Merge master into staging-next

.github/workflows/build.yml

@@ -52,7 +52,7 @@ jobs:
         with:
           merged-as-untrusted-at: ${{ inputs.mergedSha }}
 
-      - uses: cachix/install-nix-action@fc6e360bedc9ee72d75e701397f0bb30dce77568 # v31
+      - uses: cachix/install-nix-action@56a7bb7b56d9a92d4fd1bc05758de7eea4a370a8 # v31
         with:
           # Sandbox is disabled on MacOS by default.
           extra_nix_config: sandbox = true

.github/workflows/check.yml

@@ -96,7 +96,7 @@ jobs:
           merged-as-untrusted-at: ${{ inputs.mergedSha }}
           target-as-trusted-at: ${{ inputs.targetSha }}
 
-      - uses: cachix/install-nix-action@fc6e360bedc9ee72d75e701397f0bb30dce77568 # v31
+      - uses: cachix/install-nix-action@56a7bb7b56d9a92d4fd1bc05758de7eea4a370a8 # v31
 
       - uses: cachix/cachix-action@0fc020193b5a1fa3ac4575aa3a7d3aa6a35435ad # v16
         with:

.github/workflows/eval.yml

@@ -47,7 +47,7 @@ jobs:
             ci/pinned.json
 
       - name: Install Nix
-        uses: cachix/install-nix-action@fc6e360bedc9ee72d75e701397f0bb30dce77568 # v31
+        uses: cachix/install-nix-action@56a7bb7b56d9a92d4fd1bc05758de7eea4a370a8 # v31
 
       - name: Load supported versions
         id: versions
@@ -92,7 +92,7 @@ jobs:
           target-as-trusted-at: ${{ inputs.targetSha }}
 
       - name: Install Nix
-        uses: cachix/install-nix-action@fc6e360bedc9ee72d75e701397f0bb30dce77568 # v31
+        uses: cachix/install-nix-action@56a7bb7b56d9a92d4fd1bc05758de7eea4a370a8 # v31
 
       - uses: cachix/cachix-action@0fc020193b5a1fa3ac4575aa3a7d3aa6a35435ad # v16
         with:
@@ -190,7 +190,7 @@ jobs:
           merge-multiple: true
 
       - name: Install Nix
-        uses: cachix/install-nix-action@fc6e360bedc9ee72d75e701397f0bb30dce77568 # v31
+        uses: cachix/install-nix-action@56a7bb7b56d9a92d4fd1bc05758de7eea4a370a8 # v31
 
       - name: Combine all output paths and eval stats
         run: |
@@ -350,7 +350,7 @@ jobs:
           merged-as-untrusted-at: ${{ inputs.mergedSha }}
 
       - name: Install Nix
-        uses: cachix/install-nix-action@fc6e360bedc9ee72d75e701397f0bb30dce77568 # v31
+        uses: cachix/install-nix-action@56a7bb7b56d9a92d4fd1bc05758de7eea4a370a8 # v31
 
       - name: Run misc eval tasks in parallel
         run: |

.github/workflows/lint.yml

@@ -32,7 +32,7 @@ jobs:
         with:
           merged-as-untrusted-at: ${{ inputs.mergedSha }}
 
-      - uses: cachix/install-nix-action@fc6e360bedc9ee72d75e701397f0bb30dce77568 # v31
+      - uses: cachix/install-nix-action@56a7bb7b56d9a92d4fd1bc05758de7eea4a370a8 # v31
 
       # TODO: Figure out how to best enable caching for the treefmt job. Cachix won't work well,
       # because the cache would be invalidated on every commit - treefmt checks every file.
@@ -66,7 +66,7 @@ jobs:
         with:
           merged-as-untrusted-at: ${{ inputs.mergedSha }}
 
-      - uses: cachix/install-nix-action@fc6e360bedc9ee72d75e701397f0bb30dce77568 # v31
+      - uses: cachix/install-nix-action@56a7bb7b56d9a92d4fd1bc05758de7eea4a370a8 # v31
 
       - uses: cachix/cachix-action@0fc020193b5a1fa3ac4575aa3a7d3aa6a35435ad # v16
         with:
@@ -94,7 +94,7 @@ jobs:
           merged-as-untrusted-at: ${{ inputs.mergedSha }}
           target-as-trusted-at: ${{ inputs.targetSha }}
 
-      - uses: cachix/install-nix-action@fc6e360bedc9ee72d75e701397f0bb30dce77568 # v31
+      - uses: cachix/install-nix-action@56a7bb7b56d9a92d4fd1bc05758de7eea4a370a8 # v31
 
       - uses: cachix/cachix-action@0fc020193b5a1fa3ac4575aa3a7d3aa6a35435ad # v16
         with:

.github/workflows/reviewers.yml

@@ -33,7 +33,7 @@ jobs:
           sparse-checkout: ci
 
       - name: Install Nix
-        uses: cachix/install-nix-action@fc6e360bedc9ee72d75e701397f0bb30dce77568 # v31
+        uses: cachix/install-nix-action@56a7bb7b56d9a92d4fd1bc05758de7eea4a370a8 # v31
 
       - name: Build the requestReviews derivation
         run: nix-build trusted/ci -A requestReviews

CONTRIBUTING.md

@@ -91,7 +91,7 @@ This section describes how changes can be proposed with a pull request (PR).
 
 6. [Create a pull request](https://docs.github.com/en/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/creating-a-pull-request#creating-the-pull-request) from the new branch in your Nixpkgs fork to the upstream Nixpkgs repository.
    Use the branch from step 1 as the PR's base branch.
-   Go through the [pull request template](#pull-request-template).
+   Go through the [pull request template][pr-template].
 
 7. Respond to review comments and potentially to CI failures and merge conflicts by updating the PR.
    Always keep it in a mergeable state.
@@ -526,8 +526,23 @@ While this potentially can be understood by reading code, PR discussion or upstr
 Simple package version updates need to include the attribute name, old and new versions, as well as a reference to the release notes or changelog.
 Package upgrades with more extensive changes require more verbose commit messages.
 
-Pull requests should not be squash-merged, as this discards information including detail from commit messages, GPG signatures, and authorship.
-Many pull requests don't make sense as a single commit anyway.
+## Review and Merge conventions
+
+Comments on Pull Requests are considered non-blocking by default.
+Every blocking comment must be explicitly marked as such by using GitHub's "Request Changes" review type.
+A reviewer who submits a blocking review should be available for discussion and re-review.
+An abandoned review may be dismissed after reasonable time was given at the discretion of the merger.
+
+All suggestions for change, blocking or not, should be acknowledged before merge.
+This can happen implicitly by applying the suggestion, or explicitly by rejecting it.
+
+To make changes on commit structure and commit messages or apply simple suggestions, committers are encouraged to [checkout the PR](https://cli.github.com/manual/gh_pr_checkout) and push directly to the contributor's branch before merging.
+Committers will carefully weigh the cost of another review cycle against the feelings of the contributor when pushing to their branch.
+They should also transparently communicate which changes they made.
+If a contributor does not want committers to push to their branch, they must uncheck the "Allow edits and access to secrets by maintainers" box explicitly.
+
+> [!WARNING]
+> Committers: Branches created via `gh pr checkout` can't be pushed with `--force-with-lease`, so do a sanity check before pushing.
 
 ## Code conventions
 [code-conventions]: #code-conventions

lib/attrsets.nix

@@ -2085,10 +2085,8 @@ rec {
   dontRecurseIntoAttrs = attrs: attrs // { recurseForDerivations = false; };
 
   /**
-    `unionOfDisjoint x y` is equal to `x // y // z` where the
-    attrnames in `z` are the intersection of the attrnames in `x` and
-    `y`, and all values `assert` with an error message.  This
-     operator is commutative, unlike (//).
+    `unionOfDisjoint x y` is equal to `x // y`, but accessing attributes present
+    in both `x` and `y` will throw an error.  This operator is commutative, unlike `//`.
 
     # Inputs
 

lib/tests/maintainer-module.nix

@@ -7,6 +7,12 @@ in
     name = lib.mkOption {
       type = types.str;
     };
+    github = lib.mkOption {
+      type = types.str;
+    };
+    githubId = lib.mkOption {
+      type = types.ints.unsigned;
+    };
     email = lib.mkOption {
       type = types.nullOr types.str;
       default = null;
@@ -15,14 +21,6 @@ in
       type = types.nullOr types.str;
       default = null;
     };
-    github = lib.mkOption {
-      type = types.nullOr types.str;
-      default = null;
-    };
-    githubId = lib.mkOption {
-      type = types.nullOr types.ints.unsigned;
-      default = null;
-    };
     keys = lib.mkOption {
       type = types.listOf (
         types.submodule {

maintainers/README.md

@@ -34,15 +34,15 @@ In order to do so, add yourself to the [`maintainer-list.nix`](./maintainer-list
 If you're adding yourself as a maintainer as part of another PR (in which you become a maintainer of a package, for example), make your change to
 `maintainer-list.nix` in a separate commit titled `maintainers: add <name>`.
 
-### How to lose maintainer status
+### Losing maintainer status
 
-Maintainers who have become inactive on a given package can be removed.
+Maintainers who have become inactive can be removed.
 This helps us keep an accurate view of the state of maintenance in Nixpkgs.
 
 The inactivity measure is currently not strictly enforced.
 We would typically look at it if we notice that the author hasn't reacted to package-related notifications for more than 3 months.
 
-Removing the maintainer happens by making a PR on the package, adding that person as a reviewer, and then waiting a week for a reaction.
+Removing the maintainer happens by making a PR, adding that person as a reviewer, and then waiting a week for a reaction.
 
 The maintainer is welcome to come back at any time.
 

maintainers/maintainer-list.nix

@@ -1,5 +1,5 @@
 /*
-  List of NixOS maintainers.
+  List of active NixOS maintainers.
    ```nix
    handle = {
      # Required
@@ -9452,10 +9452,6 @@
     githubId = 47015416;
     name = "globule655";
   };
-  gm6k = {
-    email = "nix@quidecco.pl";
-    name = "Isidor Zeuner";
-  };
   gmacon = {
     name = "George Macon";
     matrix = "@gmacon:matrix.org";
@@ -12473,6 +12469,12 @@
     githubId = 42128690;
     name = "John Olheiser";
   };
+  JollyDevelopment = {
+    name = "Alan Roberts";
+    email = "jolly.development@gmail.com";
+    github = "JollyDevelopment";
+    githubId = 6932224;
+  };
   jonaenz = {
     name = "Jona Enzinger";
     email = "5xt3zyy5l@mozmail.com";
@@ -26078,6 +26080,8 @@
   };
   tomkoid = {
     email = "tomaszierl@outlook.com";
+    github = "tomkoid";
+    githubId = 67477750;
     name = "Tomkoid";
   };
   Tommimon = {

maintainers/team-list.nix

@@ -799,7 +799,6 @@ with lib.maintainers;
     members = [
       aanderse
       adamcstephens
-      jnsgruk
       megheaiulian
       mkg20001
     ];

nixos/doc/manual/release-notes/rl-2505.section.md

@@ -32,6 +32,8 @@ Alongside many enhancements to NixOS modules and general system improvements, th
   inputs.nixpkgs.url = "https://channels.nixos.org/nixos-25.05/nixexprs.tar.xz";
   ```
 
+- Syncthing has been updated to version 2.0.0.
+
 <!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->
 
 ## New Modules {#sec-release-25.05-new-modules}

nixos/doc/manual/release-notes/rl-2511.section.md

@@ -102,6 +102,8 @@
 
 - [KMinion](https://github.com/redpanda-data/kminion), feature-rich Prometheus exporter for Apache Kafka. Available as [services.prometheus.exporters.kafka](options.html#opt-services.prometheus.exporters.kafka).
 
+- [Spoolman](https://github.com/Donkie/Spoolman), a inventory management system for Filament spools. Available as [services.spoolman](#opt-services.spoolman.enable).
+
 - [Temporal](https://temporal.io/), a durable execution platform that enables
   developers to build scalable applications without sacrificing productivity or
   reliability. Available as [services.temporal](#opt-services.temporal.enable).

nixos/modules/module-list.nix

@@ -930,6 +930,7 @@
   ./services/misc/spice-autorandr.nix
   ./services/misc/spice-vdagentd.nix
   ./services/misc/spice-webdavd.nix
+  ./services/misc/spoolman.nix
   ./services/misc/sssd.nix
   ./services/misc/subsonic.nix
   ./services/misc/sundtek.nix

nixos/modules/services/misc/spoolman.nix

@@ -0,0 +1,84 @@
+{
+  lib,
+  pkgs,
+  config,
+  ...
+}:
+let
+  cfg = config.services.spoolman;
+in
+{
+
+  options.services.spoolman = {
+
+    enable = lib.mkEnableOption "Spoolman, a filament spool inventory management system.";
+
+    environment = lib.mkOption {
+      type = lib.types.attrs;
+      default = { };
+      example = {
+        SPOOLMAN_DB_TYPE = "sqlite";
+        SPOOLMAN_LOGGING_LEVEL = "DEBUG";
+        SPOOLMAN_AUTOMATIC_BACKUP = "TRUE";
+        SPOOLMAN_BASE_PATH = "/spoolman";
+        SPOOLMAN_METRICS_ENABLED = "TRUE";
+        SPOOLMAN_CORS_ORIGIN = "source1.domain.com:p1, source2.domain.com:p2";
+      };
+      description = ''
+        Environment variables to be passed to the spoolman service.
+        Refer to https://github.com/Donkie/Spoolman/blob/master/.env.example for details on supported variables.
+      '';
+    };
+
+    openFirewall = lib.mkOption {
+      type = lib.types.bool;
+      default = false;
+      description = ''
+        Open the appropriate ports in the firewall for spoolman.
+      '';
+    };
+
+    listen = lib.mkOption {
+      type = lib.types.str;
+      default = "127.0.0.1";
+      example = "0.0.0.0";
+      description = "The IP address to bind the spoolman server to.";
+    };
+
+    port = lib.mkOption {
+      type = lib.types.port;
+      default = 7912;
+      description = ''
+        TCP port where spoolman web-gui listens.
+      '';
+    };
+
+  };
+
+  config = lib.mkIf cfg.enable {
+
+    systemd.services.spoolman = {
+      description = "A self-hosted filament spool inventory management system";
+      wantedBy = [ "multi-user.target" ];
+      environment = {
+        SPOOLMAN_DIR_DATA = "/var/lib/spoolman";
+      }
+      // cfg.environment;
+      serviceConfig = lib.mkMerge [
+        {
+          DynamicUser = true;
+          ExecStart = "${pkgs.spoolman}/bin/spoolman --host ${cfg.listen} --port ${toString cfg.port}";
+          StateDirectory = "spoolman";
+        }
+      ];
+    };
+
+    networking.firewall = lib.mkIf cfg.openFirewall {
+      allowedTCPPorts = lib.optional (cfg.listen != "127.0.0.1") cfg.port;
+    };
+
+  };
+  meta = {
+    maintainers = with lib.maintainers; [ MayNiklas ];
+  };
+}

nixos/modules/services/networking/syncthing.nix

@@ -894,14 +894,19 @@ in
                   install -Dm600 -o ${cfg.user} -g ${cfg.group} ${toString cfg.key} ${cfg.configDir}/key.pem
                 ''}
               ''}";
-          ExecStart = ''
-            ${cfg.package}/bin/syncthing \
-              -no-browser \
-              -gui-address=${if isUnixGui then "unix://" else ""}${cfg.guiAddress} \
-              -config=${cfg.configDir} \
-              -data=${cfg.databaseDir} \
-              ${escapeShellArgs cfg.extraFlags}
-          '';
+          ExecStart =
+            let
+              args = lib.escapeShellArgs (
+                (lib.cli.toGNUCommandLine { } {
+                  "no-browser" = true;
+                  "gui-address" = (if isUnixGui then "unix://" else "") + cfg.guiAddress;
+                  "config" = cfg.configDir;
+                  "data" = cfg.databaseDir;
+                })
+                ++ cfg.extraFlags
+              );
+            in
+            "${lib.getExe cfg.package} ${args}";
           MemoryDenyWriteExecute = true;
           NoNewPrivileges = true;
           PrivateDevices = true;

nixos/modules/system/boot/loader/limine/limine-install.py

@@ -16,6 +16,15 @@ import sys
 import tempfile
 import textwrap
 
+@dataclass
+class XenBootSpec:
+    """Represent the bootspec extension for Xen dom0 kernels"""
+
+    efiPath: str
+    multibootPath: str
+    params: List[str]
+    version: str
+
 @dataclass
 class BootSpec:
     system: str
@@ -25,6 +34,7 @@ class BootSpec:
     label: str
     toplevel: str
     specialisations: Dict[str, "BootSpec"]
+    xen: XenBootSpec | None
     initrd: str | None = None
     initrdSecrets: str | None = None
 
@@ -129,11 +139,136 @@ def get_kernel_uri(kernel_path: str) -> str:
 def bootjson_to_bootspec(bootjson: dict) -> BootSpec:
     specialisations = bootjson['org.nixos.specialisation.v1']
     specialisations = {k: bootjson_to_bootspec(v) for k, v in specialisations.items()}
+    xen = None
+    if 'org.xenproject.bootspec.v2' in bootjson:
+        xen = bootjson['org.xenproject.bootspec.v2']
     return BootSpec(
         **bootjson['org.nixos.bootspec.v1'],
         specialisations=specialisations,
+        xen=xen,
     )
 
+def generate_xen_efi_files(
+        bootspec: BootSpec,
+        gen: str
+        ) -> str:
+    """Generate a Xen EFI xen.cfg file, and copy required files in place.
+
+    Assumes the bootspec has already been validated as having the requried
+    Xen keys.
+
+    Arguments:
+    bootspec -- the NixOS BootSpec requiring Xen EFI configuration
+    gen -- The system generation requiring Xen EFI configuration
+
+    Returns the path to the Xen EFI binary
+    """
+
+    xen_efi_boot_path = get_copied_path_uri(bootspec.xen['efiPath'], f'xen/{gen}')
+    xen_efi_path = get_dest_path(bootspec.xen['efiPath'], f'xen/{gen}')
+
+    xen_efi_cfg_dir = os.path.dirname(xen_efi_path)
+    xen_efi_cfg_path = xen_efi_path[:-4] + '.cfg'
+
+    if not os.path.exists(xen_efi_cfg_dir):
+        os.makedirs(xen_efi_cfg_dir)
+
+    xen_efi_cfg = (
+        f'default=nixos{gen}\n\n' +
+        f'[nixos{gen}]\n'
+        )
+    # set xen dom0 parameters
+    if 'params' in bootspec.xen and len(bootspec.xen['params']) > 0:
+        xen_efi_cfg += 'options=' + ' '.join(bootspec.xen['params']).strip() + '\n'
+
+    # set kernel and copy in-place
+    xen_efi_kernel_path = get_dest_path(bootspec.kernel, f'xen/{gen}')
+    copy_file(bootspec.kernel, xen_efi_kernel_path)
+    xen_efi_cfg += (
+        'kernel=' + os.path.basename(xen_efi_kernel_path) + ' '
+        + ' '.join(['init=' + bootspec.init] + bootspec.kernelParams).strip()
+        + '\n'
+    )
+
+    # set ramdisk and copy initrd in-place
+    if bootspec.initrd:
+        xen_efi_initrd_path = get_dest_path(bootspec.initrd, f'xen/{gen}')
+        copy_file(bootspec.initrd, xen_efi_initrd_path)
+        xen_efi_cfg += 'ramdisk=' + os.path.basename(xen_efi_initrd_path) + '\n'
+
+    with open(xen_efi_cfg_path, 'w') as xen_efi_cfg_file:
+        xen_efi_cfg_file.write(xen_efi_cfg)
+
+    return xen_efi_boot_path
+
+def xen_config_entry(
+    levels: int, bootspec: BootSpec, xenVersion: str, gen: str, time: str, efi: bool
+) -> str:
+    """Generate EFI and BIOS entries for Xen dom0 kernels.
+
+    Arguments:
+    levels -- The number of Limine menu levels for entries
+    bootspec -- The NixOS BootSpec used for generating this Limine configuration
+    xenVersion -- The version of Xen the entry is generated for, from the boot extension
+    gen -- The system generation these entries are generated for
+    time -- The build time for the configuration
+    efi -- True if EFI protocol should be used for this entry
+    """
+    # generate Xen menu label for the current generation
+    entry = '/' * levels + f'Generation {gen} with Xen {xenVersion}' + (' EFI\n' if efi else '\n')
+    entry += f'comment: Xen {xenVersion} {bootspec.label}, built on {time}\n'
+    # load Xen dom0 as the executable, using multiboot for EFI & BIOS
+    if (
+            efi and
+            'multibootPath' in bootspec.xen and
+            len(bootspec.xen['multibootPath']) > 0 and
+            os.path.exists(bootspec.xen['multibootPath'])
+        ):
+        # Use the EFI protocol and generate Xen EFI configuration
+        # files and directories which are loaded by Xen's EFI binary
+        # directly.
+        # Ideally both EFI and BIOS booting would use multiboot2,
+        # however Limine's multiboot2 module has trouble finding
+        # an entry-point in Xen's multiboot binary, and multiboot1
+        # doesn't work under EFI.
+        # Upstream Limine issue #482
+        entry += 'protocol: efi\n'
+        entry += (
+            'path: ' + generate_xen_efi_files(bootspec, gen) + '\n'
+        )
+    elif (
+            'multibootPath' in bootspec.xen and
+            len(bootspec.xen['multibootPath']) > 0 and
+            os.path.exists(bootspec.xen['multibootPath'])
+        ):
+        # Use multiboot1 if not generating an EFI entry, as multiboot2
+        # doesn't work under Limine for booting Xen.
+        # Upstream Limine issue #483
+        entry += 'protocol: multiboot\n'
+        entry += (
+            'path: ' + get_copied_path_uri(bootspec.xen['multibootPath'], f'xen/{gen}') + '\n'
+        )
+        # set params as the multiboot executable's parameters
+        if 'params' in bootspec.xen and len(bootspec.xen['params']) > 0:
+            # TODO: Understand why the first argument is ignored below?
+            # --- to work around first argument being ignored
+            entry += (
+                'cmdline: -- ' + ' '.join(bootspec.xen['params']).strip() + '\n'
+            )
+        # load the linux kernel as the second module
+        entry += 'module_path: ' + get_kernel_uri(bootspec.kernel) + '\n'
+        # set kernel parameters as the parameters to the first module
+        # TODO: Understand why the first argument is ignored below?
+        # --- to work around first argument being ignored
+        entry += (
+            'module_string: -- '
+            + ' '.join(['init=' + bootspec.init] + bootspec.kernelParams).strip()
+            + '\n'
+        )
+        if bootspec.initrd:
+            # the final module is the initrd
+            entry += 'module_path: ' + get_kernel_uri(bootspec.initrd) + '\n'
+    return entry
 
 def config_entry(levels: int, bootspec: BootSpec, label: str, time: str) -> str:
     entry = '/' * levels + label + '\n'
@@ -175,6 +310,13 @@ def generate_config_entry(profile: str, gen: str, special: bool) -> str:
     depth = 2
     entry = ""
 
+    # Xen, if configured, should be listed first for each generation
+    if boot_spec.xen and 'version' in boot_spec.xen:
+        xen_version = boot_spec.xen['version']
+        if config('efiSupport'):
+            entry += xen_config_entry(2, boot_spec, xen_version, gen, time, True)
+        entry += xen_config_entry(2, boot_spec, xen_version, gen, time, False)
+
     if len(specialisation_list) > 0:
         depth += 1
         entry += '/' * (depth-1)
@@ -189,6 +331,7 @@ def generate_config_entry(profile: str, gen: str, special: bool) -> str:
 
     for spec, spec_boot_spec in specialisation_list:
         entry += config_entry(depth, spec_boot_spec, f'{spec}', str(time))
+
     return entry
 
 
@@ -273,6 +416,13 @@ def install_bootloader() -> None:
             for file in files:
                 paths[os.path.join(dir, file)] = False
 
+    limine_xen_dir = os.path.join(limine_install_dir, 'xen')
+    if os.path.exists(limine_xen_dir):
+        print(f'cleaning {limine_xen_dir}')
+        shutil.rmtree(limine_xen_dir)
+
+    os.makedirs(limine_xen_dir)
+
     profiles = [('system', get_gens())]
 
     for profile in get_profiles():
@@ -482,7 +632,7 @@ def install_bootloader() -> None:
 
     print("removing unused boot files...")
     for path in paths:
-        if not paths[path]:
+        if not paths[path] and os.path.exists(path):
             os.remove(path)
 
 def main() -> None:

nixos/modules/system/boot/plymouth.nix

@@ -75,6 +75,20 @@ let
         exit 1
     fi
   '';
+
+  # 'emergency.serivce' and 'rescue.service' have
+  # 'ExecStartPre=-plymouth quit --wait', but 'plymouth' is not on
+  # their 'ExecSearchPath'. We could set 'ExecSearchPath', but it
+  # overrides 'DefaultEnvironment=PATH=...', which is trouble for the
+  # initrd shell. It's simpler to just reset 'ExecStartPre' with an
+  # empty string and then set it to exactly what we want.
+  preStartQuitFixup = {
+    serviceConfig.ExecStartPre = [
+      ""
+      "${plymouth}/bin/plymouth quit --wait"
+    ];
+  };
+
 in
 
 {
@@ -176,12 +190,15 @@ in
     systemd.services.plymouth-poweroff.wantedBy = [ "poweroff.target" ];
     systemd.services.plymouth-reboot.wantedBy = [ "reboot.target" ];
     systemd.services.plymouth-read-write.wantedBy = [ "sysinit.target" ];
-    systemd.services.systemd-ask-password-plymouth.wantedBy = [ "multi-user.target" ];
-    systemd.paths.systemd-ask-password-plymouth.wantedBy = [ "multi-user.target" ];
+    systemd.services.systemd-ask-password-plymouth.wantedBy = [ "sysinit.target" ];
+    systemd.paths.systemd-ask-password-plymouth.wantedBy = [ "sysinit.target" ];
 
     # Prevent Plymouth taking over the screen during system updates.
     systemd.services.plymouth-start.restartIfChanged = false;
 
+    systemd.services.rescue = preStartQuitFixup;
+    systemd.services.emergency = preStartQuitFixup;
+
     boot.initrd.systemd = {
       extraBin.plymouth = "${plymouth}/bin/plymouth"; # for the recovery shell
       storePaths = [
@@ -190,6 +207,10 @@ in
         "${plymouth}/sbin/plymouthd"
       ];
       packages = [ plymouth ]; # systemd units
+
+      services.rescue = preStartQuitFixup;
+      services.emergency = preStartQuitFixup;
+
       contents = {
         # Files
         "/etc/plymouth/plymouthd.conf".source = configFile;

nixos/modules/virtualisation/xen-boot-builder.sh

@@ -3,14 +3,15 @@
 
 export LC_ALL=C
 
-# Handle input argument and exit if the flag is invalid. See virtualisation.xen.efi.bootBuilderVerbosity below.
-[[ $# -ne 1 ]] && echo -e "\e[1;31merror:\e[0m xenBootBuilder must be called with exactly one verbosity argument. See the \e[1;34mvirtualisation.xen.efi.bootBuilderVerbosity\e[0m option." && exit 1
+# Handle input argument and exit if the flag is invalid. See virtualisation.xen.boot.builderVerbosity below.
+[[ $# -ne 1 ]] && echo -e "\e[1;31merror:\e[0m xenBootBuilder must be called with exactly one verbosity argument. See the \e[1;34mvirtualisation.xen.boot.builderVerbosity\e[0m option." && exit 1
+
 case "$1" in
     "quiet") true ;;
     "default" | "info") echo -n "Installing Xen Project Hypervisor boot entries..." ;;
     "debug") echo -e "\e[1;34mxenBootBuilder:\e[0m called with the '$1' flag" ;;
     *)
-        echo -e "\e[1;31merror:\e[0m xenBootBuilder was called with an invalid argument. See the \e[1;34mvirtualisation.xen.efi.bootBuilderVerbosity\e[0m option."
+        echo -e "\e[1;31merror:\e[0m xenBootBuilder was called with an invalid argument. See the \e[1;34mvirtualisation.xen.boot.builderVerbosity\e[0m option."
         exit 2
         ;;
 esac
@@ -46,8 +47,26 @@ for gen in "${gens[@]}"; do
 
     # We do nothing if the Bootspec for the current $gen does not contain the Xen
     # extension, which is added as a configuration attribute below.
+    # We determine this by checking for the v1 or v2 bootspec extension,
+    # and setting the appropriate attributes based on version
+    xenSpecVer=""
+    xenParamVar=""
+    xenEfiPath=""
     if grep -sq '"org.xenproject.bootspec.v1"' "$bootspecFile"; then
-        [ "$1" = "debug" ] && echo -e "                \e[1;32msuccess:\e[0m found Xen entries in $gen."
+        xenSpecVer="v1"
+        xenParamVar="xenParams"
+        xenEfiPath="xen"
+    fi
+    # We prefer the v2 extension, so if both are present somehow,
+    # we will use the v2 attributes
+    if grep -sq '"org.xenproject.bootspec.v2"' "$bootspecFile"; then
+        xenSpecVer="v2"
+        xenParamVar="params"
+        xenEfiPath="efiPath"
+    fi
+    # Check for a valid Xen spec being detected
+    if [ -n "$xenSpecVer" ]; then
+        [ "$1" = "debug" ] && echo -e "                \e[1;32msuccess:\e[0m found $xenSpecVer Xen entries in $gen."
 
         # TODO: Support DeviceTree booting. Xen has some special handling for DeviceTree
         # attributes, which will need to be translated in a boot script similar to this
@@ -63,7 +82,7 @@ for gen in "${gens[@]}"; do
         # the corresponding nixos generation, substituting `nixos` with `xen`:
         # `xen-$profile-generation-$number-specialisation-$specialisation.{cfg,conf}`
         xenGen=$(echo "$gen" | sed 's_/loader/entries/nixos_/loader/entries/xen_g;s_^.*/xen_xen_g;s_.conf$__g')
-        bootParams=$(jq -re '."org.xenproject.bootspec.v1".xenParams | join(" ")' "$bootspecFile")
+        bootParams=$(jq -re ".\"org.xenproject.bootspec.$xenSpecVer\".$xenParamVar | join(\" \")" "$bootspecFile")
         kernel=$(jq -re '."org.nixos.bootspec.v1".kernel | sub("^/nix/store/"; "") | sub("/bzImage"; "-bzImage.efi")' "$bootspecFile")
         kernelParams=$(jq -re '."org.nixos.bootspec.v1".kernelParams | join(" ")' "$bootspecFile")
         initrd=$(jq -re '."org.nixos.bootspec.v1".initrd | sub("^/nix/store/"; "") | sub("/initrd"; "-initrd.efi")' "$bootspecFile")
@@ -90,7 +109,7 @@ EOF
         # Create Xen UKI for $generation. Most of this is lifted from
         # https://xenbits.xenproject.org/docs/unstable/misc/efi.html.
         [ "$1" = "debug" ] && echo -e "\e[1;34mxenBootBuilder:\e[0m making Xen UKI..."
-        xenEfi=$(jq -re '."org.xenproject.bootspec.v1".xen' "$bootspecFile")
+        xenEfi=$(jq -re ".\"org.xenproject.bootspec.$xenSpecVer\".$xenEfiPath" "$bootspecFile")
         finalSection=$(objdump --header --wide "$xenEfi" | tail -n +6 | sort --key="4,4" | tail -n 1 | grep -Eo '\.[a-z]*')
         padding=$(objdump --header --section="$finalSection" "$xenEfi" | awk -v section="$finalSection" '$0 ~ section { printf("0x%016x\n", and(strtonum("0x"$3) + strtonum("0x"$4) + 0xfff, compl(0xfff)))};')
         [ "$1" = "debug" ] && echo "               - padding: $padding"
@@ -133,8 +152,8 @@ mapfile -t postGenerations < <(find "$efiMountPoint"/loader/entries -type f -nam
 # any hypervisor boot entries.
 if ((${#postGenerations[@]} == 0)); then
     case "$1" in
-        "default" | "info") echo "none found." && echo -e "If you believe this is an error, set the \e[1;34mvirtualisation.xen.efi.bootBuilderVerbosity\e[0m option to \e[1;34m\"debug\"\e[0m and rebuild to print debug logs." ;;
-        "debug") echo -e "\e[1;34mxenBootBuilder:\e[0m wrote \e[1;31mno generations\e[0m. Most likely, there were no generations with a valid \e[1;34morg.xenproject.bootspec.v1\e[0m entry." ;;
+        "default" | "info") echo "none found." && echo -e "If you believe this is an error, set the \e[1;34mvirtualisation.xen.boot.builderVerbosity\e[0m option to \e[1;34m\"debug\"\e[0m and rebuild to print debug logs." ;;
+        "debug") echo -e "\e[1;34mxenBootBuilder:\e[0m wrote \e[1;31mno generations\e[0m. Most likely, there were no generations with a valid \e[1;34morg.xenproject.bootspec.v1\e[0m or \e[1;34morg.xenproject.bootspec.v2\e[0m entry." ;;
     esac
 
 # If the script is successful, change the default boot, say "done.", write a

nixos/modules/virtualisation/xen-dom0.nix

@@ -51,7 +51,7 @@ let
         gnused
         jq
       ])
-      ++ optionals (cfg.efi.bootBuilderVerbosity == "info") (
+      ++ optionals (cfg.boot.builderVerbosity == "info") (
         with pkgs;
         [
           bat
@@ -146,6 +146,48 @@ in
         "path"
       ]
     )
+    (mkRenamedOptionModule
+      [
+        "virtualisation"
+        "xen"
+        "efi"
+        "bootBuilderVerbosity"
+      ]
+      [
+        "virtualisation"
+        "xen"
+        "boot"
+        "builderVerbosity"
+      ]
+    )
+    (mkRenamedOptionModule
+      [
+        "virtualisation"
+        "xen"
+        "bootParams"
+      ]
+      [
+        "virtualisation"
+        "xen"
+        "boot"
+        "params"
+      ]
+    )
+    (mkRenamedOptionModule
+      [
+        "virtualisation"
+        "xen"
+        "efi"
+        "path"
+      ]
+      [
+        "virtualisation"
+        "xen"
+        "boot"
+        "efi"
+        "path"
+      ]
+    )
   ];
 
   ## Interface ##
@@ -178,25 +220,24 @@ in
       };
     };
 
-    bootParams = mkOption {
-      default = [ ];
-      example = ''
-        [
-          "iommu=force:true,qinval:true,debug:true"
-          "noreboot=true"
-          "vga=ask"
-        ]
-      '';
-      type = listOf str;
-      description = ''
-        Xen Command Line parameters passed to Domain 0 at boot time.
-        Note: these are different from `boot.kernelParams`. See
-        the [Xen documentation](https://xenbits.xenproject.org/docs/unstable/misc/xen-command-line.html) for more information.
-      '';
-    };
-
-    efi = {
-      bootBuilderVerbosity = mkOption {
+    boot = {
+      params = mkOption {
+        default = [ ];
+        example = ''
+          [
+            "iommu=force:true,qinval:true,debug:true"
+            "noreboot=true"
+            "vga=ask"
+          ]
+        '';
+        type = listOf str;
+        description = ''
+          Xen Command Line parameters passed to Domain 0 at boot time.
+          Note: these are different from `boot.kernelParams`. See
+          the [Xen documentation](https://xenbits.xenproject.org/docs/unstable/misc/xen-command-line.html) for more information.
+        '';
+      };
+      builderVerbosity = mkOption {
         type = enum [
           "default"
           "info"
@@ -206,7 +247,7 @@ in
         default = "default";
         example = "info";
         description = ''
-          The EFI boot entry builder script should be called with exactly one of the following arguments in order to specify its verbosity:
+          The boot entry builder script should be called with exactly one of the following arguments in order to specify its verbosity:
 
           - `quiet` supresses all messages.
 
@@ -220,19 +261,33 @@ in
           This option does not alter the actual functionality of the script, just the number of messages printed when rebuilding the system.
         '';
       };
-
-      path = mkOption {
-        type = path;
-        default = "${cfg.package.boot}/${cfg.package.efi}";
-        defaultText = literalExpression "\${config.virtualisation.xen.package.boot}/\${config.virtualisation.xen.package.efi}";
-        example = literalExpression "\${config.virtualisation.xen.package}/boot/efi/efi/nixos/xen-\${config.virtualisation.xen.package.version}.efi";
-        description = ''
-          Path to xen.efi. `pkgs.xen` is patched to install the xen.efi file
-          on `$boot/boot/xen.efi`, but an unpatched Xen build may install it
-          somewhere else, such as `$out/boot/efi/efi/nixos/xen.efi`. Unless
-          you're building your own Xen derivation, you should leave this
-          option as the default value.
-        '';
+      bios = {
+        path = mkOption {
+          type = path;
+          default = "${cfg.package.boot}/${cfg.package.multiboot}";
+          defaultText = literalExpression "\${config.virtualisation.xen.package.boot}/\${config.virtualisation.xen.package.multiboot}";
+          example = literalExpression "\${config.virtualisation.xen.package}/boot/xen-\${config.virtualisation.xen.package.version}";
+          description = ''
+            Path to the Xen `multiboot` binary used for BIOS booting.
+            Unless you're building your own Xen derivation, you should leave this
+            option as the default value.
+          '';
+        };
+      };
+      efi = {
+        path = mkOption {
+          type = path;
+          default = "${cfg.package.boot}/${cfg.package.efi}";
+          defaultText = literalExpression "\${config.virtualisation.xen.package.boot}/\${config.virtualisation.xen.package.efi}";
+          example = literalExpression "\${config.virtualisation.xen.package}/boot/efi/efi/nixos/xen-\${config.virtualisation.xen.package.version}.efi";
+          description = ''
+            Path to xen.efi. `pkgs.xen` is patched to install the xen.efi file
+            on `$boot/boot/xen.efi`, but an unpatched Xen build may install it
+            somewhere else, such as `$out/boot/efi/efi/nixos/xen.efi`. Unless
+            you're building your own Xen derivation, you should leave this
+            option as the default value.
+          '';
+        };
       };
     };
 
@@ -612,8 +667,9 @@ in
       {
         assertion =
           config.boot.loader.systemd-boot.enable
-          || (config.boot ? lanzaboote) && config.boot.lanzaboote.enable;
-        message = "Xen only supports booting on systemd-boot or Lanzaboote.";
+          || (config.boot ? lanzaboote) && config.boot.lanzaboote.enable
+          || config.boot.loader.limine.enable;
+        message = "Xen only supports booting on systemd-boot, Lanzaboote or Limine.";
       }
       {
         assertion = config.boot.initrd.systemd.enable;
@@ -639,7 +695,7 @@ in
       }
     ];
 
-    virtualisation.xen.bootParams =
+    virtualisation.xen.boot.params =
       optionals cfg.trace [
         "loglvl=all"
         "guest_loglvl=all"
@@ -692,17 +748,28 @@ in
       '';
 
       # Xen Bootspec extension. This extension allows NixOS bootloaders to
-      # fetch the `xen.efi` path and access the `cfg.bootParams` option.
+      # fetch the dom0 kernel paths and access the `cfg.boot.params` option.
       bootspec.extensions = {
+        # Bootspec extension v1 is deprecated, and will be removed in 26.05
+        # It is present for backwards compatibility
         "org.xenproject.bootspec.v1" = {
-          xen = cfg.efi.path;
-          xenParams = cfg.bootParams;
+          xen = cfg.boot.efi.path;
+          xenParams = cfg.boot.params;
+        };
+        # Bootspec extension v2 includes more detail,
+        # including supporting multiboot, and is the current supported
+        # bootspec extension
+        "org.xenproject.bootspec.v2" = {
+          efiPath = cfg.boot.efi.path;
+          multibootPath = cfg.boot.bios.path;
+          version = cfg.package.version;
+          params = cfg.boot.params;
         };
       };
 
       # See the `xenBootBuilder` script in the main `let...in` statement of this file.
       loader.systemd-boot.extraInstallCommands = ''
-        ${getExe xenBootBuilder} ${cfg.efi.bootBuilderVerbosity}
+        ${getExe xenBootBuilder} ${cfg.boot.builderVerbosity}
       '';
     };
 

nixos/tests/syncthing-folders.nix

@@ -4,7 +4,7 @@ let
     name:
     pkgs.runCommand "syncthing-test-certs-${name}" { } ''
       mkdir -p $out
-      ${pkgs.syncthing}/bin/syncthing generate --config=$out
+      ${pkgs.syncthing}/bin/syncthing generate --home=$out
       ${pkgs.libxml2}/bin/xmllint --xpath 'string(configuration/device/@id)' $out/config.xml > $out/id
     '';
   idA = genNodeId "a";

nixos/tests/syncthing.nix

@@ -55,8 +55,8 @@
     a.wait_for_open_port(22000)
     b.wait_for_open_port(22000)
 
-    aDeviceID = a.succeed("syncthing -home=%s -device-id" % confdir).strip()
-    bDeviceID = b.succeed("syncthing -home=%s -device-id" % confdir).strip()
+    aDeviceID = a.succeed("syncthing --home=%s device-id" % confdir).strip()
+    bDeviceID = b.succeed("syncthing --home=%s device-id" % confdir).strip()
     addPeer(a, "b", bDeviceID)
     addPeer(b, "a", aDeviceID)
 

pkgs/applications/editors/neovim/wrapper.nix

@@ -3,6 +3,7 @@
   lib,
   makeWrapper,
   bundlerEnv,
+  wl-clipboard,
   ruby,
   nodejs,
   writeText,
@@ -39,6 +40,7 @@ let
       # the function you would have passed to python3.withPackages
       extraPython3Packages ? (_: [ ]),
 
+      waylandSupport ? stdenv.hostPlatform.isLinux,
       withNodeJs ? false,
       withPerl ? false,
       withRuby ? true,
@@ -214,6 +216,7 @@ let
         inherit
           viAlias
           vimAlias
+          waylandSupport
           withNodeJs
           withPython3
           withPerl
@@ -234,7 +237,8 @@ let
             op = acc: normalizedPlugin: acc ++ normalizedPlugin.plugin.runtimeDeps or [ ];
             runtimeDeps = lib.foldl' op [ ] pluginsNormalized;
           in
-          lib.optional finalAttrs.withRuby rubyEnv
+          lib.optionals finalAttrs.waylandSupport [ wl-clipboard ]
+          ++ lib.optional finalAttrs.withRuby rubyEnv
           ++ lib.optional finalAttrs.withNodeJs nodejs
           ++ lib.optionals finalAttrs.autowrapRuntimeDeps runtimeDeps;
 

pkgs/applications/editors/vscode/extensions/anthropic.claude-code/default.nix

@@ -0,0 +1,32 @@
+{
+  lib,
+  vscode-utils,
+  claude-code,
+}:
+vscode-utils.buildVscodeExtension (finalAttrs: {
+  pname = "claude-code";
+  inherit (claude-code) version;
+
+  vscodeExtPublisher = "anthropic";
+  vscodeExtName = "claude-code";
+  vscodeExtUniqueId = "${finalAttrs.vscodeExtPublisher}.${finalAttrs.vscodeExtName}";
+
+  src = "${claude-code}/lib/node_modules/@anthropic-ai/claude-code/vendor/claude-code.vsix";
+
+  unpackPhase = ''
+    runHook preUnpack
+
+    unzip $src
+
+    runHook postUnpack
+  '';
+
+  meta = {
+    description = "Harness the power of Claude Code without leaving your IDE";
+    homepage = "https://docs.anthropic.com/s/claude-code";
+    downloadPage = "https://marketplace.visualstudio.com/items?itemName=anthropic.claude-code";
+    license = lib.licenses.unfree;
+    sourceProvenance = with lib.sourceTypes; [ binaryBytecode ];
+    maintainers = with lib.maintainers; [ xiaoxiangmoe ];
+  };
+})

pkgs/applications/editors/vscode/extensions/default.nix

@@ -256,6 +256,8 @@ let
 
       amazonwebservices.amazon-q-vscode = callPackage ./amazonwebservices.amazon-q-vscode { };
 
+      anthropic.claude-code = callPackage ./anthropic.claude-code { };
+
       angular.ng-template = buildVscodeMarketplaceExtension {
         mktplcRef = {
           name = "ng-template";

pkgs/applications/networking/browsers/firefox/packages/firefox-beta.nix

@@ -10,11 +10,11 @@
 buildMozillaMach rec {
   pname = "firefox-beta";
   binaryName = pname;
-  version = "143.0b2";
+  version = "143.0b7";
   applicationName = "Firefox Beta";
   src = fetchurl {
     url = "mirror://mozilla/firefox/releases/${version}/source/firefox-${version}.source.tar.xz";
-    sha512 = "3d206037dbd849158b70b8a8fda8527595ead612033a6dd2f0c0417ce0bc50312d2911e3b5d2964a01ab686c7636856a32f43163ce895767a11c1f3298cbf6e8";
+    sha512 = "bf71930c7a5ab2c4ccc4f0179702491bd314763c469501f68df6cef0f1db57da6f16da77bc5d7692c0f5edf8ce616d8f927d2fa59c5c386217b9022a8e9802f8";
   };
 
   meta = {

pkgs/applications/networking/browsers/firefox/packages/firefox-devedition.nix

@@ -10,13 +10,13 @@
 buildMozillaMach rec {
   pname = "firefox-devedition";
   binaryName = pname;
-  version = "143.0b2";
+  version = "143.0b7";
   applicationName = "Firefox Developer Edition";
   requireSigning = false;
   branding = "browser/branding/aurora";
   src = fetchurl {
     url = "mirror://mozilla/devedition/releases/${version}/source/firefox-${version}.source.tar.xz";
-    sha512 = "265a3b95b3c2a3e5cd051334f9a8c9bac1f8dba10d7a625bfceeb9a75f1e45617975dc26d1760c2e656b26fdf98f18da3181402a067252451d2ac71614dcfb6d";
+    sha512 = "0c1c3af3412b14425df005b53af00e8af526cb6e0bc36f32f6bce1f4332959f35ffed4b795a40e004a41fea9747a7b7c7f6cacfd70b6ef4f54b47556cdc31ec5";
   };
 
   # buildMozillaMach sets MOZ_APP_REMOTINGNAME during configuration, but

pkgs/applications/networking/cluster/cni/plugins.nix

@@ -7,13 +7,13 @@
 
 buildGoModule rec {
   pname = "cni-plugins";
-  version = "1.7.1";
+  version = "1.8.0";
 
   src = fetchFromGitHub {
     owner = "containernetworking";
     repo = "plugins";
     rev = "v${version}";
-    hash = "sha256-S1BpOLPmWxaemPHTqZsYwGMH5KM1bPALcl78waZ0TBE=";
+    hash = "sha256-/I2fEVVQ89y8l95Ri0V5qxVj/SzXVqP0IT2vSdz8jC8=";
   };
 
   vendorHash = null;

pkgs/applications/networking/syncthing/default.nix

@@ -19,16 +19,16 @@ let
     }:
     buildGoModule rec {
       pname = stname;
-      version = "1.30.0";
+      version = "2.0.3";
 
       src = fetchFromGitHub {
         owner = "syncthing";
         repo = "syncthing";
         tag = "v${version}";
-        hash = "sha256-GKyzJ2kzs2h/tfb3StSleGBofiKk6FwVcSkCjsJRvRY=";
+        hash = "sha256-s5kW7FJfLSTezG/PvRGEoBBlMhYUoszpduKFKlnCcaU=";
       };
 
-      vendorHash = "sha256-Soky/3wEmP1QRy8xfL68sTHi3CSl4nbCINmG0DY2Qys=";
+      vendorHash = "sha256-Ws++TwmOcWe1ArRuQzIgEIUCHGC30LU4Y4zYUrBkpmA=";
 
       nativeBuildInputs = lib.optionals stdenv.hostPlatform.isDarwin [
         # Recent versions of macOS seem to require binaries to be signed when

pkgs/by-name/aa/aaaaxy/package.nix

@@ -22,13 +22,13 @@
 
 buildGoModule rec {
   pname = "aaaaxy";
-  version = "1.6.283";
+  version = "1.6.288";
 
   src = fetchFromGitHub {
     owner = "divVerent";
     repo = "aaaaxy";
     tag = "v${version}";
-    hash = "sha256-OBF5oPWoctosL1uR6/I/uNM3F39d14dmz8TKOxp5FIs=";
+    hash = "sha256-8oWrQCj1B7o2kw0mbg9ynXpu/r85uqa+2UxRH44G8ZQ=";
     fetchSubmodules = true;
   };
 

pkgs/by-name/al/alistral/package.nix

@@ -10,16 +10,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "alistral";
-  version = "0.5.13";
+  version = "0.5.14";
 
   src = fetchFromGitHub {
     owner = "RustyNova016";
     repo = "Alistral";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-z9YuoppOYghsiYhoa6nfbP+VMrdN5oY55+pS6p2pBX0=";
+    hash = "sha256-PffZx2rkOdwwhZ4LYE6ZiAWa68oZT3Gly6Is9gRPWdw=";
   };
 
-  cargoHash = "sha256-TyxeuDMmoRvIVaapA/KstFnARPpPv9h19Bg3/XnwQWs=";
+  cargoHash = "sha256-FfTySXynezMs/Nkuai+jZCSJnIo5D3obh3LboYYGhVk=";
 
   buildNoDefaultFeatures = true;
   # Would be cleaner with an "--all-features" option

pkgs/by-name/al/alsa-lib-with-plugins/package.nix

@@ -19,7 +19,6 @@ runCommand "${alsa-lib.pname}-${alsa-lib.version}"
       description = "Wrapper to ease access to ALSA plugins";
       mainProgram = "aserver";
       platforms = platforms.linux;
-      maintainers = with maintainers; [ gm6k ];
     };
     outputs = alsa-lib.outputs;
   }

pkgs/by-name/au/auth0-cli/package.nix

@@ -8,16 +8,16 @@
 
 buildGoModule rec {
   pname = "auth0-cli";
-  version = "1.17.1";
+  version = "1.18.0";
 
   src = fetchFromGitHub {
     owner = "auth0";
     repo = "auth0-cli";
     tag = "v${version}";
-    hash = "sha256-0FdKsLwONsTgysdxjaXvT4nRarPsNhKuBRRkk2ldz90=";
+    hash = "sha256-8U5jIzXh0bDKv72nPCsHa20Kzik3Gd/MUjTg6meHLiI=";
   };
 
-  vendorHash = "sha256-JJ1ppCTgclxiljNsRlDP8KNlW/wCVFaV1ExXf1ItheU=";
+  vendorHash = "sha256-Js5yB9a54+98/yPWCvHaxniGwmHXl4hHKxDXGG6IxGQ=";
 
   ldflags = [
     "-s"

pkgs/by-name/ba/bazelisk/package.nix

@@ -6,16 +6,16 @@
 
 buildGoModule rec {
   pname = "bazelisk";
-  version = "1.25.0";
+  version = "1.27.0";
 
   src = fetchFromGitHub {
     owner = "bazelbuild";
     repo = "bazelisk";
     rev = "v${version}";
-    sha256 = "sha256-1/J/Y2NlIghxQS/5CnGX+2z+glOeOZVEgSE4KWft9Zw=";
+    sha256 = "sha256-RPatTc97xYs5lhVCOjInNrNrL1UBsocdHn0C5yUHIxY=";
   };
 
-  vendorHash = "sha256-kXv7q32cFD9mwWsFaod7QPn3el72P4ugVc4DGwez8v0=";
+  vendorHash = "sha256-gv5x0BbckeGkYa5rzCmyUkvmRsmI5YPy04HVN9Z1Rgc=";
 
   ldflags = [
     "-s"

pkgs/by-name/ca/catppuccin-sddm/package.nix

@@ -2,35 +2,46 @@
   lib,
   stdenvNoCC,
   fetchFromGitHub,
+  bash,
   just,
+  catppuccin-whiskers,
   kdePackages,
   flavor ? "mocha",
+  accent ? "mauve",
   font ? "Noto Sans",
   fontSize ? "9",
   background ? null,
   loginBackground ? false,
+  userIcon ? false,
+  clockEnabled ? true,
 }:
-stdenvNoCC.mkDerivation rec {
+stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "catppuccin-sddm";
-  version = "1.1.0";
+  version = "1.1.2";
 
   src = fetchFromGitHub {
     owner = "catppuccin";
     repo = "sddm";
-    rev = "v${version}";
-    hash = "sha256-mDOiIGcpIvl4d3Dtsb2AX/1OggFEJ+hAjCd2LH7lqv0=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-7S0DKyb+4lP+5HCPAJRw/KDls2ZO9kksdlwYSz2uQC8=";
   };
 
   dontWrapQtApps = true;
 
   nativeBuildInputs = [
     just
+    catppuccin-whiskers
   ];
 
   propagatedBuildInputs = [
     kdePackages.qtsvg
   ];
 
+  postPatch = ''
+    substituteInPlace justfile \
+      --replace-fail '#!/usr/bin/env bash' '#!${lib.getExe bash}'
+  '';
+
   buildPhase = ''
     runHook preBuild
 
@@ -43,9 +54,9 @@ stdenvNoCC.mkDerivation rec {
     runHook preInstall
 
     mkdir -p "$out/share/sddm/themes/"
-    cp -r dist/catppuccin-${flavor} "$out/share/sddm/themes/catppuccin-${flavor}"
+    cp -r themes/catppuccin-${flavor}-${accent} "$out/share/sddm/themes/catppuccin-${flavor}-${accent}"
 
-    configFile=$out/share/sddm/themes/catppuccin-${flavor}/theme.conf
+    configFile=$out/share/sddm/themes/catppuccin-${flavor}-${accent}/theme.conf
 
     substituteInPlace $configFile \
       --replace-fail 'Font="Noto Sans"' 'Font="${font}"' \
@@ -62,6 +73,16 @@ stdenvNoCC.mkDerivation rec {
         --replace-fail 'LoginBackground="false"' 'LoginBackground="true"'
     ''}
 
+    ${lib.optionalString userIcon ''
+      substituteInPlace $configFile \
+        --replace-fail 'UserIcon="false"' 'UserIcon="true"'
+    ''}
+
+    ${lib.optionalString (!clockEnabled) ''
+      substituteInPlace $configFile \
+        --replace-fail 'ClockEnabled="true"' 'ClockEnabled="false"'
+    ''}
+
     runHook postInstall
   '';
 
@@ -74,6 +95,7 @@ stdenvNoCC.mkDerivation rec {
     description = "Soothing pastel theme for SDDM";
     homepage = "https://github.com/catppuccin/sddm";
     license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ gipphe ];
     platforms = lib.platforms.linux;
   };
-}
+})

pkgs/by-name/cl/clusterctl/package.nix

@@ -9,16 +9,16 @@
 
 buildGoModule rec {
   pname = "clusterctl";
-  version = "1.10.4";
+  version = "1.11.0";
 
   src = fetchFromGitHub {
     owner = "kubernetes-sigs";
     repo = "cluster-api";
     rev = "v${version}";
-    hash = "sha256-MMwM1hWZd1DdiymRAJrcFD4YoLqP0wrgDV5oIv7Lkxo=";
+    hash = "sha256-OZhlHLbe/6RYcBos4QeshRq0YDDt/vDvwafV6uyJWr8=";
   };
 
-  vendorHash = "sha256-YFtlu9ml7ZHG+m8se4K229+kzbiBZ4+dcJhFFIH7XgA=";
+  vendorHash = "sha256-kQ/hbeOoNO+F5NE2ZyEA902YCA/O6KbOrNwv1+tvSJM=";
 
   subPackages = [ "cmd/clusterctl" ];
 

pkgs/by-name/co/coroot-node-agent/package.nix

@@ -7,13 +7,13 @@
 
 buildGoModule rec {
   pname = "coroot-node-agent";
-  version = "1.25.6";
+  version = "1.25.9";
 
   src = fetchFromGitHub {
     owner = "coroot";
     repo = "coroot-node-agent";
     rev = "v${version}";
-    hash = "sha256-oeLNrpA+b4j4TKNztv4EhcNBUh3FMWYtkx2ZGobatB8=";
+    hash = "sha256-SiSNYtcqKbbVCArSFhNsu6gckQlKbTsDvECbCn0jXCU=";
   };
 
   vendorHash = "sha256-QvdFW/o481F85WuXNdz99Q9MBiGRjVSWvPRytq67vYU=";

pkgs/by-name/cr/credhub-cli/package.nix

@@ -6,13 +6,13 @@
 
 buildGoModule rec {
   pname = "credhub-cli";
-  version = "2.9.48";
+  version = "2.9.49";
 
   src = fetchFromGitHub {
     owner = "cloudfoundry-incubator";
     repo = "credhub-cli";
     rev = version;
-    sha256 = "sha256-jZmnun7EkCWiWq8i+9cgn/2ffxt9VbVf0DxYHKgwNqg=";
+    sha256 = "sha256-Ilb/iieB+TCCXUPzTh6TxJtox0sicWXCUBI1SuHNsUQ=";
   };
 
   # these tests require network access that we're not going to give them

pkgs/by-name/dp/dprint/plugins/dprint-plugin-biome.nix

@@ -1,7 +1,7 @@
 { mkDprintPlugin }:
 mkDprintPlugin {
   description = "Biome (JS/TS) wrapper plugin";
-  hash = "sha256-xcMPMSrQVEibWKdkuZ36AUzqQADQ0pOw3ufQejvdzrw=";
+  hash = "sha256-6iDlZ1e69TM1z0cfGONWyd5vGTYtyDoaw357PgBVyD4=";
   initConfig = {
     configExcludes = [ "**/node_modules" ];
     configKey = "biome";
@@ -16,6 +16,6 @@ mkDprintPlugin {
   };
   pname = "dprint-plugin-biome";
   updateUrl = "https://plugins.dprint.dev/dprint/biome/latest.json";
-  url = "https://plugins.dprint.dev/biome-0.9.3.wasm";
-  version = "0.9.3";
+  url = "https://plugins.dprint.dev/biome-0.10.1.wasm";
+  version = "0.10.1";
 }

pkgs/by-name/fa/falcoctl/package.nix

@@ -6,16 +6,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "falcoctl";
-  version = "0.11.2";
+  version = "0.11.3";
 
   src = fetchFromGitHub {
     owner = "falcosecurity";
     repo = "falcoctl";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-cbrlFxRRHwrK1+mkvEktrOCbg5bhKG7GXvv+YJ6un7I=";
+    hash = "sha256-wRqhTNCk4EBaGPjLKIpQwpYp2Rjb6/ie46zTfl6IEx0=";
   };
 
-  vendorHash = "sha256-L7VXGMWs2eRQUT37CCtQsiYZnsDi/a8QSwAw/f/mydc=";
+  vendorHash = "sha256-QvtkRKmrfKNXEH9qEo3ocfaEaK4MqK/NTKes3EPXbyE=";
 
   ldflags = [
     "-s"

pkgs/by-name/fw/fw-fanctrl/package.nix

@@ -7,14 +7,14 @@
 
 python3Packages.buildPythonPackage rec {
   pname = "fw-fanctrl";
-  version = "1.0.3";
+  version = "1.0.4";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "TamtamHero";
     repo = "fw-fanctrl";
     tag = "v${version}";
-    hash = "sha256-TDVULNb/oH66/UX20mC89NSx8YPe8mPwNCB9+phavP4=";
+    hash = "sha256-lwuBbyJnWUAXkKemhsdx73fAzO2QX2n81az074hGkzI=";
   };
 
   build-system = [ python3Packages.setuptools ];

pkgs/by-name/fx/fx/package.nix

@@ -7,13 +7,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "fx";
-  version = "39.0.2";
+  version = "39.0.4";
 
   src = fetchFromGitHub {
     owner = "antonmedv";
     repo = "fx";
     tag = finalAttrs.version;
-    hash = "sha256-fsUKdKbH+H1PD5khhIubL1DT3Qc6dLaooKe5UCXlYk0=";
+    hash = "sha256-0zBEyEKy465PZDiZgH+NpermO/7f1GD0hB0wJFbiNz4=";
   };
 
   vendorHash = "sha256-7x0nbgMzEJznDH6Wf5iaTYXLh/2IGUSeSVvb0UKKTOQ=";

pkgs/by-name/go/go-minimock/package.nix

@@ -6,13 +6,13 @@
 
 buildGoModule rec {
   pname = "go-minimock";
-  version = "3.4.5";
+  version = "3.4.6";
 
   src = fetchFromGitHub {
     owner = "gojuno";
     repo = "minimock";
     rev = "v${version}";
-    hash = "sha256-D5U1KfWXe9qtcFQKDoISC6Hq5axMO37WsyFjpPOyyo4=";
+    hash = "sha256-jbl8ngVagwbDSIZFrMtRRCHvQ0e6mojrk4rXJ/HsJSk=";
   };
 
   ldflags = [
@@ -21,7 +21,7 @@ buildGoModule rec {
     "-X main.version=${version}"
   ];
 
-  vendorHash = "sha256-MN/tHT+vjLswUxe+c3FZn+S0l+fklqnIvj4BnPfbOjw=";
+  vendorHash = "sha256-74bmsixBO5VwLZYRXN9Fx3Mu9BbL4bSF6o0h9QaET1Y=";
 
   doCheck = true;
 

pkgs/by-name/go/govc/package.nix

@@ -6,16 +6,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "govc";
-  version = "0.51.0";
+  version = "0.52.0";
 
   src = fetchFromGitHub {
     owner = "vmware";
     repo = "govmomi";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-q1I3UWl/LiIzRNsN5D2b2z+03kT95IVYob2g1uSyaHk=";
+    hash = "sha256-Gd8Th9cEpPwKlJfjUkDjZXzOzl/nhr+GgPjGuIR6Xlg=";
   };
 
-  vendorHash = "sha256-N5BWw754Why6Qo/EM1RfU6uR7jxo7+oAL9YZMNCOFoE=";
+  vendorHash = "sha256-31n3pBAK/zZ7ZbQ9GxLNyO0Tw4K2xgvxKfPDb7x/lTk=";
 
   sourceRoot = "${finalAttrs.src.name}/govc";
 

pkgs/by-name/ic/icloudpd/package.nix

@@ -9,14 +9,14 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "icloudpd";
-  version = "1.30.0";
+  version = "1.31.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "icloud-photos-downloader";
     repo = "icloud_photos_downloader";
     tag = "v${version}";
-    hash = "sha256-FuN2+ukQ9Kf/Eu7M63wrBIh31O64HZVqtC78vzKioNE=";
+    hash = "sha256-GZhc5AeOxfSPxloN630lQguh63ha63Wnuh0H6pMkPyE=";
   };
 
   pythonRelaxDeps = true;

pkgs/by-name/in/interstellar/package.nix

@@ -0,0 +1,82 @@
+{
+  copyDesktopItems,
+  flutter332,
+  fetchFromGitHub,
+  imagemagick,
+  lib,
+  libass,
+  makeDesktopItem,
+  mpv-unwrapped,
+}:
+
+flutter332.buildFlutterApplication rec {
+  pname = "interstellar";
+  version = "0.9.3";
+
+  src = fetchFromGitHub {
+    owner = "interstellar-app";
+    repo = "interstellar";
+    tag = "v${version}";
+    hash = "sha256-osZp2hk9ZoMxto5Sla4vWSWjTFB+syOwlFGTRHJjcVU=";
+  };
+
+  pubspecLock = lib.importJSON ./pubspec.lock.json;
+
+  buildInputs = [
+    imagemagick
+    libass
+    mpv-unwrapped
+  ];
+
+  nativeBuildInputs = [
+    copyDesktopItems
+  ];
+
+  # temp turn off language locale gen
+  postPatch = ''
+    substituteInPlace pubspec.yaml --replace-fail "generate: true" "generate: false"
+  '';
+
+  # 1 - turn language locale gen back on
+  # 2 - set the app version (upstream does this in a github runner)
+  # 3 - run build_runner to make model .part files and language locale gen
+  preBuild = ''
+    substituteInPlace pubspec.yaml \
+      --replace-fail "generate: false" "generate: true" \
+      --replace-fail "version: 0.0.0" "version: ${version}"
+    packageRun build_runner build -d
+  '';
+
+  extraWrapProgramArgs = ''
+    --prefix LD_LIBRARY_PATH : $out/app/interstellar/lib
+  '';
+
+  desktopItems = [
+    (makeDesktopItem {
+      name = "one.jwr.interstellar";
+      desktopName = "Interstellar";
+      exec = "interstellar";
+      icon = "Interstellar";
+      categories = [
+        "Network"
+        "News"
+      ];
+    })
+  ];
+
+  postInstall = ''
+    for size in 16 22 24 32 36 48 64 72 96 128 192 256 512 1024; do
+        mkdir -p $out/share/icons/hicolor/"$size"x"$size"/apps
+        magick $src/assets/icons/logo.png -resize "$size"x"$size" $out/share/icons/hicolor/"$size"x"$size"/apps/Interstellar.png
+    done
+  '';
+
+  meta = {
+    description = "App for Mbin/Lemmy/PieFed, connecting you to the fediverse";
+    homepage = "https://interstellar.jwr.one";
+    license = lib.licenses.agpl3Plus;
+    mainProgram = "interstellar";
+    platforms = lib.platforms.linux;
+    maintainers = with lib.maintainers; [ JollyDevelopment ];
+  };
+}

pkgs/by-name/jf/jfrog-cli/package.nix

@@ -8,17 +8,17 @@
 
 buildGoModule rec {
   pname = "jfrog-cli";
-  version = "2.78.3";
+  version = "2.78.8";
 
   src = fetchFromGitHub {
     owner = "jfrog";
     repo = "jfrog-cli";
     tag = "v${version}";
-    hash = "sha256-sV8cj+H9l/Rm/INRmfMvTMYehYVmQhZHH7KxWGcEMXs=";
+    hash = "sha256-NaCzNjDIUr0u/+WQmJbJrLyMPf8Z974ulmu4VYa+jcs=";
   };
 
   proxyVendor = true;
-  vendorHash = "sha256-SriBFQXKLYPDTqDmC4cXfV1fjwvUCUuujq5hb4w5Fgg=";
+  vendorHash = "sha256-74FD0wx+RIwvzVT4034A+gNyNWP4soosLna2TpqUxmk=";
 
   checkFlags = "-skip=^TestReleaseBundle";
 

pkgs/by-name/k3/k3sup/package.nix

@@ -10,13 +10,13 @@
 
 buildGoModule rec {
   pname = "k3sup";
-  version = "0.13.10";
+  version = "0.13.11";
 
   src = fetchFromGitHub {
     owner = "alexellis";
     repo = "k3sup";
     rev = version;
-    sha256 = "sha256-0iYz2bxUBC+tnPZgH+QQo0ZNRktniw6gs9hWrLIjS+U=";
+    sha256 = "sha256-MLGgH9Tg3lcl/nDGlGgfvgjoxjXRux79Cz6Tig0kDM4=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/ku/kube-bench/package.nix

@@ -10,7 +10,7 @@
 
 buildGoModule (finalAttrs: {
   pname = "kube-bench";
-  version = "0.11.2";
+  version = "0.12.0";
 
   __darwinAllowLocalNetworking = true; # required for tests
 
@@ -18,10 +18,10 @@ buildGoModule (finalAttrs: {
     owner = "aquasecurity";
     repo = "kube-bench";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-xIHfMJsKs66S21lsDhmj1UKuUlXKA2O7oa6Rx1pew+4=";
+    hash = "sha256-XOx0PKywl2Cyh7JgRRRTt9Y20aTFRCFBx+dGByuGHww=";
   };
 
-  vendorHash = "sha256-uJv9erZcLYKYrNmVZMxgVdSa5bVKrUH8mspc4O9efhw=";
+  vendorHash = "sha256-CXyzrV6XcAfI9wnASh4jWna2yb7aWiSbm7q9WVdecDU=";
 
   nativeBuildInputs = [ installShellFiles ];
 

pkgs/by-name/ku/kubevpn/package.nix

@@ -9,13 +9,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "kubevpn";
-  version = "2.9.5";
+  version = "2.9.7";
 
   src = fetchFromGitHub {
     owner = "KubeNetworks";
     repo = "kubevpn";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-wKZCv8gikEIXYvhovgN+WrEt2dFf+nHeBLO2UKfi55Q=";
+    hash = "sha256-MWDVigjh1DWesMjLrT7p1ghawhfGssLNMhje5gbV874=";
   };
 
   vendorHash = null;

pkgs/by-name/li/libtorrent/package.nix

@@ -14,13 +14,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "rakshasa-libtorrent";
-  version = "0.15.5";
+  version = "0.15.6";
 
   src = fetchFromGitHub {
     owner = "rakshasa";
     repo = "libtorrent";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-iFndmET8bQUg3iZ6c6WDCzSS2tx6sYJt+fEkPAaNm18=";
+    hash = "sha256-udEe9VyUzPXuCTrB3U3+XCbVWvfTT7xNvJJkLSQrRt4=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/li/lint-staged/package.nix

@@ -8,16 +8,16 @@
 
 buildNpmPackage rec {
   pname = "lint-staged";
-  version = "16.1.5";
+  version = "16.1.6";
 
   src = fetchFromGitHub {
     owner = "okonet";
     repo = "lint-staged";
     rev = "v${version}";
-    hash = "sha256-XXNBKxlHfyQXHyaWFrgFmEHmcxhodco1p44i9SjXgo4=";
+    hash = "sha256-P8VFFeYVuMjAQD9whLmuHvD/tOVT2m7QKCm5X/5me0Q=";
   };
 
-  npmDepsHash = "sha256-edBeGkkkcHR4FC+zF3W+NbguEGfU2qCJ1hYwdTMTLA0=";
+  npmDepsHash = "sha256-TdmQ3Eg86LC3pcGy779c8IcyMWcS7RU0fqkzG3OaABY=";
 
   dontNpmBuild = true;
 

pkgs/by-name/ma/mat2/package.nix

@@ -1,9 +1,6 @@
 {
-  # On Python 3.13, `tests/test_libmat2.py::TestCleaning::test_html` fails with
-  #
-  #     ValueError: The closing tag title doesn't have a corresponding opening one in ./tests/data/clean.html.
-  python312Packages,
+  python3Packages,
 }:
 
-with python312Packages;
+with python3Packages;
 toPythonApplication mat2

pkgs/by-name/mi/minetest-mapserver/package.nix

@@ -27,6 +27,5 @@ buildGoModule rec {
       cc-by-sa-30
     ];
     platforms = lib.platforms.all;
-    maintainers = with lib.maintainers; [ gm6k ];
   };
 }

pkgs/by-name/mp/mpdris2/package.nix

@@ -7,11 +7,11 @@
   gobject-introspection,
   intltool,
   libnotify,
-  python3,
+  python3Packages,
   wrapGAppsHook3,
 }:
 
-python3.pkgs.buildPythonApplication rec {
+python3Packages.buildPythonApplication rec {
   pname = "mpDris2";
   version = "0.9.1";
   format = "other";
@@ -19,8 +19,8 @@ python3.pkgs.buildPythonApplication rec {
   src = fetchFromGitHub {
     owner = "eonpatapon";
     repo = "mpDris2";
-    rev = version;
-    sha256 = "sha256-1Y6K3z8afUXeKhZzeiaEF3yqU0Ef7qdAj9vAkRlD2p8=";
+    tag = version;
+    hash = "sha256-1Y6K3z8afUXeKhZzeiaEF3yqU0Ef7qdAj9vAkRlD2p8=";
   };
 
   preConfigure = ''
@@ -40,21 +40,28 @@ python3.pkgs.buildPythonApplication rec {
     libnotify
   ];
 
-  propagatedBuildInputs = with python3.pkgs; [
+  dependencies = with python3Packages; [
     dbus-python
     mpd2
     mutagen
     pygobject3
   ];
 
+  # Python builder already uses makeWrapper, so we disable the hook
+  # and add its args to the existing ones for Python:
+  # https://nixos.org/manual/nixpkgs/stable/#ssec-gnome-common-issues-double-wrapped
+  dontWrapGApps = true;
+
+  makeWrapperArgs = [ "\${gappsWrapperArgs[@]}" ];
+
   patches = [ ./fix-gettext-0.25.patch ];
 
-  meta = with lib; {
+  meta = {
     description = "MPRIS 2 support for mpd";
     homepage = "https://github.com/eonpatapon/mpDris2/";
-    license = licenses.gpl3;
+    license = lib.licenses.gpl3Plus;
     maintainers = [ ];
-    platforms = platforms.unix;
+    platforms = lib.platforms.unix;
     mainProgram = "mpDris2";
   };
 }

pkgs/by-name/ne/netbox_4_3/package.nix

@@ -16,14 +16,14 @@ let
 in
 py.pkgs.buildPythonApplication rec {
   pname = "netbox";
-  version = "4.3.5";
+  version = "4.3.7";
   pyproject = false;
 
   src = fetchFromGitHub {
     owner = "netbox-community";
     repo = "netbox";
     tag = "v${version}";
-    hash = "sha256-EbbYHtdXcyg12FVuSBx4CAOD0TZ8PHBDQ4nv2mzTZIw=";
+    hash = "sha256-xVOP1D3C12M0M8oTrCA0M17NLuor+46UwiaKymSAVJM=";
   };
 
   patches = [

pkgs/by-name/ne/nezha-agent/package.nix

@@ -8,13 +8,13 @@
 }:
 buildGoModule (finalAttrs: {
   pname = "nezha-agent";
-  version = "1.13.0";
+  version = "1.13.1";
 
   src = fetchFromGitHub {
     owner = "nezhahq";
     repo = "agent";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-CFwHMO78v/A5hjNypFo9Fp0gdkrKgNvPRGz3RfMRRAU=";
+    hash = "sha256-csV03eYbXchIJb/ZNAaCKt2SCcO7ugpt9jspvYDiJm0=";
   };
 
   vendorHash = "sha256-5g2AgkqaelCD10dxwcEmBLYy5nrd4IALiss0dTrTTno=";

pkgs/by-name/oi/oils-for-unix/package.nix

@@ -18,11 +18,11 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "oils-for-unix";
-  version = "0.34.0";
+  version = "0.35.0";
 
   src = fetchurl {
     url = "https://oils.pub/download/oils-for-unix-${version}.tar.gz";
-    hash = "sha256-RpAY70daHKnoOXwC91stxjiCpKLiDXejA9dKcorjGiI=";
+    hash = "sha256-sNFHWl1Ul4aWh4b0exW/JE4dTDv5EZwRcUmXsR+W/co=";
   };
 
   postPatch = ''

pkgs/by-name/op/openimageio/package.nix

@@ -17,13 +17,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "openimageio";
-  version = "3.0.9.1";
+  version = "3.0.10.0";
 
   src = fetchFromGitHub {
     owner = "AcademySoftwareFoundation";
     repo = "OpenImageIO";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-tvtot+TZ2dPg8XlVBKT/kcKYKUPKjEcNDU7To5SCMrs=";
+    hash = "sha256-WbzAYZEPH81FtG6I9jwKI5NJjnFSxIgkMpo3Gt/OIOQ=";
   };
 
   outputs = [

pkgs/by-name/pa/parallel-disk-usage/package.nix

@@ -5,16 +5,16 @@
 }:
 rustPlatform.buildRustPackage rec {
   pname = "parallel-disk-usage";
-  version = "0.21.0";
+  version = "0.21.1";
 
   src = fetchFromGitHub {
     owner = "KSXGitHub";
     repo = "parallel-disk-usage";
     rev = version;
-    hash = "sha256-QPZT/SBiF6vDAhQzlxh+encoxbZ9Hi2kOZ2XalZkErg=";
+    hash = "sha256-EYveK1p/OWvtY5Q0dDlZwFkVt7u/A0qY0BG/oLgwmfE=";
   };
 
-  cargoHash = "sha256-plC+VB6dp7W7dROdYwmhTMpPHEwRSgsArwY9jrYycBk=";
+  cargoHash = "sha256-r9lNOElOr4GjzaI1ZZFdc+1i2kC4YVl7n/XR05mdEJA=";
 
   meta = with lib; {
     description = "Highly parallelized, blazing fast directory tree analyzer";

pkgs/by-name/pm/pm2/package.nix

@@ -7,13 +7,13 @@
 
 buildNpmPackage rec {
   pname = "pm2";
-  version = "6.0.8";
+  version = "6.0.9";
 
   src = fetchFromGitHub {
     owner = "Unitech";
     repo = "pm2";
     rev = "v${version}";
-    hash = "sha256-roSHLJsDeNAa9z9O/hgy9P4ho5zeLz1+w0a8U0Ix2ao=";
+    hash = "sha256-lMKYQHtmoR2eehF8QR0pqwF1peGKDGH5eXQRfYoJt+0=";
 
     # Requested patch upstream: https://github.com/Unitech/pm2/pull/5985
     postFetch = ''
@@ -21,7 +21,7 @@ buildNpmPackage rec {
     '';
   };
 
-  npmDepsHash = "sha256-6xUGO1vrzU5pi33ZaiRB6L5gY8p7ES93effyGdhsV5o=";
+  npmDepsHash = "sha256-Ko1Kki2NdLWQNqsqOCOB752XNVqLbFq9bUqgjrp9SfM=";
 
   dontNpmBuild = true;
 

pkgs/by-name/pr/protonup-qt/package.nix

@@ -7,13 +7,13 @@
 
 appimageTools.wrapAppImage rec {
   pname = "protonup-qt";
-  version = "2.12.0";
+  version = "2.13.0";
 
   src = appimageTools.extractType2 {
     inherit pname version;
     src = fetchurl {
       url = "https://github.com/DavidoTek/ProtonUp-Qt/releases/download/v${version}/ProtonUp-Qt-${version}-x86_64.AppImage";
-      hash = "sha256-8MeHSy3XW1oXAD2xrDSIB0ZLJxtk5UBIMpDRTPF9ksU=";
+      hash = "sha256-cyYuLwQqMAx5vMN9efceMNtDqzapNlJKBqWDSAYL2zI=";
     };
   };
 

pkgs/by-name/re/readeck/package.nix

@@ -2,14 +2,14 @@
   lib,
   fetchFromGitea,
   fetchNpmDeps,
-  buildGoModule,
+  buildGo125Module,
   nodejs,
   npmHooks,
   python3,
 }:
 
 let
-  file-compose = buildGoModule {
+  file-compose = buildGo125Module {
     pname = "file-compose";
     version = "unstable-2023-10-21";
 
@@ -25,16 +25,16 @@ let
   };
 in
 
-buildGoModule rec {
+buildGo125Module rec {
   pname = "readeck";
-  version = "0.19.2";
+  version = "0.20.1";
 
   src = fetchFromGitea {
     domain = "codeberg.org";
     owner = "readeck";
     repo = "readeck";
     tag = version;
-    hash = "sha256-gTU1RMd6b1wLIqI8VGa1Fn8+ydhW76E8ft5du71E1zM=";
+    hash = "sha256-7ZLEAMma0eLrcCbwbeK8EPDY1+ZOJy3i4Rz+obDsuko=";
   };
 
   nativeBuildInputs = [
@@ -80,10 +80,10 @@ buildGoModule rec {
 
   npmDeps = fetchNpmDeps {
     src = "${src}/web";
-    hash = "sha256-RkyQ7uY7OIpBY7ep2L2Ilq5abY0f91g2uqigdS64sL0=";
+    hash = "sha256-/imn3IoRh6aoQFNH0yMmgYNktfkN647H4KfpcVVC728=";
   };
 
-  vendorHash = "sha256-gqiK96FnfvRAzT0RUpYnT7HftZ1YV9jxbjstcKtGBho=";
+  vendorHash = "sha256-8SdDuMsFKpEhJ3qnH/9nly54A/PJCCh5xIyKNLDs740=";
 
   meta = {
     description = "Web application that lets you save the readable content of web pages you want to keep forever";

pkgs/by-name/rk/rke/package.nix

@@ -6,13 +6,13 @@
 
 buildGoModule rec {
   pname = "rke";
-  version = "1.8.5";
+  version = "1.8.6";
 
   src = fetchFromGitHub {
     owner = "rancher";
     repo = "rke";
     rev = "v${version}";
-    hash = "sha256-ahz5RFqc4pwnyxGoRps2PPj+PFFHuIhrxiD7XC6Tuj8=";
+    hash = "sha256-yrhEiDv9mMBQvQksMnODj/8Awh7p7CfKDnL5ttv0Le0=";
   };
 
   vendorHash = "sha256-OWC8OZhORHwntAR2YHd4KfQgB2Wtma6ayBWfY94uOA4=";

pkgs/by-name/sc/screenly-cli/package.nix

@@ -37,7 +37,6 @@ rustPlatform.buildRustPackage rec {
     license = lib.licenses.mit;
     mainProgram = "screenly";
     maintainers = with lib.maintainers; [
-      jnsgruk
       vpetersson
     ];
   };

pkgs/by-name/si/signal-export/package.nix

@@ -7,13 +7,13 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "signal-export";
-  version = "3.7.0";
+  version = "3.7.1";
   pyproject = true;
 
   src = fetchPypi {
     inherit version;
     pname = "signal_export";
-    hash = "sha256-xaXU+SODijD/iq2owj5IPKL+L2nrVfi573P58Txz8io=";
+    hash = "sha256-7oSaVC1TpRwoOwpXbercFOBoyrmKx8J9QUnt/a6JHGs=";
   };
 
   build-system = with python3.pkgs; [

pkgs/by-name/sq/sqlc/package.nix

@@ -9,17 +9,17 @@
 
 buildGoModule (finalAttrs: {
   pname = "sqlc";
-  version = "1.29.0";
+  version = "1.30.0";
 
   src = fetchFromGitHub {
     owner = "sqlc-dev";
     repo = "sqlc";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-BaEvmvbo6OQ1T9lgIuNJMyvnvVZd/20mFEMQdFtxdZc=";
+    hash = "sha256-ns0FIGu+aOuRFBYHrAqWUiYCwHE5XQqlR3AFKy5lq4E=";
   };
 
   proxyVendor = true;
-  vendorHash = "sha256-LpF94Jv7kukSa803WCmnO+y6kvHLPz0ZGEdbjwVFV40=";
+  vendorHash = "sha256-jivqXwuq6wbNQFW8BlBZIKBLpIotA2MMR5iywODycpY=";
 
   subPackages = [ "cmd/sqlc" ];
 

pkgs/by-name/su/sunvox/package.nix

@@ -33,9 +33,9 @@ stdenv.mkDerivation (finalAttrs: {
     urls = [
       "https://www.warmplace.ru/soft/sunvox/sunvox-${finalAttrs.version}.zip"
       # Upstream removes downloads of older versions, please save bumped versions to archive.org
-      "https://web.archive.org/web/20241215075639/https://www.warmplace.ru/soft/sunvox/sunvox-${finalAttrs.version}.zip"
+      "https://web.archive.org/web/20250831231045/https://www.warmplace.ru/soft/sunvox/sunvox-${finalAttrs.version}.zip"
     ];
-    hash = "sha256-RmGqko1OLkQb0Oeydpfy4wxzp6iz2MpS7R22d4qjEaE=";
+    hash = "sha256-4GcSNu6ikAGNcPWz5ghrL78U6xrcIUqjFabs26LACRM=";
   };
 
   nativeBuildInputs =

pkgs/by-name/vi/victoriametrics/package.nix

@@ -13,13 +13,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "VictoriaMetrics";
-  version = "1.124.0";
+  version = "1.125.0";
 
   src = fetchFromGitHub {
     owner = "VictoriaMetrics";
     repo = "VictoriaMetrics";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-f0Mf/4cFnJ/3I8z/4UhhNJnSCau9Q7mFfR32lP9/yi0=";
+    hash = "sha256-Xhurksf2BMw+v+4PsKm9o+XO2KfYX9wZTlq/kLLxVYc=";
   };
 
   vendorHash = null;
@@ -53,7 +53,7 @@ buildGoModule (finalAttrs: {
 
     # Allow older go versions
     substituteInPlace go.mod \
-      --replace-fail "go 1.24.6" "go ${finalAttrs.passthru.go.version}"
+      --replace-fail "go 1.25.0" "go ${finalAttrs.passthru.go.version}"
 
     # Increase timeouts in tests to prevent failure on heavily loaded builders
     substituteInPlace lib/storage/storage_test.go \

pkgs/by-name/wa/wasabiwallet/package.nix

@@ -27,11 +27,11 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "wasabiwallet";
-  version = "2.6.0";
+  version = "2.7.0";
 
   src = fetchurl {
     url = "https://github.com/WalletWasabi/WalletWasabi/releases/download/v${version}/Wasabi-${version}-linux-x64.tar.gz";
-    sha256 = "sha256-XWhRJPt0xcFez+HD8RLLXg6XoVVfTeIQhLmsRLEPPMQ=";
+    sha256 = "sha256-w2xLahVxeCxwM6LVS5Mtr7IAXoZ7ju9aeXGjHMO2GPE=";
   };
 
   dontBuild = true;

pkgs/by-name/xe/xen/package.nix

@@ -296,6 +296,9 @@ stdenv.mkDerivation (finalAttrs: {
     mkdir -p $out $out/share $boot
     cp -prvd dist/install/nix/store/*/* $out/
     cp -prvd dist/install/etc $out
+    # Decompresses the multiboot binary so it's present for bootloaders such as Limine
+    # The find command is used instead of a simple file glob so we skip processing symlinks
+    find dist/install/boot -type f -name '*.gz' -print -exec gunzip -k '{}' ';'
     cp -prvd dist/install/boot $boot
 
     runHook postInstall
@@ -322,6 +325,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   passthru = {
     efi = "boot/xen-${finalAttrs.upstreamVersion}.efi";
+    multiboot = "boot/xen-${finalAttrs.upstreamVersion}";
     flaskPolicy =
       if withFlask then
         warn "This Xen was compiled with FLASK support, but the FLASK file may not match the Xen version number. Please hardcode the path to the FLASK file instead." "boot/xenpolicy-${finalAttrs.upstreamVersion}"
@@ -367,7 +371,8 @@ stdenv.mkDerivation (finalAttrs: {
 
       Use with the `qemu_xen` package.
     ''
-    + "\nIncludes:\n* `xen.efi`: The Xen Project's [EFI binary](https://xenbits.xenproject.org/docs/${finalAttrs.meta.branch}-testing/misc/efi.html), available on the `boot` output of this package."
+    + "\nIncludes:\n* `xen-${finalAttrs.upstreamVersion}.efi`: The Xen Project's [EFI binary](https://xenbits.xenproject.org/docs/${finalAttrs.meta.branch}-testing/misc/efi.html), available on the `boot` output of this package."
+    + "\n* `xen-${finalAttrs.upstreamVersion}`: The Xen Project's multiboot binary, available on the `boot` output of this package."
     + optionalString withFlask "\n* `xsm-flask`: The [FLASK Xen Security Module](https://wiki.xenproject.org/wiki/Xen_Security_Modules_:_XSM-FLASK). The `xenpolicy` file is available on the `boot` output of this package."
     + optionalString withSeaBIOS "\n* `seabios`: Support for the SeaBIOS boot firmware on HVM domains."
     + optionalString withOVMF "\n* `ovmf`: Support for the OVMF UEFI boot firmware on HVM domains."

pkgs/by-name/ya/yabasic/package.nix

@@ -11,11 +11,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "yabasic";
-  version = "2.91.3";
+  version = "2.91.4";
 
   src = fetchurl {
     url = "http://www.yabasic.de/download/yabasic-${finalAttrs.version}.tar.gz";
-    hash = "sha256-+sS3kfWhM4Wwr0SGvkx85eTjXxc9WBvEU3J0Xy4Dcfo=";
+    hash = "sha256-3JUTNOFmZpSlAx40BHAT6YQgYLxdVPPXLwyfzDoYdlc=";
   };
 
   buildInputs = [

pkgs/by-name/ya/yaml2nix/package.nix

@@ -0,0 +1,55 @@
+{
+  lib,
+  rustPlatform,
+  fetchFromGitHub,
+  nix-update-script,
+  testers,
+}:
+rustPlatform.buildRustPackage (finalAttrs: {
+  pname = "yaml2nix";
+  version = "0.3.0";
+
+  src = fetchFromGitHub {
+    owner = "euank";
+    repo = "yaml2nix";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-DkHWWpvBco2yodyOk40LjTNcoaJ1bFKf0JY9OwWgy5M=";
+  };
+
+  cargoHash = "sha256-3N0V/5lqiE2lTXu9oUsO3FOXhWqkNlomceqIVDGGuOM=";
+
+  passthru = {
+    tests.convert = testers.runCommand {
+      name = "${finalAttrs.pname}-convert-test";
+      nativeBuildInputs = [ finalAttrs.finalPackage ];
+      script = ''
+        cat <<EOF > test.yaml
+        foo: "bar"
+        baz:
+          - qux
+        EOF
+
+        cat <<EOF > expected.nix
+        { foo = "bar"; baz = [ "qux" ]; }
+        EOF
+
+        yaml2nix test.yaml > test.nix
+
+        diff test.nix expected.nix && touch $out
+      '';
+    };
+    updateScript = nix-update-script { };
+  };
+
+  meta = {
+    description = "Command line tool to convert YAML into a Nix expression";
+    homepage = "https://github.com/euank/yaml2nix";
+    changelog = "https://github.com/euank/yaml2nix/releases/tag/${finalAttrs.src.tag}";
+    maintainers = with lib.maintainers; [
+      gepbird
+    ];
+    license = lib.licenses.gpl3Plus;
+    platforms = lib.platforms.unix;
+    mainProgram = "yaml2nix";
+  };
+})

pkgs/development/lua-modules/generated-packages.nix

@@ -814,15 +814,15 @@ final: prev: {
     }:
     buildLuarocksPackage {
       pname = "fzf-lua";
-      version = "0.0.2086-1";
+      version = "0.0.2111-1";
       knownRockspec =
         (fetchurl {
-          url = "mirror://luarocks/fzf-lua-0.0.2086-1.rockspec";
-          sha256 = "10wnp4xj33xi861fiv7p9rl8r6czwm2d8w2r2a4iqrf9plrm4k7m";
+          url = "mirror://luarocks/fzf-lua-0.0.2111-1.rockspec";
+          sha256 = "1ga202jkvzw9cq80ryfmjfs6v4l83h6ajlbipdd8xsk9yqrzi2dm";
         }).outPath;
       src = fetchzip {
-        url = "https://github.com/ibhagwan/fzf-lua/archive/de1ddf70922ef26825ae5460a154a22278954cae.zip";
-        sha256 = "1rm4msncfylgg3yn42x8w9s586glnssqlqd13cdlj1ph92a0c103";
+        url = "https://github.com/ibhagwan/fzf-lua/archive/bebc84e7ffc8fd86103f6ed6c590df72d524d342.zip";
+        sha256 = "0vykm7dlb38qib6gxy048dhacqaswi23g0l6lgnrz1ifwnpgi7x5";
       };
 
       disabled = luaOlder "5.1";
@@ -934,15 +934,15 @@ final: prev: {
     }:
     buildLuarocksPackage {
       pname = "haskell-tools.nvim";
-      version = "6.1.1-1";
+      version = "6.2.0-1";
       knownRockspec =
         (fetchurl {
-          url = "mirror://luarocks/haskell-tools.nvim-6.1.1-1.rockspec";
-          sha256 = "1w0wvrpf5gh0r1bzss5bqdghv2wynps2cxgvbkp27kzj5kqrfhdx";
+          url = "mirror://luarocks/haskell-tools.nvim-6.2.0-1.rockspec";
+          sha256 = "0y7z59sf0pa1awj7vx3h4lfcmbkv2f933a5lmy9k7sa6zcmrdd7i";
         }).outPath;
       src = fetchzip {
-        url = "https://github.com/mrcjkb/haskell-tools.nvim/archive/v6.1.1.zip";
-        sha256 = "0pmmyfwj8as5l0l6hvr5n7n4nnsnpa6p1jj7w5j8jlk4h6c006kn";
+        url = "https://github.com/mrcjkb/haskell-tools.nvim/archive/v6.2.0.zip";
+        sha256 = "123sa84kanmh80bqqqymziyzdr7gwag4m432iabbx9708qmx62c2";
       };
 
       disabled = luaOlder "5.1";
@@ -1618,15 +1618,15 @@ final: prev: {
     }:
     buildLuarocksPackage {
       pname = "lsp-progress.nvim";
-      version = "1.0.13-1";
+      version = "1.0.14-1";
       knownRockspec =
         (fetchurl {
-          url = "mirror://luarocks/lsp-progress.nvim-1.0.13-1.rockspec";
-          sha256 = "13h0kyrri0bvhkzvyngamsacx62n2dhb2j2gs495z4ghyh1p345i";
+          url = "mirror://luarocks/lsp-progress.nvim-1.0.14-1.rockspec";
+          sha256 = "0b2fi0asrqhw7yiikg7ds8yjwqmsh1xl3qcqzkwabm5sxila5ai7";
         }).outPath;
       src = fetchzip {
-        url = "https://github.com/linrongbin16/lsp-progress.nvim/archive/d5f4d28efe75ce636bfbe271eb45f39689765aab.zip";
-        sha256 = "0h63z55gwv36rahhha8vkbxb9n4f8psa265khz719i97j17x39rr";
+        url = "https://github.com/linrongbin16/lsp-progress.nvim/archive/f61cb7a788e4695ed9ae5e1b6b01bfff8f136f8b.zip";
+        sha256 = "04bdnag8wnahfl0g1x3i9dgs5rd6rjhbyyrj48wjg5lyc58qgb2x";
       };
 
       disabled = luaOlder "5.1";
@@ -2983,17 +2983,17 @@ final: prev: {
     }:
     buildLuarocksPackage {
       pname = "luarocks-build-rust-mlua";
-      version = "0.2.4-1";
+      version = "0.2.5-1";
       knownRockspec =
         (fetchurl {
-          url = "mirror://luarocks/luarocks-build-rust-mlua-0.2.4-1.rockspec";
-          sha256 = "1mi4lpd2an35rb61vz9070102yqykr2hpb850dh33lr377b7y2bh";
+          url = "mirror://luarocks/luarocks-build-rust-mlua-0.2.5-1.rockspec";
+          sha256 = "0h5y2wjv6zpd44jsgv4aiiv5wjj0fls0c81m6wbgr7vl5sx10dnm";
         }).outPath;
       src = fetchFromGitHub {
         owner = "mlua-rs";
         repo = "luarocks-build-rust-mlua";
-        rev = "0.2.4";
-        hash = "sha256-uAoAvn95FdGhMnzDT3Z2aQZyM1AG+HNPCF/J2shKVbQ=";
+        rev = "0.2.5";
+        hash = "sha256-OJk0UgM+GzuE7+AlpdTc3wcoelOk4tS3uOzjsZreBKs=";
       };
 
       meta = {
@@ -3596,15 +3596,15 @@ final: prev: {
     }:
     buildLuarocksPackage {
       pname = "lze";
-      version = "0.11.4-1";
+      version = "0.11.5-1";
       knownRockspec =
         (fetchurl {
-          url = "mirror://luarocks/lze-0.11.4-1.rockspec";
-          sha256 = "1gj3isq6d3zp99y5zsiq64s2kszhvscg74hm0s0mnsj6sg7zbqm1";
+          url = "mirror://luarocks/lze-0.11.5-1.rockspec";
+          sha256 = "09am4f3gg4yxj9851aali33dxws46s7fa3479fc2m5kcj5d30lly";
         }).outPath;
       src = fetchzip {
-        url = "https://github.com/BirdeeHub/lze/archive/v0.11.4.zip";
-        sha256 = "1zmda6qvjc9dd7dpz6gl8qmn8bnknazklb59bzxn95pz6n89fry0";
+        url = "https://github.com/BirdeeHub/lze/archive/v0.11.5.zip";
+        sha256 = "1ga2x9pcd3b5mal13kc70qsqjqba9vm3vvknj75qqd3va7jhpr5l";
       };
 
       disabled = luaOlder "5.1";
@@ -3981,15 +3981,15 @@ final: prev: {
     }:
     buildLuarocksPackage {
       pname = "neotest";
-      version = "5.9.1-1";
+      version = "5.11.0-1";
       knownRockspec =
         (fetchurl {
-          url = "mirror://luarocks/neotest-5.9.1-1.rockspec";
-          sha256 = "1q2589rjwbhhbxdf30n6kq1dmvlj27bn57rbv63s4x47qdzdnzfb";
+          url = "mirror://luarocks/neotest-5.11.0-1.rockspec";
+          sha256 = "09zij8y0514syna8wayra4fk8imz8j31qc3qy2rra74lkycvi26n";
         }).outPath;
       src = fetchzip {
-        url = "https://github.com/nvim-neotest/neotest/archive/3c81345c28cd639fcc02843ed3653be462f47024.zip";
-        sha256 = "1rqfxhy0c721hzz9azp1w403b8bccq6q24miynb42z4hc14qh8nm";
+        url = "https://github.com/nvim-neotest/neotest/archive/35a59c1f59dbb954d92b74ab64a966a668cea495.zip";
+        sha256 = "1arc0yprfbz9cfh9icm827s52nzkkz13zxlg3jbkmg95nqbp68lg";
       };
 
       disabled = luaOlder "5.1";
@@ -4390,17 +4390,17 @@ final: prev: {
     }:
     buildLuarocksPackage {
       pname = "rapidjson";
-      version = "0.7.1-1";
+      version = "0.7.2-1";
       knownRockspec =
         (fetchurl {
-          url = "mirror://luarocks/rapidjson-0.7.1-1.rockspec";
-          sha256 = "01lbsn9rckdyx0va7nm9dammic9117kxiawp55yg2h5q3p978d41";
+          url = "mirror://luarocks/rapidjson-0.7.2-1.rockspec";
+          sha256 = "1g3gw1rr54jvylq7afzkqdpid3h7nlmk76hmfva8xzhcdvbcl88h";
         }).outPath;
       src = fetchFromGitHub {
         owner = "xpol";
         repo = "lua-rapidjson";
-        rev = "v0.7.1";
-        hash = "sha256-y/czEVPtCt4uN1n49Qi7BrgZmkG+SDXlM5D2GvvO2qg=";
+        rev = "v0.7.2";
+        hash = "sha256-WdfGIgbwlMMItsasN+ZITd/iqSeHC0EVeYoUcolb1MU=";
       };
 
       disabled = luaOlder "5.1";
@@ -4651,15 +4651,15 @@ final: prev: {
     }:
     buildLuarocksPackage {
       pname = "rustaceanvim";
-      version = "6.7.0-1";
+      version = "6.9.1-1";
       knownRockspec =
         (fetchurl {
-          url = "mirror://luarocks/rustaceanvim-6.7.0-1.rockspec";
-          sha256 = "0f6rwnf7n7gq9kbpgn0g221fif910wcfsl4bx4qabj9wcyjdvss4";
+          url = "mirror://luarocks/rustaceanvim-6.9.1-1.rockspec";
+          sha256 = "1ah0f2n8dkdy50spsbly2pfzz1x0ld1ghgnrh3l6vr4fjbjwyk8d";
         }).outPath;
       src = fetchzip {
-        url = "https://github.com/mrcjkb/rustaceanvim/archive/v6.7.0.zip";
-        sha256 = "00hni3yyj7xvcx0swkv7dqgrpsihiwiivvgd6ir7f3kh01za6m02";
+        url = "https://github.com/mrcjkb/rustaceanvim/archive/v6.9.1.zip";
+        sha256 = "09rwfr8k4k4kivkq828q14l7shpispqwzrbmnvglzdhd3ziy4189";
       };
 
       disabled = luaOlder "5.1";

pkgs/development/lua-modules/overrides.nix

@@ -781,6 +781,11 @@ in
     checkPhase = ''
       runHook preCheck
       export LUA_PATH="./lua/?.lua;./lua/?/init.lua;$LUA_PATH"
+
+      # TODO: Investigate if test infra issue or upstream issue
+      # Remove failing subprocess tests that require channel functionality
+      rm tests/unit/lib/subprocess_spec.lua
+
       nvim --headless -i NONE \
         --cmd "set rtp+=${vimPlugins.plenary-nvim}" \
         -c "PlenaryBustedDirectory tests/ {sequential = true}"

pkgs/development/ocaml-modules/bstr/default.nix

@@ -0,0 +1,24 @@
+{
+  fetchurl,
+  buildDunePackage,
+  lib,
+}:
+
+buildDunePackage rec {
+  pname = "bstr";
+  version = "0.0.2";
+
+  minimalOCamlVersion = "4.13";
+
+  src = fetchurl {
+    url = "https://github.com/robur-coop/bstr/releases/download/v${version}/bstr-${version}.tbz";
+    hash = "sha256-/zvzCBzT014OesTmxGBDB98ZRU++YNDLUZ8uaDK3keM=";
+  };
+
+  meta = {
+    description = "A simple library for bigstrings";
+    homepage = "https://git.robur.coop/robur/bstr";
+    license = lib.licenses.mit;
+    maintainers = [ lib.maintainers.vbgl ];
+  };
+}

pkgs/development/ocaml-modules/git/paf.nix

@@ -23,6 +23,11 @@ buildDunePackage {
 
   inherit (git) version src;
 
+  postPatch = ''
+    substituteInPlace src/git-paf/dune --replace-fail bigstringaf 'bigstringaf bstr'
+    substituteInPlace src/git-paf/git_paf.ml --replace-fail Bigstringaf.t Bstr.t
+  '';
+
   minimalOCamlVersion = "4.08";
 
   propagatedBuildInputs = [

pkgs/development/ocaml-modules/h1/default.nix

@@ -3,11 +3,12 @@
   buildDunePackage,
   fetchurl,
   angstrom,
-  bigstringaf,
+  base64,
+  bstr,
   faraday,
   httpun-types,
   alcotest,
-  version ? "1.0.0",
+  version ? "1.1.0",
 }:
 
 buildDunePackage {
@@ -17,12 +18,13 @@ buildDunePackage {
 
   src = fetchurl {
     url = "https://github.com/robur-coop/ocaml-h1/releases/download/v${version}/h1-${version}.tbz";
-    hash = "sha256-uFHRcNmfHiFmdMAMKiS5KilIwMylf/AoJCfxllrIvRM=";
+    hash = "sha256-LTBn7TgBY5IBSfvpFJ1b2mMLT0XjwQvnk77qBqB8bTw=";
   };
 
   propagatedBuildInputs = [
     angstrom
-    bigstringaf
+    base64
+    bstr
     faraday
     httpun-types
   ];

pkgs/development/ocaml-modules/lwt/default.nix

@@ -6,19 +6,26 @@
   cppo,
   dune-configurator,
   ocplib-endian,
+  ppxlib,
+  version ? if lib.versionAtLeast ppxlib.version "0.36" then "5.9.2" else "5.9.1",
 }:
 
-buildDunePackage rec {
+buildDunePackage {
   pname = "lwt";
-  version = "5.9.1";
+  inherit version;
 
   minimalOCamlVersion = "4.08";
 
   src = fetchFromGitHub {
     owner = "ocsigen";
     repo = "lwt";
-    rev = version;
-    hash = "sha256-oPYLFugMTI3a+hmnwgUcoMgn5l88NP1Roq0agLhH/vI=";
+    tag = version;
+    hash =
+      {
+        "5.9.1" = "sha256-oPYLFugMTI3a+hmnwgUcoMgn5l88NP1Roq0agLhH/vI=";
+        "5.9.2" = "sha256-pzowRN1wwaF2iMfMPE7RCtA2XjlaXC3xD0yznriVfu8=";
+      }
+      ."${version}";
   };
 
   nativeBuildInputs = [ cppo ];

pkgs/development/ocaml-modules/lwt/ppx.nix

@@ -1,7 +1,6 @@
 {
   lib,
   fetchFromGitHub,
-  fetchpatch,
   buildDunePackage,
   lwt,
   ppxlib,
@@ -11,11 +10,6 @@ buildDunePackage {
   pname = "lwt_ppx";
   inherit (lwt) version src;
 
-  patches = lib.optional (lib.versionAtLeast ppxlib.version "0.36") (fetchpatch {
-    url = "https://github.com/ocsigen/lwt/commit/96b7ac686208968503786bb6d101f4ee84c8d2e6.patch";
-    hash = "sha256-uxTwNVqV0O11WEKy66fphvGqW17FWDEzEylhVYNwNnY=";
-  });
-
   propagatedBuildInputs = [
     lwt
     ppxlib

pkgs/development/ocaml-modules/num/default.nix

@@ -2,7 +2,6 @@
   stdenv,
   lib,
   fetchFromGitHub,
-  fetchpatch,
   ocaml,
   findlib,
   withStatic ? false,
@@ -10,22 +9,21 @@
 
 stdenv.mkDerivation (
   rec {
-    version = "1.1";
+    version = "1.6";
     pname = "ocaml${ocaml.version}-num";
     src = fetchFromGitHub {
       owner = "ocaml";
       repo = "num";
-      rev = "v${version}";
-      sha256 = "0a4mhxgs5hi81d227aygjx35696314swas0vzy3ig809jb7zq4h0";
+      tag = "v${version}";
+      hash = "sha256-JWn0WBsbKpiUlxRDaXmwXVbL2WhqQIDrXiZk1aXeEtQ=";
     };
 
-    patches = [
-      (fetchpatch {
-        url = "https://github.com/ocaml/num/commit/6d4c6d476c061298e6385e8a0864f083194b9307.patch";
-        sha256 = "18zlvb5n327q8y3c52js5dvyy29ssld1l53jqng8m9w1k24ypi0b";
-      })
-    ]
-    ++ lib.optional withStatic ./enable-static.patch;
+    patches = lib.optional withStatic ./enable-static.patch;
+
+    postPatch = ''
+      substituteInPlace num.opam --replace-fail '1.7~dev' "${version}"
+      substituteInPlace src/Makefile --replace-fail "cp META.num META" "mv META.num META"
+    '';
 
     nativeBuildInputs = [
       ocaml
@@ -36,6 +34,8 @@ stdenv.mkDerivation (
 
     createFindlibDestdir = true;
 
+    installTargets = "findlib-install";
+
     meta = {
       description = "Legacy Num library for arbitrary-precision integer and rational arithmetic";
       license = lib.licenses.lgpl21;

pkgs/development/php-packages/php-cs-fixer/default.nix

@@ -7,26 +7,24 @@
 
 php.buildComposerProject2 (finalAttrs: {
   pname = "php-cs-fixer";
-  version = "3.73.1";
+  version = "3.86.0";
 
   src = fetchFromGitHub {
     owner = "PHP-CS-Fixer";
     repo = "PHP-CS-Fixer";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-1sivnmQDqyYVimac6yjKHTGSmJlx9WFCoQJXiZVce9Y=";
+    hash = "sha256-b68m8FVGf3qUbG1otRAQ8mnY0k3IBRBvigLYowgVH1g=";
   };
 
-  # Upstream doesn't provide a composer.lock.
-  # More info at https://github.com/PHP-CS-Fixer/PHP-CS-Fixer/issues/7590
   composerLock = ./composer.lock;
-  vendorHash = "sha256-ywJ2Gj9vMeu1pOg2UtfWDaxU+mpt/ay5KNQiWZGm6h4=";
+  vendorHash = "sha256-JNtAMvuz9lFA+5c0O9XnI3Pid8TD1HaBqW2V2YDzkGw=";
 
   doInstallCheck = true;
   nativeInstallCheckInputs = [ versionCheckHook ];
   versionCheckProgramArg = "--version";
 
   meta = {
-    broken = lib.versionOlder php.version "8.2" || lib.versionAtLeast php.version "8.4";
+    broken = lib.versionOlder php.version "8.2";
     changelog = "https://github.com/PHP-CS-Fixer/PHP-CS-Fixer/releases/tag/v${finalAttrs.version}";
     description = "Tool to automatically fix PHP coding standards issues";
     homepage = "https://cs.symfony.com/";

pkgs/development/python-modules/deebot-client/default.nix

@@ -20,7 +20,7 @@
 
 buildPythonPackage rec {
   pname = "deebot-client";
-  version = "13.6.0";
+  version = "13.7.0";
   pyproject = true;
 
   disabled = pythonOlder "3.13";
@@ -29,12 +29,12 @@ buildPythonPackage rec {
     owner = "DeebotUniverse";
     repo = "client.py";
     tag = version;
-    hash = "sha256-/8IBXPqDHgAa7v5+c1co9cABXXaZJZhZy5N2TzVKG7Q=";
+    hash = "sha256-38o4hSeCxeKbfjG30XN3pex4hI4mAKRGvaybAlo8hV8=";
   };
 
   cargoDeps = rustPlatform.fetchCargoVendor {
     inherit pname version src;
-    hash = "sha256-pJSbNgDLq+c3KLVXXZGr7jc7crrbZLcyO//sXJK/bA4=";
+    hash = "sha256-KeOoOupIParD8id7xlkBigjr5Lo9yeFkClh4pPQE3cM=";
   };
 
   pythonRelaxDeps = [

pkgs/development/python-modules/holidays/default.nix

@@ -14,7 +14,7 @@
 
 buildPythonPackage rec {
   pname = "holidays";
-  version = "0.79";
+  version = "0.80";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -23,7 +23,7 @@ buildPythonPackage rec {
     owner = "vacanza";
     repo = "python-holidays";
     tag = "v${version}";
-    hash = "sha256-z1baUtD+GFPSRi8siT5X5QSSU2enC0cfnzNwYLHcWTQ=";
+    hash = "sha256-zKsJ85dd+SE2OL0t/5aHtXoHsz2WuTkg11mo2wlmeTM=";
   };
 
   build-system = [

pkgs/development/python-modules/mat2/default.nix

@@ -41,6 +41,16 @@ buildPythonPackage rec {
       url = "https://0xacab.org/jvoisin/mat2/-/commit/473903b70e1b269a6110242a9c098a10c18554e2.patch";
       hash = "sha256-vxxjAFwiTDlcTT3ZlfhOG4rlzBJS+LhLoA++8y2hEok=";
     })
+    (fetchpatch {
+      name = "fix-test-on-python313.patch";
+      url = "https://0xacab.org/jvoisin/mat2/-/commit/f07344444d6d2f04a1f93e2954f4910b194bee0c.patch";
+      hash = "sha256-y756sKkjGO11A2lrRsXAwWgupOZ00u0cDypvkbsiNbY=";
+    })
+    (fetchpatch {
+      name = "fix-test-on-python312.patch";
+      url = "https://0xacab.org/jvoisin/mat2/-/commit/7a8ea224bc327b8ee929379d577c74968ea1c352.patch";
+      hash = "sha256-pPiYhoql5WhjhLKvd6y3OnvxORSbXIGCsZMc7UH3i1Q=";
+    })
     # hardcode paths to some binaries
     (replaceVars ./paths.patch {
       exiftool = lib.getExe exiftool;

pkgs/development/python-modules/mkdocs-table-reader-plugin/default.nix

@@ -0,0 +1,60 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  setuptools,
+  mkdocs,
+  pandas,
+  tabulate,
+  pyyaml,
+  pytestCheckHook,
+  openpyxl,
+  mkdocs-macros,
+}:
+
+buildPythonPackage rec {
+  pname = "mkdocs-table-reader-plugin";
+  version = "3.1.0";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "timvink";
+    repo = "mkdocs-table-reader-plugin";
+    tag = "v${version}";
+    hash = "sha256-XyMz0CeLQderzzz/Z3H6rja619wPzx42X3jz30wt6a8=";
+  };
+
+  build-system = [
+    setuptools
+  ];
+
+  dependencies = [
+    mkdocs
+    pandas
+    tabulate
+    pyyaml
+  ];
+
+  nativeCheckInputs = [
+    pytestCheckHook
+    openpyxl
+    mkdocs-macros
+  ];
+
+  pythonImportsCheck = [
+    "mkdocs_table_reader_plugin"
+  ];
+
+  disabledTests = [
+    # fails with non zero exit code without printing stdout/stderr of `mkdocs build` -> cause unknown
+    "test_compatibility_markdownextradata"
+    "test_macros_jinja2_syntax"
+  ];
+
+  meta = {
+    description = "MkDocs plugin that enables a markdown tag like {{ read_csv('table.csv') }} to directly insert various table formats into a page";
+    homepage = "https://github.com/timvink/mkdocs-table-reader-plugin";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ marcel ];
+  };
+}

pkgs/development/python-modules/osc-lib/default.nix

@@ -11,6 +11,7 @@
   requests,
   requests-mock,
   setuptools,
+  stdenv,
   stestr,
   stevedore,
 }:
@@ -27,8 +28,7 @@ buildPythonPackage rec {
     hash = "sha256-mFZLVlq2mFgx5yQLBPVVT/zDLbOJ/EodAwsm/QxvW0Q=";
   };
 
-  # fake version to make pbr.packaging happy and not reject it...
-  PBR_VERSION = version;
+  env.PBR_VERSION = version;
 
   build-system = [
     pbr
@@ -51,7 +51,13 @@ buildPythonPackage rec {
   ];
 
   checkPhase = ''
-    stestr run
+    stestr run -e <(echo "
+    ${lib.optionalString stdenv.hostPlatform.isDarwin ''
+      osc_lib.tests.test_shell.TestShellCli.test_shell_args_cloud_public
+      osc_lib.tests.test_shell.TestShellCli.test_shell_args_precedence
+      osc_lib.tests.test_shell.TestShellCliPrecedence.test_shell_args_precedence_1
+      osc_lib.tests.test_shell.TestShellCliPrecedence.test_shell_args_precedence_2
+    ''}")
   '';
 
   pythonImportsCheck = [ "osc_lib" ];

pkgs/development/python-modules/oslo-concurrency/default.nix

@@ -1,57 +1,58 @@
 {
   lib,
   buildPythonPackage,
-  fetchPypi,
+  fetchFromGitHub,
   bash,
   coreutils,
+  debtcollector,
   eventlet,
   fasteners,
   fixtures,
   iana-etc,
   libredirect,
   oslo-config,
+  oslo-i18n,
   oslo-utils,
   oslotest,
   pbr,
   setuptools,
+  stdenv,
   stestr,
 }:
 
 buildPythonPackage rec {
   pname = "oslo-concurrency";
-  version = "7.1.0";
+  version = "7.2.0";
   pyproject = true;
 
-  src = fetchPypi {
-    pname = "oslo_concurrency";
-    inherit version;
-    hash = "sha256-34qHf4ACsH1p8dDnDbzvSSDTkkmqpi5Hj60haz3UFMs=";
+  src = fetchFromGitHub {
+    owner = "openstack";
+    repo = "oslo.concurrency";
+    tag = version;
+    hash = "sha256-72KatSWTCx4hyUel2Fu5yiqrdYveRGruvJDWWo1hkIk=";
   };
 
   postPatch = ''
-    # only a small portion of the listed packages are actually needed for running the tests
-    # so instead of removing them one by one remove everything
-    rm test-requirements.txt
-
     substituteInPlace oslo_concurrency/tests/unit/test_processutils.py \
+      --replace-fail "/usr" "" \
       --replace-fail "/bin/bash" "${bash}/bin/bash" \
-      --replace-fail "/usr/bin/true" "${coreutils}/bin/true" \
       --replace-fail "/bin/true" "${coreutils}/bin/true" \
-      --replace-fail "/usr/bin/env" "${coreutils}/bin/env"
+      --replace-fail "/bin/env" "${coreutils}/bin/env"
   '';
 
+  env.PBR_VERSION = version;
+
   build-system = [ setuptools ];
 
   dependencies = [
+    debtcollector
     fasteners
     oslo-config
+    oslo-i18n
     oslo-utils
     pbr
   ];
 
-  # tests hang for unknown reason and time the build out
-  doCheck = false;
-
   nativeCheckInputs = [
     eventlet
     fixtures
@@ -67,7 +68,14 @@ buildPythonPackage rec {
     stestr run -e <(echo "
     oslo_concurrency.tests.unit.test_lockutils_eventlet.TestInternalLock.test_fair_lock_with_spawn
     oslo_concurrency.tests.unit.test_lockutils_eventlet.TestInternalLock.test_fair_lock_with_spawn_n
-    ")
+    oslo_concurrency.tests.unit.test_lockutils_eventlet.TestInternalLock.test_lock_with_spawn
+    oslo_concurrency.tests.unit.test_lockutils_eventlet.TestInternalLock.test_lock_with_spawn_n
+    ${lib.optionalString stdenv.hostPlatform.isDarwin ''
+      oslo_concurrency.tests.unit.test_lockutils.FileBasedLockingTestCase.test_interprocess_nonblocking_external_lock
+      oslo_concurrency.tests.unit.test_lockutils.LockTestCase.test_lock_externally
+      oslo_concurrency.tests.unit.test_lockutils.LockTestCase.test_lock_externally_lock_dir_not_exist
+      oslo_concurrency.tests.unit.test_processutils.PrlimitTestCase.test_stack_size
+    ''}")
   '';
 
   pythonImportsCheck = [ "oslo_concurrency" ];

pkgs/development/python-modules/pyldavis/default.nix

@@ -43,7 +43,6 @@ buildPythonPackage rec {
   meta = with lib; {
     homepage = "https://github.com/bmabey/pyLDAvis";
     description = "Python library for interactive topic model visualization";
-    maintainers = with lib.maintainers; [ gm6k ];
     license = licenses.bsd3;
     sourceProvenance = with sourceTypes; [ fromSource ];
     platforms = platforms.all;

pkgs/development/python-modules/python-octaviaclient/default.nix

@@ -8,7 +8,6 @@
   hacking,
   keystoneauth1,
   makePythonPath,
-  openstackclient,
   openstackdocstheme,
   installer,
   osc-lib,
@@ -18,6 +17,7 @@
   pbr,
   pygments,
   python-neutronclient,
+  python-openstackclient,
   requests,
   requests-mock,
   setuptools,
@@ -57,7 +57,7 @@ buildPythonPackage rec {
     cliff
     keystoneauth1
     python-neutronclient
-    openstackclient
+    python-openstackclient
     osc-lib
     oslo-serialization
     oslo-utils

pkgs/development/python-modules/pytorch-pfn-extras/default.nix

@@ -22,14 +22,14 @@
 
 buildPythonPackage rec {
   pname = "pytorch-pfn-extras";
-  version = "0.8.3";
+  version = "0.8.4";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "pfnet";
     repo = "pytorch-pfn-extras";
     tag = "v${version}";
-    hash = "sha256-aTWPFYEc29qHOPRZu15p+x9DofMNRnTHnVEhxdPQ0Ak=";
+    hash = "sha256-OrUYO0V5fWqkIjHiYkhvjeFy0YX8CxeRqzrw3NfGK2A=";
   };
 
   build-system = [ setuptools ];

pkgs/development/python-modules/sphinx-tippy/default.nix

@@ -0,0 +1,54 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  flit-core,
+  beautifulsoup4,
+  jinja2,
+  requests,
+  sphinx,
+  sphinxHook,
+  furo,
+  myst-parser,
+}:
+
+buildPythonPackage rec {
+  pname = "sphinx-tippy";
+  version = "0.4.3";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "sphinx-extensions2";
+    repo = pname;
+    tag = "v${version}";
+    hash = "sha256-+EXvj8Q6eMu51Gh4hLD6h8I7PDZaeVH+2pZuQUMVH+4=";
+  };
+
+  build-system = [
+    flit-core
+  ];
+
+  nativeBuildInputs = [
+    sphinxHook
+    furo
+    myst-parser
+  ];
+
+  dependencies = [
+    beautifulsoup4
+    jinja2
+    requests
+    sphinx
+  ];
+
+  pythonImportsCheck = [
+    "sphinx_tippy"
+  ];
+
+  meta = {
+    description = "Get rich tool tips in your sphinx documentation";
+    homepage = "https://sphinx-tippy.readthedocs.io/en/latest/";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ minijackson ];
+  };
+}

pkgs/development/python-modules/spsdk-mcu-link/default.nix

@@ -22,14 +22,14 @@
 
 buildPythonPackage rec {
   pname = "spsdk-mcu-link";
-  version = "0.6.5";
+  version = "0.6.6";
   pyproject = true;
 
   # Latest tag missing on GitHub
   src = fetchPypi {
     pname = "spsdk_mcu_link";
     inherit version;
-    hash = "sha256-rjPmMKmRs3+wtH4aWvGiA1NNVteytbH4bx5ihJ5BkMc=";
+    hash = "sha256-KISqhJJFtHFCDOFs+Zx0ghX0lGK5tazVqEIOT9gyAQs=";
   };
 
   build-system = [

pkgs/development/python-modules/swift/default.nix

@@ -24,12 +24,12 @@
 
 buildPythonPackage rec {
   pname = "swift";
-  version = "2.35.0";
+  version = "2.35.1";
   pyproject = true;
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-x8RPQAPOERJShgYPy4uiezkHHSaxhftslEWqD7ShO40=";
+    hash = "sha256-1C0l2TlXoiFzxaZIAWz3h1cq8f11LcwGi3slpknimHU=";
   };
 
   nativeBuildInputs = [ installShellFiles ];

pkgs/development/python-modules/typst/default.nix

@@ -13,7 +13,7 @@
 
 buildPythonPackage rec {
   pname = "typst";
-  version = "0.13.5";
+  version = "0.13.7";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -22,12 +22,12 @@ buildPythonPackage rec {
     owner = "messense";
     repo = "typst-py";
     tag = "v${version}";
-    hash = "sha256-MGO5OSUlFvYBzNm71Rs84yr4j30kKCg/pqvRdQqwk+A=";
+    hash = "sha256-kbdYiWix1gDZPTkmjtrSRV/g60bLKxGbv776ezPaSCA=";
   };
 
   cargoDeps = rustPlatform.fetchCargoVendor {
     inherit pname version src;
-    hash = "sha256-/R0iFrqWtIATtgPrw88WDD00ML8XrTFgoOABLFzgtyk=";
+    hash = "sha256-IhTrGAgGgSPCD1d3pblCOME0AHv5GMV9xRUNSGTXEws=";
   };
 
   build-system = [

pkgs/development/tools/nwjs/default.nix

@@ -91,7 +91,7 @@ let
     ];
   };
 
-  version = "0.100.1";
+  version = "0.102.1";
 in
 stdenv.mkDerivation {
   pname = "nwjs";
@@ -103,12 +103,14 @@ stdenv.mkDerivation {
     in
     fetchurl {
       url = "https://dl.nwjs.io/v${version}/nwjs-${flavor}v${version}-linux-${bits}.tar.gz";
+      # TODO: Write an update script to update all 4 hashes.
+      # nixpkgs-update: no auto update
       hash =
         {
-          "sdk-ia32" = "sha256-8T3lyQi5tvXhThapng/l+wEbmXdUQBqPT7HHDBpEk5Y=";
-          "sdk-x64" = "sha256-nD1MYEm+4sq4MHkiOI46IgM6oDWpcyVWl3Yis0beEIg=";
-          "ia32" = "sha256-TfAw7+z/I3eYRn20DN0sR9moqD23UG7nvQbeXQDNDcg=";
-          "x64" = "sha256-EqLESL4zVdBzFvhPgXfcIwSVNNBVIMy1SdCu6eNU96Q=";
+          "sdk-ia32" = "sha256-uzDbEq2vNC+fm95Co3lnQX7mrUXsIDWFoa0osWCn3EM=";
+          "sdk-x64" = "sha256-jWw5kXYGxu7oen8fK2Q58QPhiBRC6H2ibGXkeUFW2pI=";
+          "ia32" = "sha256-oODdSKNlOPSLD9vAqRwYcAgH6mumyOB5Fp6G9ifSgok=";
+          "x64" = "sha256-WhHV+xj2ngEz+i1ipBhwZD9b0EF/hdi8gMBZw5qYRGA=";
         }
         ."${flavor + bits}";
     };

pkgs/tools/misc/opentelemetry-collector/builder.nix

@@ -7,17 +7,17 @@ buildGoModule rec {
   pname = "ocb";
   # Also update `pkgs/tools/misc/opentelemetry-collector/releases.nix`
   # whenever that version changes.
-  version = "0.131.0";
+  version = "0.134.0";
 
   src = fetchFromGitHub {
     owner = "open-telemetry";
     repo = "opentelemetry-collector";
     rev = "cmd/builder/v${version}";
-    hash = "sha256-T4Ffa3csQaxoRxSobNpoHqyOw6PrKdPj1XUmdrSK5d8=";
+    hash = "sha256-GcymSaVqCMQ9P3WsfOochG4mWJ/VHIzL2qK4tCszTA0=";
   };
 
   sourceRoot = "${src.name}/cmd/builder";
-  vendorHash = "sha256-1240ZKF6/MqspTXd5rznE4/bZ2QWmXS0KgPwuCdm/lA=";
+  vendorHash = "sha256-fyKeskSdAnl04lCqHFoVbTW3cJaRtAZMQH/uaa0Nbt4=";
 
   env.CGO_ENABLED = 0;
   ldflags = [

pkgs/top-level/all-packages.nix

@@ -5147,10 +5147,10 @@ with pkgs;
 
   # Haskell and GHC
 
-  haskell = callPackage ./haskell-packages.nix { };
+  haskell = recurseIntoAttrs (callPackage ./haskell-packages.nix { });
 
   haskellPackages =
-    dontRecurseIntoAttrs
+    recurseIntoAttrs
       # Prefer native-bignum to avoid linking issues with gmp
       # GHC 9.6 rts can't be built statically with hadrian, so we need to use 9.4
       # until 9.8 is ready