chore: update sources

Flake Inputs:
    • Updated input 'ags':
        'github:Aylur/ags' (2025-01-12) rev: 90db9b9fecc0f4228440d83107c6c745a35e7d77
      → 'github:Aylur/ags' (2025-01-18) rev: 92bdcb227dc390e2edb122b5bb182b38456b6a5e

    • Updated input 'astal':
        'github:Aylur/astal' (2025-01-16) rev: bc796ac226800c43e724e27f53f410c157acaffe
      → 'github:Aylur/astal' (2025-01-18) rev: 8b8416101246b4cce569f4326f828e26f15f6616

    • Updated input 'custom-sidebar-src':
        'github:elchininet/custom-sidebar' (2025-01-14) rev: 2861df235213e2cdbabddd41ecdf41b57ab5f33c
      → 'github:elchininet/custom-sidebar' (2025-01-18) rev: f658990328f47530097ab0242a5575cbba92b9ea

    • Updated input 'gpu-screen-recorder-src':
        'git+https://repo.dec05eba.com/gpu-screen-recorder' (2025-01-13) rev: 4211dfa2f8649d724f4d08f382dba7ffc7af59f9
      → 'git+https://repo.dec05eba.com/gpu-screen-recorder' (2025-01-18) rev: bae0fdd9498c844f27d1aac6a072360f785c8e14

    • Updated input 'home-manager':
        'github:nix-community/home-manager' (2025-01-14) rev: 0dfec9deb275854a56c97c356c40ef72e3a2e632
      → 'github:nix-community/home-manager' (2025-01-18) rev: 97d7946b5e107dd03cc82f21165251d4e0159655

    • Updated input 'hyprgrass':
        'github:horriblename/hyprgrass' (2025-01-13) rev: d324904d70e8c9710bcf772227f364262baf3820
      → 'github:horriblename/hyprgrass' (2025-01-18) rev: ea3a6079a7e34235ee3df4b600ee11e48b0e7f4d

    • Updated input 'hyprland':
        'github:hyprwm/Hyprland' (2025-01-16) rev: 0dc7367a7006cc3cc877d52bf34c4998144bff84
      → 'github:hyprwm/Hyprland' (2025-01-18) rev: f56153a9c1b0a00fac0932a95e0cfa5a4f6c681f

    • Updated input 'hyprland-plugins':
        'github:hyprwm/hyprland-plugins' (2025-01-08) rev: b4c0fa3ebc6ccd1589dcd17904652223088efede
      → 'github:hyprwm/hyprland-plugins' (2025-01-17) rev: d2dad5b434b338d18458bafa506f2993c13f24fc

    • Updated input 'jovian':
        'github:Jovian-Experiments/Jovian-NixOS' (2025-01-16) rev: 6bbb19666e753c18ef8af35f590cbc3ba42dd0ca
      → 'github:Jovian-Experiments/Jovian-NixOS' (2025-01-17) rev: 27a0ddac1a14e10ba98530f59db728951495f2ce

    • Updated input 'material-rounded-theme-src':
        'github:Nerwyn/material-rounded-theme' (2025-01-11) rev: 6d3b79a79b72f70c4a015dd7dbbf1c41a2b33a35
      → 'github:Nerwyn/material-rounded-theme' (2025-01-17) rev: 7c69a1f03e424ab2485345e5f38ffc5264ead375

    • Updated input 'nix-gaming':
        'github:fufexan/nix-gaming' (2025-01-14) rev: 1a9c52cd7517137c9cc74d4b73dfd63678e17c5f
      → 'github:fufexan/nix-gaming' (2025-01-19) rev: bcc7d7ccdc82e63ab261ddea67e1db1d6091c35a

    • Updated input 'nix-index-db':
        'github:Mic92/nix-index-database' (2025-01-12) rev: 271e5bd7c57e1f001693799518b10a02d1123b12
      → 'github:Mic92/nix-index-database' (2025-01-19) rev: 744d330659e207a1883d2da0141d35e520eb87bd

    • Updated input 'nixcord':
        'github:kaylorben/nixcord' (2025-01-16) rev: 02247bedd6988a1169c4499406970b92bfd8aa02
      → 'github:kaylorben/nixcord' (2025-01-17) rev: 4e76614d89940ef47fe099a0bec2c479dbf0bd34

    • Updated input 'nixpkgs':
        'github:NixOS/nixpkgs' (2025-01-14) rev: eb62e6aa39ea67e0b8018ba8ea077efe65807dc8
      → 'github:NixOS/nixpkgs' (2025-01-18) rev: b681ff2c9c9163f24ca705d948bb0cee1b3e09f9

    • Updated input 'sops-nix':
        'github:Mic92/sops-nix' (2025-01-13) rev: 553c7cb22fed19fd60eb310423fdc93045c51ba8
      → 'github:Mic92/sops-nix' (2025-01-17) rev: 4c4fb93f18b9072c6fa1986221f9a3d7bf1fe4b6

    • Updated input 'tuya-local-src':
        'github:make-all/tuya-local' (2025-01-16) rev: cd29ab1b42337a123f4398666e800912637e0c5e
      → 'github:make-all/tuya-local' (2025-01-19) rev: 15ac106e35d075deb7688b9687d637db9fcb1203

Docker Images:
    • nextcloud fpm:
       sha256:4f6026de2b9cf007bcd01298a86cae2fd5837cbef9d8aa3224454ff80ecac577
     → sha256:4c898a6e3a17fcd3bcbe9d2450079a95581cfb9f0dbfca246c39bd60c77d123b

Firefox Addons:
    ublock-origin: 1.61.2 -> 1.62.0

Node modules:
    eslint-plugin-jsdoc: 50.6.1 -> 50.6.2

_outputs.nix

@@ -11,7 +11,8 @@
       nixpkgs = mkInput {
         owner = "NixOS";
         repo = "nixpkgs";
-        ref = "nixos-unstable";
+        # FIXME: https://pr-tracker.nelim.org/?pr=374780
+        ref = "nixos-unstable-small";
       };
 
       home-manager = mkDep {

apps/config/package.json

@@ -7,7 +7,7 @@
         "@eslint/js": "9.18.0",
         "@stylistic/eslint-plugin": "2.13.0",
         "eslint": "9.18.0",
-        "eslint-plugin-jsdoc": "50.6.1",
+        "eslint-plugin-jsdoc": "50.6.2",
         "jiti": "2.4.2",
         "pkg-types": "1.3.1",
         "typescript": "5.7.3",

apps/extract-subs/default.nix

@@ -5,7 +5,7 @@
 }:
 buildApp {
   src = ./.;
-  npmDepsHash = "sha256-7UhA8oj+AES+YUrbNJZHQ5SdkzSpcjh7YP8f2WiA3qc=";
+  npmDepsHash = "sha256-vShyulD7uKHE4Oxz8Xy8HdGJpMbF5kQYlHZlQtIcKIA=";
 
   runtimeInputs = [
     ffmpeg-full

apps/update-sources/default.nix

@@ -9,7 +9,7 @@
 }:
 buildApp {
   src = ./.;
-  npmDepsHash = "sha256-G2NxC//C8254ZBNep/WWfFUXmFCWR0x8pLeqiUY1ddY=";
+  npmDepsHash = "sha256-k4m8fSF0zOznebbH87p8IPP2SzRR9siVFYBU5Cfs2T0=";
 
   runtimeInputs = [
     go

configurations/nos/modules/docker/nextcloud/images/nextcloud.nix

@@ -1,8 +1,8 @@
 pkgs:
 pkgs.dockerTools.pullImage rec {
   imageName = "nextcloud";
-  imageDigest = "sha256:4f6026de2b9cf007bcd01298a86cae2fd5837cbef9d8aa3224454ff80ecac577";
+  imageDigest = "sha256:4c898a6e3a17fcd3bcbe9d2450079a95581cfb9f0dbfca246c39bd60c77d123b";
-  hash = "sha256-Urcuc1xkwDeJo9BjRT9vz3wMr/v/Lfn7o11HALowuKU=";
+  hash = "sha256-kK4F6UQVJm+r98/FH5uMG7VyVm5zzzmA7smc3IoDpFI=";
   finalImageName = imageName;
   finalImageTag = "fpm";
 }

inputs/default.nix

@@ -139,6 +139,9 @@ let
       hyprgrass = mkHyprDep {
         owner = "horriblename";
         repo = "hyprgrass";
+
+        # FIXME: https://github.com/horriblename/hyprgrass/pull/203
+        rev = "ea3a6079a7e34235ee3df4b600ee11e48b0e7f4d";
       };
 
       hyprpaper = mkDep {
@@ -161,9 +164,6 @@ let
       nixcord = mkDep {
         owner = "kaylorben";
         repo = "nixcord";
-
-        # FIXME: https://github.com/KaylorBen/nixcord/pull/69
-        rev = "02247bedd6988a1169c4499406970b92bfd8aa02";
       };
     };
 

modules/ags/config/default.nix

@@ -1,3 +1,3 @@
 {
-  npmDepsHash = "sha256-ahAL1uY79aq39acXSr0eSYcDQH7z3eqBtzWq+6lc+MI=";
+  npmDepsHash = "sha256-mt2SERYy7u7EicYbROfSccb9krE8wtQ/fPioQOI4wYk=";
 }

modules/ags/config/package.json

@@ -7,7 +7,7 @@
         "@eslint/js": "9.18.0",
         "@stylistic/eslint-plugin": "2.13.0",
         "eslint": "9.18.0",
-        "eslint-plugin-jsdoc": "50.6.1",
+        "eslint-plugin-jsdoc": "50.6.2",
         "fzf": "0.5.2",
         "jiti": "2.4.2",
         "typescript-eslint": "8.20.0"

modules/wyoming-plus/default.nix

@@ -6,7 +6,7 @@
 }: let
   inherit (lib) getExe mkOption types;
   inherit (lib.modules) mkForce mkIf mkOverride;
-  inherit (lib.strings) concatMapStringsSep concatStringsSep;
+  inherit (lib.strings) concatMapStringsSep concatStringsSep escapeShellArgs;
 
   cfg = config.services.wyoming;
 
@@ -20,11 +20,15 @@ in {
 
   config = {
     systemd.services = mkIf (cfg.openwakeword.enable) {
-      wyoming-openwakeword.serviceConfig = {
+      # For some reason I can't just override `ExecStart` anymore.
-        MemoryDenyWriteExecute = mkForce (cfg.openwakeword.package != forkedPkg);
+      wyoming-openwakeword.serviceConfig = mkForce {
+        DynamicUser = true;
+        User = "wyoming-openwakeword";
+
+        MemoryDenyWriteExecute = cfg.openwakeword.package != forkedPkg;
 
         # changes according to https://github.com/rhasspy/wyoming-openwakeword/pull/27
-        ExecStart = mkForce (concatStringsSep " " [
+        ExecStart = concatStringsSep " " [
           (getExe cfg.openwakeword.package)
 
           "--uri ${cfg.openwakeword.uri}"
@@ -40,8 +44,37 @@ in {
             (model: "--preload-model ${model}")
             cfg.openwakeword.preloadModels)
 
-          cfg.openwakeword.extraArgs
+          (escapeShellArgs cfg.openwakeword.extraArgs)
-        ]);
+        ];
+
+        CapabilityBoundingSet = "";
+        DeviceAllow = "";
+        DevicePolicy = "closed";
+        LockPersonality = true;
+        PrivateDevices = true;
+        PrivateUsers = true;
+        ProtectHome = true;
+        ProtectHostname = true;
+        ProtectKernelLogs = true;
+        ProtectKernelModules = true;
+        ProtectKernelTunables = true;
+        ProtectControlGroups = true;
+        ProtectProc = "invisible";
+        ProcSubset = "all"; # reads /proc/cpuinfo
+        RestrictAddressFamilies = [
+          "AF_INET"
+          "AF_INET6"
+          "AF_UNIX"
+        ];
+        RestrictNamespaces = true;
+        RestrictRealtime = true;
+        RuntimeDirectory = "wyoming-openwakeword";
+        SystemCallArchitectures = "native";
+        SystemCallFilter = [
+          "@system-service"
+          "~@privileged"
+        ];
+        UMask = "0077";
       };
     };
 

overlays/build-failures/default.nix

@@ -1,4 +1,8 @@
 final: prev: {
   # FIXME: https://pr-tracker.nelim.org/?pr=357699
   nodejs_latest = prev.nodejs_22;
+
+  wyoming-faster-whisper = prev.wyoming-faster-whisper.overridePythonAttrs (o: {
+    meta = {mainProgram = o.pname;} // o.meta;
+  });
 }

scopedPackages/firefox-addons/generated-firefox-addons.nix

@@ -326,10 +326,10 @@
   };
   "ublock-origin" = buildFirefoxXpiAddon {
     pname = "ublock-origin";
-    version = "1.61.2";
+    version = "1.62.0";
     addonId = "uBlock0@raymondhill.net";
-    url = "https://addons.mozilla.org/firefox/downloads/file/4391011/ublock_origin-1.61.2.xpi";
+    url = "https://addons.mozilla.org/firefox/downloads/file/4412673/ublock_origin-1.62.0.xpi";
-    sha256 = "ee3a724a46ff32c17d1723077fecc6ede7fdab742154020b51fb6253ddcbba14";
+    sha256 = "8a9e02aa838c302fb14e2b5bc88a6036d36358aadd6f95168a145af2018ef1a3";
     meta = with lib; {
       homepage = "https://github.com/gorhill/uBlock#ublock-origin";
       description = "Finally, an efficient wide-spectrum content blocker. Easy on CPU and memory.";

scopedPackages/lovelace-components/custom-sidebar/default.nix

@@ -30,7 +30,7 @@ in
 
     pnpmDeps = pnpm.fetchDeps {
       inherit (finalAttrs) pname version src;
-      hash = "sha256-7cVWjyRZXd7xUZsgRNRYPfAap3LGH5VbLzvi2ocbkwc=";
+      hash = "sha256-NOqEnqdJ/FrgyFNdU5hG/Im8HMltWxv6DrabxAsHl6I=";
     };
 
     passthru.update = concatTextFile {

scopedPackages/lovelace-components/material-rounded-theme/default.nix

@@ -15,7 +15,7 @@ in
       substituteInPlace ./webpack.config.js --replace-fail "git branch --show-current" "echo main"
     '';
 
-    npmDepsHash = "sha256-BlG/IuyJpigw6twUoaxJ5a970JfwBb75FuwgtH4xrCw=";
+    npmDepsHash = "sha256-Vn4OBTM9MoS0LuU4nDYebncvD6wKmfcLP3gHh0CyfaM=";
 
     installPhase = ''
       mkdir $out