Merge remote-tracking branch 'origin/staging-next' into staging

ci/OWNERS

@@ -372,6 +372,10 @@ pkgs/development/python-modules/buildcatrust/ @ajs124 @lukegb @mweinelt
 # LuaPackages
 /pkgs/development/lua-modules         @NixOS/lua
 
+# mpvScripts
+/pkgs/applications/video/mpv/scripts            @uninsane
+/pkgs/applications/video/mpv/scripts.nix        @uninsane
+
 # Neovim
 /pkgs/applications/editors/neovim      @NixOS/neovim
 

doc/README.md

@@ -213,6 +213,10 @@ Put each sentence in its own line.
 This makes reviews and suggestions much easier, since GitHub's review system is based on lines.
 It also helps identifying long sentences at a glance.
 
+Not everything has been migrated to this format yet.
+Please always use it for new content.
+When changing existing content, update formatting if possible, but avoid excessive diffs.
+
 ### Writing Function Documentation
 
 Function documentation is *reference documentation*, for which

doc/contributing/contributing-to-documentation.chapter.md

@@ -1,11 +1,3 @@
 # Contributing to Nixpkgs documentation {#chap-contributing}
 
 This section has been moved to [doc/README.md](https://github.com/NixOS/nixpkgs/blob/master/doc/README.md).
-
-## devmode {#sec-contributing-devmode}
-
-This section has been moved to [doc/README.md](https://github.com/NixOS/nixpkgs/blob/master/doc/README.md).
-
-## Syntax {#sec-contributing-markup}
-
-This section has been moved to [doc/README.md](https://github.com/NixOS/nixpkgs/blob/master/doc/README.md).

doc/doc-support/package.nix

@@ -157,7 +157,7 @@ stdenvNoCC.mkDerivation (
             buildArgs = toString ../.;
             open = "/share/doc/nixpkgs/index.html";
           };
-          nixos-render-docs-redirects' = writeShellScriptBin "redirects" "${lib.getExe nixos-render-docs-redirects} --file ${toString ../redirects.json} $@";
+          nixos-render-docs-redirects' = writeShellScriptBin "redirects" ''${lib.getExe nixos-render-docs-redirects} --file '${toString ../redirects.json}' "$@"'';
         in
         mkShellNoCC {
           packages = [

doc/redirects.json

@@ -4663,12 +4663,8 @@
     "index.html#reviewing-contributions--merging-pull-requests"
   ],
   "chap-contributing": [
-    "index.html#chap-contributing"
-  ],
-  "sec-contributing-devmode": [
-    "index.html#sec-contributing-devmode"
-  ],
-  "sec-contributing-markup": [
+    "index.html#chap-contributing",
+    "index.html#sec-contributing-devmode",
     "index.html#sec-contributing-markup"
   ],
   "part-interoperability": [

maintainers/maintainer-list.nix

@@ -4010,6 +4010,12 @@
     name = "Builditluc";
     keys = [ { fingerprint = "FF16E475723B8C1E57A6B2569374074AE2D6F20E"; } ];
   };
+  burdzwastaken = {
+    email = "burdz@burdz.net";
+    github = "burdzwastaken";
+    githubId = 13855668;
+    name = "Matt Burdan";
+  };
   burmudar = {
     email = "william.bezuidenhout@gmail.com";
     github = "burmudar";

nixos/doc/manual/contributing-to-this-manual.chapter.md

@@ -1,7 +1,7 @@
 # Contributing to this manual {#chap-contributing}
 
 The sources of the NixOS manual are in the [nixos/doc/manual](https://github.com/NixOS/nixpkgs/tree/master/nixos/doc/manual) subdirectory of the [Nixpkgs](https://github.com/NixOS/nixpkgs) repository.
-This manual uses the [Nixpkgs manual syntax](https://nixos.org/manual/nixpkgs/unstable/#sec-contributing-markup).
+This manual uses the [Nixpkgs manual syntax](https://github.com/NixOS/nixpkgs/blob/master/doc/README.md#syntax) and [stylistic conventions](https://github.com/NixOS/nixpkgs/blob/master/doc/README.md#documentation-conventions).
 
 You can quickly check your edits with the following:
 
@@ -13,8 +13,6 @@ $ nix-build nixos/release.nix -A manual.x86_64-linux
 
 If the build succeeds, the manual will be in `./result/share/doc/nixos/index.html`.
 
-There's also [a convenient development daemon](https://nixos.org/manual/nixpkgs/unstable/#sec-contributing-devmode).
-
 The above instructions don't deal with the appendix of available `configuration.nix` options, and the manual pages related to NixOS. These are built, and written in a different location and in a different format, as explained in the next sections.
 
 ## Development environment {#sec-contributing-development-env}

nixos/doc/manual/release-notes/rl-2605.section.md

@@ -18,6 +18,8 @@
 
 - [ImmichFrame](https://immichframe.dev/), display your photos from Immich as a digital photo frame. Available as `services.immichframe`.
 
+- [reaction](https://reaction.ppom.me/), a daemon that scans program outputs for repeated patterns, and takes action. A common usage is to scan ssh and webserver logs, and to ban hosts that cause multiple authentication errors. A modern alternative to fail2ban. Available as [services.reaction](#opt-services.reaction.enable).
+
 - [LibreChat](https://www.librechat.ai/), open-source self-hostable ChatGPT clone with Agents and RAG APIs. Available as [services.librechat](#opt-services.librechat.enable).
 
 - [DankMaterialShell](https://danklinux.com), a complete desktop shell for Wayland compositors built with Quickshell. Available as [programs.dms-shell](#opt-programs.dms-shell.enable).

nixos/doc/manual/shell.nix

@@ -10,7 +10,7 @@ let
     buildArgs = ''${toString ../../release.nix} -A manualHTML.${builtins.currentSystem}'';
     open = "/${outputPath}/${indexPath}";
   };
-  nixos-render-docs-redirects = pkgs.writeShellScriptBin "redirects" "${pkgs.lib.getExe pkgs.nixos-render-docs-redirects} --file ${toString ./redirects.json} $@";
+  nixos-render-docs-redirects = pkgs.writeShellScriptBin "redirects" ''${pkgs.lib.getExe pkgs.nixos-render-docs-redirects} --file '${toString ./redirects.json}' "$@"'';
 in
 pkgs.mkShellNoCC {
   packages = [

nixos/modules/module-list.nix

@@ -1499,6 +1499,7 @@
   ./services/security/pass-secret-service.nix
   ./services/security/physlock.nix
   ./services/security/pocket-id.nix
+  ./services/security/reaction.nix
   ./services/security/shibboleth-sp.nix
   ./services/security/sks.nix
   ./services/security/sshguard.nix

nixos/modules/programs/wayland/niri.nix

@@ -43,10 +43,16 @@ in
         xdg.portal = {
           enable = lib.mkDefault true;
 
-          configPackages = [ cfg.package ];
-
-          config.niri = lib.mkIf (!cfg.useNautilus) {
-            "org.freedesktop.impl.portal.FileChooser" = lib.mkDefault "gtk";
+          # NOTE: `configPackages` is ignored when `xdg.portal.config.niri` is defined.
+          config.niri = {
+            default = [
+              "gnome"
+              "gtk"
+            ];
+            "org.freedesktop.impl.portal.Access" = "gtk";
+            "org.freedesktop.impl.portal.FileChooser" = lib.mkIf (!cfg.useNautilus) "gtk";
+            "org.freedesktop.impl.portal.Notification" = "gtk";
+            "org.freedesktop.impl.portal.Secret" = "gnome-keyring";
           };
 
           # Recommended by upstream, required for screencast support

nixos/modules/services/continuous-integration/woodpecker/server.nix

@@ -61,7 +61,7 @@ in
           UMask = "0007";
           ConfigurationDirectory = "woodpecker-server";
           EnvironmentFile = cfg.environmentFile;
-          ExecStart = "${cfg.package}/bin/woodpecker-server";
+          ExecStart = lib.getExe cfg.package;
           Restart = "on-failure";
           RestartSec = 15;
           CapabilityBoundingSet = "";

nixos/modules/services/misc/jellyfin.nix

@@ -129,6 +129,7 @@ in
           ];
 
           # Security options:
+          CapabilityBoundingSet = [ "" ];
           NoNewPrivileges = true;
           SystemCallArchitectures = "native";
           # AF_NETLINK needed because Jellyfin monitors the network connection
@@ -141,11 +142,15 @@ in
           RestrictNamespaces = !config.boot.isContainer;
           RestrictRealtime = true;
           RestrictSUIDSGID = true;
+          ProcSubset = "pid";
           ProtectControlGroups = !config.boot.isContainer;
+          ProtectClock = true;
           ProtectHostname = true;
           ProtectKernelLogs = !config.boot.isContainer;
           ProtectKernelModules = !config.boot.isContainer;
           ProtectKernelTunables = !config.boot.isContainer;
+          ProtectProc = "invisible";
+          ProtectSystem = true;
           LockPersonality = true;
           PrivateTmp = !config.boot.isContainer;
           # needed for hardware acceleration
@@ -154,21 +159,8 @@ in
           RemoveIPC = true;
 
           SystemCallFilter = [
-            "~@clock"
-            "~@aio"
-            "~@chown"
-            "~@cpu-emulation"
-            "~@debug"
-            "~@keyring"
-            "~@memlock"
-            "~@module"
-            "~@mount"
-            "~@obsolete"
+            "@system-service"
             "~@privileged"
-            "~@raw-io"
-            "~@reboot"
-            "~@setuid"
-            "~@swap"
           ];
           SystemCallErrorNumber = "EPERM";
         };

nixos/modules/services/network-filesystems/moosefs.nix

@@ -66,6 +66,7 @@ let
   masterCfg = settingsFormat.generate "mfsmaster.cfg" cfg.master.settings;
   metaloggerCfg = settingsFormat.generate "mfsmetalogger.cfg" cfg.metalogger.settings;
   chunkserverCfg = settingsFormat.generate "mfschunkserver.cfg" cfg.chunkserver.settings;
+  guiCfg = settingsFormat.generate "mfsgui.cfg" cfg.cgiserver.settings;
 
   systemdService = name: extraConfig: configFile: {
     wantedBy = [ "multi-user.target" ];
@@ -203,8 +204,8 @@ in
 
       cgiserver = {
         enable = lib.mkEnableOption ''
-          MooseFS CGI server for web interface.
-          Warning: The CGI server interface should be properly secured from unauthorized access,
+          MooseFS GUI server (mfsgui) for web interface.
+          Warning: The GUI server interface should be properly secured from unauthorized access,
           as it provides full control over your MooseFS installation.
         '';
 
@@ -218,21 +219,27 @@ in
           type = lib.types.submodule {
             freeformType = settingsFormat.type;
             options = {
-              BIND_HOST = lib.mkOption {
+              DATA_PATH = lib.mkOption {
                 type = lib.types.str;
-                default = "0.0.0.0";
-                description = "IP address to bind CGI server to.";
+                default = "/var/lib/mfs";
+                description = "Directory for lock files.";
               };
 
-              PORT = lib.mkOption {
+              GUISERV_LISTEN_HOST = lib.mkOption {
+                type = lib.types.str;
+                default = "*";
+                description = "IP address to bind GUI server to (* means any).";
+              };
+
+              GUISERV_LISTEN_PORT = lib.mkOption {
                 type = lib.types.port;
                 default = 9425;
-                description = "Port for CGI server to listen on.";
+                description = "Port for GUI server to listen on.";
               };
             };
           };
           default = { };
-          description = "CGI server configuration options.";
+          description = "GUI server configuration options.";
         };
       };
     };
@@ -249,22 +256,17 @@ in
         || cfg.cgiserver.enable
       )
       {
-        warnings = [ (lib.mkIf (!cfg.runAsUser) "Running MooseFS services as root is not recommended.") ];
+        warnings = [
+          (lib.mkIf (!cfg.runAsUser) "Running MooseFS services as root is not recommended.")
+        ];
 
         services.moosefs = {
-          master.settings = lib.mkIf cfg.master.enable (
-            lib.mkMerge [
-              {
-                WORKING_USER = mfsUser;
-                EXPORTS_FILENAME = toString (
-                  pkgs.writeText "mfsexports.cfg" (lib.concatStringsSep "\n" cfg.master.exports)
-                );
-              }
-              (lib.mkIf cfg.cgiserver.enable {
-                MFSCGISERV = toString cfg.cgiserver.settings.PORT;
-              })
-            ]
-          );
+          master.settings = lib.mkIf cfg.master.enable {
+            WORKING_USER = mfsUser;
+            EXPORTS_FILENAME = toString (
+              pkgs.writeText "mfsexports.cfg" (lib.concatStringsSep "\n" cfg.master.exports)
+            );
+          };
 
           metalogger.settings = lib.mkIf cfg.metalogger.enable {
             WORKING_USER = mfsUser;
@@ -278,6 +280,10 @@ in
               pkgs.writeText "mfshdd.cfg" (lib.concatStringsSep "\n" cfg.chunkserver.hdds)
             );
           };
+
+          cgiserver.settings = lib.mkIf cfg.cgiserver.enable {
+            WORKING_USER = mfsUser;
+          };
         };
 
         users =
@@ -305,7 +311,9 @@ in
             9421
           ])
           (lib.optional cfg.chunkserver.openFirewall 9422)
-          (lib.optional (cfg.cgiserver.enable && cfg.cgiserver.openFirewall) cfg.cgiserver.settings.PORT)
+          (lib.optional (
+            cfg.cgiserver.enable && cfg.cgiserver.openFirewall
+          ) cfg.cgiserver.settings.GUISERV_LISTEN_PORT)
         ];
 
         systemd.tmpfiles.rules = [
@@ -317,6 +325,9 @@ in
 
           # Chunkserver directories
           (lib.optionalString cfg.chunkserver.enable "d ${cfg.chunkserver.settings.DATA_PATH} 0700 ${mfsUser} ${mfsUser} -")
+
+          # GUI server directories
+          (lib.optionalString cfg.cgiserver.enable "d ${cfg.cgiserver.settings.DATA_PATH} 0700 ${mfsUser} ${mfsUser} -")
         ]
         ++ lib.optionals (cfg.chunkserver.enable && cfg.chunkserver.hdds != null) (
           map (dir: "d ${dir} 0755 ${mfsUser} ${mfsUser} -") cfg.chunkserver.hdds
@@ -355,19 +366,26 @@ in
 
           (lib.mkIf cfg.cgiserver.enable {
             mfs-cgiserv = {
-              description = "MooseFS CGI Server";
+              description = "MooseFS GUI Server";
               wantedBy = [ "multi-user.target" ];
               after = [ "mfs-master.service" ];
 
+              path = [
+                pkgs.bash
+                pkgs.coreutils
+                pkgs.python3
+              ];
+
               serviceConfig = {
                 Type = "simple";
-                ExecStart = "${pkgs.moosefs}/bin/mfscgiserv -D /var/lib/mfs -f start";
-                ExecStop = "${pkgs.moosefs}/bin/mfscgiserv -D /var/lib/mfs stop";
+                ExecStart = "${pkgs.moosefs}/bin/mfsgui -f -c ${guiCfg} start";
+                ExecStop = "${pkgs.moosefs}/bin/mfsgui -c ${guiCfg} stop";
+                ExecReload = "${pkgs.moosefs}/bin/mfsgui -c ${guiCfg} reload";
                 Restart = "on-failure";
                 RestartSec = "30s";
                 User = mfsUser;
                 Group = mfsUser;
-                WorkingDirectory = "/var/lib/mfs";
+                WorkingDirectory = cfg.cgiserver.settings.DATA_PATH;
               };
             };
           })

nixos/modules/services/security/reaction.nix

@@ -0,0 +1,198 @@
+{
+  lib,
+  pkgs,
+  config,
+  ...
+}:
+let
+  settingsFormat = pkgs.formats.yaml { };
+
+  inherit (lib)
+    mkOption
+    mkEnableOption
+    mkPackageOption
+    types
+    ;
+in
+{
+  options.services.reaction = {
+    enable = mkEnableOption "enable reaction";
+
+    package = mkPackageOption pkgs "reaction" { };
+
+    settings = mkOption {
+      description = ''
+        Configuration for reaction. See the [wiki](https://framagit.org/ppom/reaction-wiki).
+
+        The settings are written as a YAML file.
+
+        Can be used in combination with `settingsFiles` option, both will be present in the configuration directory.
+      '';
+      default = { };
+      type = types.submodule {
+        freeformType = settingsFormat.type;
+        options = { };
+      };
+    };
+
+    settingsFiles = mkOption {
+      description = ''
+        Configuration for reaction, see the [wiki](https://framagit.org/ppom/reaction-wiki).
+
+        reaction supports JSON, YAML and JSONnet. For those who prefer to take advantage of JSONnet rather than Nix.
+
+        Can be used in combination with `settings` option, both will be present in the configuration directory.
+      '';
+      default = [ ];
+      type = types.listOf types.path;
+    };
+
+    loglevel = mkOption {
+      description = ''
+        reaction's loglevel. One of DEBUG, INFO, WARN, ERROR.
+      '';
+      default = null;
+      type = types.nullOr (
+        types.enum [
+          "DEBUG"
+          "INFO"
+          "WARN"
+          "ERROR"
+        ]
+      );
+    };
+
+    stopForFirewall = mkOption {
+      type = types.bool;
+      default = false;
+      description = ''
+        Whether to stop reaction when reloading the firewall.
+
+        The presence of a reaction chain in the INPUT table may cause the firewall
+        reload to fail.
+        One can alternatively cherry-pick the right iptables commands to execute before and after the firewall
+        ```nix
+        {
+          systemd.services.firewall.serviceConfig = {
+            ExecStopPre = [ "''${pkgs.iptables}/bin/iptables -w -D INPUT -p all -j reaction" ];
+            ExecStartPost = [ "''${pkgs.iptables}/bin/iptables -w -I INPUT -p all -j reaction" ];
+          };
+        }
+        ```
+      '';
+    };
+
+    checkConfig = mkOption {
+      type = types.bool;
+      default = true;
+      description = "Check the syntax of the configuration files at build time";
+    };
+
+    runAsRoot = mkOption {
+      type = types.bool;
+      default = false;
+      description = ''
+        Whether to run reaction as root.
+        Defaults to false, where an unprivileged reaction user is created.
+
+        Be sure to give it sufficient permissions.
+        Example config permitting `iptables` and `journalctl` use
+
+        ```nix
+        {
+          # allows reading journal logs of processess
+          users.users.reaction.extraGroups = [ "systemd-journal" ];
+          # allows modifying ip firewall rules
+          systemd.services.reaction.AmbientCapabilities = [ "CAP_NET_ADMIN" ];
+          # optional, if more control over ssh logs is needed
+          services.openssh.settings.LogLevel = lib.mkDefault "VERBOSE";
+        }
+        ```
+      '';
+    };
+  };
+
+  config =
+    let
+      cfg = config.services.reaction;
+
+      generatedSettings = settingsFormat.generate "reaction.yml" cfg.settings;
+      namedGeneratedSettings = lib.optional (cfg.settings != { }) {
+        name = "reaction.yml";
+        path = generatedSettings;
+      };
+
+      # SAFETY: We can discard the dependencies of "file" in the name attribute because we keep them in the path attribute
+      # See https://nix.dev/manual/nix/2.32/language/string-context
+      namedSettingsFiles = builtins.map (file: {
+        name = builtins.unsafeDiscardStringContext (builtins.baseNameOf file);
+        path = file;
+      }) cfg.settingsFiles;
+
+      settingsDir = pkgs.linkFarm "reaction.d" (namedSettingsFiles ++ namedGeneratedSettings);
+    in
+    lib.mkIf cfg.enable {
+      assertions = [
+        {
+          assertion = cfg.settings != { } || (builtins.length cfg.settingsFiles) != 0;
+          message = "You must specify settings and/or settingsFile options";
+        }
+      ];
+
+      users = lib.mkIf (!cfg.runAsRoot) {
+        users.reaction = {
+          isSystemUser = true;
+          group = "reaction";
+        };
+        groups.reaction = { };
+      };
+
+      system.checks =
+        lib.optional (cfg.checkConfig && pkgs.stdenv.hostPlatform == pkgs.stdenv.buildPlatform)
+          (
+            pkgs.runCommand "reaction-config-validation" { } ''
+              ${lib.getExe cfg.package} test-config -c ${settingsDir} >/dev/null
+              echo "reaction config ${settingsDir} is valid"
+              touch $out
+            ''
+          );
+
+      # Easier to debug conf when we have direct access to it,
+      # rather than having to look for it in the systemd service file.
+      environment.etc."reaction".source = settingsDir;
+
+      systemd.services.reaction = {
+        enable = true;
+        description = "Scan logs and take action";
+        after = [ "network.target" ];
+        wantedBy = [ "multi-user.target" ];
+        partOf = lib.optionals cfg.stopForFirewall [ "firewall.service" ];
+        path = [ pkgs.iptables ];
+        unitConfig.ConditionCapability = "CAP_NET_ADMIN";
+        serviceConfig = {
+          Type = "simple";
+          User = if (!cfg.runAsRoot) then "reaction" else "root";
+          ExecStart = ''
+            ${lib.getExe cfg.package} start -c ${settingsDir}${
+              lib.optionalString (cfg.loglevel != null) " -l ${cfg.loglevel}"
+            }
+          '';
+          StateDirectory = "reaction";
+          RuntimeDirectory = "reaction";
+          WorkingDirectory = "/var/lib/reaction";
+
+          CapabilityBoundingSet = [ "CAP_NET_ADMIN" ];
+        };
+      };
+
+      environment.systemPackages = [ cfg.package ];
+    };
+
+  meta.maintainers =
+    with lib.maintainers;
+    [
+      ppom
+      phanirithvij
+    ]
+    ++ lib.teams.ngi.members;
+}

nixos/tests/all-tests.nix

@@ -1322,6 +1322,8 @@ in
   rasdaemon = runTest ./rasdaemon.nix;
   rathole = runTest ./rathole.nix;
   rauc = runTest ./rauc.nix;
+  reaction = runTest ./reaction.nix;
+  reaction-firewall = runTest ./reaction-firewall.nix;
   readarr = runTest ./readarr.nix;
   readeck = runTest ./readeck.nix;
   realm = runTest ./realm.nix;

nixos/tests/jellyfin.nix

@@ -154,5 +154,7 @@
 
           if duration.strip() != "5.000000":
               raise Exception("Downloaded video has wrong duration")
+
+      machine.log(machine.succeed("systemd-analyze security jellyfin.service | grep -v '✓'"))
     '';
 }

nixos/tests/reaction-firewall.nix

@@ -0,0 +1,79 @@
+{
+  lib,
+  pkgs,
+  ...
+}:
+{
+  name = "reaction-firewall-interaction";
+
+  nodes.machine =
+    { config, pkgs, ... }:
+    {
+      services.reaction = {
+        enable = true;
+        stopForFirewall = true; # with this enabled restarting firewall will restart reaction
+        settingsFiles = [
+          "${pkgs.reaction}/share/examples/example.jsonnet"
+          # "${pkgs.reaction}/share/examples/example.yml" # can't specify both because conflicts
+        ];
+        runAsRoot = true;
+      };
+      networking.firewall.enable = true;
+    };
+
+  testScript = # py
+    ''
+      start_all()
+      machine.wait_for_unit("multi-user.target")
+
+      # Verify both services start successfully
+      machine.wait_for_unit("firewall.service")
+      machine.wait_for_unit("reaction.service")
+
+      # Check reaction chain exists in iptables
+      output = machine.succeed("iptables -w -L -n")
+      assert "reaction" in output, "reaction chain not found in iptables"
+
+      # Reload firewall and verify there's no issues due to reaction chain
+      machine.succeed("systemctl reload firewall")
+      output = machine.succeed("journalctl -u reaction.service -u firewall.service --no-pager")
+      assert "ERROR" not in output, "firewall reload failed due to reaction"
+
+      # Verify reaction chain still exists after reload
+      output = machine.succeed("iptables -w -L -n")
+      assert "reaction" in output, "reaction chain missing after firewall reload"
+
+      # Restart firewall and verify reaction restarts as well
+      machine.succeed("systemctl restart firewall")
+      output = machine.succeed("journalctl -u reaction.service -u firewall.service --no-pager")
+      assert "INFO stop command" in output and "INFO start command" in output, "reaction did not restart when firewall was restarted"
+
+      output = machine.succeed("iptables -w -L -n")
+      assert "reaction" in output, "reaction chain missing after firewall restart"
+
+      # Stop reaction manually and verify chains are cleaned up
+      machine.succeed("systemctl stop reaction")
+      output = machine.succeed("iptables -w -L -n || true")
+      assert "reaction" not in output, "reaction chain still exists after stop"
+
+      # Start reaction again and verify it works
+      machine.succeed("systemctl start reaction")
+      machine.wait_for_unit("reaction.service")
+
+      output = machine.succeed("iptables -w -L -n")
+      assert "reaction" in output, "reaction chain not recreated"
+    '';
+
+  # Debug interactively with:
+  # - nix run .#nixosTests.reaction-firewall.driverInteractive -L
+  # - run_tests()
+  interactive.sshBackdoor.enable = true; # ssh -o User=root vsock%3
+
+  meta.maintainers =
+    with lib.maintainers;
+    [
+      ppom
+      phanirithvij
+    ]
+    ++ lib.teams.ngi.members;
+}

nixos/tests/reaction.nix

@@ -0,0 +1,107 @@
+{
+  lib,
+  pkgs,
+  ...
+}:
+{
+  name = "reaction";
+
+  nodes.server = _: {
+    services.reaction = {
+      enable = true;
+      stopForFirewall = false;
+      settingsFiles = [
+        "${pkgs.reaction}/share/examples/example.jsonnet"
+        # "${pkgs.reaction}/share/examples/example.yml" # can't specify both because conflicts
+      ];
+      runAsRoot = false;
+    };
+    services.openssh.enable = true;
+
+    # required to access journal of sshd.service as runAsRoot = false
+    users.users.reaction.extraGroups = [ "systemd-journal" ];
+    # required for allowing reaction to modifiy firewall rules
+    systemd.services.reaction.serviceConfig.AmbientCapabilities = [ "CAP_NET_ADMIN" ];
+
+    users.users.nixos.isNormalUser = true; # neeeded to establish a ssh connection, by default root login is succeeding without any password
+  };
+
+  nodes.client = _: {
+    environment.systemPackages = [
+      pkgs.sshpass
+      pkgs.libressl.nc
+    ];
+  };
+
+  testScript =
+    { nodes, ... }: # py
+    ''
+      start_all()
+
+      # Wait for everything to be ready.
+      server.wait_for_unit("multi-user.target")
+      server.wait_for_unit("reaction")
+      server.wait_for_unit("sshd")
+      client.wait_for_unit("multi-user.target")
+
+      client_addr = "${(lib.head nodes.client.networking.interfaces.eth1.ipv4.addresses).address}"
+      server_addr = "${(lib.head nodes.server.networking.interfaces.eth1.ipv4.addresses).address}"
+
+      # Verify there is not ban and the port is reachable from the client.
+      server.succeed(f"reaction show | grep -q {client_addr} || test $? -eq 1")
+      client.succeed(f"nc -w3 -z {server_addr} 22")
+
+      # Cause authentication failure log entries.
+      for _ in range(2):
+        client.fail(f"""
+          sshpass -p 'wrongpassword' \
+            ssh -o StrictHostKeyChecking=no \
+              -o User=nixos \
+              -o ServerAliveInterval=1 \
+              -o ServerAliveCountMax=2 \
+              {server_addr}
+        """)
+
+      # Verify there is a ban and the port is unreachable from the client.
+      server.sleep(2)
+      output = server.succeed("reaction show")
+      print(output)
+      assert client_addr in output, f"client did not get banned, {client_addr}"
+
+      client.fail(f"nc -w3 -z {server_addr} 22")
+
+      # Check that unbanning works
+      output = server.succeed("reaction flush")
+      print(output)
+
+      client.succeed(f"nc -w3 -z {server_addr} 22")
+    '';
+
+  # Debug interactively with:
+  # - nix run .#nixosTests.reaction.driverInteractive -L
+  # - run_tests()
+  # ssh -o User=root vsock%3 (can also do vsock/3, but % works with scp etc.)
+  # ssh -o User=root vsock%4
+  interactive.sshBackdoor.enable = true;
+
+  interactive.nodes.server =
+    { config, ... }:
+    {
+      # not needed, only for manual interactive debugging
+      virtualisation.memorySize = 4096;
+      environment.systemPackages = with pkgs; [
+        btop
+        sysz
+        sshpass
+        libressl.nc
+      ];
+    };
+
+  meta.maintainers =
+    with lib.maintainers;
+    [
+      ppom
+      phanirithvij
+    ]
+    ++ lib.teams.ngi.members;
+}

nixos/tests/uptermd.nix

@@ -51,15 +51,14 @@ in
     client1.wait_until_succeeds("pgrep -u root bash")
 
     client1.execute("ssh-keygen -t ed25519 -N \"\" -f /root/.ssh/id_ed25519")
-    client1.send_chars("TERM=xterm upterm host --server ssh://server:1337 --force-command hostname -- bash > /tmp/session-details\n")
+    client1.send_chars("TERM=xterm upterm host --server ssh://server:1337 --accept --force-command hostname -- bash > /tmp/session-details\n")
     client1.wait_for_file("/tmp/session-details")
-    client1.send_key("q")
 
     # uptermd can't connect if we don't have a keypair
     client2.execute("ssh-keygen -t ed25519 -N \"\" -f /root/.ssh/id_ed25519")
 
     # Grep the ssh connect command from the output of 'upterm host'
-    ssh_command = client1.succeed("grep 'SSH Session' /tmp/session-details | cut -d':' -f2-").strip()
+    ssh_command = client1.succeed("grep 'SSH Command' /tmp/session-details | awk -F'│' '{print $3}'").strip()
 
     # Connect with client2. Because we used '--force-command hostname' we should get "client1" as the output
     output = client2.succeed(ssh_command)

pkgs/applications/emulators/libretro/cores/pcsx-rearmed.nix

@@ -5,13 +5,13 @@
 }:
 mkLibretroCore {
   core = "pcsx-rearmed";
-  version = "0-unstable-2025-11-24";
+  version = "0-unstable-2025-12-16";
 
   src = fetchFromGitHub {
     owner = "libretro";
     repo = "pcsx_rearmed";
-    rev = "9059485691c44cb3a555464b06eddfb1082d586c";
-    hash = "sha256-sm59Xo6bEiajbmRYbCNnWToDLpJPdaJhovJe+g+GWVg=";
+    rev = "8d91fbdff8f4db6e256370f030a9f6ac8c7f2c62";
+    hash = "sha256-3DaKohQ5HoR7Un7mZF4yeFs4fQ0WfVUS15P1HQU0H+0=";
   };
 
   dontConfigure = true;

pkgs/applications/emulators/libretro/cores/stella.nix

@@ -5,13 +5,13 @@
 }:
 mkLibretroCore {
   core = "stella";
-  version = "0-unstable-2025-12-03";
+  version = "0-unstable-2025-12-14";
 
   src = fetchFromGitHub {
     owner = "stella-emu";
     repo = "stella";
-    rev = "cc938d2194290ce25c8fbd149a864705887b1692";
-    hash = "sha256-v4l7fgXvReMsqB7fbAzkY2vIfTGnMvSbeb8dPaK/KnA=";
+    rev = "6d2e3783fde1d99773a57a1ff0c14bfaeec22f93";
+    hash = "sha256-/1S09xhwvLg6fDgujWVpHb5jQUqydTVTtEjHk4leYUY=";
   };
 
   makefile = "Makefile";

pkgs/build-support/fetchdarcs/builder.sh

@@ -1,5 +1,3 @@
-set -u
-
 tagtext=""
 tagflags=""
 # Darcs hashes are sha1 (120 bits, 40-character hex)

pkgs/by-name/aw/awscli2/package.nix

@@ -73,14 +73,14 @@ let
 in
 py.pkgs.buildPythonApplication rec {
   pname = "awscli2";
-  version = "2.31.39"; # N.B: if you change this, check if overrides are still up-to-date
+  version = "2.32.15"; # N.B: if you change this, check if overrides are still up-to-date
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "aws";
     repo = "aws-cli";
     tag = version;
-    hash = "sha256-IuOamzLmnU3wIhgQIsWbU6GSRM2XLv0eH0gezp9IHNA=";
+    hash = "sha256-TOXoArw33exbMfKBnNSECymYS8hVzPoVOA7PWzbnroc=";
   };
 
   postPatch = ''

pkgs/by-name/ba/basedpyright/package.nix

@@ -18,13 +18,13 @@
 
 buildNpmPackage rec {
   pname = "basedpyright";
-  version = "1.36.0";
+  version = "1.36.1";
 
   src = fetchFromGitHub {
     owner = "detachhead";
     repo = "basedpyright";
     tag = "v${version}";
-    hash = "sha256-S9//JconHEst7JkmTejwRc9gtmnokEV4otUQURA7pNI=";
+    hash = "sha256-c0yvnLOwOR4nMYbfyXe/QRUt3qaNRzwuS8UbyviJj9E=";
   };
 
   npmDepsHash = "sha256-VHQOmRWirZYnoxk/JzGwFFV5QEIyHGg/isDvf/f7uro=";

pkgs/by-name/be/bella/package.nix

@@ -0,0 +1,70 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  pkg-config,
+  desktop-file-utils,
+  appstream-glib,
+  gjs,
+  glib,
+  gobject-introspection,
+  gtk4,
+  libadwaita,
+  libportal,
+  meson,
+  ninja,
+  wrapGAppsHook4,
+  nix-update-script,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "bella";
+  version = "0.1.3";
+
+  src = fetchFromGitHub {
+    owner = "josephmawa";
+    repo = "Bella";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-JSzgh56Ph8LjVY2uPfu1tacdr7BBbBzRfdWtcTRga7I=";
+  };
+
+  strictDeps = true;
+
+  nativeBuildInputs = [
+    pkg-config
+    desktop-file-utils # `desktop-file-validate`, `update-desktop-database`
+    appstream-glib # `appstream-util`
+    gjs
+    glib # `glib-compile-schemas`
+    gobject-introspection
+    gtk4 # `gtk4-update-icon-cache`
+    meson
+    ninja
+    wrapGAppsHook4
+  ];
+
+  buildInputs = [
+    libadwaita
+    libportal
+  ];
+
+  # GJS uses argv[0] to find gresource files, and wrappers will cause that mechanism to fail.
+  # Manually overriding the entrypoint name should do the job.
+  #
+  # - https://gitlab.gnome.org/GNOME/gjs/-/blob/6aca7b50785fa1638f144b17060870d721e3f65a/modules/script/package.js#L159
+  # - https://gitlab.gnome.org/GNOME/gjs/-/blob/6aca7b50785fa1638f144b17060870d721e3f65a/modules/script/package.js#L37
+  preFixup = ''
+    sed -i "1 a imports.package._findEffectiveEntryPointName = () => 'io.github.josephmawa.Bella';" $out/bin/io.github.josephmawa.Bella
+  '';
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "Simple eye dropper and color picker";
+    homepage = "https://github.com/josephmawa/Bella";
+    license = lib.licenses.gpl3Only;
+    maintainers = with lib.maintainers; [ pluiedev ];
+    mainProgram = "io.github.josephmawa.Bella";
+    platforms = lib.lists.intersectLists lib.platforms.linux gjs.meta.platforms;
+  };
+})

pkgs/by-name/bl/blackhole/package.nix

@@ -0,0 +1,55 @@
+{
+  stdenv,
+  lib,
+  fetchFromGitHub,
+  xcbuildHook,
+  apple-sdk,
+  nix-update-script,
+  channel ? "256ch",
+}:
+stdenv.mkDerivation (finalAttrs: {
+  pname = "blackhole";
+  version = "0.6.1";
+
+  src = fetchFromGitHub {
+    owner = "existentialaudio";
+    repo = "BlackHole";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-jFKi5LJdTOMFa1mErH6WsjgCtLCKzwpgn2+T3Fp9MtQ=";
+  };
+
+  nativeBuildInputs = [
+    xcbuildHook
+  ];
+
+  buildInputs = [ apple-sdk ];
+
+  bundleId = "audio.existential.BlackHole${channel}";
+  xcbuildFlags = [
+    "-project"
+    "BlackHole.xcodeproj"
+    "-configuration"
+    "Release"
+    "PRODUCT_BUNDLE_IDENTIFIER=${finalAttrs.bundleId}"
+    "GCC_PREPROCESSOR_DEFINITIONS=$GCC_PREPROCESSOR_DEFINITIONS kDriver_Name=\\\"blackhole${channel}\\\" kPlugIn_BundleID=\\\"${finalAttrs.bundleId}\\\" kPlugIn_Icon=\\\"BlackHole.icns\\\""
+  ];
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p $out/Library/Audio/Plug-Ins/HAL
+    mv Products/Release/BlackHole.driver $out/Library/Audio/Plug-Ins/HAL/Blackhole${channel}.driver
+
+    runHook postInstall
+  '';
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "Virtual audio driver for macOS";
+    homepage = "https://existential.audio/blackhole";
+    license = lib.licenses.gpl3Only;
+    platforms = lib.platforms.darwin;
+    maintainers = with lib.maintainers; [ eveeifyeve ];
+  };
+})

pkgs/by-name/ca/cargo-dist/package.nix

@@ -13,16 +13,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "cargo-dist";
-  version = "0.30.2";
+  version = "0.30.3";
 
   src = fetchFromGitHub {
     owner = "axodotdev";
     repo = "cargo-dist";
     rev = "v${version}";
-    hash = "sha256-1stUmm7rtNB2z2srOzDvQ9QaGsS0CySBOHt118vmJoM=";
+    hash = "sha256-x59bUgd89XAwuHwGvREDqAS/cI4Ot7HGTONGbTOgzw8=";
   };
 
-  cargoHash = "sha256-Il5PVJHoNdifqUcXxKR+j+Lgga0kIsl7IJp9oGanZ+c=";
+  cargoHash = "sha256-OTbUTYxqEzE3hyHq2hCbhigz5xJT2Bjd/pu6EI+0aWA=";
 
   nativeBuildInputs = [
     pkg-config

pkgs/by-name/ca/cargo-rail/package.nix

@@ -0,0 +1,68 @@
+{
+  lib,
+  rustPlatform,
+  fetchCrate,
+  pkg-config,
+  curl,
+  openssl,
+}:
+
+rustPlatform.buildRustPackage rec {
+  pname = "cargo-rail";
+  version = "0.7.0";
+
+  src = fetchCrate {
+    inherit pname version;
+    hash = "sha256-L8yh47lYvXVGOr8jDZ4Gk2rIfUnr88q9OR5/iDrJua0=";
+  };
+
+  cargoHash = "sha256-XvXyG3N0cuqqm0LSe7MFj6oDlCQC3tFGa7rxyQIfa8o=";
+
+  nativeBuildInputs = [ pkg-config ];
+
+  buildInputs = [
+    curl
+    openssl
+  ];
+
+  # These fail because they need a git repository
+  checkFlags = [
+    "--skip=git::defaults::tests::test_detect_default_base_ref"
+    "--skip=git::ops::tests::test_collect_tree_files_nonexistent"
+    "--skip=git::defaults::tests::test_detect_returns_usable_ref"
+    "--skip=git::mappings::tests::test_reverse_mapping_persistence"
+    "--skip=git::mappings::tests::test_save_and_load"
+    "--skip=git::ops::tests::test_collect_tree_files_with_bulk"
+    "--skip=git::ops::tests::test_get_commits_bulk"
+    "--skip=git::ops::tests::test_get_commits_touching_path"
+    "--skip=git::ops::tests::test_read_files_bulk"
+    "--skip=git::ops::tests::test_get_changed_files"
+    "--skip=git::ops::tests::test_commit_history"
+    "--skip=git::ops::tests::test_read_files_bulk_empty"
+    "--skip=sync::conflict::tests::test_clean_merge"
+    "--skip=sync::conflict::tests::test_ours_strategy"
+    "--skip=sync::conflict::tests::test_conflict_detection"
+    "--skip=sync::conflict::tests::test_union_strategy"
+    "--skip=split::engine::tests::test_copy_directory_recursive"
+    "--skip=sync::conflict::tests::test_theirs_strategy"
+    "--skip=workspace::change_analyzer::tests::test_categorize_comprehensive"
+    "--skip=workspace::change_analyzer::tests::test_proc_macro_detection"
+    "--skip=workspace::context::tests::test_cargo_state_wrapper"
+    "--skip=workspace::context::tests::test_git_state_wrapper"
+    "--skip=workspace::context::tests::test_workspace_context_build"
+    "--skip=workspace::view::tests::test_workspace_view_all_crates"
+    "--skip=workspace::view::tests::test_workspace_view_crate_info"
+    "--skip=workspace::view::tests::test_workspace_view_proc_macro"
+    "--skip=workspace::context::tests::test_graph_integration"
+  ];
+
+  meta = {
+    description = "Graph-aware monorepo orchestration for Rust workspaces";
+    mainProgram = "cargo-rail";
+    homepage = "https://github.com/loadingalias/cargo-rail";
+    changelog = "https://github.com/loadingalias/cargo-rail/releases/tag/v${version}";
+    license = lib.licenses.mit;
+    platforms = lib.platforms.unix;
+    maintainers = with lib.maintainers; [ matthiasbeyer ];
+  };
+}

pkgs/by-name/co/codefresh/package.nix

@@ -11,18 +11,18 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "codefresh";
-  version = "0.89.2";
+  version = "0.89.6";
 
   src = fetchFromGitHub {
     owner = "codefresh-io";
     repo = "cli";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-Cf3I+w0rVsjsu+m+vE/pOcASYTmsRi0yAQVpJkYbzUU=";
+    hash = "sha256-MlK+vWS2ylrWjnsNFP/FRr6YWXlpfE3Z6vMiNJvvdv0=";
   };
 
   offlineCache = fetchYarnDeps {
     yarnLock = "${finalAttrs.src}/yarn.lock";
-    hash = "sha256-wD3BmWjrFGkNqUhbo2TrWLwgo2o2MiQn7X3fyDYt5dw=";
+    hash = "sha256-CZFS13UqPiJtLFCkeSTp2GSJw+QY48ob4zgfaPm057U=";
   };
   nativeBuildInputs = [
     yarnConfigHook
@@ -42,6 +42,9 @@ stdenv.mkDerivation (finalAttrs: {
     homepage = "https://github.com/codefresh-io/cli";
     license = lib.licenses.mit;
     mainProgram = "codefresh";
-    maintainers = [ lib.maintainers.takac ];
+    maintainers = [
+      lib.maintainers.burdzwastaken
+      lib.maintainers.takac
+    ];
   };
 })

pkgs/by-name/ev/evcxr/package.nix

@@ -9,7 +9,7 @@
   libiconv,
   cargo,
   gcc,
-  mold,
+  mold-unwrapped,
   rustc,
   nix-update-script,
 
@@ -75,7 +75,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
                 gcc
                 rustc
               ]
-              ++ lib.optional withMold mold
+              ++ lib.optional withMold mold-unwrapped
             )
           } \
           --set-default RUST_SRC_PATH "$RUST_SRC_PATH"

pkgs/by-name/fa/fabric-ai/package.nix

@@ -8,13 +8,13 @@
 
 buildGoModule rec {
   pname = "fabric-ai";
-  version = "1.4.340";
+  version = "1.4.345";
 
   src = fetchFromGitHub {
     owner = "danielmiessler";
     repo = "fabric";
     tag = "v${version}";
-    hash = "sha256-tXT5Xc/izx8tBqj0plvjVLMhpZlGzEIGx2qEPO3xmVM=";
+    hash = "sha256-X4qdFSAO4bE3yVdpmq1r7rAEVAIOeQ4+YY/w4F86Fs8=";
   };
 
   vendorHash = "sha256-qWaMBhjt20WAIhDcjY4oOFBT+neJiXg0N2WsPasuHSU=";

pkgs/by-name/fe/feroxbuster/package.nix

@@ -11,16 +11,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "feroxbuster";
-  version = "2.13.0";
+  version = "2.13.1";
 
   src = fetchFromGitHub {
     owner = "epi052";
     repo = "feroxbuster";
     tag = "v${version}";
-    hash = "sha256-4YjZhBG+4Oo8mfEslNCNl0KFiqWsoreo9cPGYUoDJlk=";
+    hash = "sha256-x0oNgDEuRIHDUUSAiIgcjmm6NadyBFuvz/hOcqquM3g=";
   };
 
-  cargoHash = "sha256-D5wiNzB83AWAy2N2ykzu6PNJPZ2PT/qtLPeiQzT2OxE=";
+  cargoHash = "sha256-kWRODW1BsnifEqGZj8jK5tUK/5zK1AIRSq3JSo6YmkI=";
 
   OPENSSL_NO_VENDOR = true;
 

pkgs/by-name/fr/framac/package.nix

@@ -74,6 +74,7 @@ stdenv.mkDerivation rec {
   ]);
 
   buildInputs = with ocamlPackages; [
+    camlzip
     dune-site
     dune-configurator
     ocamlgraph

pkgs/by-name/gi/git-bug/package.nix

@@ -2,6 +2,7 @@
   lib,
   buildGoModule,
   fetchFromGitHub,
+  gitMinimal,
   installShellFiles,
 }:
 
@@ -20,7 +21,24 @@ buildGoModule rec {
 
   nativeBuildInputs = [ installShellFiles ];
 
-  doCheck = false;
+  nativeCheckInputs = [
+    gitMinimal
+  ];
+
+  checkFlags =
+    let
+      integrationTests = [
+        "TestValidateUsername/existing_organisation"
+        "TestValidateUsername/existing_organisation_with_bad_case"
+        "TestValidateUsername/existing_username"
+        "TestValidateUsername/existing_username_with_bad_case"
+        "TestValidateUsername/non_existing_username"
+        "TestValidateProject/public_project"
+      ];
+    in
+    [
+      "-skip=^${lib.concatStringsSep "$|^" integrationTests}$"
+    ];
 
   excludedPackages = [
     "doc"

pkgs/by-name/gi/git-credential-gopass/package.nix

@@ -0,0 +1,61 @@
+{
+  lib,
+  buildGoModule,
+  fetchFromGitHub,
+  makeWrapper,
+  writableTmpDirAsHomeHook,
+  gopass,
+  versionCheckHook,
+}:
+
+buildGoModule (finalAttrs: {
+  pname = "git-credential-gopass";
+  version = "1.16.1";
+
+  src = fetchFromGitHub {
+    owner = "gopasspw";
+    repo = "git-credential-gopass";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-IEur3Sw2zRYJxlwAhgpb2OnBt+FcC+OdeT7M/LzJwoY=";
+  };
+
+  vendorHash = "sha256-mtJIm7dH3jP7p0R0KxN0Yf7mi9rkJ73u8biy2Ygvk3k=";
+
+  subPackages = [ "." ];
+
+  nativeBuildInputs = [
+    makeWrapper
+    writableTmpDirAsHomeHook
+  ];
+
+  ldflags = [
+    "-s"
+    "-w"
+    "-X main.version=${finalAttrs.version}"
+    "-X main.commit=${finalAttrs.src.rev}"
+  ];
+
+  postFixup = ''
+    wrapProgram $out/bin/git-credential-gopass \
+      --prefix PATH : "${gopass.wrapperPath}"
+  '';
+
+  doInstallCheck = true;
+  nativeInstallCheckInputs = [
+    versionCheckHook
+    gopass
+  ];
+  versionCheckKeepEnvironment = [ "HOME" ];
+  preVersionCheck = ''
+    gopass setup --name "user" --email "user@localhost"
+  '';
+
+  meta = {
+    description = "Manage git credentials using gopass";
+    homepage = "https://github.com/gopasspw/git-credential-gopass";
+    changelog = "https://github.com/gopasspw/git-credential-gopass/blob/v${finalAttrs.version}/CHANGELOG.md";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ benneti ];
+    mainProgram = "git-credential-gopass";
+  };
+})

pkgs/by-name/gi/gitleaks/package.nix

@@ -35,7 +35,10 @@ buildGoModule rec {
 
   nativeCheckInputs = [ git ];
 
-  postInstall = lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
+  postInstall = ''
+    install -Dm444 config/gitleaks.toml $out/etc/gitleaks.toml
+  ''
+  + lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
     installShellCompletion --cmd ${pname} \
       --bash <($out/bin/${pname} completion bash) \
       --fish <($out/bin/${pname} completion fish) \

pkgs/by-name/go/gopass-hibp/package.nix

@@ -1,23 +1,25 @@
 {
   lib,
-  makeWrapper,
   buildGoModule,
   fetchFromGitHub,
+  makeWrapper,
   gopass,
+  versionCheckHook,
+  writableTmpDirAsHomeHook,
 }:
 
-buildGoModule rec {
+buildGoModule (finalAttrs: {
   pname = "gopass-hibp";
-  version = "1.16.0";
+  version = "1.16.1";
 
   src = fetchFromGitHub {
     owner = "gopasspw";
     repo = "gopass-hibp";
-    rev = "v${version}";
-    hash = "sha256-S4X2DWaktAfoqjLz7yAF5I0v+01bQbQLSgEb/105iCk=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-BlZxXN14bOO7LMdjS/ooqVKmRZQTpNYlYp4A4rTew4Q=";
   };
 
-  vendorHash = "sha256-8LC271XuMeDGWZnysMMumoqLwklQpDKr8VF/zyCvwNA=";
+  vendorHash = "sha256-LUmxstDE0paYaNS2Em1Xc6pJmHHWk/IJEjTZXq5qWW8=";
 
   subPackages = [ "." ];
 
@@ -26,13 +28,24 @@ buildGoModule rec {
   ldflags = [
     "-s"
     "-w"
-    "-X main.version=${version}"
-    "-X main.commit=${src.rev}"
+    "-X main.version=${finalAttrs.version}"
+    "-X main.commit=${finalAttrs.src.rev}"
   ];
 
   postFixup = ''
     wrapProgram $out/bin/gopass-hibp \
-      --prefix PATH : "${lib.makeBinPath [ gopass ]}"
+      --prefix PATH : "${gopass.wrapperPath}"
+  '';
+
+  doInstallCheck = true;
+  nativeInstallCheckInputs = [
+    versionCheckHook
+    writableTmpDirAsHomeHook
+    gopass
+  ];
+  versionCheckKeepEnvironment = [ "HOME" ];
+  preVersionCheck = ''
+    gopass setup --name "user" --email "user@localhost"
   '';
 
   __darwinAllowLocalNetworking = true;
@@ -40,9 +53,9 @@ buildGoModule rec {
   meta = {
     description = "Gopass haveibeenpwnd.com integration";
     homepage = "https://github.com/gopasspw/gopass-hibp";
-    changelog = "https://github.com/gopasspw/gopass-hibp/blob/v${version}/CHANGELOG.md";
+    changelog = "https://github.com/gopasspw/gopass-hibp/blob/v${finalAttrs.version}/CHANGELOG.md";
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [ sikmir ];
     mainProgram = "gopass-hibp";
   };
-}
+})

pkgs/by-name/go/gopass-jsonapi/package.nix

@@ -1,17 +1,17 @@
 {
   lib,
-  stdenv,
   makeWrapper,
   buildGoModule,
   fetchFromGitHub,
   installShellFiles,
+  writableTmpDirAsHomeHook,
   jq,
   gnupg,
   gopass,
+  versionCheckHook,
 }:
 
 let
-
   # https://github.com/gopasspw/gopass-jsonapi/blob/v1.16.0/internal/jsonapi/manifest/manifest_path_linux.go
   manifestPaths = {
     firefox = "$out/lib/mozilla/native-messaging-hosts/com.justwatch.gopass.json";
@@ -22,38 +22,37 @@ let
     iridium = "$out/etc/iridium-browser/native-messaging-hosts/com.justwatch.gopass.json";
     slimjet = "$out/etc/opt/slimjet/native-messaging-hosts/com.justwatch.gopass.json";
   };
-
 in
-buildGoModule rec {
+buildGoModule (finalAttrs: {
   pname = "gopass-jsonapi";
-  version = "1.16.0";
+  version = "1.16.1";
 
   src = fetchFromGitHub {
     owner = "gopasspw";
     repo = "gopass-jsonapi";
-    rev = "v${version}";
-    hash = "sha256-LPGAK/vwcbsAvL3TXX78cPCbNbYXh2++Ta1D8RjbKK4=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-JN/SC7lvPVTONNbOUmgu//xK/GaR5Tljxn99Zb1J/kQ=";
   };
 
-  vendorHash = "sha256-TTTjQRUYKqtyE/vFHol0ewbkh+2oGo9Pjr1qTmfXrq4=";
+  vendorHash = "sha256-Ki0gzhDkoUvgTCN4bYrqvN0u3AgdG22MWxcVHIE9lUQ=";
 
   subPackages = [ "." ];
 
   nativeBuildInputs = [
     installShellFiles
     makeWrapper
+    writableTmpDirAsHomeHook
   ];
 
   ldflags = [
     "-s"
     "-w"
-    "-X main.version=${version}"
-    "-X main.commit=${src.rev}"
+    "-X main.version=${finalAttrs.version}"
+    "-X main.commit=${finalAttrs.src.rev}"
   ];
 
   postInstall = ''
     # Generate native messaging manifests for Chrome and Firefox.
-    export HOME=$(mktemp -d)
     ${gnupg}/bin/gpg --batch --passphrase "" --quick-generate-key "user <user@localhost>"
     ${gopass}/bin/gopass setup --name "user" --email "user@localhost"
 
@@ -64,7 +63,7 @@ buildGoModule rec {
       in
       # The options after `--print=false` are of no effect, but if missing
       # `gopass-jsonapi configure` will ask for them. (`--libpath` and `--global`
-      # are overriden by `--manifest-path`. `--libpath` is only used to
+      # are overridden by `--manifest-path`. `--libpath` is only used to
       # compute Firefox's global manifest path. See
       # https://github.com/gopasspw/gopass-jsonapi/blob/v1.16.0/setup_others.go#L33-L46)
       #
@@ -96,10 +95,16 @@ buildGoModule rec {
       --prefix PATH : "${gopass.wrapperPath}"
   '';
 
+  doInstallCheck = true;
+  nativeInstallCheckInputs = [
+    versionCheckHook
+  ];
+  versionCheckKeepEnvironment = [ "HOME" ];
+
   meta = {
     description = "Enables communication with gopass via JSON messages";
     homepage = "https://github.com/gopasspw/gopass-jsonapi";
-    changelog = "https://github.com/gopasspw/gopass-jsonapi/blob/v${version}/CHANGELOG.md";
+    changelog = "https://github.com/gopasspw/gopass-jsonapi/blob/v${finalAttrs.version}/CHANGELOG.md";
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [
       maxhbr
@@ -107,4 +112,4 @@ buildGoModule rec {
     ];
     mainProgram = "gopass-jsonapi";
   };
-}
+})

pkgs/by-name/go/gopass-summon-provider/package.nix

@@ -1,23 +1,25 @@
 {
   lib,
-  makeWrapper,
   buildGoModule,
   fetchFromGitHub,
+  makeWrapper,
   gopass,
+  versionCheckHook,
+  writableTmpDirAsHomeHook,
 }:
 
-buildGoModule rec {
+buildGoModule (finalAttrs: {
   pname = "gopass-summon-provider";
-  version = "1.16.0";
+  version = "1.16.1";
 
   src = fetchFromGitHub {
     owner = "gopasspw";
     repo = "gopass-summon-provider";
-    rev = "v${version}";
-    hash = "sha256-ES+lU0iBwzkomWoVKQrKElOaH9XiumnzpBVRjWbI/cM=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-j3N/snUCsw/NlMQO9CoVRf6JCG48DEHqrJnZ7wiVUPk=";
   };
 
-  vendorHash = "sha256-gE8x+81DFzw0TSkxwU5s+OQccSvfRVH6dV+sWhMdBxI=";
+  vendorHash = "sha256-FhS79dSY9FjlScoXd6EbYRRwEBObZLO9g/SXBEXQpjM=";
 
   subPackages = [ "." ];
 
@@ -26,21 +28,32 @@ buildGoModule rec {
   ldflags = [
     "-s"
     "-w"
-    "-X main.version=${version}"
-    "-X main.commit=${src.rev}"
+    "-X main.version=${finalAttrs.version}"
+    "-X main.commit=${finalAttrs.src.rev}"
   ];
 
   postFixup = ''
     wrapProgram $out/bin/gopass-summon-provider \
-      --prefix PATH : "${lib.makeBinPath [ gopass ]}"
+      --prefix PATH : "${gopass.wrapperPath}"
+  '';
+
+  doInstallCheck = true;
+  nativeInstallCheckInputs = [
+    versionCheckHook
+    writableTmpDirAsHomeHook
+    gopass
+  ];
+  versionCheckKeepEnvironment = [ "HOME" ];
+  preVersionCheck = ''
+    gopass setup --name "user" --email "user@localhost"
   '';
 
   meta = {
     description = "Gopass Summon Provider";
     homepage = "https://github.com/gopasspw/gopass-summon-provider";
-    changelog = "https://github.com/gopasspw/gopass-summon-provider/blob/v${version}/CHANGELOG.md";
+    changelog = "https://github.com/gopasspw/gopass-summon-provider/blob/v${finalAttrs.version}/CHANGELOG.md";
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [ sikmir ];
     mainProgram = "gopass-summon-provider";
   };
-}
+})

pkgs/by-name/go/gopass/package.nix

@@ -28,7 +28,7 @@ let
 in
 buildGoModule (finalAttrs: {
   pname = "gopass";
-  version = "1.16.0";
+  version = "1.16.1";
 
   nativeBuildInputs = [
     installShellFiles
@@ -39,7 +39,7 @@ buildGoModule (finalAttrs: {
     owner = "gopasspw";
     repo = "gopass";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-JBa/PhVj0cKr9Btz9KzhGgsL4APAfZ/ixHGHWzd2TfA=";
+    hash = "sha256-Yr66+LUEoONNkSQUQhIWtLvxN0a5YtRVbn/nJRLqn+E=";
   };
 
   vendorHash = "sha256-ebnnnAD7SQJrSVOPborHUWd8ThOstIgihEIUjrnCztQ=";
@@ -89,6 +89,7 @@ buildGoModule (finalAttrs: {
     maintainers = with lib.maintainers; [
       rvolosatovs
       sikmir
+      yzx9
     ];
     changelog = "https://github.com/gopasspw/gopass/blob/v${finalAttrs.version}/CHANGELOG.md";
 

pkgs/by-name/go/gotip/package.nix

@@ -8,16 +8,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "gotip";
-  version = "0.5.0";
+  version = "0.6.2";
 
   src = fetchFromGitHub {
     owner = "lusingander";
     repo = "gotip";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-z5Xk+lTDAvkMOJAR6eIC6rg+CP9wv+CSANdgj+KmPjA=";
+    hash = "sha256-i5DgBuRHGLuR99lAv8M8eycd8MtEUtgGjKrI4YMoGIo=";
   };
 
-  vendorHash = "sha256-AgyFhoyPyXN5ngTi8iKzbx0wOqlu64gFdrygPOFHZT4=";
+  vendorHash = "sha256-+saAOzbBpmd7+s7FXUUB30tmi53RpDRckeLiT36ykE4=";
 
   ldflags = [
     "-s"

pkgs/by-name/ha/hail/package.nix

@@ -15,17 +15,17 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "hail";
-  version = "0.2.2";
+  version = "0.3.0";
 
   src = fetchFromGitea {
     domain = "codeberg.org";
     owner = "periwinkle";
     repo = "hail";
     tag = finalAttrs.version;
-    hash = "sha256-LJodAS24x/dBNyrUxT9F0FHnu4s+Cb+CCtoe7nPM66w=";
+    hash = "sha256-PpZfOC4M6XNcdAWd2E8ONruOq9yOTRutjKi86mmoxAo=";
   };
 
-  cargoHash = "sha256-kEPnfRY2McSVNBuBC9VSKK5p8JIUeZh/LeFZQa1Hn5U=";
+  cargoHash = "sha256-+zxoICy3lrS+7fZU0yD1C4uKRj/JtDvizKla1xmz+PY=";
 
   nativeBuildInputs = [ pkg-config ];
 

pkgs/by-name/ho/home-manager/package.nix

@@ -19,14 +19,14 @@
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "home-manager";
-  version = "0-unstable-2025-12-05";
+  version = "0-unstable-2025-12-13";
 
   src = fetchFromGitHub {
     name = "home-manager-source";
     owner = "nix-community";
     repo = "home-manager";
-    rev = "27a6182347ccae90a88231ae0dc5dfa7d15815bb";
-    hash = "sha256-fZatn/KLfHLDXnF0wy7JxXqGaZmGDTVufT4o/AOlj44=";
+    rev = "d787ec69c3216ea33be1c0424fe65cb23aa8fb31";
+    hash = "sha256-KOP4QnkiRwiD5KEOr6ceF67rfTP1OqPmCCft6xDC3k4=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/hy/hydra/package.nix

@@ -1,7 +1,7 @@
 {
   stdenv,
   lib,
-  nix,
+  nixVersions,
   perlPackages,
   buildEnv,
   makeWrapper,
@@ -50,6 +50,8 @@
 }:
 
 let
+  nix = nixVersions.nix_2_32;
+
   perlDeps = buildEnv {
     name = "hydra-perl-deps";
     paths =

pkgs/by-name/li/libvmi/package.nix

@@ -24,14 +24,14 @@
 
 let
   pname = "libvmi";
-  version = "0.14.0-unstable-2025-04-09";
+  version = "0.14.0-unstable-2025-12-14";
   libVersion = "0.0.15";
 
   src = fetchFromGitHub {
     owner = "libvmi";
     repo = "libvmi";
-    rev = "872ccc6efac607b83b603fef691c3641656fed34";
-    hash = "sha256-8rqcDU4y86Uq6I7LOOMhMYWLEt7TxvzHilddUoutMOw=";
+    rev = "b196d72af1c549a494a321a15f725fbd90cd4686";
+    hash = "sha256-JxATmUI/rsWUF/ChavD0lHNNSeblzV5xtG/4BDcJ9T4=";
   };
 in
 

pkgs/by-name/li/littlegptracker/package.nix

@@ -14,13 +14,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "littlegptracker";
-  version = "1.4.2";
+  version = "1.5.0";
 
   src = fetchFromGitHub {
     owner = "djdiskmachine";
     repo = "littlegptracker";
     tag = finalAttrs.version;
-    hash = "sha256-1uXC5nJ63YguQuNIkuK0yx9lmrMBqw0WdlmCV8o11cE=";
+    hash = "sha256-SidrFsqAn0JQqthEoYA9H0RdF6jeCeP2Pe+UpAbbL48=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/mi/mixxx/package.nix

@@ -51,13 +51,13 @@
 
 stdenv.mkDerivation rec {
   pname = "mixxx";
-  version = "2.5.3";
+  version = "2.5.4";
 
   src = fetchFromGitHub {
     owner = "mixxxdj";
     repo = "mixxx";
     rev = version;
-    hash = "sha256-WmYoblIVygLnjNaFnRoEHmfnQcaBtIVOBZicEwD4NMw=";
+    hash = "sha256-D/+ys7VE2/xHUiDG80/voc1BFxwp9M0V89gPWy57XA0=";
   };
 
   # Should be removed when bumping to 2.6.x

pkgs/by-name/ni/nickel/package.nix

@@ -14,16 +14,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "nickel";
-  version = "1.14.0";
+  version = "1.15.1";
 
   src = fetchFromGitHub {
     owner = "tweag";
     repo = "nickel";
     tag = finalAttrs.version;
-    hash = "sha256-ee9P2XrUToW0WJJk8QnIkY6/9t+RCY98Ai05cz9ViIY=";
+    hash = "sha256-NGivq2V4wdJapzU5iLcuHrz2RDz2WhnikmCq+75a338=";
   };
 
-  cargoHash = "sha256-nO8T+nSfR/EGW8IhjevmCH10P0ky+D0vyULSCVL5OYE=";
+  cargoHash = "sha256-uCy/Qo92yZ4pjjgW64nWYH21EbdMMwGXP5522tl8MAE=";
 
   cargoBuildFlags = [
     "-p nickel-lang-cli"

pkgs/by-name/nu/nuclei/package.nix

@@ -7,16 +7,16 @@
 
 buildGoModule rec {
   pname = "nuclei";
-  version = "3.6.0";
+  version = "3.6.1";
 
   src = fetchFromGitHub {
     owner = "projectdiscovery";
     repo = "nuclei";
     tag = "v${version}";
-    hash = "sha256-jZInWfXHUuntdEKdaFV46/A7NTcCB77bLYaFSL9w+Os=";
+    hash = "sha256-CuR/8vTNnHsD4yuc39SF4kjh6SCH7VTVgicU7HekYhI=";
   };
 
-  vendorHash = "sha256-jw6DhUCFz7dnWX3tMsj2fMX36YA5RwkQlONVQHg37dY=";
+  vendorHash = "sha256-j5+PpCAYV5NsXQHbyXg7Of6MmEmGDbLZBsXBSKCBo+8=";
 
   proxyVendor = true; # hash mismatch between Linux and Darwin
 

pkgs/by-name/oh/oha/package.nix

@@ -11,16 +11,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "oha";
-  version = "1.12.0";
+  version = "1.12.1";
 
   src = fetchFromGitHub {
     owner = "hatoo";
     repo = "oha";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-GDFS/f9fombAEXEf0f/issQFrFviU1nsLOIQ5nthPHk=";
+    hash = "sha256-Yz9RuYUwwvXef0XzVHCv5/uzT6KGz+tQVMRVUJN81zU=";
   };
 
-  cargoHash = "sha256-pZnHE89kwuByMtm5m9QLSuhJ6wxFrbVOShF7T6c2494=";
+  cargoHash = "sha256-suHyApGbRF8KaH9Xb47zvnoenPIA7NdiULuvUXViLu0=";
 
   CARGO_PROFILE_RELEASE_LTO = "fat";
   CARGO_PROFILE_RELEASE_CODEGEN_UNITS = "1";

pkgs/by-name/op/opencloud/package.nix

@@ -28,13 +28,13 @@ let
 in
 buildGoModule rec {
   pname = "opencloud";
-  version = "4.0.0";
+  version = "4.1.0";
 
   src = fetchFromGitHub {
     owner = "opencloud-eu";
     repo = "opencloud";
     tag = "v${version}";
-    hash = "sha256-7yl6jOJZYJjSc48ko973NWTRPjlaVkdM2u8TZ2NfR74=";
+    hash = "sha256-sZcGDE/CwB/u9LxsfFY/m4o58NjXMgTX0yx719R+wjc=";
   };
 
   postPatch = ''

pkgs/by-name/op/opencloud/web.nix

@@ -9,19 +9,19 @@
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "opencloud-web";
-  version = "4.2.1";
+  version = "4.3.0";
 
   src = fetchFromGitHub {
     owner = "opencloud-eu";
     repo = "web";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-TP9DM6s0bVpBeY4LEGDuTN8yZEwvbXpSDJXKh7j4COE=";
+    hash = "sha256-oLGmktFeDykpaK8YqMoIl7RrkPvHw2EULkbn1XDS/Yk=";
   };
 
   pnpmDeps = pnpm_10.fetchDeps {
     inherit (finalAttrs) pname version src;
     fetcherVersion = 1;
-    hash = "sha256-6eDMIad3BNN3HTe0e2R8h0Ua1cZPeRGV2tR0gKh3NFY=";
+    hash = "sha256-+oCoK6u46oPVtsvUEksuFFtjogirN370IsM33H5oOA4=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/op/openscad/package.nix

@@ -168,7 +168,7 @@ stdenv.mkDerivation rec {
   postInstall = lib.optionalString stdenv.hostPlatform.isDarwin ''
     mkdir $out/Applications
     mv $out/bin/*.app $out/Applications
-    rmdir $out/bin || true
+    ln -s "$out/Applications/OpenSCAD.app/Contents/MacOS/OpenSCAD" "$out/bin/openscad"
 
     mv --target-directory=$out/Applications/OpenSCAD.app/Contents/Resources \
       $out/share/openscad/{examples,color-schemes,locale,libraries,fonts,templates}

pkgs/by-name/pr/pretty-php/package.nix

@@ -6,16 +6,16 @@
 }:
 php.buildComposerProject2 (finalAttrs: {
   pname = "pretty-php";
-  version = "0.4.94";
+  version = "0.4.95";
 
   src = fetchFromGitHub {
     owner = "lkrms";
     repo = "pretty-php";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-zBhxuEViLxeQ9m3u1L0wYqeL+YEWWwvJS7PtsFPO5QU=";
+    hash = "sha256-V+xncL02fY0olGxqjWBWqD6N1J0XOeOPe55aULuN2bA=";
   };
 
-  vendorHash = "sha256-Y1/wNFPXza2aO07ZFybpwI3XbTVBhEvFHs9ygHQbcSo=";
+  vendorHash = "sha256-62KnzttuLsDP7DlEING/koS7lxf5A673F5DwppJs3vw=";
 
   passthru = {
     tests.version = testers.testVersion {

pkgs/by-name/qo/qovery-cli/package.nix

@@ -10,16 +10,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "qovery-cli";
-  version = "1.56.1";
+  version = "1.57.0";
 
   src = fetchFromGitHub {
     owner = "Qovery";
     repo = "qovery-cli";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-dVjpmoIO7sOvGNWyN8kshfMJQfBoLo59QD0hfozMe+U=";
+    hash = "sha256-EFzSX75/r81lJbFQ6HA3K21kd4EnBnlxpavRndgMaQs=";
   };
 
-  vendorHash = "sha256-owsLDP2ufW0kXmWOFtAiXKx/YiKEGL0QXkRQy1uA2Uw=";
+  vendorHash = "sha256-Oprgn2/KhTuAwvbbuPVwQrRc1i0Vgsdj29VgwFTYreg=";
 
   env.CGO_ENABLED = 0;
 

pkgs/by-name/re/reaction/package.nix

@@ -1,9 +1,12 @@
 {
   lib,
-  fetchFromGitLab,
+  stdenv,
+  nixosTests,
   rustPlatform,
-  nix-update-script,
+  fetchFromGitLab,
+  versionCheckHook,
   installShellFiles,
+  nix-update-script,
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "reaction";
@@ -19,9 +22,15 @@ rustPlatform.buildRustPackage (finalAttrs: {
 
   cargoHash = "sha256-Bf9XmlY0IMPY4Convftd0Hv8mQbYoiE8WrkkAeaS6Z8=";
 
-  nativeBuildInputs = [
-    installShellFiles
-  ];
+  nativeBuildInputs = [ installShellFiles ];
+
+  # cross compiling for linux target
+  buildInputs =
+    lib.optionals (stdenv.buildPlatform != stdenv.hostPlatform && stdenv.hostPlatform.isLinux)
+      [
+        stdenv.cc.libc
+        (stdenv.cc.libc.static or null)
+      ];
 
   checkFlags = [
     # Those time-based tests behave poorly in low-resource environments (CI...)
@@ -41,9 +50,16 @@ rustPlatform.buildRustPackage (finalAttrs: {
       --bash $releaseDir/reaction.bash \
       --fish $releaseDir/reaction.fish \
       --zsh $releaseDir/_reaction
+    mkdir -p $out/share/examples
+    install -Dm444 config/example* config/README.md $out/share/examples
   '';
 
+  nativeInstallCheckInputs = [ versionCheckHook ];
+  versionCheckProgramArg = "--version";
+  doInstallCheck = true;
+
   passthru.updateScript = nix-update-script { };
+  passthru.tests = { inherit (nixosTests) reaction reaction-firewall; };
 
   meta = {
     description = "Scan logs and take action: an alternative to fail2ban";
@@ -52,6 +68,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
     license = lib.licenses.agpl3Plus;
     mainProgram = "reaction";
     maintainers = with lib.maintainers; [ ppom ];
+    teams = [ lib.teams.ngi ];
     platforms = lib.platforms.unix;
   };
 })

pkgs/by-name/ru/rusty-path-of-building/package.nix

@@ -17,16 +17,16 @@
 }:
 rustPlatform.buildRustPackage rec {
   pname = "rusty-path-of-building";
-  version = "0.2.9";
+  version = "0.2.10";
 
   src = fetchFromGitHub {
     owner = "meehl";
     repo = "rusty-path-of-building";
     rev = "v${version}";
-    hash = "sha256-shJKfn17x//HqnsN4OYQ7EVShFmcvmvu+3dVhE2S/cs=";
+    hash = "sha256-odiiYWoBfcnPNfXsxj0gt/ra6Z3zeBQdWRjF7BazffY=";
   };
 
-  cargoHash = "sha256-BHfHFtYAXkq9Wgsl9t1YWpzPa+G6pHrmw9QhEQucPek=";
+  cargoHash = "sha256-OX4L8EmgMJVT6sFZRdhPl36ZUcXq2JEFpb/PJml2YE8=";
 
   nativeBuildInputs = [
     pkg-config

pkgs/by-name/s7/s7/package.nix

@@ -26,14 +26,14 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "s7";
-  version = "11.7-unstable-2025-12-08";
+  version = "11.7-unstable-2025-12-12";
 
   src = fetchFromGitLab {
     domain = "cm-gitlab.stanford.edu";
     owner = "bil";
     repo = "s7";
-    rev = "e0859623d8780e26b201f2d34c9e7bfde31331fb";
-    hash = "sha256-k7qHTdBUhQDgOF/6Nde9RU/XTA3Neoiq7rIQ9jGWGFs=";
+    rev = "0aae934b91975b85eba6de9fb041ec85e55efc8f";
+    hash = "sha256-gjmeP9qKEMrz7dWH5SoLldwZ7wrFswd8gLIN+ae7y5E=";
   };
 
   buildInputs =

pkgs/by-name/te/textadept/deps.nix

@@ -10,9 +10,9 @@
     sha256 = "sha256-G/CEzNVkwJl8CIFmSjtVEOX1bDqnnnO9hJR3VjLQf3k=";
   };
   # scintillua
-  "scintillua_6.5.zip" = {
-    url = "https://github.com/orbitalquark/scintillua/archive/scintillua_6.5.zip";
-    sha256 = "sha256-mXE4wcEenEf7vgUNyPBPzwu5vSiupbDub656+jlLP68=";
+  "scintillua_6.6.zip" = {
+    url = "https://github.com/orbitalquark/scintillua/archive/scintillua_6.6.zip";
+    sha256 = "sha256-rFza9/ISeet3GsEi9mCM6mUl9mptBfOKWbxMyYKQvGA=";
   };
   # lua
   "lua-5.4.8.tar.gz" = {
@@ -50,8 +50,8 @@
     sha256 = "sha256-IbFow4rbIvS0g5HYGT28OSfx8uZ4wgWNaUSim2Ssxsk=";
   };
   # singleapp
-  "v3.4.0.zip" = {
-    url = "https://github.com/itay-grudev/SingleApplication/archive/refs/tags/v3.4.0.zip";
-    sha256 = "sha256-FwyzM+R9ALpGH9u2RXab4Sqi4Q+p3Qs+8EdfhjPGcXY=";
+  "v3.5.3.zip" = {
+    url = "https://github.com/itay-grudev/SingleApplication/archive/refs/tags/v3.5.3.zip";
+    sha256 = "sha256-7Ipook2pdDl2aDcKWp0f4oG/y9c5DtGxRkKSFjTxiB8=";
   };
 }

pkgs/by-name/te/textadept/package.nix

@@ -10,14 +10,14 @@
   ncurses,
 }:
 stdenv.mkDerivation (finalAttrs: {
-  version = "12.8";
+  version = "12.9";
   pname = "textadept";
 
   src = fetchFromGitHub {
     owner = "orbitalquark";
     repo = "textadept";
     tag = "textadept_${finalAttrs.version}";
-    hash = "sha256-ba5YSZaWGGEFFAbHNNXv2/a4dWrG/o5mTySCmlPauWs=";
+    hash = "sha256-vpBmDcnaHdpYZIfcy482G4NGor+64Dh1tzryb8JJ+c8=";
   };
 
   nativeBuildInputs = [ cmake ] ++ lib.optionals withQt [ libsForQt5.wrapQtAppsHook ];

pkgs/by-name/up/upterm/package.nix

@@ -1,37 +1,48 @@
 {
   lib,
+  stdenv,
   buildGoModule,
   fetchFromGitHub,
+  writableTmpDirAsHomeHook,
   installShellFiles,
   nixosTests,
 }:
 
-buildGoModule rec {
+buildGoModule (finalAttrs: {
   pname = "upterm";
-  version = "0.15.3";
+  version = "0.20.0";
 
   src = fetchFromGitHub {
     owner = "owenthereal";
     repo = "upterm";
-    rev = "v${version}";
-    hash = "sha256-9h4Poz0hUg5/7CrF0ZzT4KrVaFlhvcorIgZbleMpV6w=";
+    rev = "v${finalAttrs.version}";
+    hash = "sha256-qTw8bYROAAB7FwKCCQamIbWGbqSexXl87DdvSNsFZ/I=";
   };
 
-  vendorHash = "sha256-i92RshW5dsRE88X8bXyrj13va66cc0Yu/btpR0pvoSM=";
+  vendorHash = "sha256-5OAS7s9A95h5LihXgOwkOXAMylS7g+lqjaI3MKTvlW0=";
 
   subPackages = [
     "cmd/upterm"
     "cmd/uptermd"
   ];
 
-  nativeBuildInputs = [ installShellFiles ];
+  nativeBuildInputs = [
+    writableTmpDirAsHomeHook
+    installShellFiles
+  ];
 
   postInstall = ''
     # force go to build for build arch rather than host arch during cross-compiling
     CGO_ENABLED=0 GOOS= GOARCH= go run cmd/gendoc/main.go
     installManPage etc/man/man*/*
-    installShellCompletion --bash --name upterm.bash etc/completion/upterm.bash_completion.sh
-    installShellCompletion --zsh --name _upterm etc/completion/upterm.zsh_completion
+  ''
+  + lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
+    for cmd in upterm uptermd; do
+      installShellCompletion --cmd $cmd \
+        --bash <($out/bin/$cmd completion bash) \
+        --fish <($out/bin/$cmd completion fish) \
+        --zsh <($out/bin/$cmd completion zsh)
+    done
   '';
 
   doCheck = true;
@@ -46,4 +57,4 @@ buildGoModule rec {
     license = lib.licenses.asl20;
     maintainers = with lib.maintainers; [ hax404 ];
   };
-}
+})

pkgs/by-name/vi/vintagestory/package.nix

@@ -21,11 +21,11 @@
 
 stdenv.mkDerivation rec {
   pname = "vintagestory";
-  version = "1.21.5";
+  version = "1.21.6";
 
   src = fetchurl {
     url = "https://cdn.vintagestory.at/gamefiles/stable/vs_client_linux-x64_${version}.tar.gz";
-    hash = "sha256-dG1D2Buqht+bRyxx2ie34Z+U1bdKgi5R3w29BG/a5jg=";
+    hash = "sha256-i1IsxT+pjkKbJjHwnMcyb12nxe21mwvnoRGHMabMETY=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/wi/widelands/package.nix

@@ -2,6 +2,7 @@
   lib,
   stdenv,
   fetchFromGitHub,
+  fetchpatch,
   pkg-config, # needed to find minizip
   SDL2,
   SDL2_image,
@@ -38,6 +39,14 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-/MEeb0KnefK812w5y238Icd4gW85d/pvZ08xnlVXDdk=";
   };
 
+  patches = [
+    (fetchpatch {
+      name = "modern-asio.patch";
+      url = "https://codeberg.org/wl/widelands/pulls/5025.patch";
+      sha256 = "sha256-ip9ZG9u/z7G+yG7xrEvi+DH9vsjRzYWhEe0rEjxHzzY=";
+    })
+  ];
+
   postPatch = ''
     substituteInPlace xdg/org.widelands.Widelands.desktop \
       --replace 'Exec=widelands' "Exec=$out/bin/widelands"

pkgs/by-name/xd/xdg-desktop-portal-wlr/package.nix

@@ -22,13 +22,13 @@
 
 stdenv.mkDerivation rec {
   pname = "xdg-desktop-portal-wlr";
-  version = "0.8.0";
+  version = "0.8.1";
 
   src = fetchFromGitHub {
     owner = "emersion";
     repo = "xdg-desktop-portal-wlr";
     rev = "v${version}";
-    sha256 = "sha256-TAWrDH6kud4eXFJvfihImuEFm2uTOaqAOatG+7JmaEM=";
+    sha256 = "sha256-FltwfZtxKdbJuDYVQJTTtEE/WHV5AaDnwPnAkN76qTY=";
   };
 
   strictDeps = true;

pkgs/by-name/xl/xleak/package.nix

@@ -9,16 +9,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "xleak";
-  version = "0.1.0";
+  version = "0.2.5";
 
   src = fetchFromGitHub {
     owner = "bgreenwell";
     repo = "xleak";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-n9AFNGr5kRbQr2P/6QFT0KkuiE6KPun1FZjwrq2iQZs=";
+    hash = "sha256-5amFyNI1cfTu9b5PV7/n4XIXZbFoSnaTyZo7oPpDQL4=";
   };
 
-  cargoHash = "sha256-wWN8FSaIndp9piqRHMMYyWp7iynhWQeUfzT8FDYQUyA=";
+  cargoHash = "sha256-FkSpMwkrnibOWAPbrE9Pycxc4To5jFHbma8YKGgXWSU=";
 
   doInstallCheck = true;
   nativeInstallCheckInputs = [ versionCheckHook ];

pkgs/development/compilers/mlton/default.nix

@@ -1,4 +1,4 @@
-{ callPackage }:
+{ callPackage, stdenv }:
 
 rec {
   mlton20130715 = callPackage ./20130715.nix { };
@@ -21,10 +21,21 @@ rec {
     sha256 = "sha256-rqL8lnzVVR+5Hc7sWXK8dCXN92dU76qSoii3/4StODM=";
   };
 
+  mlton20241230 = callPackage ./from-git-source.nix {
+    mltonBootstrap = mlton20210117Binary;
+    version = "20241230";
+    rev = "on-20241230-release";
+    sha256 = "sha256-gJUzav2xH8C4Vy5FuqN73Z6lPMSPQgJApF8LgsJXRWo=";
+    # https://github.com/MLton/mlton/issues/631
+    doCheck = !(stdenv.hostPlatform.isAarch64 && stdenv.hostPlatform.isDarwin);
+  };
+
   mltonHEAD = callPackage ./from-git-source.nix {
     mltonBootstrap = mlton20210117Binary;
     version = "HEAD";
-    rev = "875f7912a0b135a9a7e86a04ecac9cacf0bfe5e5";
-    sha256 = "sha256-/MIoVqqv8qrJPehU7VRFpXtAAo8UUzE3waEvB7WnS9A=";
+    rev = "61baac7108fbd91413f0537b7a42d9a1023455f4";
+    sha256 = "sha256-nWR7ZaXfKxeXfZ9IHipAQ39ASVtva4BeDHP3Zq8mqPo=";
+    # https://github.com/MLton/mlton/issues/631
+    doCheck = !(stdenv.hostPlatform.isAarch64 && stdenv.hostPlatform.isDarwin);
   };
 }

pkgs/development/compilers/mlton/from-git-source.nix

@@ -9,11 +9,12 @@
   stdenv,
   version,
   which,
+  doCheck ? true,
 }:
 
 stdenv.mkDerivation {
   pname = "mlton";
-  inherit version;
+  inherit version doCheck;
 
   src = fetchgit {
     inherit url rev sha256;
@@ -44,7 +45,5 @@ stdenv.mkDerivation {
       )
   '';
 
-  doCheck = true;
-
   meta = import ./meta.nix { inherit lib; };
 }

pkgs/development/coq-modules/coq-lsp/default.nix

@@ -23,6 +23,9 @@
   release."0.2.4+8.20".sha256 = "sha256-mQxh2/Cb5hZ99TtqWYLpZ/BRPrm5GRDYPDfKlCTK9N4=";
   release."0.2.4+9.0".sha256 = "sha256-ICPdNxJODNqmUErdTkNk7s52MRuINWLbAPm0rmXFW18=";
   release."0.2.4+9.1".sha256 = "sha256-HNHA2vbX70oZkd4QtbP28UbTRXatqxJdxw1OWDVDE8U=";
+  release."0.2.5+8.20".sha256 = "sha256-OduwwJESXVEkeX+w8nLEhLUtPo4YGDPj21yWyc1uv3U=";
+  release."0.2.5+9.0".sha256 = "sha256-nbMf7xziBYoBH0F8YBUEybCHSdsaOxlqXnyngeQNg3c=";
+  release."0.2.5+9.1".sha256 = "sha256-PzIgo15zI3JjibT8GzyHdTwofd3IF6eRmUc47NveH70=";
 
   inherit version;
   defaultVersion =
@@ -46,15 +49,15 @@
       }
       {
         case = isEq "8.20";
-        out = "0.2.4+8.20";
+        out = "0.2.5+8.20";
       }
       {
         case = isEq "9.0";
-        out = "0.2.4+9.0";
+        out = "0.2.5+9.0";
       }
       {
         case = isEq "9.1";
-        out = "0.2.4+9.1";
+        out = "0.2.5+9.1";
       }
     ] null;
 

pkgs/development/libraries/agda/agda-categories/default.nix

@@ -13,7 +13,7 @@ mkDerivation rec {
     owner = "agda";
     repo = "agda-categories";
     rev = "v${version}";
-    sha256 = "sha256-zPh6RFnky4KsnQx5Y/3FeYZ/jWK+hqJGNyCjEFPPHWQ=";
+    sha256 = "sha256-/3e8CkaTr0bUBgzhjAvu2RV6y0gk77VRA4PE6vutKPc=";
   };
 
   postPatch = ''

pkgs/development/ocaml-modules/frama-c-lannotate/default.nix

@@ -0,0 +1,29 @@
+{
+  lib,
+  buildDunePackage,
+  dune-site,
+  fetchzip,
+  frama-c,
+}:
+
+buildDunePackage (finalAttrs: {
+  pname = "frama-c-lannotate";
+  version = "0.2.4";
+
+  src = fetchzip {
+    url = "https://git.frama-c.com/pub/ltest/lannotate/-/archive/${finalAttrs.version}/lannotate-${finalAttrs.version}.tar.bz2";
+    hash = "sha256-JoD2M3R3/DcUMt33QOvwqHg4eToCgjB8riKc09TWdyc=";
+  };
+
+  propagatedBuildInputs = [
+    dune-site
+    frama-c
+  ];
+
+  meta = {
+    description = "Lannotate plugin of Frama-C, part of the LTest suite";
+    homepage = "https://frama-c.com/fc-plugins/ltest.html";
+    license = lib.licenses.lgpl2;
+    maintainers = with lib.maintainers; [ redianthus ];
+  };
+})

pkgs/development/ocaml-modules/frama-c/default.nix

@@ -0,0 +1,43 @@
+{
+  stdenv,
+  pkgs,
+  ocaml,
+  findlib,
+  framac,
+  camlzip,
+  ocamlgraph,
+  menhirLib,
+  ppx_deriving,
+  yaml,
+  yojson,
+  zarith,
+}:
+
+stdenv.mkDerivation {
+  pname = "ocaml${ocaml.version}-frama-c";
+  inherit (framac) version meta;
+
+  dontUnpack = true;
+
+  buildInputs = [ findlib ];
+
+  propagatedBuildInputs = [
+    camlzip
+    menhirLib
+    ocamlgraph
+    ppx_deriving
+    yaml
+    yojson
+    zarith
+  ];
+
+  installPhase = ''
+    runHook preInstall
+    mkdir -p $OCAMLFIND_DESTDIR
+    for p in ${framac}/lib/*
+    do
+      ln -s $p $OCAMLFIND_DESTDIR/
+    done
+    runHook postInstall
+  '';
+}

pkgs/development/python-modules/boto3-stubs/default.nix

@@ -358,13 +358,13 @@
 
 buildPythonPackage rec {
   pname = "boto3-stubs";
-  version = "1.42.9";
+  version = "1.42.10";
   pyproject = true;
 
   src = fetchPypi {
     pname = "boto3_stubs";
     inherit version;
-    hash = "sha256-sTK+gmDrVgELR0mWWM9sSF+Z6gGQlp59Gtt0xQXIPmg=";
+    hash = "sha256-Xw9tCzwwyE+z0aL8P8uusre/GTKb3qn2KHy9Du/TOgc=";
   };
 
   build-system = [ setuptools ];

pkgs/development/python-modules/botocore-stubs/default.nix

@@ -9,13 +9,13 @@
 
 buildPythonPackage rec {
   pname = "botocore-stubs";
-  version = "1.42.9";
+  version = "1.42.10";
   pyproject = true;
 
   src = fetchPypi {
     pname = "botocore_stubs";
     inherit version;
-    hash = "sha256-kv3SodkRNVFm2j4w6bubGAP34srsDZE/X606kgNSzm0=";
+    hash = "sha256-6G/LDWdVVZtxRIExaFTRmmtLmTAjYH2kfVagx11Pk4c=";
   };
 
   nativeBuildInputs = [ setuptools ];

pkgs/development/python-modules/elevenlabs/default.nix

@@ -13,7 +13,7 @@
 }:
 
 let
-  version = "2.26.1";
+  version = "2.27.0";
   tag = "v${version}";
 in
 buildPythonPackage {
@@ -25,7 +25,7 @@ buildPythonPackage {
     owner = "elevenlabs";
     repo = "elevenlabs-python";
     inherit tag;
-    hash = "sha256-cVqbN2OvzRFmnZojjycGZsGpj26o9rJYGCcfeW56YOY=";
+    hash = "sha256-S4UlutpQuF+H3ICB7cBX6tlOUgwHzBYNXR0R5eHji8w=";
   };
 
   build-system = [ poetry-core ];

pkgs/development/python-modules/iamdata/default.nix

@@ -8,14 +8,14 @@
 
 buildPythonPackage rec {
   pname = "iamdata";
-  version = "0.1.202512141";
+  version = "0.1.202512161";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "cloud-copilot";
     repo = "iam-data-python";
     tag = "v${version}";
-    hash = "sha256-NUtxqvCrsnBxoFOHBbqT8HZBBICsEuq17XGhz7XI3yo=";
+    hash = "sha256-i8eNsCX56h0PrJm3Qd4TzSPAVoK5Un0W5AH2eMOXH68=";
   };
 
   __darwinAllowLocalNetworking = true;

pkgs/development/python-modules/langchain-classic/default.nix

@@ -104,7 +104,10 @@ buildPythonPackage rec {
   ];
 
   # Bulk updater selects wrong tag (there is no tag for this yet)
-  passthru.skipBulkUpdate = true;
+  passthru = {
+    skipBulkUpdate = true;
+    updateScript = false;
+  };
 
   pythonImportsCheck = [ "langchain_classic" ];
 

pkgs/development/python-modules/langsmith/default.nix

@@ -32,14 +32,14 @@
 
 buildPythonPackage rec {
   pname = "langsmith";
-  version = "0.4.58";
+  version = "0.4.59";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "langchain-ai";
     repo = "langsmith-sdk";
     tag = "v${version}";
-    hash = "sha256-2Cxb7zQDUqAfzR59oVx7r33R88ISTmOSLsoU3Wf9HSQ=";
+    hash = "sha256-IL1lwV+WkIpYAlx+n08XlzbvzyDMUQCCZKmA+ImBIqU=";
   };
 
   sourceRoot = "${src.name}/python";

pkgs/development/python-modules/mypy-boto3/default.nix

@@ -338,8 +338,8 @@ in
       "sha256-imDBFBMNm8LdlHf9m21aS39DGfF0dbpd7DsZ8fMzIyM=";
 
   mypy-boto3-connect =
-    buildMypyBoto3Package "connect" "1.42.9"
-      "sha256-rw52qFKriqJ5yswHBenlQxzw8kMBahV5tlBu5ksf/UA=";
+    buildMypyBoto3Package "connect" "1.42.10"
+      "sha256-Ub7PZwdvQmJJDZA7iPY0MTIF582EWj1yPB2SqyxhyC8=";
 
   mypy-boto3-connect-contact-lens =
     buildMypyBoto3Package "connect-contact-lens" "1.42.3"
@@ -446,8 +446,8 @@ in
       "sha256-92qhSUqTiLgbtvCdi/Mmgve18mcYR00ABL+bNy7/OnY=";
 
   mypy-boto3-ec2 =
-    buildMypyBoto3Package "ec2" "1.42.5"
-      "sha256-G1TqpkA8EGd0lvfczdDCkRUzsfJuSlcyr1b70xFBeW8=";
+    buildMypyBoto3Package "ec2" "1.42.10"
+      "sha256-fmYwZ5a8Q8gFSeyvXnIxnUl2qtPW3RHc6SyWD19TF6Y=";
 
   mypy-boto3-ec2-instance-connect =
     buildMypyBoto3Package "ec2-instance-connect" "1.42.3"
@@ -510,8 +510,8 @@ in
       "sha256-N975AhqJFTeUcfAob8UcArGMnoDrp6T023OtmEJK4DY=";
 
   mypy-boto3-entityresolution =
-    buildMypyBoto3Package "entityresolution" "1.42.3"
-      "sha256-tZwEY8f91YWYCfHb3gSnbv0haTbyFKgpCvQKQDg12OE=";
+    buildMypyBoto3Package "entityresolution" "1.42.10"
+      "sha256-DyAxO4HPA98ON9Q2Sp5HF1lQNp8yecGiEaV12m0E7zM=";
 
   mypy-boto3-es =
     buildMypyBoto3Package "es" "1.42.3"
@@ -566,8 +566,8 @@ in
       "sha256-4LBhjln6mCxMSooGEV7mo1Fe7U6Jssxq+6JYwqnFhRs=";
 
   mypy-boto3-glacier =
-    buildMypyBoto3Package "glacier" "1.42.3"
-      "sha256-06ckDtpv0ZvarXu9RIy8UxLRprY54/NBmrCyc7vQ5ek=";
+    buildMypyBoto3Package "glacier" "1.42.10"
+      "sha256-EFKWChvNMhj07s/la58yb7iZKtAh96qysffZ8LdvZeE=";
 
   mypy-boto3-globalaccelerator =
     buildMypyBoto3Package "globalaccelerator" "1.42.3"
@@ -597,8 +597,8 @@ in
       "sha256-Wt++1dfId2tV74JssQK0iNv8jgyEfc1i0y5rUgtPecM=";
 
   mypy-boto3-health =
-    buildMypyBoto3Package "health" "1.42.3"
-      "sha256-sK6S4e6Bbvz9sjjxiTUGYS8uS+G/PRVVLGP8X+/c1HY=";
+    buildMypyBoto3Package "health" "1.42.10"
+      "sha256-4dxV8ztTpIHOx0SYIc0IZCMsThugUkobRYzjgkP5TnE=";
 
   mypy-boto3-healthlake =
     buildMypyBoto3Package "healthlake" "1.42.3"
@@ -809,8 +809,8 @@ in
       "sha256-VGQzgnrUynTDjfYpEk+FR+PrljbULl0UpbeqbaPKqSc=";
 
   mypy-boto3-logs =
-    buildMypyBoto3Package "logs" "1.42.3"
-      "sha256-6pXN1oeCkD+5UfHjhgXKOjLTtpfTFgObNZixP+2fJvo=";
+    buildMypyBoto3Package "logs" "1.42.10"
+      "sha256-Or5B12+lM/6CJUtOAIEjcv2PJA3/18Dd1L40UD0feD8=";
 
   mypy-boto3-lookoutequipment =
     buildMypyBoto3Package "lookoutequipment" "1.42.3"
@@ -889,8 +889,8 @@ in
       "sha256-VBsw9c9B6r3G5vJ0iVUCi4wVoFprYseRLeMWs69KpTQ=";
 
   mypy-boto3-mediatailor =
-    buildMypyBoto3Package "mediatailor" "1.42.3"
-      "sha256-qkV6ZthcahS3h03vCnkam1Q78uas/Sfcqwk0c4R9tAg=";
+    buildMypyBoto3Package "mediatailor" "1.42.10"
+      "sha256-4YmRgBRIz2NtTnU6aSJ+0tPAaOXsMZQY0GFTHjqtF8I=";
 
   mypy-boto3-medical-imaging =
     buildMypyBoto3Package "medical-imaging" "1.42.3"
@@ -1153,16 +1153,16 @@ in
       "sha256-AasFHhNs7b904wj2hzm0Hhj0CHit16bl+f+0cl9Y/t4=";
 
   mypy-boto3-route53resolver =
-    buildMypyBoto3Package "route53resolver" "1.42.3"
-      "sha256-Q+Mzw0HmswKrJIH1KanYN/Hk1Uba3Sel5SdcX/1yH1w=";
+    buildMypyBoto3Package "route53resolver" "1.42.10"
+      "sha256-4zDAA7G0yZl+cm8l2aW/ATWy/Zv/1ogO1IYy7fmBKCk=";
 
   mypy-boto3-rum =
     buildMypyBoto3Package "rum" "1.42.3"
       "sha256-4/Q39UsUYaluauoaLm6BOej+Krl2VbO1xKKo1orRIkI=";
 
   mypy-boto3-s3 =
-    buildMypyBoto3Package "s3" "1.42.3"
-      "sha256-JQe9+heCnx9CK4vzNNuDZomwUp++ZjWvTg86qnL5KAY=";
+    buildMypyBoto3Package "s3" "1.42.10"
+      "sha256-mkV1EktQDCnAI5GfF7Ai5mEJpWuiMY74rqs9DdLNF04=";
 
   mypy-boto3-s3control =
     buildMypyBoto3Package "s3control" "1.42.3"
@@ -1233,8 +1233,8 @@ in
       "sha256-JIwTLfrkWY98gY+eH15Sy7r9Kif+68pBqgmZoj2DTWQ=";
 
   mypy-boto3-service-quotas =
-    buildMypyBoto3Package "service-quotas" "1.42.3"
-      "sha256-INL6mi8S7oWOsHUoHb1h+uryG6chligV5vwB02XIoas=";
+    buildMypyBoto3Package "service-quotas" "1.42.10"
+      "sha256-aqQDN3jmfxcZ8PLBE9wsb4M2N7w3B+3ruKNcAngyKFE=";
 
   mypy-boto3-servicecatalog =
     buildMypyBoto3Package "servicecatalog" "1.42.3"

pkgs/development/python-modules/otxv2/default.nix

@@ -0,0 +1,43 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  python-dateutil,
+  pytz,
+  requests,
+  setuptools,
+}:
+
+buildPythonPackage rec {
+  pname = "otxv2";
+  version = "1.5.12";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "AlienVault-OTX";
+    repo = "OTX-Python-SDK";
+    tag = version;
+    hash = "sha256-JAjBXNsX0Cuni+4L6I1RuaSfors5cBAZ2krPLhIFluY=";
+  };
+
+  build-system = [ setuptools ];
+
+  dependencies = [
+    python-dateutil
+    pytz
+    requests
+  ];
+
+  # Tests require network access
+  doCheck = false;
+
+  pythonImportsCheck = [ "OTXv2" ];
+
+  meta = {
+    description = "The Python SDK for AlienVault OTX";
+    homepage = "https://github.com/AlienVault-OTX/OTX-Python-SDK";
+    changelog = "https://github.com/AlienVault-OTX/OTX-Python-SDK/releases/tag/${src.tag}";
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ fab ];
+  };
+}

pkgs/development/python-modules/pyahocorasick/default.nix

@@ -8,14 +8,14 @@
 
 buildPythonPackage rec {
   pname = "pyahocorasick";
-  version = "2.2.0";
-  format = "setuptools";
+  version = "2.3.0";
+  pyproject = true;
 
   src = fetchFromGitHub {
     owner = "WojciechMula";
     repo = "pyahocorasick";
     tag = "v${version}";
-    hash = "sha256-lFJhHDN9QAKw5dqzgjRxcs+7+LuTqP9qQ68B5LlCNmU=";
+    hash = "sha256-ysQZOyJZ9xrNp3plVpaDtGqzjNuRDAELtAcjbC8Byis=";
   };
 
   build-system = [ setuptools ];

pkgs/development/python-modules/pymeshlab/default.nix

@@ -4,13 +4,16 @@
   stdenv,
   fetchFromGitHub,
   fetchpatch,
+  buildPythonPackage,
+  python,
 
   # nativeBuildInputs
   cmake,
-  python3Packages,
+  pybind11,
 
   # propagatedBuildInputs
   meshlab,
+  numpy,
 
   # buildInputs
   libsForQt5,
@@ -19,14 +22,18 @@
   vcg,
 }:
 
-stdenv.mkDerivation (finalAttrs: {
-  pname = "pymeshlab";
+let
   version = "2025.7";
+in
+buildPythonPackage {
+  inherit version;
+  pname = "pymeshlab";
+  pyproject = false;
 
   src = fetchFromGitHub {
     owner = "cnr-isti-vclab";
     repo = "pymeshlab";
-    tag = "v${finalAttrs.version}";
+    tag = "v${version}";
     hash = "sha256-LCR2/AyX9uVX4xhZareUL6YlpUsCFiGDMBB5nFp+H6k=";
   };
 
@@ -42,16 +49,12 @@ stdenv.mkDerivation (finalAttrs: {
 
   nativeBuildInputs = [
     cmake
-    python3Packages.pybind11
-  ];
-
-  nativeCheckInputs = [
-    python3Packages.pythonImportsCheckHook
+    pybind11
   ];
 
   propagatedBuildInputs = [
     meshlab
-    python3Packages.numpy
+    numpy
   ];
 
   buildInputs = [
@@ -66,7 +69,7 @@ stdenv.mkDerivation (finalAttrs: {
   dontWrapQtApps = true;
 
   cmakeFlags = [
-    "-DCMAKE_INSTALL_PREFIX=${placeholder "out"}/${python3Packages.python.sitePackages}/pymeshlab"
+    "-DCMAKE_INSTALL_PREFIX=${placeholder "out"}/${python.sitePackages}/pymeshlab"
   ];
 
   # Get io & filter plugins from meshlab, to avoild render, decorate & edit ones
@@ -80,7 +83,7 @@ stdenv.mkDerivation (finalAttrs: {
       pyPlugins = if stdenv.hostPlatform.isDarwin then "PlugIns" else "lib/plugins";
     in
     ''
-      install -D -t $out/${python3Packages.python.sitePackages}/pymeshlab/${pyPlugins} \
+      install -D -t $out/${python.sitePackages}/pymeshlab/${pyPlugins} \
         ${meshlab}/${plugins}/libio_* \
         ${meshlab}/${plugins}/libfilter_*
     '';
@@ -88,7 +91,7 @@ stdenv.mkDerivation (finalAttrs: {
   postFixup = lib.optionalString stdenv.hostPlatform.isLinux ''
     patchelf \
       --add-needed ${meshlab}/lib/meshlab/libmeshlab-common.so \
-      $out/${python3Packages.python.sitePackages}/pymeshlab/pmeshlab.*.so
+      $out/${python.sitePackages}/pymeshlab/pmeshlab.*.so
   '';
 
   pythonImportsCheck = [ "pymeshlab" ];
@@ -100,4 +103,4 @@ stdenv.mkDerivation (finalAttrs: {
     maintainers = with lib.maintainers; [ nim65s ];
     platforms = with lib.platforms; linux ++ darwin;
   };
-})
+}

pkgs/development/python-modules/pyqt/6.x.nix

@@ -21,6 +21,7 @@
   withPrintSupport ? true,
   withSerialPort ? false,
   cups,
+  withSpeech ? true,
 }:
 
 buildPythonPackage rec {
@@ -105,7 +106,8 @@ buildPythonPackage rec {
     ++ lib.optional withMultimedia qtmultimedia
     ++ lib.optional withWebSockets qtwebsockets
     ++ lib.optional withLocation qtlocation
-    ++ lib.optional withSerialPort qtserialport;
+    ++ lib.optional withSerialPort qtserialport
+    ++ lib.optional withSpeech qtspeech;
 
   buildInputs =
     with qt6Packages;
@@ -121,7 +123,8 @@ buildPythonPackage rec {
     ++ lib.optional withMultimedia qtmultimedia
     ++ lib.optional withWebSockets qtwebsockets
     ++ lib.optional withLocation qtlocation
-    ++ lib.optional withSerialPort qtserialport;
+    ++ lib.optional withSerialPort qtserialport
+    ++ lib.optional withSpeech qtspeech;
 
   propagatedBuildInputs =
     # ld: library not found for -lcups
@@ -150,7 +153,8 @@ buildPythonPackage rec {
   ++ lib.optional withMultimedia "PyQt6.QtMultimedia"
   # ++ lib.optional withConnectivity "PyQt6.QtConnectivity"
   ++ lib.optional withLocation "PyQt6.QtPositioning"
-  ++ lib.optional withSerialPort "PyQt6.QtSerialPort";
+  ++ lib.optional withSerialPort "PyQt6.QtSerialPort"
+  ++ lib.optional withSpeech "PyQt6.QtTextToSpeech";
 
   env.NIX_CFLAGS_COMPILE = lib.optionalString stdenv.hostPlatform.isDarwin "-Wno-address-of-temporary";
 

pkgs/development/python-modules/pytensor/default.nix

@@ -15,13 +15,13 @@
   filelock,
   logical-unification,
   minikanren,
+  numba,
   numpy,
   scipy,
 
   # tests
   jax,
   jaxlib,
-  numba,
   pytest-benchmark,
   pytest-mock,
   pytestCheckHook,
@@ -33,7 +33,7 @@
 
 buildPythonPackage rec {
   pname = "pytensor";
-  version = "2.35.1";
+  version = "2.36.0";
   pyproject = true;
 
   src = fetchFromGitHub {
@@ -43,7 +43,7 @@ buildPythonPackage rec {
     postFetch = ''
       sed -i 's/git_refnames = "[^"]*"/git_refnames = " (tag: ${src.tag})"/' $out/pytensor/_version.py
     '';
-    hash = "sha256-5+yMZysK69g+3uYrP12WK3ngpAYn8XrHoVjLqjvbobg=";
+    hash = "sha256-tzwiPp0+xNKmndTn9Y1AXiqscQWaCC8gKgQHEtkyGag=";
   };
 
   build-system = [
@@ -58,6 +58,7 @@ buildPythonPackage rec {
     filelock
     logical-unification
     minikanren
+    numba
     numpy
     scipy
   ];

pkgs/development/python-modules/pytransportnswv2/default.nix

@@ -10,13 +10,12 @@
 
 buildPythonPackage rec {
   pname = "pytransportnswv2";
-  version = "2.0.8";
+  version = "2.2.0";
   pyproject = true;
 
   src = fetchPypi {
-    pname = "PyTransportNSWv2";
-    inherit version;
-    hash = "sha256-+hE5onXQ/Isv+U7y9+CphpYTOW7CsMxR7M8jZS1djSs=";
+    inherit pname version;
+    hash = "sha256-gQhXq2ZnpXMYdicDN3QWenF+kezbA9ByrzATVdybMNM=";
   };
 
   build-system = [ setuptools ];

pkgs/development/python-modules/pywerview/default.nix

@@ -8,22 +8,19 @@
   lxml,
   pyasn1,
   pycryptodome,
-  pythonOlder,
   setuptools,
 }:
 
 buildPythonPackage rec {
   pname = "pywerview";
-  version = "0.7.4";
+  version = "0.7.5";
   pyproject = true;
 
-  disabled = pythonOlder "3.7";
-
   src = fetchFromGitHub {
     owner = "the-useless-one";
     repo = "pywerview";
     tag = "v${version}";
-    hash = "sha256-PJCJyutlHApiA+5CxIpYzC13MSwd2n5zm+ZkJUppDTg=";
+    hash = "sha256-wl7/u9Uja/FflO3tN3UyanX2LIRG417RfWdyZCtUtGs=";
   };
 
   build-system = [ setuptools ];
@@ -49,7 +46,7 @@ buildPythonPackage rec {
   meta = {
     description = "Module for PowerSploit's PowerView support";
     homepage = "https://github.com/the-useless-one/pywerview";
-    changelog = "https://github.com/the-useless-one/pywerview/releases/tag/v${version}";
+    changelog = "https://github.com/the-useless-one/pywerview/releases/tag/${src.tag}";
     license = lib.licenses.gpl3Plus;
     maintainers = with lib.maintainers; [ fab ];
     mainProgram = "pywerview";

pkgs/development/python-modules/recipe-scrapers/default.nix

@@ -17,7 +17,7 @@
 
 buildPythonPackage rec {
   pname = "recipe-scrapers";
-  version = "15.10.0";
+  version = "15.11.0";
   pyproject = true;
 
   disabled = pythonOlder "3.9";
@@ -26,7 +26,7 @@ buildPythonPackage rec {
     owner = "hhursev";
     repo = "recipe-scrapers";
     tag = version;
-    hash = "sha256-04jREzBKjkly/BEWJnLx1FE7V10vBU3Q893O95B7hj4=";
+    hash = "sha256-S0/RPVeEr/lAPJZSUwCippuXyirYnmaAuesWGYwg6kE=";
   };
 
   build-system = [ setuptools ];

pkgs/development/python-modules/spython/default.nix

@@ -4,21 +4,18 @@
   fetchFromGitHub,
   setuptools,
   pytestCheckHook,
-  pythonOlder,
 }:
 
 buildPythonPackage rec {
   pname = "spython";
-  version = "0.3.14";
+  version = "0.3.15";
   pyproject = true;
 
-  disabled = pythonOlder "3.9";
-
   src = fetchFromGitHub {
     owner = "singularityhub";
     repo = "singularity-cli";
     tag = version;
-    hash = "sha256-PNMzqnKb691wcd8aGSleqHOcsUrahl8e0r5s5ek5GmQ=";
+    hash = "sha256-XYiudDXXiX0izFZZpQb71DBg/wRKjeupvKHixGFVuKM=";
   };
 
   postPatch = ''
@@ -47,7 +44,7 @@ buildPythonPackage rec {
   meta = {
     description = "Streamlined singularity python client (spython) for singularity";
     homepage = "https://github.com/singularityhub/singularity-cli";
-    changelog = "https://github.com/singularityhub/singularity-cli/blob/${version}/CHANGELOG.md";
+    changelog = "https://github.com/singularityhub/singularity-cli/blob/${src.tag}/CHANGELOG.md";
     license = lib.licenses.mpl20;
     maintainers = with lib.maintainers; [ fab ];
     mainProgram = "spython";

pkgs/development/python-modules/stringzilla/default.nix

@@ -10,14 +10,14 @@
 
 buildPythonPackage rec {
   pname = "stringzilla";
-  version = "4.4.2";
+  version = "4.5.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "ashvardanian";
     repo = "stringzilla";
     tag = "v${version}";
-    hash = "sha256-o3MrIPzu61Zod6RpmWA356hlquVPQKu7+aYZrqxjMjo=";
+    hash = "sha256-0T8hQ+P6gZnIX52jkRcpF1Ofxy45+B7K/feEQr5Phf0=";
   };
 
   build-system = [

pkgs/development/python-modules/urlscan-python/default.nix

@@ -0,0 +1,51 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  hatchling,
+  httpx,
+  pytest-freezer,
+  pytest-httpserver,
+  pytest-randomly,
+  pytest-timeout,
+  pytestCheckHook,
+  uv-dynamic-versioning,
+}:
+
+buildPythonPackage rec {
+  pname = "urlscan-python";
+  version = "0.0.1";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "urlscan";
+    repo = "urlscan-python";
+    tag = "v${version}";
+    hash = "sha256-HkovBmmVvUYA5U43w5TUOcwhZAN/0o0BETd1s9R940w=";
+  };
+
+  build-system = [
+    hatchling
+    uv-dynamic-versioning
+  ];
+
+  dependencies = [ httpx ];
+
+  nativeCheckInputs = [
+    pytest-freezer
+    pytest-httpserver
+    pytest-randomly
+    pytest-timeout
+    pytestCheckHook
+  ];
+
+  pythonImportsCheck = [ "urlscan" ];
+
+  meta = {
+    description = "Python API client for urlscan.io";
+    homepage = "https://github.com/urlscan/urlscan-python/";
+    changelog = "https://github.com/urlscan/urlscan-python/releases/tag/${src.tag}";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ fab ];
+  };
+}

pkgs/development/python-modules/watermark/default.nix

@@ -6,27 +6,24 @@
   ipython,
   py3nvml,
   pytestCheckHook,
-  pythonOlder,
   setuptools,
 }:
 
 buildPythonPackage rec {
   pname = "watermark";
-  version = "2.5.0";
+  version = "2.5.1";
   pyproject = true;
 
-  disabled = pythonOlder "3.7";
-
   src = fetchFromGitHub {
     owner = "rasbt";
     repo = "watermark";
     tag = "v${version}";
-    hash = "sha256-UR4kV6UoZ/JLO19on+qEH+M05QIsT0SXvXJtTMCKuZM=";
+    hash = "sha256-vHnXPGHPQz6+y2ZvfmUouL/3JlATGo4fmZ8AIk+bNEU=";
   };
 
-  nativeBuildInputs = [ setuptools ];
+  build-system = [ setuptools ];
 
-  propagatedBuildInputs = [
+  dependencies = [
     ipython
     importlib-metadata
   ];
@@ -45,7 +42,7 @@ buildPythonPackage rec {
   meta = {
     description = "IPython extension for printing date and timestamps, version numbers, and hardware information";
     homepage = "https://github.com/rasbt/watermark";
-    changelog = "https://github.com/rasbt/watermark/releases/tag/v${version}";
+    changelog = "https://github.com/rasbt/watermark/releases/tag/${src.tag}";
     license = lib.licenses.bsd3;
     maintainers = with lib.maintainers; [ nphilou ];
   };

pkgs/kde/plasma/plasma-vault/hardcode-paths.patch

@@ -1,5 +1,5 @@
 diff --git a/kded/engine/backends/cryfs/cryfsbackend.cpp b/kded/engine/backends/cryfs/cryfsbackend.cpp
-index f425eb3..5b8cd43 100644
+index 64138b6..5d249aa 100644
 --- a/kded/engine/backends/cryfs/cryfsbackend.cpp
 +++ b/kded/engine/backends/cryfs/cryfsbackend.cpp
 @@ -207,7 +207,7 @@ QProcess *CryFsBackend::cryfs(const QStringList &arguments) const
@@ -44,7 +44,7 @@ index b992f6f..eb828dd 100644
  
  QString GocryptfsBackend::getConfigFilePath(const Device &device) const
 diff --git a/kded/engine/fusebackend_p.cpp b/kded/engine/fusebackend_p.cpp
-index 8763304..e6860d2 100644
+index 714b660..61d8bf5 100644
 --- a/kded/engine/fusebackend_p.cpp
 +++ b/kded/engine/fusebackend_p.cpp
 @@ -90,7 +90,7 @@ QProcess *FuseBackend::process(const QString &executable, const QStringList &arg
@@ -57,19 +57,19 @@ index 8763304..e6860d2 100644
  
  FutureResult<> FuseBackend::initialize(const QString &name, const Device &device, const MountPoint &mountPoint, const Vault::Payload &payload)
 diff --git a/kded/engine/vault.cpp b/kded/engine/vault.cpp
-index c101079..67c8a83 100644
+index a7a4741..773b671 100644
 --- a/kded/engine/vault.cpp
 +++ b/kded/engine/vault.cpp
-@@ -485,7 +485,7 @@ FutureResult<> Vault::close()
-             } else {
-                 // We want to check whether there is an application
-                 // that is accessing the vault
--                AsynQt::Process::getOutput(QStringLiteral("lsof"), {QStringLiteral("-t"), mountPoint().data()}) | cast<QString>() | onError([this] {
-+                AsynQt::Process::getOutput(QStringLiteral("@lsof@"), {QStringLiteral("-t"), mountPoint().data()}) | cast<QString>() | onError([this] {
-                     d->updateMessage(i18n("Unable to lock the vault because an application is using it"));
-                 }) | onSuccess([this](const QString &result) {
-                     // based on ksolidnotify.cpp
-@@ -538,7 +538,7 @@ FutureResult<> Vault::forceClose()
+@@ -490,7 +490,7 @@ FutureResult<> Vault::close()
+                 } else {
+                     // We want to check whether there is an application
+                     // that is accessing the vault
+-                    AsynQt::Process::getOutput(QStringLiteral("lsof"), { QStringLiteral("-t"), mountPoint().data() })
++                    AsynQt::Process::getOutput(QStringLiteral("@lsof@"), { QStringLiteral("-t"), mountPoint().data() })
+                         | cast<QString>()
+                         | onError([this] {
+                             d->updateMessage(i18n("Unable to close the vault because an application is using it"));
+@@ -546,7 +546,7 @@ FutureResult<> Vault::forceClose()
      using namespace AsynQt::operators;
  
      AsynQt::await(

pkgs/kde/third-party/krohnkite/default.nix

@@ -2,7 +2,7 @@
   lib,
   nix-update-script,
   buildNpmPackage,
-  fetchFromGitHub,
+  fetchFromGitea,
   nodejs_22,
   kwin,
   kpackage,
@@ -12,10 +12,11 @@ buildNpmPackage (finalAttrs: {
   pname = "krohnkite";
   version = "0.9.9.2";
 
-  src = fetchFromGitHub {
+  src = fetchFromGitea {
+    domain = "codeberg.org";
     owner = "anametologin";
-    repo = "krohnkite";
-    tag = finalAttrs.version;
+    repo = "Krohnkite";
+    rev = finalAttrs.version;
     hash = "sha256-gulKg23BeWL270B2omRYJIuAHIsKu1cBVpimgButM9I=";
   };
 
@@ -56,8 +57,8 @@ buildNpmPackage (finalAttrs: {
 
   meta = {
     description = "Dynamic Tiling Extension for KWin 6";
-    homepage = "https://github.com/anametologin/krohnkite";
-    changelog = "https://github.com/anametologin/krohnkite/releases/tag/${finalAttrs.version}";
+    homepage = "https://codeberg.org/anametologin/Krohnkite";
+    changelog = "https://codeberg.org/anametologin/Krohnkite/releases/tag/${finalAttrs.version}";
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [
       ben9986

pkgs/servers/home-assistant/custom-components/ingress/package.nix

@@ -7,13 +7,13 @@
 buildHomeAssistantComponent rec {
   owner = "lovelylain";
   domain = "ingress";
-  version = "1.2.9";
+  version = "1.2.10";
 
   src = fetchFromGitHub {
     inherit owner;
     repo = "hass_ingress";
     tag = version;
-    hash = "sha256-jjig0Dl/vdeuN7e25CH5L/Xvc60RM3BiAt3jUw/C9q4=";
+    hash = "sha256-wenazww4eoO6qnHksRqPNw8Lee3EVyJ3lvc+qa+3I/0=";
   };
 
   meta = {

pkgs/tools/security/gopass/git-credential.nix

@@ -1,46 +0,0 @@
-{
-  lib,
-  makeWrapper,
-  buildGoModule,
-  fetchFromGitHub,
-  gopass,
-}:
-
-buildGoModule rec {
-  pname = "git-credential-gopass";
-  version = "1.16.0";
-
-  src = fetchFromGitHub {
-    owner = "gopasspw";
-    repo = "git-credential-gopass";
-    rev = "v${version}";
-    hash = "sha256-1045Ui8/WKNkAi6iSpJ1nsryA9J3U5KMAElYwN6Dho8=";
-  };
-
-  vendorHash = "sha256-JDrC0h4+ltdMHOR36BDkVpcFDDaHGv6IDnW0O4QvWVI=";
-
-  subPackages = [ "." ];
-
-  nativeBuildInputs = [ makeWrapper ];
-
-  ldflags = [
-    "-s"
-    "-w"
-    "-X main.version=${version}"
-    "-X main.commit=${src.rev}"
-  ];
-
-  postFixup = ''
-    wrapProgram $out/bin/git-credential-gopass \
-      --prefix PATH : "${lib.makeBinPath [ gopass ]}"
-  '';
-
-  meta = {
-    description = "Manage git credentials using gopass";
-    homepage = "https://github.com/gopasspw/git-credential-gopass";
-    changelog = "https://github.com/gopasspw/git-credential-gopass/blob/v${version}/CHANGELOG.md";
-    license = lib.licenses.mit;
-    maintainers = with lib.maintainers; [ benneti ];
-    mainProgram = "git-credential-gopass";
-  };
-}

pkgs/top-level/all-packages.nix

@@ -1619,14 +1619,6 @@ with pkgs;
 
   passExtensions = recurseIntoAttrs pass.extensions;
 
-  gopass = callPackage ../tools/security/gopass { };
-
-  gopass-hibp = callPackage ../tools/security/gopass/hibp.nix { };
-
-  git-credential-gopass = callPackage ../tools/security/gopass/git-credential.nix { };
-
-  gopass-summon-provider = callPackage ../tools/security/gopass/summon.nix { };
-
   kerf = kerf_1; # kerf2 is WIP
   kerf_1 = callPackage ../development/interpreters/kerf {
     stdenv = clangStdenv;
@@ -5005,10 +4997,11 @@ with pkgs;
     mlton20180207Binary
     mlton20180207
     mlton20210117
+    mlton20241230
     mltonHEAD
     ;
 
-  mlton = mlton20210117;
+  mlton = mlton20241230;
 
   mono = mono6;
 
@@ -7295,8 +7288,6 @@ with pkgs;
       hunspell.withDicts
       (_: dicts);
 
-  hydra = callPackage ../by-name/hy/hydra/package.nix { nix = nixVersions.nix_2_32; };
-
   icu-versions = callPackages ../development/libraries/icu { };
   inherit (icu-versions)
     icu60

pkgs/top-level/ocaml-packages.nix

@@ -647,6 +647,12 @@ let
 
         fpath = callPackage ../development/ocaml-modules/fpath { };
 
+        frama-c = callPackage ../development/ocaml-modules/frama-c {
+          framac = pkgs.framac.override { ocamlPackages = self; };
+        };
+
+        frama-c-lannotate = callPackage ../development/ocaml-modules/frama-c-lannotate { };
+
         frei0r = callPackage ../development/ocaml-modules/frei0r {
           inherit (pkgs) frei0r;
         };

pkgs/top-level/python-packages.nix

@@ -11596,6 +11596,8 @@ self: super: with self; {
 
   ots-python = callPackage ../development/python-modules/ots-python { };
 
+  otxv2 = callPackage ../development/python-modules/otxv2 { };
+
   ourgroceries = callPackage ../development/python-modules/ourgroceries { };
 
   outcome = callPackage ../development/python-modules/outcome { };
@@ -13832,7 +13834,7 @@ self: super: with self; {
 
   pyment = callPackage ../development/python-modules/pyment { };
 
-  pymeshlab = toPythonModule (pkgs.libsForQt5.callPackage ../applications/graphics/pymeshlab { });
+  pymeshlab = callPackage ../development/python-modules/pymeshlab { };
 
   pymeta3 = callPackage ../development/python-modules/pymeta3 { };
 
@@ -20065,6 +20067,8 @@ self: super: with self; {
 
   urlpy = callPackage ../development/python-modules/urlpy { };
 
+  urlscan-python = callPackage ../development/python-modules/urlscan-python { };
+
   urwid = callPackage ../development/python-modules/urwid { };
 
   urwid-readline = callPackage ../development/python-modules/urwid-readline { };