Merge master into haskell-updates

doc/languages-frameworks/rust.section.md

@@ -963,7 +963,7 @@ repository:
      lib.updateManyAttrsByPath [{
        path = [ "packages" "stable" ];
        update = old: old.overrideScope(final: prev: {
-         rustc = prev.rustc.overrideAttrs (_: {
+         rustc-unwrapped = prev.rustc-unwrapped.overrideAttrs (_: {
            src = lib.cleanSource /git/scratch/rust;
            # do *not* put passthru.isReleaseTarball=true here
          });
@@ -1003,4 +1003,3 @@ nix-build $NIXPKGS -A package-broken-by-rust-changes
 The `git submodule update --init` and `cargo vendor` commands above
 require network access, so they can't be performed from within the
 `rustc` derivation, unfortunately.
-

flake.nix

@@ -9,7 +9,8 @@
         nixpkgs = self;
       };
 
-      lib = import ./lib;
+      libVersionInfoOverlay = import ./lib/flake-version-info.nix self;
+      lib = (import ./lib).extend libVersionInfoOverlay;
 
       forAllSystems = lib.genAttrs lib.systems.flakeExposed;
     in
@@ -20,13 +21,7 @@
 
         nixosSystem = args:
           import ./nixos/lib/eval-config.nix (
-            args // {
-              modules = args.modules ++ [{
-                system.nixos.versionSuffix =
-                  ".${final.substring 0 8 (self.lastModifiedDate or self.lastModified or "19700101")}.${self.shortRev or "dirty"}";
-                system.nixos.revision = final.mkIf (self ? rev) self.rev;
-              }];
-            } // lib.optionalAttrs (! args?system) {
+            args // { inherit (self) lib; } // lib.optionalAttrs (! args?system) {
               # Allow system to be set modularly in nixpkgs.system.
               # We set it to null, to remove the "legacy" entrypoint's
               # non-hermetic default.
@@ -53,7 +48,11 @@
       # attribute it displays `omitted` instead of evaluating all packages,
       # which keeps `nix flake show` on Nixpkgs reasonably fast, though less
       # information rich.
-      legacyPackages = forAllSystems (system: import ./. { inherit system; });
+      legacyPackages = forAllSystems (system:
+        (import ./. { inherit system; }).extend (final: prev: {
+          lib = prev.lib.extend libVersionInfoOverlay;
+        })
+      );
 
       nixosModules = {
         notDetected = ./nixos/modules/installer/scan/not-detected.nix;

lib/attrsets.nix

@@ -51,12 +51,19 @@ rec {
 
   /* Return if an attribute from nested attribute set exists.
 
+     **Laws**:
+      1.  ```nix
+          hasAttrByPath [] x == true
+          ```
+
      Example:
        x = { a = { b = 3; }; }
        hasAttrByPath ["a" "b"] x
        => true
        hasAttrByPath ["z" "z"] x
        => false
+       hasAttrByPath [] (throw "no need")
+       => true
 
     Type:
       hasAttrByPath :: [String] -> AttrSet -> Bool
@@ -80,6 +87,71 @@ rec {
     in
       hasAttrByPath' 0 e;
 
+  /*
+    Return the longest prefix of an attribute path that refers to an existing attribute in a nesting of attribute sets.
+
+    Can be used after [`mapAttrsRecursiveCond`](#function-library-lib.attrsets.mapAttrsRecursiveCond) to apply a condition,
+    although this will evaluate the predicate function on sibling attributes as well.
+
+    Note that the empty attribute path is valid for all values, so this function only throws an exception if any of its inputs does.
+
+    **Laws**:
+    1.  ```nix
+        attrsets.longestValidPathPrefix [] x == []
+        ```
+
+    2.  ```nix
+        hasAttrByPath (attrsets.longestValidPathPrefix p x) x == true
+        ```
+
+    Example:
+      x = { a = { b = 3; }; }
+      attrsets.longestValidPathPrefix ["a" "b" "c"] x
+      => ["a" "b"]
+      attrsets.longestValidPathPrefix ["a"] x
+      => ["a"]
+      attrsets.longestValidPathPrefix ["z" "z"] x
+      => []
+      attrsets.longestValidPathPrefix ["z" "z"] (throw "no need")
+      => []
+
+    Type:
+      attrsets.longestValidPathPrefix :: [String] -> Value -> [String]
+  */
+  longestValidPathPrefix =
+    # A list of strings representing the longest possible path that may be returned.
+    attrPath:
+    # The nested attribute set to check.
+    v:
+    let
+      lenAttrPath = length attrPath;
+      getPrefixForSetAtIndex =
+        # The nested attribute set to check, if it is an attribute set, which
+        # is not a given.
+        remainingSet:
+        # The index of the attribute we're about to check, as well as
+        # the length of the prefix we've already checked.
+        remainingPathIndex:
+
+          if remainingPathIndex == lenAttrPath then
+            # All previously checked attributes exist, and no attr names left,
+            # so we return the whole path.
+            attrPath
+          else
+            let
+              attr = elemAt attrPath remainingPathIndex;
+            in
+            if remainingSet ? ${attr} then
+              getPrefixForSetAtIndex
+                remainingSet.${attr}      # advance from the set to the attribute value
+                (remainingPathIndex + 1)  # advance the path
+            else
+              # The attribute doesn't exist, so we return the prefix up to the
+              # previously checked length.
+              take remainingPathIndex attrPath;
+    in
+      getPrefixForSetAtIndex v 0;
+
   /* Create a new attribute set with `value` set at the nested attribute location specified in `attrPath`.
 
      Example:

lib/flake-version-info.nix

@@ -0,0 +1,20 @@
+# This function produces a lib overlay to be used by the nixpkgs
+# & nixpkgs/lib flakes to provide meaningful values for
+# `lib.trivial.version` et al..
+#
+# Internal and subject to change, don't use this anywhere else!
+# Instead, consider using a public interface, such as this flake here
+# in this directory, `lib/`, or use the nixpkgs flake, which applies
+# this logic for you in its `lib` output attribute.
+
+self: # from the flake
+
+finalLib: prevLib: # lib overlay
+
+{
+  trivial = prevLib.trivial // {
+    versionSuffix =
+      ".${finalLib.substring 0 8 (self.lastModifiedDate or "19700101")}.${self.shortRev or "dirty"}";
+    revisionWithDefault = default: self.rev or default;
+  };
+}

lib/flake.nix

@@ -1,5 +1,10 @@
 {
   description = "Library of low-level helper functions for nix expressions.";
 
-  outputs = { self }: { lib = import ./.; };
+  outputs = { self }:
+    let
+      lib0 = import ./.;
+    in {
+      lib = lib0.extend (import ./flake-version-info.nix self);
+    };
 }

lib/strings.nix

@@ -715,12 +715,12 @@ rec {
        getName pkgs.youtube-dl
        => "youtube-dl"
   */
-  getName = x:
-   let
-     parse = drv: (parseDrvName drv).name;
-   in if isString x
-      then parse x
-      else x.pname or (parse x.name);
+  getName = let
+    parse = drv: (parseDrvName drv).name;
+  in x:
+    if isString x
+    then parse x
+    else x.pname or (parse x.name);
 
   /* This function takes an argument that's either a derivation or a
      derivation's "name" attribute and extracts the version part from that
@@ -732,12 +732,12 @@ rec {
        getVersion pkgs.youtube-dl
        => "2016.01.01"
   */
-  getVersion = x:
-   let
-     parse = drv: (parseDrvName drv).version;
-   in if isString x
-      then parse x
-      else x.version or (parse x.name);
+  getVersion = let
+    parse = drv: (parseDrvName drv).version;
+  in x:
+    if isString x
+    then parse x
+    else x.version or (parse x.name);
 
   /* Extract name with version from URL. Ask for separator which is
      supposed to start extension.
@@ -771,12 +771,13 @@ rec {
        cmakeOptionType "string" "ENGINE" "sdl2"
        => "-DENGINE:STRING=sdl2"
   */
-  cmakeOptionType = type: feature: value:
-    assert (lib.elem (lib.toUpper type)
-      [ "BOOL" "FILEPATH" "PATH" "STRING" "INTERNAL" ]);
-    assert (lib.isString feature);
-    assert (lib.isString value);
-    "-D${feature}:${lib.toUpper type}=${value}";
+  cmakeOptionType = let
+    types = [ "BOOL" "FILEPATH" "PATH" "STRING" "INTERNAL" ];
+  in type: feature: value:
+    assert (elem (toUpper type) types);
+    assert (isString feature);
+    assert (isString value);
+    "-D${feature}:${toUpper type}=${value}";
 
   /* Create a -D<condition>={TRUE,FALSE} string that can be passed to typical
      CMake invocations.
@@ -977,9 +978,11 @@ rec {
      Many types of value are coercible to string this way, including int, float,
      null, bool, list of similarly coercible values.
   */
-  isConvertibleWithToString = x:
+  isConvertibleWithToString = let
+    types = [ "null" "int" "float" "bool" ];
+  in x:
     isStringLike x ||
-    elem (typeOf x) [ "null" "int" "float" "bool" ] ||
+    elem (typeOf x) types ||
     (isList x && lib.all isConvertibleWithToString x);
 
   /* Check whether a value can be coerced to a string.

lib/tests/misc.nix

@@ -697,6 +697,51 @@ runTests {
     expected = false;
   };
 
+  testHasAttrByPathNonStrict = {
+    expr = hasAttrByPath [] (throw "do not use");
+    expected = true;
+  };
+
+  testLongestValidPathPrefix_empty_empty = {
+    expr = attrsets.longestValidPathPrefix [ ] { };
+    expected = [ ];
+  };
+
+  testLongestValidPathPrefix_empty_nonStrict = {
+    expr = attrsets.longestValidPathPrefix [ ] (throw "do not use");
+    expected = [ ];
+  };
+
+  testLongestValidPathPrefix_zero = {
+    expr = attrsets.longestValidPathPrefix [ "a" (throw "do not use") ] { d = null; };
+    expected = [ ];
+  };
+
+  testLongestValidPathPrefix_zero_b = {
+    expr = attrsets.longestValidPathPrefix [ "z" "z" ] "remarkably harmonious";
+    expected = [ ];
+  };
+
+  testLongestValidPathPrefix_one = {
+    expr = attrsets.longestValidPathPrefix [ "a" "b" "c" ] { a = null; };
+    expected = [ "a" ];
+  };
+
+  testLongestValidPathPrefix_two = {
+    expr = attrsets.longestValidPathPrefix [ "a" "b" "c" ] { a.b = null; };
+    expected = [ "a" "b" ];
+  };
+
+  testLongestValidPathPrefix_three = {
+    expr = attrsets.longestValidPathPrefix [ "a" "b" "c" ] { a.b.c = null; };
+    expected = [ "a" "b" "c" ];
+  };
+
+  testLongestValidPathPrefix_three_extra = {
+    expr = attrsets.longestValidPathPrefix [ "a" "b" "c" ] { a.b.c.d = throw "nope"; };
+    expected = [ "a" "b" "c" ];
+  };
+
   testFindFirstIndexExample1 = {
     expr = lists.findFirstIndex (x: x > 3) (abort "index found, so a default must not be evaluated") [ 1 6 4 ];
     expected = 1;

lib/trivial.nix

@@ -1,6 +1,18 @@
 { lib }:
 
-rec {
+let
+  inherit (lib.trivial)
+    isFunction
+    isInt
+    functionArgs
+    pathExists
+    release
+    setFunctionArgs
+    toBaseDigits
+    version
+    versionSuffix
+    warn;
+in {
 
   ## Simple (higher order) functions
 
@@ -58,9 +70,7 @@ rec {
      of the next function, and the last function returns the
      final value.
   */
-  pipe = val: functions:
-    let reverseApply = x: f: f x;
-    in builtins.foldl' reverseApply val functions;
+  pipe = builtins.foldl' (x: f: f x);
 
   # note please don’t add a function like `compose = flip pipe`.
   # This would confuse users, because the order of the functions
@@ -439,7 +449,7 @@ rec {
   */
   functionArgs = f:
     if f ? __functor
-    then f.__functionArgs or (lib.functionArgs (f.__functor f))
+    then f.__functionArgs or (functionArgs (f.__functor f))
     else builtins.functionArgs f;
 
   /* Check whether something is a function or something
@@ -510,22 +520,20 @@ rec {
 
      toHexString 250 => "FA"
   */
-  toHexString = i:
-    let
-      toHexDigit = d:
-        if d < 10
-        then toString d
-        else
-          {
-            "10" = "A";
-            "11" = "B";
-            "12" = "C";
-            "13" = "D";
-            "14" = "E";
-            "15" = "F";
-          }.${toString d};
-    in
-      lib.concatMapStrings toHexDigit (toBaseDigits 16 i);
+  toHexString = let
+    hexDigits = {
+      "10" = "A";
+      "11" = "B";
+      "12" = "C";
+      "13" = "D";
+      "14" = "E";
+      "15" = "F";
+    };
+    toHexDigit = d:
+      if d < 10
+      then toString d
+      else hexDigits.${toString d};
+  in i: lib.concatMapStrings toHexDigit (toBaseDigits 16 i);
 
   /* `toBaseDigits base i` converts the positive integer i to a list of its
      digits in the given base. For example:

maintainers/maintainer-list.nix

@@ -605,6 +605,12 @@
     githubId = 4717906;
     name = "Jakub Skokan";
   };
+  ajaxbits = {
+    email = "contact@ajaxbits.com";
+    github = "ajaxbits";
+    githubId = 45179933;
+    name = "Alex Jackson";
+  };
   ajgrf = {
     email = "a@ajgrf.com";
     github = "ajgrf";

maintainers/team-list.nix

@@ -290,6 +290,7 @@ with lib.maintainers; {
     members = [
       theuni
       dpausp
+      frlan
       leona
     ];
     scope = "Team for Flying Circus employees who collectively maintain packages.";

nixos/doc/manual/release-notes/rl-2405.section.md

@@ -50,6 +50,8 @@ The pre-existing [services.ankisyncd](#opt-services.ankisyncd.enable) has been m
   The `nimPackages` and `nim2Packages` sets have been removed.
   See https://nixos.org/manual/nixpkgs/unstable#nim for more information.
 
+- `libass` now uses the native CoreText backend on Darwin, which may fix subtitle rendering issues with `mpv`, `ffmpeg`, etc.
+
 - The Yama LSM is now enabled by default in the kernel, which prevents ptracing
   non-child processes. This means you will not be able to attach gdb to an
   existing process, but will need to start that process from gdb (so it is a

nixos/modules/programs/firejail.nix

@@ -53,7 +53,7 @@ in {
           desktop = mkOption {
             type = types.nullOr types.path;
             default = null;
-            description = lib.mkDoc ".desktop file to modify. Only necessary if it uses the absolute path to the executable.";
+            description = lib.mdDoc ".desktop file to modify. Only necessary if it uses the absolute path to the executable.";
             example = literalExpression ''"''${pkgs.firefox}/share/applications/firefox.desktop"'';
           };
           profile = mkOption {

nixos/modules/security/acme/default.md

@@ -45,7 +45,7 @@ placeholder certificates in place of the real ACME certs. The placeholder
 certs are overwritten when the ACME certs arrive. For
 `foo.example.com` the config would look like this:
 
-```
+```nix
 security.acme.acceptTerms = true;
 security.acme.defaults.email = "admin+acme@example.com";
 services.nginx = {
@@ -88,7 +88,7 @@ This example uses a vhost called `certs.example.com`, with
 the intent that you will generate certs for all your vhosts and redirect
 everyone to HTTPS.
 
-```
+```nix
 security.acme.acceptTerms = true;
 security.acme.defaults.email = "admin+acme@example.com";
 
@@ -136,7 +136,7 @@ services.httpd = {
 
 Now you need to configure ACME to generate a certificate.
 
-```
+```nix
 security.acme.certs."foo.example.com" = {
   webroot = "/var/lib/acme/.challenges";
   email = "foo@example.com";
@@ -167,7 +167,7 @@ see the [lego docs](https://go-acme.github.io/lego/dns/)
 for provider/server specific configuration values. For the sake of these
 docs, we will provide a fully self-hosted example using bind.
 
-```
+```nix
 services.bind = {
   enable = true;
   extraConfig = ''
@@ -199,7 +199,7 @@ The {file}`dnskeys.conf` and {file}`certs.secret`
 must be kept secure and thus you should not keep their contents in your
 Nix config. Instead, generate them one time with a systemd service:
 
-```
+```nix
 systemd.services.dns-rfc2136-conf = {
   requiredBy = ["acme-example.com.service" "bind.service"];
   before = ["acme-example.com.service" "bind.service"];
@@ -250,7 +250,7 @@ first, however instead of setting the options for one certificate
 you will set them as defaults
 (e.g. [](#opt-security.acme.defaults.dnsProvider)).
 
-```
+```nix
 # Configure ACME appropriately
 security.acme.acceptTerms = true;
 security.acme.defaults.email = "admin+acme@example.com";
@@ -287,7 +287,7 @@ There is no way to change the user the ACME module uses (it will always be
 Below is an example configuration for OpenSMTPD, but this pattern
 can be applied to any service.
 
-```
+```nix
 # Configure ACME however you like (DNS or HTTP validation), adding
 # the following configuration for the relevant certificate.
 # Note: You cannot use `systemctl reload` here as that would mean
@@ -340,7 +340,7 @@ to be regenerated. In this scenario lego will produce the error `JWS verificatio
 The solution is to simply delete the associated accounts file and
 re-run the affected service(s).
 
-```
+```shell
 # Find the accounts folder for the certificate
 systemctl cat acme-example.com.service | grep -Po 'accounts/[^:]*'
 export accountdir="$(!!)"

nixos/modules/services/networking/avahi-daemon.nix

@@ -272,7 +272,7 @@ in
 
     users.groups.avahi = { };
 
-    system.nssModules = optional cfg.nssmdns pkgs.nssmdns;
+    system.nssModules = optional (cfg.nssmdns4 || cfg.nssmdns6) pkgs.nssmdns;
     system.nssDatabases.hosts = let
       mdnsMinimal = if (cfg.nssmdns4 && cfg.nssmdns6) then
         "mdns_minimal"

nixos/modules/tasks/network-interfaces.nix

@@ -1396,6 +1396,8 @@ in
       "net.ipv4.conf.all.forwarding" = mkDefault (any (i: i.proxyARP) interfaces);
       "net.ipv6.conf.all.disable_ipv6" = mkDefault (!cfg.enableIPv6);
       "net.ipv6.conf.default.disable_ipv6" = mkDefault (!cfg.enableIPv6);
+      # allow all users to do ICMP echo requests (ping)
+      "net.ipv4.ping_group_range" = mkDefault "0 2147483647";
       # networkmanager falls back to "/proc/sys/net/ipv6/conf/default/use_tempaddr"
       "net.ipv6.conf.default.use_tempaddr" = tempaddrValues.${cfg.tempAddresses}.sysctl;
     } // listToAttrs (forEach interfaces

nixos/tests/avahi.nix

@@ -16,7 +16,7 @@ import ./make-test-python.nix {
     cfg = { ... }: {
       services.avahi = {
         enable = true;
-        nssmdns = true;
+        nssmdns4 = true;
         publish.addresses = true;
         publish.domain = true;
         publish.enable = true;

nixos/tests/guix/publish.nix

@@ -16,7 +16,7 @@ in {
       # substitute server which requires Avahi.
       services.avahi = {
         enable = true;
-        nssmdns = true;
+        nssmdns4 = true;
         publish = {
           enable = true;
           userServices = true;

nixos/tests/unbound.nix

@@ -106,8 +106,8 @@ import ./make-test-python.nix ({ pkgs, lib, ... }:
               {
                 name = ".";
                 forward-addr = [
-                  (lib.head nodes.authoritative.config.networking.interfaces.eth1.ipv6.addresses).address
-                  (lib.head nodes.authoritative.config.networking.interfaces.eth1.ipv4.addresses).address
+                  (lib.head nodes.authoritative.networking.interfaces.eth1.ipv6.addresses).address
+                  (lib.head nodes.authoritative.networking.interfaces.eth1.ipv4.addresses).address
                 ];
               }
             ];
@@ -168,8 +168,8 @@ import ./make-test-python.nix ({ pkgs, lib, ... }:
           "unbound-extra1.conf".text = ''
             forward-zone:
             name: "example.local."
-            forward-addr: ${(lib.head nodes.resolver.config.networking.interfaces.eth1.ipv6.addresses).address}
-            forward-addr: ${(lib.head nodes.resolver.config.networking.interfaces.eth1.ipv4.addresses).address}
+            forward-addr: ${(lib.head nodes.resolver.networking.interfaces.eth1.ipv6.addresses).address}
+            forward-addr: ${(lib.head nodes.resolver.networking.interfaces.eth1.ipv4.addresses).address}
           '';
           "unbound-extra2.conf".text = ''
             auth-zone:
@@ -187,8 +187,8 @@ import ./make-test-python.nix ({ pkgs, lib, ... }:
       client = { lib, nodes, ... }: {
         imports = [ common ];
         networking.nameservers = [
-          (lib.head nodes.resolver.config.networking.interfaces.eth1.ipv6.addresses).address
-          (lib.head nodes.resolver.config.networking.interfaces.eth1.ipv4.addresses).address
+          (lib.head nodes.resolver.networking.interfaces.eth1.ipv6.addresses).address
+          (lib.head nodes.resolver.networking.interfaces.eth1.ipv4.addresses).address
         ];
         networking.interfaces.eth1.ipv4.addresses = [
           { address = "192.168.0.10"; prefixLength = 24; }
@@ -276,7 +276,7 @@ import ./make-test-python.nix ({ pkgs, lib, ... }:
       resolver.wait_for_unit("multi-user.target")
 
       with subtest("client should be able to query the resolver"):
-          test(client, ["${(lib.head nodes.resolver.config.networking.interfaces.eth1.ipv6.addresses).address}", "${(lib.head nodes.resolver.config.networking.interfaces.eth1.ipv4.addresses).address}"], doh=True)
+          test(client, ["${(lib.head nodes.resolver.networking.interfaces.eth1.ipv6.addresses).address}", "${(lib.head nodes.resolver.networking.interfaces.eth1.ipv4.addresses).address}"], doh=True)
 
       # discard the client we do not need anymore
       client.shutdown()
@@ -298,7 +298,7 @@ import ./make-test-python.nix ({ pkgs, lib, ... }:
           ).strip()
 
           # Thank you black! Can't really break this line into a readable version.
-          expected = "example.local. IN forward ${(lib.head nodes.resolver.config.networking.interfaces.eth1.ipv6.addresses).address} ${(lib.head nodes.resolver.config.networking.interfaces.eth1.ipv4.addresses).address}"
+          expected = "example.local. IN forward ${(lib.head nodes.resolver.networking.interfaces.eth1.ipv6.addresses).address} ${(lib.head nodes.resolver.networking.interfaces.eth1.ipv4.addresses).address}"
           assert out == expected, f"Expected `{expected}` but got `{out}` instead."
           local_resolver.fail("sudo -u unauthorizeduser -- unbound-control list_forwards")
 

pkgs/applications/audio/drumgizmo/default.nix

@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchurl, alsa-lib, expat, glib, libjack2, libXext, libX11, libpng
+{ lib, stdenv, fetchurl, fetchDebianPatch, alsa-lib, expat, glib, libjack2, libXext, libX11, libpng
 , libpthreadstubs, libsmf, libsndfile, lv2, pkg-config, zita-resampler
 }:
 
@@ -11,6 +11,16 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-AF8gQLiB29j963uI84TyNHIC0qwEWOCqmZIUWGq8V2o=";
   };
 
+  patches = [
+    (fetchDebianPatch {
+      pname = "drumgizmo";
+      version = "0.9.20";
+      debianRevision = "3";
+      patch = "0005-fix_ftbfs_with_gcc13.patch";
+      hash = "sha256-y5NDZ+3t6GkBeF/5UY8dwtH8k0cuM+5SGBGPSV7AX7M=";
+    })
+  ];
+
   configureFlags = [ "--enable-lv2" ];
 
   nativeBuildInputs = [ pkg-config ];
@@ -21,7 +31,6 @@ stdenv.mkDerivation rec {
   ];
 
   meta = with lib; {
-    broken = (stdenv.isLinux && stdenv.isAarch64);
     description = "An LV2 sample based drum plugin";
     homepage = "https://www.drumgizmo.org";
     license = licenses.lgpl3Plus;

pkgs/applications/audio/non/default.nix

@@ -17,6 +17,8 @@ stdenv.mkDerivation {
                   ladspaH liblo libsigcxx lrdf
   ];
 
+  env.CXXFLAGS = "-std=c++14";
+
   meta = {
     description = "Lightweight and lightning fast modular Digital Audio Workstation";
     homepage = "http://non.tuxfamily.org";

pkgs/applications/editors/vim/common.nix

@@ -1,12 +1,12 @@
 { lib, fetchFromGitHub }:
 rec {
-  version = "9.0.2048";
+  version = "9.0.2116";
 
   src = fetchFromGitHub {
     owner = "vim";
     repo = "vim";
     rev = "v${version}";
-    hash = "sha256-zR2iPiD4/gf5BnxYoe3cx2ebGWE1P2bY4Cg15gveFgg=";
+    hash = "sha256-ZKcNg/RrjvEsxpIcTjzQYi1xig3zLeTV+PXaBb4gUuM=";
   };
 
   enableParallelBuilding = true;

pkgs/applications/editors/vim/plugins/nvim-treesitter/generated.nix

@@ -495,12 +495,12 @@
   };
   elixir = buildGrammar {
     language = "elixir";
-    version = "0.0.0+rev=a2861e8";
+    version = "0.0.0+rev=11426c5";
     src = fetchFromGitHub {
       owner = "elixir-lang";
       repo = "tree-sitter-elixir";
-      rev = "a2861e88a730287a60c11ea9299c033c7d076e30";
-      hash = "sha256-hBHqQ3eBjknRPJjP+lQJU6NPFhUMtiv4FbKsTw28Bog=";
+      rev = "11426c5fd20eef360d5ecaf10729191f6bc5d715";
+      hash = "sha256-/tfxskct2GByqFmmWJ4IZNREpNGvDqz2kbIyLRveGrs=";
     };
     meta.homepage = "https://github.com/elixir-lang/tree-sitter-elixir";
   };
@@ -715,12 +715,12 @@
   };
   gitcommit = buildGrammar {
     language = "gitcommit";
-    version = "0.0.0+rev=6856a5f";
+    version = "0.0.0+rev=7e3ad5f";
     src = fetchFromGitHub {
       owner = "gbprod";
       repo = "tree-sitter-gitcommit";
-      rev = "6856a5fd0ffeff17d83325a8ce4e57811010eff1";
-      hash = "sha256-OD+lGLsMRFRPHwnXoM78t95QvjO0OQN4ae3z3wy5DO4=";
+      rev = "7e3ad5fdc61cd701e146ef78e4fc6dcdf6dbca0e";
+      hash = "sha256-Ct7zLvcJVqIaVy/wOGOPvghjwRcsHblPaTuifUcackI=";
     };
     meta.homepage = "https://github.com/gbprod/tree-sitter-gitcommit";
   };
@@ -737,12 +737,12 @@
   };
   gleam = buildGrammar {
     language = "gleam";
-    version = "0.0.0+rev=b2afa4f";
+    version = "0.0.0+rev=c9c7f0f";
     src = fetchFromGitHub {
       owner = "gleam-lang";
       repo = "tree-sitter-gleam";
-      rev = "b2afa4fd6bb41a7bf912b034c653c90af7ae5122";
-      hash = "sha256-Z1wutK2NyI5EMwTezeZp/g8JFD0p7kqBGCuh9Amyjgo=";
+      rev = "c9c7f0f01749d301b54e96ed8e0c47c7c415a196";
+      hash = "sha256-j7onMy986PeJNy9x8GUkg8Be22bGYoZs53sToLWc/eI=";
     };
     meta.homepage = "https://github.com/gleam-lang/tree-sitter-gleam";
   };
@@ -1243,12 +1243,12 @@
   };
   leo = buildGrammar {
     language = "leo";
-    version = "0.0.0+rev=23a9534";
+    version = "0.0.0+rev=304611b";
     src = fetchFromGitHub {
       owner = "r001";
       repo = "tree-sitter-leo";
-      rev = "23a9534d09d523d0dcee7dbf89e7c819e6835f6f";
-      hash = "sha256-21Vqvc3HjmKi1FRKyswMcf8rPjkyAbjTayDYMsTUsBg=";
+      rev = "304611b5eaf53aca07459a0a03803b83b6dfd3b3";
+      hash = "sha256-D3jtNBYLgN2/0TnbOMJrsuZrP+PMr835aDYlCwIPPrk=";
     };
     meta.homepage = "https://github.com/r001/tree-sitter-leo";
   };
@@ -1265,12 +1265,12 @@
   };
   liquidsoap = buildGrammar {
     language = "liquidsoap";
-    version = "0.0.0+rev=91d2708";
+    version = "0.0.0+rev=691484a";
     src = fetchFromGitHub {
       owner = "savonet";
       repo = "tree-sitter-liquidsoap";
-      rev = "91d2708e12a5869154a85190b13ac89cb1414189";
-      hash = "sha256-2wnGHQXx5QHkXSBsxjULIRlbXj7CBxWxFjef3n9lmew=";
+      rev = "691484ae766c4eee2ac59ec09e621b27b9ed9add";
+      hash = "sha256-fuvT4k/NdtMNsU0rD5z9IpJ8Hc7dHTJiMWDvpShzUMY=";
     };
     meta.homepage = "https://github.com/savonet/tree-sitter-liquidsoap";
   };
@@ -1444,12 +1444,12 @@
   };
   nickel = buildGrammar {
     language = "nickel";
-    version = "0.0.0+rev=b759233";
+    version = "0.0.0+rev=502a874";
     src = fetchFromGitHub {
       owner = "nickel-lang";
       repo = "tree-sitter-nickel";
-      rev = "b759233581fd8bae239e905c67a9ba453205da78";
-      hash = "sha256-4OrdtlpSsHTY/BmxRr0cKwTFfUSv+KN9IYDjfpdGIfg=";
+      rev = "502a8746c82c616ed441e0ab2b8c09772ee7d114";
+      hash = "sha256-ahUyqjVe0haOOXXzL7t+rC4yfN+ZsPQR551v9564P/A=";
     };
     meta.homepage = "https://github.com/nickel-lang/tree-sitter-nickel";
   };
@@ -1700,12 +1700,12 @@
   };
   poe_filter = buildGrammar {
     language = "poe_filter";
-    version = "0.0.0+rev=374f618";
+    version = "0.0.0+rev=fa83292";
     src = fetchFromGitHub {
       owner = "ObserverOfTime";
       repo = "tree-sitter-poe-filter";
-      rev = "374f618de179498c2a821136bb86c3edbe221e10";
-      hash = "sha256-X6PQQqY7fLB9AvCMfLlZ2cU8dKoCsw1KGjzYup8BoJ8=";
+      rev = "fa83292e04d27976ab5c354e0c980f2c67628a02";
+      hash = "sha256-Ij3anynA3ZYi4/Cxp+Anvgc2Te1Qxi0mnWDc0XTHaN0=";
     };
     meta.homepage = "https://github.com/ObserverOfTime/tree-sitter-poe-filter";
   };
@@ -1866,12 +1866,12 @@
   };
   qmljs = buildGrammar {
     language = "qmljs";
-    version = "0.0.0+rev=35ead5b";
+    version = "0.0.0+rev=2591330";
     src = fetchFromGitHub {
       owner = "yuja";
       repo = "tree-sitter-qmljs";
-      rev = "35ead5b9955cdb29bcf709d622fa960ff33992b6";
-      hash = "sha256-jT47lEGuk6YUjcHB0ZMyL3i5PqyUaCQmt0j78cUpy8Q=";
+      rev = "259133077f2fd854bcaa6f0149d3fc281fc8070b";
+      hash = "sha256-xg3fXYfAYHVAkByQekOd4EFLv0TbINcQPasFQYUkF0A=";
     };
     meta.homepage = "https://github.com/yuja/tree-sitter-qmljs";
   };
@@ -1921,12 +1921,12 @@
   };
   rbs = buildGrammar {
     language = "rbs";
-    version = "0.0.0+rev=23c69a4";
+    version = "0.0.0+rev=b28e181";
     src = fetchFromGitHub {
       owner = "joker1007";
       repo = "tree-sitter-rbs";
-      rev = "23c69a4fa9803abc9d87b235ca88d52418250041";
-      hash = "sha256-tdxx+feI0UIHkk1eS5VrIuYvOZWpuWF3NEioqrnZ+30=";
+      rev = "b28e1819d434e95916d11fe48ee6e8959b69197b";
+      hash = "sha256-HWWvettxkzziIWH6448RDxmVkaUNfSOgv3CtrlsgW3U=";
     };
     meta.homepage = "https://github.com/joker1007/tree-sitter-rbs";
   };
@@ -2188,12 +2188,12 @@
   };
   sql = buildGrammar {
     language = "sql";
-    version = "0.0.0+rev=a3ea0e4";
+    version = "0.0.0+rev=1b7d451";
     src = fetchFromGitHub {
       owner = "derekstride";
       repo = "tree-sitter-sql";
-      rev = "a3ea0e4143a617fc2c4ccf29c41e0ba7a1ff6ab9";
-      hash = "sha256-VwkehcELs+t+1GjiOiPs1UQT+0E7OZaXaWTyjFWlMto=";
+      rev = "1b7d451554f435d28c3217724acf00cdc627ee73";
+      hash = "sha256-d/nAvvvfTg91pKfN3iHvqD+wb/2Qk/OSl7MOq3n+yH4=";
     };
     meta.homepage = "https://github.com/derekstride/tree-sitter-sql";
   };
@@ -2558,12 +2558,12 @@
   };
   v = buildGrammar {
     language = "v";
-    version = "0.0.0+rev=165ed9f";
+    version = "0.0.0+rev=ce3481c";
     src = fetchFromGitHub {
       owner = "v-analyzer";
       repo = "v-analyzer";
-      rev = "165ed9fda0be82ff26639dd8cf5d93fe7f7432a0";
-      hash = "sha256-iH4k/begatiLc0BoAezWkhbdIjG5BHlduPMRUx/dNaI=";
+      rev = "ce3481c10eabed0ba36cfa9f72957c4d3f88689d";
+      hash = "sha256-Ro+Ft82dgfrFKZJI5GO+aLZS2qwgEh1pJMI9S6Z/8rU=";
     };
     location = "tree_sitter_v";
     meta.homepage = "https://github.com/v-analyzer/v-analyzer";
@@ -2592,12 +2592,12 @@
   };
   vhs = buildGrammar {
     language = "vhs";
-    version = "0.0.0+rev=375b42e";
+    version = "0.0.0+rev=9534865";
     src = fetchFromGitHub {
       owner = "charmbracelet";
       repo = "tree-sitter-vhs";
-      rev = "375b42e9845f704dd491c17c7e37f7c972e0faf3";
-      hash = "sha256-A9m0MNAINMbrNr3BYBU/WMtC5edXWCaxvcfCwDFe8p4=";
+      rev = "9534865e614c95eb9418e5e73f061c32fa4d9540";
+      hash = "sha256-Qf4Y1I/X5xGVZ4u2ud+XdC2dL+0sjR+0pJRJ8SUraiQ=";
     };
     meta.homepage = "https://github.com/charmbracelet/tree-sitter-vhs";
   };
@@ -2658,12 +2658,12 @@
   };
   wing = buildGrammar {
     language = "wing";
-    version = "0.0.0+rev=9573195";
+    version = "0.0.0+rev=55f5626";
     src = fetchFromGitHub {
       owner = "winglang";
       repo = "wing";
-      rev = "9573195e753fa0d303e65d8237d3902159708457";
-      hash = "sha256-DS0PJU9OlER+izTZTyiSGRIs0tGgEKImrEyFbj2b1wM=";
+      rev = "55f5626617726954a1a95aa93e363a6a04913fa1";
+      hash = "sha256-vcSD1Dz4HUTaU3LtRfqRtryGHvuA7aSu5poLyD6UyLw=";
     };
     location = "libs/tree-sitter-wing";
     generate = true;

pkgs/applications/editors/vim/plugins/overrides.nix

@@ -590,6 +590,10 @@ self: super: {
     dependencies = with self; [ plenary-nvim ];
   };
 
+  harpoon2 = super.harpoon2.overrideAttrs {
+    dependencies = with self; [ plenary-nvim ];
+  };
+
   hex-nvim = super.hex-nvim.overrideAttrs {
     postPatch = ''
       substituteInPlace lua/hex.lua --replace xxd ${xxd}/bin/xxd

pkgs/applications/editors/vim/plugins/vim-plugin-names

@@ -340,7 +340,8 @@ https://github.com/sjl/gundo.vim/,,
 https://github.com/junegunn/gv.vim/,,
 https://github.com/m4xshen/hardtime.nvim/,HEAD,
 https://git.sr.ht/~sircmpwn/hare.vim,HEAD,
-https://github.com/ThePrimeagen/harpoon/,,
+https://github.com/ThePrimeagen/harpoon/,master,
+https://github.com/ThePrimeagen/harpoon/,harpoon2,harpoon2
 https://github.com/MrcJkb/haskell-tools.nvim/,HEAD,
 https://github.com/neovimhaskell/haskell-vim/,,
 https://github.com/wenzel-hoffman/haskell-with-unicode.vim/,HEAD,

pkgs/applications/editors/vis/default.nix

@@ -30,10 +30,6 @@ stdenv.mkDerivation rec {
     libselinux
   ];
 
-  postPatch = ''
-    patchShebangs ./configure
-  '';
-
   postInstall = ''
     wrapProgram $out/bin/vis \
       --prefix LUA_CPATH ';' "${luaEnv}/lib/lua/${lua.luaversion}/?.so" \

pkgs/applications/editors/xed-editor/default.nix

@@ -1,6 +1,7 @@
 { stdenv
 , lib
 , fetchFromGitHub
+, fetchpatch
 , libxml2
 , libpeas
 , glib
@@ -28,6 +29,15 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-IpUBB7Viwc/nRfwzFllRiWoOmUxRZzS2BcxyM7W3oHI=";
   };
 
+  patches = [
+    # Fix missing include for libxml2 2.12
+    # https://github.com/linuxmint/xed/pull/611
+    (fetchpatch {
+      url = "https://github.com/linuxmint/xed/commit/28cb2e8136c1bfe90faf5f2341bde66156990778.patch";
+      hash = "sha256-AqIb7Jj19SF3tIriPwn1JeB7niCmPbBsLE4ch2AX7fk=";
+    })
+  ];
+
   nativeBuildInputs = [
     meson
     pkg-config

pkgs/applications/emulators/blink/default.nix

@@ -19,6 +19,15 @@ stdenv.mkDerivation (finalAttrs: {
     })
   ];
 
+  # Do not include --enable-static and --disable-shared flags during static compilation
+  dontAddStaticConfigureFlags = true;
+
+  # Don't add --build and --host flags as they are not supported
+  configurePlatforms = lib.optionals stdenv.hostPlatform.isStatic [ ];
+
+  # ./configure script expects --static not standard --enable-static
+  configureFlags = lib.optional stdenv.hostPlatform.isStatic "--static";
+
   # 'make check' requires internet connection
   doCheck = true;
   checkTarget = "test";

pkgs/applications/emulators/wine/sources.nix

@@ -69,9 +69,9 @@ in rec {
 
   unstable = fetchurl rec {
     # NOTE: Don't forget to change the hash for staging as well.
-    version = "8.20";
-    url = "https://dl.winehq.org/wine/source/8.x/wine-${version}.tar.xz";
-    hash = "sha256-SNa3a9ZDBaICBX+8GdkiwfSWJfbRqYJZJ8ChhXJzmYI=";
+    version = "9.0-rc1";
+    url = "https://dl.winehq.org/wine/source/9.0/wine-${version}.tar.xz";
+    hash = "sha256-GDd3V74ffxeGzopWqET2ZXKIH/z3RcC0yjTwmmDi8zA=";
     inherit (stable) patches;
 
     ## see http://wiki.winehq.org/Gecko
@@ -116,8 +116,8 @@ in rec {
 
   staging = fetchFromGitHub rec {
     # https://github.com/wine-staging/wine-staging/releases
-    version = "8.20";
-    hash = "sha256-CiWTXjUR1+GY+MO7djHfVUH71zSo3lpH9IaqS5zCeJ8=";
+    inherit (unstable) version;
+    hash = "sha256-jjy4r9VEJsU7FJ7RmE8+cgHTAkZVGruNUD5hzmGSB8c=";
     owner = "wine-staging";
     repo = "wine-staging";
     rev = "v${version}";

pkgs/applications/graphics/krita/default.nix

@@ -1,7 +1,7 @@
 { callPackage, ... }:
 
 callPackage ./generic.nix {
-  version = "5.1.5";
+  version = "5.2.0";
   kde-channel = "stable";
-  sha256 = "1lx4x4affkbh47b7w5qvahkkr4db0vcw6h24nykak6gpy2z5wxqw";
+  hash = "sha256-02oZc4pZw2dQucx1IuPJslWQGjOqwGmgeDgnUIqKkpc=";
 }

pkgs/applications/graphics/krita/generic.nix

@@ -2,13 +2,14 @@
 , karchive, kconfig, kwidgetsaddons, kcompletion, kcoreaddons
 , kguiaddons, ki18n, kitemmodels, kitemviews, kwindowsystem
 , kio, kcrash, breeze-icons
-, boost, libraw, fftw, eigen, exiv2, libheif, lcms2, gsl, openexr, giflib, libjxl
-, openjpeg, opencolorio, xsimd, poppler, curl, ilmbase, libmypaint, libwebp
-, qtmultimedia, qtx11extras, quazip
+, boost, libraw, fftw, eigen, exiv2, fribidi, libaom, libheif, libkdcraw, lcms2, gsl, openexr, giflib
+, libjxl, mlt , openjpeg, opencolorio, xsimd, poppler, curl, ilmbase, immer, kseexpr, lager
+, libmypaint , libunibreak, libwebp
+, qtmultimedia, qtx11extras, quazip, SDL2, zug, pkg-config
 , python3Packages
 , version
 , kde-channel
-, sha256
+, hash
 }:
 
 mkDerivation rec {
@@ -17,15 +18,10 @@ mkDerivation rec {
 
   src = fetchurl {
     url = "mirror://kde/${kde-channel}/krita/${version}/krita-${version}.tar.gz";
-    inherit sha256;
+    inherit hash;
   };
 
   patches = [
-    (fetchpatch {
-      name = "exiv2-0.28.patch";
-      url = "https://gitlab.archlinux.org/archlinux/packaging/packages/krita/-/raw/acd9a818660e86b14a66fceac295c2bab318c671/exiv2-0.28.patch";
-      hash = "sha256-iD2pyid513ThJVeotUlVDrwYANofnEiZmWINNUm/saw=";
-    })
     (fetchpatch {
       name = "krita-opencolorio-2.3-compat.patch";
       url = "https://invent.kde.org/graphics/krita/-/commit/520c633c2c868f2236d8e56eefecdcb6e3ebd840.patch";
@@ -34,16 +30,15 @@ mkDerivation rec {
     })
   ];
 
-  nativeBuildInputs = [ cmake extra-cmake-modules python3Packages.sip makeWrapper ];
+  nativeBuildInputs = [ cmake extra-cmake-modules pkg-config python3Packages.sip makeWrapper ];
 
   buildInputs = [
     karchive kconfig kwidgetsaddons kcompletion kcoreaddons kguiaddons
     ki18n kitemmodels kitemviews kwindowsystem kio kcrash breeze-icons
-    boost libraw fftw eigen exiv2 lcms2 gsl openexr libheif giflib libjxl
-    openjpeg opencolorio poppler curl ilmbase libmypaint libwebp
-    qtmultimedia qtx11extras quazip
+    boost libraw fftw eigen exiv2 fribidi lcms2 gsl openexr lager libaom libheif libkdcraw giflib
+    libjxl mlt openjpeg opencolorio xsimd poppler curl ilmbase immer kseexpr libmypaint
+    libunibreak libwebp qtmultimedia qtx11extras quazip SDL2 zug
     python3Packages.pyqt5
-    xsimd
   ];
 
   env.NIX_CFLAGS_COMPILE = toString ([ "-I${ilmbase.dev}/include/OpenEXR" ]
@@ -58,6 +53,9 @@ mkDerivation rec {
       --replace 'PYTHONPATH=''${_sip_python_path}' 'PYTHONPATH=${pythonPath}'
     substituteInPlace cmake/modules/SIPMacros.cmake \
       --replace 'PYTHONPATH=''${_krita_python_path}' 'PYTHONPATH=${pythonPath}'
+
+    substituteInPlace plugins/impex/jp2/jp2_converter.cc \
+      --replace '<openjpeg.h>' '<${openjpeg.incDir}/openjpeg.h>'
   '';
 
   cmakeBuildType = "RelWithDebInfo";
@@ -65,6 +63,7 @@ mkDerivation rec {
   cmakeFlags = [
     "-DPYQT5_SIP_DIR=${python3Packages.pyqt5}/${python3Packages.python.sitePackages}/PyQt5/bindings"
     "-DPYQT_SIP_DIR_OVERRIDE=${python3Packages.pyqt5}/${python3Packages.python.sitePackages}/PyQt5/bindings"
+    "-DBUILD_KRITA_QT_DESIGNER_PLUGINS=ON"
   ];
 
   preInstall = ''

pkgs/applications/misc/blender/default.nix

@@ -38,11 +38,11 @@ let
 in
 stdenv.mkDerivation (finalAttrs: rec {
   pname = "blender";
-  version = "4.0.1";
+  version = "4.0.2";
 
   src = fetchurl {
     url = "https://download.blender.org/source/${pname}-${version}.tar.xz";
-    hash = "sha256-/jLU0noX5RxhQ+26G16nGFylm65Lzfm9s11oCWCC43Q=";
+    hash = "sha256-qqDnKdp1kc+/RXcq92NFl32qp7EaCvNdmPkxPiRgd6M=";
   };
 
   patches = [

pkgs/applications/misc/corectrl/default.nix

@@ -23,13 +23,13 @@
 
 stdenv.mkDerivation rec{
   pname = "corectrl";
-  version = "1.3.6";
+  version = "1.3.8";
 
   src = fetchFromGitLab {
     owner = "corectrl";
     repo = "corectrl";
     rev = "v${version}";
-    sha256 = "sha256-a8cLtmv9nLtvN9o/aIwveTAT36XmTN1j85ZxVGIXO6E=";
+    sha256 = "sha256-lc6yWzJiSzGKMzJIpgOtirJONsh49vXWDWrhLV/erwQ=";
   };
   patches = [
     ./polkit-dir.patch

pkgs/applications/misc/corectrl/polkit-dir.patch

@@ -1,5 +1,5 @@
 diff --git a/src/helper/CMakeLists.txt b/src/helper/CMakeLists.txt
-index 1b7ed7c..757748c 100644
+index 3fe2ace..2542ea1 100644
 --- a/src/helper/CMakeLists.txt
 +++ b/src/helper/CMakeLists.txt
 @@ -22,15 +22,7 @@ message("D-Bus files will be installed into ${DBUS_DATADIR_PREFIX_DIR}/dbus-1")
@@ -7,15 +7,15 @@ index 1b7ed7c..757748c 100644
  # Find polkit
  pkg_check_modules(POLKIT REQUIRED polkit-gobject-1)
 -execute_process(
--    COMMAND pkg-config --variable=policydir polkit-gobject-1
--    RESULT_VARIABLE POLKIT_POLICY_INSTALL_DIR_RESULT
--    OUTPUT_VARIABLE POLKIT_POLICY_INSTALL_DIR
--    OUTPUT_STRIP_TRAILING_WHITESPACE
+-  COMMAND pkg-config --variable=policydir polkit-gobject-1
+-  RESULT_VARIABLE POLKIT_POLICY_INSTALL_DIR_RESULT
+-  OUTPUT_VARIABLE POLKIT_POLICY_INSTALL_DIR
+-  OUTPUT_STRIP_TRAILING_WHITESPACE
 -)
 -if(NOT POLKIT_POLICY_INSTALL_DIR_RESULT EQUAL "0")
 -  message(FATAL_ERROR "Failed to retrieve Polkit `policydir` variable using pkg-config")
 -endif()
 +option(POLKIT_POLICY_INSTALL_DIR "Polkit policy directory")
  
- list(APPEND PROCESS_MONITOR_SRC
-   pmon/processmonitor.cpp
+ list(APPEND HELPER_COMPILE_DEFINITIONS
+   ELPP_THREAD_SAFE

pkgs/applications/misc/faircamp/default.nix

@@ -16,20 +16,20 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "faircamp";
-  version = "0.8.0";
+  version = "0.11.0";
 
   src = fetchFromGitea {
     domain = "codeberg.org";
     owner = "simonrepp";
     repo = "faircamp";
     rev = version;
-    hash = "sha256-Rz/wMlVNjaGhk26QMnS4+W3oA/RSdB6FuigC84L8eDg=";
+    hash = "sha256-CD5wCvONlgNTXpFcCHCLdJ/lJsC2VTleKt9+ZX5znZo=";
   };
 
   cargoLock = {
     lockFile = ./Cargo.lock;
     outputHashes = {
-      "enolib-0.2.1" = "sha256-ryB5Tk90BvsstdXgYw7F0BJymWWetAIijhVpLeVBOa8=";
+      "enolib-0.3.0" = "sha256-nw1nnIh2r4JFcUb3D21BcjeieDTYRIza8Lrq1yD+ZYQ=";
     };
   };
 

pkgs/applications/misc/genact/default.nix

@@ -2,16 +2,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "genact";
-  version = "1.2.2";
+  version = "1.3.0";
 
   src = fetchFromGitHub {
     owner = "svenstaro";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-MB/i1jCxoGE8cPF+NE8aS7kF7ZsGb4+OyLcPcGp1hwI=";
+    sha256 = "sha256-iPDIbfbRNhgmTQHw9gNczXTcUaJ0dQpBDHg5ZOQQJ4M=";
   };
 
-  cargoSha256 = "sha256-OBGJIR3REeMxHQu3ovEKSZZ8QNlhl/5jvWbR5OdsRTQ=";
+  cargoHash = "sha256-Hg8Xlcx0j70Z8IwlJPCwm+qhurXjtKGLI3ZUCeHL1KY=";
 
   nativeBuildInputs = [ installShellFiles ];
 

pkgs/applications/misc/keylight-controller-mschneider82/default.nix

@@ -37,7 +37,7 @@ buildGoModule rec {
     longDescription = ''
       Requires having:
       * Elgato's Keylight paired to local wifi network.
-      * Service avahi with nssmdns enabled.
+      * Service avahi with nssmdns4 enabled.
     '';
     license = licenses.mit;
     homepage = "https://github.com/mschneider82/keylight-control";

pkgs/applications/misc/mupdf/default.nix

@@ -60,12 +60,12 @@ let
 
 in
 stdenv.mkDerivation rec {
-  version = "1.23.5";
+  version = "1.23.6";
   pname = "mupdf";
 
   src = fetchurl {
     url = "https://mupdf.com/downloads/archive/${pname}-${version}-source.tar.gz";
-    sha256 = "sha256-blZ5zfqu+cfoniljlSIM4sEz7T3K1RpHhmczbG6uxwY=";
+    sha256 = "sha256-rBHrhZ3UBEiOUVPNyWUbtDQeW6r007Pyfir8gvmq3Ck=";
   };
 
   patches = [ ./0001-Use-command-v-in-favor-of-which.patch

pkgs/applications/misc/tandoor-recipes/default.nix

@@ -5,7 +5,20 @@
 , fetchpatch
 }:
 let
-  python = python3;
+  python = python3.override {
+    packageOverrides = self: super: {
+      validators = super.validators.overridePythonAttrs (_: rec {
+        version = "0.20.0";
+        src = fetchFromGitHub {
+          owner = "python-validators";
+          repo = "validators";
+          rev = version;
+          hash = "sha256-ZnLyTHlsrXthGnaPzlV2ga/UTm5SSEHLTwC/tobiPak=";
+        };
+        propagatedBuildInputs = [ super.decorator super.six ];
+      });
+    };
+  };
 
   common = callPackage ./common.nix { };
 

pkgs/applications/networking/browsers/firefox-bin/default.nix

@@ -20,7 +20,6 @@
 , runtimeShell
 , systemLocale ? config.i18n.defaultLocale or "en_US"
 , patchelfUnstable  # have to use patchelfUnstable to support --no-clobber-old-sections
-, makeWrapper
 }:
 
 let
@@ -58,20 +57,6 @@ let
   source = lib.findFirst (sourceMatches mozLocale) defaultSource sources;
 
   pname = "firefox-${channel}-bin-unwrapped";
-
-  # FIXME: workaround for not being able to pass flags to patchelf
-  # Remove after https://github.com/NixOS/nixpkgs/pull/256525
-  wrappedPatchelf = stdenv.mkDerivation {
-    pname = "patchelf-wrapped";
-    inherit (patchelfUnstable) version;
-
-    nativeBuildInputs = [ makeWrapper ];
-
-    buildCommand = ''
-      mkdir -p $out/bin
-      makeWrapper ${patchelfUnstable}/bin/patchelf $out/bin/patchelf --append-flags "--no-clobber-old-sections"
-    '';
-  };
 in
 
 stdenv.mkDerivation {
@@ -79,7 +64,7 @@ stdenv.mkDerivation {
 
   src = fetchurl { inherit (source) url sha256; };
 
-  nativeBuildInputs = [ wrapGAppsHook autoPatchelfHook wrappedPatchelf ];
+  nativeBuildInputs = [ wrapGAppsHook autoPatchelfHook patchelfUnstable ];
   buildInputs = [
     gtk3
     adwaita-icon-theme
@@ -95,6 +80,8 @@ stdenv.mkDerivation {
   appendRunpaths = [
     "${pipewire}/lib"
   ];
+  # Firefox uses "relrhack" to manually process relocations from a fixed offset
+  patchelfFlags = [ "--no-clobber-old-sections" ];
 
   installPhase =
     ''

pkgs/applications/networking/cluster/cmctl/default.nix

@@ -8,18 +8,18 @@
 
 buildGoModule rec {
   pname = "cmctl";
-  version = "1.13.2";
+  version = "1.13.3";
 
   src = fetchFromGitHub {
     owner = "cert-manager";
     repo = "cert-manager";
     rev = "v${version}";
-    hash = "sha256-TfFdHKXbbi0yqvyQjZArY9GbkwjUq1Z00UuNAldyDuc=";
+    hash = "sha256-bmlM5WyJd5EtL3e4mPHwCqoIyDAgN7Ce7/vS6bhVuP0=";
   };
 
   sourceRoot = "${src.name}/cmd/ctl";
 
-  vendorHash = "sha256-63XxGvVsIRDpQ0ri6VkjciyD+k7eEMBcg0w8NU8ypYs=";
+  vendorHash = "sha256-PQKPZXgp6ggWymVBOErmLps0cilOsE54t108ApZoiDQ=";
 
   ldflags = [
     "-s"

pkgs/applications/networking/cluster/pachyderm/default.nix

@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "pachyderm";
-  version = "2.7.6";
+  version = "2.8.1";
 
   src = fetchFromGitHub {
     owner = "pachyderm";
     repo = "pachyderm";
     rev = "v${version}";
-    hash = "sha256-h0xr94DNmqjpRcas0F+UxQEnCHt5VGU2CRtv+GzJl00=";
+    hash = "sha256-ULZAmv3U6nMlhXuR6ZbZgAkWubs7t4qJBn05s0CF8uo=";
   };
 
-  vendorHash = "sha256-UBuCAIwx1UOh9bsk3eNlTOozB55RIvuKQ0P1WRkJNaI=";
+  vendorHash = "sha256-dYQicGlk+G3l03yb+PlIaMzwRcWqC1TPqQ4Akm8xJF8=";
 
   subPackages = [ "src/server/cmd/pachctl" ];
 
@@ -24,7 +24,7 @@ buildGoModule rec {
   meta = with lib; {
     description = "Containerized Data Analytics";
     homepage = "https://www.pachyderm.com/";
-    license = licenses.unfree;
+    license = licenses.asl20;
     maintainers = with maintainers; [ offline ];
     mainProgram = "pachctl";
   };

pkgs/applications/networking/instant-messengers/franz/generic.nix

@@ -23,6 +23,7 @@
 , libnotify
 , xdg-utils
 , mesa
+, libglvnd
 , libappindicator-gtk3
 }:
 
@@ -68,7 +69,7 @@ in stdenv.mkDerivation (rec {
     expat
     stdenv.cc.cc
   ];
-  runtimeDependencies = [ stdenv.cc.cc.lib (lib.getLib udev) libnotify libappindicator-gtk3 ];
+  runtimeDependencies = [ libglvnd stdenv.cc.cc.lib (lib.getLib udev) libnotify libappindicator-gtk3 ];
 
   unpackPhase = "dpkg-deb -x $src .";
 

pkgs/applications/networking/instant-messengers/rocketchat-desktop/default.nix

@@ -4,11 +4,11 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "rocketchat-desktop";
-  version = "3.9.10";
+  version = "3.9.11";
 
   src = fetchurl {
     url = "https://github.com/RocketChat/Rocket.Chat.Electron/releases/download/${version}/rocketchat-${version}-linux-amd64.deb";
-    hash = "sha256-VLHkFiIwfjCHr08wTsD8rMWSvHEswZCKl2XJr61cQYE=";
+    hash = "sha256-jyBHXzzFkCHGy8tdnE/daNbADYYAINBlC5td+wHOl4k=";
   };
 
   nativeBuildInputs = [

pkgs/applications/networking/instant-messengers/signal-desktop/default.nix

@@ -1,17 +1,6 @@
-{ callPackage, stdenv }: builtins.mapAttrs (pname: attrs: callPackage ./generic.nix (attrs // { inherit pname; })) {
-  signal-desktop = rec {
-    dir = "Signal";
-    version = "6.40.0";
-    version-aarch64 = "6.40.0";
-    url = "https://updates.signal.org/desktop/apt/pool/s/signal-desktop/signal-desktop_${version}_amd64.deb";
-    url-aarch64 = "https://github.com/0mniteck/Signal-Desktop-Mobian/raw/${version-aarch64}/builds/release/signal-desktop_${version-aarch64}_arm64.deb";
-    hash = "sha256-vyXHlycPSyEyv938IKzGM6pdERHHerx2CLY/U+WMrH4=";
-    hash-aarch64 = "sha256-3Pi0c+CGcJR1M4ll51m+B5PmGIcIjjlc0qa9b8rkMeU=";
-  };
-  signal-desktop-beta = rec {
-    dir = "Signal Beta";
-    version = "6.40.0-beta.2";
-    hash = "sha256-pfedkxbZ25DFgz+/N7ZEb9LwKrHuoMM+Zi+Tc21QPsg=";
-    url = "https://updates.signal.org/desktop/apt/pool/s/signal-desktop-beta/signal-desktop-beta_${version}_amd64.deb";
-  };
+{ hostPlatform, callPackage }: {
+  signal-desktop = if hostPlatform.system == "aarch64-linux"
+    then callPackage ./signal-desktop-aarch64.nix { }
+    else callPackage ./signal-desktop.nix { };
+  signal-desktop-beta = ./signal-desktop-beta.nix;
 }

pkgs/applications/networking/instant-messengers/signal-desktop/generic.nix

@@ -1,12 +1,4 @@
-{ pname
-, dir
-, version
-, version-aarch64 ? ""
-, hash
-, hash-aarch64 ? ""
-, url
-, url-aarch64 ? ""
-, stdenv
+{ stdenv
 , lib
 , fetchurl
 , autoPatchelfHook
@@ -55,13 +47,18 @@
 , wayland
 }:
 
+{ pname
+, dir
+, version
+, hash
+, url
+}:
+
 let
   inherit (stdenv) targetPlatform;
   ARCH = if targetPlatform.isAarch64 then "arm64" else "x64";
-  final-version = if targetPlatform.isAarch64 then version-aarch64 else version;
 in stdenv.mkDerivation rec {
-  inherit pname;
-  version = final-version;
+  inherit pname version;
 
   # Please backport all updates to the stable channel.
   # All releases have a limited lifetime and "expire" 90 days after the release.
@@ -72,8 +69,7 @@ in stdenv.mkDerivation rec {
   # few additional steps and might not be the best idea.)
 
   src = fetchurl {
-    url = if targetPlatform.isAarch64 then url-aarch64 else url;
-    hash = if targetPlatform.isAarch64 then hash-aarch64 else hash;
+    inherit url hash;
   };
 
   nativeBuildInputs = [
@@ -177,8 +173,11 @@ in stdenv.mkDerivation rec {
     patchelf --add-needed ${libpulseaudio}/lib/libpulse.so "$out/lib/${dir}/resources/app.asar.unpacked/node_modules/@signalapp/ringrtc/build/linux/libringrtc-${ARCH}.node"
   '';
 
-  # Tests if the application launches and waits for "Link your phone to Signal Desktop":
-  passthru.tests.application-launch = nixosTests.signal-desktop;
+  passthru = {
+    # Tests if the application launches and waits for "Link your phone to Signal Desktop":
+    tests.application-launch = nixosTests.signal-desktop;
+    updateScript.command = [ ./update.sh ];
+  };
 
   meta = {
     description = "Private, simple, and secure messenger";
@@ -187,11 +186,11 @@ in stdenv.mkDerivation rec {
       "Signal Android" or "Signal iOS" app.
     '';
     homepage = "https://signal.org/";
-    changelog = "https://github.com/signalapp/Signal-Desktop/releases/tag/v${final-version}";
+    changelog = "https://github.com/signalapp/Signal-Desktop/releases/tag/v${version}";
     license = lib.licenses.agpl3Only;
     maintainers = with lib.maintainers; [ mic92 equirosa urandom bkchr ];
     mainProgram = pname;
-    platforms = if builtins.stringLength version-aarch64 > 0 then [ "x86_64-linux" "aarch64-linux" ] else [ "x86_64-linux" ];
+    platforms = [ "x86_64-linux" "aarch64-linux" ];
     sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
   };
 }

pkgs/applications/networking/instant-messengers/signal-desktop/signal-desktop-aarch64.nix

@@ -0,0 +1,8 @@
+{ callPackage }:
+callPackage ./generic.nix { } rec {
+  pname = "signal-desktop";
+  dir = "Signal";
+  version = "6.40.0";
+  url = "https://github.com/0mniteck/Signal-Desktop-Mobian/raw/${version}/builds/release/signal-desktop_${version}_arm64.deb";
+  hash = "sha256-3Pi0c+CGcJR1M4ll51m+B5PmGIcIjjlc0qa9b8rkMeU=";
+}

pkgs/applications/networking/instant-messengers/signal-desktop/signal-desktop-beta.nix

@@ -0,0 +1,8 @@
+{ callPackage }:
+callPackage ./generic.nix {} rec {
+  pname = "signal-desktop-beta";
+  dir = "Signal Beta";
+  version = "6.40.0-beta.2";
+  url = "https://updates.signal.org/desktop/apt/pool/s/signal-desktop-beta/signal-desktop-beta_${version}_amd64.deb";
+  hash = "sha256-pfedkxbZ25DFgz+/N7ZEb9LwKrHuoMM+Zi+Tc21QPsg=";
+}

pkgs/applications/networking/instant-messengers/signal-desktop/signal-desktop.nix

@@ -0,0 +1,8 @@
+{ callPackage }:
+callPackage ./generic.nix {} rec {
+  pname = "signal-desktop";
+  dir = "Signal";
+  version = "6.40.0";
+  url = "https://updates.signal.org/desktop/apt/pool/s/signal-desktop/signal-desktop_${version}_amd64.deb";
+  hash = "sha256-vyXHlycPSyEyv938IKzGM6pdERHHerx2CLY/U+WMrH4=";
+}

pkgs/applications/networking/instant-messengers/signal-desktop/update.sh

@@ -0,0 +1,39 @@
+#!/usr/bin/env nix-shell
+#!nix-shell -i bash -p bash nix-update curl coreutils
+
+set -ex
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" &>/dev/null && pwd)"
+
+curl_github() {
+  curl ${GITHUB_TOKEN:+" -u \":$GITHUB_TOKEN\""} "$@"
+}
+
+case "$UPDATE_NIX_ATTR_PATH" in
+signal-desktop)
+  latestTag=$(curl_github https://api.github.com/repos/signalapp/Signal-Desktop/releases/latest | jq -r ".tag_name")
+  latestVersion="$(expr "$latestTag" : 'v\(.*\)')"
+  latestVersionAarch64=$(curl_github "https://api.github.com/repos/0mniteck/Signal-Desktop-Mobian/releases/latest" | jq -r ".tag_name")
+
+  echo "Updating signal-desktop for x86_64-linux"
+  nix-update --version "$latestVersion" \
+    --system x86_64-linux \
+    --override-filename "$SCRIPT_DIR/signal-desktop.nix"
+  signal-desktop
+
+  echo "Updating signal-desktop for aarch64-linux"
+  nix-update --version "$latestVersionAarch64" \
+    --system aarch64-linux \
+    --override-filename "$SCRIPT_DIR/signal-desktop-aarch64.nix" \
+    signal-desktop
+  ;;
+signal-desktop-beta)
+  latestTagBeta=$(curl_github https://api.github.com/repos/signalapp/Signal-Desktop/releases | jq -r ".[0].tag_name")
+  latestVersionBeta="$(expr "$latestTagBeta" : 'v\(.*\)')"
+  echo "Updating signal-desktop-beta for x86_64-linux"
+  nix-update --version "$latestVersionBeta" --system x86_64-linux --override-filename "$SCRIPT_DIR/signal-desktop-beta.nix" signal-desktop-beta
+  ;;
+*)
+  echo "Unknown attr path $UPDATE_NIX_ATTR_PATH"
+  ;;
+esac

pkgs/applications/networking/instant-messengers/signalbackup-tools/default.nix

@@ -1,14 +1,14 @@
-{ lib, stdenv, darwin, fetchFromGitHub, openssl, sqlite }:
+{ lib, stdenv, fetchFromGitHub, openssl, sqlite }:
 
-(if stdenv.isDarwin then darwin.apple_sdk_11_0.llvmPackages_14.stdenv else stdenv).mkDerivation rec {
+stdenv.mkDerivation rec {
   pname = "signalbackup-tools";
-  version = "20231114";
+  version = "20231211";
 
   src = fetchFromGitHub {
     owner = "bepaald";
     repo = pname;
     rev = version;
-    hash = "sha256-5ZDHAv8le1MLS394fto4Rg19J/b2QkZZ70Sn0Yap/hs=";
+    hash = "sha256-L8yfuaM/gyRknIM/ER0DfAZj6X9G0rAVVvAE9MtYF0g=";
   };
 
   postPatch = ''

pkgs/applications/office/paperless-ngx/default.nix

@@ -16,16 +16,18 @@
 , poppler_utils
 , liberation_ttf
 , xcbuild
+, pango
+, pkg-config
 }:
 
 let
-  version = "2.0.1";
+  version = "2.1.1";
 
   src = fetchFromGitHub {
     owner = "paperless-ngx";
     repo = "paperless-ngx";
     rev = "refs/tags/v${version}";
-    hash = "sha256-qSX+r99y7a/eITfaC/UYqSgcxx/xYOqJ4tY/iuvoeNA=";
+    hash = "sha256-/f0al6OyYo8FTOWiNFoKUYWpY0nz3qFOB00QKIvS3Dk=";
   };
 
   python = python3;
@@ -46,17 +48,22 @@ let
     pname = "paperless-ngx-frontend";
     inherit version src;
 
-    npmDepsHash = "sha256-uDaZ7j7IDgKy7wCWND2xzR1qHwUtdyjR4eyIAVy01dM=";
+    postPatch = ''
+      cd src-ui
+    '';
+
+    npmDepsHash = "sha256-K7wTYGGwEhPoXdRD+4swhSlMH0iem6YkF0tjnVHh7K8=";
 
     nativeBuildInputs = [
+      pkg-config
       python3
     ] ++ lib.optionals stdenv.isDarwin [
       xcbuild
     ];
 
-    postPatch = ''
-      cd src-ui
-    '';
+    buildInputs = [
+      pango
+    ];
 
     CYPRESS_INSTALL_BINARY = "0";
     NG_CLI_ANALYTICS = "false";

pkgs/applications/office/planify/default.nix

@@ -23,16 +23,13 @@
 
 stdenv.mkDerivation rec {
   pname = "planify";
-  version = "4.1.4";
+  version = "4.2.1";
 
   src = fetchFromGitHub {
     owner = "alainm23";
     repo = "planify";
-    # The commit is named as "Release 4.1.4", published to Flathub, but not tags
-    # https://github.com/flathub/io.github.alainm23.planify/commit/f345f81b55e4638bc6605e0bf9d15a057b846252
-    # https://github.com/alainm23/planify/issues/1002
-    rev = "73fd6cb7acfc60937d1403238c255736b97aa94b";
-    hash = "sha256-K3QFFpq2MJxK34Uh0qFyaSGeTPTZbwIVYkosFUrhflQ=";
+    rev = version;
+    hash = "sha256-tcQNnfM690Je8sF19OSZ4GnXkhsSSrNHZ5EDXmMOW9Q=";
   };
 
   nativeBuildInputs = [
@@ -59,6 +56,10 @@ stdenv.mkDerivation rec {
     webkitgtk_6_0
   ];
 
+  mesonFlags = [
+    "-Dprofile=default"
+  ];
+
   meta = with lib; {
     description = "Task manager with Todoist support designed for GNU/Linux";
     homepage = "https://github.com/alainm23/planify";

pkgs/applications/science/biology/kalign/default.nix

@@ -10,13 +10,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "kalign";
-  version = "3.3.5";
+  version = "3.4.0";
 
   src = fetchFromGitHub {
     owner = "TimoLassmann";
     repo = "kalign";
     rev = "refs/tags/v${finalAttrs.version}";
-    hash = "sha256-QufTiaiRcNOnLhOO4cnOE9bNcj9mlCg/ERFIHJB8KOU=";
+    hash = "sha256-QcFNaCTqj6CFiOzQ6ezfBL0mu8PDU11hyNdkcsLOPzA=";
   };
 
   nativeBuildInputs = [

pkgs/applications/science/biology/poretools/default.nix

@@ -11,12 +11,13 @@ python2Packages.buildPythonPackage rec {
     sha256 = "0bglj833wxpp3cq430p1d3xp085ls221js2y90w7ir2x5ay8l7am";
   };
 
-  propagatedBuildInputs = [python2Packages.h5py python2Packages.matplotlib python2Packages.seaborn python2Packages.pandas];
+  propagatedBuildInputs = [ python2Packages.h5py python2Packages.matplotlib python2Packages.seaborn python2Packages.pandas ];
 
   meta = {
     description = "a toolkit for working with nanopore sequencing data from Oxford Nanopore";
     license = lib.licenses.mit;
     homepage = "https://poretools.readthedocs.io/en/latest/";
-    maintainers = [lib.maintainers.rybern];
+    maintainers = [ lib.maintainers.rybern ];
+    broken = true; # Build error: h5py-3.9.0 not supported for interpreter python2.7
   };
 }

pkgs/applications/science/math/calc/default.nix

@@ -10,14 +10,14 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "calc";
-  version = "2.15.0.1";
+  version = "2.15.0.2";
 
   src = fetchurl {
     urls = [
       "https://github.com/lcn2/calc/releases/download/v${finalAttrs.version}/calc-${finalAttrs.version}.tar.bz2"
       "http://www.isthe.com/chongo/src/calc/calc-${finalAttrs.version}.tar.bz2"
     ];
-    hash = "sha256-u/mt9y4805IWYDdEHz94dPb4V+d4YVrrhzz8v3B+q24=";
+    hash = "sha256-dPEj32SiR7RhI9fBa9ny9+EEuuiXS2WswRcDVuOMJXc=";
   };
 
   postPatch = ''

pkgs/applications/science/math/eigenmath/default.nix

@@ -7,13 +7,13 @@
 
 stdenv.mkDerivation rec {
   pname = "eigenmath";
-  version = "unstable-2023-11-17";
+  version = "unstable-2023-12-11";
 
   src = fetchFromGitHub {
     owner = "georgeweigt";
     repo = pname;
-    rev = "b0d822f10243ad5b1c88efb5a82b43a0bbf1bfbc";
-    hash = "sha256-eJ/EmzV5UZGxwZNIna/XXkYY+vkLc610KcywBFPRfyM=";
+    rev = "a493ce81dc1b8801bb4d853af903bb084da0d17e";
+    hash = "sha256-Ej5cJrwJiTkEKJGNlfb+KBH13ISP89cYqDVNq8Iy0Gg=";
   };
 
   checkPhase = let emulator = stdenv.hostPlatform.emulator buildPackages; in ''

pkgs/applications/terminal-emulators/rio/default.nix

@@ -51,16 +51,16 @@ let
 in
 rustPlatform.buildRustPackage rec {
   pname = "rio";
-  version = "0.0.29";
+  version = "0.0.30";
 
   src = fetchFromGitHub {
     owner = "raphamorim";
     repo = "rio";
     rev = "v${version}";
-    hash = "sha256-S+mqamTm8GHCyJF/L1V4XnhJDuhwo9n3Zf+UCKXg8p8=";
+    hash = "sha256-H5kFgLHw1UXJksrlDO/Owhm/O3+vpohl4h6XYokNWPA=";
   };
 
-  cargoHash = "sha256-aKj3L1s+FgN8T4IrBuTAQyzfKOPgCt2R0C6+YIv56Zw=";
+  cargoHash = "sha256-FACRG25ORnSu4pPpn5ibUqtkylWiNBV88Pabqc81Gvg=";
 
   nativeBuildInputs = [
     ncurses

pkgs/applications/version-management/commitizen/default.nix

@@ -11,7 +11,7 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "commitizen";
-  version = "3.12.0";
+  version = "3.13.0";
   format = "pyproject";
 
   disabled = python3.pythonOlder "3.8";
@@ -20,7 +20,7 @@ python3.pkgs.buildPythonApplication rec {
     owner = "commitizen-tools";
     repo = pname;
     rev = "refs/tags/v${version}";
-    hash = "sha256-Gzx2DdCX8GyxYEi8OH2a21V6JkA50qA+39IInEjLReI=";
+    hash = "sha256-6Zo+d1OuaHYVf/KX8hKlyp/YS/1tHFmpNK6ssnxg7h0=";
   };
 
   pythonRelaxDeps = [

pkgs/applications/version-management/mercurial/default.nix

@@ -21,11 +21,11 @@ let
 
   self = python3Packages.buildPythonApplication rec {
     pname = "mercurial${lib.optionalString fullBuild "-full"}";
-    version = "6.5.2";
+    version = "6.5.3";
 
     src = fetchurl {
       url = "https://mercurial-scm.org/release/mercurial-${version}.tar.gz";
-      sha256 = "sha256-r8OdcGeXZZPIMyuOl6Eq/Tk7VQN8X7nDyrGkLHVg9go=";
+      sha256 = "sha256-LNyB+t4SnPVrEoQXUn8ZC6cv13ZWc5TOVO7XZOZn59U=";
     };
 
     format = "other";
@@ -35,7 +35,7 @@ let
     cargoDeps = if rustSupport then rustPlatform.fetchCargoTarball {
       inherit src;
       name = "mercurial-${version}";
-      sha256 = "sha256-dcyHmLkRadNK30Vv0XsCEaZGTIcF/L29lLe58ggB3Lg=";
+      sha256 = "sha256-ob81zMUY4AVNIbkFKyImnj7QhHTh7LVOCcGeZDtTAXc=";
       sourceRoot = "mercurial-${version}/rust";
     } else null;
     cargoRoot = if rustSupport then "rust" else null;

pkgs/applications/video/kodi/addons/pvr-iptvsimple/default.nix

@@ -6,13 +6,13 @@
 buildKodiBinaryAddon rec {
   pname = "pvr-iptvsimple";
   namespace = "pvr.iptvsimple";
-  version = "20.11.1";
+  version = "20.13.0";
 
   src = fetchFromGitHub {
     owner = "kodi-pvr";
     repo = "pvr.iptvsimple";
     rev = "${version}-${rel}";
-    sha256 = "sha256-Dvnuy+2xW9hPjPVqN7X057B/1zWqIPbkS90kjexJvio=";
+    sha256 = "sha256-W/tFM/WpWdSvLEf0iwQoH2JVDjyfr1l8CRQkOG5q4hk=";
   };
 
   extraBuildInputs = [

pkgs/applications/video/mpv/scripts/webtorrent-mpv-hook.nix

@@ -2,23 +2,23 @@
 
 buildNpmPackage rec {
   pname = "webtorrent-mpv-hook";
-  version = "1.3.3";
+  version = "1.4.1";
 
   src = fetchFromGitHub {
     owner = "mrxdst";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-AFKX31kriacXygZy0Mw+QwO+SwFEu13687mJ/WeAoKY=";
+    hash = "sha256-/dMtXcIyfAs++Zgz2CxRW0tkzn5QjS+WVGChlCyrU0U=";
   };
 
   postPatch = ''
     substituteInPlace src/webtorrent.ts --replace "node_path: 'node'" "node_path: '${nodejs}/bin/node'"
     # This executable is just for telling non-Nix users how to install
-    substituteInPlace package.json --replace '"bin": "build/bin.js",' ""
+    substituteInPlace package.json --replace '"bin": "build/bin.mjs",' ""
     rm -rf src/bin.ts
   '';
 
-  npmDepsHash = "sha256-GpNUJ5ZCgMjSYLqsIE/RwkTSFT3uAhxrHPe7XvGDRHE=";
+  npmDepsHash = "sha256-EqHPBoYyBuW9elxQH/XVTZoPkKHC6+7aksYo60t7WA4=";
   makeCacheWritable = true;
 
   nativeBuildInputs = [

pkgs/applications/video/rtabmap/default.nix

@@ -1,6 +1,7 @@
 { lib
 , stdenv
 , fetchFromGitHub
+, fetchpatch
 , pkg-config
 , cmake
 , opencv
@@ -35,6 +36,19 @@ stdenv.mkDerivation rec {
     hash = "sha256-1xb8O3VrErldid2OgAUMG28mSUO7QBUsPuSz8p03tSI";
   };
 
+  patches = [
+    # Fix build with g2o 20230806
+    (fetchpatch {
+      url = "https://github.com/introlab/rtabmap/commit/85cc6fe3c742855ad16c8442895e12dbb10b6e8b.patch";
+      hash = "sha256-P6GkYKCNwe9dgZdgF/oEhgjA3bJnwXFWJCPoyIknQCo=";
+    })
+    # Fix typo in previous patch
+    (fetchpatch {
+      url = "https://github.com/introlab/rtabmap/commit/c4e94bcdc31b859c1049724dbb7671e4597d86de.patch";
+      hash = "sha256-1btkV4/y+bnF3xEVqlUy/9F6BoANeTOEJjZLmRzG3iA=";
+    })
+  ];
+
   nativeBuildInputs = [ cmake pkg-config wrapQtAppsHook wrapGAppsHook ];
   buildInputs = [
     ## Required

pkgs/applications/virtualization/colima/default.nix

@@ -17,13 +17,13 @@
 
 buildGoModule rec {
   pname = "colima";
-  version = "0.6.5";
+  version = "0.6.7";
 
   src = fetchFromGitHub {
     owner = "abiosoft";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-lIYLoCFYOwu1iqGgE/jhaqrXAL5ooFHDUnwL56qcGIE=";
+    hash = "sha256-7s/e/fV6azT26oeEJhh6PPcnI/cjpmEHf9TsZHspcwE=";
     # We need the git revision
     leaveDotGit = true;
     postFetch = ''
@@ -35,7 +35,7 @@ buildGoModule rec {
   nativeBuildInputs = [ installShellFiles makeWrapper ]
     ++ lib.optionals stdenv.isDarwin [ darwin.DarwinTools ];
 
-  vendorHash = "sha256-7DIhSjHpaCyHyXKhR8KWQc2YGaD8CMq+BZHF4zIkL50=";
+  vendorHash = "sha256-ET9n15+YK8ByodePztee6tKdFvvgk7jEKSUjRYSEpq8=";
 
   # disable flaky Test_extractZones
   # https://hydra.nixos.org/build/212378003/log

pkgs/applications/virtualization/lima/bin.nix

@@ -9,31 +9,31 @@
 }:
 
 let
-  version = "0.18.0";
+  version = "0.19.0";
 
   dist = {
     aarch64-darwin = rec {
       archSuffix = "Darwin-arm64";
       url = "https://github.com/lima-vm/lima/releases/download/v${version}/lima-${version}-${archSuffix}.tar.gz";
-      sha256 = "6c58ca1b7803c2eeb1eaeb124db57fdc426b45fa65ce41a3fd83856c9be5c233";
+      sha256 = "d7b62ee446607c989610b1cd5f9ad5eaa3d1b9aa2b47210f198713b8f8bf9889";
     };
 
     x86_64-darwin = rec {
       archSuffix = "Darwin-x86_64";
       url = "https://github.com/lima-vm/lima/releases/download/v${version}/lima-${version}-${archSuffix}.tar.gz";
-      sha256 = "e19b1067dcfc7d9d34d692d26b84e2b8589c3b39ac3316efc7b25fa82dcafbc6";
+      sha256 = "e68b034023b52f3c61b6804e5f921d72981768925d6c2937e69904ecef46c6bd";
     };
 
     aarch64-linux = rec {
       archSuffix = "Linux-aarch64";
       url = "https://github.com/lima-vm/lima/releases/download/v${version}/lima-${version}-${archSuffix}.tar.gz";
-      sha256 = "1a1113a8e3a6f6f12dd01a7bbf30017d3cccf1ed7705e61c06149d8fab57654e";
+      sha256 = "8709ed5c483dc227d65adf215a9cb7127c71e25da3a78dfa7f82b7dcfbbb8afb";
     };
 
     x86_64-linux = rec {
       archSuffix = "Linux-x86_64";
       url = "https://github.com/lima-vm/lima/releases/download/v${version}/lima-${version}-${archSuffix}.tar.gz";
-      sha256 = "efd100c65173d0dff885e61778fa61737a609fc543d8260b491c8090c000bd3b";
+      sha256 = "fca174037ecc69810947b7cb444dfab2661407e8e5e7409321fa590a84250996";
     };
   };
 in

pkgs/applications/window-managers/leftwm/default.nix

@@ -41,5 +41,6 @@ rustPlatform.buildRustPackage rec {
     platforms = lib.platforms.linux;
     maintainers = with lib.maintainers; [ yanganto ];
     changelog = "https://github.com/leftwm/leftwm/blob/${version}/CHANGELOG.md";
+    mainProgram = "leftwm";
   };
 }

pkgs/build-support/bintools-wrapper/default.nix

@@ -316,10 +316,10 @@ stdenv.mkDerivation {
     ''
 
     ###
-    ### Remove LC_UUID
+    ### Remove certain timestamps from final binaries
     ###
     + optionalString (stdenv.targetPlatform.isDarwin && !(bintools.isGNU or false)) ''
-      echo "-no_uuid" >> $out/nix-support/libc-ldflags-before
+      echo "export ZERO_AR_DATE=1" >> $out/nix-support/setup-hook
     ''
 
     + ''

pkgs/build-support/build-fhsenv-bubblewrap/default.nix

@@ -200,6 +200,7 @@ let
       # Also, the cache needs to go to both 32 and 64 bit glibcs, for games
       # of both architectures to work.
       --tmpfs ${glibc}/etc \
+      --tmpfs /etc \
       --symlink /etc/ld.so.conf ${glibc}/etc/ld.so.conf \
       --symlink /etc/ld.so.cache ${glibc}/etc/ld.so.cache \
       --ro-bind ${glibc}/etc/rpc ${glibc}/etc/rpc \

pkgs/build-support/rust/rustc-wrapper/default.nix

@@ -0,0 +1,30 @@
+{ lib, runCommand, rustc-unwrapped, sysroot ? null }:
+
+runCommand "${rustc-unwrapped.pname}-wrapper-${rustc-unwrapped.version}" {
+  preferLocalBuild = true;
+  strictDeps = true;
+  inherit (rustc-unwrapped) outputs;
+
+  env = {
+    prog = "${rustc-unwrapped}/bin/rustc";
+    sysroot = lib.optionalString (sysroot != null) "--sysroot ${sysroot}";
+  };
+
+  passthru = {
+    inherit (rustc-unwrapped) pname version src llvm llvmPackages;
+    unwrapped = rustc-unwrapped;
+  };
+
+  meta = rustc-unwrapped.meta // {
+    description = "${rustc-unwrapped.meta.description} (wrapper script)";
+    priority = 10;
+  };
+} ''
+  mkdir -p $out/bin
+  ln -s ${rustc-unwrapped}/bin/* $out/bin
+  rm $out/bin/rustc
+  substituteAll ${./rustc-wrapper.sh} $out/bin/rustc
+  chmod +x $out/bin/rustc
+  ${lib.concatMapStrings (output: "ln -s ${rustc-unwrapped.${output}} \$${output}\n")
+    (lib.remove "out" rustc-unwrapped.outputs)}
+''

pkgs/build-support/rust/rustc-wrapper/rustc-wrapper.sh

@@ -0,0 +1,16 @@
+#!@shell@
+
+extraBefore=(@sysroot@)
+extraAfter=($NIX_RUSTFLAGS)
+
+# Optionally print debug info.
+if (( "${NIX_DEBUG:-0}" >= 1 )); then
+    echo "extra flags before to @prog@:" >&2
+    printf "  %q\n" "${extraBefore[@]}" >&2
+    echo "original flags to @prog@:" >&2
+    printf "  %q\n" "$@" >&2
+    echo "extra flags after to @prog@:" >&2
+    printf "  %q\n" "${extraAfter[@]}" >&2
+fi
+
+exec @prog@ "${extraBefore[@]}" "$@" "${extraAfter[@]}"

pkgs/build-support/setup-hooks/auto-patchelf.py

@@ -336,9 +336,12 @@ def main() -> None:
     )
     parser.add_argument(
         "--extra-args",
-        nargs="*",
+        # Undocumented Python argparse feature: consume all remaining arguments
+        # as values for this one. This means this argument should always be passed
+        # last.
+        nargs="...",
         type=str,
-        help="Extra arguments to pass to patchelf"
+        help="Extra arguments to pass to patchelf. This argument should always come last."
     )
 
     print("automatically fixing dependencies for ELF files")

pkgs/build-support/setup-hooks/separate-debug-info.sh

@@ -1,7 +1,7 @@
 export NIX_SET_BUILD_ID=1
 export NIX_LDFLAGS+=" --compress-debug-sections=zlib"
 export NIX_CFLAGS_COMPILE+=" -ggdb -Wa,--compress-debug-sections"
-export RUSTFLAGS+=" -g"
+export NIX_RUSTFLAGS+=" -g"
 
 fixupOutputHooks+=(_separateDebugInfo)
 

pkgs/by-name/cm/cmake/package.nix

@@ -46,11 +46,11 @@ stdenv.mkDerivation (finalAttrs: {
     + lib.optionalString isMinimalBuild "-minimal"
     + lib.optionalString cursesUI "-cursesUI"
     + lib.optionalString qt5UI "-qt5UI";
-  version = "3.27.7";
+  version = "3.27.8";
 
   src = fetchurl {
     url = "https://cmake.org/files/v${lib.versions.majorMinor finalAttrs.version}/cmake-${finalAttrs.version}.tar.gz";
-    hash = "sha256-CPcaEGA2vwUfaSdg75VYwFd8Qqw56Wugl+dmK9QVjY4=";
+    hash = "sha256-/s4kVj9peHD7uYLqi/F0gsnV+FXYyb8LgkY9dsno0Mw=";
   };
 
   patches = [
@@ -161,6 +161,12 @@ stdenv.mkDerivation (finalAttrs: {
     (lib.cmakeBool "BUILD_CursesDialog" cursesUI)
   ];
 
+  # `pkgsCross.musl64.cmake.override { stdenv = pkgsCross.musl64.llvmPackages_16.libcxxStdenv; }`
+  # fails with `The C++ compiler does not support C++11 (e.g.  std::unique_ptr).`
+  # The cause is a compiler warning `warning: argument unused during compilation: '-pie' [-Wunused-command-line-argument]`
+  # interfering with the feature check.
+  env.NIX_CFLAGS_COMPILE = "-Wno-unused-command-line-argument";
+
   # make install attempts to use the just-built cmake
   preInstall = lib.optionalString (stdenv.hostPlatform != stdenv.buildPlatform) ''
     sed -i 's|bin/cmake|${buildPackages.cmakeMinimal}/bin/cmake|g' Makefile

pkgs/by-name/co/cockpit/package.nix

@@ -45,13 +45,13 @@ in
 
 stdenv.mkDerivation rec {
   pname = "cockpit";
-  version = "305";
+  version = "306";
 
   src = fetchFromGitHub {
     owner = "cockpit-project";
     repo = "cockpit";
     rev = "refs/tags/${version}";
-    hash = "sha256-fCVnggso/wAvci9sLRVvwEsvZ+CeEfLBDnPPcAy/wGo=";
+    hash = "sha256-RB5RpwFTi//XNIIm/86JR4Jo3q5nuoW6ruH05JSfMSk=";
     fetchSubmodules = true;
   };
 

pkgs/by-name/fr/frankenphp/package.nix

@@ -7,6 +7,7 @@
 , frankenphp
 , darwin
 , pkg-config
+, makeBinaryWrapper
 , runCommand
 , writeText
 }:
@@ -41,7 +42,7 @@ in buildGoModule rec {
   vendorHash = "sha256-Lgj/pFtSQIgjrycajJ1zNY3ytvArmuk0E3IjsAzsNdM=";
 
   buildInputs = [ phpUnwrapped ] ++ phpUnwrapped.buildInputs;
-  nativeBuildInputs = lib.optionals stdenv.isDarwin [ pkg-config darwin.cctools darwin.autoSignDarwinBinariesHook ];
+  nativeBuildInputs = [ makeBinaryWrapper ] ++ lib.optionals stdenv.isDarwin [ pkg-config darwin.cctools darwin.autoSignDarwinBinariesHook ];
 
   subPackages = [ "frankenphp" ];
 
@@ -63,10 +64,13 @@ in buildGoModule rec {
     # replace hard-code homebrew path
     substituteInPlace ../frankenphp.go \
       --replace "-L/opt/homebrew/opt/libiconv/lib" "-L${darwin.libiconv}/lib"
+  '';
 
-    # remove when https://github.com/dunglas/frankenphp/pull/331 is merged and released
-    substituteInPlace ../frankenphp.go \
-      --replace "darwin pkg-config: libxml-2.0 sqlite3" "darwin pkg-config: libxml-2.0"
+  preFixup = ''
+    mkdir -p $out/lib
+    ln -s "${phpEmbedWithZts}/lib/php.ini" "$out/lib/php.ini"
+
+    wrapProgram $out/bin/frankenphp --set-default PHP_INI_SCAN_DIR $out/lib
   '';
 
   doCheck = false;

pkgs/by-name/fr/free42/package.nix

@@ -10,13 +10,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "free42";
-  version = "3.1";
+  version = "3.1.2";
 
   src = fetchFromGitHub {
     owner = "thomasokken";
     repo = "free42";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-v3nZMjV9KnoTefeu2jl3k1B7efnJnNVOAfDVLyce6QI=";
+    hash = "sha256-v7Qi0ZRLXEoZqnbIiHTkvsftwMi9vUhgH7wOtHN84nU=";
   };
 
   nativeBuildInputs = [
@@ -42,7 +42,7 @@ stdenv.mkDerivation (finalAttrs: {
       genericName = "Calculator";
       exec = "free42bin";
       type = "Application";
-      comment = finalAttrs.meta.description;
+      comment = "A software clone of HP-42S Calculator";
       categories = [ "Utility" "Calculator" ];
     })
     (makeDesktopItem {
@@ -51,7 +51,7 @@ stdenv.mkDerivation (finalAttrs: {
       genericName = "Calculator";
       exec = "free42dec";
       type = "Application";
-      comment = finalAttrs.meta.description;
+      comment = "A software clone of HP-42S Calculator";
       categories = [ "Utility" "Calculator" ];
     })
   ];

pkgs/by-name/ko/kor/package.nix

@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "kor";
-  version = "0.3.0";
+  version = "0.3.2";
 
   src = fetchFromGitHub {
     owner = "yonahd";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-emijYJL054UCOAUobspDqSc7LuQjUjT2E/rQKqJDvA8=";
+    hash = "sha256-Ov+aad+6Tp6Mm+fyjR9+xTYVlRu7uv1kD14AgSFmPMA=";
   };
 
-  vendorHash = "sha256-iAqptugku3qX6e45+YYf1bU9j2YntNQj82vR04bFMOQ=";
+  vendorHash = "sha256-HPcLjeLw3AxqZg2f5v5G4uYX65D7yXaXDZUPUgWnLFA=";
 
   preCheck = ''
     HOME=$(mktemp -d)

pkgs/by-name/ks/kseexpr/cmake_libdir.patch

@@ -0,0 +1,13 @@
+diff --git a/cmake/kseexpr.pc.in b/cmake/kseexpr.pc.in
+index 4b9f15f..fc76153 100644
+--- a/cmake/kseexpr.pc.in
++++ b/cmake/kseexpr.pc.in
+@@ -5,7 +5,7 @@
+ 
+ # pkg-config file for KSeExpr
+ prefix=@CMAKE_INSTALL_PREFIX@
+-libdir=${prefix}/@CMAKE_INSTALL_LIBDIR@
++libdir=@CMAKE_INSTALL_FULL_LIBDIR@
+ includedir=${prefix}/include
+ 
+ Name: KSeExpr

pkgs/by-name/ks/kseexpr/package.nix

@@ -0,0 +1,46 @@
+{ lib
+, stdenv
+, fetchFromGitLab
+, cmake
+, extra-cmake-modules
+, qt5
+, libsForQt5
+, bison
+, flex
+, llvm
+}:
+
+stdenv.mkDerivation rec {
+  pname = "kseexpr";
+  version = "4.0.4.0";
+  src = fetchFromGitLab {
+    domain = "invent.kde.org";
+    owner = "graphics";
+    repo = "kseexpr";
+    rev = "v${version}";
+    hash = "sha256-XjFGAN7kK2b0bLouYG3OhajhOQk4AgC4EQRzseccGCE=";
+  };
+  patches = [
+    # see https://github.com/NixOS/nixpkgs/issues/144170
+    ./cmake_libdir.patch
+  ];
+  nativeBuildInputs = [
+    cmake
+    extra-cmake-modules
+    qt5.wrapQtAppsHook
+  ];
+  buildInputs = [
+    bison
+    flex
+    libsForQt5.ki18n
+    llvm
+    qt5.qtbase
+  ];
+
+  meta = with lib; {
+    homepage    = "https://invent.kde.org/graphics/kseexpr";
+    description = "An embeddable expression evaluation engine";
+    maintainers = with maintainers; [ nek0 ];
+    license     = licenses.lgpl3Plus;
+  };
+}

pkgs/by-name/la/lager/package.nix

@@ -0,0 +1,37 @@
+{ lib
+, stdenv
+, fetchFromGitHub
+, cmake
+, pkg-config
+, boost
+, immer
+, zug
+}:
+
+stdenv.mkDerivation rec {
+  pname = "lager";
+  version = "0.1.0";
+  src = fetchFromGitHub {
+    owner = "arximboldi";
+    repo = "lager";
+    rev = "v${version}";
+    hash = "sha256-KTHrVV/186l4klwlcfDwFsKVoOVqWCUPzHnIbWuatbg=";
+  };
+  buildInputs = [
+    boost
+    immer
+    zug
+  ];
+  nativeBuildInputs = [
+    cmake
+  ];
+  cmakeFlags = [
+    "-Dlager_BUILD_EXAMPLES=OFF"
+  ];
+  meta = with lib; {
+    homepage    = "https://github.com/arximboldi/lager";
+    description = "C++ library for value-oriented design using the unidirectional data-flow architecture — Redux for C++";
+    license     = licenses.mit;
+    maintainers = with maintainers; [ nek0 ];
+  };
+}

pkgs/by-name/ni/nix-direnv/package.nix

@@ -5,13 +5,13 @@
 }:
 stdenv.mkDerivation (finalAttrs:{
   pname = "nix-direnv";
-  version = "2.5.1";
+  version = "3.0.0";
 
   src = fetchFromGitHub {
     owner = "nix-community";
     repo = "nix-direnv";
     rev = finalAttrs.version;
-    hash = "sha256-rMQ+Nb6WqXm66g2TpF8E0Io9WBR0ve06MW8I759gl2M=";
+    hash = "sha256-UmCNAejZwss5a/YDP4HrbQaLHc5BypQDUkQrh/QoEhg=";
   };
 
   # Substitute instead of wrapping because the resulting file is

pkgs/by-name/oa/oauth2ms/package.nix

@@ -0,0 +1,35 @@
+{ lib, stdenv, fetchFromGitHub, python3 }:
+
+stdenv.mkDerivation {
+  pname = "oauth2ms";
+  version = "2021-07-09";
+
+  src = fetchFromGitHub {
+    owner = "harishkrupo";
+    repo = "oauth2ms";
+    rev = "a1ef0cabfdea57e9309095954b90134604e21c08"; # No tags or releases in the repo
+    sha256 = "sha256-xPSWlHJAXhhj5I6UMjUtH1EZqCZWHJMFWTu3a4k1ETc";
+  };
+
+  buildInputs = [
+    (python3.withPackages (ps: with ps; [
+      pyxdg
+      msal
+      python-gnupg
+    ]))
+  ];
+
+  installPhase = ''
+    runHook preInstall
+    install -m755 -D oauth2ms $out/bin/oauth2ms
+    runHook postInstall
+  '';
+
+  meta = with lib; {
+    homepage = "https://github.com/harishkrupo/oauth2ms";
+    description = "XOAUTH2 compatible Office365 token fetcher";
+    platforms = platforms.all;
+    license = licenses.asl20;
+    maintainers = with maintainers; [ wentasah ];
+  };
+}

pkgs/by-name/pa/passmark-performancetest/package.nix

@@ -0,0 +1,67 @@
+{ lib
+, stdenv
+, fetchurl
+, curl
+, unzip
+, ncurses5
+, dmidecode
+, coreutils
+, util-linux
+, autoPatchelfHook
+, makeWrapper
+}:
+let
+  sources = {
+    "x86_64-linux" = {
+      url = "https://web.archive.org/web/20231205092714/https://www.passmark.com/downloads/pt_linux_x64.zip";
+      hash = "sha256-q9H+/V4fkSwJJEp+Vs+MPvndi5DInx5MQCzAv965IJg=";
+    };
+    "aarch64-linux" = {
+      url = "https://web.archive.org/web/20231205092807/https://www.passmark.com/downloads/pt_linux_arm64.zip";
+      hash = "sha256-7fmd2fukJ56e0BJFJe3SitGlordyIFbNjIzQv+u6Zuw=";
+    };
+  };
+in
+stdenv.mkDerivation rec {
+  version = "11.0.1002";
+  pname = "passmark-performancetest";
+
+  src = fetchurl (sources.${stdenv.system} or (throw "Unsupported system for PassMark performance test"));
+
+  dontConfigure = true;
+  dontBuild = true;
+
+  nativeBuildInputs = [ unzip autoPatchelfHook makeWrapper ];
+
+  buildInputs = [
+    stdenv.cc.cc.lib
+    curl
+    ncurses5
+  ];
+
+  installPhase = ''
+    runHook preInstall
+    install -Dm555 pt_linux_* "$out/bin/performancetest"
+    runHook postInstall
+  '';
+
+  # Prefix since program will call sudo
+  postFixup = ''
+    wrapProgram $out/bin/performancetest \
+        --prefix PATH ":" ${lib.makeBinPath [
+          dmidecode
+          coreutils
+          util-linux
+        ]}
+  '';
+
+  meta = with lib; {
+    description = "A software tool that allows everybody to quickly assess the performance of their computer and compare it to a number of standard 'baseline' computer systems.";
+    homepage = "https://www.passmark.com";
+    sourceProvenance = with sourceTypes; [ binaryNativeCode ];
+    license = licenses.unfree;
+    maintainers = with maintainers; [ neverbehave ];
+    platforms = builtins.attrNames sources;
+    mainProgram = "performancetest";
+  };
+}

pkgs/by-name/sp/spicetify-cli/package.nix

@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "spicetify-cli";
-  version = "2.27.2";
+  version = "2.28.1";
 
   src = fetchFromGitHub {
     owner = "spicetify";
     repo = "spicetify-cli";
     rev = "v${version}";
-    hash = "sha256-TT7ZPvpiiDAvvN2ec/qN4i/6XCxfeBTPLD3dCxVTKBY=";
+    hash = "sha256-PiOpj9FsolFZzoMATnJmMwjZrBLGXDIHv8SIaJQetRc=";
   };
 
-  vendorHash = "sha256-H2kSTsYiD9HResHes+7YxUyNcjtM0SLpDPUC0Y518VM=";
+  vendorHash = "sha256-alNUJ+ejwZPvefCTHt0/NWSAIt4MFzbPmkMinMrpe2M=";
 
   ldflags = [
     "-s -w"

pkgs/by-name/sw/swayimg/package.nix

@@ -1,7 +1,6 @@
 { lib
 , stdenv
 , fetchFromGitHub
-, fetchpatch
 , meson
 , ninja
 , pkg-config
@@ -20,27 +19,21 @@
 , libpng
 , libjxl
 , libexif
+, openexr_3
 , bash-completion
+, testers
 }:
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "swayimg";
-  version = "1.11";
+  version = "1.12";
 
   src = fetchFromGitHub {
     owner = "artemsen";
-    repo = pname;
-    rev = "v${version}";
-    sha256 = "sha256-UwIufR3EwbpNVHD1GypV3qNgiqDRllwtxAM0CZPodn0=";
+    repo = "swayimg";
+    rev = "v${finalAttrs.version}";
+    sha256 = "sha256-aKDt4lPh4w0AOucN7VrA7mo8SHI9eJqdrpJF+hG93gI=";
   };
 
-  patches = [
-    (fetchpatch {
-      name = "link-libwebp-1.3.1.patch";
-      url = "https://github.com/artemsen/swayimg/commit/bd3d6c838c699b876fd8c19b408c475eb47e17b6.patch";
-      hash = "sha256-2aMq/GTqyKw+CQr8o8ij4P4yNjBXYKXShQUknStUb5c=";
-    })
-  ];
-
   strictDeps = true;
 
   depsBuildBuild = [
@@ -49,6 +42,10 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ meson ninja pkg-config wayland-scanner ];
 
+  mesonFlags = [
+    (lib.mesonOption "version" finalAttrs.version)
+  ];
+
   buildInputs = [
     bash-completion
     wayland
@@ -65,8 +62,13 @@ stdenv.mkDerivation rec {
     libpng
     libjxl
     libexif
+    openexr_3
   ];
 
+  passthru.tests.version = testers.testVersion {
+    package = finalAttrs.finalPackage;
+  };
+
   meta = with lib; {
     homepage = "https://github.com/artemsen/swayimg";
     description = "Image viewer for Sway/Wayland";
@@ -76,4 +78,4 @@ stdenv.mkDerivation rec {
     platforms = platforms.linux;
     mainProgram = "swayimg";
   };
-}
+})

pkgs/by-name/vi/vinegar/package.nix

@@ -1,7 +1,7 @@
 { lib
 , buildGoModule
 , fetchFromGitHub
-, wine
+, wine-staging
 , makeBinaryWrapper
 , pkg-config
 , libGL
@@ -11,19 +11,19 @@
 
 buildGoModule rec {
   pname = "vinegar";
-  version = "1.5.8";
+  version = "1.5.9";
 
   src = fetchFromGitHub {
     owner = "vinegarhq";
     repo = "vinegar";
     rev = "v${version}";
-    hash = "sha256-1KDcc9Hms1hQgpvf/49zFJ85kDUsieNcoOTYaZWV+S0=";
+    hash = "sha256-cLzQnNmQYyAIdTGygk/CNU/mxGgcgoFTg5G/0DNwpz4=";
   };
 
-  vendorHash = "sha256-UJLwSOJ4vZt3kquKllm5OMfFheZtAG5gLSA20313PpA=";
+  vendorHash = "sha256-DZI4APnrldnwOmLZ9ucFBGQDxzPXTIi44eLu74WrSBI=";
 
   nativeBuildInputs = [ pkg-config makeBinaryWrapper ];
-  buildInputs = [ libGL libxkbcommon xorg.libX11 xorg.libXcursor xorg.libXfixes wine ];
+  buildInputs = [ libGL libxkbcommon xorg.libX11 xorg.libXcursor xorg.libXfixes wine-staging ];
 
   buildPhase = ''
     runHook preBuild
@@ -39,7 +39,7 @@ buildGoModule rec {
 
   postInstall = ''
     wrapProgram $out/bin/vinegar \
-      --prefix PATH : ${lib.makeBinPath [ wine ]}
+      --prefix PATH : ${lib.makeBinPath [ wine-staging ]}
   '';
 
   meta = with lib; {

pkgs/by-name/ze/zesarux/package.nix

@@ -48,7 +48,7 @@ stdenv.mkDerivation (finalAttrs: {
   sourceRoot = "${finalAttrs.src.name}/src";
 
   postPatch = ''
-    patchShebangs ./configure *.sh
+    patchShebangs *.sh
   '';
 
   configureFlags = [

pkgs/by-name/zu/zug/package.nix

@@ -0,0 +1,34 @@
+{ lib
+, stdenv
+, pkgs
+, fetchFromGitHub
+, cmake
+, boost
+}:
+
+
+stdenv.mkDerivation rec {
+  pname = "zug";
+  version = "0.1.0";
+  src = fetchFromGitHub {
+    owner = "arximboldi";
+    repo = "zug";
+    rev = "v${version}";
+    hash = "sha256-7xTMDhPIx1I1PiYNanGUsK8pdrWuemMWM7BW+NQs2BQ=";
+  };
+  nativeBuildInputs = [
+    cmake
+  ];
+  buildInputs = [
+    boost
+  ];
+  cmakeFlags = [
+    "-Dzug_BUILD_EXAMPLES=OFF"
+  ];
+  meta = with lib; {
+    homepage    = "https://github.com/arximboldi/zug";
+    description = "library for functional interactive c++ programs";
+    maintainers = with maintainers; [ nek0 ];
+    license     = licenses.boost;
+  };
+}

pkgs/data/documentation/stdman/default.nix

@@ -14,7 +14,6 @@ stdenv.mkDerivation rec {
   outputDevdoc = "out";
 
   preConfigure = "
-    patchShebangs ./configure
     patchShebangs ./do_install
   ";
 

pkgs/data/misc/cacert/default.nix

@@ -1,7 +1,7 @@
 { lib
 , stdenv
 , writeText
-, fetchurl
+, fetchFromGitHub
 , buildcatrust
 , blacklist ? []
 , extraCertificateFiles ? []
@@ -17,20 +17,10 @@
 }:
 
 let
-  blocklist = writeText "cacert-blocklist.txt" (lib.concatStringsSep "\n" (blacklist ++ [
-    # Mozilla does not trust new certificates issued by these CAs after 2022/11/30¹
-    # in their products, but unfortunately we don't have such a fine-grained
-    # solution for most system packages², so we decided to eject these.
-    #
-    # [1] https://groups.google.com/a/mozilla.org/g/dev-security-policy/c/oxX69KFvsm4/m/yLohoVqtCgAJ
-    # [2] https://utcc.utoronto.ca/~cks/space/blog/linux/CARootStoreTrustProblem
-    "TrustCor ECA-1"
-    "TrustCor RootCert CA-1"
-    "TrustCor RootCert CA-2"
-  ]));
+  blocklist = writeText "cacert-blocklist.txt" (lib.concatStringsSep "\n" blacklist);
   extraCertificatesBundle = writeText "cacert-extra-certificates-bundle.crt" (lib.concatStringsSep "\n\n" extraCertificateStrings);
 
-  srcVersion = "3.92";
+  srcVersion = "3.95";
   version = if nssOverride != null then nssOverride.version else srcVersion;
   meta = with lib; {
     homepage = "https://curl.haxx.se/docs/caextract.html";
@@ -43,9 +33,11 @@ let
     pname = "nss-cacert-certdata";
     inherit version;
 
-    src = if nssOverride != null then nssOverride.src else fetchurl {
-      url = "mirror://mozilla/security/nss/releases/NSS_${lib.replaceStrings ["."] ["_"] version}_RTM/src/nss-${version}.tar.gz";
-      hash = "sha256-PbGS1uiCA5rwKufq8yF+0RS7etg0FMZGdyq4Ah4kolQ=";
+    src = if nssOverride != null then nssOverride.src else fetchFromGitHub {
+      owner = "nss-dev";
+      repo = "nss";
+      rev = "NSS_${lib.replaceStrings ["."] ["_"] version}_RTM";
+      hash = "sha256-qgSbzlRbU+gElC2ae3FEGRUFSM1JHd/lNGNXC0x4xt4=";
     };
 
     dontBuild = true;
@@ -54,7 +46,7 @@ let
       runHook preInstall
 
       mkdir $out
-      cp nss/lib/ckfw/builtins/certdata.txt $out
+      cp lib/ckfw/builtins/certdata.txt $out
 
       runHook postInstall
     '';

pkgs/data/misc/dns-root-data/default.nix

@@ -6,11 +6,11 @@ let
     # Original source https://www.internic.net/domain/named.root
     # occasionally suffers from pointless hash changes,
     # and having stable sources for older versions has advantages, too.
-    urls = map (prefix: prefix + "cc5e14a264912/etc/root.hints") [
+    urls = map (prefix: prefix + "d9c96ae96f066a85d7/etc/root.hints") [
       "https://gitlab.nic.cz/knot/knot-resolver/raw/"
       "https://raw.githubusercontent.com/CZ-NIC/knot-resolver/"
     ];
-    sha256 = "0vdrff4l8s8grif52dnh091s8qydhh88k25zqd9rj66sf1qwcwxl";
+    hash = "sha256-4lG/uPnNHBNIZ/XIeDM1w3iukrpeW0JIjTnGSwkJ8U4=";
   };
 
   rootKey = ./root.key;
@@ -20,7 +20,7 @@ in
 
 stdenv.mkDerivation {
   pname = "dns-root-data";
-  version = "2019-01-11";
+  version = "2023-11-27";
 
   buildCommand = ''
     mkdir $out

pkgs/data/misc/shared-mime-info/default.nix

@@ -1,7 +1,6 @@
 { stdenv
 , lib
 , fetchFromGitLab
-, fetchpatch
 , meson
 , ninja
 , pkg-config
@@ -14,7 +13,7 @@
 
 stdenv.mkDerivation rec {
   pname = "shared-mime-info";
-  version = "2.3";
+  version = "2.4";
 
   outputs = [ "out" "dev" ];
 
@@ -23,15 +22,9 @@ stdenv.mkDerivation rec {
     owner = "xdg";
     repo = pname;
     rev = version;
-    sha256 = "sha256-cEfknRVtOJykEO9Iqlb0UoiayYtu+ugvmmZqAD5cGnE=";
+    hash = "sha256-5eyMkfSBUOD7p8woIYTgz5C/L8uQMXyr0fhL0l23VMA=";
   };
 
-  patches = [
-    # Submitted upstream at
-    # https://gitlab.freedesktop.org/xdg/shared-mime-info/-/issues/211
-    ./fix-clang-warnings.patch
-  ];
-
   nativeBuildInputs = [
     meson
     ninja

pkgs/data/misc/shared-mime-info/fix-clang-warnings.patch

@@ -1,31 +0,0 @@
-diff --git a/meson.build b/meson.build
-index 1780c44..7998a51 100644
---- a/meson.build
-+++ b/meson.build
-@@ -49,12 +49,7 @@ endif
- ###############################################################################
- # Dependencies
- 
--check_functions = [
--    'fdatasync',
--]
--foreach function : check_functions
--    config.set('HAVE_'+function.to_upper(), cc.has_function(function))
--endforeach
-+config.set('HAVE_FDATASYNC', cc.has_function('fdatasync', prefix: '#include <unistd.h>'))
- 
- 
- if get_option('build-translations')
-diff --git a/src/update-mime-database.cpp b/src/update-mime-database.cpp
-index 733ba06..4ca6d06 100644
---- a/src/update-mime-database.cpp
-+++ b/src/update-mime-database.cpp
-@@ -2158,7 +2158,7 @@ static void check_in_path_xdg_data(const char *mime_path)
- 
- 	env = getenv("XDG_DATA_DIRS");
- 	if (!env)
--		env = "/usr/local/share/"PATH_SEPARATOR"/usr/share/";
-+		env = "/usr/local/share/" PATH_SEPARATOR "/usr/share/";
- 	dirs = g_strsplit(env, PATH_SEPARATOR, 0);
- 	g_return_if_fail(dirs != NULL);
- 	for (n = 0; dirs[n]; n++)

pkgs/data/misc/tzdata/default.nix

@@ -22,7 +22,7 @@ stdenv.mkDerivation rec {
   ];
 
   outputs = [ "out" "bin" "man" "dev" ];
-  propagatedBuildOutputs = [];
+  propagatedBuildOutputs = [ ];
 
   makeFlags = [
     "TOPDIR=$(out)"
@@ -59,6 +59,8 @@ stdenv.mkDerivation rec {
       ( cd $out/share/zoneinfo/posix; ln -s ../* .; rm posix )
       mv $out/share/zoneinfo-leaps $out/share/zoneinfo/right
 
+      cp leap-seconds.list $out/share/zoneinfo
+
       mkdir -p "$dev/include"
       cp tzfile.h "$dev/include/tzfile.h"
     '';

pkgs/data/themes/adw-gtk3/default.nix

@@ -9,13 +9,13 @@
 
 stdenvNoCC.mkDerivation rec {
   pname = "adw-gtk3";
-  version = "5.1";
+  version = "5.2";
 
   src = fetchFromGitHub {
     owner = "lassekongo83";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-vRB6+C27M4u7v10c6dqGsKpxHMGfpCSiScZ+8qlJRr0=";
+    sha256 = "sha256-S6Yo67DTyRzS9uz/6g87SRmfPIBmAKfy4c23M5aENNg=";
   };
 
   nativeBuildInputs = [

pkgs/desktops/deepin/artwork/deepin-icon-theme/default.nix

@@ -8,13 +8,13 @@
 
 stdenvNoCC.mkDerivation rec {
   pname = "deepin-icon-theme";
-  version = "2023.04.03";
+  version = "2023.11.28";
 
   src = fetchFromGitHub {
     owner = "linuxdeepin";
     repo = pname;
     rev = version;
-    hash = "sha256-YRmpJr3tvBxomgb7yJPTqE3u4tXQKE5HHOP0CpjbQEg=";
+    hash = "sha256-kCWJAmJa0VmhnuegE+acj82Ojl4Z5D8g7/q2PzppJwg=";
   };
 
   makeFlags = [ "PREFIX=${placeholder "out"}" ];

pkgs/desktops/gnome-2/platform/GConf/default.nix

@@ -11,14 +11,16 @@ stdenv.mkDerivation rec {
 
   outputs = [ "out" "dev" "man" ];
 
-  buildInputs = [ ORBit2 libxml2 python3 ]
+  strictDeps = true;
+
+  buildInputs = [ ORBit2 libxml2 ]
     # polkit requires pam, which requires shadow.h, which is not available on
     # darwin
     ++ lib.optional (!stdenv.isDarwin) polkit;
 
   propagatedBuildInputs = [ glib dbus-glib ];
 
-  nativeBuildInputs = [ pkg-config intltool ];
+  nativeBuildInputs = [ pkg-config intltool python3 glib ];
 
   configureFlags =
     # fixes the "libgconfbackend-oldxml.so is not portable" error on darwin

pkgs/desktops/gnome-2/platform/ORBit2/default.nix

@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchurl, pkg-config, glib, libIDL, libintl }:
+{ lib, stdenv, fetchurl, pkg-config, glib, libIDL, libintl, buildPackages }:
 
 stdenv.mkDerivation rec {
   pname = "ORBit2";
@@ -9,11 +9,34 @@ stdenv.mkDerivation rec {
     sha256 = "0l3mhpyym9m5iz09fz0rgiqxl2ym6kpkwpsp1xrr4aa80nlh1jam";
   };
 
+  strictDeps = true;
+
+  # Processing file orbit-interface.idl
+  # sh: gcc: not found
+  # output does not contain binaries for build
+  depsBuildBuild = [ buildPackages.stdenv.cc ];
   nativeBuildInputs = [ pkg-config libintl ];
   propagatedBuildInputs = [ glib libIDL ];
 
   outputs = [ "out" "dev" ];
 
+  configureFlags = lib.optionals (stdenv.buildPlatform != stdenv.hostPlatform) [
+    "--with-idl-compiler=${lib.getExe' buildPackages.gnome2.ORBit2 "orbit-idl-2"}"
+    # https://github.com/void-linux/void-packages/blob/e5856e02aa6ef7e4f2725afbff2915f89d39024b/srcpkgs/ORBit2/template#L17-L35
+    "ac_cv_alignof_CORBA_boolean=1"
+    "ac_cv_alignof_CORBA_char=1"
+    "ac_cv_alignof_CORBA_double=8"
+    "ac_cv_alignof_CORBA_float=4"
+    "ac_cv_alignof_CORBA_long=4"
+    "ac_cv_alignof_CORBA_long_double=8"
+    "ac_cv_alignof_CORBA_long_long=8"
+    "ac_cv_alignof_CORBA_octet=1"
+    "ac_cv_alignof_CORBA_short=2"
+    "ac_cv_alignof_CORBA_struct=1"
+    "ac_cv_alignof_CORBA_wchar=2"
+    "ac_cv_alignof_CORBA_pointer=${if stdenv.hostPlatform.is64bit then "8" else "4"}"
+  ];
+
   preBuild = ''
     sed 's/-DG_DISABLE_DEPRECATED//' -i linc2/src/Makefile
   '';

pkgs/desktops/gnome-2/platform/libIDL/default.nix

@@ -9,7 +9,15 @@ stdenv.mkDerivation rec {
     sha256 = "08129my8s9fbrk0vqvnmx6ph4nid744g5vbwphzkaik51664vln5";
   };
 
+  strictDeps = true;
+
   buildInputs = [ glib gettext ];
 
   nativeBuildInputs = [ flex bison pkg-config ];
+
+  configureFlags = lib.optionals (stdenv.buildPlatform != stdenv.hostPlatform) [
+    # before openembedded removed libIDL
+    # the result was always ll https://lists.openembedded.org/g/openembedded-core/topic/85775262?p=%2C%2C%2C20%2C0%2C0%2C0%3A%3A%2C%2C%2C0%2C0%2C0%2C85775262
+    "libIDL_cv_long_long_format=ll"
+  ];
 }