Merge staging-next into staging

nixos/doc/manual/release-notes/rl-2505.section.md

···
 - `services.paperless` now installs `paperless-manage` as a normal system package instead of creating a symlink in `/var/lib/paperless`.
   `paperless-manage` now also changes to the appropriate user when being executed.
 
+- The `gotenberg` package has been updated to 8.16.0, which brings breaking changes to the configuration from version 8.13.0. See the [upstream release notes](https://github.com/gotenberg/gotenberg/releases/tag/v8.13.0)
+  for that release to get all the details. The `services.gotenberg` module has been updated appropriately to ensure your configuration is valid with this new release.
+
 - `asusd` has been upgraded to version 6 which supports multiple aura devices. To account for this, the single `auraConfig` configuration option has been replaced with `auraConfigs` which is an attribute set of config options per each device. The config files may also be now specified as either source files or text strings; to account for this you will need to specify that `text` is used for your existing configs, e.g.:
   ```diff
   -services.asusd.asusdConfig = '''file contents'''

nixos/modules/services/misc/gotenberg.nix

···
       "--chromium-max-queue-size=${toString cfg.chromium.maxQueueSize}"
       "--libreoffice-restart-after=${toString cfg.libreoffice.restartAfter}"
       "--libreoffice-max-queue-size=${toString cfg.libreoffice.maxQueueSize}"
-      "--pdfengines-engines=${lib.concatStringsSep "," cfg.pdfEngines}"
+      "--pdfengines-merge-engines=${lib.concatStringsSep "," cfg.pdfEngines.merge}"
+      "--pdfengines-convert-engines=${lib.concatStringsSep "," cfg.pdfEngines.convert}"
+      "--pdfengines-read-metadata-engines=${lib.concatStringsSep "," cfg.pdfEngines.readMetadata}"
+      "--pdfengines-write-metadata-engines=${lib.concatStringsSep "," cfg.pdfEngines.writeMetadata}"
+      "--api-download-from-allow-list=${cfg.downloadFrom.allowList}"
+      "--api-download-from-max-retry=${toString cfg.downloadFrom.maxRetries}"
     ]
     ++ optional cfg.enableBasicAuth "--api-enable-basic-auth"
     ++ optional cfg.chromium.autoStart "--chromium-auto-start"
     ++ optional cfg.chromium.disableJavascript "--chromium-disable-javascript"
     ++ optional cfg.chromium.disableRoutes "--chromium-disable-routes"
     ++ optional cfg.libreoffice.autoStart "--libreoffice-auto-start"
-    ++ optional cfg.libreoffice.disableRoutes "--libreoffice-disable-routes";
+    ++ optional cfg.libreoffice.disableRoutes "--libreoffice-disable-routes"
+    ++ optional cfg.pdfEngines.disableRoutes "--pdfengines-disable-routes"
+    ++ optional (
+      cfg.downloadFrom.denyList != null
+    ) "--api-download-from-deny-list=${cfg.downloadFrom.denyList}"
+    ++ optional cfg.downloadFrom.disable "--api-disable-download-from"
+    ++ optional (cfg.bodyLimit != null) "--api-body-limit=${cfg.bodyLimit}"
+    ++ lib.optionals (cfg.extraArgs != [ ]) cfg.extraArgs;
 
   inherit (lib)
     mkEnableOption
···
         description = "Port on which the API should listen.";
       };
 
+      bindIP = mkOption {
+        type = types.nullOr types.str;
+        default = "127.0.0.1";
+        description = "Port the API listener should bind to. Set to 0.0.0.0 to listen on all available IPs.";
+      };
+
       timeout = mkOption {
         type = types.nullOr types.str;
         default = "30s";
···
           If you set this, be sure to set `GOTENBERG_API_BASIC_AUTH_USERNAME`and `GOTENBERG_API_BASIC_AUTH_PASSWORD`
           in your `services.gotenberg.environmentFile` file.
         '';
+      };
+
+      bodyLimit = mkOption {
+        type = types.nullOr types.str;
+        default = null;
+        description = "Sets the max limit for `multipart/form-data` requests. Accepts values like '5M', '20G', etc.";
       };
 
       extraFontPackages = mkOption {
···
         };
       };
 
+      downloadFrom = {
+        allowList = mkOption {
+          type = types.nullOr types.str;
+          default = ".*";
+          description = "Allow these URLs to be used in the `downloadFrom` API field. Accepts a regular expression.";
+        };
+        denyList = mkOption {
+          type = types.nullOr types.str;
+          default = null;
+          description = "Deny accepting URLs from these domains in the `downloadFrom` API field. Accepts a regular expression.";
+        };
+        maxRetries = mkOption {
+          type = types.int;
+          default = 4;
+          description = "The maximum amount of times to retry downloading a file specified with `downloadFrom`.";
+        };
+        disable = mkOption {
+          type = types.bool;
+          default = false;
+          description = "Whether to disable the ability to download files for conversion from outside sources.";
+        };
+      };
+
       libreoffice = {
         package = mkPackageOption pkgs "libreoffice" { };
 
···
         };
       };
 
-      pdfEngines = mkOption {
-        type = types.listOf (
-          types.enum [
-            "pdftk"
+      pdfEngines = {
+        merge = mkOption {
+          type = types.listOf (
+            types.enum [
+              "qpdf"
+              "pdfcpu"
+              "pdftk"
+            ]
+          );
+          default = [
             "qpdf"
-            "libreoffice-pdfengine"
-            "exiftool"
             "pdfcpu"
-          ]
-        );
-        default = [
-          "pdftk"
-          "qpdf"
-          "libreoffice-pdfengine"
-          "exiftool"
-          "pdfcpu"
-        ];
-        description = ''
-          PDF engines to enable. Each one can be used to perform a specific task.
-          See [the documentation](https://gotenberg.dev/docs/configuration#pdf-engines) for more details.
-          Defaults to all possible PDF engines.
-        '';
+            "pdftk"
+          ];
+          description = "PDF Engines to use for merging files.";
+        };
+        convert = mkOption {
+          type = types.listOf (
+            types.enum [
+              "libreoffice-pdfengine"
+            ]
+          );
+          default = [
+            "libreoffice-pdfengine"
+          ];
+          description = "PDF Engines to use for converting files.";
+        };
+        readMetadata = mkOption {
+          type = types.listOf (
+            types.enum [
+              "exiftool"
+            ]
+          );
+          default = [
+            "exiftool"
+          ];
+          description = "PDF Engines to use for reading metadata from files.";
+        };
+        writeMetadata = mkOption {
+          type = types.listOf (
+            types.enum [
+              "exiftool"
+            ]
+          );
+          default = [
+            "exiftool"
+          ];
+          description = "PDF Engines to use for writing metadata to files.";
+        };
+
+        disableRoutes = mkOption {
+          type = types.bool;
+          default = false;
+          description = "Disable routes related to PDF engines.";
+        };
       };
 
       logLevel = mkOption {
···
           See `services.gotenberg.enableBasicAuth` for the names of those variables.
         '';
       }
+      {
+        assertion = !(lib.isList cfg.pdfEngines);
+        message = ''
+          Setting `services.gotenberg.pdfEngines` to a list is now deprecated.
+          Use the new `pdfEngines.mergeEngines`, `pdfEngines.convertEngines`, `pdfEngines.readMetadataEngines`, and `pdfEngines.writeMetadataEngines` settings instead.
+
+          The previous option was using a method that is now deprecated by upstream.
+        '';
+      }
     ];
 
     systemd.services.gotenberg = {
···
         FONTCONFIG_FILE = pkgs.makeFontsConf {
           fontDirectories = [ pkgs.liberation_ttf_v2 ] ++ cfg.extraFontPackages;
         };
+        # Needed for LibreOffice to work correctly.
+        # https://github.com/NixOS/nixpkgs/issues/349123#issuecomment-2418330936
+        HOME = "/run/gotenberg";
       };
       serviceConfig = {
         Type = "simple";
         DynamicUser = true;
         ExecStart = "${lib.getExe cfg.package} ${lib.escapeShellArgs args}";
+
+        # Needed for LibreOffice to work correctly.
+        # See above issue comment.
+        WorkingDirectory = "/run/gotenberg";
+        RuntimeDirectory = "gotenberg";
 
         # Hardening options
         PrivateDevices = true;
···
         SystemCallFilter = [
           "@sandbox"
           "@system-service"
+          "@chown"
         ];
         SystemCallArchitectures = "native";
 

nixos/modules/services/web-apps/mealie.nix

···
         API_PORT = toString cfg.port;
         BASE_URL = "http://localhost:${toString cfg.port}";
         DATA_DIR = "/var/lib/mealie";
-        CRF_MODEL_PATH = "/var/lib/mealie/model.crfmodel";
+        NLTK_DATA = pkgs.nltk-data.averaged_perceptron_tagger_eng;
       } // (builtins.mapAttrs (_: val: toString val) cfg.settings);
 
       serviceConfig = {

pkgs/applications/editors/vim/plugins/non-generated/sniprun/default.nix

···
   nix-update-script,
 }:
 let
-  version = "1.3.17";
+  version = "1.3.18";
   src = fetchFromGitHub {
     owner = "michaelb";
     repo = "sniprun";
     tag = "v${version}";
-    hash = "sha256-o8U3GXg61dfEzQxrs9zCgRDWonhr628aSPd/l+HxS70=";
+    hash = "sha256-2Q7Jnt7pVCuNne442KPh2cSjA6V6WSZkgUj99UpmnOM=";
   };
   sniprun-bin = rustPlatform.buildRustPackage {
     pname = "sniprun-bin";
     inherit version src;
 
     useFetchCargoVendor = true;
-    cargoHash = "sha256-HLPTt0JCmCM4SRmP8o435ilM1yxoxpAnf8hg3+8C54I=";
+    cargoHash = "sha256-cu7wn75rQcwPLjFl4v05kVMsiCD0mAlIBt49mvIaPPU=";
 
     nativeBuildInputs = [ makeWrapper ];
 

pkgs/applications/networking/browsers/vivaldi/ffmpeg-codecs.nix

···
-{
-  squashfsTools,
-  fetchurl,
-  lib,
-  stdenv,
-}:
-
-# This derivation roughly follows the update-ffmpeg script that ships with the official Vivaldi
-# downloads at https://vivaldi.com/download/
-stdenv.mkDerivation rec {
-  pname = "chromium-codecs-ffmpeg-extra";
-  version = "115541";
-
-  src = fetchurl {
-    url = "https://api.snapcraft.io/api/v1/snaps/download/XXzVIXswXKHqlUATPqGCj2w2l7BxosS8_41.snap";
-    hash = "sha256-a1peHhku+OaGvPyChvLdh6/7zT+v8OHNwt60QUq7VvU=";
-  };
-
-  buildInputs = [ squashfsTools ];
-
-  unpackPhase = ''
-    unsquashfs -dest . $src
-  '';
-
-  installPhase = ''
-    install -vD chromium-ffmpeg-${version}/chromium-ffmpeg/libffmpeg.so $out/lib/libffmpeg.so
-  '';
-
-  meta = with lib; {
-    description = "Additional support for proprietary codecs for Vivaldi";
-    homepage = "https://ffmpeg.org/";
-    sourceProvenance = with sourceTypes; [ binaryNativeCode ];
-    license = licenses.lgpl21;
-    maintainers = with maintainers; [
-      betaboon
-      cawilliamson
-      fptje
-    ];
-    platforms = [ "x86_64-linux" ];
-  };
-}

pkgs/by-name/ev/evcc/package.nix

···
 }:
 
 let
-  version = "0.202.1";
+  version = "0.203.0";
 
   src = fetchFromGitHub {
     owner = "evcc-io";
     repo = "evcc";
     tag = version;
-    hash = "sha256-GMKhlNZLk6R0XZn5I3YP5Eav8wD6WbEr1DM+VVtQtjo=";
+    hash = "sha256-rrpYa73Rl+pLQ3FhnDF+t1uHT7SJJcrx6kjdxXsOfM8=";
   };
 
-  vendorHash = "sha256-K9X63dTWE+dC5yo8LX86pUezm8OHwEHNXwxXHn/4AwU=";
+  vendorHash = "sha256-TqtJlsT/uaqQe/mAh1hw92N3uw6GLkdwh9aIMmdNbkY=";
 
   commonMeta = with lib; {
     license = licenses.mit;
···
 
   npmDeps = fetchNpmDeps {
     inherit src;
-    hash = "sha256-iTrmgNmUoHQWL5tsqhUnd0t1t9qengb6ba9pxYrL9Ks=";
+    hash = "sha256-LaP6Ee13OKwRoAZ7oF/nH8rE5zqFYzrhq6CwPaaF9SE=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/go/gotenberg/package.nix

···
   makeFontsConf,
   liberation_ttf_v2,
   exiftool,
+  pdfcpu,
   nixosTests,
   nix-update-script,
 }:
···
 in
 buildGoModule rec {
   pname = "gotenberg";
-  version = "8.9.1";
+  version = "8.16.0";
 
   src = fetchFromGitHub {
     owner = "gotenberg";
     repo = "gotenberg";
     tag = "v${version}";
-    hash = "sha256-y54DtOYIzFAk05TvXFcLdStfAXim3sVHBkW+R8CrtMM=";
+    hash = "sha256-m8aDhfcUa3QFr+7hzlQFL2wPfcx5RE+3dl5RHzWwau0=";
   };
 
-  vendorHash = "sha256-BYcdqZ8TNEG6popRt+Dg5xW5Q7RmYvdlV+niUNenRG0=";
+  vendorHash = "sha256-EM+Rpo4Zf+aqA56aFeuQ0tbvpTgZhmfv+B7qYI6PXWc=";
 
   postPatch = ''
     find ./pkg -name '*_test.go' -exec sed -i -e 's#/tests#${src}#g' {} \;
+    substituteInPlace pkg/gotenberg/fs_test.go \
+      --replace-fail "/tmp" "/build"
   '';
 
   nativeBuildInputs = [ makeBinaryWrapper ];
···
     pdftk
     qpdf
     unoconv
+    pdfcpu
     mktemp
     jre'
   ];
···
     export QPDF_BIN_PATH=${getExe qpdf}
     export UNOCONVERTER_BIN_PATH=${getExe unoconv}
     export EXIFTOOL_BIN_PATH=${getExe exiftool}
+    export PDFCPU_BIN_PATH=${getExe pdfcpu}
     # LibreOffice needs all of these set to work properly
     export LIBREOFFICE_BIN_PATH=${libreoffice'}
     export FONTCONFIG_FILE=${fontsConf}
···
   '';
 
   # These tests fail with a panic, so disable them.
-  checkFlags = [ "-skip=^TestChromiumBrowser_(screenshot|pdf)$" ];
+  checkFlags =
+    let
+      skippedTests = [
+        "TestChromiumBrowser_(screenshot|pdf)"
+        "TestNewContext"
+      ];
+    in
+    [ "-skip=^${builtins.concatStringsSep "$|^" skippedTests}$" ];
 
   preFixup = ''
     wrapProgram $out/bin/gotenberg \
···
       --set QPDF_BIN_PATH "${getExe qpdf}" \
       --set UNOCONVERTER_BIN_PATH "${getExe unoconv}" \
       --set EXIFTOOL_BIN_PATH "${getExe exiftool}" \
+      --set PDFCPU_BIN_PATH "${getExe pdfcpu}" \
       --set JAVA_HOME "${jre'}"
   '';
 

pkgs/by-name/iv/ivpn-ui/package.nix

···
+{
+  lib,
+  buildNpmPackage,
+  fetchFromGitHub,
+  electron,
+  copyDesktopItems,
+  makeDesktopItem,
+  nix-update-script,
+  makeWrapper,
+  ivpn-service,
+}:
+let
+  version = "3.14.29";
+in
+buildNpmPackage {
+  pname = "ivpn-ui";
+  inherit version;
+
+  src = fetchFromGitHub {
+    owner = "ivpn";
+    repo = "desktop-app";
+    tag = "v${version}";
+    hash = "sha256-8JScty/sGyxzC2ojRpatHpCqEXZw9ksMortIhZnukoU=";
+  };
+
+  sourceRoot = "source/ui";
+
+  npmDepsHash = "sha256-2EsXYNo+rj2v+YkZT6ciEcDAirnEZ5MezFlf9zsb/os=";
+
+  nativeBuildInputs = [
+    copyDesktopItems
+    makeWrapper
+  ];
+
+  env = {
+    ELECTRON_SKIP_BINARY_DOWNLOAD = 1;
+  };
+
+  postBuild = ''
+    cp -r ${electron.dist} electron-dist
+    chmod -R u+w electron-dist
+
+    npm exec electron-builder -- \
+      --dir \
+      -c.electronDist=electron-dist \
+      -c.electronVersion=${electron.version} \
+      --config electron-builder.config.js
+  '';
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p $out/share/ivpn-ui
+    cp -r dist/*-unpacked/{locales,resources{,.pak}} $out/share/ivpn-ui
+
+    install -Dm644 $src/ui/References/Linux/ui/ivpnicon.svg $out/share/icons/hicolor/scalable/apps/ivpn-ui.svg
+
+    makeWrapper ${lib.getExe electron} $out/bin/ivpn-ui \
+      --prefix PATH : ${lib.makeBinPath [ ivpn-service ]} \
+      --add-flags $out/share/ivpn-ui/resources/app.asar \
+      --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--ozone-platform-hint=auto --enable-features=WaylandWindowDecorations --enable-wayland-ime=true}}" \
+      --inherit-argv0
+
+    runHook postInstall
+  '';
+
+  desktopItems = [
+    (makeDesktopItem {
+      name = "ivpn-ui";
+      type = "Application";
+      desktopName = "IVPN";
+      genericName = "VPN Client";
+      comment = "UI interface for IVPN";
+      icon = "ivpn-ui";
+      exec = "ivpn-ui";
+      categories = [ "Network" ];
+      startupNotify = true;
+    })
+  ];
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "UI interface for IVPN";
+    mainProgram = "ivpn-ui";
+    homepage = "https://www.ivpn.net";
+    downloadPage = "https://github.com/ivpn/desktop-app";
+    changelog = "https://github.com/ivpn/desktop-app/releases/tag/v${version}";
+    license = lib.licenses.gpl3Only;
+    maintainers = with lib.maintainers; [ blenderfreaky ];
+    platforms = [ "x86_64-linux" ];
+  };
+}

pkgs/by-name/jd/jdt-language-server/package.nix

···
 }:
 
 let
-  timestamp = "202502271238";
+  timestamp = "202504011455";
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "jdt-language-server";
-  version = "1.45.0";
+  version = "1.46.1";
 
   src = fetchurl {
     url = "https://download.eclipse.org/jdtls/milestones/${finalAttrs.version}/jdt-language-server-${finalAttrs.version}-${timestamp}.tar.gz";
-    hash = "sha256-wJ556Vi+tc5B+ztQl67ARVKYvIihTI5BRitX7bKBJ5c=";
+    hash = "sha256-9DX99ts6oNFZjvDxH4C7IOCeZwCQATgnGcMT7/B94Cw=";
   };
 
   sourceRoot = ".";

pkgs/by-name/ke/keycloak/all-plugins.nix

···
   scim-for-keycloak = callPackage ./scim-for-keycloak { };
   scim-keycloak-user-storage-spi = callPackage ./scim-keycloak-user-storage-spi { };
   keycloak-discord = callPackage ./keycloak-discord { };
+  keycloak-magic-link = callPackage ./keycloak-magic-link { };
   keycloak-metrics-spi = callPackage ./keycloak-metrics-spi { };
   keycloak-restrict-client-auth = callPackage ./keycloak-restrict-client-auth { };
 

pkgs/by-name/ke/keycloak/keycloak-magic-link/default.nix

···
+{
+  lib,
+  fetchFromGitHub,
+  maven,
+  nix-update-script,
+}:
+maven.buildMavenPackage rec {
+  pname = "keycloak-magic-link";
+  version = "0.38";
+
+  src = fetchFromGitHub {
+    owner = "p2-inc";
+    repo = "keycloak-magic-link";
+    tag = "v${version}";
+    hash = "sha256-+fhWxAUlt9UVM81Ua2Mwek3D5Kzzk/Tsugbo0fLyxiA=";
+  };
+
+  mvnHash = "sha256-edBdooR+KqY0JKwxdwTd5AxJ0qn3MV9xLrqYukIq2oY=";
+
+  installPhase = ''
+    runHook preInstall
+    install -Dm644 target/keycloak-magic-link-${version}.jar $out/keycloak-magic-link-${version}.jar
+    runHook postInstall
+  '';
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    homepage = "https://github.com/p2-inc/keycloak-magic-link";
+    description = "Magic Link Authentication for Keycloak";
+    license = lib.licenses.elastic20;
+    maintainers = with lib.maintainers; [ lykos153 ];
+  };
+}

pkgs/by-name/me/mealie/package.nix

···
 {
   lib,
-  stdenv,
   callPackage,
   fetchFromGitHub,
   makeWrapper,
   nixosTests,
   python3Packages,
+  nltk-data,
   writeShellScript,
   nix-update-script,
 }:
 
 let
-  version = "2.7.1";
+  version = "2.8.0";
   src = fetchFromGitHub {
     owner = "mealie-recipes";
     repo = "mealie";
     tag = "v${version}";
-    hash = "sha256-nN8AuSzxHjIDKc8rGN+O2/vlzkH/A5LAr4aoAlOTLlk=";
+    hash = "sha256-0LUT7OdYoOZTdR/UXJO2eL2Afo2Y7GjBPIrjWUt205E=";
   };
 
   frontend = callPackage (import ./mealie-frontend.nix src version) { };
 
   pythonpkgs = python3Packages;
   python = pythonpkgs.python;
-
-  crfpp = stdenv.mkDerivation {
-    pname = "mealie-crfpp";
-    version = "unstable-2024-02-12";
-    src = fetchFromGitHub {
-      owner = "mealie-recipes";
-      repo = "crfpp";
-      rev = "c56dd9f29469c8a9f34456b8c0d6ae0476110516";
-      hash = "sha256-XNps3ZApU8m07bfPEnvip1w+3hLajdn9+L5+IpEaP0c=";
-    };
-
-    # Can remove once the `register` keyword is removed from source files
-    # Configure overwrites CXXFLAGS so patch it in the Makefile
-    postConfigure = lib.optionalString stdenv.cc.isClang ''
-      substituteInPlace Makefile \
-        --replace-fail "CXXFLAGS = " "CXXFLAGS = -std=c++14 "
-    '';
-  };
 in
 
 pythonpkgs.buildPythonApplication rec {
···
     gunicorn
     html2text
     httpx
+    ingredient-parser-nlp
     itsdangerous
     jinja2
     lxml
···
         ${lib.getExe pythonpkgs.gunicorn} "$@" -k uvicorn.workers.UvicornWorker mealie.app:app;
       '';
       init_db = writeShellScript "init-mealie-db" ''
-        ${python.interpreter} $OUT/${python.sitePackages}/mealie/scripts/install_model.py
         ${python.interpreter} $OUT/${python.sitePackages}/mealie/db/init_db.py
       '';
     in
···
 
       makeWrapper ${start_script} $out/bin/mealie \
         --set PYTHONPATH "$out/${python.sitePackages}:${pythonpkgs.makePythonPath dependencies}" \
-        --set LD_LIBRARY_PATH "${crfpp}/lib" \
-        --set STATIC_FILES "${frontend}" \
-        --set PATH "${lib.makeBinPath [ crfpp ]}"
+        --set STATIC_FILES "${frontend}"
 
       makeWrapper ${init_db} $out/libexec/init_db \
         --set PYTHONPATH "$out/${python.sitePackages}:${pythonpkgs.makePythonPath dependencies}" \
···
     '';
 
   nativeCheckInputs = with pythonpkgs; [ pytestCheckHook ];
+
+  # Needed for tests
+  preCheck = ''
+    export NLTK_DATA=${nltk-data.averaged_perceptron_tagger_eng}
+  '';
 
   disabledTestPaths = [
     # KeyError: 'alembic_version'

pkgs/by-name/mi/mistral-rs/package.nix

···
 }:
 
 let
+  inherit (stdenv) hostPlatform;
+
   accelIsValid = builtins.elem acceleration [
     null
     false
···
   metalSupport =
     assert accelIsValid;
     (acceleration == "metal")
-    || (stdenv.hostPlatform.isDarwin && stdenv.hostPlatform.isAarch64 && (acceleration == null));
+    || (hostPlatform.isDarwin && hostPlatform.isAarch64 && (acceleration == null));
 
 in
 rustPlatform.buildRustPackage (finalAttrs: {
···
   buildFeatures =
     lib.optionals cudaSupport [ "cuda" ]
     ++ lib.optionals mklSupport [ "mkl" ]
-    ++ lib.optionals (stdenv.hostPlatform.isDarwin && metalSupport) [ "metal" ];
+    ++ lib.optionals (hostPlatform.isDarwin && metalSupport) [ "metal" ];
 
   env =
     {
···
       CUDA_TOOLKIT_ROOT_DIR = lib.getDev cudaPackages.cuda_cudart;
     });
 
-  appendRunpaths = [
+  appendRunpaths = lib.optionals cudaSupport [
     (lib.makeLibraryPath [
       cudaPackages.libcublas
       cudaPackages.libcurand
···
   # swagger-ui will once more be copied in the target directory during the check phase
   # Not deleting the existing unpacked archive leads to a `PermissionDenied` error
   preCheck = ''
-    rm -rf target/${stdenv.hostPlatform.config}/release/build/
+    rm -rf target/${hostPlatform.config}/release/build/
   '';
 
   # Prevent checkFeatures from inheriting buildFeatures because
···
     tests = {
       version = testers.testVersion { package = mistral-rs; };
 
-      withMkl = lib.optionalAttrs (stdenv.hostPlatform == "x86_64-linux") (
+      withMkl = lib.optionalAttrs (hostPlatform.isLinux && hostPlatform.isx86_64) (
         mistral-rs.override { acceleration = "mkl"; }
       );
-      withCuda = lib.optionalAttrs stdenv.hostPlatform.isLinux (
-        mistral-rs.override { acceleration = "cuda"; }
-      );
-      withMetal = lib.optionalAttrs (stdenv.hostPlatform == "aarch64-darwin") (
+      withCuda = lib.optionalAttrs hostPlatform.isLinux (mistral-rs.override { acceleration = "cuda"; });
+      withMetal = lib.optionalAttrs (hostPlatform.isDarwin && hostPlatform.isAarch64) (
         mistral-rs.override { acceleration = "metal"; }
       );
     };

pkgs/by-name/nu/nuclei-templates/package.nix

···
 
 stdenvNoCC.mkDerivation rec {
   pname = "nuclei-templates";
-  version = "10.1.6";
+  version = "10.1.7";
 
   src = fetchFromGitHub {
     owner = "projectdiscovery";
     repo = "nuclei-templates";
     tag = "v${version}";
-    hash = "sha256-4li7585M7Pp1/mzD91+tgZgsnoo/Hfy55O+7bEyxUtA=";
+    hash = "sha256-wpsnxaWU3U5dxqGtgF8QyJzbi+Ft9ZHiuEF8WStiCpo=";
   };
 
   installPhase = ''

pkgs/by-name/or/oranchelo-icon-theme/package.nix

···
       gtk-update-icon-cache "$theme"
     done
   '';
+  dontCheckForBrokenSymlinks = true;
 
   meta = with lib; {
     description = "Oranchelo icon theme";

pkgs/by-name/pr/prefect/package.nix

···
 
 python3Packages.buildPythonApplication rec {
   pname = "prefect";
-  version = "3.3.3";
+  version = "3.3.4";
   pyproject = true;
 
   # Trying to install from source is challenging
···
   # Source will be missing sdist, uv.lock, ui artefacts ...
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-4cJoOD7wdmwL+56VMh01JqzyC6817FnLrbIf0Ydaz/g=";
+    hash = "sha256-ii5AqUeo2asSY3oA2PYqGhRev42KInSrn/plDp4Q90Q=";
   };
 
   pythonRelaxDeps = [
···
       extraArgs = [
         # avoid pre‐releases
         "--version-regex"
-        ''^\d+\.\d+\.\d+$''
+        "^(\\d+\\.\\d+\\.\\d+)$"
       ];
     };
   };

pkgs/by-name/re/readest/package.nix

···
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "readest";
-  version = "0.9.32";
+  version = "0.9.33";
 
   src = fetchFromGitHub {
     owner = "readest";
     repo = "readest";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-EdEjRKBrWGIwJbmNLDvJl/1Hq+Cs6w815ND6yH3/+TI=";
+    hash = "sha256-amGOtA2dOFjECCI5IAb9qL98XAvd+QAW4QQD41F8BG4=";
     fetchSubmodules = true;
   };
 
···
 
   pnpmDeps = pnpm_9.fetchDeps {
     inherit (finalAttrs) pname version src;
-    hash = "sha256-6JFBw/jktEQBXum7Cb4TrntbrnVQM36jE6sby2bmIlw=";
+    hash = "sha256-+fJbQmoa89WSfA4dteUSRoEfgEN38tsHZiuWyOvuvhw=";
   };
 
   pnpmRoot = "../..";
 
   useFetchCargoVendor = true;
 
-  cargoHash = "sha256-2XYfcYjrg7RUXuI0B4i9DVNr0i0bYNYHj1peAi77QaE=";
+  cargoHash = "sha256-uMm/X4MKu71MxjofRN/HR5d1yzkJhmVt9W5kHDryEtc=";
 
   cargoRoot = "../..";
 

pkgs/by-name/sa/safe-rm/package.nix

···
 
   postPatch = ''
     substituteInPlace src/main.rs \
-      --replace "/bin/rm" "${coreutils}/bin/rm"
+      --replace-fail "/bin/rm" "${coreutils}/bin/rm"
   '';
 
   nativeBuildInputs = [ installShellFiles ];

pkgs/by-name/ti/tigerbeetle/package.nix

···
   platform =
     if stdenvNoCC.hostPlatform.isDarwin then "universal-macos" else stdenvNoCC.hostPlatform.system;
   hash = builtins.getAttr platform {
-    "universal-macos" = "sha256-HTKfTNdGBUWX5QTHdSvflwPX0ytmsb5AEbb1XcJz1/k=";
-    "x86_64-linux" = "sha256-cIfia5bdwqGURd9JocZYssxQwhonFFNEJbS+gcaPdTk=";
-    "aarch64-linux" = "sha256-mTkaMP9Xo/U/oveuZBT4kXU7P/6zg7RUnKof/5VpxoQ=";
+    "universal-macos" = "sha256-ryYQyt+qjNKiT3XQuAwaG65I8KIMrkM2QeL9WvFkyik=";
+    "x86_64-linux" = "sha256-VgV+K6DDtoX5CjqGUlSAZYVakAs4GWX6+8Fi9v29HjY=";
+    "aarch64-linux" = "sha256-euyfFe9iXnAnePYd1u4ymtWqKGrf7vNuOeS0jFtChCA=";
   };
 in
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "tigerbeetle";
-  version = "0.16.33";
+  version = "0.16.35";
 
   src = fetchzip {
     url = "https://github.com/tigerbeetle/tigerbeetle/releases/download/${finalAttrs.version}/tigerbeetle-${platform}.zip";

pkgs/by-name/vi/vivaldi-ffmpeg-codecs/package.nix

···
+{
+  fetchurl,
+  lib,
+  squashfsTools,
+  stdenv,
+}:
+
+# This derivation roughly follows the update-ffmpeg script that ships with the official Vivaldi
+# downloads at https://vivaldi.com/download/
+
+let
+  sources = {
+    x86_64-linux = fetchurl {
+      url = "https://api.snapcraft.io/api/v1/snaps/download/XXzVIXswXKHqlUATPqGCj2w2l7BxosS8_73.snap";
+      hash = "sha256-YsAYQ/fKlrvu7IbIxLO0oVhWOtZZzUmA00lrU+z/0+s=";
+    };
+    aarch64-linux = fetchurl {
+      url = "https://api.snapcraft.io/api/v1/snaps/download/XXzVIXswXKHqlUATPqGCj2w2l7BxosS8_74.snap";
+      hash = "sha256-zwCbaFeVmeHQLEp7nmD8VlEjSY9PqSVt6CdW4wPtw9o=";
+    };
+  };
+in
+stdenv.mkDerivation rec {
+
+  pname = "chromium-codecs-ffmpeg-extra";
+
+  version = "119293";
+
+  src = sources."${stdenv.hostPlatform.system}";
+
+  buildInputs = [ squashfsTools ];
+
+  unpackPhase = ''
+    unsquashfs -dest . $src
+  '';
+
+  installPhase = ''
+    install -vD chromium-ffmpeg-${version}/chromium-ffmpeg/libffmpeg.so $out/lib/libffmpeg.so
+  '';
+
+  passthru = {
+    inherit sources;
+    updateScript = ./update.sh;
+  };
+
+  meta = with lib; {
+    description = "Additional support for proprietary codecs for Vivaldi and other chromium based tools";
+    homepage = "https://ffmpeg.org/";
+    sourceProvenance = with sourceTypes; [ binaryNativeCode ];
+    license = licenses.lgpl21;
+    maintainers = with maintainers; [
+      betaboon
+      cawilliamson
+      fptje
+      sarahec
+    ];
+    platforms = [
+      "x86_64-linux"
+      "aarch64-linux"
+    ];
+  };
+}

pkgs/by-name/vi/vivaldi-ffmpeg-codecs/update.sh

···
+#!/usr/bin/env nix-shell
+#!nix-shell -i bash -p common-updater-scripts coreutils grep jq squashfsTools
+
+set -eu -o pipefail
+
+RELEASES=$(curl -H 'Snap-Device-Series: 16' http://api.snapcraft.io/v2/snaps/info/chromium-ffmpeg)
+STABLE_RELEASES=$(echo $RELEASES | jq '."channel-map" | .[] | select(.channel.risk=="stable")')
+
+function max_version() {
+  local versions=$(echo $1 | jq -r '.version')
+  echo "$(echo $versions |  grep -E -o '^[0-9]+')"
+}
+
+function update_source() {
+  local platform=$1
+  local selectedRelease=$2
+  local version=$3
+  local url=$(echo $selectedRelease | jq -r '.download.url')
+  source="$(nix-prefetch-url "$url")"
+  hash=$(nix-hash --to-sri --type sha256 "$source")
+  update-source-version vivaldi-ffmpeg-codecs "$version" "$hash" "$url" --ignore-same-version --system=$platform --source-key="sources.$platform"
+}
+
+x86Release="$(echo $STABLE_RELEASES | jq 'select(.channel.architecture=="amd64")')"
+x86CodecVersion=$(max_version "$x86Release")
+arm64Release="$(echo $STABLE_RELEASES | jq -r 'select(.channel.architecture=="arm64")')"
+arm64CodecVersion=$(max_version "$arm64Release")
+
+currentVersion=$(nix-instantiate --eval -E "with import ./. {}; vivaldi-ffmpeg-codecs.version or (lib.getVersion vivaldi-ffmpeg-codecs)" | tr -d '"')
+
+if [[ "$currentVersion" == "$x86CodecVersion" ]]; then
+  exit 0
+fi
+
+# If this fails too often, consider finding the max common version between the two architectures
+if [[ "$x86CodecVersion" != "$arm64CodecVersion" ]]; then
+    >&2 echo "Multiple chromium versions found: $x86CodecVersion (intel) and $arm64CodecVersion (arm); no update"
+    exit 1
+fi
+
+
+
+update_source "x86_64-linux" "$x86Release" "$x86CodecVersion"
+update_source "aarch64-linux" "$arm64Release" "$arm64CodecVersion"

pkgs/desktops/gnome/extensions/EasyScreenCast/default.nix

···
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "gnome-shell-extension-EasyScreenCast";
-  version = "1.11.0";
+  version = "1.11.1";
 
   src = fetchFromGitHub {
     owner = "EasyScreenCast";
     repo = "EasyScreenCast";
     rev = finalAttrs.version;
-    hash = "sha256-CK9ta+2Kf7IFKb+uQhI1AtdNkJZpBgIL7JDM3JqsV4c=";
+    hash = "sha256-G4JDxaUfipn9asOXGw+OPVULOdV+OmzeK5aE/FSPGes=";
   };
 
   patches = [
···
 
   passthru.extensionUuid = "[e-mail]";
 
-  meta = with lib; {
+  meta = {
     description = "Simplifies the use of the video recording function integrated in gnome shell";
     homepage = "https://github.com/EasyScreenCast/EasyScreenCast";
-    license = licenses.gpl3Plus;
-    maintainers = with maintainers; [ doronbehar ];
-    platforms = platforms.linux;
+    license = lib.licenses.gpl3Plus;
+    maintainers = with lib.maintainers; [ ];
+    platforms = lib.platforms.linux;
   };
 })

pkgs/development/compilers/openjdk/jre.nix

···
 {
   stdenv,
   jdk,
+  jdkOnBuild, # must provide jlink
   lib,
   callPackage,
   modules ? [ "java.base" ],
···
     pname = "${jdk.pname}-minimal-jre";
     version = jdk.version;
 
+    nativeBuildInputs = [ jdkOnBuild ];
     buildInputs = [ jdk ];
+    strictDeps = true;
 
     dontUnpack = true;
 

pkgs/development/python-modules/ingredient-parser-nlp/default.nix

···
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  nix-update-script,
+
+  setuptools,
+
+  nltk,
+  python-crfsuite,
+  pint,
+  floret,
+
+  pytestCheckHook,
+  nltk-data,
+}:
+buildPythonPackage rec {
+  pname = "ingredient-parser-nlp";
+  version = "2.0.0";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "strangetom";
+    repo = "ingredient-parser";
+    tag = version;
+    hash = "sha256-i14RKBcvU56pDNGxNVBvvpQ65FCbitMIfvN5eLLJCWU=";
+  };
+
+  build-system = [ setuptools ];
+
+  dependencies = [
+    nltk
+    python-crfsuite
+    pint
+    floret
+  ];
+
+  nativeCheckInputs = [
+    pytestCheckHook
+  ];
+
+  pythonImportsCheck = [
+    "ingredient_parser"
+  ];
+
+  # Needed for tests
+  preCheck = ''
+    export NLTK_DATA=${nltk-data.averaged_perceptron_tagger_eng}
+  '';
+
+  meta = {
+    description = "Parse structured information from recipe ingredient sentences";
+    license = lib.licenses.mit;
+    homepage = "https://github.com/strangetom/ingredient-parser/";
+    changelog = "https://github.com/strangetom/ingredient-parser/releases/tag/${version}";
+    maintainers = with lib.maintainers; [ antonmosich ];
+  };
+}

pkgs/development/python-modules/particle/default.nix

···
 
 buildPythonPackage rec {
   pname = "particle";
-  version = "0.25.2";
+  version = "0.25.3";
   pyproject = true;
 
   disabled = pythonOlder "3.9";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-H6S77ji/6u8IpAsnebTDDFzk+ihloQwCrP6QZ5tOYek=";
+    hash = "sha256-eM9+VuniEYOF+/uJCNg5XnomerXwWWqq/rrbCMsERSs=";
   };
 
   postPatch = ''

pkgs/servers/monitoring/nagios-plugins/check_ssl_cert/default.nix

···
 
 stdenv.mkDerivation rec {
   pname = "check_ssl_cert";
-  version = "2.89.0";
+  version = "2.92.0";
 
   src = fetchFromGitHub {
     owner = "matteocorti";
     repo = "check_ssl_cert";
     tag = "v${version}";
-    hash = "sha256-kL89lNPuFd1ozWYNJEnZ0vcWUXIEnDS6LABTXxtjvmE=";
+    hash = "sha256-00zJt/MQ4uU/JvJfJ70mtCqtL63w2NRfUgDNmhTF8w8=";
   };
 
   nativeBuildInputs = [ makeWrapper ];

pkgs/servers/plex/raw.nix

···
 # server, and the FHS userenv and corresponding NixOS module should
 # automatically pick up the changes.
 stdenv.mkDerivation rec {
-  version = "1.41.5.9522-a96edc606";
+  version = "1.41.6.9685-d301f511a";
   pname = "plexmediaserver";
 
   # Fetch the source
···
     if stdenv.hostPlatform.system == "aarch64-linux" then
       fetchurl {
         url = "https://downloads.plex.tv/plex-media-server-new/${version}/debian/plexmediaserver_${version}_arm64.deb";
-        sha256 = "sha256-ugN1y3V1HE/IBhnvzlOYIL/5LyEa33IRPuj6903vPaA=";
+        sha256 = "sha256-w0xngKbrUVZXA9Hc6/Doq365Kt/sbZmmcHR/sWujVzw=";
       }
     else
       fetchurl {
         url = "https://downloads.plex.tv/plex-media-server-new/${version}/debian/plexmediaserver_${version}_amd64.deb";
-        sha256 = "sha256-3bGmsa2OLBt587YnZDNpSjWHdQ1ubwSNocLPW6A6kQU=";
+        sha256 = "sha256-4ZbSGQGdkXCCZZ00w0/BwRHju4DJUQQBGid0gBFK0Ck=";
       };
 
   outputs = [

pkgs/stdenv/darwin/default.nix

···
         # Use libiconvReal with gettext to break an infinite recursion.
         gettext = super.gettext.override { libiconv = super.libiconvReal; };
 
+        # Disable grep’s tests for now due to impure locale updates in
+        # macOS 15.4 breaking them in the bootstrap.
+        gnugrep = super.gnugrep.overrideAttrs { doCheck = false; };
+
         # Disable tests because they use dejagnu, which fails to run.
         libffi = super.libffi.override { doCheck = false; };
 

pkgs/tools/filesystems/ceph/default.nix

···
   );
   inherit (ceph-python-env.python) sitePackages;
 
-  version = "19.2.1";
+  version = "19.2.2";
   src = fetchurl {
     url = "https://download.ceph.com/tarballs/ceph-${version}.tar.gz";
-    hash = "sha256-QEX3LHxySVgLBg21iQga1DnyQsXFi6593e+WSjgT/h8=";
+    hash = "sha256-7FD9LJs25VzUCRIBm01Cm3ss1YLTN9YLwPZnHSMd8rs=";
   };
 in
 rec {

pkgs/tools/package-management/nix-eval-jobs/default.nix

···
 }:
 stdenv.mkDerivation rec {
   pname = "nix-eval-jobs";
-  version = "2.28.0";
+  version = "2.28.1";
 
   src = fetchFromGitHub {
     owner = "nix-community";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-v5n6t49X7MOpqS9j0FtI6TWOXvxuZMmGsp2OfUK5QfA=";
+    hash = "sha256-QuSt8PsB1huFQVXeSASfbXX0r5hmEFLNgYX4dpKewWs=";
   };
 
   buildInputs = [

pkgs/tools/package-management/nix/default.nix

···
         ) (lib.range 4 23)
       )
       // {
-        nixComponents_2_27 = throw "nixComponents_2_27 has been removed. use nixComponents_2_28.";
+        nixComponents_2_27 = throw "nixComponents_2_27 has been removed. use nixComponents_git.";
         nix_2_27 = throw "nix_2_27 has been removed. use nix_2_28.";
         nix_2_25 = throw "nix_2_25 has been removed. use nix_2_28.";
 

pkgs/tools/text/nltk-data/default.nix

···
     location = "taggers";
     hash = "sha256-tl3Cn2okhBkUtTXvAmFRx72Brez6iTGRdmFTwFmpk3M=";
   };
+  averaged_perceptron_tagger_eng = makeNltkDataPackage {
+    pname = "averaged_perceptron_tagger_eng";
+    location = "taggers";
+    hash = "sha256-tl3Cn2okhBkUtTXvAmFRx72Brez6iTGRdmFTwFmpk3M=";
+  };
   snowball_data = makeNltkDataPackage {
     pname = "snowball_data";
     location = "stemmers";

pkgs/top-level/all-packages.nix

···
 
   jre17_minimal = callPackage ../development/compilers/openjdk/jre.nix {
     jdk = jdk17;
+    jdkOnBuild = buildPackages.jdk17;
   };
   jre21_minimal = callPackage ../development/compilers/openjdk/jre.nix {
     jdk = jdk21;
+    jdkOnBuild = buildPackages.jdk21;
   };
-  jre_minimal = callPackage ../development/compilers/openjdk/jre.nix { };
+  jre_minimal = callPackage ../development/compilers/openjdk/jre.nix {
+    jdkOnBuild = buildPackages.jdk;
+  };
 
   openjdk = jdk;
   openjdk_headless = jdk_headless;
···
   };
 
   vivaldi = callPackage ../applications/networking/browsers/vivaldi { };
-
-  vivaldi-ffmpeg-codecs =
-    callPackage ../applications/networking/browsers/vivaldi/ffmpeg-codecs.nix
-      { };
 
   openrazer-daemon = python3Packages.toPythonApplication python3Packages.openrazer-daemon;
 

pkgs/top-level/python-packages.nix

···
 
   inform = callPackage ../development/python-modules/inform { };
 
+  ingredient-parser-nlp = callPackage ../development/python-modules/ingredient-parser-nlp { };
+
   iniconfig = callPackage ../development/python-modules/iniconfig { };
 
   inifile = callPackage ../development/python-modules/inifile { };