pre-commit: unbreak darwin (#414549)

Co-authored-by: Frontear <Frontear@users.noreply.github.com>

doc/languages-frameworks/python.section.md

@@ -1259,6 +1259,13 @@ as many tests should be enabled as possible. Failing tests can still be
 a good indication that the package is not in a valid state.
 :::
 
+::: {.note}
+We only want to test the functionality of a package. In particular, we are not
+interested in coverage, formatting, and type checking. If pytest fails with
+`unrecognized arguments: --cov`, add `pytest-cov-stub` to `nativeCheckInputs`
+rather than `pytest-cov`.
+:::
+
 #### Using pytest {#using-pytest}
 
 Pytest is the most common test runner for python repositories. A trivial

doc/release-notes/rl-2511.section.md

@@ -21,7 +21,7 @@
 
 <!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->
 
-- Create the first release note entry in this section!
+- Added `rewriteURL` attribute to the nixpkgs `config`, to allow for rewriting the URLs downloaded by `fetchurl`.
 
 ## Nixpkgs Library {#sec-nixpkgs-release-25.11-lib}
 

doc/stdenv/stdenv.chapter.md

@@ -599,6 +599,8 @@ Additional file types can be supported by setting the `unpackCmd` variable (see
 
 The list of source files or directories to be unpacked or copied. One of these must be set. Note that if you use `srcs`, you should also set `sourceRoot` or `setSourceRoot`.
 
+These should ideally actually be sources and licensed under a FLOSS license.  If you have to use a binary upstream release or package non-free software, make sure you correctly mark your derivation as such in the [`sourceProvenance`](#var-meta-sourceProvenance) and [`license`](#sec-meta-license) fields of the [`meta`](#chap-meta) section.
+
 ##### `sourceRoot` {#var-stdenv-sourceRoot}
 
 After unpacking all of `src` and `srcs`, if neither of `sourceRoot` and `setSourceRoot` are set, `unpackPhase` of the generic builder checks that the unpacking produced a single directory and moves the current working directory into it.

maintainers/maintainer-list.nix

@@ -2896,17 +2896,11 @@
     name = "Brandon Elam Barker";
   };
   bbenne10 = {
-    email = "Bryan.Bennett@protonmail.com";
+    email = "Bryan.Bennett+nixpkgs@proton.me";
     matrix = "@bryan.bennett:matrix.org";
     github = "bbenne10";
     githubId = 687376;
     name = "Bryan Bennett";
-    keys = [
-      {
-        # compare with https://keybase.io/bbenne10
-        fingerprint = "41EA 00B4 00F9 6970 1CB2  D3AF EF90 E3E9 8B8F 5C0B";
-      }
-    ];
   };
   bbenno = {
     email = "nix@bbenno.com";
@@ -16167,7 +16161,7 @@
     email = "mightyiampresence@gmail.com";
     github = "mightyiam";
     githubId = 635591;
-    name = "Shahar Dawn Or";
+    name = "Shahar \"Dawn\" Or";
   };
   mihaimaruseac = {
     email = "mihaimaruseac@gmail.com";
@@ -17721,6 +17715,12 @@
     github = "nikstur";
     githubId = 61635709;
   };
+  nilathedragon = {
+    email = "nilathedragon@pm.me";
+    name = "Nila The Dragon";
+    github = "nilathedragon";
+    githubId = 43315617;
+  };
   nilp0inter = {
     email = "robertomartinezp@gmail.com";
     github = "nilp0inter";
@@ -27252,6 +27252,11 @@
     githubId = 4113027;
     name = "Jesper Geertsen Jonsson";
   };
+  yethal = {
+    github = "yethal";
+    githubId = 26117918;
+    name = "Yethal";
+  };
   yinfeng = {
     email = "lin.yinfeng@outlook.com";
     github = "linyinfeng";

maintainers/team-list.nix

@@ -913,6 +913,7 @@ with lib.maintainers;
   ngi = {
     members = [
       eljamm
+      ethancedwards8
       fricklerhandwerk
       wegank
     ];

nixos/doc/manual/redirects.json

@@ -749,6 +749,15 @@
   "module-services-davis-basic-usage": [
     "index.html#module-services-davis-basic-usage"
   ],
+  "module-services-draupnir": [
+    "index.html#module-services-draupnir"
+  ],
+  "module-services-draupnir-setup": [
+    "index.html#module-services-draupnir-setup"
+  ],
+  "module-services-draupnir-setup-ems": [
+    "index.html#module-services-draupnir-setup-ems"
+  ],
   "module-services-castopod": [
     "index.html#module-services-castopod"
   ],

nixos/doc/manual/release-notes/rl-2511.section.md

@@ -22,8 +22,12 @@
 
 - [Broadcast Box](https://github.com/Glimesh/broadcast-box), a WebRTC broadcast server. Available as [services.broadcast-box](options.html#opt-services.broadcast-box.enable).
 
+- [Draupnir](https://github.com/the-draupnir-project/draupnir), a Matrix moderation bot. Available as [services.draupnir](#opt-services.draupnir.enable).
+
 - [SuiteNumérique Docs](https://github.com/suitenumerique/docs), a collaborative note taking, wiki and documentation web platform and alternative to Notion or Outline. Available as [services.lasuite-docs](#opt-services.lasuite-docs.enable).
 
+[dwl](https://codeberg.org/dwl/dwl), a compact, hackable compositor for Wayland based on wlroots. Available as [programs.dwl](#opt-programs.dwl.enable).
+
 ## Backward Incompatibilities {#sec-release-25.11-incompatibilities}
 
 <!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->
@@ -40,5 +44,7 @@
 
 - `services.clamsmtp` is unmaintained and was removed from Nixpkgs.
 
+- `services.dnscrypt-proxy2` gains a `package` option to specify dnscrypt-proxy package to use.
+
 - `amdgpu` kernel driver overdrive mode can now be enabled by setting [hardware.amdgpu.overdrive.enable](#opt-hardware.amdgpu.overdrive.enable) and customized through [hardware.amdgpu.overdrive.ppfeaturemask](#opt-hardware.amdgpu.overdrive.ppfeaturemask).
   This allows for fine-grained control over the GPU's performance and maybe required by overclocking softwares like Corectrl and Lact. These new options replace old options such as {option}`programs.corectrl.gpuOverclock.enable` and {option}`programs.tuxclocker.enableAMD`.

nixos/modules/installer/tools/nixos-generate-config.pl

@@ -49,6 +49,7 @@ if (-e "/etc/nixos-generate-config.conf") {
         $rootDir = File::Spec->rel2abs($rootDir); # resolve absolute path
     }
     $kernel = $cfg->val("Defaults", "Kernel") // $kernel;
+    $flake = $cfg->val("Defaults", "Flake") // $flake;
 }
 
 for (my $n = 0; $n < scalar @ARGV; $n++) {

nixos/modules/module-list.nix

@@ -332,6 +332,7 @@
   ./programs/vivid.nix
   ./programs/wavemon.nix
   ./programs/wayland/cardboard.nix
+  ./programs/wayland/dwl.nix
   ./programs/wayland/gtklock.nix
   ./programs/wayland/hyprland.nix
   ./programs/wayland/hyprlock.nix
@@ -757,6 +758,7 @@
   ./services/matrix/conduit.nix
   ./services/matrix/continuwuity.nix
   ./services/matrix/dendrite.nix
+  ./services/matrix/draupnir.nix
   ./services/matrix/hebbot.nix
   ./services/matrix/hookshot.nix
   ./services/matrix/lk-jwt-service.nix

nixos/modules/programs/gpu-screen-recorder.nix

@@ -34,6 +34,12 @@ in
       capabilities = "cap_sys_admin+ep";
       source = "${package}/bin/gsr-kms-server";
     };
+    security.wrappers."gpu-screen-recorder" = {
+      owner = "root";
+      group = "root";
+      capabilities = "cap_sys_nice+ep";
+      source = "${package}/bin/gpu-screen-recorder";
+    };
   };
 
   meta.maintainers = with lib.maintainers; [ timschumi ];

nixos/modules/programs/wayland/dwl.nix

@@ -0,0 +1,104 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+let
+  cfg = config.programs.dwl;
+in
+{
+  options.programs.dwl = {
+    enable = lib.mkEnableOption ''
+      Dwl is a compact, hackable compositor for Wayland based on wlroots.
+      You can manually launch Dwl by executing "exec dwl" on a TTY.
+    '';
+
+    package = lib.mkPackageOption pkgs "dwl" {
+      example = ''
+        # Lets apply bar patch from:
+        # https://codeberg.org/dwl/dwl-patches/src/branch/main/patches/bar
+        (pkgs.dwl.override {
+          configH = ./dwl-config.h;
+        }).overrideAttrs (oldAttrs: {
+          buildInputs =
+            oldAttrs.buildInputs or []
+            ++ [
+              pkgs.libdrm
+              pkgs.fcft
+            ];
+          patches = oldAttrs.patches or [] ++ [
+            ./bar-0.7.patch
+          ];
+        });
+      '';
+    };
+
+    extraSessionCommands = lib.mkOption {
+      default = "";
+      type = lib.types.lines;
+      description = ''
+        Shell commands executed just before dwl is started.
+      '';
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    environment.systemPackages = [ cfg.package ];
+
+    # Create systemd target for dwl session
+    systemd.user.targets.dwl-session = {
+      description = "dwl compositor session";
+      documentation = [ "man:systemd.special(7)" ];
+      bindsTo = [ "graphical-session.target" ];
+      wants = [ "graphical-session-pre.target" ];
+      after = [ "graphical-session-pre.target" ];
+    };
+
+    # Create wrapper script for dwl
+    environment.etc."xdg/dwl-session" = {
+      text = ''
+        #!${pkgs.runtimeShell}
+        # Import environment variables
+        ${cfg.extraSessionCommands}
+        # Setup systemd user environment
+        systemctl --user import-environment DISPLAY WAYLAND_DISPLAY
+        systemctl --user start dwl-session.target
+        # Start dwl
+        exec ${lib.getExe cfg.package}
+      '';
+      mode = "0755"; # Make it executable
+    };
+
+    # Create desktop entry for display managers
+    services.displayManager.sessionPackages =
+      let
+        dwlDesktopFile = pkgs.writeTextFile {
+          name = "dwl-desktop-entry";
+          destination = "/share/wayland-sessions/dwl.desktop";
+          text = ''
+            [Desktop Entry]
+            Name=dwl
+            Comment=Dynamic window manager for Wayland
+            Exec=/etc/xdg/dwl-session
+            Type=Application
+          '';
+        };
+
+        dwlSession = pkgs.symlinkJoin {
+          name = "dwl-session";
+          paths = [ dwlDesktopFile ];
+          passthru.providedSessions = [ "dwl" ];
+        };
+      in
+      [ dwlSession ];
+
+    # Configure XDG portal for dwl (minimal configuration)
+    xdg.portal.config.dwl.default = lib.mkDefault [
+      "wlr"
+      "gtk"
+    ];
+  };
+
+  meta.maintainers = with lib.maintainers; [ gurjaka ];
+}

nixos/modules/services/matrix/draupnir.md

@@ -0,0 +1,62 @@
+# Draupnir (Matrix Moderation Bot) {#module-services-draupnir}
+
+This chapter will show you how to set up your own, self-hosted
+[Draupnir](https://github.com/the-draupnir-project/Draupnir) instance.
+
+As an all-in-one moderation tool, it can protect your server from
+malicious invites, spam messages, and whatever else you don't want.
+In addition to server-level protection, Draupnir is great for communities
+wanting to protect their rooms without having to use their personal
+accounts for moderation.
+
+The bot by default includes support for bans, redactions, anti-spam,
+server ACLs, room directory changes, room alias transfers, account
+deactivation, room shutdown, and more. (This depends on homeserver configuration and implementation.)
+
+See the [README](https://github.com/the-draupnir-project/draupnir#readme)
+page and the [Moderator's guide](https://the-draupnir-project.github.io/draupnir-documentation/moderator/setting-up-and-configuring)
+for additional instructions on how to setup and use Draupnir.
+
+For [additional settings](#opt-services.draupnir.settings)
+see [the default configuration](https://github.com/the-draupnir-project/Draupnir/blob/main/config/default.yaml).
+
+## Draupnir Setup {#module-services-draupnir-setup}
+
+First create a new unencrypted, private room which will be used as the management room for Draupnir.
+This is the room in which moderators will interact with Draupnir and where it will log possible errors and debugging information.
+You'll need to set this room ID or alias in [services.draupnir.settings.managementRoom](#opt-services.draupnir.settings.managementRoom).
+
+Next, create a new user for Draupnir on your homeserver, if one does not already exist.
+
+The Draupnir Matrix user expects to be free of any rate limiting.
+See [Synapse #6286](https://github.com/matrix-org/synapse/issues/6286)
+for an example on how to achieve this.
+
+If you want Draupnir to be able to deactivate users, move room aliases, shut down rooms, etc.
+you'll need to make the Draupnir user a Matrix server admin.
+
+Now invite the Draupnir user to the management room.
+Draupnir will automatically try to join this room on startup.
+
+```nix
+{
+  services.draupnir = {
+    enable = true;
+
+    settings = {
+      homeserverUrl = "https://matrix.org";
+      managementRoom = "!yyy:example.org";
+    };
+
+    secrets = {
+      accessToken = "/path/to/secret/containing/access-token";
+    };
+  };
+}
+```
+
+### Element Matrix Services (EMS) {#module-services-draupnir-setup-ems}
+
+If you are using a managed ["Element Matrix Services (EMS)"](https://ems.element.io/)
+server, you will need to consent to the terms and conditions. Upon startup, an error
+log entry with a URL to the consent page will be generated.

nixos/modules/services/matrix/draupnir.nix

@@ -0,0 +1,257 @@
+{
+  config,
+  options,
+  lib,
+  pkgs,
+  ...
+}:
+
+let
+  cfg = config.services.draupnir;
+  opt = options.services.draupnir;
+
+  format = pkgs.formats.yaml { };
+  configFile = format.generate "draupnir.yaml" cfg.settings;
+
+  inherit (lib)
+    literalExpression
+    mkEnableOption
+    mkOption
+    mkPackageOption
+    mkRemovedOptionModule
+    mkRenamedOptionModule
+    types
+    ;
+in
+{
+  imports = [
+    # Removed options for those migrating from the Mjolnir module
+    (mkRenamedOptionModule
+      [ "services" "draupnir" "dataPath" ]
+      [ "services" "draupnir" "settings" "dataPath" ]
+    )
+    (mkRenamedOptionModule
+      [ "services" "draupnir" "homeserverUrl" ]
+      [ "services" "draupnir" "settings" "homeserverUrl" ]
+    )
+    (mkRenamedOptionModule
+      [ "services" "draupnir" "managementRoom" ]
+      [ "services" "draupnir" "settings" "managementRoom" ]
+    )
+    (mkRenamedOptionModule
+      [ "services" "draupnir" "accessTokenFile" ]
+      [ "services" "draupnir" "secrets" "accessToken" ]
+    )
+    (mkRemovedOptionModule [ "services" "draupnir" "pantalaimon" ] ''
+      `services.draupnir.pantalaimon.*` has been removed because it depends on the deprecated and vulnerable
+      libolm library for end-to-end encryption and upstream support for Pantalaimon in Draupnir is limited.
+      See <https://the-draupnir-project.github.io/draupnir-documentation/bot/encryption> for details.
+      If you nontheless require E2EE via Pantalaimon, you can configure `services.pantalaimon-headless.instances`
+      yourself and use that with `services.draupnir.settings.pantalaimon` and `services.draupnir.secrets.pantalaimon.password`.
+    '')
+  ];
+
+  options.services.draupnir = {
+    enable = mkEnableOption "Draupnir, a moderations bot for Matrix";
+
+    package = mkPackageOption pkgs "draupnir" { };
+
+    settings = mkOption {
+      example = literalExpression ''
+        {
+          homeserverUrl = "https://matrix.org";
+          managementRoom = "#moderators:example.org";
+
+          autojoinOnlyIfManager = true;
+          automaticallyRedactForReasons = [ "spam" "advertising" ];
+        }
+      '';
+      description = ''
+        Free-form settings written to Draupnir's configuration file.
+        See [Draupnir's default configuration](https://github.com/the-draupnir-project/Draupnir/blob/main/config/default.yaml) for available settings.
+      '';
+      default = { };
+      type = types.submodule {
+        freeformType = format.type;
+        options = {
+          homeserverUrl = mkOption {
+            type = types.str;
+            example = "https://matrix.org";
+            description = ''
+              Base URL of the Matrix homeserver that provides the Client-Server API.
+
+              ::: {.note}
+              When using Pantalaimon, set this to the Pantalaimon URL and
+              {option}`${opt.settings}.rawHomeserverUrl` to the public URL.
+              :::
+            '';
+          };
+
+          rawHomeserverUrl = mkOption {
+            type = types.str;
+            example = "https://matrix.org";
+            default = cfg.settings.homeserverUrl;
+            defaultText = literalExpression "config.${opt.settings}.homeserverUrl";
+            description = ''
+              Public base URL of the Matrix homeserver that provides the Client-Server API when using the Draupnir's
+              [Report forwarding feature](https://the-draupnir-project.github.io/draupnir-documentation/bot/homeserver-administration#report-forwarding).
+
+              ::: {.warning}
+              When using Pantalaimon, do not set this to the Pantalaimon URL!
+              :::
+            '';
+          };
+
+          managementRoom = mkOption {
+            type = types.str;
+            example = "#moderators:example.org";
+            description = ''
+              The room ID or alias where moderators can use the bot's functionality.
+
+              The bot has no access controls, so anyone in this room can use the bot - secure this room!
+              Do not enable end-to-end encryption for this room, unless set up with Pantalaimon.
+
+              ::: {.warning}
+              When using a room alias, make sure the alias used is on the local homeserver!
+              This prevents an issue where the control room becomes undefined when the alias can't be resolved.
+              :::
+            '';
+          };
+
+          dataPath = mkOption {
+            type = types.path;
+            readOnly = true;
+            default = "/var/lib/draupnir";
+            description = ''
+              The path Draupnir will store its state/data in.
+
+              ::: {.warning}
+              This option is read-only.
+              :::
+
+              ::: {.note}
+              If you want to customize where this data is stored, use a bind mount.
+              :::
+            '';
+          };
+        };
+      };
+    };
+
+    secrets = {
+      accessToken = mkOption {
+        type = types.nullOr types.path;
+        default = null;
+        description = ''
+          File containing the access token for Draupnir's Matrix account
+          to be used in place of {option}`${opt.settings}.accessToken`.
+        '';
+      };
+
+      pantalaimon.password = mkOption {
+        type = types.nullOr types.path;
+        default = null;
+        description = ''
+          File containing the password for Draupnir's Matrix account when used in
+          conjunction with Pantalaimon to be used in place of
+          {option}`${opt.settings}.pantalaimon.password`.
+
+          ::: {.warning}
+          Take note that upstream has limited Pantalaimon and E2EE support:
+          <https://the-draupnir-project.github.io/draupnir-documentation/bot/encryption> and
+          <https://the-draupnir-project.github.io/draupnir-documentation/shared/dogfood#e2ee-support>.
+          :::
+        '';
+      };
+
+      web.synapseHTTPAntispam.authorization = mkOption {
+        type = types.nullOr types.path;
+        default = null;
+        description = ''
+          File containing the secret token when using the Synapse HTTP Antispam module
+          to be used in place of
+          {option}`${opt.settings}.web.synapseHTTPAntispam.authorization`.
+
+          See <https://the-draupnir-project.github.io/draupnir-documentation/bot/synapse-http-antispam> for details.
+        '';
+      };
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    assertions = [
+      {
+        # Removed option for those migrating from the Mjolnir module - mkRemovedOption module does *not* work with submodules.
+        assertion = !(cfg.settings ? protectedRooms);
+        message = "Unset ${opt.settings}.protectedRooms, as it is unsupported on Draupnir. Add these rooms via `!draupnir rooms add` instead.";
+      }
+    ];
+
+    systemd.services.draupnir = {
+      description = "Draupnir - a moderation bot for Matrix";
+      wants = [
+        "network-online.target"
+        "matrix-synapse.service"
+        "conduit.service"
+        "dendrite.service"
+      ];
+      after = [
+        "network-online.target"
+        "matrix-synapse.service"
+        "conduit.service"
+        "dendrite.service"
+      ];
+      wantedBy = [ "multi-user.target" ];
+
+      startLimitIntervalSec = 0;
+      serviceConfig = {
+        ExecStart = toString (
+          [
+            (lib.getExe cfg.package)
+            "--draupnir-config"
+            configFile
+          ]
+          ++ lib.optionals (cfg.secrets.accessToken != null) [
+            "--access-token-path"
+            "%d/access_token"
+          ]
+          ++ lib.optionals (cfg.secrets.pantalaimon.password != null) [
+            "--pantalaimon-password-path"
+            "%d/pantalaimon_password"
+          ]
+          ++ lib.optionals (cfg.secrets.web.synapseHTTPAntispam.authorization != null) [
+            "--http-antispam-authorization-path"
+            "%d/http_antispam_authorization"
+          ]
+        );
+
+        WorkingDirectory = "/var/lib/draupnir";
+        StateDirectory = "draupnir";
+        StateDirectoryMode = "0700";
+        ProtectHome = true;
+        PrivateDevices = true;
+        Restart = "on-failure";
+        RestartSec = "5s";
+        DynamicUser = true;
+        LoadCredential =
+          lib.optionals (cfg.secrets.accessToken != null) [
+            "access_token:${cfg.secrets.accessToken}"
+          ]
+          ++ lib.optionals (cfg.secrets.pantalaimon.password != null) [
+            "pantalaimon_password:${cfg.secrets.pantalaimon.password}"
+          ]
+          ++ lib.optionals (cfg.secrets.web.synapseHTTPAntispam.authorization != null) [
+            "http_antispam_authorization:${cfg.secrets.web.synapseHTTPAntispam.authorization}"
+          ];
+      };
+    };
+  };
+
+  meta = {
+    doc = ./draupnir.md;
+    maintainers = with lib.maintainers; [
+      RorySys
+      emilylange
+    ];
+  };
+}

nixos/modules/services/networking/dnscrypt-proxy2.nix

@@ -4,22 +4,25 @@
   pkgs,
   ...
 }:
-with lib;
 
 let
+
   cfg = config.services.dnscrypt-proxy2;
+
 in
 
 {
   options.services.dnscrypt-proxy2 = {
-    enable = mkEnableOption "dnscrypt-proxy2";
+    enable = lib.mkEnableOption "dnscrypt-proxy2";
 
-    settings = mkOption {
+    package = lib.mkPackageOption pkgs "dnscrypt-proxy" { };
+
+    settings = lib.mkOption {
       description = ''
         Attrset that is converted and passed as TOML config file.
         For available params, see: <https://github.com/DNSCrypt/dnscrypt-proxy/blob/${pkgs.dnscrypt-proxy.version}/dnscrypt-proxy/example-dnscrypt-proxy.toml>
       '';
-      example = literalExpression ''
+      example = lib.literalExpression ''
         {
           sources.public-resolvers = {
             urls = [ "https://download.dnscrypt.info/resolvers-list/v2/public-resolvers.md" ];
@@ -29,27 +32,27 @@ in
           };
         }
       '';
-      type = types.attrs;
+      type = lib.types.attrs;
       default = { };
     };
 
-    upstreamDefaults = mkOption {
+    upstreamDefaults = lib.mkOption {
       description = ''
         Whether to base the config declared in {option}`services.dnscrypt-proxy2.settings` on the upstream example config (<https://github.com/DNSCrypt/dnscrypt-proxy/blob/master/dnscrypt-proxy/example-dnscrypt-proxy.toml>)
 
         Disable this if you want to declare your dnscrypt config from scratch.
       '';
-      type = types.bool;
+      type = lib.types.bool;
       default = true;
     };
 
-    configFile = mkOption {
+    configFile = lib.mkOption {
       description = ''
         Path to TOML config file. See: <https://github.com/DNSCrypt/dnscrypt-proxy/blob/master/dnscrypt-proxy/example-dnscrypt-proxy.toml>
         If this option is set, it will override any configuration done in options.services.dnscrypt-proxy2.settings.
       '';
       example = "/etc/dnscrypt-proxy/dnscrypt-proxy.toml";
-      type = types.path;
+      type = lib.types.path;
       default =
         pkgs.runCommand "dnscrypt-proxy.toml"
           {
@@ -70,11 +73,11 @@ in
             }
             ${pkgs.buildPackages.remarshal}/bin/json2toml < config.json > $out
           '';
-      defaultText = literalMD "TOML file generated from {option}`services.dnscrypt-proxy2.settings`";
+      defaultText = lib.literalMD "TOML file generated from {option}`services.dnscrypt-proxy2.settings`";
     };
   };
 
-  config = mkIf cfg.enable {
+  config = lib.mkIf cfg.enable {
 
     networking.nameservers = lib.mkDefault [ "127.0.0.1" ];
 
@@ -94,7 +97,7 @@ in
         AmbientCapabilities = "CAP_NET_BIND_SERVICE";
         CacheDirectory = "dnscrypt-proxy";
         DynamicUser = true;
-        ExecStart = "${pkgs.dnscrypt-proxy}/bin/dnscrypt-proxy -config ${cfg.configFile}";
+        ExecStart = "${lib.getExe cfg.package} -config ${cfg.configFile}";
         LockPersonality = true;
         LogsDirectory = "dnscrypt-proxy";
         MemoryDenyWriteExecute = true;

nixos/modules/services/networking/murmur.nix

@@ -5,8 +5,6 @@
   ...
 }:
 
-with lib;
-
 let
   cfg = config.services.murmur;
   forking = cfg.logFile != null;
@@ -18,64 +16,49 @@ let
     autobanTimeframe=${toString cfg.autobanTimeframe}
     autobanTime=${toString cfg.autobanTime}
 
-    logfile=${optionalString (cfg.logFile != null) cfg.logFile}
-    ${optionalString forking "pidfile=/run/murmur/murmurd.pid"}
+    logfile=${lib.optionalString (cfg.logFile != null) cfg.logFile}
+    ${lib.optionalString forking "pidfile=/run/murmur/murmurd.pid"}
 
     welcometext="${cfg.welcometext}"
     port=${toString cfg.port}
 
-    ${optionalString (cfg.hostName != "") "host=${cfg.hostName}"}
-    ${optionalString (cfg.password != "") "serverpassword=${cfg.password}"}
+    ${lib.optionalString (cfg.hostName != "") "host=${cfg.hostName}"}
+    ${lib.optionalString (cfg.password != "") "serverpassword=${cfg.password}"}
 
     bandwidth=${toString cfg.bandwidth}
     users=${toString cfg.users}
 
     textmessagelength=${toString cfg.textMsgLength}
     imagemessagelength=${toString cfg.imgMsgLength}
-    allowhtml=${boolToString cfg.allowHtml}
+    allowhtml=${lib.boolToString cfg.allowHtml}
     logdays=${toString cfg.logDays}
-    bonjour=${boolToString cfg.bonjour}
-    sendversion=${boolToString cfg.sendVersion}
+    bonjour=${lib.boolToString cfg.bonjour}
+    sendversion=${lib.boolToString cfg.sendVersion}
 
-    ${optionalString (cfg.registerName != "") "registerName=${cfg.registerName}"}
-    ${optionalString (cfg.registerPassword != "") "registerPassword=${cfg.registerPassword}"}
-    ${optionalString (cfg.registerUrl != "") "registerUrl=${cfg.registerUrl}"}
-    ${optionalString (cfg.registerHostname != "") "registerHostname=${cfg.registerHostname}"}
+    ${lib.optionalString (cfg.registerName != "") "registerName=${cfg.registerName}"}
+    ${lib.optionalString (cfg.registerPassword != "") "registerPassword=${cfg.registerPassword}"}
+    ${lib.optionalString (cfg.registerUrl != "") "registerUrl=${cfg.registerUrl}"}
+    ${lib.optionalString (cfg.registerHostname != "") "registerHostname=${cfg.registerHostname}"}
 
-    certrequired=${boolToString cfg.clientCertRequired}
-    ${optionalString (cfg.sslCert != "") "sslCert=${cfg.sslCert}"}
-    ${optionalString (cfg.sslKey != "") "sslKey=${cfg.sslKey}"}
-    ${optionalString (cfg.sslCa != "") "sslCA=${cfg.sslCa}"}
+    certrequired=${lib.boolToString cfg.clientCertRequired}
+    ${lib.optionalString (cfg.sslCert != "") "sslCert=${cfg.sslCert}"}
+    ${lib.optionalString (cfg.sslKey != "") "sslKey=${cfg.sslKey}"}
+    ${lib.optionalString (cfg.sslCa != "") "sslCA=${cfg.sslCa}"}
 
-    ${optionalString (cfg.dbus != null) "dbus=${cfg.dbus}"}
+    ${lib.optionalString (cfg.dbus != null) "dbus=${cfg.dbus}"}
 
     ${cfg.extraConfig}
   '';
 in
 {
-  imports = [
-    (mkRenamedOptionModule [ "services" "murmur" "welcome" ] [ "services" "murmur" "welcometext" ])
-    (mkRemovedOptionModule [ "services" "murmur" "pidfile" ] "Hardcoded to /run/murmur/murmurd.pid now")
-  ];
-
   options = {
     services.murmur = {
-      enable = mkOption {
-        type = types.bool;
-        default = false;
-        description = "If enabled, start the Murmur Mumble server.";
-      };
+      enable = lib.mkEnableOption "Mumble server";
 
-      openFirewall = mkOption {
-        type = types.bool;
-        default = false;
-        description = ''
-          Open ports in the firewall for the Murmur Mumble server.
-        '';
-      };
+      openFirewall = lib.mkEnableOption "opening ports in the firewall for the Mumble server";
 
-      user = mkOption {
-        type = types.str;
+      user = lib.mkOption {
+        type = lib.types.str;
         default = "murmur";
         description = ''
           The name of an existing user to use to run the service.
@@ -83,8 +66,8 @@ in
         '';
       };
 
-      group = mkOption {
-        type = types.str;
+      group = lib.mkOption {
+        type = lib.types.str;
         default = "murmur";
         description = ''
           The name of an existing group to use to run the service.
@@ -92,16 +75,16 @@ in
         '';
       };
 
-      stateDir = mkOption {
-        type = types.path;
+      stateDir = lib.mkOption {
+        type = lib.types.path;
         default = "/var/lib/murmur";
         description = ''
           Directory to store data for the server.
         '';
       };
 
-      autobanAttempts = mkOption {
-        type = types.int;
+      autobanAttempts = lib.mkOption {
+        type = lib.types.int;
         default = 10;
         description = ''
           Number of attempts a client is allowed to make in
@@ -110,8 +93,8 @@ in
         '';
       };
 
-      autobanTimeframe = mkOption {
-        type = types.int;
+      autobanTimeframe = lib.mkOption {
+        type = lib.types.int;
         default = 120;
         description = ''
           Timeframe in which a client can connect without being banned
@@ -119,47 +102,47 @@ in
         '';
       };
 
-      autobanTime = mkOption {
-        type = types.int;
+      autobanTime = lib.mkOption {
+        type = lib.types.int;
         default = 300;
         description = "The amount of time an IP ban lasts (in seconds).";
       };
 
-      logFile = mkOption {
-        type = types.nullOr types.path;
+      logFile = lib.mkOption {
+        type = lib.types.nullOr lib.types.path;
         default = null;
         example = "/var/log/murmur/murmurd.log";
         description = "Path to the log file for Murmur daemon. Empty means log to journald.";
       };
 
-      welcometext = mkOption {
-        type = types.str;
+      welcometext = lib.mkOption {
+        type = lib.types.str;
         default = "";
         description = "Welcome message for connected clients.";
       };
 
-      port = mkOption {
-        type = types.port;
+      port = lib.mkOption {
+        type = lib.types.port;
         default = 64738;
         description = "Ports to bind to (UDP and TCP).";
       };
 
-      hostName = mkOption {
-        type = types.str;
+      hostName = lib.mkOption {
+        type = lib.types.str;
         default = "";
         description = "Host to bind to. Defaults binding on all addresses.";
       };
 
-      package = mkPackageOption pkgs "murmur" { };
+      package = lib.mkPackageOption pkgs "murmur" { };
 
-      password = mkOption {
-        type = types.str;
+      password = lib.mkOption {
+        type = lib.types.str;
         default = "";
         description = "Required password to join server, if specified.";
       };
 
-      bandwidth = mkOption {
-        type = types.int;
+      bandwidth = lib.mkOption {
+        type = lib.types.int;
         default = 72000;
         description = ''
           Maximum bandwidth (in bits per second) that clients may send
@@ -167,26 +150,26 @@ in
         '';
       };
 
-      users = mkOption {
-        type = types.int;
+      users = lib.mkOption {
+        type = lib.types.int;
         default = 100;
         description = "Maximum number of concurrent clients allowed.";
       };
 
-      textMsgLength = mkOption {
-        type = types.int;
+      textMsgLength = lib.mkOption {
+        type = lib.types.int;
         default = 5000;
         description = "Max length of text messages. Set 0 for no limit.";
       };
 
-      imgMsgLength = mkOption {
-        type = types.int;
+      imgMsgLength = lib.mkOption {
+        type = lib.types.int;
         default = 131072;
         description = "Max length of image messages. Set 0 for no limit.";
       };
 
-      allowHtml = mkOption {
-        type = types.bool;
+      allowHtml = lib.mkOption {
+        type = lib.types.bool;
         default = true;
         description = ''
           Allow HTML in client messages, comments, and channel
@@ -194,8 +177,8 @@ in
         '';
       };
 
-      logDays = mkOption {
-        type = types.int;
+      logDays = lib.mkOption {
+        type = lib.types.int;
         default = 31;
         description = ''
           How long to store RPC logs for in the database. Set 0 to
@@ -203,23 +186,16 @@ in
         '';
       };
 
-      bonjour = mkOption {
-        type = types.bool;
-        default = false;
-        description = ''
-          Enable Bonjour auto-discovery, which allows clients over
-          your LAN to automatically discover Murmur servers.
-        '';
-      };
+      bonjour = lib.mkEnableOption "Bonjour auto-discovery, which allows clients over your LAN to automatically discover Mumble servers";
 
-      sendVersion = mkOption {
-        type = types.bool;
+      sendVersion = lib.mkOption {
+        type = lib.types.bool;
         default = true;
         description = "Send Murmur version in UDP response.";
       };
 
-      registerName = mkOption {
-        type = types.str;
+      registerName = lib.mkOption {
+        type = lib.types.str;
         default = "";
         description = ''
           Public server registration name, and also the name of the
@@ -228,8 +204,8 @@ in
         '';
       };
 
-      registerPassword = mkOption {
-        type = types.str;
+      registerPassword = lib.mkOption {
+        type = lib.types.str;
         default = "";
         description = ''
           Public server registry password, used authenticate your
@@ -238,14 +214,14 @@ in
         '';
       };
 
-      registerUrl = mkOption {
-        type = types.str;
+      registerUrl = lib.mkOption {
+        type = lib.types.str;
         default = "";
         description = "URL website for your server.";
       };
 
-      registerHostname = mkOption {
-        type = types.str;
+      registerHostname = lib.mkOption {
+        type = lib.types.str;
         default = "";
         description = ''
           DNS hostname where your server can be reached. This is only
@@ -255,40 +231,36 @@ in
         '';
       };
 
-      clientCertRequired = mkOption {
-        type = types.bool;
-        default = false;
-        description = "Require clients to authenticate via certificates.";
-      };
+      clientCertRequired = lib.mkEnableOption "requiring clients to authenticate via certificates";
 
-      sslCert = mkOption {
-        type = types.str;
+      sslCert = lib.mkOption {
+        type = lib.types.str;
         default = "";
         description = "Path to your SSL certificate.";
       };
 
-      sslKey = mkOption {
-        type = types.str;
+      sslKey = lib.mkOption {
+        type = lib.types.str;
         default = "";
         description = "Path to your SSL key.";
       };
 
-      sslCa = mkOption {
-        type = types.str;
+      sslCa = lib.mkOption {
+        type = lib.types.str;
         default = "";
         description = "Path to your SSL CA certificate.";
       };
 
-      extraConfig = mkOption {
-        type = types.lines;
+      extraConfig = lib.mkOption {
+        type = lib.types.lines;
         default = "";
         description = "Extra configuration to put into murmur.ini.";
       };
 
-      environmentFile = mkOption {
-        type = types.nullOr types.path;
+      environmentFile = lib.mkOption {
+        type = lib.types.nullOr lib.types.path;
         default = null;
-        example = literalExpression ''"''${config.services.murmur.stateDir}/murmurd.env"'';
+        example = lib.literalExpression ''"''${config.services.murmur.stateDir}/murmurd.env"'';
         description = ''
           Environment file as defined in {manpage}`systemd.exec(5)`.
 
@@ -311,8 +283,8 @@ in
         '';
       };
 
-      dbus = mkOption {
-        type = types.enum [
+      dbus = lib.mkOption {
+        type = lib.types.enum [
           null
           "session"
           "system"
@@ -323,19 +295,19 @@ in
     };
   };
 
-  config = mkIf cfg.enable {
-    users.users.murmur = mkIf (cfg.user == "murmur") {
+  config = lib.mkIf cfg.enable {
+    users.users.murmur = lib.mkIf (cfg.user == "murmur") {
       description = "Murmur Service user";
       home = cfg.stateDir;
       createHome = true;
       uid = config.ids.uids.murmur;
       group = cfg.group;
     };
-    users.groups.murmur = mkIf (cfg.group == "murmur") {
+    users.groups.murmur = lib.mkIf (cfg.group == "murmur") {
       gid = config.ids.gids.murmur;
     };
 
-    networking.firewall = mkIf cfg.openFirewall {
+    networking.firewall = lib.mkIf cfg.openFirewall {
       allowedTCPPorts = [ cfg.port ];
       allowedUDPPorts = [ cfg.port ];
     };
@@ -353,8 +325,8 @@ in
       serviceConfig = {
         # murmurd doesn't fork when logging to the console.
         Type = if forking then "forking" else "simple";
-        PIDFile = mkIf forking "/run/murmur/murmurd.pid";
-        EnvironmentFile = mkIf (cfg.environmentFile != null) cfg.environmentFile;
+        PIDFile = lib.mkIf forking "/run/murmur/murmurd.pid";
+        EnvironmentFile = lib.mkIf (cfg.environmentFile != null) cfg.environmentFile;
         ExecStart = "${cfg.package}/bin/mumble-server -ini /run/murmur/murmurd.ini";
         Restart = "always";
         RuntimeDirectory = "murmur";
@@ -390,7 +362,7 @@ in
 
     # currently not included in upstream package, addition requested at
     # https://github.com/mumble-voip/mumble/issues/6078
-    services.dbus.packages = mkIf (cfg.dbus == "system") [
+    services.dbus.packages = lib.mkIf (cfg.dbus == "system") [
       (pkgs.writeTextFile {
         name = "murmur-dbus-policy";
         text = ''
@@ -432,19 +404,19 @@ in
           r /run/murmur/murmurd.ini,
           r ${configFile},
       ''
-      + optionalString (cfg.logFile != null) ''
+      + lib.optionalString (cfg.logFile != null) ''
         rw ${cfg.logFile},
       ''
-      + optionalString (cfg.sslCert != "") ''
+      + lib.optionalString (cfg.sslCert != "") ''
         r ${cfg.sslCert},
       ''
-      + optionalString (cfg.sslKey != "") ''
+      + lib.optionalString (cfg.sslKey != "") ''
         r ${cfg.sslKey},
       ''
-      + optionalString (cfg.sslCa != "") ''
+      + lib.optionalString (cfg.sslCa != "") ''
         r ${cfg.sslCa},
       ''
-      + optionalString (cfg.dbus != null) ''
+      + lib.optionalString (cfg.dbus != null) ''
         dbus bus=${cfg.dbus}
       ''
       + ''

nixos/modules/services/security/kanidm.nix

@@ -54,15 +54,10 @@ let
     ++ optional (cfg.provision.extraJsonFile != null) cfg.provision.extraJsonFile
     ++ mapAttrsToList (_: x: x.basicSecretFile) cfg.provision.systems.oauth2
   );
-  secretDirectories = unique (
-    map builtins.dirOf (
-      [
-        cfg.serverSettings.tls_chain
-        cfg.serverSettings.tls_key
-      ]
-      ++ optionals cfg.provision.enable provisionSecretFiles
-    )
-  );
+  secretPaths = [
+    cfg.serverSettings.tls_chain
+    cfg.serverSettings.tls_key
+  ] ++ optionals cfg.provision.enable provisionSecretFiles;
 
   # Merge bind mount paths and remove paths where a prefix is already mounted.
   # This makes sure that if e.g. the tls_chain is in the nix store and /nix/store is already in the mount
@@ -881,7 +876,7 @@ in
         (
           defaultServiceConfig
           // {
-            BindReadOnlyPaths = mergePaths (defaultServiceConfig.BindReadOnlyPaths ++ secretDirectories);
+            BindReadOnlyPaths = mergePaths (defaultServiceConfig.BindReadOnlyPaths ++ secretPaths);
           }
         )
         {
@@ -895,8 +890,6 @@ in
 
           BindPaths =
             [
-              # To create the socket
-              "/run/kanidmd:/run/kanidmd"
               # To store backups
               cfg.serverSettings.online_backup.path
             ]

nixos/modules/services/web-apps/glance.nix

@@ -100,14 +100,64 @@ in
         for more.
 
         Settings containing secret data should be set to an
-        attribute set containing the attribute
-        <literal>_secret</literal> - a string pointing to a file
-        containing the value the option should be set to. See the
-        example in `services.glance.settings.pages` at the weather widget
+        attribute set with this format: `{ _secret = "/path/to/secret"; }`.
+        See the example in `services.glance.settings.pages` at the weather widget
         with a location secret to get a better picture of this.
+
+        Alternatively, you can use a single file with environment variables,
+        see `services.glance.environmentFile`.
       '';
     };
 
+    environmentFile = mkOption {
+      type = types.nullOr types.path;
+      description =
+        let
+          singleQuotes = "''";
+        in
+        ''
+          Path to an environment file as defined in {manpage}`systemd.exec(5)`.
+
+          See upstream documentation
+          <https://github.com/glanceapp/glance/blob/main/docs/configuration.md#environment-variables>.
+
+          Example content of the file:
+          ```
+          TIMEZONE=Europe/Paris
+          ```
+
+          Example `services.glance.settings.pages` configuration:
+          ```nix
+            [
+              {
+                name = "Home";
+                columns = [
+                  {
+                    size = "full";
+                    widgets = [
+                      {
+                        type = "clock";
+                        timezone = "\''${TIMEZONE}";
+                        label = "Local Time";
+                      }
+                    ];
+                  }
+                ];
+              }
+            ];
+          ```
+
+          Note that when using Glance's `''${ENV_VAR}` syntax in Nix,
+          you need to escape it as follows: use `\''${ENV_VAR}` in `"` strings
+          and `${singleQuotes}''${ENV_VAR}` in `${singleQuotes}` strings.
+
+          Alternatively, you can put each secret in it's own file,
+          see `services.glance.settings`.
+        '';
+      default = "/dev/null";
+      example = "/var/lib/secrets/glance";
+    };
+
     openFirewall = mkOption {
       type = types.bool;
       default = false;
@@ -159,6 +209,7 @@ in
           '';
         ExecStart = "${getExe cfg.package} --config ${mergedSettingsFile}";
         WorkingDirectory = "/var/lib/glance";
+        EnvironmentFile = cfg.environmentFile;
         StateDirectory = "glance";
         RuntimeDirectory = "glance";
         RuntimeDirectoryMode = "0755";

nixos/modules/system/boot/networkd.nix

@@ -905,8 +905,8 @@ let
           boolValues
           ++ [
             "static"
-            "dhcp-on-stop"
-            "dhcp"
+            "dynamic-on-stop"
+            "dynamic"
           ]
         ))
       ];

nixos/modules/tasks/filesystems.nix

@@ -5,11 +5,31 @@
   utils,
   ...
 }@moduleArgs:
-
-with lib;
-with utils;
-
 let
+  inherit (lib)
+    any
+    attrValues
+    concatMapStrings
+    concatMapStringsSep
+    concatStringsSep
+    elem
+    filter
+    flip
+    head
+    literalExpression
+    mkDefault
+    mkEnableOption
+    mkIf
+    mkMerge
+    mkOption
+    optional
+    optionalAttrs
+    optionalString
+    toposort
+    types
+    ;
+  inherit (utils) fsBefore;
+
   # https://wiki.archlinux.org/index.php/fstab#Filepath_spaces
   escape = string: builtins.replaceStrings [ " " "\t" ] [ "\\040" "\\011" ] string;
 
@@ -61,7 +81,7 @@ let
           description = "Location of the mounted file system.";
         };
 
-        stratis.poolUuid = lib.mkOption {
+        stratis.poolUuid = mkOption {
           type = types.uniq (types.nullOr types.str);
           description = ''
             UUID of the stratis pool that the fs is located in
@@ -166,9 +186,7 @@ let
 
       };
 
-      config.device = lib.mkIf (config.label != null) (
-        lib.mkDefault "/dev/disk/by-label/${escape config.label}"
-      );
+      config.device = mkIf (config.label != null) (mkDefault "/dev/disk/by-label/${escape config.label}");
 
       config.options =
         let
@@ -320,7 +338,7 @@ in
 
     boot.supportedFilesystems = mkOption {
       default = { };
-      example = lib.literalExpression ''
+      example = literalExpression ''
         {
           btrfs = true;
           zfs = lib.mkForce false;
@@ -471,7 +489,7 @@ in
         # Filesystems.
         ${makeFstabEntries fileSystems { }}
 
-        ${lib.optionalString (config.swapDevices != [ ]) "# Swap devices."}
+        ${optionalString (config.swapDevices != [ ]) "# Swap devices."}
         ${flip concatMapStrings config.swapDevices (sw: "${sw.realDevice} none swap ${swapOptions sw}\n")}
       '';
 

nixos/tests/all-tests.nix

@@ -409,11 +409,13 @@ in
   domination = runTest ./domination.nix;
   dovecot = handleTest ./dovecot.nix { };
   drawterm = discoverTests (import ./drawterm.nix);
+  draupnir = runTest ./matrix/draupnir.nix;
   drbd = runTest ./drbd.nix;
   druid = handleTestOn [ "x86_64-linux" ] ./druid { };
   drupal = runTest ./drupal.nix;
   drbd-driver = runTest ./drbd-driver.nix;
   dublin-traceroute = runTest ./dublin-traceroute.nix;
+  dwl = runTestOn [ "x86_64-linux" "aarch64-linux" ] ./dwl.nix;
   earlyoom = handleTestOn [ "x86_64-linux" ] ./earlyoom.nix { };
   early-mount-options = handleTest ./early-mount-options.nix { };
   ec2-config = (handleTestOn [ "x86_64-linux" ] ./ec2.nix { }).boot-ec2-config or { };
@@ -1527,7 +1529,6 @@ in
   zoom-us = runTest ./zoom-us.nix;
   zram-generator = runTest ./zram-generator.nix;
   zrepl = runTest ./zrepl.nix;
-  zsh-history = runTest ./zsh-history.nix;
   zwave-js = runTest ./zwave-js.nix;
   zwave-js-ui = runTest ./zwave-js-ui.nix;
 }

nixos/tests/dwl.nix

@@ -0,0 +1,43 @@
+{ lib, ... }:
+{
+  name = "dwl_test_vm";
+
+  meta = {
+    maintainers = with lib.maintainers; [ gurjaka ];
+  };
+
+  nodes.machine =
+    {
+      pkgs,
+      lib,
+      ...
+    }:
+    {
+      imports = [
+        ./common/user-account.nix
+        ./common/wayland-cage.nix
+      ];
+
+      environment.systemPackages = [ pkgs.foot ];
+
+      services.displayManager.defaultSession = lib.mkForce "dwl";
+
+      programs.dwl.enable = true;
+    };
+
+  testScript = ''
+    with subtest("ensure dwl starts"):
+      machine.wait_for_file("/run/user/1000/wayland-0")
+
+    with subtest("ensure foot is installed"):
+      machine.succeed("which foot")
+
+    with subtest("ensure we can open a new terminal"):
+      # sleep 3 is required to make sure dwl has started
+      # TODO: find better way to identify dwl session
+      machine.sleep(3)
+      machine.send_key("alt-shift-ret")
+      machine.sleep(3)
+      machine.screenshot("terminal")
+  '';
+}

nixos/tests/matrix/draupnir.nix

@@ -0,0 +1,150 @@
+{
+  lib,
+  ...
+}:
+
+{
+  name = "draupnir";
+  meta.maintainers = with lib.maintainers; [
+    RorySys
+    emilylange
+  ];
+
+  nodes = {
+    homeserver =
+      { pkgs, ... }:
+      {
+        services.matrix-synapse = {
+          enable = true;
+          log.root.level = "WARNING";
+          settings = {
+            database.name = "sqlite3";
+            registration_shared_secret = "supersecret-registration";
+
+            listeners = [
+              {
+                bind_addresses = [
+                  "::"
+                ];
+                port = 8008;
+                resources = [
+                  {
+                    compress = true;
+                    names = [ "client" ];
+                  }
+                  {
+                    compress = false;
+                    names = [ "federation" ];
+                  }
+                ];
+                tls = false;
+                type = "http";
+                x_forwarded = false;
+              }
+            ];
+          };
+        };
+
+        specialisation.draupnir = {
+          inheritParentConfig = true;
+
+          configuration.services.draupnir = {
+            enable = true;
+            settings = {
+              homeserverUrl = "http://localhost:8008";
+              managementRoom = "#moderators:homeserver";
+            };
+            secrets = {
+              accessToken = "/tmp/draupnir-access-token";
+            };
+          };
+        };
+
+        environment.systemPackages = with pkgs; [
+          curl
+          jq
+          (writers.writePython3Bin "test_draupnir_in_matrix"
+            {
+              libraries = [ python3Packages.matrix-nio ];
+              flakeIgnore = [ "E501" ];
+            }
+            ''
+              import asyncio
+              from nio import AsyncClient, MatrixRoom, RoomMemberEvent, RoomMessageNotice
+
+
+              async def main() -> None:
+                  client = AsyncClient("http://localhost:8008", "moderator")
+
+                  async def member_callback(room: MatrixRoom, event: RoomMemberEvent) -> None:
+                      if event.membership == "join" and event.sender == "@draupnir:homeserver":
+                          await client.room_send(
+                              room_id=room.room_id,
+                              message_type="m.room.message",
+                              content={
+                                  "msgtype": "m.text",
+                                  "body": "!draupnir status"
+                              }
+                          )
+
+                  async def message_callback(room: MatrixRoom, event: RoomMessageNotice) -> None:
+                      print(f"{event.sender}: {event.body}")
+                      if event.sender == "@draupnir:homeserver":
+                          await client.close()
+                          exit(0)
+
+                  client.add_event_callback(member_callback, RoomMemberEvent)
+                  client.add_event_callback(message_callback, RoomMessageNotice)
+
+                  print(await client.login("password"))
+
+                  room = await client.room_create(
+                      name="Moderators",
+                      alias="moderators",
+                      invite=["@draupnir:homeserver"],
+                      power_level_override={
+                          "users": {
+                              "@draupnir:homeserver": 100,
+                              "@moderator:homeserver": 100,
+                          }
+                      }
+                  )
+                  print(room)
+
+                  print(await client.join(room.room_id))
+
+                  await client.sync_forever(timeout=30000)
+
+
+              asyncio.run(main())
+            ''
+          )
+        ];
+      };
+  };
+
+  testScript =
+    { nodes, ... }:
+    ''
+      import json
+
+      homeserver.wait_for_unit("matrix-synapse.service")
+      homeserver.wait_until_succeeds("curl --fail -L http://localhost:8008/")
+
+      homeserver.succeed("matrix-synapse-register_new_matrix_user -u draupnir -p password --no-admin")
+      homeserver.succeed("matrix-synapse-register_new_matrix_user -u moderator -p password --no-admin")
+
+      # get draupnir access token
+      payload = json.dumps({ "type": "m.login.password", "user": "draupnir", "password": "password" })
+      homeserver.succeed(
+          f"curl --fail --json '{payload}' http://localhost:8008/_matrix/client/v3/login"
+          + " | jq -r .access_token"
+          + " | tee /tmp/draupnir-access-token"
+       )
+
+      homeserver.succeed("${nodes.homeserver.system.build.toplevel}/specialisation/draupnir/bin/switch-to-configuration test")
+      homeserver.wait_for_unit("draupnir.service")
+
+      print(homeserver.succeed("test_draupnir_in_matrix >&2", timeout=60))
+    '';
+}

nixos/tests/nixos-generate-config.nix

@@ -46,5 +46,11 @@
     machine.succeed("rm -rf /etc/nixos")
     machine.succeed("nixos-generate-config --flake")
     machine.succeed("nix-instantiate --parse /etc/nixos/flake.nix /etc/nixos/configuration.nix /etc/nixos/hardware-configuration.nix")
+
+    machine.succeed("mv /etc/nixos /etc/nixos-with-flake-arg")
+    machine.succeed("printf '[Defaults]\nFlake = 1\n' > /etc/nixos-generate-config.conf")
+    machine.succeed("nixos-generate-config")
+    machine.succeed("nix-instantiate --parse /etc/nixos/flake.nix /etc/nixos/configuration.nix /etc/nixos/hardware-configuration.nix")
+    machine.succeed("diff -r /etc/nixos /etc/nixos-with-flake-arg")
   '';
 }

nixos/tests/thelounge.nix

@@ -7,7 +7,8 @@ import ./make-test-python.nix {
       {
         services.thelounge = {
           enable = true;
-          plugins = [ pkgs.theLoungePlugins.themes.solarized ];
+          # nodePackages.thelounge-theme-* has been removed
+          # plugins = [ pkgs.theLoungePlugins.themes.solarized ];
         };
       };
 
@@ -28,7 +29,7 @@ import ./make-test-python.nix {
       machine.wait_for_unit("thelounge.service")
       machine.wait_for_open_port(9000)
 
-    private.wait_until_succeeds("journalctl -u thelounge.service | grep thelounge-theme-solarized")
+    # private.wait_until_succeeds("journalctl -u thelounge.service | grep thelounge-theme-solarized")
     private.wait_until_succeeds("journalctl -u thelounge.service | grep 'in private mode'")
     public.wait_until_succeeds("journalctl -u thelounge.service | grep 'in public mode'")
   '';

nixos/tests/zsh-history.nix

@@ -1,38 +0,0 @@
-{ pkgs, ... }:
-{
-  name = "zsh-history";
-  meta = with pkgs.lib.maintainers; {
-    maintainers = [ ];
-  };
-
-  nodes.default =
-    { ... }:
-    {
-      programs = {
-        zsh.enable = true;
-      };
-      environment.systemPackages = [ pkgs.zsh-history ];
-      programs.zsh.interactiveShellInit = ''
-        source ${pkgs.zsh-history.out}/share/zsh/init.zsh
-      '';
-      users.users.root.shell = "${pkgs.zsh}/bin/zsh";
-    };
-
-  testScript = ''
-    start_all()
-    default.wait_for_unit("multi-user.target")
-    default.wait_until_succeeds("pgrep -f 'agetty.*tty1'")
-
-    # Login
-    default.wait_until_tty_matches("1", "login: ")
-    default.send_chars("root\n")
-    default.wait_until_tty_matches("1", r"\nroot@default\b")
-
-    # Generate some history
-    default.send_chars("echo foobar\n")
-    default.wait_until_tty_matches("1", "foobar")
-
-    # Ensure that command was recorded in history
-    default.succeed("/run/current-system/sw/bin/history list | grep -q foobar")
-  '';
-}

pkgs/applications/editors/vim/plugins/non-generated/avante-nvim/default.nix

@@ -12,12 +12,12 @@
   pkgs,
 }:
 let
-  version = "0.0.23-unstable-2025-06-02";
+  version = "0.0.24-unstable-2025-06-05";
   src = fetchFromGitHub {
     owner = "yetone";
     repo = "avante.nvim";
-    rev = "647a459a2b87e5c9b2987cb44150b71beffdfb10";
-    hash = "sha256-GgLOcVp2IuMBr4aBRWJTvrAuWWiMEIHmec/S97piBaM=";
+    rev = "12bdb66ea4749f9f59861e7165a4de6cfbf4eb22";
+    hash = "sha256-dUtvMkb85HR7xzMoCHeeJIwwyQPdwHNdQHUMyA7+EsU=";
   };
   avante-nvim-lib = rustPlatform.buildRustPackage {
     pname = "avante-nvim-lib";

pkgs/applications/editors/vim/plugins/overrides.nix

@@ -172,9 +172,9 @@ in
 
   aerial-nvim = super.aerial-nvim.overrideAttrs {
     # optional dependencies
-    nvimSkipModules = [
-      "lualine.components.aerial"
-      "telescope._extensions.aerial"
+    checkInputs = with self; [
+      lualine-nvim
+      telescope-nvim
     ];
   };
 
@@ -212,11 +212,8 @@ in
   };
 
   asyncrun-vim = super.asyncrun-vim.overrideAttrs {
-    nvimSkipModules = [
-      # vim plugin with optional toggleterm integration
-      "asyncrun.toggleterm"
-      "asyncrun.toggleterm2"
-    ];
+    # Optional toggleterm integration
+    checkInputs = [ self.toggleterm-nvim ];
   };
 
   autosave-nvim = super.autosave-nvim.overrideAttrs {
@@ -224,12 +221,8 @@ in
   };
 
   auto-session = super.auto-session.overrideAttrs {
-    # optional telescope dependency
-    nvimSkipModules = [
-      "auto-session.session-lens.actions"
-      "auto-session.session-lens.init"
-      "telescope._extensions.session-lens"
-    ];
+    # Optional integration
+    checkInputs = [ self.telescope-nvim ];
   };
 
   aw-watcher-vim = super.aw-watcher-vim.overrideAttrs {
@@ -241,6 +234,11 @@ in
   };
 
   bamboo-nvim = super.bamboo-nvim.overrideAttrs {
+    # Optional integration
+    checkInputs = with self; [
+      barbecue-nvim
+      lualine-nvim
+    ];
     nvimSkipModules = [
       # Requires config table
       "bamboo.colors"
@@ -249,14 +247,17 @@ in
       "bamboo-light"
       "bamboo-vulgaris"
       "bamboo-multiplex"
-      # Optional modules
-      "lualine.themes.bamboo"
       "barbecue.theme.bamboo"
     ];
   };
 
   barbar-nvim = super.barbar-nvim.overrideAttrs {
-    # nvim-web-devicons dependency
+    # Optional integrations
+    checkInputs = with self; [
+      bufferline-nvim
+      nvim-web-devicons
+    ];
+    # E5108: Error executing lua ...implugin-barbar.nvim-2025-04-28/lua/bufferline/utils.lua:10: module 'barbar.utils.hl' not found:
     nvimSkipModules = [ "bufferline.utils" ];
   };
 
@@ -621,14 +622,18 @@ in
   };
 
   codecompanion-nvim = super.codecompanion-nvim.overrideAttrs {
+    checkInputs = with self; [
+      # Optional completion
+      blink-cmp
+      nvim-cmp
+      # Optional pickers
+      fzf-lua
+      mini-nvim
+      snacks-nvim
+      telescope-nvim
+    ];
     dependencies = [ self.plenary-nvim ];
     nvimSkipModules = [
-      # Optional provider dependencies
-      "codecompanion.providers.actions.mini_pick"
-      "codecompanion.providers.actions.snacks"
-      "codecompanion.providers.actions.telescope"
-      "codecompanion.providers.actions.fzf_lua"
-      "codecompanion.providers.diff.mini_diff"
       # Requires setup call
       "codecompanion.actions.static"
       "codecompanion.actions.init"
@@ -1306,9 +1311,12 @@ in
   };
 
   go-nvim = super.go-nvim.overrideAttrs {
+    checkInputs = with self; [
+      luasnip
+      null-ls-nvim
+      nvim-treesitter
+    ];
     nvimSkipModules = [
-      # Null-ls
-      "go.null_ls"
       # _GO_NVIM_CFG
       "go.inlay"
       "go.project"
@@ -1316,16 +1324,9 @@ in
       "go.tags"
       "go.gotests"
       "go.format"
-      # nvim-treesitter
-      "go.gotest"
-      "go.ginkgo"
       "go.ts.go"
-      "go.ts.utils"
       "go.ts.nodes"
-      "go.fixplurals"
-      # Luasnip
       "go.snips"
-      "snips.all"
       "snips.go"
     ];
   };
@@ -1390,11 +1391,9 @@ in
   };
 
   haskell-tools-nvim = neovimUtils.buildNeovimPlugin {
+    # Optional integrations
+    checkInputs = [ self.telescope-nvim ];
     luaAttr = luaPackages.haskell-tools-nvim;
-    nvimSkipModules = [
-      # Optional telescope integration
-      "haskell-tools.hoogle.helpers"
-    ];
   };
 
   helpview-nvim = super.helpview-nvim.overrideAttrs {
@@ -1407,10 +1406,10 @@ in
 
   himalaya-vim = super.himalaya-vim.overrideAttrs {
     buildInputs = [ himalaya ];
-    # vim plugin with optional telescope lua module
-    nvimSkipModules = [
-      "himalaya.folder.pickers.fzflua"
-      "himalaya.folder.pickers.telescope"
+    # Optional integrations
+    checkInputs = with self; [
+      fzf-lua
+      telescope-nvim
     ];
   };
 
@@ -1827,8 +1826,8 @@ in
   };
 
   material-vim = super.material-vim.overrideAttrs {
-    # vim plugin with optional lualine module
-    nvimSkipModules = "material.lualine";
+    # Optional integration
+    checkInputs = [ self.lualine-nvim ];
   };
 
   meson = buildVimPlugin {
@@ -1903,11 +1902,11 @@ in
   };
 
   molten-nvim = super.molten-nvim.overrideAttrs {
-    nvimSkipModules = [
-      # Optional image providers
-      "load_image_nvim"
-      "load_wezterm_nvim"
-      "load_snacks_nvim"
+    # Optional image providers
+    checkInputs = with self; [
+      image-nvim
+      snacks-nvim
+      wezterm-nvim
     ];
   };
 
@@ -1957,9 +1956,11 @@ in
   };
 
   neogit = super.neogit.overrideAttrs {
+    # Optional diffview integration
+    checkInputs = [ self.diffview-nvim ];
     dependencies = [ self.plenary-nvim ];
     nvimSkipModules = [
-      # Optional diffview integration
+      # E5108: Error executing lua ...vim-2024-06-13/lua/diffview/api/views/diff/diff_view.lua:13: attempt to index global 'DiffviewGlobal' (a nil value)
       "neogit.integrations.diffview"
       "neogit.popups.diff.actions"
       "neogit.popups.diff.init"
@@ -2223,11 +2224,12 @@ in
   };
 
   netman-nvim = super.netman-nvim.overrideAttrs {
-    nvimSkipModules = [
-      # Optional neo-tree integration
-      "netman.ui.neo-tree.init"
-      "netman.ui.neo-tree.commands"
-      "netman.ui.neo-tree.components"
+    # Optional neo-tree integration
+    checkInputs = with self; [
+      neo-tree-nvim
+      # FIXME: propagate `neo-tree` dependencies
+      nui-nvim
+      plenary-nvim
     ];
   };
 
@@ -2313,9 +2315,12 @@ in
   };
 
   nvim-autopairs = super.nvim-autopairs.overrideAttrs {
+    # Optional completion dependency
+    checkInputs = with self; [
+      nvim-cmp
+    ];
     nvimSkipModules = [
-      # Optional completion dependencies
-      "nvim-autopairs.completion.cmp"
+      # compe not packaged anymore
       "nvim-autopairs.completion.compe"
     ];
   };
@@ -2492,10 +2497,10 @@ in
   };
 
   nvim-neoclip-lua = super.nvim-neoclip-lua.overrideAttrs {
-    nvimSkipModules = [
-      # Optional dependencies
-      "neoclip.fzf"
-      "neoclip.telescope"
+    # Optional dependencies
+    checkInputs = with self; [
+      fzf-lua
+      telescope-nvim
     ];
   };
 
@@ -2506,7 +2511,9 @@ in
 
   nvim-notify = super.nvim-notify.overrideAttrs {
     # Optional fzf integration
-    nvimSkipModules = "notify.integrations.fzf";
+    checkInputs = [
+      self.fzf-lua
+    ];
   };
 
   nvim-nu = super.nvim-nu.overrideAttrs {
@@ -2532,13 +2539,17 @@ in
   };
 
   nvim-snippets = super.nvim-snippets.overrideAttrs {
-    # Optional cmp integration
-    nvimSkipModules = "snippets.utils.cmp";
+    checkInputs = [
+      # Optional cmp integration
+      self.nvim-cmp
+    ];
   };
 
   nvim-surround = super.nvim-surround.overrideAttrs {
-    # Optional treesitter integration
-    nvimSkipModules = "nvim-surround.queries";
+    checkInputs = [
+      # Optional treesitter integration
+      self.nvim-treesitter
+    ];
   };
 
   nvim-teal-maker = super.nvim-teal-maker.overrideAttrs {
@@ -2550,6 +2561,8 @@ in
   };
 
   nvim-test = super.nvim-test.overrideAttrs {
+    # Optional toggleterm integration
+    checkInputs = [ self.toggleterm-nvim ];
     dependencies = with self; [
       nvim-treesitter
       nvim-treesitter-parsers.c_sharp
@@ -2563,8 +2576,6 @@ in
       nvim-treesitter-parsers.zig
     ];
     nvimSkipModules = [
-      # Optional toggleterm integration
-      "nvim-test.terms.toggleterm"
       # Broken runners
       "nvim-test.runners.zig"
       "nvim-test.runners.hspec"
@@ -2767,9 +2778,11 @@ in
   };
 
   overseer-nvim = super.overseer-nvim.overrideAttrs {
-    checkInputs = [
+    checkInputs = with self; [
       # Optional integration
-      self.neotest
+      neotest
+      toggleterm-nvim
+      nvim-dap
     ];
     checkPhase = ''
       runHook preCheck
@@ -2782,11 +2795,6 @@ in
 
       runHook postCheck
     '';
-    nvimSkipModules = [
-      # Optional integrations
-      "overseer.strategy.toggleterm"
-      "overseer.dap"
-    ];
   };
 
   package-info-nvim = super.package-info-nvim.overrideAttrs {
@@ -3036,6 +3044,8 @@ in
   };
 
   snacks-nvim = super.snacks-nvim.overrideAttrs {
+    # Optional trouble integration
+    checkInputs = [ self.trouble-nvim ];
     nvimSkipModules = [
       # Requires setup call first
       # attempt to index global 'Snacks' (a nil value)
@@ -3060,8 +3070,6 @@ in
       "snacks.win"
       "snacks.words"
       "snacks.zen"
-      # Optional trouble integration
-      "trouble.sources.profiler"
       # TODO: Plugin requires libsqlite available, create a test for it
       "snacks.picker.util.db"
     ];
@@ -3427,6 +3435,7 @@ in
   };
 
   tokyonight-nvim = super.tokyonight-nvim.overrideAttrs {
+    checkInputs = [ self.fzf-lua ];
     nvimSkipModules = [
       # Meta file
       "tokyonight.docs"
@@ -3478,11 +3487,13 @@ in
     };
 
   typescript-nvim = super.typescript-nvim.overrideAttrs {
+    checkInputs = [
+      # Optional null-ls integration
+      self.none-ls-nvim
+    ];
     dependencies = with self; [
       nvim-lspconfig
     ];
-    # Optional null-ls integration
-    nvimSkipModules = [ "typescript.extensions.null-ls.code-actions.init" ];
   };
 
   typescript-tools-nvim = super.typescript-tools-nvim.overrideAttrs {
@@ -3807,7 +3818,7 @@ in
 
   vim-illuminate = super.vim-illuminate.overrideAttrs {
     # Optional treesitter integration
-    nvimSkipModules = "illuminate.providers.treesitter";
+    checkInputs = [ self.nvim-treesitter ];
   };
 
   vim-isort = super.vim-isort.overrideAttrs {
@@ -3939,14 +3950,17 @@ in
   };
 
   whichpy-nvim = super.whichpy-nvim.overrideAttrs {
-    checkInputs = with self; [
-      telescope-nvim
+    checkInputs = [
+      # Optional telescope integration
+      self.telescope-nvim
     ];
   };
 
   wiki-vim = super.wiki-vim.overrideAttrs {
-    # Optional telescope integration
-    nvimSkipModules = [ "wiki.telescope" ];
+    checkInputs = [
+      # Optional telescope integration
+      self.telescope-nvim
+    ];
   };
 
   windows-nvim = super.windows-nvim.overrideAttrs {
@@ -3989,10 +4003,9 @@ in
   };
 
   yanky-nvim = super.yanky-nvim.overrideAttrs {
-    nvimSkipModules = [
+    checkInputs = with self; [
       # Optional telescope integration
-      "yanky.telescope.mapping"
-      "yanky.telescope.yank_history"
+      telescope-nvim
     ];
   };
 
@@ -4074,12 +4087,12 @@ in
   };
 
   zk-nvim = super.zk-nvim.overrideAttrs {
-    # Optional integrations
-    nvimSkipModules = [
-      "zk.pickers.fzf_lua"
-      "zk.pickers.minipick"
-      "zk.pickers.snacks_picker"
-      "zk.pickers.telescope"
+    checkInputs = with self; [
+      # Optional pickers
+      fzf-lua
+      mini-nvim
+      snacks-nvim
+      telescope-nvim
     ];
   };
 

pkgs/applications/editors/vscode/extensions/WakaTime.vscode-wakatime/default.nix

@@ -7,8 +7,8 @@ buildVscodeMarketplaceExtension {
   mktplcRef = {
     name = "vscode-wakatime";
     publisher = "WakaTime";
-    version = "25.0.3";
-    hash = "sha256-rD2Uzzt8xfkfgM+Y0NLe7lthfxinv1Zatpr56OjfABM=";
+    version = "25.0.4";
+    hash = "sha256-J+H/PShsOGwt0AZExLApXLl86XQdZbE5cPS9v4gOXWc=";
   };
 
   meta = {

pkgs/applications/editors/vscode/extensions/default.nix

@@ -786,8 +786,8 @@ let
         mktplcRef = {
           name = "vscode-tailwindcss";
           publisher = "bradlc";
-          version = "0.14.19";
-          hash = "sha256-HgrUTrYHJNC8tS8qZza98Tr3T0O0NMb7DgddNf3m7XY=";
+          version = "0.14.20";
+          hash = "sha256-Q45o7UAqyPuSMI02BOyXHzD5eqOJLYcYGnwA+eppEj4=";
         };
         meta = {
           changelog = "https://marketplace.visualstudio.com/items/bradlc.vscode-tailwindcss/changelog";
@@ -1210,8 +1210,8 @@ let
         mktplcRef = {
           publisher = "DanielSanMedium";
           name = "dscodegpt";
-          version = "3.12.38";
-          hash = "sha256-+9OsFH586I8/P7WzadRHS9tX22/bxOByJB2LDSqp2Nk=";
+          version = "3.12.39";
+          hash = "sha256-CShqaG3P6b9JdAtbqFyGn7RGZX8ov98sYJiBy9RCXnE=";
         };
         meta = {
           changelog = "https://marketplace.visualstudio.com/items/DanielSanMedium.dscodegpt/changelog";
@@ -1279,8 +1279,8 @@ let
         mktplcRef = {
           name = "vscode-markdownlint";
           publisher = "DavidAnson";
-          version = "0.59.0";
-          hash = "sha256-zbK7kRa9k5xIM7BcwMOT1pRO7637eMUCUzgQwnpBCvI=";
+          version = "0.60.0";
+          hash = "sha256-Buwa63HahT96qhhuvARW7p1u9kbkoEyA9usoh60m3KE=";
         };
         meta = {
           changelog = "https://marketplace.visualstudio.com/items/DavidAnson.vscode-markdownlint/changelog";
@@ -1643,8 +1643,8 @@ let
         mktplcRef = {
           publisher = "editorconfig";
           name = "editorconfig";
-          version = "0.17.2";
-          hash = "sha256-Xi2+mN6zjIKm0HWxfRAFs2vYkZ10Gv6poR2b2d8XCug=";
+          version = "0.17.4";
+          hash = "sha256-MYPYhSKAxgaZ0UijxU+xiO4HDPLtXGymhN+2YmTev8M=";
         };
         meta = {
           changelog = "https://marketplace.visualstudio.com/items/EditorConfig.EditorConfig/changelog";
@@ -2129,8 +2129,8 @@ let
         mktplcRef = {
           name = "gitlab-workflow";
           publisher = "gitlab";
-          version = "6.17.0";
-          hash = "sha256-4/wGrHFB7yn7WTJq9igOU6XTOQZ1PGZ6kdMBP/IlZqw=";
+          version = "6.21.0";
+          hash = "sha256-vaOAk4ovQjUcnBtxqMlRstYLvR6uzmqGk3Sx6zV6wvY=";
         };
         meta = {
           description = "GitLab extension for Visual Studio Code";
@@ -2619,8 +2619,8 @@ let
         mktplcRef = {
           name = "gruvbox";
           publisher = "jdinhlife";
-          version = "1.26.0";
-          hash = "sha256-XSDGwJ8zL1y9EZqk2wixMEV5GRjQngs8Pvu9QppWCNI=";
+          version = "1.28.0";
+          hash = "sha256-XwQzbbZU6MfYcT50/0YgQp8UaOeQskEvEQPZXG72lLk=";
         };
         meta = {
           changelog = "https://marketplace.visualstudio.com/items/jdinhlife.gruvbox/changelog";
@@ -3264,8 +3264,8 @@ let
         mktplcRef = {
           publisher = "ms-azuretools";
           name = "vscode-docker";
-          version = "1.29.6";
-          hash = "sha256-kHQuS6wxp3Gu5WSjWRXXMLwSrv7LBSsnsNu7VY4H/J0=";
+          version = "2.0.0";
+          hash = "sha256-Yxysekp9nC91g7M5oXppOF+Rf4Jf/PD+X3inmdVfVmo=";
         };
         meta = {
           description = "Docker Extension for Visual Studio Code";
@@ -3284,8 +3284,8 @@ let
         mktplcRef = {
           name = "vscode-dotnet-runtime";
           publisher = "ms-dotnettools";
-          version = "2.3.3";
-          hash = "sha256-l+/r0C+BZr8H8qBKenVP3b4qYGR57Lol+Y1Q2XUGl24=";
+          version = "2.3.5";
+          hash = "sha256-Hik1BNhvcCs/IzqSvc2dPu3v6PhCZSqovFH4ODVJMnE=";
         };
         meta = {
           changelog = "https://marketplace.visualstudio.com/items/ms-dotnettools.vscode-dotnet-runtime/changelog";
@@ -4303,8 +4303,8 @@ let
         mktplcRef = {
           publisher = "seatonjiang";
           name = "gitmoji-vscode";
-          version = "1.2.5";
-          hash = "sha256-lWd7SyYNxoDauMecJq11akTiwEKBeXuR4htDYCbb6n4=";
+          version = "1.3.0";
+          hash = "sha256-vr6UKd+7g6J8XEY57sCqPpLuxNC4KOvf7nddDKaceaU=";
         };
         meta = {
           changelog = "https://marketplace.visualstudio.com/items/seatonjiang.gitmoji-vscode/changelog";
@@ -4617,8 +4617,8 @@ let
         mktplcRef = {
           name = "vscode-stylelint";
           publisher = "stylelint";
-          version = "1.5.0";
-          hash = "sha256-SHUb7+eL0PWlw/KUidXPvE5+MFsJz1Fi7Csptiw8j4M=";
+          version = "1.5.1";
+          hash = "sha256-Sbp2zy/6PcsMlUPe94spm3JrWxBYHfd7py3f4rb+0G4=";
         };
         meta = {
           description = "Official Stylelint extension for Visual Studio Code";
@@ -4942,8 +4942,8 @@ let
         mktplcRef = {
           name = "vscode-testscript";
           publisher = "twpayne";
-          version = "0.0.5";
-          hash = "sha256-rAkwcEmonZArN7Vls8k5ey+6V1b5bICTJoOSxgtnv+A=";
+          version = "0.0.6";
+          hash = "sha256-y8Esm6nnLf+4FPxy4aZxrTPOxx+zoWm7mUrxZ1dsPyM=";
         };
         meta = {
           description = "Syntax highlighting support for testscript";
@@ -5019,8 +5019,8 @@ let
         mktplcRef = {
           name = "vscode-mdx";
           publisher = "unifiedjs";
-          version = "1.8.14";
-          hash = "sha256-kIQPvmLkqZa3jPxIfJ3LDyIvr5yXQTsO7uzzvFa9EJM=";
+          version = "1.8.15";
+          hash = "sha256-n2aWgvhSaU7TU45yeIUU8OmIMOAVYYB500jxrChPeA4=";
         };
         meta = {
           changelog = "https://marketplace.visualstudio.com/items/unifiedjs.vscode-mdx/changelog";
@@ -5371,8 +5371,8 @@ let
         mktplcRef = {
           name = "gitblame";
           publisher = "waderyan";
-          version = "11.1.2";
-          sha256 = "sha256-TlvMyFmtJQtpsjbdh3bPiRaMHro0M7gKOgtGc2bQLN4=";
+          version = "11.1.3";
+          sha256 = "sha256-r+fmb382hzxD7frrsNZTJk6uPahO7QBfKTJWA0ObWFI=";
         };
         meta = {
           changelog = "https://marketplace.visualstudio.com/items/waderyan.gitblame/changelog";
@@ -5643,8 +5643,8 @@ let
         mktplcRef = {
           name = "vscode-zig";
           publisher = "ziglang";
-          version = "0.6.9";
-          hash = "sha256-R18NnnsYVLmCNdGU0plIYn2MKrlSedfJoXH/amxKKaY=";
+          version = "0.6.10";
+          hash = "sha256-Tptl+tJ2ZlnKyswdTjnPJakhiiJn+1XmB82rbk8aO1w=";
         };
         meta = {
           changelog = "https://marketplace.visualstudio.com/items/ziglang.vscode-zig/changelog";

pkgs/applications/editors/vscode/extensions/github.copilot-chat/default.nix

@@ -7,8 +7,8 @@ vscode-utils.buildVscodeMarketplaceExtension {
   mktplcRef = {
     publisher = "github";
     name = "copilot-chat";
-    version = "0.27.2";
-    hash = "sha256-nwBDQNs5qrA0TxQZVtuXRiOy0iBNOCFpIim0x2k37YA=";
+    version = "0.27.3";
+    hash = "sha256-b7zvbDzwJcHAp9tn2ibtyeErrH2KNbgqT4Ir7aqLMQg=";
   };
 
   meta = {

pkgs/applications/editors/vscode/extensions/github.copilot/default.nix

@@ -7,8 +7,8 @@ vscode-utils.buildVscodeMarketplaceExtension {
   mktplcRef = {
     publisher = "github";
     name = "copilot";
-    version = "1.323.0";
-    hash = "sha256-rTAq6snn3HAARrYbMJYy7aZ5rDucLfFS/t01VPjgXAo=";
+    version = "1.326.0";
+    hash = "sha256-bZ8Cm3bowUCWq4mMv/7rWIBOdw1U6UoH7RODz20/r9U=";
   };
 
   meta = {

pkgs/applications/editors/vscode/extensions/ms-azuretools.vscode-bicep/default.nix

@@ -10,8 +10,8 @@ vscode-utils.buildVscodeMarketplaceExtension {
   mktplcRef = {
     publisher = "ms-azuretools";
     name = "vscode-bicep";
-    version = "0.35.1";
-    hash = "sha256-Ggp3Z3pxPMEDxgzjPYNr830wx+upkBP4YAbKiOivbYs=";
+    version = "0.36.1";
+    hash = "sha256-yrSIHTGHZ1m6fLGrtVlT4UHyWpKuzGKdywBDsMepd4g=";
   };
 
   buildInputs = [

pkgs/applications/editors/vscode/extensions/ms-dotnettools.csdevkit/default.nix

@@ -16,19 +16,19 @@ let
     {
       x86_64-linux = {
         arch = "linux-x64";
-        hash = "sha256-XHx64V8JJl+/kb+kkTowu7mE7ysBRhUQJqicxjbHM3k=";
+        hash = "sha256-bpvaGnl6LQaZazuk/xGHxbNUsEMph0tDAaAOBIuikVQ=";
       };
       aarch64-linux = {
         arch = "linux-arm64";
-        hash = "sha256-Pm3jUARrH8bksiCpYtUvo0UB3Oq67EjJGYLGLV54rl4=";
+        hash = "sha256-yBT5sAZHXX66vuTDo+opPLBnCX09tBQYscW5LaiS3nU=";
       };
       x86_64-darwin = {
         arch = "darwin-x64";
-        hash = "sha256-hgd7tpRn2WP0PL4IOpZLL6Uzw1V9rSqlOTDfgFxwWGk=";
+        hash = "sha256-W7qGN3VbS1BJT+887mSqegKheLimYR59gNj7QOZBvyg=";
       };
       aarch64-darwin = {
         arch = "darwin-arm64";
-        hash = "sha256-PQPxwwHbLXa5+p/SfH4IFu/OBEa/1CKdfaM+HAegiDA=";
+        hash = "sha256-OlsoQsA6qHoIwRRVvMpjyO9BOdR63mRcSFkM9i0nFH0=";
       };
     }
     .${stdenv.hostPlatform.system} or (throw "Unsupported system: ${stdenv.hostPlatform.system}")
@@ -38,7 +38,7 @@ vscode-utils.buildVscodeMarketplaceExtension {
   mktplcRef = {
     name = "csdevkit";
     publisher = "ms-dotnettools";
-    version = "1.19.63";
+    version = "1.20.35";
     inherit (extInfo) hash arch;
   };
   sourceRoot = "extension"; # This has more than one folder.

pkgs/applications/editors/vscode/extensions/ms-dotnettools.csharp/default.nix

@@ -17,19 +17,19 @@ let
     {
       x86_64-linux = {
         arch = "linux-x64";
-        hash = "sha256-yJ4bAxIg3yfQJPWJcl6jUMwQ/ssHkstJWuEp3wr0dDA=";
+        hash = "sha256-rxXyDIDANtWUT4z6SK+fHwMXu/xSOIGtNpILdlC5lMc=";
       };
       aarch64-linux = {
         arch = "linux-arm64";
-        hash = "sha256-EpWHwansBwBD0aYoW2ek7iWFbp+s7ZH6ug3ejoSRG5U=";
+        hash = "sha256-3JLnZr7pGOY0wSmo9PpQclDE/Yb99qJLALgEBAPn4Ms=";
       };
       x86_64-darwin = {
         arch = "darwin-x64";
-        hash = "sha256-345hK47tyMGMJDKiujwpECDHMbRpLi17x2lH2rMX9Lg=";
+        hash = "sha256-yhP5dXP42ZKsoLZ3CySY+Nw2c0bF4IKDc0Le9ky+Qmc=";
       };
       aarch64-darwin = {
         arch = "darwin-arm64";
-        hash = "sha256-u/vflQd285SuZ41ASd8nJgs+lN6892J3x6lPgWqVY+Y=";
+        hash = "sha256-KtOZ4AzsS30nF0DtJJT/CaLRD6Pa9pz1hYBgvxPbzZw=";
       };
     }
     .${stdenv.hostPlatform.system} or (throw "Unsupported system: ${stdenv.hostPlatform.system}")
@@ -39,7 +39,7 @@ vscode-utils.buildVscodeMarketplaceExtension {
   mktplcRef = {
     name = "csharp";
     publisher = "ms-dotnettools";
-    version = "2.76.27";
+    version = "2.80.16";
     inherit (extInfo) hash arch;
   };
 

pkgs/applications/editors/vscode/extensions/reditorsupport.r/default.nix

@@ -12,8 +12,8 @@ vscode-utils.buildVscodeMarketplaceExtension {
   mktplcRef = {
     name = "r";
     publisher = "reditorsupport";
-    version = "2.8.5";
-    hash = "sha256-cZeZdrViEae9sRb9GyB/LeSQ5NRb/fAp3qQW9mPMbsM=";
+    version = "2.8.6";
+    hash = "sha256-T/Qh0WfTfXMzPonbg9NMII5qFptfNoApFFiZCT5rR3Y=";
   };
   nativeBuildInputs = [
     jq

pkgs/applications/editors/vscode/extensions/rooveterinaryinc.roo-cline/default.nix

@@ -8,8 +8,8 @@ vscode-utils.buildVscodeMarketplaceExtension {
   mktplcRef = {
     publisher = "RooVeterinaryInc";
     name = "roo-cline";
-    version = "3.18.3";
-    hash = "sha256-kg4kXO7UwDQPXb6CAysaez2v8FPRMbX+f41vE68V0QA=";
+    version = "3.19.3";
+    hash = "sha256-7GZD7oCrkGcG7B/pgXK92hL0QyyodmqyxOcRhTt5LMs=";
   };
 
   passthru.updateScript = vscode-extension-update-script { };

pkgs/applications/editors/vscode/extensions/sourcery.sourcery/default.nix

@@ -10,8 +10,8 @@ vscode-utils.buildVscodeMarketplaceExtension {
   mktplcRef = {
     name = "sourcery";
     publisher = "sourcery";
-    version = "1.36.0";
-    hash = "sha256-HbOPoDu0R47US+UtK7i2BLiYgUhnNMD1i6Ibo8h3Auk=";
+    version = "1.37.0";
+    hash = "sha256-ovCxcr1m3GmRu45hr5DG781xkQdANbQYLvV2gFhG4eQ=";
   };
 
   nativeBuildInputs = lib.optionals stdenv.hostPlatform.isLinux [ autoPatchelfHook ];

pkgs/applications/graphics/yacreader/default.nix

@@ -74,7 +74,7 @@ stdenv.mkDerivation rec {
 
   meta = {
     description = "Comic reader for cross-platform reading and managing your digital comic collection";
-    homepage = "http://www.yacreader.com";
+    homepage = "https://www.yacreader.com";
     license = lib.licenses.gpl3;
     mainProgram = "YACReader";
     maintainers = [ ];

pkgs/applications/misc/kchmviewer/default.nix

@@ -1,66 +0,0 @@
-{
-  lib,
-  stdenv,
-  fetchFromGitHub,
-  fetchpatch,
-  qmake,
-  wrapQtAppsHook,
-  chmlib,
-  libzip,
-  qtwebengine,
-}:
-
-stdenv.mkDerivation rec {
-  pname = "kchmviewer";
-  version = "8.0";
-
-  src = fetchFromGitHub {
-    owner = "gyunaev";
-    repo = pname;
-    rev = "RELEASE_${lib.replaceStrings [ "." ] [ "_" ] version}";
-    sha256 = "sha256-YNpiBf6AFBCRbAZRPODvqGbQQedJJJrZFQIQyzIeBlw=";
-  };
-
-  patches = [
-    # remove unused webkit
-    (fetchpatch {
-      url = "https://github.com/gyunaev/kchmviewer/commit/a4a3984465cb635822953350c571950ae726b539.patch";
-      sha256 = "sha256-nHW18a4SrTG4fETJmKS4ojHXwnX1d1uN1m4H0GIuI28=";
-    })
-    # QtWebengine fixes
-    (fetchpatch {
-      url = "https://github.com/gyunaev/kchmviewer/commit/9ac73e7ad15de08aab6b1198115be2eb44da7afe.patch";
-      sha256 = "sha256-qg2ytqA2On7jg19WZmHIOU7vLQI2hoyqItySLEA64SY=";
-    })
-    (fetchpatch {
-      url = "https://github.com/gyunaev/kchmviewer/commit/99a6d94bdfce9c4578cce82707e71863a71d1453.patch";
-      sha256 = "sha256-o8JkaMmcJObmMt+o/6ooCAPCi+yRAWDAgxV+tR5eHfY=";
-    })
-  ];
-
-  buildInputs = [
-    chmlib
-    libzip
-    qtwebengine
-  ];
-
-  nativeBuildInputs = [
-    qmake
-    wrapQtAppsHook
-  ];
-
-  postInstall = ''
-    install -Dm755 bin/kchmviewer -t $out/bin
-    install -Dm644 packages/kchmviewer.png -t $out/share/pixmaps
-    install -Dm644 packages/kchmviewer.desktop -t $out/share/applications
-  '';
-
-  meta = with lib; {
-    description = "CHM (Winhelp) files viewer";
-    mainProgram = "kchmviewer";
-    homepage = "http://www.ulduzsoft.com/linux/kchmviewer/";
-    license = licenses.gpl3Plus;
-    maintainers = with maintainers; [ sikmir ];
-    platforms = platforms.linux;
-  };
-}

pkgs/applications/misc/lyx/default.nix

@@ -54,7 +54,7 @@ mkDerivation rec {
 
   meta = with lib; {
     description = "WYSIWYM frontend for LaTeX, DocBook";
-    homepage = "http://www.lyx.org";
+    homepage = "https://www.lyx.org";
     license = licenses.gpl2Plus;
     maintainers = [ maintainers.vcunat ];
     platforms = platforms.linux;

pkgs/applications/misc/orpie/default.nix

@@ -10,9 +10,9 @@ ocamlPackages.buildDunePackage rec {
 
   src = fetchFromGitHub {
     owner = "pelzlpj";
-    repo = pname;
-    rev = "release-${version}";
-    sha256 = "1rx2nl6cdv609pfymnbq53pi3ql5fr4kda8x10ycd9xq2gc4f21g";
+    repo = "orpie";
+    tag = "release-${version}";
+    sha256 = "sha256-LwhH2BO4p8Y8CB2pNkl2heIR7yh42erdTcDsxgy1ouc=";
   };
 
   patches = [ ./prefix.patch ];

pkgs/applications/networking/cluster/terraform-providers/providers.json

@@ -36,13 +36,13 @@
     "vendorHash": "sha256-jK7JuARpoxq7hvq5+vTtUwcYot0YqlOZdtDwq4IqKvk="
   },
   "aiven": {
-    "hash": "sha256-XZXyeWSgJ5h+dkxYNqb49BrdlmpbfMIxY7UgP2yAtoI=",
+    "hash": "sha256-XIBaAzQWuKbLIkjSqBS3hVOtXlZzt9AonSgE+qTmU8Q=",
     "homepage": "https://registry.terraform.io/providers/aiven/aiven",
     "owner": "aiven",
     "repo": "terraform-provider-aiven",
-    "rev": "v4.40.0",
+    "rev": "v4.41.0",
     "spdx": "MIT",
-    "vendorHash": "sha256-T2yIUO8DAuUC5s/bBxgsn99fCjJO1y6TzmPTuhT08FY="
+    "vendorHash": "sha256-lzih59OW98HRfl8ENCdGDeocNZjnWvHjNWmd0djPoEM="
   },
   "akamai": {
     "hash": "sha256-JALEVzmBVmHtCG4B1jNeNdSWb+SGZWDSZgUQ5voMQPg=",
@@ -399,13 +399,13 @@
     "vendorHash": "sha256-0axKIqF1t4AW1PPi+fHfsFQLRrjhpsloQIZ9clR+8Gc="
   },
   "docker": {
-    "hash": "sha256-sPeX1bupACBSmt8ppyxQKyD+FXIPdCBWn8cnOAvNHwQ=",
+    "hash": "sha256-A2XFSVWpEZs6vmJb5i9dDqkIIlwoGLgbFxXUnFKgtMo=",
     "homepage": "https://registry.terraform.io/providers/kreuzwerker/docker",
     "owner": "kreuzwerker",
     "repo": "terraform-provider-docker",
-    "rev": "v3.6.0",
+    "rev": "v3.6.1",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-bQM6bAtTqAzrIqvCnpfxYefiTmTKaJq8okAgOVls5jk="
+    "vendorHash": "sha256-duHOqjy8AthXuDX63GO3myJ9TJmV0Ts1a8OsbSOGZWI="
   },
   "doppler": {
     "hash": "sha256-TPWHqRpvyk1dtSbQySMOecq0AhN2VlSB+2naPIbvMHI=",
@@ -543,13 +543,13 @@
     "vendorHash": "sha256-fqVBnAivVekV+4tpkl+E6eNA3wi8mhLevJRCs3W7L2g="
   },
   "grafana": {
-    "hash": "sha256-Nz+6l/sJog7Snzady4qQCooBwv6IZ+12RkFZ55Hka9w=",
+    "hash": "sha256-nKapC8Pcg/HF/xXP8fOzMQV0NSJarAym6TIb+7l0g+c=",
     "homepage": "https://registry.terraform.io/providers/grafana/grafana",
     "owner": "grafana",
     "repo": "terraform-provider-grafana",
-    "rev": "v3.25.1",
+    "rev": "v3.25.2",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-G5CiuQ0GPsJ7D+wlWQUAktT3DSgb2X7NL66c6U+9APU="
+    "vendorHash": "sha256-QTcWJlwE6s4nEPSg6svzIhsJo9p9rk1gQiSr4qSTfns="
   },
   "gridscale": {
     "hash": "sha256-Ygt3L/dzwycccQZmuwbcaLHp9FBGNHgU19wSNmY8PzQ=",
@@ -687,13 +687,13 @@
     "vendorHash": null
   },
   "jetstream": {
-    "hash": "sha256-N/cKiMwPHo8581PFg06RjgOGpGB02/CCARTIFu9kH3s=",
+    "hash": "sha256-I9T5PTNiZfCyPnNiqL8yDhJxpLRQpK7ynZmlr682BnY=",
     "homepage": "https://registry.terraform.io/providers/nats-io/jetstream",
     "owner": "nats-io",
     "repo": "terraform-provider-jetstream",
-    "rev": "v0.2.0",
+    "rev": "v0.2.1",
     "spdx": "Apache-2.0",
-    "vendorHash": "sha256-Dd02Ikt51eh/FBEtswe8Qr6P5tgQFZJTKgO01gxPX3s="
+    "vendorHash": "sha256-ctd9V5EXL0c9b4aJ47nfjhqCMTewL55IkjkQ39ShoUk="
   },
   "kafka": {
     "hash": "sha256-RZwag424lXwI1GR/kFOcpv+huaYMyG4jcFjkhvA0Nlc=",

pkgs/applications/networking/mullvad/mullvad.nix

@@ -30,18 +30,28 @@ let
 in
 rustPlatform.buildRustPackage rec {
   pname = "mullvad";
-  version = "2025.3";
+  version = "2025.6";
 
   src = fetchFromGitHub {
     owner = "mullvad";
     repo = "mullvadvpn-app";
     tag = version;
     fetchSubmodules = true;
-    hash = "sha256-IpGTqi0gSE2yXXou5fp+CryHfIKx0n3y/V4K2+ZO3k8=";
+    hash = "sha256-WWJcfnp1v1LhEElJQdLx6Gz+bj7MdgbefD6BQ4nihMs=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-EJ8yk11H1QB+7CGjJYY5BjBAFTDK4d02/DJOQTVGFho=";
+  cargoHash = "sha256-r6WogC25hpzw2pHa8RQOhr9SWks9RKKatpVHblfs+Nc=";
+
+  cargoBuildFlags = [
+    "-p mullvad-daemon --bin mullvad-daemon"
+    "-p mullvad-cli --bin mullvad"
+    "-p mullvad-setup --bin mullvad-setup"
+    "-p mullvad-problem-report --bin mullvad-problem-report"
+    "-p mullvad-exclude --bin mullvad-exclude"
+    "-p tunnel-obfuscation --bin tunnel-obfuscation"
+    "-p talpid-openvpn-plugin --lib"
+  ];
 
   checkFlags = [
     "--skip=version_check"
@@ -79,22 +89,14 @@ rustPlatform.buildRustPackage rec {
   '';
 
   postFixup =
-    # Place all binaries in the 'mullvad-' namespace, even though these
-    # specific binaries aren't used in the lifetime of the program.
+    # Files necessary for OpenVPN tunnels to work.
+    lib.optionalString enableOpenvpn ''
+      mkdir -p $out/share/mullvad
+      cp dist-assets/ca.crt $out/share/mullvad
+      ln -s ${openvpn-mullvad}/bin/openvpn $out/share/mullvad
+      ln -s ${shadowsocks-rust}/bin/sslocal $out/share/mullvad
+      ln -s $out/lib/libtalpid_openvpn_plugin.so $out/share/mullvad
     ''
-      for bin in relay_list translations-converter tunnel-obfuscation; do
-        mv "$out/bin/$bin" "$out/bin/mullvad-$bin"
-      done
-    ''
-    +
-      # Files necessary for OpenVPN tunnels to work.
-      lib.optionalString enableOpenvpn ''
-        mkdir -p $out/share/mullvad
-        cp dist-assets/ca.crt $out/share/mullvad
-        ln -s ${openvpn-mullvad}/bin/openvpn $out/share/mullvad
-        ln -s ${shadowsocks-rust}/bin/sslocal $out/share/mullvad
-        ln -s $out/lib/libtalpid_openvpn_plugin.so $out/share/mullvad
-      ''
     +
       # Set the directory where Mullvad will look for its resources by default to
       # `$out/share`, so that we can avoid putting the files in `$out/bin` --
@@ -121,7 +123,7 @@ rustPlatform.buildRustPackage rec {
   meta = {
     description = "Mullvad VPN command-line client tools";
     homepage = "https://github.com/mullvad/mullvadvpn-app";
-    changelog = "https://github.com/mullvad/mullvadvpn-app/blob/2025.2/CHANGELOG.md";
+    changelog = "https://github.com/mullvad/mullvadvpn-app/blob/2025.6/CHANGELOG.md";
     license = lib.licenses.gpl3Only;
     maintainers = with lib.maintainers; [ cole-h ];
     mainProgram = "mullvad";

pkgs/applications/science/math/mathematica/default.nix

@@ -72,7 +72,7 @@ callPackage ./generic.nix {
   );
   meta = with lib; {
     description = "Wolfram Mathematica computational software system";
-    homepage = "http://www.wolfram.com/mathematica/";
+    homepage = "https://www.wolfram.com/mathematica/";
     license = licenses.unfree;
     sourceProvenance = with sourceTypes; [ binaryNativeCode ];
     maintainers = with maintainers; [

pkgs/applications/version-management/bitbucket-server-cli/Gemfile

@@ -1,2 +0,0 @@
-source 'https://rubygems.org'
-gem 'atlassian-stash'

pkgs/applications/version-management/bitbucket-server-cli/Gemfile.lock

@@ -1,27 +0,0 @@
-GEM
-  remote: https://rubygems.org/
-  specs:
-    addressable (2.5.0)
-      public_suffix (~> 2.0, >= 2.0.2)
-    atlassian-stash (0.7.0)
-      commander (~> 4.1.2)
-      git (>= 1.2.5)
-      json (>= 1.7.5)
-      launchy (~> 2.4.2)
-    commander (4.1.6)
-      highline (~> 1.6.11)
-    git (1.3.0)
-    highline (1.6.21)
-    json (2.0.2)
-    launchy (2.4.3)
-      addressable (~> 2.3)
-    public_suffix (2.0.5)
-
-PLATFORMS
-  ruby
-
-DEPENDENCIES
-  atlassian-stash
-
-BUNDLED WITH
-   2.1.4

pkgs/applications/version-management/bitbucket-server-cli/default.nix

@@ -1,30 +0,0 @@
-{
-  lib,
-  bundlerEnv,
-  ruby,
-  bundlerUpdateScript,
-}:
-
-bundlerEnv rec {
-  name = "bitbucket-server-cli-${version}";
-
-  version = (import ./gemset.nix).atlassian-stash.version;
-  inherit ruby;
-  gemdir = ./.;
-
-  pname = "atlassian-stash";
-
-  passthru.updateScript = bundlerUpdateScript "bitbucket-server-cli";
-
-  meta = with lib; {
-    description = "Command line interface to interact with BitBucket Server (formerly Atlassian Stash)";
-    homepage = "https://bitbucket.org/atlassian/bitbucket-server-cli";
-    license = licenses.mit;
-    maintainers = with maintainers; [
-      jgertm
-      nicknovitski
-    ];
-    mainProgram = "stash";
-    platforms = platforms.unix;
-  };
-}

pkgs/applications/version-management/bitbucket-server-cli/gemset.nix

@@ -1,66 +0,0 @@
-{
-  addressable = {
-    source = {
-      remotes = [ "https://rubygems.org" ];
-      sha256 = "1j5r0anj8m4qlf2psnldip4b8ha2bsscv11lpdgnfh4nnchzjnxw";
-      type = "gem";
-    };
-    version = "2.5.0";
-  };
-  atlassian-stash = {
-    source = {
-      remotes = [ "https://rubygems.org" ];
-      sha256 = "1rsf9h5w5wiglwv0fqwp45fq06fxbg68cqkc3bpqvps1i1qm0p6i";
-      type = "gem";
-    };
-    version = "0.7.0";
-  };
-  commander = {
-    source = {
-      remotes = [ "https://rubygems.org" ];
-      sha256 = "0x9i8hf083wjlgj09nl1p9j8sr5g7amq0fdmxjqs4cxdbg3wpmsb";
-      type = "gem";
-    };
-    version = "4.1.6";
-  };
-  git = {
-    source = {
-      remotes = [ "https://rubygems.org" ];
-      sha256 = "1waikaggw7a1d24nw0sh8fd419gbf7awh000qhsf411valycj6q3";
-      type = "gem";
-    };
-    version = "1.3.0";
-  };
-  highline = {
-    source = {
-      remotes = [ "https://rubygems.org" ];
-      sha256 = "06bml1fjsnrhd956wqq5k3w8cyd09rv1vixdpa3zzkl6xs72jdn1";
-      type = "gem";
-    };
-    version = "1.6.21";
-  };
-  json = {
-    source = {
-      remotes = [ "https://rubygems.org" ];
-      sha256 = "1lhinj9vj7mw59jqid0bjn2hlfcnq02bnvsx9iv81nl2han603s0";
-      type = "gem";
-    };
-    version = "2.0.2";
-  };
-  launchy = {
-    source = {
-      remotes = [ "https://rubygems.org" ];
-      sha256 = "190lfbiy1vwxhbgn4nl4dcbzxvm049jwc158r2x7kq3g5khjrxa2";
-      type = "gem";
-    };
-    version = "2.4.3";
-  };
-  public_suffix = {
-    source = {
-      remotes = [ "https://rubygems.org" ];
-      sha256 = "040jf98jpp6w140ghkhw2hvc1qx41zvywx5gj7r2ylr1148qnj7q";
-      type = "gem";
-    };
-    version = "2.0.5";
-  };
-}

pkgs/applications/video/kodi/addons/six/default.nix

@@ -16,8 +16,11 @@ buildKodiAddon rec {
     sha256 = "sha256-d6BNpnTg6K7NPX3uWp5X0rog33C+B7YoAtLH/CrUYno=";
   };
 
-  passthru.updateScript = addonUpdateScript {
-    attrPath = "kodi.packages.six";
+  passthru = {
+    pythonPath = "lib";
+    updateScript = addonUpdateScript {
+      attrPath = "kodi.packages.six";
+    };
   };
 
   meta = with lib; {

pkgs/applications/video/mpv/scripts/mpv-image-viewer.nix

@@ -18,7 +18,7 @@ let
           hash = "sha256-VwIL1529CW9MLK4N9jHHddSSZD5RsJ5bWGWqGJ751C0=";
         };
 
-        sourceRoot = "source/scripts";
+        sourceRoot = "${self.src.name}/scripts";
 
         passthru = {
           updateScript = unstableGitUpdater { };

pkgs/applications/video/vdr/default.nix

@@ -82,7 +82,7 @@ stdenv.mkDerivation rec {
   ];
 
   meta = with lib; {
-    homepage = "http://www.tvdr.de/";
+    homepage = "https://www.tvdr.de/";
     description = "Video Disc Recorder";
     maintainers = [ maintainers.ck3d ];
     platforms = platforms.linux;

pkgs/applications/virtualization/virtualbox/default.nix

@@ -16,7 +16,6 @@
   libXcursor,
   libXfixes,
   libXmu,
-  libIDL,
   SDL2,
   libcap,
   libGL,
@@ -74,9 +73,9 @@ let
   buildType = "release";
   # Use maintainers/scripts/update.nix to update the version and all related hashes or
   # change the hashes in extpack.nix and guest-additions/default.nix as well manually.
-  virtualboxVersion = "7.1.8";
+  virtualboxVersion = "7.1.10";
   virtualboxSubVersion = "";
-  virtualboxSha256 = "3f7132c55ac6c5f50585bfaa115d29e30b47ccf535cb0a12ff50214ddae2f63d";
+  virtualboxSha256 = "7d60010a4c9102613554b46f61d17b825c30ee59d8be071e52d8aac664ca9869";
 
   kvmPatchVersion = "20250207";
   kvmPatchHash = "sha256-GzRLIXhzWL1NLvaGKcWVBCdvay1IxgJUE4koLX1ze7Y=";
@@ -148,7 +147,6 @@ stdenv.mkDerivation (finalAttrs: {
       libX11
       libXext
       libXcursor
-      libIDL
       libcap
       glib
       lvm2
@@ -249,8 +247,8 @@ stdenv.mkDerivation (finalAttrs: {
     ++ optional enableKvm (
       let
         patchVboxVersion =
-          # There is no updated patch for 7.1.8 yet, but the older one still applies.
-          if finalAttrs.virtualboxVersion == "7.1.8" then "7.1.6" else finalAttrs.virtualboxVersion;
+          # There is no updated patch for 7.1.10 yet, but the older one still applies.
+          if finalAttrs.virtualboxVersion == "7.1.10" then "7.1.6" else finalAttrs.virtualboxVersion;
       in
       fetchpatch {
         name = "virtualbox-${finalAttrs.virtualboxVersion}-kvm-dev-${finalAttrs.kvmPatchVersion}.patch";
@@ -320,7 +318,7 @@ stdenv.mkDerivation (finalAttrs: {
       ${optionalString (enableKvm) "--with-kvm"} \
       ${extraConfigureFlags} \
       --disable-kmods
-    sed -e 's@PKG_CONFIG_PATH=.*@PKG_CONFIG_PATH=${libIDL}/lib/pkgconfig:${glib.dev}/lib/pkgconfig ${libIDL}/bin/libIDL-config-2@' \
+    sed -e 's@PKG_CONFIG_PATH=.*@PKG_CONFIG_PATH=${glib.dev}/lib/pkgconfig@' \
         -i AutoConfig.kmk
     sed -e 's@arch/x86/@@' \
         -i Config.kmk

pkgs/applications/virtualization/virtualbox/extpack.nix

@@ -4,7 +4,7 @@
   virtualbox,
 }:
 let
-  virtualboxExtPackVersion = "7.1.8";
+  virtualboxExtPackVersion = "7.1.10";
 in
 fetchurl rec {
   name = "Oracle_VirtualBox_Extension_Pack-${virtualboxExtPackVersion}.vbox-extpack";
@@ -14,7 +14,7 @@ fetchurl rec {
     # Thus do not use `nix-prefetch-url` but instead plain old `sha256sum`.
     # Checksums can also be found at https://www.virtualbox.org/download/hashes/${version}/SHA256SUMS
     let
-      value = "912586a3a1e9285f9df264f7999e6fffc0b8a42f2e013dd898a86f7ed3975d37";
+      value = "e020755711849fa0ee23d3bc47bc90cb0ea595da7dda804499568a0dc2387989";
     in
     assert (builtins.stringLength value) == 64;
     value;

pkgs/applications/virtualization/virtualbox/guest-additions-iso/default.nix

@@ -5,7 +5,7 @@
 }:
 fetchurl {
   url = "http://download.virtualbox.org/virtualbox/${virtualboxVersion}/VBoxGuestAdditions_${virtualboxVersion}.iso";
-  sha256 = "0001ed19cc389f04723c9b911338559b9b74bea0d24edf794d8d2ce5b5cb14e0";
+  sha256 = "59c92f7f5fd7e081211e989f5117fc53ad8d8800ad74a01b21e97bb66fe62972";
   meta = {
     description = "Guest additions ISO for VirtualBox";
     longDescription = ''

pkgs/applications/virtualization/virtualbox/guest-additions/default.nix

@@ -12,9 +12,9 @@
   libX11,
 }:
 let
-  virtualboxVersion = "7.1.8";
+  virtualboxVersion = "7.1.10";
   virtualboxSubVersion = "";
-  virtualboxSha256 = "3f7132c55ac6c5f50585bfaa115d29e30b47ccf535cb0a12ff50214ddae2f63d";
+  virtualboxSha256 = "7d60010a4c9102613554b46f61d17b825c30ee59d8be071e52d8aac664ca9869";
 
   virtualBoxNixGuestAdditionsBuilder = callPackage ./builder.nix {
     inherit virtualboxVersion virtualboxSubVersion virtualboxSha256;

pkgs/build-support/appimage/default.nix

@@ -149,7 +149,6 @@ rec {
         xorg.libpciaccess
 
         glib
-        gtk2
         bzip2
         zlib
         gdk-pixbuf
@@ -218,7 +217,6 @@ rec {
         speex
         SDL2_ttf
         SDL2_mixer
-        libappindicator-gtk2
         libcaca
         libcanberra
         libgcrypt

pkgs/build-support/fetchurl/boot.nix

@@ -2,7 +2,10 @@ let
   mirrors = import ./mirrors.nix;
 in
 
-{ system }:
+{
+  rewriteURL,
+  system,
+}:
 
 {
   url ? builtins.head urls,
@@ -28,7 +31,15 @@ import <nix/fetchurl.nix> {
     # Handle mirror:// URIs. Since <nix/fetchurl.nix> currently
     # supports only one URI, use the first listed mirror.
     let
-      m = builtins.match "mirror://([a-z]+)/(.*)" url;
+      url_ =
+        let
+          u = rewriteURL url;
+        in
+        if builtins.isString u then
+          u
+        else
+          throw "rewriteURL deleted the only URL passed to fetchurlBoot (was ${url})";
+      m = builtins.match "mirror://([a-z]+)/(.*)" url_;
     in
-    if m == null then url else builtins.head (mirrors.${builtins.elemAt m 0}) + (builtins.elemAt m 1);
+    if m == null then url_ else builtins.head (mirrors.${builtins.elemAt m 0}) + (builtins.elemAt m 1);
 }

pkgs/build-support/fetchurl/default.nix

@@ -6,6 +6,7 @@
   stdenvNoCC,
   curl, # Note that `curl' may be `null', in case of the native stdenvNoCC.
   cacert ? null,
+  rewriteURL,
 }:
 
 let
@@ -122,7 +123,7 @@ in
 }@args:
 
 let
-  urls_ =
+  preRewriteUrls =
     if urls != [ ] && url == "" then
       (
         if lib.isList urls then urls else throw "`urls` is not a list: ${lib.generators.toPretty { } urls}"
@@ -137,6 +138,12 @@ let
     else
       throw "fetchurl requires either `url` or `urls` to be set: ${lib.generators.toPretty { } args}";
 
+  urls_ =
+    let
+      u = lib.lists.filter (url: lib.isString url) (map rewriteURL preRewriteUrls);
+    in
+    if u == [ ] then throw "urls is empty after rewriteURL (was ${toString preRewriteUrls})" else u;
+
   hash_ =
     if
       with lib.lists;

pkgs/by-name/_0/_0xpropo/package.nix

@@ -23,12 +23,12 @@ stdenvNoCC.mkDerivation rec {
     runHook postInstall
   '';
 
-  meta = with lib; {
+  meta = {
     description = "Proportional version of the 0xProto font";
     homepage = "https://github.com/0xType/0xPropo";
     changelog = "https://github.com/0xType/0xPropo/releases/tag/${version}";
-    license = licenses.ofl;
-    maintainers = with maintainers; [ vinnymeller ];
-    platforms = platforms.all;
+    license = lib.licenses.ofl;
+    maintainers = with lib.maintainers; [ vinnymeller ];
+    platforms = lib.platforms.all;
   };
 }

pkgs/by-name/_1/_1oom/package.nix

@@ -6,36 +6,34 @@
   autoreconfHook,
   allegro,
   libsamplerate,
-  libGLU,
   libX11,
-  libXext,
-  SDL,
-  SDL_mixer,
   SDL2,
   SDL2_mixer,
   readline,
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "1oom";
-  version = "1.11.2";
+  version = "1.11.6";
 
   src = fetchFromGitHub {
     owner = "1oom-fork";
     repo = "1oom";
-    tag = "v${version}";
-    hash = "sha256-xvVl/XzOnItIvW0T3RpQ4tswqANHGWFvwnoY0+uHhx8=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-w67BjS5CrQviMXOeKNWGR1SzDeJHZrIpY7FDGt86CPA=";
   };
 
-  nativeBuildInputs = [ autoreconfHook ];
+  strictDeps = true;
+  enableParallelBuilding = true;
+
+  nativeBuildInputs = [
+    autoreconfHook
+    SDL2
+  ];
   buildInputs = [
     allegro
     libsamplerate
-    libGLU
     libX11
-    libXext
-    SDL
-    SDL_mixer
     SDL2
     SDL2_mixer
     readline
@@ -47,19 +45,19 @@ stdenv.mkDerivation rec {
   ];
 
   postInstall = ''
-    install -d $doc/share/doc/${pname}
-    install -t $doc/share/doc/${pname} \
+    install -d $doc/share/doc/1oom
+    install -t $doc/share/doc/1oom \
       HACKING NEWS PHILOSOPHY README.md doc/*.txt
   '';
 
-  passthru.updateScript = gitUpdater { rev-prefix = "f"; };
+  passthru.updateScript = gitUpdater { rev-prefix = "v"; };
 
-  meta = with lib; {
+  meta = {
     homepage = "https://github.com/1oom-fork/1oom";
-    changelog = "https://github.com/1oom-fork/1oom/releases/tag/v${version}";
+    changelog = "https://github.com/1oom-fork/1oom/releases/tag/v${finalAttrs.version}";
     description = "Master of Orion (1993) game engine recreation; a more updated fork";
-    license = licenses.gpl2Only;
-    platforms = platforms.linux;
-    maintainers = [ ];
+    license = lib.licenses.gpl2Only;
+    platforms = lib.platforms.linux;
+    maintainers = with lib.maintainers; [ marcin-serwin ];
   };
-}
+})

pkgs/by-name/_2/_2ship2harkinian/package.nix

@@ -199,7 +199,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   meta = {
     homepage = "https://github.com/HarbourMasters/2ship2harkinian";
-    description = "A PC port of Majora's Mask with modern controls, widescreen, high-resolution, and more";
+    description = "PC port of Majora's Mask with modern controls, widescreen, high-resolution, and more";
     mainProgram = "2s2h";
     platforms = [ "x86_64-linux" ];
     maintainers = with lib.maintainers; [ qubitnano ];

pkgs/by-name/_3/_3270font/package.nix

@@ -29,15 +29,15 @@ stdenvNoCC.mkDerivation rec {
     runHook postInstall
   '';
 
-  meta = with lib; {
+  meta = {
     description = "Monospaced font based on IBM 3270 terminals";
     homepage = "https://github.com/rbanffy/3270font";
     changelog = "https://github.com/rbanffy/3270font/blob/v${version}/CHANGELOG.md";
     license = [
-      licenses.bsd3
-      licenses.ofl
+      lib.licenses.bsd3
+      lib.licenses.ofl
     ];
-    maintainers = [ ];
-    platforms = platforms.all;
+    maintainers = with lib.maintainers; [ ];
+    platforms = lib.platforms.all;
   };
 }

pkgs/by-name/_6/_6tunnel/package.nix

@@ -18,13 +18,13 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [ autoreconfHook ];
 
-  meta = with lib; {
+  meta = {
     description = "Tunnelling for application that don't speak IPv6";
     mainProgram = "6tunnel";
     homepage = "https://github.com/wojtekka/6tunnel";
     changelog = "https://github.com/wojtekka/6tunnel/blob/${version}/ChangeLog";
-    license = licenses.gpl2Only;
-    maintainers = with maintainers; [ Br1ght0ne ];
-    platforms = platforms.unix;
+    license = lib.licenses.gpl2Only;
+    maintainers = with lib.maintainers; [ Br1ght0ne ];
+    platforms = lib.platforms.unix;
   };
 }

pkgs/by-name/a5/a52dec/package.nix

@@ -33,13 +33,13 @@ stdenv.mkDerivation rec {
   # but it's better to disable tests than loose ASLR on i686
   doCheck = !stdenv.hostPlatform.isi686;
 
-  meta = with lib; {
+  meta = {
     description = "ATSC A/52 stream decoder";
     homepage = "https://liba52.sourceforge.io/";
     changelog = "https://git.adelielinux.org/community/a52dec/-/blob/v${version}/ChangeLog?ref_type=tags";
-    license = licenses.gpl2Plus;
-    maintainers = with maintainers; [ wegank ];
+    license = lib.licenses.gpl2Plus;
+    maintainers = with lib.maintainers; [ wegank ];
     mainProgram = "a52dec";
-    platforms = platforms.unix;
+    platforms = lib.platforms.unix;
   };
 }

pkgs/by-name/ab/abaddon/package.nix

@@ -88,7 +88,7 @@ stdenv.mkDerivation rec {
   ];
 
   meta = with lib; {
-    description = "A discord client reimplementation, written in C++";
+    description = "Discord client reimplementation, written in C++";
     mainProgram = "abaddon";
     homepage = "https://github.com/uowuo/abaddon";
     license = licenses.gpl3Plus;

pkgs/by-name/ad/adios2/package.nix

@@ -132,7 +132,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   meta = {
     homepage = "https://adios2.readthedocs.io/en/latest/";
-    description = "The Adaptable Input/Output System version 2";
+    description = "Adaptable Input/Output System version 2";
     license = lib.licenses.asl20;
     platforms = lib.platforms.unix;
     maintainers = with lib.maintainers; [ qbisi ];

pkgs/by-name/ad/adw-gtk3/package.nix

@@ -5,40 +5,37 @@
   nix-update-script,
   meson,
   ninja,
-  sassc,
+  dart-sass,
 }:
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "adw-gtk3";
-  version = "5.10";
+  version = "6.2";
 
   src = fetchFromGitHub {
     owner = "lassekongo83";
     repo = "adw-gtk3";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-0OZk27b0kujzWtRX5uvelTMivL19g6sNB1IY6BsrO10=";
+    hash = "sha256-YYaqSEnIYHHkY4L3UhFBkR3DehoB6QADhSGOP/9NKx8=";
   };
 
   nativeBuildInputs = [
     meson
     ninja
-    sassc
+    dart-sass
   ];
 
-  postPatch = ''
-    chmod +x gtk/src/adw-gtk3-dark/gtk-3.0/install-dark-theme.sh
-    patchShebangs gtk/src/adw-gtk3-dark/gtk-3.0/install-dark-theme.sh
-  '';
-
-  passthru = {
-    updateScript = nix-update-script { };
-  };
+  passthru.updateScript = nix-update-script { };
 
   meta = {
-    description = "Theme from libadwaita ported to GTK-3";
+    description = "Unofficial GTK 3 port of libadwaita";
     homepage = "https://github.com/lassekongo83/adw-gtk3";
     license = lib.licenses.lgpl21Only;
     platforms = lib.platforms.unix;
-    maintainers = with lib.maintainers; [ ciferkey ];
+    maintainers = with lib.maintainers; [
+      ciferkey
+      Gliczy
+      normalcea
+    ];
   };
 })

pkgs/by-name/ae/aeacus/package.nix

@@ -25,13 +25,13 @@ buildGoModule rec {
   # Tests require network access
   doCheck = false;
 
-  meta = with lib; {
+  meta = {
     description = "Vulnerability remediation scoring system";
     homepage = "https://github.com/elysium-suite/aeacus";
     changelog = "https://github.com/elysium-suite/aeacus/releases/tag/v${version}";
-    license = licenses.gpl2Only;
-    maintainers = with maintainers; [ fab ];
+    license = lib.licenses.gpl2Only;
+    maintainers = with lib.maintainers; [ fab ];
     mainProgram = "aeacus";
-    platforms = platforms.linux;
+    platforms = lib.platforms.linux;
   };
 }

pkgs/by-name/ae/aerc/basename-temp-file-fixup.patch

@@ -0,0 +1,34 @@
+From 2bbe75fe0bc87ab4c1e16c5a18c6200224391629 Mon Sep 17 00:00:00 2001
+From: Nicole Patricia Mazzuca <nicole@streganil.no>
+Date: Fri, 9 May 2025 09:32:21 +0200
+Subject: [PATCH] open: fix opening text/html messages
+
+This fixes a bug introduced in 93bec0de8ed5ab3d6b1f01026fe2ef20fa154329:
+aerc started using `path.Base(<part>)`, which returns `"."` on an empty
+path, but still checked for `""` two lines later.
+
+On macOS, the result is that aerc attempts to open the directory:
+
+```
+open /var/folders/vn/hs0zvdsx3vq6svvry8s1bnym0000gn/T/aerc-4229266673: is a directory
+```
+
+Signed-off-by: Nicole Patricia Mazzuca <nicole@streganil.no>
+Acked-by: Robin Jarry <robin@jarry.cc>
+---
+ commands/msgview/open.go | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/commands/msgview/open.go b/commands/msgview/open.go
+index a6e43cb8da5fd49d2aa562d4c25ee2d597deefc3..7c770d4a90b771e3a18dfcb327f5e9306d5b5fa7 100644
+--- a/commands/msgview/open.go
++++ b/commands/msgview/open.go
+@@ -59,7 +59,7 @@ func (o Open) Execute(args []string) error {
+ 		}
+ 		filename := path.Base(part.FileName())
+ 		var tmpFile *os.File
+-		if filename == "" {
++		if filename == "." {
+ 			extension := ""
+ 			if exts, _ := mime.ExtensionsByType(mimeType); len(exts) > 0 {
+ 				extension = exts[0]

pkgs/by-name/ae/aerc/basename-temp-file.patch

@@ -0,0 +1,41 @@
+From 93bec0de8ed5ab3d6b1f01026fe2ef20fa154329 Mon Sep 17 00:00:00 2001
+From: Robin Jarry <robin@jarry.cc>
+Date: Wed, 9 Apr 2025 10:49:24 +0200
+Subject: [PATCH] open: only use part basename for temp file
+
+When an attachment part has a name such as "/tmp/55208186_AllDocs.pdf",
+aerc creates a temp folder and tries to store the file by blindly
+concatenating the path as follows:
+
+	/tmp/aerc-3444057757/tmp/55208186_AllDocs.pdf
+
+And when writing to this path, it gets a "No such file or directory"
+error because the intermediate "tmp" subfolder isn't created.
+
+Reported-by: Erik Colson <eco@ecocode.net>
+Signed-off-by: Robin Jarry <robin@jarry.cc>
+---
+ commands/msgview/open.go | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/commands/msgview/open.go b/commands/msgview/open.go
+index 4293b7e4892c137a7f3fbbe79245ffb6733b2671..a6e43cb8da5fd49d2aa562d4c25ee2d597deefc3 100644
+--- a/commands/msgview/open.go
++++ b/commands/msgview/open.go
+@@ -5,6 +5,7 @@ import (
+ 	"io"
+ 	"mime"
+ 	"os"
++	"path"
+ 	"path/filepath"
+ 
+ 	"git.sr.ht/~rjarry/aerc/app"
+@@ -56,7 +57,7 @@ func (o Open) Execute(args []string) error {
+ 			app.PushError(err.Error())
+ 			return
+ 		}
+-		filename := part.FileName()
++		filename := path.Base(part.FileName())
+ 		var tmpFile *os.File
+ 		if filename == "" {
+ 			extension := ""

pkgs/by-name/ae/aerc/package.nix

@@ -33,7 +33,14 @@ buildGoModule (finalAttrs: {
     python3Packages.wrapPython
   ];
 
-  patches = [ ./runtime-libexec.patch ];
+  patches = [
+    ./runtime-libexec.patch
+
+    # TODO remove these with the next release
+    # they resolve a path injection vulnerability when saving attachments (CVE-2025-49466)
+    ./basename-temp-file.patch
+    ./basename-temp-file-fixup.patch
+  ];
 
   postPatch = ''
     substituteAllInPlace config/aerc.conf

pkgs/by-name/ag/agebox/package.nix

@@ -22,12 +22,12 @@ buildGoModule rec {
     "-X main.Version=${version}"
   ];
 
-  meta = with lib; {
+  meta = {
     homepage = "https://github.com/slok/agebox";
     changelog = "https://github.com/slok/agebox/releases/tag/v${version}";
     description = "Age based repository file encryption gitops tool";
-    license = licenses.asl20;
-    maintainers = with maintainers; [ lesuisse ];
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ lesuisse ];
     mainProgram = "agebox";
   };
 }

pkgs/by-name/ag/agi/package.nix

@@ -68,14 +68,14 @@ stdenvNoCC.mkDerivation rec {
     ];
   });
 
-  meta = with lib; {
+  meta = {
     description = "Android GPU Inspector";
     homepage = "https://gpuinspector.dev";
     changelog = "https://github.com/google/agi/releases/tag/v${version}";
     platforms = [ "x86_64-linux" ];
-    license = licenses.asl20;
-    maintainers = with maintainers; [ kashw2 ];
-    sourceProvenance = with sourceTypes; [
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ kashw2 ];
+    sourceProvenance = with lib.sourceTypes; [
       binaryBytecode
       binaryNativeCode
     ];

pkgs/by-name/ah/aha/package.nix

@@ -19,7 +19,7 @@ stdenv.mkDerivation rec {
 
   enableParallelBuilding = true;
 
-  meta = with lib; {
+  meta = {
     description = "ANSI HTML Adapter";
     mainProgram = "aha";
     longDescription = ''
@@ -27,11 +27,11 @@ stdenv.mkDerivation rec {
     '';
     homepage = "https://github.com/theZiz/aha";
     changelog = "https://github.com/theZiz/aha/blob/${version}/CHANGELOG";
-    license = with licenses; [
+    license = with lib.licenses; [
       lgpl2Plus
       mpl11
     ];
-    maintainers = with maintainers; [ pSub ];
-    platforms = platforms.all;
+    maintainers = with lib.maintainers; [ pSub ];
+    platforms = lib.platforms.all;
   };
 }

pkgs/by-name/ai/air-formatter/package.nix

@@ -36,7 +36,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
   };
 
   meta = {
-    description = "An extremely fast R code formatter";
+    description = "Extremely fast R code formatter";
     homepage = "https://posit-dev.github.io/air";
     changelog = "https://github.com/posit-dev/air/blob/${finalAttrs.version}/CHANGELOG.md";
     license = lib.licenses.mit;

pkgs/by-name/al/alacritty/package.nix

@@ -23,6 +23,7 @@
   xdg-utils,
 
   nix-update-script,
+  withGraphics ? false,
 }:
 let
   rpathLibs =
@@ -44,17 +45,32 @@ let
 in
 rustPlatform.buildRustPackage rec {
   pname = "alacritty";
-  version = "0.15.1";
+  version = "0.15.1" + lib.optionalString withGraphics "-graphics";
 
-  src = fetchFromGitHub {
-    owner = "alacritty";
-    repo = "alacritty";
-    tag = "v${version}";
-    hash = "sha256-/yERMNfCFLPb1S17Y9OacVH8UobDIIZDhM2qPzf5Vds=";
-  };
+  src =
+    # by default we want the official package
+    if !withGraphics then
+      fetchFromGitHub {
+        owner = "alacritty";
+        repo = "alacritty";
+        tag = "v${version}";
+        hash = "sha256-/yERMNfCFLPb1S17Y9OacVH8UobDIIZDhM2qPzf5Vds=";
+      }
+    # optionally we want to build the sixels feature fork
+    else
+      fetchFromGitHub {
+        owner = "ayosec";
+        repo = "alacritty";
+        tag = "v${version}";
+        hash = "sha256-n8vO6Q4bzWLaOqg8YhZ+aLOtBBTQ9plKIEJHXq+hhnM=";
+      };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-uXwefUV1NAKqwwPIWj4Slkx0c5b+RfLR3caTb42fc4M=";
+  cargoHash =
+    if !withGraphics then
+      "sha256-uXwefUV1NAKqwwPIWj4Slkx0c5b+RfLR3caTb42fc4M="
+    else
+      "sha256-UtxZFqU974N+YcHoEHifBjNSyaVuMvuc1clTDgUPuoQ=";
 
   nativeBuildInputs = [
     cmake

pkgs/by-name/al/alpaca/package.nix

@@ -20,14 +20,14 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "alpaca";
-  version = "6.0.5";
+  version = "6.1.5";
   pyproject = false; # Built with meson
 
   src = fetchFromGitHub {
     owner = "Jeffser";
     repo = "Alpaca";
     tag = version;
-    hash = "sha256-faxqSUYqf3vRZYeuXAzv+n1inMVwl5KmnndABF77Sus=";
+    hash = "sha256-4QN88KOCtVFNoqAKpjW/MSvPJFsLoXZixiGN5JNRDvs=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/am/amphetype/package.nix

@@ -10,7 +10,7 @@
 let
   pname = "amphetype";
   version = "1.0.0";
-  description = "An advanced typing practice program";
+  description = "Advanced typing practice program";
 in
 python3Packages.buildPythonApplication {
   inherit pname version;

pkgs/by-name/an/animeko/package.nix

@@ -79,13 +79,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "animeko";
-  version = "4.10.1";
+  version = "4.11.1";
 
   src = fetchFromGitHub {
     owner = "open-ani";
     repo = "animeko";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-sFEq6tJfADH5x8+wdQ9T89awT7/Qx2RV5r+cND3J0iw=";
+    hash = "sha256-JLOwWJvBfwqvAfaFn5qr8lsHL7/u97qYjZsckBjAu6I=";
     fetchSubmodules = true;
   };
 
@@ -207,6 +207,8 @@ stdenv.mkDerivation (finalAttrs: {
     "libdca.so.0"
     "liba52-0.7.4.so"
     "libFLAC.so.12"
+    "libtheoradec.so.1"
+    "libtheoraenc.so.1"
   ];
 
   dontWrapQtApps = true;

pkgs/by-name/an/ansible-doctor/package.nix

@@ -53,12 +53,12 @@ python3.pkgs.buildPythonApplication rec {
     "ansibledoctor"
   ];
 
-  meta = with lib; {
+  meta = {
     description = "Annotation based documentation for your Ansible roles";
     mainProgram = "ansible-doctor";
     homepage = "https://github.com/thegeeklab/ansible-doctor";
     changelog = "https://github.com/thegeeklab/ansible-doctor/releases/tag/v${version}";
-    license = licenses.lgpl3Only;
-    maintainers = with maintainers; [ tboerger ];
+    license = lib.licenses.lgpl3Only;
+    maintainers = with lib.maintainers; [ tboerger ];
   };
 }

pkgs/by-name/an/ansible-language-server/package.nix

@@ -34,12 +34,12 @@ buildNpmPackage rec {
   npmPackFlags = [ "--ignore-scripts" ];
   passthru.updateScript = nix-update-script { };
 
-  meta = with lib; {
+  meta = {
     changelog = "https://github.com/ansible/ansible-language-server/releases/tag/v${version}";
     description = "Ansible Language Server";
     mainProgram = "ansible-language-server";
     homepage = "https://github.com/ansible/ansible-language-server";
-    license = licenses.mit;
-    maintainers = with maintainers; [ hexa ];
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ hexa ];
   };
 }

pkgs/by-name/ap/apache-orc/package.nix

@@ -72,7 +72,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   meta = {
     changelog = "https://github.com/apache/orc/releases/tag/v${finalAttrs.version}";
-    description = "The smallest, fastest columnar storage for Hadoop workloads";
+    description = "Smallest, fastest columnar storage for Hadoop workloads";
     homepage = "https://github.com/apache/orc/";
     license = lib.licenses.asl20;
     maintainers = with lib.maintainers; [ drupol ];

pkgs/by-name/ap/appflowy/package.nix

@@ -101,7 +101,7 @@ stdenvNoCC.mkDerivation (finalAttrs: {
   ];
 
   meta = with lib; {
-    description = "An open-source alternative to Notion";
+    description = "Open-source alternative to Notion";
     homepage = "https://www.appflowy.io/";
     sourceProvenance = with sourceTypes; [ binaryNativeCode ];
     license = licenses.agpl3Only;

pkgs/by-name/aq/aquamarine/package.nix

@@ -68,7 +68,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   meta = {
     changelog = "https://github.com/hyprwm/aquamarine/releases/tag/v${finalAttrs.version}";
-    description = "A very light linux rendering backend library";
+    description = "Very light linux rendering backend library";
     homepage = "https://github.com/hyprwm/aquamarine";
     license = lib.licenses.bsd3;
     teams = [ lib.teams.hyprland ];

pkgs/by-name/ar/ares-cli/package.nix

@@ -25,7 +25,7 @@ buildNpmPackage rec {
 
   meta = {
     homepage = "https://webostv.developer.lge.com/develop/tools/cli-introduction";
-    description = "A collection of commands used for creating, packaging, installing, and launching web apps for LG webOS TV.";
+    description = "Collection of commands used for creating, packaging, installing, and launching web apps for LG webOS TV";
     longDescription = ''
       webOS CLI (Command Line Interface) provides a collection of commands used for creating, packaging, installing,
       and launching web apps in the command line environment. The CLI allows you to develop and test your app without using

pkgs/by-name/ar/argo-rollouts/package.nix

@@ -6,16 +6,16 @@
 
 buildGoModule rec {
   pname = "argo-rollouts";
-  version = "1.8.2";
+  version = "1.8.3";
 
   src = fetchFromGitHub {
     owner = "argoproj";
     repo = "argo-rollouts";
     rev = "v${version}";
-    sha256 = "sha256-C2Ha3Sdq5IOHEc9S4jb4g6do6a4Gkm4E0BVFq5TnJDM=";
+    sha256 = "sha256-OCFbnBSFSXcbXHT48sS8REAt6CtNFPCNTIfKRBj19DM=";
   };
 
-  vendorHash = "sha256-1YtRc2xLP8QAIK+vO690zHb9tXCkR7na/zwwlIdAxgQ=";
+  vendorHash = "sha256-2zarm9ZvPJ5uwEYvYI60uaN5MONKE8gd+i6TPHdD3PU=";
 
   # Disable tests since some test fail because of missing test data
   doCheck = false;

pkgs/by-name/ar/arkenfox-userjs/package.nix

@@ -29,7 +29,7 @@ stdenvNoCC.mkDerivation (finalAttrs: {
   passthru.updateScript = nix-update-script { };
 
   meta = {
-    description = "A comprehensive user.js template for configuration and hardening";
+    description = "Comprehensive user.js template for configuration and hardening";
     homepage = "https://github.com/arkenfox/user.js";
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [

pkgs/by-name/as/astro-language-server/package.nix

@@ -65,7 +65,7 @@ stdenv.mkDerivation (finalAttrs: {
   '';
 
   meta = {
-    description = "The Astro language server";
+    description = "Astro language server";
     homepage = "https://github.com/withastro/language-tools";
     changelog = "https://github.com/withastro/language-tools/blob/@astrojs/language-server@${finalAttrs.version}/packages/language-server/CHANGELOG.md";
     license = lib.licenses.mit;

pkgs/by-name/at/atasm/package.nix

@@ -55,12 +55,12 @@ stdenv.mkDerivation rec {
     mv docs/* $out/share/doc/${pname}
   '';
 
-  meta = with lib; {
+  meta = {
     homepage = "https://github.com/CycoPH/atasm";
     description = "Commandline 6502 assembler compatible with Mac/65";
-    license = licenses.gpl2Plus;
+    license = lib.licenses.gpl2Plus;
     changelog = "https://github.com/CycoPH/atasm/releases/tag/V${version}";
-    maintainers = with maintainers; [ ];
-    platforms = with platforms; unix;
+    maintainers = with lib.maintainers; [ ];
+    platforms = with lib.platforms; unix;
   };
 }

pkgs/by-name/at/atftp/package.nix

@@ -48,12 +48,12 @@ stdenv.mkDerivation rec {
 
   doCheck = true;
 
-  meta = with lib; {
+  meta = {
     description = "Advanced tftp tools";
     changelog = "https://sourceforge.net/p/atftp/code/ci/v${version}/tree/Changelog";
     homepage = "https://sourceforge.net/projects/atftp/";
-    license = licenses.gpl2Plus;
-    maintainers = with maintainers; [ raskin ];
-    platforms = platforms.linux;
+    license = lib.licenses.gpl2Plus;
+    maintainers = with lib.maintainers; [ raskin ];
+    platforms = lib.platforms.linux;
   };
 }

pkgs/by-name/at/athens/package.nix

@@ -35,16 +35,16 @@ buildGoModule (finalAttrs: {
     tests.version = testers.testVersion { package = athens; };
   };
 
-  meta = with lib; {
+  meta = {
     description = "Go module datastore and proxy";
     homepage = "https://github.com/gomods/athens";
-    changelog = "https://github.com/gomods/athens/releases/tag/v${version}";
-    license = licenses.mit;
+    changelog = "https://github.com/gomods/athens/releases/tag/v${finalAttrs.version}";
+    license = lib.licenses.mit;
     mainProgram = "athens";
-    maintainers = with maintainers; [
+    maintainers = with lib.maintainers; [
       katexochen
       malt3
     ];
-    platforms = platforms.unix;
+    platforms = lib.platforms.unix;
   };
 })

pkgs/by-name/at/atomic-swap/package.nix

@@ -40,12 +40,12 @@ buildGoModule {
 
   passthru.updateScript = nix-update-script { };
 
-  meta = with lib; {
+  meta = {
     homepage = "https://github.com/AthanorLabs/atomic-swap";
     changelog = "https://github.com/AthanorLabs/atomic-swap/releases/tag/v${version}";
     description = "ETH-XMR atomic swap implementation";
-    license = with licenses; [ lgpl3Only ];
-    maintainers = with maintainers; [
+    license = with lib.licenses; [ lgpl3Only ];
+    maintainers = with lib.maintainers; [
       happysalada
       lord-valen
     ];

pkgs/by-name/at/attic-client/package.nix

@@ -17,13 +17,13 @@ let
 in
 rustPlatform.buildRustPackage {
   pname = "attic";
-  version = "0-unstable-2025-02-02";
+  version = "0-unstable-2025-05-29";
 
   src = fetchFromGitHub {
     owner = "zhaofengli";
     repo = "attic";
-    rev = "ff8a897d1f4408ebbf4d45fa9049c06b3e1e3f4e";
-    hash = "sha256-hPYEJ4juK3ph7kbjbvv7PlU1D9pAkkhl+pwx8fZY53U=";
+    rev = "ce9373715fe3fac7a174a65a7e6d6baeba8cb4f9";
+    hash = "sha256-CvaKOUq8G10sghKpZhEB2UYjJoWhEkrDFggDgi7piUI=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/au/audiness/package.nix

@@ -31,12 +31,12 @@ python3.pkgs.buildPythonApplication rec {
 
   pythonImportsCheck = [ "audiness" ];
 
-  meta = with lib; {
+  meta = {
     description = "CLI tool to interact with Nessus";
     homepage = "https://github.com/audiusGmbH/audiness";
     changelog = "https://github.com/audiusGmbH/audiness/releases/tag/${version}";
-    license = licenses.mit;
-    maintainers = with maintainers; [ fab ];
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ fab ];
     mainProgram = "audiness";
   };
 }

pkgs/by-name/au/audion/package.nix

@@ -18,12 +18,12 @@ rustPlatform.buildRustPackage rec {
   useFetchCargoVendor = true;
   cargoHash = "sha256-kIrbHt6aAUgdF4Jx/aUOYpiBj1+pyFLCVak6R+JN2Ug=";
 
-  meta = with lib; {
+  meta = {
     description = "Ping the host continuously and write results to a file";
     homepage = "https://github.com/audiusGmbH/audion";
     changelog = "https://github.com/audiusGmbH/audion/releases/tag/${version}";
-    license = licenses.mit;
-    maintainers = with maintainers; [ fab ];
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ fab ];
     mainProgram = "audion";
   };
 }

pkgs/by-name/au/audiowaveform/package.nix

@@ -47,7 +47,7 @@ stdenv.mkDerivation rec {
   # One test is failing, see PR #101947
   doCheck = false;
 
-  meta = with lib; {
+  meta = {
     description = "C++ program to generate waveform data and render waveform images from audio files";
     longDescription = ''
       audiowaveform is a C++ command-line application that generates waveform data from either MP3, WAV, FLAC, or Ogg Vorbis format audio files.
@@ -55,9 +55,9 @@ stdenv.mkDerivation rec {
     '';
     homepage = "https://github.com/bbc/audiowaveform";
     changelog = "https://github.com/bbc/audiowaveform/blob/${version}/ChangeLog";
-    license = licenses.gpl3Plus;
-    platforms = platforms.all;
-    maintainers = with maintainers; [ edbentley ];
+    license = lib.licenses.gpl3Plus;
+    platforms = lib.platforms.all;
+    maintainers = with lib.maintainers; [ edbentley ];
     mainProgram = "audiowaveform";
   };
 }

pkgs/by-name/au/augeas/package.nix

@@ -62,13 +62,13 @@ stdenv.mkDerivation rec {
     "dev"
   ];
 
-  meta = with lib; {
+  meta = {
     description = "Configuration editing tool";
-    license = licenses.lgpl21Only;
+    license = lib.licenses.lgpl21Only;
     homepage = "https://augeas.net/";
     changelog = "https://github.com/hercules-team/augeas/releases/tag/release-${version}";
     mainProgram = "augtool";
-    maintainers = with maintainers; [ offline ];
-    platforms = platforms.unix;
+    maintainers = with lib.maintainers; [ offline ];
+    platforms = lib.platforms.unix;
   };
 }