Merge d1537033b5 into haskell-updates

doc/release-notes/rl-2511.section.md

@@ -121,6 +121,8 @@
 
 - `go-mockery` has been updated to v3. For migration instructions see the [upstream documentation](https://vektra.github.io/mockery/latest/v3/). If v2 is still required `go-mockery_v2` has been added but will be removed on or before 2029-12-31 in-line with its [upstream support lifecycle](https://vektra.github.io/mockery/)
 
+- `prometheus-script-exporter` has been updated to use a new maintained alternative. This release updates from `1.2.0 -> 3.0.1` and largely changes configuration options formats from json to yaml, among other changes.
+
 - [private-gpt](https://github.com/zylon-ai/private-gpt) service has been removed by lack of maintenance upstream.
 
 - `lxde` scope has been removed, and its packages have been moved the top-level.

doc/using/overlays.chapter.md

@@ -42,24 +42,24 @@ Because overlays that are set in NixOS configuration do not affect non-NixOS ope
 
 ## Defining overlays {#sec-overlays-definition}
 
-Overlays are Nix functions which accept two arguments, conventionally called `self` and `super`, and return a set of packages. For example, the following is a valid overlay.
+Overlays are Nix functions which accept two arguments, conventionally called either `final` and `prev` in newer code or `self` and `super` in older code, and return a set of packages. For example, the following is a valid overlay.
 
 ```nix
-self: super:
+final: prev:
 
 {
-  boost = super.boost.override { python = self.python3; };
-  rr = super.callPackage ./pkgs/rr { stdenv = self.stdenv_32bit; };
+  boost = prev.boost.override { python = final.python3; };
+  rr = prev.callPackage ./pkgs/rr { stdenv = final.stdenv_32bit; };
 }
 ```
 
-The first argument (`self`) corresponds to the final package set. You should use this set for the dependencies of all packages specified in your overlay. For example, all the dependencies of `rr` in the example above come from `self`, as well as the overridden dependencies used in the `boost` override.
+The first argument (`final`, `self`) corresponds to the final package set. You should use this set for the dependencies of all packages specified in your overlay. For example, all the dependencies of `rr` in the example above come from `final`, as well as the overridden dependencies used in the `boost` override.
 
-The second argument (`super`) corresponds to the result of the evaluation of the previous stages of Nixpkgs. It does not contain any of the packages added by the current overlay, nor any of the following overlays. This set should be used either to refer to packages you wish to override, or to access functions defined in Nixpkgs. For example, the original recipe of `boost` in the above example, comes from `super`, as well as the `callPackage` function.
+The second argument (`prev`, `super`) corresponds to the result of the evaluation of the previous stages of Nixpkgs. It does not contain any of the packages added by the current overlay, nor any of the following overlays. This set should be used either to refer to packages you wish to override, or to access functions defined in Nixpkgs. For example, the original recipe of `boost` in the above example, comes from `prev`, as well as the `callPackage` function.
 
 The value returned by this function should be a set similar to `pkgs/top-level/all-packages.nix`, containing overridden and/or new packages.
 
-Overlays are similar to other methods for customizing Nixpkgs, in particular the `packageOverrides` attribute described in [](#sec-modify-via-packageOverrides). Indeed, `packageOverrides` acts as an overlay with only the `super` argument. It is therefore appropriate for basic use, but overlays are more powerful and easier to distribute.
+Overlays are similar to other methods for customizing Nixpkgs, in particular the `packageOverrides` attribute described in [](#sec-modify-via-packageOverrides). Indeed, `packageOverrides` acts as an overlay with only the `prev` argument. It is therefore appropriate for basic use, but overlays are more powerful and easier to distribute.
 
 ## Using overlays to configure alternatives {#sec-overlays-alternatives}
 
@@ -92,12 +92,12 @@ In Nixpkgs, we have multiple implementations of the BLAS/LAPACK numerical linear
 Introduced in [PR #83888](https://github.com/NixOS/nixpkgs/pull/83888), we are able to override the `blas` and `lapack` packages to use different implementations, through the `blasProvider` and `lapackProvider` argument. This can be used to select a different provider. BLAS providers will have symlinks in `$out/lib/libblas.so.3` and `$out/lib/libcblas.so.3` to their respective BLAS libraries.  Likewise, LAPACK providers will have symlinks in `$out/lib/liblapack.so.3` and `$out/lib/liblapacke.so.3` to their respective LAPACK libraries. For example, Intel MKL is both a BLAS and LAPACK provider. An overlay can be created to use Intel MKL that looks like:
 
 ```nix
-self: super:
+final: prev:
 
 {
-  blas = super.blas.override { blasProvider = self.mkl; };
+  blas = prev.blas.override { blasProvider = final.mkl; };
 
-  lapack = super.lapack.override { lapackProvider = self.mkl; };
+  lapack = prev.lapack.override { lapackProvider = final.mkl; };
 }
 ```
 
@@ -112,12 +112,12 @@ Intel MKL requires an `openmp` implementation when running with multiple process
 To override `blas` and `lapack` with its reference implementations (i.e. for development purposes), one can use the following overlay:
 
 ```nix
-self: super:
+final: prev:
 
 {
-  blas = super.blas.override { blasProvider = self.lapack-reference; };
+  blas = prev.blas.override { blasProvider = final.lapack-reference; };
 
-  lapack = super.lapack.override { lapackProvider = self.lapack-reference; };
+  lapack = prev.lapack.override { lapackProvider = final.lapack-reference; };
 }
 ```
 
@@ -152,9 +152,9 @@ All programs that are built with [MPI](https://en.wikipedia.org/wiki/Message_Pas
 To provide MPI enabled applications that use `MPICH`, instead of the default `Open MPI`, use the following overlay:
 
 ```nix
-self: super:
+final: prev:
 
 {
-  mpi = self.mpich;
+  mpi = final.mpich;
 }
 ```

maintainers/maintainer-list.nix

@@ -15287,6 +15287,11 @@
     github = "M0NsTeRRR";
     githubId = 37785089;
   };
+  m0ustache3 = {
+    name = "M0ustach3";
+    github = "M0ustach3";
+    githubId = 37956764;
+  };
   m1cr0man = {
     email = "lucas+nix@m1cr0man.com";
     github = "m1cr0man";
@@ -16242,6 +16247,12 @@
     name = "Colton J. McCurdy";
     keys = [ { fingerprint = "D709 03C8 0BE9 ACDC 14F0  3BFB 77BF E531 397E DE94"; } ];
   };
+  mcjocobe = {
+    email = "josecolomerbel@gmail.com";
+    github = "mcjocobe";
+    githubId = 94081214;
+    name = "Jose Colomer";
+  };
   mcmtroffaes = {
     email = "matthias.troffaes@gmail.com";
     github = "mcmtroffaes";

nixos/modules/services/cluster/k3s/default.nix

@@ -82,6 +82,8 @@ let
         nativeBuildInputs = with pkgs; [
           kubernetes-helm
           cacert
+          # Helm requires HOME to refer to a writable dir
+          writableTmpDirAsHomeHook
         ];
       }
       ''

nixos/modules/services/monitoring/prometheus/exporters/script.nix

@@ -14,46 +14,29 @@ let
     literalExpression
     concatStringsSep
     ;
-  configFile = pkgs.writeText "script-exporter.yaml" (builtins.toJSON cfg.settings);
+  settingsFormat = pkgs.formats.yaml { };
+  configFile = settingsFormat.generate "script-exporter.yaml" cfg.settings;
 in
 {
   port = 9172;
   extraOpts = {
-    settings.scripts = mkOption {
-      type =
-        with types;
-        listOf (submodule {
-          options = {
-            name = mkOption {
-              type = str;
-              example = "sleep";
-              description = "Name of the script.";
-            };
-            script = mkOption {
-              type = str;
-              example = "sleep 5";
-              description = "Shell script to execute when metrics are requested.";
-            };
-            timeout = mkOption {
-              type = nullOr int;
-              default = null;
-              example = 60;
-              description = "Optional timeout for the script in seconds.";
-            };
-          };
-        });
+    settings = mkOption {
+      type = (pkgs.formats.yaml { }).type;
+      default = { };
       example = literalExpression ''
         {
           scripts = [
-            { name = "sleep"; script = "sleep 5"; }
+            { name = "sleep"; command = [ "sleep" ]; args = [ "5" ]; }
           ];
         }
       '';
       description = ''
-        All settings expressed as an Nix attrset.
+        Free-form configuration for script_exporter, expressed as a Nix attrset and rendered to YAML.
 
-        Check the official documentation for the corresponding YAML
-        settings that can all be used here: <https://github.com/adhocteam/script_exporter#sample-configuration>
+        **Migration note:**
+        The previous format using `script = "sleep 5"` is no longer supported. You must use `command` (list) and `args` (list), e.g. `{ command = [ "sleep" ]; args = [ "5" ]; }`.
+
+        See the official documentation for all available options: <https://github.com/ricoberger/script_exporter#configuration-file>
       '';
     };
   };
@@ -62,7 +45,7 @@ in
       ExecStart = ''
         ${pkgs.prometheus-script-exporter}/bin/script_exporter \
           --web.listen-address ${cfg.listenAddress}:${toString cfg.port} \
-          --config.file ${configFile} \
+          --config.files ${configFile} \
           ${concatStringsSep " \\\n  " cfg.extraFlags}
       '';
       NoNewPrivileges = true;

nixos/modules/services/networking/ncps.nix

@@ -27,6 +27,9 @@ let
         cfg.openTelemetry.grpcURL != null
       ) "--otel-grpc-url='${cfg.openTelemetry.grpcURL}'")
     ))
+    ++ (lib.optionals cfg.prometheus.enable [
+      "--prometheus-enabled"
+    ])
   );
 
   serveFlags = lib.concatStringsSep " " (
@@ -34,6 +37,7 @@ let
       "--cache-hostname='${cfg.cache.hostName}'"
       "--cache-data-path='${cfg.cache.dataPath}'"
       "--cache-database-url='${cfg.cache.databaseURL}'"
+      "--cache-temp-path='${cfg.cache.tempPath}'"
       "--server-addr='${cfg.server.addr}'"
     ]
     ++ (lib.optional cfg.cache.allowDeleteVerb "--cache-allow-delete-verb")
@@ -76,6 +80,8 @@ in
         };
       };
 
+      prometheus.enable = lib.mkEnableOption "Enable Prometheus metrics endpoint at /metrics";
+
       logLevel = lib.mkOption {
         type = lib.types.enum logLevels;
         default = "info";
@@ -165,6 +171,14 @@ in
             empty to automatically generate a private/public key.
           '';
         };
+
+        tempPath = lib.mkOption {
+          type = lib.types.str;
+          default = "/tmp";
+          description = ''
+            The path to the temporary directory that is used by the cache to download NAR files
+          '';
+        };
       };
 
       server = {
@@ -214,7 +228,7 @@ in
     };
     users.groups.ncps = { };
 
-    systemd.services.ncps-create-datadirs = {
+    systemd.services.ncps-create-directories = {
       description = "Created required directories by ncps";
       serviceConfig = {
         Type = "oneshot";
@@ -232,6 +246,12 @@ in
             mkdir -p ${dbDir}
             chown ncps:ncps ${dbDir}
           fi
+        '')
+        + (lib.optionalString (cfg.cache.tempPath != "/tmp") ''
+          if ! test -d ${cfg.cache.tempPath}; then
+            mkdir -p ${cfg.cache.tempPath}
+            chown ncps:ncps ${cfg.cache.tempPath}
+          fi
         '');
       wantedBy = [ "ncps.service" ];
       before = [ "ncps.service" ];
@@ -273,6 +293,9 @@ in
         (lib.mkIf (isSqlite && !lib.strings.hasPrefix "/var/lib/ncps" dbDir) {
           ReadWritePaths = [ dbDir ];
         })
+        (lib.mkIf (cfg.cache.tempPath != "/tmp") {
+          ReadWritePaths = [ cfg.cache.tempPath ];
+        })
 
         # Hardening
         {

nixos/modules/services/security/crowdsec.nix

@@ -0,0 +1,973 @@
+{
+  config,
+  pkgs,
+  lib,
+  ...
+}:
+let
+
+  format = pkgs.formats.yaml { };
+
+  rootDir = "/var/lib/crowdsec";
+  stateDir = "${rootDir}/state";
+  confDir = "/etc/crowdsec/";
+  hubDir = "${stateDir}/hub/";
+  notificationsDir = "${confDir}/notifications/";
+  pluginDir = "${confDir}/plugins/";
+  parsersDir = "${confDir}/parsers/";
+  localPostOverflowsDir = "${confDir}/postoverflows/";
+  localPostOverflowsS01WhitelistDir = "${localPostOverflowsDir}/s01-whitelist/";
+  localScenariosDir = "${confDir}/scenarios/";
+  localParsersS00RawDir = "${parsersDir}/s00-raw/";
+  localParsersS01ParseDir = "${parsersDir}/s01-parse/";
+  localParsersS02EnrichDir = "${parsersDir}/s02-enrich/";
+  localContextsDir = "${confDir}/contexts/";
+
+in
+{
+
+  options.services.crowdsec = {
+    enable = lib.mkEnableOption "CrowdSec Security Engine";
+
+    package = lib.mkPackageOption pkgs "crowdsec" { };
+
+    autoUpdateService = lib.mkEnableOption "if `true` `cscli hub update` will be executed daily. See `https://docs.crowdsec.net/docs/cscli/cscli_hub_update/` for more information";
+
+    openFirewall = lib.mkOption {
+      type = lib.types.bool;
+      default = false;
+      example = true;
+      description = ''
+        Whether to automatically open firewall ports for `crowdsec`.
+      '';
+    };
+
+    user = lib.mkOption {
+      type = lib.types.str;
+      description = "The user to run crowdsec as";
+      default = "crowdsec";
+    };
+
+    group = lib.mkOption {
+      type = lib.types.str;
+      description = "The group to run crowdsec as";
+      default = "crowdsec";
+    };
+
+    name = lib.mkOption {
+      type = lib.types.str;
+      description = ''
+        Name of the machine when registering it at the central or local api.
+      '';
+      default = config.networking.hostName;
+      defaultText = lib.literalExpression "config.networking.hostName";
+    };
+
+    localConfig = lib.mkOption {
+      type = lib.types.submodule {
+        options = {
+          acquisitions = lib.mkOption {
+            type = lib.types.listOf format.type;
+            default = [ ];
+            description = ''
+              A list of acquisition specifications, which define the data sources you want to be parsed.
+
+              See <https://docs.crowdsec.net/docs/data_sources/intro> for details.
+            '';
+            example = [
+              {
+                source = "journalctl";
+                journalctl_filter = [ "_SYSTEMD_UNIT=sshd.service" ];
+                labels = {
+                  type = "syslog";
+                };
+              }
+            ];
+          };
+          scenarios = lib.mkOption {
+            type = lib.types.listOf format.type;
+            default = [ ];
+            description = ''
+              A list of scenarios specifications.
+
+              See <https://docs.crowdsec.net/docs/scenarios/intro> for details.
+            '';
+            example = [
+              {
+                type = "leaky";
+                name = "crowdsecurity/myservice-bf";
+                description = "Detect myservice bruteforce";
+                filter = "evt.Meta.log_type == 'myservice_failed_auth'";
+                leakspeed = "10s";
+                capacity = 5;
+                groupby = "evt.Meta.source_ip";
+              }
+            ];
+          };
+          parsers = lib.mkOption {
+            type = lib.types.submodule {
+              options = {
+                s00Raw = lib.mkOption {
+                  type = lib.types.listOf format.type;
+                  default = [ ];
+                  description = ''
+                    A list of stage s00-raw specifications. Most of the time, those are already included in the hub, but are presented here anyway.
+
+                    See <https://docs.crowdsec.net/docs/parsers/intro> for details.
+                  '';
+                };
+                s01Parse = lib.mkOption {
+                  type = lib.types.listOf format.type;
+                  default = [ ];
+                  description = ''
+                    A list of stage s01-parse specifications.
+
+                    See <https://docs.crowdsec.net/docs/parsers/intro> for details.
+                  '';
+                  example = [
+                    {
+                      filter = "1=1";
+                      debug = true;
+                      onsuccess = "next_stage";
+                      name = "example/custom-service-logs";
+                      description = "Parsing custom service logs";
+                      grok = {
+                        pattern = "^%{DATA:some_data}$";
+                        apply_on = "message";
+                      };
+                      statics = [
+                        {
+                          parsed = "is_my_custom_service";
+                          value = "yes";
+                        }
+                      ];
+                    }
+                  ];
+                };
+                s02Enrich = lib.mkOption {
+                  type = lib.types.listOf format.type;
+                  default = [ ];
+                  description = ''
+                    A list of stage s02-enrich specifications. Inside this list, you can specify Parser Whitelists.
+
+                    See <https://docs.crowdsec.net/docs/whitelist/intro> for details.
+                  '';
+                  example = [
+                    {
+                      name = "myips/whitelist";
+                      description = "Whitelist parse events from my IPs";
+                      whitelist = {
+                        reason = "My IP ranges";
+                        ip = [
+                          "1.2.3.4"
+                        ];
+                        cidr = [
+                          "1.2.3.0/24"
+                        ];
+                      };
+                    }
+                  ];
+                };
+              };
+            };
+            default = { };
+          };
+          postOverflows = lib.mkOption {
+            type = lib.types.submodule {
+              options = {
+                s01Whitelist = lib.mkOption {
+                  type = lib.types.listOf format.type;
+                  default = [ ];
+                  description = ''
+                    A list of stage s01-whitelist specifications. Inside this list, you can specify Postoverflows Whitelists.
+
+                    See <https://docs.crowdsec.net/docs/whitelist/intro> for details.
+                  '';
+                  example = [
+                    {
+                      name = "postoverflows/whitelist_my_dns_domain";
+                      description = "Whitelist my reverse DNS";
+                      whitelist = {
+                        reason = "Don't ban me";
+                        expression = [
+                          "evt.Enriched.reverse_dns endsWith '.local.'"
+                        ];
+                      };
+                    }
+                  ];
+                };
+              };
+            };
+            default = { };
+          };
+          contexts = lib.mkOption {
+            type = lib.types.listOf format.type;
+            description = ''
+              A list of additional contexts to specify.
+
+              See <https://docs.crowdsec.net/docs/next/log_processor/alert_context/intro> for details.
+            '';
+            example = [
+              {
+                context = {
+                  target_uri = [ "evt.Meta.http_path" ];
+                  user_agent = [ "evt.Meta.http_user_agent" ];
+                  method = [ "evt.Meta.http_verb" ];
+                  status = [ "evt.Meta.http_status" ];
+                };
+              }
+            ];
+            default = [ ];
+          };
+          notifications = lib.mkOption {
+            type = lib.types.listOf format.type;
+            description = ''
+              A list of notifications to enable and use in your profiles. Note that for now, only the plugins shipped by default with CrowdSec are supported.
+
+              See <https://docs.crowdsec.net/docs/notification_plugins/intro> for details.
+            '';
+            example = [
+              {
+                type = "http";
+                name = "default_http_notification";
+                log_level = "info";
+                format = ''
+                  {{.|toJson}}
+                '';
+                url = "https://example.com/hook";
+                method = "POST";
+              }
+            ];
+            default = [ ];
+          };
+          profiles = lib.mkOption {
+            type = lib.types.listOf format.type;
+            description = ''
+              A list of profiles to enable.
+
+              See <https://docs.crowdsec.net/docs/profiles/intro> for more details.
+            '';
+            example = [
+              {
+                name = "default_ip_remediation";
+                filters = [
+                  "Alert.Remediation == true && Alert.GetScope() == 'Ip'"
+                ];
+                decisions = [
+                  {
+                    type = "ban";
+                    duration = "4h";
+                  }
+                ];
+                on_success = "break";
+              }
+              {
+                name = "default_range_remediation";
+                filters = [
+                  "Alert.Remediation == true && Alert.GetScope() == 'Range'"
+                ];
+                decisions = [
+                  {
+                    type = "ban";
+                    duration = "4h";
+                  }
+                ];
+                on_success = "break";
+              }
+            ];
+            default = [
+              {
+                name = "default_ip_remediation";
+                filters = [
+                  "Alert.Remediation == true && Alert.GetScope() == 'Ip'"
+                ];
+                decisions = [
+                  {
+                    type = "ban";
+                    duration = "4h";
+                  }
+                ];
+                on_success = "break";
+              }
+              {
+                name = "default_range_remediation";
+                filters = [
+                  "Alert.Remediation == true && Alert.GetScope() == 'Range'"
+                ];
+                decisions = [
+                  {
+                    type = "ban";
+                    duration = "4h";
+                  }
+                ];
+                on_success = "break";
+              }
+            ];
+          };
+          patterns = lib.mkOption {
+            type = lib.types.listOf lib.types.package;
+            default = [ ];
+            example = lib.literalExpression ''
+              [ (pkgs.writeTextDir "custom_service_logs" (builtins.readFile ./custom_service_logs)) ]
+            '';
+          };
+        };
+      };
+      default = { };
+    };
+
+    hub = lib.mkOption {
+      type = lib.types.submodule {
+        options = {
+          collections = lib.mkOption {
+            type = lib.types.listOf lib.types.str;
+            default = [ ];
+            description = "List of hub collections to install";
+            example = [ "crowdsecurity/linux" ];
+          };
+
+          scenarios = lib.mkOption {
+            type = lib.types.listOf lib.types.str;
+            default = [ ];
+            description = "List of hub scenarios to install";
+            example = [ "crowdsecurity/ssh-bf" ];
+          };
+
+          parsers = lib.mkOption {
+            type = lib.types.listOf lib.types.str;
+            default = [ ];
+            description = "List of hub parsers to install";
+            example = [ "crowdsecurity/sshd-logs" ];
+          };
+
+          postOverflows = lib.mkOption {
+            type = lib.types.listOf lib.types.str;
+            default = [ ];
+            description = "List of hub postoverflows to install";
+            example = [ "crowdsecurity/auditd-nix-wrappers-whitelist-process" ];
+          };
+
+          appSecConfigs = lib.mkOption {
+            type = lib.types.listOf lib.types.str;
+            default = [ ];
+            description = "List of hub appsec configurations to install";
+            example = [ "crowdsecurity/appsec-default" ];
+          };
+
+          appSecRules = lib.mkOption {
+            type = lib.types.listOf lib.types.str;
+            default = [ ];
+            description = "List of hub appsec rules to install";
+            example = [ "crowdsecurity/base-config" ];
+          };
+
+          branch = lib.mkOption {
+            type = lib.types.str;
+            default = "master";
+            description = ''
+              The git branch on which cscli is going to fetch configurations.
+
+              See `https://docs.crowdsec.net/docs/configuration/crowdsec_configuration/#hub_branch` for more information.
+            '';
+            example = [
+              "master"
+              "v1.4.3"
+              "v1.4.2"
+            ];
+          };
+        };
+      };
+      default = { };
+      description = ''
+        Hub collections, parsers, AppSec rules, etc.
+      '';
+    };
+
+    settings = lib.mkOption {
+      type = lib.types.submodule {
+        options = {
+          general = lib.mkOption {
+            description = ''
+              Settings for the main CrowdSec configuration file.
+
+              Refer to the defaults at <https://github.com/crowdsecurity/crowdsec/blob/master/config/config.yaml>.
+            '';
+            type = format.type;
+            default = { };
+          };
+          simulation = lib.mkOption {
+            type = format.type;
+            default = {
+              simulation = false;
+            };
+            description = ''
+              Attributes inside the simulation.yaml file.
+            '';
+          };
+
+          lapi = lib.mkOption {
+            type = lib.types.submodule {
+              options = {
+                credentialsFile = lib.mkOption {
+                  type = lib.types.nullOr lib.types.path;
+                  example = "/run/crowdsec/lapi.yaml";
+                  description = ''
+                    The LAPI credential file to use.
+                  '';
+                  default = null;
+                };
+              };
+            };
+            description = ''
+              LAPI Configuration attributes
+            '';
+            default = { };
+          };
+          capi = lib.mkOption {
+            type = lib.types.submodule {
+              options = {
+                credentialsFile = lib.mkOption {
+                  type = lib.types.nullOr lib.types.path;
+                  example = "/run/crowdsec/capi.yaml";
+                  description = ''
+                    The CAPI credential file to use.
+                  '';
+                  default = null;
+                };
+              };
+            };
+            description = ''
+              CAPI Configuration attributes
+            '';
+            default = { };
+          };
+          console = lib.mkOption {
+            type = lib.types.submodule {
+              options = {
+                tokenFile = lib.mkOption {
+                  type = lib.types.nullOr lib.types.path;
+                  example = "/run/crowdsec/console_token.yaml";
+                  description = ''
+                    The Console Token file to use.
+                  '';
+                  default = null;
+                };
+                configuration = lib.mkOption {
+                  type = format.type;
+                  default = {
+                    share_manual_decisions = false;
+                    share_custom = false;
+                    share_tainted = false;
+                    share_context = false;
+                  };
+                  description = ''
+                    Attributes inside the console.yaml file.
+                  '';
+                };
+              };
+            };
+            description = ''
+              Console Configuration attributes
+            '';
+            default = { };
+          };
+        };
+      };
+    };
+  };
+  config =
+    let
+      cfg = config.services.crowdsec;
+      configFile = format.generate "crowdsec.yaml" cfg.settings.general;
+      simulationFile = format.generate "simulation.yaml" cfg.settings.simulation;
+      consoleFile = format.generate "console.yaml" cfg.settings.console.configuration;
+      patternsDir = pkgs.buildPackages.symlinkJoin {
+        name = "crowdsec-patterns";
+        paths = [
+          cfg.localConfig.patterns
+          "${lib.attrsets.getOutput "out" cfg.package}/share/crowdsec/config/patterns/"
+        ];
+      };
+
+      cscli = pkgs.writeShellScriptBin "cscli" ''
+        set -euo pipefail
+        # cscli needs crowdsec on it's path in order to be able to run `cscli explain`
+        export PATH="$PATH:${lib.makeBinPath [ cfg.package ]}"
+                sudo=exec
+        if [ "$USER" != "${cfg.user}" ]; then
+          ${
+            if config.security.sudo.enable then
+              "sudo='exec ${config.security.wrapperDir}/sudo -u ${cfg.user}'"
+            else
+              ">&2 echo 'Aborting, cscli must be run as user `${cfg.user}`!'; exit 2"
+          }
+        fi
+        $sudo ${lib.getExe' cfg.package "cscli"} -c=${configFile} "$@"
+      '';
+
+      localScenariosMap = (map (format.generate "scenario.yaml") cfg.localConfig.scenarios);
+      localParsersS00RawMap = (
+        map (format.generate "parsers-s00-raw.yaml") cfg.localConfig.parsers.s00Raw
+      );
+      localParsersS01ParseMap = (
+        map (format.generate "parsers-s01-parse.yaml") cfg.localConfig.parsers.s01Parse
+      );
+      localParsersS02EnrichMap = (
+        map (format.generate "parsers-s02-enrich.yaml") cfg.localConfig.parsers.s02Enrich
+      );
+      localPostOverflowsS01WhitelistMap = (
+        map (format.generate "postoverflows-s01-whitelist.yaml") cfg.localConfig.postOverflows.s01Whitelist
+      );
+      localContextsMap = (map (format.generate "context.yaml") cfg.localConfig.contexts);
+      localNotificationsMap = (map (format.generate "notification.yaml") cfg.localConfig.notifications);
+      localProfilesFile = pkgs.writeText "local_profiles.yaml" ''
+        ---
+        ${lib.strings.concatMapStringsSep "\n---\n" builtins.toJSON cfg.localConfig.profiles}
+        ---
+      '';
+      localAcquisisionFile = pkgs.writeText "local_acquisisions.yaml" ''
+        ---
+        ${lib.strings.concatMapStringsSep "\n---\n" builtins.toJSON cfg.localConfig.acquisitions}
+        ---
+      '';
+
+      scriptArray = [
+        "set -euo pipefail"
+        "${lib.getExe' pkgs.coreutils "mkdir"} -p '${hubDir}'"
+        "${lib.getExe cscli} hub update"
+      ]
+      ++ lib.optionals (cfg.hub.collections != [ ]) [
+        "${lib.getExe cscli} collections install ${
+          lib.strings.concatMapStringsSep " " (x: lib.escapeShellArg x) cfg.hub.collections
+        }"
+      ]
+      ++ lib.optionals (cfg.hub.scenarios != [ ]) [
+        "${lib.getExe cscli} scenarios install ${
+          lib.strings.concatMapStringsSep " " (x: lib.escapeShellArg x) cfg.hub.scenarios
+        }"
+      ]
+      ++ lib.optionals (cfg.hub.parsers != [ ]) [
+        "${lib.getExe cscli} parsers install ${
+          lib.strings.concatMapStringsSep " " (x: lib.escapeShellArg x) cfg.hub.parsers
+        }"
+      ]
+      ++ lib.optionals (cfg.hub.postOverflows != [ ]) [
+        "${lib.getExe cscli} postoverflows install ${
+          lib.strings.concatMapStringsSep " " (x: lib.escapeShellArg x) cfg.hub.postOverflows
+        }"
+      ]
+      ++ lib.optionals (cfg.hub.appSecConfigs != [ ]) [
+        "${lib.getExe cscli} appsec-configs install ${
+          lib.strings.concatMapStringsSep " " (x: lib.escapeShellArg x) cfg.hub.appSecConfigs
+        }"
+      ]
+      ++ lib.optionals (cfg.hub.appSecRules != [ ]) [
+        "${lib.getExe cscli} appsec-rules install ${
+          lib.strings.concatMapStringsSep " " (x: lib.escapeShellArg x) cfg.hub.appSecRules
+        }"
+      ]
+      ++ lib.optionals (cfg.settings.general.api.server.enable) [
+        ''
+          if [ ! -s "${cfg.settings.general.api.client.credentials_path}" ]; then
+            ${lib.getExe cscli} machine add "${cfg.name}" --auto
+          fi
+        ''
+      ]
+      ++ lib.optionals (cfg.settings.capi.credentialsFile != null) [
+        ''
+          if ! grep -q password "${cfg.settings.capi.credentialsFile}" ]; then
+            ${lib.getExe cscli} capi register
+          fi
+        ''
+      ]
+      ++ lib.optionals (cfg.settings.console.tokenFile != null) [
+        ''
+          if [ ! -e "${cfg.settings.console.tokenFile}" ]; then
+            ${lib.getExe cscli} console enroll "$(cat ${cfg.settings.console.tokenFile})" --name ${cfg.name}
+          fi
+        ''
+      ];
+
+      setupScript = pkgs.writeShellScriptBin "crowdsec-setup" (
+        lib.strings.concatStringsSep "\n" scriptArray
+      );
+
+    in
+    lib.mkIf (cfg.enable) {
+
+      warnings =
+        [ ]
+        ++ lib.optionals (cfg.localConfig.profiles == [ ]) [
+          "By not specifying profiles in services.crowdsec.localConfig.profiles, CrowdSec will not react to any alert by default."
+        ]
+        ++ lib.optionals (cfg.localConfig.acquisitions == [ ]) [
+          "By not specifying acquisitions in services.crowdsec.localConfig.acquisitions, CrowdSec will not look for any data source."
+        ];
+
+      services.crowdsec.settings.general = {
+        common = {
+          daemonize = false;
+          log_media = "stdout";
+        };
+        config_paths = {
+          config_dir = confDir;
+          data_dir = stateDir;
+          simulation_path = simulationFile;
+          hub_dir = hubDir;
+          index_path = lib.strings.normalizePath "${stateDir}/hub/.index.json";
+          notification_dir = notificationsDir;
+          plugin_dir = pluginDir;
+          pattern_dir = patternsDir;
+        };
+        db_config = {
+          type = lib.mkDefault "sqlite";
+          db_path = lib.mkDefault (lib.strings.normalizePath "${stateDir}/crowdsec.db");
+          use_wal = lib.mkDefault true;
+        };
+        crowdsec_service = {
+          enable = lib.mkDefault true;
+          acquisition_path = lib.mkDefault localAcquisisionFile;
+        };
+        api = {
+          client = {
+            credentials_path = cfg.settings.lapi.credentialsFile;
+          };
+          server = {
+            enable = lib.mkDefault false;
+            listen_uri = lib.mkDefault "127.0.0.1:8080";
+
+            console_path = lib.mkDefault consoleFile;
+            profiles_path = lib.mkDefault localProfilesFile;
+
+            online_client = lib.mkDefault {
+              sharing = lib.mkDefault true;
+              pull = lib.mkDefault {
+                community = lib.mkDefault true;
+                blocklists = lib.mkDefault true;
+              };
+              credentials_path = cfg.settings.capi.credentialsFile;
+            };
+          };
+        };
+        prometheus = {
+          enabled = lib.mkDefault true;
+          level = lib.mkDefault "full";
+          listen_addr = lib.mkDefault "127.0.0.1";
+          listen_port = lib.mkDefault 6060;
+        };
+        cscli = {
+          hub_branch = cfg.hub.branch;
+        };
+      };
+
+      environment = {
+        systemPackages = [ cscli ];
+      };
+
+      systemd.packages = [ cfg.package ];
+
+      systemd.timers.crowdsec-update-hub = lib.mkIf (cfg.autoUpdateService) {
+        description = "Update the crowdsec hub index";
+        wantedBy = [ "timers.target" ];
+        timerConfig = {
+          OnCalendar = "daily";
+          RandomizedDelaySec = 300;
+          Persistent = "yes";
+          Unit = "crowdsec-update-hub.service";
+        };
+      };
+      systemd.services = {
+        crowdsec-update-hub = lib.mkIf (cfg.autoUpdateService) {
+          description = "Update the crowdsec hub index";
+          serviceConfig = {
+            Type = "oneshot";
+            User = cfg.user;
+            Group = cfg.group;
+            LimitNOFILE = 65536;
+            NoNewPrivileges = true;
+            LockPersonality = true;
+            RemoveIPC = true;
+            ReadWritePaths = [
+              rootDir
+              confDir
+            ];
+            ProtectSystem = "strict";
+            PrivateUsers = true;
+            ProtectHome = true;
+            PrivateTmp = true;
+            PrivateDevices = true;
+            ProtectHostname = true;
+            UMask = "0077";
+            ProtectKernelTunables = true;
+            ProtectKernelModules = true;
+            ProtectControlGroups = true;
+            ProtectProc = "invisible";
+            SystemCallFilter = [
+              " " # This is needed to clear the SystemCallFilter existing definitions
+              "~@reboot"
+              "~@swap"
+              "~@obsolete"
+              "~@mount"
+              "~@module"
+              "~@debug"
+              "~@cpu-emulation"
+              "~@clock"
+              "~@raw-io"
+              "~@privileged"
+              "~@resources"
+            ];
+            CapabilityBoundingSet = [
+              " " # Reset all capabilities to an empty set
+            ];
+            RestrictAddressFamilies = [
+              " " # This is needed to clear the RestrictAddressFamilies existing definitions
+              "none" # Remove all addresses families
+              "AF_UNIX"
+              "AF_INET"
+              "AF_INET6"
+            ];
+            DevicePolicy = "closed";
+            ProtectKernelLogs = true;
+            SystemCallArchitectures = "native";
+            RestrictNamespaces = true;
+            RestrictRealtime = true;
+            RestrictSUIDSGID = true;
+            ExecStart = "${lib.getExe cscli} --error hub update";
+            ExecStartPost = "systemctl reload crowdsec.service";
+            DynamicUser = true;
+          };
+        };
+
+        crowdsec = {
+          description = "CrowdSec agent";
+          wantedBy = [ "multi-user.target" ];
+          after = [ "network-online.target" ];
+          wants = [ "network-online.target" ];
+          path = lib.mkForce [ ];
+          environment = {
+            LC_ALL = "C";
+            LANG = "C";
+          };
+          serviceConfig = {
+            User = cfg.user;
+            Group = cfg.group;
+            Type = "simple";
+            RestartSec = 60;
+            LimitNOFILE = 65536;
+            NoNewPrivileges = true;
+            LockPersonality = true;
+            RemoveIPC = true;
+            ReadWritePaths = [
+              rootDir
+              confDir
+            ];
+            ProtectSystem = "strict";
+            PrivateUsers = true;
+            ProtectHome = true;
+            PrivateTmp = true;
+            PrivateDevices = true;
+            ProtectHostname = true;
+            ProtectClock = true;
+            UMask = "0077";
+            ProtectKernelTunables = true;
+            ProtectKernelModules = true;
+            ProtectControlGroups = true;
+            ProtectProc = "invisible";
+            SystemCallFilter = [
+              " " # This is needed to clear the SystemCallFilter existing definitions
+              "~@reboot"
+              "~@swap"
+              "~@obsolete"
+              "~@mount"
+              "~@module"
+              "~@debug"
+              "~@cpu-emulation"
+              "~@clock"
+              "~@raw-io"
+              "~@privileged"
+              "~@resources"
+            ];
+            CapabilityBoundingSet = [
+              " " # Reset all capabilities to an empty set
+              "CAP_SYSLOG" # Add capability to read syslog
+            ];
+            RestrictAddressFamilies = [
+              " " # This is needed to clear the RestrictAddressFamilies existing definitions
+              "none" # Remove all addresses families
+              "AF_UNIX"
+              "AF_INET"
+              "AF_INET6"
+            ];
+            DevicePolicy = "closed";
+            ProtectKernelLogs = true;
+            SystemCallArchitectures = "native";
+            DynamicUser = true;
+            RestrictNamespaces = true;
+            RestrictRealtime = true;
+            RestrictSUIDSGID = true;
+            ExecReload = [
+              " " # This is needed to clear the ExecReload definitions from upstream
+            ];
+            ExecStart = [
+              " " # This is needed to clear the ExecStart definitions from upstream
+              "${lib.getExe' cfg.package "crowdsec"} -c ${configFile} -info"
+            ];
+            ExecStartPre = [
+              " " # This is needed to clear the ExecStartPre definitions from upstream
+              "${lib.getExe setupScript}"
+              "${lib.getExe' cfg.package "crowdsec"} -c ${configFile} -t -error"
+            ];
+          };
+        };
+      };
+
+      systemd.tmpfiles.settings = {
+        "10-crowdsec" =
+
+          builtins.listToAttrs (
+            map
+              (dirName: {
+                inherit cfg;
+                name = lib.strings.normalizePath dirName;
+                value = {
+                  d = {
+                    user = cfg.user;
+                    group = cfg.group;
+                    mode = "0750";
+                  };
+                };
+              })
+              [
+                stateDir
+                hubDir
+                confDir
+                localScenariosDir
+                localPostOverflowsDir
+                localPostOverflowsS01WhitelistDir
+                parsersDir
+                localParsersS00RawDir
+                localParsersS01ParseDir
+                localParsersS02EnrichDir
+                localContextsDir
+                notificationsDir
+                pluginDir
+              ]
+          )
+          // builtins.listToAttrs (
+            map (scenarioFile: {
+              inherit cfg;
+              name = lib.strings.normalizePath "${localScenariosDir}/${builtins.unsafeDiscardStringContext (builtins.baseNameOf scenarioFile)}";
+              value = {
+                link = {
+                  type = "L+";
+                  argument = "${scenarioFile}";
+                };
+              };
+            }) localScenariosMap
+          )
+          // builtins.listToAttrs (
+            map (parser: {
+              inherit cfg;
+              name = lib.strings.normalizePath "${localParsersS00RawDir}/${builtins.unsafeDiscardStringContext (builtins.baseNameOf parser)}";
+              value = {
+                link = {
+                  type = "L+";
+                  argument = "${parser}";
+                };
+              };
+            }) localParsersS00RawMap
+          )
+          // builtins.listToAttrs (
+            map (parser: {
+              inherit cfg;
+              name = lib.strings.normalizePath "${localParsersS01ParseDir}/${builtins.unsafeDiscardStringContext (builtins.baseNameOf parser)}";
+              value = {
+                link = {
+                  type = "L+";
+                  argument = "${parser}";
+                };
+              };
+            }) localParsersS01ParseMap
+          )
+          // builtins.listToAttrs (
+            map (parser: {
+              inherit cfg;
+              name = lib.strings.normalizePath "${localParsersS02EnrichDir}/${builtins.unsafeDiscardStringContext (builtins.baseNameOf parser)}";
+              value = {
+                link = {
+                  type = "L+";
+                  argument = "${parser}";
+                };
+              };
+            }) localParsersS02EnrichMap
+          )
+          // builtins.listToAttrs (
+            map (postoverflow: {
+              inherit cfg;
+              name = lib.strings.normalizePath "${localPostOverflowsS01WhitelistDir}/${builtins.unsafeDiscardStringContext (builtins.baseNameOf postoverflow)}";
+              value = {
+                link = {
+                  type = "L+";
+                  argument = "${postoverflow}";
+                };
+              };
+            }) localPostOverflowsS01WhitelistMap
+          )
+          // builtins.listToAttrs (
+            map (context: {
+              inherit cfg;
+              name = lib.strings.normalizePath "${localContextsDir}/${builtins.unsafeDiscardStringContext (builtins.baseNameOf context)}";
+              value = {
+                link = {
+                  type = "L+";
+                  argument = "${context}";
+                };
+              };
+            }) localContextsMap
+          )
+          // builtins.listToAttrs (
+            map (notification: {
+              inherit cfg;
+              name = lib.strings.normalizePath "${notificationsDir}/${builtins.unsafeDiscardStringContext (builtins.baseNameOf notification)}";
+              value = {
+                link = {
+                  type = "L+";
+                  argument = "${notification}";
+                };
+              };
+            }) localNotificationsMap
+          );
+      };
+
+      users.users.${cfg.user} = {
+        name = cfg.user;
+        description = lib.mkDefault "CrowdSec service user";
+        isSystemUser = true;
+        group = cfg.group;
+        extraGroups = [ "systemd-journal" ];
+      };
+
+      users.groups.${cfg.group} = lib.mapAttrs (name: lib.mkDefault) { };
+
+      networking.firewall.allowedTCPPorts =
+        let
+          parsePortFromURLOption =
+            url: option:
+            builtins.addErrorContext "extracting a port from URL: `${option}` requires a port to be specified, but we failed to parse a port from '${url}'" (
+              lib.strings.toInt (lib.last (lib.strings.splitString ":" url))
+            );
+        in
+        lib.mkIf cfg.openFirewall [
+          cfg.settings.general.prometheus.listen_port
+          (parsePortFromURLOption cfg.settings.general.api.server.listen_uri "config.services.crowdsec.settings.general.api.server.listen_uri")
+        ];
+    };
+
+  meta = {
+    maintainers = with lib.maintainers; [
+      m0ustach3
+      tornax
+      jk
+    ];
+  };
+}

nixos/modules/virtualisation/xen-dom0.nix

@@ -9,6 +9,7 @@
 
 let
   inherit (builtins) readFile;
+  inherit (lib.meta) hiPrio;
   inherit (lib.modules) mkRemovedOptionModule mkRenamedOptionModule mkIf;
   inherit (lib.options)
     mkOption
@@ -797,7 +798,7 @@ in
     environment = {
       systemPackages = [
         cfg.package
-        cfg.qemu.package
+        (hiPrio cfg.qemu.package)
       ];
       etc =
         # Set up Xen Domain 0 configuration files.

nixos/tests/k3s/auto-deploy-charts.nix

@@ -1,4 +1,5 @@
-# Tests whether container images are imported and auto deploying Helm charts work
+# Tests whether container images are imported and auto deploying Helm charts,
+# including the bundled traefik, work
 import ../make-test-python.nix (
   {
     k3s,
@@ -64,7 +65,6 @@ import ../make-test-python.nix (
             "--disable local-storage"
             "--disable metrics-server"
             "--disable servicelb"
-            "--disable traefik"
           ];
           images = [
             # Provides the k3s Helm controller
@@ -148,6 +148,8 @@ import ../make-test-python.nix (
         assert hello_output.rstrip() == "Hello, world!", f"unexpected output of hello job: {hello_output}"
         assert values_file_output.rstrip() == "Hello, file!", f"unexpected output of values file job: {values_file_output}"
         assert advanced_output.rstrip() == "advanced hello", f"unexpected output of advanced job: {advanced_output}"
+        # wait for bundled traefik deployment
+        machine.wait_until_succeeds("kubectl -n kube-system rollout status deployment traefik", timeout=180)
       '';
   }
 )

nixos/tests/prometheus-exporters.nix

@@ -1564,7 +1564,8 @@ let
         settings.scripts = [
           {
             name = "success";
-            script = "sleep 1";
+            command = [ "sleep" ];
+            args = [ "1" ];
           }
         ];
       };
@@ -1572,7 +1573,7 @@ let
         wait_for_unit("prometheus-script-exporter.service")
         wait_for_open_port(9172)
         wait_until_succeeds(
-            "curl -sSf 'localhost:9172/probe?name=success' | grep -q '{}'".format(
+            "curl -sSf 'localhost:9172/probe?script=success' | grep -q '{}'".format(
                 'script_success{script="success"} 1'
             )
         )

pkgs/applications/audio/librespot/default.nix

@@ -23,16 +23,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "librespot";
-  version = "0.7.0";
+  version = "0.7.1";
 
   src = fetchFromGitHub {
     owner = "librespot-org";
     repo = "librespot";
     rev = "v${version}";
-    hash = "sha256-IsHyYH4RDMRqXLNv6RZNzRTl3+zxan0TM/bjHoZC8YA=";
+    hash = "sha256-gBMzvQxmy+GYzrOKWmbhl56j49BK8W8NYO2RrvS4mWI=";
   };
 
-  cargoHash = "sha256-1Jc7gfnrsvk3Lcrvq0jV78IMKAnMDsW3nDr1W34PVmE=";
+  cargoHash = "sha256-PiGIxMIA/RL+YkpG1f46zyAO5anx9Ii+anKrANCM+rk=";
 
   nativeBuildInputs = [
     pkg-config

pkgs/applications/backup/timeshift/unwrapped.nix

@@ -18,13 +18,13 @@
 
 stdenv.mkDerivation rec {
   pname = "timeshift";
-  version = "25.07.6";
+  version = "25.07.7";
 
   src = fetchFromGitHub {
     owner = "linuxmint";
     repo = "timeshift";
     rev = version;
-    hash = "sha256-M3r5CUSMF2Es1EDolmZAwqj2uX76wARk5oefqdf2eYk=";
+    hash = "sha256-X3TwUkOeGzcgFM/4Fyfs8eQuGK2wHe3t13WSpIizX8s=";
   };
 
   postPatch = ''

pkgs/applications/editors/emacs/make-emacs.nix

@@ -95,10 +95,11 @@
   withX ? !(stdenv.hostPlatform.isDarwin || noGui || withPgtk),
   withXinput2 ? withX,
   withXwidgets ?
-    !stdenv.hostPlatform.isDarwin
-    && !noGui
-    && (withGTK3 || withPgtk)
-    && (lib.versionOlder version "30"), # XXX: upstream bug 66068 precludes newer versions of webkit2gtk (https://lists.gnu.org/archive/html/bug-gnu-emacs/2024-09/msg00695.html)
+    !noGui
+    && (withGTK3 || withPgtk || withNS || variant == "macport")
+    && (stdenv.hostPlatform.isDarwin || lib.versionOlder version "30"),
+  # XXX: - upstream bug 66068 precludes newer versions of webkit2gtk (https://lists.gnu.org/archive/html/bug-gnu-emacs/2024-09/msg00695.html)
+  # XXX: - Apple_SDK WebKit is compatible with Emacs.
   withSmallJaDic ? false,
   withCompressInstall ? true,
 
@@ -128,7 +129,8 @@ assert withGpm -> stdenv.hostPlatform.isLinux;
 assert withImageMagick -> (withX || withNS);
 assert withNS -> stdenv.hostPlatform.isDarwin && !(withX || variant == "macport");
 assert withPgtk -> withGTK3 && !withX;
-assert withXwidgets -> !noGui && (withGTK3 || withPgtk);
+assert withXwidgets -> !noGui && (withGTK3 || withPgtk || withNS || variant == "macport");
+# XXX: The upstream --with-xwidgets flag is enabled only when Emacs is built with GTK3 or with Cocoa (including the withNS and macport variant).
 
 let
   libGccJitLibraryPaths = [
@@ -348,7 +350,7 @@ stdenv.mkDerivation (finalAttrs: {
   ++ lib.optionals withXinput2 [
     libXi
   ]
-  ++ lib.optionals withXwidgets [
+  ++ lib.optionals (withXwidgets && stdenv.hostPlatform.isLinux) [
     webkitgtk_4_0
   ]
   ++ lib.optionals stdenv.hostPlatform.isDarwin [

pkgs/applications/editors/jupyter-kernels/xeus-cling/0003-Remove-unsupported-src-root-flag.patch

@@ -0,0 +1,85 @@
+diff --git a/CMakeLists.txt b/CMakeLists.txt
+index 43718f5..d0d8670 100644
+--- a/CMakeLists.txt
++++ b/CMakeLists.txt
+@@ -63,8 +63,7 @@ if(LLVM_CONFIG)
+         "--bindir"
+         "--libdir"
+         "--includedir"
+-        "--prefix"
+-        "--src-root")
++        "--prefix")
+     execute_process(COMMAND ${CONFIG_COMMAND}
+                     RESULT_VARIABLE HAD_ERROR
+                     OUTPUT_VARIABLE CONFIG_OUTPUT)
+diff --git a/src/xmagics/executable.cpp b/src/xmagics/executable.cpp
+index 391c8c9..aba5e03 100644
+--- a/src/xmagics/executable.cpp
++++ b/src/xmagics/executable.cpp
+@@ -12,6 +12,7 @@
+ #include <iterator>
+ #include <fstream>
+ #include <memory>
++#include <optional>
+ #include <string>
+ #include <vector>
+ 
+@@ -25,7 +26,7 @@
+ #include "clang/AST/ASTContext.h"
+ #include "clang/AST/DeclGroup.h"
+ #include "clang/AST/RecursiveASTVisitor.h"
+-#include "clang/Basic/DebugInfoOptions.h"
++#include "llvm/Frontend/Debug/Options.h"
+ #include "clang/Basic/Sanitizers.h"
+ #include "clang/Basic/TargetInfo.h"
+ #include "clang/CodeGen/BackendUtil.h"
+@@ -115,7 +116,7 @@ namespace xcpp
+             // Filter out functions added by Cling.
+             if (auto Identifier = D->getIdentifier())
+             {
+-                if (Identifier->getName().startswith("__cling"))
++                if (Identifier->getName().starts_with("__cling"))
+                 {
+                     return true;
+                 }
+@@ -153,12 +154,13 @@ namespace xcpp
+         if (EnableDebugInfo)
+         {
+             CodeGenOpts.setDebugInfo(
+-                clang::codegenoptions::DebugInfoKind::FullDebugInfo);
++                llvm::codegenoptions::DebugInfoKind::FullDebugInfo);
+         }
+ 
+         std::unique_ptr<clang::CodeGenerator> CG(clang::CreateLLVMCodeGen(
+-            CI->getDiagnostics(), "object", HeaderSearchOpts,
+-            CI->getPreprocessorOpts(), CodeGenOpts, *Context));
++            CI->getDiagnostics(), "object", 
++            llvm::IntrusiveRefCntPtr<llvm::vfs::FileSystem>(&CI->getVirtualFileSystem()),
++            HeaderSearchOpts, CI->getPreprocessorOpts(), CodeGenOpts, *Context));
+         CG->Initialize(AST);
+ 
+         FindTopLevelDecls Visitor(CG.get());
+@@ -186,7 +188,9 @@ namespace xcpp
+         EmitBackendOutput(CI->getDiagnostics(), HeaderSearchOpts,
+                           CodeGenOpts, CI->getTargetOpts(),
+                           CI->getLangOpts(), DataLayout, CG->GetModule(),
+-                          clang::Backend_EmitObj, std::move(OS));
++                          clang::Backend_EmitObj, 
++                          llvm::IntrusiveRefCntPtr<llvm::vfs::FileSystem>(&CI->getVirtualFileSystem()),
++                          std::move(OS));
+         return true;
+     }
+ 
+@@ -222,10 +226,10 @@ namespace xcpp
+ 
+         llvm::StringRef OutputFileStr(OutputFile);
+         llvm::StringRef ErrorFileStr(ErrorFile);
+-        llvm::SmallVector<llvm::Optional<llvm::StringRef>, 16> Redirects = {llvm::NoneType::None, OutputFileStr, ErrorFileStr};
++        llvm::SmallVector<std::optional<llvm::StringRef>, 16> Redirects = {std::nullopt, OutputFileStr, ErrorFileStr};
+ 
+         // Finally run the linker.
+-        int ret = llvm::sys::ExecuteAndWait(Compiler, Args, llvm::NoneType::None,
++        int ret = llvm::sys::ExecuteAndWait(Compiler, Args, std::nullopt,
+                                             Redirects);
+ 
+         // Read back output and error streams.

pkgs/applications/editors/jupyter-kernels/xeus-cling/xeus-cling.nix

@@ -3,7 +3,7 @@
   clangStdenv,
   cmake,
   fetchFromGitHub,
-  llvmPackages_13,
+  llvmPackages_18,
   # Libraries
   argparse,
   cling,
@@ -65,6 +65,7 @@ clangStdenv.mkDerivation rec {
   patches = [
     ./0001-Fix-bug-in-extract_filename.patch
     ./0002-Don-t-pass-extra-includes-configure-this-with-flags.patch
+    ./0003-Remove-unsupported-src-root-flag.patch
   ];
 
   nativeBuildInputs = [ cmake ];
@@ -73,7 +74,7 @@ clangStdenv.mkDerivation rec {
     cling.unwrapped
     cppzmq
     libuuid
-    llvmPackages_13.llvm
+    llvmPackages_18.llvm
     ncurses
     openssl
     pugixml

pkgs/applications/editors/vscode/extensions/continue.continue/default.nix

@@ -0,0 +1,55 @@
+{
+  autoPatchelfHook,
+  lib,
+  stdenv,
+  vscode-utils,
+}:
+
+vscode-utils.buildVscodeMarketplaceExtension {
+  mktplcRef =
+    let
+      sources = {
+        "x86_64-linux" = {
+          arch = "linux-x64";
+          hash = "sha256-HXyY96fP9WjGWIe6ggQvygBnTEKRLUb5Qy18Vbjn160=";
+        };
+        "x86_64-darwin" = {
+          arch = "darwin-x64";
+          hash = "sha256-2b04CLmbOxXsTzheEUacqZuBtA/rSZqRMLor0lT2gsU=";
+        };
+        "aarch64-linux" = {
+          arch = "linux-arm64";
+          hash = "sha256-/eKZ3bkZ2jFr8cTpNLO6t8wsRfLyhLkQHMrkTWtCWb8=";
+        };
+        "aarch64-darwin" = {
+          arch = "darwin-arm64";
+          hash = "sha256-JRVrV2yYSfuwuBcM2MDJZz5vNRYHG4n6I/GozgdDOgk=";
+        };
+      };
+    in
+    {
+      name = "continue";
+      publisher = "Continue";
+      version = "1.1.76";
+    }
+    // sources.${stdenv.system} or (throw "Unsupported system: ${stdenv.system}");
+  nativeBuildInputs = lib.optionals stdenv.hostPlatform.isLinux [ autoPatchelfHook ];
+  buildInputs = [ (lib.getLib stdenv.cc.cc) ];
+  meta = {
+    changelog = "https://marketplace.visualstudio.com/items/Continue.continue";
+    description = "Open-source AI code assistant";
+    downloadPage = "https://marketplace.visualstudio.com/items?itemName=Continue.continue";
+    homepage = "https://github.com/continuedev/continue";
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [
+      raroh73
+      flacks
+    ];
+    platforms = [
+      "x86_64-linux"
+      "x86_64-darwin"
+      "aarch64-darwin"
+      "aarch64-linux"
+    ];
+  };
+}

pkgs/applications/editors/vscode/extensions/default.nix

@@ -1071,50 +1071,7 @@ let
         callPackage ./contextmapper.context-mapper-vscode-extension
           { };
 
-      continue.continue = buildVscodeMarketplaceExtension {
-        mktplcRef =
-          let
-            sources = {
-              "x86_64-linux" = {
-                arch = "linux-x64";
-                hash = "sha256-mm7/ITiXuSrFrAwRPVYYJ6l5b4ODyiCPv5H+WioDAWY=";
-              };
-              "x86_64-darwin" = {
-                arch = "darwin-x64";
-                hash = "sha256-ySFiSJ+6AgxECzekBIlPl2BhWJvt5Rf1DFqg6b/6PDs=";
-              };
-              "aarch64-linux" = {
-                arch = "linux-arm64";
-                hash = "sha256-zqvhlA9APWtJowCOceB52HsfU3PaAWciZWxY/QcOYgg=";
-              };
-              "aarch64-darwin" = {
-                arch = "darwin-arm64";
-                hash = "sha256-CjzAntSjbYlauVptCnqE/HpwdudoGaTMML6Fyzj48pU=";
-              };
-            };
-          in
-          {
-            name = "continue";
-            publisher = "Continue";
-            version = "1.1.49";
-          }
-          // sources.${stdenv.system} or (throw "Unsupported system: ${stdenv.system}");
-        nativeBuildInputs = lib.optionals stdenv.hostPlatform.isLinux [ autoPatchelfHook ];
-        buildInputs = [ (lib.getLib stdenv.cc.cc) ];
-        meta = {
-          description = "Open-source autopilot for software development - bring the power of ChatGPT to your IDE";
-          downloadPage = "https://marketplace.visualstudio.com/items?itemName=Continue.continue";
-          homepage = "https://github.com/continuedev/continue";
-          license = lib.licenses.asl20;
-          maintainers = [ lib.maintainers.raroh73 ];
-          platforms = [
-            "x86_64-linux"
-            "x86_64-darwin"
-            "aarch64-darwin"
-            "aarch64-linux"
-          ];
-        };
-      };
+      continue.continue = callPackage ./continue.continue { };
 
       coolbear.systemd-unit-file = buildVscodeMarketplaceExtension {
         mktplcRef = {
@@ -4457,8 +4414,8 @@ let
         mktplcRef = {
           publisher = "streetsidesoftware";
           name = "code-spell-checker";
-          version = "4.0.47";
-          hash = "sha256-g9r8I909ge44JfBRm1JBHFluXr9H8zl0ERqkwoxtQaI=";
+          version = "4.2.6";
+          hash = "sha256-veP2G/5vcaimjd98ur6Mhl4x1NKuvS21oO+HFJLHN+I=";
         };
         meta = {
           changelog = "https://marketplace.visualstudio.com/items/streetsidesoftware.code-spell-checker/changelog";
@@ -5530,8 +5487,8 @@ let
         mktplcRef = {
           name = "vscode-zig";
           publisher = "ziglang";
-          version = "0.6.12";
-          hash = "sha256-7oZWKk7qqG9maGcjurpsbD1frIH/g+KKe4F2BXmqTeo=";
+          version = "0.6.13";
+          hash = "sha256-4DYsSGqWa+jbD8tguULFQLdhKluXK8skj9nSst9UX8U=";
         };
         meta = {
           changelog = "https://marketplace.visualstudio.com/items/ziglang.vscode-zig/changelog";

pkgs/applications/editors/vscode/extensions/ms-dotnettools.csharp/default.nix

@@ -1,6 +1,7 @@
 {
   lib,
   stdenv,
+  fetchzip,
   vscode-utils,
   autoPatchelfHook,
   icu,
@@ -17,29 +18,41 @@ let
     {
       x86_64-linux = {
         arch = "linux-x64";
-        hash = "sha256-PlA1uuudUPnKCas5brviS8ZMDweFEdti6N5fu8XCzvY=";
+        hash = "sha256-FPhB2oWx5x/qr2k4sAg8w2Wx+LvW/Syfc/u8nnTCQFU=";
       };
       aarch64-linux = {
         arch = "linux-arm64";
-        hash = "sha256-DyOT9AZAdW48G7SZfiFdveY9JwZDZjtT4Mp/LYY2JRk=";
+        hash = "sha256-qVZ9Go+/mVIoUr8Qt/kJv8gvOWd7NLu1wk7YZ2v6Lw8=";
       };
       x86_64-darwin = {
         arch = "darwin-x64";
-        hash = "sha256-vew5YkrX7soPNiYO+KX5Uy2HOiJ701YWWZULtH5Aq+I=";
+        hash = "sha256-7G9t84clyi4T3k7FxoPIfaIs4VabBTvGilTptd3AHOw=";
       };
       aarch64-darwin = {
         arch = "darwin-arm64";
-        hash = "sha256-rc6KVNZWNJYt8RkbqyPB4Q7aJB6jtlWMsd4UHGbqsoI=";
+        hash = "sha256-fmWlcLVUUY6Ekx5mtsBYFrYFdXpSUg8PctDBUovETV4=";
       };
     }
     .${stdenv.hostPlatform.system} or (throw "Unsupported system: ${stdenv.hostPlatform.system}")
   );
+
+  # Get url from runtimeDependencies in package.json
+  # TODO: Automate fetching runtimeDependencies from package.json
+  #       ideally should be done at the vscode-extensions level for
+  #       everyone to reuse.
+  roslyn-copilot = fetchzip {
+    url = "https://roslyn.blob.core.windows.net/releases/Microsoft.VisualStudio.Copilot.Roslyn.LanguageServer-18.0.479-alpha.zip";
+    hash = "sha256-xq66gY3N3/R9bG6XWqLy53T/ExzGdZi3ZBNEzYAeqM8=";
+    postFetch = ''
+      touch install.Lock
+    '';
+  };
 in
 vscode-utils.buildVscodeMarketplaceExtension {
   mktplcRef = {
     name = "csharp";
     publisher = "ms-dotnettools";
-    version = "2.87.31";
+    version = "2.89.19";
     inherit (extInfo) hash arch;
   };
 
@@ -62,6 +75,10 @@ vscode-utils.buildVscodeMarketplaceExtension {
       --replace-fail 'uname -m' '${lib.getExe' coreutils "uname"} -m'
   '';
 
+  postInstall = ''
+    ln -s ${roslyn-copilot} "$out"/share/vscode/extensions/ms-dotnettools.csharp/.roslynCopilot
+  '';
+
   preFixup = ''
     (
       set -euo pipefail

pkgs/applications/emulators/libretro/cores/dosbox-pure.nix

@@ -5,13 +5,13 @@
 }:
 mkLibretroCore {
   core = "dosbox-pure";
-  version = "0-unstable-2025-08-03";
+  version = "0-unstable-2025-09-04";
 
   src = fetchFromGitHub {
     owner = "schellingb";
     repo = "dosbox-pure";
-    rev = "935b33b892b55ab5e12a093795a6563af9eacb78";
-    hash = "sha256-19ehYyVOnYg3b1cvuznYn3zB9rhp2xULKhdFN/FKE4U=";
+    rev = "a1c81ef494d2ac7a136b330edecbe855fb38b18a";
+    hash = "sha256-jMJCEoSQi1svbXLyKc4+TRubw7zDpqeql0pstaLs7O4=";
   };
 
   hardeningDisable = [ "format" ];

pkgs/applications/emulators/libretro/cores/fceumm.nix

@@ -5,13 +5,13 @@
 }:
 mkLibretroCore {
   core = "fceumm";
-  version = "0-unstable-2025-05-02";
+  version = "0-unstable-2025-09-03";
 
   src = fetchFromGitHub {
     owner = "libretro";
     repo = "libretro-fceumm";
-    rev = "3544ff567ecc417c170641587083b976739ef9db";
-    hash = "sha256-eNmzWLJVPeqFFEcFIhOQCn9OMrBp0iraTcft5pJVvvE=";
+    rev = "a5dbb223fc27cc4c7763c977682cfe3b3450d482";
+    hash = "sha256-K52Q9KDMgUUY5kmWNuMcZhib5nPdITMt5hXFyDPX+MU=";
   };
 
   meta = {

pkgs/applications/emulators/libretro/cores/play.nix

@@ -14,13 +14,13 @@
 }:
 mkLibretroCore {
   core = "play";
-  version = "0-unstable-2025-08-20";
+  version = "0-unstable-2025-08-25";
 
   src = fetchFromGitHub {
     owner = "jpd002";
     repo = "Play-";
-    rev = "7062c5e67a4a90b75fe1d0221c43f678a0d049b6";
-    hash = "sha256-PnZNcy69o0Fi2gfC7gDXyo6wUykdG4NxKumEl9P8K9Y=";
+    rev = "fe54d0a413f8e7268bc8a321e691a562edd6b257";
+    hash = "sha256-d+bVkM8BsZ9eiHaSNCC4b156EjOqyQn93lOyy6FLbks=";
     fetchSubmodules = true;
   };
 

pkgs/applications/emulators/mame/default.nix

@@ -37,14 +37,14 @@
 
 stdenv.mkDerivation rec {
   pname = "mame";
-  version = "0.279";
+  version = "0.280";
   srcVersion = builtins.replaceStrings [ "." ] [ "" ] version;
 
   src = fetchFromGitHub {
     owner = "mamedev";
     repo = "mame";
     rev = "mame${srcVersion}";
-    hash = "sha256-EMb2GK/9KBvZw3HqZwLeqzmQLpgIzJocipzR+F3vUMg=";
+    hash = "sha256-+bXohqzecHvXt9DKPbBBQoq9RX/LPX0O6kJf64wIrW8=";
   };
 
   outputs = [

pkgs/applications/networking/cluster/k3s/1_30/chart-versions.nix

@@ -1,10 +0,0 @@
-{
-  traefik-crd = {
-    url = "https://k3s.io/k3s-charts/assets/traefik-crd/traefik-crd-27.0.201+up27.0.2.tgz";
-    sha256 = "0vwprcb60y15sc4lmi58gl1zr3yhsq43jlbsfm7gs20ci90frv16";
-  };
-  traefik = {
-    url = "https://k3s.io/k3s-charts/assets/traefik/traefik-27.0.201+up27.0.2.tgz";
-    sha256 = "12dp1r82qfzqfzs4sfxc54rnw8kv42a3w4gpk5v3qkhqm6fkrnn1";
-  };
-}

pkgs/applications/networking/cluster/k3s/1_30/images-versions.json

@@ -1,26 +0,0 @@
-{
-  "airgap-images-amd64-tar-gz": {
-    "url": "https://github.com/k3s-io/k3s/releases/download/v1.30.14%2Bk3s2/k3s-airgap-images-amd64.tar.gz",
-    "sha256": "f98a57f7b25a4537096fbe9755f96cfd05bfe6fc6315f111c0f44e1abf4aad6d"
-  },
-  "airgap-images-amd64-tar-zst": {
-    "url": "https://github.com/k3s-io/k3s/releases/download/v1.30.14%2Bk3s2/k3s-airgap-images-amd64.tar.zst",
-    "sha256": "9bda99cde833c4e13fb4d35fa46fd57d4b1a2eefc33e00fa352ce686c871c842"
-  },
-  "airgap-images-arm-tar-gz": {
-    "url": "https://github.com/k3s-io/k3s/releases/download/v1.30.14%2Bk3s2/k3s-airgap-images-arm.tar.gz",
-    "sha256": "33df3a2b155118198c48e66426a04292a348aa53fef126a3cb8e4fe7aea83ccc"
-  },
-  "airgap-images-arm-tar-zst": {
-    "url": "https://github.com/k3s-io/k3s/releases/download/v1.30.14%2Bk3s2/k3s-airgap-images-arm.tar.zst",
-    "sha256": "d40a78ff14b40547bca6d05db3d7e767b272bb9257628ebd3905d1659bc49bd5"
-  },
-  "airgap-images-arm64-tar-gz": {
-    "url": "https://github.com/k3s-io/k3s/releases/download/v1.30.14%2Bk3s2/k3s-airgap-images-arm64.tar.gz",
-    "sha256": "bba9c2e417ece797a5ae8bf9346bb35dc8ab163828c801a2cb512d6097610b52"
-  },
-  "airgap-images-arm64-tar-zst": {
-    "url": "https://github.com/k3s-io/k3s/releases/download/v1.30.14%2Bk3s2/k3s-airgap-images-arm64.tar.zst",
-    "sha256": "6561f91f14c8419c9d1c20fb9af7948757d87bd91855b376058d9f2e16010452"
-  }
-}

pkgs/applications/networking/cluster/k3s/1_30/versions.nix

@@ -1,15 +0,0 @@
-{
-  k3sVersion = "1.30.14+k3s2";
-  k3sCommit = "071b1ead43641c6803e0b9fce6473baeb12357cf";
-  k3sRepoSha256 = "0lldw9kgzpr1073zsr5y4jxmh1c8ah4giyxzb10rfcwx06mglmir";
-  k3sVendorHash = "sha256-qEvdBT3noOtKdIdHDJZChowXzQMpVpY/l1ioTJCGVJ4=";
-  chartVersions = import ./chart-versions.nix;
-  imagesVersions = builtins.fromJSON (builtins.readFile ./images-versions.json);
-  k3sRootVersion = "0.14.1";
-  k3sRootSha256 = "0svbi42agqxqh5q2ri7xmaw2a2c70s7q5y587ls0qkflw5vx4sl7";
-  k3sCNIVersion = "1.7.1-k3s1";
-  k3sCNISha256 = "0k1qfmsi5bqgwd5ap8ndimw09hsxn0cqf4m5ad5a4mgl6akw6dqz";
-  containerdVersion = "1.7.27-k3s1";
-  containerdSha256 = "1w6ia9a7qs06l9wh44fpf1v2ckf2lfp9sjzk0bg4fjw5ds9sxws0";
-  criCtlVersion = "1.29.0-k3s1";
-}

pkgs/applications/networking/cluster/k3s/1_31/images-versions.json

@@ -1,26 +1,26 @@
 {
   "airgap-images-amd64-tar-gz": {
-    "url": "https://github.com/k3s-io/k3s/releases/download/v1.31.11%2Bk3s1/k3s-airgap-images-amd64.tar.gz",
-    "sha256": "fa4f87e7e82c0e613f854eedf8f64d2cdabbd127f3ae84707ed1ca59e2137855"
+    "url": "https://github.com/k3s-io/k3s/releases/download/v1.31.12%2Bk3s1/k3s-airgap-images-amd64.tar.gz",
+    "sha256": "a6899f064a179d0681b5e18f5b82fa10120badf8e74c79a4eedebe000a9eaa56"
   },
   "airgap-images-amd64-tar-zst": {
-    "url": "https://github.com/k3s-io/k3s/releases/download/v1.31.11%2Bk3s1/k3s-airgap-images-amd64.tar.zst",
-    "sha256": "c98ad7590af33ef7e148920eb809dfd0f8145a623fdd8d32c6efeecab6088412"
+    "url": "https://github.com/k3s-io/k3s/releases/download/v1.31.12%2Bk3s1/k3s-airgap-images-amd64.tar.zst",
+    "sha256": "d253cfce051c549a3ed0826d60e5c7bec7bbd9f8a64f98a9d5ec8238e9914cc3"
   },
   "airgap-images-arm-tar-gz": {
-    "url": "https://github.com/k3s-io/k3s/releases/download/v1.31.11%2Bk3s1/k3s-airgap-images-arm.tar.gz",
-    "sha256": "0b6009407069fdd684d9627c5fa4bdb31ea4644172f1f429a2cce15d2c18631d"
+    "url": "https://github.com/k3s-io/k3s/releases/download/v1.31.12%2Bk3s1/k3s-airgap-images-arm.tar.gz",
+    "sha256": "74e897222e53a2750b3ee8249964e0e47fa5c5caae9d611a18499be6b51cdee3"
   },
   "airgap-images-arm-tar-zst": {
-    "url": "https://github.com/k3s-io/k3s/releases/download/v1.31.11%2Bk3s1/k3s-airgap-images-arm.tar.zst",
-    "sha256": "c1bd7557836538592dbd59f798e7a4b91d7aef74c8f9f71631060c96a5288dd6"
+    "url": "https://github.com/k3s-io/k3s/releases/download/v1.31.12%2Bk3s1/k3s-airgap-images-arm.tar.zst",
+    "sha256": "162a158c191591ec4ca3b7f446fdf9e23eb8366407091b992087abdc6349325f"
   },
   "airgap-images-arm64-tar-gz": {
-    "url": "https://github.com/k3s-io/k3s/releases/download/v1.31.11%2Bk3s1/k3s-airgap-images-arm64.tar.gz",
-    "sha256": "6fa41db4ee001c1db8a404dd38f17f2426f27f688f9f7a2a76f4ef336f51c886"
+    "url": "https://github.com/k3s-io/k3s/releases/download/v1.31.12%2Bk3s1/k3s-airgap-images-arm64.tar.gz",
+    "sha256": "313e268ab348dd8d4708928e7bc0fb45b7f518aeb7dfaa9631d3d7d61ba1f8be"
   },
   "airgap-images-arm64-tar-zst": {
-    "url": "https://github.com/k3s-io/k3s/releases/download/v1.31.11%2Bk3s1/k3s-airgap-images-arm64.tar.zst",
-    "sha256": "97f0db38f57a2dc63167795620ba34a89348d874ecc91fbf3d8d962dc1392e47"
+    "url": "https://github.com/k3s-io/k3s/releases/download/v1.31.12%2Bk3s1/k3s-airgap-images-arm64.tar.zst",
+    "sha256": "60f19d4935f5b4b2b776c634eb9701268b94ccd100fc9c2968c096ba1fb5154f"
   }
 }

pkgs/applications/networking/cluster/k3s/1_31/versions.nix

@@ -1,8 +1,8 @@
 {
-  k3sVersion = "1.31.11+k3s1";
-  k3sCommit = "17cfde1c82427535f0d3b6fe15caef1a0e62e82f";
-  k3sRepoSha256 = "17dmk8r1rjv2wv4kfyrsdyb9xp696ckq79lzjkvh89x8g31b6p1h";
-  k3sVendorHash = "sha256-ogyFEWnTBYjpz9clO3v5DyO23mHPhUS+JC587kLJ5Ck=";
+  k3sVersion = "1.31.12+k3s1";
+  k3sCommit = "2b53c7e4c81742fbb2b0e7e90e3bb907d1fe0e24";
+  k3sRepoSha256 = "07pi1vjpm01q2riq0dic6p27nqj4wzwwzllxgmr7gfim1xx643gd";
+  k3sVendorHash = "sha256-osqhQJq+Qst3LpYdhXkAY6Pxay381PmoxD5Ji/ZV86Q=";
   chartVersions = import ./chart-versions.nix;
   imagesVersions = builtins.fromJSON (builtins.readFile ./images-versions.json);
   k3sRootVersion = "0.14.1";

pkgs/applications/networking/cluster/k3s/1_32/images-versions.json

@@ -1,26 +1,26 @@
 {
   "airgap-images-amd64-tar-gz": {
-    "url": "https://github.com/k3s-io/k3s/releases/download/v1.32.7%2Bk3s1/k3s-airgap-images-amd64.tar.gz",
-    "sha256": "f6a8720aa9bb03d0c8a97a93e994557292f1efba1fa6648cd8a07830622ce748"
+    "url": "https://github.com/k3s-io/k3s/releases/download/v1.32.8%2Bk3s1/k3s-airgap-images-amd64.tar.gz",
+    "sha256": "b2b652c75ad0e2138ed3925e43c12bd9b79be8a42a577dde9dcb518933e5501b"
   },
   "airgap-images-amd64-tar-zst": {
-    "url": "https://github.com/k3s-io/k3s/releases/download/v1.32.7%2Bk3s1/k3s-airgap-images-amd64.tar.zst",
-    "sha256": "965f5767c08cffc96bf0967813e7c3fec4c41309e9952a480f0a50865bebd039"
+    "url": "https://github.com/k3s-io/k3s/releases/download/v1.32.8%2Bk3s1/k3s-airgap-images-amd64.tar.zst",
+    "sha256": "3f690edd5e28c28ea3a52beb3ec009726f6e72f4a67096f2ce2b1a4fa3b01e3d"
   },
   "airgap-images-arm-tar-gz": {
-    "url": "https://github.com/k3s-io/k3s/releases/download/v1.32.7%2Bk3s1/k3s-airgap-images-arm.tar.gz",
-    "sha256": "9aa6f9f33e58e04fb9d8f9cd5c51dd01c6092d7b5434f84341b2f74bc8de783e"
+    "url": "https://github.com/k3s-io/k3s/releases/download/v1.32.8%2Bk3s1/k3s-airgap-images-arm.tar.gz",
+    "sha256": "343fa41d0c67b1b1bb4cd962b0f8d5f9cf175ef1b3bca4348cdbf91670a1d782"
   },
   "airgap-images-arm-tar-zst": {
-    "url": "https://github.com/k3s-io/k3s/releases/download/v1.32.7%2Bk3s1/k3s-airgap-images-arm.tar.zst",
-    "sha256": "57ab9c306cc96f8dd925bc788c80e49c2d13ee7a222a12235fb525529ad25ac0"
+    "url": "https://github.com/k3s-io/k3s/releases/download/v1.32.8%2Bk3s1/k3s-airgap-images-arm.tar.zst",
+    "sha256": "efc96a222a2fd0b13104e6fd87dd6bbda9a96abeb20a1a1cc203044ce0a38749"
   },
   "airgap-images-arm64-tar-gz": {
-    "url": "https://github.com/k3s-io/k3s/releases/download/v1.32.7%2Bk3s1/k3s-airgap-images-arm64.tar.gz",
-    "sha256": "9633b71655ed0f4af556c148f9bf7753221b3c9b42a8d902391187789302adca"
+    "url": "https://github.com/k3s-io/k3s/releases/download/v1.32.8%2Bk3s1/k3s-airgap-images-arm64.tar.gz",
+    "sha256": "04ac1b2f03bceb238ad600ef70ca7a78672d741e8ce430749b8eedbb1dd0ac47"
   },
   "airgap-images-arm64-tar-zst": {
-    "url": "https://github.com/k3s-io/k3s/releases/download/v1.32.7%2Bk3s1/k3s-airgap-images-arm64.tar.zst",
-    "sha256": "1aa05a55492ba0872fa8a0ff518d6e947869bea32dc2b8e5223bdcf53450c7f9"
+    "url": "https://github.com/k3s-io/k3s/releases/download/v1.32.8%2Bk3s1/k3s-airgap-images-arm64.tar.zst",
+    "sha256": "d76ec4a39d66da2a98e7c55dc6811350b4333a2eeae9c0bd4fc401203d92d9e8"
   }
 }

pkgs/applications/networking/cluster/k3s/1_32/versions.nix

@@ -1,8 +1,8 @@
 {
-  k3sVersion = "1.32.7+k3s1";
-  k3sCommit = "ab99e9da82c7072e4d9efbfa9464e343846fae72";
-  k3sRepoSha256 = "0srs8nrmnqsxlyhbbd7i18vbk5c55c16xg278958wi3lbwang0b2";
-  k3sVendorHash = "sha256-vKTujaFATguUtIorfa7bY8lSQsx6RhFx0sdWencR2nc=";
+  k3sVersion = "1.32.8+k3s1";
+  k3sCommit = "fe896f7e7cf8be1cfffe7151c6860deb08e2a005";
+  k3sRepoSha256 = "1knj7jzxb70zvqjn7pbjz78cm06w0402id5frib94y0i4rsmqd6g";
+  k3sVendorHash = "sha256-MbXTUvdnoLFVGYKEGBYWNkuL2Es0Io4q2E5qaUptwRQ=";
   chartVersions = import ./chart-versions.nix;
   imagesVersions = builtins.fromJSON (builtins.readFile ./images-versions.json);
   k3sRootVersion = "0.14.1";

pkgs/applications/networking/cluster/k3s/1_33/images-versions.json

@@ -1,26 +1,26 @@
 {
   "airgap-images-amd64-tar-gz": {
-    "url": "https://github.com/k3s-io/k3s/releases/download/v1.33.3%2Bk3s1/k3s-airgap-images-amd64.tar.gz",
-    "sha256": "64690dc963f6cbff8adb175a1bc41e6bf207734a9a214362544a36361a2d8350"
+    "url": "https://github.com/k3s-io/k3s/releases/download/v1.33.4%2Bk3s1/k3s-airgap-images-amd64.tar.gz",
+    "sha256": "13832518d409f950121a9c681b878f868120c73d42d3823f55cea49f61b69497"
   },
   "airgap-images-amd64-tar-zst": {
-    "url": "https://github.com/k3s-io/k3s/releases/download/v1.33.3%2Bk3s1/k3s-airgap-images-amd64.tar.zst",
-    "sha256": "51b6ddeafa465e542f0707272736100916886dd49abcb1420ee52878dd3638a9"
+    "url": "https://github.com/k3s-io/k3s/releases/download/v1.33.4%2Bk3s1/k3s-airgap-images-amd64.tar.zst",
+    "sha256": "1a3738a77c4a3fef4a85c16d7f2eadcd337605f9279fcddbc3eb4f982fbd2238"
   },
   "airgap-images-arm-tar-gz": {
-    "url": "https://github.com/k3s-io/k3s/releases/download/v1.33.3%2Bk3s1/k3s-airgap-images-arm.tar.gz",
-    "sha256": "878d17722dd98e7d88de93a83606e0c9b0d7587c7e4a043559b5236a353fb224"
+    "url": "https://github.com/k3s-io/k3s/releases/download/v1.33.4%2Bk3s1/k3s-airgap-images-arm.tar.gz",
+    "sha256": "94b084b7f9756e986855301658af957042e3ebb7c71848860f823b35844e98fa"
   },
   "airgap-images-arm-tar-zst": {
-    "url": "https://github.com/k3s-io/k3s/releases/download/v1.33.3%2Bk3s1/k3s-airgap-images-arm.tar.zst",
-    "sha256": "339dd2b33b40f03bf95ee2e5dcb8e543ab6852e156cb8aaebe3885717a2966b5"
+    "url": "https://github.com/k3s-io/k3s/releases/download/v1.33.4%2Bk3s1/k3s-airgap-images-arm.tar.zst",
+    "sha256": "1be4d940daea065ad97bc254882b12fb30af2f13ed2b26a7cd16aeacec29f048"
   },
   "airgap-images-arm64-tar-gz": {
-    "url": "https://github.com/k3s-io/k3s/releases/download/v1.33.3%2Bk3s1/k3s-airgap-images-arm64.tar.gz",
-    "sha256": "e4ab063deb50241e60218a3a30ce090a5817daa0f38dacd10651e27b2be28b9e"
+    "url": "https://github.com/k3s-io/k3s/releases/download/v1.33.4%2Bk3s1/k3s-airgap-images-arm64.tar.gz",
+    "sha256": "a89d7916b65ed066e761fe07831aa157b91b30bc1369ea9be3d1e5f0fe1dc74c"
   },
   "airgap-images-arm64-tar-zst": {
-    "url": "https://github.com/k3s-io/k3s/releases/download/v1.33.3%2Bk3s1/k3s-airgap-images-arm64.tar.zst",
-    "sha256": "c12ec7b122f34eb1f89310b05e66b500a2f49522d7cd4ceb3475a675cab6ebc6"
+    "url": "https://github.com/k3s-io/k3s/releases/download/v1.33.4%2Bk3s1/k3s-airgap-images-arm64.tar.zst",
+    "sha256": "6d898c35a9dc96d427f4258605ce61daf7587f26ea2822b711896224b746b38f"
   }
 }

pkgs/applications/networking/cluster/k3s/1_33/versions.nix

@@ -1,8 +1,8 @@
 {
-  k3sVersion = "1.33.3+k3s1";
-  k3sCommit = "236cbf257332b293f444abe6f24d699ff628173e";
-  k3sRepoSha256 = "163brwnz4af1rjv5pcghlzjnwr27b087y73bv6pri0fyqd3mwiim";
-  k3sVendorHash = "sha256-rU+rpExb9LVIROPj3MN924r7Hk8sK/5P8JSssOoIWTU=";
+  k3sVersion = "1.33.4+k3s1";
+  k3sCommit = "148243c49519922720fe1b340008dbce8fb02516";
+  k3sRepoSha256 = "1870l3mq5nsh8i82wvwsz7nqiv1xzyqypm66rfmp999s2qlssyaa";
+  k3sVendorHash = "sha256-JbnoV8huyOS7Q91QjqTKvPEtkYQxjR10o0d5z25Ycsg=";
   chartVersions = import ./chart-versions.nix;
   imagesVersions = builtins.fromJSON (builtins.readFile ./images-versions.json);
   k3sRootVersion = "0.14.1";

pkgs/applications/networking/cluster/k3s/builder.nix

@@ -127,8 +127,14 @@ let
   ];
 
   # bundled into the k3s binary
-  traefikChart = fetchurl chartVersions.traefik;
-  traefik-crdChart = fetchurl chartVersions.traefik-crd;
+  traefik = {
+    chart = fetchurl chartVersions.traefik;
+    name = builtins.baseNameOf chartVersions.traefik.url;
+  };
+  traefik-crd = {
+    chart = fetchurl chartVersions.traefik-crd;
+    name = builtins.baseNameOf chartVersions.traefik-crd.url;
+  };
 
   # a shortcut that provides the images archive for the host platform. Currently only supports
   # aarch64 (arm64) and x86_64 (amd64), throws on other architectures.
@@ -267,6 +273,18 @@ let
         "linux"
       ];
 
+      # Set flags for sqlite dbstat
+      CGO_CFLAGS = "-DSQLITE_ENABLE_DBSTAT_VTAB=1 -DSQLITE_USE_ALLOCA=1";
+
+      # Copy manifests and static charts pre build so they get embedded during build
+      preBuild = ''
+        cp -av manifests/* ./pkg/deploy/embed/
+
+        mkdir -p ./pkg/static/embed/charts/
+        cp -v ${traefik.chart} ./pkg/static/embed/charts/${traefik.name}
+        cp -v ${traefik-crd.chart} ./pkg/static/embed/charts/${traefik-crd.name}
+      '';
+
       # create the multicall symlinks for k3s
       postInstall = ''
         mv $out/bin/server $out/bin/k3s
@@ -402,10 +420,6 @@ buildGoModule rec {
     ln -vsf ${k3sCNIPlugins}/bin/cni ./bin/cni
     ln -vsf ${k3sContainerd}/bin/containerd-shim-runc-v2 ./bin
     rsync -a --no-perms --chmod u=rwX ${k3sRoot}/etc/ ./etc/
-    mkdir -p ./build/static/charts
-
-    cp ${traefikChart} ./build/static/charts
-    cp ${traefik-crdChart} ./build/static/charts
 
     export ARCH=$GOARCH
     export DRONE_TAG="v${k3sVersion}"

pkgs/applications/networking/cluster/k3s/default.nix

@@ -12,16 +12,6 @@ let
   extraArgs = builtins.removeAttrs args [ "callPackage" ];
 in
 {
-  k3s_1_30 = common (
-    (import ./1_30/versions.nix)
-    // {
-      updateScript = [
-        ./update-script.sh
-        "30"
-      ];
-    }
-  ) extraArgs;
-
   k3s_1_31 = common (
     (import ./1_31/versions.nix)
     // {

pkgs/applications/networking/cluster/nomad/default.nix

@@ -40,10 +40,10 @@ let
           inherit hash;
         };
 
-        # Nomad requires Go 1.24.4, but nixpkgs doesn't have it in unstable yet.
+        # Nomad requires Go 1.24.6, but nixpkgs doesn't have it in unstable yet.
         postPatch = ''
           substituteInPlace go.mod \
-            --replace-warn "go 1.24.4" "go 1.24.3"
+            --replace-warn "go 1.24.6" "go 1.24.5"
         '';
 
         nativeBuildInputs = [ installShellFiles ];
@@ -90,9 +90,9 @@ rec {
 
   nomad_1_10 = generic {
     buildGoModule = buildGo124Module;
-    version = "1.10.3";
-    hash = "sha256-sDOo7b32H/d5OJ6CRyga1rZZk55bFTi4ynHL/aIH87w=";
-    vendorHash = "sha256-bpCnpeRk329vUd9e6x7iCh+1ouSGd4o4Hq79K0qchJ8=";
+    version = "1.10.4";
+    hash = "sha256-lQtKSU0wcrU+HEUc6N/svpf5uAaWK68G5kY/tI2Sy8Q=";
+    vendorHash = "sha256-tclD02oinoypx80TLni+DUpB5mYKRBqsmScp2VsUDc0=";
     license = lib.licenses.bsl11;
     passthru.tests.nomad = nixosTests.nomad;
     preCheck = ''

pkgs/applications/networking/cluster/terraform-providers/providers.json

@@ -435,11 +435,11 @@
     "vendorHash": "sha256-oVTanZpCWs05HwyIKW2ajiBPz1HXOFzBAt5Us+EtTRw="
   },
   "equinix": {
-    "hash": "sha256-h/KqxQJVXBszpAxY8zYO8iQxwowtmRbDMdsHeOasjwQ=",
+    "hash": "sha256-bdcsm3160t46qR80M+j7mcTr/LfXd6FiSblEg1E7A20=",
     "homepage": "https://registry.terraform.io/providers/equinix/equinix",
     "owner": "equinix",
     "repo": "terraform-provider-equinix",
-    "rev": "v4.1.0",
+    "rev": "v4.2.0",
     "spdx": "MIT",
     "vendorHash": "sha256-65gJeUzeWB4BA76Mbw4eBScByyYyUqOl2/jwRVMJOVM="
   },
@@ -1030,11 +1030,11 @@
     "vendorHash": null
   },
   "pagerduty": {
-    "hash": "sha256-3KnXqCMvloBRT01Gfk8n9KSriSwP5FV8JPePevnPn60=",
+    "hash": "sha256-iRSd0olC82nr/Uzogg5DsiPAQIVLJRzM2wI9yubs/cw=",
     "homepage": "https://registry.terraform.io/providers/PagerDuty/pagerduty",
     "owner": "PagerDuty",
     "repo": "terraform-provider-pagerduty",
-    "rev": "v3.28.1",
+    "rev": "v3.28.2",
     "spdx": "MPL-2.0",
     "vendorHash": null
   },
@@ -1066,13 +1066,13 @@
     "vendorHash": "sha256-vT1n4FN0s9rQFj4HuXPm6lvNdzWZMyrzeWAanHOQqCg="
   },
   "postgresql": {
-    "hash": "sha256-d1m+aSQFgmL/m30707J1Ic+GdjCosr55tgGgxEU4GXE=",
+    "hash": "sha256-q4duDY9//BK5Jkg6stn0Ig4DJfzkc0gAkUua18XPgSM=",
     "homepage": "https://registry.terraform.io/providers/cyrilgdn/postgresql",
     "owner": "cyrilgdn",
     "repo": "terraform-provider-postgresql",
-    "rev": "v1.25.0",
+    "rev": "v1.26.0",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-2DWYW/NoNqchnfxEPBCFstzGuFKwXAXVmS9RqRWViWo="
+    "vendorHash": "sha256-wUd5cFXX/oc96WFyNKgQxw8kvYDiqwpDM84wbNml7LA="
   },
   "powerdns": {
     "hash": "sha256-NtJs2oNJbjUYNFsbrfo2RYhqOlKA15GJt9gi1HuTIw0=",
@@ -1264,22 +1264,22 @@
     "vendorHash": "sha256-4gtM8U//RXpYc4klCgpZS/3ZRzAHfcbOPTnNqlX4H7M="
   },
   "spacelift": {
-    "hash": "sha256-3YjA+x2pL0qzo2ucb8oK5+X+Zb5ewNQkDbizKKop6e0=",
+    "hash": "sha256-9mYWg/dIH1mkeNMwx+p/JwxG3s5swLbKuNfhi3Ksu8Q=",
     "homepage": "https://registry.terraform.io/providers/spacelift-io/spacelift",
     "owner": "spacelift-io",
     "repo": "terraform-provider-spacelift",
-    "rev": "v1.29.0",
+    "rev": "v1.31.0",
     "spdx": "MIT",
     "vendorHash": "sha256-D8VG9CWP4wo+cxb/ewP+b6qAeaBCu6lNwH2leoiBMAc="
   },
   "spotinst": {
-    "hash": "sha256-SGlNS6E96uXExu60D0WjRXB2YnsJoz4xfxfHe1/pYn8=",
+    "hash": "sha256-6FtJhxNj296yjwGJiJLwwWKA7nUaoaV89Zn2lfyuKxU=",
     "homepage": "https://registry.terraform.io/providers/spotinst/spotinst",
     "owner": "spotinst",
     "repo": "terraform-provider-spotinst",
-    "rev": "v1.225.1",
+    "rev": "v1.226.0",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-tfANShbNhWcMZvnJUIbErukbGZyPABVS4l0VKWcLqZA="
+    "vendorHash": "sha256-yDmZ2uJE31aumQ2lpkeL5LpEaniSElCMYUryYG0dYYQ="
   },
   "ssh": {
     "hash": "sha256-1UN5QJyjCuxs2vQYlSuz2jsu/HgGTxOoWWRcv4qcwow=",
@@ -1309,11 +1309,11 @@
     "vendorHash": "sha256-9M1DsE/FPQK8TG7xCJWbU3HAJCK3p/7lxdzjO1oAfWs="
   },
   "sumologic": {
-    "hash": "sha256-ogZQKIBlpj62Ileu81hJPLDMrEpG0Nhb7+rSZR08NYQ=",
+    "hash": "sha256-plDFznbeeDd33+YSJy2BIDB0hALcgqTE2NdacH4MALQ=",
     "homepage": "https://registry.terraform.io/providers/SumoLogic/sumologic",
     "owner": "SumoLogic",
     "repo": "terraform-provider-sumologic",
-    "rev": "v3.1.3",
+    "rev": "v3.1.4",
     "spdx": "MPL-2.0",
     "vendorHash": "sha256-IR6KjFW5GbsOIm3EEFyx3ctwhbifZlcNaZeGhbeK/Wo="
   },
@@ -1354,11 +1354,11 @@
     "vendorHash": "sha256-M3wnvRxMyU0Yo733E9e8Q++xVTuSXD0W3fB2C14RDNU="
   },
   "tencentcloud": {
-    "hash": "sha256-dhhQxSIsFngZ/bcZ9a1ECo98A8lu+egSi9znVRUVkBQ=",
+    "hash": "sha256-5Ue8PCe4RPA9ImzAuWj2LlxBbRCc0VQBb1AhX4vFB3g=",
     "homepage": "https://registry.terraform.io/providers/tencentcloudstack/tencentcloud",
     "owner": "tencentcloudstack",
     "repo": "terraform-provider-tencentcloud",
-    "rev": "v1.82.18",
+    "rev": "v1.82.20",
     "spdx": "MPL-2.0",
     "vendorHash": null
   },
@@ -1535,11 +1535,11 @@
     "vendorHash": "sha256-GRnVhGpVgFI83Lg34Zv1xgV5Kp8ioKTFV5uaqS80ATg="
   },
   "yandex": {
-    "hash": "sha256-42LhewtXX8TTRB6Xfz0iQaa1ldKm+YRmLm0s+LKvdic=",
+    "hash": "sha256-JTQnnJUr6qX1KilrwE1VQi74krq1ci4+iz/8jHaHmXY=",
     "homepage": "https://registry.terraform.io/providers/yandex-cloud/yandex",
     "owner": "yandex-cloud",
     "repo": "terraform-provider-yandex",
-    "rev": "v0.152.0",
+    "rev": "v0.156.0",
     "spdx": "MPL-2.0",
     "vendorHash": "sha256-LovDyADJeMQpIW3YqrdoNChmRf4XDBZK3DG/oOmtxOI="
   }

pkgs/applications/networking/remote/teamviewer/default.nix

@@ -30,7 +30,7 @@ mkDerivation rec {
     "out"
     "dev"
   ];
-  version = "15.68.5";
+  version = "15.69.4";
 
   src =
     let
@@ -39,11 +39,11 @@ mkDerivation rec {
     {
       x86_64-linux = fetchurl {
         url = "${base_url}/teamviewer_${version}_amd64.deb";
-        hash = "sha256-+MTp2ArZTcGFr1YwHIRfBIpjkRm0i9C1Pt5TzDE1SNE=";
+        hash = "sha256-GNGmqgiu4Vk0X+KndCkEoryFHG/Vv/P2xYdlzUJT1wo=";
       };
       aarch64-linux = fetchurl {
         url = "${base_url}/teamviewer_${version}_arm64.deb";
-        hash = "sha256-3IVZya1WTGl2AtQ2F9jyX2sDLBa2L2/sfsszhyvzu4A=";
+        hash = "sha256-M6Q6HIp7TgtqzVduMJM1au0i4/hDUUwdIoe3q36YA/0=";
       };
     }
     .${stdenv.hostPlatform.system} or (throw "Unsupported system: ${stdenv.hostPlatform.system}");

pkgs/applications/virtualization/docker/default.nix

@@ -1,6 +1,6 @@
 { lib, callPackage }:
 
-rec {
+let
   dockerGen =
     {
       version,
@@ -21,9 +21,8 @@ rec {
       # package dependencies
       stdenv,
       fetchFromGitHub,
-      fetchpatch,
       buildGoModule,
-      makeWrapper,
+      makeBinaryWrapper,
       installShellFiles,
       pkg-config,
       glibc,
@@ -33,7 +32,6 @@ rec {
       runc,
       tini,
       libtool,
-      bash,
       sqlite,
       iproute2,
       docker-buildx,
@@ -43,7 +41,7 @@ rec {
       iptables,
       e2fsprogs,
       xz,
-      util-linux,
+      util-linuxMinimal,
       xfsprogs,
       gitMinimal,
       procps,
@@ -62,6 +60,7 @@ rec {
       withSeccomp ? stdenv.hostPlatform.isLinux,
       libseccomp,
       knownVulnerabilities ? [ ],
+      versionCheckHook,
     }:
     let
       docker-meta = {
@@ -81,7 +80,7 @@ rec {
         src = fetchFromGitHub {
           owner = "opencontainers";
           repo = "runc";
-          rev = runcRev;
+          tag = runcRev;
           hash = runcHash;
         };
 
@@ -103,7 +102,7 @@ rec {
         src = fetchFromGitHub {
           owner = "containerd";
           repo = "containerd";
-          rev = containerdRev;
+          tag = containerdRev;
           hash = containerdHash;
         };
 
@@ -120,7 +119,7 @@ rec {
         src = fetchFromGitHub {
           owner = "krallin";
           repo = "tini";
-          rev = tiniRev;
+          tag = tiniRev;
           hash = tiniHash;
         };
 
@@ -138,12 +137,12 @@ rec {
       moby-src = fetchFromGitHub {
         owner = "moby";
         repo = "moby";
-        rev = mobyRev;
+        tag = mobyRev;
         hash = mobyHash;
       };
 
       moby = buildGoModule (
-        lib.optionalAttrs stdenv.hostPlatform.isLinux rec {
+        lib.optionalAttrs stdenv.hostPlatform.isLinux {
           pname = "moby";
           inherit version;
 
@@ -152,20 +151,21 @@ rec {
           vendorHash = null;
 
           nativeBuildInputs = [
-            makeWrapper
+            makeBinaryWrapper
             pkg-config
             go-md2man
             go
             libtool
             installShellFiles
           ];
+
           buildInputs = [
             sqlite
           ]
-          ++ lib.optional withLvm lvm2
-          ++ lib.optional withBtrfs btrfs-progs
-          ++ lib.optional withSystemd systemd
-          ++ lib.optional withSeccomp libseccomp;
+          ++ lib.optionals withLvm [ lvm2 ]
+          ++ lib.optionals withBtrfs [ btrfs-progs ]
+          ++ lib.optionals withSystemd [ systemd ]
+          ++ lib.optionals withSeccomp [ libseccomp ];
 
           extraPath = lib.optionals stdenv.hostPlatform.isLinux (
             lib.makeBinPath [
@@ -175,7 +175,7 @@ rec {
               xz
               xfsprogs
               procps
-              util-linux
+              util-linuxMinimal
               gitMinimal
             ]
           );
@@ -193,15 +193,21 @@ rec {
           '';
 
           buildPhase = ''
+            runHook preBuild
+
             export GOCACHE="$TMPDIR/go-cache"
             # build engine
             export AUTO_GOPATH=1
             export DOCKER_GITCOMMIT="${cliRev}"
             export VERSION="${version}"
             ./hack/make.sh dynbinary
+
+            runHook postBuild
           '';
 
           installPhase = ''
+            runHook preInstall
+
             install -Dm755 ./bundles/dynbinary-daemon/dockerd $out/libexec/docker/dockerd
             install -Dm755 ./bundles/dynbinary-daemon/docker-proxy $out/libexec/docker/docker-proxy
 
@@ -222,13 +228,16 @@ rec {
             install -Dm755 ./contrib/dockerd-rootless.sh $out/libexec/docker/dockerd-rootless.sh
             makeWrapper $out/libexec/docker/dockerd-rootless.sh $out/bin/dockerd-rootless \
               --prefix PATH : "$out/libexec/docker:$extraPath:$extraUserPath"
+
+            runHook postInstall
           '';
 
-          DOCKER_BUILDTAGS =
-            lib.optional withSystemd "journald"
-            ++ lib.optional (!withBtrfs) "exclude_graphdriver_btrfs"
-            ++ lib.optional (!withLvm) "exclude_graphdriver_devicemapper"
-            ++ lib.optional withSeccomp "seccomp";
+          env.DOCKER_BUILDTAGS = toString (
+            lib.optionals withSystemd [ "journald" ]
+            ++ lib.optionals (!withBtrfs) [ "exclude_graphdriver_btrfs" ]
+            ++ lib.optionals (!withLvm) [ "exclude_graphdriver_devicemapper" ]
+            ++ lib.optionals withSeccomp [ "seccomp" ]
+          );
 
           meta = docker-meta // {
             homepage = "https://mobyproject.org/";
@@ -238,33 +247,26 @@ rec {
       );
 
       plugins =
-        lib.optional buildxSupport docker-buildx
-        ++ lib.optional composeSupport docker-compose
-        ++ lib.optional sbomSupport docker-sbom
-        ++ lib.optional initSupport docker-init;
+        lib.optionals buildxSupport [ docker-buildx ]
+        ++ lib.optionals composeSupport [ docker-compose ]
+        ++ lib.optionals sbomSupport [ docker-sbom ]
+        ++ lib.optionals initSupport [ docker-init ];
+
       pluginsRef = symlinkJoin {
         name = "docker-plugins";
         paths = plugins;
       };
     in
     buildGoModule (
-      lib.optionalAttrs (!clientOnly) {
-        # allow overrides of docker components
-        # TODO: move packages out of the let...in into top-level to allow proper overrides
-        inherit
-          docker-runc
-          docker-containerd
-          docker-tini
-          moby
-          ;
-      }
-      // rec {
+      {
         pname = "docker";
         inherit version;
 
         src = fetchFromGitHub {
           owner = "docker";
           repo = "cli";
+          # Cannot use `tag` since upstream forgot to tag release, see
+          # https://github.com/docker/cli/issues/5789
           rev = cliRev;
           hash = cliHash;
         };
@@ -272,7 +274,7 @@ rec {
         vendorHash = null;
 
         nativeBuildInputs = [
-          makeWrapper
+          makeBinaryWrapper
           pkg-config
           go-md2man
           go
@@ -298,6 +300,8 @@ rec {
 
         # Keep eyes on BUILDTIME format - https://github.com/docker/cli/blob/${version}/scripts/build/.variables
         buildPhase = ''
+          runHook preBuild
+
           export GOCACHE="$TMPDIR/go-cache"
 
           # Mimic AUTO_GOPATH
@@ -309,6 +313,7 @@ rec {
           export BUILDTIME="1970-01-01T00:00:00Z"
           make dynbinary
 
+          runHook postBuild
         '';
 
         outputs = [ "out" ];
@@ -343,6 +348,10 @@ rec {
           runHook postInstall
         '';
 
+        doInstallCheck = true;
+        nativeInstallCheckInputs = [ versionCheckHook ];
+        versionCheckProgramArg = "--version";
+
         passthru = {
           # Exposed for tarsum build on non-linux systems (build-support/docker/default.nix)
           inherit moby-src;
@@ -361,38 +370,57 @@ rec {
           inherit knownVulnerabilities;
         };
       }
+      // lib.optionalAttrs (!clientOnly) {
+        # allow overrides of docker components
+        # TODO: move packages out of the let...in into top-level to allow proper overrides
+        inherit
+          docker-runc
+          docker-containerd
+          docker-tini
+          moby
+          ;
+      }
     );
-
+in
+{
   # Get revisions from
   # https://github.com/moby/moby/tree/${version}/hack/dockerfile/install/*
-  docker_25 = callPackage dockerGen rec {
-    version = "25.0.12";
-    # Upstream forgot to tag release
-    # https://github.com/docker/cli/issues/5789
-    cliRev = "43987fca488a535d810c429f75743d8c7b63bf4f";
-    cliHash = "sha256-OwufdfuUPbPtgqfPeiKrQVkOOacU2g4ommHb770gV40=";
-    mobyRev = "v${version}";
-    mobyHash = "sha256-EBOdbFP6UBK1uhXi1IzcPxYihHikuzzwMvv2NHsksYk=";
-    runcRev = "v1.2.5";
-    runcHash = "sha256-J/QmOZxYnMPpzm87HhPTkYdt+fN+yeSUu2sv6aUeTY4=";
-    containerdRev = "v1.7.27";
-    containerdHash = "sha256-H94EHnfW2Z59KcHcbfJn+BipyZiNUvHe50G5EXbrIps=";
-    tiniRev = "v0.19.0";
-    tiniHash = "sha256-ZDKu/8yE5G0RYFJdhgmCdN3obJNyRWv6K/Gd17zc1sI=";
-  };
+  docker_25 =
+    let
+      version = "25.0.12";
+    in
+    callPackage dockerGen {
+      inherit version;
+      # Upstream forgot to tag release
+      # https://github.com/docker/cli/issues/5789
+      cliRev = "43987fca488a535d810c429f75743d8c7b63bf4f";
+      cliHash = "sha256-OwufdfuUPbPtgqfPeiKrQVkOOacU2g4ommHb770gV40=";
+      mobyRev = "v${version}";
+      mobyHash = "sha256-EBOdbFP6UBK1uhXi1IzcPxYihHikuzzwMvv2NHsksYk=";
+      runcRev = "v1.2.5";
+      runcHash = "sha256-J/QmOZxYnMPpzm87HhPTkYdt+fN+yeSUu2sv6aUeTY4=";
+      containerdRev = "v1.7.27";
+      containerdHash = "sha256-H94EHnfW2Z59KcHcbfJn+BipyZiNUvHe50G5EXbrIps=";
+      tiniRev = "v0.19.0";
+      tiniHash = "sha256-ZDKu/8yE5G0RYFJdhgmCdN3obJNyRWv6K/Gd17zc1sI=";
+    };
 
-  docker_28 = callPackage dockerGen rec {
-    version = "28.3.3";
-    cliRev = "v${version}";
-    cliHash = "sha256-+nYpd9VGzzMPcBUfGM7V9MkrslYHDSUlE0vhTqDGc1s=";
-    mobyRev = "v${version}";
-    mobyHash = "sha256-3SWjoF4sXVuYxnENq5n6ZzPJx6BQXnyP8VXTQaaUSFA=";
-    runcRev = "v1.2.6";
-    runcHash = "sha256-XMN+YKdQOQeOLLwvdrC6Si2iAIyyHD5RgZbrOHrQE/g=";
-    containerdRev = "v1.7.27";
-    containerdHash = "sha256-H94EHnfW2Z59KcHcbfJn+BipyZiNUvHe50G5EXbrIps=";
-    tiniRev = "v0.19.0";
-    tiniHash = "sha256-ZDKu/8yE5G0RYFJdhgmCdN3obJNyRWv6K/Gd17zc1sI=";
-  };
+  docker_28 =
+    let
+      version = "28.3.3";
+    in
+    callPackage dockerGen {
+      version = "28.3.3";
+      cliRev = "v${version}";
+      cliHash = "sha256-+nYpd9VGzzMPcBUfGM7V9MkrslYHDSUlE0vhTqDGc1s=";
+      mobyRev = "v${version}";
+      mobyHash = "sha256-3SWjoF4sXVuYxnENq5n6ZzPJx6BQXnyP8VXTQaaUSFA=";
+      runcRev = "v1.2.6";
+      runcHash = "sha256-XMN+YKdQOQeOLLwvdrC6Si2iAIyyHD5RgZbrOHrQE/g=";
+      containerdRev = "v1.7.27";
+      containerdHash = "sha256-H94EHnfW2Z59KcHcbfJn+BipyZiNUvHe50G5EXbrIps=";
+      tiniRev = "v0.19.0";
+      tiniHash = "sha256-ZDKu/8yE5G0RYFJdhgmCdN3obJNyRWv6K/Gd17zc1sI=";
+    };
 
 }

pkgs/applications/virtualization/virtualbox/default.nix

@@ -72,12 +72,13 @@ let
   buildType = "release";
   # Use maintainers/scripts/update.nix to update the version and all related hashes or
   # change the hashes in extpack.nix and guest-additions/default.nix as well manually.
-  virtualboxVersion = "7.1.12";
+  virtualboxVersion = "7.2.0";
   virtualboxSubVersion = "";
-  virtualboxSha256 = "6f9618f39168898134975f51df7c2d6d5129c0aa82b6ae11cf47f920c70df276";
+  virtualboxSha256 = "4f2804ff27848ea772aee6b637bb1e10ee74ec2da117c257413e2d2c4f670ba0";
 
-  kvmPatchVersion = "20250207";
-  kvmPatchHash = "sha256-GzRLIXhzWL1NLvaGKcWVBCdvay1IxgJUE4koLX1ze7Y=";
+  kvmPatchVboxVersion = "7.2.0";
+  kvmPatchVersion = "20250903";
+  kvmPatchHash = "sha256-JTE9Kr+nJ6HLeDrzL2EVyDQhxzn3UsoQVIQ6zNCwioY=";
 
   # The KVM build is not compatible to VirtualBox's kernel modules. So don't export
   # modsrc at all.
@@ -231,8 +232,8 @@ stdenv.mkDerivation (finalAttrs: {
       # No update patch disables check for update function
       # https://bugs.launchpad.net/ubuntu/+source/virtualbox-ose/+bug/272212
       (fetchpatch {
-        url = "https://salsa.debian.org/pkg-virtualbox-team/virtualbox/-/raw/42a1ca1291fde365bfba140cb21a8a074aaccce2/debian/patches/16-no-update.patch";
-        hash = "sha256-qM2e4DkkpmA18Z76OUsnY1MhcGb1dT2PG68JUy6fZEE=";
+        url = "https://salsa.debian.org/pkg-virtualbox-team/virtualbox/-/raw/8028d88e6876ca5977de13c58b54e243229efe98/debian/patches/16-no-update.patch";
+        hash = "sha256-AGtFsRjwd8Yw296eqX3NC2TUptAhpFTRaOMutiheQ6Y=";
       })
     ]
     ++ [ ./extra_symbols.patch ]
@@ -250,23 +251,15 @@ stdenv.mkDerivation (finalAttrs: {
     )
     # While the KVM patch should not break any other behavior if --with-kvm is not specified,
     # we don't take any chances and only apply it if people actually want to use KVM support.
-    ++ optional enableKvm (
-      let
-        patchVboxVersion =
-          # There is no updated patch for 7.1.12 yet, but the older one still applies.
-          if finalAttrs.virtualboxVersion == "7.1.12" then "7.1.6" else finalAttrs.virtualboxVersion;
-      in
-      fetchpatch {
-        name = "virtualbox-${finalAttrs.virtualboxVersion}-kvm-dev-${finalAttrs.kvmPatchVersion}.patch";
-        url = "https://github.com/cyberus-technology/virtualbox-kvm/releases/download/dev-${finalAttrs.kvmPatchVersion}/kvm-backend-${patchVboxVersion}-dev-${finalAttrs.kvmPatchVersion}.patch";
-        hash = finalAttrs.kvmPatchHash;
-      }
-    )
+    ++ optional enableKvm (fetchpatch {
+      name = "virtualbox-${finalAttrs.virtualboxVersion}-kvm-dev-${finalAttrs.kvmPatchVersion}.patch";
+      url = "https://github.com/cyberus-technology/virtualbox-kvm/releases/download/dev-${finalAttrs.kvmPatchVersion}/kvm-backend-${kvmPatchVboxVersion}-dev-${finalAttrs.kvmPatchVersion}.patch";
+      hash = finalAttrs.kvmPatchHash;
+    })
     ++ [
       ./qt-dependency-paths.patch
       # https://github.com/NixOS/nixpkgs/issues/123851
       ./fix-audio-driver-loading.patch
-      ./fix-graphics-driver-loading.patch
     ];
 
   postPatch = ''

pkgs/applications/virtualization/virtualbox/extpack.nix

@@ -4,7 +4,7 @@
   virtualbox,
 }:
 let
-  virtualboxExtPackVersion = "7.1.12";
+  virtualboxExtPackVersion = "7.2.0";
 in
 fetchurl rec {
   name = "Oracle_VirtualBox_Extension_Pack-${virtualboxExtPackVersion}.vbox-extpack";
@@ -14,7 +14,7 @@ fetchurl rec {
     # Thus do not use `nix-prefetch-url` but instead plain old `sha256sum`.
     # Checksums can also be found at https://www.virtualbox.org/download/hashes/${version}/SHA256SUMS
     let
-      value = "c7ed97f4755988ecc05ec633475e299bbc1e0418cc3d143747a45c99df53abd3";
+      value = "8a44f3eeaf9bb71fab297bf4b3d38bd1bc55243f3c1a12bfb0e8d78170f949a0";
     in
     assert (builtins.stringLength value) == 64;
     value;

pkgs/applications/virtualization/virtualbox/fix-graphics-driver-loading.patch

@@ -1,13 +0,0 @@
-diff --git a/src/VBox/Devices/Graphics/DevVGA-SVGA3d-dx-dx11.cpp b/src/VBox/Devices/Graphics/DevVGA-SVGA3d-dx-dx11.cpp
-index 1a43382..c376d6e 100644
---- a/src/VBox/Devices/Graphics/DevVGA-SVGA3d-dx-dx11.cpp
-+++ b/src/VBox/Devices/Graphics/DevVGA-SVGA3d-dx-dx11.cpp
-@@ -3376,7 +3376,7 @@ static DECLCALLBACK(int) vmsvga3dBackInit(PPDMDEVINS pDevIns, PVGASTATE pThis, P
-     AssertReturn(pBackend, VERR_NO_MEMORY);
-     pThisCC->svga.p3dState->pBackend = pBackend;
- 
--    rc = RTLdrLoadSystem(VBOX_D3D11_LIBRARY_NAME, /* fNoUnload = */ true, &pBackend->hD3D11);
-+    rc = RTLdrLoad(VBOX_D3D11_LIBRARY_NAME, &pBackend->hD3D11);
-     AssertRC(rc);
-     if (RT_SUCCESS(rc))
-     {

pkgs/applications/virtualization/virtualbox/guest-additions-iso/default.nix

@@ -5,7 +5,7 @@
 }:
 fetchurl {
   url = "http://download.virtualbox.org/virtualbox/${virtualboxVersion}/VBoxGuestAdditions_${virtualboxVersion}.iso";
-  sha256 = "256883e2eabf7ab5c10fb3b6831c294942ce34bc615807f9d0cf6c3d2e882236";
+  sha256 = "43f7a1045cad0aab40e3af906fea37244ba6873b91b4e227245a14e51b399abd";
   meta = {
     description = "Guest additions ISO for VirtualBox";
     longDescription = ''

pkgs/applications/virtualization/virtualbox/guest-additions/builder.nix

@@ -78,9 +78,6 @@ stdenv.mkDerivation (finalAttrs: {
     rm -r src/libs/zlib*/
   '';
 
-  # Apply fix for: https://www.virtualbox.org/ticket/22397
-  patches = lib.optional stdenv.hostPlatform.isAarch64 ./guest-additions-aarch64-fix.patch;
-
   postPatch = ''
     set -x
     sed -e 's@MKISOFS --version@MKISOFS -version@' \

pkgs/applications/virtualization/virtualbox/guest-additions/default.nix

@@ -12,9 +12,9 @@
   libX11,
 }:
 let
-  virtualboxVersion = "7.1.12";
+  virtualboxVersion = "7.2.0";
   virtualboxSubVersion = "";
-  virtualboxSha256 = "6f9618f39168898134975f51df7c2d6d5129c0aa82b6ae11cf47f920c70df276";
+  virtualboxSha256 = "4f2804ff27848ea772aee6b637bb1e10ee74ec2da117c257413e2d2c4f670ba0";
 
   platform =
     if stdenv.hostPlatform.isAarch64 then

pkgs/applications/virtualization/virtualbox/guest-additions/guest-additions-aarch64-fix.patch

@@ -1,15 +0,0 @@
-diff --git a/configure b/configure
-index e845993..a5b526e 100644q
---- a/configure
-+++ b/configure
-@@ -422,6 +422,10 @@ check_environment()
-         BUILD_MACHINE='sparc32'
-         BUILD_CPU='blend'
-         ;;
-+    aarch64)
-+        BUILD_MACHINE='arm64'
-+        BUILD_CPU='blend'
-+        ;;
-     *)
-       log_failure "Cannot determine system"
-       exit 1

pkgs/by-name/_6/_6tunnel/package.nix

@@ -7,13 +7,13 @@
 
 stdenv.mkDerivation rec {
   pname = "6tunnel";
-  version = "0.13";
+  version = "0.14";
 
   src = fetchFromGitHub {
     owner = "wojtekka";
     repo = "6tunnel";
     rev = version;
-    sha256 = "0zsx9d6xz5w8zvrqsm8r625gpbqqhjzvjdzc3z8yix668yg8ff8h";
+    sha256 = "sha256-ftTAFjHlXRrXH6co8bX0RY092lAmv15svZn4BKGVuq0=";
   };
 
   nativeBuildInputs = [ autoreconfHook ];

pkgs/by-name/ac/actual-server/package.nix

@@ -11,13 +11,13 @@
 }:
 let
   yarn-berry = yarn-berry_4;
-  version = "25.8.0";
+  version = "25.9.0";
   src = fetchFromGitHub {
     name = "actualbudget-actual-source";
     owner = "actualbudget";
     repo = "actual";
     tag = "v${version}";
-    hash = "sha256-9Ov9AR+WEKtjiX+C2lvjxerc295DWSRHpTb4Lu1stoo=";
+    hash = "sha256-TYvGavj0Ts1ahgseFhuOtmfOSgPkjBIr19SIGOgx++Q=";
   };
   translations = fetchFromGitHub {
     name = "actualbudget-translations-source";
@@ -25,8 +25,8 @@ let
     repo = "translations";
     # Note to updaters: this repo is not tagged, so just update this to the Git
     # tip at the time the update is performed.
-    rev = "c1c2f298013ca3223e6cd6a4a4720bca5e8b8274";
-    hash = "sha256-3dtdymdKfEzUIzButA3L88GrehO4EjCrd/gq0Y5bcuE=";
+    rev = "3d88d15bf5125497de731f4e9dce19244bd4c7e0";
+    hash = "sha256-tOtDGNwR/DVEiOYilOLSJzNjBqvzxOF78ZJtmlz3fdg=";
   };
 
 in
@@ -82,7 +82,7 @@ stdenv.mkDerivation (finalAttrs: {
   missingHashes = ./missing-hashes.json;
   offlineCache = yarn-berry.fetchYarnBerryDeps {
     inherit (finalAttrs) src missingHashes;
-    hash = "sha256-kbQjtZivn9ni6PLk04kAJTzhhGgubhnxgHqMnGwEXZk=";
+    hash = "sha256-Vod0VfoZG2nwnu35XLAPqY5uuRLVD751D3ZysD0ypL0=";
   };
 
   pname = "actual-server";

pkgs/by-name/ah/ahk_x11/package.nix

@@ -1,7 +1,7 @@
 {
   lib,
   fetchFromGitHub,
-  crystal_1_11,
+  crystal,
   copyDesktopItems,
   gtk3,
   libxkbcommon,
@@ -11,6 +11,8 @@
   openbox,
   xvfb-run,
   xdotool,
+  nix-update-script,
+  versionCheckHook,
 
   buildDevTarget ? false, # the dev version prints debug info
 }:
@@ -18,7 +20,7 @@
 # NOTICE: AHK_X11 from this package does not support compiling scripts into portable executables.
 let
   pname = "ahk_x11";
-  version = "1.0.4-unstable-2025-01-30"; # 1.0.4 cannot build on Crystal 1.12 or below.
+  version = "1.0.5-unstable-2025-09-04";
 
   inherit (xorg)
     libXinerama
@@ -27,9 +29,6 @@ let
     libXi
     ;
 
-  # See upstream README. Crystal 1.11 or below is needed to work around phil294/AHK_X11#89.
-  crystal = crystal_1_11;
-
 in
 crystal.buildCrystalPackage {
   inherit pname version;
@@ -37,8 +36,8 @@ crystal.buildCrystalPackage {
   src = fetchFromGitHub {
     owner = "phil294";
     repo = "AHK_X11";
-    rev = "66eb5208d95f4239822053c7d35f32bc62d57573"; # tag = version;
-    hash = "sha256-KzD5ExYPRYgsYO+/hlnoQpBJwokjaK5lYL2kobI2XQ0=";
+    rev = "f5375887dec3953c4cb3d78271821645bc3840f2";
+    hash = "sha256-GTcbwCVWnC+KP2qLArEUIUMs5S0vpkA4gJHQpWP1TNg=";
     fetchSubmodules = true;
   };
 
@@ -100,6 +99,11 @@ crystal.buildCrystalPackage {
   # I don't know how to fix it for xvfb and openbox.
   doCheck = false;
 
+  doInstallCheck = true;
+  nativeInstallCheckInputs = [ versionCheckHook ];
+
+  passthru.updateScript = nix-update-script { };
+
   meta = {
     description = "AutoHotkey for X11";
     homepage = "https://phil294.github.io/AHK_X11";

pkgs/by-name/ah/ahk_x11/shards.nix

@@ -6,17 +6,17 @@
   };
   cron_parser = {
     url = "https://github.com/kostya/cron_parser.git";
-    tag = "v0.4.0";
+    rev = "v0.4.0";
     sha256 = "17fgg2nvyx99v05l10h6cnxfr7swz8yaxhmnk4l47kg2spi8w90a";
   };
   future = {
     url = "https://github.com/crystal-community/future.cr.git";
-    tag = "v1.0.0";
+    rev = "v1.0.0";
     sha256 = "1mji2djkrf4vxgs432kgkzxx54ybzk636789k2vsws3sf14l74i8";
   };
   gi-crystal = {
     url = "https://github.com/hugopl/gi-crystal.git";
-    tag = "v0.22.1";
+    rev = "v0.22.1";
     sha256 = "1bwsr5i6cmvnc72qdnmq4v6grif1hahrc7s6js2ivdrfix72flyg";
   };
   gtk3 = {
@@ -26,7 +26,7 @@
   };
   harfbuzz = {
     url = "https://github.com/hugopl/harfbuzz.cr.git";
-    tag = "v0.2.0";
+    rev = "v0.2.0";
     sha256 = "06wgqxwyib5416yp53j2iwcbr3bl4jjxb1flm7z103l365par694";
   };
   notify = {
@@ -36,12 +36,12 @@
   };
   pango = {
     url = "https://github.com/hugopl/pango.cr.git";
-    tag = "v0.3.1";
+    rev = "v0.3.1";
     sha256 = "0xlf127flimnll875mcq92q7xsi975rrgdpcpmnrwllhdhfx9qmv";
   };
   tasker = {
     url = "https://github.com/spider-gazelle/tasker.git";
-    tag = "v2.1.4";
+    rev = "v2.1.4";
     sha256 = "0254sl279nrw5nz43dz5gm89ah1zrw5bvxfma81navpx5gfg9pyb";
   };
   x11 = {

pkgs/by-name/al/alice-lg/package.nix

@@ -13,16 +13,16 @@
 
 buildGoModule rec {
   pname = "alice-lg";
-  version = "6.1.0";
+  version = "6.2.0";
 
   src = fetchFromGitHub {
     owner = "alice-lg";
     repo = "alice-lg";
     rev = version;
-    hash = "sha256-BbwTLHDtpa8HCECIiy+UxyQiLf9iAD2GzE0azXk7QGU=";
+    hash = "sha256-DlmUurpu/bs/91fLsSQ3xJ8I8NWJweynMgV6Svkf0Uo=";
   };
 
-  vendorHash = "sha256-8N5E1CW5Z7HujwXRsZLv7y4uNOJkjj155kmX9PCjajQ=";
+  vendorHash = "sha256-OkOUgW6BHJKIdY1soMqTXhL6RYy3567iL1/VZasIdvQ=";
 
   passthru.ui = stdenv.mkDerivation {
     pname = "alice-lg-ui";

pkgs/by-name/am/amnezia-vpn/package.nix

@@ -65,13 +65,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "amnezia-vpn";
-  version = "4.8.9.2";
+  version = "4.8.10.0";
 
   src = fetchFromGitHub {
     owner = "amnezia-vpn";
     repo = "amnezia-client";
     tag = finalAttrs.version;
-    hash = "sha256-UavKtAwnEa+Ym1a7XzC3JPDLovqggjsav4q2MiYUxbI=";
+    hash = "sha256-w1uBhp47XRinZpSuKeFaASOIOyjRDkDA81uqW4pK3F4=";
     fetchSubmodules = true;
   };
 

pkgs/by-name/an/ananicy-rules-cachyos/package.nix

@@ -7,13 +7,13 @@
 
 stdenvNoCC.mkDerivation {
   pname = "ananicy-rules-cachyos";
-  version = "0-unstable-2025-08-09";
+  version = "0-unstable-2025-09-03";
 
   src = fetchFromGitHub {
     owner = "CachyOS";
     repo = "ananicy-rules";
-    rev = "d929c14e7a15f69085bce6bca84af05a0fb3ff45";
-    hash = "sha256-nM/6+IzeZpiUKBTWc2kZUxp9vuhMtzHc9A/xYaMkmVQ=";
+    rev = "4a4931273868421e772c82f34f0df82252200526";
+    hash = "sha256-Wr/NIWObhzBdkI7QsYNLO52dYU3BUNGVKHliEcNGU3Y=";
   };
 
   dontConfigure = true;

pkgs/by-name/an/anyrun/package.nix

@@ -3,30 +3,29 @@
   rustPlatform,
   fetchFromGitHub,
   pkg-config,
-  wrapGAppsHook3,
-  atk,
+  wrapGAppsHook4,
   cairo,
   gdk-pixbuf,
   glib,
-  gtk3,
+  gtk4,
   pango,
   wayland,
-  gtk-layer-shell,
+  gtk4-layer-shell,
   nix-update-script,
 }:
 
-rustPlatform.buildRustPackage {
+rustPlatform.buildRustPackage (finalAttrs: {
   pname = "anyrun";
-  version = "25.9.0.pre-release.1-unstable-2025-08-19";
+  version = "25.9.0";
 
   src = fetchFromGitHub {
     owner = "anyrun-org";
     repo = "anyrun";
-    rev = "af1ffe4f17921825ff2a773995604dce2b2df3cd";
-    hash = "sha256-PKxVhfjd2AlzTopuVEx5DJMC4R7LnM5NIoMmirKMsKI=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-01XBO8U2PyhhYXo3oZAu7dghqXkxdemeG82MqnNp4wE=";
   };
 
-  cargoHash = "sha256-KpAnfytTtCJunhpk9exv8LYtF8mKDGFUUbsPP47M+Kk=";
+  cargoHash = "sha256-Xh+RWrAxa1cg0z6IGr7apzoAIlhDl8ZMpQTfoBAZXRk=";
 
   strictDeps = true;
   enableParallelBuilding = true;
@@ -34,16 +33,15 @@ rustPlatform.buildRustPackage {
 
   nativeBuildInputs = [
     pkg-config
-    wrapGAppsHook3
+    wrapGAppsHook4
   ];
 
   buildInputs = [
-    atk
     cairo
     gdk-pixbuf
     glib
-    gtk3
-    gtk-layer-shell
+    gtk4
+    gtk4-layer-shell
     pango
     wayland
   ];
@@ -58,7 +56,7 @@ rustPlatform.buildRustPackage {
     install -Dm444 anyrun/res/style.css examples/config.ron -t $out/share/doc/anyrun/examples/
   '';
 
-  passthru.updateScript = nix-update-script { extraArgs = [ "--version=branch" ]; };
+  passthru.updateScript = nix-update-script { };
 
   meta = {
     description = "Wayland-native, highly customizable runner";
@@ -71,4 +69,4 @@ rustPlatform.buildRustPackage {
     mainProgram = "anyrun";
     platforms = lib.platforms.linux;
   };
-}
+})

pkgs/by-name/ap/aptakube/darwin.nix

@@ -16,7 +16,7 @@ stdenvNoCC.mkDerivation {
 
   src = fetchurl {
     url = "https://github.com/aptakube/aptakube/releases/download/${version}/Aptakube_${version}_universal.dmg";
-    sha256 = "sha256-ljVl490cZuIcRSP8RKmf8Eq5D4OibLfuA8SugUlf1Yw=";
+    sha256 = "89828e1ac030f9532ba24afdd91d357280b32fcc475830b6667d5066e7a576ac";
   };
 
   nativeBuildInputs = [ undmg ];

pkgs/by-name/ap/aptakube/linux.nix

@@ -18,7 +18,7 @@ stdenvNoCC.mkDerivation {
 
   src = fetchurl {
     url = "https://github.com/aptakube/aptakube/releases/download/${version}/aptakube_${version}_amd64.deb";
-    sha256 = "sha256-lT8v2nXVfZb5W/FP/ymWjGypQLz7ONlp9+GblMKKXuw=";
+    sha256 = "9660c87da400dad1451f685defff774c6f5af9b3f713ad1cbd48284e965457dd";
   };
 
   nativeBuildInputs = [

pkgs/by-name/ap/aptakube/package.nix

@@ -5,7 +5,7 @@
 }:
 let
   pname = "aptakube";
-  version = "1.11.10";
+  version = "1.13.0";
   meta = {
     homepage = "https://aptakube.com/";
     description = "Modern, lightweight and multi-cluster Kubernetes GUI";

pkgs/by-name/au/autotrash/package.nix

@@ -35,6 +35,7 @@ python3Packages.buildPythonPackage rec {
   postInstall = "installManPage doc/autotrash.1";
 
   pythonImportsCheck = [ "autotrash" ];
+  nativeCheckInputs = [ python3Packages.pytestCheckHook ];
 
   meta = {
     description = "Tool to automatically purge old trashed files";

pkgs/by-name/av/avbroot/package.nix

@@ -10,16 +10,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "avbroot";
-  version = "3.20.0";
+  version = "3.22.0";
 
   src = fetchFromGitHub {
     owner = "chenxiaolong";
     repo = "avbroot";
     tag = "v${version}";
-    hash = "sha256-O5Mmu/b2Sl9UZTNHnDkqu6nWF79m480n03vJ7Ve3khQ=";
+    hash = "sha256-Ijyw6fUf5jW5di7gvnV0Eh1kG4q/x8GbG4R0q74rWLs=";
   };
 
-  cargoHash = "sha256-K7xnk0SR6x0VrGFxWQC6B+KxhNpbfvlkRhJ4oALkXco=";
+  cargoHash = "sha256-eYnKxMwdk4nlDFvzoMoWSH4NO753IY68dN/Ok0BZf0Q=";
 
   nativeBuildInputs = [
     pkg-config

pkgs/by-name/aw/aws-sso-cli/package.nix

@@ -10,15 +10,15 @@
 }:
 buildGoModule rec {
   pname = "aws-sso-cli";
-  version = "2.0.3";
+  version = "2.1.0";
 
   src = fetchFromGitHub {
     owner = "synfinatic";
     repo = "aws-sso-cli";
     rev = "v${version}";
-    hash = "sha256-GoLSdQb6snViYD9QY6NTypKquFsoX3jgClyrgTGoRq8=";
+    hash = "sha256-MomH4Zcc6iyVmLfA0PPsWgEqMBAAaPd+21NX4GdnFk0=";
   };
-  vendorHash = "sha256-SNMU7qDfLRGUSLjzrJHtIMgbcRc2DxXwWEUaUEY6PME=";
+  vendorHash = "sha256-Le5BOD/iBIMQwTNmb7JcW8xJS7WG5isf4HXpJxyvez0=";
 
   nativeBuildInputs = [
     makeWrapper

pkgs/by-name/bc/bcu/darwin-install.patch

@@ -0,0 +1,10 @@
+diff --git a/CMakeLists.txt b/CMakeLists.txt
+index 0d6b915..0a004f7 100644
+--- a/CMakeLists.txt
++++ b/CMakeLists.txt
+@@ -32,4 +32,5 @@ elseif (MACOS)
+         link_directories(${LIBUSB_LIBRARY_DIRS} ${LIBFTDI_LIBRARY_DIRS} ${LIBYAML_LIBRARY_DIRS})
+         target_link_libraries (bcu_mac ${LIBUSB_LIBDIR}/lib${LIBUSB_LIBRARIES}.dylib ${LIBFTDI_LIBDIR}/${LIBFTDI_MODULE_NAME}.dylib ${LIBYAML_LIBDIR}/lib${LIBYAML_LIBRARIES}.dylib -lpthread -lm)
+         execute_process( COMMAND sh ${PROJECT_SOURCE_DIR}/create_version_h.sh ${PROJECT_SOURCE_DIR} )
++        install(TARGETS bcu_mac DESTINATION bin)
+ endif ()

pkgs/by-name/bc/bcu/package.nix

@@ -0,0 +1,63 @@
+{
+  cmake,
+  fetchFromGitHub,
+  lib,
+  libftdi1,
+  libusb1,
+  libyaml,
+  ncurses,
+  nix-update-script,
+  pkg-config,
+  stdenv,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "bcu";
+  version = "1.1.119";
+
+  src = fetchFromGitHub {
+    owner = "nxp-imx";
+    repo = "bcu";
+    tag = "bcu_${finalAttrs.version}";
+    hash = "sha256-GVnUkIoqHED/9c3Tr4M29DB+t6Q8OPDcxVWKNn/lU/8=";
+  };
+
+  patches = [ ./darwin-install.patch ];
+
+  postPatch = ''
+    substituteInPlace create_version_h.sh \
+      --replace-fail "version=\`git describe --tags --long\`" "version=${finalAttrs.src.tag}"
+  '';
+
+  enableParallelBuilding = true;
+  strictDeps = true;
+
+  nativeBuildInputs = [
+    cmake
+    pkg-config
+  ];
+
+  buildInputs = [
+    libftdi1
+    libusb1
+    libyaml
+    ncurses
+  ];
+
+  passthru.updateScript = nix-update-script { };
+
+  env.NIX_CFLAGS_COMPILE = "-Wno-pointer-sign -Wno-deprecated-declarations -Wno-switch";
+
+  preFixup = lib.optionalString stdenv.hostPlatform.isDarwin ''
+    ln -sf $out/bin/bcu_mac $out/bin/bcu
+  '';
+
+  meta = {
+    description = "NXP i.MX remote control and power measurement tools";
+    homepage = "https://github.com/nxp-imx/bcu";
+    license = lib.licenses.bsd3;
+    mainProgram = "bcu";
+    maintainers = [ lib.maintainers.jmbaur ];
+    platforms = lib.platforms.linux ++ lib.platforms.darwin;
+  };
+})

pkgs/by-name/bi/biscuit-cli/package.nix

@@ -9,16 +9,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "biscuit-cli";
-  version = "0.5.0";
+  version = "0.6.0";
 
   src = fetchFromGitHub {
     owner = "biscuit-auth";
     repo = "biscuit-cli";
     rev = version;
-    sha256 = "sha256-BLDJ4Rzu48sAklbv021XSzmATRd+D01yGHqJt6kvjGw=";
+    sha256 = "sha256-s4Y4MhM79Z+4VxB03+56OqRQJaSHj2VQEJcL6CsT+2k=";
   };
 
-  cargoHash = "sha256-3rDsgEH6tTEnAc/+8Try/z3mMBOguOTbxfXs5QIMBf4=";
+  cargoHash = "sha256-OG8/9CxOTCYXwyavdaXvak8GbCOMvelcsSJVkEgdMdI=";
 
   passthru = {
     updateScript = nix-update-script { };

pkgs/by-name/bi/bitwarden-desktop/package.nix

@@ -34,13 +34,13 @@ let
 in
 buildNpmPackage' rec {
   pname = "bitwarden-desktop";
-  version = "2025.8.1";
+  version = "2025.8.2";
 
   src = fetchFromGitHub {
     owner = "bitwarden";
     repo = "clients";
     rev = "desktop-v${version}";
-    hash = "sha256-8meYZIJQFD2CAfB8DwFrcqkMx2lj2ZRZ7Vsaen+fXb4=";
+    hash = "sha256-cYSzAdrUvZrYPQ01uPJ6I1yJvTQtdV2rV0GTF6yKVCk=";
   };
 
   patches = [
@@ -87,7 +87,7 @@ buildNpmPackage' rec {
     "--ignore-scripts"
   ];
   npmWorkspace = "apps/desktop";
-  npmDepsHash = "sha256-LMUbwrJNW1f9PaxZIY/1QEextfHUizaTcEdPLRUFihM=";
+  npmDepsHash = "sha256-1SDXXsfyJDMjg4v0i9jDh7Y7m6LXd0vW4g0vRLeDXD8=";
 
   cargoDeps = rustPlatform.fetchCargoVendor {
     inherit

pkgs/by-name/bo/bootdev-cli/package.nix

@@ -11,13 +11,13 @@
 
 buildGoModule rec {
   pname = "bootdev-cli";
-  version = "1.20.1";
+  version = "1.20.2";
 
   src = fetchFromGitHub {
     owner = "bootdotdev";
     repo = "bootdev";
     tag = "v${version}";
-    hash = "sha256-fjXMaK6Mz38FJNrR+lVDi0EMxMoCTnC1q0wDQS1Mab8=";
+    hash = "sha256-TjldTmLX6H0k5mvq0SXoEuoFVxcmg+hMIXpCIVk1m3g=";
   };
 
   vendorHash = "sha256-jhRoPXgfntDauInD+F7koCaJlX4XDj+jQSe/uEEYIMM=";

pkgs/by-name/br/briar-desktop/package.nix

@@ -21,11 +21,11 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "briar-desktop";
-  version = "0.6.3-beta";
+  version = "0.6.4-beta";
 
   src = fetchurl {
     url = "https://desktop.briarproject.org/jars/linux/${finalAttrs.version}/briar-desktop-linux-${finalAttrs.version}.jar";
-    hash = "sha256-8JX4cgRJZDCBlu5iVL7t5nZSZn8XTk3DU3rasViQgtg=";
+    hash = "sha256-S7O625SWbgi4iby76Qe377NGiw4r9+VqgQh8kclKwMo=";
   };
 
   dontUnpack = true;
@@ -58,6 +58,7 @@ stdenv.mkDerivation (finalAttrs: {
     done
   '';
 
+  # TODO: Add a custom update script
   meta = {
     description = "Decentralized and secure messenger";
     mainProgram = "briar-desktop";

pkgs/by-name/br/brush/package.nix

@@ -12,16 +12,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "brush";
-  version = "0.2.21";
+  version = "0.2.23";
 
   src = fetchFromGitHub {
     owner = "reubeno";
     repo = "brush";
     tag = "brush-shell-v${version}";
-    hash = "sha256-CAQkbesP0wqyt7yA53BQlW/tkCoCPKEBoDLTVJBnR6o=";
+    hash = "sha256-b3foza29ty4P09PaBFh1nmGyn1YsxNPiVQHUcwWo6Lg=";
   };
 
-  cargoHash = "sha256-x/OyO96XKABf1hqSg0GMzWw6aeLOu7z2yu9rQQSM4Lc=";
+  cargoHash = "sha256-+HUZNOPPyRn2tQel/8fIiRQo761G3ygfRPuvjHkRAV8=";
 
   nativeInstallCheckInputs = [
     versionCheckHook

pkgs/by-name/ca/cargo-about/package.nix

@@ -8,16 +8,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "cargo-about";
-  version = "0.7.1";
+  version = "0.8.0";
 
   src = fetchFromGitHub {
     owner = "EmbarkStudios";
     repo = "cargo-about";
     rev = version;
-    sha256 = "sha256-h5+Fp6+yGa1quJENsCv6WE4NC2A+ceIGMXVWyeTPPLQ=";
+    sha256 = "sha256-EHqivIsS3wWvm3kJylynyobAsN2OlogXwLv9WdvzvJg=";
   };
 
-  cargoHash = "sha256-JTcRYdBZdXxM7r+XZSbFaAeWrJ5HULM1YE3p3smRW/Q=";
+  cargoHash = "sha256-J3kSBu81jQ/u6uLOT3pKFl4tfE6qOABWhpEea1O0BZI=";
 
   nativeBuildInputs = [ pkg-config ];
 

pkgs/by-name/ca/cargo-flamegraph/package.nix

@@ -10,16 +10,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "cargo-flamegraph";
-  version = "0.6.8";
+  version = "0.6.9";
 
   src = fetchFromGitHub {
     owner = "flamegraph-rs";
     repo = "flamegraph";
     rev = "v${version}";
-    sha256 = "sha256-JGUABNCZhDyTTrjFCRsT+wkuAeZn9mCHCI6XgGYEl7Y=";
+    sha256 = "sha256-yU3iWfEjtdwRKRp27moUhPuvoCE+0DiuQ67QFPfz01Y=";
   };
 
-  cargoHash = "sha256-FjLjEoorbZC2WZ424w2aFLmd4dIfy5s13sR8BSRVNIo=";
+  cargoHash = "sha256-7hmYrhOyEiseyDNea86EFBLhi5cOp6b5LO0Z8F+Ggpw=";
 
   nativeBuildInputs = lib.optionals stdenv.hostPlatform.isLinux [ makeWrapper ];
 

pkgs/by-name/ca/cargo-insta/package.nix

@@ -6,16 +6,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "cargo-insta";
-  version = "1.43.1";
+  version = "1.43.2";
 
   src = fetchFromGitHub {
     owner = "mitsuhiko";
     repo = "insta";
     rev = version;
-    hash = "sha256-8yFbf0MF5zDuMqG1AsCOvQhJc8D8cBH1WqCGulcXVH0=";
+    hash = "sha256-+0FJr1IXTnIc947ytB00z30m81peY/CjnBHMYvcQZl0=";
   };
 
-  cargoHash = "sha256-atPSV+dZgywgS+9M0LRtMqH4JP4UpYGjb2hyGAEwhkw=";
+  cargoHash = "sha256-BYYn+GGJoI0W4mbQcKlQe5IOObIQrV8hTzJeRU6cIZo=";
 
   checkFlags = [
     # Depends on `rustfmt` and does not matter for packaging.

pkgs/by-name/ca/cargo-machete/package.nix

@@ -6,16 +6,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "cargo-machete";
-  version = "0.9.0";
+  version = "0.9.1";
 
   src = fetchFromGitHub {
     owner = "bnjbvr";
     repo = "cargo-machete";
     rev = "v${version}";
-    hash = "sha256-exET/zBm5sjnrEx++PRgoWaz7lr7AEF+GVOTOZRGbbU=";
+    hash = "sha256-4tzffZeHdhAq6/K1BGkThqT+CBa3rUw+kR7aLwnqZjc=";
   };
 
-  cargoHash = "sha256-vv6QYIkQtrwlXMKPuZ1ZRJkhaN2qDI0x8vSK/bzDipE=";
+  cargoHash = "sha256-ahTvfxYYo3prPKDTalw2f2FPJLsPzGkE/2LCcyuniFY=";
 
   # tests require internet access
   doCheck = false;

pkgs/by-name/ca/cargo-nextest/package.nix

@@ -7,16 +7,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "cargo-nextest";
-  version = "0.9.102";
+  version = "0.9.103";
 
   src = fetchFromGitHub {
     owner = "nextest-rs";
     repo = "nextest";
     rev = "cargo-nextest-${version}";
-    hash = "sha256-NaWEJEmE8LW1qankVu2Z8eU2yj4/P4DKDLrCEDXPfOc=";
+    hash = "sha256-n7VVfk6bvO97tY7woEYUAuxEay/fN6F0eWBDohqIBD0=";
   };
 
-  cargoHash = "sha256-plZYGm/Sh+pKx1srRPXpZPTZ4k9k/rWZreJqJKFmiG4=";
+  cargoHash = "sha256-Nfm2KdyIgJ2rxYKn6r4lZbNkEWNQ+UAdkMiZAJfbzo8=";
 
   cargoBuildFlags = [
     "-p"

pkgs/by-name/ca/cargo-workspaces/package.nix

@@ -10,14 +10,14 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "cargo-workspaces";
-  version = "0.4.0";
+  version = "0.4.1";
 
   src = fetchCrate {
     inherit pname version;
-    hash = "sha256-kBjiRPEWHKhX6vTB48TjKYhlpaiieNzE1l0PjaLTL4k=";
+    hash = "sha256-5heOf74OUsnrG+vt9AdMXV7uRxqKYs0KRE7qm0irmC0=";
   };
 
-  cargoHash = "sha256-vHLc738wFunyUDu6/B5foTE2/wExd2Yxcl638iqOWdw=";
+  cargoHash = "sha256-Is2ddCrg+dP0TSw3EUl057RA0L2VW4mPttg2eAtC0j4=";
 
   nativeBuildInputs = [
     pkg-config

pkgs/by-name/cl/clapboard/package.nix

@@ -6,16 +6,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "clapboard";
-  version = "1.0.3";
+  version = "1.1.0";
 
   src = fetchFromGitHub {
     owner = "bjesus";
     repo = "clapboard";
     rev = "v${version}";
-    hash = "sha256-TM07BcluIh+MEcVg1ApZu85rj36ZBUfn125A0eALNMo=";
+    hash = "sha256-1y2tG4ajnsstNkPTE3eBr8QJJF6Qq/HCQzJoj1ETuUY=";
   };
 
-  cargoHash = "sha256-uPMaw36y9773LTu02muLot8I42VM2GE/MJSAHClLNgs=";
+  cargoHash = "sha256-DEwipAG/zPPftYwYahRJfpXgHPXerGdn10PkS8DHWCM=";
 
   meta = with lib; {
     description = "Wayland clipboard manager that will make you clap";

pkgs/by-name/cl/claude-code/package-lock.json

@@ -6,13 +6,13 @@
   "packages": {
     "": {
       "dependencies": {
-        "@anthropic-ai/claude-code": "^1.0.102"
+        "@anthropic-ai/claude-code": "^1.0.107"
       }
     },
     "node_modules/@anthropic-ai/claude-code": {
-      "version": "1.0.102",
-      "resolved": "https://registry.npmjs.org/@anthropic-ai/claude-code/-/claude-code-1.0.102.tgz",
-      "integrity": "sha512-UIC6qNgKNZi1nLTf1bQvxNfd74xIAqJjIx6vggh3bJOMtuXBiFwrfPk1Pdf9CayYgwZYXgSmxYYaASt6i6ficQ==",
+      "version": "1.0.107",
+      "resolved": "https://registry.npmjs.org/@anthropic-ai/claude-code/-/claude-code-1.0.107.tgz",
+      "integrity": "sha512-YYbOLIZF6aIwUeLa9Yg2gsHggBC5IWJwsA3B0wpl1z412yIgjp2CjWJ2GGLMTxCrrL5WgUe4SDmNxiAYEPP0yQ==",
       "license": "SEE LICENSE IN README.md",
       "bin": {
         "claude": "cli.js"

pkgs/by-name/cl/claude-code/package.nix

@@ -7,16 +7,16 @@
 
 buildNpmPackage rec {
   pname = "claude-code";
-  version = "1.0.102";
+  version = "1.0.107";
 
   nodejs = nodejs_20; # required for sandboxed Nix builds on Darwin
 
   src = fetchzip {
     url = "https://registry.npmjs.org/@anthropic-ai/claude-code/-/claude-code-${version}.tgz";
-    hash = "sha256-l7KiRp+V/eFVV6n1pv7tZv/VjXXWGPJnIcnicO5DGfA=";
+    hash = "sha256-ht8MReur4K/QrEY9/MH6srQL3/8LHk8pCuSDld+LlEg=";
   };
 
-  npmDepsHash = "sha256-iiimBp5GrSeabpN0nsp6vxFom7r4wNbWxiREfLeYs9w=";
+  npmDepsHash = "sha256-xbxMjwVvkUmjiaklcYsrWLcb2c9qxiYWcT5eM8LN/h8=";
 
   postPatch = ''
     cp ${./package-lock.json} package-lock.json

pkgs/by-name/cl/clickhouse/generic.nix

@@ -10,6 +10,7 @@
   stdenv,
   llvmPackages_19,
   fetchFromGitHub,
+  fetchpatch,
   cmake,
   ninja,
   python3,
@@ -89,6 +90,12 @@ llvmPackages_19.stdenv.mkDerivation (finalAttrs: {
 
   dontCargoSetupPostUnpack = true;
 
+  # Should not be necessary after 25.9
+  patches = lib.optional (lib.versions.majorMinor version == "25.8") (fetchpatch {
+    url = "https://github.com/ClickHouse/ClickHouse/commit/67a42b78cdf1c793e78c1adbcc34162f67044032.patch";
+    sha256 = "7VF+JSztqTWD+aunCS3UVNxlRdwHc2W5fNqzDyeo3Fc=";
+  });
+
   postPatch = ''
     patchShebangs src/ utils/
 

pkgs/by-name/cl/clickhouse/lts.nix

@@ -1,6 +1,6 @@
 import ./generic.nix {
-  version = "25.3.6.56-lts";
-  hash = "sha256-wpC6uw811IWImLWAatYbghp3aZ+esEEBFng6AHIesK4=";
+  version = "25.8.2.29-lts";
+  hash = "sha256-S+1fZuYlZUMkiBlMtufMT5aAi9uwbFMjYW7Dmkt/Now=";
   lts = true;
   nixUpdateExtraArgs = [
     "--version-regex"

pkgs/by-name/cl/clickhouse/package.nix

@@ -1,10 +1,10 @@
 import ./generic.nix {
-  version = "25.7.5.34-stable";
-  hash = "sha256-0+e2QPsn6EZ28j3HE2TYOpJBN9jSl19Ytbvj+124viw=";
+  version = "25.8.2.29-lts";
+  hash = "sha256-S+1fZuYlZUMkiBlMtufMT5aAi9uwbFMjYW7Dmkt/Now=";
   lts = false;
   nixUpdateExtraArgs = [
     "--version-regex"
-    "^v?(.*-stable)$"
+    "^v?(.*-stable|.*-lts)$"
     "--override-filename"
     "pkgs/by-name/cl/clickhouse/package.nix"
   ];

pkgs/by-name/cl/cling/fix-new-parser.patch

@@ -0,0 +1,54 @@
+From cd4d1d8c4963620a6a84834948845df81fbbd70b Mon Sep 17 00:00:00 2001
+From: Jonas Hahnfeld <jonas.hahnfeld@cern.ch>
+Date: Tue, 17 Dec 2024 14:54:18 +0100
+Subject: [PATCH] Use single Parser for LookupHelper
+
+It is the only construction of a temporary parser, and it seems not
+necessary (anymore).
+---
+ include/cling/Interpreter/LookupHelper.h |  2 +-
+ lib/Interpreter/Interpreter.cpp          | 11 ++++-------
+ 2 files changed, 5 insertions(+), 8 deletions(-)
+
+diff --git a/include/cling/Interpreter/LookupHelper.h b/include/cling/Interpreter/LookupHelper.h
+index 6e6e281470..cd79b2a65c 100644
+--- a/include/cling/Interpreter/LookupHelper.h
++++ b/include/cling/Interpreter/LookupHelper.h
+@@ -56,7 +56,7 @@ namespace cling {
+       WithDiagnostics
+     };
+   private:
+-    std::unique_ptr<clang::Parser> m_Parser;
++    clang::Parser* m_Parser;
+     Interpreter* m_Interpreter; // we do not own.
+     std::array<const clang::Type*, kNumCachedStrings> m_StringTy = {{}};
+     /// A map containing the hash of the lookup buffer. This allows us to avoid
+diff --git a/lib/Interpreter/Interpreter.cpp b/lib/Interpreter/Interpreter.cpp
+index 13c8409cc5..f04695439b 100644
+--- a/lib/Interpreter/Interpreter.cpp
++++ b/lib/Interpreter/Interpreter.cpp
+@@ -265,13 +265,6 @@ namespace cling {
+     }
+ 
+     Sema& SemaRef = getSema();
+-    Preprocessor& PP = SemaRef.getPreprocessor();
+-
+-    m_LookupHelper.reset(new LookupHelper(new Parser(PP, SemaRef,
+-                                                     /*SkipFunctionBodies*/false,
+-                                                     /*isTemp*/true), this));
+-    if (!m_LookupHelper)
+-      return;
+ 
+     if (!isInSyntaxOnlyMode() && !m_Opts.CompilerOpts.CUDADevice) {
+       m_Executor.reset(new IncrementalExecutor(SemaRef.Diags, *getCI(),
+@@ -317,6 +310,10 @@ namespace cling {
+       return;
+     }
+ 
++    m_LookupHelper.reset(new LookupHelper(m_IncrParser->getParser(), this));
++    if (!m_LookupHelper)
++      return;
++
+     // When not using C++ modules, we now have a PCH and we can safely setup
+     // our callbacks without fearing that they get overwritten by clang code.
+     // The modules setup is handled above.

pkgs/by-name/cl/cling/no-clang-cpp.patch

@@ -1,13 +0,0 @@
-diff --git a/tools/driver/CMakeLists.txt b/tools/driver/CMakeLists.txt
-index 590d708d83..340ae529d4 100644
---- a/tools/driver/CMakeLists.txt
-+++ b/tools/driver/CMakeLists.txt
-@@ -63,7 +63,7 @@ endif()
- add_dependencies(clang clang-resource-headers)
-
- if(NOT CLANG_LINKS_TO_CREATE)
--  set(CLANG_LINKS_TO_CREATE clang++ clang-cl clang-cpp)
-+  set(CLANG_LINKS_TO_CREATE clang++ clang-cl)
- endif()
-
- foreach(link ${CLANG_LINKS_TO_CREATE})

pkgs/by-name/cl/cling/package.nix

@@ -5,13 +5,13 @@
   git,
   lib,
   libffi,
-  llvmPackages_13,
+  llvmPackages_18,
   makeWrapper,
   ncurses,
   python3,
   zlib,
 
-  # *NOT* from LLVM 13!
+  # *NOT* from LLVM 18!
   # The compiler used to compile Cling may affect the runtime include and lib
   # directories it expects to be run with. Cling builds against (a fork of) Clang,
   # so we prefer to use Clang as the compiler as well for consistency.
@@ -34,42 +34,39 @@
 let
   stdenv = clangStdenv;
 
-  # The patched clang lives in the LLVM megarepo
-  clangSrc = fetchFromGitHub {
+  version = "1.2";
+
+  clingSrc = fetchFromGitHub {
     owner = "root-project";
-    repo = "llvm-project";
-    # cling-llvm13 branch
-    rev = "3610201fbe0352a63efb5cb45f4ea4987702c735";
-    sha256 = "sha256-Cb7BvV7yobG+mkaYe7zD2KcnPvm8/vmVATNWssklXyk=";
-    sparseCheckout = [ "clang" ];
+    repo = "cling";
+    rev = "v${version}";
+    sha256 = "sha256-ay9FXANJmB/+AdnCR4WOKHuPm6P88wLqoOgiKJwJ8JM=";
   };
 
-  llvm = llvmPackages_13.llvm.override { enableSharedLibraries = false; };
-
-  unwrapped = stdenv.mkDerivation rec {
+  unwrapped = stdenv.mkDerivation {
     pname = "cling-unwrapped";
-    version = "1.0";
+    inherit version;
 
-    src = "${clangSrc}/clang";
-
-    clingSrc = fetchFromGitHub {
+    src = fetchFromGitHub {
       owner = "root-project";
-      repo = "cling";
-      rev = "v${version}";
-      sha256 = "sha256-Ye8EINzt+dyNvUIRydACXzb/xEPLm0YSkz08Xxw3xp4=";
+      repo = "llvm-project";
+      rev = "cling-llvm18-20250721-01";
+      sha256 = "sha256-JGteapyujU5w81DsfPQfTq76cYHgk5PbAFbdYfYIDo4=";
     };
 
-    prePatch = ''
-      echo "add_llvm_external_project(cling)" >> tools/CMakeLists.txt
+    preConfigure = ''
+      cp -r ${clingSrc} cling-source
 
-      cp -r $clingSrc tools/cling
-      chmod -R a+w tools/cling
+      # Patch a bug in version 1.2 by backporting a fix. See
+      # https://github.com/root-project/cling/issues/556
+      chmod -R u+w cling-source
+      pushd cling-source
+      patch -p1 < ${./fix-new-parser.patch}
+      popd
+
+      cd llvm
     '';
 
-    patches = [
-      ./no-clang-cpp.patch
-    ];
-
     nativeBuildInputs = [
       python3
       git
@@ -84,22 +81,15 @@ let
     strictDeps = true;
 
     cmakeFlags = [
-      "-DLLVM_BINARY_DIR=${llvm.out}"
-      "-DLLVM_CONFIG=${llvm.dev}/bin/llvm-config"
-      "-DLLVM_LIBRARY_DIR=${llvm.lib}/lib"
-      "-DLLVM_MAIN_INCLUDE_DIR=${llvm.dev}/include"
-      "-DLLVM_TABLEGEN_EXE=${llvm.out}/bin/llvm-tblgen"
-      "-DLLVM_TOOLS_BINARY_DIR=${llvm.out}/bin"
-      "-DLLVM_BUILD_TOOLS=Off"
-      "-DLLVM_TOOL_CLING_BUILD=ON"
-
+      "-DLLVM_EXTERNAL_PROJECTS=cling"
+      "-DLLVM_EXTERNAL_CLING_SOURCE_DIR=../../cling-source"
+      "-DLLVM_ENABLE_PROJECTS=clang"
       "-DLLVM_TARGETS_TO_BUILD=host;NVPTX"
+      "-DLLVM_INCLUDE_TESTS=OFF"
       "-DLLVM_ENABLE_RTTI=ON"
-
-      # Setting -DCLING_INCLUDE_TESTS=ON causes the cling/tools targets to be built;
-      # see cling/tools/CMakeLists.txt
-      "-DCLING_INCLUDE_TESTS=ON"
-      "-DCLANG-TOOLS=OFF"
+    ]
+    ++ lib.optionals (!debug) [
+      "-DCMAKE_BUILD_TYPE=Release"
     ]
     ++ lib.optionals debug [
       "-DCMAKE_BUILD_TYPE=Debug"
@@ -111,11 +101,13 @@ let
 
     CPPFLAGS = if useLLVMLibcxx then [ "-stdlib=libc++" ] else [ ];
 
-    postInstall = lib.optionalString (!stdenv.hostPlatform.isDarwin) ''
+    postInstall = ''
       mkdir -p $out/share/Jupyter
-      cp -r /build/clang/tools/cling/tools/Jupyter/kernel $out/share/Jupyter
+      cp -r ../../cling-source/tools/Jupyter/kernel $out/share/Jupyter
     '';
 
+    buildTargets = [ "cling" ];
+
     dontStrip = debug;
 
     meta = with lib; {
@@ -147,18 +139,18 @@ let
     "-nostdinc++"
 
     "-resource-dir"
-    "${llvm.lib}/lib"
+    "${llvmPackages_18.llvm.lib}/lib"
 
     "-isystem"
-    "${lib.getLib unwrapped}/lib/clang/${llvmPackages_13.clang.version}/include"
+    "${lib.getLib unwrapped}/lib/clang/18/include"
   ]
   ++ lib.optionals useLLVMLibcxx [
     "-I"
-    "${lib.getDev llvmPackages_13.libcxx}/include/c++/v1"
+    "${lib.getDev llvmPackages_18.libcxx}/include/c++/v1"
     "-L"
-    "${llvmPackages_13.libcxx}/lib"
+    "${llvmPackages_18.libcxx}/lib"
     "-l"
-    "${llvmPackages_13.libcxx}/lib/libc++${stdenv.hostPlatform.extensions.sharedLibrary}"
+    "${llvmPackages_18.libcxx}/lib/libc++${stdenv.hostPlatform.extensions.sharedLibrary}"
   ]
   ++ lib.optionals (!useLLVMLibcxx) [
     "-I"

pkgs/by-name/cl/clive/package.nix

@@ -10,16 +10,16 @@
 }:
 buildGoModule rec {
   pname = "clive";
-  version = "0.12.11";
+  version = "0.12.12";
 
   src = fetchFromGitHub {
     owner = "koki-develop";
     repo = "clive";
     tag = "v${version}";
-    hash = "sha256-BAKZTWcC8EzDTlQZUJBzVQNF0kDBY7Lx+8ZFAYgoWlQ=";
+    hash = "sha256-gycxHlNbwPLpR/ATxAsQ68Fetp/hptOUsRc+D3P7x1k=";
   };
 
-  vendorHash = "sha256-ljjSopfKGSotJx52SScl7KwFyKbFF9uxQMODjuZH4vc=";
+  vendorHash = "sha256-S2MR3eDfAiEz7boUetdPmOf0rQe7QrV6yO1RfMAEj4o=";
   subPackages = [ "." ];
   buildInputs = [ ttyd ];
   nativeBuildInputs = [

pkgs/by-name/cl/cloudflared/package.nix

@@ -9,13 +9,13 @@
 
 buildGoModule rec {
   pname = "cloudflared";
-  version = "2025.8.0";
+  version = "2025.8.1";
 
   src = fetchFromGitHub {
     owner = "cloudflare";
     repo = "cloudflared";
     tag = version;
-    hash = "sha256-kvhDdgnAkYvs+W0TE8Pu3nlEp2n7tHDphDwqCc4J0eE=";
+    hash = "sha256-7qPyzxsCgRs/Jzwdg4MrtqD7arS7o420BkmbtXTlJe4=";
   };
 
   vendorHash = null;

pkgs/by-name/co/codex/package.nix

@@ -12,18 +12,18 @@
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "codex";
-  version = "0.27.0";
+  version = "0.29.0";
 
   src = fetchFromGitHub {
     owner = "openai";
     repo = "codex";
     tag = "rust-v${finalAttrs.version}";
-    hash = "sha256-vsZmHkph2rrb0K+ZRymweRculh+SIASCJCRP3V09hKU=";
+    hash = "sha256-YCQfycmDPRxMAqo57tt/6IXkUn1JIPTzEHMNbt7m3w0=";
   };
 
   sourceRoot = "${finalAttrs.src.name}/codex-rs";
 
-  cargoHash = "sha256-NK1TOY5Puo881bhgF3w470k2N4LoC6/qTI93uhg7Alw=";
+  cargoHash = "sha256-kGjpqkV0OJW8mOW/OhyfXoTgLHHrtHQcw9c8zyVtzgs=";
 
   nativeBuildInputs = [
     installShellFiles

pkgs/by-name/co/console-setup/package.nix

@@ -12,14 +12,14 @@
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "console-setup";
-  version = "1.240";
+  version = "1.242";
 
   src = fetchFromGitLab {
     domain = "salsa.debian.org";
     owner = "installer-team";
     repo = "console-setup";
     tag = finalAttrs.version;
-    hash = "sha256-cKMgFW97B0ippQjXur8e5rrlEVo5EBoAgCCni2MY5Ys=";
+    hash = "sha256-5PV1Mbg7ZGQsotwnBVz8DI77Y8ULCnoTANqBLlP3YrE=";
   };
 
   buildInputs = [

pkgs/by-name/cp/cp2k/package.nix

@@ -39,6 +39,12 @@
   elpa,
   cudaPackages,
   rocmPackages,
+  newScope,
+  mctc-lib,
+  jonquil,
+  multicharge,
+  mstore,
+  test-drive,
   config,
   gpuBackend ? (
     if config.cudaSupport then
@@ -60,6 +66,69 @@ assert builtins.elem gpuBackend [
   "rocm"
 ];
 
+let
+  grimmeCmake = lib.makeScope newScope (self: {
+    mctc-lib = mctc-lib.override {
+      buildType = "cmake";
+      inherit (self) jonquil toml-f;
+    };
+
+    toml-f = toml-f.override {
+      buildType = "cmake";
+      inherit (self) test-drive;
+    };
+
+    dftd4 = dftd4.override {
+      buildType = "cmake";
+      inherit (self) mstore mctc-lib multicharge;
+    };
+
+    jonquil = jonquil.override {
+      buildType = "cmake";
+      inherit (self) toml-f test-drive;
+    };
+
+    mstore = mstore.override {
+      buildType = "cmake";
+      inherit (self) mctc-lib;
+    };
+
+    multicharge = multicharge.override {
+      buildType = "cmake";
+      inherit (self) mctc-lib mstore;
+    };
+
+    test-drive = test-drive.override { buildType = "cmake"; };
+
+    simple-dftd3 = simple-dftd3.override {
+      buildType = "cmake";
+      inherit (self) mctc-lib mstore toml-f;
+    };
+
+    tblite = tblite.override {
+      buildType = "cmake";
+      inherit (self)
+        mctc-lib
+        mstore
+        toml-f
+        multicharge
+        dftd4
+        simple-dftd3
+        ;
+    };
+
+    sirius = sirius.override {
+      inherit (self)
+        mctc-lib
+        toml-f
+        multicharge
+        dftd4
+        simple-dftd3
+        ;
+    };
+  });
+
+in
 stdenv.mkDerivation rec {
   pname = "cp2k";
   version = "2025.2";
@@ -87,19 +156,16 @@ stdenv.mkDerivation rec {
     which
     makeWrapper
     pkg-config
+    gfortran
   ]
   ++ lib.optional (gpuBackend == "cuda") cudaPackages.cuda_nvcc;
 
   buildInputs = [
-    gfortran
     fftw
     gsl
     libint
     libvori
     libxc
-    dftd4
-    simple-dftd3
-    tblite
     libxsmm
     mpi
     spglib
@@ -110,14 +176,17 @@ stdenv.mkDerivation rec {
     plumed
     zlib
     hdf5-fortran
-    sirius
     spla
     spfft
     libvdwxc
     trexio
-    toml-f
     greenx
     gmp
+    grimmeCmake.dftd4
+    grimmeCmake.simple-dftd3
+    grimmeCmake.tblite
+    grimmeCmake.sirius
+    grimmeCmake.toml-f
   ]
   ++ lib.optional enableElpa elpa
   ++ lib.optionals (gpuBackend == "cuda") [

pkgs/by-name/cp/cpu-x/package.nix

@@ -39,13 +39,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "cpu-x";
-  version = "5.3.1";
+  version = "5.4.0";
 
   src = fetchFromGitHub {
     owner = "TheTumultuousUnicornOfDarkness";
     repo = "CPU-X";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-yrDTvOdMeUw2fxLtNjCZggs9M9P1YKeMxm/dI5MRyYQ=";
+    hash = "sha256-db7NxoVZgnYb1MZKfiFINx00JqDnf/TvwumBp6qDooQ=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/cy/cyclonedx-python/package.nix

@@ -6,14 +6,14 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "cyclonedx-python";
-  version = "7.0.0";
+  version = "7.1.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "CycloneDX";
     repo = "cyclonedx-python";
     tag = "v${version}";
-    hash = "sha256-ucIxq/pQkVd9N5ORrJjswSE1DgmKPw8r7nPJA5Qe4n0=";
+    hash = "sha256-RHw+FYj1oYM5Yf8YcU8tOsxG+3qu0ti/AYzcGxYAp/8=";
   };
 
   build-system = with python3Packages; [ poetry-core ];

pkgs/by-name/da/danger-gitlab/Gemfile

@@ -1,2 +1,4 @@
 source 'https://rubygems.org'
 gem 'danger-gitlab'
+
+gem "faraday-retry", "~> 2.3"

pkgs/by-name/da/danger-gitlab/Gemfile.lock

@@ -1,48 +1,69 @@
 GEM
   remote: https://rubygems.org/
   specs:
+    activesupport (8.0.2.1)
+      base64
+      benchmark (>= 0.3)
+      bigdecimal
+      concurrent-ruby (~> 1.0, >= 1.3.1)
+      connection_pool (>= 2.2.5)
+      drb
+      i18n (>= 1.6, < 2)
+      logger (>= 1.4.2)
+      minitest (>= 5.1)
+      securerandom (>= 0.3)
+      tzinfo (~> 2.0, >= 2.0.5)
+      uri (>= 0.13.1)
     addressable (2.8.7)
       public_suffix (>= 2.0.2, < 7.0)
     base64 (0.2.0)
-    bigdecimal (3.1.9)
+    benchmark (0.4.1)
+    bigdecimal (3.2.2)
     claide (1.1.0)
     claide-plugins (0.9.2)
       cork
       nap
       open4 (~> 1.3)
     colored2 (3.1.2)
+    concurrent-ruby (1.3.5)
+    connection_pool (2.5.3)
     cork (0.3.0)
       colored2 (~> 3.1)
-    csv (3.3.4)
-    danger (9.5.1)
+    csv (3.3.5)
+    danger (9.5.3)
       base64 (~> 0.2)
       claide (~> 1.0)
       claide-plugins (>= 0.9.2)
-      colored2 (~> 3.1)
+      colored2 (>= 3.1, < 5)
       cork (~> 0.1)
       faraday (>= 0.9.0, < 3.0)
       faraday-http-cache (~> 2.0)
-      git (~> 1.13)
-      kramdown (~> 2.3)
+      git (>= 1.13, < 3.0)
+      kramdown (>= 2.5.1, < 3.0)
       kramdown-parser-gfm (~> 1.0)
       octokit (>= 4.0)
       pstore (~> 0.1)
-      terminal-table (>= 1, < 4)
-    danger-gitlab (9.0.0)
+      terminal-table (>= 1, < 5)
+    danger-gitlab (10.0.0)
       danger
-      gitlab (~> 5.0)
-    faraday (2.13.1)
+      gitlab (~> 6.0)
+    drb (2.2.3)
+    faraday (2.13.4)
       faraday-net_http (>= 2.0, < 3.5)
       json
       logger
     faraday-http-cache (2.5.1)
       faraday (>= 0.8)
-    faraday-net_http (3.4.0)
+    faraday-net_http (3.4.1)
       net-http (>= 0.5.0)
-    git (1.19.1)
+    faraday-retry (2.3.2)
+      faraday (~> 2.0)
+    git (2.3.3)
+      activesupport (>= 5.0)
       addressable (~> 2.8)
+      process_executer (~> 1.1)
       rchardet (~> 1.8)
-    gitlab (5.1.0)
+    gitlab (6.0.0)
       base64 (~> 0.2.0)
       httparty (~> 0.20)
       terminal-table (>= 1.5.1)
@@ -50,13 +71,16 @@ GEM
       csv
       mini_mime (>= 1.0.0)
       multi_xml (>= 0.5.2)
-    json (2.12.0)
+    i18n (1.14.7)
+      concurrent-ruby (~> 1.0)
+    json (2.13.2)
     kramdown (2.5.1)
       rexml (>= 3.3.9)
     kramdown-parser-gfm (1.1.0)
       kramdown (~> 2.0)
     logger (1.7.0)
     mini_mime (1.1.5)
+    minitest (5.25.5)
     multi_xml (0.7.2)
       bigdecimal (~> 3.1)
     nap (1.1.0)
@@ -66,6 +90,7 @@ GEM
       faraday (>= 1, < 3)
       sawyer (~> 0.9)
     open4 (1.3.4)
+    process_executer (1.3.0)
     pstore (0.2.0)
     public_suffix (6.0.2)
     rchardet (1.9.0)
@@ -73,17 +98,22 @@ GEM
     sawyer (0.9.2)
       addressable (>= 2.3.5)
       faraday (>= 0.17.3, < 3)
-    terminal-table (3.0.2)
-      unicode-display_width (>= 1.1.1, < 3)
-    unicode-display_width (2.6.0)
+    securerandom (0.4.1)
+    terminal-table (4.0.0)
+      unicode-display_width (>= 1.1.1, < 4)
+    tzinfo (2.0.6)
+      concurrent-ruby (~> 1.0)
+    unicode-display_width (3.1.5)
+      unicode-emoji (~> 4.0, >= 4.0.4)
+    unicode-emoji (4.0.4)
     uri (1.0.3)
 
 PLATFORMS
   ruby
-  x86_64-linux
 
 DEPENDENCIES
   danger-gitlab
+  faraday-retry (~> 2.3)
 
 BUNDLED WITH
-   2.5.22
+   2.6.9

pkgs/by-name/da/danger-gitlab/gemset.nix

@@ -1,4 +1,28 @@
 {
+  activesupport = {
+    dependencies = [
+      "base64"
+      "benchmark"
+      "bigdecimal"
+      "concurrent-ruby"
+      "connection_pool"
+      "drb"
+      "i18n"
+      "logger"
+      "minitest"
+      "securerandom"
+      "tzinfo"
+      "uri"
+    ];
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "1ik1sm5sizrsnr3di0klh7rvsy9r9mmd805fv5srk66as5psf184";
+      type = "gem";
+    };
+    version = "8.0.2.1";
+  };
   addressable = {
     dependencies = [ "public_suffix" ];
     groups = [ "default" ];
@@ -20,15 +44,25 @@
     };
     version = "0.2.0";
   };
+  benchmark = {
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "1kicilpma5l0lwayqjb5577bm0hbjndj2gh150xz09xsgc1l1vyl";
+      type = "gem";
+    };
+    version = "0.4.1";
+  };
   bigdecimal = {
     groups = [ "default" ];
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "1k6qzammv9r6b2cw3siasaik18i6wjc5m0gw5nfdc6jj64h79z1g";
+      sha256 = "1p2szbr4jdvmwaaj2kxlbv1rp0m6ycbgfyp0kjkkkswmniv5y21r";
       type = "gem";
     };
-    version = "3.1.9";
+    version = "3.2.2";
   };
   claide = {
     groups = [ "default" ];
@@ -65,6 +99,26 @@
     };
     version = "3.1.2";
   };
+  concurrent-ruby = {
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "1ipbrgvf0pp6zxdk5ascp6i29aybz2bx9wdrlchjmpx6mhvkwfw1";
+      type = "gem";
+    };
+    version = "1.3.5";
+  };
+  connection_pool = {
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "0nrhsk7b3sjqbyl1cah6ibf1kvi3v93a7wf4637d355hp614mmyg";
+      type = "gem";
+    };
+    version = "2.5.3";
+  };
   cork = {
     dependencies = [ "colored2" ];
     groups = [ "default" ];
@@ -81,10 +135,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "1kfqg0m6vqs6c67296f10cr07im5mffj90k2b5dsm51liidcsvp9";
+      sha256 = "0gz7r2kazwwwyrwi95hbnhy54kwkfac5swh2gy5p5vw36fn38lbf";
       type = "gem";
     };
-    version = "3.3.4";
+    version = "3.3.5";
   };
   danger = {
     dependencies = [
@@ -106,10 +160,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "0s6liclz7vn2q1vzraq7gq6n2rfj4p3hn2gixgnx2qvggg2qsai1";
+      sha256 = "0dma7aj2pcpndbpvl259n8hssik3kqjdvnsmdgq521njxg6k7p6i";
       type = "gem";
     };
-    version = "9.5.1";
+    version = "9.5.3";
   };
   danger-gitlab = {
     dependencies = [
@@ -120,10 +174,20 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "0bmsyv03n2ravjc0mzq73iairgc1apzc388jalg2c3rag1psgr47";
+      sha256 = "033w7rrm6sdp3f5fha4x6ycd657gliq61p4sb2zxqkk3imvpxvm1";
       type = "gem";
     };
-    version = "9.0.0";
+    version = "10.0.0";
+  };
+  drb = {
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "0wrkl7yiix268s2md1h6wh91311w95ikd8fy8m5gx589npyxc00b";
+      type = "gem";
+    };
+    version = "2.2.3";
   };
   faraday = {
     dependencies = [
@@ -135,10 +199,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "0xbv450qj2bx0qz9l2pjrd3kc057y6bglc3na7a78zby8ssiwlyc";
+      sha256 = "09mcghancmn0s5cwk2xz581j3xm3xqxfv0yxg75axnyhrx9gy6f7";
       type = "gem";
     };
-    version = "2.13.1";
+    version = "2.13.4";
   };
   faraday-http-cache = {
     dependencies = [ "faraday" ];
@@ -157,24 +221,37 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "0jp5ci6g40d6i50bsywp35l97nc2fpi9a592r2cibwicdb6y9wd1";
+      sha256 = "0fxbckg468dabkkznv48ss8zv14d9cd8mh1rr3m98aw7wzx5fmq9";
       type = "gem";
     };
-    version = "3.4.0";
+    version = "3.4.1";
+  };
+  faraday-retry = {
+    dependencies = [ "faraday" ];
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "1laici6jximrz3a8rkm8qmwdmw3fgzk22qh4l8wd5srjj01d40i4";
+      type = "gem";
+    };
+    version = "2.3.2";
   };
   git = {
     dependencies = [
+      "activesupport"
       "addressable"
+      "process_executer"
       "rchardet"
     ];
     groups = [ "default" ];
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "0w3xhay1z7qx9ab04wmy5p4f1fadvqa6239kib256wsiyvcj595h";
+      sha256 = "1rbhfyzvzgzn6zsjnmxls0q1g7g7k9p5adk8vmf2d1aij1gly59f";
       type = "gem";
     };
-    version = "1.19.1";
+    version = "2.3.3";
   };
   gitlab = {
     dependencies = [
@@ -186,10 +263,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "1ivj6pq3s3lz8z0islynvdb3fv82ghr5k97drz07kwwqga02f702";
+      sha256 = "0fm90lis0ikw2m77q33bxjg1bhsn8cdj06z9z4qv6kxqfmkhk3my";
       type = "gem";
     };
-    version = "5.1.0";
+    version = "6.0.0";
   };
   httparty = {
     dependencies = [
@@ -206,15 +283,26 @@
     };
     version = "0.23.1";
   };
+  i18n = {
+    dependencies = [ "concurrent-ruby" ];
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "03sx3ahz1v5kbqjwxj48msw3maplpp2iyzs22l4jrzrqh4zmgfnf";
+      type = "gem";
+    };
+    version = "1.14.7";
+  };
   json = {
     groups = [ "default" ];
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "0l0av82l1i5703fd5qnxr263zw21xmbpx737av3r9pjn0w0cw3xk";
+      sha256 = "0s5vklcy2fgdxa9c6da34jbfrqq7xs6mryjglqqb5iilshcg3q82";
       type = "gem";
     };
-    version = "2.12.0";
+    version = "2.13.2";
   };
   kramdown = {
     dependencies = [ "rexml" ];
@@ -258,6 +346,16 @@
     };
     version = "1.1.5";
   };
+  minitest = {
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "0mn7q9yzrwinvfvkyjiz548a4rmcwbmz2fn9nyzh4j1snin6q6rr";
+      type = "gem";
+    };
+    version = "5.25.5";
+  };
   multi_xml = {
     dependencies = [ "bigdecimal" ];
     groups = [ "default" ];
@@ -314,6 +412,16 @@
     };
     version = "1.3.4";
   };
+  process_executer = {
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "0vslspnp4aki1cw4lwk9d5bmjfqwbf5i2wwgimch8cp14wns409v";
+      type = "gem";
+    };
+    version = "1.3.0";
+  };
   pstore = {
     groups = [ "default" ];
     platforms = [ ];
@@ -368,26 +476,58 @@
     };
     version = "0.9.2";
   };
+  securerandom = {
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "1cd0iriqfsf1z91qg271sm88xjnfd92b832z49p1nd542ka96lfc";
+      type = "gem";
+    };
+    version = "0.4.1";
+  };
   terminal-table = {
     dependencies = [ "unicode-display_width" ];
     groups = [ "default" ];
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "14dfmfjppmng5hwj7c5ka6qdapawm3h6k9lhn8zj001ybypvclgr";
+      sha256 = "1lh18gwpksk25sbcjgh94vmfw2rz0lrq61n7lwp1n9gq0cr7j17m";
       type = "gem";
     };
-    version = "3.0.2";
+    version = "4.0.0";
   };
-  unicode-display_width = {
+  tzinfo = {
+    dependencies = [ "concurrent-ruby" ];
     groups = [ "default" ];
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "0nkz7fadlrdbkf37m0x7sw8bnz8r355q3vwcfb9f9md6pds9h9qj";
+      sha256 = "16w2g84dzaf3z13gxyzlzbf748kylk5bdgg3n1ipvkvvqy685bwd";
       type = "gem";
     };
-    version = "2.6.0";
+    version = "2.0.6";
+  };
+  unicode-display_width = {
+    dependencies = [ "unicode-emoji" ];
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "0knx0bgwwpwa7wcmknqp2i019jq6b46wxfppvhxfxrsyhlbnhmmz";
+      type = "gem";
+    };
+    version = "3.1.5";
+  };
+  unicode-emoji = {
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "0ajk6rngypm3chvl6r0vwv36q1931fjqaqhjjya81rakygvlwb1c";
+      type = "gem";
+    };
+    version = "4.0.4";
   };
   uri = {
     groups = [ "default" ];

pkgs/by-name/da/danger-gitlab/package.nix

@@ -1,15 +1,21 @@
-{ lib, bundlerApp }:
+{
+  lib,
+  bundlerApp,
+  bundlerUpdateScript,
+}:
 
 bundlerApp {
   pname = "danger-gitlab";
   gemdir = ./.;
   exes = [ "danger" ];
 
-  meta = with lib; {
+  passthru.updateScript = bundlerUpdateScript "danger-gitlab";
+
+  meta = {
     description = "Gem that exists to ensure all dependencies are set up for Danger with GitLab";
     homepage = "https://github.com/danger/danger-gitlab-gem";
-    license = licenses.mit;
-    teams = [ teams.serokell ];
+    license = lib.licenses.mit;
+    teams = with lib.teams; [ serokell ];
     mainProgram = "danger";
   };
 }

pkgs/by-name/da/davis/package.nix

@@ -7,16 +7,16 @@
 
 php.buildComposerProject2 (finalAttrs: {
   pname = "davis";
-  version = "5.1.2";
+  version = "5.1.3";
 
   src = fetchFromGitHub {
     owner = "tchapi";
     repo = "davis";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-Z2e5QRyyJeisWLi2tZJZNAXrO3/DL6v2Nvxd0+SC6EU=";
+    hash = "sha256-2gM6G1ZqHOUNmFjo3icHdV7xX/kbi0MO98GDzsBTGGo=";
   };
 
-  vendorHash = "sha256-ee3Gvg8rvX9jelmSVHjFltZz9R+7w2B8L4gjv3GaN/g=";
+  vendorHash = "sha256-RNvFviWu1ZNPWguzL9MbOsWctKfPeJGWZJ8Y2HDEXkI=";
 
   composerNoPlugins = false;
 

pkgs/by-name/de/deadnix/package.nix

@@ -6,16 +6,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "deadnix";
-  version = "1.2.1";
+  version = "1.3.1";
 
   src = fetchFromGitHub {
     owner = "astro";
     repo = "deadnix";
     rev = "v${version}";
-    hash = "sha256-xaaXGzTd+t1GjD2KpiS/c8acv6bXufv/lTN+ACRGVJw=";
+    hash = "sha256-WrzIqt28RhoFYhCMu5oY5jAdGh0Gv5uryW/1jTX99aY=";
   };
 
-  cargoHash = "sha256-unp5W2vatSS58O+nEAVsVBN99hgYRVc1OkD2vVandw0=";
+  cargoHash = "sha256-IgGuWIsDsiMqscO4B876iTCdrR+nI9bpTQOyxjCtjMk=";
 
   meta = with lib; {
     description = "Find and remove unused code in .nix source files";

pkgs/by-name/di/dissent/package.nix

@@ -15,13 +15,13 @@
 
 buildGoModule rec {
   pname = "dissent";
-  version = "0.0.35";
+  version = "0.0.37";
 
   src = fetchFromGitHub {
     owner = "diamondburned";
     repo = "dissent";
     tag = "v${version}";
-    hash = "sha256-cmp+oAUV+Oehs/kz6DRW57NgegBWbFVT/7xfY7CbcZM=";
+    hash = "sha256-xrNWMLZMZiJv08hsnc/aDe8e/aytngHKD/EhFVcF5PU=";
   };
 
   nativeBuildInputs = [
@@ -56,7 +56,7 @@ buildGoModule rec {
     install -D -m 444 -t $out/share/dbus-1/services nix/so.libdb.dissent.service
   '';
 
-  vendorHash = "sha256-AhzM0wu2wwwG/sDY+r2wgmotK4zA5u6vzq4KoPMLkL0=";
+  vendorHash = "sha256-tl9H0qtp96XOanniMFqjZcsSU8LqJ4aluPoKULDzVdw=";
 
   meta = {
     description = "Third-party Discord client designed for a smooth, native experience (formerly gtkcord4)";

pkgs/by-name/dn/dnscrypt-proxy/package.nix

@@ -7,7 +7,7 @@
 
 buildGoModule rec {
   pname = "dnscrypt-proxy";
-  version = "2.1.13";
+  version = "2.1.14";
 
   vendorHash = null;
 
@@ -17,7 +17,7 @@ buildGoModule rec {
     owner = "DNSCrypt";
     repo = "dnscrypt-proxy";
     rev = version;
-    hash = "sha256-IFfhcirUGbp/pKFN/5aEpuIuhSR3ZS4K7TatBtaX5zg=";
+    hash = "sha256-JPBAlRpJw6Oy4f3twyhX95XqWFtUTEFPjwyVaNMSHmQ=";
   };
 
   passthru.tests = { inherit (nixosTests) dnscrypt-proxy2; };

pkgs/by-name/do/doxx/package.nix

@@ -0,0 +1,42 @@
+{
+  lib,
+  rustPlatform,
+  fetchFromGitHub,
+  nix-update-script,
+}:
+
+rustPlatform.buildRustPackage (finalAttrs: {
+  pname = "doxx";
+  version = "0-unstable-2025-08-18";
+
+  src = fetchFromGitHub {
+    owner = "bgreenwell";
+    repo = "doxx";
+    rev = "5c957470de1fa937cf96cd847286e2d3ee37cbee";
+    hash = "sha256-ZCvb8FnGdpzEDqYCIFjg+hiO3OZNnZ2+dSDVLx+crTU=";
+  };
+
+  cargoHash = "sha256-1i+IAQc55HYrqJm3Hx0frphSQp7jYGa6i0eOvHVMdCI=";
+
+  postInstall = ''
+    rm $out/bin/generate_test_docs
+  '';
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "Terminal document viewer for .docx files";
+    longDescription = ''
+      `doxx` is a lightning-fast, terminal-native document viewer for
+      Microsoft Word files. Built with Rust for performance and
+      reliability, it brings Word documents to your command line with
+      beautiful rendering, smart table support, and powerful export
+      capabilities.
+    '';
+    homepage = "https://github.com/bgreenwell/doxx";
+    changelog = "https://github.com/bgreenwell/doxx/blob/${finalAttrs.src.rev}/CHANGELOG.md";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ yiyu ];
+    mainProgram = "doxx";
+  };
+})

pkgs/by-name/du/dufs/package.nix

@@ -8,16 +8,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "dufs";
-  version = "0.44.0";
+  version = "0.45.0";
 
   src = fetchFromGitHub {
     owner = "sigoden";
     repo = "dufs";
     rev = "v${version}";
-    hash = "sha256-krrph0tyz7d1cSmScKSAVSYoKp9RbsZvVdOLIvbJ3dc=";
+    hash = "sha256-83lFnT4eRYaBe4e2o6l6AGQycm/oK96n5DXutBNvBsE=";
   };
 
-  cargoHash = "sha256-cklssERy3sDYWCyzgQd7tsRd+kuBmSTZBio8svMQP2Q=";
+  cargoHash = "sha256-WdjqG2URtloh5OnpBBnEWHD3WKGkCKLDcCyWRVGIXto=";
 
   nativeBuildInputs = [ installShellFiles ];