Merge master into staging-nixos

nixos/modules/services/web-apps/lasuite-docs.nix

@@ -346,6 +346,56 @@ in
   };
 
   config = mkIf cfg.enable {
+    systemd.services.lasuite-docs-postgresql-setup = mkIf cfg.postgresql.createLocally {
+      wantedBy = [ "lasuite-docs.target" ];
+      requiredBy = [ "lasuite-docs.service" ];
+      before = [ "lasuite-docs.service" ];
+      after = [ "postgresql-setup.service" ];
+
+      serviceConfig = {
+        Slice = "system-lasuite-docs.slice";
+        Type = "oneshot";
+        User = "postgres";
+
+        # lasuite-docs user cannot create a C function as it is unsafe.
+        ExecStart = ''
+          ${lib.getExe' config.services.postgresql.package "psql"} --port=${toString config.services.postgresql.settings.port} -d lasuite-docs -c "CREATE OR REPLACE FUNCTION public.immutable_unaccent(regdictionary, text) RETURNS text LANGUAGE c IMMUTABLE PARALLEL SAFE STRICT AS '$libdir/unaccent', 'unaccent_dict';"
+        '';
+
+        # hardening
+        AmbientCapabilities = "";
+        CapabilityBoundingSet = [ "" ];
+        DevicePolicy = "closed";
+        LockPersonality = true;
+        NoNewPrivileges = true;
+        PrivateDevices = true;
+        PrivateTmp = true;
+        PrivateUsers = true;
+        ProcSubset = "pid";
+        ProtectClock = true;
+        ProtectControlGroups = true;
+        ProtectHome = true;
+        ProtectHostname = true;
+        ProtectKernelLogs = true;
+        ProtectKernelModules = true;
+        ProtectKernelTunables = true;
+        ProtectProc = "invisible";
+        ProtectSystem = "strict";
+        RemoveIPC = true;
+        RestrictAddressFamilies = [
+          "AF_INET"
+          "AF_INET6"
+          "AF_UNIX"
+        ];
+        RestrictNamespaces = true;
+        RestrictRealtime = true;
+        RestrictSUIDSGID = true;
+        SystemCallArchitectures = "native";
+        UMask = "0077";
+      };
+
+    };
+
     systemd.services.lasuite-docs = {
       description = "Docs from SuiteNumérique";
       after = [

pkgs/applications/editors/vim/plugins/generated.nix

@@ -22118,6 +22118,19 @@ final: prev: {
     meta.hydraPlatforms = [ ];
   };
 
+  vim-waikiki = buildVimPlugin {
+    pname = "vim-waikiki";
+    version = "0-unstable-2020-09-19";
+    src = fetchFromGitHub {
+      owner = "fcpg";
+      repo = "vim-waikiki";
+      rev = "7af1879a8ea0e4a0a7bd181ed17ad3d37478215e";
+      hash = "sha256-8zMKrmCV4Erp0Q4WyuqyyKgZS5JGu1dXSzrhftdmNFE=";
+    };
+    meta.homepage = "https://github.com/fcpg/vim-waikiki/";
+    meta.hydraPlatforms = [ ];
+  };
+
   vim-wakatime = buildVimPlugin {
     pname = "vim-wakatime";
     version = "11.3.0-unstable-2025-08-31";

pkgs/applications/editors/vim/plugins/vim-plugin-names

@@ -1698,6 +1698,7 @@ https://github.com/hrsh7th/vim-vsnip/,,
 https://github.com/hrsh7th/vim-vsnip-integ/,,
 https://github.com/posva/vim-vue/,,
 https://github.com/leafOfTree/vim-vue-plugin/,HEAD,
+https://github.com/fcpg/vim-waikiki/,HEAD,
 https://github.com/wakatime/vim-wakatime/,,
 https://github.com/osyo-manga/vim-watchdogs/,,
 https://github.com/jasonccox/vim-wayland-clipboard/,,

pkgs/applications/editors/vscode/extensions/charliermarsh.ruff/default.nix

@@ -12,26 +12,26 @@ vscode-utils.buildVscodeMarketplaceExtension {
       sources = {
         "x86_64-linux" = {
           arch = "linux-x64";
-          hash = "sha256-oN7pb/KKhzx7LgODvEh5GyX9Nismtz1lsDcGsDlmaO0=";
+          hash = "sha256-Mm0OXz9yURDyi8liVhbzrAAFB+atfSu4YKaanxsLN1s=";
         };
         "x86_64-darwin" = {
           arch = "darwin-x64";
-          hash = "sha256-MeX4waPhX4/hmQH+iYs+RZlRGC/giXOtXG31zSAzcKI=";
+          hash = "sha256-wWIve2qM3qXcuuCA63Xc5S69UdOTvNDWjyQfaBsRruA=";
         };
         "aarch64-linux" = {
           arch = "linux-arm64";
-          hash = "sha256-pALbGD8Gikfyn4wNjCK9CTwZzaK/LjfHfJmFW0ns+yo=";
+          hash = "sha256-1ckD1nc2K/hJHZPXDZ/eCE2zIQGkvDJGyDiFD/3V/xs=";
         };
         "aarch64-darwin" = {
           arch = "darwin-arm64";
-          hash = "sha256-Tr6KjEDTtCH3EgSKK0WqU/5w8gjSz3azhxHVHlXwZTw=";
+          hash = "sha256-T6+9h5pn/NI7ZDvl9hmCu8KWrleRiZ8qLEfsKPXO56A=";
         };
       };
     in
     {
       name = "ruff";
       publisher = "charliermarsh";
-      version = "2025.32.0";
+      version = "2026.34.0";
     }
     // sources.${stdenvNoCC.hostPlatform.system}
       or (throw "Unsupported system ${stdenvNoCC.hostPlatform.system}");

pkgs/applications/networking/browsers/firefox/packages/firefox.nix

@@ -9,10 +9,10 @@
 
 buildMozillaMach rec {
   pname = "firefox";
-  version = "147.0";
+  version = "147.0.1";
   src = fetchurl {
     url = "mirror://mozilla/firefox/releases/${version}/source/firefox-${version}.source.tar.xz";
-    sha512 = "ac9017b1a2da7b2f139392c394c36341fd3476e3d4ea1a3c7e5e7bf100dc30d185132ef9256be7e6b0f9dbfc69234ac571ea1fc6db9d84543b15772f4ec85161";
+    sha512 = "f1e1bc486451254f33b000fb4513fd948a5a6e84841980ee767c42d326e1856f44a8437c8fdbff2cb34d177fea2b1907fcd72dd33bcec3f06ddb8d88151853a8";
   };
 
   meta = {

pkgs/applications/networking/sniffers/wireshark/default.nix

@@ -58,7 +58,7 @@ assert withQt -> qt6 != null;
 
 stdenv.mkDerivation rec {
   pname = "wireshark-${if withQt then "qt" else "cli"}";
-  version = "4.6.2";
+  version = "4.6.3";
 
   outputs = [
     "out"
@@ -69,7 +69,7 @@ stdenv.mkDerivation rec {
     repo = "wireshark";
     owner = "wireshark";
     rev = "v${version}";
-    hash = "sha256-fojQ0D7v6xSDltpL3Y6iIzLj6pRZU/0U0ww+sVaWDZ8=";
+    hash = "sha256-DthYkAW6UYnsDLQf2h3jgJB8RZoasjREWV1NTtZv7PQ=";
   };
 
   patches = [

pkgs/applications/virtualization/OVMF/default.nix

@@ -136,7 +136,8 @@ edk2.mkDerivation projectDscPath (finalAttrs: {
     "stackprotector"
     "pic"
     "fortify"
-  ];
+  ]
+  ++ lib.optional stdenv.hostPlatform.isAarch64 "relro";
 
   buildFlags =
     # IPv6 has no reason to be disabled.

pkgs/build-support/build-mozilla-mach/default.nix

@@ -130,7 +130,9 @@ in
   jemallocSupport ? !stdenv.hostPlatform.isMusl,
   jemalloc,
   ltoSupport ? (
-    stdenv.hostPlatform.isLinux && stdenv.hostPlatform.is64bit && !stdenv.hostPlatform.isRiscV
+    (stdenv.hostPlatform.isLinux || stdenv.hostPlatform.isDarwin)
+    && stdenv.hostPlatform.is64bit
+    && !stdenv.hostPlatform.isRiscV
   ),
   overrideCC,
   buildPackages,
@@ -163,7 +165,7 @@ in
   geolocationSupport ? !privacySupport,
   webrtcSupport ? !privacySupport,
 
-  # digital rights managemewnt
+  # digital rights management
 
   # This flag controls whether Firefox will show the nagbar, that allows
   # users at runtime the choice to enable Widevine CDM support when a site
@@ -466,7 +468,7 @@ buildStdenv.mkDerivation {
     "--host=${buildStdenv.buildPlatform.config}"
     "--target=${buildStdenv.hostPlatform.config}"
   ]
-  # LTO is done using clang and lld on Linux.
+  # LTO is done using clang and lld.
   ++ lib.optionals ltoSupport [
     "--enable-lto=cross,full" # Cross-Language LTO
     "--enable-linker=lld"

pkgs/build-support/php/builders/v2/build-composer-project.nix

@@ -9,14 +9,14 @@ let
   buildComposerProjectOverride =
     finalAttrs:
     {
-      php ? finalAttrs.php or toplevel.php,
-      composer ? finalAttrs.php.packages.composer or toplevel.php.packages.composer,
-      composerLock ? finalAttrs.composerLock or null,
-      vendorHash ? finalAttrs.vendorHash or "",
-      composerNoDev ? finalAttrs.composerNoDev or true,
-      composerNoPlugins ? finalAttrs.composerNoPlugins or true,
-      composerNoScripts ? finalAttrs.composerNoScripts or true,
-      composerStrictValidation ? finalAttrs.composerStrictValidation or true,
+      php ? toplevel.php,
+      composer ? php.packages.composer,
+      composerLock ? null,
+      vendorHash ? "",
+      composerNoDev ? true,
+      composerNoPlugins ? true,
+      composerNoScripts ? true,
+      composerStrictValidation ? true,
       buildInputs ? [ ],
       nativeBuildInputs ? [ ],
       strictDeps ? true,
@@ -35,6 +35,9 @@ let
         doCheck
         doInstallCheck
         dontCheckForBrokenSymlinks
+        composerNoDev
+        composerNoPlugins
+        composerNoScripts
         ;
 
       nativeBuildInputs = nativeBuildInputs ++ [

pkgs/build-support/php/builders/v2/build-composer-vendor.nix

@@ -8,14 +8,14 @@ let
   mkComposerVendorOverride =
     finalAttrs:
     {
-      php ? finalAttrs.php or toplevel.php,
-      composer ? finalAttrs.php.packages.composer or toplevel.php.packages.composer,
-      composerLock ? finalAttrs.composerLock or null,
-      vendorHash ? finalAttrs.vendorHash or "",
-      composerNoDev ? finalAttrs.composerNoDev or true,
-      composerNoPlugins ? finalAttrs.composerNoPlugins or true,
-      composerNoScripts ? finalAttrs.composerNoScripts or true,
-      composerStrictValidation ? finalAttrs.composerStrictValidation or true,
+      php ? toplevel.php,
+      composer ? php.packages.composer,
+      composerLock ? null,
+      vendorHash ? "",
+      composerNoDev ? true,
+      composerNoPlugins ? true,
+      composerNoScripts ? true,
+      composerStrictValidation ? true,
       buildInputs ? [ ],
       nativeBuildInputs ? [ ],
       dontPatchShebangs ? true,

pkgs/build-support/php/builders/v2/hooks/composer-install-hook.sh

@@ -11,9 +11,9 @@ declare -g composerNoScripts
 
 declare -ga composerFlags=()
 
-[[ 1 == "${composerNoDev:-1}" ]] && composerFlags+=(--no-dev)
-[[ 1 == "${composerNoPlugins:-1}" ]] && composerFlags+=(--no-plugins)
-[[ 1 == "${composerNoScripts:-1}" ]] && composerFlags+=(--no-scripts)
+[[ -n "${composerNoDev-1}" ]] && composerFlags+=(--no-dev)
+[[ -n "${composerNoPlugins-1}" ]] && composerFlags+=(--no-plugins)
+[[ -n "${composerNoScripts-1}" ]] && composerFlags+=(--no-scripts)
 
 preConfigureHooks+=(composerInstallConfigureHook)
 preBuildHooks+=(composerInstallBuildHook)
@@ -57,13 +57,31 @@ composerInstallBuildHook() {
   cp -r "${composerVendor}/${COMPOSER_VENDOR_DIR}" .
   chmod -R +w "${COMPOSER_VENDOR_DIR}"
 
-  echo -e "\e[32mGenerating optimized autoloader and restoring 'bin' directory...\e[0m"
-  COMPOSER_DISABLE_NETWORK=1 composer \
-    "${composerFlags[@]}" \
-    --no-interaction \
-    --no-progress \
-    --optimize-autoloader \
-    install
+  mapfile -t installer_paths < <(jq -r -c 'try((.extra."installer-paths") | keys[])' composer.json)
+  for installer_path in "${installer_paths[@]}"; do
+    # Remove everything after {$name} placeholder
+    installer_path="${installer_path/\{\$name\}*/}"
+    if [[ -e "${composerVendor}/${installer_path}" ]]; then
+      echo -e "\e[32mRestoring custom installer path: ${installer_path}\e[0m"
+      mkdir -p "$(dirname "${installer_path}")"
+      cp -ar "${composerVendor}/${installer_path}" "${installer_path}"
+      # Strip out the git repositories
+      find "${installer_path}" -name .git -type d -prune -print -exec rm -rf {} ";" || true
+      chmod -R +w "${installer_path}"
+    fi
+  done
+
+  # Run this only if composer.lock is available.
+  # e.g., php-codesniffer doesn't need a composer.lock file.
+  if [[ -f "composer.lock" ]]; then
+    echo -e "\e[32mEnsuring Composer dependencies are locked to 'composer.lock'...\e[0m"
+    composer \
+      --no-cache \
+      --no-interaction \
+      --no-progress \
+      "${composerFlags[@]}" \
+      install
+  fi
 
   echo "Finished phase: composerInstallBuildHook"
 }

pkgs/build-support/php/builders/v2/hooks/composer-vendor-hook.sh

@@ -10,9 +10,10 @@ declare -g composerNoPlugins
 declare -g composerNoScripts
 
 declare -ga composerFlags=()
-[[ 1 == "${composerNoDev:-1}" ]] && composerFlags+=(--no-dev)
-[[ 1 == "${composerNoPlugins:-1}" ]] && composerFlags+=(--no-plugins)
-[[ 1 == "${composerNoScripts:-1}" ]] && composerFlags+=(--no-scripts)
+
+[[ -n "${composerNoDev-1}" ]] && composerFlags+=(--no-dev)
+[[ -n "${composerNoPlugins-1}" ]] && composerFlags+=(--no-plugins)
+[[ -n "${composerNoScripts-1}" ]] && composerFlags+=(--no-scripts)
 
 preConfigureHooks+=(composerVendorConfigureHook)
 preBuildHooks+=(composerVendorBuildHook)

pkgs/by-name/be/bento/package.nix

@@ -8,17 +8,17 @@
 
 buildGoModule rec {
   pname = "bento";
-  version = "1.14.0";
+  version = "1.14.1";
 
   src = fetchFromGitHub {
     owner = "warpstreamlabs";
     repo = "bento";
     tag = "v${version}";
-    hash = "sha256-60hWz6DgJk5PJR/W19lFVxIubZBPLZ3SENc/3bpA9hs=";
+    hash = "sha256-hnDWnN07sf8ymSbwrVIQJrgiEKr81osswcGi8emSGac=";
   };
 
   proxyVendor = true;
-  vendorHash = "sha256-G9slXTly5cJT93wQrD8eITsF0rVdrpRW4r/YTYqW/Mc=";
+  vendorHash = "sha256-pCfDRnCoEjeuFuLthk6zQ1Gh4Cb+Ix9J+lh1sqA1Bf8=";
 
   subPackages = [
     "cmd/bento"

pkgs/by-name/be/better-adb-sync/package.nix

@@ -0,0 +1,41 @@
+{
+  lib,
+  python3Packages,
+  fetchFromGitHub,
+  android-tools,
+}:
+
+python3Packages.buildPythonApplication (finalAttrs: {
+  pname = "better-adb-sync";
+  version = "1.4.0";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "jb2170";
+    repo = "better-adb-sync";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-ghOpcnQEZiAEZOiVWhrHa66WgiyyYQZgTJEokJFKMRs=";
+  };
+
+  build-system = with python3Packages; [ setuptools ];
+
+  # The tool relies on the `adb` binary being available in the system
+  makeWrapperArgs = [
+    "--prefix PATH : ${lib.makeBinPath [ android-tools ]}"
+  ];
+
+  pythonImportsCheck = [
+    "BetterADBSync"
+  ];
+
+  meta = {
+    description = "Synchronize files between a PC and an Android device using ADB (Android Debug Bridge)";
+    homepage = "https://github.com/jb2170/better-adb-sync";
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [
+      lucc
+      Misaka13514
+    ];
+    mainProgram = "adbsync";
+  };
+})

pkgs/by-name/dr/drupal/package.nix

@@ -19,7 +19,7 @@ php.buildComposerProject2 (finalAttrs: {
   };
 
   composerNoPlugins = false;
-  vendorHash = "sha256-CAntERLTmR9Gf/e+qBLJqqebdXZ0E9k8ifDh75ASoRo=";
+  vendorHash = "sha256-7FwwkPTKc/miStdHv1wfLoZhV4Gku1KwNgSlWdpPG8g=";
 
   passthru = {
     tests = {

pkgs/by-name/ds/dstask/package.nix

@@ -6,21 +6,21 @@
 
 buildGoModule rec {
   pname = "dstask";
-  version = "0.26";
+  version = "1.0.1";
 
   src = fetchFromGitHub {
     owner = "naggie";
     repo = "dstask";
     rev = "v${version}";
-    sha256 = "sha256-xZFQQDK+yGAv4IbuNe2dvNa3GDASeJY2mOYw94goAIM=";
+    sha256 = "sha256-/SXQz+HDkKWGrIArqEjti93mo6Els9haitV0FfWfVTQ=";
   };
 
-  # Set vendorHash to null because dstask vendors its dependencies (meaning
+  # Set vendorHash to "sha256-HSqAbxkkjuMulFymeqApWr/JZ+a7OUTu5EYLGPL/j2U=" because dstask vendors its dependencies (meaning
   # that third party dependencies are stored in the repository).
   #
   # Ref <https://github.com/NixOS/nixpkgs/pull/87383#issuecomment-633204382>
   # and <https://github.com/NixOS/nixpkgs/blob/d4226e3a4b5fcf988027147164e86665d382bbfa/pkgs/development/go-modules/generic/default.nix#L18>
-  vendorHash = null;
+  vendorHash = "sha256-HSqAbxkkjuMulFymeqApWr/JZ+a7OUTu5EYLGPL/j2U=";
 
   doCheck = false;
 

pkgs/by-name/es/esphome/package.nix

@@ -33,14 +33,14 @@ let
 in
 python.pkgs.buildPythonApplication rec {
   pname = "esphome";
-  version = "2025.12.6";
+  version = "2025.12.7";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "esphome";
     repo = "esphome";
     tag = version;
-    hash = "sha256-7TpHpivBNA5DW/ThCUqhEn9y0L62lMhRAP9tH1800Zk=";
+    hash = "sha256-KC3LbY5mU4xig3kftIuemSz/RAnJ7wZ8eSccr9BKz9Q=";
   };
 
   patches = [

pkgs/by-name/ev/evcc/package.nix

@@ -17,16 +17,16 @@
 }:
 
 let
-  version = "0.300.3";
+  version = "0.300.4";
 
   src = fetchFromGitHub {
     owner = "evcc-io";
     repo = "evcc";
     tag = version;
-    hash = "sha256-SGTsM4zZAuh/OGpMXvphHdlcCl1hOOYTn0R1k0/2qQo=";
+    hash = "sha256-f2whzEq0LOyvNVLjSNvA19azbtJnOMJqu5EJQXnzZyg=";
   };
 
-  vendorHash = "sha256-S23rTyg+QClky0vWfRl5nnd+2cYnHMGXmxZwLoTxUu0=";
+  vendorHash = "sha256-IB3DqaUbdrqnYQpyHtnvY37xjbRvTvNOV39b8wciuTA=";
 
   commonMeta = {
     license = lib.licenses.mit;

pkgs/by-name/ex/exatorrent/package.nix

@@ -63,6 +63,11 @@ buildGoModule (finalAttrs: {
     "-extldflags '-static'"
   ];
 
+  # Fix build with GCC 15
+  # from vendor/github.com/anacrolix/go-libutp/callbacks.go:4:
+  # ./utp_types.h:120:15: error: two or more data types in declaration specifiers
+  env.NIX_CFLAGS_COMPILE = "-std=gnu17";
+
   buildInputs = lib.optionals stdenv.hostPlatform.isGnu [
     stdenv.cc.libc.static
   ];

pkgs/by-name/fa/fastmail-desktop/sources.nix

@@ -1,19 +1,19 @@
 # Generated by ./update.sh - do not update manually!
-# Last updated: 2025-12-06
+# Last updated: 2025-12-19
 { fetchurl, fetchzip }:
 {
   aarch64-darwin = {
-    version = "1.0.6";
+    version = "1.0.7";
     src = fetchurl {
-      url = "https://dl.fastmailcdn.com/desktop/production/mac/arm64/Fastmail-1.0.6-arm64-mac.zip";
-      hash = "sha512-viKPE0LS4dQQxw9jimEGjAl65uSE7XeAcuoLzq7n4i/BEfNo9QjzOzDMbxhwkGY0Ba92coddwJRXaSdx48fTTw==";
+      url = "https://dl.fastmailcdn.com/desktop/production/mac/arm64/Fastmail-1.0.7-arm64-mac.zip";
+      hash = "sha512-pH6m2BxP/y/A/DaPVNgwmd5HHVbyCVefYhJENyImsKQAKzn8RY9EI/kaybMHlQjv6N0Gmixpskvm0K74k3LUqg==";
     };
   };
   x86_64-linux = {
-    version = "1.0.6";
+    version = "1.0.7";
     src = fetchurl {
-      url = "https://dl.fastmailcdn.com/desktop/production/linux/x64/Fastmail-1.0.6.AppImage";
-      hash = "sha512-WKMhy7dLoFUqUkevkZAgxgxpz5jD4O9VVaKDYxQs0jXJVt5GUcIHDJ6aZIJG6jyinAC18NzF3vJnOftw8ZWdmg==";
+      url = "https://dl.fastmailcdn.com/desktop/production/linux/x64/Fastmail-1.0.7.AppImage";
+      hash = "sha512-MFVqBuuruqDVOkK9NC5E60BPJnIHdiL4MhitWqmmUB+NidlBxQbeDeWZu5Pwhh878UXrNvA0mVCgTZAOK7e2Ew==";
     };
   };
 }

pkgs/by-name/fi/firefly-iii-data-importer/package.nix

@@ -13,13 +13,13 @@
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "firefly-iii-data-importer";
-  version = "2.0.2";
+  version = "2.0.4";
 
   src = fetchFromGitHub {
     owner = "firefly-iii";
     repo = "data-importer";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-+oc6FJwlixJ6PNQmZoZxUveR3h+zRopptMYm6ef9r/I=";
+    hash = "sha256-PeJf0b15865iz6q3vPNIIEg8UggP7OTukyRn3yLI25o=";
   };
 
   buildInputs = [ php84 ];
@@ -38,7 +38,7 @@ stdenvNoCC.mkDerivation (finalAttrs: {
   composerStrictValidation = true;
   strictDeps = true;
 
-  vendorHash = "sha256-y8tGv5dgGHV2moBgYKSvBoc0SfHvt7HbSrctoAdMQGE=";
+  vendorHash = "sha256-hNapeTzqsDqfnG3iea6+bOdb6wd/6fgyfMpEnj5lhB4=";
 
   npmDeps = fetchNpmDeps {
     inherit (finalAttrs) src;

pkgs/by-name/fl/flatpak/package.nix

@@ -80,7 +80,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "flatpak";
-  version = "1.16.1";
+  version = "1.16.2";
 
   # TODO: split out lib once we figure out what to do with triggerdir
   outputs = [
@@ -98,7 +98,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   src = fetchurl {
     url = "https://github.com/flatpak/flatpak/releases/download/${finalAttrs.version}/flatpak-${finalAttrs.version}.tar.xz";
-    hash = "sha256-K0fo8tkNNdKTOe144abquzbu+pz6WlyjsNHydQLENnU=";
+    hash = "sha256-aRctGw2Fxo+B5t3wEV+OGwXXOxsBD+qNnssDvIrYQ+s=";
   };
 
   patches = [

pkgs/by-name/fo/forgejo-cli/package.nix

@@ -13,17 +13,17 @@
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "forgejo-cli";
-  version = "0.3.0";
+  version = "0.4.0";
 
   src = fetchFromGitea {
     domain = "codeberg.org";
-    owner = "Cyborus";
+    owner = "forgejo-contrib";
     repo = "forgejo-cli";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-8KPR7Fx26hj5glKDjczCLP6GgQBUsA5TpjhO5UZOpik=";
+    hash = "sha256-EJr/7me2wiOBSFw0VFSxyqnQKy3kpOMGJmxD7wxmWPc=";
   };
 
-  cargoHash = "sha256-kW7Pexydkosaufk1e8P5FaY+dgkeeTG5qgJxestWkVs=";
+  cargoHash = "sha256-DpQt76o3ZnIJwHR1DQ/mn9f8XiWHKVB4h3NNbvCIMZ8=";
 
   nativeBuildInputs = [
     pkg-config
@@ -52,8 +52,8 @@ rustPlatform.buildRustPackage (finalAttrs: {
 
   meta = {
     description = "CLI application for interacting with Forgejo";
-    homepage = "https://codeberg.org/Cyborus/forgejo-cli";
-    changelog = "https://codeberg.org/Cyborus/forgejo-cli/releases/tag/v${finalAttrs.version}";
+    homepage = "https://codeberg.org/forgejo-contrib/forgejo-cli";
+    changelog = "https://codeberg.org/forgejo-contrib/forgejo-cli/releases/tag/v${finalAttrs.version}";
     license = with lib.licenses; [
       asl20
       mit

pkgs/by-name/fr/freerdp/package.nix

@@ -70,13 +70,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "freerdp";
-  version = "3.20.0";
+  version = "3.20.2";
 
   src = fetchFromGitHub {
     owner = "FreeRDP";
     repo = "FreeRDP";
     rev = finalAttrs.version;
-    hash = "sha256-/v6M3r0qELpKvDmM8p3SnOmstyqfYNzyS7gw6HBOSd0=";
+    hash = "sha256-IcEWlNh0AI3Vkqf2FzQYOIq64J6iWJxWlUfYkcBpGUU=";
   };
 
   postPatch = ''

pkgs/by-name/fr/frr/package.nix

@@ -80,13 +80,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "frr";
-  version = "10.4.1";
+  version = "10.5.1";
 
   src = fetchFromGitHub {
     owner = "FRRouting";
     repo = "frr";
     rev = "frr-${finalAttrs.version}";
-    hash = "sha256-pEnMOy1/gIs8a/XCGixF3ZkSwUZ1PPuaSFBminY86DA=";
+    hash = "sha256-sTPYIaaF/OfmBMIRS4nRV2Pay03u8R1nUsqMjFH4cFo=";
   };
 
   # Without the std explicitly set, we may run into abseil-cpp

pkgs/by-name/hy/hyprland/package.nix

@@ -108,9 +108,9 @@ customStdenv.mkDerivation (finalAttrs: {
 
     # Remove extra @PREFIX@ to fix pkg-config paths
     substituteInPlace hyprland.pc.in \
-      --replace-fail  @PREFIX@ ""
+      --replace-fail  "@PREFIX@/" ""
     substituteInPlace example/hyprland.desktop.in \
-      --replace-fail  @PREFIX@ ""
+      --replace-fail  "@PREFIX@/" ""
   '';
 
   # variables used by CMake, and shown in `hyprctl version`

pkgs/by-name/hy/hysteria/package.nix

@@ -6,16 +6,16 @@
 }:
 buildGoModule rec {
   pname = "hysteria";
-  version = "2.6.5";
+  version = "2.7.0";
 
   src = fetchFromGitHub {
     owner = "apernet";
     repo = "hysteria";
     rev = "app/v${version}";
-    hash = "sha256-EiucZQ8poLmWVGd7MElZ4FWhDdDuM0/8CiomN+TKolw=";
+    hash = "sha256-eObMqyYCyrt5TemNK5AVZlO01wPjb5QscV6BSnAhQF8=";
   };
 
-  vendorHash = "sha256-ho5AC9kehhvPVS3CoB2Yucbk5vCVqWAe1MZGInusKk8=";
+  vendorHash = "sha256-K1RWbZHZUvPezPRoGSd0e8b+J1UREHWPLHWEWD5cpRc=";
   proxyVendor = true;
 
   ldflags =

pkgs/by-name/ip/iprover/package.nix

@@ -10,13 +10,13 @@
 
 stdenv.mkDerivation {
   pname = "iprover";
-  version = "3.8.1";
+  version = "3.9.2";
 
   src = fetchFromGitLab {
     owner = "korovin";
     repo = "iprover";
-    rev = "f61edb113b705606c7314dc4dce0687832c3169f";
-    hash = "sha256-XXqbEoYKjoktE3ZBEIEFjLhA1B75zhnfPszhe8SvbI8=";
+    rev = "v3.9.2";
+    hash = "sha256-CbqPtP2pKLFgo67EF0IhvIdv1dAog2vb3Es0asmmSyY=";
   };
 
   postPatch = ''
@@ -45,6 +45,10 @@ stdenv.mkDerivation {
 
   preConfigure = "patchShebangs .";
 
+  env = {
+    NIX_CFLAGS_COMPILE = "-std=gnu17";
+  };
+
   installPhase = ''
     runHook preInstall
     mkdir -p "$out/bin"

pkgs/by-name/kn/knot-dns/package.nix

@@ -27,17 +27,18 @@
   autoreconfHook,
   nixosTests,
   knot-resolver_5,
+  knot-resolver-manager_6,
   knot-dns,
   runCommandLocal,
 }:
 
 stdenv.mkDerivation rec {
   pname = "knot-dns";
-  version = "3.5.2";
+  version = "3.5.3";
 
   src = fetchurl {
     url = "https://secure.nic.cz/files/knot-dns/knot-${version}.tar.xz";
-    sha256 = "6f577c247ef870a55fe3377246bc1c2d643c673cd32de6c26231ff51d3fc7093";
+    sha256 = "e003ad1eef229c4e65a6cac876ee773e25a06177ecdc83795a26617a6eebe471";
   };
 
   outputs = [
@@ -116,6 +117,7 @@ stdenv.mkDerivation rec {
     inherit knot-resolver_5;
   }
   // lib.optionalAttrs stdenv.hostPlatform.isLinux {
+    inherit knot-resolver-manager_6; # not very reliable on non-Linux yet
     inherit (nixosTests) knot kea;
     prometheus-exporter = nixosTests.prometheus-exporters.knot;
     # Some dependencies are very version-sensitive, so the might get dropped

pkgs/by-name/la/lasuite-docs-collaboration-server/package.nix

@@ -13,20 +13,20 @@
 
 stdenv.mkDerivation rec {
   pname = "lasuite-docs-collaboration-server";
-  version = "4.1.0";
+  version = "4.4.0";
 
   src = fetchFromGitHub {
     owner = "suitenumerique";
     repo = "docs";
     tag = "v${version}";
-    hash = "sha256-vZkqHlZ1aDOXcrdyV8BXmI95AmMalXOuVLS9XWB/YxU=";
+    hash = "sha256-Cm/Ch7dBKInQYPFGfSlSMLgj8uQR6E3S+6gCFUyvFSU=";
   };
 
   sourceRoot = "source/src/frontend";
 
   offlineCache = fetchYarnDeps {
     yarnLock = "${src}/src/frontend/yarn.lock";
-    hash = "sha256-3yRKWIOPBRrOxBWUW3C5xFjb2dcA6c3cMOD8PZWjHNA=";
+    hash = "sha256-JacPecJvdyATea8o1jQOxY9Gzx4kH+HLqE0eq03dzjg=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/la/lasuite-docs-frontend/package.nix

@@ -12,20 +12,20 @@
 
 stdenv.mkDerivation rec {
   pname = "lasuite-docs-frontend";
-  version = "4.1.0";
+  version = "4.4.0";
 
   src = fetchFromGitHub {
     owner = "suitenumerique";
     repo = "docs";
     tag = "v${version}";
-    hash = "sha256-vZkqHlZ1aDOXcrdyV8BXmI95AmMalXOuVLS9XWB/YxU=";
+    hash = "sha256-Cm/Ch7dBKInQYPFGfSlSMLgj8uQR6E3S+6gCFUyvFSU=";
   };
 
   sourceRoot = "source/src/frontend";
 
   offlineCache = fetchYarnDeps {
     yarnLock = "${src}/src/frontend/yarn.lock";
-    hash = "sha256-3yRKWIOPBRrOxBWUW3C5xFjb2dcA6c3cMOD8PZWjHNA=";
+    hash = "sha256-JacPecJvdyATea8o1jQOxY9Gzx4kH+HLqE0eq03dzjg=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/la/lasuite-docs/package.nix

@@ -17,12 +17,12 @@ let
     };
   };
 
-  version = "4.1.0";
+  version = "4.4.0";
   src = fetchFromGitHub {
     owner = "suitenumerique";
     repo = "docs";
     tag = "v${version}";
-    hash = "sha256-vZkqHlZ1aDOXcrdyV8BXmI95AmMalXOuVLS9XWB/YxU=";
+    hash = "sha256-Cm/Ch7dBKInQYPFGfSlSMLgj8uQR6E3S+6gCFUyvFSU=";
   };
 
   mail-templates = stdenv.mkDerivation {
@@ -35,7 +35,7 @@ let
 
     offlineCache = fetchYarnDeps {
       yarnLock = "${src}/src/mail/yarn.lock";
-      hash = "sha256-kwt4vSIiC8NNaKmygl2moV8ft02eB4ylPND4oe9tBUA=";
+      hash = "sha256-g71OGg0PAo60h0bC+oOyvLvPOCg0pYXuYD8vsR5X9/k=";
     };
 
     nativeBuildInputs = [
@@ -58,6 +58,8 @@ python.pkgs.buildPythonApplication rec {
   patches = [
     # Support configuration throught environment variables for SECURE_*
     ./secure_settings.patch
+    # Fix creation of unsafe C function in postgresql migrations
+    ./postgresql_fix.patch
   ];
 
   build-system = with python.pkgs; [ setuptools ];
@@ -89,6 +91,7 @@ python.pkgs.buildPythonApplication rec {
       factory-boy
       gunicorn
       jsonschema
+      langfuse
       lxml
       markdown
       mozilla-django-oidc

pkgs/by-name/la/lasuite-docs/postgresql_fix.patch

@@ -0,0 +1,27 @@
+From 49c6138eab0a37d062c5e7d936535d1832b3e031 Mon Sep 17 00:00:00 2001
+From: soyouzpanda <soyouzpanda@soyouzpanda.fr>
+Date: Tue, 23 Dec 2025 19:43:50 +0100
+Subject: [PATCH] fix: disable postgresql C function creation
+
+---
+ core/migrations/0027_auto_20251120_0956.py | 5 -----
+ 1 file changed, 5 deletions(-)
+
+diff --git a/core/migrations/0027_auto_20251120_0956.py b/core/migrations/0027_auto_20251120_0956.py
+index fe795ff5..0db2090c 100644
+--- a/core/migrations/0027_auto_20251120_0956.py
++++ b/core/migrations/0027_auto_20251120_0956.py
+@@ -11,11 +11,6 @@ class Migration(migrations.Migration):
+     operations = [
+         migrations.RunSQL(
+             sql="""
+-                CREATE OR REPLACE FUNCTION public.immutable_unaccent(regdictionary, text)
+-                RETURNS text
+-                LANGUAGE c IMMUTABLE PARALLEL SAFE STRICT AS
+-                '$libdir/unaccent', 'unaccent_dict';
+-
+                 CREATE OR REPLACE FUNCTION public.f_unaccent(text)
+                 RETURNS text
+                 LANGUAGE sql IMMUTABLE PARALLEL SAFE STRICT
+--
+2.50.1

pkgs/by-name/li/libsignal-ffi/package.nix

@@ -21,14 +21,14 @@ rustPlatform.buildRustPackage rec {
   pname = "libsignal-ffi";
   # must match the version used in mautrix-signal
   # see https://github.com/mautrix/signal/issues/401
-  version = "0.86.8";
+  version = "0.86.12";
 
   src = fetchFromGitHub {
     fetchSubmodules = true;
     owner = "signalapp";
     repo = "libsignal";
     tag = "v${version}";
-    hash = "sha256-+GFuwS4y8yr86ETVIjlz/6HocAamASmBOIjkTLtCIag=";
+    hash = "sha256-XVq1fvhUF0WqSs1lJRCBRuhOW4idY6Nm21UdX4/6TE8=";
   };
 
   nativeBuildInputs = [
@@ -40,7 +40,7 @@ rustPlatform.buildRustPackage rec {
   env.BORING_BSSL_PATH = "${boringssl-wrapper}";
   env.NIX_LDFLAGS = if stdenv.hostPlatform.isDarwin then "-lc++" else "-lstdc++";
 
-  cargoHash = "sha256-uiMct9ygg1c1rQb6RsM2AoibuKCExPy9P75C7jDX8Cs=";
+  cargoHash = "sha256-vat7vjL9HDY/m7CLUJNpU3NZ79nCVHxLO5tEtaEDBnE=";
 
   cargoBuildFlags = [
     "-p"

pkgs/by-name/li/lichess-bot/package.nix

@@ -2,18 +2,23 @@
   lib,
   python3Packages,
   fetchFromGitHub,
+  versionCheckHook,
+  writeShellApplication,
+  curl,
+  jq,
+  common-updater-scripts,
 }:
 
 python3Packages.buildPythonApplication {
   pname = "lichess-bot";
-  version = "2025.12.23.1";
+  version = "2026.1.11.1";
   pyproject = false;
 
   src = fetchFromGitHub {
     owner = "lichess-bot-devs";
     repo = "lichess-bot";
-    rev = "6ea42dfaffa65efea0da09d94b058853d724a989";
-    hash = "sha256-G8DiW96mRnvmmmRALRcYDnjLilQIRqH5m6+aTluhohI=";
+    rev = "96afce91316ba1243290408f2eeb6cd89778e8ff";
+    hash = "sha256-eE6b4VWhBqWjrF028om0NE/UN9+4sI7PoZp4eV6hRcE=";
   };
 
   propagatedBuildInputs = with python3Packages; [
@@ -43,6 +48,36 @@ python3Packages.buildPythonApplication {
     runHook postInstall
   '';
 
+  nativeInstallCheckInputs = [
+    versionCheckHook
+  ];
+  versionCheckProgramArg = "--disable_auto_logging";
+  doInstallCheck = true;
+
+  passthru = {
+    updateScript = lib.getExe (writeShellApplication {
+      name = "lichess-bot-update-script";
+
+      runtimeInputs = [
+        curl
+        jq
+        common-updater-scripts
+      ];
+
+      text = ''
+        commit_msg='^Auto update version to (?<ver>[0-9.]+)$'
+        commit="$(
+          curl -s 'https://api.github.com/repos/lichess-bot-devs/lichess-bot/commits?path=lib/versioning.yml' | \
+          jq -c "map(select(.commit.message | test(\"$commit_msg\"))) | first"
+        )"
+        rev="$(jq -r '.sha' <<< "$commit")"
+        version="$(jq -r ".commit.message | capture(\"$commit_msg\") | .ver" <<< "$commit")"
+
+        update-source-version lichess-bot "$version" --rev="$rev"
+      '';
+    });
+  };
+
   meta = {
     description = "Bridge between lichess.org and bots";
     homepage = "https://github.com/lichess-bot-devs/lichess-bot";

pkgs/by-name/ma/magnetic-catppuccin-gtk/package.nix

@@ -13,14 +13,21 @@
 let
   validAccents = [
     "default"
-    "purple"
+    "blue"
+    "flamingo"
+    "green"
+    "grey"
+    "lavender"
+    "maroon"
+    "mauve"
+    "peach"
     "pink"
     "red"
-    "orange"
-    "yellow"
-    "green"
+    "rosewater"
+    "sapphire"
+    "sky"
     "teal"
-    "grey"
+    "yellow"
     "all"
   ];
   validShades = [
@@ -59,13 +66,13 @@ lib.checkListOfEnum "${pname} Valid theme accent(s)" validAccents accent lib.che
   stdenv.mkDerivation
   {
     pname = "magnetic-${lib.toLower pname}";
-    version = "0-unstable-2025-04-25";
+    version = "0-unstable-2026-01-15";
 
     src = fetchFromGitHub {
       owner = "Fausto-Korpsvart";
       repo = "Catppuccin-GTK-Theme";
-      rev = "c961826d027ed93fae12a9a309616e36d140e6b9";
-      hash = "sha256-7F4FrhM+kBFPeLp2mjmYkoDiF9iKDUkC27LUBuFyz7g=";
+      rev = "f25d8cf688d8f224f0ce396689ffcf5767eb647e";
+      hash = "sha256-W+NGyPnOEKoicJPwnftq26iP7jya1ZKq38lMjx/k9ss=";
     };
 
     nativeBuildInputs = [

pkgs/by-name/ma/matrix-synapse-unwrapped/package.nix

@@ -14,31 +14,29 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "matrix-synapse";
-  version = "1.144.0";
+  version = "1.145.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "element-hq";
     repo = "synapse";
     rev = "v${version}";
-    hash = "sha256-7m0VHiTNx00bgWFbbdXX6tX9pN89IXHbvx04pp2IwnE=";
+    hash = "sha256-JFMxnp4//Q8t6LZf6L2jJxaShE51r4MY7eJvD9JhhVo=";
   };
 
   cargoDeps = rustPlatform.fetchCargoVendor {
     inherit pname version src;
-    hash = "sha256-CKvdWo9/f8Uhi5idgRhyuZwYua6gQzoKz21XNMaXdl0=";
+    hash = "sha256-CnytwGtv/ZoJl03XFLLMTHDiRhWDgWlJD8L/QRiebyM=";
   };
 
-  postPatch = ''
-    substituteInPlace pyproject.toml \
-      --replace-fail "setuptools_rust>=1.3,<=1.11.1" "setuptools_rust<=1.12,>=1.3" \
-      --replace-fail "poetry-core>=2.0.0,<=2.1.3" "poetry-core>=2.0.0,<=2.3.0"
-  '';
-
-  build-system = with python3Packages; [
-    poetry-core
-    setuptools-rust
-  ];
+  build-system =
+    with python3Packages;
+    [
+      poetry-core
+    ]
+    ++ [
+      rustPlatform.maturinBuildHook
+    ];
 
   nativeBuildInputs = [
     rustPlatform.cargoSetupHook
@@ -80,8 +78,11 @@ python3Packages.buildPythonApplication rec {
       pydantic
       pymacaroons
       pyopenssl
+      pyparsing
+      pyrsistent
       pyyaml
       service-identity
+      setuptools-rust
       signedjson
       sortedcontainers
       treq

pkgs/by-name/ma/mautrix-signal/package.nix

@@ -20,14 +20,14 @@ let
 in
 buildGoModule rec {
   pname = "mautrix-signal";
-  version = "25.12";
-  tag = "v0.2512.0";
+  version = "26.01";
+  tag = "v0.2601.0";
 
   src = fetchFromGitHub {
     owner = "mautrix";
     repo = "signal";
     inherit tag;
-    hash = "sha256-qD3kehVZINfAg6ZitYlkabo19Zfn7X//5BoMbub9Y60=";
+    hash = "sha256-zvB0CbSzrLcUJiEIj3vtDq2C0XEYUNRbaUAn+636+uk=";
   };
 
   buildInputs =
@@ -44,7 +44,7 @@ buildGoModule rec {
 
   CGO_LDFLAGS = lib.optional withGoolm [ cppStdLib ];
 
-  vendorHash = "sha256-zfe3mdM3azHe+NssRKJqjaP7A0wrvHyIVnqUWJMsylw=";
+  vendorHash = "sha256-Eo7T/63ywNnn/t0RzjwkSYRmrL0IMdIsv4wqrQFv+5U=";
 
   ldflags = [
     "-X"

pkgs/by-name/ma/mautrix-whatsapp/package.nix

@@ -14,20 +14,20 @@
 
 buildGoModule rec {
   pname = "mautrix-whatsapp";
-  version = "25.12";
-  tag = "v0.2512.0";
+  version = "26.01";
+  tag = "v0.2601.0";
 
   src = fetchFromGitHub {
     owner = "mautrix";
     repo = "whatsapp";
     inherit tag;
-    hash = "sha256-gVQSACXQ384MYOptRKGSIzCjOgyWW+8/YrxKCaCqhuA=";
+    hash = "sha256-CNrAQSZgF0t5oo2xRsVdif3LIGOnTe2ea996icVkCjE=";
   };
 
   buildInputs = lib.optional (!withGoolm) olm;
   tags = lib.optional withGoolm "goolm";
 
-  vendorHash = "sha256-eyukS+rEysjhaywxzgqKP11IJF2SY9FSluQIOESZ6mk=";
+  vendorHash = "sha256-Jvd3NgDRCyLrRV+6+kmcUSPCSSaxaKLD9EdrSyFwm1M=";
 
   ldflags = [
     "-s"

pkgs/by-name/mo/models-dev/package.nix

@@ -9,12 +9,12 @@
 }:
 let
   pname = "models-dev";
-  version = "0-unstable-2026-01-14";
+  version = "0-unstable-2026-01-17";
   src = fetchFromGitHub {
     owner = "anomalyco";
     repo = "models.dev";
-    rev = "db79e08e389c7d10994b5d5b99165c3e124da958";
-    hash = "sha256-Z1EcHBDZSz6xUN4S9TSzRTbRLXoRQPuWx+a6myxxDMA=";
+    rev = "971e8734ae3ae7220afc4cfc8320c717107bc9ba";
+    hash = "sha256-kAbJKCRxcgORYa6+GTYPw1461+Bb8dYguexgokw4d1U=";
   };
 
   node_modules = stdenvNoCC.mkDerivation {

pkgs/by-name/ne/netbox_4_4/package.nix

@@ -16,14 +16,14 @@ let
 in
 py.pkgs.buildPythonApplication rec {
   pname = "netbox";
-  version = "4.4.8";
+  version = "4.4.9";
   pyproject = false;
 
   src = fetchFromGitHub {
     owner = "netbox-community";
     repo = "netbox";
     tag = "v${version}";
-    hash = "sha256-C7tzY6gp/jfoCf6uPGfAvO8+xHkGe7T0o0Dod+D6YRU=";
+    hash = "sha256-NA84Rcs27S68pyVdo+bif8P2sNmGkfuMPrCBn1YXubc=";
   };
 
   patches = [

pkgs/by-name/ni/nixos-container/nixos-container.pl

@@ -43,6 +43,7 @@ Usage: nixos-container list
          [--port <port>]
          [--host-address <string>]
          [--local-address <string>]
+         [--use-host-network]
        nixos-container destroy <container-name>
        nixos-container restart <container-name>
        nixos-container start <container-name>
@@ -74,6 +75,7 @@ my $signal;
 my $configFile;
 my $hostAddress;
 my $localAddress;
+my $useHostNetwork = 0;
 my $flake;
 my $flakeAttr = "container";
 
@@ -106,6 +108,7 @@ GetOptions(
     "config-file=s" => \$configFile,
     "host-address=s" => \$hostAddress,
     "local-address=s" => \$localAddress,
+    "use-host-network" => \$useHostNetwork,
     "flake=s" => \$flake,
     # Nix passthru options.
     "log-format=s" => \&copyNixFlags1,
@@ -127,6 +130,10 @@ if (defined $hostAddress and !defined $localAddress or defined $localAddress and
     die "With --host-address set, --local-address is required as well!";
 }
 
+if ($useHostNetwork && (defined $hostAddress || defined $localAddress)) {
+    die "--use-host-network cannot be used with --host-address or --local-address!";
+}
+
 my $action = $ARGV[0] or die "$0: no action specified\n";
 
 if (defined $configFile and defined $extraConfig) {
@@ -231,36 +238,44 @@ if ($action eq "create") {
     # be restricted too.
     die "$0: container name ‘$containerName’ is too long\n" if length $containerName > 11;
 
-    # Get an unused IP address.
-    my %usedIPs;
-    foreach my $confFile2 (glob "$configurationDirectory/*.conf") {
-        # Filter libpod configuration files
-        # From 22.05 and onwards this is not an issue any more as directories dont clash
-        if($confFile2 eq "/etc/containers/libpod.conf" || $confFile2 eq "/etc/containers/containers.conf" || $confFile2 eq "/etc/containers/registries.conf") {
-            next
-        }
-        my $s = read_file($confFile2) or die;
-        $usedIPs{$1} = 1 if $s =~ /^HOST_ADDRESS=([0-9\.]+)$/m;
-        $usedIPs{$1} = 1 if $s =~ /^LOCAL_ADDRESS=([0-9\.]+)$/m;
-    }
-
-    unless (defined $hostAddress) {
-        my $ipPrefix;
-        for (my $nr = 1; $nr < 255; $nr++) {
-            $ipPrefix = "10.233.$nr";
-            $hostAddress = "$ipPrefix.1";
-            $localAddress = "$ipPrefix.2";
-            last unless $usedIPs{$hostAddress} || $usedIPs{$localAddress};
-            $ipPrefix = undef;
-        }
-
-        die "$0: out of IP addresses\n" unless defined $ipPrefix;
-    }
-
     my @conf;
-    push @conf, "PRIVATE_NETWORK=1\n";
-    push @conf, "HOST_ADDRESS=$hostAddress\n";
-    push @conf, "LOCAL_ADDRESS=$localAddress\n";
+
+    if ($useHostNetwork) {
+        push @conf, "PRIVATE_NETWORK=0\n";
+        print STDERR "using host network\n";
+    } else {
+        # Get an unused IP address.
+        my %usedIPs;
+        foreach my $confFile2 (glob "$configurationDirectory/*.conf") {
+            # Filter libpod configuration files
+            # From 22.05 and onwards this is not an issue any more as directories dont clash
+            if($confFile2 eq "/etc/containers/libpod.conf" || $confFile2 eq "/etc/containers/containers.conf" || $confFile2 eq "/etc/containers/registries.conf") {
+                next
+            }
+            my $s = read_file($confFile2) or die;
+            $usedIPs{$1} = 1 if $s =~ /^HOST_ADDRESS=([0-9\.]+)$/m;
+            $usedIPs{$1} = 1 if $s =~ /^LOCAL_ADDRESS=([0-9\.]+)$/m;
+        }
+
+        unless (defined $hostAddress) {
+            my $ipPrefix;
+            for (my $nr = 1; $nr < 255; $nr++) {
+                $ipPrefix = "10.233.$nr";
+                $hostAddress = "$ipPrefix.1";
+                $localAddress = "$ipPrefix.2";
+                last unless $usedIPs{$hostAddress} || $usedIPs{$localAddress};
+                $ipPrefix = undef;
+            }
+
+            die "$0: out of IP addresses\n" unless defined $ipPrefix;
+        }
+
+        push @conf, "PRIVATE_NETWORK=1\n";
+        push @conf, "HOST_ADDRESS=$hostAddress\n";
+        push @conf, "LOCAL_ADDRESS=$localAddress\n";
+        print STDERR "host IP is $hostAddress, container IP is $localAddress\n";
+    }
+
     push @conf, "HOST_BRIDGE=$bridge\n";
     push @conf, "HOST_PORT=$port\n";
     push @conf, "AUTO_START=$autoStart\n";
@@ -269,8 +284,6 @@ if ($action eq "create") {
 
     close($lock);
 
-    print STDERR "host IP is $hostAddress, container IP is $localAddress\n";
-
     # The per-container directory is restricted to prevent users on
     # the host from messing with guest users who happen to have the
     # same uid.
@@ -517,6 +530,9 @@ elsif ($action eq "run") {
 
 elsif ($action eq "show-ip") {
     my $s = read_file($confFile) or die;
+    if ($s =~ /^PRIVATE_NETWORK=0$/m) {
+        die "$0: container uses host network, no separate IP address\n";
+    }
     $s =~ /^LOCAL_ADDRESS=([0-9\.]+)(\/[0-9]+)?$/m
         or $s =~ /^LOCAL_ADDRESS6=([0-9a-f:]+)(\/[0-9]+)?$/m
         or die "$0: cannot get IP address\n";

pkgs/by-name/oh/oh-my-posh/package.nix

@@ -6,16 +6,16 @@
 }:
 buildGoModule rec {
   pname = "oh-my-posh";
-  version = "26.23.6";
+  version = "29.0.2";
 
   src = fetchFromGitHub {
     owner = "jandedobbeleer";
     repo = "oh-my-posh";
     tag = "v${version}";
-    hash = "sha256-4Po4QKPetRmTfmgq7lTK300h1Nn7spxNxRB9q58yrzo=";
+    hash = "sha256-Ir7E8EyQ1pnDQG4bzn5ZCEkWNpoF/WXBCa8mWqz/66M=";
   };
 
-  vendorHash = "sha256-R1MNLBATbivhP27VfWLGNnZ8uJWzKhx4XhNILc7FCmE=";
+  vendorHash = "sha256-cCeKP1uWVYIfJKMUNk7Hf5voCQdzq9u5gTETgbc86N0=";
 
   sourceRoot = "${src.name}/src";
 
@@ -53,6 +53,7 @@ buildGoModule rec {
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [
       lucperkins
+      olillin
     ];
   };
 }

pkgs/by-name/ow/owi/package.nix

@@ -15,14 +15,14 @@ let
 in
 ocamlPackages.buildDunePackage {
   pname = "owi";
-  version = "0.2-unstable-2025-12-22";
+  version = "0.2-unstable-2026-01-12";
 
   src = fetchFromGitHub {
     owner = "ocamlpro";
     repo = "owi";
-    rev = "014840cd9d87c912577822b171407bf7453373f0";
+    rev = "fcfafe953edbf73a1be00e029564c65193f2ad4b";
     fetchSubmodules = true;
-    hash = "sha256-Mjd2XyPmAsonCcV98L8p9S0yYlJV8OEg2TPjZhzVBj8=";
+    hash = "sha256-Vnty6fZNSmgFTNjWPiqLu5jdtomPuirBz8i9tWBSBR8=";
   };
 
   nativeBuildInputs = with ocamlPackages; [

pkgs/by-name/sl/slade/package.nix

@@ -21,13 +21,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "slade";
-  version = "3.2.10";
+  version = "3.2.11";
 
   src = fetchFromGitHub {
     owner = "sirjuddington";
     repo = "SLADE";
     tag = finalAttrs.version;
-    hash = "sha256-r1tfp0NomZEETY41wXIDvZbgCbBFEh4oW0qcnr/t/9E=";
+    hash = "sha256-kZ6KyhI2oZH0SeymcHge9+rbq/ZGfhKXGdfOlje2zqM=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/ta/talhelper/package.nix

@@ -9,16 +9,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "talhelper";
-  version = "3.0.45";
+  version = "3.1.0";
 
   src = fetchFromGitHub {
     owner = "budimanjojo";
     repo = "talhelper";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-9oZM6vIyJH8Vw/QhE9SIbrMa4r2LCZdIDRFztFYVVk0=";
+    hash = "sha256-pvJQ6l/Zh5TpGiWe3SXWsUOwFK5WUoGTu76MPyZcXRo=";
   };
 
-  vendorHash = "sha256-jn5zwEvFqasjQt6FTQpcX8qJ11lM03aMhGyapOOjclA=";
+  vendorHash = "sha256-AkCUKg5oA2XvvDtE0m9fQdeqowx5A1SnnimF7F/CORg=";
 
   ldflags = [
     "-s"

pkgs/by-name/va/vacuum-go/package.nix

@@ -7,14 +7,14 @@
 
 buildGoModule (finalAttrs: {
   pname = "vacuum-go";
-  version = "0.23.2";
+  version = "0.23.3";
 
   src = fetchFromGitHub {
     owner = "daveshanley";
     repo = "vacuum";
     # using refs/tags because simple version gives: 'the given path has multiple possibilities' error
     tag = "v${finalAttrs.version}";
-    hash = "sha256-zQ9NzNPWJC431AF1wlrRAZRhUTMdKJO6qWa4x9jpFoE=";
+    hash = "sha256-Z++nFH1UquT+4CvW5bohQCXQGW7P0tFXFcfTvQWjMgg=";
   };
 
   vendorHash = "sha256-kpW1i6LJUFMJArSHYMI4taTfAcfDH+E39GOBOKZFu+c=";

pkgs/by-name/vo/vokoscreen-ng/package.nix

@@ -13,13 +13,13 @@
 
 stdenv.mkDerivation rec {
   pname = "vokoscreen-ng";
-  version = "4.8.1";
+  version = "4.8.3";
 
   src = fetchFromGitHub {
     owner = "vkohaupt";
     repo = "vokoscreenNG";
     tag = version;
-    hash = "sha256-3tyAJxWspyvFmy1Ye1FUSCE4Pbo0cSGux8r0qFmA+NM=";
+    hash = "sha256-D2E4G6rq6kFZbwjYhoccl/aROCdpuS8UJu0JKGc8wKU=";
   };
 
   qmakeFlags = [ "src/vokoscreenNG.pro" ];

pkgs/by-name/wa/waywall/package.nix

@@ -19,13 +19,13 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "waywall";
-  version = "0.2025.12.30";
+  version = "0.2026.01.11";
 
   src = fetchFromGitHub {
     owner = "tesselslate";
     repo = "waywall";
     tag = finalAttrs.version;
-    hash = "sha256-idtlOXT3RGjAOMgZ+e5vwZnxd33snc4sIjq0G6TU7HU=";
+    hash = "sha256-VOtwVFMGgUvsGnD1CnflKtUy5tTKqK2C/qNsWwgbyEU=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/wg/wg-access-server/package.nix

@@ -6,21 +6,22 @@
   makeWrapper,
   iptables,
   nixosTests,
+  nodejs_22,
 }:
 
-buildGoModule rec {
+buildGoModule (finalAttrs: {
   pname = "wg-access-server";
-  version = "0.12.1";
+  version = "0.13.1";
 
   src = fetchFromGitHub {
     owner = "freifunkMUC";
     repo = "wg-access-server";
-    rev = "v${version}";
-    hash = "sha256-AhFqEmHrx9MCdjnB/YA3qU7KsaMyLO+vo53VWUrcL8I=";
+    rev = "v${finalAttrs.version}";
+    hash = "sha256-x4QNEn5SR6D1YIiv+mKnQlZ94jZ7BrdIxiLxBqhtBjg=";
   };
 
   proxyVendor = true; # darwin/linux hash mismatch
-  vendorHash = "sha256-YwFq0KxUctU3ElZBo/b68pyp4lJnFGL9ClKIwUzdngM=";
+  vendorHash = "sha256-pjQeF1+1gr/0pF76KNdK7GDX3pYBTqqY3xbJeMLsJIM=";
 
   env.CGO_ENABLED = 1;
 
@@ -34,12 +35,14 @@ buildGoModule rec {
   checkFlags = [ "-skip=TestDNSProxy_ServeDNS" ];
 
   ui = buildNpmPackage {
-    inherit version src;
+    inherit (finalAttrs) version src;
     pname = "wg-access-server-ui";
 
-    npmDepsHash = "sha256-04AkSDSKsr20Jbx5BJy36f8kWNlzzplu/xnoDTkU8OQ=";
+    nodejs = nodejs_22;
 
-    sourceRoot = "${src.name}/website";
+    npmDepsHash = "sha256-UntV5+9E2lyp8IQGKbbnBNdd0JLvM5NsfkLvCSOgyGo=";
+
+    sourceRoot = "${finalAttrs.src.name}/website";
 
     installPhase = ''
       mv build $out
@@ -48,11 +51,11 @@ buildGoModule rec {
 
   postPatch = ''
     substituteInPlace internal/services/website_router.go \
-        --replace-fail 'website/build' "${ui}"
+        --replace-fail 'website/build' "${finalAttrs.ui}"
   '';
 
   preBuild = ''
-    VERSION=v${version} go generate buildinfo/buildinfo.go
+    VERSION=v${finalAttrs.version} go generate buildinfo/buildinfo.go
   '';
 
   postInstall = ''
@@ -72,4 +75,4 @@ buildGoModule rec {
     maintainers = with lib.maintainers; [ xanderio ];
     mainProgram = "wg-access-server";
   };
-}
+})

pkgs/by-name/ya/yazi/plugins/jjui/default.nix

@@ -0,0 +1,23 @@
+{
+  lib,
+  fetchFromGitHub,
+  mkYaziPlugin,
+}:
+mkYaziPlugin {
+  pname = "jjui.yazi";
+  version = "0-unstable-2026-01-17";
+
+  src = fetchFromGitHub {
+    owner = "Adda0";
+    repo = "jjui.yazi";
+    rev = "a41b2e17a4d256bc06868079efb375716e07cd28";
+    hash = "sha256-r2XWSu0voQmQj6jI2Jh17FiNwbvQcEwM6LNDqX7qCOQ=";
+  };
+
+  meta = {
+    description = "jjui plugin for yazi";
+    homepage = "https://github.com/Adda0/jjui.yazi";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ adda ];
+  };
+}

pkgs/development/python-modules/ansible-pylibssh/default.nix

@@ -13,19 +13,14 @@
 
 buildPythonPackage rec {
   pname = "ansible-pylibssh";
-  version = "1.2.2";
+  version = "1.3.0";
   pyproject = true;
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-dT5XDc3OtquONi6RzA1Zk77ryT0oe4gXjbVVCfZCOrU=";
+    hash = "sha256-JD6hsJYrC2secXrA5p2sljbmHsZbNyYMMXsjYMbjDKc=";
   };
 
-  # Remove after https://github.com/ansible/pylibssh/pull/502 is merged
-  postPatch = ''
-    sed -i "/setuptools_scm_git_archive/d" pyproject.toml
-  '';
-
   build-system = [
     cython
     expandvars
@@ -44,5 +39,6 @@ buildPythonPackage rec {
     homepage = "https://github.com/ansible/pylibssh";
     changelog = "https://github.com/ansible/pylibssh/releases/tag/v${version}";
     license = lib.licenses.lgpl21Plus;
+    maintainers = with lib.maintainers; [ wfdewith ];
   };
 }

pkgs/development/python-modules/chromadb/default.nix

@@ -66,24 +66,24 @@
   nix-update-script,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "chromadb";
-  version = "1.4.0";
+  version = "1.4.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "chroma-core";
     repo = "chroma";
-    tag = version;
-    hash = "sha256-1saQEMaGuhXT+3bSlxl7yCXYptsOiYh3Uyn4Izn5Q4M=";
+    tag = finalAttrs.version;
+    hash = "sha256-mtUxyuLiwA4l9u+pTPVIsYcvsLPPCI6c8iWK6Lgbwjc=";
   };
 
   # https://github.com/chroma-core/chroma/issues/5996
   disabled = pythonAtLeast "3.14";
 
   cargoDeps = rustPlatform.fetchCargoVendor {
-    inherit pname version src;
-    hash = "sha256-zqE3NhTYrHol5Y6/CRMPQeq43Wo+ofic9SrMLqyJJPs=";
+    inherit (finalAttrs) pname version src;
+    hash = "sha256-WdWc/8vNzcEtdxmAAbBDWxhMamxSnK2YaZPWwQ2zzU4=";
   };
 
   # Can't use fetchFromGitHub as the build expects a zipfile
@@ -95,7 +95,7 @@ buildPythonPackage rec {
   postPatch = ''
     # Nixpkgs is taking the version from `chromadb_rust_bindings` which is versioned independently
     substituteInPlace pyproject.toml \
-      --replace-fail "dynamic = [\"version\"]" "version = \"${version}\""
+      --replace-fail "dynamic = [\"version\"]" "version = \"${finalAttrs.version}\""
 
     # Flip anonymized telemetry to opt in versus current opt-in out for privacy
     substituteInPlace chromadb/config.py \
@@ -108,9 +108,7 @@ buildPythonPackage rec {
     "posthog"
   ];
 
-  build-system = [
-    rustPlatform.maturinBuildHook
-  ];
+  build-system = [ rustPlatform.maturinBuildHook ];
 
   nativeBuildInputs = [
     cargo
@@ -177,14 +175,14 @@ buildPythonPackage rec {
 
   # Disable on aarch64-linux due to broken onnxruntime
   # https://github.com/microsoft/onnxruntime/issues/10038
-  pythonImportsCheck = lib.optionals doCheck [ "chromadb" ];
+  pythonImportsCheck = lib.optionals finalAttrs.doCheck [ "chromadb" ];
 
   # Test collection breaks on aarch64-linux
   doCheck = with stdenv.buildPlatform; !(isAarch && isLinux);
 
   env = {
     ZSTD_SYS_USE_PKG_CONFIG = true;
-    SWAGGER_UI_DOWNLOAD_URL = "file://${swagger-ui}";
+    SWAGGER_UI_DOWNLOAD_URL = "file://${finalAttrs.swagger-ui}";
   };
 
   pytestFlags = [
@@ -269,7 +267,7 @@ buildPythonPackage rec {
   meta = {
     description = "AI-native open-source embedding database";
     homepage = "https://github.com/chroma-core/chroma";
-    changelog = "https://github.com/chroma-core/chroma/releases/tag/${version}";
+    changelog = "https://github.com/chroma-core/chroma/releases/tag/${finalAttrs.src.tag}";
     license = lib.licenses.asl20;
     maintainers = with lib.maintainers; [
       fab
@@ -277,4 +275,4 @@ buildPythonPackage rec {
     ];
     mainProgram = "chroma";
   };
-}
+})

pkgs/development/python-modules/coinmetrics-api-client/default.nix

@@ -18,7 +18,7 @@
 
 buildPythonPackage rec {
   pname = "coinmetrics-api-client";
-  version = "2025.12.16.20";
+  version = "2026.1.5.19";
   pyproject = true;
 
   __darwinAllowLocalNetworking = true;
@@ -26,7 +26,7 @@ buildPythonPackage rec {
   src = fetchPypi {
     inherit version;
     pname = "coinmetrics_api_client";
-    hash = "sha256-FnoaLUU+x6uOlGdFhx02z/rlpqrHHt7T8TTPmeE0I68=";
+    hash = "sha256-q8uimYYpoEJ2503SLMAROFg4ZwqPpmQJSff7W6D5R6Y=";
   };
 
   pythonRelaxDeps = [ "typer" ];

pkgs/development/python-modules/django-auth-ldap/default.nix

@@ -16,14 +16,14 @@
 
 buildPythonPackage rec {
   pname = "django-auth-ldap";
-  version = "5.2.0";
+  version = "5.3.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "django-auth-ldap";
     repo = "django-auth-ldap";
     tag = version;
-    hash = "sha256-/Wy5ZCRBIeEXOFqQW4e+GzQWpZyI9o39TfFAVb7OYeo=";
+    hash = "sha256-+ezadod2ZKrsNW7lVO1dVqQWUnzP1Mi9On8/RJ2qNfI=";
   };
 
   build-system = [ setuptools-scm ];

pkgs/development/python-modules/formatron/default.nix

@@ -24,6 +24,17 @@ buildPythonPackage rec {
     fetchSubmodules = true;
   };
 
+  postPatch = ''
+    # Fix pydantic compatibility
+    # https://github.com/Dan-wanna-M/formatron/issues/35
+    substituteInPlace src/formatron/schemas/dict_inference.py \
+      --replace-fail 'typing.Type' 'Type' \
+      --replace-fail 'typing.Any' 'Any'
+
+    substituteInPlace src/formatron/schemas/json_schema.py \
+      --replace-fail 'from pydantic import typing' 'import typing'
+  '';
+
   build-system = [
     setuptools
   ];

pkgs/development/python-modules/langgraph-prebuilt/default.nix

@@ -31,14 +31,14 @@
 # It exists so the langgraph team can iterate on it without having to rebuild langgraph.
 buildPythonPackage rec {
   pname = "langgraph-prebuilt";
-  version = "1.0.5";
+  version = "1.0.6";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "langchain-ai";
     repo = "langgraph";
     tag = "prebuilt==${version}";
-    hash = "sha256-Vytt5c1GZyQAILs09Z40n80XDoSKXyAb+cFwjK5JySY=";
+    hash = "sha256-IE9Y+kFkDN49SuwvTNwa2kK+Hig18sJPZmZCqHUP3DM=";
   };
 
   sourceRoot = "${src.name}/libs/prebuilt";

pkgs/development/python-modules/libknot/default.nix

@@ -12,12 +12,12 @@
 
 buildPythonPackage rec {
   pname = "libknot";
-  version = "3.5.1";
+  version = "3.5.3";
   pyproject = true;
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-O4kMd07Tmiy+q/klMCoeSp23EkZNoKKeuUHMhzn+118=";
+    hash = "sha256-jnJ7xWO29V04Xln8xSZ+ky5ravQ2rEpSRx8Xh6PWbyw=";
   };
 
   postPatch = ''

pkgs/development/python-modules/sdbus/default.nix

@@ -2,31 +2,49 @@
   pkgs,
   lib,
   buildPythonPackage,
-  fetchPypi,
+  fetchFromGitHub,
   pkg-config,
+  dbus,
+  setuptools,
+  pytestCheckHook,
 }:
 
-let
+buildPythonPackage (finalAttrs: {
   pname = "sdbus";
-  version = "0.14.1.post0";
-in
-buildPythonPackage {
-  format = "setuptools";
-  inherit pname version;
+  version = "0.14.2";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "python-sdbus";
+    repo = "python-sdbus";
+    tag = finalAttrs.version;
+    hash = "sha256-vRz7RTSI5QjI48YnaC20mbOKl6+yXk/TrFicQ0MDR9Q=";
+  };
+
+  build-system = [ setuptools ];
 
   nativeBuildInputs = [ pkg-config ];
+
   buildInputs = [ pkgs.systemd ];
 
-  src = fetchPypi {
-    inherit pname version;
-    hash = "sha256-rjkVqz4/ChFmMuHlh235krlSnoKwtJIAbrIvh5Htbes=";
-  };
+  pythonImportsCheck = [ "sdbus" ];
+
+  nativeCheckInputs = [
+    pytestCheckHook
+    dbus
+  ];
+
+  disabledTestPaths = [
+    # try to access /var/lib/dbus/machine-id
+    "test/test_proxies.py::TestFreedesktopDbus::test_connection"
+    "test/test_sdbus_block.py::TestSync::test_sync"
+  ];
 
   meta = {
     description = "Modern Python library for D-Bus";
     homepage = "https://github.com/python-sdbus/python-sdbus";
-    license = lib.licenses.lgpl2;
+    license = lib.licenses.lgpl2Plus;
     maintainers = with lib.maintainers; [ camelpunch ];
     platforms = lib.platforms.linux;
   };
-}
+})

pkgs/kde/generated/sources/frameworks.json

@@ -145,9 +145,9 @@
     "hash": "sha256-My4749CsKuyOeGQZweh1obM66EuKraMoNjnezMb/1Ng="
   },
   "kguiaddons": {
-    "version": "6.22.0",
-    "url": "mirror://kde/stable/frameworks/6.22/kguiaddons-6.22.0.tar.xz",
-    "hash": "sha256-t2Urzr6/yMH9ook8Gu/0E2xYbud//G5YnjY08OVTnu8="
+    "version": "6.22.1",
+    "url": "mirror://kde/stable/frameworks/6.22/kguiaddons-6.22.1.tar.xz",
+    "hash": "sha256-o/WWMtdY753x2uPqQ8it9GFT+aN+Awk48TX6n5gW1bk="
   },
   "kholidays": {
     "version": "6.22.0",

pkgs/servers/home-assistant/custom-components/alarmo/package.nix

@@ -7,13 +7,13 @@
 buildHomeAssistantComponent rec {
   owner = "nielsfaber";
   domain = "alarmo";
-  version = "1.10.13";
+  version = "1.10.15";
 
   src = fetchFromGitHub {
     owner = "nielsfaber";
     repo = "alarmo";
     tag = "v${version}";
-    hash = "sha256-TIdgJBC2oGnxfdUHCaIlq6GYUiqLzc9F0ZF4RUILkog=";
+    hash = "sha256-yXrzlaO6N6uknmIPNh9gc10Fs9xJSOXoeFEj4oBbNas=";
   };
 
   postPatch = ''

pkgs/servers/home-assistant/custom-components/tuya_local/package.nix

@@ -11,13 +11,13 @@
 buildHomeAssistantComponent rec {
   owner = "make-all";
   domain = "tuya_local";
-  version = "2025.12.3";
+  version = "2026.1.1";
 
   src = fetchFromGitHub {
     inherit owner;
     repo = "tuya-local";
     tag = version;
-    hash = "sha256-KKBon2SC7rW7Vgr/8r77mRvb+ii/ZnuJLHW9DQoqN5o=";
+    hash = "sha256-8dtzGAp7i5vKP371XaOX96WilBxLMxHn4Sc/XfrhDo0=";
   };
 
   dependencies = [

pkgs/servers/monitoring/prometheus/knot-exporter.nix

@@ -7,13 +7,13 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "knot-exporter";
-  version = "3.5.1";
+  version = "3.5.3";
   pyproject = true;
 
   src = fetchPypi {
     pname = "knot_exporter";
     inherit version;
-    hash = "sha256-BsNjzqGSH5Pn+deL2rM0XMVvpGdRfzuo4vzbG4I5Mtw=";
+    hash = "sha256-sCmzYS6mjEUHomA25HRxJs2X+9Uv50ll4tqR2BAj0ro=";
   };
 
   build-system = [