Merge master into staging-nixos

maintainers/maintainer-list.nix

@@ -3444,12 +3444,6 @@
     githubId = 20448408;
     keys = [ { fingerprint = "D446 E58D 87A0 31C7 EC15  88D7 B461 2924 45C6 E696"; } ];
   };
-  berce = {
-    email = "bert.moens@gmail.com";
-    github = "berce";
-    githubId = 10439709;
-    name = "Bert Moens";
-  };
   bergey = {
     email = "bergey@teallabs.org";
     github = "bergey";
@@ -4445,12 +4439,6 @@
     githubId = 54632731;
     name = "Cameron Dugan";
   };
-  cameronfyfe = {
-    email = "cameron.j.fyfe@gmail.com";
-    github = "cameronfyfe";
-    githubId = 21013281;
-    name = "Cameron Fyfe";
-  };
   cameronnemo = {
     email = "cnemo@tutanota.com";
     github = "CameronNemo";
@@ -18478,13 +18466,6 @@
     github = "mohe2015";
     githubId = 13287984;
   };
-  momeemt = {
-    name = "Mutsuha Asada";
-    email = "me@momee.mt";
-    github = "momeemt";
-    githubId = 43488453;
-    keys = [ { fingerprint = "D94F EA9F 5B08 F6A1 7B8F  EB8B ACB5 4F0C BC6A A7C6"; } ];
-  };
   monaaraj = {
     name = "Mon Aaraj";
     email = "owo69uwu69@gmail.com";
@@ -28968,6 +28949,14 @@
     githubId = 110242808;
     name = "Vasilii Pustovoit";
   };
+  vavakado = {
+    email = "xor@vavakado.xyz";
+    github = "vavakado";
+    githubId = 80159210;
+    name = "Vladimir Rubin";
+    matrix = "@vavakado:imagisphe.re";
+    keys = [ { fingerprint = "A054 0374 CD37 2C71 FE6D  E0CF CAB7 4472 7F36 B524"; } ];
+  };
   vbgl = {
     email = "Vincent.Laporte@gmail.com";
     github = "vbgl";

nixos/modules/services/audio/music-assistant.nix

@@ -83,7 +83,18 @@ in
         lib.optional cfg.enable 8097 # Music Assistant stream port
         ++ lib.optional (lib.elem "airplay" cfg.providers) 7000
         ++ lib.optional (lib.elem "sendspin" cfg.providers) 8927
-        ++ lib.optional (lib.elem "snapcast" cfg.providers) 1780;
+        ++ lib.optional (lib.elem "snapcast" cfg.providers) 1780
+        ++ lib.optionals (lib.elem "squeezelite" cfg.providers) [
+          # https://lyrion.org/reference/slimproto-protocol/
+          3483 # Slimproto control
+          # https://lyrion.org/reference/cli/using-the-cli/
+          9000 # Slimproto JSON-RPC
+          9090 # Slimproto CLI
+        ];
+      allowedUDPPorts = lib.optionals (lib.elem "squeezelite" cfg.providers) [
+        # https://lyrion.org/reference/slimproto-protocol/
+        3483 # Slimproto discovery
+      ];
       # The information published by Apple 1 seem to not apply to libraop.
       # The closest we could find that represents the port range being used as observed by tcpdump is the ephemeral port range.
       # 1: https://support.apple.com/en-us/103229#:~:text=49152%E2%80%93-,65535,-TCP%2C%20UDP

nixos/modules/services/networking/xrdp.nix

@@ -19,7 +19,7 @@ let
     cat > $out/startwm.sh <<EOF
     #!/bin/sh
     . /etc/profile
-    ${lib.optionalString cfg.audio.enable "${cfg.audio.package}/libexec/pulsaudio-xrdp-module/pulseaudio_xrdp_init"}
+    ${lib.optionalString cfg.audio.enable "${cfg.audio.package}/libexec/pulseaudio-xrdp-module/pulseaudio_xrdp_init"}
     ${cfg.defaultWindowManager}
     EOF
     chmod +x $out/startwm.sh

nixos/modules/services/scheduling/scx-loader.nix

@@ -75,7 +75,11 @@ in
       }
     ];
 
-    environment.systemPackages = [ cfg.package ] ++ cfg.schedsPackages;
+    environment = {
+      systemPackages = [ cfg.package ] ++ cfg.schedsPackages;
+      etc."scx_loader.toml".source = configFile;
+    };
+
     systemd.packages = [ cfg.package ];
     services.dbus.packages = [ cfg.package ];
 
@@ -84,10 +88,6 @@ in
     systemd.services.scx_loader = {
       path = cfg.schedsPackages;
       wantedBy = [ "multi-user.target" ];
-      serviceConfig = {
-        TemporaryFileSystem = [ "/etc" ];
-        BindReadOnlyPaths = [ "${configFile.outPath}:/etc/scx_loader.toml" ];
-      };
     };
   };
 

nixos/modules/services/web-apps/pretalx.nix

@@ -27,6 +27,28 @@ let
         cfg.settings.database.backend == "postgresql"
       ) finalPackage.optional-dependencies.postgres;
   };
+
+  pretalxManageWrapper = pkgs.writeShellApplication {
+    name = "pretalx-manage";
+    runtimeInputs = with pkgs; [
+      util-linux
+    ];
+    text = ''
+      cd ${cfg.settings.filesystem.data}
+      set -a
+      ${lib.concatMapStringsSep "\n" (file: ''
+        . ${lib.escapeShellArg file}
+      '') cfg.environmentFiles}
+      set +a
+      export PRETALX_CONFIG_FILE=${configFile}
+      exec runuser ${
+        lib.cli.toCommandLineShellGNU { } {
+          inherit (cfg) user;
+          preserve-environment = true;
+        }
+      } -- ${lib.getExe' pythonEnv "pretalx-manage"} "$@"
+    '';
+  };
 in
 
 {
@@ -325,18 +347,7 @@ in
     # https://docs.pretalx.org/administrator/installation/
 
     environment.systemPackages = [
-      (pkgs.writeScriptBin "pretalx-manage" ''
-        cd ${cfg.settings.filesystem.data}
-        sudo=exec
-        if [[ "$USER" != ${cfg.user} ]]; then
-          sudo='exec /run/wrappers/bin/sudo -u ${cfg.user} --preserve-env=PRETALX_CONFIG_FILE'
-        fi
-        set -a
-        ${lib.concatMapStringsSep "\n" (file: ". ${lib.escapeShellArg file}") cfg.environmentFiles}
-        set +a
-        export PRETALX_CONFIG_FILE=${configFile}
-        $sudo ${lib.getExe' pythonEnv "pretalx-manage"} "$@"
-      '')
+      pretalxManageWrapper
     ];
 
     services.logrotate.settings.pretalx = {

nixos/modules/services/web-apps/pretix.nix

@@ -24,7 +24,6 @@ let
     mkOption
     mkPackageOption
     optionals
-    optionalString
     recursiveUpdate
     types
     ;
@@ -60,6 +59,24 @@ let
   };
 
   withRedis = cfg.settings.redis.location != null;
+
+  pretixManageWrapper = pkgs.writeShellApplication {
+    name = "pretix-manage";
+    runtimeInputs = with pkgs; [
+      util-linux
+    ];
+    text = ''
+      cd ${cfg.settings.pretix.datadir}
+      export PRETIX_CONFIG_FILE=${configFile}
+      exec runuser ${
+        lib.cli.toCommandLineShellGNU { } {
+          inherit (cfg) user;
+          supp-group = if withRedis then config.services.redis.servers.pretix.group else null;
+          whitelist-environment = "PRETIX_CONFIG_FILE";
+        }
+      } -- ${getExe' pythonEnv "pretix-manage"} "$@"
+    '';
+  };
 in
 {
   meta = {
@@ -396,15 +413,7 @@ in
     # https://docs.pretix.eu/en/latest/admin/installation/index.html
 
     environment.systemPackages = [
-      (pkgs.writeScriptBin "pretix-manage" ''
-        cd ${cfg.settings.pretix.datadir}
-        sudo=exec
-        if [[ "$USER" != ${cfg.user} ]]; then
-          sudo='exec /run/wrappers/bin/sudo -u ${cfg.user} ${optionalString withRedis "-g redis-pretix"} --preserve-env=PRETIX_CONFIG_FILE'
-        fi
-        export PRETIX_CONFIG_FILE=${configFile}
-        $sudo ${getExe' pythonEnv "pretix-manage"} "$@"
-      '')
+      pretixManageWrapper
     ];
 
     services.logrotate.settings.pretix = {

nixos/tests/kea.nix

@@ -6,7 +6,6 @@
 # address.
 
 {
-  pkgs,
   lib,
   ...
 }:
@@ -15,7 +14,7 @@
 
   name = "kea";
 
-  nodes = {
+  containers = {
     router =
       { config, pkgs, ... }:
       {
@@ -26,6 +25,7 @@
           firewall.allowedUDPPorts = [ 67 ];
         };
 
+        services.resolved.enable = false;
         systemd.network = {
           enable = true;
           networks = {
@@ -141,6 +141,7 @@
           firewall.allowedUDPPorts = [ 53 ];
         };
 
+        services.resolved.enable = false;
         systemd.network = {
           enable = true;
           networks = {
@@ -153,8 +154,6 @@
           };
         };
 
-        services.resolved.enable = false;
-
         # Set up an authoritative nameserver, serving the `lan.nixos.test`
         # zone and configure an ACL that allows dynamic updates from
         # the router's ip address.
@@ -213,6 +212,7 @@
       {
         virtualisation.vlans = [ 1 ];
         systemd.services.systemd-networkd.environment.SYSTEMD_LOG_LEVEL = "debug";
+        services.resolved.enable = false;
         networking = {
           useNetworkd = true;
           useDHCP = false;
@@ -222,16 +222,23 @@
       };
   };
   testScript =
-    { ... }:
+    # python
     ''
       start_all()
+
       router.wait_for_unit("kea-dhcp4-server.service")
-      client.systemctl("start systemd-networkd-wait-online.service")
-      client.wait_for_unit("systemd-networkd-wait-online.service")
-      client.wait_until_succeeds("ping -c 5 10.0.0.1")
-      router.wait_until_succeeds("ping -c 5 10.0.0.3")
-      nameserver.wait_until_succeeds("kdig +short client.lan.nixos.test @10.0.0.2 | grep -q 10.0.0.3")
-      router.log(router.execute("curl 127.0.0.1:9547")[1])
-      router.succeed("curl --no-buffer 127.0.0.1:9547 | grep -qE '^kea_dhcp4_addresses_assigned_total.*1.0$'")
+
+      with subtest("DHCPv4"):
+          client.systemctl("start systemd-networkd-wait-online.service")
+          client.wait_for_unit("systemd-networkd-wait-online.service")
+          client.wait_until_succeeds("ping -c 5 10.0.0.1")
+          router.wait_until_succeeds("ping -c 5 10.0.0.3")
+
+      with subtest("DDNS"):
+          nameserver.wait_until_succeeds("kdig +short client.lan.nixos.test @10.0.0.2 | grep -q 10.0.0.3")
+
+      with subtest("Prometheus Exporter"):
+          router.log(router.execute("curl 127.0.0.1:9547")[1])
+          router.succeed("curl --silent 127.0.0.1:9547 | grep -qE '^kea_dhcp4_addresses_assigned_total.*1.0$'")
     '';
 }

nixos/tests/systemd-networkd-ipv6-prefix-delegation.nix

@@ -17,7 +17,7 @@ import ./make-test-python.nix (
         hexa
       ];
     };
-    nodes = {
+    containers = {
 
       # The ISP's routers job is to delegate IPv6 prefixes via DHCPv6. Like with
       # regular IPv6 auto-configuration it will also emit IPv6 router
@@ -38,6 +38,7 @@ import ./make-test-python.nix (
             interfaces.eth1 = lib.mkForce { }; # Don't use scripted networking
           };
 
+          services.resolved.enable = false;
           systemd.network = {
             enable = true;
 
@@ -204,6 +205,7 @@ import ./make-test-python.nix (
           interfaces.eth1.ipv6.addresses = lib.mkForce [ ];
         };
 
+        services.resolved.enable = false;
         systemd.network = {
           networks = {
             # systemd-networkd will load the first network unit file
@@ -300,6 +302,7 @@ import ./make-test-python.nix (
       client = {
         virtualisation.vlans = [ 2 ];
         systemd.services.systemd-networkd.environment.SYSTEMD_LOG_LEVEL = "debug";
+        services.resolved.enable = false;
         networking = {
           useNetworkd = true;
           useDHCP = false;

nixos/tests/web-apps/pretalx.nix

@@ -4,37 +4,38 @@
   name = "pretalx";
   meta.maintainers = pkgs.pretalx.meta.maintainers;
 
-  nodes = {
-    pretalx =
-      { config, ... }:
-      {
-        networking.extraHosts = ''
-          127.0.0.1 talks.local
-        '';
+  containers.pretalx =
+    { config, ... }:
+    {
+      networking.extraHosts = ''
+        127.0.0.1 talks.local
+      '';
 
-        services.pretalx = {
-          enable = true;
-          plugins = with config.services.pretalx.package.plugins; [
-            pages
-          ];
-          nginx.domain = "talks.local";
-          settings = {
-            site.url = "http://talks.local";
-          };
+      services.pretalx = {
+        enable = true;
+        plugins = with config.services.pretalx.package.plugins; [
+          pages
+        ];
+        nginx.domain = "talks.local";
+        settings = {
+          site.url = "http://talks.local";
         };
       };
-  };
+    };
 
-  testScript = ''
-    start_all()
+  testScript =
+    # python
+    ''
+      start_all()
 
-    pretalx.wait_for_unit("pretalx-web.service")
-    pretalx.wait_for_unit("pretalx-worker.service")
+      pretalx.wait_for_unit("pretalx-web.service")
+      pretalx.wait_for_unit("pretalx-worker.service")
 
-    pretalx.wait_until_succeeds("curl -q --fail http://talks.local/orga/")
+      pretalx.wait_until_succeeds("curl -q --fail http://talks.local/orga/")
 
-    pretalx.succeed("pretalx-manage --help")
+      pretalx.log(pretalx.succeed("id"))
+      pretalx.succeed("pretalx-manage --help | grep -q 'createsuperuser'")
 
-    pretalx.log(pretalx.succeed("systemd-analyze security pretalx-web.service"))
-  '';
+      pretalx.log(pretalx.succeed("systemd-analyze security pretalx-web.service"))
+    '';
 }

nixos/tests/web-apps/pretix.nix

@@ -1,50 +1,47 @@
 {
-  lib,
   pkgs,
   ...
 }:
 
 {
   name = "pretix";
-  meta.maintainers = with lib.maintainers; [ hexa ];
+  meta.maintainers = pkgs.pretix.meta.maintainers;
 
-  nodes = {
-    pretix = {
-      virtualisation.memorySize = 2048;
+  containers.pretix = {
+    networking.extraHosts = ''
+      127.0.0.1 tickets.local
+    '';
 
-      networking.extraHosts = ''
-        127.0.0.1 tickets.local
-      '';
-
-      services.pretix = {
-        enable = true;
-        nginx.domain = "tickets.local";
-        plugins = with pkgs.pretix.plugins; [
-          passbook
-          pages
-          zugferd
-        ];
-        settings = {
-          pretix = {
-            instance_name = "NixOS Test";
-            url = "http://tickets.local";
-          };
-          mail.from = "hello@tickets.local";
+    services.pretix = {
+      enable = true;
+      nginx.domain = "tickets.local";
+      plugins = with pkgs.pretix.plugins; [
+        passbook
+        pages
+        zugferd
+      ];
+      settings = {
+        pretix = {
+          instance_name = "NixOS Test";
+          url = "http://tickets.local";
         };
+        mail.from = "hello@tickets.local";
       };
     };
   };
 
-  testScript = ''
-    start_all()
+  testScript =
+    # python
+    ''
+      start_all()
 
-    pretix.wait_for_unit("pretix-web.service")
-    pretix.wait_for_unit("pretix-worker.service")
+      pretix.wait_for_unit("pretix-web.service")
+      pretix.wait_for_unit("pretix-worker.service")
 
-    pretix.wait_until_succeeds("curl -q --fail http://tickets.local")
+      pretix.wait_until_succeeds("curl -q --fail http://tickets.local")
 
-    pretix.succeed("pretix-manage --help")
+      pretix.succeed("pretix-manage --help | grep -q 'createsuperuser'")
 
-    pretix.log(pretix.succeed("systemd-analyze security pretix-web.service"))
-  '';
+      pretix.log(pretix.succeed("systemd-analyze security pretix-web.service"))
+    '';
 }

pkgs/applications/audio/deadbeef/plugins/statusnotifier.nix

@@ -11,13 +11,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "deadbeef-statusnotifier-plugin";
-  version = "1.6";
+  version = "1.7";
 
   src = fetchFromGitHub {
     owner = "vovochka404";
     repo = "deadbeef-statusnotifier-plugin";
     rev = "v${finalAttrs.version}";
-    sha256 = "sha256-6WEbY59vPNrL3W5GUwFQJimmSS+td8Ob+G46fPAxfV4=";
+    sha256 = "sha256-pDiQn+iHSTNWTO01j/fbEq3P374TMmnUiC5/Jn2hwBI=";
   };
 
   nativeBuildInputs = [ pkg-config ];

pkgs/applications/editors/emacs/elisp-packages/elpa-devel-generated.nix

@@ -5097,6 +5097,27 @@
       };
     }
   ) { };
+  keymap-popup = callPackage (
+    {
+      elpaBuild,
+      fetchurl,
+      lib,
+    }:
+    elpaBuild {
+      pname = "keymap-popup";
+      ename = "keymap-popup";
+      version = "0.3.1.0.20260530.4";
+      src = fetchurl {
+        url = "https://elpa.gnu.org/devel/keymap-popup-0.3.1.0.20260530.4.tar";
+        sha256 = "1k6aqp65x3azbipj2pwdg15pip045cawx4im04s84kbk91fx0fxs";
+      };
+      packageRequires = [ ];
+      meta = {
+        homepage = "https://elpa.gnu.org/devel/keymap-popup.html";
+        license = lib.licenses.free;
+      };
+    }
+  ) { };
   kind-icon = callPackage (
     {
       elpaBuild,

pkgs/applications/editors/emacs/elisp-packages/elpa-generated.nix

@@ -5015,6 +5015,27 @@
       };
     }
   ) { };
+  keymap-popup = callPackage (
+    {
+      elpaBuild,
+      fetchurl,
+      lib,
+    }:
+    elpaBuild {
+      pname = "keymap-popup";
+      ename = "keymap-popup";
+      version = "0.3.1";
+      src = fetchurl {
+        url = "https://elpa.gnu.org/packages/keymap-popup-0.3.1.tar";
+        sha256 = "0m44s8618n7g5pajxiv4k1dfx6l58gr01a3ga26fxc51j1d05q8b";
+      };
+      packageRequires = [ ];
+      meta = {
+        homepage = "https://elpa.gnu.org/packages/keymap-popup.html";
+        license = lib.licenses.free;
+      };
+    }
+  ) { };
   kind-icon = callPackage (
     {
       elpaBuild,

pkgs/applications/editors/emacs/elisp-packages/nongnu-common-overrides.nix

@@ -20,5 +20,22 @@ in
       yasnippet
     ]
   );
+
+  # requires optional dependency for OMEMO support.
+  jabber = super.jabber.overrideAttrs (old: {
+    buildInputs = old.buildInputs ++ [ pkgs.mbedtls ];
+    nativeBuildInputs = old.nativeBuildInputs ++ [ pkgs.pkg-config ];
+
+    # We need to run this in postInstall for package directory to become available
+    postInstall =
+      (old.postInstall or "")
+      + "\n"
+      + ''
+        pushd $out/share/emacs/site-lisp/elpa/jabber-*/src
+        make CC=$CC
+        rm -r $out/share/emacs/site-lisp/elpa/jabber-*/src
+        popd
+      '';
+  });
   # keep-sorted end
 }

pkgs/applications/editors/emacs/elisp-packages/nongnu-devel-generated.nix

@@ -3225,17 +3225,21 @@
       elpaBuild,
       fetchurl,
       fsm,
+      keymap-popup,
       lib,
     }:
     elpaBuild {
       pname = "jabber";
       ename = "jabber";
-      version = "0.10.5.0.20260423.192938";
+      version = "0.11.0.0.20260614.0";
       src = fetchurl {
-        url = "https://elpa.nongnu.org/nongnu-devel/jabber-0.10.5.0.20260423.192938.tar";
-        sha256 = "1q79iv4znishj6rdz1m76r0c8h72i2g47xfh6xfw2gqxbkkyilv3";
+        url = "https://elpa.nongnu.org/nongnu-devel/jabber-0.11.0.0.20260614.0.tar";
+        sha256 = "19h0w85m6vzwwpsgg6ifcyx2j082cgj6dpd7s5yd7pr438jazkn3";
       };
-      packageRequires = [ fsm ];
+      packageRequires = [
+        fsm
+        keymap-popup
+      ];
       meta = {
         homepage = "https://elpa.nongnu.org/nongnu-devel/jabber.html";
         license = lib.licenses.free;

pkgs/applications/editors/emacs/elisp-packages/nongnu-generated.nix

@@ -3240,17 +3240,21 @@
       elpaBuild,
       fetchurl,
       fsm,
+      keymap-popup,
       lib,
     }:
     elpaBuild {
       pname = "jabber";
       ename = "jabber";
-      version = "0.10.5";
+      version = "0.11.0";
       src = fetchurl {
-        url = "https://elpa.nongnu.org/nongnu/jabber-0.10.5.tar";
-        sha256 = "1vjmajcls0l6mwccqdp7gr4g4r1z6f2qaf2palnimjb7w3gzh4mk";
+        url = "https://elpa.nongnu.org/nongnu/jabber-0.11.0.tar";
+        sha256 = "1wikfd8iqj9r1qrh6cd593vgbkjndfpm9f12ilsdwxwh0nx3cpd7";
       };
-      packageRequires = [ fsm ];
+      packageRequires = [
+        fsm
+        keymap-popup
+      ];
       meta = {
         homepage = "https://elpa.nongnu.org/nongnu/jabber.html";
         license = lib.licenses.free;

pkgs/applications/editors/vim/plugins/non-generated/avante-nvim/default.nix

@@ -67,10 +67,10 @@ vimUtils.buildVimPlugin {
     in
     ''
       mkdir -p $out/build
-      ln -s ${avante-nvim-lib}/lib/libavante_repo_map${ext} $out/build/avante_repo_map${ext}
-      ln -s ${avante-nvim-lib}/lib/libavante_templates${ext} $out/build/avante_templates${ext}
-      ln -s ${avante-nvim-lib}/lib/libavante_tokenizers${ext} $out/build/avante_tokenizers${ext}
-      ln -s ${avante-nvim-lib}/lib/libavante_html2md${ext} $out/build/avante_html2md${ext}
+      cp ${avante-nvim-lib}/lib/libavante_repo_map${ext} $out/build/avante_repo_map${ext}
+      cp ${avante-nvim-lib}/lib/libavante_templates${ext} $out/build/avante_templates${ext}
+      cp ${avante-nvim-lib}/lib/libavante_tokenizers${ext} $out/build/avante_tokenizers${ext}
+      cp ${avante-nvim-lib}/lib/libavante_html2md${ext} $out/build/avante_html2md${ext}
 
       # Fixes PKCE auth flows not finding libcrypto
       substituteInPlace "$out/lua/avante/auth/pkce.lua" \

pkgs/applications/graphics/gimp/default.nix

@@ -338,8 +338,6 @@ stdenv.mkDerivation (finalAttrs: {
     gtk = gtk3;
   };
 
-  __structuredAttrs = true;
-
   meta = {
     description = "GNU Image Manipulation Program";
     homepage = "https://www.gimp.org/";

pkgs/applications/networking/cluster/cni/plugins.nix

@@ -7,13 +7,13 @@
 
 buildGoModule rec {
   pname = "cni-plugins";
-  version = "1.9.0";
+  version = "1.9.1";
 
   src = fetchFromGitHub {
     owner = "containernetworking";
     repo = "plugins";
     rev = "v${version}";
-    hash = "sha256-0ZonR8pV20bBbC2AkNCJhoseDVxNwwMa7coD/ON6clA=";
+    hash = "sha256-3OhUvIJPU5Ayc4/po9Rj4Tfa5536aN8bj+51M6Xg5os=";
   };
 
   vendorHash = null;

pkgs/applications/networking/cluster/terraform-providers/providers.json

@@ -1058,11 +1058,11 @@
     "vendorHash": null
   },
   "oracle_oci": {
-    "hash": "sha256-uIggPhDgTMQei6LpXPzAbfbsoNjVN35P60QcqqHyCIA=",
+    "hash": "sha256-SFs0BYaYgB4J/HbaYFx1Sh1raVWhRJdW/3KMWdyvX+I=",
     "homepage": "https://registry.terraform.io/providers/oracle/oci",
     "owner": "oracle",
     "repo": "terraform-provider-oci",
-    "rev": "v8.17.0",
+    "rev": "v8.18.0",
     "spdx": "MPL-2.0",
     "vendorHash": null
   },
@@ -1436,13 +1436,13 @@
     "vendorHash": "sha256-lWBMihP6oX7qPpTuPQQwQS3IDwdyb/rEYqtBsTozb7Q="
   },
   "venafi_venafi": {
-    "hash": "sha256-wpAckNRqZjSDt7KpCRpLSYkn6Gm+QPzn5sIJ90wRXjI=",
+    "hash": "sha256-WOCZRVAYVR9uzsyyAvCQvYReaas6YmZsbRgxxxhDF/k=",
     "homepage": "https://registry.terraform.io/providers/Venafi/venafi",
     "owner": "Venafi",
     "repo": "terraform-provider-venafi",
-    "rev": "v0.23.1",
+    "rev": "v0.23.2",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-chDZVBd7tb1VsfTXcWz7j29LzHpUnJpXKRFAyqxnR8s="
+    "vendorHash": "sha256-rqDzBez3HvhG+xvEyQ6foq/m0sFyyqrioquY9mcuWOU="
   },
   "vinyldns_vinyldns": {
     "hash": "sha256-/M+HFMDeKpIzzdn04TkMxriVeE6vvORRiqonxF38B9Q=",

pkgs/applications/networking/p2p/deluge/default.nix

@@ -5,6 +5,7 @@
   libtorrent-rasterbar,
   python3Packages,
   gtk3,
+  libappindicator-gtk3,
   glib,
   gobject-introspection,
   librsvg,
@@ -54,6 +55,7 @@ let
           gtk3
           gobject-introspection
           pygobject3
+          libappindicator-gtk3
         ];
 
       nativeBuildInputs = [

pkgs/applications/video/kodi/addons/jellycon/default.nix

@@ -17,13 +17,13 @@ in
 buildKodiAddon rec {
   pname = "jellycon";
   namespace = "plugin.video.jellycon";
-  version = "0.9.1";
+  version = "1.0.0";
 
   src = fetchFromGitHub {
     owner = "jellyfin";
     repo = "jellycon";
     rev = "v${version}";
-    sha256 = "sha256-bSAzd0nKD0S3hNEM0azmCNPw9wHQK5XH6lbfcz3sW9o=";
+    sha256 = "sha256-1o9mkMjlLDIcokpTqDKmFlCOF1XjrVOxlFfy0bpZolc=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/ac/actionlint/package.nix

@@ -53,7 +53,7 @@ buildGoModule (finalAttrs: {
     description = "Static checker for GitHub Actions workflow files";
     changelog = "https://github.com/rhysd/actionlint/raw/v${finalAttrs.version}/CHANGELOG.md";
     license = lib.licenses.mit;
-    maintainers = with lib.maintainers; [ momeemt ];
+    maintainers = [ ];
     mainProgram = "actionlint";
   };
 })

pkgs/by-name/al/algolia-cli/package.nix

@@ -43,6 +43,6 @@ buildGoModule {
     mainProgram = "algolia";
     homepage = "https://algolia.com/doc/tools/cli/";
     license = lib.licenses.mit;
-    maintainers = with lib.maintainers; [ momeemt ];
+    maintainers = [ ];
   };
 }

pkgs/by-name/al/almo/package.nix

@@ -43,7 +43,7 @@ stdenv.mkDerivation (finalAttrs: {
     platforms = lib.platforms.all;
     homepage = "https://github.com/abap34/almo";
     changelog = "https://github.com/abap34/almo/releases/tag/${finalAttrs.src.tag}";
-    maintainers = with lib.maintainers; [ momeemt ];
+    maintainers = [ ];
     mainProgram = "almo";
   };
 })

pkgs/by-name/am/amp-cli/package.nix

@@ -27,7 +27,7 @@ let
 in
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "amp-cli";
-  version = "0.0.1780564400-g2007df";
+  version = "0.0.1781370323-g977781";
 
   src = finalAttrs.passthru.sources.${stdenvNoCC.hostPlatform.system};
 
@@ -78,10 +78,10 @@ stdenvNoCC.mkDerivation (finalAttrs: {
         url = "https://static.ampcode.com/cli/${finalAttrs.version}/amp-${platform}.gz";
         hash =
           {
-            x86_64-linux = "sha256-7hUa1Qs1pNH2+31rrc9T99eDQ9Vq+CSwxROISyPqogY=";
-            aarch64-linux = "sha256-ThT2J1YBoZM5+YanRbL40GyxYQtK/xyDqac8fv0gfZs=";
-            x86_64-darwin = "sha256-VnuMqXVzqge5jgduxB+woYLVZkFtu92MEsEsrh4tJgE=";
-            aarch64-darwin = "sha256-gYAI+eQitglQTBtuilHkHKd8rsYsJ7s2QKoFQR85l6o=";
+            x86_64-linux = "sha256-taXa0AE0re6IoUxr/Sa7Os/pt/u0Zm+eCxRbRW019fA=";
+            aarch64-linux = "sha256-gFfgGlFB+HpV+KAitpOtXu2ij7hQYmxzm8gzy+l79us=";
+            x86_64-darwin = "sha256-1L+J9i/y5fg2rySOfAZySnBbqgmxpM7+7h9CoREI14s=";
+            aarch64-darwin = "sha256-1I7roExnTQFjByVDDr6ym3X+70Ba9IVE9vxBHVlJQIY=";
           }
           .${system'};
       }

pkgs/by-name/as/astroterm/package.nix

@@ -14,13 +14,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "astroterm";
-  version = "1.0.10";
+  version = "1.2.0";
 
   src = fetchFromGitHub {
     owner = "da-luce";
     repo = "astroterm";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-z9KblIAoXk///NnRFHCSAFNDuNiPxDuuiliajcsyJM0=";
+    hash = "sha256-u0UKYoZCDClRmG12czmm0rmOcy3nruarSyjdh8Lu2dw=";
   };
 
   bsc5File = fetchurl {

pkgs/by-name/av/avell-unofficial-control-center/package.nix

@@ -7,7 +7,7 @@
 python3Packages.buildPythonApplication {
   pname = "avell-unofficial-control-center";
   version = "1.0.4";
-  format = "setuptools";
+  pyproject = true;
 
   src = fetchFromGitHub {
     owner = "rodgomesc";
@@ -17,14 +17,16 @@ python3Packages.buildPythonApplication {
     sha256 = "1qz1kv7p09nxffndzz9jlkzpfx26ppz66f8603zyamjq9dqdmdin";
   };
 
-  # No tests included
-  doCheck = false;
+  build-system = with python3Packages; [ setuptools ];
 
-  propagatedBuildInputs = with python3Packages; [
+  dependencies = with python3Packages; [
     pyusb
     elevate
   ];
 
+  # No tests included
+  doCheck = false;
+
   meta = {
     homepage = "https://github.com/rodgomesc/avell-unofficial-control-center";
     description = "Software for controlling RGB keyboard lights on some gaming laptops that use ITE Device(8291) Rev 0.03";

pkgs/by-name/av/avro-tools/package.nix

@@ -36,6 +36,6 @@ stdenv.mkDerivation (finalAttrs: {
     mainProgram = "avro-tools";
     sourceProvenance = with lib.sourceTypes; [ binaryBytecode ];
     license = lib.licenses.asl20;
-    maintainers = with lib.maintainers; [ momeemt ];
+    maintainers = [ ];
   };
 })

pkgs/by-name/ba/backintime-common/package.nix

@@ -9,6 +9,7 @@
   cron,
   openssh,
   sshfs-fuse,
+  fuse3,
   gocryptfs,
   which,
   ps,
@@ -73,11 +74,14 @@ stdenv.mkDerivation (finalAttrs: {
       --replace-fail "share" "${python'.sitePackages}"
 
     substituteInPlace "schedule.py" \
-      --replace-fail "'crontab'" "'${cron}/bin/crontab'" \
+      --replace-fail "'crontab'" "'${lib.getExe' cron "crontab"}'" \
       --replace-fail "'which'" "'${lib.getExe which}'" \
       --replace-fail "'ps'" "'${lib.getExe ps}'" \
       --replace-fail "'grep'" "'${lib.getExe gnugrep}'" \
 
+    substituteInPlace mount.py \
+      --replace-fail "'fusermount'" "'${lib.getExe' fuse3 "fusermount3"}'"
+
     substituteInPlace "bitlicense.py" \
       --replace-fail "/usr/share/doc" "$out/share/doc" \
   '';

pkgs/by-name/ba/bazel-gazelle/package.nix

@@ -6,13 +6,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "bazel-gazelle";
-  version = "0.47.0";
+  version = "0.51.3";
 
   src = fetchFromGitHub {
-    owner = "bazelbuild";
+    owner = "bazel-contrib";
     repo = "bazel-gazelle";
-    rev = "v${finalAttrs.version}";
-    hash = "sha256-rnJ8rht7ccAI8ceOv3B0mlcY0fQg9Nfy+hu+/pmQQqE=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-ooqk4xutkjXoy9Irikos/53+6Mhdh3+WmJF7vo3JVFw=";
   };
 
   vendorHash = null;
@@ -22,14 +22,18 @@ buildGoModule (finalAttrs: {
   subPackages = [ "cmd/gazelle" ];
 
   meta = {
-    homepage = "https://github.com/bazelbuild/bazel-gazelle";
+    changelog = "https://github.com/bazel-contrib/bazel-gazelle/releases/tag/${finalAttrs.src.tag}";
+    homepage = "https://github.com/bazel-contrib/bazel-gazelle";
     description = ''
       Gazelle is a Bazel build file generator for Bazel projects. It natively
       supports Go and protobuf, and it may be extended to support new languages
       and custom rule sets.
     '';
     license = lib.licenses.asl20;
-    maintainers = with lib.maintainers; [ kalbasit ];
+    maintainers = with lib.maintainers; [
+      kalbasit
+      hythera
+    ];
     mainProgram = "gazelle";
   };
 })

pkgs/by-name/bi/bitwarden-desktop/package.nix

@@ -95,9 +95,6 @@ buildNpmPackage rec {
 
   env.ELECTRON_SKIP_BINARY_DOWNLOAD = "1";
 
-  # make electron-builder not attempt to codesign the app on darwin
-  env.CSC_IDENTITY_AUTO_DISCOVERY = "false";
-
   nativeBuildInputs = [
     cargo
     dart-sass

pkgs/by-name/bl/bloaty/package.nix

@@ -86,6 +86,6 @@ stdenv.mkDerivation {
     homepage = "https://github.com/google/bloaty";
     license = lib.licenses.asl20;
     platforms = lib.platforms.unix;
-    maintainers = with lib.maintainers; [ momeemt ];
+    maintainers = [ ];
   };
 }

pkgs/by-name/bl/blocky/package.nix

@@ -7,20 +7,20 @@
 
 buildGoModule (finalAttrs: {
   pname = "blocky";
-  version = "0.30.0";
+  version = "0.31.0";
 
   src = fetchFromGitHub {
     owner = "0xERR0R";
     repo = "blocky";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-SZpAPX+MIQA0HRUUmjXi7g+DEJ+jyub4rlyc0RLclew=";
+    hash = "sha256-qFGJaShWplvZo/uKRjizWWeb/OzLJCoL9YTRsKWTriY=";
   };
 
   # needs network connection and fails at
   # https://github.com/0xERR0R/blocky/blob/development/resolver/upstream_resolver_test.go
   doCheck = false;
 
-  vendorHash = "sha256-DahHFf0w0ksQniuVByX45/fLcqpAga23qMjAGnZTjjY=";
+  vendorHash = "sha256-EsGaY3U6bHjQTj+rLRtjiQJoNP5WnP7/gZ2NrRX53b0=";
 
   ldflags = [
     "-s"

pkgs/by-name/bu/buildpack/package.nix

@@ -42,6 +42,6 @@ buildGoModule (finalAttrs: {
     description = "CLI for building apps using Cloud Native Buildpacks";
     mainProgram = "pack";
     license = lib.licenses.asl20;
-    maintainers = with lib.maintainers; [ momeemt ];
+    maintainers = [ ];
   };
 })

pkgs/by-name/bu/bundletool/package.nix

@@ -31,7 +31,7 @@ stdenvNoCC.mkDerivation (finalAttrs: {
     homepage = "https://developer.android.com/studio/command-line/bundletool";
     changelog = "https://github.com/google/bundletool/releases/tag/${finalAttrs.version}";
     sourceProvenance = with lib.sourceTypes; [ binaryBytecode ];
-    maintainers = with lib.maintainers; [ momeemt ];
+    maintainers = [ ];
     platforms = jre_headless.meta.platforms;
     license = lib.licenses.asl20;
   };

pkgs/by-name/by/byobu/package.nix

@@ -18,13 +18,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "byobu";
-  version = "6.13";
+  version = "6.15";
 
   src = fetchFromGitHub {
     owner = "dustinkirkland";
     repo = "byobu";
-    rev = finalAttrs.version;
-    hash = "sha256-h+3BEMfBRozmpqFNRyfKzjKgevaYm8v7DsJMwkhiCQ4=";
+    tag = finalAttrs.version;
+    hash = "sha256-QovoXH8cm8CZMSYGjI7FgynHtJjahpe9R2s62F7aZvo=";
   };
 
   nativeBuildInputs = [
@@ -103,9 +103,9 @@ stdenv.mkDerivation (finalAttrs: {
       Tmux terminal multiplexer, and works on most Linux, BSD, and Mac
       distributions.
     '';
-    license = with lib.licenses; [ gpl3Plus ];
+    license = lib.licenses.gpl3Plus;
     mainProgram = "byobu";
-    maintainers = [ ];
+    maintainers = with lib.maintainers; [ cbrxyz ];
     platforms = lib.platforms.unix;
   };
 })

pkgs/by-name/ca/caffeine-ng/fix-build.patch

@@ -13,12 +13,3 @@ index 3e4f9ea..5b82861 100644
  )
  
  dependency('pygobject-3.0')
-@@ -82,7 +78,7 @@ configure_file(
- 
- install_data(
-   'share/applications/caffeine.desktop',
--  install_dir: '/etc/xdg/autostart',
-+  install_dir: join_paths(get_option('sysconfdir'), 'xdg/autostart'),
- )
- 
- install_data(

pkgs/by-name/ca/caffeine-ng/package.nix

@@ -19,14 +19,14 @@
 
 python3Packages.buildPythonApplication (finalAttrs: {
   pname = "caffeine-ng";
-  version = "4.2.0";
+  version = "4.3.2";
   pyproject = false;
 
   src = fetchFromCodeberg {
     owner = "WhyNotHugo";
     repo = "caffeine-ng";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-uYzLRZ+6ZgIwhSuJWRBpLYHgonX7sFXgUZid0V26V0Q=";
+    hash = "sha256-eJ/0lzE5X1WFhgTAgI/SOmtxPbK7ppTk90RWobPZk2o=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/ca/cargo-risczero/package.nix

@@ -49,6 +49,6 @@ rustPlatform.buildRustPackage rec {
     mainProgram = "cargo-risczero";
     homepage = "https://risczero.com";
     license = with lib.licenses; [ asl20 ];
-    maintainers = with lib.maintainers; [ cameronfyfe ];
+    maintainers = [ ];
   };
 }

pkgs/by-name/cf/cfn-nag/package.nix

@@ -19,7 +19,6 @@ bundlerEnv {
     mainProgram = "cfn_nag";
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [
-      momeemt
       mathstlouis
     ];
     platforms = lib.platforms.unix;

pkgs/by-name/cl/clean-css-cli/package.nix

@@ -26,6 +26,6 @@ buildNpmPackage (finalAttrs: {
     changelog = "https://github.com/clean-css/clean-css-cli/blob/v${finalAttrs.version}/History.md";
     license = lib.licenses.mit;
     mainProgram = "cleancss";
-    maintainers = with lib.maintainers; [ momeemt ];
+    maintainers = [ ];
   };
 })

pkgs/by-name/co/corefonts/package.nix

@@ -3,6 +3,7 @@
   stdenv,
   fetchurl,
   cabextract,
+  installFonts,
 }:
 
 let
@@ -76,7 +77,10 @@ stdenv.mkDerivation {
     ) fonts
   );
 
-  nativeBuildInputs = [ cabextract ];
+  nativeBuildInputs = [
+    cabextract
+    installFonts
+  ];
 
   buildCommand = ''
     for i in $exes; do
@@ -124,7 +128,9 @@ stdenv.mkDerivation {
     mv webdings.ttf  Webdings.ttf.tmp
     mv Webdings.ttf.tmp  Webdings.ttf
 
-    install -m444 -Dt $out/share/fonts/truetype *.ttf
+    # using buildCommand means no phases are run
+    # so we run the function ourselves
+    installFonts
 
     # Also put the EULA there to be on the safe side.
     cp ${eula} $out/share/fonts/truetype/eula.html

pkgs/by-name/de/deno/rusty-v8/default.nix

@@ -16,6 +16,7 @@
   glib,
   glibc,
   icu,
+  libffi,
   python3,
   gn,
   ninja,
@@ -106,6 +107,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
   buildInputs = [
     glib
     icu
+    libffi
   ]
   ++ lib.optionals stdenv.targetPlatform.isDarwin [
     apple-sdk_15
@@ -123,6 +125,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
     RUSTC_BOOTSTRAP = 1;
     EXTRA_GN_ARGS = lib.concatStringsSep " " (
       [
+        "use_system_libffi=true"
         "use_sysroot=false" # prevent download of debian sysroot
         "clang_version=\"${lib.versions.major llvmPackages.clang.version}\""
         "rustc_version=\"${rustc.version}\""

pkgs/by-name/dr/drawio/package.nix

@@ -64,19 +64,18 @@ stdenv.mkDerivation (finalAttrs: {
   buildPhase = ''
     runHook preBuild
 
-  ''
-  + lib.optionalString stdenv.hostPlatform.isDarwin ''
-    cp -R ${electron.dist}/Electron.app Electron.app
-    chmod -R u+w Electron.app
-    export CSC_IDENTITY_AUTO_DISCOVERY=false
+    electron_dist="$(mktemp -d)"
+    cp -r ${electron.dist}/. "$electron_dist"
+    chmod -R u+w "$electron_dist"
+
     sed -i "/afterSign/d" electron-builder-linux-mac.json
-  ''
-  + ''
+
     npm exec electron-builder -- \
       --dir \
-      ${lib.optionalString stdenv.hostPlatform.isDarwin "--config electron-builder-linux-mac.json --config.mac.identity=null"} \
-      -c.electronDist=${if stdenv.hostPlatform.isDarwin then "." else electron.dist} \
-      -c.electronVersion=${electron.version}
+      --config electron-builder-linux-mac.json \
+      -c.electronDist="$electron_dist" \
+      -c.electronVersion=${electron.version} \
+      -c.mac.identity=null
 
     runHook postBuild
   '';

pkgs/by-name/du/dumbpipe/package.nix

@@ -46,7 +46,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
       asl20
       mit
     ];
-    maintainers = with lib.maintainers; [ cameronfyfe ];
+    maintainers = [ ];
     mainProgram = "dumbpipe";
   };
 })

pkgs/by-name/dv/dvdisaster/package.nix

@@ -14,13 +14,13 @@
 stdenv.mkDerivation (finalAttrs: {
 
   pname = "dvdisaster";
-  version = "0.79.10-pl5";
+  version = "0.79.10-pl6";
 
   src = fetchFromGitHub {
     owner = "speed47";
     repo = "dvdisaster";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-lWvZDB08lZb87l4oEbrdtc6Me4mWHiW3DFNXYoYR3a0=";
+    hash = "sha256-yQldvTvmbZgIOLKzdubd1zomSRKvAkTnS6hpEYWPr8A=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/ej/ejs/package.nix

@@ -32,6 +32,6 @@ buildNpmPackage {
     homepage = "https://ejs.co";
     license = lib.licenses.asl20;
     mainProgram = "ejs";
-    maintainers = with lib.maintainers; [ momeemt ];
+    maintainers = [ ];
   };
 }

pkgs/by-name/et/ets/package.nix

@@ -40,7 +40,7 @@ buildGoModule (finalAttrs: {
     description = "Command output timestamper";
     homepage = "https://github.com/gdubicki/ets/";
     license = lib.licenses.mit;
-    maintainers = with lib.maintainers; [ cameronfyfe ];
+    maintainers = [ ];
     mainProgram = "ets";
   };
 })

pkgs/by-name/et/ettercap/package.nix

@@ -83,7 +83,7 @@ stdenv.mkDerivation (finalAttrs: {
       analysis.
     '';
     homepage = "https://www.ettercap-project.org/";
-    changelog = "https://github.com/Ettercap/ettercap/releases/tag/${finalAttrs.version}";
+    changelog = "https://github.com/Ettercap/ettercap/blob/master/CHANGELOG";
     license = lib.licenses.gpl2Plus;
     platforms = lib.platforms.unix;
     maintainers = with lib.maintainers; [ pSub ];

pkgs/by-name/fi/firebase-tools/package.nix

@@ -46,7 +46,6 @@ buildNpmPackage rec {
     license = lib.licenses.mit;
     mainProgram = "firebase";
     maintainers = with lib.maintainers; [
-      momeemt
       sarahec
     ];
   };

pkgs/by-name/gl/global/package.nix

@@ -87,8 +87,6 @@ stdenv.mkDerivation (finalAttrs: {
       peterhoeg
     ];
     platforms = lib.platforms.unix;
-    changelog = "https://cvs.savannah.gnu.org/viewvc/global/global/NEWS?view=markup&pathrev=VERSION-${
-      lib.replaceStrings [ "." ] [ "_" ] finalAttrs.version
-    }";
+    changelog = "https://www.gnu.org/software/global/whatsnew.html";
   };
 })

pkgs/by-name/go/google-cloud-sql-proxy/package.nix

@@ -7,18 +7,18 @@
 
 buildGoModule (finalAttrs: {
   pname = "google-cloud-sql-proxy";
-  version = "2.21.1";
+  version = "2.22.1";
 
   src = fetchFromGitHub {
     owner = "GoogleCloudPlatform";
     repo = "cloud-sql-proxy";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-3C7IfpVcv1BpzKnMV6dQJ0e7hY50owR3YijlI2+cAJQ=";
+    hash = "sha256-vTTYQ1D42X1L03EE9c5Xz/SCRE3wWROT/daY+f0vLPI=";
   };
 
   subPackages = [ "." ];
 
-  vendorHash = "sha256-tbglk7rscPx1RrURSzVW5FgZE6b6mp4tvOXVQKMUrjQ=";
+  vendorHash = "sha256-lOT9GpZk6Bv5P8kiyMR4j+aHOO0be4pW4WvVux8hpnQ=";
 
   checkFlags = [
     "-short"

pkgs/by-name/gp/gpu-viewer/package.nix

@@ -29,7 +29,7 @@
 
 python3Packages.buildPythonApplication (finalAttrs: {
   pname = "gpu-viewer";
-  version = "3.34";
+  version = "3.35";
   pyproject = false;
   __structuredAttrs = true;
 
@@ -37,7 +37,7 @@ python3Packages.buildPythonApplication (finalAttrs: {
     owner = "arunsivaramanneo";
     repo = "gpu-viewer";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-ovgP5RaFAT01zccQiyy1vERBj9OW77v0hMZ0SjoS74M=";
+    hash = "sha256-W8BPtHbOwLZ95bY6ZmAaKS87fh+gOWZIhxjWKqiavag=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/gr/gridtracker2/package.nix

@@ -50,28 +50,20 @@ buildNpmPackage (finalAttrs: {
 
   buildPhase = ''
     runHook preBuild
-  ''
-  + lib.optionalString stdenv.hostPlatform.isDarwin ''
-    # electronDist needs to be modifiable on Darwin
-    cp -r ${electron.dist} electron-dist
-    chmod -R u+w electron-dist
 
-    # Disable code signing during build on macOS.
-    # https://github.com/electron-userland/electron-builder/blob/fa6fc16/docs/code-signing.md#how-to-disable-code-signing-during-the-build-process-on-macos
-    export CSC_IDENTITY_AUTO_DISCOVERY=false
+    # the electronDist directory needs to be outside of the working directory
+    # otherwise the electron-builder config accidentally includes it inside the .asar file
+    electron_dist="$(mktemp -d)"
+    cp -r ${electron.dist}/. "$electron_dist"
+    chmod -R u+w "$electron_dist"
 
     npm exec electron-builder -- \
       --dir \
-      -c.electronDist=electron-dist \
-      -c.electronVersion=${electron.version}
-  ''
-  + lib.optionalString stdenv.hostPlatform.isLinux ''
-    npm exec electron-builder -- \
-      --dir \
-      -c.electronDist=${electron.dist} \
-      -c.electronVersion=${electron.version}
-  ''
-  + ''
+      -c.electronDist="$electron_dist" \
+      -c.electronVersion=${electron.version} \
+      -c.mac.identity=null
+    # ^ disable codesigning on Darwin
+
     runHook postBuild
   '';
 

pkgs/by-name/hi/hinoirisetr/package.nix

@@ -0,0 +1,60 @@
+{
+  fetchFromForgejo,
+  installShellFiles,
+  lib,
+  libnotify,
+  pandoc,
+  patchelf,
+  rustPlatform,
+}:
+
+rustPlatform.buildRustPackage (finalAttrs: {
+  pname = "hinoirisetr";
+  version = "1.6.3";
+
+  __structuredAttrs = true;
+
+  src = fetchFromForgejo {
+    domain = "git.vavakado.xyz";
+    owner = "me";
+    repo = "hinoirisetr";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-XgIeeVCnlntf2RopA6SMuFCgbqTlTEZv6V5ezjEHVKA=";
+  };
+
+  cargoHash = "sha256-lydS9TWb+Y1PPC7C3Mn6KNVX1fsooAcDKJeKMnXWZY0=";
+
+  nativeBuildInputs = [
+    installShellFiles
+    pandoc
+    patchelf
+  ];
+
+  buildInputs = [
+    libnotify
+  ];
+
+  postFixup = ''
+    patchelf --add-rpath "${lib.getLib libnotify}/lib" $out/bin/hinoirisetr
+  '';
+
+  postBuild = ''
+    pandoc manpages/hinoirisetr.1.md -s -t man -o hinoirisetr.1
+  '';
+
+  postInstall = ''
+    installManPage hinoirisetr.1
+  '';
+
+  meta = {
+    description = "a lightweight daemon that automatically adjusts your screen's color temperature and gamma";
+    homepage = "https://git.vavakado.xyz/me/hinoirisetr";
+    changelog = "https://git.vavakado.xyz/me/hinoirisetr/releases/tag/v${finalAttrs.version}";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [
+      vavakado
+    ];
+    mainProgram = "hinoirisetr";
+    platforms = lib.platforms.linux;
+  };
+})

pkgs/by-name/hl/hl-log-viewer/package.nix

@@ -9,16 +9,16 @@
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "hl-log-viewer";
-  version = "0.36.2";
+  version = "0.36.3";
 
   src = fetchFromGitHub {
     owner = "pamburus";
     repo = "hl";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-r6p4gw1QzZPu1DWzbTNDnvKMi/pqZvViK4rAn4aov4A=";
+    hash = "sha256-Azt1jfBZP7N5ZAgdY2Hww6nt5ty2VEKZpaHZDodP/zM=";
   };
 
-  cargoHash = "sha256-8yb8elk8iG4snyExkQdJQn5eaKMNcPqYsAE/sIW6euk=";
+  cargoHash = "sha256-RXIXoF3z2Zleje1OakHXQxPmNkRcqHjINRZYqMXS8U0=";
 
   nativeBuildInputs = [ installShellFiles ];
 

pkgs/by-name/in/inlyne/package.nix

@@ -21,21 +21,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "inlyne";
-  version = "0.5.0";
+  version = "0.5.2";
 
   src = fetchFromGitHub {
     owner = "Inlyne-Project";
     repo = "inlyne";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-ueE1NKbCMBUBrrdsHkwZ5Yv6LD3tQL3ZAk2O4xoYOcw=";
+    hash = "sha256-bUM9Mn/C9l6s6ucoLRo25m4PbbW3gp5d3AvO/9GTJcI=";
   };
 
-  cargoHash = "sha256-6TwMZNYvW1bBE+9PJUXQxP5Uz7VYsjyLabmaxcX9Mbk=";
-
-  cargoPatches = [
-    # update metrics dependency to fix Rust 1.94 compatibility
-    ./update-metrics.patch
-  ];
+  cargoHash = "sha256-IaaojW5PYSUwyh1iv2HrDidIV8keEykKHY61rpcCAPc=";
 
   nativeBuildInputs = [
     installShellFiles
@@ -83,6 +78,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
         lib.makeLibraryPath [
           libGL
           libx11
+          libxkbcommon
         ]
       }
   '';

pkgs/by-name/in/inlyne/update-metrics.patch

@@ -1,14 +0,0 @@
---- a/Cargo.lock
-+++ b/Cargo.lock
-@@ -2409,9 +2409,9 @@ dependencies = [
- 
- [[package]]
- name = "metrics"
--version = "0.24.0"
-+version = "0.24.3"
- source = "registry+https://github.com/rust-lang/crates.io-index"
--checksum = "8ae428771d17306715c5091d446327d1cfdedc82185c65ba8423ab404e45bf10"
-+checksum = "5d5312e9ba3771cfa961b585728215e3d972c950a3eed9252aa093d6301277e8"
- dependencies = [
-  "ahash 0.8.11",
-  "portable-atomic",

pkgs/by-name/ka/kando/package.nix

@@ -69,8 +69,6 @@ buildNpmPackage.override { inherit nodejs; } rec {
     ELECTRON_SKIP_BINARY_DOWNLOAD = "1";
     # use our own node headers since we skip downloading them
     NIX_CFLAGS_COMPILE = "-I${nodejs}/include/node";
-    # disable code signing on Darwin
-    CSC_IDENTITY_AUTO_DISCOVERY = lib.optionalString stdenv.hostPlatform.isDarwin "false";
   };
 
   postConfigure = ''

pkgs/by-name/le/leiningen/package.nix

@@ -68,7 +68,7 @@ stdenv.mkDerivation (finalAttrs: {
     sourceProvenance = with lib.sourceTypes; [ binaryBytecode ];
     license = lib.licenses.epl10;
     platforms = jdk.meta.platforms;
-    maintainers = with lib.maintainers; [ momeemt ];
+    maintainers = [ ];
     mainProgram = "lein";
   };
 })

pkgs/by-name/le/lemminx/package.nix

@@ -26,13 +26,13 @@ let
 in
 maven.buildMavenPackage rec {
   pname = "lemminx";
-  version = "0.31.0";
+  version = "0.31.2";
 
   src = fetchFromGitHub {
     owner = "eclipse";
     repo = "lemminx";
     tag = version;
-    hash = "sha256-a+9RN1265fsmYAUMuUTxA+VqJv7xPlzuc8HqoZwmR4M=";
+    hash = "sha256-nV+IXeGEnJ7q2GEH9LKiy8ABePHSIt8GFPj/sZzv71E=";
     # Lemminx reads this git information at runtime from a git.properties
     # file on the classpath
     leaveDotGit = true;

pkgs/by-name/lh/lha/package.nix

@@ -29,8 +29,7 @@ stdenv.mkDerivation (finalAttrs: {
     description = "Archiver and compressor using the LZSS and Huffman encoding compression algorithms";
     homepage = "https://github.com/jca02266/lha";
     platforms = lib.platforms.unix;
-    maintainers = with lib.maintainers; [
-      momeemt
+    maintainers = [
     ];
     # Some of the original LHa code has been rewritten and the current author
     # considers adopting a "true" free and open source license for it.

pkgs/by-name/li/libacr38u/package.nix

@@ -49,7 +49,7 @@ stdenv.mkDerivation {
     '';
     homepage = "https://www.acs.com.hk";
     license = lib.licenses.lgpl2Plus;
-    maintainers = with lib.maintainers; [ berce ];
+    maintainers = [ ];
     platforms = with lib.platforms; unix;
   };
 }

pkgs/by-name/ma/makemkv/app-id.patch

@@ -0,0 +1,14 @@
+diff --git a/makemkvgui/src/main.cpp b/makemkvgui/src/main.cpp
+index 73ce457..71f822c 100644
+--- a/makemkvgui/src/main.cpp
++++ b/makemkvgui/src/main.cpp
+@@ -65,6 +65,9 @@ int qMain(int argc, char **argv)
+ #if (QT_VERSION > 0x050000)
+     QCoreApplication::setAttribute(Qt::AA_UseHighDpiPixmaps);
+ #endif
++    // Ensure the app-id ('makemkv') is set, so that GNOME can show
++    // the correct icon in the dash.
++    QGuiApplication::setDesktopFileName("makemkv");
+ 
+     CApClient::ITransport*  p_trans = NULL;
+ 

pkgs/by-name/ma/makemkv/package.nix

@@ -43,7 +43,12 @@ stdenv.mkDerivation (
 
     srcs = lib.attrValues finalAttrs.passthru.srcs;
     sourceRoot = "makemkv-oss-${version}";
-    patches = [ ./r13y.patch ];
+    patches = [
+      ./r13y.patch
+      # This patch is sourced from NonGuix, licensed GPLv3:
+      # https://gitlab.com/nonguix/nonguix/-/blob/2d1f3691546f007c7cd96ae87e4e970fed789182/nongnu/packages/patches/makemkv-app-id.patch
+      ./app-id.patch
+    ];
 
     enableParallelBuilding = true;
     nativeBuildInputs = [

pkgs/by-name/mi/microsoft-edge/package.nix

@@ -164,11 +164,11 @@ let
 in
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "microsoft-edge";
-  version = "149.0.4022.52";
+  version = "149.0.4022.69";
 
   src = fetchurl {
     url = "https://packages.microsoft.com/repos/edge/pool/main/m/microsoft-edge-stable/microsoft-edge-stable_${finalAttrs.version}-1_amd64.deb";
-    hash = "sha256-3lFhfxkS80P59dk00lpBp+8IIFUvSEJVGGTfAghxw4g=";
+    hash = "sha256-0Ur+0KKJQ7VTr7IMax5BIgwSf6jNhr0Aiz+So7Hj/OE=";
   };
 
   # With strictDeps on, some shebangs were not being patched correctly

pkgs/by-name/mi/mitra/package.nix

@@ -8,16 +8,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "mitra";
-  version = "4.17.0";
+  version = "5.0.0";
 
   src = fetchFromCodeberg {
     owner = "silverpill";
     repo = "mitra";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-ysV0r0K+2ivnDg/GuqwK5HWa4/jQtopXqS9g/9wWrOw=";
+    hash = "sha256-Chn3SONSg6yhwwHcry/cO2L7/ihEco35gpRlMlQVXz8=";
   };
 
-  cargoHash = "sha256-RDMLfg+KsvfXDjsCzCn53kebBRN8/6er/LsS/BzoeU0=";
+  cargoHash = "sha256-0lXwOphoUQqe1O0KbAOl98ZbMKyG8ZZOl7NhXYwSvvQ=";
 
   # require running database
   doCheck = false;

pkgs/by-name/mq/mqtt-explorer/package.nix

@@ -56,12 +56,6 @@ stdenv.mkDerivation rec {
 
   env.ELECTRON_SKIP_BINARY_DOWNLOAD = "1";
 
-  # disable code signing on macos
-  # https://github.com/electron-userland/electron-builder/blob/77f977435c99247d5db395895618b150f5006e8f/docs/code-signing.md#how-to-disable-code-signing-during-the-build-process-on-macos
-  postConfigure = lib.optionalString stdenv.hostPlatform.isDarwin ''
-    export CSC_IDENTITY_AUTO_DISCOVERY=false
-  '';
-
   configurePhase = ''
     runHook preConfigure
 
@@ -100,7 +94,9 @@ stdenv.mkDerivation rec {
 
     yarn --offline run electron-builder --dir \
       -c.electronDist="$electron_dist" \
-      -c.electronVersion=${electron.version}
+      -c.electronVersion=${electron.version} \
+      -c.mac.identity=null
+    # ^ disable code signing on macos
 
     runHook postBuild
   '';

pkgs/by-name/ms/msedgedriver/package.nix

@@ -11,11 +11,11 @@
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "msedgedriver";
-  version = "149.0.4022.52";
+  version = "149.0.4022.69";
 
   src = fetchzip {
     url = "https://msedgedriver.microsoft.com/${finalAttrs.version}/edgedriver_linux64.zip";
-    hash = "sha256-GLPkBOlXDTpjYrrc9odDeHXXZ8vLPiw06v1bIN1zOpo=";
+    hash = "sha256-BtyQD+zkZWv5GhnxJOg4BkVLrCdBZr7KN1bvXyvp4B8=";
     stripRoot = false;
   };
 

pkgs/by-name/ni/nixtamal/package.nix

@@ -20,7 +20,7 @@
 
 ocamlPackages.buildDunePackage (finalAttrs: {
   pname = "nixtamal";
-  version = "1.5.4";
+  version = "1.6.0";
   release_year = 2026;
 
   minimalOCamlVersion = "5.3";
@@ -29,7 +29,7 @@ ocamlPackages.buildDunePackage (finalAttrs: {
     url = "https://darcs.toastal.in.th/nixtamal/stable/";
     mirrors = [ "https://smeder.ee/~toastal/nixtamal.darcs" ];
     rev = finalAttrs.version;
-    hash = "sha256-ST90m0SF3dyGOV3Q43bJ9bGuznP0WIkQsIJXUNFNPOs=";
+    hash = "sha256-OOAulI6ZJGbbUMi68jnJQ+cJpZVQYL5F5HUfdOZ3wEs=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/oc/oci-cli/package.nix

@@ -31,14 +31,14 @@ in
 
 py.pkgs.buildPythonApplication (finalAttrs: {
   pname = "oci-cli";
-  version = "3.85.0";
+  version = "3.86.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "oracle";
     repo = "oci-cli";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-10KIrd6ZI56YiqNzmo/f5jUEp5YZF5JUN6NPzbgnq9w=";
+    hash = "sha256-bdHhM7ah1dnQYOK8TXheSqSbFZn3WgMfsfQtAT24wBM=";
   };
 
   nativeBuildInputs = [ installShellFiles ];

pkgs/by-name/oe/oelint-adv/package.nix

@@ -7,14 +7,14 @@
 
 python3Packages.buildPythonApplication (finalAttrs: {
   pname = "oelint-adv";
-  version = "9.8.2";
+  version = "9.8.4";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "priv-kweihmann";
     repo = "oelint-adv";
     tag = finalAttrs.version;
-    hash = "sha256-mZleG+NAVqjeJ66SlYYvF90XwJ4H1wlsMOQRBdH1qhM=";
+    hash = "sha256-bQFjf+BAmJKsjcjZcTc34+4bcSq4hgSBKgHRcYA1ai0=";
   };
 
   postPatch = ''

pkgs/by-name/op/opencode-desktop/package.nix

@@ -54,12 +54,6 @@ stdenvNoCC.mkDerivation (finalAttrs: {
     OPENCODE_CHANNEL = "prod";
     MODELS_DEV_API_JSON = "${models-dev}/dist/_api.json";
     OPENCODE_DISABLE_MODELS_FETCH = true;
-  }
-  # Disable code signing on macOS. Public build hosts don't have Apple Developer
-  # certificates, so electron-builder's `security find-identity` spawns produce
-  # EPERM inside the nix sandbox.
-  // lib.optionalAttrs stdenvNoCC.hostPlatform.isDarwin {
-    CSC_IDENTITY_AUTO_DISCOVERY = "false";
   };
 
   postPatch = ''

pkgs/by-name/or/orca/package.nix

@@ -128,7 +128,6 @@ python3.pkgs.buildPythonApplication (finalAttrs: {
 
       Needs `services.gnome.at-spi2-core.enable = true;` in `configuration.nix`.
     '';
-    maintainers = with lib.maintainers; [ berce ];
     teams = [ lib.teams.gnome ];
     license = lib.licenses.lgpl21;
     platforms = lib.platforms.linux;

pkgs/by-name/pj/pj/package.nix

@@ -8,13 +8,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "pj";
-  version = "1.13.0";
+  version = "1.14.0";
 
   src = fetchFromGitHub {
     owner = "josephschmitt";
     repo = "pj";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-T09puEftbgvtXKcywJcXHfI+UTKGjyFaPMr7LEHDIUQ=";
+    hash = "sha256-i6BYNKizpEE3OffkOuAShFow21sMMHPyCK5RMguXCCQ=";
   };
 
   vendorHash = "sha256-rya2afSV9Y1hmUZU0wyR9NETBl3TXD/OTHv0zvVl8v8=";

pkgs/by-name/pl/plausible/package.nix

@@ -9,23 +9,23 @@
   runCommand,
   nixosTests,
   npm-lockfile-fix,
+  cmake,
   nix-update-script,
   brotli,
-  tailwindcss_3,
   esbuild,
   buildPackages,
 }:
 
 let
   pname = "plausible";
-  version = "3.0.1";
+  version = "3.2.1";
   mixEnv = "ce";
 
   src = fetchFromGitHub {
     owner = "plausible";
     repo = "analytics";
     rev = "v${version}";
-    hash = "sha256-DQIRsqkH2zgIkb3yezuJEKJ99PS031GJ+bDAeHMLNUY=";
+    hash = "sha256-2roIj0s2cybYdGmmJSPJ5Rc1gNunxlYew9JR5xxMv+k=";
     postFetch = ''
       ${lib.getExe npm-lockfile-fix} $out/assets/package-lock.json
       sed -ie '
@@ -47,7 +47,7 @@ let
     pname = "${pname}-assets";
     inherit version;
     src = "${src}/assets";
-    npmDepsHash = "sha256-hPbKEC8DE/gb483COG/ZbTuEP8Y44Fs7ppHMpXphCjg=";
+    npmDepsHash = "sha256-grYxPRzpu3pcv3lyTQxx0RDhmgFhsOKZoYbzd701xjA=";
     dontNpmBuild = true;
     installPhase = ''
       runHook preInstall
@@ -60,7 +60,7 @@ let
     pname = "${pname}-tracker";
     inherit version;
     src = "${src}/tracker";
-    npmDepsHash = "sha256-kfqJVUw3xnMT0sOkc5O42CwBxPQXiYnOQ5WpdZwzxfE";
+    npmDepsHash = "sha256-hrsvQXvbcfRDUc1qinyUJ7Oh4yMM1e+UEdYudjYyJxk=";
     dontNpmBuild = true;
     installPhase = ''
       runHook preInstall
@@ -69,6 +69,18 @@ let
     '';
   };
 
+  # lazy_html (new dep since 3.1.0) builds a NIF against lexbor
+  # its Makefile clones lexbor at build time (which sandbox forbids)
+  # pre-seed commit in lazy_html's mix.exs so the clone target is skipped
+  # and force a build in preBuild below
+  lexborCommit = "244b84956a6dc7eec293781d051354f351274c46";
+  lexborSrc = fetchFromGitHub {
+    owner = "lexbor";
+    repo = "lexbor";
+    rev = lexborCommit;
+    hash = "sha256-Oup/lGU8a9Dqfho4Llg39t9Y9n4xfUmGk0772OkpnLQ=";
+  };
+
   mixFodDeps = beamPackages.fetchMixDeps {
     inherit
       pname
@@ -76,7 +88,7 @@ let
       src
       mixEnv
       ;
-    hash = "sha256-caCbuMEDsLcxm8xehWEJiaTfgl435crBfnQFQpzGsLY";
+    hash = "sha256-fm/elkCNpu5sduBxly06i/z30Y9BMtt+qthXmLuvlUc=";
   };
 
   mjmlNif = rustPlatform.buildRustPackage {
@@ -84,7 +96,7 @@ let
     version = "";
     src = "${mixFodDeps}/mjml/native/mjml_nif";
 
-    cargoHash = "sha256-zDWOik65PWAMpIDDcG+DibprPVW/k+Q83+fjFI5vWaY=";
+    cargoHash = "sha256-a8xSRdFtMYF0n2rl7A5ZgHoaunUJLVJwHvrkc9uyZKo=";
     doCheck = false;
 
     env = {
@@ -109,7 +121,13 @@ let
           file=''${lib##*/}
           base=''${file%.*}
           ln -s "$lib" $out/mjml/priv/native/$base.so
+          # mjml >= 4.0 loads through RustlerPrecompiled (expects NIF name w/o lib prefix)
+          ln -s "$lib" $out/mjml/priv/native/''${base#lib}.so
         done
+
+        mkdir -p $out/lazy_html/_build/c/third_party/lexbor
+        cp -r --no-preserve=mode ${lexborSrc} \
+          $out/lazy_html/_build/c/third_party/lexbor/${lexborCommit}
       '';
 
   beamPackages = beam27Packages.extend (self: super: { elixir = elixir_1_18; });
@@ -126,10 +144,22 @@ beamPackages.mixRelease rec {
   nativeBuildInputs = [
     nodejs
     brotli
+    cmake
   ];
 
+  dontUseCmakeConfigure = true;
+
   mixFodDeps = patchedMixFodDeps;
 
+  # deps are compiled in mixRelease configurePhase
+  # so the force_build switch must be in place before then
+  # preBuild would be too late
+  preConfigure = ''
+    cat >> config/config.exs <<EOF
+    config :elixir_make, :force_build, lazy_html: true
+    EOF
+  '';
+
   passthru = {
     tests = {
       inherit (nixosTests) plausible;
@@ -160,12 +190,15 @@ beamPackages.mixRelease rec {
   preBuild = ''
     rm -r assets tracker
     cp --no-preserve=mode -r ${assets} assets
-    cp -r ${tracker} tracker
+    # tracker must be writable since 3.1.0
+    # compile.js emits npm_package/plausible.js
+    cp --no-preserve=mode -r ${tracker} tracker
 
     # Fix cross-compilation with buildPackages
-    # since tailwindcss_3 is not available for RiscV
+    # since tailwindcss is not available for RiscV
+    # plausible >= 3.1.0 needs tailwind v4
     cat >> config/config.exs <<EOF
-    config :tailwind, path: "${lib.getExe buildPackages.tailwindcss_3}"
+    config :tailwind, path: "${lib.getExe buildPackages.tailwindcss_4}"
     config :esbuild, path: "${lib.getExe esbuild}"
     EOF
   '';

pkgs/by-name/pr/present-cli/package.nix

@@ -28,7 +28,7 @@ rustPlatform.buildRustPackage {
     description = "Script interpolation engine for markdown documents";
     homepage = "https://github.com/terror/present/";
     license = lib.licenses.cc0;
-    maintainers = with lib.maintainers; [ cameronfyfe ];
+    maintainers = [ ];
     mainProgram = "present";
   };
 }

pkgs/by-name/pr/prqlc/package.nix

@@ -11,16 +11,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "prqlc";
-  version = "0.13.12";
+  version = "0.13.13";
 
   src = fetchFromGitHub {
     owner = "prql";
     repo = "prql";
     tag = finalAttrs.version;
-    hash = "sha256-dVabMpXrdNV6hvUVk80mWuIpg8Vb0ZaJnrezO+FtbKg=";
+    hash = "sha256-/5z8i65WpLl06uYqu+PD/fMyajeHiECbzdgTD6D4M20=";
   };
 
-  cargoHash = "sha256-hL52k61pgqOFpn3aN8DIlx2KlaOjMVD60/x6dMkZ5Rg=";
+  cargoHash = "sha256-vQOcdDnNPC6dcHbr3GgsE/seokiormNK1oi6E9JrcTY=";
 
   nativeBuildInputs = [
     pkg-config

pkgs/by-name/pu/pulseaudio-module-xrdp/package.nix

@@ -31,11 +31,11 @@ stdenv.mkDerivation rec {
   installPhase = ''
     runHook preInstall
 
-    mkdir -p $out/lib/pulseaudio/modules $out/libexec/pulsaudio-xrdp-module $out/etc/xdg/autostart
+    mkdir -p $out/lib/pulseaudio/modules $out/libexec/pulseaudio-xrdp-module $out/etc/xdg/autostart
     install -m 755 src/.libs/*${stdenv.hostPlatform.extensions.sharedLibrary} $out/lib/pulseaudio/modules
 
-    install -m 755 instfiles/load_pa_modules.sh $out/libexec/pulsaudio-xrdp-module/pulseaudio_xrdp_init
-    substituteInPlace $out/libexec/pulsaudio-xrdp-module/pulseaudio_xrdp_init \
+    install -m 755 instfiles/load_pa_modules.sh $out/libexec/pulseaudio-xrdp-module/pulseaudio_xrdp_init
+    substituteInPlace $out/libexec/pulseaudio-xrdp-module/pulseaudio_xrdp_init \
       --replace pactl ${pulseaudio}/bin/pactl
 
     runHook postInstall

pkgs/by-name/re/redo/package.nix

@@ -32,7 +32,7 @@ stdenv.mkDerivation {
     homepage = "https://github.com/jdebp/redo";
     description = "System for building target files from source files";
     license = lib.licenses.bsd2;
-    maintainers = with lib.maintainers; [ momeemt ];
+    maintainers = [ ];
     mainProgram = "redo";
     platforms = lib.platforms.unix;
   };

pkgs/by-name/rh/rhvoice/package.nix

@@ -50,7 +50,7 @@ stdenv.mkDerivation (finalAttrs: {
     description = "Free and open source speech synthesizer for Russian language and others";
     homepage = "https://github.com/Olga-Yakovleva/RHVoice/wiki";
     license = lib.licenses.gpl3;
-    maintainers = with lib.maintainers; [ berce ];
+    maintainers = [ ];
     platforms = with lib.platforms; all;
     mainProgram = "RHVoice-test";
   };

pkgs/by-name/rm/rmapi/package.nix

@@ -24,7 +24,10 @@ buildGoModule (finalAttrs: {
     homepage = "https://github.com/ddvk/rmapi";
     changelog = "https://github.com/ddvk/rmapi/blob/v${finalAttrs.version}/CHANGELOG.md";
     license = lib.licenses.agpl3Only;
-    maintainers = [ lib.maintainers.nickhu ];
+    maintainers = with lib.maintainers; [
+      nickhu
+      boltzmannrain
+    ];
     mainProgram = "rmapi";
   };
 })

pkgs/by-name/s-/s-tui/package.nix

@@ -11,7 +11,7 @@
 
 python3Packages.buildPythonPackage (finalAttrs: {
   pname = "s-tui";
-  version = "1.3.0";
+  version = "1.4.0";
   pyproject = true;
 
   build-system = with python3Packages; [ setuptools ];
@@ -20,7 +20,7 @@ python3Packages.buildPythonPackage (finalAttrs: {
     owner = "amanusk";
     repo = "s-tui";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-B5KQz+/RG+IROJah0jq+2e94DtnILwY2aH9qulWzHns=";
+    hash = "sha256-PDDT37W0x7VJ6OnkbwvPXttphD+vHDul0zmA3VY/Sao=";
   };
 
   dependencies = [

pkgs/by-name/sa/satyrographos/package.nix

@@ -40,7 +40,7 @@ ocamlPackages.buildDunePackage {
     changelog = "https://github.com/na4zagin3/satyrographos/releases/tag/${src.rev}";
     description = "Package manager for SATySFi";
     homepage = "https://github.com/na4zagin3/satyrographos";
-    maintainers = with lib.maintainers; [ momeemt ];
+    maintainers = [ ];
     mainProgram = "satyrographos";
     license = lib.licenses.lgpl3Plus;
   };

pkgs/by-name/sa/satysfi/package.nix

@@ -95,7 +95,6 @@ ocamlPackages.buildDunePackage {
     license = lib.licenses.lgpl3Only;
     maintainers = with lib.maintainers; [
       mt-caret
-      momeemt
     ];
     platforms = lib.platforms.all;
     mainProgram = "satysfi";

pkgs/by-name/se/sendme/package.nix

@@ -27,7 +27,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
       asl20
       mit
     ];
-    maintainers = with lib.maintainers; [ cameronfyfe ];
+    maintainers = [ ];
     mainProgram = "sendme";
   };
 })

pkgs/by-name/se/serve/package.nix

@@ -2,32 +2,30 @@
   buildNpmPackage,
   fetchFromGitHub,
   lib,
-  makeWrapper,
-  nodejs,
-  pnpm_9,
+  pnpm_10,
   fetchPnpmDeps,
   pnpmConfigHook,
 }:
 buildNpmPackage (finalAttrs: {
   pname = "serve";
-  version = "14.2.4";
+  version = "14.2.6";
 
   src = fetchFromGitHub {
     owner = "vercel";
     repo = "serve";
-    tag = finalAttrs.version;
-    hash = "sha256-QVbau4MrpgEQkwlWx4tU9H93zdM0mSZgIzXpjHRM5mk=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-lM04fuzgcLHz8/Jf4wJVYXveFcO6sFyJ9PQAcpweyjk=";
   };
 
   npmDeps = null;
   pnpmDeps = fetchPnpmDeps {
     inherit (finalAttrs) pname version src;
-    pnpm = pnpm_9;
-    fetcherVersion = 3;
-    hash = "sha256-N5oasGilHECndJZYdRHZFvAa4aYwmPtOTBZtcty4g/k=";
+    pnpm = pnpm_10;
+    fetcherVersion = 4;
+    hash = "sha256-9gejKf+GqB8BPAQtQSuZsTb6jFro3X1aL1noVfyKTPg=";
   };
 
-  nativeBuildInputs = [ pnpm_9 ];
+  nativeBuildInputs = [ pnpm_10 ];
   npmConfigHook = pnpmConfigHook;
 
   dontNpmBuild = true;

pkgs/by-name/si/signal-desktop/package.nix

@@ -181,10 +181,6 @@ stdenv.mkDerivation (finalAttrs: {
     ELECTRON_SKIP_BINARY_DOWNLOAD = "1";
     SIGNAL_ENV = "production";
     SOURCE_DATE_EPOCH = 1780508208;
-  }
-  // lib.optionalAttrs stdenv.hostPlatform.isDarwin {
-    # Disable code signing during local macOS builds.
-    CSC_IDENTITY_AUTO_DISCOVERY = "false";
   };
 
   preBuild = ''

pkgs/by-name/sm/smatch/package.nix

@@ -58,7 +58,7 @@ stdenv.mkDerivation (finalAttrs: {
   meta = {
     description = "Semantic analysis tool for C";
     homepage = "https://sparse.docs.kernel.org/";
-    maintainers = with lib.maintainers; [ momeemt ];
+    maintainers = [ ];
     license = lib.licenses.gpl2Plus;
     platforms = lib.platforms.all;
   };

pkgs/by-name/sn/snyk/package.nix

@@ -43,7 +43,7 @@ buildNpmPackage {
     homepage = "https://snyk.io";
     changelog = "https://github.com/snyk/cli/releases/tag/v${version}";
     license = lib.licenses.asl20;
-    maintainers = with lib.maintainers; [ momeemt ];
+    maintainers = [ ];
     mainProgram = "snyk";
   };
 }

pkgs/by-name/sp/spectral-language-server/package.nix

@@ -102,7 +102,7 @@ buildNpmPackage {
   meta = {
     homepage = "https://github.com/luizcorreia/spectral-language-server";
     description = "Awesome Spectral JSON/YAML linter with OpenAPI/AsyncAPI support";
-    maintainers = with lib.maintainers; [ momeemt ];
+    maintainers = [ ];
     license = lib.licenses.mit;
     mainProgram = "spectral-language-server";
   };

pkgs/by-name/sp/speechd/package.nix

@@ -157,10 +157,7 @@ stdenv.mkDerivation (finalAttrs: {
       "Common interface to speech synthesis" + lib.optionalString libsOnly " - client libraries only";
     homepage = "https://devel.freebsoft.org/speechd";
     license = lib.licenses.gpl2Plus;
-    maintainers = with lib.maintainers; [
-      berce
-      jtojnar
-    ];
+    maintainers = with lib.maintainers; [ jtojnar ];
     # TODO: remove checks for `withPico` once PR #375450 is merged
     platforms = if withAlsa || withPico then lib.platforms.linux else lib.platforms.unix;
     mainProgram = "speech-dispatcher";

pkgs/by-name/st/statix/package.nix

@@ -8,16 +8,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "statix";
-  version = "0-unstable-2026-05-14";
+  version = "0.5.8-unstable-2026-06-13";
 
   src = fetchFromGitHub {
     owner = "molybdenumsoftware";
     repo = "statix";
-    rev = "f0d256d60d9b9736b274a0edc0492be472318166";
-    hash = "sha256-dylteN19qQ/MclInQ+x4vf+rBGNIsaKWJ+WgiS0ZBjI=";
+    rev = "127a42f761909e5caa79f616a353e9b6e1a0587f";
+    hash = "sha256-epwk3oW5A0ttTKSO2zgC50PkD9mTFjLtDlofTIeOdf8=";
   };
 
-  cargoHash = "sha256-lODAnIGw8MncMT5xicWORSbCChn2HQXENsOStJYHepQ=";
+  cargoHash = "sha256-bsy8p8zbfQ7EjXCDwFbVaq4qN8aEsp27Jcn9zfW2eXw=";
 
   buildFeatures = lib.optional withJson "json";
 

pkgs/by-name/st/stylelint/package.nix

@@ -26,6 +26,6 @@ buildNpmPackage rec {
     mainProgram = "stylelint";
     homepage = "https://stylelint.io";
     license = lib.licenses.mit;
-    maintainers = with lib.maintainers; [ momeemt ];
+    maintainers = [ ];
   };
 }

pkgs/by-name/su/super-productivity/package.nix

@@ -78,7 +78,6 @@ buildNpmPackage rec {
   env = {
     ELECTRON_SKIP_BINARY_DOWNLOAD = "1";
     CHROMEDRIVER_SKIP_DOWNLOAD = "true";
-    CSC_IDENTITY_AUTO_DISCOVERY = "false";
   };
 
   nativeBuildInputs = [ copyDesktopItems ];

pkgs/by-name/su/superfile/package.nix

@@ -51,7 +51,6 @@ buildGoModule {
     changelog = "https://github.com/yorukot/superfile/blob/${tag}/changelog.md";
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [
-      momeemt
       redyf
     ];
     mainProgram = "superfile";

pkgs/by-name/sy/syncthing/package.nix

@@ -22,16 +22,16 @@ assert builtins.elem target [
 
 buildGoModule (finalAttrs: {
   pname = "syncthing";
-  version = "2.0.15";
+  version = "2.1.0";
 
   src = fetchFromGitHub {
     owner = "syncthing";
     repo = "syncthing";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-v77ovjV+UoCRA1GteP+HDqC8dsRvtOhFX/IkSgSIf8Y=";
+    hash = "sha256-sTtFmZBPJIHMksaFFLmA3Abt9EhAC8Nz/ibdzg2LMd4=";
   };
 
-  vendorHash = "sha256-boYTLgvH+iWlh3y3Z0LPvSVGEget3X94AthtJKphhCw=";
+  vendorHash = "sha256-rOsdg98WVAKqjV7AxH+m4oSf8Z4FPru4NSbgGFtUMVE=";
 
   nativeBuildInputs = lib.optionals stdenv.hostPlatform.isDarwin [
     # Recent versions of macOS seem to require binaries to be signed when
@@ -119,6 +119,7 @@ buildGoModule (finalAttrs: {
     maintainers = with lib.maintainers; [
       joko
       peterhoeg
+      zainkergaye
     ];
     mainProgram = target;
     platforms = lib.platforms.unix;

pkgs/by-name/te/teams-for-linux/package.nix

@@ -37,11 +37,7 @@ buildNpmPackage rec {
 
   doInstallCheck = stdenv.hostPlatform.isLinux;
 
-  env = {
-    # disable code signing on Darwin
-    CSC_IDENTITY_AUTO_DISCOVERY = "false";
-    ELECTRON_SKIP_BINARY_DOWNLOAD = "1";
-  };
+  env.ELECTRON_SKIP_BINARY_DOWNLOAD = "1";
 
   makeCacheWritable = true;
 

pkgs/by-name/tf/tflint/package.nix

@@ -61,6 +61,6 @@ buildGo125Module (finalAttrs: {
     homepage = "https://github.com/terraform-linters/tflint";
     changelog = "https://github.com/terraform-linters/tflint/blob/v${finalAttrs.version}/CHANGELOG.md";
     license = lib.licenses.mpl20;
-    maintainers = with lib.maintainers; [ momeemt ];
+    maintainers = [ ];
   };
 })