Merge remote-tracking branch 'origin/master' into staging-next

Conflicts:
	pkgs/by-name/ha/harper/package.nix

doc/hooks/tauri.section.md

@@ -26,6 +26,7 @@ In Nixpkgs, `cargo-tauri.hook` overrides the default build and install phases.
 rustPlatform.buildRustPackage rec {
   # . . .
 
+  useFetchCargoVendor = true;
   cargoHash = "...";
 
   # Assuming our app's frontend uses `npm` as a package manager

doc/languages-frameworks/rust.section.md

@@ -26,16 +26,17 @@ Rust applications are packaged by using the `buildRustPackage` helper from `rust
 
 rustPlatform.buildRustPackage rec {
   pname = "ripgrep";
-  version = "12.1.1";
+  version = "14.1.1";
 
   src = fetchFromGitHub {
     owner = "BurntSushi";
     repo = pname;
     rev = version;
-    hash = "sha256-+s5RBC3XSgb8omTbUNLywZnP6jSxZBKSS1BmXOjRF8M=";
+    hash = "sha256-gyWnahj1A+iXUQlQ1O1H1u7K5euYQOld9qWm99Vjaeg=";
   };
 
-  cargoHash = "sha256-jtBw4ahSl88L0iuCXxQgZVm1EcboWRJMNtjxLVTtzts=";
+  useFetchCargoVendor = true;
+  cargoHash = "sha256-9atn5qyBDy4P6iUoHFhg+TV6Ur71fiah4oTJbBMeEy4=";
 
   meta = {
     description = "Fast line-oriented regex search tool, similar to ag and ack";
@@ -63,18 +64,7 @@ hash using `nix-hash --to-sri --type sha256 "<original sha256>"`.
 }
 ```
 
-Exception: If the application has cargo `git` dependencies, the `cargoHash`
+If this method does not work, you can resort to copying the `Cargo.lock` file into nixpkgs
-approach will not work by default. In this case, you can set `useFetchCargoVendor = true`
-to use an improved fetcher that supports handling `git` dependencies.
-
-```nix
-{
-  useFetchCargoVendor = true;
-  cargoHash = "sha256-RqPVFovDaD2rW31HyETJfQ0qVwFxoGEvqkIgag3H6KU=";
-}
-```
-
-If this method still does not work, you can resort to copying the `Cargo.lock` file into nixpkgs
 and importing it as described in the [next section](#importing-a-cargo.lock-file).
 
 Both types of hashes are permitted when contributing to nixpkgs. The
@@ -119,7 +109,8 @@ rustPlatform.buildRustPackage rec {
     hash = "sha256-aDQA4A5mScX9or3Lyiv/5GyAehidnpKKE0grhbP1Ctc=";
   };
 
-  cargoHash = "sha256-tbrTbutUs5aPSV+yE0IBUZAAytgmZV7Eqxia7g+9zRs=";
+  useFetchCargoVendor = true;
+  cargoHash = "sha256-iDYh52rj1M5Uupvbx2WeDd/jvQZ+2A50V5rp5e2t7q4=";
   cargoDepsName = pname;
 
   # ...
@@ -443,14 +434,14 @@ hooks that can be used to integrate Cargo in non-Rust packages.
 
 Since network access is not allowed in sandboxed builds, Rust crate
 dependencies need to be retrieved using a fetcher. `rustPlatform`
-provides the `fetchCargoTarball` fetcher, which vendors all
+provides the `fetchCargoVendor` fetcher, which vendors all
 dependencies of a crate. For example, given a source path `src`
-containing `Cargo.toml` and `Cargo.lock`, `fetchCargoTarball`
+containing `Cargo.toml` and `Cargo.lock`, `fetchCargoVendor`
 can be used as follows:
 
 ```nix
 {
-  cargoDeps = rustPlatform.fetchCargoTarball {
+  cargoDeps = rustPlatform.fetchCargoVendor {
     inherit src;
     hash = "sha256-BoHIN/519Top1NUBjpB/oEMqi86Omt3zTQcXFWqrek0=";
   };
@@ -482,7 +473,7 @@ In case the lockfile contains cargo `git` dependencies, you can use
 ```
 
 If a `Cargo.lock` file is available, you can alternatively use the
-`importCargoLock` function. In contrast to `fetchCargoTarball`, this
+`importCargoLock` function. In contrast to `fetchCargoVendor`, this
 function does not require a hash (unless git dependencies are used)
 and fetches every dependency as a separate fixed-output derivation.
 `importCargoLock` can be used as follows:
@@ -521,12 +512,13 @@ you of the correct hash.
 `rustPlatform` provides the following hooks to automate Cargo builds:
 
 * `cargoSetupHook`: configure Cargo to use dependencies vendored
-  through `fetchCargoTarball`. This hook uses the `cargoDeps`
+  through `fetchCargoVendor` or `importCargoLock`. This hook uses the
-  environment variable to find the vendored dependencies. If a project
+  `cargoDeps` environment variable to find the vendored
-  already vendors its dependencies, the variable `cargoVendorDir` can
+  dependencies. If a project already vendors its dependencies, the
-  be used instead. When the `Cargo.toml`/`Cargo.lock` files are not in
+  variable `cargoVendorDir` can be used instead. When the
-  `sourceRoot`, then the optional `cargoRoot` is used to specify the
+  `Cargo.toml`/`Cargo.lock` files are not in `sourceRoot`, then the
-  Cargo root directory relative to `sourceRoot`.
+  optional `cargoRoot` is used to specify the Cargo root directory
+  relative to `sourceRoot`.
 * `cargoBuildHook`: use Cargo to build a crate. If the crate to be
   built is a crate in e.g. a Cargo workspace, the relative path to the
   crate to build can be set through the optional `buildAndTestSubdir`
@@ -557,7 +549,7 @@ you of the correct hash.
 #### Python package using `setuptools-rust` {#python-package-using-setuptools-rust}
 
 For Python packages using `setuptools-rust`, you can use
-`fetchCargoTarball` and `cargoSetupHook` to retrieve and set up Cargo
+`fetchCargoVendor` and `cargoSetupHook` to retrieve and set up Cargo
 dependencies. The build itself is then performed by
 `buildPythonPackage`.
 
@@ -586,9 +578,9 @@ buildPythonPackage rec {
     hash = "sha256-rQ2hRV52naEf6PvRsWVCTN7B1oXAQGmnpJw4iIdhamw=";
   };
 
-  cargoDeps = rustPlatform.fetchCargoTarball {
+  cargoDeps = rustPlatform.fetchCargoVendor {
     inherit pname version src sourceRoot;
-    hash = "sha256-miW//pnOmww2i6SOGbkrAIdc/JMDT4FJLqdMFojZeoY=";
+    hash = "sha256-RO1m8wEd5Ic2M9q+zFHeCJWhCr4Sv3CEWd08mkxsBec=";
   };
 
   sourceRoot = "${src.name}/bindings/python";
@@ -609,7 +601,7 @@ directory.  In such cases, the `cargoRoot` attribute can be used to
 specify the crate's directory relative to `sourceRoot`. In the
 following example, the crate is in `src/rust`, as specified in the
 `cargoRoot` attribute. Note that we also need to specify the correct
-path for `fetchCargoTarball`.
+path for `fetchCargoVendor`.
 
 ```nix
 
@@ -629,10 +621,10 @@ buildPythonPackage rec {
     hash = "sha256-xGDilsjLOnls3MfVbGKnj80KCUCczZxlis5PmHzpNcQ=";
   };
 
-  cargoDeps = rustPlatform.fetchCargoTarball {
+  cargoDeps = rustPlatform.fetchCargoVendor {
     inherit pname version src;
     sourceRoot = "${pname}-${version}/${cargoRoot}";
-    hash = "sha256-PS562W4L1NimqDV2H0jl5vYhL08H9est/pbIxSdYVfo=";
+    hash = "sha256-ctUt8maCjnGddKPf+Ii++wKsAXA1h+JM6zKQNXXwJqQ=";
   };
 
   cargoRoot = "src/rust";
@@ -644,9 +636,9 @@ buildPythonPackage rec {
 #### Python package using `maturin` {#python-package-using-maturin}
 
 Python packages that use [Maturin](https://github.com/PyO3/maturin)
-can be built with `fetchCargoTarball`, `cargoSetupHook`, and
+can be built with `fetchCargoVendor`, `cargoSetupHook`, and
 `maturinBuildHook`. For example, the following (partial) derivation
-builds the `retworkx` Python package. `fetchCargoTarball` and
+builds the `retworkx` Python package. `fetchCargoVendor` and
 `cargoSetupHook` are used to fetch and set up the crate dependencies.
 `maturinBuildHook` is used to perform the build.
 
@@ -669,9 +661,9 @@ buildPythonPackage rec {
     hash = "sha256-11n30ldg3y3y6qxg3hbj837pnbwjkqw3nxq6frds647mmmprrd20=";
   };
 
-  cargoDeps = rustPlatform.fetchCargoTarball {
+  cargoDeps = rustPlatform.fetchCargoVendor {
     inherit pname version src;
-    hash = "sha256-heOBK8qi2nuc/Ib+I/vLzZ1fUUD/G/KTw9d7M4Hz5O0=";
+    hash = "sha256-QsPCQhNZKYCAogQriQX6pBYQUDAIUsEdRX/63dAqTzg=";
   };
 
   nativeBuildInputs = with rustPlatform; [ cargoSetupHook maturinBuildHook ];
@@ -682,7 +674,7 @@ buildPythonPackage rec {
 
 #### Rust package built with `meson` {#rust-package-built-with-meson}
 
-Some projects, especially GNOME applications, are built with the Meson Build System instead of calling Cargo directly. Using `rustPlatform.buildRustPackage` may successfully build the main program, but related files will be missing. Instead, you need to set up Cargo dependencies with `fetchCargoTarball` and `cargoSetupHook` and leave the rest to Meson. `rust` and `cargo` are still needed in `nativeBuildInputs` for Meson to use.
+Some projects, especially GNOME applications, are built with the Meson Build System instead of calling Cargo directly. Using `rustPlatform.buildRustPackage` may successfully build the main program, but related files will be missing. Instead, you need to set up Cargo dependencies with `fetchCargoVendor` and `cargoSetupHook` and leave the rest to Meson. `rust` and `cargo` are still needed in `nativeBuildInputs` for Meson to use.
 
 ```nix
 { lib
@@ -713,9 +705,9 @@ stdenv.mkDerivation rec {
     hash = "sha256-PrNPprSS98yN8b8yw2G6hzTSaoE65VbsM3q7FVB4mds=";
   };
 
-  cargoDeps = rustPlatform.fetchCargoTarball {
+  cargoDeps = rustPlatform.fetchCargoVendor {
     inherit pname version src;
-    hash = "sha256-8fa3fa+sFi5H+49B5sr2vYPkp9C9s6CcE0zv4xB8gww=";
+    hash = "sha256-eR1ZGtTZQNhofFUEjI7IX16sMKPJmAl7aIFfPJukecg=";
   };
 
   nativeBuildInputs = [
@@ -998,16 +990,17 @@ in
 
 rustPlatform.buildRustPackage rec {
   pname = "ripgrep";
-  version = "12.1.1";
+  version = "14.1.1";
 
   src = fetchFromGitHub {
     owner = "BurntSushi";
     repo = "ripgrep";
     rev = version;
-    hash = "sha256-+s5RBC3XSgb8omTbUNLywZnP6jSxZBKSS1BmXOjRF8M=";
+    hash = "sha256-gyWnahj1A+iXUQlQ1O1H1u7K5euYQOld9qWm99Vjaeg=";
   };
 
-  cargoHash = "sha256-l1vL2ZdtDRxSGvP0X/l3nMw8+6WF67KPutJEzUROjg8=";
+  useFetchCargoVendor = true;
+  cargoHash = "sha256-9atn5qyBDy4P6iUoHFhg+TV6Ur71fiah4oTJbBMeEy4=";
 
   doCheck = false;
 

nixos/doc/manual/redirects.json

@@ -836,6 +836,12 @@
   "module-services-netbird-multiple-connections": [
     "index.html#module-services-netbird-multiple-connections"
   ],
+  "module-services-netbird-firewall": [
+    "index.html#module-services-netbird-firewall"
+  ],
+  "module-services-netbird-customization": [
+    "index.html#module-services-netbird-customization"
+  ],
   "module-services-mosquitto": [
     "index.html#module-services-mosquitto"
   ],

nixos/doc/manual/release-notes/rl-2505.section.md

@@ -388,6 +388,9 @@
   as before, you can use plugins like `python3Packages.jax-cuda12-plugin`.
 
 
+- `services.netbird.tunnels` was renamed to [`services.netbird.clients`](#opt-services.netbird.clients),
+  hardened (using dedicated less-privileged users) and significantly extended.
+
 <!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->
 
 ## Other Notable Changes {#sec-release-25.05-notable-changes}

nixos/modules/services/networking/netbird.md

@@ -2,7 +2,7 @@
 
 ## Quickstart {#module-services-netbird-quickstart}
 
-The absolute minimal configuration for the netbird daemon looks like this:
+The absolute minimal configuration for the Netbird client daemon looks like this:
 
 ```nix
 {
@@ -13,52 +13,76 @@ The absolute minimal configuration for the netbird daemon looks like this:
 This will set up a netbird service listening on the port `51820` associated to the
 `wt0` interface.
 
-It is strictly equivalent to setting:
+Which is equivalent to:
 
 ```nix
 {
-  services.netbird.tunnels.wt0.stateDir = "netbird";
+  services.netbird.clients.wt0 = {
+    port = 51820;
+    name = "netbird";
+    interface = "wt0";
+    hardened = false;
+  };
 }
 ```
 
-The `enable` option is mainly kept for backward compatibility, as defining netbird
+This will set up a `netbird.service` listening on the port `51820` associated to the
-tunnels through the `tunnels` option is more expressive.
+`wt0` interface. There will also be `netbird-wt0` binary installed in addition to `netbird`.
+
+see [clients](#opt-services.netbird.clients) option documentation for more details.
 
 ## Multiple connections setup {#module-services-netbird-multiple-connections}
 
-Using the `services.netbird.tunnels` option, it is also possible to define more than
+Using the `services.netbird.clients` option, it is possible to define more than
 one netbird service running at the same time.
 
-The following configuration will start a netbird daemon using the interface `wt1` and
+You must at least define a `port` for the service to listen on, the rest is optional:
-the port 51830. Its configuration file will then be located at `/var/lib/netbird-wt1/config.json`.
 
 ```nix
 {
-  services.netbird.tunnels = {
+  services.netbird.clients.wt1.port = 51830;
-    wt1 = {
+  services.netbird.clients.wt2.port = 51831;
-      port = 51830;
+}
+```
+
+see [clients](#opt-services.netbird.clients) option documentation for more details.
+
+## Exposing services internally on the Netbird network {#module-services-netbird-firewall}
+
+You can easily expose services exclusively to Netbird network by combining
+[`networking.firewall.interfaces`](#opt-networking.firewall.interfaces) rules
+with [`interface`](#opt-services.netbird.clients._name_.interface) names:
+
+```nix
+{
+  services.netbird.clients.priv.port = 51819;
+  services.netbird.clients.work.port = 51818;
+  networking.firewall.interfaces = {
+    "${config.services.netbird.clients.priv.interface}" = {
+      allowedUDPPorts = [ 1234 ];
+    };
+    "${config.services.netbird.clients.work.interface}" = {
+      allowedTCPPorts = [ 8080 ];
     };
   };
 }
 ```
 
-To interact with it, you will need to specify the correct daemon address:
+### Additional customizations {#module-services-netbird-customization}
 
-```bash
+Each Netbird client service by default:
-netbird --daemon-addr unix:///var/run/netbird-wt1/sock ...
-```
 
-The address will by default be `unix:///var/run/netbird-<name>`.
+- runs in a [hardened](#opt-services.netbird.clients._name_.hardened) mode,
+- starts with the system,
+- [opens up a firewall](#opt-services.netbird.clients._name_.openFirewall) for direct (without TURN servers)
+  peer-to-peer communication,
+- can be additionally configured with environment variables,
+- automatically determines whether `netbird-ui-<name>` should be available,
 
-It is also possible to overwrite default options passed to the service, for
+[autoStart](#opt-services.netbird.clients._name_.autoStart) allows you to start the client (an actual systemd service)
-example:
+on demand, for example to connect to work-related or otherwise conflicting network only when required.
+See the option description for more information.
 
-```nix
+[environment](#opt-services.netbird.clients._name_.environment) allows you to pass additional configurations
-{
+through environment variables, but special care needs to be taken for overriding config location and
-  services.netbird.tunnels.wt1.environment = {
+daemon address due [hardened](#opt-services.netbird.clients._name_.hardened) option.
-    NB_DAEMON_ADDR = "unix:///var/run/toto.sock";
-  };
-}
-```
-
-This will set the socket to interact with the netbird service to `/var/run/toto.sock`.

nixos/modules/services/networking/netbird.nix

@@ -4,67 +4,187 @@
   pkgs,
   ...
 }:
-
 let
   inherit (lib)
-    attrNames
+    attrValues
+    concatLists
+    concatStringsSep
+    escapeShellArgs
+    filterAttrs
     getExe
     literalExpression
     maintainers
+    makeBinPath
     mapAttrs'
+    mapAttrsToList
+    mkAliasOptionModule
     mkDefault
-    mkEnableOption
     mkIf
     mkMerge
     mkOption
+    mkOptionDefault
     mkPackageOption
     nameValuePair
     optional
+    optionalAttrs
+    optionalString
+    toShellVars
+    versionAtLeast
     versionOlder
     ;
 
   inherit (lib.types)
     attrsOf
+    bool
+    enum
+    nullOr
+    package
+    path
     port
     str
     submodule
     ;
 
-  kernel = config.boot.kernelPackages;
+  inherit (config.boot) kernelPackages;
+  inherit (config.boot.kernelPackages) kernel;
 
   cfg = config.services.netbird;
+
+  toClientList = fn: map fn (attrValues cfg.clients);
+  toClientAttrs = fn: mapAttrs' (_: fn) cfg.clients;
+
+  hardenedClients = filterAttrs (_: client: client.hardened) cfg.clients;
+  toHardenedClientList = fn: map fn (attrValues hardenedClients);
+  toHardenedClientAttrs = fn: mapAttrs' (_: fn) hardenedClients;
+
+  mkBinName =
+    client: name:
+    if client.bin.suffix == "" || client.bin.suffix == "netbird" then
+      name
+    else
+      "${name}-${client.bin.suffix}";
+
+  nixosConfig = config;
 in
 {
-  meta.maintainers = with maintainers; [ ];
+  meta.maintainers = with maintainers; [
+    nazarewk
+  ];
   meta.doc = ./netbird.md;
 
+  imports = [
+    (mkAliasOptionModule [ "services" "netbird" "tunnels" ] [ "services" "netbird" "clients" ])
+  ];
+
   options.services.netbird = {
-    enable = mkEnableOption "Netbird daemon";
+    enable = mkOption {
+      type = bool;
+      default = false;
+      description = ''
+        Enables backwards compatible Netbird client service.
+
+        This is strictly equivalent to:
+
+        ```nix
+        services.netbird.clients.default = {
+          port = 51820;
+          name = "netbird";
+          systemd.name = "netbird";
+          interface = "wt0";
+          hardened = false;
+        };
+        ```
+      '';
+    };
     package = mkPackageOption pkgs "netbird" { };
 
-    tunnels = mkOption {
+    ui.enable = mkOption {
+      type = bool;
+      default = config.services.displayManager.sessionPackages != [ ] || config.services.xserver.enable;
+      defaultText = literalExpression ''
+        config.services.displayManager.sessionPackages != [ ] || config.services.xserver.enable
+      '';
+      description = ''
+        Controls presence `netbird-ui` wrappers, defaults to presence of graphical sessions.
+      '';
+    };
+    ui.package = mkPackageOption pkgs "netbird-ui" { };
+
+    clients = mkOption {
       type = attrsOf (
         submodule (
           { name, config, ... }:
+          let
+            client = config;
+          in
           {
             options = {
               port = mkOption {
                 type = port;
-                default = 51820;
+                example = literalExpression "51820";
                 description = ''
-                  Port for the ${name} netbird interface.
+                  Port the Netbird client listens on.
                 '';
               };
 
+              name = mkOption {
+                type = str;
+                default = name;
+                description = ''
+                  Primary name for use (as a suffix) in:
+                  - systemd service name,
+                  - hardened user name and group,
+                  - [systemd `*Directory=`](https://www.freedesktop.org/software/systemd/man/latest/systemd.exec.html#RuntimeDirectory=) names,
+                  - desktop application identification,
+                '';
+              };
+
+              dns-resolver.address = mkOption {
+                type = nullOr str;
+                default = null;
+                example = "127.0.0.123";
+                description = ''
+                  An explicit address that Netbird will serve `*.netbird.cloud.` (usually) entries on.
+
+                  Netbird serves DNS on it's own (dynamic) client address by default.
+                '';
+              };
+
+              dns-resolver.port = mkOption {
+                type = port;
+                default = 53;
+                description = ''
+                  A port to serve DNS entries on when `dns-resolver.address` is enabled.
+                '';
+              };
+
+              interface = mkOption {
+                type = str;
+                default = "nb-${client.name}";
+                description = ''
+                  Name of the network interface managed by this client.
+                '';
+                apply =
+                  iface:
+                  lib.throwIfNot (
+                    builtins.stringLength iface <= 15
+                  ) "Network interface name must be 15 characters or less" iface;
+              };
+
               environment = mkOption {
                 type = attrsOf str;
                 defaultText = literalExpression ''
                   {
-                    NB_CONFIG = "/var/lib/''${stateDir}/config.json";
+                    NB_STATE_DIR = client.dir.state;
-                    NB_LOG_FILE = "console";
+                    NB_CONFIG = "''${client.dir.state}/config.json";
-                    NB_WIREGUARD_PORT = builtins.toString port;
+                    NB_DAEMON_ADDR = "unix://''${client.dir.runtime}/sock";
-                    NB_INTERFACE_NAME = name;
+                    NB_INTERFACE_NAME = client.interface;
-                    NB_DAMEON_ADDR = "/var/run/''${stateDir}"
+                    NB_LOG_FILE = mkOptionDefault "console";
+                    NB_LOG_LEVEL = client.logLevel;
+                    NB_SERVICE = client.service.name;
+                    NB_WIREGUARD_PORT = toString client.port;
+                  } // optionalAttrs (client.dns-resolver.address != null) {
+                    NB_DNS_RESOLVER_ADDRESS = "''${client.dns-resolver.address}:''${builtins.toString client.dns-resolver.port}";
                   }
                 '';
                 description = ''
@@ -72,64 +192,311 @@ in
                 '';
               };
 
-              stateDir = mkOption {
+              autoStart = mkOption {
-                type = str;
+                type = bool;
-                default = "netbird-${name}";
+                default = true;
                 description = ''
-                  Directory storing the netbird configuration.
+                  Start the service with the system.
+
+                  As of 2024-02-13 it is not possible to start a Netbird client daemon without immediately
+                  connecting to the network, but it is [planned for a near future](https://github.com/netbirdio/netbird/projects/2#card-91718018).
+                '';
+              };
+
+              openFirewall = mkOption {
+                type = bool;
+                default = true;
+                description = ''
+                  Opens up firewall `port` for communication between Netbird peers directly over LAN or public IP,
+                  without using (internet-hosted) TURN servers as intermediaries.
+                '';
+              };
+
+              hardened = mkOption {
+                type = bool;
+                default = true;
+                description = ''
+                  Hardened service:
+                  - runs as a dedicated user with minimal set of permissions (see caveats),
+                  - restricts daemon configuration socket access to dedicated user group
+                    (you can grant access to it with `users.users."<user>".extraGroups = [ ${client.user.group} ]`),
+
+                  Even though the local system resources access is restricted:
+                  - `CAP_NET_RAW`, `CAP_NET_ADMIN` and `CAP_BPF` still give unlimited network manipulation possibilites,
+                  - older kernels don't have `CAP_BPF` and use `CAP_SYS_ADMIN` instead,
+
+                  Known security features that are not (yet) integrated into the module:
+                  - 2024-02-14: `rosenpass` is an experimental feature configurable solely
+                    through `--enable-rosenpass` flag on the `netbird up` command,
+                    see [the docs](https://docs.netbird.io/how-to/enable-post-quantum-cryptography)
+                '';
+              };
+
+              logLevel = mkOption {
+                type = enum [
+                  # logrus loglevels
+                  "panic"
+                  "fatal"
+                  "error"
+                  "warn"
+                  "warning"
+                  "info"
+                  "debug"
+                  "trace"
+                ];
+                default = "info";
+                description = "Log level of the Netbird daemon.";
+              };
+
+              ui.enable = mkOption {
+                type = bool;
+                default = nixosConfig.services.netbird.ui.enable;
+                defaultText = literalExpression ''client.ui.enable'';
+                description = ''
+                  Controls presence of `netbird-ui` wrapper for this Netbird client.
+                '';
+              };
+
+              wrapper = mkOption {
+                type = package;
+                internal = true;
+                default =
+                  let
+                    makeWrapperArgs = concatLists (
+                      mapAttrsToList (key: value: [
+                        "--set-default"
+                        key
+                        value
+                      ]) client.environment
+                    );
+                    mkBin = mkBinName client;
+                  in
+                  pkgs.stdenv.mkDerivation {
+                    name = "${cfg.package.name}-wrapper-${client.name}";
+                    meta.mainProgram = mkBin "netbird";
+                    nativeBuildInputs = with pkgs; [ makeWrapper ];
+                    phases = [ "installPhase" ];
+                    installPhase = concatStringsSep "\n" [
+                      ''
+                        mkdir -p "$out/bin"
+                        makeWrapper ${lib.getExe cfg.package} "$out/bin/${mkBin "netbird"}" \
+                          ${escapeShellArgs makeWrapperArgs}
+                      ''
+                      (optionalString cfg.ui.enable ''
+                        # netbird-ui doesn't support envvars
+                        makeWrapper ${lib.getExe cfg.ui.package} "$out/bin/${mkBin "netbird-ui"}" \
+                          --add-flags '--daemon-addr=${client.environment.NB_DAEMON_ADDR}'
+
+                        mkdir -p "$out/share/applications"
+                        substitute ${cfg.ui.package}/share/applications/netbird.desktop \
+                            "$out/share/applications/${mkBin "netbird"}.desktop" \
+                          --replace-fail 'Name=Netbird' "Name=Netbird @ ${client.service.name}" \
+                          --replace-fail '${lib.getExe cfg.ui.package}' "$out/bin/${mkBin "netbird-ui"}"
+                      '')
+                    ];
+                  };
+              };
+
+              # see https://github.com/netbirdio/netbird/blob/88747e3e0191abc64f1e8c7ecc65e5e50a1527fd/client/internal/config.go#L49-L82
+              config = mkOption {
+                type = (pkgs.formats.json { }).type;
+                defaultText = literalExpression ''
+                  {
+                    DisableAutoConnect = !client.autoStart;
+                    WgIface = client.interface;
+                    WgPort = client.port;
+                  } // optionalAttrs (client.dns-resolver.address != null) {
+                    CustomDNSAddress = "''${client.dns-resolver.address}:''${builtins.toString client.dns-resolver.port}";
+                  }
+                '';
+                description = ''
+                  Additional configuration that exists before the first start and
+                  later overrides the existing values in `config.json`.
+
+                  It is mostly helpful to manage configuration ignored/not yet implemented
+                  outside of `netbird up` invocation.
+
+                  WARNING: this is not an upstream feature, it could break in the future
+                  (by having lower priority) after upstream implements an equivalent.
+
+                  It is implemented as a `preStart` script which overrides `config.json`
+                  with content of `/etc/${client.dir.baseName}/config.d/*.json` files.
+                  This option manages specifically `50-nixos.json` file.
+
+                  Consult [the source code](https://github.com/netbirdio/netbird/blob/88747e3e0191abc64f1e8c7ecc65e5e50a1527fd/client/internal/config.go#L49-L82)
+                  or inspect existing file for a complete list of available configurations.
+                '';
+              };
+
+              suffixedName = mkOption {
+                type = str;
+                default = if client.name != "netbird" then "netbird-${client.name}" else client.name;
+                description = ''
+                  A systemd service name to use (without `.service` suffix).
+                '';
+              };
+              dir.baseName = mkOption {
+                type = str;
+                default = client.suffixedName;
+                description = ''
+                  A systemd service name to use (without `.service` suffix).
+                '';
+              };
+              dir.state = mkOption {
+                type = path;
+                default = "/var/lib/${client.dir.baseName}";
+                description = ''
+                  A state directory used by Netbird client to store `config.json`, `state.json` & `resolv.conf`.
+                '';
+              };
+              dir.runtime = mkOption {
+                type = path;
+                default = "/var/run/${client.dir.baseName}";
+                description = ''
+                  A runtime directory used by Netbird client.
+                '';
+              };
+              service.name = mkOption {
+                type = str;
+                default = client.suffixedName;
+                description = ''
+                  A systemd service name to use (without `.service` suffix).
+                '';
+              };
+              user.name = mkOption {
+                type = str;
+                default = client.suffixedName;
+                description = ''
+                  A system user name for this client instance.
+                '';
+              };
+              user.group = mkOption {
+                type = str;
+                default = client.suffixedName;
+                description = ''
+                  A system group name for this client instance.
+                '';
+              };
+              bin.suffix = mkOption {
+                type = str;
+                default = if client.name != "netbird" then client.name else "";
+                description = ''
+                  A system group name for this client instance.
                 '';
               };
             };
 
-            config.environment = builtins.mapAttrs (_: mkDefault) {
+            config.environment =
-              NB_CONFIG = "/var/lib/${config.stateDir}/config.json";
+              {
-              NB_LOG_FILE = "console";
+                NB_STATE_DIR = client.dir.state;
-              NB_WIREGUARD_PORT = builtins.toString config.port;
+                NB_CONFIG = "${client.dir.state}/config.json";
-              NB_INTERFACE_NAME = name;
+                NB_DAEMON_ADDR = "unix://${client.dir.runtime}/sock";
-              NB_DAEMON_ADDR = "unix:///var/run/${config.stateDir}/sock";
+                NB_INTERFACE_NAME = client.interface;
+                NB_LOG_FILE = mkOptionDefault "console";
+                NB_LOG_LEVEL = client.logLevel;
+                NB_SERVICE = client.service.name;
+                NB_WIREGUARD_PORT = toString client.port;
+              }
+              // optionalAttrs (client.dns-resolver.address != null) {
+                NB_DNS_RESOLVER_ADDRESS = "${client.dns-resolver.address}:${builtins.toString client.dns-resolver.port}";
+              };
+
+            config.config =
+              {
+                DisableAutoConnect = !client.autoStart;
+                WgIface = client.interface;
+                WgPort = client.port;
+              }
+              // optionalAttrs (client.dns-resolver.address != null) {
+                CustomDNSAddress = "${client.dns-resolver.address}:${builtins.toString client.dns-resolver.port}";
               };
           }
         )
       );
       default = { };
       description = ''
-        Attribute set of Netbird tunnels, each one will spawn a daemon listening on ...
+        Attribute set of Netbird client daemons, by default each one will:
+
+        1. be manageable using dedicated tooling:
+          - `netbird-<name>` script,
+          - `Netbird - netbird-<name>` graphical interface when appropriate (see `ui.enable`),
+        2. run as a `netbird-<name>.service`,
+        3. listen for incoming remote connections on the port `51820` (`openFirewall` by default),
+        4. manage the `netbird-<name>` wireguard interface,
+        5. use the `/var/lib/netbird-<name>/config.json` configuration file,
+        6. override `/var/lib/netbird-<name>/config.json` with values from `/etc/netbird-<name>/config.d/*.json`,
+        7. (`hardened`) be locally manageable by `netbird-<name>` system group,
+
+        With following caveats:
+
+        - multiple daemons will interfere with each other's DNS resolution of `netbird.cloud`, but
+          should remain fully operational otherwise.
+          Setting up custom (non-conflicting) DNS zone is currently possible only when self-hosting.
+      '';
+      example = lib.literalExpression ''
+        {
+          services.netbird.clients.wt0.port = 51820;
+          services.netbird.clients.personal.port = 51821;
+          services.netbird.clients.work1.port = 51822;
+        }
       '';
     };
   };
 
   config = mkMerge [
     (mkIf cfg.enable {
-      # For backwards compatibility
+      services.netbird.clients.default = {
-      services.netbird.tunnels.wt0.stateDir = "netbird";
+        port = mkDefault 51820;
+        interface = mkDefault "wt0";
+        name = mkDefault "netbird";
+        hardened = mkDefault false;
+      };
     })
+    {
+      boot.extraModulePackages = optional (
+        cfg.clients != { } && (versionOlder kernel.version "5.6")
+      ) kernelPackages.wireguard;
 
-    (mkIf (cfg.tunnels != { }) {
+      environment.systemPackages = toClientList (client: client.wrapper)
-      boot.extraModulePackages = optional (versionOlder kernel.kernel.version "5.6") kernel.wireguard;
+      # omitted due to https://github.com/netbirdio/netbird/issues/1562
+      #++ optional (cfg.clients != { }) cfg.package
+      # omitted due to https://github.com/netbirdio/netbird/issues/1581
+      #++ optional (cfg.clients != { } && cfg.ui.enable) cfg.ui.package
+      ;
 
-      environment.systemPackages = [ cfg.package ];
+      networking.dhcpcd.denyInterfaces = toClientList (client: client.interface);
+      networking.networkmanager.unmanaged = toClientList (client: "interface-name:${client.interface}");
 
-      networking.dhcpcd.denyInterfaces = attrNames cfg.tunnels;
+      networking.firewall.allowedUDPPorts = concatLists (
+        toClientList (client: optional client.openFirewall client.port)
+      );
 
       systemd.network.networks = mkIf config.networking.useNetworkd (
-        mapAttrs' (
+        toClientAttrs (
-          name: _:
+          client:
-          nameValuePair "50-netbird-${name}" {
+          nameValuePair "50-netbird-${client.interface}" {
             matchConfig = {
-              Name = name;
+              Name = client.interface;
             };
             linkConfig = {
               Unmanaged = true;
               ActivationPolicy = "manual";
             };
           }
-        ) cfg.tunnels
+        )
       );
 
-      systemd.services = mapAttrs' (
+      environment.etc = toClientAttrs (
-        name:
+        client:
-        { environment, stateDir, ... }:
+        nameValuePair "${client.dir.baseName}/config.d/50-nixos.json" {
-        nameValuePair "netbird-${name}" {
+          text = builtins.toJSON client.config;
+          mode = "0444";
+        }
+      );
+
+      systemd.services = toClientAttrs (
+        client:
+        nameValuePair client.service.name {
           description = "A WireGuard-based mesh network that connects your devices into a single private network";
 
           documentation = [ "https://netbird.io/docs/" ];
@@ -137,17 +504,19 @@ in
           after = [ "network.target" ];
           wantedBy = [ "multi-user.target" ];
 
-          path = with pkgs; [ openresolv ];
+          path = optional (!config.services.resolved.enable) pkgs.openresolv;
-
-          inherit environment;
 
           serviceConfig = {
-            ExecStart = "${getExe cfg.package} service run";
+            ExecStart = "${getExe client.wrapper} service run";
             Restart = "always";
-            RuntimeDirectory = stateDir;
+
-            StateDirectory = stateDir;
+            RuntimeDirectory = client.dir.baseName;
+            RuntimeDirectoryMode = mkDefault "0755";
+            ConfigurationDirectory = client.dir.baseName;
+            StateDirectory = client.dir.baseName;
             StateDirectoryMode = "0700";
-            WorkingDirectory = "/var/lib/${stateDir}";
+
+            WorkingDirectory = client.dir.state;
           };
 
           unitConfig = {
@@ -157,7 +526,124 @@ in
 
           stopIfChanged = false;
         }
-      ) cfg.tunnels;
+      );
+    }
+    # Hardening section
+    (mkIf (hardenedClients != { }) {
+      users.groups = toHardenedClientAttrs (client: nameValuePair client.user.group { });
+      users.users = toHardenedClientAttrs (
+        client:
+        nameValuePair client.user.name {
+          isSystemUser = true;
+          home = client.dir.state;
+          group = client.user.group;
+        }
+      );
+
+      systemd.services = toHardenedClientAttrs (
+        client:
+        nameValuePair client.service.name (
+          mkIf client.hardened {
+            serviceConfig = {
+              RuntimeDirectoryMode = "0750";
+
+              User = client.user.name;
+              Group = client.user.group;
+
+              # settings implied by DynamicUser=true, without actully using it,
+              # see https://www.freedesktop.org/software/systemd/man/latest/systemd.exec.html#DynamicUser=
+              RemoveIPC = true;
+              PrivateTmp = true;
+              ProtectSystem = "strict";
+              ProtectHome = "yes";
+
+              AmbientCapabilities =
+                [
+                  # see https://man7.org/linux/man-pages/man7/capabilities.7.html
+                  # see https://docs.netbird.io/how-to/installation#running-net-bird-in-docker
+                  #
+                  # seems to work fine without CAP_SYS_ADMIN and CAP_SYS_RESOURCE
+                  # CAP_NET_BIND_SERVICE could be added to allow binding on low ports, but is not required,
+                  #  see https://github.com/netbirdio/netbird/pull/1513
+
+                  # failed creating tunnel interface wt-priv: [operation not permitted
+                  "CAP_NET_ADMIN"
+                  # failed to pull up wgInterface [wt-priv]: failed to create ipv4 raw socket: socket: operation not permitted
+                  "CAP_NET_RAW"
+                ]
+                # required for eBPF filter, used to be subset of CAP_SYS_ADMIN
+                ++ optional (versionAtLeast kernel.version "5.8") "CAP_BPF"
+                ++ optional (versionOlder kernel.version "5.8") "CAP_SYS_ADMIN"
+                ++ optional (
+                  client.dns-resolver.address != null && client.dns-resolver.port < 1024
+                ) "CAP_NET_BIND_SERVICE";
+            };
+          }
+        )
+      );
+
+      # see https://github.com/systemd/systemd/blob/17f3e91e8107b2b29fe25755651b230bbc81a514/src/resolve/org.freedesktop.resolve1.policy#L43-L43
+      # see all actions used at https://github.com/netbirdio/netbird/blob/13e7198046a0d73a9cd91bf8e063fafb3d41885c/client/internal/dns/systemd_linux.go#L29-L32
+      security.polkit.extraConfig = mkIf config.services.resolved.enable ''
+        // systemd-resolved access for Netbird clients
+        polkit.addRule(function(action, subject) {
+          var actions = [
+            "org.freedesktop.resolve1.revert",
+            "org.freedesktop.resolve1.set-default-route",
+            "org.freedesktop.resolve1.set-dns-servers",
+            "org.freedesktop.resolve1.set-domains",
+          ];
+          var users = ${builtins.toJSON (toHardenedClientList (client: client.user.name))};
+
+          if (actions.indexOf(action.id) >= 0 && users.indexOf(subject.user) >= 0 ) {
+            return polkit.Result.YES;
+          }
+        });
+      '';
     })
+    # migration & temporary fixups section
+    {
+      systemd.services = toClientAttrs (
+        client:
+        nameValuePair client.service.name {
+          preStart = ''
+            set -eEuo pipefail
+            ${optionalString (client.logLevel == "trace" || client.logLevel == "debug") "set -x"}
+
+            PATH="${
+              makeBinPath (
+                with pkgs;
+                [
+                  coreutils
+                  jq
+                  diffutils
+                ]
+              )
+            }:$PATH"
+            export ${toShellVars client.environment}
+
+            # merge /etc/${client.dir.baseName}/config.d' into "$NB_CONFIG"
+            {
+              test -e "$NB_CONFIG" || echo -n '{}' > "$NB_CONFIG"
+
+              # merge config.d with "$NB_CONFIG" into "$NB_CONFIG.new"
+              jq -sS 'reduce .[] as $i ({}; . * $i)' \
+                "$NB_CONFIG" \
+                /etc/${client.dir.baseName}/config.d/*.json \
+                > "$NB_CONFIG.new"
+
+              echo "Comparing $NB_CONFIG with $NB_CONFIG.new ..."
+              if ! diff <(jq -S <"$NB_CONFIG") "$NB_CONFIG.new" ; then
+                echo "Updating $NB_CONFIG ..."
+                mv "$NB_CONFIG.new" "$NB_CONFIG"
+              else
+                echo "Files are the same, not doing anything."
+                rm "$NB_CONFIG.new"
+              fi
+            }
+          '';
+        }
+      );
+    }
   ];
 }

nixos/tests/netbird.nix

@@ -1,19 +1,59 @@
-import ./make-test-python.nix ({ pkgs, lib, ... }:
+import ./make-test-python.nix (
-{
+  { pkgs, lib, ... }:
+  {
     name = "netbird";
 
-  meta.maintainers = with pkgs.lib.maintainers; [ ];
+    meta.maintainers = with pkgs.lib.maintainers; [
+      nazarewk
+    ];
 
     nodes = {
-    node = { ... }: {
+      clients =
+        { ... }:
+        {
           services.netbird.enable = true;
+          services.netbird.clients.custom.port = 51819;
         };
     };
 
+    # TODO: confirm the whole solution is working end-to-end when netbird server is implemented
     testScript = ''
       start_all()
-    node.wait_for_unit("netbird-wt0.service")
+      def did_start(node, name):
-    node.wait_for_file("/var/run/netbird/sock")
+        node.wait_for_unit(f"{name}.service")
-    node.succeed("netbird status | grep -q 'Daemon status: NeedsLogin'")
+        node.wait_for_file(f"/var/run/{name}/sock")
+        output = node.succeed(f"{name} status")
+
+        # not sure why, but it can print either of:
+        #  - Daemon status: NeedsLogin
+        #  - Management: Disconnected
+        expected = [
+          "Disconnected",
+          "NeedsLogin",
+        ]
+        assert any(msg in output for msg in expected)
+
+      did_start(clients, "netbird")
+      did_start(clients, "netbird-custom")
     '';
-})
+
+    /*
+      `netbird status` used to print `Daemon status: NeedsLogin`
+          https://github.com/netbirdio/netbird/blob/23a14737974e3849fa86408d136cc46db8a885d0/client/cmd/status.go#L154-L164
+      as the first line, but now it is just:
+
+          Daemon version: 0.26.3
+          CLI version: 0.26.3
+          Management: Disconnected
+          Signal: Disconnected
+          Relays: 0/0 Available
+          Nameservers: 0/0 Available
+          FQDN:
+          NetBird IP: N/A
+          Interface type: N/A
+          Quantum resistance: false
+          Routes: -
+          Peers count: 0/0 Connected
+    */
+  }
+)

pkgs/applications/audio/schismtracker/default.nix

@@ -9,17 +9,19 @@
   SDL2,
   libXext,
   Cocoa,
+  utf8proc,
+  nix-update-script,
 }:
 
 stdenv.mkDerivation rec {
   pname = "schismtracker";
-  version = "20240809";
+  version = "20241226";
 
   src = fetchFromGitHub {
-    owner = pname;
+    owner = "schismtracker";
-    repo = pname;
+    repo = "schismtracker";
-    rev = version;
+    tag = version;
-    sha256 = "sha256-J4al7XU+vvehDnp2fRrVesWyUN4i63g5btUkjarpXbk=";
+    hash = "sha256-CZc5rIAgEydb8JhtkRSqEB9PI7TC58oJZg939GIEiMs=";
   };
 
   # If we let it try to get the version from git, it will fail and fall back
@@ -30,9 +32,21 @@ stdenv.mkDerivation rec {
       --replace-fail 'git log' 'echo ${version} #'
   '';
 
-  configureFlags = [
+  configureFlags =
-    "--enable-dependency-tracking"
+    [
-  ] ++ lib.optional stdenv.hostPlatform.isDarwin "--disable-sdltest";
+      (lib.enableFeature true "dependency-tracking")
+      (lib.withFeature true "sdl2")
+      (lib.enableFeature true "sdl2-linking")
+    ]
+    ++ lib.optionals stdenv.hostPlatform.isLinux [
+      (lib.enableFeature true "alsa")
+      (lib.enableFeature true "alsa-linking")
+    ]
+    ++ lib.optionals stdenv.hostPlatform.isDarwin [
+      (lib.enableFeature false "sdltest")
+    ];
+
+  strictDeps = true;
 
   nativeBuildInputs = [
     autoreconfHook
@@ -41,7 +55,10 @@ stdenv.mkDerivation rec {
   ];
 
   buildInputs =
-    [ SDL2 ]
+    [
+      SDL2
+      utf8proc
+    ]
     ++ lib.optionals stdenv.hostPlatform.isLinux [
       alsa-lib
       libXext
@@ -56,12 +73,14 @@ stdenv.mkDerivation rec {
       --replace '-lSDL2main' '-lSDL2'
   '';
 
-  meta = with lib; {
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
     description = "Music tracker application, free reimplementation of Impulse Tracker";
     homepage = "https://schismtracker.org/";
-    license = licenses.gpl2Plus;
+    license = lib.licenses.gpl2Plus;
-    platforms = platforms.unix;
+    platforms = lib.platforms.unix;
-    maintainers = with maintainers; [ ftrvxmtrx ];
+    maintainers = with lib.maintainers; [ ftrvxmtrx ];
     mainProgram = "schismtracker";
   };
 }

pkgs/applications/audio/strawberry/default.nix

@@ -40,13 +40,13 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "strawberry";
-  version = "1.2.4";
+  version = "1.2.6";
 
   src = fetchFromGitHub {
     owner = "jonaski";
     repo = pname;
     rev = version;
-    hash = "sha256-acTFJS8E0hQNbiiOi8DfPyTiUcKjXwg5trk3Q2mYYmQ=";
+    hash = "sha256-FfyvSNaO8dE6zz/PNKp/2kJHbauJjmQAhTriRE5lXEk=";
   };
 
   # the big strawberry shown in the context menu is *very* much in your face, so use the grey version instead

pkgs/applications/editors/vim/plugins/nvim-treesitter/generated.nix

@@ -105,12 +105,12 @@
   };
   bash = buildGrammar {
     language = "bash";
-    version = "0.0.0+rev=49c3100";
+    version = "0.0.0+rev=a985bd2";
     src = fetchFromGitHub {
       owner = "tree-sitter";
       repo = "tree-sitter-bash";
-      rev = "49c31006d8307dcb12bc5770f35b6d5b9e2be68e";
+      rev = "a985bd2d14d249b8f583343ad21aeb13c50c85e8";
-      hash = "sha256-JW+30zIyq8Xc7NG9V+YoFqC+57BjZXIbAvWPD2lqvIE=";
+      hash = "sha256-5uI2DOLGLN0zD2VbCPB7sdLQFTL5kQtNZpGh7VC25wg=";
     };
     meta.homepage = "https://github.com/tree-sitter/tree-sitter-bash";
   };
@@ -193,23 +193,23 @@
   };
   c = buildGrammar {
     language = "c";
-    version = "0.0.0+rev=3aa2995";
+    version = "0.0.0+rev=492f7aa";
     src = fetchFromGitHub {
       owner = "tree-sitter";
       repo = "tree-sitter-c";
-      rev = "3aa2995549d5d8b26928e8d3fa2770fd4327414e";
+      rev = "492f7aaa37560204856a2b3f775398b66ba09f31";
-      hash = "sha256-iT0sjwtrDtCduxCU3wVB1AP6gzxW3DpmqNQaP3LUBiA=";
+      hash = "sha256-4Ha5coP621qncxS6IE+KvNuhJlj5qI4ZveBwe/1cq9k=";
     };
     meta.homepage = "https://github.com/tree-sitter/tree-sitter-c";
   };
   c_sharp = buildGrammar {
     language = "c_sharp";
-    version = "0.0.0+rev=acff8cb";
+    version = "0.0.0+rev=2c31cc8";
     src = fetchFromGitHub {
       owner = "tree-sitter";
       repo = "tree-sitter-c-sharp";
-      rev = "acff8cbb53a1d7b9cd07b209c9933a0e2da9ef35";
+      rev = "2c31cc87640ab6ad74fb408c0cf1262ce54da5bb";
-      hash = "sha256-Mdcr4UuoKiNodrNV7/NRfQkmgynPa798Rv9f6Qm3cFw=";
+      hash = "sha256-pr9JxTc7o5q82CaYVtSSNlp3BQS4+CGblfmtXQoj9os=";
     };
     meta.homepage = "https://github.com/tree-sitter/tree-sitter-c-sharp";
   };
@@ -336,23 +336,23 @@
   };
   cpp = buildGrammar {
     language = "cpp";
-    version = "0.0.0+rev=f41b4f6";
+    version = "0.0.0+rev=a352ed8";
     src = fetchFromGitHub {
       owner = "tree-sitter";
       repo = "tree-sitter-cpp";
-      rev = "f41b4f66a42100be405f96bdc4ebc4a61095d3e8";
+      rev = "a352ed85f733f9c6cc458fe5a82bcd4c00f70eab";
-      hash = "sha256-NRcyXjijLdoa5fdA+MKZyt7mnM5B37zCsqZh4QvuOtA=";
+      hash = "sha256-s/JJD2gfs2Kepj89N7ZCstdfZ1baONZmTxFy2D0KQ2M=";
     };
     meta.homepage = "https://github.com/tree-sitter/tree-sitter-cpp";
   };
   css = buildGrammar {
     language = "css";
-    version = "0.0.0+rev=5c89b88";
+    version = "0.0.0+rev=6731f03";
     src = fetchFromGitHub {
       owner = "tree-sitter";
       repo = "tree-sitter-css";
-      rev = "5c89b88a37a2e1e36c031469462d6ee85ff2c13c";
+      rev = "6731f030693d3698ad94865ed0228fe45df07e30";
-      hash = "sha256-R5820/4sIQIfCMg3D/LF1Kk5Mf46YLokS8tBAcGL4Eo=";
+      hash = "sha256-+TGRtlFDCfQYRC2dp+xyMZL/EpBnEjdq8vDeF1ib6Y0=";
     };
     meta.homepage = "https://github.com/tree-sitter/tree-sitter-css";
   };
@@ -370,12 +370,12 @@
   };
   cuda = buildGrammar {
     language = "cuda";
-    version = "0.0.0+rev=635e8aa";
+    version = "0.0.0+rev=757e0a6";
     src = fetchFromGitHub {
       owner = "theHamsta";
       repo = "tree-sitter-cuda";
-      rev = "635e8aa3747823a0c4e9660c07cef76fe8d3ef93";
+      rev = "757e0a61f9d38b3d9eaa299e8d866e8283ffc284";
-      hash = "sha256-+KHenEgo9wMncjEIJZoqS0x089hjdR3J1t+x663qy1M=";
+      hash = "sha256-66tJ1GVAWKqXBCzBXUGdzG/Rl2vw/eJ6mQnWnnnpBcU=";
     };
     meta.homepage = "https://github.com/theHamsta/tree-sitter-cuda";
   };
@@ -592,12 +592,12 @@
   };
   elixir = buildGrammar {
     language = "elixir";
-    version = "0.0.0+rev=02a6f7f";
+    version = "0.0.0+rev=0e8eb7f";
     src = fetchFromGitHub {
       owner = "elixir-lang";
       repo = "tree-sitter-elixir";
-      rev = "02a6f7fd4be28dd94ee4dd2ca19cb777053ea74e";
+      rev = "0e8eb7fc1dfb3d855398870827a9866a1529a5e4";
-      hash = "sha256-OM2RWQNdYMltYwmbU5f4ZK5a8Wx4JxBMYx9R5n2B4jg=";
+      hash = "sha256-rgmwf4ndSFtrdAz+w0QtIcZNgYfaLoCkqytnioXT/Pk=";
     };
     meta.homepage = "https://github.com/elixir-lang/tree-sitter-elixir";
   };
@@ -636,23 +636,23 @@
   };
   embedded_template = buildGrammar {
     language = "embedded_template";
-    version = "0.0.0+rev=3322625";
+    version = "0.0.0+rev=8495d10";
     src = fetchFromGitHub {
       owner = "tree-sitter";
       repo = "tree-sitter-embedded-template";
-      rev = "332262529bc51abf5746317b2255ccc2fff778f8";
+      rev = "8495d106154741e6d35d37064f864758ece75de6";
-      hash = "sha256-C2Lo3tT2363O++ycXiR6x0y+jy2zlmhcKp7t1LhvCe8=";
+      hash = "sha256-DCEno1QzPcM9853hldrm4IAqKsTNALe//laDn+Hcr8Q=";
     };
     meta.homepage = "https://github.com/tree-sitter/tree-sitter-embedded-template";
   };
   erlang = buildGrammar {
     language = "erlang";
-    version = "0.0.0+rev=d2281ab";
+    version = "0.0.0+rev=981fda0";
     src = fetchFromGitHub {
       owner = "WhatsApp";
       repo = "tree-sitter-erlang";
-      rev = "d2281ab060093290045941a865a3834eec862a3f";
+      rev = "981fda038d2eb182a88a9374ccb1c14b840cba0b";
-      hash = "sha256-tiZY1CXwKBwkXRrl1uJACOoXIlC9AmqDQ9bxWuq9ejw=";
+      hash = "sha256-uvVnWbkiwsqNq0hPikEwLLq1MDVohJlgK/L6zAUC+rU=";
     };
     meta.homepage = "https://github.com/WhatsApp/tree-sitter-erlang";
   };
@@ -746,12 +746,12 @@
   };
   fortran = buildGrammar {
     language = "fortran";
-    version = "0.0.0+rev=5fc069e";
+    version = "0.0.0+rev=022b032";
     src = fetchFromGitHub {
       owner = "stadelmanma";
       repo = "tree-sitter-fortran";
-      rev = "5fc069e4f05810ec6f8e399cd522e4eba864181c";
+      rev = "022b032d31299c5d8336cdfd0ece97de20a609c0";
-      hash = "sha256-dcpGhtUbaw4lBrwL01nzokWF2BQLsER5S7zEH6xOzso=";
+      hash = "sha256-STRbEv7kBtkrokXgaN9g1JNwWmSV+7gkyklhYKJszNY=";
     };
     meta.homepage = "https://github.com/stadelmanma/tree-sitter-fortran";
   };
@@ -978,12 +978,12 @@
   };
   go = buildGrammar {
     language = "go";
-    version = "0.0.0+rev=12fe553";
+    version = "0.0.0+rev=7cb21a6";
     src = fetchFromGitHub {
       owner = "tree-sitter";
       repo = "tree-sitter-go";
-      rev = "12fe553fdaaa7449f764bc876fd777704d4fb752";
+      rev = "7cb21a65af6cc8e5c6742b9dba42881ea1158475";
-      hash = "sha256-E8ieOSkpmdsMrj1m0op0WA5ki4VkodHBMtJRCmYtmGY=";
+      hash = "sha256-BOq/HH6r+6dbdUa/0rlQioXG3Dgm60gBNSc1SLfE2fI=";
     };
     meta.homepage = "https://github.com/tree-sitter/tree-sitter-go";
   };
@@ -1088,12 +1088,12 @@
   };
   groovy = buildGrammar {
     language = "groovy";
-    version = "0.0.0+rev=d1556e7";
+    version = "0.0.0+rev=8691159";
     src = fetchFromGitHub {
       owner = "murtaza64";
       repo = "tree-sitter-groovy";
-      rev = "d1556e77d49df1a28cd564af5766fdaea8ab7063";
+      rev = "86911590a8e46d71301c66468e5620d9faa5b6af";
-      hash = "sha256-oEdO9P1akGzOmZvAUrO608yptgkMsJL5YAhPwBvarPI=";
+      hash = "sha256-652wluH2C3pYmhthaj4eWDVLtEvvVIuu70bJNnt5em0=";
     };
     meta.homepage = "https://github.com/murtaza64/tree-sitter-groovy";
   };
@@ -1110,12 +1110,12 @@
   };
   hack = buildGrammar {
     language = "hack";
-    version = "0.0.0+rev=fca1e29";
+    version = "0.0.0+rev=bc5b3a1";
     src = fetchFromGitHub {
       owner = "slackhq";
       repo = "tree-sitter-hack";
-      rev = "fca1e294f6dce8ec5659233a6a21f5bd0ed5b4f2";
+      rev = "bc5b3a10d6d27e8220a113a9a7fe9bec0a1574b0";
-      hash = "sha256-XTcsqCvlwbAAi7/TXrYX8wT56Ie+0OW5+eNRMH7XNyk=";
+      hash = "sha256-dVDJRRn5pT7FPQN+RIUi/mFG6uS8rAzWJy2dBfuiNSM=";
     };
     meta.homepage = "https://github.com/slackhq/tree-sitter-hack";
   };
@@ -1243,12 +1243,12 @@
   };
   html = buildGrammar {
     language = "html";
-    version = "0.0.0+rev=d9219ad";
+    version = "0.0.0+rev=d18f83f";
     src = fetchFromGitHub {
       owner = "tree-sitter";
       repo = "tree-sitter-html";
-      rev = "d9219ada6e1a2c8f0ab0304a8bd9ca4285ae0468";
+      rev = "d18f83f8bed0be99796c4eacafe9b295ab2ee144";
-      hash = "sha256-0aLNG4eB2I0Qn0r1oF4YwUDLek78S5fbklFI/bMmxOQ=";
+      hash = "sha256-FbyIgMEheIMAvllWtizuhj39G60IYX6YPY0BIz9O2/4=";
     };
     meta.homepage = "https://github.com/tree-sitter/tree-sitter-html";
   };
@@ -1287,12 +1287,12 @@
   };
   hyprlang = buildGrammar {
     language = "hyprlang";
-    version = "0.0.0+rev=6858695";
+    version = "0.0.0+rev=d719158";
     src = fetchFromGitHub {
       owner = "luckasRanarison";
       repo = "tree-sitter-hyprlang";
-      rev = "6858695eba0e63b9e0fceef081d291eb352abce8";
+      rev = "d719158abe537b1916daaea6fa03287089f0b601";
-      hash = "sha256-5csAj7k03QEEfkZE/EBmGjqUHPlFss3EWvExT4kaiQg=";
+      hash = "sha256-5iflQ4FDEvVRuaytPl08Q9CYXm2dfZ49qJyvcsOrzuI=";
     };
     meta.homepage = "https://github.com/luckasRanarison/tree-sitter-hyprlang";
   };
@@ -1364,34 +1364,34 @@
   };
   janet_simple = buildGrammar {
     language = "janet_simple";
-    version = "0.0.0+rev=b4aa56f";
+    version = "0.0.0+rev=ca4785b";
     src = fetchFromGitHub {
       owner = "sogaiu";
       repo = "tree-sitter-janet-simple";
-      rev = "b4aa56fd0a2ea2708fc93062683ae5eaa4e973e6";
+      rev = "ca4785b47a4ff15653f0408a49c764dec533e0d3";
-      hash = "sha256-2Yo1ZGNZbe6TtfaSIykkG10L58Z6lk5hMr30K5zGuYI=";
+      hash = "sha256-pRB5G4lR0t2E9MQN/a2AC8OQppwD6gZ1AfCNPon6TIE=";
     };
     meta.homepage = "https://github.com/sogaiu/tree-sitter-janet-simple";
   };
   java = buildGrammar {
     language = "java";
-    version = "0.0.0+rev=94703d5";
+    version = "0.0.0+rev=677da92";
     src = fetchFromGitHub {
       owner = "tree-sitter";
       repo = "tree-sitter-java";
-      rev = "94703d5a6bed02b98e438d7cad1136c01a60ba2c";
+      rev = "677da92875756e31b3a42505d822cc8be7c5ab5e";
-      hash = "sha256-OvEO1BLZLjP3jt4gar18kiXderksFKO0WFXDQqGLRIY=";
+      hash = "sha256-6eJI+6bMdMb/9q9rXFF66JeuC8TaRKKzAnkfMZ8tojU=";
     };
     meta.homepage = "https://github.com/tree-sitter/tree-sitter-java";
   };
   javascript = buildGrammar {
     language = "javascript";
-    version = "0.0.0+rev=108b2d4";
+    version = "0.0.0+rev=3f1c835";
     src = fetchFromGitHub {
       owner = "tree-sitter";
       repo = "tree-sitter-javascript";
-      rev = "108b2d4d17a04356a340aea809e4dd5b801eb40d";
+      rev = "3f1c835d05165050834da0e3cbc23a75e94aaa64";
-      hash = "sha256-0x6DbmRTlxUP4vbWVsLoj+k1YOk2Dr+LAPClFsWi7r8=";
+      hash = "sha256-+lC8zuuNlMIiEDqtuMdJwKXqG9udGOREq0ufasSbIJY=";
     };
     meta.homepage = "https://github.com/tree-sitter/tree-sitter-javascript";
   };
@@ -1408,23 +1408,23 @@
   };
   jsdoc = buildGrammar {
     language = "jsdoc";
-    version = "0.0.0+rev=b253abf";
+    version = "0.0.0+rev=a417db5";
     src = fetchFromGitHub {
       owner = "tree-sitter";
       repo = "tree-sitter-jsdoc";
-      rev = "b253abf68a73217b7a52c0ec254f4b6a7bb86665";
+      rev = "a417db5dbdd869fccb6a8b75ec04459e1d4ccd2c";
-      hash = "sha256-Azzb2zBjAfwbEmAEO1YqhpaxtzbXmRjfIzRla2Hx+24=";
+      hash = "sha256-MMLgza5H9NWYn9jtOumwg3cz3hqb8GQGFc/yRSvUIVI=";
     };
     meta.homepage = "https://github.com/tree-sitter/tree-sitter-jsdoc";
   };
   json = buildGrammar {
     language = "json";
-    version = "0.0.0+rev=4d770d3";
+    version = "0.0.0+rev=54ccd94";
     src = fetchFromGitHub {
       owner = "tree-sitter";
       repo = "tree-sitter-json";
-      rev = "4d770d31f732d50d3ec373865822fbe659e47c75";
+      rev = "54ccd9485e0122a5e9faf5d8aaed7294c308e894";
-      hash = "sha256-hmcwRbTn0xPrV1OufXXq6VNhCopa1NQJhDsY3VSPovw=";
+      hash = "sha256-tltnBQNEFZeN0jIxG0eHofyMLR0CTrQos1fh02Xexas=";
     };
     meta.homepage = "https://github.com/tree-sitter/tree-sitter-json";
   };
@@ -1507,12 +1507,12 @@
   };
   kotlin = buildGrammar {
     language = "kotlin";
-    version = "0.0.0+rev=0662afb";
+    version = "0.0.0+rev=c4ddea3";
     src = fetchFromGitHub {
       owner = "fwcd";
       repo = "tree-sitter-kotlin";
-      rev = "0662afbd2ce19b17c603acf67ae707b4d69ab8f4";
+      rev = "c4ddea359a7ff4d92360b2efcd6cfce5dc25afe6";
-      hash = "sha256-r3emNyglirgxb1ktR46EgsECv6ueHUpo6wI2ULyUBtU=";
+      hash = "sha256-7REd272fpCP/ggzg7wLf5DS6QX9SIO9YGPdvj2c2w58=";
     };
     meta.homepage = "https://github.com/fwcd/tree-sitter-kotlin";
   };
@@ -1797,12 +1797,12 @@
   };
   nginx = buildGrammar {
     language = "nginx";
-    version = "0.0.0+rev=281d184";
+    version = "0.0.0+rev=989da76";
     src = fetchFromGitHub {
       owner = "opa-oz";
       repo = "tree-sitter-nginx";
-      rev = "281d184b8240b2b22670b8907b57b6d6842db6f3";
+      rev = "989da760be05a3334af3ec88705cbf57e6a9c41d";
-      hash = "sha256-OsUCCtkaCwiKWKBduk9Ktc65LP1udKcKRmU4TAy8ayE=";
+      hash = "sha256-tIbwsh7cnpm1jkIKaXQ7NI/LXWzEOsZyNLfe/qTNkkM=";
     };
     meta.homepage = "https://github.com/opa-oz/tree-sitter-nginx";
   };
@@ -2009,35 +2009,35 @@
   };
   perl = buildGrammar {
     language = "perl";
-    version = "0.0.0+rev=7120632";
+    version = "0.0.0+rev=6f280c5";
     src = fetchFromGitHub {
       owner = "tree-sitter-perl";
       repo = "tree-sitter-perl";
-      rev = "71206326a8bcbdc2032f852bab8698e315bf5910";
+      rev = "6f280c52662dc254eb7a5abc0889f7a9e1154ffd";
-      hash = "sha256-EySvg8EcCrRS7QfiainRgsCYg8Kvn5DROLxrnyD3rkU=";
+      hash = "sha256-wyIUdf0v/acVptAe3Z3tL9QvbdZYoxpeaS1a7oygyiU=";
     };
     meta.homepage = "https://github.com/tree-sitter-perl/tree-sitter-perl";
   };
   php = buildGrammar {
     language = "php";
-    version = "0.0.0+rev=43aad2b";
+    version = "0.0.0+rev=5021edd";
     src = fetchFromGitHub {
       owner = "tree-sitter";
       repo = "tree-sitter-php";
-      rev = "43aad2b9a98aa8e603ea0cf5bb630728a5591ad8";
+      rev = "5021edde6d0ea75aedc313e75cca2ac5aa064d41";
-      hash = "sha256-+CnUnrNRaD+CejyYjqelMYA1K3GN/WPeZBJoP2y5cmI=";
+      hash = "sha256-DeqHoBlx9UCq7e06W6MnAVtoG7h7qrT1PNGsWTRN2f0=";
     };
     location = "php";
     meta.homepage = "https://github.com/tree-sitter/tree-sitter-php";
   };
   php_only = buildGrammar {
     language = "php_only";
-    version = "0.0.0+rev=43aad2b";
+    version = "0.0.0+rev=5021edd";
     src = fetchFromGitHub {
       owner = "tree-sitter";
       repo = "tree-sitter-php";
-      rev = "43aad2b9a98aa8e603ea0cf5bb630728a5591ad8";
+      rev = "5021edde6d0ea75aedc313e75cca2ac5aa064d41";
-      hash = "sha256-+CnUnrNRaD+CejyYjqelMYA1K3GN/WPeZBJoP2y5cmI=";
+      hash = "sha256-DeqHoBlx9UCq7e06W6MnAVtoG7h7qrT1PNGsWTRN2f0=";
     };
     location = "php_only";
     meta.homepage = "https://github.com/tree-sitter/tree-sitter-php";
@@ -2132,12 +2132,12 @@
   };
   prisma = buildGrammar {
     language = "prisma";
-    version = "0.0.0+rev=eca2596";
+    version = "0.0.0+rev=73f39a6";
     src = fetchFromGitHub {
       owner = "victorhqc";
       repo = "tree-sitter-prisma";
-      rev = "eca2596a355b1a9952b4f80f8f9caed300a272b5";
+      rev = "73f39a6d5401cfdcd143951e499336cf5ab2ffaa";
-      hash = "sha256-MOqkM7DCQl1L8Jn9nyw89EoAr0ez4+d39HeKy2cb66c=";
+      hash = "sha256-0wHh+Gf2wer/35NdEWOCQFNdRH/wVWnRx9HnlX7vZho=";
     };
     meta.homepage = "https://github.com/victorhqc/tree-sitter-prisma";
   };
@@ -2267,12 +2267,12 @@
   };
   python = buildGrammar {
     language = "python";
-    version = "0.0.0+rev=409b5d6";
+    version = "0.0.0+rev=44c2f7a";
     src = fetchFromGitHub {
       owner = "tree-sitter";
       repo = "tree-sitter-python";
-      rev = "409b5d671eb0ea4972eeacaaca24bbec1acf79b1";
+      rev = "44c2f7aebce0efac5867cdc5f2ea03c1d43a0305";
-      hash = "sha256-IIAL2qteFPBCPmDK1N2EdDgpI4CwfMuuVL8t5tYueLU=";
+      hash = "sha256-B/c4QW3LIMQPmiRyvQe7SrQNUoIqW8U9FEnP54+XT/4=";
     };
     meta.homepage = "https://github.com/tree-sitter/tree-sitter-python";
   };
@@ -2311,12 +2311,12 @@
   };
   query = buildGrammar {
     language = "query";
-    version = "0.0.0+rev=a6674e2";
+    version = "0.0.0+rev=5c2d027";
     src = fetchFromGitHub {
       owner = "nvim-treesitter";
       repo = "tree-sitter-query";
-      rev = "a6674e279b14958625d7a530cabe06119c7a1532";
+      rev = "5c2d02747250bc326bc33687b3319b7db8554e24";
-      hash = "sha256-xtr2IVI+3h/u9f84ye7szHR/U2E8Bm5NN7vhqaCkiyI=";
+      hash = "sha256-bZ8bIrr3vclu7AklGyVIxkR3TF9JDrGJui6i71swqhM=";
     };
     meta.homepage = "https://github.com/nvim-treesitter/tree-sitter-query";
   };
@@ -2399,12 +2399,12 @@
   };
   regex = buildGrammar {
     language = "regex";
-    version = "0.0.0+rev=d329907";
+    version = "0.0.0+rev=b638d29";
     src = fetchFromGitHub {
       owner = "tree-sitter";
       repo = "tree-sitter-regex";
-      rev = "d329907611abe46d26ab5908e5922e7400212cb9";
+      rev = "b638d29335ef41215b86732dd51be34c701ef683";
-      hash = "sha256-XNoklzboR0NzFu2Ke7HT6TitROFhEM6S993INA1atfM=";
+      hash = "sha256-KHPwvjqvgqLKGL/OeotF1djSSSrAsb2H3CNUmgiva18=";
     };
     meta.homepage = "https://github.com/tree-sitter/tree-sitter-regex";
   };
@@ -2498,12 +2498,12 @@
   };
   rst = buildGrammar {
     language = "rst";
-    version = "0.0.0+rev=5120f6e";
+    version = "0.0.0+rev=dd5971e";
     src = fetchFromGitHub {
       owner = "stsewd";
       repo = "tree-sitter-rst";
-      rev = "5120f6e59284cb8b85b450bd2db0bd352635ba9f";
+      rev = "dd5971ef7759583aadd5aa5e3a3a0905eb5734d5";
-      hash = "sha256-PI1C0W8fiuIQ2fgHXDelkCa0ng1a32x/9hrA33KoefM=";
+      hash = "sha256-gW/d49PsRm/FgTS4khJ681GDjf1aAgTSXvUv/8bP0ek=";
     };
     meta.homepage = "https://github.com/stsewd/tree-sitter-rst";
   };
@@ -2531,12 +2531,12 @@
   };
   rust = buildGrammar {
     language = "rust";
-    version = "0.0.0+rev=1f63b33";
+    version = "0.0.0+rev=2eaf126";
     src = fetchFromGitHub {
       owner = "tree-sitter";
       repo = "tree-sitter-rust";
-      rev = "1f63b33efee17e833e0ea29266dd3d713e27e321";
+      rev = "2eaf126458a4d6a69401089b6ba78c5e5d6c1ced";
-      hash = "sha256-HV7zMwO3ZMaHqX5cV43iwuC+QM7ecApZ2U/hbXuM34c=";
+      hash = "sha256-u3mJghmVHYPjow1QWRoT/Ip7DZwli4EzmioZQOzqTjs=";
     };
     meta.homepage = "https://github.com/tree-sitter/tree-sitter-rust";
   };
@@ -2553,12 +2553,12 @@
   };
   scfg = buildGrammar {
     language = "scfg";
-    version = "0.0.0+rev=a551280";
+    version = "0.0.0+rev=2f3709e";
     src = fetchFromGitHub {
       owner = "rockorager";
       repo = "tree-sitter-scfg";
-      rev = "a5512800ea0220da4abbae61b8aea8423d1549aa";
+      rev = "2f3709e7656fa2c443f92041c91a9f843f8cd625";
-      hash = "sha256-Je6taNzniyd1c+2NRCF7TOvnpeW4qhYYhdAEcgpDOAA=";
+      hash = "sha256-2/n+pSR6Ojahm8iBnpNsQscrXQqzZflKBA42gX29u50=";
     };
     generate = true;
     meta.homepage = "https://github.com/rockorager/tree-sitter-scfg";
@@ -2608,6 +2608,17 @@
     };
     meta.homepage = "https://github.com/theHamsta/tree-sitter-slang";
   };
+  slim = buildGrammar {
+    language = "slim";
+    version = "0.0.0+rev=a0f08e8";
+    src = fetchFromGitHub {
+      owner = "theoo";
+      repo = "tree-sitter-slim";
+      rev = "a0f08e85b787248219ea645423c5916c8d620ef6";
+      hash = "sha256-b+V56Csa+byGvTieN+cAvoVy8UpFzS8/SSdYeW3cjts=";
+    };
+    meta.homepage = "https://github.com/theoo/tree-sitter-slim";
+  };
   slint = buildGrammar {
     language = "slint";
     version = "0.0.0+rev=f11da7e";
@@ -2654,12 +2665,12 @@
   };
   solidity = buildGrammar {
     language = "solidity";
-    version = "0.0.0+rev=f7f5251";
+    version = "0.0.0+rev=7270875";
     src = fetchFromGitHub {
       owner = "JoranHonig";
       repo = "tree-sitter-solidity";
-      rev = "f7f5251a3f5b1d04f0799b3571b12918af177fc8";
+      rev = "727087514eff57d92e273a24303142308bce3381";
-      hash = "sha256-Tt8lXaHrRFbbATUoWK+Y9FZohY1IeDTCXaaom4yZYb4=";
+      hash = "sha256-k5YExvQmDXk+k9afiq6VizFdsvSH9u8Y1u3xB9i96mw=";
     };
     meta.homepage = "https://github.com/JoranHonig/tree-sitter-solidity";
   };
@@ -2689,12 +2700,12 @@
   };
   sourcepawn = buildGrammar {
     language = "sourcepawn";
-    version = "0.0.0+rev=6b9bf9c";
+    version = "0.0.0+rev=f2af8d0";
     src = fetchFromGitHub {
       owner = "nilshelmig";
       repo = "tree-sitter-sourcepawn";
-      rev = "6b9bf9cbab91443380d2ca8a2f6c491cc7fac5bf";
+      rev = "f2af8d0dc14c6790130cceb2a20027eb41a8297c";
-      hash = "sha256-2DjGCZ701c2rMxQZM4YF61rZokZUov4ECb0gwAmyuVk=";
+      hash = "sha256-u8/wM2Dj+uO3g24MsGZfH9zkABCEaWWFI8EX3fxuljk=";
     };
     meta.homepage = "https://github.com/nilshelmig/tree-sitter-sourcepawn";
   };
@@ -2788,12 +2799,12 @@
   };
   superhtml = buildGrammar {
     language = "superhtml";
-    version = "0.0.0+rev=1fda813";
+    version = "0.0.0+rev=e6eba40";
     src = fetchFromGitHub {
       owner = "kristoff-it";
       repo = "superhtml";
-      rev = "1fda813bd9dc108e962e018e6a327434767ad616";
+      rev = "e6eba40bf54dd94d842154be0389c53a37be8dc8";
-      hash = "sha256-+32toY540h92Xk5xoYvZaMYNDxXWI4pRbkrBnU4xRjM=";
+      hash = "sha256-v1K4yuAeFxu8K/Wt2gv2Onwfa4AB4Wt1p76d2koLAYw=";
     };
     location = "tree-sitter-superhtml";
     meta.homepage = "https://github.com/kristoff-it/superhtml";
@@ -2867,12 +2878,12 @@
   };
   t32 = buildGrammar {
     language = "t32";
-    version = "0.0.0+rev=ad23ed0";
+    version = "0.0.0+rev=e5a12f7";
     src = fetchFromGitLab {
       owner = "xasc";
       repo = "tree-sitter-t32";
-      rev = "ad23ed0325658adbb1dfb397d4dfbea8872585c6";
+      rev = "e5a12f798f056049642aa03fbb83786e3a5b95d4";
-      hash = "sha256-dcz2b0NiaJEQUN6kOk+FVfxqD3wSzolH+NXkPpzrQj4=";
+      hash = "sha256-oOykmtAFPQiqK02nia8/m8pg2fi5yKt7dzZOGr9f3dQ=";
     };
     meta.homepage = "https://gitlab.com/xasc/tree-sitter-t32.git";
   };
@@ -2923,12 +2934,12 @@
   };
   templ = buildGrammar {
     language = "templ";
-    version = "0.0.0+rev=60310af";
+    version = "0.0.0+rev=a9178bf";
     src = fetchFromGitHub {
       owner = "vrischmann";
       repo = "tree-sitter-templ";
-      rev = "60310af0d788a0160d719d4aff8f146b6e6c55bd";
+      rev = "a9178bfc9cc8040c08f39b47bae5400a2bf06e50";
-      hash = "sha256-M0+Yw2Ld9qT9Ag9OaMpmls8LO4+IK0xtAZ8X5oZ2c78=";
+      hash = "sha256-QMOPxbNzLcUfhEuD635M/n3WrADryjZVKXlNMF6QezQ=";
     };
     meta.homepage = "https://github.com/vrischmann/tree-sitter-templ";
   };
@@ -3035,12 +3046,12 @@
   };
   tsx = buildGrammar {
     language = "tsx";
-    version = "0.0.0+rev=8e13e1d";
+    version = "0.0.0+rev=410947e";
     src = fetchFromGitHub {
       owner = "tree-sitter";
       repo = "tree-sitter-typescript";
-      rev = "8e13e1db35b941fc57f2bd2dd4628180448c17d5";
+      rev = "410947e9d2ca8e032cd2419bf1241406c7e6f9bb";
-      hash = "sha256-Z68ERsfHxDubDJb7nQKSH0YoBmIReUGXNF0LJAQTXEs=";
+      hash = "sha256-iRIRIighYwVB5Pze5nhdZ9gFiELiqVBYrSyKLzaXI/8=";
     };
     location = "tsx";
     meta.homepage = "https://github.com/tree-sitter/tree-sitter-typescript";
@@ -3069,12 +3080,12 @@
   };
   typescript = buildGrammar {
     language = "typescript";
-    version = "0.0.0+rev=8e13e1d";
+    version = "0.0.0+rev=410947e";
     src = fetchFromGitHub {
       owner = "tree-sitter";
       repo = "tree-sitter-typescript";
-      rev = "8e13e1db35b941fc57f2bd2dd4628180448c17d5";
+      rev = "410947e9d2ca8e032cd2419bf1241406c7e6f9bb";
-      hash = "sha256-Z68ERsfHxDubDJb7nQKSH0YoBmIReUGXNF0LJAQTXEs=";
+      hash = "sha256-iRIRIighYwVB5Pze5nhdZ9gFiELiqVBYrSyKLzaXI/8=";
     };
     location = "typescript";
     meta.homepage = "https://github.com/tree-sitter/tree-sitter-typescript";
@@ -3170,12 +3181,12 @@
   };
   v = buildGrammar {
     language = "v";
-    version = "0.0.0+rev=5351039";
+    version = "0.0.0+rev=0461bf8";
     src = fetchFromGitHub {
       owner = "vlang";
       repo = "v-analyzer";
-      rev = "535103910159887a41d019635c1cdbec910d1a31";
+      rev = "0461bf8addccb4df566827f1601f415d07b1ffbc";
-      hash = "sha256-4VxvK9KzJlN0AsXz0XL5FIs3H65vPgyj/YqTc138zC4=";
+      hash = "sha256-flnEty9x1wDDtSgQk9cRXYKfWFjvqxRXsLl5ev3rGXk=";
     };
     location = "tree_sitter_v";
     meta.homepage = "https://github.com/vlang/v-analyzer";
@@ -3215,12 +3226,12 @@
   };
   vhdl = buildGrammar {
     language = "vhdl";
-    version = "0.0.0+rev=63d0360";
+    version = "0.0.0+rev=da8ea8a";
     src = fetchFromGitHub {
       owner = "jpt13653903";
       repo = "tree-sitter-vhdl";
-      rev = "63d0360d42c43b4902b8470c7ddcf323432e2dde";
+      rev = "da8ea8afa7899a99e43a7d61afef9f77b7a675eb";
-      hash = "sha256-D85VFM82lU4GDpIWZmY+j6134DHp0pGbqg8Haj2mgiw=";
+      hash = "sha256-yLoIKO1ObSe7rQOBjd1cF0U8/x622tYWwasiCHx+aYE=";
     };
     meta.homepage = "https://github.com/jpt13653903/tree-sitter-vhdl";
   };
@@ -3348,23 +3359,23 @@
   };
   xresources = buildGrammar {
     language = "xresources";
-    version = "0.0.0+rev=983f13a";
+    version = "0.0.0+rev=d0f9dc7";
     src = fetchFromGitHub {
       owner = "ValdezFOmar";
       repo = "tree-sitter-xresources";
-      rev = "983f13acef542aef431a845fef084ddda8d9d666";
+      rev = "d0f9dc7cec4dc15fc6f9d556bb4e9dd5050328a6";
-      hash = "sha256-s/wuzVzF8TzySZ0OFNCFpbvjminQzbb3icZc+DnChjc=";
+      hash = "sha256-3TBpNdIsmOutazBlMKAsQaq7RPu4vUeZMFuZ2/2HDKo=";
     };
     meta.homepage = "https://github.com/ValdezFOmar/tree-sitter-xresources";
   };
   yaml = buildGrammar {
     language = "yaml";
-    version = "0.0.0+rev=b733d3f";
+    version = "0.0.0+rev=1805917";
     src = fetchFromGitHub {
       owner = "tree-sitter-grammars";
       repo = "tree-sitter-yaml";
-      rev = "b733d3f5f5005890f324333dd57e1f0badec5c87";
+      rev = "1805917414a9a8ba2473717fd69447277a175fae";
-      hash = "sha256-23/zcjnQUQt32N2EdQMzWM9srkXfQxlBvOo7FWH6rnw=";
+      hash = "sha256-lcdlvzDhl0mDCe4olMoEynxFFLfn3w4p24C1k/7DItA=";
     };
     meta.homepage = "https://github.com/tree-sitter-grammars/tree-sitter-yaml";
   };
@@ -3414,24 +3425,24 @@
   };
   ziggy = buildGrammar {
     language = "ziggy";
-    version = "0.0.0+rev=fe73bee";
+    version = "0.0.0+rev=3518133";
     src = fetchFromGitHub {
       owner = "kristoff-it";
       repo = "ziggy";
-      rev = "fe73beef9f52f04048d8b19016fc4fbc66b4596f";
+      rev = "3518133e9ebea7c372eff4def368eda8488fad18";
-      hash = "sha256-GSiVrl3GMp5Y8DF/gxdl1ToUoN5s3RQxNKxmab5tSHs=";
+      hash = "sha256-U3MUFYsWiM5RK3lFXyo3VaTlxqkh3b0HzQsRiegIHU8=";
     };
     location = "tree-sitter-ziggy";
     meta.homepage = "https://github.com/kristoff-it/ziggy";
   };
   ziggy_schema = buildGrammar {
     language = "ziggy_schema";
-    version = "0.0.0+rev=fe73bee";
+    version = "0.0.0+rev=3518133";
     src = fetchFromGitHub {
       owner = "kristoff-it";
       repo = "ziggy";
-      rev = "fe73beef9f52f04048d8b19016fc4fbc66b4596f";
+      rev = "3518133e9ebea7c372eff4def368eda8488fad18";
-      hash = "sha256-GSiVrl3GMp5Y8DF/gxdl1ToUoN5s3RQxNKxmab5tSHs=";
+      hash = "sha256-U3MUFYsWiM5RK3lFXyo3VaTlxqkh3b0HzQsRiegIHU8=";
     };
     location = "tree-sitter-ziggy-schema";
     meta.homepage = "https://github.com/kristoff-it/ziggy";

pkgs/applications/editors/vim/plugins/overrides.nix

@@ -760,6 +760,7 @@ in
       # Optional integrations
       fzf-lua
       telescope-nvim
+      snacks-nvim
     ];
     dependencies = with self; [
       copilot-lua
@@ -3358,6 +3359,15 @@ in
     };
   };
 
+  vimade = super.vimade.overrideAttrs {
+    checkInputs = with self; [
+      # Optional providers
+      hlchunk-nvim
+      mini-nvim
+      snacks-nvim
+    ];
+  };
+
   vim-addon-actions = super.vim-addon-actions.overrideAttrs {
     dependencies = with self; [
       vim-addon-mw-utils

pkgs/applications/version-management/gitlab/default.nix

@@ -69,7 +69,7 @@ let
         buildFlags = [ "--enable-system-libraries" ];
       };
       gitlab-glfm-markdown = attrs: {
-        cargoDeps = rustPlatform.fetchCargoTarball {
+        cargoDeps = rustPlatform.fetchCargoVendor {
           src = stdenv.mkDerivation {
             inherit (buildRubyGem { inherit (attrs) gemName version source; })
               name
@@ -83,7 +83,7 @@ let
               cp Cargo.lock $out
             '';
           };
-          hash = "sha256-vFApyObuqsMBXhT2yyMpH7rzW0GaPgJUn9/hE/GpS9I=";
+          hash = "sha256-fikyG1e45XP+oWOxuCdapW1zM2O02KozqB5qnbw2TY8=";
         };
 
         dontBuild = false;

pkgs/build-support/rust/fetch-cargo-vendor.nix

@@ -35,6 +35,9 @@ in
   name ? if args ? pname && args ? version then "${args.pname}-${args.version}" else "cargo-deps",
   hash ? (throw "fetchCargoVendor requires a `hash` value to be set for ${name}"),
   nativeBuildInputs ? [ ],
+  # This is mostly for breaking infinite recursion where dependencies
+  # of nix-prefetch-git use fetchCargoVendor.
+  allowGitDependencies ? true,
   ...
 }@args:
 
@@ -53,11 +56,15 @@ let
     {
       name = "${name}-vendor-staging";
 
-      nativeBuildInputs = [
+      nativeBuildInputs =
+        [
           fetchCargoVendorUtil
-        nix-prefetch-git
           cacert
-      ] ++ nativeBuildInputs;
+        ]
+        ++ lib.optionals allowGitDependencies [
+          nix-prefetch-git
+        ]
+        ++ nativeBuildInputs;
 
       buildPhase = ''
         runHook preBuild

pkgs/by-name/aq/aquamarine/package.nix

@@ -23,13 +23,13 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "aquamarine";
-  version = "0.5.1";
+  version = "0.7.1";
 
   src = fetchFromGitHub {
     owner = "hyprwm";
     repo = "aquamarine";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-Gxv1kTz5jEvIzmkF6XgsdKglL2jmjJOQdZ+hO9uVnlQ=";
+    hash = "sha256-NbJiiPFnmciji3JHpqF/L0SdMQXKXn+q3Q/D8RjF/ak=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/au/autoadb/package.nix

@@ -1,27 +0,0 @@
-{
-  lib,
-  rustPlatform,
-  fetchFromGitHub,
-}:
-
-rustPlatform.buildRustPackage rec {
-  pname = "autoadb";
-  version = "unstable-2020-06-01";
-
-  src = fetchFromGitHub {
-    owner = "rom1v";
-    repo = pname;
-    rev = "7f8402983603a9854bf618a384f679a17cd85e2d";
-    sha256 = "sha256-9Sv38dCtvbqvxSnRpq+HsIwF/rfLUVZbi0J+mltLres=";
-  };
-
-  cargoHash = "sha256-xxmBgJqtWq1FLWTaC8SjaBoSXkPcIZYrSOc+hCEN778=";
-
-  meta = with lib; {
-    description = "Execute a command whenever a device is adb-connected";
-    homepage = "https://github.com/rom1v/autoadb";
-    license = licenses.asl20;
-    maintainers = with maintainers; [ shawn8901 ];
-    mainProgram = "autoadb";
-  };
-}

pkgs/by-name/co/colorstorm/0001-fix-segfault.patch

@@ -0,0 +1,12 @@
+diff --git a/src/templator.zig b/src/templator.zig
+index 5630a04..0dc8ca7 100644
+--- a/src/templator.zig
++++ b/src/templator.zig
+@@ -77,7 +77,6 @@ pub fn parse_themes(f: std.fs.File) ![]Theme {
+     }
+ 
+     const parsed = try std.json.parseFromSlice([]Theme, a, list.items, .{});
+-    defer parsed.deinit();
+     const themes = parsed.value;
+ 
+     return themes;

pkgs/by-name/co/colorstorm/package.nix

@@ -2,22 +2,31 @@
   lib,
   stdenv,
   fetchFromGitHub,
-  zig_0_9,
+  zig_0_13,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "colorstorm";
-  version = "2.0.0";
+  # last tagged release is three years old and requires outdated Zig 0.9
+  # new release requested in: https://github.com/benbusby/colorstorm/issues/16
+  version = "2.0.0-unstable-2025-01-17";
 
   src = fetchFromGitHub {
     owner = "benbusby";
     repo = "colorstorm";
-    rev = "v${finalAttrs.version}";
+    rev = "e645c4293fb5f72968038dac99e0b8dab3db194f";
-    hash = "sha256-6+P+QQpP1jxsydqhVrZkjl1gaqNcx4kS2994hOBhtu8=";
+    hash = "sha256-6D+aNcjJksv7E9RJB9fnzgzvGoUPXV4Shz5wLu5YHtg=";
   };
 
+  patches = [
+    # Fixes a use-after-free segfault.
+    # See https://github.com/benbusby/colorstorm/pull/15#discussion_r1930406581
+    # and upstream PR https://github.com/NixOS/nixpkgs/pull/377279
+    ./0001-fix-segfault.patch
+  ];
+
   nativeBuildInputs = [
-    zig_0_9.hook
+    zig_0_13.hook
   ];
 
   meta = {
@@ -25,7 +34,7 @@ stdenv.mkDerivation (finalAttrs: {
     homepage = "https://github.com/benbusby/colorstorm";
     license = lib.licenses.mit;
     maintainers = [ ];
-    inherit (zig_0_9.meta) platforms;
+    inherit (zig_0_13.meta) platforms;
     mainProgram = "colorstorm";
   };
 })

pkgs/by-name/fl/flashrom/package.nix

@@ -53,6 +53,10 @@ stdenv.mkDerivation rec {
     install -Dm644 util/flashrom_udev.rules $out/lib/udev/rules.d/flashrom.rules
   '';
 
+  NIX_CFLAGS_COMPILE = lib.optionalString (
+    stdenv.cc.isClang && !stdenv.hostPlatform.isDarwin
+  ) "-Wno-gnu-folding-constant";
+
   meta = with lib; {
     homepage = "https://www.flashrom.org";
     description = "Utility for reading, writing, erasing and verifying flash ROM chips";

pkgs/by-name/fl/fluent-bit/package.nix

@@ -14,13 +14,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "fluent-bit";
-  version = "3.2.4";
+  version = "3.2.5";
 
   src = fetchFromGitHub {
     owner = "fluent";
     repo = "fluent-bit";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-oTCGjDmGVovsfj+4fjIKy/xpiuYc0Q44LYwYPI4dSF8=";
+    hash = "sha256-H3wcKeHfAJNJAEtRcTU8rz93wug39TUqV3XN4wkTqMg=";
   };
 
   # optional only to avoid linux rebuild

pkgs/by-name/fr/frida-tools/package.nix

@@ -6,11 +6,11 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "frida-tools";
-  version = "13.6.0";
+  version = "13.6.1";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-M0S8tZagToIP6Qyr9RWNAGGfWOcOtO0bYKC02IhCpvg=";
+    hash = "sha256-imNW0vorY90lp2OkhYLYwgpyW+Vxd1kdq3Lvd4/iNVA=";
   };
 
   propagatedBuildInputs = with python3Packages; [

pkgs/by-name/fu/fum/package.nix

@@ -11,16 +11,17 @@
 }:
 rustPlatform.buildRustPackage rec {
   pname = "fum";
-  version = "0.4.3";
+  version = "0.6.4";
 
   src = fetchFromGitHub {
     owner = "qxb3";
     repo = "fum";
     tag = "v${version}";
-    hash = "sha256-VRcQWwO80xFn5A21yjRsGqnnWkhWfsJxxEiw78NWJPM=";
+    hash = "sha256-vBn76s2ewLVVYhyXviQUmq+AzH6FSVdJaTEJQ2EPlM0=";
   };
 
-  cargoHash = "sha256-GW3/SqQlEUTMtvOgnMGhcREOHz/V2qtjtCAzFFKMNb4=";
+  useFetchCargoVendor = true;
+  cargoHash = "sha256-7h/KIAIxldXPXUo0lzuBqs6Uf5S5p39yV+kTfLe/LBo=";
 
   nativeBuildInputs = [
     autoPatchelfHook

pkgs/by-name/go/gollum/Gemfile.lock

@@ -5,14 +5,15 @@ GEM
     asciidoctor (2.0.23)
     base64 (0.2.0)
     builder (3.3.0)
-    concurrent-ruby (1.3.4)
+    concurrent-ruby (1.3.5)
     crass (1.0.6)
     creole (0.5.0)
+    date (3.4.1)
     expression_parser (0.9.0)
     gemojione (4.3.3)
       json
     github-markup (4.0.2)
-    gollum (6.0.1)
+    gollum (6.1.0)
       gemojione (~> 4.1)
       gollum-lib (~> 6.0)
       i18n (~> 1.8)
@@ -45,82 +46,85 @@ GEM
     htmlentities (4.3.4)
     i18n (1.14.6)
       concurrent-ruby (~> 1.0)
-    json (2.7.4)
+    json (2.9.1)
-    kramdown (2.4.0)
+    kramdown (2.5.1)
-      rexml
+      rexml (>= 3.3.9)
     kramdown-parser-gfm (1.1.0)
       kramdown (~> 2.0)
-    logger (1.6.1)
+    logger (1.6.5)
-    loofah (2.23.1)
+    loofah (2.24.0)
       crass (~> 1.0.2)
       nokogiri (>= 1.12.0)
     mime-types (3.6.0)
       logger
       mime-types-data (~> 3.2015)
-    mime-types-data (3.2024.1001)
+    mime-types-data (3.2025.0107)
-    mini_portile2 (2.8.7)
+    mini_portile2 (2.8.8)
     multi_json (1.15.0)
     mustache (1.1.1)
     mustache-sinatra (2.0.0)
       mustache (~> 1.0)
     mustermann (3.0.3)
       ruby2_keywords (~> 0.0.1)
-    nokogiri (1.16.7)
+    nokogiri (1.18.1)
       mini_portile2 (~> 2.8.2)
       racc (~> 1.4)
-    octicons (19.12.0)
+    octicons (19.14.0)
     org-ruby (0.9.12)
       rubypants (~> 0.2)
-    psych (5.1.2)
+    psych (5.2.3)
+      date
       stringio
     racc (1.8.1)
     rack (3.1.8)
-    rack-protection (4.0.0)
+    rack-protection (4.1.1)
       base64 (>= 0.1.0)
+      logger (>= 1.6.0)
       rack (>= 3.0.0, < 4)
-    rack-session (2.0.0)
+    rack-session (2.1.0)
+      base64 (>= 0.1.0)
       rack (>= 3.0.0)
-    rackup (2.1.0)
+    rackup (2.2.1)
       rack (>= 3)
-      webrick (~> 1.8)
+    rdoc (6.11.0)
-    rdoc (6.7.0)
       psych (>= 4.0.0)
-    rexml (3.3.9)
+    rexml (3.4.0)
     rouge (3.30.0)
     rss (0.3.1)
       rexml
     ruby2_keywords (0.0.5)
     rubypants (0.7.1)
-    rugged (1.7.2)
+    rugged (1.9.0)
-    sinatra (4.0.0)
+    sinatra (4.1.1)
+      logger (>= 1.6.0)
       mustermann (~> 3.0)
       rack (>= 3.0.0, < 4)
-      rack-protection (= 4.0.0)
+      rack-protection (= 4.1.1)
       rack-session (>= 2.0.0, < 3)
       tilt (~> 2.0)
-    sinatra-contrib (4.0.0)
+    sinatra-contrib (4.1.1)
       multi_json (>= 0.0.2)
       mustermann (~> 3.0)
-      rack-protection (= 4.0.0)
+      rack-protection (= 4.1.1)
-      sinatra (= 4.0.0)
+      sinatra (= 4.1.1)
       tilt (~> 2.0)
     sprockets (4.2.1)
       concurrent-ruby (~> 1.0)
       rack (>= 2.2.4, < 4)
     sprockets-helpers (1.4.0)
       sprockets (>= 2.2)
-    stringio (3.1.1)
+    stringio (3.1.2)
     therubyrhino (2.1.2)
       therubyrhino_jar (>= 1.7.4, < 1.7.9)
     therubyrhino_jar (1.7.8)
-    tilt (2.4.0)
+    tilt (2.6.0)
     twitter-text (1.14.7)
       unf (~> 0.1.0)
     unf (0.1.4)
       unf_ext
     unf_ext (0.0.9.1)
-    useragent (0.16.10)
+    useragent (0.16.11)
-    webrick (1.8.2)
+    webrick (1.9.1)
     wikicloth (0.8.3)
       builder
       expression_parser
@@ -140,4 +144,4 @@ DEPENDENCIES
   wikicloth
 
 BUNDLED WITH
-   2.5.16
+   2.5.22

pkgs/by-name/go/gollum/gemset.nix

@@ -34,10 +34,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "0chwfdq2a6kbj6xz9l6zrdfnyghnh32si82la1dnpa5h75ir5anl";
+      sha256 = "1ipbrgvf0pp6zxdk5ascp6i29aybz2bx9wdrlchjmpx6mhvkwfw1";
       type = "gem";
     };
-    version = "1.3.4";
+    version = "1.3.5";
   };
   crass = {
     groups = [ "default" ];
@@ -59,6 +59,16 @@
     };
     version = "0.5.0";
   };
+  date = {
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "0kz6mc4b9m49iaans6cbx031j9y7ldghpi5fzsdh0n3ixwa8w9mz";
+      type = "gem";
+    };
+    version = "3.4.1";
+  };
   expression_parser = {
     groups = [ "default" ];
     platforms = [ ];
@@ -115,10 +125,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "01gk8zb1mfr7ypspbg765fn3m6rdh0b6jpyxfninabl9dzazyvpi";
+      sha256 = "1djb0mr4csfpas1aq19yv3d04hw6vxxpgbffp2bsp0p0p1h51far";
       type = "gem";
     };
-    version = "6.0.1";
+    version = "6.1.0";
   };
   gollum-lib = {
     dependencies = [
@@ -179,10 +189,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "1klf2mnfilzjqwcjdi5qb1zl3ghrifz1amcnvwjvsfnx9a5jb9ly";
+      sha256 = "048danb0x10mpch6mf88mky35zjn6wk4hpbqq68ssbq58i3fzgfj";
       type = "gem";
     };
-    version = "2.7.4";
+    version = "2.9.1";
   };
   kramdown = {
     dependencies = [ "rexml" ];
@@ -190,10 +200,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "1ic14hdcqxn821dvzki99zhmcy130yhv5fqfffkcf87asv5mnbmn";
+      sha256 = "131nwypz8b4pq1hxs6gsz3k00i9b75y3cgpkq57vxknkv6mvdfw7";
       type = "gem";
     };
-    version = "2.4.0";
+    version = "2.5.1";
   };
   kramdown-parser-gfm = {
     dependencies = [ "kramdown" ];
@@ -211,10 +221,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "0lwncq2rf8gm79g2rcnnyzs26ma1f4wnfjm6gs4zf2wlsdz5in9s";
+      sha256 = "0sz584vw17pwrrc5zg6yd8lqcgfpjf4qplq3s7fr0r3505nybky3";
       type = "gem";
     };
-    version = "1.6.1";
+    version = "1.6.5";
   };
   loofah = {
     dependencies = [
@@ -225,10 +235,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "0ppp2cgli5avzk0z3dwnah6y65ymyr793yja28p2fs9vrci7986h";
+      sha256 = "07pfa5kgl7k2hxlzzn89qna6bmiyrxlchgbzi0885frsi08agrk1";
       type = "gem";
     };
-    version = "2.23.1";
+    version = "2.24.0";
   };
   mime-types = {
     dependencies = [
@@ -249,20 +259,20 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "06dbn0j13jwdrmlvrjd50mxqrjlkh3lvxp0afh4glyzbliqvqpsd";
+      sha256 = "1jixfirdang1lx9iqkcw03mz43pi4vxlfpb8ha4sbz4cqry4jai3";
       type = "gem";
     };
-    version = "3.2024.1001";
+    version = "3.2025.0107";
   };
   mini_portile2 = {
     groups = [ "default" ];
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "1q1f2sdw3y3y9mnym9dhjgsjr72sq975cfg5c4yx7gwv8nmzbvhk";
+      sha256 = "0x8asxl83msn815lwmb2d7q5p29p7drhjv5va0byhk60v9n16iwf";
       type = "gem";
     };
-    version = "2.8.7";
+    version = "2.8.8";
   };
   multi_json = {
     groups = [ "default" ];
@@ -315,20 +325,20 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "15gysw8rassqgdq3kwgl4mhqmrgh7nk2qvrcqp4ijyqazgywn6gq";
+      sha256 = "0xc4qs4izky1zgafabzykbxk8lc4dq6aivgxmfv3ciy3jrzbw66z";
       type = "gem";
     };
-    version = "1.16.7";
+    version = "1.18.1";
   };
   octicons = {
     groups = [ "default" ];
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "00ld13van1xiayr24gwpbxfb63zbw44fx25xs9cp29g6cdzi5hrp";
+      sha256 = "0a1gvsr0fcxl7z8mnflr1lmmvknr11l05x9rg3c21dnnk6rnain7";
       type = "gem";
     };
-    version = "19.12.0";
+    version = "19.14.0";
   };
   org-ruby = {
     dependencies = [ "rubypants" ];
@@ -342,15 +352,18 @@
     version = "0.9.12";
   };
   psych = {
-    dependencies = [ "stringio" ];
+    dependencies = [
+      "date"
+      "stringio"
+    ];
     groups = [ "default" ];
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "0s5383m6004q76xm3lb732bp4sjzb6mxb6rbgn129gy2izsj4wrk";
+      sha256 = "1vjrx3yd596zzi42dcaq5xw7hil1921r769dlbz08iniaawlp9c4";
       type = "gem";
     };
-    version = "5.1.2";
+    version = "5.2.3";
   };
   racc = {
     groups = [ "default" ];
@@ -375,41 +388,42 @@
   rack-protection = {
     dependencies = [
       "base64"
+      "logger"
       "rack"
     ];
     groups = [ "default" ];
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "1xmvcxgm1jq92hqxm119gfk95wzl0d46nb2c2c6qqsm4ra2n3nyh";
+      sha256 = "0sniswjyi0yn949l776h7f67rvx5w9f04wh69z5g19vlsnjm98ji";
       type = "gem";
     };
-    version = "4.0.0";
+    version = "4.1.1";
   };
   rack-session = {
+    dependencies = [
+      "base64"
+      "rack"
+    ];
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "1452c1bhh6fdnv17s1z65ajwh08axqnlmkhnr1qyyn2vacb3jz23";
+      type = "gem";
+    };
+    version = "2.1.0";
+  };
+  rackup = {
     dependencies = [ "rack" ];
     groups = [ "default" ];
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "10afdpmy9kh0qva96slcyc59j4gkk9av8ilh58cnj0qq7q3b416v";
+      sha256 = "13brkq5xkj6lcdxj3f0k7v28hgrqhqxjlhd4y2vlicy5slgijdzp";
       type = "gem";
     };
-    version = "2.0.0";
+    version = "2.2.1";
-  };
-  rackup = {
-    dependencies = [
-      "rack"
-      "webrick"
-    ];
-    groups = [ "default" ];
-    platforms = [ ];
-    source = {
-      remotes = [ "https://rubygems.org" ];
-      sha256 = "0kbcka30g681cqasw47pq93fxjscq7yvs5zf8lp3740rb158ijvf";
-      type = "gem";
-    };
-    version = "2.1.0";
   };
   rdoc = {
     dependencies = [ "psych" ];
@@ -417,10 +431,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "0ygk2zk0ky3d88v3ll7qh6xqvbvw5jin0hqdi1xkv1dhaw7myzdi";
+      sha256 = "0h00mb8wcj937srrafpjzq0klfi8rfpd4b3xpbvn9ghrn2wnzimy";
       type = "gem";
     };
-    version = "6.7.0";
+    version = "6.11.0";
   };
   RedCloth = {
     groups = [ "default" ];
@@ -437,10 +451,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "1j9p66pmfgxnzp76ksssyfyqqrg7281dyi3xyknl3wwraaw7a66p";
+      sha256 = "1ch4k2y80r4glr579kxliqnxld2qa91ydq8fiqam38bzpbps3gpg";
       type = "gem";
     };
-    version = "3.3.9";
+    version = "3.4.0";
   };
   rouge = {
     groups = [ "default" ];
@@ -488,13 +502,14 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "1sccng15h8h3mcjxfgvxy85lfpswbj0nhmzwwsqdffbzqgsb2jch";
+      sha256 = "1b7gcf6pxg4x607bica68dbz22b4kch33yi0ils6x3c8ql9akakz";
       type = "gem";
     };
-    version = "1.7.2";
+    version = "1.9.0";
   };
   sinatra = {
     dependencies = [
+      "logger"
       "mustermann"
       "rack"
       "rack-protection"
@@ -505,10 +520,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "0za92lv4s7xhgkkm6xxf7ib0b3bsyj8drxgkrskgsb5g3mxnixjl";
+      sha256 = "002dkzdc1xqhvz5sdnj4vb0apczhs07mnpgq4kkd5dd1ka2pp6af";
       type = "gem";
     };
-    version = "4.0.0";
+    version = "4.1.1";
   };
   sinatra-contrib = {
     dependencies = [
@@ -522,10 +537,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "0r9khg85m60w0i77jpnm2irh9m4k0ia4mlicapj8dr7s6ykqd9dh";
+      sha256 = "1giziwf8mgki581jf40zzw3dhjkkmdg3yxbrahj9krd5h24vb90y";
       type = "gem";
     };
-    version = "4.0.0";
+    version = "4.1.1";
   };
   sprockets = {
     dependencies = [
@@ -557,10 +572,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "07mfqb40b2wh53k33h91zva78f9zwcdnl85jiq74wnaw2wa6wiak";
+      sha256 = "0cd1kdrf62p2ya3ia4rz49d5012bqinvqjmcgkakknswz0l1hkr0";
       type = "gem";
     };
-    version = "3.1.1";
+    version = "3.1.2";
   };
   therubyrhino = {
     dependencies = [ "therubyrhino_jar" ];
@@ -588,10 +603,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "0kds7wkxmb038cwp6ravnwn8k65ixc68wpm8j5jx5bhx8ndg4x6z";
+      sha256 = "0szpapi229v3scrvw1pgy0vpjm7z3qlf58m1198kxn70cs278g96";
       type = "gem";
     };
-    version = "2.4.0";
+    version = "2.6.0";
   };
   twitter-text = {
     dependencies = [ "unf" ];
@@ -630,20 +645,20 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "1fv5kvq494swy0p17h9qya9r50w15xsi9zmvhzb8gh55kq6ki50p";
+      sha256 = "0i1q2xdjam4d7gwwc35lfnz0wyyzvnca0zslcfxm9fabml9n83kh";
       type = "gem";
     };
-    version = "0.16.10";
+    version = "0.16.11";
   };
   webrick = {
     groups = [ "default" ];
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "089gy5494j560b242vi173wnbj2913hwlwnjkpzld58r96ilc5s3";
+      sha256 = "12d9n8hll67j737ym2zw4v23cn4vxyfkb6vyv1rzpwv6y6a3qbdl";
       type = "gem";
     };
-    version = "1.8.2";
+    version = "1.9.1";
   };
   wikicloth = {
     dependencies = [

pkgs/by-name/gp/gpsprune/package.nix

@@ -11,11 +11,11 @@
 
 stdenv.mkDerivation rec {
   pname = "gpsprune";
-  version = "24.5";
+  version = "25";
 
   src = fetchurl {
     url = "https://activityworkshop.net/software/gpsprune/gpsprune_${version}.jar";
-    hash = "sha256-qQtMSQbhIgYLJbCip6ioWeVphO1DEYudmXKUer04L4Y=";
+    hash = "sha256-8FGOigjHIvj+CZwq0Lht7UZjtmrE5l2Aqx92gZjau44=";
   };
 
   dontUnpack = true;

pkgs/by-name/ha/harper/package.nix

@@ -6,17 +6,17 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "harper";
-  version = "0.17.0";
+  version = "0.18.0";
 
   src = fetchFromGitHub {
     owner = "Automattic";
     repo = "harper";
     rev = "v${version}";
-    hash = "sha256-cUN7e82CncDzA9m+pcvtrAn10E6AYaMcAuu6hpt85tA=";
+    hash = "sha256-phwFwrRuMPWPaPKi41G/YQfiRWFfNCir9478VrGckWI=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-svB+Oo51lmsOPBn9hs4gNiJ2Ih2S/i06xaJqNBxo/HU=";
+  cargoHash = "sha256-sbEky7mRPq7p9W+TXYE+3vGoZXP4NuC9dec3rTIxBPI=";
 
   meta = {
     description = "Grammar Checker for Developers";

pkgs/by-name/hy/hyprland/info.json

@@ -1,7 +1,7 @@
 {
-  "branch": "v0.46.2-b",
+  "branch": "main",
-  "commit_hash": "0bd541f2fd902dbfa04c3ea2ccf679395e316887",
+  "commit_hash": "04ac46c54357278fc68f0a95d26347ea0db99496",
-  "commit_message": "version: bump to 0.46.2",
+  "commit_message": "version: bump to 0.47.0",
-  "date": "2024-12-19",
+  "date": "2025-01-27",
-  "tag": "v0.46.2"
+  "tag": "v0.47.0"
 }

pkgs/by-name/hy/hyprland/package.nix

@@ -13,6 +13,7 @@
   cairo,
   epoll-shim,
   git,
+  glaze,
   hyprcursor,
   hyprgraphics,
   hyprland-qtutils,
@@ -85,14 +86,14 @@ assert assertMsg (!hidpiXWayland)
 
 customStdenv.mkDerivation (finalAttrs: {
   pname = "hyprland" + optionalString debug "-debug";
-  version = "0.46.2";
+  version = "0.47.0";
 
   src = fetchFromGitHub {
     owner = "hyprwm";
     repo = "hyprland";
     fetchSubmodules = true;
     tag = "v${finalAttrs.version}";
-    hash = "sha256-dj9dpVwpyTmUyVu4jtaIU39bHgVkoZjv6cgYfWyHc9E=";
+    hash = "sha256-rxvLiGNRUSVYPFsKIsqEbhxpR0sbWmHoo3azZKQ9fTY=";
   };
 
   postPatch = ''
@@ -143,6 +144,7 @@ customStdenv.mkDerivation (finalAttrs: {
     [
       aquamarine
       cairo
+      glaze
       git
       hyprcursor.dev
       hyprgraphics

pkgs/by-name/hy/hyprutils/package.nix

@@ -10,13 +10,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "hyprutils";
-  version = "0.3.3";
+  version = "0.5.0";
 
   src = fetchFromGitHub {
     owner = "hyprwm";
     repo = "hyprutils";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-1LimBKvDpBbeX+qW7T240WEyw+DBVpDotZB4JYm8Aps=";
+    hash = "sha256-TfFS0HCEJh63Kahrkp1h9hVDMdLU8a37Zz+IFucxyfA=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/li/libdaemon/package.nix

@@ -25,7 +25,7 @@ stdenv.mkDerivation rec {
     [ "--disable-lynx" ]
     ++ lib.optionals (stdenv.hostPlatform != stdenv.buildPlatform) [
       # Can't run this test while cross-compiling
-      "ac_cv_func_setpgrp_void=yes"
+      "ac_cv_func_setpgrp_void=${if stdenv.hostPlatform.isBSD then "no" else "yes"}"
     ];
 
   meta = {

pkgs/by-name/li/libloot/package.nix

@@ -150,7 +150,8 @@ stdenv.mkDerivation (finalAttrs: {
         hash = "sha256-qJ7gC4BkrXJiVcyA1BqlJSRzgc/7VmNBHtDq0ouJoTU=";
       };
 
-      cargoHash = "sha256-x4LFO6dD3bBKv6gTrNUAo7Rdw5cP67gn44QP6Iwbv0I=";
+      useFetchCargoVendor = true;
+      cargoHash = "sha256-m3lyABr7tU0AeC6EZomBw1X722ezQg/cjSZh/ZhkiBw=";
 
       lang = "c++";
       header = "libloadorder.hpp";
@@ -167,7 +168,8 @@ stdenv.mkDerivation (finalAttrs: {
         hash = "sha256-ygjSyixg+9HFFNV/G+w+TxGFTrjlWxlDt8phpCE8xyQ=";
       };
 
-      cargoHash = "sha256-39iod83yVU5PyIjwv7pLLuMeNw9fHiM0tXDauyGrbx8=";
+      useFetchCargoVendor = true;
+      cargoHash = "sha256-6sY2M7kjSYB3+6+zoMxPwdl+g7ARLHm9RdSODHQR8bE=";
 
       lang = "c++";
       header = "esplugin.hpp";
@@ -184,7 +186,8 @@ stdenv.mkDerivation (finalAttrs: {
         hash = "sha256-yXbe7ByYHvFpokRpV2pz2SX0986dpk5IpehwDUhoZKg=";
       };
 
-      cargoHash = "sha256-p+raWZkW16MrvfZhJigSPth8pZZ68twU1+0GL/Mo1Xw=";
+      useFetchCargoVendor = true;
+      cargoHash = "sha256-d3JBpYI4XMkDnufvdyZkgtp7H4amMzM0dBEO6t9efGE=";
 
       lang = "c";
       header = "loot_condition_interpreter.h";

pkgs/by-name/md/mdbook/package.nix

@@ -11,7 +11,7 @@
 let
   version = "0.4.43";
 in
-rustPlatform.buildRustPackage {
+rustPlatform.buildRustPackage rec {
   inherit version;
   pname = "mdbook";
 
@@ -22,7 +22,11 @@ rustPlatform.buildRustPackage {
     hash = "sha256-aADNcuIeDef9+a3NOWQxo6IRnKJ6AbkvE4GqvFbubyI=";
   };
 
-  cargoHash = "sha256-8K72sJywMKxX/31SJuCEoacWvHrpkuwGGLXJ9MsDkTE=";
+  cargoDeps = rustPlatform.fetchCargoVendor {
+    inherit pname version src;
+    allowGitDependencies = false;
+    hash = "sha256-W5hg6ECNQRIh07ogZkXTn51el2YltutY86aJBYFDTP4=";
+  };
 
   nativeBuildInputs = [ installShellFiles ];
 

pkgs/by-name/me/mediamtx/package.nix

@@ -8,23 +8,23 @@
 
 let
   hlsJs = fetchurl {
-    url = "https://cdn.jsdelivr.net/npm/hls.js@v1.5.19/dist/hls.min.js";
+    url = "https://cdn.jsdelivr.net/npm/hls.js@v1.5.20/dist/hls.min.js";
-    hash = "sha256-KTlFB7LXpglQPzIzKajKy3DJRGDURwP4hcmRm7Oy/a8=";
+    hash = "sha256-0BbBIwSW7lnz9bAcFszkzAG1odPTV63sIAyQixMevkk=";
   };
 in
 buildGoModule rec {
   pname = "mediamtx";
   # check for hls.js version updates in internal/servers/hls/hlsjsdownloader/VERSION
-  version = "1.11.1";
+  version = "1.11.2";
 
   src = fetchFromGitHub {
     owner = "bluenviron";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-8/RTdcq8r5yMu586iDNyC/Cfi0PydX7QkU52noQR18Y=";
+    hash = "sha256-+NT3YheDdlTPnyGLUl9mpyYx2kvN1lw2jDRdAboTSdc=";
   };
 
-  vendorHash = "sha256-Laos5sTQjtweC4GLuQuK2J/trObPlCmoHSUw4shVP4k=";
+  vendorHash = "sha256-aDBjxt3f7z/9LwYJ5KyteODGFO5u+7m/rovOd9363Fg=";
 
   postPatch = ''
     cp ${hlsJs} internal/servers/hls/hls.min.js

pkgs/by-name/mi/miracle-wm/package.nix

@@ -6,6 +6,8 @@
   nixosTests,
   boost,
   cmake,
+  coreutils,
+  dbus,
   glib,
   glm,
   gtest,
@@ -16,29 +18,31 @@
   libuuid,
   libxkbcommon,
   libgbm,
+  makeWrapper,
   mir,
   nlohmann_json,
   pcre2,
   pkg-config,
+  systemd,
   wayland,
   yaml-cpp,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "miracle-wm";
-  version = "0.4.0";
+  version = "0.4.1";
 
   src = fetchFromGitHub {
     owner = "miracle-wm-org";
     repo = "miracle-wm";
-    rev = "v${finalAttrs.version}";
+    tag = "v${finalAttrs.version}";
-    hash = "sha256-IuYRgQm3DM6ZgsfRt37GCXC3hb1vGIrqw7WxYN+Bets=";
+    hash = "sha256-LPcVLpskpmHc8EzdNqMT6BnbY8Le/BVojpXPIqy6tGI=";
   };
 
   postPatch =
     ''
-      substituteInPlace session/usr/local/share/wayland-sessions/miracle-wm.desktop.in \
+      substituteInPlace CMakeLists.txt \
-        --replace-fail '@CMAKE_INSTALL_FULL_BINDIR@/miracle-wm' 'miracle-wm'
+        --replace-fail 'DESTINATION /usr/lib' 'DESTINATION ''${CMAKE_INSTALL_LIBDIR}'
     ''
     + lib.optionalString (!finalAttrs.finalPackage.doCheck) ''
       substituteInPlace CMakeLists.txt \
@@ -52,6 +56,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   nativeBuildInputs = [
     cmake
+    makeWrapper
     pkg-config
   ];
 
@@ -75,6 +80,10 @@ stdenv.mkDerivation (finalAttrs: {
 
   checkInputs = [ gtest ];
 
+  cmakeFlags = [
+    (lib.cmakeBool "SYSTEMD_INTEGRATION" true)
+  ];
+
   doCheck = stdenv.buildPlatform.canExecute stdenv.hostPlatform;
 
   checkPhase = ''
@@ -85,6 +94,18 @@ stdenv.mkDerivation (finalAttrs: {
     runHook postCheck
   '';
 
+  postFixup = ''
+    patchShebangs $out/libexec/miracle-wm-session-setup
+    wrapProgram $out/libexec/miracle-wm-session-setup \
+      --prefix PATH : "$out/bin:${
+        lib.makeBinPath [
+          coreutils # cat
+          dbus # dbus-update-activation-environment
+          systemd # systemctl
+        ]
+      }"
+  '';
+
   passthru = {
     updateScript = gitUpdater { rev-prefix = "v"; };
     providedSessions = [ "miracle-wm" ];

pkgs/by-name/mo/motif/package.nix

@@ -3,6 +3,7 @@
   stdenv,
   fetchurl,
   fetchpatch,
+  buildPackages,
   pkg-config,
   libtool,
   xbitmaps,
@@ -32,6 +33,7 @@ stdenv.mkDerivation rec {
   };
 
   buildInputs = [
+    flex
     libtool
     xbitmaps
     libXext
@@ -55,8 +57,34 @@ stdenv.mkDerivation rec {
     libXau
   ];
 
-  postPatch = lib.optionalString (!demoSupport) ''
+  strictDeps = true;
+
+  postPatch =
+    ''
+      # File existence fails when cross-compiling - useless for Nix anyhow
+      substituteInPlace ./configure --replace-fail \
+        'as_fn_error $? "cannot check for file existence' '#' \
+        --replace-fail 'pkg-config' '${stdenv.cc.targetPrefix}pkg-config'
+    ''
+    + lib.optionalString (!demoSupport) ''
       sed 's/\<demos\>//' -i Makefile.{am,in}
+    ''
+    # for cross builds, we must copy several build tools from a native build
+    # (and we must ensure they are not removed and recreated by make)
+    + lib.optionalString (!stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
+      cp "${buildPackages.motif}/lib/internals/makestrs" config/util/makestrs
+      substituteInPlace config/util/Makefile.in \
+        --replace-fail '@rm -f makestrs$(EXEEXT)' "" \
+        --replace-fail '$(AM_V_CCLD)$(LINK) $(makestrs_OBJECTS) $(makestrs_LDADD) $(LIBS)' ""
+
+      cp "${buildPackages.motif}"/lib/internals/{wml,wmluiltok,wmldbcreate} tools/wml/
+      substituteInPlace tools/wml/Makefile.in \
+        --replace-fail '@rm -f wmldbcreate$(EXEEXT)' "" \
+        --replace-fail '$(AM_V_CCLD)$(LINK) $(wmldbcreate_OBJECTS) $(wmldbcreate_LDADD) $(LIBS)' "" \
+        --replace-fail '@rm -f wmluiltok$(EXEEXT)' "" \
+        --replace-fail '$(AM_V_CCLD)$(LINK) $(wmluiltok_OBJECTS) $(wmluiltok_LDADD) $(LIBS)' "" \
+        --replace-fail '@rm -f wml$(EXEEXT)' "" \
+        --replace-fail '$(AM_V_CCLD)$(LINK) $(wml_OBJECTS) $(wml_LDADD) $(LIBS)' ""
     '';
 
   patches = [
@@ -90,6 +118,11 @@ stdenv.mkDerivation rec {
     })
   ];
 
+  # provide correct configure answers for cross builds
+  configureFlags = [
+    "ac_cv_func_setpgrp_void=${if stdenv.hostPlatform.isBSD then "no" else "yes"}"
+  ];
+
   env = lib.optionalAttrs stdenv.cc.isClang {
     NIX_CFLAGS_COMPILE = toString [
       "-Wno-error=implicit-function-declaration"
@@ -99,6 +132,12 @@ stdenv.mkDerivation rec {
 
   enableParallelBuilding = true;
 
+  # copy tools for cross builds
+  postInstall = lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
+    mkdir -p "$out/lib/internals"
+    cp config/util/makestrs tools/wml/{wml,wmluiltok,.libs/wmldbcreate} "$out/lib/internals"
+  '';
+
   meta = with lib; {
     homepage = "https://motif.ics.com";
     description = "Unix standard widget-toolkit and window-manager";

pkgs/by-name/n8/n8n/package.nix

@@ -17,18 +17,18 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "n8n";
-  version = "1.73.1";
+  version = "1.75.2";
 
   src = fetchFromGitHub {
     owner = "n8n-io";
     repo = "n8n";
     tag = "n8n@${finalAttrs.version}";
-    hash = "sha256-gPdJKVOZlizdS0o+2nBgCImnIhtHzRjE2xk0zJA52go=";
+    hash = "sha256-fIdwciI4QUNr2wNWiq7qT4c6aZeUnkaVhSkIgFO4Svw=";
   };
 
   pnpmDeps = pnpm_9.fetchDeps {
     inherit (finalAttrs) pname version src;
-    hash = "sha256-Am9R2rfQiw1IPd22/UraqzEqvVeB5XuSrrLSYXWsWfU=";
+    hash = "sha256-rtXTAHZUeitQFTa1Tw6l4el+xWD2hLT+2wu2LXW80cE=";
   };
 
   nativeBuildInputs =

pkgs/by-name/ne/netlify-cli/package.nix

@@ -11,16 +11,16 @@
 
 buildNpmPackage rec {
   pname = "netlify-cli";
-  version = "18.0.0";
+  version = "18.0.2";
 
   src = fetchFromGitHub {
     owner = "netlify";
     repo = "cli";
     tag = "v${version}";
-    hash = "sha256-LGnFVg7c+CMgjxkVdy/rdoo6uU5HaOwGKRDHRe5Hz3Y=";
+    hash = "sha256-GykzaVJyiAH7L9afK+PdwkqImo80ldcx420pM8V4WBg=";
   };
 
-  npmDepsHash = "sha256-ONLkCbmmY45/sRwaGUWhA187YVtCcdPVnD7ZMFoQ2Y0=";
+  npmDepsHash = "sha256-n6JUInqI4ioMTebYcJXJ1ff8MjUW/+Y3b2lS7zhuSdI=";
 
   inherit nodejs;
 

pkgs/by-name/ob/oboete/package.nix

@@ -13,17 +13,17 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "oboete";
-  version = "0.1.7";
+  version = "0.1.8";
 
   src = fetchFromGitHub {
     owner = "mariinkys";
     repo = "oboete";
     tag = version;
-    hash = "sha256-W5dd8UNjG2w0N1EngDPK7Q83C2TF9UfW0GGvPaW6nls=";
+    hash = "sha256-tQn3ihGHkR91zNtBIiyyIEEo21Q0ZSKLEaV/3UI9pwU=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-UZUqPITtpHeNrsi6Nao+dfK3ACVJmZIc47aqSbwTemw=";
+  cargoHash = "sha256-91JMgdpMXL0a7oZXAG5xgiulOIyVXQ5x09wN3XDeSy0=";
 
   nativeBuildInputs = [
     pkg-config
@@ -54,7 +54,7 @@ rustPlatform.buildRustPackage rec {
   meta = {
     description = "Simple flashcards application for the COSMIC™ desktop written in Rust";
     homepage = "https://github.com/mariinkys/oboete";
-    changelog = "https://github.com/mariinkys/oboete/releases/tag/${src.tag}";
+    changelog = "https://github.com/mariinkys/oboete/releases/tag/${version}";
     license = lib.licenses.gpl3Only;
     maintainers = with lib.maintainers; [ GaetanLepage ];
     platforms = lib.platforms.linux;

pkgs/by-name/pa/parinfer-rust/package.nix

@@ -7,16 +7,17 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "parinfer-rust";
-  version = "0.4.3";
+  version = "0.4.3-unstable-2024-05-07";
 
   src = fetchFromGitHub {
     owner = "eraserhd";
     repo = "parinfer-rust";
-    rev = "v${version}";
+    rev = "d84828b453e158d06406f6b5e9056f6b54ff76c9";
-    sha256 = "0hj5in5h7pj72m4ag80ing513fh65q8xlsf341qzm3vmxm3y3jgd";
+    sha256 = "sha256-Q2fYogfn5QcNDEie4sUaVydAmDmcFXnsvz35cxPCf+M=";
   };
 
-  cargoHash = "sha256-PW9LIQamQfusaijyJ2R9xe29LhM0GNf9BdxI9vkjVdE=";
+  useFetchCargoVendor = true;
+  cargoHash = "sha256-w/GMjNtKiMGYOfzSl5IZTeHBSp4C9Mu6+oogCqHxdb4=";
 
   nativeBuildInputs = [
     llvmPackages.clang

pkgs/by-name/po/poetry/plugins/poetry-plugin-up.nix

@@ -10,14 +10,14 @@
 
 buildPythonPackage rec {
   pname = "poetry-plugin-up";
-  version = "0.8.0";
+  version = "0.9.0";
   format = "pyproject";
 
   src = fetchFromGitHub {
     owner = "MousaZeidBaker";
     repo = pname;
-    rev = "refs/tags/v${version}";
+    tag = "v${version}";
-    hash = "sha256-PWHbMDGL9CGLRmvFWLOztUW0f/TJioPjQtAgpyCbAqw=";
+    hash = "sha256-gVhx8Vhk+yT/QjcEme8w0F+6BBpnEZOqzCkUJgM9eck=";
   };
 
   build-system = [
@@ -43,7 +43,5 @@ buildPythonPackage rec {
     changelog = "https://github.com/MousaZeidBaker/poetry-plugin-up/releases/tag/${version}";
     license = licenses.mit;
     maintainers = [ maintainers.k900 ];
-    # https://github.com/MousaZeidBaker/poetry-plugin-up/pull/70
-    broken = lib.versionAtLeast poetry.version "2";
   };
 }

pkgs/by-name/re/renovate/package.nix

@@ -16,13 +16,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "renovate";
-  version = "39.107.0";
+  version = "39.137.1";
 
   src = fetchFromGitHub {
     owner = "renovatebot";
     repo = "renovate";
     tag = finalAttrs.version;
-    hash = "sha256-I2ufRvx8NZavFMKpiwgx8q8yejRUE8r7TvpSw4q56Zo=";
+    hash = "sha256-E3J+jEd21j5r4iaa4D2mNbWcwfwyzcaHTHiD3jBVXlQ=";
   };
 
   postPatch = ''
@@ -40,7 +40,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   pnpmDeps = pnpm_9.fetchDeps {
     inherit (finalAttrs) pname version src;
-    hash = "sha256-ginPQvnhB8dQStipi2kGL+cdDwqobvENnrLRbC5WIHc=";
+    hash = "sha256-ljhRpFMafpB0xbmGVoh8Icwm0c0dr7JPqAA/6sln03w=";
   };
 
   env.COREPACK_ENABLE_STRICT = 0;

pkgs/by-name/re/resumed/package.nix

@@ -6,16 +6,16 @@
 
 buildNpmPackage rec {
   pname = "resumed";
-  version = "4.0.0";
+  version = "4.1.0";
 
   src = fetchFromGitHub {
     owner = "rbardini";
     repo = "resumed";
     rev = "v${version}";
-    hash = "sha256-XaEK41UBKUldjRlxTzc42K/RwZ9D8kueU/6dm8n1W1U=";
+    hash = "sha256-kDv6kOVY8IfztmLeby2NgB5q0DtP1ajMselvr1EDQJ8=";
   };
 
-  npmDepsHash = "sha256-r0wq1KGZA5b4eIQsp+dz8Inw8AQA62BK7vgfYlViIrY=";
+  npmDepsHash = "sha256-7Wdf8NaizgIExeX+Kc8wn5f20al0bnxRpFoPy6p40jw=";
 
   meta = with lib; {
     description = "Lightweight JSON Resume builder, no-frills alternative to resume-cli";

pkgs/by-name/se/sequin/package.nix

@@ -6,16 +6,16 @@
 
 buildGoModule rec {
   pname = "sequin";
-  version = "0.3.0";
+  version = "0.3.1";
 
   src = fetchFromGitHub {
     owner = "charmbracelet";
     repo = "sequin";
     tag = "v${version}";
-    hash = "sha256-pGZ7QmmPIpXrRcfkbEbTZzHXHtqPwU8Cju9Q2xtSqvw=";
+    hash = "sha256-rszK2UZ3Eq9g+Di1lncDQIT4TlUcWZEu1SU2aE2uFHY=";
   };
 
-  vendorHash = "sha256-LehOqSahbF3Nqm0/bJ0Q3mR0ds8FEXaLEvGLwzPdvU4=";
+  vendorHash = "sha256-mpmGd6liBzz9XPcB00ZhHaQzTid6lURD5I3EvehXsA8=";
 
   ldflags = [
     "-X main.Version=${version}"

pkgs/by-name/sh/shadow/package.nix

@@ -56,10 +56,9 @@ stdenv.mkDerivation rec {
     sed 's/^\(s[ug]idperms\) = [0-9]755/\1 = 0755/' -i src/Makefile.am
   '';
 
-  # Assume System V `setpgrp (void)', which is the default on GNU variants
+  # `AC_FUNC_SETPGRP' is not cross-compilation capable.
-  # (`AC_FUNC_SETPGRP' is not cross-compilation capable.)
   preConfigure = ''
-    export ac_cv_func_setpgrp_void=yes
+    export ac_cv_func_setpgrp_void=${if stdenv.hostPlatform.isBSD then "no" else "yes"}
     export shadow_cv_logdir=/var/log
   '';
 

pkgs/by-name/st/steam-unwrapped/force-overwrite-bootstrap.patch

@@ -0,0 +1,13 @@
+diff --git a/bin_steam.sh b/bin_steam.sh
+index 49f9d8a..48f4379 100755
+--- a/bin_steam.sh
++++ b/bin_steam.sh
+@@ -297,7 +297,7 @@ fi
+ # Leave a copy of the bootstrap tarball in ~/.steam so that Steam can
+ # re-bootstrap itself if required
+ if ! cmp -s "$LAUNCHSTEAMBOOTSTRAPFILE" "$LAUNCHSTEAMDIR/bootstrap.tar.xz"; then
+-    cp "$LAUNCHSTEAMBOOTSTRAPFILE" "$LAUNCHSTEAMDIR/bootstrap.tar.xz"
++    cp -f "$LAUNCHSTEAMBOOTSTRAPFILE" "$LAUNCHSTEAMDIR/bootstrap.tar.xz"
+ fi
+ 
+ # go to the install directory and run the client

pkgs/by-name/st/steam-unwrapped/package.nix

@@ -7,14 +7,21 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "steam-unwrapped";
-  version = "1.0.0.81";
+  version = "1.0.0.82";
 
   src = fetchurl {
     # use archive url so the tarball doesn't 404 on a new release
     url = "https://repo.steampowered.com/steam/archive/stable/steam_${finalAttrs.version}.tar.gz";
-    hash = "sha256-Gia5182s4J4E3Ia1EeC5kjJX9mSltsr+b+1eRtEXtPk=";
+    hash = "sha256-r6Lx3WJx/StkW6MLjzq0Cv02VONUJBoxy9UQAPfm/Hc=";
   };
 
+  patches = [
+    # We copy the bootstrap file from the store, where it's read-only,
+    # so future attempts to update it with bare "cp" will fail.
+    # So, use "cp -f" to force an overwrite.
+    ./force-overwrite-bootstrap.patch
+  ];
+
   makeFlags = [
     "DESTDIR=$(out)"
     "PREFIX="

pkgs/by-name/sw/swapview/package.nix

@@ -6,16 +6,17 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "swapview";
-  version = "0.1.0";
+  version = "0.1.0-unstable-2023-12-03";
 
   src = fetchFromGitHub {
     owner = "lilydjwg";
     repo = "swapview";
-    rev = "v${version}";
+    rev = "cc8e863acd2084413b91572357dab34551c27ed7";
-    sha256 = "0339biydk997j5r72vzp7djwkscsz89xr3936nshv23fmxjh2rzj";
+    sha256 = "sha256-H5jMdmtZoN9nQfjXFQyYbuvPY58jmEP2j/XWGdBocFo=";
   };
 
-  cargoHash = "sha256-v3Fd08s70YX7pEIWYcgpC2daerfZhtzth4haKfUy0Q8=";
+  useFetchCargoVendor = true;
+  cargoHash = "sha256-kLWd8dg63oA4sPMPPkRn+HsU+v+gQAiniBWI0i7JszM=";
 
   meta = with lib; {
     description = "Simple program to view processes' swap usage on Linux";

pkgs/by-name/te/tensorman/package.nix

@@ -6,16 +6,17 @@
 
 rustPlatform.buildRustPackage {
   pname = "tensorman";
-  version = "unstable-2023-03-13";
+  version = "0.1.0-unstable-2024-06-24";
 
   src = fetchFromGitHub {
     owner = "pop-os";
     repo = "tensorman";
-    rev = "b1125f71b55a8d9a4d674a62fa1e8868d40d0f0d";
+    rev = "24fa3b2bb06a29708162ee474a733e9a227b1778";
-    hash = "sha256-WMX+nzNQTGeSUxOfMHo+U0ICYx8rttXpQrQClwU2zX8=";
+    hash = "sha256-kI/dOw9JnhXmLqIgaljhRMc/SX35m7WQ9b6bQa6diZ0=";
   };
 
-  cargoHash = "sha256-y/AE2jTVetqBBExBlPEB0LwIVk+LjB2i0ZjijLPs9js=";
+  useFetchCargoVendor = true;
+  cargoHash = "sha256-/Ul8+5MmTntQ0OprfG4QhUNjc3PktCandzTTWn4FD0Y=";
 
   meta = with lib; {
     description = "Utility for easy management of Tensorflow containers";

pkgs/by-name/te/termplay/package.nix

@@ -1,47 +0,0 @@
-{
-  rustPlatform,
-  fetchFromGitLab,
-  lib,
-  makeWrapper,
-  gst_all_1,
-  libsixel,
-}:
-
-rustPlatform.buildRustPackage rec {
-  pname = "termplay";
-  version = "2.0.6";
-
-  src = fetchFromGitLab {
-    owner = "jD91mZM2";
-    repo = "termplay";
-    rev = "v${version}";
-    sha256 = "1w7hdqgqr1jgxid3k7f2j52wz31gv8bzr9rsm6xzp7nnihp6i45p";
-  };
-
-  cargoHash = "sha256-i7toHEewkpQ85aj4PK4SLJQCfUllUqkqIWLaOEk3NyI=";
-
-  nativeBuildInputs = [ makeWrapper ];
-  buildInputs = [
-    gst_all_1.gstreamer
-    gst_all_1.gst-plugins-base
-    gst_all_1.gst-plugins-good
-    gst_all_1.gst-plugins-ugly
-    gst_all_1.gst-plugins-bad
-    libsixel
-  ];
-
-  buildFeatures = [ "bin" ];
-
-  postInstall = ''
-    wrapProgram $out/bin/termplay --prefix GST_PLUGIN_SYSTEM_PATH_1_0 : "$GST_PLUGIN_SYSTEM_PATH_1_0"
-  '';
-
-  meta = with lib; {
-    description = "Play an image/video in your terminal";
-    homepage = "https://jd91mzm2.github.io/termplay/";
-    license = licenses.mit;
-    maintainers = [ ];
-    platforms = platforms.unix;
-    mainProgram = "termplay";
-  };
-}

pkgs/by-name/vo/void/package.nix

@@ -1,30 +0,0 @@
-{
-  lib,
-  fetchFromGitHub,
-  rustPlatform,
-}:
-
-rustPlatform.buildRustPackage rec {
-  pname = "void";
-  version = "1.1.5";
-
-  src = fetchFromGitHub {
-    owner = "spacejam";
-    repo = "void";
-    rev = version;
-    sha256 = "08vazw4rszqscjz988k89z28skyj3grm81bm5iwknxxagmrb20fz";
-  };
-
-  # The tests are long-running and not that useful
-  doCheck = false;
-
-  cargoHash = "sha256-4LLm8EIGR9YJyVlSLRsQmBJc0QZaxBQafE4VLsDyAfI=";
-
-  meta = with lib; {
-    description = "Terminal-based personal organizer";
-    homepage = "https://github.com/spacejam/void";
-    license = licenses.gpl3;
-    maintainers = with maintainers; [ spacekookie ];
-    mainProgram = "void";
-  };
-}

pkgs/by-name/vp/vpnc/package.nix

@@ -14,13 +14,13 @@
 
 stdenv.mkDerivation {
   pname = "vpnc";
-  version = "unstable-2021-11-04";
+  version = "unstable-2024-12-20";
 
   src = fetchFromGitHub {
     owner = "streambinder";
     repo = "vpnc";
-    rev = "c8bb5371b881f8853f191c495e762f834c9def5d";
+    rev = "d58afaaafb6a43cb21bb08282b54480d7b2cc6ab";
-    sha256 = "1j1p83nfc2fpwczjcggsby0b44hk97ky0s6vns6md3awlbpgdn57";
+    sha256 = "sha256-79DaK1s+YmROKbcWIXte+GZh0qq9LAQlSmczooR86H8=";
     fetchSubmodules = true;
   };
 

pkgs/by-name/w3/w3m/package.nix

@@ -103,7 +103,7 @@ stdenv.mkDerivation rec {
       "--with-gc=${boehmgc.dev}"
     ]
     ++ lib.optionals (stdenv.buildPlatform != stdenv.hostPlatform) [
-      "ac_cv_func_setpgrp_void=yes"
+      "ac_cv_func_setpgrp_void=${if stdenv.hostPlatform.isBSD then "no" else "yes"}"
     ]
     ++ lib.optional graphicsSupport "--enable-image=${lib.optionalString x11Support "x11,"}fb"
     ++ lib.optional (graphicsSupport && !x11Support) "--without-x";

pkgs/by-name/we/webmetro/package.nix

@@ -1,34 +0,0 @@
-{
-  lib,
-  fetchFromGitHub,
-  rustPlatform,
-}:
-
-rustPlatform.buildRustPackage rec {
-  pname = "webmetro";
-  version = "unstable-20180426";
-
-  src = fetchFromGitHub {
-    owner = "Tangent128";
-    repo = pname;
-    rev = "4f6cc00fe647bd311d00a8a4cb53ab08f20a04f9";
-    sha256 = "1n2c7ygs8qsd5zgii6fqqcwg427bsij082bg4ijnzkq5630dx651";
-  };
-
-  cargoHash = "sha256-6LfJ5rI7Y+ziEIMxPpKxOS+VSrKuKohEcqIK7xdKhNg=";
-
-  meta = with lib; {
-    description = "Simple relay server for broadcasting a WebM stream";
-    longDescription = ''
-      Webmetro is a simple relay server for broadcasting a WebM stream
-      from one uploader to many downloaders, via HTTP.
-      The initialization segment is remembered, so that viewers can join
-      mid-stream.  Cluster timestamps are rewritten to be monotonic, so multiple
-      (compatibly-encoded) webm files can be chained together without
-      clients needing to reconnect.
-    '';
-    license = with licenses; [ mit ];
-    maintainers = with maintainers; [ leenaars ];
-    mainProgram = "webmetro";
-  };
-}

pkgs/by-name/we/wezterm/package.nix

@@ -29,14 +29,14 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "wezterm";
-  version = "0-unstable-2025-01-03";
+  version = "0-unstable-2025-01-24";
 
   src = fetchFromGitHub {
     owner = "wez";
     repo = "wezterm";
-    rev = "8e9cf912e66f704f300fac6107206a75036de1e7";
+    rev = "4bf0007cefff7f1ad139d89b54f074d5ad7d2184";
     fetchSubmodules = true;
-    hash = "sha256-JkAovAeoVrH2QlHzzcciraebfsSQPBQPsA3fUKEjRm8=";
+    hash = "sha256-YN1C+cgF2T/dUljCZO5RMdbJsun+7lgqLN7BW+IMZsg=";
   };
 
   postPatch = ''

pkgs/development/compilers/llvm/20/llvm/gnu-install-dirs-polly.patch

@@ -0,0 +1,13 @@
+--- a/tools/polly/cmake/polly_macros.cmake	2024-03-15 17:36:20.550893344 -0700
++++ b/tools/polly/cmake/polly_macros.cmake	2024-03-15 17:37:06.277332960 -0700
+@@ -45,8 +45,8 @@
+     install(TARGETS ${name}
+       COMPONENT ${name}
+       ${exports}
+-      LIBRARY DESTINATION lib${LLVM_LIBDIR_SUFFIX}
+-      ARCHIVE DESTINATION lib${LLVM_LIBDIR_SUFFIX})
++      LIBRARY DESTINATION ${CMAKE_INSTALL_LIBDIR}${LLVM_LIBDIR_SUFFIX}
++      ARCHIVE DESTINATION ${CMAKE_INSTALL_LIBDIR}${LLVM_LIBDIR_SUFFIX})
+     add_llvm_install_targets(install-${name}
+       COMPONENT ${name})
+   endif()

pkgs/development/compilers/llvm/common/default.nix

@@ -130,6 +130,11 @@ let
               ];
               "llvm/gnu-install-dirs-polly.patch" = [
                 {
+                  after = "20";
+                  path = ../20;
+                }
+                {
+                  before = "20";
                   after = "18";
                   path = ../18;
                 }
@@ -519,7 +524,8 @@ let
             (metadata.getVersionFile "clang/purity.patch")
             # https://reviews.llvm.org/D51899
             (metadata.getVersionFile "clang/gnu-install-dirs.patch")
-
+          ]
+          ++ lib.optionals (lib.versionOlder metadata.release_version "20") [
             # https://github.com/llvm/llvm-project/pull/116476
             # prevent clang ignoring warnings / errors for unsuppored
             # options when building & linking a source file with trailing
@@ -1063,7 +1069,7 @@ let
         ++ lib.optionals (lib.versionAtLeast metadata.release_version "13") [
           (metadata.getVersionFile "compiler-rt/armv6-scudo-libatomic.patch")
         ]
-        ++ lib.optional (lib.versionAtLeast metadata.release_version "19") (fetchpatch {
+        ++ lib.optional (lib.versions.major metadata.release_version == "19") (fetchpatch {
           url = "https://github.com/llvm/llvm-project/pull/99837/commits/14ae0a660a38e1feb151928a14f35ff0f4487351.patch";
           hash = "sha256-JykABCaNNhYhZQxCvKiBn54DZ5ZguksgCHnpdwWF2no=";
           relative = "compiler-rt";

pkgs/development/compilers/llvm/default.nix

@@ -31,9 +31,9 @@ let
     "18.1.8".officialRelease.sha256 = "sha256-iiZKMRo/WxJaBXct9GdAcAT3cz9d9pnAcO1mmR6oPNE=";
     "19.1.7".officialRelease.sha256 = "sha256-cZAB5vZjeTsXt9QHbP5xluWNQnAHByHtHnAhVDV0E6I=";
     "20.0.0-git".gitRelease = {
-      rev = "1ef5b987a464611a60e873650726b5e02fda0feb";
+      rev = "6383a12e3b4339fa4743bb97da4d51dea6d2e2ea";
-      rev-version = "20.0.0-unstable-2024-12-17";
+      rev-version = "20.0.0-unstable-2025-01-25";
-      sha256 = "sha256-QCY9z9h3z5gPvwq6bNzAB5xFFStwOCfKh4VnWInhxU4=";
+      sha256 = "sha256-LMew+lFm+HrR5iwFDnoXA6B2LiU/pVqsy1YrP9xr5GU=";
     };
   } // llvmVersions;
 

pkgs/development/interpreters/clisp/default.nix

@@ -7,7 +7,7 @@
   lib,
   stdenv,
   fetchFromGitLab,
-  autoconf269,
+  autoconf,
   automake,
   bash,
   libtool,
@@ -56,24 +56,22 @@ assert
 
 let
   ffcallAvailable = stdenv.hostPlatform.isLinux && (libffcall != null);
-  # Some modules need autoreconf called in their directory.
-  shouldReconfModule = name: name != "asdf";
 in
 
 stdenv.mkDerivation {
-  version = "2.50pre20230112";
+  version = "2.49.95-unstable-2024-12-28";
   pname = "clisp";
 
   src = fetchFromGitLab {
     owner = "gnu-clisp";
     repo = "clisp";
-    rev = "bf72805c4dace982a6d3399ff4e7f7d5e77ab99a";
+    rev = "c3ec11bab87cfdbeba01523ed88ac2a16b22304d";
-    hash = "sha256-sQoN2FUg9BPaCgvCF91lFsU/zLja1NrgWsEIr2cPiqo=";
+    hash = "sha256-xXGx2FlS0l9huVMHqNbcAViLjxK8szOFPT0J8MpGp9w=";
   };
 
   strictDeps = true;
   nativeBuildInputs = [
-    autoconf269
+    autoconf
     automake
     libtool
   ];
@@ -98,10 +96,6 @@ stdenv.mkDerivation {
       libXext
     ];
 
-  patches = [
-    ./gnulib_aarch64.patch
-  ];
-
   # First, replace port 9090 (rather low, can be used)
   # with 64237 (much higher, IANA private area, not
   # anything rememberable).
@@ -112,22 +106,6 @@ stdenv.mkDerivation {
     find . -type f | xargs sed -e 's/-lICE/-lXau &/' -i
   '';
 
-  preConfigure = lib.optionalString stdenv.hostPlatform.isDarwin (
-    ''
-      (
-        cd src
-        autoreconf -f -i -I m4 -I glm4
-      )
-    ''
-    + lib.concatMapStrings (x: ''
-      (
-        root="$PWD"
-        cd modules/${x}
-        autoreconf -f -i -I "$root/src" -I "$root/src/m4" -I "$root/src/glm4"
-      )
-    '') (builtins.filter shouldReconfModule withModules)
-  );
-
   configureFlags =
     [ "builddir" ]
     ++ lib.optional (!dllSupport) "--without-dynamic-modules"

pkgs/development/interpreters/clisp/gnulib_aarch64.patch

@@ -1,13 +0,0 @@
-diff --git a/src/gllib/vma-iter.c b/src/gllib/vma-iter.c
-index 6045f21d7..d50a3a398 100644
---- a/src/gllib/vma-iter.c
-+++ b/src/gllib/vma-iter.c
-@@ -1327,7 +1327,7 @@ vma_iterate (vma_iterate_callback_fn callback, void *data)
-          In 64-bit processes, we could use vm_region_64 or mach_vm_region.
-          I choose vm_region_64 because it uses the same types as vm_region,
-          resulting in less conditional code.  */
--# if defined __ppc64__ || defined __x86_64__
-+# if defined __aarch64__ || defined __ppc64__ || defined __x86_64__
-       struct vm_region_basic_info_64 info;
-       mach_msg_type_number_t info_count = VM_REGION_BASIC_INFO_COUNT_64;
- 

pkgs/development/interpreters/rakudo/default.nix

@@ -12,14 +12,14 @@
 
 stdenv.mkDerivation rec {
   pname = "rakudo";
-  version = "2024.12";
+  version = "2025.01";
 
   # nixpkgs-update: no auto update
   src = fetchFromGitHub {
     owner = "rakudo";
     repo = "rakudo";
     rev = version;
-    hash = "sha256-R4D+Hh3M1373MQBLX2TY8nq+so4S6DP5RM5XR+Zr95Y=";
+    hash = "sha256-NrbeB6/VnxlUt6glIvetK1o9huWaeVD6WLdpi4bb2FU=";
     fetchSubmodules = true;
   };
 

pkgs/development/interpreters/rakudo/moarvm.nix

@@ -9,14 +9,14 @@
 
 stdenv.mkDerivation rec {
   pname = "moarvm";
-  version = "2024.12";
+  version = "2025.01";
 
   # nixpkgs-update: no auto update
   src = fetchFromGitHub {
     owner = "moarvm";
     repo = "moarvm";
     rev = version;
-    hash = "sha256-CP8zYs4y2pT2keIxqE7yFy+N9aR3fidkwRXAe5blWAo=";
+    hash = "sha256-Xvkn1edzOeXBiBn2QSwk0eKfSG1JvfSkVrCAmyYtlmI=";
     fetchSubmodules = true;
   };
 

pkgs/development/interpreters/rakudo/nqp.nix

@@ -8,14 +8,14 @@
 
 stdenv.mkDerivation rec {
   pname = "nqp";
-  version = "2024.12";
+  version = "2025.01";
 
   # nixpkgs-update: no auto update
   src = fetchFromGitHub {
     owner = "raku";
     repo = "nqp";
     rev = version;
-    hash = "sha256-TjN7uH5cJzZ49KbxOYDCj2tYk6ORZWZn7ruTIn4Hgzc=";
+    hash = "sha256-45L3fEL8jIk9bkKpuhrsLM014zNW1P7Kf6qVXxJjWws=";
     fetchSubmodules = true;
   };
 

pkgs/development/libraries/apr/default.nix

@@ -38,8 +38,9 @@ stdenv.mkDerivation rec {
     lib.optionals (stdenv.hostPlatform != stdenv.buildPlatform) [
       # For cross builds, provide answers to the configure time tests.
       # These answers are valid on x86_64-linux and aarch64-linux.
+      # TODO: provide all valid answers for BSD.
       "ac_cv_file__dev_zero=yes"
-      "ac_cv_func_setpgrp_void=yes"
+      "ac_cv_func_setpgrp_void=${if stdenv.hostPlatform.isBSD then "no" else "yes"}"
       "apr_cv_tcp_nodelay_with_cork=yes"
       "ac_cv_define_PTHREAD_PROCESS_SHARED=yes"
       "apr_cv_process_shared_works=yes"

pkgs/development/ocaml-modules/ocsigen-server/conduit.patch

@@ -0,0 +1,14 @@
+diff --git a/src/server/ocsigen_cohttp.ml b/src/server/ocsigen_cohttp.ml
+index 66895339..edbfcbf2 100644
+--- a/src/server/ocsigen_cohttp.ml
++++ b/src/server/ocsigen_cohttp.ml
+@@ -105,7 +105,8 @@ let handler ~ssl ~address ~port ~connector (flow, conn) request body =
+   let rec getsockname = function
+     | `TCP (ip, port) -> Unix.ADDR_INET (Ipaddr_unix.to_inet_addr ip, port)
+     | `Unix_domain_socket path -> Unix.ADDR_UNIX path
+-    | `TLS (_, edn) -> getsockname edn
++    | `TLS (_, edn) -> getsockname (edn :> Conduit_lwt_unix.endp)
++    | `TLS_tunnel _ -> raise (Failure "TLS tunnel not supported")
+     | `Unknown err -> raise (Failure ("resolution failed: " ^ err))
+     | `Vchan_direct _ -> raise (Failure "VChan not supported")
+     | `Vchan_domain_socket _ -> raise (Failure "VChan not supported")

pkgs/development/ocaml-modules/ocsigen-server/default.nix

@@ -64,6 +64,8 @@ buildDunePackage rec {
     hash = "sha256-T3bgPZpDO6plgebLJDBtBuR2eR/bN3o24UAUv1VwgtI=";
   };
 
+  patches = [ ./conduit.patch ];
+
   nativeBuildInputs = [
     makeWrapper
     which

pkgs/tools/backup/bacula/default.nix

@@ -56,7 +56,9 @@ stdenv.mkDerivation rec {
       "--with-working-dir=/var/lib/bacula"
       "--mandir=\${out}/share/man"
     ]
-    ++ lib.optional (stdenv.buildPlatform != stdenv.hostPlatform) "ac_cv_func_setpgrp_void=yes"
+    ++
+      lib.optional (stdenv.buildPlatform != stdenv.hostPlatform)
+        "ac_cv_func_setpgrp_void=${if stdenv.hostPlatform.isBSD then "no" else "yes"}"
     ++ lib.optionals stdenv.hostPlatform.isDarwin [
       # bacula’s `configure` script fails to detect CoreFoundation correctly,
       # but these symbols are available in the nixpkgs CoreFoundation framework.

pkgs/tools/misc/sshx/default.nix

@@ -29,6 +29,8 @@ let
           cargoHash
           ;
 
+        useFetchCargoVendor = true;
+
         nativeBuildInputs = [ protobuf ];
 
         buildInputs = lib.optional stdenv.hostPlatform.isDarwin darwin.apple_sdk.frameworks.Security;
@@ -58,12 +60,12 @@ in
 {
   sshx = mkSshxPackage {
     pname = "sshx";
-    cargoHash = "sha256-PMSKhlHSjXKh/Jxvl2z+c1zDDyuVPzQapvdCdcuaFYc=";
+    cargoHash = "sha256-wXElkSaVWoUNhm2UOv8Q+UabgrVKqxwDUsk/JJaZzMw=";
   };
 
   sshx-server = mkSshxPackage rec {
     pname = "sshx-server";
-    cargoHash = "sha256-ySsTjNoI/nuz2qtZ4M2Fd9zy239+E61hUCq1r/ahgsA=";
+    cargoHash = "sha256-wXElkSaVWoUNhm2UOv8Q+UabgrVKqxwDUsk/JJaZzMw=";
 
     postPatch = ''
       substituteInPlace crates/sshx-server/src/web.rs \

pkgs/tools/text/mdbook-linkcheck/default.nix

@@ -21,7 +21,11 @@ rustPlatform.buildRustPackage rec {
     sha256 = "sha256-ZbraChBHuKAcUA62EVHZ1RygIotNEEGv24nhSPAEj00=";
   };
 
-  cargoHash = "sha256-AwixlCL5ZcLgj9wYeBvkSy2U6J8alXf488l8DMn73w4=";
+  cargoDeps = rustPlatform.fetchCargoVendor {
+    inherit pname version src;
+    allowGitDependencies = false;
+    hash = "sha256-Tt7ljjWv2CMtP/ELZNgSH/ifmBk/42+E0r9ZXQEJNP8=";
+  };
 
   buildInputs = if stdenv.hostPlatform.isDarwin then [ Security ] else [ openssl ];
 

pkgs/top-level/aliases.nix

@@ -132,6 +132,7 @@ mapAliases {
   auditBlasHook = throw "'auditBlasHook' has been removed since it never worked"; # Added 2024-04-02
   aumix = throw "'aumix' has been removed due to lack of maintenance upstream. Consider using 'pamixer' for CLI or 'pavucontrol' for GUI"; # Added 2024-09-14
   authy = throw "'authy' has been removed since it reached end of life"; # Added 2024-04-19
+  autoadb = throw "'autoadb' has been removed due to lack of maintenance upstream"; # Added 2025-01-25
   avldrums-lv2 = throw "'avldrums-lv2' has been renamed to/replaced by 'x42-avldrums'"; # Converted to throw 2024-10-17
   avrlibcCross = avrlibc; # Added 2024-09-06
   awesome-4-0 = awesome; # Added 2022-05-05
@@ -1375,6 +1376,7 @@ mapAliases {
   temurin-jre-bin-22 = throw "Temurin 22 has been removed as it has reached its end of life"; # Added 2024-09-24
   temurin-bin-22 = throw "Temurin 22 has been removed as it has reached its end of life"; # Added 2024-09-24
   tepl = libgedit-tepl; # Added 2024-04-29
+  termplay = throw "'termplay' has been removed due to lack of maintenance upstream"; # Added 2025-01-25
   testVersion = testers.testVersion; # Added 2022-04-20
   tfplugindocs = terraform-plugin-docs; # Added 2023-11-01
   invalidateFetcherByDrvHash = testers.invalidateFetcherByDrvHash; # Added 2022-05-05
@@ -1470,6 +1472,7 @@ mapAliases {
   virtscreen = throw "'virtscreen' has been removed, as it was broken and unmaintained"; # Added 2024-10-17
   vkBasalt = vkbasalt; # Added 2022-11-22
   vkdt-wayland = vkdt; # Added 2024-04-19
+  void = throw "'void' has been removed due to lack of upstream maintenance"; # Added 2025-01-25
   volnoti = throw "'volnoti' has been removed due to lack of maintenance upstream."; # Added 2024-12-04
   vuze = throw "'vuze' was removed because it is unmaintained upstream and insecure (CVE-2018-13417). BiglyBT is a maintained fork."; # Added 2024-11-22
   inherit (libsForQt5.mauiPackages) vvave; # added 2022-05-17
@@ -1486,6 +1489,7 @@ mapAliases {
   ''; # Add 2023-07-29
   waypoint = throw "waypoint has been removed from nixpkgs as the upstream project was archived"; # Added 2024-04-24
   webkitgtk = lib.warnOnInstantiate "Explicitly set the ABI version of 'webkitgtk'" webkitgtk_4_0;
+  webmetro = throw "'webmetro' has been removed due to lack of upstream maintenance"; # Added 2025-01-25
   wg-bond = throw "'wg-bond' has been removed due to lack of upstream maintenance"; # Added 2025-01-25
   wineWayland = wine-wayland;
   win-virtio = virtio-win; # Added 2023-10-17