Merge master into haskell-updates

lib/licenses.nix

@@ -103,6 +103,11 @@ in mkLicense lset) ({
     fullName = "Apache License 2.0";
   };
 
+  bola11 = {
+    url = "https://blitiri.com.ar/p/bola/";
+    fullName = "Buena Onda License Agreement 1.1";
+  };
+
   boost = {
     spdxId = "BSL-1.0";
     fullName = "Boost Software License 1.0";

maintainers/maintainer-list.nix

@@ -5494,6 +5494,13 @@
     githubId = 25618740;
     name = "Vincent Cui";
   };
+  houstdav000 = {
+    email = "houstdav000@gmail.com";
+    github = "houstdav000";
+    githubId = 17628961;
+    matrix = "@houstdav000:gh0st.ems.host";
+    name = "David Houston";
+  };
   hoverbear = {
     email = "operator+nix@hoverbear.org";
     matrix = "@hoverbear:matrix.org";
@@ -13676,6 +13683,12 @@
     githubId = 9870613;
     name = "Hubert Mühlhans";
   };
+  trobert = {
+    email = "thibaut.robert@gmail.com";
+    github = "trobert";
+    githubId = 504580;
+    name = "Thibaut Robert";
+  };
   troydm = {
     email = "d.geurkov@gmail.com";
     github = "troydm";
@@ -13885,6 +13898,12 @@
     githubId = 120451;
     name = "Urban Skudnik";
   };
+  usrfriendly = {
+      name = "Arin Lares";
+      email = "arinlares@gmail.com";
+      github = "usrfriendly";
+      githubId = 2502060;
+    };
   utdemir = {
     email = "me@utdemir.com";
     github = "utdemir";

nixos/doc/manual/from_md/release-notes/rl-2211.section.xml

@@ -142,6 +142,13 @@
           OpenSSL now defaults to OpenSSL 3, updated from 1.1.1.
         </para>
       </listitem>
+      <listitem>
+        <para>
+          An image configuration and generator has been added for Linode
+          images, largely based on the present GCE configuration and
+          image.
+        </para>
+      </listitem>
       <listitem>
         <para>
           <literal>hardware.nvidia</literal> has a new option
@@ -285,6 +292,13 @@
           <link linkend="opt-services.dolibarr.enable">services.dolibarr</link>.
         </para>
       </listitem>
+      <listitem>
+        <para>
+          <link xlink:href="https://freshrss.org/">FreshRSS</link>, a
+          free, self-hostable RSS feed aggregator. Available as
+          <link linkend="opt-services.freshrss.enable">services.freshrss</link>.
+        </para>
+      </listitem>
       <listitem>
         <para>
           <link xlink:href="https://www.expressvpn.com">expressvpn</link>,
@@ -640,6 +654,12 @@
           guide</link> on how to migrate your Neo4j instance.
         </para>
       </listitem>
+      <listitem>
+        <para>
+          The <literal>networking.wireguard</literal> module now can set
+          the mtu on interfaces and tag its packets with an fwmark.
+        </para>
+      </listitem>
       <listitem>
         <para>
           The <literal>services.matrix-synapse</literal> systemd unit
@@ -717,6 +737,21 @@
           Add udev rules for the Teensy family of microcontrollers.
         </para>
       </listitem>
+      <listitem>
+        <para>
+          systemd-oomd is enabled by default. Depending on which systemd
+          units have <literal>ManagedOOMSwap=kill</literal> or
+          <literal>ManagedOOMMemoryPressure=kill</literal>, systemd-oomd
+          will SIGKILL all the processes under the appropriate
+          descendant cgroups when the configured limits are exceeded.
+          NixOS does currently not configure cgroups with oomd by
+          default, this can be enabled using
+          <link xlink:href="options.html#opt-systemd.oomd.enableRootSlice">systemd.oomd.enableRootSlice</link>,
+          <link xlink:href="options.html#opt-systemd.oomd.enableSystemSlice">systemd.oomd.enableSystemSlice</link>,
+          and
+          <link xlink:href="options.html#opt-systemd.oomd.enableUserServices">systemd.oomd.enableUserServices</link>.
+        </para>
+      </listitem>
       <listitem>
         <para>
           The <literal>pass-secret-service</literal> package now
@@ -757,6 +792,18 @@
           which no longer has a downgrade path to releases 1.2 or older.
         </para>
       </listitem>
+      <listitem>
+        <para>
+          The <literal>nodePackages</literal> package set now defaults
+          to the LTS release in the <literal>nodejs</literal> package
+          again, instead of being pinned to
+          <literal>nodejs-14_x</literal>. Several updates to node2nix
+          have been made for compatibility with newer Node.js and npm
+          versions and a new <literal>postRebuild</literal> hook has
+          been added for packages to perform extra build steps before
+          the npm install step prunes dev dependencies.
+        </para>
+      </listitem>
     </itemizedlist>
   </section>
 </section>

nixos/doc/manual/release-notes/rl-2211.section.md

@@ -57,6 +57,8 @@ In addition to numerous new and upgraded packages, this release has the followin
 
 - OpenSSL now defaults to OpenSSL 3, updated from 1.1.1.
 
+- An image configuration and generator has been added for Linode images, largely based on the present GCE configuration and image.
+
 - `hardware.nvidia` has a new option `open` that can be used to opt in the opensource version of NVIDIA kernel driver. Note that the driver's support for GeForce and Workstation GPUs is still alpha quality, see [NVIDIA Releases Open-Source GPU Kernel Modules](https://developer.nvidia.com/blog/nvidia-releases-open-source-gpu-kernel-modules/) for the official announcement.
 
 <!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->
@@ -100,6 +102,8 @@ In addition to numerous new and upgraded packages, this release has the followin
 
 - [Dolibarr](https://www.dolibarr.org/), an enterprise resource planning and customer relationship manager. Enable using [services.dolibarr](#opt-services.dolibarr.enable).
 
+- [FreshRSS](https://freshrss.org/), a free, self-hostable RSS feed aggregator. Available as [services.freshrss](#opt-services.freshrss.enable).
+
 - [expressvpn](https://www.expressvpn.com), the CLI client for ExpressVPN. Available as [services.expressvpn](#opt-services.expressvpn.enable).
 
 - [go-autoconfig](https://github.com/L11R/go-autoconfig), IMAP/SMTP autodiscover server. Available as [services.go-autoconfig](#opt-services.go-autoconfig.enable).
@@ -215,6 +219,8 @@ Available as [services.patroni](options.html#opt-services.patroni.enable).
 
 - Neo4j was updated from version 3 to version 4. See this [migration guide](https://neo4j.com/docs/upgrade-migration-guide/current/) on how to migrate your Neo4j instance.
 
+- The `networking.wireguard` module now can set the mtu on interfaces and tag its packets with an fwmark.
+
 - The `services.matrix-synapse` systemd unit has been hardened.
 
 - Matrix Synapse now requires entries in the `state_group_edges` table to be unique, in order to prevent accidentally introducing duplicate information (for example, because a database backup was restored multiple times). If your Synapse database already has duplicate rows in this table, this could fail with an error and require manual remediation.
@@ -235,6 +241,15 @@ Available as [services.patroni](options.html#opt-services.patroni.enable).
 
 - Add udev rules for the Teensy family of microcontrollers.
 
+- systemd-oomd is enabled by default. Depending on which systemd units have
+  `ManagedOOMSwap=kill` or `ManagedOOMMemoryPressure=kill`, systemd-oomd will
+  SIGKILL all the processes under the appropriate descendant cgroups when the
+  configured limits are exceeded. NixOS does currently not configure cgroups
+  with oomd by default, this can be enabled using
+  [systemd.oomd.enableRootSlice](options.html#opt-systemd.oomd.enableRootSlice),
+  [systemd.oomd.enableSystemSlice](options.html#opt-systemd.oomd.enableSystemSlice),
+  and [systemd.oomd.enableUserServices](options.html#opt-systemd.oomd.enableUserServices).
+
 - The `pass-secret-service` package now includes systemd units from upstream, so adding it to the NixOS `services.dbus.packages` option will make it start automatically as a systemd user service when an application tries to talk to the libsecret D-Bus API.
 
 - There is a new module for AMD SEV CPU functionality, which grants access to the hardware.
@@ -245,4 +260,6 @@ Available as [services.patroni](options.html#opt-services.patroni.enable).
 
 - The `nomad` package now defaults to 1.3, which no longer has a downgrade path to releases 1.2 or older.
 
+- The `nodePackages` package set now defaults to the LTS release in the `nodejs` package again, instead of being pinned to `nodejs-14_x`. Several updates to node2nix have been made for compatibility with newer Node.js and npm versions and a new `postRebuild` hook has been added for packages to perform extra build steps before the npm install step prunes dev dependencies.
+
 <!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->

nixos/lib/testing/call-test.nix

@@ -10,7 +10,7 @@ in
     };
     result = mkOption {
       internal = true;
-      default = config;
+      default = config.test;
     };
   };
 }

nixos/modules/module-list.nix

@@ -1074,6 +1074,7 @@
   ./services/web-apps/engelsystem.nix
   ./services/web-apps/ethercalc.nix
   ./services/web-apps/fluidd.nix
+  ./services/web-apps/freshrss.nix
   ./services/web-apps/galene.nix
   ./services/web-apps/gerrit.nix
   ./services/web-apps/gotify-server.nix
@@ -1236,6 +1237,7 @@
   ./system/boot/systemd/journald.nix
   ./system/boot/systemd/logind.nix
   ./system/boot/systemd/nspawn.nix
+  ./system/boot/systemd/oomd.nix
   ./system/boot/systemd/shutdown.nix
   ./system/boot/systemd/tmpfiles.nix
   ./system/boot/systemd/user.nix

nixos/modules/services/networking/wireguard.nix

@@ -137,6 +137,33 @@ let
         See [documentation](https://www.wireguard.com/netns/).
         '';
       };
+
+      fwMark = mkOption {
+        default = null;
+        type = with types; nullOr str;
+        example = "0x6e6978";
+        description = lib.mdDoc ''
+          Mark all wireguard packets originating from
+          this interface with the given firewall mark. The firewall mark can be
+          used in firewalls or policy routing to filter the wireguard packets.
+          This can be useful for setup where all traffic goes through the
+          wireguard tunnel, because the wireguard packets need to be routed
+          differently.
+        '';
+      };
+
+      mtu = mkOption {
+        default = null;
+        type = with types; nullOr int;
+        example = 1280;
+        description = lib.mdDoc ''
+          Set the maximum transmission unit in bytes for the wireguard
+          interface. Beware that the wireguard packets have a header that may
+          add up to 80 bytes to the mtu. By default, the MTU is (1500 - 80) =
+          1420. However, if the MTU of the upstream network is lower, the MTU
+          of the wireguard network has to be adjusted as well.
+        '';
+      };
     };
 
   };
@@ -398,6 +425,7 @@ let
 
           ${ipPreMove} link add dev "${name}" type wireguard
           ${optionalString (values.interfaceNamespace != null && values.interfaceNamespace != values.socketNamespace) ''${ipPreMove} link set "${name}" netns "${ns}"''}
+          ${optionalString (values.mtu != null) ''${ipPreMove} link set "${name}" mtu ${toString values.mtu}''}
 
           ${concatMapStringsSep "\n" (ip:
             ''${ipPostMove} address add "${ip}" dev "${name}"''
@@ -406,6 +434,7 @@ let
           ${concatStringsSep " " (
             [ ''${wg} set "${name}" private-key "${privKey}"'' ]
             ++ optional (values.listenPort != null) ''listen-port "${toString values.listenPort}"''
+            ++ optional (values.fwMark != null) ''fwmark "${values.fwMark}"''
           )}
 
           ${ipPostMove} link set up dev "${name}"

nixos/modules/services/web-apps/freshrss.nix

@@ -0,0 +1,274 @@
+{ config, lib, pkgs, ... }:
+
+with lib;
+let
+  cfg = config.services.freshrss;
+
+  poolName = "freshrss";
+in
+{
+  meta.maintainers = with maintainers; [ etu stunkymonkey ];
+
+  options.services.freshrss = {
+    enable = mkEnableOption (mdDoc "FreshRSS feed reader");
+
+    package = mkOption {
+      type = types.package;
+      default = pkgs.freshrss;
+      defaultText = lib.literalExpression "pkgs.freshrss";
+      description = mdDoc "Which FreshRSS package to use.";
+    };
+
+    defaultUser = mkOption {
+      type = types.str;
+      default = "admin";
+      description = mdDoc "Default username for FreshRSS.";
+      example = "eva";
+    };
+
+    passwordFile = mkOption {
+      type = types.path;
+      description = mdDoc "Password for the defaultUser for FreshRSS.";
+      example = "/run/secrets/freshrss";
+    };
+
+    baseUrl = mkOption {
+      type = types.str;
+      description = mdDoc "Default URL for FreshRSS.";
+      example = "https://freshrss.example.com";
+    };
+
+    language = mkOption {
+      type = types.str;
+      default = "en";
+      description = mdDoc "Default language for FreshRSS.";
+      example = "de";
+    };
+
+    database = {
+      type = mkOption {
+        type = types.enum [ "sqlite" "pgsql" "mysql" ];
+        default = "sqlite";
+        description = mdDoc "Database type.";
+        example = "pgsql";
+      };
+
+      host = mkOption {
+        type = types.nullOr types.str;
+        default = "localhost";
+        description = mdDoc "Database host for FreshRSS.";
+      };
+
+      port = mkOption {
+        type = with types; nullOr port;
+        default = null;
+        description = mdDoc "Database port for FreshRSS.";
+        example = 3306;
+      };
+
+      user = mkOption {
+        type = types.nullOr types.str;
+        default = "freshrss";
+        description = mdDoc "Database user for FreshRSS.";
+      };
+
+      passFile = mkOption {
+        type = types.nullOr types.str;
+        default = null;
+        description = mdDoc "Database password file for FreshRSS.";
+        example = "/run/secrets/freshrss";
+      };
+
+      name = mkOption {
+        type = types.nullOr types.str;
+        default = "freshrss";
+        description = mdDoc "Database name for FreshRSS.";
+      };
+
+      tableprefix = mkOption {
+        type = types.nullOr types.str;
+        default = null;
+        description = mdDoc "Database table prefix for FreshRSS.";
+        example = "freshrss";
+      };
+    };
+
+    dataDir = mkOption {
+      type = types.str;
+      default = "/var/lib/freshrss";
+      description = mdDoc "Default data folder for FreshRSS.";
+      example = "/mnt/freshrss";
+    };
+
+    virtualHost = mkOption {
+      type = types.nullOr types.str;
+      default = "freshrss";
+      description = mdDoc ''
+        Name of the nginx virtualhost to use and setup. If null, do not setup any virtualhost.
+      '';
+    };
+
+    pool = mkOption {
+      type = types.str;
+      default = poolName;
+      description = mdDoc ''
+        Name of the phpfpm pool to use and setup. If not specified, a pool will be created
+        with default values.
+      '';
+    };
+  };
+
+
+  config =
+    let
+      systemd-hardening = {
+        CapabilityBoundingSet = [ "CAP_NET_BIND_SERVICE" ];
+        DeviceAllow = "";
+        LockPersonality = true;
+        NoNewPrivileges = true;
+        PrivateDevices = true;
+        PrivateTmp = true;
+        PrivateUsers = true;
+        ProcSubset = "pid";
+        ProtectClock = true;
+        ProtectControlGroups = true;
+        ProtectHome = true;
+        ProtectHostname = true;
+        ProtectKernelLogs = true;
+        ProtectKernelModules = true;
+        ProtectKernelTunables = true;
+        ProtectProc = "invisible";
+        ProtectSystem = "strict";
+        RemoveIPC = true;
+        RestrictNamespaces = true;
+        RestrictRealtime = true;
+        RestrictSUIDSGID = true;
+        SystemCallArchitectures = "native";
+        SystemCallFilter = [ "@system-service" "~@resources" "~@privileged" ];
+        UMask = "0007";
+      };
+    in
+    mkIf cfg.enable {
+      # Set up a Nginx virtual host.
+      services.nginx = mkIf (cfg.virtualHost != null) {
+        enable = true;
+        virtualHosts.${cfg.virtualHost} = {
+          root = "${cfg.package}/p";
+
+          locations."~ ^.+?\.php(/.*)?$".extraConfig = ''
+            fastcgi_pass unix:${config.services.phpfpm.pools.${cfg.pool}.socket};
+            fastcgi_split_path_info ^(.+\.php)(/.*)$;
+            include ${pkgs.nginx}/conf/fastcgi_params;
+            include ${pkgs.nginx}/conf/fastcgi.conf;
+          '';
+
+          locations."/" = {
+            tryFiles = "$uri $uri/ index.php";
+            index = "index.php index.html index.htm";
+          };
+        };
+      };
+
+      # Set up phpfpm pool
+      services.phpfpm.pools = mkIf (cfg.pool == poolName) {
+        ${poolName} = {
+          user = "freshrss";
+          settings = {
+            "listen.owner" = "nginx";
+            "listen.group" = "nginx";
+            "listen.mode" = "0600";
+            "pm" = "dynamic";
+            "pm.max_children" = 32;
+            "pm.max_requests" = 500;
+            "pm.start_servers" = 2;
+            "pm.min_spare_servers" = 2;
+            "pm.max_spare_servers" = 5;
+            "catch_workers_output" = true;
+          };
+          phpEnv = {
+            FRESHRSS_DATA_PATH = "${cfg.dataDir}";
+          };
+        };
+      };
+
+      users.users.freshrss = {
+        description = "FreshRSS service user";
+        isSystemUser = true;
+        group = "freshrss";
+      };
+      users.groups.freshrss = { };
+
+      systemd.services.freshrss-config =
+        let
+          settingsFlags = concatStringsSep " \\\n    "
+            (mapAttrsToList (k: v: "${k} ${toString v}") {
+              "--default_user" = ''"${cfg.defaultUser}"'';
+              "--auth_type" = ''"form"'';
+              "--base_url" = ''"${cfg.baseUrl}"'';
+              "--language" = ''"${cfg.language}"'';
+              "--db-type" = ''"${cfg.database.type}"'';
+              # The following attributes are optional depending on the type of
+              # database.  Those that evaluate to null on the left hand side
+              # will be omitted.
+              ${if cfg.database.name != null then "--db-base" else null} = ''"${cfg.database.name}"'';
+              ${if cfg.database.passFile != null then "--db-password" else null} = ''"$(cat ${cfg.database.passFile})"'';
+              ${if cfg.database.user != null then "--db-user" else null} = ''"${cfg.database.user}"'';
+              ${if cfg.database.tableprefix != null then "--db-prefix" else null} = ''"${cfg.database.tableprefix}"'';
+              ${if cfg.database.host != null && cfg.database.port != null then "--db-host" else null} = ''"${cfg.database.host}:${toString cfg.database.port}"'';
+            });
+        in
+        {
+          description = "Set up the state directory for FreshRSS before use";
+          wantedBy = [ "multi-user.target" ];
+          serviceConfig = {
+            Type = "oneshot";
+            User = "freshrss";
+            Group = "freshrss";
+            StateDirectory = "freshrss";
+            WorkingDirectory = cfg.package;
+          } // systemd-hardening;
+          environment = {
+            FRESHRSS_DATA_PATH = cfg.dataDir;
+          };
+
+          script = ''
+            # create files with correct permissions
+            mkdir -m 755 -p ${cfg.dataDir}
+
+            # do installation or reconfigure
+            if test -f ${cfg.dataDir}/config.php; then
+              # reconfigure with settings
+              ${pkgs.php}/bin/php ./cli/reconfigure.php ${settingsFlags}
+              ${pkgs.php}/bin/php ./cli/update-user.php --user ${cfg.defaultUser} --password "$(cat ${cfg.passwordFile})"
+            else
+              # Copy the user data template directory
+              cp -r ./data ${cfg.dataDir}
+
+              # check correct folders in data folder
+              ${pkgs.php}/bin/php ./cli/prepare.php
+              # install with settings
+              ${pkgs.php}/bin/php ./cli/do-install.php ${settingsFlags}
+              ${pkgs.php}/bin/php ./cli/create-user.php --user ${cfg.defaultUser} --password "$(cat ${cfg.passwordFile})"
+            fi
+          '';
+        };
+
+      systemd.services.freshrss-updater = {
+        description = "FreshRSS feed updater";
+        after = [ "freshrss-config.service" ];
+        wantedBy = [ "multi-user.target" ];
+        startAt = "*:0/5";
+        environment = {
+          FRESHRSS_DATA_PATH = cfg.dataDir;
+        };
+        serviceConfig = {
+          Type = "oneshot";
+          User = "freshrss";
+          Group = "freshrss";
+          StateDirectory = "freshrss";
+          WorkingDirectory = cfg.package;
+          ExecStart = "${pkgs.php}/bin/php ./app/actualize_script.php";
+        } // systemd-hardening;
+      };
+    };
+}

nixos/modules/services/web-servers/caddy/default.nix

@@ -26,7 +26,7 @@ let
 
   configFile =
     let
-      Caddyfile = pkgs.writeText "Caddyfile" ''
+      Caddyfile = pkgs.writeTextDir "Caddyfile" ''
         {
           ${cfg.globalConfig}
         }
@@ -34,10 +34,11 @@ let
       '';
 
       Caddyfile-formatted = pkgs.runCommand "Caddyfile-formatted" { nativeBuildInputs = [ cfg.package ]; } ''
-        ${cfg.package}/bin/caddy fmt ${Caddyfile} > $out
+        mkdir -p $out
+        ${cfg.package}/bin/caddy fmt ${Caddyfile}/Caddyfile > $out/Caddyfile
       '';
     in
-      if pkgs.stdenv.buildPlatform == pkgs.stdenv.hostPlatform then Caddyfile-formatted else Caddyfile;
+      "${if pkgs.stdenv.buildPlatform == pkgs.stdenv.hostPlatform then Caddyfile-formatted else Caddyfile}/Caddyfile";
 
   acmeHosts = unique (catAttrs "useACMEHost" acmeVHosts);
 
@@ -142,7 +143,7 @@ in
       default = configFile;
       defaultText = "A Caddyfile automatically generated by values from services.caddy.*";
       example = literalExpression ''
-        pkgs.writeText "Caddyfile" '''
+        pkgs.writeTextDir "Caddyfile" '''
           example.com
 
           root * /var/www/wordpress
@@ -157,17 +158,24 @@ in
     };
 
     adapter = mkOption {
-      default = "caddyfile";
-      example = "nginx";
-      type = types.str;
+      default = null;
+      example = literalExpression "nginx";
+      type = with types; nullOr str;
       description = lib.mdDoc ''
         Name of the config adapter to use.
         See <https://caddyserver.com/docs/config-adapters>
         for the full list.
 
+        If `null` is specified, the `--adapter` argument is omitted when
+        starting or restarting Caddy. Notably, this allows specification of a
+        configuration file in Caddy's native JSON format, as long as the
+        filename does not start with `Caddyfile` (in which case the `caddyfile`
+        adapter is implicitly enabled). See
+        <https://caddyserver.com/docs/command-line#caddy-run> for details.
+
         ::: {.note}
-        Any value other than `caddyfile` is only valid when
-        providing your own {option}`configFile`.
+        Any value other than `null` or `caddyfile` is only valid when providing
+        your own `configFile`.
         :::
       '';
     };
@@ -264,8 +272,8 @@ in
   config = mkIf cfg.enable {
 
     assertions = [
-      { assertion = cfg.adapter != "caddyfile" -> cfg.configFile != configFile;
-        message = "Any value other than 'caddyfile' is only valid when providing your own `services.caddy.configFile`";
+      { assertion = cfg.configFile == configFile -> cfg.adapter == "caddyfile" || cfg.adapter == null;
+        message = "To specify an adapter other than 'caddyfile' please provide your own configuration via `services.caddy.configFile`";
       }
     ] ++ map (name: mkCertOwnershipAssertion {
       inherit (cfg) group user;
@@ -295,10 +303,9 @@ in
       serviceConfig = {
         # https://www.freedesktop.org/software/systemd/man/systemd.service.html#ExecStart=
         # If the empty string is assigned to this option, the list of commands to start is reset, prior assignments of this option will have no effect.
-        ExecStart = [ "" "${cfg.package}/bin/caddy run --config ${cfg.configFile} --adapter ${cfg.adapter} ${optionalString cfg.resume "--resume"}" ];
-        ExecReload = [ "" "${cfg.package}/bin/caddy reload --config ${cfg.configFile} --adapter ${cfg.adapter} --force" ];
-
-        ExecStartPre = "${cfg.package}/bin/caddy validate --config ${cfg.configFile} --adapter ${cfg.adapter}";
+        ExecStart = [ "" ''${cfg.package}/bin/caddy run --config ${cfg.configFile} ${optionalString (cfg.adapter != null) "--adapter ${cfg.adapter}"} ${optionalString cfg.resume "--resume"}'' ];
+        ExecReload = [ "" ''${cfg.package}/bin/caddy reload --config ${cfg.configFile} ${optionalString (cfg.adapter != null) "--adapter ${cfg.adapter}"} --force'' ];
+        ExecStartPre = ''${cfg.package}/bin/caddy validate --config ${cfg.configFile} ${optionalString (cfg.adapter != null) "--adapter ${cfg.adapter}"}'';
         User = cfg.user;
         Group = cfg.group;
         ReadWriteDirectories = cfg.dataDir;

nixos/modules/system/boot/systemd/oomd.nix

@@ -0,0 +1,57 @@
+{ config, lib, ... }: let
+
+  cfg = config.systemd.oomd;
+
+in {
+  options.systemd.oomd = {
+    enable = lib.mkEnableOption (lib.mdDoc "the `systemd-oomd` OOM killer") // { default = true; };
+
+    # Fedora enables the first and third option by default. See the 10-oomd-* files here:
+    # https://src.fedoraproject.org/rpms/systemd/tree/acb90c49c42276b06375a66c73673ac351025597
+    enableRootSlice = lib.mkEnableOption (lib.mdDoc "oomd on the root slice (`-.slice`)");
+    enableSystemSlice = lib.mkEnableOption (lib.mdDoc "oomd on the system slice (`system.slice`)");
+    enableUserServices = lib.mkEnableOption (lib.mdDoc "oomd on all user services (`user@.service`)");
+
+    extraConfig = lib.mkOption {
+      type = with lib.types; attrsOf (oneOf [ str int bool ]);
+      default = {};
+      example = lib.literalExpression ''{ DefaultMemoryPressureDurationSec = "20s"; }'';
+      description = lib.mdDoc ''
+        Extra config options for `systemd-oomd`. See {command}`man oomd.conf`
+        for available options.
+      '';
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    systemd.additionalUpstreamSystemUnits = [
+      "systemd-oomd.service"
+      "systemd-oomd.socket"
+    ];
+    systemd.services.systemd-oomd.wantedBy = [ "multi-user.target" ];
+
+    environment.etc."systemd/oomd.conf".text = lib.generators.toINI {} {
+      OOM = cfg.extraConfig;
+    };
+
+    systemd.oomd.extraConfig.DefaultMemoryPressureDurationSec = lib.mkDefault "20s"; # Fedora default
+
+    users.users.systemd-oom = {
+      description = "systemd-oomd service user";
+      group = "systemd-oom";
+      isSystemUser = true;
+    };
+    users.groups.systemd-oom = { };
+
+    systemd.slices."-".sliceConfig = lib.mkIf cfg.enableRootSlice {
+      ManagedOOMSwap = "kill";
+    };
+    systemd.slices."system".sliceConfig = lib.mkIf cfg.enableSystemSlice {
+      ManagedOOMSwap = "kill";
+    };
+    systemd.services."user@".serviceConfig = lib.mkIf cfg.enableUserServices {
+      ManagedOOMMemoryPressure = "kill";
+      ManagedOOMMemoryPressureLimit = "50%";
+    };
+  };
+}

nixos/modules/virtualisation/linode-config.nix

@@ -0,0 +1,75 @@
+{ config, lib, pkgs, ... }:
+with lib;
+{
+  imports = [ ../profiles/qemu-guest.nix ];
+
+  services.openssh = {
+    enable = true;
+
+    permitRootLogin = "prohibit-password";
+    passwordAuthentication = mkDefault false;
+  };
+
+  networking = {
+    usePredictableInterfaceNames = false;
+    useDHCP = false;
+    interfaces.eth0 = {
+      useDHCP = true;
+
+      # Linode expects IPv6 privacy extensions to be disabled, so disable them
+      # See: https://www.linode.com/docs/guides/manual-network-configuration/#static-vs-dynamic-addressing
+      tempAddress = "disabled";
+    };
+  };
+
+  # Install diagnostic tools for Linode support
+  environment.systemPackages = with pkgs; [
+    inetutils
+    mtr
+    sysstat
+  ];
+
+  fileSystems."/" = {
+    fsType = "ext4";
+    device = "/dev/sda";
+    autoResize = true;
+  };
+
+  swapDevices = mkDefault [{ device = "/dev/sdb"; }];
+
+  # Enable LISH and Linode Booting w/ GRUB
+  boot = {
+    # Add Required Kernel Modules
+    # NOTE: These are not documented in the install guide
+    initrd.availableKernelModules = [
+      "virtio_pci"
+      "virtio_scsi"
+      "ahci"
+      "sd_mod"
+    ];
+
+    # Set Up LISH Serial Connection
+    kernelParams = [ "console=ttyS0,19200n8" ];
+    kernelModules = [ "virtio_net" ];
+
+    loader = {
+      # Increase Timeout to Allow LISH Connection
+      # NOTE: The image generator tries to set a timeout of 0, so we must force
+      timeout = lib.mkForce 10;
+
+      grub = {
+        enable = true;
+        version = 2;
+        forceInstall = true;
+        device = "nodev";
+
+        # Allow serial connection for GRUB to be able to use LISH
+        extraConfig = ''
+          serial --speed=19200 --unit=0 --word=8 --parity=no --stop=1;
+          terminal_input serial;
+          terminal_output serial
+        '';
+      };
+    };
+  };
+}

nixos/modules/virtualisation/linode-image.nix

@@ -0,0 +1,66 @@
+{ config, lib, pkgs, ... }:
+
+with lib;
+let
+  cfg = config.virtualisation.linodeImage;
+  defaultConfigFile = pkgs.writeText "configuration.nix" ''
+    _: {
+      imports = [
+        <nixpkgs/nixos/modules/virtualisation/linode-image.nix>
+      ];
+    }
+  '';
+in
+{
+  imports = [ ./linode-config.nix ];
+
+  options = {
+    virtualisation.linodeImage.diskSize = mkOption {
+      type = with types; either (enum (singleton "auto")) ints.positive;
+      default = "auto";
+      example = 1536;
+      description = ''
+        Size of disk image in MB.
+      '';
+    };
+
+    virtualisation.linodeImage.configFile = mkOption {
+      type = with types; nullOr str;
+      default = null;
+      description = ''
+        A path to a configuration file which will be placed at `/etc/nixos/configuration.nix`
+        and be used when switching to a new configuration.
+        If set to `null`, a default configuration is used, where the only import is
+        `<nixpkgs/nixos/modules/virtualisation/linode-image.nix>`
+      '';
+    };
+
+    virtualisation.linodeImage.compressionLevel = mkOption {
+      type = types.ints.between 1 9;
+      default = 6;
+      description = ''
+        GZIP compression level of the resulting disk image (1-9).
+      '';
+    };
+  };
+
+  config = {
+    system.build.linodeImage = import ../../lib/make-disk-image.nix {
+      name = "linode-image";
+      # NOTE: Linode specifically requires images to be `gzip`-ed prior to upload
+      # See: https://www.linode.com/docs/products/tools/images/guides/upload-an-image/#requirements-and-considerations
+      postVM = ''
+        ${pkgs.gzip}/bin/gzip -${toString cfg.compressionLevel} -c -- $diskImage > \
+        $out/nixos-image-${config.system.nixos.label}-${pkgs.stdenv.hostPlatform.system}.img.gz
+        rm $diskImage
+      '';
+      format = "raw";
+      partitionTableType = "none";
+      configFile = if cfg.configFile == null then defaultConfigFile else cfg.configFile;
+      inherit (cfg) diskSize;
+      inherit config lib pkgs;
+    };
+  };
+
+  meta.maintainers = with maintainers; [ houstdav000 ];
+}

nixos/tests/all-tests.nix

@@ -208,6 +208,7 @@ in {
   fluidd = handleTest ./fluidd.nix {};
   fontconfig-default-fonts = handleTest ./fontconfig-default-fonts.nix {};
   freeswitch = handleTest ./freeswitch.nix {};
+  freshrss = handleTest ./freshrss.nix {};
   frr = handleTest ./frr.nix {};
   fsck = handleTest ./fsck.nix {};
   ft2-clone = handleTest ./ft2-clone.nix {};
@@ -607,6 +608,7 @@ in {
   systemd-networkd-ipv6-prefix-delegation = handleTest ./systemd-networkd-ipv6-prefix-delegation.nix {};
   systemd-networkd-vrf = handleTest ./systemd-networkd-vrf.nix {};
   systemd-nspawn = handleTest ./systemd-nspawn.nix {};
+  systemd-oomd = handleTest ./systemd-oomd.nix {};
   systemd-shutdown = handleTest ./systemd-shutdown.nix {};
   systemd-timesyncd = handleTest ./systemd-timesyncd.nix {};
   systemd-misc = handleTest ./systemd-misc.nix {};
@@ -648,6 +650,9 @@ in {
   user-home-mode = handleTest ./user-home-mode.nix {};
   uwsgi = handleTest ./uwsgi.nix {};
   v2ray = handleTest ./v2ray.nix {};
+  varnish60 = handleTest ./varnish.nix { package = pkgs.varnish60; };
+  varnish71 = handleTest ./varnish.nix { package = pkgs.varnish71; };
+  varnish72 = handleTest ./varnish.nix { package = pkgs.varnish72; };
   vault = handleTest ./vault.nix {};
   vault-dev = handleTest ./vault-dev.nix {};
   vault-postgresql = handleTest ./vault-postgresql.nix {};

nixos/tests/freshrss.nix

@@ -0,0 +1,19 @@
+import ./make-test-python.nix ({ lib, pkgs, ... }: {
+  name = "freshrss";
+  meta.maintainers = with lib.maintainers; [ etu stunkymonkey ];
+
+  nodes.machine = { pkgs, ... }: {
+    services.freshrss = {
+      enable = true;
+      baseUrl = "http://localhost";
+      passwordFile = pkgs.writeText "password" "secret";
+    };
+  };
+
+  testScript = ''
+    machine.wait_for_unit("multi-user.target")
+    machine.wait_for_open_port(80)
+    response = machine.succeed("curl -vvv -s -H 'Host: freshrss' http://127.0.0.1:80/i/")
+    assert '<title>Login · FreshRSS</title>' in response, "Login page didn't load successfully"
+  '';
+})

nixos/tests/rabbitmq.nix

@@ -1,6 +1,12 @@
 # This test runs rabbitmq and checks if rabbitmq is up and running.
 
-import ./make-test-python.nix ({ pkgs, ... }: {
+import ./make-test-python.nix ({ pkgs, ... }:
+let
+  # in real life, you would keep this out of your repo and deploy it to a safe
+  # location using safe means.
+  configKeyPath = pkgs.writeText "fake-config-key" "hOjWzSEn2Z7cHzKOcf6i183O2NdjurSuoMDIIv01";
+in
+{
   name = "rabbitmq";
   meta = with pkgs.lib.maintainers; {
     maintainers = [ eelco offline ];
@@ -10,6 +16,29 @@ import ./make-test-python.nix ({ pkgs, ... }: {
     services.rabbitmq = {
       enable = true;
       managementPlugin.enable = true;
+
+      # To encrypt:
+      # rabbitmqctl --quiet encode --cipher blowfish_cfb64 --hash sha256 \
+      #   --iterations 10000 '<<"dJT8isYu6t0Xb6u56rPglSj1vK51SlNVlXfwsRxw">>' \
+      #   "hOjWzSEn2Z7cHzKOcf6i183O2NdjurSuoMDIIv01" ;
+      config = ''
+        [ { rabbit
+          , [ {default_user, <<"alice">>}
+            , { default_pass
+              , {encrypted,<<"oKKxyTze9PYmsEfl6FG1MxIUhxY7WPQL7HBoMPRC/1ZOdOZbtr9+DxjWW3e1D5SL48n3D9QOsGD0cOgYG7Qdvb7Txrepw8w=">>}
+              }
+            , {config_entry_decoder
+              , [ {passphrase, {file, <<"${configKeyPath}">>}}
+                , {cipher, blowfish_cfb64}
+                , {hash, sha256}
+                , {iterations, 10000}
+                ]
+              }
+            % , {rabbitmq_management, [{path_prefix, "/_queues"}]}
+            ]
+          }
+        ].
+      '';
     };
     # Ensure there is sufficient extra disk space for rabbitmq to be happy
     virtualisation.diskSize = 1024;
@@ -23,5 +52,10 @@ import ./make-test-python.nix ({ pkgs, ... }: {
         'su -s ${pkgs.runtimeShell} rabbitmq -c "rabbitmqctl status"'
     )
     machine.wait_for_open_port(15672)
+
+    # The password is the plaintext that was encrypted with rabbitmqctl encode above.
+    machine.wait_until_succeeds(
+        '${pkgs.rabbitmq-java-client}/bin/PerfTest --time 10 --uri amqp://alice:dJT8isYu6t0Xb6u56rPglSj1vK51SlNVlXfwsRxw@localhost'
+    )
   '';
 })

nixos/tests/systemd-oomd.nix

@@ -0,0 +1,37 @@
+import ./make-test-python.nix ({ pkgs, ... }:
+
+{
+  name = "systemd-oomd";
+
+  nodes.machine = { pkgs, ... }: {
+    systemd.oomd.extraConfig.DefaultMemoryPressureDurationSec = "1s"; # makes the test faster
+    # Kill cgroups when more than 1% pressure is encountered
+    systemd.slices."-".sliceConfig = {
+      ManagedOOMMemoryPressure = "kill";
+      ManagedOOMMemoryPressureLimit = "1%";
+    };
+    # A service to bring the system under memory pressure
+    systemd.services.testservice = {
+      serviceConfig.ExecStart = "${pkgs.coreutils}/bin/tail /dev/zero";
+    };
+    # Do not kill the backdoor
+    systemd.services.backdoor.serviceConfig.ManagedOOMMemoryPressure = "auto";
+
+    virtualisation.memorySize = 1024;
+  };
+
+  testScript = ''
+    # Start the system
+    machine.wait_for_unit("multi-user.target")
+    machine.succeed("oomctl")
+
+    # Bring the system into memory pressure
+    machine.succeed("echo 0 > /proc/sys/vm/panic_on_oom")  # NixOS tests kill the VM when the OOM killer is invoked - override this
+    machine.succeed("systemctl start testservice")
+
+    # Wait for oomd to kill something
+    # Matches these lines:
+    # systemd-oomd[508]: Killed /system.slice/systemd-udevd.service due to memory pressure for / being 3.26% > 1.00% for > 1s with reclaim activity
+    machine.wait_until_succeeds("journalctl -b | grep -q 'due to memory pressure for'")
+  '';
+})

nixos/tests/varnish.nix

@@ -0,0 +1,55 @@
+{
+  system ? builtins.currentSystem
+, pkgs ? import ../.. { inherit system; }
+, package
+}:
+import ./make-test-python.nix ({ pkgs, ... }: let
+  testPath = pkgs.hello;
+in {
+  name = "varnish";
+  meta = with pkgs.lib.maintainers; {
+    maintainers = [ ajs124 ];
+  };
+
+  nodes = {
+    varnish = { config, pkgs, ... }: {
+        services.nix-serve = {
+          enable = true;
+        };
+
+        services.varnish = {
+          inherit package;
+          enable = true;
+          http_address = "0.0.0.0:80";
+          config = ''
+            vcl 4.0;
+
+            backend nix-serve {
+              .host = "127.0.0.1";
+              .port = "${toString config.services.nix-serve.port}";
+            }
+          '';
+        };
+
+        networking.firewall.allowedTCPPorts = [ 80 ];
+        system.extraDependencies = [ testPath ];
+      };
+
+    client = { lib, ... }: {
+      nix.settings = {
+        require-sigs = false;
+        substituters = lib.mkForce [ "http://varnish" ];
+      };
+    };
+  };
+
+  testScript = ''
+    start_all()
+    varnish.wait_for_open_port(80)
+
+    client.wait_until_succeeds("curl -f http://varnish/nix-cache-info");
+
+    client.wait_until_succeeds("nix-store -r ${testPath}");
+    client.succeed("${testPath}/bin/hello");
+  '';
+})

pkgs/applications/audio/pithos/default.nix

@@ -4,13 +4,13 @@
 
 pythonPackages.buildPythonApplication rec {
   pname = "pithos";
-  version = "1.5.1";
+  version = "1.6.0";
 
   src = fetchFromGitHub {
     owner = pname;
     repo  = pname;
     rev = version;
-    sha256 = "03j04b1mk2fq0ni2ydpw40fdd36k545z8a1pq9x5c779080cwpla";
+    hash = "sha256-cFmsdQXfGxgpKe32dw1lgoANU9Drhu5Mecyz37BVP4g=";
   };
 
   format = "other";
@@ -22,6 +22,10 @@ pythonPackages.buildPythonApplication rec {
 
   nativeBuildInputs = [ meson ninja pkg-config appstream-glib wrapGAppsHook ];
 
+  propagatedNativeBuildInputs = [
+    gobject-introspection
+  ];
+
   propagatedBuildInputs =
     [ gtk3 gobject-introspection libnotify libsecret gnome.adwaita-icon-theme ] ++
     (with gst_all_1; [ gstreamer gst-plugins-base gst-plugins-good gst-plugins-ugly gst-plugins-bad ]) ++

pkgs/applications/audio/tauon/default.nix

@@ -9,9 +9,11 @@
 , librsvg
 , gobject-introspection
 , gtk3
+, kissfft
 , libnotify
 , libsamplerate
 , libvorbis
+, miniaudio
 , mpg123
 , libopenmpt
 , opusfile
@@ -23,15 +25,23 @@
 
 stdenv.mkDerivation rec {
   pname = "tauon";
-  version = "7.3.1";
+  version = "7.4.1";
 
   src = fetchFromGitHub {
     owner = "Taiko2k";
     repo = "TauonMusicBox";
     rev = "v${version}";
-    sha256 = "sha256-g3mRVPOXU3N+MApLaHAAIIsVuVv2GeB1Nj//8tuS0oI=";
+    sha256 = "sha256-cHuEmRQG40p04MXcwmYMm7Jih+mYre9IBnOPMx1/k7k=";
   };
 
+  postUnpack = ''
+    rmdir source/src/phazor/kissfft
+    ln -s ${kissfft.src} source/src/phazor/kissfft
+
+    rmdir source/src/phazor/miniaudio
+    ln -s ${miniaudio.src} source/src/phazor/miniaudio
+  '';
+
   postPatch = ''
     substituteInPlace tauon.py \
       --replace 'install_mode = False' 'install_mode = True' \

pkgs/applications/editors/ghostwriter/default.nix

@@ -14,13 +14,13 @@
 
 mkDerivation rec {
   pname = "ghostwriter";
-  version = "2.1.5";
+  version = "2.2.0";
 
   src = fetchFromGitHub {
-    owner = "wereturtle";
+    owner = "KDE";
     repo = pname;
     rev = version;
-    hash = "sha256-YmZrT/KZUa34A0mMDM423GL99BDLrqrio7gNEW833SI=";
+    hash = "sha256-8JtCO5jrkbZ4uEM7SALg64L4HSzdzzh7r1pldxzaXeI=";
   };
 
   nativeBuildInputs = [ qmake pkg-config qttools ];
@@ -33,8 +33,8 @@ mkDerivation rec {
 
   meta = with lib; {
     description = "A cross-platform, aesthetic, distraction-free Markdown editor";
-    homepage = src.meta.homepage;
-    changelog = "https://github.com/wereturtle/ghostwriter/blob/${src.rev}/CHANGELOG.md";
+    homepage = "https://kde.github.io/ghostwriter";
+    changelog = "https://github.com/KDE/ghostwriter/blob/${src.rev}/CHANGELOG.md";
     license = licenses.gpl3Plus;
     platforms = platforms.unix;
     maintainers = with maintainers; [ dotlambda erictapen ];

pkgs/applications/editors/vim/plugins/markdown-preview-nvim/package.json

@@ -1,18 +1,48 @@
 {
-  "name": "markdown-preview-vim",
-  "version": "0.0.1",
+  "name": "markdown-preview",
+  "version": "0.0.10",
   "description": "markdown preview plugin for (neo)vim",
-  "bin": "./index.js",
-  "repository": "https://github.com/iamcco/markdown-preview.vim.git",
+  "bin": "./app/server.js",
+  "repository": "https://github.com/iamcco/markdown-preview.nvim.git",
   "author": "年糕小豆汤 <ooiss@qq.com>",
   "license": "MIT",
   "private": true,
+  "scripts": {
+    "watch": "tsc -w -p ./",
+    "build-app": "cd app && rm -rf ./.next && next build && next export",
+    "build-lib": "tsc -p ./",
+    "build": "tsc -p ./ && cd app && rm -rf ./.next && next build && next export && yarn && pkg --targets node16-linux-x64,node16-macos-x64,node16-win-x64 --out-path ./bin . && rm -rf ./node_modules ./.next"
+  },
   "dependencies": {
-    "@chemzqm/neovim": "5.7.9",
-    "log4js": "3.0.6",
-    "neovim": "4.2.1",
-    "socket.io": "2.1.1",
-    "tslib": "1.9.3",
-    "vim-node-rpc": "0.1.24"
+    "@chemzqm/neovim": "^5.7.9",
+    "chart.js": "^2.7.3",
+    "highlight.js": "^10.4.1",
+    "log4js": "^6.4.0",
+    "markdown-it": "^12.3.2",
+    "markdown-it-anchor": "^5.2.4",
+    "markdown-it-deflist": "^2.0.3",
+    "markdown-it-emoji": "^1.4.0",
+    "markdown-it-footnote": "^3.0.1",
+    "markdown-it-task-lists": "^2.1.1",
+    "markdown-it-toc-done-right": "^4.0.1",
+    "md-it-meta": "^0.0.2",
+    "msgpack-lite": "^0.1.26",
+    "next": "^7.0.2",
+    "next-routes": "^1.4.2",
+    "plantuml-encoder": "^1.4.0",
+    "react": "^16.5.2",
+    "react-dom": "^16.5.2",
+    "socket.io": "^2.1.1",
+    "socket.io-client": "^2.1.1"
+  },
+  "devDependencies": {
+    "@types/node": "16",
+    "pkg": "^5.6.0",
+    "prettier": "^2.6.2",
+    "tslint": "^6.1.3",
+    "tslint-config-prettier": "^1.18.0",
+    "tslint-plugin-prettier": "^2.3.0",
+    "typescript": "^4.6.4",
+    "yuuko-tsconfig": "^1.0.0"
   }
 }

pkgs/applications/editors/vim/plugins/overrides.nix

@@ -553,8 +553,7 @@ self: super: {
       })
     ];
     postInstall = ''
-      # The node package name is `*-vim` not `*-nvim`.
-      ln -s ${nodeDep}/lib/node_modules/markdown-preview-vim/node_modules $out/app
+      ln -s ${nodeDep}/lib/node_modules/markdown-preview/node_modules $out/app
     '';
 
     nativeBuildInputs = [ nodejs ];

pkgs/applications/editors/vscode/extensions/default.nix

@@ -18,6 +18,7 @@
 , clojure-lsp
 , alejandra
 , millet
+, shfmt
 }:
 
 let
@@ -1088,6 +1089,14 @@ let
           version = "7.1.0";
           sha256 = "09z72mdr5bfdcb67xyzlv7lb9vyjlc3k9ackj4jgixfk40c68cnj";
         };
+
+        nativeBuildInputs = [ jq moreutils ];
+
+        postInstall = ''
+          cd "$out/$installPrefix"
+          jq '.contributes.configuration.properties."shellformat.path".default = "${shfmt}/bin/shfmt"' package.json | sponge package.json
+        '';
+
         meta = with lib; {
           downloadPage = "https://marketplace.visualstudio.com/items?itemName=foxundermoon.shell-format";
           homepage = "https://github.com/foxundermoon/vs-shell-format";

pkgs/applications/editors/vscode/extensions/rust-analyzer/default.nix

@@ -48,7 +48,7 @@ let
     ];
 
     # Follows https://github.com/rust-lang/rust-analyzer/blob/41949748a6123fd6061eb984a47f4fe780525e63/xtask/src/dist.rs#L39-L65
-    postInstall = ''
+    postRebuild = ''
       jq '
         .version = $ENV.version |
         .releaseTag = $ENV.releaseTag |

pkgs/applications/graphics/gnome-decoder/default.nix

@@ -0,0 +1,76 @@
+{ lib
+, clangStdenv
+, fetchFromGitLab
+, libclang
+, rustPlatform
+, meson
+, ninja
+, pkg-config
+, glib
+, gtk4
+, libadwaita
+, zbar
+, sqlite
+, pipewire
+, gstreamer
+, gst-plugins-base
+, gst-plugins-bad
+, wrapGAppsHook4
+, appstream-glib
+, desktop-file-utils
+}:
+
+clangStdenv.mkDerivation rec {
+  pname = "gnome-decoder";
+  version = "0.3.1";
+
+  src = fetchFromGitLab {
+    domain = "gitlab.gnome.org";
+    owner = "World";
+    repo = "decoder";
+    rev = version;
+    hash = "sha256-WJIOaYSesvLmOzF1Q6o6aLr4KJanXVaNa+r+2LlpKHQ=";
+  };
+
+  cargoDeps = rustPlatform.fetchCargoTarball {
+    inherit src;
+    name = "${pname}-${version}";
+    hash = "sha256-RMHVrv/0q42qFUXyd5BSymzx+BxiyqTX0Jzmxnlhyr4=";
+  };
+
+  nativeBuildInputs = [
+    meson
+    ninja
+    pkg-config
+    wrapGAppsHook4
+    appstream-glib
+    desktop-file-utils
+  ] ++ (with rustPlatform; [
+    rust.cargo
+    rust.rustc
+    cargoSetupHook
+  ]);
+
+  buildInputs = [
+    glib
+    gtk4
+    libadwaita
+    zbar
+    sqlite
+    pipewire
+    gstreamer
+    gst-plugins-base
+    gst-plugins-bad
+  ];
+
+  LIBCLANG_PATH = "${libclang.lib}/lib";
+
+  meta = with lib; {
+    description = "Scan and Generate QR Codes";
+    homepage = "https://gitlab.gnome.org/World/decoder";
+    license = licenses.gpl3Plus;
+    platforms = platforms.linux;
+    mainProgram = "decoder";
+    maintainers = with maintainers; [ zendo ];
+  };
+}

pkgs/applications/misc/1password-gui/beta.nix

@@ -2,6 +2,7 @@
 , stdenv
 , fetchurl
 , makeWrapper
+, wrapGAppsHook
 , alsa-lib
 , at-spi2-atk
 , at-spi2-core
@@ -58,11 +59,13 @@ in stdenv.mkDerivation rec {
         sha256 = "sha256-xBfpBkYff1X26Iu0Ee03lIiR6UdJOiaG+kZMVotG0Hc=";
       };
 
-  nativeBuildInputs = [ makeWrapper ];
+  nativeBuildInputs = [ makeWrapper wrapGAppsHook ];
+  buildInputs = [ glib ];
 
   dontConfigure = true;
   dontBuild = true;
   dontPatchELF = true;
+  dontWrapGApps = true;
 
   installPhase =
     let rpath = lib.makeLibraryPath [
@@ -123,17 +126,21 @@ in stdenv.mkDerivation rec {
         patchelf --set-rpath ${rpath}:$out/share/1password $file
       done
 
-      # Electron is trying to open udev via dlopen()
-      # and for some reason that doesn't seem to be impacted from the rpath.
-      # Adding udev to LD_LIBRARY_PATH fixes that.
-      # Make xdg-open overrideable at runtime.
-      makeWrapper $out/share/1password/1password $out/bin/1password \
-        --suffix PATH : ${lib.makeBinPath [ xdg-utils ]} \
-        --prefix LD_LIBRARY_PATH : ${lib.makeLibraryPath [ udev ]}
-
       runHook postInstall
     '';
 
+  preFixup = ''
+    # Electron is trying to open udev via dlopen()
+    # and for some reason that doesn't seem to be impacted from the rpath.
+    # Adding udev to LD_LIBRARY_PATH fixes that.
+    # Make xdg-open overrideable at runtime.
+    makeWrapper $out/share/1password/1password $out/bin/1password \
+      ''${gappsWrapperArgs[@]} \
+      --suffix PATH : ${lib.makeBinPath [ xdg-utils ]} \
+      --prefix LD_LIBRARY_PATH : ${lib.makeLibraryPath [ udev ]}
+  '';
+
+
   meta = with lib; {
     description = "Multi-platform password manager";
     homepage = "https://1password.com/";

pkgs/applications/misc/1password-gui/default.nix

@@ -2,6 +2,7 @@
 , stdenv
 , fetchurl
 , makeWrapper
+, wrapGAppsHook
 , alsa-lib
 , at-spi2-atk
 , at-spi2-core
@@ -58,11 +59,13 @@ in stdenv.mkDerivation rec {
         sha256 = "sha256-Smq0gOGfBTjIOMwF1AI+TJwXaIiTi/YP9mGIqcjsCNQ=";
       };
 
-  nativeBuildInputs = [ makeWrapper ];
+  nativeBuildInputs = [ makeWrapper wrapGAppsHook ];
+  buildInputs = [ glib ];
 
   dontConfigure = true;
   dontBuild = true;
   dontPatchELF = true;
+  dontWrapGApps = true;
 
   installPhase =
     let rpath = lib.makeLibraryPath [
@@ -123,17 +126,20 @@ in stdenv.mkDerivation rec {
         patchelf --set-rpath ${rpath}:$out/share/1password $file
       done
 
-      # Electron is trying to open udev via dlopen()
-      # and for some reason that doesn't seem to be impacted from the rpath.
-      # Adding udev to LD_LIBRARY_PATH fixes that.
-      # Make xdg-open overrideable at runtime.
-      makeWrapper $out/share/1password/1password $out/bin/1password \
-        --suffix PATH : ${lib.makeBinPath [ xdg-utils ]} \
-        --prefix LD_LIBRARY_PATH : ${lib.makeLibraryPath [ udev ]}
-
       runHook postInstall
     '';
 
+  preFixup = ''
+    # Electron is trying to open udev via dlopen()
+    # and for some reason that doesn't seem to be impacted from the rpath.
+    # Adding udev to LD_LIBRARY_PATH fixes that.
+    # Make xdg-open overrideable at runtime.
+    makeWrapper $out/share/1password/1password $out/bin/1password \
+      ''${gappsWrapperArgs[@]} \
+      --suffix PATH : ${lib.makeBinPath [ xdg-utils ]} \
+      --prefix LD_LIBRARY_PATH : ${lib.makeLibraryPath [ udev ]}
+  '';
+
   meta = with lib; {
     description = "Multi-platform password manager";
     homepage = "https://1password.com/";

pkgs/applications/misc/conduktor/default.nix

@@ -0,0 +1,52 @@
+{ stdenv, lib, fetchurl, fetchzip, jdk11, unzip, makeWrapper, makeDesktopItem, copyDesktopItems }:
+
+stdenv.mkDerivation rec {
+  pname = "conduktor";
+  version = "2.15.1";
+
+  src = fetchzip {
+    url = "https://github.com/conduktor/builds/releases/download/v${version}/Conduktor-linux-${version}.zip";
+    sha256 = "1kr5yh9piqbl6njsnxgh6jzf3vifw8ja5x4qm4znmzi3r49sw0gx";
+  };
+
+  nativeBuildInputs = [ makeWrapper copyDesktopItems ];
+
+  desktopItems = makeDesktopItem {
+    type = "Application";
+    name = pname;
+    desktopName = "Conduktor";
+    genericName = meta.description;
+    exec = pname;
+    icon = fetchurl {
+      url = "https://github.com/conduktor/builds/raw/v${version}/.github/resources/Conduktor.png";
+      sha256 = "0s7p74qclvac8xj2m22gfxx5m2c7cf0nqpk5sb049p2wvryhn2j4";
+    };
+    comment = "A beautiful and fully-featured desktop client for Apache Kafka";
+  };
+
+  dontConfigure = true;
+  dontBuild = true;
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p $out/share/applications
+    mv * $out
+    wrapProgram "$out/bin/conduktor" --set JAVA_HOME "${jdk11.home}"
+
+    runHook postInstall
+  '';
+
+  meta = with lib; {
+    description = "Apache Kafka Desktop Client";
+    longDescription = ''
+      Conduktor is a GUI over the Kafka ecosystem, to make the development
+      and management of Apache Kafka clusters as easy as possible.
+    '';
+    homepage = "https://www.conduktor.io/";
+    changelog = "https://www.conduktor.io/changelog/#${version}";
+    license = licenses.unfree;
+    maintainers = with maintainers; [ trobert ];
+    platforms = platforms.linux;
+  };
+}

pkgs/applications/misc/electrum/default.nix

@@ -20,7 +20,7 @@
 }:
 
 let
-  version = "4.3.1";
+  version = "4.3.2";
 
   libsecp256k1_name =
     if stdenv.isLinux then "libsecp256k1.so.0"
@@ -37,7 +37,7 @@ let
     owner = "spesmilo";
     repo = "electrum";
     rev = version;
-    sha256 = "wYblwD+ej65TVkYS7u5MiB37Ka8jENI3aoHi64xAFtU=";
+    sha256 = "sha256-z2/UamKmBq/5a0PTbHdAqGK617Lc8xRhHRpbCc7jeZo=";
 
     postFetch = ''
       mv $out ./all
@@ -53,7 +53,7 @@ python3.pkgs.buildPythonApplication {
 
   src = fetchurl {
     url = "https://download.electrum.org/${version}/Electrum-${version}.tar.gz";
-    sha256 = "pAhsHKIMCB3OutJTrgGNT9PKfTcXcgxUj/x16uBK2Is=";
+    sha256 = "sha256-vTZArTwbKcf6/vPQOvjubPecsg+h+QlZ6rdbl6qNfs0=";
   };
 
   postUnpack = ''

pkgs/applications/misc/octoprint/default.nix

@@ -74,13 +74,13 @@ let
           self: super: {
             octoprint = self.buildPythonPackage rec {
               pname = "OctoPrint";
-              version = "1.8.3";
+              version = "1.8.4";
 
               src = fetchFromGitHub {
                 owner = "OctoPrint";
                 repo = "OctoPrint";
                 rev = version;
-                hash = "sha256-uLQUVYxy7diOJl69sQ+7eshK0fsG34Fto+Zzih1MeVE=";
+                hash = "sha256-oYP+K7WBkYP7gajXZdbZso17u+GeyrIgEbhNjwRXbAo=";
               };
 
               propagatedBuildInputs = with super; [

pkgs/applications/networking/browsers/chromium/upstream-info.json

@@ -1,21 +1,21 @@
 {
   "stable": {
-    "version": "105.0.5195.125",
-    "sha256": "0rhay46fnfffqcpk6c856hj414508fmhda600lz5whcacr25q6r0",
-    "sha256bin64": "14knj758nzihs4yh6gb6w0l4i985cnrd0y5hdmz3yd49n9a7s5hv",
+    "version": "106.0.5249.61",
+    "sha256": "15qljfg8w124yp65srp1rz3ywrlqhzqzkhimn1h9xz0jkf9cnypj",
+    "sha256bin64": "0l0vxlv8gmd655z2889549iafnyd4gyknqfal5iaqdhvig3sdp07",
     "deps": {
       "gn": {
-        "version": "2022-07-11",
+        "version": "2022-08-11",
         "url": "https://gn.googlesource.com/gn",
-        "rev": "9ef321772ecc161937db69acb346397e0ccc484d",
-        "sha256": "0j85kgf8c1psys6kfsq5mph8n80hcbzhr7d2blqiiysmjj0wc6ng"
+        "rev": "0bcd37bd2b83f1a9ee17088037ebdfe6eab6d31a",
+        "sha256": "13zks2z65kg7fzzsysq4mswd4bhhy3h7ycdrpxfilcvixx2n2gac"
       }
     },
     "chromedriver": {
-      "version": "105.0.5195.52",
-      "sha256_linux": "063k766d95ssngg0rlx3c8w9157miga2k9kwig2fbdn7qs5ch764",
-      "sha256_darwin": "0rs8g25p0v3krbj00jwh5fy2nw5anrr2dzxaxaj1c8ph6qn9iqn0",
-      "sha256_darwin_aarch64": "14v5r4s2c76md09wgpd3mhfhnw5y57dqkq1iqajgahgqmvvim1by"
+      "version": "106.0.5249.21",
+      "sha256_linux": "0z4m5145s00dycb7f7nscwghzwqym4if6k95w0q6d1hjyih8jh32",
+      "sha256_darwin": "1jnwaim2p579p1xlh9y2w11rp5agmp2144ipjs1fg9p97hrdi3yf",
+      "sha256_darwin_aarch64": "13wl55n54ld6nrmy1vallrqkzz031kzmw4sjwczra6k7ryd4z09w"
     }
   },
   "beta": {
@@ -45,19 +45,19 @@
     }
   },
   "ungoogled-chromium": {
-    "version": "105.0.5195.127",
-    "sha256": "1q15i5vcb7q20awib7csh2v7mzjnppb4pqgqzgqiixs9wj710j3m",
+    "version": "106.0.5249.62",
+    "sha256": "1nm6hxr0gk5263v2ypmyc72dj1xb5r3r335vjvhvcqscgpikvnhq",
     "sha256bin64": null,
     "deps": {
       "gn": {
-        "version": "2022-07-11",
+        "version": "2022-08-11",
         "url": "https://gn.googlesource.com/gn",
-        "rev": "9ef321772ecc161937db69acb346397e0ccc484d",
-        "sha256": "0j85kgf8c1psys6kfsq5mph8n80hcbzhr7d2blqiiysmjj0wc6ng"
+        "rev": "0bcd37bd2b83f1a9ee17088037ebdfe6eab6d31a",
+        "sha256": "13zks2z65kg7fzzsysq4mswd4bhhy3h7ycdrpxfilcvixx2n2gac"
       },
       "ungoogled-patches": {
-        "rev": "105.0.5195.127-1",
-        "sha256": "0iinags8lvfiw0l55fc3ldq92qw6p01a62zs8q2av0srzpx0xd0b"
+        "rev": "106.0.5249.62-1",
+        "sha256": "0lm7brj3sx8rkq2nzz9w0by5mk9qp0ax1wsp68b2wcwcx6nrzjw4"
       }
     }
   }

pkgs/applications/networking/cluster/terraform/default.nix

@@ -168,9 +168,9 @@ rec {
   mkTerraform = attrs: pluggable (generic attrs);
 
   terraform_1 = mkTerraform {
-    version = "1.3.0";
-    sha256 = "1bl2d1wzarhglfc2vxg4m080d6z5mm35h3i4vg7n93wj9x3wkkq8";
-    vendorSha256 = "1kjbrwn6k0fycal8g189pda1w3qyjzfk2qjvm1fyj60dr155gncw";
+    version = "1.3.1";
+    sha256 = "sha256-ugdMpp/YTCyXaUY6NTrIa9r/+C4bYLYqQEic4cvgoVo=";
+    vendorSha256 = "sha256-+m7e49yN7OkiQQVvqimF0Tvz5wUr2M5bxs3yBU2lt7Y=";
     patches = [ ./provider-path-0_15.patch ];
     passthru = {
       inherit plugins;

pkgs/applications/networking/instant-messengers/cinny/default.nix

@@ -4,11 +4,11 @@ let
   configOverrides = writeText "cinny-config-overrides.json" (builtins.toJSON conf);
 in stdenv.mkDerivation rec {
   pname = "cinny";
-  version = "2.2.0";
+  version = "2.2.2";
 
   src = fetchurl {
     url = "https://github.com/ajbura/cinny/releases/download/v${version}/cinny-v${version}.tar.gz";
-    sha256 = "sha256-wwMNb3WBW/I72MXfeYdUZzE/z9YgPFdRbq/F0AdKf9Q=";
+    sha256 = "sha256-MNmU6MvDwGbFNQt7qe08klXjy1n2LiABlPkARGvjVJU=";
   };
 
   installPhase = ''

pkgs/applications/networking/instant-messengers/deltachat-desktop/default.nix

@@ -73,16 +73,13 @@ in nodePackages.deltachat-desktop.override rec {
   USE_SYSTEM_LIBDELTACHAT = "true";
   VERSION_INFO_GIT_REF = src.rev;
 
-  preRebuild = ''
-    substituteInPlace package.json \
-      --replace "node ./bin/check-nodejs-version.js" true
-  '';
-
-  postInstall = ''
+  postRebuild = ''
     rm -r node_modules/deltachat-node/node/prebuilds
 
     npm run build4production
+  '';
 
+  postInstall = ''
     npm prune --production
 
     install -D $out/lib/node_modules/deltachat-desktop/build/icon.png \

pkgs/applications/networking/instant-messengers/element/pin.json

@@ -1,7 +1,7 @@
 {
-  "version": "1.11.5",
-  "desktopSrcHash": "JbkB+J2KgHcT8rYv8ovC1r325U5NIHo8Wkh0BogLB+w=",
-  "desktopYarnHash": "1bfpd4a0xrlhm7zq2xz5f184mfp6w4glgyfm4r0y3bi06i4my8vc",
-  "webSrcHash": "XOFgJGnQ85bvkqnwke5Hww658bpBXkUspk46cqvf5AY=",
-  "webYarnHash": "0ab49y2xj8cy4ibcckvd6xhhvkv3fa8kwwlmhxvas2racx51wfnh"
+  "version": "1.11.8",
+  "desktopSrcHash": "l6IwztPEPSo3WgdUBPO4ZNgfoLts8NaqvoHekAhfVGg=",
+  "desktopYarnHash": "105xj2xwc9g8cfiby0x93gy8w8w5c76mzzxck5mgvawcc6qpvmrc",
+  "webSrcHash": "Etxlq2TEaZM9Qz4ig5H00DsshJoFH6+wtt+RL1dR2n4=",
+  "webYarnHash": "1q05r2shv1c3kghwksjzrh9rl25ins6r2y46ng7smdml4f9vdcc0"
 }

pkgs/applications/networking/instant-messengers/nheko/default.nix

@@ -33,13 +33,13 @@
 
 mkDerivation rec {
   pname = "nheko";
-  version = "0.10.1-1";
+  version = "0.10.2";
 
   src = fetchFromGitHub {
     owner = "Nheko-Reborn";
     repo = "nheko";
     rev = "v${version}";
-    sha256 = "sha256-Bpf38BAGfvmVyrAptIsQ9HaRUopqvytko6unlWLooUo=";
+    sha256 = "sha256-gid8XOZ1/hMDGNbse4GYfcAdqHiySWyy4isBgcpekIQ=";
   };
 
   nativeBuildInputs = [

pkgs/applications/networking/instant-messengers/signal-desktop/default.nix

@@ -9,7 +9,7 @@
 
 stdenv.mkDerivation rec {
   pname = "signal-desktop";
-  version = "5.60.0"; # Please backport all updates to the stable channel.
+  version = "5.61.0"; # Please backport all updates to the stable channel.
   # All releases have a limited lifetime and "expire" 90 days after the release.
   # When releases "expire" the application becomes unusable until an update is
   # applied. The expiration date for the current release can be extracted with:
@@ -19,7 +19,7 @@ stdenv.mkDerivation rec {
 
   src = fetchurl {
     url = "https://updates.signal.org/desktop/apt/pool/main/s/signal-desktop/signal-desktop_${version}_amd64.deb";
-    sha256 = "sha256-fKbBrAohb/X7pehWfP3FVwfq0Grand2HlfOa6RE2Z6w=";
+    sha256 = "sha256-1EPOuvul/Dh/gFwgCy7Wme6GYIP1Mi3TofTrIF3kU3g=";
   };
 
   nativeBuildInputs = [

pkgs/applications/networking/ipfs-cluster/default.nix

@@ -2,15 +2,15 @@
 
 buildGoModule rec {
   pname = "ipfs-cluster";
-  version = "1.0.2";
+  version = "1.0.4";
 
-  vendorSha256 = "sha256-4pCJnQ/X5bvlgyHcRVZ8LyOexaKmz+1xAntMpZCpvd0=";
+  vendorSha256 = "sha256-krjTtH8C1SGhaKMCtsbA2S9ognImof6mwD+vJ/qbyrM=";
 
   src = fetchFromGitHub {
     owner = "ipfs-cluster";
     repo = "ipfs-cluster";
     rev = "v${version}";
-    sha256 = "sha256-Mbq4NzMNIGGFOWuHlToGmel/Oa/K6xzpZTVuXnKHq1M=";
+    sha256 = "sha256-LdcCGUbrS6te03y8R7XJJOcG1j6uU0v8uEMeUHLeidg=";
   };
 
   meta = with lib; {

pkgs/applications/office/jabref/default.nix

@@ -13,25 +13,27 @@
 }:
 
 stdenv.mkDerivation rec {
-  version = "5.6";
+  version = "5.7";
   pname = "jabref";
 
   src = fetchFromGitHub {
     owner = "JabRef";
     repo = "jabref";
     rev = "v${version}";
-    hash = "sha256-w3F1td7KmdSor/2vKar3w17bChe1yH7JMobOaCjZqd4=";
+    hash = "sha256-wzBaAaxGsMPh64uW+bBOiycYfVCW9H5FCn06r6XdxeE=";
   };
 
   desktopItems = [
     (makeDesktopItem {
       comment = meta.description;
-      name = "jabref";
+      name = "JabRef %U";
       desktopName = "JabRef";
       genericName = "Bibliography manager";
       categories = [ "Office" ];
       icon = "jabref";
-      exec = "jabref";
+      exec = "JabRef";
+      startupWMClass = "org.jabref.gui.JabRefMain";
+      mimeTypes = [ "text/x-bibtex" ];
     })
   ];
 
@@ -39,12 +41,6 @@ stdenv.mkDerivation rec {
     pname = "${pname}-deps";
     inherit src version;
 
-    postPatch = ''
-        sed -i -e '/testImplementation/d' -e '/testRuntimeOnly/d' build.gradle
-        echo 'dependencyLocking { lockAllConfigurations() }' >> build.gradle
-        cp ${./gradle.lockfile} ./
-      '';
-
     nativeBuildInputs = [ gradle perl ];
     buildPhase = ''
       export GRADLE_USER_HOME=$(mktemp -d)
@@ -60,8 +56,8 @@ stdenv.mkDerivation rec {
     forceShare = [ "dummy" ];
     outputHashMode = "recursive";
     outputHash = {
-      x86_64-linux = "sha256-ySGXZM9LCJUjGCrKMc+5I6duEbmSsp3tU3t/o5nM+5M=";
-      aarch64-linux = "sha256-mfWyGGBqjRQ8q9ddR57O2rwtby2T1H6Ra2m0JGVZ1Zs=";
+      x86_64-linux = "sha256-OicHJVFxHGPE76bEDoLhkEhVcAJmplqjoh2I3nnVaLA=";
+      aarch64-linux = "sha256-8QWmweptL/+pSO6DhfBLaLcBrfKd4TDsDoXs4TgXvew=";
     }.${stdenv.hostPlatform.system} or (throw "Unsupported system ${stdenv.hostPlatform.system}");
   };
 
@@ -95,11 +91,14 @@ stdenv.mkDerivation rec {
       --no-daemon \
       -PprojVersion="${version}" \
       -PprojVersionInfo="${version} NixOS" \
+      -Dorg.gradle.java.home=${jdk} \
       assemble
 
     runHook postBuild
   '';
 
+  dontWrapGApps = true;
+
   installPhase = ''
     runHook preInstall
 
@@ -109,8 +108,6 @@ stdenv.mkDerivation rec {
 
     # script to support browser extensions
     install -Dm755 buildres/linux/jabrefHost.py $out/lib/jabrefHost.py
-    # This can be removed in the next version
-    sed -i -e "/importBibtex/s/{}/'{}'/" $out/lib/jabrefHost.py
     install -Dm644 buildres/linux/native-messaging-host/firefox/org.jabref.jabref.json $out/lib/mozilla/native-messaging-hosts/org.jabref.jabref.json
     sed -i -e "s|/opt/jabref|$out|" $out/lib/mozilla/native-messaging-hosts/org.jabref.jabref.json
 
@@ -119,31 +116,30 @@ stdenv.mkDerivation rec {
 
     # workaround for https://github.com/NixOS/nixpkgs/issues/162064
     tar xf build/distributions/JabRef-${version}.tar -C $out --strip-components=1
-    unzip $out/lib/javafx-web-18-linux${lib.optionalString stdenv.isAarch64 "-aarch64"}.jar libjfxwebkit.so -d $out/lib/
+    unzip $out/lib/javafx-web-*-linux${lib.optionalString stdenv.isAarch64 "-aarch64"}.jar libjfxwebkit.so -d $out/lib/
+
+    DEFAULT_JVM_OPTS=$(sed -n -E "s/^DEFAULT_JVM_OPTS='(.*)'$/\1/p" $out/bin/JabRef | sed -e "s|\$APP_HOME|$out|g" -e 's/"//g')
+    rm $out/bin/*
+
+    makeWrapper ${jdk}/bin/java $out/bin/JabRef \
+      "''${gappsWrapperArgs[@]}" \
+      --suffix PATH : ${lib.makeBinPath [ xdg-utils ]} \
+      --add-flags "-Djava.library.path=$out/lib/ --patch-module org.jabref=$out/share/java/jabref/resources/main" \
+      --add-flags "$DEFAULT_JVM_OPTS"
 
     # lowercase alias (for convenience and required for browser extensions)
     ln -sf $out/bin/JabRef $out/bin/jabref
 
-    rm $out/bin/JabRef.bat
-
     runHook postInstall
   '';
 
-  preFixup = ''
-    gappsWrapperArgs+=(
-      --suffix PATH : ${lib.makeBinPath [ xdg-utils ]}
-      --set JAVA_HOME "${jdk}"
-      --set JAVA_OPTS "-Djava.library.path=$out/lib/ --patch-module org.jabref=$out/share/java/jabref/resources/main"
-    )
-  '';
-
   meta = with lib; {
     description = "Open source bibliography reference manager";
     homepage = "https://www.jabref.org";
     sourceProvenance = with sourceTypes; [
       fromSource
-      binaryBytecode  # source bundles dependencies as jars
-      binaryNativeCode  # source bundles dependencies as jars
+      binaryBytecode # source bundles dependencies as jars
+      binaryNativeCode # source bundles dependencies as jars
     ];
     license = licenses.gpl2;
     platforms = [ "x86_64-linux" "aarch64-linux" ];

pkgs/applications/office/jabref/gradle.lockfile

@@ -1,180 +0,0 @@
-# This is a Gradle generated file for dependency locking.
-# Manual edits can break the build and are not advised.
-# This file is expected to be part of source control.
-classworlds:classworlds:1.1-alpha-2=modernizer
-com.fasterxml.jackson.core:jackson-annotations:2.13.2=compile,compileClasspath,jmhCompileClasspath,jmhRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.fasterxml.jackson.core:jackson-core:2.13.2=compile,compileClasspath,jmhCompileClasspath,jmhRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.fasterxml.jackson.core:jackson-databind:2.13.2=compile,compileClasspath,jmhCompileClasspath,jmhRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.fasterxml.jackson.dataformat:jackson-dataformat-yaml:2.13.2=compile,compileClasspath,jmhCompileClasspath,jmhRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.fasterxml.jackson.datatype:jackson-datatype-jsr310:2.13.2=compile,compileClasspath,jmhCompileClasspath,jmhRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.fasterxml.jackson:jackson-bom:2.13.2=compile,compileClasspath,jmhCompileClasspath,jmhRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.github.tomtung:latex2unicode_2.12:0.2.6=compile,compileClasspath,jmhCompileClasspath,jmhRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.code.findbugs:jsr305:3.0.2=checkstyle
-com.google.code.gson:gson:2.9.0=compile,compileClasspath,jmhCompileClasspath,jmhRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.errorprone:error_prone_annotations:2.11.0=checkstyle,compile,compileClasspath,jmhCompileClasspath,jmhRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.guava:failureaccess:1.0.1=checkstyle,compile,compileClasspath,jmhCompileClasspath,jmhRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.guava:guava:31.1-jre=checkstyle,compile,compileClasspath,jmhCompileClasspath,jmhRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava=checkstyle,compile,compileClasspath,jmhCompileClasspath,jmhRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.google.j2objc:j2objc-annotations:1.3=checkstyle,compile,compileClasspath,jmhCompileClasspath,jmhRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.googlecode.javaewah:JavaEWAH:1.1.13=compile,compileClasspath,jmhCompileClasspath,jmhRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.h2database:h2-mvstore:2.1.212=compile,compileClasspath,jmhCompileClasspath,jmhRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.ibm.icu:icu4j-charset:70.1=compile,compileClasspath,jmhCompileClasspath,jmhRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.ibm.icu:icu4j:69.1=antlr4
-com.ibm.icu:icu4j:70.1=compile,compileClasspath,jmhCompileClasspath,jmhRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.jfoenix:jfoenix:9.0.10=compile,compileClasspath,jmhCompileClasspath,jmhRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.konghq:unirest-java:3.13.8=compile,compileClasspath,jmhCompileClasspath,jmhRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.microsoft.azure:applicationinsights-core:2.4.1=compile,compileClasspath,jmhCompileClasspath,jmhRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.microsoft.azure:applicationinsights-logging-log4j2:2.4.1=compile,compileClasspath,jmhCompileClasspath,jmhRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.oracle.ojdbc:ojdbc10:19.3.0.0=compile,compileClasspath,jmhCompileClasspath,jmhRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.oracle.ojdbc:ons:19.3.0.0=compile,compileClasspath,jmhCompileClasspath,jmhRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.oracle.ojdbc:osdt_cert:19.3.0.0=compile,compileClasspath,jmhCompileClasspath,jmhRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.oracle.ojdbc:osdt_core:19.3.0.0=compile,compileClasspath,jmhCompileClasspath,jmhRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.oracle.ojdbc:simplefan:19.3.0.0=compile,compileClasspath,jmhCompileClasspath,jmhRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.oracle.ojdbc:ucp:19.3.0.0=compile,compileClasspath,jmhCompileClasspath,jmhRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.puppycrawl.tools:checkstyle:10.1=checkstyle
-com.sun.activation:jakarta.activation:2.0.1=compile,compileClasspath,jmhCompileClasspath,jmhRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath,xjc
-com.sun.istack:istack-commons-runtime:4.0.1=compile,compileClasspath,jmhCompileClasspath,jmhRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath,xjc
-com.sun.istack:istack-commons-tools:4.0.1=xjc
-com.sun.xml.bind.external:relaxng-datatype:3.0.2=xjc
-com.sun.xml.bind.external:rngom:3.0.2=xjc
-com.sun.xml.dtd-parser:dtd-parser:1.4.5=xjc
-com.tobiasdiez:easybind:2.2=compile,compileClasspath,jmhCompileClasspath,jmhRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.vladsch.flexmark:flexmark-ext-gfm-strikethrough:0.64.0=compile,compileClasspath,jmhCompileClasspath,jmhRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.vladsch.flexmark:flexmark-ext-gfm-tasklist:0.64.0=compile,compileClasspath,jmhCompileClasspath,jmhRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.vladsch.flexmark:flexmark-util-ast:0.64.0=compile,compileClasspath,jmhCompileClasspath,jmhRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.vladsch.flexmark:flexmark-util-builder:0.64.0=compile,compileClasspath,jmhCompileClasspath,jmhRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.vladsch.flexmark:flexmark-util-collection:0.64.0=compile,compileClasspath,jmhCompileClasspath,jmhRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.vladsch.flexmark:flexmark-util-data:0.64.0=compile,compileClasspath,jmhCompileClasspath,jmhRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.vladsch.flexmark:flexmark-util-dependency:0.64.0=compile,compileClasspath,jmhCompileClasspath,jmhRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.vladsch.flexmark:flexmark-util-format:0.64.0=compile,compileClasspath,jmhCompileClasspath,jmhRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.vladsch.flexmark:flexmark-util-html:0.64.0=compile,compileClasspath,jmhCompileClasspath,jmhRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.vladsch.flexmark:flexmark-util-misc:0.64.0=compile,compileClasspath,jmhCompileClasspath,jmhRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.vladsch.flexmark:flexmark-util-options:0.64.0=compile,compileClasspath,jmhCompileClasspath,jmhRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.vladsch.flexmark:flexmark-util-sequence:0.64.0=compile,compileClasspath,jmhCompileClasspath,jmhRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.vladsch.flexmark:flexmark-util-visitor:0.64.0=compile,compileClasspath,jmhCompileClasspath,jmhRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.vladsch.flexmark:flexmark-util:0.64.0=compile,compileClasspath,jmhCompileClasspath,jmhRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-com.vladsch.flexmark:flexmark:0.64.0=compile,compileClasspath,jmhCompileClasspath,jmhRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-commons-beanutils:commons-beanutils:1.9.4=checkstyle
-commons-cli:commons-cli:1.5.0=compile,compileClasspath,jmhCompileClasspath,jmhRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-commons-codec:commons-codec:1.11=compile,compileClasspath,jmhCompileClasspath,jmhRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-commons-collections:commons-collections:3.2.2=checkstyle
-commons-io:commons-io:2.11.0=compile,compileClasspath,jmhCompileClasspath,jmhRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-commons-logging:commons-logging:1.2=compile,compileClasspath,jmhCompileClasspath,jmhRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-de.saxsys:mvvmfx-validation:1.9.0-SNAPSHOT=compile,compileClasspath,jmhCompileClasspath,jmhRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-de.saxsys:mvvmfx:1.8.0=compile,compileClasspath,jmhCompileClasspath,jmhRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-de.undercouch:citeproc-java:3.0.0-alpha.6=compile,compileClasspath,jmhCompileClasspath,jmhRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-eu.lestard:doc-annotations:0.2=compile,compileClasspath,jmhCompileClasspath,jmhRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-info.debatty:java-string-similarity:2.0.0=compile,compileClasspath,jmhCompileClasspath,jmhRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-info.picocli:picocli:4.6.3=checkstyle
-io.github.java-diff-utils:java-diff-utils:4.11=compile,compileClasspath,jmhCompileClasspath,jmhRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-jakarta.annotation:jakarta.annotation-api:1.3.5=compile,compileClasspath,jmhCompileClasspath,jmhRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-jakarta.xml.bind:jakarta.xml.bind-api:3.0.1=compile,compileClasspath,jmhCompileClasspath,jmhRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath,xjc
-junit:junit:3.8.1=modernizer
-net.harawata:appdirs:1.2.1=compile,compileClasspath,jmhCompileClasspath,jmhRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-net.java.dev.jna:jna-platform:5.6.0=compile,compileClasspath,jmhCompileClasspath,jmhRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-net.java.dev.jna:jna:5.6.0=compile,compileClasspath,jmhCompileClasspath,jmhRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-net.jcip:jcip-annotations:1.0=compile,compileClasspath,jmhCompileClasspath,jmhRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-net.jodah:typetools:0.6.1=compile,compileClasspath,jmhCompileClasspath,jmhRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-net.sf.jopt-simple:jopt-simple:4.6=jmh,jmhCompileClasspath,jmhRuntimeClasspath
-net.sf.saxon:Saxon-HE:10.6=checkstyle
-org.abego.treelayout:org.abego.treelayout.core:1.0.3=antlr4
-org.antlr:ST4:4.3.1=antlr3,antlr4
-org.antlr:antlr-runtime:3.5.2=antlr4,compile,compileClasspath,jmhCompileClasspath,jmhRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-org.antlr:antlr-runtime:3.5.3=antlr3
-org.antlr:antlr4-runtime:4.9.3=antlr4,checkstyle,compile,compileClasspath,jmhCompileClasspath,jmhRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-org.antlr:antlr4:4.9.3=antlr4
-org.antlr:antlr:3.5.3=antlr3
-org.apache.commons:commons-csv:1.9.0=compile,compileClasspath,jmhCompileClasspath,jmhRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-org.apache.commons:commons-lang3:3.12.0=compile,compileClasspath,jmhCompileClasspath,jmhRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-org.apache.commons:commons-math3:3.2=jmh,jmhCompileClasspath,jmhRuntimeClasspath
-org.apache.commons:commons-text:1.9=compile,jmhRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
-org.apache.httpcomponents:httpasyncclient:4.1.5=compile,compileClasspath,jmhCompileClasspath,jmhRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-org.apache.httpcomponents:httpclient:4.5.13=compile,compileClasspath,jmhCompileClasspath,jmhRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-org.apache.httpcomponents:httpcore-nio:4.4.13=compile,compileClasspath,jmhCompileClasspath,jmhRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-org.apache.httpcomponents:httpcore:4.4.13=compile,compileClasspath,jmhCompileClasspath,jmhRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-org.apache.httpcomponents:httpmime:4.5.13=compile,compileClasspath,jmhCompileClasspath,jmhRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-org.apache.lucene:lucene-analysis-common:9.1.0=compile,compileClasspath,jmhCompileClasspath,jmhRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-org.apache.lucene:lucene-core:9.1.0=compile,compileClasspath,jmhCompileClasspath,jmhRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-org.apache.lucene:lucene-highlighter:9.1.0=compile,compileClasspath,jmhCompileClasspath,jmhRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-org.apache.lucene:lucene-memory:9.1.0=compile,jmhRuntimeClasspath,runtimeClasspath,testRuntimeClasspath
-org.apache.lucene:lucene-queries:9.1.0=compile,compileClasspath,jmhCompileClasspath,jmhRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-org.apache.lucene:lucene-queryparser:9.1.0=compile,compileClasspath,jmhCompileClasspath,jmhRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-org.apache.lucene:lucene-sandbox:9.1.0=compile,compileClasspath,jmhCompileClasspath,jmhRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-org.apache.maven.wagon:wagon-provider-api:1.0-beta-2=modernizer
-org.apache.maven:maven-artifact-manager:2.0.9=modernizer
-org.apache.maven:maven-artifact:2.0.9=modernizer
-org.apache.maven:maven-model:2.0.9=modernizer
-org.apache.maven:maven-plugin-api:2.0=modernizer
-org.apache.maven:maven-plugin-registry:2.0.9=modernizer
-org.apache.maven:maven-profile:2.0.9=modernizer
-org.apache.maven:maven-project:2.0.9=modernizer
-org.apache.maven:maven-repository-metadata:2.0.9=modernizer
-org.apache.maven:maven-settings:2.0.9=modernizer
-org.apache.pdfbox:fontbox:3.0.0-RC1=compile,compileClasspath,jmhCompileClasspath,jmhRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-org.apache.pdfbox:pdfbox:3.0.0-RC1=compile,compileClasspath,jmhCompileClasspath,jmhRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-org.apache.pdfbox:xmpbox:3.0.0-RC1=compile,compileClasspath,jmhCompileClasspath,jmhRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-org.apache.tika:tika-core:2.3.0=compile,compileClasspath,jmhCompileClasspath,jmhRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-org.bouncycastle:bcprov-jdk15on:1.70=compile,compileClasspath,jmhCompileClasspath,jmhRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-org.checkerframework:checker-qual:3.12.0=checkstyle,compile,compileClasspath,jmhCompileClasspath,jmhRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-org.codehaus.mojo:animal-sniffer-annotations:1.18=compile,compileClasspath,jmhCompileClasspath,jmhRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-org.codehaus.plexus:plexus-container-default:1.0-alpha-9-stable-1=modernizer
-org.controlsfx:controlsfx:11.1.1=compile,compileClasspath,jmhCompileClasspath,jmhRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-org.eclipse.jgit:org.eclipse.jgit:6.1.0.202203080745-r=compile,compileClasspath,jmhCompileClasspath,jmhRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-org.fxmisc.flowless:flowless:0.6.9=compile,compileClasspath,jmhCompileClasspath,jmhRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-org.fxmisc.richtext:richtextfx:0.10.9=compile,compileClasspath,jmhCompileClasspath,jmhRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-org.fxmisc.undo:undofx:2.1.1=compile,compileClasspath,jmhCompileClasspath,jmhRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-org.fxmisc.wellbehaved:wellbehavedfx:0.3.3=compile,compileClasspath,jmhCompileClasspath,jmhRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-org.gaul:modernizer-maven-annotations:2.3.0=modernizer
-org.gaul:modernizer-maven-plugin:2.3.0=modernizer
-org.glassfish.hk2.external:jakarta.inject:2.6.1=compile,compileClasspath,jmhCompileClasspath,jmhRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-org.glassfish.jaxb:codemodel:3.0.2=xjc
-org.glassfish.jaxb:jaxb-core:3.0.2=compile,compileClasspath,jmhCompileClasspath,jmhRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath,xjc
-org.glassfish.jaxb:jaxb-runtime:3.0.2=compile,compileClasspath,jmhCompileClasspath,jmhRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath,xjc
-org.glassfish.jaxb:jaxb-xjc:3.0.2=xjc
-org.glassfish.jaxb:txw2:3.0.2=compile,compileClasspath,jmhCompileClasspath,jmhRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath,xjc
-org.glassfish.jaxb:xsom:3.0.2=xjc
-org.glassfish:javax.json:1.0.4=antlr4
-org.jacoco:org.jacoco.agent:0.8.7=jacocoAgent,jacocoAnt
-org.jacoco:org.jacoco.ant:0.8.7=jacocoAnt
-org.jacoco:org.jacoco.core:0.8.7=jacocoAnt
-org.jacoco:org.jacoco.report:0.8.7=jacocoAnt
-org.javassist:javassist:3.28.0-GA=checkstyle
-org.jbibtex:jbibtex:1.0.19=compile,compileClasspath,jmhCompileClasspath,jmhRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-org.jetbrains:annotations:15.0=compile,compileClasspath,jmhCompileClasspath,jmhRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-org.jsoup:jsoup:1.14.3=compile,compileClasspath,jmhCompileClasspath,jmhRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-org.kordamp.ikonli:ikonli-core:12.3.1=compile,compileClasspath,jmhCompileClasspath,jmhRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-org.kordamp.ikonli:ikonli-javafx:12.3.1=compile,compileClasspath,jmhCompileClasspath,jmhRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-org.kordamp.ikonli:ikonli-materialdesign2-pack:12.3.1=compile,compileClasspath,jmhCompileClasspath,jmhRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-org.libreoffice:libreoffice:7.3.2=compile,compileClasspath,jmhCompileClasspath,jmhRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-org.libreoffice:unoloader:7.3.2=compile,compileClasspath,jmhCompileClasspath,jmhRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-org.mariadb.jdbc:mariadb-java-client:2.7.5=compile,compileClasspath,jmhCompileClasspath,jmhRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-org.openjdk.jmh:jmh-core:1.25=jmh,jmhCompileClasspath,jmhRuntimeClasspath
-org.openjdk.jmh:jmh-generator-asm:1.25=jmh,jmhCompileClasspath,jmhRuntimeClasspath
-org.openjdk.jmh:jmh-generator-bytecode:1.25=jmh,jmhCompileClasspath,jmhRuntimeClasspath
-org.openjdk.jmh:jmh-generator-reflection:1.25=jmh,jmhCompileClasspath,jmhRuntimeClasspath
-org.openjfx:javafx-base:18=compile,compileClasspath,jmhCompileClasspath,jmhRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-org.openjfx:javafx-controls:18=compile,compileClasspath,jmhCompileClasspath,jmhRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-org.openjfx:javafx-fxml:18=compile,compileClasspath,jmhCompileClasspath,jmhRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-org.openjfx:javafx-graphics:18=compile,compileClasspath,jmhCompileClasspath,jmhRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-org.openjfx:javafx-media:18=compile,compileClasspath,jmhCompileClasspath,jmhRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-org.openjfx:javafx-swing:18=compile,compileClasspath,jmhCompileClasspath,jmhRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-org.openjfx:javafx-web:18=compile,compileClasspath,jmhCompileClasspath,jmhRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-org.ow2.asm:asm-analysis:9.1=jacocoAnt
-org.ow2.asm:asm-analysis:9.2=modernizer
-org.ow2.asm:asm-commons:9.1=jacocoAnt
-org.ow2.asm:asm-commons:9.2=modernizer
-org.ow2.asm:asm-tree:9.1=jacocoAnt
-org.ow2.asm:asm-tree:9.2=modernizer
-org.ow2.asm:asm:5.0.3=jmh,jmhCompileClasspath,jmhRuntimeClasspath
-org.ow2.asm:asm:9.1=jacocoAnt
-org.ow2.asm:asm:9.2=modernizer
-org.postgresql:postgresql:42.3.3=compile,compileClasspath,jmhCompileClasspath,jmhRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-org.reactfx:reactfx:2.0-M5=compile,compileClasspath,jmhCompileClasspath,jmhRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-org.reflections:reflections:0.10.2=checkstyle
-org.scala-lang:scala-library:2.12.8=compile,compileClasspath,jmhCompileClasspath,jmhRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-org.slf4j:slf4j-api:2.0.0-alpha7=compile,compileClasspath,jmhCompileClasspath,jmhRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-org.tinylog:slf4j-tinylog:2.4.1=compile,compileClasspath,jmhCompileClasspath,jmhRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-org.tinylog:tinylog-api:2.4.1=compile,compileClasspath,jmhCompileClasspath,jmhRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-org.tinylog:tinylog-impl:2.4.1=compile,compileClasspath,jmhCompileClasspath,jmhRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-org.yaml:snakeyaml:1.30=compile,compileClasspath,jmhCompileClasspath,jmhRuntimeClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath
-empty=annotationProcessor,jmhAnnotationProcessor,testAnnotationProcessor

pkgs/applications/science/astronomy/siril/default.nix

@@ -6,13 +6,13 @@
 
 stdenv.mkDerivation rec {
   pname = "siril";
-  version = "1.0.3";
+  version = "1.0.5";
 
   src = fetchFromGitLab {
     owner = "free-astro";
     repo = pname;
     rev = version;
-    sha256 = "sha256-Y5ED2LuNapaq+FkKg3m8t4sgoh2TGXO1VX0p5gwlJjQ=";
+    sha256 = "sha256-1NPMTHPbYKPmaG+xRyKFU4/4Iio2ptn+HOvnsg4hoFE=";
   };
 
   nativeBuildInputs = [

pkgs/applications/science/math/pagsuite/default.nix

@@ -0,0 +1,37 @@
+{ lib
+, stdenv
+, fetchzip
+, cmake
+, gmp
+, scalp
+}:
+
+stdenv.mkDerivation rec {
+  pname = "pagsuite";
+  version = "1.80";
+
+  src = fetchzip {
+    url = "https://gitlab.com/kumm/pagsuite/-/raw/master/releases/pagsuite_${lib.replaceStrings ["."] ["_"] version}.zip";
+    sha256 = "sha256-JuRuDPhKKBGz8jUBkZcZW5s2berOewjsPNR/n7kuofY=";
+    stripRoot = false;
+    postFetch = ''
+      mv $out/pagsuite*/* $out
+    '';
+  };
+
+  nativeBuildInputs = [
+    cmake
+  ];
+
+  buildInputs = [
+    gmp
+    scalp
+  ];
+
+  meta = with lib; {
+    description = "Optimization tools for the (P)MCM problem";
+    homepage = "https://gitlab.com/kumm/pagsuite";
+    maintainers = with maintainers; [ wegank ];
+    license = licenses.unfree;
+  };
+}

pkgs/applications/video/epgstation/default.nix

@@ -6,7 +6,6 @@
 , makeWrapper
 , bash
 , nodejs
-, nodePackages
 , gzip
 , jq
 , yq
@@ -23,18 +22,17 @@ let
     sha256 = "K1cAvmqWEfS6EY4MKAtjXb388XLYHtouxNM70PWgFig=";
   };
 
-  client = nodePackages.epgstation-client.override (drv: {
-    # FIXME: remove this option if possible
-    #
-    # Unsetting this option resulted NPM attempting to re-download packages.
-    dontNpmInstall = true;
+  client = nodejs.pkgs.epgstation-client.override (drv: {
+    # This is set to false to keep devDependencies at build time. Build time
+    # dependencies are pruned afterwards.
+    production = false;
 
     meta = drv.meta // {
       inherit (nodejs.meta) platforms;
     };
   });
 
-  server = nodePackages.epgstation.override (drv: {
+  server = nodejs.pkgs.epgstation.override (drv: {
     inherit src;
 
     # This is set to false to keep devDependencies at build time. Build time
@@ -47,6 +45,9 @@ let
     ];
 
     preRebuild = ''
+      # Fix for OpenSSL compat with newer Node.js
+      export NODE_OPTIONS=--openssl-legacy-provider
+
       # Fix for not being able to connect to mysql using domain sockets.
       patch -p1 < ${./use-mysql-over-domain-socket.patch}
 
@@ -64,8 +65,8 @@ let
 
       pushd $out/lib/node_modules/epgstation
 
-      cp -r ${client}/lib/node_modules/epgstation-client/node_modules client/node_modules
-      chmod -R u+w client/node_modules
+      cp -r ${client}/lib/node_modules/epgstation-client/{package-lock.json,node_modules} client/
+      chmod -R u+w client/{package-lock.json,node_modules}
 
       npm run build
 

pkgs/applications/video/epgstation/package.json

@@ -35,7 +35,7 @@
     "reflect-metadata": "0.1.13",
     "socket.io": "4.3.1",
     "source-map-support": "0.5.20",
-    "sqlite3": "5.0.2",
+    "sqlite3": "5.0.11",
     "swagger-ui-dist": "3.52.5",
     "typeorm": "0.2.38",
     "url-join": "4.0.1",

pkgs/applications/video/epgstation/update.nix

@@ -6,6 +6,7 @@
 , writers
 , jq
 , yq
+, gnused
 }:
 
 let
@@ -45,6 +46,9 @@ in writers.writeBash "update-epgstation" ''
     "$SRC/client/package.json" \
     > client/package.json
 
+  # Fix issue with old sqlite3 version pinned that depends on very old node-gyp 3.x
+  ${gnused}/bin/sed -i -e 's/"sqlite3":\s*"5.0.[0-9]\+"/"sqlite3": "5.0.11"/' package.json
+
   # Regenerate node packages to update the pre-overriden epgstation derivation.
   # This must come *after* package.json has been regenerated.
   pushd ../../../development/node-packages

pkgs/applications/virtualization/docker/compose.nix

@@ -2,16 +2,16 @@
 
 buildGoModule rec {
   pname = "docker-compose";
-  version = "2.11.1";
+  version = "2.11.2";
 
   src = fetchFromGitHub {
     owner = "docker";
     repo = "compose";
     rev = "v${version}";
-    sha256 = "sha256-S7mRSpqZTL38YlYHqtXdib7LZqodfEFqdAB98sAXOkA=";
+    sha256 = "sha256-L43BIkRaPAU0zgdVsf1a3OinbspiU0LfWZPssS91wTE=";
   };
 
-  vendorSha256 = "sha256-aD0h7vSUkxaGBeN2S2GOEwKpXHKyvnwbOB7pABgBmCY=";
+  vendorSha256 = "sha256-PZumm//BV9iAkq1Kb9xNenqVrx73ZZUHTCUSVNqqEXA=";
 
   ldflags = [ "-X github.com/docker/compose/v2/internal.Version=${version}" "-s" "-w" ];
 

pkgs/applications/virtualization/nixpacks/default.nix

@@ -2,16 +2,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "nixpacks";
-  version = "0.7.1";
+  version = "0.7.2";
 
   src = fetchFromGitHub {
     owner = "railwayapp";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-d38PocmvGRvyKMCNMhE8IFNGOn6r42ODLPVo/Ak3q/8=";
+    sha256 = "sha256-tiAz8nrUq47AgafoXx/6KNl7Q3y1/Z4ITOtznU3hQAw=";
   };
 
-  cargoSha256 = "sha256-74FIlSV/prlxuMxqVx27M0ltXY3m0ddUVyHTltQLnuM=";
+  cargoSha256 = "sha256-6o254VH5fwtcTFPEFfPdLQOLk8YGbEi9ZeDfdHhVCn0=";
 
   # skip test due FHS dependency
   doCheck = false;

pkgs/applications/virtualization/pods/default.nix

@@ -0,0 +1,59 @@
+{ lib
+, stdenv
+, fetchFromGitHub
+, desktop-file-utils
+, glib
+, gtk4
+, meson
+, ninja
+, pkg-config
+, rustPlatform
+, wrapGAppsHook
+, gtksourceview5
+, libadwaita
+}:
+
+stdenv.mkDerivation rec {
+  pname = "pods";
+  version = "1.0.0-beta.4";
+
+  src = fetchFromGitHub {
+    owner = "marhkb";
+    repo = pname;
+    rev = "v${version}";
+    sha256 = "1j5rz43860n17qcxmc5dj8sll3y593jj9zz1sfvnx4g0694sp0cl";
+  };
+
+  cargoDeps = rustPlatform.fetchCargoTarball {
+    inherit src;
+    name = "${pname}-${version}";
+    sha256 = "sha256-tj0ROO8HmFWyQLYDrdywOneHz6X43dRZJFTB+aw+m7o=";
+  };
+
+  nativeBuildInputs = [
+    desktop-file-utils
+    glib
+    gtk4
+    meson
+    ninja
+    pkg-config
+    rustPlatform.cargoSetupHook
+    rustPlatform.rust.cargo
+    rustPlatform.rust.rustc
+    wrapGAppsHook
+  ];
+
+  buildInputs = [
+    gtk4
+    gtksourceview5
+    libadwaita
+  ];
+
+  meta = with lib; {
+    description = "A podman desktop application";
+    homepage = "https://github.com/marhkb/pods";
+    license = licenses.gpl3Only;
+    maintainers = with maintainers; [ figsoda ];
+    platforms = platforms.linux;
+  };
+}

pkgs/data/themes/orchis-theme/default.nix

@@ -5,6 +5,7 @@
 , gnome-themes-extra
 , gtk-engine-murrine
 , sassc
+, border-radius ? null # Suggested: 2 < value < 16
 , tweaks ? [ ] # can be "solid" "compact" "black" "primary"
 , withWallpapers ? false
 }:
@@ -21,13 +22,13 @@ assert lib.assertMsg (unknownTweaks == [ ]) ''
 stdenvNoCC.mkDerivation
 rec {
   pname = "orchis-theme";
-  version = "2022-07-20";
+  version = "2022-09-28";
 
   src = fetchFromGitHub {
     repo = "Orchis-theme";
     owner = "vinceliuice";
     rev = version;
-    sha256 = "sha256-0T9D42XwyvIb5XeXdqXbyahVHNcSeT469lSgWSisNvA=";
+    sha256 = "sha256-gabOn5ErJjDgqZCyIboMgFb1FqmDw8dljIskBENKTBg=";
   };
 
   nativeBuildInputs = [ gtk3 sassc ];
@@ -42,7 +43,9 @@ rec {
 
   installPhase = ''
     runHook preInstall
-    bash install.sh -d $out/share/themes -t all ${lib.optionalString (tweaks != []) "--tweaks " + builtins.toString tweaks}
+    bash install.sh -d $out/share/themes -t all \
+      ${lib.optionalString (tweaks != []) "--tweaks " + builtins.toString tweaks} \
+      ${lib.optionalString (!isNull border-radius) ("--round " + builtins.toString border-radius + "px")}
     ${lib.optionalString withWallpapers ''
       mkdir -p $out/share/backgrounds
       cp src/wallpaper/{1080p,2k,4k}.jpg $out/share/backgrounds

pkgs/development/libraries/drogon/default.nix

@@ -9,13 +9,13 @@
 
 stdenv.mkDerivation rec {
   pname = "drogon";
-  version = "1.8.0";
+  version = "1.8.1";
 
   src = fetchFromGitHub {
     owner = "drogonframework";
     repo = "drogon";
     rev = "v${version}";
-    sha256 = "sha256-rpn1TaEdiD/tM8F0Uc7yjF3EFGpu3/hAS0CITraLkMU=";
+    sha256 = "sha256-XzSJABYuZaYlNL12bi0ykQ1OyNsvB1AQiSTBPWiTNYU=";
     fetchSubmodules = true;
   };
 

pkgs/development/libraries/gtk/4.x.nix

@@ -62,7 +62,7 @@ in
 
 stdenv.mkDerivation rec {
   pname = "gtk4";
-  version = "4.8.0";
+  version = "4.8.1";
 
   outputs = [ "out" "dev" ] ++ lib.optionals x11Support [ "devdoc" ];
   outputBin = "dev";
@@ -74,7 +74,7 @@ stdenv.mkDerivation rec {
 
   src = fetchurl {
     url = "mirror://gnome/sources/gtk/${lib.versions.majorMinor version}/gtk-${version}.tar.xz";
-    sha256 = "yNYgNDfR41nYMSTcWRVG1AP2fjsAVE5T3VCpuqzcvX8=";
+    sha256 = "XOjY3piiO9DI7KGmEJThwAm18AncvWC0XpkKjbG3Qv0=";
   };
 
   nativeBuildInputs = [

pkgs/development/libraries/gtkmm/4.x.nix

@@ -17,13 +17,13 @@
 
 stdenv.mkDerivation rec {
   pname = "gtkmm";
-  version = "4.6.1";
+  version = "4.8.0";
 
   outputs = [ "out" "dev" ];
 
   src = fetchurl {
     url = "mirror://gnome/sources/${pname}/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "DV7+yp7GT91TC7gibGMQrJlUmz3ZYE1uNnY5eRrz0eA=";
+    sha256 = "yCeG1G4rBzRrY5fKfxkp2VL0ki+lyds97ghJi5oTbPU=";
   };
 
   nativeBuildInputs = [

pkgs/development/libraries/libadwaita/default.nix

@@ -20,7 +20,7 @@
 
 stdenv.mkDerivation rec {
   pname = "libadwaita";
-  version = "1.1.4";
+  version = "1.2.0";
 
   outputs = [ "out" "dev" "devdoc" ];
   outputBin = "devdoc"; # demo app
@@ -30,7 +30,7 @@ stdenv.mkDerivation rec {
     owner = "GNOME";
     repo = "libadwaita";
     rev = version;
-    hash = "sha256-xxnLgPKPOND/ITvDC6SOD2GlkzlIX3BzBbt6p2AEjgY=";
+    hash = "sha256-3lH7Vi9M8k+GSrCpvruRpLrIpMoOakKbcJlaAc/FK+U=";
   };
 
   nativeBuildInputs = [

pkgs/development/libraries/libmediainfo/default.nix

@@ -12,7 +12,12 @@ stdenv.mkDerivation rec {
   buildInputs = [ zlib ];
   propagatedBuildInputs = [ libzen ];
 
-  postPatch = "cd Project/GNU/Library";
+  sourceRoot = "MediaInfoLib/Project/GNU/Library";
+
+  postPatch = lib.optionalString (stdenv.cc.targetPrefix != "") ''
+    substituteInPlace configure.ac \
+      --replace "pkg-config " "${stdenv.cc.targetPrefix}pkg-config "
+  '';
 
   configureFlags = [ "--enable-shared" ];
 

pkgs/development/libraries/libpanel/default.nix

@@ -0,0 +1,65 @@
+{ stdenv
+, lib
+, fetchurl
+, meson
+, ninja
+, pkg-config
+, gobject-introspection
+, vala
+, gi-docgen
+, glib
+, gtk4
+, libadwaita
+, gnome
+}:
+
+stdenv.mkDerivation rec {
+  pname = "libpanel";
+  version = "1.0.1";
+
+  outputs = [ "out" "dev" "devdoc" ];
+  outputBin = "dev";
+
+  src = fetchurl {
+    url = "mirror://gnome/sources/libpanel/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
+    sha256 = "hBtqtx6wcv1lIAI+H3Gqx/8lDGbq37sXyVXaa/QeIwY=";
+  };
+
+  nativeBuildInputs = [
+    meson
+    ninja
+    pkg-config
+    gobject-introspection
+    vala
+    gi-docgen
+  ];
+
+  buildInputs = [
+    glib
+    gtk4
+    libadwaita
+  ];
+
+  mesonFlags = [
+    "-Dinstall-examples=true"
+  ];
+
+  postFixup = ''
+    # Cannot be in postInstall, otherwise _multioutDocs hook in preFixup will move right back.
+    moveToOutput "share/doc" "$devdoc"
+  '';
+
+  passthru = {
+    updateScript = gnome.updateScript {
+      packageName = pname;
+    };
+  };
+
+  meta = with lib; {
+    description = "Dock/panel library for GTK 4";
+    homepage = "https://gitlab.gnome.org/GNOME/libpanel";
+    license = licenses.lgpl21Plus;
+    maintainers = teams.gnome.members;
+    platforms = platforms.unix;
+  };
+}

pkgs/development/libraries/miniaudio/default.nix

@@ -0,0 +1,28 @@
+{ lib
+, stdenv
+, fetchFromGitHub
+}:
+stdenv.mkDerivation rec {
+  pname = "miniaudio";
+  version = "unstable-2020-04-20";
+
+  src = fetchFromGitHub {
+    owner = "mackron";
+    repo = "miniaudio";
+    rev = "4d813cfe23c28db165cce6785419fee9d2399766";
+    sha256 = "sha256-efZLZTmkLtvcysd25olDE/QqunU5YTYwSVmUZXPKGIY=";
+  };
+
+  installPhase = ''
+    mkdir -p $out
+    cp -r $src/* $out/
+  '';
+
+  meta = with lib; {
+    description = "Single header audio playback and capture library written in C.";
+    homepage = "https://github.com/mackron/miniaudio";
+    license = licenses.unlicense;
+    maintainers = [ maintainers.jansol ];
+    platforms = platforms.all;
+  };
+}

pkgs/development/node-packages/composition.nix

@@ -2,7 +2,7 @@
 
 {pkgs ? import <nixpkgs> {
     inherit system;
-  }, system ? builtins.currentSystem, nodejs ? pkgs."nodejs-14_x"}:
+  }, system ? builtins.currentSystem, nodejs ? pkgs."nodejs-18_x"}:
 
 let
   nodeEnv = import ./node-env.nix {

pkgs/development/node-packages/generate.sh

@@ -13,7 +13,7 @@ rm -f ./node-env.nix
     -i node-packages.json \
     -o node-packages.nix \
     -c composition.nix \
-    --pkg-name nodejs-14_x
+    --pkg-name nodejs-18_x
 
 # using --no-out-link in nix-build argument would cause the
 # gc to run before the script finishes

pkgs/development/node-packages/node-env.nix

@@ -165,7 +165,11 @@ let
           if(process.argv[2] == "development") {
               replaceDependencies(packageObj.devDependencies);
           }
+          else {
+              packageObj.devDependencies = {};
+          }
           replaceDependencies(packageObj.optionalDependencies);
+          replaceDependencies(packageObj.peerDependencies);
 
           /* Write the fixed package.json file */
           fs.writeFileSync("package.json", JSON.stringify(packageObj, null, 2));
@@ -270,7 +274,7 @@ let
 
   # Reconstructs a package-lock file from the node_modules/ folder structure and package.json files with dummy sha1 hashes
   reconstructPackageLock = writeTextFile {
-    name = "addintegrityfields.js";
+    name = "reconstructpackagelock.js";
     text = ''
       var fs = require('fs');
       var path = require('path');
@@ -280,25 +284,43 @@ let
       var lockObj = {
           name: packageObj.name,
           version: packageObj.version,
-          lockfileVersion: 1,
+          lockfileVersion: 2,
           requires: true,
+          packages: {
+              "": {
+                  name: packageObj.name,
+                  version: packageObj.version,
+                  license: packageObj.license,
+                  bin: packageObj.bin,
+                  dependencies: packageObj.dependencies,
+                  engines: packageObj.engines,
+                  optionalDependencies: packageObj.optionalDependencies
+              }
+          },
           dependencies: {}
       };
 
-      function augmentPackageJSON(filePath, dependencies) {
+      function augmentPackageJSON(filePath, packages, dependencies) {
           var packageJSON = path.join(filePath, "package.json");
           if(fs.existsSync(packageJSON)) {
               var packageObj = JSON.parse(fs.readFileSync(packageJSON));
+              packages[filePath] = {
+                  version: packageObj.version,
+                  integrity: "sha1-000000000000000000000000000=",
+                  dependencies: packageObj.dependencies,
+                  engines: packageObj.engines,
+                  optionalDependencies: packageObj.optionalDependencies
+              };
               dependencies[packageObj.name] = {
                   version: packageObj.version,
                   integrity: "sha1-000000000000000000000000000=",
                   dependencies: {}
               };
-              processDependencies(path.join(filePath, "node_modules"), dependencies[packageObj.name].dependencies);
+              processDependencies(path.join(filePath, "node_modules"), packages, dependencies[packageObj.name].dependencies);
           }
       }
 
-      function processDependencies(dir, dependencies) {
+      function processDependencies(dir, packages, dependencies) {
           if(fs.existsSync(dir)) {
               var files = fs.readdirSync(dir);
 
@@ -314,23 +336,84 @@ let
                           pkgFiles.forEach(function(entry) {
                               if(stats.isDirectory()) {
                                   var pkgFilePath = path.join(filePath, entry);
-                                  augmentPackageJSON(pkgFilePath, dependencies);
+                                  augmentPackageJSON(pkgFilePath, packages, dependencies);
                               }
                           });
                       } else {
-                          augmentPackageJSON(filePath, dependencies);
+                          augmentPackageJSON(filePath, packages, dependencies);
                       }
                   }
               });
           }
       }
 
-      processDependencies("node_modules", lockObj.dependencies);
+      processDependencies("node_modules", lockObj.packages, lockObj.dependencies);
 
       fs.writeFileSync("package-lock.json", JSON.stringify(lockObj, null, 2));
     '';
   };
 
+  # Script that links bins defined in package.json to the node_modules bin directory
+  # NPM does not do this for top-level packages itself anymore as of v7
+  linkBinsScript = writeTextFile {
+    name = "linkbins.js";
+    text = ''
+      var fs = require('fs');
+      var path = require('path');
+
+      var packageObj = JSON.parse(fs.readFileSync("package.json"));
+
+      var nodeModules = Array(packageObj.name.split("/").length).fill("..").join(path.sep);
+
+      if(packageObj.bin !== undefined) {
+          fs.mkdirSync(path.join(nodeModules, ".bin"))
+
+          if(typeof packageObj.bin == "object") {
+              Object.keys(packageObj.bin).forEach(function(exe) {
+                  if(fs.existsSync(packageObj.bin[exe])) {
+                      console.log("linking bin '" + exe + "'");
+                      fs.symlinkSync(
+                          path.join("..", packageObj.name, packageObj.bin[exe]),
+                          path.join(nodeModules, ".bin", exe)
+                      );
+                  }
+                  else {
+                      console.log("skipping non-existent bin '" + exe + "'");
+                  }
+              })
+          }
+          else {
+              if(fs.existsSync(packageObj.bin)) {
+                  console.log("linking bin '" + packageObj.bin + "'");
+                  fs.symlinkSync(
+                      path.join("..", packageObj.name, packageObj.bin),
+                      path.join(nodeModules, ".bin", packageObj.name.split("/").pop())
+                  );
+              }
+              else {
+                  console.log("skipping non-existent bin '" + packageObj.bin + "'");
+              }
+          }
+      }
+      else if(packageObj.directories !== undefined && packageObj.directories.bin !== undefined) {
+          fs.mkdirSync(path.join(nodeModules, ".bin"))
+
+          fs.readdirSync(packageObj.directories.bin).forEach(function(exe) {
+              if(fs.existsSync(path.join(packageObj.directories.bin, exe))) {
+                  console.log("linking bin '" + exe + "'");
+                  fs.symlinkSync(
+                      path.join("..", packageObj.name, packageObj.directories.bin, exe),
+                      path.join(nodeModules, ".bin", exe)
+                  );
+              }
+              else {
+                  console.log("skipping non-existent bin '" + exe + "'");
+              }
+          })
+      }
+    '';
+  };
+
   prepareAndInvokeNPM = {packageName, bypassCache, reconstructLock, npmFlags, production}:
     let
       forceOfflineFlag = if bypassCache then "--offline" else "--registry http://www.example.com";
@@ -377,13 +460,18 @@ let
 
         npm ${forceOfflineFlag} --nodedir=${nodeSources} ${npmFlags} ${lib.optionalString production "--production"} rebuild
 
+        runHook postRebuild
+
         if [ "''${dontNpmInstall-}" != "1" ]
         then
             # NPM tries to download packages even when they already exist if npm-shrinkwrap is used.
             rm -f npm-shrinkwrap.json
 
-            npm ${forceOfflineFlag} --nodedir=${nodeSources} ${npmFlags} ${lib.optionalString production "--production"} install
+            npm ${forceOfflineFlag} --nodedir=${nodeSources} --no-bin-links --ignore-scripts ${npmFlags} ${lib.optionalString production "--production"} install
         fi
+
+        # Link executables defined in package.json
+        node ${linkBinsScript}
     '';
 
   # Builds and composes an NPM package including all its dependencies

pkgs/development/node-packages/overrides.nix

@@ -9,6 +9,7 @@ let
     callPackage
     fetchFromGitHub
     fetchurl
+    fetchpatch
     nixosTests;
 
   since = version: lib.versionAtLeast nodejs.version version;
@@ -38,7 +39,7 @@ final: prev: {
     ];
   };
 
-  "@medable/mdctl-cli" = prev."@medable/mdctl-cli".override {
+  "@medable/mdctl-cli" = prev."@medable/mdctl-cli".override (oldAttrs: {
     nativeBuildInputs = with pkgs; with darwin.apple_sdk.frameworks; [
       glib
       libsecret
@@ -52,7 +53,9 @@ final: prev: {
       final.node-pre-gyp
       nodejs
     ];
-  };
+
+    meta = oldAttrs.meta // { broken = since "16"; };
+  });
   mdctl-cli = final."@medable/mdctl-cli";
 
   autoprefixer = prev.autoprefixer.override {
@@ -90,6 +93,8 @@ final: prev: {
 
   bitwarden-cli = prev."@bitwarden/cli".override {
     name = "bitwarden-cli";
+    nativeBuildInputs = [ pkgs.pkg-config ];
+    buildInputs = with pkgs; [ pixman cairo pango ];
   };
 
   bower2nix = prev.bower2nix.override {
@@ -132,7 +137,8 @@ final: prev: {
   # NOTE: this is a stub package to fetch npm dependencies for
   # ../../applications/video/epgstation
   epgstation = prev."epgstation-../../applications/video/epgstation".override (oldAttrs: {
-    buildInputs = [ final.node-pre-gyp final.node-gyp-build ];
+    buildInputs = [ pkgs.postgresql ];
+    nativeBuildInputs = [ final.node-pre-gyp final.node-gyp-build pkgs.which ];
     meta = oldAttrs.meta // { platforms = lib.platforms.none; };
   });
 
@@ -158,6 +164,13 @@ final: prev: {
     '';
   };
 
+  fauna-shell = prev.fauna-shell.override {
+    # printReleaseNotes just pulls them from GitHub which is not allowed in sandbox
+    preRebuild = ''
+      sed -i 's|"node ./tools/printReleaseNotes"|"true"|' node_modules/faunadb/package.json
+    '';
+  };
+
   flood = prev.flood.override {
     buildInputs = [ final.node-pre-gyp ];
   };
@@ -185,7 +198,7 @@ final: prev: {
 
   ijavascript = prev.ijavascript.override (oldAttrs: {
     preRebuild = ''
-      export NPM_CONFIG_ZMQ_EXTERNAL=true
+      export npm_config_zmq_external=true
     '';
     buildInputs = oldAttrs.buildInputs ++ [ final.node-gyp-build pkgs.zeromq ];
   });
@@ -208,6 +221,10 @@ final: prev: {
       libsecret
       final.node-gyp-build
       final.node-pre-gyp
+
+      pixman
+      cairo
+      pango
     ] ++ lib.optionals stdenv.isDarwin [
       darwin.apple_sdk.frameworks.AppKit
       darwin.apple_sdk.frameworks.Security
@@ -227,6 +244,15 @@ final: prev: {
     '';
   };
 
+  keyoxide = prev.keyoxide.override {
+    nativeBuildInputs = [ pkgs.pkg-config ];
+    buildInputs = with pkgs; [
+      pixman
+      cairo
+      pango
+    ];
+  };
+
   makam =  prev.makam.override {
     nativeBuildInputs = [ pkgs.buildPackages.makeWrapper ];
     postFixup = ''
@@ -295,16 +321,23 @@ final: prev: {
   };
 
   node2nix = prev.node2nix.override {
-    nativeBuildInputs = [ pkgs.buildPackages.makeWrapper ];
-    # We need to use master because of a fix that replaces git:// url to https://.
+    # Get latest commit for misc fixes
     src = fetchFromGitHub {
       owner = "svanderburg";
       repo = "node2nix";
-      rev = "68f5735f9a56737e3fedceb182705985e3ab8799";
-      sha256 = "sha256-NK6gDTkGx0GG7yPTwgtFC4ttQZPfcLaLp8W8OOMO6bg=";
+      rev = "026360084db8a27095aafdac7125d7f1a93046c8";
+      sha256 = "sha256-zO/xGG10v7HGv58RLX5SFd7QOXAL2vRxCRM8IfRZ8JA=";
     };
-
-    postInstall = ''
+    nativeBuildInputs = [ pkgs.buildPackages.makeWrapper ];
+    postInstall = let
+      # Needed to fix Node.js 16+ - PR svanderburg/node2nix#302
+      npmPatch = fetchpatch {
+        name = "emit-lockfile-v2-and-fix-bin-links-with-npmv7.patch";
+        url = "https://github.com/svanderburg/node2nix/commit/375a055041b5ee49ca5fb3f74a58ca197c90c7d5.patch";
+        hash = "sha256-uVYrXptJILojeur9s2O+J/f2vyPNCaZMn1GM/NoC5n8=";
+      };
+    in ''
+      patch -d $out/lib/node_modules/node2nix -p1 < ${npmPatch}
       wrapProgram "$out/bin/node2nix" --prefix PATH : ${lib.makeBinPath [ pkgs.nix ]}
     '';
   };
@@ -440,7 +473,7 @@ final: prev: {
   };
 
   tedicross = prev."tedicross-git+https://github.com/TediCross/TediCross.git#v0.8.7".override {
-    nativeBuildInputs = [ pkgs.buildPackages.makeWrapper ];
+    nativeBuildInputs = with pkgs; [ makeWrapper libtool autoconf ];
     postInstall = ''
       makeWrapper '${nodejs}/bin/node' "$out/bin/tedicross" \
         --add-flags "$out/lib/node_modules/tedicross/main.js"
@@ -467,10 +500,18 @@ final: prev: {
 
   thelounge-theme-flat-blue = prev.thelounge-theme-flat-blue.override {
     nativeBuildInputs = [ final.node-pre-gyp ];
+    # TODO: needed until upstream pins thelounge version 4.3.1+ (which fixes dependency on old sqlite3 and transitively very old node-gyp 3.x)
+    preRebuild = ''
+      rm -r node_modules/node-gyp
+    '';
   };
 
   thelounge-theme-flat-dark = prev.thelounge-theme-flat-dark.override {
     nativeBuildInputs = [ final.node-pre-gyp ];
+    # TODO: needed until upstream pins thelounge version 4.3.1+ (which fixes dependency on old sqlite3 and transitively very old node-gyp 3.x)
+    preRebuild = ''
+      rm -r node_modules/node-gyp
+    '';
   };
 
   triton = prev.triton.override {
@@ -555,12 +596,6 @@ final: prev: {
   };
 
   wrangler = prev.wrangler.override (oldAttrs: {
-    dontNpmInstall = true;
-    nativeBuildInputs = [ pkgs.buildPackages.makeWrapper ];
-    postInstall = ''
-      makeWrapper "$out/lib/node_modules/wrangler/bin/wrangler.js" "$out/bin/wrangler" \
-        --inherit-argv0
-    '';
     meta = oldAttrs.meta // { broken = before "16.13"; };
   });
 

pkgs/development/octave-modules/symbolic/default.nix

@@ -1,27 +1,26 @@
 { buildOctavePackage
 , lib
 , fetchFromGitHub
-# Octave's Python (Python 3)
+  # Octave's Python (Python 3)
 , python
 }:
 
 let
   pythonEnv = python.withPackages (ps: [
-      ps.sympy
-      ps.mpmath
-    ]);
+    ps.sympy
+    ps.mpmath
+  ]);
 
-in buildOctavePackage rec {
+in
+buildOctavePackage rec {
   pname = "symbolic";
-  version = "unstable-2021-10-16";
+  version = "3.0.1";
 
-  # https://github.com/cbm755/octsympy/issues/1023 has been resolved, however
-  # a new release has not been made
   src = fetchFromGitHub {
     owner = "cbm755";
     repo = "octsympy";
-    rev = "5b58530f4ada78c759829ae703a0e5d9832c32d4";
-    sha256 = "sha256-n6P1Swjl4RfgxfLY0ZuN3pcL8PcoknA6yxbnw96OZ2k=";
+    rev = "v${version}";
+    hash = "sha256-FJb5uazqEiyNI6TL9WVewMoQnC3CutcHENl+umNZeto=";
   };
 
   propagatedBuildInputs = [ pythonEnv ];

pkgs/development/python-modules/hatch-nodejs-version/default.nix

@@ -0,0 +1,41 @@
+{ lib
+, buildPythonPackage
+, fetchFromGitHub
+, pytestCheckHook
+, pythonOlder
+, hatchling
+}:
+
+buildPythonPackage rec {
+  pname = "hatch-nodejs-version";
+  version = "0.3.0";
+  format = "pyproject";
+
+  disabled = pythonOlder "3.7";
+
+  src = fetchFromGitHub {
+    owner = "agoose77";
+    repo = "hatch-nodejs-version";
+    rev = "v${version}";
+    sha256 = "sha256-TBvqXjka8poQ8xxQ/H1hFYRLqnP1024uan1d9b95ags=";
+  };
+
+  propagatedBuildInputs = [
+    hatchling
+  ];
+
+  checkInputs = [
+    pytestCheckHook
+  ];
+
+  pythonImportsCheck = [
+    "hatch_nodejs_version"
+  ];
+
+  meta = with lib; {
+    description = "Plugins for dealing with NodeJS versions";
+    homepage = "https://github.com/agoose77/hatch-nodejs-version";
+    license = licenses.mit;
+    maintainers = with maintainers; [ cpcloud ];
+  };
+}

pkgs/development/python-modules/humanize/default.nix

@@ -11,7 +11,7 @@
 }:
 
 buildPythonPackage rec {
-  version = "4.3.0";
+  version = "4.4.0";
   pname = "humanize";
   format = "pyproject";
 
@@ -21,7 +21,7 @@ buildPythonPackage rec {
     owner = "python-humanize";
     repo = pname;
     rev = version;
-    hash = "sha256-sccv3HtCgG/znZs/sfmeeOHK3xchv9zRrNX/SxyEbCQ=";
+    hash = "sha256-XxlmOs3sfHOLTkrKGsHRiBWpuCIPJua2VkKxDmjOeWE=";
   };
 
   SETUPTOOLS_SCM_PRETEND_VERSION = version;

pkgs/development/python-modules/imageio/default.nix

@@ -16,11 +16,11 @@
 
 buildPythonPackage rec {
   pname = "imageio";
-  version = "2.19.3";
+  version = "2.22.0";
   disabled = isPy27;
 
   src = fetchPypi {
-    sha256 = "sha256-DJ34DkLy7mi+qSAB5/z2EqoUmRDv4EDrdX9c4yMlCuE=";
+    sha256 = "sha256-ozLRJ+w4ey09ypZ/0GWpDxwaS6I0NXCwP+LOu27QZOo=";
     inherit pname version;
   };
 
@@ -65,6 +65,6 @@ buildPythonPackage rec {
     description = "Library for reading and writing a wide range of image, video, scientific, and volumetric data formats";
     homepage = "http://imageio.github.io/";
     license = licenses.bsd2;
-    maintainers = with maintainers; [ ];
+    maintainers = with maintainers; [ Luflosi ];
   };
 }

pkgs/development/python-modules/readme_renderer/default.nix

@@ -12,7 +12,7 @@
 
 buildPythonPackage rec {
   pname = "readme-renderer";
-  version = "37.0";
+  version = "37.2";
   format = "setuptools";
 
   disabled = pythonOlder "3.6";
@@ -20,7 +20,7 @@ buildPythonPackage rec {
   src = fetchPypi {
     pname = "readme_renderer";
     inherit version;
-    sha256 = "sha256-B7fqI04D5Y93zCIuIG5qu49MBDW+zOUQR5TuWR+TAcU=";
+    sha256 = "sha256-6K0lKTyY94HbwsWjajCZKTkACfkC+Z4XmMdhqvBKeSM=";
   };
 
   propagatedBuildInputs = [

pkgs/development/python-modules/sphinxcontrib-autoapi/default.nix

@@ -1,45 +1,52 @@
-{ stdenv
-, lib
+{ lib
+, astroid
 , buildPythonPackage
 , fetchPypi
-, pythonOlder
-, astroid
 , jinja2
-, sphinx
-, pyyaml
-, unidecode
 , mock
-, pytest
+, pytestCheckHook
+, pythonOlder
+, pyyaml
+, sphinx
+, stdenv
+, unidecode
 }:
 
 buildPythonPackage rec {
   pname = "sphinx-autoapi";
   version = "1.9.0";
-  disabled = pythonOlder "3.6";
+  format = "setuptools";
+
+  disabled = pythonOlder "3.7";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-yJfqM33xatDN4wfL3+K+ziB3iN3hWH+k/IuFfR/F3Lo=";
+    hash = "sha256-yJfqM33xatDN4wfL3+K+ziB3iN3hWH+k/IuFfR/F3Lo=";
   };
 
-  propagatedBuildInputs = [ astroid jinja2 pyyaml sphinx unidecode ];
+  propagatedBuildInputs = [
+    astroid
+    jinja2
+    pyyaml
+    sphinx
+    unidecode
+  ];
 
   checkInputs = [
     mock
-    pytest
+    pytestCheckHook
   ];
 
-  checkPhase = ''
-    pytest
-  '';
+  pythonImportsCheck = [
+    "autoapi"
+  ];
 
   meta = with lib; {
-    broken = stdenv.isDarwin;
     homepage = "https://github.com/readthedocs/sphinx-autoapi";
     description = "Provides 'autodoc' style documentation";
     longDescription = "Sphinx AutoAPI provides 'autodoc' style documentation for multiple programming languages without needing to load, run, or import the project being documented.";
     license = licenses.mit;
     maintainers = with maintainers; [ karolchmist ];
+    broken = stdenv.isDarwin;
   };
-
 }

pkgs/development/python-modules/sphinxcontrib-mscgen/default.nix

@@ -0,0 +1,39 @@
+{ lib
+, buildPythonPackage
+, fetchPypi
+, pythonOlder
+, sphinx
+, mscgen
+}:
+
+buildPythonPackage rec {
+  pname = "sphinxcontrib-mscgen";
+  version = "0.6";
+  format = "setuptools";
+
+  disabled = pythonOlder "3.7";
+
+  src = fetchPypi {
+    inherit pname version;
+    hash = "sha256-AXfSWRq3CepT/jNOgHxiYT7vkdKZejPu/LeUqxZ8T5A=";
+  };
+
+  propagatedBuildInputs = [
+    mscgen
+    sphinx
+  ];
+
+  # There are no unit tests
+  doCheck = false;
+
+  pythonImportsCheck = [
+    "sphinxcontrib.mscgen"
+  ];
+
+  meta = with lib; {
+    description = "Sphinx extension using mscgen to render diagrams";
+    homepage = "https://github.com/sphinx-contrib/mscgen";
+    license = licenses.bola11;
+    maintainers = with maintainers; [ drupol ];
+  };
+}

pkgs/development/python-modules/types-pyyaml/default.nix

@@ -5,13 +5,13 @@
 
 buildPythonPackage rec {
   pname = "types-pyyaml";
-  version = "6.0.11";
+  version = "6.0.12";
   format = "setuptools";
 
   src = fetchPypi {
     pname = "types-PyYAML";
     inherit version;
-    sha256 = "sha256-f32i/RHpvB5enrPqG+hPSEl0cBeln8Lu4Oo07RFHwuA=";
+    sha256 = "sha256-9vNQQYElhy8/BAnZamKlpc60UjGvXMB+4ANOxIo8gvo=";
   };
 
   # Module doesn't have tests

pkgs/development/python-modules/types-redis/default.nix

@@ -5,12 +5,12 @@
 
 buildPythonPackage rec {
   pname = "types-redis";
-  version = "4.3.20";
+  version = "4.3.21";
   format = "setuptools";
 
   src = fetchPypi {
     inherit pname version;
-    sha256 = "sha256-dO0ClFRw3eot0hRHwYXauzFp5aUyjSayXPNUfZSbjgQ=";
+    sha256 = "sha256-/QF6ZzOvGT0U8bsptP95wKvJBuhlQVjRerpFemOBr+I=";
   };
 
   # Module doesn't have tests

pkgs/development/python-modules/types-urllib3/default.nix

@@ -5,12 +5,12 @@
 
 buildPythonPackage rec {
   pname = "types-urllib3";
-  version = "1.26.24";
+  version = "1.26.25";
   format = "setuptools";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-obOq6n3aPrG1Fpnucjqt0jVIjk3EZI4DDwm8Qp7P9C8=";
+    hash = "sha256-Wu8OZjck7vkkr6izILYv/vLBc2wfpsrs/JvGyK4sPe8=";
   };
 
   # Module doesn't have tests

pkgs/development/tools/analysis/makefile2graph/default.nix

@@ -2,13 +2,13 @@
 
 stdenv.mkDerivation rec {
   pname = "makefile2graph";
-  version = "unstable-2018-01-03";
+  version = "2021.11.06";
 
   src = fetchFromGitHub {
     owner = "lindenb";
     repo = "makefile2graph";
-    rev = "61fb95a5ba91c20236f5e4deb11127c34b47091f";
-    sha256 = "07hq40bl48i8ka35fcciqcafpd8k9rby1wf4vl2p53v0665xaghr";
+    rev = "refs/tags/${version}";
+    hash = "sha256-4jyftC0eCJ13X/L4uEWhT5FA5/UXUmSHSoba89GSySQ=";
   };
 
   nativeBuildInputs = [ makeWrapper ];

pkgs/development/tools/build-managers/sbt-extras/default.nix

@@ -3,14 +3,14 @@
 
 stdenv.mkDerivation rec {
   pname = "sbt-extras";
-  rev = "79d05c5dce595536263f337ab04b2868cb72604f";
-  version = "2022-07-12";
+  rev = "ddc1c0a9e9df598ad60edbd004e5abb51b32e42c";
+  version = "2022-09-23";
 
   src = fetchFromGitHub {
     owner = "paulp";
     repo = "sbt-extras";
     inherit rev;
-    sha256 = "GQue3n2oUTDz2QGf46T2ePJ0fD5XPFZ/36SWlT+DBTM=";
+    sha256 = "SsqxDipM6B2w1kT1yuNc+PXYDE8qpUSwaXqItYuCgRU=";
   };
 
   dontBuild = true;

pkgs/development/tools/build-managers/scala-cli/sources.json

@@ -1,13 +1,17 @@
 {
-  "version": "0.1.14",
+  "version": "0.1.15",
   "assets": {
+    "aarch64-darwin": {
+      "asset": "scala-cli-aarch64-apple-darwin.gz",
+      "sha256": "17zc0fd83r8wsj9bf448f1y0s5plp3xdkqh2qbfsqak4jk4f22jn"
+    },
     "x86_64-darwin": {
       "asset": "scala-cli-x86_64-apple-darwin.gz",
-      "sha256": "1h20bd8rabpxgjp6czbn9m5yhmz77vkvpbsxmnf6src942ihb7sn"
+      "sha256": "1c3znwad91czfvym82g4hbh96ny8wnhjcqshj6zchvzdh8c1xiqm"
     },
     "x86_64-linux": {
       "asset": "scala-cli-x86_64-pc-linux.gz",
-      "sha256": "1n4f920qpwhnarky1dh79sk1r3ayriinf4ah53704xvscc083c70"
+      "sha256": "0s193bkh1b431hbdfa9fnw3id6p57byy8n10v3s15sk5yi96jl87"
     }
   }
 }

pkgs/development/tools/cloud-nuke/default.nix

@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "cloud-nuke";
-  version = "0.19.0";
+  version = "0.19.1";
 
   src = fetchFromGitHub {
     owner = "gruntwork-io";
     repo = pname;
     rev = "v${version}";
-    sha256 = "sha256-NZFjocmmrOFGnGvLcgJPuUpzfG27FM+CnjUCjxI4l7M=";
+    sha256 = "sha256-509kDq2didjtsMbEkDzTh37P8bY6pIcNr51fccxqrPg=";
   };
 
   vendorSha256 = "sha256-DJmN7KAOgKYIzcsOyW3v7PTbuNgFaH0JSdRPDqi0q+w=";

pkgs/development/tools/konf/default.nix

@@ -5,13 +5,13 @@
 
 buildGoModule rec {
   pname = "konf";
-  version = "0.3.0";
+  version = "0.4.0";
 
   src = fetchFromGitHub {
     owner = "SimonTheLeg";
     repo = "konf-go";
     rev = "v${version}";
-    hash = "sha256-n8WJyihpbtci8Q6zUapwrpTrVZVAS53OpnwAsv6w1FY=";
+    hash = "sha256-8TXr/jYMl3NLERtLkm7qG97IL/idz4xxP0g0LEy4/j8=";
   };
 
   vendorHash = "sha256-sB3j19HrTtaRqNcooqNy8vBvuzxxyGDa7MOtiGoVgN8=";

pkgs/development/tools/ktlint/default.nix

@@ -1,4 +1,4 @@
-{ lib, stdenv, fetchurl, makeWrapper, jre_headless }:
+{ lib, stdenv, fetchurl, makeWrapper, jre_headless, gnused }:
 
 stdenv.mkDerivation rec {
   pname = "ktlint";
@@ -18,7 +18,7 @@ stdenv.mkDerivation rec {
   '';
 
   postFixup = ''
-    wrapProgram $out/bin/ktlint --prefix PATH : "${jre_headless}/bin"
+    wrapProgram $out/bin/ktlint --prefix PATH : "${lib.makeBinPath [ jre_headless gnused ]}"
   '';
 
   meta = with lib; {

pkgs/development/tools/misc/rsass/default.nix

@@ -0,0 +1,23 @@
+{ lib, rustPlatform, fetchCrate }:
+
+rustPlatform.buildRustPackage rec {
+  pname = "rsass";
+  version = "0.26.0";
+
+  src = fetchCrate {
+    inherit pname version;
+    sha256 = "sha256-Ksub+VYTbaWbFpHJFrMr6Dnx6LOnEOUlI2qHhCfbS40=";
+  };
+
+  cargoSha256 = "sha256-ugG4ivQ2NzLJeZss7h9TME2Aipurl1LZBgxt1cYaK2E=";
+
+  buildFeatures = [ "commandline" ];
+
+  meta = with lib; {
+    description = "Sass reimplemented in rust with nom";
+    homepage = "https://github.com/kaj/rsass";
+    changelog = "https://github.com/kaj/rsass/blob/v${version}/CHANGELOG.md";
+    license = with licenses; [ mit /* or */ asl20 ];
+    maintainers = with maintainers; [ figsoda ];
+  };
+}

pkgs/development/tools/pgloader/default.nix

@@ -1,11 +1,11 @@
 { lib, stdenv, fetchurl, makeWrapper, sbcl_2_2_6, sqlite, freetds, libzip, curl, git, cacert, openssl }:
 stdenv.mkDerivation rec {
   pname = "pgloader";
-  version = "3.6.7";
+  version = "3.6.8";
 
   src = fetchurl {
-    url = "https://github.com/dimitri/pgloader/releases/download/v3.6.7/pgloader-bundle-3.6.7.tgz";
-    sha256 = "sha256-JfF2el0vJjDAyB2l3H4dLgEIgnmXlrCUVYKDpj2jM1Y=";
+    url = "https://github.com/dimitri/pgloader/releases/download/v3.6.8/pgloader-bundle-3.6.8.tgz";
+    sha256 = "sha256-h5vB+KOapbXsSVNIVWEsaanyczaCfl81+SXdiNmNboE=";
   };
 
   nativeBuildInputs = [ git makeWrapper ];

pkgs/development/tools/rust/cargo-make/default.nix

@@ -13,11 +13,11 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "cargo-make";
-  version = "0.36.0";
+  version = "0.36.1";
 
   src = fetchCrate {
     inherit pname version;
-    sha256 = "sha256-Kh6llGiSzzrd4V2wBRe7FW1cq1JaMv+A0VUy8FLi5J0=";
+    sha256 = "sha256-kezwewPdHGcATPaU7wvbunVQ9a2Orf5CuVCue8Ux84I=";
   };
 
   nativeBuildInputs = [ pkg-config ];
@@ -25,7 +25,7 @@ rustPlatform.buildRustPackage rec {
   buildInputs = [ openssl ]
     ++ lib.optionals stdenv.isDarwin [ Security SystemConfiguration libiconv ];
 
-  cargoSha256 = "sha256-FKmr590pwscWxQZYakkc6zFVLO2nGK9OMDhLiZxnELs=";
+  cargoSha256 = "sha256-ZGNR2xAGsdv4lNnGckB/n5mhzetz6Gn3z2TpAvnvsjU=";
 
   # Some tests fail because they need network access.
   # However, Travis ensures a proper build.

pkgs/development/web/insomnia/default.nix

@@ -15,12 +15,12 @@ let
   ];
 in stdenv.mkDerivation rec {
   pname = "insomnia";
-  version = "2022.5.1";
+  version = "2022.6.0";
 
   src = fetchurl {
     url =
       "https://github.com/Kong/insomnia/releases/download/core%40${version}/Insomnia.Core-${version}.deb";
-    sha256 = "sha256-ExdfXfpimM6E/S6xiLTHdq3f4/ydtyfZ2+9o32z87gc=";
+    sha256 = "sha256-ARGIcNHnqQEyp1JVNV59FvvYv9JTSS55R+lTHl0IrWk=";
   };
 
   nativeBuildInputs = [

pkgs/games/0ad/data.nix

@@ -6,7 +6,7 @@ stdenv.mkDerivation rec {
 
   src = fetchurl {
     url = "http://releases.wildfiregames.com/0ad-${version}-alpha-unix-data.tar.xz";
-    sha256 = "1c9zrddmjxvvacismld6fbwbw9vrdbq6g6d3424p8w5p6xg5wlwy";
+    sha256 = "sgDkhVj4goB5EOPGhlZ7ajliSNnUGAROz94JCwV3LX0=";
   };
 
   installPhase = ''

pkgs/games/0ad/game.nix

@@ -2,7 +2,7 @@
 , pkg-config, spidermonkey_78, boost, icu, libxml2, libpng, libsodium
 , libjpeg, zlib, curl, libogg, libvorbis, enet, miniupnpc
 , openal, libGLU, libGL, xorgproto, libX11, libXcursor, nspr, SDL2
-, gloox, nvidia-texture-tools
+, gloox, nvidia-texture-tools, freetype
 , withEditor ? true, wxGTK
 }:
 
@@ -26,11 +26,11 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "0ad";
-  version = "0.0.25b";
+  version = "0.0.26";
 
   src = fetchurl {
     url = "http://releases.wildfiregames.com/0ad-${version}-alpha-unix-build.tar.xz";
-    sha256 = "1p9fa8f7sjb9c5wl3mawzyfqvgr614kdkhrj2k4db9vkyisws3fp";
+    sha256 = "Lhxt9+MxLnfF+CeIZkz/w6eNO/YGBsAAOSdeHRPA7ks=";
   };
 
   nativeBuildInputs = [ python3 perl pkg-config ];
@@ -39,7 +39,7 @@ stdenv.mkDerivation rec {
     spidermonkey_78_6 boost icu libxml2 libpng libjpeg
     zlib curl libogg libvorbis enet miniupnpc openal libidn
     libGLU libGL xorgproto libX11 libXcursor nspr SDL2 gloox
-    nvidia-texture-tools libsodium fmt
+    nvidia-texture-tools libsodium fmt freetype
   ] ++ lib.optional withEditor wxGTK;
 
   NIX_CFLAGS_COMPILE = toString [
@@ -50,14 +50,7 @@ stdenv.mkDerivation rec {
     "-I${fmt.dev}/include"
   ];
 
-  patches = [
-    ./rootdir_env.patch
-    (fetchpatch {
-      # fix build with gcc11 and glibc 2.35
-      url = "https://github.com/0ad/0ad/commit/7df614338cbd41f5e254ce75f649490b2637e1d0.patch";
-      hash = "sha256-QZvcNm8Zni3aJnMPueft0OITf8zeMDXWBjOLYoirJs0=";
-    })
-  ];
+  patches = [ ./rootdir_env.patch ];
 
   configurePhase = ''
     # Delete shipped libraries which we don't need.

pkgs/games/ddnet/default.nix

@@ -30,13 +30,13 @@
 
 stdenv.mkDerivation rec {
   pname = "ddnet";
-  version = "16.3.2";
+  version = "16.4";
 
   src = fetchFromGitHub {
     owner = "ddnet";
     repo = pname;
     rev = version;
-    sha256 = "sha256-VvMcb3Im071MZmOvTOu7zRNKcp5dSJGS3kMvTLD/sFQ=";
+    sha256 = "sha256-8t4UKytYmkELEMQ06jIj7C9cdOc5L22AnigwkGBzx20=";
   };
 
   nativeBuildInputs = [ cmake ninja pkg-config ];

pkgs/games/enyo-launcher/default.nix

@@ -1,14 +1,14 @@
 { mkDerivation, lib, fetchFromGitLab, cmake, qtbase }:
 
 mkDerivation rec {
-  pname = "enyo-doom";
-  version = "2.0.2";
+  pname = "enyo-launcher";
+  version = "2.0.5";
 
   src = fetchFromGitLab {
     owner = "sdcofer70";
-    repo = "enyo-doom";
+    repo = "enyo-launcher";
     rev = version;
-    sha256 = "1s1vpwrrpb9c7r2b0k1j7dlsfasfzmi6prcwql4mxwixrl7f8ms1";
+    sha256 = "sha256-qdVP5QN2t0GK4VBWuFGrnRfgamQDZGRjwaAe6TIK604=";
   };
 
   nativeBuildInputs = [ cmake ];
@@ -16,10 +16,10 @@ mkDerivation rec {
   buildInputs = [ qtbase ];
 
   meta = {
-    homepage = "https://gitlab.com/sdcofer70/enyo-doom";
+    homepage = "https://gitlab.com/sdcofer70/enyo-launcher";
     description = "Frontend for Doom engines";
     license = lib.licenses.gpl3Plus;
     platforms = lib.platforms.unix;
-    maintainers = [ lib.maintainers.tadfisher ];
+    maintainers = [ lib.maintainers.usrfriendly ];
   };
 }

pkgs/servers/amqp/rabbitmq-server/default.nix

@@ -25,6 +25,17 @@
 , nixosTests
 }:
 
+let
+  runtimePath = lib.makeBinPath ([
+    erlang
+    getconf # for getting memory limits
+    socat
+    procps
+    gnused
+    coreutils # used by helper scripts
+  ] ++ lib.optionals stdenv.isLinux [ systemd ]); # for systemd unit activation check
+in
+
 stdenv.mkDerivation rec {
   pname = "rabbitmq-server";
   version = "3.10.8";
@@ -48,15 +59,6 @@ stdenv.mkDerivation rec {
     export LANG=C.UTF-8 # fix elixir locale warning
   '';
 
-  runtimePath = lib.makeBinPath ([
-    erlang
-    getconf # for getting memory limits
-    socat
-    procps
-    gnused
-    coreutils # used by helper scripts
-  ] ++ lib.optionals stdenv.isLinux [ systemd ]); # for systemd unit activation check
-
   postInstall = ''
     # rabbitmq-env calls to sed/coreutils, so provide everything early
     sed -i $out/sbin/rabbitmq-env -e '2s|^|PATH=${runtimePath}\''${PATH:+:}\$PATH/\n|'

pkgs/servers/clickhouse/default.nix

@@ -8,7 +8,7 @@
 
 stdenv.mkDerivation rec {
   pname = "clickhouse";
-  version = "22.3.2.2";
+  version = "22.8.5.29";
 
   broken = stdenv.buildPlatform.is32bit; # not supposed to work on 32-bit https://github.com/ClickHouse/ClickHouse/pull/23959#issuecomment-835343685
 
@@ -17,7 +17,7 @@ stdenv.mkDerivation rec {
     repo   = "ClickHouse";
     rev    = "v${version}-lts";
     fetchSubmodules = true;
-    sha256 = "0rhzgm0gvwpx4h5xyr7y393y7s9slcr4a7grw9316f5m70frxg2v";
+    sha256 = "sha256-JRdZb5YgaumTnjJEYIXh9o3NSv67DAdl9gizVKvGTJI=";
   };
 
   nativeBuildInputs = [ cmake libtool llvm-bintools ninja ];
@@ -45,6 +45,7 @@ stdenv.mkDerivation rec {
 
   cmakeFlags = [
     "-DENABLE_TESTS=OFF"
+    "-DENABLE_CCACHE=0"
     "-DENABLE_EMBEDDED_COMPILER=ON"
     "-USE_INTERNAL_LLVM_LIBRARY=OFF"
   ];
@@ -66,7 +67,7 @@ stdenv.mkDerivation rec {
   passthru.tests.clickhouse = nixosTests.clickhouse;
 
   meta = with lib; {
-    homepage = "https://clickhouse.tech/";
+    homepage = "https://clickhouse.com";
     description = "Column-oriented database management system";
     license = licenses.asl20;
     maintainers = with maintainers; [ orivej ];

pkgs/servers/http/dufs/default.nix

@@ -0,0 +1,32 @@
+{ stdenv, lib, fetchFromGitHub, rustPlatform, Security, openssl, pkg-config }:
+
+rustPlatform.buildRustPackage rec {
+  pname = "dufs";
+  version = "0.30.0";
+
+  src = fetchFromGitHub {
+    owner = "sigoden";
+    repo = pname;
+    rev = "v${version}";
+    sha256 = "sha256-UJ93yUJqxkP+PyUrhKkjV90vr55MemC1zRbzh/gFqPU=";
+  };
+
+  cargoSha256 = "sha256-dyn0wj11MC9NYwULsR6ytYUl+8wsRkVLBIwcgM5mMNQ=";
+
+  nativeBuildInputs = lib.optionals stdenv.isLinux [
+    pkg-config
+  ];
+
+  buildInputs = lib.optionals stdenv.isLinux [
+    openssl
+  ] ++ lib.optionals stdenv.isDarwin [
+    Security
+  ];
+
+  meta = with lib; {
+    description = "A file server that supports static serving, uploading, searching, accessing control, webdav";
+    homepage = "https://github.com/sigoden/dufs";
+    license = with licenses; [ asl20 /* or */ mit ];
+    maintainers = [ maintainers.holymonson ];
+  };
+}

pkgs/servers/irc/ircd-hybrid/default.nix

@@ -2,11 +2,11 @@
 
 stdenv.mkDerivation rec {
   pname = "ircd-hybrid";
-  version = "8.2.42";
+  version = "8.2.43";
 
   src = fetchurl {
     url = "mirror://sourceforge/ircd-hybrid/ircd-hybrid-${version}.tgz";
-    sha256 = "sha256-aS0he/x+o3xOQ5H7hrCpJ4C8MusUT2liM0lyF1W4H2o=";
+    sha256 = "sha256-vQNzx4DjCMGm9piQFf8o4cIpme92S3toY2tihXPCUe8=";
   };
 
   buildInputs = [ openssl zlib ];

pkgs/servers/jellyfin/node-deps.nix

@@ -11817,8 +11817,8 @@ let
   args = {
     name = "jellyfin-web";
     packageName = "jellyfin-web";
-    version = "10.8.4";
-    src = ../../../../../../../nix/store/xhax6fynqk44hhwd647im3jd31dbaw4n-source;
+    version = "10.8.5";
+    src = ../../../../../../../../../nix/store/ab0b3ia5gcmwb7p5kz6dvw456qrdbz91-source;
     dependencies = [
       sources."@ampproject/remapping-2.1.2"
       (sources."@apideck/better-ajv-errors-0.3.3" // {

pkgs/servers/jellyfin/web.nix

@@ -7,13 +7,13 @@
 
 stdenv.mkDerivation rec {
   pname = "jellyfin-web";
-  version = "10.8.4";
+  version = "10.8.5";
 
   src = fetchFromGitHub {
     owner = "jellyfin";
     repo = "jellyfin-web";
     rev = "v${version}";
-    sha256 = "3A2eBwO0Vg0Qgwm0Y04jheu42JpbxL6XtJRkrxSUkGo=";
+    sha256 = "KNIxqZSTO1330KFW8y+4nVFiCM1KEEwEM0Vdei26gVI=";
   };
 
   nativeBuildInputs = [

pkgs/servers/monitoring/mimir/default.nix

@@ -1,13 +1,13 @@
 { lib, buildGoModule, fetchFromGitHub, nixosTests }:
 buildGoModule rec {
   pname = "mimir";
-  version = "2.3.0";
+  version = "2.3.1";
 
   src = fetchFromGitHub {
     rev = "${pname}-${version}";
     owner = "grafana";
     repo = pname;
-    sha256 = "sha256-lLrDgt4WYxyMkwjS8TLTy1agPAo/Z0BtqY9hIYSDyGI=";
+    sha256 = "sha256-2Gg2SYH2cqSKXePEfUAwW4AXpiMGso3FeGTmHRNxtaU=";
   };
 
   vendorSha256 = null;

pkgs/servers/mx-puppet-discord/default.nix

@@ -1,14 +1,17 @@
-{ stdenv, fetchFromGitHub, pkgs, lib, nodejs-14_x, nodePackages, pkg-config, libjpeg
-, pixman, cairo, pango }:
+{ stdenv, fetchFromGitLab, pkgs, lib, nodejs-14_x, pkg-config
+, libjpeg, pixman, cairo, pango, which, postgresql }:
 
 let
   nodejs = nodejs-14_x;
-  # No official version ever released
-  src = fetchFromGitHub {
-    owner = "matrix-discord";
+
+  version = "0.1.1";
+
+  src = fetchFromGitLab {
+    group = "mx-puppet";
+    owner = "discord";
     repo = "mx-puppet-discord";
-    rev = "bb6438a504182a7a64048b992179427587ccfded";
-    sha256 = "0g2p5xwxxgvlnq0fg0x4q9x4asqyppdv6b5z6bvncm62kc70z6xk";
+    rev = "v${version}";
+    hash = "sha256-ZhyjUt6Bz/0R4+Lq/IoY9rNjdwVE2qp4ZQLc684+T/0=";
   };
 
   myNodePackages = import ./node-composition.nix {
@@ -17,25 +20,22 @@ let
   };
 
 in myNodePackages.package.override {
-  pname = "mx-puppet-discord";
-  version = "2021-08-01";
+  inherit version src;
 
-  inherit src;
+  nativeBuildInputs = [ nodejs.pkgs.node-pre-gyp nodejs.pkgs.node-gyp-build pkg-config which ];
+  buildInputs = [ libjpeg pixman cairo pango postgresql ];
 
-  nativeBuildInputs = [ nodePackages.node-pre-gyp pkg-config ];
-  buildInputs = [ libjpeg pixman cairo pango ];
+  postRebuild = ''
+    # Build typescript stuff
+    npm run build
+  '';
 
   postInstall = ''
-    # Patch shebangs in node_modules, otherwise the webpack build fails with interpreter problems
-    patchShebangs --build "$out/lib/node_modules/mx-puppet-discord/node_modules/"
-    # compile Typescript sources
-    npm run build
-
     # Make an executable to run the server
     mkdir -p $out/bin
     cat <<EOF > $out/bin/mx-puppet-discord
     #!/bin/sh
-    exec ${nodejs}/bin/node $out/lib/node_modules/mx-puppet-discord/build/index.js "\$@"
+    exec ${nodejs}/bin/node $out/lib/node_modules/@mx-puppet/discord/build/index.js "\$@"
     EOF
     chmod +x $out/bin/mx-puppet-discord
   '';
@@ -43,7 +43,7 @@ in myNodePackages.package.override {
   meta = with lib; {
     description = "A discord puppeting bridge for matrix";
     license = licenses.asl20;
-    homepage = "https://github.com/matrix-discord/mx-puppet-discord";
+    homepage = "https://gitlab.com/mx-puppet/discord/mx-puppet-discord";
     maintainers = with maintainers; [ expipiplus1 ];
     platforms = platforms.unix;
   };

pkgs/servers/mx-puppet-discord/generate.sh

@@ -1,22 +1,24 @@
 #!/usr/bin/env nix-shell
 #! nix-shell -i bash -p nodePackages.node2nix
 
-# No official release
-rev=bb6438a504182a7a64048b992179427587ccfded
-u=https://raw.githubusercontent.com/matrix-discord/mx-puppet-discord/$rev
-# Download package.json and package-lock.json
-curl -O $u/package.json
-curl $u/package-lock.json |
-  sed -e 's|git+ssh://git@|git+https://|g' > package-lock.json
+tag="v0.1.1"
+u="https://gitlab.com/mx-puppet/discord/mx-puppet-discord/-/raw/$tag"
+# Download package.json and patch in @discordjs/opus optional dependency
+curl $u/package.json |
+    sed 's|"typescript": *"\^\?3\.[^"]*"|"typescript": "^4.8.3"|' |  # TODO: remove when newer typescript version pinned
+    sed 's|\("dependencies": *{\)|\1\n"@discordjs/opus": "^0.8.0",|' >package.json
 
 node2nix \
   --nodejs-14 \
   --node-env ../../development/node-packages/node-env.nix \
   --input package.json \
-  --lock package-lock.json \
+  --strip-optional-dependencies \
   --output node-packages.nix \
-  --composition node-composition.nix
+  --composition node-composition.nix \
+  --registry https://registry.npmjs.org \
+  --registry https://gitlab.com/api/v4/packages/npm \
+  --registry-scope '@mx-puppet'
 
 sed -i 's|<nixpkgs>|../../..|' node-composition.nix
 
-rm -f package.json package-lock.json
+rm -f package.json

pkgs/servers/mx-puppet-discord/node-composition.nix

@@ -1,4 +1,4 @@
-# This file has been generated by node2nix 1.9.0. Do not edit!
+# This file has been generated by node2nix 1.11.1. Do not edit!
 
 {pkgs ? import ../../.. {
     inherit system;

pkgs/servers/varnish/default.nix

@@ -1,5 +1,5 @@
 { lib, stdenv, fetchurl, fetchpatch, pcre, pcre2, jemalloc, libxslt, groff, ncurses, pkg-config, readline, libedit
-, coreutils, python3, makeWrapper }:
+, coreutils, python3, makeWrapper, nixosTests }:
 
 let
   common = { version, hash, extraNativeBuildInputs ? [] }:
@@ -12,8 +12,6 @@ let
         inherit hash;
       };
 
-      passthru.python = python3;
-
       nativeBuildInputs = with python3.pkgs; [ pkg-config docutils sphinx makeWrapper];
       buildInputs = [
         libxslt groff ncurses readline libedit python3
@@ -37,6 +35,11 @@ let
 
       outputs = [ "out" "dev" "man" ];
 
+      passthru = {
+        python = python3;
+        tests = nixosTests."varnish${builtins.replaceStrings [ "." ] [ "" ] (lib.versions.majorMinor version)}";
+      };
+
       meta = with lib; {
         broken = stdenv.isDarwin;
         description = "Web application accelerator also known as a caching HTTP reverse proxy";
@@ -48,12 +51,19 @@ let
     };
 in
 {
+  # EOL TBA
   varnish60 = common {
     version = "6.0.10";
     hash = "sha256-a4W/dI7jeaoI43UE+G6tS6fgzEDqsXI8CUv+Wh4HJus=";
   };
+  # EOL 2023-03-15. TODO: remove ahead of 22.11 release? if not, remove for 23.05
   varnish71 = common {
     version = "7.1.1";
     hash = "sha256-LK++JZDn1Yp7rIrZm+kuRA/k04raaBbdiDbyL6UToZA=";
   };
+  # EOL 2023-09-15
+  varnish72 = common {
+    version = "7.2.0";
+    hash = "sha256-HaipftX3t9TV4E/FyW/JqFyzog0HbrorGJUfSzBsloY=";
+  };
 }

pkgs/servers/varnish/modules.nix

@@ -41,8 +41,8 @@ in
     version = "0.15.1";
     sha256 = "1lwgjhgr5yw0d17kbqwlaj5pkn70wvaqqjpa1i0n459nx5cf5pqj";
   };
-  modules19 = common {
-    version = "0.19.0";
-    sha256 = "0qq5g6bbd1a1ml1wk8jj9z39a899jzqbf7aizr3pvyz0f4kz8mis";
+  modules20 = common {
+    version = "0.20.0";
+    sha256 = "sha256-3eH3qCa24rWqYXsTTDmm/9LjBMxcxUuozuRzZ3e8cUo=";
   };
 }

pkgs/servers/varnish/packages.nix

@@ -1,4 +1,4 @@
-{ callPackages, callPackage, varnish60, varnish71, fetchFromGitHub }: {
+{ callPackages, callPackage, varnish60, varnish71, varnish72, fetchFromGitHub }: {
   varnish60Packages = rec {
     varnish = varnish60;
     modules = (callPackages ./modules.nix { inherit varnish; }).modules15;
@@ -15,7 +15,7 @@
   };
   varnish71Packages = rec {
     varnish = varnish71;
-    modules = (callPackages ./modules.nix { inherit varnish; }).modules19;
+    modules = (callPackages ./modules.nix { inherit varnish; }).modules20;
     digest  = callPackage ./digest.nix {
       inherit varnish;
       version = "6.6";
@@ -27,4 +27,8 @@
       sha256 = "1g53zblyxi1jivwppmpdqhi5xnzapsfib453sxyqbc5dfs7fijxr";
     };
   };
+  varnish72Packages = rec {
+    varnish = varnish72;
+    modules = (callPackages ./modules.nix { inherit varnish; }).modules20;
+  };
 }

pkgs/servers/web-apps/freshrss/default.nix

@@ -0,0 +1,38 @@
+{ stdenvNoCC, lib, fetchFromGitHub, nixosTests, pkgs }:
+
+stdenvNoCC.mkDerivation rec {
+  pname = "FreshRSS";
+  version = "1.20.0";
+
+  src = fetchFromGitHub {
+    owner = "FreshRSS";
+    repo = "FreshRSS";
+    rev = version;
+    hash = "sha256-mzhEw2kFv77SmeuEx66n9ujWMscZO3+03tHimk1/vk4=";
+  };
+
+  passthru.tests = nixosTests.freshrss;
+
+  # There's nothing to build.
+  dontBuild = true;
+
+  # the data folder is no in this package and thereby declared by an env-var
+  overrideConfig = pkgs.writeText "constants.local.php" ''
+    <?php
+      define('DATA_PATH', getenv('FRESHRSS_DATA_PATH'));
+  '';
+
+  installPhase = ''
+    mkdir -p $out
+    cp -vr * $out/
+
+    cp $overrideConfig $out/constants.local.php
+  '';
+
+  meta = with lib; {
+    description = "FreshRSS is a free, self-hostable RSS aggregator";
+    homepage = "https://www.freshrss.org/";
+    license = licenses.agpl3Plus;
+    maintainers = with maintainers; [ etu stunkymonkey ];
+  };
+}