Merge remote-tracking branch 'origin/staging-next' into staging

.editorconfig

@@ -89,6 +89,10 @@ trim_trailing_whitespace = unset
 end_of_line = unset
 insert_final_newline = unset
 
+# see https://manual.jule.dev/project/code-style.html#indentions
+[*.jule]
+indent_style = tab
+
 # Keep this hint at the bottom:
 # Please don't add entries for subfolders here.
 # Create <subfolder>/.editorconfig instead.

.github/workflows/pr.yml

@@ -40,6 +40,7 @@ jobs:
       - id: prepare
         uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
         with:
+          retries: 3
           script: |
             require('./ci/github-script/prepare.js')({
               github,

.github/workflows/test.yml

@@ -27,6 +27,7 @@ jobs:
       - id: prepare
         uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
         with:
+          retries: 3
           script: |
             require('./ci/github-script/prepare.js')({
               github,

ci/README.md

@@ -10,6 +10,14 @@ In order to ensure that the needed packages are generally available without buil
 
 Run [`update-pinned.sh`](./update-pinned.sh) to update it.
 
+## GitHub specific code
+
+Some of the code is specific to GitHub.
+This code is currently spread out over multiple places and written in both Bash and JavaScript.
+The goal is to eventually have all GitHub specific code in `ci/github-script` and written in JavaScript via `actions/github-script`.
+A lot of code has already been migrated, but some Bash code still remains.
+New CI features need to be introduced in JavaScript, not Bash.
+
 ## `ci/nixpkgs-vet.sh BASE_BRANCH [REPOSITORY]`
 
 Runs the [`nixpkgs-vet` tool](https://github.com/NixOS/nixpkgs-vet) on the HEAD commit, closely matching what CI does.

ci/eval/compare/maintainers.nix

@@ -7,7 +7,13 @@
   removedattrs,
 }:
 let
-  pkgs = import ../../.. { system = "x86_64-linux"; };
+  pkgs = import ../../.. {
+    system = "x86_64-linux";
+    # We should never try to ping maintainers through package aliases, this can only lead to errors.
+    # One example case is, where an attribute is a throw alias, but then re-introduced in a PR.
+    # This would trigger the throw. By disabling aliases, we can fallback gracefully below.
+    config.allowAliases = false;
+  };
 
   changedpaths = lib.importJSON changedpathsjson;
 

doc/hooks/index.md

@@ -20,6 +20,7 @@ ghc.section.md
 gnome.section.md
 haredo.section.md
 installShellFiles.section.md
+julec.section.md
 just.section.md
 libiconv.section.md
 libxml2.section.md

doc/hooks/julec.section.md

@@ -0,0 +1,77 @@
+# julec.hook {#julec-hook}
+
+[Jule](https://jule.dev) is an effective programming language designed to build efficient, fast, reliable and safe software while maintaining simplicity.
+
+In Nixpkgs, `jule.hook` overrides the default build, check and install phases.
+
+## Example code snippet {#julec-hook-example-code-snippet}
+
+```nix
+{
+  julec,
+  clangStdenv,
+}:
+
+clangStdenv.mkDerivation (finalAttrs: {
+  # ...
+
+  nativeBuildInputs = [ julec.hook ];
+
+  # Customize filenames if needed
+  JULE_SRC_DIR = "./src";
+  JULE_OUT_DIR = "./bin";
+  JULE_OUT_NAME = "hello-jule";
+  JULE_TEST_DIR = "./tests";
+  JULE_TEST_OUT_DIR = "./test-bin";
+  JULE_TEST_OUT_NAME = "hello-jule-test";
+
+  # ...
+})
+```
+
+## Variables controlling julec.hook {#julec-hook-variables}
+
+### `JULE_SRC_DIR` {#julec-hook-variable-jule-src-dir}
+
+Specifies the source directory containing `main.jule`.
+Default is `./src`.
+
+### `JULE_OUT_DIR` {#julec-hook-variable-jule-out-dir}
+
+Specifies the output directory for the compiled binary.
+Default is `./bin`.
+
+### `JULE_OUT_NAME` {#julec-hook-variable-jule-out-name}
+
+Specifies the name of the compiled binary.
+Default is `output`.
+
+### `JULE_TEST_DIR` {#julec-hook-variable-jule-test-dir}
+
+Specifies the directory containing test files.
+Default is the value of [`JULE_SRC_DIR`](#julec-hook-variable-jule-src-dir).
+
+### `JULE_TEST_OUT_DIR` {#julec-hook-variable-jule-test-out-dir}
+
+Specifies the output directory for compiled test binaries.
+Default is the value of [`JULE_OUT_DIR`](#julec-hook-variable-jule-out-dir).
+
+### `JULE_TEST_OUT_NAME` {#julec-hook-variable-jule-test-out-name}
+
+Specifies the name of the compiled test binary.
+Default is the value of [`JULE_OUT_NAME`](#julec-hook-variable-jule-out-name) with `-test` suffix.
+
+### `dontUseJulecBuild` {#julec-hook-variable-dontusejulecbuild}
+
+When set to true, doesn't use the predefined `julecBuildHook`.
+Default is false.
+
+### `dontUseJulecCheck` {#julec-hook-variable-dontusejuleccheck}
+
+When set to true, doesn't use the predefined `julecCheckHook`.
+Default is false.
+
+### `dontUseJulecInstall` {#julec-hook-variable-dontusejulecinstall}
+
+When set to true, doesn't use the predefined `julecInstallHook`.
+Default is false.

doc/redirects.json

@@ -130,6 +130,42 @@
   "libcxxhardeningfast": [
     "index.html#libcxxhardeningfast"
   ],
+  "julec-hook": [
+    "index.html#julec-hook"
+  ],
+  "julec-hook-example-code-snippet": [
+    "index.html#julec-hook-example-code-snippet"
+  ],
+  "julec-hook-variable-dontusejulecbuild": [
+    "index.html#julec-hook-variable-dontusejulecbuild"
+  ],
+  "julec-hook-variable-dontusejuleccheck": [
+    "index.html#julec-hook-variable-dontusejuleccheck"
+  ],
+  "julec-hook-variable-dontusejulecinstall": [
+    "index.html#julec-hook-variable-dontusejulecinstall"
+  ],
+  "julec-hook-variable-jule-out-dir": [
+    "index.html#julec-hook-variable-jule-out-dir"
+  ],
+  "julec-hook-variable-jule-out-name": [
+    "index.html#julec-hook-variable-jule-out-name"
+  ],
+  "julec-hook-variable-jule-src-dir": [
+    "index.html#julec-hook-variable-jule-src-dir"
+  ],
+  "julec-hook-variable-jule-test-dir": [
+    "index.html#julec-hook-variable-jule-test-dir"
+  ],
+  "julec-hook-variable-jule-test-out-dir": [
+    "index.html#julec-hook-variable-jule-test-out-dir"
+  ],
+  "julec-hook-variable-jule-test-out-name": [
+    "index.html#julec-hook-variable-jule-test-out-name"
+  ],
+  "julec-hook-variables": [
+    "index.html#julec-hook-variables"
+  ],
   "major-ghc-deprecation": [
     "index.html#major-ghc-deprecation"
   ],

doc/release-notes/rl-2511.section.md

@@ -378,6 +378,8 @@
   - `number`
   - `numbers.*`
 
+- `lib.cli.toGNUCommandLine` and `lib.cli.toGNUCommandLineShell` have been deprecated in favor of `lib.cli.toCommandLine`, `lib.cli.toCommandLineShell`, `lib.cli.toCommandLineGNU` and `lib.cli.toCommandLineShellGNU`.
+
 ### Additions and Improvements {#sec-nixpkgs-release-25.11-lib-additions-improvements}
 
 - `neovim`: Added support for the `vim.o.exrc` option, the `VIMINIT` environment variable, and sourcing of `sysinit.vim`.
@@ -385,3 +387,5 @@
   See the neovim help page [`:help startup`](https://neovim.io/doc/user/starting.html#startup) for more information, as well as [the nixpkgs neovim wrapper documentation](#neovim-custom-configuration).
 
 - `cloudflare-ddns`: Added package cloudflare-ddns.
+
+- `lib.cli.toCommandLine`, `lib.cli.toCommandLineShell`, `lib.cli.toCommandLineGNU` and `lib.cli.toCommandLineShellGNU` have been added to address multiple issues in `lib.cli.toGNUCommandLine` and `lib.cli.toGNUCommandLineShell`.

lib/cli.nix

@@ -1,6 +1,6 @@
 { lib }:
 
-rec {
+{
   /**
     Automatically convert an attribute set to command-line options.
 
@@ -20,6 +20,7 @@ rec {
     : The attributes to transform into arguments.
 
     # Examples
+
     :::{.example}
     ## `lib.cli.toGNUCommandLineShell` usage example
 
@@ -38,7 +39,10 @@ rec {
 
     :::
   */
-  toGNUCommandLineShell = options: attrs: lib.escapeShellArgs (toGNUCommandLine options attrs);
+  toGNUCommandLineShell =
+    lib.warnIf (lib.oldestSupportedReleaseIsAtLeast 2511)
+      "lib.cli.toGNUCommandLineShell is deprecated, please use lib.cli.toCommandLineShell or lib.cli.toCommandLineShellGNU instead."
+      (options: attrs: lib.escapeShellArgs (lib.cli.toGNUCommandLine options attrs));
 
   /**
     Automatically convert an attribute set to a list of command-line options.
@@ -55,7 +59,7 @@ rec {
 
     : The attributes to transform into arguments.
 
-    # Options
+    ## Options
 
     `mkOptionName`
 
@@ -85,6 +89,7 @@ rec {
     This is useful if the command requires equals, for example, `-c=5`.
 
     # Examples
+
     :::{.example}
     ## `lib.cli.toGNUCommandLine` usage example
 
@@ -111,38 +116,224 @@ rec {
     :::
   */
   toGNUCommandLine =
+    lib.warnIf (lib.oldestSupportedReleaseIsAtLeast 2511)
+      "lib.cli.toGNUCommandLine is deprecated, please use lib.cli.toCommandLine or lib.cli.toCommandLineShellGNU instead."
+      (
+        {
+          mkOptionName ? k: if builtins.stringLength k == 1 then "-${k}" else "--${k}",
+
+          mkBool ? k: v: lib.optional v (mkOptionName k),
+
+          mkList ? k: v: lib.concatMap (mkOption k) v,
+
+          mkOption ?
+            k: v:
+            if v == null then
+              [ ]
+            else if optionValueSeparator == null then
+              [
+                (mkOptionName k)
+                (lib.generators.mkValueStringDefault { } v)
+              ]
+            else
+              [ "${mkOptionName k}${optionValueSeparator}${lib.generators.mkValueStringDefault { } v}" ],
+
+          optionValueSeparator ? null,
+        }:
+        options:
+        let
+          render =
+            k: v:
+            if builtins.isBool v then
+              mkBool k v
+            else if builtins.isList v then
+              mkList k v
+            else
+              mkOption k v;
+
+        in
+        builtins.concatLists (lib.mapAttrsToList render options)
+      );
+
+  /**
+    Converts the given attributes into a single shell-escaped command-line string.
+    Similar to `toCommandLineGNU`, but returns a single escaped string instead of an array of arguments.
+    For further reference see: [`lib.cli.toCommandLineGNU`](#function-library-lib.cli.toCommandLineGNU)
+  */
+  toCommandLineShellGNU =
+    options: attrs: lib.escapeShellArgs (lib.cli.toCommandLineGNU options attrs);
+
+  /**
+    Converts an attribute set into a list of GNU-style command line options.
+
+    `toCommandLineGNU` returns a list of string arguments.
+
+    # Inputs
+
+    `options`
+
+    : Options, see below.
+
+    `attrs`
+
+    : The attributes to transform into arguments.
+
+    ## Options
+
+    `isLong`
+
+    : A function that determines whether an option is long or short.
+
+    `explicitBool`
+
+    : Whether or not boolean option arguments should be formatted explicitly.
+
+    `formatArg`
+
+    : A function that turns the option argument into a string.
+
+    # Examples
+
+    :::{.example}
+    ## `lib.cli.toCommandLineGNU` usage example
+
+    ```nix
+    lib.cli.toCommandLineGNU {} {
+      v = true;
+      verbose = [true true false null];
+      i = ".bak";
+      testsuite = ["unit" "integration"];
+      e = ["s/a/b/" "s/b/c/"];
+      n = false;
+      data = builtins.toJSON {id = 0;};
+    }
+    => [
+      "--data={\"id\":0}"
+      "-es/a/b/"
+      "-es/b/c/"
+      "-i.bak"
+      "--testsuite=unit"
+      "--testsuite=integration"
+      "-v"
+      "--verbose"
+      "--verbose"
+    ]
+    ```
+
+    :::
+  */
+  toCommandLineGNU =
     {
-      mkOptionName ? k: if builtins.stringLength k == 1 then "-${k}" else "--${k}",
-
-      mkBool ? k: v: lib.optional v (mkOptionName k),
-
-      mkList ? k: v: lib.concatMap (mkOption k) v,
-
-      mkOption ?
-        k: v:
-        if v == null then
-          [ ]
-        else if optionValueSeparator == null then
-          [
-            (mkOptionName k)
-            (lib.generators.mkValueStringDefault { } v)
-          ]
-        else
-          [ "${mkOptionName k}${optionValueSeparator}${lib.generators.mkValueStringDefault { } v}" ],
-
-      optionValueSeparator ? null,
+      isLong ? optionName: builtins.stringLength optionName > 1,
+      explicitBool ? false,
+      formatArg ? lib.generators.mkValueStringDefault { },
     }:
-    options:
     let
-      render =
-        k: v:
-        if builtins.isBool v then
-          mkBool k v
-        else if builtins.isList v then
-          mkList k v
-        else
-          mkOption k v;
-
+      optionFormat = optionName: {
+        option = if isLong optionName then "--${optionName}" else "-${optionName}";
+        sep = if isLong optionName then "=" else "";
+        inherit explicitBool formatArg;
+      };
     in
-    builtins.concatLists (lib.mapAttrsToList render options);
+    lib.cli.toCommandLine optionFormat;
+
+  /**
+    Converts the given attributes into a single shell-escaped command-line string.
+    Similar to `toCommandLine`, but returns a single escaped string instead of an array of arguments.
+    For further reference see: [`lib.cli.toCommandLine`](#function-library-lib.cli.toCommandLine)
+  */
+  toCommandLineShell =
+    optionFormat: attrs: lib.escapeShellArgs (lib.cli.toCommandLine optionFormat attrs);
+
+  /**
+    Converts an attribute set into a list of command line options.
+
+    `toCommandLine` returns a list of string arguments.
+
+    # Inputs
+
+    `optionFormat`
+
+    : The option format that describes how options and their arguments should be formatted.
+
+    `attrs`
+
+    : The attributes to transform into arguments.
+
+    # Examples
+    :::{.example}
+    ## `lib.cli.toCommandLine` usage example
+
+    ```nix
+    let
+      optionFormat = optionName: {
+        option = "-${optionName}";
+        sep = "=";
+        explicitBool = true;
+      };
+    in lib.cli.toCommandLine optionFormat {
+      v = true;
+      verbose = [true true false null];
+      i = ".bak";
+      testsuite = ["unit" "integration"];
+      e = ["s/a/b/" "s/b/c/"];
+      n = false;
+      data = builtins.toJSON {id = 0;};
+    }
+    => [
+      "-data={\"id\":0}"
+      "-e=s/a/b/"
+      "-e=s/b/c/"
+      "-i=.bak"
+      "-n=false"
+      "-testsuite=unit"
+      "-testsuite=integration"
+      "-v=true"
+      "-verbose=true"
+      "-verbose=true"
+      "-verbose=false"
+    ]
+    ```
+
+    :::
+  */
+  toCommandLine =
+    optionFormat: attrs:
+    let
+      handlePair =
+        k: v:
+        if k == "" then
+          lib.throw "lib.cli.toCommandLine only accepts non-empty option names."
+        else if builtins.isList v then
+          builtins.concatMap (handleOption k) v
+        else
+          handleOption k v;
+
+      handleOption = k: renderOption (optionFormat k) k;
+
+      renderOption =
+        {
+          option,
+          sep,
+          explicitBool,
+          formatArg ? lib.generators.mkValueStringDefault { },
+        }:
+        k: v:
+        if v == null || (!explicitBool && v == false) then
+          [ ]
+        else if !explicitBool && v == true then
+          [ option ]
+        else
+          let
+            arg = formatArg v;
+          in
+          if sep != null then
+            [ "${option}${sep}${arg}" ]
+          else
+            [
+              option
+              arg
+            ];
+    in
+    builtins.concatLists (lib.mapAttrsToList handlePair attrs);
 }

lib/tests/misc.nix

@@ -3106,6 +3106,86 @@ runTests {
     expected = "-X PUT --data '{\"id\":0}' --retry 3 --url https://example.com/foo --url https://example.com/bar --verbose";
   };
 
+  testToCommandLine = {
+    expr =
+      let
+        optionFormat = optionName: {
+          option = "-${optionName}";
+          sep = "=";
+          explicitBool = true;
+        };
+      in
+      cli.toCommandLine optionFormat {
+        v = true;
+        verbose = [
+          true
+          true
+          false
+          null
+        ];
+        i = ".bak";
+        testsuite = [
+          "unit"
+          "integration"
+        ];
+        e = [
+          "s/a/b/"
+          "s/b/c/"
+        ];
+        n = false;
+        data = builtins.toJSON { id = 0; };
+      };
+
+    expected = [
+      "-data={\"id\":0}"
+      "-e=s/a/b/"
+      "-e=s/b/c/"
+      "-i=.bak"
+      "-n=false"
+      "-testsuite=unit"
+      "-testsuite=integration"
+      "-v=true"
+      "-verbose=true"
+      "-verbose=true"
+      "-verbose=false"
+    ];
+  };
+
+  testToCommandLineGNU = {
+    expr = cli.toCommandLineGNU { } {
+      v = true;
+      verbose = [
+        true
+        true
+        false
+        null
+      ];
+      i = ".bak";
+      testsuite = [
+        "unit"
+        "integration"
+      ];
+      e = [
+        "s/a/b/"
+        "s/b/c/"
+      ];
+      n = false;
+      data = builtins.toJSON { id = 0; };
+    };
+
+    expected = [
+      "--data={\"id\":0}"
+      "-es/a/b/"
+      "-es/b/c/"
+      "-i.bak"
+      "--testsuite=unit"
+      "--testsuite=integration"
+      "-v"
+      "--verbose"
+      "--verbose"
+    ];
+  };
+
   testSanitizeDerivationNameLeadingDots = testSanitizeDerivationName {
     name = "..foo";
     expected = "foo";

maintainers/maintainer-list.nix

@@ -21236,6 +21236,12 @@
     githubId = 39039420;
     name = "Quinn Dougherty";
   };
+  quinneden = {
+    email = "quinn@qeden.dev";
+    github = "quinneden";
+    githubId = 125415641;
+    name = "Quinn Edenfield";
+  };
   QuiNzX = {
     name = "QuiNz-";
     github = "QuiNzX";

maintainers/team-list.nix

@@ -37,7 +37,6 @@ with lib.maintainers;
       aanderse
       arianvp
       emily
-      flokli
       m1cr0man
     ];
     scope = "Maintain ACME-related packages and modules.";

nixos/doc/manual/release-notes/rl-2511.section.md

@@ -256,6 +256,10 @@
 
 - `services.gateone` has been removed as the package was removed such that it does not work.
 
+- `teleport` has been upgraded from major version 17 to major version 18.
+Refer to [upstream upgrade instructions](https://goteleport.com/docs/upgrading/overview/)
+and [release notes for v18](https://goteleport.com/docs/changelog/#1800-070325).
+
 - `services.dwm-status.extraConfig` was replaced by [RFC0042](https://github.com/NixOS/rfcs/blob/master/rfcs/0042-config-option.md)-compliant [](#opt-services.dwm-status.settings), which is used to generate the config file. `services.dwm-status.order` is now moved to [](#opt-services.dwm-status.settings.order), as it's a part of the config file.
 
 - `gitversion` was updated to 6.3.0, which includes a number of breaking changes, old configurations may need updating or they will cause the tool to fail to run.

nixos/modules/hardware/printers.nix

@@ -10,7 +10,7 @@ let
   ensurePrinter =
     p:
     let
-      args = lib.cli.toGNUCommandLineShell { } (
+      args = lib.cli.toCommandLineShellGNU { } (
         {
           p = p.name;
           v = p.deviceUri;

nixos/modules/services/finance/libeufin/common.nix

@@ -48,7 +48,7 @@ libeufinComponent:
             DynamicUser = true;
             ExecStart =
               let
-                args = lib.cli.toGNUCommandLineShell { } {
+                args = lib.cli.toCommandLineShellGNU { } {
                   c = configFile;
                   L = if cfg.debug then "debug" else null;
                 };
@@ -80,7 +80,7 @@ libeufinComponent:
             initialAccountRegistration = lib.concatMapStringsSep "\n" (
               account:
               let
-                args = lib.cli.toGNUCommandLineShell { } {
+                args = lib.cli.toCommandLineShellGNU { } {
                   c = configFile;
                   inherit (account) username password name;
                   payto_uri = "payto://x-taler-bank/${bankHost}/${account.username}?receiver-name=${account.name}";
@@ -90,7 +90,7 @@ libeufinComponent:
               "${lib.getExe' cfg.package "libeufin-bank"} create-account ${args}"
             ) cfg.initialAccounts;
 
-            args = lib.cli.toGNUCommandLineShell { } {
+            args = lib.cli.toCommandLineShellGNU { } {
               c = configFile;
               L = if cfg.debug then "debug" else null;
             };

nixos/modules/services/hardware/undervolt.nix

@@ -16,7 +16,7 @@ let
         limit != null && window != null
       ) "Both power limit and window must be set";
       "${toString limit} ${toString window}";
-  cliArgs = lib.cli.toGNUCommandLine { } {
+  cliArgs = lib.cli.toCommandLineGNU { } {
     inherit (cfg)
       verbose
       temp

nixos/modules/services/home-automation/ebusd.nix

@@ -170,7 +170,7 @@ in
         serviceConfig = {
           ExecStart =
             let
-              args = lib.cli.toGNUCommandLineShell { optionValueSeparator = "="; } (
+              args = lib.cli.toCommandLineShellGNU { } (
                 lib.foldr (a: b: a // b) { } [
                   {
                     inherit (cfg)

nixos/modules/services/mail/mailpit.nix

@@ -22,7 +22,7 @@ let
 
   isNonNull = v: v != null;
   genCliFlags =
-    settings: concatStringsSep " " (cli.toGNUCommandLine { } (filterAttrs (const isNonNull) settings));
+    settings: concatStringsSep " " (cli.toCommandLineGNU { } (filterAttrs (const isNonNull) settings));
 in
 {
   options.services.mailpit.instances = mkOption {

nixos/modules/services/misc/paperless.nix

@@ -686,7 +686,7 @@ in
           path = [ manage ];
           script = ''
             paperless-manage document_exporter ${cfg.exporter.directory} ${
-              lib.cli.toGNUCommandLineShell { } cfg.exporter.settings
+              lib.cli.toCommandLineShellGNU { } cfg.exporter.settings
             }
           '';
         };

nixos/modules/services/networking/gns3-server.nix

@@ -187,7 +187,7 @@ in
 
       systemd.services.gns3-server =
         let
-          commandArgs = lib.cli.toGNUCommandLineShell { } {
+          commandArgs = lib.cli.toCommandLineShellGNU { } {
             config = "/etc/gns3/gns3_server.conf";
             pid = "/run/gns3/server.pid";
             log = cfg.log.file;

nixos/modules/services/networking/hylafax/systemd.nix

@@ -14,7 +14,13 @@ let
     mkMerge
     optional
     ;
-  inherit (lib.cli) toGNUCommandLine;
+  inherit (lib.cli) toCommandLine;
+
+  optionFormat = optionName: {
+    option = "-${optionName}";
+    sep = null;
+    explicitBool = false;
+  };
 
   cfg = config.services.hylafax;
   mapModems = lib.forEach (lib.attrValues cfg.modems);
@@ -23,9 +29,7 @@ let
     prefix: program: posArg: options:
     let
       start = "${prefix}${cfg.package}/spool/bin/${program}";
-      optionsList = toGNUCommandLine { mkOptionName = k: "-${k}"; } (
-        { q = cfg.spoolAreaPath; } // options
-      );
+      optionsList = toCommandLine optionFormat ({ q = cfg.spoolAreaPath; } // options);
       posArgList = optional (posArg != null) posArg;
     in
     "${start} ${escapeShellArgs (optionsList ++ posArgList)}";

nixos/modules/services/networking/newt.nix

@@ -83,7 +83,7 @@ in
       };
       # the flag values will all be overwritten if also defined in the env file
       serviceConfig = {
-        ExecStart = "${lib.getExe cfg.package} ${lib.cli.toGNUCommandLineShell { } cfg.settings}";
+        ExecStart = "${lib.getExe cfg.package} ${lib.cli.toCommandLineShellGNU { } cfg.settings}";
         DynamicUser = true;
         StateDirectory = "newt";
         StateDirectoryMode = "0700";

nixos/modules/services/networking/syncthing.nix

@@ -947,7 +947,7 @@ in
           ExecStart =
             let
               args = lib.escapeShellArgs (
-                (lib.cli.toGNUCommandLine { } {
+                (lib.cli.toCommandLineGNU { } {
                   "no-browser" = true;
                   "gui-address" = (if isUnixGui then "unix://" else "") + cfg.guiAddress;
                   "config" = cfg.configDir;

nixos/modules/services/networking/wstunnel.nix

@@ -26,7 +26,7 @@ let
         str
         (listOf str)
       ]);
-    generate = lib.cli.toGNUCommandLineShell { };
+    generate = lib.cli.toCommandLineShellGNU { };
   };
 
   hostPortToString = { host, port, ... }: "${host}:${toString port}";

nixos/modules/services/security/tsidp.nix

@@ -164,7 +164,7 @@ in
           Type = "simple";
           ExecStart =
             let
-              args = lib.cli.toGNUCommandLineShell { mkOptionName = k: "-${k}"; } {
+              args = lib.cli.toCommandLineShellGNU { } {
                 dir = stateDir;
                 hostname = cfg.settings.hostName;
                 port = cfg.settings.port;

nixos/modules/services/system/earlyoom.nix

@@ -179,7 +179,7 @@ in
       serviceConfig.EnvironmentFile = "";
 
       environment.EARLYOOM_ARGS =
-        lib.cli.toGNUCommandLineShell { } {
+        lib.cli.toCommandLineShellGNU { } {
           m =
             "${toString cfg.freeMemThreshold}"
             + optionalString (cfg.freeMemKillThreshold != null) ",${toString cfg.freeMemKillThreshold}";

nixos/modules/services/system/self-deploy.nix

@@ -179,7 +179,7 @@ in
         ${gitWithRepo} checkout FETCH_HEAD
 
         nix-build${renderNixArgs cfg.nixArgs} ${
-          lib.cli.toGNUCommandLineShell { } {
+          lib.cli.toCommandLineShellGNU { } {
             attr = cfg.nixAttribute;
             out-link = outPath;
           }

nixos/modules/services/web-apps/c2fmzq-server.nix

@@ -25,10 +25,8 @@ let
           str
         ])
       );
-    generate = lib.cli.toGNUCommandLineShell {
-      mkBool = k: v: [
-        "--${k}=${if v then "true" else "false"}"
-      ];
+    generate = lib.cli.toCommandLineShellGNU {
+      explicitBool = true;
     };
   };
 in

nixos/modules/services/web-apps/libretranslate.nix

@@ -146,7 +146,7 @@ in
           Type = "simple";
           ExecStart = ''
             ${cfg.package}/bin/libretranslate ${
-              lib.cli.toGNUCommandLineShell { } (
+              lib.cli.toCommandLineShellGNU { } (
                 cfg.extraArgs
                 // {
                   inherit (cfg) host port threads;

nixos/modules/services/web-apps/zitadel.nix

@@ -207,7 +207,7 @@ in
         configFile = settingsFormat.generate "config.yaml" cfg.settings;
         stepsFile = settingsFormat.generate "steps.yaml" cfg.steps;
 
-        args = lib.cli.toGNUCommandLineShell { } {
+        args = lib.cli.toCommandLineShellGNU { } {
           config = cfg.extraSettingsPaths ++ [ configFile ];
           steps = cfg.extraStepsPaths ++ [ stepsFile ];
           masterkeyFile = cfg.masterKeyFile;

nixos/modules/services/web-servers/fcgiwrap.nix

@@ -151,7 +151,7 @@ in
       serviceConfig = {
         ExecStart = ''
           ${pkgs.fcgiwrap}/sbin/fcgiwrap ${
-            cli.toGNUCommandLineShell { } (
+            cli.toCommandLineShellGNU { } (
               {
                 c = cfg.process.prefork;
               }

nixos/modules/system/boot/loader/limine/limine-install.py

@@ -51,6 +51,11 @@ def config(*path: str) -> Optional[Any]:
         result = result[component]
     return result
 
+
+def bool_to_yes_no(value: bool) -> str:
+    return 'yes' if value else 'no'
+
+
 def get_system_path(profile: str = 'system', gen: Optional[str] = None, spec: Optional[str] = None) -> str:
     basename = f'{profile}-{gen}-link' if gen is not None else profile
     profiles_dir = '/nix/var/nix/profiles'
@@ -377,10 +382,14 @@ def copy_file(from_path: str, to_path: str):
 
     paths[to_path] = True
 
-def option_from_config(name: str, config_path: List[str], conversion: Callable[[str], str] | None = None) -> str:
-    if config(*config_path):
-        return f'{name}: {conversion(config(*config_path)) if conversion else config(*config_path)}\n'
-    return ''
+
+def option_from_config(name: str, config_path: List[str]) -> str:
+    value = config(*config_path)
+    if value is None:
+        return ""
+    if isinstance(value, bool):
+        value = bool_to_yes_no(value)
+    return f"{name}: {config(*config_path)}\n"
 
 
 def install_bootloader() -> None:
@@ -439,8 +448,8 @@ def install_bootloader() -> None:
         profiles += [(profile, get_gens(profile))]
 
     timeout = config('timeout')
-    editor_enabled = 'yes' if config('enableEditor') else 'no'
-    hash_mismatch_panic = 'yes' if config('panicOnChecksumMismatch') else 'no'
+    editor_enabled = bool_to_yes_no(config('enableEditor'))
+    hash_mismatch_panic = bool_to_yes_no(config('panicOnChecksumMismatch'))
 
     last_gen = get_gens()[-1]
     last_gen_json = json.load(open(os.path.join(get_system_path('system', last_gen), 'boot.json'), 'r'))

nixos/modules/system/boot/systemd/journald-gateway.nix

@@ -8,7 +8,7 @@
 let
   cfg = config.services.journald.gateway;
 
-  cliArgs = lib.cli.toGNUCommandLineShell { } {
+  cliArgs = lib.cli.toCommandLineShellGNU { } {
     # If either of these are null / false, they are not passed in the command-line
     inherit (cfg)
       cert

nixos/modules/system/boot/systemd/journald-remote.nix

@@ -9,7 +9,7 @@ let
   cfg = config.services.journald.remote;
   format = pkgs.formats.systemd { };
 
-  cliArgs = lib.cli.toGNUCommandLineShell { } {
+  cliArgs = lib.cli.toCommandLineShellGNU { } {
     inherit (cfg) output;
     # "-3" specifies the file descriptor from the .socket unit.
     "listen-${cfg.listen}" = "-3";

nixos/modules/virtualisation/containerd.nix

@@ -90,7 +90,7 @@ in
         ++ lib.optional config.boot.zfs.enabled config.boot.zfs.package;
       serviceConfig = {
         ExecStart = ''${pkgs.containerd}/bin/containerd ${
-          lib.concatStringsSep " " (lib.cli.toGNUCommandLine { } cfg.args)
+          lib.concatStringsSep " " (lib.cli.toCommandLineGNU { } cfg.args)
         }'';
         Delegate = "yes";
         KillMode = "process";

nixos/modules/virtualisation/virtualbox-image.nix

@@ -252,8 +252,8 @@ in
           --ostype ${if pkgs.stdenv.hostPlatform.system == "x86_64-linux" then "Linux26_64" else "Linux26"}
         VBoxManage modifyvm "$vmName" \
           --memory ${toString cfg.memorySize} \
-          ${lib.cli.toGNUCommandLineShell { } cfg.params}
-        VBoxManage storagectl "$vmName" ${lib.cli.toGNUCommandLineShell { } cfg.storageController}
+          ${lib.cli.toCommandLineShellGNU { } cfg.params}
+        VBoxManage storagectl "$vmName" ${lib.cli.toCommandLineShellGNU { } cfg.storageController}
         VBoxManage storageattach "$vmName" --storagectl ${cfg.storageController.name} --port 0 --device 0 --type hdd \
           --medium disk.vdi
         ${lib.optionalString (cfg.extraDisk != null) ''

nixos/tests/limine/secure-boot.nix

@@ -26,10 +26,12 @@
       boot.loader.limine.secureBoot.enable = true;
       boot.loader.limine.secureBoot.createAndEnrollKeys = true;
       boot.loader.timeout = 0;
+
+      environment.systemPackages = [ pkgs.mokutil ];
     };
 
   testScript = ''
     machine.start()
-    assert "Secure Boot: enabled (user)" in machine.succeed("bootctl status")
+    assert "SecureBoot enabled" in machine.succeed("mokutil --sb-state")
   '';
 }

pkgs/applications/editors/vscode/extensions/elijah-potter.harper/default.nix

@@ -13,7 +13,7 @@ vscode-utils.buildVscodeMarketplaceExtension {
     name = "harper";
     publisher = "elijah-potter";
     version = harper.version;
-    hash = "sha256-m9PN1BZf6rLrNnX8meX2TjGx8zGLl0GgnHEgQirh9Oc=";
+    hash = "sha256-kWO3Gd2g5IsMCg+rvlQ3LpU/g5hUrpCsg3+vmOO0mnA=";
   };
 
   nativeBuildInputs = [

pkgs/applications/networking/browsers/chromium/info.json

@@ -808,7 +808,7 @@
     }
   },
   "ungoogled-chromium": {
-    "version": "141.0.7390.107",
+    "version": "141.0.7390.122",
     "deps": {
       "depot_tools": {
         "rev": "3f41e54ae17d53d4a39feecad64c3d3e6871b219",
@@ -820,16 +820,16 @@
         "hash": "sha256-WERLGrReUATmn3RhxtmyZcJBxdIY/WZqBDranCLDYEg="
       },
       "ungoogled-patches": {
-        "rev": "141.0.7390.107-1",
-        "hash": "sha256-IQoIcOlFhbSBpmZ6bpoX43XMPrKWRVExETjBBT4TCs0="
+        "rev": "141.0.7390.122-1",
+        "hash": "sha256-xFJdvGHLMXNcotHTamh9Q4M2/ctoJ3b5ORHBWtZOY90="
       },
       "npmHash": "sha256-i1eQ4YlrWSgY522OlFtGDDPmxE2zd1hDM03AzR8RafE="
     },
     "DEPS": {
       "src": {
         "url": "https://chromium.googlesource.com/chromium/src.git",
-        "rev": "1c008349f76ff3a317bf28316fc5008c0120deb4",
-        "hash": "sha256-NRqWOkGrg/Y4wZi4WQDJ6CvsDpeseVgTc/iAnuPRy/U=",
+        "rev": "b477534e7e10d193e916cd4e2967c589383625b2",
+        "hash": "sha256-3sVHRzERwlLzXl2qSn2Lil4U4d6N63MUOomSUrjy2YY=",
         "recompress": true
       },
       "src/third_party/clang-format/script": {

pkgs/build-support/writers/scripts.nix

@@ -812,7 +812,13 @@ rec {
       strip ? true,
     }:
     let
-      nimCompileCmdArgs = lib.cli.toGNUCommandLineShell { optionValueSeparator = ":"; } (
+      optionFormat = optionName: {
+        option = "--${optionName}";
+        sep = ":";
+        explicitBool = false;
+      };
+
+      nimCompileCmdArgs = lib.cli.toCommandLineShell optionFormat (
         {
           d = "release";
           nimcache = ".";

pkgs/by-name/an/anki/package.nix

@@ -14,7 +14,7 @@
   nixosTests,
   nodejs,
   jq,
-  protobuf,
+  protobuf_31,
   python3,
   python3Packages,
   qt6,
@@ -176,7 +176,7 @@ python3Packages.buildPythonApplication rec {
     # https://github.com/ankitects/anki/blob/24.11/docs/linux.md#packaging-considerations
     OFFLINE_BUILD = "1";
     NODE_BINARY = lib.getExe nodejs;
-    PROTOC_BINARY = lib.getExe protobuf;
+    PROTOC_BINARY = lib.getExe protobuf_31;
     PYTHON_BINARY = lib.getExe python3;
     UV_BINARY = lib.getExe uv;
     UV_NO_MANAGED_PYTHON = "1";

pkgs/by-name/an/antora/test/default.nix

@@ -43,7 +43,7 @@ stdenvNoCC.mkDerivation {
       # The --to-dir and --ui-bundle-url options are not included in the
       # playbook due to Antora and Nix limitations.
       antora ${
-        lib.cli.toGNUCommandLineShell { } {
+        lib.cli.toCommandLineShellGNU { } {
           cache-dir = "$(mktemp --directory)";
           extension = if antora-lunr-extension-test then antora-lunr-extension else false;
           to-dir = placeholder "out";

pkgs/by-name/co/containerlab/package.nix

@@ -8,16 +8,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "containerlab";
-  version = "0.70.2";
+  version = "0.71.0";
 
   src = fetchFromGitHub {
     owner = "srl-labs";
     repo = "containerlab";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-QBv0SZ7XxVc0yWbOxPKdfzk9AKYlMJyeZwpAx1jbamk=";
+    hash = "sha256-wfkkRQ0F8G57pEuyLP1qjoZGkDNW/Ix4Nh3ZKoWK+w8=";
   };
 
-  vendorHash = "sha256-XttJ/GXhNKVHLR33A/o3N3OYHsyKWHBhD5QOz0AlfFk=";
+  vendorHash = "sha256-s5WBCYOdNooygEL0AbhIqZLeWd4gnpAvWjJu38QTKYU=";
 
   nativeBuildInputs = [
     installShellFiles
@@ -37,9 +37,10 @@ buildGoModule (finalAttrs: {
     export USER="runner"
   '';
 
-  # TestVerifyLinks wants to use docker.sock which is not available in the Nix build env
-  # KernelModulesLoaded wants to use /proc/modules which is not available in Nix build env
   checkFlags = [
+    # Not available in sandbox:
+    # - docker.sock needed for TestVerifyLinks
+    # - /proc/modules needed for KernelModulesLoaded
     "-skip=^TestVerifyLinks$|^TestIsKernelModuleLoaded$"
   ];
 
@@ -60,7 +61,7 @@ buildGoModule (finalAttrs: {
     changelog = "https://github.com/srl-labs/containerlab/releases/tag/v${finalAttrs.version}";
     license = lib.licenses.bsd3;
     platforms = lib.platforms.linux;
-    maintainers = [ ];
+    maintainers = with lib.maintainers; [ _0x4A6F ];
     mainProgram = "containerlab";
   };
 })

pkgs/by-name/de/dependabot-cli/package.nix

@@ -12,20 +12,20 @@
 }:
 let
   pname = "dependabot-cli";
-  version = "1.76.0";
+  version = "1.76.1";
 
   # `tag` is what `dependabot` uses to find the relevant docker images.
   tag = "nixpkgs-dependabot-cli-${version}";
 
   # Get these hashes from
   # nix run nixpkgs#nix-prefetch-docker -- --image-name ghcr.io/github/dependabot-update-job-proxy/dependabot-update-job-proxy --image-tag latest --final-image-name dependabot-update-job-proxy --final-image-tag ${tag}
-  updateJobProxy.imageDigest = "sha256:42b2a171891f4667d9a443cbfdc5f10a58e5b5d7f1b9eae6c12ec9815bec72fd";
-  updateJobProxy.hash = "sha256-+GcGyip8cgVBZeji6Zn3oN8Mc3xZvASohbPVNUbHOgA=";
+  updateJobProxy.imageDigest = "sha256:d40c689e947e78ecdaccb3da1d070a458b7f1d1cfb3052cf5751e43583d89560";
+  updateJobProxy.hash = "sha256-6VhY+7pg6+LXQ1F58ghKdabqpgPcbxWI91KNz6FntJA=";
 
   # Get these hashes from
   # nix run nixpkgs#nix-prefetch-docker -- --image-name ghcr.io/dependabot/dependabot-updater-github-actions --image-tag latest --final-image-name dependabot-updater-github-actions --final-image-tag ${tag}
-  updaterGitHubActions.imageDigest = "sha256:d26d4ce071684b63d935c550552ae0d129f845254cb1e2f8635f15c62f43319e";
-  updaterGitHubActions.hash = "sha256-21E8q1+cwYlD8FL5njGhpsGRd/YkGQNS/y0howQFp6g=";
+  updaterGitHubActions.imageDigest = "sha256:e2cfbdde4014cd17cd85b9b411cb87a41d985bc27569e5fe1457ec68d16400b1";
+  updaterGitHubActions.hash = "sha256-VC+F0139+7n6rBLAw6MCgMf6yHCci7blaeLkHJ22fVc=";
 in
 buildGoModule {
   inherit pname version;
@@ -34,10 +34,10 @@ buildGoModule {
     owner = "dependabot";
     repo = "cli";
     rev = "v${version}";
-    hash = "sha256-fSb2zzddwGJ1r9NhPEhE1WCndyoBK4VLOP3CmQUcjy0=";
+    hash = "sha256-i/Kr+69ws3HDWS+cQSn3cZzvW6GzKT+Avd3fZfvSA/c=";
   };
 
-  vendorHash = "sha256-xdouoPEPPhHcXNWxMdcdxVQsgRlFXBXjyZQ7CcROA4U=";
+  vendorHash = "sha256-dD48OKpuGAJAro7qV4tqpf/uENV2X1VQ2kUvAuJLXc0=";
 
   ldflags = [
     "-s"

pkgs/by-name/ff/fflogs/package.nix

@@ -6,10 +6,10 @@
 
 let
   pname = "fflogs";
-  version = "8.17.71";
+  version = "8.17.83";
   src = fetchurl {
     url = "https://github.com/RPGLogs/Uploaders-fflogs/releases/download/v${version}/fflogs-v${version}.AppImage";
-    hash = "sha256-ey2hfndsLxViy7dYtIwfUgsk9kQycgBpsHGoBwO9LUs=";
+    hash = "sha256-orVUCf7+OzJQ561maIYEBKgSgLuKfuSXFGMLZV/HMjM=";
   };
   extracted = appimageTools.extractType2 { inherit pname version src; };
 in

pkgs/by-name/fl/flare-signal/package.nix

@@ -28,29 +28,29 @@ let
     owner = "whisperfish";
     repo = "presage";
     # match with commit from Cargo.toml
-    rev = "31a418d0a35ad746590165520b652d6adb7a0384";
-    hash = "sha256-Mf8RvwfrVpbsUj+mA9L7IjnbMKoZDjZKYor2iqFWSx4=";
+    rev = "ed011688fc8d9c0ee07c3d44743c138c1fa4dfda";
+    hash = "sha256-NTSxSOAmA9HOH52GPwl6pL0MQly+NTfJDk7k7TUP9II=";
   };
 in
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "flare";
   # NOTE: also update presage commit
-  version = "0.17.1";
+  version = "0.17.2";
 
   src = fetchFromGitLab {
     domain = "gitlab.com";
     owner = "schmiddi-on-mobile";
     repo = "flare";
     tag = finalAttrs.version;
-    hash = "sha256-3SYsVF3aUJYSr3pM/BGXYExQwbwckExYwEcF3cZ/94g=";
+    hash = "sha256-Nezg+fNC29blGhyetJqs9l6/IL08b7tHn+D3pzKj26I=";
   };
 
   cargoDeps =
     let
       cargoDeps = rustPlatform.fetchCargoVendor {
         inherit (finalAttrs) pname version src;
-        hash = "sha256-cxhnfdYcsyXxvTpGGXm2rK3cKVsNk66FYif7/c16NhU=";
+        hash = "sha256-Y6jY588axEcqv0WN6Fcm8Kd5yd2JXvKwMd8h1L6J9TE=";
       };
     in
     # Replace with simpler solution:

pkgs/by-name/fr/fritz-exporter/package.nix

@@ -6,14 +6,14 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "fritz-exporter";
-  version = "2.5.2";
+  version = "2.6.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "pdreker";
     repo = "fritz_exporter";
     tag = "fritzexporter-v${version}";
-    hash = "sha256-xQLTI6b8X22aU6dj7Tmkzxn7vE4y8r/djUetG3Qg9Qw=";
+    hash = "sha256-m2jDQN6c3S4xDIrmRFdD+stwutBxcespLKZvxp1VC0I=";
   };
 
   postPatch = ''
@@ -43,6 +43,9 @@ python3.pkgs.buildPythonApplication rec {
     pytestCheckHook
   ];
 
+  # Required for tests
+  __darwinAllowLocalNetworking = true;
+
   meta = {
     changelog = "https://github.com/pdreker/fritz_exporter/blob/${src.tag}/CHANGELOG.md";
     description = "Prometheus exporter for Fritz!Box home routers";

pkgs/by-name/gi/gitaly/package.nix

@@ -7,7 +7,7 @@
 }:
 
 let
-  version = "18.5.0";
+  version = "18.5.1";
   package_version = "v${lib.versions.major version}";
   gitaly_package = "gitlab.com/gitlab-org/gitaly/${package_version}";
 
@@ -21,7 +21,7 @@ let
       owner = "gitlab-org";
       repo = "gitaly";
       rev = "v${version}";
-      hash = "sha256-kVFO8brtXWWGU2nWTtHR1q5RrTIXy2ssra9YjtWsglU=";
+      hash = "sha256-719FC9+OBX9Li9gkIpusFoZrpMyeDwCsoWxt9pfhI1A=";
     };
 
     vendorHash = "sha256-I2YMn84wEAY+Z02bmkyP/b0eix7FW3hP/noyEKYsEaQ=";

pkgs/by-name/gi/gitlab-pages/package.nix

@@ -6,14 +6,14 @@
 
 buildGoModule rec {
   pname = "gitlab-pages";
-  version = "18.5.0";
+  version = "18.5.1";
 
   # nixpkgs-update: no auto update
   src = fetchFromGitLab {
     owner = "gitlab-org";
     repo = "gitlab-pages";
     rev = "v${version}";
-    hash = "sha256-7jMiKN2L4rF4YyqoJW8pzj5rP5g6ScwZ3qkY+OCZOZ8=";
+    hash = "sha256-UrVH5Ky5aiqquQ2o6bSkqLD4ULl9/vUViOoACantT1Q=";
   };
 
   vendorHash = "sha256-VWD/AXqEVWo7G9p1q1BM2LUNwAFmkPm+Gm2s9EPu6nM=";

pkgs/by-name/gi/gitlab/data.json

@@ -1,16 +1,16 @@
 {
-  "version": "18.5.0",
-  "repo_hash": "0r1q6byqv3zziwsw63z7km5jjap7q6222j91lnr048w6cf425n1w",
+  "version": "18.5.1",
+  "repo_hash": "0h80pzsfn6lb8mz8igbpkmazzj3kkdwhrqxazjq6g9zrsqsvydx5",
   "yarn_hash": "16f7r4v4mjjdsfbzy5vy1g18p0l3gnjvfvzrl2xrxdibx7a3b4xs",
   "frontend_islands_yarn_hash": "0kks9hzm5fq3fss9ys8zxls3d3860l1fvsfcrbhf9rccmwvmjn3l",
   "owner": "gitlab-org",
   "repo": "gitlab",
-  "rev": "v18.5.0-ee",
+  "rev": "v18.5.1-ee",
   "passthru": {
-    "GITALY_SERVER_VERSION": "18.5.0",
-    "GITLAB_PAGES_VERSION": "18.5.0",
+    "GITALY_SERVER_VERSION": "18.5.1",
+    "GITLAB_PAGES_VERSION": "18.5.1",
     "GITLAB_SHELL_VERSION": "14.45.3",
     "GITLAB_ELASTICSEARCH_INDEXER_VERSION": "5.9.4",
-    "GITLAB_WORKHORSE_VERSION": "18.5.0"
+    "GITLAB_WORKHORSE_VERSION": "18.5.1"
   }
 }

pkgs/by-name/gi/gitlab/gitlab-workhorse/default.nix

@@ -10,7 +10,7 @@ in
 buildGoModule rec {
   pname = "gitlab-workhorse";
 
-  version = "18.5.0";
+  version = "18.5.1";
 
   # nixpkgs-update: no auto update
   src = fetchFromGitLab {

pkgs/by-name/gi/gitlab/rubyEnv/Gemfile

@@ -331,7 +331,8 @@ gem 'js_regex', '~> 3.8', feature_category: :shared
 gem 'device_detector', feature_category: :shared
 
 # Redis
-gem 'redis', '~> 5.4.0', feature_category: :redis
+# Do NOT upgrade until Rails is upgraded with a version that contains https://github.com/rails/rails/pull/55359.
+gem 'redis', '= 5.4.0', feature_category: :redis
 gem 'redis-client', '~> 0.25', feature_category: :redis
 gem 'redis-cluster-client', '~> 0.13', feature_category: :redis
 gem 'redis-clustering', '~> 5.4.0', feature_category: :redis

pkgs/by-name/gi/gitlab/rubyEnv/Gemfile.lock

@@ -1624,7 +1624,7 @@ GEM
       json
     recursive-open-struct (1.1.3)
     redcarpet (3.6.0)
-    redis (5.4.1)
+    redis (5.4.0)
       redis-client (>= 0.22.0)
     redis-actionpack (5.5.0)
       actionpack (>= 5)
@@ -1634,8 +1634,8 @@ GEM
       connection_pool
     redis-cluster-client (0.13.5)
       redis-client (~> 0.24)
-    redis-clustering (5.4.1)
-      redis (= 5.4.1)
+    redis-clustering (5.4.0)
+      redis (= 5.4.0)
       redis-cluster-client (>= 0.10.0)
     redis-namespace (1.11.0)
       redis (>= 4)
@@ -2364,7 +2364,7 @@ DEPENDENCIES
   rbtrace (~> 0.4)
   re2 (~> 2.15)
   recaptcha (~> 5.12)
-  redis (~> 5.4.0)
+  redis (= 5.4.0)
   redis-actionpack (~> 5.5.0)
   redis-client (~> 0.25)
   redis-cluster-client (~> 0.13)
@@ -2452,4 +2452,4 @@ DEPENDENCIES
   yard (~> 0.9)
 
 BUNDLED WITH
-   2.7.1
+   2.7.2

pkgs/by-name/gi/gitlab/rubyEnv/gemset.nix

@@ -7528,10 +7528,10 @@ src: {
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "1bpsh5dbvybsa8qnv4dg11a6f2zn4sndarf7pk4iaayjgaspbrmm";
+      sha256 = "0syhyw1bp9nbb0fvcmm58y1c6iav6xw6b4bzjz1rz2j1d7c012br";
       type = "gem";
     };
-    version = "5.4.1";
+    version = "5.4.0";
   };
   redis-actionpack = {
     dependencies = [
@@ -7579,10 +7579,10 @@ src: {
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "1sj4b3j7i3rb5a276g7yyd95kji4j9sl6wmqfgpz39gx06qlni47";
+      sha256 = "0fsnfi15xiy8sal6av11fqfjmdmjpy93amf790i0zwqcf1iq1qbw";
       type = "gem";
     };
-    version = "5.4.1";
+    version = "5.4.0";
   };
   redis-namespace = {
     dependencies = [ "redis" ];

pkgs/by-name/go/goreleaser/package.nix

@@ -10,16 +10,16 @@
 }:
 buildGo125Module rec {
   pname = "goreleaser";
-  version = "2.12.5";
+  version = "2.12.6";
 
   src = fetchFromGitHub {
     owner = "goreleaser";
     repo = "goreleaser";
     rev = "v${version}";
-    hash = "sha256-EHJ1ARzk6BD5D121u+1UTe90oLOovKKD+LQWLIj81Jk=";
+    hash = "sha256-ZYlT/CkYMPZgVNR0uaDPbLT7WH5EDcUeTwUPFM6fZOg=";
   };
 
-  vendorHash = "sha256-J/OwvPxC8wz/91sWWUBNkW5E71m8EPjTq3h/MOxT/3k=";
+  vendorHash = "sha256-Zv13xWe/wwmq+2lqvsX6oWIyEYlCojgIgH/cvr5rSOI=";
 
   ldflags = [
     "-s"

pkgs/by-name/gp/gpauth/package.nix

@@ -11,18 +11,18 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "gpauth";
-  version = "2.4.1";
+  version = "2.4.6";
 
   src = fetchFromGitHub {
     owner = "yuezk";
     repo = "GlobalProtect-openconnect";
     rev = "v${version}";
-    hash = "sha256-MY4JvftrC6sR8M0dFvnGZOkvHIhPRcyct9AG/8527gw=";
+    hash = "sha256-AxerhMQBgEgeecKAhedokMdpra1C9iqhutPrdAQng6Q=";
   };
 
   buildAndTestSubdir = "apps/gpauth";
 
-  cargoHash = "sha256-8LSGuRnWRWeaY6t25GdZ2y4hGIJ+mP3UBXRjcvPuD6U=";
+  cargoHash = "sha256-oPnBpwE8bdYgve1Dh64WNjWXClSRoHL5PVwrB1ovU6Y=";
 
   nativeBuildInputs = [
     perl

pkgs/by-name/gp/gpclient/package.nix

@@ -8,6 +8,11 @@
   perl,
   pkg-config,
   vpnc-scripts,
+  glib,
+  pango,
+  cairo,
+  atk,
+  gtk3,
 }:
 
 rustPlatform.buildRustPackage {
@@ -32,6 +37,11 @@ rustPlatform.buildRustPackage {
     openconnect
     openssl
     glib-networking
+    glib
+    pango
+    cairo
+    atk
+    gtk3
   ];
 
   preConfigure = ''

pkgs/by-name/gr/grav/package.nix

@@ -6,7 +6,7 @@
 }:
 
 let
-  version = "1.7.49.5";
+  version = "1.7.50.2";
 in
 stdenvNoCC.mkDerivation {
   pname = "grav";
@@ -14,7 +14,7 @@ stdenvNoCC.mkDerivation {
 
   src = fetchzip {
     url = "https://github.com/getgrav/grav/releases/download/${version}/grav-admin-v${version}.zip";
-    hash = "sha256-zhjsYWma0qze8zdzX01EauzMONeEC6TRkhdQJUoJEUQ=";
+    hash = "sha256-UaaROMdUNFX6gcbJnfRn9CopZ3nuIMD91CkHnujtnE4=";
   };
 
   patches = [

pkgs/by-name/ha/harper/package.nix

@@ -7,18 +7,18 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "harper";
-  version = "0.65.0";
+  version = "0.68.0";
 
   src = fetchFromGitHub {
     owner = "Automattic";
     repo = "harper";
     rev = "v${version}";
-    hash = "sha256-y2oYEJTZWZ7Rc7ZLjYUh3Cy9dtznGLhIXzJ6D0JUIGw=";
+    hash = "sha256-NYbTz/+APVGU8P0edXz84YBbBWBc8k7rhDXpRxH7Pjc=";
   };
 
   buildAndTestSubdir = "harper-ls";
 
-  cargoHash = "sha256-o6RFBCvPn3AH3mMI3guHziqOcYN99o8yk5b6VXWoepI=";
+  cargoHash = "sha256-3Vk8nQPUxD1D6AG6PjJwju5xolvfVucfYL9i6l9atOk=";
 
   passthru.updateScript = nix-update-script { };
 

pkgs/by-name/ju/julec/hook.nix

@@ -0,0 +1,15 @@
+{
+  julec,
+  clang,
+  makeSetupHook,
+}:
+
+makeSetupHook {
+  name = "julec-hook";
+
+  propagatedBuildInputs = [ julec ];
+
+  meta = {
+    inherit (julec.meta) maintainers;
+  };
+} ./hook.sh

pkgs/by-name/ju/julec/hook.sh

@@ -0,0 +1,80 @@
+# shellcheck shell=bash disable=SC2154,SC2034
+
+julecSetEnv() {
+  if [ -z "$JULE_SRC_DIR" ]; then
+    export JULE_SRC_DIR='./src'
+  fi
+  if [ -z "$JULE_OUT_DIR" ]; then
+    export JULE_OUT_DIR='./bin'
+  fi
+  if [ -z "$JULE_OUT_NAME" ]; then
+    export JULE_OUT_NAME='output'
+  fi
+  if [ -z "$JULE_TEST_DIR" ]; then
+    export JULE_TEST_DIR="$JULE_SRC_DIR"
+  fi
+  if [ -z "$JULE_TEST_OUT_DIR" ]; then
+    export JULE_TEST_OUT_DIR="$JULE_OUT_DIR"
+  fi
+  if [ -z "$JULE_TEST_OUT_NAME" ]; then
+    export JULE_TEST_OUT_NAME="$JULE_OUT_NAME-test"
+  fi
+}
+
+julecBuildHook() {
+  echo "Executing julecBuildHook"
+
+  runHook preBuild
+
+  julecSetEnv
+  mkdir -p "$JULE_OUT_DIR"
+  julec --opt L2 -p -o "$JULE_OUT_DIR/$JULE_OUT_NAME" "$JULE_SRC_DIR"
+
+  runHook postBuild
+
+  echo "Finished julecBuildHook"
+}
+
+julecCheckHook() {
+  echo "Executing julecCheckHook"
+
+  runHook preCheck
+
+  echo "Building tests..."
+
+  julecSetEnv
+  mkdir -p "$JULE_TEST_OUT_DIR"
+  julec test -o "$JULE_TEST_OUT_DIR/$JULE_TEST_OUT_NAME" "$JULE_TEST_DIR"
+
+  echo "Running tests..."
+
+  "$JULE_TEST_OUT_DIR/$JULE_TEST_OUT_NAME"
+
+  runHook postCheck
+
+  echo "Finished julecCheckHook"
+}
+
+julecInstallHook() {
+  echo "Executing julecInstallHook"
+
+  runHook preInstall
+
+  julecSetEnv
+  mkdir -p "$out/bin"
+  cp -r "$JULE_OUT_DIR/$JULE_OUT_NAME" "$out/bin/"
+
+  runHook postInstall
+
+  echo "Finished julecInstallHook"
+}
+
+if [ -z "${dontUseJulecBuild-}" ] && [ -z "${buildPhase-}" ]; then
+  buildPhase=julecBuildHook
+fi
+if [ -z "${dontUseJulecCheck-}" ] && [ -z "${checkPhase-}" ]; then
+  checkPhase=julecCheckHook
+fi
+if [ -z "${dontUseJulecInstall-}" ] && [ -z "${installPhase-}" ]; then
+  installPhase=julecInstallHook
+fi

pkgs/by-name/ju/julec/package.nix

@@ -1,6 +1,7 @@
 {
   lib,
   clangStdenv,
+  callPackage,
   fetchFromGitHub,
 }:
 
@@ -93,6 +94,12 @@ clangStdenv.mkDerivation (finalAttrs: {
     runHook postInstall
   '';
 
+  passthru = {
+    # see doc/hooks/julec.section.md
+    hook = callPackage ./hook.nix { julec = finalAttrs.finalPackage; };
+    tests.hello-jule = callPackage ./test { julec = finalAttrs.finalPackage; };
+  };
+
   meta = {
     description = "Jule Programming Language Compiler";
     longDescription = ''

pkgs/by-name/ju/julec/test/default.nix

@@ -0,0 +1,19 @@
+{
+  julec,
+  clangStdenv,
+}:
+
+clangStdenv.mkDerivation (finalAttrs: {
+  pname = "hello-jule";
+  inherit (julec) version;
+
+  src = ./hello-jule;
+
+  nativeBuildInputs = [ julec.hook ];
+
+  doCheck = true;
+
+  meta = {
+    inherit (julec.meta) platforms;
+  };
+})

pkgs/by-name/ju/julec/test/hello-jule/src/_test.jule

@@ -0,0 +1,8 @@
+use "std/testing"
+
+#test
+fn testPi(t: &testing::T) {
+		if getPi() != 3.14 {
+				t.Errorf("PI not precise enough")
+		}
+}

pkgs/by-name/ju/julec/test/hello-jule/src/main.jule

@@ -0,0 +1,7 @@
+fn main() {
+		println("Hello, Jule!");
+}
+
+fn getPi(): f64 {
+		ret 3.14;
+}

pkgs/by-name/kr/krunkit/package.nix

@@ -0,0 +1,58 @@
+{
+  cargo,
+  darwin,
+  pkg-config,
+  rustc,
+  stdenv,
+  fetchFromGitHub,
+  libepoxy,
+  libkrun-efi,
+  rustPlatform,
+  lib,
+  nix-update-script,
+}:
+stdenv.mkDerivation (finalAttrs: {
+  pname = "krunkit";
+  version = "1.0.0";
+
+  src = fetchFromGitHub {
+    owner = "containers";
+    repo = "krunkit";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-dsEZZiLgHyd6xeXZCdDd4zsxzwQeIhAK+lewY2ZfvpY=";
+  };
+
+  cargoDeps = rustPlatform.fetchCargoVendor {
+    inherit (finalAttrs) src;
+    hash = "sha256-i0cC3aOEqcvOcwTPbM6AazMzd8Q+QLwuhnvPGv3ntsc=";
+  };
+
+  nativeBuildInputs = [
+    cargo
+    darwin.sigtool
+    pkg-config
+    rustc
+    rustPlatform.bindgenHook
+    rustPlatform.cargoSetupHook
+  ];
+
+  buildInputs = [
+    libepoxy
+    libkrun-efi
+  ];
+
+  makeFlags = [ "PREFIX=${placeholder "out"}" ];
+
+  # This is necessary in order for the binary to keep its entitlements
+  dontStrip = true;
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "Launch configurable virtual machines with libkrun";
+    homepage = "https://github.com/containers/krunkit";
+    license = lib.licenses.asl20;
+    platforms = [ "aarch64-darwin" ];
+    maintainers = with lib.maintainers; [ quinneden ];
+  };
+})

pkgs/by-name/la/laravel/composer.lock

@@ -167,7 +167,7 @@
         },
         {
             "name": "illuminate/collections",
-            "version": "v12.34.0",
+            "version": "v12.35.0",
             "source": {
                 "type": "git",
                 "url": "https://github.com/illuminate/collections.git",
@@ -226,7 +226,7 @@
         },
         {
             "name": "illuminate/conditionable",
-            "version": "v12.34.0",
+            "version": "v12.35.0",
             "source": {
                 "type": "git",
                 "url": "https://github.com/illuminate/conditionable.git",
@@ -272,7 +272,7 @@
         },
         {
             "name": "illuminate/contracts",
-            "version": "v12.34.0",
+            "version": "v12.35.0",
             "source": {
                 "type": "git",
                 "url": "https://github.com/illuminate/contracts.git",
@@ -320,7 +320,7 @@
         },
         {
             "name": "illuminate/filesystem",
-            "version": "v12.34.0",
+            "version": "v12.35.0",
             "source": {
                 "type": "git",
                 "url": "https://github.com/illuminate/filesystem.git",
@@ -387,7 +387,7 @@
         },
         {
             "name": "illuminate/macroable",
-            "version": "v12.34.0",
+            "version": "v12.35.0",
             "source": {
                 "type": "git",
                 "url": "https://github.com/illuminate/macroable.git",
@@ -433,16 +433,16 @@
         },
         {
             "name": "illuminate/support",
-            "version": "v12.34.0",
+            "version": "v12.35.0",
             "source": {
                 "type": "git",
                 "url": "https://github.com/illuminate/support.git",
-                "reference": "89291f59ef6c170c00f10a41c566c49ee32ca09a"
+                "reference": "eefcefcf6edff2c986f746f10fad3da3e79a1223"
             },
             "dist": {
                 "type": "zip",
-                "url": "https://api.github.com/repos/illuminate/support/zipball/89291f59ef6c170c00f10a41c566c49ee32ca09a",
-                "reference": "89291f59ef6c170c00f10a41c566c49ee32ca09a",
+                "url": "https://api.github.com/repos/illuminate/support/zipball/eefcefcf6edff2c986f746f10fad3da3e79a1223",
+                "reference": "eefcefcf6edff2c986f746f10fad3da3e79a1223",
                 "shasum": ""
             },
             "require": {
@@ -508,7 +508,7 @@
                 "issues": "https://github.com/laravel/framework/issues",
                 "source": "https://github.com/laravel/framework"
             },
-            "time": "2025-10-13T21:11:33+00:00"
+            "time": "2025-10-18T13:23:12+00:00"
         },
         {
             "name": "laravel/prompts",
@@ -2262,16 +2262,16 @@
         },
         {
             "name": "nikic/php-parser",
-            "version": "v5.6.1",
+            "version": "v5.6.2",
             "source": {
                 "type": "git",
                 "url": "https://github.com/nikic/PHP-Parser.git",
-                "reference": "f103601b29efebd7ff4a1ca7b3eeea9e3336a2a2"
+                "reference": "3a454ca033b9e06b63282ce19562e892747449bb"
             },
             "dist": {
                 "type": "zip",
-                "url": "https://api.github.com/repos/nikic/PHP-Parser/zipball/f103601b29efebd7ff4a1ca7b3eeea9e3336a2a2",
-                "reference": "f103601b29efebd7ff4a1ca7b3eeea9e3336a2a2",
+                "url": "https://api.github.com/repos/nikic/PHP-Parser/zipball/3a454ca033b9e06b63282ce19562e892747449bb",
+                "reference": "3a454ca033b9e06b63282ce19562e892747449bb",
                 "shasum": ""
             },
             "require": {
@@ -2314,9 +2314,9 @@
             ],
             "support": {
                 "issues": "https://github.com/nikic/PHP-Parser/issues",
-                "source": "https://github.com/nikic/PHP-Parser/tree/v5.6.1"
+                "source": "https://github.com/nikic/PHP-Parser/tree/v5.6.2"
             },
-            "time": "2025-08-13T20:13:15+00:00"
+            "time": "2025-10-21T19:32:17+00:00"
         },
         {
             "name": "phar-io/manifest",

pkgs/by-name/la/laravel/package.nix

@@ -7,19 +7,19 @@
 }:
 php.buildComposerProject2 (finalAttrs: {
   pname = "laravel";
-  version = "5.21.0";
+  version = "5.22.0";
 
   src = fetchFromGitHub {
     owner = "laravel";
     repo = "installer";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-2UfLzB3m/WjzJC7h/wYX9MHCUQFCVWRlXWVUpmDtUoE=";
+    hash = "sha256-kC6RD+rtjHXrOGhF/E9l8/eArTnDrXIw3D6lnDpsl7I=";
   };
 
   nativeBuildInputs = [ makeWrapper ];
 
   composerLock = ./composer.lock;
-  vendorHash = "sha256-My17A7xl2HacrVP5SMzYpSar6cJ0MONznkJIPLFTII8=";
+  vendorHash = "sha256-s+wBvGnDyKbzniZoKJ4wUcv0FCo7XnrD6KYvYhllBFM=";
 
   # Adding npm (nodejs) and php composer to path
   postInstall = ''

pkgs/by-name/li/libkrun-efi/package.nix

@@ -0,0 +1,117 @@
+{
+  cargo,
+  fetchFromGitHub,
+  fetchurl,
+  fixDarwinDylibNames,
+  lib,
+  libepoxy,
+  libkrun-efi,
+  moltenvk,
+  pkg-config,
+  rustc,
+  rustPlatform,
+  rutabaga_gfx,
+  nix-update-script,
+  stdenv,
+  buildPackages,
+  meson,
+  ninja,
+  vulkan-headers,
+  withGpu ? true,
+}:
+let
+  virglrenderer = stdenv.mkDerivation (finalAttrs: {
+    pname = "virglrenderer";
+    version = "0.10.4d-krunkit";
+
+    src = fetchurl {
+      url = "https://gitlab.freedesktop.org/slp/virglrenderer/-/archive/${finalAttrs.version}/virglrenderer-${finalAttrs.version}.tar.bz2";
+      hash = "sha256-M/buj97QUeY6CYeW0VICD5F6FBPi9ATPGHpNA48xL3o=";
+    };
+
+    separateDebugInfo = true;
+
+    buildInputs = [
+      libepoxy
+      moltenvk
+      vulkan-headers
+    ];
+
+    nativeBuildInputs = [
+      meson
+      ninja
+      pkg-config
+      (buildPackages.python3.withPackages (ps: [ ps.pyyaml ]))
+    ];
+
+    mesonFlags = [
+      (lib.mesonBool "render-server" false)
+      (lib.mesonBool "venus" true)
+      (lib.mesonEnable "drm" false)
+    ];
+
+    meta = {
+      description = "Virtual 3D GPU library that allows a qemu guest to use the host GPU for accelerated 3D rendering";
+      mainProgram = "virgl_test_server";
+      homepage = "https://gitlab.freedesktop.org/slp/virglrenderer";
+      license = lib.licenses.mit;
+      platforms = lib.platforms.unix;
+      maintainers = [ lib.maintainers.quinneden ];
+    };
+  });
+in
+stdenv.mkDerivation (finalAttrs: {
+  pname = "libkrun-efi";
+  version = "1.15.1";
+
+  src = fetchFromGitHub {
+    owner = "containers";
+    repo = "libkrun";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-VhlFyYJ/TH12I3dUq0JTus60rQEJq5H4Pm1puCnJV5A=";
+  };
+
+  outputs = [
+    "out"
+    "dev"
+  ];
+
+  cargoDeps = rustPlatform.fetchCargoVendor {
+    inherit (finalAttrs) src;
+    hash = "sha256-dK3V7HCCvTqmQhB5Op2zmBPa9FO3h9gednU9tpQk+1U=";
+  };
+
+  nativeBuildInputs = [
+    cargo
+    fixDarwinDylibNames
+    pkg-config
+    rustc
+    rustPlatform.bindgenHook
+    rustPlatform.cargoSetupHook
+  ];
+
+  buildInputs = [
+    libepoxy
+    rutabaga_gfx
+    virglrenderer
+  ];
+
+  makeFlags = [
+    "PREFIX=${placeholder "out"}"
+    "EFI=1"
+  ]
+  ++ lib.optional withGpu "GPU=1";
+
+  passthru = {
+    tests.withoutGpu = libkrun-efi.override { withGpu = false; };
+    updateScript = nix-update-script { };
+  };
+
+  meta = {
+    description = "EFI variant of Libkrun, a dynamic library providing Virtualization-based process isolation capabilities";
+    homepage = "https://github.com/containers/libkrun";
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ quinneden ];
+    platforms = [ "aarch64-darwin" ];
+  };
+})

pkgs/by-name/li/libnl-tiny/package.nix

@@ -7,12 +7,12 @@
 
 stdenv.mkDerivation {
   pname = "libnl-tiny";
-  version = "0-unstable-2025-03-19";
+  version = "0-unstable-2025-10-20";
 
   src = fetchgit {
     url = "https://git.openwrt.org/project/libnl-tiny.git";
-    rev = "c0df580adbd4d555ecc1962dbe88e91d75b67a4e";
-    hash = "sha256-j5oIEbWqVWd7rNpCMm9+WZwud43uTGeHG81lmzQOoeY=";
+    rev = "c69fb5ef80b9780fe9add345052aef9ccb5d51f4";
+    hash = "sha256-QH4w++kekejvvgTye6djs0jYzcNsxfrE3XCBed+Oizo=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/li/lightway/package.nix

@@ -21,7 +21,7 @@ rustPlatform.buildRustPackage {
 
   cargoHash = "sha256-RFlac10XFJXT3Giayy31kZ3Nn1Q+YsPt/zCdkSV0Atk=";
 
-  cargoBuildFlags = lib.cli.toGNUCommandLine { } {
+  cargoBuildFlags = lib.cli.toCommandLineGNU { } {
     package = [
       "lightway-client"
       "lightway-server"

pkgs/by-name/mb/mbusd/package.nix

@@ -22,6 +22,11 @@ stdenv.mkDerivation rec {
     pkg-config
   ];
 
+  postPatch = ''
+    substituteInPlace CMakeLists.txt \
+      --replace-fail "cmake_minimum_required(VERSION 3.2)" "cmake_minimum_required(VERSION 3.10)"
+  '';
+
   meta = {
     description = "Modbus TCP to Modbus RTU (RS-232/485) gateway";
     homepage = "https://github.com/3cky/mbusd";

pkgs/by-name/ne/necesse-server/package.nix

@@ -6,7 +6,7 @@
 }:
 
 let
-  version = "1.0.1-20456269";
+  version = "1.0.1-20495154";
   urlVersion = lib.replaceStrings [ "." ] [ "-" ] version;
 
 in
@@ -16,7 +16,7 @@ stdenvNoCC.mkDerivation {
 
   src = fetchzip {
     url = "https://necessegame.com/content/server/${urlVersion}/necesse-server-linux64-${urlVersion}.zip";
-    hash = "sha256-1Du0r/R7wLqnWRkihW3Kwzo58HEmUt8NgNYWSyJwwdc=";
+    hash = "sha256-1k+4ywYjVddAb4yyGx1Fi/RXMyJzPIiQIyUzA0VhpAI=";
   };
 
   # removing packaged jre since we use our own

pkgs/by-name/ne/nemu/package.nix

@@ -27,13 +27,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "nemu";
-  version = "3.3.1";
+  version = "3.4.0";
 
   src = fetchFromGitHub {
     owner = "nemuTUI";
     repo = "nemu";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-6WzqBkspKKs1e8kg1i71ntZHa78s5pJ1u02mXvzpiEc=";
+    hash = "sha256-QvyCBHZmahZPIghPX53HcL5HsOVvhsVwdMZosVQ9A5U=";
   };
 
   cmakeFlags = [

pkgs/by-name/ne/nexusmods-app/deps.json

@@ -1926,23 +1926,23 @@
   },
   {
     "pname": "NexusMods.HyperDuck",
-    "version": "0.28.0",
-    "hash": "sha256-vJW/9DbnSIzxH6CR1CzMru0w/BA7HwxuJ0TiKt6NgcQ="
+    "version": "0.28.2",
+    "hash": "sha256-VErxX62rvY5MA9LGyBcKi1BCgtgzOo4rgWTRczFNrVY="
   },
   {
     "pname": "NexusMods.MnemonicDB",
-    "version": "0.28.0",
-    "hash": "sha256-AzSzn2mdp4sx1ntOfm03kWlfo/mxxURcEMmChxSyEAI="
+    "version": "0.28.2",
+    "hash": "sha256-l6b1r0swnRfqAIk7WvdQv0VaekFRXENhZqEL9ut4AT0="
   },
   {
     "pname": "NexusMods.MnemonicDB.Abstractions",
-    "version": "0.28.0",
-    "hash": "sha256-c6hEojlKk8B//lpEyxrYBy/QlpixzDE4LJq+sk4XZDY="
+    "version": "0.28.2",
+    "hash": "sha256-HJsnz1nQeUG4iln+WDkR3SMEalYM47Z8vdYZf8V+RIU="
   },
   {
     "pname": "NexusMods.MnemonicDB.SourceGenerator",
-    "version": "0.28.0",
-    "hash": "sha256-o888EyOAzDypNzhZTtW8BZp0Ew/fOUsho6IeBbGlmNM="
+    "version": "0.28.2",
+    "hash": "sha256-vmOO/qImh5RrWC3U11D5A4Gd2SvOJvuoDID+b5fI+cA="
   },
   {
     "pname": "NexusMods.Paths",
@@ -1969,51 +1969,6 @@
     "version": "0.20.0",
     "hash": "sha256-k+1dgCZEuEO8xVfdwGKec+FgE//FX1xqIyiyPGYypF0="
   },
-  {
-    "pname": "Nito.AsyncEx",
-    "version": "5.1.2",
-    "hash": "sha256-9o4YLWAHSeApF4E/qNFyaZPh/V9N5JSeF32uquukb5I="
-  },
-  {
-    "pname": "Nito.AsyncEx.Context",
-    "version": "5.1.2",
-    "hash": "sha256-7BCVYJgZyU2/Z4r8CKajorlzajr6GBUBAbY3AcswPC0="
-  },
-  {
-    "pname": "Nito.AsyncEx.Coordination",
-    "version": "5.1.2",
-    "hash": "sha256-NHMnIBkGzzuoZL0qHKAwFC35doB08IDvmCQptC2uu2s="
-  },
-  {
-    "pname": "Nito.AsyncEx.Interop.WaitHandles",
-    "version": "5.1.2",
-    "hash": "sha256-1DgBWnkYggWQk0w2g7Y24Ogl7TJ7bQkc/0NIUFJzN00="
-  },
-  {
-    "pname": "Nito.AsyncEx.Oop",
-    "version": "5.1.2",
-    "hash": "sha256-1hnCagbt6SLbn+RpasWdBH3pLvqm8kC2Ut2iG75OUMM="
-  },
-  {
-    "pname": "Nito.AsyncEx.Tasks",
-    "version": "5.1.2",
-    "hash": "sha256-W5jxZZ0pbPHte6TkWTq4FDtHOejvlrdyb1Inw+Yhl4c="
-  },
-  {
-    "pname": "Nito.Cancellation",
-    "version": "1.1.2",
-    "hash": "sha256-oZKZUymYJiM2AfMpX4pX0FIlut0lEWdy250iVX0w+is="
-  },
-  {
-    "pname": "Nito.Collections.Deque",
-    "version": "1.1.1",
-    "hash": "sha256-6Pmz6XQ+rY32O21Z3cUDVQsLH+i53LId18UCPTAxRZQ="
-  },
-  {
-    "pname": "Nito.Disposables",
-    "version": "2.2.1",
-    "hash": "sha256-FKDLUWysqroSHLU2kLjK1m0g417AAPh6n2TIkwiapcM="
-  },
   {
     "pname": "NLog",
     "version": "6.0.3",
@@ -2689,11 +2644,6 @@
     "version": "4.3.0",
     "hash": "sha256-KMY5DfJnDeIsa13DpqvyN8NkReZEMAFnlmNglVoFIXI="
   },
-  {
-    "pname": "System.Collections.Immutable",
-    "version": "1.7.1",
-    "hash": "sha256-WMMAUqoxT3J1gW9DI8v31VAuhwqTc4Posose5jq1BNo="
-  },
   {
     "pname": "System.Collections.Immutable",
     "version": "5.0.0",
@@ -3069,6 +3019,11 @@
     "version": "5.0.0",
     "hash": "sha256-M5Z8pw8rVb8ilbnTdaOptzk5VFd5DlKa7zzCpuytTtE="
   },
+  {
+    "pname": "System.Reactive",
+    "version": "6.0.0",
+    "hash": "sha256-hXB18OsiUHSCmRF3unAfdUEcbXVbG6/nZxcyz13oe9Y="
+  },
   {
     "pname": "System.Reactive",
     "version": "6.0.1",
@@ -3194,11 +3149,6 @@
     "version": "4.3.0",
     "hash": "sha256-51813WXpBIsuA6fUtE5XaRQjcWdQ2/lmEokJt97u0Rg="
   },
-  {
-    "pname": "System.Runtime.CompilerServices.Unsafe",
-    "version": "4.4.0",
-    "hash": "sha256-SeTI4+yVRO2SmAKgOrMni4070OD+Oo8L1YiEVeKDyig="
-  },
   {
     "pname": "System.Runtime.CompilerServices.Unsafe",
     "version": "4.5.3",
@@ -3564,6 +3514,11 @@
     "version": "2.5.0",
     "hash": "sha256-i9TpQJ2+JhSQ7RXkdmC6pkND32V4cLyEaPLGrD/EpYk="
   },
+  {
+    "pname": "Verify.TUnit",
+    "version": "30.11.0",
+    "hash": "sha256-xuP2oetSNIBhCzt7go3S2Icy8wy3pBseq4XcEMMrDV8="
+  },
   {
     "pname": "Verify.Xunit",
     "version": "30.11.0",