Merge remote-tracking branch 'origin/master' into staging-next

.github/workflows/eval.yml

@@ -4,8 +4,8 @@ on:
   pull_request:
     paths:
       - .github/workflows/eval.yml
+      - .github/workflows/reviews.yml # needs eval results from the same event type
   pull_request_target:
-    types: [opened, ready_for_review, synchronize, reopened]
   push:
     # Keep this synced with ci/request-reviews/dev-branches.txt
     branches:
@@ -153,12 +153,13 @@ jobs:
           name: diff-${{ matrix.system }}
           path: diff/*
 
-  tag:
-    name: Tag
+  compare:
+    name: Comparison
     runs-on: ubuntu-24.04-arm
     needs: [ prepare, outpaths ]
     if: needs.prepare.outputs.targetSha
     permissions:
+      issues: write # needed to create *new* labels
       pull-requests: write
       statuses: write
     steps:
@@ -209,11 +210,8 @@ jobs:
           name: comparison
           path: comparison/*
 
-      - name: Build the requestReviews derivation
-        run: nix-build trusted/ci -A requestReviews
-
       - name: Labelling pull request
-        if: ${{ github.event_name == 'pull_request_target' && github.repository_owner == 'NixOS' }}
+        if: ${{ github.event_name == 'pull_request_target' }}
         env:
           GH_TOKEN: ${{ github.token }}
           REPOSITORY: ${{ github.repository }}
@@ -247,7 +245,7 @@ jobs:
           done < <(comm -13 before after)
 
       - name: Add eval summary to commit statuses
-        if: ${{ github.event_name == 'pull_request_target' && github.repository_owner == 'NixOS' }}
+        if: ${{ github.event_name == 'pull_request_target' }}
         env:
           GH_TOKEN: ${{ github.token }}
           PR_HEAD_SHA: ${{ github.event.pull_request.head.sha }}
@@ -266,30 +264,12 @@ jobs:
             "/repos/$GITHUB_REPOSITORY/statuses/$PR_HEAD_SHA" \
             -f "context=Eval / Summary" -f "state=success" -f "description=$description" -f "target_url=$target_url"
 
-      # See ./codeowners-v2.yml, reuse the same App because we need the same permissions
-      # Can't use the token received from permissions above, because it can't get enough permissions
-      - uses: actions/create-github-app-token@df432ceedc7162793a195dd1713ff69aefc7379e # v2.0.6
-        if: vars.OWNER_APP_ID
-        id: app-token
-        with:
-          app-id: ${{ vars.OWNER_APP_ID }}
-          private-key: ${{ secrets.OWNER_APP_PRIVATE_KEY }}
-          permission-administration: read
-          permission-members: read
-          permission-pull-requests: write
-
-      - name: Requesting maintainer reviews
-        if: ${{ steps.app-token.outputs.token && github.repository_owner == 'NixOS' }}
-        env:
-          GH_TOKEN: ${{ github.token }}
-          REPOSITORY: ${{ github.repository }}
-          NUMBER: ${{ github.event.number }}
-          AUTHOR: ${{ github.event.pull_request.user.login }}
-          # Don't request reviewers on draft PRs
-          DRY_MODE: ${{ github.event.pull_request.draft && '1' || '' }}
-        run: |
-          # maintainers.json contains GitHub IDs. Look up handles to request reviews from.
-          # There appears to be no API to request reviews based on GitHub IDs
-          jq -r 'keys[]' comparison/maintainers.json \
-            | while read -r id; do gh api /user/"$id" --jq .login; done \
-            | GH_TOKEN=${{ steps.app-token.outputs.token }} result/bin/request-reviewers.sh "$REPOSITORY" "$NUMBER" "$AUTHOR"
+  reviewers:
+    name: Reviewers
+    # No dependency on "compare", so that it can start at the same time.
+    # We only wait for the "comparison" artifact to be available, which makes the start-to-finish time
+    # for the eval workflow considerably faster.
+    needs: [ prepare, outpaths ]
+    if: needs.prepare.outputs.targetSha
+    uses: ./.github/workflows/reviewers.yml
+    secrets: inherit

.github/workflows/labels.yml

@@ -10,13 +10,14 @@ on:
 
 permissions:
   contents: read
+  issues: write # needed to create *new* labels
   pull-requests: write
 
 jobs:
   labels:
     name: label-pr
     runs-on: ubuntu-24.04-arm
-    if: "github.repository_owner == 'NixOS' && !contains(github.event.pull_request.title, '[skip treewide]')"
+    if: "!contains(github.event.pull_request.title, '[skip treewide]')"
     steps:
       - uses: actions/labeler@8558fd74291d67161a8a78ce36a881fa63b766a9 # v5.0.0
         if: |

.github/workflows/manual-nixpkgs-v2.yml

@@ -5,8 +5,6 @@ on:
     paths:
       - .github/workflows/manual-nixpkgs-v2.yml
   pull_request_target:
-    branches:
-      - master
     paths:
       - 'doc/**'
       - 'lib/**'
@@ -38,4 +36,4 @@ jobs:
           authToken: '${{ secrets.CACHIX_AUTH_TOKEN }}'
 
       - name: Building Nixpkgs manual
-        run: NIX_PATH=nixpkgs=$(pwd)/untrusted nix-build --option restrict-eval true untrusted/ci -A manual-nixpkgs -A manual-nixpkgs-tests
+        run: nix-build untrusted/ci -A manual-nixpkgs -A manual-nixpkgs-tests

.github/workflows/reviewers.yml

@@ -0,0 +1,98 @@
+# This workflow will request reviews from the maintainers of each package
+# listed in the PR's most recent eval comparison artifact.
+
+name: Reviewers
+
+on:
+  pull_request:
+    paths:
+      - .github/workflows/reviewers.yml
+  pull_request_target:
+    types: [ready_for_review]
+  workflow_call:
+
+permissions: {}
+
+jobs:
+  request:
+    name: Request
+    runs-on: ubuntu-24.04-arm
+    steps:
+      - name: Check out the PR at the base commit
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          path: trusted
+          sparse-checkout: ci
+
+      - name: Install Nix
+        uses: cachix/install-nix-action@526118121621777ccd86f79b04685a9319637641 # v31
+        with:
+          extra_nix_config: sandbox = true
+
+      - name: Build the requestReviews derivation
+        run: nix-build trusted/ci -A requestReviews
+
+      # See ./codeowners-v2.yml, reuse the same App because we need the same permissions
+      # Can't use the token received from permissions above, because it can't get enough permissions
+      - uses: actions/create-github-app-token@df432ceedc7162793a195dd1713ff69aefc7379e # v2.0.6
+        if: vars.OWNER_APP_ID
+        id: app-token
+        with:
+          app-id: ${{ vars.OWNER_APP_ID }}
+          private-key: ${{ secrets.OWNER_APP_PRIVATE_KEY }}
+          permission-administration: read
+          permission-members: read
+          permission-pull-requests: write
+
+
+      # In the regular case, this workflow is called via workflow_call from the eval workflow directly.
+      # In the more special case, when a PR is undrafted an eval run will have started already.
+      - name: Wait for comparison to be done
+        uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
+        with:
+          script: |
+            const run_id = (await github.rest.actions.listWorkflowRuns({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              workflow_id: 'eval.yml',
+              event: context.eventName,
+              head_sha: context.payload.pull_request.head.sha
+            })).data.workflow_runs[0].id
+
+            // Waiting 120 * 5 sec = 10 min. max.
+            // The extreme case is an Eval run that just started when the PR is undrafted.
+            // Eval takes max 5-6 minutes, normally.
+            for (let i = 0; i < 120; i++) {
+              const result = await github.rest.actions.listWorkflowRunArtifacts({
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                run_id,
+                name: 'comparison'
+              })
+              if (result.data.total_count > 0) return
+              await new Promise(resolve => setTimeout(resolve, 5000))
+            }
+            throw new Error("No comparison artifact found.")
+
+      - name: Download the comparison results
+        uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4.1.8
+        with:
+          pattern: comparison
+          path: comparison
+          merge-multiple: true
+
+      - name: Requesting maintainer reviews
+        if: ${{ steps.app-token.outputs.token }}
+        env:
+          GH_TOKEN: ${{ github.token }}
+          REPOSITORY: ${{ github.repository }}
+          NUMBER: ${{ github.event.number }}
+          AUTHOR: ${{ github.event.pull_request.user.login }}
+          # Don't request reviewers on draft PRs
+          DRY_MODE: ${{ github.event.pull_request.draft && '1' || '' }}
+        run: |
+          # maintainers.json contains GitHub IDs. Look up handles to request reviews from.
+          # There appears to be no API to request reviews based on GitHub IDs
+          jq -r 'keys[]' comparison/maintainers.json \
+            | while read -r id; do gh api /user/"$id" --jq .login; done \
+            | GH_TOKEN=${{ steps.app-token.outputs.token }} result/bin/request-reviewers.sh "$REPOSITORY" "$NUMBER" "$AUTHOR"

ci/default.nix

@@ -82,8 +82,8 @@ in
   # CI jobs
   lib-tests = import ../lib/tests/release.nix { inherit pkgs; };
   manual-nixos = (import ../nixos/release.nix { }).manual.${system} or null;
-  manual-nixpkgs = (import ../pkgs/top-level/release.nix { }).manual;
-  manual-nixpkgs-tests = (import ../pkgs/top-level/release.nix { }).manual.tests;
+  manual-nixpkgs = (import ../doc { });
+  manual-nixpkgs-tests = (import ../doc { }).tests;
   nixpkgs-vet = pkgs.callPackage ./nixpkgs-vet.nix { };
   parse = pkgs.lib.recurseIntoAttrs {
     latest = pkgs.callPackage ./parse.nix { nix = pkgs.nixVersions.latest; };

ci/pinned-nixpkgs.json

@@ -1,4 +1,4 @@
 {
-  "rev": "eaeed9530c76ce5f1d2d8232e08bec5e26f18ec1",
-  "sha256": "132nimgi1g88fbhddk4b8b1qk68jly494x2mnphyk3xa1d2wy9q7"
+  "rev": "3d1f29646e4b57ed468d60f9d286cde23a8d1707",
+  "sha256": "1wzvc9h9a6l9wyhzh892xb5x88kxmbzxb1k8s7fizyyw2q4nqw07"
 }

doc/default.nix

@@ -1,6 +1,6 @@
 {
-  pkgs ? (import ./.. { }),
+  pkgs ? (import ../ci { }).pkgs,
   nixpkgs ? { },
 }:
 
-pkgs.nixpkgs-manual.override { inherit nixpkgs; }
+pkgs.callPackage ./doc-support/package.nix { inherit nixpkgs; }

doc/shell.nix

@@ -1,7 +1 @@
-let
-  pkgs = import ../. {
-    config = { };
-    overlays = [ ];
-  };
-in
-pkgs.nixpkgs-manual.shell
+(import ./default.nix { }).shell

maintainers/maintainer-list.nix

@@ -15720,6 +15720,16 @@
     name = "John McParland";
     keys = [ { fingerprint = "39D2 171D D733 C718 DD21  285E B326 E14B 05D8 7A4E"; } ];
   };
+  MCSeekeri = {
+    email = "mcseekeri@outlook.com";
+    github = "mcseekeri";
+    githubId = 20928094;
+    name = "MCSeekeri";
+    keys = [
+      { fingerprint = "5922 79AB D9D6 85EB 9D16  754C ECDC AD89 5A38 4A12"; }
+      { fingerprint = "0762 A387 F160 76F1 116C  BF13 3276 6666 6666 6666"; }
+    ];
+  };
   McSinyx = {
     email = "cnx@loang.net";
     github = "McSinyx";
@@ -21768,6 +21778,12 @@
     githubId = 7309170;
     name = "Ryota Kameoka";
   };
+  ryota2357 = {
+    email = "contact@ryota2357.com";
+    github = "ryota2357";
+    githubId = 61523777;
+    name = "Ryota Otsuki";
+  };
   rypervenche = {
     email = "git@ryper.org";
     github = "rypervenche";

pkgs/README.md

@@ -107,7 +107,7 @@ Now that this is out of the way. To add a package to Nixpkgs:
 
    - XML::Simple, a Perl module: [`pkgs/top-level/perl-packages.nix`](top-level/perl-packages.nix) (search for the `XMLSimple` attribute). Most Perl modules are so simple to build that they are defined directly in `perl-packages.nix`; no need to make a separate file for them.
 
-   - Adobe Reader: [`pkgs/applications/misc/adobe-reader/default.nix`](applications/misc/adobe-reader/default.nix). Shows how binary-only packages can be supported. In particular the `postFixup` phase uses `patchelf` to set the RUNPATH and ELF interpreter of the executables so that the right libraries are found at runtime.
+   - Discord Game SDK: [`pkgs/by-name/di/discord-gamesdk/package.nix`](./by-name/di/discord-gamesdk/package.nix). Shows how binary-only packages can be supported. In particular, the `autoPatchelfHook` is used to set the RUNPATH and ELF interpreter of the executables so that the right libraries are found at runtime.
 
    Some notes:
 

pkgs/applications/misc/adobe-reader/default.nix

@@ -1,99 +0,0 @@
-{
-  lib,
-  stdenv,
-  fetchurl,
-  libX11,
-  cups,
-  zlib,
-  libxml2,
-  pango,
-  atk,
-  gtk2,
-  glib,
-  gdk-pixbuf,
-  gdk-pixbuf-xlib,
-}:
-
-stdenv.mkDerivation rec {
-  pname = "adobe-reader";
-  version = "9.5.5";
-
-  src = fetchurl {
-    url = "http://ardownload.adobe.com/pub/adobe/reader/unix/9.x/${version}/enu/AdbeRdr${version}-1_i486linux_enu.tar.bz2";
-    sha256 = "0h35misxrqkl5zlmmvray1bqf4ywczkm89n9qw7d9arqbg3aj3pf";
-  };
-
-  # !!! Adobe Reader contains copies of OpenSSL, libcurl, and libicu.
-  # We should probably remove those and use the regular Nixpkgs versions.
-  libPath = lib.makeLibraryPath [
-    stdenv.cc.cc
-    libX11
-    zlib
-    libxml2
-    cups
-    pango
-    atk
-    gtk2
-    glib
-    gdk-pixbuf
-    gdk-pixbuf-xlib
-  ];
-
-  installPhase = ''
-    p=$out/libexec/adobe-reader
-    mkdir -p $out/libexec
-    tar xvf COMMON.TAR -C $out
-    tar xvf ILINXR.TAR -C $out
-    mv $out/Adobe/Reader9 $p
-    rmdir $out/Adobe
-
-    # Disable this plugin for now (it needs LDAP).
-    rm $p/Reader/intellinux/plug_ins/PPKLite.api
-
-    # Remove unneeded files
-    rm $p/bin/UNINSTALL
-  '';
-
-  postFixup = ''
-    patchelf --interpreter "$(cat $NIX_CC/nix-support/dynamic-linker)" \
-        --set-rpath $libPath \
-        $p/Reader/intellinux/bin/acroread
-
-    # The "xargs -r" is to shut up a warning when Mozilla can't be found.
-    substituteInPlace $p/bin/acroread \
-        --replace-fail /bin/pwd $(type -P pwd) \
-        --replace-fail /bin/ls $(type -P ls) \
-        --replace-fail xargs "xargs -r"
-
-    mkdir -p $out/bin
-    ln -s $p/bin/acroread $out/bin/acroread
-
-    mkdir -p $out/share/applications
-    mv $p/Resource/Support/AdobeReader.desktop $out/share/applications/
-    icon=$p/Resource/Icons/128x128/AdobeReader9.png
-    [ -e $icon ]
-    sed -i $out/share/applications/AdobeReader.desktop \
-        -e "s|Icon=.*|Icon=$icon|"
-
-    mkdir -p $out/share/mimelnk/application
-    mv $p/Resource/Support/vnd*.desktop $out/share/mimelnk/application
-  '';
-
-  dontStrip = true;
-
-  passthru.mozillaPlugin = "/libexec/adobe-reader/Browser/intellinux";
-
-  meta = {
-    description = "Adobe Reader, a viewer for PDF documents";
-    homepage = "http://www.adobe.com/products/reader";
-    sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
-    license = lib.licenses.unfree;
-    knownVulnerabilities = [
-      "Numerous unresolved vulnerabilities"
-      "See: https://www.cvedetails.com/product/497/Adobe-Acrobat-Reader.html?vendor_id=53"
-    ];
-    platforms = [ "i686-linux" ];
-    maintainers = with lib.maintainers; [ onny ];
-    mainProgram = "acroread";
-  };
-}

pkgs/applications/networking/geph/default.nix

@@ -1,142 +0,0 @@
-{
-  lib,
-  stdenvNoCC,
-  rustPlatform,
-  fetchFromGitHub,
-  buildGoModule,
-  makeWrapper,
-  nodejs,
-  pnpm,
-  esbuild,
-  perl,
-  pkg-config,
-  glib,
-  webkitgtk_4_0,
-  libayatana-appindicator,
-  cairo,
-  openssl,
-}:
-
-let
-  version = "4.99.16";
-  geph-meta = with lib; {
-    description = "Modular Internet censorship circumvention system designed specifically to deal with national filtering";
-    homepage = "https://geph.io";
-    platforms = platforms.linux;
-    maintainers = with maintainers; [ penalty1083 ];
-  };
-in
-{
-  cli = rustPlatform.buildRustPackage rec {
-    pname = "geph4-client";
-    inherit version;
-
-    src = fetchFromGitHub {
-      owner = "geph-official";
-      repo = pname;
-      rev = "v${version}";
-      hash = "sha256-6YWPsSRIZpvVCIGZ1z7srobDvVzLr0o2jBcB/7kbK7I=";
-    };
-
-    useFetchCargoVendor = true;
-    cargoHash = "sha256-igIYTlI3hqvlOTgdwouA9YussP9h0pOHUUTCjA2LE5U=";
-
-    nativeBuildInputs = [ perl ];
-
-    meta = geph-meta // {
-      license = with lib.licenses; [ gpl3Only ];
-    };
-  };
-
-  gui = stdenvNoCC.mkDerivation (finalAttrs: {
-    pname = "geph-gui";
-    inherit version;
-
-    src = fetchFromGitHub {
-      owner = "geph-official";
-      repo = "gephgui-pkg";
-      rev = "9f0d5c689c2cae67a4750a68295676f449724a98";
-      hash = "sha256-/aHd1EDrFp1kXen5xRCCl8LVlMVH0pY8buILZri81II=";
-      fetchSubmodules = true;
-    };
-
-    gephgui-wry = rustPlatform.buildRustPackage {
-      pname = "gephgui-wry";
-      inherit (finalAttrs) version src;
-
-      sourceRoot = "${finalAttrs.src.name}/gephgui-wry";
-
-      useFetchCargoVendor = true;
-      cargoHash = "sha256-pCj4SulUVEC4QTPBrPQBn5xJ+sHPs6KfjsdVRcsRapY=";
-
-      pnpmDeps = pnpm.fetchDeps {
-        inherit (finalAttrs) pname version src;
-        sourceRoot = "${finalAttrs.src.name}/gephgui-wry/gephgui";
-        hash = "sha256-0MGlsLEgugQ1wEz07ROIwkanTa8PSKwIaxNahyS1014=";
-      };
-
-      nativeBuildInputs = [
-        pkg-config
-        pnpm.configHook
-        makeWrapper
-        nodejs
-      ];
-
-      buildInputs = [
-        glib
-        webkitgtk_4_0
-        libayatana-appindicator
-        cairo
-        openssl
-      ];
-
-      ESBUILD_BINARY_PATH = "${lib.getExe (
-        esbuild.override {
-          buildGoModule =
-            args:
-            buildGoModule (
-              args
-              // rec {
-                version = "0.15.10";
-                src = fetchFromGitHub {
-                  owner = "evanw";
-                  repo = "esbuild";
-                  rev = "v${version}";
-                  hash = "sha256-DebmLtgPrla+1UcvOHMnWmxa/ZqrugeRRKXIiJ9LYDk=";
-                };
-                vendorHash = "sha256-+BfxCyg0KkDQpHt/wycy/8CTG6YBA/VJvJFhhzUnSiQ=";
-              }
-            );
-        }
-      )}";
-
-      pnpmRoot = "gephgui";
-
-      preBuild = ''
-        pushd gephgui
-        pnpm build
-        popd
-      '';
-    };
-
-    dontBuild = true;
-
-    installPhase = ''
-      install -Dt $out/bin ${finalAttrs.gephgui-wry}/bin/gephgui-wry
-      install -d $out/share/icons/hicolor
-      for i in '16' '32' '64' '128' '256'
-      do
-        name=''${i}x''${i}
-        dir=$out/share/icons/hicolor
-        mkdir -p $dir
-        mv flatpak/icons/$name $dir
-      done
-      install -Dt $out/share/applications flatpak/icons/io.geph.GephGui.desktop
-      sed -i -e '/StartupWMClass/s/=.*/=gephgui-wry/' $out/share/applications/io.geph.GephGui.desktop
-    '';
-
-    meta = geph-meta // {
-      license = with lib.licenses; [ unfree ];
-    };
-  });
-}

pkgs/by-name/av/avr-sim/package.nix

@@ -1,72 +0,0 @@
-{
-  lib,
-  stdenv,
-  fetchzip,
-  lazarus,
-  fpc,
-  pango,
-  cairo,
-  glib,
-  atk,
-  gtk2,
-  libX11,
-  gdk-pixbuf,
-}:
-stdenv.mkDerivation rec {
-  pname = "avr-sim";
-  version = "2.8";
-
-  # Unfortunately old releases get removed:
-  # http://www.avr-asm-tutorial.net/avr_sim/avr_sim-download.html
-  # Therefore, fallback to an archive.org snapshot
-  src = fetchzip {
-    urls = [
-      "http://www.avr-asm-tutorial.net/avr_sim/28/avr_sim_28_lin_src.zip"
-      "https://web.archive.org/web/20231129125754/http://www.avr-asm-tutorial.net/avr_sim/28/avr_sim_28_lin_src.zip"
-    ];
-    hash = "sha256-7MgUzMs+l+3RVUbORAWyU1OUpgrKIeWhS+ObgRJtOHc=";
-  };
-
-  nativeBuildInputs = [
-    lazarus
-    fpc
-  ];
-
-  buildInputs = [
-    pango
-    cairo
-    glib
-    atk
-    gtk2
-    libX11
-    gdk-pixbuf
-  ];
-
-  NIX_LDFLAGS = "--as-needed -rpath ${lib.makeLibraryPath buildInputs}";
-
-  buildPhase = ''
-    runHook preBuild
-
-    lazbuild --lazarusdir=${lazarus}/share/lazarus --build-mode=Release avr_sim.lpi
-
-    runHook postBuild
-  '';
-
-  installPhase = ''
-    runHook preInstall
-
-    mkdir -p $out/bin
-
-    cp avr_sim $out/bin
-
-    runHook postInstall
-  '';
-
-  meta = with lib; {
-    description = "AVR assembler simulator for the stepwise execution of assembler source code - with many extras";
-    homepage = "http://www.avr-asm-tutorial.net/avr_sim/index_en.html";
-    license = licenses.unfree;
-    platforms = platforms.unix;
-    maintainers = with maintainers; [ ameer ];
-  };
-}

pkgs/by-name/bi/biblioteca/package.nix

@@ -24,14 +24,14 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "biblioteca";
-  version = "1.5";
+  version = "1.6";
 
   src = fetchFromGitHub {
     owner = "workbenchdev";
     repo = "Biblioteca";
     tag = "v${finalAttrs.version}";
     fetchSubmodules = true;
-    hash = "sha256-zrrI3u4ukGN6eb/eK/aZG4gi/xtXciyRS+JX9Js9KEw=";
+    hash = "sha256-9AL8obvXB/bgqhTw8VE30OytNFQmxvJ6TYGN8ir+NfI=";
   };
 
   patches = [

pkgs/by-name/ch/checkov/package.nix

@@ -25,14 +25,14 @@ with py.pkgs;
 
 python3.pkgs.buildPythonApplication rec {
   pname = "checkov";
-  version = "3.2.435";
+  version = "3.2.436";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "bridgecrewio";
     repo = "checkov";
     tag = version;
-    hash = "sha256-zV430pGFkfyf0oznXe69lTsMkGUrrA5TTyGobE4AK9I=";
+    hash = "sha256-QI7gJjk7TtafSqGJ8vX+bTgajeRjBUHQnNJxhDiVUDI=";
   };
 
   pythonRelaxDeps = [

pkgs/by-name/di/directx-headers/package.nix

@@ -7,13 +7,13 @@
 }:
 stdenv.mkDerivation rec {
   pname = "directx-headers";
-  version = "1.615.0";
+  version = "1.616.0";
 
   src = fetchFromGitHub {
     owner = "microsoft";
     repo = "DirectX-Headers";
     rev = "v${version}";
-    hash = "sha256-1s/lrvUUOBGVAtfyAG2b/9raQVj2Hcjw9/RtqBO7ENA=";
+    hash = "sha256-bPFeaNCxECKnecvt9jDIvxiQE6VaT7qD8Tyqm8L3u3M=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/do/dotenvx/package.nix

@@ -8,16 +8,16 @@
 
 buildNpmPackage rec {
   pname = "dotenvx";
-  version = "1.41.0";
+  version = "1.44.1";
 
   src = fetchFromGitHub {
     owner = "dotenvx";
     repo = "dotenvx";
     tag = "v${version}";
-    hash = "sha256-qYigFqJF/+37bd8LPg8u9EkI/50ULxTs3LwjrcAYntk=";
+    hash = "sha256-uzEZfzGAwA/boDft/Z3Toq3gUG0n3nqREtLjgmIO1Kw=";
   };
 
-  npmDepsHash = "sha256-k+M3AdEHSrpl+rKTbxmTkcHVgwm5lHt3xjj2fQ4UFiI=";
+  npmDepsHash = "sha256-kWOj/78yurII4O9XYzcvC2JflCWRbbqIOU4WkdbX5AM=";
 
   dontNpmBuild = true;
 

pkgs/by-name/fx/fx/package.nix

@@ -5,21 +5,23 @@
   installShellFiles,
 }:
 
-buildGoModule rec {
+buildGoModule (finalAttrs: {
   pname = "fx";
-  version = "36.0.0";
+  version = "36.0.3";
 
   src = fetchFromGitHub {
     owner = "antonmedv";
     repo = "fx";
-    rev = version;
-    hash = "sha256-wUiyMczToGqfHZ/FMUhCO4ud6h/bNHhVt4eWoZJckbU=";
+    tag = finalAttrs.version;
+    hash = "sha256-SUv6kHqIft7M7XyypA7jBYcEuYHLYYVtTnwgL1vhT3w=";
   };
 
-  nativeBuildInputs = [ installShellFiles ];
-
   vendorHash = "sha256-8KiCj2khO0zxsZDG1YD0EjsoZSY4q+IXC+NLeeXgVj4=";
 
+  ldflags = [ "-s" ];
+
+  nativeBuildInputs = [ installShellFiles ];
+
   postInstall = ''
     installShellCompletion --cmd fx \
       --bash <($out/bin/fx --comp bash) \
@@ -27,12 +29,12 @@ buildGoModule rec {
       --zsh <($out/bin/fx --comp zsh)
   '';
 
-  meta = with lib; {
+  meta = {
+    changelog = "https://github.com/antonmedv/fx/releases/tag/${finalAttrs.src.tag}";
     description = "Terminal JSON viewer";
-    mainProgram = "fx";
     homepage = "https://github.com/antonmedv/fx";
-    changelog = "https://github.com/antonmedv/fx/releases/tag/${src.rev}";
-    license = licenses.mit;
-    maintainers = with maintainers; [ figsoda ];
+    license = lib.licenses.mit;
+    mainProgram = "fx";
+    maintainers = with lib.maintainers; [ figsoda ];
   };
-}
+})

pkgs/by-name/ge/geph/package.nix

@@ -0,0 +1,115 @@
+{
+  lib,
+  rustPlatform,
+  fetchFromGitHub,
+  pkg-config,
+  libxkbcommon,
+  openssl,
+  rust-jemalloc-sys-unprefixed,
+  sqlite,
+  vulkan-loader,
+  wayland,
+  iproute2,
+  iptables,
+  libglvnd,
+  copyDesktopItems,
+  makeDesktopItem,
+}:
+let
+  binPath = lib.makeBinPath [
+    iproute2
+    iptables
+  ];
+in
+rustPlatform.buildRustPackage (finalAttrs: {
+  pname = "geph5";
+  version = "0.2.61";
+
+  src = fetchFromGitHub {
+    owner = "geph-official";
+    repo = "geph5";
+    rev = "geph5-client-v${finalAttrs.version}";
+    hash = "sha256-qy1E5x5Fn+xwS5st6HkMrJu9nksXQQIyJf97FvNOKO4=";
+  };
+
+  cargoHash = "sha256-r97DsSsqp/KtgqtYQe92nz2qaOBcJF6w9ckfxpk8Cxg=";
+
+  patches = [ ./test-fix.patch ];
+
+  postPatch = ''
+    substituteInPlace binaries/geph5-client/src/vpn/*.sh \
+      --replace-fail 'PATH=' 'PATH=${binPath}:'
+  '';
+
+  nativeBuildInputs = [
+    pkg-config
+    copyDesktopItems
+  ];
+
+  buildInputs = [
+    openssl
+    rust-jemalloc-sys-unprefixed
+    sqlite
+  ];
+
+  env = {
+    OPENSSL_NO_VENDOR = true;
+    LIBSQLITE3_SYS_USE_PKG_CONFIG = "1";
+  };
+
+  buildFeatures = [
+    "aws_lambda"
+    "windivert"
+  ];
+
+  checkFlags = [
+    # Wrong test
+    "--skip=traffcount::tests::test_traffic_cleanup"
+    "--skip=traffcount::tests::test_traffic_count_basic"
+    # Requires network
+    "--skip=dns::tests::resolve_google"
+    # Never finish
+    "--skip=tests::test_blind_sign"
+    "--skip=tests::test_generate_secret_key"
+  ];
+
+  desktopItems = [
+    (makeDesktopItem {
+      name = "Geph5";
+      desktopName = "Geph5";
+      icon = "geph5";
+      exec = "geph5-client-gui";
+      categories = [ "Network" ];
+      comment = "Modular Internet censorship circumvention system designed specifically to deal with national filtering";
+    })
+  ];
+
+  postInstall = ''
+    install -m 444 -D binaries/geph5-client-gui/icon.png $out/share/icons/hicolor/512x512/apps/geph5.png
+  '';
+
+  postFixup = ''
+    # Add required but not explicitly requested libraries
+    patchelf --add-rpath '${
+      lib.makeLibraryPath [
+        wayland
+        libxkbcommon
+        vulkan-loader
+        libglvnd
+      ]
+    }' "$out/bin/geph5-client-gui"
+  '';
+
+  meta = {
+    description = "Modular Internet censorship circumvention system designed specifically to deal with national filtering";
+    homepage = "https://github.com/geph-official/geph5";
+    changelog = "https://github.com/geph-official/geph5/releases/tag/geph5-client-v${finalAttrs.version}";
+    mainProgram = "geph5-client";
+    platforms = lib.platforms.unix;
+    license = lib.licenses.mpl20;
+    maintainers = with lib.maintainers; [
+      penalty1083
+      MCSeekeri
+    ];
+  };
+})

pkgs/by-name/ge/geph/test-fix.patch

@@ -0,0 +1,27 @@
+diff --git a/binaries/geph5-client/src/traffcount.rs b/binaries/geph5-client/src/traffcount.rs
+index 5c91a27..61c0b3b 100644
+--- a/binaries/geph5-client/src/traffcount.rs
++++ b/binaries/geph5-client/src/traffcount.rs
+@@ -28,14 +28,14 @@ impl TraffCount {
+     }
+ 
+     // /// Create a new traffic counter with custom history length
+-    // pub fn with_history(max_seconds: usize) -> Self {
+-    //     let now = Instant::now();
+-    //     Self {
+-    //         bins: VecDeque::with_capacity(max_seconds),
+-    //         window_start: now,
+-    //         max_history_seconds: max_seconds,
+-    //     }
+-    // }
++    pub fn with_history(max_seconds: usize) -> Self {
++        let now = Instant::now();
++        Self {
++            bins: VecDeque::with_capacity(max_seconds),
++            window_start: now,
++            max_history_seconds: max_seconds,
++        }
++    }
+ 
+     /// Increment the traffic count with the given number of bytes
+     pub fn incr(&mut self, bytes: f64) {

pkgs/by-name/go/google-chrome/update.sh

@@ -30,7 +30,7 @@ update_linux() {
     local new_hash
     local new_sri_hash
 
-    read -ra version_info <<< "$(get_version_info "linux" "linux = stdenv.mkDerivation" "});")"
+    read -ra version_info <<< "$(get_version_info "linux" "linux = stdenvNoCC.mkDerivation" "});")"
     version="${version_info[0]}"
     current_version="${version_info[1]}"
 
@@ -43,8 +43,8 @@ update_linux() {
     new_hash="$(nix-prefetch-url "$download_url" 2>/dev/null)"
     new_sri_hash="$(nix hash to-sri --type sha256 "$new_hash")"
 
-    sed -i "/^  linux = stdenv.mkDerivation/,/^  });/s/version = \".*\"/version = \"$version\"/" "$DEFAULT_NIX"
-    sed -i "/^  linux = stdenv.mkDerivation/,/^  });/s|hash = \".*\"|hash = \"$new_sri_hash\"|" "$DEFAULT_NIX"
+    sed -i "/^  linux = stdenvNoCC.mkDerivation/,/^  });/s/version = \".*\"/version = \"$version\"/" "$DEFAULT_NIX"
+    sed -i "/^  linux = stdenvNoCC.mkDerivation/,/^  });/s|hash = \".*\"|hash = \"$new_sri_hash\"|" "$DEFAULT_NIX"
 
     echo "[Nix] Linux google-chrome: $current_version -> $version with hash $new_hash"
 }

pkgs/by-name/li/libcifpp/package.nix

@@ -10,13 +10,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "libcifpp";
-  version = "8.0.0";
+  version = "8.0.1";
 
   src = fetchFromGitHub {
     owner = "PDB-REDO";
     repo = "libcifpp";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-t1ovrrKu+QSSdwgTp2Nag4SsAJeU9aRizJccd+u+dVI=";
+    hash = "sha256-cfyou+R0VrAfYM8ez5myZkDKO5VfB9WAQF+amy3oRzU=";
   };
 
   nativeBuildInputs = [ cmake ];

pkgs/by-name/li/libnick/package.nix

@@ -19,13 +19,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "libnick";
-  version = "2025.3.3";
+  version = "2025.5.3";
 
   src = fetchFromGitHub {
     owner = "NickvisionApps";
     repo = "libnick";
     tag = finalAttrs.version;
-    hash = "sha256-5GO39rtSvg96y6VE0Ej4x7j1zDatP6JSktIcyhSrb98=";
+    hash = "sha256-JibExEI5MisKZ9kEIOMzDg8A8LEM8U+ckGFfnZu+ghQ=";
   };
 
   nativeBuildInputs =

pkgs/by-name/lu/luau-lsp/package.nix

@@ -9,13 +9,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "luau-lsp";
-  version = "1.47.0";
+  version = "1.48.0";
 
   src = fetchFromGitHub {
     owner = "JohnnyMorganz";
     repo = "luau-lsp";
     tag = finalAttrs.version;
-    hash = "sha256-/LJCLH94Egk7FvsarsMimIyehE3T9tgMz7SK6vf+BDg=";
+    hash = "sha256-KW47R5hOFESDiPt/dvVLFQqHqLxza/lUNLy2PYUPxIg=";
     fetchSubmodules = true;
   };
 

pkgs/by-name/lu/lug-helper/package.nix

@@ -15,12 +15,12 @@
 }:
 stdenvNoCC.mkDerivation (finalAttrs: {
   name = "lug-helper";
-  version = "3.9";
+  version = "3.10";
   src = fetchFromGitHub {
     owner = "starcitizen-lug";
     repo = "lug-helper";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-Fne0esV/1o+f4Fnn8oeUL+gc29d0ndGpYG21YQvZDvM=";
+    hash = "sha256-AEHFyKoxIdckir/S96hwR3h9PuzlB5EMWF7PPbeVPYg=";
   };
 
   buildInputs = [

pkgs/by-name/op/open-webui/package.nix

@@ -9,13 +9,13 @@
 }:
 let
   pname = "open-webui";
-  version = "0.6.12";
+  version = "0.6.13";
 
   src = fetchFromGitHub {
     owner = "open-webui";
     repo = "open-webui";
     tag = "v${version}";
-    hash = "sha256-q8pb+XIBKzU8zWohBtKNQhYBwcQF51/uqgVrMxcKcUc=";
+    hash = "sha256-teBGAo9YyFSBVXMElpw2zON5oCa3O8k+pf9pSNSW5gc=";
   };
 
   frontend = buildNpmPackage rec {
@@ -32,7 +32,7 @@ let
       url = "https://github.com/pyodide/pyodide/releases/download/${pyodideVersion}/pyodide-${pyodideVersion}.tar.bz2";
     };
 
-    npmDepsHash = "sha256-576Cd7I4CzOItSycQH8CwLAelLoNnQcJVZ338IhMb/k=";
+    npmDepsHash = "sha256-/olaKqd0ZBFKyfoyhuPsd1Gl7nC9pro2apiWLjPe07s=";
 
     # Disabling `pyodide:fetch` as it downloads packages during `buildPhase`
     # Until this is solved, running python packages from the browser will not work.

pkgs/by-name/pa/parabolic/package.nix

@@ -7,6 +7,7 @@
   itstool,
   ninja,
   yelp-tools,
+  desktop-file-utils,
   pkg-config,
   libnick,
   boost,
@@ -18,6 +19,8 @@
   libxmlxx5,
   blueprint-compiler,
   qt6,
+  qlementine,
+  qlementine-icons,
   yt-dlp,
   ffmpeg,
   aria2,
@@ -31,13 +34,13 @@ assert lib.assertOneOf "uiPlatform" uiPlatform [
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "parabolic";
-  version = "2025.1.4";
+  version = "2025.5.4";
 
   src = fetchFromGitHub {
     owner = "NickvisionApps";
     repo = "Parabolic";
     tag = finalAttrs.version;
-    hash = "sha256-B8/e5urhy5tAgHNd/PR3HlNQd0M0CxgC56nArFGlQ9c=";
+    hash = "sha256-2CFV9//8gFK1TYksdy9P4nLb7kj/8Q5dr5huoAuDNRs=";
   };
 
   # Patches desktop file/dbus service bypassing wrapped executable
@@ -59,6 +62,7 @@ stdenv.mkDerivation (finalAttrs: {
       pkg-config
       itstool
       yelp-tools
+      desktop-file-utils
     ]
     ++ lib.optionals (uiPlatform == "gnome") [
       wrapGAppsHook4
@@ -76,6 +80,8 @@ stdenv.mkDerivation (finalAttrs: {
     ++ lib.optionals (uiPlatform == "qt") [
       qt6.qtbase
       qt6.qtsvg
+      qlementine
+      qlementine-icons
     ]
     ++ lib.optionals (uiPlatform == "gnome") [
       glib
@@ -88,16 +94,28 @@ stdenv.mkDerivation (finalAttrs: {
     (lib.cmakeFeature "UI_PLATFORM" uiPlatform)
   ];
 
+  dontWrapGApps = true;
+  dontWrapQtApps = true;
+
   preFixup =
-    lib.optionalString (uiPlatform == "gnome") "gappsWrapperArgs"
-    + lib.optionalString (uiPlatform == "qt") "qtWrapperArgs"
-    + "+=(--prefix PATH : ${
-      lib.makeBinPath [
-        aria2
-        ffmpeg
-        yt-dlp
-      ]
-    })";
+    lib.optionalString (uiPlatform == "gnome") ''
+      makeWrapperArgs+=("''${gappsWrapperArgs[@]}")
+    ''
+    + lib.optionalString (uiPlatform == "qt") ''
+      makeWrapperArgs+=("''${qtWrapperArgs[@]}")
+    ''
+    + ''
+        makeWrapperArgs+=(--prefix PATH : ${
+          lib.makeBinPath [
+            aria2
+            ffmpeg
+            yt-dlp
+          ]
+        })
+
+      wrapProgram $out/bin/org.nickvision.tubeconverter \
+        ''${makeWrapperArgs[@]}
+    '';
 
   passthru.updateScript = nix-update-script { };
 

pkgs/by-name/po/postgres-lsp/package.nix

@@ -2,6 +2,7 @@
   lib,
   rustPlatform,
   fetchFromGitHub,
+  rust-jemalloc-sys,
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "postgres-lsp";
@@ -22,6 +23,10 @@ rustPlatform.buildRustPackage (finalAttrs: {
     rustPlatform.bindgenHook
   ];
 
+  buildInputs = [
+    rust-jemalloc-sys
+  ];
+
   env = {
     SQLX_OFFLINE = 1;
 
@@ -43,7 +48,10 @@ rustPlatform.buildRustPackage (finalAttrs: {
     description = "Tools and language server for Postgres";
     homepage = "https://pgtools.dev";
     license = lib.licenses.mit;
-    maintainers = with lib.maintainers; [ figsoda ];
+    maintainers = with lib.maintainers; [
+      figsoda
+      myypo
+    ];
     mainProgram = "postgrestools";
   };
 })

pkgs/by-name/ql/qlementine-icons/package.nix

@@ -0,0 +1,49 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  cmake,
+  qt6,
+  nix-update-script,
+}:
+stdenv.mkDerivation (finalAttrs: {
+  pname = "qlementine-icons";
+  version = "1.8.1";
+
+  src = fetchFromGitHub {
+    owner = "oclero";
+    repo = "qlementine-icons";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-b6krWtDCQjJRzzkFNYLt33iSSQHm1UZ3AedXrzRrDTs=";
+  };
+
+  nativeBuildInputs = [ cmake ];
+
+  buildInputs = [
+    qt6.qtbase
+    qt6.qtsvg
+  ];
+
+  dontWrapQtApps = true;
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "Vector icon set for modern desktop Qt5/Qt6 applications";
+    longDescription = ''
+      An icon set aimed to be used in conjunction with the Qlementine Qt library.
+
+      This icon set provides icons as requested by the Freedesktop
+      standard, and vastly expands it, in 16×16 pixels.
+
+      The icons are in SVG format, so can be scaled to any size without
+      loosing any quality. However, they've been designed to be used in
+      `16×16` pixels, to be pixel-perfect.
+    '';
+    homepage = "https://github.com/oclero/qlementine-icons";
+    changelog = "https://github.com/oclero/qlementine-icons/releases/tag/v${finalAttrs.version}";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ normalcea ];
+    platforms = lib.platforms.unix;
+  };
+})

pkgs/by-name/ql/qlementine/package.nix

@@ -0,0 +1,54 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  cmake,
+  qt6,
+  nix-update-script,
+}:
+stdenv.mkDerivation (finalAttrs: {
+  pname = "qlementine";
+  version = "1.2.2";
+
+  src = fetchFromGitHub {
+    owner = "oclero";
+    repo = "qlementine";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-icImLN04Ux+pqWaBTNruCkZC+735vzMz8tzssyCncjI=";
+  };
+
+  nativeBuildInputs = [ cmake ];
+
+  buildInputs = [
+    qt6.qtbase
+    qt6.qtsvg
+  ];
+
+  dontWrapQtApps = true;
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "Modern QStyle for desktop Qt6 applications";
+    longDescription = ''
+      A QStyle for desktop Qt6 applications.
+
+      This library contains:
+
+      - A custom QStyle named QlementineStyle, that implements all the
+        necessary API to give a modern look and feel to your Qt
+        application. It's a drop-in replacement for the default QStyle.
+
+      - Lots of utilities to help you write beautiful QWidgets that fits
+        well with the style.
+
+      - A collection of new QWidgets that are missing in Qt's standard
+        collection, such as Switch.
+    '';
+    homepage = "https://oclero.github.io/qlementine/";
+    changelog = "https://github.com/oclero/qlementine/releases/tag/v${finalAttrs.version}";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ normalcea ];
+    platforms = lib.platforms.unix;
+  };
+})

pkgs/by-name/sk/skim/package.nix

@@ -12,7 +12,7 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "skim";
-  version = "0.17.3";
+  version = "0.18.0";
 
   outputs = [
     "out"
@@ -24,7 +24,7 @@ rustPlatform.buildRustPackage rec {
     owner = "skim-rs";
     repo = "skim";
     tag = "v${version}";
-    hash = "sha256-aq6qOlxFftiUyMqzbIgv/PnxqSNt6TsHCsy586LdZy0=";
+    hash = "sha256-79HHJeAP3pnM/KAdGsGw31MRXl3Qz2ttTvXX+oBCcow=";
   };
 
   postPatch = ''
@@ -32,7 +32,7 @@ rustPlatform.buildRustPackage rec {
   '';
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-yhZFLrpI2U/9VWGZkzYGzF5nPRmKpqJnfZ+6bmBYXNI=";
+  cargoHash = "sha256-N1s6Kf6iy28QcrLQy6TVbXjfSb9KtzJeaKksW4wXsMw=";
 
   nativeBuildInputs = [ installShellFiles ];
 

pkgs/by-name/tr/trivy/package.nix

@@ -11,19 +11,19 @@
 
 buildGo124Module rec {
   pname = "trivy";
-  version = "0.62.1";
+  version = "0.63.0";
 
   src = fetchFromGitHub {
     owner = "aquasecurity";
     repo = "trivy";
     tag = "v${version}";
-    hash = "sha256-STu/xkKC2Ci5HbUi+gdz3ZXB+xgpkh6bs/lB/pG2Uig=";
+    hash = "sha256-e1T4z0L1poPzZgq8ooBmXiA+d+aTaf9bE09Rx2yFk68=";
   };
 
   # Hash mismatch on across Linux and Darwin
   proxyVendor = true;
 
-  vendorHash = "sha256-0/nM0mcTWF4OPIZvHd6fOPfYMMDw5d96acNuw4kM7Tw=";
+  vendorHash = "sha256-lp5rajoeGR+nLO8EOLPdRLz0r19nGq2YNSjba8Zpq9E=";
 
   subPackages = [ "cmd/trivy" ];
 

pkgs/by-name/ya/yazi-unwrapped/package.nix

@@ -8,18 +8,18 @@
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "yazi";
-  version = "25.5.28";
+  version = "25.5.31";
 
   srcs = builtins.attrValues finalAttrs.passthru.srcs;
 
   sourceRoot = finalAttrs.passthru.srcs.code_src.name;
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-g+6RawDZsgYnXiybhaiosOfz/k4LHe5iX+VqHikfPzM=";
+  cargoHash = "sha256-5oNhqiQYkzaNZ1vK3hV5vWQCNr6D9VPNoqkS8ZOLf/4=";
 
   env.YAZI_GEN_COMPLETIONS = true;
   env.VERGEN_GIT_SHA = "Nixpkgs";
-  env.VERGEN_BUILD_DATE = "2025-05-28";
+  env.VERGEN_BUILD_DATE = "2025-05-30";
 
   nativeBuildInputs = [ installShellFiles ];
   buildInputs = [ rust-jemalloc-sys ];
@@ -42,7 +42,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
       owner = "sxyazi";
       repo = "yazi";
       tag = "v${finalAttrs.version}";
-      hash = "sha256-z+dh1lO6lvStlv58mi5T/cxYdewo2+5bRSO7naVcHMs=";
+      hash = "sha256-Er9d/5F34c2Uw+DN/9j+j7TdeWiSxMQlZSgsATC04cM=";
     };
 
     man_src = fetchFromGitHub {

pkgs/by-name/yu/yubioath-flutter/package.nix

@@ -1,6 +1,6 @@
 {
   lib,
-  flutter324,
+  flutter332,
   python3,
   fetchFromGitHub,
   pcre2,
@@ -10,25 +10,27 @@
   gnome-screenshot,
   makeWrapper,
   removeReferencesTo,
+  runCommand,
+  yq,
+  yubioath-flutter,
+  _experimental-update-script-combinators,
+  gitUpdater,
 }:
 
-flutter324.buildFlutterApplication rec {
+flutter332.buildFlutterApplication rec {
   pname = "yubioath-flutter";
-  version = "7.1.1";
+  version = "7.2.2";
 
   src = fetchFromGitHub {
     owner = "Yubico";
     repo = "yubioath-flutter";
-    rev = version;
-    hash = "sha256-MpY6yJvGBaFiEwuGEme2Uvyi5INCYhZJHyaRpC9pCuk=";
+    tag = version;
+    hash = "sha256-XkRSyy845hxQX5Ew5Sx3ZLh9UXfFMF6YdZJx+p/PJpo=";
   };
 
-  passthru.helper = python3.pkgs.callPackage ./helper.nix { inherit src version meta; };
-
   pubspecLock = lib.importJSON ./pubspec.lock.json;
-  gitHashes = {
-    window_manager = "sha256-mLX51nbWFccsAfcqLQIYDjYz69y9wAz4U1RZ8TIYSj0=";
-  };
+
+  gitHashes.window_manager = "sha256-WKcNwEOthXj1S2lKlpdhy+r8JZslVqhwY2ywXeTSBEs=";
 
   postPatch = ''
     rm -f pubspec.lock
@@ -37,40 +39,6 @@ flutter324.buildFlutterApplication rec {
       --replace-fail "../build/linux/helper" "${passthru.helper}/libexec/helper"
   '';
 
-  preInstall = ''
-    # Make sure we have permission to delete things CMake has copied in to our build directory from elsewhere.
-    chmod -R +w build
-  '';
-
-  postInstall = ''
-    # Swap the authenticator-helper symlink with the correct symlink.
-    ln -fs "${passthru.helper}/bin/authenticator-helper" "$out/app/$pname/helper/authenticator-helper"
-
-    # Move the icon.
-    mkdir $out/share/icons
-    mv $out/app/$pname/linux_support/com.yubico.yubioath.png $out/share/icons
-
-    # Cleanup.
-    rm -rf \
-      "$out/app/$pname/README.adoc" \
-      "$out/app/$pname/desktop_integration.sh" \
-      "$out/app/$pname/linux_support" \
-      $out/bin/* # We will repopulate this directory later.
-
-    # Symlink binary.
-    ln -sf "$out/app/$pname/authenticator" "$out/bin/yubioath-flutter"
-
-    # Set the correct path to the binary in desktop file.
-    substituteInPlace "$out/share/applications/com.yubico.authenticator.desktop" \
-      --replace "@EXEC_PATH/authenticator" "$out/bin/yubioath-flutter" \
-      --replace "@EXEC_PATH/linux_support/com.yubico.yubioath.png" "$out/share/icons/com.yubico.yubioath.png"
-  '';
-
-  # Needed for QR scanning to work
-  extraWrapProgramArgs = ''
-    --prefix PATH : ${lib.makeBinPath [ gnome-screenshot ]}
-  '';
-
   nativeBuildInputs = [
     makeWrapper
     removeReferencesTo
@@ -83,12 +51,63 @@ flutter324.buildFlutterApplication rec {
     libappindicator
   ];
 
-  meta = with lib; {
+  preInstall = ''
+    # Make sure we have permission to delete things CMake has copied in to our build directory from elsewhere.
+    chmod -R +w build
+  '';
+
+  postInstall = ''
+    # Swap the authenticator-helper symlink with the correct symlink.
+    ln -fs "${passthru.helper}/bin/authenticator-helper" "$out/app/$pname/helper/authenticator-helper"
+
+    # Move the icon.
+    mkdir $out/share/pixmaps
+    mv $out/app/$pname/linux_support/com.yubico.yubioath.png $out/share/pixmaps
+
+    # Cleanup.
+    rm -rf \
+      "$out/app/$pname/README.adoc" \
+      "$out/app/$pname/desktop_integration.sh" \
+      "$out/app/$pname/linux_support" \
+      $out/bin/* # We will repopulate this directory later.
+
+    # Symlink binary.
+    ln -sf "$out/app/$pname/authenticator" "$out/bin/yubioath-flutter"
+
+    # Set the correct path to the binary in desktop file.
+    substituteInPlace "$out/share/applications/com.yubico.yubioath.desktop" \
+      --replace-fail '"@EXEC_PATH/authenticator"' "yubioath-flutter" \
+      --replace-fail "@EXEC_PATH/linux_support/com.yubico.yubioath.png" "com.yubico.yubioath"
+  '';
+
+  # Needed for QR scanning to work
+  extraWrapProgramArgs = ''
+    --prefix PATH : ${lib.makeBinPath [ gnome-screenshot ]}
+  '';
+
+  passthru = {
+    helper = python3.pkgs.callPackage ./helper.nix { inherit src version meta; };
+    pubspecSource =
+      runCommand "pubspec.lock.json"
+        {
+          nativeBuildInputs = [ yq ];
+          inherit (yubioath-flutter) src;
+        }
+        ''
+          cat $src/pubspec.lock | yq > $out
+        '';
+    updateScript = _experimental-update-script-combinators.sequence [
+      (gitUpdater { })
+      (_experimental-update-script-combinators.copyAttrOutputToFile "yubioath-flutter.pubspecSource" ./pubspec.lock.json)
+    ];
+  };
+
+  meta = {
     description = "Yubico Authenticator for Desktop";
     mainProgram = "yubioath-flutter";
     homepage = "https://github.com/Yubico/yubioath-flutter";
-    license = licenses.asl20;
-    maintainers = with maintainers; [ lukegb ];
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ lukegb ];
     platforms = [
       "x86_64-linux"
       "aarch64-linux"

pkgs/desktops/lomiri/services/lomiri-content-hub/default.nix

@@ -2,7 +2,9 @@
   stdenv,
   lib,
   fetchFromGitLab,
+  fetchpatch,
   gitUpdater,
+  nixosTests,
   testers,
   cmake,
   cmake-extras,
@@ -31,13 +33,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "lomiri-content-hub";
-  version = "2.0.0";
+  version = "2.1.0";
 
   src = fetchFromGitLab {
     owner = "ubports";
     repo = "development/core/lomiri-content-hub";
     rev = finalAttrs.version;
-    hash = "sha256-eA5oCoAZB7fWyWm0Sy6wXh0EW+h76bdfJ2dotr7gUC0=";
+    hash = "sha256-S/idjDdcRvqZqKmflkYJyQckz4/9k/8JY6eRDACk9Ag=";
   };
 
   outputs = [
@@ -47,9 +49,18 @@ stdenv.mkDerivation (finalAttrs: {
     "examples"
   ];
 
+  patches = [
+    # Remove when version > 2.1.0
+    (fetchpatch {
+      name = "0001-lomiri-content-hub-treewide-Add-missing-LDM-include-dirs.patch";
+      url = "https://gitlab.com/ubports/development/core/lomiri-content-hub/-/commit/cdd3371714c183d4caf166157082288c022bb98d.patch";
+      hash = "sha256-Uubd425T+0KxPR9lJW6+ejO2fFzcDwEIpJATSZ9jYD4=";
+    })
+  ];
+
   postPatch = ''
     substituteInPlace import/*/Content/CMakeLists.txt \
-      --replace-fail "\''${CMAKE_INSTALL_LIBDIR}/qt5/qml" "\''${CMAKE_INSTALL_PREFIX}/${qtbase.qtQmlPrefix}"
+      --replace-fail "\''${CMAKE_INSTALL_LIBDIR}/qt\''${QT_VERSION_MAJOR}/qml" "\''${CMAKE_INSTALL_PREFIX}/${qtbase.qtQmlPrefix}"
 
     # Look for peer files in running system
     substituteInPlace src/com/lomiri/content/service/registry-updater.cpp \
@@ -101,6 +112,7 @@ stdenv.mkDerivation (finalAttrs: {
   cmakeFlags = [
     (lib.cmakeBool "GSETTINGS_COMPILE" true)
     (lib.cmakeBool "GSETTINGS_LOCALINSTALL" true)
+    (lib.cmakeBool "ENABLE_QT6" (lib.strings.versionAtLeast qtbase.version "6"))
     (lib.cmakeBool "ENABLE_TESTS" finalAttrs.finalPackage.doCheck)
     (lib.cmakeBool "ENABLE_DOC" true)
     (lib.cmakeBool "ENABLE_UBUNTU_COMPAT" true) # in case something still depends on it
@@ -145,7 +157,12 @@ stdenv.mkDerivation (finalAttrs: {
   '';
 
   passthru = {
-    tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
+    tests = {
+      pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
+      # Tests content-hub functionality, up to the point where one app receives a content exchange request
+      # from another and changes into a mode to pick the content to send
+      vm = nixosTests.lomiri.desktop-appinteractions;
+    };
     updateScript = gitUpdater { };
   };
 

pkgs/desktops/lomiri/services/mediascanner2/default.nix

@@ -2,7 +2,6 @@
   stdenv,
   lib,
   fetchFromGitLab,
-  fetchpatch,
   gitUpdater,
   nixosTests,
   testers,
@@ -32,13 +31,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "mediascanner2";
-  version = "0.117";
+  version = "0.118";
 
   src = fetchFromGitLab {
     owner = "ubports";
     repo = "development/core/mediascanner2";
-    rev = finalAttrs.version;
-    hash = "sha256-e1vDPnIIfevXj9ODEEKJ2y4TiU0H+08aTf2vU+emdQk=";
+    tag = finalAttrs.version;
+    hash = "sha256-ZJXJNDZUDor5EJ+rn7pQt7lLzoszZUQM3B+u1gBSMs8=";
   };
 
   outputs = [
@@ -46,22 +45,6 @@ stdenv.mkDerivation (finalAttrs: {
     "dev"
   ];
 
-  patches = [
-    (fetchpatch {
-      name = "0001-mediascanner2-scannerdaemon-Drop-desktop-and-MEDIASCANNER_RUN-check.patch";
-      url = "https://gitlab.com/ubports/development/core/mediascanner2/-/commit/1e65b32e32a0536b9e2f283ba563fa78b6ef6d61.patch";
-      hash = "sha256-Xhm5+/E/pP+mn+4enqdsor1oRqfYTzabg1ODVfIhra4=";
-    })
-
-    # Fix taglib 2.x compat
-    # Remove when version > 0.117
-    (fetchpatch {
-      name = "0002-mediascanner2-Fix-taglib-2.x-compat.patch";
-      url = "https://gitlab.com/ubports/development/core/mediascanner2/-/commit/0ce744ecb32abb39516d1b9f98d47c3e86690158.patch";
-      hash = "sha256-hz/EB83yNoxhxkEcg7ZMezknpKajhH1BNkYD3wrf/eY=";
-    })
-  ];
-
   postPatch = ''
     substituteInPlace src/qml/MediaScanner.*/CMakeLists.txt \
       --replace-fail "\''${CMAKE_INSTALL_LIBDIR}/qt5/qml" "\''${CMAKE_INSTALL_PREFIX}/${qtbase.qtQmlPrefix}"
@@ -131,6 +114,9 @@ stdenv.mkDerivation (finalAttrs: {
   meta = {
     description = "Media scanner service & access library";
     homepage = "https://gitlab.com/ubports/development/core/mediascanner2";
+    changelog = "https://gitlab.com/ubports/development/core/mediascanner2/-/blob/${
+      if (!builtins.isNull finalAttrs.src.tag) then finalAttrs.src.tag else finalAttrs.src.rev
+    }/ChangeLog";
     license = lib.licenses.gpl3Only;
     teams = [ lib.teams.lomiri ];
     mainProgram = "mediascanner-service-2.0";

pkgs/development/interpreters/python/cpython/default.nix

@@ -26,6 +26,7 @@
   sqlite,
   xz,
   zlib,
+  zstd,
 
   # platform-specific dependencies
   bashNonInteractive,
@@ -202,6 +203,8 @@ let
     ++ optionals (!stdenv.hostPlatform.isDarwin) [
       autoconf-archive # needed for AX_CHECK_COMPILE_FLAG
       autoreconfHook
+    ]
+    ++ optionals (!stdenv.hostPlatform.isDarwin || passthru.pythonAtLeast "3.14") [
       pkg-config
     ]
     ++ optionals (stdenv.hostPlatform != stdenv.buildPlatform) [
@@ -231,6 +234,9 @@ let
       xz
       zlib
     ]
+    ++ optionals (passthru.pythonAtLeast "3.14") [
+      zstd
+    ]
     ++ optionals withMpdecimal [
       mpdecimal
     ]

pkgs/development/python-modules/boto3-stubs/default.nix

@@ -359,7 +359,7 @@
 
 buildPythonPackage rec {
   pname = "boto3-stubs";
-  version = "1.38.24";
+  version = "1.38.27";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
@@ -367,7 +367,7 @@ buildPythonPackage rec {
   src = fetchPypi {
     pname = "boto3_stubs";
     inherit version;
-    hash = "sha256-Fgd4T9N5RY5V7pL0/R12vzKHgaJ928Miw91ht85KoeM=";
+    hash = "sha256-ikXzK4PSnsPbKLN+po6l8XmxQYYyEUl++SuhjiqJauw=";
   };
 
   build-system = [ setuptools ];

pkgs/development/python-modules/botocore-stubs/default.nix

@@ -10,7 +10,7 @@
 
 buildPythonPackage rec {
   pname = "botocore-stubs";
-  version = "1.38.24";
+  version = "1.38.27";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
@@ -18,7 +18,7 @@ buildPythonPackage rec {
   src = fetchPypi {
     pname = "botocore_stubs";
     inherit version;
-    hash = "sha256-7TRpF1kdG3SZLq3IvQIKCdVSKMvfnTJzpNsriPC9uPk=";
+    hash = "sha256-WDFdExi3nY+L0oiLFYfZD6T/phAKWLYQlGEQ6IVwuZU=";
   };
 
   nativeBuildInputs = [ setuptools ];

pkgs/development/python-modules/mechanicalsoup/default.nix

@@ -14,7 +14,7 @@
 
 buildPythonPackage rec {
   pname = "mechanicalsoup";
-  version = "1.3.0";
+  version = "1.4.0";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -23,7 +23,7 @@ buildPythonPackage rec {
     owner = "MechanicalSoup";
     repo = "MechanicalSoup";
     tag = "v${version}";
-    hash = "sha256-iZ2nwBxikf0cTTlxzcGvHJim4N6ZEqIhlK7t1WAYdms=";
+    hash = "sha256-fu3DGTsLrw+MHZCFF4WHMpyjqkexH/c8j9ko9ZAeAwU=";
   };
 
   postPatch = ''

pkgs/development/python-modules/mitogen/default.nix

@@ -8,7 +8,7 @@
 
 buildPythonPackage rec {
   pname = "mitogen";
-  version = "0.3.23";
+  version = "0.3.24";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
@@ -17,7 +17,7 @@ buildPythonPackage rec {
     owner = "mitogen-hq";
     repo = "mitogen";
     tag = "v${version}";
-    hash = "sha256-UhIimbD+Nx2v/W+A0y2L4a/iYFGF+PH59wCqW2Q4ioQ=";
+    hash = "sha256-TogWhsKnwF4uHOhCNxPpNiyWen3Vfh5bbDI8wKprP/k=";
   };
 
   build-system = [ setuptools ];

pkgs/development/python-modules/mypy-boto3/default.nix

@@ -66,8 +66,8 @@ rec {
       "sha256-NoNqTKRj7/wlqoBwsEW/wgj1cBAHYRXgLVfZvkP5EV0=";
 
   mypy-boto3-amplify =
-    buildMypyBoto3Package "amplify" "1.38.0"
-      "sha256-Yv+wP2Evnr71q1ySqNuz5jxwiJAi55frDVr/Js8rOd4=";
+    buildMypyBoto3Package "amplify" "1.38.26"
+      "sha256-m+R9I+UnOmamcErUqyzSgmJJB1Z8aM+GiF4m+vKNb1w=";
 
   mypy-boto3-amplifybackend =
     buildMypyBoto3Package "amplifybackend" "1.38.0"
@@ -150,8 +150,8 @@ rec {
       "sha256-6OgMopfNAD7bpLnDFXlcejFqKYTOvrJOd/X39SHYa1A=";
 
   mypy-boto3-autoscaling =
-    buildMypyBoto3Package "autoscaling" "1.38.0"
-      "sha256-cktwW7m3hDjlGuli/kLnjup8v6+NMypkis1uwaMjDGw=";
+    buildMypyBoto3Package "autoscaling" "1.38.26"
+      "sha256-U70vqWbBuDSUxbftuGdZasnmjBOk5QUDShSE+JAr5rA=";
 
   mypy-boto3-autoscaling-plans =
     buildMypyBoto3Package "autoscaling-plans" "1.38.0"
@@ -250,8 +250,8 @@ rec {
       "sha256-YpciSNXGJznUocicc/2Yw3DPbBd75hysRiRQz8aCMHM=";
 
   mypy-boto3-cloudtrail =
-    buildMypyBoto3Package "cloudtrail" "1.38.0"
-      "sha256-YF6b1GuGRcUxY+5RICiH6V12DoDxjLq6lyrjItqfNQk=";
+    buildMypyBoto3Package "cloudtrail" "1.38.26"
+      "sha256-M1KQxsztgLZFr6TgOX0+P7eEKS3FEAm6UFoNWEnJOoc=";
 
   mypy-boto3-cloudtrail-data =
     buildMypyBoto3Package "cloudtrail-data" "1.38.0"
@@ -338,8 +338,8 @@ rec {
       "sha256-GaC5ClnSfg8/8jCv2ropPoUS7YOIhKkyicDhsYUUPwk=";
 
   mypy-boto3-connect =
-    buildMypyBoto3Package "connect" "1.38.7"
-      "sha256-Aq0JiXGaBHSN31Z72a0LL8jG25f+0dBIlIWZuCergV4=";
+    buildMypyBoto3Package "connect" "1.38.26"
+      "sha256-6Gaap6zNuKaibd/8iM9uSgryw69A0abbb8cUXtjRQ6Q=";
 
   mypy-boto3-connect-contact-lens =
     buildMypyBoto3Package "connect-contact-lens" "1.38.0"
@@ -374,16 +374,16 @@ rec {
       "sha256-du5cZjwXzIW8FP2N7e9Ob9Cm9pPlReSY65EQkfsa+bg=";
 
   mypy-boto3-dataexchange =
-    buildMypyBoto3Package "dataexchange" "1.38.0"
-      "sha256-0ys8v/ATJ7c0+MJoAiSqIBoCcgO022HB9C/Jg7vFgNc=";
+    buildMypyBoto3Package "dataexchange" "1.38.26"
+      "sha256-0S7/kVuT7nll8VsBWQg34kfeil3AVQxrFNOqDDkhjDM=";
 
   mypy-boto3-datapipeline =
     buildMypyBoto3Package "datapipeline" "1.38.0"
       "sha256-BpMkYM5+cchfhg+xJR9/cXd75fzl44rwsXXEe5ofowU=";
 
   mypy-boto3-datasync =
-    buildMypyBoto3Package "datasync" "1.38.20"
-      "sha256-/tlmBxr4MvI1YuPq5+BgHzQj2J+c1nN/C/poOxE0Xd8=";
+    buildMypyBoto3Package "datasync" "1.38.26"
+      "sha256-6QbYEYPwv26NV5rZSeQWmD2YqV0EOooDpVL0fFP0Hac=";
 
   mypy-boto3-dax =
     buildMypyBoto3Package "dax" "1.38.0"
@@ -446,8 +446,8 @@ rec {
       "sha256-RQh46jrXqj4bXTRJ+tPR9sql7yUn7Ek9u4p0OU0A7b0=";
 
   mypy-boto3-ec2 =
-    buildMypyBoto3Package "ec2" "1.38.24"
-      "sha256-QehCKooiP5jPrE6UA4OA6MJTdCczUTPsoFfDi/R13TQ=";
+    buildMypyBoto3Package "ec2" "1.38.25"
+      "sha256-rtfXRsfGr34/dUJK1kgpp85blNyHERSkScQDraIpVMs=";
 
   mypy-boto3-ec2-instance-connect =
     buildMypyBoto3Package "ec2-instance-connect" "1.38.0"
@@ -506,8 +506,8 @@ rec {
       "sha256-Lr2cpSBkWl30iIS3fc4qiOWBTbIu5L0MMW5O9Au+COM=";
 
   mypy-boto3-emr-serverless =
-    buildMypyBoto3Package "emr-serverless" "1.38.0"
-      "sha256-WxLk2ka6qnoynRbOQcXAEv84896eFOY4AYApw3c+ZlA=";
+    buildMypyBoto3Package "emr-serverless" "1.38.27"
+      "sha256-+BU0uQBQmQSxGwXalJ9A95Y8RXaFy9L6Lk8Z3D6QwkM=";
 
   mypy-boto3-entityresolution =
     buildMypyBoto3Package "entityresolution" "1.38.0"
@@ -518,8 +518,8 @@ rec {
       "sha256-u6EpWVFrrL7BCeaBdRCvY33m46fj8qQX8uNYRZfsUOI=";
 
   mypy-boto3-events =
-    buildMypyBoto3Package "events" "1.38.0"
-      "sha256-MBfgy4G5lVYXGzbs0aQK8qx3b16tmiAyq/ZTguwtbdI=";
+    buildMypyBoto3Package "events" "1.38.25"
+      "sha256-7Qy4CTzuWYTg2DF4odirHVLfwx4a1BVtJ62jcAlNDoY=";
 
   mypy-boto3-evidently =
     buildMypyBoto3Package "evidently" "1.38.0"
@@ -558,8 +558,8 @@ rec {
       "sha256-t1Pj8GSr9XDym/s1qAXaiGSGWEEttDhjBnPrB/L6Lwo=";
 
   mypy-boto3-fsx =
-    buildMypyBoto3Package "fsx" "1.38.0"
-      "sha256-lDGC5LuanclpzeDgrQ9bApm3BFzG3sANnFvchVM48UQ=";
+    buildMypyBoto3Package "fsx" "1.38.26"
+      "sha256-Njes201HxzOKDRwaxXWLp3ZjoRjEi62jYM0y2yvetWY=";
 
   mypy-boto3-gamelift =
     buildMypyBoto3Package "gamelift" "1.38.0"
@@ -702,8 +702,8 @@ rec {
       "sha256-FdGvtAvQGv9Aqho48WB/6+LYchVetmrjQ0i/GJrdvx4=";
 
   mypy-boto3-ivs-realtime =
-    buildMypyBoto3Package "ivs-realtime" "1.38.0"
-      "sha256-l8fDX2Dy1+SV0YUKs1g5AO4UcETibLAuuRFyfSpiWgo=";
+    buildMypyBoto3Package "ivs-realtime" "1.38.26"
+      "sha256-qCSBnfEsBKOLtuM986Kxul4wusWT2/+Kf/MEDWUxRf8=";
 
   mypy-boto3-ivschat =
     buildMypyBoto3Package "ivschat" "1.38.0"
@@ -938,8 +938,8 @@ rec {
       "sha256-wAV1UHqtLfNs+bh/PaWh61pT+wZU7cx3dfcjwxPR0m4=";
 
   mypy-boto3-mwaa =
-    buildMypyBoto3Package "mwaa" "1.38.0"
-      "sha256-2hV5TYKrrowbOqQZiw0DphDW2d2lFo8PYGolyqewznw=";
+    buildMypyBoto3Package "mwaa" "1.38.26"
+      "sha256-cwlTRUR7R/EBhLS5KUzLjbOxrOomGzI/jnLBHLiPDY0=";
 
   mypy-boto3-neptune =
     buildMypyBoto3Package "neptune" "1.38.18"
@@ -950,8 +950,8 @@ rec {
       "sha256-U0fMJNyZpqwYlMuqTBSZCgAtls7IuyKnjWBAJ+6rTV8=";
 
   mypy-boto3-network-firewall =
-    buildMypyBoto3Package "network-firewall" "1.38.0"
-      "sha256-Ty7z/tbUkc8Zu/YpdKrL+7ZbJoIPzVOvFKdbgrS9baY=";
+    buildMypyBoto3Package "network-firewall" "1.38.25"
+      "sha256-R2uEXo+0gtP1b76aKT9VWCKM0Uy3PulOO2T9WH2V8dM=";
 
   mypy-boto3-networkmanager =
     buildMypyBoto3Package "networkmanager" "1.38.0"
@@ -1162,8 +1162,8 @@ rec {
       "sha256-gBkjxkSmaolRcBzYEbUwRvaZpEcPSD4cmfx/mi7VPM4=";
 
   mypy-boto3-s3 =
-    buildMypyBoto3Package "s3" "1.38.0"
-      "sha256-+P5YbkUSP/zTBaDDCEcSjzkx2IhknitMWlL0Ehg8hAo=";
+    buildMypyBoto3Package "s3" "1.38.26"
+      "sha256-OKRd7leC1cB93qB+pQllxNK6fndhfBn2E7TJ+A+WG1I=";
 
   mypy-boto3-s3control =
     buildMypyBoto3Package "s3control" "1.38.14"
@@ -1174,8 +1174,8 @@ rec {
       "sha256-lBWZesgIKYnjSjUOPBhF4GNsNSk09YDSEyX0qweT3iM=";
 
   mypy-boto3-sagemaker =
-    buildMypyBoto3Package "sagemaker" "1.38.14"
-      "sha256-XKVR3rpjs3qNWapIjo28h2D5CywnrBYi8dEbkCtzRhg=";
+    buildMypyBoto3Package "sagemaker" "1.38.27"
+      "sha256-uzh49125b/AmTSUP5MtNqeahVwFpUZn7KclG2kgiCJE=";
 
   mypy-boto3-sagemaker-a2i-runtime =
     buildMypyBoto3Package "sagemaker-a2i-runtime" "1.38.0"
@@ -1346,8 +1346,8 @@ rec {
       "sha256-b6TgvxWdQI5TAI/OsJzmzlte1v30NdJucdedKgCb9LY=";
 
   mypy-boto3-synthetics =
-    buildMypyBoto3Package "synthetics" "1.38.13"
-      "sha256-goFpYJQHLzYybY8gt9FTUVXXMX+8k58YNxZ8VsNfwr4=";
+    buildMypyBoto3Package "synthetics" "1.38.25"
+      "sha256-E9+a0LjuQfyxL/b/uZpMCrvWFmX2vPS+qJNMKcc10mU=";
 
   mypy-boto3-textract =
     buildMypyBoto3Package "textract" "1.38.0"

pkgs/development/python-modules/opower/default.nix

@@ -15,7 +15,7 @@
 
 buildPythonPackage rec {
   pname = "opower";
-  version = "0.12.2";
+  version = "0.12.3";
   pyproject = true;
 
   disabled = pythonOlder "3.9";
@@ -24,7 +24,7 @@ buildPythonPackage rec {
     owner = "tronikos";
     repo = "opower";
     tag = "v${version}";
-    hash = "sha256-9qDkhhx96+Zu2yr+EWJc0m2ntNlCo0luFOr6NxWtJSw=";
+    hash = "sha256-fsZpAipBw6XLeLdum1p5gkpKSOG40TLa6cLFTUSA05Y=";
   };
 
   build-system = [ setuptools ];

pkgs/development/python-modules/pymupdf4llm/default.nix

@@ -0,0 +1,56 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  setuptools,
+  pymupdf,
+}:
+
+buildPythonPackage rec {
+  pname = "pymupdf4llm";
+  version = "0.0.17";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "pymupdf";
+    repo = "RAG";
+    tag = "v${version}";
+    hash = "sha256-+RLK+UorkU8eVQJGrc7pVNZPtIpxMgA9mBKA6GeWUa0=";
+  };
+
+  sourceRoot = "${src.name}/pymupdf4llm";
+
+  build-system = [ setuptools ];
+
+  dependencies = [ pymupdf ];
+
+  checkPhase = ''
+    runHook preCheck
+
+    python3 - <<'EOF'
+    import fitz
+    import pymupdf4llm
+
+    doc = fitz.open()
+    page = doc.new_page()
+    page.insert_text((72, 72), "Hello, Nix!")
+    doc.save("input.pdf")
+
+    md = pymupdf4llm.to_markdown("input.pdf")
+    assert isinstance(md, str), "Returned value is not a string"
+    assert "Hello, Nix!" in md, "Returned value does not contain the expected text"
+    EOF
+
+    runHook postCheck
+  '';
+
+  pythonImportsCheck = [ "pymupdf4llm" ];
+
+  meta = {
+    description = "PyMuPDF Utilities for LLM/RAG - converts PDF pages to Markdown format for Retrieval-Augmented Generation";
+    homepage = "https://github.com/pymupdf/RAG";
+    changelog = "https://github.com/pymupdf/RAG/blob/${src.tag}/CHANGES.md";
+    license = lib.licenses.agpl3Only;
+    maintainers = with lib.maintainers; [ ryota2357 ];
+  };
+}

pkgs/development/python-modules/sendgrid/default.nix

@@ -15,7 +15,7 @@
 
 buildPythonPackage rec {
   pname = "sendgrid";
-  version = "6.12.2";
+  version = "6.12.3";
   pyproject = true;
 
   disabled = pythonOlder "3.6";
@@ -24,7 +24,7 @@ buildPythonPackage rec {
     owner = pname;
     repo = "sendgrid-python";
     tag = version;
-    hash = "sha256-p9U/tno5LhcfhhZE4iPspN2Du0RA7vurqwxlZmTwavk=";
+    hash = "sha256-7j/V731e+eXFW42WRHuJpZ3OFObVXLOgl81Ww3EAApU=";
   };
 
   build-system = [ setuptools ];

pkgs/development/python-modules/tencentcloud-sdk-python/default.nix

@@ -10,7 +10,7 @@
 
 buildPythonPackage rec {
   pname = "tencentcloud-sdk-python";
-  version = "3.0.1389";
+  version = "3.0.1390";
   pyproject = true;
 
   disabled = pythonOlder "3.9";
@@ -19,7 +19,7 @@ buildPythonPackage rec {
     owner = "TencentCloud";
     repo = "tencentcloud-sdk-python";
     tag = version;
-    hash = "sha256-mLBC1ZOLO8vh5QMmG15TD07hHwBBlaRABY5ZMjKES1I=";
+    hash = "sha256-UOJ1NCWKFqcrU2uMX4qTy8ooFEy6TIrb1YTIthHspuM=";
   };
 
   build-system = [ setuptools ];

pkgs/development/python-modules/twilio/default.nix

@@ -21,7 +21,7 @@
 
 buildPythonPackage rec {
   pname = "twilio";
-  version = "9.6.1";
+  version = "9.6.2";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
@@ -30,7 +30,7 @@ buildPythonPackage rec {
     owner = "twilio";
     repo = "twilio-python";
     tag = version;
-    hash = "sha256-6prKi6gMEBA0kxY/57Uyc56Kf54tEQOlEf8nL0wivXA=";
+    hash = "sha256-W0+lRCVWrm+dieZozloePlro/pGp3ag2WBTzpJ9CXxY=";
   };
 
   build-system = [ setuptools ];

pkgs/development/python-modules/yolink-api/default.nix

@@ -12,7 +12,7 @@
 
 buildPythonPackage rec {
   pname = "yolink-api";
-  version = "0.5.2";
+  version = "0.5.4";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
@@ -21,7 +21,7 @@ buildPythonPackage rec {
     owner = "YoSmart-Inc";
     repo = "yolink-api";
     tag = "v${version}";
-    hash = "sha256-ZFEEFYCA5hBtQTe1G80wxIOF6sR+gbaqpjm9oqyyvE8=";
+    hash = "sha256-b83ozdnaZ15LMUiDJH2LPZv9D/ovV0Nx15+R6tip6Yk=";
   };
 
   build-system = [ setuptools ];

pkgs/os-specific/linux/kernel/kernels-org.json

@@ -24,16 +24,16 @@
         "hash": "sha256:1v1pq9yzxrlaxx4y4cj5q3wska0jbv2inc7phqfw70fj88kai0hx"
     },
     "6.12": {
-        "version": "6.12.30",
-        "hash": "sha256:0bpqkh64bj6nslbb43hj28lxmrxinrapwgh05q5wwh0yjx46l16z"
+        "version": "6.12.31",
+        "hash": "sha256:19sba8zak31gn89pzfa3kb9rv7y9z8kybvyikigamq7nblz5nk5h"
     },
     "6.13": {
         "version": "6.13.12",
         "hash": "sha256:0hhj49k3ksjcp0dg5yiahqzryjfdpr9c1a9ph6j9slzmkikbn7v1"
     },
     "6.14": {
-        "version": "6.14.8",
-        "hash": "sha256:0199maj3mk577wwaszbi0cl5a0afx1ynad896bmmg8vm636jxcb2"
+        "version": "6.14.9",
+        "hash": "sha256:0qgkr69745al6nf4wicxq284xnsmxybh29r7hjh2b6bi6bhds31r"
     },
     "6.15": {
         "version": "6.15",

pkgs/tools/security/trufflehog/default.nix

@@ -8,16 +8,16 @@
 
 buildGoModule rec {
   pname = "trufflehog";
-  version = "3.88.33";
+  version = "3.88.35";
 
   src = fetchFromGitHub {
     owner = "trufflesecurity";
     repo = "trufflehog";
     tag = "v${version}";
-    hash = "sha256-cliUjSMH36XhV0VLHqTcZa2xBbgRqFl2kczl4AmVEwU=";
+    hash = "sha256-x83lA3VWrs3PfGjprqTqt12JtSs2wgqThNNVGviLddI=";
   };
 
-  vendorHash = "sha256-sF7+2IrVlGskoQjVYrnmFC7KSNSh0fl3BErSMJESrcA=";
+  vendorHash = "sha256-i7yS/+HQa8gOWhkWzyop3IObOwkjpzmzyqBlp9dSV3Y=";
 
   nativeBuildInputs = [ makeWrapper ];
 

pkgs/top-level/aliases.nix

@@ -237,6 +237,7 @@ mapAliases {
   adminer-pematon = adminneo; # Added 2025-02-20
   adminerneo = adminneo; # Added 2025-02-27
   adtool = throw "'adtool' has been removed, as it was broken and unmaintained";
+  adobe-reader = throw "'adobe-reader' has been removed, as it was broken, outdated and insecure"; # added 2025-05-31
   adom = throw "'adom' has been removed, as it was broken and unmaintained"; # added 2024-05-09
   adoptopenjdk-bin = throw "adoptopenjdk has been removed as the upstream project is deprecated. Consider using `temurin-bin`"; # Added 2024-05-09
   adoptopenjdk-bin-17-packages-darwin = throw "adoptopenjdk has been removed as the upstream project is deprecated. Consider using `temurin-bin-17`."; # Added 2024-05-09
@@ -318,6 +319,7 @@ mapAliases {
   authy = throw "'authy' has been removed since it reached end of life"; # Added 2024-04-19
   autoadb = throw "'autoadb' has been removed due to lack of maintenance upstream"; # Added 2025-01-25
   avldrums-lv2 = throw "'avldrums-lv2' has been renamed to/replaced by 'x42-avldrums'"; # Converted to throw 2024-10-17
+  avr-sim = throw "'avr-sim' has been removed as it was broken and unmaintained. Possible alternatives are 'simavr', SimulAVR and AVRStudio."; # Added 2025-05-31
   avrlibcCross = avrlibc; # Added 2024-09-06
   axmldec = throw "'axmldec' has been removed as it was broken and unmaintained for 8 years"; # Added 2025-05-17
   awesome-4-0 = awesome; # Added 2022-05-05

pkgs/top-level/all-packages.nix

@@ -8135,8 +8135,6 @@ with pkgs;
   gecode_6 = qt5.callPackage ../development/libraries/gecode { };
   gecode = gecode_6;
 
-  geph = recurseIntoAttrs (callPackages ../applications/networking/geph { pnpm = pnpm_8; });
-
   gegl = callPackage ../development/libraries/gegl {
     openexr = openexr_2;
   };
@@ -11933,8 +11931,6 @@ with pkgs;
 
   activitywatch = callPackage ../applications/office/activitywatch/wrapper.nix { };
 
-  adobe-reader = pkgsi686Linux.callPackage ../applications/misc/adobe-reader { };
-
   anilibria-winmaclinux = libsForQt5.callPackage ../applications/video/anilibria-winmaclinux { };
 
   masterpdfeditor4 = libsForQt5.callPackage ../applications/misc/masterpdfeditor4 { };
@@ -13012,7 +13008,7 @@ with pkgs;
     k3s_1_32
     k3s_1_33
     ;
-  k3s = k3s_1_32;
+  k3s = k3s_1_33;
 
   kapow = libsForQt5.callPackage ../applications/misc/kapow { };
 

pkgs/top-level/python-packages.nix

@@ -12916,6 +12916,8 @@ self: super: with self; {
 
   pymupdf-fonts = callPackage ../development/python-modules/pymupdf-fonts { };
 
+  pymupdf4llm = callPackage ../development/python-modules/pymupdf4llm { };
+
   pymvglive = callPackage ../development/python-modules/pymvglive { };
 
   pymysensors = callPackage ../development/python-modules/pymysensors { };