Merge master into staging-next

maintainers/maintainer-list.nix

@@ -21803,6 +21803,12 @@
     github = "vector1dev";
     githubId = 127302590;
   };
+  vedantmgoyal9 = {
+    name = "Vedant Mohan Goyal";
+    matrix = "@vedantmgoyal:beeper.com";
+    github = "vedantmgoyal9";
+    githubId = 83997633;
+  };
   veehaitch = {
     name = "Vincent Haupert";
     email = "mail@vincent-haupert.de";

nixos/doc/manual/release-notes/rl-2411.section.md

@@ -35,6 +35,9 @@
   Users that want to keep PulseAudio will want to set `services.pipewire.enable = false;` and `hardware.pulseaudio.enable = true;`.
   There is currently no plan to fully deprecate and remove PulseAudio, however, PipeWire should generally be preferred for new installs.
 
+- Support for mounting filesystems from block devices protected with [dm-verity](https://docs.kernel.org/admin-guide/device-mapper/verity.html)
+  was added through the `boot.initrd.systemd.dmVerity` option.
+
 ## New Modules {#sec-release-24.11-new-modules}
 
 - [TaskChampion Sync-Server](https://github.com/GothenburgBitFactory/taskchampion-sync-server), a [Taskwariror 3](https://taskwarrior.org/docs/upgrade-3/) sync server, replacing Taskwarrior 2's sync server named [`taskserver`](https://github.com/GothenburgBitFactory/taskserver).

nixos/modules/module-list.nix

@@ -363,6 +363,7 @@
   ./security/systemd-confinement.nix
   ./security/tpm2.nix
   ./security/wrappers/default.nix
+  ./services/accessibility/orca.nix
   ./services/accessibility/speechd.nix
   ./services/admin/docuum.nix
   ./services/admin/meshcentral.nix
@@ -1621,6 +1622,7 @@
   ./system/boot/stage-2.nix
   ./system/boot/systemd.nix
   ./system/boot/systemd/coredump.nix
+  ./system/boot/systemd/dm-verity.nix
   ./system/boot/systemd/initrd-secrets.nix
   ./system/boot/systemd/initrd.nix
   ./system/boot/systemd/journald.nix

nixos/modules/security/auditd.nix

@@ -1,19 +1,29 @@
-{ config, lib, pkgs, ... }:
+{
-
+  config,
-with lib;
+  lib,
+  pkgs,
+  ...
+}:
 
 {
-  options.security.auditd.enable = mkEnableOption "the Linux Audit daemon";
+  options.security.auditd.enable = lib.mkEnableOption "the Linux Audit daemon";
 
-  config = mkIf config.security.auditd.enable {
+  config = lib.mkIf config.security.auditd.enable {
     boot.kernelParams = [ "audit=1" ];
 
     environment.systemPackages = [ pkgs.audit ];
 
     systemd.services.auditd = {
       description = "Linux Audit daemon";
-      wantedBy = [ "basic.target" ];
+      wantedBy = [ "sysinit.target" ];
-      before = [ "shutdown.target" ];
+      after = [
+        "local-fs.target"
+        "systemd-tmpfiles-setup.service"
+      ];
+      before = [
+        "sysinit.target"
+        "shutdown.target"
+      ];
       conflicts = [ "shutdown.target" ];
 
       unitConfig = {

nixos/modules/services/accessibility/orca.nix

@@ -0,0 +1,25 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+let
+  cfg = config.services.orca;
+  inherit (lib)
+    mkEnableOption
+    mkIf
+    mkPackageOption
+    ;
+in
+{
+  options.services.orca = {
+    enable = mkEnableOption "Orca screen reader";
+    package = mkPackageOption pkgs "orca" { };
+  };
+
+  config = mkIf cfg.enable {
+    environment.systemPackages = [ cfg.package ];
+    services.speechd.enable = true;
+  };
+}

nixos/modules/services/desktop-managers/plasma6.nix

@@ -245,6 +245,9 @@ in {
     xdg.portal.configPackages = mkDefault [kdePackages.xdg-desktop-portal-kde];
     services.pipewire.enable = mkDefault true;
 
+    # Enable screen reader by default
+    services.orca.enable = mkDefault true;
+
     services.displayManager = {
       sessionPackages = [kdePackages.plasma-workspace];
       defaultSession = mkDefault "plasma";

nixos/modules/services/monitoring/netdata.nix

@@ -374,14 +374,6 @@ in {
         permissions = "u+rx,g+x,o-rwx";
       };
 
-      "logs-management.plugin" = {
-        source = "${cfg.package}/libexec/netdata/plugins.d/logs-management.plugin.org";
-        capabilities = "cap_dac_read_search,cap_syslog+ep";
-        owner = cfg.user;
-        group = cfg.group;
-        permissions = "u+rx,g+x,o-rwx";
-      };
-
       "slabinfo.plugin" = {
         source = "${cfg.package}/libexec/netdata/plugins.d/slabinfo.plugin.org";
         capabilities = "cap_dac_override+ep";

nixos/modules/services/security/endlessh-go.nix

@@ -9,6 +9,8 @@ in
   options.services.endlessh-go = {
     enable = mkEnableOption "endlessh-go service";
 
+    package = mkPackageOption pkgs "endlessh-go" { };
+
     listenAddress = mkOption {
       type = types.str;
       default = "0.0.0.0";
@@ -86,7 +88,7 @@ in
         {
           Restart = "always";
           ExecStart = with cfg; concatStringsSep " " ([
-            "${pkgs.endlessh-go}/bin/endlessh-go"
+            (lib.getExe cfg.package)
             "-logtostderr"
             "-host=${listenAddress}"
             "-port=${toString port}"

nixos/modules/services/x11/desktop-managers/cinnamon.nix

@@ -172,7 +172,6 @@ in
       ] ++ utils.removePackagesByName [
         # accessibility
         onboard
-        orca
 
         # theme
         sound-theme-freedesktop
@@ -199,6 +198,8 @@ in
         })
       ];
 
+      services.orca.enable = mkDefault (notExcluded pkgs.orca);
+
       xdg.portal.configPackages = mkDefault [ pkgs.cinnamon-common ];
 
       # Override GSettings schemas

nixos/modules/services/x11/desktop-managers/gnome.nix

@@ -357,6 +357,8 @@ in
         isSystem = true;
       };
 
+      services.orca.enable = notExcluded pkgs.orca;
+
       fonts.packages = with pkgs; [
         cantarell-fonts
         dejavu_fonts
@@ -380,7 +382,6 @@ in
             pkgs.gnome-shell-extensions
             pkgs.gnome-tour # GNOME Shell detects the .desktop file on first log-in.
             pkgs.gnome-user-docs
-            pkgs.orca
             pkgs.glib # for gsettings program
             pkgs.gnome-menus
             pkgs.gtk3.out # for gtk-launch program

nixos/modules/services/x11/desktop-managers/pantheon.nix

@@ -175,6 +175,7 @@ in
         # https://gitlab.gnome.org/GNOME/mutter/-/merge_requests/1443
         pkgs.pantheon.mutter
       ];
+      services.orca.enable = mkDefault (notExcluded pkgs.orca);
       systemd.packages = with pkgs; [
         gnome-session
         pantheon.gala
@@ -211,7 +212,6 @@ in
         adwaita-icon-theme
         gtk3.out # for gtk-launch program
         onboard
-        orca # elementary/greeter#668
         sound-theme-freedesktop
         xdg-user-dirs # Update user dirs as described in https://freedesktop.org/wiki/Software/xdg-user-dirs/
       ]) ++ (with pkgs.pantheon; [

nixos/modules/services/x11/desktop-managers/plasma5.nix

@@ -357,6 +357,9 @@ in
         pkgs.media-player-info
       ];
 
+      # Enable screen reader by default
+      services.orca.enable = mkDefault true;
+
       services.displayManager.sddm = {
         theme = mkDefault "breeze";
       };

nixos/modules/system/boot/systemd/dm-verity.nix

@@ -0,0 +1,65 @@
+{ config, lib, ... }:
+
+let
+  cfg = config.boot.initrd.systemd.dmVerity;
+in
+{
+  options = {
+    boot.initrd.systemd.dmVerity = {
+      enable = lib.mkEnableOption "dm-verity" // {
+        description = ''
+          Mount verity-protected block devices in the initrd.
+
+          Enabling this option allows to use `systemd-veritysetup` and
+          `systemd-veritysetup-generator` in the initrd.
+        '';
+      };
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    assertions = [
+      {
+        assertion = cfg.enable -> config.boot.initrd.systemd.enable;
+        message = ''
+          'boot.initrd.systemd.dmVerity.enable' requires 'boot.initrd.systemd.enable' to be enabled.
+        '';
+      }
+    ];
+
+    boot.initrd = {
+      availableKernelModules = [
+        # For documentation, see https://docs.kernel.org/admin-guide/device-mapper/dm-init.html
+        "dm_mod"
+        # For documentation, see:
+        # - https://docs.kernel.org/admin-guide/device-mapper/verity.html
+        # - https://gitlab.com/cryptsetup/cryptsetup/-/wikis/DMVerity
+        "dm_verity"
+      ];
+
+      # dm-verity needs additional udev rules from LVM to work.
+      services.lvm.enable = true;
+
+      # The additional targets and store paths allow users to integrate verity-protected devices
+      # through the systemd tooling.
+      systemd = {
+        additionalUpstreamUnits = [
+          # https://github.com/systemd/systemd/blob/main/units/veritysetup-pre.target
+          "veritysetup-pre.target"
+          # https://github.com/systemd/systemd/blob/main/units/veritysetup.target
+          "veritysetup.target"
+          # https://github.com/systemd/systemd/blob/main/units/remote-veritysetup.target
+          "remote-veritysetup.target"
+        ];
+
+        storePaths = [
+          # These are the two binaries mentioned in https://github.com/systemd/systemd/blob/main/src/veritysetup/meson.build; there are no others.
+          "${config.boot.initrd.systemd.package}/lib/systemd/systemd-veritysetup"
+          "${config.boot.initrd.systemd.package}/lib/systemd/system-generators/systemd-veritysetup-generator"
+        ];
+      };
+    };
+  };
+
+  meta.maintainers = [ lib.maintainers.msanft ];
+}

nixos/modules/system/boot/systemd/initrd.nix

@@ -218,7 +218,7 @@ in {
     };
 
     root = lib.mkOption {
-      type = lib.types.enum [ "fstab" "gpt-auto" ];
+      type = lib.types.nullOr (lib.types.enum [ "fstab" "gpt-auto" ]);
       default = "fstab";
       example = "gpt-auto";
       description = ''
@@ -227,6 +227,9 @@ in {
         allow specifying the root file system itself this
         way. Instead, the `fstab` value is used in order to interpret
         the root file system specified with the `fileSystems` option.
+
+        If the root FS is mounted by other means, such as systemd generators other than
+        `fstab`, `gpt-auto` or a custom generator, set this to `null`.
       '';
     };
 
@@ -398,9 +401,9 @@ in {
     ++ lib.optional (cfg.enableTpm2 && !(pkgs.stdenv.hostPlatform.isRiscV64 || pkgs.stdenv.hostPlatform.isArmv7)) "tpm-crb"
     ++ lib.optional cfg.package.withEfi "efivarfs";
 
-    boot.kernelParams = [
+    boot.kernelParams =
-      "root=${config.boot.initrd.systemd.root}"
+      lib.optional (config.boot.initrd.systemd.root != null) "root=${config.boot.initrd.systemd.root}"
-    ] ++ lib.optional (config.boot.resumeDevice != "") "resume=${config.boot.resumeDevice}"
+      ++ lib.optional (config.boot.resumeDevice != "") "resume=${config.boot.resumeDevice}"
       # `systemd` mounts root in initrd as read-only unless "rw" is on the kernel command line.
       # For NixOS activation to succeed, we need to have root writable in initrd.
       ++ lib.optional (config.boot.initrd.systemd.root == "gpt-auto") "rw";

nixos/tests/all-tests.nix

@@ -259,6 +259,7 @@ in {
   dhparams = handleTest ./dhparams.nix {};
   disable-installer-tools = handleTest ./disable-installer-tools.nix {};
   discourse = handleTest ./discourse.nix {};
+  dm-verity = runTest ./dm-verity.nix;
   dnscrypt-proxy2 = handleTestOn ["x86_64-linux"] ./dnscrypt-proxy2.nix {};
   dnscrypt-wrapper = runTestOn ["x86_64-linux"] ./dnscrypt-wrapper;
   dnsdist = import ./dnsdist.nix { inherit pkgs runTest; };

nixos/tests/dm-verity.nix

@@ -0,0 +1,245 @@
+# Tests a NixOS system with a read-only root filesystem that's integrity-protected
+# through DM-verity. The root filesystem is mounted read-only, and for NixOS activation
+# to succeed, an overlay `tmpfs` is mounted on top of it.
+# This test uses systemd-repart to create a bootable disk image, as it supplies handy
+# utilities for creating verity partitions, but it can also be setup manually through
+# `systemd-veritysetup`.
+
+{ lib, pkgs, ... }:
+
+let
+  imageId = "verity-root-image";
+  imageVersion = "1-rc1";
+
+  # Use a random, but fixed root hash placeholder to allow us specifying the "real" root hash
+  # after the image is first built.
+  roothashPlaceholder = "61fe0f0c98eff2a595dd2f63a5e481a0a25387261fa9e34c37e3a4910edf32b8";
+in
+{
+  name = "verity-root";
+
+  meta.maintainers = with lib.maintainers; [ msanft ];
+
+  nodes.machine =
+    {
+      lib,
+      pkgs,
+      config,
+      modulesPath,
+      ...
+    }:
+    {
+
+      imports = [ "${modulesPath}/image/repart.nix" ];
+
+      virtualisation.directBoot.enable = false;
+      virtualisation.mountHostNixStore = false;
+      virtualisation.useEFIBoot = true;
+
+      # Disable boot loaders, as a UKI is used, which contains systemd-stub.
+      # TODO(raitobezarius): revisit this when #244907 lands
+      boot.loader.grub.enable = false;
+
+      system.image.id = imageId;
+      system.image.version = imageVersion;
+
+      # systemd-veritysetup-generator takes care of setting up the root filesystem.
+      fileSystems = lib.mkForce { };
+      virtualisation.fileSystems = lib.mkForce { };
+
+      # Provides 'veritysetup' to check if the verity-protected device
+      # has been mapped correctly.
+      environment.systemPackages = with pkgs; [ cryptsetup ];
+
+      boot.initrd = {
+        kernelModules = [ "overlay" ];
+        supportedFilesystems = [ "erofs" ];
+
+        systemd = {
+          enable = true;
+          dmVerity.enable = true;
+          root = null; # systemd-veritysetup-generator takes care of mounting /
+
+          tmpfiles.settings = {
+            "10-mountpoints" =
+              let
+                conf = {
+                  mode = "0755";
+                  user = "root";
+                  group = "root";
+                };
+              in
+              {
+                "/run/etc/upper".d = conf;
+                "/run/etc/work".d = conf;
+                "/run/var/upper".d = conf;
+                "/run/var/work".d = conf;
+                "/run/tmp/upper".d = conf;
+                "/run/tmp/work".d = conf;
+              };
+          };
+
+          # We directly define the mount units here, as we need to specify dependencies very
+          # granularly, and systemd-fstab-generator doesn't give us that flexibility.
+          mounts = [
+            {
+              where = "/sysroot/etc";
+              what = "overlay";
+              type = "overlay";
+              options = "lowerdir=/sysroot${config.system.build.etc}/etc,upperdir=/run/etc/upper,workdir=/run/etc/work";
+              wantedBy = [
+                "initrd-fs.target"
+                "initrd-switch-root.target"
+                "default.target"
+              ];
+              before = [ "initrd-fs.target" ];
+              after = [ "systemd-tmpfiles-setup.service" ];
+              unitConfig.RequiresMountsFor = "/sysroot/nix/store";
+              unitConfig.DefaultDependencies = false;
+            }
+            {
+              where = "/sysroot/var";
+              what = "overlay";
+              type = "overlay";
+              options = "lowerdir=/sysroot/var,upperdir=/run/var/upper,workdir=/run/var/work";
+              wantedBy = [
+                "initrd-fs.target"
+                "initrd-switch-root.target"
+                "default.target"
+              ];
+              before = [ "initrd-fs.target" ];
+              after = [ "systemd-tmpfiles-setup.service" ];
+              unitConfig.RequiresMountsFor = "/sysroot/nix/store";
+              unitConfig.DefaultDependencies = false;
+            }
+            {
+              where = "/sysroot/tmp";
+              what = "overlay";
+              type = "overlay";
+              options = "lowerdir=/sysroot/tmp,upperdir=/run/tmp/upper,workdir=/run/tmp/work";
+              wantedBy = [
+                "initrd-fs.target"
+                "initrd-switch-root.target"
+                "default.target"
+              ];
+              before = [ "initrd-fs.target" ];
+              after = [ "systemd-tmpfiles-setup.service" ];
+              unitConfig.RequiresMountsFor = "/sysroot/nix/store";
+              unitConfig.DefaultDependencies = false;
+            }
+          ];
+        };
+      };
+
+      boot.kernelParams = [
+        "systemd.verity=yes"
+        "roothash=${roothashPlaceholder}"
+      ];
+
+      image.repart = {
+        name = imageId;
+        # OVMF does not work with the default repart sector size of 4096
+        sectorSize = 512;
+        partitions = {
+          # ESP
+          "00-esp" = {
+            contents =
+              let
+                efiArch = config.nixpkgs.hostPlatform.efiArch;
+              in
+              {
+                "/EFI/BOOT/BOOT${lib.toUpper efiArch}.EFI".source = "${pkgs.systemd}/lib/systemd/boot/efi/systemd-boot${efiArch}.efi";
+
+                "/EFI/Linux/${config.system.boot.loader.ukiFile}".source = "${config.system.build.uki}/${config.system.boot.loader.ukiFile}";
+              };
+            repartConfig = {
+              Type = "esp";
+              Format = "vfat";
+              # Minimize = "guess" seems to not work very well for vfat
+              # partitions. It's better to set a sensible default instead. The
+              # aarch64 kernel seems to generally be a little bigger than the
+              # x86_64 kernel. To stay on the safe side, leave some more slack
+              # for every platform other than x86_64.
+              SizeMinBytes = if config.nixpkgs.hostPlatform.isx86_64 then "64M" else "96M";
+            };
+          };
+
+          # Root Partition
+          "10-root" = {
+            storePaths = [ config.system.build.toplevel ];
+            repartConfig = {
+              Type = "root";
+              Format = "erofs";
+              Label = "root";
+              Verity = "data";
+              VerityMatchKey = "root";
+              Minimize = "best";
+              # We need to ensure that mountpoints are available.
+              MakeDirectories = "/bin /boot /dev /etc /home /lib /lib64 /mnt /nix /opt /proc /root /run /srv /sys /tmp /usr /var";
+            };
+          };
+
+          # Verity hashtree for the root partition
+          "20-root-verity" = {
+            repartConfig = {
+              Type = "root-verity";
+              Label = "root-verity";
+              Verity = "hash";
+              VerityMatchKey = "root";
+              Minimize = "best";
+            };
+          };
+        };
+      };
+    };
+
+  testScript =
+    let
+      # We override the build of the image by extending it with code to replace the placeholder with the real root hash.
+      # This way, we can build the image first and then set the root hash afterwards in a single derivation.
+      buildOverride = oldAttrs: {
+        nativeBuildInputs = oldAttrs.nativeBuildInputs ++ [ pkgs.jq ];
+        postInstall = ''
+          # Replace the placeholder with the real root hash.
+          realRoothash=$(${pkgs.jq}/bin/jq -r "[.[] | select(.roothash != null)] | .[0].roothash" $out/repart-output.json)
+          sed -i "0,/${roothashPlaceholder}/ s/${roothashPlaceholder}/$realRoothash/" $out/${oldAttrs.pname}_${oldAttrs.version}.raw
+        '';
+      };
+    in
+    { nodes, ... }:
+    ''
+      import os, subprocess, tempfile
+
+      tmp_disk_image = tempfile.NamedTemporaryFile()
+
+      subprocess.run([
+        "${nodes.machine.virtualisation.qemu.package}/bin/qemu-img",
+        "create",
+        "-f",
+        "qcow2",
+        "-b",
+        "${nodes.machine.system.build.image.overrideAttrs buildOverride}/${nodes.machine.image.repart.imageFile}",
+        "-F",
+        "raw",
+        tmp_disk_image.name,
+      ])
+
+      # Set NIX_DISK_IMAGE so that the qemu script finds the right disk image.
+      os.environ['NIX_DISK_IMAGE'] = tmp_disk_image.name
+
+      os_release = machine.succeed("cat /etc/os-release")
+      assert 'IMAGE_ID="${imageId}"' in os_release
+      assert 'IMAGE_VERSION="${imageVersion}"' in os_release
+
+      bootctl_status = machine.succeed("bootctl status")
+      assert "Boot Loader Specification Type #2 (.efi)" in bootctl_status
+
+      verity_status = machine.succeed("veritysetup status root")
+      assert "type:        VERITY" in verity_status
+      assert "status:      verified" in verity_status
+
+      commandline = machine.succeed("cat /proc/cmdline")
+      roothash = commandline.split("roothash=")[1].split(" ")[0]
+      assert roothash in verity_status
+    '';
+}

pkgs/applications/audio/clementine/default.nix

@@ -47,15 +47,16 @@ let
   withMTP = config.clementine.mtp or true;
   withCD = config.clementine.cd or true;
   withCloud = config.clementine.cloud or true;
-in mkDerivation {
+in
+mkDerivation {
   pname = "clementine";
-  version = "unstable-2022-04-11";
+  version = "1.4.rc2-unstable-2024-05-12";
 
   src = fetchFromGitHub {
     owner = "clementine-player";
     repo = "Clementine";
-    rev = "250024e117fbe5fae7c62b9c8e655d66412a6ed7";
+    rev = "7607ddcb96e79d373c4b60d9de21f3315719c7d8";
-    sha256 = "06fcbs3wig3mh711iypyj49qm5246f7qhvgvv8brqfrd8cqyh6qf";
+    sha256 = "sha256-yOG/Je6N8YEsu5AOtxOFgDl3iqb97assYMZYMSwQqqk=";
   };
 
   nativeBuildInputs = [
@@ -117,6 +118,7 @@ in mkDerivation {
   '';
 
   cmakeFlags = [
+    "-DFORCE_GIT_REVISION=1.3.1"
     "-DUSE_SYSTEM_PROJECTM=ON"
     "-DSPOTIFY_BLOB=OFF"
   ];

pkgs/applications/audio/musescore/default.nix

@@ -1,6 +1,7 @@
 { stdenv
 , lib
 , fetchFromGitHub
+, fetchpatch
 , cmake
 , wrapQtAppsHook
 , pkg-config
@@ -18,18 +19,16 @@
 , portmidi
 , qtbase
 , qtdeclarative
-, qtgraphicaleffects
 , flac
 , libopusenc
 , libopus
 , tinyxml-2
-, qtquickcontrols
+, qt5compat
-, qtquickcontrols2
+, qtwayland
-, qtscript
 , qtsvg
-, qtxmlpatterns
+, qtscxml
 , qtnetworkauth
-, qtx11extras
+, qttools
 , nixosTests
 , darwin
 }:
@@ -50,31 +49,48 @@ let
   } else portaudio;
 in stdenv'.mkDerivation (finalAttrs: {
   pname = "musescore";
-  version = "4.3.2";
+  version = "4.4.0";
 
   src = fetchFromGitHub {
     owner = "musescore";
     repo = "MuseScore";
     rev = "v${finalAttrs.version}";
-    sha256 = "sha256-QjvY8R2nq/DeFDikHn9qr4aCEwzAcogQXM5vdZqhoMM=";
+    sha256 = "sha256-oDbOaLFmSpZ7D8E7LBxUwFwiaPcucIUj3eEp6sXR5o8=";
   };
+  patches = [
+    # https://github.com/musescore/MuseScore/pull/24247
+    (fetchpatch {
+      name = "skip-downloading-harfbuzz.patch";
+      url = "https://github.com/musescore/MuseScore/commit/686ea243d58b43eb3dff7ebdabb2e09de4d212e4.patch";
+      hash = "sha256-fsb1hKFKXwBdMPh+Ek0UT3XtI8qg3ieWUQW1/XDvhmg=";
+    })
+    # https://github.com/musescore/MuseScore/pull/24261
+    (fetchpatch {
+      name = "allow-using-system-harfbuzz.patch";
+      url = "https://github.com/musescore/MuseScore/commit/696279e362afe72db5e92f8a47aa64b3a0e86a86.patch";
+      hash = "sha256-z1W2SmzUUlVL7mRR2frzUZjMEnwqkVfRVz4TufR1tDU=";
+    })
+    # https://github.com/musescore/MuseScore/pull/24326
+    (fetchpatch {
+      name = "fix-menubar-with-qt6.5+.patch";
+      url = "https://github.com/musescore/MuseScore/pull/24326/commits/b274f13311ad0b2bce339634a006ba22fbd3379e.patch";
+      hash = "sha256-ZGmjRa01CBEIxJdJYQMhdg4A9yjWdlgn0pCPmENBTq0=";
+    })
+  ];
 
   cmakeFlags = [
-    "-DMUSESCORE_BUILD_MODE=release"
+    "-DMUSE_APP_BUILD_MODE=release"
     # Disable the build and usage of the `/bin/crashpad_handler` utility - it's
     # not useful on NixOS, see:
     # https://github.com/musescore/MuseScore/issues/15571
-    "-DMUE_BUILD_CRASHPAD_CLIENT=OFF"
+    "-DMUSE_MODULE_DIAGNOSTICS_CRASHPAD_CLIENT=OFF"
     # Use our versions of system libraries
     "-DMUE_COMPILE_USE_SYSTEM_FREETYPE=ON"
+    "-DMUE_COMPILE_USE_SYSTEM_HARFBUZZ=ON"
     "-DMUE_COMPILE_USE_SYSTEM_TINYXML=ON"
     # Implies also -DMUE_COMPILE_USE_SYSTEM_OPUS=ON
     "-DMUE_COMPILE_USE_SYSTEM_OPUSENC=ON"
     "-DMUE_COMPILE_USE_SYSTEM_FLAC=ON"
-    # From some reason, in $src/build/cmake/SetupBuildEnvironment.cmake,
-    # upstream defaults to compiling to x86_64 only, unless this cmake flag is
-    # set
-    "-DMUE_COMPILE_BUILD_MACOS_APPLE_SILICON=ON"
     # Don't bundle qt qml files, relevant really only for darwin, but we set
     # this for all platforms anyway.
     "-DMUE_COMPILE_INSTALL_QTQML_FILES=OFF"
@@ -94,6 +110,7 @@ in stdenv'.mkDerivation (finalAttrs: {
   nativeBuildInputs = [
     wrapQtAppsHook
     cmake
+    qttools
     pkg-config
     ninja
   ];
@@ -114,14 +131,11 @@ in stdenv'.mkDerivation (finalAttrs: {
     tinyxml-2
     qtbase
     qtdeclarative
-    qtgraphicaleffects
+    qt5compat
-    qtquickcontrols
+    qtwayland
-    qtquickcontrols2
-    qtscript
     qtsvg
-    qtxmlpatterns
+    qtscxml
     qtnetworkauth
-    qtx11extras
   ] ++ lib.optionals stdenv.isLinux [
     alsa-lib
   ];

pkgs/applications/gis/qgis/default.nix

@@ -24,13 +24,13 @@ in symlinkJoin rec {
   pythonInputs = qgis-unwrapped.pythonBuildInputs ++ (extraPythonPackages qgis-unwrapped.py.pkgs);
 
   postBuild = ''
-    # unpackPhase
-
     buildPythonPath "$pythonInputs"
 
-    wrapProgram $out/bin/qgis \
+    for program in $out/bin/*; do
-      --prefix PATH : $program_PATH \
+      wrapProgram $program \
-      --set PYTHONPATH $program_PYTHONPATH
+        --prefix PATH : $program_PATH \
+        --set PYTHONPATH $program_PYTHONPATH
+    done
   '';
 
   passthru = {

pkgs/applications/gis/qgis/ltr.nix

@@ -24,13 +24,13 @@ in symlinkJoin rec {
   pythonInputs = qgis-ltr-unwrapped.pythonBuildInputs ++ (extraPythonPackages qgis-ltr-unwrapped.py.pkgs);
 
   postBuild = ''
-    # unpackPhase
-
     buildPythonPath "$pythonInputs"
 
-    wrapProgram $out/bin/qgis \
+    for program in $out/bin/*; do
-      --prefix PATH : $program_PATH \
+      wrapProgram $program \
-      --set PYTHONPATH $program_PYTHONPATH
+        --prefix PATH : $program_PATH \
+        --set PYTHONPATH $program_PYTHONPATH
+    done
   '';
 
   passthru = {

pkgs/applications/gis/qgis/unwrapped-ltr.nix

@@ -173,9 +173,11 @@ in mkDerivation rec {
     # the path at build time using GRASS_PREFIX.
     # Using wrapGAppsHook also prevents file dialogs from crashing the program
     # on non-NixOS.
-    wrapProgram $out/bin/qgis \
+    for program in $out/bin/*; do
-      "''${gappsWrapperArgs[@]}" \
+      wrapProgram $program \
-      --prefix PATH : ${lib.makeBinPath [ grass ]}
+        "''${gappsWrapperArgs[@]}" \
+        --prefix PATH : ${lib.makeBinPath [ grass ]}
+    done
   '';
 
   meta = with lib; {

pkgs/applications/gis/qgis/unwrapped.nix

@@ -175,9 +175,11 @@ in mkDerivation rec {
     # the path at build time using GRASS_PREFIX.
     # Using wrapGAppsHook also prevents file dialogs from crashing the program
     # on non-NixOS.
-    wrapProgram $out/bin/qgis \
+    for program in $out/bin/*; do
-      "''${gappsWrapperArgs[@]}" \
+      wrapProgram $program \
-      --prefix PATH : ${lib.makeBinPath [ grass ]}
+        "''${gappsWrapperArgs[@]}" \
+        --prefix PATH : ${lib.makeBinPath [ grass ]}
+    done
   '';
 
   meta = with lib; {

pkgs/applications/office/qownnotes/default.nix

@@ -20,14 +20,14 @@
 let
   pname = "qownnotes";
   appname = "QOwnNotes";
-  version = "24.9.0";
+  version = "24.9.1";
 in
 stdenv.mkDerivation {
   inherit pname version;
 
   src = fetchurl {
     url = "https://github.com/pbek/QOwnNotes/releases/download/v${version}/qownnotes-${version}.tar.xz";
-    hash = "sha256-xlGBpRiak/th/z9zKbQXpuk3py/W1ns90NjKw4w3FtI=";
+    hash = "sha256-W9w7FJ0EfwPLC9R6OnDz+yny4VSaRGdrPXvaReV9hco=";
   };
 
   nativeBuildInputs = [

pkgs/applications/window-managers/miriway/default.nix

@@ -11,13 +11,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "miriway";
-  version = "0-unstable-2024-08-14";
+  version = "0-unstable-2024-08-31";
 
   src = fetchFromGitHub {
     owner = "Miriway";
     repo = "Miriway";
-    rev = "2d00e8a61cb029cec96596897a1dada8033c601a";
+    rev = "2d754931f038865bd91938578b862262f0ce7c00";
-    hash = "sha256-DB07IGFXLQj2LsU8iVZrSda0FS/efKUAolet8fK9Clo=";
+    hash = "sha256-wmtAbajZ859tvLjKuwqFUq05VGLxHNJX1XyIXM6vvgU=";
   };
 
   strictDeps = true;

pkgs/by-name/at/atlauncher/package.nix

@@ -1,9 +1,8 @@
 {
-  copyDesktopItems,
+  fetchFromGitHub,
-  fetchurl,
+  gradle,
   jre,
   lib,
-  makeDesktopItem,
   makeWrapper,
   stdenvNoCC,
 
@@ -24,23 +23,37 @@ stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "atlauncher";
   version = "3.4.36.10";
 
-  src = fetchurl {
+  src = fetchFromGitHub {
-    url = "https://github.com/ATLauncher/ATLauncher/releases/download/v${finalAttrs.version}/ATLauncher-${finalAttrs.version}.jar";
+    owner = "ATLauncher";
-    hash = "sha256-JZTiYcea5ik8a4RmNLxZcuea7spGWftUGRiRW2Ive7c=";
+    repo = "ATLauncher";
+    rev = "v${finalAttrs.version}";
+    hash = "sha256-EMV/M5W/acJaQJsi4COoRQC2YVfuJG9HGcwvGfakoNo=";
   };
 
-  env.ICON = fetchurl {
+  postPatch = ''
-    url = "https://atlauncher.com/assets/images/logo.svg";
+    # exclude UI tests
-    hash = "sha256-XoqpsgLmkpa2SdjZvPkgg6BUJulIBIeu6mBsJJCixfo=";
+    sed -i "/test {/a\    exclude '**/BasicLauncherUiTest.class'" build.gradle
-  };
+  '';
-
-  dontUnpack = true;
 
   nativeBuildInputs = [
-    copyDesktopItems
+    gradle
     makeWrapper
   ];
 
+  mitmCache = gradle.fetchDeps {
+    inherit (finalAttrs) pname;
+    data = ./deps.json;
+  };
+
+  doCheck = true;
+
+  gradleBuildTask = "shadowJar";
+
+  gradleFlags = [
+    "--exclude-task"
+    "createExe"
+  ];
+
   installPhase =
     let
       runtimeLibraries =
@@ -59,30 +72,28 @@ stdenvNoCC.mkDerivation (finalAttrs: {
     ''
       runHook preInstall
 
-      mkdir -p $out/bin $out/share/java
+      mkdir -p $out/{bin,share/java}
-      cp $src $out/share/java/ATLauncher.jar
+      cp build/libs/ATLauncher-${finalAttrs.version}.jar $out/share/java/ATLauncher.jar
 
-      makeWrapper ${jre}/bin/java $out/bin/atlauncher \
+      makeWrapper ${lib.getExe jre} $out/bin/atlauncher \
         --prefix LD_LIBRARY_PATH : "${lib.makeLibraryPath runtimeLibraries}" \
         --add-flags "-jar $out/share/java/ATLauncher.jar" \
         --add-flags "--working-dir \"\''${XDG_DATA_HOME:-\$HOME/.local/share}/ATLauncher\"" \
         --add-flags "--no-launcher-update"
 
-      mkdir -p $out/share/icons/hicolor/scalable/apps
-      cp $ICON $out/share/icons/hicolor/scalable/apps/atlauncher.svg
-
       runHook postInstall
     '';
 
-  desktopItems = [
+  postInstall =
-    (makeDesktopItem {
+    let
-      categories = [ "Game" ];
+      packagingDir = "${finalAttrs.src}/packaging/linux/_common";
-      desktopName = "ATLauncher";
+    in
-      exec = "atlauncher";
+    ''
-      icon = "atlauncher";
+      install -D -m444 ${packagingDir}/atlauncher.desktop -t $out/share/applications
-      name = "atlauncher";
+      install -D -m444 ${packagingDir}/atlauncher.metainfo.xml -t $out/share/metainfo
-    })
+      install -D -m444 ${packagingDir}/atlauncher.png -t $out/share/pixmaps
-  ];
+      install -D -m444 ${packagingDir}/atlauncher.svg -t $out/share/icons/hicolor/scalable/apps
+    '';
 
   meta = {
     changelog = "https://github.com/ATLauncher/ATLauncher/blob/v${finalAttrs.version}/CHANGELOG.md";
@@ -93,6 +104,9 @@ stdenvNoCC.mkDerivation (finalAttrs: {
     mainProgram = "atlauncher";
     maintainers = with lib.maintainers; [ getpsyched ];
     platforms = lib.platforms.all;
-    sourceProvenance = [ lib.sourceTypes.binaryBytecode ];
+    sourceProvenance = with lib.sourceTypes; [
+      fromSource
+      binaryBytecode # mitm cache
+    ];
   };
 })

pkgs/by-name/au/audiobookshelf/source.json

@@ -1,9 +1,9 @@
 {
   "owner": "advplyr",
   "repo": "audiobookshelf",
-  "rev": "48f232790a5026ac886564ef57660a338a168187",
+  "rev": "24923c0009446e2db26ec366b25dd38deb2e2573",
-  "hash": "sha256-2/lUByeWMZlxk7i+mvzBuxlxD97C+JEtmf/ajht5AOs=",
+  "hash": "sha256-afNz4dTEr/6STn6cqSHxugn5ofa0jY4HvUnckJabxdo=",
-  "version": "2.13.2",
+  "version": "2.13.3",
-  "depsHash": "sha256-kU5Nrhy6AePwD2/kmvTXvrvGUH8uz3qm3ZvD3kC9EmE=",
+  "depsHash": "sha256-fRz4qUxd8lZODQikP011FtvyFCz4fehESUfBmSBLwtA=",
-  "clientDepsHash": "sha256-1haujBoC9KyusE52HeepOcvmb6v7EG5XWD4dq1wPfe4="
+  "clientDepsHash": "sha256-VGbwiCuDjA1rtUpLw7gO+Xb5/D09evf/Jrb93H0QCH8="
 }

pkgs/by-name/ba/basedpyright/package.nix

@@ -11,13 +11,13 @@
 }:
 
 let
-  version = "1.17.1";
+  version = "1.17.2";
 
   src = fetchFromGitHub {
     owner = "detachhead";
     repo = "basedpyright";
     rev = "refs/tags/v${version}";
-    hash = "sha256-mFY0GvVGiozxd04ktSoqcezBwXkOAeIWTgNnv1zB74A=";
+    hash = "sha256-6pksb2drjiZo1Hp6P/G06LAj3nW5WXJbVNGt5897jAA=";
   };
 
   patchedPackageJSON = runCommand "package.json" { } ''
@@ -47,7 +47,7 @@ let
     pname = "pyright-internal";
     inherit version src;
     sourceRoot = "${src.name}/packages/pyright-internal";
-    npmDepsHash = "sha256-IJMK/YhTldOr3Gh4ewlVLUSt3PlhIjilxB7QBJpdu80=";
+    npmDepsHash = "sha256-w6SurZ4EG2QW7paZsWxu0gNXMXxnzQygClOUdLeBKdw=";
     dontNpmBuild = true;
     # Uncomment this flag when using unreleased peer dependencies
     # npmFlags = [ "--legacy-peer-deps" ];
@@ -94,7 +94,7 @@ buildNpmPackage rec {
   inherit version src;
 
   sourceRoot = "${src.name}/packages/pyright";
-  npmDepsHash = "sha256-TmJrh/Pya7jXhMQyCz6wwCCP0gzTTKFNUKF+vBq22U0=";
+  npmDepsHash = "sha256-y7arZsXjJ0LdWpXdSZjc7EBJPN/oWAje4uQDEhkRbDM=";
 
   postPatch = ''
     chmod +w ../../

pkgs/by-name/de/dep-scan/package.nix

@@ -4,16 +4,28 @@
   python3,
 }:
 
+let
+  appthreat-vulnerability-db = (
+    python3.pkgs.appthreat-vulnerability-db.overrideAttrs (oldAttrs: rec {
+      version = "5.7.3";
+      src = oldAttrs.src.override {
+        rev = "refs/tags/v${version}";
+        hash = "sha256-MrlgBUx3T2G46Pnah3obe5b4yKDzsAFVC/B7AHM0kZY=";
+      };
+    })
+  );
+
+in
 python3.pkgs.buildPythonApplication rec {
   pname = "dep-scan";
-  version = "5.3.4";
+  version = "5.4.3";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "owasp-dep-scan";
     repo = "dep-scan";
     rev = "refs/tags/v${version}";
-    hash = "sha256-5iMhl3Wcxwgq4Wr0TUcAuRnb2+y8DHBugnnkpcZfSAM=";
+    hash = "sha256-m0vDsCetOSfScu1eprrGaDJ1VuXxuNFBitK8N5GtfSQ=";
   };
 
   build-system = with python3.pkgs; [ setuptools ];

pkgs/by-name/ez/eza/package.nix

@@ -17,16 +17,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "eza";
-  version = "0.19.1";
+  version = "0.19.2";
 
   src = fetchFromGitHub {
     owner = "eza-community";
     repo = "eza";
     rev = "v${version}";
-    hash = "sha256-VV8tqVJq+bsgfdNSxSzo1vqYtYT37D2pBX4HydY6cKs=";
+    hash = "sha256-sTGU1Voa+mMBRIHVVUF79BwvxQfjA4XknhhhT5sk5xE=";
   };
 
-  cargoHash = "sha256-SUvQxW3STsP1VrPJKK2NYbApuoGfbmfUiywZILvcvj4=";
+  cargoHash = "sha256-DSZ+1Svb22RlNzx74Kpj+oWrK60s4nGfpzzodDRL/Ko=";
 
   nativeBuildInputs = [ cmake pkg-config installShellFiles pandoc ];
   buildInputs = [ zlib ]

pkgs/by-name/fe/feishin/package.nix

@@ -11,13 +11,13 @@
 }:
 let
   pname = "feishin";
-  version = "0.8.0";
+  version = "0.8.1";
 
   src = fetchFromGitHub {
     owner = "jeffvli";
     repo = "feishin";
     rev = "v${version}";
-    hash = "sha256-KaZA7ZAeN6f1PWMeUl0Z4Xl/S/uD2vLPHM5uM+dIbko=";
+    hash = "sha256-9ExTxVptPEZ+E1Tr7vS3JCfH8RoRDfZ0daA1AHWuuas=";
   };
 
   electron = electron_31;
@@ -26,7 +26,7 @@ buildNpmPackage {
   inherit pname version;
 
   inherit src;
-  npmDepsHash = "sha256-1BG4U6x+e204KdrIh0S/rrdj/3wh2iuuWQgFXLjO3iw=";
+  npmDepsHash = "sha256-7CsbhwdNGkeNTNYrpMfOiQDU5lo23723F4zmM6QyFdA=";
 
   npmFlags = [ "--legacy-peer-deps" ];
   makeCacheWritable = true;
@@ -60,7 +60,7 @@ buildNpmPackage {
         inherit version;
 
         src = "${src}/release/app";
-        npmDepsHash = "sha256-//K8jiO3nEHs08l9eMDW2HnZBeBgxBMai2omoCI7wQw=";
+        npmDepsHash = "sha256-2LsciXkFSCxFghiMRM7NoCv+7k9MC9W0xPtMsddZCZk=";
 
         npmFlags = [ "--ignore-scripts" ];
         dontNpmBuild = true;

pkgs/by-name/fi/filesender/package.nix

@@ -6,13 +6,13 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "filesender";
-  version = "2.48";
+  version = "2.49";
 
   src = fetchFromGitHub {
     owner = "filesender";
     repo = "filesender";
     rev = "filesender-${finalAttrs.version}";
-    hash = "sha256-lXA9XZ5gbfut2EQ5bF2w8rhAEM++8rQseWviKwfRWGk=";
+    hash = "sha256-GNhborbwV9G2x7pLDyxGVCtTf4AIaMYQGAKNJPzedzo=";
   };
 
   patches = [

pkgs/by-name/go/google-chrome/package.nix

@@ -236,6 +236,7 @@ let
         mv "$icon_file" "$logo_output_path/google-$appname.png"
       done
 
+      # "--simulate-outdated-no-au" disables auto updates and browser outdated popup
       makeWrapper "$out/share/google/$appname/google-$appname" "$exe" \
         --prefix LD_LIBRARY_PATH : "$rpath" \
         --prefix PATH            : "$binpath" \
@@ -243,13 +244,8 @@ let
         --prefix XDG_DATA_DIRS   : "$XDG_ICON_DIRS:$GSETTINGS_SCHEMAS_PATH:${addDriverRunpath.driverLink}/share" \
         --set CHROME_WRAPPER  "google-chrome-$dist" \
         --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--ozone-platform-hint=auto --enable-features=WaylandWindowDecorations}}" \
-        --add-flags ${
+        --add-flags "--simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT'" \
-          lib.concatStringsSep " " [
+        --add-flags ${lib.escapeShellArg commandLineArgs}
-            (lib.escapeShellArg commandLineArgs)
-            # Disables auto updates and browser outdated popup
-            "--simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT'"
-          ]
-        }
 
       for elf in $out/share/google/$appname/{chrome,chrome-sandbox,chrome_crashpad_handler}; do
         patchelf --set-rpath $rpath $elf
@@ -288,15 +284,11 @@ let
       cp -r *.app $out/Applications
 
       mkdir -p $out/bin
-      makeWrapper $out/Applications/Google\ Chrome.app/Contents/MacOS/Google\ Chrome $out/bin/google-chrome-stable \
-        --add-flags ${
-          lib.concatStringsSep " " [
-            (lib.escapeShellArg commandLineArgs)
-            # Disables auto updates and browser outdated popup
-            "--simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT'"
-          ]
-        }
 
+      # "--simulate-outdated-no-au" disables auto updates and browser outdated popup
+      makeWrapper $out/Applications/Google\ Chrome.app/Contents/MacOS/Google\ Chrome $out/bin/google-chrome-stable \
+        --add-flags "--simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT'" \
+        --add-flags ${lib.escapeShellArg commandLineArgs}
       runHook postInstall
     '';
   });

pkgs/by-name/mi/micro/package.nix

@@ -1,26 +1,14 @@
 {
   lib,
-  stdenv,
   buildGoModule,
+  callPackage,
   fetchFromGitHub,
   installShellFiles,
-  callPackage,
+  stdenv,
-  wl-clipboard,
-  xclip,
-  makeWrapper,
-  # Boolean flags
-  withXclip ? stdenv.isLinux,
-  withWlClipboard ?
-    if withWlclip != null then
-      lib.warn ''
-        withWlclip is deprecated and will be removed;
-        use withWlClipboard instead.
-      '' withWlclip
-    else
-      stdenv.isLinux,
   # Deprecated options
-  # Remove them before or right after next version update from Nixpkgs or this
+  # Remove them as soon as possible
-  # package itself
+  withXclip ? null,
+  withWlClipboard ? null,
   withWlclip ? null,
 }:
 
@@ -38,10 +26,7 @@ let
 
     vendorHash = "sha256-ePhObvm3m/nT+7IyT0W6K+y+9UNkfd2kYjle2ffAd9Y=";
 
-    nativeBuildInputs = [
+    nativeBuildInputs = [ installShellFiles ];
-      installShellFiles
-      makeWrapper
-    ];
 
     outputs = [
       "out"
@@ -73,22 +58,12 @@ let
       install -Dm644 assets/micro-logo-mark.svg $out/share/icons/hicolor/scalable/apps/micro.svg
     '';
 
-    postFixup =
-      let
-        clipboardPackages =
-          lib.optionals withXclip [ xclip ]
-          ++ lib.optionals withWlClipboard [ wl-clipboard ];
-      in
-      lib.optionalString (withXclip || withWlClipboard) ''
-        wrapProgram "$out/bin/micro" \
-                  --prefix PATH : "${lib.makeBinPath clipboardPackages}"
-      '';
-
     passthru = {
       tests = lib.packagesFromDirectoryRecursive {
         inherit callPackage;
         directory = ./tests;
       };
+      wrapper = callPackage ./wrapper.nix { micro = self; };
     };
 
     meta = {
@@ -114,4 +89,11 @@ let
     };
   };
 in
-self
+lib.warnIf (withXclip != null || withWlClipboard != null || withWlclip != null) ''
+  The options `withXclip`, `withWlClipboard`, `withWlclip` were removed. If
+  you are seeking for clipboard support, please consider the following
+  packages:
+  - `micro-with-wl-clipboard`
+  - `micro-with-xclip`
+  - `micro-full`
+'' self

pkgs/by-name/mi/micro/wrapper.nix

@@ -0,0 +1,33 @@
+{
+  lib,
+  micro,
+  makeWrapper,
+  symlinkJoin,
+  # configurable options
+  extraPackages ? [ ],
+}:
+
+symlinkJoin {
+  name = "micro-wrapped-${micro.version}";
+  inherit (micro) pname version outputs;
+
+  nativeBuildInputs = [ makeWrapper ];
+
+  paths = [ micro ];
+
+  postBuild = ''
+    ${lib.concatMapStringsSep "\n" (
+      output: "ln --verbose --symbolic --no-target-directory ${micro.${output}} \$${output}"
+    ) (lib.remove "out" micro.outputs)}
+
+    pushd $out/bin
+    for f in *; do
+      rm $f
+      makeWrapper ${micro}/bin/$f $f \
+        --prefix PATH ":" "${lib.makeBinPath extraPackages}"
+    done
+    popd
+  '';
+
+  meta = micro.meta;
+}

pkgs/by-name/mi/mistral-rs/package.nix

@@ -19,6 +19,7 @@
 
   testers,
   mistral-rs,
+  nix-update-script,
 
   cudaPackages,
   cudaCapability ? null,
@@ -56,7 +57,6 @@ let
       cudaCapability;
   cudaCapability' = lib.toInt (cudaPackages.cudaFlags.dropDot cudaCapabilityString);
 
-  # TODO Should we assert mklAccel -> stdenv.isLinux && stdenv.isx86_64 ?
   mklSupport =
     assert accelIsValid;
     (acceleration == "mkl");
@@ -80,27 +80,23 @@ in
 
 rustPlatform.buildRustPackage rec {
   pname = "mistral-rs";
-  version = "0.1.18";
+  version = "0.3.0";
 
   src = fetchFromGitHub {
     owner = "EricLBuehler";
     repo = "mistral.rs";
     rev = "refs/tags/v${version}";
-    hash = "sha256-lMDFWNv9b0UfckqLmyWRVwnqmGe6nxYsUHzoi2+oG84=";
+    hash = "sha256-3o7Esn+hEXKOoHX6JeXu/sgkWeL6tLCoH+Ep81/LoeU=";
   };
 
   cargoLock = {
     lockFile = ./Cargo.lock;
     outputHashes = {
-      "candle-core-0.6.0" = "sha256-DxGBWf2H7MamrbboTJ4zHy1HeE8ZVT7QvE3sTYrRxBc=";
+      "bindgen_cuda-0.1.6" = "sha256-OWGcQxT+x5HyIFskNVWpPr6Qfkh6Mv/g4PVSm5oA27g=";
-      "range-checked-0.1.0" = "sha256-S+zcF13TjwQPFWZLIbUDkvEeaYdaxCOtDLtI+JRvum8=";
+      "candle-core-0.6.0" = "sha256-8UBDQfbVR4gsZRRCy899DA27saiC85+FRm6L4YBX2oA=";
     };
   };
 
-  postPatch = ''
-    ln -s ${./Cargo.lock} Cargo.lock
-  '';
-
   nativeBuildInputs = [
     pkg-config
     python3
@@ -112,6 +108,7 @@ rustPlatform.buildRustPackage rec {
       openssl
     ]
     ++ lib.optionals cudaSupport [
+      cudaPackages.cuda_cudart
       cudaPackages.cuda_nvrtc
       cudaPackages.libcublas
       cudaPackages.libcurand
@@ -120,7 +117,13 @@ rustPlatform.buildRustPackage rec {
     ++ lib.optionals stdenv.isDarwin darwinBuildInputs;
 
   cargoBuildFlags =
-    lib.optionals cudaSupport [ "--features=cuda" ]
+    [
+      # This disables the plotly crate which fails to build because of the kaleido feature requiring
+      # network access at build-time.
+      # See https://github.com/NixOS/nixpkgs/pull/323788#issuecomment-2206085825
+      "--no-default-features"
+    ]
+    ++ lib.optionals cudaSupport [ "--features=cuda" ]
     ++ lib.optionals mklSupport [ "--features=mkl" ]
     ++ lib.optionals (stdenv.isDarwin && metalSupport) [ "--features=metal" ];
 
@@ -129,7 +132,7 @@ rustPlatform.buildRustPackage rec {
       SWAGGER_UI_DOWNLOAD_URL =
         let
           # When updating:
-          # - Look for the version of `utopia-swagger-ui` at:
+          # - Look for the version of `utoipa-swagger-ui` at:
           #   https://github.com/EricLBuehler/mistral.rs/blob/v<MISTRAL-RS-VERSION>/mistralrs-server/Cargo.toml
           # - Look at the corresponding version of `swagger-ui` at:
           #   https://github.com/juhaku/utoipa/blob/utoipa-swagger-ui-<UTOPIA-SWAGGER-UI-VERSION>/utoipa-swagger-ui/build.rs#L21-L22
@@ -166,20 +169,29 @@ rustPlatform.buildRustPackage rec {
   checkFlags = [
     "--skip=gguf::gguf_tokenizer::tests::test_decode_gpt2"
     "--skip=gguf::gguf_tokenizer::tests::test_decode_llama"
+    "--skip=gguf::gguf_tokenizer::tests::test_encode_decode_gpt2"
+    "--skip=gguf::gguf_tokenizer::tests::test_encode_decode_llama"
     "--skip=gguf::gguf_tokenizer::tests::test_encode_gpt2"
     "--skip=gguf::gguf_tokenizer::tests::test_encode_llama"
     "--skip=sampler::tests::test_argmax"
     "--skip=sampler::tests::test_gumbel_speculative"
+    "--skip=util::tests::test_parse_image_url"
   ];
 
   passthru = {
     tests = {
       version = testers.testVersion { package = mistral-rs; };
 
-      withMkl = mistral-rs.override { acceleration = "mkl"; };
+      # TODO: uncomment when mkl support will be fixed
-      withCuda = mistral-rs.override { acceleration = "cuda"; };
+      withMkl = lib.optionalAttrs (stdenv.hostPlatform == "x86_64-linux") (
-      withMetal = mistral-rs.override { acceleration = "metal"; };
+        mistral-rs.override { acceleration = "mkl"; }
+      );
+      withCuda = lib.optionalAttrs stdenv.isLinux (mistral-rs.override { acceleration = "cuda"; });
+      withMetal = lib.optionalAttrs (stdenv.hostPlatform == "aarch64-darwin") (
+        mistral-rs.override { acceleration = "metal"; }
+      );
     };
+    updateScript = nix-update-script { };
   };
 
   meta = {
@@ -194,6 +206,8 @@ rustPlatform.buildRustPackage rec {
         lib.platforms.linux
       else if metalSupport then
         [ "aarch64-darwin" ]
+      else if mklSupport then
+        [ "x86_64-linux" ]
       else
         lib.platforms.unix;
     broken = mklSupport;

pkgs/by-name/ne/netscanner/package.nix

@@ -6,7 +6,7 @@
 }:
 let
   pname = "netscanner";
-  version = "0.5.2";
+  version = "0.5.3";
 in
 rustPlatform.buildRustPackage {
   inherit pname version;
@@ -17,10 +17,10 @@ rustPlatform.buildRustPackage {
     owner = "Chleba";
     repo = "netscanner";
     rev = "refs/tags/v${version}";
-    hash = "sha256-gVwI5dGQqSQf2wR7oKMTRIqseUbAEDTTuQ51S6dvEFw=";
+    hash = "sha256-rqUGi7UF9y3VZ0KoctCesQVgJbR1WfqhFA6aYFFimNk=";
   };
 
-  cargoHash = "sha256-30VSeBbaVWVEO14eUx28HSymfkCxH0IZmEN4cnJ9wIk=";
+  cargoHash = "sha256-VP6L3lXDXadimSWC2L4yfzTRfTcUilJtZ7TeHARAKAY=";
 
   postFixup = ''
     wrapProgram $out/bin/netscanner \

pkgs/by-name/pl/plasmusic-toolbar/package.nix

@@ -6,13 +6,13 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "plasmusic-toolbar";
-  version = "1.5.0";
+  version = "1.6.0";
 
   src = fetchFromGitHub {
     owner = "ccatterina";
     repo = "plasmusic-toolbar";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-22eSrvigJHmwVB396APkDtiJjavpijUMuZ4mqQGVwf4=";
+    hash = "sha256-tZ2xcoGZp2GWoKd4XjO2K4he3tKBHgxi0PdqY+5ULn0=";
   };
 
   installPhase = ''

pkgs/by-name/sc/scrutiny-collector/package.nix

@@ -24,7 +24,7 @@ buildGoModule rec {
 
   vendorHash = "sha256-SiQw6pq0Fyy8Ia39S/Vgp9Mlfog2drtVn43g+GXiQuI=";
 
-  buildInputs = [ makeWrapper ];
+  nativeBuildInputs = [ makeWrapper ];
 
   CGO_ENABLED = 0;
 

pkgs/development/compilers/gcc-arm-embedded/13/default.nix

@@ -9,7 +9,7 @@
 
 stdenv.mkDerivation rec {
   pname = "gcc-arm-embedded";
-  version = "13.2.rel1";
+  version = "13.3.rel1";
 
   platform = {
     aarch64-darwin = "darwin-arm64";
@@ -20,11 +20,12 @@ stdenv.mkDerivation rec {
 
   src = fetchurl {
     url = "https://developer.arm.com/-/media/Files/downloads/gnu/${version}/binrel/arm-gnu-toolchain-${version}-${platform}-arm-none-eabi.tar.xz";
+    # hashes obtained from location ${url}.sha256asc
     sha256 = {
-      aarch64-darwin = "39c44f8af42695b7b871df42e346c09fee670ea8dfc11f17083e296ea2b0d279";
+      aarch64-darwin = "fb6921db95d345dc7e5e487dd43b745e3a5b4d5c0c7ca4f707347148760317b4";
-      aarch64-linux  = "8fd8b4a0a8d44ab2e195ccfbeef42223dfb3ede29d80f14dcf2183c34b8d199a";
+      aarch64-linux  = "c8824bffd057afce2259f7618254e840715f33523a3d4e4294f471208f976764";
-      x86_64-darwin  = "075faa4f3e8eb45e59144858202351a28706f54a6ec17eedd88c9fb9412372cc";
+      x86_64-darwin  = "1ab00742d1ed0926e6f227df39d767f8efab46f5250505c29cb81f548222d794";
-      x86_64-linux   = "6cd1bbc1d9ae57312bcd169ae283153a9572bd6a8e4eeae2fedfbc33b115fdbb";
+      x86_64-linux   = "95c011cee430e64dd6087c75c800f04b9c49832cc1000127a92a97f9c8d83af4";
     }.${stdenv.hostPlatform.system} or (throw "Unsupported system: ${stdenv.hostPlatform.system}");
   };
 

pkgs/development/libraries/LAStools/default.nix

@@ -27,7 +27,7 @@ stdenv.mkDerivation rec {
     description = "Software for rapid LiDAR processing";
     homepage = "http://lastools.org/";
     license = licenses.unfree;
-    maintainers = with maintainers; [ stephenwithph ];
+    maintainers = with maintainers; teams.geospatial.members ++ [ stephenwithph ];
     platforms = platforms.unix;
   };
 }

pkgs/development/libraries/libLAS/default.nix

@@ -49,11 +49,11 @@ stdenv.mkDerivation rec {
     install_name_tool -change "@rpath/liblas.3.dylib" "$out/lib/liblas.3.dylib" $out/lib/liblas_c.dylib
   '';
 
-  meta = {
+  meta = with lib; {
     description = "LAS 1.0/1.1/1.2 ASPRS LiDAR data translation toolset";
     homepage = "https://liblas.org";
-    license = lib.licenses.bsd3;
+    license = licenses.bsd3;
-    platforms = lib.platforms.unix;
+    platforms = platforms.unix;
-    maintainers = [ lib.maintainers.michelk ];
+    maintainers = with maintainers; teams.geospatial.members ++ [ lib.maintainers.michelk ];
   };
 }

pkgs/development/python-modules/adafruit-platformdetect/default.nix

@@ -8,7 +8,7 @@
 
 buildPythonPackage rec {
   pname = "adafruit-platformdetect";
-  version = "3.73.0";
+  version = "3.74.0";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
@@ -16,7 +16,7 @@ buildPythonPackage rec {
   src = fetchPypi {
     pname = "adafruit_platformdetect";
     inherit version;
-    hash = "sha256-IwkJityP+Hs9mkpdOu6+P3t/VasOE9Get1/6hl82+rg=";
+    hash = "sha256-rVmtqpVjQgovAsVCu3+hgglga9LJPGT8zzlhySmpba8=";
   };
 
   build-system = [ setuptools-scm ];

pkgs/development/python-modules/appthreat-vulnerability-db/default.nix

@@ -21,7 +21,7 @@
 
 buildPythonPackage rec {
   pname = "appthreat-vulnerability-db";
-  version = "6.0.8";
+  version = "6.0.14";
   pyproject = true;
 
   disabled = pythonOlder "3.10";
@@ -30,7 +30,7 @@ buildPythonPackage rec {
     owner = "AppThreat";
     repo = "vulnerability-db";
     rev = "refs/tags/v${version}";
-    hash = "sha256-lgt609UDuHTGQTTrpvxNvgUk6GU+TYqwc19dzatI4Io=";
+    hash = "sha256-Xm/2AHV4r6SmKK1wZS20xh9xRO3zhdEB/hpRT1o3z2Q=";
   };
 
   pythonRelaxDeps = [

pkgs/development/python-modules/awkward/default.nix

@@ -86,6 +86,12 @@ buildPythonPackage rec {
     # Disable tests dependending on jax on darwin
   ] ++ lib.optionals stdenv.isDarwin [ "tests/test_2603_custom_behaviors_with_jax.py" ];
 
+  disabledTests = [
+    # AssertionError: Regex pattern did not match.
+    "test_serialise_with_nonserialisable_attrs"
+    "test_serialise_with_nonserialisable_attrs"
+  ];
+
   meta = {
     description = "Manipulate JSON-like data with NumPy-like idioms";
     homepage = "https://github.com/scikit-hep/awkward";

pkgs/development/python-modules/lxml-html-clean/default.nix

@@ -10,7 +10,7 @@
 
 buildPythonPackage rec {
   pname = "lxml-html-clean";
-  version = "0.2.0";
+  version = "0.2.2";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
@@ -19,7 +19,7 @@ buildPythonPackage rec {
     owner = "fedora-python";
     repo = "lxml_html_clean";
     rev = "refs/tags/${version}";
-    hash = "sha256-3ifuEgjCLDj0dBh9AbjAT/hNFGfINbvyjgRuxIRuarw=";
+    hash = "sha256-DiHbO2m/JckdXFMU7/LAW2hkyskqWtrQ93sgsVcdDSo=";
   };
 
   build-system = [ setuptools ];

pkgs/development/tools/rust/cargo-llvm-cov/default.nix

@@ -26,7 +26,7 @@
 
 let
   pname = "cargo-llvm-cov";
-  version = "0.6.11";
+  version = "0.6.12";
 
   owner = "taiki-e";
   homepage = "https://github.com/${owner}/${pname}";
@@ -37,7 +37,7 @@ let
   cargoLock = fetchurl {
     name = "Cargo.lock";
     url = "https://crates.io/api/v1/crates/${pname}/${version}/download";
-    sha256 = "sha256-/PwzG+Erz1aMDg50glZBP7mNHzuvvn2Dn+dicMG2ouo=";
+    sha256 = "sha256-QMO5J5c8MQr84w6X74oQrHV99cjSUVfpC8Ub1csQ0gI=";
     downloadToTemp = true;
     postFetch = ''
       tar xzf $downloadedFile ${pname}-${version}/Cargo.lock
@@ -55,7 +55,7 @@ rustPlatform.buildRustPackage {
     inherit owner;
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-1HZNYC7bMG7olnZH4oOC/fXOAF9qt7MYhlQbaOKDmvg=";
+    sha256 = "sha256-BlXgbCWjGya/I94nqfjBqQPSWnVhyhNn0oSRL9xiS6k=";
   };
 
   # Upstream doesn't include the lockfile so we need to add it back
@@ -63,7 +63,7 @@ rustPlatform.buildRustPackage {
     cp ${cargoLock} source/Cargo.lock
   '';
 
-  cargoHash = "sha256-sN3vNZgi45pcDXI8kQ0L/r6HCDGs8l2VMwI+LHjwZ6Q=";
+  cargoHash = "sha256-nabO19JePQRuhxsbm5wVIU4+5si6p0VgqR2QLmLeivU=";
 
   # `cargo-llvm-cov` reads these environment variables to find these binaries,
   # which are needed to run the tests

pkgs/development/tools/rust/cargo-llvm-lines/default.nix

@@ -2,16 +2,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "cargo-llvm-lines";
-  version = "0.4.39";
+  version = "0.4.40";
 
   src = fetchFromGitHub {
     owner = "dtolnay";
     repo = pname;
     rev = version;
-    hash = "sha256-iy8bZvF3JYnlABzhmsrzo89pmKAWQYVNSZ9HoplpWiY=";
+    hash = "sha256-FyPq2+Smx4ZbJG13TKUHlyAANU4JbpAAUxisH9c4Aq8=";
   };
 
-  cargoHash = "sha256-vFj7U+30dcLkFJ1eet6lykTcJHzKWOSzAqPqKJrp6Gg=";
+  cargoHash = "sha256-AH27+WrWguFpZFIq3N8Wb1Nlwbof6tgX0W4AtwMtoVw=";
 
   meta = with lib; {
     description = "Count the number of lines of LLVM IR across all instantiations of a generic function";

pkgs/development/tools/rust/cargo-nextest/default.nix

@@ -1,31 +1,22 @@
-{ lib, rustPlatform, fetchFromGitHub, stdenv, darwin }:
+{ lib, rustPlatform, fetchFromGitHub, nix-update-script }:
 
 rustPlatform.buildRustPackage rec {
   pname = "cargo-nextest";
-  version = "0.9.72";
+  version = "0.9.77";
 
   src = fetchFromGitHub {
     owner = "nextest-rs";
     repo = "nextest";
     rev = "cargo-nextest-${version}";
-    hash = "sha256-FQM1SVzGgmu6HHijP9kKEJPhhzSLs/jo36b4qnx0lb4=";
+    hash = "sha256-4wqWCa3HHctKSaSYiiLBa9PM6cWyr0H7blI9BWGLTuI=";
   };
 
-  cargoHash = "sha256-2ttG9lPIkLRzDPcDNZjROOIIDhcEHfBvs/DTniZtQUY=";
+  cargoHash = "sha256-9XOkXK5sH+Qo8omS8V8FMgnh+oqLZL4paqoL9UOPevA=";
-
-  buildInputs = lib.optionals stdenv.isDarwin [
-    darwin.apple_sdk.frameworks.SystemConfiguration
-  ];
 
   cargoBuildFlags = [ "-p" "cargo-nextest" ];
   cargoTestFlags = [ "-p" "cargo-nextest" ];
 
-  # TODO: investigate some more why these tests fail in nix
+  passthru.updateScript = nix-update-script { };
-  checkFlags = [
-    "--skip=tests_integration::test_list"
-    "--skip=tests_integration::test_relocated_run"
-    "--skip=tests_integration::test_run"
-  ];
 
   meta = with lib; {
     description = "Next-generation test runner for Rust projects";

pkgs/os-specific/linux/prl-tools/default.nix

@@ -142,6 +142,7 @@ stdenv.mkDerivation (finalAttrs: {
       done
 
       install -Dm755 ../../tools/prlfsmountd.sh $out/sbin/prlfsmountd
+      install -Dm755 ../../tools/prlbinfmtconfig.sh $out/sbin/prlbinfmtconfig
       for f in $out/bin/* $out/sbin/*; do
         wrapProgram $f \
           --prefix LD_LIBRARY_PATH ':' "${libPath}" \

pkgs/os-specific/linux/zfs/2_2.nix

@@ -14,10 +14,10 @@ callPackage ./generic.nix args {
   # this attribute is the correct one for this package.
   kernelModuleAttribute = "zfs_2_2";
   # check the release notes for compatible kernels
-  kernelCompatible = kernel: kernel.kernelOlder "6.10";
+  kernelCompatible = kernel: kernel.kernelOlder "6.11";
 
   # this package should point to the latest release.
-  version = "2.2.5";
+  version = "2.2.6";
 
   tests = [
     nixosTests.zfs.installer
@@ -26,5 +26,5 @@ callPackage ./generic.nix args {
 
   maintainers = with lib.maintainers; [ adamcstephens amarshall ];
 
-  hash = "sha256-BkwcNPk+jX8CXp5xEVrg4THof7o/5j8RY2SY6+IPNTg=";
+  hash = "sha256-wkgoYg6uQOHVq8a9sJXzO/QXJ6q28l7JXWkC+BFvOb0=";
 }

pkgs/os-specific/linux/zfs/generic.nix

@@ -184,6 +184,7 @@ let
 
       # Add Bash completions.
       install -v -m444 -D -t $out/share/bash-completion/completions contrib/bash_completion.d/zfs
+    '' + optionalString (lib.versionOlder version "2.2.6") ''
       (cd $out/share/bash-completion/completions; ln -s zfs zpool)
     '';
 

pkgs/os-specific/linux/zfs/unstable.nix

@@ -20,12 +20,12 @@ callPackage ./generic.nix args {
   # IMPORTANT: Always use a tagged release candidate or commits from the
   # zfs-<version>-staging branch, because this is tested by the OpenZFS
   # maintainers.
-  version = "2.2.5";
+  version = "2.2.6";
   # rev = "";
 
   tests = [
     nixosTests.zfs.unstable
   ];
 
-  hash = "sha256-BkwcNPk+jX8CXp5xEVrg4THof7o/5j8RY2SY6+IPNTg=";
+  hash = "sha256-wkgoYg6uQOHVq8a9sJXzO/QXJ6q28l7JXWkC+BFvOb0=";
 }

pkgs/servers/home-assistant/custom-components/default.nix

@@ -22,6 +22,8 @@
 
   frigate = callPackage ./frigate {};
 
+  garmin_connect = callPackage ./garmin_connect {};
+
   govee-lan = callPackage ./govee-lan {};
 
   gpio = callPackage ./gpio {};

pkgs/servers/home-assistant/custom-components/garmin_connect/default.nix

@@ -0,0 +1,35 @@
+{
+  lib,
+  buildHomeAssistantComponent,
+  fetchFromGitHub,
+  garminconnect,
+  tzlocal,
+}:
+
+buildHomeAssistantComponent {
+  owner = "cyberjunky";
+  domain = "garmin_connect";
+  version = "unstable-2024-08-31";
+
+  src = fetchFromGitHub {
+    owner = "cyberjunky";
+    repo = "home-assistant-garmin_connect";
+    rev = "d42edcabc67ba6a7f960e849c8aaec1aabef87c0";
+    hash = "sha256-KqbP6TpH9B0/AjtsW5TcWSNgUhND+w8rO6X8fHqtsDI=";
+  };
+
+  propagatedBuildInputs = [
+    garminconnect
+    tzlocal
+  ];
+
+  meta = with lib; {
+    description = "The Garmin Connect integration allows you to expose data from Garmin Connect to Home Assistant";
+    homepage = "https://github.com/cyberjunky/home-assistant-garmin_connect";
+    maintainers = with maintainers; [
+      matthiasbeyer
+      dmadisetti
+    ];
+    license = licenses.mit;
+  };
+}

pkgs/servers/home-assistant/custom-lovelace-modules/default.nix

@@ -1,9 +1,10 @@
-{ callPackage
+{
+  lib,
+  pkgs,
+  callPackage,
 }:
 
 {
-  android-tv-card = callPackage ./android-tv-card { };
-
   apexcharts-card = callPackage ./apexcharts-card { };
 
   atomic-calendar-revive = callPackage ./atomic-calendar-revive { };
@@ -32,7 +33,14 @@
 
   template-entity-row = callPackage ./template-entity-row { };
 
+  universal-remote-card = callPackage ./universal-remote-card { };
+
   valetudo-map-card = callPackage ./valetudo-map-card { };
 
   zigbee2mqtt-networkmap = callPackage ./zigbee2mqtt-networkmap { };
 }
+// lib.optionalAttrs pkgs.config.allowAliases {
+  android-tv-card =
+    lib.warn "`home-assistant-custom-lovelace-modules.android-tv-card` has been renamed to `universal-remote-card`"
+    pkgs.home-assistant-custom-lovelace-modules.universal-remote-card;
+}

pkgs/servers/home-assistant/custom-lovelace-modules/universal-remote-card/default.nix

@@ -4,33 +4,33 @@
 }:
 
 buildNpmPackage rec {
-  pname = "android-tv-card";
+  pname = "universal-remote-card";
-  version = "3.9.4";
+  version = "4.0.0";
 
   src = fetchFromGitHub {
     owner = "Nerwyn";
     repo = "android-tv-card";
     rev = version;
-    hash = "sha256-I50WNH/OL7O6YrZ0yf+uPJc05STJrjP8DS/wfaSBTHU=";
+    hash = "sha256-vQfXsEMYPga816X8eGYdjgpou38KfMtLcKjIGkT25xU=";
   };
 
   patches = [ ./dont-call-git.patch ];
 
-  npmDepsHash = "sha256-cuc7+QziclvJWp7MncLjkzfub5UbWYPVoUC/DZfs38g=";
+  npmDepsHash = "sha256-lFpgO/5JEmnl1wXLuy/OqncxPSx96BTydbprGEN+feM=";
 
   installPhase = ''
     runHook preInstall
 
     mkdir $out
-    cp dist/android-tv-card.min.js $out
+    cp dist/universal-remote-card.min.js $out
 
     runHook postInstall
   '';
 
-  passthru.entrypoint = "android-tv-card.min.js";
+  passthru.entrypoint = "universal-remote-card.min.js";
 
   meta = with lib; {
-    description = "Universal Customizable TV Remote Card, with HA actions, super configurable touchpad, slider, haptics, and keyboard";
+    description = "Completely customizable universal remote card for Home Assistant. Supports multiple platforms out of the box";
     homepage = "https://github.com/Nerwyn/android-tv-card";
     license = licenses.asl20;
     maintainers = with maintainers; [ k900 ];

pkgs/servers/monitoring/grafana-image-renderer/default.nix

@@ -7,18 +7,18 @@
 
 mkYarnPackage rec {
   pname = "grafana-image-renderer";
-  version = "3.11.3";
+  version = "3.11.4";
 
   src = fetchFromGitHub {
     owner = "grafana";
     repo = "grafana-image-renderer";
     rev = "v${version}";
-    hash = "sha256-a++aQt2y7+Nrvjka9XV7j8YwmppWFnUffFO4XEiZVvo=";
+    hash = "sha256-ob+YSHuu8vnj3TeAeXa9vTaRJouWpgsdq0gvdKV3BnA=";
   };
 
   offlineCache = fetchYarnDeps {
     yarnLock = src + "/yarn.lock";
-    hash = "sha256-rW9mxrM4aHKGojyRbsxQe3ZZJQ8I42PJ0MplkVu3qyA=";
+    hash = "sha256-ZrP3cLGyA8I1EhYrQPkqUwUk52FvVxR8Wg4OGllNRmg=";
   };
 
   packageJSON = ./package.json;

pkgs/servers/monitoring/grafana-image-renderer/package.json

@@ -28,7 +28,7 @@
     "@grpc/grpc-js": "^1.8.22",
     "@grpc/proto-loader": "^0.7.2",
     "@hapi/boom": "^10.0.0",
-    "@puppeteer/browsers": "^1.6.0",
+    "@puppeteer/browsers": "^2.3.1",
     "chokidar": "^3.5.2",
     "dompurify": "^2.4.0",
     "express": "^4.19.2",
@@ -40,10 +40,10 @@
     "morgan": "^1.9.0",
     "multer": "^1.4.5-lts.1",
     "on-finished": "^2.3.0",
-    "poolpeteer": "^0.23.0",
+    "poolpeteer": "^0.24.0",
     "prom-client": "^14.1.0",
-    "puppeteer": "^21.0.3",
+    "puppeteer": "^22.8.2",
-    "puppeteer-cluster": "^0.23.0",
+    "puppeteer-cluster": "^0.24.0",
     "unique-filename": "^2.0.1",
     "winston": "^3.8.2"
   },
@@ -59,7 +59,7 @@
     "@types/supertest": "^2.0.15",
     "@typescript-eslint/eslint-plugin": "5.37.0",
     "@typescript-eslint/parser": "5.37.0",
-    "axios": "1.6.7",
+    "axios": "1.7.4",
     "cross-env": "7.0.3",
     "eslint": "8.23.1",
     "fast-png": "^6.2.0",

pkgs/tools/security/nuclei/default.nix

@@ -6,16 +6,16 @@
 
 buildGoModule rec {
   pname = "nuclei";
-  version = "3.3.1";
+  version = "3.3.2";
 
   src = fetchFromGitHub {
     owner = "projectdiscovery";
     repo = "nuclei";
     rev = "refs/tags/v${version}";
-    hash = "sha256-pUctan5p3jxrj2/98nzibZQAL2EK8R5jnD/hjVgxSzQ=";
+    hash = "sha256-CBZeo2k9ZA41NotA6XIhkIQkEDvcbSIBCnPSOYXlLDQ=";
   };
 
-  vendorHash = "sha256-sJkkgh7F5Hgj9K6m7OTQbamkcS3uS78jK9HdLYeypIU=";
+  vendorHash = "sha256-ewjJ89tCeedlTGngB7yU8JbfoTnPUw5Pg2iMwjg1SgU=";
 
   subPackages = [ "cmd/nuclei/" ];
 

pkgs/tools/system/netdata/default.nix

@@ -20,7 +20,7 @@
 }:
 
 stdenv.mkDerivation rec {
-  version = "1.46.1";
+  version = "1.47.0";
   pname = "netdata";
 
   src = fetchFromGitHub {
@@ -28,9 +28,9 @@ stdenv.mkDerivation rec {
     repo = "netdata";
     rev = "v${version}";
     hash = if withCloudUi
-      then "sha256-tFjczhJ7bIEUDZx3MxYBu4tGkJhoQn5V79D4sLV2o8U="
+      then "sha256-eMapy4HQaEblDfZt2uVSfBWRlkstX7TxZDBgSv5bW/I="
       # we delete the v2 GUI after fetching
-      else "sha256-uW3jRiJjFIFSfmmavM3KVF985F8nMKa+lQAgNBZvKyE=";
+      else "sha256-Gx7u3Owh/fVAnSw91xfdcmyx4m+bvQAvDaUxzXQ36/0=";
     fetchSubmodules = true;
 
     # Remove v2 dashboard distributed under NCUL1. Make sure an empty
@@ -46,7 +46,7 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [ cmake pkg-config makeWrapper go ninja ]
     ++ lib.optionals withCups [ cups.dev ];
   # bash is only used to rewrite shebangs
-  buildInputs = [ bash curl jemalloc json_c libuv zlib libyaml ]
+  buildInputs = [ bash curl jemalloc json_c libuv zlib libyaml lm_sensors ]
     ++ lib.optionals stdenv.isDarwin [ CoreFoundation IOKit libossp_uuid ]
     ++ lib.optionals (!stdenv.isDarwin) [ libcap libuuid ]
     ++ lib.optionals withCups [ cups ]
@@ -69,7 +69,7 @@ stdenv.mkDerivation rec {
     ./dashboard-v2-removal.patch
   ];
 
-  # Guard against unused buld-time development inputs in closure. Without
+  # Guard against unused build-time development inputs in closure. Without
   # the ./skip-CONFIGURE_COMMAND.patch patch the closure retains inputs up
   # to bootstrap tools:
   #   https://github.com/NixOS/nixpkgs/pull/175719
@@ -94,8 +94,6 @@ stdenv.mkDerivation rec {
        $out/libexec/netdata/plugins.d/slabinfo.plugin.org
     mv $out/libexec/netdata/plugins.d/debugfs.plugin \
        $out/libexec/netdata/plugins.d/debugfs.plugin.org
-    mv $out/libexec/netdata/plugins.d/logs-management.plugin \
-       $out/libexec/netdata/plugins.d/logs-management.plugin.org
     ${lib.optionalString withSystemdJournal ''
       mv $out/libexec/netdata/plugins.d/systemd-journal.plugin \
          $out/libexec/netdata/plugins.d/systemd-journal.plugin.org
@@ -115,30 +113,31 @@ stdenv.mkDerivation rec {
   '';
 
   preConfigure = lib.optionalString (!stdenv.isDarwin) ''
-    substituteInPlace src/collectors/python.d.plugin/python_modules/third_party/lm_sensors.py \
-      --replace-fail 'ctypes.util.find_library("sensors")' '"${lm_sensors.out}/lib/libsensors${stdenv.hostPlatform.extensions.sharedLibrary}"'
-  '' + ''
     export GOCACHE=$TMPDIR/go-cache
     export GOPATH=$TMPDIR/go
-    export GOPROXY=file://${passthru.netdata-go-modules}
     export GOSUMDB=off
 
+    substituteInPlace packaging/cmake/Modules/NetdataGoTools.cmake \
+      --replace-fail \
+        'GOPROXY=https://proxy.golang.org' \
+        'GOPROXY=file://${passthru.netdata-go-modules}'
+
     # Prevent the path to be caught into the Nix store path.
     substituteInPlace CMakeLists.txt \
-      --replace-fail 'set(CACHE_DIR "''${CMAKE_INSTALL_PREFIX}/var/cache/netdata")' 'set(CACHE_DIR "/var/cache/netdata")' \
+      --replace-fail 'set(CACHE_DIR "''${NETDATA_RUNTIME_PREFIX}/var/cache/netdata")' 'set(CACHE_DIR "/var/cache/netdata")' \
-      --replace-fail 'set(CONFIG_DIR "''${CMAKE_INSTALL_PREFIX}/etc/netdata")' 'set(CONFIG_DIR "/etc/netdata")' \
+      --replace-fail 'set(CONFIG_DIR "''${NETDATA_RUNTIME_PREFIX}/etc/netdata")' 'set(CONFIG_DIR "/etc/netdata")' \
-      --replace-fail 'set(LIBCONFIG_DIR "''${CMAKE_INSTALL_PREFIX}/usr/lib/netdata/conf.d")' 'set(LIBCONFIG_DIR "${placeholder "out"}/share/netdata/conf.d")' \
+      --replace-fail 'set(LIBCONFIG_DIR "''${NETDATA_RUNTIME_PREFIX}/usr/lib/netdata/conf.d")' 'set(LIBCONFIG_DIR "${placeholder "out"}/share/netdata/conf.d")' \
-      --replace-fail 'set(LOG_DIR "''${CMAKE_INSTALL_PREFIX}/var/log/netdata")' 'set(LOG_DIR "/var/log/netdata")' \
+      --replace-fail 'set(LOG_DIR "''${NETDATA_RUNTIME_PREFIX}/var/log/netdata")' 'set(LOG_DIR "/var/log/netdata")' \
-      --replace-fail 'set(PLUGINS_DIR "''${CMAKE_INSTALL_PREFIX}/usr/libexec/netdata/plugins.d")' 'set(PLUGINS_DIR "${placeholder "out"}/libexec/netdata/plugins.d")' \
+      --replace-fail 'set(PLUGINS_DIR "''${NETDATA_RUNTIME_PREFIX}/usr/libexec/netdata/plugins.d")' 'set(PLUGINS_DIR "${placeholder "out"}/libexec/netdata/plugins.d")' \
-      --replace-fail 'set(VARLIB_DIR "''${CMAKE_INSTALL_PREFIX}/var/lib/netdata")' 'set(VARLIB_DIR "/var/lib/netdata")' \
+      --replace-fail 'set(VARLIB_DIR "''${NETDATA_RUNTIME_PREFIX}/var/lib/netdata")' 'set(VARLIB_DIR "/var/lib/netdata")' \
-      --replace-fail 'set(pkglibexecdir_POST "''${CMAKE_INSTALL_PREFIX}/usr/libexec/netdata")' 'set(pkglibexecdir_POST "${placeholder "out"}/libexec/netdata")' \
+      --replace-fail 'set(pkglibexecdir_POST "''${NETDATA_RUNTIME_PREFIX}/usr/libexec/netdata")' 'set(pkglibexecdir_POST "${placeholder "out"}/libexec/netdata")' \
-      --replace-fail 'set(localstatedir_POST "''${CMAKE_INSTALL_PREFIX}/var")' 'set(localstatedir_POST "/var")' \
+      --replace-fail 'set(localstatedir_POST "''${NETDATA_RUNTIME_PREFIX}/var")' 'set(localstatedir_POST "/var")' \
-      --replace-fail 'set(sbindir_POST "''${CMAKE_INSTALL_PREFIX}/usr/sbin")' 'set(sbindir_POST "${placeholder "out"}/bin")' \
+      --replace-fail 'set(sbindir_POST "''${NETDATA_RUNTIME_PREFIX}/''${BINDIR}")' 'set(sbindir_POST "${placeholder "out"}/bin")' \
-      --replace-fail 'set(configdir_POST "''${CMAKE_INSTALL_PREFIX}/etc/netdata")' 'set(configdir_POST "/etc/netdata")' \
+      --replace-fail 'set(configdir_POST "''${NETDATA_RUNTIME_PREFIX}/etc/netdata")' 'set(configdir_POST "/etc/netdata")' \
-      --replace-fail 'set(libconfigdir_POST "''${CMAKE_INSTALL_PREFIX}/usr/lib/netdata/conf.d")' 'set(libconfigdir_POST "${placeholder "out"}/share/netdata/conf.d")' \
+      --replace-fail 'set(libconfigdir_POST "''${NETDATA_RUNTIME_PREFIX}/usr/lib/netdata/conf.d")' 'set(libconfigdir_POST "${placeholder "out"}/share/netdata/conf.d")' \
-      --replace-fail 'set(cachedir_POST "''${CMAKE_INSTALL_PREFIX}/var/cache/netdata")' 'set(libconfigdir_POST "/var/cache/netdata")' \
+      --replace-fail 'set(cachedir_POST "''${NETDATA_RUNTIME_PREFIX}/var/cache/netdata")' 'set(libconfigdir_POST "/var/cache/netdata")' \
-      --replace-fail 'set(registrydir_POST "''${CMAKE_INSTALL_PREFIX}/var/lib/netdata/registry")' 'set(registrydir_POST "/var/lib/netdata/registry")' \
+      --replace-fail 'set(registrydir_POST "''${NETDATA_RUNTIME_PREFIX}/var/lib/netdata/registry")' 'set(registrydir_POST "/var/lib/netdata/registry")' \
-      --replace-fail 'set(varlibdir_POST "''${CMAKE_INSTALL_PREFIX}/var/lib/netdata")' 'set(varlibdir_POST "/var/lib/netdata")'
+      --replace-fail 'set(varlibdir_POST "''${NETDATA_RUNTIME_PREFIX}/var/lib/netdata")' 'set(varlibdir_POST "/var/lib/netdata")'
   '';
 
   cmakeFlags = [
@@ -179,9 +178,9 @@ stdenv.mkDerivation rec {
       pname = "netdata-go-plugins";
       inherit version src;
 
-      sourceRoot = "${src.name}/src/go/collectors/go.d.plugin";
+      sourceRoot = "${src.name}/src/go/plugin/go.d";
 
-      vendorHash = "sha256-fK6pboXgJom77iakb+CJvNuweQjLIrpS7suWRNY/KM4=";
+      vendorHash = "sha256-NZ1tg+lvXNgypqmjjb5f7dHH6DIA9VOa4PMM4eq11n0=";
       doCheck = false;
       proxyVendor = true;
 

pkgs/tools/system/netdata/ndsudo-fix-path.patch

@@ -2,7 +2,7 @@
 #     https://github.com/netdata/netdata/security/advisories/GHSA-pmhq-4cxq-wj93
 
 diff --git a/src/collectors/plugins.d/ndsudo.c b/src/collectors/plugins.d/ndsudo.c
-index 8b4d76f46..68fa52d38 100644
+index d53ca9f28..b42a121bf 100644
 --- a/src/collectors/plugins.d/ndsudo.c
 +++ b/src/collectors/plugins.d/ndsudo.c
 @@ -357,9 +357,6 @@ int main(int argc, char *argv[]) {
@@ -12,5 +12,6 @@ index 8b4d76f46..68fa52d38 100644
 -    char new_path[] = "PATH=/bin:/sbin:/usr/bin:/usr/sbin:/usr/local/bin:/usr/local/sbin";
 -    putenv(new_path);
 -
-     bool found = false;
+     setuid(0);
-     char filename[FILENAME_MAX];
+     setgid(0);
+     setegid(0);

pkgs/tools/text/runiq/default.nix

@@ -1,15 +1,21 @@
-{ lib, rustPlatform, fetchCrate, stdenv, darwin }:
+{ lib, rustPlatform, fetchFromGitHub, stdenv, darwin }:
 
 rustPlatform.buildRustPackage rec {
   pname = "runiq";
-  version = "2.0.0";
+  version = "2.0.0-unstable-2024-08-19";
 
-  src = fetchCrate {
+  src = fetchFromGitHub {
-    inherit pname version;
+    owner = "whitfin";
-    hash = "sha256-qcgPuJOpK2fCsHAgzoIKF7upb9B3ySIZkpu9xf4JnCc=";
+    repo = "runiq";
+    rev = "a642926f6ec09d4faeebebb563d4aed89e0d36fb";
+    hash = "sha256-DWP0kbTjXlyUI/+bHgom9/XJ2XW/BJEU4xvIisPVug0=";
   };
 
-  cargoHash = "sha256-WSMV0GNKNckN9uSPN647iDloGkNtaKcrZbeyglUappc=";
+  cargoLock.lockFile = ./Cargo.lock;
+
+  postPatch = ''
+    ln -s ${./Cargo.lock} Cargo.lock
+  '';
 
   buildInputs = lib.optionals stdenv.isDarwin [
     darwin.apple_sdk.frameworks.Security

pkgs/top-level/all-packages.nix

@@ -25093,6 +25093,25 @@ with pkgs;
 
   meteor = callPackage ../servers/meteor { };
 
+  micro-full = micro.wrapper.override {
+    extraPackages = [
+      wl-clipboard
+      xclip
+    ];
+  };
+
+  micro-with-wl-clipboard = micro.wrapper.override {
+    extraPackages = [
+      wl-clipboard
+    ];
+  };
+
+  micro-with-xclip = micro.wrapper.override {
+    extraPackages = [
+      xclip
+    ];
+  };
+
   micronaut = callPackage ../development/tools/micronaut { };
 
   minio = callPackage ../servers/minio { };
@@ -31993,7 +32012,7 @@ with pkgs;
     autoreconfHook = buildPackages.autoreconfHook269;
   };
 
-  musescore = libsForQt5.callPackage ../applications/audio/musescore { };
+  musescore = qt6.callPackage ../applications/audio/musescore { };
 
   music-player = callPackage ../applications/audio/music-player { };