Merge staging-next into staging

2025-01-22 00:14:52 +00:00 · 2025-01-22 00:14:52 +00:00 · 9fb7ecfb57
commit 9fb7ecfb57
parent 78f2f7972b fbd8e721cf
95 changed files with 999 additions and 543 deletions
--- a/.git-blame-ignore-revs
+++ b/.git-blame-ignore-revs
@ -1,5 +1,11 @@
 # This file contains a list of commits that are not likely what you
 # are looking for in a blame, such as mass reformatting or renaming.
+#
+# If a commit's line ends with `# !autorebase <command>`,
+# where <command> is an idempotent bash command that reapplies the changes from the commit,
+# the `maintainers/scripts/auto-rebase/run.sh` script can be used to rebase
+# across that commit while automatically resolving merge conflicts caused by the commit.
+#
 # You can set this file as a default ignore file for blame by running
 # the following command.
 #
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@ -2792,6 +2792,12 @@
    githubId = 29384538;
    keys = [ { fingerprint = "D35E C9CE E631 638F F1D8  B401 6F0E 410D C3EE D02"; } ];
  };
+  bengsparks = {
+    email = "benjamin.sparks@protonmail.com";
+    github = "bengsparks";
+    githubId = 4313548;
+    name = "Ben Sparks";
+  };
  benhiemer = {
    name = "Benedikt Hiemer";
    email = "ben.email@posteo.de";
@ -5821,6 +5827,8 @@
  };
  DimitarNestorov = {
    name = "Dimitar Nestorov";
+    email = "nix@dimitarnestorov.com";
+    matrix = "@dimitarnestorov:matrix.org";
    github = "DimitarNestorov";
    githubId = 8790386;
  };
--- a/maintainers/scripts/auto-rebase/README.md
+++ b/maintainers/scripts/auto-rebase/README.md
@ -0,0 +1,16 @@
+# Auto rebase script
+
+The [`./run.sh` script](./run.sh) in this directory rebases the current branch onto a target branch,
+while automatically resolving merge conflicts caused by marked commits in [`.git-blame-ignore-revs`](../../../.git-blame-ignore-revs).
+See the header comment of that file to understand how to mark commits.
+
+This is convenient for resolving merge conflicts for pull requests after e.g. treewide reformats.
+
+## Testing
+
+To run the tests in the [test directory](./test):
+```
+$ cd test
+$ nix-shell
+nix-shell> ./run.sh
+```
--- a/maintainers/scripts/auto-rebase/run.sh
+++ b/maintainers/scripts/auto-rebase/run.sh
@ -0,0 +1,61 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+if (( $# < 1 )); then
+    echo "Usage: $0 TARGET_BRANCH"
+    echo ""
+    echo "TARGET_BRANCH: Branch to rebase the current branch onto, e.g. master or release-24.11"
+    exit 1
+fi
+
+targetBranch=$1
+
+# Loop through all autorebase-able commits in .git-blame-ignore-revs on the base branch
+readarray -t autoLines < <(
+  git show "$targetBranch":.git-blame-ignore-revs \
+      | sed -n 's/^\([0-9a-f]\+\).*!autorebase \(.*\)$/\1 \2/p'
+)
+for line in "${autoLines[@]}"; do
+    read -r autoCommit autoCmd <<< "$line"
+
+    if ! git cat-file -e "$autoCommit"; then
+        echo "Not a valid commit: $autoCommit"
+        exit 1
+    elif git merge-base --is-ancestor "$autoCommit" HEAD; then
+        # Skip commits that we have already
+        continue
+    fi
+
+    echo -e "\e[32mAuto-rebasing commit $autoCommit with command '$autoCmd'\e[0m"
+
+    # The commit before the commit
+    parent=$(git rev-parse "$autoCommit"~)
+
+    echo "Rebasing on top of the previous commit, might need to manually resolve conflicts"
+    if ! git rebase --onto "$parent" "$(git merge-base "$targetBranch" HEAD)"; then
+      echo -e "\e[33m\e[1mRestart this script after resolving the merge conflict as described above\e[0m"
+      exit 1
+    fi
+
+    echo "Reapplying the commit on each commit of our branch"
+    # This does two things:
+    # - The parent filter inserts the auto commit between its parent and
+    #   and our first commit. By itself, this causes our first commit to
+    #   effectively "undo" the auto commit, since the tree of our first
+    #   commit is unchanged. This is why the following is also necessary:
+    # - The tree filter runs the command on each of our own commits,
+    #   effectively reapplying it.
+    FILTER_BRANCH_SQUELCH_WARNING=1 git filter-branch \
+        --parent-filter "sed 's/$parent/$autoCommit/'" \
+        --tree-filter "$autoCmd" \
+        "$autoCommit"..HEAD
+
+    # A tempting alternative is something along the lines of
+    #   git rebase --strategy-option=theirs --onto "$rev" "$parent" \
+    #     --exec '$autoCmd && git commit --all --amend --no-edit' \
+    # but this causes problems because merges are not guaranteed to maintain the formatting.
+    # The ./test.sh exercises such a case.
+done
+
+echo "Rebasing on top of the latest target branch commit"
+git rebase --onto "$targetBranch" "$(git merge-base "$targetBranch" HEAD)"
--- a/maintainers/scripts/auto-rebase/test/default.nix
+++ b/maintainers/scripts/auto-rebase/test/default.nix
@ -0,0 +1,46 @@
+let
+  pkgs = import ../../../.. {
+    config = { };
+    overlays = [ ];
+  };
+
+  inherit (pkgs)
+    lib
+    stdenvNoCC
+    gitMinimal
+    treefmt
+    nixfmt-rfc-style
+    ;
+in
+
+stdenvNoCC.mkDerivation {
+  name = "test";
+  src = lib.fileset.toSource {
+    root = ./..;
+    fileset = lib.fileset.unions [
+      ../run.sh
+      ./run.sh
+      ./first.diff
+      ./second.diff
+    ];
+  };
+  nativeBuildInputs = [
+    gitMinimal
+    treefmt
+    nixfmt-rfc-style
+  ];
+  patchPhase = ''
+    patchShebangs .
+  '';
+
+  buildPhase = ''
+    export HOME=$(mktemp -d)
+    export PAGER=true
+    git config --global user.email "Your Name"
+    git config --global user.name "your.name@example.com"
+    ./test/run.sh
+  '';
+  installPhase = ''
+    touch $out
+  '';
+}
--- a/maintainers/scripts/auto-rebase/test/first.diff
+++ b/maintainers/scripts/auto-rebase/test/first.diff
@ -0,0 +1,11 @@
+diff --git a/b.nix b/b.nix
+index 9d18f25..67b0466 100644
+--- a/b.nix
+++ b/b.nix
+@@ -1,5 +1,5 @@
+ {
+   this = "is";
+ 
+-  some = "set";
+  some = "value";
+ }
--- a/maintainers/scripts/auto-rebase/test/run.sh
+++ b/maintainers/scripts/auto-rebase/test/run.sh
@ -0,0 +1,112 @@
+#!/usr/bin/env bash
+
+set -euo pipefail
+
+# https://stackoverflow.com/a/246128/6605742
+SCRIPT_DIR=$( cd -- "$( dirname -- "${BASH_SOURCE[0]}" )" &> /dev/null && pwd )
+
+# Allows using a local directory for temporary files,
+# which can then be inspected after the run
+if (( $# > 0 )); then
+    tmp=$(realpath "$1/tmp")
+    if [[ -e "$tmp" ]]; then
+        rm -rf "$tmp"
+    fi
+    mkdir -p "$tmp"
+else
+    tmp=$(mktemp -d)
+    trap 'rm -rf "$tmp"' exit
+fi
+
+# Tests a scenario where two poorly formatted files were modified on both the
+# main branch and the feature branch, while the main branch also did a treewide
+# format.
+
+git init "$tmp/repo"
+cd "$tmp/repo" || exit
+git branch -m main
+
+# Some initial poorly-formatted files
+cat > a.nix <<EOF
+{ x
+, y
+
+, z
+}:
+null
+EOF
+
+cat > b.nix <<EOF
+{
+  this = "is";
+
+
+  some="set" ;
+ }
+EOF
+
+git add -A
+git commit -m "init"
+
+git switch -c feature
+
+# Some changes
+sed 's/set/value/' -i b.nix
+git commit -a -m "change b"
+sed '/, y/d' -i a.nix
+git commit -a -m "change a"
+
+git switch main
+
+# A change to cause a merge conflict
+sed 's/y/why/' -i a.nix
+git commit -a -m "change a"
+
+cat > treefmt.toml <<EOF
+[formatter.nix]
+command = "nixfmt"
+includes = [ "*.nix" ]
+EOF
+git add -A
+git commit -a -m "introduce treefmt"
+
+# Treewide reformat
+treefmt
+git commit -a -m "format"
+
+echo "$(git rev-parse HEAD) # !autorebase treefmt" > .git-blame-ignore-revs
+git add -A
+git commit -a -m "update ignored revs"
+
+git switch feature
+
+# Setup complete
+
+git log --graph --oneline feature main
+
+# This expectedly fails with a merge conflict that has to be manually resolved
+"$SCRIPT_DIR"/../run.sh main && exit 1
+sed '/<<</,/>>>/d' -i a.nix
+git add a.nix
+GIT_EDITOR=true git rebase --continue
+
+"$SCRIPT_DIR"/../run.sh main
+
+git log --graph --oneline feature main
+
+checkDiff() {
+    local ref=$1
+    local file=$2
+    expectedDiff=$(cat "$file")
+    actualDiff=$(git diff "$ref"~ "$ref")
+    if [[ "$expectedDiff" != "$actualDiff" ]]; then
+        echo -e "Expected this diff:\n$expectedDiff"
+        echo -e "But got this diff:\n$actualDiff"
+        exit 1
+    fi
+}
+
+checkDiff HEAD~ "$SCRIPT_DIR"/first.diff
+checkDiff HEAD "$SCRIPT_DIR"/second.diff
+
+echo "Success!"
--- a/maintainers/scripts/auto-rebase/test/second.diff
+++ b/maintainers/scripts/auto-rebase/test/second.diff
@ -0,0 +1,11 @@
+diff --git a/a.nix b/a.nix
+index 18ba7ce..bcf38bc 100644
+--- a/a.nix
+++ b/a.nix
+@@ -1,6 +1,5 @@
+ {
+   x,
+-  why,
+ 
+   z,
+ }:
--- a/nixos/doc/manual/release-notes/rl-2505.section.md
+++ b/nixos/doc/manual/release-notes/rl-2505.section.md
@ -303,6 +303,8 @@

 - `matomo` now defaults to version 5 (previously available as `matomo_5`). Version 4 has been removed as it reached EOL on December 19, 2024.

+- `matomo-beta` has been removed as the version of the `matomo` package can now be easily overriden through `overrideAttrs` (see [PR #374022](https://github.com/NixOS/nixpkgs/pull/374022))
+
 - `docker_24` has been removed, as it was EOL with vulnerabilites since June 08, 2024.

 - `containerd` has been updated to v2, which contains breaking changes. See the [containerd
--- a/nixos/modules/services/web-servers/varnish/default.nix
+++ b/nixos/modules/services/web-servers/varnish/default.nix
@ -5,65 +5,80 @@
  ...
 }:

-with lib;
-
 let
  cfg = config.services.varnish;

+  # Varnish has very strong opinions and very complicated code around handling
+  # the stateDir. After a lot of back and forth, we decided that we a)
+  # do not want a configurable option here, as most of the handling depends
+  # on the version and the compile time options. Putting everything into
+  # /var/run (RAM backed) is absolutely recommended by Varnish anyways.
+  # We do need to pay attention to the version-dependend variations, though!
+  stateDir =
+    if
+      (lib.versionOlder cfg.package.version "7")
+    # Remove after Varnish 6.0 is gone. In 6.0 varnishadm always appends the
+    # hostname (by default) and can't be nudged to not use any name. This has
+    # long changed by 7.5 and can be used without the host name.
+    then
+      "/var/run/varnish/${config.networking.hostName}"
+    # Newer varnish uses this:
+    else
+      "/var/run/varnishd";
+
  commandLine =
    "-f ${pkgs.writeText "default.vcl" cfg.config}"
    +
-      optionalString (cfg.extraModules != [ ])
+      lib.optionalString (cfg.extraModules != [ ])
        " -p vmod_path='${
-           makeSearchPathOutput "lib" "lib/varnish/vmods" ([ cfg.package ] ++ cfg.extraModules)
+           lib.makeSearchPathOutput "lib" "lib/varnish/vmods" ([ cfg.package ] ++ cfg.extraModules)
         }' -r vmod_path";
 in
 {
+  imports = [
+    (lib.mkRemovedOptionModule [
+      "services"
+      "varnish"
+      "stateDir"
+    ] "The `stateDir` option never was functional or useful. varnish uses compile-time settings.")
+  ];
+
  options = {
    services.varnish = {
-      enable = mkEnableOption "Varnish Server";
+      enable = lib.mkEnableOption "Varnish Server";

-      enableConfigCheck = mkEnableOption "checking the config during build time" // {
+      enableConfigCheck = lib.mkEnableOption "checking the config during build time" // {
        default = true;
      };

-      package = mkPackageOption pkgs "varnish" { };
+      package = lib.mkPackageOption pkgs "varnish" { };

-      http_address = mkOption {
-        type = types.str;
+      http_address = lib.mkOption {
+        type = lib.types.str;
        default = "*:6081";
        description = ''
          HTTP listen address and port.
        '';
      };

-      config = mkOption {
-        type = types.lines;
+      config = lib.mkOption {
+        type = lib.types.lines;
        description = ''
          Verbatim default.vcl configuration.
        '';
      };

-      stateDir = mkOption {
-        type = types.path;
-        default = "/run/varnish/${config.networking.hostName}";
-        defaultText = literalExpression ''"/run/varnish/''${config.networking.hostName}"'';
-        description = ''
-          Directory holding all state for Varnish to run. Note that this should be a tmpfs in order to avoid performance issues and crashes.
-        '';
-      };
-
-      extraModules = mkOption {
-        type = types.listOf types.package;
+      extraModules = lib.mkOption {
+        type = lib.types.listOf lib.types.package;
        default = [ ];
-        example = literalExpression "[ pkgs.varnishPackages.geoip ]";
+        example = lib.literalExpression "[ pkgs.varnishPackages.geoip ]";
        description = ''
          Varnish modules (except 'std').
        '';
      };

-      extraCommandLine = mkOption {
-        type = types.str;
+      extraCommandLine = lib.mkOption {
+        type = lib.types.str;
        default = "";
        example = "-s malloc,256M";
        description = ''
@ -74,30 +89,20 @@ in

  };

-  config = mkIf cfg.enable {
-
+  config = lib.mkIf cfg.enable {
    systemd.services.varnish = {
      description = "Varnish";
      wantedBy = [ "multi-user.target" ];
      after = [ "network.target" ];
-      preStart = mkIf (!(lib.hasPrefix "/run/" cfg.stateDir)) ''
-        mkdir -p ${cfg.stateDir}
-        chown -R varnish:varnish ${cfg.stateDir}
-      '';
-      postStop = mkIf (!(lib.hasPrefix "/run/" cfg.stateDir)) ''
-        rm -rf ${cfg.stateDir}
-      '';
      serviceConfig = {
        Type = "simple";
        PermissionsStartOnly = true;
-        ExecStart = "${cfg.package}/sbin/varnishd -a ${cfg.http_address} -n ${cfg.stateDir} -F ${cfg.extraCommandLine} ${commandLine}";
+        ExecStart = "${cfg.package}/sbin/varnishd -a ${cfg.http_address} -n ${stateDir} -F ${cfg.extraCommandLine} ${commandLine}";
        Restart = "always";
        RestartSec = "5s";
        User = "varnish";
        Group = "varnish";
-        RuntimeDirectory = mkIf (lib.hasPrefix "/run/" cfg.stateDir) (
-          lib.removePrefix "/run/" cfg.stateDir
-        );
+        RuntimeDirectory = lib.removePrefix "/var/run/" stateDir;
        AmbientCapabilities = "cap_net_bind_service";
        NoNewPrivileges = true;
        LimitNOFILE = 131072;
@ -107,7 +112,7 @@ in
    environment.systemPackages = [ cfg.package ];

    # check .vcl syntax at compile time (e.g. before nixops deployment)
-    system.checks = mkIf cfg.enableConfigCheck [
+    system.checks = lib.mkIf cfg.enableConfigCheck [
      (pkgs.runCommand "check-varnish-syntax" { } ''
        ${cfg.package}/bin/varnishd -C ${commandLine} 2> $out || (cat $out; exit 1)
      '')
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@ -587,7 +587,7 @@ in {
  mate = handleTest ./mate.nix {};
  mate-wayland = handleTest ./mate-wayland.nix {};
  matter-server = handleTest ./matter-server.nix {};
-  matomo = handleTest ./matomo.nix {};
+  matomo = runTest ./matomo.nix;
  matrix-appservice-irc = runTest ./matrix/appservice-irc.nix;
  matrix-conduit = handleTest ./matrix/conduit.nix {};
  matrix-synapse = handleTest ./matrix/synapse.nix {};
@ -1143,6 +1143,7 @@ in {
  v2ray = handleTest ./v2ray.nix {};
  varnish60 = handleTest ./varnish.nix { package = pkgs.varnish60; };
  varnish75 = handleTest ./varnish.nix { package = pkgs.varnish75; };
+  varnish76 = handleTest ./varnish.nix { package = pkgs.varnish76; };
  vault = handleTest ./vault.nix {};
  vault-agent = handleTest ./vault-agent.nix {};
  vault-dev = handleTest ./vault-dev.nix {};
--- a/nixos/tests/matomo.nix
+++ b/nixos/tests/matomo.nix
@ -1,84 +1,58 @@
+{ lib, ... }:
 {
-  system ? builtins.currentSystem,
-  config ? { },
-  pkgs ? import ../.. { inherit system config; },
-}:
+  name = "matomo";

-with import ../lib/testing-python.nix { inherit system pkgs; };
-with pkgs.lib;
-
-let
-  matomoTest =
-    package:
-    makeTest {
-      name = "matomo";
-
-      nodes.machine =
-        { config, pkgs, ... }:
-        {
-          services.matomo = {
-            package = package;
-            enable = true;
-            nginx = {
-              forceSSL = false;
-              enableACME = false;
-            };
-          };
-          services.mysql = {
-            enable = true;
-            package = pkgs.mariadb;
-          };
-          services.nginx.enable = true;
+  nodes.machine =
+    { config, pkgs, ... }:
+    {
+      services.matomo = {
+        enable = true;
+        nginx = {
+          forceSSL = false;
+          enableACME = false;
        };
-
-      testScript = ''
-        start_all()
-        machine.wait_for_unit("mysql.service")
-        machine.wait_for_unit("phpfpm-matomo.service")
-        machine.wait_for_unit("nginx.service")
-
-        with subtest("matomo.js reachable via HTTP"):
-          machine.succeed("curl -sSfk http://machine/matomo.js")
-
-        with subtest("js/piwik.js reachable via HTTP"):
-          machine.succeed("curl -sSfk http://machine/js/piwik.js")
-
-        with subtest("matomo.php (API) reachable via HTTP"):
-          machine.succeed("curl -sSfk http://machine/matomo.php")
-
-        # without the grep the command does not produce valid utf-8 for some reason
-        with subtest("welcome screen loads"):
-            machine.succeed(
-                "curl -sSfL http://localhost/ | grep '<title>Matomo[^<]*Installation'"
-            )
-
-        with subtest("killing the phpfpm process should trigger an automatic restart"):
-          machine.succeed("systemctl kill -s KILL phpfpm-matomo")
-          machine.sleep(1)
-          machine.wait_for_unit("phpfpm-matomo.service")
-      '';
+      };
+      services.mysql = {
+        enable = true;
+        package = pkgs.mariadb;
+      };
+      services.nginx.enable = true;
    };
-in
-{
-  matomo = matomoTest pkgs.matomo // {
-    name = "matomo";
-    meta.maintainers =
-      with maintainers;
-      [
-        florianjacob
-        mmilata
-        twey
-        boozedog
-      ]
-      ++ lib.teams.flyingcircus.members;
-  };
-  matomo-beta = matomoTest pkgs.matomo-beta // {
-    name = "matomo-beta";
-    meta.maintainers = with maintainers; [
+
+  testScript = ''
+    start_all()
+    machine.wait_for_unit("mysql.service")
+    machine.wait_for_unit("phpfpm-matomo.service")
+    machine.wait_for_unit("nginx.service")
+
+    with subtest("matomo.js reachable via HTTP"):
+      machine.succeed("curl -sSfk http://machine/matomo.js")
+
+    with subtest("js/piwik.js reachable via HTTP"):
+      machine.succeed("curl -sSfk http://machine/js/piwik.js")
+
+    with subtest("matomo.php (API) reachable via HTTP"):
+      machine.succeed("curl -sSfk http://machine/matomo.php")
+
+    # without the grep the command does not produce valid utf-8 for some reason
+    with subtest("welcome screen loads"):
+      machine.succeed(
+        "curl -sSfL http://localhost/ | grep '<title>Matomo[^<]*Installation'"
+      )
+
+    with subtest("killing the phpfpm process should trigger an automatic restart"):
+      machine.succeed("systemctl kill -s KILL phpfpm-matomo")
+      machine.sleep(1)
+      machine.wait_for_unit("phpfpm-matomo.service")
+  '';
+
+  meta.maintainers =
+    with lib.maintainers;
+    [
      florianjacob
      mmilata
      twey
      boozedog
-    ];
-  };
+    ]
+    ++ lib.teams.flyingcircus.members;
 }
--- a/nixos/tests/varnish.nix
+++ b/nixos/tests/varnish.nix
@ -56,8 +56,12 @@ import ./make-test-python.nix (

      client.wait_until_succeeds("curl -f http://varnish/nix-cache-info");

-      client.wait_until_succeeds("nix-store -r ${testPath}");
-      client.succeed("${testPath}/bin/hello");
+      client.wait_until_succeeds("nix-store -r ${testPath}")
+      client.succeed("${testPath}/bin/hello")
+
+      output = varnish.succeed("varnishadm status")
+      print(output)
+      assert "Child in state running" in output, "Unexpected varnishadm response"
    '';
  }
 )
--- a/pkgs/applications/audio/snapcast/default.nix
+++ b/pkgs/applications/audio/snapcast/default.nix
@ -20,17 +20,18 @@
  pulseaudioSupport ? false,
  libpulseaudio,
  nixosTests,
+  openssl,
 }:

 stdenv.mkDerivation rec {
  pname = "snapcast";
-  version = "0.29.0";
+  version = "0.30.0";

  src = fetchFromGitHub {
    owner = "badaix";
    repo = "snapcast";
    rev = "v${version}";
-    hash = "sha256-FWOGBXYWLHHZhvC5/BpkDd70ZupzALZ3ks3qTcrtwKQ=";
+    hash = "sha256-EJgpZz4PnXfge0rkVH1F7cah+i9AvDJVSUVqL7qChDM=";
  };

  nativeBuildInputs = [
@ -51,6 +52,7 @@ stdenv.mkDerivation rec {
      aixlog
      popl
      soxr
+      openssl
    ]
    ++ lib.optional pulseaudioSupport libpulseaudio
    ++ lib.optional stdenv.hostPlatform.isLinux alsa-lib
--- a/pkgs/applications/emulators/libretro/cores/vice.nix
+++ b/pkgs/applications/emulators/libretro/cores/vice.nix
@ -0,0 +1,29 @@
+{
+  lib,
+  fetchFromGitHub,
+  mkLibretroCore,
+  type ? "x64",
+}:
+mkLibretroCore {
+  core = "vice-${type}";
+  version = "0-unstable-2025-01-11";
+
+  src = fetchFromGitHub {
+    owner = "libretro";
+    repo = "vice-libretro";
+    rev = "5afa33f347306f168ff0b4c54a7825895dd07b50";
+    hash = "sha256-D0DSKgqZV8EluRry2qSm7qnWnvwwDWz91G66W4nF2Kk=";
+  };
+
+  makefile = "Makefile";
+
+  env = {
+      EMUTYPE = "${type}";
+  };
+
+  meta = {
+    description = "Port of vice to libretro";
+    homepage = "https://github.com/libretro/vice-libretro";
+    license = lib.licenses.gpl2;
+  };
+}
--- a/pkgs/applications/emulators/libretro/default.nix
+++ b/pkgs/applications/emulators/libretro/default.nix
@ -189,6 +189,26 @@ lib.makeScope newScope (self: {

  vecx = self.callPackage ./cores/vecx.nix { };

+  vice-x64 = self.callPackage ./cores/vice.nix { type = "x64"; };
+
+  vice-x128 = self.callPackage ./cores/vice.nix { type = "x128"; };
+
+  vice-x64dtv = self.callPackage ./cores/vice.nix { type = "x64dtv"; };
+
+  vice-x64sc = self.callPackage ./cores/vice.nix { type = "x64sc"; };
+
+  vice-xcbm2 = self.callPackage ./cores/vice.nix { type = "xcbm2"; };
+
+  vice-xcbm5x0 = self.callPackage ./cores/vice.nix { type = "xcbm5x0"; };
+
+  vice-xpet = self.callPackage ./cores/vice.nix { type = "xpet"; };
+
+  vice-xplus4 = self.callPackage ./cores/vice.nix { type = "xplus4"; };
+
+  vice-xscpu64 = self.callPackage ./cores/vice.nix { type = "xscpu64"; };
+
+  vice-xvic = self.callPackage ./cores/vice.nix { type = "xvic"; };
+
  virtualjaguar = self.callPackage ./cores/virtualjaguar.nix { };

  yabause = self.callPackage ./cores/yabause.nix { };
--- a/pkgs/applications/misc/ola/default.nix
+++ b/pkgs/applications/misc/ola/default.nix
@ -15,6 +15,7 @@
  libmicrohttpd,
  perl,
  python3,
+  fetchpatch,
 }:

 stdenv.mkDerivation rec {
@ -27,7 +28,13 @@ stdenv.mkDerivation rec {
    tag = version;
    hash = "sha256-8w8ZT3D/+8Pxl9z2KTXeydVxE5xiPjxZevgmMFgrblU=";
  };
-
+  patches = [
+    # Fix build error with GCC 14 due to stricter C++20 compliance (template-id in constructors)
+    (fetchpatch {
+      url = "https://github.com/OpenLightingProject/ola/commit/d9b9c78645c578adb7c07b692842e841c48310be.patch";
+      hash = "sha256-BplSqQv8ztWMpiX/M3/3wvf6LsPTBglh48gHlUoM6rw=";
+    })
+  ];
  nativeBuildInputs = [
    autoreconfHook
    bison
--- a/pkgs/applications/misc/tandoor-recipes/common.nix
+++ b/pkgs/applications/misc/tandoor-recipes/common.nix
@ -1,12 +1,12 @@
 { lib, fetchFromGitHub }:
 rec {
-  version = "1.5.27";
+  version = "1.5.29";

  src = fetchFromGitHub {
    owner = "TandoorRecipes";
    repo = "recipes";
    rev = version;
-    hash = "sha256-HP4gVk127hvvL337Cb4Wbvvf55RWY7u5RF/FKDCottw=";
+    hash = "sha256-NfU071BLZ/NtpbZe475oNl8LGiVzVix9iekEoCGtcdk=";
  };

  yarnHash = "sha256-lU8QrTkI32XOHefIkj/0fa2UKhuZpQIT1wyweQnzXmQ=";
--- a/pkgs/applications/networking/cluster/terraform-providers/providers.json
+++ b/pkgs/applications/networking/cluster/terraform-providers/providers.json
@ -1427,13 +1427,13 @@
    "vendorHash": "sha256-kjS1YYMoE5IBeKWXnxzO3nFp6NpBEwUCaTzO0VSBDLA="
  },
  "vultr": {
-    "hash": "sha256-gQwLGnYmB9bwpGrLNdbw+zY0MlPPrY/37rJPtindT1Q=",
+    "hash": "sha256-vgeTK5fGHYzHCBdxq1JN9agK6+jYGkCkFnAWrkIz/gM=",
    "homepage": "https://registry.terraform.io/providers/vultr/vultr",
    "owner": "vultr",
    "repo": "terraform-provider-vultr",
-    "rev": "v2.21.0",
+    "rev": "v2.23.1",
    "spdx": "MPL-2.0",
-    "vendorHash": null
+    "vendorHash": "sha256-UW9/XEG+yTgMEttWFRMeneni0i/ZEcsrniT5vbhtRf8="
  },
  "wavefront": {
    "hash": "sha256-yNNtOkodzwxKvHQq9GZlUicezGW6u2ih6ry/cOtJQGM=",
--- a/pkgs/applications/virtualization/docker/compose.nix
+++ b/pkgs/applications/virtualization/docker/compose.nix
@ -2,13 +2,13 @@

 buildGoModule rec {
  pname = "docker-compose";
-  version = "2.32.2";
+  version = "2.32.4";

  src = fetchFromGitHub {
    owner = "docker";
    repo = "compose";
    rev = "v${version}";
-    hash = "sha256-i4wpM7Rc4pFUUzPFvoPxUlifIvk4GJzBhCLpUndFnjE=";
+    hash = "sha256-t2XW75PuoZAZ0Nw2CMnP73BwJSpt5BtzGJLAM5zqbrI=";
  };

  postPatch = ''
--- a/pkgs/by-name/ad/adriconf/package.nix
+++ b/pkgs/by-name/ad/adriconf/package.nix
@ -3,6 +3,8 @@
  lib,
  fetchFromGitLab,
  cmake,
+  gettext,
+  glib,
  pkg-config,
  libdrm,
  libGL,
@ -28,6 +30,8 @@ stdenv.mkDerivation rec {

  nativeBuildInputs = [
    cmake
+    gettext # msgfmt
+    glib # glib-compile-resources
    pkg-config
  ];
  buildInputs = [
@ -41,6 +45,7 @@ stdenv.mkDerivation rec {
    pciutils
  ];

+  # tries to download googletest
  cmakeFlags = [ "-DENABLE_UNIT_TESTS=off" ];

  postInstall = ''
--- a/pkgs/by-name/ar/ariang/package.nix
+++ b/pkgs/by-name/ar/ariang/package.nix
@ -7,16 +7,16 @@

 buildNpmPackage rec {
  pname = "ariang";
-  version = "1.3.8";
+  version = "1.3.9";

  src = fetchFromGitHub {
    owner = "mayswind";
    repo = "AriaNg";
    rev = version;
-    hash = "sha256-B7gyBVryRn1SwUIqzxc1MYDS8l/mxMfJtE1/ZrBjC1E=";
+    hash = "sha256-c3+iyw8LgdB29552jJQr4q5P2ZW80jC0aN+eaenEYFo=";
  };

-  npmDepsHash = "sha256-DmACToIdXfAqiXe13vevWrpWDY1YgRWVaTfdlk5uhPg=";
+  npmDepsHash = "sha256-N7ZK6wthBYAt8tU8sJE0QChAYxWfJ1HG5P+AjXZfIiw=";

  makeCacheWritable = true;

--- a/pkgs/by-name/au/auth0-cli/package.nix
+++ b/pkgs/by-name/au/auth0-cli/package.nix
@ -5,16 +5,16 @@

 buildGoModule rec {
  pname = "auth0-cli";
-  version = "1.7.2";
+  version = "1.8.0";

  src = fetchFromGitHub {
    owner = "auth0";
    repo = "auth0-cli";
    tag = "v${version}";
-    hash = "sha256-9/Jjsg6E8+gkN5eGZsxmTBwVoD/eO7euidY6ds7skpA=";
+    hash = "sha256-D982lmu44JFrxGcn0G1BssGkE3juUoB6qbCHWCTg9kw=";
  };

-  vendorHash = "sha256-XXCmIASYQD21h1h8HOcAl8HK5QUvgfqRpauq93tUNZ8=";
+  vendorHash = "sha256-OEHJTMcoaB4BZ06GjXIFPbCyoMGeumjTzWWFmgqLML8=";

  ldflags = [
    "-s"
--- a/pkgs/by-name/be/betterdisplay/package.nix
+++ b/pkgs/by-name/be/betterdisplay/package.nix
@ -4,15 +4,18 @@
  fetchurl,
  undmg,
  nix-update-script,
+  versionCheckHook,
+  writeShellScript,
+  xcbuild,
 }:

 stdenvNoCC.mkDerivation (finalAttrs: {
  pname = "betterdisplay";
-  version = "3.2.1";
+  version = "3.3.0";

  src = fetchurl {
    url = "https://github.com/waydabber/BetterDisplay/releases/download/v${finalAttrs.version}/BetterDisplay-v${finalAttrs.version}.dmg";
-    hash = "sha256-UQLVRCeUznTqT6qDR6sZRZ5xMVgs0Th2iRRpnF0pqVI=";
+    hash = "sha256-A0kh3XNdl5kJ32Kxwb0PAgxfGJR+EZEoaP+gspRJEcU=";
  };

  dontPatch = true;
@ -32,6 +35,15 @@ stdenvNoCC.mkDerivation (finalAttrs: {
    runHook postInstall
  '';

+  nativeInstallCheckInputs = [ versionCheckHook ];
+  versionCheckProgram = writeShellScript "version-check" ''
+    ${xcbuild}/bin/PlistBuddy -c "Print :CFBundleShortVersionString" "$1"
+  '';
+  versionCheckProgramArg = [
+    "${placeholder "out"}/Applications/BetterDisplay.app/Contents/Info.plist"
+  ];
+  doInstallCheck = true;
+
  passthru.updateScript = nix-update-script { };

  meta = {
--- a/pkgs/by-name/bu/buildkite-agent-metrics/package.nix
+++ b/pkgs/by-name/bu/buildkite-agent-metrics/package.nix
@ -5,7 +5,7 @@
 }:
 buildGoModule rec {
  pname = "buildkite-agent-metrics";
-  version = "5.9.12";
+  version = "5.9.13";

  outputs = [
    "out"
@ -16,10 +16,10 @@ buildGoModule rec {
    owner = "buildkite";
    repo = "buildkite-agent-metrics";
    rev = "v${version}";
-    hash = "sha256-5k7njo8J96hb/RUdIRcP4KfwEH5Z2S4AyDyazcFlN0s=";
+    hash = "sha256-AVFQ3GP4YDQ6d9NSeol3Eobxzmoa9bRyCAKTsDbyZyQ=";
  };

-  vendorHash = "sha256-zb+z1neus1mnJWeuI5DSc73cXMGWme0mz/PU2Z/Zam8=";
+  vendorHash = "sha256-RQmxYxTcQn5VEy8Z96EtArYBnODmde1RlV4CA6fhbZA=";

  postInstall = ''
    mkdir -p $lambda/bin
--- a/pkgs/by-name/bu/buildkite-cli/package.nix
+++ b/pkgs/by-name/bu/buildkite-cli/package.nix
@ -6,16 +6,16 @@

 buildGoModule rec {
  pname = "buildkite-cli";
-  version = "3.4.2";
+  version = "3.5.0";

  src = fetchFromGitHub {
    owner = "buildkite";
    repo = "cli";
    rev = "v${version}";
-    sha256 = "sha256-Tb9Hyhyf+ib/tLUHc+gUccZ7TuXltxxjaIpCfvnoVkA=";
+    sha256 = "sha256-UKpvqjHnkDv6HDpDmXe3ZoFSMGmPE/KLc7TuJKjNJXw=";
  };

-  vendorHash = "sha256-1QXcRykXoNGYCR8+6ut1eU8TVNtx8b2O2MIjmL8rfQk=";
+  vendorHash = "sha256-FV35NCwntmIWakcNH9nu1MTwZArERCc8hN57PmunkX4=";

  doCheck = false;

--- a/pkgs/by-name/ca/cargo-bundle-licenses/package.nix
+++ b/pkgs/by-name/ca/cargo-bundle-licenses/package.nix
@ -6,16 +6,16 @@

 rustPlatform.buildRustPackage rec {
  pname = "cargo-bundle-licenses";
-  version = "2.1.1";
+  version = "2.3.0";

  src = fetchFromGitHub {
    owner = "sstadick";
    repo = "cargo-bundle-licenses";
    rev = "v${version}";
-    hash = "sha256-oyb5uWIKXhPSMpb1t6C/IYKK8FMSANIQXs2XdJ/bD2A=";
+    hash = "sha256-Rw5uwfUPTkIbiOQDohBRoAm0momljJRSYP+VmEOOw/k=";
  };

-  cargoHash = "sha256-HxFRHgb0nBF6YGaiynv95fNwej70IAwP4jhVcGvdFok=";
+  cargoHash = "sha256-SfTt49J6D7RESo6iO3b/l0+Vu1dEW+PG0M2RIko2OJ4=";

  meta = with lib; {
    description = "Generate a THIRDPARTY file with all licenses in a cargo project";
--- a/pkgs/by-name/ca/cargo-shuttle/package.nix
+++ b/pkgs/by-name/ca/cargo-shuttle/package.nix
@ -11,17 +11,17 @@

 rustPlatform.buildRustPackage rec {
  pname = "cargo-shuttle";
-  version = "0.50.0";
+  version = "0.51.0";

  src = fetchFromGitHub {
    owner = "shuttle-hq";
    repo = "shuttle";
    rev = "v${version}";
-    hash = "sha256-D3o4GdGD/lP4bchjpyj684G1CDWMhnZHke131GAI1es=";
+    hash = "sha256-oKFL/tnMsXz/qic65DgLmnmeyBsrklacs+XeVM6RGSs=";
  };

  useFetchCargoVendor = true;
-  cargoHash = "sha256-hlYcDQi4wv43UBYSvnWUMunAKVCFVFA7hvxjaeGA2pA=";
+  cargoHash = "sha256-ocTkpIqXTf8k+onUroaCt/jMnslctzCt7g9wNtkI82g=";

  nativeBuildInputs = [ pkg-config ];

--- a/pkgs/by-name/co/cobang/package.nix
+++ b/pkgs/by-name/co/cobang/package.nix
@ -13,14 +13,14 @@

 python3Packages.buildPythonApplication rec {
  pname = "cobang";
-  version = "0.14.1";
+  version = "0.15.0";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "hongquan";
    repo = "CoBang";
    tag = "v${version}";
-    hash = "sha256-/8JtDoXFQGlM7tlwKd+WRIKpnKCD6OnMmbvElg7LbzU=";
+    hash = "sha256-ozHmGpRx+Ts6yrDXwm4OHXTArunQbJOlA/7zJvRNQio=";
  };

  postPatch = ''
--- a/pkgs/by-name/co/comrak/package.nix
+++ b/pkgs/by-name/co/comrak/package.nix
@ -6,16 +6,16 @@

 rustPlatform.buildRustPackage rec {
  pname = "comrak";
-  version = "0.33.0";
+  version = "0.34.0";

  src = fetchFromGitHub {
    owner = "kivikakk";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-VN8f5r25kfUqekt9q28oMmkzQUE+Ko8DYhRZjpbbDfM=";
+    sha256 = "sha256-8LBMyCmt4HTYgprChfPSFZm6uQ7yFmJ0+srAUz785MA=";
  };

-  cargoHash = "sha256-Hdjit5dpZXT7ENamUX0ygTy+XAyCkcqq94wAJUPd8DY=";
+  cargoHash = "sha256-Z2LNFlHWS3IdjXlwdIizkjNFaPqTbMf0i6Y6jigKCzg=";

  meta = with lib; {
    description = "CommonMark-compatible GitHub Flavored Markdown parser and formatter";
--- a/pkgs/by-name/eb/eb-garamond/package.nix
+++ b/pkgs/by-name/eb/eb-garamond/package.nix
@ -1,23 +1,43 @@
 {
  lib,
  stdenvNoCC,
-  fetchzip,
+  fetchFromGitHub,
+  python3,
+  ttfautohint,
 }:
-
 stdenvNoCC.mkDerivation rec {
  pname = "eb-garamond";
  version = "0.016";

-  src = fetchzip {
-    url = "https://bitbucket.org/georgd/eb-garamond/downloads/EBGaramond-${version}.zip";
-    hash = "sha256-P2VCLcqcMBBoTDJyRLP9vlHI+jE0EqPjPziN2MJbgEg=";
+  src = fetchFromGitHub {
+    owner = "georgd";
+    repo = "EB-Garamond";
+    tag = "v${version}";
+    hash = "sha256-ajieKhTeH6yv2qiE2xqnHFoMS65//4ZKiccAlC2PXGQ=";
  };

+  nativeBuildInputs = [
+    (python3.withPackages (p: [ p.fontforge ]))
+    ttfautohint
+  ];
+
+  postPatch = ''
+    substituteInPlace Makefile \
+      --replace-fail "@\$(SFNTTOOL) -w \$< \$@"   "@fontforge -lang=ff -c 'Open(\$\$1); Generate(\$\$2)' \$< \$@"
+  '';
+
+  buildPhase = ''
+    runHook preBuild
+    make WEB=build EOT="" all
+    runHook postBuild
+  '';
+
  installPhase = ''
    runHook preInstall

-    install -Dm644 otf/*.otf                                 -t $out/share/fonts/opentype
-    install -Dm644 Changes README.markdown README.xelualatex -t $out/share/doc/${pname}-${version}
+    install -Dm644 build/*.ttf  -t $out/share/fonts/truetype
+    install -Dm644 build/*.otf  -t $out/share/fonts/opentype
+    install -Dm644 build/*.woff -t $out/share/fonts/woff

    runHook postInstall
  '';
@ -26,6 +46,7 @@ stdenvNoCC.mkDerivation rec {
    homepage = "http://www.georgduffner.at/ebgaramond/";
    description = "Digitization of the Garamond shown on the Egenolff-Berner specimen";
    maintainers = with maintainers; [
+      bengsparks
      relrod
      rycee
    ];
--- a/pkgs/by-name/ej/ejsonkms/package.nix
+++ b/pkgs/by-name/ej/ejsonkms/package.nix
@ -8,16 +8,16 @@

 buildGoModule rec {
  pname = "ejsonkms";
-  version = "0.2.3";
+  version = "0.2.4";

  src = fetchFromGitHub {
    owner = "envato";
    repo = "ejsonkms";
    rev = "v${version}";
-    hash = "sha256-GrereV1IFRTaQEK+wjRHnXSydaKQgQeuxYgSAxEuok0=";
+    hash = "sha256-kk/+EOZ1g6SiIajcKXf6lVnll/NRWgwbFO2j07HERBI=";
  };

-  vendorHash = "sha256-bfR2jz4M5C60Nket9UW2C9GTK8jkbm6FZUar+wwDnbc=";
+  vendorHash = "sha256-ZSoxG532eicpR1pS2oLYnJxtJrsHZZRbjncxU4uyT3c=";

  ldflags = [
    "-X main.version=v${version}"
--- a/pkgs/by-name/ex/exo/package.nix
+++ b/pkgs/by-name/ex/exo/package.nix
@ -7,14 +7,14 @@
 }:
 python3Packages.buildPythonApplication rec {
  pname = "exo";
-  version = "0.0.9-alpha";
+  version = "0.0.10-alpha";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "exo-explore";
    repo = "exo";
    tag = "v${version}";
-    hash = "sha256-H3Jxq0GS3Ha9cDsIHCsTupD0/Mp80Mxf2NvAyZytTb0=";
+    hash = "sha256-JJGjr9RLiJ23mPpSsx6exs8hXx/ZkL5rl8i6Xg1vFhY=";
  };

  build-system = with python3Packages; [ setuptools ];
--- a/pkgs/by-name/fr/freeipmi/package.nix
+++ b/pkgs/by-name/fr/freeipmi/package.nix
@ -9,12 +9,12 @@
 }:

 stdenv.mkDerivation rec {
-  version = "1.6.14";
+  version = "1.6.15";
  pname = "freeipmi";

  src = fetchurl {
    url = "mirror://gnu/freeipmi/${pname}-${version}.tar.gz";
-    sha256 = "sha256-Gj2sXHa3zMTU+GqhK475shK673SJvwXombiau34U7bU=";
+    sha256 = "sha256-1pKcNUY59c51tbGJfos2brY2JcI+XEWQp66gNP4rjK8=";
  };

  depsBuildBuild = [ buildPackages.stdenv.cc ];
--- a/pkgs/by-name/gi/gitkraken/package.nix
+++ b/pkgs/by-name/gi/gitkraken/package.nix
@ -57,24 +57,24 @@

 let
  pname = "gitkraken";
-  version = "10.6.1";
+  version = "10.6.2";

  throwSystem = throw "Unsupported system: ${stdenv.hostPlatform.system}";

  srcs = {
    x86_64-linux = fetchzip {
      url = "https://release.axocdn.com/linux/GitKraken-v${version}.tar.gz";
-      hash = "sha256-OzVBimAi9vAi6YhSRV0a51MWSmdHmHvvXbimeaNFpBU=";
+      hash = "sha256-E/9BR4PE5QF075+NgJZTtgDoShHEqeRcoICnMLt3RuY=";
    };

    x86_64-darwin = fetchzip {
      url = "https://release.axocdn.com/darwin/GitKraken-v${version}.zip";
-      hash = "sha256-MF6H3tNUw4P4BAzScMsolyB9Qage/7aZwe84gCBjyV4=";
+      hash = "sha256-gCiZN+ivXEF5KLas7eZn9iWfXcDGwf1gXK1ejY2C4xs=";
    };

    aarch64-darwin = fetchzip {
      url = "https://release.axocdn.com/darwin-arm64/GitKraken-v${version}.zip";
-      hash = "sha256-Akn8LSSYEj/dUU8iNWm5wO239wKGBmQp9RfzbCjI5Wo=";
+      hash = "sha256-1zd57Kqi5iKHw/dNqLQ7jVAkNFvkFeqQbZPN32kF9IU=";
    };
  };

--- a/pkgs/by-name/go/google-cloud-sql-proxy/package.nix
+++ b/pkgs/by-name/go/google-cloud-sql-proxy/package.nix
@ -7,18 +7,18 @@

 buildGoModule rec {
  pname = "google-cloud-sql-proxy";
-  version = "2.14.2";
+  version = "2.14.3";

  src = fetchFromGitHub {
    owner = "GoogleCloudPlatform";
    repo = "cloud-sql-proxy";
    rev = "v${version}";
-    hash = "sha256-jnecQkfZzg7psWOamJTpUnxjkW0tJkuGw06GGBNbub0=";
+    hash = "sha256-zY4V5QNoesvwJxW9htTkmMk6KPCxKvLg1FVn+xmlw14=";
  };

  subPackages = [ "." ];

-  vendorHash = "sha256-7jMDSW32MoHCN51yqLliUBfcjsE5l0mPvGXair5KLxA=";
+  vendorHash = "sha256-ZwCe8gJ1Sowvt0X+inFoiYpJjhl/sdQUqrkXte2gV2I=";

  checkFlags = [
    "-short"
--- a/pkgs/by-name/gr/grpc-gateway/package.nix
+++ b/pkgs/by-name/gr/grpc-gateway/package.nix
@ -2,16 +2,16 @@

 buildGoModule rec {
  pname = "grpc-gateway";
-  version = "2.25.1";
+  version = "2.26.0";

  src = fetchFromGitHub {
    owner = "grpc-ecosystem";
    repo = "grpc-gateway";
    tag = "v${version}";
-    sha256 = "sha256-1bNYTzfBSwEEi5tjDjUI9i+0Xh+T0SQNE+8GgDwexx0=";
+    sha256 = "sha256-Vg47U57gHau7t5a1TEQuTKRUtn90gbrTETO+ngd8Bzc=";
  };

-  vendorHash = "sha256-zWWJxvwOZTAk5f6AMrhCBo3n5/Np6hucx6AM+Ucq6ec=";
+  vendorHash = "sha256-8YxAPvTP9o7ns4Gjs1WdqFColyZg7LoYolGQmNdCvTs=";

  ldflags = [
    "-X=main.version=${version}"
--- a/pkgs/by-name/he/hexpatch/package.nix
+++ b/pkgs/by-name/he/hexpatch/package.nix
@ -10,16 +10,16 @@

 rustPlatform.buildRustPackage rec {
  pname = "hexpatch";
-  version = "1.9.4";
+  version = "1.9.5";

  src = fetchFromGitHub {
    owner = "Etto48";
    repo = "HexPatch";
    tag = "v${version}";
-    hash = "sha256-tVJp8ZFHaHM6Yhty0n5W4ZDKG/L5+8ZcbbTnw2yLEOI=";
+    hash = "sha256-DRuknqj4E+G4ChN5CH5N4Zrl3btSo1HdqiRPfLC5YTE=";
  };

-  cargoHash = "sha256-oKZjLS4+blGMt3K6in4i7JLqKZ8uWAv/uBFU9VT0Ha8=";
+  cargoHash = "sha256-5yZ+eJUjUUNCmJtFYRSzvdjZ7tnyjCO+lgwdDHluSGg=";

  nativeBuildInputs = [
    cmake
@ -37,7 +37,7 @@ rustPlatform.buildRustPackage rec {
  doInstallCheck = true;

  passthru = {
-    upateScript = nix-update-script { };
+    updateScript = nix-update-script { };
  };

  meta = {
--- a/pkgs/by-name/ht/httm/package.nix
+++ b/pkgs/by-name/ht/httm/package.nix
@ -7,16 +7,16 @@

 rustPlatform.buildRustPackage rec {
  pname = "httm";
-  version = "0.44.1";
+  version = "0.45.0";

  src = fetchFromGitHub {
    owner = "kimono-koans";
    repo = pname;
    rev = version;
-    hash = "sha256-vf5wIXYMBB7I6enmCYByoAE+2MWA/iUoq3UY86yRsEU=";
+    hash = "sha256-g+UUiFgOTuSNymg3OcIsoTqWA/OOZzwFCUQ7YxW1AzE=";
  };

-  cargoHash = "sha256-o9Ctt5a96vBhh0eB0z9N9qR3txVWdeq2qH9dYaxqtoA=";
+  cargoHash = "sha256-+ygXGSnhs9N7oHGqVA7Bo3JIgR8TZpY9y4tkBd4vZy8=";

  nativeBuildInputs = [ installShellFiles ];

--- a/pkgs/by-name/k3/k3sup/package.nix
+++ b/pkgs/by-name/k3/k3sup/package.nix
@ -9,13 +9,13 @@

 buildGoModule rec {
  pname = "k3sup";
-  version = "0.13.7";
+  version = "0.13.8";

  src = fetchFromGitHub {
    owner = "alexellis";
    repo = "k3sup";
    rev = version;
-    sha256 = "sha256-B9Mo0+dqF15LuhCytMBax2gKjHl9mBkxLXCdb9f0Big=";
+    sha256 = "sha256-WmvCmG/wk63VnfJTFk3HhiaLzCe9O6kdUc7GpYNAwP4=";
  };

  nativeBuildInputs = [ makeWrapper installShellFiles ];
--- a/pkgs/by-name/kt/ktor-cli/package.nix
+++ b/pkgs/by-name/kt/ktor-cli/package.nix
@ -6,13 +6,13 @@

 buildGoModule rec {
  pname = "ktor-cli";
-  version = "0.3.1";
+  version = "0.4.0";

  src = fetchFromGitHub {
    owner = "ktorio";
    repo = "ktor-cli";
    tag = version;
-    hash = "sha256-UOO6hoUZazlrP+OJ6WCdY358wnRnAiQHEXrOpN7ZIvU=";
+    hash = "sha256-TGwkGm1Rsg82f6FJeTnhyvfS2MRMe5+DTdxTsOwwb1Q=";
  };

  subPackages = "cmd/ktor";
--- a/pkgs/by-name/li/libfakekey/package.nix
+++ b/pkgs/by-name/li/libfakekey/package.nix
@ -22,7 +22,7 @@ stdenv.mkDerivation rec {
    hash = "sha256-QNJlxZ9uNwNgFWm9qRJdPfusx7dXHZajjFH7wDhpgcs=";
  };

-  preConfigure = "./autogen.sh";
+  configureScript = "./autogen.sh";

  nativeBuildInputs = [
    automake
--- a/pkgs/by-name/li/litmusctl/package.nix
+++ b/pkgs/by-name/li/litmusctl/package.nix
@ -8,7 +8,7 @@

 buildGoModule rec {
  pname = "litmusctl";
-  version = "1.13.0";
+  version = "1.14.0";

  nativeBuildInputs = [
    installShellFiles
@ -22,7 +22,7 @@ buildGoModule rec {
    owner = "litmuschaos";
    repo = "litmusctl";
    rev = "${version}";
-    hash = "sha256-lPdejdnBefhYgv52I7BOm1VTgqHSp8u1lgJJxK5GWSA=";
+    hash = "sha256-Saj5sx5YkcKsnMrnIzPcLok+mgEZSh9p8rnfQbJhAeU=";
  };

  vendorHash = "sha256-7FYOQ89aUFPX+5NCPYKg+YGCXstQ6j9DK4V2mCgklu0=";
--- a/pkgs/by-name/lm/lm_sensors/package.nix
+++ b/pkgs/by-name/lm/lm_sensors/package.nix
@ -14,7 +14,7 @@

 let
  version = "3.6.0";
-  tag = lib.replaceStrings [ "." ] [ "-" ] version;
+  tag = "V" + lib.replaceStrings [ "." ] [ "-" ] version;
 in

 stdenv.mkDerivation {
--- a/pkgs/servers/web-apps/matomo/bootstrap.php
+++ b/pkgs/servers/web-apps/matomo/bootstrap.php
--- a/pkgs/servers/web-apps/matomo/change-path-geoip2-5.x.patch
+++ b/pkgs/servers/web-apps/matomo/change-path-geoip2-5.x.patch
--- a/pkgs/servers/web-apps/matomo/make-localhost-default-database-host.patch
+++ b/pkgs/servers/web-apps/matomo/make-localhost-default-database-host.patch
--- a/pkgs/by-name/ma/matomo/package.nix
+++ b/pkgs/by-name/ma/matomo/package.nix
@ -0,0 +1,123 @@
+{
+  lib,
+  stdenv,
+  fetchurl,
+  makeWrapper,
+  php,
+  nixosTests,
+  nix-update-script,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "matomo";
+  version = "5.2.1";
+
+  src = fetchurl {
+    url = "https://builds.matomo.org/matomo-${finalAttrs.version}.tar.gz";
+    hash = "sha256-5glMwwIG0Uo8bu904u40FUa+yaUlrQe1nUCkv9/ATks=";
+  };
+
+  nativeBuildInputs = [ makeWrapper ];
+
+  patches = [
+    # This changes the default value of the database server field
+    # from 127.0.0.1 to localhost.
+    # unix socket authentication only works with localhost,
+    # but password-based SQL authentication works with both.
+    # TODO: is upstream interested in this?
+    # -> discussion at https://github.com/matomo-org/matomo/issues/12646
+    ./make-localhost-default-database-host.patch
+    # This changes the default config for path.geoip2 so that it doesn't point
+    # to the nix store.
+    ./change-path-geoip2-5.x.patch
+  ];
+
+  # this bootstrap.php adds support for getting PIWIK_USER_PATH
+  # from an environment variable. Point it to a mutable location
+  # to be able to use matomo read-only from the nix store
+  postPatch = ''
+    cp ${./bootstrap.php} bootstrap.php
+  '';
+
+  # TODO: future versions might rename the PIWIK_… variables to MATOMO_…
+  # TODO: Move more unnecessary files from share/, especially using PIWIK_INCLUDE_PATH.
+  #       See https://forum.matomo.org/t/bootstrap-php/5926/10 and
+  #       https://github.com/matomo-org/matomo/issues/11654#issuecomment-297730843
+  installPhase = ''
+    runHook preInstall
+
+    # copy everything to share/, used as webroot folder, and then remove what's known to be not needed
+    mkdir -p $out/share
+    cp -ra * $out/share/
+    # tmp/ is created by matomo in PIWIK_USER_PATH
+    rmdir $out/share/tmp
+    # config/ needs to be accessed by PIWIK_USER_PATH anyway
+    ln -s $out/share/config $out/
+
+    makeWrapper ${php}/bin/php $out/bin/matomo-console \
+      --add-flags "$out/share/console"
+
+    runHook postInstall
+  '';
+
+  filesToFix = [
+    "misc/composer/build-xhprof.sh"
+    "misc/composer/clean-xhprof.sh"
+    "misc/cron/archive.sh"
+    "plugins/GeoIp2/config/config.php"
+    "plugins/Installation/FormDatabaseSetup.php"
+    "vendor/pear/archive_tar/sync-php4"
+    "vendor/szymach/c-pchart/coverage.sh"
+    "vendor/matomo/matomo-php-tracker/run_tests.sh"
+    "vendor/twig/twig/drupal_test.sh"
+  ];
+
+  # This fixes the consistency check in the admin interface
+  #
+  # The filesToFix list may contain files that are exclusive to only one of the versions we build
+  # make sure to test for existence to avoid erroring on an incompatible version and failing
+  postFixup = ''
+    pushd $out/share > /dev/null
+    for f in $filesToFix; do
+      if [ -f "$f" ]; then
+        length="$(wc -c "$f" | cut -d' ' -f1)"
+        hash="$(md5sum "$f" | cut -d' ' -f1)"
+        sed -i "s:\\(\"$f\"[^(]*(\\).*:\\1\"$length\", \"$hash\"),:g" config/manifest.inc.php
+      else
+        echo "INFO(files-to-fix): $f does not exist in this version"
+      fi
+    done
+    popd > /dev/null
+  '';
+
+  passthru = {
+    updateScript = nix-update-script {
+      extraArgs = [
+        "--url"
+        "https://github.com/matomo-org/matomo"
+      ];
+    };
+    tests = lib.optionalAttrs stdenv.hostPlatform.isLinux {
+      inherit (nixosTests) matomo;
+    };
+  };
+
+  meta = {
+    description = "Real-time web analytics application";
+    mainProgram = "matomo-console";
+    license = lib.licenses.gpl3Plus;
+    homepage = "https://matomo.org/";
+    changelog = "https://github.com/matomo-org/matomo/releases/tag/${finalAttrs.version}";
+    platforms = lib.platforms.all;
+    maintainers =
+      with lib.maintainers;
+      [
+        florianjacob
+        sebbel
+        twey
+        boozedog
+        niklaskorz
+      ]
+      ++ lib.teams.flyingcircus.members;
+  };
+})
--- a/pkgs/by-name/mo/moar/package.nix
+++ b/pkgs/by-name/mo/moar/package.nix
@ -2,13 +2,13 @@

 buildGoModule rec {
  pname = "moar";
-  version = "1.31.0";
+  version = "1.31.2";

  src = fetchFromGitHub {
    owner = "walles";
    repo = pname;
    rev = "v${version}";
-    hash = "sha256-0HDFK2wPQtwIAVup/pVSjrdt1zpbfLV08HxeVPWC8dE=";
+    hash = "sha256-0B3XouAxQ6b9cWoov+Ofhlt+zgGh6AP1gy46LoiumoE=";
  };

  vendorHash = "sha256-J9u7LxzXk4npRyymmMKyN2ZTmhT4WwKjy0X5ITcHtoE=";
--- a/pkgs/by-name/pg/pgbackrest/package.nix
+++ b/pkgs/by-name/pg/pgbackrest/package.nix
@ -19,13 +19,13 @@

 stdenv.mkDerivation rec {
  pname = "pgbackrest";
-  version = "2.54.1";
+  version = "2.54.2";

  src = fetchFromGitHub {
    owner = "pgbackrest";
    repo = "pgbackrest";
    rev = "release/${version}";
-    sha256 = "sha256-kzFTWKzBQ0Jfew8oV+iaNAEx4lQncySyAI2VAgNu42s=";
+    sha256 = "sha256-Q0WZLbtn+qJLs2jop5S92NFC6QBtCQnU3AEEcm6MSVI=";
  };

  strictDeps = true;
--- a/pkgs/by-name/pu/pulumictl/package.nix
+++ b/pkgs/by-name/pu/pulumictl/package.nix
@ -6,16 +6,16 @@

 buildGoModule rec {
  pname = "pulumictl";
-  version = "0.0.47";
+  version = "0.0.48";

  src = fetchFromGitHub {
    owner = "pulumi";
    repo = "pulumictl";
    rev = "v${version}";
-    sha256 = "sha256-bZ7Di1DcvGECfOzW72QnfWRn76U+agsNsdsprBjx5Rw=";
+    sha256 = "sha256-rFVxfWeESWmqH0BhKY6BO5AxSPXVW8tOPGyUXB5Kc/E=";
  };

-  vendorHash = "sha256-QYQk36e7NLZnl00fRW4i4UMy7jFVaGHlXcxXt/wqw3M=";
+  vendorHash = "sha256-x5CBSzwOfX0BwwbAOuW1ibrLnnkVSNjqG0Sj2EcmRbM=";

  ldflags = [
    "-s"
--- a/pkgs/by-name/sh/shadow/package.nix
+++ b/pkgs/by-name/sh/shadow/package.nix
@ -87,7 +87,7 @@ stdenv.mkDerivation rec {
  disallowedReferences = lib.optional (stdenv.buildPlatform != stdenv.hostPlatform) stdenv.shellPackage;

  meta = with lib; {
-    homepage = "https://github.com/shadow-maint";
+    homepage = "https://github.com/shadow-maint/shadow";
    description = "Suite containing authentication-related tools such as passwd and su";
    license = licenses.bsd3;
    platforms = platforms.linux;
--- a/pkgs/by-name/sh/shadps4/package.nix
+++ b/pkgs/by-name/sh/shadps4/package.nix
@ -37,13 +37,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "shadps4";
-  version = "0.5.0-unstable-2025-01-02";
+  version = "0.5.0-unstable-2025-01-20";

  src = fetchFromGitHub {
    owner = "shadps4-emu";
    repo = "shadPS4";
-    rev = "596f4cdf0e66a97c9d2d4272091d8c0167a5b8e1";
-    hash = "sha256-apwAl8TCzSKchqYGHV0UsMSGErF4GgiwhlwmOPWpeLs=";
+    rev = "95a30b2b3e1aa4e20c3db632955cc67bbded0fb1";
+    hash = "sha256-52BhGKSUv+9asACNkppxiNm3Gja7r3LcXOIwhQR5ALs=";
    fetchSubmodules = true;
  };

--- a/pkgs/by-name/sk/sketchybar-app-font/package.nix
+++ b/pkgs/by-name/sk/sketchybar-app-font/package.nix
@ -9,13 +9,13 @@

 stdenvNoCC.mkDerivation (finalAttrs: {
  pname = "sketchybar-app-font";
-  version = "2.0.29";
+  version = "2.0.30";

  src = fetchFromGitHub {
    owner = "kvndrsslr";
    repo = "sketchybar-app-font";
-    rev = "v2.0.29";
-    hash = "sha256-8SWN22pjHnXWM+RUEYNux0ZWhRUVMib3M7r2SlI33tQ=";
+    rev = "v2.0.30";
+    hash = "sha256-Kx7Uazrmyn7yQedqnY1YJXSY2QFe0nCEIFLFUZwS9Tk=";
  };

  pnpmDeps = pnpm_9.fetchDeps {
--- a/pkgs/by-name/sl/slimserver/package.nix
+++ b/pkgs/by-name/sl/slimserver/package.nix
@ -33,13 +33,13 @@ let
 in
 perlPackages.buildPerlPackage rec {
  pname = "slimserver";
-  version = "9.0.0";
+  version = "9.0.1";

  src = fetchFromGitHub {
    owner = "LMS-Community";
    repo = "slimserver";
    rev = version;
-    hash = "sha256-Sd39J8YOywOOtVHxO3OPABULwRI5VGovS33tAj4TFkw=";
+    hash = "sha256-BIWTsF9SVGBkFaZF/QYFsgATglaORhnFT/2/qRe4emg=";
  };

  nativeBuildInputs = [ makeWrapper ];
@ -51,6 +51,7 @@ perlPackages.buildPerlPackage rec {
      ArchiveZip
      AsyncUtil
      AudioScan
+      CarpAssert
      CarpClan
      CGI
      ClassAccessor
--- a/pkgs/by-name/sp/spacectl/package.nix
+++ b/pkgs/by-name/sp/spacectl/package.nix
@ -9,16 +9,16 @@

 buildGoModule rec {
  pname = "spacectl";
-  version = "1.8.0";
+  version = "1.9.0";

  src = fetchFromGitHub {
    owner = "spacelift-io";
    repo = "spacectl";
    rev = "v${version}";
-    hash = "sha256-IkGkySGvRFvIxx9c2jkFJ0vJ6iqdp+pQYgOuZgHZjIw=";
+    hash = "sha256-24aw5ooN6ru9p+/21M64VlZdzcep0S76XA27wtZ0xyA=";
  };

-  vendorHash = "sha256-SYfXG6YM0Q2rCnoTM2tYvE17uBCD8yQiW/5DTCxMPWo=";
+  vendorHash = "sha256-VfhbwbKQOmXzLjS/O8BDdYHtZT2kBuxRcAPpHMlenUc=";

  nativeBuildInputs = [ installShellFiles ];

--- a/pkgs/by-name/st/stevenblack-blocklist/package.nix
+++ b/pkgs/by-name/st/stevenblack-blocklist/package.nix
@ -6,13 +6,13 @@
 }:
 stdenvNoCC.mkDerivation (finalAttrs: {
  pname = "stevenblack-blocklist";
-  version = "3.15.8";
+  version = "3.15.10";

  src = fetchFromGitHub {
    owner = "StevenBlack";
    repo = "hosts";
    tag = finalAttrs.version;
-    hash = "sha256-WdqYgQB4MN1H3SH/Wn8yJIDXJToAcy49D3Rqd8/zj64=";
+    hash = "sha256-f5SH4qQzRWYKwIjpzOuhI9mPwlyNcBWjr2mrCKLgml4=";
  };

  outputs = [
--- a/pkgs/by-name/sw/swiftformat/package.nix
+++ b/pkgs/by-name/sw/swiftformat/package.nix
@ -12,13 +12,13 @@

 swift.stdenv.mkDerivation rec {
  pname = "swiftformat";
-  version = "0.55.4";
+  version = "0.55.5";

  src = fetchFromGitHub {
    owner = "nicklockwood";
    repo = "SwiftFormat";
    rev = version;
-    sha256 = "sha256-0Dk2SgfPozgbdhyQa74NZkd/kA6JleSfpHDn4NuQdEo=";
+    sha256 = "sha256-AZAQSwmGNHN6ykh9ufeQLC1dEXvTt32X24MPTDh6bI8=";
  };

  nativeBuildInputs = [
--- a/pkgs/by-name/ta/tana/package.nix
+++ b/pkgs/by-name/ta/tana/package.nix
@ -55,7 +55,7 @@ let
  ];
  buildInputs = glLibs ++ libs;
  runpathPackages = glLibs ++ [ stdenv.cc.cc stdenv.cc.libc ];
-  version = "1.0.20";
+  version = "1.0.21";
 in
 stdenv.mkDerivation {
  pname = "tana";
@ -63,7 +63,7 @@ stdenv.mkDerivation {

  src = fetchurl {
    url = "https://github.com/tanainc/tana-desktop-releases/releases/download/v${version}/tana_${version}_amd64.deb";
-    hash = "sha256-fJiAqPppPoIN4gT54YMgbf/Fe9eVgRYHU6q6Yopl46I=";
+    hash = "sha256-NjBJz1zHLnWLWTxgSZwnmuZr2FbHuYLxynRG8jGMP+0=";
  };

  nativeBuildInputs = [
--- a/pkgs/by-name/ta/tart/package.nix
+++ b/pkgs/by-name/ta/tart/package.nix
@ -12,11 +12,11 @@
 }:
 stdenvNoCC.mkDerivation (finalAttrs: {
  pname = "tart";
-  version = "2.20.2";
+  version = "2.24.0";

  src = fetchurl {
-    url = "https://github.com/cirruslabs/tart/releases/download/${finalAttrs.version}/tart-arm64.tar.gz";
-    hash = "sha256-caHuBTRpbmFbmTlDRnxZyGM6F95iKjMhKbPTez5Hecc=";
+    url = "https://github.com/cirruslabs/tart/releases/download/${finalAttrs.version}/tart.tar.gz";
+    hash = "sha256-5GBn5jWT3d/PidVvmWgfxGTuk72an6WbtRtR/5XHOzk=";
  };
  sourceRoot = ".";

@ -46,7 +46,10 @@ stdenvNoCC.mkDerivation (finalAttrs: {
      aduh95
    ];
    mainProgram = finalAttrs.pname;
-    platforms = [ "aarch64-darwin" ];
+    platforms = [
+      "aarch64-darwin"
+      "x86_64-darwin"
+    ];
    sourceProvenance = with sourceTypes; [ binaryNativeCode ];
  };
 })
--- a/pkgs/by-name/v2/v2ray-geoip/package.nix
+++ b/pkgs/by-name/v2/v2ray-geoip/package.nix
@ -3,21 +3,19 @@
  stdenvNoCC,
  fetchFromGitHub,
  pkgsBuildBuild,
-  jq,
-  moreutils,
  dbip-country-lite,
 }:

 let
  generator = pkgsBuildBuild.buildGoModule rec {
    pname = "v2ray-geoip";
-    version = "202501160051";
+    version = "202501190004";

    src = fetchFromGitHub {
      owner = "v2fly";
      repo = "geoip";
      tag = version;
-      hash = "sha256-WSi7xsjKqQT37lzkOY1WZwvx5RXNKO3aMwnMiMBwMdA=";
+      hash = "sha256-l5gz3w/80o2UwexzcJ1ALhQMcwqor9m/0RG3WOBeVAc=";
    };

    vendorHash = "sha256-nvJsifXF6u3eWqd9X0kGZxASEs/LX2dQraZAwgnw060=";
@ -29,32 +27,20 @@ let
      maintainers = with lib.maintainers; [ nickcao ];
    };
  };
-  input = {
-    type = "maxmindMMDB";
-    action = "add";
-    args = {
-      uri = dbip-country-lite.mmdb;
-    };
-  };
 in

 stdenvNoCC.mkDerivation {
  inherit (generator) pname src;
  inherit (dbip-country-lite) version;

-  nativeBuildInputs = [
-    jq
-    moreutils
-  ];
-
-  postPatch = ''
-    jq '.input[0] |= ${builtins.toJSON input}' config.json | sponge config.json
-  '';
+  nativeBuildInputs = [ generator ];

  buildPhase = ''
    runHook preBuild

-    ${generator}/bin/geoip
+    mkdir -p db-ip
+    ln -s ${dbip-country-lite.mmdb} ./db-ip/dbip-country-lite.mmdb
+    geoip

    runHook postBuild
  '';
--- a/pkgs/by-name/wh/whoami/package.nix
+++ b/pkgs/by-name/wh/whoami/package.nix
@ -6,16 +6,16 @@

 buildGoModule rec {
  pname = "whoami";
-  version = "1.10.3";
+  version = "1.10.4";

  src = fetchFromGitHub {
    owner = "traefik";
    repo = "whoami";
    rev = "v${version}";
-    hash = "sha256-wzxgmysqn4aWAZEaMjMwHdHLe4UZ4nwdNFJw5X7fuKQ=";
+    hash = "sha256-T5oUIJ6ELfPNd8JW5hUXV6bRUGVRD0IgHJ34ioR4sMs=";
  };

-  vendorHash = "sha256-qDfkYIAymkFUtbKka9OLoYjT+S9KhOra2UtOvhoz5Mw=";
+  vendorHash = "sha256-0Qxw+MUYVgzgWB8vi3HBYtVXSq/btfh4ZfV/m1chNrA=";

  ldflags = [ "-s" ];

--- a/pkgs/by-name/wh/whoogle-search/package.nix
+++ b/pkgs/by-name/wh/whoogle-search/package.nix
@ -7,13 +7,13 @@

 python3Packages.buildPythonApplication rec {
  pname = "whoogle-search";
-  version = "0.9.1";
+  version = "0.9.2";
  pyproject = true;

  src = fetchPypi {
    pname = "whoogle_search";
    inherit version;
-    hash = "sha256-4i/p18tu5q4yRBKQHRAyXaxYcPORbU9KyIzF2yW9VCk=";
+    hash = "sha256-Vp59n8o6hq4q15nuQguLGvQhYWrXpR6ZjDnaBCV4I4M=";
  };

  build-system = with python3Packages; [ setuptools ];
--- a/pkgs/by-name/ze/zed-editor/package.nix
+++ b/pkgs/by-name/ze/zed-editor/package.nix
@ -95,7 +95,7 @@ let
 in
 rustPlatform.buildRustPackage rec {
  pname = "zed-editor";
-  version = "0.169.2";
+  version = "0.169.3";

  outputs = [ "out" ] ++ lib.optional buildRemoteServer "remote_server";

@ -103,7 +103,7 @@ rustPlatform.buildRustPackage rec {
    owner = "zed-industries";
    repo = "zed";
    tag = "v${version}";
-    hash = "sha256-IdJVWsHWMzE0AZxFy6jOmquc2jFeozNDdAhbB3fFMwk=";
+    hash = "sha256-F7R3GDjz5I82CqupVcTvhR+wvANAcxjIDDJ8azVTtfY=";
  };

  patches = [
@ -123,7 +123,7 @@ rustPlatform.buildRustPackage rec {
  '';

  useFetchCargoVendor = true;
-  cargoHash = "sha256-0zH5J3nvBpqD22nFzX98MBoTtNDpWS4NSSMcT1DB2SM=";
+  cargoHash = "sha256-yuf2NNnclaMKXJnbg+SC7xqcgkf4JT36GqWXNBNZUCI=";

  nativeBuildInputs =
    [
--- a/pkgs/desktops/lomiri/development/trust-store/1001-treewide-Switch-to-glog-CMake-module.patch
+++ b/pkgs/desktops/lomiri/development/trust-store/1001-treewide-Switch-to-glog-CMake-module.patch
@ -0,0 +1,57 @@
+From dbd44fbdc580a83ce7fb67fe8d2c87acee087cb0 Mon Sep 17 00:00:00 2001
+From: OPNA2608 <opna2608@protonmail.com>
+Date: Mon, 20 Jan 2025 19:25:00 +0100
+Subject: [PATCH] treewide: Switch to glog CMake module
+
+---
+ CMakeLists.txt     | 5 ++---
+ src/CMakeLists.txt | 2 +-
+ 2 files changed, 3 insertions(+), 4 deletions(-)
+
+diff --git a/CMakeLists.txt b/CMakeLists.txt
+index 6f03c1c..b58d8ab 100644
+--- a/CMakeLists.txt
+++ b/CMakeLists.txt
+@@ -38,8 +38,9 @@ IF(CMAKE_BUILD_TYPE MATCHES [cC][oO][vV][eE][rR][aA][gG][eE])
+   SET(CMAKE_SHARED_LINKER_FLAGS "${CMAKE_SHARED_LINKER_FLAGS} -ftest-coverage -fprofile-arcs" )
+ ENDIF(CMAKE_BUILD_TYPE MATCHES [cC][oO][vV][eE][rR][aA][gG][eE])
+ 
+-find_package(PkgConfig)
+find_package(PkgConfig REQUIRED)
+ find_package(Boost COMPONENTS filesystem program_options system REQUIRED)
+find_package(glog REQUIRED)
+ 
+ add_subdirectory(3rd_party/xdg)
+ 
+@@ -56,7 +57,6 @@ if (TRUST_STORE_MIR_AGENT_ENABLED)
+   )
+ endif()
+ 
+-pkg_check_modules(GLOG libglog REQUIRED)
+ pkg_check_modules(PROCESS_CPP process-cpp REQUIRED)
+ 
+ include(CTest)
+@@ -66,7 +66,6 @@ include_directories(
+   3rd_party/xdg
+ 
+   ${GFLAGS_INCLUDE_DIRS}
+-  ${GLOG_INCLUDE_DIRS}
+   ${PROCESS_CPP_INCLUDE_DIRS}
+ )
+ 
+diff --git a/src/CMakeLists.txt b/src/CMakeLists.txt
+index ac87e7f..416549c 100644
+--- a/src/CMakeLists.txt
+++ b/src/CMakeLists.txt
+@@ -211,7 +211,7 @@ target_link_libraries(
+   ${Boost_LIBRARIES}
+   ${DBUS_LIBRARIES}
+   ${GFLAGS_LDFLAGS}
+-  ${GLOG_LDFLAGS}
+  glog::glog
+   ${GLIB_LDFLAGS}
+   ${GOBJECT_LDFLAGS}
+   ${LIBAPPARMOR_LDFLAGS}
+-- 
+2.47.1
+
--- a/pkgs/desktops/lomiri/development/trust-store/default.nix
+++ b/pkgs/desktops/lomiri/development/trust-store/default.nix
@ -5,7 +5,9 @@
  fetchpatch,
  gitUpdater,
  testers,
-  boost,
+  # dbus-cpp not compatible with Boost 1.87
+  # https://gitlab.com/ubports/development/core/lib-cpp/dbus-cpp/-/issues/8
+  boost186,
  cmake,
  cmake-extras,
  dbus,
@ -50,6 +52,10 @@ stdenv.mkDerivation (finalAttrs: {
      url = "https://gitlab.com/ubports/development/core/trust-store/-/commit/569f6b35d8bcdb2ae5ff84549cd92cfc0899675b.patch";
      hash = "sha256-3lrdVIzscXGiLKwftC5oECICVv3sBoS4UedfRHx7uOs=";
    })
+
+    # Fix compatibility with glog 0.7.x
+    # Remove when https://gitlab.com/ubports/development/core/trust-store/-/merge_requests/18 merged & in release
+    ./1001-treewide-Switch-to-glog-CMake-module.patch
  ];

  postPatch =
@ -79,7 +85,7 @@ stdenv.mkDerivation (finalAttrs: {
  ];

  buildInputs = [
-    boost
+    boost186
    cmake-extras
    dbus-cpp
    glog
--- a/pkgs/development/compilers/gcl/default.nix
+++ b/pkgs/development/compilers/gcl/default.nix
@ -61,5 +61,6 @@ stdenv.mkDerivation rec {
    maintainers = lib.teams.lisp.members;
    license = licenses.gpl2;
    platforms = platforms.linux;
+    broken = true; # 2025-01-21; to check after 2.7.0 is tagged
  };
 }
--- a/pkgs/development/compilers/llvm/common/default.nix
+++ b/pkgs/development/compilers/llvm/common/default.nix
@ -317,20 +317,6 @@ let
      };
  };

-  lldbPlugins = lib.makeExtensible (
-    lldbPlugins:
-    let
-      callPackage = newScope (
-        lldbPlugins
-        // {
-          inherit stdenv;
-          inherit (tools) lldb;
-        }
-      );
-    in
-    lib.recurseIntoAttrs { llef = callPackage ./lldb-plugins/llef.nix { }; }
-  );
-
  tools = lib.makeExtensible (
    tools:
    let
@ -671,6 +657,14 @@ let
          );
      };

+      lldbPlugins = lib.makeExtensible (
+        lldbPlugins:
+        let
+          callPackage = newScope ( lldbPlugins // tools // args // metadata );
+        in
+        lib.recurseIntoAttrs { llef = callPackage ./lldb-plugins/llef.nix { }; }
+      );
+
      lldb = callPackage ./lldb.nix (
        {
          patches =
@ -1222,7 +1216,7 @@ let
  noExtend = extensible: lib.attrsets.removeAttrs extensible [ "extend" ];
 in
 {
-  inherit tools libraries lldbPlugins;
+  inherit tools libraries;
  inherit (metadata) release_version;
 }
 // (noExtend libraries)
--- a/pkgs/development/libraries/opencsg/default.nix
+++ b/pkgs/development/libraries/opencsg/default.nix
@ -15,11 +15,11 @@
 }:

 stdenv.mkDerivation rec {
-  version = "1.6.0";
+  version = "1.7.0";
  pname = "opencsg";
  src = fetchurl {
    url = "http://www.opencsg.org/OpenCSG-${version}.tar.gz";
-    hash = "sha256-v4+4Dj4M4R2H3XjdFaDehy27iXLYf1+Jz/xGHvrUe+g=";
+    hash = "sha256-uJLezIGp5nwsTSXFOZ1XbY93w7DAUmBgZ0MkPIZTnfg=";
  };

  nativeBuildInputs = [ qmake ] ++ lib.optional stdenv.hostPlatform.isDarwin fixDarwinDylibNames;
--- a/pkgs/development/php-packages/composer/default.nix
+++ b/pkgs/development/php-packages/composer/default.nix
@ -16,13 +16,13 @@

 stdenvNoCC.mkDerivation (finalAttrs: {
  pname = "composer";
-  version = "2.8.4";
+  version = "2.8.5";

  # Hash used by ../../../build-support/php/pkgs/composer-phar.nix to
  # use together with the version from this package to keep the
  # bootstrap phar file up-to-date together with the end user composer
  # package.
-  passthru.pharHash = "sha256-xMTi4b6rDqBOC9BCpdu6n+2h+/XtoNNiA5WO3TQ8Coo=";
+  passthru.pharHash = "sha256-nO8YIS4iI1GutHa4HeeypTg/d1M2R0Rnv1x8z+hKsMw=";

  composer = callPackage ../../../build-support/php/pkgs/composer-phar.nix {
    inherit (finalAttrs) version;
@ -33,19 +33,9 @@ stdenvNoCC.mkDerivation (finalAttrs: {
    owner = "composer";
    repo = "composer";
    tag = finalAttrs.version;
-    hash = "sha256-m4CfWWbrmMN0j27XaMx/KRbFjpW5iMMNUlAtzlrorJc=";
+    hash = "sha256-/E/fXh+jefPwzsADpmGyrJ+xqW5CSPNok0DVLD1KZDY=";
  };

-  patches = [
-    # Fix an issue preventing reproducible builds
-    # This patch should be removed at the next release (2.8.5)
-    # More information at https://github.com/composer/composer/pull/12090
-    (fetchpatch {
-      url = "https://github.com/composer/composer/commit/7b1e983ce9a0b30a6369cda11a7d61cca9c1ce46.patch";
-      hash = "sha256-veBdfZxzgL/R3P87GpvxQc+es3AdpaKSzCX0DCzH63U=";
-    })
-  ];
-
  nativeBuildInputs = [ makeBinaryWrapper ];

  buildInputs = [ php ];
@ -53,7 +43,7 @@ stdenvNoCC.mkDerivation (finalAttrs: {
  vendor = stdenvNoCC.mkDerivation {
    pname = "${finalAttrs.pname}-vendor";

-    inherit (finalAttrs) src version patches;
+    inherit (finalAttrs) src version;

    nativeBuildInputs = [
      cacert
@ -97,7 +87,7 @@ stdenvNoCC.mkDerivation (finalAttrs: {

    outputHashMode = "recursive";
    outputHashAlgo = "sha256";
-    outputHash = "sha256-0VbIaOuXeBNRd41q4Ogde8/B4hApueb5FeZ8cGHwB7s=";
+    outputHash = "sha256-UcMB0leKqD8cXeExXpjDgPvF8pfhGXnCR0EN4FVWouw=";
  };

  installPhase = ''
--- a/pkgs/development/python-modules/aioesphomeapi/default.nix
+++ b/pkgs/development/python-modules/aioesphomeapi/default.nix
@ -26,7 +26,7 @@

 buildPythonPackage rec {
  pname = "aioesphomeapi";
-  version = "28.0.0";
+  version = "28.0.1";
  pyproject = true;

  disabled = pythonOlder "3.9";
@ -35,7 +35,7 @@ buildPythonPackage rec {
    owner = "esphome";
    repo = "aioesphomeapi";
    tag = "v${version}";
-    hash = "sha256-vMqDxg2BV9/g5FquejnT/Rsvwjhdh01K2LxiT355p1U=";
+    hash = "sha256-MAlgr+DaJWQnO4Y8KesP/d9aCRbSjUb9ciuvR5DHz+w=";
  };

  build-system = [
--- a/pkgs/development/python-modules/holidays/default.nix
+++ b/pkgs/development/python-modules/holidays/default.nix
@ -14,7 +14,7 @@

 buildPythonPackage rec {
  pname = "holidays";
-  version = "0.64";
+  version = "0.65";
  pyproject = true;

  disabled = pythonOlder "3.8";
@ -23,7 +23,7 @@ buildPythonPackage rec {
    owner = "vacanza";
    repo = "python-holidays";
    tag = "v${version}";
-    hash = "sha256-rPQr7nyouBepTi4tW0+wrbROYyWo92KkZUI6ff5jl7I=";
+    hash = "sha256-ykfcIWTRwYntp0cgrtNdgOH9y8P4TxayFPKRbo+5cI8=";
  };

  build-system = [
--- a/pkgs/development/python-modules/manim/default.nix
+++ b/pkgs/development/python-modules/manim/default.nix
@ -2,26 +2,26 @@
  lib,
  buildPythonPackage,
  fetchFromGitHub,
-  poetry-core,
-  pytest-xdist,
-  pytestCheckHook,
-  pythonOlder,
-
-  cairo,
-  ffmpeg,
  texliveInfraOnly,

+  # build-system
+  poetry-core,
+
+  # buildInputs
+  cairo,
+
+  # dependencies
+  av,
+  beautifulsoup4,
  click,
  cloup,
  decorator,
  isosurfaces,
-  jupyterlab,
  manimpango,
  mapbox-earcut,
  moderngl,
  moderngl-window,
  networkx,
-  notebook,
  numpy,
  pillow,
  pycairo,
@ -36,6 +36,17 @@
  tqdm,
  typing-extensions,
  watchdog,
+
+  # optional-dependencies
+  jupyterlab,
+  notebook,
+
+  # tests
+  ffmpeg,
+  pytest-cov-stub,
+  pytest-xdist,
+  pytestCheckHook,
+  versionCheckHook,
 }:

 let
@ -175,41 +186,26 @@ in
 buildPythonPackage rec {
  pname = "manim";
  pyproject = true;
-  version = "0.18.1";
-  disabled = pythonOlder "3.9";
+  version = "0.19.0";

  src = fetchFromGitHub {
    owner = "ManimCommunity";
    repo = "manim";
    tag = "v${version}";
-    hash = "sha256-o+Wl3NMK6yopcsRVFtZuUE9c1GABa5d8rbQNHDJ4OiQ=";
+    hash = "sha256-eQgp/GwKsfQA1ZgqfB3HF2ThEgH3Fbn9uAtcko9pkjs=";
  };

  build-system = [
    poetry-core
  ];

-  pythonRelaxDeps = [
-    "cloup"
-    "isosurfaces"
-    "pillow"
-    "skia-pathops"
-    "watchdog"
-  ];
-
  patches = [ ./pytest-report-header.patch ];

-  postPatch = ''
-    substituteInPlace pyproject.toml \
-      --replace "--no-cov-on-fail --cov=manim --cov-report xml --cov-report term" ""
-
-    substituteInPlace manim/_config/default.cfg \
-      --replace "ffmpeg_executable = ffmpeg" "ffmpeg_executable = ${lib.getExe ffmpeg}"
-  '';
-
  buildInputs = [ cairo ];

  dependencies = [
+    av
+    beautifulsoup4
    click
    cloup
    decorator
@ -257,16 +253,19 @@ buildPythonPackage rec {
  nativeCheckInputs = [
    ffmpeg
    manim-tinytex
+    pytest-cov-stub
    pytest-xdist
    pytestCheckHook
+    versionCheckHook
  ];
+  versionCheckProgramArg = [ "--version" ];

  # about 55 of ~600 tests failing mostly due to demand for display
  disabledTests = import ./failing_tests.nix;

  pythonImportsCheck = [ "manim" ];

-  meta = with lib; {
+  meta = {
    description = "Animation engine for explanatory math videos - Community version";
    longDescription = ''
      Manim is an animation engine for explanatory math videos. It's used to
@ -274,8 +273,9 @@ buildPythonPackage rec {
      3Blue1Brown on YouTube. This is the community maintained version of
      manim.
    '';
+    changelog = "https://docs.manim.community/en/latest/changelog/${version}-changelog.html";
    homepage = "https://github.com/ManimCommunity/manim";
-    license = licenses.mit;
+    license = lib.licenses.mit;
    maintainers = [ ];
  };
 }
--- a/pkgs/development/python-modules/manim/pytest-report-header.patch
+++ b/pkgs/development/python-modules/manim/pytest-report-header.patch
@ -1,17 +1,26 @@
-diff --git a/conftest.py b/conftest.py
-index dacb730a..149c6702 100644
--- a/conftest.py
-+++ b/conftest.py
-@@ -33,17 +33,3 @@ def temp_media_dir(tmpdir, monkeypatch, request):
-         with tempconfig({"media_dir": str(tmpdir)}):
-             assert config.media_dir == str(tmpdir)
-             yield tmpdir
-
-
+diff --git a/tests/conftest.py b/tests/conftest.py
+index 4de34bbb..07b4bea6 100644
+--- a/tests/conftest.py
+++ b/tests/conftest.py
+@@ -4,31 +4,11 @@ import logging
+ import sys
+ from pathlib import Path
+ 
+-import cairo
+-import moderngl
+ import pytest
+ 
+ import manim
+ 
+ 
 -def pytest_report_header(config):
-    ctx = moderngl.create_standalone_context()
-    info = ctx.info
-    ctx.release()
+-    try:
+-        ctx = moderngl.create_standalone_context()
+-        info = ctx.info
+-        ctx.release()
+-    except Exception as e:
+-        raise Exception("Error while creating moderngl context") from e
+-
 -    return (
 -        f"\nCairo Version: {cairo.cairo_version()}",
 -        "\nOpenGL information",
@ -20,3 +29,8 @@ index dacb730a..149c6702 100644
 -        f"renderer: {info['GL_RENDERER'].strip()}",
 -        f"version: {info['GL_VERSION'].strip()}\n",
 -    )
+-
+-
+ def pytest_addoption(parser):
+     parser.addoption(
+         "--skip_slow",
--- a/pkgs/development/python-modules/publicsuffixlist/default.nix
+++ b/pkgs/development/python-modules/publicsuffixlist/default.nix
@ -11,14 +11,14 @@

 buildPythonPackage rec {
  pname = "publicsuffixlist";
-  version = "1.0.2.20250117";
+  version = "1.0.2.20250121";
  pyproject = true;

  disabled = pythonOlder "3.7";

  src = fetchPypi {
    inherit pname version;
-    hash = "sha256-7jkUrZDmx9umNrUlzzXDdJWsDtfHKg/u8dfDNtVgiCU=";
+    hash = "sha256-LVbIYZ0rkGmZKbtnenZF5elK9wnr3A+b24NZXX3pxUM=";
  };

  build-system = [ setuptools ];
--- a/pkgs/development/python-modules/recurring-ical-events/default.nix
+++ b/pkgs/development/python-modules/recurring-ical-events/default.nix
@ -16,7 +16,7 @@

 buildPythonPackage rec {
  pname = "recurring-ical-events";
-  version = "3.4.0";
+  version = "3.4.1";

  disabled = pythonOlder "3.8";

@ -26,7 +26,7 @@ buildPythonPackage rec {
    owner = "niccokunzmann";
    repo = "python-recurring-ical-events";
    tag = "v${version}";
-    hash = "sha256-+spbfeJ1hMMQqLj9IIu2xj4J6y1r2f94b4NK8vcDF5M=";
+    hash = "sha256-JhGKowFtRJwLj/5J1lNpgMTl1d+oWsmV4wI3hfOW5io=";
  };

  build-system = [ setuptools ];
--- a/pkgs/development/python-modules/sagemaker/default.nix
+++ b/pkgs/development/python-modules/sagemaker/default.nix
@ -40,14 +40,14 @@

 buildPythonPackage rec {
  pname = "sagemaker";
-  version = "2.237.2";
+  version = "2.237.3";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "aws";
    repo = "sagemaker-python-sdk";
    tag = "v${version}";
-    hash = "sha256-cNBPuXoViHy03ZMBrF3+xeMSUpovi1lloXizBvgNJmw=";
+    hash = "sha256-eQ+5WFEobJUHdIK317A94/ro2H1xU738j3b7Z6iddlk=";
  };

  build-system = [
--- a/pkgs/development/python-modules/testcontainers/default.nix
+++ b/pkgs/development/python-modules/testcontainers/default.nix
@ -16,14 +16,14 @@

 buildPythonPackage rec {
  pname = "testcontainers";
-  version = "4.9.0";
+  version = "4.9.1";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "testcontainers";
    repo = "testcontainers-python";
    tag = "testcontainers-v${version}";
-    hash = "sha256-E0g0A3RJY2l/0N6t+/OSXB+Xm2O/9y7FkscXfGm/nKw=";
+    hash = "sha256-qbOtsENvPl+l2ODGyuxmiAoJwU4EIACu1GW5GPP207c=";
  };

  postPatch = ''
--- a/pkgs/development/python-modules/transformers/default.nix
+++ b/pkgs/development/python-modules/transformers/default.nix
@ -58,14 +58,14 @@

 buildPythonPackage rec {
  pname = "transformers";
-  version = "4.48.0";
+  version = "4.48.1";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "huggingface";
    repo = "transformers";
    tag = "v${version}";
-    hash = "sha256-jh2bMmvTC0G0kLJl7xXpsvXvBmlbZEDA88AfosoE9sA=";
+    hash = "sha256-doYvjwajwXqqaKZ363p2SE//9eupfkwrG66j0iUAnU0=";
  };

  build-system = [ setuptools ];
--- a/pkgs/development/tools/continuous-integration/woodpecker/cli.nix
+++ b/pkgs/development/tools/continuous-integration/woodpecker/cli.nix
@ -18,6 +18,6 @@ buildGoModule {

  meta = common.meta // {
    description = "Command line client for the Woodpecker Continuous Integration server";
-    mainProgram = "woodpecker";
+    mainProgram = "woodpecker-cli";
  };
 }
--- a/pkgs/development/tools/continuous-integration/woodpecker/common.nix
+++ b/pkgs/development/tools/continuous-integration/woodpecker/common.nix
@ -1,7 +1,7 @@
 { lib, fetchzip }:
 let
-  version = "2.8.3";
-  srcHash = "sha256-/Ozzibz2BhVSxQeH9tg3cC5uVl0gEA/Hw2AMOELW/I8=";
+  version = "3.0.1";
+  srcHash = "sha256-BJHvZhi/jjVH/NZKqGwL2ZiYGxM72EtJ0KTO21IigAY=";
  # The tarball contains vendored dependencies
  vendorHash = null;
 in
@ -18,18 +18,16 @@ in
    cd $out/bin
    for f in *; do
      if [ "$f" = cli ]; then
-        mv -- "$f" "woodpecker"
        # Issue a warning to the user if they call the deprecated executable
-        cat >woodpecker-cli << EOF
+        cat >woodpecker << EOF
    #!/bin/sh
-    echo 'WARNING: calling \`woodpecker-cli\` is deprecated, use \`woodpecker\` instead.' >&2
-    $out/bin/woodpecker "\$@"
+    echo 'WARNING: calling \`woodpecker\` is deprecated, use \`woodpecker-cli\` instead.' >&2
+    $out/bin/woodpecker-cli "\$@"
    EOF
-        chmod +x woodpecker-cli
-        patchShebangs woodpecker-cli
-      else
-        mv -- "$f" "woodpecker-$f"
+        chmod +x woodpecker
+        patchShebangs woodpecker
      fi
+        mv -- "$f" "woodpecker-$f"
    done
    cd -
  '';
@ -37,7 +35,7 @@ in
  ldflags = [
    "-s"
    "-w"
-    "-X go.woodpecker-ci.org/woodpecker/v2/version.Version=${version}"
+    "-X go.woodpecker-ci.org/woodpecker/v3/version.Version=${version}"
  ];

  meta = with lib; {
--- a/pkgs/os-specific/linux/kernel/update-zen.py
+++ b/pkgs/os-specific/linux/kernel/update-zen.py
@ -64,24 +64,24 @@ def update_file(relpath, variant, version, suffix, sha256):
        for line in f:
            result = line
            result = re.sub(
-                fr'^      version = ".+"; #{variant}',
-                f'      version = "{version}"; #{variant}',
+                fr'^      version = ".+"; # {variant}',
+                f'      version = "{version}"; # {variant}',
                result)
            result = re.sub(
-                fr'^      suffix = ".+"; #{variant}',
-                f'      suffix = "{suffix}"; #{variant}',
+                fr'^      suffix = ".+"; # {variant}',
+                f'      suffix = "{suffix}"; # {variant}',
                result)
            result = re.sub(
-                fr'^      sha256 = ".+"; #{variant}',
-                f'      sha256 = "{sha256}"; #{variant}',
+                fr'^      sha256 = ".+"; # {variant}',
+                f'      sha256 = "{sha256}"; # {variant}',
                result)
            print(result, end='')


 def read_file(relpath, variant):
    file_path = os.path.join(DIR, relpath)
-    re_version = re.compile(fr'^\s*version = "(.+)"; #{variant}')
-    re_suffix = re.compile(fr'^\s*suffix = "(.+)"; #{variant}')
+    re_version = re.compile(fr'^\s*version = "(.+)"; # {variant}')
+    re_suffix = re.compile(fr'^\s*suffix = "(.+)"; # {variant}')
    version = None
    suffix = None
    with fileinput.FileInput(file_path, mode='r') as f:
--- a/pkgs/os-specific/linux/kernel/zen-kernels.nix
+++ b/pkgs/os-specific/linux/kernel/zen-kernels.nix
@ -12,16 +12,16 @@ let
  variants = {
    # ./update-zen.py zen
    zen = {
-      version = "6.12.2"; # zen
+      version = "6.12.10"; # zen
      suffix = "zen1"; # zen
-      sha256 = "0a6anmfm6495j6lwlywr62ghpwdvbdn54bl5baya5jz7vfqc1ghj"; # zen
+      sha256 = "1kd3bcnhlarnrpl87mrdb5r9k2jdq7m8607ai847dkmncw7q2d1q"; # zen
      isLqx = false;
    };
    # ./update-zen.py lqx
    lqx = {
-      version = "6.12.2"; # lqx
-      suffix = "lqx3"; # lqx
-      sha256 = "18ibc0dz70vxb61mzdhbhbjg0kfxgcsrl3zdki0cqlhcvfxwk19h"; # lqx
+      version = "6.12.10"; # lqx
+      suffix = "lqx1"; # lqx
+      sha256 = "0sg905xdyy9wmjqv6d8p5jr307j767wgk27gzxhq8dnb2dz2yg5v"; # lqx
      isLqx = true;
    };
  };
--- a/pkgs/servers/monitoring/prometheus/artifactory-exporter.nix
+++ b/pkgs/servers/monitoring/prometheus/artifactory-exporter.nix
@ -7,14 +7,14 @@

 buildGoModule rec {
  pname = "artifactory_exporter";
-  version = "1.14.0";
+  version = "1.15.0";
  rev = "v${version}";

  src = fetchFromGitHub {
    owner = "peimanja";
    repo = pname;
    rev = rev;
-    hash = "sha256-+CCUSI7Rh9fENzsg7rpI01Cm++kafd1nGgpyFRt20Ug=";
+    hash = "sha256-5aE+ga8tK7EpkcH1exmIdROCnZ49Fz/GGkk993uYcGY=";
  };

  vendorHash = "sha256-CQ7JvXcutj63UzaYk/jbmd9G2whN48Xv1PCllaI9Nuo=";
--- a/pkgs/servers/monitoring/prometheus/sql-exporter.nix
+++ b/pkgs/servers/monitoring/prometheus/sql-exporter.nix
@ -9,13 +9,13 @@

 buildGoModule rec {
  pname = "sql_exporter";
-  version = "0.5.8";
+  version = "0.5.9";

  src = fetchFromGitHub {
    owner = "justwatchcom";
    repo = pname;
    rev = "v${version}";
-    sha256 = "sha256-Uf5Itclc43E8tsgS8rR8F2Dq9gNVIagoB5KfEqqd7MI=";
+    sha256 = "sha256-KygxnNbElzRtVwjKmlbgdCxO3oEYssfFl5UAk5+F50c=";
  };

  vendorHash = null;
--- a/pkgs/servers/varnish/default.nix
+++ b/pkgs/servers/varnish/default.nix
@ -54,7 +54,7 @@ let
        ++ lib.optional stdenv.hostPlatform.isDarwin libunwind
        ++ lib.optional stdenv.hostPlatform.isLinux jemalloc;

-      buildFlags = [ "localstatedir=/var/spool" ];
+      buildFlags = [ "localstatedir=/var/run" ];

      postPatch = ''
        substituteInPlace bin/varnishtest/vtc_main.c --replace /bin/rm "${coreutils}/bin/rm"
@ -83,7 +83,7 @@ let
        description = "Web application accelerator also known as a caching HTTP reverse proxy";
        homepage = "https://www.varnish-cache.org";
        license = licenses.bsd2;
-        maintainers = [ ];
+        maintainers = lib.teams.flyingcircus.members;
        platforms = platforms.unix;
      };
    };
@ -99,4 +99,9 @@ in
    version = "7.5.0";
    hash = "sha256-/KYbmDE54arGHEVG0SoaOrmAfbsdgxRXHjFIyT/3K10=";
  };
+  # EOL 2025-09-15
+  varnish76 = common {
+    version = "7.6.1";
+    hash = "sha256-Wpu1oUn/J4Z7VKZs4W0qS5Pt/6VHPLh8nHH3aZz4Rbo=";
+  };
 }
--- a/pkgs/servers/varnish/modules.nix
+++ b/pkgs/servers/varnish/modules.nix
@ -59,4 +59,8 @@ in
    version = "0.24.0";
    hash = "sha256-2MfcrhhkBz9GyQxEWzjipdn1CBEqnCvC3t1G2YSauak=";
  };
+  modules25 = common {
+    version = "0.25.0";
+    hash = "sha256-m/7moizVyvoP8xnpircAFVUqCmCfTGkgVyRc6zkdVsk=";
+  };
 }
--- a/pkgs/servers/varnish/packages.nix
+++ b/pkgs/servers/varnish/packages.nix
@ -3,6 +3,7 @@
  callPackage,
  varnish60,
  varnish75,
+  varnish76,
 }:
 {
  varnish60Packages = rec {
@ -23,4 +24,8 @@
    varnish = varnish75;
    modules = (callPackages ./modules.nix { inherit varnish; }).modules24;
  };
+  varnish76Packages = rec {
+    varnish = varnish76;
+    modules = (callPackages ./modules.nix { inherit varnish; }).modules25;
+  };
 }
--- a/pkgs/servers/web-apps/matomo/default.nix
+++ b/pkgs/servers/web-apps/matomo/default.nix
@ -1,135 +0,0 @@
-{
-  lib,
-  stdenv,
-  fetchurl,
-  makeWrapper,
-  php,
-  nixosTests,
-}:
-
-let
-  versions = {
-    matomo = {
-      version = "5.2.1";
-      hash = "sha256-5glMwwIG0Uo8bu904u40FUa+yaUlrQe1nUCkv9/ATks=";
-    };
-    matomo-beta = {
-      version = "5.2.1";
-      # `beta` examples: "b1", "rc1", null
-      # when updating: use null if stable version is >= latest beta or release candidate
-      beta = null;
-      hash = "sha256-5glMwwIG0Uo8bu904u40FUa+yaUlrQe1nUCkv9/ATks=";
-    };
-  };
-  common =
-    pname:
-    {
-      version,
-      hash,
-      beta ? null,
-    }:
-    stdenv.mkDerivation (finalAttrs: {
-      name = "${pname}-${finalAttrs.version}";
-      version = version + lib.optionalString (beta != null) "-${toString beta}";
-
-      src = fetchurl {
-        url = "https://builds.matomo.org/matomo-${finalAttrs.version}.tar.gz";
-        inherit hash;
-      };
-
-      nativeBuildInputs = [ makeWrapper ];
-
-      patches = [
-        # This changes the default value of the database server field
-        # from 127.0.0.1 to localhost.
-        # unix socket authentication only works with localhost,
-        # but password-based SQL authentication works with both.
-        # TODO: is upstream interested in this?
-        # -> discussion at https://github.com/matomo-org/matomo/issues/12646
-        ./make-localhost-default-database-host.patch
-        # This changes the default config for path.geoip2 so that it doesn't point
-        # to the nix store.
-        ./change-path-geoip2-5.x.patch
-      ];
-
-      # this bootstrap.php adds support for getting PIWIK_USER_PATH
-      # from an environment variable. Point it to a mutable location
-      # to be able to use matomo read-only from the nix store
-      postPatch = ''
-        cp ${./bootstrap.php} bootstrap.php
-      '';
-
-      # TODO: future versions might rename the PIWIK_… variables to MATOMO_…
-      # TODO: Move more unnecessary files from share/, especially using PIWIK_INCLUDE_PATH.
-      #       See https://forum.matomo.org/t/bootstrap-php/5926/10 and
-      #       https://github.com/matomo-org/matomo/issues/11654#issuecomment-297730843
-      installPhase = ''
-        runHook preInstall
-
-        # copy everything to share/, used as webroot folder, and then remove what's known to be not needed
-        mkdir -p $out/share
-        cp -ra * $out/share/
-        # tmp/ is created by matomo in PIWIK_USER_PATH
-        rmdir $out/share/tmp
-        # config/ needs to be accessed by PIWIK_USER_PATH anyway
-        ln -s $out/share/config $out/
-
-        makeWrapper ${php}/bin/php $out/bin/matomo-console \
-          --add-flags "$out/share/console"
-
-        runHook postInstall
-      '';
-
-      filesToFix = [
-        "misc/composer/build-xhprof.sh"
-        "misc/composer/clean-xhprof.sh"
-        "misc/cron/archive.sh"
-        "plugins/GeoIp2/config/config.php"
-        "plugins/Installation/FormDatabaseSetup.php"
-        "vendor/pear/archive_tar/sync-php4"
-        "vendor/szymach/c-pchart/coverage.sh"
-        "vendor/matomo/matomo-php-tracker/run_tests.sh"
-        "vendor/twig/twig/drupal_test.sh"
-      ];
-
-      # This fixes the consistency check in the admin interface
-      #
-      # The filesToFix list may contain files that are exclusive to only one of the versions we build
-      # make sure to test for existence to avoid erroring on an incompatible version and failing
-      postFixup = ''
-        pushd $out/share > /dev/null
-        for f in $filesToFix; do
-          if [ -f "$f" ]; then
-            length="$(wc -c "$f" | cut -d' ' -f1)"
-            hash="$(md5sum "$f" | cut -d' ' -f1)"
-            sed -i "s:\\(\"$f\"[^(]*(\\).*:\\1\"$length\", \"$hash\"),:g" config/manifest.inc.php
-          else
-            echo "INFO(files-to-fix): $f does not exist in this version"
-          fi
-        done
-        popd > /dev/null
-      '';
-
-      passthru = {
-        tests = nixosTests.matomo."${pname}";
-      };
-
-      meta = with lib; {
-        description = "Real-time web analytics application";
-        mainProgram = "matomo-console";
-        license = licenses.gpl3Plus;
-        homepage = "https://matomo.org/";
-        platforms = platforms.all;
-        maintainers =
-          with maintainers;
-          [
-            florianjacob
-            sebbel
-            twey
-            boozedog
-          ]
-          ++ teams.flyingcircus.members;
-      };
-    });
-in
-lib.mapAttrs common versions
--- a/pkgs/test/replace-vars/default.nix
+++ b/pkgs/test/replace-vars/default.nix
@ -11,7 +11,7 @@ let
  inherit (testers) testEqualContents testBuildFailure;

  mkTests =
-    callReplaceVars:
+    callReplaceVars: mkExpectation:
    lib.recurseIntoAttrs {
      succeeds = testEqualContents {
        assertion = "replaceVars-succeeds";
@ -21,13 +21,15 @@ let
          brotherhood = "shared humanity";
        };

-        expected = builtins.toFile "expected" ''
-          All human beings are born free and are the same in dignity and rights.
-          They are endowed with reason and conscience and should act towards
-          one another in a spirit of shared humanity.
+        expected = mkExpectation (
+          builtins.toFile "source.txt" ''
+            All human beings are born free and are the same in dignity and rights.
+            They are endowed with reason and conscience and should act towards
+            one another in a spirit of shared humanity.

-            -- eroosevelt@humanrights.un.org
-        '';
+              -- eroosevelt@humanrights.un.org
+          ''
+        );
      };

      # There might eventually be a usecase for this, but it's not supported at the moment.
@ -83,13 +85,15 @@ let
          brotherhood = null;
        };

-        expected = builtins.toFile "expected" ''
-          All human beings are born free and are the same in dignity and rights.
-          They are endowed with reason and conscience and should act towards
-          one another in a spirit of @brotherhood@.
+        expected = mkExpectation (
+          builtins.toFile "source.txt" ''
+            All human beings are born free and are the same in dignity and rights.
+            They are endowed with reason and conscience and should act towards
+            one another in a spirit of @brotherhood@.

-            -- eroosevelt@humanrights.un.org
-        '';
+              -- eroosevelt@humanrights.un.org
+          ''
+        );
      };

      fails-in-check-phase-with-exemption =
@ -120,13 +124,21 @@ let
    };
 in
 {
-  replaceVars = mkTests replaceVars;
-  replaceVarsWith = mkTests (
-    src: replacements:
-    replaceVarsWith {
-      inherit src replacements;
-      dir = "bin";
-      isExecutable = true;
-    }
-  );
+  replaceVars = mkTests replaceVars lib.id;
+  replaceVarsWith =
+    mkTests
+      (
+        src: replacements:
+        replaceVarsWith {
+          inherit src replacements;
+          dir = "bin";
+          isExecutable = true;
+        }
+      )
+      (
+        file:
+        runCommand "expected" { inherit file; } ''
+          install -Dm755 "$file" "$out/bin/$(stripHash "$file")"
+        ''
+      );
 }
--- a/pkgs/tools/admin/awsume/default.nix
+++ b/pkgs/tools/admin/awsume/default.nix
@ -39,12 +39,13 @@ buildPythonApplication rec {
  postPatch = ''
    patchShebangs shell_scripts
    substituteInPlace shell_scripts/{awsume,awsume.fish} --replace-fail "awsumepy" "$out/bin/awsumepy"
+    substituteInPlace awsume/configure/autocomplete.py --replace-fail "awsume-autocomplete" "$out/bin/awsume-autocomplete"
  '';

  postInstall = ''
    installShellCompletion --cmd awsume \
      --bash <(PYTHONPATH=./awsume/configure ${python3}/bin/python3 -c"import autocomplete; print(autocomplete.SCRIPTS['bash'])") \
-      --zsh <(PYTHONPATH=./awsume/configure ${python3}/bin/python3 -c"import autocomplete; print(autocomplete.SCRIPTS['zsh'])") \
+      --zsh <(PYTHONPATH=./awsume/configure ${python3}/bin/python3 -c"import autocomplete; print(autocomplete.ZSH_AUTOCOMPLETE_FUNCTION)") \
      --fish <(PYTHONPATH=./awsume/configure ${python3}/bin/python3 -c"import autocomplete; print(autocomplete.SCRIPTS['fish'])") \

    rm -f $out/bin/awsume.bat
--- a/pkgs/tools/text/gawk/gawkextlib.nix
+++ b/pkgs/tools/text/gawk/gawkextlib.nix
@ -34,6 +34,9 @@ let
      extraBuildInputs ? [ ],
      doCheck ? true,
      patches ? [ ],
+      extraPostPatch ? "",
+      env ? { },
+      broken ? null,
    }:
    let
      is_extension = gawkextlib != null;
@ -50,9 +53,11 @@ let

      inherit patches;

-      postPatch = ''
-        cd ${name}
-      '';
+      postPatch =
+        ''
+          cd ${name}
+        ''
+        + extraPostPatch;

      nativeBuildInputs = [
        autoconf
@ -70,10 +75,12 @@ let
      setupHook = if is_extension then ./setup-hook.sh else null;
      inherit gawk;

+      inherit env;
+
      inherit doCheck;
      nativeCheckInputs = [ more ];

-      meta = with lib; {
+      meta = {
        homepage = "https://sourceforge.net/projects/gawkextlib/";
        description = "Dynamically loaded extension libraries for GNU AWK";
        mainProgram = "xmlgawk";
@ -85,10 +92,10 @@ let
          database, use the GD graphics library, and perform unlimited
          precision MPFR calculations.
        '';
-        license = licenses.gpl3Plus;
-        platforms = platforms.unix;
-        maintainers = with maintainers; [ tomberek ];
-      };
+        license = lib.licenses.gpl3Plus;
+        platforms = lib.platforms.unix;
+        maintainers = with lib.maintainers; [ tomberek ];
+      } // lib.optionalAttrs (broken != null) { inherit broken; };
    }
  );
  gawkextlib = buildExtension {
@ -112,11 +119,16 @@ let
    errno = buildExtension {
      inherit gawkextlib;
      name = "errno";
+      extraPostPatch = ''
+        substituteInPlace Makefile.am --replace-fail 'cpp -M' '${stdenv.cc.targetPrefix}cpp -M'
+      '';
    };
    gd = buildExtension {
      inherit gawkextlib;
      name = "gd";
      extraBuildInputs = [ gd ];
+      # GCC 14 makes this an error by default, remove when fixed upstream
+      env.NIX_CFLAGS_COMPILE = "-Wno-error=incompatible-pointer-types";
    };
    haru = buildExtension {
      inherit gawkextlib;
@ -127,6 +139,8 @@ let
        # https://github.com/libharu/libharu/commit/88271b73c68c521a49a15e3555ef00395aa40810
        ./fix-typos-corrected-in-libharu-2.4.4.patch
      ];
+      # GCC 14 makes this an error by default, remove when fixed upstream
+      env.NIX_CFLAGS_COMPILE = "-Wno-error=incompatible-pointer-types";
    };
    json = buildExtension {
      inherit gawkextlib;
@ -136,6 +150,9 @@ let
    lmdb = buildExtension {
      inherit gawkextlib;
      name = "lmdb";
+      extraPostPatch = ''
+        substituteInPlace Makefile.am --replace-fail 'cpp -M' '${stdenv.cc.targetPrefix}cpp -M'
+      '';
      extraBuildInputs = [ lmdb ];
      #  mdb_env_open(env, /dev/null)
      #! No such device
@ -175,6 +192,9 @@ let
    select = buildExtension {
      inherit gawkextlib;
      name = "select";
+      extraPostPatch = ''
+        substituteInPlace Makefile.am --replace-fail 'cpp -M' '${stdenv.cc.targetPrefix}cpp -M'
+      '';
    };
    timex = buildExtension {
      inherit gawkextlib;
@ -187,6 +207,8 @@ let
        expat
        libiconv
      ];
+      # gawk: xmlbase:14: fatal: load_ext: cannot open library `../.libs/xml.so`
+      broken = !stdenv.buildPlatform.canExecute stdenv.hostPlatform;
    };
  };
 in
--- a/pkgs/top-level/aliases.nix
+++ b/pkgs/top-level/aliases.nix
@ -839,6 +839,7 @@ mapAliases {
  mathematica10 = throw "mathematica10 has been removed as it was obsolete, broken, and depended on OpenCV 2"; # Added 2024-08-20
  mathematica11 = throw "mathematica11 has been removed as it was obsolete, broken, and depended on OpenCV 2"; # Added 2024-08-20
  matomo_5 = matomo; # Added 2024-12-12
+  matomo-beta = throw "matomo-beta has been removed as it mostly just pointed to the latest matomo release, use `matomo.overrideAttrs` to access a specific beta version instead"; # Added 2025-01-15
  matrique = throw "'matrique' has been renamed to/replaced by 'spectral'"; # Converted to throw 2024-10-17
  matrix-sliding-sync = throw "matrix-sliding-sync has been removed as matrix-synapse 114.0 and later covers its functionality"; # Added 2024-10-20
  maui-nota = libsForQt5.mauiPackages.nota; # added 2022-05-17
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@ -5474,9 +5474,9 @@ with pkgs;
  unzipNLS = lowPrio (unzip.override { enableNLS = true; });

  inherit (callPackages ../servers/varnish { })
-    varnish60 varnish75;
+    varnish60 varnish75 varnish76;
  inherit (callPackages ../servers/varnish/packages.nix { })
-    varnish60Packages varnish75Packages;
+    varnish60Packages varnish75Packages varnish76Packages;

  varnishPackages = varnish75Packages;
  varnish = varnishPackages.varnish;
@ -11875,9 +11875,6 @@ with pkgs;
  };

  tt-rss = callPackage ../servers/tt-rss { };
-  inherit (callPackages ../servers/web-apps/matomo {})
-    matomo
-    matomo-beta;

  unpackerr = callPackage ../servers/unpackerr {
    inherit (darwin.apple_sdk.frameworks) Cocoa WebKit;
--- a/pkgs/top-level/perl-packages.nix
+++ b/pkgs/top-level/perl-packages.nix
@ -22795,8 +22795,12 @@ with self; {
      hash = "sha256-RokV+joE3PZXT8lX7/SVkV4kVpQ0lwyR7o5OFFn8kRQ=";
    };
    setOutputFlags = false;
-    buildInputs = [ pkgs.which ];
+    nativeBuildInputs = [ pkgs.which ];
    patches = [ ../development/perl-modules/Socket6-sv_undef.patch ];
+    preConfigure = lib.optionalString (!stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
+      substituteInPlace configure \
+        --replace-fail 'cross_compiling=no' 'cross_compiling=yes;ipv6_cv_can_inet_ntop=yes'
+    '';
    meta = {
      description = "IPv6 related part of the C socket.h defines and structure manipulators";
      license = with lib.licenses; [ bsd3 ];
@ -27714,7 +27718,21 @@ with self; {
      # in an error with clang 16.
      ../development/perl-modules/tk-configure-implicit-int-fix.patch
    ];
-    makeMakerFlags = [ "X11INC=${pkgs.xorg.libX11.dev}/include" "X11LIB=${pkgs.xorg.libX11.out}/lib" ];
+    postPatch = ''
+      substituteInPlace pTk/mTk/additions/imgWindow.c \
+        --replace-fail '"X11/Xproto.h"' "<X11/Xproto.h>"
+      substituteInPlace PNG/zlib/Makefile.in \
+        --replace-fail '$(AR) $@' '$(AR) rc $@'
+      substituteInPlace PNG/libpng/scripts/makefile.gcc \
+        --replace-fail 'AR_RC = ar rcs' 'AR_RC = ${pkgs.stdenv.cc.targetPrefix}ar rcs'
+      substituteInPlace JPEG/jpeg/makefile.cfg \
+        --replace-fail 'AR= ar rc' 'AR= ${pkgs.stdenv.cc.targetPrefix}ar rc'
+    '';
+    makeMakerFlags = [
+      "AR=${pkgs.stdenv.cc.targetPrefix}ar"
+      "X11INC=${pkgs.xorg.libX11.dev}/include"
+      "X11LIB=${pkgs.xorg.libX11.out}/lib"
+    ];
    buildInputs = [ pkgs.xorg.libX11 pkgs.libpng ];
    env = lib.optionalAttrs stdenv.cc.isGNU {
      NIX_CFLAGS_COMPILE = toString [