Merge staging-next into staging

maintainers/maintainer-list.nix

@@ -7186,6 +7186,12 @@
     githubId = 28287;
     name = "Jon Roberts";
   };
+  encode42 = {
+    name = "encode42";
+    email = "me@encode42.dev";
+    github = "encode42";
+    githubId = 34699884;
+  };
   enderger = {
     email = "endergeryt@gmail.com";
     github = "enderger";
@@ -23609,6 +23615,13 @@
     githubId = 1901799;
     name = "Nathan van Doorn";
   };
+  tanya1866 = {
+    email = "tanyaarora@tutamail.com";
+    matrix = "@tanya1866:matrix.org";
+    github = "tanya1866";
+    githubId = 119473725;
+    name = "Tanya Arora";
+  };
   taranarmo = {
     email = "taranarmo@gmail.com";
     github = "taranarmo";

nixos/doc/manual/release-notes/rl-2505.section.md

@@ -85,8 +85,6 @@
 
 - [ncps](https://github.com/kalbasit/ncps), a Nix binary cache proxy service implemented in Go using [go-nix](https://github.com/nix-community/go-nix). Available as [services.ncps](options.html#opt-services.ncps.enable).
 
-- [Conduwuit](https://conduwuit.puppyirl.gay/), a federated chat server implementing the Matrix protocol, forked from Conduit. Available as [services.conduwuit](#opt-services.conduwuit.enable).
-
 - [Readeck](https://readeck.org/), a read-it later web-application. Available as [services.readeck](#opt-services.readeck.enable).
 
 - [Traccar](https://www.traccar.org/), a modern GPS Tracking Platform. Available as [services.traccar](#opt-services.traccar.enable).
@@ -345,9 +343,14 @@
   Given a site example.com, http://example.com now 301 redirects to https://example.com.
   To keep the old behavior for a site `example.com`, set `services.caddy.virtualHosts."example.com".hostName = "http://example.com"`.
 
+- `slskd` has been updated to v0.22.3, which includes breaking changes to `script` integrations. Please review the [changelog](https://github.com/slskd/slskd/releases/tag/0.22.3)
+  and the accompanying [pull request](https://github.com/slskd/slskd/pull/1292).
+
 - The behavior of `services.hostapd.radios.<name>.networks.<name>.authentication.enableRecommendedPairwiseCiphers` was changed to not include `CCMP-256` anymore.
   Since all configured pairwise ciphers have to be supported by the radio, this caused startup failures on many devices which is hard to debug in hostapd.
 
+- The `conduwuit` matrix server implementation has officially been discontinued by upstream and the package has thus been marked as vulnerable, as it is a security-sensitive package that has reached EOL.
+
 - `gkraken` software and `hardware.gkraken.enable` option have been removed, use `coolercontrol` via `programs.coolercontrol.enable` option instead.
 
 - To avoid delaying user logins unnecessarily the `multi-user.target` is no longer ordered after `network-online.target`.

nixos/modules/module-list.nix

@@ -748,7 +748,6 @@
   ./services/matrix/appservice-discord.nix
   ./services/matrix/appservice-irc.nix
   ./services/matrix/conduit.nix
-  ./services/matrix/conduwuit.nix
   ./services/matrix/dendrite.nix
   ./services/matrix/hebbot.nix
   ./services/matrix/hookshot.nix

nixos/modules/rename.nix

@@ -311,6 +311,10 @@ in
     (mkRemovedOptionModule [ "services" "rippleDataApi" ] ''
       The corresponding package was broken, abandoned upstream and thus removed from nixpkgs.
     '')
+    (mkRemovedOptionModule [ "services" "conduwuit" ] ''
+      The conduwuit project has been discontinued by upstream.
+      See https://github.com/NixOS/nixpkgs/pull/397902 for more information.
+    '')
 
     # Do NOT add any option renames here, see top of the file
   ];

nixos/modules/services/matrix/conduwuit.nix

@@ -1,265 +0,0 @@
-{
-  config,
-  lib,
-  pkgs,
-  ...
-}:
-let
-  cfg = config.services.conduwuit;
-  defaultUser = "conduwuit";
-  defaultGroup = "conduwuit";
-
-  format = pkgs.formats.toml { };
-  configFile = format.generate "conduwuit.toml" cfg.settings;
-in
-{
-  meta.maintainers = with lib.maintainers; [ niklaskorz ];
-  options.services.conduwuit = {
-    enable = lib.mkEnableOption "conduwuit";
-
-    user = lib.mkOption {
-      type = lib.types.nonEmptyStr;
-      description = ''
-        The user {command}`conduwuit` is run as.
-      '';
-      default = defaultUser;
-    };
-
-    group = lib.mkOption {
-      type = lib.types.nonEmptyStr;
-      description = ''
-        The group {command}`conduwuit` is run as.
-      '';
-      default = defaultGroup;
-    };
-
-    extraEnvironment = lib.mkOption {
-      type = lib.types.attrsOf lib.types.str;
-      description = "Extra Environment variables to pass to the conduwuit server.";
-      default = { };
-      example = {
-        RUST_BACKTRACE = "yes";
-      };
-    };
-
-    package = lib.mkPackageOption pkgs "conduwuit" { };
-
-    settings = lib.mkOption {
-      type = lib.types.submodule {
-        freeformType = format.type;
-        options = {
-          global.server_name = lib.mkOption {
-            type = lib.types.nonEmptyStr;
-            example = "example.com";
-            description = "The server_name is the name of this server. It is used as a suffix for user and room ids.";
-          };
-          global.address = lib.mkOption {
-            type = lib.types.nullOr (lib.types.listOf lib.types.nonEmptyStr);
-            default = null;
-            example = [
-              "127.0.0.1"
-              "::1"
-            ];
-            description = ''
-              Addresses (IPv4 or IPv6) to listen on for connections by the reverse proxy/tls terminator.
-              If set to `null`, conduwuit will listen on IPv4 and IPv6 localhost.
-              Must be `null` if `unix_socket_path` is set.
-            '';
-          };
-          global.port = lib.mkOption {
-            type = lib.types.listOf lib.types.port;
-            default = [ 6167 ];
-            description = ''
-              The port(s) conduwuit will be running on.
-              You need to set up a reverse proxy in your web server (e.g. apache or nginx),
-              so all requests to /_matrix on port 443 and 8448 will be forwarded to the conduwuit
-              instance running on this port.
-            '';
-          };
-          global.unix_socket_path = lib.mkOption {
-            type = lib.types.nullOr lib.types.path;
-            default = null;
-            description = ''
-              Listen on a UNIX socket at the specified path. If listening on a UNIX socket,
-              listening on an address will be disabled. The `address` option must be set to
-              `null` (the default value). The option {option}`services.conduwuit.group` must
-              be set to a group your reverse proxy is part of.
-
-              This will automatically add a system user "conduwuit" to your system if
-              {option}`services.conduwuit.user` is left at the default, and a "conduwuit"
-              group if {option}`services.conduwuit.group` is left at the default.
-            '';
-          };
-          global.unix_socket_perms = lib.mkOption {
-            type = lib.types.ints.positive;
-            default = 660;
-            description = "The default permissions (in octal) to create the UNIX socket with.";
-          };
-          global.max_request_size = lib.mkOption {
-            type = lib.types.ints.positive;
-            default = 20000000;
-            description = "Max request size in bytes. Don't forget to also change it in the proxy.";
-          };
-          global.allow_registration = lib.mkOption {
-            type = lib.types.bool;
-            default = false;
-            description = ''
-              Whether new users can register on this server.
-
-              Registration with token requires `registration_token` or `registration_token_file` to be set.
-
-              If set to true without a token configured, and
-              `yes_i_am_very_very_sure_i_want_an_open_registration_server_prone_to_abuse`
-              is set to true, users can freely register.
-            '';
-          };
-          global.allow_encryption = lib.mkOption {
-            type = lib.types.bool;
-            default = true;
-            description = "Whether new encrypted rooms can be created. Note: existing rooms will continue to work.";
-          };
-          global.allow_federation = lib.mkOption {
-            type = lib.types.bool;
-            default = true;
-            description = ''
-              Whether this server federates with other servers.
-            '';
-          };
-          global.trusted_servers = lib.mkOption {
-            type = lib.types.listOf lib.types.nonEmptyStr;
-            default = [ "matrix.org" ];
-            description = ''
-              Servers listed here will be used to gather public keys of other servers
-              (notary trusted key servers).
-
-              Currently, conduwuit doesn't support inbound batched key requests, so
-              this list should only contain other Synapse servers.
-
-              Example: `[ "matrix.org" "constellatory.net" "tchncs.de" ]`
-            '';
-          };
-          global.database_path = lib.mkOption {
-            readOnly = true;
-            type = lib.types.path;
-            default = "/var/lib/conduwuit/";
-            description = ''
-              Path to the conduwuit database, the directory where conduwuit will save its data.
-              Note that database_path cannot be edited because of the service's reliance on systemd StateDir.
-            '';
-          };
-          global.allow_check_for_updates = lib.mkOption {
-            type = lib.types.bool;
-            default = false;
-            description = ''
-              If enabled, conduwuit will send a simple GET request periodically to
-              <https://pupbrain.dev/check-for-updates/stable> for any new announcements made.
-              Despite the name, this is not an update check endpoint, it is simply an announcement check endpoint.
-
-              Disabled by default.
-            '';
-          };
-        };
-      };
-      default = { };
-      # TOML does not allow null values, so we use null to omit those fields
-      apply = lib.filterAttrsRecursive (_: v: v != null);
-      description = ''
-        Generates the conduwuit.toml configuration file. Refer to
-        <https://conduwuit.puppyirl.gay/configuration.html>
-        for details on supported values.
-      '';
-    };
-  };
-
-  config = lib.mkIf cfg.enable {
-    assertions = [
-      {
-        assertion = !(cfg.settings ? global.unix_socket_path) || !(cfg.settings ? global.address);
-        message = ''
-          In `services.conduwuit.settings.global`, `unix_socket_path` and `address` cannot be set at the
-          same time.
-          Leave one of the two options unset or explicitly set them to `null`.
-        '';
-      }
-      {
-        assertion = cfg.user != defaultUser -> config ? users.users.${cfg.user};
-        message = "If `services.conduwuit.user` is changed, the configured user must already exist.";
-      }
-      {
-        assertion = cfg.group != defaultGroup -> config ? users.groups.${cfg.group};
-        message = "If `services.conduwuit.group` is changed, the configured group must already exist.";
-      }
-    ];
-
-    users.users = lib.mkIf (cfg.user == defaultUser) {
-      ${defaultUser} = {
-        group = cfg.group;
-        home = cfg.settings.global.database_path;
-        isSystemUser = true;
-      };
-    };
-
-    users.groups = lib.mkIf (cfg.group == defaultGroup) {
-      ${defaultGroup} = { };
-    };
-
-    systemd.services.conduwuit = {
-      description = "Conduwuit Matrix Server";
-      documentation = [ "https://conduwuit.puppyirl.gay/" ];
-      wantedBy = [ "multi-user.target" ];
-      wants = [ "network-online.target" ];
-      after = [ "network-online.target" ];
-      environment = lib.mkMerge ([
-        { CONDUWUIT_CONFIG = configFile; }
-        cfg.extraEnvironment
-      ]);
-      startLimitBurst = 5;
-      startLimitIntervalSec = 60;
-      serviceConfig = {
-        DynamicUser = true;
-        User = cfg.user;
-        Group = cfg.group;
-
-        DevicePolicy = "closed";
-        LockPersonality = true;
-        MemoryDenyWriteExecute = true;
-        NoNewPrivileges = true;
-        ProtectClock = true;
-        ProtectControlGroups = true;
-        ProtectHome = true;
-        ProtectHostname = true;
-        ProtectKernelLogs = true;
-        ProtectKernelModules = true;
-        ProtectKernelTunables = true;
-        PrivateDevices = true;
-        PrivateMounts = true;
-        PrivateTmp = true;
-        PrivateUsers = true;
-        PrivateIPC = true;
-        RemoveIPC = true;
-        RestrictAddressFamilies = [
-          "AF_INET"
-          "AF_INET6"
-          "AF_UNIX"
-        ];
-        RestrictNamespaces = true;
-        RestrictRealtime = true;
-        SystemCallArchitectures = "native";
-        SystemCallFilter = [
-          "@system-service @resources"
-          "~@clock @debug @module @mount @reboot @swap @cpu-emulation @obsolete @timer @chown @setuid @privileged @keyring @ipc"
-        ];
-        SystemCallErrorNumber = "EPERM";
-
-        StateDirectory = "conduwuit";
-        StateDirectoryMode = "0700";
-        RuntimeDirectory = "conduwuit";
-        RuntimeDirectoryMode = "0750";
-
-        ExecStart = lib.getExe cfg.package;
-        Restart = "on-failure";
-        RestartSec = 10;
-      };
-    };
-  };
-}

nixos/tests/all-tests.nix

@@ -317,7 +317,6 @@ in
   coder = handleTest ./coder.nix { };
   collectd = handleTest ./collectd.nix { };
   commafeed = handleTest ./commafeed.nix { };
-  conduwuit = runTest ./matrix/conduwuit.nix;
   connman = handleTest ./connman.nix { };
   consul = handleTest ./consul.nix { };
   consul-template = handleTest ./consul-template.nix { };

nixos/tests/matrix/conduwuit.nix

@@ -1,103 +0,0 @@
-{ lib, ... }:
-let
-  name = "conduwuit";
-in
-{
-  inherit name;
-
-  nodes = {
-    conduwuit = {
-      services.conduwuit = {
-        enable = true;
-        settings.global = {
-          server_name = name;
-          address = [ "0.0.0.0" ];
-          allow_registration = true;
-          yes_i_am_very_very_sure_i_want_an_open_registration_server_prone_to_abuse = true;
-        };
-        extraEnvironment.RUST_BACKTRACE = "yes";
-      };
-      networking.firewall.allowedTCPPorts = [ 6167 ];
-    };
-    client =
-      { pkgs, ... }:
-      {
-        environment.systemPackages = [
-          (pkgs.writers.writePython3Bin "do_test" { libraries = [ pkgs.python3Packages.matrix-nio ]; } ''
-            import asyncio
-            import nio
-
-
-            async def main() -> None:
-                # Connect to conduwuit
-                client = nio.AsyncClient("http://conduwuit:6167", "alice")
-
-                # Register as user alice
-                response = await client.register("alice", "my-secret-password")
-
-                # Log in as user alice
-                response = await client.login("my-secret-password")
-
-                # Create a new room
-                response = await client.room_create(federate=False)
-                print("Matrix room create response:", response)
-                assert isinstance(response, nio.RoomCreateResponse)
-                room_id = response.room_id
-
-                # Join the room
-                response = await client.join(room_id)
-                print("Matrix join response:", response)
-                assert isinstance(response, nio.JoinResponse)
-
-                # Send a message to the room
-                response = await client.room_send(
-                    room_id=room_id,
-                    message_type="m.room.message",
-                    content={
-                        "msgtype": "m.text",
-                        "body": "Hello conduwuit!"
-                    }
-                )
-                print("Matrix room send response:", response)
-                assert isinstance(response, nio.RoomSendResponse)
-
-                # Sync responses
-                response = await client.sync(timeout=30000)
-                print("Matrix sync response:", response)
-                assert isinstance(response, nio.SyncResponse)
-
-                # Check the message was received by conduwuit
-                last_message = response.rooms.join[room_id].timeline.events[-1].body
-                assert last_message == "Hello conduwuit!"
-
-                # Leave the room
-                response = await client.room_leave(room_id)
-                print("Matrix room leave response:", response)
-                assert isinstance(response, nio.RoomLeaveResponse)
-
-                # Close the client
-                await client.close()
-
-
-            if __name__ == "__main__":
-                asyncio.run(main())
-          '')
-        ];
-      };
-  };
-
-  testScript = ''
-    start_all()
-
-    with subtest("start conduwuit"):
-          conduwuit.wait_for_unit("conduwuit.service")
-          conduwuit.wait_for_open_port(6167)
-
-    with subtest("ensure messages can be exchanged"):
-          client.succeed("do_test >&2")
-  '';
-
-  meta.maintainers = with lib.maintainers; [
-    niklaskorz
-  ];
-}

pkgs/applications/emulators/wine/base.nix

@@ -265,7 +265,7 @@ stdenv.mkDerivation (
             hidden="$(dirname "$prog")/.$(basename "$prog")"
             mv "$prog" "$hidden"
             makeWrapper "$hidden" "$prog" \
-              --inherit-argv0 \
+              ${lib.optionalString (lib.versionAtLeast version "10.1") "--inherit-argv0"} \
               --set WINELOADER "$hidden" \
               --prefix GST_PLUGIN_SYSTEM_PATH_1_0 ":" "$GST_PLUGIN_SYSTEM_PATH_1_0"
           fi

pkgs/by-name/af/affine/package.nix

@@ -21,6 +21,8 @@
   nix-update-script,
   buildType ? "stable",
   commandLineArgs ? "",
+  llvmPackages,
+  apple-sdk_15,
 }:
 let
   hostPlatform = stdenvNoCC.hostPlatform;
@@ -41,17 +43,17 @@ in
 stdenv.mkDerivation (finalAttrs: {
   pname = binName;
 
-  version = "0.20.5";
+  version = "0.21.2";
   src = fetchFromGitHub {
     owner = "toeverything";
     repo = "AFFiNE";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-eMVHwjJe6u3A3Dxo6SurusRuMksp/moPmXAUv0FXBwc=";
+    hash = "sha256-d5dHHiiCXhzn8qJlCqJVw0qC86PvKyDZstPivX9bpCI=";
   };
 
   cargoDeps = rustPlatform.fetchCargoVendor {
     inherit (finalAttrs) pname version src;
-    hash = "sha256-Ob+A7NMTFuJ2wmRkHmemHnqkEAiY7G8NyxXXrT7NTR8=";
+    hash = "sha256-0vhUeqCStM7P8+sDs3ZI+JlEzPAreoP+1X8x5zKOJUo=";
   };
   yarnOfflineCache = stdenvNoCC.mkDerivation {
     name = "yarn-offline-cache";
@@ -96,8 +98,13 @@ stdenv.mkDerivation (finalAttrs: {
       '';
     dontInstall = true;
     outputHashMode = "recursive";
-    outputHash = "sha256-e5GNWgeYw4CcpOGDd/LNk+syBupqAuws0hz+wUbaFL4=";
+    outputHash = "sha256-pJiMCyBJSuTaxix3kKnSCrURL2+t26zB4Y59gGdxalo=";
   };
+
+  buildInputs = lib.optionals hostPlatform.isDarwin [
+    apple-sdk_15
+  ];
+
   nativeBuildInputs =
     [
       nodejs
@@ -113,10 +120,18 @@ stdenv.mkDerivation (finalAttrs: {
     ++ lib.optionals hostPlatform.isLinux [
       copyDesktopItems
       makeWrapper
+    ]
+    ++ lib.optionals hostPlatform.isDarwin [
+      # bindgenHook is needed to build `coreaudio-sys` on darwin
+      rustPlatform.bindgenHook
     ];
 
-  # force yarn install run in CI mode
-  env.CI = "1";
+  env = {
+    # force yarn install run in CI mode
+    CI = "1";
+    # `LIBCLANG_PATH` is needed to build `coreaudio-sys` on darwin
+    LIBCLANG_PATH = lib.optionalString hostPlatform.isDarwin "${lib.getLib llvmPackages.libclang}/lib";
+  };
 
   # Remove code under The AFFiNE Enterprise Edition (EE) license.
   # Keep file package.json for `yarn install --immutable` lockfile check.

pkgs/by-name/ap/aporetic-bin/package.nix

@@ -0,0 +1,39 @@
+{
+  stdenvNoCC,
+  lib,
+  fetchFromGitHub,
+}:
+
+stdenvNoCC.mkDerivation (finalAttrs: {
+  pname = "aporetic-bin";
+  version = "1.1.0";
+
+  src = fetchFromGitHub {
+    owner = "protesilaos";
+    repo = "aporetic";
+    tag = finalAttrs.version;
+    hash = "sha256-5lPViAo9SztOdds6HEmKJpT17tgcxmU/voXDffxTMDI=";
+  };
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p $out/share/fonts/truetype
+    cp -r $src/{aporetic-sans-mono,aporetic-sans,aporetic-serif-mono,aporetic-serif} $out/share/fonts/truetype
+
+    runHook postInstall
+  '';
+
+  meta = {
+    homepage = "https://github.com/protesilaos/aporetic";
+    description = ''
+      Custom build of Iosevka with different style and metrics than the default. This is the successor to my "Iosevka Comfy" fonts.
+    '';
+    license = lib.licenses.ofl;
+    platforms = lib.platforms.all;
+    maintainers = with lib.maintainers; [
+      DamienCassou
+      drupol
+    ];
+  };
+})

pkgs/by-name/ap/aporetic/package.nix

@@ -17,9 +17,9 @@ let
   version = "1.1.0";
   src = fetchFromGitHub {
     owner = "protesilaos";
-    repo = pname;
-    rev = version;
-    sha256 = "sha256-5lPViAo9SztOdds6HEmKJpT17tgcxmU/voXDffxTMDI=";
+    repo = "aporetic";
+    tag = version;
+    hash = "sha256-5lPViAo9SztOdds6HEmKJpT17tgcxmU/voXDffxTMDI=";
   };
   privateBuildPlan = src.outPath + "/private-build-plans.toml";
   makeIosevkaFont =
@@ -45,21 +45,22 @@ let
             };
 
             npmDepsHash = "sha256-HeqwpZyHLHdMhd/UfXVBonMu+PhStrLCxAMuP/KuTT8=";
-
-            meta = with lib; {
-              inherit (src.meta) homepage;
-              description = ''
-                Customised build of the Iosevka typeface, with a consistent rounded style and overrides for almost all individual glyphs in both roman (upright) and italic (slanted) variants.
-              '';
-              license = licenses.ofl;
-              platforms = iosevka.meta.platforms;
-              maintainers = [ maintainers.DamienCassou ];
-            };
           }
         );
     });
 in
 symlinkJoin {
   inherit pname version;
+
   paths = (builtins.map makeIosevkaFont sets);
+
+  meta = {
+    inherit (src.meta) homepage;
+    description = ''
+      Custom build of Iosevka with different style and metrics than the default, successor to my "Iosevka Comfy" fonts
+    '';
+    license = lib.licenses.ofl;
+    platforms = iosevka.meta.platforms;
+    maintainers = [ lib.maintainers.DamienCassou ];
+  };
 }

pkgs/by-name/au/authentik/package.nix

@@ -7,6 +7,7 @@
   buildNpmPackage,
   buildGoModule,
   runCommand,
+  bash,
   chromedriver,
   openapi-generator-cli,
   nodejs,
@@ -343,6 +344,8 @@ stdenvNoCC.mkDerivation {
   pname = "authentik";
   inherit src version;
 
+  buildInputs = [ bash ];
+
   postPatch = ''
     rm Makefile
     patchShebangs lifecycle/ak

pkgs/by-name/ay/ayatana-indicator-session/package.nix

@@ -22,13 +22,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "ayatana-indicator-session";
-  version = "24.5.0";
+  version = "24.5.1";
 
   src = fetchFromGitHub {
     owner = "AyatanaIndicators";
     repo = "ayatana-indicator-session";
     tag = finalAttrs.version;
-    hash = "sha256-p4nu7ZgnEjnnxNqyZIg//YcssnQcCY7GFDbpGIu1dz0=";
+    hash = "sha256-jqcgQTsC4VBit3wwtKKTdEG71CUPJpeMtpzikE4IGhE=";
   };
 
   postPatch = ''

pkgs/by-name/co/conduwuit/package.nix

@@ -15,7 +15,6 @@
   rust-jemalloc-sys,
   enableLiburing ? stdenv.hostPlatform.isLinux,
   liburing,
-  nixosTests,
 }:
 let
   rust-jemalloc-sys' = rust-jemalloc-sys.override {
@@ -81,16 +80,12 @@ rustPlatform.buildRustPackage rec {
 
   passthru = {
     updateScript = nix-update-script { };
-    tests =
-      {
-        version = testers.testVersion {
-          inherit version;
-          package = conduwuit;
-        };
-      }
-      // lib.optionalAttrs stdenv.hostPlatform.isLinux {
-        inherit (nixosTests) conduwuit;
+    tests = {
+      version = testers.testVersion {
+        inherit version;
+        package = conduwuit;
       };
+    };
   };
 
   meta = {
@@ -98,6 +93,9 @@ rustPlatform.buildRustPackage rec {
     homepage = "https://conduwuit.puppyirl.gay/";
     changelog = "https://github.com/girlbossceo/conduwuit/releases/tag/v${version}";
     license = lib.licenses.asl20;
+    knownVulnerabilities = [
+      "On April 11, 2025, the conduwuit project officially ceased development"
+    ];
     maintainers = with lib.maintainers; [ niklaskorz ];
     # Not a typo, conduwuit is a drop-in replacement for conduit.
     mainProgram = "conduit";

pkgs/by-name/fi/firewalld/add-config-path-env-var.patch

@@ -0,0 +1,12 @@
+--- a/src/firewall/config/__init__.py.in
++++ b/src/firewall/config/__init__.py.in
+@@ -80,7 +80,8 @@
+     FIREWALLD_POLICIES = path + "/policies"
+ 
+ 
+-set_default_config_paths("/usr/lib/firewalld")
++import os
++set_default_config_paths(os.environ.get("NIX_FIREWALLD_CONFIG_PATH", "/usr/lib/firewalld"))
+ 
+ FIREWALLD_LOGFILE = "/var/log/firewalld"
+ 

pkgs/by-name/fi/firewalld/package.nix

@@ -2,20 +2,27 @@
   lib,
   stdenv,
   fetchFromGitHub,
-  autoreconfHook,
-  bash,
+  autoconf,
+  automake,
   docbook_xml_dtd_42,
   docbook-xsl-nons,
   glib,
   gobject-introspection,
   gtk3,
   intltool,
+  ipset,
+  iptables,
+  kdePackages,
+  kmod,
   libnotify,
   libxml2,
   libxslt,
+  networkmanager,
   networkmanagerapplet,
   pkg-config,
   python3,
+  qt6,
+  sysctl,
   wrapGAppsNoGuiHook,
   withGui ? false,
 }:
@@ -30,8 +37,7 @@ let
       pygobject3
     ]
     ++ lib.optionals withGui [
-      pyqt5
-      pyqt5-sip
+      pyqt6
     ]
   );
 in
@@ -47,27 +53,32 @@ stdenv.mkDerivation rec {
   };
 
   patches = [
+    ./add-config-path-env-var.patch
     ./respect-xml-catalog-files-var.patch
+    ./specify-localedir.patch
   ];
 
   postPatch =
     ''
-      substituteInPlace src/firewall/config/__init__.py.in \
-        --replace "/usr/share" "$out/share"
+      substituteInPlace config/xmlschema/check.sh \
+        --replace-fail /usr/bin/ ""
 
-      for file in config/firewall-{applet,config}.desktop.in; do
-        substituteInPlace $file \
-          --replace "/usr/bin/" "$out/bin/"
+      for file in src/{firewall-offline-cmd.in,firewall/config/__init__.py.in} \
+        config/firewall-{applet,config}.desktop.in; do
+          substituteInPlace $file \
+            --replace-fail /usr "$out"
       done
     ''
     + lib.optionalString withGui ''
       substituteInPlace src/firewall-applet.in \
-        --replace "/usr/bin/nm-connection-editor" "${networkmanagerapplet}/bin/nm-connection-editor"
+        --replace-fail "/usr/bin/systemsettings" "${kdePackages.systemsettings}/bin/systemsettings" \
+        --replace-fail "/usr/bin/nm-connection-editor" "${networkmanagerapplet}/bin/nm-connection-editor"
     '';
 
   nativeBuildInputs =
     [
-      autoreconfHook
+      autoconf
+      automake
       docbook_xml_dtd_42
       docbook-xsl-nons
       glib
@@ -77,40 +88,78 @@ stdenv.mkDerivation rec {
       pkg-config
       python3
       python3.pkgs.wrapPython
+      wrapGAppsNoGuiHook
     ]
     ++ lib.optionals withGui [
-      gobject-introspection
-      wrapGAppsNoGuiHook
+      qt6.wrapQtAppsHook
     ];
 
   buildInputs =
     [
-      bash
       glib
+      gobject-introspection
+      ipset
+      iptables
+      kmod
+      networkmanager
+      pythonPath
+      sysctl
     ]
     ++ lib.optionals withGui [
       gtk3
       libnotify
-      pythonPath
+      qt6.qtbase
     ];
 
-  dontWrapGApps = true;
-
-  preFixup = lib.optionalString withGui ''
-    makeWrapperArgs+=("''${gappsWrapperArgs[@]}")
+  preConfigure = ''
+    ./autogen.sh
   '';
 
+  ac_cv_path_MODPROBE = lib.getExe' kmod "modprobe";
+  ac_cv_path_RMMOD = lib.getExe' kmod "rmmod";
+  ac_cv_path_SYSCTL = lib.getExe' sysctl "sysctl";
+
+  configureFlags = [
+    "--with-iptables=${lib.getExe' iptables "iptables"}"
+    "--with-iptables-restore=${lib.getExe' iptables "iptables-restore"}"
+    "--with-ip6tables=${lib.getExe' iptables "ip6tables"}"
+    "--with-ip6tables-restore=${lib.getExe' iptables "ip6tables-restore"}"
+    "--with-ebtables=${lib.getExe' iptables "ebtables"}"
+    "--with-ebtables-restore=${lib.getExe' iptables "ebtables-restore"}"
+    "--with-ipset=${lib.getExe' ipset "ipset"}"
+  ];
+
+  postInstall =
+    ''
+      rm -r $out/share/firewalld/testsuite
+    ''
+    + lib.optionalString (!withGui) ''
+      rm $out/bin/firewall-{applet,config}
+    '';
+
+  dontWrapGApps = true;
+  dontWrapQtApps = true;
+
+  preFixup =
+    ''
+      makeWrapperArgs+=("''${gappsWrapperArgs[@]}")
+    ''
+    + lib.optionalString withGui ''
+      makeWrapperArgs+=("''${qtWrapperArgs[@]}")
+    '';
+
   postFixup = ''
-    chmod +x $out/share/firewalld/*.py $out/share/firewalld/testsuite/python/*.py $out/share/firewalld/testsuite/{,integration/}testsuite
-    patchShebangs --host $out/share/firewalld/testsuite/{,integration/}testsuite $out/share/firewalld/*.py
+    chmod +x $out/share/firewalld/*.py
+    patchShebangs --host $out/share/firewalld/*.py
     wrapPythonProgramsIn "$out/bin" "$out ${pythonPath}"
-    wrapPythonProgramsIn "$out/share/firewalld/testsuite/python" "$out ${pythonPath}"
   '';
 
-  meta = with lib; {
+  meta = {
     description = "Firewall daemon with D-Bus interface";
-    homepage = "https://github.com/firewalld/firewalld";
-    license = licenses.gpl2Plus;
-    maintainers = [ ];
+    homepage = "https://firewalld.org";
+    downloadPage = "https://github.com/firewalld/firewalld/releases";
+    license = lib.licenses.gpl2Plus;
+    maintainers = with lib.maintainers; [ prince213 ];
+    platforms = lib.platforms.linux;
   };
 }

pkgs/by-name/fi/firewalld/specify-localedir.patch

@@ -0,0 +1,12 @@
+--- a/src/firewall/config/__init__.py.in
++++ b/src/firewall/config/__init__.py.in
+@@ -19,6 +19,9 @@
+ DOMAIN = "firewalld"
+ import gettext
+ 
++locale.bindtextdomain(DOMAIN, "/usr/share/locale")
++gettext.bindtextdomain(DOMAIN, "/usr/share/locale")
++
+ gettext.install(domain=DOMAIN)
+ 
+ from . import dbus  # noqa: F401

pkgs/by-name/kn/knot-dns/package.nix

@@ -33,11 +33,11 @@
 
 stdenv.mkDerivation rec {
   pname = "knot-dns";
-  version = "3.4.5";
+  version = "3.4.6";
 
   src = fetchurl {
     url = "https://secure.nic.cz/files/knot-dns/knot-${version}.tar.xz";
-    sha256 = "sha256-NZr3Cvr6fMqhhDmnwes1Jw/57s6B0HVq5MpxaxQzy0s=";
+    sha256 = "sha256-0ZxaH/lLTyYCfWNd4Qjb/Ij1ZSvobMs7qaRO6b4OWDk=";
   };
 
   outputs = [

pkgs/by-name/li/libhydrogen/package.nix

@@ -0,0 +1,65 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  testers,
+  pkg-config,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "libhydrogen";
+  version = "0-unstable-2025-04-06";
+
+  src = fetchFromGitHub {
+    owner = "jedisct1";
+    repo = "libhydrogen";
+    rev = "bbca575b62510bfdc6dd927a4bfa7df4a51cb846";
+    hash = "sha256-sLOE3oR53hmvRqIPD5PU9Q04TFqw2KuWT1OQBA/KdRc=";
+  };
+
+  outputs = [
+    "out"
+    "dev"
+  ];
+
+  nativeBuildInputs = [ pkg-config ];
+  enableParallelBuilding = true;
+
+  makeFlags = [
+    "PREFIX=${placeholder "out"}"
+    "INCLUDE_INSTALL_DIR=${placeholder "dev"}/include"
+    "LIBRARY_INSTALL_DIR=${placeholder "out"}/lib"
+    "PKGCONFIG_INSTALL_DIR=${placeholder "dev"}/lib/pkgconfig"
+    "lib"
+  ];
+
+  checkTarget = "test";
+
+  postInstall = ''
+    mkdir -p "$dev/lib/pkgconfig"
+    cat > "$dev/lib/pkgconfig/libhydrogen.pc" <<EOF
+    Name: libhydrogen
+    Description: Lightweight cryptographic library
+    Version: ${finalAttrs.version}
+    Libs: -L$out/lib -lhydrogen
+    Cflags: -I$dev/include
+    EOF
+  '';
+
+  doCheck = true;
+
+  preCheck = ''
+    export LD_LIBRARY_PATH=$PWD:$LD_LIBRARY_PATH
+  '';
+
+  passthru.tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
+
+  meta = {
+    description = "Lightweight, secure, easy-to-use crypto library suitable for constrained environments";
+    homepage = "https://github.com/jedisct1/libhydrogen";
+    license = lib.licenses.isc;
+    maintainers = [ lib.maintainers.tanya1866 ];
+    pkgConfigModules = [ "libhydrogen" ];
+    platforms = lib.platforms.all;
+  };
+})

pkgs/by-name/mr/mrpack-install/package.nix

@@ -0,0 +1,82 @@
+{
+  lib,
+  stdenv,
+  buildGoModule,
+  fetchFromGitHub,
+  buildPackages,
+  installShellFiles,
+  nix-update-script,
+}:
+
+let
+  version = "0.16.10";
+in
+buildGoModule {
+  pname = "mrpack-install";
+  inherit version;
+
+  src = fetchFromGitHub {
+    owner = "nothub";
+    repo = "mrpack-install";
+    tag = "v${version}";
+    hash = "sha256-mTAXFK97t10imdICpg0UI4YLF744oscJqoOIBG5GEkc=";
+  };
+
+  vendorHash = "sha256-az+NpP/hCIq2IfO8Bmn/qG3JVypeDljJ0jWg6yT6hks=";
+
+  ldflags = [
+    "-s"
+    "-w"
+    "-X github.com/nothub/mrpack-install/buildinfo.version=${version}"
+    "-X github.com/nothub/mrpack-install/buildinfo.date=1970-01-01T00:00:00Z"
+  ];
+
+  checkFlags =
+    let
+      skippedTests = [
+        # Skip tests that require network access
+        "TestFetchMetadata"
+        "TestClient_VersionFromHash"
+        "TestClient_GetDependencies"
+        "TestClient_GetProjectVersions_Count"
+        "TestClient_GetVersion"
+        "TestClient_CheckProjectValidity_Slug"
+        "Test_GetProject_404"
+        "TestClient_GetProjects_Count"
+        "TestClient_GetProjectVersions_Filter_NoResults"
+        "Test_GetProject_Success"
+        "TestClient_CheckProjectValidity_Id"
+        "TestClient_GetLatestGameVersion"
+        "TestClient_GetProjectVersions_Filter_Results"
+        "TestClient_GetProjects_Slug"
+        "TestClient_GetVersions"
+        "TestGetPlayerUuid"
+      ];
+    in
+    [ "-skip=^${builtins.concatStringsSep "$|^" skippedTests}$" ];
+
+  nativeBuildInputs = [
+    installShellFiles
+  ];
+
+  postInstall =
+    let
+      mrpack-install = "${stdenv.hostPlatform.emulator buildPackages} $out/bin/mrpack-install";
+    in
+    lib.optionalString (stdenv.hostPlatform.emulatorAvailable buildPackages) ''
+      installShellCompletion --cmd mrpack-install \
+        --bash <(${mrpack-install} completion bash) \
+        --fish <(${mrpack-install} completion fish) \
+        --zsh <(${mrpack-install} completion zsh)
+    '';
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "CLI application for installing Minecraft servers and Modrinth modpacks";
+    homepage = "https://github.com/nothub/mrpack-install";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ encode42 ];
+    mainProgram = "mrpack-install";
+  };
+}

pkgs/by-name/si/signal-desktop-source/package.nix

@@ -18,7 +18,7 @@
 }:
 let
   nodejs = nodejs_22;
-  pnpm = pnpm_10;
+  pnpm = pnpm_10.override { inherit nodejs; };
   electron = electron_35;
 
   nodeOS =
@@ -39,6 +39,7 @@ let
       or (throw "unsupported platform ${stdenv.hostPlatform.parsed.cpu.name}");
 
   libsignal-node = callPackage ./libsignal-node.nix { inherit nodejs; };
+  signal-sqlcipher = callPackage ./signal-sqlcipher.nix { inherit pnpm nodejs; };
 
   webrtc = callPackage ./webrtc.nix { };
   ringrtc = callPackage ./ringrtc.nix { inherit webrtc; };
@@ -85,7 +86,7 @@ let
 
     nativeBuildInputs = [
       nodejs
-      (pnpm.override { inherit nodejs; }).configHook
+      pnpm.configHook
     ];
 
     buildPhase = ''
@@ -107,7 +108,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   nativeBuildInputs = [
     nodejs
-    (pnpm.override { inherit nodejs; }).configHook
+    pnpm.configHook
     makeWrapper
     copyDesktopItems
     python3
@@ -157,6 +158,11 @@ stdenv.mkDerivation (finalAttrs: {
       die "libsignal-client version mismatch"
     fi
 
+    if [ "`jq -r '.dependencies."@signalapp/sqlcipher"' < package.json`" != "${signal-sqlcipher.version}" ]
+    then
+      die "signal-sqlcipher version mismatch"
+    fi
+
     if [ "`jq -r '.dependencies."@signalapp/ringrtc"' < package.json`" != "${ringrtc.version}" ]
     then
       die "ringrtc version mismatch"
@@ -168,6 +174,9 @@ stdenv.mkDerivation (finalAttrs: {
 
     rm -fr node_modules/@signalapp/libsignal-client/prebuilds
     cp -r ${libsignal-node}/lib node_modules/@signalapp/libsignal-client/prebuilds
+
+    rm -fr node_modules/@signalapp/sqlcipher
+    cp -r ${signal-sqlcipher} node_modules/@signalapp/sqlcipher
   '';
 
   buildPhase = ''
@@ -235,6 +244,7 @@ stdenv.mkDerivation (finalAttrs: {
       ringrtc
       webrtc
       sticker-creator
+      signal-sqlcipher
       ;
     tests.application-launch = nixosTests.signal-desktop;
     updateScript.command = [ ./update.sh ];
@@ -265,12 +275,5 @@ stdenv.mkDerivation (finalAttrs: {
       "x86_64-linux"
       "aarch64-linux"
     ];
-    sourceProvenance = with lib.sourceTypes; [
-      fromSource
-
-      # @signalapp/sqlcipher
-      # ringrtc
-      binaryNativeCode
-    ];
   };
 })

pkgs/by-name/si/signal-desktop-source/signal-sqlcipher.nix

@@ -0,0 +1,74 @@
+{
+  stdenv,
+  lib,
+  fetchFromGitHub,
+  pnpm,
+  nodejs,
+  rustPlatform,
+  cargo,
+  dump_syms,
+  python3,
+}:
+stdenv.mkDerivation (finalAttrs: {
+  pname = "node-sqlcipher";
+  version = "1.0.0";
+
+  src = fetchFromGitHub {
+    owner = "signalapp";
+    repo = "node-sqlcipher";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-fuChNio2iWYuxIj40jW1lJCZItnQKrzX7m1gJeeajvs=";
+  };
+
+  pnpmDeps = pnpm.fetchDeps {
+    inherit (finalAttrs) pname version src;
+    hash = "sha256-regaYG+SDvIgdnHQVR1GG1A1FSBXpzFfLuyTEdMt1kQ=";
+  };
+
+  cargoRoot = "deps/extension";
+  cargoDeps = rustPlatform.fetchCargoVendor {
+    name = "sqlcipher-signal-exentsion";
+    inherit (finalAttrs) src cargoRoot;
+    hash = "sha256-qT4HM/FRL8qugKKNlMYM/0zgUsC6cDOa9fgd1d4VIrc=";
+  };
+
+  nativeBuildInputs = [
+    nodejs
+    pnpm.configHook
+    rustPlatform.cargoSetupHook
+    cargo
+    dump_syms
+    python3
+  ];
+
+  buildPhase = ''
+    runHook preBuild
+
+    export npm_config_nodedir=${nodejs}
+    pnpm run prebuildify
+    pnpm run build
+
+    runHook postBuild
+  '';
+
+  installPhase = ''
+    runHook preInstall
+
+    cp -r dist $out
+    cp -r prebuilds $out
+
+    runHook postInstall
+  '';
+
+  meta = {
+    description = "Fast N-API-based Node.js addon wrapping sqlcipher and FTS5 segmenting APIs";
+    homepage = "https://github.com/signalapp/node-sqlcipher/tree/main";
+    license = with lib.licenses; [
+      agpl3Only
+
+      # deps/sqlcipher
+      bsd3
+    ];
+    platforms = lib.platforms.linux;
+  };
+})

pkgs/by-name/si/signal-desktop-source/sqlite3.gyp

@@ -1,40 +0,0 @@
-{
-  'includes': ['common.gypi'],
-  'targets': [
-    {
-      'target_name': 'locate_sqlite3',
-      'type': 'none',
-      'copies': [{
-        'files': [
-          '@extension@/src/sqlite3.c',
-        ],
-        'destination': '<(SHARED_INTERMEDIATE_DIR)/sqlite3',
-      }],
-    },
-    {
-      'target_name': 'sqlite3',
-      'type': 'static_library',
-      'dependencies': ['locate_sqlite3'],
-      'sources': ['<(SHARED_INTERMEDIATE_DIR)/sqlite3/sqlite3.c'],
-      'include_dirs': [
-        '<(SHARED_INTERMEDIATE_DIR)/sqlite3/',
-      ],
-      'direct_dependent_settings': {
-        'include_dirs': [
-          '@extension@/include',
-        ],
-      },
-      'cflags': ['-std=c99', '-w'],
-      'xcode_settings': {
-        'OTHER_CFLAGS': ['-std=c99'],
-        'WARNING_CFLAGS': ['-w'],
-      },
-      'includes': ['defines.gypi'],
-      'link_settings': {
-        'libraries': [
-          '@extension@/lib/libsignal_sqlcipher_extension@static_lib_ext@',
-        ]
-      }
-    },
-  ],
-}

pkgs/by-name/si/signal-desktop-source/update.sh

@@ -22,6 +22,7 @@ latestVersion="`jq -r '.version' <<< $packageJson`"
 nodeVersion="`jq -r '.engines.node' <<< $packageJson | cut -d. -f1`"
 electronVersion="`jq -r '.devDependencies.electron' <<< $packageJson | cut -d. -f1`"
 libsignalClientVersion=`jq -r '.dependencies."@signalapp/libsignal-client"' <<< $packageJson`
+signalSqlcipherVersion=`jq -r '.dependencies."@signalapp/sqlcipher"' <<< $packageJson`
 ringrtcVersion=`jq -r '.dependencies."@signalapp/ringrtc"' <<< $packageJson`
 ringrtcVersionProperties="`curl_github "https://raw.githubusercontent.com/signalapp/ringrtc/refs/tags/v$ringrtcVersion/config/version.properties"`"
 webrtcVersion="`grep --only-matching "^webrtc.version=.*$" <<< $ringrtcVersionProperties | sed "s/webrtc.version=//g"`"
@@ -46,6 +47,15 @@ update-source-version signal-desktop-source.libsignal-node \
   --ignore-same-version \
   --source-key=npmDeps
 
+update-source-version signal-desktop-source.signal-sqlcipher \
+  "$signalSqlcipherVersion"
+update-source-version signal-desktop-source.signal-sqlcipher \
+  --ignore-same-version \
+  --source-key=cargoDeps.vendorStaging
+update-source-version signal-desktop-source.signal-sqlcipher \
+  --ignore-same-version \
+  --source-key=pnpmDeps
+
 update-source-version signal-desktop-source.ringrtc "$ringrtcVersion"
 update-source-version signal-desktop-source.ringrtc \
   --ignore-same-version \

pkgs/by-name/sl/slskd/deps.json

@@ -781,8 +781,8 @@
   },
   {
     "pname": "Soulseek",
-    "version": "6.5.0",
-    "hash": "sha256-QvWiuXMYYL+u3gez7MYP3uoDmQKljsU+oM2keyH7jD0="
+    "version": "7.0.1",
+    "hash": "sha256-sGs+AomE20UILH0+RcArkMAR/Xk7yewppMnvg2YZ1WQ="
   },
   {
     "pname": "SQLitePCLRaw.bundle_e_sqlite3",
@@ -1101,8 +1101,8 @@
   },
   {
     "pname": "System.Memory",
-    "version": "4.5.5",
-    "hash": "sha256-EPQ9o1Kin7KzGI5O3U3PUQAZTItSbk9h/i4rViN3WiI="
+    "version": "4.6.0",
+    "hash": "sha256-OhAEKzUM6eEaH99DcGaMz2pFLG/q/N4KVWqqiBYUOFo="
   },
   {
     "pname": "System.Net.Http",

pkgs/by-name/sl/slskd/package.nix

@@ -19,13 +19,13 @@ let
 in
 buildDotnetModule rec {
   pname = "slskd";
-  version = "0.22.2";
+  version = "0.22.3";
 
   src = fetchFromGitHub {
     owner = "slskd";
     repo = "slskd";
     tag = version;
-    hash = "sha256-Arf/QOq0wYely+CYwb4sJXsxB2BbEHZ2bUNyqeGbFdg=";
+    hash = "sha256-CXJ55mtNVaPZVxuzYyiMjnJJZPAUlRc/DHKt6+ZfWHo=";
   };
 
   nativeBuildInputs = [
@@ -40,7 +40,7 @@ buildDotnetModule rec {
     name = "${pname}-${version}-npm-deps";
     inherit src;
     sourceRoot = "${src.name}/${npmRoot}";
-    hash = "sha256-eCHYPkE8eJKg0IX7hN9Wm9HsWKUFPW5T4e+o6N0CsNc=";
+    hash = "sha256-I/rgSIFFCA47Y22zbmrrdUWS7mHCxKmFwO3QNBHTdCM=";
   };
 
   projectFile = "slskd.sln";

pkgs/by-name/tr/trilium-next-desktop/package.nix

@@ -5,7 +5,7 @@
   fetchurl,
   makeBinaryWrapper,
   # use specific electron since it has to load a compiled module
-  electron_34,
+  electron_35,
   autoPatchelfHook,
   makeDesktopItem,
   copyDesktopItems,
@@ -15,7 +15,7 @@
 
 let
   pname = "trilium-next-desktop";
-  version = "0.92.6";
+  version = "0.92.7";
 
   triliumSource = os: arch: sha256: {
     url = "https://github.com/TriliumNext/Notes/releases/download/v${version}/TriliumNextNotes-v${version}-${os}-${arch}.zip";
@@ -26,10 +26,10 @@ let
   darwinSource = triliumSource "macos";
 
   # exposed like this for update.sh
-  x86_64-linux.sha256 = "1ky5w6iwqcsc66ywgamkfs9yd6bp51c3y69251pi4b365dwbglf5";
-  aarch64-linux.sha256 = "1zm6g2rkg31ahnn8y5h42vb632pqjg6d8kb4xkkrb4pp9h71sgjm";
-  x86_64-darwin.sha256 = "011y5vh0bfn73l8n4my5pdpgrvvicy1lvnjrb1qyaglg7gw2sy0r";
-  aarch64-darwin.sha256 = "05v6pk1h5y5kqwjkixji3a44dcr219320z0i6yvwv4d8mc943qhs";
+  x86_64-linux.sha256 = "0m907hc7bvamkvijsbxqg6ns7dv7qz02d5fsl6wgqx5vi6w02y9w";
+  aarch64-linux.sha256 = "1hb3sjkzz3d9vrjramz47l4aqqm7ah2k7a9s14csxllcjqjmv8nz";
+  x86_64-darwin.sha256 = "0qscjw2j0nyxvx9w6m4n9yb30wzk5xmg7ylf8yp0k58jxvi7b87q";
+  aarch64-darwin.sha256 = "1ah25g41x7kpjvwih59mfcf2lylwppdklrmmm1s1p2fn4261jds4";
 
   sources = {
     x86_64-linux = linuxSource "x64" x86_64-linux.sha256;
@@ -115,7 +115,7 @@ let
       asar pack $tmp/ $out/share/trilium/resources/app.asar
       rm -rf $tmp
 
-      makeWrapper ${lib.getExe electron_34} $out/bin/trilium \
+      makeWrapper ${lib.getExe electron_35} $out/bin/trilium \
         "''${gappsWrapperArgs[@]}" \
         --set-default ELECTRON_IS_DEV 0 \
         --add-flags $out/share/trilium/resources/app.asar

pkgs/by-name/tr/trilium-next-server/package.nix

@@ -7,12 +7,12 @@
 }:
 
 let
-  version = "0.92.6";
+  version = "0.92.7";
 
   serverSource_x64.url = "https://github.com/TriliumNext/Notes/releases/download/v${version}/TriliumNextNotes-Server-v${version}-linux-x64.tar.xz";
-  serverSource_x64.sha256 = "1mh7q11hwp5vrbdrwb0apmxkiv90i3163m8a3cbv0jhd5amv9rjv";
+  serverSource_x64.sha256 = "0ckwfk27wfskd8pk5blvcvn6pd4jmq0dys283gsqk271n8ca4537";
   serverSource_arm64.url = "https://github.com/TriliumNext/Notes/releases/download/v${version}/TriliumNextNotes-Server-v${version}-linux-arm64.tar.xz";
-  serverSource_arm64.sha256 = "1w5208izjifcq4vsryjpmw2nr140fk2h802q9lkil1646r2b5lyg";
+  serverSource_arm64.sha256 = "1lk0mf4h74d9z1w5jdfwbxsdh1mbbjr6gx0q0w0wg6y3ylyjcii9";
 
   serverSource =
     if stdenv.hostPlatform.isx86_64 then

pkgs/by-name/ve/vectorcode/package.nix

@@ -9,14 +9,14 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "vectorcode";
-  version = "0.5.3";
+  version = "0.5.5";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "Davidyz";
     repo = "VectorCode";
     tag = version;
-    hash = "sha256-Vfo+wY51b3triiDhURlMl1iKNlYDy7eqEtT9/RVNZCM=";
+    hash = "sha256-hoANo+CqGvMyFSPDVYVWJUf6UUo3n9C1Yu8xt5yrZUs=";
   };
 
   build-system = with python3Packages; [

pkgs/by-name/ya/yazi/plugins/yatline/default.nix

@@ -5,13 +5,13 @@
 }:
 mkYaziPlugin {
   pname = "yatline.yazi";
-  version = "0-unstable-2025-03-05";
+  version = "0-unstable-2025-04-11";
 
   src = fetchFromGitHub {
     owner = "imsi32";
     repo = "yatline.yazi";
-    rev = "6b0fc1ef5eca034460b4c69cb87c424103227a2e";
-    hash = "sha256-JiUik4umi+ujsJmHliUbLsIj7ZTKayrWAAM8HmRdjwk=";
+    rev = "90e0284b22f922e7e024c403e7e596359e3aa2a0";
+    hash = "sha256-99HcvxylfPf5MlAnDOi/eg3C1XwzKnGz/vmMTBnSm/o=";
   };
 
   meta = {

pkgs/by-name/zi/zint/fix-installation-of-cmake-files.patch

@@ -0,0 +1,39 @@
+From ba86d5d0826d221075329aaf67f1f4f8f868550f Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Sandro=20J=C3=A4ckel?= <sandro.jaeckel@gmail.com>
+Date: Fri, 11 Apr 2025 03:24:38 +0200
+Subject: [PATCH] Fix installation of cmake files
+
+When binaries, libs and development files like include or cmake files
+are installed to different target directories then those where before
+relatively installed to the binary and not in the correct directory
+where other development related files where installed.
+
+Tested inside of nixpkgs with zxing using the system library of zint.
+---
+ CMakeLists.txt         | 2 +-
+ backend/CMakeLists.txt | 2 +-
+ 2 files changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/CMakeLists.txt b/CMakeLists.txt
+index 6f7cf220..ecfe53c3 100644
+--- a/CMakeLists.txt
++++ b/CMakeLists.txt
+@@ -201,4 +201,4 @@ if(ZINT_UNINSTALL)
+ endif()
+ 
+ configure_file("zint-config.cmake.in" "zint-config.cmake" @ONLY)
+-install(FILES "${CMAKE_CURRENT_BINARY_DIR}/zint-config.cmake" DESTINATION "${CMAKE_INSTALL_DATADIR}/zint")
++install(FILES "${CMAKE_CURRENT_BINARY_DIR}/zint-config.cmake" DESTINATION "${CMAKE_INSTALL_LIBDIR}/cmake/zint")
+diff --git a/backend/CMakeLists.txt b/backend/CMakeLists.txt
+index 45538515..1e7e40b3 100644
+--- a/backend/CMakeLists.txt
++++ b/backend/CMakeLists.txt
+@@ -131,7 +131,7 @@ endif()
+ if(ZINT_STATIC)
+     install(TARGETS zint-static EXPORT zint-targets ${INSTALL_TARGETS_DEFAULT_ARGS})
+ endif()
+-install(EXPORT zint-targets NAMESPACE zint:: DESTINATION "${CMAKE_INSTALL_DATADIR}/zint")
++install(EXPORT zint-targets NAMESPACE zint:: DESTINATION "${CMAKE_INSTALL_LIBDIR}/cmake/zint")
+ install(FILES zint.h DESTINATION ${CMAKE_INSTALL_INCLUDEDIR} COMPONENT Devel)
+ 
+ if(ZINT_TEST)

pkgs/by-name/zi/zint/package.nix

@@ -26,14 +26,11 @@ stdenv.mkDerivation (finalAttrs: {
     hash = "sha256-+dXIU66HIS2mE0pa99UemMMFBGCYjupUX8P7q3G7Nis=";
   };
 
-  postPatch = ''
+  patches = [
     # Fix cmake file installation
     # https://github.com/zint/zint/pull/8
-    substituteInPlace CMakeLists.txt \
-      --replace-fail 'DESTINATION "''${CMAKE_INSTALL_DATADIR}/zint"' 'DESTINATION lib/cmake/zint'
-    substituteInPlace backend/CMakeLists.txt \
-      --replace-fail 'DESTINATION "''${CMAKE_INSTALL_DATADIR}/zint"' 'DESTINATION lib/cmake/zint'
-  '';
+    ./fix-installation-of-cmake-files.patch
+  ];
 
   nativeBuildInputs = [
     cmake

pkgs/development/interpreters/php/8.3.nix

@@ -4,8 +4,8 @@ let
   base = callPackage ./generic.nix (
     _args
     // {
-      version = "8.3.19";
-      hash = "sha256-rWkCoqAvlOw+mYIGniZou6POR+L2u7q5Xra323vz01A=";
+      version = "8.3.20";
+      hash = "sha256-NrTmoyPNRWc6VPKW6dJma39d9XZBAxx3xP2BN7xOvrM=";
     }
   );
 in

pkgs/development/interpreters/php/8.4.nix

@@ -4,8 +4,8 @@ let
   base = callPackage ./generic.nix (
     _args
     // {
-      version = "8.4.5";
-      hash = "sha256-k3jHiIfQzXRi/FwX8t4wyFLyD3nSh5XiVz/jJQ05Q24=";
+      version = "8.4.6";
+      hash = "sha256-nPJzRQm2A/ZYlherUqlxKgPg/gWZUc3dLUYj30v3xsY=";
     }
   );
 in

pkgs/development/php-packages/parallel/default.nix

@@ -6,8 +6,8 @@
 
 buildPecl {
   pname = "parallel";
-  version = "1.2.4";
-  hash = "sha256-s9W9aZpQsJLdzZ/d2E1iGDsMTAAjeWbOgWeKP6nNp0A=";
+  version = "1.2.6";
+  hash = "sha256-tFQUbRxEb7gJlec0447akrngkJ0UZqojz5QNfXqvDcA=";
   meta = {
     description = "Parallel concurrency API";
     # parallel extension requires PHP with ZTS enabled

pkgs/development/php-packages/phalcon/default.nix

@@ -37,6 +37,5 @@ buildPecl rec {
     license = licenses.bsd3;
     homepage = "https://phalcon.io";
     maintainers = teams.php.members ++ [ maintainers.krzaczek ];
-    broken = lib.versionAtLeast php.version "8.4";
   };
 }

pkgs/development/python-modules/transformers/default.nix

@@ -58,14 +58,14 @@
 
 buildPythonPackage rec {
   pname = "transformers";
-  version = "4.51.1";
+  version = "4.51.2";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "huggingface";
     repo = "transformers";
     tag = "v${version}";
-    hash = "sha256-02HT0GAfEyGgqPvly7EPZX0loSeS2mJQNI87E8WbEGY=";
+    hash = "sha256-RBG0//uKSRO8wBGdaQe8KPeIUXUKAws+VlSXYYtUr+o=";
   };
 
   build-system = [ setuptools ];

pkgs/development/tools/qtcreator/default.nix

@@ -31,11 +31,11 @@
 
 stdenv.mkDerivation rec {
   pname = "qtcreator";
-  version = "16.0.0";
+  version = "16.0.1";
 
   src = fetchurl {
     url = "mirror://qt/official_releases/${pname}/${lib.versions.majorMinor version}/${version}/qt-creator-opensource-src-${version}.tar.xz";
-    hash = "sha256-GLQ1PmijHAYnEwCMBc5/fuiKqvVtWsDG3lebq/soN9o=";
+    hash = "sha256-Elz13fDOK9n7MTEE7Edy9iirpm1o6yOFCB+yJtiYMSw=";
   };
 
   nativeBuildInputs = [

pkgs/servers/sql/postgresql/ext/pg-gvm.nix

@@ -14,13 +14,13 @@
 
 postgresqlBuildExtension (finalAttrs: {
   pname = "pg-gvm";
-  version = "22.6.8";
+  version = "22.6.9";
 
   src = fetchFromGitHub {
     owner = "greenbone";
     repo = "pg-gvm";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-D8KpOTF+vcBNIn//8Y0Hwk4B+OBF2Hh3dkWyO2KYeqw=";
+    hash = "sha256-T1U7t6ORHtmWeg77PR4gUH4nn3ywVC3MnvqoEIpJ4aw=";
   };
 
   nativeBuildInputs = [

pkgs/top-level/aliases.nix

@@ -1565,6 +1565,7 @@ mapAliases {
   shipyard = jumppad; # Added 2023-06-06
   siduck76-st = st-snazzy; # Added 2024-12-24
   signal-desktop-beta = throw "signal-desktop-beta has been removed to make the signal-desktop package easier to maintain";
+  signal-desktop = lib.warnOnInstantiate "'signal-desktop' has been renamed to 'signal-desktop-bin'; in the future, 'signal-desktop' will point to 'signal-desktop-source'" signal-desktop-bin; # Added 2025-04-01
   sheesy-cli = throw "'sheesy-cli' has been removed due to lack of upstream maintenance"; # Added 2025-01-26
   shout = nodePackages.shout; # Added unknown; moved 2024-10-19
   sky = throw "'sky' has been removed because its upstream website disappeared"; # Added 2024-07-21