From 33e4cdc14b713e5af8e6bc2f2e4b27be17dbcfda Mon Sep 17 00:00:00 2001
From: encode42 <me@encode42.dev>
Date: Thu, 13 Feb 2025 23:47:58 -0500
Subject: [PATCH 01/40] maintainers: add encode42

---
 maintainers/maintainer-list.nix | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index b02dee4fe9a9..580a7e72a00c 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -6944,6 +6944,12 @@
     githubId = 28287;
     name = "Jon Roberts";
   };
+  encode42 = {
+    name = "encode42";
+    email = "me@encode42.dev";
+    github = "encode42";
+    githubId = 34699884;
+  };
   enderger = {
     email = "endergeryt@gmail.com";
     github = "enderger";

From 9d4eae5ed206647e73dab1d941ee08b95a4f7d06 Mon Sep 17 00:00:00 2001
From: Marcin Serwin <marcin@serwin.dev>
Date: Tue, 1 Apr 2025 23:12:41 +0200
Subject: [PATCH 02/40] signal-desktop: rename to signal-desktop-bin

---
 .../si/{signal-desktop => signal-desktop-bin}/copy-noto-emoji.py | 0
 .../si/{signal-desktop => signal-desktop-bin}/generic.nix        | 0
 .../si/{signal-desktop => signal-desktop-bin}/package.nix        | 0
 .../si/{signal-desktop => signal-desktop-bin}/pyproject.toml     | 0
 .../signal-desktop-aarch64.nix                                   | 0
 .../signal-desktop-darwin.nix                                    | 0
 .../si/{signal-desktop => signal-desktop-bin}/signal-desktop.nix | 0
 pkgs/by-name/si/{signal-desktop => signal-desktop-bin}/update.sh | 0
 pkgs/top-level/aliases.nix                                       | 1 +
 9 files changed, 1 insertion(+)
 rename pkgs/by-name/si/{signal-desktop => signal-desktop-bin}/copy-noto-emoji.py (100%)
 rename pkgs/by-name/si/{signal-desktop => signal-desktop-bin}/generic.nix (100%)
 rename pkgs/by-name/si/{signal-desktop => signal-desktop-bin}/package.nix (100%)
 rename pkgs/by-name/si/{signal-desktop => signal-desktop-bin}/pyproject.toml (100%)
 rename pkgs/by-name/si/{signal-desktop => signal-desktop-bin}/signal-desktop-aarch64.nix (100%)
 rename pkgs/by-name/si/{signal-desktop => signal-desktop-bin}/signal-desktop-darwin.nix (100%)
 rename pkgs/by-name/si/{signal-desktop => signal-desktop-bin}/signal-desktop.nix (100%)
 rename pkgs/by-name/si/{signal-desktop => signal-desktop-bin}/update.sh (100%)

diff --git a/pkgs/by-name/si/signal-desktop/copy-noto-emoji.py b/pkgs/by-name/si/signal-desktop-bin/copy-noto-emoji.py
similarity index 100%
rename from pkgs/by-name/si/signal-desktop/copy-noto-emoji.py
rename to pkgs/by-name/si/signal-desktop-bin/copy-noto-emoji.py
diff --git a/pkgs/by-name/si/signal-desktop/generic.nix b/pkgs/by-name/si/signal-desktop-bin/generic.nix
similarity index 100%
rename from pkgs/by-name/si/signal-desktop/generic.nix
rename to pkgs/by-name/si/signal-desktop-bin/generic.nix
diff --git a/pkgs/by-name/si/signal-desktop/package.nix b/pkgs/by-name/si/signal-desktop-bin/package.nix
similarity index 100%
rename from pkgs/by-name/si/signal-desktop/package.nix
rename to pkgs/by-name/si/signal-desktop-bin/package.nix
diff --git a/pkgs/by-name/si/signal-desktop/pyproject.toml b/pkgs/by-name/si/signal-desktop-bin/pyproject.toml
similarity index 100%
rename from pkgs/by-name/si/signal-desktop/pyproject.toml
rename to pkgs/by-name/si/signal-desktop-bin/pyproject.toml
diff --git a/pkgs/by-name/si/signal-desktop/signal-desktop-aarch64.nix b/pkgs/by-name/si/signal-desktop-bin/signal-desktop-aarch64.nix
similarity index 100%
rename from pkgs/by-name/si/signal-desktop/signal-desktop-aarch64.nix
rename to pkgs/by-name/si/signal-desktop-bin/signal-desktop-aarch64.nix
diff --git a/pkgs/by-name/si/signal-desktop/signal-desktop-darwin.nix b/pkgs/by-name/si/signal-desktop-bin/signal-desktop-darwin.nix
similarity index 100%
rename from pkgs/by-name/si/signal-desktop/signal-desktop-darwin.nix
rename to pkgs/by-name/si/signal-desktop-bin/signal-desktop-darwin.nix
diff --git a/pkgs/by-name/si/signal-desktop/signal-desktop.nix b/pkgs/by-name/si/signal-desktop-bin/signal-desktop.nix
similarity index 100%
rename from pkgs/by-name/si/signal-desktop/signal-desktop.nix
rename to pkgs/by-name/si/signal-desktop-bin/signal-desktop.nix
diff --git a/pkgs/by-name/si/signal-desktop/update.sh b/pkgs/by-name/si/signal-desktop-bin/update.sh
similarity index 100%
rename from pkgs/by-name/si/signal-desktop/update.sh
rename to pkgs/by-name/si/signal-desktop-bin/update.sh
diff --git a/pkgs/top-level/aliases.nix b/pkgs/top-level/aliases.nix
index d007fa62b3e7..99547c038813 100644
--- a/pkgs/top-level/aliases.nix
+++ b/pkgs/top-level/aliases.nix
@@ -1550,6 +1550,7 @@ mapAliases {
   shipyard = jumppad; # Added 2023-06-06
   siduck76-st = st-snazzy; # Added 2024-12-24
   signal-desktop-beta = throw "signal-desktop-beta has been removed to make the signal-desktop package easier to maintain";
+  signal-desktop = lib.warnOnInstantiate "'signal-desktop' has been renamed to 'signal-desktop-bin'; in the future, 'signal-desktop' will point to 'signal-desktop-source'" signal-desktop-bin; # Added 2025-04-01
   sheesy-cli = throw "'sheesy-cli' has been removed due to lack of upstream maintenance"; # Added 2025-01-26
   shout = nodePackages.shout; # Added unknown; moved 2024-10-19
   sky = throw "'sky' has been removed because its upstream website disappeared"; # Added 2024-07-21

From bbf3a5c5825d9db0fb91b75bb7d2ce1371cc6bab Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Tue, 8 Apr 2025 11:36:49 +0000
Subject: [PATCH 03/40] ayatana-indicator-session: 24.5.0 -> 24.5.1

---
 pkgs/by-name/ay/ayatana-indicator-session/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/ay/ayatana-indicator-session/package.nix b/pkgs/by-name/ay/ayatana-indicator-session/package.nix
index e6a2c4737bd4..24a1371488f9 100644
--- a/pkgs/by-name/ay/ayatana-indicator-session/package.nix
+++ b/pkgs/by-name/ay/ayatana-indicator-session/package.nix
@@ -22,13 +22,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "ayatana-indicator-session";
-  version = "24.5.0";
+  version = "24.5.1";
 
   src = fetchFromGitHub {
     owner = "AyatanaIndicators";
     repo = "ayatana-indicator-session";
     tag = finalAttrs.version;
-    hash = "sha256-p4nu7ZgnEjnnxNqyZIg//YcssnQcCY7GFDbpGIu1dz0=";
+    hash = "sha256-jqcgQTsC4VBit3wwtKKTdEG71CUPJpeMtpzikE4IGhE=";
   };
 
   postPatch = ''

From f86274ee35bea24fe3ab1ee671cc1c7983906bd5 Mon Sep 17 00:00:00 2001
From: Acid Bong <acidbong@tilde.club>
Date: Thu, 10 Apr 2025 14:46:03 +0300
Subject: [PATCH 04/40] wine: don't set argv0 in the wrapper for v10.0 and
 earlier
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

God, why didn't I check .stable 🤦

Fixes #397271
---
 pkgs/applications/emulators/wine/base.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/applications/emulators/wine/base.nix b/pkgs/applications/emulators/wine/base.nix
index 6c608bcdfdf7..0ca31e9695be 100644
--- a/pkgs/applications/emulators/wine/base.nix
+++ b/pkgs/applications/emulators/wine/base.nix
@@ -265,7 +265,7 @@ stdenv.mkDerivation (
             hidden="$(dirname "$prog")/.$(basename "$prog")"
             mv "$prog" "$hidden"
             makeWrapper "$hidden" "$prog" \
-              --inherit-argv0 \
+              ${lib.optionalString (lib.versionAtLeast version "10.1") "--inherit-argv0"} \
               --set WINELOADER "$hidden" \
               --prefix GST_PLUGIN_SYSTEM_PATH_1_0 ":" "$GST_PLUGIN_SYSTEM_PATH_1_0"
           fi

From eed8e360f56840c1651a6e2e8e2b5aed7707ea46 Mon Sep 17 00:00:00 2001
From: Seth Flynn <getchoo@tuta.io>
Date: Wed, 9 Apr 2025 22:56:12 -0400
Subject: [PATCH 05/40] slskd: 0.22.2 -> 0.22.3

Diff: https://github.com/slskd/slskd/compare/0.22.2...0.22.3

Changelog: https://github.com/slskd/slskd/releases/tag/0.22.3
---
 nixos/doc/manual/release-notes/rl-2505.section.md | 3 +++
 pkgs/by-name/sl/slskd/deps.json                   | 8 ++++----
 pkgs/by-name/sl/slskd/package.nix                 | 6 +++---
 3 files changed, 10 insertions(+), 7 deletions(-)

diff --git a/nixos/doc/manual/release-notes/rl-2505.section.md b/nixos/doc/manual/release-notes/rl-2505.section.md
index 4693f11f16b2..d79dc8a7acbd 100644
--- a/nixos/doc/manual/release-notes/rl-2505.section.md
+++ b/nixos/doc/manual/release-notes/rl-2505.section.md
@@ -298,6 +298,9 @@
   Given a site example.com, http://example.com now 301 redirects to https://example.com.
   To keep the old behavior for a site `example.com`, set `services.caddy.virtualHosts."example.com".hostName = "http://example.com"`.
 
+- `slskd` has been updated to v0.22.3, which includes breaking changes to `script` integrations. Please review the [changelog](https://github.com/slskd/slskd/releases/tag/0.22.3)
+  and the accompanying [pull request](https://github.com/slskd/slskd/pull/1292).
+
 - The behavior of `services.hostapd.radios.<name>.networks.<name>.authentication.enableRecommendedPairwiseCiphers` was changed to not include `CCMP-256` anymore.
   Since all configured pairwise ciphers have to be supported by the radio, this caused startup failures on many devices which is hard to debug in hostapd.
 
diff --git a/pkgs/by-name/sl/slskd/deps.json b/pkgs/by-name/sl/slskd/deps.json
index d8efc40b1a43..2229e5050cb4 100644
--- a/pkgs/by-name/sl/slskd/deps.json
+++ b/pkgs/by-name/sl/slskd/deps.json
@@ -781,8 +781,8 @@
   },
   {
     "pname": "Soulseek",
-    "version": "6.5.0",
-    "hash": "sha256-QvWiuXMYYL+u3gez7MYP3uoDmQKljsU+oM2keyH7jD0="
+    "version": "7.0.1",
+    "hash": "sha256-sGs+AomE20UILH0+RcArkMAR/Xk7yewppMnvg2YZ1WQ="
   },
   {
     "pname": "SQLitePCLRaw.bundle_e_sqlite3",
@@ -1101,8 +1101,8 @@
   },
   {
     "pname": "System.Memory",
-    "version": "4.5.5",
-    "hash": "sha256-EPQ9o1Kin7KzGI5O3U3PUQAZTItSbk9h/i4rViN3WiI="
+    "version": "4.6.0",
+    "hash": "sha256-OhAEKzUM6eEaH99DcGaMz2pFLG/q/N4KVWqqiBYUOFo="
   },
   {
     "pname": "System.Net.Http",
diff --git a/pkgs/by-name/sl/slskd/package.nix b/pkgs/by-name/sl/slskd/package.nix
index 1192c5536dd0..d022abfbc63c 100644
--- a/pkgs/by-name/sl/slskd/package.nix
+++ b/pkgs/by-name/sl/slskd/package.nix
@@ -19,13 +19,13 @@ let
 in
 buildDotnetModule rec {
   pname = "slskd";
-  version = "0.22.2";
+  version = "0.22.3";
 
   src = fetchFromGitHub {
     owner = "slskd";
     repo = "slskd";
     tag = version;
-    hash = "sha256-Arf/QOq0wYely+CYwb4sJXsxB2BbEHZ2bUNyqeGbFdg=";
+    hash = "sha256-CXJ55mtNVaPZVxuzYyiMjnJJZPAUlRc/DHKt6+ZfWHo=";
   };
 
   nativeBuildInputs = [
@@ -40,7 +40,7 @@ buildDotnetModule rec {
     name = "${pname}-${version}-npm-deps";
     inherit src;
     sourceRoot = "${src.name}/${npmRoot}";
-    hash = "sha256-eCHYPkE8eJKg0IX7hN9Wm9HsWKUFPW5T4e+o6N0CsNc=";
+    hash = "sha256-I/rgSIFFCA47Y22zbmrrdUWS7mHCxKmFwO3QNBHTdCM=";
   };
 
   projectFile = "slskd.sln";

From a6f2e1f2f1486688a060daccb539517846381a12 Mon Sep 17 00:00:00 2001
From: encode42 <me@encode42.dev>
Date: Thu, 13 Feb 2025 23:49:51 -0500
Subject: [PATCH 06/40] mrpack-install: init at 0.16.10

---
 pkgs/by-name/mr/mrpack-install/package.nix | 82 ++++++++++++++++++++++
 1 file changed, 82 insertions(+)
 create mode 100644 pkgs/by-name/mr/mrpack-install/package.nix

diff --git a/pkgs/by-name/mr/mrpack-install/package.nix b/pkgs/by-name/mr/mrpack-install/package.nix
new file mode 100644
index 000000000000..aa232e169d9b
--- /dev/null
+++ b/pkgs/by-name/mr/mrpack-install/package.nix
@@ -0,0 +1,82 @@
+{
+  lib,
+  stdenv,
+  buildGoModule,
+  fetchFromGitHub,
+  buildPackages,
+  installShellFiles,
+  nix-update-script,
+}:
+
+let
+  version = "0.16.10";
+in
+buildGoModule {
+  pname = "mrpack-install";
+  inherit version;
+
+  src = fetchFromGitHub {
+    owner = "nothub";
+    repo = "mrpack-install";
+    tag = "v${version}";
+    hash = "sha256-mTAXFK97t10imdICpg0UI4YLF744oscJqoOIBG5GEkc=";
+  };
+
+  vendorHash = "sha256-az+NpP/hCIq2IfO8Bmn/qG3JVypeDljJ0jWg6yT6hks=";
+
+  ldflags = [
+    "-s"
+    "-w"
+    "-X github.com/nothub/mrpack-install/buildinfo.version=${version}"
+    "-X github.com/nothub/mrpack-install/buildinfo.date=1970-01-01T00:00:00Z"
+  ];
+
+  checkFlags =
+    let
+      skippedTests = [
+        # Skip tests that require network access
+        "TestFetchMetadata"
+        "TestClient_VersionFromHash"
+        "TestClient_GetDependencies"
+        "TestClient_GetProjectVersions_Count"
+        "TestClient_GetVersion"
+        "TestClient_CheckProjectValidity_Slug"
+        "Test_GetProject_404"
+        "TestClient_GetProjects_Count"
+        "TestClient_GetProjectVersions_Filter_NoResults"
+        "Test_GetProject_Success"
+        "TestClient_CheckProjectValidity_Id"
+        "TestClient_GetLatestGameVersion"
+        "TestClient_GetProjectVersions_Filter_Results"
+        "TestClient_GetProjects_Slug"
+        "TestClient_GetVersions"
+        "TestGetPlayerUuid"
+      ];
+    in
+    [ "-skip=^${builtins.concatStringsSep "$|^" skippedTests}$" ];
+
+  nativeBuildInputs = [
+    installShellFiles
+  ];
+
+  postInstall =
+    let
+      mrpack-install = "${stdenv.hostPlatform.emulator buildPackages} $out/bin/mrpack-install";
+    in
+    lib.optionalString (stdenv.hostPlatform.emulatorAvailable buildPackages) ''
+      installShellCompletion --cmd mrpack-install \
+        --bash <(${mrpack-install} completion bash) \
+        --fish <(${mrpack-install} completion fish) \
+        --zsh <(${mrpack-install} completion zsh)
+    '';
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "CLI application for installing Minecraft servers and Modrinth modpacks";
+    homepage = "https://github.com/nothub/mrpack-install";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ encode42 ];
+    mainProgram = "mrpack-install";
+  };
+}

From 70f265fa7b376c47eeb56cd0917618d7f6574810 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Fri, 11 Apr 2025 01:01:28 +0000
Subject: [PATCH 07/40] knot-dns: 3.4.5 -> 3.4.6

---
 pkgs/by-name/kn/knot-dns/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/kn/knot-dns/package.nix b/pkgs/by-name/kn/knot-dns/package.nix
index a0cee0a2722d..f2c58300c055 100644
--- a/pkgs/by-name/kn/knot-dns/package.nix
+++ b/pkgs/by-name/kn/knot-dns/package.nix
@@ -33,11 +33,11 @@
 
 stdenv.mkDerivation rec {
   pname = "knot-dns";
-  version = "3.4.5";
+  version = "3.4.6";
 
   src = fetchurl {
     url = "https://secure.nic.cz/files/knot-dns/knot-${version}.tar.xz";
-    sha256 = "sha256-NZr3Cvr6fMqhhDmnwes1Jw/57s6B0HVq5MpxaxQzy0s=";
+    sha256 = "sha256-0ZxaH/lLTyYCfWNd4Qjb/Ij1ZSvobMs7qaRO6b4OWDk=";
   };
 
   outputs = [

From 3280fce729208100762506869d9fc1c3be70aede Mon Sep 17 00:00:00 2001
From: Pol Dellaiera <pol.dellaiera@protonmail.com>
Date: Fri, 11 Apr 2025 06:53:43 +0200
Subject: [PATCH 08/40] aporetic: add `meta` attribute

---
 pkgs/by-name/ap/aporetic/package.nix | 27 ++++++++++++++-------------
 1 file changed, 14 insertions(+), 13 deletions(-)

diff --git a/pkgs/by-name/ap/aporetic/package.nix b/pkgs/by-name/ap/aporetic/package.nix
index acfd47d95aca..54b2f4f50673 100644
--- a/pkgs/by-name/ap/aporetic/package.nix
+++ b/pkgs/by-name/ap/aporetic/package.nix
@@ -17,9 +17,9 @@ let
   version = "1.1.0";
   src = fetchFromGitHub {
     owner = "protesilaos";
-    repo = pname;
-    rev = version;
-    sha256 = "sha256-5lPViAo9SztOdds6HEmKJpT17tgcxmU/voXDffxTMDI=";
+    repo = "aporetic";
+    tag = version;
+    hash = "sha256-5lPViAo9SztOdds6HEmKJpT17tgcxmU/voXDffxTMDI=";
   };
   privateBuildPlan = src.outPath + "/private-build-plans.toml";
   makeIosevkaFont =
@@ -45,21 +45,22 @@ let
             };
 
             npmDepsHash = "sha256-HeqwpZyHLHdMhd/UfXVBonMu+PhStrLCxAMuP/KuTT8=";
-
-            meta = with lib; {
-              inherit (src.meta) homepage;
-              description = ''
-                Customised build of the Iosevka typeface, with a consistent rounded style and overrides for almost all individual glyphs in both roman (upright) and italic (slanted) variants.
-              '';
-              license = licenses.ofl;
-              platforms = iosevka.meta.platforms;
-              maintainers = [ maintainers.DamienCassou ];
-            };
           }
         );
     });
 in
 symlinkJoin {
   inherit pname version;
+
   paths = (builtins.map makeIosevkaFont sets);
+
+  meta = {
+    inherit (src.meta) homepage;
+    description = ''
+      Custom build of Iosevka with different style and metrics than the default. This is the successor to my "Iosevka Comfy" fonts.
+    '';
+    license = lib.licenses.ofl;
+    platforms = iosevka.meta.platforms;
+    maintainers = [ lib.maintainers.DamienCassou ];
+  };
 }

From 14552c1b7f9b61982be7c4afed342404128b257e Mon Sep 17 00:00:00 2001
From: Tanya <tanyaarora1866@gmail.com>
Date: Tue, 8 Apr 2025 23:12:22 +0530
Subject: [PATCH 09/40] libhydrogen: init at 2024-04-06 (bbca575b)

---
 pkgs/by-name/li/libhydrogen/package.nix | 66 +++++++++++++++++++++++++
 1 file changed, 66 insertions(+)
 create mode 100644 pkgs/by-name/li/libhydrogen/package.nix

diff --git a/pkgs/by-name/li/libhydrogen/package.nix b/pkgs/by-name/li/libhydrogen/package.nix
new file mode 100644
index 000000000000..822e682dac9a
--- /dev/null
+++ b/pkgs/by-name/li/libhydrogen/package.nix
@@ -0,0 +1,66 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  testers,
+  pkg-config,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "libhydrogen";
+  version = "0-unstable-2025-04-06";
+
+  src = fetchFromGitHub {
+    owner = "jedisct1";
+    repo = "libhydrogen";
+    rev = "bbca575b62510bfdc6dd927a4bfa7df4a51cb846";
+    hash = "sha256-sLOE3oR53hmvRqIPD5PU9Q04TFqw2KuWT1OQBA/KdRc=";
+  };
+
+  outputs = [
+    "out"
+    "dev"
+  ];
+
+  nativeBuildInputs = [ pkg-config ];
+  enableParallelBuilding = true;
+
+  makeFlags = [
+    "PREFIX=${placeholder "out"}"
+    "INCLUDE_INSTALL_DIR=${placeholder "dev"}/include"
+    "LIBRARY_INSTALL_DIR=${placeholder "out"}/lib"
+    "PKGCONFIG_INSTALL_DIR=${placeholder "dev"}/lib/pkgconfig"
+  ];
+
+  postInstall = ''
+    mkdir -p "$dev/lib/pkgconfig"
+    cat > "$dev/lib/pkgconfig/libhydrogen.pc" <<EOF
+    Name: libhydrogen
+    Description: Lightweight cryptographic library
+    Version: ${finalAttrs.version}
+    Libs: -L$out/lib -lhydrogen
+    Cflags: -I$dev/include
+    EOF
+  '';
+
+  doCheck = true;
+
+  preCheck = ''
+    export LD_LIBRARY_PATH=$PWD:$LD_LIBRARY_PATH
+  '';
+
+  checkPhase = ''
+    tests/tests
+  '';
+
+  passthru.tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
+
+  meta = {
+    description = "Lightweight, secure, easy-to-use crypto library suitable for constrained environments";
+    homepage = "https://github.com/jedisct1/libhydrogen";
+    license = lib.licenses.isc;
+    maintainers = [ lib.maintainers.tanya1866 ];
+    pkgConfigModules = [ "libhydrogen" ];
+    platforms = lib.platforms.all;
+  };
+})

From b3b3e378563705c6988ab5848638f753f07189ae Mon Sep 17 00:00:00 2001
From: Pol Dellaiera <pol.dellaiera@protonmail.com>
Date: Fri, 11 Apr 2025 06:55:59 +0200
Subject: [PATCH 10/40] aporetic-bin: init at 1.1.0

---
 pkgs/by-name/ap/aporetic-bin/package.nix | 39 ++++++++++++++++++++++++
 pkgs/by-name/ap/aporetic/package.nix     |  2 +-
 2 files changed, 40 insertions(+), 1 deletion(-)
 create mode 100644 pkgs/by-name/ap/aporetic-bin/package.nix

diff --git a/pkgs/by-name/ap/aporetic-bin/package.nix b/pkgs/by-name/ap/aporetic-bin/package.nix
new file mode 100644
index 000000000000..fe9d0b1753d2
--- /dev/null
+++ b/pkgs/by-name/ap/aporetic-bin/package.nix
@@ -0,0 +1,39 @@
+{
+  stdenvNoCC,
+  lib,
+  fetchFromGitHub,
+}:
+
+stdenvNoCC.mkDerivation (finalAttrs: {
+  pname = "aporetic-bin";
+  version = "1.1.0";
+
+  src = fetchFromGitHub {
+    owner = "protesilaos";
+    repo = "aporetic";
+    tag = finalAttrs.version;
+    hash = "sha256-5lPViAo9SztOdds6HEmKJpT17tgcxmU/voXDffxTMDI=";
+  };
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p $out/share/fonts/truetype
+    cp -r $src/{aporetic-sans-mono,aporetic-sans,aporetic-serif-mono,aporetic-serif} $out/share/fonts/truetype
+
+    runHook postInstall
+  '';
+
+  meta = {
+    homepage = "https://github.com/protesilaos/aporetic";
+    description = ''
+      Custom build of Iosevka with different style and metrics than the default. This is the successor to my "Iosevka Comfy" fonts.
+    '';
+    license = lib.licenses.ofl;
+    platforms = lib.platforms.all;
+    maintainers = with lib.maintainers; [
+      DamienCassou
+      drupol
+    ];
+  };
+})
diff --git a/pkgs/by-name/ap/aporetic/package.nix b/pkgs/by-name/ap/aporetic/package.nix
index 54b2f4f50673..e16b39318fd3 100644
--- a/pkgs/by-name/ap/aporetic/package.nix
+++ b/pkgs/by-name/ap/aporetic/package.nix
@@ -57,7 +57,7 @@ symlinkJoin {
   meta = {
     inherit (src.meta) homepage;
     description = ''
-      Custom build of Iosevka with different style and metrics than the default. This is the successor to my "Iosevka Comfy" fonts.
+      Custom build of Iosevka with different style and metrics than the default, successor to my "Iosevka Comfy" fonts
     '';
     license = lib.licenses.ofl;
     platforms = iosevka.meta.platforms;

From bdcc68262e766163d0fa84c8f0fe6d61bbff98d5 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Sandro=20J=C3=A4ckel?= <sandro.jaeckel@gmail.com>
Date: Fri, 11 Apr 2025 16:03:05 +0200
Subject: [PATCH 11/40] zint: fetch submitted patch

---
 .../fix-installation-of-cmake-files.patch     | 39 +++++++++++++++++++
 pkgs/by-name/zi/zint/package.nix              |  9 ++---
 2 files changed, 42 insertions(+), 6 deletions(-)
 create mode 100644 pkgs/by-name/zi/zint/fix-installation-of-cmake-files.patch

diff --git a/pkgs/by-name/zi/zint/fix-installation-of-cmake-files.patch b/pkgs/by-name/zi/zint/fix-installation-of-cmake-files.patch
new file mode 100644
index 000000000000..7bbe0b23508c
--- /dev/null
+++ b/pkgs/by-name/zi/zint/fix-installation-of-cmake-files.patch
@@ -0,0 +1,39 @@
+From ba86d5d0826d221075329aaf67f1f4f8f868550f Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Sandro=20J=C3=A4ckel?= <sandro.jaeckel@gmail.com>
+Date: Fri, 11 Apr 2025 03:24:38 +0200
+Subject: [PATCH] Fix installation of cmake files
+
+When binaries, libs and development files like include or cmake files
+are installed to different target directories then those where before
+relatively installed to the binary and not in the correct directory
+where other development related files where installed.
+
+Tested inside of nixpkgs with zxing using the system library of zint.
+---
+ CMakeLists.txt         | 2 +-
+ backend/CMakeLists.txt | 2 +-
+ 2 files changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/CMakeLists.txt b/CMakeLists.txt
+index 6f7cf220..ecfe53c3 100644
+--- a/CMakeLists.txt
++++ b/CMakeLists.txt
+@@ -201,4 +201,4 @@ if(ZINT_UNINSTALL)
+ endif()
+ 
+ configure_file("zint-config.cmake.in" "zint-config.cmake" @ONLY)
+-install(FILES "${CMAKE_CURRENT_BINARY_DIR}/zint-config.cmake" DESTINATION "${CMAKE_INSTALL_DATADIR}/zint")
++install(FILES "${CMAKE_CURRENT_BINARY_DIR}/zint-config.cmake" DESTINATION "${CMAKE_INSTALL_LIBDIR}/cmake/zint")
+diff --git a/backend/CMakeLists.txt b/backend/CMakeLists.txt
+index 45538515..1e7e40b3 100644
+--- a/backend/CMakeLists.txt
++++ b/backend/CMakeLists.txt
+@@ -131,7 +131,7 @@ endif()
+ if(ZINT_STATIC)
+     install(TARGETS zint-static EXPORT zint-targets ${INSTALL_TARGETS_DEFAULT_ARGS})
+ endif()
+-install(EXPORT zint-targets NAMESPACE zint:: DESTINATION "${CMAKE_INSTALL_DATADIR}/zint")
++install(EXPORT zint-targets NAMESPACE zint:: DESTINATION "${CMAKE_INSTALL_LIBDIR}/cmake/zint")
+ install(FILES zint.h DESTINATION ${CMAKE_INSTALL_INCLUDEDIR} COMPONENT Devel)
+ 
+ if(ZINT_TEST)
diff --git a/pkgs/by-name/zi/zint/package.nix b/pkgs/by-name/zi/zint/package.nix
index f38c6277bf56..605e6c26ce29 100644
--- a/pkgs/by-name/zi/zint/package.nix
+++ b/pkgs/by-name/zi/zint/package.nix
@@ -26,14 +26,11 @@ stdenv.mkDerivation (finalAttrs: {
     hash = "sha256-+dXIU66HIS2mE0pa99UemMMFBGCYjupUX8P7q3G7Nis=";
   };
 
-  postPatch = ''
+  patches = [
     # Fix cmake file installation
     # https://github.com/zint/zint/pull/8
-    substituteInPlace CMakeLists.txt \
-      --replace-fail 'DESTINATION "''${CMAKE_INSTALL_DATADIR}/zint"' 'DESTINATION lib/cmake/zint'
-    substituteInPlace backend/CMakeLists.txt \
-      --replace-fail 'DESTINATION "''${CMAKE_INSTALL_DATADIR}/zint"' 'DESTINATION lib/cmake/zint'
-  '';
+    ./fix-installation-of-cmake-files.patch
+  ];
 
   nativeBuildInputs = [
     cmake

From 21fbe41c6ac86dff7c7ccf35bb289aaa2fd84b37 Mon Sep 17 00:00:00 2001
From: Marcin Serwin <marcin@serwin.dev>
Date: Thu, 10 Apr 2025 18:44:34 +0200
Subject: [PATCH 12/40] signal-desktop-source: build signal-sqlcipher from
 source

---
 .../si/signal-desktop-source/package.nix      | 23 +++---
 .../signal-sqlcipher.nix                      | 74 +++++++++++++++++++
 .../si/signal-desktop-source/sqlite3.gyp      | 40 ----------
 .../si/signal-desktop-source/update.sh        | 10 +++
 4 files changed, 97 insertions(+), 50 deletions(-)
 create mode 100644 pkgs/by-name/si/signal-desktop-source/signal-sqlcipher.nix
 delete mode 100644 pkgs/by-name/si/signal-desktop-source/sqlite3.gyp

diff --git a/pkgs/by-name/si/signal-desktop-source/package.nix b/pkgs/by-name/si/signal-desktop-source/package.nix
index ecb384b1d0fe..7c0993a8fc9f 100644
--- a/pkgs/by-name/si/signal-desktop-source/package.nix
+++ b/pkgs/by-name/si/signal-desktop-source/package.nix
@@ -19,7 +19,7 @@
 }:
 let
   nodejs = nodejs_22;
-  pnpm = pnpm_10;
+  pnpm = pnpm_10.override { inherit nodejs; };
   electron = electron_35;
 
   nodeOS =
@@ -45,6 +45,7 @@ let
   '';
 
   libsignal-node = callPackage ./libsignal-node.nix { inherit nodejs; };
+  signal-sqlcipher = callPackage ./signal-sqlcipher.nix { inherit pnpm nodejs; };
 
   webrtc = callPackage ./webrtc.nix { };
   ringrtc = callPackage ./ringrtc.nix { inherit webrtc; };
@@ -91,7 +92,7 @@ let
 
     nativeBuildInputs = [
       nodejs
-      (pnpm.override { inherit nodejs; }).configHook
+      pnpm.configHook
     ];
 
     buildPhase = ''
@@ -113,7 +114,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   nativeBuildInputs = [
     nodejs
-    (pnpm.override { inherit nodejs; }).configHook
+    pnpm.configHook
     makeWrapper
     copyDesktopItems
     python3
@@ -163,6 +164,11 @@ stdenv.mkDerivation (finalAttrs: {
       die "libsignal-client version mismatch"
     fi
 
+    if [ "`jq -r '.dependencies."@signalapp/sqlcipher"' < package.json`" != "${signal-sqlcipher.version}" ]
+    then
+      die "signal-sqlcipher version mismatch"
+    fi
+
     if [ "`jq -r '.dependencies."@signalapp/ringrtc"' < package.json`" != "${ringrtc.version}" ]
     then
       die "ringrtc version mismatch"
@@ -174,6 +180,9 @@ stdenv.mkDerivation (finalAttrs: {
 
     rm -fr node_modules/@signalapp/libsignal-client/prebuilds
     cp -r ${libsignal-node}/lib node_modules/@signalapp/libsignal-client/prebuilds
+
+    rm -fr node_modules/@signalapp/sqlcipher
+    cp -r ${signal-sqlcipher} node_modules/@signalapp/sqlcipher
   '';
 
   buildPhase = ''
@@ -241,6 +250,7 @@ stdenv.mkDerivation (finalAttrs: {
       ringrtc
       webrtc
       sticker-creator
+      signal-sqlcipher
       ;
     tests.application-launch = nixosTests.signal-desktop;
     updateScript.command = [ ./update.sh ];
@@ -271,12 +281,5 @@ stdenv.mkDerivation (finalAttrs: {
       "x86_64-linux"
       "aarch64-linux"
     ];
-    sourceProvenance = with lib.sourceTypes; [
-      fromSource
-
-      # @signalapp/sqlcipher
-      # ringrtc
-      binaryNativeCode
-    ];
   };
 })
diff --git a/pkgs/by-name/si/signal-desktop-source/signal-sqlcipher.nix b/pkgs/by-name/si/signal-desktop-source/signal-sqlcipher.nix
new file mode 100644
index 000000000000..37ebead94a60
--- /dev/null
+++ b/pkgs/by-name/si/signal-desktop-source/signal-sqlcipher.nix
@@ -0,0 +1,74 @@
+{
+  stdenv,
+  lib,
+  fetchFromGitHub,
+  pnpm,
+  nodejs,
+  rustPlatform,
+  cargo,
+  dump_syms,
+  python3,
+}:
+stdenv.mkDerivation (finalAttrs: {
+  pname = "node-sqlcipher";
+  version = "1.0.0";
+
+  src = fetchFromGitHub {
+    owner = "signalapp";
+    repo = "node-sqlcipher";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-fuChNio2iWYuxIj40jW1lJCZItnQKrzX7m1gJeeajvs=";
+  };
+
+  pnpmDeps = pnpm.fetchDeps {
+    inherit (finalAttrs) pname version src;
+    hash = "sha256-regaYG+SDvIgdnHQVR1GG1A1FSBXpzFfLuyTEdMt1kQ=";
+  };
+
+  cargoRoot = "deps/extension";
+  cargoDeps = rustPlatform.fetchCargoVendor {
+    name = "sqlcipher-signal-exentsion";
+    inherit (finalAttrs) src cargoRoot;
+    hash = "sha256-qT4HM/FRL8qugKKNlMYM/0zgUsC6cDOa9fgd1d4VIrc=";
+  };
+
+  nativeBuildInputs = [
+    nodejs
+    pnpm.configHook
+    rustPlatform.cargoSetupHook
+    cargo
+    dump_syms
+    python3
+  ];
+
+  buildPhase = ''
+    runHook preBuild
+
+    export npm_config_nodedir=${nodejs}
+    pnpm run prebuildify
+    pnpm run build
+
+    runHook postBuild
+  '';
+
+  installPhase = ''
+    runHook preInstall
+
+    cp -r dist $out
+    cp -r prebuilds $out
+
+    runHook postInstall
+  '';
+
+  meta = {
+    description = "Fast N-API-based Node.js addon wrapping sqlcipher and FTS5 segmenting APIs";
+    homepage = "https://github.com/signalapp/node-sqlcipher/tree/main";
+    license = with lib.licenses; [
+      agpl3Only
+
+      # deps/sqlcipher
+      bsd3
+    ];
+    platforms = lib.platforms.linux;
+  };
+})
diff --git a/pkgs/by-name/si/signal-desktop-source/sqlite3.gyp b/pkgs/by-name/si/signal-desktop-source/sqlite3.gyp
deleted file mode 100644
index 2c73ab250b61..000000000000
--- a/pkgs/by-name/si/signal-desktop-source/sqlite3.gyp
+++ /dev/null
@@ -1,40 +0,0 @@
-{
-  'includes': ['common.gypi'],
-  'targets': [
-    {
-      'target_name': 'locate_sqlite3',
-      'type': 'none',
-      'copies': [{
-        'files': [
-          '@extension@/src/sqlite3.c',
-        ],
-        'destination': '<(SHARED_INTERMEDIATE_DIR)/sqlite3',
-      }],
-    },
-    {
-      'target_name': 'sqlite3',
-      'type': 'static_library',
-      'dependencies': ['locate_sqlite3'],
-      'sources': ['<(SHARED_INTERMEDIATE_DIR)/sqlite3/sqlite3.c'],
-      'include_dirs': [
-        '<(SHARED_INTERMEDIATE_DIR)/sqlite3/',
-      ],
-      'direct_dependent_settings': {
-        'include_dirs': [
-          '@extension@/include',
-        ],
-      },
-      'cflags': ['-std=c99', '-w'],
-      'xcode_settings': {
-        'OTHER_CFLAGS': ['-std=c99'],
-        'WARNING_CFLAGS': ['-w'],
-      },
-      'includes': ['defines.gypi'],
-      'link_settings': {
-        'libraries': [
-          '@extension@/lib/libsignal_sqlcipher_extension@static_lib_ext@',
-        ]
-      }
-    },
-  ],
-}
diff --git a/pkgs/by-name/si/signal-desktop-source/update.sh b/pkgs/by-name/si/signal-desktop-source/update.sh
index 4271874b2470..4614a7222861 100755
--- a/pkgs/by-name/si/signal-desktop-source/update.sh
+++ b/pkgs/by-name/si/signal-desktop-source/update.sh
@@ -22,6 +22,7 @@ latestVersion="`jq -r '.version' <<< $packageJson`"
 nodeVersion="`jq -r '.engines.node' <<< $packageJson | cut -d. -f1`"
 electronVersion="`jq -r '.devDependencies.electron' <<< $packageJson | cut -d. -f1`"
 libsignalClientVersion=`jq -r '.dependencies."@signalapp/libsignal-client"' <<< $packageJson`
+signalSqlcipherVersion=`jq -r '.dependencies."@signalapp/sqlcipher"' <<< $packageJson`
 ringrtcVersion=`jq -r '.dependencies."@signalapp/ringrtc"' <<< $packageJson`
 ringrtcVersionProperties="`curl_github "https://raw.githubusercontent.com/signalapp/ringrtc/refs/tags/v$ringrtcVersion/config/version.properties"`"
 webrtcVersion="`grep --only-matching "^webrtc.version=.*$" <<< $ringrtcVersionProperties | sed "s/webrtc.version=//g"`"
@@ -46,6 +47,15 @@ update-source-version signal-desktop-source.libsignal-node \
   --ignore-same-version \
   --source-key=npmDeps
 
+update-source-version signal-desktop-source.signal-sqlcipher \
+  "$signalSqlcipherVersion"
+update-source-version signal-desktop-source.signal-sqlcipher \
+  --ignore-same-version \
+  --source-key=cargoDeps.vendorStaging
+update-source-version signal-desktop-source.signal-sqlcipher \
+  --ignore-same-version \
+  --source-key=pnpmDeps
+
 update-source-version signal-desktop-source.ringrtc "$ringrtcVersion"
 update-source-version signal-desktop-source.ringrtc \
   --ignore-same-version \

From 0c540cba1c2767d2a65029aafcc1b65a89959b30 Mon Sep 17 00:00:00 2001
From: Patrick Hobusch <patrick@hobusch.net>
Date: Fri, 11 Apr 2025 23:01:55 +0800
Subject: [PATCH 13/40] authentik: Add missing dependency on bash

---
 pkgs/by-name/au/authentik/package.nix | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/pkgs/by-name/au/authentik/package.nix b/pkgs/by-name/au/authentik/package.nix
index ea5f865ad081..b6b1a3b465da 100644
--- a/pkgs/by-name/au/authentik/package.nix
+++ b/pkgs/by-name/au/authentik/package.nix
@@ -7,6 +7,7 @@
   buildNpmPackage,
   buildGoModule,
   runCommand,
+  bash,
   chromedriver,
   openapi-generator-cli,
   nodejs,
@@ -343,6 +344,8 @@ stdenvNoCC.mkDerivation {
   pname = "authentik";
   inherit src version;
 
+  buildInputs = [ bash ];
+
   postPatch = ''
     rm Makefile
     patchShebangs lifecycle/ak

From 43282ed6ec565e8ae16456161f7f69b7f78d0103 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Fri, 11 Apr 2025 17:54:44 +0000
Subject: [PATCH 14/40] php: 8.4.5 -> 8.4.6

---
 pkgs/development/interpreters/php/8.4.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/interpreters/php/8.4.nix b/pkgs/development/interpreters/php/8.4.nix
index 77a36a6cdaa9..50159b0f2f35 100644
--- a/pkgs/development/interpreters/php/8.4.nix
+++ b/pkgs/development/interpreters/php/8.4.nix
@@ -4,8 +4,8 @@ let
   base = callPackage ./generic.nix (
     _args
     // {
-      version = "8.4.5";
-      hash = "sha256-k3jHiIfQzXRi/FwX8t4wyFLyD3nSh5XiVz/jJQ05Q24=";
+      version = "8.4.6";
+      hash = "sha256-nPJzRQm2A/ZYlherUqlxKgPg/gWZUc3dLUYj30v3xsY=";
     }
   );
 in

From f790b874ae61325b2f43d2170b1750398e3fcf82 Mon Sep 17 00:00:00 2001
From: Qiming Chu <cchuqiming@gmail.com>
Date: Sat, 12 Apr 2025 01:49:28 +0800
Subject: [PATCH 15/40] affine: 0.20.5 -> 0.21.2, fix darwin build

Signed-off-by: Qiming Chu <cchuqiming@gmail.com>
---
 pkgs/by-name/af/affine/package.nix | 27 +++++++++++++++++++++------
 1 file changed, 21 insertions(+), 6 deletions(-)

diff --git a/pkgs/by-name/af/affine/package.nix b/pkgs/by-name/af/affine/package.nix
index 0628d85c49ad..b54ab0dce852 100644
--- a/pkgs/by-name/af/affine/package.nix
+++ b/pkgs/by-name/af/affine/package.nix
@@ -21,6 +21,8 @@
   nix-update-script,
   buildType ? "stable",
   commandLineArgs ? "",
+  llvmPackages,
+  apple-sdk_15,
 }:
 let
   hostPlatform = stdenvNoCC.hostPlatform;
@@ -41,17 +43,17 @@ in
 stdenv.mkDerivation (finalAttrs: {
   pname = binName;
 
-  version = "0.20.5";
+  version = "0.21.2";
   src = fetchFromGitHub {
     owner = "toeverything";
     repo = "AFFiNE";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-eMVHwjJe6u3A3Dxo6SurusRuMksp/moPmXAUv0FXBwc=";
+    hash = "sha256-d5dHHiiCXhzn8qJlCqJVw0qC86PvKyDZstPivX9bpCI=";
   };
 
   cargoDeps = rustPlatform.fetchCargoVendor {
     inherit (finalAttrs) pname version src;
-    hash = "sha256-Ob+A7NMTFuJ2wmRkHmemHnqkEAiY7G8NyxXXrT7NTR8=";
+    hash = "sha256-0vhUeqCStM7P8+sDs3ZI+JlEzPAreoP+1X8x5zKOJUo=";
   };
   yarnOfflineCache = stdenvNoCC.mkDerivation {
     name = "yarn-offline-cache";
@@ -96,8 +98,13 @@ stdenv.mkDerivation (finalAttrs: {
       '';
     dontInstall = true;
     outputHashMode = "recursive";
-    outputHash = "sha256-e5GNWgeYw4CcpOGDd/LNk+syBupqAuws0hz+wUbaFL4=";
+    outputHash = "sha256-pJiMCyBJSuTaxix3kKnSCrURL2+t26zB4Y59gGdxalo=";
   };
+
+  buildInputs = lib.optionals hostPlatform.isDarwin [
+    apple-sdk_15
+  ];
+
   nativeBuildInputs =
     [
       nodejs
@@ -113,10 +120,18 @@ stdenv.mkDerivation (finalAttrs: {
     ++ lib.optionals hostPlatform.isLinux [
       copyDesktopItems
       makeWrapper
+    ]
+    ++ lib.optionals hostPlatform.isDarwin [
+      # bindgenHook is needed to build `coreaudio-sys` on darwin
+      rustPlatform.bindgenHook
     ];
 
-  # force yarn install run in CI mode
-  env.CI = "1";
+  env = {
+    # force yarn install run in CI mode
+    CI = "1";
+    # `LIBCLANG_PATH` is needed to build `coreaudio-sys` on darwin
+    LIBCLANG_PATH = lib.optionalString hostPlatform.isDarwin "${lib.getLib llvmPackages.libclang}/lib";
+  };
 
   # Remove code under The AFFiNE Enterprise Edition (EE) license.
   # Keep file package.json for `yarn install --immutable` lockfile check.

From 6a2be790086d77cececa140f224bde065b3cdda9 Mon Sep 17 00:00:00 2001
From: Piotr Kwiecinski <2151333+piotrkwiecinski@users.noreply.github.com>
Date: Fri, 11 Apr 2025 20:40:39 +0200
Subject: [PATCH 16/40] php84Extensions.phalcon: remove broken flag

php 8.4 is supported since 5.9.2
---
 pkgs/development/php-packages/phalcon/default.nix | 1 -
 1 file changed, 1 deletion(-)

diff --git a/pkgs/development/php-packages/phalcon/default.nix b/pkgs/development/php-packages/phalcon/default.nix
index 6202a1adc7ab..d36cf582fbe6 100644
--- a/pkgs/development/php-packages/phalcon/default.nix
+++ b/pkgs/development/php-packages/phalcon/default.nix
@@ -37,6 +37,5 @@ buildPecl rec {
     license = licenses.bsd3;
     homepage = "https://phalcon.io";
     maintainers = teams.php.members ++ [ maintainers.krzaczek ];
-    broken = lib.versionAtLeast php.version "8.4";
   };
 }

From 35de3d6754924b8d4e33f57d2e61d9ffb7144806 Mon Sep 17 00:00:00 2001
From: Niklas Korz <niklas@niklaskorz.de>
Date: Fri, 11 Apr 2025 11:20:41 +0200
Subject: [PATCH 17/40] conduwuit: mark as EOL

On April 11, 2025, the conduwuit project officially ceased development.
nixpkgs marks security-sensitive projects that have reached EOL as
vulnerable.
---
 nixos/doc/manual/release-notes/rl-2505.section.md | 2 ++
 pkgs/by-name/co/conduwuit/package.nix             | 3 +++
 2 files changed, 5 insertions(+)

diff --git a/nixos/doc/manual/release-notes/rl-2505.section.md b/nixos/doc/manual/release-notes/rl-2505.section.md
index 947b227fb667..b73d8b2db4b8 100644
--- a/nixos/doc/manual/release-notes/rl-2505.section.md
+++ b/nixos/doc/manual/release-notes/rl-2505.section.md
@@ -303,6 +303,8 @@
 - The behavior of `services.hostapd.radios.<name>.networks.<name>.authentication.enableRecommendedPairwiseCiphers` was changed to not include `CCMP-256` anymore.
   Since all configured pairwise ciphers have to be supported by the radio, this caused startup failures on many devices which is hard to debug in hostapd.
 
+- The `conduwuit` matrix server implementation has officially been discontinued by upstream and the package has thus been marked as vulnerable, as it is a security-sensitive package that has reached EOL.
+
 - `gkraken` software and `hardware.gkraken.enable` option have been removed, use `coolercontrol` via `programs.coolercontrol.enable` option instead.
 
 - To avoid delaying user logins unnecessarily the `multi-user.target` is no longer ordered after `network-online.target`.
diff --git a/pkgs/by-name/co/conduwuit/package.nix b/pkgs/by-name/co/conduwuit/package.nix
index 89af36894092..a4436d7b0620 100644
--- a/pkgs/by-name/co/conduwuit/package.nix
+++ b/pkgs/by-name/co/conduwuit/package.nix
@@ -98,6 +98,9 @@ rustPlatform.buildRustPackage rec {
     homepage = "https://conduwuit.puppyirl.gay/";
     changelog = "https://github.com/girlbossceo/conduwuit/releases/tag/v${version}";
     license = lib.licenses.asl20;
+    knownVulnerabilities = [
+      "On April 11, 2025, the conduwuit project officially ceased development"
+    ];
     maintainers = with lib.maintainers; [ niklaskorz ];
     # Not a typo, conduwuit is a drop-in replacement for conduit.
     mainProgram = "conduit";

From d2fb99b640cdf37735f03958ad29001bf69963e6 Mon Sep 17 00:00:00 2001
From: Niklas Korz <niklas@niklaskorz.de>
Date: Fri, 11 Apr 2025 22:19:06 +0200
Subject: [PATCH 18/40] nixos/conduwuit: remove

As the conduwuit project has been officially discontinued,
and the conduwuit NixOS module hasn't been around long enough
to appear in any stable NixOS release, we've removed it.
---
 .../manual/release-notes/rl-2505.section.md   |   2 -
 nixos/modules/module-list.nix                 |   1 -
 nixos/modules/rename.nix                      |   4 +
 nixos/modules/services/matrix/conduwuit.nix   | 265 ------------------
 nixos/tests/all-tests.nix                     |   1 -
 nixos/tests/matrix/conduwuit.nix              | 103 -------
 pkgs/by-name/co/conduwuit/package.nix         |  15 +-
 7 files changed, 9 insertions(+), 382 deletions(-)
 delete mode 100644 nixos/modules/services/matrix/conduwuit.nix
 delete mode 100644 nixos/tests/matrix/conduwuit.nix

diff --git a/nixos/doc/manual/release-notes/rl-2505.section.md b/nixos/doc/manual/release-notes/rl-2505.section.md
index b73d8b2db4b8..c13ba556a69e 100644
--- a/nixos/doc/manual/release-notes/rl-2505.section.md
+++ b/nixos/doc/manual/release-notes/rl-2505.section.md
@@ -85,8 +85,6 @@
 
 - [ncps](https://github.com/kalbasit/ncps), a Nix binary cache proxy service implemented in Go using [go-nix](https://github.com/nix-community/go-nix). Available as [services.ncps](options.html#opt-services.ncps.enable).
 
-- [Conduwuit](https://conduwuit.puppyirl.gay/), a federated chat server implementing the Matrix protocol, forked from Conduit. Available as [services.conduwuit](#opt-services.conduwuit.enable).
-
 - [Readeck](https://readeck.org/), a read-it later web-application. Available as [services.readeck](#opt-services.readeck.enable).
 
 - [Traccar](https://www.traccar.org/), a modern GPS Tracking Platform. Available as [services.traccar](#opt-services.traccar.enable).
diff --git a/nixos/modules/module-list.nix b/nixos/modules/module-list.nix
index fadee10d20ce..b71aa4867252 100644
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@@ -748,7 +748,6 @@
   ./services/matrix/appservice-discord.nix
   ./services/matrix/appservice-irc.nix
   ./services/matrix/conduit.nix
-  ./services/matrix/conduwuit.nix
   ./services/matrix/dendrite.nix
   ./services/matrix/hebbot.nix
   ./services/matrix/hookshot.nix
diff --git a/nixos/modules/rename.nix b/nixos/modules/rename.nix
index 49872bc7a96b..0e8711fd489a 100644
--- a/nixos/modules/rename.nix
+++ b/nixos/modules/rename.nix
@@ -311,6 +311,10 @@ in
     (mkRemovedOptionModule [ "services" "rippleDataApi" ] ''
       The corresponding package was broken, abandoned upstream and thus removed from nixpkgs.
     '')
+    (mkRemovedOptionModule [ "services" "conduwuit" ] ''
+      The conduwuit project has been discontinued by upstream.
+      See https://github.com/NixOS/nixpkgs/pull/397902 for more information.
+    '')
 
     # Do NOT add any option renames here, see top of the file
   ];
diff --git a/nixos/modules/services/matrix/conduwuit.nix b/nixos/modules/services/matrix/conduwuit.nix
deleted file mode 100644
index b4d9fdd1c95e..000000000000
--- a/nixos/modules/services/matrix/conduwuit.nix
+++ /dev/null
@@ -1,265 +0,0 @@
-{
-  config,
-  lib,
-  pkgs,
-  ...
-}:
-let
-  cfg = config.services.conduwuit;
-  defaultUser = "conduwuit";
-  defaultGroup = "conduwuit";
-
-  format = pkgs.formats.toml { };
-  configFile = format.generate "conduwuit.toml" cfg.settings;
-in
-{
-  meta.maintainers = with lib.maintainers; [ niklaskorz ];
-  options.services.conduwuit = {
-    enable = lib.mkEnableOption "conduwuit";
-
-    user = lib.mkOption {
-      type = lib.types.nonEmptyStr;
-      description = ''
-        The user {command}`conduwuit` is run as.
-      '';
-      default = defaultUser;
-    };
-
-    group = lib.mkOption {
-      type = lib.types.nonEmptyStr;
-      description = ''
-        The group {command}`conduwuit` is run as.
-      '';
-      default = defaultGroup;
-    };
-
-    extraEnvironment = lib.mkOption {
-      type = lib.types.attrsOf lib.types.str;
-      description = "Extra Environment variables to pass to the conduwuit server.";
-      default = { };
-      example = {
-        RUST_BACKTRACE = "yes";
-      };
-    };
-
-    package = lib.mkPackageOption pkgs "conduwuit" { };
-
-    settings = lib.mkOption {
-      type = lib.types.submodule {
-        freeformType = format.type;
-        options = {
-          global.server_name = lib.mkOption {
-            type = lib.types.nonEmptyStr;
-            example = "example.com";
-            description = "The server_name is the name of this server. It is used as a suffix for user and room ids.";
-          };
-          global.address = lib.mkOption {
-            type = lib.types.nullOr (lib.types.listOf lib.types.nonEmptyStr);
-            default = null;
-            example = [
-              "127.0.0.1"
-              "::1"
-            ];
-            description = ''
-              Addresses (IPv4 or IPv6) to listen on for connections by the reverse proxy/tls terminator.
-              If set to `null`, conduwuit will listen on IPv4 and IPv6 localhost.
-              Must be `null` if `unix_socket_path` is set.
-            '';
-          };
-          global.port = lib.mkOption {
-            type = lib.types.listOf lib.types.port;
-            default = [ 6167 ];
-            description = ''
-              The port(s) conduwuit will be running on.
-              You need to set up a reverse proxy in your web server (e.g. apache or nginx),
-              so all requests to /_matrix on port 443 and 8448 will be forwarded to the conduwuit
-              instance running on this port.
-            '';
-          };
-          global.unix_socket_path = lib.mkOption {
-            type = lib.types.nullOr lib.types.path;
-            default = null;
-            description = ''
-              Listen on a UNIX socket at the specified path. If listening on a UNIX socket,
-              listening on an address will be disabled. The `address` option must be set to
-              `null` (the default value). The option {option}`services.conduwuit.group` must
-              be set to a group your reverse proxy is part of.
-
-              This will automatically add a system user "conduwuit" to your system if
-              {option}`services.conduwuit.user` is left at the default, and a "conduwuit"
-              group if {option}`services.conduwuit.group` is left at the default.
-            '';
-          };
-          global.unix_socket_perms = lib.mkOption {
-            type = lib.types.ints.positive;
-            default = 660;
-            description = "The default permissions (in octal) to create the UNIX socket with.";
-          };
-          global.max_request_size = lib.mkOption {
-            type = lib.types.ints.positive;
-            default = 20000000;
-            description = "Max request size in bytes. Don't forget to also change it in the proxy.";
-          };
-          global.allow_registration = lib.mkOption {
-            type = lib.types.bool;
-            default = false;
-            description = ''
-              Whether new users can register on this server.
-
-              Registration with token requires `registration_token` or `registration_token_file` to be set.
-
-              If set to true without a token configured, and
-              `yes_i_am_very_very_sure_i_want_an_open_registration_server_prone_to_abuse`
-              is set to true, users can freely register.
-            '';
-          };
-          global.allow_encryption = lib.mkOption {
-            type = lib.types.bool;
-            default = true;
-            description = "Whether new encrypted rooms can be created. Note: existing rooms will continue to work.";
-          };
-          global.allow_federation = lib.mkOption {
-            type = lib.types.bool;
-            default = true;
-            description = ''
-              Whether this server federates with other servers.
-            '';
-          };
-          global.trusted_servers = lib.mkOption {
-            type = lib.types.listOf lib.types.nonEmptyStr;
-            default = [ "matrix.org" ];
-            description = ''
-              Servers listed here will be used to gather public keys of other servers
-              (notary trusted key servers).
-
-              Currently, conduwuit doesn't support inbound batched key requests, so
-              this list should only contain other Synapse servers.
-
-              Example: `[ "matrix.org" "constellatory.net" "tchncs.de" ]`
-            '';
-          };
-          global.database_path = lib.mkOption {
-            readOnly = true;
-            type = lib.types.path;
-            default = "/var/lib/conduwuit/";
-            description = ''
-              Path to the conduwuit database, the directory where conduwuit will save its data.
-              Note that database_path cannot be edited because of the service's reliance on systemd StateDir.
-            '';
-          };
-          global.allow_check_for_updates = lib.mkOption {
-            type = lib.types.bool;
-            default = false;
-            description = ''
-              If enabled, conduwuit will send a simple GET request periodically to
-              <https://pupbrain.dev/check-for-updates/stable> for any new announcements made.
-              Despite the name, this is not an update check endpoint, it is simply an announcement check endpoint.
-
-              Disabled by default.
-            '';
-          };
-        };
-      };
-      default = { };
-      # TOML does not allow null values, so we use null to omit those fields
-      apply = lib.filterAttrsRecursive (_: v: v != null);
-      description = ''
-        Generates the conduwuit.toml configuration file. Refer to
-        <https://conduwuit.puppyirl.gay/configuration.html>
-        for details on supported values.
-      '';
-    };
-  };
-
-  config = lib.mkIf cfg.enable {
-    assertions = [
-      {
-        assertion = !(cfg.settings ? global.unix_socket_path) || !(cfg.settings ? global.address);
-        message = ''
-          In `services.conduwuit.settings.global`, `unix_socket_path` and `address` cannot be set at the
-          same time.
-          Leave one of the two options unset or explicitly set them to `null`.
-        '';
-      }
-      {
-        assertion = cfg.user != defaultUser -> config ? users.users.${cfg.user};
-        message = "If `services.conduwuit.user` is changed, the configured user must already exist.";
-      }
-      {
-        assertion = cfg.group != defaultGroup -> config ? users.groups.${cfg.group};
-        message = "If `services.conduwuit.group` is changed, the configured group must already exist.";
-      }
-    ];
-
-    users.users = lib.mkIf (cfg.user == defaultUser) {
-      ${defaultUser} = {
-        group = cfg.group;
-        home = cfg.settings.global.database_path;
-        isSystemUser = true;
-      };
-    };
-
-    users.groups = lib.mkIf (cfg.group == defaultGroup) {
-      ${defaultGroup} = { };
-    };
-
-    systemd.services.conduwuit = {
-      description = "Conduwuit Matrix Server";
-      documentation = [ "https://conduwuit.puppyirl.gay/" ];
-      wantedBy = [ "multi-user.target" ];
-      wants = [ "network-online.target" ];
-      after = [ "network-online.target" ];
-      environment = lib.mkMerge ([
-        { CONDUWUIT_CONFIG = configFile; }
-        cfg.extraEnvironment
-      ]);
-      startLimitBurst = 5;
-      startLimitIntervalSec = 60;
-      serviceConfig = {
-        DynamicUser = true;
-        User = cfg.user;
-        Group = cfg.group;
-
-        DevicePolicy = "closed";
-        LockPersonality = true;
-        MemoryDenyWriteExecute = true;
-        NoNewPrivileges = true;
-        ProtectClock = true;
-        ProtectControlGroups = true;
-        ProtectHome = true;
-        ProtectHostname = true;
-        ProtectKernelLogs = true;
-        ProtectKernelModules = true;
-        ProtectKernelTunables = true;
-        PrivateDevices = true;
-        PrivateMounts = true;
-        PrivateTmp = true;
-        PrivateUsers = true;
-        PrivateIPC = true;
-        RemoveIPC = true;
-        RestrictAddressFamilies = [
-          "AF_INET"
-          "AF_INET6"
-          "AF_UNIX"
-        ];
-        RestrictNamespaces = true;
-        RestrictRealtime = true;
-        SystemCallArchitectures = "native";
-        SystemCallFilter = [
-          "@system-service @resources"
-          "~@clock @debug @module @mount @reboot @swap @cpu-emulation @obsolete @timer @chown @setuid @privileged @keyring @ipc"
-        ];
-        SystemCallErrorNumber = "EPERM";
-
-        StateDirectory = "conduwuit";
-        StateDirectoryMode = "0700";
-        RuntimeDirectory = "conduwuit";
-        RuntimeDirectoryMode = "0750";
-
-        ExecStart = lib.getExe cfg.package;
-        Restart = "on-failure";
-        RestartSec = 10;
-      };
-    };
-  };
-}
diff --git a/nixos/tests/all-tests.nix b/nixos/tests/all-tests.nix
index 04caa7267e0e..7bbb84dbca4f 100644
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@@ -317,7 +317,6 @@ in
   coder = handleTest ./coder.nix { };
   collectd = handleTest ./collectd.nix { };
   commafeed = handleTest ./commafeed.nix { };
-  conduwuit = runTest ./matrix/conduwuit.nix;
   connman = handleTest ./connman.nix { };
   consul = handleTest ./consul.nix { };
   consul-template = handleTest ./consul-template.nix { };
diff --git a/nixos/tests/matrix/conduwuit.nix b/nixos/tests/matrix/conduwuit.nix
deleted file mode 100644
index 3e1123b692a6..000000000000
--- a/nixos/tests/matrix/conduwuit.nix
+++ /dev/null
@@ -1,103 +0,0 @@
-{ lib, ... }:
-let
-  name = "conduwuit";
-in
-{
-  inherit name;
-
-  nodes = {
-    conduwuit = {
-      services.conduwuit = {
-        enable = true;
-        settings.global = {
-          server_name = name;
-          address = [ "0.0.0.0" ];
-          allow_registration = true;
-          yes_i_am_very_very_sure_i_want_an_open_registration_server_prone_to_abuse = true;
-        };
-        extraEnvironment.RUST_BACKTRACE = "yes";
-      };
-      networking.firewall.allowedTCPPorts = [ 6167 ];
-    };
-    client =
-      { pkgs, ... }:
-      {
-        environment.systemPackages = [
-          (pkgs.writers.writePython3Bin "do_test" { libraries = [ pkgs.python3Packages.matrix-nio ]; } ''
-            import asyncio
-            import nio
-
-
-            async def main() -> None:
-                # Connect to conduwuit
-                client = nio.AsyncClient("http://conduwuit:6167", "alice")
-
-                # Register as user alice
-                response = await client.register("alice", "my-secret-password")
-
-                # Log in as user alice
-                response = await client.login("my-secret-password")
-
-                # Create a new room
-                response = await client.room_create(federate=False)
-                print("Matrix room create response:", response)
-                assert isinstance(response, nio.RoomCreateResponse)
-                room_id = response.room_id
-
-                # Join the room
-                response = await client.join(room_id)
-                print("Matrix join response:", response)
-                assert isinstance(response, nio.JoinResponse)
-
-                # Send a message to the room
-                response = await client.room_send(
-                    room_id=room_id,
-                    message_type="m.room.message",
-                    content={
-                        "msgtype": "m.text",
-                        "body": "Hello conduwuit!"
-                    }
-                )
-                print("Matrix room send response:", response)
-                assert isinstance(response, nio.RoomSendResponse)
-
-                # Sync responses
-                response = await client.sync(timeout=30000)
-                print("Matrix sync response:", response)
-                assert isinstance(response, nio.SyncResponse)
-
-                # Check the message was received by conduwuit
-                last_message = response.rooms.join[room_id].timeline.events[-1].body
-                assert last_message == "Hello conduwuit!"
-
-                # Leave the room
-                response = await client.room_leave(room_id)
-                print("Matrix room leave response:", response)
-                assert isinstance(response, nio.RoomLeaveResponse)
-
-                # Close the client
-                await client.close()
-
-
-            if __name__ == "__main__":
-                asyncio.run(main())
-          '')
-        ];
-      };
-  };
-
-  testScript = ''
-    start_all()
-
-    with subtest("start conduwuit"):
-          conduwuit.wait_for_unit("conduwuit.service")
-          conduwuit.wait_for_open_port(6167)
-
-    with subtest("ensure messages can be exchanged"):
-          client.succeed("do_test >&2")
-  '';
-
-  meta.maintainers = with lib.maintainers; [
-    niklaskorz
-  ];
-}
diff --git a/pkgs/by-name/co/conduwuit/package.nix b/pkgs/by-name/co/conduwuit/package.nix
index a4436d7b0620..15ebfc2e3649 100644
--- a/pkgs/by-name/co/conduwuit/package.nix
+++ b/pkgs/by-name/co/conduwuit/package.nix
@@ -15,7 +15,6 @@
   rust-jemalloc-sys,
   enableLiburing ? stdenv.hostPlatform.isLinux,
   liburing,
-  nixosTests,
 }:
 let
   rust-jemalloc-sys' = rust-jemalloc-sys.override {
@@ -81,16 +80,12 @@ rustPlatform.buildRustPackage rec {
 
   passthru = {
     updateScript = nix-update-script { };
-    tests =
-      {
-        version = testers.testVersion {
-          inherit version;
-          package = conduwuit;
-        };
-      }
-      // lib.optionalAttrs stdenv.hostPlatform.isLinux {
-        inherit (nixosTests) conduwuit;
+    tests = {
+      version = testers.testVersion {
+        inherit version;
+        package = conduwuit;
       };
+    };
   };
 
   meta = {

From 40d4b689f3f7fd1570fb726f43b7d1899e80ecab Mon Sep 17 00:00:00 2001
From: Gaetan Lepage <gaetan@glepage.com>
Date: Sat, 12 Apr 2025 01:10:14 +0200
Subject: [PATCH 19/40] python312Packages.transformers: 4.51.1 -> 4.51.2

Diff: https://github.com/huggingface/transformers/compare/refs/tags/v4.51.1...refs/tags/v4.51.2

Changelog: https://github.com/huggingface/transformers/releases/tag/v4.51.2
---
 pkgs/development/python-modules/transformers/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/transformers/default.nix b/pkgs/development/python-modules/transformers/default.nix
index ec0b502b711c..6886bc9c93a2 100644
--- a/pkgs/development/python-modules/transformers/default.nix
+++ b/pkgs/development/python-modules/transformers/default.nix
@@ -58,14 +58,14 @@
 
 buildPythonPackage rec {
   pname = "transformers";
-  version = "4.51.1";
+  version = "4.51.2";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "huggingface";
     repo = "transformers";
     tag = "v${version}";
-    hash = "sha256-02HT0GAfEyGgqPvly7EPZX0loSeS2mJQNI87E8WbEGY=";
+    hash = "sha256-RBG0//uKSRO8wBGdaQe8KPeIUXUKAws+VlSXYYtUr+o=";
   };
 
   build-system = [ setuptools ];

From 369560e5b63278e671694c12fa7de628fcf12701 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Fri, 11 Apr 2025 23:28:07 +0000
Subject: [PATCH 20/40] postgresqlPackages.pg-gvm: 22.6.8 -> 22.6.9

---
 pkgs/servers/sql/postgresql/ext/pg-gvm.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/servers/sql/postgresql/ext/pg-gvm.nix b/pkgs/servers/sql/postgresql/ext/pg-gvm.nix
index 679374aae167..e08982715966 100644
--- a/pkgs/servers/sql/postgresql/ext/pg-gvm.nix
+++ b/pkgs/servers/sql/postgresql/ext/pg-gvm.nix
@@ -14,13 +14,13 @@
 
 postgresqlBuildExtension (finalAttrs: {
   pname = "pg-gvm";
-  version = "22.6.8";
+  version = "22.6.9";
 
   src = fetchFromGitHub {
     owner = "greenbone";
     repo = "pg-gvm";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-D8KpOTF+vcBNIn//8Y0Hwk4B+OBF2Hh3dkWyO2KYeqw=";
+    hash = "sha256-T1U7t6ORHtmWeg77PR4gUH4nn3ywVC3MnvqoEIpJ4aw=";
   };
 
   nativeBuildInputs = [

From eacbeb75c30066b5f56ec44b8314160ed1947655 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sat, 12 Apr 2025 01:06:49 +0000
Subject: [PATCH 21/40] qtcreator: 16.0.0 -> 16.0.1

---
 pkgs/development/tools/qtcreator/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/tools/qtcreator/default.nix b/pkgs/development/tools/qtcreator/default.nix
index ed43fd476372..8a9b6d01ac03 100644
--- a/pkgs/development/tools/qtcreator/default.nix
+++ b/pkgs/development/tools/qtcreator/default.nix
@@ -31,11 +31,11 @@
 
 stdenv.mkDerivation rec {
   pname = "qtcreator";
-  version = "16.0.0";
+  version = "16.0.1";
 
   src = fetchurl {
     url = "mirror://qt/official_releases/${pname}/${lib.versions.majorMinor version}/${version}/qt-creator-opensource-src-${version}.tar.xz";
-    hash = "sha256-GLQ1PmijHAYnEwCMBc5/fuiKqvVtWsDG3lebq/soN9o=";
+    hash = "sha256-Elz13fDOK9n7MTEE7Edy9iirpm1o6yOFCB+yJtiYMSw=";
   };
 
   nativeBuildInputs = [

From a1726999659146a4d5018e22d212829c1b4bb6dc Mon Sep 17 00:00:00 2001
From: Tanya <tanyaarora1866@gmail.com>
Date: Fri, 11 Apr 2025 10:41:47 +0530
Subject: [PATCH 22/40] maintainers: add tanya1866

---
 maintainers/maintainer-list.nix         | 7 +++++++
 pkgs/by-name/li/libhydrogen/package.nix | 7 +++----
 2 files changed, 10 insertions(+), 4 deletions(-)

diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index 74fec3f9b32a..13d769088138 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -23540,6 +23540,13 @@
     githubId = 1901799;
     name = "Nathan van Doorn";
   };
+  tanya1866 = {
+    email = "tanyaarora@tutamail.com";
+    matrix = "@tanya1866:matrix.org";
+    github = "tanya1866";
+    githubId = 119473725;
+    name = "Tanya Arora";
+  };
   taranarmo = {
     email = "taranarmo@gmail.com";
     github = "taranarmo";
diff --git a/pkgs/by-name/li/libhydrogen/package.nix b/pkgs/by-name/li/libhydrogen/package.nix
index 822e682dac9a..eda73c73877d 100644
--- a/pkgs/by-name/li/libhydrogen/package.nix
+++ b/pkgs/by-name/li/libhydrogen/package.nix
@@ -30,8 +30,11 @@ stdenv.mkDerivation (finalAttrs: {
     "INCLUDE_INSTALL_DIR=${placeholder "dev"}/include"
     "LIBRARY_INSTALL_DIR=${placeholder "out"}/lib"
     "PKGCONFIG_INSTALL_DIR=${placeholder "dev"}/lib/pkgconfig"
+    "lib"
   ];
 
+  checkTarget = "test";
+
   postInstall = ''
     mkdir -p "$dev/lib/pkgconfig"
     cat > "$dev/lib/pkgconfig/libhydrogen.pc" <<EOF
@@ -49,10 +52,6 @@ stdenv.mkDerivation (finalAttrs: {
     export LD_LIBRARY_PATH=$PWD:$LD_LIBRARY_PATH
   '';
 
-  checkPhase = ''
-    tests/tests
-  '';
-
   passthru.tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
 
   meta = {

From 60dac5e176b0fc6318169be9613504d2f9a96253 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sat, 12 Apr 2025 08:22:15 +0000
Subject: [PATCH 23/40] yaziPlugins.yatline: 0-unstable-2025-03-05 ->
 0-unstable-2025-04-11

---
 pkgs/by-name/ya/yazi/plugins/yatline/default.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/ya/yazi/plugins/yatline/default.nix b/pkgs/by-name/ya/yazi/plugins/yatline/default.nix
index 8a247292af2c..17b78fd76452 100644
--- a/pkgs/by-name/ya/yazi/plugins/yatline/default.nix
+++ b/pkgs/by-name/ya/yazi/plugins/yatline/default.nix
@@ -5,13 +5,13 @@
 }:
 mkYaziPlugin {
   pname = "yatline.yazi";
-  version = "0-unstable-2025-03-05";
+  version = "0-unstable-2025-04-11";
 
   src = fetchFromGitHub {
     owner = "imsi32";
     repo = "yatline.yazi";
-    rev = "6b0fc1ef5eca034460b4c69cb87c424103227a2e";
-    hash = "sha256-JiUik4umi+ujsJmHliUbLsIj7ZTKayrWAAM8HmRdjwk=";
+    rev = "90e0284b22f922e7e024c403e7e596359e3aa2a0";
+    hash = "sha256-99HcvxylfPf5MlAnDOi/eg3C1XwzKnGz/vmMTBnSm/o=";
   };
 
   meta = {

From 3df73bdfb15dfa4a05db9d6ef3336138b1d28c76 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sat, 12 Apr 2025 02:02:49 +0000
Subject: [PATCH 24/40] vectorcode: 0.5.3 -> 0.5.5

---
 pkgs/by-name/ve/vectorcode/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/ve/vectorcode/package.nix b/pkgs/by-name/ve/vectorcode/package.nix
index 1a3636d3e707..5ab9bcbffb37 100644
--- a/pkgs/by-name/ve/vectorcode/package.nix
+++ b/pkgs/by-name/ve/vectorcode/package.nix
@@ -9,14 +9,14 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "vectorcode";
-  version = "0.5.3";
+  version = "0.5.5";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "Davidyz";
     repo = "VectorCode";
     tag = version;
-    hash = "sha256-Vfo+wY51b3triiDhURlMl1iKNlYDy7eqEtT9/RVNZCM=";
+    hash = "sha256-hoANo+CqGvMyFSPDVYVWJUf6UUo3n9C1Yu8xt5yrZUs=";
   };
 
   build-system = with python3Packages; [

From f301f1ca2bb3fcc70d7c0c7e2a0c002208a4833d Mon Sep 17 00:00:00 2001
From: Sizhe Zhao <prc.zhao@outlook.com>
Date: Thu, 13 Mar 2025 00:59:12 +0800
Subject: [PATCH 25/40] firewalld: update meta attributes

---
 pkgs/by-name/fi/firewalld/package.nix | 10 ++++++----
 1 file changed, 6 insertions(+), 4 deletions(-)

diff --git a/pkgs/by-name/fi/firewalld/package.nix b/pkgs/by-name/fi/firewalld/package.nix
index 5fe266ea17e3..bd112bbda6be 100644
--- a/pkgs/by-name/fi/firewalld/package.nix
+++ b/pkgs/by-name/fi/firewalld/package.nix
@@ -107,10 +107,12 @@ stdenv.mkDerivation rec {
     wrapPythonProgramsIn "$out/share/firewalld/testsuite/python" "$out ${pythonPath}"
   '';
 
-  meta = with lib; {
+  meta = {
     description = "Firewall daemon with D-Bus interface";
-    homepage = "https://github.com/firewalld/firewalld";
-    license = licenses.gpl2Plus;
-    maintainers = [ ];
+    homepage = "https://firewalld.org";
+    downloadPage = "https://github.com/firewalld/firewalld/releases";
+    license = lib.licenses.gpl2Plus;
+    maintainers = with lib.maintainers; [ prince213 ];
+    platforms = lib.platforms.linux;
   };
 }

From 448091b05cacb5a1e85bff718568d4da58d75e7a Mon Sep 17 00:00:00 2001
From: Sizhe Zhao <prc.zhao@outlook.com>
Date: Mon, 24 Mar 2025 17:30:18 +0800
Subject: [PATCH 26/40] firewalld: avoid autoreconfHook

Run autogen.sh to properly create i18n and l10n files.
---
 pkgs/by-name/fi/firewalld/package.nix | 10 ++++++++--
 1 file changed, 8 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/fi/firewalld/package.nix b/pkgs/by-name/fi/firewalld/package.nix
index bd112bbda6be..c71515ccec25 100644
--- a/pkgs/by-name/fi/firewalld/package.nix
+++ b/pkgs/by-name/fi/firewalld/package.nix
@@ -2,7 +2,8 @@
   lib,
   stdenv,
   fetchFromGitHub,
-  autoreconfHook,
+  autoconf,
+  automake,
   bash,
   docbook_xml_dtd_42,
   docbook-xsl-nons,
@@ -67,7 +68,8 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs =
     [
-      autoreconfHook
+      autoconf
+      automake
       docbook_xml_dtd_42
       docbook-xsl-nons
       glib
@@ -94,6 +96,10 @@ stdenv.mkDerivation rec {
       pythonPath
     ];
 
+  preConfigure = ''
+    ./autogen.sh
+  '';
+
   dontWrapGApps = true;
 
   preFixup = lib.optionalString withGui ''

From ea57607629880fda5c879797aa8e86846392a2a0 Mon Sep 17 00:00:00 2001
From: Sizhe Zhao <prc.zhao@outlook.com>
Date: Mon, 24 Mar 2025 17:33:00 +0800
Subject: [PATCH 27/40] firewalld: add runtime programs as build inputs

---
 pkgs/by-name/fi/firewalld/package.nix | 14 ++++++++++++--
 1 file changed, 12 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/fi/firewalld/package.nix b/pkgs/by-name/fi/firewalld/package.nix
index c71515ccec25..328c4171efe1 100644
--- a/pkgs/by-name/fi/firewalld/package.nix
+++ b/pkgs/by-name/fi/firewalld/package.nix
@@ -4,19 +4,22 @@
   fetchFromGitHub,
   autoconf,
   automake,
-  bash,
   docbook_xml_dtd_42,
   docbook-xsl-nons,
   glib,
   gobject-introspection,
   gtk3,
   intltool,
+  ipset,
+  iptables,
+  kmod,
   libnotify,
   libxml2,
   libxslt,
   networkmanagerapplet,
   pkg-config,
   python3,
+  sysctl,
   wrapGAppsNoGuiHook,
   withGui ? false,
 }:
@@ -74,11 +77,15 @@ stdenv.mkDerivation rec {
       docbook-xsl-nons
       glib
       intltool
+      ipset
+      iptables
+      kmod
       libxml2
       libxslt
       pkg-config
       python3
       python3.pkgs.wrapPython
+      sysctl
     ]
     ++ lib.optionals withGui [
       gobject-introspection
@@ -87,8 +94,11 @@ stdenv.mkDerivation rec {
 
   buildInputs =
     [
-      bash
       glib
+      ipset
+      iptables
+      kmod
+      sysctl
     ]
     ++ lib.optionals withGui [
       gtk3

From dacd3b409bd0f74f67c8c407b5d7b2ad955b4a32 Mon Sep 17 00:00:00 2001
From: Sizhe Zhao <prc.zhao@outlook.com>
Date: Mon, 24 Mar 2025 17:47:07 +0800
Subject: [PATCH 28/40] firewalld: install applet and config for gui

---
 pkgs/by-name/fi/firewalld/package.nix | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/pkgs/by-name/fi/firewalld/package.nix b/pkgs/by-name/fi/firewalld/package.nix
index 328c4171efe1..3f5fcf9f2d1c 100644
--- a/pkgs/by-name/fi/firewalld/package.nix
+++ b/pkgs/by-name/fi/firewalld/package.nix
@@ -110,6 +110,10 @@ stdenv.mkDerivation rec {
     ./autogen.sh
   '';
 
+  postInstall = lib.optionalString (!withGui) ''
+    rm $out/bin/firewall-{applet,config}
+  '';
+
   dontWrapGApps = true;
 
   preFixup = lib.optionalString withGui ''

From 652cac382a47bc721e84552a2ef7d24e1df74721 Mon Sep 17 00:00:00 2001
From: Sizhe Zhao <prc.zhao@outlook.com>
Date: Mon, 24 Mar 2025 17:52:10 +0800
Subject: [PATCH 29/40] firewalld: wrap non-gui programs with gtk

---
 pkgs/by-name/fi/firewalld/package.nix | 45 +++++++++++++--------------
 1 file changed, 21 insertions(+), 24 deletions(-)

diff --git a/pkgs/by-name/fi/firewalld/package.nix b/pkgs/by-name/fi/firewalld/package.nix
index 3f5fcf9f2d1c..9b4d85799135 100644
--- a/pkgs/by-name/fi/firewalld/package.nix
+++ b/pkgs/by-name/fi/firewalld/package.nix
@@ -69,41 +69,38 @@ stdenv.mkDerivation rec {
         --replace "/usr/bin/nm-connection-editor" "${networkmanagerapplet}/bin/nm-connection-editor"
     '';
 
-  nativeBuildInputs =
-    [
-      autoconf
-      automake
-      docbook_xml_dtd_42
-      docbook-xsl-nons
-      glib
-      intltool
-      ipset
-      iptables
-      kmod
-      libxml2
-      libxslt
-      pkg-config
-      python3
-      python3.pkgs.wrapPython
-      sysctl
-    ]
-    ++ lib.optionals withGui [
-      gobject-introspection
-      wrapGAppsNoGuiHook
-    ];
+  nativeBuildInputs = [
+    autoconf
+    automake
+    docbook_xml_dtd_42
+    docbook-xsl-nons
+    glib
+    intltool
+    ipset
+    iptables
+    kmod
+    libxml2
+    libxslt
+    pkg-config
+    python3
+    python3.pkgs.wrapPython
+    sysctl
+    wrapGAppsNoGuiHook
+  ];
 
   buildInputs =
     [
       glib
+      gobject-introspection
       ipset
       iptables
       kmod
+      pythonPath
       sysctl
     ]
     ++ lib.optionals withGui [
       gtk3
       libnotify
-      pythonPath
     ];
 
   preConfigure = ''
@@ -116,7 +113,7 @@ stdenv.mkDerivation rec {
 
   dontWrapGApps = true;
 
-  preFixup = lib.optionalString withGui ''
+  preFixup = ''
     makeWrapperArgs+=("''${gappsWrapperArgs[@]}")
   '';
 

From 099202f1baba54c072e3f10d5a28da79a010064a Mon Sep 17 00:00:00 2001
From: Sizhe Zhao <prc.zhao@outlook.com>
Date: Mon, 24 Mar 2025 23:25:54 +0800
Subject: [PATCH 30/40] firewalld: use pyqt6 instead of pyqt5

---
 pkgs/by-name/fi/firewalld/package.nix | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/pkgs/by-name/fi/firewalld/package.nix b/pkgs/by-name/fi/firewalld/package.nix
index 9b4d85799135..468d63e0db95 100644
--- a/pkgs/by-name/fi/firewalld/package.nix
+++ b/pkgs/by-name/fi/firewalld/package.nix
@@ -34,8 +34,7 @@ let
       pygobject3
     ]
     ++ lib.optionals withGui [
-      pyqt5
-      pyqt5-sip
+      pyqt6
     ]
   );
 in

From 27d754aac6dff811c2a01562a65a5380250ef40f Mon Sep 17 00:00:00 2001
From: Sizhe Zhao <prc.zhao@outlook.com>
Date: Mon, 24 Mar 2025 23:31:51 +0800
Subject: [PATCH 31/40] firewalld: fix networkmanager integration

---
 pkgs/by-name/fi/firewalld/package.nix | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/fi/firewalld/package.nix b/pkgs/by-name/fi/firewalld/package.nix
index 468d63e0db95..7fab2ce7beb6 100644
--- a/pkgs/by-name/fi/firewalld/package.nix
+++ b/pkgs/by-name/fi/firewalld/package.nix
@@ -12,10 +12,12 @@
   intltool,
   ipset,
   iptables,
+  kdePackages,
   kmod,
   libnotify,
   libxml2,
   libxslt,
+  networkmanager,
   networkmanagerapplet,
   pkg-config,
   python3,
@@ -56,7 +58,7 @@ stdenv.mkDerivation rec {
   postPatch =
     ''
       substituteInPlace src/firewall/config/__init__.py.in \
-        --replace "/usr/share" "$out/share"
+        --replace-fail /usr "$out"
 
       for file in config/firewall-{applet,config}.desktop.in; do
         substituteInPlace $file \
@@ -65,7 +67,8 @@ stdenv.mkDerivation rec {
     ''
     + lib.optionalString withGui ''
       substituteInPlace src/firewall-applet.in \
-        --replace "/usr/bin/nm-connection-editor" "${networkmanagerapplet}/bin/nm-connection-editor"
+        --replace-fail "/usr/bin/systemsettings" "${kdePackages.systemsettings}/bin/systemsettings" \
+        --replace-fail "/usr/bin/nm-connection-editor" "${networkmanagerapplet}/bin/nm-connection-editor"
     '';
 
   nativeBuildInputs = [
@@ -94,6 +97,7 @@ stdenv.mkDerivation rec {
       ipset
       iptables
       kmod
+      networkmanager
       pythonPath
       sysctl
     ]

From 3a1c054bb9390e158652c1efe20367b2eb8ee252 Mon Sep 17 00:00:00 2001
From: Sizhe Zhao <prc.zhao@outlook.com>
Date: Mon, 24 Mar 2025 23:33:42 +0800
Subject: [PATCH 32/40] firewalld: fix paths

---
 pkgs/by-name/fi/firewalld/package.nix | 11 ++++++-----
 1 file changed, 6 insertions(+), 5 deletions(-)

diff --git a/pkgs/by-name/fi/firewalld/package.nix b/pkgs/by-name/fi/firewalld/package.nix
index 7fab2ce7beb6..dae4be7bc773 100644
--- a/pkgs/by-name/fi/firewalld/package.nix
+++ b/pkgs/by-name/fi/firewalld/package.nix
@@ -57,12 +57,13 @@ stdenv.mkDerivation rec {
 
   postPatch =
     ''
-      substituteInPlace src/firewall/config/__init__.py.in \
-        --replace-fail /usr "$out"
+      substituteInPlace config/xmlschema/check.sh \
+        --replace-fail /usr/bin/ ""
 
-      for file in config/firewall-{applet,config}.desktop.in; do
-        substituteInPlace $file \
-          --replace "/usr/bin/" "$out/bin/"
+      for file in src/{firewall-offline-cmd.in,firewall/config/__init__.py.in} \
+        config/firewall-{applet,config}.desktop.in; do
+          substituteInPlace $file \
+            --replace-fail /usr "$out"
       done
     ''
     + lib.optionalString withGui ''

From ee19ecd464c92be604bc98433b985b5dc233637f Mon Sep 17 00:00:00 2001
From: Sizhe Zhao <prc.zhao@outlook.com>
Date: Mon, 24 Mar 2025 23:36:52 +0800
Subject: [PATCH 33/40] firewalld: wrap gui programs with qt6

---
 pkgs/by-name/fi/firewalld/package.nix | 53 ++++++++++++++++-----------
 1 file changed, 32 insertions(+), 21 deletions(-)

diff --git a/pkgs/by-name/fi/firewalld/package.nix b/pkgs/by-name/fi/firewalld/package.nix
index dae4be7bc773..9c54afb0f871 100644
--- a/pkgs/by-name/fi/firewalld/package.nix
+++ b/pkgs/by-name/fi/firewalld/package.nix
@@ -21,6 +21,7 @@
   networkmanagerapplet,
   pkg-config,
   python3,
+  qt6,
   sysctl,
   wrapGAppsNoGuiHook,
   withGui ? false,
@@ -72,24 +73,28 @@ stdenv.mkDerivation rec {
         --replace-fail "/usr/bin/nm-connection-editor" "${networkmanagerapplet}/bin/nm-connection-editor"
     '';
 
-  nativeBuildInputs = [
-    autoconf
-    automake
-    docbook_xml_dtd_42
-    docbook-xsl-nons
-    glib
-    intltool
-    ipset
-    iptables
-    kmod
-    libxml2
-    libxslt
-    pkg-config
-    python3
-    python3.pkgs.wrapPython
-    sysctl
-    wrapGAppsNoGuiHook
-  ];
+  nativeBuildInputs =
+    [
+      autoconf
+      automake
+      docbook_xml_dtd_42
+      docbook-xsl-nons
+      glib
+      intltool
+      ipset
+      iptables
+      kmod
+      libxml2
+      libxslt
+      pkg-config
+      python3
+      python3.pkgs.wrapPython
+      sysctl
+      wrapGAppsNoGuiHook
+    ]
+    ++ lib.optionals withGui [
+      qt6.wrapQtAppsHook
+    ];
 
   buildInputs =
     [
@@ -105,6 +110,7 @@ stdenv.mkDerivation rec {
     ++ lib.optionals withGui [
       gtk3
       libnotify
+      qt6.qtbase
     ];
 
   preConfigure = ''
@@ -116,10 +122,15 @@ stdenv.mkDerivation rec {
   '';
 
   dontWrapGApps = true;
+  dontWrapQtApps = true;
 
-  preFixup = ''
-    makeWrapperArgs+=("''${gappsWrapperArgs[@]}")
-  '';
+  preFixup =
+    ''
+      makeWrapperArgs+=("''${gappsWrapperArgs[@]}")
+    ''
+    + lib.optionalString withGui ''
+      makeWrapperArgs+=("''${qtWrapperArgs[@]}")
+    '';
 
   postFixup = ''
     chmod +x $out/share/firewalld/*.py $out/share/firewalld/testsuite/python/*.py $out/share/firewalld/testsuite/{,integration/}testsuite

From 367f4890275bde16bbd2a5f60e9bc111e09ff7fc Mon Sep 17 00:00:00 2001
From: Sizhe Zhao <prc.zhao@outlook.com>
Date: Mon, 24 Mar 2025 23:40:09 +0800
Subject: [PATCH 34/40] firewalld: fix i18n

---
 pkgs/by-name/fi/firewalld/package.nix             |  1 +
 pkgs/by-name/fi/firewalld/specify-localedir.patch | 12 ++++++++++++
 2 files changed, 13 insertions(+)
 create mode 100644 pkgs/by-name/fi/firewalld/specify-localedir.patch

diff --git a/pkgs/by-name/fi/firewalld/package.nix b/pkgs/by-name/fi/firewalld/package.nix
index 9c54afb0f871..d28f0ce70a89 100644
--- a/pkgs/by-name/fi/firewalld/package.nix
+++ b/pkgs/by-name/fi/firewalld/package.nix
@@ -54,6 +54,7 @@ stdenv.mkDerivation rec {
 
   patches = [
     ./respect-xml-catalog-files-var.patch
+    ./specify-localedir.patch
   ];
 
   postPatch =
diff --git a/pkgs/by-name/fi/firewalld/specify-localedir.patch b/pkgs/by-name/fi/firewalld/specify-localedir.patch
new file mode 100644
index 000000000000..57e79da4d0b1
--- /dev/null
+++ b/pkgs/by-name/fi/firewalld/specify-localedir.patch
@@ -0,0 +1,12 @@
+--- a/src/firewall/config/__init__.py.in
++++ b/src/firewall/config/__init__.py.in
+@@ -19,6 +19,9 @@
+ DOMAIN = "firewalld"
+ import gettext
+ 
++locale.bindtextdomain(DOMAIN, "/usr/share/locale")
++gettext.bindtextdomain(DOMAIN, "/usr/share/locale")
++
+ gettext.install(domain=DOMAIN)
+ 
+ from . import dbus  # noqa: F401

From 2b32dee3c3fc668cfa8015151cf62532dfc8669b Mon Sep 17 00:00:00 2001
From: Sizhe Zhao <prc.zhao@outlook.com>
Date: Mon, 24 Mar 2025 23:42:18 +0800
Subject: [PATCH 35/40] firewalld: remove testsuite

---
 pkgs/by-name/fi/firewalld/package.nix | 15 +++++++++------
 1 file changed, 9 insertions(+), 6 deletions(-)

diff --git a/pkgs/by-name/fi/firewalld/package.nix b/pkgs/by-name/fi/firewalld/package.nix
index d28f0ce70a89..466e25285a91 100644
--- a/pkgs/by-name/fi/firewalld/package.nix
+++ b/pkgs/by-name/fi/firewalld/package.nix
@@ -118,9 +118,13 @@ stdenv.mkDerivation rec {
     ./autogen.sh
   '';
 
-  postInstall = lib.optionalString (!withGui) ''
-    rm $out/bin/firewall-{applet,config}
-  '';
+  postInstall =
+    ''
+      rm -r $out/share/firewalld/testsuite
+    ''
+    + lib.optionalString (!withGui) ''
+      rm $out/bin/firewall-{applet,config}
+    '';
 
   dontWrapGApps = true;
   dontWrapQtApps = true;
@@ -134,10 +138,9 @@ stdenv.mkDerivation rec {
     '';
 
   postFixup = ''
-    chmod +x $out/share/firewalld/*.py $out/share/firewalld/testsuite/python/*.py $out/share/firewalld/testsuite/{,integration/}testsuite
-    patchShebangs --host $out/share/firewalld/testsuite/{,integration/}testsuite $out/share/firewalld/*.py
+    chmod +x $out/share/firewalld/*.py
+    patchShebangs --host $out/share/firewalld/*.py
     wrapPythonProgramsIn "$out/bin" "$out ${pythonPath}"
-    wrapPythonProgramsIn "$out/share/firewalld/testsuite/python" "$out ${pythonPath}"
   '';
 
   meta = {

From ea168da721a097d9364b113b8352f0546fe50dff Mon Sep 17 00:00:00 2001
From: Sizhe Zhao <prc.zhao@outlook.com>
Date: Mon, 7 Apr 2025 11:20:03 +0800
Subject: [PATCH 36/40] firewalld: add NIX_FIREWALLD_CONFIG_PATH

---
 .../fi/firewalld/add-config-path-env-var.patch       | 12 ++++++++++++
 pkgs/by-name/fi/firewalld/package.nix                |  1 +
 2 files changed, 13 insertions(+)
 create mode 100644 pkgs/by-name/fi/firewalld/add-config-path-env-var.patch

diff --git a/pkgs/by-name/fi/firewalld/add-config-path-env-var.patch b/pkgs/by-name/fi/firewalld/add-config-path-env-var.patch
new file mode 100644
index 000000000000..bba877e5593a
--- /dev/null
+++ b/pkgs/by-name/fi/firewalld/add-config-path-env-var.patch
@@ -0,0 +1,12 @@
+--- a/src/firewall/config/__init__.py.in
++++ b/src/firewall/config/__init__.py.in
+@@ -80,7 +80,8 @@
+     FIREWALLD_POLICIES = path + "/policies"
+ 
+ 
+-set_default_config_paths("/usr/lib/firewalld")
++import os
++set_default_config_paths(os.environ.get("NIX_FIREWALLD_CONFIG_PATH", "/usr/lib/firewalld"))
+ 
+ FIREWALLD_LOGFILE = "/var/log/firewalld"
+ 
diff --git a/pkgs/by-name/fi/firewalld/package.nix b/pkgs/by-name/fi/firewalld/package.nix
index 466e25285a91..f8606abb4757 100644
--- a/pkgs/by-name/fi/firewalld/package.nix
+++ b/pkgs/by-name/fi/firewalld/package.nix
@@ -53,6 +53,7 @@ stdenv.mkDerivation rec {
   };
 
   patches = [
+    ./add-config-path-env-var.patch
     ./respect-xml-catalog-files-var.patch
     ./specify-localedir.patch
   ];

From afd5a4bf7ba952d99ed40f894d848b45a0135fd0 Mon Sep 17 00:00:00 2001
From: Sizhe Zhao <prc.zhao@outlook.com>
Date: Sat, 12 Apr 2025 13:55:07 +0800
Subject: [PATCH 37/40] firewalld: remove linux-only dependencies

---
 pkgs/by-name/fi/firewalld/package.nix | 18 ++++++++++++++----
 1 file changed, 14 insertions(+), 4 deletions(-)

diff --git a/pkgs/by-name/fi/firewalld/package.nix b/pkgs/by-name/fi/firewalld/package.nix
index f8606abb4757..59c62cdfd2d8 100644
--- a/pkgs/by-name/fi/firewalld/package.nix
+++ b/pkgs/by-name/fi/firewalld/package.nix
@@ -83,15 +83,11 @@ stdenv.mkDerivation rec {
       docbook-xsl-nons
       glib
       intltool
-      ipset
-      iptables
-      kmod
       libxml2
       libxslt
       pkg-config
       python3
       python3.pkgs.wrapPython
-      sysctl
       wrapGAppsNoGuiHook
     ]
     ++ lib.optionals withGui [
@@ -119,6 +115,20 @@ stdenv.mkDerivation rec {
     ./autogen.sh
   '';
 
+  ac_cv_path_MODPROBE = lib.getExe' kmod "modprobe";
+  ac_cv_path_RMMOD = lib.getExe' kmod "rmmod";
+  ac_cv_path_SYSCTL = lib.getExe' sysctl "sysctl";
+
+  configureFlags = [
+    "--with-iptables=${lib.getExe' iptables "iptables"}"
+    "--with-iptables-restore=${lib.getExe' iptables "iptables-restore"}"
+    "--with-ip6tables=${lib.getExe' iptables "ip6tables"}"
+    "--with-ip6tables-restore=${lib.getExe' iptables "ip6tables-restore"}"
+    "--with-ebtables=${lib.getExe' iptables "ebtables"}"
+    "--with-ebtables-restore=${lib.getExe' iptables "ebtables-restore"}"
+    "--with-ipset=${lib.getExe' ipset "ipset"}"
+  ];
+
   postInstall =
     ''
       rm -r $out/share/firewalld/testsuite

From 6b9ee4386f01e7ced3f87db38f2e39bbf1851127 Mon Sep 17 00:00:00 2001
From: Piotr Kwiecinski <2151333+piotrkwiecinski@users.noreply.github.com>
Date: Sat, 12 Apr 2025 10:56:04 +0200
Subject: [PATCH 38/40] php8{1-4}Extensions.parallel: 1.2.4 -> 1.2.6

---
 pkgs/development/php-packages/parallel/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/php-packages/parallel/default.nix b/pkgs/development/php-packages/parallel/default.nix
index abb5da0bb888..c3ab601ae1d5 100644
--- a/pkgs/development/php-packages/parallel/default.nix
+++ b/pkgs/development/php-packages/parallel/default.nix
@@ -6,8 +6,8 @@
 
 buildPecl {
   pname = "parallel";
-  version = "1.2.4";
-  hash = "sha256-s9W9aZpQsJLdzZ/d2E1iGDsMTAAjeWbOgWeKP6nNp0A=";
+  version = "1.2.6";
+  hash = "sha256-tFQUbRxEb7gJlec0447akrngkJ0UZqojz5QNfXqvDcA=";
   meta = {
     description = "Parallel concurrency API";
     # parallel extension requires PHP with ZTS enabled

From 6572a9c92693d5d795970d1995cd907e97e9b8bc Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sat, 12 Apr 2025 09:38:50 +0000
Subject: [PATCH 39/40] php83: 8.3.19 -> 8.3.20

---
 pkgs/development/interpreters/php/8.3.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/interpreters/php/8.3.nix b/pkgs/development/interpreters/php/8.3.nix
index 594b2eacebbf..82f4249c21f0 100644
--- a/pkgs/development/interpreters/php/8.3.nix
+++ b/pkgs/development/interpreters/php/8.3.nix
@@ -4,8 +4,8 @@ let
   base = callPackage ./generic.nix (
     _args
     // {
-      version = "8.3.19";
-      hash = "sha256-rWkCoqAvlOw+mYIGniZou6POR+L2u7q5Xra323vz01A=";
+      version = "8.3.20";
+      hash = "sha256-NrTmoyPNRWc6VPKW6dJma39d9XZBAxx3xP2BN7xOvrM=";
     }
   );
 in

From f516607cdc82d0d9b7961f85df0a7ce3e73329f5 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Fri, 11 Apr 2025 12:13:17 +0000
Subject: [PATCH 40/40] trilium-next-desktop: 0.92.6 -> 0.92.7

---
 pkgs/by-name/tr/trilium-next-desktop/package.nix | 14 +++++++-------
 pkgs/by-name/tr/trilium-next-server/package.nix  |  6 +++---
 2 files changed, 10 insertions(+), 10 deletions(-)

diff --git a/pkgs/by-name/tr/trilium-next-desktop/package.nix b/pkgs/by-name/tr/trilium-next-desktop/package.nix
index 37bec86b0668..584b271af68e 100644
--- a/pkgs/by-name/tr/trilium-next-desktop/package.nix
+++ b/pkgs/by-name/tr/trilium-next-desktop/package.nix
@@ -5,7 +5,7 @@
   fetchurl,
   makeBinaryWrapper,
   # use specific electron since it has to load a compiled module
-  electron_34,
+  electron_35,
   autoPatchelfHook,
   makeDesktopItem,
   copyDesktopItems,
@@ -15,7 +15,7 @@
 
 let
   pname = "trilium-next-desktop";
-  version = "0.92.6";
+  version = "0.92.7";
 
   triliumSource = os: arch: sha256: {
     url = "https://github.com/TriliumNext/Notes/releases/download/v${version}/TriliumNextNotes-v${version}-${os}-${arch}.zip";
@@ -26,10 +26,10 @@ let
   darwinSource = triliumSource "macos";
 
   # exposed like this for update.sh
-  x86_64-linux.sha256 = "1ky5w6iwqcsc66ywgamkfs9yd6bp51c3y69251pi4b365dwbglf5";
-  aarch64-linux.sha256 = "1zm6g2rkg31ahnn8y5h42vb632pqjg6d8kb4xkkrb4pp9h71sgjm";
-  x86_64-darwin.sha256 = "011y5vh0bfn73l8n4my5pdpgrvvicy1lvnjrb1qyaglg7gw2sy0r";
-  aarch64-darwin.sha256 = "05v6pk1h5y5kqwjkixji3a44dcr219320z0i6yvwv4d8mc943qhs";
+  x86_64-linux.sha256 = "0m907hc7bvamkvijsbxqg6ns7dv7qz02d5fsl6wgqx5vi6w02y9w";
+  aarch64-linux.sha256 = "1hb3sjkzz3d9vrjramz47l4aqqm7ah2k7a9s14csxllcjqjmv8nz";
+  x86_64-darwin.sha256 = "0qscjw2j0nyxvx9w6m4n9yb30wzk5xmg7ylf8yp0k58jxvi7b87q";
+  aarch64-darwin.sha256 = "1ah25g41x7kpjvwih59mfcf2lylwppdklrmmm1s1p2fn4261jds4";
 
   sources = {
     x86_64-linux = linuxSource "x64" x86_64-linux.sha256;
@@ -115,7 +115,7 @@ let
       asar pack $tmp/ $out/share/trilium/resources/app.asar
       rm -rf $tmp
 
-      makeWrapper ${lib.getExe electron_34} $out/bin/trilium \
+      makeWrapper ${lib.getExe electron_35} $out/bin/trilium \
         "''${gappsWrapperArgs[@]}" \
         --set-default ELECTRON_IS_DEV 0 \
         --add-flags $out/share/trilium/resources/app.asar
diff --git a/pkgs/by-name/tr/trilium-next-server/package.nix b/pkgs/by-name/tr/trilium-next-server/package.nix
index 71bce5aff70b..2ee833043e27 100644
--- a/pkgs/by-name/tr/trilium-next-server/package.nix
+++ b/pkgs/by-name/tr/trilium-next-server/package.nix
@@ -7,12 +7,12 @@
 }:
 
 let
-  version = "0.92.6";
+  version = "0.92.7";
 
   serverSource_x64.url = "https://github.com/TriliumNext/Notes/releases/download/v${version}/TriliumNextNotes-Server-v${version}-linux-x64.tar.xz";
-  serverSource_x64.sha256 = "1mh7q11hwp5vrbdrwb0apmxkiv90i3163m8a3cbv0jhd5amv9rjv";
+  serverSource_x64.sha256 = "0ckwfk27wfskd8pk5blvcvn6pd4jmq0dys283gsqk271n8ca4537";
   serverSource_arm64.url = "https://github.com/TriliumNext/Notes/releases/download/v${version}/TriliumNextNotes-Server-v${version}-linux-arm64.tar.xz";
-  serverSource_arm64.sha256 = "1w5208izjifcq4vsryjpmw2nr140fk2h802q9lkil1646r2b5lyg";
+  serverSource_arm64.sha256 = "1lk0mf4h74d9z1w5jdfwbxsdh1mbbjr6gx0q0w0wg6y3ylyjcii9";
 
   serverSource =
     if stdenv.hostPlatform.isx86_64 then