Merge 0966d21d79 into haskell-updates

.git-blame-ignore-revs

@@ -288,3 +288,6 @@ b4532efe93882ae2e3fc579929a42a5a56544146
 # nixfmt 1.0.0
 62fe01651911043bd3db0add920af3d2935d9869 # !autorebase nix-shell --run treefmt
 5a0711127cd8b916c3d3128f473388c8c79df0da # !autorebase nix-shell --run treefmt
+
+# systemd: nixfmt
+b1c5cd3e794cdf89daa5e4f0086274a416a1cded

.github/labeler.yml

@@ -28,6 +28,7 @@
               - nixos/modules/services/x11/desktop-managers/cinnamon.nix
               - nixos/tests/cinnamon.nix
               - nixos/tests/cinnamon-wayland.nix
+              - pkgs/by-name/ci/cinnamon/**/*
               - pkgs/by-name/ci/cinnamon-*/**/*
               - pkgs/by-name/cj/cjs/**/*
               - pkgs/by-name/mu/muffin/**/*

doc/module-system/module-system.chapter.md

@@ -116,6 +116,16 @@ A nominal type marker, always `"configuration"`.
 
 The [`class` argument](#module-system-lib-evalModules-param-class).
 
+#### `graph` {#module-system-lib-evalModules-return-value-graph}
+
+Represents all the modules that took part in the evaluation.
+It is a list of `ModuleGraph` where `ModuleGraph` is defined as an attribute set with the following attributes:
+
+- `key`: `string` for the purpose of module deduplication and `disabledModules`
+- `file`: `string` for the purpose of error messages and warnings
+- `imports`: `[ ModuleGraph ]`
+- `disabled`: `bool`
+
 ## Module arguments {#module-system-module-arguments}
 
 Module arguments are the attribute values passed to modules when they are evaluated.

doc/redirects.json

@@ -487,6 +487,9 @@
   "module-system-lib-evalModules-return-value-_configurationClass": [
     "index.html#module-system-lib-evalModules-return-value-_configurationClass"
   ],
+  "module-system-lib-evalModules-return-value-graph": [
+    "index.html#module-system-lib-evalModules-return-value-graph"
+  ],
   "part-stdenv": [
     "index.html#part-stdenv"
   ],

lib/modules.nix

@@ -245,25 +245,26 @@ let
         };
       };
 
-      merged =
-        let
-          collected =
-            collectModules class (specialArgs.modulesPath or "") (regularModules ++ [ internalModule ])
-              (
-                {
-                  inherit
-                    lib
-                    options
-                    specialArgs
-                    ;
-                  _class = class;
-                  _prefix = prefix;
-                  config = addErrorContext "if you get an infinite recursion here, you probably reference `config` in `imports`. If you are trying to achieve a conditional import behavior dependent on `config`, consider importing unconditionally, and using `mkEnableOption` and `mkIf` to control its effect." config;
-                }
-                // specialArgs
-              );
-        in
-        mergeModules prefix (reverseList collected);
+      # This function takes an empty attrset as an argument.
+      # It could theoretically be replaced with its body,
+      # but such a binding is avoided to allow for earlier grabage collection.
+      doCollect =
+        { }:
+        collectModules class (specialArgs.modulesPath or "") (regularModules ++ [ internalModule ]) (
+          {
+            inherit
+              lib
+              options
+              specialArgs
+              ;
+            _class = class;
+            _prefix = prefix;
+            config = addErrorContext "if you get an infinite recursion here, you probably reference `config` in `imports`. If you are trying to achieve a conditional import behavior dependent on `config`, consider importing unconditionally, and using `mkEnableOption` and `mkIf` to control its effect." config;
+          }
+          // specialArgs
+        );
+
+      merged = mergeModules prefix (reverseList (doCollect { }).modules);
 
       options = merged.matchedOptions;
 
@@ -359,12 +360,13 @@ let
         options = checked options;
         config = checked (removeAttrs config [ "_module" ]);
         _module = checked (config._module);
+        inherit (doCollect { }) graph;
         inherit extendModules type class;
       };
     in
     result;
 
-  # collectModules :: (class: String) -> (modulesPath: String) -> (modules: [ Module ]) -> (args: Attrs) -> [ Module ]
+  # collectModules :: (class: String) -> (modulesPath: String) -> (modules: [ Module ]) -> (args: Attrs) -> ModulesTree
   #
   # Collects all modules recursively through `import` statements, filtering out
   # all modules in disabledModules.
@@ -424,8 +426,37 @@ let
         else
           m: m;
 
+      # isDisabled :: String -> [ { disabled, file } ] -> StructuredModule -> bool
+      #
+      # Figures out whether a `StructuredModule` is disabled.
+      isDisabled =
+        modulesPath: disabledList:
+        let
+          moduleKey =
+            file: m:
+            if isString m then
+              if substring 0 1 m == "/" then m else toString modulesPath + "/" + m
+
+            else if isConvertibleWithToString m then
+              if m ? key && m.key != toString m then
+                throw "Module `${file}` contains a disabledModules item that is an attribute set that can be converted to a string (${toString m}) but also has a `.key` attribute (${m.key}) with a different value. This makes it ambiguous which module should be disabled."
+              else
+                toString m
+
+            else if m ? key then
+              m.key
+
+            else if isAttrs m then
+              throw "Module `${file}` contains a disabledModules item that is an attribute set, presumably a module, that does not have a `key` attribute. This means that the module system doesn't have any means to identify the module that should be disabled. Make sure that you've put the correct value in disabledModules: a string path relative to modulesPath, a path value, or an attribute set with a `key` attribute."
+            else
+              throw "Each disabledModules item must be a path, string, or a attribute set with a key attribute, or a value supported by toString. However, one of the disabledModules items in `${toString file}` is none of that, but is of type ${typeOf m}.";
+
+          disabledKeys = concatMap ({ file, disabled }: map (moduleKey file) disabled) disabledList;
+        in
+        structuredModule: elem structuredModule.key disabledKeys;
+
       /**
-        Collects all modules recursively into the form
+        Collects all modules recursively into a `[ StructuredModule ]` and a list of disabled modules:
 
           {
             disabled = [ <list of disabled modules> ];
@@ -493,36 +524,32 @@ let
         modulesPath:
         { disabled, modules }:
         let
-          moduleKey =
-            file: m:
-            if isString m then
-              if substring 0 1 m == "/" then m else toString modulesPath + "/" + m
-
-            else if isConvertibleWithToString m then
-              if m ? key && m.key != toString m then
-                throw "Module `${file}` contains a disabledModules item that is an attribute set that can be converted to a string (${toString m}) but also has a `.key` attribute (${m.key}) with a different value. This makes it ambiguous which module should be disabled."
-              else
-                toString m
-
-            else if m ? key then
-              m.key
-
-            else if isAttrs m then
-              throw "Module `${file}` contains a disabledModules item that is an attribute set, presumably a module, that does not have a `key` attribute. This means that the module system doesn't have any means to identify the module that should be disabled. Make sure that you've put the correct value in disabledModules: a string path relative to modulesPath, a path value, or an attribute set with a `key` attribute."
-            else
-              throw "Each disabledModules item must be a path, string, or a attribute set with a key attribute, or a value supported by toString. However, one of the disabledModules items in `${toString file}` is none of that, but is of type ${typeOf m}.";
-
-          disabledKeys = concatMap ({ file, disabled }: map (moduleKey file) disabled) disabled;
-          keyFilter = filter (attrs: !elem attrs.key disabledKeys);
+          keyFilter = filter (attrs: !isDisabled modulesPath disabled attrs);
         in
         map (attrs: attrs.module) (genericClosure {
           startSet = keyFilter modules;
           operator = attrs: keyFilter attrs.modules;
         });
 
+      toGraph =
+        modulesPath:
+        { disabled, modules }:
+        let
+          isDisabledModule = isDisabled modulesPath disabled;
+
+          toModuleGraph = structuredModule: {
+            disabled = isDisabledModule structuredModule;
+            inherit (structuredModule) key;
+            file = structuredModule.module._file;
+            imports = map toModuleGraph structuredModule.modules;
+          };
+        in
+        map toModuleGraph (filter (x: x.key != "lib/modules.nix") modules);
     in
-    modulesPath: initialModules: args:
-    filterModules modulesPath (collectStructuredModules unknownModule "" initialModules args);
+    modulesPath: initialModules: args: {
+      modules = filterModules modulesPath (collectStructuredModules unknownModule "" initialModules args);
+      graph = toGraph modulesPath (collectStructuredModules unknownModule "" initialModules args);
+    };
 
   /**
     Wrap a module with a default location for reporting errors.

lib/tests/modules.sh

@@ -20,6 +20,10 @@ cd "$DIR"/modules
 pass=0
 fail=0
 
+local-nix-instantiate() {
+    nix-instantiate --timeout 1 --eval-only --show-trace --read-write-mode --json "$@"
+}
+
 # loc
 #   prints the location of the call of to the function that calls it
 # loc n
@@ -55,7 +59,7 @@ evalConfig() {
     local attr=$1
     shift
     local script="import ./default.nix { modules = [ $* ];}"
-    nix-instantiate --timeout 1 -E "$script" -A "$attr" --eval-only --show-trace --read-write-mode --json
+    local-nix-instantiate -E "$script" -A "$attr"
 }
 
 reportFailure() {
@@ -106,6 +110,20 @@ globalErrorLogCheck() {
       }
 }
 
+checkExpression() {
+  local path=$1
+  local output
+  {
+      output="$(local-nix-instantiate --strict "$path" 2>&1)" && ((++pass))
+  } || {
+      logStartFailure
+      echo "$output"
+      ((++fail))
+      logFailure
+      logEndFailure
+  }
+}
+
 checkConfigError() {
     local errorContains=$1
     local err=""
@@ -337,6 +355,9 @@ checkConfigOutput '^12$' config.value ./declare-coerced-value-unsound.nix
 checkConfigError 'A definition for option .* is not of type .*. Definition values:\n\s*- In .*: "1000"' config.value ./declare-coerced-value-unsound.nix ./define-value-string-bigint.nix
 checkConfigError 'toInt: Could not convert .* to int' config.value ./declare-coerced-value-unsound.nix ./define-value-string-arbitrary.nix
 
+# Check `graph` attribute
+checkExpression './graph/test.nix'
+
 # Check mkAliasOptionModule.
 checkConfigOutput '^true$' config.enable ./alias-with-priority.nix
 checkConfigOutput '^true$' config.enableAlias ./alias-with-priority.nix

lib/tests/modules/graph/a.nix

@@ -0,0 +1,8 @@
+{
+  imports = [
+    {
+      imports = [ { } ];
+    }
+  ];
+  disabledModules = [ ./b.nix ];
+}

lib/tests/modules/graph/b.nix

@@ -0,0 +1,3 @@
+args: {
+  imports = [ { key = "explicit-key"; } ];
+}

lib/tests/modules/graph/test.nix

@@ -0,0 +1,64 @@
+let
+  lib = import ../../..;
+
+  evaluation = lib.evalModules {
+    modules = [
+      { }
+      (args: { })
+      ./a.nix
+      ./b.nix
+    ];
+  };
+
+  actual = evaluation.graph;
+
+  expected = [
+    {
+      key = ":anon-1";
+      file = "<unknown-file>";
+      imports = [ ];
+      disabled = false;
+    }
+    {
+      key = ":anon-2";
+      file = "<unknown-file>";
+      imports = [ ];
+      disabled = false;
+    }
+    {
+      key = toString ./a.nix;
+      file = toString ./a.nix;
+      imports = [
+        {
+          key = "${toString ./a.nix}:anon-1";
+          file = toString ./a.nix;
+          imports = [
+            {
+              key = "${toString ./a.nix}:anon-1:anon-1";
+              file = toString ./a.nix;
+              imports = [ ];
+              disabled = false;
+            }
+          ];
+          disabled = false;
+        }
+      ];
+      disabled = false;
+    }
+    {
+      key = toString ./b.nix;
+      file = toString ./b.nix;
+      imports = [
+        {
+          key = "explicit-key";
+          file = toString ./b.nix;
+          imports = [ ];
+          disabled = false;
+        }
+      ];
+      disabled = true;
+    }
+  ];
+in
+assert actual == expected;
+null

maintainers/maintainer-list.nix

@@ -5966,6 +5966,12 @@
     githubId = 58050402;
     name = "Jost Alemann";
   };
+  DDoSolitary = {
+    email = "DDoSolitary@gmail.com";
+    github = "DDoSolitary";
+    githubId = 25856103;
+    name = "DDoSolitary";
+  };
   dduan = {
     email = "daniel@duan.ca";
     github = "dduan";
@@ -6602,6 +6608,12 @@
     githubId = 129093;
     name = "Desmond O. Chang";
   };
+  DoctorDalek1963 = {
+    email = "dyson.dyson@icloud.com";
+    github = "DoctorDalek1963";
+    githubId = 69600500;
+    name = "Dyson Dyson";
+  };
   dod-101 = {
     email = "david.thievon@proton.me";
     github = "DOD-101";
@@ -11947,6 +11959,12 @@
     githubId = 51518420;
     name = "jitwit";
   };
+  jjacke13 = {
+    email = "vaios.k@pm.me";
+    github = "jjacke13";
+    githubId = 156372486;
+    name = "Vaios Karastathis";
+  };
   jjjollyjim = {
     email = "jamie@kwiius.com";
     github = "JJJollyjim";
@@ -16157,6 +16175,13 @@
     githubId = 318066;
     name = "Mirco Bauer";
   };
+  meenzen = {
+    name = "Samuel Meenzen";
+    email = "samuel@meenzen.net";
+    matrix = "@samuel:mnzn.dev";
+    github = "meenzen";
+    githubId = 22305878;
+  };
   megheaiulian = {
     email = "iulian.meghea@gmail.com";
     github = "megheaiulian";

maintainers/team-list.nix

@@ -309,6 +309,7 @@ with lib.maintainers;
       raphaelr
       jamiemagee
       anpin
+      meenzen
     ];
     scope = "Maintainers of the .NET build tools and packages";
     shortName = "dotnet";

nixos/doc/manual/release-notes/rl-2511.section.md

@@ -161,6 +161,8 @@
 
 - `services.dnscrypt-proxy2` gains a `package` option to specify dnscrypt-proxy package to use.
 
+- `services.nextcloud.configureRedis` now defaults to `true` in accordance with upstream recommendations to have caching for file locking. See the [upstream doc](https://docs.nextcloud.com/server/31/admin_manual/configuration_files/files_locking_transactional.html) for further details.
+
 - `services.gitea` supports sending notifications with sendmail again. To do this, activate the parameter `services.gitea.mailerUseSendmail` and configure SMTP server.
 
 - `libvirt` now supports using `nftables` backend.

nixos/lib/test-driver/src/test_driver/machine/ocr.py

@@ -12,10 +12,7 @@ def perform_ocr_on_screenshot(screenshot_path: Path) -> str:
     Perform OCR on a screenshot that contains text.
     Returns a string with all words that could be found.
     """
-    variants = perform_ocr_variants_on_screenshot(screenshot_path, False)[0]
-    if len(variants) != 1:
-        raise MachineError(f"Received wrong number of OCR results: {len(variants)}")
-    return variants[0]
+    return perform_ocr_variants_on_screenshot(screenshot_path, False)[0]
 
 
 def perform_ocr_variants_on_screenshot(

nixos/modules/config/resolvconf.nix

@@ -174,8 +174,6 @@ in
 
       networking.resolvconf.subscriberFiles = [ "/etc/resolv.conf" ];
 
-      networking.resolvconf.package = pkgs.openresolv;
-
       environment.systemPackages = [ cfg.package ];
 
       systemd.services.resolvconf = {

nixos/modules/module-list.nix

@@ -1683,6 +1683,7 @@
   ./services/web-apps/simplesamlphp.nix
   ./services/web-apps/slskd.nix
   ./services/web-apps/snipe-it.nix
+  ./services/web-apps/snips-sh.nix
   ./services/web-apps/sogo.nix
   ./services/web-apps/stash.nix
   ./services/web-apps/stirling-pdf.nix

nixos/modules/services/networking/dnsmasq.nix

@@ -179,7 +179,7 @@ in
         touch ${stateDir}/dnsmasq.leases
         chown -R dnsmasq ${stateDir}
         ${lib.optionalString cfg.resolveLocalQueries "touch /etc/dnsmasq-{conf,resolv}.conf"}
-        dnsmasq --test
+        dnsmasq --test -C ${cfg.configFile}
       '';
       serviceConfig = {
         Type = "dbus";

nixos/modules/services/networking/ntp/ntpd-rs.nix

@@ -90,6 +90,49 @@ in
           ""
           "${lib.makeBinPath [ cfg.package ]}/ntp-daemon --config=${validateConfig configFile}"
         ];
+
+        CapabilityBoundingSet = [
+          "CAP_SYS_TIME"
+          "CAP_NET_BIND_SERVICE"
+        ];
+        AmbientCapabilities = [
+          "CAP_SYS_TIME"
+          "CAP_NET_BIND_SERVICE"
+        ];
+        LimitCORE = 0;
+        LimitNOFILE = 65535;
+        LockPersonality = true;
+        MemorySwapMax = 0;
+        MemoryZSwapMax = 0;
+        PrivateTmp = true;
+        ProcSubset = "pid";
+        ProtectControlGroups = true;
+        ProtectHome = true;
+        ProtectHostname = true;
+        ProtectKernelLogs = true;
+        ProtectKernelModules = true;
+        ProtectKernelTunables = true;
+        ProtectProc = "invisible";
+        ProtectSystem = "strict";
+        Restart = "on-failure";
+        RestartSec = "10s";
+        RestrictAddressFamilies = [
+          "AF_INET"
+          "AF_INET6"
+          "AF_UNIX"
+          "AF_NETLINK"
+        ];
+        RestrictNamespaces = true;
+        RestrictRealtime = true;
+        SystemCallArchitectures = "native";
+        SystemCallFilter = [
+          "@system-service"
+          "@resources"
+          "@network-io"
+          "@clock"
+        ];
+        NoNewPrivileges = true;
+        UMask = "0077";
       };
     };
 
@@ -103,6 +146,44 @@ in
           ""
           "${lib.makeBinPath [ cfg.package ]}/ntp-metrics-exporter --config=${validateConfig configFile}"
         ];
+
+        CapabilityBoundingSet = [ ];
+        LimitCORE = 0;
+        LimitNOFILE = 65535;
+        LockPersonality = true;
+        MemorySwapMax = 0;
+        MemoryZSwapMax = 0;
+        PrivateTmp = true;
+        ProcSubset = "pid";
+        ProtectClock = true;
+        ProtectControlGroups = true;
+        ProtectHome = true;
+        ProtectHostname = true;
+        ProtectKernelLogs = true;
+        ProtectKernelModules = true;
+        ProtectKernelTunables = true;
+        ProtectProc = "invisible";
+        ProtectSystem = "strict";
+        PrivateDevices = true;
+        RestrictSUIDSGID = true;
+        RemoveIPC = true;
+        RestrictAddressFamilies = [
+          "AF_INET"
+          "AF_INET6"
+          "AF_UNIX"
+        ];
+        RestrictNamespaces = true;
+        RestrictRealtime = true;
+        SystemCallArchitectures = "native";
+        SystemCallFilter = [
+          "@system-service"
+          "@network-io"
+          "~@privileged"
+          "~@resources"
+          "~@mount"
+        ];
+        NoNewPrivileges = true;
+        UMask = "0077";
       };
     };
   };

nixos/modules/services/networking/tailscale-derper.nix

@@ -82,10 +82,11 @@ in
           locations."/" = {
             proxyPass = "http://127.0.0.1:${toString cfg.port}";
             proxyWebsockets = true;
-            extraConfig = ''
-              keepalive_timeout 0;
-              proxy_buffering off;
-            '';
+            extraConfig = # nginx
+              ''
+                proxy_buffering off;
+                proxy_read_timeout 3600s;
+              '';
           };
         };
       };

nixos/modules/services/web-apps/nextcloud.nix

@@ -772,11 +772,14 @@ in
 
     configureRedis = lib.mkOption {
       type = lib.types.bool;
-      default = config.services.nextcloud.notify_push.enable;
-      defaultText = lib.literalExpression "config.services.nextcloud.notify_push.enable";
+      default = true;
       description = ''
         Whether to configure Nextcloud to use the recommended Redis settings for small instances.
 
+        ::: {.note}
+        The Nextcloud system check recommends to configure either Redis or Memcache for file lock caching.
+        :::
+
         ::: {.note}
         The `notify_push` app requires Redis to be configured. If this option is turned off, this must be configured manually.
         :::

nixos/modules/services/web-apps/snips-sh.nix

@@ -0,0 +1,159 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+let
+  inherit (lib)
+    mkOption
+    mkEnableOption
+    mkPackageOption
+    mapAttrs
+    optional
+    boolToString
+    isBool
+    mkIf
+    getExe
+    types
+    ;
+
+  cfg = config.services.snips-sh;
+in
+{
+  meta.maintainers = with lib.maintainers; [
+    isabelroses
+    NotAShelf
+  ];
+
+  options.services.snips-sh = {
+    enable = mkEnableOption "snips.sh";
+
+    package = mkPackageOption pkgs "snips-sh" {
+      example = "pkgs.snips-sh.override {withTensorflow = true;}";
+    };
+
+    stateDir = mkOption {
+      type = types.path;
+      default = "/var/lib/snips-sh";
+      description = "The state directory of the service.";
+    };
+
+    settings = mkOption {
+      type = types.submodule {
+        freeformType = types.attrsOf (
+          types.nullOr (
+            types.oneOf [
+              types.str
+              types.int
+              types.bool
+            ]
+          )
+        );
+
+        options = {
+          SNIPS_HTTP_INTERNAL = mkOption {
+            type = types.str;
+            description = "The internal HTTP address of the service";
+          };
+
+          SNIPS_SSH_INTERNAL = mkOption {
+            type = types.str;
+            description = "The internal SSH address of the service";
+          };
+        };
+      };
+
+      default = { };
+      example = {
+        SNIPS_HTTP_INTERNAL = "http://0.0.0.0:8080";
+        SNIPS_SSH_INTERNAL = "ssh://0.0.0.0:2222";
+      };
+
+      description = ''
+        The configuration of snips-sh is done through environment variables,
+        therefore you must use upper snake case (e.g. {env}`SNIPS_HTTP_INTERNAL`).
+
+        Based on the attributes passed to this config option an environment file will be generated
+        that is passed to snips-sh's systemd service.
+
+        The available configuration options can be found in
+        [self-hosting guide](https://github.com/robherley/snips.sh/blob/main/docs/self-hosting.md#configuration) to
+        find about the environment variables you can use.
+      '';
+    };
+
+    environmentFile = mkOption {
+      type = with types; nullOr path;
+      default = null;
+      example = "/etc/snips-sh.env";
+      description = ''
+        Additional environment file as defined in {manpage}`systemd.exec(5)`.
+
+        Sensitive secrets such as {env}`SNIPS_SSH_HOSTKEYPATH` and {env}`SNIPS_METRICS_STATSD`
+        may be passed to the service while avoiding potentially making them world-readable in the nix store or
+        to convert an existing non-nix installation with minimum hassle.
+
+        Note that this file needs to be available on the host on which
+        `snips-sh` is running.
+      '';
+    };
+  };
+
+  config = mkIf cfg.enable {
+    systemd = {
+      tmpfiles.settings."10-snips-sh" = {
+        "${cfg.stateDir}/data".D = {
+          mode = "0755";
+        };
+      };
+
+      services.snips-sh = {
+        wants = [ "network-online.target" ];
+        after = [ "network-online.target" ];
+        wantedBy = [ "multi-user.target" ];
+
+        environment = mapAttrs (_: v: if isBool v then boolToString v else toString v) cfg.settings;
+
+        serviceConfig = {
+          EnvironmentFile = optional (cfg.environmentFile != null) cfg.environmentFile;
+          ExecStart = getExe cfg.package;
+          LimitNOFILE = "1048576";
+          AmbientCapabilities = "CAP_NET_BIND_SERVICE";
+          WorkingDirectory = cfg.stateDir;
+          RuntimeDirectory = "snips-sh";
+          StateDirectory = "snips-sh";
+          StateDirectoryMode = "0700";
+          Restart = "always";
+
+          # hardening
+          DynamicUser = true;
+          NoNewPrivileges = true;
+          ProtectSystem = "strict";
+          ProtectHome = true;
+          ProtectHostname = true;
+          ProtectClock = true;
+          ProtectKernelLogs = true;
+          ProtectKernelModules = true;
+          ProtectKernelTunables = true;
+          ProtectControlGroups = true;
+          PrivateTmp = true;
+          PrivateDevices = true;
+          PrivateUsers = true;
+          RestrictAddressFamilies = [
+            "AF_INET"
+            "AF_INET6"
+            "AF_UNIX"
+          ];
+          RestrictNamespaces = true;
+          RestrictSUIDSGID = true;
+          SystemCallFilter = "@system-service";
+          LockPersonality = true;
+          MemoryDenyWriteExecute = true;
+          CapabilityBoundingSet = "CAP_NET_BIND_SERVICE";
+          RemoveIPC = true;
+        };
+      };
+    };
+  };
+}

nixos/modules/services/web-servers/caddy/default.nix

@@ -30,9 +30,11 @@ let
         ${optionalString (
           hostOpts.useACMEHost != null
         ) "tls ${sslCertDir}/cert.pem ${sslCertDir}/key.pem"}
-        log {
-          ${hostOpts.logFormat}
-        }
+        ${optionalString (hostOpts.logFormat != null) ''
+          log {
+            ${hostOpts.logFormat}
+          }
+        ''}
 
         ${hostOpts.extraConfig}
       }

nixos/modules/services/web-servers/caddy/vhost-options.nix

@@ -56,7 +56,7 @@ in
     };
 
     logFormat = mkOption {
-      type = types.lines;
+      type = types.nullOr types.lines;
       default = ''
         output file ${cfg.logDir}/access-${lib.replaceStrings [ "/" " " ] [ "_" "_" ] config.hostName}.log
       '';

nixos/modules/services/x11/desktop-managers/cinnamon.nix

@@ -66,7 +66,7 @@ in
 
   config = mkMerge [
     (mkIf cfg.enable {
-      services.displayManager.sessionPackages = [ pkgs.cinnamon-common ];
+      services.displayManager.sessionPackages = [ pkgs.cinnamon ];
 
       services.xserver.displayManager.lightdm.greeters.slick = {
         enable = mkDefault true;
@@ -114,7 +114,7 @@ in
       services.accounts-daemon.enable = true;
       services.system-config-printer.enable = (mkIf config.services.printing.enable (mkDefault true));
       services.dbus.packages = with pkgs; [
-        cinnamon-common
+        cinnamon
         cinnamon-screensaver
         nemo-with-extensions
         xapp
@@ -166,7 +166,7 @@ in
             desktop-file-utils
 
             # common-files
-            cinnamon-common
+            cinnamon
             cinnamon-session
             cinnamon-desktop
             cinnamon-menus
@@ -177,7 +177,7 @@ in
 
             # session requirements
             cinnamon-screensaver
-            # cinnamon-killer-daemon: provided by cinnamon-common
+            # cinnamon-killer-daemon: provided by cinnamon
             networkmanagerapplet # session requirement - also nm-applet not needed
 
             # packages
@@ -225,7 +225,7 @@ in
 
       services.orca.enable = mkDefault (notExcluded pkgs.orca);
 
-      xdg.portal.configPackages = mkDefault [ pkgs.cinnamon-common ];
+      xdg.portal.configPackages = mkDefault [ pkgs.cinnamon ];
 
       # Override GSettings schemas
       environment.sessionVariables.NIX_GSETTINGS_OVERRIDES_DIR = "${nixos-gsettings-overrides}/share/gsettings-schemas/nixos-gsettings-overrides/glib-2.0/schemas";

nixos/tests/all-tests.nix

@@ -1353,6 +1353,7 @@ in
   snapcast = runTest ./snapcast.nix;
   snapper = runTest ./snapper.nix;
   snipe-it = runTest ./web-apps/snipe-it.nix;
+  snips-sh = runTest ./snips-sh.nix;
   soapui = runTest ./soapui.nix;
   soft-serve = runTest ./soft-serve.nix;
   sogo = runTest ./sogo.nix;

nixos/tests/nextcloud/with-mysql-and-memcached.nix

@@ -23,10 +23,10 @@ runTest (
           services.nextcloud = {
             caching = {
               apcu = true;
-              redis = false;
               memcached = true;
             };
             config.dbtype = "mysql";
+            configureRedis = false;
           };
 
           services.memcached.enable = true;

nixos/tests/snips-sh.nix

@@ -0,0 +1,27 @@
+{ lib, ... }:
+{
+  name = "snips-sh";
+
+  nodes.machine = {
+    services.snips-sh = {
+      enable = true;
+      settings = {
+        SNIPS_HTTP_INTERNAL = "http://0.0.0.0:8080";
+        SNIPS_SSH_INTERNAL = "ssh://0.0.0.0:2222";
+      };
+    };
+  };
+
+  testScript = ''
+    start_all()
+
+    machine.wait_for_unit("snips-sh.service")
+    machine.wait_for_open_port(8080)
+    machine.succeed("curl --fail http://localhost:8080")
+  '';
+
+  meta.maintainers = with lib.maintainers; [
+    isabelroses
+    NotAShelf
+  ];
+}

pkgs/applications/editors/leo-editor/default.nix

@@ -10,13 +10,13 @@
 
 mkDerivation rec {
   pname = "leo-editor";
-  version = "6.8.4";
+  version = "6.8.6.1";
 
   src = fetchFromGitHub {
     owner = "leo-editor";
     repo = "leo-editor";
     rev = version;
-    sha256 = "sha256-CSugdfkAMy6VFdNdSGR+iCrK/XhwseoiMQ4mfgu4F/E=";
+    sha256 = "sha256-3ojiIjsGJpPgVSUi0QhIddqwsDxfRWxhxAQ5YmzwZiQ=";
   };
 
   dontBuild = true;

pkgs/applications/editors/vim/plugins/generated.nix

@@ -15103,6 +15103,19 @@ final: prev: {
     meta.hydraPlatforms = [ ];
   };
 
+  tiny-glimmer-nvim = buildVimPlugin {
+    pname = "tiny-glimmer.nvim";
+    version = "2025-07-01";
+    src = fetchFromGitHub {
+      owner = "rachartier";
+      repo = "tiny-glimmer.nvim";
+      rev = "60a632536e0741c9cecb892f89fbe65a270dc7c7";
+      sha256 = "0xa3ma6ps1q5766ib2iksc7bw8rpqn96llynb75njwj2kpadfcis";
+    };
+    meta.homepage = "https://github.com/rachartier/tiny-glimmer.nvim/";
+    meta.hydraPlatforms = [ ];
+  };
+
   tiny-inline-diagnostic-nvim = buildVimPlugin {
     pname = "tiny-inline-diagnostic.nvim";
     version = "2025-07-16";

pkgs/applications/editors/vim/plugins/vim-plugin-names

@@ -1159,6 +1159,7 @@ https://github.com/levouh/tint.nvim/,HEAD,
 https://github.com/tinted-theming/tinted-nvim/,HEAD,
 https://github.com/tinted-theming/tinted-vim/,HEAD,
 https://github.com/rachartier/tiny-devicons-auto-colors.nvim/,HEAD,
+https://github.com/rachartier/tiny-glimmer.nvim/,HEAD,
 https://github.com/rachartier/tiny-inline-diagnostic.nvim/,HEAD,
 https://github.com/tomtom/tinykeymap_vim/,,tinykeymap
 https://github.com/tomtom/tlib_vim/,,

pkgs/applications/editors/vscode/extensions/default.nix

@@ -902,8 +902,8 @@ let
           mktplcRef = {
             name = "catppuccin-vsc-icons";
             publisher = "catppuccin";
-            version = "1.21.0";
-            hash = "sha256-rWExJ9XJ8nKki8TP0UNLCmslw+aCm1hR2h2xxhnY9bg=";
+            version = "1.23.0";
+            hash = "sha256-jnn169toS1zaixiOrtWjgOvv3UskM13vfFcvaQEesjU=";
           };
           meta = {
             changelog = "https://marketplace.visualstudio.com/items/Catppuccin.catppuccin-vsc-icons/changelog";
@@ -1614,8 +1614,8 @@ let
         mktplcRef = {
           name = "elixir-ls";
           publisher = "JakeBecker";
-          version = "0.28.0";
-          hash = "sha256-pHLAA7i2HJC523lPotUy5Zwa3BTSTurC2BA+eevdH38=";
+          version = "0.29.2";
+          hash = "sha256-+MkKUhyma/mc5MZa0+RFty5i7rox0EARPTm/uggQj6M=";
         };
         meta = {
           changelog = "https://marketplace.visualstudio.com/items/JakeBecker.elixir-ls/changelog";

pkgs/applications/editors/vscode/extensions/llvm-vs-code-extensions.lldb-dap/default.nix

@@ -4,8 +4,8 @@ vscode-utils.buildVscodeMarketplaceExtension {
   mktplcRef = {
     name = "lldb-dap";
     publisher = "llvm-vs-code-extensions";
-    version = "0.2.15";
-    hash = "sha256-Xr/TUpte9JqdvQ8eoD0l8ztg0tR8qwX/Ju1eVU6Xc0s=";
+    version = "0.2.16";
+    hash = "sha256-q0wBPSQHy/R8z5zb3iMdapzrn7c9y9X6Ow9CXY3lwtc=";
   };
 
   meta = {

pkgs/applications/emulators/libretro/cores/dosbox-pure.nix

@@ -5,13 +5,13 @@
 }:
 mkLibretroCore {
   core = "dosbox-pure";
-  version = "0-unstable-2025-07-28";
+  version = "0-unstable-2025-08-03";
 
   src = fetchFromGitHub {
     owner = "schellingb";
     repo = "dosbox-pure";
-    rev = "4b5f6c964aa56357e19632bf73d1875c2496fdd1";
-    hash = "sha256-J1NSt2Q4+lWUVqROv5yAM/rXI5COl0FRux3xqFLw20g=";
+    rev = "935b33b892b55ab5e12a093795a6563af9eacb78";
+    hash = "sha256-19ehYyVOnYg3b1cvuznYn3zB9rhp2xULKhdFN/FKE4U=";
   };
 
   hardeningDisable = [ "format" ];

pkgs/applications/emulators/libretro/cores/fmsx.nix

@@ -5,13 +5,13 @@
 }:
 mkLibretroCore {
   core = "fmsx";
-  version = "0-unstable-2024-10-21";
+  version = "0-unstable-2025-07-31";
 
   src = fetchFromGitHub {
     owner = "libretro";
     repo = "fmsx-libretro";
-    rev = "9eb5f25df5397212a3e3088ca1a64db0740bbe5f";
-    hash = "sha256-Pac1tQvPxYETU+fYU17moBHGfjNtzZiOsOms1uFQAmE=";
+    rev = "fbe4dfc4c3e3f7eb27089def3d663a905b181845";
+    hash = "sha256-1hZQO16SDB8n1wdTP67Kpns3izg/nPGl5M7wjFDBjGc=";
   };
 
   makefile = "Makefile";

pkgs/applications/emulators/libretro/cores/genesis-plus-gx.nix

@@ -5,13 +5,13 @@
 }:
 mkLibretroCore {
   core = "genesis-plus-gx";
-  version = "0-unstable-2025-07-18";
+  version = "0-unstable-2025-08-03";
 
   src = fetchFromGitHub {
     owner = "libretro";
     repo = "Genesis-Plus-GX";
-    rev = "0cfb7a22b129f42feb3b48095871c122acf45158";
-    hash = "sha256-Fonxi2RQJ/iqSLAfun2anHCzVnM7TkJFkc8PtWkNsQY=";
+    rev = "a69c81e44a3a25e5a9254a18652eae2dad875003";
+    hash = "sha256-vjh8NxoQgGU/u8XZLLQslYSlJdlMqU5quOjyWnUm3Ig=";
   };
 
   meta = {

pkgs/applications/emulators/libretro/cores/play.nix

@@ -14,13 +14,13 @@
 }:
 mkLibretroCore {
   core = "play";
-  version = "0-unstable-2025-07-23";
+  version = "0-unstable-2025-08-04";
 
   src = fetchFromGitHub {
     owner = "jpd002";
     repo = "Play-";
-    rev = "78c184bca1063d5482cbfad924af72dd23ebbff1";
-    hash = "sha256-0n6PQqepc7xKVMf8slN9aOodzBbt7J2c68z7200q07M=";
+    rev = "c7e327b5b86bfeaf13e89440a319ee5b0c039a3d";
+    hash = "sha256-J7rCOl7vHX/2Jy/fPh8yDAf8xQc41wmkMcC9SSRqxF0=";
     fetchSubmodules = true;
   };
 

pkgs/applications/graphics/paraview/default.nix

@@ -1,137 +0,0 @@
-{
-  lib,
-  stdenv,
-  fetchFromGitLab,
-  fetchurl,
-  boost,
-  cmake,
-  ffmpeg,
-  libsForQt5,
-  gdal,
-  gfortran,
-  libXt,
-  makeWrapper,
-  ninja,
-  mpi,
-  python312,
-  tbb,
-  libGLU,
-  libGL,
-  withDocs ? true,
-}:
-
-let
-  version = "5.13.2";
-
-  docFiles = [
-    (fetchurl {
-      url = "https://www.paraview.org/paraview-downloads/download.php?submit=Download&version=v${lib.versions.majorMinor version}&type=data&os=Sources&downloadFile=ParaViewTutorial-${version}.pdf";
-      name = "Tutorial.pdf";
-      hash = "sha256-jJ6YUT2rgVExfKv900LbSO+MDQ4u73K7cBScHxWoP+g=";
-    })
-    (fetchurl {
-      url = "https://www.paraview.org/paraview-downloads/download.php?submit=Download&version=v${lib.versions.majorMinor version}&type=data&os=Sources&downloadFile=ParaViewGettingStarted-${version}.pdf";
-      name = "GettingStarted.pdf";
-      hash = "sha256-ptPQA8By8Hj0qI5WRtw3ZhklelXeYeJwVaUdfd6msJM=";
-    })
-    (fetchurl {
-      url = "https://www.paraview.org/paraview-downloads/download.php?submit=Download&version=v${lib.versions.majorMinor version}&type=data&os=Sources&downloadFile=ParaViewCatalystGuide-${version}.pdf";
-      name = "CatalystGuide.pdf";
-      hash = "sha256-Pl7X5cBj3OralkOw5A29CtXnA+agYr6kWHf/+KZNHow=";
-    })
-  ];
-
-in
-stdenv.mkDerivation rec {
-  pname = "paraview";
-  inherit version;
-
-  src = fetchFromGitLab {
-    domain = "gitlab.kitware.com";
-    owner = "paraview";
-    repo = "paraview";
-    rev = "v${version}";
-    hash = "sha256-29PLXVpvj8RLkSDWQgj5QjBZ6l1/0NoVx/qcJXOSssU=";
-    fetchSubmodules = true;
-  };
-
-  # Find the Qt platform plugin "minimal"
-  preConfigure = ''
-    export QT_PLUGIN_PATH=${libsForQt5.qtbase.bin}/${libsForQt5.qtbase.qtPluginPrefix}
-  '';
-
-  cmakeFlags = [
-    "-DPARAVIEW_ENABLE_FFMPEG=ON"
-    "-DPARAVIEW_ENABLE_GDAL=ON"
-    "-DPARAVIEW_ENABLE_MOTIONFX=ON"
-    "-DPARAVIEW_ENABLE_VISITBRIDGE=ON"
-    "-DPARAVIEW_ENABLE_XDMF3=ON"
-    "-DPARAVIEW_INSTALL_DEVELOPMENT_FILES=ON"
-    "-DPARAVIEW_USE_MPI=ON"
-    "-DPARAVIEW_USE_PYTHON=ON"
-    "-DVTK_SMP_IMPLEMENTATION_TYPE=TBB"
-    "-DVTKm_ENABLE_MPI=ON"
-    "-DCMAKE_INSTALL_LIBDIR=lib"
-    "-DCMAKE_INSTALL_INCLUDEDIR=include"
-    "-DCMAKE_INSTALL_BINDIR=bin"
-    "-DOpenGL_GL_PREFERENCE=GLVND"
-    "-GNinja"
-  ];
-
-  nativeBuildInputs = [
-    cmake
-    makeWrapper
-    ninja
-    gfortran
-    libsForQt5.wrapQtAppsHook
-  ];
-
-  buildInputs = [
-    libGLU
-    libGL
-    libXt
-    mpi
-    tbb
-    boost
-    ffmpeg
-    gdal
-    libsForQt5.qtbase
-    libsForQt5.qtx11extras
-    libsForQt5.qttools
-    libsForQt5.qtxmlpatterns
-    libsForQt5.qtsvg
-  ];
-
-  postInstall =
-    let
-      docDir = "$out/share/paraview-${lib.versions.majorMinor version}/doc";
-    in
-    lib.optionalString withDocs ''
-      mkdir -p ${docDir};
-      for docFile in ${lib.concatStringsSep " " docFiles}; do
-        cp $docFile ${docDir}/$(stripHash $docFile);
-      done;
-    '';
-
-  propagatedBuildInputs = [
-    (python312.withPackages (
-      ps: with ps; [
-        numpy
-        matplotlib
-        mpi4py
-      ]
-    ))
-  ];
-
-  # 23k objects, >4h on a normal build slot
-  requiredSystemFeatures = [ "big-parallel" ];
-
-  meta = {
-    homepage = "https://www.paraview.org";
-    description = "3D Data analysis and visualization application";
-    license = lib.licenses.bsd3;
-    maintainers = with lib.maintainers; [ guibert ];
-    changelog = "https://www.kitware.com/paraview-${lib.concatStringsSep "-" (lib.versions.splitVersion version)}-release-notes";
-    platforms = lib.platforms.linux;
-  };
-}

pkgs/applications/misc/electrum/ltc.nix

@@ -70,17 +70,17 @@ python3.pkgs.buildPythonApplication {
       aiorpcx
       attrs
       bitstring
+      certifi
       cryptography
       dnspython
       jsonrpclib-pelix
       matplotlib
       pbkdf2
       protobuf
-      py-scrypt
       pysocks
       qrcode
       requests
-      certifi
+      scrypt
       # plugins
       btchip-python
       ckcc-protocol

pkgs/applications/networking/browsers/palemoon/bin.nix

@@ -23,7 +23,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "palemoon-bin";
-  version = "33.8.0";
+  version = "33.8.1.2";
 
   src = finalAttrs.passthru.sources."gtk${if withGTK3 then "3" else "2"}";
 
@@ -173,11 +173,11 @@ stdenv.mkDerivation (finalAttrs: {
       {
         gtk3 = fetchzip {
           urls = urlRegionVariants "gtk3";
-          hash = "sha256-cdPFMYlVEr6D+0mH7Mg5nGpf0KvePGLm3Y/ZytdFHHA=";
+          hash = "sha256-qgabtZ/8nBaOGP0pIXd/byd9XCxulT8w+7uczJE4SAg=";
         };
         gtk2 = fetchzip {
           urls = urlRegionVariants "gtk2";
-          hash = "sha256-dgWKmkHl5B1ri3uev63MNz/+E767ip9wJ/YzSog8vdQ=";
+          hash = "sha256-qeA8EYRY9STsezWrvlVt73fgxPB0mynkxtTV71HFMgU=";
         };
       };
 

pkgs/applications/networking/cluster/k3s/update-script.sh

@@ -61,17 +61,19 @@ fi
 cd "${NIXPKGS_K3S_PATH}/${MAJOR_VERSION}_${MINOR_VERSION}"
 
 CHARTS_URL=https://k3s.io/k3s-charts/assets
+TRAEFIK_CRD_CHART_SHA256=$(nix-hash --type sha256 --base32 --flat <(curl -o - "${CHARTS_URL}/traefik-crd/${CHART_FILES[0]}"))
+TRAEFIK_CHART_SHA256=$(nix-hash --type sha256 --base32 --flat <(curl -o - "${CHARTS_URL}/traefik/${CHART_FILES[1]}"))
 # Get metadata for both files
 rm -f chart-versions.nix.update
 cat > chart-versions.nix.update <<EOF
 {
   traefik-crd = {
     url = "${CHARTS_URL}/traefik-crd/${CHART_FILES[0]}";
-    sha256 = "$(nix-prefetch-url --quiet "${CHARTS_URL}/traefik-crd/${CHART_FILES[0]}")";
+    sha256 = "$TRAEFIK_CRD_CHART_SHA256";
   };
   traefik = {
     url = "${CHARTS_URL}/traefik/${CHART_FILES[1]}";
-    sha256 = "$(nix-prefetch-url --quiet "${CHARTS_URL}/traefik/${CHART_FILES[1]}")";
+    sha256 = "$TRAEFIK_CHART_SHA256";
   };
 }
 EOF

pkgs/applications/networking/cluster/terraform-providers/providers.json

@@ -45,13 +45,13 @@
     "vendorHash": "sha256-jZ950/nPFt3+t3CHsNEkYo7POabRCHVvcfu04Iq3cJc="
   },
   "akamai": {
-    "hash": "sha256-JALEVzmBVmHtCG4B1jNeNdSWb+SGZWDSZgUQ5voMQPg=",
+    "hash": "sha256-pXBQikG5yjCPj/Nv6+qJBv3+BpRx04CbDQo9Q9nU0o4=",
     "homepage": "https://registry.terraform.io/providers/akamai/akamai",
     "owner": "akamai",
     "repo": "terraform-provider-akamai",
-    "rev": "v8.0.0",
+    "rev": "v8.1.0",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-sf6gCPsKnBVjMsCw7ZA4BKt9GAGtAcgU7vRZN8xzN9Q="
+    "vendorHash": "sha256-WT4sjem80445Qwlr3i/OuQMujrxEKqhws1GLpvbqKaU="
   },
   "alicloud": {
     "hash": "sha256-ITu569Um+3Y7FPCBNALvePAjCCIf/3+Hu0831o7rZCU=",
@@ -570,13 +570,13 @@
     "vendorHash": null
   },
   "harbor": {
-    "hash": "sha256-KYCyqNKqW/I4q1JHVK4rD9H8/D60IL7H9cCgz6wLg5Q=",
+    "hash": "sha256-RZkXUB4Msmsm+1mQij+577d7KUrDpk50oPc2rcFevi4=",
     "homepage": "https://registry.terraform.io/providers/goharbor/harbor",
     "owner": "goharbor",
     "repo": "terraform-provider-harbor",
-    "rev": "v3.10.21",
+    "rev": "v3.10.23",
     "spdx": "MIT",
-    "vendorHash": "sha256-C1MT4mA7ubh1mN4+HO0bwMpjVHjDIG6UXZI6gvXHFZE="
+    "vendorHash": "sha256-UmlhKa2SVgrhRc1EOO9sEkherIS77CP+hkAL3Y79h3U="
   },
   "hcloud": {
     "hash": "sha256-O6GaMSL5E9t5v9nsRh7aGIXy/w04sCy7AYG4AvGsbLc=",
@@ -1309,11 +1309,11 @@
     "vendorHash": "sha256-IR6KjFW5GbsOIm3EEFyx3ctwhbifZlcNaZeGhbeK/Wo="
   },
   "sysdig": {
-    "hash": "sha256-q7HXqmvOiUktGOas9Xjt2hucxqasnPZ2O9uIn1gL1FE=",
+    "hash": "sha256-KAwuE67gNOrDDLxgbxMtub0tMa45IiIOJ9Sq9mncK4c=",
     "homepage": "https://registry.terraform.io/providers/sysdiglabs/sysdig",
     "owner": "sysdiglabs",
     "repo": "terraform-provider-sysdig",
-    "rev": "v1.58.0",
+    "rev": "v1.59.0",
     "spdx": "MPL-2.0",
     "vendorHash": "sha256-rWiafaFE1RolO9JUN1WoW4EWJjR7kpfeVEOTLf21j50="
   },

pkgs/applications/networking/mumble/default.nix

@@ -6,6 +6,7 @@
   pkg-config,
   qt5,
   cmake,
+  ninja,
   avahi,
   boost,
   libopus,
@@ -51,6 +52,7 @@ let
 
         nativeBuildInputs = [
           cmake
+          ninja
           pkg-config
           python3
           qt5.wrapQtAppsHook

pkgs/applications/video/kodi/addons/controller-topology-project/default.nix

@@ -8,13 +8,13 @@
 let
   drv = stdenv.mkDerivation rec {
     pname = "controller-topology-project";
-    version = "1.0.4";
+    version = "1.0.5";
 
     src = fetchFromGitHub {
       owner = "kodi-game";
       repo = "controller-topology-project";
       rev = "v${version}";
-      sha256 = "sha256-0h2Qbnym8XxUVao7aEN25uIKSIreutH272OiqtG4Obc=";
+      sha256 = "sha256-9NqupL/LAshME7GlzKAT6i3kx2MPEBU7Jw2nPele1W8=";
     };
 
     postPatch = ''

pkgs/build-support/dotnet/build-dotnet-module/default.nix

@@ -98,13 +98,7 @@ let
         else
           dotnet-sdk.meta.platforms;
 
-      inherit (callPackage ./hooks { inherit dotnet-sdk dotnet-runtime; })
-        dotnetConfigureHook
-        dotnetBuildHook
-        dotnetCheckHook
-        dotnetInstallHook
-        dotnetFixupHook
-        ;
+      hook = callPackage ./hook { inherit dotnet-runtime; };
 
       inherit (dotnetCorePackages) systemToDotnetRid;
     in
@@ -140,11 +134,7 @@ let
         ;
 
       nativeBuildInputs = args.nativeBuildInputs or [ ] ++ [
-        dotnetConfigureHook
-        dotnetBuildHook
-        dotnetCheckHook
-        dotnetInstallHook
-        dotnetFixupHook
+        hook
 
         cacert
         makeWrapper

pkgs/build-support/dotnet/build-dotnet-module/hook/default.nix

@@ -0,0 +1,18 @@
+{
+  lib,
+  which,
+  coreutils,
+  makeSetupHook,
+  # Passed from ../default.nix
+  dotnet-runtime,
+}:
+makeSetupHook {
+  name = "dotnet-hook";
+  substitutions = {
+    dotnetRuntime = dotnet-runtime;
+    wrapperPath = lib.makeBinPath [
+      which
+      coreutils
+    ];
+  };
+} ./dotnet-hook.sh

pkgs/build-support/dotnet/build-dotnet-module/hook/dotnet-hook.sh

@@ -0,0 +1,426 @@
+# shellcheck shell=bash
+
+dotnetConfigurePhase() {
+  echo "Executing dotnetConfigureHook"
+
+  runHook preConfigure
+
+  local -a projectFiles flags runtimeIds
+  concatTo projectFiles dotnetProjectFiles dotnetTestProjectFiles
+  concatTo flags dotnetFlags dotnetRestoreFlags
+  concatTo runtimeIds dotnetRuntimeIds
+
+  if [[ -z ${enableParallelBuilding-} ]]; then
+    flags+=(--disable-parallel)
+  fi
+
+  if [[ -v dotnetSelfContainedBuild ]]; then
+    if [[ -n $dotnetSelfContainedBuild ]]; then
+      flags+=("-p:SelfContained=true")
+    else
+      flags+=("-p:SelfContained=false")
+    fi
+  fi
+
+  dotnetRestore() {
+    local -r projectFile="${1-}"
+    for runtimeId in "${runtimeIds[@]}"; do
+      dotnet restore ${1+"$projectFile"} \
+             -p:ContinuousIntegrationBuild=true \
+             -p:Deterministic=true \
+             -p:NuGetAudit=false \
+             --runtime "$runtimeId" \
+             "${flags[@]}"
+    done
+  }
+
+  if [[ -f .config/dotnet-tools.json || -f dotnet-tools.json ]]; then
+    dotnet tool restore
+  fi
+
+  # dotnetGlobalTool is set in buildDotnetGlobalTool to patch dependencies but
+  # avoid other project-specific logic. This is a hack, but the old behavior
+  # is worse as it relied on a bug: setting projectFile to an empty string
+  # made the hooks actually skip all project-specific logic. It’s hard to keep
+  # backwards compatibility with this odd behavior now since we are using
+  # arrays, so instead we just pass a variable to indicate that we don’t have
+  # projects.
+  if [[ -z ${dotnetGlobalTool-} ]]; then
+    if (( ${#projectFiles[@]} == 0 )); then
+      dotnetRestore
+    fi
+
+    local projectFile
+    for projectFile in "${projectFiles[@]}"; do
+      dotnetRestore "$projectFile"
+    done
+  fi
+
+  runHook postConfigure
+
+  echo "Finished dotnetConfigureHook"
+}
+
+if [[ -z "${dontDotnetConfigure-}" && -z "${configurePhase-}" ]]; then
+  configurePhase=dotnetConfigurePhase
+fi
+
+dotnetBuildPhase() {
+  echo "Executing dotnetBuildHook"
+
+  runHook preBuild
+
+  local -r dotnetBuildType="${dotnetBuildType-Release}"
+
+  local -a projectFiles flags runtimeIds
+  concatTo projectFiles dotnetProjectFiles dotnetTestProjectFiles
+  concatTo flags dotnetFlags dotnetBuildFlags
+  concatTo runtimeIds dotnetRuntimeIds
+
+  if [[ -n "${enableParallelBuilding-}" ]]; then
+    local -r maxCpuFlag="$NIX_BUILD_CORES"
+    local -r parallelBuildFlag="true"
+  else
+    local -r maxCpuFlag="1"
+    local -r parallelBuildFlag="false"
+  fi
+
+  if [[ -v dotnetSelfContainedBuild ]]; then
+    if [[ -n $dotnetSelfContainedBuild ]]; then
+      flags+=("-p:SelfContained=true")
+    else
+      flags+=("-p:SelfContained=false")
+    fi
+  fi
+
+  if [[ -n ${dotnetUseAppHost-} ]]; then
+    flags+=("-p:UseAppHost=true")
+  fi
+
+  if [[ -n ${version-} ]]; then
+    flags+=("-p:InformationalVersion=$version")
+  fi
+
+  if [[ -n ${versionForDotnet-} ]]; then
+    flags+=("-p:Version=$versionForDotnet")
+  fi
+
+  dotnetBuild() {
+    local -r projectFile="${1-}"
+
+    for runtimeId in "${runtimeIds[@]}"; do
+      local runtimeIdFlags=()
+      if [[ $projectFile == *.csproj || -n ${dotnetSelfContainedBuild-} ]]; then
+        runtimeIdFlags+=("--runtime" "$runtimeId")
+      fi
+
+      dotnet build ${1+"$projectFile"} \
+             -maxcpucount:"$maxCpuFlag" \
+             -p:BuildInParallel="$parallelBuildFlag" \
+             -p:ContinuousIntegrationBuild=true \
+             -p:Deterministic=true \
+             -p:OverwriteReadOnlyFiles=true \
+             --configuration "$dotnetBuildType" \
+             --no-restore \
+             "${runtimeIdFlags[@]}" \
+             "${flags[@]}"
+    done
+  }
+
+  if (( ${#projectFiles[@]} == 0 )); then
+    dotnetBuild
+  fi
+
+  local projectFile
+  for projectFile in "${projectFiles[@]}"; do
+    dotnetBuild "$projectFile"
+  done
+
+  runHook postBuild
+
+  echo "Finished dotnetBuildHook"
+}
+
+if [[ -z ${dontDotnetBuild-} && -z ${buildPhase-} ]]; then
+  buildPhase=dotnetBuildPhase
+fi
+
+dotnetCheckPhase() {
+  echo "Executing dotnetCheckHook"
+
+  runHook preCheck
+
+  local -r dotnetBuildType="${dotnetBuildType-Release}"
+
+  local -a projectFiles testProjectFiles testFilters disabledTests flags runtimeIds runtimeDeps
+  concatTo projectFiles dotnetProjectFiles
+  concatTo testProjectFiles dotnetTestProjectFiles
+  concatTo testFilters dotnetTestFilters
+  concatTo disabledTests dotnetDisabledTests
+  concatTo flags dotnetFlags dotnetTestFlags
+  concatTo runtimeIds dotnetRuntimeIds
+  concatTo runtimeDeps dotnetRuntimeDeps
+
+  if (( ${#disabledTests[@]} > 0 )); then
+    local disabledTestsFilters=("${disabledTests[@]/#/FullyQualifiedName!=}")
+    testFilters=( "${testFilters[@]}" "${disabledTestsFilters[@]//,/%2C}" )
+  fi
+
+  if (( ${#testFilters[@]} > 0 )); then
+    local OLDIFS="$IFS" IFS='&'
+    flags+=("--filter:${testFilters[*]}")
+    IFS="$OLDIFS"
+  fi
+
+  local libraryPath="${LD_LIBRARY_PATH-}"
+  if (( ${#runtimeDeps[@]} > 0 )); then
+    local libraryPaths=("${runtimeDeps[@]/%//lib}")
+    local OLDIFS="$IFS" IFS=':'
+    libraryPath="${libraryPaths[*]}${libraryPath:+':'}$libraryPath"
+    IFS="$OLDIFS"
+  fi
+
+  if [[ -n ${enableParallelBuilding-} ]]; then
+    local -r maxCpuFlag="$NIX_BUILD_CORES"
+  else
+    local -r maxCpuFlag="1"
+  fi
+
+  local projectFile runtimeId
+  for projectFile in "${testProjectFiles[@]-${projectFiles[@]}}"; do
+    for runtimeId in "${runtimeIds[@]}"; do
+      local runtimeIdFlags=()
+      if [[ $projectFile == *.csproj ]]; then
+        runtimeIdFlags=("--runtime" "$runtimeId")
+      fi
+
+      LD_LIBRARY_PATH=$libraryPath \
+        dotnet test "$projectFile" \
+        -maxcpucount:"$maxCpuFlag" \
+        -p:ContinuousIntegrationBuild=true \
+        -p:Deterministic=true \
+        --configuration "$dotnetBuildType" \
+        --no-restore \
+        --no-build \
+        --logger "console;verbosity=normal" \
+        "${runtimeIdFlags[@]}" \
+        "${flags[@]}"
+    done
+  done
+
+  runHook postCheck
+
+  echo "Finished dotnetCheckHook"
+}
+
+if [[ -z "${dontDotnetCheck-}" && -z "${checkPhase-}" ]]; then
+  checkPhase=dotnetCheckPhase
+fi
+
+# For compatibility, convert makeWrapperArgs to an array unless we are using
+# structured attributes. That is, we ensure that makeWrapperArgs is always an
+# array.
+# See https://github.com/NixOS/nixpkgs/blob/858f4db3048c5be3527e183470e93c1a72c5727c/pkgs/build-support/dotnet/build-dotnet-module/hooks/dotnet-fixup-hook.sh#L1-L3
+# and https://github.com/NixOS/nixpkgs/pull/313005#issuecomment-2175482920
+# shellcheck disable=2206
+if [[ -z $__structuredAttrs ]]; then
+  makeWrapperArgs=( ${makeWrapperArgs-} )
+fi
+
+# First argument is the executable you want to wrap,
+# the second is the destination for the wrapper.
+wrapDotnetProgram() {
+  local -r dotnetRuntime=@dotnetRuntime@
+  local -r wrapperPath=@wrapperPath@
+
+  # shellcheck disable=2016
+  local -r dotnetFromEnvScript='dotnetFromEnv() {
+    local dotnetPath
+    if command -v dotnet 2>&1 >/dev/null; then
+        dotnetPath=$(which dotnet) && \
+            dotnetPath=$(realpath "$dotnetPath") && \
+            dotnetPath=$(dirname "$dotnetPath") && \
+            export DOTNET_ROOT="$dotnetPath"
+    fi
+}
+dotnetFromEnv'
+
+  # shellcheck disable=2206
+  local -a runtimeDeps
+  concatTo runtimeDeps dotnetRuntimeDeps
+
+  local wrapperFlags=()
+  if (( ${#runtimeDeps[@]} > 0 )); then
+    local libraryPath=("${dotnetRuntimeDeps[@]/%//lib}")
+    local OLDIFS="$IFS" IFS=':'
+    wrapperFlags+=("--suffix" "LD_LIBRARY_PATH" ":" "${libraryPath[*]}")
+    IFS="$OLDIFS"
+  fi
+
+  if [[ -z ${dotnetSelfContainedBuild-} ]]; then
+    if [[ -n ${useDotnetFromEnv-} ]]; then
+      # if dotnet CLI is available, set DOTNET_ROOT based on it. Otherwise set to default .NET runtime
+      wrapperFlags+=("--suffix" "PATH" ":" "$wrapperPath")
+      wrapperFlags+=("--run" "$dotnetFromEnvScript")
+      if [[ -n $dotnetRuntime ]]; then
+        wrapperFlags+=("--set-default" "DOTNET_ROOT" "$dotnetRuntime/share/dotnet")
+        wrapperFlags+=("--suffix" "PATH" ":" "$dotnetRuntime/bin")
+      fi
+    elif [[ -n $dotnetRuntime ]]; then
+      wrapperFlags+=("--set" "DOTNET_ROOT" "$dotnetRuntime/share/dotnet")
+      wrapperFlags+=("--prefix" "PATH" ":" "$dotnetRuntime/bin")
+    fi
+  fi
+
+  # shellcheck disable=2154
+  makeWrapper "$1" "$2" \
+              "${wrapperFlags[@]}" \
+              "${gappsWrapperArgs[@]}" \
+              "${makeWrapperArgs[@]}"
+
+  echo "installed wrapper to $2"
+}
+
+dotnetFixupPhase() {
+  local -r dotnetInstallPath="${dotnetInstallPath-$out/lib/$pname}"
+
+  local executable executableBasename
+
+  # check if dotnetExecutables is declared (including empty values, in which case we generate no executables)
+  # shellcheck disable=2154
+  if declare -p dotnetExecutables &>/dev/null; then
+    # shellcheck disable=2206
+    local -a executables
+    concatTo executables dotnetExecutables
+    for executable in "${executables[@]}"; do
+      executableBasename=$(basename "$executable")
+
+      local path="$dotnetInstallPath/$executable"
+
+      if test -x "$path"; then
+        wrapDotnetProgram "$path" "$out/bin/$executableBasename"
+      else
+        echo "Specified binary \"$executable\" is either not an executable or does not exist!"
+        echo "Looked in $path"
+        exit 1
+      fi
+    done
+  else
+    while IFS= read -r -d '' executable; do
+      executableBasename=$(basename "$executable")
+      wrapDotnetProgram "$executable" "$out/bin/$executableBasename" \;
+    done < <(find "$dotnetInstallPath" ! -name "*.dll" -executable -type f -print0)
+  fi
+}
+
+if [[ -z "${dontFixup-}" && -z "${dontDotnetFixup-}" ]]; then
+  appendToVar preFixupPhases dotnetFixupPhase
+fi
+
+dotnetInstallPhase() {
+  echo "Executing dotnetInstallHook"
+
+  runHook preInstall
+
+  local -r dotnetInstallPath="${dotnetInstallPath-$out/lib/$pname}"
+  local -r dotnetBuildType="${dotnetBuildType-Release}"
+
+  local -a projectFiles flags installFlags packFlags runtimeIds
+  concatTo projectFiles dotnetProjectFiles
+  concatTo flags dotnetFlags
+  concatTo installFlags dotnetInstallFlags
+  concatTo packFlags dotnetPackFlags
+  concatTo runtimeIds dotnetRuntimeIds
+
+  if [[ -v dotnetSelfContainedBuild ]]; then
+    if [[ -n $dotnetSelfContainedBuild ]]; then
+      installFlags+=("--self-contained")
+    else
+      installFlags+=("--no-self-contained")
+      # https://learn.microsoft.com/en-us/dotnet/core/deploying/trimming/trim-self-contained
+      # Trimming is only available for self-contained build, so force disable it here
+      installFlags+=("-p:PublishTrimmed=false")
+    fi
+  fi
+
+  if [[ -n ${dotnetUseAppHost-} ]]; then
+    installFlags+=("-p:UseAppHost=true")
+  fi
+
+  if [[ -n ${enableParallelBuilding-} ]]; then
+    local -r maxCpuFlag="$NIX_BUILD_CORES"
+  else
+    local -r maxCpuFlag="1"
+  fi
+
+  dotnetPublish() {
+    local -r projectFile="${1-}"
+
+    for runtimeId in "${runtimeIds[@]}"; do
+      runtimeIdFlags=()
+      if [[ $projectFile == *.csproj || -n ${dotnetSelfContainedBuild-} ]]; then
+        runtimeIdFlags+=("--runtime" "$runtimeId")
+      fi
+
+      dotnet publish ${1+"$projectFile"} \
+             -maxcpucount:"$maxCpuFlag" \
+             -p:ContinuousIntegrationBuild=true \
+             -p:Deterministic=true \
+             -p:OverwriteReadOnlyFiles=true \
+             --output "$dotnetInstallPath" \
+             --configuration "$dotnetBuildType" \
+             --no-restore \
+             --no-build \
+             "${runtimeIdFlags[@]}" \
+             "${flags[@]}" \
+             "${installFlags[@]}"
+    done
+  }
+
+  dotnetPack() {
+    local -r projectFile="${1-}"
+
+    for runtimeId in "${runtimeIds[@]}"; do
+      dotnet pack ${1+"$projectFile"} \
+             -maxcpucount:"$maxCpuFlag" \
+             -p:ContinuousIntegrationBuild=true \
+             -p:Deterministic=true \
+             -p:OverwriteReadOnlyFiles=true \
+             --output "$out/share/nuget/source" \
+             --configuration "$dotnetBuildType" \
+             --no-restore \
+             --no-build \
+             --runtime "$runtimeId" \
+             "${flags[@]}" \
+             "${packFlags[@]}"
+    done
+  }
+
+  if (( ${#projectFiles[@]} == 0 )); then
+    dotnetPublish
+  else
+    local projectFile
+    for projectFile in "${projectFiles[@]}"; do
+      dotnetPublish "$projectFile"
+    done
+  fi
+
+  if [[ -n ${packNupkg-} ]]; then
+    if (( ${#projectFiles[@]} == 0 )); then
+      dotnetPack
+    else
+      local projectFile
+      for projectFile in "${projectFiles[@]}"; do
+        dotnetPack "$projectFile"
+      done
+    fi
+  fi
+
+  runHook postInstall
+
+  echo "Finished dotnetInstallHook"
+}
+
+if [[ -z "${dontDotnetInstall-}" && -z "${installPhase-}" ]]; then
+  installPhase=dotnetInstallPhase
+fi

pkgs/build-support/dotnet/build-dotnet-module/hooks/default.nix

@@ -1,54 +0,0 @@
-{
-  lib,
-  stdenv,
-  which,
-  coreutils,
-  zlib,
-  openssl,
-  makeSetupHook,
-  zip,
-  # Passed from ../default.nix
-  dotnet-sdk,
-  dotnet-runtime,
-}:
-{
-  dotnetConfigureHook = makeSetupHook {
-    name = "dotnet-configure-hook";
-    substitutions = {
-      dynamicLinker = "${stdenv.cc}/nix-support/dynamic-linker";
-      libPath = lib.makeLibraryPath [
-        stdenv.cc.cc
-        stdenv.cc.libc
-        dotnet-sdk.passthru.icu
-        zlib
-        openssl
-      ];
-    };
-  } ./dotnet-configure-hook.sh;
-
-  dotnetBuildHook = makeSetupHook {
-    name = "dotnet-build-hook";
-  } ./dotnet-build-hook.sh;
-
-  dotnetCheckHook = makeSetupHook {
-    name = "dotnet-check-hook";
-  } ./dotnet-check-hook.sh;
-
-  dotnetInstallHook = makeSetupHook {
-    name = "dotnet-install-hook";
-    substitutions = {
-      inherit zip;
-    };
-  } ./dotnet-install-hook.sh;
-
-  dotnetFixupHook = makeSetupHook {
-    name = "dotnet-fixup-hook";
-    substitutions = {
-      dotnetRuntime = if (dotnet-runtime != null) then dotnet-runtime else null;
-      wrapperPath = lib.makeBinPath [
-        which
-        coreutils
-      ];
-    };
-  } ./dotnet-fixup-hook.sh;
-}

pkgs/build-support/dotnet/build-dotnet-module/hooks/dotnet-build-hook.sh

@@ -1,91 +0,0 @@
-dotnetBuildHook() {
-    echo "Executing dotnetBuildHook"
-
-    runHook preBuild
-
-    local -r dotnetBuildType="${dotnetBuildType-Release}"
-
-    if [[ -n $__structuredAttrs ]]; then
-        local dotnetProjectFilesArray=( "${dotnetProjectFiles[@]}" )
-        local dotnetTestProjectFilesArray=( "${dotnetTestProjectFiles[@]}" )
-        local dotnetFlagsArray=( "${dotnetFlags[@]}" )
-        local dotnetBuildFlagsArray=( "${dotnetBuildFlags[@]}" )
-        local dotnetRuntimeIdsArray=( "${dotnetRuntimeIds[@]}" )
-    else
-        local dotnetProjectFilesArray=($dotnetProjectFiles)
-        local dotnetTestProjectFilesArray=($dotnetTestProjectFiles)
-        local dotnetFlagsArray=($dotnetFlags)
-        local dotnetBuildFlagsArray=($dotnetBuildFlags)
-        local dotnetRuntimeIdsArray=($dotnetRuntimeIds)
-    fi
-
-    if [[ -n "${enableParallelBuilding-}" ]]; then
-        local -r maxCpuFlag="$NIX_BUILD_CORES"
-        local -r parallelBuildFlag="true"
-    else
-        local -r maxCpuFlag="1"
-        local -r parallelBuildFlag="false"
-    fi
-
-    if [[ -v dotnetSelfContainedBuild ]]; then
-        if [[ -n $dotnetSelfContainedBuild ]]; then
-            dotnetBuildFlagsArray+=("-p:SelfContained=true")
-        else
-            dotnetBuildFlagsArray+=("-p:SelfContained=false")
-        fi
-    fi
-
-    if [[ -n ${dotnetUseAppHost-} ]]; then
-        dotnetBuildFlagsArray+=("-p:UseAppHost=true")
-    fi
-
-    local versionFlagsArray=()
-    if [[ -n ${version-} ]]; then
-        versionFlagsArray+=("-p:InformationalVersion=$version")
-    fi
-
-    if [[ -n ${versionForDotnet-} ]]; then
-        versionFlagsArray+=("-p:Version=$versionForDotnet")
-    fi
-
-    dotnetBuild() {
-        local -r projectFile="${1-}"
-
-        for runtimeId in "${dotnetRuntimeIdsArray[@]}"; do
-            local runtimeIdFlagsArray=()
-            if [[ $projectFile == *.csproj || -n ${dotnetSelfContainedBuild-} ]]; then
-                runtimeIdFlagsArray+=("--runtime" "$runtimeId")
-            fi
-
-            dotnet build ${1+"$projectFile"} \
-                -maxcpucount:"$maxCpuFlag" \
-                -p:BuildInParallel="$parallelBuildFlag" \
-                -p:ContinuousIntegrationBuild=true \
-                -p:Deterministic=true \
-                -p:OverwriteReadOnlyFiles=true \
-                --configuration "$dotnetBuildType" \
-                --no-restore \
-                "${versionFlagsArray[@]}" \
-                "${runtimeIdFlagsArray[@]}" \
-                "${dotnetBuildFlagsArray[@]}" \
-                "${dotnetFlagsArray[@]}"
-        done
-    }
-
-    if (( ${#dotnetProjectFilesArray[@]} == 0 )); then
-        dotnetBuild
-    fi
-
-    local projectFile
-    for projectFile in "${dotnetProjectFilesArray[@]}" "${dotnetTestProjectFilesArray[@]}"; do
-        dotnetBuild "$projectFile"
-    done
-
-    runHook postBuild
-
-    echo "Finished dotnetBuildHook"
-}
-
-if [[ -z ${dontDotnetBuild-} && -z ${buildPhase-} ]]; then
-    buildPhase=dotnetBuildHook
-fi

pkgs/build-support/dotnet/build-dotnet-module/hooks/dotnet-check-hook.sh

@@ -1,81 +0,0 @@
-dotnetCheckHook() {
-    echo "Executing dotnetCheckHook"
-
-    runHook preCheck
-
-    local -r dotnetBuildType="${dotnetBuildType-Release}"
-
-    if [[ -n $__structuredAttrs ]]; then
-        local dotnetProjectFilesArray=( "${dotnetProjectFiles[@]}" )
-        local dotnetTestProjectFilesArray=( "${dotnetTestProjectFiles[@]}" )
-        local dotnetTestFlagsArray=( "${dotnetTestFlags[@]}" )
-        local dotnetTestFiltersArray=( "${dotnetTestFilters[@]}" )
-        local dotnetDisabledTestsArray=( "${dotnetDisabledTests[@]}" )
-        local dotnetRuntimeDepsArray=( "${dotnetRuntimeDeps[@]}" )
-        local dotnetRuntimeIdsArray=( "${dotnetRuntimeIds[@]}" )
-    else
-        local dotnetProjectFilesArray=($dotnetProjectFiles)
-        local dotnetTestProjectFilesArray=($dotnetTestProjectFiles)
-        local dotnetTestFlagsArray=($dotnetTestFlags)
-        local dotnetTestFiltersArray=($dotnetTestFilters)
-        local dotnetDisabledTestsArray=($dotnetDisabledTests)
-        local dotnetRuntimeDepsArray=($dotnetRuntimeDeps)
-        local dotnetRuntimeIdsArray=($dotnetRuntimeIds)
-    fi
-
-    if (( ${#dotnetDisabledTestsArray[@]} > 0 )); then
-        local disabledTestsFilters=("${dotnetDisabledTestsArray[@]/#/FullyQualifiedName!=}")
-        dotnetTestFiltersArray=( "${dotnetTestFiltersArray[@]}" "${disabledTestsFilters[@]//,/%2C}" )
-    fi
-
-    if (( ${#dotnetTestFiltersArray[@]} > 0 )); then
-        local OLDIFS="$IFS" IFS='&'
-        dotnetTestFlagsArray+=("--filter:${dotnetTestFiltersArray[*]}")
-        IFS="$OLDIFS"
-    fi
-
-    local libraryPath="${LD_LIBRARY_PATH-}"
-    if (( ${#dotnetRuntimeDepsArray[@]} > 0 )); then
-        local libraryPathArray=("${dotnetRuntimeDepsArray[@]/%//lib}")
-        local OLDIFS="$IFS" IFS=':'
-        libraryPath="${libraryPathArray[*]}${libraryPath:+':'}$libraryPath"
-        IFS="$OLDIFS"
-    fi
-
-    if [[ -n ${enableParallelBuilding-} ]]; then
-        local -r maxCpuFlag="$NIX_BUILD_CORES"
-    else
-        local -r maxCpuFlag="1"
-    fi
-
-    local projectFile runtimeId
-    for projectFile in "${dotnetTestProjectFilesArray[@]-${dotnetProjectFilesArray[@]}}"; do
-        for runtimeId in "${dotnetRuntimeIdsArray[@]}"; do
-            local runtimeIdFlagsArray=()
-            if [[ $projectFile == *.csproj ]]; then
-                runtimeIdFlagsArray=("--runtime" "$runtimeId")
-            fi
-
-            LD_LIBRARY_PATH=$libraryPath \
-                dotnet test "$projectFile" \
-                -maxcpucount:"$maxCpuFlag" \
-                -p:ContinuousIntegrationBuild=true \
-                -p:Deterministic=true \
-                --configuration "$dotnetBuildType" \
-                --no-restore \
-                --no-build \
-                --logger "console;verbosity=normal" \
-                "${runtimeIdFlagsArray[@]}" \
-                "${dotnetTestFlagsArray[@]}" \
-                "${dotnetFlagsArray[@]}"
-        done
-    done
-
-    runHook postCheck
-
-    echo "Finished dotnetCheckHook"
-}
-
-if [[ -z "${dontDotnetCheck-}" && -z "${checkPhase-}" ]]; then
-    checkPhase=dotnetCheckHook
-fi

pkgs/build-support/dotnet/build-dotnet-module/hooks/dotnet-configure-hook.sh

@@ -1,78 +0,0 @@
-dotnetConfigureHook() {
-    echo "Executing dotnetConfigureHook"
-
-    runHook preConfigure
-
-    local -r dynamicLinker=@dynamicLinker@
-    local -r libPath=@libPath@
-
-    if [[ -n $__structuredAttrs ]]; then
-        local dotnetProjectFilesArray=( "${dotnetProjectFiles[@]}" )
-        local dotnetTestProjectFilesArray=( "${dotnetTestProjectFiles[@]}" )
-        local dotnetFlagsArray=( "${dotnetFlags[@]}" )
-        local dotnetRestoreFlagsArray=( "${dotnetRestoreFlags[@]}" )
-        local dotnetRuntimeIdsArray=( "${dotnetRuntimeIds[@]}" )
-    else
-        local dotnetProjectFilesArray=($dotnetProjectFiles)
-        local dotnetTestProjectFilesArray=($dotnetTestProjectFiles)
-        local dotnetFlagsArray=($dotnetFlags)
-        local dotnetRestoreFlagsArray=($dotnetRestoreFlags)
-        local dotnetRuntimeIdsArray=($dotnetRuntimeIds)
-    fi
-
-    if [[ -z ${enableParallelBuilding-} ]]; then
-        local -r parallelFlag="--disable-parallel"
-    fi
-
-    if [[ -v dotnetSelfContainedBuild ]]; then
-        if [[ -n $dotnetSelfContainedBuild ]]; then
-            dotnetRestoreFlagsArray+=("-p:SelfContained=true")
-        else
-            dotnetRestoreFlagsArray+=("-p:SelfContained=false")
-        fi
-    fi
-
-    dotnetRestore() {
-        local -r projectFile="${1-}"
-        for runtimeId in "${dotnetRuntimeIdsArray[@]}"; do
-            dotnet restore ${1+"$projectFile"} \
-                -p:ContinuousIntegrationBuild=true \
-                -p:Deterministic=true \
-                -p:NuGetAudit=false \
-                --runtime "$runtimeId" \
-                ${parallelFlag-} \
-                "${dotnetRestoreFlagsArray[@]}" \
-                "${dotnetFlagsArray[@]}"
-        done
-    }
-
-    if [[ -f .config/dotnet-tools.json || -f dotnet-tools.json ]]; then
-        dotnet tool restore
-    fi
-
-    # dotnetGlobalTool is set in buildDotnetGlobalTool to patch dependencies but
-    # avoid other project-specific logic. This is a hack, but the old behavior
-    # is worse as it relied on a bug: setting projectFile to an empty string
-    # made the hooks actually skip all project-specific logic. It’s hard to keep
-    # backwards compatibility with this odd behavior now since we are using
-    # arrays, so instead we just pass a variable to indicate that we don’t have
-    # projects.
-    if [[ -z ${dotnetGlobalTool-} ]]; then
-        if (( ${#dotnetProjectFilesArray[@]} == 0 )); then
-            dotnetRestore
-        fi
-
-        local projectFile
-        for projectFile in "${dotnetProjectFilesArray[@]}" "${dotnetTestProjectFilesArray[@]}"; do
-            dotnetRestore "$projectFile"
-        done
-    fi
-
-    runHook postConfigure
-
-    echo "Finished dotnetConfigureHook"
-}
-
-if [[ -z "${dontDotnetConfigure-}" && -z "${configurePhase-}" ]]; then
-    configurePhase=dotnetConfigureHook
-fi

pkgs/build-support/dotnet/build-dotnet-module/hooks/dotnet-fixup-hook.sh

@@ -1,101 +0,0 @@
-# For compatibility, convert makeWrapperArgs to an array unless we are using
-# structured attributes. That is, we ensure that makeWrapperArgs is always an
-# array.
-# See https://github.com/NixOS/nixpkgs/blob/858f4db3048c5be3527e183470e93c1a72c5727c/pkgs/build-support/dotnet/build-dotnet-module/hooks/dotnet-fixup-hook.sh#L1-L3
-# and https://github.com/NixOS/nixpkgs/pull/313005#issuecomment-2175482920
-if [[ -z $__structuredAttrs ]]; then
-    makeWrapperArgs=( ${makeWrapperArgs-} )
-fi
-
-# First argument is the executable you want to wrap,
-# the second is the destination for the wrapper.
-wrapDotnetProgram() {
-    local -r dotnetRuntime=@dotnetRuntime@
-    local -r wrapperPath=@wrapperPath@
-
-    local -r dotnetFromEnvScript='dotnetFromEnv() {
-    local dotnetPath
-    if command -v dotnet 2>&1 >/dev/null; then
-        dotnetPath=$(which dotnet) && \
-            dotnetPath=$(realpath "$dotnetPath") && \
-            dotnetPath=$(dirname "$dotnetPath") && \
-            export DOTNET_ROOT="$dotnetPath"
-    fi
-}
-dotnetFromEnv'
-
-    if [[ -n $__structuredAttrs ]]; then
-        local -r dotnetRuntimeDepsArray=( "${dotnetRuntimeDeps[@]}" )
-    else
-        local -r dotnetRuntimeDepsArray=($dotnetRuntimeDeps)
-    fi
-
-    local dotnetRuntimeDepsFlags=()
-    if (( ${#dotnetRuntimeDepsArray[@]} > 0 )); then
-        local libraryPathArray=("${dotnetRuntimeDepsArray[@]/%//lib}")
-        local OLDIFS="$IFS" IFS=':'
-        dotnetRuntimeDepsFlags+=("--suffix" "LD_LIBRARY_PATH" ":" "${libraryPathArray[*]}")
-        IFS="$OLDIFS"
-    fi
-
-    local dotnetRootFlagsArray=()
-    if [[ -z ${dotnetSelfContainedBuild-} ]]; then
-        if [[ -n ${useDotnetFromEnv-} ]]; then
-            # if dotnet CLI is available, set DOTNET_ROOT based on it. Otherwise set to default .NET runtime
-            dotnetRootFlagsArray+=("--suffix" "PATH" ":" "$wrapperPath")
-            dotnetRootFlagsArray+=("--run" "$dotnetFromEnvScript")
-            if [[ -n $dotnetRuntime ]]; then
-                dotnetRootFlagsArray+=("--set-default" "DOTNET_ROOT" "$dotnetRuntime/share/dotnet")
-                dotnetRootFlagsArray+=("--suffix" "PATH" ":" "$dotnetRuntime/bin")
-            fi
-        elif [[ -n $dotnetRuntime ]]; then
-            dotnetRootFlagsArray+=("--set" "DOTNET_ROOT" "$dotnetRuntime/share/dotnet")
-            dotnetRootFlagsArray+=("--prefix" "PATH" ":" "$dotnetRuntime/bin")
-        fi
-    fi
-
-    makeWrapper "$1" "$2" \
-        "${dotnetRuntimeDepsFlags[@]}" \
-        "${dotnetRootFlagsArray[@]}" \
-        "${gappsWrapperArgs[@]}" \
-        "${makeWrapperArgs[@]}"
-
-    echo "installed wrapper to "$2""
-}
-
-dotnetFixupHook() {
-    local -r dotnetInstallPath="${dotnetInstallPath-$out/lib/$pname}"
-
-    local executable executableBasename
-
-    # check if dotnetExecutables is declared (including empty values, in which case we generate no executables)
-    if declare -p dotnetExecutables &>/dev/null; then
-        if [[ -n $__structuredAttrs ]]; then
-            local dotnetExecutablesArray=( "${dotnetExecutables[@]}" )
-        else
-            local dotnetExecutablesArray=($dotnetExecutables)
-        fi
-        for executable in "${dotnetExecutablesArray[@]}"; do
-            executableBasename=$(basename "$executable")
-
-            local path="$dotnetInstallPath/$executable"
-
-            if test -x "$path"; then
-                wrapDotnetProgram "$path" "$out/bin/$executableBasename"
-            else
-                echo "Specified binary \"$executable\" is either not an executable or does not exist!"
-                echo "Looked in $path"
-                exit 1
-            fi
-        done
-    else
-        while IFS= read -d '' executable; do
-            executableBasename=$(basename "$executable")
-            wrapDotnetProgram "$executable" "$out/bin/$executableBasename" \;
-        done < <(find "$dotnetInstallPath" ! -name "*.dll" -executable -type f -print0)
-    fi
-}
-
-if [[ -z "${dontFixup-}" && -z "${dontDotnetFixup-}" ]]; then
-    appendToVar preFixupPhases dotnetFixupHook
-fi

pkgs/build-support/dotnet/build-dotnet-module/hooks/dotnet-install-hook.sh

@@ -1,114 +0,0 @@
-dotnetInstallHook() {
-    echo "Executing dotnetInstallHook"
-
-    runHook preInstall
-
-    local -r dotnetInstallPath="${dotnetInstallPath-$out/lib/$pname}"
-    local -r dotnetBuildType="${dotnetBuildType-Release}"
-
-    if [[ -n $__structuredAttrs ]]; then
-        local dotnetProjectFilesArray=( "${dotnetProjectFiles[@]}" )
-        local dotnetFlagsArray=( "${dotnetFlags[@]}" )
-        local dotnetInstallFlagsArray=( "${dotnetInstallFlags[@]}" )
-        local dotnetPackFlagsArray=( "${dotnetPackFlags[@]}" )
-        local dotnetRuntimeIdsArray=( "${dotnetRuntimeIds[@]}" )
-    else
-        local dotnetProjectFilesArray=($dotnetProjectFiles)
-        local dotnetFlagsArray=($dotnetFlags)
-        local dotnetInstallFlagsArray=($dotnetInstallFlags)
-        local dotnetPackFlagsArray=($dotnetPackFlags)
-        local dotnetRuntimeIdsArray=($dotnetRuntimeIds)
-    fi
-
-    if [[ -v dotnetSelfContainedBuild ]]; then
-        if [[ -n $dotnetSelfContainedBuild ]]; then
-            dotnetInstallFlagsArray+=("--self-contained")
-        else
-            dotnetInstallFlagsArray+=("--no-self-contained")
-            # https://learn.microsoft.com/en-us/dotnet/core/deploying/trimming/trim-self-contained
-            # Trimming is only available for self-contained build, so force disable it here
-            dotnetInstallFlagsArray+=("-p:PublishTrimmed=false")
-        fi
-    fi
-
-    if [[ -n ${dotnetUseAppHost-} ]]; then
-        dotnetInstallFlagsArray+=("-p:UseAppHost=true")
-    fi
-
-    if [[ -n ${enableParallelBuilding-} ]]; then
-        local -r maxCpuFlag="$NIX_BUILD_CORES"
-    else
-        local -r maxCpuFlag="1"
-    fi
-
-    dotnetPublish() {
-        local -r projectFile="${1-}"
-
-        for runtimeId in "${dotnetRuntimeIdsArray[@]}"; do
-            runtimeIdFlagsArray=()
-            if [[ $projectFile == *.csproj || -n ${dotnetSelfContainedBuild-} ]]; then
-                runtimeIdFlagsArray+=("--runtime" "$runtimeId")
-            fi
-
-            dotnet publish ${1+"$projectFile"} \
-                -maxcpucount:"$maxCpuFlag" \
-                -p:ContinuousIntegrationBuild=true \
-                -p:Deterministic=true \
-                -p:OverwriteReadOnlyFiles=true \
-                --output "$dotnetInstallPath" \
-                --configuration "$dotnetBuildType" \
-                --no-restore \
-                --no-build \
-                "${runtimeIdFlagsArray[@]}" \
-                "${dotnetInstallFlagsArray[@]}" \
-                "${dotnetFlagsArray[@]}"
-        done
-    }
-
-    dotnetPack() {
-        local -r projectFile="${1-}"
-
-        for runtimeId in "${dotnetRuntimeIdsArray[@]}"; do
-            dotnet pack ${1+"$projectFile"} \
-                   -maxcpucount:"$maxCpuFlag" \
-                   -p:ContinuousIntegrationBuild=true \
-                   -p:Deterministic=true \
-                   -p:OverwriteReadOnlyFiles=true \
-                   --output "$out/share/nuget/source" \
-                   --configuration "$dotnetBuildType" \
-                   --no-restore \
-                   --no-build \
-                   --runtime "$runtimeId" \
-                   "${dotnetPackFlagsArray[@]}" \
-                   "${dotnetFlagsArray[@]}"
-        done
-    }
-
-    if (( ${#dotnetProjectFilesArray[@]} == 0 )); then
-        dotnetPublish
-    else
-        local projectFile
-        for projectFile in "${dotnetProjectFilesArray[@]}"; do
-            dotnetPublish "$projectFile"
-        done
-    fi
-
-    if [[ -n ${packNupkg-} ]]; then
-        if (( ${#dotnetProjectFilesArray[@]} == 0 )); then
-            dotnetPack
-        else
-            local projectFile
-            for projectFile in "${dotnetProjectFilesArray[@]}"; do
-                dotnetPack "$projectFile"
-            done
-        fi
-    fi
-
-    runHook postInstall
-
-    echo "Finished dotnetInstallHook"
-}
-
-if [[ -z "${dontDotnetInstall-}" && -z "${installPhase-}" ]]; then
-    installPhase=dotnetInstallHook
-fi

pkgs/by-name/an/ananicy-rules-cachyos/package.nix

@@ -7,13 +7,13 @@
 
 stdenvNoCC.mkDerivation {
   pname = "ananicy-rules-cachyos";
-  version = "0-unstable-2025-07-06";
+  version = "0-unstable-2025-08-06";
 
   src = fetchFromGitHub {
     owner = "CachyOS";
     repo = "ananicy-rules";
-    rev = "339bee6f2de3de8e866c23b210baf6cabf153549";
-    hash = "sha256-D/+/7NdfV8kHwYm5mJ6b7Vl3QCUdK2+NbZSefWTZt5k=";
+    rev = "80576999c92af3eb88ea2008d4a18d29393ed579";
+    hash = "sha256-SdxOgm7purRxIU16RFuSgUzKIgi+7gJ2hJuCDVCjd54=";
   };
 
   dontConfigure = true;

pkgs/by-name/ap/api-linter/package.nix

@@ -6,16 +6,16 @@
 
 buildGoModule rec {
   pname = "api-linter";
-  version = "1.70.1";
+  version = "1.70.2";
 
   src = fetchFromGitHub {
     owner = "googleapis";
     repo = "api-linter";
     tag = "v${version}";
-    hash = "sha256-Jztu8xQWLeJVSk+yx3julu0wkQNpgQtzZvrKP71T7Eg=";
+    hash = "sha256-2ILG+FW+58WnmL5Ts1K32ee0SR15yp9NnEtmEo6r6w8=";
   };
 
-  vendorHash = "sha256-wIZdL393uPVqz0rJV5NU6SHm8RU5orrHREhKbjBHTYU=";
+  vendorHash = "sha256-CHObiSQudxZw5KjimQk8myTsLeQMBZU8SewW4I2dNsw=";
 
   subPackages = [ "cmd/api-linter" ];
 

pkgs/by-name/ar/arc-theme/package.nix

@@ -10,7 +10,7 @@
   gnome-themes-extra,
   gtk-engine-murrine,
   inkscape,
-  cinnamon-common,
+  cinnamon,
   makeFontsConf,
   python3,
 }:
@@ -55,7 +55,7 @@ stdenv.mkDerivation rec {
   mesonFlags = [
     # "-Dthemes=cinnamon,gnome-shell,gtk2,gtk3,plank,xfwm,metacity"
     # "-Dvariants=light,darker,dark,lighter"
-    "-Dcinnamon_version=${cinnamon-common.version}"
+    "-Dcinnamon_version=${cinnamon.version}"
     "-Dgnome_shell_version=${gnome-shell.version}"
     # You will need to patch gdm to make use of this.
     "-Dgnome_shell_gresource=true"

pkgs/by-name/ar/art/package.nix

@@ -40,13 +40,13 @@
 
 stdenv.mkDerivation rec {
   pname = "art";
-  version = "1.25.7";
+  version = "1.25.8";
 
   src = fetchFromGitHub {
     owner = "artpixls";
     repo = "ART";
     tag = version;
-    hash = "sha256-VrIayD7Gj0j5Rfs6sl2tZTqPFTvQcJHgUnGQ6IGiUmU=";
+    hash = "sha256-FsaTXGlQ390XgFrV4InF+xFr+Y9JgZefsR/AyHOuSsA=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/ar/artichoke/package.nix

@@ -10,16 +10,16 @@
 
 rustPlatform.buildRustPackage {
   pname = "artichoke";
-  version = "0-unstable-2025-07-28";
+  version = "0-unstable-2025-08-03";
 
   src = fetchFromGitHub {
     owner = "artichoke";
     repo = "artichoke";
-    rev = "148d3bf4bc361fa3214c02219e50e22e4cf2a3cf";
-    hash = "sha256-CKCRFSg8ROMhKwiIDU9iAYY/HfGtYlW1zrtn7thxIzY=";
+    rev = "ff0b17820a5f64ea9e8b744cef4a9111df3ed252";
+    hash = "sha256-0SUU/1gp7A0gjluc8ZyF9C4ZxAgNsM6jwuT3E8GxFQY=";
   };
 
-  cargoHash = "sha256-a43awTdhOlu+KO3B6XQ7Vdv4NbZ3iffq4rpmBBgUcZ8=";
+  cargoHash = "sha256-JD+qt0pu5wxIuLa3Bd9eadQFE7dyKzqxsAKPebG7+Zg=";
 
   nativeBuildInputs = [
     rustPlatform.bindgenHook

pkgs/by-name/az/azurite/package.nix

@@ -10,16 +10,16 @@
 
 buildNpmPackage rec {
   pname = "azurite";
-  version = "3.34.0";
+  version = "3.35.0";
 
   src = fetchFromGitHub {
     owner = "Azure";
     repo = "Azurite";
     rev = "v${version}";
-    hash = "sha256-6NECduq2ewed8bR4rlF5MW8mGcsgu8bqgA/DBt8ywtM=";
+    hash = "sha256-sVYiHQJ3nR5vM+oPAHzr/MjuNBMY14afqCHpw32WCiQ=";
   };
 
-  npmDepsHash = "sha256-WRaD99CsIuH3BrO01eVuoEZo40VjuScnVzmlFcKpj8g=";
+  npmDepsHash = "sha256-UBHjb65Ud7IANsR30DokbI/16+dVjDEtfhqRPAQhGUw=";
 
   nativeBuildInputs = [
     pkg-config

pkgs/by-name/ba/baresip/fix-modules-path.patch

@@ -0,0 +1,29 @@
+commit 46479c52695cc5f8c01370fd2594468666c45c8e
+Author: rnhmjoj <rnhmjoj@inventati.org>
+Date:   Sun Aug 3 00:18:47 2025 +0200
+
+    Fix the modules path at build time
+    
+    The location of the modules is determined by reading the `module_path`
+    setting, which is set to "$out/lib/baresip/modules" when the
+    configuration file is generated during the first run. If the package is
+    updated and the store path changes, baresip breaks completely, forcing
+    the user to manually fix the configuration.
+    
+    This patch fixes the location of the modules at build time, ignoring the
+    `module_path` setting, to avoid this issue.
+
+diff --git a/src/module.c b/src/module.c
+index 9f2135c6..b62d0bdd 100644
+--- a/src/module.c
++++ b/src/module.c
+@@ -141,8 +141,7 @@ int module_init(const struct conf *conf)
+ 	if (!conf)
+ 		return EINVAL;
+ 
+-	if (conf_get(conf, "module_path", &path))
+-		pl_set_str(&path, ".");
++	pl_set_str(&path, MOD_PATH);
+ 
+ 	err = conf_apply(conf, "module", module_handler, &path);
+ 	if (err)

pkgs/by-name/ba/baresip/package.nix

@@ -29,21 +29,29 @@
   zlib,
   dbusSupport ? true,
 }:
+
 stdenv.mkDerivation rec {
-  version = "3.10.1";
+  version = "3.24.0";
   pname = "baresip";
+
   src = fetchFromGitHub {
     owner = "baresip";
     repo = "baresip";
     rev = "v${version}";
-    hash = "sha256-0huZP1hopHaN5R1Hki6YutpvoASfIHzHMl/Y4czHHMo=";
+    hash = "sha256-32XyMblHF+ST+TpIbdyPFdRtWnIugYMr4lYZnfeFm/c=";
   };
+
+  patches = [
+    ./fix-modules-path.patch
+  ];
+
   prePatch = ''
     substituteInPlace cmake/FindGTK3.cmake --replace-fail GTK3_CFLAGS_OTHER ""
   ''
   + lib.optionalString (!dbusSupport) ''
     substituteInPlace cmake/modules.cmake --replace-fail 'list(APPEND MODULES ctrl_dbus)' ""
   '';
+
   nativeBuildInputs = [
     cmake
     pkg-config
@@ -102,72 +110,75 @@ stdenv.mkDerivation rec {
     -D__need_timeval -D__need_timespec -D__need_time_t
   '';
 
-  doInstallCheck = true;
   # CMake feature detection is prone to breakage between upgrades:
   # spot-check that the optional modules we care about were compiled
-  postInstallCheck = lib.concatMapStringsSep "\n" (m: "test -x $out/lib/baresip/modules/${m}.so") [
-    "account"
-    "alsa"
-    "aubridge"
-    "auconv"
-    "aufile"
-    "auresamp"
-    "ausine"
-    "avcodec"
-    "avfilter"
-    "avformat"
-    "cons"
-    "contact"
-    "ctrl_dbus"
-    "ctrl_tcp"
-    "debug_cmd"
-    "dtls_srtp"
-    "ebuacip"
-    "echo"
-    "evdev"
-    "fakevideo"
-    "g711"
-    "g722"
-    "g726"
-    "gst"
-    "gtk"
-    "httpd"
-    "httpreq"
-    "ice"
-    "l16"
-    "menu"
-    "mixausrc"
-    "mixminus"
-    "multicast"
-    "mwi"
-    "natpmp"
-    "netroam"
-    "pcp"
-    "pipewire"
-    "plc"
-    "portaudio"
-    "presence"
-    "rtcpsummary"
-    "sdl"
-    "selfview"
-    "serreg"
-    "snapshot"
-    "sndfile"
-    "srtp"
-    "stdio"
-    "stun"
-    "swscale"
-    "syslog"
-    "turn"
-    "uuid"
-    "v4l2"
-    "vidbridge"
-    "vidinfo"
-    "vp8"
-    "vp9"
-    "vumeter"
-    "x11"
-  ];
+  installCheckPhase = ''
+    runHook preInstallCheck
+    ${lib.concatMapStringsSep "\n" (m: "test -x $out/lib/baresip/modules/${m}.so") [
+      "account"
+      "alsa"
+      "aubridge"
+      "auconv"
+      "aufile"
+      "auresamp"
+      "ausine"
+      "avcodec"
+      "avfilter"
+      "avformat"
+      "cons"
+      "contact"
+      "ctrl_dbus"
+      "ctrl_tcp"
+      "debug_cmd"
+      "dtls_srtp"
+      "ebuacip"
+      "echo"
+      "evdev"
+      "fakevideo"
+      "g711"
+      "g722"
+      "g726"
+      "gst"
+      "gtk"
+      "httpd"
+      "httpreq"
+      "ice"
+      "l16"
+      "menu"
+      "mixausrc"
+      "mixminus"
+      "multicast"
+      "mwi"
+      "natpmp"
+      "netroam"
+      "pcp"
+      "pipewire"
+      "plc"
+      "portaudio"
+      "presence"
+      "rtcpsummary"
+      "sdl"
+      "selfview"
+      "serreg"
+      "snapshot"
+      "sndfile"
+      "srtp"
+      "stdio"
+      "stun"
+      "swscale"
+      "syslog"
+      "turn"
+      "uuid"
+      "v4l2"
+      "vidbridge"
+      "vidinfo"
+      "vp8"
+      "vp9"
+      "vumeter"
+      "x11"
+    ]}
+    runHook postInstallCheck
+  '';
 
   meta = {
     description = "Modular SIP User-Agent with audio and video support";
@@ -175,6 +186,7 @@ stdenv.mkDerivation rec {
     maintainers = with lib.maintainers; [
       raskin
       ehmry
+      rnhmjoj
     ];
     mainProgram = "baresip";
     license = lib.licenses.bsd3;

pkgs/by-name/bl/bluemap/package.nix

@@ -8,11 +8,11 @@
 
 stdenvNoCC.mkDerivation rec {
   pname = "bluemap";
-  version = "5.10";
+  version = "5.11";
 
   src = fetchurl {
     url = "https://github.com/BlueMap-Minecraft/BlueMap/releases/download/v${version}/BlueMap-${version}-cli.jar";
-    hash = "sha256-vz6ReXfgqWYnyFQNBgqaWLZ0sOJqHOmFcAnuwbbOmGA=";
+    hash = "sha256-DhsnuwVDvIb7eR4Hs2jOTufY2ysd+Awo0b8xg84quGU=";
   };
 
   dontUnpack = true;

pkgs/by-name/bn/bngblaster/package.nix

@@ -13,13 +13,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "bngblaster";
-  version = "0.9.22";
+  version = "0.9.23";
 
   src = fetchFromGitHub {
     owner = "rtbrick";
     repo = "bngblaster";
     rev = finalAttrs.version;
-    hash = "sha256-vLvPiHwrFLqNV9ReeFAr0YBn8HUt6SazanpwZ1q09oU=";
+    hash = "sha256-qo48OW02IMAAxMYTYguv5jKvy/GPq1WKgcluSrMIt2E=";
   };
 
   nativeBuildInputs = [ cmake ];

pkgs/by-name/ca/cargo-xwin/package.nix

@@ -6,16 +6,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "cargo-xwin";
-  version = "0.19.1";
+  version = "0.19.2";
 
   src = fetchFromGitHub {
     owner = "rust-cross";
     repo = "cargo-xwin";
     rev = "v${version}";
-    hash = "sha256-rmbu3WNwCmgojAWAthIQ9/XiSS04d9DoZwGRGAuRfDw=";
+    hash = "sha256-qWHpExVt/a20GrP2uVvGbubF+Nr71Ob6abGLcnlpKJc=";
   };
 
-  cargoHash = "sha256-7xpkxJh5KVJVw6wQZGr2daU1qg0e969EWflf4Z/01oY=";
+  cargoHash = "sha256-HctMp95J8ovYuvh7m5wxrNt+ZCVCzwPSSm71Ma1cVxI=";
 
   meta = with lib; {
     description = "Cross compile Cargo project to Windows MSVC target with ease";

pkgs/by-name/cf/cf-hero/package.nix

@@ -0,0 +1,34 @@
+{
+  lib,
+  buildGoModule,
+  fetchFromGitHub,
+}:
+
+buildGoModule (finalAttrs: {
+  pname = "cf-hero";
+  version = "1.0.4";
+
+  src = fetchFromGitHub {
+    owner = "musana";
+    repo = "CF-Hero";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-n0kcapHBz6Dap6KKJByCwBZmXmcO/aK88X78Yit6rx4=";
+  };
+
+  vendorHash = "sha256-Yf+iZ3UIpP9EtOWW1jh3h3zTFK1D7mcOh113Q4fbAhA=";
+
+  ldflags = [
+    "-s"
+    "-w"
+  ];
+
+  meta = {
+    description = "Tool that uses multiple data sources to discover the origin IP addresses of Cloudflare-protected web applications";
+    homepage = "https://github.com/musana/CF-Hero";
+    changelog = "https://github.com/musana/CF-Hero/releases/tag/${finalAttrs.src.tag}";
+    # No licensing details present, https://github.com/musana/CF-Hero/issues/16
+    license = lib.licenses.unfree;
+    maintainers = with lib.maintainers; [ fab ];
+    mainProgram = "cf-hero";
+  };
+})

pkgs/by-name/ch/chhoto-url/package.nix

@@ -8,13 +8,13 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "chhoto-url";
-  version = "6.2.11";
+  version = "6.2.12";
 
   src = fetchFromGitHub {
     owner = "SinTan1729";
     repo = "chhoto-url";
     tag = finalAttrs.version;
-    hash = "sha256-3VQmTQ6ZlDTRL3nx/sQxWLKgW8ee0Ts+C1CiWkiX2/g=";
+    hash = "sha256-hV/YWxOPRTojVTFIXwzqImBKyQ1dCDq5+bgCdS7T1p0=";
   };
 
   sourceRoot = "${finalAttrs.src.name}/actix";
@@ -24,7 +24,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
       --replace-fail "./resources/" "${placeholder "out"}/share/chhoto-url/resources/"
   '';
 
-  cargoHash = "sha256-QIqLzk/vAOrW0ain0Oq9tnqzCSyK4yDOYsjmil3xPc4=";
+  cargoHash = "sha256-9wXbd56KOQ7suZqtg2cSFf2FGQJADFMHJbwAAxJ2V4g=";
 
   postInstall = ''
     mkdir -p $out/share/chhoto-url

pkgs/by-name/ch/chroma/package.nix

@@ -10,7 +10,7 @@ in
 
 buildGoModule rec {
   pname = "chroma";
-  version = "2.19.0";
+  version = "2.20.0";
 
   # To update:
   # nix-prefetch-git --rev v${version} https://github.com/alecthomas/chroma.git > src.json
@@ -21,7 +21,7 @@ buildGoModule rec {
     inherit (srcInfo) sha256;
   };
 
-  vendorHash = "sha256-Gqldcp68Rn4wkfQptbmKUjkwLSb+qaFboJNfmWVkrPU=";
+  vendorHash = "sha256-GiaVgqhhrexSnBWVtQ+/cwdykHVDxR95BFMkrH1s+8Q=";
 
   modRoot = "./cmd/chroma";
 

pkgs/by-name/ch/chroma/src.json

@@ -1,12 +1,13 @@
 {
   "url": "https://github.com/alecthomas/chroma.git",
-  "rev": "adeac8f5dbfb6806a51bcf07eefd89fc8a0aee6a",
-  "date": "2025-07-01T09:59:45+10:00",
-  "path": "/nix/store/063ldbczafhxq02g5n28bxr1xnl6fwgd-chroma",
-  "sha256": "1r50gqbizi7l1l07syx9wgfyx1k8gzspmsbpk42jnwgw3h9dcw42",
-  "hash": "sha256-gnDWEhz8cSsFmXfpevV/aIbu3eOpe30ADfTEHxd+oOQ=",
+  "rev": "303b65df3f2d2151cee24bcf9f9b625db474ef51",
+  "date": "2025-08-04T13:55:06+10:00",
+  "path": "/nix/store/1f8p33h1srs9knj6sn6mc5rf0wcybf4g-chroma",
+  "sha256": "05w4hnfcxqdlsz7mkc0m3jbp1aj67wzyhq5jh8ldfgnyjnlafia3",
+  "hash": "sha256-Q0WnqJXePtcogrJg6D8/RqpwlxwVsFnP17ThzpyFhBc=",
   "fetchLFS": false,
   "fetchSubmodules": false,
   "deepClone": false,
+  "fetchTags": false,
   "leaveDotGit": false
 }

pkgs/by-name/ci/cinnamon-desktop/package.nix

@@ -64,7 +64,7 @@ stdenv.mkDerivation rec {
   postPatch = ''
     chmod +x install-scripts/meson_install_schemas.py # patchShebangs requires executable file
     patchShebangs install-scripts/meson_install_schemas.py
-    sed "s|/usr/share|/run/current-system/sw/share|g" -i ./schemas/* # NOTE: unless this causes a circular dependency, we could link it to cinnamon-common/share/cinnamon
+    sed "s|/usr/share|/run/current-system/sw/share|g" -i ./schemas/* # NOTE: unless this causes a circular dependency, we could link it to cinnamon/share/cinnamon
   '';
 
   meta = with lib; {

pkgs/by-name/ci/cinnamon-gsettings-overrides/package.nix

@@ -15,7 +15,7 @@
   cinnamon-desktop,
   cinnamon-session,
   cinnamon-settings-daemon,
-  cinnamon-common,
+  cinnamon,
   bulky,
 }:
 
@@ -35,7 +35,7 @@ let
     cinnamon-desktop
     cinnamon-session
     cinnamon-settings-daemon
-    cinnamon-common
+    cinnamon
     gnome-terminal
     gsettings-desktop-schemas
     gtk3

pkgs/by-name/ci/cinnamon-screensaver/package.nix

@@ -9,7 +9,7 @@
   dbus,
   gettext,
   cinnamon-desktop,
-  cinnamon-common,
+  cinnamon,
   intltool,
   libxslt,
   gtk3,
@@ -29,13 +29,13 @@
 
 stdenv.mkDerivation rec {
   pname = "cinnamon-screensaver";
-  version = "6.4.0";
+  version = "6.4.1";
 
   src = fetchFromGitHub {
     owner = "linuxmint";
     repo = "cinnamon-screensaver";
     rev = version;
-    hash = "sha256-XlEu/aBwNeu+CC6IRnFTF6LUnb7VY2+OOGsdCvQYweA=";
+    hash = "sha256-CK4WP5IafNII81e8HxUNN3Vp36Ln78Xvv5lIMvL+nbk=";
   };
 
   patches = [
@@ -80,7 +80,7 @@ stdenv.mkDerivation rec {
     pam
     cairo
     cinnamon-desktop
-    cinnamon-common
+    cinnamon
     libgnomekbd
     caribou
   ];

pkgs/by-name/ci/cinnamon/package.nix

@@ -73,16 +73,15 @@ let
     ]
   );
 in
-# TODO (after 25.05 branch-off): Rename to pkgs.cinnamon
 stdenv.mkDerivation rec {
-  pname = "cinnamon-common";
-  version = "6.4.7";
+  pname = "cinnamon";
+  version = "6.4.10";
 
   src = fetchFromGitHub {
     owner = "linuxmint";
     repo = "cinnamon";
     rev = version;
-    hash = "sha256-WBdzlourYf2oEXUMbzNcNNsc8lBo6ujAy/K1Y6nGOjU=";
+    hash = "sha256-8yg39x5rWxJ2IcDFO4AjqrctPSjqdUSfmrKbjT3Yx+0=";
   };
 
   patches = [

pkgs/by-name/cj/cjs/package.nix

@@ -8,7 +8,7 @@
   glib,
   readline,
   libsysprof-capture,
-  spidermonkey_115,
+  spidermonkey_128,
   meson,
   mesonEmulatorHook,
   dbus,
@@ -19,13 +19,13 @@
 
 stdenv.mkDerivation rec {
   pname = "cjs";
-  version = "6.4.0";
+  version = "128.0";
 
   src = fetchFromGitHub {
     owner = "linuxmint";
     repo = "cjs";
     rev = version;
-    hash = "sha256-2lkIWroOo3hxu9/L/Ty7CADzVrZ0ohyHVmm65NoNlD4=";
+    hash = "sha256-B9N/oNRvsnr3MLkpcH/aBST6xOJSFdvSUFuD6EldE38=";
   };
 
   outputs = [
@@ -52,7 +52,7 @@ stdenv.mkDerivation rec {
     cairo
     readline
     libsysprof-capture
-    spidermonkey_115
+    spidermonkey_128
   ];
 
   propagatedBuildInputs = [

pkgs/by-name/cl/claude-code/package-lock.json

@@ -6,13 +6,13 @@
   "packages": {
     "": {
       "dependencies": {
-        "@anthropic-ai/claude-code": "^1.0.69"
+        "@anthropic-ai/claude-code": "^1.0.71"
       }
     },
     "node_modules/@anthropic-ai/claude-code": {
-      "version": "1.0.69",
-      "resolved": "https://registry.npmjs.org/@anthropic-ai/claude-code/-/claude-code-1.0.69.tgz",
-      "integrity": "sha512-kF86lNI9o6rt14cEDw16G89rHz4pL0lv/sASztV8XenEeQ/6VUZ5Jk+icYg6XTQKe33BsdtNKFS3IL3iLyzQyw==",
+      "version": "1.0.71",
+      "resolved": "https://registry.npmjs.org/@anthropic-ai/claude-code/-/claude-code-1.0.71.tgz",
+      "integrity": "sha512-2Z1HU8TiOSRZSZdHCPs+ih942cteUQ9Yx1EHHW5fO9y+gwxPYDR8Xbh/rAJMl/G58cJIn2jRiZmkWcGMN+Iqqg==",
       "license": "SEE LICENSE IN README.md",
       "bin": {
         "claude": "cli.js"

pkgs/by-name/cl/claude-code/package.nix

@@ -7,16 +7,16 @@
 
 buildNpmPackage rec {
   pname = "claude-code";
-  version = "1.0.69";
+  version = "1.0.71";
 
   nodejs = nodejs_20; # required for sandboxed Nix builds on Darwin
 
   src = fetchzip {
     url = "https://registry.npmjs.org/@anthropic-ai/claude-code/-/claude-code-${version}.tgz";
-    hash = "sha256-uZbe7N3FSAVxNxL7npujJcBFH6ZjnwDz327bZWN2IEM=";
+    hash = "sha256-ZJUvscbEaWHILL77R5/sPdNcxCLc2BL9P6tR+S7QnHg=";
   };
 
-  npmDepsHash = "sha256-a06NT96pVOiz06ZZ9r+1s+oF9U/I7SRJFFAw1e0NkMY=";
+  npmDepsHash = "sha256-wQ/DRPefziSRv6aFZXRpmz2vC6mQRqgc7r3++cDpYSg=";
 
   postPatch = ''
     cp ${./package-lock.json} package-lock.json

pkgs/by-name/co/code-cursor/package.nix

@@ -16,20 +16,20 @@ let
 
   sources = {
     x86_64-linux = fetchurl {
-      url = "https://downloads.cursor.com/production/a1fa6fc7d2c2f520293aad84aaa38d091dee6fef/linux/x64/Cursor-1.3.8-x86_64.AppImage";
-      hash = "sha256-qR1Wu3H0JUCKIoUP/QFC1YyYiRaQ9PVN7ZT9TjHwn1k=";
+      url = "https://downloads.cursor.com/production/54c27320fab08c9f5dd5873f07fca101f7a3e076/linux/x64/Cursor-1.3.9-x86_64.AppImage";
+      hash = "sha256-0kkTL6ZCnLxGBQSVoZ7UEOBNtTZVQolVAk/2McCV0Rw=";
     };
     aarch64-linux = fetchurl {
-      url = "https://downloads.cursor.com/production/a1fa6fc7d2c2f520293aad84aaa38d091dee6fef/linux/arm64/Cursor-1.3.8-aarch64.AppImage";
-      hash = "sha256-UrUstEFP8W8Y9WUCR5kt3434bKCBBK/NaSu2UK8+gII=";
+      url = "https://downloads.cursor.com/production/54c27320fab08c9f5dd5873f07fca101f7a3e076/linux/arm64/Cursor-1.3.9-aarch64.AppImage";
+      hash = "sha256-5g26fm+tpm8xQTutygI20TcUHL08gKlG0uZSHixK2Ao=";
     };
     x86_64-darwin = fetchurl {
-      url = "https://downloads.cursor.com/production/a1fa6fc7d2c2f520293aad84aaa38d091dee6fef/darwin/x64/Cursor-darwin-x64.dmg";
-      hash = "sha256-FGjqbOdr1HSjVlDYP/+vp4bVQoqdJww3U4t59QLg1kk=";
+      url = "https://downloads.cursor.com/production/54c27320fab08c9f5dd5873f07fca101f7a3e076/darwin/x64/Cursor-darwin-x64.dmg";
+      hash = "sha256-IJV35JNpoUybArz2NhvX8IzDUmvzN+GVq/MyDtXgVeI=";
     };
     aarch64-darwin = fetchurl {
-      url = "https://downloads.cursor.com/production/a1fa6fc7d2c2f520293aad84aaa38d091dee6fef/darwin/arm64/Cursor-darwin-arm64.dmg";
-      hash = "sha256-tsVPS48APst7kbEh7cjhJ2zYKcKBDdjH+NXMpAe4Ixs=";
+      url = "https://downloads.cursor.com/production/54c27320fab08c9f5dd5873f07fca101f7a3e076/darwin/arm64/Cursor-darwin-arm64.dmg";
+      hash = "sha256-TYdv8UKoBtv0WUHWBqJtpG9vHDkEBBPLS/7BZhdxR1M=";
     };
   };
 
@@ -39,7 +39,7 @@ in
   inherit useVSCodeRipgrep;
   commandLineArgs = finalCommandLineArgs;
 
-  version = "1.3.8";
+  version = "1.3.9";
   pname = "cursor";
 
   # You can find the current VSCode version in the About dialog:

pkgs/by-name/co/codebuff/package-lock.json

@@ -5,7 +5,7 @@
   "packages": {
     "": {
       "dependencies": {
-        "codebuff": "^1.0.441"
+        "codebuff": "^1.0.451"
       }
     },
     "node_modules/chownr": {
@@ -18,9 +18,9 @@
       }
     },
     "node_modules/codebuff": {
-      "version": "1.0.441",
-      "resolved": "https://registry.npmjs.org/codebuff/-/codebuff-1.0.441.tgz",
-      "integrity": "sha512-2/u30sGXiEd1caB+doYWy34lbv8DJhQ2SomHXpCmmeEKITUgd9ckdVMLaaEgrR/FIUHyFBcu7aCVzmwsBEfnuQ==",
+      "version": "1.0.451",
+      "resolved": "https://registry.npmjs.org/codebuff/-/codebuff-1.0.451.tgz",
+      "integrity": "sha512-LYzX+cu1zMnU/qntnRMQzQ+iPT436OYphFyIrEvx5DarfEEns5UIMDyWp0E9PWxbU4WsJfHJnL6srYxC/T8hUg==",
       "cpu": [
         "x64",
         "arm64"

pkgs/by-name/co/codebuff/package.nix

@@ -6,14 +6,14 @@
 
 buildNpmPackage rec {
   pname = "codebuff";
-  version = "1.0.441";
+  version = "1.0.451";
 
   src = fetchzip {
     url = "https://registry.npmjs.org/codebuff/-/codebuff-${version}.tgz";
-    hash = "sha256-l57ZQTvvIR8mpFJGJeF6AqE6sbjIUkQdjlvdQ4UAQ9g=";
+    hash = "sha256-98NiHDb0PrK71I28y7DwDJf2i+mKTQBp22PY4WJh5ig=";
   };
 
-  npmDepsHash = "sha256-/LiXKA0HdFg3K7xyioL0SKjWicktCpih1oJkEPLDzIA=";
+  npmDepsHash = "sha256-qtBi5OT7UBsCIriO6Fk33gLOFNp5Ae0bT9qN+37b2sg=";
 
   postPatch = ''
     cp ${./package-lock.json} package-lock.json

pkgs/by-name/co/codex/package.nix

@@ -14,18 +14,18 @@
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "codex";
-  version = "0.11.0";
+  version = "0.14.0";
 
   src = fetchFromGitHub {
     owner = "openai";
     repo = "codex";
     tag = "rust-v${finalAttrs.version}";
-    hash = "sha256-t7FgR84alnJGhN/dsFtUySFfOpGoBlRfP+D/Q6JPz5M=";
+    hash = "sha256-qpYkD8fpnlTJ7RLAQrfswLFc58l/KY0x8NgGl/msG/I=";
   };
 
   sourceRoot = "${finalAttrs.src.name}/codex-rs";
 
-  cargoHash = "sha256-SNl6UXzvtVR+ep7CIoCcpvET8Hs7ew1fmHqOXbzN7kU=";
+  cargoHash = "sha256-oPWkxEMnffDZ7cmjWmmYGurYnHn4vYu64BhG7NhrxhE=";
 
   nativeBuildInputs = [
     installShellFiles
@@ -49,6 +49,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
     "--skip=includes_base_instructions_override_in_request" # Fails with 'stream ended unexpectedly: InternalAgentDied'
     "--skip=includes_user_instructions_message_in_request" # Fails with 'stream ended unexpectedly: InternalAgentDied'
     "--skip=originator_config_override_is_used" # Fails with 'stream ended unexpectedly: InternalAgentDied'
+    "--skip=azure_overrides_assign_properties_used_for_responses_url" # Panics
     "--skip=test_conversation_create_and_send_message_ok" # Version 0.0.0 hardcoded
     "--skip=test_send_message_session_not_found" # Version 0.0.0 hardcoded
     "--skip=test_send_message_success" # Version 0.0.0 hardcoded

pkgs/by-name/cr/cryptop/package.nix

@@ -1,13 +1,9 @@
 {
   lib,
-  buildPythonApplication,
+  python3Packages,
   fetchPypi,
-  requests,
-  requests-cache,
-  setuptools,
 }:
-
-buildPythonApplication rec {
+python3Packages.buildPythonApplication rec {
   pname = "cryptop";
   version = "0.2.0";
   format = "setuptools";
@@ -17,7 +13,7 @@ buildPythonApplication rec {
     sha256 = "0akrrz735vjfrm78plwyg84vabj0x3qficq9xxmy9kr40fhdkzpb";
   };
 
-  propagatedBuildInputs = [
+  propagatedBuildInputs = with python3Packages; [
     setuptools
     requests
     requests-cache
@@ -29,7 +25,7 @@ buildPythonApplication rec {
   meta = {
     homepage = "https://github.com/huwwp/cryptop";
     description = "Command line Cryptocurrency Portfolio";
-    license = with lib.licenses; [ mit ];
+    license = lib.licenses.mit;
     maintainers = with lib.maintainers; [ bhipple ];
     mainProgram = "cryptop";
   };

pkgs/by-name/cs/csharpier/package.nix

@@ -2,10 +2,10 @@
 
 buildDotnetGlobalTool {
   pname = "csharpier";
-  version = "1.0.3";
+  version = "1.1.1";
   executables = "csharpier";
 
-  nugetHash = "sha256-DJe3zpzFCBjmsNmLMgIC1clLxo/exPZ+xHUmdpKMaMo=";
+  nugetHash = "sha256-B0ijqWm3eZ31T+C5zRr4TkmfPsOfseaHpGPYZf5Yiw4=";
 
   meta = with lib; {
     description = "Opinionated code formatter for C#";

pkgs/by-name/de/deepsource/package.nix

@@ -9,13 +9,13 @@
 
 buildGoModule rec {
   pname = "deepsource";
-  version = "0.9.0";
+  version = "0.10.0";
 
   src = fetchFromGitHub {
     owner = "DeepSourceCorp";
     repo = "cli";
     rev = "v${version}";
-    hash = "sha256-GWIQT6VIvU4ZIHwK3v2bGasE4mJc2cMpUAJvIQ2zJR4=";
+    hash = "sha256-kmP3U6SRvolmi7QA0rFNTg+w+DJEQUHOmbSE4sdEBK4=";
   };
 
   nativeBuildInputs = [ installShellFiles ];

pkgs/by-name/dn/dnscontrol/package.nix

@@ -9,16 +9,16 @@
 
 buildGoModule rec {
   pname = "dnscontrol";
-  version = "4.22.0";
+  version = "4.23.0";
 
   src = fetchFromGitHub {
     owner = "StackExchange";
     repo = "dnscontrol";
     tag = "v${version}";
-    hash = "sha256-5K2o0qa+19ur6axDrVkhDDoTMzRO/oNYIGJciIKGvII=";
+    hash = "sha256-Jaa+geO2836kQHTRhaQru367iQvqac6sgnpL9244dkw=";
   };
 
-  vendorHash = "sha256-hniL/pFbYOjpLuAHdH0gD0kFKnW9d/pN7283m9V3e/0=";
+  vendorHash = "sha256-PbOqi9vfz46lwoP3aUPl/JKDJtYYF7IwnN9lppZ8KYA=";
 
   nativeBuildInputs = [ installShellFiles ];
 

pkgs/by-name/do/docker-language-server/package.nix

@@ -8,16 +8,16 @@
 
 buildGoModule rec {
   pname = "docker-language-server";
-  version = "0.14.0";
+  version = "0.15.0";
 
   src = fetchFromGitHub {
     owner = "docker";
     repo = "docker-language-server";
     tag = "v${version}";
-    hash = "sha256-ht63NilujpbDhBjkzCNpY95AAuwqya37qchgqKLlTw8=";
+    hash = "sha256-cxLg0fLUC4dj3QUax+vIsJENRXNifbXMoRkldM44i+0=";
   };
 
-  vendorHash = "sha256-w7CDl27178oe/DpfqSbNbyOsR3D34EpcCMZNQ7i3JE4=";
+  vendorHash = "sha256-xvRHxi7aem88mrmdAmSyRNtBUSZD4rjUut2VjPeoejg=";
 
   nativeCheckInputs = [
     docker

pkgs/by-name/do/dosage-tracker/package.nix

@@ -17,13 +17,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "dosage";
-  version = "1.9.9";
+  version = "1.9.10";
 
   src = fetchFromGitHub {
     owner = "diegopvlk";
     repo = "Dosage";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-UVcbZgPk35VsYvyzIJrR79vAhSByJjn8kh+y0KQcwpM=";
+    hash = "sha256-aLZ1Jl2h5KmZQ8zNyNqivAkf4Gjqh2eQfoKLabdXhBI=";
   };
 
   # https://github.com/NixOS/nixpkgs/issues/318830

pkgs/by-name/do/dotenv-cli/package.nix

@@ -10,18 +10,18 @@
 }:
 stdenv.mkDerivation rec {
   pname = "dotenv-cli";
-  version = "9.0.0";
+  version = "10.0.0";
 
   src = fetchFromGitHub {
     owner = "entropitor";
     repo = "dotenv-cli";
     rev = "v${version}";
-    hash = "sha256-mpVObsilwVCq1V2Z11uqK1T7VgwpfTYng2vqrTqJZE4=";
+    hash = "sha256-prSGIEHf6wRqOFVsn3Ws25yG7Ga2YEbiU/IMP3QeLXU=";
   };
 
   yarnOfflineCache = fetchYarnDeps {
     yarnLock = "${src}/yarn.lock";
-    hash = "sha256-ak6QD9Z0tE0XgFVt3QkjZxk2kelUFPX9bEF855RiY2w=";
+    hash = "sha256-rbG1oM1mEZSB/eYp87YMi6v9ves5YR7u7rkQRlziz7I=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/do/dotenvx/package.nix

@@ -8,16 +8,16 @@
 
 buildNpmPackage rec {
   pname = "dotenvx";
-  version = "1.48.3";
+  version = "1.48.4";
 
   src = fetchFromGitHub {
     owner = "dotenvx";
     repo = "dotenvx";
     tag = "v${version}";
-    hash = "sha256-5clMrH9r7CltZ2oEfDvyubFroOq/YVRaPkBfRnMyHNc=";
+    hash = "sha256-reWOFI17YSaCTFriCpJELdDj9K2MintKt9OBy/2aXE4=";
   };
 
-  npmDepsHash = "sha256-O8w5gyG2PDUSGuAcSQ4ccvkYhb9pQL5NjWXjSoXk6gQ=";
+  npmDepsHash = "sha256-XPkqJVkShCzft4LEobCUgbsyl5W/vHXRPNPKltFO5hc=";
 
   dontNpmBuild = true;
 

pkgs/by-name/du/duckstation-bin/package.nix

@@ -1,45 +0,0 @@
-{
-  lib,
-  stdenvNoCC,
-  fetchurl,
-  unzip,
-}:
-
-stdenvNoCC.mkDerivation (finalAttrs: {
-  pname = "duckstation-bin";
-  version = "0.1-7371";
-
-  src = fetchurl {
-    url = "https://github.com/stenzek/duckstation/releases/download/v${finalAttrs.version}/duckstation-mac-release.zip";
-    hash = "sha256-ukORbTG0lZIsUInkEnyPB9+PwFxxK5hbgj9D6tjOEAY=";
-  };
-
-  nativeBuildInputs = [ unzip ];
-
-  dontPatch = true;
-  dontConfigure = true;
-  dontBuild = true;
-
-  sourceRoot = ".";
-
-  installPhase = ''
-    runHook preInstall
-    mkdir -p $out/Applications
-    cp -r DuckStation.app $out/Applications/DuckStation.app
-    runHook postInstall
-  '';
-
-  passthru = {
-    updateScript = ./update.sh;
-  };
-
-  meta = {
-    homepage = "https://github.com/stenzek/duckstation";
-    description = "Fast PlayStation 1 emulator for x86-64/AArch32/AArch64";
-    changelog = "https://github.com/stenzek/duckstation/releases/tag/v${finalAttrs.version}";
-    license = lib.licenses.gpl3Only;
-    maintainers = with lib.maintainers; [ matteopacini ];
-    platforms = lib.platforms.darwin;
-    sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
-  };
-})

pkgs/by-name/du/duckstation-bin/update.sh

@@ -1,20 +0,0 @@
-#!/usr/bin/env nix-shell
-#!nix-shell -i bash -p curl jq gnused
-
-set -euo pipefail
-
-cd "$(dirname "$0")" || exit 1
-
-# Grab latest version, ignoring "latest" and "preview" tags
-LATEST_VER="$(curl --fail -s ${GITHUB_TOKEN:+-u ":$GITHUB_TOKEN"} "https://api.github.com/repos/stenzek/duckstation/releases" | jq -r '.[].tag_name' | grep '^v' | head -n 1 | sed 's/^v//')"
-CURRENT_VER="$(grep -oP 'version = "\K[^"]+' package.nix)"
-
-if [[ "$LATEST_VER" == "$CURRENT_VER" ]]; then
-    echo "duckstation-bin is up-to-date"
-    exit 0
-fi
-
-HASH="$(nix-hash --to-sri --type sha256 "$(nix-prefetch-url --type sha256 "https://github.com/stenzek/duckstation/releases/download/v${LATEST_VER}/duckstation-mac-release.zip")")"
-
-sed -i "s#hash = \".*\"#hash = \"$HASH\"#g" package.nix
-sed -i "s#version = \".*\";#version = \"$LATEST_VER\";#g" package.nix

pkgs/by-name/du/duckstation/001-fix-test-inclusion.diff

@@ -1,11 +0,0 @@
-diff --git a/src/CMakeLists.txt b/src/CMakeLists.txt
-index 879d46bc..95570f6b 100644
---- a/src/CMakeLists.txt
-+++ b/src/CMakeLists.txt
-@@ -20,5 +20,5 @@ if(BUILD_REGTEST)
- endif()
- 
- if(BUILD_TESTS)
--  add_subdirectory(common-tests EXCLUDE_FROM_ALL)
-+  add_subdirectory(common-tests)
- endif()

pkgs/by-name/du/duckstation/002-hardcode-vars.diff

@@ -1,19 +0,0 @@
-diff --git a/src/scmversion/gen_scmversion.sh b/src/scmversion/gen_scmversion.sh
-index 9122cd8..50ed8f9 100755
---- a/src/scmversion/gen_scmversion.sh
-+++ b/src/scmversion/gen_scmversion.sh
-@@ -10,10 +10,10 @@ else
- fi
- 
- 
--HASH=$(git rev-parse HEAD)
--BRANCH=$(git rev-parse --abbrev-ref HEAD | tr -d '\r\n')
--TAG=$(git describe --dirty | tr -d '\r\n')
--DATE=$(git log -1 --date=iso8601-strict --format=%cd)
-+HASH="@gitHash@"
-+BRANCH="@gitBranch@"
-+TAG="@gitTag@"
-+DATE="@gitDate@"
- 
- cd $CURDIR
- 

pkgs/by-name/du/duckstation/003-fix-NEON-intrinsics.patch

@@ -1,70 +0,0 @@
-From 19e094e5c7aaaf375a13424044521701e85c8313 Mon Sep 17 00:00:00 2001
-From: OPNA2608 <opna2608@protonmail.com>
-Date: Thu, 9 Jan 2025 17:46:25 +0100
-Subject: [PATCH] Fix usage of NEON intrinsics
-
----
- src/common/gsvector_neon.h | 12 ++++++------
- 1 file changed, 6 insertions(+), 6 deletions(-)
-
-diff --git a/src/common/gsvector_neon.h b/src/common/gsvector_neon.h
-index e4991af5e..61b8dc09b 100644
---- a/src/common/gsvector_neon.h
-+++ b/src/common/gsvector_neon.h
-@@ -867,7 +867,7 @@ public:
- 
-   ALWAYS_INLINE int mask() const
-   {
--    const uint32x2_t masks = vshr_n_u32(vreinterpret_u32_s32(v2s), 31);
-+    const uint32x2_t masks = vshr_n_u32(vreinterpret_u32_f32(v2s), 31);
-     return (vget_lane_u32(masks, 0) | (vget_lane_u32(masks, 1) << 1));
-   }
- 
-@@ -2882,7 +2882,7 @@ public:
-   ALWAYS_INLINE GSVector4 gt64(const GSVector4& v) const
-   {
- #ifdef CPU_ARCH_ARM64
--    return GSVector4(vreinterpretq_f32_f64(vcgtq_f64(vreinterpretq_f64_f32(v4s), vreinterpretq_f64_f32(v.v4s))));
-+    return GSVector4(vreinterpretq_f32_u64(vcgtq_f64(vreinterpretq_f64_f32(v4s), vreinterpretq_f64_f32(v.v4s))));
- #else
-     GSVector4 ret;
-     ret.U64[0] = (F64[0] > v.F64[0]) ? 0xFFFFFFFFFFFFFFFFULL : 0;
-@@ -2894,7 +2894,7 @@ public:
-   ALWAYS_INLINE GSVector4 eq64(const GSVector4& v) const
-   {
- #ifdef CPU_ARCH_ARM64
--    return GSVector4(vreinterpretq_f32_f64(vceqq_f64(vreinterpretq_f64_f32(v4s), vreinterpretq_f64_f32(v.v4s))));
-+    return GSVector4(vreinterpretq_f32_u64(vceqq_f64(vreinterpretq_f64_f32(v4s), vreinterpretq_f64_f32(v.v4s))));
- #else
-     GSVector4 ret;
-     ret.U64[0] = (F64[0] == v.F64[0]) ? 0xFFFFFFFFFFFFFFFFULL : 0;
-@@ -2906,7 +2906,7 @@ public:
-   ALWAYS_INLINE GSVector4 lt64(const GSVector4& v) const
-   {
- #ifdef CPU_ARCH_ARM64
--    return GSVector4(vreinterpretq_f32_f64(vcgtq_f64(vreinterpretq_f64_f32(v4s), vreinterpretq_f64_f32(v.v4s))));
-+    return GSVector4(vreinterpretq_f32_u64(vcgtq_f64(vreinterpretq_f64_f32(v4s), vreinterpretq_f64_f32(v.v4s))));
- #else
-     GSVector4 ret;
-     ret.U64[0] = (F64[0] < v.F64[0]) ? 0xFFFFFFFFFFFFFFFFULL : 0;
-@@ -2918,7 +2918,7 @@ public:
-   ALWAYS_INLINE GSVector4 ge64(const GSVector4& v) const
-   {
- #ifdef CPU_ARCH_ARM64
--    return GSVector4(vreinterpretq_f32_f64(vcgeq_f64(vreinterpretq_f64_f32(v4s), vreinterpretq_f64_f32(v.v4s))));
-+    return GSVector4(vreinterpretq_f32_u64(vcgeq_f64(vreinterpretq_f64_f32(v4s), vreinterpretq_f64_f32(v.v4s))));
- #else
-     GSVector4 ret;
-     ret.U64[0] = (F64[0] >= v.F64[0]) ? 0xFFFFFFFFFFFFFFFFULL : 0;
-@@ -2930,7 +2930,7 @@ public:
-   ALWAYS_INLINE GSVector4 le64(const GSVector4& v) const
-   {
- #ifdef CPU_ARCH_ARM64
--    return GSVector4(vreinterpretq_f32_f64(vcleq_f64(vreinterpretq_f64_f32(v4s), vreinterpretq_f64_f32(v.v4s))));
-+    return GSVector4(vreinterpretq_f32_u64(vcleq_f64(vreinterpretq_f64_f32(v4s), vreinterpretq_f64_f32(v.v4s))));
- #else
-     GSVector4 ret;
-     ret.U64[0] = (F64[0] <= v.F64[0]) ? 0xFFFFFFFFFFFFFFFFULL : 0;
--- 
-2.47.0
-

pkgs/by-name/du/duckstation/package.nix

@@ -1,147 +0,0 @@
-{
-  lib,
-  stdenv,
-  llvmPackages,
-  SDL2,
-  callPackage,
-  cmake,
-  cpuinfo,
-  cubeb,
-  curl,
-  extra-cmake-modules,
-  libXrandr,
-  libbacktrace,
-  libwebp,
-  makeWrapper,
-  ninja,
-  pkg-config,
-  qt6,
-  vulkan-loader,
-  wayland,
-  wayland-scanner,
-}:
-
-let
-  sources = callPackage ./sources.nix { };
-  inherit (qt6)
-    qtbase
-    qtsvg
-    qttools
-    qtwayland
-    wrapQtAppsHook
-    ;
-in
-llvmPackages.stdenv.mkDerivation (finalAttrs: {
-  inherit (sources.duckstation) pname version src;
-
-  patches = [
-    # Tests are not built by default
-    ./001-fix-test-inclusion.diff
-    # Patching yet another script that fills data based on git commands . . .
-    ./002-hardcode-vars.diff
-    # Fix NEON intrinsics usage
-    ./003-fix-NEON-intrinsics.patch
-    ./remove-cubeb-vendor.patch
-  ];
-
-  nativeBuildInputs = [
-    cmake
-    extra-cmake-modules
-    ninja
-    pkg-config
-    qttools
-    wayland-scanner
-    wrapQtAppsHook
-  ];
-
-  buildInputs = [
-    SDL2
-    cpuinfo
-    cubeb
-    curl
-    libXrandr
-    libbacktrace
-    libwebp
-    qtbase
-    qtsvg
-    qtwayland
-    sources.discord-rpc-patched
-    sources.lunasvg
-    sources.shaderc-patched
-    sources.soundtouch-patched
-    sources.spirv-cross-patched
-    wayland
-  ];
-
-  cmakeFlags = [
-    (lib.cmakeBool "BUILD_TESTS" true)
-  ];
-
-  strictDeps = true;
-
-  doInstallCheck = true;
-
-  postPatch = ''
-    gitHash=$(cat .nixpkgs-auxfiles/git_hash) \
-    gitBranch=$(cat .nixpkgs-auxfiles/git_branch) \
-    gitTag=$(cat .nixpkgs-auxfiles/git_tag) \
-    gitDate=$(cat .nixpkgs-auxfiles/git_date) \
-      substituteAllInPlace src/scmversion/gen_scmversion.sh
-  '';
-
-  # error: cannot convert 'int16x8_t' to '__Int32x4_t'
-  env.NIX_CFLAGS_COMPILE = lib.optionalString stdenv.hostPlatform.isAarch64 "-flax-vector-conversions";
-
-  installCheckPhase = ''
-    runHook preInstallCheck
-
-    $out/share/duckstation/common-tests
-
-    runHook postInstallCheck
-  '';
-
-  installPhase = ''
-    runHook preInstall
-
-    mkdir -p $out/bin $out/share
-
-    cp -r bin $out/share/duckstation
-    ln -s $out/share/duckstation/duckstation-qt $out/bin/
-
-    install -Dm644 $src/scripts/org.duckstation.DuckStation.desktop $out/share/applications/org.duckstation.DuckStation.desktop
-    install -Dm644 $src/scripts/org.duckstation.DuckStation.png $out/share/pixmaps/org.duckstation.DuckStation.png
-
-    runHook postInstall
-  '';
-
-  qtWrapperArgs =
-    let
-      libPath = lib.makeLibraryPath ([
-        sources.shaderc-patched
-        sources.spirv-cross-patched
-        vulkan-loader
-      ]);
-    in
-    [
-      "--prefix LD_LIBRARY_PATH : ${libPath}"
-    ];
-
-  # https://github.com/stenzek/duckstation/blob/master/scripts/appimage/apprun-hooks/default-to-x11.sh
-  # Can't avoid the double wrapping, the binary wrapper from qtWrapperArgs doesn't support --run
-  postFixup = ''
-    source "${makeWrapper}/nix-support/setup-hook"
-    wrapProgram $out/bin/duckstation-qt \
-      --run 'if [[ -z $I_WANT_A_BROKEN_WAYLAND_UI ]]; then export QT_QPA_PLATFORM=xcb; fi'
-  '';
-
-  meta = {
-    homepage = "https://github.com/stenzek/duckstation";
-    description = "Fast PlayStation 1 emulator for x86-64/AArch32/AArch64";
-    license = lib.licenses.gpl3Only;
-    mainProgram = "duckstation-qt";
-    maintainers = with lib.maintainers; [
-      guibou
-    ];
-    platforms = lib.platforms.linux;
-  };
-})

pkgs/by-name/du/duckstation/remove-cubeb-vendor.patch

@@ -1,33 +0,0 @@
-diff --git a/dep/CMakeLists.txt b/dep/CMakeLists.txt
-index af35687..8347825 100644
---- a/dep/CMakeLists.txt
-+++ b/dep/CMakeLists.txt
-@@ -22,9 +22,8 @@ add_subdirectory(rcheevos EXCLUDE_FROM_ALL)
- disable_compiler_warnings_for_target(rcheevos)
- add_subdirectory(rapidyaml EXCLUDE_FROM_ALL)
- disable_compiler_warnings_for_target(rapidyaml)
--add_subdirectory(cubeb EXCLUDE_FROM_ALL)
--disable_compiler_warnings_for_target(cubeb)
--disable_compiler_warnings_for_target(speex)
-+find_package(cubeb REQUIRED GLOBAL)
-+add_library(cubeb ALIAS cubeb::cubeb)
- add_subdirectory(kissfft EXCLUDE_FROM_ALL)
- disable_compiler_warnings_for_target(kissfft)
- 
-diff --git a/src/util/cubeb_audio_stream.cpp b/src/util/cubeb_audio_stream.cpp
-index 85579c4..339190a 100644
---- a/src/util/cubeb_audio_stream.cpp
-+++ b/src/util/cubeb_audio_stream.cpp
-@@ -261,9 +261,9 @@ std::vector<std::pair<std::string, std::string>> AudioStream::GetCubebDriverName
-   std::vector<std::pair<std::string, std::string>> names;
-   names.emplace_back(std::string(), TRANSLATE_STR("AudioStream", "Default"));
- 
--  const char** cubeb_names = cubeb_get_backend_names();
--  for (u32 i = 0; cubeb_names[i] != nullptr; i++)
--    names.emplace_back(cubeb_names[i], cubeb_names[i]);
-+  cubeb_backend_names backends = cubeb_get_backend_names();
-+  for (u32 i = 0; i < backends.count; i++)
-+    names.emplace_back(backends.names[i], backends.names[i]);
-   return names;
- }
-

pkgs/by-name/du/duckstation/shaderc-patched.nix

@@ -1,20 +0,0 @@
-{
-  fetchpatch,
-  duckstation,
-  shaderc,
-}:
-
-shaderc.overrideAttrs (old: {
-  pname = "shaderc-patched-for-duckstation";
-  patches = (old.patches or [ ]) ++ [
-    (fetchpatch {
-      url = "file://${duckstation.src}/scripts/shaderc-changes.patch";
-      hash = "sha256-Ps/D+CdSbjVWg3ZGOEcgbpQbCNkI5Nuizm4E5qiM9Wo=";
-      excludes = [
-        "CHANGES"
-        "CMakeLists.txt"
-        "libshaderc/CMakeLists.txt"
-      ];
-    })
-  ];
-})

pkgs/by-name/du/duckstation/sources.nix

@@ -1,166 +0,0 @@
-{
-  lib,
-  duckstation,
-  fetchFromGitHub,
-  fetchpatch,
-  shaderc,
-  spirv-cross,
-  discord-rpc,
-  stdenv,
-  cmake,
-  ninja,
-}:
-
-{
-  duckstation =
-    let
-      self = {
-        pname = "duckstation";
-        version = "0.1-7465";
-        src = fetchFromGitHub {
-          owner = "stenzek";
-          repo = "duckstation";
-          rev = "aa955b8ae28314ae061613f0ddf13183a98aca03";
-          #
-          # Some files are filled by using Git commands; it requires deepClone.
-          # More info at `checkout_ref` function in nix-prefetch-git.
-          # However, `.git` is a bit nondeterministic (and Git itself makes no
-          # guarantees whatsoever).
-          # Then, in order to enhance reproducibility, what we will do here is:
-          #
-          # - Execute the desired Git commands;
-          # - Save the obtained info into files;
-          # - Remove `.git` afterwards.
-          #
-          deepClone = true;
-          postFetch = ''
-            cd $out
-            mkdir -p .nixpkgs-auxfiles/
-            git rev-parse HEAD > .nixpkgs-auxfiles/git_hash
-            git rev-parse --abbrev-ref HEAD | tr -d '\r\n' > .nixpkgs-auxfiles/git_branch
-            git describe --dirty | tr -d '\r\n' > .nixpkgs-auxfiles/git_tag
-            git log -1 --date=iso8601-strict --format=%cd > .nixpkgs-auxfiles/git_date
-            find $out -name .git -print0 | xargs -0 rm -fr
-          '';
-          hash = "sha256-ixrlr7Rm6GZAn/kh2sSeCCiK/qdmQ5+5jbbhAKjTx/E=";
-        };
-      };
-    in
-    self;
-
-  shaderc-patched = shaderc.overrideAttrs (
-    old:
-    let
-      version = "2024.3-unstable-2024-08-24";
-      src = fetchFromGitHub {
-        owner = "stenzek";
-        repo = "shaderc";
-        rev = "f60bb80e255144e71776e2ad570d89b78ea2ab4f";
-        hash = "sha256-puZxkrEVhhUT4UcCtEDmtOMX4ugkB6ooMhKRBlb++lE=";
-      };
-    in
-    {
-      pname = "shaderc-patched-for-duckstation";
-      inherit version src;
-      patches = (old.patches or [ ]);
-      cmakeFlags = (old.cmakeFlags or [ ]) ++ [
-        (lib.cmakeBool "SHADERC_SKIP_EXAMPLES" true)
-        (lib.cmakeBool "SHADERC_SKIP_TESTS" true)
-      ];
-      outputs = [
-        "out"
-        "lib"
-        "dev"
-      ];
-      postFixup = '''';
-    }
-  );
-  spirv-cross-patched = spirv-cross.overrideAttrs (
-    old:
-    let
-      version = "1.3.290.0";
-      src = fetchFromGitHub {
-        owner = "KhronosGroup";
-        repo = "SPIRV-Cross";
-        rev = "vulkan-sdk-${version}";
-        hash = "sha256-h5My9PbPq1l03xpXQQFolNy7G1RhExtTH6qPg7vVF/8=";
-      };
-    in
-    {
-      pname = "spirv-cross-patched-for-duckstation";
-      inherit version src;
-      patches = (old.patches or [ ]);
-      cmakeFlags = (old.cmakeFlags or [ ]) ++ [
-        (lib.cmakeBool "SPIRV_CROSS_CLI" false)
-        (lib.cmakeBool "SPIRV_CROSS_ENABLE_CPP" false)
-        (lib.cmakeBool "SPIRV_CROSS_ENABLE_C_API" true)
-        (lib.cmakeBool "SPIRV_CROSS_ENABLE_GLSL" true)
-        (lib.cmakeBool "SPIRV_CROSS_ENABLE_HLSL" false)
-        (lib.cmakeBool "SPIRV_CROSS_ENABLE_MSL" false)
-        (lib.cmakeBool "SPIRV_CROSS_ENABLE_REFLECT" false)
-        (lib.cmakeBool "SPIRV_CROSS_ENABLE_TESTS" false)
-        (lib.cmakeBool "SPIRV_CROSS_ENABLE_UTIL" true)
-        (lib.cmakeBool "SPIRV_CROSS_SHARED" true)
-        (lib.cmakeBool "SPIRV_CROSS_STATIC" false)
-      ];
-    }
-  );
-  discord-rpc-patched = discord-rpc.overrideAttrs (old: {
-    pname = "discord-rpc-patched-for-duckstation";
-    version = "3.4.0-unstable-2024-08-02";
-    src = fetchFromGitHub {
-      owner = "stenzek";
-      repo = "discord-rpc";
-      rev = "144f3a3f1209994d8d9e8a87964a989cb9911c1e";
-      hash = "sha256-VyL8bEjY001eHWcEoUPIAFDAmaAbwcNb1hqlV2a3cWs=";
-    };
-    patches = (old.patches or [ ]);
-  });
-
-  soundtouch-patched = stdenv.mkDerivation (finalAttrs: {
-    pname = "soundtouch-patched-for-duckstation";
-    version = "2.2.3-unstable-2024-08-02";
-    src = fetchFromGitHub {
-      owner = "stenzek";
-      repo = "soundtouch";
-      rev = "463ade388f3a51da078dc9ed062bf28e4ba29da7";
-      hash = "sha256-hvBW/z+fmh/itNsJnlDBtiI1DZmUMO9TpHEztjo2pA0=";
-    };
-
-    nativeBuildInputs = [
-      cmake
-      ninja
-    ];
-
-    meta = {
-      homepage = "https://github.com/stenzek/soundtouch";
-      description = "SoundTouch Audio Processing Library (forked from https://codeberg.org/soundtouch/soundtouch)";
-      license = lib.licenses.lgpl21;
-      platforms = lib.platforms.linux;
-    };
-
-  });
-
-  lunasvg = stdenv.mkDerivation (finalAttrs: {
-    pname = "lunasvg-patched-for-duckstation";
-    version = "2.4.1-unstable-2024-08-24";
-    src = fetchFromGitHub {
-      owner = "stenzek";
-      repo = "lunasvg";
-      rev = "9af1ac7b90658a279b372add52d6f77a4ebb482c";
-      hash = "sha256-ZzOe84ZF5JRrJ9Lev2lwYOccqtEGcf76dyCDBDTvI2o=";
-    };
-
-    nativeBuildInputs = [
-      cmake
-      ninja
-    ];
-
-    meta = {
-      homepage = "https://github.com/stenzek/lunasvg";
-      description = "Standalone SVG rendering library in C++";
-      license = lib.licenses.mit;
-      platforms = lib.platforms.linux;
-    };
-  });
-}

pkgs/by-name/en/enzyme/package.nix

@@ -7,13 +7,13 @@
 }:
 llvmPackages.stdenv.mkDerivation rec {
   pname = "enzyme";
-  version = "0.0.187";
+  version = "0.0.188";
 
   src = fetchFromGitHub {
     owner = "EnzymeAD";
     repo = "Enzyme";
     rev = "v${version}";
-    hash = "sha256-vdLt7LtVkgcgoUzzl5jb7ERIyQMpY+iSwJpdQpWxoJw=";
+    hash = "sha256-CoImpu1Hwn11s+6GeYPIyaIHz7kdjrBMpbxAUzaJWZU=";
   };
 
   postPatch = ''

pkgs/by-name/et/ethercat/package.nix

@@ -8,13 +8,13 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "ethercat";
-  version = "1.6.6";
+  version = "1.6.7";
 
   src = fetchFromGitLab {
     owner = "etherlab.org";
     repo = "ethercat";
     rev = "refs/tags/${finalAttrs.version}";
-    hash = "sha256-11Y4qGJlbZYnFZ3pI18kjE2aIht30ZtN4eTsYhWqg+g=";
+    hash = "sha256-UNd8PLdudI5TMdKKNH6BQP2VQ0LSPvsA/sEYnIuZRRA=";
   };
 
   separateDebugInfo = true;

pkgs/by-name/fh/fh/package.nix

@@ -10,16 +10,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "fh";
-  version = "0.1.24";
+  version = "0.1.25";
 
   src = fetchFromGitHub {
     owner = "DeterminateSystems";
     repo = "fh";
     rev = "v${version}";
-    hash = "sha256-t7IZlG7rKNbkt2DIU5H0/B0+b4e9YEVJx14ijpOycCw=";
+    hash = "sha256-YVtFzJMdHpshtRqBDVw3Kr88psAPfcdOI0XVDGnFkq0=";
   };
 
-  cargoHash = "sha256-IXzqcIVk7F/MgWofzlwEkXfu7s8e7GdjYhdFbXUTeeo=";
+  cargoHash = "sha256-D/8YYv9V1ny9AWFkVPgcE9doq+OxN+yiCCt074FKgn0=";
 
   nativeBuildInputs = [
     installShellFiles