Merge branch 'staging-next' into staging

.github/workflows/eval.yml

@@ -11,9 +11,6 @@ on:
       systems:
         required: true
         type: string
-      defaultVersion:
-        required: true
-        type: string
       testVersions:
         required: false
         default: false
@@ -108,7 +105,7 @@ jobs:
       - name: Evaluate the ${{ matrix.system }} output paths at the merge commit
         env:
           MATRIX_SYSTEM: ${{ matrix.system }}
-          MATRIX_VERSION: ${{ matrix.version || inputs.defaultVersion }}
+          MATRIX_VERSION: ${{ matrix.version || 'nixVersions.latest' }}
         run: |
           nix-build nixpkgs/untrusted/ci --arg nixpkgs ./nixpkgs/untrusted-pinned  -A eval.singleSystem \
             --argstr evalSystem "$MATRIX_SYSTEM" \
@@ -122,14 +119,12 @@ jobs:
         if: inputs.targetSha
         env:
           MATRIX_SYSTEM: ${{ matrix.system }}
-          # This must match the default version set in the Merge Queue.
-          VERSION: lixPackageSets.latest.lix
         # This is very quick, because it pulls the eval results from Cachix.
         run: |
           nix-build nixpkgs/trusted/ci --arg nixpkgs ./nixpkgs/trusted-pinned -A eval.singleSystem \
             --argstr evalSystem "$MATRIX_SYSTEM" \
             --arg chunkSize 8000 \
-            --argstr nixPath "$VERSION" \
+            --argstr nixPath "nixVersions.latest" \
             --out-link target
 
       - name: Compare outpaths against the target branch
@@ -289,10 +284,6 @@ jobs:
                           diff.removed,
                           diff.changed,
                           diff.rebuilds
-                        ).filter(attr =>
-                          // Exceptions related to dev shells, which changed at some time between 2.18 and 2.24.
-                          !attr.startsWith('tests.devShellTools.nixos.') &&
-                          !attr.startsWith('tests.devShellTools.unstructuredDerivationInputEnv.')
                         )
                         if (attrs.length > 0) {
                           core.setFailed(

.github/workflows/merge-group.yml

@@ -55,8 +55,6 @@ jobs:
     with:
       mergedSha: ${{ inputs.mergedSha || github.event.merge_group.head_sha }}
       systems: ${{ needs.prepare.outputs.systems }}
-      # This must match the version in Eval's target step.
-      defaultVersion: lixPackageSets.latest.lix
 
   # This job's only purpose is to create the target for the "Required Status Checks" branch ruleset.
   # It "needs" all the jobs that should block the Merge Queue.

.github/workflows/pr.yml

@@ -86,7 +86,6 @@ jobs:
       mergedSha: ${{ needs.prepare.outputs.mergedSha }}
       targetSha: ${{ needs.prepare.outputs.targetSha }}
       systems: ${{ needs.prepare.outputs.systems }}
-      defaultVersion: nixVersions.latest
       testVersions: ${{ contains(fromJSON(needs.prepare.outputs.touched), 'pinned') && !contains(fromJSON(needs.prepare.outputs.headBranch).type, 'development') }}
 
   labels:

doc/release-notes/rl-2511.section.md

@@ -108,6 +108,8 @@
 
 - the "pie" hardening flag has been removed. compilers are expected to enable PIE by default, as has been common practice since 2016 outside of nixpkgs. If a package needs "pie" disabled pass `-no-pie` in `CFLAGS`. It is unlikely this will be necessary in many cases; due to the prevalance of default PIE toolchains most packages incompatible with PIE already pass no-pie.
 
+- `wayclip` now uses the `ext-data-control-v1` Wayland protocol instead of `wlr-data-control-unstable-v1`.
+
 - `cudaPackages.cudatoolkit-legacy-runfile` has been removed.
 
 - `conduwuit` was removed due to upstream ceasing development and deleting their repository. For existing data, a migration to `matrix-conduit`, `matrix-continuwuity` or `matrix-tuwunel` may be possible.

maintainers/maintainer-list.nix

@@ -5316,12 +5316,6 @@
     githubId = 1957293;
     name = "Casey Ransom";
   };
-  CrazedProgrammer = {
-    email = "crazedprogrammer@gmail.com";
-    github = "CrazedProgrammer";
-    githubId = 12202789;
-    name = "CrazedProgrammer";
-  };
   creator54 = {
     email = "hi.creator54@gmail.com";
     github = "Creator54";
@@ -5859,6 +5853,12 @@
       { fingerprint = "E8F9 0B80 908E 723D 0EDF  0916 5803 CDA5 9C26 A96A"; }
     ];
   };
+  datosh = {
+    email = "fabian@kammel.dev";
+    github = "datosh";
+    githubId = 6423339;
+    name = "Fabian Kammel";
+  };
   dav-wolff = {
     email = "nixpkgs@dav.dev";
     github = "dav-wolff";
@@ -14712,6 +14712,13 @@
     githubId = 67327023;
     keys = [ { fingerprint = "8185 29F9 BB4C 33F0 69BB  9782 D1AC CDCF 2B9B 9799"; } ];
   };
+  lillecarl = {
+    name = "Carl Andersson";
+    github = "lillecarl";
+    githubId = 207073;
+    email = "nixos@lillecarl.com";
+    matrix = "@lillecarl:matrix.org";
+  };
   lillycham = {
     email = "lillycat332@gmail.com";
     github = "lillycham";
@@ -15879,6 +15886,12 @@
     githubId = 1913876;
     name = "Markus Scherer";
   };
+  MarkusZoppelt = {
+    email = "markus@zoppelt.net";
+    github = "MarkusZoppelt";
+    githubId = 2495125;
+    name = "Markus Zoppelt";
+  };
   marmolak = {
     email = "hack.robin@gmail.com";
     github = "marmolak";
@@ -23057,12 +23070,6 @@
     githubId = 73446695;
     name = "Savinien Petitjean";
   };
-  savannidgerinel = {
-    email = "savanni@luminescent-dreams.com";
-    github = "savannidgerinel";
-    githubId = 8534888;
-    name = "Savanni D'Gerinel";
-  };
   savedra1 = {
     email = "michaelsavedra@gmail.com";
     github = "savedra1";

maintainers/scripts/update-typst-packages.py

@@ -78,7 +78,14 @@ class TypstPackage:
             "nix-command",
         ]
         result = subprocess.run(cmd + [url], capture_output=True, text=True)
-        hash = re.search(r"hash\s+\'(sha256-.{44})\'", result.stderr).groups()[0]
+        # We currently rely on Typst Universe's github repository to
+        # track package dependencies. However, there might be an
+        # inconsistency between the registry and the repository. We
+        # skip packages that cannot be fetched from the registry.
+        if re.search(r"error: unable to download", result.stderr):
+            return url, None
+        else:
+            hash = re.search(r"hash\s+\'(sha256-.{44})\'", result.stderr).groups()[0]
         return url, hash
 
     def to_name_full(self):
@@ -86,10 +93,14 @@ class TypstPackage:
 
     def to_attrs(self):
         deps = set()
-        excludes = list(map(
-            lambda e: os.path.join(self.path, e),
-            self.meta["package"]["exclude"] if "exclude" in self.meta["package"] else [],
-        ))
+        excludes = list(
+            map(
+                lambda e: os.path.join(self.path, e),
+                self.meta["package"]["exclude"]
+                if "exclude" in self.meta["package"]
+                else [],
+            )
+        )
         for root, _, files in os.walk(self.path):
             for file in filter(lambda f: f.split(".")[-1] == "typ", files):
                 file_path = os.path.join(root, file)
@@ -110,6 +121,9 @@ class TypstPackage:
         )
         source_url, source_hash = self.source()
 
+        if not source_hash:
+            return None
+
         return dict(
             url=source_url,
             hash=source_hash,
@@ -152,11 +166,12 @@ def generate_typst_packages(preview_dir, output_file):
         def generate_package(pname, package_subtree):
             sorted_keys = sorted(package_subtree.keys(), key=Version, reverse=True)
             print(f"Generating metadata for {pname}")
-            return {
-                pname: OrderedDict(
-                    (k, package_subtree[k].to_attrs()) for k in sorted_keys
-                )
-            }
+            version_set = OrderedDict(
+                (k, a)
+                for k, a in [(k, package_subtree[k].to_attrs()) for k in sorted_keys]
+                if a is not None
+            )
+            return {pname: version_set} if len(version_set) > 0 else {}
 
         with concurrent.futures.ThreadPoolExecutor(max_workers=100) as executor:
             sorted_packages = sorted(package_tree.items(), key=lambda x: x[0])

nixos/doc/manual/development/settings-options.section.md

@@ -358,6 +358,16 @@ have a predefined type and string generator already declared under
 
     :   Outputs the xml with header.
 
+`pkgs.formats.plist` { escape ? true }
+
+:   A function taking an attribute set with values
+
+    `escape`
+
+    :   Whether to escape XML special characters in string values and keys.
+
+    It returns a set with Property list (plist) specific attributes `type` and `generate` as specified [below](#pkgs-formats-result).
+
 `pkgs.formats.pythonVars` { }
 
 :   A function taking an empty attribute set (for future extensibility)

nixos/doc/manual/release-notes/rl-2511.section.md

@@ -112,6 +112,8 @@
 
 - [ente](https://github.com/ente-io/ente), a service that provides a fully open source, end-to-end encrypted platform for photos and videos. Available as [services.ente.api](#opt-services.ente.api.enable) and  [services.ente.web](#opt-services.ente.web.enable).
 
+- [PairDrop](https://github.com/schlagmichdoch/pairdrop), a peer-to-peer file transfer web app. Available as [services.pairdrop](#opt-services.pairdrop.enable).
+
 - [SuiteNumérique Docs](https://github.com/suitenumerique/docs), a collaborative note taking, wiki and documentation web platform and alternative to Notion or Outline. Available as [services.lasuite-docs](#opt-services.lasuite-docs.enable).
 
 - [dwl](https://codeberg.org/dwl/dwl), a compact, hackable compositor for Wayland based on wlroots. Available as [programs.dwl](#opt-programs.dwl.enable).

nixos/modules/module-list.nix

@@ -1296,6 +1296,7 @@
   ./services/networking/openconnect.nix
   ./services/networking/opengfw.nix
   ./services/networking/openvpn.nix
+  ./services/networking/opkssh/opkssh.nix
   ./services/networking/ostinato.nix
   ./services/networking/owamp.nix
   ./services/networking/pangolin.nix
@@ -1634,6 +1635,7 @@
   ./services/web-apps/lasuite-docs.nix
   ./services/web-apps/lasuite-meet.nix
   ./services/web-apps/lemmy.nix
+  ./services/web-apps/librespeed.nix
   ./services/web-apps/libretranslate.nix
   ./services/web-apps/limesurvey.nix
   ./services/web-apps/linkwarden.nix
@@ -1671,6 +1673,7 @@
   ./services/web-apps/openvscode-server.nix
   ./services/web-apps/openwebrx.nix
   ./services/web-apps/outline.nix
+  ./services/web-apps/pairdrop.nix
   ./services/web-apps/part-db.nix
   ./services/web-apps/peering-manager.nix
   ./services/web-apps/peertube-runner.nix

nixos/modules/programs/rust-motd.nix

@@ -113,7 +113,7 @@ in
       }
     ];
     systemd.services.rust-motd = {
-      path = with pkgs; [ bash ];
+      path = with pkgs; [ bash ] ++ lib.optional (cfg.settings.fail_2_ban or { } != { }) fail2ban;
       documentation = [
         "https://github.com/rust-motd/rust-motd/blob/v${pkgs.rust-motd.version}/README.md"
       ];

nixos/modules/security/pam.nix

@@ -2298,7 +2298,7 @@ in
       ++ lib.optionals config.security.pam.enableFscrypt [ pkgs.fscrypt-experimental ]
       ++ lib.optionals config.security.pam.u2f.enable [ pkgs.pam_u2f ];
 
-    boot.supportedFilesystems = lib.optionals config.security.pam.enableEcryptfs [ "ecryptfs" ];
+    boot.supportedFilesystems = lib.mkIf config.security.pam.enableEcryptfs [ "ecryptfs" ];
 
     security.wrappers = {
       unix_chkpwd = {

nixos/modules/services/networking/oink.nix

@@ -85,6 +85,10 @@ in
       after = [ "network.target" ];
       wantedBy = [ "multi-user.target" ];
       script = "${cfg.package}/bin/oink -c ${oinkConfig}";
+      serviceConfig = {
+        Restart = "on-failure";
+        RestartSec = "10";
+      };
     };
   };
 }

nixos/modules/services/networking/opkssh/opkssh.nix

@@ -0,0 +1,170 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+let
+  cfg = config.services.opkssh;
+
+  providerFile = pkgs.writeText "opkssh-providers" (
+    lib.concatStringsSep "\n" (
+      lib.mapAttrsToList (
+        name: provider: "${provider.issuer} ${provider.clientId} ${provider.lifetime}"
+      ) cfg.providers
+    )
+  );
+
+  authIdFile = pkgs.writeText "opkssh-auth-id" (
+    lib.concatStringsSep "\n" (
+      lib.map (auth: "${auth.user} ${auth.principal} ${auth.issuer}") cfg.authorizations
+    )
+  );
+in
+{
+  options.services.opkssh = {
+    enable = lib.mkEnableOption "OpenID Connect SSH authentication";
+
+    package = lib.mkPackageOption pkgs "opkssh" { };
+
+    user = lib.mkOption {
+      type = lib.types.str;
+      default = "opksshuser";
+      description = "System user for running opkssh";
+    };
+
+    group = lib.mkOption {
+      type = lib.types.str;
+      default = "opksshuser";
+      description = "System group for opkssh";
+    };
+
+    providers = lib.mkOption {
+      type = lib.types.attrsOf (
+        lib.types.submodule {
+          options = {
+            issuer = lib.mkOption {
+              type = lib.types.str;
+              description = "Issuer URI";
+              example = "https://accounts.google.com";
+            };
+
+            clientId = lib.mkOption {
+              type = lib.types.str;
+              description = "OAuth client ID";
+            };
+
+            lifetime = lib.mkOption {
+              type = lib.types.enum [
+                "12h"
+                "24h"
+                "48h"
+                "1week"
+                "oidc"
+                "oidc-refreshed"
+              ];
+              default = "24h";
+              description = "Token lifetime";
+            };
+          };
+        }
+      );
+      default = {
+        google = {
+          issuer = "https://accounts.google.com";
+          clientId = "206584157355-7cbe4s640tvm7naoludob4ut1emii7sf.apps.googleusercontent.com";
+          lifetime = "24h";
+        };
+        microsoft = {
+          issuer = "https://login.microsoftonline.com/9188040d-6c67-4c5b-b112-36a304b66dad/v2.0";
+          clientId = "096ce0a3-5e72-4da8-9c86-12924b294a01";
+          lifetime = "24h";
+        };
+        github = {
+          issuer = "https://token.actions.githubusercontent.com";
+          clientId = "github";
+          lifetime = "oidc";
+        };
+      };
+      description = "OpenID Connect providers configuration";
+    };
+
+    authorizations = lib.mkOption {
+      type = lib.types.listOf (
+        lib.types.submodule {
+          options = {
+            user = lib.mkOption {
+              type = lib.types.str;
+              description = "Linux user to authorize";
+            };
+
+            principal = lib.mkOption {
+              type = lib.types.str;
+              description = "Principal identifier (email, repo, etc.)";
+            };
+
+            issuer = lib.mkOption {
+              type = lib.types.str;
+              description = "Issuer URI";
+            };
+          };
+        }
+      );
+      default = [ ];
+      description = "User authorization mappings";
+      example = lib.literalExpression ''
+        # This example refers to values in the providers example
+        # adjust your expressions as necessary
+        [
+          {
+            user = "alice";
+            principal = "alice@gmail.com";
+            inherit (config.services.opkssh.providers.google) issuer;
+          }
+          {
+            user = "bob";
+            principal = "repo:NixOs/nixpkgs:environment:production";
+            inherit (config.services.opkssh.providers.github) issuer;
+          }
+        ];
+      '';
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    users.groups.${cfg.group} = { };
+    users.users.${cfg.user} = {
+      isSystemUser = true;
+      description = "OpenPubkey OpenID Connect SSH User";
+      group = cfg.group;
+    };
+
+    services.openssh = {
+      authorizedKeysCommand = "/run/wrappers/bin/opkssh verify %u %k %t";
+      authorizedKeysCommandUser = cfg.user;
+    };
+
+    security.wrappers."opkssh" = {
+      source = "${cfg.package}/bin/opkssh";
+      owner = "root";
+      group = "root";
+    };
+
+    environment.etc."opk/providers" = {
+      mode = "0640";
+      user = cfg.user;
+      group = cfg.group;
+      source = providerFile;
+    };
+
+    environment.etc."opk/auth_id" = {
+      mode = "0640";
+      user = cfg.user;
+      group = cfg.group;
+      source = authIdFile;
+    };
+  };
+
+  meta.maintainers = with lib.maintainers; [ datosh ];
+}

nixos/modules/services/networking/soju.nix

@@ -22,7 +22,6 @@ let
     ${listenCfg}
     hostname ${cfg.hostName}
     ${tlsCfg}
-    db sqlite3 ${stateDir}/soju.db
     ${logCfg}
     http-origin ${concatStringsSep " " cfg.httpOrigins}
     accept-proxy-ip ${concatStringsSep " " cfg.acceptProxyIP}
@@ -153,6 +152,7 @@ in
         ExecStart = "${lib.getExe' cfg.package "soju"} -config ${cfg.configFile}";
         StateDirectory = "soju";
         RuntimeDirectory = "soju";
+        WorkingDirectory = stateDir;
       };
     };
   };

nixos/modules/services/web-apps/glance.nix

@@ -208,6 +208,7 @@ in
             ${secretReplacements}
           '';
         ExecStart = "${getExe cfg.package} --config ${mergedSettingsFile}";
+        Restart = "on-failure";
         WorkingDirectory = "/var/lib/glance";
         EnvironmentFile = cfg.environmentFile;
         StateDirectory = "glance";

nixos/modules/services/web-apps/librespeed.nix

@@ -0,0 +1,452 @@
+{
+  config,
+  lib,
+  options,
+  pkgs,
+  ...
+}:
+let
+  cfg = config.services.librespeed;
+  opt = options.services.librespeed;
+
+  settingsFormat = pkgs.formats.toml { };
+
+  configFile = settingsFormat.generate "librespeed-rust-config.toml" cfg.settings;
+
+  librespeedAssets =
+    pkgs.runCommand "librespeed-assets"
+      {
+        serversList = ''
+          function get_servers() {
+            return ${builtins.toJSON cfg.frontend.servers}
+          }
+          function override_settings () {
+          ${lib.pipe cfg.frontend.settings [
+            (lib.mapAttrs (name: val: "  s.setParameter(${builtins.toJSON name},${builtins.toJSON val});"))
+            lib.attrValues
+            lib.concatLines
+          ]}
+          }
+        '';
+        passAsFile = [ "serversList" ];
+      }
+      ''
+        cp -r ${cfg.package}/assets $out
+        chmod +w "$out/servers_list.js"
+        cp "$serversListPath" "$out/servers_list.js"
+        substitute ${cfg.package}/assets/index.html $out/index.html \
+          --replace-fail "s.setParameter(\"telemetry_level\",\"basic\"); //enable telemetry" "override_settings();" \
+          --replace-fail "LibreSpeed Example" ${lib.escapeShellArg (lib.escapeXML cfg.frontend.pageTitle)} \
+          --replace-fail "PUT@YOUR_EMAIL.HERE" ${lib.escapeShellArg (lib.escapeXML cfg.frontend.contactEmail)} \
+          --replace-fail "TO BE FILLED BY DEVELOPER" ${lib.escapeShellArg (lib.escapeXML cfg.frontend.contactEmail)}
+      '';
+in
+{
+  options.services.librespeed = {
+    enable = lib.mkEnableOption "LibreSpeed server";
+    package = lib.mkPackageOption pkgs "librespeed-rust" { };
+
+    domain = lib.mkOption {
+      description = ''
+        If not `null`, this will add an entry to `services.librespeed.servers` and
+        configure librespeed to use TLS.
+      '';
+      default = null;
+      type = with lib.types; nullOr nonEmptyStr;
+    };
+
+    downloadIPDB = lib.mkOption {
+      description = ''
+        Whether to download the IP info database before starting librespeed.
+        Disable this if you want to use the Go implementation.
+      '';
+      default = !(cfg.secrets ? "ipinfo_api_key");
+      defaultText = lib.literalExpression ''!(config.${opt.secrets} ? "ipinfo_api_key")'';
+      type = lib.types.bool;
+    };
+
+    secrets = lib.mkOption {
+      description = ''
+        Attribute set of filesystem paths.
+        The contents of the specified paths will be read at service start time and merged with the attributes provided in `settings`.
+      '';
+      default = { };
+      type =
+        with lib.types;
+        nullOr (
+          attrsOf (pathWith {
+            inStore = false;
+            absolute = true;
+          })
+        );
+    };
+
+    settings = lib.mkOption {
+      description = ''
+        LibreSpeed configuration written as Nix expression.
+        All values set to `null` will be excluded from the evaluated config.
+        This is useful if you want to omit certain defaults when using a different LibreSpeed implementation.
+
+        See [github.com/librespeed](https://github.com/librespeed/speedtest-rust) for configuration help.
+      '';
+      default = {
+        assets_path =
+          if (cfg.frontend.enable && !cfg.frontend.useNginx) then
+            librespeedAssets
+          else
+            pkgs.writeTextDir "index.html" "";
+
+        bind_address = "::";
+        listen_port = 8989;
+        base_url = "backend";
+        worker_threads = "auto";
+
+        database_type = "none";
+        database_file = "/var/lib/librespeed/speedtest.sqlite";
+
+        # librespeed-rust will fail to start if the following config parameters are omitted.
+        ipinfo_api_key = "";
+        stats_password = "";
+
+        redact_ip_addresses = false;
+        result_image_theme = "light";
+
+        enable_tls = cfg.tlsCertificate != null && cfg.tlsKey != null;
+        tls_cert_file = lib.optionalString (
+          cfg.tlsCertificate != null
+        ) "/run/credentials/librespeed.service/cert.pem";
+        tls_key_file = lib.optionalString (
+          cfg.tlsKey != null
+        ) "/run/credentials/librespeed.service/key.pem";
+      };
+      defaultText = lib.literalExpression ''
+        {
+          assets_path = if (config.${opt.frontend.enable} && !config.${opt.frontend.useNginx}) then
+            librespeedAssets
+          else
+            pkgs.writeTextDir "index.html" "";
+
+          bind_address = "::";
+          listen_port = 8989;
+          base_url = "backend";
+          worker_threads = "auto";
+
+          database_type = "none";
+          database_file = "/var/lib/librespeed/speedtest.sqlite";
+
+          # librespeed-rust will fail to start if the following config parameters are omitted.
+          ipinfo_api_key = "";
+          stats_password = "";
+
+          redact_ip_addresses = false;
+          result_image_theme = "light";
+
+          enable_tls = config.${opt.tlsCertificate} != null && config.${opt.tlsKey} != null;
+          tls_cert_file = lib.optionalString (config.${opt.tlsCertificate} != null) "/run/credentials/librespeed.service/cert.pem";
+          tls_key_file = lib.optionalString (config.${opt.tlsKey} != null) "/run/credentials/librespeed.service/key.pem";
+        }
+      '';
+      type =
+        with lib.types;
+        nullOr (
+          attrsOf (oneOf [
+            (nullOr bool)
+            int
+            str
+            package
+          ])
+        );
+    };
+
+    useACMEHost = lib.mkOption {
+      type = with lib.types; nullOr nonEmptyStr;
+      default = null;
+      example = "speed.example.com";
+      description = ''
+        Use a certificate generated by the NixOS ACME module for the given host.
+        Note that this will not generate a new certificate - you will need to do so with `security.acme.certs`.
+      '';
+    };
+
+    tlsCertificate = lib.mkOption {
+      type = with lib.types; nullOr nonEmptyStr;
+      default =
+        if (cfg.useACMEHost != null) then
+          "${config.security.acme.certs.${cfg.useACMEHost}.directory}/cert.pem"
+        else
+          null;
+      defaultText = lib.literalExpression "lib.optionalString (config.${opt.useACMEHost} != null) \"\${config.security.acme.certs.\${config.${opt.useACMEHost}}.directory}/cert.pem\"";
+      description = "TLS certificate to use. Use together with `tlsKey`.";
+    };
+
+    tlsKey = lib.mkOption {
+      type = with lib.types; nullOr nonEmptyStr;
+      default =
+        if (cfg.useACMEHost != null) then
+          "${config.security.acme.certs.${cfg.useACMEHost}.directory}/key.pem"
+        else
+          null;
+      defaultText = lib.literalExpression "lib.optionalString (config.${opt.useACMEHost} != null) \"\${config.security.acme.certs.\${config.${opt.useACMEHost}}.directory}/key.pem\"";
+      description = "TLS private key to use. Use together with `tlsCertificate`.";
+    };
+
+    frontend = {
+      enable = lib.mkEnableOption "" // {
+        description = ''
+          Enables the LibreSpeed frontend and adds a nginx virtual host if
+          not explicitly disabled and `services.librespeed.domain` is not `null`.
+        '';
+      };
+
+      contactEmail = lib.mkOption {
+        description = "Email address listed in the privacy policy.";
+        type = lib.types.str;
+      };
+
+      pageTitle = lib.mkOption {
+        description = "Title of the webpage.";
+        default = "LibreSpeed";
+        type = lib.types.str;
+      };
+
+      useNginx = lib.mkOption {
+        description = ''
+          Configure nginx for the LibreSpeed frontend.
+          This will only create a virtual host for the frontend and won't proxy all requests because
+          the reported upload and download speeds are inaccurate if proxied.
+        '';
+        default = cfg.domain != null;
+        defaultText = lib.literalExpression "config.${opt.domain} != null";
+        type = lib.types.bool;
+      };
+
+      settings = lib.mkOption {
+        description = ''
+          Override default settings of the speedtest web client.
+          See [speedtest_worker.js][link] for a list of possible values.
+
+          [link]: https://github.com/librespeed/speedtest/blob/master/speedtest_worker.js#L39
+        '';
+        default = {
+          telemetry_level = "basic";
+        };
+        type = lib.types.nullOr (
+          lib.types.submodule {
+            freeformType =
+              with lib.types;
+              attrsOf (oneOf [
+                bool
+                int
+                str
+                float
+              ]);
+          }
+        );
+      };
+
+      servers = lib.mkOption {
+        description = "LibreSpeed servers that should appear in the server list.";
+        type = lib.types.listOf (
+          lib.types.submodule {
+            options = {
+              name = lib.mkOption {
+                description = "Name shown in the server list.";
+                type = lib.types.nonEmptyStr;
+              };
+
+              server = lib.mkOption {
+                description = "URL to the server. You may use `//` instead of `http://` or `https://`.";
+                type = lib.types.nonEmptyStr;
+              };
+
+              dlURL = lib.mkOption {
+                description = ''
+                  URL path to download test on this server.
+                  Append `.php` to the default value if the server uses the php implementation.
+                '';
+                default = "backend/garbage";
+                type = lib.types.nonEmptyStr;
+              };
+
+              ulURL = lib.mkOption {
+                description = ''
+                  URL path to upload test on this server.
+                  Append `.php` to the default value if the server uses the php implementation.
+                '';
+                default = "backend/empty";
+                type = lib.types.nonEmptyStr;
+              };
+
+              pingURL = lib.mkOption {
+                description = ''
+                  URL path to latency/jitter test on this server.
+                  Append `.php` to the default value if the server uses the php implementation.
+                '';
+                default = "backend/empty";
+                type = lib.types.nonEmptyStr;
+              };
+
+              getIpURL = lib.mkOption {
+                description = ''
+                  URL path to IP lookup on this server.
+                  Append `.php` to the default value if the server uses the php implementation.
+                '';
+                default = "backend/getIP";
+                type = lib.types.nonEmptyStr;
+              };
+            };
+          }
+        );
+      };
+    };
+  };
+  config = lib.mkIf cfg.enable {
+    assertions = [
+      {
+        assertion = cfg.frontend.useNginx -> cfg.domain != null;
+        message = "${opt.frontend.useNginx} requires ${opt.domain} to be set.";
+      }
+    ];
+
+    security.acme.certs = lib.mkIf (cfg.useACMEHost != null) {
+      ${cfg.useACMEHost}.reloadServices = [ "librespeed.service" ];
+    };
+
+    services = {
+      librespeed = {
+        frontend.servers = lib.mkIf (cfg.frontend.enable && (cfg.domain != null)) [
+          {
+            name = cfg.domain;
+            server = "//${cfg.domain}";
+          }
+        ];
+        settings = lib.mapAttrs (n: v: lib.mkDefault v) opt.settings.default;
+      };
+
+      nginx.virtualHosts = lib.mkIf (cfg.frontend.enable && cfg.frontend.useNginx) {
+        ${cfg.domain} = {
+          forceSSL = true;
+          locations = {
+            "/".root = librespeedAssets;
+            "= /servers.json".return = "200 '${builtins.toJSON cfg.frontend.servers}'";
+            "/backend/" = {
+              proxyPass = "http://127.0.0.1:${toString cfg.settings.listen_port}/backend/";
+              extraConfig = # nginx
+              ''
+                client_max_body_size 0;
+                gzip off;
+                proxy_buffering off;
+                proxy_request_buffering off;
+              ''
+              + lib.optionalString (lib.any (m: m.name == "brotli") config.services.nginx.additionalModules) ''
+                brotli off;
+              ''
+              + lib.optionalString (lib.any (m: m.name == "zstd") config.services.nginx.additionalModules) ''
+                zstd off;
+              '';
+            };
+          };
+        };
+      };
+    };
+
+    systemd.services = {
+      librespeed-secrets = lib.mkIf (cfg.secrets != { }) {
+        description = "LibreSpeed secret helper";
+
+        ExecStart = lib.getExe (
+          pkgs.writeShellApplication {
+            name = "librespeed-secrets";
+            runtimeInputs = [ pkgs.coreutils ];
+            text = ''
+              cp ${configFile} ''${RUNTIME_DIRECTORY%%:*}/config.toml
+            ''
+            + lib.pipe cfg.secrets [
+              (lib.mapAttrs (
+                name: file: ''
+                  cat >>''${RUNTIME_DIRECTORY%%:*}/config.toml <<EOF
+                  ${name}="$(<${lib.escapeShellArg file})"
+                  EOF
+                ''
+              ))
+              (lib.concatLines lib.attrValues)
+            ];
+          }
+        );
+
+        serviceConfig = {
+          Type = "oneshot";
+          RemainAfterExit = true;
+          RuntimeDirectory = "librespeed";
+          UMask = "u=rw";
+        };
+      };
+
+      librespeed = {
+        description = "LibreSpeed server daemon";
+        wantedBy = [ "multi-user.target" ];
+        wants = [
+          "network.target"
+        ]
+        ++ lib.optionals (cfg.useACMEHost != null) [
+          "acme-finished-${cfg.useACMEHost}.target"
+        ];
+        requires = lib.optionals (cfg.secrets != { }) [ "librespeed-secrets.service" ];
+        after = [
+          "network.target"
+        ]
+        ++ lib.optionals (cfg.secrets != { }) [
+          "librespeed-secrets.service"
+        ]
+        ++ lib.optionals (cfg.useACMEHost != null) [
+          "acme-finished-${cfg.useACMEHost}.target"
+        ];
+
+        serviceConfig = {
+          Type = "simple";
+          Restart = "always";
+
+          DynamicUser = true;
+
+          LoadCredential = lib.mkIf (cfg.tlsCertificate != null && cfg.tlsKey != null) [
+            "cert.pem:${cfg.tlsCertificate}"
+            "key.pem:${cfg.tlsKey}"
+          ];
+
+          ExecStartPre = lib.mkIf cfg.downloadIPDB "${lib.getExe cfg.package} --update-ipdb";
+          ExecStart = "${lib.getExe cfg.package} -c ${
+            if (cfg.secrets == { }) then configFile else "\${RUNTIME_DIRECTORY%%:*}/config.toml"
+          }";
+          WorkingDirectory = "/var/cache/librespeed";
+          RuntimeDirectory = "librespeed";
+          RuntimeDirectoryPreserve = true;
+          StateDirectory = "librespeed";
+          CacheDirectory = "librespeed";
+          SyslogIdentifier = "librespeed";
+
+          RestrictSUIDSGID = true;
+          RestrictNamespaces = true;
+          PrivateTmp = true;
+          PrivateDevices = true;
+          PrivateUsers = true;
+          ProtectHostname = true;
+          ProtectClock = true;
+          ProtectKernelTunables = true;
+          ProtectKernelModules = true;
+          ProtectKernelLogs = true;
+          ProtectControlGroups = true;
+          ProtectSystem = "strict";
+          ProtectHome = true;
+          ProtectProc = "invisible";
+          SystemCallArchitectures = "native";
+          SystemCallFilter = "@system-service";
+          SystemCallErrorNumber = "EPERM";
+          LockPersonality = true;
+          NoNewPrivileges = true;
+        };
+      };
+    };
+  };
+
+  meta.maintainers = lib.teams.c3d2.members;
+}

nixos/modules/services/web-apps/pairdrop.nix

@@ -0,0 +1,152 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+let
+  inherit (lib)
+    boolToString
+    getExe
+    isBool
+    maintainers
+    mapAttrs
+    mkEnableOption
+    mkIf
+    mkOption
+    mkPackageOption
+    optionalAttrs
+    optionals
+    types
+    ;
+
+  cfg = config.services.pairdrop;
+
+  json = pkgs.formats.json { };
+in
+{
+  options.services.pairdrop = {
+    enable = mkEnableOption "pairdrop";
+
+    package = mkPackageOption pkgs "pairdrop" { };
+
+    port = mkOption {
+      type = types.port;
+      default = 3000;
+      example = 3010;
+      description = "The port to listen on.";
+    };
+
+    rtcConfig = mkOption {
+      type = json.type;
+      default = null;
+      example = {
+        sdpSemantics = "unified-plan";
+        iceServers = [
+          {
+            urls = "stun:stun.example.com:19302";
+          }
+        ];
+      };
+      description = ''
+        Configuration for STUN/TURN servers.
+        This is converted to JSON and written into a file automatically.
+        If you want to provide a file path instead, set `RTC_CONFIG` in {option}`services.pairdrop.environment`.
+      '';
+    };
+
+    environment = mkOption {
+      description = ''
+        Additional configuration (environment variables) for PairDrop, see
+        <https://github.com/schlagmichdoch/PairDrop/blob/master/docs/host-your-own.md#environment-variables>
+        for supported values.
+      '';
+
+      type = types.submodule {
+        freeformType =
+          with types;
+          attrsOf (oneOf [
+            bool
+            int
+            str
+          ]);
+
+        options = { };
+      };
+
+      default = { };
+
+      example = {
+        DEBUG_MODE = true;
+        RATE_LIMIT = 1;
+        IPV6_LOCALIZE = 4;
+        WS_FALLBACK = true;
+        SIGNALING_SERVER = "pairdrop.net";
+        RTC_CONFIG = "/etc/pairdrop/rtc-config.json";
+
+        DONATION_BUTTON_ACTIVE = false;
+        TWITTER_BUTTON_ACTIVE = false;
+        MASTODON_BUTTON_ACTIVE = false;
+        BLUESKY_BUTTON_ACTIVE = false;
+        CUSTOM_BUTTON_ACTIVE = false;
+        PRIVACYPOLICY_BUTTON_ACTIVE = false;
+      };
+    };
+  };
+
+  config = mkIf cfg.enable {
+    warnings = optionals (cfg.rtcConfig != null && cfg.environment ? RTC_CONFIG) [
+      "Both services.pairdrop.rtcConfig and services.pairdrop.environment.RTC_CONFIG are set. The environment variable will take precedence."
+    ];
+
+    systemd.services.pairdrop =
+      let
+        environment = {
+          PORT = toString cfg.port;
+        }
+        // (optionalAttrs (cfg.rtcConfig != null) {
+          RTC_CONFIG = json.generate "rtc-config.json" cfg.rtcConfig;
+        })
+        // (mapAttrs (_: v: if isBool v then boolToString v else toString v) cfg.environment);
+      in
+      {
+        inherit environment;
+
+        description = "PairDrop: Transfer Files Cross-Platform";
+        after = [ "network.target" ];
+        wantedBy = [ "multi-user.target" ];
+        serviceConfig = {
+          ExecStart = getExe cfg.package;
+
+          Type = "simple";
+          Restart = "on-failure";
+          RestartSec = 3;
+          DynamicUser = true;
+
+          # Hardening
+          CapabilityBoundingSet = "";
+          NoNewPrivileges = true;
+          PrivateUsers = true;
+          PrivateTmp = true;
+          PrivateDevices = true;
+          PrivateMounts = true;
+          ProtectClock = true;
+          ProtectControlGroups = true;
+          ProtectHome = true;
+          ProtectHostname = true;
+          ProtectKernelLogs = true;
+          ProtectKernelModules = true;
+          ProtectKernelTunables = true;
+          RestrictAddressFamilies = [
+            "AF_INET"
+            "AF_INET6"
+          ];
+          RestrictNamespaces = true;
+          RestrictRealtime = true;
+          RestrictSUIDSGID = true;
+        };
+      };
+  };
+
+  meta.maintainers = with maintainers; [ diogotcorreia ];
+}

nixos/tests/all-tests.nix

@@ -787,7 +787,7 @@ in
   keepalived = runTest ./keepalived.nix;
   keepassxc = runTest ./keepassxc.nix;
   kerberos = handleTest ./kerberos/default.nix { };
-  kernel-generic = handleTest ./kernel-generic.nix { };
+  kernel-generic = handleTest ./kernel-generic { };
   kernel-latest-ath-user-regd = runTest ./kernel-latest-ath-user-regd.nix;
   kernel-rust = handleTest ./kernel-rust.nix { };
   keter = runTest ./keter.nix;
@@ -1150,6 +1150,7 @@ in
   oxidized = handleTest ./oxidized.nix { };
   pacemaker = runTest ./pacemaker.nix;
   packagekit = runTest ./packagekit.nix;
+  pairdrop = runTest ./web-apps/pairdrop.nix;
   paisa = runTest ./paisa.nix;
   pam-file-contents = runTest ./pam/pam-file-contents.nix;
   pam-lastlog = runTest ./pam/pam-lastlog.nix;

nixos/tests/kernel-generic.nix

@@ -1,61 +0,0 @@
-{
-  system ? builtins.currentSystem,
-  config ? { },
-  pkgs ? import ../.. { inherit system config; },
-}@args:
-
-with pkgs.lib;
-
-let
-  testsForLinuxPackages =
-    linuxPackages:
-    (import ./make-test-python.nix (
-      { pkgs, ... }:
-      {
-        name = "kernel-${linuxPackages.kernel.version}";
-        meta = with pkgs.lib.maintainers; {
-          maintainers = [
-            nequissimus
-            atemu
-            ma27
-          ];
-        };
-
-        nodes.machine =
-          { ... }:
-          {
-            boot.kernelPackages = linuxPackages;
-          };
-
-        testScript = ''
-          assert "Linux" in machine.succeed("uname -s")
-          assert "${linuxPackages.kernel.modDirVersion}" in machine.succeed("uname -a")
-        '';
-      }
-    ) args);
-  kernels = pkgs.linuxKernel.vanillaPackages // {
-    inherit (pkgs.linuxKernel.packages)
-      linux_6_12_hardened
-      linux_rt_5_4
-      linux_rt_5_10
-      linux_rt_5_15
-      linux_rt_6_1
-      linux_rt_6_6
-      linux_libre
-
-      linux_testing
-      ;
-  };
-
-in
-mapAttrs (_: lP: testsForLinuxPackages lP) kernels
-// {
-  passthru = {
-    inherit testsForLinuxPackages;
-
-    # Useful for development testing of all Kernel configs without building full Kernel
-    configfiles = mapAttrs (_: lP: lP.kernel.configfile) kernels;
-
-    testsForKernel = kernel: testsForLinuxPackages (pkgs.linuxPackagesFor kernel);
-  };
-}

nixos/tests/kernel-generic/default.nix

@@ -0,0 +1,98 @@
+{
+  system ? builtins.currentSystem,
+  config ? { },
+  pkgs ? import ../.. { inherit system config; },
+}@args:
+
+with pkgs.lib;
+
+let
+  patchedPkgs = pkgs.extend (
+    final: prev: {
+      kernelPackagesExtensions = prev.kernelPackagesExtensions ++ [
+        (
+          finalKernelPackages: _:
+          let
+            finalKernel = finalKernelPackages.kernel;
+          in
+          {
+            hello-world = final.stdenv.mkDerivation {
+              name = "hello-module";
+
+              nativeBuildInputs = finalKernel.moduleBuildDependencies;
+              makeFlags = finalKernel.commonMakeFlags ++ [
+                # Variable refers to the local Makefile.
+                "KDIR=${finalKernel.dev}/lib/modules/${finalKernel.modDirVersion}/build"
+                # Variable of the Linux src tree's main Makefile.
+                "INSTALL_MOD_PATH=$(out)"
+              ];
+
+              buildFlags = [ "modules" ];
+              installTargets = [ "modules_install" ];
+
+              src = ./hello-world-src;
+            };
+          }
+        )
+      ];
+    }
+  );
+
+  testsForLinuxPackages =
+    linuxPackages:
+    (import ../make-test-python.nix (
+      { pkgs, ... }:
+      {
+        name = "kernel-${linuxPackages.kernel.version}";
+        meta = with pkgs.lib.maintainers; {
+          maintainers = [
+            nequissimus
+            atemu
+            ma27
+          ];
+        };
+
+        nodes.machine =
+          { config, ... }:
+          {
+            boot.kernelPackages = linuxPackages;
+
+            boot.extraModulePackages = [ config.boot.kernelPackages.hello-world ];
+
+            boot.kernelModules = [ "hello" ];
+          };
+
+        testScript = ''
+          assert "Linux" in machine.succeed("uname -s")
+          assert "${linuxPackages.kernel.modDirVersion}" in machine.succeed("uname -a")
+
+          assert "Hello world!" in machine.succeed("dmesg")
+        '';
+      }
+    ) args);
+  kernels = patchedPkgs.linuxKernel.vanillaPackages // {
+    inherit (patchedPkgs.linuxKernel.packages)
+      linux_6_12_hardened
+      linux_rt_5_4
+      linux_rt_5_10
+      linux_rt_5_15
+      linux_rt_6_1
+      linux_rt_6_6
+      linux_libre
+
+      linux_testing
+      ;
+  };
+
+in
+mapAttrs (_: lP: testsForLinuxPackages lP) kernels
+// {
+  passthru = {
+    inherit testsForLinuxPackages;
+
+    # Useful for development testing of all Kernel configs without building full Kernel
+    configfiles = mapAttrs (_: lP: lP.kernel.configfile) kernels;
+
+    testsForKernel = kernel: testsForLinuxPackages (pkgs.linuxPackagesFor kernel);
+  };
+}

nixos/tests/kernel-generic/hello-world-src/Makefile

@@ -0,0 +1,15 @@
+ifneq ($(KERNELRELEASE),)
+# kbuild part of makefile
+obj-m := hello.o
+else
+# normal makefile
+KDIR ?= /lib/modules/`uname -r`/build
+
+.PHONY: modules
+modules:
+	$(MAKE) -C $(KDIR) M=$$PWD modules
+
+.PHONY: modules_install
+modules_install:
+	$(MAKE) -C $(KDIR) M=$$PWD modules_install
+endif

nixos/tests/kernel-generic/hello-world-src/hello.c

@@ -0,0 +1,18 @@
+// SPDX-License-Identifier: MIT
+#include <linux/module.h>
+#include <linux/printk.h>
+
+static int hello(void)
+{
+	pr_info("Hello world!");
+	return 0;
+}
+module_init(hello);
+
+static void goodbye(void)
+{
+	pr_info("Goodbye");
+}
+module_exit(goodbye);
+
+MODULE_LICENSE("MIT");

nixos/tests/web-apps/pairdrop.nix

@@ -0,0 +1,32 @@
+{ ... }:
+{
+  name = "pairdrop-nixos";
+
+  nodes.machine =
+    { pkgs, ... }:
+    {
+      services.pairdrop = {
+        enable = true;
+        port = 1337;
+        environment = {
+          SIGNALING_SERVER = "pairdrop.net";
+          CUSTOM_BUTTON_ACTIVE = false;
+        };
+      };
+    };
+
+  testScript = ''
+    import json
+
+    machine.wait_for_unit("pairdrop.service")
+
+    machine.wait_for_open_port(1337)
+    machine.succeed("curl --fail http://localhost:1337/")
+
+    res = machine.succeed("curl --fail http://localhost:1337/config")
+    print(res)
+    cfg = json.loads(res)
+    assert cfg["signalingServer"] == "pairdrop.net/"
+    assert cfg["buttons"]["custom_button"]["active"] == "false"
+  '';
+}

pkgs/applications/editors/vscode/extensions/saoudrizwan.claude-dev/default.nix

@@ -7,8 +7,8 @@ vscode-utils.buildVscodeMarketplaceExtension {
   mktplcRef = {
     name = "claude-dev";
     publisher = "saoudrizwan";
-    version = "3.32.7";
-    hash = "sha256-cnjF/laOw7A+nAtBOMWXi4M6NoOK/4kWHne4qlyn4wM=";
+    version = "3.32.8";
+    hash = "sha256-IwWAk8Awi6JNDQbJ7XX2wiFVsEYKzIBHqynig5W5Dtg=";
   };
 
   meta = {

pkgs/applications/emulators/libretro/cores/beetle-pce-fast.nix

@@ -5,13 +5,13 @@
 }:
 mkLibretroCore {
   core = "mednafen-pce-fast";
-  version = "0-unstable-2025-10-03";
+  version = "0-unstable-2025-10-10";
 
   src = fetchFromGitHub {
     owner = "libretro";
     repo = "beetle-pce-fast-libretro";
-    rev = "3e666a36bb3d5b3fa1573b62a9928bd441b618b7";
-    hash = "sha256-PIuCTGd9N8wQcfZWEIAVhZr31gJ0onca734Bn0GsVsk=";
+    rev = "22ca252ac248de126f5c7df8f8ff07a31a7e7731";
+    hash = "sha256-7mG7TCTPuu3T6x50Lw85lwcZh80zSTG4XbDhoxCSw/0=";
   };
 
   makefile = "Makefile";

pkgs/applications/networking/browsers/librewolf/src.json

@@ -1,11 +1,11 @@
 {
-  "packageVersion": "143.0.4-1",
+  "packageVersion": "144.0-1",
   "source": {
-    "rev": "143.0.4-1",
-    "hash": "sha256-RyLz5se2AqXAmsa/MckiUgcBfRxZVVsrNg2L757qOuo="
+    "rev": "144.0-1",
+    "hash": "sha256-5LE8VUKQUua8l/mZN8a7MQCr3uPWJuFZ2WfhJyt14bE="
   },
   "firefox": {
-    "version": "143.0.4",
-    "hash": "sha512-K8veTnLqQenMyYg2kBY1NQtdx7UMYY4Zq2EDonrcDwF8o/p1VTeMivbuHzoU0Ck1KJ/isNNdhA1hD1rAeojktg=="
+    "version": "144.0",
+    "hash": "sha512-4fkk7QBqMfUzPqavIZwfuQ1IZuWImsY0wySj6AsEKn4LK5rreYZy6hpDT7+Bf8C4KhLsD7QFpI46LKIcw5REXg=="
   }
 }

pkgs/applications/networking/cluster/terraform-providers/default.nix

@@ -82,7 +82,9 @@ let
       passthru = attrs // {
         inherit provider-source-address;
         updateScript = writeShellScript "update" ''
-          ./pkgs/applications/networking/cluster/terraform-providers/update-provider "${owner}_${lib.removePrefix "terraform-provider-" repo}"
+          ./pkgs/applications/networking/cluster/terraform-providers/update-provider "${
+            lib.replaceStrings [ "registry.terraform.io/" "/" ] [ "" "_" ] provider-source-address
+          }"
         '';
       };
     }

pkgs/applications/networking/instant-messengers/linphone/bc-mbedtls/default.nix

@@ -0,0 +1,71 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitLab,
+
+  cmake,
+  ninja,
+  perl, # Project uses Perl for scripting and testing
+  python3,
+}:
+let
+  rev = "1d452d3852321cb55c07307cb506b25759134b76";
+in
+stdenv.mkDerivation {
+  pname = "mbedtls";
+  # taken from `ChangeLog`
+  version = "3.6.1-unstable-2025-08-11";
+
+  src = fetchFromGitLab {
+    inherit rev;
+
+    domain = "gitlab.linphone.org";
+    group = "BC";
+    owner = "public/external";
+    repo = "mbedtls";
+    sha256 = "sha256-jQpRn2F21sPKKAiaqsUvaKyuR80AnedG/hAyiNamKjc=";
+    fetchSubmodules = true;
+  };
+
+  nativeBuildInputs = [
+    cmake
+    ninja
+    perl
+    python3
+  ];
+
+  strictDeps = true;
+
+  # trivialautovarinit on clang causes test failures
+  hardeningDisable = lib.optional stdenv.cc.isClang "trivialautovarinit";
+
+  cmakeFlags = [
+    # tests don't compile, due to how BC sets up threading
+    "-DENABLE_TESTING=OFF"
+    "-DENABLE_PROGRAMS=OFF"
+
+    "-DUSE_SHARED_MBEDTLS_LIBRARY=${if stdenv.hostPlatform.isStatic then "off" else "on"}"
+
+    # Avoid a dependency on jsonschema and jinja2 by not generating source code
+    # using python. In releases, these generated files are already present in
+    # the repository and do not need to be regenerated. See:
+    # https://github.com/Mbed-TLS/mbedtls/releases/tag/v3.3.0 below "Requirement changes".
+    "-DGEN_FILES=off"
+  ];
+
+  # Parallel checking causes test failures
+  # https://github.com/Mbed-TLS/mbedtls/issues/4980
+  enableParallelChecking = false;
+
+  meta = {
+    homepage = "https://gitlab.linphone.org/BC/public/external/mbedtls";
+    changelog = "https://gitlab.linphone.org/BC/public/external/mbedtls/-/blob/${rev}/ChangeLog";
+    description = "Portable cryptographic and TLS library, formerly known as PolarSSL (Linphone fork)";
+    license = with lib.licenses; [
+      asl20 # or
+      gpl2Plus
+    ];
+    platforms = lib.platforms.all;
+    maintainers = with lib.maintainers; [ naxdy ];
+  };
+}

pkgs/applications/networking/instant-messengers/linphone/bctoolbox/default.nix

@@ -2,7 +2,7 @@
   bcunit,
   bc-decaf,
   mkLinphoneDerivation,
-  openssl,
+  bc-mbedtls,
   lib,
 
   # tests
@@ -14,15 +14,14 @@ mkLinphoneDerivation (finalAttrs: {
   propagatedBuildInputs = [
     bcunit
     bc-decaf
-    openssl
+    bc-mbedtls
   ];
 
   cmakeFlags = [
     "-DENABLE_STRICT=NO"
 
-    # mbedtils does not build
-    "-DENABLE_MBEDTLS=NO"
-    "-DENABLE_OPENSSL=YES"
+    "-DENABLE_MBEDTLS=YES"
+    "-DENABLE_OPENSSL=NO"
   ];
 
   strictDeps = true;

pkgs/applications/video/obs-studio/default.nix

@@ -6,6 +6,7 @@
   ninja,
   nv-codec-headers-12,
   fetchFromGitHub,
+  fetchpatch2,
   addDriverRunpath,
   autoAddDriverRunpath,
   cudaSupport ? config.cudaSupport,
@@ -97,6 +98,11 @@ stdenv.mkDerivation (finalAttrs: {
 
   patches = [
     ./fix-nix-plugin-path.patch
+    # Fix build with Qt 6.10 https://github.com/obsproject/obs-studio/pull/12328
+    (fetchpatch2 {
+      url = "https://github.com/obsproject/obs-studio/commit/26dfacbd4f5217258a2f1c5472a544c65a182d10.patch?full_index=1";
+      hash = "sha256-gEWDzZ+GPCR+rmytXcbiBcvzLg8VwZCveMKkvho3COI=";
+    })
   ];
 
   nativeBuildInputs = [

pkgs/applications/window-managers/hyprwm/hyprland-plugins/hyprgrass.nix

@@ -12,13 +12,13 @@
 
 mkHyprlandPlugin {
   pluginName = "hyprgrass";
-  version = "0.8.2-unstable-2025-05-08";
+  version = "0.8.2-unstable-2025-10-08";
 
   src = fetchFromGitHub {
     owner = "horriblename";
     repo = "hyprgrass";
-    rev = "7cf3779b5cdc6fa62fdc733b30c31a5b8e48609c";
-    hash = "sha256-8Sl2V23EYcZMniBLmKenxH7bMLTGC6Q84ntyFvOUkWU=";
+    rev = "fdfa60d464a18ae20b7a7bc63c0d2336f37c164b";
+    hash = "sha256-2Y2D2wuNqSldprawq8BSca90gSYSR5ZKL5ZW2YAV2F8=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/_1/_1password-gui/package.nix

@@ -33,7 +33,6 @@ let
     maintainers = with lib.maintainers; [
       khaneliman
       timstott
-      savannidgerinel
       sebtm
       bdd
     ];

pkgs/by-name/al/albedo/package.nix

@@ -6,16 +6,16 @@
 
 buildGoModule rec {
   pname = "albedo";
-  version = "0.2.0";
+  version = "0.3.0";
 
   src = fetchFromGitHub {
     owner = "coreruleset";
     repo = "albedo";
     tag = "v${version}";
-    hash = "sha256-4ZQTOix5bCn4EmrabiG4L74F2++cQhIbvtgNKBW7aDk=";
+    hash = "sha256-H/ViMVzuuQYORDiNXBgs7imy+c4IaL2pY5KVN6ecJoo=";
   };
 
-  vendorHash = "sha256-qZga699UjBsPmOUSN66BFInl8Bmk42HiVn0MfPlxRE4=";
+  vendorHash = "sha256-FBkHpTn4jG6iw1GYAuGHh2WCRro4mRgumYoGMkmv6qU=";
 
   ldflags = [
     "-s"

pkgs/by-name/al/aligator/package.nix

@@ -4,8 +4,6 @@
   fontconfig,
   llvmPackages,
   nix-update-script,
-  python3Packages,
-  pythonSupport ? false,
   stdenv,
 
   # nativeBuildInputs
@@ -23,18 +21,19 @@
   pinocchio,
 
   # checkInputs
+  catch2_3,
   gbenchmark,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "aligator";
-  version = "0.15.0";
+  version = "0.16.0";
 
   src = fetchFromGitHub {
     owner = "Simple-Robotics";
     repo = "aligator";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-x9vOj5Dy2SaQOLBCM13wZ/4SxgBz+99K/UxJqhKTg3c=";
+    hash = "sha256-OyCJa2iTkCxVLooSKdVgBd0y7rHObo4vFcc56t48TSY=";
   };
 
   outputs = [
@@ -49,48 +48,33 @@ stdenv.mkDerivation (finalAttrs: {
     cmake
     graphviz
     pkg-config
-  ]
-  ++ lib.optionals pythonSupport [
-    python3Packages.python
-    python3Packages.pythonImportsCheckHook
   ];
+
   buildInputs = [
     fmt
   ]
   ++ lib.optionals stdenv.hostPlatform.isDarwin [
     llvmPackages.openmp
   ];
+
   propagatedBuildInputs = [
-    suitesparse
-  ]
-  ++ lib.optionals pythonSupport [
-    python3Packages.crocoddyl
-    python3Packages.matplotlib
-    python3Packages.pinocchio
-  ]
-  ++ lib.optionals (!pythonSupport) [
     crocoddyl
     pinocchio
+    suitesparse
   ];
+
   checkInputs = [
+    catch2_3
     gbenchmark
-  ]
-  ++ lib.optionals pythonSupport [
-    python3Packages.matplotlib
-    python3Packages.pytest
   ];
 
   cmakeFlags = [
-    (lib.cmakeBool "BUILD_PYTHON_INTERFACE" pythonSupport)
+    (lib.cmakeBool "BUILD_PYTHON_INTERFACE" false)
     (lib.cmakeBool "BUILD_WITH_PINOCCHIO_SUPPORT" true)
     (lib.cmakeBool "BUILD_CROCODDYL_COMPAT" true)
     (lib.cmakeBool "BUILD_WITH_OPENMP_SUPPORT" true)
     (lib.cmakeBool "BUILD_WITH_CHOLMOD_SUPPORT" true)
     (lib.cmakeBool "GENERATE_PYTHON_STUBS" false) # this need git at configure time
-  ]
-  ++ lib.optionals (stdenv.hostPlatform.isDarwin && pythonSupport) [
-    # ignore one failing test for now
-    (lib.cmakeFeature "CMAKE_CTEST_ARGUMENTS" "--exclude-regex;'aligator-test-py-rollout|aligator-test-py-frames'")
   ];
 
   # Fontconfig error: Cannot load default config file: No such file: (null)
@@ -105,7 +89,6 @@ stdenv.mkDerivation (finalAttrs: {
   '';
 
   doCheck = true;
-  pythonImportsCheck = [ "aligator" ];
 
   passthru.updateScript = nix-update-script { };
 

pkgs/by-name/al/aliyun-cli/package.nix

@@ -8,13 +8,13 @@
 
 buildGoModule rec {
   pname = "aliyun-cli";
-  version = "3.0.305";
+  version = "3.0.307";
 
   src = fetchFromGitHub {
     owner = "aliyun";
     repo = "aliyun-cli";
     tag = "v${version}";
-    hash = "sha256-zbDG6Mr+CVMoIfB7Jy99VrSNdAER+qYh3fbzoI6tMiE=";
+    hash = "sha256-36IGN0salTpMWJDA/UKFQiyob/r5WLZFC9krTXVTxuA=";
     fetchSubmodules = true;
   };
 

pkgs/by-name/as/assimp/package.nix

@@ -45,12 +45,17 @@ stdenv.mkDerivation (finalAttrs: {
 
   cmakeFlags = [
     (lib.cmakeBool "ASSIMP_BUILD_ASSIMP_TOOLS" true)
+    (lib.cmakeBool "ASSIMP_BUILD_TESTS" finalAttrs.finalPackage.doCheck)
   ];
 
   # Some matrix tests fail on non-86_64-linux:
   # https://github.com/assimp/assimp/issues/6246
   # https://github.com/assimp/assimp/issues/6247
-  doCheck = !(stdenv.hostPlatform.isLinux && !stdenv.hostPlatform.isx86_64);
+  # On Darwin, the bundled googletest is not compatible with Clang 21.
+  #  contrib/googletest/googletest/include/gtest/gtest-printers.h:498:35:
+  #  error: implicit conversion from 'char16_t' to 'char32_t' may change the meaning of the represented code unit
+  #  [-Werror,-Wcharacter-conversion]
+  doCheck = stdenv.hostPlatform.isLinux && stdenv.hostPlatform.isx86_64;
   checkPhase = ''
     runHook preCheck
     bin/unit

pkgs/by-name/av/avalonia/deps.json

@@ -887,8 +887,8 @@
   },
   {
     "pname": "Microsoft.WindowsDesktop.App.Ref",
-    "version": "8.0.20",
-    "hash": "sha256-EDrxjwHRVTirMADYU+po/ANd6LaoehL/9RSiuZEsIB0="
+    "version": "8.0.21",
+    "hash": "sha256-RufsU8Mr81jK6fIbULBgkv0BRVmobXL38L8rBwBjJyg="
   },
   {
     "pname": "Mono.Cecil",

pkgs/by-name/ba/backgroundremover/package.nix

@@ -5,13 +5,14 @@
   fetchFromGitHub,
   fetchurl,
   gitUpdater,
+  imagemagick,
 }:
 
 let
   p = python3.pkgs;
   self = p.buildPythonApplication rec {
     pname = "backgroundremover";
-    version = "0.3.0";
+    version = "0.3.4";
     pyproject = true;
 
     build-system = [
@@ -21,8 +22,8 @@ let
     src = fetchFromGitHub {
       owner = "nadermx";
       repo = "backgroundremover";
-      rev = "v${version}";
-      hash = "sha256-fWazMDjc+EoXvO7Iq+zwtJaMEU64ajpO6JtlvU5T0nc=";
+      tag = "v${version}";
+      hash = "sha256-7C31wlokX3M4csZ4ZbOqxowQvh8DMQJJcENKgQWNTa8=";
     };
 
     models = runCommand "background-remover-models" { } ''
@@ -36,9 +37,6 @@ let
       rm -rf *dist
       substituteInPlace backgroundremover/bg.py backgroundremover/u2net/detect.py \
         --replace-fail 'os.path.expanduser(os.path.join("~", ".u2net", model_name + ".pth"))' "os.path.join(\"$models\", model_name + \".pth\")"
-
-      substituteInPlace backgroundremover/bg.py \
-        --replace-fail 'import moviepy.editor' 'import moviepy'
     '';
 
     pythonRelaxDeps = [
@@ -87,11 +85,15 @@ let
           in
           runCommand "backgroundremover-image-test.png"
             {
-              buildInputs = [ self ];
+              buildInputs = [
+                self
+                imagemagick
+              ];
             }
             ''
+              convert ${demoImage} input.png
               export NUMBA_CACHE_DIR=$(mktemp -d)
-              backgroundremover -i ${demoImage} -o $out
+              backgroundremover -i input.png -o $out
             '';
       };
       updateScript = gitUpdater { rev-prefix = "v"; };

pkgs/by-name/ba/balena-cli/package.nix

@@ -21,16 +21,16 @@ let
 in
 buildNpmPackage' rec {
   pname = "balena-cli";
-  version = "22.4.10";
+  version = "22.4.13";
 
   src = fetchFromGitHub {
     owner = "balena-io";
     repo = "balena-cli";
     rev = "v${version}";
-    hash = "sha256-KvFyqVrb5C89B4BeZCqdDZtneX7kWyaLF0oI8SqrsGw=";
+    hash = "sha256-nke7EQscVPu1A/d4DKi7pSb6/MQgeFtG+zhMZT+bhWk=";
   };
 
-  npmDepsHash = "sha256-ty+D/p4cDlWkruUD0J4IzaEWIFp/fe4KBGqorV+qmrw=";
+  npmDepsHash = "sha256-GQXbXkOt8nkOB2OeEcKsp1yJd5lXS+KKout/5ffLgD0=";
 
   makeCacheWritable = true;
 

pkgs/by-name/bc/bcachefs-tools/kernel-module.nix

@@ -38,11 +38,12 @@ stdenv.mkDerivation {
 
     inherit (bcachefs-tools.meta)
       homepage
+      downloadPage
       license
       maintainers
       platforms
       ;
 
-    broken = !(lib.versionAtLeast kernel.version "6.16" && lib.versionOlder kernel.version "6.18");
+    broken = !(lib.versionAtLeast kernel.version "6.16" && lib.versionOlder kernel.version "6.19");
   };
 }

pkgs/by-name/bc/bcachefs-tools/package.nix

@@ -19,7 +19,7 @@
   rustPlatform,
   makeWrapper,
   nix-update-script,
-  testers,
+  versionCheckHook,
   nixosTests,
   installShellFiles,
   fuseSupport ? false,
@@ -28,15 +28,25 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "bcachefs-tools";
-  version = "1.31.7";
+  version = "1.31.11";
 
   src = fetchFromGitHub {
     owner = "koverstreet";
     repo = "bcachefs-tools";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-gKtOyaDN9hQo45Rk9hMabKRefOG+ooaCrtLBCPx0fT8=";
+    hash = "sha256-CnRB/iS1NZ0Ebsi12wXFvVb0qdv0V9q1oC3nLj13mqs=";
   };
 
+  cargoDeps = rustPlatform.fetchCargoVendor {
+    inherit (finalAttrs) src;
+    hash = "sha256-50xy1nqDctgz/lXd5JsfaU6yxDoRCQRtiYBwuEuiKFA=";
+  };
+
+  postPatch = ''
+    substituteInPlace Makefile \
+      --replace-fail "target/release/bcachefs" "target/${stdenv.hostPlatform.rust.rustcTargetSpec}/release/bcachefs"
+  '';
+
   nativeBuildInputs = [
     pkg-config
     cargo
@@ -45,14 +55,12 @@ stdenv.mkDerivation (finalAttrs: {
     rustPlatform.bindgenHook
     makeWrapper
     installShellFiles
-    udevCheckHook
   ];
 
   buildInputs = [
     libaio
     keyutils
     lz4
-
     libsodium
     liburcu
     libuuid
@@ -63,16 +71,6 @@ stdenv.mkDerivation (finalAttrs: {
   ]
   ++ lib.optional fuseSupport fuse3;
 
-  cargoDeps = rustPlatform.fetchCargoVendor {
-    src = finalAttrs.src;
-    hash = "sha256-INnv9kRgM8RRMwBnC6Vwj9S5FfI5gMscU//aNzHF+8w=";
-  };
-
-  outputs = [
-    "out"
-    "dkms"
-  ];
-
   makeFlags = [
     "PREFIX=${placeholder "out"}"
     "VERSION=${finalAttrs.version}"
@@ -84,6 +82,9 @@ stdenv.mkDerivation (finalAttrs: {
     "PKGCONFIG_UDEVDIR=$(out)/lib/udev"
   ]
   ++ lib.optional fuseSupport "BCACHEFS_FUSE=1";
+
+  enableParallelBuilding = true;
+
   installFlags = [
     "install"
     "install_dkms"
@@ -97,18 +98,18 @@ stdenv.mkDerivation (finalAttrs: {
   # FIXME: Try enabling this once the default linux kernel is at least 6.7
   doCheck = false; # needs bcachefs module loaded on builder
 
-  doInstallCheck = true;
-
-  postPatch = ''
-    substituteInPlace Makefile \
-      --replace-fail "target/release/bcachefs" "target/${stdenv.hostPlatform.rust.rustcTargetSpec}/release/bcachefs"
-  '';
-
   preCheck = lib.optionalString (!fuseSupport) ''
     rm tests/test_fuse.py
   '';
   checkFlags = [ "BCACHEFS_TEST_USE_VALGRIND=no" ];
 
+  doInstallCheck = true;
+  nativeInstallCheckInputs = [
+    udevCheckHook
+    versionCheckHook
+  ];
+  versionCheckProgramArg = "version";
+
   postInstall = lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
     installShellCompletion --cmd bcachefs \
       --bash <($out/sbin/bcachefs completions bash) \
@@ -116,16 +117,16 @@ stdenv.mkDerivation (finalAttrs: {
       --fish <($out/sbin/bcachefs completions fish)
   '';
 
+  outputs = [
+    "out"
+    "dkms"
+  ];
+
   passthru = {
     # See NOTE in linux-kernels.nix
     kernelModule = import ./kernel-module.nix finalAttrs.finalPackage;
 
     tests = {
-      version = testers.testVersion {
-        package = finalAttrs.finalPackage;
-        command = "${finalAttrs.meta.mainProgram} version";
-        version = "${finalAttrs.version}";
-      };
       smoke-test = nixosTests.bcachefs;
       inherit (nixosTests.installer) bcachefsSimple bcachefsEncrypted bcachefsMulti;
     };
@@ -133,11 +134,10 @@ stdenv.mkDerivation (finalAttrs: {
     updateScript = nix-update-script { };
   };
 
-  enableParallelBuilding = true;
-
   meta = {
     description = "Tool for managing bcachefs filesystems";
     homepage = "https://bcachefs.org/";
+    downloadPage = "https://github.com/koverstreet/bcachefs-tools";
     license = lib.licenses.gpl2Only;
     maintainers = with lib.maintainers; [
       davidak

pkgs/by-name/bi/bitrise/package.nix

@@ -6,18 +6,23 @@
 }:
 buildGoModule rec {
   pname = "bitrise";
-  version = "2.33.2";
+  version = "2.34.3";
 
   src = fetchFromGitHub {
     owner = "bitrise-io";
     repo = "bitrise";
     rev = "v${version}";
-    hash = "sha256-ckiozGSk8a0bzTzj8PuN55rrL2r95BylYRUHZdQF+Kc=";
+    hash = "sha256-Px4u3Jc3HbTN9NRGFYwTVL0/g+PsFw+JxEyOuTSTQbc=";
   };
 
   # many tests rely on writable $HOME/.bitrise and require network access
   doCheck = false;
 
+  # resolves error: main module (github.com/bitrise-io/bitrise/v2) does not contain package github.com/bitrise-io/bitrise/v2/integrationtests/config
+  excludedPackages = [
+    "./integrationtests"
+  ];
+
   vendorHash = null;
   ldflags = [
     "-X github.com/bitrise-io/bitrise/version.Commit=${src.rev}"

pkgs/by-name/bl/blas-reference/package.nix

@@ -26,6 +26,13 @@ stdenv.mkDerivation rec {
 
   cmakeFlags = [ "-DBUILD_SHARED_LIBS=ON" ] ++ lib.optional blas64 "-DBUILD_INDEX64=ON";
 
+  # CMake 4 is no longer retro compatible with versions < 3.5
+  postPatch = ''
+    substituteInPlace CMakeLists.txt --replace-fail \
+      "cmake_minimum_required(VERSION 3.2)" \
+      "cmake_minimum_required(VERSION 3.5)"
+  '';
+
   postInstall =
     let
       canonicalExtension =

pkgs/by-name/bo/bootspec/package.nix

@@ -6,16 +6,16 @@
 }:
 rustPlatform.buildRustPackage rec {
   pname = "bootspec";
-  version = "1.1.0";
+  version = "2.0.0";
 
   src = fetchFromGitHub {
     owner = "DeterminateSystems";
     repo = "bootspec";
     rev = "v${version}";
-    hash = "sha256-WDEaTxj5iT8tvasd6gnMhRgNoEdDi9Wi4ke8sVtNpt8=";
+    hash = "sha256-FeNBn/HeOanvFSCH9gNBCwlSJx1EhhEdrgX2rbXdZgI=";
   };
 
-  cargoHash = "sha256-ZJKoL1vYfAG1rpCcE1jRm7Yj2dhooJ6iQ91c6EGF83E=";
+  cargoHash = "sha256-vJVOseAvIGNxos180Z5OHgo3u/2iyeOgOetXTJxyZx0=";
 
   passthru.updateScript = nix-update-script { };
 

pkgs/by-name/ca/cargo-xwin/package.nix

@@ -6,16 +6,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "cargo-xwin";
-  version = "0.20.0";
+  version = "0.20.1";
 
   src = fetchFromGitHub {
     owner = "rust-cross";
     repo = "cargo-xwin";
     rev = "v${version}";
-    hash = "sha256-R9CdgsBuyPYOFG4aW59JjxvNkc6IXXjsHR7359wcNGk=";
+    hash = "sha256-RfXX6LZrxQmWtjnMVIpCj9KVn5fnvQRGgEeH+gTR0Vk=";
   };
 
-  cargoHash = "sha256-0oe7zh7fZv2P88DBtTirmW7HvLP0jgJ5Je88IL4v+l8=";
+  cargoHash = "sha256-0N2JLENHG6QUcEtw237Oe/fwdgo87DVJ+Gx6wtpP9BU=";
 
   meta = with lib; {
     description = "Cross compile Cargo project to Windows MSVC target with ease";

pkgs/by-name/cc/ccemux/package.nix

@@ -71,7 +71,6 @@ stdenv.mkDerivation rec {
     sourceProvenance = with sourceTypes; [ binaryBytecode ];
     license = licenses.mit;
     maintainers = with maintainers; [
-      CrazedProgrammer
       viluon
     ];
     mainProgram = "ccemux";

pkgs/by-name/ce/centrifugo/package.nix

@@ -16,16 +16,16 @@ let
 in
 buildGoModule rec {
   pname = "centrifugo";
-  version = "6.3.1";
+  version = "6.4.0";
 
   src = fetchFromGitHub {
     owner = "centrifugal";
     repo = "centrifugo";
     rev = "v${version}";
-    hash = "sha256-1LP33LXGb+W23Mej/kOOl4wIuP/ZKj5ICOabH0WjKWk=";
+    hash = "sha256-tkhYt9KqxSp2uvFLUz9SMiyP/M8EmVlnFWFI7RZWtYQ=";
   };
 
-  vendorHash = "sha256-cSiRXIm9Iz0FmialBfcs04e5OUZn/ap9q/MEmGzWz+M=";
+  vendorHash = "sha256-KdmkhgfF+9n5VL5GyKBXO9isCozY8DDSdP1pCGQE2D4=";
 
   ldflags = [
     "-s"

pkgs/by-name/cg/cgoban/package.nix

@@ -37,7 +37,7 @@ stdenv.mkDerivation {
     homepage = "https://www.gokgs.com/";
     sourceProvenance = with sourceTypes; [ binaryBytecode ];
     license = licenses.free;
-    maintainers = with maintainers; [ savannidgerinel ];
+    maintainers = [ ];
     platforms = temurin-jre-bin-17.meta.platforms;
   };
 }

pkgs/by-name/ch/chezmoi/package.nix

@@ -7,16 +7,16 @@
 
 buildGo125Module (finalAttrs: {
   pname = "chezmoi";
-  version = "2.65.0";
+  version = "2.66.0";
 
   src = fetchFromGitHub {
     owner = "twpayne";
     repo = "chezmoi";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-neUltKkmNUtTajTwfWIIM9sJfDSXuAqJT3uLq6vR5NE=";
+    hash = "sha256-r49KRq6PIB6gRnudY9HMm0UBjd07J6tUpA3oTOyJzGI=";
   };
 
-  vendorHash = "sha256-NQ7k9bydAJDOGRX3bvRGkX5FuU8Va1IjUa6h0JEiLzo=";
+  vendorHash = "sha256-ioRFzkp4aSUdPq3NSKDj05DbTp6PwAjVkf7VtdpaI2w=";
 
   nativeBuildInputs = [
     installShellFiles

pkgs/by-name/cn/cnquery/package.nix

@@ -6,13 +6,13 @@
 
 buildGoModule rec {
   pname = "cnquery";
-  version = "12.4.0";
+  version = "12.5.1";
 
   src = fetchFromGitHub {
     owner = "mondoohq";
     repo = "cnquery";
     tag = "v${version}";
-    hash = "sha256-A/2/pk9ncGZwxiA4BOcpiPZcLiyRB0dTmf/tw3yDikc=";
+    hash = "sha256-f7P7m+RBrWxvdBMtPXZLNB4/Alr0ByiEhh9mIcVPfLk=";
   };
 
   subPackages = [ "apps/cnquery" ];

pkgs/by-name/co/coal/package.nix

@@ -9,21 +9,20 @@
   jrl-cmakemodules,
   assimp,
   octomap,
+  pkg-config,
   qhull,
-  pythonSupport ? false,
-  python3Packages,
   zlib,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "coal";
-  version = "3.0.1";
+  version = "3.0.2";
 
   src = fetchFromGitHub {
     owner = "coal-library";
     repo = "coal";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-2X1chL4tYQXo50W/C5z+IVA1DGPcPdA378lh+7Bs2OE=";
+    hash = "sha256-7Ww1vAzKaCccBpBQU1hzI7Jk+oXw73zhnH594Xn9gbw=";
   };
 
   strictDeps = true;
@@ -31,10 +30,7 @@ stdenv.mkDerivation (finalAttrs: {
   nativeBuildInputs = [
     cmake
     doxygen
-  ]
-  ++ lib.optionals pythonSupport [
-    python3Packages.numpy
-    python3Packages.pythonImportsCheckHook
+    pkg-config
   ];
 
   propagatedBuildInputs = [
@@ -43,28 +39,18 @@ stdenv.mkDerivation (finalAttrs: {
     octomap
     qhull
     zlib
-  ]
-  ++ lib.optionals (!pythonSupport) [
     boost
     eigen
-  ]
-  ++ lib.optionals pythonSupport [
-    python3Packages.boost
-    python3Packages.eigenpy
   ];
 
   cmakeFlags = [
     (lib.cmakeBool "COAL_BACKWARD_COMPATIBILITY_WITH_HPP_FCL" true)
     (lib.cmakeBool "COAL_HAS_QHULL" true)
     (lib.cmakeBool "INSTALL_DOCUMENTATION" true)
-    (lib.cmakeBool "BUILD_PYTHON_INTERFACE" pythonSupport)
+    (lib.cmakeBool "BUILD_PYTHON_INTERFACE" false)
   ];
 
   doCheck = true;
-  pythonImportsCheck = [
-    "coal"
-    "hppfcl"
-  ];
 
   outputs = [
     "dev"

pkgs/by-name/co/cockpit/package.nix

@@ -44,13 +44,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "cockpit";
-  version = "348";
+  version = "349";
 
   src = fetchFromGitHub {
     owner = "cockpit-project";
     repo = "cockpit";
     tag = finalAttrs.version;
-    hash = "sha256-JO+tHrG1fxfDRdGHIDZ6TBLug/6p/vB8RkxC9TLoOuk=";
+    hash = "sha256-MfZPT0gY3G4Tkp2TQN7HZVgy1oiJU9zrIzaLU8r9FjU=";
     fetchSubmodules = true;
   };
 

pkgs/by-name/co/codecrafters-cli/package.nix

@@ -7,13 +7,13 @@
 
 buildGoModule rec {
   pname = "codecrafters-cli";
-  version = "40";
+  version = "42";
 
   src = fetchFromGitHub {
     owner = "codecrafters-io";
     repo = "cli";
     tag = "v${version}";
-    hash = "sha256-JtjzulWeikUR1tJFBjssZuNhiXtQVR9IP2xABz06X/U=";
+    hash = "sha256-vkugNHeajGv/2t3/4eZbcsXXuaD7/fUM/3Cg0AO+6H0=";
     # A shortened git commit hash is part of the version output, and is
     # needed at build time. Use the `.git` directory to retrieve the
     # commit SHA, and remove the directory afterwards since it is not needed

pkgs/by-name/co/compsize/package.nix

@@ -44,7 +44,7 @@ stdenv.mkDerivation rec {
     mainProgram = "compsize";
     homepage = "https://github.com/kilobyte/compsize";
     license = licenses.gpl2Plus;
-    maintainers = with maintainers; [ CrazedProgrammer ];
+    maintainers = [ ];
     platforms = platforms.linux;
   };
 }

pkgs/by-name/co/cosign/package.nix

@@ -13,13 +13,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "cosign";
-  version = "2.6.1";
+  version = "3.0.2";
 
   src = fetchFromGitHub {
     owner = "sigstore";
     repo = "cosign";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-JQxVO7wZFyRovst3qb0EErDyIIhPNsIpBq/iQVf6djY=";
+    hash = "sha256-5jCO2LW7nzbzo+de0fpxBcVASDmINB6yFerkQZlo2o8=";
   };
 
   buildInputs = lib.optional (stdenv.hostPlatform.isLinux && pivKeySupport) (lib.getDev pcsclite);
@@ -29,7 +29,7 @@ buildGoModule (finalAttrs: {
     installShellFiles
   ];
 
-  vendorHash = "sha256-7qVJMQI5htqMavrxFP2lQfQ/7b27bRWnNYg2cHmTZYE=";
+  vendorHash = "sha256-hedkslhyAsictu9Cbw7CgreoWa1StLpTt8oTPNLr5fc=";
 
   subPackages = [
     "cmd/cosign"

pkgs/by-name/cr/crocoddyl/package.nix

@@ -4,27 +4,35 @@
   doxygen,
   example-robot-data,
   fetchFromGitHub,
+  fetchpatch,
   ipopt,
   lapack,
   lib,
   pinocchio,
   pkg-config,
-  pythonSupport ? false,
-  python3Packages,
   stdenv,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "crocoddyl";
-  version = "3.0.1";
+  version = "3.1.0";
 
   src = fetchFromGitHub {
     owner = "loco-3d";
     repo = "crocoddyl";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-eUH9fMhuIUp5kuDKNo4B8iJ3JlMIqv7wX6meOpyPTJk=";
+    hash = "sha256-m7UiCa8ydjsAIhsFiShTi3/JaKgq2TCQ1XYAMyTNg1U=";
   };
 
+  patches = [
+    # ref. https://github.com/loco-3d/crocoddyl/pull/1440 merged upstream
+    (fetchpatch {
+      name = "add-missing-include.patch";
+      url = "https://github.com/loco-3d/crocoddyl/commit/6994bea7bb3ae6027f5b611ef1635768538150fd.patch";
+      hash = "sha256-XbQKRWpWm5Rk4figoA2swId4Pz2xKDpU4NFP46p8WO0=";
+    })
+  ];
+
   outputs = [
     "out"
     "doc"
@@ -36,31 +44,20 @@ stdenv.mkDerivation (finalAttrs: {
     cmake
     doxygen
     pkg-config
-  ]
-  ++ lib.optionals pythonSupport [
-    python3Packages.python
-    python3Packages.pythonImportsCheckHook
   ];
 
   propagatedBuildInputs = [
     blas
     ipopt
     lapack
-  ]
-  ++ lib.optionals (!pythonSupport) [
     example-robot-data
     pinocchio
-  ]
-  ++ lib.optionals pythonSupport [
-    python3Packages.example-robot-data
-    python3Packages.pinocchio
-    python3Packages.scipy
   ];
 
   cmakeFlags = [
     (lib.cmakeBool "INSTALL_DOCUMENTATION" true)
-    (lib.cmakeBool "BUILD_EXAMPLES" pythonSupport)
-    (lib.cmakeBool "BUILD_PYTHON_INTERFACE" pythonSupport)
+    (lib.cmakeBool "BUILD_EXAMPLES" false)
+    (lib.cmakeBool "BUILD_PYTHON_INTERFACE" false)
   ];
 
   prePatch = ''
@@ -71,8 +68,6 @@ stdenv.mkDerivation (finalAttrs: {
   '';
 
   doCheck = true;
-  pythonImportsCheck = [ "crocoddyl" ];
-  checkInputs = lib.optionals pythonSupport [ python3Packages.scipy ];
 
   meta = with lib; {
     description = "Crocoddyl optimal control library";

pkgs/by-name/cr/cronie/package.nix

@@ -16,6 +16,11 @@ stdenv.mkDerivation (finalAttrs: {
     hash = "sha256-WrzdpE9t7vWpc8QFoFs+S/HgHwsidRNmfcHp7ltSWQw=";
   };
 
+  configureFlags = [
+    "--localstatedir=/var"
+    "--sysconfdir=/etc"
+  ];
+
   nativeBuildInputs = [ autoreconfHook ];
 
   outputs = [
@@ -36,6 +41,6 @@ stdenv.mkDerivation (finalAttrs: {
     ];
     mainProgram = "crond";
     maintainers = [ ];
-    platforms = lib.platforms.all;
+    platforms = lib.platforms.linux;
   };
 })

pkgs/by-name/cu/curlpp/package.nix

@@ -29,6 +29,6 @@ stdenv.mkDerivation rec {
     description = "C++ wrapper around libcURL";
     mainProgram = "curlpp-config";
     license = licenses.mit;
-    maintainers = with maintainers; [ CrazedProgrammer ];
+    maintainers = [ ];
   };
 }

pkgs/by-name/da/dabtools/package.nix

@@ -30,6 +30,13 @@ stdenv.mkDerivation {
     libusb1
   ];
 
+  #  CMake 4 is no longer retro compatible with versions < 3.5
+  postPatch = ''
+    substituteInPlace CMakeLists.txt src/CMakeLists.txt --replace-fail \
+      "cmake_minimum_required(VERSION 2.8)" \
+      "cmake_minimum_required(VERSION 3.5)"
+  '';
+
   meta = with lib; {
     description = "Commandline tools for DAB and DAB+ digital radio broadcasts";
     homepage = "https://github.com/Opendigitalradio/dabtools";

pkgs/by-name/di/dinit/package.nix

@@ -4,7 +4,7 @@
   fetchFromGitHub,
   m4,
   installShellFiles,
-  util-linux,
+  util-linuxMinimal,
 }:
 
 stdenv.mkDerivation rec {
@@ -24,8 +24,8 @@ stdenv.mkDerivation rec {
 
   postPatch = ''
     substituteInPlace src/shutdown.cc \
-      --replace-fail '"/bin/umount"' '"${util-linux}/bin/umount"' \
-      --replace-fail '"/sbin/swapoff"' '"${util-linux}/bin/swapoff"'
+      --replace-fail '"/bin/umount"' '"${util-linuxMinimal}/bin/umount"' \
+      --replace-fail '"/sbin/swapoff"' '"${util-linuxMinimal}/bin/swapoff"'
   '';
 
   nativeBuildInputs = [
@@ -49,7 +49,10 @@ stdenv.mkDerivation rec {
     description = "Service manager / supervision system, which can (on Linux) also function as a system manager and init";
     homepage = "https://davmac.org/projects/dinit";
     license = lib.licenses.asl20;
-    maintainers = with lib.maintainers; [ aanderse ];
+    maintainers = with lib.maintainers; [
+      aanderse
+      lillecarl
+    ];
     platforms = lib.platforms.unix;
   };
 }

pkgs/by-name/do/dockerfile-language-server/package.nix

@@ -6,20 +6,20 @@
 
 buildNpmPackage rec {
   pname = "dockerfile-language-server";
-  version = "0.14.1";
+  version = "0.15.0";
 
   src = fetchFromGitHub {
     owner = "rcjsuen";
     repo = "dockerfile-language-server";
     tag = "v${version}";
-    hash = "sha256-oPU9XVxD9GbXMWkeGKncriFi1oP3YlkWnjxzltaz/iU=";
+    hash = "sha256-olgOUbVHHj9vD7upswqVJYBRIRb+kg6uXC2y5shnM+g=";
   };
 
   preBuild = ''
     npm run prepublishOnly
   '';
 
-  npmDepsHash = "sha256-p5BBKoq+ANR8z4YWsjmKaNqkyQGETwG5OmdapasLk+c=";
+  npmDepsHash = "sha256-cJ11l2NF/sCzPw/eQNFon5oKRM+KPoy4lxLz0yivHTo=";
 
   meta = {
     changelog = "https://github.com/rcjsuen/dockerfile-language-server/blob/${src.tag}/CHANGELOG.md";

pkgs/by-name/do/dovi-tool/package.nix

@@ -1,37 +1,51 @@
 {
   lib,
+  stdenv,
   rustPlatform,
   fetchFromGitHub,
   pkg-config,
   fontconfig,
+  makeFontsConf,
   versionCheckHook,
   nix-update-script,
 }:
 
+let
+  fontsConf = makeFontsConf {
+    fontDirectories = [ ];
+  };
+in
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "dovi-tool";
-  version = "2.2.0";
+  version = "2.3.1";
 
   src = fetchFromGitHub {
     owner = "quietvoid";
     repo = "dovi_tool";
     tag = finalAttrs.version;
-    hash = "sha256-z783L6gBr9o44moKYZGwymWEMp5ZW7yOhZcpvbznXK4=";
+    hash = "sha256-4C9d8Rt1meV6Pcdnf2SaiWGA97sRj2WmvKsf1rC01Bs=";
   };
 
-  cargoHash = "sha256-pwB6QBLeHALbYZHzTBm/ODLPHhxM3B5n+B/0iXYNuVc=";
+  cargoHash = "sha256-Dg6IDcYm3qTSyE5kVgZ8Yka8538KDFyBN+weUyAfQT8=";
 
-  nativeBuildInputs = [
+  nativeBuildInputs = lib.optionals (!stdenv.hostPlatform.isDarwin) [
     pkg-config
   ];
 
-  buildInputs = [
+  buildInputs = lib.optionals (!stdenv.hostPlatform.isDarwin) [
     fontconfig
   ];
 
-  checkFlags = [
-    # fails because nix-store is read only
-    "--skip=rpu::plot::plot_p7"
+  preCheck = lib.optionals (!stdenv.hostPlatform.isDarwin) ''
+    # Fontconfig error: Cannot load default config file: No such file: (null)
+    export FONTCONFIG_FILE="${fontsConf}"
+    # Fontconfig error: No writable cache directories
+    export XDG_CACHE_HOME="$(mktemp -d)"
+  '';
+
+  # Needed for rpu::plot::plot_p7 to pass in the sandbox.
+  __impureHostDeps = lib.optionals stdenv.hostPlatform.isDarwin [
+    "/System/Library/Fonts/Supplemental/Arial.ttf"
   ];
 
   nativeInstallCheckInputs = [

pkgs/by-name/dp/dprint/plugins/dprint-plugin-markdown.nix

@@ -1,7 +1,7 @@
 { mkDprintPlugin }:
 mkDprintPlugin {
   description = "Markdown code formatter";
-  hash = "sha256-2lpgVMExOjMVRTvX6hGRWuufwh2AIkiXaOzkN8LhZgw=";
+  hash = "sha256-XrTiMkgjHOD8a2N5Ips79+D2SbM36s9Hdk7o/iwGIlc=";
   initConfig = {
     configExcludes = [ ];
     configKey = "markdown";
@@ -9,6 +9,6 @@ mkDprintPlugin {
   };
   pname = "dprint-plugin-markdown";
   updateUrl = "https://plugins.dprint.dev/dprint/markdown/latest.json";
-  url = "https://plugins.dprint.dev/markdown-0.19.0.wasm";
-  version = "0.19.0";
+  url = "https://plugins.dprint.dev/markdown-0.20.0.wasm";
+  version = "0.20.0";
 }

pkgs/by-name/ed/edlib/package.nix

@@ -2,6 +2,7 @@
   lib,
   stdenv,
   fetchFromGitHub,
+  fetchpatch,
   cmake,
 }:
 
@@ -16,6 +17,15 @@ stdenv.mkDerivation (finalAttrs: {
     hash = "sha256-XejxohLVdBBzpYZ//OpqC1ActmCaZ8tunJyhOYtZmKQ=";
   };
 
+  patches = [
+    # Bump minimum CMake version to 3.20
+    (fetchpatch {
+      name = "bump-cmake-version.patch";
+      url = "https://github.com/Martinsos/edlib/commit/47359e591f3861f12105fa8e72242de64d5597c4.patch?full_index=1";
+      hash = "sha256-Efbv8XYF1jOz6MypIyhfFJGQQt8gTYNZRd+R8ukIf3o=";
+    })
+  ];
+
   nativeBuildInputs = [ cmake ];
 
   doCheck = true;

pkgs/by-name/en/envoy-bin/package.nix

@@ -8,7 +8,7 @@
   versionCheckHook,
 }:
 let
-  version = "1.35.4";
+  version = "1.36.0";
   inherit (stdenv.hostPlatform) system;
   throwSystem = throw "envoy-bin is not available for ${system}.";
 
@@ -21,8 +21,8 @@ let
 
   hash =
     {
-      aarch64-linux = "sha256-iTZilcY0Tc6xjMCSOEdwyzyJeRhd+5A4WIhq89817bc=";
-      x86_64-linux = "sha256-hBy2DmJlTADt9E3V81CKlFXkM17q52gN5Eq/l4F+qcw=";
+      aarch64-linux = "sha256-AQFQbCksOJshIzSPvkixRd2jq+hT8+/B5yw1iFzdNqY=";
+      x86_64-linux = "sha256-2fAq74ha9P3KUukQcmu2HxJ7iLAdmAZm/DF832oqMME=";
     }
     .${system} or throwSystem;
 in

pkgs/by-name/et/etherpad-lite/package.nix

@@ -13,13 +13,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "etherpad-lite";
-  version = "2.5.0";
+  version = "2.5.1";
 
   src = fetchFromGitHub {
     owner = "ether";
     repo = "etherpad-lite";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-11fNDAR6zmHv1O5nL0GhGJj6eHwDc8zT0Tvrba7qBpw=";
+    hash = "sha256-0Qrmpz9ehblS2Jdw137CJVKYmhkXt8c9B6kDG8OxZPo=";
   };
 
   patches = [
@@ -32,7 +32,7 @@ stdenv.mkDerivation (finalAttrs: {
   pnpmDeps = pnpm.fetchDeps {
     inherit (finalAttrs) pname version src;
     fetcherVersion = 1;
-    hash = "sha256-PZD55V/3dvNLx39tD4I00IzURhuyqMX4uObnQfnSBtk=";
+    hash = "sha256-gajm1yXQPZZ/oB27HwgTEoKLzwMKsHDoo2w+mIOnJrc=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/ex/example-robot-data/package.nix

@@ -5,20 +5,18 @@
   lib,
   jrl-cmakemodules,
   pkg-config,
-  pythonSupport ? false,
-  python3Packages,
   stdenv,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "example-robot-data";
-  version = "4.3.0";
+  version = "4.4.0";
 
   src = fetchFromGitHub {
     owner = "Gepetto";
     repo = "example-robot-data";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-i5YU5lcbB3gm8/YrRRiE2NDcLEq7+eF7GtIrJ1DF1cU=";
+    hash = "sha256-HnI1EaTSqk7mbihwFTgnMxgPZxMSYnAwaCLEXS3LUbE=";
   };
 
   outputs = [
@@ -32,25 +30,15 @@ stdenv.mkDerivation (finalAttrs: {
     cmake
     doxygen
     pkg-config
-  ]
-  ++ lib.optionals pythonSupport [
-    python3Packages.python
-    python3Packages.pythonImportsCheckHook
   ];
 
   propagatedBuildInputs = [
     jrl-cmakemodules
-  ]
-  ++ lib.optionals pythonSupport [ python3Packages.pinocchio ];
+  ];
 
-  cmakeFlags = [ (lib.cmakeBool "BUILD_PYTHON_INTERFACE" pythonSupport) ];
+  cmakeFlags = [ (lib.cmakeBool "BUILD_PYTHON_INTERFACE" false) ];
 
   doCheck = true;
-  # The package expect to find an `example-robot-data/robots` folder somewhere
-  # either in install prefix or in the sources
-  # where it can find the meshes for unit tests
-  preCheck = "ln -s source ../../example-robot-data";
-  pythonImportsCheck = [ "example_robot_data" ];
 
   meta = with lib; {
     description = "Set of robot URDFs for benchmarking and developed examples";

pkgs/by-name/fo/foot/package.nix

@@ -27,7 +27,7 @@
 }:
 
 let
-  version = "1.24.0";
+  version = "1.25.0";
 
   # build stimuli file for PGO build and the script to generate it
   # independently of the foot's build, so we can cache the result
@@ -104,7 +104,7 @@ stdenv.mkDerivation {
     owner = "dnkl";
     repo = "foot";
     tag = version;
-    hash = "sha256-uex2p28rKBwnqPjO1Pen1GA3a9mEnrcpIb1oIUJv/Lk=";
+    hash = "sha256-s7SwIdkWhBKcq9u4V0FLKW6CA36MBvDyB9ELB0V52O0=";
   };
 
   separateDebugInfo = true;

pkgs/by-name/fo/forgejo/package.nix

@@ -1,8 +1,8 @@
 import ./generic.nix {
-  version = "12.0.4";
-  hash = "sha256-g6PNJYiGR7tUpurVL1gvGzJzDoMCLmkGiLLsSZfkbYQ=";
-  npmDepsHash = "sha256-V8FUoL9y36bagkg8Scttv/IzKg+MIIqp7witvT8bSWA=";
-  vendorHash = "sha256-GE3trnaWuAVSEfi11tZo5JXedWOYOMzcHQ3GFyISVTQ=";
+  version = "13.0.0";
+  hash = "sha256-8NRUJpf25Bai0NtzYf2APmOt3rqpP9mPM13KMjNLl2M=";
+  npmDepsHash = "sha256-7WjcMsKPtKUWJfDrJc65ZXq2tjK8+8DnqwINj+0XyiQ=";
+  vendorHash = "sha256-PHItbU27d9ouykUlhr9owylMpF+3wz2vc8c0UTR1RVU=";
   lts = false;
   nixUpdateExtraArgs = [
     "--override-filename"

pkgs/by-name/ga/garnet/deps.json

@@ -6,18 +6,18 @@
   },
   {
     "pname": "Azure.Core",
-    "version": "1.47.1",
-    "hash": "sha256-YJR1bDI9H9lr6p/9QcOWEhnpMD8ePyxxO39S32VAOak="
+    "version": "1.47.3",
+    "hash": "sha256-fWyfqF1lpnap4cF3l9J0fYtZbxIqm6UFsuJgN+/hwW4="
   },
   {
     "pname": "Azure.Identity",
-    "version": "1.15.0",
-    "hash": "sha256-eqR6Akmrtu4U4fPvkDwMbwk2dPGx+MaKPj+Y80e0/Ak="
+    "version": "1.16.0",
+    "hash": "sha256-vJa746fywiLlC2QoUu2SLf+mQPzGTGxbXzGoWqAUb0Q="
   },
   {
     "pname": "Azure.Storage.Blobs",
-    "version": "12.25.0",
-    "hash": "sha256-SjIwM1sIBd4I9ShAeaIAfPUzc3K7tbodW6y1vNAD+4U="
+    "version": "12.25.1",
+    "hash": "sha256-OJgmzE7+BJsrqGMErUwG4wmaguYL1zPbhtdQvvqFuHY="
   },
   {
     "pname": "Azure.Storage.Common",
@@ -126,13 +126,13 @@
   },
   {
     "pname": "Microsoft.Identity.Client",
-    "version": "4.73.1",
-    "hash": "sha256-cd5ArtDvQK4gdX8M0GHQEsCFWlqpdm6lxvaM2yMHkhc="
+    "version": "4.76.0",
+    "hash": "sha256-v5/iulShs0yMHvNoRo/pbDVYu3tOl9Y7kovSKJbgQnc="
   },
   {
     "pname": "Microsoft.Identity.Client.Extensions.Msal",
-    "version": "4.73.1",
-    "hash": "sha256-wc4oHBGKCJhAqNIyD4LlugCFvmyiW5iVzGYP88bnWqs="
+    "version": "4.76.0",
+    "hash": "sha256-OCt+XN0tt1URnn0Wh7y19YCNo3ViG5th9HAa6GusFeE="
   },
   {
     "pname": "Microsoft.IdentityModel.Abstractions",
@@ -181,8 +181,8 @@
   },
   {
     "pname": "System.ClientModel",
-    "version": "1.5.1",
-    "hash": "sha256-n4PHKtjmFXo37s5yhfUQ9UbfnWplqHpC+wsvlHxctow="
+    "version": "1.6.1",
+    "hash": "sha256-OMnamkT9Nt5ZSR6xPKFmOQRUjdn0a4nP9jkD2eZxxc0="
   },
   {
     "pname": "System.Diagnostics.DiagnosticSource",
@@ -224,6 +224,11 @@
     "version": "8.0.1",
     "hash": "sha256-cxYZL0Trr6RBplKmECv94ORuyjrOM6JB0D/EwmBSisg="
   },
+  {
+    "pname": "System.Numerics.Tensors",
+    "version": "9.0.9",
+    "hash": "sha256-wc7lhmydATxle8Wv124yFPT+bkpKpcCQL2TAPGodIAc="
+  },
   {
     "pname": "System.Numerics.Vectors",
     "version": "4.5.0",

pkgs/by-name/ga/garnet/package.nix

@@ -8,13 +8,13 @@
 
 buildDotnetModule rec {
   pname = "garnet";
-  version = "1.0.84";
+  version = "1.0.86";
 
   src = fetchFromGitHub {
     owner = "microsoft";
     repo = "garnet";
     tag = "v${version}";
-    hash = "sha256-Bg+WQrGs9HyH3E9Ry4fPrnfDcKL8WuTH798pwHrLIuo=";
+    hash = "sha256-EmwDc6kbOL++g1Xq4LoV3JuxYWSifOmv8vvWKsU3CE4=";
   };
 
   projectFile = "main/GarnetServer/GarnetServer.csproj";

pkgs/by-name/ge/gemini-cli/package.nix

@@ -13,16 +13,16 @@
 
 buildNpmPackage (finalAttrs: {
   pname = "gemini-cli";
-  version = "0.8.2";
+  version = "0.9.0";
 
   src = fetchFromGitHub {
     owner = "google-gemini";
     repo = "gemini-cli";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-M9sR8c6d5JrFnZ50Q7PgOJ5b6NCKqAOW8tZWG1jpKLc=";
+    hash = "sha256-QvcC/QzotP1OhcOyZoNK5FkZwVKm4ZNfU5s3B9UKhc0=";
   };
 
-  npmDepsHash = "sha256-S3vXyjQ3AkmItNXAEBJTHyEGUfdh+jxjHOcs7o7DUqc=";
+  npmDepsHash = "sha256-0Tbwco+9Int7krl2bsphCMPtObJtJhYw8X3zyof30qA=";
 
   nativeBuildInputs = [
     jq

pkgs/by-name/gh/ghc_filesystem/package.nix

@@ -19,6 +19,9 @@ stdenv.mkDerivation (finalAttrs: {
 
   nativeBuildInputs = [ cmake ];
 
+  # https://github.com/NixOS/nixpkgs/issues/451580
+  env.NIX_CFLAGS_COMPILE = lib.optionalString stdenv.cc.isClang "-Wno-error=character-conversion";
+
   passthru = {
     updateScript = nix-update-script { };
   };

pkgs/by-name/go/go-camo/package.nix

@@ -9,16 +9,16 @@
 
 buildGo125Module rec {
   pname = "go-camo";
-  version = "2.7.0";
+  version = "2.7.1";
 
   src = fetchFromGitHub {
     owner = "cactus";
     repo = "go-camo";
     tag = "v${version}";
-    hash = "sha256-CuEnJcbLcehmAj+TCx3VbRLWhYhbzYaXfV6qweuoooA=";
+    hash = "sha256-gAlbSUYa3yxEfPzJQHDzM0XJ/ap93qgMnSTg3irtHMw=";
   };
 
-  vendorHash = "sha256-3Yl0x02KcYG5+FVuON54NlO+ehvgvywep4Hu9sQ6nN4=";
+  vendorHash = "sha256-Qv5DFa4XDJw4e6sLbTUN59bRxMUCMXrPZJmCF7OhumY=";
 
   nativeBuildInputs = [
     installShellFiles

pkgs/by-name/go/go-dnscollector/package.nix

@@ -6,16 +6,16 @@
 
 buildGoModule rec {
   pname = "go-dnscollector";
-  version = "1.11.0";
+  version = "1.12.0";
 
   src = fetchFromGitHub {
     owner = "dmachard";
     repo = "go-dnscollector";
     rev = "v${version}";
-    sha256 = "sha256-2NHJs2KdSDw36ePG8s/YSU4wlWG+14NQ6oWJYqMv2Wk=";
+    sha256 = "sha256-LQJxK2MZtFeFm5keNoNSDHXmxS8z9/fsCV02BGsph74=";
   };
 
-  vendorHash = "sha256-N0gaDyOlRvFR1Buj/SKoOjwkVMRxd8Uj7iT/cDBfM9A=";
+  vendorHash = "sha256-nZheY/CbzDR/GB4Nu3xiWXsxrrvu/AKZE0gquBrfXXM=";
 
   subPackages = [ "." ];
 

pkgs/by-name/go/gost/package.nix

@@ -9,16 +9,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "gost";
-  version = "3.2.4";
+  version = "3.2.5";
 
   src = fetchFromGitHub {
     owner = "go-gost";
     repo = "gost";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-zFGoM+fYO/o70LJ2fbzhMv4qbjLozJGmGbudqHjCFRU=";
+    hash = "sha256-voVk4zzNm2UZWQ3c/n0YOwuaE9JcIlEmJ881nTXXyrY=";
   };
 
-  vendorHash = "sha256-W3CHttD9iGpl2wG/Pa21YY6ACf5M894p25nLfMX0+F4=";
+  vendorHash = "sha256-73gjw0oW8i7Vp6ZxxqkO42/atdde4J+lu/pCHK/xY+8=";
 
   # Based on ldflags in upstream's .goreleaser.yaml
   ldflags = [

pkgs/by-name/gr/gradle-completion/package.nix

@@ -8,13 +8,13 @@
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "gradle-completion";
-  version = "1.4.1";
+  version = "1.5.2";
 
   src = fetchFromGitHub {
     owner = "gradle";
     repo = "gradle-completion";
     rev = "v${finalAttrs.version}";
-    sha256 = "15b0692i3h8h7b95465b2aw9qf5qjmjag5n62347l8yl7zbhv3l2";
+    sha256 = "u3bnvNkjKzNp604hnPoAT3YY3Xf9eJlAe174YnM2RMQ=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/gr/grype/package.nix

@@ -10,13 +10,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "grype";
-  version = "0.100.0";
+  version = "0.101.0";
 
   src = fetchFromGitHub {
     owner = "anchore";
     repo = "grype";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-POGGhZ2uTqWjUsl1zR4eirb+Daji+igTtUNwTte7gPA=";
+    hash = "sha256-20nl2mfU5PeEtUwyOUrKZ58nHyVvxZol4M37IPabx3A=";
     # populate values that require us to use git. By doing this in postFetch we
     # can delete .git afterwards and maintain better reproducibility of the src.
     leaveDotGit = true;
@@ -31,7 +31,7 @@ buildGoModule (finalAttrs: {
 
   proxyVendor = true;
 
-  vendorHash = "sha256-QGGY88CELV9e5UxtfDXKmShnKiP8i+0f8iA9pOTirzc=";
+  vendorHash = "sha256-VbJKdd04S1aXXnflEZTtpIh4eJFe17WXZXqWDDo9YiI=";
 
   nativeBuildInputs = [ installShellFiles ];
 

pkgs/by-name/ha/harlequin/package.nix

@@ -10,7 +10,27 @@
   withPostgresAdapter ? true,
   withBigQueryAdapter ? true,
 }:
-python3Packages.buildPythonApplication rec {
+let
+  # Using textual 5.3.0 to avoid error at runtime
+  # https://github.com/tconbeer/harlequin/issues/841
+  python = python3Packages.python.override {
+    self = python3Packages.python;
+    packageOverrides = self: super: {
+      textual = super.textual.overridePythonAttrs (old: rec {
+        version = "5.3.0";
+
+        src = fetchFromGitHub {
+          owner = "Textualize";
+          repo = "textual";
+          tag = "v${version}";
+          hash = "sha256-J7Sb4nv9wOl1JnR6Ky4XS9HZHABKtNKPB3uYfC/UGO4=";
+        };
+      });
+    };
+  };
+  pythonPackages = python.pkgs;
+in
+pythonPackages.buildPythonApplication rec {
   pname = "harlequin";
   version = "2.1.2";
   pyproject = true;
@@ -28,14 +48,15 @@ python3Packages.buildPythonApplication rec {
     "textual"
     "tree-sitter"
     "tree-sitter-sql"
+    "rich-click"
   ];
 
-  build-system = with python3Packages; [ poetry-core ];
+  build-system = with pythonPackages; [ poetry-core ];
 
   nativeBuildInputs = [ glibcLocales ];
 
   dependencies =
-    with python3Packages;
+    with pythonPackages;
     [
       click
       duckdb
@@ -67,7 +88,7 @@ python3Packages.buildPythonApplication rec {
     updateScript = nix-update-script { };
   };
 
-  nativeCheckInputs = with python3Packages; [
+  nativeCheckInputs = with pythonPackages; [
     pytest-asyncio
     pytestCheckHook
     versionCheckHook

pkgs/by-name/ht/httplib/package.nix

@@ -4,8 +4,9 @@
   fetchFromGitHub,
   openssl,
   stdenv,
+  copyPkgconfigItems,
+  makePkgconfigItem,
 }:
-
 stdenv.mkDerivation (finalAttrs: {
   pname = "httplib";
   version = "0.19.0";
@@ -17,18 +18,36 @@ stdenv.mkDerivation (finalAttrs: {
     hash = "sha256-OLwD7mpwqG7BUugUca+CJpPMaabJzUMC0zYzJK9PBCg=";
   };
 
-  nativeBuildInputs = [ cmake ];
+  nativeBuildInputs = [
+    cmake
+    copyPkgconfigItems
+  ];
 
   buildInputs = [ openssl ];
 
   strictDeps = true;
 
+  pkgconfigItems = [
+    (makePkgconfigItem rec {
+      name = "httplib";
+      inherit (finalAttrs) version;
+      cflags = [ "-I${variables.includedir}" ];
+      variables = rec {
+        prefix = placeholder "out";
+        includedir = "${prefix}/include";
+      };
+      inherit (finalAttrs.meta) description;
+    })
+  ];
+
   meta = {
     homepage = "https://github.com/yhirose/cpp-httplib";
     description = "C++ header-only HTTP/HTTPS server and client library";
     changelog = "https://github.com/yhirose/cpp-httplib/releases/tag/${finalAttrs.src.rev}";
     license = lib.licenses.mit;
-    maintainers = [ ];
+    maintainers = with lib.maintainers; [
+      fzakaria
+    ];
     platforms = lib.platforms.all;
   };
 })

pkgs/by-name/hu/hubble/package.nix

@@ -9,13 +9,13 @@
 
 buildGo124Module rec {
   pname = "hubble";
-  version = "1.17.2";
+  version = "1.18.0";
 
   src = fetchFromGitHub {
     owner = "cilium";
     repo = "hubble";
     tag = "v${version}";
-    hash = "sha256-ZkowUftSEGo+UjYM+kk3tQJc8QJgoJATeIKPwu2ikQ4=";
+    hash = "sha256-ZJnfy9s80VJxH6XXPvERupPmMfMJ0SfbeWybJL5QjDw=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/ip/ipxe/package.nix

@@ -48,7 +48,7 @@ in
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "ipxe";
-  version = "1.21.1-unstable-2025-10-09";
+  version = "1.21.1-unstable-2025-10-16";
 
   nativeBuildInputs = [
     mtools
@@ -66,8 +66,8 @@ stdenv.mkDerivation (finalAttrs: {
   src = fetchFromGitHub {
     owner = "ipxe";
     repo = "ipxe";
-    rev = "1cc1f1cd4f06e297552b3cf15d43ee23f5fa1ce2";
-    hash = "sha256-h316o/6hg6x9RWt760UXa39hArkjc0AyKS/he6OKhoA=";
+    rev = "c1badf71ca22f94277873ebc6171bfa41a50e378";
+    hash = "sha256-emPO4DRVr/rQZgr+Tnvg3+oijhh9IzG1TH0BWu96oBY=";
   };
 
   # Calling syslinux on a FAT image isn't going to work on Aarch64.

pkgs/by-name/jr/jrl-cmakemodules/package.nix

@@ -2,27 +2,41 @@
   lib,
   stdenv,
   fetchFromGitHub,
+  fetchpatch,
+  nix-update-script,
   cmake,
 }:
 
-stdenv.mkDerivation {
+stdenv.mkDerivation (finalAttrs: {
   pname = "jrl-cmakemodules";
-  version = "0-unstable-2025-05-04";
+  version = "1.1.0";
 
   src = fetchFromGitHub {
     owner = "jrl-umi3218";
     repo = "jrl-cmakemodules";
-    rev = "2dd858f5a71d8224f178fb3dc0bcd95256ba10e7";
-    hash = "sha256-Iq9IuhEJBmDd14FhQ3wb94AoJDUjJ1h1D3qCdQYCnUc=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-WQiAAexshQ4zgaBNo/CD91XV+PAeoPZatmehSA14aPM=";
   };
 
+  patches = [
+    # ref. https://github.com/jrl-umi3218/jrl-cmakemodules/pull/783
+    (fetchpatch {
+      name = "fix-permissions.patch";
+      url = "https://github.com/jrl-umi3218/jrl-cmakemodules/commit/defed70c8a7c5e4bd5b26006bef26e3fb22c3b26.patch";
+      hash = "sha256-muO6DwQhNPCv6DPmnHnEHjsh/FSj0ljgNCb+ZowLRaY=";
+    })
+  ];
+
   nativeBuildInputs = [ cmake ];
 
+  passthru.updateScript = nix-update-script { };
+
   meta = {
     description = "CMake utility toolbox";
     homepage = "https://github.com/jrl-umi3218/jrl-cmakemodules";
+    changelog = "https://github.com/jrl-umi3218/jrl-cmakemodules/releases/tag/${finalAttrs.src.tag}";
     license = lib.licenses.lgpl3Plus;
     maintainers = [ lib.maintainers.nim65s ];
     platforms = lib.platforms.all;
   };
-}
+})

pkgs/by-name/ku/kubedock/package.nix

@@ -6,16 +6,16 @@
 
 buildGoModule rec {
   pname = "kubedock";
-  version = "0.18.2";
+  version = "0.18.3";
 
   src = fetchFromGitHub {
     owner = "joyrex2001";
     repo = "kubedock";
     rev = version;
-    hash = "sha256-95C14Vo3QbHR/PEIPoLECCq9hhLg0Q7iThvdfaV6/lY=";
+    hash = "sha256-HGaXiYuOVI1lMomT+WnyPUEpShBv8qVbJIOt0j2FK58=";
   };
 
-  vendorHash = "sha256-iTXpODO45oUgpSvKmjLBQWAVDHLrOYN6iBL/58dd1Mg=";
+  vendorHash = "sha256-D3jsBWbeZzIFomUoUNR762OwnmPF9Wg9bxdt1KsP6s8=";
 
   # config.Build not defined as it would break r-ryantm
   ldflags = [

pkgs/by-name/ku/kurve/package.nix

@@ -13,14 +13,14 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "kurve";
-  version = "2.0.0";
+  version = "2.1.0";
   dontWrapQtApps = true;
 
   src = fetchFromGitHub {
     owner = "luisbocanegra";
     repo = "kurve";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-qw/6V3TWGZFL8dgyDUxzBr4U6/jaX9uwpyg3Bd3pKdg=";
+    hash = "sha256-Fm2HoD3W/MymUr3JiVxssHvxwIGQ7jri0iz+asSS1eY=";
   };
 
   installPhase = ''

pkgs/by-name/la/labwc/package.nix

@@ -29,13 +29,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "labwc";
-  version = "0.9.1";
+  version = "0.9.2";
 
   src = fetchFromGitHub {
     owner = "labwc";
     repo = "labwc";
     tag = finalAttrs.version;
-    hash = "sha256-8SKSITFwbagJhuTXVHpPmQoaooktIXc1CeO9ZOUuh1w=";
+    hash = "sha256-aKjebrUqksLoDhHa/maI871jq/2u6YbTaNd6+hJz8uE=";
   };
 
   outputs = [

pkgs/by-name/li/librenms/package.nix

@@ -27,16 +27,16 @@ let
 in
 phpPackage.buildComposerProject2 rec {
   pname = "librenms";
-  version = "25.8.0";
+  version = "25.9.1";
 
   src = fetchFromGitHub {
     owner = "librenms";
     repo = "librenms";
     tag = version;
-    sha256 = "sha256-OJd5wlne5F2fa5pK4i1hRAIzcZlzgOwJjw2UhqkEYfY=";
+    sha256 = "sha256-EDdXPhPi5gJXIMniMloLWDuW3BmajxEKJM2Tkgxn36Q=";
   };
 
-  vendorHash = "sha256-kFyOoE+WJ/3hhPg5tC3w/PrDkLgOtJGeOwZEHsTOdG8=";
+  vendorHash = "sha256-Tc4pW7UNY7Tvu0UJLifV24UW06xQSQG1W3+jkzvm0iw=";
 
   php = phpPackage;
 

pkgs/by-name/li/librespeed-rust/package.nix

@@ -0,0 +1,36 @@
+{
+  lib,
+  fetchFromGitHub,
+  rustPlatform,
+}:
+
+rustPlatform.buildRustPackage rec {
+  pname = "librespeed-rust";
+  version = "1.3.8";
+
+  src = fetchFromGitHub {
+    owner = "librespeed";
+    repo = "speedtest-rust";
+    tag = "v${version}";
+    hash = "sha256-TINIKZefT4ngnEtlMjxO56PrQxW5gyb1+higiSnkE3Q=";
+  };
+
+  postPatch = ''
+    ln -s ${./Cargo.lock} Cargo.lock
+  '';
+
+  # Remove vendored lockfile once <https://github.com/librespeed/speedtest-rust/pull/29> lands.
+  cargoLock.lockFile = ./Cargo.lock;
+
+  postInstall = ''
+    cp -r assets $out/
+  '';
+
+  meta = {
+    description = "Very lightweight speed test implementation in Rust";
+    homepage = "https://github.com/librespeed/speedtest-rust";
+    license = lib.licenses.lgpl3Plus;
+    teams = with lib.teams; [ c3d2 ];
+    mainProgram = "librespeed-rs";
+  };
+}

pkgs/by-name/li/libresplit/package.nix

@@ -13,13 +13,13 @@
 
 stdenv.mkDerivation {
   pname = "libresplit";
-  version = "0-unstable-2025-10-02";
+  version = "0-unstable-2025-10-15";
 
   src = fetchFromGitHub {
     owner = "wins1ey";
     repo = "LibreSplit";
-    rev = "0cb1b5d3eff0245fda17f734388eee609b9a4416";
-    hash = "sha256-3DK+6pK0jSxy5s80u4lweMyiywknJPEG4rovhOPG4go=";
+    rev = "7628922ba2c6b6a9e6d6d144b55d20479d7ceeb3";
+    hash = "sha256-3UXDHmcW6lxXGno5ijG6OlQ58F1z/J2O8S1y2O+7+p4=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/li/libvirt-dbus/package.nix

@@ -0,0 +1,75 @@
+{
+  stdenv,
+  fetchFromGitLab,
+  meson,
+  pkg-config,
+  docutils,
+  ninja,
+  glib,
+  libvirt,
+  libvirt-glib,
+  systemd,
+  gitUpdater,
+  lib,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "libvirt-dbus";
+  version = "1.4.1";
+
+  outputs = [
+    "out"
+    "man"
+  ];
+
+  src = fetchFromGitLab {
+    owner = "libvirt";
+    repo = "libvirt-dbus";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-S4QktQmcnTte4XsIcgc5dkA8LjMJaOD2lljS01WT0dk=";
+  };
+
+  postPatch = ''
+    substituteInPlace "data/system/meson.build" \
+      --replace-fail ": systemd_system_unit_dir" ": '$out/lib/systemd/system'"
+
+    substituteInPlace "data/session/meson.build" \
+      --replace-fail ": systemd_user_unit_dir" ": '$out/lib/systemd/user'"
+  '';
+
+  nativeBuildInputs = [
+    meson
+    pkg-config
+    docutils
+    ninja
+  ];
+
+  buildInputs = [
+    glib
+    libvirt
+    libvirt-glib
+    systemd
+  ];
+
+  mesonFlags = [
+    (lib.mesonOption "init_script" "systemd")
+    (lib.mesonOption "unix_socket_group" "qemu-libvirtd")
+    # TODO: uncomment below on next release
+    # (lib.mesonOption "sysusersdir" "${placeholder "out"}/lib/sysusers.d")
+  ];
+
+  doCheck = false; # needs running D-Bus and libvirt
+
+  passthru.updateScript = gitUpdater {
+    rev-prefix = "v";
+  };
+
+  meta = {
+    description = "libvirt D-Bus API binding";
+    homepage = "https://libvirt.org/dbus.html";
+    changelog = "https://gitlab.com/libvirt/libvirt-dbus/-/blob/v${finalAttrs.version}/NEWS.rst";
+    license = lib.licenses.lgpl2Plus;
+    platforms = lib.platforms.linux;
+    maintainers = with lib.maintainers; [ andre4ik3 ];
+  };
+})

pkgs/by-name/lu/lugaru/package.nix

@@ -52,6 +52,16 @@ stdenv.mkDerivation rec {
 
   cmakeFlags = [ "-DSYSTEM_INSTALL=ON" ];
 
+  # CMake 3.0 is deprecated and no longer supported by CMake > 4
+  # https://github.com/NixOS/nixpkgs/issues/445447
+  postPatch = ''
+    substituteInPlace CMakeLists.txt --replace-fail \
+      "cmake_minimum_required(VERSION 3.0)" \
+      "cmake_minimum_required(VERSION 3.10)" \
+    --replace-fail \
+      "cmake_policy(SET CMP0004 OLD)" ""
+  '';
+
   meta = {
     description = "Third person ninja rabbit fighting game";
     mainProgram = "lugaru";

pkgs/by-name/ma/matrix-authentication-service/package.nix

@@ -18,21 +18,21 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "matrix-authentication-service";
-  version = "1.3.0";
+  version = "1.4.1";
 
   src = fetchFromGitHub {
     owner = "element-hq";
     repo = "matrix-authentication-service";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-iwQ+ItcpjShEyRi3RI0IuXXmlfzamGFHrdZpp7wBBis=";
+    hash = "sha256-9mQXWpGy+oFK5cEWeW88CSZQqfpmOAUS1x9KkyEMg+0=";
   };
 
-  cargoHash = "sha256-FgV2YfU2iqlYwoq3WCaM52fDmgKIQg2gx5q68P3Mhf0=";
+  cargoHash = "sha256-3ODOJY8/hksbMak8SsQP87rOnCd7+1G0wD4m5daPrbk=";
 
   npmDeps = fetchNpmDeps {
     name = "${finalAttrs.pname}-${finalAttrs.version}-npm-deps";
     src = "${finalAttrs.src}/${finalAttrs.npmRoot}";
-    hash = "sha256-PGT8UCjsgyARHw2/lbCAMSNQr/5FqbDz0Auf90jjHLk=";
+    hash = "sha256-UgvT81DR4pWlQRfQgmecp+AOUSih4+/v7c1ApIDf3Ts=";
   };
 
   npmRoot = "frontend";

pkgs/by-name/ma/mautrix-slack/package.nix

@@ -12,21 +12,19 @@
   # any issues they run into.
   withGoolm ? false,
 }:
-let
-  version = "0.2.3";
-in
-buildGoModule {
+buildGoModule rec {
   pname = "mautrix-slack";
-  inherit version;
+  version = "25.10";
+  tag = "v0.2510.0";
 
   src = fetchFromGitHub {
     owner = "mautrix";
     repo = "slack";
-    tag = "v${version}";
-    hash = "sha256-gR5D2uCNS+LiP0KXup/iIiOThWohzeBe4CD/oWak1BM=";
+    tag = tag;
+    hash = "sha256-PeSE7WKFSSxZyyG9TJmYeCzHY3bPvkHZ5l+mLzr8tS8=";
   };
 
-  vendorHash = "sha256-aukL6RThtWcznz/x25btTTvloYkRZ/vhAQj1hOdI1U4=";
+  vendorHash = "sha256-9MsHRU2EqMTWEMVraJ/6/084X5yx3zzSdxP8zSYFJ1E=";
 
   buildInputs = lib.optional (!withGoolm) olm;
   tags = lib.optional withGoolm "goolm";
@@ -35,6 +33,13 @@ buildGoModule {
   versionCheckProgramArg = "--version";
   doInstallCheck = true;
 
+  ldflags = [
+    "-s"
+    "-w"
+    "-X"
+    "main.Tag=${tag}"
+  ];
+
   passthru.updateScript = nix-update-script { };
 
   meta = {

pkgs/by-name/me/megasync/package.nix

@@ -34,13 +34,13 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "megasync";
-  version = "5.15.0.1";
+  version = "5.16.0.2";
 
   src = fetchFromGitHub rec {
     owner = "meganz";
     repo = "MEGAsync";
     tag = "v${finalAttrs.version}_Linux";
-    hash = "sha256-CqeR1UmwrwUjr8QM2LCkZ4RaEU2bU1fq+QLCN7yfIJk=";
+    hash = "sha256-Bkye2Is3GbdnYYaS//AkNfrt8ppWP9zE58obcmUm0wE=";
     fetchSubmodules = false; # DesignTokensImporter cannot be fetched, see #1010 in github:meganz/megasync
     leaveDotGit = true;
     postFetch = ''
@@ -67,6 +67,10 @@ stdenv.mkDerivation (finalAttrs: {
       url = "https://aur.archlinux.org/cgit/aur.git/plain/030-megasync-app-fix-cmake-dependencies-detection.patch?h=megasync&id=ff59780039697591e7e3a966db058b23bee0451c";
       hash = "sha256-11XWctv1veUEguc9Xvz2hMYw26CaCwu6M4hyA+5r81U=";
     })
+    (fetchpatch {
+      url = "https://aur.archlinux.org/cgit/aur.git/plain/040-megasync-app-add-missing-link-to-zlib.patch?h=megasync&id=c1f647871f5aad7e421971165b07e51b3e7900e9";
+      hash = "sha256-HMsS5TlzkQZbfANSIrvH8Cp6mTxLJ04idcWUWeD2A0U=";
+    })
     ./megasync-fix-cmake-install-bindir.patch
     ./dont-fetch-clang-format.patch
   ];

pkgs/by-name/mi/mim-solvers/fix-croco-310.patch

@@ -0,0 +1,52 @@
+From 1cb7fe38e3ec43117c646cae521eb8347145965a Mon Sep 17 00:00:00 2001
+From: Guilhem Saurel <guilhem.saurel@laas.fr>
+Date: Tue, 14 Oct 2025 19:37:16 +0200
+Subject: [PATCH] fix for crocoddyl v3.1.0 explicit template instanciation
+
+ref. https://github.com/loco-3d/crocoddyl/pull/1367
+
+Yes, that was a breaking change
+---
+ tests/factory/point-mass.hpp | 22 ++++++++++++++++++++++
+ 1 file changed, 22 insertions(+)
+
+diff --git a/tests/factory/point-mass.hpp b/tests/factory/point-mass.hpp
+index e82c977..c2e93af 100644
+--- a/tests/factory/point-mass.hpp
++++ b/tests/factory/point-mass.hpp
+@@ -60,6 +60,17 @@ class DAMPointMass1D : public crocoddyl::DifferentialActionModelAbstract {
+   // Destructor
+   virtual ~DAMPointMass1D();
+ 
++  // Explicit template instanciation
++  std::shared_ptr<crocoddyl::DifferentialActionModelBase> cloneAsDouble()
++      const override {
++    return std::make_shared<DAMPointMass1D>(*this);
++  }
++
++  std::shared_ptr<crocoddyl::DifferentialActionModelBase> cloneAsFloat()
++      const override {
++    return std::make_shared<DAMPointMass1D>(*this);
++  }
++
+   // Cost & dynamics
+   void calc(const std::shared_ptr<DifferentialActionDataAbstract>& data,
+             const Eigen::Ref<const VectorXd>& x,
+@@ -135,6 +146,17 @@ class DAMPointMass2D : public crocoddyl::DifferentialActionModelAbstract {
+   // Destructor
+   virtual ~DAMPointMass2D();
+ 
++  // Explicit template instanciation
++  std::shared_ptr<crocoddyl::DifferentialActionModelBase> cloneAsDouble()
++      const override {
++    return std::make_shared<DAMPointMass2D>(*this);
++  }
++
++  std::shared_ptr<crocoddyl::DifferentialActionModelBase> cloneAsFloat()
++      const override {
++    return std::make_shared<DAMPointMass2D>(*this);
++  }
++
+   // Cost & dynamics
+   void calc(const std::shared_ptr<DifferentialActionDataAbstract>& data,
+             const Eigen::Ref<const VectorXd>& x,

pkgs/by-name/mi/mim-solvers/package.nix

@@ -3,12 +3,11 @@
   crocoddyl,
   ctestCheckHook,
   fetchFromGitHub,
+  fetchpatch,
   lib,
   llvmPackages,
   pkg-config,
   proxsuite,
-  python3Packages,
-  pythonSupport ? false,
   stdenv,
   nix-update-script,
 }:
@@ -24,49 +23,44 @@ stdenv.mkDerivation (finalAttrs: {
     hash = "sha256-1Mqu9Hfy65HUIOVG/gJBpSMlOwDWVcH+LrR8CaWz0BE=";
   };
 
-  # eigenpy is not used without python support
-  postPatch = lib.optionalString (!pythonSupport) ''
-    substituteInPlace CMakeLists.txt --replace-fail \
-      "add_project_dependency(eigenpy 2.7.10 REQUIRED)" \
-      ""
-  '';
+  patches = [
+    # ref. https://github.com/machines-in-motion/mim_solvers/pull/71 merged upstream
+    (fetchpatch {
+      name = "build-standalone-python-interface.patch";
+      url = "https://github.com/machines-in-motion/mim_solvers/commit/796eecf05dd9165dd0795aa562ead17de4f19633.patch";
+      hash = "sha256-/OiMzyDVEbpC/Dr/HcguwAdhmbQNxnIRsHAVkX68xqA=";
+    })
+    # Fix for crocoddyl 3.1.0
+    # ref. https://github.com/machines-in-motion/mim_solvers/pull/72
+    ./fix-croco-310.patch
+  ];
 
   nativeBuildInputs = [
     cmake
     pkg-config
-  ]
-  ++ lib.optional pythonSupport python3Packages.pythonImportsCheckHook;
+  ];
+
   buildInputs = lib.optional stdenv.hostPlatform.isDarwin llvmPackages.openmp;
-  propagatedBuildInputs =
-    lib.optionals pythonSupport [
-      python3Packages.crocoddyl
-      python3Packages.osqp
-      python3Packages.proxsuite
-      python3Packages.scipy
-    ]
-    ++ lib.optionals (!pythonSupport) [
-      crocoddyl
-      proxsuite
-    ];
+
+  propagatedBuildInputs = [
+    crocoddyl
+    proxsuite
+  ];
 
   cmakeFlags = [
-    (lib.cmakeBool "BUILD_PYTHON_INTERFACE" pythonSupport)
+    (lib.cmakeBool "BUILD_PYTHON_INTERFACE" false)
     (lib.cmakeBool "BUILD_WITH_PROXSUITE" true)
-  ]
-  ++ lib.optional (stdenv.hostPlatform.isDarwin) (
-    lib.cmakeFeature "CMAKE_CTEST_ARGUMENTS" "--exclude-regex;'py-test-clqr-osqp'"
-  )
-  ++ lib.optional (stdenv.hostPlatform.isLinux && stdenv.hostPlatform.isAarch64) (
-    lib.cmakeFeature "CMAKE_CTEST_ARGUMENTS" "--exclude-regex;'test_solvers'"
-  );
+  ];
 
   nativeCheckInputs = [
     ctestCheckHook
   ];
   disabledTests = [
     # Fails with osqp>=1.0.0
-    # See https://github.com/machines-in-motion/mim_solvers/pull/66
+    # See https://github.com/machines-in-motion/mim_solvers/pull/67
     "py-test-clqr-osqp"
+    # need removed ActuationModelMultiCopterBase in crocoddyl 3.1.0
+    "py-test-sqp-no-reg"
   ]
   ++ lib.optionals (stdenv.hostPlatform.isLinux && stdenv.hostPlatform.isAarch64) [
     # Several errors such as:
@@ -78,8 +72,6 @@ stdenv.mkDerivation (finalAttrs: {
   ];
   doCheck = true;
 
-  pythonImportsCheck = [ "mim_solvers" ];
-
   passthru.updateScript = nix-update-script { };
 
   meta = {

pkgs/by-name/ms/msnake/package.nix

@@ -18,6 +18,12 @@ stdenv.mkDerivation (finalAttrs: {
     hash = "sha256-5q3yT7amPF+SSvO6/eUU7IiK0k6f3nme9YYBUobSuuo=";
   };
 
+  postPatch = ''
+    substituteInPlace CMakeLists.txt --replace-fail \
+      "cmake_minimum_required(VERSION 2.8.4)" \
+      "cmake_minimum_required(VERSION 4.0)"
+  '';
+
   nativeBuildInputs = [
     cmake
   ];

pkgs/by-name/mt/mtail/package.nix

@@ -8,16 +8,16 @@
 
 buildGoModule rec {
   pname = "mtail";
-  version = "3.2.19";
+  version = "3.2.20";
 
   src = fetchFromGitHub {
     owner = "jaqx0r";
     repo = "mtail";
     rev = "v${version}";
-    hash = "sha256-rAN5k3XjDTSmdp2E5pa5W+nK4J8l5+sPqSFQRdjebmA=";
+    hash = "sha256-w895q6J0o4a4y3YwGWyu5tpv7ow9RNWEFQVIMDJo43Y=";
   };
 
-  vendorHash = "sha256-SMdEowzg53uori/Ge+GE4542wswBU2kgdyAXxeKQiiU=";
+  vendorHash = "sha256-hVguLf/EkTz7Z8lTT9tCQ8iGO5asSkrsW+u8D1ND+dw=";
 
   nativeBuildInputs = [
     gotools # goyacc

pkgs/by-name/na/namespace-cli/package.nix

@@ -6,16 +6,16 @@
 
 buildGoModule rec {
   pname = "namespace-cli";
-  version = "0.0.441";
+  version = "0.0.442";
 
   src = fetchFromGitHub {
     owner = "namespacelabs";
     repo = "foundation";
     rev = "v${version}";
-    hash = "sha256-qnKt6tXHHPt1uB9JY70atnOLwXgal0YO9n2w60S8lJk=";
+    hash = "sha256-SGibs1Jbq6WWeiDS1SbjX5s+Wy2vpCD74TofB9CbuVE=";
   };
 
-  vendorHash = "sha256-p3ciuSL3lJHLbWVsfKiaKZ+gjxCZCOBhXcucxBUVIEs=";
+  vendorHash = "sha256-913vffq86pju2UKW0UkTm8qE7bylR9n0SgacELIRhVY=";
 
   subPackages = [
     "cmd/nsc"