Merge master into staging-next

nixos/doc/manual/release-notes/rl-2511.section.md

@@ -125,6 +125,9 @@
 - `amdgpu` kernel driver overdrive mode can now be enabled by setting [hardware.amdgpu.overdrive.enable](#opt-hardware.amdgpu.overdrive.enable) and customized through [hardware.amdgpu.overdrive.ppfeaturemask](#opt-hardware.amdgpu.overdrive.ppfeaturemask).
   This allows for fine-grained control over the GPU's performance and maybe required by overclocking softwares like Corectrl and Lact. These new options replace old options such as {option}`programs.corectrl.gpuOverclock.enable` and {option}`programs.tuxclocker.enableAMD`.
 
+- `services.varnish.http_address` has been superseeded by `services.varnish.listen` which is now
+  structured config for all of varnish's `-a` variations.
+
 - [](#opt-services.gnome.gnome-keyring.enable) does not ship with an SSH agent anymore, as this is now handled by the `gcr_4` package instead of `gnome-keyring`. A new module has been added to support this, under [](#opt-services.gnome.gcr-ssh-agent.enable) (its default value has been set to [](#opt-services.gnome.gnome-keyring.enable) to ensure a smooth transition). See the [relevant upstream PR](https://gitlab.gnome.org/GNOME/gcr/-/merge_requests/67) for more details.
 
 - The `nettools` package (ifconfig, arp, mii-tool, netstat, route) is not installed by default anymore. The suite is unmaintained and users should migrate to `iproute2` and `ethtool` instead.

nixos/modules/services/mail/spamassassin.nix

@@ -121,6 +121,7 @@ in
 
     users.users.spamd = {
       description = "Spam Assassin Daemon";
+      home = "/var/lib/spamassassin";
       uid = config.ids.uids.spamd;
       group = "spamd";
     };

nixos/modules/services/web-servers/varnish/default.nix

@@ -6,6 +6,16 @@
 }:
 
 let
+  inherit (lib)
+    types
+    mkOption
+    hasPrefix
+    concatMapStringsSep
+    optionalString
+    concatMap
+    ;
+  inherit (builtins) isNull;
+
   cfg = config.services.varnish;
 
   # Varnish has very strong opinions and very complicated code around handling
@@ -26,6 +36,91 @@ let
     else
       "/var/run/varnishd";
 
+  # from --help:
+  #   -a [<name>=]address[:port][,proto] # HTTP listen address and port
+  #      [,user=<u>][,group=<g>]   # Can be specified multiple times.
+  #      [,mode=<m>]               #   default: ":80,HTTP"
+  #                                # Proto can be "PROXY" or "HTTP" (default)
+  #                                # user, group and mode set permissions for
+  #                                #   a Unix domain socket.
+  commandLineAddresses =
+    (concatMapStringsSep " " (
+      a:
+      "-a "
+      + optionalString (!isNull a.name) "${a.name}="
+      + a.address
+      + optionalString (!isNull a.port) ":${toString a.port}"
+      + optionalString (!isNull a.proto) ",${a.proto}"
+      + optionalString (!isNull a.user) ",user=${a.user}"
+      + optionalString (!isNull a.group) ",group=${a.group}"
+      + optionalString (!isNull a.mode) ",mode=${a.mode}"
+    ) cfg.listen)
+    + lib.optionalString (!isNull cfg.http_address) " -a ${cfg.http_address}";
+  addressSubmodule = types.submodule {
+    options = {
+      name = mkOption {
+        description = "Name is referenced in logs. If name is not specified, 'a0', 'a1', etc. is used.";
+        default = null;
+        type = with types; nullOr str;
+      };
+      address = mkOption {
+        description = ''
+          If given an IP address, it can be a host name ("localhost"), an IPv4 dotted-quad
+          ("127.0.0.1") or an IPv6  address enclosed in square brackets ("[::1]").
+
+          (VCL4.1 and higher) If given an absolute Path ("/path/to/listen.sock") or "@"
+          followed by the name of an abstract socket ("@myvarnishd") accept connections
+          on a Unix domain socket.
+
+          The user, group and mode sub-arguments may be used to specify the permissions
+          of the socket file. These sub-arguments do not apply to  abstract sockets.
+        '';
+        type = types.str;
+      };
+      port = mkOption {
+        description = "The port to use for IP sockets. If port is not specified, port 80 (http) is used.";
+        default = null;
+        type = with types; nullOr int;
+      };
+      proto = mkOption {
+        description = "PROTO can be 'HTTP' (the default) or 'PROXY'.  Both version 1 and 2 of the proxy protocol can be used.";
+        type = types.enum [
+          "HTTP"
+          "PROXY"
+        ];
+        default = "HTTP";
+      };
+      user = mkOption {
+        description = "User name who owns the socket file.";
+        default = null;
+        type = with lib.types; nullOr str;
+      };
+      group = mkOption {
+        description = "Group name who owns the socket file.";
+        default = null;
+        type = with lib.types; nullOr str;
+      };
+      mode = mkOption {
+        description = "Permission of the socket file (3-digit octal value).";
+        default = null;
+        type = with types; nullOr str;
+      };
+    };
+  };
+  checkedAddressModule = types.addCheck addressSubmodule (
+    m:
+    (
+      if ((hasPrefix "@" m.address) || (hasPrefix "/" m.address)) then
+        # this is a unix socket
+        (m.port != null)
+      else
+      # this is not a path-based unix socket
+      if !(hasPrefix "/" m.address) && (m.group != null) || (m.user != null) || (m.mode != null) then
+        false
+      else
+        true
+    )
+  );
   commandLine =
     "-f ${pkgs.writeText "default.vcl" cfg.config}"
     +
@@ -54,13 +149,23 @@ in
       package = lib.mkPackageOption pkgs "varnish" { };
 
       http_address = lib.mkOption {
-        type = lib.types.str;
-        default = "*:6081";
+        type = with lib.types; nullOr str;
+        default = null;
         description = ''
           HTTP listen address and port.
         '';
       };
 
+      listen = lib.mkOption {
+        description = "Accept for client requests on the specified listen addresses.";
+        type = lib.types.listOf checkedAddressModule;
+        defaultText = lib.literalExpression ''[ { address="*"; port=6081; } ]'';
+        default = lib.optional (isNull cfg.http_address) {
+          address = "*";
+          port = 6081;
+        };
+      };
+
       config = lib.mkOption {
         type = lib.types.lines;
         description = ''
@@ -97,7 +202,7 @@ in
       serviceConfig = {
         Type = "simple";
         PermissionsStartOnly = true;
-        ExecStart = "${cfg.package}/sbin/varnishd -a ${cfg.http_address} -n ${stateDir} -F ${cfg.extraCommandLine} ${commandLine}";
+        ExecStart = "${cfg.package}/sbin/varnishd ${commandLineAddresses} -n ${stateDir} -F ${cfg.extraCommandLine} ${commandLine}";
         Restart = "always";
         RestartSec = "5s";
         User = "varnish";
@@ -118,6 +223,21 @@ in
       '')
     ];
 
+    assertions = concatMap (m: [
+      {
+        assertion = (hasPrefix "/" m.address) || (hasPrefix "@" m.address) -> m.port == null;
+        message = "Listen ports must not be specified with UNIX sockets: ${builtins.toJSON m}";
+      }
+      {
+        assertion = !(hasPrefix "/" m.address) -> m.user == null && m.group == null && m.mode == null;
+        message = "Abstract UNIX sockets or IP sockets can not be used with user, group, and mode settings: ${builtins.toJSON m}";
+      }
+    ]) cfg.listen;
+
+    warnings =
+      lib.optional (!isNull cfg.http_address)
+        "The option `services.varnish.http_address` is deprecated. Use `services.varnish.listen` instead.";
+
     users.users.varnish = {
       group = "varnish";
       uid = config.ids.uids.varnish;

nixos/modules/system/boot/loader/limine/limine-install.py

@@ -274,7 +274,7 @@ def install_bootloader() -> None:
     profiles = [('system', get_gens())]
 
     for profile in get_profiles():
-        profiles += (profile, get_gens(profile))
+        profiles += [(profile, get_gens(profile))]
 
     timeout = config('timeout')
     editor_enabled = 'yes' if config('enableEditor') else 'no'

nixos/tests/varnish.nix

@@ -10,7 +10,12 @@ in
 
   nodes = {
     varnish =
-      { config, pkgs, ... }:
+      {
+        config,
+        pkgs,
+        lib,
+        ...
+      }:
       {
         services.nix-serve = {
           enable = true;
@@ -19,9 +24,29 @@ in
         services.varnish = {
           inherit package;
           enable = true;
-          http_address = "0.0.0.0:80";
+          http_address = "0.0.0.0:81";
+          listen = [
+            {
+              address = "0.0.0.0";
+              port = 80;
+              proto = "HTTP";
+            }
+            {
+              name = "proxyport";
+              address = "0.0.0.0";
+              port = 8080;
+              proto = "PROXY";
+            }
+            { address = "@asdf"; }
+            {
+              address = "/run/varnishd/client.http.sock";
+              user = "varnish";
+              group = "varnish";
+              mode = "660";
+            }
+          ];
           config = ''
-            vcl 4.0;
+            vcl 4.1;
 
             backend nix-serve {
               .host = "127.0.0.1";
@@ -32,6 +57,26 @@ in
 
         networking.firewall.allowedTCPPorts = [ 80 ];
         system.extraDependencies = [ testPath ];
+
+        assertions =
+          map
+            (
+              pattern:
+              let
+                cmdline = config.systemd.services.varnish.serviceConfig.ExecStart;
+              in
+              {
+                assertion = lib.hasInfix pattern cmdline;
+                message = "Address argument `${pattern}` missing in commandline `${cmdline}`.";
+              }
+            )
+            [
+              " -a 0.0.0.0:80,HTTP "
+              " -a proxyport=0.0.0.0:8080,PROXY "
+              " -a @asdf,HTTP "
+              " -a /run/varnishd/client.http.sock,HTTP,user=varnish,group=varnish,mode=660 "
+              " -a 0.0.0.0:81 "
+            ];
       };
 
     client =
@@ -48,6 +93,7 @@ in
     start_all()
     varnish.wait_for_open_port(80)
 
+
     client.wait_until_succeeds("curl -f http://varnish/nix-cache-info");
 
     client.wait_until_succeeds("nix-store -r ${testPath}")

pkgs/applications/editors/vscode/extensions/tboby.cwtools-vscode/default.nix

@@ -6,8 +6,8 @@ vscode-utils.buildVscodeMarketplaceExtension {
   mktplcRef = {
     name = "cwtools-vscode";
     publisher = "tboby";
-    version = "0.10.25";
-    hash = "sha256-TcnS4Cwn+V9hwScpLgUK5u8Jfm89EBv+koUOi1bB0DM=";
+    version = "0.10.26";
+    hash = "sha256-1ZfmcF87LyRxCbQvVX21m1yFu+7QeDCofKXEHj5W8DA=";
   };
   meta = {
     description = "Paradox Language Features for Visual Studio Code";

pkgs/by-name/aq/aquamarine/package.nix

@@ -23,13 +23,13 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "aquamarine";
-  version = "0.8.0";
+  version = "0.9.1";
 
   src = fetchFromGitHub {
     owner = "hyprwm";
     repo = "aquamarine";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-ybpV2+yNExdHnMhhhmtxqgBCgI+nRr8gi/D+VVb9lQY=";
+    hash = "sha256-1bxH4zW/mnEh7ySsByZBRpANUG/Ym8kgorawYI70z7A=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/bo/bootc/package.nix

@@ -13,16 +13,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "bootc";
-  version = "1.1.2";
+  version = "1.4.0";
   useFetchCargoVendor = true;
-  cargoHash = "sha256-/Sb2XtVguj5zpj/OTl90xFHFSaBeLgb8xIlNm4UrnRI=";
+  cargoHash = "sha256-7Fn68bcm8ZyR5eALCMIdcXcZ595EnWFHKdnqI5vMso4=";
   doInstallCheck = true;
 
   src = fetchFromGitHub {
-    owner = "containers";
+    owner = "bootc-dev";
     repo = "bootc";
     rev = "v${version}";
-    hash = "sha256-p1+j62MllmPcvWnijieSZmlgwYy76X17fv12Haetz78=";
+    hash = "sha256-FuU3rQtKpK+ScQ10GivisSJseY2GOFJ/y2HRKIiU0G8=";
   };
 
   nativeBuildInputs = [ pkg-config ];
@@ -35,13 +35,26 @@ rustPlatform.buildRustPackage rec {
     ostree-full
   ];
 
+  checkFlags = [
+    # These all require a writable /var/tmp
+    "--skip=test_cli_fns"
+    "--skip=test_diff"
+    "--skip=test_tar_export_reproducible"
+    "--skip=test_tar_export_structure"
+    "--skip=test_tar_import_empty"
+    "--skip=test_tar_import_export"
+    "--skip=test_tar_import_signed"
+    "--skip=test_tar_write"
+    "--skip=test_tar_write_tar_layer"
+  ];
+
   nativeInstallCheckInputs = [
     versionCheckHook
   ];
 
   meta = {
     description = "Boot and upgrade via container images";
-    homepage = "https://containers.github.io/bootc";
+    homepage = "https://bootc-dev.github.io/bootc";
     license = lib.licenses.mit;
     mainProgram = "bootc";
     maintainers = with lib.maintainers; [ thesola10 ];

pkgs/by-name/ca/candy-icons/package.nix

@@ -8,13 +8,13 @@
 
 stdenvNoCC.mkDerivation {
   pname = "candy-icons";
-  version = "0-unstable-2025-06-23";
+  version = "0-unstable-2025-07-10";
 
   src = fetchFromGitHub {
     owner = "EliverLara";
     repo = "candy-icons";
-    rev = "29976b2036490599753766f869f83e9346d8cf8e";
-    hash = "sha256-UxuW9cRGmKS2t8ik2tMAQHU0Xj+W5WhWuBxnLkkPnoE=";
+    rev = "475c5b27d34e6bde3ed11e985a727bd7ec9f155a";
+    hash = "sha256-XU10gw0WYWnzyzbzJlg2oNCksLY/Tt1CJGo0Nu4FLnM=";
   };
 
   nativeBuildInputs = [ gtk3 ];

pkgs/by-name/da/databricks-cli/package.nix

@@ -10,13 +10,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "databricks-cli";
-  version = "0.258.0";
+  version = "0.259.0";
 
   src = fetchFromGitHub {
     owner = "databricks";
     repo = "cli";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-8JVU0tn0KINBdEE0nS2VQ8v9TUn9h2euPGZELSCbcLA=";
+    hash = "sha256-UzfLtGwiyEnHRn54qAwcqMXag8k8GjpB5BGMYh/93O8=";
   };
 
   # Otherwise these tests fail asserting that the version is 0.0.0-dev

pkgs/by-name/dv/dvdauthor/gettext-0.25.patch

@@ -0,0 +1,14 @@
+diff --git a/configure.ac b/configure.ac
+index f4b270f..17e102f 100644
+--- a/configure.ac
++++ b/configure.ac
+@@ -1,5 +1,9 @@
+ AC_INIT(DVDAuthor,0.7.2,dvdauthor-users@lists.sourceforge.net)
+ 
++AC_CONFIG_MACRO_DIRS([m4])
++AM_GNU_GETTEXT_VERSION([0.25])
++AM_GNU_GETTEXT([external])
++
+ AC_CONFIG_HEADERS(src/config.h)
+ AC_CONFIG_AUX_DIR(autotools)
+ 

pkgs/by-name/dv/dvdauthor/package.nix

@@ -40,6 +40,7 @@ stdenv.mkDerivation rec {
       url = "https://github.com/ldo/dvdauthor/commit/45705ece5ec5d7d6b9ab3e7a68194796a398e855.patch?full_index=1";
       hash = "sha256-tykCr2Axc1qhUvjlGyXQ6X+HwzuFTm5Va2gjGlOlSH0=";
     })
+    ./gettext-0.25.patch
   ];
 
   buildInputs = [

pkgs/by-name/en/ente-web/package.nix

@@ -12,7 +12,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "ente-web";
-  version = "1.1.53";
+  version = "1.1.57";
 
   src = fetchFromGitHub {
     owner = "ente-io";
@@ -20,13 +20,13 @@ stdenv.mkDerivation (finalAttrs: {
     sparseCheckout = [ "web" ];
     tag = "photos-v${finalAttrs.version}";
     fetchSubmodules = true;
-    hash = "sha256-LYFkqB44pS7WLa4HEnYrnRanh04P82ydsqiZYHNAshc=";
+    hash = "sha256-SCkxGm/w0kES7wDuLBsUTgwrFYNLvLD51NyioAVTLrg=";
   };
   sourceRoot = "${finalAttrs.src.name}/web";
 
   offlineCache = fetchYarnDeps {
     yarnLock = "${finalAttrs.src}/web/yarn.lock";
-    hash = "sha256-8uqKlqBnYTft3P7r1rQaEqn7ixj55yWnSLKTNi/0MZA=";
+    hash = "sha256-FnLMXOpIVNOhaM7VjNEDlwpew9T/5Ch5eFed9tLpDsI=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/fl/flutter_rust_bridge_codegen/package.nix

@@ -7,18 +7,18 @@
 }:
 rustPlatform.buildRustPackage rec {
   pname = "flutter_rust_bridge_codegen";
-  version = "2.11.0";
+  version = "2.11.1";
 
   src = fetchFromGitHub {
     owner = "fzyzcjy";
     repo = "flutter_rust_bridge";
     rev = "v${version}";
-    hash = "sha256-vtdIbrVm9r8PiTYvhz4Ikj4e22jxqgEraH+YHlRS4O4=";
+    hash = "sha256-Us+LwT6tjBcTl2xclVsiLauSlIO8w+PiokpiDB+h1fI=";
     fetchSubmodules = true;
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-TwnibHjMDZ3aj1EDNHd/AO7nNtSnY335P3vU4iyp4SY=";
+  cargoHash = "sha256-pxEwcLiRB95UBfXb+JgS8duEXiZUApH/C8Exus5TkfU=";
   cargoBuildFlags = "--package flutter_rust_bridge_codegen";
   cargoTestFlags = "--package flutter_rust_bridge_codegen";
 

pkgs/by-name/fr/freetds/gettext-0.25.patch

@@ -0,0 +1,13 @@
+diff --git i/configure.ac w/configure.ac
+index bb07bba1..c4e15d53 100644
+--- i/configure.ac
++++ w/configure.ac
+@@ -20,6 +20,8 @@ AM_INIT_AUTOMAKE([dist-bzip2 parallel-tests subdir-objects foreign])
+ m4_ifdef([AM_SILENT_RULES], [AM_SILENT_RULES(yes)])
+ AC_CONFIG_HEADERS(include/config.h)
+ AC_CONFIG_MACRO_DIR([m4])
++AM_GNU_GETTEXT_VERSION([0.25])
++AM_GNU_GETTEXT([external])
+ 
+ dnl configuration directory will be /usr/local/etc
+ AC_PREFIX_DEFAULT(/usr/local)

pkgs/by-name/fr/freetds/package.nix

@@ -22,6 +22,10 @@ stdenv.mkDerivation rec {
     hash = "sha256-XLZsRqYKg7iihV5GYUi2+ieWLH/R3LP25dCrF+xf9t0=";
   };
 
+  patches = [
+    ./gettext-0.25.patch
+  ];
+
   buildInputs = [
     openssl
   ] ++ lib.optional odbcSupport unixODBC;

pkgs/by-name/g-/g-ls/package.nix

@@ -8,16 +8,16 @@
 
 buildGoModule rec {
   pname = "g-ls";
-  version = "0.30.0";
+  version = "0.31.0";
 
   src = fetchFromGitHub {
     owner = "Equationzhao";
     repo = "g";
     tag = "v${version}";
-    hash = "sha256-OaYWorybwUxG452b0vEKwryxmRaNTQ5xDWe9GmEWuGE=";
+    hash = "sha256-cHB9oW4vF00hvhZ7KNY5TUjIjLjEoiJb/psMSq+kSHU=";
   };
 
-  vendorHash = "sha256-E/4iB1apLCOEtijCZymObz0Zjlf0+dQC37ALSbl1tr0=";
+  vendorHash = "sha256-5ksa0AJ7JbQPzBypDDMUvnXtIeXNEm9zKL5JetHWnrs=";
 
   subPackages = [ "." ];
 

pkgs/by-name/gi/gitea-actions-runner/package.nix

@@ -1,42 +1,42 @@
 {
   lib,
   fetchFromGitea,
-  buildGo123Module,
+  buildGoModule,
   testers,
   gitea-actions-runner,
 }:
 
-buildGo123Module rec {
+buildGoModule (finalAttrs: {
   pname = "gitea-actions-runner";
-  version = "0.2.11";
+  version = "0.2.12";
 
   src = fetchFromGitea {
     domain = "gitea.com";
     owner = "gitea";
     repo = "act_runner";
-    rev = "v${version}";
-    hash = "sha256-PmDa8XIe1uZ4SSrs9zh5HBmFaOuj+uuLm7jJ4O5V1dI=";
+    rev = "v${finalAttrs.version}";
+    hash = "sha256-z/wEs110Y2IZ2Jm6bayxlD2sjyl2V/v+gP6l9pwGi5o=";
   };
 
-  vendorHash = "sha256-lYJFySGqkhT89vHDp1FcTiiC7DG4ziQ1DaBHLh/kXQc=";
+  vendorHash = "sha256-HuiL6OLShSeGtHb4dOeOFOpOgl55s3x18uYgM4X8G7M=";
 
   ldflags = [
     "-s"
     "-w"
-    "-X gitea.com/gitea/act_runner/internal/pkg/ver.version=v${version}"
+    "-X gitea.com/gitea/act_runner/internal/pkg/ver.version=v${finalAttrs.version}"
   ];
 
   passthru.tests.version = testers.testVersion {
     package = gitea-actions-runner;
-    version = "v${version}";
+    version = "v${finalAttrs.version}";
   };
 
   meta = {
     mainProgram = "act_runner";
     maintainers = with lib.maintainers; [ techknowlogick ];
     license = lib.licenses.mit;
-    changelog = "https://gitea.com/gitea/act_runner/releases/tag/v${version}";
+    changelog = "https://gitea.com/gitea/act_runner/releases/tag/v${finalAttrs.version}";
     homepage = "https://gitea.com/gitea/act_runner";
     description = "Runner for Gitea based on act";
   };
-}
+})

pkgs/by-name/ho/holo-daemon/package.nix

@@ -11,18 +11,18 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "holo-daemon";
-  version = "0.7.0";
+  version = "0.8.0";
 
   src = fetchFromGitHub {
     owner = "holo-routing";
     repo = "holo";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-wASY+binAflxaXjKdSfUXS8jgdEHjdIF3AOzjN/a1Fo=";
+    hash = "sha256-8cScq/6e9u3rDilnjT6mAbEudXybNj3YUicYiEgoCyE=";
   };
 
   passthru.updateScript = nix-update-script { };
 
-  cargoHash = "sha256-5X6a86V3Y9+KK0kGbS/ovelqXyLv15gQRFI7GhiYBjY=";
+  cargoHash = "sha256-YZ2c6W6CCqgyN+6i7Vh5fWLKw8L4pUqvq/tDO/Q/kf0=";
 
   # Use rust nightly features
   RUSTC_BOOTSTRAP = 1;
@@ -36,19 +36,6 @@ rustPlatform.buildRustPackage (finalAttrs: {
     pcre2
   ];
 
-  # Might not be needed if latest nightly compiler version is used
-  preConfigure = ''
-    # Find all lib.rs and main.rs files and add required unstable features
-    # Add the feature flag at the top of the file if not present`
-    find . -name "lib.rs" -o -name "main.rs" | while read -r file; do
-      for feature in extract_if let_chains hash_extract_if; do
-        if ! grep -q "feature.*$feature" "$file"; then
-          sed -i "1i #![feature($feature)]" "$file"
-        fi
-      done
-    done
-  '';
-
   meta = {
     description = "`holo` daemon that provides the routing protocols, tools and policies";
     homepage = "https://github.com/holo-routing/holo";

pkgs/by-name/hy/hyperswarm/package.nix

@@ -7,13 +7,13 @@
 
 buildNpmPackage (finalAttrs: {
   pname = "hyperswarm";
-  version = "4.11.7";
+  version = "4.12.1";
 
   src = fetchFromGitHub {
     owner = "holepunchto";
     repo = "hyperswarm";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-Z/FNBDJbiyR5AY40RDtiuQmjNUZ+BSGv8aewBnhSNZw=";
+    hash = "sha256-BQ1/kNJAFoxPJ2I3dyV7EHafKfbbDqCQw039VT4YLT8=";
   };
 
   npmDepsHash = "sha256-4ysUYFIFlzr57J7MdZit1yX3Dgpb2eY0rdYnwyppwK0=";

pkgs/by-name/hy/hyprpanel/package.nix

@@ -37,7 +37,7 @@
 }:
 ags.bundle {
   pname = "hyprpanel";
-  version = "0-unstable-2025-07-03";
+  version = "0-unstable-2025-07-12";
 
   __structuredAttrs = true;
   strictDeps = true;
@@ -45,8 +45,8 @@ ags.bundle {
   src = fetchFromGitHub {
     owner = "Jas-SinghFSU";
     repo = "HyprPanel";
-    rev = "343c9857bd7f1d302d591e8d5f3f9952dc84775b";
-    hash = "sha256-MGJmxnjlERXJLDywrSHYSgpt7fhh3/HOHQboRrxDW64=";
+    rev = "59b57fca0634c98f23227ea948f87df7814e72f6";
+    hash = "sha256-cl1NEWTUsNxBmLjyvz+GDP4Hy7riaOszSGpfplHA7Y4=";
   };
 
   # keep in sync with https://github.com/Jas-SinghFSU/HyprPanel/blob/master/flake.nix#L42

pkgs/by-name/li/limine/package.nix

@@ -42,14 +42,14 @@ in
 # as bootloader for various platforms and corresponding binary and helper files.
 stdenv.mkDerivation (finalAttrs: {
   pname = "limine";
-  version = "9.4.0";
+  version = "9.5.0";
 
   # We don't use the Git source but the release tarball, as the source has a
   # `./bootstrap` script performing network access to download resources.
   # Packaging that in Nix is very cumbersome.
   src = fetchurl {
     url = "https://github.com/limine-bootloader/limine/releases/download/v${finalAttrs.version}/limine-${finalAttrs.version}.tar.gz";
-    hash = "sha256-ddQB0wKMhKSnPrJflgsDfyWCzOiFehf/2CijPiVk65U=";
+    hash = "sha256-SWJ5e6/q92UyC0ea8yJAYcFNr5LreJ2qFY7hcunovEM=";
   };
 
   enableParallelBuilding = true;

pkgs/by-name/mi/mise/package.nix

@@ -21,17 +21,17 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "mise";
-  version = "2025.7.0";
+  version = "2025.7.4";
 
   src = fetchFromGitHub {
     owner = "jdx";
     repo = "mise";
     rev = "v${version}";
-    hash = "sha256-PIUw84xwR9m06fPkO7MYf95Q21YvYnBMi+MY+OOz+2k=";
+    hash = "sha256-l1Bce0CFhR5cyBnlNGy4KM8aqVntGkzRsi+Qh6KODQk=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-5876Lc4rRNwTH8u5bMyV52Eps9QOcBHhE3v+33hzeBA=";
+  cargoHash = "sha256-ujZ6iPwsIlAFCfkZbGLqgLjvJMZE+ehKRw10NnwS7jE=";
 
   nativeBuildInputs = [
     installShellFiles

pkgs/by-name/mp/mpdris2/fix-gettext-0.25.patch

@@ -0,0 +1,14 @@
+diff --git i/configure.ac w/configure.ac
+index dcc3c3d..888dc12 100644
+--- i/configure.ac
++++ w/configure.ac
+@@ -4,6 +4,9 @@ AC_INIT([mpDris2],
+ 	[mpdris2],
+ 	[https://github.com/eonpatapon/mpDris2])
+ AC_CONFIG_AUX_DIR([build-aux])
++AC_CONFIG_MACRO_DIRS([m4])
++AM_GNU_GETTEXT_VERSION([0.21])
++AM_GNU_GETTEXT([external])
+ AM_INIT_AUTOMAKE([1.11 tar-ustar foreign])
+ 
+ m4_ifdef([AM_SILENT_RULES],[AM_SILENT_RULES([yes])])

pkgs/by-name/mp/mpdris2/package.nix

@@ -2,6 +2,7 @@
   lib,
   autoreconfHook,
   fetchFromGitHub,
+  gettext,
   glib,
   gobject-introspection,
   intltool,
@@ -28,6 +29,7 @@ python3.pkgs.buildPythonApplication rec {
 
   nativeBuildInputs = [
     autoreconfHook
+    gettext
     gobject-introspection
     intltool
     wrapGAppsHook3
@@ -45,6 +47,8 @@ python3.pkgs.buildPythonApplication rec {
     pygobject3
   ];
 
+  patches = [ ./fix-gettext-0.25.patch ];
+
   meta = with lib; {
     description = "MPRIS 2 support for mpd";
     homepage = "https://github.com/eonpatapon/mpDris2/";

pkgs/by-name/mu/museum/package.nix

@@ -9,14 +9,14 @@
 
 buildGoModule rec {
   pname = "museum";
-  version = "1.1.53";
+  version = "1.1.57";
 
   src = fetchFromGitHub {
     owner = "ente-io";
     repo = "ente";
     sparseCheckout = [ "server" ];
     rev = "photos-v${version}";
-    hash = "sha256-lgxgtxRV4jRnOwlgX1jY6CrgVF0pSvoW5fVEU3L0jMY=";
+    hash = "sha256-801wTTxruhZc18+TAPSYrBRtCPNZXwSKs2Hkvc/6BjM=";
   };
 
   vendorHash = "sha256-px4pMqeH73Fe06va4+n6hklIUDMbPmAQNKKRIhwv6ec=";

pkgs/by-name/sc/scooter/package.nix

@@ -18,6 +18,12 @@ rustPlatform.buildRustPackage rec {
   useFetchCargoVendor = true;
   cargoHash = "sha256-kPweKXAitvODNoKTr2iB+qM9qMWGoKEQCxpkgrpnewY=";
 
+  # Ensure that only the `scooter` package is built (excluding `xtask`)
+  cargoBuildFlags = [
+    "--package"
+    "scooter"
+  ];
+
   # Many tests require filesystem writes which fail in Nix sandbox
   doCheck = false;
 

pkgs/by-name/so/solaar/package.nix

@@ -95,6 +95,7 @@ python3Packages.buildPythonApplication rec {
     '';
     homepage = "https://pwr-solaar.github.io/Solaar/";
     license = licenses.gpl2Only;
+    mainProgram = "solaar";
     maintainers = with maintainers; [
       spinus
       ysndr

pkgs/by-name/st/stevenblack-blocklist/package.nix

@@ -6,13 +6,13 @@
 }:
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "stevenblack-blocklist";
-  version = "3.15.51";
+  version = "3.15.55";
 
   src = fetchFromGitHub {
     owner = "StevenBlack";
     repo = "hosts";
     tag = finalAttrs.version;
-    hash = "sha256-NISp1TNEgoLn2sBglpoKfg/aiiLynNOrOWqTppkbDs0=";
+    hash = "sha256-eDKP15xvd/SHZd4i2EorRZkS7ih5d8YNvCJQsRQeMYs=";
   };
 
   outputs = [

pkgs/by-name/tr/trealla/package.nix

@@ -23,13 +23,13 @@ assert lib.elem lineEditingLibrary [
 ];
 stdenv.mkDerivation (finalAttrs: {
   pname = "trealla";
-  version = "2.77.23";
+  version = "2.78.0";
 
   src = fetchFromGitHub {
     owner = "trealla-prolog";
     repo = "trealla";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-PkQ9fBkkhGBlkbII/C+E5g4AQR6xckrRkAgKBwVhNuk=";
+    hash = "sha256-CJ1/Qbt6osuJZNuKiEaGEsDztVo8hTNOv6XvUQyWbFU=";
   };
 
   postPatch = ''

pkgs/by-name/va/vacuum-go/package.nix

@@ -7,17 +7,17 @@
 
 buildGoModule (finalAttrs: {
   pname = "vacuum-go";
-  version = "0.17.1";
+  version = "0.17.5";
 
   src = fetchFromGitHub {
     owner = "daveshanley";
     repo = "vacuum";
     # using refs/tags because simple version gives: 'the given path has multiple possibilities' error
     tag = "v${finalAttrs.version}";
-    hash = "sha256-zWnYBDNsOoyc28JB8/dbommIxKUU2XGOHHYsR2q1hj0=";
+    hash = "sha256-QBbpDV/hlzFgrmCsywH5CC43V2Rt0fwPkf6ZCgjqqUc=";
   };
 
-  vendorHash = "sha256-4cYG8ilWSI+bSoEBpohN6Fr3kmsBUNmbz0iyHmiCDgw=";
+  vendorHash = "sha256-AjmET86E/xu6DTK07kMySWp5Z8W1RE/QPSe2B/IfDl0=";
 
   env.CGO_ENABLED = 0;
   ldflags = [

pkgs/development/compilers/rust/1_88.nix

@@ -7,7 +7,6 @@
 # 2. The LLVM version used for building should match with rust upstream.
 #    Check the version number in the src/llvm-project git submodule in:
 #    https://github.com/rust-lang/rust/blob/<version-tag>/.gitmodules
-# 3. Firefox and Thunderbird should still build on x86_64-linux.
 
 {
   stdenv,

pkgs/development/interpreters/clisp/default.nix

@@ -130,10 +130,16 @@ stdenv.mkDerivation {
 
   doCheck = true;
 
-  postInstall = lib.optionalString (withModules != [ ]) (
-    ''bash ./clisp-link add "$out"/lib/clisp*/base "$(dirname "$out"/lib/clisp*/base)"/full''
-    + lib.concatMapStrings (x: " " + x) withModules
-  );
+  postInstall = lib.optionalString (withModules != [ ]) ''
+    bash ./clisp-link add "$out"/lib/clisp*/base "$(dirname "$out"/lib/clisp*/base)"/full \
+      ${lib.concatMapStrings (x: " " + x) withModules}
+
+    find "$out"/lib/clisp*/full -type l -name "*.o" | while read -r symlink; do
+      if [[ "$(readlink "$symlink")" =~ (.*\/builddir\/)(.*) ]]; then
+        ln -sf "../''${BASH_REMATCH[2]}" "$symlink"
+      fi
+    done
+  '';
 
   env.NIX_CFLAGS_COMPILE = "-O0 -falign-functions=${
     if stdenv.hostPlatform.is64bit then "8" else "4"

pkgs/development/python-modules/ddgs/default.nix

@@ -0,0 +1,45 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  setuptools,
+  click,
+  primp,
+  lxml,
+  versionCheckHook,
+}:
+
+buildPythonPackage rec {
+  pname = "ddgs";
+  version = "9.0.2";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "deedy5";
+    repo = "ddgs";
+    tag = "v${version}";
+    hash = "sha256-c0kTZV+lM1/vkI51TK6klUmnoaAdt8KSEn/rjeqcBa8=";
+  };
+
+  build-system = [ setuptools ];
+
+  dependencies = [
+    click
+    primp
+    lxml
+  ];
+
+  nativeCheckInputs = [ versionCheckHook ];
+  versionCheckProgramArg = "version";
+
+  pythonImportsCheck = [ "ddgs" ];
+
+  meta = {
+    description = "D.D.G.S. | Dux Distributed Global Search. A metasearch library that aggregates results from diverse web search services";
+    mainProgram = "ddgs";
+    homepage = "https://github.com/deedy5/ddgs";
+    changelog = "https://github.com/deedy5/ddgs/releases/tag/${src.tag}";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ drawbu ];
+  };
+}

pkgs/development/python-modules/langchain-aws/default.nix

@@ -24,14 +24,14 @@
 
 buildPythonPackage rec {
   pname = "langchain-aws";
-  version = "0.2.27";
+  version = "0.2.28";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "langchain-ai";
     repo = "langchain-aws";
     tag = "langchain-aws==${version}";
-    hash = "sha256-FHWozXf0zEyKvFODZ+8JHMiwARJETJxmLh3z1HJSNV4=";
+    hash = "sha256-sfdijQxcw0TNK1/IOmHQTHznDIMDTvXqMWBb58cTPlI=";
   };
 
   postPatch = ''

pkgs/development/python-modules/mpi-pytest/default.nix

@@ -11,14 +11,14 @@
 
 buildPythonPackage rec {
   pname = "mpi-pytest";
-  version = "2025.6.0";
+  version = "2025.7";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "firedrakeproject";
     repo = "mpi-pytest";
     tag = "v${version}";
-    hash = "sha256-hZPTVqVaCd75UMoUQTZXrmnFM6cpMp9ejKqct3lN0Bo=";
+    hash = "sha256-TZj1hObMVzYfAUC0UjXMvUThbKCNdiB1FMSA0AHjZ9s=";
   };
 
   build-system = [

pkgs/development/python-modules/optype/default.nix

@@ -12,14 +12,14 @@
 
 buildPythonPackage rec {
   pname = "optype";
-  version = "0.10.0";
+  version = "0.11.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "jorenham";
     repo = "optype";
     tag = "v${version}";
-    hash = "sha256-F6nkbSSmAHIs2I/Yi1+PPtEsSSTnCO8Hsws7JyleJsM=";
+    hash = "sha256-jExwQiEkCLiVFwiFYp2dBvH5PiRlSVG20CneGnht+No=";
   };
 
   disabled = pythonOlder "3.11";

pkgs/development/tools/misc/coreboot-toolchain/default.nix

@@ -15,8 +15,8 @@ let
         flex,
         getopt,
         git,
-        gnat,
-        gcc,
+        gnat14,
+        gcc14,
         lib,
         perl,
         stdenvNoCC,
@@ -50,7 +50,7 @@ let
         buildInputs = [
           flex
           zlib
-          (if withAda then gnat else gcc)
+          (if withAda then gnat14 else gcc14)
         ];
 
         enableParallelBuilding = true;

pkgs/development/web/nodejs/v24.nix

@@ -17,8 +17,8 @@ let
 in
 buildNodejs {
   inherit enableNpm;
-  version = "24.3.0";
-  sha256 = "eb688ef8a63fda9ebc0b5f907609a46e26db6d9aceefc0832009a98371e992ed";
+  version = "24.4.0";
+  sha256 = "42fa8079da25a926013cd89b9d3467d09110e4fbb0c439342ebe4dd6ecc26bbb";
   patches =
     (
       if (stdenv.hostPlatform.emulatorAvailable buildPackages) then
@@ -51,13 +51,6 @@ buildNodejs {
       ./node-npm-build-npm-package-logic.patch
       ./use-correct-env-in-tests.patch
       ./bin-sh-node-run-v22.patch
-
-      # Fix for flaky test
-      # TODO: remove when included in a release
-      (fetchpatch2 {
-        url = "https://github.com/nodejs/node/commit/cd685fe3b6b18d2a1433f2635470513896faebe6.patch?full_index=1";
-        hash = "sha256-KA7WBFnLXCKx+QVDGxFixsbj3Y7uJkAKEUTeLShI1Xo=";
-      })
     ]
     ++ lib.optionals (!stdenv.buildPlatform.isDarwin) [
       # test-icu-env is failing without the reverts

pkgs/os-specific/linux/kernel/zen-kernels.nix

@@ -16,9 +16,9 @@ let
   variants = {
     # ./update-zen.py zen
     zen = {
-      version = "6.15.4"; # zen
-      suffix = "zen2"; # zen
-      sha256 = "0mf83mwpsa2zm1crc3gqbgmsrpsdxi52r1yvrknrcvi003m1y55y"; # zen
+      version = "6.15.6"; # zen
+      suffix = "zen1"; # zen
+      sha256 = "11nfmnyyqph9d0hihss9dg96z7dgiqk3p16c2i2li6q52walbj6g"; # zen
       isLqx = false;
     };
     # ./update-zen.py lqx

pkgs/servers/sql/postgresql/ext/pg_net.nix

@@ -8,21 +8,17 @@
 
 postgresqlBuildExtension (finalAttrs: {
   pname = "pg_net";
-  version = "0.18.0";
+  version = "0.19.1";
 
   src = fetchFromGitHub {
     owner = "supabase";
     repo = "pg_net";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-MXZewz6vb1ZEGMzbk/x0VtBDH2GxnwYWsy3EjJnas2U=";
+    hash = "sha256-Sy2PG1zCB6tNbcMNMWvl/Fe2Zu1stvEIqGrLsRF09GY=";
   };
 
   buildInputs = [ curl ];
 
-  env.NIX_CFLAGS_COMPILE = toString (
-    lib.optional (lib.versionAtLeast postgresql.version "18") "-Wno-error=missing-variable-declarations"
-  );
-
   meta = {
     description = "Async networking for Postgres";
     homepage = "https://github.com/supabase/pg_net";

pkgs/tools/security/firefox_decrypt/default.nix

@@ -18,8 +18,8 @@ buildPythonApplication rec {
   src = fetchFromGitHub {
     owner = "unode";
     repo = pname;
-    rev = "0931c0484d7429f7d4de3a2f5b62b01b7924b49f";
-    hash = "sha256-9HbH8DvHzmlem0XnDbcrIsMQRBuf82cHObqpLzQxNZM=";
+    tag = "${version}";
+    hash = "sha256-HPjOUWusPXoSwwDvW32Uad4gFERvn79ee/WxeX6h3jY=";
   };
 
   nativeBuildInputs = [
@@ -42,6 +42,9 @@ buildPythonApplication rec {
     description = "Tool to extract passwords from profiles of Mozilla Firefox and derivates";
     mainProgram = "firefox_decrypt";
     license = licenses.gpl3Plus;
-    maintainers = with maintainers; [ schnusch ];
+    maintainers = with maintainers; [
+      schnusch
+      unode
+    ];
   };
 }

pkgs/top-level/python-packages.nix

@@ -3409,6 +3409,8 @@ self: super: with self; {
 
   dctorch = callPackage ../development/python-modules/dctorch { };
 
+  ddgs = callPackage ../development/python-modules/ddgs { };
+
   ddt = callPackage ../development/python-modules/ddt { };
 
   deal = callPackage ../development/python-modules/deal { };