Merge master into staging-next

.github/labeler-no-sync.yml

@@ -7,6 +7,39 @@
       - any-glob-to-any-file:
         - .github/workflows/*
         - ci/**/*.*
+  - all:
+    - head-branch:
+      # r-ryantm's branches have this prefix.
+      - ^auto-update/
+    - changed-files:
+      - any-glob-to-any-file:
+        # Browser updates should always be backported.
+        - pkgs/applications/kde/angelfish.nix
+        - pkgs/applications/kde/falkon.nix
+        - pkgs/applications/kde/konqueror.nix
+        - pkgs/applications/networking/browsers/**/*
+        - pkgs/by-name/br/brave/**/*
+        # Added in December 2024, uncomment for 25.05
+        # - pkgs/by-name/ca/catalyst-browser/**/*
+        - pkgs/by-name/ch/chawan/**/*
+        - pkgs/by-name/di/dillo-plus/**/*
+        - pkgs/by-name/di/dillo/**/*
+        - pkgs/by-name/ed/edbrowse/**/*
+        - pkgs/by-name/ep/epiphany/**/*
+        - pkgs/by-name/go/google-chrome/**/*
+        - pkgs/by-name/ly/lynx/**/*
+        - pkgs/by-name/mi/microsoft-edge/**/*
+        - pkgs/by-name/mi/midori-unwrapped/**/*
+        - pkgs/by-name/mu/mullvad-browser/**/*
+        - pkgs/by-name/op/opera/**/*
+        - pkgs/by-name/to/tor-browser/**/*
+        - pkgs/by-name/vi/vimb-unwrapped/**/*
+        - pkgs/by-name/w3/w3m/**/*
+        - pkgs/desktops/lomiri/applications/morph-browser/**/*
+        - pkgs/development/libraries/webkitgtk/**/*
+        - pkgs/kde/gear/angelfish/**/*
+        - pkgs/kde/gear/falkon/**/*
+        - pkgs/kde/gear/konqueror/**/*
 
 "6.topic: policy discussion":
   - any:

doc/release-notes/rl-2505.section.md

@@ -348,7 +348,7 @@
   [Prisma ORM upgrade guide](https://www.prisma.io/docs/orm/more/upgrade-guides/upgrading-versions/upgrading-to-prisma-6)
   for more information.
 
-- `depdendency-track` no longer bundes the UI inside the jar. This bundling
+- `dependency-track` no longer bundes the UI inside the jar. This bundling
   functionality is deprecated by upstream and causes UI assets not being served
   after weeks of runtime.
 

lib/meta.nix

@@ -289,7 +289,8 @@ rec {
   */
   availableOn =
     platform: pkg:
-    ((!pkg ? meta.platforms) || any (platformMatch platform) pkg.meta.platforms)
+    pkg != null
+    && ((!pkg ? meta.platforms) || any (platformMatch platform) pkg.meta.platforms)
     && all (elem: !platformMatch platform elem) (pkg.meta.badPlatforms or [ ]);
 
   /**

nixos/doc/manual/configuration/luks-file-systems.section.md

@@ -117,7 +117,7 @@ added to the LUKS volume.
 ```
 
 Existing key slots are left intact, unless `--wipe-slot=` is specified. It is
-recommened to add a recovery key that should be stored in a secure physical
+recommended to add a recovery key that should be stored in a secure physical
 location and can be entered wherever a password would be entered.
 
 ```ShellSession

nixos/doc/manual/development/settings-options.section.md

@@ -412,7 +412,7 @@ have a predefined type and string generator already declared under
 
     `multiline` (default `true`)
 
-    :   Whether to procude a multiline output. The output may still wrap across
+    :   Whether to produce a multiline output. The output may still wrap across
         multiple lines if it would otherwise exceed `columnWidth`.
 
     `columnWidth` (default `100`)

nixos/doc/manual/release-notes/rl-2505.section.md

@@ -114,7 +114,7 @@
 
 - [PostgREST](https://postgrest.org), a standalone web server that turns your PostgreSQL database directly into a RESTful API. Available as [services.postgrest](options.html#opt-services.postgrest.enable).
 
-- [postgres-websockets](https://github.com/diogob/postgres-websockets), a middleware that adds websockets capabilites on top of PostgreSQL's asynchronous notifications using LISTEN and NOTIFY commands. Available as [services.postgres-websockets](options.html#opt-services.postgres-websockets.enable).
+- [postgres-websockets](https://github.com/diogob/postgres-websockets), a middleware that adds websockets capabilities on top of PostgreSQL's asynchronous notifications using LISTEN and NOTIFY commands. Available as [services.postgres-websockets](options.html#opt-services.postgres-websockets.enable).
 
 - [µStreamer](https://github.com/pikvm/ustreamer), a lightweight MJPEG-HTTP streamer. Available as [services.ustreamer](options.html#opt-services.ustreamer).
 
@@ -184,7 +184,7 @@
 
 - [nvidia-gpu](https://github.com/utkuozdemir/nvidia_gpu_exporter), a Prometheus exporter that scrapes `nvidia-smi` for GPU metrics. Available as [services.prometheus.exporters.nvidia-gpu](#opt-services.prometheus.exporters.nvidia-gpu.enable).
 
-- [Lavalink](https://github.com/lavalink-devs/Lavalink), a standalone audio sending node based on Lavaplayer and Koe. Availble as [services.lavalink](#opt-services.lavalink.enable).
+- [Lavalink](https://github.com/lavalink-devs/Lavalink), a standalone audio sending node based on Lavaplayer and Koe. Available as [services.lavalink](#opt-services.lavalink.enable).
 
 - [OpenGamepadUI](https://github.com/ShadowBlip/OpenGamepadUI/), an open source gamepad-native game launcher and overlay for Linux. Available as [programs.opengamepadui](#opt-programs.opengamepadui.enable).
 
@@ -401,7 +401,7 @@
   +extraCreateArgs+=("--exclude" "/some/path")
   ```
 
-- `programs.xonsh.package` now gets overrided internally with `extraPackages` to support `programs.xonsh.extraPackages`. See `programs.xonsh.extraPackages` for more details.
+- `programs.xonsh.package` now gets overridden internally with `extraPackages` to support `programs.xonsh.extraPackages`. See `programs.xonsh.extraPackages` for more details.
 
 - `services.nitter.guestAccounts` has been renamed to `services.nitter.sessionsFile`, for consistency with upstream. The file format is unchanged.
 

nixos/modules/services/backup/borgbackup.md

@@ -105,7 +105,7 @@ The following few commands (run as root) let you test your backup.
 > systemctl restart borgbackup-job-backupToLocalServer
 > sleep 10
 > systemctl restart borgbackup-job-backupToLocalServer
-> export BORG_PASSPHRASE=topSecrect
+> export BORG_PASSPHRASE=topSecret
 > borg list --rsh='ssh -i /run/keys/id_ed25519_my_borg_repo' borg@nixos:.
 nixos-backupToLocalServer-2020-03-30T21:46:17 Mon, 2020-03-30 21:46:19 [84feb97710954931ca384182f5f3cb90665f35cef214760abd7350fb064786ac]
 nixos-backupToLocalServer-2020-03-30T21:46:30 Mon, 2020-03-30 21:46:32 [e77321694ecd160ca2228611747c6ad1be177d6e0d894538898de7a2621b6e68]

nixos/modules/virtualisation/oci-containers.nix

@@ -434,6 +434,7 @@ let
       };
 
       effectiveUser = container.podman.user or "root";
+      inherit (config.users.users.${effectiveUser}) uid;
       dependOnLingerService =
         cfg.backend == "podman" && effectiveUser != "root" && config.users.users.${effectiveUser}.linger;
     in
@@ -441,7 +442,7 @@ let
       wantedBy = [ ] ++ optional (container.autoStart) "multi-user.target";
       wants =
         lib.optional (container.imageFile == null && container.imageStream == null) "network-online.target"
-        ++ lib.optional dependOnLingerService "linger-users.service";
+        ++ lib.optionals dependOnLingerService [ "linger-users.service" ];
       after =
         lib.optionals (cfg.backend == "docker") [
           "docker.service"
@@ -452,8 +453,15 @@ let
           "network-online.target"
         ]
         ++ dependsOn
-        ++ lib.optional dependOnLingerService "linger-users.service";
-      requires = dependsOn;
+        ++ lib.optionals dependOnLingerService [ "linger-users.service" ]
+        ++ lib.optionals (effectiveUser != "root" && container.podman.sdnotify == "healthy") [
+          "user@${toString uid}.service"
+        ];
+      requires =
+        dependsOn
+        ++ lib.optionals (effectiveUser != "root" && container.podman.sdnotify == "healthy") [
+          "user@${toString uid}.service"
+        ];
       environment = lib.mkMerge [
         proxy_env
         (mkIf (cfg.backend == "podman" && container.podman.user != "root") {
@@ -523,6 +531,10 @@ let
         else
           "${cfg.backend} rm -f ${name} || true";
 
+      unitConfig = mkIf (effectiveUser != "root") {
+        RequiresMountsFor = "/run/user/${toString uid}/containers";
+      };
+
       serviceConfig =
         {
           ### There is no generalized way of supporting `reload` for docker
@@ -616,6 +628,15 @@ in
                   assertion = cfg.backend == "docker" -> podman == null;
                   message = "virtualisation.oci-containers.containers.${name}: Cannot set `podman` option if backend is `docker`.";
                 }
+                {
+                  assertion =
+                    cfg.backend == "podman" && podman.sdnotify == "healthy" && podman.user != "root"
+                    -> config.users.users.${podman.user}.uid != null;
+                  message = ''
+                    Rootless container ${name} (with podman and sdnotify=healthy)
+                    requires that its running user ${podman.user} has a statically specified uid.
+                  '';
+                }
               ];
           in
           concatMap (name: toAssertions name cfg.containers.${name}) (lib.attrNames cfg.containers);

nixos/tests/oci-containers.nix

@@ -80,6 +80,7 @@ let
               home = "/var/lib/redis";
               linger = type == "healthy";
               createHome = true;
+              uid = 2342;
               subUidRanges = [
                 {
                   count = 65536;

pkgs/applications/editors/vim/plugins/generated.nix

@@ -6548,6 +6548,19 @@ final: prev: {
     meta.hydraPlatforms = [ ];
   };
 
+  kanagawa-paper-nvim = buildVimPlugin {
+    pname = "kanagawa-paper.nvim";
+    version = "2025-04-27";
+    src = fetchFromGitHub {
+      owner = "thesimonho";
+      repo = "kanagawa-paper.nvim";
+      rev = "4f41353f6a2bf9f25b2466a0f1eb6883d8fd09c1";
+      sha256 = "0gan0jqn4azkqln5xsnffpyjqmzqv1wwv02xv2d0yykmlqk9yqc8";
+    };
+    meta.homepage = "https://github.com/thesimonho/kanagawa-paper.nvim/";
+    meta.hydraPlatforms = [ ];
+  };
+
   kdl-vim = buildVimPlugin {
     pname = "kdl.vim";
     version = "2023-02-20";
@@ -11453,6 +11466,19 @@ final: prev: {
     meta.hydraPlatforms = [ ];
   };
 
+  oil-git-status-nvim = buildVimPlugin {
+    pname = "oil-git-status.nvim";
+    version = "2025-04-03";
+    src = fetchFromGitHub {
+      owner = "refractalize";
+      repo = "oil-git-status.nvim";
+      rev = "4b5cf53842c17a09420919e655a6a559da3112d7";
+      sha256 = "1jzw6lkvi9xxzqy8xz056xlb45byr1arklh87zmyf0nj9plm2nsp";
+    };
+    meta.homepage = "https://github.com/refractalize/oil-git-status.nvim/";
+    meta.hydraPlatforms = [ ];
+  };
+
   ollama-nvim = buildVimPlugin {
     pname = "ollama.nvim";
     version = "2024-06-09";

pkgs/applications/editors/vim/plugins/overrides.nix

@@ -1457,6 +1457,14 @@ in
     passthru.python3Dependencies = ps: [ ps.jupytext ];
   };
 
+  kanagawa-paper-nvim = super.kanagawa-paper-nvim.overrideAttrs {
+    nvimSkipModules = [
+      # skipping wezterm theme switcher since it relies on a wezterm module
+      # that does not seem to be available, tried to build setting wezterm-nvim as a dep
+      "wezterm.theme_switcher"
+    ];
+  };
+
   kulala-nvim = super.kulala-nvim.overrideAttrs {
     dependencies = with self; [
       nvim-treesitter
@@ -2623,6 +2631,10 @@ in
     ];
   };
 
+  oil-git-status-nvim = super.oil-git-status-nvim.overrideAttrs {
+    dependencies = [ self.oil-nvim ];
+  };
+
   ollama-nvim = super.ollama-nvim.overrideAttrs {
     dependencies = [ self.plenary-nvim ];
   };

pkgs/applications/editors/vim/plugins/vim-plugin-names

@@ -501,6 +501,7 @@ https://github.com/julelang/jule.nvim/,HEAD,
 https://github.com/julelang/jule.nvim/,HEAD,
 https://github.com/JuliaEditorSupport/julia-vim/,,
 https://github.com/GCBallesteros/jupytext.nvim/,HEAD,
+https://github.com/thesimonho/kanagawa-paper.nvim/,HEAD,
 https://github.com/rebelot/kanagawa.nvim/,,
 https://github.com/imsnif/kdl.vim/,HEAD,
 https://github.com/anuvyklack/keymap-layer.nvim/,HEAD,
@@ -879,6 +880,7 @@ https://github.com/obsidian-nvim/obsidian.nvim/,HEAD,
 https://github.com/nvimdev/oceanic-material/,,
 https://github.com/mhartington/oceanic-next/,,
 https://github.com/pwntester/octo.nvim/,,
+https://github.com/refractalize/oil-git-status.nvim/,HEAD,
 https://github.com/nomnivore/ollama.nvim/,HEAD,
 https://github.com/yonlu/omni.vim/,,
 https://github.com/Hoffs/omnisharp-extended-lsp.nvim/,HEAD,

pkgs/by-name/al/all-the-package-names/package.nix

@@ -7,16 +7,16 @@
 
 buildNpmPackage rec {
   pname = "all-the-package-names";
-  version = "2.0.2137";
+  version = "2.0.2146";
 
   src = fetchFromGitHub {
     owner = "nice-registry";
     repo = "all-the-package-names";
     tag = "v${version}";
-    hash = "sha256-1HabSjZUHjPWkKZc+Xeh11bzb6ycQ1V7GS/XGycFoKc=";
+    hash = "sha256-mPPlBXhnDYTQPATw1Ulb/bk44Q5Q+hUA9tGcxCj0i3w=";
   };
 
-  npmDepsHash = "sha256-zSGpKDcmBYod81wCeoSzOqse1zSao4aURngh55wq6CA=";
+  npmDepsHash = "sha256-yNG6rQRbXRDtmCm2KNZLZ1/ein+QA7/0CjAVIMVp2PI=";
 
   passthru.updateScript = nix-update-script { };
 

pkgs/by-name/an/anytype-heart/package.nix

@@ -11,12 +11,12 @@
 
 let
   pname = "anytype-heart";
-  version = "0.39.11";
+  version = "0.40.19";
   src = fetchFromGitHub {
     owner = "anyproto";
     repo = "anytype-heart";
     tag = "v${version}";
-    hash = "sha256-+H63bc4aJPERfclzKh4E3uYEEwNycLfe0BCPSlilqCc=";
+    hash = "sha256-BUQZmZ7jKWdbBcWtx7rbbeEJbo5FncYHmp/5FVd0vdI=";
   };
 
   arch =
@@ -34,7 +34,7 @@ in
 buildGoModule {
   inherit pname version src;
 
-  vendorHash = "sha256-fbZ1DiRcD9dnS8e7BMrKPYApqZmQbaH6DsSSO1knDmo=";
+  vendorHash = "sha256-xsxgeoS1wIi0/LNGmZZyWKWzhkMJUnCEslXcIz+Dw8U=";
 
   subPackages = [ "cmd/grpcserver" ];
   tags = [

pkgs/by-name/an/anytype/0001-feat-update-Disable-auto-checking-for-updates-and-updating-manually.patch

@@ -0,0 +1,37 @@
+From d236396b1da80a7233168e01e8164256e7f69cc1 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?David=20Chocholat=C3=BD?= <chocholaty.david@protonmail.com>
+Date: Fri, 25 Apr 2025 12:29:37 +0200
+Subject: [PATCH] feat(update): Disable auto checking for updates and updating
+ manually
+
+---
+ electron/js/update.js | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+diff --git a/electron/js/update.js b/electron/js/update.js
+index 0e34efa..9386c90 100644
+--- a/electron/js/update.js
++++ b/electron/js/update.js
+@@ -29,7 +29,8 @@ class UpdateManager {
+ 		autoUpdater.autoInstallOnAppQuit = false;
+ 		autoUpdater.channel = channel;
+ 
+-		this.setTimeout();
++		// PATCH(update): Never check for updates on a timer timeout.
++		// this.setTimeout();
+ 
+ 		autoUpdater.on('checking-for-update', () => {
+ 			Util.log('info', 'Checking for update');
+@@ -93,6 +94,9 @@ class UpdateManager {
+ 	};
+ 
+ 	isAllowed () {
++		// PATCH(update): Always disallow update check, even when requested by the user manually or when Anytype starts.
++		return false;
++
+ 		const { config } = ConfigManager;
+ 
+ 		if (config.updateDisabled) {
+-- 
+2.49.0
+

pkgs/by-name/an/anytype/package.nix

@@ -13,27 +13,27 @@
 
 let
   pname = "anytype";
-  version = "0.45.3";
+  version = "0.46.4";
 
   src = fetchFromGitHub {
     owner = "anyproto";
     repo = "anytype-ts";
     tag = "v${version}";
-    hash = "sha256-fwfxmNca75xAAHKeT2nddz+XZexDomzHbw188LXxZqA=";
+    hash = "sha256-JA8DHOPRLPoc8/GXkHfktVy3sZ5BpSFmgn71Xt15iLE=";
   };
   description = "P2P note-taking tool";
 
   locales = fetchFromGitHub {
     owner = "anyproto";
     repo = "l10n-anytype-ts";
-    rev = "687106c4e37297f86fab79f77ef83599b61ab65c";
-    hash = "sha256-Y0irD0jzqYobnjtD2M1+hTDRUUYnuygUx9+tE1gUoTw=";
+    rev = "07eed415b0eec409dcdfedf848936d41f190c7ec";
+    hash = "sha256-PgDZkL/tg7/uZhLLenRjkb5NB1hQjUJflaAce2TlDRE=";
   };
 in
 buildNpmPackage {
   inherit pname version src;
 
-  npmDepsHash = "sha256-9BI+rXzTYonlMhcH8uiWyyF18JGv8GL1U9hZ9Z6X3As=";
+  npmDepsHash = "sha256-4pMYKmQ7+f8BKztLF4Jfe89tuh+DiQNnS3ulL0i6Gw0=";
 
   env = {
     ELECTRON_SKIP_BINARY_DOWNLOAD = "1";
@@ -50,6 +50,10 @@ buildNpmPackage {
     "--nodedir=${electron.headers}"
   ];
 
+  patches = [
+    ./0001-feat-update-Disable-auto-checking-for-updates-and-updating-manually.patch
+  ];
+
   buildPhase = ''
     runHook preBuild
 

pkgs/by-name/en/encrypted-dns-server/package.nix

@@ -9,16 +9,16 @@
 }:
 rustPlatform.buildRustPackage rec {
   pname = "encrypted-dns-server";
-  version = "0.9.16";
+  version = "0.9.17";
 
   src = fetchFromGitHub {
     owner = "DNSCrypt";
     repo = "encrypted-dns-server";
     tag = version;
-    hash = "sha256-llBMOqmxEcysoBsRg5s1uqCyR6+ilTgBI7BaeSDVoEw=";
+    hash = "sha256-un7607HQ7s7G2GPTmYVT3wK/ePLNVyV+A2mtKt0YGsw=";
   };
 
-  cargoHash = "sha256-33XcfiktgDG34aamw8X3y0QkybVENUJxLhx47WZUpFc=";
+  cargoHash = "sha256-qhY1LgtV0Kmj/at9EG7Y+swN1Oy0/SzRCr7U8xVh8KA=";
 
   nativeBuildInputs = [ pkg-config ];
 

pkgs/by-name/en/enter-tex/package.nix

@@ -1,7 +1,7 @@
 {
   stdenv,
   lib,
-  fetchurl,
+  fetchFromGitLab,
   desktop-file-utils,
   docbook-xsl-nons,
   gettext,
@@ -21,16 +21,20 @@
   libgedit-gtksourceview,
   libgedit-tepl,
   libgee,
-  gnome,
+  gitUpdater,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "enter-tex";
-  version = "3.47.0";
+  version = "3.48.0";
 
-  src = fetchurl {
-    url = "mirror://gnome/sources/enter-tex/${lib.versions.majorMinor finalAttrs.version}/enter-tex-${finalAttrs.version}.tar.xz";
-    hash = "sha256-oIyuySdcCruVNWdN9bnBa5KxSWjNIZFtb/wvoMud12o=";
+  src = fetchFromGitLab {
+    domain = "gitlab.gnome.org";
+    group = "World";
+    owner = "gedit";
+    repo = "enter-tex";
+    tag = finalAttrs.version;
+    hash = "sha256-OnkP4E1kNWuE9k7SQ/ujnxnFgVyAqIhqHAw04ZA0Tno=";
   };
 
   nativeBuildInputs = [
@@ -60,18 +64,16 @@ stdenv.mkDerivation (finalAttrs: {
 
   preBuild = ''
     # Workaround the use case of C code mixed with Vala code.
-    # https://gitlab.gnome.org/swilmet/enter-tex/-/blob/3.47.0/docs/more-information.md#install-procedure
+    # https://gitlab.gnome.org/World/gedit/enter-tex/-/blob/3.48.0/docs/more-information.md#install-procedure
     ninja src/gtex/Gtex-1.gir
   '';
 
   doCheck = true;
 
-  passthru.updateScript = gnome.updateScript {
-    packageName = "enter-tex";
-  };
+  passthru.updateScript = gitUpdater { };
 
   meta = with lib; {
-    homepage = "https://gitlab.gnome.org/swilmet/enter-tex";
+    homepage = "https://gitlab.gnome.org/World/gedit/enter-tex";
     description = "LaTeX editor for the GNOME desktop";
     maintainers = with maintainers; [
       manveru

pkgs/by-name/ge/gedit/package.nix

@@ -3,8 +3,7 @@
   lib,
   meson,
   mesonEmulatorHook,
-  fetchurl,
-  python3,
+  fetchFromGitLab,
   pkg-config,
   gtk3,
   gtk-mac-integration,
@@ -20,7 +19,7 @@
   gobject-introspection,
   docbook-xsl-nons,
   ninja,
-  gnome,
+  gitUpdater,
   gspell,
   itstool,
   desktop-file-utils,
@@ -29,16 +28,21 @@
 
 stdenv.mkDerivation rec {
   pname = "gedit";
-  version = "48.1";
+  version = "48.2";
 
   outputs = [
     "out"
     "devdoc"
   ];
 
-  src = fetchurl {
-    url = "mirror://gnome/sources/gedit/${lib.versions.major version}/gedit-${version}.tar.xz";
-    hash = "sha256-lx56wmvAo6Pe0np1Y3ckFWh9sOWgkrRUflsQpVhYswo=";
+  src = fetchFromGitLab {
+    domain = "gitlab.gnome.org";
+    group = "World";
+    owner = "gedit";
+    repo = "gedit";
+    tag = version;
+    fetchSubmodules = true;
+    hash = "sha256-M8ZyjY4wSogEjhEx9sOKfuGkbiypDmZoU0H4ja+TgaY=";
   };
 
   patches = [
@@ -55,7 +59,6 @@ stdenv.mkDerivation rec {
       meson
       ninja
       pkg-config
-      python3
       vala
       wrapGAppsHook3
       gtk-doc
@@ -81,19 +84,10 @@ stdenv.mkDerivation rec {
       gtk-mac-integration
     ];
 
-  postPatch = ''
-    chmod +x build-aux/meson/post_install.py
-    patchShebangs build-aux/meson/post_install.py
-  '';
-
   # Reliably fails to generate gedit-file-browser-enum-types.h in time
   enableParallelBuilding = false;
 
-  passthru = {
-    updateScript = gnome.updateScript {
-      packageName = "gedit";
-    };
-  };
+  passthru.updateScript = gitUpdater { };
 
   meta = with lib; {
     homepage = "https://gitlab.gnome.org/World/gedit/gedit";

pkgs/by-name/gh/ghostunnel/package.nix

@@ -4,6 +4,8 @@
   fetchFromGitHub,
   lib,
   nixosTests,
+  apple-sdk_12,
+  darwinMinVersionHook,
 }:
 
 buildGoModule rec {
@@ -17,16 +19,20 @@ buildGoModule rec {
     hash = "sha256-NnRm1HEdfK6WI5ntilLSwdR2B5czG5CIcMFzl2TzEds=";
   };
 
-  vendorHash = null;
+  vendorHash = "sha256-vP8OtjpYNMm1KkNfD3pmNrHh3HRy1GkzUbfLKWKhHbo=";
 
   deleteVendor = true;
 
-  # The certstore directory isn't recognized as a subpackage, but is when moved
-  # into the vendor directory.
-  postUnpack = ''
-    mkdir -p $sourceRoot/vendor/ghostunnel
-    mv $sourceRoot/certstore $sourceRoot/vendor/ghostunnel/
-  '';
+  buildInputs = lib.optionals stdenv.hostPlatform.isDarwin [
+    apple-sdk_12
+    (darwinMinVersionHook "12.0")
+  ];
+
+  # These tests don't exist for Linux, and on Darwin they attempt to use the macOS Keychain
+  # which doesn't work from a nix build. Presumably other platform implementations of the
+  # certstore would have similar issues, so it probably makes sense to skip them in
+  # general wherever they are available.
+  checkFlags = [ "-skip=^Test(ImportDelete|Signer|Certificate)(RSA|ECDSA|EC)$" ];
 
   passthru.tests = {
     nixos = nixosTests.ghostunnel;
@@ -34,12 +40,14 @@ buildGoModule rec {
   };
 
   meta = with lib; {
-    broken = stdenv.hostPlatform.isDarwin;
     description = "TLS proxy with mutual authentication support for securing non-TLS backend applications";
     homepage = "https://github.com/ghostunnel/ghostunnel#readme";
     changelog = "https://github.com/ghostunnel/ghostunnel/releases/tag/v${version}";
     license = licenses.asl20;
-    maintainers = with maintainers; [ roberth ];
+    maintainers = with maintainers; [
+      roberth
+      mjm
+    ];
     mainProgram = "ghostunnel";
   };
 }

pkgs/by-name/go/golden-cheetah/package.nix

@@ -26,13 +26,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "golden-cheetah";
-  version = "3.7-DEV2408";
+  version = "3.7";
 
   src = fetchFromGitHub {
     owner = "GoldenCheetah";
     repo = "GoldenCheetah";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-6JAdnYaKULJsc/zdcTMbCkbOCbiVtnJivEazDKL721c=";
+    hash = "sha256-INlkFWugIoln7wrmgLZUC/Ye8eV+mlT6BZ0ZdP7CiqE=";
   };
 
   buildInputs =

pkgs/by-name/hc/hcxdumptool/package.nix

@@ -1,31 +1,35 @@
 {
-  stdenv,
   lib,
+  stdenv,
   fetchFromGitHub,
   openssl,
+  libpcap,
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "hcxdumptool";
-  version = "6.3.2";
+  version = "6.3.5";
 
   src = fetchFromGitHub {
     owner = "ZerBea";
     repo = "hcxdumptool";
-    rev = version;
-    sha256 = "sha256-InMyDUEH135Y1RYJ3z1+RQxPMi7+QMf670S/S2ZL9vg=";
+    tag = finalAttrs.version;
+    hash = "sha256-PA4nbjg4ybWvZZ7wbsh+OR/wEEVm5qu5OfM9EO3HBYs=";
   };
 
-  buildInputs = [ openssl ];
+  buildInputs = [
+    openssl
+    libpcap
+  ];
 
   installFlags = [ "PREFIX=$(out)" ];
 
-  meta = with lib; {
+  meta = {
     homepage = "https://github.com/ZerBea/hcxdumptool";
     description = "Small tool to capture packets from wlan devices";
-    license = licenses.mit;
-    platforms = platforms.linux;
-    maintainers = with maintainers; [ danielfullmer ];
+    license = lib.licenses.mit;
+    platforms = lib.platforms.linux;
+    maintainers = with lib.maintainers; [ danielfullmer ];
     mainProgram = "hcxdumptool";
   };
-}
+})

pkgs/by-name/ht/httptap/package.nix

@@ -2,37 +2,24 @@
   lib,
   buildGoModule,
   fetchFromGitHub,
-  fetchpatch,
 }:
 
-buildGoModule rec {
+buildGoModule (finalAttrs: {
   pname = "httptap";
-  version = "0.0.8";
+  version = "0.1.1";
 
   src = fetchFromGitHub {
     owner = "monasticacademy";
     repo = "httptap";
-    tag = "v${version}";
-    hash = "sha256-1BtV5ao5dAKSINdUdJD/wxTMFXXiP8Vy1A7gQfVIsUQ=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-Cn5u6q0r06SJp4uhF7j5K6yNZv8Q3WNxlDd5Vxmshhw=";
   };
 
-  patches = [
-    # this patch updates go.mod to include missing dependencies
-    # https://github.com/monasticacademy/httptap/pull/13
-    (fetchpatch {
-      name = "update-go-mod";
-      url = "https://github.com/monasticacademy/httptap/commit/3b520725c784d6435be6a51c58ae847bae729962.patch";
-      hash = "sha256-0dPq0Ldu1m8YZKctFtoUcbQdmx6sqjA8EVhTeMwNWx8=";
-    })
-  ];
-
-  vendorHash = "sha256-+TtHw2KdeNHCgnMnkxJJ9shqsrlbeTzYwbPH0dJmCjM=";
+  vendorHash = "sha256-yTtUt+kfDwN6W4caHCAYFjpYzhaqZUbLe+Nz7JKAXu8=";
 
   env.CGO_ENABLED = 0;
 
-  subPackages = [
-    "."
-  ];
+  subPackages = [ "." ];
 
   ldflags = [
     "-s"
@@ -46,4 +33,4 @@ buildGoModule rec {
     maintainers = with lib.maintainers; [ jpetrucciani ];
     mainProgram = "httptap";
   };
-}
+})

pkgs/by-name/ic/icdiff/package.nix

@@ -1,7 +1,7 @@
 {
   lib,
-  fetchFromGitHub,
   python3Packages,
+  fetchFromGitHub,
   bash,
   git,
   less,
@@ -9,33 +9,33 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "icdiff";
-  version = "1.9.5";
+  version = "2.0.7";
 
   src = fetchFromGitHub {
     owner = "jeffkaufman";
     repo = "icdiff";
-    rev = "release-${version}";
-    sha256 = "080v8h09pv8qwplin4kwfm0kmqjwdqjfxbpcdrv16sv4hwfwl5qd";
+    tag = "release-${version}";
+    hash = "sha256-XOw/xhPGlzi1hAgzQ1EtioUM476A+lQWLlvvaxd9j08=";
   };
 
+  # error: could not lock config file /homeless-shelter/.gitconfig: No such file or directory
+  doCheck = false;
+
   nativeCheckInputs = [
     bash
     git
     less
   ];
 
-  # error: could not lock config file /homeless-shelter/.gitconfig: No such file or directory
-  doCheck = false;
-
   checkPhase = ''
     patchShebangs test.sh
     ./test.sh ${python3Packages.python.interpreter}
   '';
 
-  meta = with lib; {
+  meta = {
     homepage = "https://www.jefftk.com/icdiff";
     description = "Side-by-side highlighted command line diffs";
     maintainers = [ ];
-    license = licenses.psfl;
+    license = lib.licenses.psfl;
   };
 }

pkgs/by-name/je/jetbrains-toolbox/package.nix

@@ -6,6 +6,7 @@
   fetchurl,
   makeWrapper,
   icu,
+  libappindicator-gtk3,
   undmg,
 }:
 
@@ -65,6 +66,7 @@ let
       install -Dm644 ${src}/jetbrains-toolbox.desktop $out/share/applications/jetbrains-toolbox.desktop
       install -Dm644 ${src}/.DirIcon $out/share/icons/hicolor/scalable/apps/jetbrains-toolbox.svg
       wrapProgram $out/bin/jetbrains-toolbox \
+        --prefix LD_LIBRARY_PATH : ${lib.makeLibraryPath [ libappindicator-gtk3 ]} \
         --append-flags "--update-failed"
     '';
 

pkgs/by-name/li/libgedit-gfls/package.nix

@@ -11,11 +11,12 @@
   mesonEmulatorHook,
   gtk3,
   glib,
+  gitUpdater,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "libgedit-gfls";
-  version = "0.2.1";
+  version = "0.3.0";
 
   outputs = [
     "out"
@@ -28,8 +29,8 @@ stdenv.mkDerivation (finalAttrs: {
     group = "World";
     owner = "gedit";
     repo = "libgedit-gfls";
-    rev = finalAttrs.version;
-    hash = "sha256-kMkqEly8RDc5eKqUupQD4tkVIXxL1rt4e/OCAPoutIg=";
+    tag = finalAttrs.version;
+    hash = "sha256-X56QPcmNB0Ey+kzSqDnb6/j6/w7IU7MFSAxW8mX8I3w=";
   };
 
   nativeBuildInputs =
@@ -54,6 +55,8 @@ stdenv.mkDerivation (finalAttrs: {
     glib
   ];
 
+  passthru.updateScript = gitUpdater { };
+
   meta = {
     homepage = "https://gitlab.gnome.org/World/gedit/libgedit-gfls";
     description = "Module dedicated to file loading and saving";

pkgs/by-name/li/libgedit-tepl/package.nix

@@ -15,11 +15,12 @@
   pkg-config,
   gtk-doc,
   docbook-xsl-nons,
+  gitUpdater,
 }:
 
 stdenv.mkDerivation rec {
   pname = "libgedit-tepl";
-  version = "6.12.0";
+  version = "6.13.0";
 
   outputs = [
     "out"
@@ -32,8 +33,8 @@ stdenv.mkDerivation rec {
     group = "World";
     owner = "gedit";
     repo = "libgedit-tepl";
-    rev = version;
-    hash = "sha256-s3b7wj6b2SM0+i0vXUDDhnspgPcsRAsA5kLblh0orJE=";
+    tag = version;
+    hash = "sha256-YWONsw5+gq5Uew6xB76pKsGTJmI83zAssO5WX6aP7ZM=";
   };
 
   strictDeps = true;
@@ -62,6 +63,8 @@ stdenv.mkDerivation rec {
     libgedit-gtksourceview
   ];
 
+  passthru.updateScript = gitUpdater { };
+
   meta = with lib; {
     homepage = "https://gitlab.gnome.org/World/gedit/libgedit-tepl";
     description = "Text editor product line";

pkgs/by-name/lu/lug-helper/package.nix

@@ -15,12 +15,12 @@
 }:
 stdenvNoCC.mkDerivation (finalAttrs: {
   name = "lug-helper";
-  version = "3.7";
+  version = "3.8";
   src = fetchFromGitHub {
     owner = "starcitizen-lug";
     repo = "lug-helper";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-2z8Le65DQk121jTM3UP25V3Xzq+KUve5XJQmNaQ2IGg=";
+    hash = "sha256-e0pq3E9Jsx9pBRhN0gFJxZPDUbK/Xe84+5AO2/RlsLo=";
   };
 
   buildInputs = [

pkgs/by-name/mi/mihomo-party/package.nix

@@ -87,5 +87,6 @@ stdenv.mkDerivation rec {
     license = lib.licenses.gpl3Plus;
     sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
     maintainers = with lib.maintainers; [ ];
+    knownVulnerabilities = [ "https://github.com/mihomo-party-org/mihomo-party/issues/706" ];
   };
 }

pkgs/by-name/pa/paretosecurity/package.nix

@@ -17,18 +17,23 @@ buildGoModule (finalAttrs: {
     webkitgtk_4_1
   ];
   pname = "paretosecurity";
-  version = "0.2.12";
+  version = "0.2.13";
 
   src = fetchFromGitHub {
     owner = "ParetoSecurity";
     repo = "agent";
     rev = finalAttrs.version;
-    hash = "sha256-skBxDPC+C8JU1CW6g3SA2C4IawaoPzVi8pdl5BCutUY=";
+    hash = "sha256-G2An1Br/NJcIEKaM/pPEGkJazD9UFypRZ/KLmqkNUTo=";
   };
 
   vendorHash = "sha256-YnyACP/hJYxi4AWMwr0We4YUTbWwahKAIYN6RnHmzls=";
   proxyVendor = true;
 
+  # Skip building the Windows installer
+  preBuild = ''
+    rm -rf cmd/paretosecurity-installer
+  '';
+
   ldflags = [
     "-s"
     "-X=github.com/ParetoSecurity/agent/shared.Version=${finalAttrs.version}"

pkgs/by-name/ph/pharo/package.nix

@@ -17,13 +17,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "pharo";
-  version = "10.3.1-6cdb1e5";
+  version = "10.3.4+3.884643b";
 
   src = fetchzip {
     # It is necessary to download from there instead of from the repository because that archive
     # also contains artifacts necessary for the bootstrapping.
-    url = "https://files.pharo.org/vm/pharo-spur64-headless/Linux-x86_64/source/PharoVM-${finalAttrs.version}-Linux-x86_64-c-src.zip";
-    hash = "sha256-Oskbo0ZMh2Wr8uY9BjA54AhFVDEuzs4AN8cpO02gdfY=";
+    url = "https://files.pharo.org/vm/pharo-spur64-headless/Linux-x86_64/source/PharoVM-v${finalAttrs.version}-Linux-x86_64-c-src.zip";
+    hash = "sha256-JBN0gPVMIUFzrdLqrCnCvf4cbZMfpluO2/jCxk3U+M8=";
   };
 
   strictDeps = true;
@@ -59,6 +59,12 @@ stdenv.mkDerivation (finalAttrs: {
     "-Wno-incompatible-pointer-types"
   ];
 
+  # Fix missing version.info
+  preBuild = ''
+    mkdir -p /build/source/build/
+    echo "${finalAttrs.version}" > /build/source/build/version.info
+  '';
+
   installPhase = ''
     runHook preInstall
 

pkgs/by-name/py/pytr/package.nix

@@ -8,14 +8,14 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "pytr";
-  version = "0.4.1";
+  version = "0.4.2";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "pytr-org";
     repo = "pytr";
     tag = "v${version}";
-    hash = "sha256-uWG8q6H6q54v3Iq5LOkr7zi5rds+y13O0ai9R9QySdI=";
+    hash = "sha256-7554su1bR3m6wcIcmT64O+x/kvVlDMsG/hkTym25B/Q=";
   };
 
   build-system = with python3Packages; [

pkgs/by-name/sh/sherlock/package.nix

@@ -3,7 +3,6 @@
   fetchFromGitHub,
   makeWrapper,
   python3,
-  poetry,
 }:
 
 python3.pkgs.buildPythonApplication rec {
@@ -59,7 +58,6 @@ python3.pkgs.buildPythonApplication rec {
 
   nativeCheckInputs = with python3.pkgs; [
     pytestCheckHook
-    poetry
     poetry-core
     jsonschema
     openpyxl

pkgs/by-name/ta/tantivy-go/package.nix

@@ -6,17 +6,17 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "tantivy-go";
-  version = "0.3.1";
+  version = "1.0.1";
 
   src = fetchFromGitHub {
     owner = "anyproto";
     repo = "tantivy-go";
     tag = "v${version}";
-    hash = "sha256-IlGtyTjOAvmrbgmvy4NelTOgOWopxNta3INq2QcMEqY=";
+    hash = "sha256-iTGIm5C7SMBZv2OcKCQCyEZS/eeMJQ5nFSpuFJbTEXU=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-3+HtZ7SAnvTNXtYlokX/Z9VD1lDw+nh6R/njYOZeGoE=";
+  cargoHash = "sha256-f8xI4g6MK4NUn0DpxD+miaCzBe8FSSqaL5rpjoqUGfY=";
 
   cargoPatches = [
     ./add-Cargo.lock.patch

pkgs/by-name/ti/tidal-hifi/electron.nix

@@ -0,0 +1,31 @@
+{
+  fetchzip,
+  lib,
+}:
+let
+  /*
+    see:
+    https://github.com/Mastermindzh/tidal-hifi/blob/master/build/electron-builder.base.yml
+     for the expected version
+  */
+  version = "35.1.1";
+in
+(fetchzip {
+  url = "https://github.com/castlabs/electron-releases/releases/download/v${version}+wvcus/electron-v${version}+wvcus-linux-x64.zip";
+  hash = "sha256-AkPKeG7MrCBlk41qXZxFPRukUPRcIUanq6fJPx5d3RU=";
+  stripRoot = false;
+
+}).overrideAttrs
+  (
+    final: _: {
+      name = "castlabs-electron-${version}";
+      inherit version;
+      pname = "castlabs-electron";
+      passthru.dist = final.finalPackage.outPath;
+
+      meta = {
+        license = lib.licenses.unfreeRedistributable;
+        sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
+      };
+    }
+  )

pkgs/by-name/ti/tidal-hifi/package.nix

@@ -1,98 +1,109 @@
 {
   lib,
+  buildNpmPackage,
+  fetchFromGitHub,
+  callPackage,
+  libdbusmenu,
+  xdg-utils,
+  makeShellWrapper,
+  copyDesktopItems,
+  makeDesktopItem,
   stdenv,
-  fetchurl,
-  autoPatchelfHook,
-  dpkg,
-  makeWrapper,
   wrapGAppsHook3,
-  alsa-lib,
+  glib,
+  gtk3,
+  gtk4,
   at-spi2-atk,
-  at-spi2-core,
-  atk,
+  libdrm,
+  libgbm,
+  libxkbcommon,
+  libxshmfence,
+  libGL,
+  vulkan-loader,
+  alsa-lib,
   cairo,
   cups,
   dbus,
   expat,
-  ffmpeg,
-  fontconfig,
-  freetype,
   gdk-pixbuf,
-  glib,
-  gtk3,
-  libappindicator-gtk3,
-  libdbusmenu,
-  libdrm,
-  libnotify,
-  libpulseaudio,
-  libsecret,
-  libuuid,
-  libxkbcommon,
-  libgbm,
   nss,
+  nspr,
+  libX11,
+  libxcb,
+  libXcomposite,
+  libXdamage,
+  libXext,
+  libXfixes,
+  libXrandr,
+  libxkbfile,
   pango,
   systemd,
-  xdg-utils,
-  xorg,
-  libGL,
+  pciutils,
+  libnotify,
+  pipewire,
+  libsecret,
+  libpulseaudio,
+  speechd-minimal,
+
+  castlabs-electron ? callPackage ./electron.nix { },
 }:
 
-stdenv.mkDerivation (finalAttrs: {
-  pname = "tidal-hifi";
-  version = "5.18.2";
+let
+  version = "5.19.0";
 
-  src = fetchurl {
-    url = "https://github.com/Mastermindzh/tidal-hifi/releases/download/${finalAttrs.version}/tidal-hifi_${finalAttrs.version}_amd64.deb";
-    sha256 = "sha256-jo3vnq7ul7e+UsaBswil8EctUxVJMcTxo77YyQ2ncIM=";
-  };
-
-  nativeBuildInputs = [
-    autoPatchelfHook
-    dpkg
-    makeWrapper
-    wrapGAppsHook3
-  ];
-
-  buildInputs = [
+  electronLibPath = lib.makeLibraryPath [
     alsa-lib
     at-spi2-atk
-    at-spi2-core
-    atk
     cairo
     cups
     dbus
     expat
-    ffmpeg
-    fontconfig
-    freetype
     gdk-pixbuf
     glib
     gtk3
-    pango
-    systemd
-    libgbm
+    gtk4
     nss
-    libuuid
-    libdrm
+    nspr
+    libX11
+    libxcb
+    libXcomposite
+    libXdamage
+    libXext
+    libXfixes
+    libXrandr
+    libxkbfile
+    pango
+    pciutils
+    stdenv.cc.cc
+    systemd
     libnotify
+    pipewire
     libsecret
     libpulseaudio
+    speechd-minimal
+    libdrm
+    libgbm
     libxkbcommon
-    libappindicator-gtk3
-    xorg.libX11
-    xorg.libxcb
-    xorg.libXcomposite
-    xorg.libXcursor
-    xorg.libXdamage
-    xorg.libXext
-    xorg.libXfixes
-    xorg.libXi
-    xorg.libXrandr
-    xorg.libXrender
-    xorg.libXScrnSaver
-    xorg.libxshmfence
-    xorg.libXtst
+    libxshmfence
     libGL
+    vulkan-loader
+  ];
+in
+buildNpmPackage {
+  pname = "tidal-hifi";
+  inherit version;
+
+  src = fetchFromGitHub {
+    owner = "Mastermindzh";
+    repo = "tidal-hifi";
+    tag = version;
+    hash = "sha256-/pPmfgKwrtOrEu7YVJTuQF/FIMa+W6uSnFbMFuyURFQ=";
+  };
+
+  nativeBuildInputs = [
+    makeShellWrapper
+    wrapGAppsHook3
+    copyDesktopItems
   ];
 
   runtimeDependencies = [
@@ -102,36 +113,101 @@ stdenv.mkDerivation (finalAttrs: {
     xdg-utils
   ];
 
+  npmDepsHash = "sha256-TNhD/ZkqJtsidAEIOL/WmJZw09BuFgd4ECnzbieNhVY=";
+  forceGitDeps = true;
+  makeCacheWritable = true;
+
+  env.ELECTRON_SKIP_BINARY_DOWNLOAD = "1";
+
+  buildPhase = ''
+    runHook preBuild
+
+    npm run compile
+    npm exec electron-builder -- \
+        --dir \
+        --config build/electron-builder.base.yml \
+        -c.electronDist=${castlabs-electron.dist} \
+        -c.electronVersion=${castlabs-electron.version}
+
+    runHook postBuild
+  '';
+
+  desktopItems = [
+    (makeDesktopItem {
+      name = "TIDAL Hi-Fi";
+      desktopName = "tidal-hifi";
+      genericName = "TIDAL Hi-Fi";
+      comment = "The web version of listen.tidal.com running in electron with hifi support thanks to widevine.";
+      icon = "tidal-hifi";
+      startupNotify = true;
+      terminal = false;
+      type = "Application";
+      categories = [
+        "Network"
+        "Application"
+        "AudioVideo"
+        "Audio"
+        "Video"
+      ];
+      startupWMClass = "tidal-hifi";
+      mimeTypes = [ "x-scheme-handler/tidal" ];
+      extraConfig.X-PulseAudio-Properties = "media.role=music";
+    })
+  ];
+
+  dontWrapGApps = true;
+
   installPhase = ''
     runHook preInstall
 
-    mkdir -p "$out/bin"
-    cp -R "opt" "$out"
-    cp -R "usr/share" "$out/share"
-    chmod -R g-w "$out"
+    for i in 16 22 24 32 48 64 128 256 384; do
+      install -Dm644 "assets/icons/$i"x"$i.png" "$out/share/icons/hicolor/$i"x"$i/apps/tidal-hifi.png"
+    done
+
+    mv dist/linux-unpacked "$out/share/tidal-hifi"
 
     runHook postInstall
   '';
 
+  # see: pkgs/development/tools/electron/binary/generic.nix
   postFixup = ''
-    makeWrapper $out/opt/tidal-hifi/tidal-hifi $out/bin/tidal-hifi \
-      --prefix LD_LIBRARY_PATH : "${lib.makeLibraryPath finalAttrs.buildInputs}" \
-      --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--ozone-platform-hint=auto --enable-features=WaylandWindowDecorations --enable-wayland-ime=true}}" \
+    patchelf \
+      --set-interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" \
+      --set-rpath "${electronLibPath}:$out/share/tidal-hifi" \
+      $out/share/tidal-hifi/tidal-hifi \
+      $out/share/tidal-hifi/chrome_crashpad_handler
+
+    # patch libANGLE
+    patchelf \
+      --set-rpath "${
+        lib.makeLibraryPath [
+          libGL
+          pciutils
+          vulkan-loader
+        ]
+      }" \
+      $out/share/tidal-hifi/lib*GL*
+
+    # replace bundled vulkan-loader
+    rm "$out/share/tidal-hifi/libvulkan.so.1"
+    ln -s -t "$out/share/tidal-hifi" "${lib.getLib vulkan-loader}/lib/libvulkan.so.1"
+
+    makeShellWrapper "$out/share/tidal-hifi/tidal-hifi" "$out/bin/tidal-hifi" \
+      --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--ozone-platform-hint=auto --enable-features=WaylandWindowDecorations}}" \
       "''${gappsWrapperArgs[@]}"
-    substituteInPlace $out/share/applications/tidal-hifi.desktop \
-      --replace "/opt/tidal-hifi/tidal-hifi" "tidal-hifi"
   '';
 
   meta = {
-    changelog = "https://github.com/Mastermindzh/tidal-hifi/releases/tag/${finalAttrs.version}";
+    changelog = "https://github.com/Mastermindzh/tidal-hifi/releases/tag/${version}";
     description = "Web version of Tidal running in electron with hifi support thanks to widevine";
     homepage = "https://github.com/Mastermindzh/tidal-hifi";
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [
+      gerg-l
       qbit
       spikespaz
     ];
     platforms = lib.platforms.linux;
     mainProgram = "tidal-hifi";
   };
-})
+}

pkgs/by-name/ts/ts_query_ls/package.nix

@@ -6,7 +6,7 @@
 }:
 let
   pname = "ts_query_ls";
-  version = "1.11.0";
+  version = "2.0.0";
 in
 rustPlatform.buildRustPackage {
   inherit pname version;
@@ -15,13 +15,13 @@ rustPlatform.buildRustPackage {
     owner = "ribru17";
     repo = "ts_query_ls";
     rev = "v${version}";
-    hash = "sha256-RpzQUqCaS6/MrYlVqkWaJPUgEpIBIzToMygn+TDeX88=";
+    hash = "sha256-RWryYFeJ6DdXG9kSjPbSu3xfiGjaUBNEj2XBIoXbySg=";
   };
 
   nativeBuildInputs = [ cmake ];
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-g0BVLduTWZRxNwDblvl7lm/ZduvEAbkSFYmzADMkKjg=";
+  cargoHash = "sha256-IlvUpEpdMocJ1d5GVWmuKfVRdOskuzIiqP6uSg/QxZc=";
 
   meta = {
     description = "LSP implementation for Tree-sitter's query files";

pkgs/by-name/un/unblob/package.nix

@@ -1,10 +1,14 @@
 {
   lib,
+  libiconv,
   python3,
   fetchFromGitHub,
   gitUpdater,
   makeWrapper,
+  rustPlatform,
+  stdenvNoCC,
   e2fsprogs,
+  erofs-utils,
   jefferson,
   lz4,
   lziprecover,
@@ -23,6 +27,7 @@ let
   # These dependencies are only added to PATH
   runtimeDeps = [
     e2fsprogs
+    erofs-utils
     jefferson
     lziprecover
     lzop
@@ -38,7 +43,7 @@ let
 in
 python3.pkgs.buildPythonApplication rec {
   pname = "unblob";
-  version = "25.1.8";
+  version = "25.4.14";
   pyproject = true;
   disabled = python3.pkgs.pythonOlder "3.9";
 
@@ -46,15 +51,22 @@ python3.pkgs.buildPythonApplication rec {
     owner = "onekey-sec";
     repo = "unblob";
     tag = version;
-    hash = "sha256-PGpJPAo9q52gQ3EGusYtDA2e0MG5kFClqCYPB2DvuMs=";
+    hash = "sha256-kWZGQX8uSKdFW+uauunHcruXhJ5XpBfyDY7gPyWGK90=";
     forceFetchGit = true;
     fetchLFS = true;
   };
 
+  cargoDeps = rustPlatform.fetchCargoVendor {
+    inherit pname version src;
+    hash = "sha256-lGsDax7+CUACeYChDqdPsVbKE/hH94CPek6UBVz1eqs=";
+  };
+
   strictDeps = true;
 
   build-system = with python3.pkgs; [ poetry-core ];
 
+  buildInputs = lib.optionals stdenvNoCC.hostPlatform.isDarwin [ libiconv ];
+
   dependencies = with python3.pkgs; [
     arpy
     attrs
@@ -69,15 +81,17 @@ python3.pkgs.buildPythonApplication rec {
     pyfatfs
     pyperscan
     python-magic
+    pyzstd
     rarfile
     rich
     structlog
     treelib
-    unblob-native
   ];
 
-  nativeBuildInputs = [
+  nativeBuildInputs = with rustPlatform; [
     makeWrapper
+    maturinBuildHook
+    cargoSetupHook
   ];
 
   # These are runtime-only CLI dependencies, which are used through
@@ -87,7 +101,7 @@ python3.pkgs.buildPythonApplication rec {
     "ubi-reader"
   ];
 
-  pythonRelaxDeps = [ "rich" ];
+  pythonRelaxDeps = [ "lz4" ];
 
   pythonImportsCheck = [ "unblob" ];
 
@@ -112,13 +126,6 @@ python3.pkgs.buildPythonApplication rec {
       disabled = [
         # https://github.com/tytso/e2fsprogs/issues/152
         "test_all_handlers[filesystem.extfs]"
-
-        # Should be dropped after upgrading to next version
-        # Needs https://github.com/onekey-sec/unblob/pull/1128/commits/c6af67f0c6f32fa01d7abbf495eb0293e9184438
-        # Unfortunately patches touching LFS stored assets cannot be applied
-        "test_all_handlers[filesystem.ubi.ubi]"
-        "test_all_handlers[archive.dlink.encrpted_img]"
-        "test_all_handlers[archive.dlink.shrs]"
       ];
     in
     [

pkgs/by-name/vu/vuetorrent/package.nix

@@ -7,16 +7,16 @@
 
 buildNpmPackage rec {
   pname = "vuetorrent";
-  version = "2.24.1";
+  version = "2.24.2";
 
   src = fetchFromGitHub {
     owner = "VueTorrent";
     repo = "VueTorrent";
     tag = "v${version}";
-    hash = "sha256-FuX1wZVWB6+5G0ePE7Eb4Gkq736UKB/caW5AcCYJtUU=";
+    hash = "sha256-+BTnFQxg+8vJdfwER6lM7dszRxBiX20K/vYv+nuH/1Y=";
   };
 
-  npmDepsHash = "sha256-lRTB4Wfkp9UAi0N9iOSJQIJNFBz3RDGTglFofWqIWZ0=";
+  npmDepsHash = "sha256-4lIxaNqXO5jDmXgPfoxRuSe8p6jV7momSbpl9Nns0VI=";
 
   installPhase = ''
     runHook preInstall

pkgs/data/fonts/maple-font/default.nix

@@ -17,7 +17,7 @@ let
     }:
     stdenv.mkDerivation rec {
       inherit pname;
-      version = "7.1";
+      version = "7.2";
       src = fetchurl {
         url = "https://github.com/subframe7536/Maple-font/releases/download/v${version}/${pname}.zip";
         inherit hash;

pkgs/data/fonts/maple-font/hashes.json

@@ -1,46 +1,46 @@
 {
-  "MapleMono-CN-unhinted": "sha256-D4B+KAkybvfVS+HztoYTCF+Qs9lxrh1de2bBPUBdO68=",
-  "MapleMono-CN": "sha256-63qfevuputeewEXaV5CbjSnOQ6tqXNPwN65BnkTXcf0=",
-  "MapleMono-NF-CN-unhinted": "sha256-qLqcdCL3uCDW6QDx+W39HcL3r303RNjEuEhiA38YRYU=",
-  "MapleMono-NF-CN": "sha256-9gxjsh9j7Tlc1Z5naK7PSppbViI6cZtlqk6/5Jhvt5E=",
-  "MapleMono-NF-unhinted": "sha256-hnELGz8zpQ/n2Pj3SWqduuflmIBhT+8Md6c5QMXhzd4=",
-  "MapleMono-NF": "sha256-ZzU+PgrazEziTx8ooNkkjqAPwFcM1EPQBRSkkm3C60I=",
-  "MapleMono-OTF": "sha256-Nxpv748064mp5Lz4lvdCUz9jWY78dVMOSlC1FBDOvws=",
-  "MapleMono-TTF-AutoHint": "sha256-R1ZNozNRHYtNXar96w3V1qkwbAOWCdMZMmhK7Dtyqs4=",
-  "MapleMono-TTF": "sha256-7aFMMCxreDD2KnpgIt/gcYAyp+pNEtdfSgT/4aOM/P8=",
-  "MapleMono-Variable": "sha256-FyaIAYpdDOj6IDLJUU33Yg7VqEK0VN/n92b2I4LrdcA=",
-  "MapleMono-Woff2": "sha256-lxcBjgmngFZ1UhBej3lE+IqKxvQoDE5rH3++h4CN0ac=",
-  "MapleMonoNL-CN-unhinted": "sha256-tkEEKNjHN/lveLvYtlP3EvmtKVnQMdaBFDe6c+fjtB8=",
-  "MapleMonoNL-CN": "sha256-D7Whkd1+qL5OwlAVIepscLqQwusbIWKwtg1C2vfC4yI=",
-  "MapleMonoNL-NF-CN-unhinted": "sha256-8MtWWxzrrLTdHsAB+vNWBN62TJ59Tr6pfmAsJVdk/KA=",
-  "MapleMonoNL-NF-CN": "sha256-58UpkirwaSTOgk0m5UoDL+1tAz4FzDD9f+zPUieqUkA=",
-  "MapleMonoNL-NF-unhinted": "sha256-6ImbXQwoXBQ9FDjB4qLPIwoi8wc+/AWc3P5ALZfkdE4=",
-  "MapleMonoNL-NF": "sha256-Lk8JBrLxwmonB7w4Je9evGM0wUjpgwIZ3Qj+IU/XZ1o=",
-  "MapleMonoNL-OTF": "sha256-Lcrde1I3SV6f7RYiyguK0w9wgRCn3Ra703xkB8gtqJ4=",
-  "MapleMonoNL-TTF-AutoHint": "sha256-++via+eB8KE/RQ6NpCXL3DsBuI/+U0IWMUZPvDQ1zuA=",
-  "MapleMonoNL-TTF": "sha256-B5z0KEnEis39A1sPj1bOZTfSdtwR4PJPfms84EiMYsQ=",
-  "MapleMonoNL-Variable": "sha256-zdMMVg+KS/VSP/ICQciSMOXLFZdcyZvJQusXcYJlfbs=",
-  "MapleMonoNL-Woff2": "sha256-ksaugxwIw56txNfOJtgSeSOffwUxs4JrIUYfDj5t3wY=",
-  "MapleMonoNormal-CN-unhinted": "sha256-B4v2lJeSerzX3NRbfalAQ2zfNQJtkwfO3fVvrL5yAWg=",
-  "MapleMonoNormal-CN": "sha256-MBtXNBDzW6WogNCvGMVzzgJ5VPupYOPPI/f8OC+qU0w=",
-  "MapleMonoNormal-NF-CN-unhinted": "sha256-a/rW5sU02nBMx0SuSfIZPnR37g9WzzBSv9J46kiv4xc=",
-  "MapleMonoNormal-NF-CN": "sha256-p1mFIMlT4JEmxyGCG24W8SCdi+4d1S9QyHF09g3iDnY=",
-  "MapleMonoNormal-NF-unhinted": "sha256-1sn7wt1s71t0F4W8fUSbqOie71V4cJisBrpFc77s0jI=",
-  "MapleMonoNormal-NF": "sha256-zoLY/fj7kxkg0040K0UQxhieicM5eo9WLS+WBAXZr5g=",
-  "MapleMonoNormal-OTF": "sha256-OdaYoRney4GwdsQvruR+jj889LBwBWU9FtTNJR9pIHo=",
-  "MapleMonoNormal-TTF-AutoHint": "sha256-bx7FdvgDPpQV8wGpWD+3wzEETSL3HgYnM8UbmoSJSc4=",
-  "MapleMonoNormal-TTF": "sha256-FULu8LaFW+RcUiO5HVj2e4vhfcphgvmyRT/iQ0/xQc8=",
-  "MapleMonoNormal-Variable": "sha256-jCkN4QghmVlyuFO1eeL9vS0TNNVFNp9uQ0i226SNTtg=",
-  "MapleMonoNormal-Woff2": "sha256-EApY/qeoRMOseqqWz52tySSQk+BUZ71iafE03DGfQ/Q=",
-  "MapleMonoNormalNL-CN-unhinted": "sha256-mkswI0WwTyg+RWKFeb2M/mkfIFc1PIgVy2QYjqQiuiA=",
-  "MapleMonoNormalNL-CN": "sha256-TrOyQkGibptTtXAT+269XvZsgWv39n1jO5yIn2NaZII=",
-  "MapleMonoNormalNL-NF-CN-unhinted": "sha256-3ZMVAS/2coyy0cAy5e/r3XHKSTsfGxOn97jVQf7b/WY=",
-  "MapleMonoNormalNL-NF-CN": "sha256-Zqu+FfuJmtFglwm7kwUZ8tR8xMvd1kacepK1KkCD1WI=",
-  "MapleMonoNormalNL-NF-unhinted": "sha256-GW4jUZ05BUIxl164Uu4b2gsACP6MyfehrgQ8Ja57/HI=",
-  "MapleMonoNormalNL-NF": "sha256-+tApldIkG2s+IG7EOp/DqsRqcSXtu6H0SiuoO6H/E6I=",
-  "MapleMonoNormalNL-OTF": "sha256-lehO8olLXbwD/6TTuJw4z1V2ZQQaIU0yglL06a4foAg=",
-  "MapleMonoNormalNL-TTF-AutoHint": "sha256-+5OrKlftga0gWyTNZ5W79CqkdvZNfrM991RuWyMSq3k=",
-  "MapleMonoNormalNL-TTF": "sha256-ZfyCm62dfoLicwxUgvbgYBibvmhtIJTklK1zu7K6ies=",
-  "MapleMonoNormalNL-Variable": "sha256-oJdnpT3HuyptiD2P4Jm2Kj3ch8Pq/aoW5zfvtjZ1Lac=",
-  "MapleMonoNormalNL-Woff2": "sha256-ioeqrNud0v3/xgP7wmycxus7CcqsPDb8NMyYCCQih2k="
+  "MapleMono-CN-unhinted": "sha256-+OBpkxboDvvjP5Rh8xoFUH76a237nilG0Ko1Me/Ygw4=",
+  "MapleMono-CN": "sha256-PVmtJLV9tyojaM5CIbQ9M2gOQPhx4Tjvam4vVO1/UqM=",
+  "MapleMono-NF-CN-unhinted": "sha256-qT77eUeq9Uept1AJuz4KvbJlfqvUtooJSekVoJUphD0=",
+  "MapleMono-NF-CN": "sha256-w7j1UI8OE4CbNzeY4n0g3WKtVgkJ07uMpRnRCVRIo8M=",
+  "MapleMono-NF-unhinted": "sha256-g2XHcy1zqZ/M5Fw6JQD2ifWmNijWZzcvQ5LdsAQJQWA=",
+  "MapleMono-NF": "sha256-E6hYxVShsP+QrgM1w6hjCiiArvQfcIHAEvG7WGOcpds=",
+  "MapleMono-OTF": "sha256-LnNxiGLtqO2H01O25N36ML9Kwxop9fH+4IvXk1VJFvs=",
+  "MapleMono-TTF-AutoHint": "sha256-K3oj/ik/9dkpH7sp1EgX12Ts/zsTWFOOulGwE2k+eno=",
+  "MapleMono-TTF": "sha256-1wQ97Tm2BN+ba2Oxonyeovl5UlLooYrYfkrA85CQZmM=",
+  "MapleMono-Variable": "sha256-qvph60EzXkkgDN+rvx8qH3IPAH9s/IIl3W8lb6cSN50=",
+  "MapleMono-Woff2": "sha256-eUHj2NOjsVvwFnh2/chauGEGfBXe5f7xeN2DLm9j5ko=",
+  "MapleMonoNL-CN-unhinted": "sha256-gqgd25Zkp1g/A5d1NTkawb8pnFv7ITTwdK1JQMzie9w=",
+  "MapleMonoNL-CN": "sha256-fZTMr9SGtaUJJ7GwILQ0anNMsS6XLDFoYqbF12aD7N0=",
+  "MapleMonoNL-NF-CN-unhinted": "sha256-r1+8h0Tosdgum02mDXQQtoxwbyVD+WjtAkdPXT74Yd0=",
+  "MapleMonoNL-NF-CN": "sha256-RubqDmNtgtuzFFTD8p5EV1PIE4zUFtOqsbT84ed+oTc=",
+  "MapleMonoNL-NF-unhinted": "sha256-QLyTquz5Xfd/DZ9NEWqNmAcOzDyiXV4KzePLhzZKL60=",
+  "MapleMonoNL-NF": "sha256-zo/voGFI/8wTzeXj+STzOPK8xEV5Tnmpg0LYbeJ3vgI=",
+  "MapleMonoNL-OTF": "sha256-iK1XlhFlMy8UnjYbntOhvZtL3BlQmGDk5YIAxfaaUKA=",
+  "MapleMonoNL-TTF-AutoHint": "sha256-KZRI7INinrg3yHrIcfFo/Za36d569z2fXjKsGXBXmV8=",
+  "MapleMonoNL-TTF": "sha256-4G61jgVY2PcjS4RRB/tDKujZ7rDdG44o5OYSJKQbboE=",
+  "MapleMonoNL-Variable": "sha256-6lxd8bdREW7loOUznAQUIvjhs7p/LDsD6pJbk4JmNpU=",
+  "MapleMonoNL-Woff2": "sha256-Ovh6++Bz8Cib9BcHxg5SYm6NHgKHuX9MW6HbmPH/LJw=",
+  "MapleMonoNormal-CN-unhinted": "sha256-BRRISfA21EQvNUlCGwNiVBkZpDAF+iCV99LsYJsuv9Q=",
+  "MapleMonoNormal-CN": "sha256-SXG2nlBpyuiFMLUClyl5ZzoPxVF5w33JjCaC5tPG/8s=",
+  "MapleMonoNormal-NF-CN-unhinted": "sha256-0EZzl2Cddqh2tLsfDd5VNhJweueZJK/KaqO9VUkGLIk=",
+  "MapleMonoNormal-NF-CN": "sha256-/nQhsf7AyoJ+xkUujY8z5p/xWyPLROIGtpSQgMvmlYc=",
+  "MapleMonoNormal-NF-unhinted": "sha256-2LlrEYI92GHRICLfYbUl9U+EbdAbCjiZSXD7z5vRC4w=",
+  "MapleMonoNormal-NF": "sha256-UJAXFD4KVm8lbZzPMaEwrH0divRf7HxixDxurPGkU44=",
+  "MapleMonoNormal-OTF": "sha256-98NGP7arvw1W2akNWweKK+OfW14VtbF/fy8olRXcAPA=",
+  "MapleMonoNormal-TTF-AutoHint": "sha256-j9mG3VM4DP82ynw0UFuMDXjcbMnuVKOfJ9HMBFrrvDk=",
+  "MapleMonoNormal-TTF": "sha256-mEJJ/y5amhMBt+MroSUMuaTqGg3LUeYTiAn/vAMfy5U=",
+  "MapleMonoNormal-Variable": "sha256-LwW94IJAfdltG2wmJiv6JmB8fNdddb//yHsZvMvlSTo=",
+  "MapleMonoNormal-Woff2": "sha256-HuHcNeCw/AEsScKGciTK5O5Rz7eCS0hlzfz5ZYcqLyU=",
+  "MapleMonoNormalNL-CN-unhinted": "sha256-u7QqDoWt+NZgBxFH4D/U+SyiCKEObKPOh89A9fINoUk=",
+  "MapleMonoNormalNL-CN": "sha256-K30io0S/kqpLD3aBZcTvVKy5IGbzq43uiTzKmxEgpW8=",
+  "MapleMonoNormalNL-NF-CN-unhinted": "sha256-RYQR301tnCD85t5f5E7wpTXrg6NDw3drJ85Z6z/Xo68=",
+  "MapleMonoNormalNL-NF-CN": "sha256-UDgWMxBzZajs0p6lBtAW2jbZEvMLb4GpvmdKhKWU+W4=",
+  "MapleMonoNormalNL-NF-unhinted": "sha256-vf7pXN7N+/HA1gia4mFGJNJOsrBdUf5lNKi/BlLoNN0=",
+  "MapleMonoNormalNL-NF": "sha256-VqKI6pICNlUZ/5cpgNRRKNgeA3xgUNYEVDjUDb006Ss=",
+  "MapleMonoNormalNL-OTF": "sha256-uQjt6K5s6+1sIxRnI51PgDxlyRi7xIsiNZbIP3hauNw=",
+  "MapleMonoNormalNL-TTF-AutoHint": "sha256-0zS5NdpnIeOwcaz8Rv1sCWeUdjWZE8SoF54myIQKAFE=",
+  "MapleMonoNormalNL-TTF": "sha256-Oqa2CPuXqqemxUR37Z98KOz2EWDXbxLSGZUpsQpMdGA=",
+  "MapleMonoNormalNL-Variable": "sha256-kWh6n9lFShmnLME0+1M2aKOrc64WrZk6SkQTT2AkEDU=",
+  "MapleMonoNormalNL-Woff2": "sha256-/Dl6B5Ya6BWHZqzOH7wcuJmTOUtO3jJXiW83+vWJpgM="
 }

pkgs/development/compilers/chicken/5/deps.toml

@@ -44,9 +44,9 @@ version = "1.2"
 [address-info]
 dependencies = ["srfi-1"]
 license = "bsd"
-sha256 = "0vzrbzalqx3bv5nzq9rykfyhnrgnf2hlh55hi67pgync9z06v3jy"
+sha256 = "1drshasifvvpzp3bk7gc3pbvawcajhmhp9pg25dynbd0yndvgnby"
 synopsis = "Network address information access"
-version = "1.0.5"
+version = "1.0.6"
 
 [advice]
 dependencies = ["srfi-1"]
@@ -359,23 +359,23 @@ version = "1.2"
 [breadline]
 dependencies = ["apropos", "srfi-18"]
 license = "gpl-3"
-sha256 = "1kkga2n6vw2hxg9sd20f6swnj6hikddyiamsdbqp5m72nlxkq72c"
+sha256 = "1rvffygravnaw5sns03qfn28zznvamprfhmzgscjfpck1j4x6ylc"
 synopsis = "Bindings to readline"
-version = "0.12"
+version = "1.0.2"
 
 [brev-separate]
 dependencies = ["matchable", "miscmacros", "srfi-1", "srfi-69"]
 license = "bsd-1-clause"
-sha256 = "1wzcqbccngcajzw4js7llys1pnmnvsmkk01v1ji6khy4kyghvspl"
+sha256 = "08mczqjyaf5bhm64hnb80r0237mq9w2kj4grn2a8ahzc7870h7jm"
 synopsis = "Hodge podge of macros and combinators"
-version = "1.97"
+version = "1.98"
 
 [brev]
 dependencies = ["anaphora", "brev-separate", "clojurian", "combinators", "define-options", "dwim-sort", "fix-me-now", "acetone", "html-parser", "match-generics", "http-client", "matchable", "miscmacros", "scsh-process", "sequences", "srfi-1", "srfi-42", "srfi-69", "strse", "sxml-serializer", "sxml-transforms", "sxpath", "tree", "uri-common"]
 license = "public-domain"
-sha256 = "0gzbhyv228a76cnnisn7cqyhjsrphxn0bavxisg9rd40ndggijka"
+sha256 = "0k890r62hp5ivyah3mrwm712xxlkrb7qmzg1825nmw1ij8c2hj1z"
 synopsis = "A huge pile of batteries and shortcuts"
-version = "1.42"
+version = "1.43"
 
 [byte-blob]
 dependencies = ["srfi-1"]
@@ -546,11 +546,11 @@ synopsis = "A chicken wrapper for cmark with markdown to sxml capabilities"
 version = "0.1.0"
 
 [coin-change]
-dependencies = ["srfi-1"]
+dependencies = []
 license = "unlicense"
-sha256 = "09p83afsh2dx4y2cpyi55bf2br03ysdpq9xrqik7fmks3913kxmk"
+sha256 = "0pjrf705ri2cxqnvc3648ww71zgn163r4g7a3wf5zwnhsha2fmya"
 synopsis = "Greedy solver for the coin change problem"
-version = "1.0.2"
+version = "1.0.4"
 
 [color]
 dependencies = ["fmt", "records", "srfi-13"]
@@ -723,9 +723,9 @@ version = "1.2"
 [define-options]
 dependencies = ["brev-separate", "getopt-long", "matchable", "quasiwalk", "srfi-1"]
 license = "lgpl"
-sha256 = "1j9lj5kj3j8jhclxnxrrc2wn6qn9j0bhr2y9fydg05an9q7jmrh0"
+sha256 = "1cnd1gfbsnbkgj7nlcps74clsslfcbf5addji1b4v63zn3v167va"
 synopsis = "Conveniently bind to getopt-long options"
-version = "1.23"
+version = "1.24"
 
 [define-record-and-printer]
 dependencies = ["hahn", "matchable"]
@@ -1423,9 +1423,9 @@ version = "0.4"
 [ipfs]
 dependencies = ["http-client", "intarweb", "medea", "srfi-1", "srfi-13", "srfi-189", "srfi-197", "uri-common"]
 license = "unlicense"
-sha256 = "1fipsadibalrakzgai8mhxhizsy5a9jdg82x7x4r84gzjr30s327"
+sha256 = "0fip6rkpg14xbjg2nk191ib3n4lckn8ynpnvlmb7jwk356b499kz"
 synopsis = "IPFS HTTP API for Scheme"
-version = "0.0.17"
+version = "0.0.18"
 
 [irc]
 dependencies = ["matchable", "regex", "srfi-1"]
@@ -1626,9 +1626,9 @@ version = "3.4"
 [lmdb]
 dependencies = ["srfi-1"]
 license = "openldap"
-sha256 = "1ymy7ji9q7zvy8708f4zzavxkvajmq8l8m1z6v6873qkxgv6jkw8"
+sha256 = "0yr55f5sqj5ln8h0wd7ra8qrs5rv0rppqhg2px4azx1jn3mmgdl0"
 synopsis = "Bindings to LMDB"
-version = "1.0.6"
+version = "1.0.7"
 
 [locale]
 dependencies = ["srfi-1", "utf8", "check-errors"]
@@ -1763,6 +1763,13 @@ sha256 = "11q9599lqs3rb0af6sxj2lvbm06a39igpnpdp1drl8zswdw41kyk"
 synopsis = "A flonum matrix module for CHICKEN Scheme."
 version = "0.6rel"
 
+[md2]
+dependencies = ["message-digest"]
+license = "bsd"
+sha256 = "1dcqr5dh4blrd7dphhjgywdxc93f513pyhw5c086kfcs1aiw7dpb"
+synopsis = "Message Digest 2 algorithm as defined in RFC1319"
+version = "1.3"
+
 [md5]
 dependencies = ["message-digest-primitive"]
 license = "public-domain"
@@ -2004,9 +2011,9 @@ version = "5.1.0"
 [number-limits]
 dependencies = []
 license = "bsd"
-sha256 = "134958zarw74yrxn97sixmm987b047p7izppc0cxx9rlviq145hd"
+sha256 = "1xw11mnvcwqqnjhljbpsn7966w3kqaygr3dcqqv6fkfxgccb811z"
 synopsis = "Limit constants for numbers"
-version = "3.0.8"
+version = "3.0.9"
 
 [oauth]
 dependencies = ["srfi-1", "srfi-13", "uri-common", "intarweb", "http-client", "hmac", "sha1", "base64"]
@@ -2099,6 +2106,13 @@ sha256 = "1dywjbim23k12fcvdiypq2g5p8wyljgq7zmsvlf8h2anaaq34sm1"
 synopsis = ""
 version = "0.3"
 
+[pbkdf2]
+dependencies = ["message-digest", "hmac", "sha2", "sha1", "md5", "md2"]
+license = "bsd"
+sha256 = "031yfdg33ypiyvqcd58paxfrmxy5j0nksjy7c2hgxrmz4q3dsb48"
+synopsis = "Password-Based Key Derivation Function as defined in RFC2898"
+version = "1.3"
+
 [pdf]
 dependencies = ["srfi-1", "regex", "format"]
 license = "bsd"
@@ -2550,9 +2564,9 @@ version = "1.8"
 [scm2wiki]
 dependencies = ["srfi-1", "srfi-13", "srfi-14", "args", "comparse"]
 license = "mit"
-sha256 = "03mc88pri6c3h5r5z3xz771mdarc0a6iv4x691jlq6chs983x13v"
+sha256 = "0q3w1i5ikn1hla4vy8g1374yh5ym9dh0fwm4pip8ffpdlhsbm571"
 synopsis = "An auto-documentation tool for CHICKEN Scheme."
-version = "0.3.3"
+version = "0.6.0"
 
 [scmfmt]
 dependencies = []
@@ -3194,9 +3208,9 @@ version = "0.1.7"
 [srfi-180]
 dependencies = ["srfi-34", "srfi-35", "srfi-158"]
 license = "bsd"
-sha256 = "1sxyhd4kzhlg0p3a1fzrxkqn7amhd8vb89ql4ykssrknmc9svmvd"
+sha256 = "14y763q74hrk9lgb21bdymcjinfd9bvf2q4kqm7vzay7ayghhc3x"
 synopsis = "A JSON parser and printer that supports JSON bigger than memory."
-version = "1.5.2"
+version = "1.6.1"
 
 [srfi-189]
 dependencies = ["srfi-1", "typed-records"]
@@ -3219,6 +3233,13 @@ sha256 = "18raq9r8nvs6dvb9fq7095bi9sxh655pjs4k7jwj486369jn90di"
 synopsis = "SRFI 193: Command line"
 version = "0.1.3"
 
+[srfi-194]
+dependencies = ["r7rs", "srfi-133", "srfi-27", "srfi-158"]
+license = "mit"
+sha256 = "1h5zyiqxh0zflh622fp151i88xglz12kzrvsakdrcljga3k1s6ww"
+synopsis = "Random data generators"
+version = "1.0.0"
+
 [srfi-196]
 dependencies = ["srfi-1", "srfi-133", "typed-records", "utf8"]
 license = "mit"
@@ -3282,6 +3303,13 @@ sha256 = "0vrpgqdmwdaphy0szskxyl2x6xhwycgvi6flwi5v6m2zi5cd3j1c"
 synopsis = "SRFI 227: Optional Arguments"
 version = "1.1"
 
+[srfi-228]
+dependencies = ["r7rs", "srfi-1", "srfi-128", "srfi-151"]
+license = "mit"
+sha256 = "1psh5ha8r7ryp26pkbv8yvvpy8x6lf5l7607npbjac0k8vr2jwrn"
+synopsis = "Composing Comparators"
+version = "1.0.0"
+
 [srfi-232]
 dependencies = ["srfi-1"]
 license = "mit"
@@ -3296,6 +3324,13 @@ sha256 = "0vf6f0f6jm4frpz995kxjzydg3p7vjn58shmv6s2p34hmfsjcm04"
 synopsis = "Multidimensional arrays"
 version = "1.3"
 
+[srfi-252]
+dependencies = ["r7rs", "srfi-1", "srfi-64", "srfi-158", "srfi-194", "srfi-143", "srfi-144"]
+license = "mit"
+sha256 = "0r1kxw29yjz941mbgmkgj66w7l8zh09mm69gqnhsl6h1hqb2wkbg"
+synopsis = "Property Testing"
+version = "1.0.0"
+
 [srfi-253]
 dependencies = ["r7rs"]
 license = "mit"
@@ -3303,6 +3338,13 @@ sha256 = "1b7lrsv5fhl9s3swz0abfx3y2wqrk07n3fwhymg9cz3908cjqms3"
 synopsis = "SRFI 253: Data (Type-)Checking"
 version = "0.1.0"
 
+[srfi-259]
+dependencies = ["r7rs", "integer-map"]
+license = "mit"
+sha256 = "1zlblib4k0gz40yazx2nxacspgkgcngsfk1lb5rv8kd0d3l8ckfk"
+synopsis = "Tagged procedures with type safety"
+version = "0.10.0"
+
 [srfi-27]
 dependencies = ["srfi-1", "vector-lib", "timed-resource", "miscmacros", "check-errors"]
 license = "bsd"
@@ -3579,9 +3621,9 @@ version = "1.39"
 [stty]
 dependencies = ["foreigners", "srfi-69"]
 license = "bsd"
-sha256 = "195qkj1ckji115ih9ccfsn52hg8cbbwn19vblcggv3g0xmpncdak"
+sha256 = "0pdry1874iswsm1bq1q38xv2ijf6hq9pwxisapgifjw0wgcld3i0"
 synopsis = "stty-style interface to termios"
-version = "0.6"
+version = "0.7"
 
 [sundials]
 dependencies = ["srfi-1", "srfi-69", "srfi-13", "compile-file"]
@@ -3593,9 +3635,9 @@ version = "2.17"
 [svgpath]
 dependencies = ["brev-separate", "clojurian", "match-generics", "miscmacros", "srfi-1", "srfi-69", "strse", "sxpath", "tree"]
 license = "lgpl"
-sha256 = "0017w5vc9qpz5gcghhlsw6fzla2vxkvykm9rvriiqm9zywq48wlh"
+sha256 = "1sp8v2cvlpjm3kjgaw5g73fszx71drzjcxrfbd38kg30xnd32jn3"
 synopsis = "Parse, normalize, and write SVG path data"
-version = "1.7"
+version = "1.15"
 
 [svn-client]
 dependencies = []
@@ -3649,9 +3691,9 @@ version = "1.0"
 [symbol-utils]
 dependencies = ["utf8"]
 license = "bsd"
-sha256 = "0sw95b9487i9sr27zxnl3f6f07wrrpzx3g75q32yk2v79q898kd8"
+sha256 = "1234p97sagl4bn1rgkrvp7xn22m6qrisnnpabmf51a6zn6ffj286"
 synopsis = "Symbol Utilities"
-version = "2.6.1"
+version = "2.6.2"
 
 [synch]
 dependencies = ["srfi-18", "check-errors"]
@@ -3726,9 +3768,9 @@ version = "0.0.6"
 [test-new-egg]
 dependencies = ["henrietta-cache", "salmonella", "srfi-1"]
 license = "bsd"
-sha256 = "01m7bi646f0ypv5j1zpsw16fk4rzw3lmycxlhkzzb11ghlgl2vqq"
+sha256 = "1ghcwf3i598bznkdxx3xprsfwkbqbyvf3l077z9jh2x1jdsvgfas"
 synopsis = "A tool to test new eggs before they are added to the official CHICKEN repository"
-version = "1.0.4"
+version = "1.0.5"
 
 [test-utils]
 dependencies = ["test"]
@@ -3810,9 +3852,9 @@ version = "2.0"
 [transducers]
 dependencies = ["r7rs", "srfi-1", "srfi-128", "srfi-133", "srfi-143", "srfi-146", "srfi-160", "srfi-253"]
 license = "mit"
-sha256 = "1ncbx703w0iwpsh2d302zlw6brajjdjravcp7y4cf3zk6rd3xfrd"
+sha256 = "0fyypwr9syd3iwhwayglff2rg6xsc4w3hcaz4k6ldm2y2f16g7yv"
 synopsis = "Transducers for working with foldable data types."
-version = "0.7.0"
+version = "0.7.1"
 
 [transmission]
 dependencies = ["http-client", "intarweb", "medea", "r7rs", "srfi-1", "srfi-189", "uri-common"]
@@ -4017,6 +4059,13 @@ sha256 = "1fj8swh4s4gwif2dp59ls0vbdi2d5w50b2q2q00yiyvlr7smm4hs"
 synopsis = "named standard colors as available in X11"
 version = "1.1"
 
+[xdg-basedir]
+dependencies = []
+license = "bsd"
+sha256 = "0ck91mxsyyrsdmxx3gi6p0dg1i9y5z9g77kvh6y0x20d0s3ymv0w"
+synopsis = "Implementation of the XDG Base Directory Specification"
+version = "1.0.0"
+
 [xj]
 dependencies = ["fmt", "html-parser", "srfi-1", "utf8", "brev-separate"]
 license = "bsd-3-clause"

pkgs/development/haskell-modules/configuration-hackage2nix/main.yaml

@@ -238,9 +238,6 @@ package-maintainers:
     - xmonad-contrib
   erictapen:
     - hakyll
-  evenbrenden:
-    - unleash-client-haskell
-    - unleash-client-haskell-core
   Gabriella439:
     - annah
     - bench

pkgs/development/libraries/nss/latest.nix

@@ -5,6 +5,6 @@
 #       Example: nix-shell ./maintainers/scripts/update.nix --argstr package cacert
 
 import ./generic.nix {
-  version = "3.110";
-  hash = "sha256-OA2nBAbGLgTeEo2RfK335UoCfQM0lXpnOtoyFCLb84g=";
+  version = "3.111";
+  hash = "sha256-GFtoSvLF5nAwBIiMa9CeEl5geAOK60gG2tjuQFubgYs=";
 }

pkgs/development/python-modules/gpu-rir/default.nix

@@ -0,0 +1,83 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+
+  # build-system
+  cmake,
+  setuptools,
+
+  # nativeBuildInputs
+  autoAddDriverRunpath,
+  cudaPackages,
+
+  # dependencies
+  numpy,
+  scipy,
+}:
+
+buildPythonPackage {
+  pname = "gpu-rir";
+  version = "0-unstable-2025-01-20";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "DavidDiazGuerra";
+    repo = "gpuRIR";
+    rev = "fd8af43a4a113d3c2c05f0085a0119ecb1f1a484";
+    hash = "sha256-nYi91iaNb9gswYzXW7aNpD3yYIgMvTen9r02G4d6joo=";
+  };
+
+  # Inject cmakeFlags in the cmake call
+  postPatch = ''
+    substituteInPlace setup.py \
+      --replace-fail \
+        "cmake_args = [" \
+        "cmake_args = os.environ.get('cmakeFlags', \"\").split() + ["
+  '';
+
+  build-system = [
+    cmake
+    setuptools
+  ];
+  dontUseCmakeConfigure = true;
+
+  nativeBuildInputs = [
+    autoAddDriverRunpath
+    cudaPackages.cuda_nvcc
+  ];
+
+  # TODO: Investigate why (deprecated) FindCUDA fails to set these variables
+  cmakeFlags = [
+    (lib.cmakeFeature "CUDA_CUFFT_LIBARIES" "${lib.getLib cudaPackages.libcufft}/lib/libcufft.so")
+    (lib.cmakeFeature "CUDA_curand_LIBRARY" "${lib.getLib cudaPackages.libcurand}/lib/libcurand.so")
+  ];
+
+  buildInputs = with cudaPackages; [
+    cuda_cccl # <nv/target>
+    cuda_cudart # cuda_runtime.h
+    libcufft
+    libcurand
+  ];
+
+  dependencies = [
+    numpy
+    scipy
+  ];
+
+  pythonImportsCheck = [ "gpuRIR" ];
+  # Fails at import because there is no GPU access in the sandbox:
+  # Check whether the following modules can be imported: gpuRIR
+  # GPUassert: CUDA driver version is insufficient for CUDA runtime version /build/source/src/gpuRIR_cuda.cu 1037
+  dontUsePythonImportsCheck = true;
+
+  # No tests
+  doCheck = false;
+
+  meta = {
+    description = "Python library for Room Impulse Response (RIR) simulation with GPU acceleration";
+    homepage = "https://github.com/DavidDiazGuerra/gpuRIR";
+    license = lib.licenses.agpl3Only;
+    maintainers = with lib.maintainers; [ GaetanLepage ];
+  };
+}

pkgs/development/python-modules/pytest-postgresql/default.nix

@@ -1,5 +1,6 @@
 {
   lib,
+  stdenv,
   buildPythonPackage,
   fetchFromGitHub,
   pytestCheckHook,
@@ -62,7 +63,9 @@ buildPythonPackage rec {
     "pytest_postgresql.executor"
   ];
 
-  __darwinAllowLocalNetworking = true;
+  # Can't reliably run checkPhase on darwin because of nix bug, see:
+  #  https://github.com/NixOS/nixpkgs/issues/371242
+  doCheck = !stdenv.buildPlatform.isDarwin;
 
   meta = {
     homepage = "https://pypi.python.org/pypi/pytest-postgresql";

pkgs/development/python-modules/textual/default.nix

@@ -29,14 +29,14 @@
 
 buildPythonPackage rec {
   pname = "textual";
-  version = "3.1.1";
+  version = "3.2.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "Textualize";
     repo = "textual";
     tag = "v${version}";
-    hash = "sha256-emF6LpjVCgxC+Cf+LhFrawc3rxfMnZtyijmoVg0ZJbQ=";
+    hash = "sha256-kPu8qjIbsSOgIdBTubjz6gR58Myu2ioWdpzk5LEedU4=";
   };
 
   build-system = [ poetry-core ];

pkgs/development/python-modules/unblob-native/default.nix

@@ -1,46 +0,0 @@
-{
-  lib,
-  stdenvNoCC,
-  buildPythonPackage,
-  fetchFromGitHub,
-  nix-update-script,
-  rustPlatform,
-  libiconv,
-}:
-
-buildPythonPackage rec {
-  pname = "unblob-native";
-  version = "0.1.6";
-  pyproject = true;
-
-  src = fetchFromGitHub {
-    owner = "onekey-sec";
-    repo = "unblob-native";
-    tag = "v${version}";
-    hash = "sha256-11eMU7eplvZS1OS34fhbD8g1dOwOUCc8Xk1dEZI8dyU=";
-  };
-
-  cargoDeps = rustPlatform.fetchCargoVendor {
-    inherit pname version src;
-    hash = "sha256-NjyxAZH4A46llIjEQO0X+IiwpS74RPY9wLujsDr7OxA=";
-  };
-
-  nativeBuildInputs = with rustPlatform; [
-    maturinBuildHook
-    cargoSetupHook
-  ];
-
-  buildInputs = lib.optionals stdenvNoCC.hostPlatform.isDarwin [ libiconv ];
-
-  pythonImportsCheck = [ "unblob_native" ];
-
-  passthru.updateScript = nix-update-script { };
-
-  meta = {
-    description = "Performance sensitive parts of Unblob";
-    homepage = "https://unblob.org";
-    license = lib.licenses.mit;
-    platforms = lib.platforms.unix;
-    maintainers = with lib.maintainers; [ vlaci ];
-  };
-}

pkgs/os-specific/linux/zfs/2_3.nix

@@ -15,10 +15,10 @@ callPackage ./generic.nix args {
   # this attribute is the correct one for this package.
   kernelModuleAttribute = "zfs_2_3";
   # check the release notes for compatible kernels
-  kernelCompatible = kernel: kernel.kernelOlder "6.14";
+  kernelCompatible = kernel: kernel.kernelOlder "6.15";
 
   # this package should point to the latest release.
-  version = "2.3.1";
+  version = "2.3.2";
 
   tests = {
     inherit (nixosTests.zfs) installer series_2_3;
@@ -29,5 +29,5 @@ callPackage ./generic.nix args {
     amarshall
   ];
 
-  hash = "sha256-3WrxjIMuPiqBcVX4UZHpcMWNqxBE2NS810SRmvi05ZQ=";
+  hash = "sha256-+DqpIgHCVi0fDOqvKwaGXIiiXw8xEnlv2tgRwgLX9G8=";
 }

pkgs/os-specific/linux/zfs/unstable.nix

@@ -14,20 +14,20 @@ callPackage ./generic.nix args {
   # this attribute is the correct one for this package.
   kernelModuleAttribute = "zfs_unstable";
   # check the release notes for compatible kernels
-  kernelCompatible = kernel: kernel.kernelOlder "6.14";
+  kernelCompatible = kernel: kernel.kernelOlder "6.15";
 
   # this package should point to a version / git revision compatible with the latest kernel release
   # IMPORTANT: Always use a tagged release candidate or commits from the
   # zfs-<version>-staging branch, because this is tested by the OpenZFS
   # maintainers.
-  version = "2.3.1";
+  version = "2.3.2";
   # rev = "";
 
   tests = {
     inherit (nixosTests.zfs) unstable;
   };
 
-  hash = "sha256-3WrxjIMuPiqBcVX4UZHpcMWNqxBE2NS810SRmvi05ZQ=";
+  hash = "sha256-+DqpIgHCVi0fDOqvKwaGXIiiXw8xEnlv2tgRwgLX9G8=";
 
   extraLongDescription = ''
     This is "unstable" ZFS, and will usually be a pre-release version of ZFS.

pkgs/top-level/python-aliases.nix

@@ -772,6 +772,7 @@ mapAliases ({
   types-paramiko = throw "types-paramiko has been removed because it was unused."; # added 2022-05-30
   ufoLib2 = ufolib2; # added 2024-01-07
   ukrainealarm = throw "ukrainealarm has been removed, as it has been replaced as a home-assistant dependency by uasiren."; # added 2024-01-05
+  unblob-native = throw "unblob-native has been removed because its functionality is merged into unblob 25.4.14."; # Added 2025-05-02
   unittest2 = throw "unittest2 has been removed as it's a backport of unittest that's unmaintained and not needed beyond Python 3.4."; # added 2022-12-01
   update_checker = update-checker; # added 2024-01-07
   uproot3 = throw "uproot3 has been removed, use uproot instead"; # added 2022-12-13

pkgs/top-level/python-packages.nix

@@ -5903,6 +5903,8 @@ self: super: with self; {
 
   gptcache = callPackage ../development/python-modules/gptcache { };
 
+  gpu-rir = callPackage ../development/python-modules/gpu-rir { };
+
   gpuctypes = callPackage ../development/python-modules/gpuctypes { };
 
   gpustat = callPackage ../development/python-modules/gpustat { };
@@ -18318,8 +18320,6 @@ self: super: with self; {
 
   unasync = callPackage ../development/python-modules/unasync { };
 
-  unblob-native = callPackage ../development/python-modules/unblob-native { };
-
   uncertainties = callPackage ../development/python-modules/uncertainties { };
 
   uncompyle6 = callPackage ../development/python-modules/uncompyle6 { };