Merge staging-next into staging

doc/release-notes/rl-2511.section.md

@@ -61,6 +61,8 @@
 
 - `lima` package now only includes the guest agent for the host's architecture by default. If your guest VM's architecture differs from your Lima host's, you'll need to enable the `lima-additional-guestagents` package by setting `withAdditionalGuestAgents = true` when overriding lima with this input.
 
+- `mongodb-6_0` was removed as it is end of life as of 2025-07-31.
+
 - `vmware-horizon-client` was renamed to `omnissa-horizon-client`, following [VMware's sale of their end-user business to Omnissa](https://www.omnissa.com/insights/introducing-omnissa-the-former-vmware-end-user-computing-business/). The binary has been renamed from `vmware-view` to `horizon-client`.
 
 - `neovimUtils.makeNeovimConfig` now uses `customLuaRC` parameter instead of accepting `luaRcContent`. The old usage is deprecated but still works with a warning.

maintainers/maintainer-list.nix

@@ -11809,6 +11809,11 @@
     name = "Jez Cope";
     keys = [ { fingerprint = "D9DA 3E47 E8BD 377D A317  B3D0 9E42 CE07 1C45 59D1"; } ];
   };
+  jf-uu = {
+    github = "jf-uu";
+    githubId = 181011550;
+    name = "jf-uu";
+  };
   jfchevrette = {
     email = "jfchevrette@gmail.com";
     github = "jfchevrette";

nixos/doc/manual/release-notes/rl-2511.section.md

@@ -16,6 +16,8 @@
 
 <!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->
 
+- [Overseerr](https://overseerr.dev), a request management and media discovery tool for the Plex ecosystem. Available as [services.overseerr](#opt-services.overseerr.enable).
+
 - [gtklock](https://github.com/jovanlanik/gtklock), a GTK-based lockscreen for Wayland. Available as [programs.gtklock](#opt-programs.gtklock.enable).
 - [Chrysalis](https://github.com/keyboardio/Chrysalis), a graphical configurator for Kaleidoscope-powered keyboards. Available as [programs.chrysalis](#opt-programs.chrysalis.enable).
 

nixos/lib/make-options-doc/default.nix

@@ -59,9 +59,6 @@
   let
     # Evaluate a NixOS configuration
     eval = import (pkgs.path + "/nixos/lib/eval-config.nix") {
-      # Overridden explicitly here, this would include all modules from NixOS otherwise.
-      # See: docs of eval-config.nix for more details
-      baseModules = [];
       modules = [
         ./module.nix
       ];

nixos/modules/module-list.nix

@@ -886,6 +886,7 @@
   ./services/misc/open-webui.nix
   ./services/misc/orthanc.nix
   ./services/misc/osrm.nix
+  ./services/misc/overseerr.nix
   ./services/misc/owncast.nix
   ./services/misc/packagekit.nix
   ./services/misc/paisa.nix

nixos/modules/services/misc/overseerr.nix

@@ -0,0 +1,89 @@
+{
+  config,
+  pkgs,
+  lib,
+  ...
+}:
+
+let
+  cfg = config.services.overseerr;
+in
+{
+  meta.maintainers = [ lib.maintainers.jf-uu ];
+
+  options.services.overseerr = {
+    enable = lib.mkEnableOption "Overseerr, a request management and media discovery tool for the Plex ecosystem";
+
+    package = lib.mkPackageOption pkgs "overseerr" { };
+
+    openFirewall = lib.mkOption {
+      type = lib.types.bool;
+      default = false;
+      description = "Open a port in the firewall for the Overseerr web interface.";
+    };
+
+    port = lib.mkOption {
+      type = lib.types.port;
+      default = 5055;
+      description = "The port which the Overseerr web UI should listen on.";
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    systemd.services.overseerr = {
+      description = "Request management and media discovery tool for the Plex ecosystem";
+      after = [ "network.target" ];
+      wantedBy = [ "multi-user.target" ];
+      environment = {
+        CONFIG_DIRECTORY = "/var/lib/overseerr";
+        PORT = toString cfg.port;
+      };
+      serviceConfig = {
+        CapabilityBoundingSet = "";
+        DynamicUser = true;
+        ExecStart = lib.getExe cfg.package;
+        LockPersonality = true;
+        NoNewPrivileges = true;
+        PrivateDevices = true;
+        PrivateIPC = true;
+        PrivateMounts = true;
+        PrivateTmp = true;
+        PrivateUsers = true;
+        ProcSubset = "pid";
+        ProtectClock = true;
+        ProtectControlGroups = true;
+        ProtectHome = true;
+        ProtectHostname = true;
+        ProtectKernelLogs = true;
+        ProtectKernelModules = true;
+        ProtectKernelTunables = true;
+        ProtectProc = "invisible";
+        ProtectSystem = "strict";
+        RemoveIPC = true;
+        Restart = "on-failure";
+        RestrictAddressFamilies = [
+          "AF_INET"
+          "AF_INET6"
+          "AF_UNIX"
+        ];
+        RestrictNamespaces = true;
+        RestrictRealtime = true;
+        RestrictSUIDSGID = true;
+        StateDirectory = "overseerr";
+        StateDirectoryMode = "0700";
+        SystemCallArchitectures = "native";
+        SystemCallErrorNumber = "EPERM";
+        SystemCallFilter = [
+          "@system-service"
+          "~@privileged"
+          "~@resources"
+        ];
+        Type = "exec";
+      };
+    };
+
+    networking.firewall = lib.mkIf cfg.openFirewall {
+      allowedTCPPorts = [ cfg.port ];
+    };
+  };
+}

nixos/tests/all-tests.nix

@@ -712,6 +712,7 @@ in
   };
   oku = runTest ./oku.nix;
   oncall = runTest ./web-apps/oncall.nix;
+  overseerr = runTest ./overseerr.nix;
   # 9pnet_virtio used to mount /nix partition doesn't support
   # hibernation. This test happens to work on x86_64-linux but
   # not on other platforms.

nixos/tests/mitmproxy.nix

@@ -71,6 +71,7 @@ in
         [
           counter
           pkgs.mitmproxy
+          pkgs.mitmproxy2swagger
         ];
     };
 
@@ -130,5 +131,17 @@ in
       machine.succeed("mitmdump -C /root/replay")
 
       t.assertEqual("2", curl("http://localhost:8000/counter"))
+
+      # create a OpenAPI 3.0 spec from captured flow
+      # https://github.com/alufers/mitmproxy2swagger
+
+      # create a initial spec
+      machine.succeed("mitmproxy2swagger -i /root/replay -f flow -o /root/spec -p http://localhost:8000")
+      # don't ignore any endpoint
+      machine.succeed("sed -i -e 's/- ignore:/- /' /root/spec")
+      # generate the actual spec
+      machine.succeed("mitmproxy2swagger -i /root/replay -f flow -o /root/spec -p http://localhost:8000")
+      # check for endpoint /counter
+      machine.succeed("grep '/counter:' /root/spec")
     '';
 }

nixos/tests/overseerr.nix

@@ -0,0 +1,20 @@
+{ lib, pkgs, ... }:
+{
+  name = "overseerr";
+  meta.maintainers = with lib.maintainers; [ jf-uu ];
+
+  nodes.machine =
+    { pkgs, ... }:
+    {
+      environment.systemPackages = [ pkgs.jq ];
+      services.overseerr.enable = true;
+    };
+
+  testScript = ''
+    machine.wait_for_unit("overseerr.service")
+    machine.wait_for_open_port(5055)
+
+    version = machine.succeed("curl --fail http://localhost:5055/api/v1/status | jq --raw-output .version").rstrip("\n")
+    assert version == "${pkgs.overseerr.version}", f"expected version to be ${pkgs.overseerr.version}, got {version}"
+  '';
+}

pkgs/applications/editors/emacs/elisp-packages/manual-packages.nix

@@ -15,6 +15,10 @@ lib.packagesFromDirectoryRecursive {
     inherit (pkgs) codeium;
   };
 
+  eaf-browser = callPackage ./manual-packages/eaf-browser {
+    inherit (pkgs) aria2;
+  };
+
   elpaca = callPackage ./manual-packages/elpaca { inherit (pkgs) git; };
 
   emacs-application-framework = callPackage ./manual-packages/emacs-application-framework {

pkgs/applications/editors/emacs/elisp-packages/manual-packages/eaf-browser/default.nix

@@ -0,0 +1,71 @@
+{
+  # Basic
+  lib,
+  melpaBuild,
+  fetchFromGitHub,
+  # Dependencies
+  aria2,
+  # Java Script dependency
+  nodejs,
+  fetchNpmDeps,
+  npmHooks,
+  # Updater
+  nix-update-script,
+}:
+
+melpaBuild (finalAttrs: {
+
+  pname = "eaf-browser";
+  version = "0-unstable-2025-06-14";
+
+  src = fetchFromGitHub {
+    owner = "emacs-eaf";
+    repo = "eaf-browser";
+    rev = "120967319132f361a2b27f89ee54d1984aa23eaf";
+    hash = "sha256-DsPrctB1bSGBPQLI2LsnSUtqnzWpZRrWrVZM8lS9fms=";
+  };
+
+  env.npmDeps = fetchNpmDeps {
+    name = "${finalAttrs.pname}-npm-deps";
+    inherit (finalAttrs) src;
+    hash = "sha256-UfQL7rN47nI1FyhgBlzH4QtyVCn0wGV3Rv5Y+aidRNE=";
+  };
+
+  nativeBuildInputs = [
+    nodejs
+    npmHooks.npmConfigHook
+  ];
+
+  files = ''
+    ("*.el"
+     "*.py"
+     "easylist.txt"
+     "aria2-ng")
+  '';
+
+  postInstall = ''
+    LISPDIR=$out/share/emacs/site-lisp/elpa/${finalAttrs.ename}-${finalAttrs.melpaVersion}
+    cp -r node_modules $LISPDIR/
+  '';
+
+  passthru = {
+    updateScript = nix-update-script { extraArgs = [ "--version=branch" ]; };
+    eafPythonDeps =
+      ps: with ps; [
+        pysocks
+      ];
+    eafOtherDeps = [
+      aria2
+    ];
+  };
+
+  meta = {
+    description = "Modern browser in Emacs";
+    homepage = "https://github.com/emacs-eaf/eaf-browser";
+    license = lib.licenses.gpl3Only;
+    maintainers = with lib.maintainers; [
+      thattemperature
+    ];
+  };
+
+})

pkgs/applications/networking/browsers/chromium/info.json

@@ -1,10 +1,10 @@
 {
   "chromium": {
-    "version": "139.0.7258.66",
+    "version": "139.0.7258.127",
     "chromedriver": {
-      "version": "139.0.7258.67",
-      "hash_darwin": "sha256-kWrlkFZ1X0n7h5GtnfZnKbT1zylVuaSCDMJA549LoEY=",
-      "hash_darwin_aarch64": "sha256-HWgR2CWj5/N2zPIIHXBnA1DoYe0+KAmScopNfMcYlzc="
+      "version": "139.0.7258.128",
+      "hash_darwin": "sha256-QHYwd9B47p3/Y3z/TYaUpNbCBenUrI7yXVsMUwtnifg=",
+      "hash_darwin_aarch64": "sha256-rwMRpEW+sQ6u/Y0rJWGw7UICfjZO8WQddOfzpqwcsnY="
     },
     "deps": {
       "depot_tools": {
@@ -21,8 +21,8 @@
     "DEPS": {
       "src": {
         "url": "https://chromium.googlesource.com/chromium/src.git",
-        "rev": "a62d329947691f76c376a873eae39f56381103c8",
-        "hash": "sha256-RWqOw0Kogz2GwbICet7NdcGnZMrkkE4bu70jU+tbYFQ=",
+        "rev": "5dc2cf9cf870d324cd9fba708f26d2572cc6d4d8",
+        "hash": "sha256-YcOVErOKKruc3kPuXhmeibo3KL+Rrny1FEwF769+aEU=",
         "recompress": true
       },
       "src/third_party/clang-format/script": {
@@ -97,8 +97,8 @@
       },
       "src/third_party/angle": {
         "url": "https://chromium.googlesource.com/angle/angle.git",
-        "rev": "0145c376fadde16390298681252785f98ae90185",
-        "hash": "sha256-8ztvupTvp5v8lTq3eo/viR9X85qm+bw8299jxr6XslE="
+        "rev": "5f3636345f1d8afd495e2fcc474fd81e91c4866b",
+        "hash": "sha256-fx+QD0T85Js9jPQx2aghJU8UOL6WbR0bOkGY2i87A3w="
       },
       "src/third_party/angle/third_party/glmark2/src": {
         "url": "https://chromium.googlesource.com/external/github.com/glmark2/glmark2",
@@ -402,8 +402,8 @@
       },
       "src/third_party/libaom/source/libaom": {
         "url": "https://aomedia.googlesource.com/aom.git",
-        "rev": "0ddc6630b3723b14b164752d46c27752f078ddd3",
-        "hash": "sha256-cs1+5vBEFPqzi1vbxiSgujrLIoaXZROZaRJq2gRdUrE="
+        "rev": "90c632fc6c01cd8637186c783ca8012bab3c3260",
+        "hash": "sha256-e+rUkNOakv6WQrgx1ozoJTynk/GZy1zdsnYX4oz+6ks="
       },
       "src/third_party/crabbyavif/src": {
         "url": "https://chromium.googlesource.com/external/github.com/webmproject/CrabbyAvif.git",
@@ -632,8 +632,8 @@
       },
       "src/third_party/skia": {
         "url": "https://skia.googlesource.com/skia.git",
-        "rev": "cbc694239b06ecf694676aba22d5263dbc23ee5e",
-        "hash": "sha256-5vIwNP9RbtUVtgKKDiZd6NVkR2Ed3DUqZWESTUM+fIs="
+        "rev": "2d6f1aa4be9c33b013c322b2bc9cd99a682243b6",
+        "hash": "sha256-VysJkpCRRYNdCStnXvo6wyMCv1gLHecMwefKiwypARc="
       },
       "src/third_party/smhasher/src": {
         "url": "https://chromium.googlesource.com/external/smhasher.git",
@@ -797,8 +797,8 @@
       },
       "src/v8": {
         "url": "https://chromium.googlesource.com/v8/v8.git",
-        "rev": "b07b4e9376489c7f7c0ff2af5eceb4261b3bb784",
-        "hash": "sha256-MnrieVgkvlkWKZ0O790gDSCrgF9c+XEk/XLHQDzMqVY="
+        "rev": "505ec917b67c535519bebec58c62a34f145dd49f",
+        "hash": "sha256-fsf8j2Spe++vSnuO8763eWWmMhYqcyybpILb7OkkXq4="
       }
     }
   },

pkgs/by-name/_3/_3cpio/package.nix

@@ -0,0 +1,35 @@
+{
+  fetchFromGitHub,
+  lib,
+  lz4,
+  lzop,
+  nix-update-script,
+  rustPlatform,
+}:
+
+rustPlatform.buildRustPackage rec {
+  pname = "3cpio";
+  version = "0.8.0";
+
+  src = fetchFromGitHub {
+    owner = "bdrung";
+    repo = "3cpio";
+    tag = version;
+    hash = "sha256-1kdJSwe9v7ojdukj04/G/RDeEk0NVCXmiNoVaelqt4Y=";
+  };
+
+  cargoHash = "sha256-axPghG1T5NZYzGRZBwtdBJ5tQh+h8/vep/EmL5ADCjE=";
+
+  # Tests attempt to access arbitrary filepaths
+  doCheck = false;
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "Manage initrd cpio archives";
+    homepage = "https://github.com/bdrung/3cpio";
+    license = lib.licenses.isc;
+    maintainers = [ lib.maintainers.jmbaur ];
+    mainProgram = "3cpio";
+  };
+}

pkgs/by-name/an/angular-language-server/package.nix

@@ -16,11 +16,11 @@
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "angular-language-server";
-  version = "20.1.1";
+  version = "20.2.1";
   src = fetchurl {
     name = "angular-language-server-${finalAttrs.version}.zip";
     url = "https://github.com/angular/vscode-ng-language-service/releases/download/v${finalAttrs.version}/ng-template.vsix";
-    hash = "sha256-fcJXyuGow39uep6Giexft+3a/nnoJSsKdwjtAQKTMj0=";
+    hash = "sha256-oemc2lJDPsWWG+tcJAk8u5lSGUpIoI6K/fE/TZC5bWw=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/bi/bitrise/package.nix

@@ -6,13 +6,13 @@
 }:
 buildGoModule rec {
   pname = "bitrise";
-  version = "2.32.1";
+  version = "2.33.0";
 
   src = fetchFromGitHub {
     owner = "bitrise-io";
     repo = "bitrise";
     rev = "v${version}";
-    hash = "sha256-IAuOqL5S9X003OtM9I0gtIIS+NI9snGcM55OPCtQWik=";
+    hash = "sha256-MpXJQHmpE9s3GYpqyrWCTBIzMCdb+nBAw+2DXmnK3Lw=";
   };
 
   # many tests rely on writable $HOME/.bitrise and require network access

pkgs/by-name/ci/cinny-unwrapped/package.nix

@@ -13,16 +13,16 @@
 
 buildNpmPackage rec {
   pname = "cinny-unwrapped";
-  version = "4.8.1";
+  version = "4.9.0";
 
   src = fetchFromGitHub {
     owner = "cinnyapp";
     repo = "cinny";
     tag = "v${version}";
-    hash = "sha256-1F49KHAfCtvcqMeRYI8r6Ke7oz+EQqOfkgdgn5E1DU4=";
+    hash = "sha256-tvBaONJwfkCK77aHmWJ/UAAZHq2WIc7geNT2tEFKuZ0=";
   };
 
-  npmDepsHash = "sha256-Tx+08NrbFolI7agC6AtNvkOgCJWJa4fsY0CFC02h4r0=";
+  npmDepsHash = "sha256-9faffTlXEI1lMrVrkSyso/tfjs/4W+TVzmiv+bZAv18=";
 
   nativeBuildInputs = [
     python3

pkgs/by-name/co/codebook/package.nix

@@ -7,17 +7,17 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "codebook";
-  version = "0.3.6";
+  version = "0.3.8";
 
   src = fetchFromGitHub {
     owner = "blopker";
     repo = "codebook";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-zSxMvWRpH1AtvHo/odQZftxgAMdOd8p2ZiMUcsOWhes=";
+    hash = "sha256-1ZjR3nUWpeglTTTtXdvbmMGK7SW517cQIu6IQ63a8Wc=";
   };
 
   buildAndTestSubdir = "crates/codebook-lsp";
-  cargoHash = "sha256-FS8ZEjFFoNCJGkfL8C5hBgwj9o9XT239/9Qh/Xea2wk=";
+  cargoHash = "sha256-fwI+k9m5ptGb1KQ+mxsAmwlPhQwWSo5HGM0XeWlFHTI=";
 
   # Integration tests require internet access for dictionaries
   doCheck = false;

pkgs/by-name/co/colima/package.nix

@@ -14,13 +14,13 @@
 
 buildGoModule rec {
   pname = "colima";
-  version = "0.8.1";
+  version = "0.8.4";
 
   src = fetchFromGitHub {
     owner = "abiosoft";
     repo = "colima";
     tag = "v${version}";
-    hash = "sha256-RQnHqEabxyoAKr8BfmVhk8z+l5oy8pa5JPTWk/0FV5g=";
+    hash = "sha256-TNq0lHNF6jwUqamJXYTxuF0Q9mfVwi8BaesQv87eRiE=";
     # We need the git revision
     leaveDotGit = true;
     postFetch = ''
@@ -35,7 +35,7 @@ buildGoModule rec {
   ]
   ++ lib.optionals stdenv.hostPlatform.isDarwin [ darwin.DarwinTools ];
 
-  vendorHash = "sha256-rqCPpO/Va31U++sfELcN1X6oDtDiCXoGj0RHKZUM6rY=";
+  vendorHash = "sha256-ZwgzKCOEhgKK2LNRLjnWP6qHI4f6OGORvt3CREJf55I=";
 
   # disable flaky Test_extractZones
   # https://hydra.nixos.org/build/212378003/log

pkgs/by-name/do/dolibarr/package.nix

@@ -8,13 +8,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "dolibarr";
-  version = "21.0.2";
+  version = "22.0.0";
 
   src = fetchFromGitHub {
     owner = "Dolibarr";
     repo = "dolibarr";
     tag = finalAttrs.version;
-    hash = "sha256-H1p20dDe7YDFFk0hwyNvJ7LG9/3FF7JPo322Cgb0gYo=";
+    hash = "sha256-NEE/ZKfkJLW360ioffzBOPJIkxrV0a2F4CFEPZPbivA=";
   };
 
   dontBuild = true;

pkgs/by-name/dr/dropbear/package.nix

@@ -32,6 +32,11 @@ stdenv.mkDerivation rec {
     (lib.concatStringsSep " ")
   ];
 
+  configureFlags = lib.optionals stdenv.hostPlatform.isMusl [
+    "--enable-wtmp=no"
+    "--enable-wtmpx=no"
+  ];
+
   # https://www.gnu.org/software/make/manual/html_node/Libraries_002fSearch.html
   preConfigure = ''
     makeFlagsArray=(

pkgs/by-name/fl/flexoptix-app/allow-no-secret-manager.patch

@@ -0,0 +1,9 @@
+--- app/node_modules/rme-electron/main/fo-storage/models/fo-storage-file.js
++++ app/node_modules/rme-electron/main/fo-storage/models/fo-storage-file.js
+@@ -25,6 +25,7 @@
+		if (!this.#isPlainObject(initialContent)) {
+			throw new Error("Content must be a plain object");
+		}
++		safeStorage.setUsePlainTextEncryption(true);
+		this.#content = initialContent;
+	}

pkgs/by-name/fl/flexoptix-app/disable-autoupdate.patch

@@ -1,16 +1,12 @@
---- app/electron/jsComponents/mainWindowEvents.js	2024-02-18 12:53:41.115773007 -0500
-+++ app/electron/jsComponents/mainWindowEvents.js2	2024-02-18 23:22:20.003280203 -0500
-@@ -128,7 +128,12 @@
- 
- 	if (app.isPackaged) {
- 		global.mainWindow.webContents.once("did-finish-load", function () {
--			autoUpdater.checkForUpdates();
-+			global.mainWindow.loadURL(
-+				url.format({
-+					...global.APPLICATION_URL_OBJECT,
-+					slashes: true,
-+				}),
-+			);
- 		});
- 	} else {
- 		global.mainWindow.webContents.openDevTools();
+--- app/node_modules/electron-updater/out/AppUpdater.js
++++ app/node_modules/electron-updater/out/AppUpdater.js
+@@ -211,6 +211,9 @@
+      * Asks the server whether there is an update.
+      */
+     checkForUpdates() {
++        this.emit("update-not-available", null);
++        return true;
++
+         if (!this.isUpdaterActive()) {
+             return Promise.resolve(null);
+         }

pkgs/by-name/fl/flexoptix-app/package.nix

@@ -3,29 +3,42 @@
   appimageTools,
   fetchurl,
   asar,
+  python3,
 }:
 let
   pname = "flexoptix-app";
-  version = "5.21.2-latest";
+  version = "5.48.0-latest";
 
   src = fetchurl {
     name = "${pname}-${version}.AppImage";
     url = "https://flexbox.reconfigure.me/download/electron/linux/x64/FLEXOPTIX%20App.${version}.AppImage";
-    hash = "sha256-BnNRwD09CE1EZDg3Hn3khN4FZ8Hj5LLAunk+NKU5BJo=";
+    hash = "sha256-VSGfExus+4dDef6V1ZEATMBVCIb0JS459+yolx5sg3c=";
   };
 
   udevRules = fetchurl {
     url = "https://www.flexoptix.net/static/frontend/Flexoptix/default/en_US/files/99-tprogrammer.rules";
-    hash = "sha256-faowRYdrk88WUpOpaEfedzybBgxVRZhvAaYP9HAuzAE=";
+    hash = "sha256-/1ZtJT+1IMyYqw3N0bVJ/T3vbmex169lzx+SlY5WsnA=";
   };
 
   appimageContents = (appimageTools.extract { inherit pname version src; }).overrideAttrs (oA: {
     buildCommand = ''
       ${oA.buildCommand}
 
-      # Get rid of the autoupdater
+      # Remove left-over node-gyp executable symlinks
+      # https://github.com/nodejs/node-gyp/issues/2713
+      find $out/ -type l -name python3 -exec ln -sf ${python3.interpreter} {} \;
+
+      # Extract app to make it patchable
       ${asar}/bin/asar extract $out/resources/app.asar app
+
+      # Fix app crash when none of these secret managers is available: https://www.electronjs.org/docs/latest/api/safe-storage#safestoragegetselectedstoragebackend-linux
+      patch -p0 < ${./allow-no-secret-manager.patch}
+      # Get rid of the autoupdater
       patch -p0 < ${./disable-autoupdate.patch}
+
+      # Makes debugging easier: cp -r app $out/_app
+
+      # Repackage
       ${asar}/bin/asar pack app $out/resources/app.asar
     '';
   });
@@ -42,7 +55,10 @@ appimageTools.wrapAppImage {
     install -Dm444 ${appimageContents}/flexoptix-app.desktop -t $out/share/applications
     install -Dm444 ${appimageContents}/flexoptix-app.png -t $out/share/pixmaps
     substituteInPlace $out/share/applications/flexoptix-app.desktop \
-      --replace 'Exec=AppRun' "Exec=$out/bin/${pname} --"
+      --replace-fail 'Exec=AppRun' "Exec=$out/bin/${pname} --"
+
+    # For debugging
+    [[ -e ${appimageContents}/_app ]] && ln -s ${appimageContents}/_app $out
 
     # Add udev rules
     mkdir -p $out/lib/udev/rules.d

pkgs/by-name/fr/freetube/package.nix

@@ -20,13 +20,13 @@ let
 in
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "freetube";
-  version = "0.23.5";
+  version = "0.23.6";
 
   src = fetchFromGitHub {
     owner = "FreeTubeApp";
     repo = "FreeTube";
     tag = "v${finalAttrs.version}-beta";
-    hash = "sha256-tVe//h20cTVgpHeo3IlfGfuAH+dM6H5MEfGny5Uhrjk=";
+    hash = "sha256-Z1L45RHlmylfqKBY37PC5TQ3ubOgH0AHFGM7VkmtkZ0=";
   };
 
   # Darwin requires writable Electron dist
@@ -49,7 +49,7 @@ stdenvNoCC.mkDerivation (finalAttrs: {
 
   yarnOfflineCache = fetchYarnDeps {
     yarnLock = "${finalAttrs.src}/yarn.lock";
-    hash = "sha256-F1YcdshWGRCO7kHsCK0Ejs0aMR7BFXd5M9ITdRVcpbk=";
+    hash = "sha256-ia5wLRt3Hmo4/dsB1/rhGWGJ7LMnVR9ju9lSlQZDTTg=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/ha/harbor-cli/package.nix

@@ -9,16 +9,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "harbor-cli";
-  version = "0.0.8";
+  version = "0.0.9";
 
   src = fetchFromGitHub {
     owner = "goharbor";
     repo = "harbor-cli";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-7Fi4FeWsLwTtNZhD8TfSBTMr/LKzUm6UO4aWC0eJFtQ=";
+    hash = "sha256-3LgFhSG/k4cnpxiYaXTPr52n1cntIG2qfLkYaOyaqGw=";
   };
 
-  vendorHash = "sha256-gkPMyDX5CO7j6JX3AUNw9o/HApRwLHAd8mD25rq96Lk=";
+  vendorHash = "sha256-QnKSzWa/XTrA83d/DXcS5PE59CL4wD2sISNDV5pBIfM=";
 
   excludedPackages = [
     "dagger"

pkgs/by-name/hi/high-tide/package.nix

@@ -18,14 +18,14 @@
 
 python313Packages.buildPythonApplication rec {
   pname = "high-tide";
-  version = "0.1.7";
+  version = "0.1.8";
   pyproject = false;
 
   src = fetchFromGitHub {
     owner = "Nokse22";
     repo = "high-tide";
     tag = "v${version}";
-    hash = "sha256-QFa9K/iSPe3cIx90PzPCkJszrygON9ijukv4px3Rob8=";
+    hash = "sha256-QcTK5E8rz/JcC40CCCK8G7PUZ6UAg53UPmxyLBXNHxY=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/ka/kanboard/package.nix

@@ -9,13 +9,13 @@
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "kanboard";
-  version = "1.2.46";
+  version = "1.2.47";
 
   src = fetchFromGitHub {
     owner = "kanboard";
     repo = "kanboard";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-IYnlBNa4f+ZpOttQHlIZi8wsZYJuB/kWWLwhQK8vdQY=";
+    hash = "sha256-LedK1Ct4xz88r4gvN2jxOE/7Yg6rnrnjCHdhmn3tun4=";
   };
 
   dontBuild = true;

pkgs/by-name/li/lint-staged/package.nix

@@ -8,16 +8,16 @@
 
 buildNpmPackage rec {
   pname = "lint-staged";
-  version = "16.1.3";
+  version = "16.1.5";
 
   src = fetchFromGitHub {
     owner = "okonet";
     repo = "lint-staged";
     rev = "v${version}";
-    hash = "sha256-Aviq2FJBA2R2w8WkvafD7uwM6RxBNCbiawqrvy/VyEw=";
+    hash = "sha256-XXNBKxlHfyQXHyaWFrgFmEHmcxhodco1p44i9SjXgo4=";
   };
 
-  npmDepsHash = "sha256-l/t/TS7Yj2ti35mL0Ol3mug0I87Xtcx+RCv8Z6hK7AY=";
+  npmDepsHash = "sha256-edBeGkkkcHR4FC+zF3W+NbguEGfU2qCJ1hYwdTMTLA0=";
 
   dontNpmBuild = true;
 

pkgs/by-name/ma/manifold/package.nix

@@ -12,13 +12,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "manifold";
-  version = "3.2.0";
+  version = "3.2.1";
 
   src = fetchFromGitHub {
     owner = "elalish";
     repo = "manifold";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-tcEjgOU90tYnlZDedHJvnqWFDDtXGx64G80wnWz4lBI=";
+    hash = "sha256-d/e4SKwfKqvLZgQu/Gfwsym9/XqEqQr7fWNSyLtCxzs=";
   };
 
   nativeBuildInputs = [ cmake ];

pkgs/by-name/mo/modsecurity_standalone/package.nix

@@ -13,7 +13,6 @@
   luaSupport ? false,
   lua5,
   perl,
-  fetchpatch,
   versionCheckHook,
 }:
 
@@ -24,13 +23,13 @@ in
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "modsecurity";
-  version = "2.9.8";
+  version = "2.9.12";
 
   src = fetchFromGitHub {
     owner = "owasp-modsecurity";
     repo = "modsecurity";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-fJ5XeO5m5LlImAuzIvXVVWkc9awbaRI3NWWOOwGrshI=";
+    hash = "sha256-scMOiu8oI3+VcXe05gLNQ8ILmnP4iwls8ZZ9r+3ei5Y=";
   };
 
   nativeBuildInputs = [
@@ -61,11 +60,6 @@ stdenv.mkDerivation (finalAttrs: {
 
   enableParallelBuilding = true;
 
-  env.NIX_CFLAGS_COMPILE = toString [
-    # msc_test.c:86:5: error: initialization of 'int' from 'void *' makes integer from pointer without a cast []
-    "-Wno-error=int-conversion"
-  ];
-
   outputs = [
     "out"
     "nginx"
@@ -74,24 +68,6 @@ stdenv.mkDerivation (finalAttrs: {
     # by default modsecurity's install script copies compiled output to httpd's modules folder
     # this patch removes those lines
     ./Makefile.am.patch
-    # remove when 2.9.9 is released
-    (fetchpatch {
-      name = "move-id_log";
-      url = "https://github.com/owasp-modsecurity/ModSecurity/commit/149376377ecef9ecc36ee81d5b666fc0ac7e249b.patch";
-      hash = "sha256-KjQGqSBt/u9zPZY1aSIupnYHleJbsOAOk3Y2bNOyRxk=";
-    })
-    # remove when 2.9.9 is released
-    (fetchpatch {
-      name = "gcc-format-security";
-      url = "https://github.com/owasp-modsecurity/ModSecurity/commit/cddd9a7eb5585a9b3be1f9bdcadcace8f60f5808.patch";
-      hash = "sha256-H1wkZQ5bTQIRhlEvvvj7YCBi9qndRgHgKTnE9Cusq3I=";
-    })
-    # remove when 2.9.9 is released
-    (fetchpatch {
-      name = "gcc-incompatible-pointer-type";
-      url = "https://github.com/owasp-modsecurity/ModSecurity/commit/4919814a5cf0e7911f71856ed872b0e73b659a0a.patch";
-      hash = "sha256-9JzCtiLf43xw6i4NqQpok37es+kuWXZWKdJum28Hx4M=";
-    })
   ];
 
   doCheck = true;

pkgs/by-name/mp/mprime/package.nix

@@ -31,13 +31,12 @@ in
 
 stdenv.mkDerivation rec {
   pname = "mprime";
-  version = "30.8b15";
-
+  version = "30.19b21";
   src = fetchurl {
-    url = "https://www.mersenne.org/ftp_root/gimps/p95v${
+    url = "https://download.mersenne.ca/gimps/v30/30.19/p95v${
       lib.replaceStrings [ "." ] [ "" ] version
     }.source.zip";
-    hash = "sha256-CNYorZStHV0aESGX9LfLZ4oD5PFR2UOFLN1MiLaKw58=";
+    hash = "sha256-vchDpUem+R3GcASj77zZmFivfbB17Nd7cYiyPlrCzio=";
   };
 
   postPatch = ''
@@ -88,6 +87,7 @@ stdenv.mkDerivation rec {
       "x86_64-linux"
       "x86_64-darwin"
     ];
+    maintainers = with maintainers; [ dstremur ];
     mainProgram = "mprime";
   };
 }

pkgs/by-name/op/opencloud/package.nix

@@ -28,13 +28,13 @@ let
 in
 buildGoModule rec {
   pname = "opencloud";
-  version = "3.2.1";
+  version = "3.3.0";
 
   src = fetchFromGitHub {
     owner = "opencloud-eu";
     repo = "opencloud";
     tag = "v${version}";
-    hash = "sha256-8bVBkLzqQpSnNqCZzNxqglyd14FtaJvbrwCQDbwrn2Q=";
+    hash = "sha256-ekOqKJxXTEClHfVZ5VDzKgEG3imK7ec/bnpqduL4LOQ=";
   };
 
   postPatch = ''

pkgs/by-name/op/opencloud/web.nix

@@ -9,19 +9,19 @@
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "opencloud-web";
-  version = "3.2.0";
+  version = "3.3.0";
 
   src = fetchFromGitHub {
     owner = "opencloud-eu";
     repo = "web";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-11vHPrmtyqRIvR/619z2YvF3VAW5EfrAhwnGTVexEZA=";
+    hash = "sha256-QBIAy3S8pss6NhN7V+AovWMoYZmu0cHbi6E7lUugYzU=";
   };
 
   pnpmDeps = pnpm_10.fetchDeps {
     inherit (finalAttrs) pname version src;
     fetcherVersion = 1;
-    hash = "sha256-PAoDkeiZIzf4P21oct0pNwMHT6jMLtS44if6maxN9c0=";
+    hash = "sha256-KYSjgDrl/IC+xi/GN+DqB0H6q0HWT7sjzGk/YvfTmHA=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/op/opensnitch/package.nix

@@ -34,13 +34,13 @@ let
 in
 buildGoModule (finalAttrs: {
   pname = "opensnitch";
-  version = "1.7.1";
+  version = "1.7.2";
 
   src = fetchFromGitHub {
     owner = "evilsocket";
     repo = "opensnitch";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-j73wbHm8hrfm+8YVwonzU+ddzwSk9+ecucsQ0Es715k=";
+    hash = "sha256-XAR7yZjAzbMxIVGSV82agpAGwlejkILGgDI6iRicZuQ=";
   };
 
   postPatch = ''
@@ -63,7 +63,7 @@ buildGoModule (finalAttrs: {
     protoc-gen-go-grpc'
   ];
 
-  vendorHash = "sha256-IByoQuJsGORmePlv1HzvF8RSu2XhP5Sry1j3NoY2WP8=";
+  vendorHash = "sha256-6/N/E+uk6RVmSLy6fSWjHj+J5mPFXtHZwWThhFJnfYY=";
 
   preBuild = ''
     make -C ../proto ../daemon/ui/protocol/ui.pb.go

pkgs/by-name/ov/overseerr/package.nix

@@ -0,0 +1,73 @@
+{
+  fetchFromGitHub,
+  fetchYarnDeps,
+  lib,
+  makeWrapper,
+  node-gyp,
+  node-pre-gyp,
+  nodejs,
+  python3,
+  stdenv,
+  yarnBuildHook,
+  yarnConfigHook,
+  yarnInstallHook,
+}:
+
+stdenv.mkDerivation rec {
+  pname = "overseerr";
+  version = "1.34.0";
+
+  src = fetchFromGitHub {
+    owner = "sct";
+    repo = "overseerr";
+    tag = "v${version}";
+    hash = "sha256-4332XsupUGjkFo0+4wn2fUyK5/y6EQoPaAuayBH/myk=";
+  };
+
+  offlineCache = fetchYarnDeps {
+    yarnLock = "${src}/yarn.lock";
+    hash = "sha256-f30P+/DxDz9uBmdgvaYK4YOAUmVce8MUnNHBXr8/yKc=";
+  };
+
+  env.CYPRESS_INSTALL_BINARY = 0;
+
+  nativeBuildInputs = [
+    makeWrapper
+    node-gyp
+    node-pre-gyp
+    nodejs
+    python3
+    yarnBuildHook
+    yarnConfigHook
+    yarnInstallHook
+  ];
+
+  postInstall = ''
+    # Fixes "Error: Cannot find module" (bcrypt) and "SQLite package has not been found installed".
+    pushd $out/lib/node_modules/overseerr/node_modules
+    for module in bcrypt sqlite3; do
+      pushd $module
+      node-pre-gyp rebuild --build-from-source --nodedir=${nodejs} --prefer-offline
+      popd
+    done
+
+    makeWrapper "${lib.getExe nodejs}" "$out/bin/overseerr" \
+      --set NODE_ENV production \
+      --chdir "$out/lib/node_modules/overseerr" \
+      --add-flags "dist/index.js" \
+      --add-flags "--"
+  '';
+
+  meta = {
+    badPlatforms = [
+      # FileNotFoundError: [Errno 2] No such file or directory: 'xcodebuild'
+      lib.systems.inspect.patterns.isDarwin
+    ];
+    changelog = "https://github.com/sct/overseerr/releases/tag/v${version}";
+    description = "Request management and media discovery tool for the Plex ecosystem";
+    homepage = "https://github.com/sct/overseerr";
+    license = lib.licenses.mit;
+    mainProgram = "overseerr";
+    maintainers = with lib.maintainers; [ jf-uu ];
+  };
+}

pkgs/by-name/pi/pixi/package.nix

@@ -14,16 +14,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "pixi";
-  version = "0.49.0";
+  version = "0.51.0";
 
   src = fetchFromGitHub {
     owner = "prefix-dev";
     repo = "pixi";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-BLzE2mhSCrVPhiECrEcOMB0+DC6KjTFBmuJmtpJ20bA=";
+    hash = "sha256-DuYfDy87HoJc+LL/vL91Omx6Spy7wO4HKI3Uary2DGs=";
   };
 
-  cargoHash = "sha256-bzOfIXT9QQE0CzVjOCMv7l9/MKNqazO7yxVmFOPKeEg=";
+  cargoHash = "sha256-pqhoEWWEjgMDz9G4Bhom0cdP1R3fWydAI9Z3aX4sQD4=";
 
   nativeBuildInputs = [
     pkg-config

pkgs/by-name/rm/rmfakecloud/package.nix

@@ -10,16 +10,16 @@
 
 buildGoModule rec {
   pname = "rmfakecloud";
-  version = "0.0.24";
+  version = "0.0.25";
 
   src = fetchFromGitHub {
     owner = "ddvk";
     repo = "rmfakecloud";
     rev = "v${version}";
-    hash = "sha256-ZsYq1+Bb6SyMGdbiy5UzanDiUiFOt4uhttiPKC0ESis=";
+    hash = "sha256-dembIFEoKQEZabsl7oK8rzvV2G7nhmebfw0AGUBanYs=";
   };
 
-  vendorHash = "sha256-S2P80uhX86IVUVEoR4tZ7e6qMe7CK+6bmmjBgjXGZmo=";
+  vendorHash = "sha256-ColOCdKa/sKoLnF/3idBIEyFB2JWYM+1y5TdC/LZT4A=";
 
   # if using webUI build it
   # use env because of https://github.com/NixOS/nixpkgs/issues/358844
@@ -29,7 +29,7 @@ buildGoModule rec {
     sourceRoot = "${src.name}/ui";
     pnpmLock = "${src}/ui/pnpm-lock.yaml";
     fetcherVersion = 1;
-    hash = "sha256-VNmCT4um2W2ii8jAm+KjQSjixYEKoZkw7CeRwErff/o=";
+    hash = "sha256-uywmHN9HWKi0CaqTg9uEio2XCu6ap9v2xtbodW/6b4Q=";
   };
   preBuild = lib.optionals enableWebui ''
     # using sass-embedded fails at executing node_modules/sass-embedded-linux-x64/dart-sass/src/dart

pkgs/by-name/sc/sccache/package.nix

@@ -4,21 +4,27 @@
   rustPlatform,
   pkg-config,
   openssl,
+  distributed ? false,
 }:
 
-rustPlatform.buildRustPackage rec {
+rustPlatform.buildRustPackage (finalAttrs: {
   version = "0.10.0";
   pname = "sccache";
 
   src = fetchFromGitHub {
     owner = "mozilla";
     repo = "sccache";
-    rev = "v${version}";
+    rev = "v${finalAttrs.version}";
     sha256 = "sha256-VEDMeRFQKNPS3V6/DhMWxHR7YWsCzAXTzp0lO+COl08=";
   };
 
   cargoHash = "sha256-1kfKBN4uRbU5LjbC0cLgMqoGnOSEAdC0S7EzXlfaDPo=";
 
+  buildFeatures = lib.optionals distributed [
+    "dist-client"
+    "dist-server"
+  ];
+
   nativeBuildInputs = [
     pkg-config
   ];
@@ -34,11 +40,11 @@ rustPlatform.buildRustPackage rec {
     description = "Ccache with Cloud Storage";
     mainProgram = "sccache";
     homepage = "https://github.com/mozilla/sccache";
-    changelog = "https://github.com/mozilla/sccache/releases/tag/v${version}";
+    changelog = "https://github.com/mozilla/sccache/releases/tag/v${finalAttrs.version}";
     maintainers = with lib.maintainers; [
       doronbehar
       figsoda
     ];
     license = lib.licenses.asl20;
   };
-}
+})

pkgs/by-name/te/teams-for-linux/package.nix

@@ -16,16 +16,16 @@
 
 buildNpmPackage rec {
   pname = "teams-for-linux";
-  version = "2.1.0";
+  version = "2.1.4";
 
   src = fetchFromGitHub {
     owner = "IsmaelMartinez";
     repo = "teams-for-linux";
     tag = "v${version}";
-    hash = "sha256-lISDy721e3bfWMl56DlIxVKN2bW8Yonc5XSVL072OQk=";
+    hash = "sha256-wzw7GXKehQCYX2RDH5G/SqhBSziVPnXiaPiLrhC2Dfc=";
   };
 
-  npmDepsHash = "sha256-QcjXJcEIi/sUJLUF+wMqhXyLYPgjZKK6n4ngyvrH9NA=";
+  npmDepsHash = "sha256-PWWEFbenAXuYKwFN+C+pQumrYJqgtfAt9EzEiaMddhQ=";
 
   nativeBuildInputs = [
     makeWrapper
@@ -61,7 +61,8 @@ buildNpmPackage rec {
         -c.npmRebuild=true \
         -c.asarUnpack="**/*.node" \
         -c.electronDist=electron-dist \
-        -c.electronVersion=${electron_37.version}
+        -c.electronVersion=${electron_37.version} \
+        -c.mac.identity=null
 
     runHook postBuild
   '';

pkgs/by-name/tr/traefik/package.nix

@@ -8,16 +8,16 @@
 
 buildGo124Module (finalAttrs: {
   pname = "traefik";
-  version = "3.4.4";
+  version = "3.5.0";
 
   # Archive with static assets for webui
   src = fetchzip {
     url = "https://github.com/traefik/traefik/releases/download/v${finalAttrs.version}/traefik-v${finalAttrs.version}.src.tar.gz";
-    hash = "sha256-v9czTMaNcl4Aov6w4+CAM6YQoyIEy90eBfwrnmQVmgQ=";
+    hash = "sha256-xsTf6DASRUlV1dJooZQjIBmdtdeLYZwVTvznZ7LxoZ4=";
     stripRoot = false;
   };
 
-  vendorHash = "sha256-y0RibDQF+iG3HCX2FkEqxxn8bsC7zc4rQyRyq8oRgQM=";
+  vendorHash = "sha256-rs68UCXzi4JfZqdJpr4kPqmpfZU4CIC8AK2YCXy0i14=";
 
   subPackages = [ "cmd/traefik" ];
 

pkgs/by-name/uu/uuu/package.nix

@@ -18,13 +18,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "uuu";
-  version = "1.5.219";
+  version = "1.5.222";
 
   src = fetchFromGitHub {
     owner = "nxp-imx";
     repo = "mfgtools";
     rev = "uuu_${finalAttrs.version}";
-    hash = "sha256-hiRKW97PBU6bIXnS/D1oPaSLpY8Z/wm+m8Pp/4RCVQM=";
+    hash = "sha256-n5CgsArkj67vR6WaUaTUYno1pFffXRxjlC7kU8N/oEM=";
   };
 
   passthru.updateScript = nix-update-script {

pkgs/by-name/vi/vista-fonts/package.nix

@@ -3,6 +3,7 @@
   stdenvNoCC,
   fetchurl,
   cabextract,
+  fontforge,
 }:
 
 stdenvNoCC.mkDerivation {
@@ -14,7 +15,10 @@ stdenvNoCC.mkDerivation {
     hash = "sha256-xOdTVI0wkv/X3ThJEF4KJtm1oa/kbm5mf+fGiHiTcB8=";
   };
 
-  nativeBuildInputs = [ cabextract ];
+  nativeBuildInputs = [
+    cabextract
+    fontforge
+  ];
 
   unpackPhase = ''
     runHook preUnpack
@@ -30,10 +34,29 @@ stdenvNoCC.mkDerivation {
     runHook preInstall
 
     mkdir -p $out/share/fonts/truetype
-    cp *.ttf *.ttc $out/share/fonts/truetype
 
-    # Set up no-op font configs to override any aliases set up by
-    # other packages.
+    # Remove the embedded bitmaps from Calibri and Cambria because they have very low resolutions.
+    fontforge -c "
+    import fontforge
+    import sys
+
+    def removeBitmaps(font):
+      for table in ('EBDT', 'EBLC', 'EBSC'):
+        font.setTableData(table, None)
+
+    for path in sys.argv[1:]:
+      fonts = [fontforge.open(f'{path}({font})') for font in fontforge.fontsInFile(path)]
+      for font in fonts:
+        removeBitmaps(font)
+      if len(fonts) > 1:
+        fonts[0].generateTtc(f'$out/share/fonts/truetype/{path}', fonts[1:], layer=fonts[0].activeLayer)
+      else:
+        fonts[0].generate(f'$out/share/fonts/truetype/{path}')
+    " calibri* cambria*
+
+    cp -n *.ttf *.ttc $out/share/fonts/truetype
+
+    # Set up no-op font configs to override any aliases set up by other packages.
     mkdir -p $out/etc/fonts/conf.d
     for name in Calibri Cambria Candara Consolas Constantia Corbel ; do
       substitute ${./no-op.conf} $out/etc/fonts/conf.d/30-''${name,,}.conf \

pkgs/by-name/ze/zed-editor/package.nix

@@ -99,7 +99,7 @@ let
 in
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "zed-editor";
-  version = "0.198.5";
+  version = "0.198.6";
 
   outputs = [
     "out"
@@ -112,7 +112,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
     owner = "zed-industries";
     repo = "zed";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-jDwHw5kbm0qfV2WJ5tbFl9z/1S1ICp8bCZbhUD5o0VI=";
+    hash = "sha256-XsfY6K8qsL2mi0+Z3tJp6LVDm7D+X3dPnaqgeT1iIHs=";
   };
 
   patches = [
@@ -138,7 +138,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
         --replace-fail "inner.redirect(policy)" "inner.redirect_policy(policy)"
     '';
 
-  cargoHash = "sha256-MHwMsMdv7TjnWi2Kmr7vA+TUK+VyHMm4faYOssJ5Z1o=";
+  cargoHash = "sha256-XIED6sQ7a5z2p1CZQ4A9TSTTNI5qpp9WSzVmiYdYG2o=";
 
   nativeBuildInputs = [
     cmake

pkgs/development/compilers/go/1.25.nix

@@ -28,11 +28,11 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "go";
-  version = "1.25rc3";
+  version = "1.25.0";
 
   src = fetchurl {
     url = "https://go.dev/dl/go${finalAttrs.version}.src.tar.gz";
-    hash = "sha256-Rw4LjnCmjyhV59AJ8TXsgLPRgIXSxOU323Xmrkliv3Q=";
+    hash = "sha256-S9AekSlyB7+kUOpA1NWpOxtTGl5DhHOyoG4Y4HciciU=";
   };
 
   strictDeps = true;

pkgs/development/ocaml-modules/colombe/default.nix

@@ -0,0 +1,41 @@
+{
+  alcotest,
+  angstrom,
+  buildDunePackage,
+  crowbar,
+  emile,
+  fetchurl,
+  fmt,
+  ipaddr,
+  lib,
+}:
+
+let
+  pname = "colombe";
+  version = "0.12.0";
+in
+buildDunePackage {
+  inherit pname version;
+  minimalOCamlVersion = "4.03";
+  src = fetchurl {
+    url = "https://github.com/mirage/colombe/releases/download/v${version}/colombe-${version}.tbz";
+    hash = "sha256-9g9l0wTzlXtESNeoBxhjMxlX0bRFY19T2+PN1lZ7ojE=";
+  };
+  propagatedBuildInputs = [
+    angstrom
+    emile
+    fmt
+    ipaddr
+  ];
+  doCheck = true;
+  checkInputs = [
+    alcotest
+    crowbar
+  ];
+  meta = {
+    description = "SMTP protocol according to RFC5321 without extensions";
+    homepage = "https://github.com/mirage/colombe";
+    license = lib.licenses.mit;
+    maintainers = [ lib.maintainers.vog ];
+  };
+}

pkgs/development/ocaml-modules/colombe/sendmail.nix

@@ -0,0 +1,36 @@
+{
+  alcotest,
+  angstrom,
+  base64,
+  buildDunePackage,
+  colombe,
+  hxd,
+  ke,
+  lib,
+  logs,
+  mrmime,
+  rresult,
+  tls,
+}:
+
+buildDunePackage {
+  pname = "sendmail";
+  inherit (colombe) version src;
+  propagatedBuildInputs = [
+    base64
+    colombe
+    logs
+    rresult
+    hxd
+    ke
+    tls
+  ];
+  doCheck = true;
+  checkInputs = [
+    alcotest
+    mrmime
+  ];
+  meta = colombe.meta // {
+    description = "Library to be able to send an email";
+  };
+}

pkgs/development/ocaml-modules/letters/default.nix

@@ -0,0 +1,58 @@
+{
+  alcotest-lwt,
+  buildDunePackage,
+  ca-certs,
+  colombe,
+  containers,
+  domain-name,
+  emile,
+  fetchFromGitHub,
+  fmt,
+  lib,
+  logs,
+  lwt,
+  mrmime,
+  ptime,
+  rresult,
+  sendmail,
+  tls-lwt,
+  x509,
+}:
+
+let
+  pname = "letters";
+  version = "0.4.0";
+in
+buildDunePackage {
+  inherit pname version;
+  src = fetchFromGitHub {
+    owner = "oxidizing";
+    repo = "letters";
+    tag = version;
+    hash = "sha256-75uLg+0AVDNdQ0M4w8H7MrTYwAKMhe8R5xC4vPNGkuQ=";
+  };
+  propagatedBuildInputs = [
+    ca-certs
+    colombe
+    containers
+    domain-name
+    emile
+    fmt
+    logs
+    lwt
+    mrmime
+    ptime
+    rresult
+    sendmail
+    tls-lwt
+    x509
+  ];
+  doCheck = true;
+  checkInputs = [ alcotest-lwt ];
+  meta = {
+    description = "OCaml library for creating and sending emails over SMTP using LWT";
+    homepage = "https://github.com/oxidizing/letters";
+    license = lib.licenses.mit;
+    maintainers = [ lib.maintainers.vog ];
+  };
+}

pkgs/development/python-modules/baidu-aip/default.nix

@@ -0,0 +1,39 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchPypi,
+  setuptools,
+  chardet,
+  requests,
+}:
+
+buildPythonPackage rec {
+  pname = "baidu-aip";
+  version = "4.16.1";
+  pyproject = true;
+
+  src = fetchPypi {
+    inherit pname version;
+    hash = "sha256-zNYjEVVwhqFAR7w7CR3rWYefUZcM+sPZ87KYfDDLxN0=";
+  };
+
+  build-system = [ setuptools ];
+
+  dependencies = [
+    chardet
+    requests
+  ];
+
+  # Package has no tests
+  doCheck = false;
+
+  pythonImportsCheck = [ "aip" ];
+
+  meta = {
+    description = "Baidu AI Platform SDK for Python";
+    homepage = "https://github.com/Baidu-AIP/python-sdk";
+    changelog = "https://github.com/Baidu-AIP/python-sdk/releases";
+    license = lib.licenses.asl20;
+    maintainers = [ lib.maintainers.jamiemagee ];
+  };
+}

pkgs/development/python-modules/python-doi/default.nix

@@ -7,21 +7,21 @@
 
 buildPythonPackage rec {
   pname = "python-doi";
-  version = "0.1.1";
+  version = "0.2";
   format = "setuptools";
 
   src = fetchFromGitHub {
     owner = "papis";
     repo = "python-doi";
     rev = "v${version}";
-    sha256 = "1wa5inh2a0drjswrnhjv6m23mvbfdgqj2jb8fya7q0armzp7l6fr";
+    sha256 = "sha256-c5Wo/bJuHwAG7XOy4Re9joYw14jWZ6QaRB4Wsk8StL0=";
   };
 
   disabled = !isPy3k;
 
   meta = with lib; {
     description = "Python library to work with Document Object Identifiers (doi)";
-    homepage = "https://github.com/alejandrogallo/python-doi";
+    homepage = "https://github.com/papis/python-doi";
     maintainers = with maintainers; [ teto ];
   };
 }

pkgs/development/python-modules/triton/bin.nix

@@ -1,12 +1,10 @@
 {
   lib,
   stdenv,
-  addDriverRunpath,
   cudaPackages,
   buildPythonPackage,
   fetchurl,
   python,
-  pythonOlder,
   autoPatchelfHook,
   filelock,
   lit,
@@ -15,7 +13,7 @@
 
 buildPythonPackage rec {
   pname = "triton";
-  version = "3.3.1";
+  version = "3.4.0";
   format = "wheel";
 
   src =

pkgs/development/python-modules/triton/binary-hashes.nix

@@ -7,46 +7,46 @@
 
 version:
 builtins.getAttr version {
-  "3.3.1" = {
+  "3.4.0" = {
     aarch64-linux-310 = {
-      name = "triton-3.3.1-cp310-cp310-manylinux_2_27_aarch64.manylinux_2_28_aarch64.whl";
-      url = "https://download.pytorch.org/whl/triton-3.3.1-cp310-cp310-manylinux_2_27_aarch64.manylinux_2_28_aarch64.whl";
-      hash = "sha256-nuTCrhQM7ftvnmnlRFf6KIqrbxOP0axLcdqSzfpmCQE=";
+      name = "triton-3.4.0-cp310-cp310-manylinux_2_27_aarch64.manylinux_2_28_aarch64.whl";
+      url = "https://download.pytorch.org/whl/triton-3.4.0-cp310-cp310-manylinux_2_27_aarch64.manylinux_2_28_aarch64.whl";
+      hash = "sha256-husMt2NDKM1Xf6UbWTOPGvQZnPmrYjhaxCqCeD2RFqQ=";
     };
     x86_64-linux-310 = {
-      name = "triton-3.3.1-cp310-cp310-manylinux_2_27_x86_64.manylinux_2_28_x86_64.whl";
-      url = "https://download.pytorch.org/whl/triton-3.3.1-cp310-cp310-manylinux_2_27_x86_64.manylinux_2_28_x86_64.whl";
-      hash = "sha256-t020RbHFYoRNPPrW6Weccuk/37GpCiQFKwO7XEnRJC4=";
+      name = "triton-3.4.0-cp310-cp310-manylinux_2_27_x86_64.manylinux_2_28_x86_64.whl";
+      url = "https://download.pytorch.org/whl/triton-3.4.0-cp310-cp310-manylinux_2_27_x86_64.manylinux_2_28_x86_64.whl";
+      hash = "sha256-axdYjFnL4dmHEz6nzRzC5SKeBUSgapkIv69oxh9WSVo=";
     };
     aarch64-linux-311 = {
-      name = "triton-3.3.1-cp311-cp311-manylinux_2_27_aarch64.manylinux_2_28_aarch64.whl";
-      url = "https://download.pytorch.org/whl/triton-3.3.1-cp311-cp311-manylinux_2_27_aarch64.manylinux_2_28_aarch64.whl";
-      hash = "sha256-1OMWwp3LUQPc/N+Y3o+huRwL+yYhisV37MwwWFrftg0=";
+      name = "triton-3.4.0-cp311-cp311-manylinux_2_27_aarch64.manylinux_2_28_aarch64.whl";
+      url = "https://download.pytorch.org/whl/triton-3.4.0-cp311-cp311-manylinux_2_27_aarch64.manylinux_2_28_aarch64.whl";
+      hash = "sha256-3Y0y0zf1gST+JUBD0oKkvBM8Ksp5ibxjWLLFRtISFRM=";
     };
     x86_64-linux-311 = {
-      name = "triton-3.3.1-cp311-cp311-manylinux_2_27_x86_64.manylinux_2_28_x86_64.whl";
-      url = "https://download.pytorch.org/whl/triton-3.3.1-cp311-cp311-manylinux_2_27_x86_64.manylinux_2_28_x86_64.whl";
-      hash = "sha256-sx46om+Ms8xb9OGHv3N8us8XMR4REreB1KBZNT39cxs=";
+      name = "triton-3.4.0-cp311-cp311-manylinux_2_27_x86_64.manylinux_2_28_x86_64.whl";
+      url = "https://download.pytorch.org/whl/triton-3.4.0-cp311-cp311-manylinux_2_27_x86_64.manylinux_2_28_x86_64.whl";
+      hash = "sha256-4rCv5CDSAtlvULhH10Skh7eAVnl1RV5W9ksGEVLulVQ=";
     };
     aarch64-linux-312 = {
-      name = "triton-3.3.1-cp312-cp312-manylinux_2_27_aarch64.manylinux_2_28_aarch64.whl";
-      url = "https://download.pytorch.org/whl/triton-3.3.1-cp312-cp312-manylinux_2_27_aarch64.manylinux_2_28_aarch64.whl";
-      hash = "sha256-mxmTw7pHARfc8oiP8RbYKAntek080FB0/ED/ORkLLOg=";
+      name = "triton-3.4.0-cp312-cp312-manylinux_2_27_aarch64.manylinux_2_28_aarch64.whl";
+      url = "https://download.pytorch.org/whl/triton-3.4.0-cp312-cp312-manylinux_2_27_aarch64.manylinux_2_28_aarch64.whl";
+      hash = "sha256-AOpKHBXwebv0n/AsMSIQ/bj/BbFQPqMIEmEOKjsXHzs=";
     };
     x86_64-linux-312 = {
-      name = "triton-3.3.1-cp312-cp312-manylinux_2_27_x86_64.manylinux_2_28_x86_64.whl";
-      url = "https://download.pytorch.org/whl/triton-3.3.1-cp312-cp312-manylinux_2_27_x86_64.manylinux_2_28_x86_64.whl";
-      hash = "sha256-mZnoOroh4aeMHzbyG85iG3e8qlMCd6UEhKfLSoIvbkM=";
+      name = "triton-3.4.0-cp312-cp312-manylinux_2_27_x86_64.manylinux_2_28_x86_64.whl";
+      url = "https://download.pytorch.org/whl/triton-3.4.0-cp312-cp312-manylinux_2_27_x86_64.manylinux_2_28_x86_64.whl";
+      hash = "sha256-hVBnKxGE8FGH9BQNsy4z5htZIEb9Ph65B+O321Mht1A=";
     };
     aarch64-linux-313 = {
-      name = "triton-3.3.1-cp313-cp313-manylinux_2_27_aarch64.manylinux_2_28_aarch64.whl";
-      url = "https://download.pytorch.org/whl/triton-3.3.1-cp313-cp313-manylinux_2_27_aarch64.manylinux_2_28_aarch64.whl";
-      hash = "sha256-S3nkmxWuMd0JWQkPN6Ni64HHfFZDug7FblKZA7BtKM8=";
+      name = "triton-3.4.0-cp313-cp313-manylinux_2_27_aarch64.manylinux_2_28_aarch64.whl";
+      url = "https://download.pytorch.org/whl/triton-3.4.0-cp313-cp313-manylinux_2_27_aarch64.manylinux_2_28_aarch64.whl";
+      hash = "sha256-WstSjwHcFDYsSoj6Tc+iJ9Ey9uYfJypodOhNZIUDfKQ=";
     };
     x86_64-linux-313 = {
-      name = "triton-3.3.1-cp313-cp313-manylinux_2_27_x86_64.manylinux_2_28_x86_64.whl";
-      url = "https://download.pytorch.org/whl/triton-3.3.1-cp313-cp313-manylinux_2_27_x86_64.manylinux_2_28_x86_64.whl";
-      hash = "sha256-uJ2Ea1pBmDF/7Cel06YJ6pa21Vf/RLVsIxdlRgI8QkA=";
+      name = "triton-3.4.0-cp313-cp313-manylinux_2_27_x86_64.manylinux_2_28_x86_64.whl";
+      url = "https://download.pytorch.org/whl/triton-3.4.0-cp313-cp313-manylinux_2_27_x86_64.manylinux_2_28_x86_64.whl";
+      hash = "sha256-Dlgr/YFHr9Dhf0ELOe4WHfkzoqyp9lPhF42q6Y+H9gE=";
     };
   };
 }

pkgs/development/python-modules/types-awscrt/default.nix

@@ -8,7 +8,7 @@
 
 buildPythonPackage rec {
   pname = "types-awscrt";
-  version = "0.27.5";
+  version = "0.27.6";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -16,7 +16,7 @@ buildPythonPackage rec {
   src = fetchPypi {
     pname = "types_awscrt";
     inherit version;
-    hash = "sha256-ju/lDRcJUgZjt302Q6dyw1rOPYrPyylvhXYnYiyEy0w=";
+    hash = "sha256-nT8YZak7iywy8TdRSsiMsEi1vEOHOZRboZ2XJpiZW/s=";
   };
 
   build-system = [ setuptools ];

pkgs/misc/uboot/default.nix

@@ -203,6 +203,7 @@ in
       "tools/mkenvimage"
       "tools/mkimage"
       "tools/env/fw_printenv"
+      "tools/mkeficapsule"
     ];
 
     pythonScriptsToInstall = {
@@ -240,6 +241,12 @@ in
     filesToInstall = [ "u-boot-sunxi-with-spl.bin" ];
   };
 
+  ubootBananaPim2Zero = buildUBoot {
+    defconfig = "bananapi_m2_zero_defconfig";
+    filesToInstall = [ "u-boot-sunxi-with-spl.bin" ];
+    extraMeta.platforms = [ "armv7l-linux" ];
+  };
+
   ubootBananaPim3 = buildUBoot {
     defconfig = "Sinovoip_BPI_M3_defconfig";
     extraMeta.platforms = [ "armv7l-linux" ];

pkgs/servers/home-assistant/component-packages.nix

@@ -537,7 +537,8 @@
       ];
     "baidu" =
       ps: with ps; [
-      ]; # missing inputs: baidu-aip
+        baidu-aip
+      ];
     "balay" =
       ps: with ps; [
       ];

pkgs/servers/nosql/mongodb/6.0.nix

@@ -1,39 +0,0 @@
-{
-  stdenv,
-  callPackage,
-  fetchpatch,
-  sasl,
-  boost,
-  cctools,
-  avxSupport ? stdenv.hostPlatform.avxSupport,
-}:
-
-let
-  buildMongoDB = callPackage ./mongodb.nix {
-    inherit
-      sasl
-      boost
-      cctools
-      stdenv
-      ;
-  };
-in
-buildMongoDB {
-  inherit avxSupport;
-  version = "6.0.24";
-  sha256 = "sha256-5Ip7uulbdb1rTzDWkPQjra035hA01bltPfvqnTm3tDw=";
-  patches = [
-    # Patches a bug that it couldn't build MongoDB 6.0 on gcc 13 because a include in ctype.h was missing
-    ./fix-gcc-13-ctype-6_0.patch
-
-    (fetchpatch {
-      name = "mongodb-6.1.0-rc-more-specific-cache-alignment-types.patch";
-      url = "https://github.com/mongodb/mongo/commit/5435f9585f857f6145beaf6d31daf336453ba86f.patch";
-      sha256 = "sha256-gWlE2b/NyGe2243iNCXzjcERIY8/4ZWI4Gjh5SF0tYA=";
-    })
-
-    # Fix building with python 3.12 since the imp module was removed
-    ./mongodb-python312.patch
-  ];
-  # passthru.tests = { inherit (nixosTests) mongodb; }; # currently tests mongodb-7_0
-}

pkgs/servers/nosql/mongodb/fix-gcc-13-ctype-6_0.patch

@@ -1,12 +0,0 @@
-diff --git a/src/mongo/util/ctype.h b/src/mongo/util/ctype.h
-index a3880e2..78ee57e 100644
---- a/src/mongo/util/ctype.h
-+++ b/src/mongo/util/ctype.h
-@@ -67,6 +67,7 @@
- #pragma once
-
- #include <array>
-+#include <cstdint>
-
- namespace mongo::ctype {
- namespace detail {

pkgs/top-level/aliases.nix

@@ -1331,6 +1331,7 @@ mapAliases {
   monero = throw "'monero' has been renamed to/replaced by 'monero-cli'"; # Converted to throw 2024-10-17
   mongodb-4_4 = throw "mongodb-4_4 has been removed, it's end of life since April 2024"; # Added 2024-04-11
   mongodb-5_0 = throw "mongodb-5_0 has been removed, it's end of life since October 2024"; # Added 2024-10-01
+  mongodb-6_0 = throw "mongodb-6_0 has been removed, it's end of life since July 2025"; # Added 2025-07-23
   moz-phab = mozphab; # Added 2022-08-09
   mp3info = throw "'mp3info' has been removed due to lack of maintenance upstream. Consider using 'eartag' or 'tagger' instead"; # Added 2024-09-14
   mp3splt = throw "'mp3splt' has been removed due to lack of maintenance upstream."; # Added 2025-05-17

pkgs/top-level/all-packages.nix

@@ -3803,10 +3803,6 @@ with pkgs;
 
   nifskope = libsForQt5.callPackage ../tools/graphics/nifskope { };
 
-  notation = callPackage ../by-name/no/notation/package.nix {
-    buildGoModule = buildGo123Module;
-  };
-
   nsjail = callPackage ../tools/security/nsjail {
     protobuf = protobuf_21;
   };
@@ -9647,8 +9643,8 @@ with pkgs;
   go = go_1_24;
   buildGoModule = buildGo124Module;
 
-  go_latest = go_1_24;
-  buildGoLatestModule = buildGo124Module;
+  go_latest = go_1_25;
+  buildGoLatestModule = buildGo125Module;
 
   go_1_23 = callPackage ../development/compilers/go/1.23.nix { };
   buildGo123Module = callPackage ../build-support/go/module.nix {
@@ -10327,11 +10323,6 @@ with pkgs;
 
   mongodb = hiPrio mongodb-7_0;
 
-  mongodb-6_0 = callPackage ../servers/nosql/mongodb/6.0.nix {
-    sasl = cyrus_sasl;
-    boost = boost178.override { enableShared = false; };
-  };
-
   mongodb-7_0 = callPackage ../servers/nosql/mongodb/7.0.nix {
     sasl = cyrus_sasl;
     boost = boost179.override { enableShared = false; };
@@ -11143,6 +11134,7 @@ with pkgs;
     ubootA20OlinuxinoLime
     ubootA20OlinuxinoLime2EMMC
     ubootBananaPi
+    ubootBananaPim2Zero
     ubootBananaPim3
     ubootBananaPim64
     ubootAmx335xEVM

pkgs/top-level/ocaml-packages.nix

@@ -262,6 +262,8 @@ let
 
         coin = callPackage ../development/ocaml-modules/coin { };
 
+        colombe = callPackage ../development/ocaml-modules/colombe { };
+
         color = callPackage ../development/ocaml-modules/color { };
 
         colors = callPackage ../development/ocaml-modules/colors { };
@@ -1042,6 +1044,8 @@ let
 
         letsencrypt-mirage = callPackage ../development/ocaml-modules/letsencrypt/mirage.nix { };
 
+        letters = callPackage ../development/ocaml-modules/letters { };
+
         libc = callPackage ../development/ocaml-modules/libc { };
 
         lilv = callPackage ../development/ocaml-modules/lilv {
@@ -1893,6 +1897,8 @@ let
 
         semver = callPackage ../development/ocaml-modules/semver { };
 
+        sendmail = callPackage ../development/ocaml-modules/colombe/sendmail.nix { };
+
         seq = callPackage ../development/ocaml-modules/seq { };
 
         seqes = callPackage ../development/ocaml-modules/seqes { };

pkgs/top-level/python-packages.nix

@@ -1655,6 +1655,8 @@ self: super: with self; {
 
   bagit = callPackage ../development/python-modules/bagit { };
 
+  baidu-aip = callPackage ../development/python-modules/baidu-aip { };
+
   baize = callPackage ../development/python-modules/baize { };
 
   bambi = callPackage ../development/python-modules/bambi { };