Merge master into staging-next

.github/workflows/backport.yml

@@ -40,7 +40,7 @@ jobs:
         with:
           ref: ${{ github.event.pull_request.head.sha }}
           token: ${{ steps.app-token.outputs.token }}
-          persist-credentials: false
+          persist-credentials: true
 
       - name: Log current API rate limits
         env:

maintainers/maintainer-list.nix

@@ -1106,6 +1106,12 @@
     githubId = 83360;
     name = "Aleksey Sidorov";
   };
+  alemonmk = {
+    email = "almk@rmntn.net";
+    github = "alemonmk";
+    githubId = 3955369;
+    name = "Lemon Lam";
+  };
   alerque = {
     email = "caleb@alerque.com";
     github = "alerque";

maintainers/scripts/remove-old-aliases.py

@@ -1,7 +1,7 @@
 #!/usr/bin/env nix-shell
 #!nix-shell -i python3 -p "python3.withPackages(ps: with ps; [ ])" nix
 """
-A program to remove old aliases or convert old aliases to throws
+Converts old aliases to warnings, converts old warnings to throws, and removes old throws.
 Example usage:
 ./maintainers/scripts/remove-old-aliases.py --year 2018 --file ./pkgs/top-level/aliases.nix
 
@@ -31,22 +31,42 @@ def process_args() -> argparse.Namespace:
     arg_parser.add_argument(
         "--only-throws",
         action="store_true",
-        help="only operate on throws. e.g remove throws older than $date",
+        help="Deprecated, use --only throws instead",
+    )
+    arg_parser.add_argument(
+        "--only",
+        choices=["aliases", "warnings", "throws"],
+        help="Only act on the specified types"
+        "(i.e. only act on entries that are 'normal' aliases, warnings, or throws)."
+        "Can be repeated.",
+        action="append",
+        dest="operate_on",
     )
     arg_parser.add_argument("--file", required=True, type=Path, help="alias file")
     arg_parser.add_argument(
         "--dry-run", action="store_true", help="don't modify files, only print results"
     )
-    return arg_parser.parse_args()
+
+    parsed = arg_parser.parse_args()
+
+    if parsed.only_throws:
+        parsed.operate_on.append("throws")
+
+    if parsed.operate_on is None:
+        parsed.operate_on = ["aliases", "warnings", "throws"]
+
+    return parsed
 
 
 def get_date_lists(
-    txt: list[str], cutoffdate: datetimedate, only_throws: bool
-) -> tuple[list[str], list[str], list[str]]:
+    txt: list[str], cutoffdate: datetimedate
+) -> tuple[list[str], list[str], list[str], list[str], list[str]]:
     """get a list of lines in which the date is older than $cutoffdate"""
     date_older_list: list[str] = []
     date_older_throw_list: list[str] = []
+    date_older_warning_list: list[str] = []
     date_sep_line_list: list[str] = []
+    date_too_complex_list: list[str] = []
 
     for lineno, line in enumerate(txt, start=1):
         line = line.rstrip()
@@ -69,68 +89,104 @@ def get_date_lists(
         ):
             continue
 
-        if "=" not in line:
-            date_sep_line_list.append(f"{lineno} {line}")
+        if line.lstrip().startswith("inherit (") and ";" in line:
+            date_older_list.append(line)
+        elif "=" not in line:
+            date_sep_line_list.append(f"{lineno:>5} {line}")
         # 'if' lines could be complicated
         elif "if " in line and "if =" not in line:
-            print(f"RESOLVE MANUALLY {line}")
-        elif "throw" in line:
+            date_too_complex_list.append(f"{lineno:>5} {line}")
+        elif "= with " in line:
+            date_too_complex_list.append(f"{lineno:>5} {line}")
+        elif "lib.warnOnInstantiate" in line or "warning" in line:
+            if 'lib.warnOnInstantiate "' in line:
+                date_older_warning_list.append(line)
+            else:
+                date_too_complex_list.append(f"{lineno:>5} {line}")
+        elif " = throw" in line:
             date_older_throw_list.append(line)
-        elif not only_throws:
+        else:
             date_older_list.append(line)
 
     return (
         date_older_list,
         date_sep_line_list,
+        date_too_complex_list,
         date_older_throw_list,
+        date_older_warning_list,
     )
 
 
-def convert_to_throw(date_older_list: list[str]) -> list[tuple[str, str]]:
-    """convert a list of lines to throws"""
-    converted_list = []
-    for line in date_older_list.copy():
+def convert(lines: list[str], convert_to: str) -> list[tuple[str, str]]:
+    """convert a list of lines to either "throws" or "warnings"."""
+    converted_lines = {}
+    for line in lines.copy():
         indent: str = " " * (len(line) - len(line.lstrip()))
-        before_equal = ""
-        after_equal = ""
-        try:
-            before_equal, after_equal = (x.strip() for x in line.split("=", maxsplit=2))
-        except ValueError as err:
-            print(err, line, "\n")
-            date_older_list.remove(line)
-            continue
 
-        alias = before_equal
-        alias_unquoted = before_equal.strip('"')
-        replacement = next(x.strip(";:") for x in after_equal.split())
+        if "=" not in line:
+            assert "inherit (" in line
+            before, sep, after = line.partition("inherit (")
+            inside, sep, after = after.partition(")")
+            if not sep:
+                print(f"FAILED ON {line}")
+                continue
+            alias, *_ = after.strip().split(";")[0].split()
+            replacement = f"{inside.strip()}.{alias}"
+
+        else:
+            before_equal = ""
+            after_equal = ""
+            try:
+                before_equal, after_equal = (
+                    x.strip() for x in line.split("=", maxsplit=2)
+                )
+                if after_equal.startswith("lib.warnOnInstantiate"):
+                    after_equal = after_equal.split("\"", maxsplit=3)[2].strip()
+            except ValueError as err:
+                print(err, line, "\n")
+                lines.remove(line)
+                continue
+
+            alias = before_equal
+            replacement = next(x.strip(";:") for x in after_equal.split())
+
+        alias_unquoted = alias.strip('"')
         replacement = replacement.removeprefix("pkgs.")
 
-        converted = (
-            f"{indent}{alias} = throw \"'{alias_unquoted}' has been"
-            f" renamed to/replaced by '{replacement}'\";"
-            f" # Converted to throw {datetime.today().strftime('%Y-%m-%d')}"
-        )
-        converted_list.append((line, converted))
+        if convert_to == "throws":
+            converted = (
+                f"{indent}{alias} = throw \"'{alias_unquoted}' has been"
+                f" renamed to/replaced by '{replacement}'\";"
+                f" # Converted to throw {datetime.today().strftime('%Y-%m-%d')}"
+            )
+            converted_lines[line] = converted
+        elif convert_to == "warnings":
+            converted = (
+                f"{indent}{alias} = lib.warnOnInstantiate \"'{alias_unquoted}' has been"
+                f" renamed to/replaced by '{replacement}'\" {replacement};"
+                f" # Converted to warning {datetime.today().strftime('%Y-%m-%d')}"
+            )
+            converted_lines[line] = converted
+        else:
+            raise ValueError("'convert_to' must be either 'throws' or 'warnings'")
 
-    return converted_list
+    return converted_lines
 
 
 def generate_text_to_write(
     txt: list[str],
-    date_older_list: list[str],
-    converted_to_throw: list[tuple[str, str]],
-    date_older_throw_list: list[str],
+    converted_lines: dict[str, str],
 ) -> list[str]:
     """generate a list of text to be written to the aliasfile"""
     text_to_write: list[str] = []
     for line in txt:
         text_to_append: str = ""
-        if converted_to_throw:
-            for tupl in converted_to_throw:
-                if line == tupl[0]:
-                    text_to_append = f"{tupl[1]}\n"
-        if line not in date_older_list and line not in date_older_throw_list:
-            text_to_append = f"{line}\n"
+        try:
+            new_line = converted_lines[line]
+            if new_line is not None:
+                text_to_write.append(f"{new_line}\n")
+        except KeyError:
+            text_to_write.append(f"{line}\n")
         if text_to_append:
             text_to_write.append(text_to_append)
 
@@ -171,30 +227,48 @@ def main() -> None:
     """main"""
     args = process_args()
 
-    only_throws = args.only_throws
     aliasfile = Path(args.file).absolute()
     cutoffdate = (datetime.strptime(f"{args.year}-{args.month}-01", "%Y-%m-%d")).date()
 
     txt: list[str] = (aliasfile.read_text(encoding="utf-8")).splitlines()
 
     date_older_list: list[str] = []
-    date_sep_line_list: list[str] = []
+    date_older_warning_list: list[str] = []
     date_older_throw_list: list[str] = []
+    date_sep_line_list: list[str] = []
+    date_too_complex_list: list[str] = []
 
-    date_older_list, date_sep_line_list, date_older_throw_list = get_date_lists(
-        txt, cutoffdate, only_throws
-    )
+    (
+        date_older_list,
+        date_sep_line_list,
+        date_too_complex_list,
+        date_older_throw_list,
+        date_older_warning_list,
+    ) = get_date_lists(txt, cutoffdate)
 
-    converted_to_throw: list[tuple[str, str]] = []
-    if date_older_list:
-        converted_to_throw = convert_to_throw(date_older_list)
-        print(" Will be converted to throws. ".center(100, "-"))
+    converted_lines: dict[str, str] = {}
+
+    if date_older_list and "aliases" in args.operate_on:
+        converted_lines.update(convert(date_older_list, "warnings"))
+        print(" Will be converted to warnings. ".center(100, "-"))
         for l_n in date_older_list:
             print(l_n)
 
-    if date_older_throw_list:
+    if date_older_warning_list and "warnings" in args.operate_on:
+        converted_lines.update(convert(date_older_warning_list, "throws"))
+        print(" Will be converted to throws. ".center(100, "-"))
+        for l_n in date_older_warning_list:
+            print(l_n)
+
+    if date_older_throw_list and "throws" in args.operate_on:
         print(" Will be removed. ".center(100, "-"))
         for l_n in date_older_throw_list:
+            converted_lines[l_n] = None
+            print(l_n)
+
+    if date_too_complex_list:
+        print(" Too complex, resolve manually. ".center(100, "-"))
+        for l_n in date_too_complex_list:
             print(l_n)
 
     if date_sep_line_list:
@@ -203,9 +277,7 @@ def main() -> None:
             print(l_n)
 
     if not args.dry_run:
-        text_to_write = generate_text_to_write(
-            txt, date_older_list, converted_to_throw, date_older_throw_list
-        )
+        text_to_write = generate_text_to_write(txt, converted_lines)
         write_file(aliasfile, text_to_write)
 
 

nixos/doc/manual/release-notes/rl-2511.section.md

@@ -82,6 +82,8 @@
 
 - [Corteza](https://cortezaproject.org/), a low-code platform. Available as [services.corteza](#opt-services.corteza.enable).
 
+- [Warpgate](https://warpgate.null.page), a SSH, HTTPS, MySQL and Postgres bastion. Available as [services.warpgate](#opt-services.warpgate.enable). Note that you need to run `warpgate recover-access` to recover builtin admin account, as the initialisation script uses a throwaway value to initialise its database.
+
 - [TuneD](https://tuned-project.org/), a system tuning service for Linux. Available as [services.tuned](#opt-services.tuned.enable).
 
 - [yubikey-manager](https://github.com/Yubico/yubikey-manager), a tool for configuring YubiKey devices. Available as [programs.yubikey-manager](#opt-programs.yubikey-manager.enable).

nixos/modules/module-list.nix

@@ -1498,6 +1498,7 @@
   ./services/security/vault-agent.nix
   ./services/security/vault.nix
   ./services/security/vaultwarden/default.nix
+  ./services/security/warpgate.nix
   ./services/security/yubikey-agent.nix
   ./services/system/automatic-timezoned.nix
   ./services/system/bpftune.nix

nixos/modules/services/display-managers/ly.nix

@@ -65,13 +65,7 @@ in
       package = mkPackageOption pkgs [ "ly" ] { };
 
       settings = mkOption {
-        type =
-          with lib.types;
-          attrsOf (oneOf [
-            str
-            int
-            bool
-          ]);
+        type = with lib.types; attrsOf iniFmt.lib.types.atom;
         default = { };
         example = {
           load = false;

nixos/modules/services/security/warpgate.nix

@@ -0,0 +1,444 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+let
+  cfg = config.services.warpgate;
+  yaml = pkgs.formats.yaml { };
+in
+{
+  options.services.warpgate =
+    let
+      inherit (lib.types)
+        nullOr
+        enum
+        str
+        bool
+        port
+        listOf
+        attrsOf
+        submodule
+        ;
+      inherit (lib.options) mkOption mkPackageOption literalExpression;
+    in
+    {
+      enable = mkOption {
+        description = ''
+          Whether to enable Warpgate.
+          This module will initialize Warpgate base on your config automatically. Please run `warpgate recover-access` to gain access.
+        '';
+        type = bool;
+        default = false;
+      };
+
+      package = mkPackageOption pkgs "warpgate" { };
+
+      databaseUrlFile = mkOption {
+        description = ''
+          Path to file containing database connection string with credentials.
+          Should be a one line file with: `database_url: <protocol>://<username>:<password>@<host>/<database>`.
+          See [SeaORM documentation](https://www.sea-ql.org/SeaORM/docs/install-and-config/connection/).
+        '';
+        type = nullOr str;
+        default = null;
+      };
+
+      settings = mkOption {
+        description = "Warpgate configuration.";
+        type = submodule {
+          freeformType = yaml.type;
+          options = {
+            sso_providers = mkOption {
+              description = "Configure OIDC single sign-on providers.";
+              default = [ ];
+              type = listOf (submodule {
+                freeformType = yaml.type;
+                options = {
+                  name = mkOption {
+                    description = "Internal identifier of SSO provider.";
+                    type = str;
+                  };
+                  label = mkOption {
+                    description = "SSO provider name displayed on login page.";
+                    type = str;
+                  };
+                  provider = mkOption {
+                    description = "SSO provider configurations.";
+                    type = attrsOf yaml.type;
+                  };
+                };
+              });
+              example = literalExpression ''
+                [
+                  {
+                    name = "3rd party SSO";
+                    label = "ACME SSO";
+                    provider = {
+                      type = "custom";
+                      client_id = "123...";
+                      client_secret = "BC...";
+                      issuer_url = "https://sso.acme.inc";
+                      scopes = ["email"];
+                    };
+                  }
+                  {
+                    ...
+                  }
+                ]
+              '';
+            };
+            recordings = {
+              enable = mkOption {
+                description = "Whether to enable session recording.";
+                default = true;
+                type = bool;
+              };
+              path = mkOption {
+                description = "Path to store session recordings.";
+                default = "/var/lib/warpgate/recordings";
+                type = str;
+              };
+            };
+            external_host = mkOption {
+              description = ''
+                Configure the domain name of this Warpgate instance.
+                See [HTTP domain binding](https://warpgate.null.page/http-domain-binding/).
+              '';
+              default = null;
+              type = nullOr str;
+            };
+            database_url = mkOption {
+              description = ''
+                Database connection string.
+                See [SeaORM documentation](https://www.sea-ql.org/SeaORM/docs/install-and-config/connection/).
+              '';
+              default = "sqlite:/var/lib/warpgate/db";
+              type = nullOr str;
+            };
+            ssh = {
+              enable = mkOption {
+                description = "Whether to enable SSH listener.";
+                default = false;
+                type = bool;
+              };
+              listen = mkOption {
+                description = "Listen endpoint of SSH listener.";
+                default = "[::]:2222";
+                type = str;
+              };
+              external_port = mkOption {
+                description = "The SSH listener is reachable via this port externally.";
+                default = null;
+                type = nullOr port;
+              };
+              keys = mkOption {
+                description = "Path to store SSH host & client keys.";
+                default = "/var/lib/warpgate/ssh-keys";
+                type = str;
+              };
+              host_key_verification = mkOption {
+                description = "Specify host key verification action when connecting to a SSH target with unknown/differing host key.";
+                default = "prompt";
+                type = enum [
+                  "prompt"
+                  "auto_accept"
+                  "auto_reject"
+                ];
+              };
+              inactivity_timeout = mkOption {
+                description = "How long can user be inactive until Warpgate terminates the connection.";
+                default = "5m";
+                type = str;
+              };
+              keepalive_interval = mkOption {
+                description = "If nothing is received from the client for this amount of time, server will send a keepalive message.";
+                default = null;
+                type = nullOr str;
+              };
+            };
+            http = {
+              listen = mkOption {
+                description = "Listen endpoint of HTTP listener.";
+                default = "[::]:8888";
+                type = str;
+              };
+              external_port = mkOption {
+                description = "The HTTP listener is reachable via this port externally.";
+                default = null;
+                type = nullOr port;
+              };
+              certificate = mkOption {
+                description = "Path to HTTPS listener certificate.";
+                default = "/var/lib/warpgate/tls.certificate.pem";
+                type = str;
+              };
+              key = mkOption {
+                description = "Path to HTTPS listener private key.";
+                default = "/var/lib/warpgate/tls.key.pem";
+                type = str;
+              };
+              sni_certificates = mkOption {
+                description = "Certificates for additional domains.";
+                default = [ ];
+                type = listOf (submodule {
+                  freeformType = yaml.type;
+                  options = {
+                    certificate = mkOption {
+                      description = "Path to certificate.";
+                      default = "";
+                      type = str;
+                    };
+                    key = mkOption {
+                      description = "Path to private key.";
+                      default = "";
+                      type = str;
+                    };
+                  };
+                });
+                example = literalExpression ''
+                  [
+                    {
+                      certificate = "/var/lib/warpgate/example.tld.pem";
+                      key = "/var/lib/warpgate/example.tld.key.pem";
+                    }
+                    {
+                      ...
+                    }
+                  ]
+                '';
+              };
+              trust_x_forwarded_headers = mkOption {
+                description = ''
+                  Trust X-Forwarded-* headers. Required when being reverse proxied.
+                  See [Running behind a reverse proxy](https://warpgate.null.page/reverse-proxy/).
+                '';
+                default = false;
+                type = bool;
+              };
+              session_max_age = mkOption {
+                description = "How long until a logged in session expires.";
+                default = "30m";
+                type = str;
+              };
+              cookie_max_age = mkOption {
+                description = "How long until logged in cookie expires.";
+                default = "1day";
+                type = str;
+              };
+            };
+            mysql = {
+              enable = mkOption {
+                description = "Whether to enable MySQL listener.";
+                default = false;
+                type = bool;
+              };
+              listen = mkOption {
+                description = "Listen endpoint of MySQL listener.";
+                default = "[::]:33306";
+                type = str;
+              };
+              external_port = mkOption {
+                description = "The MySQL listener is reachable via this port externally.";
+                default = null;
+                type = nullOr port;
+              };
+              certificate = mkOption {
+                description = "Path to MySQL listener certificate.";
+                default = "/var/lib/warpgate/tls.certificate.pem";
+                type = str;
+              };
+              key = mkOption {
+                description = "Path to MySQL listener private key.";
+                default = "/var/lib/warpgate/tls.key.pem";
+                type = str;
+              };
+            };
+            postgres = {
+              enable = mkOption {
+                description = "Whether to enable PostgreSQL listener.";
+                default = false;
+                type = bool;
+              };
+              listen = mkOption {
+                description = "Listen endpoint of PostgreSQL listener.";
+                default = "[::]:55432";
+                type = str;
+              };
+              external_port = mkOption {
+                description = "The PostgreSQL listener is reachable via this port externally.";
+                default = null;
+                type = nullOr str;
+              };
+              certificate = mkOption {
+                description = "Path to PostgreSQL listener certificate.";
+                default = "/var/lib/warpgate/tls.certificate.pem";
+                type = str;
+              };
+              key = mkOption {
+                description = "Path to PostgreSQL listener private key.";
+                default = "/var/lib/warpgate/tls.key.pem";
+                type = str;
+              };
+            };
+            log = {
+              retention = mkOption {
+                description = "How long Warpgate keep its logs.";
+                default = "7days";
+                type = str;
+              };
+              send_to = mkOption {
+                description = ''
+                  Path of UNIX socket of log forwarder.
+                  See [Log forwarding](https://warpgate.null.page/log-forwarding/);
+                '';
+                default = null;
+                type = nullOr str;
+              };
+            };
+            config_provider = mkOption {
+              description = ''
+                Source of truth of users.
+                DO NOT change this, Warpgate only implemented database provider.
+              '';
+              default = "database";
+              type = enum [
+                "file"
+                "database"
+              ];
+            };
+          };
+        };
+        default = { };
+        example = {
+          ssh = {
+            enable = true;
+            listen = "[::]:2211";
+          };
+          http = {
+            listen = "[::]:8011";
+          };
+        };
+      };
+    };
+
+  config =
+    let
+      inherit (lib.lists)
+        any
+        map
+        head
+        reverseList
+        ;
+      inherit (lib.strings) splitString toIntBase10;
+
+      preStartScript = pkgs.writers.writeBash "warpgate-init" ''
+        CFGFILE=/var/lib/warpgate/config.yaml
+        if [ ! -O $CFGFILE ] || [ ! -s $CFGFILE ]; then
+          INITPWD=$(tr -dc 'A-Za-z0-9!?%=' </dev/urandom 2>/dev/null | head -c 16)
+          ${lib.getExe cfg.package} \
+            --config $CFGFILE unattended-setup \
+            --data-path /var/lib/warpgate \
+            --http-port 8888 \
+            --admin-password $INITPWD
+        fi
+        ${
+          if cfg.databaseUrlFile != null then
+            ''
+              sed -e '/^database_url: null/d' ${yaml.generate "warpgate-config" cfg.settings} > $CFGFILE
+              cat /run/credentials/warpgate.service/databaseUrl >> $CFGFILE
+            ''
+          else
+            "cp --no-preserve=ownership ${yaml.generate "warpgate-config" cfg.settings} $CFGFILE"
+        }
+      '';
+      bindOnPrivilegedPorts = any (x: toIntBase10 x < 1025) (
+        map (x: head (reverseList (splitString ":" x))) (
+          [ cfg.settings.http.listen ]
+          ++ lib.optional cfg.settings.ssh.enable cfg.settings.ssh.listen
+          ++ lib.optional cfg.settings.mysql.enable cfg.settings.mysql.listen
+          ++ lib.optional cfg.settings.postgres.enable cfg.settings.postgres.listen
+        )
+      );
+    in
+    lib.mkIf cfg.enable {
+      assertions = [
+        {
+          assertion = !((cfg.databaseUrlFile != null) && (cfg.settings.database_url != null));
+          message = "You cannot configure databaseUrlFile and settings.database_url at the same time.";
+        }
+        {
+          assertion = !((cfg.databaseUrlFile == null) && (cfg.settings.database_url == null));
+          message = "Either databaseUrlFile or settings.database_url must be set; Set the other to null.";
+        }
+      ];
+
+      environment.systemPackages = [ cfg.package ];
+
+      systemd.services.warpgate = {
+        description = "Warpgate smart bastion";
+        wantedBy = [ "multi-user.target" ];
+        after = [ "network.target" ];
+        startLimitBurst = 5;
+        serviceConfig = {
+          LoadCredential = "${
+            if cfg.databaseUrlFile != null then "databaseUrl:${cfg.databaseUrlFile}" else ""
+          }";
+          ExecStartPre = preStartScript;
+          ExecStart = "${lib.getExe cfg.package} --config /var/lib/warpgate/config.yaml run";
+          DynamicUser = true;
+          RestartSec = 3;
+          Restart = "on-failure";
+          StateDirectory = "warpgate";
+          StateDirectoryMode = "0700";
+          LockPersonality = true;
+          MemoryDenyWriteExecute = true;
+          NoNewPrivileges = true;
+          PrivateTmp = true;
+          ProtectHome = true;
+          PrivateDevices = true;
+          DeviceAllow = [
+            "/dev/null rw"
+            "/dev/urandom r"
+          ];
+          DevicePolicy = "strict";
+          ProtectHostname = true;
+          ProtectKernelLogs = true;
+          ProtectKernelModules = true;
+          ProtectKernelTunables = true;
+          RestrictNamespaces = true;
+          ProtectProc = "invisible";
+          ProtectSystem = "full";
+          ProtectClock = true;
+          ProtectControlGroups = true;
+          RestrictRealtime = true;
+          RestrictSUIDSGID = true;
+          RemoveIPC = true;
+          RestrictAddressFamilies = [
+            "AF_INET"
+            "AF_INET6"
+            "AF_UNIX"
+          ];
+          SystemCallArchitectures = "native";
+          SystemCallFilter = [
+            "@system-service"
+            "~@privileged"
+          ];
+        }
+        // (
+          if bindOnPrivilegedPorts then
+            {
+              AmbientCapabilities = [ "CAP_NET_BIND_SERVICE" ];
+              CapabilityBoundingSet = [ "CAP_NET_BIND_SERVICE" ];
+            }
+          else
+            {
+              PrivateUsers = true;
+            }
+        );
+      };
+    };
+
+  meta.maintainers = with lib.maintainers; [ alemonmk ];
+}

nixos/modules/services/web-apps/nextcloud.nix

@@ -647,7 +647,7 @@ in
         '';
       };
       adminuser = lib.mkOption {
-        type = lib.types.str;
+        type = lib.types.nullOr lib.types.str;
         default = "root";
         description = ''
           Username for the admin account. The username is only set during the
@@ -656,7 +656,7 @@ in
         '';
       };
       adminpassFile = lib.mkOption {
-        type = lib.types.str;
+        type = lib.types.nullOr lib.types.str;
         description = ''
           The full path to a file that contains the admin's password. The password is
           set only in the initial setup of Nextcloud by the systemd service `nextcloud-setup.service`.
@@ -1124,6 +1124,26 @@ in
               https://docs.nextcloud.com/server/latest/admin_manual/configuration_database/db_conversion.html
             '';
           }
+          {
+            assertion =
+              lib.versionAtLeast overridePackage.version "32.0.0"
+              || (cfg.config.adminuser != null && cfg.config.adminpassFile != null);
+            message = ''
+              Disabling initial admin user creation is only available on Nextcloud >= 32.0.0.
+            '';
+          }
+          {
+            assertion = cfg.config.adminuser == null -> cfg.config.adminpassFile == null;
+            message = ''
+              If `services.nextcloud.config.adminuser` is null, `services.nextcloud.config.adminpassFile` must be null as well in order to disable initial admin user creation.
+            '';
+          }
+          {
+            assertion = cfg.config.adminpassFile == null -> cfg.config.adminuser == null;
+            message = ''
+              If `services.nextcloud.config.adminpassFile` is null, `services.nextcloud.config.adminuser` must be null as well in order to disable initial admin user creation.
+            '';
+          }
         ];
       }
 
@@ -1167,10 +1187,14 @@ in
                     arg = "DBPASS";
                     value = if c.dbpassFile != null then ''"$(<"$CREDENTIALS_DIRECTORY/dbpass")"'' else ''""'';
                   };
-                  adminpass = {
-                    arg = "ADMINPASS";
-                    value = ''"$(<"$CREDENTIALS_DIRECTORY/adminpass")"'';
-                  };
+                  adminpass =
+                    if c.adminpassFile != null then
+                      {
+                        arg = "ADMINPASS";
+                        value = ''"$(<"$CREDENTIALS_DIRECTORY/adminpass")"'';
+                      }
+                    else
+                      null;
                   installFlags = lib.concatStringsSep " \\\n    " (
                     lib.mapAttrsToList (k: v: "${k} ${toString v}") {
                       "--database" = ''"${c.dbtype}"'';
@@ -1181,15 +1205,16 @@ in
                       ${if c.dbhost != null then "--database-host" else null} = ''"${c.dbhost}"'';
                       ${if c.dbuser != null then "--database-user" else null} = ''"${c.dbuser}"'';
                       "--database-pass" = "\"\$${dbpass.arg}\"";
-                      "--admin-user" = ''"${c.adminuser}"'';
-                      "--admin-pass" = "\"\$${adminpass.arg}\"";
+                      ${if c.adminuser != null then "--admin-user" else null} = ''"${c.adminuser}"'';
+                      ${if adminpass != null then "--admin-pass" else null} = "\"\$${adminpass.arg}\"";
+                      ${if c.adminuser == null && adminpass == null then "--disable-admin-user" else null} = "";
                       "--data-dir" = ''"${datadir}/data"'';
                     }
                   );
                 in
                 ''
                   ${mkExport dbpass}
-                  ${mkExport adminpass}
+                  ${lib.optionalString (adminpass != null) (mkExport adminpass)}
                   ${lib.getExe occ} maintenance:install \
                       ${installFlags}
                 '';
@@ -1216,10 +1241,12 @@ in
                     exit 1
                   fi
                 ''}
-                if [ -z "$(<"$CREDENTIALS_DIRECTORY/adminpass")" ]; then
-                  echo "adminpassFile ${c.adminpassFile} is empty!"
-                  exit 1
-                fi
+                ${lib.optionalString (c.adminpassFile != null) ''
+                  if [ -z "$(<"$CREDENTIALS_DIRECTORY/adminpass")" ]; then
+                    echo "adminpassFile ${c.adminpassFile} is empty!"
+                    exit 1
+                  fi
+                ''}
 
                 # Check if systemd-tmpfiles setup worked correctly
                 if [[ ! -O "${datadir}/config" ]]; then
@@ -1261,10 +1288,9 @@ in
               '';
               serviceConfig.Type = "oneshot";
               serviceConfig.User = "nextcloud";
-              serviceConfig.LoadCredential = [
-                "adminpass:${cfg.config.adminpassFile}"
-              ]
-              ++ runtimeSystemdCredentials;
+              serviceConfig.LoadCredential =
+                lib.optional (cfg.config.adminpassFile != null) "adminpass:${cfg.config.adminpassFile}"
+                ++ runtimeSystemdCredentials;
               # On Nextcloud ≥ 26, it is not necessary to patch the database files to prevent
               # an automatic creation of the database user.
               environment.NC_setup_create_db_user = "false";

nixos/tests/all-tests.nix

@@ -1609,6 +1609,7 @@ in
   vsftpd = runTest ./vsftpd.nix;
   waagent = runTest ./waagent.nix;
   wakapi = runTest ./wakapi.nix;
+  warpgate = runTest ./warpgate.nix;
   warzone2100 = runTest ./warzone2100.nix;
   wasabibackend = runTest ./wasabibackend.nix;
   wastebin = runTest ./wastebin.nix;

nixos/tests/nextcloud/default.nix

@@ -30,8 +30,8 @@ let
         }
       ];
 
-      adminuser = "root";
-      adminpass = "hunter2";
+      adminuser = pkgs.lib.mkDefault "root";
+      adminpass = pkgs.lib.mkDefault "hunter2";
 
       test-helpers.rclone = "${pkgs.writeShellScript "rclone" ''
         set -euo pipefail
@@ -129,13 +129,16 @@ let
           }
         );
     in
-    map callNextcloudTest [
-      ./basic.nix
-      ./with-declarative-redis-and-secrets.nix
-      ./with-mysql-and-memcached.nix
-      ./with-postgresql-and-redis.nix
-      ./with-objectstore.nix
-    ];
+    map callNextcloudTest (
+      [
+        ./basic.nix
+        ./with-declarative-redis-and-secrets.nix
+        ./with-mysql-and-memcached.nix
+        ./with-postgresql-and-redis.nix
+        ./with-objectstore.nix
+      ]
+      ++ (pkgs.lib.optional (version >= 32) ./without-admin-user.nix)
+    );
 in
 listToAttrs (
   concatMap genTests [

nixos/tests/nextcloud/without-admin-user.nix

@@ -0,0 +1,48 @@
+{
+  name,
+  pkgs,
+  testBase,
+  system,
+  ...
+}:
+
+with import ../../lib/testing-python.nix { inherit system pkgs; };
+runTest (
+  {
+    config,
+    lib,
+    ...
+  }:
+  rec {
+    inherit name;
+
+    meta.maintainers = lib.teams.nextcloud.members;
+
+    imports = [ testBase ];
+
+    nodes = {
+      nextcloud =
+        { config, pkgs, ... }:
+        {
+          services.nextcloud = {
+            config = {
+              dbtype = "sqlite";
+              adminuser = null;
+              adminpassFile = lib.mkForce null;
+            };
+          };
+        };
+    };
+
+    adminuser = "root";
+    # This needs to be a "secure" password, since the password_policy app is enabled after installation and will forbid "simple" passwords.
+    adminpass = "+CVpTwaOEktxsFc6";
+
+    # Manually create the adminuser to make the default set of tests pass.
+    # If adminuser was already created during the installation this command would not succeed.
+    # This user name must always match the default value in services.nextcloud.config.adminuser!
+    test-helpers.init = ''
+      nextcloud.succeed("OC_PASS=${adminpass} nextcloud-occ user:add ${adminuser} --password-from-env")
+    '';
+  }
+)

nixos/tests/warpgate.nix

@@ -0,0 +1,49 @@
+{
+  name = "warpgate";
+
+  nodes = {
+    machine = {
+      services.warpgate = {
+        enable = true;
+      };
+    };
+
+    machine2 = {
+      environment.etc."warpgate-db-url".text = "database: sqlite:/var/lib/warpgate/db/";
+      services.warpgate = {
+        enable = true;
+        databaseUrlFile = "/etc/warpgate-db-url";
+        settings = {
+          database_url = null;
+        };
+      };
+    };
+
+    machine3 = {
+      services.warpgate = {
+        enable = true;
+        settings = {
+          http.listen = "[::]:443";
+        };
+      };
+    };
+  };
+
+  testScript = ''
+    machine.wait_for_unit("warpgate.service")
+    machine.wait_for_open_port(8888)
+    machine.succeed("stat /var/lib/warpgate/db/db.sqlite3")
+    machine.succeed("curl -k --fail https://localhost:8888/@warpgate")
+    machine.shutdown()
+
+    machine2.wait_for_unit("warpgate.service")
+    machine2.wait_for_open_port(8888)
+    machine2.succeed("curl -k --fail https://localhost:8888/@warpgate")
+    machine2.shutdown()
+
+    machine3.wait_for_unit("warpgate.service")
+    machine3.wait_for_open_port(443)
+    machine3.succeed("curl -k --fail https://localhost/@warpgate")
+    machine3.shutdown()
+  '';
+}

pkgs/applications/blockchains/nano-wallet/default.nix

@@ -15,24 +15,23 @@
 stdenv.mkDerivation rec {
 
   pname = "nano-wallet";
-  version = "25.1";
+  version = "28.2";
 
   src = fetchFromGitHub {
     owner = "nanocurrency";
     repo = "nano-node";
-    rev = "V${version}";
+    tag = "V${version}";
     fetchSubmodules = true;
-    hash = "sha256-YvYEXHC8kxviZLQwINs+pS61wITSfqfrrPmlR+zNRoE=";
+    hash = "sha256-Wo1Gd6dOnCoPiGmuJQhZmKKSg7LrKpfdvLNNKBYTUWI=";
   };
 
+  env.NIX_CFLAGS_COMPILE = "-Wno-error";
+
   patches = [
-    # Fix gcc-13 build failure due to missing <cstdint> includes.
+    # fix issue with <algorithm> include
     (fetchpatch {
-      name = "gcc-13.patch";
-      url = "https://github.com/facebook/rocksdb/commit/88edfbfb5e1cac228f7cc31fbec24bb637fe54b1.patch";
-      stripLen = 1;
-      extraPrefix = "submodules/rocksdb/";
-      hash = "sha256-HhlIYyPzIZFuyzHTUPz3bXgXiaFSQ8pVrLLMzegjTgE=";
+      url = "https://github.com/nanocurrency/nano-node/commit/1835a04dbbd1f6970649d7f72c454831432dd01f.patch";
+      hash = "sha256-IpC4yaIbJzQWYIC0QGXYQ345g6JnD2+xZG30qAQ1ubo=";
     })
   ];
 

pkgs/applications/editors/jupyter-kernels/xeus-cling/xeus-cling.nix

@@ -94,6 +94,9 @@ clangStdenv.mkDerivation rec {
       --replace-fail "simplisticCastAs" "castAs"
     substituteInPlace src/xmime_internal.hpp \
       --replace-fail "code.str()" "code.str().str()"
+
+    substituteInPlace CMakeLists.txt \
+      --replace-fail "cmake_minimum_required(VERSION 3.4.3)" "cmake_minimum_required(VERSION 3.10)"
   '';
 
   dontStrip = debug;

pkgs/applications/editors/vscode/extensions/anthropic.claude-code/default.nix

@@ -7,8 +7,8 @@ vscode-utils.buildVscodeMarketplaceExtension {
   mktplcRef = {
     name = "claude-code";
     publisher = "anthropic";
-    version = "2.0.26";
-    hash = "sha256-5wEIWlqKVBs7pwzsIAFtAjGWHTjlLI/LzCs+8M0LL9Q=";
+    version = "2.0.27";
+    hash = "sha256-4zifN9Wf7Tp+qrIvjf3iBPqu8wtedCAu1v93lDBAGbo=";
   };
 
   meta = {

pkgs/applications/networking/mumble/default.nix

@@ -155,12 +155,6 @@ let
       patches = [
         ./disable-overlay-build.patch
         ./fix-plugin-copy.patch
-        # Can be removed before the next update of Mumble, as that fix was upstreamed
-        # fix version display in MacOS Finder
-        (fetchpatch {
-          url = "https://github.com/mumble-voip/mumble/commit/fbd21bd422367bed19f801bf278562f567cbb8b7.patch";
-          sha256 = "sha256-qFhC2j/cOWzAhs+KTccDIdcgFqfr4y4VLjHiK458Ucs=";
-        })
       ];
 
       postInstall = lib.optionalString stdenv.hostPlatform.isDarwin ''
@@ -224,14 +218,14 @@ let
     } source;
 
   source = rec {
-    version = "1.5.735";
+    version = "1.5.857";
 
     # Needs submodules
     src = fetchFromGitHub {
       owner = "mumble-voip";
       repo = "mumble";
-      rev = "v${version}";
-      hash = "sha256-JRnGgxkf5ct6P71bYgLbCEUmotDLS2Evy6t8R7ac7D4=";
+      tag = "v${version}";
+      hash = "sha256-4ySak2nzT8p48waMgBc9kLrvFB8716e7p0G4trzuh1k=";
       fetchSubmodules = true;
     };
   };

pkgs/applications/office/libreoffice/default.nix

@@ -341,11 +341,14 @@ stdenv.mkDerivation (finalAttrs: {
       includes = [ "sdext/*" ];
       hash = "sha256-8yipl5ln1yCNfVM8SuWowsw1Iy/SXIwbdT1ZfNw4cJA=";
     })
-    # Fix build with Poppler 25.10
-    (fetchpatch2 {
-      url = "https://gitlab.archlinux.org/archlinux/packaging/packages/libreoffice-still/-/raw/f5241554e4a0f6fd95ac4e5cc398a30243407e6a/fix_build_with_poppler_25.10.patch";
-      hash = "sha256-lbPOkc1HeT5Qsp6XfVyVJtmvSL68qTrmbd3q9lvKSu8=";
-    })
+    # Currently included in the condition above
+    # Uncomment if Collabora is again the only version needing it
+    # Remove if Collabora is updated far enough not to need it anymore
+    ## Fix build with Poppler 25.10
+    #(fetchpatch2 {
+    #  url = "https://gitlab.archlinux.org/archlinux/packaging/packages/libreoffice-still/-/raw/f5241554e4a0f6fd95ac4e5cc398a30243407e6a/fix_build_with_poppler_25.10.patch";
+    #  hash = "sha256-lbPOkc1HeT5Qsp6XfVyVJtmvSL68qTrmbd3q9lvKSu8=";
+    #})
   ]
   ++ lib.optionals (variant == "collabora") [
     ./fix-unpack-collabora.patch

pkgs/applications/science/biology/minc-tools/default.nix

@@ -16,15 +16,22 @@
 
 stdenv.mkDerivation {
   pname = "minc-tools";
-  version = "2.3.06-unstable-2023-08-12";
+  version = "2.3.06-unstable-2024-11-28";
 
   src = fetchFromGitHub {
     owner = "BIC-MNI";
     repo = "minc-tools";
-    rev = "c86a767dbb63aaa05ee981306fa09f6133bde427";
-    hash = "sha256-PLNcuDU0ht1PcjloDhrPzpOpE42gbhPP3rfHtP7WnM4=";
+    rev = "a72077d92266f9ea4c49b6dd3efd5766b81a104c";
+    hash = "sha256-YafO5UjeADO/658Xm973JtqldRYkGQ4v8m1oNJoZrbM=";
   };
 
+  # Fix for CMake > 4 in which the old policy for CMP0026 was removed.
+  # Note this breaks the tests, but they are not enabled anyway.
+  # Upstream issue: https://github.com/BIC-MNI/minc-tools/issues/123
+  postPatch = ''
+    substituteInPlace CMakeLists.txt --replace-fail "SET CMP0026 OLD" "SET CMP0026 NEW"
+  '';
+
   nativeBuildInputs = [
     cmake
     flex
@@ -58,12 +65,12 @@ stdenv.mkDerivation {
     done
   '';
 
-  meta = with lib; {
+  meta = {
     homepage = "https://github.com/BIC-MNI/minc-tools";
     description = "Command-line utilities for working with MINC files";
-    maintainers = with maintainers; [ bcdarwin ];
-    platforms = platforms.unix;
-    license = licenses.free;
+    maintainers = with lib.maintainers; [ bcdarwin ];
+    platforms = lib.platforms.unix;
+    license = lib.licenses.free;
     broken = stdenv.hostPlatform.isDarwin;
   };
 }

pkgs/applications/virtualization/singularity/packages.nix

@@ -46,19 +46,19 @@ let
     callPackage
       (import ./generic.nix rec {
         pname = "singularity-ce";
-        version = "4.3.3";
+        version = "4.3.4";
         projectName = "singularity";
 
         src = fetchFromGitHub {
           owner = "sylabs";
           repo = "singularity";
           tag = "v${version}";
-          hash = "sha256-gQuakfQgB5gLVYLmmThy06CyGBhlBOCJI9jaEm7ucf0=";
+          hash = "sha256-+KW9XaYXNzOpUier8FJ4lbKx7uJ8jNKHkt2QX2Kiehs=";
         };
 
         # Override vendorHash with overrideAttrs.
         # See https://nixos.org/manual/nixpkgs/unstable/#buildGoModule-vendorHash
-        vendorHash = "sha256-z8bLbudm1b5xFCAUpL/m90vxwLJlBqpQCjAEjSYOQH8=";
+        vendorHash = "sha256-JCRUhY00Zj6rlmyDW+RKoGNKhmxesgHn9XdO8h2DAj4=";
 
         extraConfigureFlags = [
           # Do not build squashfuse from the Git submodule sources, use Nixpkgs provided version

pkgs/applications/virtualization/virtualbox/guest-additions/default.nix

@@ -4,6 +4,7 @@
   callPackage,
   lib,
   dbus,
+  kmod,
   xorg,
   zlib,
   patchelf,
@@ -81,6 +82,7 @@ stdenv.mkDerivation {
     patchelf
     makeWrapper
     virtualBoxNixGuestAdditionsBuilder
+    kmod
   ]
   ++ kernel.moduleBuildDependencies;
 
@@ -140,6 +142,11 @@ stdenv.mkDerivation {
     # libGL.so (which we can't), and Oracle doesn't plan on supporting libglvnd
     # either. (#18457)
 
+    mkdir -p $out/etc/depmod.d
+    for mod in $out/lib/modules/*/misc/*; do
+      echo "override $(modinfo -F name "$mod") * misc" >> $out/etc/depmod.d/vbox.conf
+    done
+
     runHook postInstall
   '';
 

pkgs/by-name/am/amiberry/package.nix

@@ -2,6 +2,7 @@
   lib,
   stdenv,
   fetchFromGitHub,
+  fetchpatch,
   cmake,
   copyDesktopItems,
   makeWrapper,
@@ -28,6 +29,15 @@ stdenv.mkDerivation (finalAttrs: {
     hash = "sha256-EOoVJYefX2pQ2Zz9bLD1RS47u/+7ZWTMwZYha0juF64=";
   };
 
+  patches = [
+    # cmake-4 support
+    (fetchpatch {
+      name = "cmake-4.patch";
+      url = "https://github.com/BlitterStudio/amiberry/commit/dbd85a37147603875b9ca51a9409c65a26c0d60a.patch?full_index=1";
+      hash = "sha256-w8Z9yhNafbXWv3nV8GDNpks2R1+M12uG1mWWrwVaEUk=";
+    })
+  ];
+
   nativeBuildInputs = [
     cmake
     copyDesktopItems

pkgs/by-name/cd/cdncheck/package.nix

@@ -6,16 +6,16 @@
 
 buildGoModule rec {
   pname = "cdncheck";
-  version = "1.2.6";
+  version = "1.2.7";
 
   src = fetchFromGitHub {
     owner = "projectdiscovery";
     repo = "cdncheck";
     tag = "v${version}";
-    hash = "sha256-MZA9PkDftUyHqcC5i9QLvMTq+q1m7MVEkMPyD4EiWtk=";
+    hash = "sha256-Tit9AJ6V20vutd4veymlyi9thstcf6+sefHfhGeRQ68=";
   };
 
-  vendorHash = "sha256-tPhWKjaoUHQq6MdhktSZpfF7651YKeWd9ecg8V3E6aQ=";
+  vendorHash = "sha256-n0/9VLnB4y0YSbc6fu9SP0sWfGFSh7QgZfJkHMJB80U=";
 
   subPackages = [ "cmd/cdncheck/" ];
 

pkgs/by-name/cl/claude-code/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@anthropic-ai/claude-code",
-  "version": "2.0.26",
+  "version": "2.0.27",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@anthropic-ai/claude-code",
-      "version": "2.0.26",
+      "version": "2.0.27",
       "license": "SEE LICENSE IN README.md",
       "bin": {
         "claude": "cli.js"

pkgs/by-name/cl/claude-code/package.nix

@@ -7,14 +7,14 @@
 }:
 buildNpmPackage (finalAttrs: {
   pname = "claude-code";
-  version = "2.0.26";
+  version = "2.0.27";
 
   src = fetchzip {
     url = "https://registry.npmjs.org/@anthropic-ai/claude-code/-/claude-code-${finalAttrs.version}.tgz";
-    hash = "sha256-4roXnR6y3jFr7uCZFKTFOyahPjnhJuyVFXunQ89flL4=";
+    hash = "sha256-ZxwEnUWCtgrGhgtUjcWcMgLqzaajwE3pG7iSIfaS3ic=";
   };
 
-  npmDepsHash = "sha256-fEXaPqT9TxDb3uWJRRGIJMP2NffUBDGpPY2uJc6DP0k=";
+  npmDepsHash = "sha256-cBhHQYHmLtGhLfaK//L48qGZCF+u6N/OsLTTpNA2t+E==";
 
   postPatch = ''
     cp ${./package-lock.json} package-lock.json

pkgs/by-name/cl/claude-code/update.sh

@@ -1,5 +1,5 @@
 #!/usr/bin/env nix-shell
-#!nix-shell --pure --keep NIX_PATH -i bash --packages nodejs nix-update git
+#!nix-shell --pure --keep NIX_PATH -i bash --packages nodejs nix-update git cacert
 
 set -euo pipefail
 

pkgs/by-name/co/copilot-language-server/package.nix

@@ -10,11 +10,11 @@
 }:
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "copilot-language-server";
-  version = "1.385.0";
+  version = "1.388.0";
 
   src = fetchzip {
     url = "https://github.com/github/copilot-language-server-release/releases/download/${finalAttrs.version}/copilot-language-server-js-${finalAttrs.version}.zip";
-    hash = "sha256-AzMLicQHP3r8RZIkf/jqlU2n78bliLwam9t1DUgqvzw=";
+    hash = "sha256-qFFLDy1/4w5Qlp3wcWlISoBMYVNHCsVLW27JBuoCcMk=";
     stripRoot = false;
   };
 

pkgs/by-name/cp/cppcodec/package.nix

@@ -3,6 +3,7 @@
   stdenv,
   fetchFromGitHub,
   cmake,
+  fetchpatch,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
@@ -16,6 +17,17 @@ stdenv.mkDerivation (finalAttrs: {
     hash = "sha256-k4EACtDOSkTXezTeFtVdM1EVJjvGga/IQSrvDzhyaXw=";
   };
 
+  patches = [
+    # CMake 2.8 is deprecated and is no longer supported by CMake > 4
+    # https://github.com/NixOS/nixpkgs/issues/445447
+    # Luckily, this has been fixed on master.
+    (fetchpatch {
+      name = "modernize-cmake.patch";
+      url = "https://github.com/tplgy/cppcodec/commit/8019b8b580f8573c33c50372baec7039dfe5a8ce.patch";
+      hash = "sha256-0MCx3nTsey4Qonx+lyexbcxut0qIHOJZbkJ9u23Zuv8=";
+    })
+  ];
+
   nativeBuildInputs = [ cmake ];
 
   meta = with lib; {

pkgs/by-name/cu/cursor-cli/package.nix

@@ -9,26 +9,26 @@ let
   inherit (stdenv) hostPlatform;
   sources = {
     x86_64-linux = fetchurl {
-      url = "https://downloads.cursor.com/lab/2025.10.20-f1b214f/linux/x64/agent-cli-package.tar.gz";
-      hash = "sha256-v6wGVuKrK4JFFaJN55le5+wZV7LI9Bc70Osc05F0PeQ=";
+      url = "https://downloads.cursor.com/lab/2025.10.22-f894c20/linux/x64/agent-cli-package.tar.gz";
+      hash = "sha256-bblnHWrPXJ9UmStfjUis1jLYLyawRchF0+UBMmPHy7M=";
     };
     aarch64-linux = fetchurl {
-      url = "https://downloads.cursor.com/lab/2025.10.20-f1b214f/linux/arm64/agent-cli-package.tar.gz";
-      hash = "sha256-j3z3K2tt2wl54OjLMPudGnCP2+9U2dOspM0G0Ob68Ds=";
+      url = "https://downloads.cursor.com/lab/2025.10.22-f894c20/linux/arm64/agent-cli-package.tar.gz";
+      hash = "sha256-MnL1TLI7ggi9qaicUN//8o3EJoCPd0gF9KKfekIhUM0=";
     };
     x86_64-darwin = fetchurl {
-      url = "https://downloads.cursor.com/lab/2025.10.20-f1b214f/darwin/x64/agent-cli-package.tar.gz";
-      hash = "sha256-KRECUSqYohrCiF3YySZeJ0MaRhb7h+O+KyqCfpCbV8w=";
+      url = "https://downloads.cursor.com/lab/2025.10.22-f894c20/darwin/x64/agent-cli-package.tar.gz";
+      hash = "sha256-UEQyHEopNKf5uDUlZVzTESXVi8e2wHp83cD01diAISY=";
     };
     aarch64-darwin = fetchurl {
-      url = "https://downloads.cursor.com/lab/2025.10.20-f1b214f/darwin/arm64/agent-cli-package.tar.gz";
-      hash = "sha256-4S1HMPielrUwP5pyA/tp1FuByge9dcRx2XndTFnBKbY=";
+      url = "https://downloads.cursor.com/lab/2025.10.22-f894c20/darwin/arm64/agent-cli-package.tar.gz";
+      hash = "sha256-18u5K/4Mc9+R32umaBWD5chgMoatkd/ZSMCiPElmPJU=";
     };
   };
 in
 stdenv.mkDerivation {
   pname = "cursor-cli";
-  version = "0-unstable-2025-10-20";
+  version = "0-unstable-2025-10-22";
 
   src = sources.${hostPlatform.system};
 

pkgs/by-name/de/debian-devscripts/package.nix

@@ -30,14 +30,14 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "debian-devscripts";
-  version = "2.25.20";
+  version = "2.25.21";
 
   src = fetchFromGitLab {
     domain = "salsa.debian.org";
     owner = "debian";
     repo = "devscripts";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-TpS4Gb6HZfCO42PSMyQ6qC1uUYAGkC9r4DHz4tofYKw=";
+    hash = "sha256-5X3bhtUSCBUzIZ3EScppnK+VS2IxnmDwqt2BwQG4fMA=";
   };
 
   patches = [

pkgs/by-name/di/discord-sh/package.nix

@@ -11,13 +11,13 @@
 
 stdenvNoCC.mkDerivation rec {
   pname = "discord-sh";
-  version = "2.0.0";
+  version = "2.0.1";
 
   src = fetchFromGitHub {
     owner = "ChaoticWeg";
     repo = "discord.sh";
     rev = "v${version}";
-    sha256 = "sha256-ZOGhwR9xFzkm+q0Gm8mSXZ9toXG4xGPNwBQMCVanCbY=";
+    sha256 = "sha256-z57uMbH6PI68aTMAjA8UIPEefV8sQRR4cS0eK6Ypxuk=";
   };
 
   # ignore Makefile by disabling buildPhase. Upstream Makefile tries to download

pkgs/by-name/du/duckx/package.nix

@@ -27,6 +27,13 @@ stdenv.mkDerivation (finalAttrs: {
     (lib.cmakeFeature "CMAKE_CXX_STANDARD" "14")
   ];
 
+  postPatch = ''
+    substituteInPlace CMakeLists.txt \
+      --replace-fail "cmake_minimum_required(VERSION 3.0)" "cmake_minimum_required(VERSION 3.10)"
+    # CMake 3.0 is deprecated and is no longer supported by CMake > 4
+    # https://github.com/NixOS/nixpkgs/issues/445447
+  '';
+
   passthru = {
     updateScript = gitUpdater { rev-prefix = "v"; };
   };

pkgs/by-name/fa/far2l/package.nix

@@ -1,6 +1,7 @@
 {
   lib,
   stdenv,
+  fetchpatch,
   fetchFromGitHub,
   makeWrapper,
   cmake,
@@ -52,6 +53,14 @@ stdenv.mkDerivation rec {
     sha256 = "sha256-a/k36O19z/lHnETOGIbTJ7BNAI5zOQxVUSp+nIM08i4=";
   };
 
+  patches = [
+    (fetchpatch {
+      name = "cmake4-fix";
+      url = "https://github.com/elfmz/far2l/commit/97ac0a3a0f29110a330d8f8634775e024561e817.patch?full_index=1";
+      hash = "sha256-LlCKgFPxoRrb2nD+PARsJCpUXqMO0rLyNbuvLh949fU=";
+    })
+  ];
+
   nativeBuildInputs = [
     cmake
     ninja

pkgs/by-name/fa/fava/package.nix

@@ -8,17 +8,17 @@
 let
   src = buildNpmPackage (finalAttrs: {
     pname = "fava-frontend";
-    version = "1.30.6";
+    version = "1.30.7";
 
     src = fetchFromGitHub {
       owner = "beancount";
       repo = "fava";
       tag = "v${finalAttrs.version}";
-      hash = "sha256-AMbKGIfR/URu7RpyBKSR3lzfIliRWjnUNNjLvu9KmfM=";
+      hash = "sha256-gO6eJIFp/yWAXFWhUcqkkfk2pA8/vyTxgPRPBmv4a6Q=";
     };
     sourceRoot = "${finalAttrs.src.name}/frontend";
 
-    npmDepsHash = "sha256-geou0+Ges0jjrlXG9m3u1GMdf0Qt2pTd8vRGh9gAWJ4=";
+    npmDepsHash = "sha256-cXIhEzYFpLOxUEY7lhTWW7R3/ptkx7hB9K92Fd2m1Ng=";
     makeCacheWritable = true;
 
     preBuild = ''
@@ -34,7 +34,7 @@ let
 in
 python3Packages.buildPythonApplication {
   pname = "fava";
-  version = "1.30.6";
+  inherit (src) version;
   pyproject = true;
 
   inherit src;
@@ -78,10 +78,6 @@ python3Packages.buildPythonApplication {
     SNAPSHOT_IGNORE = lib.versions.major python3Packages.beancount.version == "2";
   };
 
-  preCheck = ''
-    export HOME=$TEMPDIR
-  '';
-
   meta = {
     description = "Web interface for beancount";
     mainProgram = "fava";

pkgs/by-name/fo/forecast/package.nix

@@ -16,13 +16,13 @@
 
 rustPlatform.buildRustPackage {
   pname = "forecast";
-  version = "0-unstable-2025-10-09";
+  version = "0-unstable-2025-10-21";
 
   src = fetchFromGitHub {
     owner = "cosmic-utils";
     repo = "forecast";
-    rev = "f4dca2317007bc3316b22456e36a76d50500ccc8";
-    hash = "sha256-zbL4a5haggMJEN7vbe+v026Qo4BFZvtoH8QaZPmpcBw=";
+    rev = "8f04cafd809d58bdd46556b66f3aa4574e81fcbd";
+    hash = "sha256-DRShCI/tBh/a3IM/UH8yujlJyEeqGJ+kbnqSF8AibS0=";
   };
 
   cargoHash = "sha256-di7zjwI0/6NB2cAih3d7iqwSb+o/607jbgJN1MtbZX8=";

pkgs/by-name/fo/foxotron/package.nix

@@ -18,7 +18,6 @@
   alsa-lib,
   fontconfig,
 }:
-
 stdenv.mkDerivation rec {
   pname = "foxotron";
   version = "2024-09-23";
@@ -43,12 +42,17 @@ stdenv.mkDerivation rec {
 
   postPatch = ''
     substituteInPlace CMakeLists.txt \
-      --replace "set(CMAKE_OSX_ARCHITECTURES x86_64)" ""
+      --replace-fail "set(CMAKE_OSX_ARCHITECTURES x86_64)" "" \
+      --replace-fail "cmake_minimum_required(VERSION 3.0)" "cmake_minimum_required(VERSION 3.10)"
+
+    substituteInPlace externals/glm/CMakeLists.txt \
+      --replace-fail "cmake_minimum_required(VERSION 3.2 FATAL_ERROR)" "cmake_minimum_required(VERSION 3.10)" \
+      --replace-fail "cmake_policy(VERSION 3.2)" "cmake_policy(VERSION 3.10)"
 
     # Outdated vendored assimp, many warnings with newer compilers, too old for CMake option to control this
     # Note that this -Werror caused issues on darwin, so make sure to re-check builds there before removing this
     substituteInPlace externals/assimp/code/CMakeLists.txt \
-      --replace 'TARGET_COMPILE_OPTIONS(assimp PRIVATE -Werror)' ""
+      --replace-fail 'TARGET_COMPILE_OPTIONS(assimp PRIVATE -Werror)' ""
   '';
 
   nativeBuildInputs = [

pkgs/by-name/ga/galario/package.nix

@@ -10,7 +10,6 @@
   pythonPackages ? null,
   llvmPackages,
 }:
-
 let
   # CMake recipes are needed to build galario
   # Build process would usually download them
@@ -50,6 +49,9 @@ stdenv.mkDerivation (finalAttrs: {
     substituteInPlace python/utils.py \
       --replace-fail "trapz" "trapezoid" \
       --replace-fail "np.int" "int"
+
+    substituteInPlace CMakeLists.txt \
+      --replace-fail "cmake_minimum_required(VERSION 3.0)" "cmake_minimum_required(VERSION 3.10)"
   '';
 
   nativeCheckInputs = lib.optionals enablePython [

pkgs/by-name/go/golly/package.nix

@@ -13,10 +13,10 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "golly";
-  version = "4.3";
+  version = "5.0";
 
   src = fetchurl {
-    hash = "sha256-UdJHgGPn7FDN4rYTgfPBAoYE5FGC43TP8OFBmYIqCB0=";
+    hash = "sha256-WDXN5CgVP5uEC6lKQ1nlyybrMC56wBoJfNf1pcgwNhE=";
     url = "mirror://sourceforge/project/golly/golly/golly-${finalAttrs.version}/golly-${finalAttrs.version}-src.tar.gz";
   };
 

pkgs/by-name/hu/hugo/package.nix

@@ -11,16 +11,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "hugo";
-  version = "0.151.2";
+  version = "0.152.2";
 
   src = fetchFromGitHub {
     owner = "gohugoio";
     repo = "hugo";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-jCHKXqIQBeSyhkusTbygaoyqifayc6jFXY9ot/oWmtM=";
+    hash = "sha256-nSWeCRhbaEgr54VDstBKnouUeWR1JjLXEqtYUcEMdyQ=";
   };
 
-  vendorHash = "sha256-KJCpZ7rX2v98n7EXbfwL2wf6pLMDMHX7Mnugyh+nx6k=";
+  vendorHash = "sha256-3cIz3SWV/3vYhCgFEGAa+mOaUCzsJurkI2rPtVANE38=";
 
   checkFlags =
     let

pkgs/by-name/in/infamousPlugins/package.nix

@@ -42,6 +42,17 @@ stdenv.mkDerivation rec {
     zita-resampler
   ];
 
+  postPatch = ''
+    substituteInPlace CMakeLists.txt --replace-fail \
+      'cmake_minimum_required(VERSION 2.8)' \
+      'cmake_minimum_required(VERSION 4.0)'
+    find src -name "CMakeLists.txt" -type f | while read -r file; do
+      substituteInPlace "$file" --replace-fail \
+        'cmake_minimum_required(VERSION 2.8)' \
+        'cmake_minimum_required(VERSION 4.0)'
+    done
+  '';
+
   meta = with lib; {
     homepage = "https://ssj71.github.io/infamousPlugins";
     description = "Collection of open-source LV2 plugins";

pkgs/by-name/ka/kaldi/package.nix

@@ -34,6 +34,8 @@ stdenv.mkDerivation (finalAttrs: {
     "-DBLAS_LIBRARIES=-lblas"
     "-DLAPACK_LIBRARIES=-llapack"
     "-DFETCHCONTENT_SOURCE_DIR_OPENFST:PATH=${finalAttrs.passthru.sources.openfst}"
+    # Fix the build with CMake 4 (openfst does not contain cmake_minimum_required)
+    "-DCMAKE_POLICY_VERSION_MINIMUM=3.10"
   ];
 
   buildInputs = [

pkgs/by-name/le/ledger/package.nix

@@ -2,7 +2,6 @@
   stdenv,
   lib,
   fetchFromGitHub,
-  fetchpatch2,
   cmake,
   boost,
   gmp,
@@ -21,13 +20,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "ledger";
-  version = "3.3.2";
+  version = "3.4.1";
 
   src = fetchFromGitHub {
     owner = "ledger";
     repo = "ledger";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-Uym4s8EyzXHlISZqThcb6P1H5bdgD9vmdIOLkk5ikG0=";
+    hash = "sha256-yk6/4ImUzgZY8O7MmQMwFkuJ/pMXo6W5TAA0GGIxYgg=";
   };
 
   # by default, it will query the python interpreter for it's sitepackages location
@@ -37,29 +36,6 @@ stdenv.mkDerivation (finalAttrs: {
       --replace-fail 'DESTINATION ''${Python_SITEARCH}' 'DESTINATION "${placeholder "py"}/${python3.sitePackages}"'
   '';
 
-  patches = [
-    (fetchpatch2 {
-      name = "ledger-boost-1.85-compat.patch";
-      url = "https://github.com/ledger/ledger/commit/46207852174feb5c76c7ab894bc13b4f388bf501.patch";
-      hash = "sha256-X0NSN60sEFLvcfMmtVoxC7fidcr5tJUlFVQ/E8qfLss=";
-    })
-    (fetchpatch2 {
-      name = "ledger-boost-1.86-compat-1.patch";
-      url = "https://github.com/ledger/ledger/commit/f6750ed89b46926d1f0859f3b25d18ed62ac219e.patch";
-      hash = "sha256-pktwotuMbZcR2DpZccMqV13524avKvazDX/+Ki6h69g=";
-    })
-    (fetchpatch2 {
-      name = "ledger-boost-1.86-compat-2.patch";
-      url = "https://github.com/ledger/ledger/commit/62f626fa73bd6832028f43c204c43cf15bd5f409.patch";
-      hash = "sha256-cazhSxadNpiA6ofZxS8JALOPy88cNPM/jKHaUYk8pBw=";
-    })
-    (fetchpatch2 {
-      name = "ledger-boost-1.86-compat-3.patch";
-      url = "https://github.com/ledger/ledger/commit/124398c35be573324cf2384c08b99b4476f29e2b.patch";
-      hash = "sha256-N3dUrqNsOiVgedoYmyfYllK+4lvKdMxc8iq0+DgEbxc=";
-    })
-  ];
-
   outputs = [
     "out"
     "dev"
@@ -99,10 +75,6 @@ stdenv.mkDerivation (finalAttrs: {
     (lib.cmakeBool "BUILD_DOCS" true)
     (lib.cmakeBool "USE_PYTHON" usePython)
     (lib.cmakeBool "USE_GPGME" gpgmeSupport)
-
-    # CMake 4 dropped support of versions lower than 3.5, and versions
-    # lower than 3.10 are deprecated.
-    (lib.cmakeFeature "CMAKE_POLICY_VERSION_MINIMUM" "3.10")
   ];
 
   installTargets = [
@@ -135,6 +107,9 @@ stdenv.mkDerivation (finalAttrs: {
       their data, there really is no alternative.
     '';
     platforms = lib.platforms.all;
-    maintainers = with lib.maintainers; [ jwiegley ];
+    maintainers = with lib.maintainers; [
+      jwiegley
+      afh
+    ];
   };
 })

pkgs/by-name/li/lint-staged/package.nix

@@ -8,16 +8,16 @@
 
 buildNpmPackage rec {
   pname = "lint-staged";
-  version = "16.2.5";
+  version = "16.2.6";
 
   src = fetchFromGitHub {
     owner = "okonet";
     repo = "lint-staged";
     rev = "v${version}";
-    hash = "sha256-9SsdcF294v6/PAsz/cJXsqUbloSy24HHG7z7bCKUHaw=";
+    hash = "sha256-d4DB1kVUwO9+VF90BZjSAAH3/KyjmbJ4yfXOMOX23Wc=";
   };
 
-  npmDepsHash = "sha256-/hknNGUG02jFEYfYNM/eShiNptktJcc4XGAG3klfryA=";
+  npmDepsHash = "sha256-L0X3v5Ekd8qt8A9TTtgGsnv1WV1HKcRwAiHpf5zP3oo=";
 
   dontNpmBuild = true;
 

pkgs/by-name/mi/minc_widgets/package.nix

@@ -2,6 +2,7 @@
   lib,
   stdenv,
   fetchFromGitHub,
+  fetchpatch,
   cmake,
   makeWrapper,
   perlPackages,
@@ -22,6 +23,14 @@ stdenv.mkDerivation {
     sha256 = "1b9g6lf37wpp211ikaji4rf74rl9xcmrlyqcw1zq3z12ji9y33bm";
   };
 
+  patches = [
+    (fetchpatch {
+      name = "cmake4-fix.patch";
+      url = "https://github.com/BIC-MNI/minc-widgets/commit/9f5bc1996d2f9b4702efdb010834e2c7f1e3fbf1.patch";
+      hash = "sha256-qqMKbxQS+HTRQaOP2DH/m8Z3DqoCMGLFp1AEKaQ6l5s=";
+    })
+  ];
+
   nativeBuildInputs = [
     cmake
     makeWrapper
@@ -50,11 +59,11 @@ stdenv.mkDerivation {
     done
   '';
 
-  meta = with lib; {
+  meta = {
     homepage = "https://github.com/BIC-MNI/minc-widgets";
     description = "Collection of Perl and shell scripts for processing MINC files";
-    maintainers = with maintainers; [ bcdarwin ];
-    platforms = platforms.unix;
-    license = licenses.free;
+    maintainers = with lib.maintainers; [ bcdarwin ];
+    platforms = lib.platforms.unix;
+    license = lib.licenses.free;
   };
 }

pkgs/by-name/mu/museum/package.nix

@@ -10,17 +10,17 @@
 
 buildGoModule (finalAttrs: {
   pname = "museum";
-  version = "1.2.11";
+  version = "1.2.15";
 
   src = fetchFromGitHub {
     owner = "ente-io";
     repo = "ente";
     sparseCheckout = [ "server" ];
     tag = "photos-v${finalAttrs.version}";
-    hash = "sha256-GSHWEbnBn2nS2aQ1lQU8Vpp8lEQiPBfmU7BsfXADVXs=";
+    hash = "sha256-NP9ow5CUr2JNzajj2IOiWmcXs1hTbuHTufa64pbj+l4=";
   };
 
-  vendorHash = "sha256-5o2nOFBwMY3qHyMWp+NDRkxf/2egTzWCiGMzY3No4OY=";
+  vendorHash = "sha256-napF55nA/9P8l5lddnEHQMjLXWSyTzgblIQCbSZ20MA=";
 
   sourceRoot = "${finalAttrs.src.name}/server";
 

pkgs/by-name/nu/nuclei-templates/package.nix

@@ -6,13 +6,13 @@
 
 stdenvNoCC.mkDerivation rec {
   pname = "nuclei-templates";
-  version = "10.3.0";
+  version = "10.3.1";
 
   src = fetchFromGitHub {
     owner = "projectdiscovery";
     repo = "nuclei-templates";
     tag = "v${version}";
-    hash = "sha256-WzPH3uyRAseN51gpmezfD0Mcbjh2K2mSkRbo3LFShG4=";
+    hash = "sha256-ZiqTusOcWv3XRQaxOlu8MojQHBbCue7IIyPI078YP04=";
   };
 
   installPhase = ''

pkgs/by-name/or/orocos-kdl/package.nix

@@ -8,15 +8,14 @@
 
 stdenv.mkDerivation rec {
   pname = "orocos-kdl";
-  version = "1.5.1";
+  version = "1.5.3";
 
   src = fetchFromGitHub {
     owner = "orocos";
     repo = "orocos_kinematics_dynamics";
-    tag = "v${version}";
-    sha256 = "15ky7vw461005axx96d0f4zxdnb9dxl3h082igyd68sbdb8r1419";
-    # Needed to build Python bindings
-    fetchSubmodules = true;
+    tag = "${version}";
+    hash = "sha256-4pPU+6uMMYLGq2V46wmg6lHFVhwFXrEg7PfnWGAI2is=";
+    fetchSubmodules = true; # Needed to build Python bindings
   };
 
   sourceRoot = "${src.name}/orocos_kdl";

pkgs/by-name/pr/protobuf-language-server/package.nix

@@ -0,0 +1,31 @@
+{
+  lib,
+  buildGoModule,
+  fetchFromGitHub,
+}:
+
+buildGoModule (finalAttrs: {
+  pname = "protobuf-language-server";
+  version = "0.1.1";
+
+  src = fetchFromGitHub {
+    owner = "lasorda";
+    repo = "protobuf-language-server";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-bDsvByXa2kH3DnvQpAq79XvwFg4gfhtOP2BpqA1LCI0=";
+  };
+
+  vendorHash = "sha256-dRria1zm5Jk7ScXh0HXeU686EmZcRrz5ZgnF0ca9aUQ=";
+
+  # TestMethodsGen overwrites go-lsp/lsp/methods_gen.go with missing imports.
+  # This causes other tests to break.
+  checkFlags = [ "-skip=TestMethodsGen" ];
+
+  meta = {
+    description = "Language server implementation for Google Protocol Buffers";
+    mainProgram = "protobuf-language-server";
+    homepage = "https://github.com/lasorda/protobuf-language-server";
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ bizmyth ];
+  };
+})

pkgs/by-name/qo/qovery-cli/package.nix

@@ -4,43 +4,56 @@
   buildGoModule,
   fetchFromGitHub,
   installShellFiles,
-  qovery-cli,
-  testers,
+  versionCheckHook,
+  writableTmpDirAsHomeHook,
 }:
 
-buildGoModule rec {
+buildGoModule (finalAttrs: {
   pname = "qovery-cli";
-  version = "1.2.6";
+  version = "1.52.0";
 
   src = fetchFromGitHub {
     owner = "Qovery";
     repo = "qovery-cli";
-    tag = "v${version}";
-    hash = "sha256-NxrhZmRbkQNj2K4b6Em4cAdssJRdwEKbdGy8EThN4JY=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-m6NdZ4K0FAZvTloworoK3Lluu9ySCGfS4L216ImByb8=";
   };
 
-  vendorHash = "sha256-GKW89qzyuvwCUvN0i+LgU36Vtr5XuvgXIxwnMlGSTFg=";
+  vendorHash = "sha256-9rAAeJVKBndb4w3LNJLLBvkX5me/Y3GnA55SYGOxqi4=";
+
+  env.CGO_ENABLED = 0;
+
+  ldflags = [ "-X github.com/qovery/qovery-cli/utils.Version=v${finalAttrs.version}" ];
 
   nativeBuildInputs = [ installShellFiles ];
 
   postInstall = lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
-    installShellCompletion --cmd ${pname} \
-      --bash <($out/bin/${pname} completion bash) \
-      --fish <($out/bin/${pname} completion fish) \
-      --zsh <($out/bin/${pname} completion zsh)
+    installShellCompletion --cmd qovery-cli \
+      --bash <($out/bin/qovery-cli completion bash) \
+      --fish <($out/bin/qovery-cli completion fish) \
+      --zsh <($out/bin/qovery-cli completion zsh)
   '';
 
-  passthru.tests.version = testers.testVersion {
-    package = qovery-cli;
-    command = "HOME=$(mktemp -d); ${pname} version";
-  };
+  # need network
+  doCheck = false;
+
+  doInstallCheck = true;
+
+  nativeInstallCheckInputs = [
+    versionCheckHook
+    writableTmpDirAsHomeHook
+  ];
+
+  versionCheckKeepEnvironment = [ "HOME" ];
+
+  versionCheckProgramArg = "version";
 
   meta = {
     description = "Qovery Command Line Interface";
     homepage = "https://github.com/Qovery/qovery-cli";
-    changelog = "https://github.com/Qovery/qovery-cli/releases/tag/v${version}";
+    changelog = "https://github.com/Qovery/qovery-cli/releases/tag/v${finalAttrs.version}";
     license = with lib.licenses; [ asl20 ];
     maintainers = with lib.maintainers; [ fab ];
     mainProgram = "qovery-cli";
   };
-}
+})

pkgs/by-name/re/retool/package.nix

@@ -8,7 +8,7 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "retool";
-  version = "2.4.3";
+  version = "2.4.4";
 
   pyproject = true;
   disabled = python3.pkgs.pythonOlder "3.10";
@@ -17,7 +17,7 @@ python3.pkgs.buildPythonApplication rec {
     owner = "unexpectedpanda";
     repo = "retool";
     tag = "v${version}";
-    hash = "sha256-uYzsHraA5LX+5wZWSAO7lOFhssd7LojftLP5pufgUcc=";
+    hash = "sha256-hWCMxWcjjFF5xg7WrF4wjwGneoQCEUp+4oe+CieElcQ=";
   };
 
   nativeBuildInputs = with python3.pkgs; [

pkgs/by-name/rk/rkrlv2/package.nix

@@ -13,21 +13,30 @@
   libsndfile,
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "rkrlv2";
   version = "beta_3";
 
   src = fetchFromGitHub {
     owner = "ssj71";
     repo = "rkrlv2";
-    rev = version;
-    sha256 = "WjpPNUEYw4aGrh57J+7kkxKFXgCJWNaWAmueFbNUJJo=";
+    tag = finalAttrs.version;
+    hash = "sha256-WjpPNUEYw4aGrh57J+7kkxKFXgCJWNaWAmueFbNUJJo=";
   };
 
+  postPatch = ''
+    substituteInPlace ./CMakeLists.txt lv2/CMakeLists.txt --replace-fail \
+      "cmake_minimum_required(VERSION 2.6)" \
+      "cmake_minimum_required(VERSION 4.0)"
+  '';
+
+  strictDeps = true;
+
   nativeBuildInputs = [
     cmake
     pkg-config
   ];
+
   buildInputs = [
     libXft
     libXpm
@@ -38,12 +47,12 @@ stdenv.mkDerivation rec {
     libsndfile
   ];
 
-  meta = with lib; {
+  meta = {
     description = "Rakarrak effects ported to LV2";
     homepage = "https://github.com/ssj71/rkrlv2";
-    license = licenses.gpl2Only;
-    maintainers = [ maintainers.joelmo ];
-    platforms = platforms.unix;
+    license = lib.licenses.gpl2Only;
+    maintainers = [ lib.maintainers.joelmo ];
+    platforms = lib.platforms.unix;
     broken = stdenv.hostPlatform.isAarch64; # g++: error: unrecognized command line option '-mfpmath=sse'
   };
-}
+})

pkgs/by-name/sd/sdrpp/cmake4.patch

@@ -0,0 +1,27 @@
+diff --git a/core/libcorrect/CMakeLists.txt b/core/libcorrect/CMakeLists.txt
+index 7fce281d..b709255f 100644
+--- a/core/libcorrect/CMakeLists.txt
++++ b/core/libcorrect/CMakeLists.txt
+@@ -1,4 +1,4 @@
+-cmake_minimum_required(VERSION 2.8)
++cmake_minimum_required(VERSION 3.13)
+ project(Correct C)
+ include(CheckLibraryExists)
+ include(CheckIncludeFiles)
+diff --git a/misc_modules/discord_integration/discord-rpc/CMakeLists.txt b/misc_modules/discord_integration/discord-rpc/CMakeLists.txt
+index 1dc1c913..e9924677 100644
+--- a/misc_modules/discord_integration/discord-rpc/CMakeLists.txt
++++ b/misc_modules/discord_integration/discord-rpc/CMakeLists.txt
+@@ -1,4 +1,4 @@
+-cmake_minimum_required (VERSION 3.2.0)
++cmake_minimum_required (VERSION 3.13)
+ project (DiscordRPC)
+ 
+ include(GNUInstallDirs)
+@@ -11,4 +11,4 @@ file(GLOB_RECURSE ALL_SOURCE_FILES
+ 
+ # add subdirs
+ 
+-add_subdirectory(src)
+\ No newline at end of file
++add_subdirectory(src)

pkgs/by-name/sd/sdrpp/package.nix

@@ -69,18 +69,26 @@ stdenv.mkDerivation rec {
   # SDR++ uses a rolling release model.
   # Choose a git hash from head and use the date from that commit as
   # version qualifier
-  git_hash = "27ab5bf3c194169ddf60ca312723fce96149cc8e";
-  git_date = "2024-01-22";
-  version = "1.1.0-unstable-" + git_date;
+  git_rev = "4658a1ade6707dee6f2ae09ba9eb71097223ea93";
+  git_hash = "sha256-UxYAcqOMPQYdUbL2636LpOGbCaxHjLiJhsH62s+0AZU=";
+  git_date = "2025-10-09";
+  version_number = "1.2.1";
+
+  version = "${version_number}-unstable-" + git_date;
 
   src = fetchFromGitHub {
     owner = "AlexandreRouma";
     repo = "SDRPlusPlus";
-    rev = git_hash;
-    hash = "sha256-R4xWeqdHEAaje37VQaGlg+L2iYIOH4tXMHvZkZq4SDU=";
+    rev = git_rev;
+    hash = git_hash;
   };
 
-  patches = [ ./runtime-prefix.patch ];
+  patches = [
+    ./runtime-prefix.patch
+    # CMake 4 dropped support of versions lower than 3.5,
+    # versions lower than 3.10 are deprecated.
+    ./cmake4.patch
+  ];
 
   postPatch = ''
     substituteInPlace CMakeLists.txt \
@@ -90,7 +98,7 @@ stdenv.mkDerivation rec {
       --replace "codec2.h" "codec2/codec2.h"
     # Since the __TIME_ and __DATE__ is canonicalized in the build,
     # use our qualified version shown in the programs window title.
-    substituteInPlace core/src/version.h --replace "1.1.0" "$version"
+    substituteInPlace core/src/version.h --replace-fail "${version_number}" "$version"
   '';
 
   nativeBuildInputs = [

pkgs/by-name/sp/spire/package.nix

@@ -6,7 +6,7 @@
 
 buildGoModule (finalAttrs: {
   pname = "spire";
-  version = "1.13.1";
+  version = "1.13.2";
 
   outputs = [
     "out"
@@ -18,7 +18,7 @@ buildGoModule (finalAttrs: {
     owner = "spiffe";
     repo = "spire";
     tag = "v${finalAttrs.version}";
-    sha256 = "sha256-1i2zT2oTJXMmISzUc4ixlZQjtjCcqUEi6RzgF9Zwm9s=";
+    sha256 = "sha256-iZMeD5ZwWKjY9mfuXgEgh+QLotmv28T8xBgpKoQTgxw=";
   };
 
   vendorHash = "sha256-tho3Qm9uHiiSNFmBZGZFgxhAKD4HKWsIUmiqkWlToQk=";
@@ -99,6 +99,7 @@ buildGoModule (finalAttrs: {
     maintainers = with lib.maintainers; [
       fkautz
       jk
+      mjm
     ];
   };
 })

pkgs/by-name/su/supersonic/package.nix

@@ -18,16 +18,16 @@
 
 buildGoModule rec {
   pname = "supersonic" + lib.optionalString waylandSupport "-wayland";
-  version = "0.18.1";
+  version = "0.19.0";
 
   src = fetchFromGitHub {
     owner = "dweymouth";
     repo = "supersonic";
     tag = "v${version}";
-    hash = "sha256-NzgmkxG58XvaxcIcu9J0VeRjCQ922rJOp3IWX49dgIU=";
+    hash = "sha256-GMmIUDgbFFrOqDJ13C0o1fHg1tiWSjbCm36VPD7/IGw=";
   };
 
-  vendorHash = "sha256-dG5D7a13TbVurjqFbKwiZ5IOPul39sCmyPCCzRx0NEY=";
+  vendorHash = "sha256-FQmaxDIVWCxyFdgz03aNRXFyi8UeMeCqiVHNZOqq/8Q=";
 
   nativeBuildInputs = [
     copyDesktopItems

pkgs/by-name/uu/uutils-coreutils/package.nix

@@ -21,19 +21,19 @@ assert selinuxSupport -> lib.meta.availableOn stdenv.hostPlatform libselinux;
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "uutils-coreutils";
-  version = "0.2.2";
+  version = "0.3.0";
 
   src = fetchFromGitHub {
     owner = "uutils";
     repo = "coreutils";
     tag = finalAttrs.version;
-    hash = "sha256-VcwdCi40Tm8J3t0qFSFGvRwW6B5cCDj1wm+H3i20axo=";
+    hash = "sha256-qvHNV3oy89CVR4LtrxFQJpev3yhHXy2Fh5PTik7Eo8g=";
   };
 
   cargoDeps = rustPlatform.fetchCargoVendor {
     inherit (finalAttrs) src;
     name = "uutils-coreutils-${finalAttrs.version}";
-    hash = "sha256-/QNOrfqdMviOVP1Fzorc6RAsgLDSKtg/MXfXJEzxwMc=";
+    hash = "sha256-yJHp8FCk7W6EDhO/MLrhui50RHW4GOwPQnQmfkdkWd8=";
   };
 
   patches = [

pkgs/by-name/uu/uutils-coreutils/selinux_no_auto_detect.diff

@@ -1,10 +1,10 @@
 diff --git a/GNUmakefile b/GNUmakefile
-index 20dc731d3..400e5b84f 100644
+index e4bc5f435..b677d119c 100644
 --- a/GNUmakefile
 +++ b/GNUmakefile
-@@ -69,19 +69,6 @@ TOYBOX_SRC  := $(TOYBOX_ROOT)/toybox-$(TOYBOX_VER)
- #------------------------------------------------------------------------
- OS ?= $(shell uname -s)
+@@ -76,19 +76,6 @@ ifeq ($(OS),Windows_NT)
+ endif
+ LN ?= ln -sf
  
 -ifdef SELINUX_ENABLED
 -	override SELINUX_ENABLED := 0
@@ -21,8 +21,8 @@ index 20dc731d3..400e5b84f 100644
 -
  # Possible programs
  PROGS       := \
- 	base32 \
-@@ -200,8 +187,10 @@ endif
+ 	arch \
+@@ -224,8 +211,10 @@ endif
  
  ifneq ($(OS),Windows_NT)
  	PROGS := $(PROGS) $(UNIX_PROGS)
@@ -31,6 +31,6 @@ index 20dc731d3..400e5b84f 100644
 -	PROGS := $(PROGS) $(SELINUX_PROGS)
 +		PROGS := $(PROGS) $(SELINUX_PROGS)
 +	endif
- # Always use external libstdbuf when building with make (Unix only)
- 	CARGOFLAGS += --features feat_external_libstdbuf
  endif
+ 
+ UTILS ?= $(filter-out $(SKIP_UTILS),$(PROGS))

pkgs/by-name/uv/uvcdynctrl/package.nix

@@ -39,6 +39,15 @@ stdenv.mkDerivation {
     done
   '';
 
+  postPatch = ''
+    substituteInPlace CMakeLists.txt \
+      --replace-fail "cmake_minimum_required (VERSION 2.6)" "cmake_minimum_required(VERSION 3.10)"
+    substituteInPlace libwebcam/CMakeLists.txt \
+      --replace-fail "cmake_minimum_required (VERSION 2.6)" "cmake_minimum_required(VERSION 3.10)"
+    substituteInPlace uvcdynctrl/CMakeLists.txt \
+      --replace-fail "cmake_minimum_required (VERSION 2.6)" "cmake_minimum_required(VERSION 3.10)"
+  '';
+
   doInstallCheck = true;
 
   meta = with lib; {

pkgs/by-name/vo/vobsub2srt/package.nix

@@ -28,6 +28,11 @@ stdenv.mkDerivation {
   buildInputs = [ libtiff ];
   propagatedBuildInputs = [ tesseract3 ];
 
+  postPatch = ''
+    substituteInPlace CMakeLists.txt \
+      --replace-fail "cmake_minimum_required(VERSION 2.6.4 FATAL_ERROR)" "cmake_minimum_required(VERSION 3.10)"
+  '';
+
   meta = {
     homepage = "https://github.com/ruediger/VobSub2SRT";
     description = "Converts VobSub subtitles into SRT subtitles";

pkgs/by-name/wa/warpgate/disable-rust-reproducible-build.patch

@@ -0,0 +1,14 @@
+diff --git a/.cargo/config.toml b/.cargo/config.toml
+index 8ab4225..8e0c812 100644
+--- a/.cargo/config.toml
++++ b/.cargo/config.toml
+@@ -1,8 +1,5 @@
+ # https://github.com/rust-lang/cargo/issues/5376#issuecomment-2163350032
+ [target.'cfg(all())']
+ rustflags = [
+-    "--cfg", "tokio_unstable",
+-    "-Zremap-cwd-prefix=/reproducible-cwd",
+-    "--remap-path-prefix=$HOME=/reproducible-home",
+-    "--remap-path-prefix=$PWD=/reproducible-pwd",
++    "--cfg", "tokio_unstable"
+ ]

pkgs/by-name/wa/warpgate/hardcode-version.patch

@@ -0,0 +1,14 @@
+diff --git a/warpgate-common/src/version.rs b/warpgate-common/src/version.rs
+index 07db547..2a7967f 100644
+--- a/warpgate-common/src/version.rs
++++ b/warpgate-common/src/version.rs
+@@ -1,8 +1,3 @@
+-use git_version::git_version;
+-
+ pub fn warpgate_version() -> &'static str {
+-    git_version!(
+-        args = ["--tags", "--always", "--dirty=-modified"],
+-        fallback = "unknown"
+-    )
++    "v@version@"
+ }

pkgs/by-name/wa/warpgate/package.nix

@@ -0,0 +1,78 @@
+{
+  lib,
+  replaceVars,
+  fetchurl,
+  fetchFromGitHub,
+  rustPlatform,
+  buildNpmPackage,
+  openapi-generator-cli,
+  nixosTests,
+}:
+rustPlatform.buildRustPackage (
+  finalAttrs:
+  let
+    warpgate-web = buildNpmPackage {
+      pname = "${finalAttrs.pname}-web";
+      version = finalAttrs.version;
+
+      src = finalAttrs.src;
+      sourceRoot = "${finalAttrs.src.name}/warpgate-web";
+
+      patches = [ ./web-ui-package-json.patch ];
+
+      npmDepsHash = "sha256-1zCxKAH2IAKSFdL8Pyd8dJi0i8Y5mgYcWNKVpiQszc0=";
+
+      nativeBuildInputs = [ openapi-generator-cli ];
+
+      preBuild = "rm node_modules/.bin/openapi-generator-cli";
+
+      installPhase = ''
+        runHook preInstall
+        cp -R dist $out
+        runHook postInstall
+      '';
+    };
+  in
+  {
+    pname = "warpgate";
+    version = "0.17.0";
+
+    src = fetchFromGitHub {
+      owner = "warp-tech";
+      repo = "warpgate";
+      tag = "v${finalAttrs.version}";
+      hash = "sha256-nr0z8c0o5u4Rqs9pFUaxnasRHUhwT3qQe5+JNV+LObg=";
+    };
+
+    cargoHash = "sha256-pIr5Z7rp+dYOuKYnlsBdya6MqAdL0U2gUhwXvLfmM34=";
+
+    patches = [
+      (replaceVars ./hardcode-version.patch { inherit (finalAttrs) version; })
+      ./disable-rust-reproducible-build.patch
+    ];
+
+    buildFeatures = [
+      "postgres"
+      "mysql"
+      "sqlite"
+    ];
+
+    preBuild = ''ln -rs "${warpgate-web}" warpgate-web/dist'';
+
+    # skip check, project included tests require python stuff and docker
+    doCheck = false;
+
+    passthru.tests = {
+      inherit (nixosTests) warpgate;
+    };
+
+    meta = {
+      description = "Smart SSH, HTTPS, MySQL and Postgres bastion that requires no additional client-side software";
+      homepage = "https://warpgate.null.page";
+      license = lib.licenses.asl20;
+      platforms = lib.platforms.linux;
+      mainProgram = "warpgate";
+      maintainers = with lib.maintainers; [ alemonmk ];
+    };
+  }
+)

pkgs/by-name/wa/warpgate/web-ui-package-json.patch

@@ -0,0 +1,15 @@
+diff --git a/package.json b/package.json
+index 54125c3..6942dfb 100644
+--- a/package.json
++++ b/package.json
+@@ -12,8 +12,8 @@
+     "postinstall": "npm run openapi:client:gateway && npm run openapi:client:admin",
+     "openapi:schema:gateway": "cargo run -p warpgate-protocol-http > src/gateway/lib/openapi-schema.json",
+     "openapi:schema:admin": "cargo run -p warpgate-admin > src/admin/lib/openapi-schema.json",
+-    "openapi:client:gateway": "openapi-generator-cli generate -g typescript-fetch -i src/gateway/lib/openapi-schema.json -o src/gateway/lib/api-client -p npmName=warpgate-gateway-api-client -p useSingleRequestParameter=true && cd src/gateway/lib/api-client && npm i typescript@5 && npm i && npx tsc --target esnext --module esnext && rm -rf src tsconfig.json",
+-    "openapi:client:admin": "openapi-generator-cli generate -g typescript-fetch -i src/admin/lib/openapi-schema.json -o src/admin/lib/api-client -p npmName=warpgate-admin-api-client -p useSingleRequestParameter=true && cd src/admin/lib/api-client && npm i typescript@5 && npm i && npx tsc --target esnext --module esnext && rm -rf src tsconfig.json",
++    "openapi:client:gateway": "openapi-generator-cli generate -g typescript-fetch -i src/gateway/lib/openapi-schema.json -o src/gateway/lib/api-client -p npmName=warpgate-gateway-api-client -p useSingleRequestParameter=true && ln -sr node_modules src/gateway/lib/api-client/node_modules && cd src/gateway/lib/api-client && npx tsc --target esnext --module esnext && rm -rf src tsconfig.json",
++    "openapi:client:admin": "openapi-generator-cli generate -g typescript-fetch -i src/admin/lib/openapi-schema.json -o src/admin/lib/api-client -p npmName=warpgate-admin-api-client -p useSingleRequestParameter=true && ln -sr node_modules src/admin/lib/api-client/node_modules && cd src/admin/lib/api-client && npx tsc --target esnext --module esnext && rm -rf src tsconfig.json",
+     "openapi:tests-sdk": "openapi-generator-cli generate -g python -i src/admin/lib/openapi-schema.json -o ../tests/api_sdk",
+     "openapi": "npm run openapi:schema:admin && npm run openapi:schema:gateway && npm run openapi:client:admin && npm run openapi:client:gateway"
+   },

pkgs/by-name/wa/waymore/package.nix

@@ -8,14 +8,14 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "waymore";
-  version = "6.4";
+  version = "6.5";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "xnl-h4ck3r";
     repo = "waymore";
     tag = "v${version}";
-    hash = "sha256-XIzUT9OYdtiBAdGYxeCSv89gxYqlvE7wAijt+WJqk2k=";
+    hash = "sha256-3nvdbQydtnk/tod2WyJLAGKKjwTv6Z6JA7+qwqgp2o4=";
   };
 
   preBuild = ''

pkgs/by-name/wp/wpsoffice-cn/package.nix

@@ -1,27 +1,29 @@
 {
   lib,
   stdenv,
-  dpkg,
   autoPatchelfHook,
+  runCommandLocal,
+  curl,
+  coreutils,
+  cacert,
+  # wpsoffice dependencies
   alsa-lib,
-  at-spi2-core,
+  libjpeg,
   libtool,
   libxkbcommon,
+  nss,
   nspr,
   udev,
   gtk3,
   libgbm,
   libusb1,
+  unixODBC,
+  libmysqlclient,
   libsForQt5,
   xorg,
+  # wpsoffice runtime dependencies
   cups,
   pango,
-  bzip2,
-  libmysqlclient,
-  runCommandLocal,
-  curl,
-  coreutils,
-  cacert,
 }:
 
 let
@@ -32,10 +34,9 @@ let
   fetch =
     {
       url,
-      uri,
       hash,
     }:
-    runCommandLocal "wpsoffice-cn-${version}-src"
+    runCommandLocal "wpsoffice-cn-${version}.deb"
       {
         outputHashAlgo = "sha256";
         outputHash = hash;
@@ -50,9 +51,10 @@ let
       }
       ''
         readonly SECURITY_KEY="7f8faaaa468174dc1c9cd62e5f218a5b"
+        prefix="https://wps-linux-personal.wpscdn.cn"
 
         timestamp10=$(date '+%s')
-        md5hash=($(printf '%s' "$SECURITY_KEY${uri}$timestamp10" | md5sum))
+        md5hash=($(printf '%s' "$SECURITY_KEY''${${url}#$prefix}$timestamp10" | md5sum))
 
         curl --retry 3 --retry-delay 3 "${url}?t=$timestamp10&k=$md5hash" > $out
       '';
@@ -68,24 +70,20 @@ in
 stdenv.mkDerivation {
   inherit pname src version;
 
-  unpackCmd = "dpkg -x $src .";
-  sourceRoot = ".";
-
-  nativeBuildInputs = [
-    dpkg
-    autoPatchelfHook
-  ];
+  nativeBuildInputs = [ autoPatchelfHook ];
 
   buildInputs = [
     alsa-lib
-    at-spi2-core
+    libjpeg
     libtool
     libxkbcommon
+    nss
     nspr
     udev
     gtk3
     libgbm
     libusb1
+    unixODBC
     libsForQt5.qtbase
     xorg.libXdamage
     xorg.libXtst
@@ -101,9 +99,17 @@ stdenv.mkDerivation {
     pango
   ];
 
-  autoPatchelfIgnoreMissingDeps = [
-    "libpeony.so.3"
-  ];
+  unpackPhase = ''
+    # Unpack the .deb file
+    ar x $src
+    tar -xf data.tar.xz
+
+    # Remove unneeded files
+    rm -rf usr/share/{fonts,locale}
+    rm -f usr/bin/misc
+    rm -rf opt/kingsoft/wps-office/{desktops,INSTALL}
+    rm -f opt/kingsoft/wps-office/office6/lib{peony-wpsprint-menu-plugin,bz2,jpeg,stdc++,gcc_s,odbc*,nss*,dbus-1}.so*
+  '';
 
   installPhase = ''
     runHook preInstall
@@ -127,8 +133,6 @@ stdenv.mkDerivation {
   '';
 
   preFixup = ''
-    # libbz2 dangling symlink
-    ln -sf ${bzip2.out}/lib/libbz2.so $out/opt/kingsoft/wps-office/office6/libbz2.so
     # dlopen dependency
     patchelf --add-needed libudev.so.1 $out/opt/kingsoft/wps-office/office6/addons/cef/libcef.so
     # libmysqlclient dependency
@@ -138,19 +142,20 @@ stdenv.mkDerivation {
 
   passthru.updateScript = ./update.sh;
 
-  meta = with lib; {
+  meta = {
     description = "Office suite, formerly Kingsoft Office";
-    homepage = "https://www.wps.com";
+    homepage = "https://www.wps.cn";
     platforms = [ "x86_64-linux" ];
-    sourceProvenance = with sourceTypes; [ binaryNativeCode ];
+    sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
     hydraPlatforms = [ ];
-    license = licenses.unfree;
-    maintainers = with maintainers; [
+    license = lib.licenses.unfree;
+    maintainers = with lib.maintainers; [
       mlatus
       th0rgal
       wineee
       pokon548
       chillcicada
     ];
+    mainProgram = "wps";
   };
 }

pkgs/by-name/wp/wpsoffice-cn/sources.nix

@@ -1,10 +1,9 @@
 # Generated by ./update.sh - do not update manually!
-# Last updated: 2025-09-15
+# Last updated: 2025-10-27
 {
   version = "12.1.2.22571";
   x86_64 = {
     url = "https://wps-linux-personal.wpscdn.cn/wps/download/ep/Linux2023/22571/wps-office_12.1.2.22571.AK.preread.sw_480057_amd64.deb";
-    uri = "/wps/download/ep/Linux2023/22571/wps-office_12.1.2.22571.AK.preread.sw_480057_amd64.deb";
     hash = "sha256-aB1EWP0Ev5WuAuzih3ybD23qaRRTUjlES1emas+sUDA=";
   };
 }

pkgs/by-name/wp/wpsoffice-cn/update.sh

@@ -13,12 +13,11 @@ payload=$(curl -s "https://www.wps.cn/product/wpslinux")
 version=$(echo "$payload" | grep -oP '(?<=banner_txt">)[^<]+')
 
 amd64_url=$(echo "$payload" | grep -oP "downLoad\('[^']*'" | head -1 | sed "s/downLoad('//;s/'$//")
-amd64_uri="${amd64_url#$prefix}"
 
 timestamp10=$(date '+%s')
-md5hash=($(printf '%s' "$SECURITY_KEY$amd64_uri$timestamp10" | md5sum))
+amd64_md5hash=($(printf '%s' "$SECURITY_KEY${amd64_url#$prefix}$timestamp10" | md5sum))
 
-amd64_hash=$(nix-prefetch-url --name "wpsoffice-cn-$version.deb" "$amd64_url?t=$timestamp10&k=$md5hash")
+amd64_hash=$(nix-prefetch-url --name "wpsoffice-cn-$version.deb" "$amd64_url?t=$timestamp10&k=$amd64_md5hash")
 
 amd64_hash=$(nix --extra-experimental-features nix-command hash convert --to sri --hash-algo sha256 "$amd64_hash")
 
@@ -29,7 +28,6 @@ cat > sources.nix << EOF
   version = "$version";
   x86_64 = {
     url = "$amd64_url";
-    uri = "$amd64_uri";
     hash = "$amd64_hash";
   };
 }

pkgs/development/compilers/openjdk/8/source.json

@@ -1,6 +1,6 @@
 {
-  "hash": "sha256-CQZKhDojo+a4vZsIzRM/KoUfR17LedQYBWCRJxDFJUM=",
+  "hash": "sha256-2TN7JG42h9tYJNUzL2OLsbCWdKjWcvRf/4L9jfVfRSQ=",
   "owner": "openjdk",
   "repo": "jdk8u",
-  "rev": "refs/tags/jdk8u462-b08"
+  "rev": "refs/tags/jdk8u472-b08"
 }

pkgs/development/python-modules/beangulp/default.nix

@@ -6,6 +6,7 @@
   chardet,
   click,
   fetchFromGitHub,
+  fetchpatch2,
   lxml,
   petl,
   python-magic,
@@ -25,6 +26,13 @@ buildPythonPackage rec {
     hash = "sha256-h7xLHwEyS+tOI7v6Erp12VfVnxOf4930++zghhC3in4=";
   };
 
+  patches = [
+    (fetchpatch2 {
+      url = "https://github.com/beancount/beangulp/commit/254bfb38ffed049ef8f3041bfaf01b3f5a8aa771.patch?full_index=1";
+      hash = "sha256-ojysT23K0xmFafzTnRZiHkLS2ioDR/tVK02mfF7N9so=";
+    })
+  ];
+
   build-system = [ setuptools ];
 
   dependencies = [

pkgs/development/python-modules/cyclonedx-python-lib/default.nix

@@ -11,7 +11,6 @@
   py-serializable,
   poetry-core,
   pytestCheckHook,
-  pythonOlder,
   requirements-parser,
   sortedcontainers,
   setuptools,
@@ -23,16 +22,14 @@
 
 buildPythonPackage rec {
   pname = "cyclonedx-python-lib";
-  version = "11.2.0";
+  version = "11.4.0";
   pyproject = true;
 
-  disabled = pythonOlder "3.9";
-
   src = fetchFromGitHub {
     owner = "CycloneDX";
     repo = "cyclonedx-python-lib";
     tag = "v${version}";
-    hash = "sha256-HfHZKOae83ASym1MSlVb0+aVWpyziDgQEQxLzWMM/MQ=";
+    hash = "sha256-fCumFp9ubzCtTrO0r/R/OF83cc0v4XX5K/2vfxQrT84=";
   };
 
   pythonRelaxDeps = [ "py-serializable" ];

pkgs/development/python-modules/dask-awkward/default.nix

@@ -88,5 +88,8 @@ buildPythonPackage rec {
     changelog = "https://github.com/dask-contrib/dask-awkward/releases/tag/${src.tag}";
     license = lib.licenses.bsd3;
     maintainers = with lib.maintainers; [ veprbl ];
+    # dask-awkward is incompatible with recent dask versions.
+    # See https://github.com/dask-contrib/dask-awkward/pull/582 for context.
+    broken = lib.versionAtLeast dask.version "2025.4.0";
   };
 }

pkgs/development/python-modules/django-mfa3/default.nix

@@ -12,14 +12,14 @@
 
 buildPythonPackage rec {
   pname = "django-mfa3";
-  version = "1.0.0";
+  version = "1.1.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "xi";
     repo = "django-mfa3";
     tag = version;
-    hash = "sha256-bgIzrSM8KP6uQHvn393NWYw9DODdHLMqKn6pgw3EG/w=";
+    hash = "sha256-J31NiqOysOS6FFDCaCiPAJUBvD0Xu99sIykLxfk0M3U=";
   };
 
   build-system = [ setuptools ];

pkgs/development/python-modules/google-cloud-bigtable/default.nix

@@ -25,13 +25,13 @@
 
 buildPythonPackage rec {
   pname = "google-cloud-bigtable";
-  version = "2.33.0";
+  version = "2.34.0";
 
   src = fetchFromGitHub {
     owner = "googleapis";
     repo = "python-bigtable";
     tag = "v${version}";
-    hash = "sha256-32+UMTfnSncDsSnN54MjRE4eL1PXsUdblnxe/rj5Pqc=";
+    hash = "sha256-KPibMigfBJ2sE/QVgTjr7901dzj+/hWbOYz92naUxMw=";
   };
 
   pyproject = true;

pkgs/development/python-modules/homematicip/default.nix

@@ -16,7 +16,7 @@
 
 buildPythonPackage rec {
   pname = "homematicip";
-  version = "2.3.0";
+  version = "2.3.1";
   pyproject = true;
 
   disabled = pythonOlder "3.12";
@@ -25,7 +25,7 @@ buildPythonPackage rec {
     owner = "hahn-th";
     repo = "homematicip-rest-api";
     tag = version;
-    hash = "sha256-yH9Yis6NyKD+mSjaff0S9J6UtoVceML06ny50/6aG/0=";
+    hash = "sha256-QDqBi2XbMdokUyRNJacDPa/VqESp4NCUHLByBuayd1g=";
   };
 
   build-system = [

pkgs/development/python-modules/pwdlib/default.nix

@@ -12,14 +12,14 @@
 
 buildPythonPackage rec {
   pname = "pwdlib";
-  version = "0.2.1";
+  version = "0.3.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "frankie567";
     repo = "pwdlib";
     tag = "v${version}";
-    hash = "sha256-aPrgn5zfKk72QslGzb0acCNnZ7m3lyIBjvu4yhfZhSQ=";
+    hash = "sha256-0ye/CYlDW73Y2HGKjSdk7LniVkQ6OznoO/qnypRCmBQ=";
   };
 
   build-system = [

pkgs/development/python-modules/pykdl/default.nix

@@ -2,7 +2,6 @@
   lib,
   stdenv,
   toPythonModule,
-  fetchpatch,
   cmake,
   pybind11,
   orocos-kdl,
@@ -17,15 +16,6 @@ toPythonModule (
 
     sourceRoot = "${orocos-kdl.src.name}/python_orocos_kdl";
 
-    patches = [
-      # Support system pybind11; the vendored copy doesn't support Python 3.11
-      (fetchpatch {
-        url = "https://github.com/orocos/orocos_kinematics_dynamics/commit/e25a13fc5820dbca6b23d10506407bca9bcdd25f.patch";
-        hash = "sha256-NGMVGEYsa7hVX+SgRZgeSm93BqxFR1uiyFvzyF5H0Y4=";
-        stripLen = 1;
-      })
-    ];
-
     # Fix hardcoded installation path
     postPatch = ''
       substituteInPlace CMakeLists.txt \

pkgs/development/python-modules/pylitterbot/default.nix

@@ -16,14 +16,14 @@
 
 buildPythonPackage rec {
   pname = "pylitterbot";
-  version = "2024.2.6";
+  version = "2024.2.7";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "natekspencer";
     repo = "pylitterbot";
     tag = "v${version}";
-    hash = "sha256-oQuEo0np+e+HfsQoWbv84BNpxNJQO3ZjocaCfllqkts=";
+    hash = "sha256-gBY9+cd0DKqzHKyB86NzfKkULjVXn3oBSHxyRhmMAno=";
   };
 
   pythonRelaxDeps = [ "deepdiff" ];

pkgs/development/python-modules/pythonqwt/default.nix

@@ -18,14 +18,14 @@
 
 buildPythonPackage rec {
   pname = "pythonqwt";
-  version = "0.14.6";
+  version = "0.15.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "PlotPyStack";
     repo = "PythonQwt";
     tag = "v${version}";
-    hash = "sha256-D7iZ/737x+f63clnH41S8DtmBXDMf01A04UBKsHTJwA=";
+    hash = "sha256-S67k5kfGqB6Ezr2XMlW3x/ya6MW6df2cFrGEqlsLOhk=";
   };
 
   build-system = [

pkgs/development/python-modules/ttn-client/default.nix

@@ -6,21 +6,18 @@
   hatchling,
   pytest-asyncio,
   pytestCheckHook,
-  pythonOlder,
 }:
 
 buildPythonPackage rec {
   pname = "ttn-client";
-  version = "1.2.1";
+  version = "1.2.2";
   pyproject = true;
 
-  disabled = pythonOlder "3.11";
-
   src = fetchFromGitHub {
     owner = "angelnu";
     repo = "thethingsnetwork_python_client";
     tag = "v${version}";
-    hash = "sha256-dWEXoqW4JyYeLFLS3J4CaRJ45wjdVf8wrtMGCKgBds8=";
+    hash = "sha256-B3AN0VqMhQoqqPjUf/JTWYdyVQVXt+QsBbqsooDsuDE=";
   };
 
   build-system = [ hatchling ];
@@ -42,7 +39,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "Module to fetch/receive and parse uplink messages from The Thinks Network";
     homepage = "https://github.com/angelnu/thethingsnetwork_python_client";
-    changelog = "https://github.com/angelnu/thethingsnetwork_python_client/releases/tag/v${version}";
+    changelog = "https://github.com/angelnu/thethingsnetwork_python_client/releases/tag/${src.tag}";
     license = licenses.mit;
     maintainers = with maintainers; [ fab ];
   };

pkgs/games/doom-ports/zandronum/add_gitinfo.patch

@@ -1,15 +0,0 @@
-diff -r 4178904d7698 src/gitinfo.h
---- /dev/null	Thu Jan 01 00:00:00 1970 +0000
-+++ b/src/gitinfo.h	Fri Dec 01 13:02:42 2023 -0300
-@@ -0,0 +1,11 @@
-+// 4178904d769879e6c2919fb647ee6dd2736399e9
-+//
-+// This file was automatically generated by the
-+// updaterevision tool. Do not edit by hand.
-+
-+#define GIT_DESCRIPTION "ZA_3.0.1-572-4178904d7698"
-+#define GIT_HASH "4178904d769879e6c2919fb647ee6dd2736399e9"
-+#define GIT_TIME "2021-12-11 16:35:55 -0500"
-+#define HG_REVISION_NUMBER 1639258555
-+#define HG_REVISION_HASH_STRING "4178904d7698"
-+#define HG_TIME "211211-2135"

pkgs/games/doom-ports/zandronum/default.nix

@@ -1,7 +1,7 @@
 {
   stdenv,
   lib,
-  fetchhg,
+  fetchFromGitLab,
   cmake,
   pkg-config,
   makeWrapper,
@@ -9,6 +9,7 @@
   soundfont-fluid,
   SDL_compat,
   libGL,
+  libopus,
   glew,
   bzip2,
   zlib,
@@ -29,25 +30,21 @@ let
   clientLibPath = lib.makeLibraryPath [ fluidsynth ];
 
 in
-stdenv.mkDerivation {
+stdenv.mkDerivation (finalAttrs: {
   pname = "zandronum${suffix}";
-  version = "3.1.0";
+  version = "3.2.1";
 
-  src = fetchhg {
-    # expired ssl certificate
-    url = "http://hg.osdn.net/view/zandronum/zandronum-stable";
-    rev = "4178904d7698";
-    hash = "sha256-5t36CoRPPjDKQE0DVSv2Qqpqko6JAXBI53tuAYiylHQ=";
+  src = fetchFromGitLab {
+    domain = "foss.heptapod.net";
+    owner = "zandronum";
+    repo = "zandronum-stable";
+    tag = "ZA_${finalAttrs.version}";
+    hash = "sha256-A5sfZMiCypBxAUOsoB8yuinZf7b9D7+HH9rpVs3esgA=";
   };
 
   # zandronum tries to download sqlite now when running cmake, don't let it
-  # it also needs the current mercurial revision info embedded in gitinfo.h
-  # otherwise, the client will fail to connect to servers because the
-  # protocol version doesn't match.
   patches = [
     ./zan_configure_impurity.patch
-    ./dont_update_gitinfo.patch
-    ./add_gitinfo.patch
   ];
 
   # I have no idea why would SDL and libjpeg be needed for the server part!
@@ -66,6 +63,7 @@ stdenv.mkDerivation {
     glew
     fmod
     fluidsynth
+    libopus
     gtk2
   ];
 
@@ -117,12 +115,12 @@ stdenv.mkDerivation {
     inherit fmod sqlite;
   };
 
-  meta = with lib; {
+  meta = {
     homepage = "https://zandronum.com/";
     description = "Multiplayer oriented port, based off Skulltag, for Doom and Doom II by id Software";
     mainProgram = "zandronum-server";
-    maintainers = with maintainers; [ lassulus ];
-    license = licenses.sleepycat;
-    platforms = platforms.linux;
+    maintainers = with lib.maintainers; [ lassulus ];
+    license = lib.licenses.sleepycat;
+    platforms = lib.platforms.linux;
   };
-}
+})

pkgs/games/doom-ports/zandronum/dont_update_gitinfo.patch

@@ -1,19 +0,0 @@
-diff -r 4178904d7698 src/CMakeLists.txt
---- a/src/CMakeLists.txt	Sat Dec 11 16:35:55 2021 -0500
-+++ b/src/CMakeLists.txt	Fri Dec 01 13:00:32 2023 -0300
-@@ -642,15 +642,6 @@
- 	add_definitions( -DBACKPATCH )
- endif( BACKPATCH )
- 
--# Update gitinfo.h
--
--get_target_property( UPDATEREVISION_EXE updaterevision LOCATION )
--
--add_custom_target( revision_check ALL
--	COMMAND ${UPDATEREVISION_EXE} src/gitinfo.h
--	WORKING_DIRECTORY ${CMAKE_SOURCE_DIR}
--	DEPENDS updaterevision )
--
- # Libraries ZDoom needs
- 
- message( STATUS "Fluid synth libs: ${FLUIDSYNTH_LIBRARIES}" )

pkgs/games/doom-ports/zandronum/zan_configure_impurity.patch

@@ -2,8 +2,6 @@ diff -r 4178904d7698 sqlite/CMakeLists.txt
 --- a/sqlite/CMakeLists.txt	Sat Dec 11 16:35:55 2021 -0500
 +++ b/sqlite/CMakeLists.txt	Fri Dec 01 12:57:55 2023 -0300
 @@ -1,65 +1,5 @@
- cmake_minimum_required( VERSION 2.4 )
- 
 -# [BB/EP] Download SQLite archive and extract the sources if necessary.
 -set( ZAN_SQLITE_VERSION 3360000 ) # SQL version 3.36.0
 -set( ZAN_SQLITE_YEAR 2021 )

pkgs/games/mudlet/default.nix

@@ -58,21 +58,21 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "mudlet";
-  version = "4.17.2";
+  version = "4.19.1";
 
   src = fetchFromGitHub {
     owner = "Mudlet";
     repo = "Mudlet";
     rev = "Mudlet-${version}";
     fetchSubmodules = true;
-    hash = "sha256-K75frptePKfHeGQNXaX4lKsLwO6Rs6AAka6hvP8MA+k=";
+    hash = "sha256-I4RRIfHw9kZwxMlc9pvdtwPpq9EvNJU69WpGgZ+0uiw=";
   };
 
   patches = [
     (fetchpatch {
-      name = "darwin-AppKit.patch";
-      url = "https://github.com/Mudlet/Mudlet/commit/68cdd404f81a6d16c80068c45fe0f10802f08d9e.patch";
-      hash = "sha256-74FtcjOR/lu9ohtcoup0+gUfCQRznO48zMmb97INhdY=";
+      name = "cmake4-fix.patch";
+      url = "https://github.com/Mudlet/Mudlet/commit/933f2551fe3084f0fad6d8b971c6176fe154d8d7.patch?full_index=1";
+      hash = "sha256-MElSRhTaT1a5r/Pz3e7MTrzq0krjdspgW0woAB2C8jc=";
     })
   ];
 
@@ -176,6 +176,7 @@ stdenv.mkDerivation rec {
       felixalbrigtsen
     ];
     platforms = platforms.linux ++ platforms.darwin;
+    broken = stdenv.hostPlatform.isDarwin;
     license = licenses.gpl2Plus;
     mainProgram = "mudlet";
   };

pkgs/servers/home-assistant/custom-components/fellow/package.nix

@@ -10,13 +10,13 @@
 buildHomeAssistantComponent {
   owner = "NewsGuyTor";
   domain = "fellow";
-  version = "0-unstable-2025-10-06";
+  version = "0-unstable-2025-10-21";
 
   src = fetchFromGitHub {
     owner = "NewsGuyTor";
     repo = "FellowAiden-HomeAssistant";
-    rev = "c0b724e2ac3174b99fcb7d05a9c63a3ac6ce03b4";
-    hash = "sha256-gK9lVFehqRWq7HQd+VPJB/iaIvLdHu51XxyfM14aY0s=";
+    rev = "c801347b9654dc469fa6b446a4e7fd88071d318e";
+    hash = "sha256-UZgNJGI3em5PluL5u7k0pEH8fGUYinoWSJjVAhuulSo=";
   };
 
   passthru.updateScript = unstableGitUpdater { };

pkgs/servers/sql/postgresql/ext/lantern.nix

@@ -21,6 +21,9 @@ postgresqlBuildExtension (finalAttrs: {
   };
 
   postPatch = ''
+    substituteInPlace lantern_hnsw/CMakeLists.txt \
+      --replace-fail "cmake_minimum_required(VERSION 3.3)" "cmake_minimum_required(VERSION 3.10)"
+
     patchShebangs --build lantern_hnsw/scripts/link_llvm_objects.sh
   '';
 

pkgs/tools/misc/kronometer/default.nix

@@ -1,6 +1,7 @@
 {
   mkDerivation,
   fetchurl,
+  fetchpatch,
   lib,
   extra-cmake-modules,
   kdoctools,
@@ -18,6 +19,13 @@ mkDerivation rec {
     sha256 = "sha256-dbnhom8PRo0Bay3DzS2P0xQSrJaMXD51UadQL3z6xHY=";
   };
 
+  patches = [
+    (fetchpatch {
+      url = "https://invent.kde.org/utilities/kronometer/-/commit/949f1dccd48f4a1e3068e24d241c5ce73fe2ab8f.patch";
+      hash = "sha256-zv9ty25vQXr3xB1S7QmXx3YIouOVUoMpdZ9gHBD1gMQ=";
+    })
+  ];
+
   meta = with lib; {
     homepage = "https://kde.org/applications/utilities/kronometer/";
     description = "Stopwatch application";

pkgs/tools/security/nitrokey-app/default.nix

@@ -38,6 +38,17 @@ stdenv.mkDerivation rec {
     cppcodec
   ];
 
+  # CMake 3.1 is deprecated and is no longer supported by CMake > 4
+  # https://github.com/NixOS/nixpkgs/issues/445447
+  postPatch = ''
+    substituteInPlace CMakeLists.txt --replace-fail \
+      "CMAKE_MINIMUM_REQUIRED(VERSION 3.1.0 FATAL_ERROR)" \
+      "cmake_minimum_required(VERSION 3.10  FATAL_ERROR)" \
+    --replace-fail \
+      "cmake_policy(SET CMP0043 OLD)" \
+      "cmake_policy(SET CMP0043 NEW)"
+  '';
+
   meta = with lib; {
     description = "Provides extra functionality for the Nitrokey Pro and Storage";
     mainProgram = "nitrokey-app";

pkgs/top-level/aliases.nix

@@ -467,7 +467,7 @@ mapAliases {
   ansible-later = throw "ansible-later has been discontinued. The author recommends switching to ansible-lint"; # Added 2025-08-24
   ansible_2_14 = throw "Ansible 2.14 goes end of life in 2024/05 and can't be supported throughout the 24.05 release cycle"; # Added 2024-04-11
   ansible_2_15 = throw "Ansible 2.15 goes end of life in 2024/11 and can't be supported throughout the 24.11 release cycle"; # Added 2024-11-08
-  antennas = throw "antennas has been removed as it only works with tvheadend, which nobody was willing to maintain and was stuck on an unmaintained version that required FFmpeg 4. Please see https://github.com/NixOS/nixpkgs/pull/332259 if you are interested in maintaining a newer version"; # Added 2024-08-21
+  antennas = throw "antennas has been removed as it only works with tvheadend, which nobody was willing to maintain and was stuck on an unmaintained version that required FFmpeg 4. If you are interested in maintaining a newer version, please see https://github.com/NixOS/nixpkgs/pull/332259"; # Added 2024-08-21
   antic = throw "'antic' has been removed as it has been merged into 'flint3'"; # Added 2025-03-28
   antimicroX = throw "'antimicroX' has been renamed to/replaced by 'antimicrox'"; # Converted to throw 2024-10-17
   antlr4_8 = throw "antlr4_8 has been removed. Consider using a more recent version of antlr4"; # Added 2025-10-20
@@ -1165,12 +1165,12 @@ mapAliases {
   grafana_reporter = grafana-reporter; # Added 2024-06-09
   grapefruit = throw "'grapefruit' was removed due to being blocked by Roblox, rendering the package useless"; # Added 2024-08-23
   graphite-kde-theme = throw "'graphite-kde-theme' has been removed, as it is only compatible with Plasma 5, which is EOL"; # Added 2025-08-20
-  graylog-3_3 = throw "graylog 3.x is EOL. Please consider downgrading nixpkgs if you need an upgrade from 3.x to latest series."; # Added 2023-10-09
-  graylog-4_0 = throw "graylog 4.x is EOL. Please consider downgrading nixpkgs if you need an upgrade from 4.x to latest series."; # Added 2023-10-09
-  graylog-4_3 = throw "graylog 4.x is EOL. Please consider downgrading nixpkgs if you need an upgrade from 4.x to latest series."; # Added 2023-10-09
-  graylog-5_0 = throw "graylog 5.0.x is EOL. Please consider downgrading nixpkgs if you need an upgrade from 5.0.x to latest series."; # Added 2024-02-15
-  graylog-5_1 = throw "graylog 5.1.x is EOL. Please consider downgrading nixpkgs if you need an upgrade from 5.1.x to latest series."; # Added 2024-10-16
-  graylog-5_2 = throw "graylog 5.2 is EOL. Please consider downgrading nixpkgs if you need an upgrade from 5.2 to latest series."; # Added 2025-03-21
+  graylog-3_3 = throw "graylog 3.x is EOL. If you need an upgrade from 3.x to latest series, please consider downgrading nixpkgs."; # Added 2023-10-09
+  graylog-4_0 = throw "graylog 4.x is EOL. If you need an upgrade from 4.x to latest series, please consider downgrading nixpkgs."; # Added 2023-10-09
+  graylog-4_3 = throw "graylog 4.x is EOL. If you need an upgrade from 4.x to latest series, please consider downgrading nixpkgs."; # Added 2023-10-09
+  graylog-5_0 = throw "graylog 5.0.x is EOL. If you need an upgrade from 5.0.x to latest series, please consider downgrading nixpkgs."; # Added 2024-02-15
+  graylog-5_1 = throw "graylog 5.1.x is EOL. If you need an upgrade from 5.1.x to latest series, please consider downgrading nixpkgs."; # Added 2024-10-16
+  graylog-5_2 = throw "graylog 5.2.x is EOL. If you need an upgrade from 5.2.x to latest series, please consider downgrading nixpkgs."; # Added 2025-03-21
   green-pdfviewer = throw "'green-pdfviewer' has been removed due to lack of maintenance upstream."; # Added 2024-12-04
   gringo = clingo; # added 2022-11-27
   grub2_full = grub2; # Added 2022-11-18
@@ -1796,29 +1796,6 @@ mapAliases {
   neochat = makePlasma5Throw "neochat"; # added 2022-05-10
   neocities-cli = neocities; # Added 2024-07-31
   neocomp = throw "neocomp has been remove because it fails to build and was unmaintained upstream"; # Added 2025-04-28
-  nerdfonts =
-    throw
-      "
-    nerdfonts has been separated into individual font packages under the namespace nerd-fonts.
-    For example change:
-      fonts.packages = [
-        ...
-        (pkgs.nerdfonts.override { fonts = [ "
-      0
-      xproto
-      " "
-      DroidSansMono
-      " ]; })
-      ]
-    to
-      fonts.packages = [
-        ...
-        pkgs.nerd-fonts._0xproto
-        pkgs.nerd-fonts.droid-sans-mono
-      ]
-    or for all fonts
-      fonts.packages = [ ... ] ++ builtins.filter lib.attrsets.isDerivation (builtins.attrValues pkgs.nerd-fonts)
-  "; # Added 2024-11-09
   netbox_3_3 = throw "netbox 3.3 series has been removed as it was EOL"; # Added 2023-09-02
   netbox_3_5 = throw "netbox 3.5 series has been removed as it was EOL"; # Added 2024-01-22
   netbox_3_7 = throw "netbox 3.7 series has been removed as it was EOL"; # Added 2025-04-23
@@ -1899,11 +1876,11 @@ mapAliases {
   nodejs-slim_18 = nodejs_18; # Added 2025-04-23
   nodejs_18 = throw "Node.js 18.x has reached End-Of-Life and has been removed"; # Added 2025-04-23
   nomacs-qt6 = nomacs; # Added 2025-08-30
-  nomad_1_4 = throw "nomad_1_4 is no longer supported upstream. You can switch to using a newer version of the nomad package, or revert to older nixpkgs if you cannot upgrade"; # Added 2025-02-02
-  nomad_1_5 = throw "nomad_1_5 is no longer supported upstream. You can switch to using a newer version of the nomad package, or revert to older nixpkgs if you cannot upgrade"; # Added 2025-02-02
-  nomad_1_6 = throw "nomad_1_6 is no longer supported upstream. You can switch to using a newer version of the nomad package, or revert to older nixpkgs if you cannot upgrade"; # Added 2025-02-02
-  nomad_1_7 = throw "nomad_1_7 is no longer supported upstream. You can switch to using a newer version of the nomad package, or revert to older nixpkgs if you cannot upgrade"; # Added 2025-03-27
-  nomad_1_8 = throw "nomad_1_8 is no longer supported upstream. You can switch to using a newer version of the nomad package, or revert to older nixpkgs if you cannot upgrade"; # Added 2025-03-27
+  nomad_1_4 = throw "nomad_1_4 is no longer supported upstream. You can switch to using a newer version of the nomad package. If you cannot upgrade, you can revert to older nixpkgs."; # Added 2025-02-02
+  nomad_1_5 = throw "nomad_1_5 is no longer supported upstream. You can switch to using a newer version of the nomad package. If you cannot upgrade, you can revert to older nixpkgs."; # Added 2025-02-02
+  nomad_1_6 = throw "nomad_1_6 is no longer supported upstream. You can switch to using a newer version of the nomad package. If you cannot upgrade, you can revert to older nixpkgs."; # Added 2025-02-02
+  nomad_1_7 = throw "nomad_1_7 is no longer supported upstream. You can switch to using a newer version of the nomad package. If you cannot upgrade, you can revert to older nixpkgs."; # Added 2025-03-27
+  nomad_1_8 = throw "nomad_1_8 is no longer supported upstream. You can switch to using a newer version of the nomad package. If you cannot upgrade, you can revert to older nixpkgs."; # Added 2025-03-27
   norouter = throw "norouter has been removed because it has been marked as broken since at least November 2024."; # Added 2025-09-29
   notes-up = throw "'notes-up' has been removed as it was unmaintained and depends on deprecated webkitgtk_4_0"; # Added 2025-10-09
   notify-sharp = throw "'notify-sharp' has been removed as it was unmaintained and depends on deprecated dbus-sharp versions"; # Added 2025-08-25
@@ -1995,8 +1972,8 @@ mapAliases {
   OSCAR = oscar; # Added 2024-06-12
   osm2xmap = throw "osm2xmap has been removed, as it is unmaintained upstream and depended on old dependencies with broken builds"; # Added 2025-09-16
   osxfuse = throw "'osxfuse' has been renamed to/replaced by 'macfuse-stubs'"; # Converted to throw 2024-10-17
-  overrideLibcxx = "overrideLibcxx has beeen removed, as it was no longer used and Darwin now uses libc++ from the latest SDK; see the Nixpkgs 25.11 release notes for details"; # Added 2025-09-15
-  overrideSDK = "overrideSDK has been removed as it was a legacy compatibility stub. See <https://nixos.org/manual/nixpkgs/stable/#sec-darwin-legacy-frameworks-overrides> for migration instructions"; # Added 2025-08-04
+  overrideLibcxx = throw "overrideLibcxx has been removed, as it was no longer used and Darwin now uses libc++ from the latest SDK; see the Nixpkgs 25.11 release notes for details"; # Added 2025-09-15
+  overrideSDK = throw "overrideSDK has been removed as it was a legacy compatibility stub. See <https://nixos.org/manual/nixpkgs/stable/#sec-darwin-legacy-frameworks-overrides> for migration instructions"; # Added 2025-08-04
   ovn-lts = throw "ovn-lts has been removed. Please use the latest version available under ovn"; # Added 2024-08-24
   oxygen-icons5 = throw "
     The top-level oxygen-icons5 alias has been removed.
@@ -2480,7 +2457,7 @@ mapAliases {
   symbiyosys = sby; # Added 2024-08-18
   syn2mas = throw "'syn2mas' has been removed. It has been integrated into the main matrix-authentication-service CLI as a subcommand: 'mas-cli syn2mas'."; # Added 2025-07-07
   sync = taler-sync; # Added 2024-09-04
-  syncall = "'syncall' has been removed because it has been marked as broken since at least November 2024."; # Added 2025-10-01
+  syncall = throw "'syncall' has been removed because it has been marked as broken since at least November 2024."; # Added 2025-10-01
   syncthing-cli = throw "'syncthing-cli' has been renamed to/replaced by 'syncthing'"; # Converted to throw 2024-10-17
   syncthing-tray = throw "syncthing-tray has been removed because it is broken and unmaintained"; # Added 2025-05-18
   syncthingtray-qt6 = syncthingtray; # Added 2024-03-06
@@ -2605,7 +2582,7 @@ mapAliases {
   tumpa = throw "tumpa has been removed, as it is broken"; # Added 2024-07-15
   turbogit = throw "turbogit has been removed as it is unmaintained upstream and depends on an insecure version of libgit2"; # Added 2024-08-25
   tvbrowser-bin = tvbrowser; # Added 2023-03-02
-  tvheadend = throw "tvheadend has been removed as it nobody was willing to maintain it and it was stuck on an unmaintained version that required FFmpeg 4. Please see https://github.com/NixOS/nixpkgs/pull/332259 if you are interested in maintaining a newer version"; # Added 2024-08-21
+  tvheadend = throw "tvheadend has been removed as it nobody was willing to maintain it and it was stuck on an unmaintained version that required FFmpeg 4. If you are interested in maintaining a newer version, please see https://github.com/NixOS/nixpkgs/pull/332259."; # Added 2024-08-21
   typst-fmt = typstfmt; # Added 2023-07-15
   typst-lsp = throw "'typst-lsp' has been removed due to lack of upstream maintenance, consider using 'tinymist' instead"; # Added 2025-01-25
   typst-preview = throw "The features of 'typst-preview' have been consolidated to 'tinymist', an all-in-one language server for typst"; # Added 2024-07-07

pkgs/top-level/all-packages.nix

@@ -8342,7 +8342,10 @@ with pkgs;
         # More recent versions of abseil seem to be missing absl::if_constexpr
         abseil-cpp = abseil-cpp_202407;
       };
-      protobuf_27 = callPackage ../development/libraries/protobuf/27.nix { };
+      protobuf_27 = callPackage ../development/libraries/protobuf/27.nix {
+        # More recent versions of abseil seem to be missing absl::if_constexpr
+        abseil-cpp = abseil-cpp_202407;
+      };
       protobuf_25 = callPackage ../development/libraries/protobuf/25.nix { };
       protobuf_21 = callPackage ../development/libraries/protobuf/21.nix {
         abseil-cpp = abseil-cpp_202103;