Merge staging-next into staging

doc/languages-frameworks/index.md

@@ -98,6 +98,7 @@ scheme.section.md
 swift.section.md
 tcl.section.md
 texlive.section.md
+typst.section.md
 vim.section.md
 neovim.section.md
 ```

doc/languages-frameworks/typst.section.md

@@ -0,0 +1,62 @@
+# Typst {#typst}
+
+Typst can be configured to include packages from [Typst Universe](https://typst.app/universe/) or custom packages.
+
+## Custom Environment {#typst-custom-environment}
+
+You can create a custom Typst environment with a selected set of packages from **Typst Universe** using the following code. It is also possible to specify a Typst package with a specific version (e.g., `cetz_0_3_0`). A package without a version number will always refer to its latest version.
+
+```nix
+typst.withPackages (p: with p; [
+  polylux_0_4_0
+  cetz_0_3_0
+])
+```
+
+### Handling Outdated Package Hashes {#typst-handling-outdated-package-hashes}
+
+Since **Typst Universe** does not provide a way to fetch a package with a specific hash, the package hashes in `nixpkgs` can sometimes be outdated. To resolve this issue, you can manually override the package source using the following approach:
+
+```nix
+typst.withPackages.override (old: {
+  typstPackages = old.typstPackages.extend (_: previous: {
+    polylux_0_4_0 = previous.polylux_0_4_0.overrideAttrs (oldPolylux: {
+      src = oldPolylux.src.overrideAttrs {
+        outputHash = YourUpToDatePolyluxHash;
+      };
+    });
+  });
+}) (p: with p; [
+  polylux_0_4_0
+  cetz_0_3_0
+])
+```
+
+## Custom Packages {#typst-custom-packages}
+
+`Nixpkgs` provides a helper function, `buildTypstPackage`, to build custom Typst packages that can be used within the Typst environment. However, all dependencies of the custom package must be explicitly specified in `typstDeps`.
+
+Here's how to define a custom Typst package:
+
+```nix
+{ buildTypstPackage, typstPackages, fetchzip }:
+
+buildTypstPackage (finalAttrs: {
+  pname = "my-typst-package";
+  version = "0.0.1";
+  src = fetchzip { ... };
+  typstDeps = with typstPackages; [ cetz_0_3_0 ];
+})
+```
+
+### Package Scope and Usage {#typst-package-scope-and-usage}
+
+By default, every custom package is scoped under `@preview`, as shown below:
+
+```typst
+#import "@preview/my-typst-package:0.0.1": *
+```
+
+Since `@preview` is intended for packages from **Typst Universe**, it is recommended to use this approach **only for temporary or experimental modifications over existing packages** from **Typst Universe**.
+
+On the other hand, **local packages**, packages scoped under `@local`, are **not** considered part of the Typst environment. This means that local packages must be manually linked to the Typst compiler if needed.

doc/redirects.json

@@ -413,6 +413,24 @@
   "tester-testEqualArrayOrMap-return": [
     "index.html#tester-testEqualArrayOrMap-return"
   ],
+  "typst": [
+    "index.html#typst",
+    "doc/languages-frameworks/typst.section.md#typst"
+  ],
+  "typst-custom-environment": [
+    "index.html#typst-custom-environment",
+    "doc/languages-frameworks/typst.section.md#typst-custom-environment"
+  ],
+  "typst-custom-packages": [
+    "index.html#typst-custom-packages",
+    "doc/languages-frameworks/typst.section.md#typst-custom-packages"
+  ],
+  "typst-handling-outdated-package-hashes": [
+    "index.html#typst-handling-outdated-package-hashes"
+  ],
+  "typst-package-scope-and-usage": [
+    "index.html#typst-package-scope-and-usage"
+  ],
   "variables-specifying-dependencies": [
     "index.html#variables-specifying-dependencies"
   ],

maintainers/maintainer-list.nix

@@ -4284,6 +4284,11 @@
     name = "CherryKitten";
     keys = [ { fingerprint = "264C FA1A 194C 585D F822  F673 C01A 7CBB A617 BD5F"; } ];
   };
+  cherrypiejam = {
+    github = "cherrypiejam";
+    githubId = 46938348;
+    name = "Gongqi Huang";
+  };
   chessai = {
     email = "chessai1996@gmail.com";
     github = "chessai";
@@ -6494,6 +6499,12 @@
     githubId = 472846;
     name = "Sebastian Krohn";
   };
+  dramforever = {
+    name = "Vivian Wang";
+    email = "dramforever@live.com";
+    github = "dramforever";
+    githubId = 2818072;
+  };
   drawbu = {
     email = "nixpkgs@drawbu.dev";
     github = "drawbu";

maintainers/scripts/update-typst-packages.py

@@ -0,0 +1,226 @@
+#!/usr/bin/env nix-shell
+#!nix-shell -p "python3.withPackages (p: with p; [ tomli tomli-w packaging license-expression])" -i python3
+
+# This file is formatted with `ruff format`.
+
+import os
+import re
+import tomli
+import tomli_w
+import subprocess
+import concurrent.futures
+import argparse
+import tempfile
+import tarfile
+from string import punctuation
+from packaging.version import Version
+from urllib import request
+from collections import OrderedDict
+
+
+class TypstPackage:
+    def __init__(self, **kwargs):
+        self.pname = kwargs["pname"]
+        self.version = kwargs["version"]
+        self.meta = kwargs["meta"]
+        self.path = kwargs["path"]
+        self.repo = (
+            None
+            if "repository" not in self.meta["package"]
+            else self.meta["package"]["repository"]
+        )
+        self.description = self.meta["package"]["description"].rstrip(punctuation)
+        self.license = self.meta["package"]["license"]
+        self.params = "" if "params" not in kwargs else kwargs["params"]
+        self.deps = [] if "deps" not in kwargs else kwargs["deps"]
+
+    @classmethod
+    def package_name_full(cls, package_name, version):
+        version_number = map(lambda x: int(x), version.split("."))
+        version_nix = "_".join(map(lambda x: str(x), version_number))
+        return "_".join((package_name, version_nix))
+
+    def license_tokens(self):
+        import license_expression as le
+
+        try:
+            # FIXME: ad hoc conversion
+            exception_list = [("EUPL-1.2+", "EUPL-1.2")]
+
+            def sanitize_license_string(license_string, lookups):
+                if not lookups:
+                    return license_string
+                return sanitize_license_string(
+                    license_string.replace(lookups[0][0], lookups[0][1]), lookups[1:]
+                )
+
+            sanitized = sanitize_license_string(self.license, exception_list)
+            licensing = le.get_spdx_licensing()
+            parsed = licensing.parse(sanitized, validate=True)
+            return [s.key for s in licensing.license_symbols(parsed)]
+        except le.ExpressionError as e:
+            print(
+                f'Failed to parse license string "{self.license}" because of {str(e)}'
+            )
+            exit(1)
+
+    def source(self):
+        url = f"https://packages.typst.org/preview/{self.pname}-{self.version}.tar.gz"
+        cmd = [
+            "nix",
+            "store",
+            "prefetch-file",
+            "--unpack",
+            "--hash-type",
+            "sha256",
+            "--refresh",
+            "--extra-experimental-features",
+            "nix-command",
+        ]
+        result = subprocess.run(cmd + [url], capture_output=True, text=True)
+        hash = re.search(r"hash\s+\'(sha256-.{44})\'", result.stderr).groups()[0]
+        return url, hash
+
+    def to_name_full(self):
+        return self.package_name_full(self.pname, self.version)
+
+    def to_attrs(self):
+        deps = set()
+        excludes = list(map(
+            lambda e: os.path.join(self.path, e),
+            self.meta["package"]["exclude"] if "exclude" in self.meta["package"] else [],
+        ))
+        for root, _, files in os.walk(self.path):
+            for file in filter(lambda f: f.split(".")[-1] == "typ", files):
+                file_path = os.path.join(root, file)
+                if file_path in excludes:
+                    continue
+                with open(file_path, "r") as f:
+                    deps.update(
+                        set(
+                            re.findall(
+                                r"^\s*#import\s+\"@preview/([\w|-]+):(\d+.\d+.\d+)\"",
+                                f.read(),
+                                re.MULTILINE,
+                            )
+                        )
+                    )
+        self.deps = list(
+            filter(lambda p: p[0] != self.pname or p[1] != self.version, deps)
+        )
+        source_url, source_hash = self.source()
+
+        return dict(
+            url=source_url,
+            hash=source_hash,
+            typstDeps=[
+                self.package_name_full(p, v)
+                for p, v in sorted(self.deps, key=lambda x: (x[0], Version(x[1])))
+            ],
+            description=self.description,
+            license=self.license_tokens(),
+        ) | (dict(homepage=self.repo) if self.repo else dict())
+
+
+def generate_typst_packages(preview_dir, output_file):
+    package_tree = dict()
+
+    print("Parsing metadata... from", preview_dir)
+    for p in os.listdir(preview_dir):
+        package_dir = os.path.join(preview_dir, p)
+        for v in os.listdir(package_dir):
+            package_version_dir = os.path.join(package_dir, v)
+            with open(
+                os.path.join(package_version_dir, "typst.toml"), "rb"
+            ) as meta_file:
+                try:
+                    package = TypstPackage(
+                        pname=p,
+                        version=v,
+                        meta=tomli.load(meta_file),
+                        path=package_version_dir,
+                    )
+                    if package.pname in package_tree:
+                        package_tree[package.pname][v] = package
+                    else:
+                        package_tree[package.pname] = dict({v: package})
+                except tomli.TOMLDecodeError:
+                    print("Invalid typst.toml:", package_version_dir)
+
+    with open(output_file, "wb") as typst_packages:
+
+        def generate_package(pname, package_subtree):
+            sorted_keys = sorted(package_subtree.keys(), key=Version, reverse=True)
+            print(f"Generating metadata for {pname}")
+            return {
+                pname: OrderedDict(
+                    (k, package_subtree[k].to_attrs()) for k in sorted_keys
+                )
+            }
+
+        with concurrent.futures.ThreadPoolExecutor(max_workers=100) as executor:
+            sorted_packages = sorted(package_tree.items(), key=lambda x: x[0])
+            futures = list()
+            for pname, psubtree in sorted_packages:
+                futures.append(executor.submit(generate_package, pname, psubtree))
+            packages = OrderedDict(
+                (package, subtree)
+                for future in futures
+                for package, subtree in future.result().items()
+            )
+            print(f"Writing metadata... to {output_file}")
+            tomli_w.dump(packages, typst_packages)
+
+
+def main(args):
+    PREVIEW_DIR = "packages/preview"
+    TYPST_PACKAGE_TARBALL_URL = (
+        "https://github.com/typst/packages/archive/refs/heads/main.tar.gz"
+    )
+
+    directory = args.directory
+    if not directory:
+        tempdir = tempfile.mkdtemp()
+        print(tempdir)
+        typst_tarball = os.path.join(tempdir, "main.tar.gz")
+
+        print(
+            "Downloading Typst packages source from {} to {}".format(
+                TYPST_PACKAGE_TARBALL_URL, typst_tarball
+            )
+        )
+        with request.urlopen(
+            request.Request(TYPST_PACKAGE_TARBALL_URL), timeout=15.0
+        ) as response:
+            if response.status == 200:
+                with open(typst_tarball, "wb+") as f:
+                    f.write(response.read())
+            else:
+                print("Download failed")
+                exit(1)
+        with tarfile.open(typst_tarball) as tar:
+            tar.extractall(path=tempdir, filter="data")
+        directory = os.path.join(tempdir, "packages-main")
+    directory = os.path.abspath(directory)
+
+    generate_typst_packages(
+        os.path.join(directory, PREVIEW_DIR),
+        args.output,
+    )
+
+    exit(0)
+
+
+if __name__ == "__main__":
+    parser = argparse.ArgumentParser()
+    parser.add_argument(
+        "-d", "--directory", help="Local Typst Universe repository", default=None
+    )
+    parser.add_argument(
+        "-o",
+        "--output",
+        help="Output file",
+        default=os.path.join(os.path.abspath("."), "typst-packages-from-universe.toml"),
+    )
+    args = parser.parse_args()
+    main(args)

nixos/tests/all-tests.nix

@@ -767,7 +767,7 @@ in
   magic-wormhole-mailbox-server = runTest ./magic-wormhole-mailbox-server.nix;
   magnetico = handleTest ./magnetico.nix { };
   mailcatcher = runTest ./mailcatcher.nix;
-  mailhog = handleTest ./mailhog.nix { };
+  mailhog = runTest ./mailhog.nix;
   mailpit = runTest ./mailpit.nix;
   mailman = runTest ./mailman.nix;
   man = handleTest ./man.nix { };
@@ -830,7 +830,7 @@ in
   mosquitto = runTest ./mosquitto.nix;
   moosefs = handleTest ./moosefs.nix { };
   movim = import ./web-apps/movim { inherit recurseIntoAttrs runTest; };
-  mpd = handleTest ./mpd.nix { };
+  mpd = runTest ./mpd.nix;
   mpv = runTest ./mpv.nix;
   mtp = handleTest ./mtp.nix { };
   multipass = handleTest ./multipass.nix { };
@@ -1176,7 +1176,7 @@ in
   rustls-libssl = handleTest ./rustls-libssl.nix { };
   rxe = handleTest ./rxe.nix { };
   sabnzbd = handleTest ./sabnzbd.nix { };
-  samba = handleTest ./samba.nix { };
+  samba = runTest ./samba.nix;
   samba-wsdd = handleTest ./samba-wsdd.nix { };
   sane = handleTest ./sane.nix { };
   sanoid = handleTest ./sanoid.nix { };

nixos/tests/mailhog.nix

@@ -1,30 +1,28 @@
-import ./make-test-python.nix (
+{ lib, ... }:
-  { lib, ... }:
+{
-  {
+  name = "mailhog";
-    name = "mailhog";
+  meta.maintainers = with lib.maintainers; [
-    meta.maintainers = with lib.maintainers; [
+    jojosch
-      jojosch
+    RTUnreal
-      RTUnreal
+  ];
-    ];
 
-    nodes.machine =
+  nodes.machine =
-      { pkgs, ... }:
+    { pkgs, ... }:
-      {
+    {
-        services.mailhog.enable = true;
+      services.mailhog.enable = true;
-      };
+    };
 
-    testScript = ''
+  testScript = ''
-      start_all()
+    start_all()
 
-      machine.wait_for_unit("mailhog.service")
+    machine.wait_for_unit("mailhog.service")
-      machine.wait_for_open_port(1025)
+    machine.wait_for_open_port(1025)
-      machine.wait_for_open_port(8025)
+    machine.wait_for_open_port(8025)
-      # Test sendmail wrapper (this uses smtp, which tests the connection)
+    # Test sendmail wrapper (this uses smtp, which tests the connection)
-      machine.succeed('printf "To: root@example.com\r\n\r\nthis is the body of the email" | sendmail -t -i -f sender@example.com')
+    machine.succeed('printf "To: root@example.com\r\n\r\nthis is the body of the email" | sendmail -f sender@example.com')
-      res = machine.succeed(
+    res = machine.succeed(
-          "curl --fail http://localhost:8025/api/v2/messages"
+        "curl --fail http://localhost:8025/api/v2/messages"
-      )
+    )
-      assert all(msg in res for msg in ["this is the body of the email", "sender@example.com", "root@example.com"])
+    assert all(msg in res for msg in ["this is the body of the email", "sender@example.com", "root@example.com"])
-    '';
+  '';
-  }
+}
-)

nixos/tests/mpd.nix

@@ -1,150 +1,148 @@
-import ./make-test-python.nix (
+{ pkgs, lib, ... }:
-  { pkgs, lib, ... }:
+let
-  let
+  track = pkgs.fetchurl {
-    track = pkgs.fetchurl {
+    # Sourced from http://freemusicarchive.org/music/Blue_Wave_Theory/Surf_Music_Month_Challenge/Skyhawk_Beach_fade_in
-      # Sourced from http://freemusicarchive.org/music/Blue_Wave_Theory/Surf_Music_Month_Challenge/Skyhawk_Beach_fade_in
 
-      name = "Blue_Wave_Theory-Skyhawk_Beach.mp3";
+    name = "Blue_Wave_Theory-Skyhawk_Beach.mp3";
-      url = "https://freemusicarchive.org/file/music/ccCommunity/Blue_Wave_Theory/Surf_Music_Month_Challenge/Blue_Wave_Theory_-_04_-_Skyhawk_Beach.mp3";
+    url = "https://freemusicarchive.org/file/music/ccCommunity/Blue_Wave_Theory/Surf_Music_Month_Challenge/Blue_Wave_Theory_-_04_-_Skyhawk_Beach.mp3";
-      hash = "sha256-91VDWwrcP6Cw4rk72VHvZ8RGfRBrpRE8xo/02dcJhHc=";
+    hash = "sha256-91VDWwrcP6Cw4rk72VHvZ8RGfRBrpRE8xo/02dcJhHc=";
-      meta.license = lib.licenses.cc-by-sa-40;
+    meta.license = lib.licenses.cc-by-sa-40;
-    };
+  };
 
-    defaultCfg = rec {
+  defaultCfg = rec {
-      user = "mpd";
+    user = "mpd";
-      group = "mpd";
+    group = "mpd";
-      dataDir = "/var/lib/mpd";
+    dataDir = "/var/lib/mpd";
-      musicDirectory = "${dataDir}/music";
+    musicDirectory = "${dataDir}/music";
-    };
+  };
 
-    defaultMpdCfg = {
+  defaultMpdCfg = {
-      inherit (defaultCfg)
+    inherit (defaultCfg)
-        dataDir
+      dataDir
-        musicDirectory
+      musicDirectory
-        user
+      user
-        group
+      group
-        ;
+      ;
-      enable = true;
+    enable = true;
-    };
+  };
 
-    musicService =
+  musicService =
-      {
+    {
-        user,
+      user,
-        group,
+      group,
-        musicDirectory,
+      musicDirectory,
-      }:
+    }:
-      {
+    {
-        description = "Sets up the music file(s) for MPD to use.";
+      description = "Sets up the music file(s) for MPD to use.";
-        requires = [ "mpd.service" ];
+      requires = [ "mpd.service" ];
-        after = [ "mpd.service" ];
+      after = [ "mpd.service" ];
-        wantedBy = [ "default.target" ];
+      wantedBy = [ "default.target" ];
-        script = ''
+      script = ''
-          cp ${track} ${musicDirectory}
+        cp ${track} ${musicDirectory}
-        '';
+      '';
-        serviceConfig = {
+      serviceConfig = {
-          User = user;
+        User = user;
-          Group = group;
+        Group = group;
-        };
       };
-
-    mkServer =
-      { mpd, musicService }:
-      {
-        boot.kernelModules = [ "snd-dummy" ];
-        services.mpd = mpd;
-        systemd.services.musicService = musicService;
-      };
-  in
-  {
-    name = "mpd";
-    meta = {
-      maintainers = with lib.maintainers; [ emmanuelrosa ];
     };
 
-    nodes = {
+  mkServer =
-      client = { ... }: { };
+    { mpd, musicService }:
-
+    {
-      serverALSA =
+      boot.kernelModules = [ "snd-dummy" ];
-        { ... }:
+      services.mpd = mpd;
-        lib.mkMerge [
+      systemd.services.musicService = musicService;
-          (mkServer {
-            mpd = defaultMpdCfg // {
-              network.listenAddress = "any";
-              extraConfig = ''
-                audio_output {
-                  type "alsa"
-                  name "ALSA"
-                  mixer_type "null"
-                }
-              '';
-            };
-            musicService = musicService { inherit (defaultMpdCfg) user group musicDirectory; };
-          })
-          { networking.firewall.allowedTCPPorts = [ 6600 ]; }
-        ];
-
-      serverPulseAudio =
-        { ... }:
-        lib.mkMerge [
-          (mkServer {
-            mpd = defaultMpdCfg // {
-              extraConfig = ''
-                audio_output {
-                  type "pulse"
-                  name "The Pulse"
-                }
-              '';
-            };
-
-            musicService = musicService { inherit (defaultMpdCfg) user group musicDirectory; };
-          })
-          {
-            services.pulseaudio = {
-              enable = true;
-              systemWide = true;
-              tcp.enable = true;
-              tcp.anonymousClients.allowAll = true;
-            };
-            systemd.services.mpd.environment.PULSE_SERVER = "localhost";
-          }
-        ];
     };
+in
+{
+  name = "mpd";
+  meta = {
+    maintainers = with lib.maintainers; [ emmanuelrosa ];
+  };
 
-    testScript = ''
+  nodes = {
-      mpc = "${lib.getExe pkgs.mpc} --wait"
+    client = { ... }: { };
 
-      # Connects to the given server and attempts to play a tune.
+    serverALSA =
-      def play_some_music(server):
+      { ... }:
-          server.wait_for_unit("mpd.service")
+      lib.mkMerge [
-          server.succeed(f"{mpc} update")
+        (mkServer {
-          _, tracks = server.execute(f"{mpc} ls")
+          mpd = defaultMpdCfg // {
+            network.listenAddress = "any";
+            extraConfig = ''
+              audio_output {
+                type "alsa"
+                name "ALSA"
+                mixer_type "null"
+              }
+            '';
+          };
+          musicService = musicService { inherit (defaultMpdCfg) user group musicDirectory; };
+        })
+        { networking.firewall.allowedTCPPorts = [ 6600 ]; }
+      ];
 
-          for track in tracks.splitlines():
+    serverPulseAudio =
-              server.succeed(f"{mpc} add {track}")
+      { ... }:
+      lib.mkMerge [
+        (mkServer {
+          mpd = defaultMpdCfg // {
+            extraConfig = ''
+              audio_output {
+                type "pulse"
+                name "The Pulse"
+              }
+            '';
+          };
 
-          _, added_tracks = server.execute(f"{mpc} playlist")
+          musicService = musicService { inherit (defaultMpdCfg) user group musicDirectory; };
+        })
+        {
+          services.pulseaudio = {
+            enable = true;
+            systemWide = true;
+            tcp.enable = true;
+            tcp.anonymousClients.allowAll = true;
+          };
+          systemd.services.mpd.environment.PULSE_SERVER = "localhost";
+        }
+      ];
+  };
 
-          # Check we succeeded adding audio tracks to the playlist
+  testScript = ''
-          assert len(added_tracks.splitlines()) > 0
+    mpc = "${lib.getExe pkgs.mpc} --wait"
 
-          server.succeed(f"{mpc} play")
+    # Connects to the given server and attempts to play a tune.
+    def play_some_music(server):
+        server.wait_for_unit("mpd.service")
+        server.succeed(f"{mpc} update")
+        _, tracks = server.execute(f"{mpc} ls")
 
-          _, output = server.execute(f"{mpc} status")
+        for track in tracks.splitlines():
-          # Assure audio track is playing
+            server.succeed(f"{mpc} add {track}")
-          assert "playing" in output
 
-          server.succeed(f"{mpc} stop")
+        _, added_tracks = server.execute(f"{mpc} playlist")
+
+        # Check we succeeded adding audio tracks to the playlist
+        assert len(added_tracks.splitlines()) > 0
+
+        server.succeed(f"{mpc} play")
+
+        _, output = server.execute(f"{mpc} status")
+        # Assure audio track is playing
+        assert "playing" in output
+
+        server.succeed(f"{mpc} stop")
 
 
-      play_some_music(serverALSA)
+    play_some_music(serverALSA)
-      play_some_music(serverPulseAudio)
+    play_some_music(serverPulseAudio)
 
-      client.wait_for_unit("multi-user.target")
+    client.wait_for_unit("multi-user.target")
-      client.succeed(f"{mpc} -h serverALSA status")
+    client.succeed(f"{mpc} -h serverALSA status")
 
-      # The PulseAudio-based server is configured not to accept external client connections
+    # The PulseAudio-based server is configured not to accept external client connections
-      # to perform the following test:
+    # to perform the following test:
-      client.fail(f"{mpc} -h serverPulseAudio status")
+    client.fail(f"{mpc} -h serverPulseAudio status")
-    '';
+  '';
-  }
+}
-)

nixos/tests/samba.nix

@@ -1,50 +1,48 @@
-import ./make-test-python.nix (
+{ lib, ... }:
-  { pkgs, lib, ... }:
+{
-  {
+  name = "samba";
-    name = "samba";
 
-    meta.maintainers = [ lib.maintainers.anthonyroussel ];
+  meta.maintainers = [ lib.maintainers.anthonyroussel ];
 
-    nodes = {
+  nodes = {
-      client =
+    client =
-        { ... }:
+      { ... }:
-        {
+      {
-          virtualisation.fileSystems = {
+        virtualisation.fileSystems = {
-            "/public" = {
+          "/public" = {
-              fsType = "cifs";
+            fsType = "cifs";
-              device = "//server/public";
+            device = "//server/public";
-              options = [ "guest" ];
+            options = [ "guest" ];
+          };
+        };
+      };
+
+    server =
+      { ... }:
+      {
+        services.samba = {
+          enable = true;
+          openFirewall = true;
+          settings = {
+            "public" = {
+              "path" = "/public";
+              "read only" = true;
+              "browseable" = "yes";
+              "guest ok" = "yes";
+              "comment" = "Public samba share.";
             };
           };
         };
+      };
+  };
 
-      server =
+  testScript = ''
-        { ... }:
+    server.start()
-        {
+    server.wait_for_unit("samba.target")
-          services.samba = {
+    server.succeed("mkdir -p /public; echo bar > /public/foo")
-            enable = true;
-            openFirewall = true;
-            settings = {
-              "public" = {
-                "path" = "/public";
-                "read only" = true;
-                "browseable" = "yes";
-                "guest ok" = "yes";
-                "comment" = "Public samba share.";
-              };
-            };
-          };
-        };
-    };
 
-    testScript = ''
+    client.start()
-      server.start()
+    client.wait_for_unit("remote-fs.target")
-      server.wait_for_unit("samba.target")
+    client.succeed("[[ $(cat /public/foo) = bar ]]")
-      server.succeed("mkdir -p /public; echo bar > /public/foo")
+  '';
-
+}
-      client.start()
-      client.wait_for_unit("remote-fs.target")
-      client.succeed("[[ $(cat /public/foo) = bar ]]")
-    '';
-  }
-)

pkgs/applications/audio/plexamp/default.nix

@@ -7,12 +7,12 @@
 
 let
   pname = "plexamp";
-  version = "4.11.5";
+  version = "4.12.0";
 
   src = fetchurl {
     url = "https://plexamp.plex.tv/plexamp.plex.tv/desktop/Plexamp-${version}.AppImage";
     name = "${pname}-${version}.AppImage";
-    hash = "sha512-j8fPp6JcTB/PwsGgvEGqETZ83mGee1MwR4T9eFcNuoLRtlnudM7c3WDgxhpUdv5Nx3XkcMVnW1fntZYN2sIfzA==";
+    hash = "sha512-vIH6HPWjL0fzM8rXZhXYUH6qT3mca5WxicRRaQr9RHW511x8pNnRmdwtMDfKtyrhUiZFiE1XAfWBDXmuxbJW/g==";
   };
 
   appimageContents = appimageTools.extractType2 {
@@ -38,7 +38,7 @@ appimageTools.wrapType2 {
   meta = with lib; {
     description = "Beautiful Plex music player for audiophiles, curators, and hipsters";
     homepage = "https://plexamp.com/";
-    changelog = "https://forums.plex.tv/t/plexamp-release-notes/221280/77";
+    changelog = "https://forums.plex.tv/t/plexamp-release-notes/221280/78";
     license = licenses.unfree;
     maintainers = with maintainers; [
       killercup

pkgs/applications/networking/instant-messengers/gajim/default.nix

@@ -40,11 +40,11 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "gajim";
-  version = "2.1.0";
+  version = "2.1.1";
 
   src = fetchurl {
     url = "https://gajim.org/downloads/${lib.versions.majorMinor version}/gajim-${version}.tar.gz";
-    hash = "sha256-LuguvOkqFDHG46+J2Q0rXnRHRuiVdCG84FuZ8CeLDYE=";
+    hash = "sha256-1pPrc7lzxaLK1QbxslGYGS8xOxuT231RvZrdvWeGFOk=";
   };
 
   format = "pyproject";

pkgs/build-support/build-typst-package.nix

@@ -0,0 +1,60 @@
+{
+  lib,
+  stdenvNoCC,
+}:
+
+/**
+  `buildTypstPackage` is a helper builder for typst packages.
+
+  # Inputs
+
+    `attrs`
+    : attrs for stdenvNoCC.mkDerivation + typstDeps (a list of `buildTypstPackage` derivations)
+
+  # Example
+  ```nix
+  { buildTypstPackage, typstPackages }:
+
+  buildTypstPackage {
+    pname = "example";
+    version = "0.0.1";
+    src = ./.;
+    typstDeps = with typstPackages; [ oxifmt ];
+  }
+  ```
+*/
+
+lib.extendMkDerivation {
+  constructDrv = stdenvNoCC.mkDerivation;
+
+  excludeDrvArgNames = [
+    "typstDeps"
+  ];
+
+  extendDrvArgs =
+    finalAttrs:
+    {
+      typstDeps ? [ ],
+      ...
+    }@attrs:
+    {
+      name = "typst-package-${finalAttrs.pname}-${finalAttrs.version}";
+
+      installPhase =
+        let
+          outDir = "$out/lib/typst-packages/${finalAttrs.pname}/${finalAttrs.version}";
+        in
+        ''
+          runHook preInstall
+          mkdir -p ${outDir}
+          cp -r . ${outDir}
+          runHook postInstall
+        '';
+
+      propagatedBuildInputs = typstDeps;
+
+      passthru = {
+        inherit typstDeps;
+      };
+    };
+}

pkgs/by-name/al/alistral/package.nix

@@ -10,13 +10,13 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "alistral";
-  version = "0.5.5";
+  version = "0.5.6";
 
   src = fetchFromGitHub {
     owner = "RustyNova016";
     repo = "Alistral";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-DrHoVAIPD/F6pY04QXVilXiwD/nWzeVquuHzRiq2sRY=";
+    hash = "sha256-6p2KMFTdC04lEhNQiu88ALBPrpQUF9JhXDacntoq4lE=";
   };
 
   # remove if updating to rust 1.85
@@ -27,7 +27,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
   '';
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-Jyus5L0z0Z6Qf9vBcO6/h+py0JNKG1FS6qXONUM26BM=";
+  cargoHash = "sha256-2pi2hfQTLs2HAlgp1DQCMFp/nMJQfcuQFhGlrsWgy5E=";
 
   env.RUSTC_BOOTSTRAP = 1;
 

pkgs/by-name/au/audacious-plugins/package.nix

@@ -110,9 +110,7 @@ stdenv.mkDerivation rec {
   dontWrapQtApps = true;
 
   postInstall = ''
-    ln -s ${
+    ln -s ${vgmstream.audacious}/lib/audacious/Input/* $out/lib/audacious/Input
-      vgmstream.override { buildAudaciousPlugin = true; }
-    }/lib/audacious/Input/* $out/lib/audacious/Input
   '';
 
   meta = audacious-bare.meta // {

pkgs/by-name/br/broot/package.nix

@@ -15,17 +15,17 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "broot";
-  version = "1.45.1";
+  version = "1.46.0";
 
   src = fetchFromGitHub {
     owner = "Canop";
     repo = "broot";
     rev = "v${version}";
-    hash = "sha256-xLmVqYjQqjWMBm2A5OJl2wFIvxbWviX//J10BnKgWyk=";
+    hash = "sha256-m7TG3Bxqp87g9GPijy+daP4nYgCJkTmC95U+DgUcWGM=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-8QRqRAXyqWS13TxUlSawjh/Qo4Qs5yQtNlqXj0hMW0c=";
+  cargoHash = "sha256-elpzGgF9o7iV2YaQFFqQ9jafEuYVPImC808MWWFZ4gw=";
 
   nativeBuildInputs = [
     installShellFiles

pkgs/by-name/co/codex/package.nix

@@ -2,22 +2,26 @@
   lib,
   buildNpmPackage,
   fetchFromGitHub,
+  versionCheckHook,
 }:
 
 buildNpmPackage rec {
   pname = "codex";
-  version = "0.1.04160940"; # from codex-cli/package.json
+  version = "0.1.2504161510"; # from codex-cli/package.json
 
   src = fetchFromGitHub {
     owner = "openai";
     repo = "codex";
-    rev = "e8afebac157f2069fc7ae0e33fb44c85ebf48892";
+    rev = "b0ccca555685b1534a0028cb7bfdcad8fe2e477a";
-    hash = "sha256-FW03PSmeyJPDPpWw4XEqKZQqEwjOV2VFVQWXmXBevYU=";
+    hash = "sha256-WTnP6HZfrMjUoUZL635cngpfvvjrA2Zvm74T2627GwA=";
   };
 
   sourceRoot = "${src.name}/codex-cli";
 
-  npmDepsHash = "sha256-QdfO/p8oQnwIANeNRD0vD55v5lc9dHeaScpnpLqWdxc=";
+  npmDepsHash = "sha256-riVXC7T9zgUBUazH5Wq7+MjU1FepLkp9kHLSq+ZVqbs=";
+
+  doInstallCheck = true;
+  nativeInstallCheckInputs = [ versionCheckHook ];
 
   meta = {
     description = "Lightweight coding agent that runs in your terminal";

pkgs/by-name/cr/crosvm/package.nix

@@ -21,12 +21,12 @@
 
 rustPlatform.buildRustPackage {
   pname = "crosvm";
-  version = "0-unstable-2025-04-07";
+  version = "0-unstable-2025-04-16";
 
   src = fetchgit {
     url = "https://chromium.googlesource.com/chromiumos/platform/crosvm";
-    rev = "7cb0f63341ca728c2d0f53c94fadfd20dd307186";
+    rev = "28a224e3fb19ce9fe1ce2a32b952af4c96e10bea";
-    hash = "sha256-xEKOEEGyfrfCGzI2+brkVwHcKKKLctNU+adgzVNGses=";
+    hash = "sha256-LRXtGSSFAhRoSIFLfAhYyrBVx1tsxHgpQIfyKTI2Awk=";
     fetchSubmodules = true;
   };
 

pkgs/by-name/gg/ggh/package.nix

@@ -0,0 +1,38 @@
+{
+  lib,
+  buildGoModule,
+  fetchFromGitHub,
+  nix-update-script,
+}:
+
+buildGoModule (finalAttrs: {
+  pname = "ggh";
+  version = "0.1.4";
+
+  src = fetchFromGitHub {
+    owner = "byawitz";
+    repo = "ggh";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-itNx/AcLUQCH99ZCOXiXPWNg3mx+UhHepidqmzPY8Oc=";
+  };
+
+  vendorHash = "sha256-WPPjpxCD3WA3E7lx5+DPvG31p8djera5xRn980eaJT8=";
+
+  ldflags = [
+    "-s"
+    "-w"
+    "-X main.version=v${finalAttrs.version}"
+  ];
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "Recall your SSH sessions (also search your SSH config file)";
+    homepage = "https://github.com/byawitz/ggh";
+    changelog = "https://github.com/byawitz/ggh/releases/tag/v${finalAttrs.version}";
+    license = lib.licenses.asl20;
+    maintainers = [ lib.maintainers.ilarvne ];
+    platforms = lib.platforms.unix;
+    mainProgram = "ggh";
+  };
+})

pkgs/by-name/gi/gitlab-ci-local/package.nix

@@ -5,6 +5,9 @@
   nix-update-script,
   gitlab-ci-local,
   testers,
+  makeBinaryWrapper,
+  rsync,
+  gitMinimal,
 }:
 
 buildNpmPackage rec {
@@ -20,12 +23,26 @@ buildNpmPackage rec {
 
   npmDepsHash = "sha256-fndSJd15sZ/sIFvh+MzNw25kuP9D9+Qc0mDqgnvjnPo=";
 
+  nativeBuildInputs = [
+    makeBinaryWrapper
+  ];
+
   postPatch = ''
     # remove cleanup which runs git commands
     substituteInPlace package.json \
       --replace-fail "npm run cleanup" "true"
   '';
 
+  postInstall = ''
+    wrapProgram $out/bin/gitlab-ci-local \
+      --prefix PATH : "${
+        lib.makeBinPath [
+          rsync
+          gitMinimal
+        ]
+      }"
+  '';
+
   passthru = {
     updateScript = nix-update-script { };
     tests.version = testers.testVersion {

pkgs/by-name/go/go-xmlstruct/package.nix

@@ -0,0 +1,50 @@
+{
+  lib,
+  buildGoModule,
+  fetchFromGitHub,
+  nix-update-script,
+}:
+
+buildGoModule (finalAttrs: {
+  pname = "go-xmlstruct";
+  version = "1.10.0";
+
+  src = fetchFromGitHub {
+    owner = "twpayne";
+    repo = "go-xmlstruct";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-7nDxLvTu/l3bbkG/MYFWqO0KGNfVVwW9/WqvKvj0wOc=";
+  };
+
+  vendorHash = "sha256-dxnMWxcWu67FI833bFoxy+5s2ELp3gXisLiTACZRzGU=";
+
+  doInstallCheck = true;
+  installCheckPhase = ''
+    runHook preInstallCheck
+
+    # The --help flag doesn't actually exist in goxmlstruct, causing it to return exit code 2,
+    # but this error condition is the only way to get the usage information.
+    output=$($out/bin/goxmlstruct --help 2>&1 || true)
+
+    if ! echo "$output" | grep -q "Usage of $out/bin/goxmlstruct:"; then
+      echo "Expected usage information not found in output"
+      echo "Got: $output"
+      exit 1
+    fi
+
+    runHook postInstallCheck
+  '';
+
+  passthru = {
+    updateScript = nix-update-script { };
+  };
+
+  meta = {
+    description = "Generate Go structs from multiple XML documents";
+    mainProgram = "goxmlstruct";
+    homepage = "https://github.com/twpayne/go-xmlstruct";
+    changelog = "https://github.com/twpayne/go-xmlstruct/releases/tag/v${finalAttrs.version}";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ dvcorreia ];
+  };
+})

pkgs/by-name/he/hevi/deps.nix

@@ -0,0 +1,42 @@
+# generated by zon2nix (https://github.com/nix-community/zon2nix)
+
+{
+  linkFarm,
+  fetchzip,
+  fetchgit,
+}:
+
+linkFarm "zig-packages" [
+  {
+    name = "12204a4669fa6e8ebb1720e3581a24c1a7f538f2f4ee3ebc91a9e36285c89572d761";
+    path = fetchgit {
+      url = "https://github.com/MFAshby/zig-lsp-kit.git";
+      rev = "1c07e3e3305f8dd6355735173321c344fc152d3e";
+      hash = "sha256-WBJ7hbc69W3mtzrMLwehcKccSbVe/8Dy9sX4IA4VbcY=";
+    };
+  }
+  {
+    name = "1220841471bd4891cbb199d27cc5e7e0fb0a5b7c5388a70bd24fa3eb7285755c396c";
+    path = fetchgit {
+      url = "https://github.com/kubkon/zig-yaml.git";
+      rev = "beddd5da24de91d430ca7028b00986f7745b13e9";
+      hash = "sha256-CJms2LjwoYNlbhapFYzvOImuaMH/zikllYeQ2/VlHi0=";
+    };
+  }
+  {
+    name = "12209cde192558f8b3dc098ac2330fc2a14fdd211c5433afd33085af75caa9183147";
+    path = fetchgit {
+      url = "https://github.com/ziglibs/known-folders.git";
+      rev = "0ad514dcfb7525e32ae349b9acc0a53976f3a9fa";
+      hash = "sha256-X+XkFj56MkYxxN9LUisjnkfCxUfnbkzBWHy9pwg5M+g=";
+    };
+  }
+  {
+    name = "1220c198cdaf6cb73fca6603cc5039046ed10de2e9f884cae9224ff826731df1c68d";
+    path = fetchgit {
+      url = "https://github.com/kristoff-it/ziggy";
+      rev = "ae30921d8c98970942d3711553aa66ff907482fe";
+      hash = "sha256-dZemnsmM0383HnA7zhykyO/DnG0mx+PVjjr9NiIfu4I=";
+    };
+  }
+]

pkgs/by-name/he/hevi/package.nix

@@ -0,0 +1,39 @@
+{
+  callPackage,
+  fetchFromGitHub,
+  lib,
+  stdenv,
+  zig_0_13,
+}:
+
+let
+  zig = zig_0_13;
+in
+stdenv.mkDerivation (finalAttrs: {
+  pname = "hevi";
+  version = "1.1.0";
+
+  src = fetchFromGitHub {
+    owner = "Arnau478";
+    repo = "hevi";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-wnpuM2qlbeDIupDPQPKdWmjAKepCG0+u3uxcLDFB09w=";
+  };
+
+  nativeBuildInputs = [
+    zig.hook
+  ];
+
+  postPatch = ''
+    ln -s ${callPackage ./deps.nix { }} $ZIG_GLOBAL_CACHE_DIR/p
+  '';
+
+  meta = {
+    description = "Hex viewer";
+    homepage = "https://github.com/Arnau478/hevi";
+    license = lib.licenses.gpl3Only;
+    maintainers = [ lib.maintainers.jmbaur ];
+    mainProgram = "hevi";
+    inherit (zig.meta) platforms;
+  };
+})

pkgs/by-name/hu/huion-switcher/package.nix

@@ -0,0 +1,60 @@
+{
+  lib,
+  nix-update-script,
+  fetchFromGitHub,
+  rustPlatform,
+  udev,
+  pkg-config,
+  installShellFiles,
+  versionCheckHook,
+}:
+
+rustPlatform.buildRustPackage (finalAttrs: {
+  pname = "huion-switcher";
+  version = "0.5.0";
+
+  src = fetchFromGitHub {
+    owner = "whot";
+    repo = "huion-switcher";
+    tag = finalAttrs.version;
+    hash = "sha256-+cMvBVtJPbsJhEmOh3SEXZrVwp9Uuvx6QmUCcpenS20=";
+  };
+
+  buildInputs = [ udev ];
+  nativeBuildInputs = [
+    pkg-config
+    installShellFiles
+  ];
+
+  useFetchCargoVendor = true;
+  cargoHash = "sha256-yj55FMdf91ZG95yuMt3dQFhUjYM0/sUfFKB+W+5xEfo=";
+
+  postInstall = ''
+    mv huion-switcher.{man,1}
+    installManPage huion-switcher.1
+
+    # Install 80-huion-switcher.rules
+
+    # Mind the trailing space! We leave the args to huion-switcher in place
+    substituteInPlace "80-huion-switcher.rules" --replace-fail \
+      "IMPORT{program}=\"huion-switcher " \
+      "IMPORT{program}=\"$out/bin/huion-switcher "
+
+    install -Dm 0644 -t "$out/lib/udev/rules.d" "80-huion-switcher.rules"
+  '';
+
+  doInstallCheck = true;
+  nativeInstallCheckInputs = [ versionCheckHook ];
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "Utility to switch Huion devices into raw tablet mode";
+    homepage = "https://github.com/whot/huion-switcher";
+    changelog = "https://github.com/whot/huion-switcher/releases/tag/${finalAttrs.version}";
+    license = lib.licenses.gpl2Only;
+    platforms = lib.platforms.linux;
+    mainProgram = "huion-switcher";
+    maintainers = with lib.maintainers; [ dramforever ];
+  };
+})

pkgs/by-name/kd/kdiff3/package.nix

@@ -3,42 +3,38 @@
   lib,
   fetchurl,
   extra-cmake-modules,
-  kdoctools,
-  wrapQtAppsHook,
   boost,
-  kcrash,
+  kdePackages,
-  kconfig,
-  kinit,
-  kparts,
-  kiconthemes,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "kdiff3";
-  version = "1.11.5";
+  version = "1.12.2";
 
   src = fetchurl {
     url = "mirror://kde/stable/kdiff3/kdiff3-${finalAttrs.version}.tar.xz";
-    hash = "sha256-Qg8Ys7lolpigXhAvikFxkEkHTaaPlslL4Y0bgpfutUU=";
+    hash = "sha256-MaN8vPnUIHintIRdQqwaAzp9cjKlq66qAo9kJbufpDk=";
   };
 
   nativeBuildInputs = [
     extra-cmake-modules
-    kdoctools
+    kdePackages.kdoctools
-    wrapQtAppsHook
+    kdePackages.wrapQtAppsHook
   ];
 
-  buildInputs = [
+  buildInputs = with kdePackages; [
+    qtbase
     boost
     kconfig
     kcrash
-    kinit
     kparts
     kiconthemes
   ];
 
   cmakeFlags = [ "-Wno-dev" ];
 
+  env.LANG = "C.UTF-8";
+
   postInstall = lib.optionalString stdenv.hostPlatform.isDarwin ''
     ln -s "$out/Applications/KDE/kdiff3.app/Contents/MacOS" "$out/bin"
   '';
@@ -49,6 +45,6 @@ stdenv.mkDerivation (finalAttrs: {
     homepage = "https://invent.kde.org/sdk/kdiff3";
     license = licenses.gpl2Plus;
     maintainers = with maintainers; [ peterhoeg ];
-    platforms = with platforms; linux ++ darwin;
+    inherit (kdePackages.qtbase.meta) platforms;
   };
 })

pkgs/by-name/ly/lyto/package.nix

@@ -0,0 +1,42 @@
+{
+  lib,
+  python3,
+  fetchFromGitHub,
+}:
+
+python3.pkgs.buildPythonApplication rec {
+  pname = "lyto";
+  version = "0.2.2";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "eeriemyxi";
+    repo = "lyto";
+    tag = "v${version}";
+    hash = "sha256-XCAM7vo4EcbIxFddggeqABru4epE2jW2YpF++I0mpdU=";
+  };
+
+  build-system = [
+    python3.pkgs.hatchling
+  ];
+
+  dependencies = with python3.pkgs; [
+    qrcode
+    rich
+    sixel
+    zeroconf
+  ];
+
+  pythonImportsCheck = [
+    "lyto"
+  ];
+
+  meta = {
+    description = "Automatic wireless ADB connection using QR codes";
+    homepage = "https://github.com/eeriemyxi/lyto";
+    changelog = "https://github.com/eeriemyxi/lyto/releases/tag/v${version}";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ atemu ];
+    mainProgram = "lyto";
+  };
+}

pkgs/by-name/ma/macos-defaults/package.nix

@@ -0,0 +1,38 @@
+{
+  lib,
+  fetchFromGitHub,
+  rustPlatform,
+  nix-update-script,
+}:
+rustPlatform.buildRustPackage (finalAttrs: {
+  pname = "macos-defaults";
+  version = "0.2.0";
+
+  src = fetchFromGitHub {
+    owner = "dsully";
+    repo = "macos-defaults";
+    tag = finalAttrs.version;
+    hash = "sha256-dSZjMuw7ott0dgiYo0rqekEvScmrX6iG7xHaPAgo1/E=";
+  };
+
+  useFetchCargoVendor = true;
+  cargoHash = "sha256-xSg6WAkFPS8B1G4WqMW77egCMmOEo3rK2EKcrDYaBjA=";
+
+  checkFlags = [
+    # accesses home dir
+    "--skip=defaults::tests::plist_path_tests"
+    # accesses system_profiler
+    "--skip=defaults::tests::test_get_hardware_uuid"
+  ];
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "Tool for managing macOS defaults declaratively via YAML files";
+    homepage = "https://github.com/dsully/macos-defaults";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ josh ];
+    mainProgram = "macos-defaults";
+    platforms = lib.platforms.darwin;
+  };
+})

pkgs/by-name/ma/matcha-gtk-theme/package.nix

@@ -24,13 +24,13 @@ lib.checkListOfEnum "${pname}: color variants" [ "standard" "light" "dark" ] col
   stdenvNoCC.mkDerivation
   rec {
     inherit pname;
-    version = "2024-05-01";
+    version = "2025-04-11";
 
     src = fetchFromGitHub {
       owner = "vinceliuice";
       repo = pname;
       rev = version;
-      sha256 = "trQwRZ/JKIS8TcRIg0eL5GmB/yymDwqqNued0ddRuqU=";
+      sha256 = "sha256-vPAGEa3anWAynEg2AYme4qpHJdLDKk2CmL5iQ1mBYgM=";
     };
 
     nativeBuildInputs = [

pkgs/by-name/mp/mpiCheckPhaseHook/mpi-check-hook.sh

@@ -55,7 +55,7 @@ setupMpiCheck() {
       # The solution is to use a preset cpu topology file and disable ucx model.
 
       # Disable sysfs cpu topology directory discovery.
-      export PRTE_MCA_hwloc_use_topo_file="@topology@"
+      export HWLOC_XMLFILE="@topology@"
       # Use the network model ob1 instead of ucx.
       export OMPI_MCA_pml=ob1
       ;;
@@ -68,6 +68,8 @@ setupMpiCheck() {
     MVAPICH)
       # Disable CPU pinning
       export MV2_ENABLE_AFFINITY=0
+      # Disable sysfs cpu topology directory discovery.
+      export HWLOC_XMLFILE="@topology@"
       ;;
   esac
 

pkgs/by-name/mu/mullvad-browser/package.nix

@@ -97,7 +97,7 @@ let
     ++ lib.optionals mediaSupport [ ffmpeg ]
   );
 
-  version = "14.0.9";
+  version = "14.5";
 
   sources = {
     x86_64-linux = fetchurl {
@@ -109,7 +109,7 @@ let
         "https://tor.eff.org/dist/mullvadbrowser/${version}/mullvad-browser-linux-x86_64-${version}.tar.xz"
         "https://tor.calyxinstitute.org/dist/mullvadbrowser/${version}/mullvad-browser-linux-x86_64-${version}.tar.xz"
       ];
-      hash = "sha256-5mVplSTqXVTL+QSJg0hthKUL/JiwX3A3DC869HRzQ7M=";
+      hash = "sha256-uqwsDXbS8tfG/bgTQKvdiaPzchVhssoQccQStncNWOk=";
     };
   };
 
@@ -249,7 +249,7 @@ stdenv.mkDerivation rec {
     # FONTCONFIG_FILE is required to make fontconfig read the MB
     # fonts.conf; upstream uses FONTCONFIG_PATH, but FC_DEBUG=1024
     # indicates the system fonts.conf being used instead.
-    FONTCONFIG_FILE=$MB_IN_STORE/fontconfig/fonts.conf
+    FONTCONFIG_FILE=$MB_IN_STORE/fonts/fonts.conf
     substituteInPlace "$FONTCONFIG_FILE" \
       --replace-fail '<dir prefix="cwd">fonts</dir>' "<dir>$MB_IN_STORE/fonts</dir>"
 

pkgs/by-name/ne/nesting/package.nix

@@ -9,33 +9,34 @@
   versionCheckHook,
 }:
 
-buildGoModule rec {
+buildGoModule (finalAttrs: {
   pname = "nesting";
   version = "0.3.0";
 
   src = fetchFromGitLab {
-    group = "gitlab-org";
+    owner = "gitlab-org/fleeting";
-    owner = "fleeting";
     repo = "nesting";
-    tag = "v${version}";
+    tag = "v${finalAttrs.version}";
     hash = "sha256-ejoLld1TmwaqTlSyuzyEVEqLyEehu6g7yc0H0Cvkqp4=";
   };
 
   vendorHash = "sha256-CyXlK/0VWMFlwSfisoaNCRdknasp8faN/K/zdyRhAQQ=";
 
-  subPackages = [ "cmd/nesting" ];
-
-  # See https://gitlab.com/gitlab-org/fleeting/nesting/-/blob/v0.3.0/Makefile?ref_type=tags#L22-24.
-  #
-  # Needed for "nesting version" to not show "dev".
-  ldflags = [
-    "-X gitlab.com/gitlab-org/fleeting/nesting.NAME=nesting"
-    "-X gitlab.com/gitlab-org/fleeting/nesting.VERSION=v${version}"
-    "-X gitlab.com/gitlab-org/fleeting/nesting.REVISION=${src.rev}"
-  ];
-
   buildInputs = lib.optionals stdenv.hostPlatform.isDarwin [ apple-sdk_15 ];
 
+  # Needed for "nesting version" to not show "dev".
+  #
+  # https://gitlab.com/gitlab-org/fleeting/nesting/-/blob/v0.3.0/Makefile?ref_type=tags#L22-24
+  ldflags =
+    let
+      ldflagsPackageVariablePrefix = "gitlab.com/gitlab-org/fleeting/nesting";
+    in
+    [
+      "-X ${ldflagsPackageVariablePrefix}.NAME=nesting"
+      "-X ${ldflagsPackageVariablePrefix}.VERSION=${finalAttrs.version}"
+      "-X ${ldflagsPackageVariablePrefix}.REFERENCE=v${finalAttrs.version}"
+    ];
+
   doInstallCheck = true;
 
   nativeInstallCheckInputs = [ versionCheckHook ];
@@ -57,4 +58,4 @@ buildGoModule rec {
       "x86_64-darwin"
     ];
   };
-}
+})

pkgs/by-name/oa/oama/0001-Downgrade-cabal-version-for-ghc-9.6-compat.patch

@@ -0,0 +1,22 @@
+From d6d43789bf5af99c9c18f4c88e6a6751bdcacbce Mon Sep 17 00:00:00 2001
+From: Nick Hu <me@nickhu.co.uk>
+Date: Wed, 16 Apr 2025 15:18:02 +0100
+Subject: [PATCH] Downgrade cabal-version for ghc 9.6 compat
+
+---
+ oama.cabal | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/oama.cabal b/oama.cabal
+index 658c051..4d0c428 100644
+--- a/oama.cabal
++++ b/oama.cabal
+@@ -1,4 +1,4 @@
+-cabal-version:      3.12
++cabal-version:      3.8
+ name:               oama
+ version:            0.19.0
+ license:            BSD-3-Clause
+-- 
+2.48.1
+

pkgs/by-name/oa/oama/generated-package.nix

@@ -10,6 +10,7 @@
   fetchgit,
   hsyslog,
   http-conduit,
+  http-types,
   lib,
   mtl,
   network,
@@ -30,11 +31,11 @@
 }:
 mkDerivation {
   pname = "oama";
-  version = "0.14";
+  version = "0.19.0";
   src = fetchgit {
     url = "https://github.com/pdobsan/oama.git";
-    sha256 = "1hdhkc6hh4nvx31vkaii7hd2rxlwqrsvr6i1i0a9r1xlda05ffq0";
+    sha256 = "1nrgpnh76fcmkdw1j3ha5cam7bnxkgfns2plj8609qv0v0swmj4s";
-    rev = "4e1ffd3001034771d284678f0160060c1871707c";
+    rev = "3eef17b7e290dfced252375a13bc8dd46849adf0";
     fetchSubmodules = true;
   };
   isLibrary = true;
@@ -47,6 +48,7 @@ mkDerivation {
     directory
     hsyslog
     http-conduit
+    http-types
     mtl
     network
     network-uri
@@ -72,6 +74,7 @@ mkDerivation {
     directory
     hsyslog
     http-conduit
+    http-types
     mtl
     network
     network-uri

pkgs/by-name/oa/oama/package.nix

@@ -8,6 +8,7 @@ let
   inherit (haskell.lib.compose) overrideCabal justStaticExecutables;
 
   overrides = {
+    patches = [ ./0001-Downgrade-cabal-version-for-ghc-9.6-compat.patch ];
     description = "OAuth credential MAnager";
     homepage = "https://github.com/pdobsan/oama";
     maintainers = with lib.maintainers; [ aidalgol ];

pkgs/by-name/oa/oama/update.sh

@@ -1,5 +1,5 @@
 #!/usr/bin/env nix-shell
-#!nix-shell -i bash -p cabal2nix curl jq nixfmt-rfc-style
+#!nix-shell -i bash -p haskell.packages.ghc910.cabal2nix nix-prefetch-git curl jq nixfmt-rfc-style
 
 set -euo pipefail
 

pkgs/by-name/op/openmolcas/nevpt2.patch

@@ -0,0 +1,22 @@
+diff --git a/src/gctime.c b/src/gctime.c
+index 34fcb6f..832459c 100644
+--- a/src/gctime.c
++++ b/src/gctime.c
+@@ -1,14 +1,15 @@
++#include <string.h>
+ typedef long f77_int;     /* Fortran integer type */
+ typedef char * f77_char;    /* Fortran character argument */
+ #define CH_F2C(X) ((char *) (X))  /* How to get char ptr from F77 argument */
+-gctime (fstr, lstr) f77_char *fstr; int lstr; {
++int gctime (fstr, lstr) f77_char *fstr; int lstr; {
+    long time(), t;
+    char *ctime();
+    t = time ( (long *) 0);
+    strcpy(CH_F2C(fstr),ctime(&t));
+    return (0);
+    }
+-gctime_(fstr, lstr) f77_char *fstr; int lstr; {
++int gctime_(fstr, lstr) f77_char *fstr; int lstr; {
+    long time(), t;
+    char *ctime();
+    t = time ( (long *) 0);

pkgs/by-name/op/openmolcas/openblasPath.patch

@@ -1,12 +0,0 @@
-diff --git a/CMakeLists.txt b/CMakeLists.txt
-index 276ae4e2..db13e6e3 100644
---- a/CMakeLists.txt
-+++ b/CMakeLists.txt
-@@ -1507,7 +1507,6 @@ if (LINALG STREQUAL "OpenBLAS")
-     NAMES openblas
-     PATHS ${OPENBLASROOT}
-     PATH_SUFFIXES lib
--    NO_DEFAULT_PATH
-   )
- 
-   if (NOT LIBOPENBLAS)

pkgs/by-name/op/openmolcas/package.nix

@@ -7,6 +7,7 @@
   gfortran,
   perl,
   blas-ilp64,
+  lapack-ilp64,
   hdf5-cpp,
   python3,
   texliveMinimal,
@@ -16,7 +17,7 @@
   gsl,
   boost,
   autoPatchelfHook,
-  enableQcmaquis ? false,
+  enableQcmaquis ? true,
   # Note that the CASPT2 module is broken with MPI
   # See https://gitlab.com/Molcas/OpenMolcas/-/issues/169
   enableMpi ? false,
@@ -25,11 +26,7 @@
 }:
 
 assert blas-ilp64.isILP64;
-assert lib.elem blas-ilp64.passthru.implementation [
+assert lapack-ilp64.isILP64;
-  "openblas"
-  "mkl"
-];
-assert enableQcmaquis -> lib.elem blas-ilp64.passthru.implementation "mkl";
 
 let
   python = python3.withPackages (
@@ -46,30 +43,43 @@ let
     rev = "release-3.1.4"; # Must match tag in cmake/custom/qcmaquis.cmake
     hash = "sha256-vhC5k+91IPFxdCi5oYt1NtF9W08RxonJjPpA0ls4I+o=";
   };
-  nevtp2Src = fetchFromGitHub {
+
-    owner = "qcscine";
+  # NEVPT2 sources must be patched to be valid C code in gctime.c
-    repo = "nevpt2";
+  nevpt2Src = stdenv.mkDerivation {
-    rev = "e1484fd"; # Must match tag in cmake/custom/nevpt2.cmake
+    pname = "nevpt2-src";
-    hash = "sha256-Vl+FhwhJBbD/7U2CwsYE9BClSQYLJ8DKXV9EXxQUmz0=";
+    version = "unstable";
+    phases = [
+      "unpackPhase"
+      "patchPhase"
+      "installPhase"
+    ];
+    src = fetchFromGitHub {
+      owner = "qcscine";
+      repo = "nevpt2";
+      rev = "e1484fd"; # Must match tag in cmake/custom/nevpt2.cmake
+      hash = "sha256-Vl+FhwhJBbD/7U2CwsYE9BClSQYLJ8DKXV9EXxQUmz0=";
+    };
+    patches = [ ./nevpt2.patch ];
+    installPhase = ''
+      mkdir $out
+      cp -r * $out/.
+    '';
   };
 
 in
 stdenv.mkDerivation rec {
   pname = "openmolcas";
-  version = "24.10";
+  version = "25.02";
 
   src = fetchFromGitLab {
     owner = "Molcas";
     repo = "OpenMolcas";
     rev = "v${version}";
-    hash = "sha256-LXxr/xqBHG7a0rOBrb8IMZ4IjZak3NsBw40Qf+z1fic=";
+    hash = "sha256-Ty7C7zj1lQixuUzeKLcwQCmcPexZXtIGDzp1wUMKDi0=";
   };
 
   patches = [
-    # Required to handle openblas multiple outputs
+    # Required for a local QCMaquis build. Also sanitises QCMaquis BLAS/LAPACK handling
-    ./openblasPath.patch
-
-    # Required for a local QCMaquis build
     ./qcmaquis.patch
   ];
 
@@ -83,7 +93,7 @@ stdenv.mkDerivation rec {
       --subst-var-by "qcmaquis_src_url" "file://${qcmaquisSrc}"
 
     substituteInPlace cmake/custom/nevpt2.cmake \
-      --subst-var-by "nevpt2_src_url" "file://${nevtp2Src}"
+      --subst-var-by "nevpt2_src_url" "file://${nevpt2Src}"
   '';
 
   nativeBuildInputs = [
@@ -97,13 +107,14 @@ stdenv.mkDerivation rec {
 
   buildInputs =
     [
-      blas-ilp64.passthru.provider
       hdf5-cpp
       python
       armadillo
       libxc
       gsl.dev
       boost
+      blas-ilp64
+      lapack-ilp64
     ]
     ++ lib.optionals enableMpi [
       mpi
@@ -112,38 +123,31 @@ stdenv.mkDerivation rec {
 
   passthru = lib.optionalAttrs enableMpi { inherit mpi; };
 
-  cmakeFlags =
+  preConfigure =
-    [
+    ''
-      "-DOPENMP=ON"
+      cmakeFlagsArray+=(
-      "-DTOOLS=ON"
+        "-DOPENMP=ON"
-      "-DHDF5=ON"
+        "-DTOOLS=ON"
-      "-DFDE=ON"
+        "-DHDF5=ON"
-      "-DEXTERNAL_LIBXC=${lib.getDev libxc}"
+        "-DFDE=ON"
-      (lib.strings.cmakeBool "DMRG" enableQcmaquis)
+        "-DEXTERNAL_LIBXC=${lib.getDev libxc}"
-      (lib.strings.cmakeBool "NEVPT2" enableQcmaquis)
+        ${lib.strings.cmakeBool "DMRG" enableQcmaquis}
-      "-DCMAKE_SKIP_BUILD_RPATH=ON"
+        ${lib.strings.cmakeBool "NEVPT2" enableQcmaquis}
-      (lib.strings.cmakeBool "BUILD_STATIC_LIBS" stdenv.hostPlatform.isStatic)
+        "-DCMAKE_SKIP_BUILD_RPATH=ON"
-      (lib.strings.cmakeBool "BUILD_SHARED_LIBS" (!stdenv.hostPlatform.isStatic))
+        ${lib.strings.cmakeBool "BUILD_STATIC_LIBS" stdenv.hostPlatform.isStatic}
-    ]
+        ${lib.strings.cmakeBool "BUILD_SHARED_LIBS" (!stdenv.hostPlatform.isStatic)}
-    ++ lib.optionals (blas-ilp64.passthru.implementation == "openblas") [
+        "-DLINALG=Manual"
-      "-DOPENBLASROOT=${blas-ilp64.passthru.provider.dev}"
+        "-DLINALG_LIBRARIES=-lblas -llapack"
-      "-DLINALG=OpenBLAS"
+        ${lib.strings.cmakeBool "DGA" enableMpi}
-    ]
+        ${lib.strings.cmakeBool "MPI" enableMpi}
-    ++ lib.optionals (blas-ilp64.passthru.implementation == "mkl") [
+      )
-      "-DMKLROOT=${blas-ilp64.passthru.provider}"
+    ''
-      "-DLINALG=MKL"
+    + lib.optionalString enableMpi ''
-    ]
+      export GAROOT=${globalarrays};
-    ++ lib.optionals enableMpi [
+    '';
-      "-DGA=ON"
-      "-DMPI=ON"
-    ];
-
-  preConfigure = lib.optionalString enableMpi ''
-    export GAROOT=${globalarrays};
-  '';
 
+  # The Makefile will install pymolcas during the build grrr.
   postConfigure = ''
-    # The Makefile will install pymolcas during the build grrr.
     mkdir -p $out/bin
     export PATH=$PATH:$out/bin
   '';
@@ -158,8 +162,8 @@ stdenv.mkDerivation rec {
   # removed by autopatchelf
   noAuditTmpdir = true;
 
+  # Wrong store path in shebang (bare Python, no Python pkgs), force manual re-patching
   postFixup = ''
-    # Wrong store path in shebang (bare Python, no Python pkgs), force manual re-patching
     for exe in $(find $out/bin/ -type f -name "*.py"); do
       sed -i "1s:.*:#!${python}/bin/python:" "$exe"
     done

pkgs/by-name/op/openmolcas/qcmaquis.patch

@@ -45,3 +45,58 @@ index 5fd1ef207..8d2957c6e 100644
                         SOURCE_SUBDIR dmrg
                         CMAKE_ARGS ${EP_CMAKE_ARGS}
                         CMAKE_CACHE_ARGS ${EP_CMAKE_CACHE_ARGS}
+diff --git a/cmake/custom/qcmaquis.cmake b/cmake/custom/qcmaquis.cmake
+index 5fd1ef207..4291ec3d7 100644
+--- a/cmake/custom/qcmaquis.cmake
++++ b/cmake/custom/qcmaquis.cmake
+@@ -94,47 +94,9 @@ if (NOT MAQUIS_DMRG_FOUND) # Does the opposite work?
+     )
+   endif (BOOST_ROOT)
+
+-  if (LINALG STREQUAL "Manual")
+-    target_files (LINALG_LIBRARIES_FILES ${LINALG_LIBRARIES})
+-    list (APPEND LINALG_LIBRARIES_FILES ${CMAKE_Fortran_IMPLICIT_LINK_LIBRARIES})
+-    string (REPLACE ";" '\' LINALG_LIBRARIES_FILES "${LINALG_LIBRARIES_FILES}")
+-    list (APPEND QCMaquisCMakeArgs
+-          "-DBLAS_LAPACK_SELECTOR=manual"
+-          "-DMAQUISLapack_LIBRARIES=${LINALG_LIBRARIES_FILES}"
+-    )
+-  elseif (LINALG STREQUAL "MKL")
+-    list (APPEND QCMaquisCMakeArgs
+-          "-DBLAS_LAPACK_SELECTOR=mkl_sequential"
+-    )
+-  elseif (LINALG STREQUAL "OpenBLAS")
+-    list (APPEND QCMaquisCMakeArgs
+-          "-DBLAS_LAPACK_SELECTOR=openblas"
+-          "-DOPENBLASROOT=${OPENBLASROOT}"
+-    )
+-  elseif (LINALG STREQUAL "Accelerate")
+-    list (APPEND QCMaquisCMakeArgs
+-          "-DBLAS_LAPACK_SELECTOR:STRING=veclib"
+-    )
+-  elseif (LINALG STREQUAL "Internal")
+-
+-    # To link QCMaquis with Fortran static libraries, we
+-    # need to add -lgfortran for gfortran
+-    # It seems that ${CMAKE_Fortran_IMPLICIT_LINK_LIBRARIES}
+-    # is not suited for this because it contains also other unnecessary libraries
+-
+-    # for some reason, the list does not work if the generator expression -lgfortran is not first
+-    # but for correct linking it needs to be last AND with a prepended "-l"
+-    if (CMAKE_Fortran_COMPILER_ID STREQUAL "GNU")
+-      set (Fortran_RUNTIME_LIBRARY "gfortran")
+-    endif ()
+-
+-    list (APPEND QCMaquisCMakeArgs
+-          "-DBLAS_LAPACK_SELECTOR=manual"
+-          "-DMAQUISLapack_LIBRARIES=$<$<BOOL:Fortran_RUNTIME_LIBRARY>:${Fortran_RUNTIME_LIBRARY}\ >$<TARGET_FILE:blas>\ $<TARGET_FILE:lapack>\ $<TARGET_FILE:blas>\ -l$<$<BOOL:Fortran_RUNTIME_LIBRARY>:${Fortran_RUNTIME_LIBRARY}>"
+-    )
+-  else ()
+-    message (FATAL_ERROR "LINALG=${LINALG} is not supported by QCMaquis")
+-  endif ()
++  list (APPEND QCMaquisCMakeArgs
++        "-DBLAS_LAPACK_SELECTOR=auto"
++  )
+
+   # Enabling source changes to keep ExternalProject happy
+   set (CMAKE_DISABLE_SOURCE_CHANGES OFF

pkgs/by-name/sp/speed-cloudflare-cli/package.nix

@@ -0,0 +1,38 @@
+{
+  lib,
+  fetchFromGitHub,
+  stdenv,
+  nodejs,
+}:
+stdenv.mkDerivation {
+  pname = "speed-cloudflare-cli";
+  version = "2.0.3-unstable-2024-05-15";
+
+  src = fetchFromGitHub {
+    owner = "KNawm";
+    repo = "speed-cloudflare-cli";
+    rev = "dd301195e7def359a39cceeba16b1c0bedac8f5d";
+    sha256 = "sha256-kxLeQUdJbkmApf5Af3Mgd3WvS3GhXXOIvA4gNB55TGM=";
+  };
+
+  nativeBuildInputs = [ nodejs ];
+
+  installPhase = ''
+    mkdir -p $out/bin
+
+    install -Dm755 $src/cli.js $out/bin/speed-cloudflare-cli
+    install -Dm644 $src/chalk.js $out/bin/chalk.js
+    install -Dm644 $src/stats.js $out/bin/stats.js
+
+    patchShebangs $out/bin/speed-cloudflare-cli
+  '';
+
+  meta = {
+    description = "Measure the speed and consistency of your internet connection using speed.cloudflare.com";
+    homepage = "https://github.com/KNawm/speed-cloudflare-cli";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ TheColorman ];
+    mainProgram = "speed-cloudflare-cli";
+    inherit (nodejs.meta) platforms;
+  };
+}

pkgs/by-name/sp/spider/package.nix

@@ -14,17 +14,17 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "spider";
-  version = "2.36.2";
+  version = "2.36.34";
 
   src = fetchFromGitHub {
     owner = "spider-rs";
     repo = "spider";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-Os94Q8RDaKc3jzir63nZ8dWgPwPZHxnvOZg2l/4v5EE=";
+    hash = "sha256-gdjXTIUeVMjjRq/MfYuvISVt9lFXfIewF6oZ/a46mUE=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-v5zz9WLj2aLRUHJScVSFzoQhyOqExkN03j3N47f3lgA=";
+  cargoHash = "sha256-gb+WwxiPBoX2QUuRNmOq1J/q0TnmFvmimBAhZ4+It+E=";
 
   nativeBuildInputs = [
     pkg-config

pkgs/by-name/su/subfont/package.nix

@@ -0,0 +1,42 @@
+{
+  lib,
+  buildNpmPackage,
+  fetchurl,
+  testers,
+}:
+
+let
+  pname = "subfont";
+  version = "7.2.1";
+  src = fetchurl {
+    url = "https://registry.npmjs.org/subfont/-/subfont-${version}.tgz";
+    hash = "sha256-8zfMO/3zEKkLI7nZShVpaJxxueM8amdsiIEGmcebLgQ=";
+  };
+in
+buildNpmPackage (finalAttrs: {
+  inherit pname version src;
+
+  npmDepsHash = "sha256-vqsm8/1I1HFo9IZdOqGQ/qFEyLTYY5uwtsnp1PJfPIk=";
+
+  postPatch = ''
+    ln -s ${./package-lock.json} package-lock.json
+  '';
+
+  dontNpmBuild = true;
+
+  env.PUPPETEER_SKIP_DOWNLOAD = true;
+
+  passthru.tests.version = testers.testVersion {
+    inherit version;
+    package = finalAttrs.finalPackage;
+  };
+
+  meta = {
+    description = "Command line tool to optimize webfont loading by aggressively subsetting based on font use, self-hosting of Google fonts and preloading";
+    mainProgram = "subfont";
+    homepage = "https://github.com/Munter/subfont";
+    changelog = "https://github.com/Munter/subfont/blob/v${version}/CHANGELOG.md";
+    license = with lib.licenses; [ mit ];
+    maintainers = with lib.maintainers; [ dav-wolff ];
+  };
+})

pkgs/by-name/te/textcompare/package.nix

@@ -0,0 +1,60 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  desktop-file-utils,
+  gjs,
+  gobject-introspection,
+  gtksourceview5,
+  gtk4,
+  libadwaita,
+  meson,
+  ninja,
+  wrapGAppsHook4,
+  nix-update-script,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "textcompare";
+  version = "0.1.2";
+
+  src = fetchFromGitHub {
+    owner = "josephmawa";
+    repo = "TextCompare";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-npF2kCYeW/RGaS7x2FrHEX3BdmO8CXj47biOw9IZ4nk=";
+  };
+
+  strictDeps = true;
+
+  nativeBuildInputs = [
+    desktop-file-utils
+    gjs
+    gobject-introspection
+    gtk4
+    meson
+    ninja
+    wrapGAppsHook4
+  ];
+
+  buildInputs = [
+    gjs
+    gtksourceview5
+    libadwaita
+  ];
+
+  preFixup = ''
+    sed -i "1 a imports.package._findEffectiveEntryPointName = () => 'io.github.josephmawa.TextCompare';" $out/bin/io.github.josephmawa.TextCompare
+  '';
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "Simple desktop app to compare old and new text";
+    homepage = "https://github.com/josephmawa/TextCompare";
+    license = lib.licenses.gpl3Plus;
+    maintainers = with lib.maintainers; [ iamanaws ];
+    mainProgram = "io.github.josephmawa.TextCompare";
+    platforms = lib.lists.intersectLists lib.platforms.linux gjs.meta.platforms;
+  };
+})

pkgs/by-name/to/tor-browser/package.nix

@@ -109,7 +109,7 @@ lib.warnIf (useHardenedMalloc != null)
         ++ lib.optionals mediaSupport [ ffmpeg ]
       );
 
-      version = "14.0.9";
+      version = "14.5";
 
       sources = {
         x86_64-linux = fetchurl {
@@ -119,7 +119,7 @@ lib.warnIf (useHardenedMalloc != null)
             "https://tor.eff.org/dist/torbrowser/${version}/tor-browser-linux-x86_64-${version}.tar.xz"
             "https://tor.calyxinstitute.org/dist/torbrowser/${version}/tor-browser-linux-x86_64-${version}.tar.xz"
           ];
-          hash = "sha256-oTOTTB5tuAhzaQY3nlSUD4lZNHAGmURIf5XCzFB2xeg=";
+          hash = "sha256-wSxmNPPJsLRjDVimc2Rp1rBcIgYp/CtPKuU6+gZfVmw=";
         };
 
         i686-linux = fetchurl {
@@ -129,7 +129,7 @@ lib.warnIf (useHardenedMalloc != null)
             "https://tor.eff.org/dist/torbrowser/${version}/tor-browser-linux-i686-${version}.tar.xz"
             "https://tor.calyxinstitute.org/dist/torbrowser/${version}/tor-browser-linux-i686-${version}.tar.xz"
           ];
-          hash = "sha256-Z/CDaO5eEPVwBnm3SJxBYvInyB7Oy6Ve8hNJunTJET0=";
+          hash = "sha256-upqpWUl5qmDj7Oc/wIGdNlgIJSaTbhxlq4X+zjCPHfA=";
         };
       };
 
@@ -291,7 +291,7 @@ lib.warnIf (useHardenedMalloc != null)
         # FONTCONFIG_FILE is required to make fontconfig read the TBB
         # fonts.conf; upstream uses FONTCONFIG_PATH, but FC_DEBUG=1024
         # indicates the system fonts.conf being used instead.
-        FONTCONFIG_FILE=$TBB_IN_STORE/fontconfig/fonts.conf
+        FONTCONFIG_FILE=$TBB_IN_STORE/fonts/fonts.conf
         substituteInPlace "$FONTCONFIG_FILE" \
           --replace-fail '<dir prefix="cwd">fonts</dir>' "<dir>$TBB_IN_STORE/fonts</dir>"
 

pkgs/by-name/tw/twitch-dl/package.nix

@@ -5,6 +5,7 @@
   installShellFiles,
   scdoc,
   ffmpeg,
+  writableTmpDirAsHomeHook,
 }:
 
 python3Packages.buildPythonApplication rec {
@@ -38,6 +39,7 @@ python3Packages.buildPythonApplication rec {
 
   nativeCheckInputs = [
     python3Packages.pytestCheckHook
+    writableTmpDirAsHomeHook
   ];
 
   disabledTestPaths = [
@@ -72,10 +74,6 @@ python3Packages.buildPythonApplication rec {
     installManPage twitch-dl.1
   '';
 
-  preInstallCheck = ''
-    export HOME="$(mktemp -d)"
-  '';
-
   meta = with lib; {
     description = "CLI tool for downloading videos from Twitch";
     homepage = "https://github.com/ihabunek/twitch-dl";

pkgs/by-name/ty/typst/package.nix

@@ -7,6 +7,7 @@
   openssl,
   nix-update-script,
   versionCheckHook,
+  callPackage,
 }:
 
 rustPlatform.buildRustPackage (finalAttrs: {
@@ -56,7 +57,11 @@ rustPlatform.buildRustPackage (finalAttrs: {
   nativeInstallCheckInputs = [ versionCheckHook ];
   versionCheckProgramArg = "--version";
 
-  passthru.updateScript = nix-update-script { };
+  passthru = {
+    updateScript = nix-update-script { };
+    packages = callPackage ./typst-packages.nix { };
+    withPackages = callPackage ./with-packages.nix { };
+  };
 
   meta = {
     changelog = "https://github.com/typst/typst/releases/tag/v${finalAttrs.version}";

pkgs/by-name/ty/typst/typst-packages.nix

@@ -0,0 +1,52 @@
+{
+  lib,
+  callPackage,
+}:
+
+let
+  toPackageName = name: version: "${name}_${lib.replaceStrings [ "." ] [ "_" ] version}";
+in
+lib.makeExtensible (
+  final:
+  lib.recurseIntoAttrs (
+    lib.foldlAttrs (
+      packageSet: pname: versionSet:
+      packageSet
+      // (lib.foldlAttrs (
+        subPackageSet: version: packageSpec:
+        subPackageSet
+        // {
+          ${toPackageName pname version} = callPackage (
+            {
+              lib,
+              buildTypstPackage,
+              fetchzip,
+            }:
+            buildTypstPackage (finalAttrs: {
+              inherit pname version;
+
+              src = fetchzip {
+                inherit (packageSpec) hash;
+                url = "https://packages.typst.org/preview/${finalAttrs.pname}-${finalAttrs.version}.tar.gz";
+                stripRoot = false;
+              };
+
+              typstDeps = builtins.filter (x: x != null) (
+                lib.map (d: (lib.attrsets.attrByPath [ d ] null final)) packageSpec.typstDeps
+              );
+
+              meta = {
+                inherit (packageSpec) description;
+                maintainers = with lib.maintainers; [ cherrypiejam ];
+                license = lib.map (lib.flip lib.getAttr lib.licensesSpdx) packageSpec.license;
+              } // (if packageSpec ? "homepage" then { inherit (packageSpec) homepage; } else { });
+            })
+          ) { };
+        }
+      ) { } versionSet)
+      // {
+        ${pname} = final.${toPackageName pname (lib.last (lib.attrNames versionSet))};
+      }
+    ) { } (lib.importTOML ./typst-packages-from-universe.toml)
+  )
+)

pkgs/by-name/ty/typst/with-packages.nix

@@ -0,0 +1,33 @@
+{
+  lib,
+  buildEnv,
+  typstPackages,
+  makeBinaryWrapper,
+  typst,
+}:
+
+lib.makeOverridable (
+  { ... }@typstPkgs:
+  f:
+  buildEnv {
+    name = "${typst.name}-env";
+
+    paths = lib.foldl' (acc: p: acc ++ lib.singleton p ++ p.propagatedBuildInputs) [ ] (f typstPkgs);
+
+    pathsToLink = [ "/lib/typst-packages" ];
+
+    nativeBuildInputs = [ makeBinaryWrapper ];
+
+    postBuild = ''
+      export TYPST_LIB_DIR="$out/lib/typst/packages"
+      mkdir -p $TYPST_LIB_DIR
+
+      mv $out/lib/typst-packages $TYPST_LIB_DIR/preview
+
+      cp -r ${typst}/share $out/share
+      mkdir -p $out/bin
+
+      makeWrapper "${lib.getExe typst}" "$out/bin/typst" --set TYPST_PACKAGE_CACHE_PATH $TYPST_LIB_DIR
+    '';
+  }
+) typstPackages

pkgs/by-name/ve/versatiles/package.nix

@@ -6,17 +6,17 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "versatiles";
-  version = "0.15.4"; # When updating: Replace with current version
+  version = "0.15.5"; # When updating: Replace with current version
 
   src = fetchFromGitHub {
     owner = "versatiles-org";
     repo = "versatiles-rs";
     tag = "v${version}"; # When updating: Replace with long commit hash of new version
-    hash = "sha256-C9LTfRi6FRRg4yUIbs1DMtOtILTO/ItjWGnuKwUSHeU="; # When updating: Use `lib.fakeHash` for recomputing the hash once. Run: 'nix-build -A versatiles'. Swap with new hash and proceed.
+    hash = "sha256-j50KZBYNzO9YNq6Nu3hozBmR2+KHbpCZuowSWMZ4yk4="; # When updating: Use `lib.fakeHash` for recomputing the hash once. Run: 'nix-build -A versatiles'. Swap with new hash and proceed.
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-B9QCkAjyak2rX3waMG74KBbBVKn2veliMl7tAS41HQQ="; # When updating: Same as above
+  cargoHash = "sha256-SmN/E7vvf9aoopOyigiZJoYBp1mADter4gCwI/tsG0Q="; # When updating: Same as above
 
   __darwinAllowLocalNetworking = true;
 

pkgs/by-name/vg/vgmstream/package.nix

@@ -1,6 +1,7 @@
 {
   stdenv,
   lib,
+  fetchzip,
   fetchFromGitHub,
   cmake,
   pkg-config,
@@ -10,10 +11,8 @@
   ffmpeg,
   libvorbis,
   libao,
-  jansson,
   speex,
   nix-update-script,
-  buildAudaciousPlugin ? false, # only build cli by default, pkgs.audacious-plugins sets this to enable plugin support
 }:
 
 stdenv.mkDerivation rec {
@@ -27,6 +26,24 @@ stdenv.mkDerivation rec {
     hash = "sha256-TmaWC04XbtFfBYhmTO4ouh3NoByio1BCpDJGJy3r0NY=";
   };
 
+  # https://github.com/vgmstream/vgmstream/blob/1b6a7915bf98ca14a71a0d44bef7a2c6a75c686d/cmake/dependencies/atrac9.cmake
+  atrac9-src = fetchFromGitHub {
+    owner = "Thealexbarney";
+    repo = "LibAtrac9";
+    rev = "6a9e00f6c7abd74d037fd210b6670d3cdb313049";
+    hash = "sha256-n47CzIbh8NxJ4GzKLjZQeS27k2lGx08trC1m4AOzVZc=";
+  };
+
+  # https://github.com/vgmstream/vgmstream/blob/1b6a7915bf98ca14a71a0d44bef7a2c6a75c686d/cmake/dependencies/celt.cmake
+  celt-0_6_1-src = fetchzip {
+    url = "https://downloads.xiph.org/releases/celt/celt-0.6.1.tar.gz";
+    hash = "sha256-DI1z10mTDQOn/R1FssaegmOa6ZNx3bXNiWHwLnytJWw=";
+  };
+  celt-0_11_0-src = fetchzip {
+    url = "https://downloads.xiph.org/releases/celt/celt-0.11.0.tar.gz";
+    hash = "sha256-JI3b44iCxQ29bqJGNH/L18pEuWiTFZ2132ceaqe8U0E=";
+  };
+
   passthru.updateScript = nix-update-script {
     attrPath = "vgmstream";
     extraArgs = [
@@ -35,35 +52,56 @@ stdenv.mkDerivation rec {
     ];
   };
 
+  outputs = [
+    "out"
+    "audacious"
+  ];
+
   nativeBuildInputs = [
     cmake
     pkg-config
-  ] ++ lib.optional buildAudaciousPlugin gtk3;
+    gtk3
+  ];
 
   buildInputs = [
     mpg123
     ffmpeg
     libvorbis
     libao
-    jansson
     speex
-  ] ++ lib.optional buildAudaciousPlugin audacious-bare;
+    audacious-bare
+  ];
 
-  preConfigure = ''
+  preConfigure =
-    substituteInPlace cmake/dependencies/audacious.cmake \
+    ''
-      --replace "pkg_get_variable(AUDACIOUS_PLUGIN_DIR audacious plugin_dir)" "set(AUDACIOUS_PLUGIN_DIR \"$out/lib/audacious\")"
+      substituteInPlace cmake/dependencies/audacious.cmake \
-  '';
+        --replace-fail "pkg_get_variable(AUDACIOUS_PLUGIN_DIR audacious plugin_dir)" "set(AUDACIOUS_PLUGIN_DIR \"$audacious/lib/audacious\")"
+    ''
+    +
+      # cmake/dependencies/celt.cmake uses configure_file to modify ${CELT_0110_PATH}/libcelt/ecintrin.h.
+      # Therefore, CELT_0110_PATH needs to point to a mutable directory.
+      ''
+        mkdir -p dependencies/celt-0.11.0/
+        cp -r ${celt-0_11_0-src}/* dependencies/celt-0.11.0/
+        chmod -R +w dependencies/celt-0.11.0/
+      '';
 
   cmakeFlags = [
-    # It always tries to download it, no option to use the system one
+    "-DATRAC9_PATH=${atrac9-src}"
-    "-DUSE_CELT=OFF"
+    "-DCELT_0061_PATH=${celt-0_6_1-src}"
-  ] ++ lib.optional (!buildAudaciousPlugin) "-DBUILD_AUDACIOUS=OFF";
+    "-DCELT_0110_PATH=../dependencies/celt-0.11.0"
+    # libg719_decode omitted because it doesn't have a free software license
+  ];
 
   meta = with lib; {
     description = "Library for playback of various streamed audio formats used in video games";
     homepage = "https://vgmstream.org";
     maintainers = with maintainers; [ zane ];
-    license = with licenses; isc;
+    license = with licenses; [
+      isc # vgmstream itself
+      mit # atrac9
+      bsd2 # celt
+    ];
     platforms = with platforms; unix;
   };
 }

pkgs/by-name/wa/wasmtime/package.nix

@@ -1,14 +1,12 @@
 {
   lib,
-  rustPlatform,
-  cmake,
-  fetchFromGitHub,
-  Security,
   stdenv,
+  rustPlatform,
+  fetchFromGitHub,
+  cmake,
+  versionCheckHook,
+  nix-update-script,
 }:
-let
-  inherit (stdenv.targetPlatform.rust) cargoShortTarget;
-in
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "wasmtime";
   version = "31.0.0";
@@ -37,7 +35,6 @@ rustPlatform.buildRustPackage (finalAttrs: {
     "dev"
   ];
 
-  buildInputs = lib.optional stdenv.hostPlatform.isDarwin Security;
   nativeBuildInputs = [ cmake ];
 
   doCheck =
@@ -52,6 +49,9 @@ rustPlatform.buildRustPackage (finalAttrs: {
       !isAarch64;
 
   postInstall =
+    let
+      inherit (stdenv.targetPlatform.rust) cargoShortTarget;
+    in
     ''
       # move libs from out to dev
       install -d -m 0755 $dev/lib
@@ -74,6 +74,16 @@ rustPlatform.buildRustPackage (finalAttrs: {
         $dev/lib/libwasmtime.dylib
     '';
 
+  nativeInstallCheckInputs = [
+    versionCheckHook
+  ];
+  versionCheckProgramArg = "--version";
+  doInstallCheck = true;
+
+  passthru = {
+    updateScript = nix-update-script { };
+  };
+
   meta = {
     description = "Standalone JIT-style runtime for WebAssembly, using Cranelift";
     homepage = "https://wasmtime.dev/";

pkgs/by-name/yu/yuhaiin/package.nix

@@ -0,0 +1,50 @@
+{
+  lib,
+  buildGoModule,
+  fetchFromGitHub,
+  versionCheckHook,
+}:
+
+buildGoModule rec {
+  pname = "yuhaiin";
+  version = "0.3.8";
+
+  src = fetchFromGitHub {
+    owner = "yuhaiin";
+    repo = "yuhaiin";
+    tag = "v${version}";
+    hash = "sha256-9vrq2qKbBLObANzVWrP73BuhQdY0JSEdPci420lj3Fg=";
+  };
+
+  vendorHash = "sha256-FSm/oG0XkTqx93DrtVKoJAmIlkHNXEG20IanXuMxBgw=";
+
+  subPackages = [ "cmd/yuhaiin" ];
+
+  ldflags =
+    let
+      # https://github.com/yuhaiin/yuhaiin/blob/dbbcd93c3dce141a3323e03043d5d0eabe7252d1/makefile#L1
+      module = "github.com/Asutorufa/yuhaiin/internal";
+    in
+    [
+      "-s"
+      "-w"
+      "-X ${module}/version.Version=v${version}"
+      "-X ${module}/version.GitCommit=${src.rev}"
+      "-X ${module}/version.BuildDate=unknown"
+    ];
+
+  nativeCheckInputs = [
+    versionCheckHook
+  ];
+
+  versionCheckProgramArg = [ "--version" ];
+
+  meta = {
+    description = "Proxy kit for Linux/Windows/MacOS";
+    homepage = "https://github.com/yuhaiin/yuhaiin";
+    changelog = "https://github.com/yuhaiin/yuhaiin/releases/tag/v${version}";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ oluceps ];
+    mainProgram = "yuhaiin";
+  };
+}

pkgs/by-name/za/zashboard/package.nix

@@ -0,0 +1,57 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  pnpm_9,
+  nodejs,
+  nix-update-script,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "zashboard";
+  version = "1.77.0";
+
+  src = fetchFromGitHub {
+    owner = "Zephyruso";
+    repo = "zashboard";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-cjl8yrmx0mpaHRs3uNV6oqpi5/aO4LNsvIv+IPlQEjE=";
+  };
+
+  nativeBuildInputs = [
+    pnpm_9.configHook
+    nodejs
+  ];
+
+  pnpmDeps = pnpm_9.fetchDeps {
+    inherit (finalAttrs) pname version src;
+    hash = "sha256-7mptT9cPhxz1VMtAtU2Na99xLtAoGcUHC0ca87Dv5Ng=";
+  };
+
+  buildPhase = ''
+    runHook preBuild
+
+    pnpm run build
+
+    runHook postBuild
+  '';
+
+  installPhase = ''
+    runHook preInstall
+
+    cp -r dist $out
+
+    runHook postInstall
+  '';
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "Dashboard Using Clash API";
+    homepage = "https://github.com/Zephyruso/zashboard";
+    changelog = "https://github.com/Zephyruso/zashboard/releases/tag/v${finalAttrs.version}";
+    license = lib.licenses.mit;
+    platforms = lib.platforms.all;
+    maintainers = with lib.maintainers; [ emaryn ];
+  };
+})

pkgs/development/libraries/boost/1.88.nix

@@ -0,0 +1,19 @@
+{ callPackage, fetchurl, ... }@args:
+
+callPackage ./generic.nix (
+  args
+  // rec {
+    version = "1.88.0";
+
+    src = fetchurl {
+      urls = [
+        "mirror://sourceforge/boost/boost_${builtins.replaceStrings [ "." ] [ "_" ] version}.tar.bz2"
+        "https://boostorg.jfrog.io/artifactory/main/release/${version}/source/boost_${
+          builtins.replaceStrings [ "." ] [ "_" ] version
+        }.tar.bz2"
+      ];
+      # SHA256 from http://www.boost.org/users/history/version_1_88_0.html
+      sha256 = "46d9d2c06637b219270877c9e16155cbd015b6dc84349af064c088e9b5b12f7b";
+    };
+  }
+)

pkgs/development/libraries/boost/default.nix

@@ -29,4 +29,5 @@ in
   boost183 = makeBoost ./1.83.nix;
   boost186 = makeBoost ./1.86.nix;
   boost187 = makeBoost ./1.87.nix;
+  boost188 = makeBoost ./1.88.nix;
 }

pkgs/development/libraries/boost/generic.nix

@@ -165,8 +165,10 @@ stdenv.mkDerivation {
 
   patches =
     patches
-    ++ lib.optional stdenv.hostPlatform.isDarwin ./darwin-no-system-python.patch
+    ++ lib.optional (
-    ++ [ ./cmake-paths-173.patch ]
+      lib.versionOlder version "1.88" && stdenv.hostPlatform.isDarwin
+    ) ./darwin-no-system-python.patch
+    ++ lib.optional (lib.versionOlder version "1.88") ./cmake-paths-173.patch
     ++ lib.optional (version == "1.77.0") (fetchpatch {
       url = "https://github.com/boostorg/math/commit/7d482f6ebc356e6ec455ccb5f51a23971bf6ce5b.patch";
       relative = "include";
@@ -209,7 +211,10 @@ stdenv.mkDerivation {
         extraPrefix = "libs/python/";
       })
     ]
-    ++ lib.optional (lib.versionAtLeast version "1.81" && stdenv.cc.isClang) ./fix-clang-target.patch
+
+    ++ lib.optional (
+      lib.versionAtLeast version "1.81" && lib.versionOlder version "1.88" && stdenv.cc.isClang
+    ) ./fix-clang-target.patch
     ++ lib.optional (lib.versionAtLeast version "1.86" && lib.versionOlder version "1.87") [
       # Backport fix for NumPy 2 support.
       (fetchpatch {
@@ -220,7 +225,7 @@ stdenv.mkDerivation {
         hash = "sha256-0IHK55JSujYcwEVOuLkwOa/iPEkdAKQlwVWR42p/X2U=";
       })
     ]
-    ++ lib.optional (lib.versionAtLeast version "1.87") [
+    ++ lib.optional (version == "1.87.0") [
       # Fix operator<< for shared_ptr and intrusive_ptr
       # https://github.com/boostorg/smart_ptr/issues/115
       (fetchpatch {
@@ -298,7 +303,7 @@ stdenv.mkDerivation {
   # Fix compilation to 32-bit ARM with clang in downstream packages
   # https://github.com/ned14/outcome/pull/308
   # https://github.com/boostorg/json/pull/1064
-  postPatch = lib.optionalString (lib.versionAtLeast version "1.87") ''
+  postPatch = lib.optionalString (version == "1.87.0") ''
     substituteInPlace \
       boost/outcome/outcome_gdb.h \
       boost/outcome/experimental/status-code/status_code.hpp \

pkgs/development/python-modules/aider-chat/default.nix

@@ -124,7 +124,7 @@ let
     ];
   };
 
-  version = "0.82.0";
+  version = "0.82.1";
   aider-chat = buildPythonPackage {
     pname = "aider-chat";
     inherit version;
@@ -137,7 +137,7 @@ let
       owner = "Aider-AI";
       repo = "aider";
       tag = "v${version}";
-      hash = "sha256-UlPYUYAYDhPPgoIvEWRLYjCe3iQ2ltH5mT3GkX+IrGI=";
+      hash = "sha256-J9znZfPcg1cLINFOCSQ6mpr/slL/jQXqenyi3a++VVE=";
     };
 
     pythonRelaxDeps = true;

pkgs/development/python-modules/databricks-sdk/default.nix

@@ -21,14 +21,14 @@
 
 buildPythonPackage rec {
   pname = "databricks-sdk";
-  version = "0.49.0";
+  version = "0.50.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "databricks";
     repo = "databricks-sdk-py";
     tag = "v${version}";
-    hash = "sha256-lNP3ETmRK6sRx9mP2JuIe/OcBbCDEvipST2LUjycgjs=";
+    hash = "sha256-taC95lKQdGzygWAi7w1eKy2yDeX6V6YsGROHHstBTfo=";
   };
 
   build-system = [

pkgs/development/python-modules/minari/default.nix

@@ -22,6 +22,7 @@
   huggingface-hub,
   mktestdocs,
   pytest,
+  scikit-image,
 
   # tests
   jaxlib,
@@ -30,14 +31,14 @@
 
 buildPythonPackage rec {
   pname = "minari";
-  version = "0.5.2";
+  version = "0.5.3";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "Farama-Foundation";
     repo = "Minari";
     tag = "v${version}";
-    hash = "sha256-7iIM1WGQRmhUh8idP/vtLnAbBncK6ezMyTvSAKW/9FE=";
+    hash = "sha256-LvJwp2dZdGPazJPWQtrk+v7zaPjOlomBu5j9avVdCcA=";
   };
 
   build-system = [
@@ -69,6 +70,7 @@ buildPythonPackage rec {
       # gymnasium-robotics
       mktestdocs
       pytest
+      scikit-image
     ];
   };
 

pkgs/development/python-modules/pyngrok/default.nix

@@ -9,14 +9,14 @@
 
 buildPythonPackage rec {
   pname = "pyngrok";
-  version = "7.2.3";
+  version = "7.2.4";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-zjPIo7Lubn9yftHJm12slHb/4ZBeq2uKpQapy+XXHU4=";
+    hash = "sha256-67LsgBVc5+AOv5JHv9mjZ75xSFezUO180iZ7NADuXS0=";
   };
 
   build-system = [

pkgs/development/python-modules/pythonqwt/default.nix

@@ -18,14 +18,14 @@
 
 buildPythonPackage rec {
   pname = "pythonqwt";
-  version = "0.14.4";
+  version = "0.14.5";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "PlotPyStack";
     repo = "PythonQwt";
     tag = "v${version}";
-    hash = "sha256-ZlrnCsC/is4PPUbzaMfwWSHQSQ06ksb2b/dkU8VhtSU=";
+    hash = "sha256-VNeW5LOL/CM/RUrC5TUj6FnVlhmXaPRYjGPz8b01Tew=";
   };
 
   build-system = [

pkgs/development/python-modules/sentence-transformers/default.nix

@@ -26,14 +26,14 @@
 
 buildPythonPackage rec {
   pname = "sentence-transformers";
-  version = "4.0.2";
+  version = "4.1.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "UKPLab";
     repo = "sentence-transformers";
     tag = "v${version}";
-    hash = "sha256-sBTepBXSFyDX1zUu/iAj6PamCWhV8fjRbaFN7fBmOao=";
+    hash = "sha256-9Mg3+7Yxf195h4cUNLP/Z1PrauxanHJfS8OV2JIwRj4=";
   };
 
   build-system = [ setuptools ];

pkgs/development/python-modules/sixel/default.nix

@@ -0,0 +1,40 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  hatchling,
+  pillow,
+}:
+
+buildPythonPackage rec {
+  pname = "python-sixel";
+  version = "0.2.0";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "lubosz";
+    repo = "python-sixel";
+    tag = version;
+    hash = "sha256-ALNdwuZIMS2oWO42LpjgIpAxcQh4Gk35nCwenINLQ64=";
+  };
+
+  build-system = [
+    hatchling
+  ];
+
+  dependencies = [
+    pillow
+  ];
+
+  pythonImportsCheck = [
+    "sixel"
+  ];
+
+  meta = {
+    description = "Display images in the terminal";
+    homepage = "https://github.com/lubosz/python-sixel";
+    changelog = "https://github.com/lubosz/python-sixel/releases/tag/${version}";
+    license = lib.licenses.gpl3Only;
+    maintainers = with lib.maintainers; [ atemu ];
+  };
+}

pkgs/development/tools/infisical/default.nix

@@ -21,7 +21,7 @@ let
   buildHashes = builtins.fromJSON (builtins.readFile ./hashes.json);
 
   # the version of infisical
-  version = "0.36.23";
+  version = "0.40.0";
 
   # the platform-specific, statically linked binary
   src =

pkgs/development/tools/infisical/hashes.json

@@ -1,6 +1,6 @@
 { "_comment": "@generated by pkgs/development/tools/infisical/update.sh"
-, "x86_64-linux": "sha256-lUnvumfma4gBxbOzKBdjdSMRvCjgzzdRdisIB0c+U30="
+, "x86_64-linux": "sha256-c+QmBp8He5R0DnFLONMAs7+s4YeHZQrv4dyPoQEH7m0="
-, "x86_64-darwin": "sha256-wN8IWlbhMVMYj9jxtqOZksjinPCHrrAFjIV24cv5vNw="
+, "x86_64-darwin": "sha256-zpciZC97WTT9Ze9qmJI6QacHgHQgH0vEPqiY31cOE/k="
-, "aarch64-linux": "sha256-NPBgtEJ8pzxHG0D21EE0ngZAxbETAfJpmIoWp2BokPw="
+, "aarch64-linux": "sha256-SyAgYJ2EB5G+IbDp43q+nruWDwr7JlQcStiJjqy25XQ="
-, "aarch64-darwin": "sha256-wlfz6LOn2Ri5m1ID8kXnlFN/zzNgDpC4zUgiWziUUC0="
+, "aarch64-darwin": "sha256-GI0r8XMzsKp+AZrad4VRAXOyCFcIwHnaWabzKlK1OCI="
 }

pkgs/os-specific/linux/kernel/xanmod-kernels.nix

@@ -14,12 +14,12 @@ let
   # kernel config in the xanmod version commit
   variants = {
     lts = {
-      version = "6.12.21";
+      version = "6.12.23";
-      hash = "sha256-Zb/n+hLho94+6u5BHAmRYfit/kv1xlh/Tp39kI3kfjA=";
+      hash = "sha256-OBsKzXcFLwqidotHDmPwKFtBX9zRC7DoDR4hhWZUv/E=";
     };
     main = {
-      version = "6.13.9";
+      version = "6.13.11";
-      hash = "sha256-JRmyvlvU8NOQ4aLdZ2BmQWUnl1RGjcjucaWN4zVxQpg=";
+      hash = "sha256-hv93f1poaCmjdy2G39+T2crnYMS26FxD2Dn2hmTGZB8=";
     };
   };
 

pkgs/top-level/all-packages.nix

@@ -4046,8 +4046,6 @@ with pkgs;
 
   kronometer = libsForQt5.callPackage ../tools/misc/kronometer { };
 
-  kdiff3 = libsForQt5.callPackage ../tools/text/kdiff3 { };
-
   kwalletcli = libsForQt5.callPackage ../tools/security/kwalletcli { };
 
   peruse = libsForQt5.callPackage ../tools/misc/peruse { };
@@ -9025,6 +9023,7 @@ with pkgs;
     boost183
     boost186
     boost187
+    boost188
     ;
 
   boost = boost187;
@@ -16415,6 +16414,10 @@ with pkgs;
     inherit (darwin.apple_sdk.frameworks) Security;
   };
 
+  buildTypstPackage = callPackage ../build-support/build-typst-package.nix { };
+
+  typstPackages = typst.packages;
+
   ueberzug = with python3Packages; toPythonApplication ueberzug;
 
   ueberzugpp = callPackage ../by-name/ue/ueberzugpp/package.nix {
@@ -19423,10 +19426,6 @@ with pkgs;
     nanoizeNewlib = true;
   };
 
-  wasmtime = callPackage ../development/interpreters/wasmtime {
-    inherit (darwin.apple_sdk.frameworks) Security;
-  };
-
   wfuzz = with python3Packages; toPythonApplication wfuzz;
 
   kodelife = callPackage ../applications/graphics/kodelife {

pkgs/top-level/python-packages.nix

@@ -15822,6 +15822,8 @@ self: super: with self; {
 
   six = callPackage ../development/python-modules/six { };
 
+  sixel = callPackage ../development/python-modules/sixel { };
+
   sjcl = callPackage ../development/python-modules/sjcl { };
 
   skein = callPackage ../development/python-modules/skein { };