Merge master into staging-next

maintainers/maintainer-list.nix

@@ -12526,6 +12526,12 @@
     githubId = 1631737;
     name = "Mikhail Medvedev";
   };
+  meebey = {
+    email = "meebey@meebey.net";
+    github = "meebey";
+    githubId = 318066;
+    name = "Mirco Bauer";
+  };
   megheaiulian = {
     email = "iulian.meghea@gmail.com";
     github = "megheaiulian";

nixos/doc/manual/release-notes/rl-2405.section.md

@@ -32,6 +32,11 @@ In addition to numerous new and upgraded packages, this release has the followin
 
 - Julia environments can now be built with arbitrary packages from the ecosystem using the `.withPackages` function. For example: `julia.withPackages ["Plots"]`.
 
+- The PipeWire and WirePlumber modules have removed support for using
+`environment.etc."pipewire/..."` and `environment.etc."wireplumber/..."`.
+Use `services.pipewire.extraConfig` or `services.pipewire.configPackages` for PipeWire and
+`services.pipewire.wireplumber.configPackages` for WirePlumber instead."
+
 - A new option `systemd.sysusers.enable` was added. If enabled, users and
   groups are created with systemd-sysusers instead of with a custom perl script.
 

nixos/modules/services/desktops/pipewire/pipewire.nix

@@ -1,14 +1,21 @@
 # PipeWire service.
 { config, lib, pkgs, ... }:
 
-with lib;
-
 let
+  inherit (builtins) attrNames concatMap length;
+  inherit (lib) maintainers teams;
+  inherit (lib.attrsets) attrByPath attrsToList concatMapAttrs filterAttrs;
+  inherit (lib.lists) flatten optional optionals;
+  inherit (lib.modules) mkIf mkRemovedOptionModule;
+  inherit (lib.options) literalExpression mkEnableOption mkOption mkPackageOption;
+  inherit (lib.strings) concatMapStringsSep hasPrefix optionalString;
+  inherit (lib.types) attrsOf bool listOf package;
+
   json = pkgs.formats.json {};
   mapToFiles = location: config: concatMapAttrs (name: value: { "share/pipewire/${location}.conf.d/${name}.conf" = json.generate "${name}" value; }) config;
   extraConfigPkgFromFiles = locations: filesSet: pkgs.runCommand "pipewire-extra-config" { } ''
-    mkdir -p ${lib.concatMapStringsSep " " (l: "$out/share/pipewire/${l}.conf.d") locations}
-    ${lib.concatMapStringsSep ";" ({name, value}: "ln -s ${value} $out/${name}") (lib.attrsToList filesSet)}
+    mkdir -p ${concatMapStringsSep " " (l: "$out/share/pipewire/${l}.conf.d") locations}
+    ${concatMapStringsSep ";" ({name, value}: "ln -s ${value} $out/${name}") (attrsToList filesSet)}
   '';
   cfg = config.services.pipewire;
   enable32BitAlsaPlugins = cfg.alsa.support32Bit
@@ -40,15 +47,15 @@ let
     name = "pipewire-configs";
     paths = configPackages
       ++ [ extraConfigPkg ]
-      ++ lib.optionals cfg.wireplumber.enable cfg.wireplumber.configPackages;
+      ++ optionals cfg.wireplumber.enable cfg.wireplumber.configPackages;
     pathsToLink = [ "/share/pipewire" ];
   };
 
-  requiredLv2Packages = lib.flatten
+  requiredLv2Packages = flatten
     (
-      lib.concatMap
+      concatMap
       (p:
-        lib.attrByPath ["passthru" "requiredLv2Packages"] [] p
+        attrByPath ["passthru" "requiredLv2Packages"] [] p
       )
       configPackages
     );
@@ -59,58 +66,58 @@ let
     pathsToLink = [ "/lib/lv2" ];
   };
 in {
-  meta.maintainers = teams.freedesktop.members ++ [ lib.maintainers.k900 ];
+  meta.maintainers = teams.freedesktop.members ++ [ maintainers.k900 ];
 
   ###### interface
   options = {
     services.pipewire = {
-      enable = mkEnableOption (lib.mdDoc "PipeWire service");
+      enable = mkEnableOption "PipeWire service";
 
       package = mkPackageOption pkgs "pipewire" { };
 
       socketActivation = mkOption {
         default = true;
-        type = types.bool;
-        description = lib.mdDoc ''
+        type = bool;
+        description = ''
           Automatically run PipeWire when connections are made to the PipeWire socket.
         '';
       };
 
       audio = {
-        enable = lib.mkOption {
-          type = lib.types.bool;
+        enable = mkOption {
+          type = bool;
           # this is for backwards compatibility
           default = cfg.alsa.enable || cfg.jack.enable || cfg.pulse.enable;
-          defaultText = lib.literalExpression "config.services.pipewire.alsa.enable || config.services.pipewire.jack.enable || config.services.pipewire.pulse.enable";
-          description = lib.mdDoc "Whether to use PipeWire as the primary sound server";
+          defaultText = literalExpression "config.services.pipewire.alsa.enable || config.services.pipewire.jack.enable || config.services.pipewire.pulse.enable";
+          description = "Whether to use PipeWire as the primary sound server";
         };
       };
 
       alsa = {
-        enable = mkEnableOption (lib.mdDoc "ALSA support");
-        support32Bit = mkEnableOption (lib.mdDoc "32-bit ALSA support on 64-bit systems");
+        enable = mkEnableOption "ALSA support";
+        support32Bit = mkEnableOption "32-bit ALSA support on 64-bit systems";
       };
 
       jack = {
-        enable = mkEnableOption (lib.mdDoc "JACK audio emulation");
+        enable = mkEnableOption "JACK audio emulation";
       };
 
       raopOpenFirewall = mkOption {
-        type = lib.types.bool;
+        type = bool;
         default = false;
-        description = lib.mdDoc ''
+        description = ''
           Opens UDP/6001-6002, required by RAOP/Airplay for timing and control data.
         '';
       };
 
       pulse = {
-        enable = mkEnableOption (lib.mdDoc "PulseAudio server emulation");
+        enable = mkEnableOption "PulseAudio server emulation";
       };
 
-      systemWide = lib.mkOption {
-        type = lib.types.bool;
+      systemWide = mkOption {
+        type = bool;
         default = false;
-        description = lib.mdDoc ''
+        description = ''
           If true, a system-wide PipeWire service and socket is enabled
           allowing all users in the "pipewire" group to use it simultaneously.
           If false, then user units are used instead, restricting access to
@@ -124,7 +131,7 @@ in {
 
       extraConfig = {
         pipewire = mkOption {
-          type = lib.types.attrsOf json.type;
+          type = attrsOf json.type;
           default = {};
           example = {
             "10-clock-rate" = {
@@ -138,7 +145,7 @@ in {
               };
             };
           };
-          description = lib.mdDoc ''
+          description = ''
             Additional configuration for the PipeWire server.
 
             Every item in this attrset becomes a separate drop-in file in `/etc/pipewire/pipewire.conf.d`.
@@ -157,7 +164,7 @@ in {
           '';
         };
         client = mkOption {
-          type = lib.types.attrsOf json.type;
+          type = attrsOf json.type;
           default = {};
           example = {
             "10-no-resample" = {
@@ -166,7 +173,7 @@ in {
               };
             };
           };
-          description = lib.mdDoc ''
+          description = ''
             Additional configuration for the PipeWire client library, used by most applications.
 
             Every item in this attrset becomes a separate drop-in file in `/etc/pipewire/client.conf.d`.
@@ -177,7 +184,7 @@ in {
           '';
         };
         client-rt = mkOption {
-          type = lib.types.attrsOf json.type;
+          type = attrsOf json.type;
           default = {};
           example = {
             "10-alsa-linear-volume" = {
@@ -186,7 +193,7 @@ in {
               };
             };
           };
-          description = lib.mdDoc ''
+          description = ''
             Additional configuration for the PipeWire client library, used by real-time applications and legacy ALSA clients.
 
             Every item in this attrset becomes a separate drop-in file in `/etc/pipewire/client-rt.conf.d`.
@@ -198,7 +205,7 @@ in {
           '';
         };
         jack = mkOption {
-          type = lib.types.attrsOf json.type;
+          type = attrsOf json.type;
           default = {};
           example = {
             "20-hide-midi" = {
@@ -207,7 +214,7 @@ in {
               };
             };
           };
-          description = lib.mdDoc ''
+          description = ''
             Additional configuration for the PipeWire JACK server and client library.
 
             Every item in this attrset becomes a separate drop-in file in `/etc/pipewire/jack.conf.d`.
@@ -218,7 +225,7 @@ in {
           '';
         };
         pipewire-pulse = mkOption {
-          type = lib.types.attrsOf json.type;
+          type = attrsOf json.type;
           default = {};
           example = {
             "15-force-s16-info" = {
@@ -232,7 +239,7 @@ in {
               }];
             };
           };
-          description = lib.mdDoc ''
+          description = ''
             Additional configuration for the PipeWire PulseAudio server.
 
             Every item in this attrset becomes a separate drop-in file in `/etc/pipewire/pipewire-pulse.conf.d`.
@@ -248,10 +255,32 @@ in {
         };
       };
 
-      configPackages = lib.mkOption {
-        type = lib.types.listOf lib.types.package;
+      configPackages = mkOption {
+        type = listOf package;
         default = [];
-        description = lib.mdDoc ''
+        example = literalExpression ''[
+          (pkgs.writeTextDir "share/pipewire/pipewire.conf.d/10-loopback.conf" '''
+            context.modules = [
+            {   name = libpipewire-module-loopback
+                args = {
+                  node.description = "Scarlett Focusrite Line 1"
+                  capture.props = {
+                      audio.position = [ FL ]
+                      stream.dont-remix = true
+                      node.target = "alsa_input.usb-Focusrite_Scarlett_Solo_USB_Y7ZD17C24495BC-00.analog-stereo"
+                      node.passive = true
+                  }
+                  playback.props = {
+                      node.name = "SF_mono_in_1"
+                      media.class = "Audio/Source"
+                      audio.position = [ MONO ]
+                  }
+                }
+            }
+            ]
+          ''')
+        ]'';
+        description = ''
           List of packages that provide PipeWire configuration, in the form of
           `share/pipewire/*/*.conf` files.
 
@@ -260,11 +289,11 @@ in {
         '';
       };
 
-      extraLv2Packages = lib.mkOption {
-        type = lib.types.listOf lib.types.package;
+      extraLv2Packages = mkOption {
+        type = listOf package;
         default = [];
-        example = lib.literalExpression "[ pkgs.lsp-plugins ]";
-        description = lib.mdDoc ''
+        example = literalExpression "[ pkgs.lsp-plugins ]";
+        description = ''
           List of packages that provide LV2 plugins in `lib/lv2` that should
           be made available to PipeWire for [filter chains][wiki-filter-chain].
 
@@ -279,11 +308,11 @@ in {
   };
 
   imports = [
-    (lib.mkRemovedOptionModule ["services" "pipewire" "config"] ''
+    (mkRemovedOptionModule ["services" "pipewire" "config"] ''
       Overriding default PipeWire configuration through NixOS options never worked correctly and is no longer supported.
       Please create drop-in configuration files via `services.pipewire.extraConfig` instead.
     '')
-    (lib.mkRemovedOptionModule ["services" "pipewire" "media-session"] ''
+    (mkRemovedOptionModule ["services" "pipewire" "media-session"] ''
       pipewire-media-session is no longer supported upstream and has been removed.
       Please switch to `services.pipewire.wireplumber` instead.
     '')
@@ -306,12 +335,12 @@ in {
         message = "Using PipeWire's ALSA/PulseAudio compatibility layers requires running PipeWire as the sound server. Set `services.pipewire.audio.enable` to true.";
       }
       {
-        assertion = builtins.length
-          (builtins.attrNames
+        assertion = length
+          (attrNames
             (
-              lib.filterAttrs
+              filterAttrs
                 (name: value:
-                  lib.hasPrefix "pipewire/" name || name == "pipewire"
+                  hasPrefix "pipewire/" name || name == "pipewire"
                 )
                 config.environment.etc
             )) == 1;
@@ -320,7 +349,7 @@ in {
     ];
 
     environment.systemPackages = [ cfg.package ]
-                                 ++ lib.optional cfg.jack.enable jack-libs;
+                                 ++ optional cfg.jack.enable jack-libs;
 
     systemd.packages = [ cfg.package ];
 
@@ -336,16 +365,16 @@ in {
     systemd.user.sockets.pipewire.enable = !cfg.systemWide;
     systemd.user.services.pipewire.enable = !cfg.systemWide;
 
-    systemd.services.pipewire.environment.LV2_PATH = lib.mkIf cfg.systemWide "${lv2Plugins}/lib/lv2";
-    systemd.user.services.pipewire.environment.LV2_PATH = lib.mkIf (!cfg.systemWide) "${lv2Plugins}/lib/lv2";
+    systemd.services.pipewire.environment.LV2_PATH = mkIf cfg.systemWide "${lv2Plugins}/lib/lv2";
+    systemd.user.services.pipewire.environment.LV2_PATH = mkIf (!cfg.systemWide) "${lv2Plugins}/lib/lv2";
 
     # Mask pw-pulse if it's not wanted
     systemd.user.services.pipewire-pulse.enable = cfg.pulse.enable;
     systemd.user.sockets.pipewire-pulse.enable = cfg.pulse.enable;
 
-    systemd.sockets.pipewire.wantedBy = lib.mkIf cfg.socketActivation [ "sockets.target" ];
-    systemd.user.sockets.pipewire.wantedBy = lib.mkIf cfg.socketActivation [ "sockets.target" ];
-    systemd.user.sockets.pipewire-pulse.wantedBy = lib.mkIf cfg.socketActivation [ "sockets.target" ];
+    systemd.sockets.pipewire.wantedBy = mkIf cfg.socketActivation [ "sockets.target" ];
+    systemd.user.sockets.pipewire.wantedBy = mkIf cfg.socketActivation [ "sockets.target" ];
+    systemd.user.sockets.pipewire-pulse.wantedBy = mkIf cfg.socketActivation [ "sockets.target" ];
 
     services.udev.packages = [ cfg.package ];
 
@@ -377,18 +406,18 @@ in {
     };
 
     environment.sessionVariables.LD_LIBRARY_PATH =
-      lib.mkIf cfg.jack.enable [ "${cfg.package.jack}/lib" ];
+      mkIf cfg.jack.enable [ "${cfg.package.jack}/lib" ];
 
-    networking.firewall.allowedUDPPorts = lib.mkIf cfg.raopOpenFirewall [ 6001 6002 ];
+    networking.firewall.allowedUDPPorts = mkIf cfg.raopOpenFirewall [ 6001 6002 ];
 
-    users = lib.mkIf cfg.systemWide {
+    users = mkIf cfg.systemWide {
       users.pipewire = {
         uid = config.ids.uids.pipewire;
         group = "pipewire";
         extraGroups = [
           "audio"
           "video"
-        ] ++ lib.optional config.security.rtkit.enable "rtkit";
+        ] ++ optional config.security.rtkit.enable "rtkit";
         description = "PipeWire system service user";
         isSystemUser = true;
         home = "/var/lib/pipewire";

nixos/modules/services/desktops/pipewire/wireplumber.nix

@@ -1,46 +1,65 @@
 { config, lib, pkgs, ... }:
 
 let
+  inherit (builtins) attrNames concatMap length;
+  inherit (lib) maintainers;
+  inherit (lib.attrsets) attrByPath filterAttrs;
+  inherit (lib.lists) flatten optional;
+  inherit (lib.modules) mkIf;
+  inherit (lib.options) literalExpression mkOption;
+  inherit (lib.strings) hasPrefix;
+  inherit (lib.types) bool listOf package;
+
   pwCfg = config.services.pipewire;
   cfg = pwCfg.wireplumber;
   pwUsedForAudio = pwCfg.audio.enable;
 in
 {
-  meta.maintainers = [ lib.maintainers.k900 ];
+  meta.maintainers = [ maintainers.k900 ];
 
   options = {
     services.pipewire.wireplumber = {
-      enable = lib.mkOption {
-        type = lib.types.bool;
-        default = config.services.pipewire.enable;
-        defaultText = lib.literalExpression "config.services.pipewire.enable";
-        description = lib.mdDoc "Whether to enable WirePlumber, a modular session / policy manager for PipeWire";
+      enable = mkOption {
+        type = bool;
+        default = pwCfg.enable;
+        defaultText = literalExpression "config.services.pipewire.enable";
+        description = "Whether to enable WirePlumber, a modular session / policy manager for PipeWire";
       };
 
-      package = lib.mkOption {
-        type = lib.types.package;
+      package = mkOption {
+        type = package;
         default = pkgs.wireplumber;
-        defaultText = lib.literalExpression "pkgs.wireplumber";
-        description = lib.mdDoc "The WirePlumber derivation to use.";
+        defaultText = literalExpression "pkgs.wireplumber";
+        description = "The WirePlumber derivation to use.";
       };
 
-      configPackages = lib.mkOption {
-        type = lib.types.listOf lib.types.package;
+      configPackages = mkOption {
+        type = listOf package;
         default = [ ];
-        description = lib.mdDoc ''
+        example = literalExpression ''[
+          (pkgs.writeTextDir "share/wireplumber/wireplumber.conf.d/10-bluez.conf" '''
+            monitor.bluez.properties = {
+              bluez5.roles = [ a2dp_sink a2dp_source bap_sink bap_source hsp_hs hsp_ag hfp_hf hfp_ag ]
+              bluez5.codecs = [ sbc sbc_xq aac ]
+              bluez5.enable-sbc-xq = true
+              bluez5.hfphsp-backend = "native"
+            }
+          ''')
+        ]'';
+        description = ''
           List of packages that provide WirePlumber configuration, in the form of
-          `share/wireplumber/*/*.lua` files.
+          `share/wireplumber/*/*.conf` files.
 
           LV2 dependencies will be picked up from config packages automatically
           via `passthru.requiredLv2Packages`.
         '';
       };
 
-      extraLv2Packages = lib.mkOption {
-        type = lib.types.listOf lib.types.package;
+      extraLv2Packages = mkOption {
+        type = listOf package;
         default = [];
-        example = lib.literalExpression "[ pkgs.lsp-plugins ]";
-        description = lib.mdDoc ''
+        example = literalExpression "[ pkgs.lsp-plugins ]";
+        description = ''
           List of packages that provide LV2 plugins in `lib/lv2` that should
           be made available to WirePlumber for [filter chains][wiki-filter-chain].
 
@@ -78,8 +97,8 @@ in
       '';
 
       configPackages = cfg.configPackages
-          ++ lib.optional (!pwUsedForAudio) pwNotForAudioConfigPkg
-          ++ lib.optional config.services.pipewire.systemWide systemwideConfigPkg;
+          ++ optional (!pwUsedForAudio) pwNotForAudioConfigPkg
+          ++ optional pwCfg.systemWide systemwideConfigPkg;
 
       configs = pkgs.buildEnv {
         name = "wireplumber-configs";
@@ -87,11 +106,11 @@ in
         pathsToLink = [ "/share/wireplumber" ];
       };
 
-      requiredLv2Packages = lib.flatten
+      requiredLv2Packages = flatten
         (
-          lib.concatMap
+          concatMap
             (p:
-              lib.attrByPath ["passthru" "requiredLv2Packages"] [] p
+              attrByPath ["passthru" "requiredLv2Packages"] [] p
             )
             configPackages
         );
@@ -102,19 +121,19 @@ in
         pathsToLink = [ "/lib/lv2" ];
       };
     in
-    lib.mkIf cfg.enable {
+    mkIf cfg.enable {
       assertions = [
         {
           assertion = !config.hardware.bluetooth.hsphfpd.enable;
           message = "Using WirePlumber conflicts with hsphfpd, as it provides the same functionality. `hardware.bluetooth.hsphfpd.enable` needs be set to false";
         }
         {
-          assertion = builtins.length
-            (builtins.attrNames
+          assertion = length
+            (attrNames
               (
-                lib.filterAttrs
+                filterAttrs
                   (name: value:
-                    lib.hasPrefix "wireplumber/" name || name == "wireplumber"
+                    hasPrefix "wireplumber/" name || name == "wireplumber"
                   )
                   config.environment.etc
               )) == 1;
@@ -128,19 +147,19 @@ in
 
       systemd.packages = [ cfg.package ];
 
-      systemd.services.wireplumber.enable = config.services.pipewire.systemWide;
-      systemd.user.services.wireplumber.enable = !config.services.pipewire.systemWide;
+      systemd.services.wireplumber.enable = pwCfg.systemWide;
+      systemd.user.services.wireplumber.enable = !pwCfg.systemWide;
 
       systemd.services.wireplumber.wantedBy = [ "pipewire.service" ];
       systemd.user.services.wireplumber.wantedBy = [ "pipewire.service" ];
 
-      systemd.services.wireplumber.environment = lib.mkIf config.services.pipewire.systemWide {
+      systemd.services.wireplumber.environment = mkIf pwCfg.systemWide {
         # Force WirePlumber to use system dbus.
         DBUS_SESSION_BUS_ADDRESS = "unix:path=/run/dbus/system_bus_socket";
         LV2_PATH = "${lv2Plugins}/lib/lv2";
       };
 
       systemd.user.services.wireplumber.environment.LV2_PATH =
-        lib.mkIf (!config.services.pipewire.systemWide) "${lv2Plugins}/lib/lv2";
+        mkIf (!pwCfg.systemWide) "${lv2Plugins}/lib/lv2";
     };
 }

pkgs/applications/networking/browsers/chromium/upstream-info.nix

@@ -1,11 +1,11 @@
 {
   stable = {
     chromedriver = {
-      hash_darwin = "sha256-yRLbe3xl0L/PfRcVB4LA6JeDvLpgUhtKZiAfyB2v/ZE=";
+      hash_darwin = "sha256-sB6gH5k5zK1IIctBTXQpxlgmLEoIatcLDYO+WIFaYxA=";
       hash_darwin_aarch64 =
-        "sha256-TMreCFF9Lo+9gy7kzZWd9Mjep0CYa3Cxn4kr9BNTdkE=";
-      hash_linux = "sha256-rM2usA0zDZ1aXvkbvm+l0xalViEJIxu8ZYZvoTkNiis=";
-      version = "123.0.6312.58";
+        "sha256-sikyGQG0Y14eNjT3f/Z50cPmm38T58X7zQIGopXOHOs=";
+      hash_linux = "sha256-2WZmRXyvxN3hXeOoPQXL6lU6Xki9iUmTdETRxOkIYD0=";
+      version = "123.0.6312.86";
     };
     deps = {
       gn = {
@@ -15,9 +15,9 @@
         version = "2024-02-19";
       };
     };
-    hash = "sha256-GrCYCUjxV16tinqrIqW4DQD51dKIgKNu2fLLz9Yqq7k=";
-    hash_deb_amd64 = "sha256-z+UC7wUsWAX7kPIgk8S9ujW2n6HlUp0m3zHTvsAiTps=";
-    version = "123.0.6312.58";
+    hash = "sha256-b72MiRv4uxolKE92tK224FvyA56NM3FcCjijkc9m3ro=";
+    hash_deb_amd64 = "sha256-JsEJw8aEptesRiCtIrfHRQu1xq27TzHSmUr+dsvnV7o=";
+    version = "123.0.6312.86";
   };
   ungoogled-chromium = {
     deps = {

pkgs/applications/networking/cluster/cilium/default.nix

@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "cilium-cli";
-  version = "0.16.0";
+  version = "0.16.3";
 
   src = fetchFromGitHub {
     owner = "cilium";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-RJJETvgLdE/fJtd1LMShJ7Hm8/s1zUybhec6YPT44wg=";
+    hash = "sha256-WD0CUPl9Qkalhog2IbefMkiLiVZFW59X21sYH4hUqZs=";
   };
 
   vendorHash = null;

pkgs/applications/networking/cluster/fn-cli/default.nix

@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "fn";
-  version = "0.6.29";
+  version = "0.6.30";
 
   src = fetchFromGitHub {
     owner = "fnproject";
     repo = "cli";
     rev = version;
-    hash = "sha256-hN9Kok2+ZNYZsG+3ffzr1jGfIMg99JzgzC0x585KDF4=";
+    hash = "sha256-1j0Hd/SYoBhelCIFUFxkByczWSYFXjTE9TVH9E3Km+Y=";
   };
 
   vendorHash = null;

pkgs/applications/science/logic/alt-ergo/default.nix

@@ -2,11 +2,11 @@
 
 let
   pname = "alt-ergo";
-  version = "2.5.2";
+  version = "2.5.3";
 
   src = fetchurl {
     url = "https://github.com/OCamlPro/alt-ergo/releases/download/v${version}/alt-ergo-${version}.tbz";
-    hash = "sha256-9GDBcBH49sheO5AjmDsznMEbw0JSrnSOcIIRN40/aJU=";
+    hash = "sha256-tmWLZBLfdmfYlCQq+zcUneeueDAE6AJeZMy8kfNCC04=";
   };
 in
 

pkgs/build-support/kernel/make-initrd-ng/Cargo.lock

@@ -4,9 +4,9 @@ version = 3
 
 [[package]]
 name = "eyre"
-version = "0.6.11"
+version = "0.6.12"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b6267a1fa6f59179ea4afc8e50fd8612a3cc60bc858f786ff877a4a8cb042799"
+checksum = "7cd915d99f24784cdc19fd37ef22b97e3ff0ae756c7e492e9fbfe897d61e2aec"
 dependencies = [
  "indenter",
  "once_cell",

pkgs/by-name/cr/crunchy-cli/package.nix

@@ -5,17 +5,18 @@
 , openssl
 , pkg-config
 , rustPlatform
+, nix-update-script
 }:
 
 rustPlatform.buildRustPackage rec {
   pname = "crunchy-cli";
-  version = "3.2.5";
+  version = "3.3.1";
 
   src = fetchFromGitHub {
     owner = "crunchy-labs";
     repo = "crunchy-cli";
     rev = "v${version}";
-    hash = "sha256-hzmTwUd+bQwr+5UtXKMalJZUDxOC5nhXNTXbYZN8xtA=";
+    hash = "sha256-qpbAUqtSOLO1m4gF7+rwArIEpbGnssqw1B/kPrmOhm0=";
   };
 
   cargoLock = {
@@ -39,11 +40,13 @@ rustPlatform.buildRustPackage rec {
     OPENSSL_NO_VENDOR = true;
   };
 
-  meta = with lib; {
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
     description = "Command-line downloader for Crunchyroll";
     homepage = "https://github.com/crunchy-labs/crunchy-cli";
-    license = licenses.mit;
-    maintainers = with maintainers; [ stepbrobd ];
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ stepbrobd ];
     mainProgram = "crunchy-cli";
   };
 }

pkgs/by-name/du/dust/package.nix

@@ -5,13 +5,13 @@ rustPlatform.buildRustPackage rec {
   # Since then, `dust` has been freed up, allowing this package to take that attribute.
   # However in order for tools like `nix-env` to detect package updates, keep `du-dust` for pname.
   pname = "du-dust";
-  version = "0.9.0";
+  version = "1.0.0";
 
   src = fetchFromGitHub {
     owner = "bootandy";
     repo = "dust";
     rev = "v${version}";
-    hash = "sha256-5X7gRMTUrG6ecZnwExBTadOJo/HByohTMDsgxFmp1HM=";
+    hash = "sha256-KTsB9QqcLafG2XNj8PdkzwVrFDmpBQzNyDLajT/JDz0=";
     # Remove unicode file names which leads to different checksums on HFS+
     # vs. other filesystems because of unicode normalisation.
     postFetch = ''
@@ -19,7 +19,7 @@ rustPlatform.buildRustPackage rec {
     '';
   };
 
-  cargoHash = "sha256-uc7jbA8HqsH1bSJgbnUVT/f7F7kZJ4Jf3yyFvseH7no=";
+  cargoHash = "sha256-d6Mnuo6JlbuHUGz+UCmC8jvNks3SpeP/aNQGXHBzB+8=";
 
   nativeBuildInputs = [ installShellFiles ];
 
@@ -36,7 +36,7 @@ rustPlatform.buildRustPackage rec {
     description = "du + rust = dust. Like du but more intuitive";
     homepage = "https://github.com/bootandy/dust";
     license = licenses.asl20;
-    maintainers = with maintainers; [ infinisil ];
+    maintainers = with maintainers; [ aaronjheng ];
     mainProgram = "dust";
   };
 }

pkgs/by-name/et/ethercat/package.nix

@@ -0,0 +1,39 @@
+{ autoreconfHook
+, cmake
+, lib
+, pkg-config
+, stdenv
+, fetchFromGitLab
+, gitUpdater
+}:
+stdenv.mkDerivation (finalAttrs: {
+  pname = "ethercat";
+  version = "1.6-alpha";
+
+  src = fetchFromGitLab {
+    owner = "etherlab.org";
+    repo = "ethercat";
+    rev = "refs/tags/${finalAttrs.version}";
+    hash = "sha256-kzyA6h0rZFEROLcFZoU+2fIQ/Y0NwtdPuliKDbwkHrE=";
+  };
+
+  separateDebugInfo = true;
+
+  nativeBuildInputs = [ autoreconfHook pkg-config ];
+
+  configureFlags = [
+    "--enable-userlib=yes"
+    "--enable-kernel=no"
+  ];
+
+  passthru.updateScript = gitUpdater { };
+
+  meta = with lib; {
+    description = "IgH EtherCAT Master for Linux";
+    homepage = "https://etherlab.org/ethercat";
+    changelog = "https://gitlab.com/etherlab.org/ethercat/-/blob/${finalAttrs.version}/NEWS";
+    license = licenses.gpl2Plus;
+    maintainers = with maintainers; [ stv0g ];
+    platforms = [ "x86_64-linux" ];
+  };
+})

pkgs/by-name/sm/smuxi/package.nix

@@ -0,0 +1,105 @@
+{ stdenv
+, autoconf, automake, itstool, intltool, pkg-config
+, fetchFromGitHub
+, glib
+, gettext
+, sqlite
+, mono
+, stfl
+, makeWrapper, lib
+, guiSupport ? true
+, gtk-sharp-2_0
+, gdk-pixbuf
+, pango
+}:
+
+stdenv.mkDerivation rec {
+  pname = "smuxi";
+  version = "unstable-2023-07-01";
+
+  runtimeLoaderEnvVariableName = if stdenv.isDarwin then
+                                   "DYLD_FALLBACK_LIBRARY_PATH"
+                                 else
+                                   "LD_LIBRARY_PATH";
+
+  src = fetchFromGitHub {
+    owner = "meebey";
+    repo = "smuxi";
+    rev = "3e4b5050b66944532e95df3c31245c8ae6379b3f";
+    hash = "sha256-zSsckcEPEX99v3RkM4O4+Get5tnz4FOpiodoTGTZq+8=";
+    fetchSubmodules = true;
+  };
+
+  nativeBuildInputs = [ pkg-config ];
+  buildInputs = [ autoconf automake itstool intltool gettext
+    mono
+    stfl
+    makeWrapper ] ++ lib.optionals (guiSupport) [
+      gtk-sharp-2_0
+      # loaded at runtime by GTK#
+      gdk-pixbuf pango
+    ];
+
+  preConfigure = ''
+    NOCONFIGURE=1 NOGIT=1 ./autogen.sh
+  '';
+
+  configureFlags = [
+    "--disable-frontend-gnome"
+    "--enable-frontend-stfl"
+  ] ++ lib.optional guiSupport "--enable-frontend-gnome";
+
+  postInstall = ''
+    makeWrapper "${mono}/bin/mono" "$out/bin/smuxi-message-buffer" \
+      --add-flags "$out/lib/smuxi/smuxi-message-buffer.exe" \
+      --prefix ${runtimeLoaderEnvVariableName} : ${lib.makeLibraryPath [
+                                                  gettext sqlite
+                                                 ]}
+
+    makeWrapper "${mono}/bin/mono" "$out/bin/smuxi-server" \
+      --add-flags "$out/lib/smuxi/smuxi-server.exe" \
+      --prefix ${runtimeLoaderEnvVariableName} : ${lib.makeLibraryPath [
+                                                  gettext sqlite
+                                                 ]}
+
+    makeWrapper "${mono}/bin/mono" "$out/bin/smuxi-frontend-stfl" \
+      --add-flags "$out/lib/smuxi/smuxi-frontend-stfl.exe" \
+      --prefix ${runtimeLoaderEnvVariableName} : ${lib.makeLibraryPath [
+                                                  gettext sqlite stfl
+                                                 ]}
+
+    makeWrapper "${mono}/bin/mono" "$out/bin/smuxi-frontend-gnome" \
+      --add-flags "$out/lib/smuxi/smuxi-frontend-gnome.exe" \
+      --prefix MONO_GAC_PREFIX : ${if guiSupport then gtk-sharp-2_0 else ""} \
+      --prefix ${runtimeLoaderEnvVariableName} : ${lib.makeLibraryPath [
+                                                   gettext
+                                                   glib
+                                                   sqlite
+                                                   gtk-sharp-2_0
+                                                   gtk-sharp-2_0.gtk gdk-pixbuf pango
+                                                  ]}
+
+    # install log4net and nini libraries
+    mkdir -p $out/lib/smuxi/
+    cp -a lib/log4net.dll $out/lib/smuxi/
+    cp -a lib/Nini.dll $out/lib/smuxi/
+
+    # install GTK+ icon theme on Darwin
+    ${if guiSupport && stdenv.isDarwin then "
+      mkdir -p $out/lib/smuxi/icons/
+      cp -a images/Smuxi-Symbolic $out/lib/smuxi/icons/
+    " else ""}
+  '';
+
+  meta = with lib; {
+    homepage = "https://smuxi.im/";
+    downloadPage = "https://smuxi.im/download/";
+    changelog = "https://github.com/meebey/smuxi/releases/tag/v${version}";
+    description = "irssi-inspired, detachable, cross-platform, multi-protocol (IRC, XMPP/Jabber) chat client for the GNOME desktop";
+    platforms = platforms.unix;
+    license = lib.licenses.gpl2Plus;
+    maintainers = with maintainers; [
+      meebey
+    ];
+  };
+}

pkgs/by-name/ss/ssh-tpm-agent/package.nix

@@ -0,0 +1,34 @@
+{ lib
+, buildGo122Module
+, fetchFromGitHub
+, openssl
+}:
+
+buildGo122Module rec {
+  pname = "ssh-tpm-agent";
+  version = "0.3.1";
+
+  src = fetchFromGitHub {
+    owner = "Foxboron";
+    repo = "ssh-tpm-agent";
+    rev = "v${version}";
+    hash = "sha256-8CGSiCOcns4cWkYWqibs6hAFRipYabKPCpkhxF4OE8w=";
+  };
+
+  proxyVendor = true;
+
+  vendorHash = "sha256-zUAIesBeuh1zlxXcjKSNmMawZGgUr9z3NzT0XKn/YCQ=";
+
+  buildInputs = [
+    openssl
+  ];
+
+  meta = with lib; {
+    description = "SSH agent with support for TPM sealed keys for public key authentication";
+    homepage = "https://github.com/Foxboron/ssh-agent-tpm";
+    license = licenses.mit;
+    platforms = platforms.linux;
+    maintainers = with maintainers; [ sgo ];
+    mainProgram = "ssh-tpm-agent";
+  };
+}

pkgs/by-name/st/steampipe/package.nix

@@ -3,8 +3,8 @@
   fetchFromGitHub,
   installShellFiles,
   lib,
+  makeWrapper,
   nix-update-script,
-  stdenv,
   steampipe,
   testers,
 }:
@@ -16,30 +16,48 @@ buildGoModule rec {
   src = fetchFromGitHub {
     owner = "turbot";
     repo = "steampipe";
-    rev = "v${version}";
+    rev = "refs/tags/v${version}";
     hash = "sha256-Oz1T9koeXnmHc5oru1apUtmhhvKi/gAtg/Hb7HKkkP0=";
   };
 
   vendorHash = "sha256-U0BeGCRLjL56ZmVKcKqrrPTCXpShJzJq5/wnXDKax6g=";
   proxyVendor = true;
 
-  patchPhase = ''
-    runHook prePatch
+  postPatch = ''
     # Patch test that relies on looking up homedir in user struct to prefer ~
     substituteInPlace pkg/steampipeconfig/shared_test.go \
-      --replace 'filehelpers "github.com/turbot/go-kit/files"' "" \
-      --replace 'filepaths.SteampipeDir, _ = filehelpers.Tildefy("~/.steampipe")' 'filepaths.SteampipeDir = "~/.steampipe"';
-    runHook postPatch
+      --replace-fail 'filehelpers "github.com/turbot/go-kit/files"' "" \
+      --replace-fail 'filepaths.SteampipeDir, _ = filehelpers.Tildefy("~/.steampipe")' 'filepaths.SteampipeDir = "~/.steampipe"';
   '';
 
-  nativeBuildInputs = [ installShellFiles ];
+  nativeBuildInputs = [
+    installShellFiles
+    makeWrapper
+  ];
 
-  ldflags = [ "-s" "-w" ];
+  ldflags = [
+    "-s"
+    "-w"
+  ];
 
+  doCheck = true;
+
+  checkFlags =
+    let
+      skippedTests = [
         # panic: could not create backups directory: mkdir /var/empty/.steampipe: operation not permitted
-  doCheck = !stdenv.isDarwin;
+        "TestTrimBackups"
+        # Skip tests that require network access
+        "TestIsPortBindable"
+      ];
+    in
+    [ "-skip=^${builtins.concatStringsSep "$|^" skippedTests}$" ];
 
   postInstall = ''
+    wrapProgram $out/bin/steampipe \
+      --set-default STEAMPIPE_UPDATE_CHECK false \
+      --set-default STEAMPIPE_TELEMETRY none
+
     INSTALL_DIR=$(mktemp -d)
     installShellCompletion --cmd steampipe \
       --bash <($out/bin/steampipe --install-dir $INSTALL_DIR completion bash) \
@@ -56,12 +74,12 @@ buildGoModule rec {
     updateScript = nix-update-script { };
   };
 
-  meta = with lib; {
-    homepage = "https://steampipe.io/";
-    description = "select * from cloud;";
-    license = licenses.agpl3Only;
-    mainProgram = "steampipe";
-    maintainers = with maintainers; [ hardselius ];
+  meta = {
     changelog = "https://github.com/turbot/steampipe/blob/v${version}/CHANGELOG.md";
+    description = "Dynamically query your cloud, code, logs & more with SQL";
+    homepage = "https://steampipe.io/";
+    license = lib.licenses.agpl3Only;
+    mainProgram = "steampipe";
+    maintainers = with lib.maintainers; [ hardselius anthonyroussel ];
   };
 }

pkgs/by-name/ug/ugrep-indexer/package.nix

@@ -0,0 +1,40 @@
+{ lib
+, stdenv
+, fetchFromGitHub
+, brotli
+, bzip2
+, lz4
+, xz
+, zlib
+, zstd
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "ugrep-indexer";
+  version = "0.9.6";
+
+  src = fetchFromGitHub {
+    owner = "Genivia";
+    repo = "ugrep-indexer";
+    rev = "v${finalAttrs.version}";
+    hash = "sha256-ZXZF9ZSdfQ2gxi5JkDJCUzMbkTs9KLzZBsyYxR/v4tI=";
+  };
+
+  buildInputs = [
+    brotli
+    bzip2
+    lz4
+    zlib
+    zstd
+    xz
+  ];
+
+  meta = with lib; {
+    description = "Utility that recursively indexes files to speed up recursive grepping";
+    homepage = "https://github.com/Genivia/ugrep-indexer";
+    changelog = "https://github.com/Genivia/ugrep-indexer/releases/tag/v${finalAttrs.version}";
+    maintainers = with maintainers; [ mikaelfangel ];
+    license = licenses.bsd3;
+    platforms = platforms.all;
+  };
+})

pkgs/development/libraries/gtk-sharp/2.0.nix

@@ -65,7 +65,7 @@ stdenv.mkDerivation rec {
   meta = with lib; {
     description = "Graphical User Interface Toolkit for mono and .Net";
     homepage = "https://www.mono-project.com/docs/gui/gtksharp";
-    platforms = platforms.linux;
+    platforms = platforms.unix;
     license = licenses.gpl2;
   };
 }

pkgs/development/ocaml-modules/irmin/chunk.nix

@@ -4,7 +4,6 @@ buildDunePackage rec {
 
   pname = "irmin-chunk";
   inherit (irmin) version src strictDeps;
-  duneVersion = "3";
 
   propagatedBuildInputs = [ irmin fmt logs lwt ];
 

pkgs/development/ocaml-modules/irmin/containers.nix

@@ -7,7 +7,6 @@ buildDunePackage {
   pname = "irmin-containers";
 
   inherit (ppx_irmin) src version strictDeps;
-  duneVersion = "3";
 
   nativeBuildInputs = [
     ppx_irmin

pkgs/development/ocaml-modules/irmin/default.nix

@@ -10,7 +10,6 @@ buildDunePackage {
   inherit (ppx_irmin) src version strictDeps;
 
   minimalOCamlVersion = "4.10";
-  duneVersion = "3";
 
   propagatedBuildInputs = [
     astring

pkgs/development/ocaml-modules/irmin/fs.nix

@@ -7,7 +7,6 @@ buildDunePackage rec {
   pname = "irmin-fs";
 
   inherit (irmin) version src strictDeps;
-  duneVersion = "3";
 
   propagatedBuildInputs = [ irmin astring logs lwt ];
 

pkgs/development/ocaml-modules/irmin/git.nix

@@ -10,7 +10,6 @@ buildDunePackage {
   pname = "irmin-git";
 
   inherit (irmin) version src strictDeps;
-  duneVersion = "3";
 
   propagatedBuildInputs = [
     git

pkgs/development/ocaml-modules/irmin/graphql.nix

@@ -7,7 +7,6 @@ buildDunePackage rec {
   pname = "irmin-graphql";
 
   inherit (irmin) version src;
-  duneVersion = "3";
 
   propagatedBuildInputs = [ cohttp-lwt cohttp-lwt-unix graphql-cohttp graphql-lwt irmin git-unix ];
 

pkgs/development/ocaml-modules/irmin/http.nix

@@ -9,8 +9,6 @@ buildDunePackage rec {
   pname = "irmin-http";
 
   inherit (irmin) version src strictDeps;
-  duneVersion = "3";
-
 
   propagatedBuildInputs = [ astring cohttp-lwt cohttp-lwt-unix fmt jsonm logs lwt uri irmin webmachine ];
 
@@ -25,5 +23,3 @@ buildDunePackage rec {
   };
 
 }
-
-

pkgs/development/ocaml-modules/irmin/mirage-git.nix

@@ -7,7 +7,6 @@ buildDunePackage {
   pname = "irmin-mirage-git";
 
   inherit (irmin-mirage) version src strictDeps;
-  duneVersion = "3";
 
   propagatedBuildInputs = [
     irmin-mirage

pkgs/development/ocaml-modules/irmin/mirage-graphql.nix

@@ -6,7 +6,6 @@ buildDunePackage {
   pname = "irmin-mirage-graphql";
 
   inherit (irmin-mirage) version src strictDeps;
-  duneVersion = "3";
 
   propagatedBuildInputs = [
     irmin-mirage

pkgs/development/ocaml-modules/irmin/mirage.nix

@@ -4,7 +4,6 @@ buildDunePackage {
   pname = "irmin-mirage";
 
   inherit (irmin) version src strictDeps;
-  duneVersion = "3";
 
   propagatedBuildInputs = [
     irmin fmt ptime mirage-clock

pkgs/development/ocaml-modules/irmin/pack.nix

@@ -4,8 +4,7 @@
 }:
 
 buildDunePackage rec {
-  minimalOCamlVersion = "4.10";
-  duneVersion = "3";
+  minimalOCamlVersion = "4.12";
 
   pname = "irmin-pack";
 

pkgs/development/ocaml-modules/irmin/ppx.nix

@@ -2,15 +2,14 @@
 
 buildDunePackage rec {
   pname = "ppx_irmin";
-  version = "3.5.1";
+  version = "3.7.2";
 
   src = fetchurl {
     url = "https://github.com/mirage/irmin/releases/download/${version}/irmin-${version}.tbz";
-    hash = "sha256-zXiKjT9KPdGNwWChU9SuyR6vaw+0GtQUZNJsecMEqY4=";
+    hash = "sha256-aqW6TGoCM3R9S9OrOW8rOjO7gPnY7UoXjIOgNQM8DlI=";
   };
 
   minimalOCamlVersion = "4.10";
-  duneVersion = "3";
 
   propagatedBuildInputs = [
     ppx_repr

pkgs/development/ocaml-modules/irmin/test.nix

@@ -8,7 +8,6 @@ buildDunePackage {
   pname = "irmin-test";
 
   inherit (irmin) version src strictDeps;
-  duneVersion = "3";
 
   nativeBuildInputs = [ ppx_irmin ];
 

pkgs/development/ocaml-modules/irmin/tezos.nix

@@ -7,7 +7,6 @@ buildDunePackage rec {
   pname = "irmin-tezos";
 
   inherit (irmin) version src strictDeps;
-  duneVersion = "3";
 
   propagatedBuildInputs = [
     irmin

pkgs/development/python-modules/uproot/default.nix

@@ -19,7 +19,7 @@
 
 buildPythonPackage rec {
   pname = "uproot";
-  version = "5.3.1";
+  version = "5.3.2";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -28,7 +28,7 @@ buildPythonPackage rec {
     owner = "scikit-hep";
     repo = "uproot5";
     rev = "refs/tags/v${version}";
-    hash = "sha256-cZVdsemaA3ni6xFfrkyLJA+12B7vyURj9OYVuOhqTXU=";
+    hash = "sha256-dq362pevqgLx5KwZ19zQ6aOn5NCyiqynPCF7YdI6tkw=";
   };
 
   nativeBuildInputs = [
@@ -59,13 +59,16 @@ buildPythonPackage rec {
 
   disabledTests = [
     # Tests that try to download files
+    "test_descend_into_path_classname_of"
     "test_fallback"
     "test_file"
     "test_fsspec_cache_http"
     "test_fsspec_cache_http_directory"
     "test_fsspec_chunks"
     "test_fsspec_globbing_http"
+    "test_fsspec_writing_http"
     "test_fsspec_writing_memory"
+    "test_fsspec_writing_ssh"
     "test_http"
     "test_http_fallback"
     "test_http_multipart"
@@ -74,9 +77,11 @@ buildPythonPackage rec {
     "test_http_size_port"
     "test_issue_1054_filename_colons"
     "test_no_multipart"
-    "test_open_fsspec_http"
     "test_open_fsspec_github"
+    "test_open_fsspec_http"
+    "test_open_fsspec_ss"
     "test_pickle_roundtrip_http"
+    "test_split_ranges_if_large_file_in_http"
     # Cyclic dependency with dask-awkward
     "test_decompression_executor_for_dask"
   ];

pkgs/development/tools/impl/default.nix

@@ -2,20 +2,16 @@
 
 buildGoModule rec {
   pname = "impl";
-  version = "1.2.0";
+  version = "1.3.0";
 
   src = fetchFromGitHub {
     owner = "josharian";
     repo = "impl";
     rev = "v${version}";
-    hash = "sha256-BqRoLh0MpNQgY9OHHRBbegWGsq3Y4wOqg94rWvex76I=";
+    hash = "sha256-a9jAoZp/wVnTyaE4l2yWSf5aSxXEtqN6SoxU68XhRhk=";
   };
 
-  vendorHash = "sha256-+5+CM5iGV54zRa7rJoQDBWrO98icNxlAv8JwATynanY=";
-
-  preCheck = ''
-    export GOROOT="$(go env GOROOT)"
-  '';
+  vendorHash = "sha256-vTqDoM/LK5SHkayLKYig+tCrXLelOoILmQGCxlTWHog=";
 
   meta = with lib; {
     description = "Generate method stubs for implementing an interface";

pkgs/development/web/nodejs/v18.nix

@@ -19,8 +19,8 @@ let
 in
 buildNodejs {
   inherit enableNpm;
-  version = "18.19.1";
-  sha256 = "sha256-CQ+WouzeCAtrOCxtZCvKXQvkcCp4y1Vb578CsgvRbe0=";
+  version = "18.20.0";
+  sha256 = "sha256-BMhneaLMfu/fzzeanYWIOqHTsdyJCbYiGxY2hIF4VqQ=";
   patches = [
     ./disable-darwin-v8-system-instrumentation.patch
     ./bypass-darwin-xcrun-node16.patch

pkgs/os-specific/linux/kernel/common-config.nix

@@ -173,7 +173,7 @@ let
       DAMON_VADDR = whenAtLeast "5.15" yes;
       DAMON_PADDR = whenAtLeast "5.16" yes;
       DAMON_SYSFS = whenAtLeast "5.18" yes;
-      DAMON_DBGFS = whenAtLeast "5.15" yes;
+      DAMON_DBGFS = whenBetween "5.15" "6.9" yes;
       DAMON_RECLAIM = whenAtLeast "5.16" yes;
       DAMON_LRU_SORT = whenAtLeast "6.0" yes;
       # Support recovering from memory failures on systems with ECC and MCA recovery.
@@ -577,7 +577,7 @@ let
       EXT4_FS_SECURITY  = yes;
       EXT4_ENCRYPTION   = whenOlder "5.1" yes;
 
-      NTFS_FS            = whenAtLeast "5.15" no;
+      NTFS_FS            = whenBetween "5.15" "6.9" no;
       NTFS3_LZX_XPRESS   = whenAtLeast "5.15" yes;
       NTFS3_FS_POSIX_ACL = whenAtLeast "5.15" yes;
 
@@ -728,7 +728,8 @@ let
       X86_USER_SHADOW_STACK = whenAtLeast "6.6" yes;
 
       # Mitigate straight line speculation at the cost of some file size
-      SLS = whenAtLeast "5.17" yes;
+      SLS = whenBetween "5.17" "6.9" yes;
+      MITIGATION_SLS = whenAtLeast "6.9" yes;
     };
 
     microcode = {

pkgs/os-specific/linux/kernel/kernels-org.json

@@ -1,7 +1,7 @@
 {
     "testing": {
-        "version": "6.8-rc7",
-        "hash": "sha256:0q9isgv6lxzrmb4idl0spxv2l7fsk3nn4cdq0vdw9c8lyzrh5yy0"
+        "version": "6.9-rc1",
+        "hash": "sha256:05hi2vfmsjwl5yhqmy4h5a954090nv48z9gabhvh16xlaqlfh8nz"
     },
     "6.1": {
         "version": "6.1.82",

pkgs/os-specific/linux/kernel/linux-rt-5.10.nix

@@ -6,7 +6,7 @@
 , ... } @ args:
 
 let
-  version = "5.10.211-rt103"; # updated by ./update-rt.sh
+  version = "5.10.213-rt105"; # updated by ./update-rt.sh
   branch = lib.versions.majorMinor version;
   kversion = builtins.elemAt (lib.splitString "-" version) 0;
 in buildLinux (args // {
@@ -17,14 +17,14 @@ in buildLinux (args // {
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v5.x/linux-${kversion}.tar.xz";
-    sha256 = "1cir36s369fl6s46x16xnjg0wdlnkipsp2zhz11m9d3z205hly1s";
+    sha256 = "105df7w6m5a3fngi6ajqs5qblaq4lbxsgcppllrk7v1r68i31kw4";
   };
 
   kernelPatches = let rt-patch = {
     name = "rt";
     patch = fetchurl {
       url = "mirror://kernel/linux/kernel/projects/rt/${branch}/older/patch-${version}.patch.xz";
-      sha256 = "07br63p90gwmijxq8ad7iyi4d3fkm6jwwl2s2k1549bbaldchbk6";
+      sha256 = "1q5kz3mfvwb4fd5i2mbklsa6gifb8g3wbq0wi2478q097dvmb6gi";
     };
   }; in [ rt-patch ] ++ kernelPatches;
 

pkgs/os-specific/linux/kernel/linux-rt-6.1.nix

@@ -6,7 +6,7 @@
 , ... } @ args:
 
 let
-  version = "6.1.80-rt26"; # updated by ./update-rt.sh
+  version = "6.1.82-rt27"; # updated by ./update-rt.sh
   branch = lib.versions.majorMinor version;
   kversion = builtins.elemAt (lib.splitString "-" version) 0;
 in buildLinux (args // {
@@ -18,14 +18,14 @@ in buildLinux (args // {
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v6.x/linux-${kversion}.tar.xz";
-    sha256 = "0wdnyy7m9kfkl98id0gm6jzp4aa0hfy6gfkb4k4cg1wbpfpcm3jn";
+    sha256 = "01pcrcjp5mifjjmfz7j1jb8nhq8nkxspavxmv1l7d1qnskcx4l6i";
   };
 
   kernelPatches = let rt-patch = {
     name = "rt";
     patch = fetchurl {
       url = "mirror://kernel/linux/kernel/projects/rt/${branch}/older/patch-${version}.patch.xz";
-      sha256 = "0w47ii5xhsbnkmgzlgg18ljwdms88scbzhqlw0qv3lnldicykg0p";
+      sha256 = "03mj6p9z5c2hzdl46479gb9x41papq91g86yyc61fv8hj8kxgysc";
     };
   }; in [ rt-patch ] ++ kernelPatches;
 

pkgs/os-specific/linux/kernel/linux-rt-6.6.nix

@@ -6,7 +6,7 @@
 , ... } @ args:
 
 let
-  version = "6.6.21-rt26"; # updated by ./update-rt.sh
+  version = "6.6.22-rt27"; # updated by ./update-rt.sh
   branch = lib.versions.majorMinor version;
   kversion = builtins.elemAt (lib.splitString "-" version) 0;
 in buildLinux (args // {
@@ -18,14 +18,14 @@ in buildLinux (args // {
 
   src = fetchurl {
     url = "mirror://kernel/linux/kernel/v6.x/linux-${kversion}.tar.xz";
-    sha256 = "0mz420w99agr7jv1jgqfr4fjhzbv005xif086sqx556s900l62zf";
+    sha256 = "1x52c6ywmspp3naishzsknhy7i0b7mv9baxx25a0y987cjsygqr3";
   };
 
   kernelPatches = let rt-patch = {
     name = "rt";
     patch = fetchurl {
       url = "mirror://kernel/linux/kernel/projects/rt/${branch}/older/patch-${version}.patch.xz";
-      sha256 = "1sh2jkm3h52a5dkc72xgrw1kz1faw1kzhpbqg64gsxbivmxfvf21";
+      sha256 = "01n9khj51xf8dj2hhxhlkha4f8hwf6w5marc227ljm9w5hlza12g";
     };
   }; in [ rt-patch ] ++ kernelPatches;
 

pkgs/tools/admin/cf-vault/default.nix

@@ -1,4 +1,4 @@
-{buildGoModule, fetchFromGitHub, lib}:
+{buildGoModule, fetchFromGitHub, lib, testers, cf-vault}:
 buildGoModule rec {
   pname = "cf-vault";
   version = "0.0.18";
@@ -10,8 +10,19 @@ buildGoModule rec {
     sha256 = "sha256-vp9ufjNZabY/ck2lIT+QpD6IgaVj1BkBRTjPxkb6IjQ=";
   };
 
+  ldflags = [
+    "-s"
+    "-w"
+    "-X github.com/jacobbednarz/cf-vault/cmd.Rev=${version}"
+  ];
+
   vendorHash = "sha256-7qFB1Y1AnqMgdu186tAXCdoYOhCMz8pIh6sY02LbIgs=";
 
+  passthru.tests.version = testers.testVersion {
+    package = cf-vault;
+    command = "cf-vault version";
+  };
+
   meta = with lib; {
     description = ''
       A tool for managing your Cloudflare credentials, securely..

pkgs/tools/misc/nvimpager/default.nix

@@ -31,14 +31,15 @@ stdenv.mkDerivation rec {
   doCheck = true;
   nativeCheckInputs = [ lua51Packages.busted util-linux neovim ];
   # filter out one test that fails in the sandbox of nix
-  checkPhase = ''
+  checkPhase = let
+    exclude-tags = if stdenv.isDarwin then "nix,mac" else "nix";
+  in ''
     runHook preCheck
-    make test BUSTED='busted --output TAP --exclude-tags=nix'
+    make test BUSTED='busted --output TAP --exclude-tags=${exclude-tags}'
     runHook postCheck
   '';
 
   meta = with lib; {
-    broken = stdenv.isDarwin;
     description = "Use neovim as pager";
     longDescription = ''
       Use neovim as a pager to view manpages, diffs, etc with nvim's syntax

pkgs/top-level/linux-kernels.nix

@@ -214,8 +214,6 @@ in {
         kernelPatches = [
           kernelPatches.bridge_stp_helper
           kernelPatches.request_key_helper
-          kernelPatches.rust_1_75
-          kernelPatches.rust_1_76
         ];
       };
       latest = packageAliases.linux_latest.kernel;