Merge master into staging-next

doc/release-notes/rl-2511.section.md

@@ -39,6 +39,10 @@
 
 - `tooling-language-server` has been renamed to `deputy` (both the package and binary), following the rename of the upstream project.
 
+- `webfontkitgenerator` has been renamed to `webfont-bundler`, following the rename of the upstream project.
+  The binary name remains `webfontkitgenerator`.
+  The `webfontkitgenerator` package is an alias to `webfont-bundler`.
+
 - `lima` package now only includes the guest agent for the host's architecture by default. If your guest VM's architecture differs from your Lima host's, you'll need to enable the `lima-additional-guestagents` package by setting `withAdditionalGuestAgents = true` when overriding lima with this input.
 
 - `vmware-horizon-client` was renamed to `omnissa-horizon-client`, following [VMware's sale of their end-user business to Omnissa](https://www.omnissa.com/insights/introducing-omnissa-the-former-vmware-end-user-computing-business/). The binary has been renamed from `vmware-view` to `horizon-client`.

maintainers/maintainer-list.nix

@@ -26238,6 +26238,12 @@
     githubId = 29992205;
     keys = [ { fingerprint = "6684 4E7D D213 C75D 8828  6215 C714 A58B 6C1E 0F52"; } ];
   };
+  ungeskriptet = {
+    name = "David Wronek";
+    email = "nix@david-w.eu";
+    github = "ungeskriptet";
+    githubId = 40729975;
+  };
   unhammer = {
     email = "unhammer@fsfe.org";
     github = "unhammer";

nixos/modules/services/mail/tlsrpt.nix

@@ -50,6 +50,17 @@ let
     ];
   };
 
+  collectdConfigFile = format.generate "tlsrpt-collectd.cfg" {
+    tlsrpt_collectd = dropNullValues cfg.collectd.settings;
+  };
+  fetcherConfigFile = format.generate "tlsrpt-fetcher.cfg" {
+    tlsrpt_fetcher = dropNullValues cfg.fetcher.settings;
+  };
+  reportdConfigFile = format.generate "tlsrpt-reportd.cfg" {
+    tlsrpt_reportd = dropNullValues cfg.reportd.settings;
+  };
+
+  withPostfix = config.services.postfix.enable && cfg.configurePostfix;
 in
 
 {
@@ -117,14 +128,6 @@ in
           See {manpage}`tlsrpt-collectd(1)` for possible flags.
         '';
       };
-
-      configurePostfix = mkOption {
-        type = types.bool;
-        default = true;
-        description = ''
-          Whether to modify the local Postfix service to grant access to the collectd socket.
-        '';
-      };
     };
 
     fetcher = {
@@ -229,9 +232,16 @@ in
 
             sendmail_script = mkOption {
               type = with types; nullOr str;
-              default = if config.services.postfix.enable then "sendmail" else null;
+              default =
+                if config.services.postfix.enable && config.services.postfix.setSendmail then
+                  "/run/wrappers/bin/sendmail -i -t"
+                else
+                  null;
               defaultText = lib.literalExpression ''
-                if any [ config.services.postfix.enable ] then "sendmail" else null
+                if config.services.postfix.enable && config.services.postfix.setSendmail then
+                  "/run/wrappers/bin/sendmail -i -t"
+                else
+                  null
               '';
               description = ''
                 Path to a sendmail-compatible executable for delivery reports.
@@ -255,19 +265,21 @@ in
         '';
       };
     };
+
+    configurePostfix = mkOption {
+      type = types.bool;
+      default = true;
+      description = ''
+        Whether to configure permissions to allow integration with Postfix.
+      '';
+    };
   };
 
   config = mkIf cfg.enable {
     environment.etc = {
-      "tlsrpt/collectd.cfg".source = format.generate "tlsrpt-collectd.cfg" {
-        tlsrpt_collectd = dropNullValues cfg.collectd.settings;
-      };
-      "tlsrpt/fetcher.cfg".source = format.generate "tlsrpt-fetcher.cfg" {
-        tlsrpt_fetcher = dropNullValues cfg.fetcher.settings;
-      };
-      "tlsrpt/reportd.cfg".source = format.generate "tlsrpt-reportd.cfg" {
-        tlsrpt_reportd = dropNullValues cfg.reportd.settings;
-      };
+      "tlsrpt/collectd.cfg".source = collectdConfigFile;
+      "tlsrpt/fetcher.cfg".source = fetcherConfigFile;
+      "tlsrpt/reportd.cfg".source = reportdConfigFile;
     };
 
     users.users.tlsrpt = {
@@ -276,11 +288,9 @@ in
     };
     users.groups.tlsrpt = { };
 
-    users.users.postfix.extraGroups =
-      lib.mkIf (config.services.postfix.enable && cfg.collectd.configurePostfix)
-        [
-          "tlsrpt"
-        ];
+    users.users.postfix.extraGroups = lib.mkIf withPostfix [
+      "tlsrpt"
+    ];
 
     systemd.services.tlsrpt-collectd = {
       description = "TLSRPT datagram collector";
@@ -288,7 +298,7 @@ in
 
       wantedBy = [ "multi-user.target" ];
 
-      restartTriggers = [ "/etc/tlsrpt/collectd.cfg" ];
+      restartTriggers = [ collectdConfigFile ];
 
       serviceConfig = commonServiceSettings // {
         ExecStart = toString (
@@ -312,7 +322,7 @@ in
 
       wantedBy = [ "multi-user.target" ];
 
-      restartTriggers = [ "/etc/tlsrpt/reportd.cfg" ];
+      restartTriggers = [ reportdConfigFile ];
 
       serviceConfig = commonServiceSettings // {
         ExecStart = toString (
@@ -324,7 +334,10 @@ in
         RestrictAddressFamilies = [
           "AF_INET"
           "AF_INET6"
+          "AF_NETLINK"
         ];
+        ReadWritePaths = lib.optionals withPostfix [ "/var/lib/postfix/queue/maildrop" ];
+        SupplementaryGroups = lib.optionals withPostfix [ "postdrop" ];
         UMask = "0077";
       };
     };

nixos/modules/services/security/vaultwarden/default.nix

@@ -224,7 +224,8 @@ in
     users.groups.vaultwarden = { };
 
     systemd.services.vaultwarden = {
-      after = [ "network.target" ];
+      after = [ "network-online.target" ];
+      wants = [ "network-online.target" ];
       path = with pkgs; [ openssl ];
       serviceConfig = {
         User = user;

nixos/modules/services/web-apps/peering-manager.nix

@@ -19,17 +19,16 @@ let
     settingsFile
     extraConfigFile
   ];
+  finalConfigFile =
+    if (cfg.environmentFile != null) then "/var/lib/peering-manager/configuration.py" else configFile;
 
   pkg =
     (pkgs.peering-manager.overrideAttrs (old: {
       postInstall = ''
-        ln -s ${configFile} $out/opt/peering-manager/peering_manager/configuration.py
+        ln -s ${finalConfigFile} $out/opt/peering-manager/peering_manager/configuration.py
       ''
       + lib.optionalString cfg.enableLdap ''
         ln -s ${cfg.ldapConfigPath} $out/opt/peering-manager/peering_manager/ldap_config.py
-      ''
-      + lib.optionalString cfg.enableOidc ''
-        ln -s ${cfg.oidcConfigPath} $out/opt/peering-manager/peering_manager/oidc_config.py
       '';
     })).override
       {
@@ -55,6 +54,32 @@ in
       '';
     };
 
+    environmentFile = mkOption {
+      type = with types; nullOr path;
+      default = null;
+      example = "/run/secrets/peering-manager.env";
+      description = ''
+        Environment file as defined in {manpage}`systemd.exec(5)`.
+
+        Secrets may be passed to the service without adding them to the world-readable
+        Nix store, by specifying placeholder variables as the option value in Nix and
+        setting these variables accordingly in the environment file.
+
+        ```
+          # snippet of peering-manager-related config
+          services.peering-manager.settings.SOCIAL_AUTH_OIDC_SECRET = "$PM_OIDC_SECRET";
+        ```
+
+        ```
+          # content of the environment file
+          PM_OIDC_SECRET=topsecret
+        ```
+
+        Note that this file needs to be available on the host on which
+        `peering-manager` is running.
+      '';
+    };
+
     enableScheduledTasks = mkOption {
       type = types.bool;
       default = true;
@@ -155,26 +180,23 @@ in
         See the [documentation](https://peering-manager.readthedocs.io/en/stable/setup/6-ldap/#configuration) for possible options.
       '';
     };
-
-    enableOidc = mkOption {
-      type = types.bool;
-      default = false;
-      description = ''
-        Enable OIDC-Authentication for Peering Manager.
-
-        This requires a configuration file being pass through `oidcConfigPath`.
-      '';
-    };
-
-    oidcConfigPath = mkOption {
-      type = types.path;
-      description = ''
-        Path to the Configuration-File for OIDC-Authentication, will be loaded as `oidc_config.py`.
-        See the [documentation](https://peering-manager.readthedocs.io/en/stable/setup/6b-oidc/#configuration) for possible options.
-      '';
-    };
   };
 
+  imports = [
+    (lib.mkRemovedOptionModule [ "services" "peering-manager" "enableOidc" ] ''
+      The enableOidc option has been removed, since peering-manager has OIDC support builtin since version >= 1.9.0.
+
+      Make sure to update your OIDC configuration according to the documentation:
+      https://peering-manager.readthedocs.io/en/v1.9.3/administration/authentication/oidc/
+    '')
+    (lib.mkRemovedOptionModule [ "services" "peering-manager" "oidcConfigPath" ] ''
+      The oidcConfigPath option has been removed, since peering-manager has OIDC support builtin since version >= 1.9.0.
+
+      The new config settings for OIDC are explained in the documentation:
+      https://peering-manager.readthedocs.io/en/v1.9.3/administration/authentication/oidc/
+    '')
+  ];
+
   config = lib.mkIf cfg.enable {
     services.peering-manager = {
       settings = {
@@ -208,18 +230,7 @@ in
           PEERINGDB_API_KEY = file.readline()
       '';
 
-      plugins = (
-        ps:
-        (lib.optionals cfg.enableLdap [ ps.django-auth-ldap ])
-        ++ (lib.optionals cfg.enableOidc (
-          with ps;
-          [
-            mozilla-django-oidc
-            pyopenssl
-            josepy
-          ]
-        ))
-      );
+      plugins = (ps: (lib.optionals cfg.enableLdap [ ps.django-auth-ldap ]));
     };
 
     system.build.peeringManagerPkg = pkg;
@@ -266,9 +277,22 @@ in
         };
       in
       {
+        peering-manager-config = lib.mkIf (cfg.environmentFile != null) (
+          lib.recursiveUpdate defaults {
+            description = "Peering Manager config file setup";
+            wantedBy = [ "peering-manager.target" ];
+            serviceConfig = {
+              Type = "oneshot";
+              EnvironmentFile = [ cfg.environmentFile ];
+              ExecStart = "${lib.getExe pkgs.envsubst} -i ${configFile} -o ${finalConfigFile}";
+            };
+          }
+        );
+
         peering-manager-migration = lib.recursiveUpdate defaults {
           description = "Peering Manager migrations";
           wantedBy = [ "peering-manager.target" ];
+          after = lib.mkIf (cfg.environmentFile != null) [ "peering-manager-config.service" ];
           serviceConfig = {
             Type = "oneshot";
             ExecStart = "${pkg}/bin/peering-manager migrate";
@@ -278,7 +302,10 @@ in
         peering-manager = lib.recursiveUpdate defaults {
           description = "Peering Manager WSGI Service";
           wantedBy = [ "peering-manager.target" ];
-          after = [ "peering-manager-migration.service" ];
+          after = [
+            "peering-manager-migration.service"
+          ]
+          ++ lib.optionals (cfg.environmentFile != null) [ "peering-manager-config.service" ];
 
           preStart = ''
             ${pkg}/bin/peering-manager remove_stale_contenttypes --no-input
@@ -341,7 +368,7 @@ in
           after = [ "peering-manager.service" ];
           serviceConfig = {
             Type = "oneshot";
-            ExecStart = "${pkg}/bin/peering-manager poll_bgp_sessions --all";
+            ExecStart = "${pkg}/bin/peering-manager poll_bgp_sessions";
           };
         };
       };

pkgs/applications/editors/vim/plugins/generated.nix

@@ -9370,6 +9370,19 @@ final: prev: {
     meta.hydraPlatforms = [ ];
   };
 
+  neotest-ctest = buildVimPlugin {
+    pname = "neotest-ctest";
+    version = "2025-07-02";
+    src = fetchFromGitHub {
+      owner = "orjangj";
+      repo = "neotest-ctest";
+      rev = "124e8834a07aa522c6e9fa96f03e8ab0b7f2fa05";
+      sha256 = "0rml2m0v14v7ikllya6d55gwm75lfkf2ip11cm8x4n7x2pw17d04";
+    };
+    meta.homepage = "https://github.com/orjangj/neotest-ctest/";
+    meta.hydraPlatforms = [ ];
+  };
+
   neotest-dart = buildVimPlugin {
     pname = "neotest-dart";
     version = "2025-06-03";
@@ -14372,6 +14385,19 @@ final: prev: {
     meta.hydraPlatforms = [ ];
   };
 
+  tardis-nvim = buildVimPlugin {
+    pname = "tardis.nvim";
+    version = "2025-07-28";
+    src = fetchFromGitHub {
+      owner = "fredehoey";
+      repo = "tardis.nvim";
+      rev = "951f0903dd52eab69a240a89e514c62d4ea0260f";
+      sha256 = "0bdb7bw4f0gidwibs7n6l5gz2a23pm868i9ksh7kkafhl7qf4vz3";
+    };
+    meta.homepage = "https://github.com/fredehoey/tardis.nvim/";
+    meta.hydraPlatforms = [ ];
+  };
+
   targets-vim = buildVimPlugin {
     pname = "targets.vim";
     version = "2024-07-10";

pkgs/applications/editors/vim/plugins/non-generated/avante-nvim/default.nix

@@ -12,12 +12,12 @@
   pkgs,
 }:
 let
-  version = "0.0.25-unstable-2025-07-11";
+  version = "0.0.27-unstable-2025-07-28";
   src = fetchFromGitHub {
     owner = "yetone";
     repo = "avante.nvim";
-    rev = "c4ce24e3c047c3283652aeb9a16114603d6f705c";
-    hash = "sha256-ILOISh3+bfN1dEz1BN4+iZ2WJzmt0++QVZUjp24ZjNI=";
+    rev = "5e4eb8652b4776f139282a343f04a3a8c7f23cb0";
+    hash = "sha256-rmpBI2j7zwU5tIUjK7fMhfle5LVksk/kuCnwN9WQkic=";
   };
   avante-nvim-lib = rustPlatform.buildRustPackage {
     pname = "avante-nvim-lib";

pkgs/applications/editors/vim/plugins/overrides.nix

@@ -1284,6 +1284,8 @@ in
     nvimSkipModules = [
       "fzf-lua.shell_helper"
       "fzf-lua.spawn"
+      "fzf-lua.rpc"
+      "fzf-lua.types"
     ];
   };
 
@@ -2045,6 +2047,14 @@ in
     ];
   };
 
+  neotest-ctest = super.neotest-ctest.overrideAttrs {
+    dependencies = with self; [
+      neotest
+      nvim-nio
+      plenary-nvim
+    ];
+  };
+
   neotest-dart = super.neotest-dart.overrideAttrs {
     dependencies = with self; [
       neotest
@@ -3298,6 +3308,11 @@ in
     meta.maintainers = with lib.maintainers; [ callumio ];
   };
 
+  tardis-nvim = super.tardis-nvim.overrideAttrs {
+    dependencies = [ self.plenary-nvim ];
+    meta.maintainers = with lib.maintainers; [ fredeb ];
+  };
+
   taskwarrior2 = buildVimPlugin {
     inherit (taskwarrior2) version pname;
     src = "${taskwarrior2.src}/scripts/vim";

pkgs/applications/editors/vim/plugins/vim-plugin-names

@@ -719,6 +719,7 @@ https://github.com/Shougo/neosnippet-snippets/,,
 https://github.com/Shougo/neosnippet.vim/,,
 https://github.com/kassio/neoterm/,,
 https://github.com/rcasia/neotest-bash/,HEAD,
+https://github.com/orjangj/neotest-ctest/,HEAD,
 https://github.com/sidlatau/neotest-dart/,HEAD,
 https://github.com/MarkEmmons/neotest-deno/,HEAD,
 https://github.com/Issafalcon/neotest-dotnet/,HEAD,
@@ -1103,6 +1104,7 @@ https://github.com/preservim/tagbar/,,
 https://github.com/vim-scripts/taglist.vim/,,
 https://github.com/luckasRanarison/tailwind-tools.nvim/,HEAD,
 https://github.com/themaxmarchuk/tailwindcss-colors.nvim/,HEAD,
+https://github.com/fredehoey/tardis.nvim/,HEAD,
 https://github.com/wellle/targets.vim/,,
 https://github.com/tbabej/taskwiki/,,
 https://github.com/tomtom/tcomment_vim/,,

pkgs/applications/networking/browsers/floorp/default.nix

@@ -9,7 +9,7 @@
 (
   (buildMozillaMach rec {
     pname = "floorp";
-    packageVersion = "11.28.0";
+    packageVersion = "11.29.0";
     applicationName = "Floorp";
     binaryName = "floorp";
     branding = "browser/branding/official";
@@ -17,14 +17,14 @@
     allowAddonSideload = true;
 
     # Must match the contents of `browser/config/version.txt` in the source tree
-    version = "128.12.0";
+    version = "128.13.0";
 
     src = fetchFromGitHub {
       owner = "Floorp-Projects";
       repo = "Floorp";
       fetchSubmodules = true;
       rev = "v${packageVersion}";
-      hash = "sha256-2BSl7RHhqFAYSpshBYxuVWwLlVXdOT3xgH4tva5ShY4=";
+      hash = "sha256-uTTI9n99P4hHDf849lR7oiNGLbCa03ivjE1xF0gyT4Y=";
     };
 
     extraConfigureFlags = [

pkgs/build-support/php/builders/v2/build-composer-project.nix

@@ -86,12 +86,12 @@ let
           inherit (finalAttrs)
             pname
             src
+            vendorHash
             version
             ;
           inherit
             php
             composer
-            vendorHash
             composerLock
             composerNoDev
             composerNoPlugins

pkgs/by-name/bu/buildstream/package.nix

@@ -13,6 +13,9 @@
   addBinToPathHook,
   gitMinimal,
   versionCheckHook,
+
+  # Optional features
+  enableBuildstreamPlugins ? true,
 }:
 
 python3Packages.buildPythonApplication rec {
@@ -53,7 +56,10 @@ python3Packages.buildPythonApplication rec {
     ruamel-yaml-clib
     tomlkit
     ujson
-  ]);
+  ])
+  ++ lib.optionals enableBuildstreamPlugins [
+    python3Packages.buildstream-plugins
+  ];
 
   buildInputs = [
     fuse3

pkgs/by-name/ce/cerberus/package.nix

@@ -0,0 +1,92 @@
+{
+  lib,
+  fetchFromGitHub,
+  writableTmpDirAsHomeHook,
+  unstableGitUpdater,
+  ocamlPackages,
+  opam,
+}:
+ocamlPackages.buildDunePackage {
+  pname = "cerberus";
+  version = "0-unstable-2025-06-29";
+
+  src = fetchFromGitHub {
+    owner = "rems-project";
+    repo = "cerberus";
+    rev = "61700b301f0f1fbc1940db51c50240c397759057";
+    hash = "sha256-QpgHOQqiJMlMf2RH5/TI3AirdqYPS7HwE9YIlxgorqg=";
+  };
+
+  minimalOCamlVersion = "4.12";
+
+  strictDeps = true;
+
+  nativeBuildInputs = [
+    opam
+    writableTmpDirAsHomeHook
+    ocamlPackages.lem
+    ocamlPackages.menhir
+  ];
+
+  buildInputs = with ocamlPackages; [
+    sha
+    pprint
+    cmdliner
+    yojson
+    lem
+    result
+    ppx_deriving
+    zarith
+    sexplib
+    menhirLib
+    janeStreet.ppx_sexp_conv
+  ];
+
+  env.OPAM_SWITCH_PREFIX = placeholder "out";
+  buildPhase = ''
+    runHook preBuild
+
+    make Q= cerberus
+
+    runHook postBuild
+  '';
+
+  doInstallCheck = true;
+  installCheckPhase = ''
+    runHook preInstallCheck
+
+    PATH="$out/bin":$PATH
+
+    patchShebangs --build tests
+
+    tests/run-ci.sh
+
+    runHook postInstallCheck
+  '';
+
+  passthru.updateScript = unstableGitUpdater { branch = "master"; };
+
+  meta = {
+    homepage = "https://www.cl.cam.ac.uk/~pes20/cerberus/";
+    license = with lib.licenses; [
+      # Most of Cerberus
+      bsd2
+      # https://github.com/rems-project/cerberus/blob/master/THIRD_PARTY_FILES.md
+      # Files from Linux kernel
+      gpl2Only
+      # Files from cppmem
+      bsd3
+      # Files from musl
+      mit
+      # Files from BSD
+      bsdOriginal
+      # Slightly modified vendored SibylFS
+      isc
+    ];
+    mainProgram = "cerberus";
+    maintainers = with lib.maintainers; [
+      RossSmyth
+    ];
+    platforms = lib.platforms.unix;
+  };
+}

pkgs/by-name/co/cockpit/package.nix

@@ -41,13 +41,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "cockpit";
-  version = "342";
+  version = "343";
 
   src = fetchFromGitHub {
     owner = "cockpit-project";
     repo = "cockpit";
     tag = finalAttrs.version;
-    hash = "sha256-NkddZeWvMSP8pcN+eFWDm6iux3REjPP2jBwHF5CTzmU=";
+    hash = "sha256-Yov8C1zpSYkkK5U7Lly6jGqvtfIZVH4modd2mLZRrGs=";
     fetchSubmodules = true;
   };
 

pkgs/by-name/cp/cppman/package.nix

@@ -0,0 +1,70 @@
+{
+  lib,
+  python3Packages,
+  fetchFromGitHub,
+  groff,
+  nix-update-script,
+  versionCheckHook,
+  writableTmpDirAsHomeHook,
+}:
+python3Packages.buildPythonApplication rec {
+  pname = "cppman";
+  version = "0.5.9";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "aitjcize";
+    repo = "cppman";
+    tag = version;
+    hash = "sha256-iPJR4XAjNrBhFHZVOATPi3WwTC1/Y6HK3qmKLqbaK98=";
+  };
+
+  build-system = with python3Packages; [
+    setuptools
+    distutils
+  ];
+
+  dependencies = [
+    python3Packages.beautifulsoup4
+    python3Packages.html5lib
+    python3Packages.lxml
+    python3Packages.six
+    python3Packages.soupsieve
+    python3Packages.typing-extensions
+    python3Packages.webencodings
+    groff
+  ];
+
+  # cppman pins all dependency versions via requirements.txt as install_requires
+  pythonRelaxDeps = true;
+
+  # bs4 is merely a dummy package and can be safely removed
+  # Ideally, its version would also stay fixed.
+  postPatch = ''
+    substituteInPlace requirements.txt \
+      --replace-fail "bs4==0.0.2" ""
+  '';
+
+  pythonImportsCheck = [
+    "cppman"
+  ];
+
+  nativeCheckInputs = [
+    versionCheckHook
+    writableTmpDirAsHomeHook
+  ];
+  # Writable $HOME is required for `cppman --version` to work
+  versionCheckKeepEnvironment = "HOME";
+  versionCheckProgramArg = "--version";
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "Terminal viewer for C++ 98/11/14 manual pages";
+    homepage = "https://github.com/aitjcize/cppman";
+    changelog = "https://github.com/aitjcize/cppman/blob/${src.tag}/ChangeLog";
+    license = lib.licenses.gpl3Only;
+    maintainers = with lib.maintainers; [ ryan4yin ];
+    mainProgram = "cppman";
+  };
+}

pkgs/by-name/gi/git-town/package.nix

@@ -13,13 +13,13 @@
 
 buildGoModule rec {
   pname = "git-town";
-  version = "21.2.0";
+  version = "21.3.0";
 
   src = fetchFromGitHub {
     owner = "git-town";
     repo = "git-town";
     tag = "v${version}";
-    hash = "sha256-/d3HXTkbb2z7+e141pquhDVvl+veFD6Z7m64026Xak4=";
+    hash = "sha256-G1xeMOKZ1EKCZXqC2fJEUa5PeWUGknv0zew7rjAXqkM=";
   };
 
   vendorHash = null;

pkgs/by-name/im/impala/package.nix

@@ -5,16 +5,16 @@
 }:
 rustPlatform.buildRustPackage rec {
   pname = "impala";
-  version = "0.2.4";
+  version = "0.3.0";
 
   src = fetchFromGitHub {
     owner = "pythops";
     repo = "impala";
     rev = "v${version}";
-    hash = "sha256-NPNzvqnuYXrHCOLN0kZwtzPiKVdl6UFnb/S/XtG+sEY=";
+    hash = "sha256-E3Vb2ZgpU0Qj5IoyB1zCyhUD1Cz07TVV0B2M6IFZ6KQ=";
   };
 
-  cargoHash = "sha256-TILQKCBq6oji9u78sfEzoqYhKmtah5Q5x0JOVMNqzTk=";
+  cargoHash = "sha256-vRhv3hu6GsyOJZdP+zMFHnlNa3ETksSp6p18nVUUMQc=";
 
   meta = {
     description = "TUI for managing wifi";

pkgs/by-name/ko/komga/package.nix

@@ -10,11 +10,11 @@
 
 stdenvNoCC.mkDerivation rec {
   pname = "komga";
-  version = "1.22.1";
+  version = "1.23.0";
 
   src = fetchurl {
     url = "https://github.com/gotson/${pname}/releases/download/${version}/${pname}-${version}.jar";
-    sha256 = "sha256-MAMHrYJva1n7TtYNjoN4Yb1+mApWfjpXxgFWgkeFc3g=";
+    sha256 = "sha256-OkRTa0yMmxT95yey/7EIYulJ4zr/fZEWMIygzppr5Lw=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/lo/lowdown/package.nix

@@ -5,6 +5,7 @@
   fixDarwinDylibNames,
   which,
   dieHook,
+  bmake,
   enableShared ? !stdenv.hostPlatform.isStatic,
   enableStatic ? stdenv.hostPlatform.isStatic,
   enableDarwinSandbox ? true,
@@ -16,7 +17,7 @@ stdenv.mkDerivation rec {
   pname = "lowdown${
     lib.optionalString (stdenv.hostPlatform.isDarwin && !enableDarwinSandbox) "-unsandboxed"
   }";
-  version = "1.3.2";
+  version = "2.0.2";
 
   outputs = [
     "out"
@@ -27,12 +28,13 @@ stdenv.mkDerivation rec {
 
   src = fetchurl {
     url = "https://kristaps.bsd.lv/lowdown/snapshots/lowdown-${version}.tar.gz";
-    hash = "sha512-IQmgPm2zE+B82Zdg+ldjtU/XI+qab9YRAzwzRMYv32KKjql0YLDEgc/m6DbgyCiNBkulD0dVExCtrTM+nBFHzw==";
+    hash = "sha512-cfzhuF4EnGmLJf5EGSIbWqJItY3npbRSALm+GarZ7SMU7Hr1xw0gtBFMpOdi5PBar4TgtvbnG4oRPh+COINGlA==";
   };
 
   nativeBuildInputs = [
     which
     dieHook
+    bmake # Uses FreeBSD's dialect
   ]
   ++ lib.optionals stdenv.hostPlatform.isDarwin [ fixDarwinDylibNames ];
 
@@ -74,7 +76,7 @@ stdenv.mkDerivation rec {
 
   postInstall =
     let
-      soVersion = "1";
+      soVersion = "2";
     in
 
     # Check that soVersion is up to date even if we are not on darwin

pkgs/by-name/m1/m1n1/package.nix

@@ -0,0 +1,82 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  imagemagick,
+  source-code-pro,
+  nix-update-script,
+}:
+stdenv.mkDerivation (finalAttrs: {
+  pname = "m1n1";
+  version = "1.4.21";
+
+  src = fetchFromGitHub {
+    owner = "AsahiLinux";
+    repo = "m1n1";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-0ZnDexY/Sf2TJFfUv/YelCctFJVENffWqBU0r0azD0M=";
+  };
+
+  nativeBuildInputs = [
+    imagemagick
+  ];
+
+  postConfigure = ''
+    patchShebangs --build font/makefont.sh
+    FONT_PATH=${source-code-pro}/share/fonts/opentype/SourceCodePro-Bold.otf
+    rm font/{SourceCodePro-Bold.ttf,font.bin,font_retina.bin}
+    ./font/makefont.sh 8 16 12 $FONT_PATH font/font.bin
+    ./font/makefont.sh 16 32 25 $FONT_PATH font/font_retina.bin
+  '';
+
+  makeFlags = [
+    "ARCH=${stdenv.cc.targetPrefix}"
+    "RELEASE=1"
+  ];
+
+  enableParallelBuilding = true;
+
+  installPhase = ''
+    runHook preInstall
+
+    install -Dm644 build/m1n1.bin -t $out/lib/m1n1/
+
+    install -Dm644 3rdparty_licenses/LICENSE.* -t $out/share/doc/m1n1/licenses/
+    install -Dm644 LICENSE -t $out/share/doc/m1n1/licenses/
+
+    runHook postInstall
+  '';
+
+  passthru = {
+    updateScript = nix-update-script { };
+  };
+
+  meta = {
+    description = "Bootloader to bridge the Apple (XNU) boot to Linux boot";
+    homepage = "https://github.com/AsahiLinux/m1n1";
+    changelog = "https://github.com/AsahiLinux/m1n1/releases/tag/${finalAttrs.src.tag}";
+    license = with lib.licenses; [
+      # m1n1 embeds several libraries, all of which cannot be
+      # unvendored easily.
+
+      # m1n1, minlzma, musl-libc
+      mit
+      # libfdt: dual BSD2 and GPL-2-or-later
+      # tinf: zlib
+      # arm-trusted-firmware: BSD3
+      # dlmalloc: CC0
+      # PDCLib: CC0
+      # Source Code Pro: OFL1.1
+      # dwc3: BSD3 and GPL-2-or-later
+      cc0
+      ofl
+      zlib
+      bsd2
+      gpl2Plus
+      bsd3
+      asl20
+    ];
+    maintainers = with lib.maintainers; [ normalcea ];
+    platforms = lib.platforms.aarch64;
+  };
+})

pkgs/by-name/mi/minio-client/package.nix

@@ -7,16 +7,16 @@
 
 buildGoModule rec {
   pname = "minio-client";
-  version = "2025-07-16T15-35-03Z";
+  version = "2025-07-21T05-28-08Z";
 
   src = fetchFromGitHub {
     owner = "minio";
     repo = "mc";
     rev = "RELEASE.${version}";
-    sha256 = "sha256-U5bKSew/qqbBs/VR0mSserH/0jdzZsztDJiJ02BHFIY=";
+    sha256 = "sha256-qKlUWppr2zuFkMFoqo1x7xB6PnRYXnkN+31xZKlvuho=";
   };
 
-  vendorHash = "sha256-MpLQZFrf2sBAweXtYeFi5j6p6GaXuN99x+r4UK8D9xM=";
+  vendorHash = "sha256-0ERiUx114EyoooPIVMCjiDkPb4/D0ZC/YuG14+30NPw=";
 
   subPackages = [ "." ];
 

pkgs/by-name/ne/nest-cli/package.nix

@@ -7,16 +7,16 @@
 
 buildNpmPackage rec {
   pname = "nest-cli";
-  version = "11.0.7";
+  version = "11.0.8";
 
   src = fetchFromGitHub {
     owner = "nestjs";
     repo = "nest-cli";
     tag = version;
-    hash = "sha256-CCNbkSu/ymSKdFVDKZezekVFXl6Ipg9Dp9+Tyd4D+cY=";
+    hash = "sha256-vqu5eUtr8oO2HgQhXIHel92qHhHJSqyAJmI2+Oc5VoY=";
   };
 
-  npmDepsHash = "sha256-R9uSOeoQJw061ZEJMe8aDYUaUC1QvHQ9nOyoQa+z+fY=";
+  npmDepsHash = "sha256-QLJBqVHEvOhRRGU9x/5hCvRSi0xKYMDXeqMi6yWNHbU=";
   npmFlags = [ "--legacy-peer-deps" ];
 
   env = {

pkgs/by-name/oc/oci2git/package.nix

@@ -10,16 +10,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "oci2git";
-  version = "0.2.0";
+  version = "0.2.1";
 
   src = fetchFromGitHub {
     owner = "Virviil";
     repo = "oci2git";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-+y2sWYoEuGGOYBk3E1b+2G9eF0mGSABHi92cCm+v590=";
+    hash = "sha256-83Rcw4K3+bqcvqoXTQ2ay/7eAO6GT76RV3qFzfX6O60=";
   };
 
-  cargoHash = "sha256-khl56908go19CV2XlwzH5xE4BNzQW8U7D6ce9OZgovA=";
+  cargoHash = "sha256-7OallIrRg278Bo9iV7FStXbZ1W29RuAK6AnB3PQNWrY=";
 
   nativeBuildInputs = [
     pkg-config

pkgs/by-name/pe/peering-manager/fix-pyixapi-0.2.3-compatibility.patch

@@ -1,30 +0,0 @@
-From ee558ff66e467412942559a8a92252e3fc009920 Mon Sep 17 00:00:00 2001
-From: Guillaume Mazoyer <guillaume@mazoyer.eu>
-Date: Wed, 21 Feb 2024 23:32:32 +0100
-Subject: [PATCH] Use pyixapi 0.2.3
-
----
-diff --git a/extras/models/ixapi.py b/extras/models/ixapi.py
-index 65572c971e065e3deed69465a71a54b4e1372851..637a004043e0a044c65a5e37fbb2b3bf82965436 100644
---- a/extras/models/ixapi.py
-+++ b/extras/models/ixapi.py
-@@ -7,7 +7,6 @@
- from django.db import models
- from django.db.models import Q
- from django.urls import reverse
--from django.utils.timezone import make_aware
- 
- from peering_manager.models import ChangeLoggedModel
- 
-@@ -117,9 +116,9 @@ def dial(self):
-         if auth:
-             # Save tokens if they've changed
-             self.access_token = api.access_token.encoded
--            self.access_token_expiration = make_aware(api.access_token.expires_at)
-+            self.access_token_expiration = api.access_token.expires_at
-             self.refresh_token = api.refresh_token.encoded
--            self.refresh_token_expiration = make_aware(api.refresh_token.expires_at)
-+            self.refresh_token_expiration = api.refresh_token.expires_at
-             self.save()
- 
-         return api

pkgs/by-name/pe/peering-manager/package.nix

@@ -9,38 +9,33 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "peering-manager";
-  version = "1.8.3";
+  version = "1.9.6";
 
   src = fetchFromGitHub {
     owner = "peering-manager";
     repo = "peering-manager";
     tag = "v${version}";
-    sha256 = "sha256-UV1zSX9C9y5faOBUQ7bfj2DT6ffhMW28MIT7SaYjMgw=";
+    sha256 = "sha256-XPnov+pvO0H1ucMuSXs2tpYRE87jpfDiBDUFjnEhydA=";
   };
 
   format = "other";
 
-  patches = [
-    # Fix compatibility with pyixapi 0.2.3
-    # https://github.com/peering-manager/peering-manager/commit/ee558ff66e467412942559a8a92252e3fc009920
-    ./fix-pyixapi-0.2.3-compatibility.patch
-  ];
-
   propagatedBuildInputs =
     with python3.pkgs;
     [
       django
-      djangorestframework
-      django-redis
       django-debug-toolbar
       django-filter
       django-postgresql-netfields
       django-prometheus
+      django-redis
       django-rq
       django-tables2
       django-taggit
+      djangorestframework
       drf-spectacular
       drf-spectacular-sidecar
+      dulwich
       jinja2
       markdown
       napalm
@@ -50,6 +45,7 @@ python3.pkgs.buildPythonApplication rec {
       pynetbox
       pyyaml
       requests
+      social-auth-app-django
       tzdata
     ]
     ++ plugins python3.pkgs;

pkgs/by-name/re/redlib/package.nix

@@ -6,18 +6,19 @@
   fetchFromGitHub,
   nix-update-script,
 }:
-rustPlatform.buildRustPackage rec {
+
+rustPlatform.buildRustPackage {
   pname = "redlib";
-  version = "0.36.0";
+  version = "0.36.0-unstable-2025-07-21";
 
   src = fetchFromGitHub {
     owner = "redlib-org";
     repo = "redlib";
-    tag = "v${version}";
-    hash = "sha256-a+FFQqKXYws8b/iGr49eZMVmKBqacQGvW8P51ybtBSc=";
+    rev = "3e67694e2b9a4012b259264af5f2b81807dbadf0";
+    hash = "sha256-vFK9DiVANbTKi19DCWdRG8gKKwcyoAcLa1teXCZ9nfE=";
   };
 
-  cargoHash = "sha256-1zPLnkNZvuZS5z9AEJvhyIv+8/y+YhqFcj5Mu7RSqnE=";
+  cargoHash = "sha256-FDeENHY6bwwCq6leSoIuCqPI6PCHpEod7KN2grS2gFw=";
 
   postInstall = ''
     install -D contrib/redlib.service $out/lib/systemd/system/redlib.service
@@ -67,7 +68,6 @@ rustPlatform.buildRustPackage rec {
   };
 
   meta = {
-    changelog = "https://github.com/redlib-org/redlib/releases/tag/v${version}";
     description = "Private front-end for Reddit (Continued fork of Libreddit)";
     homepage = "https://github.com/redlib-org/redlib";
     license = lib.licenses.agpl3Only;

pkgs/by-name/sa/samfirm-js/package.nix

@@ -0,0 +1,34 @@
+{
+  lib,
+  buildNpmPackage,
+  fetchFromGitHub,
+}:
+
+buildNpmPackage rec {
+  pname = "samfirm-js";
+  version = "0.3.0-unstable-2023-12-27";
+
+  src = fetchFromGitHub {
+    owner = "DavidArsene";
+    repo = "samfirm.js";
+    rev = "5e2537c2452c3033259a1e4399d9bb755e99f1da";
+    hash = "sha256-81nWdIXJMXy5P37K9A3hAdLrYAEtqPJy7baM1Z22tzs=";
+  };
+
+  npmDepsHash = "sha256-os75tFpyxzxGpt5Era+K+zgMJyfwD4u0AtTRLC/fPUQ=";
+
+  installPhase = ''
+    runHook preInstall
+    install -Dm555 dist/index.js $out/bin/samfirm-js
+    runHook postInstall
+  '';
+
+  meta = {
+    description = "Program for downloading Samsung firmware";
+    homepage = "https://github.com/DavidArsene/samfirm.js";
+    license = lib.licenses.gpl3;
+    platforms = lib.platforms.linux;
+    maintainers = with lib.maintainers; [ ungeskriptet ];
+    mainProgram = "samfirm-js";
+  };
+}

pkgs/by-name/sn/snipe-it/package.nix

@@ -9,16 +9,16 @@
 
 php84.buildComposerProject2 (finalAttrs: {
   pname = "snipe-it";
-  version = "8.2.0";
+  version = "8.2.1";
 
   src = fetchFromGitHub {
     owner = "grokability";
     repo = "snipe-it";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-mXcc6wSDoO7z2xYUjwn6hU39OBmsZOw4JeZTpwZMMbI=";
+    hash = "sha256-l0FiZZbzY49y2Q5WcCZwJD8YlQbBrOXJkMo7fMlSHxg=";
   };
 
-  vendorHash = "sha256-84kllssopKRAC/Dws+5s6e61/O56B+Uy19jjIV8yLUo=";
+  vendorHash = "sha256-+FUEBZdGu+wC9LW2UWz1wM4PZnJdTAxZU0kRkCzgjJE=";
 
   postInstall = ''
     snipe_it_out="$out/share/php/snipe-it"

pkgs/by-name/sp/spotify-player/package.nix

@@ -49,16 +49,16 @@ assert lib.assertOneOf "withAudioBackend" withAudioBackend [
 
 rustPlatform.buildRustPackage rec {
   pname = "spotify-player";
-  version = "0.20.6";
+  version = "0.20.7";
 
   src = fetchFromGitHub {
     owner = "aome510";
     repo = "spotify-player";
     tag = "v${version}";
-    hash = "sha256-PYf8Ms0hmG4EWDjb+er6YvY/UFiQbIF6dtCL87O4rOs=";
+    hash = "sha256-g+SU6qDnafLiNOzZ75HUPgifuC8A+rb+KoqJoMHBJ04=";
   };
 
-  cargoHash = "sha256-ec4rIYZsIvYIezDm956aYSM75e/GEoNilVjm40691Ys=";
+  cargoHash = "sha256-rwWSKJMI/4fY60m+vGqTqrTijJN6d0PfQH417Ku9+0E=";
 
   nativeBuildInputs = [
     pkg-config

pkgs/by-name/ti/tinystatus/package.nix

@@ -1,56 +1,58 @@
 {
   lib,
   stdenvNoCC,
-  makeWrapper,
-  netcat,
-  curl,
-  unixtools,
-  coreutils,
-  mktemp,
-  findutils,
-  gnugrep,
   fetchFromGitHub,
+  makeBinaryWrapper,
+  coreutils,
+  curl,
+  findutils,
   gawk,
+  gnugrep,
   gnused,
+  mktemp,
+  netcat,
+  unixtools,
 }:
 
-stdenvNoCC.mkDerivation rec {
+stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "tinystatus";
-  version = "0-unstable-2021-07-09";
+  version = "0-unstable-2025-03-27";
 
   src = fetchFromGitHub {
     owner = "bderenzo";
     repo = "tinystatus";
-    rev = "fc128adf240261ac99ea3e3be8d65a92eda52a73";
-    sha256 = "sha256-FvQwibm6F10l9/U3RnNTGu+C2JjHOwbv62VxXAfI7/s=";
+    rev = "169ee0bb2efe4531080936d1e2a46e451feebe3e";
+    hash = "sha256-nPrABKKIDP1n1rhcojFJJ15kqa5b4s7F/wMAgD/eVBw=";
   };
 
-  nativeBuildInputs = [ makeWrapper ];
-
-  runtimeInputs = [
-    curl
-    netcat
-    unixtools.ping
-    coreutils
-    mktemp
-    findutils
-    gnugrep
-    gawk
-    gnused
-  ];
+  nativeBuildInputs = [ makeBinaryWrapper ];
 
   installPhase = ''
     runHook preInstall
-    install -Dm555 tinystatus $out/bin/tinystatus
+
+    install -Dm755 tinystatus $out/bin/tinystatus
     wrapProgram $out/bin/tinystatus \
-      --set PATH "${lib.makeBinPath runtimeInputs}"
+      --set PATH "${
+        lib.makeBinPath [
+          coreutils
+          curl
+          findutils
+          gawk
+          gnugrep
+          gnused
+          mktemp
+          netcat
+          unixtools.ping
+        ]
+      }"
+
     runHook postInstall
   '';
 
   doInstallCheck = true;
 
   installCheckPhase = ''
-    runHook preCheck
+    runHook preInstallCheck
 
     cat <<EOF >test.csv
     ping, 0, testing, this.should.fail.example.com
@@ -58,15 +60,15 @@ stdenvNoCC.mkDerivation rec {
 
     $out/bin/tinystatus test.csv | grep Disrupted
 
-    runHook postCheck
+    runHook postInstallCheck
   '';
 
-  meta = with lib; {
+  meta = {
     description = "Static HTML status page generator written in pure shell";
     mainProgram = "tinystatus";
     homepage = "https://github.com/bderenzo/tinystatus";
-    license = licenses.mit;
-    platforms = platforms.unix;
-    maintainers = with maintainers; [ matthewcroughan ];
+    license = lib.licenses.mit;
+    platforms = lib.platforms.unix;
+    maintainers = with lib.maintainers; [ matthewcroughan ];
   };
-}
+})

pkgs/by-name/we/webfont-bundler/package.nix

@@ -21,14 +21,14 @@
   wrapGAppsHook4,
 }:
 stdenv.mkDerivation (finalAttrs: {
-  pname = "webfont-kit-generator";
-  version = "1.2.0";
+  pname = "webfont-bundler";
+  version = "1.3.0";
 
   src = fetchFromGitHub {
     owner = "rafaelmardojai";
     repo = "webfont-kit-generator";
-    rev = finalAttrs.version;
-    hash = "sha256-ZfyF1Didce88/HaLeMNTw0nGzj3EZnC7V9OzsN21L40=";
+    tag = finalAttrs.version;
+    hash = "sha256-5TFsUSY6pJc/OwOklw5YocrleL9nzxKMVS1Bt6LPI/Q=";
   };
 
   nativeBuildInputs = [
@@ -69,9 +69,11 @@ stdenv.mkDerivation (finalAttrs: {
   };
 
   meta = with lib; {
-    description = "Webfont Kit Generator is a simple utility that allows you to generate woff, woff2 and the necessary CSS boilerplate from non-web font formats (otf & ttf)";
+    description = "Create @font-face kits easily";
+    longDescription = "Webfont Bundler is a simple utility that allows you to generate woff, woff2 and the necessary CSS boilerplate from non-web font formats (otf and ttf).";
+    changelog = "https://github.com/rafaelmardojai/webfont-kit-generator/releases/tag/${finalAttrs.version}";
     mainProgram = "webfontkitgenerator";
-    homepage = "https://apps.gnome.org/app/com.rafaelmardojai.WebfontKitGenerator";
+    homepage = "https://apps.gnome.org/WebfontKitGenerator/";
     license = licenses.gpl3Plus;
     maintainers = with maintainers; [ benediktbroich ];
     teams = [ teams.gnome-circle ];

pkgs/development/lua-modules/generated-packages.nix

@@ -814,15 +814,15 @@ final: prev: {
     }:
     buildLuarocksPackage {
       pname = "fzf-lua";
-      version = "0.0.1948-1";
+      version = "0.0.2041-1";
       knownRockspec =
         (fetchurl {
-          url = "mirror://luarocks/fzf-lua-0.0.1948-1.rockspec";
-          sha256 = "1409hywqgs9y6vkrbwd1d5k1fw4a2qrls64npf7ky0wyag0srggb";
+          url = "mirror://luarocks/fzf-lua-0.0.2041-1.rockspec";
+          sha256 = "1n6q17q3if71z3cws6b6am5zlggf7hq887s17421i5lznn9psp0j";
         }).outPath;
       src = fetchzip {
-        url = "https://github.com/ibhagwan/fzf-lua/archive/3d4342120cf12f36b60a8161a8835b111ec5ec9a.zip";
-        sha256 = "189dp1yqidah2w9ilhghbx59h470f72iy5kkb1fz09527jn9yd5i";
+        url = "https://github.com/ibhagwan/fzf-lua/archive/cdfac04b264cd924173e7f63a00b4883e2b98564.zip";
+        sha256 = "1z3zj1vlrgd04dhjv172m342z4b37ji5b4hzp44js07bsf8d398y";
       };
 
       disabled = luaOlder "5.1";
@@ -903,15 +903,15 @@ final: prev: {
     }:
     buildLuarocksPackage {
       pname = "grug-far.nvim";
-      version = "1.6.42-1";
+      version = "1.6.43-1";
       knownRockspec =
         (fetchurl {
-          url = "mirror://luarocks/grug-far.nvim-1.6.42-1.rockspec";
-          sha256 = "0mypn7i1cbjz97mki1adsmdrjgzqd3v4rh49bjrfmkzv2n32sp1z";
+          url = "mirror://luarocks/grug-far.nvim-1.6.43-1.rockspec";
+          sha256 = "0q0g85pxdx81k99dd5j7w807v25b3lixff83shgd08dgvbsndh9q";
         }).outPath;
       src = fetchzip {
-        url = "https://github.com/MagicDuck/grug-far.nvim/archive/b3f9412b1ed76f14cfc68e1ee899873544330c80.zip";
-        sha256 = "1iifqvv6r6gmz0z1jdm290cm12zrv44cy4w758giyw0j4zlcbbhc";
+        url = "https://github.com/MagicDuck/grug-far.nvim/archive/45981a9af7f4e666a3cdaedb1d21d2ab926727a2.zip";
+        sha256 = "1ghszc3v70bdwkiklkis9vwp3qkxapgiz16xpnrjlgns7k5lrzf7";
       };
 
       disabled = luaOlder "5.1";
@@ -934,15 +934,15 @@ final: prev: {
     }:
     buildLuarocksPackage {
       pname = "haskell-tools.nvim";
-      version = "6.1.0-1";
+      version = "6.1.1-1";
       knownRockspec =
         (fetchurl {
-          url = "mirror://luarocks/haskell-tools.nvim-6.1.0-1.rockspec";
-          sha256 = "1190vp2vld871w9sqjx7iz4yhf666kgx20ranqpywicj7qsn74l4";
+          url = "mirror://luarocks/haskell-tools.nvim-6.1.1-1.rockspec";
+          sha256 = "1w0wvrpf5gh0r1bzss5bqdghv2wynps2cxgvbkp27kzj5kqrfhdx";
         }).outPath;
       src = fetchzip {
-        url = "https://github.com/mrcjkb/haskell-tools.nvim/archive/v6.1.0.zip";
-        sha256 = "1cq04jx7ds908gcca8np732figc0qljpcrnfcsmkgfjnmp1p3mqs";
+        url = "https://github.com/mrcjkb/haskell-tools.nvim/archive/v6.1.1.zip";
+        sha256 = "0pmmyfwj8as5l0l6hvr5n7n4nnsnpa6p1jj7w5j8jlk4h6c006kn";
       };
 
       disabled = luaOlder "5.1";
@@ -2950,17 +2950,17 @@ final: prev: {
     }:
     buildLuarocksPackage {
       pname = "luarocks";
-      version = "3.12.0";
+      version = "3.12.2-1";
       knownRockspec =
         (fetchurl {
-          url = "mirror://luarocks/luarocks-3.12.0-1.rockspec";
-          sha256 = "sha256-FaGp4yJkddh5EicGA5uKsD2UDR/XwOsKmxBPil67zs0=";
+          url = "mirror://luarocks/luarocks-3.12.2-1.rockspec";
+          sha256 = "1ak4w8hxl54yk2lj95l22xjrgw3cpla08s28aa160jrbk6vs5n44";
         }).outPath;
       src = fetchFromGitHub {
         owner = "luarocks";
         repo = "luarocks";
-        rev = "v3.12.0";
-        hash = "sha256-PGK4gjEhCJt2+0viNU0/qJBBOxPIy2swXplQOolmP2E=";
+        rev = "v3.12.2";
+        hash = "sha256-hQysstYGUcZnnEXL+9ECS0sBViYggeDIMgo6LpUexBA=";
       };
 
       meta = {
@@ -3246,17 +3246,17 @@ final: prev: {
     }:
     buildLuarocksPackage {
       pname = "luasystem";
-      version = "0.6.2-1";
+      version = "0.6.3-1";
       knownRockspec =
         (fetchurl {
-          url = "mirror://luarocks/luasystem-0.6.2-1.rockspec";
-          sha256 = "0s6vd8a35x156ccp9b95rzqgklmgvz3a2bcfp4g09vlyh2kqy1am";
+          url = "mirror://luarocks/luasystem-0.6.3-1.rockspec";
+          sha256 = "0zqmrrnvpvy0bmvdc26lgcabx525xq0xy1ysh91d74hdvnznn2jc";
         }).outPath;
       src = fetchFromGitHub {
         owner = "lunarmodules";
         repo = "luasystem";
-        rev = "v0.6.2";
-        hash = "sha256-EcKs8W8UAbyA5WCt75tGO2osNgFbL8SNUl78vKSy82o=";
+        rev = "v0.6.3";
+        hash = "sha256-8d2835/EcyDJX9yTn6MTfaZryjY1wkSP+IIIKGPDXMk=";
       };
 
       disabled = luaOlder "5.1";
@@ -3371,15 +3371,15 @@ final: prev: {
     }:
     buildLuarocksPackage {
       pname = "luautf8";
-      version = "0.1.6-1";
+      version = "0.1.7-1";
       knownRockspec =
         (fetchurl {
-          url = "mirror://luarocks/luautf8-0.1.6-1.rockspec";
-          sha256 = "0piqf7nxhkgawib8ymvqaw2jn0ksnw1ahcxxiry121r4cxq5i65h";
+          url = "mirror://luarocks/luautf8-0.1.7-1.rockspec";
+          sha256 = "0a06r8g2vnh2vzwghjiz7bwkl0x75q52skvylgz9c37i62swbwgl";
         }).outPath;
       src = fetchurl {
-        url = "https://github.com/starwing/luautf8/archive/refs/tags/0.1.6.tar.gz";
-        sha256 = "0mlnfsskbsjd6d643yb9i03r5135w5x8hrlaa00bv6mhmys76s5p";
+        url = "https://github.com/starwing/luautf8/archive/refs/tags/0.1.7.tar.gz";
+        sha256 = "1fqrka532hx97kj5iqnx4h5x5i2a319iv2b6zmifflmh6lya6mgw";
       };
 
       disabled = luaOlder "5.1";
@@ -3565,15 +3565,15 @@ final: prev: {
     }:
     buildLuarocksPackage {
       pname = "lz.n";
-      version = "2.11.2-1";
+      version = "2.11.3-1";
       knownRockspec =
         (fetchurl {
-          url = "mirror://luarocks/lz.n-2.11.2-1.rockspec";
-          sha256 = "0m0019k9asx8z82drj54cgzal0hzmdwzrm6vbknsgwhwlq5wwk6v";
+          url = "mirror://luarocks/lz.n-2.11.3-1.rockspec";
+          sha256 = "0fg256gwa7444fh7wivasi77x7qgxx4r3hjqw90qa1kav10np88n";
         }).outPath;
       src = fetchzip {
-        url = "https://github.com/nvim-neorocks/lz.n/archive/v2.11.2.zip";
-        sha256 = "0b4q1q083fiwfjmk44a15qd9rrb6hd92bim0q7xjdgm2j6ja8j73";
+        url = "https://github.com/nvim-neorocks/lz.n/archive/v2.11.3.zip";
+        sha256 = "0vnr1iiq4z3q7s3qylfmvcclmspydg8ll4p75jilcx9d114v7wwc";
       };
 
       disabled = luaOlder "5.1";
@@ -3981,15 +3981,15 @@ final: prev: {
     }:
     buildLuarocksPackage {
       pname = "neotest";
-      version = "5.8.0-1";
+      version = "5.9.1-1";
       knownRockspec =
         (fetchurl {
-          url = "mirror://luarocks/neotest-5.8.0-1.rockspec";
-          sha256 = "05gm5hpy5pralchkr0d3zfc5l7zs9qv6xflk9482rysfnkm7d3dh";
+          url = "mirror://luarocks/neotest-5.9.1-1.rockspec";
+          sha256 = "1q2589rjwbhhbxdf30n6kq1dmvlj27bn57rbv63s4x47qdzdnzfb";
         }).outPath;
       src = fetchzip {
-        url = "https://github.com/nvim-neotest/neotest/archive/d66cf4e05a116957f0d3a7755a24291c7d1e1f72.zip";
-        sha256 = "09bxarrrfnqvyv22ls6lm0y03ngcp6r372b8hy4rld902psdb11q";
+        url = "https://github.com/nvim-neotest/neotest/archive/3c81345c28cd639fcc02843ed3653be462f47024.zip";
+        sha256 = "1rqfxhy0c721hzz9azp1w403b8bccq6q24miynb42z4hc14qh8nm";
       };
 
       disabled = luaOlder "5.1";
@@ -4651,15 +4651,15 @@ final: prev: {
     }:
     buildLuarocksPackage {
       pname = "rustaceanvim";
-      version = "6.3.2-1";
+      version = "6.5.1-1";
       knownRockspec =
         (fetchurl {
-          url = "mirror://luarocks/rustaceanvim-6.3.2-1.rockspec";
-          sha256 = "0mvwhv3x3c5wmkxcqpm3slipfi8ns1p6wzfn0jhdwbgj5zmxa3br";
+          url = "mirror://luarocks/rustaceanvim-6.5.1-1.rockspec";
+          sha256 = "0rgj1k67aclpvxf7s5izlb2gki473kkkwws2rql6rz999gdcrny3";
         }).outPath;
       src = fetchzip {
-        url = "https://github.com/mrcjkb/rustaceanvim/archive/v6.3.2.zip";
-        sha256 = "1hs31xdawvs8ln4b7idmad2689rwlls480w0hvv8xkrl638wjbd5";
+        url = "https://github.com/mrcjkb/rustaceanvim/archive/v6.5.1.zip";
+        sha256 = "1q3p71jsc4ka4jp43pigcgknzpz2cgvcpvjczghz4xf5zcizfkgc";
       };
 
       disabled = luaOlder "5.1";
@@ -5033,17 +5033,17 @@ final: prev: {
     }:
     buildLuarocksPackage {
       pname = "tiktoken_core";
-      version = "0.2.3-1";
+      version = "0.2.4-1";
       knownRockspec =
         (fetchurl {
-          url = "mirror://luarocks/tiktoken_core-0.2.3-1.rockspec";
-          sha256 = "0xwsjirxr5y6famhhwc170py6lsxhfsy1r3sviwfwz22cj51frx7";
+          url = "mirror://luarocks/tiktoken_core-0.2.4-1.rockspec";
+          sha256 = "028zmsgad88hnq7h2r8r2c364dsayh0ga1wpbv9dfqx2l3k0wqvd";
         }).outPath;
       src = fetchFromGitHub {
         owner = "gptlang";
         repo = "lua-tiktoken";
-        rev = "v0.2.3";
-        hash = "sha256-Se/V2+X1Fddie3W1OYrEJt9Jn8ZqmiYbByu8H1OvECA=";
+        rev = "v0.2.4";
+        hash = "sha256-B2oGoMOab80SJbYqs8gVCQxiLZ+5GIZ9fMgMN/sl1CA=";
       };
 
       disabled = luaOlder "5.1";
@@ -5069,17 +5069,17 @@ final: prev: {
     }:
     buildLuarocksPackage {
       pname = "tl";
-      version = "0.24.6-1";
+      version = "0.24.7-1";
       knownRockspec =
         (fetchurl {
-          url = "mirror://luarocks/tl-0.24.6-1.rockspec";
-          sha256 = "1g5k9hgc6hc85l4q1s1cvnlrnc1awl28cxbrl8ld07drvaksjnqd";
+          url = "mirror://luarocks/tl-0.24.7-1.rockspec";
+          sha256 = "0c2xfrw2wasiy3g8b6fpqvlnzb0bp5l9s3pvi9ky1w4b6nbc81s7";
         }).outPath;
       src = fetchFromGitHub {
         owner = "teal-language";
         repo = "tl";
-        rev = "v0.24.6";
-        hash = "sha256-ct2EjEqmEBImKXuKCWiTve++s1rARHIIuuf95Zg+9G0=";
+        rev = "v0.24.7";
+        hash = "sha256-5saLQczm/3jRXmhHUyasGKMH95ft96+CMHkVeI7ip3A=";
       };
 
       propagatedBuildInputs = [

pkgs/development/lua-modules/overrides.nix

@@ -59,6 +59,7 @@
   zziplib,
   writableTmpDirAsHomeHook,
   gitMinimal,
+  getopt,
 }:
 
 final: prev:
@@ -157,6 +158,7 @@ in
     checkInputs = [
       fd
       fzf
+      getopt
       ripgrep
     ];
     nativeCheckInputs = [
@@ -174,18 +176,14 @@ in
 
       # TODO: remove with new nvim-web-devicons release
       # Disabled devicons test because we have old version as dep and fzf-lua checks for a new icon
-      substituteInPlace tests/file/ui_spec.lua \
+      substituteInPlace tests/files_spec.lua \
         --replace-fail \
-          "T[\"files()\"][\"icons\"] = new_set({ parametrize = { { \"devicons\" }, { \"mini\" } } })" \
-          "T[\"files()\"][\"icons\"] = new_set({ parametrize = { { \"mini\" } } })"
+          "T[\"files\"][\"icons\"] = new_set({ parametrize = { { \"devicons\" }, { \"mini\" } } })" \
+          "T[\"files\"][\"icons\"] = new_set({ parametrize = { { \"mini\" } } })"
 
       # TODO: Figure out why 2 files extra
-      substituteInPlace tests/screenshots/tests-file-ui_spec.lua---files\(\)---executable---1-+-args-{-\'fd\'-} \
-        --replace-fail "112" "114"
-
-      # TODO: Figure out why 2 files extra
-      substituteInPlace tests/screenshots/tests-file-ui_spec.lua---files\(\)---preview-should-work-after-chdir-#1864 \
-        --replace-fail "111" "113"
+      substituteInPlace tests/screenshots/tests-files_spec.lua---files---executable---1-+-args-{-\'fd\'-} \
+        --replace-fail "96" "98"
 
       make test
 
@@ -1060,7 +1058,7 @@ in
   tiktoken_core = prev.tiktoken_core.overrideAttrs (oa: {
     cargoDeps = rustPlatform.fetchCargoVendor {
       src = oa.src;
-      hash = "sha256-sO2q4cmkJc6T4iyJUWpBfr2ISycS1cXAIO0ibMfzyIE=";
+      hash = "sha256-egmb4BTbORpTpVO50IcqbZU1Y0hioXLMkxxUAo05TIA=";
     };
     nativeBuildInputs = oa.nativeBuildInputs ++ [
       cargo

pkgs/development/python-modules/buildstream-plugins/default.nix

@@ -0,0 +1,39 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  setuptools,
+  cython,
+}:
+
+buildPythonPackage rec {
+  pname = "buildstream-plugins";
+  version = "2.4.0";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "apache";
+    repo = "buildstream-plugins";
+    tag = version;
+    hash = "sha256-VAHDMy4DvNneWP1jhrIZzogZ5Gz5PS/GcFpOg2cGYvs=";
+  };
+
+  build-system = [
+    cython
+    setuptools
+  ];
+
+  # Do not run pyTest, causes infinite recursion as `buildstream-plugins`
+  # depends on `Buildstream`, and vice-versa for tests.
+  # May be fixable by skipping certain tests? TODO.
+
+  pythonImportsCheck = [ "buildstream_plugins" ];
+
+  meta = {
+    description = "BuildStream plugins";
+    homepage = "https://github.com/apache/buildstream-plugins";
+    platforms = lib.platforms.linux;
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ shymega ];
+  };
+}

pkgs/development/python-modules/coffea/default.nix

@@ -41,14 +41,14 @@
 
 buildPythonPackage rec {
   pname = "coffea";
-  version = "2025.7.2";
+  version = "2025.7.3";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "CoffeaTeam";
     repo = "coffea";
     tag = "v${version}";
-    hash = "sha256-MSCJRjw4bbQQAA39fOQAJ9qfRXO/hUrLeXZMRVGd2Zc=";
+    hash = "sha256-lCrmWcVzu8Ls0a+r2D1DMZ/Ysq3H9bPj13XOmAS1M5I=";
   };
 
   build-system = [

pkgs/development/python-modules/django-markup/default.nix

@@ -27,7 +27,7 @@
 
 buildPythonPackage rec {
   pname = "django-markup";
-  version = "1.9.1";
+  version = "1.10";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -36,7 +36,7 @@ buildPythonPackage rec {
     owner = "bartTC";
     repo = "django-markup";
     tag = "v${version}";
-    hash = "sha256-dj5Z36W4Stly203SKWpR/DF+Wf7+ejbZnDCmHNRb3c0=";
+    hash = "sha256-LcEbN5/LbY3xWellBVK2Kfvt/XLzRJjGWcEk8h722Og=";
   };
 
   build-system = [ poetry-core ];
@@ -76,7 +76,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "Generic Django application to convert text with specific markup to html";
     homepage = "https://github.com/bartTC/django-markup";
-    changelog = "https://github.com/bartTC/django-markup/blob/v${version}/CHANGELOG.md";
+    changelog = "https://github.com/bartTC/django-markup/blob/${src.tag}/CHANGELOG.md";
     license = licenses.mit;
     maintainers = with maintainers; [ hexa ];
   };

pkgs/development/python-modules/gftools/default.nix

@@ -62,14 +62,14 @@ let
 in
 buildPythonPackage rec {
   pname = "gftools";
-  version = "0.9.86";
+  version = "0.9.87";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "googlefonts";
     repo = "gftools";
     tag = "v${version}";
-    hash = "sha256-4N27R+rbPSnxg701OGtrD7/iwTaUBdhp528+9n4ZIt8=";
+    hash = "sha256-xHgF4+wyoM3IAehdtIaDNpx7HpfwKDt0CVYGUvMKvDY=";
   };
 
   postPatch = ''

pkgs/development/python-modules/knx-frontend/default.nix

@@ -7,14 +7,14 @@
 
 buildPythonPackage rec {
   pname = "knx-frontend";
-  version = "2025.6.13.181749";
+  version = "2025.7.23.50952";
   pyproject = true;
 
   # TODO: source build, uses yarn.lock
   src = fetchPypi {
     pname = "knx_frontend";
     inherit version;
-    hash = "sha256-ERSVE88D9Hw1Ixh3f2cfP4fq54clam1KKvG2Hj/Hizk=";
+    hash = "sha256-LcYUXJ5K9jl3h7Jbdi/zVVZEMKcQiMz7O+IpBvgvqV0=";
   };
 
   build-system = [ setuptools ];

pkgs/development/python-modules/pygame-sdl2/default.nix

@@ -15,14 +15,14 @@
 
 buildPythonPackage rec {
   pname = "pygame-sdl2";
-  version = "8.3.7.25031702";
+  version = "8.4.0.25071206";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "renpy";
     repo = "pygame_sdl2";
     tag = "renpy-${version}";
-    hash = "sha256-7MoQpCkBd20qck7eycs/MX0sjj4XRIrZmYPkKhuct6w=";
+    hash = "sha256-I4zk19aNfVZstkVDLkwI/TBXliGAqVmOjeQLbRFri8Y=";
   };
 
   build-system = [

pkgs/development/python-modules/pyopencl/default.nix

@@ -30,7 +30,7 @@
 
 buildPythonPackage rec {
   pname = "pyopencl";
-  version = "2025.2.5";
+  version = "2025.2.6";
   pyproject = true;
 
   src = fetchFromGitHub {
@@ -38,7 +38,7 @@ buildPythonPackage rec {
     repo = "pyopencl";
     tag = "v${version}";
     fetchSubmodules = true;
-    hash = "sha256-VmnCMaq6op/7M+n1U9mPgRpCyZtkgmzMXQuWW6Clbd4=";
+    hash = "sha256-ofAyBaD/iMm2+2PFGVTEzg/kaPmcwlvLPAihRE+JlJg=";
   };
 
   build-system = [

pkgs/development/python-modules/tenant-schemas-celery/default.nix

@@ -8,14 +8,14 @@
 
 buildPythonPackage rec {
   pname = "tenant-schemas-celery";
-  version = "4.0.1";
+  version = "4.0.2";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "maciej-gol";
     repo = "tenant-schemas-celery";
     tag = version;
-    hash = "sha256-rGLrP8rE9SACMDVpNeBU85U/Sb2lNhsgEgHJhAsdKNM=";
+    hash = "sha256-HJBSUS75Zk/b1i4QTaAOFO34Pstg5tEpeNBiTADpN+I=";
   };
 
   build-system = [ setuptools ];

pkgs/development/tcl-modules/by-name/tk/tkimg/package.nix

@@ -34,5 +34,6 @@ tcl.mkTclDerivation rec {
     maintainers = with lib.maintainers; [ matthewcroughan ];
     license = lib.licenses.bsd3;
     platforms = lib.platforms.unix;
+    badPlatforms = lib.platforms.darwin;
   };
 }

pkgs/development/tools/misc/linuxkit/default.nix

@@ -11,13 +11,13 @@
 
 buildGoModule rec {
   pname = "linuxkit";
-  version = "1.7.0";
+  version = "1.7.1";
 
   src = fetchFromGitHub {
     owner = "linuxkit";
     repo = "linuxkit";
     rev = "v${version}";
-    sha256 = "sha256-G9Ao87sRbMcxB7VDvMaOPYCQg4l7EMEM2Mm9wl/N/5s=";
+    sha256 = "sha256-YOREG9BDJpXa4JhQj2vSxuI+FnVoL9CEcefBIHz+0QY=";
   };
 
   vendorHash = null;

pkgs/games/sgt-puzzles/default.nix

@@ -18,11 +18,11 @@
 
 stdenv.mkDerivation rec {
   pname = "sgt-puzzles";
-  version = "20250714.880288c";
+  version = "20250722.dbe6378";
 
   src = fetchurl {
     url = "http://www.chiark.greenend.org.uk/~sgtatham/puzzles/puzzles-${version}.tar.gz";
-    hash = "sha256-Ml25epg2ir0NqgPCQWpJnfqZU3w0p4pZCHC2esul1Cw=";
+    hash = "sha256-ayNBRAAIForVZgHQJ1fr3m1aZ3bG9YNQxHTeO0YcwTA=";
   };
 
   sgt-puzzles-menu = fetchurl {

pkgs/os-specific/linux/kernel/xanmod-kernels.nix

@@ -14,12 +14,12 @@ let
   # kernel config in the xanmod version commit
   variants = {
     lts = {
-      version = "6.12.39";
-      hash = "sha256-yv8CtqqxJiiRjnZJrsqRw/q6B9JnS5nmnYlqTYWN6Kc=";
+      version = "6.12.40";
+      hash = "sha256-L8wL47kD+lrnJsrp0B1MZ2Lg8zs+m1vQ24gPGuvxIA0=";
     };
     main = {
-      version = "6.15.7";
-      hash = "sha256-YMDjtoGz/PQKmbB2umI+5mODP4A1NqzVusc9kg2zGzA=";
+      version = "6.15.8";
+      hash = "sha256-P4DpTS0RhvsgBrNDsZMiA1NvCQucuPmJ4GDyF9mZ7ZU=";
     };
   };
 

pkgs/servers/home-assistant/custom-lovelace-modules/sankey-chart/package.nix

@@ -6,16 +6,16 @@
 
 buildNpmPackage rec {
   pname = "sankey-chart";
-  version = "3.9.3";
+  version = "3.9.4";
 
   src = fetchFromGitHub {
     owner = "MindFreeze";
     repo = "ha-sankey-chart";
     rev = "v${version}";
-    hash = "sha256-qOUzMi2anKc5sQqy9xvA/ISg0NPuPXQqzjqaPbyiYvY=";
+    hash = "sha256-5G/ji9vt4QIs+zyfdBZwgHTjCDTyX68N0lqfIMVMTN0=";
   };
 
-  npmDepsHash = "sha256-mz682Ine+YQHxS/Hni6namkohOsGhVhFZi7lsKMHOnc=";
+  npmDepsHash = "sha256-jlnGmdwQu1AZTDVrH7njgq5/UorDceUhJtFqzo/xLfc=";
 
   installPhase = ''
     runHook preInstall

pkgs/tools/package-management/lix/default.nix

@@ -9,6 +9,7 @@
   fetchgit,
   fetchFromGitHub,
   fetchFromGitea,
+  fetchpatch2,
   rustPlatform,
   editline,
   ncurses,
@@ -168,6 +169,15 @@ lib.makeExtensible (self: {
         hash = "sha256-b5d+HnPcyHz0ZJW1+LZl4qm4LGTB/TiaDFQVlVL2xpE=";
       };
 
+      patches = [
+        # Support for lowdown >= 1.4, https://gerrit.lix.systems/c/lix/+/3731
+        (fetchpatch2 {
+          name = "lix-2.91-lowdown-1.4.0.patch";
+          url = "https://git.lix.systems/lix-project/lix/commit/ecff59d77371b21fef229c33ebb629bc49a8fad5.patch";
+          sha256 = "sha256-2M5oId5kObwzpw67rddAPI2RbWPEVlGBrMUXZWqqmEo=";
+        })
+      ];
+
       docCargoDeps = rustPlatform.fetchCargoVendor {
         name = "lix-doc-${version}";
         inherit src;
@@ -200,6 +210,15 @@ lib.makeExtensible (self: {
         hash = "sha256-iP2iUDxA99RcgQyZROs7bQw8pqxa1vFudRqjAIHg9Iw=";
       };
 
+      patches = [
+        # Support for lowdown >= 1.4, https://gerrit.lix.systems/c/lix/+/3731
+        (fetchpatch2 {
+          name = "lix-lowdown-1.4.0.patch";
+          url = "https://git.lix.systems/lix-project/lix/commit/858de5f47a1bfd33835ec97794ece339a88490f1.patch";
+          hash = "sha256-FfLO2dFSWV1qwcupIg8dYEhCHir2XX6/Hs89eLwd+SY=";
+        })
+      ];
+
       cargoDeps = rustPlatform.fetchCargoVendor {
         name = "lix-${version}";
         inherit src;
@@ -231,6 +250,15 @@ lib.makeExtensible (self: {
         hash = "sha256-Oqw04eboDM8rrUgAXiT7w5F2uGrQdt8sGX+Mk6mVXZQ=";
       };
 
+      patches = [
+        # Support for lowdown >= 1.4, https://gerrit.lix.systems/c/lix/+/3731
+        (fetchpatch2 {
+          name = "lix-lowdown-1.4.0.patch";
+          url = "https://git.lix.systems/lix-project/lix/commit/858de5f47a1bfd33835ec97794ece339a88490f1.patch";
+          hash = "sha256-FfLO2dFSWV1qwcupIg8dYEhCHir2XX6/Hs89eLwd+SY=";
+        })
+      ];
+
       cargoDeps = rustPlatform.fetchCargoVendor {
         name = "lix-${version}";
         inherit src;

pkgs/tools/package-management/nix/common-autoconf.nix

@@ -254,6 +254,14 @@ let
       "--enable-lto"
     ];
 
+    env.CXXFLAGS = toString (
+      lib.optionals (lib.versionAtLeast lowdown.version "1.4.0") [
+        # Autotools based build system wasn't updated with the backport of
+        # https://github.com/NixOS/nix/pull/12115, so set the define explicitly.
+        "-DHAVE_LOWDOWN_1_4"
+      ]
+    );
+
     makeFlags = [
       # gcc runs multi-threaded LTO using make and does not yet detect the new fifo:/path style
       # of make jobserver. until gcc adds support for this we have to instruct make to use this

pkgs/top-level/aliases.nix

@@ -2142,6 +2142,7 @@ mapAliases {
   ''; # Add 2023-07-29
   waypoint = throw "waypoint has been removed from nixpkgs as the upstream project was archived"; # Added 2024-04-24
   wcurl = throw "'wcurl' has been removed due to being bundled with 'curl'"; # Added 2025-07-04
+  webfontkitgenerator = webfont-bundler; # Added 2025-07-27
   webkitgtk = throw "'webkitgtk' attribute has been removed from nixpkgs, use attribute with ABI version set explicitly"; # Added 2025-06-11
   webmetro = throw "'webmetro' has been removed due to lack of upstream maintenance"; # Added 2025-01-25
   wg-bond = throw "'wg-bond' has been removed due to lack of upstream maintenance"; # Added 2025-01-25

pkgs/top-level/python-packages.nix

@@ -2170,6 +2170,8 @@ self: super: with self; {
 
   buildcatrust = callPackage ../development/python-modules/buildcatrust { };
 
+  buildstream-plugins = callPackage ../development/python-modules/buildstream-plugins { };
+
   bump-my-version = callPackage ../development/python-modules/bump-my-version { };
 
   bump2version = callPackage ../development/python-modules/bump2version { };