Merge master into staging-next

maintainers/scripts/kde/generate-sources.py

@@ -46,7 +46,7 @@ def to_sri(hash):
 
 @click.command
 @click.argument(
-    "set",
+    "pkgset",
     type=click.Choice(["frameworks", "gear", "plasma"]),
     required=True
 )
@@ -71,9 +71,9 @@ def to_sri(hash):
     type=str,
     default=None,
 )
-def main(set: str, version: str, nixpkgs: pathlib.Path, sources_url: str | None):
+def main(pkgset: str, version: str, nixpkgs: pathlib.Path, sources_url: str | None):
     root_dir = nixpkgs / "pkgs/kde"
-    set_dir = root_dir / set
+    set_dir = root_dir / pkgset
     generated_dir = root_dir / "generated"
     metadata = utils.KDERepoMetadata.from_json(generated_dir)
 
@@ -82,7 +82,7 @@ def main(set: str, version: str, nixpkgs: pathlib.Path, sources_url: str | None)
             "frameworks": f"frameworks/{version}/",
             "gear": f"release-service/{version}/src/",
             "plasma": f"plasma/{version}/",
-        }[set]
+        }[pkgset]
         sources_url = f"https://download.kde.org/stable/{set_url}"
 
     client = httpx.Client()
@@ -91,6 +91,7 @@ def main(set: str, version: str, nixpkgs: pathlib.Path, sources_url: str | None)
     bs = bs4.BeautifulSoup(sources.text, features="html.parser")
 
     results = {}
+    projects_to_update_rust = set()
     for item in bs.select("tr")[3:]:
         link = item.select_one("td:nth-child(2) a")
         if not link:
@@ -101,6 +102,9 @@ def main(set: str, version: str, nixpkgs: pathlib.Path, sources_url: str | None)
         if project_name not in metadata.projects_by_name:
             print(f"Warning: unknown tarball: {project_name}")
 
+        if project_name in PROJECTS_WITH_RUST:
+            projects_to_update_rust.add(project_name)
+
         if version_and_ext.endswith(".sig"):
             continue
 
@@ -126,19 +130,8 @@ def main(set: str, version: str, nixpkgs: pathlib.Path, sources_url: str | None)
         pkg_dir = set_dir / project_name
         pkg_file = pkg_dir / "default.nix"
 
-        if project_name in PROJECTS_WITH_RUST:
-            print(f"Updating cargoDeps hash for {set}/{project_name}...")
-            subprocess.run([
-                "nix-update",
-                f"kdePackages.{project_name}",
-                "--version",
-                "skip",
-                "--override-filename",
-                pkg_file
-            ])
-
         if not pkg_file.exists():
-            print(f"Generated new package: {set}/{project_name}")
+            print(f"Generated new package: {pkgset}/{project_name}")
             pkg_dir.mkdir(parents=True, exist_ok=True)
             with pkg_file.open("w") as fd:
                 fd.write(LEAF_TEMPLATE.render(pname=project_name) + "\n")
@@ -149,9 +142,20 @@ def main(set: str, version: str, nixpkgs: pathlib.Path, sources_url: str | None)
 
     sources_dir = generated_dir / "sources"
     sources_dir.mkdir(parents=True, exist_ok=True)
-    with (sources_dir / f"{set}.json").open("w") as fd:
+    with (sources_dir / f"{pkgset}.json").open("w") as fd:
         json.dump(results, fd, indent=2)
 
+    for project_name in projects_to_update_rust:
+            print(f"Updating cargoDeps hash for {pkgset}/{project_name}...")
+            subprocess.run([
+                "nix-update",
+                f"kdePackages.{project_name}",
+                "--version",
+                "skip",
+                "--override-filename",
+                pkg_file
+            ])
+
 
 if __name__ == "__main__":
     main()  # type: ignore

nixos/modules/services/misc/evremap.nix

@@ -131,9 +131,9 @@ in
       description = "evremap - keyboard input remapper";
       wantedBy = [ "multi-user.target" ];
 
-      script = "${lib.getExe pkgs.evremap} remap ${configFile}";
-
       serviceConfig = {
+        ExecStart = "${lib.getExe pkgs.evremap} remap ${configFile}";
+
         DynamicUser = true;
         User = "evremap";
         SupplementaryGroups = [

nixos/modules/services/networking/ntp/ntpd-rs.nix

@@ -63,7 +63,7 @@ in
       };
       source = lib.mkIf cfg.useNetworkingTimeServers (
         map (ts: {
-          mode = "server";
+          mode = if lib.strings.hasInfix "pool" ts then "pool" else "server";
           address = ts;
         }) config.networking.timeServers
       );

nixos/modules/services/web-apps/glance.nix

@@ -8,15 +8,27 @@ let
   cfg = config.services.glance;
 
   inherit (lib)
-    mkEnableOption
-    mkPackageOption
-    mkOption
-    mkIf
+    catAttrs
+    concatMapStrings
     getExe
+    mkEnableOption
+    mkIf
+    mkOption
+    mkPackageOption
     types
     ;
 
+  inherit (builtins)
+    concatLists
+    isAttrs
+    isList
+    attrNames
+    getAttr
+    ;
+
   settingsFormat = pkgs.formats.yaml { };
+  settingsFile = settingsFormat.generate "glance.yaml" cfg.settings;
+  mergedSettingsFile = "/run/glance/glance.yaml";
 in
 {
   options.services.glance = {
@@ -69,7 +81,9 @@ in
                       { type = "calendar"; }
                       {
                         type = "weather";
-                        location = "Nivelles, Belgium";
+                        location = {
+                          _secret = "/var/lib/secrets/glance/location";
+                        };
                       }
                     ];
                   }
@@ -84,6 +98,13 @@ in
         Configuration written to a yaml file that is read by glance. See
         <https://github.com/glanceapp/glance/blob/main/docs/configuration.md>
         for more.
+
+        Settings containing secret data should be set to an
+        attribute set containing the attribute
+        <literal>_secret</literal> - a string pointing to a file
+        containing the value the option should be set to. See the
+        example in `services.glance.settings.pages` at the weather widget
+        with a location secret to get a better picture of this.
       '';
     };
 
@@ -102,13 +123,41 @@ in
       description = "Glance feed dashboard server";
       wantedBy = [ "multi-user.target" ];
       after = [ "network.target" ];
+      path = [ pkgs.replace-secret ];
 
       serviceConfig = {
-        ExecStart =
+        ExecStartPre =
           let
-            glance-yaml = settingsFormat.generate "glance.yaml" cfg.settings;
+            findSecrets =
+              data:
+              if isAttrs data then
+                if data ? _secret then
+                  [ data ]
+                else
+                  concatLists (map (attr: findSecrets (getAttr attr data)) (attrNames data))
+              else if isList data then
+                concatLists (map findSecrets data)
+              else
+                [ ];
+            secretPaths = catAttrs "_secret" (findSecrets cfg.settings);
+            mkSecretReplacement = secretPath: ''
+              replace-secret ${
+                lib.escapeShellArgs [
+                  "_secret: ${secretPath}"
+                  secretPath
+                  mergedSettingsFile
+                ]
+              }
+            '';
+            secretReplacements = concatMapStrings mkSecretReplacement secretPaths;
           in
-          "${getExe cfg.package} --config ${glance-yaml}";
+          # Use "+" to run as root because the secrets may not be accessible to glance
+          "+"
+          + pkgs.writeShellScript "glance-start-pre" ''
+            install -m 600 -o $USER ${settingsFile} ${mergedSettingsFile}
+            ${secretReplacements}
+          '';
+        ExecStart = "${getExe cfg.package} --config ${mergedSettingsFile}";
         WorkingDirectory = "/var/lib/glance";
         StateDirectory = "glance";
         RuntimeDirectory = "glance";

nixos/modules/services/web-apps/mastodon.nix

@@ -55,6 +55,9 @@ let
     // lib.optionalAttrs cfg.smtp.authenticate { SMTP_LOGIN = cfg.smtp.user; }
     // lib.optionalAttrs (cfg.elasticsearch.host != null) { ES_HOST = cfg.elasticsearch.host; }
     // lib.optionalAttrs (cfg.elasticsearch.host != null) { ES_PORT = toString cfg.elasticsearch.port; }
+    // lib.optionalAttrs (cfg.elasticsearch.host != null && cfg.elasticsearch.prefix != null) {
+      ES_PREFIX = cfg.elasticsearch.prefix;
+    }
     // lib.optionalAttrs (cfg.elasticsearch.host != null) { ES_PRESET = cfg.elasticsearch.preset; }
     // lib.optionalAttrs (cfg.elasticsearch.user != null) { ES_USER = cfg.elasticsearch.user; }
     // cfg.extraConfig;
@@ -670,6 +673,16 @@ in
           default = 9200;
         };
 
+        prefix = lib.mkOption {
+          description = ''
+            If provided, adds a prefix to indexes in Elasticsearch. This allows to use the same
+            Elasticsearch cluster between different projects or Mastodon servers.
+          '';
+          type = lib.types.nullOr lib.types.str;
+          default = null;
+          example = "mastodon";
+        };
+
         preset = lib.mkOption {
           description = ''
             It controls the ElasticSearch indices configuration (number of shards and replica).

nixos/modules/services/x11/desktop-managers/gnome.nix

@@ -288,6 +288,7 @@ in
       hardware.bluetooth.enable = mkDefault true;
       programs.dconf.enable = true;
       security.polkit.enable = true;
+      security.rtkit.enable = mkDefault true;
       services.accounts-daemon.enable = true;
       services.dleyna.enable = mkDefault true;
       services.power-profiles-daemon.enable = mkDefault true;

nixos/modules/services/x11/display-managers/gdm.nix

@@ -206,7 +206,7 @@ in
       ];
 
     # Otherwise GDM will not be able to start correctly and display Wayland sessions
-    systemd.packages = with pkgs.gnome; [
+    systemd.packages = [
       gdm
       pkgs.gnome-session
       pkgs.gnome-shell

nixos/tests/all-tests.nix

@@ -1296,7 +1296,7 @@ in
   systemd-initrd-luks-unl0kr = handleTest ./systemd-initrd-luks-unl0kr.nix { };
   systemd-initrd-modprobe = handleTest ./systemd-initrd-modprobe.nix { };
   systemd-initrd-shutdown = handleTest ./systemd-shutdown.nix { systemdStage1 = true; };
-  systemd-initrd-simple = handleTest ./systemd-initrd-simple.nix { };
+  systemd-initrd-simple = runTest ./systemd-initrd-simple.nix;
   systemd-initrd-swraid = handleTest ./systemd-initrd-swraid.nix { };
   systemd-initrd-vconsole = handleTest ./systemd-initrd-vconsole.nix { };
   systemd-initrd-networkd = handleTest ./systemd-initrd-networkd.nix { };

nixos/tests/glance.nix

@@ -5,19 +5,47 @@
 
   nodes = {
     machine_default =
-      { pkgs, ... }:
+      { ... }:
       {
         services.glance = {
           enable = true;
         };
       };
 
-    machine_custom_port =
+    machine_configured =
       { pkgs, ... }:
+      let
+        # Do not use this in production. This will make the secret world-readable
+        # in the Nix store
+        secrets.glance-location.path = builtins.toString (
+          pkgs.writeText "location-secret" "Nivelles, Belgium"
+        );
+      in
       {
         services.glance = {
           enable = true;
-          settings.server.port = 5678;
+          settings = {
+            server.port = 5678;
+            pages = [
+              {
+                name = "Home";
+                columns = [
+                  {
+                    size = "full";
+                    widgets = [
+                      { type = "calendar"; }
+                      {
+                        type = "weather";
+                        location = {
+                          _secret = secrets.glance-location.path;
+                        };
+                      }
+                    ];
+                  }
+                ];
+              }
+            ];
+          };
         };
       };
   };
@@ -25,23 +53,31 @@
   extraPythonPackages =
     p: with p; [
       beautifulsoup4
+      pyyaml
+      types-pyyaml
       types-beautifulsoup4
     ];
 
   testScript = ''
     from bs4 import BeautifulSoup
+    import yaml
 
     machine_default.start()
     machine_default.wait_for_unit("glance.service")
     machine_default.wait_for_open_port(8080)
 
-    machine_custom_port.start()
-    machine_custom_port.wait_for_unit("glance.service")
-    machine_custom_port.wait_for_open_port(5678)
+    machine_configured.start()
+    machine_configured.wait_for_unit("glance.service")
+    machine_configured.wait_for_open_port(5678)
 
     soup = BeautifulSoup(machine_default.succeed("curl http://localhost:8080"))
     expected_version = "v${config.nodes.machine_default.services.glance.package.version}"
     assert any(a.text == expected_version for a in soup.select(".footer a"))
+
+    yaml_contents = machine_configured.succeed("cat /run/glance/glance.yaml")
+    yaml_parsed = yaml.load(yaml_contents, Loader=yaml.FullLoader)
+    location = yaml_parsed["pages"][0]["columns"][0]["widgets"][1]["location"]
+    assert location == "Nivelles, Belgium"
   '';
 
   meta.maintainers = [ lib.maintainers.drupol ];

nixos/tests/ntpd-rs.nix

@@ -11,7 +11,7 @@ import ./make-test-python.nix (
       client = {
         services.ntpd-rs = {
           enable = true;
-          metrics.enable = true;
+          metrics.enable = false;
           useNetworkingTimeServers = false;
           settings = {
             source = [
@@ -27,11 +27,22 @@ import ./make-test-python.nix (
         };
       };
       server = {
-        networking.firewall.allowedUDPPorts = [ 123 ];
+        networking.firewall = {
+          allowedTCPPorts = [
+            9975
+          ];
+          allowedUDPPorts = [
+            123
+          ];
+        };
+
         services.ntpd-rs = {
           enable = true;
           metrics.enable = true;
           settings = {
+            observability = {
+              metrics-exporter-listen = "[::]:9975";
+            };
             server = [
               { listen = "[::]:123"; }
             ];
@@ -48,8 +59,19 @@ import ./make-test-python.nix (
         for machine in (server, client):
           machine.wait_for_unit('multi-user.target')
           machine.succeed('systemctl is-active ntpd-rs.service')
-          machine.succeed('systemctl is-active ntpd-rs-metrics.service')
-          machine.succeed('curl http://localhost:9975/metrics | grep ntp_uptime_seconds')
+
+        client.fail('systemctl is-active ntpd-rs-metrics.service')
+        server.succeed('systemctl is-active ntpd-rs-metrics.service')
+
+        server.wait_for_open_port(9975)
+        client.succeed('curl http://server:9975/metrics | grep ntp_uptime_seconds')
+        server.fail('curl --fail --connect-timeout 2 http://client:9975/metrics | grep ntp_uptime_seconds')
+
+        client.succeed("ntp-ctl status | grep server:123")
+        server.succeed("ntp-ctl status | grep '\[::\]:123'")
+
+        client.succeed("grep '^mode = \"server\"' $(systemctl status ntpd-rs | grep -oE '/nix/store[^ ]*ntpd-rs.toml')")
+        server.succeed("grep '^mode = \"pool\"' $(systemctl status ntpd-rs | grep -oE '/nix/store[^ ]*ntpd-rs.toml')")
       '';
   }
 )

nixos/tests/systemd-initrd-simple.nix

@@ -1,5 +1,3 @@
-import ./make-test-python.nix (
-  { lib, pkgs, ... }:
 {
   name = "systemd-initrd-simple";
 
@@ -11,7 +9,9 @@ import ./make-test-python.nix (
       virtualisation.fileSystems."/".autoResize = true;
     };
 
-    testScript = ''
+  testScript =
+    # python
+    ''
       import subprocess
 
       with subtest("testing initrd backdoor"):
@@ -50,6 +50,8 @@ import ./make-test-python.nix (
           newAvail = machine.succeed("df --output=avail / | sed 1d")
 
           assert int(oldAvail) < int(newAvail), "File system did not grow"
+
+      with subtest("no warnings from systemd about write permissions"):
+          machine.fail("journalctl -b 0 | grep 'is marked world-writable, which is a security risk as it is executed with privileges'")
     '';
 }
-)

pkgs/applications/misc/1password-gui/default.nix

@@ -26,8 +26,6 @@ let
   };
 
   meta = {
-    # Requires to be installed in "/Application" which is not possible for now (https://github.com/NixOS/nixpkgs/issues/254944)
-    broken = stdenv.hostPlatform.isDarwin;
     description = "Multi-platform password manager";
     homepage = "https://1password.com/";
     sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];

pkgs/applications/misc/1password-gui/sources.json

@@ -19,20 +19,20 @@
   },
   "beta": {
     "x86_64-linux": {
-      "url": "https://downloads.1password.com/linux/tar/beta/x86_64/1password-8.10.70-24.BETA.x64.tar.gz",
-      "hash": "sha256-XNub6kGh2QH2WQKh0Hj6IBVQENfe5YIaOtRV+pkuioc="
+      "url": "https://downloads.1password.com/linux/tar/beta/x86_64/1password-8.10.76-32.BETA.x64.tar.gz",
+      "hash": "sha256-149kU1CKQ0iLlD6O7jOjrcwwlxMdd5iAm53ILK2mv2o="
     },
     "aarch64-linux": {
-      "url": "https://downloads.1password.com/linux/tar/beta/aarch64/1password-8.10.70-24.BETA.arm64.tar.gz",
-      "hash": "sha256-wqpSPCGFiDioIzhUyVCEBfRval13mu0dMSs4oIt+RIU="
+      "url": "https://downloads.1password.com/linux/tar/beta/aarch64/1password-8.10.76-32.BETA.arm64.tar.gz",
+      "hash": "sha256-xHurzI8OcooSOCkQlSgtOH1Bgdur2oO1sNwKUOvSckA="
     },
     "x86_64-darwin": {
-      "url": "https://downloads.1password.com/mac/1Password-8.10.70-24.BETA-x86_64.zip",
-      "hash": "sha256-jzjXVh9iTua0/0N3lP4xIPVd1hDlsWssbTtDvvzoTZk="
+      "url": "https://downloads.1password.com/mac/1Password-8.10.76-32.BETA-x86_64.zip",
+      "hash": "sha256-LgDl5DLUdn4bSRXrx11QOv0J6VXyns+KQgbU/Y0JxDU="
     },
     "aarch64-darwin": {
-      "url": "https://downloads.1password.com/mac/1Password-8.10.70-24.BETA-aarch64.zip",
-      "hash": "sha256-qb1j9VMhI+tf643HCOz+5dhTuFAgd1ICv8lvRC+um+I="
+      "url": "https://downloads.1password.com/mac/1Password-8.10.76-32.BETA-aarch64.zip",
+      "hash": "sha256-mJFuejGiUKV0PEJF8ajiL3cMRQTRghoaCRyP8afatgY="
     }
   }
 }

pkgs/applications/misc/1password-gui/versions.json

@@ -1,6 +1,6 @@
 {
   "stable-linux": "8.10.75",
   "stable-darwin": "8.10.75",
-  "beta-linux":"8.10.70-24.BETA",
-  "beta-darwin": "8.10.70-24.BETA"
+  "beta-linux":"8.10.76-32.BETA",
+  "beta-darwin": "8.10.76-32.BETA"
 }

pkgs/build-support/kernel/make-initrd-ng/src/main.rs

@@ -212,7 +212,7 @@ fn copy_file<
         }
 
         // Remove writable permissions
-        permissions.set_mode(permissions.mode() ^ 0o222);
+        permissions.set_mode(permissions.mode() & 0o555);
         fs::set_permissions(&target, permissions)
             .wrap_err_with(|| format!("failed to remove writable permissions for {:?}", target))?;
     };

pkgs/build-support/make-hardcode-gsettings-patch/default.nix

@@ -27,6 +27,10 @@
     For example, `{ "org.gnome.evolution" = "EVOLUTION_SCHEMA_PATH"; }`
     hardcodes looking for `org.gnome.evolution` into `@EVOLUTION_SCHEMA_PATH@`.
 
+  - `schemaExistsFunction`: name of the function that is used for checking
+    if optional schema exists. Its invocation will be replaced with TRUE
+    for known schemas.
+
   - `patches`: A list of patches to apply before generating the patch.
 
   Example:
@@ -54,6 +58,7 @@
   src,
   patches ? [ ],
   schemaIdToVariableMapping,
+  schemaExistsFunction ? null,
 }:
 
 runCommand "hardcode-gsettings.patch"
@@ -71,6 +76,7 @@ runCommand "hardcode-gsettings.patch"
     patchPhase
     set -x
     cp ${builtins.toFile "glib-schema-to-var.json" (builtins.toJSON schemaIdToVariableMapping)} ./glib-schema-to-var.json
+    cp ${builtins.toFile "glib-schema-exists-function.json" (builtins.toJSON schemaExistsFunction)} ./glib-schema-exists-function.json
     git init
     git add -A
     spatch --sp-file "${./hardcode-gsettings.cocci}" --dir . --in-place

pkgs/build-support/make-hardcode-gsettings-patch/hardcode-gsettings.cocci

@@ -34,6 +34,17 @@ def get_schema_directory(schema_id):
         return f'"@{schema_to_var[schema_id]}@"'
     raise Exception(f"Unknown schema path {schema_id!r}, please add it to ./glib-schema-to-var.json")
 
+
+@script:python schema_exists_fn@
+fn;
+@@
+import json
+
+with open("./glib-schema-exists-function.json") as fn_file:
+    if (fn := json.load(fn_file)):
+        coccinelle.fn = fn
+
+
 @find_cpp_constants@
 identifier const_name;
 expression val;
@@ -143,3 +154,12 @@ fresh identifier SCHEMA_DIRECTORY = script:python(SCHEMA_ID) { get_schema_direct
 +   schema = g_settings_schema_source_lookup(schema_source, SCHEMA_ID, FALSE);
 +   settings = g_settings_new_full(schema, NULL, PATH);
 +}
+
+
+@replace_schema_exists_fns depends on ever record_cpp_constants || never record_cpp_constants@
+// We want to run after #define constants have been collected but even if there are no #defines.
+expression SCHEMA_ID;
+identifier schema_exists_fn.fn;
+@@
+-fn(SCHEMA_ID)
++true

pkgs/by-name/ch/chez/package.nix

@@ -22,11 +22,11 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "chez-scheme";
-  version = "10.1.0";
+  version = "10.2.0";
 
   src = fetchurl {
     url = "https://github.com/cisco/ChezScheme/releases/download/v${finalAttrs.version}/csv${finalAttrs.version}.tar.gz";
-    hash = "sha256-kYGmyMSrXl0y2Hn/FZ0zWlDU+LOIYRriKiY+kyw1OYs=";
+    hash = "sha256-t5WRbUz+1ZJAxfRLG1B6hlfv0o5i5y4TTQNIbp8+N0o=";
   };
 
   nativeBuildInputs =

pkgs/by-name/en/envoy-bin/package.nix

@@ -8,7 +8,7 @@
   versionCheckHook,
 }:
 let
-  version = "1.34.0";
+  version = "1.34.1";
   inherit (stdenv.hostPlatform) system;
   throwSystem = throw "envoy-bin is not available for ${system}.";
 
@@ -21,8 +21,8 @@ let
 
   hash =
     {
-      aarch64-linux = "sha256-VVEYQ25ZNmWftuhLOOZnxKaosQFeMHsQdkAzIq+zEM0=";
-      x86_64-linux = "sha256-FavpvY1hYNOnlFQE2NV3O8z9gyKGpD01oU/wute9iRA=";
+      aarch64-linux = "sha256-7v9KwHdQIF4dElsvTPxsJNnpxfLJk3TQ4tCgzwqsebs=";
+      x86_64-linux = "sha256-iCZNZRh2qa0oqn4Jjj34Q1cEBM9gts6WjESWykorbp0=";
     }
     .${system} or throwSystem;
 in

pkgs/by-name/fa/fastfetch/package.nix

@@ -38,6 +38,7 @@
   xorg,
   yyjson,
   zlib,
+  zfs,
   # Feature flags
   audioSupport ? true,
   brightnessSupport ? true,
@@ -54,6 +55,7 @@
   waylandSupport ? true,
   x11Support ? true,
   xfceSupport ? true,
+  zfsSupport ? false,
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "fastfetch";
@@ -175,6 +177,10 @@ stdenv.mkDerivation (finalAttrs: {
           #  Needed for XFWM theme and XFCE Terminal font.
           xfce.xfconf
         ]
+        ++ lib.optionals zfsSupport [
+          # Needed for zpool module
+          zfs
+        ]
       );
 
       macosDeps = lib.optionals stdenv.hostPlatform.isDarwin [
@@ -198,6 +204,8 @@ stdenv.mkDerivation (finalAttrs: {
       (lib.cmakeBool "ENABLE_CHAFA" imageSupport)
 
       (lib.cmakeBool "ENABLE_SQLITE3" sqliteSupport)
+
+      (lib.cmakeBool "ENABLE_LIBZFS" zfsSupport)
     ]
     ++ lib.optionals stdenv.hostPlatform.isLinux [
       (lib.cmakeBool "ENABLE_PULSE" audioSupport)
@@ -270,7 +278,7 @@ stdenv.mkDerivation (finalAttrs: {
     longDescription = ''
       Fast and highly customizable system info script.
 
-      Feature flags (all default to 'true' except rpmSupport and flashfetchSupport):
+      Feature flags (all default to 'true' except rpmSupport, flashfetchSupport and zfsSupport):
       * audioSupport: PulseAudio functionality
       * brightnessSupport: External display brightness detection via DDCUtil
       * dbusSupport: DBus functionality for Bluetooth, WiFi, player & media detection
@@ -286,6 +294,7 @@ stdenv.mkDerivation (finalAttrs: {
       * waylandSupport: Wayland display detection
       * x11Support: X11 display information
       * xfceSupport: XFCE integration for theme and terminal font detection
+      * zfsSupport: zpool information
     '';
   };
 })

pkgs/by-name/gi/gitbutler/package.nix

@@ -35,13 +35,13 @@ in
 
 rustPlatform.buildRustPackage rec {
   pname = "gitbutler";
-  version = "0.14.18";
+  version = "0.14.19";
 
   src = fetchFromGitHub {
     owner = "gitbutlerapp";
     repo = "gitbutler";
     tag = "release/${version}";
-    hash = "sha256-lYC7thGiCAW6snGyE+qQteS1WfY9k3aez84U8PEjmjg=";
+    hash = "sha256-NopuZbgF2jdwuf/p/JzubS0IM5xBnlkh9Tj234auBnE=";
   };
 
   # Let Tauri know what version we're building
@@ -60,11 +60,11 @@ rustPlatform.buildRustPackage rec {
   '';
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-VVGdZxfBLj1kKEJjck5jhOsoW4KRUWiup6w6wpRto7Q=";
+  cargoHash = "sha256-wzSRUZeB5f9Z/D+Sa5Nl77jh7GDnnUehcmwanPcaSKM=";
 
   pnpmDeps = pnpm_9.fetchDeps {
     inherit pname version src;
-    hash = "sha256-v+nW5C4an5Yx6Kfd1iErNiXRofPubgLSNFZu/Ae1DFc=";
+    hash = "sha256-5NtfstUuIYyntt09Mu9GAFAOImfO6VMmJ7g15kvGaLE=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/gl/glib/package.nix

@@ -31,7 +31,6 @@
   tzdata,
   desktop-file-utils,
   shared-mime-info,
-  makeHardcodeGsettingsPatch,
   testers,
   gobject-introspection,
   libsystemtap,
@@ -365,18 +364,6 @@ stdenv.mkDerivation (finalAttrs: {
       packageName = "glib";
       versionPolicy = "odd-unstable";
     };
-
-    mkHardcodeGsettingsPatch =
-      {
-        src,
-        glib-schema-to-var,
-      }:
-      builtins.trace
-        "glib.mkHardcodeGsettingsPatch is deprecated, please use makeHardcodeGsettingsPatch instead"
-        (makeHardcodeGsettingsPatch {
-          inherit src;
-          schemaIdToVariableMapping = glib-schema-to-var;
-        });
   };
 
   meta = with lib; {

pkgs/by-name/gp/gpaste/package.nix

@@ -19,12 +19,12 @@
 }:
 
 stdenv.mkDerivation (finalAttrs: {
-  version = "45.2";
   pname = "gpaste";
+  version = "45.3";
 
   src = fetchurl {
     url = "https://www.imagination-land.org/files/gpaste/GPaste-${finalAttrs.version}.tar.xz";
-    hash = "sha256-2WC0FGPQisY3YH4EgJcR/Re69fJznUD1KlCGljivyEE=";
+    hash = "sha256-UU8pw7bqEwg2Vh7S6GTx8swI/2IhlwjQgkGNZCzoMwc=";
   };
 
   patches = [

pkgs/by-name/gr/gramps/package.nix

@@ -1,4 +1,5 @@
 {
+  stdenv,
   lib,
   fetchFromGitHub,
   gtk3,
@@ -10,6 +11,7 @@
   gobject-introspection,
   wrapGAppsHook3,
   gettext,
+  desktopToDarwinBundle,
   # Optional packages:
   enableOSM ? true,
   osm-gps-map,
@@ -52,12 +54,17 @@ buildPythonApplication rec {
     python3Packages.setuptools
   ];
 
-  nativeCheckInputs = [
+  nativeCheckInputs =
+    [
       glibcLocales
       python3Packages.unittestCheckHook
       python3Packages.jsonschema
       python3Packages.mock
       python3Packages.lxml
+    ]
+    # TODO: use JHBuild to build the Gramps' bundle
+    ++ lib.optionals stdenv.hostPlatform.isDarwin [
+      desktopToDarwinBundle
     ];
 
   buildInputs =

pkgs/by-name/ip/ipxe/package.nix

@@ -48,7 +48,7 @@ in
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "ipxe";
-  version = "1.21.1-unstable-2025-04-25";
+  version = "1.21.1-unstable-2025-05-07";
 
   nativeBuildInputs = [
     mtools
@@ -65,8 +65,8 @@ stdenv.mkDerivation (finalAttrs: {
   src = fetchFromGitHub {
     owner = "ipxe";
     repo = "ipxe";
-    rev = "4c8bf666f4afb578645269a5a81431d784fad771";
-    hash = "sha256-9yxUArp1kKA8deCnaHJkOnrL4Ox08u/7/VxCQjOUkvY=";
+    rev = "12dee2dab2ea6bc619603c2036e6512889813c4c";
+    hash = "sha256-um0CAxIY7FFGAzM1vCL8uurFY3DieK46Y9JA12s5fVw=";
   };
 
   # Calling syslinux on a FAT image isn't going to work on Aarch64.

pkgs/by-name/js/jsonnet/fix-cpp-unresolved-symbols.patch

@@ -1,12 +0,0 @@
-diff --git a/cpp/CMakeLists.txt b/cpp/CMakeLists.txt
-index 3a52458..872e6c6 100644
---- a/cpp/CMakeLists.txt
-+++ b/cpp/CMakeLists.txt
-@@ -10,6 +10,7 @@ set(LIBJSONNETPP_SOURCE
-
- add_library(libjsonnet++ SHARED ${LIBJSONNETPP_HEADERS} ${LIBJSONNETPP_SOURCE})
- add_dependencies(libjsonnet++ jsonnet)
-+target_link_libraries(libjsonnet++ libjsonnet)
- # target_link_libraries(libjsonnet libjsonnet)
-
- # CMake prepends CMAKE_SHARED_LIBRARY_PREFIX to shared libraries, so without

pkgs/by-name/js/jsonnet/package.nix

@@ -9,7 +9,7 @@
 
 stdenv.mkDerivation rec {
   pname = "jsonnet";
-  version = "0.20.0";
+  version = "0.21.0";
   outputs = [
     "out"
     "doc"
@@ -19,7 +19,7 @@ stdenv.mkDerivation rec {
     rev = "v${version}";
     owner = "google";
     repo = "jsonnet";
-    sha256 = "sha256-FtVJE9alEl56Uik+nCpJMV5DMVVmRCnE1xMAiWdK39Y=";
+    sha256 = "sha256-QHp0DOu/pqcgN7di219cHzfFb7fWtdGGE6J1ZXgbOGQ=";
   };
 
   nativeBuildInputs = [
@@ -37,11 +37,6 @@ stdenv.mkDerivation rec {
       "-DBUILD_SHARED_BINARIES=${if stdenv.hostPlatform.isStatic then "OFF" else "ON"}"
     ];
 
-  # https://github.com/google/jsonnet/issues/778
-  patches = [
-    ./fix-cpp-unresolved-symbols.patch
-  ];
-
   enableParallelBuilding = true;
 
   # Upstream writes documentation in html, not in markdown/rst, so no

pkgs/by-name/k9/k9s/package.nix

@@ -12,13 +12,13 @@
 
 buildGoModule rec {
   pname = "k9s";
-  version = "0.50.4";
+  version = "0.50.5";
 
   src = fetchFromGitHub {
     owner = "derailed";
     repo = "k9s";
     rev = "v${version}";
-    hash = "sha256-JosFo7/JgM7tVMXY+OjASXnbwVYoJ5WGtgR5LTxaAYY=";
+    hash = "sha256-hh00R0PCqhAUlwFps40CQ+hc6p2634WEGqNjX1mi/J8=";
   };
 
   ldflags = [
@@ -33,7 +33,7 @@ buildGoModule rec {
 
   proxyVendor = true;
 
-  vendorHash = "sha256-uWdSeHYbDvRWwKAd/wwUsI7uEtX6aunsB1+cRmfBNUc=";
+  vendorHash = "sha256-g2tS1EpmG+Wba3kF9cH83JAG6EhKK4LrASGUSFtYYY8=";
 
   # TODO investigate why some config tests are failing
   doCheck = !(stdenv.hostPlatform.isDarwin && stdenv.hostPlatform.isAarch64);

pkgs/by-name/la/ladybird/package.nix

@@ -42,13 +42,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "ladybird";
-  version = "0-unstable-2025-03-27";
+  version = "0-unstable-2025-05-07";
 
   src = fetchFromGitHub {
     owner = "LadybirdWebBrowser";
     repo = "ladybird";
-    rev = "5ea45da15f5ac956db1cfe0aad74b570f7e88339";
-    hash = "sha256-wODm5O15jwnyxvkHVCQBptwoC97tTD0KzwYqGPdY520=";
+    rev = "5610f5a8652fb5273acd3739634bb8f69df1d786";
+    hash = "sha256-XG7FmadzZN9ew3oPOFjv0CzB/UzLWGq3AANRp2MQAq8=";
   };
 
   postPatch = ''
@@ -131,6 +131,8 @@ stdenv.mkDerivation (finalAttrs: {
 
   cmakeFlags =
     [
+      # Takes an enormous amount of resources, even with mold
+      (lib.cmakeBool "ENABLE_LTO_FOR_RELEASE" false)
       # Disable network operations
       "-DSERENITY_CACHE_DIR=Caches"
       "-DENABLE_NETWORK_DOWNLOADS=OFF"

pkgs/by-name/le/lean4/mimalloc.patch

@@ -0,0 +1,16 @@
+--- a/CMakeLists.txt
++++ b/CMakeLists.txt
+@@ -77,12 +77,8 @@
+ if (USE_MIMALLOC)
+   ExternalProject_add(mimalloc
+     PREFIX mimalloc
+-    GIT_REPOSITORY https://github.com/microsoft/mimalloc
+-    GIT_TAG v2.2.3
+-    # just download, we compile it as part of each stage as it is small
+-    CONFIGURE_COMMAND ""
+-    BUILD_COMMAND ""
++    SOURCE_DIR "MIMALLOC-SRC"
+     INSTALL_COMMAND "")
+   list(APPEND EXTRA_DEPENDS mimalloc)
+ endif()
+ 

pkgs/by-name/le/lean4/package.nix

@@ -8,29 +8,51 @@
   cadical,
   pkg-config,
   libuv,
+  enableMimalloc ? true,
   perl,
   testers,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "lean4";
-  version = "4.18.0";
+  version = "4.19.0";
+
+  # Using a vendored version rather than nixpkgs' version to match the exact version required by
+  # Lean.  Apparently, even a slight version change can impact greatly the final performance.
+  mimalloc-src = fetchFromGitHub {
+    owner = "microsoft";
+    repo = "mimalloc";
+    tag = "v2.2.3";
+    hash = "sha256-B0gngv16WFLBtrtG5NqA2m5e95bYVcQraeITcOX9A74=";
+  };
 
   src = fetchFromGitHub {
     owner = "leanprover";
     repo = "lean4";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-1hVcRO9RbVUgoKTUTFXBqJZwt50/aw/P9dxUdI7RpCc=";
+    hash = "sha256-Iw5JSamrty9l6aJ2WwslAolSHfi2q0UO8P8HI1gp+j8=";
   };
 
-  postPatch = ''
+  postPatch =
+    let
+      pattern = "\${LEAN_BINARY_DIR}/../mimalloc/src/mimalloc";
+    in
+    ''
       substituteInPlace src/CMakeLists.txt \
         --replace-fail 'set(GIT_SHA1 "")' 'set(GIT_SHA1 "${finalAttrs.src.tag}")'
 
       # Remove tests that fails in sandbox.
       # It expects `sourceRoot` to be a git repository.
       rm -rf src/lake/examples/git/
-  '';
+    ''
+    + (lib.optionalString enableMimalloc ''
+      substituteInPlace CMakeLists.txt \
+        --replace-fail 'MIMALLOC-SRC' '${finalAttrs.mimalloc-src}'
+      for file in src/CMakeLists.txt src/runtime/CMakeLists.txt; do
+        substituteInPlace "$file" \
+          --replace-fail '${pattern}' '${finalAttrs.mimalloc-src}'
+      done
+    '');
 
   preConfigure = ''
     patchShebangs stage0/src/bin/ src/bin/
@@ -52,9 +74,12 @@ stdenv.mkDerivation (finalAttrs: {
     perl
   ];
 
+  patches = [ ./mimalloc.patch ];
+
   cmakeFlags = [
     "-DUSE_GITHASH=OFF"
     "-DINSTALL_LICENSE=OFF"
+    "-DUSE_MIMALLOC=${if enableMimalloc then "ON" else "OFF"}"
   ];
 
   passthru.tests = {

pkgs/by-name/li/libsidplayfp/package.nix

@@ -19,14 +19,14 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "libsidplayfp";
-  version = "2.13.0";
+  version = "2.13.1";
 
   src = fetchFromGitHub {
     owner = "libsidplayfp";
     repo = "libsidplayfp";
     rev = "v${finalAttrs.version}";
     fetchSubmodules = true;
-    hash = "sha256-uKChHjC5kzctFEEYP6YUp0sr7s9YULn9nfu87wsjxUQ=";
+    hash = "sha256-gUi7g+TZmF6XgacImVSNc69zpMckjCaqwfidIrrh38U=";
   };
 
   outputs = [ "out" ] ++ lib.optionals docSupport [ "doc" ];

pkgs/by-name/op/open-webui/package.nix

@@ -8,13 +8,13 @@
 }:
 let
   pname = "open-webui";
-  version = "0.6.6";
+  version = "0.6.7";
 
   src = fetchFromGitHub {
     owner = "open-webui";
     repo = "open-webui";
     tag = "v${version}";
-    hash = "sha256-6gM4Ke63lFzxji7+hfuzMYN3MK4wkI6+iMH/qYM92oE=";
+    hash = "sha256-4V0WhiVhjxYtbwDt+83AfkjJtQFew2P6i1sLtRL13lg=";
   };
 
   frontend = buildNpmPackage rec {
@@ -30,7 +30,7 @@ let
       url = "https://github.com/pyodide/pyodide/releases/download/${pyodideVersion}/pyodide-${pyodideVersion}.tar.bz2";
     };
 
-    npmDepsHash = "sha256-T1cVyq2xnpF8yTcLdVPj4pyASVRFpEdIoWRh3hQaPv4=";
+    npmDepsHash = "sha256-kOqfYAMkpiT2d79fpH1ON5FQAuV1i3/PL9waQq/YR58=";
 
     # Disabling `pyodide:fetch` as it downloads packages during `buildPhase`
     # Until this is solved, running python packages from the browser will not work.

pkgs/by-name/op/opencloud-desktop-shell-integration-dolphin/package.nix

@@ -0,0 +1,45 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  cmake,
+  qt6,
+  kdePackages,
+  opencloud-desktop-shell-integration-resources,
+}:
+
+stdenv.mkDerivation rec {
+  pname = "opencloud-desktop-shell-integration-dolphin";
+  version = "1.0.0";
+
+  src = fetchFromGitHub {
+    owner = "opencloud-eu";
+    repo = "desktop-shell-integration-dolphin";
+    tag = "v${version}";
+    hash = "sha256-+Bu/kN4RvR/inWQHYcfWOF6BWHTFm5jlea/QeT4NhFQ=";
+  };
+
+  buildInputs = [
+    qt6.qtbase
+    kdePackages.extra-cmake-modules
+    kdePackages.kbookmarks
+    kdePackages.kcoreaddons
+    kdePackages.kio
+    opencloud-desktop-shell-integration-resources
+  ];
+
+  nativeBuildInputs = [
+    cmake
+  ];
+
+  dontWrapQtApps = true;
+
+  meta = {
+    description = "This is the OpenCloud Desktop shell integration for the great KDE Dolphin in KDE Frameworks 6";
+    homepage = "https://github.com/opencloud-eu/desktop-shell-integration-dolphin";
+    license = lib.licenses.gpl2Only;
+    maintainers = with lib.maintainers; [ k900 ];
+    mainProgram = "opencloud-desktop-shell-integration-dolphin";
+    platforms = lib.platforms.all;
+  };
+}

pkgs/by-name/op/opencloud-desktop-shell-integration-resources/package.nix

@@ -0,0 +1,35 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  cmake,
+  kdePackages,
+}:
+
+stdenv.mkDerivation rec {
+  pname = "opencloud-desktop-shell-integration-resources";
+  version = "1.0.0";
+
+  src = fetchFromGitHub {
+    owner = "opencloud-eu";
+    repo = "desktop-shell-integration-resources";
+    tag = "v${version}";
+    hash = "sha256-TqJanrAKD3aNQu5jL1Dt0bn84dYBNGImAKBGsAY2xeU=";
+  };
+
+  buildInputs = [
+    kdePackages.extra-cmake-modules
+  ];
+
+  nativeBuildInputs = [
+    cmake
+  ];
+
+  meta = {
+    description = "Shared assets for OpenCloud desktop shell integrations";
+    homepage = "https://github.com/opencloud-eu/desktop-shell-integration-resources";
+    license = lib.licenses.gpl2Only;
+    maintainers = with lib.maintainers; [ k900 ];
+    platforms = lib.platforms.all;
+  };
+}

pkgs/by-name/pa/passt/package.nix

@@ -11,11 +11,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "passt";
-  version = "2025_04_15.2340bbf";
+  version = "2025_05_03.587980c";
 
   src = fetchurl {
     url = "https://passt.top/passt/snapshot/passt-${finalAttrs.version}.tar.gz";
-    hash = "sha256-eYIgAj8BtCZ9OxG8/IDaUvFCtB+1ROU0UHf6sbaVUEY=";
+    hash = "sha256-ussvShWxhR6ScBYiCJG0edrqS+W+74DSlsDRS1GCByA=";
   };
 
   separateDebugInfo = true;

pkgs/by-name/po/poetry/package.nix

@@ -17,12 +17,12 @@ let
       # We keep the override around even when the versions match, as
       # it's likely to become relevant again after the next Poetry update.
       poetry-core = super.poetry-core.overridePythonAttrs (old: rec {
-        version = "2.1.2";
+        version = "2.1.3";
         src = fetchFromGitHub {
           owner = "python-poetry";
           repo = "poetry-core";
           tag = version;
-          hash = "sha256-fNj/LI4A4RjjPzYT+0ekwqmm3qzzZL3aACOe8BHviuk=";
+          hash = "sha256-CgaWlqjvBTN7GuerzmO5IiEdXxYH6pmTDj9IsNJlCBE=";
         };
       });
     }

pkgs/by-name/po/poetry/unwrapped.nix

@@ -37,7 +37,7 @@
 
 buildPythonPackage rec {
   pname = "poetry";
-  version = "2.1.2";
+  version = "2.1.3";
   pyproject = true;
 
   disabled = pythonOlder "3.9";
@@ -46,7 +46,7 @@ buildPythonPackage rec {
     owner = "python-poetry";
     repo = "poetry";
     tag = version;
-    hash = "sha256-51pO/PP5OwTmi+1uy26CK/1oQ/P21wPBoRVE9Jv0TjA=";
+    hash = "sha256-aMmYgFdQhgMd99atAtr5MD0yniaIi+QTPJ0rMI2jMxk=";
   };
 
   build-system = [
@@ -132,6 +132,7 @@ buildPythonPackage rec {
     "test_builder_should_execute_build_scripts"
     "test_env_system_packages_are_relative_to_lib"
     "test_install_warning_corrupt_root"
+    "test_no_additional_output_in_verbose_mode"
     "test_project_plugins_are_installed_in_project_folder"
     "test_application_command_not_found_messages"
     # PermissionError: [Errno 13] Permission denied: '/build/pytest-of-nixbld/pytest-0/popen-gw3/test_find_poetry_managed_pytho1/.local/share/pypoetry/python/pypy@3.10.8/bin/python'
@@ -160,12 +161,12 @@ buildPythonPackage rec {
   # in the Python script, which runs after the wrapper.
   makeWrapperArgs = [ "--unset PYTHONPATH" ];
 
-  meta = with lib; {
-    changelog = "https://github.com/python-poetry/poetry/blob/${src.rev}/CHANGELOG.md";
+  meta = {
+    changelog = "https://github.com/python-poetry/poetry/blob/${src.tag}/CHANGELOG.md";
     homepage = "https://python-poetry.org/";
     description = "Python dependency management and packaging made easy";
-    license = licenses.mit;
-    maintainers = with maintainers; [
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [
       jakewaksbaum
       dotlambda
     ];

pkgs/by-name/po/pomerium/package.nix

@@ -19,12 +19,12 @@ let
 in
 buildGo123Module rec {
   pname = "pomerium";
-  version = "0.29.2";
+  version = "0.29.3";
   src = fetchFromGitHub {
     owner = "pomerium";
     repo = "pomerium";
     rev = "v${version}";
-    hash = "sha256-FortINGa0JNUxVeGiJ6i+cbmapMZeCXPY9hWox+Y49o=";
+    hash = "sha256-jlNU6pygq6X0DL3f25aVGHB8VoKw+VEdNFB5QY8MR9E=";
   };
 
   vendorHash = "sha256-K9LcGvANajoVKEDIswahD0mT5845qGZzafmWMKkVn8Q=";

pkgs/by-name/so/source-meta-json-schema/package.nix

@@ -5,7 +5,7 @@
   cmake,
 }:
 let
-  version = "9.2.1";
+  version = "9.2.4";
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "source-meta-json-schema";
@@ -15,7 +15,7 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "sourcemeta";
     repo = "jsonschema";
     rev = "v${version}";
-    hash = "sha256-VWq0BPVQRUmMXf6YZ4lid7EPPERA818UqE18EtayUus=";
+    hash = "sha256-IQuXybTpdVdPiYVpb9BffZdUs0TxKqA1HkzxS/gi+pw=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/tr/tracexec/package.nix

@@ -15,13 +15,13 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "tracexec";
-  version = "0.11.0";
+  version = "0.12.0";
 
   src = fetchFromGitHub {
     owner = "kxxt";
     repo = "tracexec";
     tag = "v${version}";
-    hash = "sha256-d/GtP6PyIs5mqpMBl086XoQ0AqZmvI4+jidH7GHgyzk=";
+    hash = "sha256-j1zgHDO5bmJAXi9KvkHqenm/QfM9DmD9yNqF6TxJ9sY=";
   };
 
   # remove if updating to rust 1.85
@@ -35,7 +35,7 @@ rustPlatform.buildRustPackage rec {
   env.RUSTC_BOOTSTRAP = 1;
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-OX3I2TjpRtDutbrnysFVFyWeFkISvWn5SLxMaUgBhes=";
+  cargoHash = "sha256-XuuLuIeD/S60by/hg1fR+ML3PtIyX9JNrEvgGzI3UiM=";
 
   hardeningDisable = [ "zerocallusedregs" ];
 

pkgs/by-name/up/upower/package.nix

@@ -71,6 +71,11 @@ stdenv.mkDerivation (finalAttrs: {
         url = "https://gitlab.freedesktop.org/upower/upower/-/commit/9ee76826bd41a5d3a377dfd6f5835f42ec50be9a.patch";
         hash = "sha256-E56iz/iHn+VM7Opo0a13A5nhnB9nf6C7Y1kyWzk4ZnU=";
       })
+      # Fix style issues in the udev rules file
+      (fetchpatch {
+        url = "https://gitlab.freedesktop.org/upower/upower/-/commit/6f9d84694da56b317989b8c34250b60d833a4b29.patch";
+        hash = "sha256-xBUbf4qz9Llmw7CuKKMp/uPk7JqwjB4+p7z9kMOVRuE=";
+      })
     ];
 
   strictDeps = true;
@@ -163,7 +168,7 @@ stdenv.mkDerivation (finalAttrs: {
     patchShebangs src/linux/unittest_inspector.py
 
     substituteInPlace src/linux/integration-test.py \
-      --replace "/usr/share/dbus-1" "$out/share/dbus-1"
+      --replace-fail "/usr/share/dbus-1" "$out/share/dbus-1"
   '';
 
   preCheck = ''

pkgs/by-name/us/usb-modeswitch/data.nix

@@ -20,8 +20,14 @@ stdenv.mkDerivation rec {
     "DESTDIR=$(out)"
   ];
 
-  prePatch = ''
-    sed -i 's@usb_modeswitch@${usb-modeswitch}/lib/udev/usb_modeswitch@g' 40-usb_modeswitch.rules
+  postPatch =
+    # bash
+    ''
+      substituteInPlace 40-usb_modeswitch.rules \
+        --replace-fail "usb_modeswitch" "${usb-modeswitch}/lib/udev/usb_modeswitch"
+
+      # Fix issue reported by udevadm verify
+      sed -i 's/,,/,/g' 40-usb_modeswitch.rules
     '';
 
   # we add tcl here so we can patch in support for new devices by dropping config into

pkgs/by-name/vi/vieb/package.nix

@@ -11,20 +11,20 @@
 
 buildNpmPackage rec {
   pname = "vieb";
-  version = "12.2.0";
+  version = "12.3.0";
 
   src = fetchFromGitHub {
     owner = "Jelmerro";
     repo = pname;
     rev = version;
-    hash = "sha256-5LbVSwU+G3mu5MWxmnscoqfQw3ZA9xFXNJGYx3L+aUQ=";
+    hash = "sha256-g3L+bzsDP3vfTaroqCWzRDymFTZE+6nLytRWzPMBoX8=";
   };
 
   postPatch = ''
     sed -i '/"electron"/d' package.json
   '';
 
-  npmDepsHash = "sha256-RgMPFxjXEvEb8Jz9f6kWiBFqgVYIsyOsUDWkkyaw4IM=";
+  npmDepsHash = "sha256-0V2fKdfqO64DLqLGz1OK9BZEbwGDqPFUdxu9F6v6Ms4=";
   makeCacheWritable = true;
   dontNpmBuild = true;
   env.ELECTRON_SKIP_BINARY_DOWNLOAD = 1;

pkgs/by-name/wi/winbox4/build-from-dmg.nix

@@ -0,0 +1,37 @@
+{
+  pname,
+  version,
+  hash,
+  fetchurl,
+  stdenvNoCC,
+  undmg,
+  metaCommon ? { },
+}:
+
+stdenvNoCC.mkDerivation (finalAttrs: {
+  inherit pname version;
+
+  src = fetchurl {
+    name = "WinBox-${finalAttrs.version}.dmg";
+    url = "https://download.mikrotik.com/routeros/winbox/${finalAttrs.version}/WinBox.dmg";
+    inherit hash;
+  };
+
+  sourceRoot = ".";
+
+  nativeBuildInputs = [ undmg ];
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p $out/{bin,Applications}
+    cp -R "WinBox.app" "$out/Applications/WinBox.app"
+    ln -s "$out/Applications/WinBox.app/Contents/MacOS/WinBox" "$out/bin/WinBox"
+
+    runHook postInstall
+  '';
+
+  meta = metaCommon // {
+    platforms = [ "aarch64-darwin" ];
+  };
+})

pkgs/by-name/wi/winbox4/build-from-zip.nix

@@ -0,0 +1,119 @@
+{
+  pname,
+  version,
+  hash,
+  autoPatchelfHook,
+  copyDesktopItems,
+  fetchurl,
+  fontconfig,
+  freetype,
+  lib,
+  libGL,
+  libxkbcommon,
+  makeDesktopItem,
+  makeWrapper,
+  stdenvNoCC,
+  unzip,
+  writeShellApplication,
+  xorg,
+  zlib,
+  metaCommon ? { },
+}:
+
+stdenvNoCC.mkDerivation (finalAttrs: {
+  inherit pname version;
+
+  src = fetchurl {
+    name = "WinBox_Linux-${finalAttrs.version}.zip";
+    url = "https://download.mikrotik.com/routeros/winbox/${finalAttrs.version}/WinBox_Linux.zip";
+    inherit hash;
+  };
+
+  sourceRoot = ".";
+
+  nativeBuildInputs = [
+    autoPatchelfHook
+    copyDesktopItems
+    # makeBinaryWrapper does not support --run
+    makeWrapper
+    unzip
+  ];
+
+  buildInputs = [
+    fontconfig
+    freetype
+    libGL
+    libxkbcommon
+    xorg.libxcb
+    xorg.xcbutilimage
+    xorg.xcbutilkeysyms
+    xorg.xcbutilrenderutil
+    xorg.xcbutilwm
+    zlib
+  ];
+
+  installPhase = ''
+    runHook preInstall
+
+    install -Dm644 "assets/img/winbox.png" "$out/share/pixmaps/winbox.png"
+    install -Dm755 "WinBox" "$out/bin/WinBox"
+
+    wrapProgram "$out/bin/WinBox" --run "${lib.getExe finalAttrs.migrationScript}"
+
+    runHook postInstall
+  '';
+
+  desktopItems = [
+    (makeDesktopItem {
+      name = "winbox";
+      desktopName = "WinBox";
+      comment = "GUI administration for Mikrotik RouterOS";
+      exec = "WinBox";
+      icon = "winbox";
+      categories = [ "Utility" ];
+    })
+  ];
+
+  migrationScript = writeShellApplication {
+    name = "winbox-migrate";
+    text = ''
+      XDG_DATA_HOME=''${XDG_DATA_HOME:-$HOME/.local/share}
+      targetFile="$XDG_DATA_HOME/MikroTik/WinBox/Addresses.cdb"
+
+      if [ -f "$targetFile" ]; then
+        echo "NixOS: WinBox 4 data already present at $(dirname "$targetFile"). Skipping automatic migration."
+        exit 0
+      fi
+
+      # cover both wine prefix variants
+      # latter was used until https://github.com/NixOS/nixpkgs/pull/329626 was merged on 2024/07/24
+      winePrefixes=(
+        "''${WINEPREFIX:-$HOME/.wine}"
+        "''${WINBOX_HOME:-$XDG_DATA_HOME/winbox}/wine"
+      )
+      sourceFilePathSuffix="drive_c/users/$USER/AppData/Roaming/Mikrotik/Winbox/Addresses.cdb"
+      selectedSourceFile=""
+
+      for prefix in "''${winePrefixes[@]}"
+      do
+        echo "NixOS: Probing WinBox 3 data path at $prefix..."
+        if [ -f "$prefix/$sourceFilePathSuffix" ]; then
+          selectedSourceFile="$prefix/$sourceFilePathSuffix"
+          break
+        fi
+      done
+
+      if [ -z "$selectedSourceFile" ]; then
+        echo "NixOS: WinBox 3 data not found. Skipping automatic migration."
+        exit 0
+      fi
+
+      echo "NixOS: Automatically migrating WinBox 3 data..."
+      install -Dvm644 "$selectedSourceFile" "$targetFile"
+    '';
+  };
+
+  meta = metaCommon // {
+    platforms = [ "x86_64-linux" ];
+  };
+})

pkgs/by-name/wi/winbox4/package.nix

@@ -1,123 +1,18 @@
 {
-  autoPatchelfHook,
-  copyDesktopItems,
-  fetchurl,
-  fontconfig,
-  freetype,
   lib,
-  libGL,
-  libxkbcommon,
-  makeDesktopItem,
-  makeWrapper,
+  callPackage,
   stdenvNoCC,
-  unzip,
-  writeShellApplication,
-  xorg,
-  zlib,
 }:
-
-stdenvNoCC.mkDerivation (finalAttrs: {
+let
   pname = "winbox";
   version = "4.0beta20";
 
-  src = fetchurl {
-    name = "WinBox_Linux-${finalAttrs.version}.zip";
-    url = "https://download.mikrotik.com/routeros/winbox/${finalAttrs.version}/WinBox_Linux.zip";
-    hash = "sha256-mU+z7yRYKXnGAXHB5LS5SVUgIzRlR9nV2FzXispntF0=";
-  };
-
-  sourceRoot = ".";
-
-  nativeBuildInputs = [
-    autoPatchelfHook
-    copyDesktopItems
-    # makeBinaryWrapper does not support --run
-    makeWrapper
-    unzip
-  ];
-
-  buildInputs = [
-    fontconfig
-    freetype
-    libGL
-    libxkbcommon
-    xorg.libxcb
-    xorg.xcbutilimage
-    xorg.xcbutilkeysyms
-    xorg.xcbutilrenderutil
-    xorg.xcbutilwm
-    zlib
-  ];
-
-  installPhase = ''
-    runHook preInstall
-
-    install -Dm644 "assets/img/winbox.png" "$out/share/pixmaps/winbox.png"
-    install -Dm755 "WinBox" "$out/bin/WinBox"
-
-    wrapProgram "$out/bin/WinBox" --run "${lib.getExe finalAttrs.migrationScript}"
-
-    runHook postInstall
-  '';
-
-  desktopItems = [
-    (makeDesktopItem {
-      name = "winbox";
-      desktopName = "Winbox";
-      comment = "GUI administration for Mikrotik RouterOS";
-      exec = "WinBox";
-      icon = "winbox";
-      categories = [ "Utility" ];
-    })
-  ];
-
-  migrationScript = writeShellApplication {
-    name = "winbox-migrate";
-    text = ''
-      XDG_DATA_HOME=''${XDG_DATA_HOME:-$HOME/.local/share}
-      targetFile="$XDG_DATA_HOME/MikroTik/WinBox/Addresses.cdb"
-
-      if [ -f "$targetFile" ]; then
-        echo "NixOS: WinBox 4 data already present at $(dirname "$targetFile"). Skipping automatic migration."
-        exit 0
-      fi
-
-      # cover both wine prefix variants
-      # latter was used until https://github.com/NixOS/nixpkgs/pull/329626 was merged on 2024/07/24
-      winePrefixes=(
-        "''${WINEPREFIX:-$HOME/.wine}"
-        "''${WINBOX_HOME:-$XDG_DATA_HOME/winbox}/wine"
-      )
-      sourceFilePathSuffix="drive_c/users/$USER/AppData/Roaming/Mikrotik/Winbox/Addresses.cdb"
-      selectedSourceFile=""
-
-      for prefix in "''${winePrefixes[@]}"
-      do
-        echo "NixOS: Probing WinBox 3 data path at $prefix..."
-        if [ -f "$prefix/$sourceFilePathSuffix" ]; then
-          selectedSourceFile="$prefix/$sourceFilePathSuffix"
-          break
-        fi
-      done
-
-      if [ -z "$selectedSourceFile" ]; then
-        echo "NixOS: WinBox 3 data not found. Skipping automatic migration."
-        exit 0
-      fi
-
-      echo "NixOS: Automatically migrating WinBox 3 data..."
-      install -Dvm644 "$selectedSourceFile" "$targetFile"
-    '';
-  };
-
-  meta = {
+  metaCommon = {
     description = "Graphical configuration utility for RouterOS-based devices";
     homepage = "https://mikrotik.com";
     downloadPage = "https://mikrotik.com/download";
-    changelog = "https://download.mikrotik.com/routeros/winbox/${finalAttrs.version}/CHANGELOG";
     sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
     license = lib.licenses.unfree;
-    platforms = [ "x86_64-linux" ];
     mainProgram = "WinBox";
     maintainers = with lib.maintainers; [
       Scrumplex
@@ -125,4 +20,22 @@ stdenvNoCC.mkDerivation (finalAttrs: {
       savalet
     ];
   };
+  x86_64-zip = callPackage ./build-from-zip.nix {
+    inherit pname version metaCommon;
+
+    hash = "sha256-mU+z7yRYKXnGAXHB5LS5SVUgIzRlR9nV2FzXispntF0=";
+  };
+
+  x86_64-dmg = callPackage ./build-from-dmg.nix {
+    inherit pname version metaCommon;
+
+    hash = "sha256-tLsreK6YsqsbMaY4dil34eiHxAG7GrZYyll6BX9dsx8=";
+  };
+in
+(if stdenvNoCC.hostPlatform.isDarwin then x86_64-dmg else x86_64-zip).overrideAttrs (oldAttrs: {
+  meta = oldAttrs.meta // {
+    platforms = x86_64-zip.meta.platforms ++ x86_64-dmg.meta.platforms;
+    mainProgram = "WinBox";
+    changelog = "https://download.mikrotik.com/routeros/winbox/${oldAttrs.version}/CHANGELOG";
+  };
 })

pkgs/development/cuda-modules/generic-builders/multiplex.nix

@@ -81,7 +81,7 @@ let
   redistArch = flags.getRedistArch hostPlatform.system;
 
   preferable =
-    p1: p2: (isSupported p2 -> isSupported p1) && (strings.versionAtLeast p1.version p2.version);
+    p1: p2: (isSupported p2 -> isSupported p1) && (strings.versionOlder p2.version p1.version);
 
   # All the supported packages we can build for our platform.
   # perSystemReleases :: List Package

pkgs/development/interpreters/python/default.nix

@@ -93,9 +93,9 @@
         major = "3";
         minor = "14";
         patch = "0";
-        suffix = "a7";
+        suffix = "b1";
       };
-      hash = "sha256-ca287DrJ7fkzCOVc+0GE8utLFv2iuwpaOCkp7SnIOG0=";
+      hash = "sha256-Ld0wp3yfYuBlzmSGZKJUubDAEbzaqMHCeHCH5kTL6zk=";
       inherit passthruFun;
     };
     # Minimal versions of Python (built without optional dependencies)

pkgs/development/python-modules/oslotest/default.nix

@@ -11,12 +11,12 @@
 
 buildPythonPackage rec {
   pname = "oslotest";
-  version = "5.0.0";
+  version = "5.0.1";
   format = "setuptools";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-97skDGy+8voLq7lRP/PafQ8ozDja+Y70Oy6ISDZ/vSA=";
+    hash = "sha256-WpRA0o2MywC89f56BWkEF+pilDsMjpOkMX2LG9Au6O4=";
   };
 
   nativeBuildInputs = [ pbr ];

pkgs/development/python-modules/python-picnic-api2/default.nix

@@ -11,14 +11,14 @@
 
 buildPythonPackage rec {
   pname = "python-picnic-api2";
-  version = "1.2.4";
+  version = "1.3.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "codesalatdev";
     repo = "python-picnic-api";
     tag = "v${version}";
-    hash = "sha256-vlb53f+k+oX9ycyTe/63u0qoqIn8kHKtCehl82Ks9wY=";
+    hash = "sha256-lr8xlSu5kvkNNEM22Pc+PFGs4re+Ytw2ct97h6ydY04=";
   };
 
   build-system = [ hatchling ];

pkgs/development/python-modules/torch/source/default.nix

@@ -364,7 +364,7 @@ buildPythonPackage rec {
     ''
     + lib.optionalString (cudaSupport && cudaPackages ? cudnn) ''
       export CUDNN_INCLUDE_DIR=${lib.getLib cudnn}/include
-      export CUDNN_LIB_DIR=${cudnn.lib}/lib
+      export CUDNN_LIB_DIR=${lib.getLib cudnn}/lib
     ''
     + lib.optionalString rocmSupport ''
       export ROCM_PATH=${rocmtoolkit_joined}

pkgs/games/armagetronad/default.nix

@@ -70,8 +70,8 @@ let
       # https://gitlab.com/armagetronad/armagetronad/-/commits/trunk/?ref_type=heads
       ${unstableVersionMajor} =
         let
-          rev = "1830e09888597b372fad192b0d246aefe555540c";
-          hash = "sha256-svVcg2AMk2GHmg1Szny10KCLZQ6Cly1RrSVNGmf7Fdg=";
+          rev = "813b684ab0de8ee9737c9fc1f9b90ba0543dd418";
+          hash = "sha256-01jWE9rSBJn+JS8p8LTFqIGquOY1avXsAZnfYfo5pPk=";
         in
         dedicatedServer: {
           version = "${unstableVersionMajor}-${builtins.substring 0 8 rev}";

pkgs/kde/gear/falkon/default.nix

@@ -5,20 +5,10 @@
   qtwebengine,
   qttools,
   python3Packages,
-  fetchpatch,
 }:
 mkKdeDerivation {
   pname = "falkon";
 
-  # Fix crash on startup
-  # FIXME: remove in 25.04.1
-  patches = [
-    (fetchpatch {
-      url = "https://invent.kde.org/network/falkon/-/commit/31ba9472369256804400a2db36b3dca3b4be2d73.patch";
-      hash = "sha256-jLJjL4Bp03aZfM/OPXZzgL56T0C/2hHSzNERpbTitzw=";
-    })
-  ];
-
   extraNativeBuildInputs = [
     qttools
     qtwebchannel

pkgs/servers/home-assistant/custom-components/moonraker/package.nix

@@ -8,13 +8,13 @@
 buildHomeAssistantComponent rec {
   owner = "marcolivierarsenault";
   domain = "moonraker";
-  version = "1.7.1";
+  version = "1.8.0";
 
   src = fetchFromGitHub {
     owner = "marcolivierarsenault";
     repo = "moonraker-home-assistant";
     tag = version;
-    hash = "sha256-BPlHMTGb1xSxFydeLsHKBlXSqgh1qmTrenPo+XPx2IM=";
+    hash = "sha256-FamZ4MvfWzynTpAKCMnABsX6h1+nB4jAOkO386J02OM=";
   };
 
   dependencies = [

pkgs/servers/nextcloud/notify_push.nix

@@ -13,23 +13,23 @@ rustPlatform.buildRustPackage rec {
   # in nixpkgs!
   # For that, check the `<dependencies>` section of `appinfo/info.xml`
   # in the app (https://github.com/nextcloud/notify_push/blob/main/appinfo/info.xml)
-  version = "1.0.0";
+  version = "1.1.0";
 
   src = fetchFromGitHub {
     owner = "nextcloud";
     repo = "notify_push";
     tag = "v${version}";
-    hash = "sha256-Y71o+ARi/YB2BRDfEyORbrA9HPvsUlWdh5UjM8hzmcA=";
+    hash = "sha256-mHoVNKvE4Hszi1wg9fIHjRMJp5+CIBCgUPzreJ6Jnew=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-bO3KN+ynxNdbnFv1ZHJSSPWd4SxWQGIis3O3Gfba8jw=";
+  cargoHash = "sha256-PkRWyz4Gd2gGg9n4yChtR96QNOjEK5HNVhBwkkVjVPE=";
 
   passthru = rec {
     app = fetchNextcloudApp {
       appName = "notify_push";
       appVersion = version;
-      hash = "sha256-4yCs4Q25PhYVICAIFlNiRTOFvL0JdmUwR5bNxp54GiA=";
+      hash = "sha256-nxbmzRaW4FYmwTF27P9K7SebKYiL5KOMdyU5unif+NQ=";
       license = "agpl3Plus";
       homepage = "https://github.com/nextcloud/notify_push";
       url = "https://github.com/nextcloud-releases/notify_push/releases/download/v${version}/notify_push-v${version}.tar.gz";
@@ -43,7 +43,7 @@ rustPlatform.buildRustPackage rec {
       buildAndTestSubdir = "test_client";
 
       useFetchCargoVendor = true;
-      cargoHash = "sha256-bO3KN+ynxNdbnFv1ZHJSSPWd4SxWQGIis3O3Gfba8jw=";
+      cargoHash = "sha256-PkRWyz4Gd2gGg9n4yChtR96QNOjEK5HNVhBwkkVjVPE=";
 
       meta = meta // {
         mainProgram = "test_client";

pkgs/test/make-hardcode-gsettings-patch/default.nix

@@ -13,14 +13,16 @@ let
       expected,
       src,
       patches ? [ ],
-      schemaIdToVariableMapping,
+      args,
     }:
 
     let
-      patch = makeHardcodeGsettingsPatch ({
-        inherit src schemaIdToVariableMapping;
-        inherit patches;
-      });
+      patch = makeHardcodeGsettingsPatch (
+        args
+        // {
+          inherit src patches;
+        }
+      );
     in
     runCommandLocal "makeHardcodeGsettingsPatch-tests-${name}"
 
@@ -54,11 +56,13 @@ in
   basic = mkTest {
     name = "basic";
     src = ./fixtures/example-project;
+    args = {
       schemaIdToVariableMapping = {
         "org.gnome.evolution-data-server.addressbook" = "EDS";
         "org.gnome.evolution.calendar" = "EVO";
         "org.gnome.seahorse.nautilus.window" = "SEANAUT";
       };
+    };
     expected = ./fixtures/example-project-patched;
   };
 
@@ -69,9 +73,26 @@ in
       # Avoid using wrapper function, which the generator cannot handle.
       ./fixtures/example-project-wrapped-settings-constructor-resolve.patch
     ];
+    args = {
       schemaIdToVariableMapping = {
         "org.gnome.evolution-data-server.addressbook" = "EDS";
       };
+    };
     expected = ./fixtures/example-project-wrapped-settings-constructor-patched;
   };
+
+  existsFn = mkTest {
+    name = "exists-fn";
+    src = ./fixtures/example-project;
+    args = {
+      schemaIdToVariableMapping = {
+        "org.gnome.evolution-data-server.addressbook" = "EDS";
+        "org.gnome.evolution.calendar" = "EVO";
+        "org.gnome.seahorse.nautilus.window" = "SEANAUT";
+      };
+      schemaExistsFunction = "e_ews_common_utils_gsettings_schema_exists";
+    };
+    expected = ./fixtures/example-project-patched-with-exists-fn;
+  };
+
 }

pkgs/test/make-hardcode-gsettings-patch/fixtures/example-project-patched-with-exists-fn/main.c

@@ -0,0 +1,129 @@
+#include <gio/gio.h>
+#include <glib-object.h>
+
+void schema_id_literal() {
+  GSettings *settings;
+  {
+    g_autoptr(GSettingsSchemaSource) schema_source;
+    g_autoptr(GSettingsSchema) schema;
+    schema_source = g_settings_schema_source_new_from_directory("@EDS@", g_settings_schema_source_get_default(), TRUE, NULL);
+    schema = g_settings_schema_source_lookup(schema_source, "org.gnome.evolution-data-server.addressbook", FALSE);
+    settings = g_settings_new_full(schema, NULL, NULL);
+  }
+  g_object_unref(settings);
+}
+
+#define SELF_UID_PATH_ID "org.gnome.evolution-data-server.addressbook"
+int schema_id_from_constant() {
+  GSettings *settings;
+  {
+    g_autoptr(GSettingsSchemaSource) schema_source;
+    g_autoptr(GSettingsSchema) schema;
+    schema_source = g_settings_schema_source_new_from_directory("@EDS@", g_settings_schema_source_get_default(), TRUE, NULL);
+    schema = g_settings_schema_source_lookup(schema_source, SELF_UID_PATH_ID, FALSE);
+    settings = g_settings_new_full(schema, NULL, NULL);
+  }
+  g_object_unref(settings);
+}
+
+void schema_id_autoptr() {
+  g_autoptr(GSettings) settings = NULL;
+  {
+    g_autoptr(GSettingsSchemaSource) schema_source;
+    g_autoptr(GSettingsSchema) schema;
+    schema_source = g_settings_schema_source_new_from_directory("@EVO@", g_settings_schema_source_get_default(), TRUE, NULL);
+    schema = g_settings_schema_source_lookup(schema_source, "org.gnome.evolution.calendar", FALSE);
+    settings = g_settings_new_full(schema, NULL, NULL);
+  }
+}
+
+void schema_id_with_backend() {
+  GSettings *settings;
+  {
+    g_autoptr(GSettingsSchemaSource) schema_source;
+    g_autoptr(GSettingsSchema) schema;
+    schema_source = g_settings_schema_source_new_from_directory("@EDS@", g_settings_schema_source_get_default(), TRUE, NULL);
+    schema = g_settings_schema_source_lookup(schema_source, "org.gnome.evolution-data-server.addressbook", FALSE);
+    settings = g_settings_new_full(schema, g_settings_backend_get_default(), NULL);
+  }
+  g_object_unref(settings);
+}
+
+void schema_id_with_backend_and_path() {
+  GSettings *settings;
+  {
+    g_autoptr(GSettingsSchemaSource) schema_source;
+    g_autoptr(GSettingsSchema) schema;
+    schema_source = g_settings_schema_source_new_from_directory("@SEANAUT@", g_settings_schema_source_get_default(), TRUE, NULL);
+    schema = g_settings_schema_source_lookup(schema_source, "org.gnome.seahorse.nautilus.window", FALSE);
+    settings = g_settings_new_full(schema, g_settings_backend_get_default(), "/org/gnome/seahorse/nautilus/windows/123/");
+  }
+  g_object_unref(settings);
+}
+
+void schema_id_with_path() {
+  GSettings *settings;
+  {
+    g_autoptr(GSettingsSchemaSource) schema_source;
+    g_autoptr(GSettingsSchema) schema;
+    schema_source = g_settings_schema_source_new_from_directory("@SEANAUT@", g_settings_schema_source_get_default(), TRUE, NULL);
+    schema = g_settings_schema_source_lookup(schema_source, "org.gnome.seahorse.nautilus.window", FALSE);
+    settings = g_settings_new_full(schema, NULL, "/org/gnome/seahorse/nautilus/windows/123/");
+  }
+  g_object_unref(settings);
+}
+
+void exists_fn_guard() {
+  if (!true) {
+    return;
+  }
+
+  g_autoptr(GSettings) settings = NULL;
+  {
+    g_autoptr(GSettingsSchemaSource) schema_source;
+    g_autoptr(GSettingsSchema) schema;
+    schema_source = g_settings_schema_source_new_from_directory("@EVO@", g_settings_schema_source_get_default(), TRUE, NULL);
+    schema = g_settings_schema_source_lookup(schema_source, "org.gnome.evolution.calendar", FALSE);
+    settings = g_settings_new_full(schema, NULL, NULL);
+  }
+}
+
+void exists_fn_nested() {
+  if (true) {
+    g_autoptr(GSettings) settings = NULL;
+    {
+      g_autoptr(GSettingsSchemaSource) schema_source;
+      g_autoptr(GSettingsSchema) schema;
+      schema_source = g_settings_schema_source_new_from_directory("@EVO@", g_settings_schema_source_get_default(), TRUE, NULL);
+      schema = g_settings_schema_source_lookup(schema_source, "org.gnome.evolution.calendar", FALSE);
+      settings = g_settings_new_full(schema, NULL, NULL);
+    }
+  }
+}
+
+void exists_fn_unknown() {
+  if (true) {
+    g_autoptr(GSettings) settings = NULL;
+    {
+      g_autoptr(GSettingsSchemaSource) schema_source;
+      g_autoptr(GSettingsSchema) schema;
+      schema_source = g_settings_schema_source_new_from_directory("@EVO@", g_settings_schema_source_get_default(), TRUE, NULL);
+      schema = g_settings_schema_source_lookup(schema_source, "org.gnome.evolution.calendar", FALSE);
+      settings = g_settings_new_full(schema, NULL, NULL);
+    }
+  }
+}
+
+int main() {
+  schema_id_literal();
+  schema_id_from_constant();
+  schema_id_autoptr();
+  schema_id_with_backend();
+  schema_id_with_backend_and_path();
+  schema_id_with_path();
+  exists_fn_guard();
+  exists_fn_nested();
+  exists_fn_unknown();
+
+  return 0;
+}

pkgs/test/make-hardcode-gsettings-patch/fixtures/example-project-patched/main.c

@@ -73,6 +73,47 @@ void schema_id_with_path() {
   g_object_unref(settings);
 }
 
+void exists_fn_guard() {
+  if (!e_ews_common_utils_gsettings_schema_exists("org.gnome.evolution.calendar")) {
+    return;
+  }
+
+  g_autoptr(GSettings) settings = NULL;
+  {
+    g_autoptr(GSettingsSchemaSource) schema_source;
+    g_autoptr(GSettingsSchema) schema;
+    schema_source = g_settings_schema_source_new_from_directory("@EVO@", g_settings_schema_source_get_default(), TRUE, NULL);
+    schema = g_settings_schema_source_lookup(schema_source, "org.gnome.evolution.calendar", FALSE);
+    settings = g_settings_new_full(schema, NULL, NULL);
+  }
+}
+
+void exists_fn_nested() {
+  if (e_ews_common_utils_gsettings_schema_exists("org.gnome.evolution.calendar")) {
+    g_autoptr(GSettings) settings = NULL;
+    {
+      g_autoptr(GSettingsSchemaSource) schema_source;
+      g_autoptr(GSettingsSchema) schema;
+      schema_source = g_settings_schema_source_new_from_directory("@EVO@", g_settings_schema_source_get_default(), TRUE, NULL);
+      schema = g_settings_schema_source_lookup(schema_source, "org.gnome.evolution.calendar", FALSE);
+      settings = g_settings_new_full(schema, NULL, NULL);
+    }
+  }
+}
+
+void exists_fn_unknown() {
+  if (e_ews_common_utils_gsettings_schema_exists("org.gnome.foo")) {
+    g_autoptr(GSettings) settings = NULL;
+    {
+      g_autoptr(GSettingsSchemaSource) schema_source;
+      g_autoptr(GSettingsSchema) schema;
+      schema_source = g_settings_schema_source_new_from_directory("@EVO@", g_settings_schema_source_get_default(), TRUE, NULL);
+      schema = g_settings_schema_source_lookup(schema_source, "org.gnome.evolution.calendar", FALSE);
+      settings = g_settings_new_full(schema, NULL, NULL);
+    }
+  }
+}
+
 int main() {
   schema_id_literal();
   schema_id_from_constant();
@@ -80,6 +121,9 @@ int main() {
   schema_id_with_backend();
   schema_id_with_backend_and_path();
   schema_id_with_path();
+  exists_fn_guard();
+  exists_fn_nested();
+  exists_fn_unknown();
 
   return 0;
 }

pkgs/test/make-hardcode-gsettings-patch/fixtures/example-project/main.c

@@ -37,6 +37,29 @@ void schema_id_with_path() {
   g_object_unref(settings);
 }
 
+void exists_fn_guard() {
+  if (!e_ews_common_utils_gsettings_schema_exists("org.gnome.evolution.calendar")) {
+    return;
+  }
+
+  g_autoptr(GSettings) settings = NULL;
+  settings = g_settings_new("org.gnome.evolution.calendar");
+}
+
+void exists_fn_nested() {
+  if (e_ews_common_utils_gsettings_schema_exists("org.gnome.evolution.calendar")) {
+    g_autoptr(GSettings) settings = NULL;
+    settings = g_settings_new("org.gnome.evolution.calendar");
+  }
+}
+
+void exists_fn_unknown() {
+  if (e_ews_common_utils_gsettings_schema_exists("org.gnome.foo")) {
+    g_autoptr(GSettings) settings = NULL;
+    settings = g_settings_new("org.gnome.evolution.calendar");
+  }
+}
+
 int main() {
   schema_id_literal();
   schema_id_from_constant();
@@ -44,6 +67,9 @@ int main() {
   schema_id_with_backend();
   schema_id_with_backend_and_path();
   schema_id_with_path();
+  exists_fn_guard();
+  exists_fn_nested();
+  exists_fn_unknown();
 
   return 0;
 }

pkgs/tools/networking/networkmanager/default.nix

@@ -134,8 +134,6 @@ stdenv.mkDerivation (finalAttrs: {
         gnused
         ;
       inherit runtimeShell;
-      # patch context
-      OUTPUT = null;
     })
 
     # Meson does not support using different directories during build and

pkgs/tools/networking/networkmanager/fix-paths.patch

@@ -31,26 +31,6 @@ index f3441508ab..7cde8d7d39 100644
                  log_domain  = LOGD_IP6;
              }
          }
-diff --git a/src/libnm-client-impl/meson.build b/src/libnm-client-impl/meson.build
-index 3dd2338a82..de75cc040b 100644
---- a/src/libnm-client-impl/meson.build
-+++ b/src/libnm-client-impl/meson.build
-@@ -190,7 +190,6 @@ if enable_introspection
-       input: [gen_infos_cmd, libnm_gir[0]] + libnm_core_settings_sources,
-       output: 'nm-property-infos-' + name + '.xml',
-       command: [
--        python_path,
-         gen_infos_cmd,
-         name,
-         '@OUTPUT@',
-@@ -206,7 +205,6 @@ if enable_introspection
-         'env',
-         'GI_TYPELIB_PATH=' + gi_typelib_path,
-         'LD_LIBRARY_PATH=' + ld_library_path,
--        python_path,
-         gen_gir_cmd,
-         '--lib-path', meson.current_build_dir(),
-         '--gir', libnm_gir[0],
 diff --git a/src/libnmc-base/nm-vpn-helpers.c b/src/libnmc-base/nm-vpn-helpers.c
 index cbe76f5f1c..8515f94994 100644
 --- a/src/libnmc-base/nm-vpn-helpers.c
@@ -88,43 +68,3 @@ index cbe76f5f1c..8515f94994 100644
  
      oc_argv[oc_argc++] = path;
      oc_argv[oc_argc++] = "--authenticate";
-diff --git a/src/libnmc-setting/meson.build b/src/libnmc-setting/meson.build
-index 4d5079dfb3..5a15447fde 100644
---- a/src/libnmc-setting/meson.build
-+++ b/src/libnmc-setting/meson.build
-@@ -9,7 +9,6 @@ if enable_docs
-     input: [merge_cmd, nm_settings_docs_xml_gir['nmcli'], nm_property_infos_xml['nmcli']],
-     output: 'settings-docs-input.xml',
-     command: [
--      python_path,
-       merge_cmd,
-       '@OUTPUT@',
-       nm_property_infos_xml['nmcli'],
-@@ -23,7 +22,6 @@ if enable_docs
-     input: [gen_cmd, settings_docs_input_xml],
-     output: 'settings-docs.h',
-     command: [
--      python_path,
-       gen_cmd,
-       '--output', '@OUTPUT@',
-       '--xml', settings_docs_input_xml
-diff --git a/src/tests/client/meson.build b/src/tests/client/meson.build
-index 5686a1c174..cfb6649a21 100644
---- a/src/tests/client/meson.build
-+++ b/src/tests/client/meson.build
-@@ -6,7 +6,6 @@ test(
-   args: [
-     build_root,
-     source_root,
--    python_path,
-     '--',
-     'TestNmcli',
-   ],
-@@ -23,7 +22,6 @@ if enable_nm_cloud_setup
-     args: [
-       build_root,
-       source_root,
--      python_path,
-       '--',
-       'TestNmCloudSetup',
-     ],