Merge d229de74ad into haskell-updates

maintainers/maintainer-list.nix

@@ -17322,6 +17322,17 @@
     githubId = 7831184;
     name = "John Mercier";
   };
+  mochienya = {
+    name = "mochienya";
+    github = "mochienya";
+    githubId = 187453775;
+    matrix = "@mochienya:matrix.org";
+    keys = [
+      {
+        fingerprint = "7A49 5110 84F4 EAF1 BE30  5CF0 CC3B E964 564F 9554";
+      }
+    ];
+  };
   mockersf = {
     email = "francois.mockers@vleue.com";
     github = "mockersf";
@@ -18721,6 +18732,12 @@
     github = "noahgitsham";
     githubId = 73707948;
   };
+  nobbele = {
+    name = "nobbele";
+    email = "realnobbele@gmail.com";
+    github = "nobbele";
+    githubId = 17962514;
+  };
   nobbz = {
     name = "Norbert Melzer";
     email = "timmelzer+nixpkgs@gmail.com";

nixos/doc/manual/development/option-types.section.md

@@ -316,22 +316,34 @@ A union of types is a type such that a value is valid when it is valid for at le
 
 If some values are instances of more than one of the types, it is not possible to distinguish which type they are meant to be instances of. If that's needed, consider using a [sum type](#sec-option-types-sums).
 
+<!-- SYNC WITH oneOf BELOW -->
 `types.either` *`t1 t2`*
 
 :   Type *`t1`* or type *`t2`*, e.g. `with types; either int str`.
     Multiple definitions cannot be merged.
 
+    ::: {.warning}
+    `either` and `oneOf` eagerly decide the active type based on the passed types' shallow check method. For composite types like `attrsOf` and `submodule`, which both match all attribute set definitions, the first type argument will be chosen for the returned option value, and this therefore also decides how nested values are checked and merged. For example, `either (attrsOf int) (submodule {...})` will always use `attrsOf int` for any attribute set value, even if it was intended as a submodule. This behavior is a trade-off that keeps the implementation simple and the evaluation order predictable, avoiding unexpected strictness problems such as infinite recursions. When proper type discrimination is needed, consider using a [sum type](#sec-option-types-sums) like `attrTag` instead.
+    :::
+
+<!-- SYNC WITH either ABOVE -->
 `types.oneOf` \[ *`t1 t2`* ... \]
 
 :   Type *`t1`* or type *`t2`* and so forth, e.g.
     `with types; oneOf [ int str bool ]`. Multiple definitions cannot be
     merged.
 
+    ::: {.warning}
+    `either` and `oneOf` eagerly decide the active type based on the passed types' shallow check method. For composite types like `attrsOf` and `submodule`, which both match all attribute set definitions, the first matching type in the list will be chosen for the returned option value, and this therefore also decides how nested values are checked and merged. For example, `oneOf [ (attrsOf int) (submodule {...}) ]` will always use `attrsOf int` for any attribute set value, even if it was intended as a submodule. This behavior is a trade-off that keeps the implementation simple and the evaluation order predictable, avoiding unexpected strictness problems such as infinite recursions. When proper type discrimination is needed, consider using a [sum type](#sec-option-types-sums) like `attrTag` instead.
+    :::
+
 `types.nullOr` *`t`*
 
 :   `null` or type *`t`*. Multiple definitions are merged according to
     type *`t`*.
 
+    This is mostly equivalent to `either (enum [ null ]) t`, but `nullOr` provides a `null` fallback for attribute values with `mkIf false` definitions in `lazyAttrsOf (nullOr t)`, whereas `either` would throw an error when the attribute is accessed.
+
 
 ## Sum types {#sec-option-types-sums}
 

nixos/doc/manual/release-notes/rl-2511.section.md

@@ -377,6 +377,8 @@ and [release notes for v18](https://goteleport.com/docs/changelog/#1800-070325).
 
 - `services.gitea` supports sending notifications with sendmail again. To do this, activate the parameter `services.gitea.mailerUseSendmail` and configure SMTP server.
 
+- `services.mattermost` has been updated to use the 10.11 ESR instead of 10.5. While this shouldn't break anyone, we also now package Mattermost 11 as mattermostLatest. Note that Mattermost 11 drops support for MySQL. The Mattermost module will assertion fail if you try to use MySQL with Mattermost 11; support for using MySQL with Mattermost will fully be removed in NixOS 26.
+
 - `simplesamlphp` has been removed since the package was severely outdated, unmaintained in nixpkgs and having known vulnerabilities.
 
 - `networking.wireless.networks.<name>` now has an option to specify SSID, hence allowing duplicated SSID setup. The BSSID option is added along side with this.

nixos/modules/services/misc/rsync.nix

@@ -119,15 +119,6 @@ in
   };
 
   config = lib.mkIf cfg.enable {
-    assertions = [
-      {
-        assertion = lib.all (job: job.sources != [ ]) (lib.attrValues cfg.jobs);
-        message = ''
-          At least one source directory must be provided to rsync.
-        '';
-      }
-    ];
-
     systemd = lib.mkMerge (
       lib.mapAttrsToList (
         jobName: job:

nixos/modules/services/web-apps/mattermost.nix

@@ -966,6 +966,13 @@ in
             or hostname, and services.mattermost.port to specify the port separately.
           '';
         }
+        {
+          # Can't use MySQL on version 11.
+          assertion = versionAtLeast cfg.package.version "11" -> cfg.database.driver == "postgres";
+          message = ''
+            Only Postgres is supported as the database driver in Mattermost 11 and later.
+          '';
+        }
       ];
     })
     (mkIf cfg.matterircd.enable {

nixos/tests/mattermost/default.nix

@@ -69,27 +69,11 @@ import ../make-test-python.nix (
         )
         extraConfig
       ];
-
-    makeMysql =
-      mattermostConfig: extraConfig:
-      lib.mkMerge [
-        mattermostConfig
-        (
-          { pkgs, config, ... }:
-          {
-            services.mattermost.database = {
-              driver = lib.mkForce "mysql";
-              peerAuth = lib.mkForce true;
-            };
-          }
-        )
-        extraConfig
-      ];
   in
   {
     name = "mattermost";
 
-    nodes = rec {
+    nodes = {
       postgresMutable = makeMattermost {
         mutableConfig = true;
         preferNixConfig = false;
@@ -174,25 +158,6 @@ import ../make-test-python.nix (
           MM_SUPPORTSETTINGS_ABOUTLINK=https://nixos.org
         '';
       } { };
-
-      mysqlMutable = makeMysql postgresMutable { };
-      mysqlMostlyMutable = makeMysql postgresMostlyMutable { };
-      mysqlImmutable = makeMysql postgresImmutable {
-        # Let's try to use this on MySQL.
-        services.mattermost.database = {
-          peerAuth = lib.mkForce true;
-          user = lib.mkForce "mmuser";
-          name = lib.mkForce "mmuser";
-        };
-      };
-      mysqlEnvironmentFile = makeMysql postgresEnvironmentFile {
-        services.mattermost.environmentFile = lib.mkForce (
-          pkgs.writeText "mattermost-env" ''
-            MM_SQLSETTINGS_DATASOURCE=mattermost@unix(/run/mysqld/mysqld.sock)/mattermost?charset=utf8mb4,utf8&writeTimeout=30s
-            MM_SUPPORTSETTINGS_ABOUTLINK=https://nixos.org
-          ''
-        );
-      };
     };
 
     testScript =
@@ -567,22 +532,6 @@ import ../make-test-python.nix (
             shutdown_queue.task_done()
         threading.Thread(target=shutdown_worker, daemon=True).start()
 
-        ${pkgs.lib.optionalString pkgs.stdenv.hostPlatform.isx86_64 ''
-          # Only run the MySQL tests on x86_64 so we don't have to debug MySQL ARM issues.
-          run_mattermost_tests(
-            shutdown_queue,
-            "${nodes.mysqlMutable.system.build.toplevel}",
-            mysqlMutable,
-            "${nodes.mysqlMostlyMutable.system.build.toplevel}",
-            "${nodes.mysqlMostlyMutable.services.mattermost.pluginsBundle}",
-            mysqlMostlyMutable,
-            "${nodes.mysqlImmutable.system.build.toplevel}",
-            mysqlImmutable,
-            "${nodes.mysqlEnvironmentFile.system.build.toplevel}",
-            mysqlEnvironmentFile
-          )
-        ''}
-
         run_mattermost_tests(
           shutdown_queue,
           "${nodes.postgresMutable.system.build.toplevel}",

pkgs/applications/networking/browsers/palemoon/bin.nix

@@ -23,7 +23,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "palemoon-bin";
-  version = "33.9.0.1";
+  version = "33.9.1";
 
   src = finalAttrs.passthru.sources."gtk${if withGTK3 then "3" else "2"}";
 
@@ -173,11 +173,11 @@ stdenv.mkDerivation (finalAttrs: {
       {
         gtk3 = fetchzip {
           urls = urlRegionVariants "gtk3";
-          hash = "sha256-QhER20l8GP0wQ0pDVwBZbYb2FImbX0kiUS9RCcR7gvg=";
+          hash = "sha256-muFqS3NpYX0Walhd+RFIZh7pUKQ5ZbPMZJasm9+rqTE=";
         };
         gtk2 = fetchzip {
           urls = urlRegionVariants "gtk2";
-          hash = "sha256-13lq59H8xGNbZHalZo87xAaoQg61t2v+B/LXnPoEyoU=";
+          hash = "sha256-lRFXpv+dp3ALVSiEDwE4kiaVjBX5XuVZeugEr+St53I=";
         };
       };
 

pkgs/applications/networking/cluster/terraform-providers/providers.json

@@ -489,13 +489,13 @@
     "vendorHash": "sha256-MYVkNvJ+rbwGw0htClIbmxk3YX2OK/ZO/QOTyMRFiug="
   },
   "hashicorp_aws": {
-    "hash": "sha256-paVJc2HHtdAoc1KoYj0P5/t990/9nZedqBnjJNvmoOM=",
+    "hash": "sha256-5W5v4j4oBXIfqW75ClXkBtAahgEW6oMiTmILL6++fEc=",
     "homepage": "https://registry.terraform.io/providers/hashicorp/aws",
     "owner": "hashicorp",
     "repo": "terraform-provider-aws",
-    "rev": "v6.17.0",
+    "rev": "v6.18.0",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-93DyqAPi6hirke0KyR6gggC7cgAZOOByUIIA6C+6LZU="
+    "vendorHash": "sha256-Nxw5C4li2kH6MAlyaqHAUL+XYyuVPZYSkQ6PnmL3sV8="
   },
   "hashicorp_awscc": {
     "hash": "sha256-SrJQG1F9V/HThL6TDduT/qEA2x3tzII56+JMVDFpqEk=",
@@ -741,11 +741,11 @@
     "vendorHash": null
   },
   "integrations_github": {
-    "hash": "sha256-OexDIuEHRSOeHq0lRZcaaezdQpm5tgINGcka6jk+bK0=",
+    "hash": "sha256-FVDx8KH7foy1rZigDVEWMEalQ9nJnLkRjkJsFi0aEuM=",
     "homepage": "https://registry.terraform.io/providers/integrations/github",
     "owner": "integrations",
     "repo": "terraform-provider-github",
-    "rev": "v6.7.0",
+    "rev": "v6.7.1",
     "spdx": "MIT",
     "vendorHash": null
   },

pkgs/by-name/al/alfis/package.nix

@@ -12,16 +12,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "alfis";
-  version = "0.8.7";
+  version = "0.8.8";
 
   src = fetchFromGitHub {
     owner = "Revertron";
     repo = "Alfis";
     tag = "v${version}";
-    hash = "sha256-u5luVJRNIuGqqNyh+C7nMSkZgoq/S7gpmsEiz8ntmC4=";
+    hash = "sha256-gRk4kvIV+5cCUFaJvGbTAR44678Twa28iMGZ75lJz2c=";
   };
 
-  cargoHash = "sha256-ittJ/iKcmvd5r8oaBoGhi/E2osq245OWxSC+VH+bme4=";
+  cargoHash = "sha256-Ge0+7ClXlJFT6CyluHF7k4stsX+KuYp/riro1pvrcKM=";
 
   nativeBuildInputs = [
     pkg-config

pkgs/by-name/an/animdl/package.nix

@@ -21,6 +21,7 @@ python3Packages.buildPythonApplication {
   ];
 
   pythonRelaxDeps = [
+    "click"
     "cssselect"
     "httpx"
     "lxml"
@@ -55,12 +56,11 @@ python3Packages.buildPythonApplication {
 
   doCheck = true;
 
-  meta = with lib; {
+  meta = {
     description = "Highly efficient, powerful and fast anime scraper";
     homepage = "https://github.com/justfoolingaround/animdl";
-    license = licenses.gpl3Only;
+    license = lib.licenses.gpl3Only;
     mainProgram = "animdl";
-    maintainers = with maintainers; [ passivelemon ];
+    maintainers = with lib.maintainers; [ passivelemon ];
-    platforms = [ "x86_64-linux" ];
   };
 }

pkgs/by-name/ap/apkeditor/arsclib/default.nix

@@ -8,8 +8,8 @@
 let
   self = REAndroidLibrary {
     pname = "arsclib";
-    # 1.3.5 is not new enough for APKEditor because of API changes
+    # 1.3.8 is not new enough for APKEditor because of API changes
-    version = "1.3.5-unstable-2024-10-21";
+    version = "1.3.8-unstable-2025-09-23";
     projectName = "ARSCLib";
 
     src = fetchFromGitHub {
@@ -18,8 +18,8 @@ let
       # This is the latest commit at the time of packaging.
       # It can be changed to a stable release ("V${version}")
       # if it is compatible with APKEditor.
-      rev = "ed6ccf00e56d7cce13e8648ad46a2678a6093248";
+      rev = "7238433395dea6f7d0fce3139f1659063ac31f42";
-      hash = "sha256-jzd7xkc4O+P9hlGsFGGl2P3pqVvV5+mDyKTRUuGfFSA=";
+      hash = "sha256-93eskC/qdkkNAZFYqSzoFxhmWgzTvDyZmZxOvwELGCs=";
     };
 
     mitmCache = gradle.fetchDeps {

pkgs/by-name/ap/apkeditor/jcommand/default.nix

@@ -8,7 +8,7 @@
 let
   self = REAndroidLibrary {
     pname = "jcommand";
-    version = "0-unstable-2024-09-20";
+    version = "0-unstable-2025-01-21";
     projectName = "JCommand";
 
     src = fetchFromGitHub {
@@ -18,8 +18,8 @@ let
       # it is hard to determine the actual commit that APKEditor is intended to use,
       # so I think we should use the latest commit that doesn't break compilation or basic functionality.
       # Currently this is the latest commit at the time of packaging.
-      rev = "714b6263c28dabb34adc858951cf4bc60d6c3fed";
+      rev = "27d5fd21dc7da268182ea81e59007af890adb06e";
-      hash = "sha256-6Em+1ddUkZBCYWs88qtfeGnxISZchFrHgDL8fsgZoQg=";
+      hash = "sha256-sbblGrp16rMGGGt7xAFd9F3ACeadYYEymBEL+s5BZ1E=";
     };
 
     mitmCache = gradle.fetchDeps {

pkgs/by-name/ap/apkeditor/package.nix

@@ -3,6 +3,7 @@
   stdenv,
   fetchFromGitHub,
   callPackage,
+  versionCheckHook,
 
   jre,
   gradle,
@@ -54,7 +55,7 @@ let
   apkeditor =
     let
       pname = "apkeditor";
-      version = "1.4.1";
+      version = "1.4.5";
       projectName = "APKEditor";
     in
     REAndroidLibrary {
@@ -69,8 +70,8 @@ let
       src = fetchFromGitHub {
         owner = "REAndroid";
         repo = "APKEditor";
-        tag = "v${version}";
+        tag = "V${version}";
-        hash = "sha256-a72j9qGjJXnTFeqLez2rhBSArFVYCX+Xs7NQd8CY5Yk=";
+        hash = "sha256-yuNMyEnxTjHPSBPWVD8b+f612hWGGayZHKHxtWtxXDg=";
       };
 
       patches = [
@@ -99,8 +100,15 @@ let
           --add-flags "-jar $out/${apkeditor.outJar}"
       '';
 
+      doInstallCheck = true;
+      nativeInstallCheckInputs = [ versionCheckHook ];
+
+      passthru.updateScript = ./update.sh;
+
       meta = {
         description = "Powerful android apk resources editor";
+        homepage = "https://github.com/REAndroid/APKEditor";
+        changelog = "https://github.com/REAndroid/APKEditor/releases/tag/V${version}";
         maintainers = with lib.maintainers; [ ulysseszhan ];
         license = lib.licenses.asl20;
         platforms = lib.platforms.all;

pkgs/by-name/ap/apkeditor/smali/default.nix

@@ -8,7 +8,7 @@
 let
   self = REAndroidLibrary {
     pname = "smali";
-    version = "0-unstable-2024-10-15";
+    version = "0-unstable-2024-11-24";
     projectName = "smali";
 
     src = fetchFromGitHub {
@@ -18,8 +18,8 @@ let
       # it is hard to determine the actual commit that APKEditor is intended to use,
       # so I think we should use the latest commit that doesn't break compilation or basic functionality.
       # Currently this is the latest commit at the time of packaging.
-      rev = "c781eafb31f526abce9fdf406ce2c925fec20d28";
+      rev = "76b35b4e0c9e8c874ca3e374bb943bba8d280770";
-      hash = "sha256-6tkvikgWMUcKwzsgbfpxlB6NZBAlZtTE34M3qPQw7Y4=";
+      hash = "sha256-PhRBjiIKA4EIiafPplZNBErXG8V84Xn0cZLWVPmJelQ=";
     };
 
     patches = [

pkgs/by-name/ap/apkeditor/update.sh

@@ -0,0 +1,58 @@
+#!/usr/bin/env nix-shell
+#!nix-shell -i bash -p curl jq common-updater-scripts
+
+set -euo pipefail
+
+GITHUB_TOKEN="${GITHUB_TOKEN:-}"
+
+nixpkgs_attr() {
+  nix-instantiate --eval --raw --attr "$1"
+}
+
+github_api() {
+  local token_opt=()
+  if [[ -n "$GITHUB_TOKEN" ]]; then
+    token_opt=(-H "Authorization: Bearer $GITHUB_TOKEN")
+  fi
+  curl -fsS "${token_opt[@]}" "https://api.github.com$1"
+}
+
+update_mitm_cache() {
+  if [[ -z "$(nixpkgs_attr "$1.mitmCache.name")" ]]; then
+    return
+  fi
+  "$(nix-build -A "$1.mitmCache.updateScript")"
+}
+
+update() {
+  echo "Updating $1..." >&2
+
+  local owner="$(nixpkgs_attr "$1.src.owner")"
+  local repo="$(nixpkgs_attr "$1.src.repo")"
+
+  local old_version="$(nixpkgs_attr "$1.version")"
+  local use_last_commit=0
+  if [[ "$old_version" == *unstable* ]]; then
+    use_last_commit=1
+  fi
+
+  if (( use_last_commit )); then
+    local repo_info="$(github_api "/repos/$owner/$repo/commits?per_page=1" | jq ".[0]")"
+    local new_rev="$(echo "$repo_info" | jq -r .sha)"
+    local date="$(echo "$repo_info" | jq -r .commit.author.date)"
+    date="$(date -u -d "$date" +%Y-%m-%d)"
+    local new_version="${old_version%%-unstable*}-unstable-$(date -u -d "$date" +%Y-%m-%d)"
+    update-source-version "$1" "$new_version" --rev="$new_rev" --ignore-same-version --ignore-same-hash
+  else
+    local tag="$(github_api "/repos/$owner/$repo/releases/latest" | jq -r .tag_name)"
+    local new_version="${tag#V}"
+    update-source-version "$1" "$new_version" --ignore-same-version --ignore-same-hash
+  fi
+
+  update_mitm_cache "$1"
+}
+
+update apkeditor.passthru.deps.arsclib
+update apkeditor.passthru.deps.smali
+update apkeditor.passthru.deps.jcommand
+update apkeditor

pkgs/by-name/ba/baidupcs-go/package.nix

@@ -7,16 +7,16 @@
 
 buildGoModule rec {
   pname = "baidupcs-go";
-  version = "3.9.9";
+  version = "4.0.0";
 
   src = fetchFromGitHub {
     owner = "qjfoidnh";
     repo = "BaiduPCS-Go";
     rev = "v${version}";
-    hash = "sha256-x0oEuj8LoR0yUkKOzI27u3AIFVDDV7vMHCqvjENHwv8=";
+    hash = "sha256-synfJtYZmIiK2SoTG0rt+qZ0ixXIXDXnrNL2s5eDtQY=";
   };
 
-  vendorHash = "sha256-hW+IrzS5+DublQUIIcecL08xoauTjba9qnAtpzNeDXw=";
+  vendorHash = "sha256-oOZeBCHpAasi9K77xA+8HxZErGWKwb4OaWzWhHagtQE=";
 
   doCheck = false;
 

pkgs/by-name/ba/basedpyright/package.nix

@@ -18,16 +18,16 @@
 
 buildNpmPackage rec {
   pname = "basedpyright";
-  version = "1.31.7";
+  version = "1.32.1";
 
   src = fetchFromGitHub {
     owner = "detachhead";
     repo = "basedpyright";
     tag = "v${version}";
-    hash = "sha256-mC+qnEI2a7tGjIIZxRzGY+VyfYnTY1brCKGHU3KOf0Q=";
+    hash = "sha256-bxqUH5MYwp8MLD8ve8afgN3qe3hCPRu0l7QO7m1ZSzA=";
   };
 
-  npmDepsHash = "sha256-dwtMl5dFpol+J+cM6EHiwO+F93Iyurwx9Kr317IGtVw=";
+  npmDepsHash = "sha256-zNmZ4wXxe31NnQ+VlTLoPM2zTDmKdw1D28pi/roybdQ=";
   npmWorkspace = "packages/pyright";
 
   preBuild = ''

pkgs/by-name/be/beammp-launcher/package.nix

@@ -63,7 +63,10 @@ stdenv.mkDerivation (finalAttrs: {
     homepage = "https://github.com/BeamMP/BeamMP-Launcher";
     license = lib.licenses.agpl3Only;
     mainProgram = "BeamMP-Launcher";
-    maintainers = [ lib.maintainers.Andy3153 ];
+    maintainers = with lib.maintainers; [
+      Andy3153
+      mochienya
+    ];
     platforms = lib.platforms.linux;
   };
 })

pkgs/by-name/bl/blightmud/package.nix

@@ -9,14 +9,14 @@
   withTTS ? false,
   speechd-minimal,
 }:
-rustPlatform.buildRustPackage rec {
+rustPlatform.buildRustPackage (finalAttrs: {
   pname = "blightmud";
   version = "5.3.1";
 
   src = fetchFromGitHub {
     owner = "blightmud";
     repo = "blightmud";
-    rev = "v${version}";
+    rev = "v${finalAttrs.version}";
     hash = "sha256-9GUul5EoejcnCQqq1oX+seBtxttYIUhgcexaZk+7chk=";
   };
 
@@ -59,7 +59,7 @@ rustPlatform.buildRustPackage rec {
     in
     builtins.concatStringsSep " " (map skipFlag skipList);
 
-  meta = with lib; {
+  meta = {
     description = "Terminal MUD client written in Rust";
     mainProgram = "blightmud";
     longDescription = ''
@@ -72,8 +72,8 @@ rustPlatform.buildRustPackage rec {
       friendly mode.
     '';
     homepage = "https://github.com/Blightmud/Blightmud";
-    license = licenses.gpl3Plus;
+    license = lib.licenses.gpl3Plus;
-    maintainers = with maintainers; [ cpu ];
+    maintainers = with lib.maintainers; [ cpu ];
-    platforms = platforms.linux ++ platforms.darwin;
+    platforms = with lib.platforms; linux ++ darwin;
   };
-}
+})

pkgs/by-name/ch/chiaki-ng/package.nix

@@ -8,13 +8,6 @@
   python3,
   ffmpeg,
   libopus,
-  wrapQtAppsHook,
-  qtbase,
-  qtmultimedia,
-  qtsvg,
-  qtwayland,
-  qtdeclarative,
-  qtwebengine,
   SDL2,
   libevdev,
   udev,
@@ -33,6 +26,7 @@
   lcms2,
   libdovi,
   xxHash,
+  kdePackages,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
@@ -42,7 +36,7 @@ stdenv.mkDerivation (finalAttrs: {
   src = fetchFromGitHub {
     owner = "streetpea";
     repo = "chiaki-ng";
-    rev = "v${finalAttrs.version}";
+    tag = "v${finalAttrs.version}";
     hash = "sha256-7pDQnlElnBkW+Nr6R+NaylZbsGH8dB31nd7jxYD66yQ=";
     fetchSubmodules = true;
   };
@@ -50,7 +44,7 @@ stdenv.mkDerivation (finalAttrs: {
   nativeBuildInputs = [
     cmake
     pkg-config
-    wrapQtAppsHook
+    kdePackages.wrapQtAppsHook
     protobuf
     python3
     python3.pkgs.wrapPython
@@ -61,12 +55,12 @@ stdenv.mkDerivation (finalAttrs: {
   buildInputs = [
     ffmpeg
     libopus
-    qtbase
+    kdePackages.qtbase
-    qtmultimedia
+    kdePackages.qtmultimedia
-    qtsvg
+    kdePackages.qtsvg
-    qtdeclarative
+    kdePackages.qtdeclarative
-    qtwayland
+    kdePackages.qtwayland
-    qtwebengine
+    kdePackages.qtwebengine
     protobuf
     SDL2
     curlFull
@@ -108,16 +102,16 @@ stdenv.mkDerivation (finalAttrs: {
     wrapPythonPrograms
   '';
 
-  meta = with lib; {
+  meta = {
     homepage = "https://streetpea.github.io/chiaki-ng/";
     description = "Next-Generation of Chiaki (the open-source remote play client for PlayStation)";
     # Includes OpenSSL linking exception that we currently have no way
     # to represent.
     #
     # See also: <https://github.com/spdx/license-list-XML/issues/939>
-    license = licenses.agpl3Only;
+    license = lib.licenses.agpl3Only;
-    maintainers = with maintainers; [ devusb ];
+    maintainers = with lib.maintainers; [ devusb ];
-    platforms = platforms.linux;
+    platforms = lib.platforms.linux;
     mainProgram = "chiaki";
   };
 })

pkgs/by-name/ch/chiaki/package.nix

@@ -6,24 +6,20 @@
   pkg-config,
   ffmpeg,
   libopus,
-  mkDerivation,
-  qtbase,
-  qtmultimedia,
-  qtsvg,
   SDL2,
   libevdev,
   udev,
-  qtmacextras,
   nanopb,
+  libsForQt5,
 }:
 
-mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "chiaki";
   version = "2.2.0";
 
   src = fetchgit {
     url = "https://git.sr.ht/~thestr4ng3r/chiaki";
-    rev = "v${version}";
+    tag = "v${finalAttrs.version}";
     fetchSubmodules = true;
     hash = "sha256-mLx2ygMlIuDJt9iT4nIj/dcLGjMvvmneKd49L7C3BQk=";
   };
@@ -31,6 +27,7 @@ mkDerivation rec {
   nativeBuildInputs = [
     cmake
     pkg-config
+    libsForQt5.wrapQtAppsHook
   ];
 
   postPatch = ''
@@ -42,9 +39,9 @@ mkDerivation rec {
   buildInputs = [
     ffmpeg
     libopus
-    qtbase
+    libsForQt5.qtbase
-    qtmultimedia
+    libsForQt5.qtmultimedia
-    qtsvg
+    libsForQt5.qtsvg
     SDL2
     nanopb
   ]
@@ -53,19 +50,19 @@ mkDerivation rec {
     udev
   ]
   ++ lib.optionals stdenv.hostPlatform.isDarwin [
-    qtmacextras
+    libsForQt5.qtmacextras
   ];
 
   doCheck = true;
 
   installCheckPhase = "$out/bin/chiaki --help";
 
-  meta = with lib; {
+  meta = {
     homepage = "https://git.sr.ht/~thestr4ng3r/chiaki";
     description = "Free and Open Source PlayStation Remote Play Client";
-    license = licenses.agpl3Only;
+    license = lib.licenses.agpl3Only;
     maintainers = [ ];
-    platforms = platforms.all;
+    platforms = lib.platforms.all;
     mainProgram = "chiaki";
   };
-}
+})

pkgs/by-name/cr/crosvm/package.nix

@@ -21,18 +21,18 @@
 
 rustPlatform.buildRustPackage {
   pname = "crosvm";
-  version = "0-unstable-2025-10-21";
+  version = "0-unstable-2025-10-27";
 
   src = fetchgit {
     url = "https://chromium.googlesource.com/chromiumos/platform/crosvm";
-    rev = "f6de423867b914a59d86c54d102831bccc7ed2c8";
+    rev = "4630761f03d5a389d36c22bf685df107b43083a7";
-    hash = "sha256-xTuu1tMoFuMcj2RqtGjyDbcFPh3bTCtWpr0fuND4aos=";
+    hash = "sha256-hp90A/uSXS/RNn1HCCWF4Sv3X8AOtcCOk9DRv95epVc=";
     fetchSubmodules = true;
   };
 
   separateDebugInfo = true;
 
-  cargoHash = "sha256-ROj0qOnePzkuzck6jXgjvOM9ksL/ubZOxOtku1B7dZA=";
+  cargoHash = "sha256-P6vFWs9lVn4EkXUVOi+3s/tptAV/J7tH5GBCQv/dwUA=";
 
   nativeBuildInputs = [
     pkg-config

pkgs/by-name/cu/cups-filters/package.nix

@@ -6,6 +6,7 @@
   dbus,
   dejavu_fonts,
   fetchFromGitHub,
+  fetchpatch,
   fontconfig,
   gawk,
   ghostscript,
@@ -62,6 +63,16 @@
         hash = "sha256-bLOl64bdeZ10JLcQ7GbU+VffJu3Lzo0ves7O7GQIOWY=";
       };
 
+      patches = [
+        # Fix build with gcc15
+        # https://github.com/OpenPrinting/cups-filters/pull/618
+        (fetchpatch {
+          name = "cups-filters-fix-build-with-gcc15-c23.patch";
+          url = "https://github.com/OpenPrinting/cups-filters/commit/9871a50b5c1f9c2caa2754aac1f5db70c886021b.patch";
+          hash = "sha256-Hu3nCHzX6K4tD7T5XIt0dh6GPQxmgfuHqbBXWfdXxoA=";
+        })
+      ];
+
       strictDeps = true;
 
       nativeBuildInputs = [

pkgs/by-name/cw/cwltool/package.nix

@@ -1,62 +1,39 @@
 {
   lib,
   fetchFromGitHub,
-  git,
   nodejs,
-  python3,
+  python3Packages,
 }:
 
-let
+python3Packages.buildPythonApplication rec {
-  py = python3.override {
-    packageOverrides = final: prev: {
-      # Requires "pydot >= 1.4.1, <3",
-      pydot = prev.pydot.overridePythonAttrs (old: rec {
-        version = "2.0.0";
-        src = old.src.override {
-          inherit version;
-          hash = "sha256-YCRq8hUSP6Bi8hzXkb5n3aI6bygN8J9okZ5jeh5PMjU=";
-        };
-        doCheck = false;
-      });
-    };
-  };
-in
-with py.pkgs;
-
-py.pkgs.buildPythonApplication rec {
   pname = "cwltool";
-  version = "3.1.20250110105449";
+  version = "3.1.20250925164626";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "common-workflow-language";
     repo = "cwltool";
     tag = version;
-    hash = "sha256-V0CQiNkIw81s6e9224qcfbsOqBvMo34q+lRURpRetKs=";
+    hash = "sha256-esY/p7wm0HvLiX+jZENBye4NblYveYAXevYRQxk+u44=";
   };
 
   postPatch = ''
     substituteInPlace setup.py \
-      --replace-fail "prov == 1.5.1" "prov" \
-      --replace-fail '"schema-salad >= 8.7, < 9",' '"schema-salad",' \
       --replace-fail "PYTEST_RUNNER + " ""
     substituteInPlace pyproject.toml \
-      --replace-fail "mypy==1.14.1" "mypy"
+      --replace-fail "mypy==1.18.2" "mypy"
   '';
 
-  build-system = with py.pkgs; [
+  build-system = with python3Packages; [
     setuptools
     setuptools-scm
   ];
 
-  nativeBuildInputs = [ git ];
+  dependencies = with python3Packages; [
-
-  dependencies = with py.pkgs; [
     argcomplete
     bagit
     coloredlogs
     cwl-utils
-    mypy
     mypy-extensions
     prov
     psutil
@@ -74,7 +51,7 @@ py.pkgs.buildPythonApplication rec {
     typing-extensions
   ];
 
-  nativeCheckInputs = with py.pkgs; [
+  nativeCheckInputs = with python3Packages; [
     mock
     nodejs
     pytest-mock
@@ -83,6 +60,8 @@ py.pkgs.buildPythonApplication rec {
     pytestCheckHook
   ];
 
+  pythonRelaxDeps = [ "prov" ];
+
   disabledTests = [
     "test_content_types"
     "test_env_filtering"

pkgs/by-name/do/doomseeker/package.nix

@@ -3,14 +3,11 @@
   stdenv,
   cmake,
   fetchFromBitbucket,
-  wrapQtAppsHook,
   pkg-config,
-  qtbase,
-  qttools,
-  qtmultimedia,
   zlib,
   bzip2,
   xxd,
+  qt5,
 }:
 
 stdenv.mkDerivation {
@@ -31,15 +28,15 @@ stdenv.mkDerivation {
   ];
 
   nativeBuildInputs = [
-    wrapQtAppsHook
+    qt5.wrapQtAppsHook
     cmake
-    qttools
+    qt5.qttools
     pkg-config
     xxd
   ];
   buildInputs = [
-    qtbase
+    qt5.qtbase
-    qtmultimedia
+    qt5.qtmultimedia
     zlib
     bzip2
   ];
@@ -52,12 +49,12 @@ stdenv.mkDerivation {
     ln -s $out/lib/doomseeker/doomseeker $out/bin/
   '';
 
-  meta = with lib; {
+  meta = {
     homepage = "http://doomseeker.drdteam.org/";
     description = "Multiplayer server browser for many Doom source ports";
     mainProgram = "doomseeker";
-    license = licenses.gpl2Plus;
+    license = lib.licenses.gpl2Plus;
-    platforms = platforms.unix;
+    platforms = lib.platforms.unix;
     maintainers = [ ];
   };
 }

pkgs/by-name/du/dua/package.nix

@@ -6,15 +6,15 @@
   nix-update-script,
 }:
 
-rustPlatform.buildRustPackage rec {
+rustPlatform.buildRustPackage (finalAttrs: {
   pname = "dua";
-  version = "2.32.0";
+  version = "2.32.2";
 
   src = fetchFromGitHub {
     owner = "Byron";
     repo = "dua-cli";
-    tag = "v${version}";
+    tag = "v${finalAttrs.version}";
-    hash = "sha256-u8g7X/70ZsZF6vUiVnisItwSMiNXgiAdOXqGUT34EaY=";
+    hash = "sha256-MB5uePy32jTvOtkQKcP9peFPqwR68E+NZ7UGMuLx8Eo=";
     # Remove unicode file names which leads to different checksums on HFS+
     # vs. other filesystems because of unicode normalisation.
     postFetch = ''
@@ -22,19 +22,19 @@ rustPlatform.buildRustPackage rec {
     '';
   };
 
-  cargoHash = "sha256-6WjaKGCnEoHCIDqMHtp/dpdHbrUe2XOxCtstQCuXPyc=";
+  cargoHash = "sha256-6H0x6I3nkCezu4/Hguv0XTdl+3QiyPL8Ue1rqTQU7VA=";
 
   checkFlags = [
     # Skip interactive tests
+    "--skip=interactive::app::tests::journeys_readonly::quit_instantly_when_nothing_marked"
+    "--skip=interactive::app::tests::journeys_readonly::quit_requires_two_presses_when_items_marked"
     "--skip=interactive::app::tests::journeys_readonly::simple_user_journey_read_only"
     "--skip=interactive::app::tests::journeys_with_writes::basic_user_journey_with_deletion"
     "--skip=interactive::app::tests::unit::it_can_handle_ending_traversal_reaching_top_but_skipping_levels"
     "--skip=interactive::app::tests::unit::it_can_handle_ending_traversal_without_reaching_the_top"
   ];
 
-  nativeInstallCheckInputs = [
+  nativeInstallCheckInputs = [ versionCheckHook ];
-    versionCheckHook
-  ];
   versionCheckProgramArg = "--version";
   doInstallCheck = true;
 
@@ -43,12 +43,13 @@ rustPlatform.buildRustPackage rec {
   meta = {
     description = "Tool to conveniently learn about the disk usage of directories";
     homepage = "https://github.com/Byron/dua-cli";
-    changelog = "https://github.com/Byron/dua-cli/blob/v${version}/CHANGELOG.md";
+    changelog = "https://github.com/Byron/dua-cli/blob/v${finalAttrs.version}/CHANGELOG.md";
     license = with lib.licenses; [ mit ];
     maintainers = with lib.maintainers; [
       figsoda
       killercup
+      defelo
     ];
     mainProgram = "dua";
   };
-}
+})

pkgs/by-name/du/duckstation/package.nix

@@ -8,7 +8,6 @@
   ninja,
   extra-cmake-modules,
   wayland-scanner,
-  makeBinaryWrapper,
   qt6,
   sdl3,
   zstd,
@@ -29,7 +28,7 @@
   spirv-cross,
   udev,
   libbacktrace,
-  ffmpeg-headless,
+  ffmpeg_8-headless,
   alsa-lib,
   libjack2,
   libpulseaudio,
@@ -47,17 +46,11 @@ let
   meta = {
     description = "Fast PlayStation 1 emulator for x86-64/AArch32/AArch64/RV64";
     longDescription = ''
-      # DISCLAIMER
+      DISCLAIMER: This is an **unofficial** package, do not report any
-      This is an **unofficial** package, do not report any issues to
+      issues to duckstation developers. Instead, please report them to
-      duckstation developers. Instead, please report them to
       <https://github.com/NixOS/nixpkgs> or use the officially
       supported platform build at <https://duckstation.org> or other
-      upstream-approved distribution mechanism not listed here. We
+      upstream-approved distribution mechanism not listed here.
-      (nixpkgs) do not endorse or condone any action taken on your own
-      accord in regards to this package.
-
-      The SDL audio backend must be used as cubeb support is currently
-      non-functional without patches.
     '';
     homepage = "https://duckstation.org";
     license = lib.licenses.cc-by-nc-nd-40;
@@ -71,15 +64,22 @@ let
 
   linuxDrv = llvmPackages.stdenv.mkDerivation (finalAttrs: {
     pname = "duckstation";
-    version = pkgSources.duckstation.version;
+    version = "0.1-9787-unstable-2025-10-13";
 
     src = fetchFromGitHub {
       owner = "stenzek";
       repo = "duckstation";
-      tag = "v${finalAttrs.version}";
+      rev = "8f0c9dd171210dfd7f06223a393e2565abbaabf3";
-      hash = pkgSources.duckstation.hash_linux;
+      hash = "sha256-CzHWdY0RaGBB6CY3PzHHHbq3/Mbf6WtUm6Dizr0IW6I=";
     };
 
+    # TODO: Remove once this is fixed upstream.
+    postPatch = ''
+      substituteInPlace src/util/animated_image.cpp \
+        --replace-fail "png_write_frame_head(png_ptr, info_ptr," \
+                       "png_write_frame_head(png_ptr, info_ptr, 0,"
+    '';
+
     vendorDiscordRPC = llvmPackages.stdenv.mkDerivation {
       pname = "discord-rpc-duckstation";
       inherit (finalAttrs) version;
@@ -190,7 +190,8 @@ let
           - Improving performance.
           - Fixing game-breaking bugs.
           - Unlocking the frame rate (e.g. "60 FPS patches").
-          - Widescreen rendering where the built-in widescreen rendering rendering is insufficient.
+          - Widescreen rendering where the built-in widescreen
+            rendering rendering is insufficient.
         '';
         license = lib.licenses.mit;
         inherit (meta) maintainers;
@@ -209,7 +210,6 @@ let
       ninja
       extra-cmake-modules
       wayland-scanner
-      makeBinaryWrapper
       qt6.wrapQtAppsHook
       qt6.qttools
     ];
@@ -232,7 +232,7 @@ let
       qt6.qtbase
       udev
       libbacktrace
-      ffmpeg-headless
+      ffmpeg_8-headless
       alsa-lib
       libjack2
       pipewire
@@ -244,19 +244,14 @@ let
       finalAttrs.soundtouch
     ];
 
-    cmakeFlags = [
+    installPhase = ''
-      (lib.cmakeBool "ALLOW_INSTALL" true)
+      runHook preInstall
-      (lib.cmakeFeature "CMAKE_INSTALL_PREFIX" "${placeholder "out"}/lib/duckstation")
-    ];
 
-    postInstall = ''
+      mkdir -p $out/{lib,bin,share/{applications,icons/hicolor/512x512/apps}}
-      makeWrapper $out/lib/duckstation/duckstation-qt $out/bin/duckstation-qt
+      cp -r bin $out/lib/duckstation
-
+      ln -s $out/lib/duckstation/duckstation-qt $out/bin/duckstation-qt
-      mkdir -p $out/share/applications
       ln -s $out/lib/duckstation/resources/org.duckstation.DuckStation.desktop \
             $out/share/applications
-
-      mkdir -p $out/share/icons/hicolor/512x512/apps
       ln -s $out/lib/duckstation/resources/org.duckstation.DuckStation.png \
             $out/share/icons/hicolor/512x512/apps
 
@@ -265,8 +260,19 @@ let
       install -Dm644 README.* -t $out/share/doc/duckstation
       install -Dm644 CONTRIBUTORS.md -t $out/share/doc/duckstation
       popd
+
+      runHook postInstall
     '';
 
+    qtWrapperArgs = [
+      "--prefix LD_LIBRARY_PATH : ${
+        (lib.makeLibraryPath [
+          ffmpeg_8-headless
+          finalAttrs.vendorShaderc
+        ])
+      }"
+    ];
+
     inherit passthru;
 
     meta = meta // {

pkgs/by-name/du/duckstation/sources.json

@@ -13,8 +13,8 @@
     "hash": "sha256-/o3LPYvMTlKhuvLQITnADmz8BTGXVaVR0aciOWVyFS8="
   },
   "chtdb": {
-    "date": "2025-10-05",
+    "date": "2025-10-16",
-    "rev": "eab12dde0ddfd03e1260d7111f2a0709144e047e",
+    "rev": "aff6149c29beae9c52aa35ea5cb53986c8916546",
-    "hash": "sha256-wRk9BijV52BCcvpeq4CzhLsaWYYrt+vFvdMwlAixBvU="
+    "hash": "sha256-gpJ6Wlo7PGMPraK8Bppb+3qDWZ6Oxd4kvLJEFtGF50U="
   }
 }

pkgs/by-name/dx/dxx-rebirth/package.nix

@@ -64,11 +64,11 @@ stdenv.mkDerivation {
 
   passthru.updateScript = unstableGitUpdater { };
 
-  meta = with lib; {
+  meta = {
     description = "Source Port of the Descent 1 and 2 engines";
     homepage = "https://www.dxx-rebirth.com/";
-    license = licenses.gpl3;
+    license = lib.licenses.gpl3;
-    maintainers = with maintainers; [ peterhoeg ];
+    maintainers = with lib.maintainers; [ peterhoeg ];
-    platforms = with platforms; linux;
+    platforms = lib.platforms.linux;
   };
 }

pkgs/by-name/ej/ejabberd/package.nix

@@ -19,7 +19,6 @@
   gawk,
   fetchFromGitHub,
   fetchgit,
-  fetchpatch2,
   beamPackages,
   nixosTests,
   withMysql ? false,
@@ -141,7 +140,7 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "ejabberd";
-  version = "25.08";
+  version = "25.10";
 
   nativeBuildInputs = [
     makeWrapper
@@ -171,7 +170,7 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "processone";
     repo = "ejabberd";
     tag = finalAttrs.version;
-    hash = "sha256-nipFr4ezo2prlpLfAW8iu8HAG8nhkIXXiAbsoM7QKTM=";
+    hash = "sha256-dTu3feSOakSHdk+hMDvYQwog64O3e/z5NOsGM3Rq7WY=";
   };
 
   passthru.tests = {
@@ -217,6 +216,7 @@ stdenv.mkDerivation (finalAttrs: {
   meta = {
     description = "Open-source XMPP application server written in Erlang";
     mainProgram = "ejabberdctl";
+    changelog = "https://github.com/processone/ejabberd/releases/tag/${finalAttrs.version}";
     license = lib.licenses.gpl2Plus;
     homepage = "https://www.ejabberd.im";
     platforms = lib.platforms.linux;

pkgs/by-name/ej/ejabberd/rebar-deps.nix

@@ -44,21 +44,21 @@ let
     };
     yconf = builder {
       name = "yconf";
-      version = "1.0.21";
+      version = "1.0.22";
       src = fetchHex {
         pkg = "yconf";
-        version = "1.0.21";
+        version = "1.0.22";
-        sha256 = "sha256-xSSl8f2Gh12FtGnMLjaMIE+XzKHDkYc24h9QAcAdCWw=";
+        sha256 = "sha256-rKg0V86r5wdWSEtch7p7GVX1EdSZFoaH6uqnwwDoV/E=";
       };
       beamDeps = [ fast_yaml ];
     };
     xmpp = builder {
       name = "xmpp";
-      version = "1.11.1";
+      version = "1.11.2";
       src = fetchHex {
         pkg = "xmpp";
-        version = "1.11.1";
+        version = "1.11.2";
-        sha256 = "sha256-pckz35BKs87BVCXaM05BDOhOw657ge/gaeXbNop7NxY=";
+        sha256 = "sha256-u2gWROFePvwACKs6cXlE1nz2EaS340Q4KqY2dEe9UtI=";
       };
       beamDeps = [
         ezlib
@@ -124,11 +124,11 @@ let
     };
     p1_pgsql = builder {
       name = "p1_pgsql";
-      version = "1.1.35";
+      version = "1.1.36";
       src = fetchHex {
         pkg = "p1_pgsql";
-        version = "1.1.35";
+        version = "1.1.36";
-        sha256 = "sha256-6ZWURGxBHGYGlnlbBiM29cS9gARR2PYgu01M4wTiVcI=";
+        sha256 = "sha256-gryouJXIT0YA641gmjLLX91yp/W9k437KReeCMZD/Qk=";
       };
       beamDeps = [ xmpp ];
     };
@@ -154,11 +154,11 @@ let
     };
     p1_acme = builder {
       name = "p1_acme";
-      version = "1.0.28";
+      version = "1.0.29";
       src = fetchHex {
         pkg = "p1_acme";
-        version = "1.0.28";
+        version = "1.0.29";
-        sha256 = "sha256-zmhpht4/nV/Sha/odSPLRTKaNJxsa+eswe2RZyXUZCM=";
+        sha256 = "sha256-CP049/vi3CiiN6obOLMGtzRVaVzIiBo93WoRt8Ufe8c=";
       };
       beamDeps = [
         base64url

pkgs/by-name/ex/exim/package.nix

@@ -39,11 +39,11 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "exim";
-  version = "4.98.2";
+  version = "4.99";
 
   src = fetchurl {
     url = "https://ftp.exim.org/pub/exim/exim4/${pname}-${version}.tar.xz";
-    hash = "sha256-iLjopnwdtswLHRSBYao25mL0yi/vJdW282lNSQ5C3K4=";
+    hash = "sha256-XfOLBC/6mpyNMbILyEgVWAcONhsG9ldghiKmKjJ63Lo=";
   };
 
   enableParallelBuilding = true;

pkgs/by-name/ff/fflogs/package.nix

@@ -6,10 +6,10 @@
 
 let
   pname = "fflogs";
-  version = "8.17.83";
+  version = "8.17.85";
   src = fetchurl {
     url = "https://github.com/RPGLogs/Uploaders-fflogs/releases/download/v${version}/fflogs-v${version}.AppImage";
-    hash = "sha256-orVUCf7+OzJQ561maIYEBKgSgLuKfuSXFGMLZV/HMjM=";
+    hash = "sha256-vI2WI9CeupQf96GxW89D8Z8R/h1hB5Rfib2A+4Yd6zc=";
   };
   extracted = appimageTools.extractType2 { inherit pname version src; };
 in

pkgs/by-name/fl/flying-carpet/package.nix

@@ -0,0 +1,84 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  rustPlatform,
+  fetchNpmDeps,
+  cargo-tauri,
+  glib-networking,
+  nodejs,
+  npmHooks,
+  openssl,
+  pkg-config,
+  webkitgtk_4_1,
+  wrapGAppsHook4,
+  copyDesktopItems,
+  makeDesktopItem,
+  nix-update-script,
+}:
+
+rustPlatform.buildRustPackage (finalAttrs: {
+  pname = "flying-carpet";
+  version = "9.0.0";
+
+  src = fetchFromGitHub {
+    owner = "spieglt";
+    repo = "FlyingCarpet";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-xjTypnI6NXG4D3iaSEHcea2as3MSmKVo9x/4JTx9znc=";
+  };
+
+  cargoHash = "sha256-zoZS7rV5Pou9OmodLF8CqcEsAWFjSdtk/S5OXsnKKyg=";
+
+  nativeBuildInputs = [
+    cargo-tauri.hook
+    nodejs
+    pkg-config
+    wrapGAppsHook4
+    copyDesktopItems
+  ];
+
+  buildInputs = [
+    glib-networking
+    openssl
+    webkitgtk_4_1
+  ];
+
+  checkFlags = [
+    "--skip"
+    "network"
+  ];
+
+  desktopItems = [
+    (makeDesktopItem {
+      name = "FlyingCarpet";
+      desktopName = "FlyingCarpet";
+      exec = "FlyingCarpet";
+      icon = "FlyingCarpet";
+      categories = [ "Development" ];
+    })
+  ];
+
+  postInstall = ''
+    install -Dm644 "Flying Carpet/src-tauri/icons/32x32.png" "$out/share/icons/hicolor/32x32/apps/FlyingCarpet.png"
+    install -Dm644 "Flying Carpet/src-tauri/icons/128x128.png" "$out/share/icons/hicolor/128x128/apps/FlyingCarpet.png"
+    install -Dm644 "Flying Carpet/src-tauri/icons/128x128@2x.png" "$out/share/icons/hicolor/256x256@2/apps/FlyingCarpet.png"
+  '';
+
+  preFixup = ''
+    # https://github.com/tauri-apps/tauri/issues/9304
+    gappsWrapperArgs+=(--set WEBKIT_DISABLE_DMABUF_RENDERER 1)
+  '';
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "Send and receive files between Android, iOS, Linux, macOS, and Windows over ad hoc WiFi";
+    homepage = "https://github.com/spieglt/FlyingCarpet";
+    changelog = "https://github.com/spieglt/FlyingCarpet/releases/tag/${finalAttrs.src.tag}";
+    license = lib.licenses.gpl3Only;
+    maintainers = with lib.maintainers; [ ulysseszhan ];
+    platforms = lib.platforms.linux; # No darwin: https://github.com/spieglt/FlyingCarpet/issues/117
+    mainProgram = "FlyingCarpet";
+  };
+})

pkgs/by-name/ga/gargoyle/package.nix

@@ -3,6 +3,7 @@
   stdenv,
   fetchFromGitHub,
   fetchDebianPatch,
+  fetchpatch,
   cmake,
   pkg-config,
   fluidsynth,
@@ -36,6 +37,11 @@ stdenv.mkDerivation rec {
       patch = "ftbfs_gcc14.patch";
       hash = "sha256-eMx/RlUpq5Ez+1L8VZo40Y3h2ZKkqiQEmKTlkZRMXnI=";
     })
+    (fetchpatch {
+      name = "cmake4-fix";
+      url = "https://github.com/garglk/garglk/commit/8d976852e2db0215e9cf4f926e626f1aa766f751.patch?full_index=1";
+      hash = "sha256-lJAuiOErSp3oDmeoqrfCdnHH816VLYiVthIG4U8BJ5E=";
+    })
   ];
 
   postPatch = ''

pkgs/by-name/go/go-judge/package.nix

@@ -6,16 +6,16 @@
 
 buildGoModule rec {
   pname = "go-judge";
-  version = "1.9.8";
+  version = "1.9.9";
 
   src = fetchFromGitHub {
     owner = "criyle";
     repo = "go-judge";
     rev = "v${version}";
-    hash = "sha256-hBOH5FDqzUGiCXucbTPBPXdEnHPq7fL0SYlY5b3OMHY=";
+    hash = "sha256-orYfnqtNvTIJLAfjrrRU6WT3wKzQCzYmCNEHC8OBlQo=";
   };
 
-  vendorHash = "sha256-dUJpNGJvvmIJuA6GSWhL4weQEwn5iM9k+y8clHdxhvY=";
+  vendorHash = "sha256-2mCd8ymY9l4A2wAe7+MVCsCqT92qIVHHHfkNJvEMg5k=";
 
   tags = [
     "nomsgpack"

pkgs/by-name/ha/harbor-cli/package.nix

@@ -9,13 +9,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "harbor-cli";
-  version = "0.0.13";
+  version = "0.0.14";
 
   src = fetchFromGitHub {
     owner = "goharbor";
     repo = "harbor-cli";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-TVuWSbBPRXq9icfMXEg0wONaqD5S2ge5DQiDHSlrADk=";
+    hash = "sha256-86qRXxCLcmVpO/fdmVGxiqVFrAQYIFlNHLxnoBgY9+k=";
   };
 
   vendorHash = "sha256-Pj573V6S2LaytQMK0jGVyLMX/GBZ1GOmYV/LPO1ScS4=";

pkgs/by-name/ig/igv/package.nix

@@ -10,10 +10,10 @@
 
 stdenv.mkDerivation rec {
   pname = "igv";
-  version = "2.19.6";
+  version = "2.19.7";
   src = fetchzip {
     url = "https://data.broadinstitute.org/igv/projects/downloads/${lib.versions.majorMinor version}/IGV_${version}.zip";
-    sha256 = "sha256-hemTOCNBfigpvlFStBbxGGLpORYPfh6vn1pyE8hKWHw=";
+    sha256 = "sha256-IkzaQAM+s1boEKo/3ShtbUhihrhxLQCTz8/0lzAyYJA=";
   };
 
   installPhase = ''

pkgs/by-name/in/instawow/package.nix

@@ -14,7 +14,7 @@ python3.pkgs.buildPythonApplication rec {
     owner = "layday";
     repo = "instawow";
     tag = "v${version}";
-    sha256 = "sha256-NFs8+BUXJEn64TDojG/xkH1O+zZurv0PWY+YDhu2mQY=";
+    hash = "sha256-NFs8+BUXJEn64TDojG/xkH1O+zZurv0PWY+YDhu2mQY=";
   };
 
   extras = [ ]; # Disable GUI, most dependencies are not packaged.
@@ -44,11 +44,11 @@ python3.pkgs.buildPythonApplication rec {
     ]
     ++ plugins;
 
-  meta = with lib; {
+  meta = {
     homepage = "https://github.com/layday/instawow";
     description = "World of Warcraft add-on manager CLI and GUI";
     mainProgram = "instawow";
-    license = licenses.gpl3;
+    license = lib.licenses.gpl3;
-    maintainers = with maintainers; [ seirl ];
+    maintainers = with lib.maintainers; [ seirl ];
   };
 }

pkgs/by-name/ko/koboredux/package.nix

@@ -14,7 +14,6 @@
 
 let
   inherit (lib)
-    and
     licenses
     maintainers
     optional
@@ -27,8 +26,8 @@ let
 
   main_src = fetchFromGitHub {
     owner = "olofson";
-    repo = pname;
+    repo = "koboredux";
-    rev = "v${version}";
+    tag = "v${version}";
     sha256 = "09h9r65z8bar2z89s09j6px0gdq355kjf38rmd85xb2aqwnm6xig";
   };
 

pkgs/by-name/le/ledfx/package.nix

@@ -1,19 +1,28 @@
 {
   lib,
-  fetchPypi,
+  fetchFromGitHub,
   python3,
 }:
 
 python3.pkgs.buildPythonApplication rec {
   pname = "ledfx";
-  version = "2.0.111";
+  version = "2.1.0";
   pyproject = true;
 
-  src = fetchPypi {
+  src = fetchFromGitHub {
-    inherit pname version;
+    owner = "LedFx";
-    hash = "sha256-b6WHulQa1er0DpMfeJLqqb4z8glUt1dHvvNigXgrf7Y=";
+    repo = "LedFx";
+    tag = "v${version}";
+    hash = "sha256-N9EHK0GVohFCjEKsm3g4h+4XWfzZO1tzdd2z5IN1YjI=";
   };
 
+  postPatch = ''
+    substituteInPlace tests/conftest.py \
+      --replace-fail '"uv",' "" \
+      --replace-fail '"run",' "" \
+      --replace-fail '"ledfx",' "\"$out/bin/ledfx\","
+  '';
+
   pythonRelaxDeps = true;
 
   pythonRemoveDeps = [
@@ -27,43 +36,49 @@ python3.pkgs.buildPythonApplication rec {
   ];
 
   dependencies = with python3.pkgs; [
+    # sorted like in pyproject.toml in upstream
+    numpy
+    cffi
     aiohttp
     aiohttp-cors
     aubio
     certifi
-    flux-led
-    python-dotenv
-    icmplib
-    mss
     multidict
-    netifaces2
-    numpy
     openrgb-python
     paho-mqtt
-    pillow
     psutil
-    pybase64
     pyserial
     pystray
-    python-mbedtls
-    python-osc
     python-rtmidi
-    # rpi-ws281x # not packaged
     requests
     sacn
-    samplerate
     sentry-sdk
-    setuptools
     sounddevice
-    stupidartnet
+    samplerate
-    uvloop
+    icmplib
-    vnoise
     voluptuous
     zeroconf
+    pillow
+    flux-led
+    python-osc
+    pybase64
+    mss
+    uvloop
+    stupidartnet
+    python-dotenv
+    vnoise
+    netifaces2
+    packaging
   ];
 
-  # Project has no tests
+  optional-dependencies = {
-  doCheck = false;
+    hue = with pyproject.pkgs; [ python-mbedtls ];
+  };
+
+  nativeCheckInputs = with python3.pkgs; [
+    pytestCheckHook
+    pytest-asyncio
+  ];
 
   meta = {
     description = "Network based LED effect controller with support for advanced real-time audio effects";

pkgs/by-name/li/linthesia/package.nix

@@ -18,7 +18,7 @@
   wrapGAppsHook3,
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "linthesia";
   version = "unstable-2023-05-23";
 
@@ -26,7 +26,7 @@ stdenv.mkDerivation rec {
     owner = "linthesia";
     repo = "linthesia";
     rev = "1f2701241f8865c2f5c14a97b81ae64884cf0396";
-    sha256 = "sha256-3uPcpDUGtAGW9q/u8Cn+0bNqikII1Y/a0PKARW/5nao=";
+    hash = "sha256-3uPcpDUGtAGW9q/u8Cn+0bNqikII1Y/a0PKARW/5nao=";
   };
 
   postPatch = ''
@@ -52,12 +52,12 @@ stdenv.mkDerivation rec {
     gtk3.out # icon cache
   ];
 
-  meta = with lib; {
+  meta = {
     description = "Game of playing music using a MIDI keyboard following a MIDI file";
     mainProgram = "linthesia";
-    inherit (src.meta) homepage;
+    inherit (finalAttrs.src.meta) homepage;
-    license = licenses.gpl2Plus;
+    license = lib.licenses.gpl2Plus;
-    platforms = platforms.linux;
+    platforms = lib.platforms.linux;
     maintainers = [ ];
   };
-}
+})

pkgs/by-name/ll/llama-cpp/package.nix

@@ -75,13 +75,13 @@ let
 in
 effectiveStdenv.mkDerivation (finalAttrs: {
   pname = "llama-cpp";
-  version = "6821";
+  version = "6869";
 
   src = fetchFromGitHub {
     owner = "ggml-org";
     repo = "llama.cpp";
     tag = "b${finalAttrs.version}";
-    hash = "sha256-HqrX7xOYsF0UUF12c8KgIM2HMeTm1XxiFPuz/PaToI0=";
+    hash = "sha256-LZSeejn1IPybmfoRsOhg1YpTCFl0LrRJZyKT8ECbVjo=";
     leaveDotGit = true;
     postFetch = ''
       git -C "$out" rev-parse --short HEAD > $out/COMMIT

pkgs/by-name/lz/lzbench/package.nix

@@ -6,13 +6,13 @@
 
 stdenv.mkDerivation rec {
   pname = "lzbench";
-  version = "2.1";
+  version = "2.2";
 
   src = fetchFromGitHub {
     owner = "inikep";
     repo = "lzbench";
     rev = "v${version}";
-    sha256 = "sha256-JyK5Hah3X4zwmli44HEO62BYfNg7BBd0+DLlljeHmRc=";
+    sha256 = "sha256-CmT+mjFKf8/HE00re1QzU2pwdUYR8Js1kN4y6c2ZiNY=";
   };
 
   enableParallelBuilding = true;

pkgs/by-name/ma/mattermost/package.nix

@@ -18,11 +18,11 @@
     # the version regex here as well.
     #
     # Ensure you also check ../mattermostLatest/package.nix.
-    regex = "^v(10\\.5\\.[0-9]+)$";
+    regex = "^v(10\\.11\\.[0-9]+)$";
-    version = "10.5.12";
+    version = "10.11.4";
-    srcHash = "sha256-VaW+rA0UeIZhGU9BlYZgyznAOtLN+JI7UPbMRPCwTww=";
+    srcHash = "sha256-gSVoO0paAwvxEeZkcCP81oxMcSu/H8n3Tr+2OEXuFyM=";
-    vendorHash = "sha256-vxUxSkj1EwgMtPpCGJSA9jCDBeLrWhecdwq4KBThhj4=";
+    vendorHash = "sha256-DS4OC3eQffD/8yLE01gnTJXwV77G7rWk4kqA/rTCtJw=";
-    npmDepsHash = "sha256-tIeuDUZbqgqooDm5TRfViiTT5OIyN0BPwvJdI+wf7p0=";
+    npmDepsHash = "sha256-p9dq31qw0EZDQIl2ysKE38JgDyLA6XvSv+VtHuRh+8A=";
     lockfileOverlay = ''
       unlock(.; "@floating-ui/react"; "channels/node_modules/@floating-ui/react")
     '';

pkgs/by-name/ma/mattermost/tests.nix

@@ -1,6 +1,5 @@
 {
   lib,
-  stdenv,
   mattermost,
   gotestsum,
   which,
@@ -12,16 +11,10 @@
   runtimeShell,
 }:
 
-let
-  inherit (lib.lists) optionals;
-  inherit (lib.strings) versionAtLeast;
-  is10 = version: versionAtLeast version "10.0";
-in
 mattermost.overrideAttrs (
   final: prev: {
     doCheck = true;
     checkTargets = [
-      "test-server"
       "test-mmctl"
     ];
     nativeCheckInputs = [
@@ -52,113 +45,17 @@ mattermost.overrideAttrs (
     # X  TestFoo
     # X  TestFoo/TestBar
     # -> TestFoo/TestBar/baz_test
-    disabledTests = [
+    disabledTests = lib.lists.uniqueStrings [
       # All these plugin tests for mmctl reach out to the marketplace, which is impossible in the sandbox
       "TestMmctlE2ESuite/TestPluginDeleteCmd/Delete_Plugin/SystemAdminClient"
       "TestMmctlE2ESuite/TestPluginDeleteCmd/Delete_Plugin/LocalClient"
       "TestMmctlE2ESuite/TestPluginDeleteCmd/Delete_a_Plugin_without_permissions"
       "TestMmctlE2ESuite/TestPluginDeleteCmd/Delete_Unknown_Plugin/SystemAdminClient"
       "TestMmctlE2ESuite/TestPluginDeleteCmd/Delete_Unknown_Plugin/LocalClient"
-      "TestMmctlE2ESuite/TestPluginInstallURLCmd/install_new_plugins/SystemAdminClient"
+      "TestMmctlE2ESuite/TestPluginInstallURLCmd"
-      "TestMmctlE2ESuite/TestPluginInstallURLCmd/install_new_plugins/LocalClient"
+      "TestMmctlE2ESuite/TestPluginMarketplaceInstallCmd"
-      "TestMmctlE2ESuite/TestPluginInstallURLCmd/install_an_already_installed_plugin_without_force/SystemAdminClient"
+      "TestMmctlE2ESuite/TestPluginMarketplaceInstallCmd"
-      "TestMmctlE2ESuite/TestPluginInstallURLCmd/install_an_already_installed_plugin_without_force/LocalClient"
+      "TestMmctlE2ESuite/TestPluginMarketplaceListCmd"
-      "TestMmctlE2ESuite/TestPluginInstallURLCmd/install_an_already_installed_plugin_with_force/SystemAdminClient"
-      "TestMmctlE2ESuite/TestPluginInstallURLCmd/install_an_already_installed_plugin_with_force/LocalClient"
-      "TestMmctlE2ESuite/TestPluginMarketplaceInstallCmd/install_a_plugin/SystemAdminClient"
-      "TestMmctlE2ESuite/TestPluginMarketplaceInstallCmd/install_a_plugin/LocalClient"
-      "TestMmctlE2ESuite/TestPluginMarketplaceListCmd/List_Marketplace_Plugins_for_Admin_User/SystemAdminClient"
-      "TestMmctlE2ESuite/TestPluginMarketplaceListCmd/List_Marketplace_Plugins_for_Admin_User/LocalClient"
-
-      # Seems to just be broken.
-      "TestMmctlE2ESuite/TestPreferenceUpdateCmd"
-
-      # Has a hardcoded "google.com" test which also verifies that the address isn't loopback,
-      # so we also can't just substituteInPlace to one that will resolve
-      "TestDialContextFilter"
-
-      # No interfaces but loopback in the sandbox, so returns empty
-      "TestGetServerIPAddress"
-
-      # S3 bucket tests (needs Minio)
-      "TestInsecureMakeBucket"
-      "TestMakeBucket"
-      "TestListDirectory"
-      "TestTimeout"
-      "TestStartServerNoS3Bucket"
-      "TestS3TestConnection"
-      "TestS3FileBackendTestSuite"
-      "TestS3FileBackendTestSuiteWithEncryption"
-      "TestWriteFileVideoMimeTypes"
-
-      # Mail tests (needs a SMTP server)
-      "TestSendMailUsingConfig"
-      "TestSendMailUsingConfigAdvanced"
-      "TestSendMailWithEmbeddedFilesUsingConfig"
-      "TestSendCloudWelcomeEmail"
-      "TestMailConnectionAdvanced"
-      "TestMailConnectionFromConfig"
-      "TestEmailTest"
-      "TestBasicAPIPlugins/test_send_mail_plugin"
-
-      # Seems to be unreliable
-      "TestPluginAPIUpdateUserPreferences"
-      "TestPluginAPIGetUserPreferences"
-
-      # These invite tests try to send a welcome email and we don't have a SMTP server up.
-      "TestInviteUsersToTeam"
-      "TestInviteGuestsToTeam"
-      "TestSendInviteEmails"
-      "TestDeliver"
-
-      # https://github.com/mattermost/mattermost/issues/29184
-      "TestUpAndDownMigrations/Should_be_reversible_for_mysql"
-    ]
-    ++ optionals (is10 final.version) [
-      ## mattermostLatest test ignores
-
-      # These bot related tests appear to be broken.
-      "TestCreateBot"
-      "TestPatchBot"
-      "TestGetBot"
-      "TestEnableBot"
-      "TestDisableBot"
-      "TestAssignBot"
-      "TestConvertBotToUser"
-
-      # Need Elasticsearch or Opensearch
-      "TestBlevePurgeIndexes"
-      "TestOpensearchAggregation"
-      "TestOpensearchInterfaceTestSuite"
-      "TestOpenSearchIndexerJobIsEnabled"
-      "TestOpenSearchIndexerPending"
-      "TestBulkProcessor"
-      "TestElasticsearchAggregation"
-      "TestElasticsearchInterfaceTestSuite"
-      "TestElasticSearchIndexerJobIsEnabled"
-      "TestElasticSearchIndexerPending"
-
-      # Broken in the sandbox.
-      "TestVersion"
-      "TestRunServerNoSystemd"
-
-      # Appear to be broken.
-      "TestSessionStore/MySQL"
-      "TestAccessControlPolicyStore/MySQL"
-      "TestAttributesStore/MySQL"
-      "TestBasicAPIPlugins"
-
-      "TestRunExportJobE2EByType"
-      "TestUpdateTeam"
-      "TestSyncSyncableRoles"
-    ]
-    ++ optionals (!stdenv.hostPlatform.isx86_64) [
-      # aarch64: invalid operating system or processor architecture
-      "TestCanIUpgradeToE0"
-
-      # aarch64: thumbnail previews are nondeterministic
-      "TestUploadFiles/multipart_Happy_image_thumbnail"
-      "TestUploadFiles/simple_Happy_image_thumbnail"
     ];
 
     preCheck = ''
@@ -378,7 +275,7 @@ mattermost.overrideAttrs (
 
       # Ensure we parallelize the tests, and skip the correct ones.
       # Spaces are important here due to how the Makefile works.
-      export GOFLAGS=" -parallel=$NIX_BUILD_CORES -skip='$(echo "$disabledTests" | tr ' ' '|')' "
+      export GOFLAGS=" -p=$NIX_BUILD_CORES -parallel=$NIX_BUILD_CORES -skip='$(echo "$disabledTests" | tr ' ' '|')' "
 
       # ce n'est pas un conteneur
       MMCTL_TESTFLAGS="$GOFLAGS" MM_NO_DOCKER=true make $checkTargets

pkgs/by-name/ma/mattermostLatest/package.nix

@@ -10,11 +10,11 @@ mattermost.override {
     # See https://docs.mattermost.com/about/mattermost-server-releases.html
     # and make sure the version regex is up to date here.
     # Ensure you also check ../mattermost/package.nix for ESR releases.
-    regex = "^v(10\\.[0-9]+\\.[0-9]+)$";
+    regex = "^v(11\\.[0-9]+\\.[0-9]+)$";
-    version = "10.12.1";
+    version = "11.0.2";
-    srcHash = "sha256-PL55NKypsLA+H19cS99iIsMI3IBb6vLvAbAVLZyg+sE=";
+    srcHash = "sha256-2w9v/ktmqSwzcylq8ayRDZD5BsHo9tBL+9X3GRNlvd0=";
-    vendorHash = "sha256-DS4OC3eQffD/8yLE01gnTJXwV77G7rWk4kqA/rTCtJw=";
+    vendorHash = "sha256-JkQvj92q5FZjQWB5gGCsAz7EpHO+IckBSFoFEFi3v0A=";
-    npmDepsHash = "sha256-O9iX6hnwkEHK0kkHqWD6RYXqoSEW6zs+utiYHnt54JY=";
+    npmDepsHash = "sha256-YU6FDsMX0QIGFatUDRos/AkgwljIBeI5w/TJt/lglw0=";
     lockfileOverlay = ''
       unlock(.; "@floating-ui/react"; "channels/node_modules/@floating-ui/react")
     '';

pkgs/by-name/mu/mudlet/package.nix

@@ -6,20 +6,16 @@
   cmake,
   git,
   pkg-config,
-  qttools,
   which,
-  wrapQtAppsHook,
   boost,
   hunspell,
   libGLU,
   libsForQt5,
   libsecret,
   libzip,
-  lua,
+  lua5_1,
   pcre,
   pugixml,
-  qtbase,
-  qtmultimedia,
   discord-rpc,
   yajl,
   withDiscordRpc ? false,
@@ -43,7 +39,7 @@ let
         });
       };
     in
-    lua.override { inherit packageOverrides; };
+    lua5_1.override { inherit packageOverrides; };
 
   luaEnv = overrideLua.withPackages (
     ps: with ps; [
@@ -56,14 +52,14 @@ let
     ]
   );
 in
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "mudlet";
   version = "4.19.1";
 
   src = fetchFromGitHub {
     owner = "Mudlet";
     repo = "Mudlet";
-    rev = "Mudlet-${version}";
+    rev = "Mudlet-${finalAttrs.version}";
     fetchSubmodules = true;
     hash = "sha256-I4RRIfHw9kZwxMlc9pvdtwPpq9EvNJU69WpGgZ+0uiw=";
   };
@@ -81,9 +77,9 @@ stdenv.mkDerivation rec {
     git
     luaEnv
     pkg-config
-    qttools
+    libsForQt5.qttools
     which
-    wrapQtAppsHook
+    libsForQt5.wrapQtAppsHook
   ];
 
   buildInputs = [
@@ -96,8 +92,8 @@ stdenv.mkDerivation rec {
     luaEnv
     pcre
     pugixml
-    qtbase
+    libsForQt5.qtbase
-    qtmultimedia
+    libsForQt5.qtmultimedia
     yajl
   ]
   ++ lib.optional withDiscordRpc discord-rpc;
@@ -129,7 +125,7 @@ stdenv.mkDerivation rec {
     cp -r src/mudlet.app/ $out/Applications/mudlet.app
     mv $out/Applications/mudlet.app/Contents/MacOS/mudlet $out/Applications/mudlet.app/Contents/MacOS/mudlet-unwrapped
     makeQtWrapper $out/Applications/Mudlet.app/Contents/MacOS/mudlet-unwrapped $out/Applications/Mudlet.app/Contents/MacOS/mudlet \
-      --set LUA_CPATH "${luaEnv}/lib/lua/${lua.luaversion}/?.so" \
+      --set LUA_CPATH "${luaEnv}/lib/lua/${lua5_1.luaversion}/?.so" \
       --prefix LUA_PATH : "$NIX_LUA_PATH" \
       --prefix DYLD_LIBRARY_PATH : "${
         lib.makeLibraryPath (
@@ -146,7 +142,7 @@ stdenv.mkDerivation rec {
     mkdir -pv $out/bin
     cp src/mudlet $out/bin/mudlet-unwrapped
     makeQtWrapper $out/bin/mudlet-unwrapped $out/bin/mudlet \
-      --set LUA_CPATH "${luaEnv}/lib/lua/${lua.luaversion}/?.so" \
+      --set LUA_CPATH "${luaEnv}/lib/lua/${lua5_1.luaversion}/?.so" \
       --prefix LUA_PATH : "$NIX_LUA_PATH" \
       --prefix LD_LIBRARY_PATH : "${
         lib.makeLibraryPath (
@@ -166,18 +162,18 @@ stdenv.mkDerivation rec {
     runHook postInstall
   '';
 
-  meta = with lib; {
+  meta = {
     description = "Crossplatform mud client";
     homepage = "https://www.mudlet.org/";
-    maintainers = with maintainers; [
+    maintainers = with lib.maintainers; [
       wyvie
       pstn
       cpu
       felixalbrigtsen
     ];
-    platforms = platforms.linux ++ platforms.darwin;
+    platforms = with lib.platforms; linux ++ darwin;
     broken = stdenv.hostPlatform.isDarwin;
-    license = licenses.gpl2Plus;
+    license = lib.licenses.gpl2Plus;
     mainProgram = "mudlet";
   };
-}
+})

pkgs/by-name/my/mymake/package.nix

@@ -0,0 +1,45 @@
+{
+  stdenv,
+  lib,
+  fetchFromGitHub,
+  nix-update-script,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "mymake";
+  version = "2.3.6";
+
+  src = fetchFromGitHub {
+    owner = "fstromback";
+    repo = "mymake";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-UQjvxdOvD9O6TrzBFJwh3CistDGZM9HZbcwVPx1n4+A=";
+  };
+
+  buildPhase = ''
+    runHook preBuild
+
+    ./compile.sh mm
+
+    runHook postBuild
+  '';
+
+  installPhase = ''
+    runHook preInstall
+
+    install -Dm755 mm $out/bin/mm
+
+    runHook postInstall
+  '';
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "Tool for compiling and running programs with minimal configuration";
+    homepage = "https://github.com/fstromback/mymake";
+    maintainers = [ lib.maintainers.nobbele ];
+    license = lib.licenses.mit;
+    platforms = lib.platforms.linux;
+    mainProgram = "mm";
+  };
+})

pkgs/by-name/my/mysql84/package.nix

@@ -27,11 +27,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "mysql";
-  version = "8.4.6";
+  version = "8.4.7";
 
   src = fetchurl {
     url = "https://dev.mysql.com/get/Downloads/MySQL-${lib.versions.majorMinor finalAttrs.version}/mysql-${finalAttrs.version}.tar.gz";
-    hash = "sha256-oeUj3IvpbRilreEGmYZhKFygG29bRsCLJlQRDkDfL7c=";
+    hash = "sha256-wL8zqUzbkI8UmuoHl6/7GxOSYszw4Ll4ehckYgdULmk=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/np/npush/package.nix

@@ -5,12 +5,12 @@
   ncurses,
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "npush";
   version = "0.7";
 
   src = fetchurl {
-    url = "mirror://sourceforge/project/npush/${pname}/${version}/${pname}-${version}.tgz";
+    url = "mirror://sourceforge/project/npush/npush/${finalAttrs.version}/npush-${finalAttrs.version}.tgz";
     hash = "sha256-8hbSsyeehzd4T3fUhDyebyI/oTHOHr3a8ArYAquivNk=";
   };
 
@@ -42,13 +42,13 @@ stdenv.mkDerivation rec {
     runHook postInstall
   '';
 
-  meta = with lib; {
+  meta = {
     broken = stdenv.hostPlatform.isDarwin;
     homepage = "https://npush.sourceforge.net/";
     description = "Sokoban-like game";
     mainProgram = "npush";
-    license = licenses.gpl2Plus;
+    license = lib.licenses.gpl2Plus;
     maintainers = [ ];
-    platforms = with platforms; unix;
+    platforms = lib.platforms.unix;
   };
-}
+})

pkgs/by-name/nt/ntfy/package.nix

@@ -1,9 +1,9 @@
 {
   lib,
   stdenv,
-  python3,
+  python3Packages,
   fetchFromGitHub,
-  fetchpatch,
+  writableTmpDirAsHomeHook,
   withXmpp ? false, # sleekxmpp doesn't support python 3.10, see https://github.com/dschep/ntfy/issues/266
   withMatrix ? true,
   withSlack ? true,
@@ -12,74 +12,29 @@
   withDbus ? stdenv.hostPlatform.isLinux,
 }:
 
-let
+python3Packages.buildPythonApplication rec {
-  python = python3.override {
-    self = python;
-    packageOverrides = self: super: {
-      ntfy-webpush = self.callPackage ./webpush.nix { };
-
-      # databases, on which slack-sdk depends, is incompatible with SQLAlchemy 2.0
-      sqlalchemy = super.sqlalchemy_1_4;
-    };
-  };
-in
-python.pkgs.buildPythonApplication rec {
   pname = "ntfy";
-  version = "2.7.0";
+  version = "2.7.1";
 
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "dschep";
     repo = "ntfy";
-    rev = "v${version}";
+    tag = "v${version}";
-    sha256 = "09f02cn4i1l2aksb3azwfb70axqhn7d0d0vl2r6640hqr74nc1cv";
+    hash = "sha256-EIhoZ2tFJQOc5PyRCazwRhldFxQb65y6h+vYPwV7ReE=";
   };
 
-  patches = [
-    # Fix Slack integration no longer working.
-    # From https://github.com/dschep/ntfy/pull/229 - "Swap Slacker for Slack SDK"
-    (fetchpatch {
-      name = "ntfy-Swap-Slacker-for-Slack-SDK.patch";
-      url = "https://github.com/dschep/ntfy/commit/2346e7cfdca84c8f1afc7462a92145c1789deb3e.patch";
-      sha256 = "13k7jbsdx0jx7l5s8whirric76hml5bznkfcxab5xdp88q52kpk7";
-    })
-    # Add compatibility with emoji 2.0
-    # https://github.com/dschep/ntfy/pull/250
-    (fetchpatch {
-      name = "ntfy-Add-compatibility-with-emoji-2.0.patch";
-      url = "https://github.com/dschep/ntfy/commit/4128942bb7a706117e7154a50a73b88f531631fe.patch";
-      sha256 = "sha256-V8dIy/K957CPFQQS1trSI3gZOjOcVNQLgdWY7g17bRw=";
-    })
-    # Change getargspec to getfullargspec for python 3.11 compatibility
-    (fetchpatch {
-      url = "https://github.com/dschep/ntfy/commit/71be9766ea041d2df6ebbce2781f980eea002852.patch";
-      hash = "sha256-6OChaTj4g3gxVDScc/JksBISHuq+5fbNQregchSXYaQ=";
-    })
-    # Fix compatibility with Python 3.11
-    # https://github.com/dschep/ntfy/pull/271
-    (fetchpatch {
-      url = "https://github.com/dschep/ntfy/pull/271/commits/444b60bec7de474d029cac184e82885011dd1474.patch";
-      hash = "sha256-PKTu8cOpws1z6f1T4uIi2iCJAoAwu+X0Pe7XnHYtHuI=";
-    })
-    # Fix compatibility with Python 3.12
-    # https://github.com/dschep/ntfy/pull/271
-    (fetchpatch {
-      url = "https://github.com/dschep/ntfy/pull/271/commits/d49ab9f9dba4966a44b5f0c6911741edabd35f6b.patch";
-      hash = "sha256-qTUWMS8EXWYCK/ZL0Us7iJp62UIKwYT1BqDy59832ig=";
-    })
-  ];
-
   postPatch = ''
     # We disable the Darwin specific things because it relies on pyobjc, which we don't have.
     substituteInPlace setup.py \
       --replace-fail "':sys_platform == \"darwin\"'" "'darwin'"
   '';
 
-  build-system = with python.pkgs; [ setuptools ];
+  build-system = with python3Packages; [ setuptools ];
 
   dependencies =
-    with python.pkgs;
+    with python3Packages;
     (
       [
         requests
@@ -108,30 +63,32 @@ python.pkgs.buildPythonApplication rec {
       ]
     );
 
-  nativeCheckInputs = with python.pkgs; [
+  nativeCheckInputs = with python3Packages; [
     mock
     pytestCheckHook
+    writableTmpDirAsHomeHook
   ];
 
   disabledTests = [
+    # AssertionError: {'backends': ['default']} != {}
+    "test_default_config"
+  ]
+  ++ lib.optionals (!withXmpp) [
     "test_xmpp"
   ];
 
-  disabledTestPaths = [
+  disabledTestPaths = lib.optionals (!withXmpp) [
     "tests/test_xmpp.py"
   ];
 
-  preCheck = ''
-    export HOME=$(mktemp -d)
-  '';
-
   pythonImportsCheck = [ "ntfy" ];
 
-  meta = with lib; {
+  meta = {
+    changelog = "https://github.com/dschep/ntfy/releases/tag/${src.tag}";
     description = "Utility for sending notifications, on demand and when commands finish";
     homepage = "https://ntfy.readthedocs.io/en/latest/";
-    license = licenses.gpl3;
+    license = lib.licenses.gpl3Only;
-    maintainers = with maintainers; [ kamilchm ];
+    maintainers = with lib.maintainers; [ kamilchm ];
     mainProgram = "ntfy";
   };
 }

pkgs/by-name/op/openscad-unstable/package.nix

@@ -44,33 +44,29 @@
   ctestCheckHook,
 }:
 # clang consume much less RAM than GCC
-clangStdenv.mkDerivation rec {
+let
-  pname = "openscad-unstable";
+  python3withPackages = (
-  version = "2025-06-04";
+    python3.withPackages (
-  src = fetchFromGitHub {
-    owner = "openscad";
-    repo = "openscad";
-    rev = "65856c9330f8cc4ffcaccf03d91b4217f2eae28d";
-    hash = "sha256-jozcLFGVSfw8G12oSxHjqUyFtAfENgIByID+omk08mU=";
-    fetchSubmodules = true; # Only really need sanitizers-cmake and MCAD and manifold
-  };
-
-  patches = [ ./test.diff ];
-
-  # fix use of our lib3mf cmake export instead of finder
-  postPatch = ''
-    substituteInPlace CMakeLists.txt --replace-fail \
-      "Lib3MF" \
-      "lib3mf"
-  '';
-
-  nativeBuildInputs = [
-    (python3.withPackages (
       ps: with ps; [
         numpy
         pillow
       ]
-    ))
+    )
+  );
+in
+clangStdenv.mkDerivation rec {
+  pname = "openscad-unstable";
+  version = "2021.01-unstable-2025-10-27";
+  src = fetchFromGitHub {
+    owner = "openscad";
+    repo = "openscad";
+    rev = "aa785fe4ab3d52450a5e51eb73585ac9bbcc8798";
+    hash = "sha256-TngfItArYtm8243DdYkQlkfc/MBTZGYrf08hfloWRWk=";
+    fetchSubmodules = true; # Only really need sanitizers-cmake and MCAD and manifold
+  };
+
+  nativeBuildInputs = [
+    python3withPackages
     bison
     cmake
     flex
@@ -134,6 +130,10 @@ clangStdenv.mkDerivation rec {
     # The sources enable this for only apple. We turn it off globally anyway to stay
     # consistent.
     "-DUSE_QT6=OFF"
+
+    # For tests
+    "-DVENV_DIR=${python3withPackages}"
+    "-DVENV_BIN_PATH=${python3withPackages}/bin"
   ];
 
   # tests rely on sysprof which is not available on darwin
@@ -147,6 +147,12 @@ clangStdenv.mkDerivation rec {
       done )
   '';
 
+  postPatch = ''
+    # Take Python3 executable as passed
+    sed -e '/set(VENV_DIR /d' -i tests/cmake/ImageCompare.cmake
+    sed -e '/find_path(VENV_BIN_PATH /d' -i tests/cmake/ImageCompare.cmake
+  '';
+
   postInstall = lib.optionalString stdenv.hostPlatform.isDarwin ''
     mkdir $out/Applications
     mv $out/bin/*.app $out/Applications

pkgs/by-name/op/openscad-unstable/test.diff

@@ -1,42 +0,0 @@
-diff --git a/tests/CMakeLists.txt b/tests/CMakeLists.txt
-index 5c1b40af4..917451dee 100644
---- a/tests/CMakeLists.txt
-+++ b/tests/CMakeLists.txt
-@@ -59,13 +59,14 @@ if(USE_IMAGE_COMPARE_PY)
- 
-   # Since msys2 on Windows prefers bin/ over Scripts, we need to look for the actual folder to determine
-   # how to utilize the venv
--  find_path(VENV_BIN_PATH activate PATHS "${VENV_DIR}/bin" "${VENV_DIR}/Scripts" NO_DEFAULT_PATH NO_CACHE)
--  if(WIN32)
--    set(IMAGE_COMPARE_EXE "${VENV_BIN_PATH}/python.exe")
--  else()
--    set(IMAGE_COMPARE_EXE "${VENV_BIN_PATH}/python")
--  endif()
--  if(EXISTS "${IMAGE_COMPARE_EXE}")
-+  # find_path(VENV_BIN_PATH activate PATHS "${VENV_DIR}/bin" "${VENV_DIR}/Scripts" NO_DEFAULT_PATH NO_CACHE)
-+  # if(WIN32)
-+  #   set(IMAGE_COMPARE_EXE "${VENV_BIN_PATH}/python.exe")
-+  # else()
-+  #   set(IMAGE_COMPARE_EXE "${VENV_BIN_PATH}/python")
-+  # endif()
-+  set(IMAGE_COMPARE_EXE "python3")
-+  # if(EXISTS "${IMAGE_COMPARE_EXE}")
-     message(STATUS "venv found, testing libraries")
-     execute_process(
-       COMMAND "${IMAGE_COMPARE_EXE}" "${CCSD}/image_compare.py" "--status"
-@@ -77,10 +78,10 @@ if(USE_IMAGE_COMPARE_PY)
-       message(STATUS "venv libraries complete")
-       set(BUILD_VENV FALSE)
-     endif()
--  else()
--    message(STATUS "venv not found")
--    set(BUILD_VENV TRUE)
--  endif()
-+  # else()
-+  #   message(STATUS "venv not found")
-+  #   set(BUILD_VENV TRUE)
-+  # endif()
-   if(BUILD_VENV)
-     message(STATUS "Setting up testing venv for image comparison")
-     execute_process(
-

pkgs/by-name/op/openxcom/package.nix

@@ -7,7 +7,7 @@
   libGL,
   openssl,
   pkg-config,
-  SDL,
+  SDL_compat,
   SDL_image,
   SDL_mixer,
   SDL_gfx,
@@ -36,7 +36,7 @@ stdenv.mkDerivation {
     boost
     libGL
     libGLU
-    SDL
+    SDL_compat
     SDL_gfx
     SDL_image
     SDL_mixer

pkgs/by-name/ov/ovftool/package.nix

@@ -33,13 +33,13 @@ let
       fileName,
       version,
       toolId ? ovftoolId,
-      artifactId ? 21342,
+      artifactId ? 29161,
       fileType ? "Download",
       source ? "",
       hash ? "",
     }:
     let
-      requestJson = builtins.toJSON {
+      requestJson = lib.strings.toJSON {
         inherit
           fileName
           artifactId
@@ -73,14 +73,14 @@ let
 
   ovftoolSystems = {
     "x86_64-linux" = rec {
-      version = "4.6.3-24031167";
+      version = "5.0.0-24781994";
       fileName = "VMware-ovftool-${version}-lin.x86_64.zip";
-      hash = "sha256-NEwwgmEh/mrZkMMhI+Kq+SYdd3MJ0+IBLdUhd1+kPow=";
+      hash = "sha256-I389VdRZQH9BJT/qxSyUPlRZC7MHv++TDc8rJ1jY788=";
     };
     "x86_64-darwin" = rec {
-      version = "4.6.3-24031167";
+      version = "5.0.0-24781994";
       fileName = "VMware-ovftool-${version}-mac.x64.zip";
-      hash = "sha256-vhACcc4tjaQhvKwZyWkgpaKaoC+coWGl1zfSIC6WebM=";
+      hash = "sha256-vfhagEOnTGxOsY8kFY555c8EhI12GwQ2JwgTjEz7UT0=";
     };
   };
 
@@ -158,9 +158,7 @@ stdenv.mkDerivation (final: {
     # libgoogleurl and libcurl.
     #
     # FIXME: Replace libgoogleurl? Possibly from Chromium?
-    # FIXME: Tell VMware to use a modern version of OpenSSL on macOS. As of ovftool
+    # FIXME: Tell VMware to use a modern version of OpenSSL on macOS.
-    # v4.6.3 ovftool uses openssl-1.0.2zj which in seems to be the extended
-    # support LTS release: https://www.openssl.org/support/contracts.html
 
     # Install all libs that are not patched in preFixup.
     # Darwin dylibs are under `lib` in the zip.
@@ -174,7 +172,7 @@ stdenv.mkDerivation (final: {
     libvmacore.so \
     libvmomi.so
   ''
-  # macOS still relies on OpenSSL 1.0.2 as of v4.6.3, but Linux is in the clear
+  # macOS still relies on OpenSSL 1.0.2 as of v4.6.3 and later, but Linux is in the clear
   + lib.optionalString stdenv.hostPlatform.isDarwin ''
     lib/libcrypto.1.0.2.dylib \
     lib/libgoogleurl.59.0.30.45.2.dylib \
@@ -326,24 +324,24 @@ stdenv.mkDerivation (final: {
       set +x
     '';
 
-  meta = with lib; {
+  meta = {
     description = "VMware tools for working with OVF, OVA, and VMX images";
     homepage = "https://developer.vmware.com/web/tool/ovf-tool/";
-    sourceProvenance = with sourceTypes; [ binaryNativeCode ];
+    sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
-    license = licenses.unfree;
+    license = lib.licenses.unfree;
-    maintainers = with maintainers; [
+    maintainers = with lib.maintainers; [
       numinit
       thanegill
     ];
-    platforms = builtins.attrNames ovftoolSystems;
+    platforms = lib.attrNames ovftoolSystems;
     mainProgram = "ovftool";
-    knownVulnerabilities = lib.optionals (stdenv.hostPlatform.isDarwin) [
+    knownVulnerabilities = lib.optionals stdenv.hostPlatform.isDarwin [
-      "The bundled version of openssl 1.0.2zj in ovftool for Darwin has open vulnerabilities."
+      "The bundled version of openssl 1.0.2zk in ovftool for Darwin has open vulnerabilities (maximum severity: Moderate)"
       "https://openssl-library.org/news/vulnerabilities-1.0.2/"
-      "CVE-2024-0727"
+      "Please nag Broadcom to update to OpenSSL 3 for Darwin."
-      "CVE-2024-5535"
       "CVE-2024-9143"
       "CVE-2024-13176"
+      "CVE-2025-9230"
     ];
   };
 })

pkgs/by-name/pa/parcellite/package.nix

@@ -1,52 +0,0 @@
-{
-  lib,
-  stdenv,
-  fetchFromGitHub,
-  autoreconfHook,
-  gtk2,
-  hicolor-icon-theme,
-  intltool,
-  pkg-config,
-  which,
-  wrapGAppsHook3,
-  xdotool,
-  libappindicator-gtk2,
-}:
-
-stdenv.mkDerivation rec {
-  pname = "parcellite";
-  version = "1.2.1";
-
-  src = fetchFromGitHub {
-    owner = "rickyrockrat";
-    repo = "parcellite";
-    rev = version;
-    sha256 = "19q4x6x984s6gxk1wpzaxawgvly5vnihivrhmja2kcxhzqrnfhiy";
-  };
-
-  nativeBuildInputs = [
-    autoreconfHook
-    intltool
-    pkg-config
-    wrapGAppsHook3
-  ];
-  buildInputs = [
-    gtk2
-    hicolor-icon-theme
-    libappindicator-gtk2
-  ];
-  NIX_LDFLAGS = "-lgio-2.0";
-
-  preFixup = ''
-    # Need which and xdotool on path to fix auto-pasting.
-    gappsWrapperArgs+=(--prefix PATH : "${which}/bin:${xdotool}/bin")
-  '';
-
-  meta = with lib; {
-    description = "Lightweight GTK clipboard manager";
-    homepage = "https://github.com/rickyrockrat/parcellite";
-    license = licenses.gpl3Plus;
-    platforms = platforms.linux;
-    mainProgram = "parcellite";
-  };
-}

pkgs/by-name/pe/pegasus-frontend/package.nix

@@ -3,15 +3,9 @@
   fetchFromGitHub,
   stdenv,
   cmake,
-  qtbase,
-  qtgraphicaleffects,
-  qtmultimedia,
-  qtsvg,
-  qttools,
-  qtx11extras,
   SDL2,
   sqlite,
-  wrapQtAppsHook,
+  libsForQt5,
 }:
 
 stdenv.mkDerivation {
@@ -28,26 +22,29 @@ stdenv.mkDerivation {
 
   nativeBuildInputs = [
     cmake
-    qttools
+    libsForQt5.qttools
-    wrapQtAppsHook
+    libsForQt5.wrapQtAppsHook
   ];
 
-  buildInputs = [
+  buildInputs =
-    qtbase
+    (with libsForQt5; [
-    qtmultimedia
+      qtbase
-    qtsvg
+      qtmultimedia
-    qtgraphicaleffects
+      qtsvg
-    qtx11extras
+      qtgraphicaleffects
-    sqlite
+      qtx11extras
-    SDL2
+    ])
-  ];
+    ++ [
+      sqlite
+      SDL2
+    ];
 
-  meta = with lib; {
+  meta = {
     description = "Cross platform, customizable graphical frontend for launching emulators and managing your game collection";
     mainProgram = "pegasus-fe";
     homepage = "https://pegasus-frontend.org/";
-    license = licenses.gpl3Plus;
+    license = lib.licenses.gpl3Plus;
-    maintainers = with maintainers; [ tengkuizdihar ];
+    maintainers = with lib.maintainers; [ tengkuizdihar ];
-    platforms = platforms.linux;
+    platforms = lib.platforms.linux;
   };
 }

pkgs/by-name/pr/privatebin/package.nix

@@ -8,13 +8,13 @@
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "privatebin";
-  version = "2.0.1";
+  version = "2.0.2";
 
   src = fetchFromGitHub {
     owner = "PrivateBin";
     repo = "PrivateBin";
     tag = finalAttrs.version;
-    hash = "sha256-FspB10F/gz4d5T4TEYyifosgFLvnSMpVsr2t4NvFTqU=";
+    hash = "sha256-ErTB+qUz0CQf+YZZoFH2/ceAHFfgIbKXst6dTTM1pKQ=";
   };
 
   installPhase = ''

pkgs/by-name/qg/qgo/package.nix

@@ -1,18 +1,15 @@
 {
   lib,
-  mkDerivation,
+  stdenv,
+  libsForQt5,
   fetchFromGitHub,
-  qmake,
-  qtbase,
-  qtmultimedia,
-  qttools,
 }:
 
-mkDerivation {
+stdenv.mkDerivation {
   pname = "qgo";
   version = "unstable-2017-12-18";
 
-  meta = with lib; {
+  meta = {
     description = "Go client based on Qt5";
     mainProgram = "qgo";
     longDescription = ''
@@ -28,8 +25,8 @@ mkDerivation {
       Chinese, "囲碁(Yi Go)" in Japanese, "바둑(Baduk)" in Korean.
     '';
     homepage = "https://github.com/pzorin/qgo";
-    license = licenses.gpl2Plus;
+    license = lib.licenses.gpl2Plus;
-    maintainers = with maintainers; [ zalakain ];
+    maintainers = with lib.maintainers; [ zalakain ];
   };
 
   src = fetchFromGitHub {
@@ -44,11 +41,12 @@ mkDerivation {
     sed -i 's|@out@|'"''${out}"'|g' src/src.pro src/defines.h
   '';
   nativeBuildInputs = [
-    qmake
+    libsForQt5.qmake
-    qttools
+    libsForQt5.qttools
+    libsForQt5.wrapQtAppsHook
   ];
   buildInputs = [
-    qtbase
+    libsForQt5.qtbase
-    qtmultimedia
+    libsForQt5.qtmultimedia
   ];
 }

pkgs/by-name/qt/qtads/package.nix

@@ -1,31 +1,31 @@
 {
   lib,
-  mkDerivation,
+  stdenv,
   fetchFromGitHub,
   pkg-config,
-  qmake,
   SDL2,
   fluidsynth,
   libsndfile,
   libvorbis,
   mpg123,
-  qtbase,
+  qt5,
 }:
 
-mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "qtads";
   version = "3.4.0";
 
   src = fetchFromGitHub {
     owner = "realnc";
     repo = "qtads";
-    rev = "v${version}";
+    tag = "v${finalAttrs.version}";
-    sha256 = "sha256-KIqufpvl7zeUtDBXUOAZxBIbfv+s51DoSaZr3jol+bw=";
+    hash = "sha256-KIqufpvl7zeUtDBXUOAZxBIbfv+s51DoSaZr3jol+bw=";
   };
 
   nativeBuildInputs = [
     pkg-config
-    qmake
+    qt5.qmake
+    qt5.wrapQtAppsHook
   ];
 
   buildInputs = [
@@ -34,15 +34,15 @@ mkDerivation rec {
     libsndfile
     libvorbis
     mpg123
-    qtbase
+    qt5.qtbase
   ];
 
-  meta = with lib; {
+  meta = {
     homepage = "https://realnc.github.io/qtads/";
     description = "Multimedia interpreter for TADS games";
     mainProgram = "qtads";
-    license = licenses.gpl3Plus;
+    license = lib.licenses.gpl3Plus;
-    platforms = platforms.linux;
+    platforms = lib.platforms.linux;
-    maintainers = with maintainers; [ orivej ];
+    maintainers = with lib.maintainers; [ orivej ];
   };
-}
+})

pkgs/by-name/qu/quakespasm/package.nix

@@ -20,16 +20,16 @@
   useSDL2 ? stdenv.hostPlatform.isDarwin, # TODO: CoreAudio fails to initialize with SDL 1.x for some reason.
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "quakespasm";
   version = "0.96.3";
 
   src = fetchurl {
-    url = "mirror://sourceforge/quakespasm/quakespasm-${version}.tar.gz";
+    url = "mirror://sourceforge/quakespasm/quakespasm-${finalAttrs.version}.tar.gz";
-    sha256 = "sha256-tXjWzkpPf04mokRY8YxLzI04VK5iUuuZgu6B2V5QGA4=";
+    hash = "sha256-tXjWzkpPf04mokRY8YxLzI04VK5iUuuZgu6B2V5QGA4=";
   };
 
-  sourceRoot = "${pname}-${version}/Quake";
+  sourceRoot = "quakespasm-${finalAttrs.version}/Quake";
 
   patches = lib.optionals stdenv.hostPlatform.isDarwin [
     # Makes Darwin Makefile use system libraries instead of ones from app bundle
@@ -113,7 +113,7 @@ stdenv.mkDerivation rec {
     })
   ];
 
-  meta = with lib; {
+  meta = {
     description = "Engine for iD software's Quake";
     homepage = "https://quakespasm.sourceforge.net/";
     longDescription = ''
@@ -125,8 +125,8 @@ stdenv.mkDerivation rec {
       and smoother mouse input - though no CD support.
     '';
 
-    platforms = platforms.unix;
+    platforms = lib.platforms.unix;
-    maintainers = with maintainers; [ mikroskeem ];
+    maintainers = with lib.maintainers; [ mikroskeem ];
     mainProgram = "quake";
   };
-}
+})

pkgs/by-name/qw/qwen-code/add-missing-resolved-integrity-fields.patch

@@ -1,70 +0,0 @@
-From 0735b59eba183574e080d2912347d58e6e3d158e Mon Sep 17 00:00:00 2001
-From: Sergey Volkov <taranarmo@gmail.com>
-Date: Fri, 12 Sep 2025 20:06:24 +0200
-Subject: [PATCH] Add missing resolved and integrity fields to several packages
-
----
- package-lock.json | 12 ++++++++++++
- 1 file changed, 12 insertions(+)
-
-diff --git a/package-lock.json b/package-lock.json
-index 146686dc..9ad9009f 100644
---- a/package-lock.json
-+++ b/package-lock.json
-@@ -12574,6 +12574,8 @@
-     },
-     "packages/cli/node_modules/@testing-library/dom": {
-       "version": "10.4.0",
-+      "resolved": "https://registry.npmjs.org/@testing-library/dom/-/dom-10.4.0.tgz",
-+      "integrity": "sha512-pemlzrSESWbdAloYml3bAJMEfNh1Z7EduzqPKprCH5S341frlpYnUEW0H72dLxa6IsYr+mPno20GiSm+h9dEdQ==",
-       "dev": true,
-       "license": "MIT",
-       "peer": true,
-@@ -12609,6 +12611,8 @@
-     },
-     "packages/cli/node_modules/@testing-library/react": {
-       "version": "16.3.0",
-+      "resolved": "https://registry.npmjs.org/@testing-library/react/-/react-16.3.0.tgz",
-+      "integrity": "sha512-kFSyxiEDwv1WLl2fgsq6pPBbw5aWKrsY2/noi1Id0TK0UParSF62oFQFGHXIyaG4pp2tEub/Zlel+fjjZILDsw==",
-       "dev": true,
-       "license": "MIT",
-       "dependencies": {
-@@ -12660,6 +12664,8 @@
-     },
-     "packages/cli/node_modules/aria-query": {
-       "version": "5.3.0",
-+      "resolved": "https://registry.npmjs.org/aria-query/-/aria-query-5.3.0.tgz",
-+      "integrity": "sha512-b0P0sZPKtyu8HkeRAfCq0IfURZK+SuwMjY1UXGBU27wpAiTwQAIlq56IbIO+ytk/JjS1fMR14ee5WBBfKi5J6A==",
-       "dev": true,
-       "license": "Apache-2.0",
-       "peer": true,
-@@ -12669,6 +12675,8 @@
-     },
-     "packages/cli/node_modules/emoji-regex": {
-       "version": "10.4.0",
-+      "resolved": "https://registry.npmjs.org/emoji-regex/-/emoji-regex-10.4.0.tgz",
-+      "integrity": "sha512-EC+0oUMY1Rqm4O6LLrgjtYDvcVYTy7chDnM4Q7030tP4Kwj3u/pR6gP9ygnp2CJMK5Gq+9Q2oqmrFJAz01DXjw==",
-       "license": "MIT"
-     },
-     "packages/cli/node_modules/react-is": {
-@@ -12681,6 +12689,8 @@
-     },
-     "packages/cli/node_modules/string-width": {
-       "version": "7.2.0",
-+      "resolved": "https://registry.npmjs.org/string-width/-/string-width-7.2.0.tgz",
-+      "integrity": "sha512-tsaTIkKW9b4N+AEj+SVA+WhJzV7/zMhcSu78mLKWSk7cXMOSHsBKFWUs0fWwq8QyK3MgJBQRX6Gbi4kYbdvGkQ==",
-       "license": "MIT",
-       "dependencies": {
-         "emoji-regex": "^10.3.0",
-@@ -12815,6 +12825,8 @@
-     },
-     "packages/core/node_modules/ignore": {
-       "version": "7.0.5",
-+      "resolved": "https://registry.npmjs.org/ignore/-/ignore-7.0.5.tgz",
-+      "integrity": "sha512-Hs59xBNfUIunMFgWAbGX5cq6893IbWg4KnrjbYwX3tx0ztorVgTDA6B2sxf8ejHJ4wz8BqGUMYlnzNBer5NvGg==",
-       "license": "MIT",
-       "engines": {
-         "node": ">= 4"
--- 
-2.51.0
-

pkgs/by-name/qw/qwen-code/package.nix

@@ -6,46 +6,40 @@
   jq,
   git,
   ripgrep,
+  pkg-config,
+  glib,
+  libsecret,
 }:
 
 buildNpmPackage (finalAttrs: {
   pname = "qwen-code";
-  version = "0.0.14";
+  version = "0.1.0";
 
   src = fetchFromGitHub {
     owner = "QwenLM";
     repo = "qwen-code";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-Rld6k0MPfOOncK240zOJbcvheV4UKU2yF7luBrTrnFs=";
+    hash = "sha256-5XC4Pwf+vuK1T3/bPptUejg8v9wj3izF80Mt+iqVr9Y=";
   };
 
-  patches = [
+  npmDepsHash = "sha256-Psj/5SDWBnsRJVJnJwXGUgVbqUnjoH6HpAqqFruHkYw=";
-    # similar to upstream gemini-cli some node deps are missing resolved and integrity fields
-    # upstream the problem is solved in master and in v0.4+, eventually the fix should arrive to qwen
-    ./add-missing-resolved-integrity-fields.patch
-  ];
-
-  npmDepsHash = "sha256-43s13HncNKv4uOKVwNvqIF+Ih3rJBWrpVJnE3hCKD2w=";
 
   nativeBuildInputs = [
     jq
+    pkg-config
+    git
   ];
 
   buildInputs = [
-    git
     ripgrep
+    glib
+    libsecret
   ];
 
   postPatch = ''
-    # Remove @lvce-editor/ripgrep dependency (no network on buildPhase
+    # patches below remove node-pty and keytar dependencies which cause build fail on Darwin
-    substituteInPlace package.json --replace-fail '"@lvce-editor/ripgrep": "^1.6.0",' ""
-    substituteInPlace packages/core/package.json --replace-fail '"@lvce-editor/ripgrep": "^1.6.0",' ""
-    substituteInPlace packages/core/src/tools/ripGrep.ts \
-      --replace-fail "const { rgPath } = await import('@lvce-editor/ripgrep');" "const rgPath = 'rg';"
-
-    # patches below remove node-pty dependency which causes build fail on Darwin
     # should be conditional on platform but since package-lock.json is patched it changes its hash
-    # though seems like this dependency is not really required by the package
+    # though seems like these dependencies are not really required by the package
     ${jq}/bin/jq '
       del(.packages."node_modules/node-pty") |
       del(.packages."node_modules/@lydell/node-pty") |
@@ -55,11 +49,18 @@ buildNpmPackage (finalAttrs: {
       del(.packages."node_modules/@lydell/node-pty-linux-x64") |
       del(.packages."node_modules/@lydell/node-pty-win32-arm64") |
       del(.packages."node_modules/@lydell/node-pty-win32-x64") |
+      del(.packages."node_modules/keytar") |
       walk(
         if type == "object" and has("dependencies") then
-          .dependencies |= with_entries(select(.key | contains("node-pty") | not))
+          .dependencies |= with_entries(select(.key | (contains("node-pty") | not) and (contains("keytar") | not)))
         elif type == "object" and has("optionalDependencies") then
-          .optionalDependencies |= with_entries(select(.key | contains("node-pty") | not))
+          .optionalDependencies |= with_entries(select(.key | (contains("node-pty") | not) and (contains("keytar") | not)))
+        else .
+        end
+      ) |
+      walk(
+        if type == "object" and has("peerDependencies") then
+          .peerDependencies |= with_entries(select(.key | (contains("node-pty") | not) and (contains("keytar") | not)))
         else .
         end
       )
@@ -79,10 +80,14 @@ buildNpmPackage (finalAttrs: {
     runHook preInstall
 
     mkdir -p $out/bin $out/share/qwen-code
-    cp -r bundle/* $out/share/qwen-code/
+    cp -r dist/* $out/share/qwen-code/
-    cp node_modules/tiktoken/tiktoken_bg.wasm $out/share/qwen-code/
+    # Install production dependencies only
+    npm prune --production
+    cp -r node_modules $out/share/qwen-code/
+    # Remove broken symlinks that cause issues in Nix environment
+    find $out/share/qwen-code/node_modules -type l -delete || true
     patchShebangs $out/share/qwen-code
-    ln -s $out/share/qwen-code/gemini.js $out/bin/qwen
+    ln -s $out/share/qwen-code/cli.js $out/bin/qwen
 
     runHook postInstall
   '';

pkgs/by-name/ro/rogue/package.nix

@@ -2,30 +2,30 @@
   lib,
   stdenv,
   fetchurl,
-  ncurses,
+  ncurses5,
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "rogue";
   version = "5.4.4";
 
   src = fetchurl {
     urls = [
-      "https://src.fedoraproject.org/repo/pkgs/rogue/rogue${version}-src.tar.gz/033288f46444b06814c81ea69d96e075/rogue${version}-src.tar.gz"
+      "https://src.fedoraproject.org/repo/pkgs/rogue/rogue${finalAttrs.version}-src.tar.gz/033288f46444b06814c81ea69d96e075/rogue${finalAttrs.version}-src.tar.gz"
-      "http://ftp.vim.org/ftp/pub/ftp/os/Linux/distr/slitaz/sources/packages-cooking/r/rogue${version}-src.tar.gz"
+      "http://ftp.vim.org/ftp/pub/ftp/os/Linux/distr/slitaz/sources/packages-cooking/r/rogue${finalAttrs.version}-src.tar.gz"
-      "http://rogue.rogueforge.net/files/rogue${lib.versions.majorMinor version}/rogue${version}-src.tar.gz"
+      "http://rogue.rogueforge.net/files/rogue${lib.versions.majorMinor finalAttrs.version}/rogue${finalAttrs.version}-src.tar.gz"
     ];
     sha256 = "18g81274d0f7sr04p7h7irz0d53j6kd9j1y3zbka1gcqq0gscdvx";
   };
 
-  buildInputs = [ ncurses ];
+  buildInputs = [ ncurses5 ];
 
-  meta = with lib; {
+  meta = {
     homepage = "http://rogue.rogueforge.net/rogue-5-4/";
     description = "Final version of the original Rogue game developed for the UNIX operating system";
     mainProgram = "rogue";
-    platforms = platforms.all;
+    platforms = lib.platforms.all;
-    license = licenses.bsd3;
+    license = lib.licenses.bsd3;
     maintainers = [ ];
   };
-}
+})

pkgs/by-name/s7/s7/package.nix

@@ -26,14 +26,14 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "s7";
-  version = "11.7-unstable-2025-10-20";
+  version = "11.7-unstable-2025-10-26";
 
   src = fetchFromGitLab {
     domain = "cm-gitlab.stanford.edu";
     owner = "bil";
     repo = "s7";
-    rev = "479045bf9445789c6a0a0252dd6fc092f2b0b507";
+    rev = "6fc94288ed46533527b1ddb24c3b162a9d0f7ab7";
-    hash = "sha256-F7IPAjIlfZcuj9Of0wDYQWPTAWWZO9z6/FbjHwZlJAo=";
+    hash = "sha256-kJhvgZ/GTSSplmY6bzHxHhtgukssepBsSWD7kwXwnps=";
   };
 
   buildInputs =

pkgs/by-name/sc/scummvm/package.nix

@@ -23,14 +23,14 @@
   nix-update-script,
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "scummvm";
   version = "2.9.1";
 
   src = fetchFromGitHub {
     owner = "scummvm";
     repo = "scummvm";
-    rev = "v${version}";
+    rev = "v${finalAttrs.version}";
     hash = "sha256-+MM47piuXuIBmAQd0g/cAg5t02qSQ0sw/DwFrMUSIAA=";
   };
 
@@ -82,12 +82,12 @@ stdenv.mkDerivation rec {
     updateScript = nix-update-script { };
   };
 
-  meta = with lib; {
+  meta = {
     description = "Program to run certain classic graphical point-and-click adventure games (such as Monkey Island)";
     mainProgram = "scummvm";
     homepage = "https://www.scummvm.org/";
-    license = licenses.gpl2Plus;
+    license = lib.licenses.gpl2Plus;
-    maintainers = [ maintainers.peterhoeg ];
+    maintainers = with lib.maintainers; [ peterhoeg ];
-    platforms = platforms.unix;
+    platforms = lib.platforms.unix;
   };
-}
+})

pkgs/by-name/se/session-desktop/Info.plist

@@ -0,0 +1,93 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+  <dict>
+    <key>CFBundleDisplayName</key>
+    <string>Session</string>
+    <key>CFBundleExecutable</key>
+    <string>Session</string>
+    <key>CFBundleIconFile</key>
+    <string>icon.icns</string>
+    <key>CFBundleIdentifier</key>
+    <string>com.loki-project.messenger-desktop</string>
+    <key>CFBundleInfoDictionaryVersion</key>
+    <string>6.0</string>
+    <key>CFBundleName</key>
+    <string>Session</string>
+    <key>CFBundlePackageType</key>
+    <string>APPL</string>
+    <key>CFBundleShortVersionString</key>
+    <string>@version@</string>
+    <key>CFBundleVersion</key>
+    <string>refs/heads/master</string>
+    <key>LSApplicationCategoryType</key>
+    <string>public.app-category.social-networking</string>
+    <key>LSEnvironment</key>
+    <dict>
+      <key>MallocNanoZone</key>
+      <string>0</string>
+    </dict>
+    <key>LSMinimumSystemVersion</key>
+    <string>11.0</string>
+    <key>NSAppTransportSecurity</key>
+    <dict>
+      <key>NSAllowsArbitraryLoads</key>
+      <true/>
+      <key>NSAllowsLocalNetworking</key>
+      <true/>
+      <key>NSExceptionDomains</key>
+      <dict>
+        <key>127.0.0.1</key>
+        <dict>
+          <key>NSIncludesSubdomains</key>
+          <false/>
+          <key>NSTemporaryExceptionAllowsInsecureHTTPLoads</key>
+          <true/>
+          <key>NSTemporaryExceptionAllowsInsecureHTTPSLoads</key>
+          <false/>
+          <key>NSTemporaryExceptionMinimumTLSVersion</key>
+          <string>1.0</string>
+          <key>NSTemporaryExceptionRequiresForwardSecrecy</key>
+          <false/>
+        </dict>
+        <key>localhost</key>
+        <dict>
+          <key>NSIncludesSubdomains</key>
+          <false/>
+          <key>NSTemporaryExceptionAllowsInsecureHTTPLoads</key>
+          <true/>
+          <key>NSTemporaryExceptionAllowsInsecureHTTPSLoads</key>
+          <false/>
+          <key>NSTemporaryExceptionMinimumTLSVersion</key>
+          <string>1.0</string>
+          <key>NSTemporaryExceptionRequiresForwardSecrecy</key>
+          <false/>
+        </dict>
+      </dict>
+    </dict>
+    <key>NSBluetoothAlwaysUsageDescription</key>
+    <string>This app needs access to Bluetooth</string>
+    <key>NSBluetoothPeripheralUsageDescription</key>
+    <string>This app needs access to Bluetooth</string>
+    <key>NSCameraUsageDescription</key>
+    <string>Session requires camera access to record video.</string>
+    <key>NSHighResolutionCapable</key>
+    <true/>
+    <key>NSHumanReadableCopyright</key>
+    <string>Copyright © 2025 Session Foundation</string>
+    <key>NSMainNibFile</key>
+    <string>MainMenu</string>
+    <key>NSMicrophoneUsageDescription</key>
+    <string>Session requires microphone access to record audio.</string>
+    <key>NSPrefersDisplaySafeAreaCompatibilityMode</key>
+    <false/>
+    <key>NSPrincipalClass</key>
+    <string>AtomApplication</string>
+    <key>NSQuitAlwaysKeepsWindows</key>
+    <false/>
+    <key>NSRequiresAquaSystemAppearance</key>
+    <false/>
+    <key>NSSupportsAutomaticGraphicsSwitching</key>
+    <true/>
+  </dict>
+</plist>

pkgs/by-name/se/session-desktop/fake-git.sh

@@ -0,0 +1,74 @@
+if [ "$1" != "rev-parse" ]; then
+  echo "$@" >&2
+  exit 1
+fi
+shift
+
+short=0
+shortlen=7
+ref=
+while [ $# -gt 0 ]; do
+  case "$1" in
+    --short)
+      short=1
+      if [ $# -gt 1 ] && [ "$2" -eq "$2" ] 2>/dev/null; then
+        shortlen=$2
+        shift
+      else
+        shortlen=7
+      fi
+      ;;
+    --short=*)
+      short=1
+      shortlen=''${1#--short=}
+      ;;
+    --is-inside-work-tree)
+      echo true
+      exit 0
+      ;;
+    HEAD|HEAD:*)
+      ref=$1
+      ;;
+    *)
+      echo "rev-parse $@" >&2
+      exit 1
+      ;;
+  esac
+  shift
+done
+
+if [ -z "$ref" ]; then
+  echo "rev-parse" >&2
+  exit 1
+fi
+
+case "$ref" in
+  HEAD)
+    path=$(pwd)
+    hash=
+    while [ "$path" != "/" ]; do
+      if [ -f "$path/.gitrev" ]; then
+        hash=$(cat "$path/.gitrev")
+        break
+      fi
+      path=$(dirname "$path")
+    done
+    ;;
+  HEAD:*)
+    subpath=''${ref#HEAD:}
+    if [ -f "$PWD/$subpath/.gitrev" ]; then
+      hash=$(cat "$PWD/$subpath/.gitrev")
+    fi
+    ;;
+esac
+
+if [ -z "$hash" ]; then
+  echo "rev-parse $ref" >&2
+  exit 1
+fi
+
+if [ "$short" -eq 1 ]; then
+  printf '%s\n' "$(printf '%s' "$hash" | cut -c1-"$shortlen")"
+else
+  printf '%s\n' "$hash"
+fi

pkgs/by-name/se/session-desktop/package.nix

@@ -1,67 +1,336 @@
 {
   lib,
+  fetchFromGitHub,
   makeDesktopItem,
+  writeShellScriptBin,
   copyDesktopItems,
-  stdenvNoCC,
+  stdenv,
-  fetchurl,
-  appimageTools,
   makeWrapper,
+  fetchpatch,
+  replaceVars,
+  fetchYarnDeps,
+  yarnConfigHook,
+  yarnBuildHook,
+  yarnInstallHook,
+  rustPlatform,
+  nodejs,
+  electron,
+  jq,
+  python3,
+  git,
+  cmake,
+  openssl,
+  tcl,
+  xcodebuild,
+  cctools,
+  darwin,
 }:
 
 let
-  version = "1.15.2";
+  fake-git = writeShellScriptBin "git" (lib.readFile ./fake-git.sh);
-  pname = "session-desktop";
+
+  sqlcipher-src = stdenv.mkDerivation (finalAttrs: {
+    pname = "sqlcipher-src";
+    # when updating: look for the version in deps/download.js of @signalapp/better-sqlite3, whose version is in turn found in yarn.lock
+    version = "4.6.1";
+    src = fetchFromGitHub {
+      owner = "signalapp";
+      repo = "sqlcipher";
+      tag = "v${finalAttrs.version}-f_barrierfsync";
+      hash = "sha256-3fGRPZpJmLbY95DLJ34BK53ZTzJ1dWEzislXsOrTc8k=";
+    };
+
+    patches = [
+      # Needed to reproduce the build artifact from Signal's CI.
+      # TODO: find the actual CI workflow that produces
+      # https://build-artifacts.signal.org/desktop/sqlcipher-v2-4.6.1-signal-patch2--0.2.1-asm2-6253f886c40e49bf892d5cdc92b2eb200b12cd8d80c48ce5b05967cfd01ee8c7.tar.gz
+      # See also: https://github.com/signalapp/better-sqlite3/blob/v9.0.13/deps/defines.gypi#L33
+      # Building @signalapp/better-sqlite3 will require openssl without this patch.
+      (fetchpatch {
+        name = "sqlcipher-crypto-custom.patch";
+        url = "https://github.com/sqlcipher/sqlcipher/commit/702af1ff87528a78f5a9b2091806d3a5642e1d4a.patch";
+        hash = "sha256-OKh6qCGHBQWZyzXfyEveAs71wrNwlWLuG9jNqDeKNG4=";
+      })
+    ];
+
+    buildInputs = [
+      openssl
+      tcl
+    ];
+
+    # see https://github.com/signalapp/node-sqlcipher/blob/v2.4.4/deps/sqlcipher/update.sh
+    configureFlags = [ "--enable-update-limit" ];
+    makeFlags = [
+      "sqlite3.h"
+      "sqlite3.c"
+      "sqlite3ext.h"
+      "shell.c"
+    ];
+
+    installPhase = ''
+      runHook preInstall
+
+      mkdir -p $out
+      cp sqlite3.h sqlite3.c sqlite3ext.h shell.c $out
+
+      runHook postInstall
+    '';
+
+    meta = {
+      homepage = "https://github.com/signalapp/sqlcipher";
+      license = lib.licenses.bsd3;
+    };
+  });
+
+  signal-sqlcipher-extension = rustPlatform.buildRustPackage (finalAttrs: {
+    pname = "signal-sqlcipher-extension";
+    # when updating: look for the version in deps/download.js of @signalapp/better-sqlite3, whose version is in turn found in yarn.lock
+    version = "0.2.1";
+    src = fetchFromGitHub {
+      owner = "signalapp";
+      repo = "Signal-Sqlcipher-Extension";
+      rev = "v${finalAttrs.version}";
+      hash = "sha256-INSkm7ZuetPASuIqezzzG/bXoEHClUb9XpxWbxLVXRc=";
+    };
+
+    cargoHash = "sha256-qT4HM/FRL8qugKKNlMYM/0zgUsC6cDOa9fgd1d4VIrc=";
+
+    postInstall = ''
+      mkdir -p $out/include
+      cp target/*.h $out/include
+    '';
+
+    meta = {
+      homepage = "https://github.com/signalapp/Signal-Sqlcipher-Extension";
+      license = lib.licenses.agpl3Only;
+    };
+  });
+
+  libsession-util-nodejs = stdenv.mkDerivation (finalAttrs: {
+    pname = "libsession-util-nodejs";
+    version = "0.5.5"; # find version in yarn.lock
+    src = fetchFromGitHub {
+      owner = "session-foundation";
+      repo = "libsession-util-nodejs";
+      tag = "v${finalAttrs.version}";
+      fetchSubmodules = true;
+      deepClone = true; # need git rev for all submodules
+      hash = "sha256-FmI9Xmml+sjXHJ+W6CfBC8QUrQR89H3HWEYlHE2Xsts=";
+      # fetchgit is not reproducible with deepClone + fetchSubmodules:
+      # https://github.com/NixOS/nixpkgs/issues/100498
+      postFetch = ''
+        find $out -name .git -type d -prune | while read -r gitdir; do
+          pushd "$(dirname "$gitdir")"
+          git rev-parse HEAD > .gitrev
+          popd
+        done
+        find $out -name .git -type d -prune -exec rm -rf {} +
+      '';
+    };
+
+    postPatch = ''
+      sed -i -E 's/--runtime-version=[^[:space:]]*/--runtime-version=${electron.version}/' package.json
+    '';
+
+    nativeBuildInputs = [
+      yarnConfigHook
+      yarnBuildHook
+      yarnInstallHook
+      nodejs
+      cmake
+      python3
+      fake-git # used in update_version.sh, libsession-util/external/oxen-libquic/cmake/check_submodule.cmake, etc.
+      jq
+    ];
+
+    dontUseCmakeConfigure = true;
+    yarnOfflineCache = fetchYarnDeps {
+      yarnLock = "${finalAttrs.src}/yarn.lock";
+      hash = "sha256-0pH88EOqxG/kg7edaWnaLEs3iqhIoRCJxDdBn4JxYeY=";
+    };
+
+    preBuild = ''
+      # prevent downloading; see https://github.com/cmake-js/cmake-js/blob/v7.3.1/lib/dist.js
+      mkdir -p "$HOME/.cmake-js/electron-${stdenv.hostPlatform.node.arch}"
+      ln -s ${electron.headers} "$HOME/.cmake-js/electron-${stdenv.hostPlatform.node.arch}/v${electron.version}"
+
+      # populate src/version.h
+      yarn update_version
+    '';
+
+    # The install script is the build script.
+    # `yarn install` may be better than `yarn run install`.
+    # However, the former seems to use /bin/bash while the latter uses stdenv.shell,
+    # and the former simply cannot find the cmake-js command, which is pretty weird,
+    # and using `yarn config set script-shell` does not help.
+    yarnBuildScript = "run";
+    yarnBuildFlags = "install";
+
+    postInstall = ''
+      # build is not installed by default because it is in .gitignore
+      cp -r build $out/lib/node_modules/libsession_util_nodejs
+    '';
+
+    meta = {
+      homepage = "https://github.com/session-foundation/libsession-util-nodejs";
+      # No license file, but gpl3Only makes sense because package.json says GPL-3.0,
+      # which is also consistent with session-desktop and libsession-util.
+      license = lib.licenses.gpl3Only;
+    };
+  });
 
-  src = fetchurl {
-    url = "https://github.com/session-foundation/session-desktop/releases/download/v${version}/session-desktop-linux-x86_64-${version}.AppImage";
-    hash = "sha256-xQ/Fjg04XgXUioCCU0+sOLaTWZV1z05EmzZCqEU++Ok=";
-  };
-  appimage = appimageTools.wrapType2 { inherit version pname src; };
-  appimage-contents = appimageTools.extractType2 { inherit version pname src; };
 in
-stdenvNoCC.mkDerivation {
+stdenv.mkDerivation (finalAttrs: {
-  inherit version pname;
+  pname = "session-desktop";
-  src = appimage;
+  version = "1.16.10";
+  src = fetchFromGitHub {
+    owner = "session-foundation";
+    repo = "session-desktop";
+    tag = "v${finalAttrs.version}";
+    leaveDotGit = true;
+    hash = "sha256-9l5AgG9YNz61lS/1Q/b46UgdyidHH7sQK7ZWz19XWr0=";
+    postFetch = ''
+      pushd $out
+      git rev-parse HEAD > .gitrev
+      rm -rf .git
+      popd
+    '';
+  };
+
+  postPatch = ''
+    jq '
+      del(.engines) # too restrictive Node version requirement
+      # control what files are packed in the install phase
+      + {files: ["**/*.js", "**/*.html", "**/*.node", "_locales", "config", "fonts", "images", "mmdb", "mnemonic_languages", "protos", "sound", "stylesheets"]}
+    ' package.json > package.json.new
+    mv package.json.new package.json
+  '';
 
   nativeBuildInputs = [
     copyDesktopItems
     makeWrapper
+    yarnConfigHook
+    yarnBuildHook
+    yarnInstallHook
+    nodejs
+    jq
+    python3
+    fake-git # see build/updateLocalConfig.js
+  ]
+  ++ lib.optionals stdenv.hostPlatform.isDarwin [
+    cctools # provides libtool needed for better-sqlite3
+    xcodebuild
+    darwin.autoSignDarwinBinariesHook
   ];
 
+  env = {
+    npm_config_nodedir = electron.headers;
+    ELECTRON_SKIP_BINARY_DOWNLOAD = 1;
+  };
+
+  dontUseCmakeConfigure = true;
+  yarnOfflineCache = fetchYarnDeps {
+    # Future maintainers: keep in mind that sometimes the upstream deduplicates dependencies
+    # (see the `dedup` script in package.json) before committing yarn.lock,
+    # which may unfortunately break the offline cache (and may not).
+    # If that happens, clone the repo and run `yarn install --ignore-scripts` yourself,
+    # copy the modified yarn.lock here, and use `./yarn.lock` instead of `"${finalAttrs.src}/yarn.lock"`,
+    # and also add `cp ${./yarn.lock} yarn.lock` to postPatch.
+    yarnLock = "${finalAttrs.src}/yarn.lock";
+    hash = "sha256-A2AbKOXWx8+PN467DVpKVTorZDs/UFaxjc7VS0Xdo6k=";
+  };
+
+  preBuild = ''
+    # prevent downloading
+    pushd node_modules/@signalapp/better-sqlite3/deps
+    tar -czf sqlcipher.tar.gz \
+      -C ${signal-sqlcipher-extension} lib include \
+      -C ${sqlcipher-src} . \
+      --transform="s,^lib,./signal-sqlcipher-extension/${stdenv.targetPlatform.rust.cargoShortTarget}," \
+      --transform="s,^include,./signal-sqlcipher-extension/include,"
+    hash=$(sha256sum sqlcipher.tar.gz | cut -d' ' -f1)
+    sed -i "s/^const HASH = '.*';/const HASH = '$hash';/" download.js
+    popd
+
+    export NODE_ENV=production
+
+    # rebuild native modules except libsession_util_nodejs
+    rm -rf node_modules/libsession_util_nodejs
+    npm rebuild --verbose --offline --no-progress --release # why doesn't yarn have `rebuild`?
+    cp -r ${libsession-util-nodejs}/lib/node_modules/libsession_util_nodejs node_modules
+    chmod -R +w node_modules/libsession_util_nodejs
+    rm -rf node_modules/libsession_util_nodejs/node_modules
+
+    # some important things that did not run because of --ignore-scripts
+    yarn run postinstall
+  '';
+
+  preInstall = ''
+    # Do not want yarn prune to remove native modules that we just built.
+    mv node_modules node_modules.dev
+  '';
+
+  postInstall = ''
+    find node_modules.dev -mindepth 2 -maxdepth 3 -type d -name build  | while read -r buildDir; do
+      packageDir=$(dirname ''${buildDir#node_modules.dev/})
+      installPackageDir="$out/lib/node_modules/session-desktop/node_modules/$packageDir"
+      if [ -d "$installPackageDir" ]; then
+        cp -r "$buildDir" "$installPackageDir"
+      fi
+    done
+
+    makeWrapper ${lib.getExe electron} $out/bin/session-desktop \
+      --add-flags $out/lib/node_modules/session-desktop \
+      --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--ozone-platform-hint=auto --enable-features=WaylandWindowDecorations --enable-wayland-ime=true}}" \
+      --set NODE_ENV production \
+      --inherit-argv0
+
+    for f in build/icons/icon_*.png; do
+      base=$(basename $f .png)
+      size=''${base#icon_}
+      install -Dm644 $f $out/share/icons/hicolor/$size/apps/session-desktop.png
+    done
+  ''
+  + lib.optionalString stdenv.hostPlatform.isDarwin ''
+    mkdir -p $out/Applications/Session.app/Contents/{MacOS,Resources}
+    ln -s $out/bin/session-desktop $out/Applications/Session.app/Contents/MacOS/Session
+    install -Dm644 build/icon-mac.icns $out/Applications/Session.app/Contents/Resources/icon.icns
+    install -Dm644 ${
+      # Adapted from the dmg package from upstream:
+      # https://github.com/session-foundation/session-desktop/releases/download/v1.16.10/session-desktop-mac-arm64-1.16.10.dmg
+      replaceVars ./Info.plist { inherit (finalAttrs) version; }
+    } $out/Applications/Session.app/Contents/Info.plist
+  '';
+
   desktopItems = [
     (makeDesktopItem {
       name = "Session";
       desktopName = "Session";
       comment = "Onion routing based messenger";
       exec = "session-desktop";
-      icon = "${appimage-contents}/session-desktop.png";
+      icon = "session-desktop";
       terminal = false;
       type = "Application";
       categories = [ "Network" ];
     })
   ];
 
-  installPhase = ''
+  passthru = {
-    runHook preInstall
+    inherit sqlcipher-src signal-sqlcipher-extension libsession-util-nodejs;
+    updateScript = ./update.sh;
+  };
 
-    mkdir -p $out/
+  meta = {
-    cp -r bin $out/bin
-
-    wrapProgram $out/bin/session-desktop \
-      --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--ozone-platform-hint=auto --enable-features=WaylandWindowDecorations --enable-wayland-ime=true}}"
-
-    runHook postInstall
-  '';
-
-  meta = with lib; {
     description = "Onion routing based messenger";
     mainProgram = "session-desktop";
     homepage = "https://getsession.org/";
-    license = licenses.gpl3Only;
+    downloadPage = "https://getsession.org/download";
-    maintainers = with maintainers; [
+    changelog = "https://github.com/session-foundation/session-desktop/releases/tag/${finalAttrs.src.tag}";
+    license = lib.licenses.gpl3Only;
+    maintainers = with lib.maintainers; [
       alexnortung
+      ulysseszhan
     ];
-    platforms = [ "x86_64-linux" ];
+    platforms = lib.platforms.all;
-    sourceProvenance = with sourceTypes; [ binaryNativeCode ];
   };
-}
+})

pkgs/by-name/se/session-desktop/update.sh

@@ -0,0 +1,33 @@
+#!/usr/bin/env nix-shell
+#!nix-shell -i bash -p curl jq common-updater-scripts
+
+set -euo pipefail
+
+currentVersion="$(nix-instantiate --eval --raw -A session-desktop.version)"
+latestVersion="$(
+  curl -s https://api.github.com/repos/session-foundation/session-desktop/releases/latest \
+    ${GITHUB_TOKEN:+--user ":$GITHUB_TOKEN"} \
+  | jq -r .tag_name | sed 's/^v//'
+)"
+if [ "$currentVersion" = "$latestVersion" ]; then
+  echo "Already up-to-date"
+  exit 0
+fi
+
+yarnLock="$(curl -s https://raw.githubusercontent.com/session-foundation/session-desktop/v$latestVersion/yarn.lock)"
+depVersion() {
+  name="$(echo "$1" | sed 's/\//\\&/g')"
+  echo "$yarnLock" | awk '/^"?'"$name"'@/ {flag=1; next} flag && /^  version "[^"]+"/ {match($0, /^  version "([^"]+)"/, a); print a[1]; exit}' -
+}
+
+update-source-version session-desktop.passthru.libsession-util.nodejs "$(depVersion libsession_util_nodejs)"
+
+downloadJs="$(curl -s https://raw.githubusercontent.com/signalapp/better-sqlite3/v$(depVersion @signalapp/better-sqlite3)/deps/download.js)"
+sqlDepVersion() {
+  echo "$downloadJs" | awk "match(\$0, /^const ${1}_VERSION = '([0-9.]+)['-]/, a) {print a[1]}" -
+}
+
+update-source-version session-desktop.passthru.sqlcipher-src "$(sqlDepVersion SQLCIPHER)"
+update-source-version session-desktop.passthru.signal-sqlcipher-extension "$(sqlDepVersion EXTENSION)"
+
+update-source-version session-desktop "$latestVersion"