Merge 4a8e787879 into haskell-updates

.gitignore

@@ -37,3 +37,6 @@ update-git-commits.txt
 
 # JetBrains IDEA module declaration file
 /nixpkgs.iml
+
+# Usually used for manual backports
+.worktree/

lib/tests/nix-for-tests.nix

@@ -1,4 +1,5 @@
 {
+  lib ? pkgs.lib,
   pkgs,
 }:
 
@@ -13,20 +14,8 @@
 
 builtins.mapAttrs (
   attr: pkg:
-  if
-    # TODO descend in `nixComponents_*` and override `nix-store`. Also
-    # need to introduce the flag needed to do that with.
-    #
-    # This must be done before Nix 2.26 and beyond becomes the default.
-    !(builtins.elem attr [
-      "nixComponents_2_26"
-      "nix_2_26"
-      "latest"
-    ])
-    # There may-be non-package things, like functions, in there too
-    && builtins.isAttrs pkg
-  then
-    pkg.override { withAWS = false; }
+  if lib.versionAtLeast pkg.version "2.26" then
+    pkg.overrideScope (finalScope: prevScope: { aws-sdk-cpp = null; })
   else
-    pkg
+    pkg.override { withAWS = false; }
 ) pkgs.nixVersions

maintainers/maintainer-list.nix

@@ -23204,6 +23204,17 @@
     github = "sweenu";
     githubId = 7051978;
   };
+  sweiglbosker = {
+    email = "stefan@s00.xyz";
+    github = "sweiglbosker";
+    githubId = 124390044;
+    name = "Stefan Weigl-Bosker";
+    keys = [
+      {
+        fingerprint = "B520 0ABF BD21 3FC9 C17C  6DB9 1291 CBBC F3B9 F225";
+      }
+    ];
+  };
   swendel = {
     name = "Sebastian Wendel";
     email = "nixpkgs.aiX5ph@srx.digital";

nixos/doc/manual/release-notes/rl-2505.section.md

@@ -10,6 +10,8 @@
   Users on old macOS versions should consider upgrading to a supported version (potentially using [OpenCore Legacy Patcher](https://dortania.github.io/OpenCore-Legacy-Patcher/) for old hardware) or installing NixOS.
   If neither of those options are viable and you require new versions of software, [MacPorts](https://www.macports.org/) supports versions back to Mac OS X Snow Leopard 10.6.
 
+- Initial support for the [COSMIC DE](https://system76.com/cosmic), a Rust-based desktop environment by System76, makers of Pop!_OS. Toggle the greeter (login manager) using `services.displayManager.cosmic-greeter.enable` and the DE itself with `services.desktopManager.cosmic.enable`. Mostly stable but still experimental. Please report any issues to the [COSMIC DE tracker in Nixpkgs](https://github.com/NixOS/nixpkgs/issues/259641) instead of upstream.
+
 - The default kernel package has been updated from 6.6 to 6.12. All supported kernels remain available.
 
 - GCC has been updated from GCC 13 to GCC 14.
@@ -134,6 +136,8 @@
 
 - [Autotier](https://github.com/45Drives/autotier), a passthrough FUSE filesystem. Available as [services.autotierfs](options.html#opt-services.autotierfs.enable).
 
+- [PostgREST](https://postgrest.org), a standalone web server that turns your PostgreSQL database directly into a RESTful API. Available as [services.postgrest](options.html#opt-services.postgrest.enable).
+
 - [µStreamer](https://github.com/pikvm/ustreamer), a lightweight MJPEG-HTTP streamer. Available as [services.ustreamer](options.html#opt-services.ustreamer).
 
 - [Whoogle Search](https://github.com/benbusby/whoogle-search), a self-hosted, ad-free, privacy-respecting metasearch engine. Available as [services.whoogle-search](options.html#opt-services.whoogle-search.enable).

nixos/modules/config/qt.nix

@@ -4,7 +4,6 @@
   pkgs,
   ...
 }:
-
 let
   cfg = config.qt;
 
@@ -22,6 +21,11 @@ let
       libsForQt5.plasma-integration
       libsForQt5.systemsettings
     ];
+    kde6 = [
+      kdePackages.kio
+      kdePackages.plasma-integration
+      kdePackages.systemsettings
+    ];
     lxqt = [
       lxqt.lxqt-qtplugin
       lxqt.lxqt-config
@@ -32,6 +36,11 @@ let
     ];
   };
 
+  # Maps style names to their QT_QPA_PLATFORMTHEME, if necessary.
+  styleNames = {
+    kde6 = "kde";
+  };
+
   stylePackages = with pkgs; {
     bb10bright = [ libsForQt5.qtstyleplugins ];
     bb10dark = [ libsForQt5.qtstyleplugins ];
@@ -61,7 +70,10 @@ let
       adwaita-qt6
     ];
 
-    breeze = [ libsForQt5.breeze-qt5 ];
+    breeze = [
+      libsForQt5.breeze-qt5
+      kdePackages.breeze
+    ];
 
     kvantum = [
       libsForQt5.qtstyleplugin-kvantum
@@ -115,6 +127,14 @@ in
             "libsForQt5"
             "systemsettings"
           ]
+          [
+            "kdePackages"
+            "plasma-integration"
+          ]
+          [
+            "kdePackages"
+            "systemsettings"
+          ]
           [
             "lxqt"
             "lxqt-config"
@@ -138,7 +158,8 @@ in
           The options are
           - `gnome`: Use GNOME theme with [qgnomeplatform](https://github.com/FedoraQt/QGnomePlatform)
           - `gtk2`: Use GTK theme with [qtstyleplugins](https://github.com/qt/qtstyleplugins)
-          - `kde`: Use Qt settings from Plasma.
+          - `kde`: Use Qt settings from Plasma 5.
+          - `kde6`: Use Qt settings from Plasma 6.
           - `lxqt`: Use LXQt style set using the [lxqt-config-appearance](https://github.com/lxqt/lxqt-config)
              application.
           - `qt5ct`: Use Qt style set using the [qt5ct](https://sourceforge.net/projects/qt5ct/)
@@ -215,7 +236,9 @@ in
       ];
 
     environment.variables = {
-      QT_QPA_PLATFORMTHEME = lib.mkIf (cfg.platformTheme != null) cfg.platformTheme;
+      QT_QPA_PLATFORMTHEME =
+        lib.mkIf (cfg.platformTheme != null)
+          styleNames.${cfg.platformTheme} or cfg.platformTheme;
       QT_STYLE_OVERRIDE = lib.mkIf (cfg.style != null) cfg.style;
     };
 

nixos/modules/module-list.nix

@@ -513,6 +513,7 @@
   ./services/databases/pgbouncer.nix
   ./services/databases/pgmanage.nix
   ./services/databases/postgresql.nix
+  ./services/databases/postgrest.nix
   ./services/databases/redis.nix
   ./services/databases/surrealdb.nix
   ./services/databases/tigerbeetle.nix
@@ -578,6 +579,7 @@
   ./services/development/vsmartcard-vpcd.nix
   ./services/development/zammad.nix
   ./services/display-managers/default.nix
+  ./services/display-managers/cosmic-greeter.nix
   ./services/display-managers/greetd.nix
   ./services/display-managers/sddm.nix
   ./services/display-managers/ly.nix

nixos/modules/services/databases/postgrest.nix

@@ -0,0 +1,311 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+let
+  cfg = config.services.postgrest;
+
+  # Turns an attrset of libpq connection params:
+  #   {
+  #     dbname = "postgres";
+  #     user = "authenticator";
+  #   }
+  # into a libpq connection string:
+  #   dbname=postgres user=authenticator
+  db-uri = lib.pipe (cfg.settings.db-uri or { }) [
+    (lib.filterAttrs (_: v: v != null))
+    (lib.mapAttrsToList (k: v: "${k}=${v}"))
+    (lib.concatStringsSep " ")
+  ];
+
+  # Writes a postgrest config file according to:
+  #   https://hackage.haskell.org/package/configurator-0.3.0.0/docs/Data-Configurator.html
+  # Only a subset of the functionality is used by PostgREST.
+  configFile = lib.pipe (cfg.settings // { inherit db-uri; }) [
+    (lib.filterAttrs (_: v: v != null))
+
+    (lib.mapAttrs (
+      _: v:
+      if true == v then
+        "true"
+      else if false == v then
+        "false"
+      else if lib.isInt v then
+        toString v
+      else
+        "\"${lib.escape [ "\"" ] v}\""
+    ))
+
+    (lib.mapAttrsToList (k: v: "${k} = ${v}"))
+    (lib.concatStringsSep "\n")
+    (pkgs.writeText "postgrest.conf")
+  ];
+in
+
+{
+  meta = {
+    maintainers = with lib.maintainers; [ wolfgangwalther ];
+  };
+
+  options.services.postgrest = {
+    enable = lib.mkEnableOption "PostgREST";
+
+    pgpassFile = lib.mkOption {
+      type =
+        with lib.types;
+        nullOr (pathWith {
+          inStore = false;
+          absolute = true;
+        });
+      default = null;
+      example = "/run/keys/db_password";
+      description = ''
+        The password to authenticate to PostgreSQL with.
+        Not needed for peer or trust based authentication.
+
+        The file must be a valid `.pgpass` file as described in:
+        <https://www.postgresql.org/docs/current/libpq-pgpass.html>
+
+        In most cases, the following will be enough:
+        ```
+        *:*:*:*:<password>
+        ```
+      '';
+    };
+
+    jwtSecretFile = lib.mkOption {
+      type =
+        with lib.types;
+        nullOr (pathWith {
+          inStore = false;
+          absolute = true;
+        });
+      default = null;
+      example = "/run/keys/jwt_secret";
+      description = ''
+        The secret or JSON Web Key (JWK) (or set) used to decode JWT tokens clients provide for authentication.
+        For security the key must be at least 32 characters long.
+        If this parameter is not specified then PostgREST refuses authentication requests.
+
+        <https://docs.postgrest.org/en/stable/references/configuration.html#jwt-secret>
+      '';
+    };
+
+    settings = lib.mkOption {
+      type = lib.types.submodule {
+        freeformType =
+          with lib.types;
+          attrsOf (oneOf [
+            bool
+            ints.unsigned
+            str
+          ]);
+
+        options = {
+          admin-server-port = lib.mkOption {
+            type = with lib.types; nullOr port;
+            default = null;
+            description = ''
+              Specifies the port for the admin server, which can be used for healthchecks.
+
+              <https://docs.postgrest.org/en/stable/references/admin_server.html#admin-server>
+            '';
+          };
+
+          db-config = lib.mkOption {
+            type = lib.types.bool;
+            default = false;
+            example = true;
+            description = ''
+              Enables the in-database configuration.
+
+              <https://docs.postgrest.org/en/stable/references/configuration.html#in-database-configuration>
+
+              ::: {.note}
+              This is enabled by default upstream, but disabled by default in this module.
+              :::
+            '';
+          };
+
+          db-uri = lib.mkOption {
+            type = lib.types.submodule {
+              freeformType = with lib.types; attrsOf str;
+
+              # This should not be used; use pgpassFile instead.
+              options.password = lib.mkOption {
+                default = null;
+                readOnly = true;
+                internal = true;
+              };
+              # This should not be used; use pgpassFile instead.
+              options.passfile = lib.mkOption {
+                default = null;
+                readOnly = true;
+                internal = true;
+              };
+            };
+            default = { };
+            description = ''
+              libpq connection parameters as documented in:
+
+              <https://www.postgresql.org/docs/current/libpq-connect.html#LIBPQ-PARAMKEYWORDS>
+
+              ::: {.note}
+              The `settings.db-uri.password` and `settings.db-uri.passfile` options are blocked.
+              Use [`pgpassFile`](#opt-services.postgrest.pgpassFile) instead.
+              :::
+            '';
+            example = lib.literalExpression ''
+              {
+                host = "localhost";
+                dbname = "postgres";
+              }
+            '';
+          };
+
+          # This should not be used; use jwtSecretFile instead.
+          jwt-secret = lib.mkOption {
+            default = null;
+            readOnly = true;
+            internal = true;
+          };
+
+          server-host = lib.mkOption {
+            type = with lib.types; nullOr str;
+            default = "127.0.0.1";
+            description = ''
+              Where to bind the PostgREST web server.
+
+              ::: {.note}
+              The admin server will also bind here, but potentially exposes sensitive information.
+              Make sure you turn off the admin server, when opening this to the public.
+
+              <https://github.com/PostgREST/postgrest/issues/3956>
+              :::
+            '';
+          };
+
+          server-port = lib.mkOption {
+            type = with lib.types; nullOr port;
+            default = null;
+            example = 3000;
+            description = ''
+              The TCP port to bind the web server.
+            '';
+          };
+
+          server-unix-socket = lib.mkOption {
+            type = with lib.types; nullOr path;
+            default = "/run/postgrest/postgrest.sock";
+            description = ''
+              Unix domain socket where to bind the PostgREST web server.
+            '';
+          };
+        };
+      };
+      default = { };
+      description = ''
+        PostgREST configuration as documented in:
+        <https://docs.postgrest.org/en/stable/references/configuration.html#list-of-parameters>
+
+        `db-uri` is represented as an attribute set, see [`settings.db-uri`](#opt-services.postgrest.settings.db-uri)
+
+        ::: {.note}
+        The `settings.jwt-secret` option is blocked.
+        Use [`jwtSecretFile`](#opt-services.postgrest.jwtSecretFile) instead.
+        :::
+      '';
+      example = lib.literalExpression ''
+        {
+          db-anon-role = "anon";
+          db-uri.dbname = "postgres";
+          "app.settings.custom" = "value";
+        }
+      '';
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    assertions = [
+      {
+        assertion = (cfg.settings.server-port == null) != (cfg.settings.server-unix-socket == null);
+        message = ''
+          PostgREST can listen either on a TCP port or on a unix socket, but not both.
+          Please set one of `settings.server-port`](#opt-services.postgrest.jwtSecretFile) or `settings.server-unix-socket` to `null`.
+
+          <https://docs.postgrest.org/en/stable/references/configuration.html#server-unix-socket>
+        '';
+      }
+    ];
+
+    warnings =
+      lib.optional (cfg.settings.admin-server-port != null && cfg.settings.server-host != "127.0.0.1")
+        "The PostgREST admin server is potentially listening on a public host. This may expose sensitive information via the `/config` endpoint.";
+
+    systemd.services.postgrest = {
+      description = "PostgREST";
+
+      wantedBy = [ "multi-user.target" ];
+      wants = [ "network-online.target" ];
+      after = [
+        "network-online.target"
+        "postgresql.service"
+      ];
+
+      serviceConfig = {
+        CacheDirectory = "postgrest";
+        CacheDirectoryMode = "0700";
+        Environment =
+          lib.optional (cfg.pgpassFile != null) "PGPASSFILE=%C/postgrest/pgpass"
+          ++ lib.optional (cfg.jwtSecretFile != null) "PGRST_JWT_SECRET=@%d/jwt_secret";
+        LoadCredential =
+          lib.optional (cfg.pgpassFile != null) "pgpass:${cfg.pgpassFile}"
+          ++ lib.optional (cfg.jwtSecretFile != null) "jwt_secret:${cfg.jwtSecretFile}";
+        Restart = "always";
+        RuntimeDirectory = "postgrest";
+        User = "postgrest";
+
+        # Hardening
+        CapabilityBoundingSet = [ "" ];
+        DevicePolicy = "closed";
+        DynamicUser = true;
+        LockPersonality = true;
+        MemoryDenyWriteExecute = true;
+        NoNewPrivileges = true;
+        PrivateDevices = true;
+        PrivateIPC = true;
+        PrivateMounts = true;
+        ProcSubset = "pid";
+        ProtectClock = true;
+        ProtectControlGroups = true;
+        ProtectHostname = true;
+        ProtectKernelLogs = true;
+        ProtectKernelModules = true;
+        ProtectKernelTunables = true;
+        ProtectProc = "invisible";
+        RestrictAddressFamilies = [
+          "AF_INET"
+          "AF_INET6"
+          "AF_UNIX"
+        ];
+        RestrictNamespaces = true;
+        RestrictRealtime = true;
+        SystemCallArchitectures = "native";
+        SystemCallFilter = [ "" ];
+        UMask = "0077";
+      };
+
+      # Copy the pgpass file to different location, to have it report mode 0400.
+      # Fixes: https://github.com/systemd/systemd/issues/29435
+      script = ''
+        if [ -f "$CREDENTIALS_DIRECTORY/pgpass" ]; then
+            cp -f "$CREDENTIALS_DIRECTORY/pgpass" "$CACHE_DIRECTORY/pgpass"
+        fi
+        exec ${lib.getExe pkgs.postgrest} ${configFile}
+      '';
+    };
+  };
+}

nixos/modules/services/desktop-managers/cosmic.nix

@@ -0,0 +1,142 @@
+# SPDX-License-Identifier: MIT
+# SPDX-FileCopyrightText: Lily Foster <lily@lily.flowers>
+# Portions of this code are adapted from nixos-cosmic
+# https://github.com/lilyinstarlight/nixos-cosmic
+
+{
+  config,
+  lib,
+  pkgs,
+  utils,
+  ...
+}:
+
+let
+  cfg = config.services.desktopManager.cosmic;
+in
+{
+  meta.maintainers = with lib.maintainers; [
+    thefossguy
+    HeitorAugustoLN
+    nyabinary
+    ahoneybun
+  ];
+
+  options = {
+    services.desktopManager.cosmic = {
+      enable = lib.mkEnableOption "Enable the COSMIC desktop environment";
+
+      xwayland.enable = lib.mkEnableOption "Xwayland support for the COSMIC compositor" // {
+        default = true;
+      };
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    # Environment packages
+    environment.pathsToLink = [
+      "/share/backgrounds"
+      "/share/cosmic"
+    ];
+    environment.systemPackages =
+      with pkgs;
+      [
+        adwaita-icon-theme
+        alsa-utils
+        cosmic-applets
+        cosmic-applibrary
+        cosmic-bg
+        (cosmic-comp.override { useXWayland = false; })
+        cosmic-edit
+        cosmic-files
+        config.services.displayManager.cosmic-greeter.package
+        cosmic-icons
+        cosmic-idle
+        cosmic-launcher
+        cosmic-notifications
+        cosmic-osd
+        cosmic-panel
+        cosmic-player
+        cosmic-randr
+        cosmic-screenshot
+        cosmic-session
+        cosmic-settings
+        cosmic-settings-daemon
+        cosmic-term
+        cosmic-wallpapers
+        cosmic-workspaces-epoch
+        hicolor-icon-theme
+        playerctl
+        pop-icon-theme
+        pop-launcher
+        xdg-user-dirs
+      ]
+      ++ lib.optionals cfg.xwayland.enable [
+        xwayland
+      ]
+      ++ lib.optionals config.services.flatpak.enable [
+        cosmic-store
+      ];
+
+    # Distro-wide defaults for graphical sessions
+    services.graphical-desktop.enable = true;
+
+    xdg = {
+      icons.fallbackCursorThemes = lib.mkDefault [ "Cosmic" ];
+
+      portal = {
+        enable = true;
+        extraPortals = with pkgs; [
+          xdg-desktop-portal-cosmic
+          xdg-desktop-portal-gtk
+        ];
+        configPackages = lib.mkDefault [ pkgs.xdg-desktop-portal-cosmic ];
+      };
+    };
+
+    systemd = {
+      packages = [ pkgs.cosmic-session ];
+      user.targets = {
+        cosmic-session = {
+          wants = [ "xdg-desktop-autostart.target" ];
+          before = [ "xdg-desktop-autostart.target" ];
+        };
+        tray = {
+          description = "Cosmic Tray Target";
+          requires = [ "graphical-session-pre.target" ];
+        };
+      };
+    };
+
+    fonts.packages = with pkgs; [
+      fira
+      noto-fonts
+      open-sans
+    ];
+
+    # Required options for the COSMIC DE
+    environment.sessionVariables.X11_BASE_RULES_XML = "${config.services.xserver.xkb.dir}/rules/base.xml";
+    environment.sessionVariables.X11_EXTRA_RULES_XML = "${config.services.xserver.xkb.dir}/rules/base.extras.xml";
+    programs.dconf.enable = true;
+    programs.dconf.packages = [ pkgs.cosmic-session ];
+    security.polkit.enable = true;
+    security.rtkit.enable = true;
+    services.accounts-daemon.enable = true;
+    services.displayManager.sessionPackages = [ pkgs.cosmic-session ];
+    services.libinput.enable = true;
+    services.upower.enable = true;
+    # Setup PAM authentication for the `cosmic-greeter` user
+    security.pam.services.cosmic-greeter = { };
+
+    # Good to have defaults
+    hardware.bluetooth.enable = lib.mkDefault true;
+    networking.networkmanager.enable = lib.mkDefault true;
+    services.acpid.enable = lib.mkDefault true;
+    services.avahi.enable = lib.mkDefault true;
+    services.gnome.gnome-keyring.enable = lib.mkDefault true;
+    services.gvfs.enable = lib.mkDefault true;
+    services.power-profiles-daemon.enable = lib.mkDefault (
+      !config.hardware.system76.power-daemon.enable
+    );
+  };
+}

nixos/modules/services/display-managers/cosmic-greeter.nix

@@ -0,0 +1,70 @@
+# SPDX-License-Identifier: MIT
+# SPDX-FileCopyrightText: Lily Foster <lily@lily.flowers>
+# Portions of this code are adapted from nixos-cosmic
+# https://github.com/lilyinstarlight/nixos-cosmic
+
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+let
+  cfg = config.services.displayManager.cosmic-greeter;
+in
+
+{
+  meta.maintainers = with lib.maintainers; [
+    thefossguy
+    HeitorAugustoLN
+    nyabinary
+    ahoneybun
+  ];
+
+  options.services.displayManager.cosmic-greeter = {
+    enable = lib.mkEnableOption "COSMIC greeter";
+    package = lib.mkPackageOption pkgs "cosmic-greeter" { };
+  };
+
+  config = lib.mkIf cfg.enable {
+    services.greetd = {
+      enable = true;
+      settings = {
+        default_session = {
+          user = "cosmic-greeter";
+          command = ''${lib.getExe' pkgs.coreutils "env"} XCURSOR_THEME="''${XCURSOR_THEME:-Pop}" systemd-cat -t cosmic-greeter ${lib.getExe pkgs.cosmic-comp} ${lib.getExe cfg.package}'';
+        };
+      };
+    };
+
+    # Daemon for querying background state and such
+    systemd.services.cosmic-greeter-daemon = {
+      wantedBy = [ "multi-user.target" ];
+      before = [ "greetd.service" ];
+      serviceConfig = {
+        Type = "dbus";
+        BusName = "com.system76.CosmicGreeter";
+        ExecStart = lib.getExe' cfg.package "cosmic-greeter-daemon";
+        Restart = "on-failure";
+      };
+    };
+
+    # The greeter user is hardcoded in `cosmic-greeter`
+    users.groups.cosmic-greeter = { };
+    users.users.cosmic-greeter = {
+      description = "COSMIC login greeter user";
+      isSystemUser = true;
+      home = "/var/lib/cosmic-greeter";
+      createHome = true;
+      group = "cosmic-greeter";
+    };
+    # Setup PAM authentication for the `cosmic-greeter` user
+    security.pam.services.cosmic-greeter = { };
+
+    hardware.graphics.enable = true;
+    services.accounts-daemon.enable = true;
+    services.dbus.packages = [ cfg.package ];
+    services.libinput.enable = true;
+  };
+}

nixos/modules/services/x11/desktop-managers/default.nix

@@ -21,6 +21,7 @@ in
     ./lxqt.nix ./enlightenment.nix ./gnome.nix ./retroarch.nix ./kodi.nix
     ./mate.nix ./pantheon.nix ./surf-display.nix ./cde.nix
     ./cinnamon.nix ./budgie.nix ./deepin.nix ../../desktop-managers/lomiri.nix
+    ../../desktop-managers/cosmic.nix
   ];
 
   options = {

nixos/modules/services/x11/display-managers/startx.nix

@@ -102,14 +102,6 @@ in
 
     environment.systemPackages = with pkgs; [ xorg.xinit ];
 
-    # Make graphical-session fail if the user environment has not been imported
-    systemd.user.targets.graphical-session = {
-      unitConfig.AssertEnvironment = [
-        "DISPLAY"
-        "XDG_SESSION_ID"
-      ];
-    };
-
   };
 
 }

nixos/modules/virtualisation/incus.nix

@@ -62,6 +62,9 @@ let
         skopeo
         umoci
       ]
+      ++ lib.optionals (lib.versionAtLeast cfg.package.version "6.11.0") [
+        lego
+      ]
       ++ lib.optionals config.security.apparmor.enable [
         apparmor-bin-utils
 

nixos/tests/all-tests.nix

@@ -386,7 +386,7 @@ in {
   etebase-server = handleTest ./etebase-server.nix {};
   etesync-dav = handleTest ./etesync-dav.nix {};
   evcc = runTest ./evcc.nix;
-  fail2ban = handleTest ./fail2ban.nix { };
+  fail2ban = runTest ./fail2ban.nix;
   fakeroute = handleTest ./fakeroute.nix {};
   fancontrol = handleTest ./fancontrol.nix {};
   fanout = handleTest ./fanout.nix {};
@@ -715,7 +715,7 @@ in {
   miniflux = handleTest ./miniflux.nix {};
   minio = handleTest ./minio.nix {};
   miracle-wm = runTest ./miracle-wm.nix;
-  miriway = handleTest ./miriway.nix {};
+  miriway = runTest ./miriway.nix;
   misc = handleTest ./misc.nix {};
   misskey = handleTest ./misskey.nix {};
   mjolnir = handleTest ./matrix/mjolnir.nix {};
@@ -734,7 +734,7 @@ in {
   moodle = handleTest ./moodle.nix {};
   moonraker = handleTest ./moonraker.nix {};
   mopidy = handleTest ./mopidy.nix {};
-  morph-browser = handleTest ./morph-browser.nix { };
+  morph-browser = runTest ./morph-browser.nix;
   morty = handleTest ./morty.nix {};
   mosquitto = handleTest ./mosquitto.nix {};
   moosefs = handleTest ./moosefs.nix {};
@@ -974,6 +974,7 @@ in {
   postfix-raise-smtpd-tls-security-level = handleTest ./postfix-raise-smtpd-tls-security-level.nix {};
   postfixadmin = handleTest ./postfixadmin.nix {};
   postgresql = handleTest ./postgresql {};
+  postgrest = runTest ./postgrest.nix;
   powerdns = handleTest ./powerdns.nix {};
   powerdns-admin = handleTest ./powerdns-admin.nix {};
   power-profiles-daemon = handleTest ./power-profiles-daemon.nix {};

nixos/tests/fail2ban.nix

@@ -1,21 +1,46 @@
-import ./make-test-python.nix (
-  { pkgs, ... }:
-  {
-    name = "fail2ban";
+{ pkgs, ... }:
+{
+  name = "fail2ban";
 
-    nodes.machine = _: {
-      services.fail2ban = {
-        enable = true;
-        bantime-increment.enable = true;
-      };
-
-      services.openssh.enable = true;
+  nodes.machine = _: {
+    services.fail2ban = {
+      enable = true;
+      bantime-increment.enable = true;
     };
+    services.openssh.enable = true;
+    networking.nftables.enable = true;
+  };
 
-    testScript = ''
-      machine.wait_for_unit("multi-user.target")
+  nodes.client = _: {
+    environment.systemPackages = [
+      pkgs.sshpass
+      pkgs.libressl.nc
+    ];
 
-      machine.wait_for_unit("fail2ban")
-    '';
-  }
-)
+  };
+
+  testScript = ''
+    start_all()
+
+    # Wait for everything to be ready.
+    machine.wait_for_unit("multi-user.target")
+    machine.wait_for_unit("fail2ban")
+    machine.wait_for_unit("sshd")
+    client.wait_for_unit("multi-user.target")
+
+    client_addr = "2001:db8:1::1"
+    machine_addr = "2001:db8:1::2"
+
+    # Verify there is not ban and the port is reachable from the client.
+    machine.succeed(f"test 0 -eq $(fail2ban-client get sshd banned {client_addr})")
+    client.succeed(f"nc -w3 -z {machine_addr} 22")
+
+    # Cause authentication failure log entries.
+    for _ in range(2):
+      client.fail(f"sshpass -p 'wrongpassword' ssh -o StrictHostKeyChecking=no {machine_addr}")
+
+    # Verify there is a ban and the port is unreachable from the client.
+    machine.wait_until_succeeds(f"test 1 -eq $(fail2ban-client get sshd banned {client_addr})")
+    client.fail(f"nc -w3 -z {machine_addr} 22")
+  '';
+}

nixos/tests/miriway.nix

@@ -1,148 +1,146 @@
-import ./make-test-python.nix (
-  { pkgs, lib, ... }:
-  {
-    name = "miriway";
+{ pkgs, lib, ... }:
+{
+  name = "miriway";
 
-    meta = {
-      maintainers = with lib.maintainers; [ OPNA2608 ];
-    };
+  meta = {
+    maintainers = with lib.maintainers; [ OPNA2608 ];
+  };
 
-    nodes.machine =
-      { config, ... }:
-      {
-        imports = [
-          ./common/auto.nix
-          ./common/user-account.nix
-        ];
+  nodes.machine =
+    { config, ... }:
+    {
+      imports = [
+        ./common/auto.nix
+        ./common/user-account.nix
+      ];
 
-        # Seems to very rarely get interrupted by oom-killer
-        virtualisation.memorySize = 2047;
+      # Seems to very rarely get interrupted by oom-killer
+      virtualisation.memorySize = 2047;
 
-        test-support.displayManager.auto = {
-          enable = true;
-          user = "alice";
-        };
-
-        programs.ydotool.enable = true;
-
-        services.xserver.enable = true;
-        services.displayManager.defaultSession = lib.mkForce "miriway";
-
-        programs.miriway = {
-          enable = true;
-          config = ''
-            add-wayland-extensions=all
-            enable-x11=
-
-            ctrl-alt=t:foot --maximized
-            ctrl-alt=a:env WINIT_UNIX_BACKEND=x11 WAYLAND_DISPLAY= alacritty --option window.startup_mode=\"maximized\"
-
-            shell-component=dbus-update-activation-environment --systemd DISPLAY WAYLAND_DISPLAY
-
-            shell-component=foot --maximized
-          '';
-        };
-
-        environment = {
-          shellAliases = {
-            test-wayland = "wayland-info | tee /tmp/test-wayland.out && touch /tmp/test-wayland-exit-ok";
-            test-x11 = "glinfo | tee /tmp/test-x11.out && touch /tmp/test-x11-exit-ok";
-          };
-
-          systemPackages = with pkgs; [
-            mesa-demos
-            wayland-utils
-            foot
-            alacritty
-          ];
-
-          # To help with OCR
-          etc."xdg/foot/foot.ini".source = (pkgs.formats.ini { }).generate "foot.ini" {
-            main = {
-              font = "inconsolata:size=16";
-            };
-            colors = rec {
-              foreground = "000000";
-              background = "ffffff";
-              regular2 = foreground;
-            };
-          };
-          etc."xdg/alacritty/alacritty.toml".source = (pkgs.formats.toml { }).generate "alacritty.toml" {
-            font = rec {
-              normal.family = "Inconsolata";
-              bold.family = normal.family;
-              italic.family = normal.family;
-              bold_italic.family = normal.family;
-              size = 16;
-            };
-            colors = rec {
-              primary = {
-                foreground = "0x000000";
-                background = "0xffffff";
-              };
-              normal = {
-                green = primary.foreground;
-              };
-            };
-          };
-        };
-
-        fonts.packages = [ pkgs.inconsolata ];
+      test-support.displayManager.auto = {
+        enable = true;
+        user = "alice";
       };
 
-    enableOCR = true;
+      programs.ydotool.enable = true;
 
-    testScript =
-      { nodes, ... }:
-      ''
-        start_all()
-        machine.wait_for_unit("multi-user.target")
+      services.xserver.enable = true;
+      services.displayManager.defaultSession = lib.mkForce "miriway";
 
-        # Wait for Miriway to complete startup
-        machine.wait_for_file("/run/user/1000/wayland-0")
-        machine.succeed("pgrep miriway-shell")
-        machine.screenshot("miriway_launched")
+      programs.miriway = {
+        enable = true;
+        config = ''
+          add-wayland-extensions=all
+          enable-x11=
 
-        # Test Wayland
-        # We let Miriway start the first terminal, as we might get stuck if it's not ready to process the first keybind
-        # machine.send_key("ctrl-alt-t")
-        machine.wait_for_text(r"(alice|machine)")
-        machine.send_chars("test-wayland\n")
-        machine.wait_for_file("/tmp/test-wayland-exit-ok")
-        machine.copy_from_vm("/tmp/test-wayland.out")
-        machine.screenshot("foot_wayland_info")
+          ctrl-alt=t:foot --maximized
+          ctrl-alt=a:env WINIT_UNIX_BACKEND=x11 WAYLAND_DISPLAY= alacritty --option window.startup_mode=\"maximized\"
 
-        # please actually register that we want to close the window
-        machine.succeed("ydotool mousemove -- 10 10")
-        machine.sleep(3)
+          shell-component=dbus-update-activation-environment --systemd DISPLAY WAYLAND_DISPLAY
 
-        machine.send_chars("exit\n")
+          shell-component=foot --maximized
+        '';
+      };
 
-        # please actually register that we want to close the window
-        machine.succeed("ydotool mousemove -- 10 10")
-        machine.sleep(3)
+      environment = {
+        shellAliases = {
+          test-wayland = "wayland-info | tee /tmp/test-wayland.out && touch /tmp/test-wayland-exit-ok";
+          test-x11 = "glinfo | tee /tmp/test-x11.out && touch /tmp/test-x11-exit-ok";
+        };
 
-        machine.wait_until_fails("pgrep foot")
+        systemPackages = with pkgs; [
+          mesa-demos
+          wayland-utils
+          foot
+          alacritty
+        ];
 
-        # Test XWayland
-        machine.send_key("ctrl-alt-a")
-        machine.wait_for_text(r"(alice|machine)")
-        machine.send_chars("test-x11\n")
-        machine.wait_for_file("/tmp/test-x11-exit-ok")
-        machine.copy_from_vm("/tmp/test-x11.out")
-        machine.screenshot("alacritty_glinfo")
+        # To help with OCR
+        etc."xdg/foot/foot.ini".source = (pkgs.formats.ini { }).generate "foot.ini" {
+          main = {
+            font = "inconsolata:size=16";
+          };
+          colors = rec {
+            foreground = "000000";
+            background = "ffffff";
+            regular2 = foreground;
+          };
+        };
+        etc."xdg/alacritty/alacritty.toml".source = (pkgs.formats.toml { }).generate "alacritty.toml" {
+          font = rec {
+            normal.family = "Inconsolata";
+            bold.family = normal.family;
+            italic.family = normal.family;
+            bold_italic.family = normal.family;
+            size = 16;
+          };
+          colors = rec {
+            primary = {
+              foreground = "0x000000";
+              background = "0xffffff";
+            };
+            normal = {
+              green = primary.foreground;
+            };
+          };
+        };
+      };
 
-        # please actually register that we want to close the window
-        machine.succeed("ydotool mousemove -- 10 10")
-        machine.sleep(3)
+      fonts.packages = [ pkgs.inconsolata ];
+    };
 
-        machine.send_chars("exit\n")
+  enableOCR = true;
 
-        # please actually register that we want to close the window
-        machine.succeed("ydotool mousemove -- 10 10")
-        machine.sleep(3)
+  testScript =
+    { nodes, ... }:
+    ''
+      start_all()
+      machine.wait_for_unit("multi-user.target")
 
-        machine.wait_until_fails("pgrep alacritty")
-      '';
-  }
-)
+      # Wait for Miriway to complete startup
+      machine.wait_for_file("/run/user/1000/wayland-0")
+      machine.succeed("pgrep miriway-shell")
+      machine.screenshot("miriway_launched")
+
+      # Test Wayland
+      # We let Miriway start the first terminal, as we might get stuck if it's not ready to process the first keybind
+      # machine.send_key("ctrl-alt-t")
+      machine.wait_for_text(r"(alice|machine)")
+      machine.send_chars("test-wayland\n")
+      machine.wait_for_file("/tmp/test-wayland-exit-ok")
+      machine.copy_from_vm("/tmp/test-wayland.out")
+      machine.screenshot("foot_wayland_info")
+
+      # please actually register that we want to close the window
+      machine.succeed("ydotool mousemove -- 10 10")
+      machine.sleep(3)
+
+      machine.send_chars("exit\n")
+
+      # please actually register that we want to close the window
+      machine.succeed("ydotool mousemove -- 10 10")
+      machine.sleep(3)
+
+      machine.wait_until_fails("pgrep foot")
+
+      # Test XWayland
+      machine.send_key("ctrl-alt-a")
+      machine.wait_for_text(r"(alice|machine)")
+      machine.send_chars("test-x11\n")
+      machine.wait_for_file("/tmp/test-x11-exit-ok")
+      machine.copy_from_vm("/tmp/test-x11.out")
+      machine.screenshot("alacritty_glinfo")
+
+      # please actually register that we want to close the window
+      machine.succeed("ydotool mousemove -- 10 10")
+      machine.sleep(3)
+
+      machine.send_chars("exit\n")
+
+      # please actually register that we want to close the window
+      machine.succeed("ydotool mousemove -- 10 10")
+      machine.sleep(3)
+
+      machine.wait_until_fails("pgrep alacritty")
+    '';
+}

nixos/tests/morph-browser.nix

@@ -1,57 +1,55 @@
-import ./make-test-python.nix (
-  { pkgs, lib, ... }:
-  {
-    name = "morph-browser-standalone";
-    meta.maintainers = lib.teams.lomiri.members;
+{ pkgs, lib, ... }:
+{
+  name = "morph-browser-standalone";
+  meta.maintainers = lib.teams.lomiri.members;
 
-    nodes.machine =
-      { config, pkgs, ... }:
-      {
-        imports = [
-          ./common/x11.nix
+  nodes.machine =
+    { config, pkgs, ... }:
+    {
+      imports = [
+        ./common/x11.nix
+      ];
+
+      services.xserver.enable = true;
+
+      environment = {
+        systemPackages = with pkgs.lomiri; [
+          suru-icon-theme
+          morph-browser
         ];
-
-        services.xserver.enable = true;
-
-        environment = {
-          systemPackages = with pkgs.lomiri; [
-            suru-icon-theme
-            morph-browser
-          ];
-          variables = {
-            UITK_ICON_THEME = "suru";
-          };
+        variables = {
+          UITK_ICON_THEME = "suru";
         };
-
-        i18n.supportedLocales = [ "all" ];
-
-        fonts.packages = with pkgs; [
-          # Intended font & helps with OCR
-          ubuntu-classic
-        ];
       };
 
-    enableOCR = true;
+      i18n.supportedLocales = [ "all" ];
 
-    testScript = ''
-      machine.wait_for_x()
+      fonts.packages = with pkgs; [
+        # Intended font & helps with OCR
+        ubuntu-classic
+      ];
+    };
 
-      with subtest("morph browser launches"):
-          machine.execute("morph-browser >&2 &")
-          machine.wait_for_text(r"Web Browser|New|sites|Bookmarks")
-          machine.screenshot("morph_open")
+  enableOCR = true;
 
-      with subtest("morph browser displays HTML"):
-          machine.send_chars("file://${pkgs.valgrind.doc}/share/doc/valgrind/html/index.html\n")
-          machine.wait_for_text("Valgrind Documentation")
-          machine.screenshot("morph_htmlcontent")
+  testScript = ''
+    machine.wait_for_x()
 
-      machine.succeed("pkill -f morph-browser")
+    with subtest("morph browser launches"):
+        machine.execute("morph-browser >&2 &")
+        machine.wait_for_text(r"Web Browser|New|sites|Bookmarks")
+        machine.screenshot("morph_open")
 
-      with subtest("morph browser localisation works"):
-          machine.execute("env LANG=de_DE.UTF-8 morph-browser >&2 &")
-          machine.wait_for_text(r"Web-Browser|Neuer|Seiten|Lesezeichen")
-          machine.screenshot("morph_localised")
-    '';
-  }
-)
+    with subtest("morph browser displays HTML"):
+        machine.send_chars("file://${pkgs.valgrind.doc}/share/doc/valgrind/html/index.html\n")
+        machine.wait_for_text("Valgrind Documentation")
+        machine.screenshot("morph_htmlcontent")
+
+    machine.succeed("pkill -f morph-browser")
+
+    with subtest("morph browser localisation works"):
+        machine.execute("env LANG=de_DE.UTF-8 morph-browser >&2 &")
+        machine.wait_for_text(r"Web-Browser|Neuer|Seiten|Lesezeichen")
+        machine.screenshot("morph_localised")
+  '';
+}

nixos/tests/postgrest.nix

@@ -0,0 +1,88 @@
+{ lib, ... }:
+{
+  name = "postgrest";
+
+  meta = {
+    maintainers = with lib.maintainers; [ wolfgangwalther ];
+  };
+
+  nodes.machine =
+    {
+      config,
+      lib,
+      pkgs,
+      ...
+    }:
+    {
+      services.postgresql = {
+        enable = true;
+        initialScript = pkgs.writeText "init.sql" ''
+          CREATE ROLE postgrest LOGIN NOINHERIT;
+          CREATE ROLE anon ROLE postgrest;
+
+          CREATE ROLE postgrest_with_password LOGIN NOINHERIT PASSWORD 'password';
+          CREATE ROLE authenticated ROLE postgrest_with_password;
+        '';
+      };
+
+      services.postgrest = {
+        enable = true;
+        settings = {
+          admin-server-port = 3001;
+          db-anon-role = "anon";
+          db-uri.dbname = "postgres";
+        };
+      };
+
+      specialisation.withSecrets.configuration = {
+        services.postgresql.enableTCPIP = true;
+        services.postgrest = {
+          pgpassFile = "/run/secrets/.pgpass";
+          jwtSecretFile = "/run/secrets/jwt.secret";
+          settings.db-uri.host = "localhost";
+          settings.db-uri.user = "postgrest_with_password";
+          settings.server-port = 3000;
+          settings.server-unix-socket = null;
+        };
+      };
+    };
+
+  extraPythonPackages = p: [ p.pyjwt ];
+
+  testScript =
+    { nodes, ... }:
+    let
+      withSecrets = "${nodes.machine.system.build.toplevel}/specialisation/withSecrets";
+    in
+    ''
+      import jwt
+
+      machine.wait_for_unit("postgresql.service")
+
+      def wait_for_postgrest():
+          machine.wait_for_unit("postgrest.service")
+          machine.wait_until_succeeds("curl --fail -s http://localhost:3001/ready", timeout=30)
+
+      with subtest("anonymous access"):
+          wait_for_postgrest()
+          machine.succeed(
+            "curl --fail-with-body --no-progress-meter --unix-socket /run/postgrest/postgrest.sock http://localhost",
+            timeout=2
+          )
+
+      machine.execute("""
+        mkdir -p /run/secrets
+        echo "*:*:*:*:password" > /run/secrets/.pgpass
+        echo reallyreallyreallyreallyverysafe > /run/secrets/jwt.secret
+      """)
+
+      with subtest("authenticated access"):
+          machine.succeed("${withSecrets}/bin/switch-to-configuration test >&2")
+          wait_for_postgrest()
+          token = jwt.encode({ "role": "authenticated" }, "reallyreallyreallyreallyverysafe")
+          machine.succeed(
+            f"curl --fail-with-body --no-progress-meter -H 'Authorization: Bearer {token}' http://localhost:3000",
+            timeout=2
+          )
+    '';
+}

pkgs/applications/audio/qpwgraph/default.nix

@@ -14,14 +14,14 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "qpwgraph";
-  version = "0.8.2";
+  version = "0.8.3";
 
   src = fetchFromGitLab {
     domain = "gitlab.freedesktop.org";
     owner = "rncbc";
     repo = "qpwgraph";
     rev = "v${finalAttrs.version}";
-    sha256 = "sha256-BU57Iprz+kQXybKtR26Qi+3gsLv761hlg4HAnay6hIA=";
+    sha256 = "sha256-adgUpX2xfjf61//SUfhUU4NCP048q0WsTM4YkUny0UE=";
   };
 
   nativeBuildInputs = [

pkgs/applications/editors/emacs/build-support/trivial.nix

@@ -19,7 +19,12 @@ lib.extendMkDerivation {
             foundMakefile=1
           fi
 
-          emacs -l package -f package-initialize -L . --batch -f batch-byte-compile *.el
+          emacs -l package -f package-initialize \
+            --eval "(setq byte-compile-debug ${if finalAttrs.ignoreCompilationError then "nil" else "t"})" \
+            --eval "(setq byte-compile-error-on-warn ${
+              if finalAttrs.turnCompilationWarningToError then "t" else "nil"
+            })" \
+            -L . --batch -f batch-byte-compile *.el
 
           runHook postBuild
         '';

pkgs/applications/editors/jupyter-kernels/xeus-cling/xeus-cling.nix

@@ -34,6 +34,21 @@ let
     };
   });
 
+  # Nixpkgs moved to xeus 5.2.0, but we need 3.2.0
+  # https://github.com/jupyter-xeus/xeus-cling/issues/523
+  xeus_3_2_0 = xeus.overrideAttrs (oldAttrs: {
+    version = "3.2.0";
+
+    src = fetchFromGitHub {
+      owner = "jupyter-xeus";
+      repo = "xeus";
+      tag = "3.2.0";
+      sha256 = "sha256-D/dJ0SHxTHJw63gHD6FRZS7O2TVZ0voIv2mQASEjLA8=";
+    };
+
+    buildInputs = oldAttrs.buildInputs ++ lib.singleton xtl;
+  });
+
 in
 
 clangStdenv.mkDerivation rec {
@@ -62,7 +77,7 @@ clangStdenv.mkDerivation rec {
     ncurses
     openssl
     pugixml
-    xeus
+    xeus_3_2_0
     xeus-zmq
     xtl
     zeromq
@@ -73,11 +88,11 @@ clangStdenv.mkDerivation rec {
 
   postPatch = ''
     substituteInPlace src/xmagics/executable.cpp \
-      --replace "getDataLayout" "getDataLayoutString"
+      --replace-fail "getDataLayout" "getDataLayoutString"
     substituteInPlace src/xmagics/execution.cpp \
-      --replace "simplisticCastAs" "castAs"
+      --replace-fail "simplisticCastAs" "castAs"
     substituteInPlace src/xmime_internal.hpp \
-      --replace "code.str()" "code.str().str()"
+      --replace-fail "code.str()" "code.str().str()"
   '';
 
   dontStrip = debug;

pkgs/applications/editors/vscode/extensions/anweber.vscode-httpyac/default.nix

@@ -5,14 +5,14 @@
 }:
 
 let
-  version = "6.16.6";
+  version = "6.16.7";
 in
 vscode-utils.buildVscodeMarketplaceExtension {
   mktplcRef = {
     name = "vscode-httpyac";
     publisher = "anweber";
     inherit version;
-    hash = "sha256-GR1DX6td/a75STpfIU0UtOxpNBWCkyzecEZdDMZTy1M=";
+    hash = "sha256-NAyVsEb3QBgq+cGWF03kjk2bQ8L5mulYYyIhIhjNVMQ=";
   };
 
   buildInputs = [ httpyac ];

pkgs/applications/editors/vscode/extensions/visualjj.visualjj/default.nix

@@ -2,6 +2,7 @@
   stdenvNoCC,
   lib,
   vscode-utils,
+  vscode-extensions-update-script,
 }:
 
 vscode-utils.buildVscodeMarketplaceExtension {
@@ -10,34 +11,43 @@ vscode-utils.buildVscodeMarketplaceExtension {
       sources = {
         "x86_64-linux" = {
           arch = "linux-x64";
-          hash = "sha256-ub19F5vWUWg2eWUg/lst/+GrCsw6o6yeRQ9Lnb83Oow=";
+          hash = "sha256-eeLALUmJoIJfLKbX7MWQFIexfid7eOPTK0UE1sgd5jA=";
         };
         "x86_64-darwin" = {
           arch = "darwin-x64";
-          hash = "sha256-sNxpfCZbT4rCBn7fYBimFiNsMg72i8GmLfK7EP+8hHg=";
+          hash = "sha256-DftuIxJpP3zcfsoCam4FoqO2PSS/xPTmdefjhWAJqc0=";
         };
         "aarch64-linux" = {
           arch = "linux-arm64";
-          hash = "sha256-snPaNPNTHFHZmaXckcjQuHTw/LvwaEj9irRLXnyrGHU=";
+          hash = "sha256-TiZTp19fcDYPvJnx7F/i96JD8gcE+t1irZstnuagchQ=";
         };
         "aarch64-darwin" = {
           arch = "darwin-arm64";
-          hash = "sha256-wcNms02vhe3WSWn0HE7owf/0W25EZvkLvRn2oQJewd4=";
+          hash = "sha256-oXKAxgZ1IH+qiw9E/96J7rmvSHgLPwLZItLpFRjh7c0=";
         };
       };
     in
     {
       name = "visualjj";
       publisher = "visualjj";
-      version = "0.13.6";
+      version = "0.14.1";
     }
-    // sources.${stdenvNoCC.system} or (throw "Unsupported system ${stdenvNoCC.system}");
+    // sources.${stdenvNoCC.hostPlatform.system}
+      or (throw "Unsupported system ${stdenvNoCC.hostPlatform.system}");
+
+  passthru.updateScript = vscode-extensions-update-script { extraArgs = [ "--platforms" ]; };
 
   meta = {
     description = "Jujutsu version control integration, for simpler Git workflow";
     downloadPage = "https://www.visualjj.com";
     homepage = "https://www.visualjj.com";
     license = lib.licenses.unfree;
+    platforms = [
+      "aarch64-linux"
+      "aarch64-darwin"
+      "x86_64-linux"
+      "x86_64-darwin"
+    ];
     maintainers = [ lib.maintainers.drupol ];
   };
 }

pkgs/applications/emulators/mame/default.nix

@@ -40,14 +40,14 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "mame";
-  version = "0.275";
+  version = "0.276";
   srcVersion = builtins.replaceStrings [ "." ] [ "" ] version;
 
   src = fetchFromGitHub {
     owner = "mamedev";
     repo = "mame";
     rev = "mame${srcVersion}";
-    hash = "sha256-VD0T+zoR8fPZqRwTVrk2k5ui3tLQumEg1Fd64SJdszU=";
+    hash = "sha256-HrEQmeCTwNXcEWcpXfLkBNnZdcZag4nB6ZN+8KKf5AE=";
   };
 
   outputs = [

pkgs/applications/misc/klayout/default.nix

@@ -1,6 +1,17 @@
-{ lib, mkDerivation, fetchFromGitHub
-, python3, ruby, qtbase, qtmultimedia, qttools, qtxmlpatterns
-, which, perl, libgit2
+{
+  lib,
+  mkDerivation,
+  fetchFromGitHub,
+  python3,
+  ruby,
+  qtbase,
+  qtmultimedia,
+  qttools,
+  qtxmlpatterns,
+  which,
+  perl,
+  libgit2,
+  stdenv,
 }:
 
 mkDerivation rec {
@@ -41,12 +52,28 @@ mkDerivation rec {
     runHook postBuild
   '';
 
-  postBuild = ''
-    mkdir $out/bin
-    mv $out/lib/klayout $out/bin/
+  postBuild =
+    lib.optionalString stdenv.hostPlatform.isLinux ''
+      mkdir $out/bin
 
-    install -Dm444 etc/klayout.desktop -t $out/share/applications
-    install -Dm444 etc/logo.png $out/share/icons/hicolor/256x256/apps/klayout.png
+      install -Dm444 etc/klayout.desktop -t $out/share/applications
+      install -Dm444 etc/logo.png $out/share/icons/hicolor/256x256/apps/klayout.png
+      mv $out/lib/klayout $out/bin/
+    ''
+    + lib.optionalString stdenv.hostPlatform.isDarwin ''
+      mkdir -p $out/Applications
+      mv $out/lib/klayout.app $out/Applications/
+    '';
+
+  preFixup = lib.optionalString stdenv.hostPlatform.isDarwin ''
+    exec_name=$out/Applications/klayout.app/Contents/MacOS/klayout
+
+    for lib in $out/lib/libklayout_*.0.dylib; do
+      base_name=$(basename $lib)
+      install_name_tool -change "$base_name" "@rpath/$base_name" "$exec_name"
+    done
+
+    wrapQtApp "$out/Applications/klayout.app/Contents/MacOS/klayout"
   '';
 
   env.NIX_CFLAGS_COMPILE = toString [ "-Wno-parentheses" ];
@@ -63,8 +90,7 @@ mkDerivation rec {
     license = with licenses; [ gpl2Plus ];
     homepage = "https://www.klayout.de/";
     changelog = "https://www.klayout.de/development.html#${version}";
-    platforms = platforms.linux;
+    platforms = platforms.linux ++ platforms.darwin;
     maintainers = with maintainers; [ ];
   };
 }
-

pkgs/applications/science/electronics/dsview/default.nix

@@ -16,7 +16,7 @@
   desktopToDarwinBundle,
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "dsview";
 
   version = "1.3.2";
@@ -24,7 +24,7 @@ stdenv.mkDerivation rec {
   src = fetchFromGitHub {
     owner = "DreamSourceLab";
     repo = "DSView";
-    rev = "v${version}";
+    rev = "v${finalAttrs.version}";
     sha256 = "sha256-d/TfCuJzAM0WObOiBhgfsTirlvdROrlCm+oL1cqUrIs=";
   };
 
@@ -33,6 +33,9 @@ stdenv.mkDerivation rec {
     ./install.patch
   ];
 
+  # /build/source/libsigrok4DSL/strutil.c:343:19: error: implicit declaration of function 'strcasecmp'; did you mean 'g_strcasecmp'? []
+  env.NIX_CFLAGS_COMPILE = "-Wno-error=implicit-function-declaration";
+
   nativeBuildInputs = [
     cmake
     pkg-config
@@ -49,15 +52,15 @@ stdenv.mkDerivation rec {
     python3
   ] ++ lib.optional stdenv.hostPlatform.isLinux qtwayland;
 
-  meta = with lib; {
+  meta = {
     description = "GUI program for supporting various instruments from DreamSourceLab, including logic analyzer, oscilloscope, etc";
     mainProgram = "DSView";
     homepage = "https://www.dreamsourcelab.com/";
-    license = licenses.gpl3Plus;
-    platforms = platforms.unix;
-    maintainers = with maintainers; [
+    license = lib.licenses.gpl3Plus;
+    platforms = lib.platforms.unix;
+    maintainers = with lib.maintainers; [
       bachp
       carlossless
     ];
   };
-}
+})

pkgs/applications/video/obs-studio/default.nix

@@ -68,13 +68,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "obs-studio";
-  version = "31.0.2";
+  version = "31.0.3";
 
   src = fetchFromGitHub {
     owner = "obsproject";
     repo = "obs-studio";
     rev = finalAttrs.version;
-    hash = "sha256-I8VExGFr0thEaT8vHvdNwck7AYSpdpfLVPjij1Utt0E=";
+    hash = "sha256-i1wkGlafPvfMTsQr5Ww5iwmUu+23cr0YmN10llJfohA=";
     fetchSubmodules = true;
   };
 

pkgs/by-name/al/aligator/package.nix

@@ -8,7 +8,7 @@
   gbenchmark,
   graphviz,
   lib,
-  llvmPackages, # llvm/Support/Host.h required by casadi 3.6.5 and not available in llvm 18
+  llvmPackages,
   pinocchio,
   pkg-config,
   proxsuite-nlp,
@@ -20,13 +20,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "aligator";
-  version = "0.8.0";
+  version = "0.12.0";
 
   src = fetchFromGitHub {
     owner = "Simple-Robotics";
     repo = "aligator";
-    rev = "v${finalAttrs.version}";
-    hash = "sha256-o4QjxTaZUa17hZsCv4hCI2cedaHoojBtLe8SVUkl0bo=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-oy2qcJbIGr5pe+XYWKntfsc6Ie7oEU1qqrPXjuqULmY=";
   };
 
   outputs = [
@@ -36,13 +36,21 @@ stdenv.mkDerivation (finalAttrs: {
 
   strictDeps = true;
 
-  nativeBuildInputs = [
-    doxygen
-    cmake
-    graphviz
-    pkg-config
-  ] ++ lib.optional pythonSupport python3Packages.pythonImportsCheckHook;
-  buildInputs = [ fmt ] ++ lib.optional stdenv.hostPlatform.isDarwin llvmPackages.openmp;
+  nativeBuildInputs =
+    [
+      doxygen
+      cmake
+      graphviz
+      pkg-config
+    ]
+    ++ lib.optionals pythonSupport [
+      python3Packages.pythonImportsCheckHook
+    ];
+  buildInputs =
+    [ fmt ]
+    ++ lib.optionals stdenv.hostPlatform.isDarwin [
+      llvmPackages.openmp
+    ];
   propagatedBuildInputs =
     [ suitesparse ]
     ++ lib.optionals pythonSupport [
@@ -74,14 +82,19 @@ stdenv.mkDerivation (finalAttrs: {
     ]
     ++ lib.optionals (stdenv.hostPlatform.isDarwin && pythonSupport) [
       # ignore one failing test for now
-      (lib.cmakeFeature "CMAKE_CTEST_ARGUMENTS" "--exclude-regex;aligator-test-py-integrators")
+      (lib.cmakeFeature "CMAKE_CTEST_ARGUMENTS" "--exclude-regex;aligator-test-py-rollout")
     ];
 
   # Fontconfig error: Cannot load default config file: No such file: (null)
   env.FONTCONFIG_FILE = "${fontconfig.out}/etc/fonts/fonts.conf";
 
-  # Fontconfig error: No writable cache directories
-  preBuild = "export XDG_CACHE_HOME=$(mktemp -d)";
+  preBuild = ''
+    # silence matplotlib warning
+    export MPLCONFIGDIR=$(mktemp -d)
+
+    # Fontconfig error: No writable cache directories
+    export XDG_CACHE_HOME=$(mktemp -d)
+  '';
 
   doCheck = true;
   pythonImportsCheck = [ "aligator" ];

pkgs/by-name/ay/ayatana-indicator-display/package.nix

@@ -17,6 +17,7 @@
   libgudev,
   libqtdbusmock,
   libqtdbustest,
+  librda,
   libsForQt5,
   lomiri,
   mate,
@@ -30,13 +31,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "ayatana-indicator-display";
-  version = "24.5.0";
+  version = "24.5.1";
 
   src = fetchFromGitHub {
     owner = "AyatanaIndicators";
     repo = "ayatana-indicator-display";
     tag = finalAttrs.version;
-    hash = "sha256-ZEmJJtVK1dHIrY0C6pqVu1N5PmQtYqX0K5v5LvzNfFA=";
+    hash = "sha256-vvDgJVFrgtjAzDXXas19osDydS+C3brZOctXIIWrkyM=";
   };
 
   postPatch = ''
@@ -69,6 +70,7 @@ stdenv.mkDerivation (finalAttrs: {
       glib
       libayatana-common
       libgudev
+      librda
       libsForQt5.qtbase
       systemd
     ]

pkgs/by-name/ay/ayatana-indicator-messages/fix-pie.patch

@@ -1,29 +0,0 @@
-From 316457cf70dd105905d5d4925f43de280f08ab10 Mon Sep 17 00:00:00 2001
-From: OPNA2608 <opna2608@protonmail.com>
-Date: Sat, 11 Jan 2025 20:55:29 +0100
-Subject: [PATCH] tests/CMakeLists.txt: Drop hardcoded -no-pie linker flags
-
----
- tests/CMakeLists.txt | 2 --
- 1 file changed, 2 deletions(-)
-
-diff --git a/tests/CMakeLists.txt b/tests/CMakeLists.txt
-index 63beacb..5b0812c 100644
---- a/tests/CMakeLists.txt
-+++ b/tests/CMakeLists.txt
-@@ -32,7 +32,6 @@ add_dependencies("indicator-messages-service" "ayatana-indicator-messages-servic
- # test-gactionmuxer
- 
- add_executable("test-gactionmuxer" test-gactionmuxer.cpp)
--target_link_options("test-gactionmuxer" PRIVATE -no-pie)
- target_include_directories("test-gactionmuxer" PUBLIC ${PROJECT_DEPS_INCLUDE_DIRS} "${CMAKE_SOURCE_DIR}/src")
- target_link_libraries("test-gactionmuxer" "indicator-messages-service" ${PROJECT_DEPS_LIBRARIES} ${GTEST_LIBRARIES} ${GTEST_BOTH_LIBRARIES} ${GMOCK_LIBRARIES})
- add_test("test-gactionmuxer" "test-gactionmuxer")
-@@ -59,7 +58,6 @@ add_custom_target("gschemas-compiled" ALL DEPENDS gschemas.compiled)
- 
- pkg_check_modules(DBUSTEST REQUIRED dbustest-1)
- add_executable("indicator-test" indicator-test.cpp)
--target_link_options("indicator-test" PRIVATE -no-pie)
- target_include_directories("indicator-test" PUBLIC ${PROJECT_DEPS_INCLUDE_DIRS} ${DBUSTEST_INCLUDE_DIRS} "${CMAKE_SOURCE_DIR}/libmessaging-menu")
- target_link_libraries("indicator-test" "messaging-menu" ${PROJECT_DEPS_LIBRARIES} ${DBUSTEST_LIBRARIES} ${GTEST_LIBRARIES} ${GTEST_BOTH_LIBRARIES} ${GMOCK_LIBRARIES})
- target_compile_definitions(

pkgs/by-name/ay/ayatana-indicator-messages/package.nix

@@ -26,13 +26,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "ayatana-indicator-messages";
-  version = "24.5.0";
+  version = "24.5.1";
 
   src = fetchFromGitHub {
     owner = "AyatanaIndicators";
     repo = "ayatana-indicator-messages";
     tag = finalAttrs.version;
-    hash = "sha256-D1181eD2mAVXEa7RLXXC4b2tVGrxbh0WWgtbC1anHH0=";
+    hash = "sha256-M6IXI0ZnWPZod2ewxxfCeHhdYUrWDW/BFc1vMHmjObA=";
   };
 
   outputs = [
@@ -40,16 +40,11 @@ stdenv.mkDerivation (finalAttrs: {
     "dev"
   ] ++ lib.optionals withDocumentation [ "devdoc" ];
 
-  patches = [
-    # Remove when https://github.com/AyatanaIndicators/ayatana-indicator-messages/pull/39 merged & in release
-    ./fix-pie.patch
-  ];
-
   postPatch =
     ''
       # Uses pkg_get_variable, cannot substitute prefix with that
       substituteInPlace data/CMakeLists.txt \
-        --replace-fail "\''${SYSTEMD_USER_DIR}" "$out/lib/systemd/user"
+        --replace-fail 'pkg_get_variable(SYSTEMD_USER_DIR systemd systemduserunitdir)' 'pkg_get_variable(SYSTEMD_USER_DIR systemd systemduserunitdir DEFINE_VARIABLES prefix=''${CMAKE_INSTALL_PREFIX})'
 
       # Bad concatenation
       substituteInPlace libmessaging-menu/messaging-menu.pc.in \
@@ -61,8 +56,8 @@ stdenv.mkDerivation (finalAttrs: {
         --replace-fail 'GI_TYPELIB_PATH=\"' 'GI_TYPELIB_PATH=\"$GI_TYPELIB_PATH$\{GI_TYPELIB_PATH\:+\:\}'
     ''
     + lib.optionalString (!withDocumentation) ''
-      sed -i CMakeLists.txt \
-        '/add_subdirectory(doc)/d'
+      substituteInPlace CMakeLists.txt \
+        --replace-fail 'add_subdirectory(doc)' '# add_subdirectory(doc)'
     '';
 
   strictDeps = true;
@@ -105,9 +100,9 @@ stdenv.mkDerivation (finalAttrs: {
   ];
 
   cmakeFlags = [
-    "-DENABLE_TESTS=${lib.boolToString finalAttrs.finalPackage.doCheck}"
-    "-DGSETTINGS_LOCALINSTALL=ON"
-    "-DGSETTINGS_COMPILE=ON"
+    (lib.cmakeBool "ENABLE_TESTS" finalAttrs.finalPackage.doCheck)
+    (lib.cmakeBool "GSETTINGS_LOCALINSTALL" true)
+    (lib.cmakeBool "GSETTINGS_COMPILE" true)
   ];
 
   makeFlags = lib.optionals withDocumentation [
@@ -163,6 +158,9 @@ stdenv.mkDerivation (finalAttrs: {
       others, e.g. XFCE, LXDE).
     '';
     homepage = "https://github.com/AyatanaIndicators/ayatana-indicator-messages";
+    changelog = "https://github.com/AyatanaIndicators/ayatana-indicator-messages/blob/${
+      if (!builtins.isNull finalAttrs.src.tag) then finalAttrs.src.tag else finalAttrs.src.rev
+    }/ChangeLog";
     license = lib.licenses.gpl3Only;
     platforms = lib.platforms.linux;
     maintainers = with lib.maintainers; [ OPNA2608 ];

pkgs/by-name/b3/b3sum/package.nix

@@ -6,15 +6,15 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "b3sum";
-  version = "1.7.0";
+  version = "1.8.0";
 
   src = fetchCrate {
     inherit version pname;
-    hash = "sha256-bDydKLPJgeUngkWO8L5BkJP9rGy3mx0QJhWAN2CCYhE=";
+    hash = "sha256-FWblGKr/ZQsLZkPOax20FYEyoLiPREf7UjfOtFCljZU=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-yB0noD5eabr+HANPRhIhBEG4PCwtJPULNIy+Wx/tC3U=";
+  cargoHash = "sha256-vSxAG0CKtTHZ/3fSDtZqmqvfY+swDBBPZ8YZP1Vlj0w=";
 
   meta = {
     description = "BLAKE3 cryptographic hash function";

pkgs/by-name/ba/bazelisk/package.nix

@@ -17,8 +17,6 @@ buildGoModule rec {
 
   vendorHash = "sha256-kXv7q32cFD9mwWsFaod7QPn3el72P4ugVc4DGwez8v0=";
 
-  doCheck = false;
-
   ldflags = [
     "-s"
     "-w"

pkgs/by-name/bi/bibiman/package.nix

@@ -8,18 +8,18 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "bibiman";
-  version = "0.11.0";
+  version = "0.11.4";
 
   src = fetchFromGitea {
     domain = "codeberg.org";
     owner = "lukeflo";
     repo = "bibiman";
     tag = "v${version}";
-    hash = "sha256-g8C5yLtEHS/4Q312Rdse9FFymDXacIHqwg/ySpSt+NE=";
+    hash = "sha256-LYoo3j3On4oCANg0acsyL7knFhOjKW0/zBVyK20knDs=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-RWLKiYyUQUgAPPWTugp1G05X3B9SbknmpVLc7eSdn8U=";
+  cargoHash = "sha256-VYG9KshZ4/MIgtwmfJ+sa8PKj9dgPuNgCUgqF+XRiMA=";
 
   nativeInstallCheckInputs = [
     versionCheckHook

pkgs/by-name/bu/bun/package.nix

@@ -16,7 +16,7 @@
 }:
 
 stdenvNoCC.mkDerivation rec {
-  version = "1.2.5";
+  version = "1.2.7";
   pname = "bun";
 
   src = passthru.sources.${stdenvNoCC.hostPlatform.system} or (throw "Unsupported system: ${stdenvNoCC.hostPlatform.system}");
@@ -76,19 +76,19 @@ stdenvNoCC.mkDerivation rec {
     sources = {
       "aarch64-darwin" = fetchurl {
         url = "https://github.com/oven-sh/bun/releases/download/bun-v${version}/bun-darwin-aarch64.zip";
-        hash = "sha256-VeZSChcuIqN9SCLyOv3pCybzaIDOPqrTSGmUGNv3iLs=";
+        hash = "sha256-VxB20tZEoKSWchHphR9YTESmRcCgt7tRma/xIXL9WuQ=";
       };
       "aarch64-linux" = fetchurl {
         url = "https://github.com/oven-sh/bun/releases/download/bun-v${version}/bun-linux-aarch64.zip";
-        hash = "sha256-7htcq7X9uyVkB4fjKYRu9BOEyoaZ21BPRb/uAV80i1g=";
+        hash = "sha256-nCS4Oky54tHiH8cdHNj4nz1vd3bqeR1CusjgPku1MZs=";
       };
       "x86_64-darwin" = fetchurl {
         url = "https://github.com/oven-sh/bun/releases/download/bun-v${version}/bun-darwin-x64-baseline.zip";
-        hash = "sha256-P/MaERH0ww2O8a2Xk74ziNAp5aEZ8JiP5PCltNSTB1M=";
+        hash = "sha256-C8LjwcdW/1H6NfzsJ0+X+xRzfYFNihzne8ePJGk1etE=";
       };
       "x86_64-linux" = fetchurl {
         url = "https://github.com/oven-sh/bun/releases/download/bun-v${version}/bun-linux-x64.zip";
-        hash = "sha256-iPZL7e4zD/TWMo4+kMZpvHrFMUknxgT4XjKeoqHRl5s=";
+        hash = "sha256-hHsTjLGOq4Inyx87Fu3Kuvdk5Yp5pef5BeunaOo138s=";
       };
     };
     updateScript = writeShellScript "update-bun" ''

pkgs/by-name/ca/casadi/package.nix

@@ -38,13 +38,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "casadi";
-  version = "3.6.7";
+  version = "3.7.0";
 
   src = fetchFromGitHub {
     owner = "casadi";
     repo = "casadi";
     rev = finalAttrs.version;
-    hash = "sha256-Mft0qhjdAbU82RgjYuKue5p7EqbTbt3ii5yXSsCFHrQ=";
+    hash = "sha256-WumXAWO65XnNQqHMqAwfj2Y+KGOVTWx95qIuyE1M9us=";
   };
 
   patches = [

pkgs/by-name/ch/checkstyle/package.nix

@@ -1,12 +1,12 @@
 { lib, stdenvNoCC, fetchurl, makeBinaryWrapper, jre }:
 
 stdenvNoCC.mkDerivation rec {
-  version = "10.21.4";
+  version = "10.22.0";
   pname = "checkstyle";
 
   src = fetchurl {
     url = "https://github.com/checkstyle/checkstyle/releases/download/checkstyle-${version}/checkstyle-${version}-all.jar";
-    sha256 = "sha256-PB2U1uzIPgLf9YfJultrTsT+w4x6lY61h+/smyji8xg=";
+    sha256 = "sha256-U6QpASgCKxv3NTFINkJ9Aey4E9Y089RY5X2TNhSlIOs=";
   };
 
   nativeBuildInputs = [ makeBinaryWrapper ];

pkgs/by-name/ci/civo/package.nix

@@ -7,16 +7,16 @@
 
 buildGoModule rec {
   pname = "civo";
-  version = "1.1.98";
+  version = "1.1.99";
 
   src = fetchFromGitHub {
     owner = "civo";
     repo = "cli";
     rev = "v${version}";
-    hash = "sha256-gxqVWnhlLYizoij6L9/ThM9T7K7++nGZwgFP3OzBqOY=";
+    hash = "sha256-30uv9vVjfjZWsUhwrgY7TYs8cAkv+v/TdsSW+VmupJM=";
   };
 
-  vendorHash = "sha256-LN6rzZXw7YoHMyPCujPiyjs8tG+nN2fxwQnEenohw1c=";
+  vendorHash = "sha256-c4KyK0HtIW08/DQ6PLgA+M8GABrKHjAayZahkvo/Erc=";
 
   nativeBuildInputs = [ installShellFiles ];
 

pkgs/by-name/cl/cloud-hypervisor/package.nix

@@ -10,17 +10,17 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "cloud-hypervisor";
-  version = "44.0";
+  version = "45.0";
 
   src = fetchFromGitHub {
     owner = "cloud-hypervisor";
     repo = "cloud-hypervisor";
     rev = "v${version}";
-    hash = "sha256-2nA8bhezmGa6Gu420nxDrgW0SonTQv1WoGYmBwm7/bI=";
+    hash = "sha256-PmgHO3gRE/LfLiRC+sAQXKUeclweVUNJV2ihpkvx0Wg=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-e2VbzBPfoy5+YrqZ5mkbxMLpQIOG0x5tIhNG6Tv+u0M=";
+  cargoHash = "sha256-h9ydLEp7GpW5jMkt5jObR09lPWGs+rmvdoEZntIZwxY=";
 
   separateDebugInfo = true;
 

pkgs/by-name/co/compiledb/package.nix

@@ -7,22 +7,24 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "compiledb";
-  version = "0.10.1";
+  version = "0.10.7";
   pyproject = true;
 
-  build-system = [ python3Packages.setuptools ];
-
   src = fetchFromGitHub {
     owner = "nickdiego";
     repo = "compiledb";
-    tag = "v${version}";
-    hash = "sha256-pN2F0bFT5r8w+8kZOP/tU7Cx1SDN81fzkMfnj19jMWM=";
+    tag = version;
+    hash = "sha256-toqBf5q1EfZVhZN5DAtxkyFF7UlyNbqxWAIWFMwacxw=";
   };
 
+  build-system = with python3Packages; [
+    setuptools
+    setuptools-scm
+  ];
+
   dependencies = with python3Packages; [
     click
     bashlex
-    shutilwhich
   ];
 
   # fix the tests

pkgs/by-name/cr/crocoddyl/package.nix

@@ -16,13 +16,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "crocoddyl";
-  version = "3.0.0";
+  version = "3.0.1";
 
   src = fetchFromGitHub {
     owner = "loco-3d";
     repo = "crocoddyl";
-    rev = "v${finalAttrs.version}";
-    hash = "sha256-oWcclzzuswiR1SaQJd6GnMltJ2vgt7AgJPT0FJzD1Gs=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-eUH9fMhuIUp5kuDKNo4B8iJ3JlMIqv7wX6meOpyPTJk=";
   };
 
   outputs = [
@@ -59,17 +59,11 @@ stdenv.mkDerivation (finalAttrs: {
       python3Packages.scipy
     ];
 
-  cmakeFlags =
-    [
-      (lib.cmakeBool "INSTALL_DOCUMENTATION" true)
-      (lib.cmakeBool "BUILD_EXAMPLES" pythonSupport)
-      (lib.cmakeBool "BUILD_PYTHON_INTERFACE" pythonSupport)
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      # ref. https://github.com/stack-of-tasks/pinocchio/issues/2563
-      # remove this for crocoddyl >= 3.0.0
-      (lib.cmakeFeature "CMAKE_CTEST_ARGUMENTS" "--exclude-regex;test_pybinds_*")
-    ];
+  cmakeFlags = [
+    (lib.cmakeBool "INSTALL_DOCUMENTATION" true)
+    (lib.cmakeBool "BUILD_EXAMPLES" pythonSupport)
+    (lib.cmakeBool "BUILD_PYTHON_INTERFACE" pythonSupport)
+  ];
 
   prePatch = ''
     substituteInPlace \

pkgs/by-name/ec/ecs-agent/package.nix

@@ -2,13 +2,13 @@
 
 buildGoModule rec {
   pname = "amazon-ecs-agent";
-  version = "1.91.1";
+  version = "1.91.2";
 
   src = fetchFromGitHub {
     rev = "v${version}";
     owner = "aws";
     repo = pname;
-    hash = "sha256-BIfyuZ7bf1P/8JfavIJNi06k8zEcCL1jwxAEnknpqq4=";
+    hash = "sha256-7f1qJ9dgouhj+DGikdIzUREPraAA/1y/5lYA8fbIoJo=";
   };
 
   vendorHash = null;

pkgs/by-name/fe/feather/package.nix

@@ -23,13 +23,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "feather";
-  version = "2.7.0";
+  version = "2.8.0";
 
   src = fetchFromGitHub {
     owner = "feather-wallet";
     repo = "feather";
     rev = finalAttrs.version;
-    hash = "sha256-CwydKX8cCtmrUSLUHNCDOteVmkjzj0zMHgwUyrWrWm8=";
+    hash = "sha256-c7qa6MmENCEjZz8b/xyCcCO2+iI5dI8hJynBW3haSWE=";
     fetchSubmodules = true;
   };
 

pkgs/by-name/ge/gearlever/package.nix

@@ -21,14 +21,14 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "gearlever";
-  version = "2.3.2";
+  version = "3.0.2";
   pyproject = false; # Built with meson
 
   src = fetchFromGitHub {
     owner = "mijorus";
     repo = "gearlever";
     tag = version;
-    hash = "sha256-w+tCOMDNm99cAtA9AmADBc6dP4y5KDDP8iiRZS+5upQ=";
+    hash = "sha256-b5CH7qJKsXwARCIv4EiwGcc3nH/GKGkb8gwxPWYAr4s=";
   };
 
   postPatch =

pkgs/by-name/gi/gitleaks/package.nix

@@ -6,6 +6,7 @@
   installShellFiles,
   nix-update-script,
   versionCheckHook,
+  git,
 }:
 
 buildGoModule rec {
@@ -32,8 +33,7 @@ buildGoModule rec {
     versionCheckHook
   ];
 
-  # With v8 the config tests are blocking
-  doCheck = false;
+  nativeCheckInputs = [ git ];
 
   postInstall = lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
     installShellCompletion --cmd ${pname} \

pkgs/by-name/go/go-grip/package.nix

@@ -0,0 +1,29 @@
+{
+  buildGoModule,
+  fetchFromGitHub,
+  lib,
+  gitUpdater,
+}:
+buildGoModule rec {
+  pname = "go-grip";
+  version = "0.5.6";
+
+  src = fetchFromGitHub {
+    owner = "chrishrb";
+    repo = "go-grip";
+    tag = "v${version}";
+    hash = "sha256-c3tl5nALPqIAMSqjbbQDi6mN6M1mKJvzxxDHcj/QyuY=";
+  };
+
+  vendorHash = "sha256-aU6vo/uqJzctD7Q8HPFzHXVVJwMmlzQXhAA6LSkRAow=";
+
+  passthru.updateScript = gitUpdater { rev-prefix = "v"; };
+
+  meta = {
+    description = "Preview Markdown files locally before committing them";
+    homepage = "https://github.com/chrishrb/go-grip";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ heisfer ];
+    mainProgram = "go-grip";
+  };
+}

pkgs/by-name/go/golangci-lint/package.nix

@@ -7,13 +7,13 @@
 
 buildGo124Module rec {
   pname = "golangci-lint";
-  version = "2.0.0";
+  version = "2.0.2";
 
   src = fetchFromGitHub {
     owner = "golangci";
     repo = "golangci-lint";
     rev = "v${version}";
-    hash = "sha256-1TDYMjFEyI9ULnLn+1RYxRWrGkJZcEDDGvLb4qiVLNc=";
+    hash = "sha256-+IndC9znKgVGiFWW0aCNjhxPwX1kDFnfG2+SKEQ15Rc=";
   };
 
   vendorHash = "sha256-B6mCvJtIfRbAv6fZ8Ge82nT9oEcL3WR4D+AAVs9R3zM=";

pkgs/by-name/gr/grun/package.nix

@@ -1,42 +0,0 @@
-{
-  lib,
-  stdenv,
-  fetchFromGitHub,
-  gtk2,
-  pkg-config,
-  autoreconfHook,
-}:
-
-stdenv.mkDerivation {
-  pname = "grun";
-  version = "0.9.3";
-
-  src = fetchFromGitHub {
-    owner = "lrgc";
-    repo = "grun";
-    rev = "release_0_9_3";
-    hash = "sha256-VbvX0wrgMIPmPnu3aQdtQ6H0X3umi8aJ42QvmmeMrJ0=";
-  };
-
-  buildInputs = [
-    gtk2
-  ];
-
-  nativeBuildInputs = [
-    pkg-config
-    autoreconfHook
-  ];
-
-  makeFlags = [
-    "PREFIX=${placeholder "out"}"
-  ];
-
-  meta = {
-    description = "Application launcher written in C and using GTK for the interface";
-    mainProgram = "grun";
-    homepage = "https://github.com/lrgc/grun";
-    platforms = lib.platforms.linux;
-    license = with lib.licenses; [ gpl2Only ];
-    maintainers = with lib.maintainers; [ _3JlOy-PYCCKUi ];
-  };
-}

pkgs/by-name/in/incus/package.nix

@@ -1,7 +1,7 @@
 import ./generic.nix {
-  hash = "sha256-uuaJoUrAZ1kSeO2xdXhfdI8Zy4zbA9r1pIhPMqzUios=";
-  version = "6.10.1";
-  vendorHash = "sha256-/8aBG8RiC03+oVI9lgPFwbi3b4juumziXL4WH0k/4PA=";
+  hash = "sha256-S6PTtgP4MFV+kiEgV8PBvek1SrVjLaCR9OJy/6jqJGE=";
+  version = "6.11.0";
+  vendorHash = "sha256-wKL+woCMjGJwCBG/JBhFbY4uc97/5K7OWPZRp0J+5DQ=";
   patches = [ ];
   nixUpdateExtraArgs = [
     "--override-filename=pkgs/by-name/in/incus/package.nix"

pkgs/by-name/la/lakectl/package.nix

@@ -7,18 +7,18 @@
 
 buildGoModule (finalAttrs: {
   pname = "lakectl";
-  version = "1.53.0";
+  version = "1.53.1";
 
   src = fetchFromGitHub {
     owner = "treeverse";
     repo = "lakeFS";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-AYFhkwnlK8RU/HPemJkoZiJ1DCSszIFybJRsUIGhs4g=";
+    hash = "sha256-kZ7GvrrZq9XAq//jC6sP4uudTJsGJw6/vYXAPs63Wq8=";
   };
 
   subPackages = [ "cmd/lakectl" ];
   proxyVendor = true;
-  vendorHash = "sha256-p5eHkVbUrcSC4i+R/HGh2nSTIWVkFNiN+TVh10rdWqs=";
+  vendorHash = "sha256-X7rXEM+8fgbmG+K05KOJp8345muASgnrWGW0jbJ9WSM=";
 
   ldflags = [
     "-s"

pkgs/by-name/la/lazysql/package.nix

@@ -10,13 +10,13 @@
 
 buildGoModule rec {
   pname = "lazysql";
-  version = "0.3.6";
+  version = "0.3.7";
 
   src = fetchFromGitHub {
     owner = "jorgerojas26";
     repo = "lazysql";
     rev = "v${version}";
-    hash = "sha256-tQZ8thL3rmTtxDG0Z/DgxH1PjDL4Kxx9LXDLqVTZ7Lc=";
+    hash = "sha256-fpzcCCLkUJGuTfQiADwLL2238LP0TJJMYAXUwCfPkFM=";
   };
 
   vendorHash = "sha256-LLOUTml/mz7edCUy82k+S5PfpFovgUTQr0BoQQXiVGs=";

pkgs/by-name/li/libpsm2/package.nix

@@ -53,5 +53,7 @@ stdenv.mkDerivation rec {
     ];
     platforms = [ "x86_64-linux" ];
     maintainers = [ maintainers.bzizou ];
+    # uses __off64_t, srand48_r, lrand48_r, drand48_r
+    broken = stdenv.hostPlatform.isMusl;
   };
 }

pkgs/by-name/ls/lsd/package.nix

@@ -6,6 +6,7 @@
   pandoc,
   testers,
   lsd,
+  git,
 }:
 
 rustPlatform.buildRustPackage rec {
@@ -37,8 +38,7 @@ rustPlatform.buildRustPackage rec {
       --zsh $releaseDir/build/lsd-*/out/_lsd
   '';
 
-  # Found argument '--test-threads' which wasn't expected, or isn't valid in this context
-  doCheck = false;
+  nativeCheckInputs = [ git ];
 
   passthru.tests.version = testers.testVersion { package = lsd; };
 

pkgs/by-name/ma/matrix-sdk-crypto-nodejs/package.nix

@@ -21,13 +21,9 @@ stdenv.mkDerivation rec {
     hash = "sha256-g86RPfhF9XHpbXhHRbyhl920VazCrQyRQrYV6tVCHy4=";
   };
 
-  cargoDeps = rustPlatform.importCargoLock {
-    lockFile = ./Cargo.lock;
-    outputHashes = {
-      "matrix-sdk-base-0.7.0" = "sha256-nCiG4T/MB7gvGrmadKOEbh8+54081PHee9Bm8oY/nl0=";
-      "ruma-0.10.1" = "sha256-Yc5RKk4aRjNIoQsMl30fFehTDCkRO9VvenAvLoVHzXo=";
-      "vodozemac-0.6.0" = "sha256-jJgrJJ0SFcy2oRRZ3ubuKnM2pLO8Tx6NyXordWJjz8o=";
-    };
+  cargoDeps = rustPlatform.fetchCargoVendor {
+    inherit pname version src;
+    hash = "sha256-5+nW5g9oxe4L39wJUkSuP3ul5yH8V+E7IdhQVfvzhNk=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/me/meld/package.nix

@@ -22,13 +22,13 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "meld";
-  version = "3.22.3";
+  version = "3.23.0";
 
   format = "other";
 
   src = fetchurl {
-    url = "mirror://gnome/sources/${pname}/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "sha256-N/fynrH/D+xNiwiNVIPFVt4QifbQGP5tSBmTyvJJnYQ=";
+    url = "mirror://gnome/sources/meld/${lib.versions.majorMinor version}/meld-${version}.tar.xz";
+    hash = "sha256-mDwqQkDgJaIQnHc4GYcQ6dawY8kQsEgzLRRpDPU4wqY=";
   };
 
   nativeBuildInputs = [
@@ -62,7 +62,7 @@ python3.pkgs.buildPythonApplication rec {
 
   passthru = {
     updateScript = gnome.updateScript {
-      packageName = pname;
+      packageName = "meld";
       versionPolicy = "none"; # should be odd-unstable but we are tracking unstable versions for now
     };
   };

pkgs/by-name/mi/miracle-wm/package.nix

@@ -30,19 +30,21 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "miracle-wm";
-  version = "0.4.1";
+  version = "0.5.1";
 
   src = fetchFromGitHub {
     owner = "miracle-wm-org";
     repo = "miracle-wm";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-LPcVLpskpmHc8EzdNqMT6BnbY8Le/BVojpXPIqy6tGI=";
+    hash = "sha256-PCY6vAnDjyoIL66oREUGRypQFX90EKB1RlXTkQDyXMw=";
   };
 
   postPatch =
     ''
       substituteInPlace CMakeLists.txt \
-        --replace-fail 'DESTINATION /usr/lib' 'DESTINATION ''${CMAKE_INSTALL_LIBDIR}'
+        --replace-fail 'DESTINATION /usr/lib' 'DESTINATION ''${CMAKE_INSTALL_LIBDIR}' \
+        --replace-fail '-march=native' '# -march=native' \
+        --replace-fail '-flto' '# -flto'
     ''
     + lib.optionalString (!finalAttrs.finalPackage.doCheck) ''
       substituteInPlace CMakeLists.txt \

pkgs/by-name/mi/mise/package.nix

@@ -23,17 +23,17 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "mise";
-  version = "2025.3.6";
+  version = "2025.3.11";
 
   src = fetchFromGitHub {
     owner = "jdx";
     repo = "mise";
     rev = "v${version}";
-    hash = "sha256-wp/C7RrMcpk/BFath9zZbEMzhQWFYagnT2zimnPRpPI=";
+    hash = "sha256-n7A6LGjcVz6LWz8fkkG5XS2WZf3FFkbidnt/S5jxy5g=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-49C4MzvGUiO16kNEKoHtlvkOxG16jsD2iW5upaVuYGI=";
+  cargoHash = "sha256-On2+ROA71RyZdFPvH4Zem/494Q4uCYS4EZSvQL1DDWQ=";
 
   nativeBuildInputs = [
     installShellFiles

pkgs/by-name/na/narsil/package.nix

@@ -14,16 +14,16 @@
 }:
 stdenv.mkDerivation rec {
   pname = "narsil";
-  version = "7c20b01e055491e86a44201504e8d36873ef1822";
+  version = "1.4.0-48-gaf7c8c1b3";
 
   src = fetchFromGitHub {
     owner = "NickMcConnell";
     repo = "NarSil";
-    rev = version;
-    hash = "sha256-6J9WCWXhKiTRLiH08DTGzAXe8QZFQOLYJkfNVONgWU0=";
+    tag = version;
+    hash = "sha256-w/rXKD66Kx+XE1ItOwurf5XWE02OHirofVMUQqpf6WQ=";
   };
 
-  passthru.updateScript = nix-update-script { extraArgs = [ "--version=branch=main" ]; };
+  passthru.updateScript = nix-update-script { };
 
   nativeBuildInputs = [ autoreconfHook ];
   buildInputs =

pkgs/by-name/ne/nestopia-ue/package.nix

@@ -22,13 +22,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "nestopia";
-  version = "1.53.0";
+  version = "1.53.1";
 
   src = fetchFromGitHub {
     owner = "0ldsk00l";
     repo = "nestopia";
     rev = finalAttrs.version;
-    hash = "sha256-C2uiC8zlleXQlThrRETJa9vu++mJy1ySJKAkgu5zuxc=";
+    hash = "sha256-6r6o/2GDp1Rcp+OWaQVgIQGC6NAxtmx4lxDWWpwv8aQ=";
   };
 
   buildInputs = [

pkgs/by-name/ne/networkmanager_strongswan/package.nix

@@ -15,11 +15,11 @@
 
 stdenv.mkDerivation rec {
   pname = "NetworkManager-strongswan";
-  version = "1.6.1";
+  version = "1.6.2";
 
   src = fetchurl {
     url = "https://download.strongswan.org/NetworkManager/${pname}-${version}.tar.bz2";
-    sha256 = "sha256-IMb5vOVGvMHeO1h5AJM1gCgSBMluhn1nYA1b8zC4EbY=";
+    sha256 = "sha256-jL8kf63MsCbTTvYn1M7YbpUOMXPl2h/ZY7Rpz2rAr34=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/of/offrss/package.nix

@@ -8,7 +8,7 @@
   libiconv,
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "offrss";
   version = "1.3";
 
@@ -28,7 +28,7 @@ stdenv.mkDerivation rec {
   # Workaround build failure on -fno-common toolchains:
   #   ld: serve_pdf.o:offrss.h:75: multiple definition of `cgi_url_path';
   #     offrss.o:offrss.h:75: first defined here
-  env.NIX_CFLAGS_COMPILE = "-fcommon";
+  env.NIX_CFLAGS_COMPILE = "-fcommon -Wno-error=implicit-function-declaration";
 
   configurePhase =
     ''
@@ -43,16 +43,16 @@ stdenv.mkDerivation rec {
     '';
 
   src = fetchurl {
-    url = "http://vicerveza.homeunix.net/~viric/soft/offrss/offrss-${version}.tar.gz";
-    sha256 = "1akw1x84jj2m9z60cvlvmz21qwlaywmw18pl7lgp3bj5nw6250p6";
+    url = "http://vicerveza.homeunix.net/~viric/soft/offrss/offrss-${finalAttrs.version}.tar.gz";
+    hash = "sha256-5oIiDLdFrnEfPfSiwCv3inIcxK+bbgbMT1VISVAPfKo=";
   };
 
-  meta = with lib; {
+  meta = {
     homepage = "http://vicerveza.homeunix.net/~viric/cgi-bin/offrss";
     description = "Offline RSS/Atom reader";
-    license = licenses.agpl3Plus;
+    license = lib.licenses.agpl3Plus;
     maintainers = [ ];
     platforms = lib.platforms.linux;
     mainProgram = "offrss";
   };
-}
+})

pkgs/by-name/om/omake/package.nix

@@ -1,18 +1,19 @@
 {
   lib,
   stdenv,
-  fetchurl,
+  fetchFromGitHub,
   ocaml,
 }:
 
-stdenv.mkDerivation rec {
-
+stdenv.mkDerivation (finalAttrs: {
   pname = "omake";
-  version = "0.10.6";
+  version = "0.10.7";
 
-  src = fetchurl {
-    url = "http://download.camlcity.org/download/${pname}-${version}.tar.gz";
-    hash = "sha256-AuSZEnybyk8HaDZ7mbwDqjFXMXVQ7TDRuRU/aRY8/yE=";
+  src = fetchFromGitHub {
+    owner = "ocaml-omake";
+    repo = "omake";
+    tag = "omake-${finalAttrs.version}";
+    hash = "sha256-5ZOdY3uGcI0KGpnr7epUwe2ueKCoLeaHGzaiTiXLNoc=";
   };
 
   strictDeps = true;
@@ -28,4 +29,4 @@ stdenv.mkDerivation rec {
     ];
     inherit (ocaml.meta) platforms;
   };
-}
+})

pkgs/by-name/on/oneDNN/package.nix

@@ -10,13 +10,13 @@
 # https://github.com/oneapi-src/oneDNN#oneapi-deep-neural-network-library-onednn
 stdenv.mkDerivation (finalAttrs: {
   pname = "oneDNN";
-  version = "3.7";
+  version = "3.7.2";
 
   src = fetchFromGitHub {
     owner = "oneapi-src";
     repo = "oneDNN";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-KUQRdsmEFC9hgBF0O8+Ltb2wC4QzjLjMdfxZCi3Dy2A=";
+    hash = "sha256-buOrJOPI2Fe5fqyaFjC+Wai4BX2RhQ+41+VR2Kyi8+A=";
   };
 
   outputs = [ "out" "dev" "doc" ];

pkgs/by-name/pi/pinentry-dmenu/package.nix

@@ -0,0 +1,60 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  fontconfig,
+  gpgme,
+  libX11,
+  libXinerama,
+  libXft,
+  pkg-config,
+  zlib,
+  writeText,
+  libassuan,
+  libconfig,
+  libgpg-error,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "pinentry-dmenu";
+  version = "0.2.2";
+
+  src = fetchFromGitHub {
+    owner = "ritze";
+    repo = "pinentry-dmenu";
+    tag = finalAttrs.version;
+    hash = "sha256-FmP9tI/oU7VM8x+Wu6bbeg1CVopZc6oOWnd4qUptVV8=";
+  };
+
+  nativeBuildInputs = [ pkg-config ];
+  buildInputs = [
+    fontconfig
+    gpgme
+    libassuan
+    libconfig
+    libgpg-error
+    libX11
+    libXinerama
+    libXft
+  ];
+
+  preConfigure = ''
+    makeFlagsArray+=(
+      PREFIX="$out"
+      CC="$CC"
+      # default config.mk hardcodes dependent libraries and include paths
+      INCS="`$PKG_CONFIG --cflags fontconfig x11 xft xinerama`"
+      LIBS="`$PKG_CONFIG --libs   fontconfig x11 xft xinerama`"
+    )
+  '';
+
+  meta = {
+    description = "Pinentry implementation based on dmenu";
+    homepage = "https://github.com/ritze/pinentry-dmenu";
+    changelog = "https://github.com/ritze/pinentry-dmenu/releases/tag/${finalAttrs.version}";
+    license = lib.licenses.gpl2Only;
+    maintainers = with lib.maintainers; [ sweiglbosker ];
+    mainProgram = "pinentry-dmenu";
+    platforms = lib.platforms.linux;
+  };
+})

pkgs/by-name/po/poetry/package.nix

@@ -17,12 +17,12 @@ let
       # We keep the override around even when the versions match, as
       # it's likely to become relevant again after the next Poetry update.
       poetry-core = super.poetry-core.overridePythonAttrs (old: rec {
-        version = "2.1.1";
+        version = "2.1.2";
         src = fetchFromGitHub {
           owner = "python-poetry";
           repo = "poetry-core";
           tag = version;
-          hash = "sha256-DeDfDaP+jPrN6F/lv6shVOG6+4VdD1nL9mz1wJn55Sc=";
+          hash = "sha256-fNj/LI4A4RjjPzYT+0ekwqmm3qzzZL3aACOe8BHviuk=";
         };
       });
     }

pkgs/by-name/po/poetry/unwrapped.nix

@@ -4,7 +4,6 @@
   buildPythonPackage,
   pythonOlder,
   fetchFromGitHub,
-  fetchpatch2,
   findpython,
   installShellFiles,
   build,
@@ -38,7 +37,7 @@
 
 buildPythonPackage rec {
   pname = "poetry";
-  version = "2.1.1";
+  version = "2.1.2";
   pyproject = true;
 
   disabled = pythonOlder "3.9";
@@ -47,17 +46,9 @@ buildPythonPackage rec {
     owner = "python-poetry";
     repo = "poetry";
     tag = version;
-    hash = "sha256-2u0idmnXY0FNvc8peDMWIFAeGH/xdIfMrMErUdxc0UA=";
+    hash = "sha256-51pO/PP5OwTmi+1uy26CK/1oQ/P21wPBoRVE9Jv0TjA=";
   };
 
-  patches = [
-    # https://github.com/python-poetry/poetry/pull/9939
-    (fetchpatch2 {
-      url = "https://github.com/python-poetry/poetry/commit/c2387ff3c878ab608d7616e4984fc01c4226416c.patch?full_index=1";
-      hash = "sha256-cxTDbFykRr+kGk4jYzKwhU8QEZvK5A/P8zxliXpE+Sg=";
-    })
-  ];
-
   build-system = [
     poetry-core
   ];

pkgs/by-name/pp/pplite/package.nix

@@ -2,6 +2,7 @@
   stdenv,
   lib,
   fetchurl,
+  fetchpatch,
   flint3,
   gmp,
 }:
@@ -20,6 +21,15 @@ stdenv.mkDerivation {
     gmp
   ];
 
+  patches = [
+    # https://github.com/ezaffanella/PPLite/pull/1
+    (fetchpatch {
+      name = "flint-3_2.patch";
+      url = "https://github.com/ezaffanella/PPLite/commit/96fd1e50131f70bb78efdd60985525e970c9df06.patch";
+      hash = "sha256-8FNyL8h/rBm2Hegib2l08vqEmFDU0PhMCV8Ui2G4xHQ=";
+    })
+  ];
+
   meta = {
     homepage = "https://github.com/ezaffanella/PPLite";
     description = "Convex polyhedra library for Abstract Interpretation";

pkgs/by-name/rk/rke/package.nix

@@ -6,13 +6,13 @@
 
 buildGoModule rec {
   pname = "rke";
-  version = "1.8.0";
+  version = "1.8.1";
 
   src = fetchFromGitHub {
     owner = "rancher";
     repo = pname;
     rev = "v${version}";
-    hash = "sha256-5KL9XAd0CnJ7yTfU1KpYqHBu9DxTTqo2fMPAr9IqqZY=";
+    hash = "sha256-mTSeUFmkXI9yZ1yeBXzudf2BmLtdmoiTlB/wtn++NAo=";
   };
 
   vendorHash = "sha256-5+BjXPh52RNoaU/ABpvgbAO+mKcW4Hg2SRxRhV9etIo=";

pkgs/by-name/ro/roslyn-ls/deps.json

@@ -199,15 +199,15 @@
   },
   {
     "pname": "Microsoft.DotNet.Arcade.Sdk",
-    "version": "9.0.0-beta.25111.5",
-    "hash": "sha256-gwzSdsu6YfLYxjltDOUouvajClMQ/BW8aiJQlYyxtlk=",
-    "url": "https://pkgs.dev.azure.com/dnceng/9ee6d478-d288-47f7-aacc-f6e6d082ae6d/_packaging/1a5f89f6-d8da-4080-b15f-242650c914a8/nuget/v3/flat2/microsoft.dotnet.arcade.sdk/9.0.0-beta.25111.5/microsoft.dotnet.arcade.sdk.9.0.0-beta.25111.5.nupkg"
+    "version": "9.0.0-beta.25161.4",
+    "hash": "sha256-NrQSPWnG7RlhNMyrqcz4sR0+WWpJpoTrrRtVLkIGFms=",
+    "url": "https://pkgs.dev.azure.com/dnceng/9ee6d478-d288-47f7-aacc-f6e6d082ae6d/_packaging/1a5f89f6-d8da-4080-b15f-242650c914a8/nuget/v3/flat2/microsoft.dotnet.arcade.sdk/9.0.0-beta.25161.4/microsoft.dotnet.arcade.sdk.9.0.0-beta.25161.4.nupkg"
   },
   {
     "pname": "Microsoft.DotNet.XliffTasks",
-    "version": "9.0.0-beta.25111.5",
-    "hash": "sha256-ZOwHiBzSiJ9PJwLP1iw18sZoxW+78ej+gGg4yt9dei4=",
-    "url": "https://pkgs.dev.azure.com/dnceng/9ee6d478-d288-47f7-aacc-f6e6d082ae6d/_packaging/1a5f89f6-d8da-4080-b15f-242650c914a8/nuget/v3/flat2/microsoft.dotnet.xlifftasks/9.0.0-beta.25111.5/microsoft.dotnet.xlifftasks.9.0.0-beta.25111.5.nupkg"
+    "version": "9.0.0-beta.25161.4",
+    "hash": "sha256-l4CTmNsxuFP3Bjs2mS1/zdmsb/ZvyHpddTX2HT+MVu4=",
+    "url": "https://pkgs.dev.azure.com/dnceng/9ee6d478-d288-47f7-aacc-f6e6d082ae6d/_packaging/1a5f89f6-d8da-4080-b15f-242650c914a8/nuget/v3/flat2/microsoft.dotnet.xlifftasks/9.0.0-beta.25161.4/microsoft.dotnet.xlifftasks.9.0.0-beta.25161.4.nupkg"
   },
   {
     "pname": "Microsoft.Extensions.Configuration",

pkgs/by-name/ro/roslyn-ls/package.nix

@@ -32,18 +32,18 @@ in
 buildDotnetModule rec {
   inherit pname dotnet-sdk dotnet-runtime;
 
-  vsVersion = "2.69.22";
+  vsVersion = "2.70.15";
   src = fetchFromGitHub {
     owner = "dotnet";
     repo = "roslyn";
     rev = "VSCode-CSharp-${vsVersion}";
-    hash = "sha256-z3DDbLFKH5u0w6LswZcghLkkqDYEtCRFNIfoq7N+P2c=";
+    hash = "sha256-vXRt/scWxekd8U04MGfD4W8aj05H0CqkbIYZy8+0OdU=";
   };
 
   # versioned independently from vscode-csharp
   # "roslyn" in here:
   # https://github.com/dotnet/vscode-csharp/blob/main/package.json
-  version = "4.14.0-3.25156.1";
+  version = "4.14.0-3.25164.3";
   projectFile = "src/LanguageServer/${project}/${project}.csproj";
   useDotnetFromEnv = true;
   nugetDeps = ./deps.json;

pkgs/by-name/rs/rs/package.nix

@@ -6,12 +6,12 @@
   libbsd,
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "rs";
   version = "20200313";
 
   src = fetchurl {
-    url = "https://www.mirbsd.org/MirOS/dist/mir/rs/rs-${version}.tar.gz";
+    url = "https://www.mirbsd.org/MirOS/dist/mir/rs/rs-${finalAttrs.version}.tar.gz";
     hash = "sha256-kZIV3J/oWiejC/Y9VkBs+1A/n8mCAyPEvTv+daajvD8=";
   };
 
@@ -27,7 +27,7 @@ stdenv.mkDerivation rec {
   buildPhase = ''
     runHook preBuild
 
-    ${stdenv.cc}/bin/cc utf8.c rs.c -o rs -lbsd
+    ${stdenv.cc}/bin/cc -DNEED_STRTONUM utf8.c rs.c -o rs -lbsd
 
     runHook postBuild
   '';
@@ -41,7 +41,7 @@ stdenv.mkDerivation rec {
     runHook postInstall
   '';
 
-  meta = with lib; {
+  meta = {
     homepage = "http://www.mirbsd.org/htman/i386/man1/rs.htm";
     description = "Reshape a data array from standard input";
     mainProgram = "rs";
@@ -66,8 +66,8 @@ stdenv.mkDerivation rec {
       to control presentation of the output columns, including transposition of
       the rows and columns.
     '';
-    license = licenses.bsd3;
-    maintainers = with maintainers; [ ];
-    platforms = platforms.unix;
+    license = lib.licenses.bsd3;
+    maintainers = [ ];
+    platforms = lib.platforms.unix;
   };
-}
+})

pkgs/by-name/so/sops/package.nix

@@ -1,29 +1,24 @@
 {
   lib,
-  buildGo122Module,
+  buildGoModule,
   fetchFromGitHub,
   installShellFiles,
   versionCheckHook,
   nix-update-script,
 }:
 
-buildGo122Module rec {
+buildGoModule rec {
   pname = "sops";
-  version = "3.9.4";
+  version = "3.10.0";
 
   src = fetchFromGitHub {
     owner = "getsops";
     repo = pname;
     tag = "v${version}";
-    hash = "sha256-w2RMK1Fl/k8QXV68j0Kc6shtx4vQa07RCnpgHLM8c8Q=";
+    hash = "sha256-NOZvVL4b7+TVlB6iM4HJDa5PHOjvcN0BXDMOHmqg7lU=";
   };
 
-  vendorHash = "sha256-wxmSj3QaFChGE+/2my7Oe2mhprwi404izUxteecyggY=";
-
-  postPatch = ''
-    substituteInPlace go.mod \
-      --replace-fail "go 1.22" "go 1.22.7"
-  '';
+  vendorHash = "sha256-I+iwimrNdKABZFP2etZTQJAXKigh+0g/Jhip86Cl5Rg=";
 
   subPackages = [ "cmd/sops" ];
 

pkgs/by-name/sp/spider/package.nix

@@ -14,17 +14,17 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "spider";
-  version = "2.34.2";
+  version = "2.36.2";
 
   src = fetchFromGitHub {
     owner = "spider-rs";
     repo = "spider";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-3KEOzrIFizVBZRI1pD1PeNVj1IiV3ImucW77qHJhDM8=";
+    hash = "sha256-Os94Q8RDaKc3jzir63nZ8dWgPwPZHxnvOZg2l/4v5EE=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-Hn9rQ9yv7vekmtGWorETK1b5rdfW0M/88Q6IvH51oE0=";
+  cargoHash = "sha256-v5zz9WLj2aLRUHJScVSFzoQhyOqExkN03j3N47f3lgA=";
 
   nativeBuildInputs = [
     pkg-config

pkgs/by-name/ti/tiledb/FindMagic_EP.cmake.patch

@@ -0,0 +1,14 @@
+diff --git a/FindMagic_EP.cmake b/FindMagic_EP.cmake
+--- a/cmake/Modules/FindMagic_EP.cmake
++++ b/cmake/Modules/FindMagic_EP.cmake
+@@ -126,9 +126,7 @@ if(NOT TILEDB_LIBMAGIC_EP_BUILT)
+     # that was modified by tiledb to also build with cmake for nix
+     ExternalProject_Add(ep_magic
+       PREFIX "externals"
+-      GIT_REPOSITORY "https://github.com/TileDB-Inc/file-windows.git"
+-      GIT_TAG "5.38.2.tiledb"
+-      GIT_SUBMODULES_RECURSE TRUE
++      DOWNLOAD_COMMAND true
+       UPDATE_COMMAND ""
+       CMAKE_ARGS
+         -DCMAKE_INSTALL_PREFIX=${TILEDB_EP_INSTALL_PREFIX}

pkgs/by-name/ti/tiledb/package.nix

@@ -2,6 +2,7 @@
   lib,
   stdenv,
   fetchFromGitHub,
+
   cmake,
   zlib,
   lz4,
@@ -15,56 +16,70 @@
   clang-tools,
   catch2_3,
   python3,
+  gtest,
   doxygen,
   fixDarwinDylibNames,
-  gtest,
-  rapidcheck,
-  libpng,
-  file,
-  runCommand,
-  catch2,
   useAVX2 ? stdenv.hostPlatform.avx2Support,
 }:
 
 let
-  rapidcheck' = runCommand "rapidcheck" { } ''
-    cp -r ${rapidcheck.out} $out
-    chmod -R +w $out
-    cp -r ${rapidcheck.dev}/* $out
-  '';
+  # pre-fetch ExternalProject from cmake/Modules/FindMagic_EP.cmake
+  ep-file-windows = fetchFromGitHub {
+    owner = "TileDB-Inc";
+    repo = "file-windows";
+    rev = "5.38.2.tiledb";
+    hash = "sha256-TFn30VCuWZr252VN1T5NNCZe2VEN3xQSomS7XxxKGF8=";
+    fetchSubmodules = true;
+  };
+
 in
 stdenv.mkDerivation rec {
   pname = "tiledb";
-  version = "2.27.2";
+  version = "2.18.2";
 
   src = fetchFromGitHub {
     owner = "TileDB-Inc";
     repo = "TileDB";
-    tag = version;
-    hash = "sha256-zk4jkXJMh6wpuEKaCvuKUDod+F8B/6W5Lw8gwelcPEM=";
+    rev = version;
+    hash = "sha256-uLiXhigYz3v7NgY38twot3sBHxZS5QCrOiPfME4wWzE=";
   };
 
-  # libcxx (as of llvm-19) does not yet support `stop_token` and `jthread`
-  # without the -fexperimental-library flag. Tiledb adds its own
-  # implementations in the std namespace which conflict with libcxx. This
-  # test can be re-enabled once libcxx supports stop_token and jthread.
-  postPatch = lib.optionalString (stdenv.cc.libcxx != null) ''
-    truncate -s0 tiledb/stdx/test/CMakeLists.txt
-  '';
+  patches = [
+    ./FindMagic_EP.cmake.patch
+  ];
 
-  env.TILEDB_DISABLE_AUTO_VCPKG = "1";
+  postPatch =
+    ''
+      # copy pre-fetched external project to directory where it is expected to be
+      mkdir -p build/externals/src
+      cp -a ${ep-file-windows} build/externals/src/ep_magic
+      chmod -R u+w build/externals/src/ep_magic
+
+      # add openssl on path
+      sed -i '49i list(APPEND OPENSSL_PATHS "${openssl.dev}" "${openssl.out}")' \
+        cmake/Modules/FindOpenSSL_EP.cmake
+    ''
+    # libcxx (as of llvm-19) does not yet support `stop_token` and `jthread`
+    # without the -fexperimental-library flag. Tiledb adds its own
+    # implementations in the std namespace which conflict with libcxx. This
+    # test can be re-enabled once libcxx supports stop_token and jthread.
+    + lib.optionalString (stdenv.cc.libcxx != null) ''
+      truncate -s0 tiledb/stdx/test/CMakeLists.txt
+    '';
+
+  # upstream will hopefully fix this in some newer release
+  env.CXXFLAGS = "-include random";
 
   # (bundled) blosc headers have a warning on some archs that it will be using
   # unaccelerated routines.
   cmakeFlags = [
+    "-DTILEDB_VCPKG=OFF"
     "-DTILEDB_WEBP=OFF"
     "-DTILEDB_WERROR=OFF"
-    # https://github.com/NixOS/nixpkgs/issues/144170
-    "-DCMAKE_INSTALL_INCLUDEDIR=include"
-    "-DCMAKE_INSTALL_LIBDIR=lib"
   ] ++ lib.optional (!useAVX2) "-DCOMPILER_SUPPORTS_AVX2=FALSE";
 
   nativeBuildInputs = [
+    ep-file-windows
     catch2_3
     clang-tools
     cmake
@@ -72,6 +87,10 @@ stdenv.mkDerivation rec {
     doxygen
   ] ++ lib.optional stdenv.hostPlatform.isDarwin fixDarwinDylibNames;
 
+  nativeCheckInputs = [
+    gtest
+  ];
+
   buildInputs = [
     zlib
     lz4
@@ -82,34 +101,20 @@ stdenv.mkDerivation rec {
     openssl
     boost
     libpqxx
-    libpng
-    file
-    rapidcheck'
-    catch2
-  ];
-
-  # fatal error: catch.hpp: No such file or directory
-  doCheck = false;
-
-  nativeCheckInputs = [
-    gtest
-    catch2
   ];
 
   # test commands taken from
   # https://github.com/TileDB-Inc/TileDB/blob/dev/.github/workflows/unit-test-runs.yml
   checkPhase = ''
     runHook preCheck
-
-    pushd ..
-    cmake --build build --target tests
-    ctest --test-dir build -R '(^unit_|test_assert)' --no-tests=error
-    ctest --test-dir build -R 'test_ci_asserts'
-    popd
-
+    make -C tiledb tests -j$NIX_BUILD_CORES
+    make -C tiledb test ARGS="-R '^unit_'" -R "test_assert"
+    make -C tiledb test ARGS="-R 'test_ci_asserts'"
     runHook postCheck
   '';
 
+  doCheck = true;
+
   installTargets = [
     "install-tiledb"
     "doc"
@@ -119,11 +124,11 @@ stdenv.mkDerivation rec {
     install_name_tool -add_rpath ${tbb}/lib $out/lib/libtiledb.dylib
   '';
 
-  meta = {
+  meta = with lib; {
     description = "TileDB allows you to manage the massive dense and sparse multi-dimensional array data";
     homepage = "https://github.com/TileDB-Inc/TileDB";
-    license = lib.licenses.mit;
-    platforms = lib.platforms.unix;
-    maintainers = with lib.maintainers; [ rakesh4g ];
+    license = licenses.mit;
+    platforms = platforms.unix;
+    maintainers = with maintainers; [ rakesh4g ];
   };
 }

pkgs/by-name/vs/vscode-extensions-update/vscode_extensions_batch_update.py

@@ -0,0 +1,117 @@
+#! /usr/bin/env nix-shell
+#! nix-shell -i python3 -p nix python3 python3Packages.loguru nix-search-tv vscode-extensions-update gitMinimal
+
+import argparse
+import subprocess
+
+from loguru import logger
+
+
+class VSCodeExtensionBatchUpdater:
+    # Extensions to be skipped
+    _excluded_extensions = [
+        # wrong upstream constraint: 0.10.x
+        "vscode-extensions.ms-vscode.theme-tomorrowkit",
+        "vscode-extensions.richie5um2.snake-trail",
+        # not supported
+        "vscode-extensions.ms-ceintl.vscode-language-pack-cs",
+        "vscode-extensions.ms-ceintl.vscode-language-pack-de",
+        "vscode-extensions.ms-ceintl.vscode-language-pack-es",
+        "vscode-extensions.ms-ceintl.vscode-language-pack-fr",
+        "vscode-extensions.ms-ceintl.vscode-language-pack-it",
+        "vscode-extensions.ms-ceintl.vscode-language-pack-ja",
+        "vscode-extensions.ms-ceintl.vscode-language-pack-ko",
+        "vscode-extensions.ms-ceintl.vscode-language-pack-pt-br",
+        "vscode-extensions.ms-ceintl.vscode-language-pack-qps-ploc",
+        "vscode-extensions.ms-ceintl.vscode-language-pack-ru",
+        "vscode-extensions.ms-ceintl.vscode-language-pack-tr",
+        "vscode-extensions.ms-ceintl.vscode-language-pack-zh-hans",
+        "vscode-extensions.ms-ceintl.vscode-language-pack-zh-hant",
+    ]
+
+    # Unable to determine the correct file location
+    _extension_file_map = {
+        "vscode-extensions.hashicorp.terraform": "pkgs/applications/editors/vscode/extensions/hashicorp.terraform/default.nix",
+        "vscode-extensions.betterthantomorrow.calva": "pkgs/applications/editors/vscode/extensions/betterthantomorrow.calva/default.nix",
+    }
+
+    def __init__(self):
+        self.parser = argparse.ArgumentParser(
+            description="Batch update VSCode extensions"
+        )
+        # By default, update command skips extensions with updateScript or need '--platforms'
+        self.parser.add_argument(
+            "--platforms",
+            action="store_true",
+            help="add '--platforms' to update command from some extensions",
+        )
+        self.platforms = self.parser.parse_args().platforms
+
+    def execute_command(
+        self, command, env: dict[str, str] = None, shell: bool = False
+    ) -> str:
+        logger.debug("Executing command: {} (shell={})", command, shell)
+        return subprocess.run(
+            command,
+            check=True,
+            capture_output=True,
+            text=True,
+            env=env,
+            shell=shell,
+        ).stdout.strip()
+
+    def _get_extension_list(self) -> list[str]:
+        # Get extension list from nix-search-tv output
+        command = "nix-search-tv print | grep '^nixpkgs/ vscode-extensions\\.' | cut -d' ' -f2-"
+        output = self.execute_command(command, shell=True)
+        extension_list = output.splitlines()
+        logger.info("Found {} extensions: {}", len(extension_list), extension_list)
+        return extension_list
+
+    def _has_update_script(self, extension: str) -> bool:
+        try:
+            result = self._get_nix_attribute(f"{extension}.updateScript")
+            return "not found" not in result
+        except subprocess.CalledProcessError:
+            return False
+
+    def _has_platform_source(self, extension: str) -> bool:
+        source_url = self._get_nix_attribute(f"{extension}.src.url")
+        return "targetPlatform=" in source_url
+
+    def _get_nix_attribute(self, attribute: str) -> str:
+        return self.execute_command(["nix", "eval", "--raw", "-f", ".", attribute])
+
+    def _get_extension_filename(self, extension: str) -> str | None:
+        return self._extension_file_map.get(extension)
+
+    def _update_extension(self, extension: str) -> None:
+        logger.info("Updating extension: {}", extension)
+        if extension in self._excluded_extensions:
+            return
+        try:
+            if self._has_update_script(extension):
+                return
+            update_command = ["vscode-extensions-update", extension, "--commit"]
+            if self._has_platform_source(extension):
+                if self.platforms:
+                    update_command.append("--platforms")
+                else:
+                    return
+            filename = self._get_extension_filename(extension)
+            if filename:
+                update_command.extend(["--override-filename", filename])
+            self.execute_command(update_command)
+            logger.info("Updated extension: {}", extension)
+        except subprocess.CalledProcessError:
+            logger.error("Failed to update extension: {}", extension)
+            self.execute_command(["git", "restore", "."])
+
+    def run(self) -> None:
+        for extension in self._get_extension_list():
+            self._update_extension(extension)
+
+
+if __name__ == "__main__":
+    updater = VSCodeExtensionBatchUpdater()
+    updater.run()

pkgs/by-name/vs/vscode-extensions-update/vscode_extensions_update.py

@@ -1,21 +1,24 @@
 #! /usr/bin/env nix-shell
-#! nix-shell -i python3 -p nix python3 nodePackages.semver vsce nix-update gitMinimal
+#! nix-shell -i python3 -p nix python3 python3Packages.loguru nodePackages.semver vsce nix-update gitMinimal coreutils common-updater-scripts
 
 import argparse
 import json
 import os
+import re
 import subprocess
 import sys
 
+from loguru import logger
+
 
 class VSCodeExtensionUpdater:
     """
-    A class to update VSCode extension version in nixpkgs.
+    A class to update VSCode extension version.
     """
 
     def __init__(self):
         self.parser = argparse.ArgumentParser(
-            description="Update VSCode extension version in nixpkgs."
+            description="Update VSCode extension version."
         )
         self.parser.add_argument(
             "attribute",
@@ -42,7 +45,7 @@ class VSCodeExtensionUpdater:
         self.args = self.parser.parse_args()
         self.attribute_path = self.args.attribute
         if not self.attribute_path:
-            print("Error: Attribute path is required.", file=sys.stderr)
+            logger.error("Error: Attribute path is required.")
             sys.exit(1)
         self.target_vscode_version = self._get_nix_vscode_version()
         self.current_version = self._get_nix_vscode_extension_version()
@@ -58,13 +61,19 @@ class VSCodeExtensionUpdater:
         self.nix_systems = self._get_nix_vscode_extension_platforms() or [
             self.nix_system
         ]
-        if not self.args.platforms and self.nix_system in self.nix_systems:
-            self.nix_systems = [self.nix_system]
-        else:
-            self.nix_systems = self.nix_systems[:1]
-        print(f"VSCode version: {self.target_vscode_version}")
-        print(f"Extension Marketplace ID: {self.extension_marketplace_id}")
-        print(f"Extension Current Version: {self.current_version}")
+        if not self.args.platforms:
+            self.nix_systems = (
+                [self.nix_system]
+                if self.nix_system in self.nix_systems
+                else self.nix_systems[:1]
+            )
+        if self.nix_system in self.nix_systems:
+            self.nix_systems.remove(self.nix_system)
+            self.nix_systems.insert(0, self.nix_system)
+        self.supported_nix_systems = self.get_supported_nix_systems()
+        logger.info(f"VSCode version: {self.target_vscode_version}")
+        logger.info(f"Extension Marketplace ID: {self.extension_marketplace_id}")
+        logger.info(f"Extension Current Version: {self.current_version}")
 
     def execute_command(
         self, commandline: list[str], env: dict[str, str] = None
@@ -72,6 +81,7 @@ class VSCodeExtensionUpdater:
         """
         Executes a shell command and returns its output.
         """
+        logger.debug("Executing command: {}", commandline)
         return subprocess.run(
             commandline,
             check=True,
@@ -92,6 +102,51 @@ class VSCodeExtensionUpdater:
         """
         return self._get_nix_attribute("system")
 
+    def get_supported_nix_systems(self) -> list[str]:
+        nix_config = self.execute_command(["nix", "config", "show"])
+        system = None
+        extra_platforms = []
+        for line in nix_config.splitlines():
+            if "=" not in line:
+                continue
+            key, value = line.split("=", 1)
+            key = key.strip()
+            value = value.strip()
+            if key == "system":
+                system = value
+            elif key == "extra-platforms":
+                extra_platforms = value.strip("[]").replace('"', "").split()
+        return ([system] if system is not None else []) + extra_platforms
+
+    def _get_nix_vscode_extension_src_hash(self, system: str) -> str:
+        url = self.execute_command(
+            [
+                "nix",
+                "eval",
+                "--raw",
+                "-f",
+                ".",
+                f"{self.attribute_path}.src.url",
+                "--system",
+                system,
+            ]
+        )
+        if "warning" not in url:
+            sha256 = self.execute_command(["nix-prefetch-url", url])
+            hash = self.execute_command(
+                [
+                    "nix",
+                    "hash",
+                    "convert",
+                    "--to",
+                    "sri",
+                    "--hash-algo",
+                    "sha256",
+                    sha256,
+                ]
+            )
+            return hash
+
     def get_target_platform(self, nix_system: str) -> str:
         """
         Retrieves the VS Code targetPlatform variable based on the Nix system.
@@ -108,9 +163,8 @@ class VSCodeExtensionUpdater:
         try:
             return platform_mapping[nix_system]
         except KeyError:
-            print(
-                f"Error: Unknown Nix system '{nix_system}'. Cannot determine targetPlatform.",
-                file=sys.stderr,
+            logger.error(
+                f"Error: Unknown Nix system '{nix_system}'. Cannot determine targetPlatform."
             )
             sys.exit(1)
 
@@ -166,25 +220,10 @@ class VSCodeExtensionUpdater:
         """
         command = ["vsce", "show", extension_id, "--json"]
         try:
-            with subprocess.Popen(
-                command,
-                stdout=subprocess.PIPE,
-                stderr=subprocess.PIPE,
-                text=True,
-            ) as proc:
-                data = json.load(proc.stdout)
-                proc.wait()
-                if proc.returncode != 0:
-                    err = proc.stderr.read()
-                    raise subprocess.CalledProcessError(
-                        proc.returncode, command, output=err
-                    )
-                return data
-        except json.JSONDecodeError:
-            print(
-                "Error: Couldn’t decode JSON response from VSCode marketplace; maybe the extension is not available?",
-                file=sys.stderr,
-            )
+            output = self.execute_command(command)
+            return json.loads(output)
+        except (json.JSONDecodeError, subprocess.CalledProcessError) as e:
+            logger.exception(e)
             sys.exit(1)
 
     def find_compatible_extension_version(
@@ -207,7 +246,7 @@ class VSCodeExtensionUpdater:
                 None,
             )
             if candidate_pre_release and not self.allow_pre_release:
-                print(f"Skipping PreRelease version {candidate_version}")
+                logger.debug(f"Skipping PreRelease version {candidate_version}")
                 continue
             engine_version_constraint = next(
                 (
@@ -218,9 +257,12 @@ class VSCodeExtensionUpdater:
                 None,
             )
             if engine_version_constraint:
-                print(
+                logger.debug(
                     f"Testing extension version: {candidate_version} with VSCode {self.target_vscode_version} (constraint: {engine_version_constraint})"
                 )
+                engine_version_constraint = self.replace_version_symbol(
+                    engine_version_constraint
+                )
                 try:
                     self.execute_command(
                         [
@@ -230,22 +272,70 @@ class VSCodeExtensionUpdater:
                             engine_version_constraint,
                         ]
                     )
-
-                    print(f"Compatible version found: {candidate_version}")
+                    logger.info(f"Compatible version found: {candidate_version}")
                     return candidate_version
                 except (ValueError, subprocess.CalledProcessError):
-                    print(
+                    logger.debug(
                         f"Version {candidate_version} is not compatible with VSCode {self.target_vscode_version} (constraint: {engine_version_constraint})."
                     )
                 continue
             return candidate_version
         else:
-            print(
-                "Error: not found compatible version.",
-                file=sys.stderr,
-            )
+            logger.error("Error: not found compatible version.")
             sys.exit(1)
 
+    def replace_version_symbol(self, version: str) -> str:
+        version = re.sub(r"^\^", ">=", version)
+        return version
+
+    def update_version_for_default_nix(self, content: str, new_version: str):
+        target_name = self.attribute_path.removeprefix("vscode-extensions.")
+        pattern = re.compile(
+            rf"{re.escape(target_name)}\s*=\s*buildVscodeMarketplaceExtension\s*\{{",
+            re.MULTILINE,
+        )
+        match = pattern.search(content)
+        if not match:
+            raise ValueError("Target block not found.")
+        brace_start = content.find("{", match.end() - 1)
+        if brace_start == -1:
+            raise ValueError("Opening brace not found.")
+        count = 0
+        pos = brace_start
+        text_len = len(content)
+        while pos < text_len:
+            if content[pos] == "{":
+                count += 1
+            elif content[pos] == "}":
+                count -= 1
+                if count == 0:
+                    break
+            pos += 1
+        if count != 0:
+            raise ValueError("Braces mismatch.")
+        block_end = pos
+        block_text = content[brace_start : block_end + 1]
+        version_pattern = re.compile(r'(version\s*=\s*")([^"]+)(";)')
+
+        def repl(m):
+            match_version = m.group(2)
+            if self.current_version == match_version:
+                return f"{m.group(1)}{new_version}{m.group(3)}"
+            return m.group(0)
+
+        new_block_text, count_sub = version_pattern.subn(repl, block_text)
+        if count_sub == 0:
+            raise ValueError("No version field updated.")
+        updated_content = (
+            content[:brace_start] + new_block_text + content[block_end + 1 :]
+        )
+        with open(
+            self.override_filename,
+            "w",
+            encoding="utf-8",
+        ) as f:
+            f.write(updated_content)
+
     def run_nix_update(self, new_version: str, system: str) -> None:
         """
         Builds and executes the nix-update command.
@@ -272,16 +362,44 @@ class VSCodeExtensionUpdater:
                 self.override_filename = (
                     "pkgs/applications/editors/vscode/extensions/default.nix"
                 )
-        update_command = [
-            "nix-update",
-            self.attribute_path,
-            "--version",
-            new_version,
-            "--override-filename",
-            self.override_filename,
-            "--system",
-            system,
-        ]
+        if (
+            new_version != "skip"
+            and "pkgs/applications/editors/vscode/extensions/default.nix"
+            in self.override_filename
+        ):
+            with logger.catch(exception=(IOError, ValueError)):
+                with open(
+                    self.override_filename,
+                    "r",
+                    encoding="utf-8",
+                ) as f:
+                    content = f.read()
+                if content.count(self.current_version) > 1:
+                    self.update_version_for_default_nix(content, new_version)
+                    new_version = "skip"
+        if system not in self.supported_nix_systems:
+            hash = self._get_nix_vscode_extension_src_hash(system)
+            update_command = [
+                "update-source-version",
+                self.attribute_path,
+                self.new_version,
+                hash,
+                f"--system={system}",
+                "--ignore-same-version",
+                "--ignore-same-hash",
+                f"--file={self.override_filename}",
+            ]
+        else:
+            update_command = [
+                "nix-update",
+                self.attribute_path,
+                "--version",
+                new_version,
+                "--override-filename",
+                self.override_filename,
+                "--system",
+                system,
+            ]
         self.execute_command(update_command)
 
     def run(self):
@@ -289,7 +407,7 @@ class VSCodeExtensionUpdater:
             self.extension_marketplace_id
         )
         available_versions = marketplace_data.get("versions", [])
-        print(
+        logger.info(
             f"Total versions found for {self.extension_marketplace_id}: {len(available_versions)}"
         )
         self.new_version = self.find_compatible_extension_version(
@@ -300,9 +418,8 @@ class VSCodeExtensionUpdater:
                 ["semver", self.current_version, "-r", f"<{self.new_version}"]
             )
         except subprocess.CalledProcessError:
-            print("Already up to date or new version is older!")
+            logger.info("Already up to date or new version is older!")
             sys.exit(0)
-        print(f"Selected extension version from Marketplace: {self.new_version}")
         for i, system in enumerate(self.nix_systems):
             version = self.new_version if i == 0 else "skip"
             self.run_nix_update(version, system)

pkgs/by-name/wa/waybackurls/package.nix

@@ -0,0 +1,33 @@
+{
+  lib,
+  buildGoModule,
+  fetchFromGitHub,
+}:
+
+buildGoModule rec {
+  pname = "waybackurls";
+  version = "0.1.0";
+
+  src = fetchFromGitHub {
+    owner = "tomnomnom";
+    repo = "waybackurls";
+    tag = "v${version}";
+    hash = "sha256-aX6pCEp2809oYn1BUwdfKzJzMttnZItGXC1QL4yMztg=";
+  };
+
+  vendorHash = null;
+
+  ldflags = [
+    "-s"
+    "-w"
+  ];
+
+  meta = {
+    description = "Tool to fetch all the URLs that the Wayback Machine knows about for a domain";
+    homepage = "https://github.com/tomnomnom/waybackurls";
+    changelog = "https://github.com/tomnomnom/waybackurls/releases/tag/${src.tag}";
+    license = lib.licenses.unfree;
+    maintainers = with lib.maintainers; [ fab ];
+    mainProgram = "waybackurls";
+  };
+}

pkgs/by-name/xe/xeus/package.nix

@@ -6,18 +6,19 @@
   doctest,
   nlohmann_json,
   libuuid,
+  nix-update-script,
   xtl,
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "xeus";
-  version = "3.2.0";
+  version = "5.2.0";
 
   src = fetchFromGitHub {
     owner = "jupyter-xeus";
-    repo = "xeus";
-    rev = version;
-    sha256 = "sha256-D/dJ0SHxTHJw63gHD6FRZS7O2TVZ0voIv2mQASEjLA8=";
+    repo = finalAttrs.pname;
+    tag = finalAttrs.version;
+    hash = "sha256-/4SVrfPU5pkO3PNrhgdCcNUts++Or7AeMqO/PorsBdw=";
   };
 
   nativeBuildInputs = [
@@ -28,7 +29,6 @@ stdenv.mkDerivation rec {
   buildInputs = [
     nlohmann_json
     libuuid
-    xtl
   ];
 
   cmakeFlags = [
@@ -38,11 +38,13 @@ stdenv.mkDerivation rec {
   doCheck = true;
   preCheck = ''export LD_LIBRARY_PATH=$PWD'';
 
-  meta = with lib; {
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
     homepage = "https://xeus.readthedocs.io";
     description = "C++ implementation of the Jupyter Kernel protocol";
-    license = licenses.bsd3;
-    maintainers = with maintainers; [ serge_sans_paille ];
-    platforms = platforms.all;
+    license = lib.licenses.bsd3;
+    maintainers = with lib.maintainers; [ serge_sans_paille ];
+    platforms = lib.platforms.all;
   };
-}
+})

pkgs/by-name/yg/yggstack/package.nix

@@ -2,20 +2,21 @@
   lib,
   buildGoModule,
   fetchFromGitHub,
+  nix-update-script,
 }:
 
 buildGoModule rec {
   pname = "yggstack";
-  version = "1.0.1";
+  version = "1.0.4";
 
   src = fetchFromGitHub {
     owner = "yggdrasil-network";
     repo = "yggstack";
     rev = "${version}";
-    hash = "sha256-RQ7AvVv+VLfgzlb7orZbSB7TNz/hj2fo832ed4WUN80=";
+    hash = "sha256-S3yk2v2RPGFeGDJ8Lmjr7VM2kIswIREfPpDLXM/P1YU=";
   };
 
-  vendorHash = "sha256-Hjb3KSh+2qYYKdgv4+dsSp0kAbzz8gu9qnQdA7wB5fA=";
+  vendorHash = "sha256-7EIUsMhAJ+uPD5LG7Yucpo82aJYYRt9vrmAbsQzNmEw=";
 
   ldflags = [
     "-X github.com/yggdrasil-network/yggdrasil-go/src/version.buildVersion=${version}"
@@ -26,6 +27,8 @@ buildGoModule rec {
 
   doCheck = false;
 
+  passthru.updateScript = nix-update-script { };
+
   meta = with lib; {
     description = "Yggdrasil as SOCKS proxy / port forwarder";
     homepage = "https://yggdrasil-network.github.io/";

pkgs/desktops/xfce/core/xfce4-session/default.nix

@@ -1,5 +1,6 @@
 { lib
 , mkXfceDerivation
+, fetchpatch
 , polkit
 , exo
 , libxfce4util
@@ -17,9 +18,25 @@
 mkXfceDerivation {
   category = "xfce";
   pname = "xfce4-session";
-  version = "4.20.0";
+  version = "4.20.2";
 
-  sha256 = "sha256-mn3ky1NzrpQZRkhc605mj+GFhbFq26eW59YKUfnX9X8=";
+  sha256 = "sha256-wd+8W9Z0dH7bqILBUNG9YxpRf8TnRJ/7b3QviM1HVnY=";
+
+  patches = [
+    # Use syntax compatible with most sh shells
+    # The `**` syntax is a bash extension
+    (fetchpatch {
+      url = "https://gitlab.xfce.org/xfce/xfce4-session/-/commit/53d6e20a29948ae7aa179447cef0704786b77f8b.patch";
+      hash = "sha256-c8IU1VOcEYdZJy8Eq2wqSL5tTXt7gKfGOs7jxb8npOE=";
+    })
+
+    # wayland: start a D-Bus session only if there isn't one already
+    # https://gitlab.xfce.org/xfce/xfce4-session/-/issues/218
+    (fetchpatch {
+      url = "https://gitlab.xfce.org/xfce/xfce4-session/-/commit/f6e2805b8a7742172f399d78618313bcb28bf095.patch";
+      hash = "sha256-EViVialDbdLH2SGUtcroo5iGc+B4HVJajV7PMl5q6vs=";
+    })
+  ];
 
   buildInputs = [
     exo

pkgs/development/ada-modules/gnatprove/0002-mute-aarch64-warnings.patch

@@ -0,0 +1,22 @@
+--- a/src/counterexamples/ce_parsing.adb	2025-03-14 21:48:15.657409808 +0100
++++ b/src/counterexamples/ce_parsing.adb	2025-03-14 22:04:32.114664704 +0100
+@@ -975,6 +975,9 @@
+                elsif Is_Extended_Precision_Floating_Point_Type (Ty) then
+                   pragma Assert (Size (Exp) = 15);
+                   pragma Assert (Size (Significand) = 63);
++                  pragma Warnings (Off, "assertion will fail at run time");
++                  pragma Warnings (Off,
++                      "types for unchecked conversion have different sizes");
+                   declare
+                      package P is new Parse_Conversion
+                        (Interfaces.Unsigned_128, Long_Long_Float);
+@@ -983,6 +986,9 @@
+                   begin
+                      return (Float_K, (Extended_K, F));
+                   end;
++                  pragma Warnings (On,
++                      "types for unchecked conversion have different sizes");
++                  pragma Warnings (On, "assertion will fail at run time");
+                else
+                   raise Program_Error;
+                end if;

pkgs/development/ada-modules/gnatprove/default.nix

@@ -56,6 +56,9 @@ let
       patches = [
         # Disable Coq related targets which are missing in the fsf-14 branch
         ./0001-fix-install.patch
+
+        # Suppress warnings on aarch64: https://github.com/AdaCore/spark2014/issues/54
+        ./0002-mute-aarch64-warnings.patch
       ];
       commit_date = "2024-01-11";
     };

pkgs/development/ada-modules/gprbuild/nixpkgs-gnat.xml

@@ -53,4 +53,37 @@
       <grep regexp="[^\r\n]+"></grep>
     </target>
   </compiler_description>
+  <configuration>
+    <!-- aarch64-linux - native compiler. -->
+    <targets>
+      <target name="^aarch64-unknown-linux-gnu$" />
+    </targets>
+    <hosts>
+      <host name="^aarch64-unknown-linux-gnu$" />
+    </hosts>
+    <config>
+   for Archive_Builder  use ("ar", "cr");
+   for Archive_Builder_Append_Option use ("q");
+   for Archive_Indexer  use ("ranlib");
+   for Archive_Suffix   use ".a";
+    </config>
+  </configuration>
+  <configuration>
+    <!-- aarch64-linux - native compiler. -->
+    <targets>
+      <target name="^aarch64-unknown-linux-gnu$" />
+    </targets>
+    <hosts>
+      <host name="^aarch64-unknown-linux-gnu$" />
+    </hosts>
+    <config>
+   for Object_Lister use ("nm", "-g");
+   for Object_Lister_Matcher use " [TDRBSG] (.*)";
+
+   package Linker is
+      for Export_File_Format use "GNU";
+      for Export_File_Switch use "-Wl,--version-script=";
+   end Linker;
+    </config>
+  </configuration>
 </gprconfig>

pkgs/development/haskell-modules/configuration-nix.nix

@@ -389,6 +389,7 @@ self: super: builtins.intersectAttrs super {
     dontCheck
     enableSeparateBinOutput
     (self.generateOptparseApplicativeCompletions [ "postgrest" ])
+    (overrideCabal { passthru.tests = pkgs.nixosTests.postgrest; })
   ];
 
   # Tries to mess with extended POSIX attributes, but can't in our chroot environment.

pkgs/development/libraries/flint/3.nix

@@ -1,7 +1,6 @@
 {
   lib,
   stdenv,
-  fetchpatch,
   fetchurl,
   gmp,
   mpfr,
@@ -23,26 +22,13 @@ assert
 
 stdenv.mkDerivation rec {
   pname = "flint3";
-  version = "3.1.2";
+  version = "3.2.1";
 
   src = fetchurl {
-    url = "https://www.flintlib.org/flint-${version}.tar.gz";
-    sha256 = "sha256-/bOkMaN0ZINKz/O9wUX0/o0PlR3VMnxMb5P0y6xcJwA=";
+    url = "https://flintlib.org/download/flint-${version}.tar.gz";
+    hash = "sha256-ynvkbXeXInfrb+DE92dUhDL1a7U0qhfW26LXzOFc0j8=";
   };
 
-  patches = [
-    (fetchpatch {
-      url = "https://github.com/flintlib/flint/commit/e7d005c369754243cba32bd782ea2a5fc874fde5.diff";
-      hash = "sha256-IqEtYEpNVXfoTeerh/0ig+eDqUpAlGdBB3uO8ShYh3o=";
-    })
-    # C99 compliance (avoid using I as identifier): https://github.com/flintlib/flint/pull/2027
-    (fetchpatch {
-      name = "flint3-reserved-identifier.patch";
-      url = "https://github.com/flintlib/flint/commit/b579cdd2d45aa1109a764f6838e9888b937e7ac5.patch";
-      hash = "sha256-8GLlA9ACzzxSiYaxLv9+p0oJA5TS7289b0EyoNcsSaU=";
-    })
-  ];
-
   nativeBuildInputs = [
     autoconf
     automake
@@ -68,8 +54,6 @@ stdenv.mkDerivation rec {
   # We're not using autoreconfHook because flint's bootstrap
   # script calls autoreconf, among other things.
   preConfigure = ''
-    # the following configure.ac fix is only needed for flint 3.1.X
-    sed -i 's/if "$ac_cv_prog_cxx_g" = "yes"/if test "$ac_cv_prog_cxx_g" = "yes"/' configure.ac
     echo "Executing bootstrap.sh"
     ./bootstrap.sh
   '';
@@ -92,7 +76,7 @@ stdenv.mkDerivation rec {
 
   meta = with lib; {
     description = "Fast Library for Number Theory";
-    license = licenses.gpl2Plus;
+    license = licenses.lgpl3Plus;
     maintainers = with maintainers; [ smasher164 ] ++ teams.sage.members;
     platforms = platforms.unix;
     homepage = "https://www.flintlib.org/";

pkgs/development/libraries/mesa/default.nix

@@ -200,7 +200,11 @@ in stdenv.mkDerivation {
 
     (lib.mesonBool "gallium-nine" false) # Direct3D9 in Wine, largely supplanted by DXVK
     (lib.mesonBool "osmesa" false) # deprecated upstream
-    (lib.mesonEnable "gallium-xa" false) # old and mostly dead
+
+    # Only used by xf86-video-vmware, which has more features than VMWare's KMS driver,
+    # so we're keeping it for now. Should be removed when that's no longer the case.
+    # See: https://github.com/NixOS/nixpkgs/pull/392492
+    (lib.mesonEnable "gallium-xa" true)
 
     (lib.mesonBool "teflon" true) # TensorFlow frontend
 

pkgs/development/libraries/science/networking/ns-3/default.nix

@@ -63,13 +63,13 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "ns-3";
-  version = "39";
+  version = "44";
 
   src = fetchFromGitLab {
     owner = "nsnam";
     repo = "ns-3-dev";
     rev = "ns-3.${version}";
-    hash = "sha256-2d8xCCfxRpcCZgt7ne17F7cUo/wIxLyvjQs3izNUnmY=";
+    hash = "sha256-rw/WAMk4ZitULqkdyEh9vAFp1UrD1tw2JqgxOT5JQ5I=";
   };
 
   nativeBuildInputs = [

pkgs/development/python-modules/aiohomekit/default.nix

@@ -21,7 +21,7 @@
 
 buildPythonPackage rec {
   pname = "aiohomekit";
-  version = "3.2.8";
+  version = "3.2.13";
   pyproject = true;
 
   disabled = pythonOlder "3.10";
@@ -30,7 +30,7 @@ buildPythonPackage rec {
     owner = "Jc2k";
     repo = "aiohomekit";
     tag = version;
-    hash = "sha256-b197P2hTk6lhLKm+4VvyvyPZDqb7NqO0aqoIf3BQBfs=";
+    hash = "sha256-J6VxfuLHdxJ92V1puOWv+dnlpBKRBww1iP6IcRMqamk=";
   };
 
   build-system = [ poetry-core ];
@@ -68,7 +68,7 @@ buildPythonPackage rec {
       Homekit accessories.
     '';
     homepage = "https://github.com/Jc2k/aiohomekit";
-    changelog = "https://github.com/Jc2k/aiohomekit/releases/tag/${version}";
+    changelog = "https://github.com/Jc2k/aiohomekit/releases/tag/${src.tag}";
     license = licenses.asl20;
     maintainers = with maintainers; [ fab ];
     mainProgram = "aiohomekitctl";

pkgs/development/python-modules/awsiotsdk/default.nix

@@ -23,6 +23,11 @@ buildPythonPackage rec {
     hash = "sha256-vqx/OgQ/hgH6ULBI1I9+fD4CswQZDzfdNlhImbnQiKg=";
   };
 
+  postPatch = ''
+    substituteInPlace awsiot/__init__.py \
+      --replace-fail  "__version__ = '1.0.0-dev'" "__version__ = '${version}'"
+  '';
+
   pythonRelaxDeps = [ "awscrt" ];
 
   build-system = [ setuptools ];

pkgs/development/python-modules/databricks-sdk/default.nix

@@ -21,14 +21,14 @@
 
 buildPythonPackage rec {
   pname = "databricks-sdk";
-  version = "0.46.0";
+  version = "0.49.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "databricks";
     repo = "databricks-sdk-py";
     tag = "v${version}";
-    hash = "sha256-bvtIeysj3FW4Kj2WZeKSGwkqKoWIxKIzJFiduNlaBWE=";
+    hash = "sha256-lNP3ETmRK6sRx9mP2JuIe/OcBbCDEvipST2LUjycgjs=";
   };
 
   build-system = [

pkgs/development/python-modules/httpx-ws/default.nix

@@ -16,7 +16,7 @@
 
 buildPythonPackage rec {
   pname = "httpx-ws";
-  version = "0.7.1";
+  version = "0.7.2";
   pyproject = true;
 
   disabled = pythonOlder "3.9";
@@ -25,7 +25,7 @@ buildPythonPackage rec {
     owner = "frankie567";
     repo = "httpx-ws";
     tag = "v${version}";
-    hash = "sha256-UO9O4d7QfPdIWL4CtlOuwQRsk/9sEFknahDLWIOfeA0=";
+    hash = "sha256-ixaD7X6V/tUalZbYtic7D9lRqv8yGnwl+j5m832n/hQ=";
   };
 
   # we don't need to use the hatch-regex-commit plugin

pkgs/development/python-modules/llm-gemini/default.nix

@@ -15,14 +15,14 @@
 }:
 buildPythonPackage rec {
   pname = "llm-gemini";
-  version = "0.15";
+  version = "0.16";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "simonw";
     repo = "llm-gemini";
     tag = version;
-    hash = "sha256-NNzorEb3dVoKef+9eXzStcFAkQhnhMBVnwLBc2lA2+o=";
+    hash = "sha256-JtNFYEriiWi5fgIHM8hhMct4G7AdVKZhro9y40gxaZo=";
   };
 
   build-system = [
@@ -52,7 +52,7 @@ buildPythonPackage rec {
   meta = {
     description = "LLM plugin to access Google's Gemini family of models";
     homepage = "https://github.com/simonw/llm-gemini";
-    changelog = "https://github.com/simonw/llm-gemini/releases/tag/${version}";
+    changelog = "https://github.com/simonw/llm-gemini/releases/tag/${src.tag}";
     license = lib.licenses.asl20;
     maintainers = with lib.maintainers; [ josh ];
   };

pkgs/development/python-modules/lnkparse3/default.nix

@@ -10,7 +10,7 @@
 
 buildPythonPackage rec {
   pname = "lnkparse3";
-  version = "1.5.0";
+  version = "1.5.1";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
@@ -19,7 +19,7 @@ buildPythonPackage rec {
     owner = "Matmaus";
     repo = "LnkParse3";
     tag = "v${version}";
-    hash = "sha256-oyULNRjC0pcVUOeTjjW3g3mB7KySYcwAS+/KwQEIkK4=";
+    hash = "sha256-ebaKVl7GFoJiyQR7x4AN9Md8dtuYUchaN8ORbUrj5DY=";
   };
 
   build-system = [ setuptools ];

pkgs/development/python-modules/mcp/default.nix

@@ -10,6 +10,7 @@
   pydantic,
   pydantic-settings,
   pytest-asyncio,
+  pytest-examples,
   pytestCheckHook,
   python-dotenv,
   rich,
@@ -17,21 +18,25 @@
   starlette,
   typer,
   uvicorn,
+  websockets,
 }:
 
 buildPythonPackage rec {
   pname = "mcp";
-  version = "1.3.0";
+  version = "1.5.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "modelcontextprotocol";
     repo = "python-sdk";
     tag = "v${version}";
-    hash = "sha256-DbRXD4o/uFfpGvrux8lm7/t2utdFDEFg2G7CiraCJd0=";
+    hash = "sha256-Z2NN6k4mD6NixDON1MUOELpBZW9JvMvFErcCbFPdg2o=";
   };
 
   postPatch = ''
+    substituteInPlace pyproject.toml \
+      --replace-fail ', "uv-dynamic-versioning"' "" \
+      --replace-fail 'dynamic = ["version"]' 'version = "${version}"'
     substituteInPlace tests/client/test_stdio.py \
       --replace '/usr/bin/tee' '${lib.getExe' coreutils "tee"}'
   '';
@@ -61,18 +66,24 @@ buildPythonPackage rec {
     rich = [
       rich
     ];
+    ws = [
+      websockets
+    ];
   };
 
   pythonImportsCheck = [ "mcp" ];
 
   nativeCheckInputs = [
     pytest-asyncio
+    pytest-examples
     pytestCheckHook
   ] ++ lib.flatten (lib.attrValues optional-dependencies);
 
   disabledTests = [
     # attempts to run the package manager uv
     "test_command_execution"
+    # performance-dependent test
+    "test_messages_are_executed_concurrently"
   ];
 
   __darwinAllowLocalNetworking = true;

pkgs/development/python-modules/mcpadapt/default.nix

@@ -16,14 +16,14 @@
 
 buildPythonPackage rec {
   pname = "mcpadapt";
-  version = "0.0.16";
+  version = "0.0.18";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "grll";
     repo = "mcpadapt";
     tag = "v${version}";
-    hash = "sha256-l5noNvg2vQJa0kOPJG78whrnTKkYy1FUfSb9V+ICpAo=";
+    hash = "sha256-E8A4zjkS3giR6oS5SmVwFwy7g2z3CvZsJBegZ35b41Q=";
   };
 
   build-system = [ hatchling ];

pkgs/development/python-modules/mplhep/default.nix

@@ -25,14 +25,14 @@
 
 buildPythonPackage rec {
   pname = "mplhep";
-  version = "0.3.58";
+  version = "0.3.59";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "scikit-hep";
     repo = "mplhep";
     tag = "v${version}";
-    hash = "sha256-d2dVOWR982QxAe6JVLyRIafA6x7CcNBO155cXMkCbYk=";
+    hash = "sha256-Xanj2AkFRq/zu2ntTHVt1QkikN0bYfRcBj6CBho15os=";
   };
 
   build-system = [

pkgs/development/python-modules/nanobind/default.nix

@@ -27,14 +27,14 @@
 }:
 buildPythonPackage rec {
   pname = "nanobind";
-  version = "2.5.0";
+  version = "2.6.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "wjakob";
     repo = "nanobind";
     tag = "v${version}";
-    hash = "sha256-sH+qZHd9OKDxl2yTAeDh4xLwW64k6nIToyLfd3cR6kE=";
+    hash = "sha256-1CU5aRhiVPGXLVYZzOM8ELgRwa3hz7kQSwlTYsvFE7s=";
     fetchSubmodules = true;
   };
 
@@ -57,13 +57,6 @@ buildPythonPackage rec {
   doCheck = false;
 
   preCheck = ''
-    # TODO: added 2.2.0, re-enable on next bump
-    # https://github.com/wjakob/nanobind/issues/754
-    # "generated stubs do not match their references"
-    # > -import tensorflow.python.framework.ops
-    # > +import tensorflow
-    rm tests/test_ndarray_ext.pyi.ref
-
     # build tests
     make -j $NIX_BUILD_CORES
   '';

pkgs/development/python-modules/py-dactyl/default.nix

@@ -0,0 +1,48 @@
+{
+  buildPythonPackage,
+  fetchFromGitHub,
+  lib,
+  pytestCheckHook,
+  requests,
+  setuptools,
+}:
+
+buildPythonPackage rec {
+  pname = "py-dactyl";
+  version = "2.0.5";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "iamkubi";
+    repo = "pydactyl";
+    tag = "v${version}";
+    hash = "sha256-yw5S4I4mtb9URnZ1So1nlZi4v7y0Nz4msx+8SwSi8N4=";
+  };
+
+  build-system = [ setuptools ];
+
+  dependencies = [
+    requests
+  ];
+
+  pythonImportsCheck = [ "pydactyl" ];
+
+  nativeCheckInputs = [
+    pytestCheckHook
+  ];
+
+  disabledTests = [
+    # upstream's tests are not fully maintained
+    "test_get_file_contents"
+    "test_paginated_response_multipage_iterator"
+    "test_pterodactyl_client_debug_param"
+  ];
+
+  meta = {
+    changelog = "https://github.com/iamkubi/pydactyl/releases/tag/${src.tag}";
+    description = "Python wrapper for the Pterodactyl Panel API";
+    homepage = "https://github.com/iamkubi/pydactyl";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ dotlambda ];
+  };
+}

pkgs/development/python-modules/pyexploitdb/default.nix

@@ -10,7 +10,7 @@
 
 buildPythonPackage rec {
   pname = "pyexploitdb";
-  version = "0.2.73";
+  version = "0.2.74";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
@@ -18,7 +18,7 @@ buildPythonPackage rec {
   src = fetchPypi {
     pname = "pyExploitDb";
     inherit version;
-    hash = "sha256-KpbrcCjG8F/Ktka7puh/7rSpEMSf5LvMH+Yd//UbhjQ=";
+    hash = "sha256-pQRyIv1wu78vNjxl5tt0kI34RvCEycEMMEtaOnlaa10=";
   };
 
   build-system = [ setuptools ];