Merge remote-tracking branch 'origin/staging-next' into staging

.github/workflows/teams.yml

@@ -14,6 +14,7 @@ defaults:
 
 jobs:
   sync:
+    if: github.event_name != 'schedule' || github.repository_owner == 'NixOS'
     runs-on: ubuntu-24.04-arm
     steps:
       # Use a GitHub App to create the PR so that CI gets triggered and to

doc/release-notes/rl-2511.section.md

@@ -110,6 +110,8 @@
 
 - `spidermonkey_91` has been removed, as it has been EOL since September 2022.
 
+- `ddccontrol` service now enables `hardware.i2c` by default, and adds `ddcci_backlight` to the kernel modules, based on [experiences reported on discourse](https://discourse.nixos.org/t/brightness-control-of-external-monitors-with-ddcci-backlight/8639/).
+
 - The license of duckstation has changed from `gpl3Only` to `cc-by-nc-nd-40` making it unfree in newer releases. The `duckstation` package has been overhauled to support the new releases and `duckstation-bin` has been aliased to `duckstation` to support darwin binary builds.
 
 - `hiawata` has been removed, due to lack of active development upstream, lack of maintainership downstream and upcoming security issues.
@@ -168,7 +170,7 @@
 
 - `meilisearch_1_11` has been removed, as it is no longer supported.
 
-- `budgie-desktop` has been updated [10.9.3](https://github.com/BuddiesOfBudgie/budgie-desktop/releases/tag/v10.9.3), this changes `XDG_CURRENT_DESKTOP` from `Budgie:GNOME` to `Budgie`.
+- `budgie-desktop` has been updated [10.9.4](https://github.com/BuddiesOfBudgie/budgie-desktop/releases/tag/v10.9.4). This changes `XDG_CURRENT_DESKTOP` from `Budgie:GNOME` to `Budgie` and contains ABI bumps for libpeas2 migration.
 
 - Greetd and its original greeters (`tuigreet`, `gtkgreet`, `qtgreet`, `regreet`, `wlgreet`) were moved from `greetd` namespace to top level (`greetd.tuigreet` -> `tuigreet`, `greetd.greetd` -> `greetd`, etc). The original attrs are available for compatibility as passthrus of `greetd`, but will emit a warning. They will be removed in future releases.
 
@@ -242,6 +244,8 @@
 
 - `rocmPackages.triton` has been removed in favor of `python3Packages.triton`.
 
+- `oink` service no longer accepts `settings.apiKey` and `settings.secretApiKey` options as these have been replaced by `apiKeyFile` and `secretApiKeyFile`.
+
 - `linpinyin`, which is used for Chinese character input, has migrated from the unmaintained BDB database format to the newer KyotoCabinet database format. If you want to migrate your user input statistics you can consider using [bdbtokyotodb](https://codeberg.org/raboof/bdbtokyotodb).
 
 - `go-mockery` has been updated to v3. For migration instructions see the [upstream documentation](https://vektra.github.io/mockery/latest/v3/). If v2 is still required `go-mockery_v2` has been added but will be removed on or before 2029-12-31 in-line with its [upstream support lifecycle](https://vektra.github.io/mockery/)

lib/licenses.nix

@@ -747,6 +747,11 @@ lib.mapAttrs mkLicense (
       fullName = "Historical Permission Notice and Disclaimer - University of California variant";
     };
 
+    hyphenBulgarian = {
+      fullName = "hyphen-bulgarian License";
+      spdxId = "hyphen-bulgarian";
+    };
+
     # Intel's license, seems free
     iasl = {
       spdxId = "Intel-ACPI";

maintainers/github-teams.json

@@ -220,7 +220,6 @@
       "gshpychka": 23005347,
       "hexagonal-sun": 222664,
       "heywoodlh": 18178614,
-      "iedame": 60272,
       "isabelroses": 71222764,
       "jonhermansen": 660911,
       "juliusrickert": 5007494,

maintainers/maintainer-list.nix

@@ -588,7 +588,7 @@
   adamperkowski = {
     name = "Adam Perkowski";
     email = "me@adamperkowski.dev";
-    matrix = "@xx0a_q:matrix.org";
+    matrix = "@adam:matrix.system72.dev";
     github = "adamperkowski";
     githubId = 75480869;
     keys = [
@@ -1156,10 +1156,11 @@
     name = "Alexandru Nechita";
   };
   alexandrutocar = {
-    email = "at@myquiet.place";
+    email = "alexandru.tocar@outlook.com";
     github = "alexandrutocar";
     githubId = 65486851;
     name = "Alexandru Tocar";
+    keys = [ { fingerprint = "B617 DD24 3AB0 2E3F 2E67  DBFD 1305 2A85 D7A4 2AA4"; } ];
   };
   alexarice = {
     email = "alexrice999@hotmail.co.uk";
@@ -1191,6 +1192,12 @@
     githubId = 2335822;
     name = "Alexandre Esteves";
   };
+  alexland7219 = {
+    email = "alexland7219@gmail.com";
+    github = "alexland7219";
+    githubId = 58669111;
+    name = "Alexandre Ros";
+  };
   alexnabokikh = {
     email = "nabokikh@duck.com";
     github = "alexnabokikh";
@@ -10840,12 +10847,6 @@
     githubId = 1550265;
     name = "Dominic Steinitz";
   };
-  iedame = {
-    email = "git@ieda.me";
-    github = "iedame";
-    githubId = 60272;
-    name = "Rafael Ieda";
-  };
   if-loop69420 = {
     github = "if-loop69420";
     githubId = 81078181;
@@ -12602,7 +12603,7 @@
     name = "Ioannis Koutras";
   };
   jolars = {
-    email = "jolars@posteo.com";
+    email = "johan@jolars.co";
     matrix = "@jola:mozilla.org";
     github = "jolars";
     githubId = 13087841;
@@ -23961,6 +23962,7 @@
     githubId = 49711232;
     github = "ShyAssassin";
     email = "ShyAssassin@assassin.dev";
+    keys = [ { fingerprint = "370E 8296 12AF D0E1 9A1A  88F6 AA81 2447 4716 E56D"; } ];
   };
   shyim = {
     email = "s.sayakci@gmail.com";
@@ -28911,6 +28913,16 @@
     name = "Zexin Yuan";
     keys = [ { fingerprint = "FE16 B281 90EF 6C3F F661  6441 C2DD 1916 FE47 1BE2"; } ];
   };
+  zacharyarnaise = {
+    name = "Zachary Arnaise";
+    github = "zacharyarnaise";
+    githubId = 121795280;
+    keys = [
+      {
+        fingerprint = "5C1A 2BE8 C6B4 AFC0 DE82  73E9 B1F3 94D8 D460 C3B2";
+      }
+    ];
+  };
   zacharyweiss = {
     name = "Zachary Weiss";
     email = "me@zachary.ws";

nixos/default.nix

@@ -1,12 +1,15 @@
 {
   configuration ? import ./lib/from-env.nix "NIXOS_CONFIG" <nixos-config>,
   system ? builtins.currentSystem,
+  # This should only be used for special arguments that need to be evaluated when resolving module structure (like in imports).
+  # For everything else, there's _module.args.
+  specialArgs ? { },
 }:
 
 let
 
   eval = import ./lib/eval-config.nix {
-    inherit system;
+    inherit system specialArgs;
     modules = [ configuration ];
   };
 

nixos/lib/utils.nix

@@ -229,7 +229,7 @@ let
       listToAttrs (flatten (recurse "." item));
 
     /*
-      Takes an attrset and a file path and generates a bash snippet that
+      Takes some options, an attrset and a file path and generates a bash snippet that
       outputs a JSON file at the file path with all instances of
 
       { _secret = "/path/to/secret" }
@@ -237,6 +237,28 @@ let
       in the attrset replaced with the contents of the file
       "/path/to/secret" in the output JSON.
 
+      The first argument exposes the following options:
+
+      - attr: The name of the secret attribute that will be processed, defaults to "_secret"
+      - loadCredential: A boolean determining whether the script should load secrets directly (false)
+        or load them from $CREDENTIALS_DIRECTORY (true). In the latter case the output attribute set
+        will contain a .credentials attribute with the necessary credential list that can be passed
+        to systemd's `LoadCredential=` option.
+
+      The output of this utility is an attribute set containing the main script and optionally
+      a list of credentials:
+
+      {
+        # The main script
+        script = "...";
+
+        # If the loadCredential option was set:
+        credentials = [
+          "secret1:/path/to/secret1"
+          #...
+        ];
+      }
+
       When a configuration option accepts an attrset that is finally
       converted to JSON, this makes it possible to let the user define
       arbitrary secret values.
@@ -245,7 +267,7 @@ let
         If the file "/path/to/secret" contains the string
         "topsecretpassword1234",
 
-        genJqSecretsReplacementSnippet {
+        genJqSecretsReplacement { } {
           example = [
             {
               irrelevant = "not interesting";
@@ -293,7 +315,7 @@ let
           { "b": "topsecretpassword5678" }
         ]
 
-        genJqSecretsReplacementSnippet {
+        genJqSecretsReplacement { } {
           example = [
             {
               irrelevant = "not interesting";
@@ -330,12 +352,12 @@ let
           ]
         }
     */
-    genJqSecretsReplacementSnippet = genJqSecretsReplacementSnippet' "_secret";
-
-    # Like genJqSecretsReplacementSnippet, but allows the name of the
-    # attr which identifies the secret to be changed.
-    genJqSecretsReplacementSnippet' =
-      attr: set: output:
+    genJqSecretsReplacement =
+      {
+        attr ? "_secret",
+        loadCredential ? false,
+      }:
+      set: output:
       let
         secretsRaw = recursiveGetAttrsetWithJqPrefix set attr;
         # Set default option values
@@ -347,38 +369,115 @@ let
           // set
         ) secretsRaw;
         stringOrDefault = str: def: if str == "" then def else str;
-      in
-      ''
-        if [[ -h '${output}' ]]; then
-          rm '${output}'
-        fi
 
-        inherit_errexit_enabled=0
-        shopt -pq inherit_errexit && inherit_errexit_enabled=1
-        shopt -s inherit_errexit
-      ''
-      + concatStringsSep "\n" (
-        imap1 (index: name: ''
-          secret${toString index}=$(<'${secrets.${name}.${attr}}')
-          export secret${toString index}
-        '') (attrNames secrets)
-      )
-      + "\n"
-      + "${pkgs.jq}/bin/jq >'${output}' "
-      + escapeShellArg (
-        stringOrDefault (concatStringsSep " | " (
+        # Sanitize path to create a valid credential tag (same as in genLoadCredentialForJqSecretsReplacementSnippet)
+        sanitizePath =
+          path: lib.stringAsChars (c: if builtins.match "[a-zA-Z0-9_.#=!-]" c != null then c else "_") path;
+
+        # Generate credential tag for a given index and path
+        credentialTag = index: path: "${toString index}_${sanitizePath (secrets.${path}.${attr})}";
+
+        credentialPath =
+          index: name:
+          if loadCredential then
+            ''"$CREDENTIALS_DIRECTORY/${credentialTag index name}"''
+          else
+            "'${secrets.${name}.${attr}}'";
+      in
+      {
+        script = ''
+          if [[ -h '${output}' ]]; then
+            rm '${output}'
+          fi
+
+          inherit_errexit_enabled=0
+          shopt -pq inherit_errexit && inherit_errexit_enabled=1
+          shopt -s inherit_errexit
+        ''
+        + concatStringsSep "\n" (
           imap1 (
             index: name:
-            ''${name} = ($ENV.secret${toString index}${optionalString (!secrets.${name}.quote) " | fromjson"})''
-          ) (attrNames secrets)
-        )) "."
-      )
-      + ''
-         <<'EOF'
-        ${toJSON set}
-        EOF
-        (( ! inherit_errexit_enabled )) && shopt -u inherit_errexit
-      '';
+            # We keep variable assignment and export separated to avoid masking the return code of the file access.
+            # With `set -e` this will now fail if a file doesn't exist.
+            ''
+              secret${toString index}=$(<${credentialPath index name})
+              export secret${toString index}
+            '') (attrNames secrets)
+        )
+        + "\n"
+        + "${pkgs.jq}/bin/jq >'${output}' "
+        + escapeShellArg (
+          stringOrDefault (concatStringsSep " | " (
+            imap1 (
+              index: name:
+              ''${name} = ($ENV.secret${toString index}${optionalString (!secrets.${name}.quote) " | fromjson"})''
+            ) (attrNames secrets)
+          )) "."
+        )
+        + ''
+           <<'EOF'
+          ${toJSON set}
+          EOF
+          (( ! inherit_errexit_enabled )) && shopt -u inherit_errexit
+        '';
+
+        /*
+          Generates a list of systemd LoadCredential entries if loadCredential was set,
+          otherwise returns null.
+
+          The tag is sanitized to only contain characters a-zA-Z0-9_-.#=! and prefixed
+          with an index to ensure uniqueness.
+
+          Example:
+            genLoadCredentialForJqSecretsReplacementSnippet { } {
+              example = {
+                secret1 = { _secret = "/path/to/secret"; };
+                secret2 = { _secret = "/another/secret"; };
+              };
+            }
+            -> [ "0_path_to_secret:/path/to/secret" "1_another_secret:/another/secret" ]
+        */
+        credentials =
+          if loadCredential then
+            imap1 (
+              index: path:
+              "${toString index}_${sanitizePath (secretsRaw.${path}.${attr})}:${secretsRaw.${path}.${attr}}"
+            ) (attrNames secretsRaw)
+          else
+            null;
+      };
+
+    /*
+      A convenience function around `genJqSecretsReplacement` without any additional
+      settings that returns just the script that does the secret replacing. Make sure
+      to have a look at `genJqSecretsReplacement` first to decide whether you need
+      the additional functionality.
+
+      Example:
+        If the file "/path/to/secret" contains the string
+        "topsecretpassword1234",
+
+        genJqSecretsReplacementSnippet {
+          example = [
+            {
+              irrelevant = "not interesting";
+            }
+            {
+              ignored = "ignored attr";
+              relevant = {
+                secret = {
+                  _secret = "/path/to/secret";
+                };
+              };
+            }
+          ];
+        } "/path/to/output.json"
+
+        will return a set of bash commands that replaces the secret values
+        in the given attrset with values from the respective files and saves the result
+        as a JSON file.
+    */
+    genJqSecretsReplacementSnippet = set: output: (genJqSecretsReplacement { } set output).script;
 
     /*
       Remove packages of packagesToRemove from packages, based on their names.

nixos/modules/image/repart.nix

@@ -384,8 +384,8 @@ in
               you're at version 9, you cannot increment this to 10.
             ''
             ++ lib.optional (partitionConfig.stripNixStorePrefix != "_mkMergedOptionModule") ''
-              The option definition `image.repart.paritions.${fileName}.stripNixStorePrefix`
-              has changed to `image.repart.paritions.${fileName}.nixStorePrefix` and now
+              The option definition `image.repart.partitions.${fileName}.stripNixStorePrefix`
+              has changed to `image.repart.partitions.${fileName}.nixStorePrefix` and now
               accepts the path to use as prefix directly. Use `nixStorePrefix = "/"` to
               achieve the same effect as setting `stripNixStorePrefix = true`.
             ''

nixos/modules/services/audio/gonic.nix

@@ -10,6 +10,10 @@ let
     mkKeyValue = lib.generators.mkKeyValueDefault { } " ";
     listsAsDuplicateKeys = true;
   };
+  assertKey = key: {
+    assertion = cfg.settings ? ${key};
+    message = "Please set services.gonic.settings.${key}. See https://github.com/sentriz/gonic#configuration-options for supported values.";
+  };
 in
 {
   options = {
@@ -29,6 +33,7 @@ in
         example = {
           music-path = [ "/mnt/music" ];
           podcast-path = "/mnt/podcasts";
+          playlists-path = "/mnt/playlists";
         };
         description = ''
           Configuration for Gonic, see <https://github.com/sentriz/gonic#configuration-options> for supported values.
@@ -39,6 +44,12 @@ in
   };
 
   config = lib.mkIf cfg.enable {
+    assertions = [
+      (assertKey "music-path")
+      (assertKey "podcast-path")
+      (assertKey "playlists-path")
+    ];
+
     systemd.services.gonic = {
       description = "Gonic Media Server";
       after = [ "network.target" ];
@@ -62,6 +73,7 @@ in
         BindPaths = [
           cfg.settings.playlists-path
           cfg.settings.podcast-path
+          cfg.settings.cache-path
         ];
         BindReadOnlyPaths = [
           # gonic can access scrobbling services
@@ -94,7 +106,6 @@ in
         ];
         RestrictRealtime = true;
         LockPersonality = true;
-        MemoryDenyWriteExecute = true;
         UMask = "0066";
         ProtectHostname = true;
       };

nixos/modules/services/backup/pgbackrest.nix

@@ -83,10 +83,7 @@ let
   secretPathOption =
     with lib.types;
     lib.mkOption {
-      type = nullOr (pathWith {
-        inStore = false;
-        absolute = true;
-      });
+      type = nullOr externalPath;
       default = null;
       internal = true;
     };
@@ -142,10 +139,7 @@ in
               };
 
               options.sftp-private-key-file = lib.mkOption {
-                type = nullOr (pathWith {
-                  inStore = false;
-                  absolute = true;
-                });
+                type = nullOr externalPath;
                 default = null;
                 description = ''
                   SFTP private key file.

nixos/modules/services/databases/postgres-websockets.nix

@@ -31,12 +31,7 @@ in
     enable = lib.mkEnableOption "postgres-websockets";
 
     pgpassFile = lib.mkOption {
-      type =
-        with lib.types;
-        nullOr (pathWith {
-          inStore = false;
-          absolute = true;
-        });
+      type = with lib.types; nullOr externalPath;
       default = null;
       example = "/run/keys/db_password";
       description = ''
@@ -54,12 +49,7 @@ in
     };
 
     jwtSecretFile = lib.mkOption {
-      type =
-        with lib.types;
-        nullOr (pathWith {
-          inStore = false;
-          absolute = true;
-        });
+      type = with lib.types; nullOr externalPath;
       example = "/run/keys/jwt_secret";
       description = ''
         Secret used to sign JWT tokens used to open communications channels.

nixos/modules/services/databases/postgrest.nix

@@ -54,12 +54,7 @@ in
     enable = lib.mkEnableOption "PostgREST";
 
     pgpassFile = lib.mkOption {
-      type =
-        with lib.types;
-        nullOr (pathWith {
-          inStore = false;
-          absolute = true;
-        });
+      type = with lib.types; nullOr externalPath;
       default = null;
       example = "/run/keys/db_password";
       description = ''
@@ -77,12 +72,7 @@ in
     };
 
     jwtSecretFile = lib.mkOption {
-      type =
-        with lib.types;
-        nullOr (pathWith {
-          inStore = false;
-          absolute = true;
-        });
+      type = with lib.types; nullOr externalPath;
       default = null;
       example = "/run/keys/jwt_secret";
       description = ''

nixos/modules/services/desktop-managers/plasma6.nix

@@ -268,6 +268,7 @@ in
     services.upower.enable = config.powerManagement.enable;
     services.libinput.enable = mkDefault true;
     services.geoclue2.enable = mkDefault true;
+    services.fwupd.enable = mkDefault true;
 
     # Extra UDEV rules used by Solid
     services.udev.packages = [

nixos/modules/services/hardware/ddccontrol.nix

@@ -10,31 +10,49 @@ let
 in
 
 {
+  meta.maintainers = with lib.maintainers; [ doronbehar ];
+
   ###### interface
 
   options = {
     services.ddccontrol = {
-      enable = lib.mkEnableOption "ddccontrol for controlling displays";
+      enable = lib.mkEnableOption ''
+        ddccontrol for controlling displays.
+
+        This [enables `hardware.i2c`](#opt-hardware.i2c.enable), so note to add
+        yourself to [`hardware.i2c.group`](#opt-hardware.i2c.group).
+      '';
+      package =
+        lib.mkPackageOption pkgs
+          "package with which to control brightness; added also to [services.dbus.packages](#opt-services.dbus.packages)."
+          {
+            default = [ "ddccontrol" ];
+            example = [ "ddcutil-service" ];
+          };
     };
   };
 
   ###### implementation
 
   config = lib.mkIf cfg.enable {
+    boot.kernelModules = [
+      "ddcci_backlight"
+    ];
     # Load the i2c-dev module
-    boot.kernelModules = [ "i2c_dev" ];
+    hardware.i2c = {
+      enable = true;
+    };
 
-    # Give users access to the "gddccontrol" tool
     environment.systemPackages = [
-      pkgs.ddccontrol
+      cfg.package
     ];
 
     services.dbus.packages = [
-      pkgs.ddccontrol
+      cfg.package
     ];
 
     systemd.packages = [
-      pkgs.ddccontrol
+      cfg.package
     ];
   };
 }

nixos/modules/services/mail/postfix.nix

@@ -522,6 +522,7 @@ in
                 nullOr (oneOf [
                   bool
                   int
+                  path
                   str
                   (listOf str)
                 ])

nixos/modules/services/matrix/matrix-alertmanager.nix

@@ -76,17 +76,11 @@ in
       description = "Makes the bot mention @room when posting an alert";
     };
     tokenFile = lib.mkOption {
-      type = lib.types.pathWith {
-        inStore = false;
-        absolute = true;
-      };
+      type = lib.types.externalPath;
       description = "File that contains a valid Matrix token for the Matrix user.";
     };
     secretFile = lib.mkOption {
-      type = lib.types.pathWith {
-        inStore = false;
-        absolute = true;
-      };
+      type = lib.types.externalPath;
       description = "File that contains a secret for the Alertmanager webhook.";
     };
   };

nixos/modules/services/misc/klipper.nix

@@ -217,7 +217,7 @@ in
       }
     ]
     ++ lib.mapAttrsToList (mcu: firmware: {
-      assertion = firmware.enable -> firmware.serial != null;
+      assertion = firmware.enableKlipperFlash -> firmware.serial != null;
       message = ''
         Unable to determine the serial connection for services.klipper.firmwares."${mcu}". Please set one of the following:
 

nixos/modules/services/monitoring/prometheus/exporters/storagebox.nix

@@ -15,10 +15,7 @@ in
   extraOpts = {
     package = mkPackageOption pkgs "prometheus-storagebox-exporter" { };
     tokenFile = lib.mkOption {
-      type = lib.types.pathWith {
-        inStore = false;
-        absolute = true;
-      };
+      type = lib.types.externalPath;
       description = "File that contains the Hetzner API token to use.";
     };
 

nixos/modules/services/networking/cloudflare-dyndns.nix

@@ -15,11 +15,7 @@ in
       package = lib.mkPackageOption pkgs "cloudflare-dyndns" { };
 
       apiTokenFile = lib.mkOption {
-        type = lib.types.pathWith {
-          absolute = true;
-          inStore = false;
-        };
-
+        type = lib.types.externalPath;
         description = ''
           The path to a file containing the CloudFlare API token.
         '';

nixos/modules/services/networking/oink.nix

@@ -20,15 +20,17 @@ in
   options.services.oink = {
     enable = lib.mkEnableOption "Oink, a dynamic DNS client for Porkbun";
     package = lib.mkPackageOption pkgs "oink" { };
+    apiKeyFile = lib.mkOption {
+      type = lib.types.path;
+      example = "/run/keys/oink-api-key";
+      description = "Path to a file containing the API key to use when modifying DNS records.";
+    };
+    secretApiKeyFile = lib.mkOption {
+      type = lib.types.path;
+      example = "/run/keys/oink-secret-api-key";
+      description = "Path to a file containing the secret API key to use when modifying DNS records.";
+    };
     settings = {
-      apiKey = lib.mkOption {
-        type = lib.types.str;
-        description = "API key to use when modifying DNS records.";
-      };
-      secretApiKey = lib.mkOption {
-        type = lib.types.str;
-        description = "Secret API key to use when modifying DNS records.";
-      };
       interval = lib.mkOption {
         # https://github.com/rlado/oink/blob/v1.1.1/src/main.go#L364
         type = lib.types.ints.between 60 172800; # 48 hours
@@ -79,12 +81,29 @@ in
     };
   };
 
+  imports = [
+    (lib.mkRemovedOptionModule [ "services" "oink" "settings" "apiKey" ] ''
+      This option has been removed because it would make the API key world-readable.
+      Use {option}`apiKeyFile` instead.
+      If you insist on keeping the API key world-readable, you can use `oink.apiKeyFile = pkgs.writeText "api-key" "secret";`.
+    '')
+    (lib.mkRemovedOptionModule [ "services" "oink" "settings" "secretApiKey" ] ''
+      This option has been removed because it would make the API key world-readable.
+      Use {option}`secretApiKeyFile` instead.
+      If you insist on keeping the API key world-readable, you can use `oink.secretApiKeyFile = pkgs.writeText "secret-api-key" "secret";`.
+    '')
+  ];
   config = lib.mkIf cfg.enable {
     systemd.services.oink = {
       description = "Dynamic DNS client for Porkbun";
       after = [ "network.target" ];
       wantedBy = [ "multi-user.target" ];
-      script = "${cfg.package}/bin/oink -c ${oinkConfig}";
+      script =
+        lib.optionalString (cfg.apiKeyFile != null) "OINK_OVERRIDE_APIKEY=\"$(cat ${cfg.apiKeyFile})\" "
+        + lib.optionalString (
+          cfg.secretApiKeyFile != null
+        ) "OINK_OVERRIDE_SECRETAPIKEY=\"$(cat ${cfg.secretApiKeyFile})\" "
+        + "${cfg.package}/bin/oink -c ${oinkConfig}";
       serviceConfig = {
         Restart = "on-failure";
         RestartSec = "10";

nixos/modules/services/networking/syncthing.nix

@@ -559,12 +559,7 @@ in
                                     '';
                                   };
                                   encryptionPasswordFile = mkOption {
-                                    type = types.nullOr (
-                                      types.pathWith {
-                                        inStore = false;
-                                        absolute = true;
-                                      }
-                                    );
+                                    type = types.nullOr types.externalPath;
                                     default = null;
                                     description = ''
                                       Path to encryption password. If set, the file will be read during

nixos/modules/services/search/meilisearch.nix

@@ -182,8 +182,6 @@ in
       no_analytics = lib.mkDefault true;
     };
 
-    services.meilisearch.package = lib.mkDefault pkgs.meilisearch;
-
     # used to restore dumps
     environment.systemPackages = [ cfg.package ];
 

nixos/modules/services/security/step-ca.nix

@@ -55,12 +55,7 @@ in
         '';
       };
       intermediatePasswordFile = lib.mkOption {
-        type = lib.types.nullOr (
-          lib.types.pathWith {
-            inStore = false;
-            absolute = true;
-          }
-        );
+        type = lib.types.nullOr lib.types.externalPath;
         default = null;
         example = "/run/keys/smallstep-password";
         description = ''

nixos/modules/services/web-apps/immich.nix

@@ -2,6 +2,7 @@
   config,
   lib,
   pkgs,
+  utils,
   ...
 }:
 let
@@ -9,10 +10,9 @@ let
   format = pkgs.formats.json { };
   isPostgresUnixSocket = lib.hasPrefix "/" cfg.database.host;
   isRedisUnixSocket = lib.hasPrefix "/" cfg.redis.host;
-
-  # convert a Nix attribute path to jq object identifier-index:
-  # https://jqlang.org/manual/#object-identifier-index
-  attrPathToIndex = attrPath: "." + lib.concatStringsSep "." attrPath;
+  secretsReplacement = utils.genJqSecretsReplacement {
+    loadCredential = true;
+  } cfg.settings "/run/immich/config.json";
 
   commonServiceConfig = {
     Type = "simple";
@@ -55,6 +55,22 @@ let
     if cfg.database.enable then config.services.postgresql.package else pkgs.postgresql;
 in
 {
+  imports = [
+    (lib.mkRemovedOptionModule
+      [
+        "services"
+        "immich"
+        "secretSettings"
+      ]
+      ''
+        `secretSettings` has been deprecated as secrets can now be specified
+        directly in `settings`. To do so, set `_secret` of the desired
+        attribute to a file path, for example:
+          `services.immich.settings.oauth.clientSecret._secret = "/path/to/secret/file";`
+      ''
+    )
+  ];
+
   options.services.immich = {
     enable = mkEnableOption "Immich";
     package = lib.mkPackageOption pkgs "immich" { };
@@ -128,6 +144,7 @@ in
         <https://my.immich.app/admin/system-settings> for
         options and defaults.
         Setting it to `null` allows configuring Immich in the web interface.
+        You can load secret values from a file in this configuration by setting `somevalue._secret = "/path/to/file"` instead of setting `somevalue` directly.
       '';
       type = types.nullOr (
         types.submodule {
@@ -151,27 +168,6 @@ in
       );
     };
 
-    secretSettings = mkOption {
-      default = { };
-      description = ''
-        Secrets to to be added to the JSON file generated from {option}`settings`, read from files.
-      '';
-      example = lib.literalExpression ''
-        {
-          notifications.smtp.transport.password = "/path/to/secret";
-          oauth.clientSecret = "/path/to/other/secret";
-        }
-      '';
-      type =
-        let
-          inherit (types) attrsOf either path;
-          recursiveType = either (attrsOf recursiveType) path // {
-            description = "nested " + (attrsOf path).description;
-          };
-        in
-        recursiveType;
-    };
-
     machine-learning = {
       enable =
         mkEnableOption "immich's machine-learning functionality to detect faces and search for objects"
@@ -424,24 +420,10 @@ in
         postgresqlPackage
       ];
 
-      preStart = mkIf (cfg.settings != null) (
-        ''
-          cat '${format.generate "immich-config.json" cfg.settings}' > /run/immich/config.json
-        ''
-        + lib.concatStrings (
-          lib.mapAttrsToListRecursive (attrPath: _: ''
-            tmp="$(mktemp)"
-            ${lib.getExe pkgs.jq} --rawfile secret "$CREDENTIALS_DIRECTORY/${attrPathToIndex attrPath}" \
-              '${attrPathToIndex attrPath} = ($secret | rtrimstr("\n"))' /run/immich/config.json > "$tmp"
-            mv "$tmp" /run/immich/config.json
-          '') cfg.secretSettings
-        )
-      );
+      preStart = mkIf (cfg.settings != null) secretsReplacement.script;
 
       serviceConfig = commonServiceConfig // {
-        LoadCredential = lib.mapAttrsToListRecursive (
-          attrPath: file: "${attrPathToIndex attrPath}:${file}"
-        ) cfg.secretSettings;
+        LoadCredential = secretsReplacement.credentials;
         ExecStart = lib.getExe cfg.package;
         EnvironmentFile = mkIf (cfg.secretsFile != null) cfg.secretsFile;
         Slice = "system-immich.slice";

nixos/modules/services/web-apps/librespeed.nix

@@ -71,14 +71,7 @@ in
         The contents of the specified paths will be read at service start time and merged with the attributes provided in `settings`.
       '';
       default = { };
-      type =
-        with lib.types;
-        nullOr (
-          attrsOf (pathWith {
-            inStore = false;
-            absolute = true;
-          })
-        );
+      type = with lib.types; nullOr (attrsOf externalPath);
     };
 
     settings = lib.mkOption {

nixos/modules/services/web-apps/oncall.nix

@@ -78,10 +78,7 @@ in
     };
 
     secretFile = lib.mkOption {
-      type = lib.types.pathWith {
-        inStore = false;
-        absolute = true;
-      };
+      type = lib.types.externalPath;
       example = "/run/keys/oncall-dbpassword";
       description = ''
         A YAML file containing secrets such as database or user passwords.

nixos/modules/services/web-apps/photoprism.nix

@@ -33,12 +33,7 @@ in
     enable = lib.mkEnableOption "Photoprism web server";
 
     passwordFile = lib.mkOption {
-      type = lib.types.nullOr (
-        lib.types.pathWith {
-          inStore = false;
-          absolute = true;
-        }
-      );
+      type = lib.types.nullOr lib.types.externalPath;
       default = null;
       description = ''
         Admin password file.
@@ -46,12 +41,7 @@ in
     };
 
     databasePasswordFile = lib.mkOption {
-      type = lib.types.nullOr (
-        lib.types.pathWith {
-          inStore = false;
-          absolute = true;
-        }
-      );
+      type = lib.types.nullOr lib.types.externalPath;
       default = null;
       description = ''
         Database password file.

nixos/modules/system/boot/networkd.nix

@@ -376,6 +376,7 @@ let
             "TOS"
             "TTL"
             "DiscoverPathMTU"
+            "IgnoreDontFragment"
             "IPv6FlowLabel"
             "CopyDSCP"
             "EncapsulationLimit"
@@ -398,6 +399,7 @@ let
           (assertInt "TTL")
           (assertRange "TTL" 0 255)
           (assertValueOneOf "DiscoverPathMTU" boolValues)
+          (assertValueOneOf "IgnoreDontFragment" boolValues)
           (assertValueOneOf "CopyDSCP" boolValues)
           (assertValueOneOf "Mode" [
             "ip6ip6"

nixos/tests/breitbandmessung.nix

@@ -23,9 +23,6 @@
 
       environment.systemPackages = with pkgs; [ breitbandmessung ];
       environment.variables.XAUTHORITY = "/home/alice/.Xauthority";
-
-      # breitbandmessung is unfree
-      nixpkgs.config.allowUnfreePredicate = pkg: builtins.elem (lib.getName pkg) [ "breitbandmessung" ];
     };
 
   enableOCR = true;

nixos/tests/brscan5.nix

@@ -7,7 +7,6 @@
   node.pkgsReadOnly = false;
 
   nodes.machine = {
-    nixpkgs.config.allowUnfree = true;
     hardware.sane = {
       enable = true;
       brscan5 = {

nixos/tests/common/acme/server/generate-certs.nix

@@ -4,11 +4,8 @@
   pkgs ? import <nixpkgs> { },
   minica ? pkgs.minica,
   mkDerivation ? pkgs.stdenv.mkDerivation,
+  domain ? (import ./snakeoil-certs.nix).domain,
 }:
-let
-  conf = import ./snakeoil-certs.nix;
-  domain = conf.domain;
-in
 mkDerivation {
   name = "test-certs";
   buildInputs = [

nixos/tests/consul.nix

@@ -57,8 +57,6 @@ let
       ];
       networking.firewall = firewallSettings;
 
-      nixpkgs.config.allowUnfreePredicate = pkg: builtins.elem (lib.getName pkg) [ "consul" ];
-
       services.consul = {
         enable = true;
         inherit webUi;
@@ -87,8 +85,6 @@ let
       ];
       networking.firewall = firewallSettings;
 
-      nixpkgs.config.allowUnfreePredicate = pkg: builtins.elem (lib.getName pkg) [ "consul" ];
-
       services.consul =
         assert builtins.elem thisConsensusServerHost allConsensusServerHosts;
         {

nixos/tests/deconz.nix

@@ -12,7 +12,6 @@ in
   node.pkgsReadOnly = false;
 
   nodes.machine = {
-    nixpkgs.config.allowUnfree = true;
     services.deconz = {
       enable = true;
       inherit httpPort;

nixos/tests/minecraft-server.nix

@@ -15,8 +15,6 @@ in
     {
       environment.systemPackages = [ pkgs.mcrcon ];
 
-      nixpkgs.config.allowUnfree = true;
-
       services.minecraft-server = {
         declarative = true;
         enable = true;

nixos/tests/n8n.nix

@@ -15,12 +15,6 @@ in
   nodes.machine =
     { ... }:
     {
-      nixpkgs.config.allowUnfreePredicate =
-        pkg:
-        builtins.elem (lib.getName pkg) [
-          "n8n"
-        ];
-
       services.n8n = {
         enable = true;
         environment.WEBHOOK_URL = webhookUrl;

nixos/tests/outline.nix

@@ -8,7 +8,6 @@
 
   nodes.outline = {
     virtualisation.memorySize = 2 * 1024;
-    nixpkgs.config.allowUnfree = true;
     services.outline = {
       enable = true;
       forceHttps = false;

nixos/tests/prometheus-exporters.nix

@@ -1502,9 +1502,6 @@ let
       metricProvider = {
         services.sabnzbd.enable = true;
 
-        # unrar is required for sabnzbd
-        nixpkgs.config.allowUnfreePredicate = pkg: builtins.elem (pkgs.lib.getName pkg) [ "unrar" ];
-
         # extract the generated api key before starting
         systemd.services.sabnzbd-apikey = {
           requires = [ "sabnzbd.service" ];

nixos/tests/quake3.nix

@@ -7,18 +7,6 @@ let
     });
   };
 
-  # Only allow the demo data to be used (only if it's unfreeRedistributable).
-  unfreePredicate =
-    pkg:
-    let
-      allowPackageNames = [
-        "quake3-demodata"
-        "quake3-pointrelease"
-      ];
-      allowLicenses = [ lib.licenses.unfreeRedistributable ];
-    in
-    lib.elem pkg.pname allowPackageNames && lib.elem (pkg.meta.license or null) allowLicenses;
-
   client =
     { pkgs, ... }:
     {
@@ -26,7 +14,6 @@ let
       hardware.graphics.enable = true;
       environment.systemPackages = [ pkgs.quake3demo ];
       nixpkgs.config.packageOverrides = overrides;
-      nixpkgs.config.allowUnfreePredicate = unfreePredicate;
     };
 in
 {
@@ -49,7 +36,6 @@ in
             + "+map q3dm7 +addbot grunt +addbot daemia 2> /tmp/log";
         };
         nixpkgs.config.packageOverrides = overrides;
-        nixpkgs.config.allowUnfreePredicate = unfreePredicate;
         networking.firewall.allowedUDPPorts = [ 27960 ];
       };
 

nixos/tests/redlib.nix

@@ -1,4 +1,8 @@
 { lib, pkgs, ... }:
+let
+  certs = import redlib/snakeoil-certs.nix;
+  redditDomain = certs.domain;
+in
 {
   name = "redlib";
   meta.maintainers = with lib.maintainers; [
@@ -7,6 +11,24 @@
   ];
 
   nodes.machine = {
+    # The test will hang if Redlib can't initialize its OAuth client, so we
+    # provide it with a mock endpoint.
+    networking.hosts."127.0.0.1" = [ redditDomain ];
+    security.pki.certificates = [
+      (builtins.readFile certs.ca.cert)
+    ];
+    services.nginx = {
+      enable = true;
+      virtualHosts.${redditDomain} = {
+        onlySSL = true;
+        sslCertificate = certs.${redditDomain}.cert;
+        sslCertificateKey = certs.${redditDomain}.key;
+        locations."/auth/v2/oauth/access-token/loid".extraConfig = ''
+          return 200 "{\"access_token\":\"AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\",\"expires_in\":0}";
+        '';
+      };
+    };
+
     services.redlib = {
       package = pkgs.redlib;
       enable = true;

nixos/tests/redlib/ca.cert.pem

@@ -0,0 +1,13 @@
+-----BEGIN CERTIFICATE-----
+MIIB/TCCAYKgAwIBAgIIR+NCHSDJCIAwCgYIKoZIzj0EAwMwIDEeMBwGA1UEAxMV
+bWluaWNhIHJvb3QgY2EgNDdlMzQyMCAXDTI1MTEwOTA2MjMwNFoYDzIxMjUxMTA5
+MDYyMzA0WjAgMR4wHAYDVQQDExVtaW5pY2Egcm9vdCBjYSA0N2UzNDIwdjAQBgcq
+hkjOPQIBBgUrgQQAIgNiAASo81ED5tomfR47qFXpan+0cBKP7eoAhAAkJeT9w/h2
+axpVVQ/X+rDFu1QbKDqE7lJ2j3Ue7eb/6Q5Zrt9MSFPDcQz7eFr6kX0S2u5AHO9z
+6E60gUNUwZBDBenr0P/uTQ6jgYYwgYMwDgYDVR0PAQH/BAQDAgKEMB0GA1UdJQQW
+MBQGCCsGAQUFBwMBBggrBgEFBQcDAjASBgNVHRMBAf8ECDAGAQH/AgEAMB0GA1Ud
+DgQWBBQuPLVPdRiEUCga2W3RKwL4diQVMDAfBgNVHSMEGDAWgBQuPLVPdRiEUCga
+2W3RKwL4diQVMDAKBggqhkjOPQQDAwNpADBmAjEAqG8PIYJ0CQG3CfLsQFpwDLmj
+DoEFgcRMkRQz4vtAQMpLhoo8VAPo7Vl+AAaZgRVPAjEA6XDte56Oou5qMj4Zkzi8
+EYIucHtYrfTNJOarDSYYvTlNrmuQ73KTP4Hxfd26TA2q
+-----END CERTIFICATE-----

nixos/tests/redlib/ca.key.pem

@@ -0,0 +1,6 @@
+-----BEGIN PRIVATE KEY-----
+MIG2AgEAMBAGByqGSM49AgEGBSuBBAAiBIGeMIGbAgEBBDBuuWbxl4uwwcIT0SvT
+jcQHDekytbQrLw4imrpfrAJmTdvyHcfEGiWuwscs36mq50WhZANiAASo81ED5tom
+fR47qFXpan+0cBKP7eoAhAAkJeT9w/h2axpVVQ/X+rDFu1QbKDqE7lJ2j3Ue7eb/
+6Q5Zrt9MSFPDcQz7eFr6kX0S2u5AHO9z6E60gUNUwZBDBenr0P/uTQ4=
+-----END PRIVATE KEY-----

nixos/tests/redlib/snakeoil-certs.nix

@@ -0,0 +1,17 @@
+# To generate cert files:
+# cp $(nix-build ../common/acme/server/generate-certs.nix --arg domain '(import ./snakeoil-certs.nix).domain' --no-out-link)/* .
+
+let
+  domain = "www.reddit.com";
+in
+{
+  inherit domain;
+  ca = {
+    cert = ./ca.cert.pem;
+    key = ./ca.key.pem;
+  };
+  ${domain} = {
+    cert = ./${domain}.cert.pem;
+    key = ./${domain}.key.pem;
+  };
+}

nixos/tests/redlib/www.reddit.com.cert.pem

@@ -0,0 +1,13 @@
+-----BEGIN CERTIFICATE-----
+MIIB5jCCAW2gAwIBAgIIFaN6FT3RbaswCgYIKoZIzj0EAwMwIDEeMBwGA1UEAxMV
+bWluaWNhIHJvb3QgY2EgNDdlMzQyMB4XDTI1MTEwOTA2MjMwNFoXDTQ1MTEwOTA2
+MjMwNFowGTEXMBUGA1UEAxMOd3d3LnJlZGRpdC5jb20wdjAQBgcqhkjOPQIBBgUr
+gQQAIgNiAAQpU1quYyW3g2ZjtwSFLNOhucqkjFhCN5rcSZOLpbnieelZ6axvoH6x
+2Znfcu4YqYtK8G/zHDv2o9gQQpDBcWp7dobpUVbfrSRxsr5LEYlEXPUslbFkFWau
+HzKTx5QTyu2jezB5MA4GA1UdDwEB/wQEAwIFoDAdBgNVHSUEFjAUBggrBgEFBQcD
+AQYIKwYBBQUHAwIwDAYDVR0TAQH/BAIwADAfBgNVHSMEGDAWgBQuPLVPdRiEUCga
+2W3RKwL4diQVMDAZBgNVHREEEjAQgg53d3cucmVkZGl0LmNvbTAKBggqhkjOPQQD
+AwNnADBkAjAqU0nW3KRXEZMTP9qjnNqherjVYa8WPWMCtwYqiFDOWilByZFjEZUs
+8it+unxaNe4CMA12fOFHgsM1tKRiSslIHXSx5V71RkXGrQxxqfRlD0w7LjsJWXRv
+Z6DKyxfF6MJPEA==
+-----END CERTIFICATE-----

nixos/tests/redlib/www.reddit.com.key.pem

@@ -0,0 +1,6 @@
+-----BEGIN PRIVATE KEY-----
+MIG2AgEAMBAGByqGSM49AgEGBSuBBAAiBIGeMIGbAgEBBDB1r7aQH0yOtCYquZXn
+1jVqo9gD7kIZRa4TaeHNRRKcv9w9WswTfSJ/0QILIFP0K7WhZANiAAQpU1quYyW3
+g2ZjtwSFLNOhucqkjFhCN5rcSZOLpbnieelZ6axvoH6x2Znfcu4YqYtK8G/zHDv2
+o9gQQpDBcWp7dobpUVbfrSRxsr5LEYlEXPUslbFkFWauHzKTx5QTyu0=
+-----END PRIVATE KEY-----

nixos/tests/sabnzbd.nix

@@ -11,9 +11,6 @@
       services.sabnzbd = {
         enable = true;
       };
-
-      # unrar is unfree
-      nixpkgs.config.allowUnfreePredicate = pkg: builtins.elem (lib.getName pkg) [ "unrar" ];
     };
 
   testScript = ''

nixos/tests/teleport.nix

@@ -9,7 +9,6 @@ with import ../lib/testing-python.nix { inherit system pkgs; };
 
 let
   packages = with pkgs; {
-    "16" = teleport_16;
     "17" = teleport_17;
     "18" = teleport_18;
   };

nixos/tests/unifi.nix

@@ -11,8 +11,6 @@
   node.pkgsReadOnly = false;
 
   nodes.machine = {
-    nixpkgs.config.allowUnfree = true;
-
     services.unifi.enable = true;
   };
 

nixos/tests/virtualbox.nix

@@ -426,8 +426,6 @@ let
             enable = true;
           }
           // vboxHostConfig;
-
-          nixpkgs.config.allowUnfree = config.virtualisation.virtualbox.host.enableExtensionPack;
         };
 
       testScript = ''

nixos/tests/vscode-remote-ssh.nix

@@ -1,22 +1,6 @@
 import ./make-test-python.nix (
-  { lib, ... }@args:
+  { lib, pkgs, ... }@args:
   let
-    pkgs = args.pkgs.extend (
-      self: super: {
-        stdenv = super.stdenv.override {
-          config = super.config // {
-            allowUnfreePredicate =
-              pkg:
-              builtins.elem (lib.getName pkg) [
-                "vscode"
-                "vscode-with-extensions"
-                "vscode-extension-ms-vscode-remote-remote-ssh"
-              ];
-          };
-        };
-      }
-    );
-
     inherit (import ./ssh-keys.nix pkgs) snakeOilPrivateKey snakeOilPublicKey;
 
     inherit (pkgs.vscode.passthru) rev vscodeServer;

nixos/tests/web-apps/immich.nix

@@ -17,14 +17,14 @@
       services.immich = {
         enable = true;
         environment.IMMICH_LOG_LEVEL = "verbose";
-        settings.backup.database = {
-          enabled = true;
-          cronExpression = "invalid";
-        };
-        secretSettings = {
-          backup.database.cronExpression = "${pkgs.writeText "cron" "0 02 * * *"}";
+        settings = {
+          backup.database = {
+            enabled = true;
+            # Test loading secrets from files:
+            cronExpression._secret = "${pkgs.writeText "cron" "0 02 * * *"}";
+          };
           # thanks to LoadCredential files only readable by root should work
-          notifications.smtp.transport.password = "/etc/shadow";
+          notifications.smtp.transport.password._secret = "/etc/shadow";
         };
       };
 

pkgs/applications/editors/vim/plugins/cocPlugins.nix

@@ -2,6 +2,7 @@
   lib,
   buildVimPlugin,
   pkgs,
+  coc-nginx,
 }:
 final: prev:
 let
@@ -60,3 +61,9 @@ lib.genAttrs cocPackages (
     src = "${cocPkg}/lib/node_modules/${cocPkg.pname}";
   }
 )
+// {
+  coc-nginx = buildVimPlugin {
+    inherit (coc-nginx) pname version meta;
+    src = "${coc-nginx}/lib/node_modules/@yaegassy/coc-nginx";
+  };
+}

pkgs/applications/editors/vim/plugins/generated.nix

@@ -5307,6 +5307,19 @@ final: prev: {
     meta.hydraPlatforms = [ ];
   };
 
+  floaterm = buildVimPlugin {
+    pname = "floaterm";
+    version = "2025-09-23";
+    src = fetchFromGitHub {
+      owner = "nvzone";
+      repo = "floaterm";
+      rev = "34e14f0b5e2687fd31a93fe75982ec84e5145856";
+      sha256 = "0g0wf1f049sayj9d11xjjz37ssvp7g9q39b5dwimf3i6fn80b42k";
+    };
+    meta.homepage = "https://github.com/nvzone/floaterm/";
+    meta.hydraPlatforms = [ ];
+  };
+
   floating-input-nvim = buildVimPlugin {
     pname = "floating-input.nvim";
     version = "2025-05-28";
@@ -5620,6 +5633,19 @@ final: prev: {
     meta.hydraPlatforms = [ ];
   };
 
+  gdscript-extended-lsp-nvim = buildVimPlugin {
+    pname = "gdscript-extended-lsp.nvim";
+    version = "2025-10-28";
+    src = fetchFromGitHub {
+      owner = "Teatek";
+      repo = "gdscript-extended-lsp.nvim";
+      rev = "27eab5f4979b759368a7760d6955fb93f147e97e";
+      sha256 = "1jilxsz49w720ai41zksvap6bsib347bz9xh0x8b0izcpmsdjc80";
+    };
+    meta.homepage = "https://github.com/Teatek/gdscript-extended-lsp.nvim/";
+    meta.hydraPlatforms = [ ];
+  };
+
   gen-nvim = buildVimPlugin {
     pname = "gen.nvim";
     version = "2025-05-03";

pkgs/applications/editors/vim/plugins/nodePackagePlugins.nix

@@ -10,20 +10,13 @@ let
     "coc-ltex"
     "coc-tsserver"
     "coc-ultisnips"
-    "coc-nginx"
   ];
-
-  packageNameOverrides = {
-    "coc-nginx" = "@yaegassy/coc-nginx";
-  };
-
-  getPackageName = name: packageNameOverrides.${name} or name;
 in
 lib.genAttrs nodePackageNames (
   name:
   buildVimPlugin {
     pname = name;
-    inherit (nodePackages.${getPackageName name}) version meta;
-    src = "${nodePackages.${getPackageName name}}/lib/node_modules/${getPackageName name}";
+    inherit (nodePackages.${name}) version meta;
+    src = "${nodePackages.${name}}/lib/node_modules/${name}";
   }
 )

pkgs/applications/editors/vim/plugins/non-generated/avante-nvim/default.nix

@@ -12,12 +12,12 @@
   pkgs,
 }:
 let
-  version = "0.0.27-unstable-2025-10-31";
+  version = "0.0.27-unstable-2025-11-09";
   src = fetchFromGitHub {
     owner = "yetone";
     repo = "avante.nvim";
-    rev = "7f48770e66684e9a7d4d5b9c47505a23e0167a6e";
-    hash = "sha256-U8RnTBGW+dR26JATQ10JbM8R03qX/ovPjvelHw2J7fc=";
+    rev = "f8a7cd1a606460ec0a2c4ec886bc102daccf912e";
+    hash = "sha256-jRIPBO/5JKFe2bZYjPtW8o0dDujoCxU8zq9Ot3hCtzs=";
   };
   avante-nvim-lib = rustPlatform.buildRustPackage {
     pname = "avante-nvim-lib";

pkgs/applications/editors/vim/plugins/overrides.nix

@@ -1215,6 +1215,10 @@ assertNoAdditions {
     dependencies = [ self.leap-nvim ];
   };
 
+  floaterm = super.floaterm.overrideAttrs {
+    dependencies = [ self.nvzone-volt ];
+  };
+
   flutter-tools-nvim = super.flutter-tools-nvim.overrideAttrs {
     # Optional dap integration
     checkInputs = [ self.nvim-dap ];

pkgs/applications/editors/vim/plugins/vim-plugin-names

@@ -406,6 +406,7 @@ https://github.com/willothy/flatten.nvim/,HEAD,
 https://github.com/felipeagc/fleet-theme-nvim/,,
 https://github.com/ggandor/flit.nvim/,HEAD,
 https://github.com/ncm2/float-preview.nvim/,,
+https://github.com/nvzone/floaterm/,HEAD,
 https://github.com/liangxianzhe/floating-input.nvim/,HEAD,
 https://github.com/floobits/floobits-neovim/,,
 https://github.com/nvim-flutter/flutter-tools.nvim/,HEAD,
@@ -430,6 +431,7 @@ https://github.com/gfanto/fzf-lsp.nvim/,,
 https://github.com/junegunn/fzf.vim/,,
 https://github.com/NTBBloodbath/galaxyline.nvim/,,
 https://github.com/gbprod/nord.nvim/,,gbprod-nord
+https://github.com/Teatek/gdscript-extended-lsp.nvim/,HEAD,
 https://github.com/David-Kunz/gen.nvim/,HEAD,
 https://github.com/jsfaint/gen_tags.vim/,,
 https://github.com/gentoo/gentoo-syntax/,,

pkgs/applications/editors/vscode/extensions/default.nix

@@ -2285,8 +2285,8 @@ let
         mktplcRef = {
           name = "vscode-vibrancy-continued";
           publisher = "illixion";
-          version = "1.1.61";
-          hash = "sha256-1LjAIMjk7JjLTf49QvDaLeGGDD5SUCLC3/41RfVVhEM=";
+          version = "1.1.62";
+          hash = "sha256-Urfa4XligTfFk6+GIuGabm5EFeQe+gRhdtb8IoXz+Ak=";
         };
         meta = {
           downloadPage = "https://marketplace.visualstudio.com/items?itemName=illixion.vscode-vibrancy-continued";
@@ -4514,8 +4514,8 @@ let
         mktplcRef = {
           name = "tabnine-vscode";
           publisher = "tabnine";
-          version = "3.321.0";
-          hash = "sha256-GIszVwrS0brC+3jT+48zUa0E2Q+DUau/WuoOfRDobb8=";
+          version = "3.324.0";
+          hash = "sha256-W1+TCXUmuTCb+IZZk3n6dyIDfVbMuU3jJUOsfrdjoXo=";
         };
         meta = {
           license = lib.licenses.mit;
@@ -5116,8 +5116,8 @@ let
         mktplcRef = {
           name = "vim";
           publisher = "vscodevim";
-          version = "1.31.0";
-          hash = "sha256-97dQeCFm2i5uRF45k1tVMWiXNh5xBw3MVYM8MSIeDFE=";
+          version = "1.32.0";
+          hash = "sha256-qZYtCjqWoqE2qjrJN70ws9/w0FncLCWqTeVX/B66CmQ=";
         };
         meta = {
           license = lib.licenses.mit;

pkgs/applications/editors/vscode/extensions/ms-azuretools.vscode-containers/default.nix

@@ -7,8 +7,8 @@ vscode-utils.buildVscodeMarketplaceExtension {
   mktplcRef = {
     publisher = "ms-azuretools";
     name = "vscode-containers";
-    version = "2.2.0";
-    hash = "sha256-UxWsu7AU28plnT0QMdpPJrcYZIV09FeC+rmYKf39a6M=";
+    version = "2.3.0";
+    hash = "sha256-zrEZpd2geX2G4u6LkIk3d6C7vhwZZ4lwHGQR3Z0OWY4=";
   };
 
   meta = {

pkgs/applications/emulators/libretro/cores/bluemsx.nix

@@ -5,13 +5,13 @@
 }:
 mkLibretroCore {
   core = "bluemsx";
-  version = "0-unstable-2025-11-01";
+  version = "0-unstable-2025-11-04";
 
   src = fetchFromGitHub {
     owner = "libretro";
     repo = "bluemsx-libretro";
-    rev = "1f8aeb9ac3f3a4202736ac22e1785f01a834b975";
-    hash = "sha256-VnTL7MLhB/WEHm9930OvM84I5Vp4AaAI6qh7I4QRkVw=";
+    rev = "036376d6679c9e153712dbbb3fdca774afc49706";
+    hash = "sha256-0oT+m30bay/3BQgKBxX397a8o+QP1/IHIo0jGmSWGGg=";
   };
 
   meta = {

pkgs/applications/emulators/libretro/cores/fbneo.nix

@@ -5,13 +5,13 @@
 }:
 mkLibretroCore {
   core = "fbneo";
-  version = "0-unstable-2025-11-02";
+  version = "0-unstable-2025-11-06";
 
   src = fetchFromGitHub {
     owner = "libretro";
     repo = "fbneo";
-    rev = "442a0e901c3d7d60c94f21caf46c0535233086f6";
-    hash = "sha256-ewwF7btf5EEBmGzAVuH4LavrDpmVzEBD/BE1/T/p6bM=";
+    rev = "7759881be43b5f1711c95a2a80aa8987a98fbb99";
+    hash = "sha256-vYHWJV5xRACjdllmeg/3tr2WgI4QcWtuhKJhEwGIGD0=";
   };
 
   makefile = "Makefile";

pkgs/applications/emulators/libretro/cores/genesis-plus-gx.nix

@@ -5,13 +5,13 @@
 }:
 mkLibretroCore {
   core = "genesis-plus-gx";
-  version = "0-unstable-2025-10-23";
+  version = "0-unstable-2025-11-07";
 
   src = fetchFromGitHub {
     owner = "libretro";
     repo = "Genesis-Plus-GX";
-    rev = "cecccacf767b1c8e86af3e315223b052a7f81b95";
-    hash = "sha256-x2ClmCtWIF9HS8Yb+8cNm9MSxwcwSm05G+hZGWBz2OY=";
+    rev = "180bed8e35fc48827f087926c4770f9ccdeaad0c";
+    hash = "sha256-7RfO2GdsMZ/9VZ0cK2pl/s+kOUyUBbqTSDVzn1icN6k=";
   };
 
   meta = {

pkgs/applications/gis/qgis/unwrapped.nix

@@ -21,7 +21,6 @@
   grass,
   gsl,
   hdf5,
-  libspatialindex,
   libspatialite,
   libzip,
   netcdf,
@@ -82,14 +81,14 @@ let
   ];
 in
 mkDerivation rec {
-  version = "3.44.3";
+  version = "3.44.4";
   pname = "qgis-unwrapped";
 
   src = fetchFromGitHub {
     owner = "qgis";
     repo = "QGIS";
     rev = "final-${lib.replaceStrings [ "." ] [ "_" ] version}";
-    hash = "sha256-g7ZdNLal16b0Fbq492mPpOiNkYc3Bm4c7INWX+2e7H8=";
+    hash = "sha256-G9atxBBANlUDGl39bkwTo6L04/+0o5A5ake4KvIY70E=";
   };
 
   passthru = {
@@ -115,7 +114,6 @@ mkDerivation rec {
     geos
     gsl
     hdf5
-    libspatialindex
     libspatialite
     libzip
     netcdf
@@ -159,6 +157,9 @@ mkDerivation rec {
     "-DWITH_PDAL=True"
     "-DENABLE_TESTS=False"
     "-DQT_PLUGINS_DIR=${qtbase}/${qtbase.qtPluginPrefix}"
+
+    # See https://github.com/libspatialindex/libspatialindex/issues/276
+    "-DWITH_INTERNAL_SPATIALINDEX=True"
   ]
   ++ lib.optional (!withWebKit) "-DWITH_QTWEBKIT=OFF"
   ++ lib.optional withServer [

pkgs/applications/graphics/xournalpp/default.nix

@@ -84,10 +84,7 @@ stdenv.mkDerivation rec {
     homepage = "https://xournalpp.github.io/";
     changelog = "https://github.com/xournalpp/xournalpp/blob/v${version}/CHANGELOG.md";
     license = lib.licenses.gpl2Plus;
-    maintainers = with lib.maintainers; [
-      sikmir
-      iedame
-    ];
+    maintainers = with lib.maintainers; [ sikmir ];
     platforms = lib.platforms.unix;
     mainProgram = "xournalpp";
   };

pkgs/applications/misc/lutris/default.nix

@@ -155,10 +155,7 @@ buildPythonApplication rec {
     homepage = "https://lutris.net";
     description = "Open Source gaming platform for GNU/Linux";
     license = licenses.gpl3Plus;
-    maintainers = with maintainers; [
-      rapiteanu
-      iedame
-    ];
+    maintainers = with maintainers; [ rapiteanu ];
     platforms = platforms.linux;
     mainProgram = "lutris";
   };

pkgs/applications/networking/cluster/terraform-providers/providers.json

@@ -1,12 +1,12 @@
 {
   "1password_onepassword": {
-    "hash": "sha256-u2nSzEKD0o/e0AzeHdKQj3+h7mAt6r5cxaKsPn6nRGo=",
+    "hash": "sha256-4wEKPTBt9F8N9jPk/PUu+ewrCJ8IztU9CblfJxA7h1k=",
     "homepage": "https://registry.terraform.io/providers/1Password/onepassword",
     "owner": "1Password",
     "repo": "terraform-provider-onepassword",
-    "rev": "v2.1.2",
+    "rev": "v2.2.0",
     "spdx": "MIT",
-    "vendorHash": null
+    "vendorHash": "sha256-n01cHzyG9FvxCb92sFccKY1h7Pa0zmi+CUxSYHM5Elc="
   },
   "a10networks_thunder": {
     "hash": "sha256-2i1DSOSt/vbFs0QCPogEBvADhLJFKbrQzwZ20ChCQMk=",
@@ -363,11 +363,11 @@
     "vendorHash": "sha256-Q3H/6mpkWn1Gw0NRMtKtkBRGHjPJZGBFdGwfalyQ4Z0="
   },
   "equinix_equinix": {
-    "hash": "sha256-WjJxZzrsyHHjsVK4pZf3ByTcFBXbIlw7JiMp9uMv19I=",
+    "hash": "sha256-qF3v9sol5/pdK+WCsz69eT/xAwsSfjnCjKTa+AXuBUI=",
     "homepage": "https://registry.terraform.io/providers/equinix/equinix",
     "owner": "equinix",
     "repo": "terraform-provider-equinix",
-    "rev": "v4.7.0",
+    "rev": "v4.10.0",
     "spdx": "MIT",
     "vendorHash": "sha256-GEdgHY2cIiXxeIYev7zbGd4c+IyZZfeZtSj9Z/gG6E4="
   },
@@ -489,13 +489,13 @@
     "vendorHash": "sha256-MYVkNvJ+rbwGw0htClIbmxk3YX2OK/ZO/QOTyMRFiug="
   },
   "hashicorp_aws": {
-    "hash": "sha256-wavy4GE4VrXhDYqWAJsexxFPDM/Roo+YKp/DqVw8+jU=",
+    "hash": "sha256-YxN5bk0Us+LZlNMzt1/eh5I2gV77S/J+wt82WIGZvZU=",
     "homepage": "https://registry.terraform.io/providers/hashicorp/aws",
     "owner": "hashicorp",
     "repo": "terraform-provider-aws",
-    "rev": "v6.19.0",
+    "rev": "v6.20.0",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-xMXyuGRsoyGJKJLCR6E5IpySkym34ShzrJtwbAMoCZw="
+    "vendorHash": "sha256-mTK19nqRGR7H45oUHgSC56KrAEJFIu/EocqBjY70fDY="
   },
   "hashicorp_awscc": {
     "hash": "sha256-eaFzTQehn1nIq0Zl/8r2AtmPQnhh7X44q/6JVzIzX2A=",
@@ -561,22 +561,22 @@
     "vendorHash": "sha256-xIagZvWtlNpz5SQfxbA7r9ojAeS3CW2pwV337ObKOwU="
   },
   "hashicorp_google": {
-    "hash": "sha256-sGdKvVyQkYVM2zZ6fVgUr2ANgQVwJjvlcbSUAUagsqU=",
+    "hash": "sha256-PoPYcCr66g+3S94q0SprdQokgVkFM1p3oYSBEMOdSWY=",
     "homepage": "https://registry.terraform.io/providers/hashicorp/google",
     "owner": "hashicorp",
     "repo": "terraform-provider-google",
-    "rev": "v7.9.0",
+    "rev": "v7.10.0",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-kSFeWcuoym3FJP/E/diWuafEv1sffYinAzCjZ6z7B84="
+    "vendorHash": "sha256-BghusRVsU7HrX6hWpbanGJ93UdHSq8nWmcEGnyyVOTs="
   },
   "hashicorp_google-beta": {
-    "hash": "sha256-j8CDyKV43rmxA6wyF1luO95AJCY5jpz9suUVLKWUVQo=",
+    "hash": "sha256-lL4BtInJu/STew7SaNrwPnmLDLucMvbyGanAK9tsJKE=",
     "homepage": "https://registry.terraform.io/providers/hashicorp/google-beta",
     "owner": "hashicorp",
     "repo": "terraform-provider-google-beta",
-    "rev": "v7.9.0",
+    "rev": "v7.10.0",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-tc7PInjXPEAI/sYtrYZsQxQV3Gk04ov/4SBQ1fHqkIQ="
+    "vendorHash": "sha256-zLUlrIdfqhiVITQe7bmoYl570LvLS8aEMU2HC4xmKTU="
   },
   "hashicorp_helm": {
     "hash": "sha256-XU5AxXYvZtHnxGotOvGOojybcusVX9DRK2sazfytkAw=",
@@ -669,13 +669,13 @@
     "vendorHash": "sha256-tYvQURTrFtr+rgSMGq2zi/5p5jJVGIse7+hj95gz68U="
   },
   "hashicorp_vault": {
-    "hash": "sha256-5jx6a2BfnugD41D6iK7wvOzmMPImxNHCiIix4+puRp4=",
+    "hash": "sha256-xmi+79FoT8vXHJqMmIAIV+YcpZzAA40cNOxDOufJkro=",
     "homepage": "https://registry.terraform.io/providers/hashicorp/vault",
     "owner": "hashicorp",
     "repo": "terraform-provider-vault",
-    "rev": "v5.3.0",
+    "rev": "v5.4.0",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-qrztgFJ/WDTxP5565rnx2sAELFKQGOxFuEYqWQQYVVY="
+    "vendorHash": "sha256-zZUFUcgMQkbnh7It9k/7J/2KfiP1q3nlcC58xPb2bBo="
   },
   "hashicorp_vsphere": {
     "hash": "sha256-vRO6vxzi4d0hNc0MmQLhN7roONnsjxPBtFt0fyvxWd8=",
@@ -805,11 +805,11 @@
     "vendorHash": "sha256-OZG8EA8xtskbLZgHzWm865wjnhRCsWdNepNMHfdtkyw="
   },
   "kislerdm_neon": {
-    "hash": "sha256-O7VYLD1qyH5oXv02OxrhQW+J1VysiHwbwW+Fzq4VKkE=",
+    "hash": "sha256-4icz/nGHIP2nzGbP4iGuPVbn8OC+u13qBSwYbyFLCto=",
     "homepage": "https://registry.terraform.io/providers/kislerdm/neon",
     "owner": "kislerdm",
     "repo": "terraform-provider-neon",
-    "rev": "v0.11.0",
+    "rev": "v0.12.0",
     "spdx": "MPL-2.0",
     "vendorHash": "sha256-7mJ+BX7laBKsr4DX1keMXnGi79CZp8M1jD0COQ1lcmU="
   },
@@ -985,13 +985,13 @@
     "vendorHash": null
   },
   "nutanix_nutanix": {
-    "hash": "sha256-nk5wdbAzgBJ6gyYSXZAiNdjx/XQ6XldAMsjb8yv+y7w=",
+    "hash": "sha256-NhVgZCscSyM6O/d4BYokGz9FQ2fSuN2/kw8iZhzzBQY=",
     "homepage": "https://registry.terraform.io/providers/nutanix/nutanix",
     "owner": "nutanix",
     "repo": "terraform-provider-nutanix",
-    "rev": "v2.3.1",
+    "rev": "v2.3.3",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-ByB1ztK2/1pTFeO34eXVyQSSbe35qqoCeWe6MPZN7vY="
+    "vendorHash": "sha256-CZo/GLUwmq/TxRDQr2h49rqENB24Zt4M7k5t7epXHuE="
   },
   "oboukili_argocd": {
     "hash": "sha256-3a/g1SbgeMWFMNTY/sYrItyE1rRimdNro8nu9wPTf6M=",
@@ -1048,11 +1048,11 @@
     "vendorHash": null
   },
   "oracle_oci": {
-    "hash": "sha256-R+Khf/BCDaFf1ExD3+zUIEoL/egRw0ube83cP3opO/I=",
+    "hash": "sha256-Pp2eOcz1LQv2Ft2oiwW+7dypDO1PuRE0I7Wcr2E/G4w=",
     "homepage": "https://registry.terraform.io/providers/oracle/oci",
     "owner": "oracle",
     "repo": "terraform-provider-oci",
-    "rev": "v7.24.0",
+    "rev": "v7.25.0",
     "spdx": "MPL-2.0",
     "vendorHash": null
   },
@@ -1120,11 +1120,11 @@
     "vendorHash": "sha256-L1wufPa7LPPyOPTL+jFQgiWzJoJYS+fCdw3N0KZqKtc="
   },
   "rancher_rancher2": {
-    "hash": "sha256-E1E7xrQUOGbGV1xNpZFrIql6zgfzr3jmCbIFREbJdwE=",
+    "hash": "sha256-vFsnbB35rL8U/4b/53SeuDXr+3GT/aVphKRB5H1B/Z8=",
     "homepage": "https://registry.terraform.io/providers/rancher/rancher2",
     "owner": "rancher",
     "repo": "terraform-provider-rancher2",
-    "rev": "v8.2.1",
+    "rev": "v8.3.1",
     "spdx": "MPL-2.0",
     "vendorHash": "sha256-M2lJKmIR66lQKFkInjizn68ax2Gq4sim5Y3vZKyDhZ8="
   },
@@ -1147,13 +1147,13 @@
     "vendorHash": null
   },
   "sacloud_sakuracloud": {
-    "hash": "sha256-kiAl/qdLbXzBCwgms3Y7TD/Ez2Hq0ifZ1SLVIPa9Bmk=",
+    "hash": "sha256-BNwGibmt6Ym8fqYtM3pB++Yo33LvOSBL+CY/FmSW/r0=",
     "homepage": "https://registry.terraform.io/providers/sacloud/sakuracloud",
     "owner": "sacloud",
     "repo": "terraform-provider-sakuracloud",
-    "rev": "v2.31.1",
+    "rev": "v2.31.2",
     "spdx": "Apache-2.0",
-    "vendorHash": "sha256-BREv9hd6Oa/S8NjpRoLcF8uUFykEyffQO0LCuA3WFmc="
+    "vendorHash": "sha256-b1ziyrDKVUbTrN31t1IRFcK8EjsDSBP4FfArPkHKlBc="
   },
   "sap_btp": {
     "hash": "sha256-55SNzeOaMyaidEbCjGPNF20qhQgddNHOl2xNqd7OZU4=",
@@ -1489,11 +1489,11 @@
     "vendorHash": "sha256-OoIlSsR8vbS15TfZvPP+RBDjPvD7Jzr2CpgMk76s6R8="
   },
   "wgebis_mailgun": {
-    "hash": "sha256-/AYzQgMWo2cPjEMlrOSZLn4IVq4At09KFXkIpc7L5p0=",
+    "hash": "sha256-W+cvYNwsa5T6ZIPeEVbO9ogdZurwDPOKUwJfPXNKSqg=",
     "homepage": "https://registry.terraform.io/providers/wgebis/mailgun",
     "owner": "wgebis",
     "repo": "terraform-provider-mailgun",
-    "rev": "v0.8.0",
+    "rev": "v0.8.1",
     "spdx": "MPL-2.0",
     "vendorHash": "sha256-Z4DfoG4ApXbPNXZs9YvBWQj1bH7moLNI6P+nKDHt/Jc="
   },

pkgs/applications/science/electronics/librepcb/default.nix

@@ -63,7 +63,6 @@ stdenv.mkDerivation rec {
     maintainers = with maintainers; [
       luz
       thoughtpolice
-      iedame
     ];
     license = licenses.gpl3Plus;
     platforms = platforms.linux;

pkgs/applications/science/math/cemu-ti/cmake-no-deploy.patch

@@ -0,0 +1,13 @@
+diff --git a/CMakeLists.txt b/CMakeLists.txt
+index 68ce1294..5c2924f6 100644
+--- a/CMakeLists.txt
++++ b/CMakeLists.txt
+@@ -350,7 +350,7 @@ message("Binary dir: ${CMAKE_CURRENT_BINARY_DIR}")
+
+ # TODO: linux .desktop/.xml files
+
+-if(COMMAND qt_generate_deploy_app_script)
++if(FALSE)
+     qt_generate_deploy_app_script(
+         TARGET CEmu
+         FILENAME_VARIABLE deploy_script

pkgs/applications/science/math/cemu-ti/default.nix

@@ -26,6 +26,8 @@ stdenv.mkDerivation (finalAttrs: {
     # This is resolved upstream, but I can't apply the patch because the
     # sourceRoot isn't set to the base of the Git repo.
     ./resolve-ambiguous-constexpr.patch
+    # Disable the deploy_script generation. It's broken with Qt 6.10 and not used by this package.
+    ./cmake-no-deploy.patch
   ];
 
   nativeBuildInputs = [

pkgs/applications/science/misc/vite/default.nix

@@ -60,7 +60,7 @@ stdenv.mkDerivation (finalAttrs: {
 
     homepage = "http://vite.gforge.inria.fr/";
     license = lib.licenses.cecill20;
-    maintainers = with lib.maintainers; [ iedame ];
+    maintainers = [ ];
     platforms = lib.platforms.linux;
   };
 })

pkgs/applications/video/mpv/scripts/visualizer.nix

@@ -6,13 +6,13 @@
 }:
 buildLua {
   pname = "visualizer";
-  version = "0-unstable-2025-04-12";
+  version = "0-unstable-2025-11-07";
 
   src = fetchFromGitHub {
     owner = "mfcc64";
     repo = "mpv-scripts";
-    rev = "bf6776f5c3dae8d83ba29b820496af89dc436613";
-    sha256 = "9ApUBXjH4TKPP4P/fUXSNYbJu2AH6HBYt+1K+sHB7yE=";
+    rev = "fd73f95c6b642366adf1df8dd4ff998d89d2e13e";
+    sha256 = "+4QV1f+8YffevXNYETHDl4Rwb5cDx+YBbaDk7MscHEU=";
   };
   passthru.updateScript = unstableGitUpdater { };
 

pkgs/applications/video/obs-studio/default.nix

@@ -7,6 +7,7 @@
   nv-codec-headers-12,
   fetchFromGitHub,
   fetchpatch2,
+  fetchurl,
   addDriverRunpath,
   autoAddDriverRunpath,
   cudaSupport ? config.cudaSupport,
@@ -68,19 +69,33 @@
 let
   inherit (lib) optional optionals;
 
-  cef = cef-binary.overrideAttrs (oldAttrs: {
-    version = "138.0.17";
-    __intentionallyOverridingVersion = true; # `cef-binary` uses the overridden `srcHash` values in its source FOD
-    gitRevision = "ac9b751";
-    chromiumVersion = "138.0.7204.97";
+  selectSystem =
+    attrs:
+    attrs.${stdenv.hostPlatform.system} or (throw "Unsupported system ${stdenv.hostPlatform.system}");
 
-    srcHash =
-      {
-        aarch64-linux = "sha256-kdO7c9oUfv0HK8wTmvYzw9S6EapnSGEQNCGN9D1JSL0=";
-        x86_64-linux = "sha256-3qgIhen6l/kxttyw0z78nmwox62riVhlmFSGPkUot7g=";
-      }
-      .${stdenv.hostPlatform.system} or (throw "unsupported system ${stdenv.hostPlatform.system}");
-  });
+  cef = cef-binary.overrideAttrs (
+    oldAttrs:
+    let
+      version = "6533";
+      revision = "6";
+    in
+    {
+      inherit version;
+
+      src = fetchurl {
+        url = "https://cdn-fastly.obsproject.com/downloads/cef_binary_${version}_linux_${
+          selectSystem {
+            aarch64-linux = "aarch64";
+            x86_64-linux = "x86_64";
+          }
+        }_v${revision}.tar.xz";
+        hash = selectSystem {
+          aarch64-linux = "sha256-ZCUURp6qKaXIh4kQhNLnP33C10Bfffp3JrLbwkswmZk=";
+          x86_64-linux = "sha256-eWMzVRmhnM3FIz9zNMWrAjAm4vPpoMxBcAfAnYZggUY=";
+        };
+      };
+    }
+  );
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "obs-studio";

pkgs/applications/window-managers/wayfire/default.nix

@@ -17,27 +17,37 @@
   libinput,
   libjpeg,
   libxkbcommon,
+  libxml2,
+  vulkan-headers,
   wayland,
   wayland-protocols,
   wayland-scanner,
-  wlroots,
+  wlroots_0_19,
   pango,
-  nlohmann_json,
   xorg,
+  yyjson,
 }:
+let
+  wlroots = wlroots_0_19;
+in
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "wayfire";
-  version = "0.9.0";
+  version = "0.10.0";
 
   src = fetchFromGitHub {
     owner = "WayfireWM";
     repo = "wayfire";
     rev = "v${finalAttrs.version}";
     fetchSubmodules = true;
-    hash = "sha256-xQZ4/UE66IISZQLl702OQXAAr8XmEsA4hJwB7aXua+E=";
+    hash = "sha256-rnrcuikfRPnIfIkmKUIRh8Sm+POwFLzaZZMAlmeBdjY=";
   };
 
+  postPatch = ''
+    substituteInPlace plugins/common/wayfire/plugins/common/cairo-util.hpp \
+      --replace "<drm_fourcc.h>" "<libdrm/drm_fourcc.h>"
+  '';
+
   nativeBuildInputs = [
     meson
     ninja
@@ -53,9 +63,11 @@ stdenv.mkDerivation (finalAttrs: {
     libinput
     libjpeg
     libxkbcommon
+    libxml2
+    vulkan-headers
     wayland-protocols
     xorg.xcbutilwm
-    nlohmann_json
+    yyjson
   ];
 
   propagatedBuildInputs = [
@@ -92,6 +104,7 @@ stdenv.mkDerivation (finalAttrs: {
     description = "3D Wayland compositor";
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [
+      teatwig
       wucke13
       wineee
     ];

pkgs/applications/window-managers/wayfire/focus-request.nix

@@ -1,59 +0,0 @@
-{
-  stdenv,
-  lib,
-  fetchFromGitLab,
-  meson,
-  ninja,
-  pkg-config,
-  wayfire,
-  wf-config,
-  wayland,
-  pango,
-  libinput,
-  libxkbcommon,
-  librsvg,
-  libGL,
-  xcbutilwm,
-}:
-
-stdenv.mkDerivation (finalAttrs: {
-  pname = "focus-request";
-  version = "0.8.0.2";
-
-  src = fetchFromGitLab {
-    owner = "wayfireplugins";
-    repo = "focus-request";
-    rev = "v${finalAttrs.version}";
-    hash = "sha256-kUYvLC28IPrvnMT/wKFRlOVkc2ohF3k0T/Qrm/zVkpE=";
-  };
-
-  nativeBuildInputs = [
-    meson
-    ninja
-    pkg-config
-  ];
-
-  buildInputs = [
-    wayfire
-    wf-config
-    wayland
-    pango
-    libinput
-    libxkbcommon
-    librsvg
-    libGL
-    xcbutilwm
-  ];
-
-  env = {
-    PKG_CONFIG_WAYFIRE_METADATADIR = "${placeholder "out"}/share/wayfire/metadata";
-  };
-
-  meta = {
-    homepage = "https://gitlab.com/wayfireplugins/focus-request";
-    description = "Wayfire plugin provides a mechanism to grant focus to views that make a focus self-request";
-    license = lib.licenses.mit;
-    maintainers = with lib.maintainers; [ wineee ];
-    inherit (wayfire.meta) platforms;
-  };
-})

pkgs/applications/window-managers/wayfire/plugins.nix

@@ -10,15 +10,15 @@ lib.makeScope pkgs.newScope (
     inherit (self) callPackage;
   in
   {
-    focus-request = callPackage ./focus-request.nix { };
     wayfire-plugins-extra = callPackage ./wayfire-plugins-extra.nix { };
-    wayfire-shadows = callPackage ./wayfire-shadows.nix { };
     wcm = callPackage ./wcm.nix { };
     wf-shell = callPackage ./wf-shell.nix { };
-    windecor = callPackage ./windecor.nix { };
-    wwp-switcher = callPackage ./wwp-switcher.nix { };
   }
 )
 // lib.optionalAttrs config.allowAliases {
   firedecor = throw "wayfirePlugins.firedecor has been removed as it is unmaintained and no longer used by mate-wayland-session."; # Added 2025-09-03
+  focus-request = throw "wayfirePlugins.focus-request is now included with wayfirePlugins.wayfire-plugins-extra";
+  wayfire-shadows = throw "wayfirePlugins.wayfire-shadows is now included with wayfirePlugins.wayfire-plugins-extra";
+  windecor = throw "wayfirePlugins.windecor has been removed as it is unmaintained";
+  wwp-switcher = throw "wayfirePlugins.wwp-switcher has been removed as it is unmaintained";
 }

pkgs/applications/window-managers/wayfire/wayfire-plugins-extra.nix

@@ -8,23 +8,30 @@
   wayfire,
   wayland-scanner,
   wf-config,
+  boost,
+  libdrm,
   libevdev,
   libinput,
   libxkbcommon,
-  nlohmann_json,
+  vulkan-headers,
   xcbutilwm,
   gtkmm3,
+  withFiltersPlugin ? true,
+  withFocusRequestPlugin ? true,
+  withPixdecorPlugin ? true,
+  withWayfireShadowsPlugin ? true,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "wayfire-plugins-extra";
-  version = "0.9.0";
+  version = "0.10.0";
 
   src = fetchFromGitHub {
     owner = "WayfireWM";
     repo = "wayfire-plugins-extra";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-TukDomxqfrM45+C7azfO8jVaqk3E5irdphH8U5IYItg=";
+    hash = "sha256-C5dgs81R4XuPjIm7sj1Mtu4IMIRBEYU6izg2olymeVI=";
+    fetchSubmodules = true;
   };
 
   nativeBuildInputs = [
@@ -37,19 +44,21 @@ stdenv.mkDerivation (finalAttrs: {
   buildInputs = [
     wayfire
     wf-config
+    boost
+    libdrm
     libevdev
     libinput
     libxkbcommon
-    nlohmann_json
+    vulkan-headers
     xcbutilwm
     gtkmm3
   ];
 
   mesonFlags = [
-    # plugins in submodule, packaged individually
-    (lib.mesonBool "enable_windecor" false)
-    (lib.mesonBool "enable_wayfire_shadows" false)
-    (lib.mesonBool "enable_focus_request" false)
+    (lib.mesonBool "enable_filters" withFiltersPlugin)
+    (lib.mesonBool "enable_focus_request" withFocusRequestPlugin)
+    (lib.mesonBool "enable_pixdecor" withPixdecorPlugin)
+    (lib.mesonBool "enable_wayfire_shadows" withWayfireShadowsPlugin)
   ];
 
   env = {

pkgs/applications/window-managers/wayfire/wayfire-shadows.nix

@@ -1,54 +0,0 @@
-{
-  stdenv,
-  lib,
-  fetchFromGitHub,
-  unstableGitUpdater,
-  meson,
-  ninja,
-  pkg-config,
-  wayfire,
-  libxkbcommon,
-  libGL,
-  libinput,
-  xcbutilwm,
-}:
-
-stdenv.mkDerivation (finalAttrs: {
-  pname = "wayfire-shadows";
-  version = "0-unstable-2025-03-04";
-
-  src = fetchFromGitHub {
-    owner = "timgott";
-    repo = "wayfire-shadows";
-    rev = "8257a4f04670d8baf29e2d9cee0d78f978f0233f";
-    hash = "sha256-cRayvjbolVxWtr1PbLSjxtIpZogTJaoAMxPOcZ+zBT8=";
-  };
-
-  nativeBuildInputs = [
-    meson
-    ninja
-    pkg-config
-  ];
-
-  buildInputs = [
-    wayfire
-    libxkbcommon
-    libGL
-    libinput
-    xcbutilwm
-  ];
-
-  env = {
-    PKG_CONFIG_WAYFIRE_METADATADIR = "${placeholder "out"}/share/wayfire/metadata";
-  };
-
-  passthru.updateScript = unstableGitUpdater { };
-
-  meta = {
-    homepage = "https://github.com/timgott/wayfire-shadows";
-    description = "Wayfire plugin that adds window shadows";
-    license = lib.licenses.mit;
-    maintainers = with lib.maintainers; [ wineee ];
-    inherit (wayfire.meta) platforms;
-  };
-})

pkgs/applications/window-managers/wayfire/wcm.nix

@@ -19,14 +19,14 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "wcm";
-  version = "0.9.0";
+  version = "0.10.0";
 
   src = fetchFromGitHub {
     owner = "WayfireWM";
     repo = "wcm";
     rev = "v${finalAttrs.version}";
     fetchSubmodules = true;
-    hash = "sha256-oaaEtyu/9XVhFTkmD7WjScMycpKf+M7oPyQatbY23Vo=";
+    hash = "sha256-O4BYwb+GOMZIn3I2B/WMJ5tUZlaegvwBuyNK9l/gxvQ=";
   };
 
   nativeBuildInputs = [
@@ -48,15 +48,12 @@ stdenv.mkDerivation (finalAttrs: {
     libxkbcommon
   ];
 
-  mesonFlags = [
-    "-Denable_wdisplays=false"
-  ];
-
   meta = {
     homepage = "https://github.com/WayfireWM/wcm";
     description = "Wayfire Config Manager";
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [
+      teatwig
       wucke13
       wineee
     ];

pkgs/applications/window-managers/wayfire/wf-config.nix

@@ -14,13 +14,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "wf-config";
-  version = "0.9.0";
+  version = "0.10.0";
 
   src = fetchFromGitHub {
     owner = "WayfireWM";
     repo = "wf-config";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-5HejuluCTsRsnHuaMCTnCPkbFvT/IcLkfNGjnXnZjJ0=";
+    hash = "sha256-WcGt6yl2LpLnAOVtiCyMyWsoMAUMG1MYhvW/m2DDMX4=";
   };
 
   nativeBuildInputs = [
@@ -60,6 +60,7 @@ stdenv.mkDerivation (finalAttrs: {
     description = "Library for managing configuration files, written for Wayfire";
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [
+      teatwig
       wucke13
       wineee
     ];

pkgs/applications/window-managers/wayfire/windecor.nix

@@ -1,58 +0,0 @@
-{
-  stdenv,
-  lib,
-  fetchFromGitLab,
-  meson,
-  ninja,
-  pkg-config,
-  wayfire,
-  eudev,
-  libinput,
-  libxkbcommon,
-  librsvg,
-  libGL,
-  xcbutilwm,
-}:
-
-stdenv.mkDerivation (finalAttrs: {
-  pname = "windecor";
-  version = "0.8.0";
-
-  src = fetchFromGitLab {
-    owner = "wayfireplugins";
-    repo = "windecor";
-    rev = "v${finalAttrs.version}";
-    hash = "sha256-v0kGT+KrtfFJ/hp1Dr8izKVj6UHhuW6udHFjWt1y9TY=";
-  };
-
-  postPatch = ''
-    substituteInPlace meson.build \
-      --replace "wayfire.get_variable( pkgconfig: 'metadatadir' )" "join_paths(get_option('prefix'), 'share/wayfire/metadata')"
-  '';
-
-  nativeBuildInputs = [
-    meson
-    ninja
-    pkg-config
-  ];
-
-  buildInputs = [
-    wayfire
-    eudev
-    libinput
-    libxkbcommon
-    librsvg
-    libGL
-    xcbutilwm
-  ];
-
-  mesonFlags = [ "--sysconfdir=/etc" ];
-
-  meta = {
-    homepage = "https://gitlab.com/wayfireplugins/windecor";
-    description = "Window decoration plugin for wayfire";
-    license = lib.licenses.mit;
-    maintainers = with lib.maintainers; [ wineee ];
-    inherit (wayfire.meta) platforms;
-  };
-})

pkgs/applications/window-managers/wayfire/wwp-switcher.nix

@@ -1,58 +0,0 @@
-{
-  stdenv,
-  lib,
-  fetchFromGitHub,
-  unstableGitUpdater,
-  meson,
-  ninja,
-  pkg-config,
-  wayfire,
-  libxkbcommon,
-  libGL,
-  libinput,
-  gtk3,
-  glibmm,
-  xcbutilwm,
-}:
-
-stdenv.mkDerivation (finalAttrs: {
-  pname = "wwp-switcher";
-  version = "0-unstable-2024-07-23";
-
-  src = fetchFromGitHub {
-    owner = "wb9688";
-    repo = "wwp-switcher";
-    rev = "d0cd97534a2a6355697efecb7bcf8f85f5dc4b5b";
-    hash = "sha256-cU8INUb+JXlSCM7cAOUBU7z7W0IM6pAGN0izGdFYntc=";
-  };
-
-  nativeBuildInputs = [
-    meson
-    ninja
-    pkg-config
-  ];
-
-  buildInputs = [
-    wayfire
-    libxkbcommon
-    libGL
-    libinput
-    gtk3
-    glibmm
-    xcbutilwm
-  ];
-
-  env = {
-    PKG_CONFIG_WAYFIRE_METADATADIR = "${placeholder "out"}/share/wayfire/metadata";
-  };
-
-  passthru.updateScript = unstableGitUpdater { };
-
-  meta = {
-    homepage = "https://github.com/wb9688/wwp-switcher";
-    description = "Plugin to switch active window";
-    license = lib.licenses.mit;
-    maintainers = with lib.maintainers; [ wineee ];
-    inherit (wayfire.meta) platforms;
-  };
-})

pkgs/build-support/node/fetch-npm-deps/default.nix

@@ -242,12 +242,16 @@
         buildPhase = ''
           runHook preBuild
 
-          if [[ ! -e package-lock.json ]]; then
+          if [[ -f npm-shrinkwrap.json ]]; then
+            local -r srcLockfile="npm-shrinkwrap.json"
+          elif [[ -f package-lock.json ]]; then
+            local -r srcLockfile="package-lock.json"
+          else
             echo
-            echo "ERROR: The package-lock.json file does not exist!"
+            echo "ERROR: No lock file!"
             echo
-            echo "package-lock.json is required to make sure that npmDepsHash doesn't change"
-            echo "when packages are updated on npm."
+            echo "package-lock.json or npm-shrinkwrap.json is required to make sure"
+            echo "that npmDepsHash doesn't change when packages are updated on npm."
             echo
             echo "Hint: You can copy a vendored package-lock.json file via postPatch."
             echo
@@ -255,7 +259,7 @@
             exit 1
           fi
 
-          prefetch-npm-deps package-lock.json $out
+          prefetch-npm-deps $srcLockfile $out
 
           runHook postBuild
         '';

pkgs/build-support/trivial-builders/default.nix

@@ -350,12 +350,10 @@ rec {
         ${lib.concatMapStringsSep "\n" (option: "set -o ${option}") bashOptions}
       ''
       + lib.optionalString (runtimeEnv != null) (
-        lib.concatStrings (
-          lib.mapAttrsToList (name: value: ''
-            ${lib.toShellVar name value}
-            export ${name}
-          '') runtimeEnv
-        )
+        lib.concatMapAttrsStringSep "" (name: value: ''
+          ${lib.toShellVar name value}
+          export ${name}
+        '') runtimeEnv
       )
       + lib.optionalString (runtimeInputs != [ ]) ''
 

pkgs/build-support/trivial-builders/test/writeShellApplication.nix

@@ -35,14 +35,15 @@ in
 linkFarm "writeShellApplication-tests" {
   test-meta =
     let
-      script = writeShellApplication {
+      args = {
         name = "test-meta";
         text = "";
         meta.description = "Test for the `writeShellApplication` `meta` argument";
       };
+      script = writeShellApplication args;
     in
-    assert script.meta.mainProgram == "test-meta";
-    assert script.meta.description == "A test for the `writeShellApplication` `meta` argument";
+    assert script.meta.mainProgram == args.name;
+    assert script.meta.description == args.meta.description;
     script;
 
   test-runtime-inputs = checkShellApplication {

pkgs/by-name/_1/_1password-cli/package.nix

@@ -93,7 +93,6 @@ stdenv.mkDerivation {
     maintainers = with lib.maintainers; [
       joelburget
       khaneliman
-      iedame
     ];
     sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
     license = lib.licenses.unfree;

pkgs/by-name/_1/_1password-gui/package.nix

@@ -35,7 +35,6 @@ let
       timstott
       sebtm
       bdd
-      iedame
     ];
     platforms = [
       "x86_64-linux"

pkgs/by-name/ad/adwsteamgtk/package.nix

@@ -46,10 +46,7 @@ python3Packages.buildPythonApplication rec {
     description = "Simple Gtk wrapper for Adwaita-for-Steam";
     homepage = "https://github.com/Foldex/AdwSteamGtk";
     license = lib.licenses.gpl3Plus;
-    maintainers = with lib.maintainers; [
-      reedrw
-      iedame
-    ];
+    maintainers = with lib.maintainers; [ reedrw ];
     mainProgram = "adwaita-steam-gtk";
     platforms = lib.platforms.linux;
   };

pkgs/by-name/al/alure/package.nix

@@ -28,6 +28,6 @@ stdenv.mkDerivation (finalAttrs: {
     homepage = "https://github.com/kcat/alure";
     license = lib.licenses.mit;
     platforms = lib.platforms.linux;
-    maintainers = with lib.maintainers; [ iedame ];
+    maintainers = [ ];
   };
 })

pkgs/by-name/an/ansel/package.nix

@@ -82,13 +82,13 @@ let
 in
 stdenv.mkDerivation {
   pname = "ansel";
-  version = "0-unstable-2025-10-25";
+  version = "0-unstable-2025-11-02";
 
   src = fetchFromGitHub {
     owner = "aurelienpierreeng";
     repo = "ansel";
-    rev = "0b268719d9a83c2296b5ce9fcc02bec9ad0f83f9";
-    hash = "sha256-LEVXZ9VUMAqDG39Kaew+JYedEqdlfxb5RdyG1X8PVpI=";
+    rev = "3b86745c11db83d58b949e7ae4b899826631ee1a";
+    hash = "sha256-aSQE9vT4ZN0VCEbwXK0/W8xwXpIgbiA5dU4FG5eajv8=";
     fetchSubmodules = true;
   };
 

pkgs/by-name/an/ansible-doctor/package.nix

@@ -8,14 +8,14 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "ansible-doctor";
-  version = "7.3.0";
+  version = "8.0.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "thegeeklab";
     repo = "ansible-doctor";
     tag = "v${version}";
-    hash = "sha256-4Mep9JA4I5zCciglK/yn4Jxu0EIjHi7WUWeKlLcVcP8=";
+    hash = "sha256-6elotoKZ4Hjelnw9LEiDONAFqqM5ewMKEorDtzA7LKY=";
   };
 
   build-system = with python3Packages; [

pkgs/by-name/an/anvil-editor/package.nix

@@ -12,29 +12,36 @@
   vulkan-headers,
   libGL,
   xorg,
-  buildPackages,
 }:
 
 buildGoModule (finalAttrs: {
   pname = "anvil-editor";
-  version = "0.6";
+  version = "0.6.3";
 
   # has to update vendorHash of extra package manually
   # nixpkgs-update: no auto update
   src = fetchzip {
     url = "https://anvil-editor.net/releases/anvil-src-v${finalAttrs.version}.tar.gz";
-    hash = "sha256-i0S5V3j6OPpu4z1ljDKP3WYa9L+EKwo/MBNgW2ENYk8=";
+    hash = "sha256-GPzd1oKkf160ya0sxUd72wego0BvwCerZ5SiY2q0EDE=";
   };
 
-  modRoot = "anvil/src/anvil";
+  modRoot = "anvil/editor";
 
-  vendorHash = "sha256-1oFBV7D7JgOt5yYAxVvC4vL4ccFv3JrNngZbo+5pzrk=";
+  vendorHash = "sha256-Q2iVB5pvP2/VXjdSwWVkdqrVUj/nIiC/VHyD5nP9ilE=";
 
   anvilExtras = buildGoModule {
     pname = "anvil-editor-extras";
     inherit (finalAttrs) version src meta;
-    vendorHash = "sha256-4pfk5XuwDbCWFZIF+1l+dy8NfnGNjgHmSg9y6/RnTSo=";
-    modRoot = "anvil-extras";
+    vendorHash = "sha256-q/PunSBe+gWTWyf8rjfikK56rP2PeZqpuiFG9HIVMTk=";
+    modRoot = "anvil/extras";
+    # Include dependency on anvil api
+    postPatch = ''
+      pushd anvil/extras
+      cp -r ${finalAttrs.src}/anvil/api/go/anvil ./_anvil_api
+      echo "replace github.com/jeffwilliams/anvil/api/go/anvil => ./_anvil_api" >> go.mod
+      go mod edit -require=github.com/jeffwilliams/anvil/api/go/anvil@v0.0.0
+      popd
+    '';
   };
 
   nativeBuildInputs = [
@@ -75,15 +82,7 @@ buildGoModule (finalAttrs: {
   ];
 
   postInstall = ''
-    pushd ../../img
-      # cannot add to nativeBuildInputs
-      # will be conflict with icnsutils in desktopToDarwinBundle
-      ${lib.getExe' buildPackages.libicns "icns2png"} -x anvil.icns
-      for width in 32 48 128 256; do
-        square=''${width}x''${width}
-        install -Dm644 anvil_''${square}x32.png $out/share/icons/hicolor/''${square}/apps/anvil.png
-      done
-    popd
+    install -Dm644 misc/icon/anvil-icon.svg $out/share/icons/hicolor/scalable/apps/anvil.svg
     cp ${finalAttrs.anvilExtras}/bin/* $out/bin
   '';
 
@@ -94,9 +93,5 @@ buildGoModule (finalAttrs: {
     mainProgram = "anvil";
     maintainers = with lib.maintainers; [ aleksana ];
     platforms = with lib.platforms; unix ++ windows;
-    # Doesn't build with >buildGo123Module.
-    # Multiple errors like the following:
-    # '> vendor/gioui.org/internal/vk/vulkan.go:1916:9: cannot define new methods on non-local type SurfaceCapabilities'
-    broken = true;
   };
 })

pkgs/by-name/ap/apko/package.nix

@@ -11,13 +11,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "apko";
-  version = "0.30.20";
+  version = "0.30.21";
 
   src = fetchFromGitHub {
     owner = "chainguard-dev";
     repo = "apko";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-ZmvEBWCtJ2GQO8sqjeSYMclMkVxjSiLBdrRf8N9zXiQ=";
+    hash = "sha256-YDEu1fn1EHeMulvno6KeHIr4bAJ5RwPXWomqzGFUfrQ=";
     # populate values that require us to use git. By doing this in postFetch we
     # can delete .git afterwards and maintain better reproducibility of the src.
     leaveDotGit = true;

pkgs/by-name/ap/appcleaner/package.nix

@@ -30,10 +30,7 @@ stdenvNoCC.mkDerivation (finalAttrs: {
     homepage = "https://freemacsoft.net/appcleaner";
     license = lib.licenses.unfree;
     sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
-    maintainers = with lib.maintainers; [
-      emilytrau
-      iedame
-    ];
+    maintainers = with lib.maintainers; [ emilytrau ];
     platforms = lib.platforms.darwin;
   };
 })

pkgs/by-name/ar/aranym/package.nix

@@ -54,7 +54,7 @@ stdenv.mkDerivation (finalAttrs: {
     '';
     license = with lib.licenses; [ gpl2Plus ];
     mainProgram = "aranym";
-    maintainers = with lib.maintainers; [ iedame ];
+    maintainers = [ ];
     platforms = lib.platforms.unix;
     # never successfully built on Hydra for darwin or aarch64 linux
     broken = stdenv.hostPlatform.isDarwin || stdenv.hostPlatform.isAarch64;

pkgs/by-name/ar/arch-install-scripts/package.nix

@@ -19,18 +19,19 @@
     "/usr/bin/vendor_perl"
     "/usr/bin/core_perl"
   ],
+  chrootSetprivPath ? "/usr/bin/setpriv",
 }:
 
 resholve.mkDerivation rec {
   pname = "arch-install-scripts";
-  version = "29";
+  version = "31";
 
   src = fetchFromGitLab {
     domain = "gitlab.archlinux.org";
     owner = "archlinux";
     repo = "arch-install-scripts";
     tag = "v${version}";
-    hash = "sha256-XWcZZ+ET3J4dB6M9CdXESf0iQh+2vYxlxoJ6TZ3vFUk=";
+    hash = "sha256-Oh1nC/gPJDDy8cXiZPbEfpwOuO+RFRcxVCZuTtB2MV8=";
   };
 
   nativeBuildInputs = [
@@ -40,12 +41,16 @@ resholve.mkDerivation rec {
 
   postPatch = ''
     substituteInPlace ./Makefile \
-      --replace "PREFIX = /usr/local" "PREFIX ?= /usr/local"
+      --replace-fail "PREFIX = /usr/local" "PREFIX ?= /usr/local"
+
     substituteInPlace ./pacstrap.in \
-      --replace "cp -a" "cp -LR --no-preserve=mode" \
-      --replace "unshare pacman" "unshare ${pacman}/bin/pacman" \
-      --replace 'gnupg "$newroot/etc/pacman.d/"' 'gnupg "$newroot/etc/pacman.d/" && chmod 700 "$newroot/etc/pacman.d/gnupg"'
+      --replace-fail "cp -a" "cp -LR --no-preserve=mode" \
+      --replace-fail "unshare pacman" "unshare ${pacman}/bin/pacman" \
+      --replace-fail '"$gpg_dir" "$newroot/$gpg_dir"' '"$gpg_dir" "$newroot/$gpg_dir" && chmod 700 "$newroot/etc/pacman.d/gnupg"'
+
     echo "export PATH=${lib.strings.makeSearchPath "" chrootPath}:\$PATH" >> ./common
+    substituteInPlace ./arch-chroot.in \
+      --replace-fail "sd_args+=(setpriv" "sd_args+=(${chrootSetprivPath}"
   '';
 
   installFlags = [ "PREFIX=$(out)" ];
@@ -80,10 +85,17 @@ resholve.mkDerivation rec {
         util-linux
       ];
 
-      execer = [ "cannot:${pacman}/bin/pacman-key" ];
+      execer = [
+        "cannot:${pacman}/bin/pacman-conf"
+        "cannot:${pacman}/bin/pacman-key"
+      ];
 
-      # TODO: no good way to resolve mount/umount in Nix builds for now
-      # see https://github.com/abathur/resholve/issues/29
+      fake.external = [
+        "systemd-escape"
+        "systemd-run"
+      ];
+
+      # Avoid using setuid wrappers
       fix = {
         mount = true;
         umount = true;
@@ -93,6 +105,7 @@ resholve.mkDerivation rec {
         "$setup"
         "$pid_unshare"
         "$mount_unshare"
+        "$sd_args"
         "${pacman}/bin/pacman"
       ];
     };

pkgs/by-name/ar/arduino-ide/package.nix

@@ -32,10 +32,7 @@ appimageTools.wrapType2 {
     changelog = "https://github.com/arduino/arduino-ide/releases/tag/${version}";
     license = lib.licenses.agpl3Only;
     mainProgram = "arduino-ide";
-    maintainers = with lib.maintainers; [
-      clerie
-      iedame
-    ];
+    maintainers = with lib.maintainers; [ clerie ];
     platforms = [ "x86_64-linux" ];
   };
 }

pkgs/by-name/au/autotools-language-server/package.nix

@@ -6,14 +6,14 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "autotools-language-server";
-  version = "0.0.22";
+  version = "0.0.23";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "Freed-Wu";
     repo = "autotools-language-server";
     tag = version;
-    hash = "sha256-PvaEcdvUE8QpxKuW65RL8SgDl/RM/C3HTEK3v+YA73c=";
+    hash = "sha256-cehiqxst3iGpR2UnkpN7wVAxd924n0ZNek3aiwEW+ZA=";
   };
 
   build-system = [

pkgs/by-name/aw/aws-mfa/package.nix

@@ -1,13 +1,11 @@
 {
   lib,
-  buildPythonApplication,
+  python3Packages,
   fetchFromGitHub,
   fetchpatch,
-  setuptools,
-  boto3,
 }:
 
-buildPythonApplication rec {
+python3Packages.buildPythonApplication rec {
   pname = "aws-mfa";
   version = "0.0.12";
   pyproject = true;
@@ -28,11 +26,11 @@ buildPythonApplication rec {
     })
   ];
 
-  build-system = [
+  build-system = with python3Packages; [
     setuptools
   ];
 
-  dependencies = [
+  dependencies = with python3Packages; [
     boto3
   ];
 

pkgs/by-name/aw/aws-vault/package.nix

@@ -9,25 +9,21 @@
 }:
 buildGoModule rec {
   pname = "aws-vault";
-  version = "7.7.5";
+  version = "7.6.5";
 
   src = fetchFromGitHub {
     owner = "ByteNess";
     repo = "aws-vault";
     rev = "v${version}";
-    hash = "sha256-K91GNyvtjDO6UMU9cC+TbUdMWdXrPlKLU8u5cbEMdRA=";
+    hash = "sha256-2Z3gh4F29v04pV5hz4XEn1GZFLjXMBnbBghGKczoCBk=";
   };
 
-  proxyVendor = true;
-  vendorHash = "sha256-3AL3vjKqzjrzgPrLLwIgWpn1hRB6soTMbaRly/fvziA=";
-
+  vendorHash = "sha256-nzeNwiNiDXBO9fwMVlc09Ulj/SPzxV+vrMb70PB5N+8=";
   nativeBuildInputs = [
     installShellFiles
     makeWrapper
   ];
 
-  env.CGO_ENABLED = "0";
-
   postInstall = ''
     # make xdg-open overrideable at runtime
     # aws-vault uses https://github.com/skratchdot/open-golang/blob/master/open/open.go to open links

pkgs/by-name/az/azure-cli/extensions-generated.json

@@ -50,9 +50,9 @@
   },
   "aks-preview": {
     "pname": "aks-preview",
-    "version": "18.0.0b44",
-    "url": "https://azcliprod.blob.core.windows.net/cli-extensions/aks_preview-18.0.0b44-py2.py3-none-any.whl",
-    "hash": "sha256-lpkKTYjIReWC5J+amHDnR/jhOjXwCmV0MkoiX+nmwiE=",
+    "version": "19.0.0b10",
+    "url": "https://azcliprod.blob.core.windows.net/cli-extensions/aks_preview-19.0.0b10-py2.py3-none-any.whl",
+    "hash": "sha256-xteDVuaDzci2reA8MGECuGepCLlcwcWEb8fRCL3r7h8=",
     "description": "Provides a preview for upcoming AKS features"
   },
   "alb": {
@@ -120,9 +120,9 @@
   },
   "authV2": {
     "pname": "authV2",
-    "version": "1.0.0",
-    "url": "https://azcliprod.blob.core.windows.net/cli-extensions/authV2-1.0.0-py3-none-any.whl",
-    "hash": "sha256-wY5B27CGJZK6rL3sPeLvRuZyMS8J+ttHCHI+OZp1NIM=",
+    "version": "1.0.1",
+    "url": "https://azcliprod.blob.core.windows.net/cli-extensions/authV2-1.0.1-py3-none-any.whl",
+    "hash": "sha256-D5/Yy/ybgTFA6DtTVJeRLmBf97YzB3j0Y/TVAUs/toc=",
     "description": "Microsoft Azure Command-Line Tools Authv2 Extension"
   },
   "automanage": {
@@ -141,9 +141,9 @@
   },
   "azure-firewall": {
     "pname": "azure-firewall",
-    "version": "1.5.0",
-    "url": "https://azcliprod.blob.core.windows.net/cli-extensions/azure_firewall-1.5.0-py2.py3-none-any.whl",
-    "hash": "sha256-wE/LgTfxqeHOkkybF8pp7TSLJe+WPqjKiEaYe/C8phs=",
+    "version": "2.0.0",
+    "url": "https://azcliprod.blob.core.windows.net/cli-extensions/azure_firewall-2.0.0-py2.py3-none-any.whl",
+    "hash": "sha256-tIX7vovIVGe9NsBg3N8LbwyVsxgurJKXLUtUYveaZtA=",
     "description": "Manage Azure Firewall resources"
   },
   "azurelargeinstance": {
@@ -232,9 +232,9 @@
   },
   "connectedmachine": {
     "pname": "connectedmachine",
-    "version": "2.0.0b1",
-    "url": "https://azcliprod.blob.core.windows.net/cli-extensions/connectedmachine-2.0.0b1-py3-none-any.whl",
-    "hash": "sha256-TNewwps4rNSx/O+GIhdFMsLJC8Z0pxD2VIlGsujOPVs=",
+    "version": "2.0.0b2",
+    "url": "https://azcliprod.blob.core.windows.net/cli-extensions/connectedmachine-2.0.0b2-py3-none-any.whl",
+    "hash": "sha256-LZfsPWODjBB6i3Z/oAGquxlRCS8NKxkp2W3K4j+n9XQ=",
     "description": "Microsoft Azure Command-Line Tools ConnectedMachine Extension"
   },
   "connectedvmware": {
@@ -268,7 +268,7 @@
   "customlocation": {
     "pname": "customlocation",
     "version": "0.1.4",
-    "url": "https://arcplatformcliextprod.z13.web.core.windows.net/customlocation-0.1.4-py2.py3-none-any.whl",
+    "url": "https://azcliprod.blob.core.windows.net/cli-extensions/customlocation-0.1.4-py2.py3-none-any.whl",
     "hash": "sha256-4Ou6/8XRwH5c1hXZy54hJE7fxEeyjLAYcTmhGNyIkrc=",
     "description": "Microsoft Azure Command-Line Tools Customlocation Extension"
   },
@@ -338,7 +338,7 @@
   "deploy-to-azure": {
     "pname": "deploy-to-azure",
     "version": "0.2.0",
-    "url": "https://github.com/Azure/deploy-to-azure-cli-extension/releases/download/20200318.1/deploy_to_azure-0.2.0-py2.py3-none-any.whl",
+    "url": "https://azcliprod.blob.core.windows.net/cli-extensions/deploy_to_azure-0.2.0-py2.py3-none-any.whl",
     "hash": "sha256-+SUIDuerw673M9TGMTFwve2qlWmvG5VCc4O8PFnkzrg=",
     "description": "Deploy to Azure using Github Actions"
   },
@@ -421,9 +421,9 @@
   },
   "elastic": {
     "pname": "elastic",
-    "version": "1.0.0b4",
-    "url": "https://azcliprod.blob.core.windows.net/cli-extensions/elastic-1.0.0b4-py3-none-any.whl",
-    "hash": "sha256-+zjE4PUe1FvB7z1i4FFP3EyWBDco/dZe9DbBDMogijY=",
+    "version": "1.0.0b5",
+    "url": "https://azcliprod.blob.core.windows.net/cli-extensions/elastic-1.0.0b5-py3-none-any.whl",
+    "hash": "sha256-P8N5gq5tmaw3IVJc3616x9gfGKC1F8hzu/Whck4v4XU=",
     "description": "Microsoft Azure Command-Line Tools MicrosoftElastic Extension"
   },
   "elastic-san": {
@@ -456,9 +456,9 @@
   },
   "fleet": {
     "pname": "fleet",
-    "version": "1.8.0",
-    "url": "https://azcliprod.blob.core.windows.net/cli-extensions/fleet-1.8.0-py3-none-any.whl",
-    "hash": "sha256-3JX3KQ4eSr3CQ5UkvssOcCHaAeIFsm0/xWd5JYaL0G4=",
+    "version": "1.8.1",
+    "url": "https://azcliprod.blob.core.windows.net/cli-extensions/fleet-1.8.1-py3-none-any.whl",
+    "hash": "sha256-842zQA4Jk0dp8jMCro5lut4Ro5u7ny1sp095uqXyR9k=",
     "description": "Microsoft Azure Command-Line Tools Fleet Extension"
   },
   "fluid-relay": {
@@ -485,7 +485,7 @@
   "fzf": {
     "pname": "fzf",
     "version": "1.0.2",
-    "url": "https://pahealyfzf.blob.core.windows.net/fzf/fzf-1.0.2-py2.py3-none-any.whl",
+    "url": "https://azcliprod.blob.core.windows.net/cli-extensions/fzf-1.0.2-py2.py3-none-any.whl",
     "hash": "sha256-hKvu0DtLv6e4wL4I2TZv8wQOIWDfT1pTnw4cngocNZw=",
     "description": "Microsoft Azure Command-Line Tools fzf Extension"
   },
@@ -652,10 +652,10 @@
   },
   "managednetworkfabric": {
     "pname": "managednetworkfabric",
-    "version": "8.2.1",
-    "url": "https://azcliprod.blob.core.windows.net/cli-extensions/managednetworkfabric-8.2.1-py3-none-any.whl",
-    "hash": "sha256-lVW++ZSooBiMtWpiFpxpaBygDBckM7OZPYZNZko7/Cs=",
-    "description": "Support for managednetworkfabric commands based on 2024-06-15-preview API version"
+    "version": "9.0.0",
+    "url": "https://azcliprod.blob.core.windows.net/cli-extensions/managednetworkfabric-9.0.0-py3-none-any.whl",
+    "hash": "sha256-0rHpjofa54BNAfgzIoapCZKxgVgQJhOyLQxB8LhxkgQ=",
+    "description": "Support for managednetworkfabric commands based on 2025-07-15 API version"
   },
   "managementpartner": {
     "pname": "managementpartner",
@@ -685,6 +685,13 @@
     "hash": "sha256-i6RQpaPar6i5trbp7oIk9Gj9lyMy6QUADyrMf/AM2bs=",
     "description": "Microsoft Azure Command-Line Tools Microsoft Fabric Extension"
   },
+  "migrate": {
+    "pname": "migrate",
+    "version": "2.0.1b1",
+    "url": "https://azcliprod.blob.core.windows.net/cli-extensions/migrate-2.0.1b1-py3-none-any.whl",
+    "hash": "sha256-vRMg/oeqSFXwZaB6J6RO51U6kjWdE4O7EWc/i4LxOmU=",
+    "description": "Support for Azure Migrate preview"
+  },
   "mixed-reality": {
     "pname": "mixed-reality",
     "version": "1.0.0b1",
@@ -806,9 +813,9 @@
   },
   "palo-alto-networks": {
     "pname": "palo-alto-networks",
-    "version": "1.1.2b2",
-    "url": "https://azcliprod.blob.core.windows.net/cli-extensions/palo_alto_networks-1.1.2b2-py3-none-any.whl",
-    "hash": "sha256-xOjYa4QakDrL4Xud0OHvJuY7Df2l2B1mnqw8aMlqiAg=",
+    "version": "1.1.2",
+    "url": "https://azcliprod.blob.core.windows.net/cli-extensions/palo_alto_networks-1.1.2-py3-none-any.whl",
+    "hash": "sha256-ZxLr6FrIbm4SroHRSxSgG5R4boKdlJ1EQ1rC3ralq70=",
     "description": "Microsoft Azure Command-Line Tools PaloAltoNetworks Extension"
   },
   "peering": {
@@ -855,9 +862,9 @@
   },
   "quantum": {
     "pname": "quantum",
-    "version": "1.0.0b9",
-    "url": "https://azcliprod.blob.core.windows.net/cli-extensions/quantum-1.0.0b9-py3-none-any.whl",
-    "hash": "sha256-DYnSYOsA+nZJ9V2JIqIHB/697a9ATJLBneyrPsHGoVY=",
+    "version": "1.0.0b10",
+    "url": "https://azcliprod.blob.core.windows.net/cli-extensions/quantum-1.0.0b10-py3-none-any.whl",
+    "hash": "sha256-ihvof5C7EOMq65Ljbv2ax9Lri67AY0kSBb687dUGAv0=",
     "description": "Microsoft Azure Command-Line Tools Quantum Extension"
   },
   "qumulo": {
@@ -876,9 +883,9 @@
   },
   "redisenterprise": {
     "pname": "redisenterprise",
-    "version": "1.2.3",
-    "url": "https://azcliprod.blob.core.windows.net/cli-extensions/redisenterprise-1.2.3-py3-none-any.whl",
-    "hash": "sha256-HTioMOjcy0gBdlrP5Ffd9Pf0SByAiRzkBM9zdPBM/Pw=",
+    "version": "1.3.0",
+    "url": "https://azcliprod.blob.core.windows.net/cli-extensions/redisenterprise-1.3.0-py3-none-any.whl",
+    "hash": "sha256-53kvBZJxKFcjFnGu6VzALidEx2MexVaoZDLW/4tsckY=",
     "description": "Microsoft Azure Command-Line Tools RedisEnterprise Extension"
   },
   "reservation": {
@@ -968,7 +975,7 @@
   "stack-hci-vm": {
     "pname": "stack-hci-vm",
     "version": "1.10.4",
-    "url": "https://hciarcvmsstorage.z13.web.core.windows.net/cli-extensions/stack_hci_vm-1.10.4-py3-none-any.whl",
+    "url": "https://azcliprod.blob.core.windows.net/cli-extensions/stack_hci_vm-1.10.4-py3-none-any.whl",
     "hash": "sha256-MjcpQ7a+5Rw6Z7MAVzoa/qT6HSX6uaV+kWoiMBhK/JM=",
     "description": "Microsoft Azure Command-Line Tools Stack-HCi-VM Extension"
   },
@@ -1114,9 +1121,9 @@
   },
   "workload-orchestration": {
     "pname": "workload-orchestration",
-    "version": "4.0.0",
-    "url": "https://azcliprod.blob.core.windows.net/cli-extensions/workload_orchestration-4.0.0-py3-none-any.whl",
-    "hash": "sha256-FiAi5pfW67mYqtQJcUlMLwArKQroXD0GoSX82WZH0RQ=",
+    "version": "4.1.0",
+    "url": "https://azcliprod.blob.core.windows.net/cli-extensions/workload_orchestration-4.1.0-py3-none-any.whl",
+    "hash": "sha256-9+pQFtpZzIEk4971hNJuB6gxu7WtRtDO69zt6jgq60A=",
     "description": "Microsoft Azure Command-Line Tools WorkloadOperations Extension"
   },
   "workloads": {

pkgs/by-name/az/azure-cli/package.nix

@@ -26,14 +26,14 @@
 }:
 
 let
-  version = "2.78.0";
+  version = "2.79.0";
 
   src = fetchFromGitHub {
     name = "azure-cli-${version}-src";
     owner = "Azure";
     repo = "azure-cli";
     tag = "azure-cli-${version}";
-    hash = "sha256-kSZ9nFKEXDQtExSuGxyym5xHKVDnOB4QmDG3AZjGGEI=";
+    hash = "sha256-VvCtHNMdfW/fFZlbu/7EHlSa6GtFZ0B9pdqQFjHdmXg=";
   };
 
   # put packages that needs to be overridden in the py package scope