Merge master into staging-next

pkgs/applications/editors/vscode/extensions/google.colab/default.nix

@@ -7,8 +7,8 @@ vscode-utils.buildVscodeMarketplaceExtension {
   mktplcRef = {
     publisher = "google";
     name = "colab";
-    version = "0.1.3";
-    hash = "sha256-aK2Bfis9eTyNTaFldnjV9P0TK/G0gRBFRp9QvlajS5Y=";
+    version = "0.1.4";
+    hash = "sha256-15n8e7KHMHU16oScivd6aY8v5vnzlH+4ME9Z6qt3AHw=";
   };
 
   meta = {

pkgs/applications/video/mpv/scripts/mpv-playlistmanager.nix

@@ -8,13 +8,13 @@
 
 buildLua {
   pname = "mpv-playlistmanager";
-  version = "0-unstable-2025-09-03";
+  version = "0-unstable-2025-12-17";
 
   src = fetchFromGitHub {
     owner = "jonniek";
     repo = "mpv-playlistmanager";
-    rev = "b11621e1dc4afd24b41b887aff0748146176c4c1";
-    hash = "sha256-0+ISjWb8aGdRjsFOPURBZzTmJ4X8ayzYfnxYICDmizA=";
+    rev = "75caa611c9dab164e74a04a62abfbf508e51d71e";
+    hash = "sha256-wSyxcR+qIWozbDjrZT+B6SgFaigSWofExdsZ2fF7/uY=";
   };
   passthru.updateScript = unstableGitUpdater { };
 

pkgs/by-name/ei/eigenwallet/package.nix

@@ -12,11 +12,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "eigenwallet";
-  version = "3.5.1";
+  version = "3.6.1";
 
   src = fetchurl {
     url = "https://github.com/eigenwallet/core/releases/download/${finalAttrs.version}/eigenwallet_${finalAttrs.version}_amd64.deb";
-    hash = "sha256-+0eZWEqVkJW54ADTC2Ay6cGHqcqRBpxOYJkN5Unil0A=";
+    hash = "sha256-L0JNKbirnZSVNNhEzSpwq5JstfpSGSo5E83zmxoOuXU=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/fa/faustPhysicalModeling/package.nix

@@ -8,13 +8,13 @@
 }:
 stdenv.mkDerivation rec {
   pname = "faustPhysicalModeling";
-  version = "2.79.3";
+  version = "2.83.1";
 
   src = fetchFromGitHub {
     owner = "grame-cncm";
     repo = "faust";
     rev = version;
-    sha256 = "sha256-j5ADlKZriwLARpEJ/4xgvyAhF5ld9Hl2gXZS3NPJJj8=";
+    sha256 = "sha256-c1I5ha9QvnC7jKdycAhW/iAzUcEA7NopXAquIS001Y8=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/ge/gemini-cli/package.nix

@@ -8,6 +8,7 @@
   clang_20,
   libsecret,
   ripgrep,
+  nodejs,
   nix-update-script,
 }:
 
@@ -59,14 +60,18 @@ buildNpmPackage (finalAttrs: {
       --replace-fail "settings.merged.general?.disableUpdateNag" "(settings.merged.general?.disableUpdateNag ?? true)"
   '';
 
-  # Prevent npmDeps from getting into the closure
-  disallowedReferences = [ finalAttrs.npmDeps ];
+  # Prevent npmDeps and python from getting into the closure
+  disallowedReferences = [
+    finalAttrs.npmDeps
+    nodejs.python
+  ];
 
   installPhase = ''
     runHook preInstall
     mkdir -p $out/{bin,share/gemini-cli}
 
     npm prune --omit=dev
+    rm node_modules/shell-quote/print.py # remove python demo to prevent python from getting into the closure
     cp -r node_modules $out/share/gemini-cli/
 
     rm -f $out/share/gemini-cli/node_modules/@google/gemini-cli

pkgs/by-name/ho/homebank/package.nix

@@ -13,10 +13,10 @@
 
 stdenv.mkDerivation rec {
   pname = "homebank";
-  version = "5.9.5";
+  version = "5.9.6";
   src = fetchurl {
     url = "https://www.gethomebank.org/public/sources/homebank-${version}.tar.gz";
-    hash = "sha256-/2yLD22kERM+KbhI6R9I/biN5ArQLLogqIQJMKPn7UM=";
+    hash = "sha256-8DIL/gTysY/e1DcuuJ5qY6vXUBY4uUWNoSzUaCQ+t3o=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/ma/mas/package.nix

@@ -2,6 +2,7 @@
   lib,
   stdenvNoCC,
   fetchurl,
+  installShellFiles,
   libarchive,
   p7zip,
   testers,
@@ -10,14 +11,30 @@
 
 stdenvNoCC.mkDerivation rec {
   pname = "mas";
-  version = "2.2.2";
+  version = "4.1.0";
 
-  src = fetchurl {
-    url = "https://github.com/mas-cli/mas/releases/download/v${version}/mas-${version}.pkg";
-    hash = "sha256-v+tiD5ZMVFzeShyuOt8Ss3yw6p8VjopHaMimOQznL6o=";
-  };
+  src =
+    let
+      sources =
+        {
+          x86_64-darwin = {
+            arch = "x86_64";
+            hash = "sha256-9GkAV2gitqtZ7Ew/QVXDj3tDTbh5uwBxPtYdLSnucZE=";
+          };
+          aarch64-darwin = {
+            arch = "arm64";
+            hash = "sha256-8zaZOPOCyLHOFmHhviJXIy5SB5trqQM/MFHhB9ygilQ=";
+          };
+        }
+        .${stdenvNoCC.hostPlatform.system};
+    in
+    fetchurl {
+      url = "https://github.com/mas-cli/mas/releases/download/v${version}/mas-${version}-${sources.arch}.pkg";
+      inherit (sources) hash;
+    };
 
   nativeBuildInputs = [
+    installShellFiles
     libarchive
     p7zip
   ];
@@ -36,8 +53,11 @@ stdenvNoCC.mkDerivation rec {
   installPhase = ''
     runHook preInstall
 
-    mkdir -p $out/bin
-    cp mas $out/bin
+    install -Dm755 usr/local/opt/mas/bin/mas $out/bin/mas
+
+    installManPage usr/local/opt/mas/share/man/man1/mas.1
+    installShellCompletion --bash usr/local/opt/mas/etc/bash_completion.d/mas
+    installShellCompletion --fish usr/local/opt/mas/share/fish/vendor_completions.d/mas.fish
 
     runHook postInstall
   '';

pkgs/by-name/ma/matrix-conduit/fix_validate_event_fields_for_invites_over_federation.patch

@@ -0,0 +1,91 @@
+From a0f57159572c81c8ae6f9c9440e5cd74315b8570 Mon Sep 17 00:00:00 2001
+From: Jason Volk <jason@zemos.net>
+Date: Sun, 21 Dec 2025 22:04:07 +0000
+Subject: [PATCH] fix: validate event fields for invites over federation.
+
+---
+ src/api/server_server.rs | 61 ++++++++++++++++++++++++++++++++++++++++
+ 1 file changed, 61 insertions(+)
+
+diff --git a/src/api/server_server.rs b/src/api/server_server.rs
+index adc764ff..d29f6031 100644
+--- a/src/api/server_server.rs
++++ b/src/api/server_server.rs
+@@ -2132,6 +2132,44 @@ pub async fn create_invite_route(
+         CanonicalJsonValue::String(event_id.to_string()),
+     );
+ 
++    let event_room_id: OwnedRoomId = serde_json::from_value(
++        signed_event
++            .get("room_id")
++            .ok_or(Error::BadRequest(
++                ErrorKind::InvalidParam,
++                "Event had no room_id field.",
++            ))?
++            .clone()
++            .into(),
++    )
++    .map_err(|_| Error::BadRequest(ErrorKind::InvalidParam, "room_id is not a room id."))?;
++
++    if room_id != event_room_id {
++        return Err(Error::BadRequest(
++            ErrorKind::InvalidParam,
++            "room_id parameter does not match event.",
++        ));
++    }
++
++    let event_type: StateEventType = serde_json::from_value(
++        signed_event
++            .get("type")
++            .ok_or(Error::BadRequest(
++                ErrorKind::InvalidParam,
++                "Event had no type field.",
++            ))?
++            .clone()
++            .into(),
++    )
++    .map_err(|_| Error::BadRequest(ErrorKind::InvalidParam, "type is not an event type."))?;
++
++    if event_type != StateEventType::RoomMember {
++        return Err(Error::BadRequest(
++            ErrorKind::InvalidParam,
++            "Invite event was not m.room.member type.",
++        ));
++    }
++
+     let sender: OwnedUserId = serde_json::from_value(
+         signed_event
+             .get("sender")
+@@ -2144,6 +2182,29 @@ pub async fn create_invite_route(
+     )
+     .map_err(|_| Error::BadRequest(ErrorKind::InvalidParam, "sender is not a user id."))?;
+ 
++    if sender.server_name() != sender_servername {
++        return Err(Error::BadRequest(
++            ErrorKind::InvalidParam,
++            "Invite sender must match the origin server.",
++        ));
++    }
++
++    let event_content: RoomMemberEventContent = serde_json::from_value(
++        signed_event
++            .get("content")
++            .ok_or_else(|| Error::BadRequest(ErrorKind::InvalidParam, "Missing event content."))?
++            .clone()
++            .into(),
++    )
++    .map_err(|_| Error::BadRequest(ErrorKind::InvalidParam, "Invalid event content."))?;
++
++    if event_content.membership != MembershipState::Invite {
++        return Err(Error::BadRequest(
++            ErrorKind::InvalidParam,
++            "Membership of invite event must be invite.",
++        ));
++    }
++
+     let invited_user: Box<_> = serde_json::from_value(
+         signed_event
+             .get("state_key")
+-- 
+GitLab
+

pkgs/by-name/ma/matrix-conduit/package.nix

@@ -21,6 +21,11 @@ rustPlatform.buildRustPackage (finalAttrs: {
     hash = "sha256-rJyuR8Ie/JiNKNjQL21+Q1PWliEAm+lwGraGeDxEHyY=";
   };
 
+  patches = [
+    # https://gitlab.com/famedly/conduit/-/merge_requests/784
+    ./fix_validate_event_fields_for_invites_over_federation.patch
+  ];
+
   cargoHash = "sha256-4ZA+3f8Kt+1JAm9KXnMRxAF+X9z8HSJoJe6Ny63SlnA=";
 
   # Conduit enables rusqlite's bundled feature by default, but we'd rather use our copy of SQLite.

pkgs/by-name/op/open-webui/package.nix

@@ -9,13 +9,13 @@
 }:
 let
   pname = "open-webui";
-  version = "0.6.42";
+  version = "0.6.43";
 
   src = fetchFromGitHub {
     owner = "open-webui";
     repo = "open-webui";
     tag = "v${version}";
-    hash = "sha256-nUrGF0IcIsU9JLyuyhzNldx948t7sNWWB6cIlBFxX8c=";
+    hash = "sha256-gkCG2SIYCF89IFi6neslvZNFyoC6PrMM2Vda/a3mc0k=";
   };
 
   frontend = buildNpmPackage rec {
@@ -32,7 +32,7 @@ let
       url = "https://github.com/pyodide/pyodide/releases/download/${pyodideVersion}/pyodide-${pyodideVersion}.tar.bz2";
     };
 
-    npmDepsHash = "sha256-BKQmeMV0NAgWgx9c+wL6GyrJb8agtmInlQidfzlEZZM=";
+    npmDepsHash = "sha256-bw0f6jlA09s7Ptd8+q8RHRFZgnyE+ecsfY30XdKlyRM=";
 
     # See https://github.com/open-webui/open-webui/issues/15880
     npmFlags = [
@@ -131,6 +131,7 @@ python3Packages.buildPythonApplication rec {
       langchain
       langchain-classic
       langchain-community
+      langchain-text-splitters
       langdetect
       ldap3
       loguru

pkgs/by-name/op/opencode/package.nix

@@ -13,12 +13,12 @@
 }:
 let
   pname = "opencode";
-  version = "1.0.180";
+  version = "1.0.184";
   src = fetchFromGitHub {
     owner = "sst";
     repo = "opencode";
     tag = "v${version}";
-    hash = "sha256-Jwniz/mxMrzR6FL5fL3JRG1mkMP57wxpdtPBpSFxNfY=";
+    hash = "sha256-qEVFORKMoaLTsBbs2D9aLaD1W4vbQppJ6fB+bHWLcgM=";
   };
 
   node_modules = stdenvNoCC.mkDerivation {

pkgs/by-name/ph/photoprism/package.nix

@@ -84,10 +84,14 @@ stdenv.mkDerivation (finalAttrs: {
 
     # install frontend
     ln -s ${frontend}/assets/* ${assets_path}
+    rm ${assets_path}/models
+    mkdir -p ${assets_path}/models
+    ln -s ${frontend}/assets/models/* ${assets_path}/models/
+
     # install tensorflow models
-    ln -s ${nasnet}/nasnet ${assets_path}
-    ln -s ${nsfw}/nsfw ${assets_path}
-    ln -s ${facenet}/facenet ${assets_path}
+    ln -s ${nasnet}/nasnet ${assets_path}/models/
+    ln -s ${nsfw}/nsfw ${assets_path}/models/
+    ln -s ${facenet}/facenet ${assets_path}/models/
 
     runHook postInstall
   '';

pkgs/by-name/vi/vintagestory/package.nix

@@ -25,7 +25,7 @@ stdenv.mkDerivation rec {
 
   src = fetchurl {
     url = "https://cdn.vintagestory.at/gamefiles/stable/vs_client_linux-x64_${version}.tar.gz";
-    hash = "sha256-i1IsxT+pjkKbJjHwnMcyb12nxe21mwvnoRGHMabMETY=";
+    hash = "sha256-LkiL/8W9MKpmJxtK+s5JvqhOza0BLap1SsaDvbLYR0c=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/wa/waffle/package.nix

@@ -29,7 +29,7 @@ stdenv.mkDerivation rec {
 
   src = fetchFromGitLab {
     domain = "gitlab.freedesktop.org";
-    owner = "libgbm";
+    owner = "Mesa";
     repo = "waffle";
     rev = "v${version}";
     sha256 = "sha256-Y7GRYLqSO572qA1eZ3jS8QlZ1X9xKpDtScaySTuPK/U=";

pkgs/tools/admin/meshcentral/default.nix

@@ -41,6 +41,8 @@ yarn2nix-moretea.mkYarnPackage {
     ln -s $out/libexec/meshcentral/deps/meshcentral/meshcentral.js $out/bin/meshcentral
   '';
 
+  doDist = false;
+
   publishBinsFor = [ ];
 
   passthru.updateScript = ./update.sh;