tag/1.7.6) for the full list of changes.
 
 - `ente-auth` now uses the name `enteauth` for its binary. The previous name was `ente_auth`.
 
···
 
 - `siduck76-st` has been renamed to `st-snazzy`, like the project's [flake](https://github.com/siduck/st/blob/main/flake.nix).
 
+- `python3Packages.jax` now directly depends on `python3Packages.jaxlib`.
+  As a result, packages that depend on jax no longer need to include jaxlib to their dependencies.
+  There is also a breaking change in the handling of CUDA. Instead of using a CUDA compatible jaxlib
+  as before, you can use plugins like `python3Packages.jax-cuda12-plugin`.
+
 
 <!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->
 
···
   services.caddy = {
     enable = true;
     package = pkgs.caddy.withPlugins {
-      plugins = [ "github.com/caddy-dns/powerdns@v1.0.1" ];
-      hash = "sha256-F/jqR4iEsklJFycTjSaW8B/V3iTGqqGOzwYBUXxRKrc=";
+      plugins = [
+        # tagged upstream
+        "github.com/caddy-dns/powerdns@v1.0.1"
+        # pseudo-version number generated by Go
+        "github.com/caddy-dns/cloudflare@v0.0.0-20240703190432-89f16b99c18e"
+        "github.com/mholt/caddy-webdav@v0.0.0-20241008162340-42168ba04c9d"
+      ];
+      hash = "sha256-wqXSd1Ep9TVpQi570TTb96LwzNYvWL5EBJXMJfYWCAk=";
     };
   };
   ```
 
   To get the necessary hash of the vendored dependencies, omit `hash`. The build will fail and tell you the correct value.
+
+  Note that all provided plugins must have versions/tags (string after `@`), even if upstream repo does not tag each release. For untagged plugins, you can either create an empty Go project and run `go get <plugin>` and see changes in `go.mod` to get the pseudo-version number, or provide a commit hash in place of version/tag for the first run, and update the plugin string based on the error output.
 
 - KDE Partition Manager `partitionmanager`'s support for ReiserFS is removed.
   ReiserFS has not been actively maintained for many years. It has been marked as obsolete since Linux 6.6, and

nixos/modules/module-list.nix

···
   ./programs/usbtop.nix
   ./programs/vim.nix
   ./programs/virt-manager.nix
+  ./programs/vivid.nix
   ./programs/wavemon.nix
   ./programs/wayland/cardboard.nix
   ./programs/wayland/hyprlock.nix

nixos/modules/programs/vivid.nix

···
+{
+  pkgs,
+  config,
+  lib,
+  ...
+}:
+
+let
+  cfg = config.programs.vivid;
+in
+{
+  options = {
+    programs.vivid = {
+      enable = lib.mkOption {
+        default = false;
+        description = "Whether to configure LS_COLORS with vivid.";
+        type = lib.types.bool;
+      };
+
+      package = lib.mkPackageOption pkgs "vivid" { example = "vivid"; };
+
+      theme = lib.mkOption {
+        default = "gruvbox-dark-soft";
+        description = "Theme to be used (see `vivid themes`)";
+        example = "solarized-dark";
+        type = lib.types.str;
+      };
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    environment.systemPackages = [ cfg.package ];
+
+    programs =
+      let
+        interactiveShellInit = lib.mkAfter ''
+          export LS_COLORS="$(${lib.getExe cfg.package} generate ${cfg.theme})"
+        '';
+        enableLsColors = lib.mkOverride 999 false;
+      in
+      {
+        bash = {
+          inherit interactiveShellInit enableLsColors;
+        };
+        zsh = {
+          inherit interactiveShellInit enableLsColors;
+        };
+      };
+
+    assertions = [
+      {
+        assertion = !config.programs.bash.enableLsColors;
+        message = "`programs.vivid.enable` is incompatible with `programs.bash.enableLsColors`.";
+      }
+      {
+        assertion = !config.programs.zsh.enableLsColors;
+        message = "`programs.vivid.enable` is incompatible with `programs.zsh.enableLsColors`.";
+      }
+    ];
+  };
+
+  meta.maintainers = with lib.maintainers; [ blackheaven ];
+}

nixos/modules/services/misc/nix-optimise.nix

···
           which the optimiser will run.
         '';
       };
+
+      randomizedDelaySec = lib.mkOption {
+        default = "1800";
+        type = lib.types.singleLineStr;
+        example = "45min";
+        description = ''
+          Add a randomized delay before the optimizer will run.
+          The delay will be chosen between zero and this value.
+          This value must be a time span in the format specified by
+          {manpage}`systemd.time(7)`
+        '';
+      };
+
+      persistent = lib.mkOption {
+        default = true;
+        type = lib.types.bool;
+        example = false;
+        description = ''
+          Takes a boolean argument. If true, the time when the service
+          unit was last triggered is stored on disk. When the timer is
+          activated, the service unit is triggered immediately if it
+          would have been triggered at least once during the time when
+          the timer was inactive. Such triggering is nonetheless
+          subject to the delay imposed by RandomizedDelaySec=. This is
+          useful to catch up on missed runs of the service when the
+          system was powered down.
+        '';
+      };
     };
   };
 
···
 
       timers.nix-optimise = lib.mkIf cfg.automatic {
         timerConfig = {
-          Persistent = true;
-          RandomizedDelaySec = 1800;
+          RandomizedDelaySec = cfg.randomizedDelaySec;
+          Persistent = cfg.persistent;
         };
       };
     };

nixos/modules/services/monitoring/cockpit.nix

···
 
     networking.firewall.allowedTCPPorts = mkIf cfg.openFirewall [ cfg.port ];
 
-    # units are in reverse sort order if you ls $out/lib/systemd/system
-    # all these units are basically verbatim translated from upstream
-
-    # Translation from $out/lib/systemd/system/systemd-cockpithttps.slice
-    systemd.slices.system-cockpithttps = {
-      description = "Resource limits for all cockpit-ws-https@.service instances";
-      sliceConfig = {
-        TasksMax = 200;
-        MemoryHigh = "75%";
-        MemoryMax = "90%";
-      };
-    };
-
-    # Translation from $out/lib/systemd/system/cockpit-wsinstance-https@.socket
-    systemd.sockets."cockpit-wsinstance-https@" = {
-      unitConfig = {
-        Description = "Socket for Cockpit Web Service https instance %I";
-        BindsTo = [ "cockpit.service" "cockpit-wsinstance-https@%i.service" ];
-        # clean up the socket after the service exits, to prevent fd leak
-        # this also effectively prevents a DoS by starting arbitrarily many sockets, as
-        # the services are resource-limited by system-cockpithttps.slice
-        Documentation = "man:cockpit-ws(8)";
-      };
-      socketConfig = {
-        ListenStream = "/run/cockpit/wsinstance/https@%i.sock";
-        SocketUser = "root";
-        SocketMode = "0600";
-      };
-    };
-
-    # Translation from $out/lib/systemd/system/cockpit-wsinstance-https@.service
-    systemd.services."cockpit-wsinstance-https@" = {
-      description = "Cockpit Web Service https instance %I";
-      bindsTo = [ "cockpit.service"];
-      path = [ cfg.package ];
-      documentation = [ "man:cockpit-ws(8)" ];
-      serviceConfig = {
-        Slice = "system-cockpithttps.slice";
-        ExecStart = "${cfg.package}/libexec/cockpit-ws --for-tls-proxy --port=0";
-        User = "root";
-        Group = "";
-      };
-    };
-
-    # Translation from $out/lib/systemd/system/cockpit-wsinstance-http.socket
-    systemd.sockets.cockpit-wsinstance-http = {
-      unitConfig = {
-        Description = "Socket for Cockpit Web Service http instance";
-        BindsTo = "cockpit.service";
-        Documentation = "man:cockpit-ws(8)";
-      };
-      socketConfig = {
-        ListenStream = "/run/cockpit/wsinstance/http.sock";
-        SocketUser = "root";
-        SocketMode = "0600";
-      };
-    };
-
-    # Translation from $out/lib/systemd/system/cockpit-wsinstance-https-factory.socket
-    systemd.sockets.cockpit-wsinstance-https-factory = {
-      unitConfig = {
-        Description = "Socket for Cockpit Web Service https instance factory";
-        BindsTo = "cockpit.service";
-        Documentation = "man:cockpit-ws(8)";
-      };
-      socketConfig = {
-        ListenStream = "/run/cockpit/wsinstance/https-factory.sock";
-        Accept = true;
-        SocketUser = "root";
-        SocketMode = "0600";
-      };
-    };
-
-    # Translation from $out/lib/systemd/system/cockpit-wsinstance-https-factory@.service
-    systemd.services."cockpit-wsinstance-https-factory@" = {
-      description = "Cockpit Web Service https instance factory";
-      documentation = [ "man:cockpit-ws(8)" ];
-      path = [ cfg.package ];
-      serviceConfig = {
-        ExecStart = "${cfg.package}/libexec/cockpit-wsinstance-factory";
-        User = "root";
-      };
-    };
-
-    # Translation from $out/lib/systemd/system/cockpit-wsinstance-http.service
-    systemd.services."cockpit-wsinstance-http" = {
-      description = "Cockpit Web Service http instance";
-      bindsTo = [ "cockpit.service" ];
-      path = [ cfg.package ];
-      documentation = [ "man:cockpit-ws(8)" ];
-      serviceConfig = {
-        ExecStart = "${cfg.package}/libexec/cockpit-ws --no-tls --port=0";
-        User = "root";
-        Group = "";
-      };
-    };
-
-    # Translation from $out/lib/systemd/system/cockpit.socket
-    systemd.sockets."cockpit" = {
-      unitConfig = {
-        Description = "Cockpit Web Service Socket";
-        Documentation = "man:cockpit-ws(8)";
-        Wants = "cockpit-motd.service";
-      };
-      socketConfig = {
-        ListenStream = cfg.port;
-        ExecStartPost = [
-          "-${cfg.package}/share/cockpit/motd/update-motd \"\" localhost"
-          "-${pkgs.coreutils}/bin/ln -snf active.motd /run/cockpit/motd"
-        ];
-        ExecStopPost = "-${pkgs.coreutils}/bin/ln -snf inactive.motd /run/cockpit/motd";
-      };
-      wantedBy = [ "sockets.target" ];
-    };
-
-    # Translation from $out/lib/systemd/system/cockpit.service
-    systemd.services."cockpit" = {
-      description = "Cockpit Web Service";
-      documentation = [ "man:cockpit-ws(8)" ];
-      restartIfChanged = true;
-      path = with pkgs; [ coreutils cfg.package ];
-      requires = [ "cockpit.socket" "cockpit-wsinstance-http.socket" "cockpit-wsinstance-https-factory.socket" ];
-      after = [ "cockpit-wsinstance-http.socket" "cockpit-wsinstance-https-factory.socket" ];
-      environment = {
-        G_MESSAGES_DEBUG = "cockpit-ws,cockpit-bridge";
-      };
-      serviceConfig = {
-        RuntimeDirectory="cockpit/tls";
-        ExecStartPre = [
-          # cockpit-tls runs in a more constrained environment, these + means that these commands
-          # will run with full privilege instead of inside that constrained environment
-          # See https://www.freedesktop.org/software/systemd/man/systemd.service.html#ExecStart= for details
-          "+${cfg.package}/libexec/cockpit-certificate-ensure --for-cockpit-tls"
-        ];
-        ExecStart = "${cfg.package}/libexec/cockpit-tls";
-        User = "root";
-        Group = "";
-        NoNewPrivileges = true;
-        ProtectSystem = "strict";
-        ProtectHome = true;
-        PrivateTmp = true;
-        PrivateDevices = true;
-        ProtectKernelTunables = true;
-        RestrictAddressFamilies = [ "AF_UNIX" "AF_INET" "AF_INET6" ];
-        MemoryDenyWriteExecute = true;
-      };
-    };
-
-    # Translation from $out/lib/systemd/system/cockpit-motd.service
-    # This part basically implements a motd state machine:
-    # - If cockpit.socket is enabled then /run/cockpit/motd points to /run/cockpit/active.motd
-    # - If cockpit.socket is disabled then /run/cockpit/motd points to /run/cockpit/inactive.motd
-    # - As cockpit.socket is disabled by default, /run/cockpit/motd points to /run/cockpit/inactive.motd
-    # /run/cockpit/active.motd is generated dynamically by cockpit-motd.service
-    systemd.services."cockpit-motd" = {
-      path = with pkgs; [ nettools ];
-      serviceConfig = {
-        Type = "oneshot";
-        ExecStart = "${cfg.package}/share/cockpit/motd/update-motd";
-      };
-      description = "Cockpit motd updater service";
-      documentation = [ "man:cockpit-ws(8)" ];
-      wants = [ "network.target" ];
-      after = [ "network.target" "cockpit.socket" ];
-    };
+    systemd.packages = [ cfg.package ];
+    systemd.sockets.cockpit.wantedBy = [ "multi-user.target" ];
 
     systemd.tmpfiles.rules = [ # From $out/lib/tmpfiles.d/cockpit-tmpfiles.conf
       "C /run/cockpit/inactive.motd 0640 root root - ${cfg.package}/share/cockpit/motd/inactive.motd"

nixos/modules/services/networking/minidlna.nix

···
-# Module for MiniDLNA, a simple DLNA server.
 { config, lib, pkgs, ... }:
-with lib;
 
 let
   cfg = config.services.minidlna;
-  settingsFormat = pkgs.formats.keyValue { listsAsDuplicateKeys = true; };
-  settingsFile = settingsFormat.generate "minidlna.conf" cfg.settings;
-in
+  format = pkgs.formats.keyValue { listsAsDuplicateKeys = true; };
+  cfgfile = format.generate "minidlna.conf" cfg.settings;
 
-{
-  ###### interface
-  options.services.minidlna.enable = mkOption {
-    type = types.bool;
-    default = false;
-    description = ''
-      Whether to enable MiniDLNA, a simple DLNA server.
-      It serves media files such as video and music to DLNA client devices
-      such as televisions and media players. If you use the firewall, consider
-      adding the following: `services.minidlna.openFirewall = true;`
-    '';
-  };
+in {
+  options.services.minidlna.enable = lib.mkEnableOption "MiniDLNA, a simple DLNA server. Consider adding `openFirewall = true` into your config";
+  options.services.minidlna.openFirewall = lib.mkEnableOption "opening HTTP (TCP) and SSDP (UDP) ports in the firewall";
+  options.services.minidlna.package = lib.mkPackageOption pkgs "minidlna" {};
 
-  options.services.minidlna.package = lib.mkPackageOption pkgs "minidlna" { };
-
-  options.services.minidlna.openFirewall = mkOption {
-    type = types.bool;
-    default = false;
-    description = ''
-      Whether to open both HTTP (TCP) and SSDP (UDP) ports in the firewall.
-    '';
-  };
-
-  options.services.minidlna.settings = mkOption {
+  options.services.minidlna.settings = lib.mkOption {
     default = {};
-    description = ''
-      The contents of MiniDLNA's configuration file.
-      When the service is activated, a basic template is generated from the current options opened here.
-    '';
-    type = types.submodule {
-      freeformType = settingsFormat.type;
+    description = "Configuration for `minidlna.conf(5)`.";
+    type = lib.types.submodule {
+      freeformType = format.type;
 
-      options.media_dir = mkOption {
-        type = types.listOf types.str;
+      options.media_dir = lib.mkOption {
+        type = lib.types.listOf lib.types.str;
         default = [];
         example = [ "/data/media" "V,/home/alice/video" ];
         description = ''
···
           The directories must be accessible to the `minidlna` user account.
         '';
       };
-      options.notify_interval = mkOption {
-        type = types.int;
+      options.notify_interval = lib.mkOption {
+        type = lib.types.int;
         default = 90000;
         description = ''
           The interval between announces (in seconds).
           Instead of waiting for announces, you should set `openFirewall` option to use SSDP discovery.
-          Lower values (e.g. 30 seconds) should be used if your network blocks the discovery unicast.
-          Some relevant information can be found here:
-          https://sourceforge.net/p/minidlna/discussion/879957/thread/1389d197/
+          Lower values (e.g. 30 seconds) should be used if your network is blocking the SSDP multicast.
+          Some relevant information can be found [here](https://sourceforge.net/p/minidlna/discussion/879957/thread/1389d197/).
         '';
       };
-      options.port = mkOption {
-        type = types.port;
+      options.port = lib.mkOption {
+        type = lib.types.port;
         default = 8200;
         description = "Port number for HTTP traffic (descriptions, SOAP, media transfer).";
       };
-      options.db_dir = mkOption {
-        type = types.path;
+      options.db_dir = lib.mkOption {
+        type = lib.types.path;
         default = "/var/cache/minidlna";
         example = "/tmp/minidlna";
-        description = "Specify the directory where you want MiniDLNA to store its database and album art cache.";
+        description = "Specify the directory to store database and album art cache.";
       };
-      options.friendly_name = mkOption {
-        type = types.str;
+      options.friendly_name = lib.mkOption {
+        type = lib.types.str;
         default = config.networking.hostName;
-        defaultText = literalExpression "config.networking.hostName";
+        defaultText = lib.literalExpression "config.networking.hostName";
         example = "rpi3";
-        description = "Name that the DLNA server presents to clients.";
+        description = "Name that the server presents to clients.";
       };
-      options.root_container = mkOption {
-        type = types.str;
+      options.root_container = lib.mkOption {
+        type = lib.types.str;
         default = "B";
         example = ".";
         description = "Use a different container as the root of the directory tree presented to clients.";
       };
-      options.log_level = mkOption {
-        type = types.str;
+      options.log_level = lib.mkOption {
+        type = lib.types.str;
         default = "warn";
         example = "general,artwork,database,inotify,scanner,metadata,http,ssdp,tivo=warn";
         description = "Defines the type of messages that should be logged and down to which level of importance.";
       };
-      options.inotify = mkOption {
-        type = types.enum [ "yes" "no" ];
+      options.enable_subtitles = lib.mkOption {
+        type = lib.types.enum [ "yes" "no" ];
+        default = "yes";
+        description = "Enable subtitle support on unknown clients.";
+      };
+      options.inotify = lib.mkOption {
+        type = lib.types.enum [ "yes" "no" ];
         default = "no";
         description = "Whether to enable inotify monitoring to automatically discover new files.";
       };
-      options.enable_tivo = mkOption {
-        type = types.enum [ "yes" "no" ];
+      options.enable_tivo = lib.mkOption {
+        type = lib.types.enum [ "yes" "no" ];
         default = "no";
         description = "Support for streaming .jpg and .mp3 files to a TiVo supporting HMO.";
       };
-      options.wide_links = mkOption {
-        type = types.enum [ "yes" "no" ];
+      options.wide_links = lib.mkOption {
+        type = lib.types.enum [ "yes" "no" ];
         default = "no";
         description = "Set this to yes to allow symlinks that point outside user-defined `media_dir`.";
       };
     };
   };
 
-  imports = [
-    (mkRemovedOptionModule [ "services" "minidlna" "config" ] "")
-    (mkRemovedOptionModule [ "services" "minidlna" "extraConfig" ] "")
-    (mkRenamedOptionModule [ "services" "minidlna" "loglevel"] [ "services" "minidlna" "settings" "log_level" ])
-    (mkRenamedOptionModule [ "services" "minidlna" "rootContainer"] [ "services" "minidlna" "settings" "root_container" ])
-    (mkRenamedOptionModule [ "services" "minidlna" "mediaDirs"] [ "services" "minidlna" "settings" "media_dir" ])
-    (mkRenamedOptionModule [ "services" "minidlna" "friendlyName"] [ "services" "minidlna" "settings" "friendly_name" ])
-    (mkRenamedOptionModule [ "services" "minidlna" "announceInterval"] [ "services" "minidlna" "settings" "notify_interval" ])
-  ];
+  config = lib.mkIf cfg.enable {
+    networking.firewall.allowedTCPPorts = lib.mkIf cfg.openFirewall [ cfg.settings.port ];
+    networking.firewall.allowedUDPPorts = lib.mkIf cfg.openFirewall [ 1900 ];
 
-  ###### implementation
-  config = mkIf cfg.enable {
-    networking.firewall.allowedTCPPorts = mkIf cfg.openFirewall [ cfg.settings.port ];
-    networking.firewall.allowedUDPPorts = mkIf cfg.openFirewall [ 1900 ];
-
+    users.groups.minidlna.gid = config.ids.gids.minidlna;
     users.users.minidlna = {
       description = "MiniDLNA daemon user";
       group = "minidlna";
       uid = config.ids.uids.minidlna;
     };
-
-    users.groups.minidlna.gid = config.ids.gids.minidlna;
 
     systemd.services.minidlna = {
       description = "MiniDLNA Server";
···
         CacheDirectory = "minidlna";
         RuntimeDirectory = "minidlna";
         PIDFile = "/run/minidlna/pid";
-        ExecStart = "${lib.getExe cfg.package} -S -P /run/minidlna/pid -f ${settingsFile}";
+        ExecStart = "${lib.getExe cfg.package} -S -P /run/minidlna/pid -f ${cfgfile}";
       };
     };
   };

nixos/modules/services/networking/ntp/chrony.nix

···
 
       enableMemoryLocking = mkOption {
         type = types.bool;
-        default = config.environment.memoryAllocator.provider != "graphene-hardened";
-        defaultText = ''config.environment.memoryAllocator.provider != "graphene-hardened"'';
+        default = config.environment.memoryAllocator.provider != "graphene-hardened" && config.environment.memoryAllocator.provider != "graphene-hardened-light";
+        defaultText = ''config.environment.memoryAllocator.provider != "graphene-hardened" && config.environment.memoryAllocator.provider != "graphene-hardened-light"'';
         description = ''
           Whether to add the `-m` flag to lock memory.
         '';

nixos/modules/services/web-apps/dex.nix

···
   fixClient =
     client:
     if client ? secretFile then
-      ((builtins.removeAttrs client [ "secretFile" ]) // { secret = client.secretFile; })
+      (
+        (builtins.removeAttrs client [ "secretFile" ])
+        // {
+          secret = client.secretFile;
+        }
+      )
     else
       client;
   filteredSettings = mapAttrs (
···
       '') secretFiles
     )
   );
+
+  restartTriggers =
+    [ ]
+    ++ (optionals (cfg.environmentFile != null) [ cfg.environmentFile ])
+    ++ (filter (file: builtins.typeOf file == "path") secretFiles);
 in
 {
   options.services.dex = {
···
         "networking.target"
       ] ++ (optional (cfg.settings.storage.type == "postgres") "postgresql.service");
       path = with pkgs; [ replace-secret ];
+      restartTriggers = restartTriggers;
       serviceConfig =
         {
           ExecStart = "${pkgs.dex-oidc}/bin/dex serve /run/dex/config.yaml";

nixos/tests/caddy.nix

···
   {
     name = "caddy";
     meta = with pkgs.lib.maintainers; {
-      maintainers = [ Br1ght0ne ];
+      maintainers = [
+        Br1ght0ne
+        stepbrobd
+      ];
     };
 
     nodes = {
       webserver =
-        { pkgs, lib, ... }:
+        { pkgs, ... }:
         {
           services.caddy.enable = true;
           services.caddy.extraConfig = ''
···
               respond "hello world"
             '';
           };
+          specialisation.with-plugins.configuration = {
+            services.caddy = {
+              package = pkgs.caddy.withPlugins {
+                plugins = [ "github.com/caddyserver/replace-response@v0.0.0-20241211194404-3865845790a7" ];
+                hash = "sha256-zgMdtOJbmtRSfTlrrg8njr11in2C7OAXLB+34V23jek=";
+              };
+              configFile = pkgs.writeText "Caddyfile" ''
+                {
+                  order replace after encode
+                }
+
+                localhost:80 {
+                  respond "hello world"
+                  replace world caddy
+                }
+              '';
+            };
+          };
         };
     };
 
···
         justReloadSystem = "${nodes.webserver.system.build.toplevel}/specialisation/config-reload";
         multipleConfigs = "${nodes.webserver.system.build.toplevel}/specialisation/multiple-configs";
         rfc42Config = "${nodes.webserver.system.build.toplevel}/specialisation/rfc42";
+        withPluginsConfig = "${nodes.webserver.system.build.toplevel}/specialisation/with-plugins";
       in
       ''
         url = "http://localhost/example.html"
···
             )
             webserver.wait_for_open_port(80)
             webserver.succeed("curl http://localhost | grep hello")
+
+        with subtest("plugins are correctled installed and configurable"):
+            webserver.succeed(
+                "${withPluginsConfig}/bin/switch-to-configuration test >&2"
+            )
+            webserver.wait_for_open_port(80)
+            webserver.succeed("curl http://localhost | grep caddy")
       '';
   }
 )

nixos/tests/cockpit.nix

···
                     log("Opening homepage")
                     driver.get("https://server:9090")
 
-                    wait = WebDriverWait(driver, 60)
 
-
-                    def wait_elem(by, query):
+                    def wait_elem(by, query, timeout=10):
+                        wait = WebDriverWait(driver, timeout)
                         wait.until(EC.presence_of_element_located((by, query)))
 
 
-                    def wait_title_contains(title):
+                    def wait_title_contains(title, timeout=10):
+                        wait = WebDriverWait(driver, timeout)
                         wait.until(EC.title_contains(title))
 
 
···
 
                     assert "Web console is running in limited access mode" in driver.page_source
 
+                    log("Clicking the sudo button")
+                    driver.switch_to.default_content()
+                    driver.find_element(By.CSS_SELECTOR, 'button.ct-locked').click()
+                    log("Checking that /nonexistent is not a thing")
+                    assert '/nonexistent' not in driver.page_source
+
                     driver.close()
                   '';
             in
···
     testScript = ''
       start_all()
 
+      server.wait_for_unit("sockets.target")
       server.wait_for_open_port(9090)
-      server.wait_for_unit("network.target")
-      server.wait_for_unit("multi-user.target")
-      server.systemctl("start", "polkit")
-
-      client.wait_for_unit("multi-user.target")
 
       client.succeed("curl -k https://server:9090 -o /dev/stderr")
       print(client.succeed("whoami"))

pkgs/applications/editors/neovim/wrapper.nix

···
 
     wrapperArgsStr = if lib.isString wrapperArgs then wrapperArgs else lib.escapeShellArgs wrapperArgs;
 
-    generatedWrapperArgs = let
-      op = acc: normalizedPlugin: acc ++ normalizedPlugin.plugin.runtimeDeps or [];
-
-      runtimeDeps = lib.foldl' op [] pluginsNormalized;
-
-      binPath = lib.makeBinPath (
-           lib.optional finalAttrs.withRuby rubyEnv
-        ++ lib.optional finalAttrs.withNodeJs nodejs
-        ++ lib.optionals finalAttrs.autowrapRuntimeDeps runtimeDeps
-        );
-    in
-
-      # vim accepts a limited number of commands so we join them all
-          [
-            "--add-flags" ''--cmd "lua ${providerLuaRc}"''
-          ]
-          ++ lib.optionals (packpathDirs.myNeovimPackages.start != [] || packpathDirs.myNeovimPackages.opt != []) [
-            "--add-flags" ''--cmd "set packpath^=${finalPackdir}"''
-            "--add-flags" ''--cmd "set rtp^=${finalPackdir}"''
-          ]
-          ++ lib.optionals finalAttrs.withRuby [
-            "--set" "GEM_HOME" "${rubyEnv}/${rubyEnv.ruby.gemPath}"
-          ] ++ lib.optionals (binPath != "") [
-            "--suffix" "PATH" ":" binPath
-          ]
-          ;
+    generatedWrapperArgs =
+            [
+              # vim accepts a limited number of commands so we join all the provider ones
+              "--add-flags" ''--cmd "lua ${providerLuaRc}"''
+            ]
+            ++ lib.optionals (finalAttrs.packpathDirs.myNeovimPackages.start != [] || finalAttrs.packpathDirs.myNeovimPackages.opt != []) [
+              "--add-flags" ''--cmd "set packpath^=${finalPackdir}"''
+              "--add-flags" ''--cmd "set rtp^=${finalPackdir}"''
+            ]
+            ++ lib.optionals finalAttrs.withRuby [
+              "--set" "GEM_HOME" "${rubyEnv}/${rubyEnv.ruby.gemPath}"
+            ] ++ lib.optionals (finalAttrs.runtimeDeps != []) [
+              "--suffix" "PATH" ":" (lib.makeBinPath finalAttrs.runtimeDeps)
+            ]
+            ;
 
     providerLuaRc = neovimUtils.generateProviderRc {
       inherit (finalAttrs) withPython3 withNodeJs withPerl withRuby;
···
       inherit autoconfigure autowrapRuntimeDeps wrapRc providerLuaRc packpathDirs;
       inherit python3Env rubyEnv;
       inherit wrapperArgs generatedWrapperArgs;
+
+
+      runtimeDeps = let
+        op = acc: normalizedPlugin: acc ++ normalizedPlugin.plugin.runtimeDeps or [];
+        runtimeDeps = lib.foldl' op [] pluginsNormalized;
+      in
+             lib.optional finalAttrs.withRuby rubyEnv
+          ++ lib.optional finalAttrs.withNodeJs nodejs
+          ++ lib.optionals finalAttrs.autowrapRuntimeDeps runtimeDeps
+          ;
+
+
       luaRcContent = rcContent;
       # Remove the symlinks created by symlinkJoin which we need to perform
       # extra actions upon

pkgs/applications/editors/vim/plugins/generated.nix

···
     meta.homepage = "https://github.com/kbenzie/vim-spirv/";
   };
 
+  vim-splunk = buildVimPlugin {
+    pname = "vim-splunk";
+    version = "2024-08-10";
+    src = fetchFromGitHub {
+      owner = "yorokobi";
+      repo = "vim-splunk";
+      rev = "827cdf8d9f6940eea146e6571a1086ed7a4061eb";
+      sha256 = "08f5c14ic4mr039by2ml9xf6b2l2rylgjj5q3m7gj29n7mn1zzc7";
+    };
+    meta.homepage = "https://github.com/yorokobi/vim-splunk/";
+  };
+
   vim-startify = buildVimPlugin {
     pname = "vim-startify";
     version = "2023-09-20";

pkgs/applications/editors/vim/plugins/vim-plugin-names

···
 https://github.com/christoomey/vim-sort-motion/,,
 https://github.com/tpope/vim-speeddating/,,
 https://github.com/kbenzie/vim-spirv/,,
+https://github.com/yorokobi/vim-splunk/,HEAD,
 https://github.com/mhinz/vim-startify/,,
 https://github.com/dstein64/vim-startuptime/,,
 https://github.com/axelf4/vim-strip-trailing-whitespace/,,

pkgs/applications/emulators/libretro/cores/fbalpha2012.nix

···
   lib,
   fetchFromGitHub,
   mkLibretroCore,
+  runCommand,
+  zlib,
 }:
-mkLibretroCore {
+mkLibretroCore rec {
   core = "fbalpha2012";
   version = "0-unstable-2024-10-21";
 
···
     hash = "sha256-giEV09dT/e82bmDlRkxpkW04JcsEZc/enIPecqYtg3c=";
   };
 
+  sourceRoot = "${src.name}/svn-current/trunk";
+
+  # unvendor zlib and broken minizip code
+  postPatch =
+    let
+      minizip-src = runCommand "minizip-src" { } ''
+        mkdir $out
+        unpackFile ${zlib.src}
+        cp */contrib/minizip/{unzip.*,ioapi.*,crypt.h} $out/
+      '';
+    in
+    ''
+      substituteInPlace ${makefile} \
+        --replace-fail '-I$(FBA_LIB_DIR)/zlib' ""
+
+      cp ${minizip-src}/* src/burner
+    '';
+
+  buildInputs = [ zlib ];
+
+  makeFlags = [ "EXTERNAL_ZLIB=1" ];
+
   makefile = "makefile.libretro";
-  preBuild = "cd svn-current/trunk";
 
   meta = {
     description = "Port of Final Burn Alpha ~2012 to libretro";

pkgs/applications/emulators/libretro/cores/mame2003.nix

···
 }:
 mkLibretroCore {
   core = "mame2003";
-  version = "0-unstable-2024-11-01";
+  version = "0-unstable-2024-12-10";
 
   src = fetchFromGitHub {
     owner = "libretro";
     repo = "mame2003-libretro";
-    rev = "6d543115531fc96422b73c989a628600cacbea50";
-    hash = "sha256-jFzFQVB0uiSRa82sq1fiMEXyzzDJqRANNgq5hj/ZAl4=";
+    rev = "b6c6d52d8d630d1a172b6b771443dcbbdb45b76d";
+    hash = "sha256-E0kymRxy5aubvcwE5sHcS4T3OEY924TAOXtJN69wp+8=";
   };
+
+  # Fix build with GCC 14
+  env.NIX_CFLAGS_COMPILE = "-Wno-error=incompatible-pointer-types";
 
   makefile = "Makefile";
 

pkgs/applications/emulators/libretro/cores/mame2016.nix

···
   fetchFromGitHub,
   mkLibretroCore,
   python3,
+  rapidjson,
 }:
 mkLibretroCore {
   core = "mame2016";
···
     hash = "sha256-IsM7f/zlzvomVOYlinJVqZllUhDfy4NNTeTPtNmdVak=";
   };
 
+  postPatch = ''
+    rm -r 3rdparty/rapidjson
+    ln -s ${lib.getInclude rapidjson} 3rdparty/rapidjson
+  '';
+
   patches = [ ./patches/mame2016-python311.patch ];
   extraNativeBuildInputs = [ python3 ];
   extraBuildInputs = [ alsa-lib ];
   makeFlags = [ "PYTHON_EXECUTABLE=python3" ];
-  # Build failures when this is set to a bigger number
-  NIX_BUILD_CORES = 8;
-  # Fix build errors in GCC13
-  NIX_CFLAGS_COMPILE = "-Wno-error -fpermissive";
+
+  env = {
+    # Build failures when this is set to a bigger number
+    NIX_BUILD_CORES = 8;
+    # Fix build errors in GCC 13
+    NIX_CFLAGS_COMPILE = "-Wno-error -fpermissive";
+  };
 
   meta = {
     description = "Port of MAME ~2016 to libretro, compatible with MAME 0.174 sets";

pkgs/applications/emulators/libretro/cores/np2kai.nix

···
     "NP2KAI_HASH=${builtins.substring 0 7 src.rev}"
   ];
 
+  # Fix build with GCC 14
+  env.NIX_CFLAGS_COMPILE = toString [
+    "-Wno-error=incompatible-pointer-types"
+    "-Wno-error=int-conversion"
+  ];
+
   preBuild = "cd sdl";
 
   meta = {

pkgs/applications/emulators/libretro/mkLibretroCore.nix

···
 
     passthru = {
       inherit core libretroCore;
-      updateScript = unstableGitUpdater { };
+      # libretro repos sometimes has a fake tag like "Current", ignore
+      # it by setting hardcodeZeroVersion
+      updateScript = unstableGitUpdater { hardcodeZeroVersion = true; };
     } // (args.passthru or { });
 
     meta =

pkgs/applications/misc/gallery-dl/default.nix pkgs/by-name/ga/gallery-dl/package.nix

···
 {
   lib,
-  buildPythonApplication,
-  fetchPypi,
-  requests,
+  fetchFromGitHub,
+  gitUpdater,
   yt-dlp,
-  pytestCheckHook,
-  nix-update-script,
+  python3Packages,
 }:
 
-buildPythonApplication rec {
+python3Packages.buildPythonApplication rec {
   pname = "gallery-dl";
-  version = "1.28.1";
-  format = "setuptools";
+  version = "1.28.2";
+  pyproject = true;
 
-  src = fetchPypi {
-    inherit version;
-    pname = "gallery_dl";
-    hash = "sha256-1UxLZZoDJsaiPqb+zaiWb9TyQIknKlrz6RN21B0sNe4=";
+  src = fetchFromGitHub {
+    owner = "mikf";
+    repo = "gallery-dl";
+    rev = "v${version}";
+    hash = "sha256-AVycp24wGhit9JVE0b+didc2GRnB+EQNnJ3y9a5dMQw=";
   };
 
-  propagatedBuildInputs = [
-    requests
+  build-system = [ python3Packages.setuptools ];
+
+  dependencies = [
+    python3Packages.requests
     yt-dlp
   ];
 
-  nativeCheckInputs = [ pytestCheckHook ];
+  nativeCheckInputs = [ python3Packages.pytestCheckHook ];
 
   disabledTests = [
     # requires network access
···
 
   pythonImportsCheck = [ "gallery_dl" ];
 
-  passthru.updateScript = nix-update-script { };
+  passthru.updateScript = gitUpdater { rev-prefix = "v"; };
 
   meta = {
     description = "Command-line program to download image-galleries and -collections from several image hosting sites";
···
     changelog = "https://github.com/mikf/gallery-dl/blob/v${version}/CHANGELOG.md";
     license = lib.licenses.gpl2Only;
     mainProgram = "gallery-dl";
-    maintainers = with lib.maintainers; [ dawidsowa ];
+    maintainers = [
+      lib.maintainers.dawidsowa
+      lib.maintainers.lucasew
+    ];
   };
 }

pkgs/applications/misc/prusa-slicer/super-slicer-use-boost186.patch

···
+diff --git a/src/hints/HintsToPot.cpp b/src/hints/HintsToPot.cpp
+index 7c8029cdeb..4791f0612f 100644
+--- a/src/hints/HintsToPot.cpp
++++ b/src/hints/HintsToPot.cpp
+@@ -9,7 +9,7 @@
+ 
+ bool write_to_pot(boost::filesystem::path path, const std::vector<std::pair<std::string, std::string>>& data)
+ {
+-	boost::filesystem::ofstream file(std::move(path), std::ios_base::app);
++	boost::nowide::ofstream file(path.string(), std::ios_base::app);
+ 	for (const auto& element : data)
+ 	{
+ 		//Example of .pot element 
+diff --git a/src/slic3r/GUI/RemovableDriveManager.cpp b/src/slic3r/GUI/RemovableDriveManager.cpp
+index 2f8ac96a1a..f0f95c9459 100644
+--- a/src/slic3r/GUI/RemovableDriveManager.cpp
++++ b/src/slic3r/GUI/RemovableDriveManager.cpp
+@@ -22,7 +22,8 @@
+ #include <pwd.h>
+ #include <boost/filesystem.hpp>
+ #include <boost/system/error_code.hpp>
+-#include <boost/filesystem/convenience.hpp>
++#include <boost/filesystem/path.hpp>
++#include <boost/filesystem/operations.hpp>
+ #include <boost/process.hpp>
+ #endif
+ 
+diff --git a/src/slic3r/GUI/ScriptExecutor.cpp b/src/slic3r/GUI/ScriptExecutor.cpp
+index 3e10680e46..374915ee34 100644
+--- a/src/slic3r/GUI/ScriptExecutor.cpp
++++ b/src/slic3r/GUI/ScriptExecutor.cpp
+@@ -825,6 +825,19 @@ void as_back_custom_initial_value(int preset_type, std::string& key) {
+     set_custom_option(preset_type, serialized_vars);
+ }
+ 
++inline void load_string_file(boost::filesystem::path const& p, std::string& str)
++{
++    boost::filesystem::ifstream file;
++    file.exceptions(std::ios_base::failbit | std::ios_base::badbit);
++    file.open(p, std::ios_base::binary);
++    const boost::uintmax_t sz = boost::filesystem::file_size(p);
++    if (BOOST_UNLIKELY(sz > static_cast< boost::uintmax_t >((std::numeric_limits< std::streamsize >::max)())))
++        BOOST_FILESYSTEM_THROW(std::length_error("File size exceeds max read size"));
++    str.resize(static_cast< std::size_t >(sz), '\0');
++    if (sz > 0u)
++        file.read(&str[0], static_cast< std::streamsize >(sz));
++}
++
+ /////// main script fucntions //////
+ 
+ //TODO: add "unset" function, that revert to last value (befoer a scripted set) if a set has been made since last not-scripted change.
+@@ -960,7 +973,7 @@ void ScriptContainer::init(const std::string& tab_key, Tab* tab)
+         //res = builder.AddSectionFromFile(ui_script_file.string().c_str()); //seems to be problematic on cyrillic locale
+         {
+             std::string all_file;
+-            boost::filesystem::load_string_file(ui_script_file, all_file);
++            load_string_file(ui_script_file, all_file);
+             res = builder.AddSectionFromMemory(ui_script_file.string().c_str(), all_file.c_str(), (unsigned int)(all_file.length()), 0);
+         }
+         if (res < 0) throw CompileErrorException("Error, can't build the script for tab " + tab_key);

pkgs/applications/misc/prusa-slicer/super-slicer.nix

···
   description = "PrusaSlicer fork with more features and faster development cycle";
 
   patches = [
-    # Fix compile error with boost 1.79. See https://github.com/supermerill/SuperSlicer/issues/2823
-    (fetchpatch {
-      url = "https://raw.githubusercontent.com/gentoo/gentoo/81e3ca3b7c131e8345aede89e3bbcd700e1ad567/media-gfx/superslicer/files/superslicer-2.4.58.3-boost-1.79-port-v2.patch";
-      # Excludes Linux-only patches
-      excludes = [
-        "src/slic3r/GUI/FreeCADDialog.cpp"
-        "src/slic3r/GUI/Tab.cpp"
-        "src/slic3r/Utils/Http.cpp"
-      ];
-      hash = "sha256-v0q2MhySayij7+qBTE5q01IOq/DyUcWnjpbzB/AV34c=";
-    })
     # Drop if this fix gets merged upstream
     (fetchpatch {
       url = "https://github.com/supermerill/SuperSlicer/commit/fa7c545efa5d1880cf24af32083094fc872d3692.patch";
       hash = "sha256-fh31qrqjQiRQL03pQl4KJAEtbKMwG8/nJroqIDOIePw=";
     })
+    ./super-slicer-use-boost186.patch
   ];
 
   versions = {
     stable = {
-      version = "2.3.57.12";
-      hash = "sha256-lePhDRHI++9zs54bTt2/Lu6ZQ7egjJCWb752aI0s7Mw==";
-      patches = null;
+      version = "2.5.59.13";
+      hash = "sha256-FkoGcgVoBeHSZC3W5y30TBPmPrWnZSlO66TgwskgqAU=";
+      inherit patches;
     };
     latest = {
-      version = "2.4.58.5";
-      hash = "sha256-UywxEGedXaBUTKojEkbkuejI6SdPSkPxTJMwUDNW6W0=";
+      version = "2.5.59.13";
+      hash = "sha256-FkoGcgVoBeHSZC3W5y30TBPmPrWnZSlO66TgwskgqAU=";
       inherit patches;
     };
     beta = {
-      version = "2.5.59.6";
-      hash = "sha256-4ivhkcvVw5NlPsDz3J840aWc0qnp/XzCnTTCICwi3/c=";
+      version = "2.5.60.0";
+      hash = "sha256-dDRK07SatLLhuoc2fJKbHUwAofRRvBUoXWO61W2blFM=";
       inherit patches;
     };
   };
···
             --replace-fail 'auto &vi' 'auto vi'
         '';
 
-      # We don't need PS overrides anymore, and gcode-viewer is embedded in the binary.
-      postInstall = null;
+      # We don't need PS overrides anymore, and gcode-viewer is embedded in the binary
+      # but we do still need to move OCCTWrapper.so to the lib directory
+      postInstall = ''
+        if [[ -f $out/bin/OCCTWrapper.so ]]; then
+          mkdir -p "$out/lib"
+          mv -v $out/bin/*.* $out/lib/
+        fi
+      '';
       separateDebugInfo = true;
 
       buildInputs = super.buildInputs ++ [

pkgs/applications/misc/rofi/default.nix

···
   git,
   cairo,
   libxcb,
+  xcb-util-cursor,
+  xcbutilkeysyms,
   xcbutil,
   xcbutilwm,
   xcbutilxrm,
-  xcb-util-cursor,
   libstartup_notification,
   bison,
   flex,
···
 
 stdenv.mkDerivation rec {
   pname = "rofi-unwrapped";
-  version = "1.7.5";
+  version = "1.7.6";
 
   src = fetchFromGitHub {
     owner = "davatorium";
     repo = "rofi";
     rev = version;
     fetchSubmodules = true;
-    hash = "sha256-3XFusKeckagEPfbLtt1xAVTEfn1Qebdi/Iq1AYbHCR4=";
+    hash = "sha256-hT9FMCAwY8hZx4y1l0vHfcReIJUBxSmixZJhKP8nRpw=";
   };
 
   preConfigure = ''
···
     check
     libstartup_notification
     libxcb
+    xcb-util-cursor
+    xcbutilkeysyms
     xcbutil
     xcbutilwm
     xcbutilxrm
-    xcb-util-cursor
     which
   ];
 

pkgs/applications/misc/workrave/default.nix pkgs/by-name/wo/workrave/package.nix

···
   cairomm,
   dbus,
   dbus-glib,
-  gdome2,
-  gstreamer,
-  gst-plugins-base,
-  gst-plugins-good,
+  gst_all_1,
   libsigcxx,
   boost,
-  jinja2,
+  python3Packages,
 }:
 
 stdenv.mkDerivation rec {
···
     libtool
     pkg-config
     wrapGAppsHook3
-    jinja2
+    python3Packages.jinja2
     gobject-introspection
   ];
 
···
     cairomm
     dbus
     dbus-glib
-    gdome2
-    gstreamer
-    gst-plugins-base
-    gst-plugins-good
+    gst_all_1.gstreamer
+    gst_all_1.gst-plugins-base
+    gst_all_1.gst-plugins-good
     libsigcxx
     boost
   ];
···
   enableParallelBuilding = true;
 
   meta = with lib; {
-    broken = (stdenv.hostPlatform.isLinux && stdenv.hostPlatform.isAarch64);
     description = "Program to help prevent Repetitive Strain Injury";
     mainProgram = "workrave";
     longDescription = ''

pkgs/by-name/ag/agenix-cli/package.nix

···
+{
+  lib,
+  fetchFromGitHub,
+  rustPlatform,
+  nix-update-script,
+}:
+
+rustPlatform.buildRustPackage rec {
+  pname = "agenix-cli";
+  version = "0.1.0";
+
+  src = fetchFromGitHub {
+    owner = "cole-h";
+    repo = "agenix-cli";
+    rev = "v${version}";
+    sha256 = "sha256-0+QVY1sDhGF4hAN6m2FdKZgm9V1cuGGjY4aitRBnvKg=";
+  };
+
+  cargoHash = "sha256-TLCSLxrKLBge/DgyzvBSshssIiFOuc/4Dq0wY7u2hxI=";
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "Companion tool to https://github.com/ryantm/agenix";
+    homepage = "https://github.com/cole-h/agenix-cli";
+    license = with lib.licenses; [
+      asl20
+      mit
+    ];
+    maintainers = with lib.maintainers; [ misuzu ];
+    mainProgram = "agenix";
+  };
+}

pkgs/by-name/aj/aja-desktop-software/package.nix

···
+{
+  stdenvNoCC,
+  lib,
+  fetchzip,
+  dpkg,
+  patchelf,
+  buildFHSEnv,
+  writeShellScript,
+  makeBinaryWrapper,
+}:
+
+let
+  pname = "aja-desktop-software";
+  version = "17.1.3";
+  meta = {
+    description = "Graphical utilities for interacting with AJA desktop video cards";
+    homepage = "https://www.aja.com/products/aja-control-room";
+    license = lib.licenses.unfree; # https://www.aja.com/software-license-agreement
+    maintainers = [ lib.maintainers.lukegb ];
+    platforms = [ "x86_64-linux" ];
+    sourceProvenance = [
+      lib.sourceTypes.binaryNativeCode
+      lib.sourceTypes.binaryFirmware
+    ];
+  };
+
+  unwrapped = stdenvNoCC.mkDerivation {
+    pname = "${pname}-unwrapped";
+    inherit version;
+
+    src = fetchzip {
+      url = "https://www.aja.com/assets/support/files/9895/en/AJA-Desktop-Software-Installer_Linux-Ubuntu_v${version}_Release.zip";
+      hash = "sha256-TxDcYIhEcpPnpoqpey5vSvUltLT/3xwBfOhAP81Q9+E=";
+    };
+
+    unpackCmd = "dpkg -x $curSrc/ajaretail_*.deb source";
+
+    nativeBuildInputs = [
+      dpkg
+      patchelf
+    ];
+
+    installPhase = ''
+      runHook preInstall
+
+      mkdir -p $out/share
+      mv usr/share/applications $out/share/applications
+      mv usr/share/doc $out/share/doc
+
+      mv etc $out/etc
+
+      mv opt $out/opt
+
+      ln -s $out/opt/aja/bin $out/bin
+
+      # For some reason ajanmos doesn't have /opt/aja/lib in its rpath...
+      patchelf $out/opt/aja/bin/ajanmos --add-rpath $out/opt/aja/lib
+
+      runHook postInstall
+    '';
+
+    dontPatchELF = true;
+
+    inherit meta;
+  };
+in
+buildFHSEnv {
+  inherit pname version;
+
+  targetPkgs =
+    pkgs:
+    [ unwrapped ]
+    ++ (with pkgs; [
+      ocl-icd
+      libGL
+      udev
+      libpulseaudio
+      zstd
+      glib
+      fontconfig
+      freetype
+      xorg.libxcb
+      xorg.libX11
+      xorg.xcbutilwm
+      xorg.xcbutilimage
+      xorg.xcbutilkeysyms
+      xorg.xcbutilrenderutil
+      xorg.libSM
+      xorg.libICE
+      libxkbcommon
+      dbus
+      avahi
+    ]);
+
+  nativeBuildInputs = [
+    makeBinaryWrapper
+  ];
+
+  unshareIpc = false;
+  unsharePid = false;
+
+  runScript = writeShellScript "aja" ''
+    exec_binary="$1"
+    shift
+    export QT_PLUGIN_PATH="${unwrapped}/opt/aja/plugins"
+    exec "${unwrapped}/opt/aja/bin/$exec_binary" "$@"
+  '';
+
+  extraInstallCommands = ''
+    mkdir -p $out/libexec/aja-desktop
+    mv $out/bin/${pname} $out/libexec/aja-desktop/${pname}
+
+    for binary in controlpanel controlroom ajanmos systemtest; do
+      makeWrapper "$out/libexec/aja-desktop/${pname}" "$out/bin/aja-$binary" \
+        --add-flags "$binary"
+    done
+  '';
+
+  passthru = {
+    inherit unwrapped;
+  };
+
+  meta = meta // {
+    mainProgram = "aja-controlpanel";
+  };
+}

pkgs/by-name/al/alt-tab-macos/package.nix

···
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "alt-tab-macos";
-  version = "7.12.0";
+  version = "7.14.1";
 
   src = fetchurl {
     url = "https://github.com/lwouis/alt-tab-macos/releases/download/v${finalAttrs.version}/AltTab-${finalAttrs.version}.zip";
-    hash = "sha256-CUsbex5R3msKZYrp52snX6ZBTZjtVRN63t6ABDcDYfI=";
+    hash = "sha256-62+2N+TjKq+TdJuaOizpiSvGQnkC2+VhBX+3A2QepwI=";
   };
 
   sourceRoot = ".";

pkgs/by-name/ap/apt-cacher-ng/package.nix

···
   c-ares,
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "apt-cacher-ng";
-  version = "3.7.4";
+  version = "3.7.5";
 
   src = fetchurl {
-    url = "mirror://debian/pool/main/a/apt-cacher-ng/apt-cacher-ng_${version}.orig.tar.xz";
-    sha256 = "0pwsj9rf6a6q7cnfbpcrfq2gjcy7sylqzqqr49g2zi39lrrh8533";
+    url = "mirror://debian/pool/main/a/apt-cacher-ng/apt-cacher-ng_${finalAttrs.version}.orig.tar.xz";
+    hash = "sha256-LkiH1ocDljNJkqzNMx4Sy6ht/vhXUy9hC7BjWo4ykA0=";
   };
-
-  patches = [
-    # this patch fixes the build for glibc >= 2.38
-    (fetchpatch {
-      name = "strlcpy-glibc238.patch";
-      url = "https://bugs.debian.org/cgi-bin/bugreport.cgi?att=0;bug=1052360;msg=10";
-      hash = "sha256-uhQj+ZcHCV36Tm0pF/+JG59bSaRdTZCrMcKL3YhZTk8=";
-    })
-  ];
 
   nativeBuildInputs = [
     cmake
···
     c-ares
   ];
 
-  meta = with lib; {
+  meta = {
     description = "Caching proxy specialized for Linux distribution files";
     mainProgram = "apt-cacher-ng";
     homepage = "https://www.unix-ag.uni-kl.de/~bloch/acng/";
-    license = licenses.bsdOriginal;
-    platforms = platforms.linux;
-    maintainers = [ maintainers.makefu ];
+    license = lib.licenses.bsdOriginal;
+    platforms = lib.platforms.linux;
+    maintainers = [ lib.maintainers.makefu ];
   };
-}
+})

pkgs/by-name/ar/arj/package.nix

···
+{
+  gccStdenv,
+  lib,
+  fetchurl,
+  fetchzip,
+  fetchpatch,
+  autoreconfHook,
+}:
+
+gccStdenv.mkDerivation (finalAttrs: {
+  pname = "arj";
+  version = "3.10.22";
+  debianrev = "28";
+
+  src = fetchurl {
+    url = "http://deb.debian.org/debian/pool/main/a/arj/arj_${finalAttrs.version}.orig.tar.gz";
+    hash = "sha256-WJ5Mm8zIZp57bY1vzWTgH2osIf4QqtVqgzBOzDuWp9s=";
+  };
+
+  versionPatch = fetchzip {
+    url = "http://deb.debian.org/debian/pool/main/a/arj/arj_${finalAttrs.version}-${finalAttrs.debianrev}.debian.tar.xz";
+    hash = "sha256-rmu5RSZ6OHGT093PShzkvC3ktm/U6smta6pmn9D7Jfw=";
+  };
+
+  nativeBuildInputs = [ autoreconfHook ];
+
+  postPatch =
+    lib.optionalString gccStdenv.hostPlatform.isDarwin ''
+      substituteInPlace environ.c \
+          --replace-fail "  #include <sys/statfs.h>" "  #include <sys/mount.h>"
+    ''
+    + ''
+      cp -r ${finalAttrs.versionPatch} ./debian
+      chmod +w debian/patches/gnu_build_cross.patch
+      chmod +w debian/patches
+      mv debian/patches/gnu_build_cross.patch debian/patches/zz_for_last_gnu_build_cross.patch # This patch should be applied at last
+      for fname in debian/patches/*.patch
+        do
+          patch -p1 < "$fname"
+        done
+    '';
+
+  env = {
+    NIX_CFLAGS_COMPILE = toString [
+      "-Wno-error=implicit-function-declaration"
+    ];
+  };
+
+  preAutoreconf = ''
+    cd gnu
+  '';
+
+  postConfigure = ''
+    cd ..
+  '';
+
+  meta = {
+    description = "Open-source implementation of the world-famous ARJ archiver";
+    longDescription = ''
+      This version of ARJ has been created with an intent to preserve maximum
+      compatibility and retain the feature set of the original ARJ archiver as
+      provided by ARJ Software, Inc.
+    '';
+    license = lib.licenses.gpl2Plus;
+    maintainers = [ lib.maintainers.sander ];
+    platforms = lib.platforms.unix;
+  };
+})

pkgs/by-name/as/asha-pipewire-sink/package.nix

···
+{
+  cmake,
+  stdenv,
+  fetchFromGitHub,
+  lib,
+  pkg-config,
+  pipewire,
+  bluez,
+  glib,
+}:
+
+stdenv.mkDerivation rec {
+  pname = "asha-pipewire-sink";
+  version = "0-unstable-2024-10-22";
+
+  src = fetchFromGitHub {
+    owner = "thewierdnut";
+    repo = "asha_pipewire_sink";
+    rev = "bbf665b9a3b90fcdbaeb092799ea3c5ba4347e31";
+    hash = "sha256-PuJ6lBV7s5OqGe1X4wD7T+8LVMCFpgvM1pnMjXYr8gs=";
+  };
+
+  nativeBuildInputs = [
+    cmake
+    pkg-config
+  ];
+
+  buildInputs = [
+    bluez.dev
+    glib.dev
+    pipewire.dev
+  ];
+
+  installPhase = ''
+    install -Dm755 asha_connection_test snoop_analyze asha_stream_test asha_pipewire_sink -t $out/bin
+  '';
+
+  meta = {
+    description = "Sample ASHA implementation for Linux designed to work with pipewire and bluez";
+    homepage = "https://github.com/thewierdnut/asha_pipewire_sink";
+    license = lib.licenses.unlicense;
+    platforms = lib.platforms.all;
+    maintainers = with lib.maintainers; [ onny ];
+    mainProgram = "asha_pipewire_sink";
+  };
+}

pkgs/by-name/c6/c64-debugger/package.nix

···
   src = fetchgit {
     url = "https://git.code.sf.net/p/c64-debugger/code";
     rev = "f97772e3f5c8b4fa99e8ed212ed1c4cb1e2389f1";
-    sha256 = "sha256-3SR73AHQlYSEYpJLtQ/aJ1UITZGq7aA9tQKxBsn/yuc=";
+    hash = "sha256-3SR73AHQlYSEYpJLtQ/aJ1UITZGq7aA9tQKxBsn/yuc=";
   };
 
   buildInputs = [
···
     runHook postInstall
   '';
 
-  meta = with lib; {
+  env = {
+    NIX_CFLAGS_COMPILE = toString [
+      "-Wno-error=narrowing"
+      "-Wno-error=implicit-function-declaration"
+      "-Wno-error=int-conversion"
+      "-Wno-error=incompatible-pointer-types"
+    ];
+  };
+
+  meta = {
     homepage = "https://sourceforge.net/projects/c64-debugger";
     description = "Commodore 64, Atari XL/XE and NES code and memory debugger that works in real time";
-    license = with licenses; [
+    license = with lib.licenses; [
       gpl3Only # c64-debugger
       mit # MTEngine
       # emulators included in c64-debugger
···
       gpl2 # nestopiaue
     ];
     mainProgram = "c64debugger";
-    maintainers = [ maintainers.detegr ];
-    platforms = platforms.linux;
+    maintainers = [ lib.maintainers.detegr ];
+    platforms = lib.platforms.linux;
   };
 }

pkgs/by-name/ca/caddy/package.nix

···
 , testers
 , installShellFiles
 , stdenv
-, go
-, xcaddy
-, cacert
-, git
 }:
 let
   version = "2.8.4";
···
     description = "Fast and extensible multi-platform HTTP/1-2-3 web server with automatic HTTPS";
     license = licenses.asl20;
     mainProgram = "caddy";
-    maintainers = with maintainers; [ Br1ght0ne emilylange techknowlogick ];
+    maintainers = with maintainers; [ Br1ght0ne techknowlogick ];
   };
 }

pkgs/by-name/ca/caddy/plugins.nix

···
+# callPackage args
 {
   lib,
   stdenv,
···
   git,
   caddy,
 }:
+
+let
+  inherit (builtins) hashString;
+  inherit (lib)
+    assertMsg
+    concatMapStrings
+    elemAt
+    fakeHash
+    filter
+    hasInfix
+    length
+    lessThan
+    sort
+    toShellVar
+    ;
+in
+
+# pkgs.caddy.withPlugins args
 {
   plugins,
-  hash ? lib.fakeHash,
+  hash ? fakeHash,
 }:
+
 let
-  pluginsSorted = lib.sort lib.lessThan plugins;
-  pluginsList = lib.concatMapStrings (plugin: "${plugin}-") pluginsSorted;
-  pluginsHash = builtins.hashString "md5" pluginsList;
-  pluginsWithoutVersion = lib.filter (p: !lib.hasInfix "@" p) pluginsSorted;
+  pluginsSorted = sort lessThan plugins;
+  pluginsList = concatMapStrings (plugin: "${plugin}-") pluginsSorted;
+  pluginsHash = hashString "md5" pluginsList;
+  pluginsWithoutVersion = filter (p: !hasInfix "@" p) pluginsSorted;
 in
-assert lib.assertMsg (
-  lib.length pluginsWithoutVersion == 0
-) "All plugins should have a version (eg ${lib.elemAt pluginsWithoutVersion 0}@x.y.z)!";
+
+# eval barrier: user provided plugins must have tags
+# the go module must either be tagged in upstream repo
+# or user must provide commit sha or a pseudo-version number
+# https://go.dev/doc/modules/version-numbers#pseudo-version-number
+assert assertMsg (
+  length pluginsWithoutVersion == 0
+) "Plugins must have tags present (e.g. ${elemAt pluginsWithoutVersion 0}@x.y.z)!";
+
 caddy.overrideAttrs (
   finalAttrs: prevAttrs: {
     vendorHash = null;
···
       dontUnpack = true;
       buildPhase =
         let
-          withArgs = lib.concatMapStrings (plugin: "--with ${plugin} ") pluginsSorted;
+          withArgs = concatMapStrings (plugin: "--with ${plugin} ") pluginsSorted;
         in
         ''
           export GOCACHE=$TMPDIR/go-cache
···
       outputHashAlgo = "sha256";
     };
 
+    # xcaddy built output always uses pseudo-version number
+    # we enforce user provided plugins are present and have matching tags here
     doInstallCheck = true;
     installCheckPhase = ''
       runHook preInstallCheck
 
-      ${lib.toShellVar "notfound" pluginsSorted}
+      ${toShellVar "notfound" pluginsSorted}
+
       while read kind module version; do
         [[ "$kind" = "dep" ]] || continue
         module="''${module}@''${version}"
···
           fi
         done
       done < <($out/bin/caddy build-info)
+
       if (( ''${#notfound[@]} )); then
-        >&2 echo "Plugins not found: ''${notfound[@]}"
+        for plugin in "''${notfound[@]}"; do
+          base=''${plugin%@*}
+          specified=''${plugin#*@}
+          found=0
+
+          while read kind module expected; do
+            [[ "$kind" = "dep" && "$module" = "$base" ]] || continue
+            echo "Plugin \"$base\" have incorrect tag:"
+            echo "  specified: \"$base@$specified\""
+            echo "  got: \"$base@$expected\""
+            found=1
+          done < <($out/bin/caddy build-info)
+
+          if (( found == 0 )); then
+            echo "Plugin \"$base\" not found in build:"
+            echo "  specified: \"$base@$specified\""
+            echo "  plugin does not exist in the xcaddy build output, open an issue in nixpkgs or upstream"
+          fi
+        done
+
         exit 1
       fi
 

pkgs/by-name/ca/canokey-usbip/package.nix

···
     python3
   ];
 
+  env = {
+    NIX_CFLAGS_COMPILE = toString [
+      "-Wno-error=incompatible-pointer-types"
+    ];
+  };
+
   postInstall = ''
     install -D --target-directory=$out/bin canokey-usbip
   '';

pkgs/by-name/ca/cargo-generate/package.nix

···
 
 rustPlatform.buildRustPackage rec {
   pname = "cargo-generate";
-  version = "0.22.0";
+  version = "0.22.1";
 
   src = fetchFromGitHub {
     owner = "cargo-generate";
     repo = "cargo-generate";
     rev = "v${version}";
-    sha256 = "sha256-oiXv6MbQpmWFi2cTN3a1Zx7Bjr0Y+f6/O+0FQNidbBg=";
+    sha256 = "sha256-iOZCSd6jF1OF7ScjpsMlvMjsFHyg6QJJ6qk0OxrARho=";
   };
 
-  cargoHash = "sha256-8yLGxydU7jjoG13I+h7qjtabcCxzjnEiE8tAbH56pp4=";
+  cargoHash = "sha256-ZLzJpD3bIuNtGl5kzhvpE07jtfEV+lgnTiPcFM7MHdE=";
 
   nativeBuildInputs = [ pkg-config ];
 

pkgs/by-name/cl/clipit/package.nix

···
 {
   fetchFromGitHub,
+  fetchpatch,
   lib,
   stdenv,
   autoreconfHook,
···
     intltoolize --copy --force --automake
   '';
 
+  patches = [
+    # Fixes for GCC14
+    (fetchpatch {
+      url = "https://salsa.debian.org/debian/clipit/-/raw/d4bafc28fcb445d1940cdfede6c70142cf3162f5/debian/patches/incompatible-pointer-types.patch";
+      hash = "sha256-STI1fpnoPdEqu1embQcUlTG712HPbJ+LPm930P13Ixo=";
+    })
+    (fetchpatch {
+      url = "https://salsa.debian.org/debian/clipit/-/raw/656d0814030c13437b10d40ee75615d0e8cd873e/debian/patches/missing-prototypes.patch";
+      hash = "sha256-UD183IjV5BprPHQK9bhmUBKfUYgqEZ9M1cRE+AmhAPA=";
+    })
+  ];
+
   nativeBuildInputs = [
     pkg-config
     wrapGAppsHook3
     autoreconfHook
     intltool
   ];
+
   configureFlags = [
     "--with-gtk3"
     "--enable-appindicator=yes"
   ];
+
   buildInputs = [
     gtk3
     libayatana-appindicator

pkgs/by-name/co/cockpit/package.nix

···
   git,
   glib,
   glib-networking,
-  gnused,
   gnutls,
   json-glib,
   krb5,
···
   pkg-config,
   polkit,
   python3Packages,
-  runtimeShell,
   systemd,
   udev,
   xmlto,
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "cockpit";
-  version = "330";
+  version = "331";
 
   src = fetchFromGitHub {
     owner = "cockpit-project";
     repo = "cockpit";
-    rev = "refs/tags/${version}";
-    hash = "sha256-tPoFa9/22WUO+N3Pc/7jdWIOsoImeru6/F+2yUi92iI=";
+    tag = finalAttrs.version;
+    hash = "sha256-G0L1ZcvjUCSNkDvYoyConymZ4bsEye03t5K15EyI008=";
     fetchSubmodules = true;
   };
 
···
     echo "#!/bin/sh" > test/node_modules
 
     substituteInPlace src/tls/cockpit-certificate-helper.in \
-      --replace 'COCKPIT_CONFIG="@sysconfdir@/cockpit"' 'COCKPIT_CONFIG=/etc/cockpit'
+      --replace-fail 'COCKPIT_CONFIG="@sysconfdir@/cockpit"' 'COCKPIT_CONFIG=/etc/cockpit'
 
     substituteInPlace src/tls/cockpit-certificate-ensure.c \
-      --replace '#define COCKPIT_SELFSIGNED_PATH      PACKAGE_SYSCONF_DIR COCKPIT_SELFSIGNED_FILENAME' '#define COCKPIT_SELFSIGNED_PATH      "/etc" COCKPIT_SELFSIGNED_FILENAME'
+      --replace-fail '#define COCKPIT_SELFSIGNED_PATH      PACKAGE_SYSCONF_DIR COCKPIT_SELFSIGNED_FILENAME' '#define COCKPIT_SELFSIGNED_PATH      "/etc" COCKPIT_SELFSIGNED_FILENAME'
 
     substituteInPlace src/common/cockpitconf.c \
-      --replace 'const char *cockpit_config_dirs[] = { PACKAGE_SYSCONF_DIR' 'const char *cockpit_config_dirs[] = { "/etc"'
+      --replace-fail 'const char *cockpit_config_dirs[] = { PACKAGE_SYSCONF_DIR' 'const char *cockpit_config_dirs[] = { "/etc"'
 
     # instruct users with problems to create a nixpkgs issue instead of nagging upstream directly
     substituteInPlace configure.ac \
-      --replace '[e-mail]' 'https://github.com/NixOS/nixpkgs/issues/new?assignees=&labels=0.kind%3A+bug&template=bug_report.md&title=cockpit%25'
+      --replace-fail '[e-mail]' 'https://github.com/NixOS/nixpkgs/issues/new?assignees=&labels=0.kind%3A+bug&template=bug_report.md&title=cockpit%25'
 
     patchShebangs \
       build.js \
       test/common/pixel-tests \
       test/common/run-tests \
       test/common/tap-cdp \
-      test/static-code \
       tools/escape-to-c \
       tools/make-compile-commands \
       tools/node-modules \
       tools/termschutz \
-      tools/webpack-make.js
+      tools/webpack-make.js \
+      tools/test-driver \
+      test/common/static-code
 
     for f in node_modules/.bin/*; do
       patchShebangs $(realpath $f)
···
     for f in pkg/**/*.js pkg/**/*.jsx test/**/* src/**/*; do
       # some files substituteInPlace report as missing and it's safe to ignore them
       substituteInPlace "$(realpath "$f")" \
-        --replace '"/usr/bin/' '"' \
-        --replace '"/bin/' '"' || true
+        --replace-quiet '"/usr/bin/' '"' \
+        --replace-quiet '"/bin/' '"' || true
     done
 
     substituteInPlace src/common/Makefile-common.am \
-      --replace 'TEST_PROGRAM += test-pipe' "" # skip test-pipe because it hangs the build
+      --replace-warn 'TEST_PROGRAM += test-pipe' "" # skip test-pipe because it hangs the build
+
+    substituteInPlace src/ws/Makefile-ws.am \
+      --replace-warn 'TEST_PROGRAM += test-compat' ""
 
     substituteInPlace test/pytest/*.py \
-      --replace "'bash" "'${bashInteractive}/bin/bash"
+      --replace-quiet "'bash" "'${bashInteractive}/bin/bash"
 
-    echo "m4_define(VERSION_NUMBER, [${version}])" > version.m4
+    echo "m4_define(VERSION_NUMBER, [${finalAttrs.version}])" > version.m4
+
+    # hardcode libexecdir, I am assuming that cockpit only use it to find it's binaries
+    printf 'def get_libexecdir() -> str:\n\treturn "%s"' "$out/libexec" >> src/cockpit/packages.py
   '';
 
   configureFlags = [
···
     "--disable-pcp" # TODO: figure out how to package its dependency
     "--with-default-session-path=/run/wrappers/bin:/run/current-system/sw/bin"
     "--with-admin-group=root" # TODO: really? Maybe "wheel"?
-    "--enable-old-bridge=yes"
   ];
 
   enableParallelBuilding = true;
 
-  preBuild = ''
-    patchShebangs \
-      tools/test-driver
-  '';
-
-  postBuild = ''
-    chmod +x \
-      src/systemd/update-motd \
-      src/tls/cockpit-certificate-helper \
-      src/ws/cockpit-desktop
-
-    patchShebangs \
-      src/systemd/update-motd \
-      src/tls/cockpit-certificate-helper \
-      src/ws/cockpit-desktop
-
-    substituteInPlace src/ws/cockpit-desktop \
-      --replace ' /bin/bash' ' ${runtimeShell}'
-  '';
-
   fixupPhase = ''
     runHook preFixup
+
+    patchShebangs $out/libexec/*
 
     wrapProgram $out/libexec/cockpit-certificate-helper \
       --prefix PATH : ${
···
       } \
       --run 'cd $(mktemp -d)'
 
-    wrapProgram $out/share/cockpit/motd/update-motd \
-      --prefix PATH : ${lib.makeBinPath [ gnused ]}
-
     wrapProgram $out/bin/cockpit-bridge \
       --prefix PYTHONPATH : $out/${python3Packages.python.sitePackages}
 
     substituteInPlace $out/${python3Packages.python.sitePackages}/cockpit/_vendor/systemd_ctypes/libsystemd.py \
-      --replace-fail libsystemd.so.0 ${systemd}/lib/libsystemd.so.0
+      --replace-warn libsystemd.so.0 ${systemd}/lib/libsystemd.so.0
 
     substituteInPlace $out/share/polkit-1/actions/org.cockpit-project.cockpit-bridge.policy \
       --replace-fail /usr $out
 
+    substituteInPlace $out/lib/systemd/*/* \
+      --replace-warn /bin /run/current-system/sw/bin
+
     runHook postFixup
   '';
 
-  doCheck = true;
+  nativeCheckInputs = [ python3Packages.pytestCheckHook ];
+
   checkInputs = [
     bashInteractive
     cacert
     dbus
     glib-networking
     openssh
-    python3Packages.pytest
   ];
-  checkPhase = ''
+
+  preCheck = ''
     export GIO_EXTRA_MODULES=$GIO_EXTRA_MODULES:${glib-networking}/lib/gio/modules
     export G_DEBUG=fatal-criticals
     export G_MESSAGES_DEBUG=cockpit-ws,cockpit-wrapper,cockpit-bridge
     export PATH=$PATH:$(pwd)
 
-    make pytest -j$NIX_BUILD_CORES || true
     make check  -j$NIX_BUILD_CORES || true
-    test/static-code
     npm run eslint
-    npm run stylelint || true
+    npm run stylelint
   '';
 
   passthru = {
···
     updateScript = nix-update-script { };
   };
 
-  meta = with lib; {
+  meta = {
     description = "Web-based graphical interface for servers";
     mainProgram = "cockpit-bridge";
     homepage = "https://cockpit-project.org/";
-    license = licenses.lgpl21;
-    maintainers = with maintainers; [ lucasew ];
+    changelog = "https://cockpit-project.org/blog/cockpit-${finalAttrs.version}.html";
+    license = lib.licenses.lgpl21;
+    maintainers = [ lib.maintainers.lucasew ];
   };
-}
+})

pkgs/by-name/co/copywrite/package.nix

···
+{
+  lib,
+  stdenv,
+  buildGoModule,
+  fetchFromGitHub,
+  installShellFiles,
+  testers,
+  copywrite,
+}:
+
+let
+  commitHash = "6ed520a710166c6094098b786c63f212604654a4"; # matches tag release
+  shortCommitHash = builtins.substring 0 7 commitHash;
+in
+buildGoModule rec {
+  pname = "copywrite";
+  version = "0.19.0";
+
+  src = fetchFromGitHub {
+    owner = "hashicorp";
+    repo = "copywrite";
+    rev = "v${version}";
+    hash = "sha256-DmlPioaw/wMk8GoBYNG24P4J1C6h0bjVjjOuMYW6Tgo=";
+  };
+
+  vendorHash = "sha256-ZIu0/fue3xi+YVE9GFsVjCNs8t3c3TWH8O0xUzJdim8=";
+
+  ldflags = [
+    "-s"
+    "-w"
+    "-X github.com/hashicorp/copywrite/cmd.version=${version}"
+    "-X github.com/hashicorp/copywrite/cmd.commit=${shortCommitHash}"
+  ];
+
+  env.CGO_ENABLED = 0;
+
+  nativeBuildInputs = [ installShellFiles ];
+  postInstall = lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
+    $out/bin/copywrite completion bash > copywrite.bash
+    $out/bin/copywrite completion zsh > copywrite.zsh
+    $out/bin/copywrite completion fish > copywrite.fish
+    installShellCompletion copywrite.{bash,zsh,fish}
+  '';
+
+  passthru.tests.version = testers.testVersion {
+    package = copywrite;
+    command = "copywrite --version";
+    version = "${version}-${shortCommitHash}";
+  };
+
+  meta = {
+    description = "Automate copyright headers and license files at scale";
+    mainProgram = "copywrite";
+    homepage = "https://github.com/hashicorp/copywrite";
+    changelog = "https://github.com/hashicorp/copywrite/releases/tag/v${version}";
+    license = lib.licenses.mpl20;
+    maintainers = with lib.maintainers; [ dvcorreia ];
+  };
+}

pkgs/by-name/da/daemontools/package.nix

···
     sha256 = "07scvw88faxkscxi91031pjkpccql6wspk4yrlnsbrrb5c0kamd5";
   };
 
-  patches = [ ./fix-nix-usernamespace-build.patch ];
+  patches = [
+    (fetchurl {
+      url = "https://salsa.debian.org/debian/daemontools/-/raw/1844f0e704ab66844da14354a16ea068eba0403f/debian/patches/0005-fix-ftbfs.patch";
+      hash = "sha256-Q7t0kwajjTW2Ms5m44E4spBwHi5Xi6Y39FQVsawr8LA=";
+    })
+    ./fix-nix-usernamespace-build.patch
+  ];
 
   outputs = [
     "out"
···
     sed -i -e '1 s_$_ -include ${glibc.dev}/include/errno.h_' src/conf-cc
 
     substituteInPlace src/Makefile \
-      --replace '/bin/sh' '${bash}/bin/bash -oxtrace'
+      --replace-fail '/bin/sh' '${bash}/bin/bash -oxtrace'
 
     sed -i -e "s_^PATH=.*_PATH=$src/daemontools-${version}/compile:''${PATH}_" src/rts.tests
 

pkgs/by-name/dn/dnote/package.nix

···
+{
+  lib,
+  stdenv,
+  buildGoModule,
+  fetchFromGitHub,
+  fetchNpmDeps,
+  npmHooks,
+  nodejs,
+  nix-update-script,
+  versionCheckHook,
+  postgresqlTestHook,
+  postgresql,
+  defaultApiEndPoint ? "https://api.getdnote.com",
+}:
+
+buildGoModule rec {
+  pname = "dnote";
+  version = "0.15.1";
+
+  src = fetchFromGitHub {
+    owner = "dnote";
+    repo = "dnote";
+    tag = "cli-v${version}";
+    hash = "sha256-2vVopuFf9bx8U3+U4wznC/9nlLtan+fU5v9HUCEI1R4=";
+  };
+
+  npmDeps = fetchNpmDeps {
+    inherit version src;
+    pname = "${pname}-webui";
+    sourceRoot = "${src.name}/pkg/server/assets";
+    hash = "sha256-gUr8ptPsE7uw/F52CZi1P2L7eLgGiELEz6tI+fwAN0I=";
+  };
+
+  overrideModAttrs = oldAttrs: {
+    # Do not add `npmConfigHook` to `goModules`
+    nativeBuildInputs = lib.remove npmHooks.npmConfigHook oldAttrs.nativeBuildInputs;
+    preBuild = null;
+  };
+
+  npmRoot = "pkg/server/assets";
+
+  env = {
+    DBHost = "localhost";
+    DBPort = "5432";
+    DBName = "test_db";
+    DBUser = "postgres";
+    DBPassword = "";
+    DBSkipSSL = true;
+    SmtpUsername = "mock-SmtpUsername";
+    SmtpPassword = "mock-SmtpPassword";
+    SmtpHost = "mock-SmtpHost";
+    SmtpPort = 465;
+    WebURL = "http://localhost:3000";
+    DisableRegistration = false;
+    postgresqlEnableTCP = true;
+  };
+
+  nativeBuildInputs = [
+    npmHooks.npmConfigHook
+    nodejs
+  ];
+
+  nativeCheckInputs = [
+    postgresqlTestHook
+    postgresql
+  ];
+
+  tags = [
+    "fts5"
+  ];
+
+  preBuild = ''
+    patchShebangs .
+
+    pushd pkg/server/assets
+
+    ./styles/build.sh
+    ./js/build.sh
+
+    popd
+  '';
+
+  ldflags = [
+    "-X github.com/dnote/dnote/pkg/server/buildinfo.Version=${version}"
+    "-X github.com/dnote/dnote/pkg/cli/buildinfo.Version=${version}"
+    "-X main.apiEndpoint=${defaultApiEndPoint}"
+    "-X main.versionTag=${version}"
+    "-X github.com/dnote/dnote/pkg/server/buildinfo.Standalone=true"
+    "-X github.com/dnote/dnote/pkg/server/buildinfo.JSFiles=main.js"
+    "-X github.com/dnote/dnote/pkg/server/buildinfo.CSSFiles=main.css"
+  ];
+
+  __darwinAllowLocalNetworking = true;
+
+  postInstall = ''
+    mv $out/bin/cli $out/bin/dnote-cli
+    mv $out/bin/migrate $out/bin/dnote-migrate
+    mv $out/bin/server $out/bin/dnote-server
+    mv $out/bin/templates $out/bin/dnote-templates
+    mv $out/bin/watcher $out/bin/dnote-watcher
+  '';
+
+  checkFlags = [
+    "-p 1"
+  ];
+
+  vendorHash = "sha256-4mP5z3ZVlHYhItRjkbXvcOxVm6PuZ6viL2GHqzCH9tA=";
+
+  nativeInstallCheckInputs = [
+    versionCheckHook
+  ];
+  versionCheckProgram = "${placeholder "out"}/bin/dnote-cli";
+  versionCheckProgramArg = [ "version" ];
+  # Fails on darwin:
+  # panic: initializing context: initializing files: creating the dnote dir:
+  #   initializing config dir: creating a directory at /var/empty/.config/dnote: mkdir /var/empty: file exists
+  doInstallCheck = !stdenv.hostPlatform.isDarwin;
+
+  passthru = {
+    updateScript = nix-update-script { };
+  };
+
+  meta = {
+    description = "Simple command line notebook for programmers";
+    homepage = "https://www.getdnote.com/";
+    changelog = "https://github.com/dnote/dnote/blob/cli-v${version}/CHANGELOG.md";
+    platforms = lib.platforms.unix;
+    maintainers = with lib.maintainers; [ bot-wxt1221 ];
+    license = with lib.licenses; [
+      gpl3Only
+      agpl3Only
+    ];
+  };
+}

pkgs/by-name/do/dotenvx/package.nix

···
 
 buildNpmPackage rec {
   pname = "dotenvx";
-  version = "1.28.0";
+  version = "1.32.0";
 
   src = fetchFromGitHub {
     owner = "dotenvx";
     repo = "dotenvx";
     rev = "refs/tags/v${version}";
-    hash = "sha256-MSLWr0d31mMn1Emsyb/1YSL74LzAwH8WI16ya8FN0Gc=";
+    hash = "sha256-GOofZ8nBsncxdmoodA86s0HUuLGw6UxDpTcG6yKiE6k=";
   };
 
-  npmDepsHash = "sha256-pao2U3H28S1YL725vTzRpJ86TitiNKQ6dniwEUjC2nk=";
+  npmDepsHash = "sha256-eRxOptiD23W6S1ey3Ev5AGdWLHE4+O1+IT/AP8tbVQU=";
 
   dontNpmBuild = true;
 

pkgs/by-name/en/envision-unwrapped/package.nix

···
 {
   appstream-glib,
+  applyPatches,
   cairo,
   cargo,
   desktop-file-utils,
···
   rustc,
   stdenv,
   vte-gtk4,
+  versionCheckHook,
   wrapGAppsHook4,
   zlib,
 }:
···
     hash = "sha256-J1zctfFOyu+uLpctTiAe5OWBM7nXanzQocTGs1ToUMA=";
   };
 
+  patches = [
+    ./support-headless-cli.patch
+  ];
+
   strictDeps = true;
 
   cargoDeps = rustPlatform.fetchCargoTarball {
-    inherit (finalAttrs) pname version src;
-    hash = "sha256-kNZucZKzxFHzDAIGE1PFfuBq1rSVkb2Gpk23MEgohME=";
+    inherit (finalAttrs) pname version;
+    # TODO: Use srcOnly instead
+    src = applyPatches {
+      inherit (finalAttrs) src patches;
+    };
+    hash = "sha256-zWaw6K2H67PEmFISDNce5jDUXKV39qu35SO+Ai0DP90=";
   };
 
   nativeBuildInputs = [
···
     pkg-config
     rustPlatform.cargoSetupHook
     rustc
+    versionCheckHook
     wrapGAppsHook4
   ];
 

pkgs/by-name/en/envision-unwrapped/support-headless-cli.patch

···
+diff --git a/Cargo.lock b/Cargo.lock
+index 989abbb..dbfc483 100644
+--- a/Cargo.lock
++++ b/Cargo.lock
+@@ -26,6 +26,55 @@ dependencies = [
+  "memchr",
+ ]
+ 
++[[package]]
++name = "anstream"
++version = "0.6.18"
++source = "registry+https://github.com/rust-lang/crates.io-index"
++checksum = "8acc5369981196006228e28809f761875c0327210a891e941f4c683b3a99529b"
++dependencies = [
++ "anstyle",
++ "anstyle-parse",
++ "anstyle-query",
++ "anstyle-wincon",
++ "colorchoice",
++ "is_terminal_polyfill",
++ "utf8parse",
++]
++
++[[package]]
++name = "anstyle"
++version = "1.0.10"
++source = "registry+https://github.com/rust-lang/crates.io-index"
++checksum = "55cc3b69f167a1ef2e161439aa98aed94e6028e5f9a59be9a6ffb47aef1651f9"
++
++[[package]]
++name = "anstyle-parse"
++version = "0.2.6"
++source = "registry+https://github.com/rust-lang/crates.io-index"
++checksum = "3b2d16507662817a6a20a9ea92df6652ee4f94f914589377d69f3b21bc5798a9"
++dependencies = [
++ "utf8parse",
++]
++
++[[package]]
++name = "anstyle-query"
++version = "1.1.2"
++source = "registry+https://github.com/rust-lang/crates.io-index"
++checksum = "79947af37f4177cfead1110013d678905c37501914fba0efea834c3fe9a8d60c"
++dependencies = [
++ "windows-sys 0.59.0",
++]
++
++[[package]]
++name = "anstyle-wincon"
++version = "3.0.6"
++source = "registry+https://github.com/rust-lang/crates.io-index"
++checksum = "2109dbce0e72be3ec00bed26e6a7479ca384ad226efdd66db8fa2e3a38c83125"
++dependencies = [
++ "anstyle",
++ "windows-sys 0.59.0",
++]
++
+ [[package]]
+ name = "anyhow"
+ version = "1.0.93"
+@@ -368,6 +417,46 @@ dependencies = [
+  "libloading",
+ ]
+ 
++[[package]]
++name = "clap"
++version = "4.5.23"
++source = "registry+https://github.com/rust-lang/crates.io-index"
++checksum = "3135e7ec2ef7b10c6ed8950f0f792ed96ee093fa088608f1c76e569722700c84"
++dependencies = [
++ "clap_builder",
++ "clap_derive",
++]
++
++[[package]]
++name = "clap_builder"
++version = "4.5.23"
++source = "registry+https://github.com/rust-lang/crates.io-index"
++checksum = "30582fc632330df2bd26877bde0c1f4470d57c582bbc070376afcd04d8cb4838"
++dependencies = [
++ "anstream",
++ "anstyle",
++ "clap_lex",
++ "strsim",
++]
++
++[[package]]
++name = "clap_derive"
++version = "4.5.18"
++source = "registry+https://github.com/rust-lang/crates.io-index"
++checksum = "4ac6a0c7b1a9e9a5186361f67dfa1b88213572f427fb9ab038efb2bd8c582dab"
++dependencies = [
++ "heck",
++ "proc-macro2",
++ "quote",
++ "syn",
++]
++
++[[package]]
++name = "clap_lex"
++version = "0.7.4"
++source = "registry+https://github.com/rust-lang/crates.io-index"
++checksum = "f46ad14479a25103f283c0f10005961cf086d8dc42205bb44c46ac563475dca6"
++
+ [[package]]
+ name = "cmake"
+ version = "0.1.52"
+@@ -377,6 +466,12 @@ dependencies = [
+  "cc",
+ ]
+ 
++[[package]]
++name = "colorchoice"
++version = "1.0.3"
++source = "registry+https://github.com/rust-lang/crates.io-index"
++checksum = "5b63caa9aa9397e2d9480a9b13673856c78d8ac123288526c37d7839f2a86990"
++
+ [[package]]
+ name = "concurrent-queue"
+ version = "2.5.0"
+@@ -558,6 +653,7 @@ version = "2.0.1"
+ dependencies = [
+  "anyhow",
+  "ash",
++ "clap",
+  "gettext-rs",
+  "git2",
+  "gtk4",
+@@ -1443,6 +1539,12 @@ version = "2.10.1"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+ checksum = "ddc24109865250148c2e0f3d25d4f0f479571723792d3802153c60922a4fb708"
+ 
++[[package]]
++name = "is_terminal_polyfill"
++version = "1.70.1"
++source = "registry+https://github.com/rust-lang/crates.io-index"
++checksum = "7943c866cc5cd64cbc25b2e01621d07fa8eb2a1a23160ee81ce38704e97b8ecf"
++
+ [[package]]
+ name = "itertools"
+ version = "0.12.1"
+@@ -2637,6 +2739,12 @@ version = "1.1.0"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+ checksum = "a2eb9349b6444b326872e140eb1cf5e7c522154d69e7a0ffb0fb81c06b37543f"
+ 
++[[package]]
++name = "strsim"
++version = "0.11.1"
++source = "registry+https://github.com/rust-lang/crates.io-index"
++checksum = "7da8b5736845d9f2fcb837ea5d9e2628564b3b043a70948a3f0b778838c5fb4f"
++
+ [[package]]
+ name = "subtle"
+ version = "2.6.1"
+@@ -3045,6 +3153,12 @@ version = "1.0.4"
+ source = "registry+https://github.com/rust-lang/crates.io-index"
+ checksum = "b6c140620e7ffbb22c2dee59cafe6084a59b5ffc27a8859a5f0d494b5d52b6be"
+ 
++[[package]]
++name = "utf8parse"
++version = "0.2.2"
++source = "registry+https://github.com/rust-lang/crates.io-index"
++checksum = "06abde3611657adf66d383f00b093d7faecc7fa57071cce2578660c9f1010821"
++
+ [[package]]
+ name = "uuid"
+ version = "1.11.0"
+diff --git a/Cargo.toml b/Cargo.toml
+index 512e892..01e9fb7 100644
+--- a/Cargo.toml
++++ b/Cargo.toml
+@@ -42,3 +42,4 @@ notify-rust = "4.11.3"
+ zbus = { version = "5.1.1", features = ["tokio"] }
+ tracing-subscriber = { version = "0.3.19", features = ["env-filter"] }
+ tracing = "0.1.41"
++clap = { version = "4.5.23", features = ["derive"] }
+diff --git a/meson.build b/meson.build
+index 4d58596..53991dd 100644
+--- a/meson.build
++++ b/meson.build
+@@ -77,6 +77,7 @@ meson.add_dist_script(
+ 
+ global_conf = configuration_data()
+ global_conf.set('APP_ID', application_id)
++global_conf.set('DESCRIPTION', description)
+ global_conf.set('RESOURCES_BASE_PATH', '/' + base_id.replace('.', '/'))
+ global_conf.set('PKGDATADIR', pkgdatadir)
+ global_conf.set('PROFILE', profile)
+diff --git a/src/constants.rs.in b/src/constants.rs.in
+index db00776..886e545 100644
+--- a/src/constants.rs.in
++++ b/src/constants.rs.in
+@@ -3,6 +3,7 @@ use std::path::PathBuf;
+ 
+ pub const APP_NAME: &str = "@PRETTY_NAME@";
+ pub const APP_ID: &str = "@APP_ID@";
++pub const DESCRIPTION: &str = "@DESCRIPTION@";
+ pub const RESOURCES_BASE_PATH: &str = "@RESOURCES_BASE_PATH@";
+ pub const PKG_DATA_DIR: &str = "@PKGDATADIR@";
+ pub const RESOURCES: &str = concat!("@PKGDATADIR@", "/resources.gresource");
+diff --git a/src/main.rs b/src/main.rs
+index 4453911..cd7c212 100644
+--- a/src/main.rs
++++ b/src/main.rs
+@@ -1,4 +1,5 @@
+ use anyhow::Result;
++use clap::Parser;
+ use constants::{resources, APP_ID, APP_NAME, GETTEXT_PACKAGE, LOCALE_DIR, RESOURCES_BASE_PATH};
+ use file_builders::{
+     active_runtime_json::restore_active_runtime_backup,
+@@ -82,6 +83,11 @@ fn main() -> Result<()> {
+     gettextrs::bindtextdomain(GETTEXT_PACKAGE, LOCALE_DIR).expect("Unable to bind the text domain");
+     gettextrs::textdomain(GETTEXT_PACKAGE).expect("Unable to switch to the text domain");
+ 
++    let opts = CmdLineOpts::parse();
++    if let Some(exit_code) = opts.handle_non_activating_opts() {
++        std::process::exit(exit_code);
++    }
++
+     gtk::init()?;
+     glib::set_application_name(APP_NAME);
+ 
+@@ -115,10 +121,6 @@ fn main() -> Result<()> {
+     let sender = BROKER.sender();
+     main_app.connect_command_line(move |this, cmdline| {
+         let opts = CmdLineOpts::from_cmdline(cmdline);
+-        if let Some(exit_code) = opts.handle_non_activating_opts() {
+-            this.quit();
+-            return exit_code;
+-        }
+         this.activate();
+         sender.emit(Msg::HandleCommandLine(opts));
+         0
+diff --git a/src/ui/cmdline_opts.rs b/src/ui/cmdline_opts.rs
+index 48458e0..4b224c6 100644
+--- a/src/ui/cmdline_opts.rs
++++ b/src/ui/cmdline_opts.rs
+@@ -1,4 +1,8 @@
+-use crate::config::Config;
++use crate::{
++    config::Config,
++    constants::{APP_NAME, DESCRIPTION, VERSION},
++};
++use clap::Parser;
+ use gtk::{
+     gio::{
+         prelude::{ApplicationCommandLineExt, ApplicationExt},
+@@ -8,21 +12,47 @@ use gtk::{
+ };
+ use tracing::error;
+ 
+-#[derive(Debug, Clone)]
++#[derive(Parser, Debug, Clone)]
++#[command(name = APP_NAME)]
++#[command(version = VERSION)]
++#[command(about = DESCRIPTION, long_about = None)]
+ pub struct CmdLineOpts {
++    #[arg(short = 'S', long = "start", help = "Start the XR Service right away")]
+     pub start: bool,
++
++    #[arg(
++        short = 'l',
++        long = "list-profiles",
++        help = "List the available profiles"
++    )]
+     pub list_profiles: bool,
++
++    #[arg(
++        short = 'p',
++        long = "profile",
++        help = "Switch to the profile indicated by the UUID"
++    )]
+     pub profile_uuid: Option<String>,
++
++    #[arg(
++        short = 'd',
++        long = "skip-dependency-check",
++        help = "Skip dependency checks when building profiles"
++    )]
+     pub skip_depcheck: bool,
++
++    #[arg(
++        short = 'c',
++        long = "check-deps-for",
++        help = "Prints missing dependencies for given profile id; returns nothing if all dependencies are satisfied"
++    )]
+     pub check_dependencies_for: Option<String>,
+ }
+ 
+ impl CmdLineOpts {
+     const OPT_START: (&'static str, char) = ("start", 'S');
+-    const OPT_LIST_PROFILES: (&'static str, char) = ("list-profiles", 'l');
+     const OPT_PROFILE: (&'static str, char) = ("profile", 'p');
+     const OPT_SKIP_DEPCHECK: (&'static str, char) = ("skip-dependency-check", 'd');
+-    const OPT_CHECK_DEPS_FOR: (&'static str, char) = ("check-deps-for", 'c');
+ 
+     pub fn init(app: &impl IsA<Application>) {
+         app.add_main_option(
+@@ -33,14 +63,6 @@ impl CmdLineOpts {
+             "Start the XR Service right away",
+             None,
+         );
+-        app.add_main_option(
+-            Self::OPT_LIST_PROFILES.0,
+-            glib::Char::try_from(Self::OPT_LIST_PROFILES.1).unwrap(),
+-            glib::OptionFlags::IN_MAIN,
+-            glib::OptionArg::None,
+-            "List the available profiles",
+-            None,
+-        );
+         app.add_main_option(
+             Self::OPT_PROFILE.0,
+             glib::Char::try_from(Self::OPT_PROFILE.1).unwrap(),
+@@ -57,14 +79,6 @@ impl CmdLineOpts {
+             "Skip dependency checks when building profiles",
+             None,
+         );
+-        app.add_main_option(
+-            Self::OPT_CHECK_DEPS_FOR.0,
+-            glib::Char::try_from(Self::OPT_CHECK_DEPS_FOR.1).unwrap(),
+-            glib::OptionFlags::IN_MAIN,
+-            glib::OptionArg::String,
+-            "Prints missing dependencies for given profile id; returns nothing if all dependencies are satisfied",
+-            None,
+-        );
+     }
+ 
+     /// returns an exit code if the application should quit immediately
+@@ -100,14 +114,12 @@ impl CmdLineOpts {
+         let opts = cmdline.options_dict();
+         Self {
+             start: opts.contains(Self::OPT_START.0),
+-            list_profiles: opts.contains(Self::OPT_LIST_PROFILES.0),
++            list_profiles: false,
+             profile_uuid: opts
+                 .lookup::<String>(Self::OPT_PROFILE.0)
+                 .unwrap_or_default(),
+             skip_depcheck: opts.contains(Self::OPT_SKIP_DEPCHECK.0),
+-            check_dependencies_for: opts
+-                .lookup::<String>(Self::OPT_CHECK_DEPS_FOR.0)
+-                .unwrap_or_default(),
++            check_dependencies_for: None,
+         }
+     }
+ }

pkgs/by-name/en/envision/package.nix

···
   lib,
   pkgs,
   buildFHSEnv,
+  envision,
   envision-unwrapped,
+  testers,
 }:
 
 let
···
     (
       (
         # OpenHMD dependencies
-        openhmd.buildInputs ++ openhmd.nativeBuildInputs
+        (
+          pkgs.openhmd.buildInputs
+          ++ pkgs.openhmd.nativeBuildInputs
+          ++ (with pkgs; [
+            meson
+          ])
+        )
       )
       ++ (
         # OpenComposite dependencies
···
           xorg.libXrandr
           xorg.libXrender
           xorg.xorgproto
+          SDL2
+          wayland
 
           # Additional dependencies required for Monado WMR support
           bc
···
           lz4.dev
           tbb
           libxkbcommon
+          boost
+          glew
 
           # Not required for build, but autopatchelf requires them
           glibc
···
         vulkan-loader
         vulkan-headers
         x264
+        glslang
+        libdrm
+        openssl
       ])
     );
 in
···
   runScript = "env libs=${
     lib.makeLibraryPath ((runtimeBuildDeps pkgs) ++ [ pkgs.libgcc.lib ])
   } envision --skip-dependency-check";
+
+  # TODO: When buildFHSEnv gets finalAttrs support, profiles should be moved into the derivation so it can be overrideAttrs'd
+  passthru.tests =
+    let
+      kebabToPascal =
+        kebab:
+        lib.foldl' (
+          acc: part: acc + lib.substring 0 1 (lib.toUpper part) + lib.substring 1 (lib.stringLength part) part
+        ) "" (lib.splitString "-" kebab);
+      pascalToCamel =
+        pascal: lib.substring 0 1 (lib.toLower pascal) + lib.substring 1 (lib.stringLength pascal) pascal;
+      kebabToCamel = x: pascalToCamel (kebabToPascal x);
+      profiles = [
+        "lighthouse-default"
+        "openhmd-default"
+        "simulated-default"
+        "survive-default"
+        "wmr-default"
+        "wivrn-default"
+      ];
+    in
+    {
+      allProfilesPresent = testers.runCommand {
+        name = "envision-all-profiles-present-test";
+        # TODO: Is there a better way to escape ${}?
+        script =
+          ''
+            export ALL_PROFILES=(${lib.concatStringsSep " " (profiles ++ [ "UUID" ])})
+            export ENVISION_PROFILES=($(envision -l | grep -oP '^\w+(?=:)'))
+
+            # This is dark magic
+            missing_from_array=($(grep -vf <(printf "%s\n" "$''
+          + ''{ALL_PROFILES[@]}") <(printf "%s\n" "$''
+          + ''
+            {ENVISION_PROFILES[@]}") || true))
+
+                      if [ $''
+          + ''
+            {#missing_from_array[@]} -gt 0 ]; then
+                        echo "Missing profiles: $''
+          + ''
+            {missing_from_array[@]}"
+                        exit 1
+                      fi
+
+                      touch $out
+          '';
+        nativeBuildInputs = [ envision ];
+      };
+    }
+    // lib.listToAttrs (
+      lib.map (profile: {
+        name = "${kebabToCamel profile}DependenciesMet";
+        value = testers.runCommand {
+          name = "envision-profile-${profile}-dependencies-met-test";
+          script = ''
+            envision -c ${profile}
+            touch $out
+          '';
+          nativeBuildInputs = [ envision ];
+        };
+      }) profiles
+    );
 
   meta = envision-unwrapped.meta // {
     description = "${envision-unwrapped.meta.description} (with build environment)";

pkgs/by-name/ex/exercism/package.nix

···
 {
   lib,
   buildGoModule,
+  installShellFiles,
   fetchFromGitHub,
   nix-update-script,
 }:
···
 
   subPackages = [ "./exercism" ];
 
+  nativeBuildInputs = [ installShellFiles ];
+
   passthru.updateScript = nix-update-script { };
+
+  postInstall = ''
+    installShellCompletion --cmd exercism \
+      --bash shell/exercism_completion.bash \
+      --fish shell/exercism.fish \
+      --zsh shell/exercism_completion.zsh
+  '';
 
   meta = with lib; {
     inherit (src.meta) homepage;

pkgs/by-name/fl/flet-client-flutter/package.nix

···
 { lib
 , fetchFromGitHub
 , pkg-config
-, flutter
+, flutter324
 , gst_all_1
 , libunwind
 , makeWrapper
···
 , libplacebo
 , _experimental-update-script-combinators
 , flet-client-flutter
+, fletTarget ? "linux"
 }:
 
-flutter.buildFlutterApplication rec {
+flutter324.buildFlutterApplication rec {
   pname = "flet-client-flutter";
-  version = "0.24.1";
+  version = "0.25.2";
 
   src = fetchFromGitHub {
     owner = "flet-dev";
     repo = "flet";
-    rev = "v${version}";
-    hash = "sha256-cT1cWxMVpZ0fXoIaJpW96ifQKNe7+PLUXjIFJ3ALdyo=";
+    tag = "v${version}";
+    hash = "sha256-bD44MCRZPXB/xuw2vBCzNbRNSVgdc4GyyWg3F2adxKk=";
   };
 
   sourceRoot = "${src.name}/client";
···
   cmakeFlags = [
     "-DMIMALLOC_LIB=${mimalloc}/lib/mimalloc.o"
   ];
+
+  targetFlutterPlatform = fletTarget;
 
   pubspecLock = lib.importJSON ./pubspec.lock.json;
 

pkgs/by-name/fl/flet-client-flutter/pubspec.lock.json

···
       "source": "hosted",
       "version": "0.7.10"
     },
+    "dio": {
+      "dependency": "transitive",
+      "description": {
+        "name": "dio",
+        "sha256": "5598aa796bbf4699afd5c67c0f5f6e2ed542afc956884b9cd58c306966efc260",
+        "url": "https://pub.dev"
+      },
+      "source": "hosted",
+      "version": "5.7.0"
+    },
+    "dio_web_adapter": {
+      "dependency": "transitive",
+      "description": {
+        "name": "dio_web_adapter",
+        "sha256": "33259a9276d6cea88774a0000cfae0d861003497755969c92faa223108620dc8",
+        "url": "https://pub.dev"
+      },
+      "source": "hosted",
+      "version": "2.0.0"
+    },
     "equatable": {
       "dependency": "transitive",
       "description": {
···
       "dependency": "transitive",
       "description": {
         "name": "file_picker",
-        "sha256": "167bb619cdddaa10ef2907609feb8a79c16dfa479d3afaf960f8e223f754bf12",
+        "sha256": "aac85f20436608e01a6ffd1fdd4e746a7f33c93a2c83752e626bdfaea139b877",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "8.1.2"
+      "version": "8.1.3"
     },
     "fixnum": {
       "dependency": "transitive",
···
       "dependency": "transitive",
       "description": {
         "name": "fl_chart",
-        "sha256": "d0f0d49112f2f4b192481c16d05b6418bd7820e021e265a3c22db98acf7ed7fb",
+        "sha256": "94307bef3a324a0d329d3ab77b2f0c6e5ed739185ffc029ed28c0f9b019ea7ef",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "0.68.0"
+      "version": "0.69.0"
     },
     "flet": {
       "dependency": "direct main",
···
         "relative": true
       },
       "source": "path",
-      "version": "0.24.1"
+      "version": "0.25.1"
+    },
+    "flet_ads": {
+      "dependency": "direct main",
+      "description": {
+        "path": "../packages/flet_ads",
+        "relative": true
+      },
+      "source": "path",
+      "version": "0.25.1"
     },
     "flet_audio": {
       "dependency": "direct main",
···
         "relative": true
       },
       "source": "path",
-      "version": "0.24.1"
+      "version": "0.25.1"
     },
     "flet_audio_recorder": {
       "dependency": "direct main",
···
         "relative": true
       },
       "source": "path",
-      "version": "0.24.1"
+      "version": "0.25.1"
     },
     "flet_flashlight": {
       "dependency": "direct main",
···
         "relative": true
       },
       "source": "path",
-      "version": "0.24.1"
+      "version": "0.25.1"
     },
     "flet_geolocator": {
       "dependency": "direct main",
···
         "relative": true
       },
       "source": "path",
-      "version": "0.24.1"
+      "version": "0.25.1"
     },
     "flet_lottie": {
       "dependency": "direct main",
···
         "relative": true
       },
       "source": "path",
-      "version": "0.24.1"
+      "version": "0.25.1"
     },
     "flet_map": {
       "dependency": "direct main",
···
         "relative": true
       },
       "source": "path",
-      "version": "0.24.1"
+      "version": "0.25.1"
     },
     "flet_permission_handler": {
       "dependency": "direct main",
···
         "relative": true
       },
       "source": "path",
-      "version": "0.24.1"
+      "version": "0.25.1"
     },
     "flet_rive": {
       "dependency": "direct main",
···
         "relative": true
       },
       "source": "path",
-      "version": "0.24.1"
+      "version": "0.25.1"
     },
     "flet_video": {
       "dependency": "direct main",
···
         "relative": true
       },
       "source": "path",
-      "version": "0.24.1"
+      "version": "0.25.1"
     },
     "flet_webview": {
       "dependency": "direct main",
···
         "relative": true
       },
       "source": "path",
-      "version": "0.24.1"
+      "version": "0.25.1"
     },
     "flutter": {
       "dependency": "direct main",
···
       "source": "hosted",
       "version": "7.0.2"
     },
+    "flutter_map_animations": {
+      "dependency": "transitive",
+      "description": {
+        "name": "flutter_map_animations",
+        "sha256": "08233f89919049a3601e785d32e9d1d9e1faac6578190150f1d7495fc1050d36",
+        "url": "https://pub.dev"
+      },
+      "source": "hosted",
+      "version": "0.8.0"
+    },
+    "flutter_map_cancellable_tile_provider": {
+      "dependency": "transitive",
+      "description": {
+        "name": "flutter_map_cancellable_tile_provider",
+        "sha256": "03662220ce0cd784ad2f2a45c36fc379b8b315c74f5c12b5ff4a0515eab1acd1",
+        "url": "https://pub.dev"
+      },
+      "source": "hosted",
+      "version": "3.0.2"
+    },
     "flutter_markdown": {
       "dependency": "transitive",
       "description": {
         "name": "flutter_markdown",
-        "sha256": "2e8a801b1ded5ea001a4529c97b1f213dcb11c6b20668e081cafb23468593514",
+        "sha256": "f0e599ba89c9946c8e051780f0ec99aba4ba15895e0380a7ab68f420046fc44e",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "0.7.3"
+      "version": "0.7.4+1"
     },
     "flutter_plugin_android_lifecycle": {
       "dependency": "transitive",
···
       "dependency": "transitive",
       "description": {
         "name": "flutter_svg",
-        "sha256": "7b4ca6cf3304575fe9c8ec64813c8d02ee41d2afe60bcfe0678bcb5375d596a2",
+        "sha256": "de82e6bf958cec7190fbc1c5298282c851228e35ae2b14e2b103e7f777818c64",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "2.0.10+1"
+      "version": "2.0.13"
     },
     "flutter_test": {
       "dependency": "direct dev",
···
       },
       "source": "hosted",
       "version": "0.2.3"
+    },
+    "google_mobile_ads": {
+      "dependency": "transitive",
+      "description": {
+        "name": "google_mobile_ads",
+        "sha256": "4775006383a27a5d86d46f8fb452bfcb17794fc0a46c732979e49a8eb1c8963f",
+        "url": "https://pub.dev"
+      },
+      "source": "hosted",
+      "version": "5.2.0"
     },
     "graphs": {
       "dependency": "transitive",
···
       "dependency": "transitive",
       "description": {
         "name": "rive",
-        "sha256": "23ffbeb1d45956b2d5ecd4b2c2d3bae2e61bc32b61fc2e9a48021e28feab6b5f",
+        "sha256": "b44b62feb908610ca6c85e05f4573a66118a23867425926cf06152d171236141",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "0.13.0"
+      "version": "0.13.17"
     },
     "rive_common": {
       "dependency": "transitive",
       "description": {
         "name": "rive_common",
-        "sha256": "3fcaa47dd20dde59d197fc71dce174ca0a7ce9083a0fb73cf457e2cd111b0bbc",
+        "sha256": "a3e5786f8d85c89977062b9ceeb3b72a7c28f81e32fb68497744042ce20bee2f",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "0.3.2"
+      "version": "0.4.12"
     },
     "safe_local_storage": {
       "dependency": "transitive",
···
       "dependency": "transitive",
       "description": {
         "name": "screen_retriever",
-        "sha256": "6ee02c8a1158e6dae7ca430da79436e3b1c9563c8cf02f524af997c201ac2b90",
+        "sha256": "570dbc8e4f70bac451e0efc9c9bb19fa2d6799a11e6ef04f946d7886d2e23d0c",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "0.1.9"
+      "version": "0.2.0"
+    },
+    "screen_retriever_linux": {
+      "dependency": "transitive",
+      "description": {
+        "name": "screen_retriever_linux",
+        "sha256": "f7f8120c92ef0784e58491ab664d01efda79a922b025ff286e29aa123ea3dd18",
+        "url": "https://pub.dev"
+      },
+      "source": "hosted",
+      "version": "0.2.0"
+    },
+    "screen_retriever_macos": {
+      "dependency": "transitive",
+      "description": {
+        "name": "screen_retriever_macos",
+        "sha256": "71f956e65c97315dd661d71f828708bd97b6d358e776f1a30d5aa7d22d78a149",
+        "url": "https://pub.dev"
+      },
+      "source": "hosted",
+      "version": "0.2.0"
+    },
+    "screen_retriever_platform_interface": {
+      "dependency": "transitive",
+      "description": {
+        "name": "screen_retriever_platform_interface",
+        "sha256": "ee197f4581ff0d5608587819af40490748e1e39e648d7680ecf95c05197240c0",
+        "url": "https://pub.dev"
+      },
+      "source": "hosted",
+      "version": "0.2.0"
+    },
+    "screen_retriever_windows": {
+      "dependency": "transitive",
+      "description": {
+        "name": "screen_retriever_windows",
+        "sha256": "449ee257f03ca98a57288ee526a301a430a344a161f9202b4fcc38576716fe13",
+        "url": "https://pub.dev"
+      },
+      "source": "hosted",
+      "version": "0.2.0"
     },
     "sensors_plus": {
       "dependency": "transitive",
···
       "dependency": "transitive",
       "description": {
         "name": "shared_preferences",
-        "sha256": "c272f9cabca5a81adc9b0894381e9c1def363e980f960fa903c604c471b22f68",
+        "sha256": "746e5369a43170c25816cc472ee016d3a66bc13fcf430c0bc41ad7b4b2922051",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "2.3.1"
+      "version": "2.3.2"
     },
     "shared_preferences_android": {
       "dependency": "transitive",
···
       "dependency": "transitive",
       "description": {
         "name": "url_launcher",
-        "sha256": "21b704ce5fa560ea9f3b525b43601c678728ba46725bab9b01187b4831377ed3",
+        "sha256": "9d06212b1362abc2f0f0d78e6f09f726608c74e3b9462e8368bb03314aa8d603",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "6.3.0"
+      "version": "6.3.1"
     },
     "url_launcher_android": {
       "dependency": "transitive",
···
       "dependency": "transitive",
       "description": {
         "name": "webview_flutter",
-        "sha256": "6869c8786d179f929144b4a1f86e09ac0eddfe475984951ea6c634774c16b522",
+        "sha256": "889a0a678e7c793c308c68739996227c9661590605e70b1f6cf6b9a6634f7aec",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "4.8.0"
+      "version": "4.10.0"
     },
     "webview_flutter_android": {
-      "dependency": "transitive",
+      "dependency": "direct overridden",
       "description": {
         "name": "webview_flutter_android",
-        "sha256": "c66651fba15f9d7ddd31daec42da8d6bce46c85610a7127e3ebcb39a4395c3c9",
+        "sha256": "74693a212d990b32e0b7055d27db973a18abf31c53942063948cdfaaef9787ba",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "3.16.6"
+      "version": "4.0.0"
     },
     "webview_flutter_platform_interface": {
       "dependency": "transitive",
···
       "source": "hosted",
       "version": "2.10.0"
     },
+    "webview_flutter_web": {
+      "dependency": "transitive",
+      "description": {
+        "name": "webview_flutter_web",
+        "sha256": "cbe1efe45e1be8470fdef7ddb75e2e2998c7ca47b75c09b9354934d20eca146b",
+        "url": "https://pub.dev"
+      },
+      "source": "hosted",
+      "version": "0.2.3+2"
+    },
     "webview_flutter_wkwebview": {
       "dependency": "transitive",
       "description": {
         "name": "webview_flutter_wkwebview",
-        "sha256": "9c62cc46fa4f2d41e10ab81014c1de470a6c6f26051a2de32111b2ee55287feb",
+        "sha256": "1942a12224ab31e9508cf00c0c6347b931b023b8a4f0811e5dec3b06f94f117d",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "3.14.0"
+      "version": "3.15.0"
     },
     "win32": {
       "dependency": "transitive",
···
       "dependency": "transitive",
       "description": {
         "name": "window_manager",
-        "sha256": "8699323b30da4cdbe2aa2e7c9de567a6abd8a97d9a5c850a3c86dcd0b34bbfbf",
+        "sha256": "732896e1416297c63c9e3fb95aea72d0355f61390263982a47fd519169dc5059",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "0.3.9"
+      "version": "0.4.3"
     },
     "window_to_front": {
       "dependency": "transitive",
···
     }
   },
   "sdks": {
-    "dart": ">=3.4.0 <4.0.0",
-    "flutter": ">=3.22.0"
+    "dart": ">=3.5.0 <4.0.0",
+    "flutter": ">=3.24.0"
   }
 }

pkgs/by-name/fr/freeorion/package.nix

···
 , doxygen
 , graphviz
 , makeWrapper
-, boost179
+, boost
 , SDL2
 , python3
 , freetype
···
 
 stdenv.mkDerivation rec {
   pname = "freeorion";
-  version = "0.5.0.1";
+  version = "0.5.0.1-unstable-2024-07-28";
 
   src = fetchFromGitHub {
     owner = "freeorion";
     repo = "freeorion";
-    rev = "v${version}";
-    sha256 = "sha256-VvTq6TcLc5BMvRTjVsZ2HA9ug3WAqFuTHIoFQ/9/zWc=";
+    # Current `release-0.5` commit to pick up Boost and GCC 14 fixes
+    # until another release is cut.
+    rev = "dc3d6a4f01aa78229c419fa17b4e383f73b024e2";
+    hash = "sha256-9yPk77YeYkGMJqrlDYRTUMDKMWpxUXhVCnHhomiUc/A=";
   };
 
   buildInputs = [
-    (boost179.override { enablePython = true; python = python3; })
+    (boost.override { enablePython = true; python = python3; })
     (python3.withPackages (p: with p; [ pycodestyle ]))
     SDL2
     freetype

pkgs/by-name/gd/gdome2/fno-common.patch

···
-On gcc-10 -fno-common is the default which forbids miltiple definitions.
---- a/libgdome/xpath/gdome-xpath-xpnsresolv.h
-+++ b/libgdome/xpath/gdome-xpath-xpnsresolv.h
-@@ -42,6 +42,6 @@ void gdome_xpath_xpnsresolv_ref (GdomeXPathNSResolver *self, GdomeException *exc
- void gdome_xpath_xpnsresolv_unref (GdomeXPathNSResolver *self, GdomeException *exc);
- GdomeDOMString * gdome_xpath_xpnsresolv_lookupNamespaceURI( GdomeXPathNSResolver *self, GdomeDOMString *prefix, GdomeException *exc);
- 
--const GdomeXPathNSResolverVtab gdome_xpath_xpnsresolv_vtab;
-+extern const GdomeXPathNSResolverVtab gdome_xpath_xpnsresolv_vtab;
- 
- #endif /* GDOME_XPNSRESOLV_FILE */

pkgs/by-name/gd/gdome2/package.nix

···
-{
-  lib,
-  stdenv,
-  fetchurl,
-  pkg-config,
-  glib,
-  libxml2,
-  gtk-doc,
-}:
-
-let
-  pname = "gdome2";
-  version = "0.8.1";
-in
-
-stdenv.mkDerivation {
-  name = "${pname}-${version}";
-
-  src = fetchurl {
-    url = "http://gdome2.cs.unibo.it/tarball/${pname}-${version}.tar.gz";
-    sha256 = "0hyms5s3hziajp3qbwdwqjc2xcyhb783damqg8wxjpwfxyi81fzl";
-  };
-
-  hardeningDisable = [ "format" ];
-
-  nativeBuildInputs = [ pkg-config ];
-  buildInputs = [
-    glib
-    libxml2
-    gtk-doc
-  ];
-  propagatedBuildInputs = [
-    glib
-    libxml2
-  ];
-  patches = [
-    ./xml-document.patch
-    ./fno-common.patch
-  ];
-
-  meta = with lib; {
-    homepage = "http://gdome2.cs.unibo.it/";
-    description = "DOM C library developed for the Gnome project";
-    mainProgram = "gdome-config";
-    license = licenses.lgpl21Plus;
-    maintainers = with maintainers; [
-      prikhi
-      roconnor
-    ];
-    platforms = platforms.linux;
-  };
-}

pkgs/by-name/gd/gdome2/xml-document.patch

···
---- a/libgdome/gdomecore/gdome-xml-documentt.c	2003-07-13 14:47:54.000000000 +0400
-+++ b/libgdome/gdomecore/gdome-xml-documentt.c	2013-07-02 14:09:18.304613703 +0400
-@@ -342,7 +342,7 @@
- 	}
- 	xmlNodeDumpOutput (out_buff, NULL, (xmlNode *)is, 0, 0, NULL);
- 	xmlOutputBufferFlush(out_buff);
--	ret = g_strndup (out_buff->buffer->content, out_buff->buffer->use);
-+	ret = g_strndup (xmlBufContent(out_buff), xmlBufUse(out_buff));
- 	(void)xmlOutputBufferClose(out_buff);
-
- 	return gdome_xml_str_mkref_own (ret);

pkgs/by-name/ge/geographiclib/package.nix

···
 
 stdenv.mkDerivation rec {
   pname = "geographiclib";
-  version = "2.4";
+  version = "2.5";
 
   src = fetchFromGitHub {
     owner = "geographiclib";
     repo = "geographiclib";
-    rev = "v${version}";
-    hash = "sha256-1CuB3H4KFFRo8wdFaa9NQLBdT8HxK2AdiVkEhbeYagM=";
+    tag = "v${version}";
+    hash = "sha256-hFheJ6Q1GEfqPVq7t4SHN/n2JniqCQUzwl7GEVG0jgo=";
   };
+
+  outputs = [
+    "dev"
+    "doc"
+    "out"
+  ];
 
   nativeBuildInputs = [
     cmake
···
   ];
 
   cmakeFlags = [
-    "-DBUILD_DOCUMENTATION=ON"
-    "-DCMAKE_INSTALL_LIBDIR=lib"
+    (lib.cmakeBool "BUILD_DOCUMENTATION" true)
+    (lib.cmakeFeature "CMAKE_INSTALL_LIBDIR" "lib")
   ];
 
-  meta = with lib; {
+  meta = {
     description = "C++ geographic library";
     longDescription = ''
       GeographicLib is a small C++ library for:
···
       * gravity (e.g., EGM2008) and geomagnetic field (e.g., WMM2020) calculations
     '';
     homepage = "https://geographiclib.sourceforge.io/";
-    license = licenses.mit;
-    maintainers = with maintainers; [ sikmir ];
-    platforms = platforms.unix;
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ sikmir ];
+    platforms = lib.platforms.unix;
   };
 }

pkgs/by-name/gh/ghostty/darwin.nix

···
+{
+  pname,
+  version,
+  outputs,
+  meta,
+  lib,
+  stdenvNoCC,
+  fetchurl,
+  _7zz,
+  makeWrapper,
+}:
+
+stdenvNoCC.mkDerivation (finalAttrs: {
+  inherit pname version outputs;
+
+  src = fetchurl {
+    url = "https://release.files.ghostty.org/${finalAttrs.version}/Ghostty.dmg";
+    sha256 = "sha256-CR96Kz9BYKFtfVKygiEku51XFJk4FfYqfXACeYQ3JlI=";
+  };
+
+  nativeBuildInputs = [
+    _7zz
+    makeWrapper
+  ];
+
+  sourceRoot = ".";
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p $out/Applications
+    mv Ghostty.app $out/Applications/
+    makeWrapper $out/Applications/Ghostty.app/Contents/MacOS/ghostty $out/bin/ghostty
+
+    runHook postInstall
+  '';
+
+  postFixup =
+    let
+      resources = "$out/Applications/Ghostty.app/Contents/Resources";
+    in
+    ''
+      mkdir -p $man/share
+      ln -s ${resources}/man $man/share/man
+
+      mkdir -p $terminfo/share
+      ln -s ${resources}/terminfo $terminfo/share/terminfo
+
+      mkdir -p $shell_integration
+      for folder in "${resources}/ghostty/shell-integration"/*; do
+        ln -s $folder $shell_integration/$(basename "$folder")
+      done
+
+      mkdir -p $vim
+      for folder in "${resources}/vim/vimfiles"/*; do
+        ln -s $folder $vim/$(basename "$folder")
+      done
+    '';
+
+  meta = meta // {
+    sourceProvenance = [ lib.sourceTypes.binaryNativeCode ];
+  };
+})

pkgs/by-name/gh/ghostty/linux.nix

···
+{
+  pname,
+  version,
+  outputs,
+  meta,
+  lib,
+  stdenv,
+  bzip2,
+  callPackage,
+  fetchFromGitHub,
+  fontconfig,
+  freetype,
+  glib,
+  glslang,
+  harfbuzz,
+  libGL,
+  libX11,
+  libadwaita,
+  ncurses,
+  nixosTests,
+  oniguruma,
+  pandoc,
+  pkg-config,
+  removeReferencesTo,
+  versionCheckHook,
+  wrapGAppsHook4,
+  zig_0_13,
+  # Usually you would override `zig.hook` with this, but we do that internally
+  # since upstream recommends a non-default level
+  # https://github.com/ghostty-org/ghostty/blob/4b4d4062dfed7b37424c7210d1230242c709e990/PACKAGING.md#build-options
+  optimizeLevel ? "ReleaseFast",
+  # https://github.com/ghostty-org/ghostty/blob/4b4d4062dfed7b37424c7210d1230242c709e990/build.zig#L106
+  withAdwaita ? true,
+}:
+
+let
+  zig_hook = zig_0_13.hook.overrideAttrs {
+    zig_default_flags = "-Dcpu=baseline -Doptimize=${optimizeLevel} --color off";
+  };
+
+  # https://github.com/ghostty-org/ghostty/blob/4b4d4062dfed7b37424c7210d1230242c709e990/src/apprt.zig#L72-L76
+  appRuntime = if stdenv.hostPlatform.isLinux then "gtk" else "none";
+  # https://github.com/ghostty-org/ghostty/blob/4b4d4062dfed7b37424c7210d1230242c709e990/src/font/main.zig#L94
+  fontBackend = if stdenv.hostPlatform.isDarwin then "coretext" else "fontconfig_freetype";
+  # https://github.com/ghostty-org/ghostty/blob/4b4d4062dfed7b37424c7210d1230242c709e990/src/renderer.zig#L51-L52
+  renderer = if stdenv.hostPlatform.isDarwin then "metal" else "opengl";
+in
+
+stdenv.mkDerivation (finalAttrs: {
+  inherit
+    pname
+    version
+    outputs
+    meta
+    ;
+
+  src = fetchFromGitHub {
+    owner = "ghostty-org";
+    repo = "ghostty";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-AHI1Z4mfgXkNwQA8xYq4tS0/BARbHL7gQUT41vCxQTM=";
+  };
+
+  # Avoid using runtime hacks to help find X11
+  postPatch = lib.optionalString (appRuntime == "gtk") ''
+    substituteInPlace src/apprt/gtk/x11.zig \
+      --replace-warn 'std.DynLib.open("libX11.so");' 'std.DynLib.open("${lib.getLib libX11}/lib/libX11.so");'
+  '';
+
+  deps = callPackage ./deps.nix {
+    name = "${finalAttrs.pname}-cache-${finalAttrs.version}";
+  };
+
+  strictDeps = true;
+
+  nativeBuildInputs =
+    [
+      ncurses
+      pandoc
+      pkg-config
+      removeReferencesTo
+      zig_hook
+    ]
+    ++ lib.optionals (appRuntime == "gtk") [
+      glib # Required for `glib-compile-schemas`
+      wrapGAppsHook4
+    ];
+
+  buildInputs =
+    [
+      glslang
+      oniguruma
+    ]
+    ++ lib.optional (appRuntime == "gtk" && withAdwaita) libadwaita
+    ++ lib.optional (appRuntime == "gtk") libX11
+    ++ lib.optional (renderer == "opengl") libGL
+    ++ lib.optionals (fontBackend == "fontconfig_freetype") [
+      bzip2
+      fontconfig
+      freetype
+      harfbuzz
+    ];
+
+  zigBuildFlags =
+    [
+      "--system"
+      "${finalAttrs.deps}"
+      "-Dversion-string=${finalAttrs.version}"
+
+      "-Dapp-runtime=${appRuntime}"
+      "-Dfont-backend=${fontBackend}"
+      "-Dgtk-adwaita=${lib.boolToString withAdwaita}"
+      "-Drenderer=${renderer}"
+    ]
+    ++ lib.mapAttrsToList (name: package: "-fsys=${name} --search-prefix ${lib.getLib package}") {
+      inherit glslang;
+    };
+
+  zigCheckFlags = finalAttrs.zigBuildFlags;
+
+  # Unit tests currently fail inside the sandbox
+  doCheck = false;
+
+  /**
+    Ghostty really likes all of it's resources to be in the same directory, so link them back after we split them
+
+    - https://github.com/ghostty-org/ghostty/blob/4b4d4062dfed7b37424c7210d1230242c709e990/src/os/resourcesdir.zig#L11-L52
+    - https://github.com/ghostty-org/ghostty/blob/4b4d4062dfed7b37424c7210d1230242c709e990/src/termio/Exec.zig#L745-L750
+    - https://github.com/ghostty-org/ghostty/blob/4b4d4062dfed7b37424c7210d1230242c709e990/src/termio/Exec.zig#L818-L834
+
+    terminfo and shell integration should also be installable on remote machines
+
+    ```nix
+    { pkgs, ... }: {
+      environment.systemPackages = [ pkgs.ghostty.terminfo ];
+
+      programs.bash = {
+        interactiveShellInit = ''
+          if [[ "$TERM" == "xterm-ghostty" ]]; then
+            builtin source ${pkgs.ghostty.shell_integration}/bash/ghostty.bash
+          fi
+        '';
+      };
+    }
+    ```
+  */
+  postFixup = ''
+    ln -s $man/share/man $out/share/man
+
+    moveToOutput share/terminfo $terminfo
+    ln -s $terminfo/share/terminfo $out/share/terminfo
+
+    mv $out/share/ghostty/shell-integration $shell_integration
+    ln -s $shell_integration $out/share/ghostty/shell-integration
+
+    mv $out/share/vim/vimfiles $vim
+    rmdir $out/share/vim
+    ln -s $vim $out/share/vim-plugins
+
+
+    remove-references-to -t ${finalAttrs.deps} $out/bin/ghostty
+  '';
+
+  nativeInstallCheckInputs = [
+    versionCheckHook
+  ];
+
+  doInstallCheck = true;
+
+  versionCheckProgramArg = [ "--version" ];
+
+  passthru = {
+    tests = lib.optionalAttrs stdenv.hostPlatform.isLinux {
+      inherit (nixosTests) allTerminfo;
+      nixos = nixosTests.terminal-emulators.ghostty;
+    };
+  };
+
+})

pkgs/by-name/gh/ghostty/package.nix

···
 {
-  lib,
-  stdenv,
-  bzip2,
+  stdenvNoCC,
   callPackage,
-  fetchFromGitHub,
-  fontconfig,
-  freetype,
-  glib,
-  glslang,
-  harfbuzz,
-  libGL,
-  libX11,
-  libadwaita,
-  ncurses,
-  nixosTests,
-  oniguruma,
-  pandoc,
-  pkg-config,
-  removeReferencesTo,
-  versionCheckHook,
-  wrapGAppsHook4,
-  zig_0_13,
-  # Usually you would override `zig.hook` with this, but we do that internally
-  # since upstream recommends a non-default level
-  # https://github.com/ghostty-org/ghostty/blob/4b4d4062dfed7b37424c7210d1230242c709e990/PACKAGING.md#build-options
-  optimizeLevel ? "ReleaseFast",
-  # https://github.com/ghostty-org/ghostty/blob/4b4d4062dfed7b37424c7210d1230242c709e990/build.zig#L106
-  withAdwaita ? true,
+  lib,
 }:
 
 let
-  zig_hook = zig_0_13.hook.overrideAttrs {
-    zig_default_flags = "-Dcpu=baseline -Doptimize=${optimizeLevel} --color off";
-  };
-
-  # https://github.com/ghostty-org/ghostty/blob/4b4d4062dfed7b37424c7210d1230242c709e990/src/apprt.zig#L72-L76
-  appRuntime = if stdenv.hostPlatform.isLinux then "gtk" else "none";
-  # https://github.com/ghostty-org/ghostty/blob/4b4d4062dfed7b37424c7210d1230242c709e990/src/font/main.zig#L94
-  fontBackend = if stdenv.hostPlatform.isDarwin then "coretext" else "fontconfig_freetype";
-  # https://github.com/ghostty-org/ghostty/blob/4b4d4062dfed7b37424c7210d1230242c709e990/src/renderer.zig#L51-L52
-  renderer = if stdenv.hostPlatform.isDarwin then "metal" else "opengl";
-in
-
-stdenv.mkDerivation (finalAttrs: {
   pname = "ghostty";
   version = "1.0.0";
-
   outputs = [
     "out"
     "man"
···
     "terminfo"
     "vim"
   ];
-
-  src = fetchFromGitHub {
-    owner = "ghostty-org";
-    repo = "ghostty";
-    tag = "v${finalAttrs.version}";
-    hash = "sha256-AHI1Z4mfgXkNwQA8xYq4tS0/BARbHL7gQUT41vCxQTM=";
-  };
-
-  # Avoid using runtime hacks to help find X11
-  postPatch = lib.optionalString (appRuntime == "gtk") ''
-    substituteInPlace src/apprt/gtk/x11.zig \
-      --replace-warn 'std.DynLib.open("libX11.so");' 'std.DynLib.open("${lib.getLib libX11}/lib/libX11.so");'
-  '';
-
-  deps = callPackage ./deps.nix {
-    name = "${finalAttrs.pname}-cache-${finalAttrs.version}";
-  };
-
-  strictDeps = true;
-
-  nativeBuildInputs =
-    [
-      ncurses
-      pandoc
-      pkg-config
-      removeReferencesTo
-      zig_hook
-    ]
-    ++ lib.optionals (appRuntime == "gtk") [
-      glib # Required for `glib-compile-schemas`
-      wrapGAppsHook4
-    ];
-
-  buildInputs =
-    [
-      glslang
-      oniguruma
-    ]
-    ++ lib.optional (appRuntime == "gtk" && withAdwaita) libadwaita
-    ++ lib.optional (appRuntime == "gtk") libX11
-    ++ lib.optional (renderer == "opengl") libGL
-    ++ lib.optionals (fontBackend == "fontconfig_freetype") [
-      bzip2
-      fontconfig
-      freetype
-      harfbuzz
-    ];
-
-  zigBuildFlags =
-    [
-      "--system"
-      "${finalAttrs.deps}"
-      "-Dversion-string=${finalAttrs.version}"
-
-      "-Dapp-runtime=${appRuntime}"
-      "-Dfont-backend=${fontBackend}"
-      "-Dgtk-adwaita=${lib.boolToString withAdwaita}"
-      "-Drenderer=${renderer}"
-    ]
-    ++ lib.mapAttrsToList (name: package: "-fsys=${name} --search-prefix ${lib.getLib package}") {
-      inherit glslang;
-    };
-
-  zigCheckFlags = finalAttrs.zigBuildFlags;
-
-  # Unit tests currently fail inside the sandbox
-  doCheck = false;
-
-  /**
-    Ghostty really likes all of it's resources to be in the same directory, so link them back after we split them
-
-    - https://github.com/ghostty-org/ghostty/blob/4b4d4062dfed7b37424c7210d1230242c709e990/src/os/resourcesdir.zig#L11-L52
-    - https://github.com/ghostty-org/ghostty/blob/4b4d4062dfed7b37424c7210d1230242c709e990/src/termio/Exec.zig#L745-L750
-    - https://github.com/ghostty-org/ghostty/blob/4b4d4062dfed7b37424c7210d1230242c709e990/src/termio/Exec.zig#L818-L834
-
-    terminfo and shell integration should also be installable on remote machines
-
-    ```nix
-    { pkgs, ... }: {
-      environment.systemPackages = [ pkgs.ghostty.terminfo ];
-
-      programs.bash = {
-        interactiveShellInit = ''
-          if [[ "$TERM" == "xterm-ghostty" ]]; then
-            builtin source ${pkgs.ghostty.shell_integration}/bash/ghostty.bash
-          fi
-        '';
-      };
-    }
-    ```
-  */
-  postFixup = ''
-    ln -s $man/share/man $out/share/man
-
-    moveToOutput share/terminfo $terminfo
-    ln -s $terminfo/share/terminfo $out/share/terminfo
-
-    mv $out/share/ghostty/shell-integration $shell_integration
-    ln -s $shell_integration $out/share/ghostty/shell-integration
-
-    mv $out/share/vim/vimfiles $vim
-    rmdir $out/share/vim
-    ln -s $vim $out/share/vim-plugins
-
-
-    remove-references-to -t ${finalAttrs.deps} $out/bin/ghostty
-  '';
-
-  nativeInstallCheckInputs = [
-    versionCheckHook
-  ];
-
-  doInstallCheck = true;
-
-  versionCheckProgramArg = [ "--version" ];
-
-  passthru = {
-    tests = lib.optionalAttrs stdenv.hostPlatform.isLinux {
-      inherit (nixosTests) allTerminfo;
-      nixos = nixosTests.terminal-emulators.ghostty;
-    };
-  };
-
   meta = {
     description = "Fast, native, feature-rich terminal emulator pushing modern features";
     longDescription = ''
···
       jcollie
       pluiedev
       getchoo
+      DimitarNestorov
     ];
     outputsToInstall = [
       "out"
···
       "terminfo"
     ];
     platforms = lib.platforms.linux ++ lib.platforms.darwin;
-    # Issues finding the SDK in the sandbox
-    broken = stdenv.hostPlatform.isDarwin;
   };
-})
+in
+
+if stdenvNoCC.hostPlatform.isDarwin then
+  callPackage ./darwin.nix {
+    inherit
+      pname
+      version
+      outputs
+      meta
+      ;
+  }
+else
+  callPackage ./linux.nix {
+    inherit
+      pname
+      version
+      outputs
+      meta
+      ;
+  }

pkgs/by-name/gn/gnome-pomodoro-watcher/package.nix

···
+{
+  lib,
+  rustPlatform,
+  fetchFromGitHub,
+}:
+
+rustPlatform.buildRustPackage {
+  pname = "gnome-pomodoro-watcher";
+  version = "0-unstable-2023-12-20";
+
+  src = fetchFromGitHub {
+    owner = "sei40kr";
+    repo = "gnome-pomodoro-watcher";
+    rev = "7c1443d470c9a6bfc07fd9d26a138f136de96515";
+    hash = "sha256-VQjjLK2gnxbf7CzRjNrS/562fBGVAFMTxj6F71hOXrU=";
+  };
+
+  cargoHash = "sha256-P7hrSTb8XE/rCAGflbZwrqpQGxWnXFREqXSmZmIMAGU=";
+
+  meta = with lib; {
+    description = "Helper tool to watch GNOME Pomodoro timer";
+    homepage = "https://github.com/sei40kr/gnome-pomodoro-watcher";
+    license = licenses.mit;
+    maintainers = with maintainers; [ sei40kr ];
+    mainProgram = "gnome-pomodoro-watcher";
+  };
+}

pkgs/by-name/go/gollama/package.nix

···
 
 buildGoModule rec {
   pname = "gollama";
-  version = "1.28.0";
+  version = "1.28.4";
 
   src = fetchFromGitHub {
     owner = "sammcj";
     repo = "gollama";
     rev = "refs/tags/v${version}";
-    hash = "sha256-nQrd0gpl6fjJ5wzDvDGpI01h7jeGEyB6uuObgoz7Uo8=";
+    hash = "sha256-n3GbEPh69mrr5qZ2TVzKv06lkR+zuhH9TtjmusXDHQg=";
   };
 
-  vendorHash = "sha256-vIqDYtdz799qm3vp8w293OLx1IoLNr5YjyNqYcvOkI0=";
+  vendorHash = "sha256-Y5yg54em+vqoWXxS3JVQVPEM+fLXgoblmY+48WpxSCQ=";
 
   doCheck = false;
 

pkgs/by-name/gq/gqlgenc/package.nix

···
 
 buildGoModule rec {
   pname = "gqlgenc";
-  version = "0.27.4";
+  version = "0.30.2";
 
   src = fetchFromGitHub {
     owner = "yamashou";
     repo = "gqlgenc";
     rev = "v${version}";
-    sha256 = "sha256-NqFF3ppdg3nUZJ3ij0Zx3uKXz4Xhr/JEnkAzYNbPqOE=";
+    sha256 = "sha256-F6EuOqB9ccat9pytJn8glBn5X9eEsEUN2+8+FqVvEbY=";
   };
 
   excludedPackages = [ "example" ];
 
-  vendorHash = "sha256-ln26CHD0q+iPyAx5DalOGyCtVB1QR+7ls1ZjNK8APBU=";
+  vendorHash = "sha256-h3ePmfRkGqVXdtjX2cU5y2HnX+VkmTWNwrEkhLAmrlU=";
 
   meta = with lib; {
     description = "Go tool for building GraphQL client with gqlgen";

pkgs/by-name/ha/hardinfo2/package.nix

···
     ];
     maintainers = with lib.maintainers; [ sigmanificient ];
     platforms = lib.platforms.linux;
-    mainProgram = "hardinfo";
+    mainProgram = "hardinfo2";
   };
 })

pkgs/by-name/ho/houdini/runtime-build.nix

···
-{ stdenv, bc, version, src, eulaDate }:
-stdenv.mkDerivation {
+{ stdenv, bc, version, src, eulaDate, outputHash ? null }:
+stdenv.mkDerivation ({
   inherit version src;
   pname = "houdini-runtime";
 
···
                       --accept-EULA ${eulaDate} \
                       $out
     echo "licensingMode = localValidator" >> $out/houdini/Licensing.opt  # does not seem to do anything any more. not sure, official docs do not say anything about it
+    sed -i 's@'"$out"'@$HFS@g' $out/packages/package_dirs.json  # this seem to be internal houdini tools unavailable to users anyway, but they break fixed-derivation
   '';
 
   dontFixup = true;
-}
+} // (if isNull outputHash then {} else {
+  inherit outputHash;
+  outputHashAlgo = "sha256";
+  outputHashMode = "recursive";
+}))

pkgs/by-name/ho/houdini/runtime.nix

···
 { requireFile, callPackage }:
 
 callPackage ./runtime-build.nix rec {
-  version = "20.5.370";
+  version = "20.5.445";
   eulaDate = "2021-10-13";
   src = requireFile {
     name = "houdini-${version}-linux_x86_64_gcc11.2.tar.gz";
-    hash = "sha256-QwPCU7E5yoJvWsiRUMBSAhEJYckbFTrQa1S4fto8dy0=";
+    hash = "sha256-rk8HKX1Aq7ACbAWKFxfjSzfa3PA/iXQZsYOkr/kSbkM=";
     url = "https://www.sidefx.com/download/daily-builds/?production=true";
   };
+  outputHash = "sha256-bdL+Ha5LWkty4r+rgPAKr50pxV+j7CLspD4KOsSxyMo=";
 }

pkgs/by-name/hy/hyprnome/package.nix

···
 
   cargoHash = "sha256-oxIZTp5ZJRUjXLpMw2nOnPHYHhHN03HWFRhBZ82Ac10=";
 
+  # Upstream has 'missing_docs = "deny"', which trips up test builds for 0.3.1 release.
+  # Let's just treat lints as warnings.
+  env.RUSTFLAGS = "--cap-lints warn";
+
   nativeBuildInputs = [ installShellFiles ];
 
   postInstall = ''

pkgs/by-name/im/immich/package.nix

···
   fetchFromGitHub,
   fetchpatch2,
   python3,
-  nodejs,
+  nodejs_20,
   node-gyp,
   runCommand,
   nixosTests,
···
   vips,
 }:
 let
+  nodejs = nodejs_20;
   buildNpmPackage' = buildNpmPackage.override { inherit nodejs; };
   sources = lib.importJSON ./sources.json;
   inherit (sources) version;
···
     mkdir node_modules
     ln -s ${node-addon-api} node_modules/node-addon-api
 
-    ${lib.getExe nodejs} install/check
+    node install/check
 
     rm -r node_modules
 

pkgs/by-name/ip/ipxe/package.nix

···
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "ipxe";
-  version = "1.21.1-unstable-2024-12-03";
+  version = "1.21.1-unstable-2024-12-18";
 
   nativeBuildInputs = [
     gnu-efi
···
   src = fetchFromGitHub {
     owner = "ipxe";
     repo = "ipxe";
-    rev = "24db39fb2983ca83ab5c6ee37cb57a4f7f6f94e6";
-    hash = "sha256-RuJRtrjM2gyPBVAC9FeVDu+CksXY8XiNstLb1/QiUCw=";
+    rev = "83ba34076ad4ca79be81a71f25303b340c60e7b8";
+    hash = "sha256-nzAU9ZaUa+D6tBv2mq8mXRGCY7dDeSURPVUjJ1Jy7Vg=";
   };
 
   # Calling syslinux on a FAT image isn't going to work on Aarch64.

pkgs/by-name/jc/jcli/package.nix

···
 
 buildGoModule rec {
   pname = "jcli";
-  version = "0.0.44";
+  version = "0.0.46";
 
   src = fetchFromGitHub {
     owner = "jenkins-zh";
     repo = "jenkins-cli";
     tag = "v${version}";
-    hash = "sha256-lsYLUgjpHcURiMTA4we9g+a6dFimOupAYMw0TcmABk4=";
+    hash = "sha256-l0qpyrggDJSzaJMbhgJYVK2Y3A/R+xS0Qoy3afA/eGo=";
   };
 
-  vendorHash = "sha256-f2f/Qi6aav7LPpO9ERYkejygz0XiPQ8YrKLB63EpaoY=";
+  vendorHash = "sha256-0x0Cl6cqullGIvtQTlHTGnWz9dBCT7aMEIRSB/Cuy8k=";
 
   ldflags = [
     "-s"
···
     + lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
       installShellCompletion --cmd jcli \
         --bash <($out/bin/jcli completion --type bash) \
+        --fish <($out/bin/jcli completion --type fish) \
         --zsh <($out/bin/jcli completion --type zsh)
     '';
 

pkgs/by-name/jf/jfrog-cli/package.nix

···
 
 buildGoModule rec {
   pname = "jfrog-cli";
-  version = "2.72.2";
+  version = "2.72.5";
 
   src = fetchFromGitHub {
     owner = "jfrog";
     repo = "jfrog-cli";
     rev = "refs/tags/v${version}";
-    hash = "sha256-Vu57V6OiMZjR+g0afeLEkQcwGA0e8PZzYAJjR3/wNoI=";
+    hash = "sha256-owE3mWzVogESko4SeysobC3VmmH37ikk7llJv65ZTfU=";
   };
 
   proxyVendor = true;
-  vendorHash = "sha256-BSLBXHcowF2iVS/fMR3UIIdpbuLDgsPXYV4WK/oeHB4=";
+  vendorHash = "sha256-cxuNlIXD4LIBWxbTdC/ygiF/ti4eHYQBR6kZRhhgJtY=";
 
   postPatch = ''
     # Patch out broken test cleanup.

pkgs/by-name/ka/kakasi/package.nix

···
   lib,
   stdenv,
   fetchurl,
+  fetchpatch,
+  autoreconfHook,
   libiconv,
 }:
 
···
   pname = "kakasi";
   version = "2.3.6";
 
+  nativeBuildInputs = [ autoreconfHook ];
   buildInputs = lib.optionals stdenv.hostPlatform.isDarwin [ libiconv ];
 
   meta = with lib; {
···
     sha256 = "1qry3xqb83pjgxp3my8b1sy77z4f0893h73ldrvdaky70cdppr9f";
   };
 
+  patches = [
+    (fetchpatch {
+      url = "https://src.fedoraproject.org/rpms/kakasi/raw/4756771/f/kakasi-configure-c99.patch";
+      hash = "sha256-XPIp/+AR6K84lv606aRHPQwia/1K3rt/7KSo0V0ZQ5o=";
+    })
+  ];
+
   postPatch = ''
     for a in tests/kakasi-* ; do
       substituteInPlace $a \
-        --replace "/bin/echo" echo
+        --replace-quiet "/bin/echo" echo
     done
   '';
 

pkgs/by-name/kx/kx-aspe-cli/package.nix

···
   cargoHash = "sha256-ZZwb5WHKFMAP5yPT1DDi+nWy7rjM/UI6ahagNqTDDMM=";
 
   meta = {
-    homepage = "https://github.com/rustic-rs/rustic";
+    homepage = "https://codeberg.org/keyoxide/kx-aspe-cli";
     changelog = "https://codeberg.org/keyoxide/kx-aspe-cli/src/commit/${src.rev}/CHANGELOG.md";
     description = "Keyoxide profile generator CLI using ASPE";
     mainProgram = "kx-aspe";

pkgs/by-name/li/libeb/package.nix

···
   fetchurl,
   perl,
   zlib,
+  fetchpatch,
 }:
 stdenv.mkDerivation rec {
   pname = "libeb";
···
     url = "ftp://ftp.sra.co.jp/pub/misc/eb/eb-${version}.tar.bz2";
     sha256 = "0psbdzirazfnn02hp3gsx7xxss9f1brv4ywp6a15ihvggjki1rxb";
   };
+
+  patches = [
+    (fetchpatch {
+      name = "gcc-14.patch";
+      url = "https://salsa.debian.org/debian/eb/-/raw/50c84ee2d190083fc88a14e62ef9fef779d088de/debian/patches/0002-gcc14-fix.patch";
+      hash = "sha256-0hht7ojj4MLNfFbemDR2hD1PbSmBxrC2JtDl2WJINlM=";
+    })
+  ];
 
   nativeBuildInputs = [ perl ];
   buildInputs = [ zlib ];

pkgs/by-name/li/libsearpc/package.nix

···
 }:
 
 stdenv.mkDerivation rec {
-  version = "3.3-20230626";
-  commit = "783141fb694f3bd1f8bd8a783670dd25a53b9fc1";
+  version = "3.3-20241031";
+  commit = "d00c062d76d86b76c8c179bfb4babc9e2200b3f1";
   pname = "libsearpc";
 
   src = fetchFromGitHub {
     owner = "haiwen";
     repo = "libsearpc";
     rev = commit;
-    sha256 = "sha256-nYYp3EyA8nufhbWaw4Lv/c4utGYaxC+PoFyamUEVJx4=";
+    sha256 = "sha256-Ze1dOEFUIA16OlqkyDjQw6c6JcDECjYsdCm5um0kG/c=";
   };
 
   nativeBuildInputs = [
···
     jansson
   ];
 
-  meta = with lib; {
+  meta = {
     homepage = "https://github.com/haiwen/libsearpc";
     description = "Simple and easy-to-use C language RPC framework based on GObject System";
     mainProgram = "searpc-codegen.py";
-    license = licenses.lgpl3;
-    platforms = platforms.linux;
-    maintainers = with maintainers; [ greizgh ];
+    license = lib.licenses.lgpl3;
+    platforms = lib.platforms.linux;
+    maintainers = with lib.maintainers; [ greizgh ];
   };
 }

pkgs/by-name/li/libsignal-ffi/Cargo.lock

···
 
 [[package]]
 name = "boring"
-version = "4.9.0"
-source = "git+https://github.com/signalapp/boring?tag=signal-v4.9.0b#3d4180b232d332a86ee3b41d1a622b0f1c1c6037"
+version = "4.13.0"
+source = "git+https://github.com/signalapp/boring?tag=signal-v4.13.0#1af143f50937bce6a9a9c7405ec824a9153c8ba0"
 dependencies = [
  "bitflags",
  "boring-sys",
  "foreign-types",
  "libc",
  "once_cell",
+ "openssl-macros",
 ]
 
 [[package]]
 name = "boring-sys"
-version = "4.9.0"
-source = "git+https://github.com/signalapp/boring?tag=signal-v4.9.0b#3d4180b232d332a86ee3b41d1a622b0f1c1c6037"
+version = "4.13.0"
+source = "git+https://github.com/signalapp/boring?tag=signal-v4.13.0#1af143f50937bce6a9a9c7405ec824a9153c8ba0"
 dependencies = [
  "autocfg",
  "bindgen",
···
 checksum = "324a1be68054ef05ad64b861cc9eaf1d623d2d8cb25b4bf2cb9cdd902b4bf253"
 dependencies = [
  "crc32fast",
+ "libz-sys",
  "miniz_oxide",
 ]
 
···
 ]
 
 [[package]]
+name = "intmap"
+version = "2.0.0"
+source = "git+https://github.com/JesperAxelsson/rust-intmap?rev=e7edd6e8fb452506ca2570e91f62b14dc29a950c#e7edd6e8fb452506ca2570e91f62b14dc29a950c"
+
+[[package]]
 name = "ipnet"
 version = "2.10.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
···
 
 [[package]]
 name = "libsignal-ffi"
-version = "0.62.0"
+version = "0.64.1"
 dependencies = [
  "cpufeatures",
  "futures-util",
···
 
 [[package]]
 name = "libsignal-jni"
-version = "0.62.0"
+version = "0.64.1"
 dependencies = [
  "cfg-if",
  "cpufeatures",
+ "flate2",
  "jni 0.19.0",
  "jni 0.21.1",
  "libsignal-bridge",
···
 
 [[package]]
 name = "libsignal-jni-testing"
-version = "0.62.0"
+version = "0.64.1"
 dependencies = [
  "jni 0.21.1",
  "libsignal-bridge-testing",
···
  "cbc",
  "clap",
  "clap-stdin",
+ "criterion",
  "derive-where",
  "dir-test",
  "displaydoc",
  "env_logger",
+ "flate2",
  "futures",
  "hex",
  "hex-literal",
  "hkdf",
  "hmac",
+ "intmap",
  "itertools 0.13.0",
  "json5",
  "libsignal-account-keys",
···
  "protobuf",
  "protobuf-codegen",
  "protobuf-json-mapping",
+ "rand",
  "serde",
  "serde_json",
  "sha2",
···
  "thiserror",
  "usernames",
  "uuid",
+ "visibility",
  "zkcredential",
  "zkgroup",
 ]
···
  "tokio-util",
  "tungstenite 0.23.0",
  "url",
+ "visibility",
  "warp",
 ]
 
 [[package]]
 name = "libsignal-node"
-version = "0.62.0"
+version = "0.64.1"
 dependencies = [
  "cmake",
  "futures",
···
  "subtle",
  "test-case",
  "zerocopy",
+]
+
+[[package]]
+name = "libz-sys"
+version = "1.1.20"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d2d16453e800a8cf6dd2fc3eb4bc99b786a9b90c663b8559a5b1a041bf89e472"
+dependencies = [
+ "cc",
+ "pkg-config",
+ "vcpkg",
 ]
 
 [[package]]
···
 checksum = "c08d65885ee38876c4f86fa503fb49d7b507c2b62552df7c70b2fce627e06381"
 
 [[package]]
+name = "openssl-macros"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a948666b637a0f465e8564c73e89d4dde00d72d4d473cc972f390fc3dcee7d9c"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.77",
+]
+
+[[package]]
 name = "openssl-probe"
 version = "0.1.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
···
  "der",
  "spki",
 ]
+
+[[package]]
+name = "pkg-config"
+version = "0.3.31"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "953ec861398dccce10c670dfeaf3ec4911ca479e9c02154b3a215178c5f566f2"
 
 [[package]]
 name = "plotters"
···
 
 [[package]]
 name = "tokio-boring"
-version = "4.9.0"
-source = "git+https://github.com/signalapp/boring?tag=signal-v4.9.0b#3d4180b232d332a86ee3b41d1a622b0f1c1c6037"
+version = "4.13.0"
+source = "git+https://github.com/signalapp/boring?tag=signal-v4.13.0#1af143f50937bce6a9a9c7405ec824a9153c8ba0"
 dependencies = [
  "boring",
  "boring-sys",
···
 checksum = "830b7e5d4d90034032940e4ace0d9a9a057e7a45cd94e6c007832e39edb82f6d"
 
 [[package]]
+name = "vcpkg"
+version = "0.2.15"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "accd4ea62f7bb7a82fe23066fb0957d48ef677f6eeb8215f372f52e48bb32426"
+
+[[package]]
 name = "version_check"
 version = "0.9.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "0b928f33d975fc6ad9f86c8f283853ad26bdd5b10b7f1542aa2fa15e2289105a"
+
+[[package]]
+name = "visibility"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d674d135b4a8c1d7e813e2f8d1c9a58308aee4a680323066025e53132218bd91"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.77",
+]
 
 [[package]]
 name = "wait-timeout"

pkgs/by-name/li/libsignal-ffi/package.nix

···
   pname = "libsignal-ffi";
   # must match the version used in mautrix-signal
   # see https://github.com/mautrix/signal/issues/401
-  version = "0.62.0";
+  version = "0.64.1";
 
   src = fetchFromGitHub {
     fetchSubmodules = true;
     owner = "signalapp";
     repo = "libsignal";
     rev = "v${version}";
-    hash = "sha256-+tY00a5NJflVkSVESFhaP1B5qqZs72AwZM9pCIrAQRk=";
+    hash = "sha256-36z8Tgf3w0ZDLOS7hMTeVbZLiq/M/es6+sL8rEWtps4=";
   };
 
   buildInputs = lib.optional stdenv.hostPlatform.isDarwin [ darwin.apple_sdk.frameworks.Security ];
···
   ] ++ lib.optionals stdenv.hostPlatform.isDarwin [ xcodebuild ];
 
   env.BORING_BSSL_PATH = "${boringssl-wrapper}";
+  env.NIX_LDFLAGS = "-lstdc++";
 
   # The Cargo.lock contains git dependencies
   cargoLock = {
     lockFile = ./Cargo.lock;
     outputHashes = {
-      "boring-4.9.0" = "sha256-zhf0sO6TV4e55k4MxAB/TlXdqd96dg6i674RbuUPrtM=";
+      "boring-4.13.0" = "sha256-+0LeCN4YtHe84GzkMZog8gCTvrzVNoAYXv04jQXZaUo=";
+      "intmap-2.0.0" = "sha256-PGlkaZl+DYS4QkpJFfUf+2unVKwd9vLNF0N+/YFg8qE=";
       "curve25519-dalek-4.1.3" = "sha256-bPh7eEgcZnq9C3wmSnnYv0C4aAP+7pnwk9Io29GrI4A=";
     };
   };

pkgs/by-name/li/lint-staged/package.nix

···
 
 buildNpmPackage rec {
   pname = "lint-staged";
-  version = "15.2.11";
+  version = "15.3.0";
 
   src = fetchFromGitHub {
     owner = "okonet";
     repo = "lint-staged";
     rev = "v${version}";
-    hash = "sha256-f2sHvbReLfX+PtFAZuxK36ZzHmaegqCG/7ADel8YVOA=";
+    hash = "sha256-TcjJtNELI7jOVpQJJovVTKrrQtHlECUaX6/CeoCXgsA=";
   };
 
-  npmDepsHash = "sha256-RhR5nexLM5Ah35u/8jhv2PzrMYWYztPf964kQXWNim8=";
+  npmDepsHash = "sha256-FWbXo8io35nGk8baYtL7FIx7DI7QQk2JsAoJPQ9dWp8=";
 
   dontNpmBuild = true;
 

pkgs/by-name/lu/lunacy/package.nix

···
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "lunacy";
-  version = "10.9.0";
+  version = "10.10";
 
   src = fetchurl {
     url = "https://lcdn.icons8.com/setup/Lunacy_${finalAttrs.version}.deb";
-    hash = "sha256-z5EUztSbU/8G0UE6UVgtIu6iQUY40PZYy1jDbjPIuv8=";
+    hash = "sha256-4aIsEECUl9AjVhPMEhmuAew6ZynaIl15i8jmo3NJ6TU=";
   };
 
   buildInputs = [

pkgs/by-name/md/mdbook-alerts/package.nix

···
 
 rustPlatform.buildRustPackage rec {
   pname = "mdbook-alerts";
-  version = "0.6.10";
+  version = "0.7.0";
 
   src = fetchFromGitHub {
     owner = "lambdalisue";
     repo = "rs-mdbook-alerts";
     rev = "v${version}";
-    hash = "sha256-xyjLrqNb/YC2FWQXsCFJgiIDZz4xWACnrUiBuXS2Nio=";
+    hash = "sha256-MZS9TESITj3tzdaXYu5S2QUCW7cZuTpH1skFKeVi/sQ=";
   };
 
-  cargoHash = "sha256-ZKnpOgTyUETCW0qxAjEj2E75mgHWLxmaTTfpdW+y3OY=";
+  cargoHash = "sha256-twAIr1GVkvo4ZC7iwgKY4L1CklGVvGqd/eQf8toncDE=";
 
   meta = {
     description = "Preprocessor for mdbook to support the inclusion of Markdown alerts";

pkgs/by-name/mo/monkeysAudio/package.nix

···
 }:
 
 stdenv.mkDerivation (finalAttrs: {
-  version = "10.85";
+  version = "10.86";
   pname = "monkeys-audio";
 
   src = fetchzip {
     url = "https://monkeysaudio.com/files/MAC_${builtins.concatStringsSep "" (lib.strings.splitString "." finalAttrs.version)}_SDK.zip";
-    hash = "sha256-072ZFJ+cmT9rXxQmG3tDbnxnbRmvTxbZ6JtOhONe5n0=";
+    hash = "sha256-kT44DHD1XcIcijQ2LM69kvDfTfxiNYTQS/JFn0kEHgY=";
     stripRoot = false;
   };
 

pkgs/by-name/n8/n8n/package.nix

···
   pnpm,
   python3,
   node-gyp,
-  cacert,
   xcbuild,
   libkrb5,
   libmongocrypt,
   postgresql,
   makeWrapper,
-  nix-update-script,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
···
   src = fetchFromGitHub {
     owner = "n8n-io";
     repo = "n8n";
-    rev = "n8n@${finalAttrs.version}";
+    tag = "n8n@${finalAttrs.version}";
     hash = "sha256-GIA2y81nuKWe1zuZQ99oczQtQWStyT1Qh3bZ1oe8me4=";
   };
 
···
     pnpm.configHook
     python3 # required to build sqlite3 bindings
     node-gyp # required to build sqlite3 bindings
-    cacert # required for rustls-native-certs (dependency of turbo build tool)
     makeWrapper
   ] ++ lib.optional stdenv.hostPlatform.isDarwin [ xcbuild ];
 
···
   '';
 
   preInstall = ''
-    echo "Removing non-deterministic files"
+    echo "Removing non-deterministic and unnecessary files"
 
-    rm -r $(find -type d -name .turbo)
+    find -type d -name .turbo -exec rm -rf {} +
     rm node_modules/.modules.yaml
     rm packages/nodes-base/dist/types/nodes.json
 
-    echo "Removed non-deterministic files"
+    pnpm --ignore-scripts prune --prod
+    find -type f \( -name "*.ts" -o -name "*.map" \) -exec rm -rf {} +
+    rm -rf node_modules/.pnpm/{typescript*,prettier*}
+
+    echo "Removed non-deterministic and unnecessary files"
   '';
 
   installPhase = ''
···
 
   passthru = {
     tests = nixosTests.n8n;
-    updateScript = nix-update-script { };
+    updateScript = ./update.sh;
   };
 
+  # this package has ~80000 files, these take too long and seem to be unnecessary
   dontStrip = true;
+  dontPatchELF = true;
+  dontRewriteSymlinks = true;
 
   meta = {
     description = "Free and source-available fair-code licensed workflow automation tool";
···
       Easily automate tasks across different services.
     '';
     homepage = "https://n8n.io";
-    changelog = "https://github.com/n8n-io/n8n/releases/tag/${finalAttrs.src.rev}";
+    changelog = "https://github.com/n8n-io/n8n/releases/tag/n8n@${finalAttrs.version}";
     maintainers = with lib.maintainers; [
       gepbird
     ];

pkgs/by-name/n8/n8n/update.sh

···
+#!/usr/bin/env nix-shell
+#!nix-shell --pure -i bash -p bash curl jq nix-update cacert git
+set -euo pipefail
+
+new_version="$(curl -s "https://api.github.com/repos/n8n-io/n8n/releases/latest" | jq --raw-output '.tag_name | ltrimstr("n8n@")')"
+nix-update n8n --version "$new_version"

pkgs/by-name/na/namespace-cli/package.nix

···
 
 buildGoModule rec {
   pname = "namespace-cli";
-  version = "0.0.397";
+  version = "0.0.398";
 
   src = fetchFromGitHub {
     owner = "namespacelabs";
     repo = "foundation";
     rev = "v${version}";
-    hash = "sha256-rfJr8kcfqaKEnOzO53NxvjBKYnDOTDCX0TTtrLoCPfM=";
+    hash = "sha256-wSRlasUxHb4ukmQRZcuLqjcIwN/vat4kWet2R8Cyxt0=";
   };
 
-  vendorHash = "sha256-T4uyL9izxV747SuQfp94g0VMQo0g8MvBXL97OinYa2Q=";
+  vendorHash = "sha256-b8er/iF7Dqq+BAulzE/tUebNeKmTMilc+a0yCAJ5E/0=";
 
   subPackages = [
     "cmd/nsc"

pkgs/by-name/nv/nvitop/package.nix

···
   lib,
   python3Packages,
   fetchFromGitHub,
+  versionCheckHook,
 }:
 
 python3Packages.buildPythonApplication rec {
   pname = "nvitop";
-  version = "1.3.2";
+  version = "1.4.0";
 
   src = fetchFromGitHub {
     owner = "XuehaiPan";
-    repo = pname;
-    rev = "refs/tags/v${version}";
-    hash = "sha256-TunGtNe+lgx/hk8kNtB8yaCdbkiJ3d4JJ8NKB+6urJA=";
+    repo = "nvitop";
+    tag = "v${version}";
+    hash = "sha256-Z0JGW7vcZFxguQqhqhpPpOvcOct7B9z8RoEFu5NsOl0=";
   };
 
   pythonRelaxDeps = [ "nvidia-ml-py" ];
 
-  propagatedBuildInputs = with python3Packages; [
+  dependencies = with python3Packages; [
     cachetools
     psutil
     termcolor
     nvidia-ml-py
   ];
 
-  checkPhase = ''
-    $out/bin/nvitop --help
-  '';
+  nativeCheckInputs = [
+    versionCheckHook
+  ];
+  versionCheckProgramArg = [ "--version" ];
 
-  meta = with lib; {
+  meta = {
     description = "Interactive NVIDIA-GPU process viewer, the one-stop solution for GPU process management";
     homepage = "https://github.com/XuehaiPan/nvitop";
     changelog = "https://github.com/XuehaiPan/nvitop/releases/tag/v${version}";
-    license = licenses.gpl3;
-    maintainers = with maintainers; [ GaetanLepage ];
-    platforms = with platforms; linux;
+    license = lib.licenses.gpl3;
+    maintainers = with lib.maintainers; [ GaetanLepage ];
+    platforms = with lib.platforms; linux;
   };
 }

pkgs/by-name/op/open-webui/package.nix

···
 }:
 let
   pname = "open-webui";
-  version = "0.4.8";
+  version = "0.5.2";
 
   src = fetchFromGitHub {
     owner = "open-webui";
     repo = "open-webui";
-    rev = "refs/tags/v${version}";
-    hash = "sha256-9N/t8hxODM6Dk/eMKS26/2Sh1lJVkq9pNkPcEtbXqb4=";
+    tag = "v${version}";
+    hash = "sha256-QQSJaef/0G8elj3c3uVWq9Yh7puNhe0vZc+IVH3rDpE=";
   };
 
   frontend = buildNpmPackage {
     inherit pname version src;
 
-    npmDepsHash = "sha256-ThOGBurFjndBZcdpiGugdXpv1YCwCN7s3l2JjSk/hY0=";
+    npmDepsHash = "sha256-SUrI5nKtW/NoqT2BNRjBM9Aw9KIZL/T6SEtEbazhvPQ=";
 
     # Disabling `pyodide:fetch` as it downloads packages during `buildPhase`
     # Until this is solved, running python packages from the browser will not work.
···
     docx2txt
     duckduckgo-search
     einops
-    emoji # This dependency is missing in upstream's pyproject.toml
     extract-msg
     fake-useragent
     fastapi
···
     flask-cors
     fpdf2
     ftfy
+    google-api-python-client
+    google-auth-httplib2
+    google-auth-oauthlib
     google-generativeai
     googleapis-common-protos
     iso-639
···
   };
 
   meta = {
-    changelog = "https://github.com/open-webui/open-webui/blob/${src.rev}/CHANGELOG.md";
+    changelog = "https://github.com/open-webui/open-webui/blob/${src.tag}/CHANGELOG.md";
     description = "Comprehensive suite for LLMs with a user-friendly WebUI";
     homepage = "https://github.com/open-webui/open-webui";
     license = lib.licenses.mit;
     mainProgram = "open-webui";
-    maintainers = with lib.maintainers; [ shivaraj-bh ];
+    maintainers = with lib.maintainers; [
+      drupol
+      shivaraj-bh
+    ];
   };
 }

pkgs/by-name/or/ord/package.nix

···
 
 rustPlatform.buildRustPackage rec {
   pname = "ord";
-  version = "0.22.0";
+  version = "0.22.1";
 
   src = fetchFromGitHub {
     owner = "ordinals";
     repo = "ord";
     rev = version;
-    hash = "sha256-E2u9qXcenpnoivAOiRG2CoRO3zWzdqswRYR2p/Fzcaw=";
+    hash = "sha256-95da/aoBhrQ/GaM4fojFufs6+OI2KLF6SGsSw6qtYUc=";
   };
 
-  cargoHash = "sha256-+qEvXQkg4TtdzVpGEF0ZzROxwgPGZ8qerHsCIhGcMUo=";
+  cargoHash = "sha256-yATfAPBA96ozqhdekklFCgHr9Oj2YIKws/m4hc70i6E=";
 
   nativeBuildInputs = [
     pkg-config

pkgs/by-name/pl/plemoljp-nf/package.nix

···
 
 stdenvNoCC.mkDerivation rec {
   pname = "plemoljp-nf";
-  version = "1.7.1";
+  version = "2.0.0";
 
   src = fetchzip {
     url = "https://github.com/yuru7/PlemolJP/releases/download/v${version}/PlemolJP_NF_v${version}.zip";
-    hash = "sha256-nxGvaHLs65z4CSy/smy+koQyuYcDXJKjPZt5NusUN3E=";
+    hash = "sha256-+RFUQv/OjHFfYdodcGpnGJQ6r99q2gHKNFynFm4C8Lo=";
   };
 
   installPhase = ''

pkgs/by-name/pl/plemoljp/package.nix

···
 
 stdenvNoCC.mkDerivation rec {
   pname = "plemoljp";
-  version = "1.7.1";
+  version = "2.0.0";
 
   src = fetchzip {
     url = "https://github.com/yuru7/PlemolJP/releases/download/v${version}/PlemolJP_v${version}.zip";
-    hash = "sha256-YH1c/2jk8QZNyPvzRZjxNHyNeci9tjn+oOW8xLd8kjk=";
+    hash = "sha256-6u7JfU5fYGGKcvLocKaT5rRun/CYhzk80rmlvP+utuM=";
   };
 
   installPhase = ''

pkgs/by-name/ra/ranger/package.nix

···
   neoVimSupport ? true,
   improvedEncodingDetection ? true,
   rightToLeftTextSupport ? false,
+  gitUpdater,
 }:
 
 python3Packages.buildPythonApplication rec {
   pname = "ranger";
-  version = "1.9.3-unstable-2023-08-23";
+  version = "1.9.4";
 
   src = fetchFromGitHub {
     owner = "ranger";
     repo = "ranger";
-    rev = "38bb8901004b75a407ffee4b9e176bc0a436cb15";
-    hash = "sha256-NpsrABk95xHNvhlRjKFh326IW83mYj1cmK3aE9JQSRo=";
+    tag = "v${version}";
+    hash = "sha256-9ehxMXwQj7oVhlotTc3mzCKCkoMSbB9cliPg/NMEoWM=";
   };
 
   LC_ALL = "en_US.UTF-8";
···
         --replace "set preview_images false" "set preview_images true"
     '';
 
-  meta = with lib; {
+  passthru.updateScript = gitUpdater { rev-prefix = "v"; };
+
+  meta = {
     description = "File manager with minimalistic curses interface";
     homepage = "https://ranger.github.io/";
-    license = licenses.gpl3Only;
-    platforms = platforms.unix;
-    maintainers = with maintainers; [
+    license = lib.licenses.gpl3Only;
+    platforms = lib.platforms.unix;
+    maintainers = with lib.maintainers; [
       toonn
-      magnetophon
+      lucasew
     ];
     mainProgram = "ranger";
   };

pkgs/by-name/ra/raycast/package.nix

···
   stdenvNoCC,
   fetchurl,
   writeShellApplication,
+  cacert,
   curl,
   jq,
-  common-updater-scripts,
+  openssl,
   undmg,
 }:
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "raycast";
-  version = "1.88.3";
+  version = "1.88.4";
 
-  src = fetchurl {
-    name = "Raycast.dmg";
-    url = "https://releases.raycast.com/releases/${finalAttrs.version}/download?build=universal";
-    hash = "sha256-MOJlEUQHLDw8YeQC9sG5QLSO8qhgcWG8HtyRZCPHb+M=";
-  };
+  src =
+    {
+      aarch64-darwin = fetchurl {
+        name = "Raycast.dmg";
+        url = "https://releases.raycast.com/releases/${finalAttrs.version}/download?build=arm";
+        hash = "sha256-q3pX/mOl/u9KMcAfvXm4giYKjnTB903N1ibubvaO9Uw=";
+      };
+      x86_64-darwin = fetchurl {
+        name = "Raycast.dmg";
+        url = "https://releases.raycast.com/releases/${finalAttrs.version}/download?build=x86_64";
+        hash = "sha256-l61AVKx+aYmgnVK8d+by2pKiu1cIAueLipRjOzCvib4=";
+      };
+    }
+    .${stdenvNoCC.system} or (throw "raycast: ${stdenvNoCC.system} is unsupported.");
 
   dontPatch = true;
   dontConfigure = true;
···
   passthru.updateScript = lib.getExe (writeShellApplication {
     name = "raycast-update-script";
     runtimeInputs = [
+      cacert
       curl
       jq
-      common-updater-scripts
+      openssl
     ];
     text = ''
       url=$(curl --silent "https://releases.raycast.com/releases/latest?build=universal")
       version=$(echo "$url" | jq -r '.version')
-      update-source-version raycast "$version" --file=./pkgs/by-name/ra/raycast/package.nix
+
+      arm_url="https://releases.raycast.com/releases/$version/download?build=arm"
+      x86_url="https://releases.raycast.com/releases/$version/download?build=x86_64"
+
+      arm_hash="sha256-$(curl -sL "$arm_url" | openssl dgst -sha256 -binary | openssl base64)"
+      x86_hash="sha256-$(curl -sL "$x86_url" | openssl dgst -sha256 -binary | openssl base64)"
+
+      sed -i -E \
+        -e 's|(version = )"[0-9]+\.[0-9]+\.[0-9]+";|\1"'"$version"'";|' \
+        -e '/aarch64-darwin = fetchurl/,/};/ s|(hash = )"sha256-[A-Za-z0-9+/]+=";|\1"'"$arm_hash"'";|' \
+        -e '/x86_64-darwin = fetchurl/,/};/ s|(hash = )"sha256-[A-Za-z0-9+/]+=";|\1"'"$x86_hash"'";|' \
+        ./pkgs/by-name/ra/raycast/package.nix
     '';
   });
 

pkgs/by-name/re/release-plz/package.nix

···
 
 rustPlatform.buildRustPackage rec {
   pname = "release-plz";
-  version = "0.3.111";
+  version = "0.3.112";
 
   src = fetchFromGitHub {
     owner = "MarcoIeni";
     repo = "release-plz";
     rev = "release-plz-v${version}";
-    hash = "sha256-k9QuYskc3lhqfjOY6vhCuzHq3+l5q3EfOEbrWz4yb4M=";
+    hash = "sha256-qoaFZTKtQSmFuCJ8c9ShhnzVHrFFKVOdEn5rXVN2TL0=";
   };
 
-  cargoHash = "sha256-l1fltHsqV0zS3EdAYLO9uTTi6iMu+ZD8zGwW9/uULoQ=";
+  cargoHash = "sha256-sY732QvV9hVwPdi3llUol/DP017/mlCCivRF9by8HH0=";
 
   nativeBuildInputs = [
     installShellFiles

pkgs/by-name/rp/rpcs3/package.nix

···
 
 let
   # Keep these separate so the update script can regex them
-  rpcs3GitVersion = "17206-9d4ff13c2";
-  rpcs3Version = "0.0.34-17206-9d4ff13c2";
-  rpcs3Revision = "9d4ff13c2bbcb85d8fa63b479d0f4c28f9472147";
-  rpcs3Hash = "sha256-FZItMeClPxwzwLVH5YPLV7NQZ5kFn6SjdduMI9P2kWQ=";
+  rpcs3GitVersion = "17265-418a99a62";
+  rpcs3Version = "0.0.34-17265-418a99a62";
+  rpcs3Revision = "418a99a62b814b7f831072610c9e7d7b5e90610c";
+  rpcs3Hash = "sha256-NN7gEtt/18JCAHFZNQ8OqpATWx50qXda2Kk7NVq5T9Y=";
 
   inherit (qt6Packages)
     qtbase

pkgs/by-name/ru/rust-analyzer-unwrapped/package.nix

···
 
 rustPlatform.buildRustPackage rec {
   pname = "rust-analyzer-unwrapped";
-  version = "2024-12-16";
-  cargoHash = "sha256-RUFhNJTLP1xOr+qpRVYZipk9rZ/c9kqJE9wuqmwFFPE=";
+  version = "2024-12-23";
+  cargoHash = "sha256-9fPKd94erhUIBIeg8gDaCvJmKHwwNuLUMiEwCMdVeFE=";
 
   src = fetchFromGitHub {
     owner = "rust-lang";
     repo = "rust-analyzer";
     rev = version;
-    hash = "sha256-7DBZsPlP/9ZpYk+k6dLFG6SEH848HuGaY7ri/gdye4M=";
+    hash = "sha256-NlsVD/fI32wsHFua9Xvc7IFHCUpQIOs6D6RS/3AhMT8=";
   };
 
   cargoBuildFlags = [

pkgs/by-name/ry/ryzenadj/package.nix

···
   };
 
   nativeBuildInputs = [
-    pciutils
     cmake
   ];
+
+  buildInputs = [
+    pciutils
+  ];
+
+  strictDeps = true;
 
   installPhase = ''
     install -D libryzenadj.so $out/lib/libryzenadj.so

pkgs/by-name/sn/snoop/package.nix

···
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "snoop";
-  version = "0.4.1";
+  version = "0.4.2";
 
   src = fetchFromGitLab {
     domain = "gitlab.gnome.org";
     owner = "philippun1";
     repo = "snoop";
-    rev = "refs/tags/${finalAttrs.version}";
-    hash = "sha256-v4+A0q04+THBJ+U5izICVhofXPEC3db73MzYonXcDvU=";
+    tag = finalAttrs.version;
+    hash = "sha256-M+wV6WYPtTbKXgBCOD/qN3LYAbpucwSAuKZQBVUjZo8=";
   };
 
   patchPhase = ''

pkgs/by-name/st/stats/package.nix

···
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "stats";
-  version = "2.11.21";
+  version = "2.11.22";
 
   src = fetchurl {
     url = "https://github.com/exelban/stats/releases/download/v${finalAttrs.version}/Stats.dmg";
-    hash = "sha256-EqgWHxiSpMpzxQkogfMX8wTlzIhlfcUIlTARlihjwgw=";
+    hash = "sha256-b8Yj8YRoiE37cj4NDDdreoPH5BokBBTReFihUnHQ1wU=";
   };
 
   sourceRoot = ".";

pkgs/by-name/st/stevenblack-blocklist/package.nix

···
 }:
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "stevenblack-blocklist";
-  version = "3.15.0";
+  version = "3.15.5";
 
   src = fetchFromGitHub {
     owner = "StevenBlack";
     repo = "hosts";
     rev = "refs/tags/${finalAttrs.version}";
-    hash = "sha256-CMafExAcNPDOjFd518MHK1rWYhapP6eBIXKk6YAjJqc=";
+    hash = "sha256-bBQu5n/rMT8bEsBMmv3CtGUZ/ybCTuDw5E2GYZI5woU=";
   };
 
   outputs = [

pkgs/by-name/su/subxt/package.nix

···
 
 rustPlatform.buildRustPackage rec {
   pname = "subxt";
-  version = "0.37.1";
+  version = "0.38.0";
 
   src = fetchFromGitHub {
     owner = "paritytech";
     repo = "subxt";
     rev = "v${version}";
-    hash = "sha256-lCDjqvdjiQktyFAp3KuFHehwapd3BiLxMSLsNK+wDDo=";
+    hash = "sha256-mUW1foT3JkpsnieJutL+GZZXiTcRUklnjfoaWcH8ccE=";
   };
 
-  cargoHash = "sha256-RmeV2EYHGbMMAeerQkHcYav+RIVY68Tj66zjcFgjUfQ=";
+  cargoHash = "sha256-+psdikles6ICg2eSBGxJoiG5EZG8voR2fs6PGnOWvDc=";
 
   # Only build the command line client
   cargoBuildFlags = [ "--bin" "subxt" ];

pkgs/by-name/su/supergee/package.nix

···
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  meson,
+  ninja,
+  vala,
+  gtk3,
+  beets,
+  libgee,
+  glib,
+  libxml2,
+  unstableGitUpdater,
+  pkg-config,
+  cmake,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "supergee";
+  version = "0-unstable-2023-11-21";
+
+  src = fetchFromGitHub {
+    owner = "DannyGB";
+    repo = "SuperGee";
+    rev = "c1232f6a8a9d4161644d728df793ffd3cb5cc4af";
+    hash = "sha256-lv7C4ku3MdiHxg1LfmnzT5Sx3DTtvP9g3XPOQlNBDkg=";
+  };
+
+  nativeBuildInputs = [
+    meson
+    ninja
+    libxml2.bin
+    vala
+    pkg-config
+    cmake
+    glib.bin
+  ];
+
+  buildInputs = [
+    gtk3
+    libgee
+    glib
+  ];
+
+  postPatch = ''
+    substituteInPlace BeetService.vala \
+      --replace-fail '"beet"' '"${lib.getExe beets}"'
+  '';
+
+  preConfigure = ''
+    pushd ..
+    find -exec chmod +w {} \;
+    mkdir build
+    cd build
+    mkdir SuperG@exe
+    glib-compile-resources --sourcedir ../resources --generate-source --target SuperG@exe/resources.c ../resources/superg.gresource.xml
+    popd
+  '';
+
+  installPhase = ''
+    runHook preInstall
+
+    install -Dm755 SuperG $out/bin/SuperG
+
+    runHook postInstall
+  '';
+
+  sourceRoot = "${finalAttrs.src.name}/src";
+
+  dontUseCmakeConfigure = true;
+
+  passthru = {
+    updateScript = unstableGitUpdater { hardcodeZeroVersion = true; };
+  };
+
+  meta = {
+    description = "Vala based UI for beets";
+    homepage = "https://github.com/DannyGB/SuperGee";
+    license = lib.licenses.gpl3Only;
+    platforms = lib.platforms.linux;
+    mainProgram = "SuperG";
+    maintainers = with lib.maintainers; [ bot-wxt1221 ];
+  };
+})

pkgs/by-name/ta/tabby-agent/package.nix

···
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "tabby-agent";
-  version = "0.21.2";
+  version = "0.22.0";
 
   src = fetchFromGitHub {
     owner = "TabbyML";
     repo = "tabby";
     rev = "refs/tags/v${finalAttrs.version}";
-    hash = "sha256-1mvONz1Pl79qIro8UHvE3ReSHqNxJJOUAKh/lXUeQKs=";
+    hash = "sha256-TP0KEGH8w9kdTj5yxCsAn4LRS1gj3Dnz96GA8DDSJJU=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/ta/talosctl/package.nix

···
 
 buildGoModule rec {
   pname = "talosctl";
-  version = "1.9.0";
+  version = "1.9.1";
 
   src = fetchFromGitHub {
     owner = "siderolabs";
     repo = "talos";
     tag = "v${version}";
-    hash = "sha256-j/GqAUP3514ROf64+ouvCg//9QuGoVDgxkNFqi4r+WE=";
+    hash = "sha256-Qvt9/okT37J3ge/lb17OX4aaiXbSFU1j7drdiJDqFnA=";
   };
 
-  vendorHash = "sha256-XvOMNyiHnemqnbOzWmzZXkr3+/ZgJDg8vjCtWFkCtLs=";
+  vendorHash = "sha256-vZFXqU9tgnL8odBpOcvRig1KKVH20CM0ze0+pypaRKE=";
 
   ldflags = [
     "-s"

pkgs/by-name/te/terramate/package.nix

···
 
 buildGoModule rec {
   pname = "terramate";
-  version = "0.11.4";
+  version = "0.11.5";
 
   src = fetchFromGitHub {
     owner = "terramate-io";
     repo = "terramate";
     rev = "v${version}";
-    hash = "sha256-RZBafDaSGW01EdvDg8RUynrSO84/pkh3OcVXlSsZ+ao=";
+    hash = "sha256-xEV72bswFW7ie3FWa07vmffIXMIi0A5ZSpg6wRS7o5g=";
   };
 
-  vendorHash = "sha256-PwMxmls7sL9RhgvGKKDwxAeObk7HVBtYLOsIYt90dVU=";
+  vendorHash = "sha256-6nnUyNOdG1QmaHeRXRWvyjLhYPXA3Xs9062ZkF82Kzo=";
 
   # required for version info
   nativeBuildInputs = [ git ];

pkgs/by-name/tp/tpnote/package.nix

···
 
 rustPlatform.buildRustPackage rec {
   pname = "tpnote";
-  version = "1.24.11";
+  version = "1.24.12";
 
   src = fetchFromGitHub {
     owner = "getreu";
     repo = "tp-note";
     rev = "v${version}";
-    hash = "sha256-k3Vz57YSfMppDaXocsCABfm/d0b51udUS2nI2mX9+b8=";
+    hash = "sha256-1Y7Sw9wiUno4A6i0lYDJpqfIT/HV5rxXfuJnJ+FJTBU=";
   };
 
-  cargoHash = "sha256-S4gUw628hBWDiCK199dVQMe10Q7sztt7YgwtE0X5c80=";
+  cargoHash = "sha256-ZOE2D8GXrJ7BQK7iMoUnqyrj4zc+ODJxZ1jgH7xYMI0=";
 
   nativeBuildInputs = [
     cmake

pkgs/by-name/tu/tuxguitar/package.nix

···
 }:
 
 stdenv.mkDerivation (finalAttrs: {
-  version = "1.6.5";
+  version = "1.6.6";
   pname = "tuxguitar";
 
   src = fetchurl {
     url = "https://github.com/helge17/tuxguitar/releases/download/${finalAttrs.version}/tuxguitar-${finalAttrs.version}-linux-swt-amd64.tar.gz";
-    hash = "sha256-wxiLqNc20/AROZZWghzbrUz/VK++fEIKyP5ipomy1Po=";
+    hash = "sha256-kfPk+IIg5Q4Fc9HMS0kxxCarlbJjVKluIvz8KpDjJLM=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/ty/typos-lsp/package.nix

···
   pname = "typos-lsp";
   # Please update the corresponding VSCode extension too.
   # See pkgs/applications/editors/vscode/extensions/tekumara.typos-vscode/default.nix
-  version = "0.1.31";
+  version = "0.1.32";
 
   src = fetchFromGitHub {
     owner = "tekumara";
     repo = "typos-lsp";
     rev = "refs/tags/v${version}";
-    hash = "sha256-rr6ZleJa6ECzFNHtqh08YyQAbHvRtYdjzh1uFPPZ3sU=";
+    hash = "sha256-ezRyitmdcOki/thQGJ11+UYMIG2fYJ9HMcvD++s/ewM=";
   };
 
-  cargoHash = "sha256-PgvD2RWGXa7A9NNX0oYQtQ3Bq9yAe+XyRiORVsICJWg=";
+  cargoHash = "sha256-J1XbhCP2EMFIHs2U9kTtNNdGF4UnZWNgIO7L3YlYkqo=";
 
   # fix for compilation on aarch64
   # see https://github.com/NixOS/nixpkgs/issues/145726

pkgs/by-name/ur/url-parser/package.nix

···
 
 buildGoModule rec {
   pname = "url-parser";
-  version = "2.1.1";
+  version = "2.1.2";
 
   src = fetchFromGitHub {
     owner = "thegeeklab";
     repo = "url-parser";
     rev = "refs/tags/v${version}";
-    hash = "sha256-XXTa/FtvxXU34avQA+ykJjBRndMaOYTJDlJLbqzFqvM=";
+    hash = "sha256-IGA+T0Qv3l32UmWciCH2J5G+YGWu0plqSG7yfEtuswM=";
   };
 
-  vendorHash = "sha256-kXVNJgaA2Oon0+fTxk4WtN3P4PlaQszbaXEvSyS2lWU=";
+  vendorHash = "sha256-Znt8C7B+tSZnzq+3DaycEu0VtkltKhODG9sB5aO99rc=";
 
   ldflags = [
     "-s"

pkgs/by-name/us/usbkvm/package.nix

···
+{
+  buildGoModule,
+  fetchzip,
+  gst_all_1,
+  gtkmm3,
+  hidapi,
+  lib,
+  makeWrapper,
+  meson,
+  ninja,
+  pkg-config,
+  python3,
+  stdenv,
+  wrapGAppsHook3,
+}:
+
+let
+  version = "0.1.0";
+
+  src = fetchzip {
+    url = "https://github.com/carrotIndustries/usbkvm/releases/download/v${version}/usbkvm-v${version}.tar.gz";
+    sha256 = "sha256-OuZ7+IjsvK7/PaiTRwssaQFJDFWJ8HX+kqV13CUyTZA=";
+  };
+
+  ms-tools-lib = buildGoModule {
+    pname = "usbkvm-ms-tools-lib";
+    inherit version;
+
+    inherit src;
+    sourceRoot = "source/ms-tools";
+    vendorHash = "sha256-imHpsos7RDpATSZFWRxug67F7VgjRTT1SkLt7cWk6tU=";
+
+    buildInputs = [
+      hidapi
+    ];
+
+    buildPhase = ''
+      mkdir -p $out/
+      go build -C lib/ -o $out/ -buildmode=c-archive mslib.go
+    '';
+  };
+in
+stdenv.mkDerivation {
+  pname = "usbkvm";
+  inherit version src;
+
+  nativeBuildInputs = [
+    pkg-config
+    python3
+    meson
+    ninja
+    makeWrapper
+    wrapGAppsHook3
+  ];
+
+  buildInputs = [
+    gst_all_1.gstreamer
+    gtkmm3
+    hidapi
+  ];
+
+  # The package includes instructions to build the "mslib.{a,h}" files using a
+  # Go compiler, but that doesn't work in the Nix sandbox. We patch out this
+  # build step to instead copy those files from the Nix store:
+  patches = [
+    ./precompiled-mslib.patch
+  ];
+  postPatch = ''
+    substituteInPlace meson.build \
+      --replace-fail "@MSLIB_A_PRECOMPILED@" "${ms-tools-lib}/mslib.a" \
+      --replace-fail "@MSLIB_H_PRECOMPILED@" "${ms-tools-lib}/mslib.h"
+  '';
+
+  postFixup =
+    let
+      GST_PLUGIN_PATH = lib.makeSearchPathOutput "lib" "lib/gstreamer-1.0" [
+        gst_all_1.gst-plugins-base
+        (gst_all_1.gst-plugins-good.override { gtkSupport = true; })
+      ];
+    in
+    lib.optionalString stdenv.hostPlatform.isLinux ''
+      wrapProgram $out/bin/usbkvm \
+        --prefix GST_PLUGIN_PATH : "${GST_PLUGIN_PATH}"
+    '';
+
+  postInstall = ''
+    mkdir -p $out/lib/udev/rules.d/
+    cp ../70-usbkvm.rules $out/lib/udev/rules.d/
+  '';
+
+  meta = {
+    homepage = "https://github.com/carrotIndustries/usbkvm";
+    description = "An open-source USB KVM (Keyboard, Video and Mouse) adapter";
+    changelog = "https://github.com/carrotIndustries/usbkvm/releases/tag/v${version}";
+    license = lib.licenses.gpl3;
+    maintainers = with lib.maintainers; [ lschuermann ];
+    mainProgram = "usbkvm";
+  };
+}

pkgs/by-name/us/usbkvm/precompiled-mslib.patch

···
+diff --git a/meson.build b/meson.build
+index 6e60b0b..b25da9d 100644
+--- a/meson.build
++++ b/meson.build
+@@ -125,7 +125,7 @@ mslib = custom_target(
+     'mslib',
+     output: ['mslib.a', 'mslib.h'],
+     input: 'ms-tools/lib/mslib.go',
+-    command: ['go', 'build', '-C',  join_paths(meson.current_source_dir(), 'ms-tools/lib'), '-o', join_paths(meson.current_build_dir(), '@OUTPUT0@'), '-buildmode=c-archive', 'mslib.go']
++    command: ['cp', '@MSLIB_A_PRECOMPILED@', '@MSLIB_H_PRECOMPILED@', join_paths(meson.current_build_dir(), '@OUTDIR@')]
+     
+ )
+ 

pkgs/by-name/ut/utpm/package.nix

···
+{
+  lib,
+  fetchFromGitHub,
+  rustPlatform,
+  openssl,
+  pkg-config,
+}:
+rustPlatform.buildRustPackage rec {
+  pname = "utpm";
+  version = "0-unstable-2024-12-17";
+
+  useFetchCargoVendor = true;
+  cargoHash = "sha256-fqGxor2PgsQemnPNoZkgNUNc7yRg2eqHTLzJAVpt6+8=";
+
+  src = fetchFromGitHub {
+    owner = "Thumuss";
+    repo = pname;
+    rev = "6c2cabc8e7e696ea129f55aa7732a6be63bc2319";
+    hash = "sha256-uuET0BG2kBFEEWSSZ35h6+tnqTTjEHOP50GR3IkL+CE=";
+  };
+
+  env.OPENSSL_NO_VENDOR = 1;
+
+  buildInputs = [
+    openssl
+  ];
+  nativeBuildInputs = [
+    pkg-config
+  ];
+
+  doCheck = false; # no tests
+
+  meta = {
+    description = "Package manager for typst";
+    longDescription = ''
+      UTPM is a package manager for local and remote packages. Create quickly
+      new projects and templates from a singular tool, and then publish it directly
+      to Typst!
+    '';
+    homepage = "https://github.com/Thumuss/utpm";
+    license = lib.licenses.mit;
+    mainProgram = "utpm";
+    maintainers = with lib.maintainers; [ louis-thevenet ];
+  };
+}

pkgs/by-name/vi/video-downloader/package.nix

···
 
 python3Packages.buildPythonApplication rec {
   pname = "video-downloader";
-  version = "0.12.20";
+  version = "0.12.21";
   pyproject = false; # Built with meson
 
   src = fetchFromGitHub {
     owner = "Unrud";
     repo = "video-downloader";
     tag = "v${version}";
-    hash = "sha256-UaSEcqD4hYRacQfLHgkXgO+/lIV5GxMX9NDOTLhTw+o=";
+    hash = "sha256-rlhb2FaNkUivrN08kERXyoEzRIMdByr5foiQJ80OlT8=";
   };
 
   propagatedBuildInputs = with python3Packages; [

pkgs/by-name/wa/waycheck/package.nix

···
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "waycheck";
-  version = "1.4.0";
+  version = "1.5.0";
 
   src = fetchFromGitLab {
     domain = "gitlab.freedesktop.org";
     owner = "serebit";
     repo = "waycheck";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-wawz7QCzpeQgdxwFQaZ/yV//AepEE+FLNG7ho/lHtFE=";
+    hash = "sha256-uicwbAIEQh457eYerpC0C4adjRNtmJMsOg+xe5KaIRg=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/wa/wayfreeze/package.nix

···
 
 rustPlatform.buildRustPackage {
   pname = "wayfreeze";
-  version = "0-unstable-2024-09-20";
+  version = "0-unstable-2024-12-26";
 
   src = fetchFromGitHub {
     owner = "Jappie3";
     repo = "wayfreeze";
-    rev = "dcbe2690ce41a286ef1eed54747bac47cee6dc2c";
-    hash = "sha256-XlZSVN/kTSA5X/kTpD/Hr5YBXdfh8gJPq5Da4tL0Gpk=";
+    rev = "5f7b7f50b69962b41a685c82fc9e82370d02275a";
+    hash = "sha256-ARnA0R5wZqHDIY+0le0F9okpJS4OI9XpLjN3vsmqUkY=";
   };
 
   passthru.updateScript = nix-update-script { extraArgs = [ "--version=branch" ]; };
 
-  cargoHash = "sha256-DOG/IMtHYjdzfPVyFDN20+VB4oEzdSle28F07DydETc=";
+  cargoHash = "sha256-khbayCb0M3vOx00a7M0tOTQ+AKumioCBtoJs2/Ca0+g=";
 
   buildInputs = [
     libxkbcommon

pkgs/by-name/we/webdav/package.nix

···
 
 buildGo123Module rec {
   pname = "webdav";
-  version = "5.4.4";
+  version = "5.7.0";
 
   src = fetchFromGitHub {
     owner = "hacdias";
     repo = "webdav";
     rev = "v${version}";
-    sha256 = "sha256-8T/CRIVB4jW9kJ26om6fcm/khfzqdYCWbhJIIRZlMC0=";
+    sha256 = "sha256-vQLYg7qqNO3b/93fO6/zydsakfvyfYSsCUGwNPF6PXY=";
   };
 
-  vendorHash = "sha256-f/Og0FkuaeUJ4bjqeUXVacIWnp6uiod7s146iKDSMgU=";
+  vendorHash = "sha256-x5CUy46c4SunzMw/v2DWpdahuXFZnJdGInQ0lSho/es=";
 
   __darwinAllowLocalNetworking = true;
 

pkgs/by-name/xc/xcaddy/package.nix

···
     license = licenses.asl20;
     maintainers = with maintainers; [
       tjni
-      emilylange
     ];
   };
 }

pkgs/by-name/xc/xcb-imdkit/package.nix

···
     hash = "sha256-QfuetGPY6u4OhFiE5/CoVEpdODWnd1PHWBtM3ymsZ98=";
   };
 
+  strictDeps = true;
+
   nativeBuildInputs = [
     cmake
-    extra-cmake-modules
     xorgproto
     uthash
   ];
 
   buildInputs = [
+    extra-cmake-modules
     xcbutil
     xcbutilkeysyms
   ];

pkgs/by-name/xh/xh/package.nix

···
   pkg-config,
   withNativeTls ? true,
   stdenv,
-  darwin,
   openssl,
 }:
 
···
     pkg-config
   ];
 
-  buildInputs = lib.optionals withNativeTls (
-    if stdenv.hostPlatform.isDarwin then
-      [ darwin.apple_sdk.frameworks.SystemConfiguration ]
-    else
-      [ openssl ]
-  );
+  buildInputs = lib.optionals (withNativeTls && !stdenv.hostPlatform.isDarwin) [ openssl ];
 
-  # Get openssl-sys to use pkg-config
-  OPENSSL_NO_VENDOR = 1;
+  env = {
+    # Get openssl-sys to use pkg-config
+    OPENSSL_NO_VENDOR = 1;
+  };
 
   postInstall = ''
     installShellCompletion \
···
     $out/bin/xhs --help > /dev/null
   '';
 
-  meta = with lib; {
+  meta = {
     description = "Friendly and fast tool for sending HTTP requests";
     homepage = "https://github.com/ducaale/xh";
     changelog = "https://github.com/ducaale/xh/blob/v${version}/CHANGELOG.md";
-    license = licenses.mit;
-    maintainers = with maintainers; [
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [
       figsoda
       aaronjheng
     ];

pkgs/data/fonts/hackgen/default.nix

···
   fetchzip,
 }:
 
-stdenvNoCC.mkDerivation rec {
+stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "hackgen-font";
-  version = "2.9.1";
+  version = "2.10.0";
 
   src = fetchzip {
-    url = "https://github.com/yuru7/HackGen/releases/download/v${version}/HackGen_v${version}.zip";
-    hash = "sha256-PkCaidfPcUBGjPu36Jza175jCu6WJ06YhVFDENzd+Z4=";
+    url = "https://github.com/yuru7/HackGen/releases/download/v${finalAttrs.version}/HackGen_v${finalAttrs.version}.zip";
+    hash = "sha256-cIFrYfjPLspXYfaiITmlIMes6dP9fwjJ59wD9FLO0OU=";
   };
 
   installPhase = ''
···
     runHook postInstall
   '';
 
-  meta = with lib; {
+  meta = {
     description = "Composite font of Hack and GenJyuu-Goghic";
     homepage = "https://github.com/yuru7/HackGen";
-    license = licenses.ofl;
-    platforms = platforms.all;
-    maintainers = with maintainers; [ natsukium ];
+    license = lib.licenses.ofl;
+    platforms = lib.platforms.all;
+    maintainers = with lib.maintainers; [ natsukium ];
   };
-}
+})

pkgs/data/fonts/hackgen/nerdfont.nix

···
   fetchzip,
 }:
 
-stdenvNoCC.mkDerivation rec {
+stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "hackgen-nf-font";
-  version = "2.9.1";
+  version = "2.10.0";
 
   src = fetchzip {
-    url = "https://github.com/yuru7/HackGen/releases/download/v${version}/HackGen_NF_v${version}.zip";
-    hash = "sha256-NzmCVFU1JNK0tdJyQBwMzuHxvAbOaQPV2Gbf8EYYKxI=";
+    url = "https://github.com/yuru7/HackGen/releases/download/v${finalAttrs.version}/HackGen_NF_v${finalAttrs.version}.zip";
+    hash = "sha256-n0ibIzNIy5tUdC0QEWRRW4S5Byih39agW2IxCiqTLoQ=";
   };
 
   installPhase = ''
···
     runHook postInstall
   '';
 
-  meta = with lib; {
+  meta = {
     description = "Composite font of Hack, GenJyuu-Gothic and nerd-fonts";
     homepage = "https://github.com/yuru7/HackGen";
-    license = licenses.ofl;
-    platforms = platforms.all;
-    maintainers = with maintainers; [ natsukium ];
+    license = lib.licenses.ofl;
+    platforms = lib.platforms.all;
+    maintainers = with lib.maintainers; [ natsukium ];
   };
-}
+})

pkgs/desktops/gnome-2/platform/ORBit2/default.nix

···
     "dev"
   ];
 
+  env.NIX_CFLAGS_COMPILE = toString (
+    lib.optionals (stdenv.cc.isGNU && (lib.versionAtLeast (lib.getVersion stdenv.cc.cc) "14")) [
+      # the ./configure script is not compatible with gcc-14, not easy to
+      # regenerate without porting: https://github.com/NixOS/nixpkgs/issues/367694
+      "-Wno-error=implicit-int"
+      "-Wno-error=incompatible-pointer-types"
+    ]
+  );
+
   configureFlags = lib.optionals (stdenv.buildPlatform != stdenv.hostPlatform) [
     "--with-idl-compiler=${lib.getExe' buildPackages.gnome2.ORBit2 "orbit-idl-2"}"
     # https://github.com/void-linux/void-packages/blob/e5856e02aa6ef7e4f2725afbff2915f89d39024b/srcpkgs/ORBit2/template#L17-L35

pkgs/development/libraries/ffmpeg/generic.nix

···
 , withKvazaar ? withFullDeps # HEVC encoding
 , withLadspa ? withFullDeps # LADSPA audio filtering
 , withLc3 ? withFullDeps && lib.versionAtLeast version "7.1" # LC3 de/encoding
-, withLcevcdec ? withFullDeps && lib.versionAtLeast version "7.1" # LCEVC decoding
+, withLcevcdec ? false && lib.versionAtLeast version "7.1" # LCEVC decoding # FIXME currently makes ffmpeg crash in any operation on non-AVX CPUs
 , withLcms2 ? withFullDeps # ICC profile support via lcms2
 , withLzma ? withHeadlessDeps # xz-utils
 , withMetal ? false # Unfree and requires manual downloading of files

pkgs/development/libraries/glibc/info.nix

···
     perl
   ];
 
-  makeFlags = [ "info" ];
+  buildFlags = [ "info" ];
 
   # I don't know why the info is not generated in 'build'
   # Somehow building the info still does not work, because the final

pkgs/development/libraries/libcef/default.nix

···
   dontPatchELF = true;
 
   installPhase = ''
-    mkdir -p $out/lib/ $out/share/cef/
+    mkdir -p $out/lib/ $out/share/cef/ $out/libexec/cef/
     cp libcef_dll_wrapper/libcef_dll_wrapper.a $out/lib/
     cp ../Release/libcef.so $out/lib/
     cp ../Release/libEGL.so $out/lib/
     cp ../Release/libGLESv2.so $out/lib/
+    cp ../Release/libvk_swiftshader.so $out/lib/
+    cp ../Release/libvulkan.so.1 $out/lib/
+    cp ../Release/chrome-sandbox $out/libexec/cef/
     patchelf --set-rpath "${rpath}" $out/lib/libcef.so
     patchelf --set-rpath "${gl_rpath}" $out/lib/libEGL.so
     patchelf --set-rpath "${gl_rpath}" $out/lib/libGLESv2.so
-    cp ../Release/*.bin $out/share/cef/
+    patchelf --set-rpath "${gl_rpath}" $out/lib/libvk_swiftshader.so
+    patchelf --set-rpath "${gl_rpath}" $out/lib/libvulkan.so.1
+    cp ../Release/*.bin ../Release/*.json $out/share/cef/
     cp -r ../Resources/* $out/share/cef/
     cp -r ../include $out/
   '';

pkgs/development/libraries/ngtcp2/gnutls.nix

···
 
 stdenv.mkDerivation rec {
   pname = "ngtcp2";
-  version = "1.9.1";
+  version = "1.10.0";
 
   src = fetchFromGitHub {
     owner = "ngtcp2";
     repo = "ngtcp2";
     rev = "v${version}";
-    hash = "sha256-D9u54+CZYKcYZFedwgmI515s2MruZsVoJ3AZi494ohM=";
+    hash = "sha256-MYkrdI4hGCR7QVXksznWDWSbKJtqpd4imqtQm5BxVqo=";
   };
 
   outputs = [ "out" "dev" ];

pkgs/development/libraries/qt-jdenticon/default.nix

···
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "qt-jdenticon";
-  version = "0.3.0";
+  version = "0.3.1";
 
   src = fetchFromGitHub {
     owner = "Nheko-Reborn";
     repo = "qt-jdenticon";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-Q5M7+XkY+/IS45rcFLYPfbcvQm8LDk4S9gzKigCIM7s=";
+    hash = "sha256-3XJHBn+S6oDPfmWSyFDW7qkg69wuxj+GUqMBUCDp3n0=";
   };
 
   nativeBuildInputs = [ qmake ];

pkgs/development/python-modules/brian2/default.nix

···
 
 buildPythonPackage rec {
   pname = "brian2";
-  version = "2.7.1";
+  version = "2.8.0";
   pyproject = true;
 
   # https://github.com/python/cpython/issues/117692
···
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-mp1xo6ooYm21s6FYcegQdsHmVgH81usV9IfIM0GM7lc=";
+    hash = "sha256-1JSE58y1T0YLuFMgVv2qf7bZoLddeyoyxF2dzgsbuUg=";
   };
 
   patches = [
-    (fetchpatch {
-      url = "https://github.com/brian-team/brian2/commit/8ed663cafde42cbe2e0171cb19d2217e01676d20.patch";
-      hash = "sha256-+s5SJdJmsnee3sWhaj/jwf8RXkfMrLp0aTWF52jLdqU=";
-    })
     ./0001-remove-invalidxyz.patch # invalidxyz are reported as error so I remove it
   ];
 

pkgs/development/python-modules/cohere/default.nix

···
 
 buildPythonPackage rec {
   pname = "cohere";
-  version = "5.11.3";
+  version = "5.13.4";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "cohere-ai";
     repo = "cohere-python";
-    rev = "refs/tags/${version}";
-    hash = "sha256-0Y/zSw2pdrwsYpBctiV/tVf2xPhf3jG7c18frSjBass=";
+    tag = version;
+    hash = "sha256-MqcbEcB+jnRh6rTqEH56k6IDpbY5ZRoqzdvxP305J7Q=";
   };
 
   build-system = [ poetry-core ];

pkgs/development/python-modules/equinox/default.nix

···
 
 buildPythonPackage rec {
   pname = "equinox";
-  version = "0.11.10";
+  version = "0.11.11";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "patrick-kidger";
     repo = "equinox";
     tag = "v${version}";
-    hash = "sha256-QoqwLdtWCDrXyqiI6Xw7jq2sxiRCmLaxk3/ZGHrvqL4=";
+    hash = "sha256-xCAk9qac2ZmevUMMRgBokLKuGWyrF4fGpN03li49cR8=";
   };
 
   build-system = [ hatchling ];

pkgs/development/python-modules/flet-cli/default.nix

···
+{
+  lib,
+  buildPythonPackage,
+  flet-client-flutter,
+
+  # build-system
+  poetry-core,
+
+  flet,
+  flet-desktop,
+  flet-web,
+  qrcode,
+  toml,
+  watchdog,
+}:
+
+buildPythonPackage rec {
+  pname = "flet-cli";
+  inherit (flet-client-flutter) version src;
+  pyproject = true;
+
+  sourceRoot = "${src.name}/sdk/python/packages/flet-cli";
+
+  build-system = [ poetry-core ];
+
+  dependencies = [
+    flet
+    flet-desktop
+    flet-web
+    qrcode
+    toml
+    watchdog
+  ];
+
+  pythonRelaxDeps = [
+    "qrcode"
+    "watchdog"
+  ];
+
+  makeWrapperArgs = [
+    "--prefix"
+    "PYTHONPATH"
+    ":"
+    "$PYTHONPATH"
+  ];
+
+  postInstall = ''
+    mkdir -p $out/bin
+    makeWrapper ${flet}/bin/flet $out/bin/flet \
+      --prefix PYTHONPATH : $PYTHONPATH
+  '';
+
+  pythonImportsCheck = [ "flet_cli" ];
+
+  meta = {
+    description = "Command-line interface tool for Flet, a framework for building interactive multi-platform applications using Python.";
+    homepage = "https://flet.dev/";
+    changelog = "https://github.com/flet-dev/flet/releases/tag/v${version}";
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [
+      heyimnova
+      lucasew
+    ];
+    mainProgram = "flet";
+  };
+}

pkgs/development/python-modules/flet-core/default.nix

···
-{
-  lib,
-  buildPythonPackage,
-  flet-client-flutter,
-
-  # build-system
-  poetry-core,
-
-  # propagates
-  typing-extensions,
-  repath,
-}:
-
-buildPythonPackage rec {
-  pname = "flet-core";
-  inherit (flet-client-flutter) version src;
-  pyproject = true;
-
-  sourceRoot = "${src.name}/sdk/python/packages/flet-core";
-
-  nativeBuildInputs = [ poetry-core ];
-
-  propagatedBuildInputs = [
-    repath
-    typing-extensions
-  ];
-
-  doCheck = false;
-
-  meta = {
-    changelog = "https://github.com/flet-dev/flet/releases/tag/v${version}";
-    description = "Library is the foundation of Flet framework and is not intended to be used directly";
-    homepage = "https://flet.dev/";
-    license = lib.licenses.asl20;
-    maintainers = with lib.maintainers; [
-      heyimnova
-      lucasew
-    ];
-  };
-}

pkgs/development/python-modules/flet-desktop/default.nix

···
+{
+  lib,
+  buildPythonPackage,
+  flet-client-flutter,
+
+  # build-system
+  poetry-core,
+
+  flet,
+}:
+
+buildPythonPackage rec {
+  pname = "flet-desktop";
+  inherit (flet-client-flutter) version src;
+  pyproject = true;
+
+  sourceRoot = "${src.name}/sdk/python/packages/flet-desktop";
+
+  build-system = [ poetry-core ];
+
+  dependencies = [ flet ];
+
+  _flet_setup_view = ''
+    if 'FLET_VIEW_PATH' not in os.environ:
+      os.environ['FLET_VIEW_PATH'] = '${flet-client-flutter}/bin'
+  '';
+  postPatch = ''
+    echo "$_flet_setup_view" >> src/flet_desktop/__init__.py
+  '';
+
+  pythonImportsCheck = [ "flet_desktop" ];
+
+  meta = {
+    description = "Compiled Flutter Flet desktop client.";
+    homepage = "https://flet.dev/";
+    changelog = "https://github.com/flet-dev/flet/releases/tag/v${version}";
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [
+      heyimnova
+      lucasew
+    ];
+  };
+}

pkgs/development/python-modules/flet-runtime/_setup_runtime.py

···
-import os
-if 'FLET_VIEW_PATH' not in os.environ:
-  os.environ["FLET_VIEW_PATH"] = "@flet-client-flutter@/bin"

pkgs/development/python-modules/flet-runtime/default.nix

···
-{
-  lib,
-  buildPythonPackage,
-  flet-client-flutter,
-  poetry-core,
-  flet-core,
-  httpx,
-  oauthlib,
-}:
-
-buildPythonPackage rec {
-  pname = "flet-runtime";
-  inherit (flet-client-flutter) version src;
-
-  pyproject = true;
-
-  sourceRoot = "${src.name}/sdk/python/packages/flet-runtime";
-
-  postPatch = ''
-    substitute ${./_setup_runtime.py} src/flet_runtime/_setup_runtime.py \
-      --replace @flet-client-flutter@ ${flet-client-flutter}
-
-    echo -e "import flet_runtime._setup_runtime\n$(cat src/flet_runtime/__init__.py)" > src/flet_runtime/__init__.py
-  '';
-
-  nativeBuildInputs = [
-    poetry-core
-  ];
-
-  pythonRelaxDeps = [ "httpx" ];
-
-  propagatedBuildInputs = [
-    flet-core
-    httpx
-    oauthlib
-  ];
-
-  pythonImportsCheck = [ "flet_runtime" ];
-
-  meta = {
-    changelog = "https://github.com/flet-dev/flet/releases/tag/v${version}";
-    description = "Base package for Flet desktop and Flet mobile";
-    homepage = "https://flet.dev/";
-    license = lib.licenses.asl20;
-    maintainers = with lib.maintainers; [ lucasew ];
-  };
-}

pkgs/development/python-modules/flet-web/default.nix

···
+{
+  lib,
+  buildPythonPackage,
+  flet-client-flutter,
+
+  # build-system
+  poetry-core,
+
+  flet,
+  fastapi,
+  uvicorn,
+  python,
+}:
+
+buildPythonPackage rec {
+  pname = "flet-web";
+  inherit (flet-client-flutter) version src;
+  pyproject = true;
+
+  sourceRoot = "${src.name}/sdk/python/packages/flet-web";
+
+  build-system = [ poetry-core ];
+
+  dependencies = [
+    flet
+    fastapi
+    uvicorn
+  ];
+
+  pythonImportsCheck = [ "flet_web" ];
+
+  web = flet-client-flutter.override {
+    fletTarget = "web";
+  };
+
+  postInstall = ''
+    ln -s $web $out/${python.sitePackages}/flet_web/web
+  '';
+
+  meta = {
+    description = "Flet web client in Flutter.";
+    homepage = "https://flet.dev/";
+    changelog = "https://github.com/flet-dev/flet/releases/tag/v${version}";
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [
+      heyimnova
+      lucasew
+    ];
+  };
+}

pkgs/development/python-modules/flet/default.nix

···
 
   # build-system
   poetry-core,
+  pytestCheckHook,
 
   # propagates
   fastapi,
-  flet-core,
-  flet-runtime,
   httpx,
   oauthlib,
   packaging,
   qrcode,
+  repath,
   cookiecutter,
   uvicorn,
   watchdog,
   websocket-client,
   websockets,
-
 }:
 
 buildPythonPackage rec {
   pname = "flet";
   inherit (flet-client-flutter) version src;
-
   pyproject = true;
 
   sourceRoot = "${src.name}/sdk/python/packages/flet";
 
-  nativeBuildInputs = [
-    poetry-core
-  ];
+  build-system = [ poetry-core ];
+
+  nativeCheckInputs = [ pytestCheckHook ];
 
   makeWrapperArgs = [
     "--prefix"
···
     "$PYTHONPATH"
   ];
 
-  pythonRelaxDeps = [
-    "cookiecutter"
-    "packaging"
-    "qrcode"
-    "watchdog"
-    "websockets"
-  ];
+  _flet_version = ''
+    version = "${version}"
+    def update_version():
+      pass
+  '';
+  _flet_utils_pip = ''
+    def install_flet_package(name: str):
+      pass
+  '';
 
-  propagatedBuildInputs = [
+  postPatch = ''
+     # nerf out nagging about pip
+    echo "$_flet_version" > src/flet/version.py
+    echo "$_flet_utils_pip" >> src/flet/utils/pip.py
+  '';
+
+  dependencies = [
     fastapi
-    flet-core
-    flet-runtime
     uvicorn
     websocket-client
     watchdog
···
     websockets
     httpx
     packaging
+    repath
     qrcode
     cookiecutter
     fastapi
     uvicorn
   ];
-
-  doCheck = false;
 
   pythonImportsCheck = [ "flet" ];
 

pkgs/development/python-modules/jax-cuda12-pjrt/default.nix

···
+{
+  lib,
+  stdenv,
+  buildPythonPackage,
+  fetchurl,
+  autoAddDriverRunpath,
+  autoPatchelfHook,
+  pypaInstallHook,
+  wheelUnpackHook,
+  cudaPackages,
+  python,
+  jaxlib,
+}:
+let
+  inherit (jaxlib) version;
+  inherit (cudaPackages) cudaVersion;
+
+  cudaLibPath = lib.makeLibraryPath (
+    with cudaPackages;
+    [
+      (lib.getLib cuda_cudart) # libcudart.so
+      (lib.getLib cuda_cupti) # libcupti.so
+      (lib.getLib cudnn) # libcudnn.so
+      (lib.getLib libcufft) # libcufft.so
+      (lib.getLib libcusolver) # libcusolver.so
+      (lib.getLib libcusparse) # libcusparse.so
+    ]
+  );
+
+  # Find new releases at https://storage.googleapis.com/jax-releases
+  # When upgrading, you can get these hashes from prefetch.sh. See
+  # https://github.com/google/jax/issues/12879 as to why this specific URL is the correct index.
+
+  # upstream does not distribute jax-cuda12-pjrt 0.4.38 binaries for aarch64-linux
+  srcs = {
+    "x86_64-linux" = fetchurl {
+      url = "https://storage.googleapis.com/jax-releases/cuda12_plugin/jax_cuda12_pjrt-${version}-py3-none-manylinux2014_x86_64.whl";
+      hash = "sha256-g75MWfvPMAd6YAhdmOfVncc4sckeDWKOSsF3n94VrCs=";
+    };
+    "aarch64-linux" = fetchurl {
+      url = "https://storage.googleapis.com/jax-releases/cuda12_plugin/jax_cuda12_pjrt-${version}-py3-none-manylinux2014_aarch64.whl";
+      hash = "sha256-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=";
+    };
+  };
+in
+buildPythonPackage {
+  pname = "jax-cuda12-pjrt";
+  inherit version;
+  pyproject = false;
+
+  src =
+    srcs.${stdenv.hostPlatform.system}
+      or (throw "jax-cuda12-pjrt: No src for ${stdenv.hostPlatform.system}");
+
+  nativeBuildInputs = [
+    autoAddDriverRunpath
+    autoPatchelfHook
+    pypaInstallHook
+    wheelUnpackHook
+  ];
+
+  # The following attributes (buildInputs, postInstall and preInstallCheck) are copied from jaxlib-0.4.28
+  # but it does not recognize GPUs as of 2024-12-29
+  # Dynamic link dependencies
+  buildInputs = [ (lib.getLib stdenv.cc.cc) ];
+
+  # jaxlib looks for ptxas at runtime, eg when running `jax.random.PRNGKey(0)`.
+  # Linking into $out is the least bad solution. See
+  # * https://github.com/NixOS/nixpkgs/pull/164176#discussion_r828801621
+  # * https://github.com/NixOS/nixpkgs/pull/288829#discussion_r1493852211
+  # for more info.
+  postInstall = ''
+    mkdir -p $out/${python.sitePackages}/jaxlib/cuda/bin
+    ln -s ${lib.getExe' cudaPackages.cuda_nvcc "ptxas"} $out/${python.sitePackages}/jaxlib/cuda/bin/ptxas
+  '';
+
+  # jaxlib contains shared libraries that open other shared libraries via dlopen
+  # and these implicit dependencies are not recognized by ldd or
+  # autoPatchelfHook. That means we need to sneak them into rpath. This step
+  # must be done after autoPatchelfHook and the automatic stripping of
+  # artifacts. autoPatchelfHook runs in postFixup and auto-stripping runs in the
+  # patchPhase.
+  preInstallCheck = ''
+    shopt -s globstar
+
+    for file in $out/**/*.so; do
+      echo $file
+      patchelf --add-rpath "${cudaLibPath}" "$file"
+    done
+  '';
+
+  # no tests
+  doCheck = false;
+
+  pythonImportsCheck = [ "jax_plugins.xla_cuda12" ];
+
+  meta = {
+    description = "JAX XLA PJRT Plugin for NVIDIA GPUs";
+    homepage = "https://github.com/jax-ml/jax/tree/main/jax_plugins/cuda";
+    sourceProvenance = [ lib.sourceTypes.binaryNativeCode ];
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ natsukium ];
+    platforms = lib.attrNames srcs;
+    # see CUDA compatibility matrix
+    # https://jax.readthedocs.io/en/latest/installation.html#pip-installation-nvidia-gpu-cuda-installed-locally-harder
+    broken =
+      !(lib.versionAtLeast cudaVersion "12.1")
+      || !(lib.versionAtLeast cudaPackages.cudnn.version "9.1")
+      || true;
+  };
+}

pkgs/development/python-modules/jax-cuda12-plugin/default.nix

···
+{
+  lib,
+  stdenv,
+  buildPythonPackage,
+  fetchPypi,
+  autoAddDriverRunpath,
+  autoPatchelfHook,
+  pypaInstallHook,
+  wheelUnpackHook,
+  cudaPackages,
+  python,
+  jaxlib,
+  jax-cuda12-pjrt,
+}:
+let
+  inherit (cudaPackages) cudaVersion;
+  inherit (jaxlib) version;
+
+  getSrcFromPypi =
+    {
+      platform,
+      dist,
+      hash,
+    }:
+    fetchPypi {
+      inherit
+        version
+        platform
+        dist
+        hash
+        ;
+      pname = "jax_cuda12_plugin";
+      format = "wheel";
+      python = dist;
+      abi = dist;
+    };
+
+  # upstream does not distribute jax-cuda12-plugin 0.4.38 binaries for aarch64-linux
+  srcs = {
+    "3.10-x86_64-linux" = getSrcFromPypi {
+      platform = "manylinux2014_x86_64";
+      dist = "cp310";
+      hash = "sha256-nULpmc1k3VZ8FJ7Wj3k5K6iGRDZCGLtjbNzvoBl8kv4=";
+    };
+    "3.10-aarch64-linux" = getSrcFromPypi {
+      platform = "manylinux2014_aarch64";
+      dist = "cp310";
+      hash = "sha256-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=";
+    };
+    "3.11-x86_64-linux" = getSrcFromPypi {
+      platform = "manylinux2014_x86_64";
+      dist = "cp311";
+      hash = "sha256-cEZUOG8OYAoCgdquqViCqmekfttoOTthsbFzx+jKdKg=";
+    };
+    "3.11-aarch64-linux" = getSrcFromPypi {
+      platform = "manylinux2014_aarch64";
+      dist = "cp311";
+      hash = "sha256-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=";
+    };
+    "3.12-x86_64-linux" = getSrcFromPypi {
+      platform = "manylinux2014_x86_64";
+      dist = "cp312";
+      hash = "sha256-Ufas/3Ew63LrsCU039NYGg9eoGlx3lLX68Ia1Nh/5x4=";
+    };
+    "3.12-aarch64-linux" = getSrcFromPypi {
+      platform = "manylinux2014_aarch64";
+      dist = "cp312";
+      hash = "sha256-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=";
+    };
+    "3.13-x86_64-linux" = getSrcFromPypi {
+      platform = "manylinux2014_x86_64";
+      dist = "cp313";
+      hash = "sha256-CSKKTCtEO3aozZqOwikGAInEzINuBiSWh1ptb9xm0x8=";
+    };
+    "3.13-aarch64-linux" = getSrcFromPypi {
+      platform = "manylinux2014_aarch64";
+      dist = "cp313";
+      hash = "sha256-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=";
+    };
+  };
+in
+buildPythonPackage {
+  pname = "jax-cuda12-plugin";
+  inherit version;
+  pyproject = false;
+
+  src = (
+    srcs."${python.pythonVersion}-${stdenv.hostPlatform.system}"
+      or (throw "python${python.pythonVersion}Packages.jax-cuda12-plugin is not supported on ${stdenv.hostPlatform.system}")
+  );
+
+  nativeBuildInputs = [
+    autoAddDriverRunpath
+    autoPatchelfHook
+    pypaInstallHook
+    wheelUnpackHook
+  ];
+
+  dependencies = [ jax-cuda12-pjrt ];
+
+  pythonImportsCheck = [ "jax_cuda12_plugin" ];
+
+  meta = {
+    description = "JAX Plugin for CUDA12";
+    homepage = "https://github.com/jax-ml/jax/tree/main/jax_plugins/cuda";
+    sourceProvenance = [ lib.sourceTypes.binaryNativeCode ];
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ natsukium ];
+    platforms = lib.platforms.linux;
+    # see CUDA compatibility matrix
+    # https://jax.readthedocs.io/en/latest/installation.html#pip-installation-nvidia-gpu-cuda-installed-locally-harder
+    broken =
+      !(lib.versionAtLeast cudaVersion "12.1")
+      || !(lib.versionAtLeast cudaPackages.cudnn.version "9.1")
+      || true;
+  };
+}

pkgs/development/python-modules/jax/default.nix

···
 {
   lib,
+  config,
+  stdenv,
   blas,
-  buildPythonPackage,
-  callPackage,
-  setuptools,
-  importlib-metadata,
-  fetchFromGitHub,
-  jaxlib,
-  jaxlib-bin,
-  jaxlib-build,
-  hypothesis,
   lapack,
-  matplotlib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  cudaSupport ? config.cudaSupport,
+
+  # build-system
+  setuptools,
+
+  # dependencies
+  jaxlib,
   ml-dtypes,
   numpy,
   opt-einsum,
+  scipy,
+
+  # optional-dependencies
+  jax-cuda12-plugin,
+
+  # tests
+  cloudpickle,
+  hypothesis,
+  matplotlib,
   pytestCheckHook,
   pytest-xdist,
-  pythonOlder,
-  scipy,
-  stdenv,
+
+  # passthru
+  callPackage,
+  jax,
+  jaxlib-build,
+  jaxlib-bin,
 }:
 
 let
···
 in
 buildPythonPackage rec {
   pname = "jax";
-  version = "0.4.28";
+  version = "0.4.38";
   pyproject = true;
-
-  disabled = pythonOlder "3.9";
 
   src = fetchFromGitHub {
     owner = "google";
     repo = "jax";
     # google/jax contains tags for jax and jaxlib. Only use jax tags!
-    rev = "refs/tags/jax-v${version}";
-    hash = "sha256-qSHPwi3is6Ts7pz5s4KzQHBMbcjGp+vAOsejW3o36Ek=";
+    tag = "jax-v${version}";
+    hash = "sha256-H8I9Mkz6Ia1RxJmnuJOSevLGHN2J8ey59ZTlFx8YfnA=";
   };
 
-  nativeBuildInputs = [ setuptools ];
+  build-system = [ setuptools ];
 
   # The version is automatically set to ".dev" if this variable is not set.
   # https://github.com/google/jax/commit/e01f2617b85c5bdffc5ffb60b3d8d8ca9519a1f3
   JAX_RELEASE = "1";
 
-  # jaxlib is _not_ included in propagatedBuildInputs because there are
-  # different versions of jaxlib depending on the desired target hardware. The
-  # JAX project ships separate wheels for CPU, GPU, and TPU.
-  propagatedBuildInputs = [
+  dependencies = [
+    jaxlib
     ml-dtypes
     numpy
     opt-einsum
     scipy
-  ] ++ lib.optional (pythonOlder "3.10") importlib-metadata;
+  ] ++ lib.optionals cudaSupport optional-dependencies.cuda;
+
+  optional-dependencies = rec {
+    cuda = [ jax-cuda12-plugin ];
+    cuda12 = cuda;
+    cuda12_pip = cuda;
+    cuda12_local = cuda;
+  };
 
   nativeCheckInputs = [
+    cloudpickle
     hypothesis
-    jaxlib
     matplotlib
     pytestCheckHook
     pytest-xdist
···
   # which creates a circular dependency. See https://discourse.nixos.org/t/how-to-nix-ify-python-packages-with-circular-dependencies/14648/2.
   # Not a big deal, this is how the JAX docs suggest running the test suite
   # anyhow.
-  pytestFlagsArray = [
-    "--numprocesses=4"
-    "-W ignore::DeprecationWarning"
-    "tests/"
-  ];
+  pytestFlagsArray =
+    [
+      "--numprocesses=4"
+      "-W ignore::DeprecationWarning"
+      "tests/"
+    ]
+    ++ lib.optionals stdenv.hostPlatform.isDarwin [
+      # SystemError: nanobind::detail::nb_func_error_except(): exception could not be translated!
+      "--deselect tests/shape_poly_test.py::ShapePolyTest"
+      "--deselect tests/tree_util_test.py::TreeTest"
+    ];
 
   # Prevents `tests/export_back_compat_test.py::CompatTest::test_*` tests from failing on darwin with
   # PermissionError: [Errno 13] Permission denied: '/tmp/back_compat_testdata/test_*.py'
···
       # Fails on some hardware due to some numerical error
       # See https://github.com/google/jax/issues/18535
       "testQdwhWithOnRankDeficientInput5"
+    ]
+    ++ lib.optionals stdenv.hostPlatform.isDarwin [
+      # SystemError: nanobind::detail::nb_func_error_except(): exception could not be translated!
+      "testInAxesPyTreePrefixMismatchError"
+      "testInAxesPyTreePrefixMismatchErrorKwargs"
+      "testOutAxesPyTreePrefixMismatchError"
+      "test_tree_map"
+      "test_vjp_rule_inconsistent_pytree_structures_error"
+      "test_vmap_in_axes_tree_prefix_error"
+      "test_vmap_mismatched_axis_sizes_error_message_issue_705"
     ];
 
-  disabledTestPaths = [
-    # Segmentation fault. See https://gist.github.com/zimbatm/e9b61891f3bcf5e4aaefd13f94344fba
-    "tests/linalg_test.py"
-  ]
-  ++ lib.optionals (stdenv.hostPlatform.isDarwin && stdenv.hostPlatform.isAarch64) [
-    # RuntimeWarning: invalid value encountered in cast
-    "tests/lax_test.py"
-  ];
+  disabledTestPaths =
+    [
+      # Segmentation fault. See https://gist.github.com/zimbatm/e9b61891f3bcf5e4aaefd13f94344fba
+      "tests/linalg_test.py"
+    ]
+    ++ lib.optionals (stdenv.hostPlatform.isDarwin && stdenv.hostPlatform.isAarch64) [
+      # RuntimeWarning: invalid value encountered in cast
+      "tests/lax_test.py"
+    ];
 
   pythonImportsCheck = [ "jax" ];
 
···
   #
   #   NIXPKGS_ALLOW_UNFREE=1 nixglhost -- nix run --impure .#python3Packages.jax.passthru.tests.test_cuda_jaxlibBin
   passthru.tests = {
-    test_cuda_jaxlibSource = callPackage ./test-cuda.nix {
-      jaxlib = jaxlib-build.override { cudaSupport = true; };
-    };
+    # jaxlib-build is broken as of 2024-12-20
+    # test_cuda_jaxlibSource = callPackage ./test-cuda.nix {
+    #   jax = jax.override { jaxlib = jaxlib-build; };
+    # };
     test_cuda_jaxlibBin = callPackage ./test-cuda.nix {
-      jaxlib = jaxlib-bin.override { cudaSupport = true; };
+      jax = jax.override { jaxlib = jaxlib-bin; };
     };
   };
 
   # updater fails to pick the correct branch
   passthru.skipBulkUpdate = true;
 
-  meta = with lib; {
+  meta = {
     description = "Source-built JAX frontend: differentiate, compile, and transform Numpy code";
     longDescription = ''
       This is the JAX frontend package, it's meant to be used together with one of the jaxlib implementations,
       e.g. `python3Packages.jaxlib`, `python3Packages.jaxlib-bin`, or `python3Packages.jaxlibWithCuda`.
     '';
     homepage = "https://github.com/google/jax";
-    license = licenses.asl20;
-    maintainers = with maintainers; [ samuela ];
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ samuela ];
   };
 }

pkgs/development/python-modules/jax/test-cuda.nix

···
 {
   jax,
-  jaxlib,
   pkgs,
 }:
 
···
   {
     libraries = [
       jax
-      jaxlib
-    ];
+    ] ++ jax.optional-dependencies.cuda;
   }
   ''
     import jax

pkgs/development/python-modules/jaxlib/bin.nix

···
 
 {
   absl-py,
-  autoAddDriverRunpath,
   autoPatchelfHook,
   buildPythonPackage,
-  config,
   fetchPypi,
-  fetchurl,
   flatbuffers,
-  jaxlib-build,
   lib,
   ml-dtypes,
   python,
   scipy,
   stdenv,
-  # Options:
-  cudaSupport ? config.cudaSupport,
-  cudaPackages,
 }:
 
 let
-  inherit (cudaPackages) cudaVersion;
-
-  version = "0.4.28";
-
+  version = "0.4.38";
   inherit (python) pythonVersion;
-
-  cudaLibPath = lib.makeLibraryPath (
-    with cudaPackages;
-    [
-      (lib.getLib cuda_cudart) # libcudart.so
-      (lib.getLib cuda_cupti) # libcupti.so
-      (lib.getLib cudnn) # libcudnn.so
-      (lib.getLib libcufft) # libcufft.so
-      (lib.getLib libcusolver) # libcusolver.so
-      (lib.getLib libcusparse) # libcusparse.so
-    ]
-  );
 
   # As of 2023-06-06, google/jax upstream is no longer publishing CPU-only wheels to their GCS bucket. Instead the
   # official instructions recommend installing CPU-only versions via PyPI.
-  cpuSrcs =
+  srcs =
     let
       getSrcFromPypi =
         {
···
         };
     in
     {
-      "3.9-x86_64-linux" = getSrcFromPypi {
-        platform = "manylinux2014_x86_64";
-        dist = "cp39";
-        hash = "sha256-Slbr8FtKTBeRaZ2HTgcvP4CPCYa0AQsU+1SaackMqdw=";
-      };
-      "3.9-aarch64-darwin" = getSrcFromPypi {
-        platform = "macosx_11_0_arm64";
-        dist = "cp39";
-        hash = "sha256-sBVi7IrXVxm30DiXUkiel+trTctMjBE75JFjTVKCrTw=";
-      };
-      "3.9-x86_64-darwin" = getSrcFromPypi {
-        platform = "macosx_10_14_x86_64";
-        dist = "cp39";
-        hash = "sha256-T5jMg3srbG3P4Kt/+esQkxSSCUYRmqOvn6oTlxj/J4c=";
-      };
-
       "3.10-x86_64-linux" = getSrcFromPypi {
         platform = "manylinux2014_x86_64";
         dist = "cp310";
-        hash = "sha256-47zcb45g+FVPQVwU2TATTmAuPKM8OOVGJ0/VRfh1dps=";
+        hash = "sha256-Ya7MuaJ8Z/24RQ9jVyQAGc1FEcudYqROR2R1bThIU60=";
+      };
+      "3.10-aarch64-linux" = getSrcFromPypi {
+        platform = "manylinux2014_aarch64";
+        dist = "cp310";
+        hash = "sha256-7hnBY6j98IOdTBi4il+/tOcxunxDdBbT5Ug+Vwu3ZOQ=";
       };
       "3.10-aarch64-darwin" = getSrcFromPypi {
         platform = "macosx_11_0_arm64";
         dist = "cp310";
-        hash = "sha256-8Djmi9ENGjVUcisLvjbmpEg4RDenWqnSg/aW8O2fjAk=";
+        hash = "sha256-MLL1LLUNdHNK8vR3wlM6elg+O7eyyKzes2Hud9lAV3o=";
       };
       "3.10-x86_64-darwin" = getSrcFromPypi {
         platform = "macosx_10_14_x86_64";
         dist = "cp310";
-        hash = "sha256-pCHSN/jCXShQFm0zRgPGc925tsJvUrxJZwS4eCKXvWY=";
+        hash = "sha256-VcGbnT8zpvxZ9kSqWiH7oCY5zN13bLSptVJmJfV4Of8=";
       };
 
       "3.11-x86_64-linux" = getSrcFromPypi {
         platform = "manylinux2014_x86_64";
         dist = "cp311";
-        hash = "sha256-Rc4PPIQM/4I2z/JsN/Jsn/B4aV+T4MFiwyDCgfUEEnU=";
+        hash = "sha256-J1H/cDfWqZfQvg53zEvjgcWp+buLMU7bdVwTpv2Wn0U=";
+      };
+      "3.11-aarch64-linux" = getSrcFromPypi {
+        platform = "manylinux2014_aarch64";
+        dist = "cp311";
+        hash = "sha256-Q9tYxMQnYnKWNmpWwQMY4fAPUDaQ4X+Uu0NEKT4ZleA=";
       };
       "3.11-aarch64-darwin" = getSrcFromPypi {
         platform = "macosx_11_0_arm64";
         dist = "cp311";
-        hash = "sha256-eThX+vN/Nxyv51L+pfyBH0NeQ7j7S1AgWERKf17M+Ck=";
+        hash = "sha256-P7DqrnNpFXr+y+rVCq8p5z/936d6IzXXIb2XlPPFEOQ=";
       };
       "3.11-x86_64-darwin" = getSrcFromPypi {
         platform = "macosx_10_14_x86_64";
         dist = "cp311";
-        hash = "sha256-L/gpDtx7ksfq5SUX9lSSYz4mey6QZ7rT5MMj0hPnfPU=";
+        hash = "sha256-tn/eq9bf7Qi3do873/tSEWAIX4MFZpvRl77vYdCN4Is=";
       };
 
       "3.12-x86_64-linux" = getSrcFromPypi {
         platform = "manylinux2014_x86_64";
         dist = "cp312";
-        hash = "sha256-RqGqhX9P7uikP8upXA4Kti1AwmzJcwtsaWVZCLo1n40=";
+        hash = "sha256-2tbAqWVnwG0IPARp/sQPIBIQsJk2W9aYvjGm0uyI/Vk=";
+      };
+      "3.12-aarch64-linux" = getSrcFromPypi {
+        platform = "manylinux2014_aarch64";
+        dist = "cp312";
+        hash = "sha256-SW9FsOABojQTCc0MdK8LZwU33O15wWjLIwz8x3PwqoY";
       };
       "3.12-aarch64-darwin" = getSrcFromPypi {
         platform = "macosx_11_0_arm64";
         dist = "cp312";
-        hash = "sha256-jdi//jhTcC9jzZJNoO4lc0pNGc1ckmvgM9dyun0cF10=";
+        hash = "sha256-8zvK/jLJelYuz2iU18QWdMgMCs3t+lQj1Jr1EUcUmHQ=";
       };
       "3.12-x86_64-darwin" = getSrcFromPypi {
         platform = "macosx_10_14_x86_64";
         dist = "cp312";
-        hash = "sha256-1sCaVFMpciRhrwVuc1FG0sjHTCKsdCaoRetp8ya096A=";
+        hash = "sha256-P+/qmF8EFYFvO7r9PwOkNwUCde+brJpywTFOFkSsV8E=";
+      };
+
+      "3.13-x86_64-linux" = getSrcFromPypi {
+        platform = "manylinux2014_x86_64";
+        dist = "cp313";
+        hash = "sha256-LOd7qM2pJZpLypevwcci5CkabEY6Y/jTcsbtyFEX1iU=";
+      };
+      "3.13-aarch64-linux" = getSrcFromPypi {
+        platform = "manylinux2014_aarch64";
+        dist = "cp313";
+        hash = "sha256-JIzKN3Hr8ksHD0lwE2TOraM+YTlEWwbHgsylrFrZK/Q=";
+      };
+      "3.13-aarch64-darwin" = getSrcFromPypi {
+        platform = "macosx_11_0_arm64";
+        dist = "cp313";
+        hash = "sha256-b+MmuK82Y4fdR8zzElg7Kxf+0ScSybdKZIsYoTy9ur8=";
+      };
+      "3.13-x86_64-darwin" = getSrcFromPypi {
+        platform = "macosx_10_14_x86_64";
+        dist = "cp313";
+        hash = "sha256-QeVa5YGKiC5XiehI9vFmh6wTK8+7Wl+hFKXRi3jQXy0=";
       };
     };
-
-  # Note that the prebuilt jaxlib binary requires specific version of CUDA to
-  # work. The cuda12 jaxlib binaries only works with CUDA 12.2, and cuda11
-  # jaxlib binaries only works with CUDA 11.8. This is why we need to find a
-  # binary that matches the provided cudaVersion.
-  gpuSrcVersionString = "cuda${cudaVersion}-${pythonVersion}";
-
-  # Find new releases at https://storage.googleapis.com/jax-releases
-  # When upgrading, you can get these hashes from prefetch.sh. See
-  # https://github.com/google/jax/issues/12879 as to why this specific URL is the correct index.
-  gpuSrcs = {
-    "cuda12.2-3.9" = fetchurl {
-      url = "https://storage.googleapis.com/jax-releases/cuda12/jaxlib-${version}+cuda12.cudnn89-cp39-cp39-manylinux2014_x86_64.whl";
-      hash = "sha256-d8LIl22gIvmWfoyKfXKElZJXicPQIZxdS4HumhwQGCw=";
-    };
-    "cuda12.2-3.10" = fetchurl {
-      url = "https://storage.googleapis.com/jax-releases/cuda12/jaxlib-${version}+cuda12.cudnn89-cp310-cp310-manylinux2014_x86_64.whl";
-      hash = "sha256-PXtWv+UEcMWF8LhWe6Z1UGkf14PG3dkJ0Iop0LiimnQ=";
-    };
-    "cuda12.2-3.11" = fetchurl {
-      url = "https://storage.googleapis.com/jax-releases/cuda12/jaxlib-${version}+cuda12.cudnn89-cp311-cp311-manylinux2014_x86_64.whl";
-      hash = "sha256-QO2WSOzmJ48VaCha596mELiOfPsAGLpGctmdzcCHE/o=";
-    };
-    "cuda12.2-3.12" = fetchurl {
-      url = "https://storage.googleapis.com/jax-releases/cuda12/jaxlib-${version}+cuda12.cudnn89-cp312-cp312-manylinux2014_x86_64.whl";
-      hash = "sha256-ixWMaIChy4Ammsn23/3cCoala0lFibuUxyUr3tjfFKU=";
-    };
-  };
 in
 buildPythonPackage {
   pname = "jaxlib";
   inherit version;
   format = "wheel";
 
-  disabled =
-    !(
-      pythonVersion == "3.9"
-      || pythonVersion == "3.10"
-      || pythonVersion == "3.11"
-      || pythonVersion == "3.12"
-    );
-
   # See https://discourse.nixos.org/t/ofborg-does-not-respect-meta-platforms/27019/6.
-  src =
-    if !cudaSupport then
-      (cpuSrcs."${pythonVersion}-${stdenv.hostPlatform.system}"
-        or (throw "jaxlib-bin is not supported on ${stdenv.hostPlatform.system}")
-      )
-    else
-      gpuSrcs."${gpuSrcVersionString}" or (throw "jaxlib-bin: No gpuSrc for ${gpuSrcVersionString}");
+  src = (
+    srcs."${pythonVersion}-${stdenv.hostPlatform.system}"
+      or (throw "jaxlib-bin is not supported on ${stdenv.hostPlatform.system}")
+  );
 
   # Prebuilt wheels are dynamically linked against things that nix can't find.
   # Run `autoPatchelfHook` to automagically fix them.
-  nativeBuildInputs =
-    lib.optionals stdenv.hostPlatform.isLinux [ autoPatchelfHook ]
-    ++ lib.optionals cudaSupport [ autoAddDriverRunpath ];
+  nativeBuildInputs = lib.optionals stdenv.hostPlatform.isLinux [ autoPatchelfHook ];
   # Dynamic link dependencies
   buildInputs = [ (lib.getLib stdenv.cc.cc) ];
 
-  # jaxlib contains shared libraries that open other shared libraries via dlopen
-  # and these implicit dependencies are not recognized by ldd or
-  # autoPatchelfHook. That means we need to sneak them into rpath. This step
-  # must be done after autoPatchelfHook and the automatic stripping of
-  # artifacts. autoPatchelfHook runs in postFixup and auto-stripping runs in the
-  # patchPhase.
-  preInstallCheck = lib.optional cudaSupport ''
-    shopt -s globstar
-
-    for file in $out/**/*.so; do
-      patchelf --add-rpath "${cudaLibPath}" "$file"
-    done
-  '';
-
-  propagatedBuildInputs = [
+  dependencies = [
     absl-py
     flatbuffers
     ml-dtypes
     scipy
   ];
 
-  # jaxlib looks for ptxas at runtime, eg when running `jax.random.PRNGKey(0)`.
-  # Linking into $out is the least bad solution. See
-  # * https://github.com/NixOS/nixpkgs/pull/164176#discussion_r828801621
-  # * https://github.com/NixOS/nixpkgs/pull/288829#discussion_r1493852211
-  # for more info.
-  postInstall = lib.optional cudaSupport ''
-    mkdir -p $out/${python.sitePackages}/jaxlib/cuda/bin
-    ln -s ${lib.getExe' cudaPackages.cuda_nvcc "ptxas"} $out/${python.sitePackages}/jaxlib/cuda/bin/ptxas
-  '';
+  pythonImportsCheck = [ "jaxlib" ];
 
-  inherit (jaxlib-build) pythonImportsCheck;
-
-  meta = with lib; {
+  meta = {
     description = "Prebuilt jaxlib backend from PyPi";
     homepage = "https://github.com/google/jax";
-    sourceProvenance = with sourceTypes; [ binaryNativeCode ];
-    license = licenses.asl20;
-    maintainers = with maintainers; [ samuela ];
-    platforms = [
-      "aarch64-darwin"
-      "x86_64-linux"
-      "x86_64-darwin"
-    ];
-    broken =
-      !(cudaSupport -> lib.versionAtLeast cudaVersion "11.1")
-      || !(cudaSupport -> lib.versionAtLeast cudaPackages.cudnn.version "8.2")
-      || !(cudaSupport -> stdenv.hostPlatform.isLinux)
-      || !(cudaSupport -> (gpuSrcs ? "cuda${cudaVersion}-${pythonVersion}"))
+    sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ samuela ];
+    badPlatforms = [
       # Fails at pythonImportsCheckPhase:
       # ...-python-imports-check-hook.sh/nix-support/setup-hook: line 10: 28017 Illegal instruction: 4
       # /nix/store/5qpssbvkzfh73xih07xgmpkj5r565975-python3-3.11.9/bin/python3.11 -c
       # 'import os; import importlib; list(map(lambda mod: importlib.import_module(mod), os.environ["pythonImportsCheck"].split()))'
-      || (stdenv.hostPlatform.isDarwin && stdenv.hostPlatform.isx86_64);
+      "x86_64-darwin"
+    ];
   };
 }

pkgs/development/python-modules/jaxlib/prefetch.sh

···
 #! nix-shell -i sh -p jq
 
 prefetch () {
-    expr="(import <nixpkgs> { system = \"$2\"; config.cudaSupport = $3; }).python$1.pkgs.jaxlib-bin.src.url"
+    expr="(import <nixpkgs> { system = \"$2\"; config.cudaSupport = true; }).python$1.pkgs.$3.src.url"
     url=$(NIX_PATH=.. nix-instantiate --eval -E "$expr" | jq -r)
     echo "$url"
     sha256=$(nix-prefetch-url "$url")
-    nix hash to-sri --type sha256 "$sha256"
+    nix hash convert --to sri --hash-algo sha256 "$sha256"
     echo
 }
 
-for py in "39" "310" "311" "312"; do
-    prefetch "$py" "x86_64-linux" "false"
-    prefetch "$py" "aarch64-darwin" "false"
-    prefetch "$py" "x86_64-darwin" "false"
-    prefetch "$py" "x86_64-linux" "true"
+for py in "310" "311" "312" "313"; do
+    prefetch "$py" "x86_64-linux" "jaxlib-bin"
+    prefetch "$py" "aarch64-linux" "jaxlib-bin"
+    prefetch "$py" "aarch64-darwin" "jaxlib-bin"
+    prefetch "$py" "x86_64-darwin" "jaxlib-bin"
+    prefetch "$py" "x86_64-linux" "jax-cuda12-plugin"
+    prefetch "$py" "aarch64-linux" "jax-cuda12-plugin"
+done
+
+for arch in "x86_64-linux" "aarch64-linux"; do
+    prefetch "312" "$arch" "jax-cuda12-pjrt"
 done

pkgs/development/python-modules/jinja2-strcase/default.nix

···
+{
+  lib,
+  buildPythonPackage,
+  fetchPypi,
+  freezegun,
+  jinja2,
+  pytestCheckHook,
+  setuptools,
+}:
+
+buildPythonPackage rec {
+  pname = "jinja2-strcase";
+  version = "0.0.2";
+  pyproject = true;
+
+  src = fetchPypi {
+    inherit pname version;
+    hash = "sha256-2Qw3971A00WqzI94sIf2bmxapMloqyOnkVc/z3VsM3k=";
+  };
+
+  build-system = [ setuptools ];
+
+  dependencies = [ jinja2 ];
+
+  nativeCheckInputs = [
+    freezegun
+    pytestCheckHook
+  ];
+
+  pythonImportsCheck = [ "jinja2_strcase" ];
+
+  doCheck = false; # no tests
+
+  meta = {
+    homepage = "https://github.com/marchmiel/jinja2-strcase";
+    description = "Library for converting string case in Jinja2 templates";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ crimeminister ];
+  };
+}

pkgs/development/python-modules/librosa/default.nix

···
   # build-system
   setuptools,
 
-  # runtime
+  # dependencies
   audioread,
   decorator,
   joblib,
···
   src = fetchFromGitHub {
     owner = "librosa";
     repo = "librosa";
-    rev = "refs/tags/${version}";
+    tag = version;
     fetchSubmodules = true; # for test data
     hash = "sha256-0FbKVAFWmcFTW2dR27nif6hPZeIxFWYF1gTm4BEJZ/Q=";
   };
 
-  nativeBuildInputs = [ setuptools ];
+  build-system = [ setuptools ];
 
   patches = [
     (fetchpatch2 {
···
       url = "https://github.com/librosa/librosa/commit/d0a12c87cdff715ffb8ac1c7383bba1031aa71e4.patch";
       hash = "sha256-NHuGo4U1FRikb5OIkycQBvuZ+0OdG/VykTcuhXkLUug=";
     })
+    # Fix numpy2 test incompatibilities
+    # TODO: remove when updating to the next release
+    (fetchpatch2 {
+      name = "numpy2-support-tests";
+      url = "https://github.com/librosa/librosa/commit/7eb0a09e703a72a5979049ec546a522c70285aff.patch";
+      hash = "sha256-m9UpSDKOAr7qzTtahVQktu259cp8QDYjDChpQV0xuY0=";
+    })
   ];
 
   postPatch = ''
···
       --replace-fail "--cov-report term-missing --cov librosa --cov-report=xml " ""
   '';
 
-  propagatedBuildInputs = [
+  dependencies = [
     audioread
     decorator
     joblib
···
   ] ++ optional-dependencies.matplotlib;
 
   preCheck = ''
-    export HOME=$TMPDIR
+    export HOME=$(mktemp -d)
   '';
 
   disabledTests =
···
       "test_unknown_axis"
       "test_axis_bound_warning"
       "test_auto_aspect"
+    ]
+    ++ lib.optionals (stdenv.hostPlatform.isLinux && stdenv.hostPlatform.isAarch64) [
+      # Flaky (numerical comparison fails)
+      "test_istft_multi"
+      "test_pitch_shift_multi"
+      "test_time_stretch_multi"
     ];
 
-  meta = with lib; {
+  meta = {
     description = "Python library for audio and music analysis";
     homepage = "https://github.com/librosa/librosa";
     changelog = "https://github.com/librosa/librosa/releases/tag/${version}";
-    license = licenses.isc;
-    maintainers = with maintainers; [ GuillaumeDesforges ];
+    license = lib.licenses.isc;
+    maintainers = with lib.maintainers; [ GuillaumeDesforges ];
   };
 }

pkgs/development/python-modules/locust/default.nix

···
+{
+  lib,
+  buildPythonPackage,
+  python,
+  callPackage,
+  fetchFromGitHub,
+  poetry-core,
+  poetry-dynamic-versioning,
+  pytestCheckHook,
+  configargparse,
+  cryptography,
+  flask,
+  flask-cors,
+  flask-login,
+  gevent,
+  geventhttpclient,
+  msgpack,
+  psutil,
+  pyquery,
+  pyzmq,
+  requests,
+  retry,
+  tomli,
+  werkzeug,
+}:
+
+buildPythonPackage rec {
+  pname = "locust";
+  version = "2.31.2";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "locustio";
+    repo = "locust";
+    rev = "refs/tags/${version}";
+    hash = "sha256-xDquVQjkWVER9h0a6DHWRZH6KtRf0jsThycSojDEdh4=";
+  };
+
+  postPatch = ''
+    substituteInPlace pyproject.toml \
+      --replace-fail 'script = "pre_build.py"' ""
+
+    substituteInPlace locust/test/test_main.py \
+      --replace-fail '"locust"' '"${placeholder "out"}/bin/locust"'
+
+    substituteInPlace locust/test/test_log.py \
+      --replace-fail '"locust"' '"${placeholder "out"}/bin/locust"'
+  '';
+
+  webui = callPackage ./webui.nix {
+    inherit version;
+    src = "${src}/locust/webui";
+  };
+
+  preBuild = ''
+    mkdir -p $out/${python.sitePackages}/${pname}
+    ln -sf ${webui} $out/${python.sitePackages}/${pname}/webui
+  '';
+
+  build-system = [
+    poetry-core
+    poetry-dynamic-versioning
+  ];
+
+  pythonRelaxDeps = [
+    # version 0.7.0.dev0 is not considered to be >= 0.6.3
+    "flask-login"
+  ];
+
+  dependencies = [
+    configargparse
+    flask
+    flask-cors
+    flask-login
+    gevent
+    geventhttpclient
+    msgpack
+    psutil
+    pyzmq
+    requests
+    tomli
+    werkzeug
+  ];
+
+  pythonImportsCheck = [ "locust" ];
+
+  nativeCheckInputs = [
+    cryptography
+    pyquery
+    pytestCheckHook
+    retry
+  ];
+
+  # locust's test suite is very flaky, due to heavy reliance on timing-based tests and access to the
+  # network.
+  doCheck = false;
+
+  meta = {
+    description = "Developer-friendly load testing framework";
+    homepage = "https://docs.locust.io/";
+    changelog = "https://github.com/locustio/locust/blob/${version}/CHANGELOG.md";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ jokatzke ];
+  };
+}

pkgs/development/python-modules/locust/webui.nix

···
+{
+  stdenv,
+  fetchYarnDeps,
+  yarnConfigHook,
+  yarnBuildHook,
+  nodejs,
+  version,
+  src,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "locust-ui";
+  inherit version src;
+
+  yarnOfflineCache = fetchYarnDeps {
+    yarnLock = "${finalAttrs.src}/yarn.lock";
+    hash = "sha256-ek02mjB8DsBUOR28WSuqj6oVvxTq8EKTNXWFFI3OhuU=";
+  };
+
+  nativeBuildInputs = [
+    yarnConfigHook
+    yarnBuildHook
+    nodejs
+  ];
+
+  dontNpmPrune = true;
+  yarnBuildScript = "build";
+  postInstall = ''
+    mkdir -p $out/dist
+    cp -r dist/** $out/dist
+  '';
+})

pkgs/development/python-modules/nifty8/default.nix

···
 {
-  config,
   lib,
   stdenv,
   buildPythonPackage,
   fetchFromGitLab,
-
-  cudaSupport ? config.cudaSupport,
 
   # build-system
   setuptools,
···
     ducc0
     h5py
     jax
-    (jaxlib.override { inherit cudaSupport; })
+    jaxlib
     matplotlib
     mpi4py
     mpi

pkgs/development/python-modules/ollama/default.nix

···
   httpx,
   pillow,
   poetry-core,
+  pydantic,
   pytest-asyncio,
   pytest-httpserver,
   pytestCheckHook,
···
 
 buildPythonPackage rec {
   pname = "ollama";
-  version = "0.3.3";
+  version = "0.4.4";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
···
     owner = "ollama";
     repo = "ollama-python";
     rev = "refs/tags/v${version}";
-    hash = "sha256-27OJwPvHBxCdaiHk8EQ2s1OeBzgsrzp1MjgKHNgvz+A=";
+    hash = "sha256-GW/4adrU6/4cM96U6A8Btgv7Qt1jtSFJr9F8+zwTEpk=";
   };
 
   postPatch = ''
···
 
   nativeCheckInputs = [
     pillow
+    pydantic
     pytest-asyncio
     pytest-httpserver
     pytestCheckHook

pkgs/development/python-modules/pymunk/default.nix

···
   buildPythonPackage,
   fetchPypi,
   python,
+  setuptools,
   cffi,
   pytestCheckHook,
   pythonOlder,
···
 
 buildPythonPackage rec {
   pname = "pymunk";
-  version = "6.5.2";
-  format = "setuptools";
+  version = "6.9.0";
+  pyproject = true;
 
-  disabled = pythonOlder "3.7";
+  disabled = pythonOlder "3.8";
 
   src = fetchPypi {
     inherit pname version;
-    extension = "zip";
-    hash = "sha256-AV6upaZcnbKmQm9tTItRB6LpckappjdHvMH/awn/KeE=";
+    hash = "sha256-dl98VhqFmhtWW8UXpHzDmS1iWOhg+RdMUzAzwhivY8M=";
   };
 
-  propagatedBuildInputs = [ cffi ];
+  nativeBuildInputs = [ cffi ];
+
+  build-system = [ setuptools ];
+
+  dependencies = [ cffi ];
 
   buildInputs = lib.optionals stdenv.hostPlatform.isDarwin [ ApplicationServices ];
 

pkgs/development/python-modules/tree-sitter-html/default.nix

···
 
 buildPythonPackage rec {
   pname = "tree-sitter-html";
-  version = "0.20.3";
+  version = "0.23.2";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "tree-sitter";
     repo = "tree-sitter-html";
-    rev = "v${version}";
-    hash = "sha256-sHy3fVWemJod18HCQ8zBC/LpeCCPH0nzhI1wrkCg8nw=";
+    tag = "v${version}";
+    hash = "sha256-Pd5Me1twLGOrRB3pSMVX9M8VKenTK0896aoLznjNkGo=";
   };
 
   build-system = [

pkgs/development/python-modules/tree-sitter-json/default.nix

···
 
 buildPythonPackage rec {
   pname = "tree-sitter-json";
-  version = "0.21.0";
+  version = "0.24.8";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "tree-sitter";
     repo = "tree-sitter-json";
-    rev = "v${version}";
-    hash = "sha256-waejAbS7MjrE7w03MPqvBRpEpqTcKc6RgKCVSYaDV1Y=";
+    tag = "v${version}";
+    hash = "sha256-DNZC2cTy1C8OaMOpEHM6NoRtOIbLaBf0CLXXWCKODlw=";
   };
 
   build-system = [

pkgs/development/python-modules/tree-sitter-python/default.nix

···
 
 buildPythonPackage rec {
   pname = "tree-sitter-python";
-  version = "0.23.2";
+  version = "0.23.6";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "tree-sitter";
     repo = "tree-sitter-python";
-    rev = "v${version}";
-    hash = "sha256-cOBG2xfFJ0PpR1RIKW1GeeNeOBA9DAP/N4RXRGYp3yw=";
+    tag = "v${version}";
+    hash = "sha256-71Od4sUsxGEvTwmXX8hBvzqD55hnXkVJublrhp1GICg=";
   };
 
   build-system = [

pkgs/development/python-modules/tree-sitter-rust/default.nix

···
 
 buildPythonPackage rec {
   pname = "tree-sitter-rust";
-  version = "0.21.2";
+  version = "0.23.2";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "tree-sitter";
     repo = "tree-sitter-rust";
-    rev = "v${version}";
-    hash = "sha256-4CTh6fKSV8TuMHLAfEKWsAeCqeCM2uo6hVmF5KWhyPY=";
+    tag = "v${version}";
+    hash = "sha256-aT+tlrEKMgWqTEq/NHh8Vj92h6i1aU6uPikDyaP2vfc=";
   };
 
   build-system = [

pkgs/development/python-modules/whenever/default.nix

···
 
 buildPythonPackage rec {
   pname = "whenever";
-  version = "0.6.15";
+  version = "0.6.16";
   pyproject = true;
 
   disabled = pythonOlder "3.9";
···
     owner = "ariebovenberg";
     repo = "whenever";
     rev = "refs/tags/${version}";
-    hash = "sha256-zCtHvgAQ05zmT6U7CAspG65fE4tPyS/+/gId048DbeA=";
+    hash = "sha256-aTFbO3mBcX+a9Zqp7SXjEx2+ix+J8g4n8V3KEyatAXY=";
   };
 
   cargoDeps = rustPlatform.fetchCargoTarball {
     inherit src;
-    hash = "sha256-sCwjo3KU4u+2FsWz8CJiqXKSaIKX6DFe1eCkIzRXF3s=";
+    hash = "sha256-8xSw7VEfRKXMpwn7HKhrvgLV3Sy3TAmLHjm0WZF/2aY=";
   };
 
   build-system = [

pkgs/development/tools/electron/common.nix

···
   chromium,
   nodejs,
   python3,
+  fetchpatch,
   fetchYarnDeps,
   fetchNpmDeps,
   fixup-yarn-lock,
···
 
   src = null;
 
-  patches = base.patches;
+  patches =
+    base.patches
+    ++ lib.optionals (lib.versionOlder info.version "32") [
+      # Backport a few fixes for -Wmissing-template-arg-list-after-template-kw
+      # which only effects the soon-to-be-EOLed electron 31 (chromium M126).
+      # https://issues.chromium.org/issues/344680447
+
+      # https://chromium-review.googlesource.com/c/chromium/src/+/5604664
+      (fetchpatch {
+        url = "https://github.com/chromium/chromium/commit/b0088fa60970412160535c367e2ff53b25b8538e.patch";
+        hash = "sha256-eEYO+IN1062iCqVr6eO3UZlGLN376lMXc6UQunJGpdQ=";
+      })
+
+      # https://android-review.googlesource.com/c/platform/external/perfetto/+/3114454
+      (fetchpatch {
+        name = "perfetto-e2f661907a717551235563389977b7468da6d45e.patch";
+        url = "https://android.googlesource.com/platform/external/perfetto/+/e2f661907a717551235563389977b7468da6d45e^!?format=TEXT";
+        decode = "base64 -d";
+        stripLen = 1;
+        extraPrefix = "third_party/perfetto/";
+        hash = "sha256-5zSAZZI1tR7O4Aui22T/6uyk0RpuIy7XqDD0nwlDySQ=";
+      })
+
+      ./electron-31-perfetto-missing-template-arg-list.patch
+
+      # And a finally fix for -Winvalid-constexpr that is happening within the electron patchset.
+      # https://github.com/electron/electron/pull/42413/commits/394a26f94a3fbce91e15e80e8e73b9a3ec1f04d1
+      (fetchpatch {
+        url = "https://github.com/electron/electron/commit/394a26f94a3fbce91e15e80e8e73b9a3ec1f04d1.patch";
+        stripLen = 1;
+        extraPrefix = "electron/";
+        hash = "sha256-lllUUDm1thnC+rH8hBtPBVLRx6Pis5TPEUeQli9z1Mk=";
+      })
+    ];
 
   unpackPhase =
     ''

pkgs/development/tools/electron/electron-31-perfetto-missing-template-arg-list.patch

···
+diff --git a/include/perfetto/tracing/internal/track_event_data_source.h b/include/perfetto/tracing/internal/track_event_data_source.h
+index 1d924b271..dba896262 100644
+--- a/third_party/perfetto/include/perfetto/tracing/internal/track_event_data_source.h
++++ b/third_party/perfetto/include/perfetto/tracing/internal/track_event_data_source.h
+@@ -1061,7 +1061,7 @@ class TrackEventDataSource
+       const TrackType& track,
+       std::function<void(protos::pbzero::TrackDescriptor*)> callback) {
+     TrackRegistry::Get()->UpdateTrack(track, std::move(callback));
+-    Base::template Trace([&](typename Base::TraceContext ctx) {
++    Base::Trace([&](typename Base::TraceContext ctx) {
+       TrackEventInternal::WriteTrackDescriptor(
+           track, ctx.tls_inst_->trace_writer.get(), ctx.GetIncrementalState(),
+           *ctx.GetCustomTlsState(), TrackEventInternal::GetTraceTime());

pkgs/servers/home-assistant/custom-lovelace-modules/universal-remote-card/package.nix

···
 
 buildNpmPackage rec {
   pname = "universal-remote-card";
-  version = "4.3.1";
+  version = "4.3.3";
 
   src = fetchFromGitHub {
     owner = "Nerwyn";
     repo = "android-tv-card";
     rev = version;
-    hash = "sha256-w8bA+Jzs72RWPw26YoBYz1YtY7a1zXEA1+gWpSVjVNI=";
+    hash = "sha256-MNEu/2GyRqyaLgaEtDQT53Bjjxbd+ZUJtLJNmSTriig=";
   };
 
   patches = [ ./dont-call-git.patch ];
 
-  npmDepsHash = "sha256-ha/P47C88HVrSZK5vQXdMUhIoqnP0cspwoLYzVM+mVI=";
+  npmDepsHash = "sha256-gYXF7yqpjas797v74HTEw7qv8b7ZLb956qqJzbsGUXg=";
 
   installPhase = ''
     runHook preInstall

pkgs/servers/mautrix-signal/default.nix

···
 
 buildGoModule rec {
   pname = "mautrix-signal";
-  version = "0.7.3";
+  version = "0.7.4";
 
   src = fetchFromGitHub {
     owner = "mautrix";
     repo = "signal";
     rev = "v${version}";
-    hash = "sha256-VU0VZkh1sjOuSI+/JXZKWQF5pZ3NebBFbDdsOgaocg4=";
+    hash = "sha256-1UI2oYDnmwy9+URBMA2yTBMEoFsE8qnkhn7E0l/lOTs=";
   };
 
   buildInputs =
···
 
   CGO_LDFLAGS = lib.optional withGoolm [ "-lstdc++" ];
 
-  vendorHash = "sha256-fERAigormEy6+240AOkMyrjMDj5/eU0Lo4wD0AuAn+4=";
+  vendorHash = "sha256-ADuW6KMNUwJeGqFlQsJ8qSI0alPQpSAFx1zrhwsAmsI=";
 
   doCheck = true;
   preCheck =

pkgs/servers/web-apps/wordpress/packages/plugins.json

···
     "sha256": "1svp2a3xr6ajfhabz2n4rqcf9bzfr9dilc2n27ral9akc86lj1ii",
     "version": "5.3.2"
   },
+  "wp-fail2ban-addon-contact-form-7": {
+    "path": "wp-fail2ban-addon-contact-form-7/tags/2.0.0",
+    "rev": "3069647",
+    "sha256": "05qfh64dja3dbzs4z7y0gn9b0bm2a03babr3qkjn6g9v4wa6m36i",
+    "version": "2.0.0"
+  },
   "wp-fastest-cache": {
     "path": "wp-fastest-cache/tags/1.3.2",
     "rev": "3181365",

pkgs/servers/web-apps/wordpress/packages/wordpress-plugins.json

···
 , "worker": "gpl3Plus"
 , "wp-change-email-sender": "gpl2Plus"
 , "wp-fail2ban": "gpl3Plus"
+, "wp-fail2ban-addon-contact-form-7": "gpl3Plus"
 , "wp-fastest-cache": "gpl2Plus"
 , "wp-gdpr-compliance": "gpl2Plus"
 , "wp-import-export-lite": "gpl3Plus"

pkgs/tools/archivers/arj/default.nix

···
-{
-  stdenv,
-  lib,
-  fetchurl,
-  fetchpatch,
-  autoreconfHook,
-}:
-
-stdenv.mkDerivation rec {
-  pname = "arj";
-  version = "3.10.22";
-
-  src = fetchurl {
-    url = "mirror://sourceforge/${pname}/${pname}-${version}.tar.gz";
-    sha256 = "1nx7jqxwqkihhdmdbahhzqhjqshzw1jcsvwddmxrwrn8rjdlr7jq";
-  };
-
-  patches = [
-    (fetchpatch {
-      url = "https://sources.debian.org/data/main/a/arj/3.10.22-24/debian/patches/001_arches_align.patch";
-      sha256 = "0i3qclm2mh98c04rqpx1r4qagd3wpxlkj7lvq0ddpkmr8bm0fh0m";
-    })
-
-    (fetchpatch {
-      url = "https://sources.debian.org/data/main/a/arj/3.10.22-24/debian/patches/002_no_remove_static_const.patch";
-      sha256 = "0zfjqmjsj0y1kfzxbp29v6nxq5qwgazhb9clqc544sm5zn0bdp8n";
-    })
-
-    (fetchpatch {
-      url = "https://sources.debian.org/data/main/a/arj/3.10.22-24/debian/patches/003_64_bit_clean.patch";
-      sha256 = "0mda9fkaqf2s1xl6vlbkbq20362h3is9dpml9kfmacpbifl4dx3n";
-    })
-
-    (fetchpatch {
-      url = "https://sources.debian.org/data/main/a/arj/3.10.22-24/debian/patches/004_parallel_build.patch";
-      sha256 = "0gam6k7jknzmbjlf1r6c9kjh5s5h76pd31v59cnaqiycwiy8z6q9";
-    })
-
-    (fetchpatch {
-      url = "https://sources.debian.org/data/main/a/arj/3.10.22-24/debian/patches/005_use_system_strnlen.patch";
-      sha256 = "0q0ypm8mdsxd0rl1k0id6fdx5m7mvqgwcla4r250cmc6zqzpib6d";
-    })
-
-    (fetchpatch {
-      url = "https://sources.debian.org/data/main/a/arj/3.10.22-24/debian/patches/006_use_safe_strcpy.patch";
-      sha256 = "1garad95s34cix3kd77lz37andrcnz19glzkfdnkjaq7ldvzwikc";
-    })
-
-    (fetchpatch {
-      url = "https://sources.debian.org/data/main/a/arj/3.10.22-24/debian/patches/hurd_no_fcntl_getlk.patch";
-      sha256 = "0b3hpn4qypimrw9ar2n4h24886sl6pmim4lb4ly1wqcq0f73arva";
-    })
-
-    (fetchpatch {
-      url = "https://sources.debian.org/data/main/a/arj/3.10.22-24/debian/patches/security_format.patch";
-      sha256 = "0q67cvln55p38bm0xwd2cgppqmkp2nfar2pg1zj78f7ncn35lbvf";
-    })
-
-    (fetchpatch {
-      url = "https://sources.debian.org/data/main/a/arj/3.10.22-24/debian/patches/doc_refer_robert_k_jung.patch";
-      sha256 = "1wxdx0m6a9vdvjlaycwsissn75l1ni7grg8n6qmkynz2vrcvgzb1";
-    })
-
-    (fetchpatch {
-      url = "https://sources.debian.org/data/main/a/arj/3.10.22-24/debian/patches/gnu_build_fix.patch";
-      sha256 = "19ycp1rak7l6ql28m50v95ls621w3sl8agw5r5va73svkgh8hc3g";
-    })
-
-    (fetchpatch {
-      url = "https://sources.debian.org/data/main/a/arj/3.10.22-24/debian/patches/gnu_build_flags.patch";
-      sha256 = "1jw1y9i9lw1idgi4l9cycwsql1hcz1m4f3k2iybwsgx0acaw695q";
-    })
-
-    (fetchpatch {
-      url = "https://sources.debian.org/data/main/a/arj/3.10.22-24/debian/patches/gnu_build_strip.patch";
-      sha256 = "1b18khj6cxnjyqk2ycygwqlcs20hrsbf4h6bckl99dxnpbq5blxi";
-    })
-
-    (fetchpatch {
-      url = "https://sources.debian.org/data/main/a/arj/3.10.22-24/debian/patches/gnu_build_pie.patch";
-      sha256 = "1jqswxgc1plipblf055n9175fbanfi6fb67lnzk8dcvxjn227fs3";
-    })
-
-    (fetchpatch {
-      url = "https://sources.debian.org/data/main/a/arj/3.10.22-24/debian/patches/self_integrity_64bit.patch";
-      sha256 = "0s5zdq81a0f83hdg9hy6lqn3xvckx9y9r20awczm9mbf11vi01cb";
-    })
-
-    (fetchpatch {
-      url = "https://sources.debian.org/data/main/a/arj/3.10.22-24/debian/patches/security-afl.patch";
-      sha256 = "0yajcwpghij8wg21a0kkp3f9x7anz5m121jx2vnkyn04bvi9541a";
-    })
-
-    (fetchpatch {
-      url = "https://sources.debian.org/data/main/a/arj/3.10.22-24/debian/patches/security-traversal-dir.patch";
-      sha256 = "10lv3867k0wm2s0cyf40hkxfqbjaxm4aph5ivk2q2rjkracrn2y4";
-    })
-
-    (fetchpatch {
-      url = "https://sources.debian.org/data/main/a/arj/3.10.22-24/debian/patches/security-traversal-symlink.patch";
-      sha256 = "095pdfskxwh0jnyy31dpz10s2ppv8n7lvvn4q722y3g71d0c79qq";
-    })
-
-    (fetchpatch {
-      url = "https://sources.debian.org/data/main/a/arj/3.10.22-24/debian/patches/out-of-bounds-read.patch";
-      sha256 = "0ps9lqkbqzlhzr2bnr47sir431z1nywr7nagkmk42iki4d96v0jq";
-    })
-
-    (fetchpatch {
-      url = "https://sources.debian.org/data/main/a/arj/3.10.22-24/debian/patches/remove_build_date.patch";
-      sha256 = "1vjlfq6firxpj068l9acyqs77mfydn1rwgr2jmxgsy9mq0fw1dsc";
-    })
-
-    (fetchpatch {
-      url = "https://sources.debian.org/data/main/a/arj/3.10.22-24/debian/patches/reproducible_help_archive.patch";
-      sha256 = "0l3qi9f140pwc6fk8qdbxx4g9d8zlf45asimmr8wfpbi4pf59n8i";
-    })
-
-    (fetchpatch {
-      url = "https://sources.debian.org/data/main/a/arj/3.10.22-24/debian/patches/gnu_build_cross.patch";
-      sha256 = "1vb0vbh3jbxj192q47vg3f41l343ghcz2ypbrrm2bkbpwm5cl8qr";
-    })
-
-    (fetchpatch {
-      url = "https://sources.debian.org/data/main/a/arj/3.10.22-24/debian/patches/fix-time_t-usage.patch";
-      sha256 = "012c6pnf5y4jwn715kxn3vjy088rm905959j6yh8bslyx84qaijv";
-    })
-
-    (fetchpatch {
-      url = "https://sources.debian.org/data/main/a/arj/3.10.22-24/debian/patches/gnu_build_fix_autoreconf.patch";
-      sha256 = "0yhxbdasnbqcg1nyx2379fpbr7fmdlv4n2nlxrv1z1vbc7rlvw9d";
-    })
-  ];
-
-  nativeBuildInputs = [ autoreconfHook ];
-
-  postPatch = lib.optionalString stdenv.hostPlatform.isDarwin ''
-    substituteInPlace environ.c \
-        --replace "  #include <sys/statfs.h>" "  #include <sys/mount.h>"
-  '';
-
-  preAutoreconf = ''
-    cd gnu
-  '';
-
-  postConfigure = ''
-    cd ..
-  '';
-
-  meta = with lib; {
-    description = "Open-source implementation of the world-famous ARJ archiver";
-    longDescription = ''
-      This version of ARJ has been created with an intent to preserve maximum
-      compatibility and retain the feature set of the original ARJ archiver as
-      provided by ARJ Software, Inc.
-    '';
-    license = licenses.gpl2Plus;
-    maintainers = [ maintainers.sander ];
-    platforms = platforms.unix;
-  };
-}

pkgs/tools/package-management/apt-dater/default.nix pkgs/by-name/ap/apt-dater/package.nix

···
   libxml2,
   ncurses,
   popt,
+  libxslt,
   screen,
 }:
 
 stdenv.mkDerivation rec {
   pname = "apt-dater";
-  version = "1.0.4";
+  version = "1.0.4-unstable-2024-10-04";
 
   src = fetchFromGitHub {
     owner = "DE-IBH";
     repo = "apt-dater";
-    rev = "v${version}";
-    sha256 = "1r6gz9jkh1wxi11mcq5p9mqg0szclsaq8ic79vnfnbjdrmmdfi4y";
+    rev = "113ea9b72d318f316ea7cac8ddad5be004787a22";
+    hash = "sha256-/Ufa/pEbqD25kp+k0zm9MuLS1zG+xWqhpBkL7ng2+Bo=";
   };
 
   nativeBuildInputs = [
···
 
   prePatch = ''
     substituteInPlace etc/Makefile.am \
-      --replace 02770 0770
+      --replace-fail 02770 0770
   '';
 
   postPatch = ''
     substituteInPlace configure.ac \
-      --replace "/usr/bin/screen" "${screen}/bin/screen"
+      --replace-fail "/usr/bin/screen" "${screen}/bin/screen" \
+      --replace-fail "/usr/bin/xsltproc" "${libxslt}/bin/xsltproc" \
+      --replace-fail "man/Makefile" "" # Need /usr/share/xml/docbook/stylesheet/nwalsh can't find in nixpkgs
+    substituteInPlace Makefile.am \
+      --replace-fail "man" ""
+    substituteInPlace build/screen_sockpath \
+      --replace-fail "/usr/bin/screen" "${screen}/bin/screen"
+  '';
+
+  postInstall = ''
+    substituteInPlace $out/bin/adsh \
+      --replace-fail "apt-dater" "$out/bin/apt-dater"
   '';
 
   doCheck = true;
 
-  meta = with lib; {
+  meta = {
     homepage = "https://github.com/DE-IBH/apt-dater";
     description = "Terminal-based remote package update manager";
     longDescription = ''
···
       number of remote hosts using SSH. It supports Debian-based managed hosts
       as well as rug (e.g. openSUSE) and yum (e.g. CentOS) based systems.
     '';
-    license = licenses.gpl2Plus;
-    maintainers = with maintainers; [ c0bw3b ];
+    license = lib.licenses.gpl2Plus;
+    mainProgram = "apt-dater";
+    maintainers = with lib.maintainers; [ c0bw3b ];
   };
 }

pkgs/top-level/aliases.nix

···
   gcj = gcj6; # Added 2024-09-13
   gcj6 = throw "gcj6 has been removed from Nixpkgs, as it is unmaintained and obsolete"; # Added 2024-09-13
   gcolor2 = throw "'gcolor2' has been removed due to lack of maintenance upstream and depending on gtk2. Consider using 'gcolor3' or 'eyedropper' instead"; # Added 2024-09-15
+  gdome2 = throw "'gdome2' has been removed from nixpkgs, as it is umaintained and obsolete"; # Added 2024-12-29
   geos_3_11 = throw "geos_3_11 has been removed from nixpgks. Please use a more recent 'geos' instead.";
   gfortran48 = throw "'gfortran48' has been removed from nixpkgs"; # Added 2024-09-10
   gfortran49 = throw "'gfortran49' has been removed from nixpkgs"; # Added 2024-09-11

pkgs/top-level/all-packages.nix

···
 
   apitrace = libsForQt5.callPackage ../applications/graphics/apitrace { };
 
-  arj = callPackage ../tools/archivers/arj {
-    stdenv = gccStdenv;
-  };
-
   arpack-mpi = arpack.override { useMpi = true; };
 
   inherit (callPackages ../data/fonts/arphic {})
···
   amule-web = amule.override {
     monolithic = false;
     httpServer = true;
-  };
-
-  apt-dater = callPackage ../tools/package-management/apt-dater {
-    autoreconfHook = buildPackages.autoreconfHook269;
   };
 
   bashate = python3Packages.callPackage ../development/tools/bashate {
···
   };
 
   uniscribe = callPackage ../tools/text/uniscribe { };
-
-  gallery-dl = python3Packages.callPackage ../applications/misc/gallery-dl { };
 
   gandi-cli = python3Packages.callPackage ../tools/networking/gandi-cli { };
 
···
 
   wordnet = callPackage ../applications/misc/wordnet {
     inherit (darwin.apple_sdk.frameworks) Cocoa;
-  };
-
-  workrave = callPackage ../applications/misc/workrave {
-    inherit (python3Packages) jinja2;
-    inherit (gst_all_1) gstreamer gst-plugins-base gst-plugins-good;
   };
 
   worldengine-cli = python3Packages.worldengine;

pkgs/top-level/perl-packages.nix

···
 
   NetDNS = buildPerlPackage {
     pname = "Net-DNS";
-    version = "1.44";
+    version = "1.48";
     src = fetchurl {
-      url = "mirror://cpan/authors/id/N/NL/NLNETLABS/Net-DNS-1.44.tar.gz";
-      hash = "sha256-E9ftxLjOoBMhR/qsNXH2s8cdHQz9hExTDFoET0o+wx4=";
+      url = "mirror://cpan/authors/id/N/NL/NLNETLABS/Net-DNS-1.48.tar.gz";
+      hash = "sha256-5V8+caMcK4VgJL9QYbEWCwP4edgBNUFPONgiBHaUR1M=";
     };
     propagatedBuildInputs = [ DigestHMAC ];
     makeMakerFlags = [ "--noonline-tests" ];

pkgs/top-level/python-packages.nix

···
 
   flet = callPackage ../development/python-modules/flet { };
 
-  flet-core = callPackage ../development/python-modules/flet-core { };
+  flet-cli = callPackage ../development/python-modules/flet-cli { };
 
-  flet-runtime = callPackage ../development/python-modules/flet-runtime { };
+  flet-desktop = callPackage ../development/python-modules/flet-desktop { };
+
+  flet-web = callPackage ../development/python-modules/flet-web { };
 
   flexcache = callPackage ../development/python-modules/flexcache { };
 
···
 
   jax = callPackage ../development/python-modules/jax { };
 
+  jax-cuda12-pjrt = callPackage ../development/python-modules/jax-cuda12-pjrt { };
+
+  jax-cuda12-plugin = callPackage ../development/python-modules/jax-cuda12-plugin { };
+
   jax-jumpy = callPackage ../development/python-modules/jax-jumpy { };
 
-  jaxlib-bin = callPackage ../development/python-modules/jaxlib/bin.nix {
-    inherit (pkgs.config) cudaSupport;
-  };
+  jaxlib-bin = callPackage ../development/python-modules/jaxlib/bin.nix { };
 
   jaxlib-build = callPackage ../development/python-modules/jaxlib rec {
     # Some platforms don't have `cudaSupport` defined, hence the need for 'or false'.
···
     IOKit = pkgs.darwin.apple_sdk_11_0.IOKit;
   };
 
-  # Use the -bin on macOS since the source build doesn't support it (see #323154)
-  jaxlib = if jaxlib-build.meta.unsupported then jaxlib-bin else jaxlib-build;
-
-  jaxlibWithCuda = self.jaxlib.override {
-    cudaSupport = true;
-  };
-
-  jaxlibWithoutCuda = self.jaxlib.override {
-    cudaSupport = false;
-  };
+  jaxlib = jaxlib-bin;
 
   jaxopt = callPackage ../development/python-modules/jaxopt { };
 
···
   jinja2-git = callPackage ../development/python-modules/jinja2-git { };
 
   jinja2-pluralize = callPackage ../development/python-modules/jinja2-pluralize { };
+
+  jinja2-strcase = callPackage ../development/python-modules/jinja2-strcase { };
 
   jinja2-time = callPackage ../development/python-modules/jinja2-time { };
 
···
   locket = callPackage ../development/python-modules/locket { };
 
   lockfile = callPackage ../development/python-modules/lockfile { };
+
+  locust = callPackage ../development/python-modules/locust { };
 
   log-symbols = callPackage ../development/python-modules/log-symbols { };