Merge master into staging-nixos

doc/stdenv/platform-notes.chapter.md

@@ -117,10 +117,11 @@ The following is a list of Xcode versions, the SDK version in Nixpkgs, and the a
 Check your package’s documentation (platform support or installation instructions) to find which Xcode or SDK version to use.
 Generally, only the last SDK release for a major version is packaged.
 
-| Xcode version      | SDK version        | Nixpkgs attribute             |
-|--------------------|--------------------|-------------------------------|
-| 15.0–15.4          | 14.4               | `apple-sdk_14` / `apple-sdk`  |
-| 16.0               | 15.0               | `apple-sdk_15`                |
+| Xcode version | SDK version | Nixpkgs attribute            |
+|---------------|-------------|------------------------------|
+| 15.0–15.4     | 14.4        | `apple-sdk_14` / `apple-sdk` |
+| 16.0          | 15.0        | `apple-sdk_15`               |
+| 26.0+         | 26.0+       | `apple-sdk_26`, etc          |
 
 
 #### Darwin Default SDK versions {#sec-darwin-troubleshooting-darwin-defaults}
@@ -129,7 +130,7 @@ The current default version of the SDK and deployment target (minimum supported
 Because of the ways that minimum version and SDK can be changed that are not visible to Nix, they should be treated as lower bounds.
 If you need to parameterize over a specific version, create a function that takes the version as a parameter instead of relying on these attributes.
 
-On macOS, the `darwinMinVersion` and `darwinSdkVersion` are always the same, and are currently set to 11.3.
+On macOS, the `darwinMinVersion` is 14.0, and the `darwinSdkVersion` is 14.4.
 
 
 #### `xcrun` cannot find a binary {#sec-darwin-troubleshooting-xcrun}

maintainers/maintainer-list.nix

@@ -29308,6 +29308,12 @@
     github = "Zhaith-Izaliel";
     githubId = 39216756;
   };
+  zhangxy = {
+    email = "zhangxy_2023@163.com";
+    github = "zhangxy-2023";
+    githubId = 246511921;
+    name = "Xinyao Zhang";
+  };
   zhaofengli = {
     email = "hello@zhaofeng.li";
     matrix = "@zhaofeng:zhaofeng.li";

nixos/modules/services/web-apps/onlyoffice.nix

@@ -30,6 +30,10 @@ in
         ```
         set $secure_link_secret "changeme";
         ```
+
+        This file must be readable both by nginx and by the onlyoffice
+        documentserver. Since nginx is added to the onlyoffice group,
+        you may want to make the file readable to the onlyoffice group.
       '';
     };
 

pkgs/applications/emulators/libretro/cores/vba-m.nix

@@ -5,13 +5,13 @@
 }:
 mkLibretroCore {
   core = "vbam";
-  version = "0-unstable-2025-11-05";
+  version = "0-unstable-2025-11-25";
 
   src = fetchFromGitHub {
     owner = "libretro";
     repo = "vbam-libretro";
-    rev = "d0787aee43d260675da203c2f85ba9fa226c0c66";
-    hash = "sha256-WhsiKsDk7jEIklrOw1YFCcWSlAmLK4vCCji3Mnsgwmw=";
+    rev = "c3db5dc221a3038ee54572047304963cbca15cd6";
+    hash = "sha256-e+elKAcQXTVH2VtW0J4FG2p6bJTWSuxrIrnMHwjaO9I=";
   };
 
   makefile = "Makefile";

pkgs/applications/networking/cluster/terraform-providers/providers.json

@@ -832,13 +832,13 @@
     "vendorHash": "sha256-Y1L1nIOubhBN5vNIXY7miQgR9OzoTCS7QA55DEMwDSA="
   },
   "linode_linode": {
-    "hash": "sha256-t6vHW9t3MWsPsGUh44OXvYTfHa03qiH3lveKK0dit9Q=",
+    "hash": "sha256-AxG8N/kEu2+Yym63Ac04SxjrUyCiSp/zmIXQqscpeWM=",
     "homepage": "https://registry.terraform.io/providers/linode/linode",
     "owner": "linode",
     "repo": "terraform-provider-linode",
-    "rev": "v3.5.1",
+    "rev": "v3.6.0",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-8LbFq29JvQX3Trn81fr3YMjFwW+OTWAyK6OVAkh0I3A="
+    "vendorHash": "sha256-2zdUEV84CQ236ktTfMcucAb2gwDPIQ+Br5AfKncZdJA="
   },
   "loafoe_htpasswd": {
     "hash": "sha256-ALTyTTVyS2HHenmk8HVwtQenCmJX05kyXifJTzzmnHE=",

pkgs/applications/networking/instant-messengers/telegram/kotatogram-desktop/default.nix

@@ -41,6 +41,8 @@ let
     ];
 
     nativeBuildInputs = oldAttrs.nativeBuildInputs ++ [ yasm ];
+
+    env.NIX_CFLAGS_COMPILE = lib.optionalString stdenv.cc.isClang "-Wno-c++11-narrowing";
   });
 in
 telegram-desktop.override {
@@ -69,12 +71,18 @@ telegram-desktop.override {
       })
     ];
 
-    buildInputs = (old.buildInputs or [ ]) ++ [
-      alsa-lib
-      jemalloc
-      libopus
-      libpulseaudio
-    ];
+    buildInputs =
+      (old.buildInputs or [ ])
+      ++ [
+        libopus
+      ]
+      ++ lib.optionals stdenv.hostPlatform.isLinux [
+        alsa-lib
+        jemalloc
+        libpulseaudio
+      ];
+
+    env.NIX_CFLAGS_COMPILE = lib.optionalString stdenv.cc.isClang "-Wno-missing-template-arg-list-after-template-kw";
 
     meta = {
       description = "Kotatogram – experimental Telegram Desktop fork";

pkgs/by-name/_6/_64gram/package.nix

@@ -2,10 +2,6 @@
   lib,
   fetchFromGitHub,
   telegram-desktop,
-  alsa-lib,
-  jemalloc,
-  libopus,
-  libpulseaudio,
   withWebkit ? true,
 }:
 
@@ -24,17 +20,6 @@ telegram-desktop.override {
       fetchSubmodules = true;
     };
 
-    buildInputs = (old.buildInputs or [ ]) ++ [
-      alsa-lib
-      jemalloc
-      libopus
-      libpulseaudio
-    ];
-
-    cmakeFlags = (old.cmakeFlags or [ ]) ++ [
-      (lib.cmakeBool "DESKTOP_APP_DISABLE_AUTOUPDATE" true)
-    ];
-
     meta = {
       description = "Unofficial Telegram Desktop providing Windows 64bit build and extra features";
       license = lib.licenses.gpl3Only;

pkgs/by-name/bl/blackmagic-desktop-video/package.nix

@@ -14,7 +14,7 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "blackmagic-desktop-video";
-  version = "15.2";
+  version = "15.3";
 
   buildInputs = [
     autoPatchelfHook
@@ -30,7 +30,7 @@ stdenv.mkDerivation (finalAttrs: {
       {
         outputHashMode = "recursive";
         outputHashAlgo = "sha256";
-        outputHash = "sha256-OCpzKmwa4HbKTGSeVxBlYXB6TNe5uqLhtowLwAQjIJQ=";
+        outputHash = "sha256-QcM/FTEYkG1Zteb2TNysQjP/mNS1B2Wa8rqkJ70m24s=";
 
         impureEnvVars = lib.fetchers.proxyImpureEnvVars;
 

pkgs/by-name/bo/boringssl/package.nix

@@ -11,12 +11,12 @@
 # reference: https://boringssl.googlesource.com/boringssl/+/refs/tags/0.20250818.0/BUILDING.md
 stdenv.mkDerivation (finalAttrs: {
   pname = "boringssl";
-  version = "0.20251110.0";
+  version = "0.20251124.0";
 
   src = fetchgit {
     url = "https://boringssl.googlesource.com/boringssl";
     tag = finalAttrs.version;
-    hash = "sha256-ATrenftYVxaFnQwd+Ed4tnW8J5Pkfu9e+ORpaBU7ZIc=";
+    hash = "sha256-xRuerQhS2uk9eFNaSkl8krcepVwUDmAxc9nhLCI1w98=";
   };
 
   patches = [

pkgs/by-name/ca/cargo-tally/package.nix

@@ -6,14 +6,14 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "cargo-tally";
-  version = "1.0.70";
+  version = "1.0.71";
 
   src = fetchCrate {
     inherit pname version;
-    hash = "sha256-9KOrnHWro3ZDFl9jl2lZl9/fDUbbMfzGftsV+1HXNfQ=";
+    hash = "sha256-jJj4aXhGMU5L7Yya65wi022M6lE/nHiyjozptSJcMGg=";
   };
 
-  cargoHash = "sha256-7E9KO16LdIIULzxvPMZPPKlOunktYQkVbdnCZmxwlSw=";
+  cargoHash = "sha256-GC4rYaNwTLfbSAojnhZb0vi6FmNiXL6YJ5TEVtQom6M=";
 
   meta = {
     description = "Graph the number of crates that depend on your crate over time";

pkgs/by-name/ca/casacore/package.nix

@@ -0,0 +1,65 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  cmake,
+  gfortran,
+  flex,
+  bison,
+  blas,
+  lapack,
+  cfitsio,
+  wcslib,
+  fftw,
+  fftwFloat,
+  readline,
+  gsl,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "casacore";
+  version = "3.7.1";
+
+  src = fetchFromGitHub {
+    owner = "casacore";
+    repo = "casacore";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-6zgTSGNKp2hHsh3GFl+o6ElavSNYnQvLsfb1xUrgNZI=";
+  };
+
+  nativeBuildInputs = [
+    cmake
+    gfortran
+    flex
+    bison
+  ];
+
+  buildInputs = [
+    blas
+    lapack
+    cfitsio
+    wcslib
+    fftw
+    fftwFloat
+    readline
+    gsl
+  ];
+
+  enableParallelBuilding = true;
+
+  strictDeps = true;
+
+  cmakeFlags = [
+    (lib.cmakeBool "ENABLE_SHARED" (!stdenv.hostPlatform.isStatic))
+    (lib.cmakeBool "BUILD_PYTHON3" false) # TODO: If/when we package python-casacore, this will change
+  ];
+
+  meta = {
+    homepage = "https://casacore.github.io/casacore/";
+    changelog = "https://github.com/casacore/casacore/blob/master/CHANGES.md";
+    description = "Suite of C++ libraries for radio astronomy data processing";
+    maintainers = with lib.maintainers; [ kiranshila ];
+    license = lib.licenses.lgpl2Only;
+    platforms = lib.platforms.all;
+  };
+})

pkgs/by-name/cr/crun/package.nix

@@ -40,13 +40,13 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "crun";
-  version = "1.24";
+  version = "1.25.1";
 
   src = fetchFromGitHub {
     owner = "containers";
     repo = "crun";
     rev = version;
-    hash = "sha256-Sdp6ZxUzK8T7zfrgevrLxhMh7SQfO+6mABBiFMLbgh0=";
+    hash = "sha256-WBAwyDODMrUDlgonRbxaNQ+aN8K6YicY2JVArXDJem8=";
     fetchSubmodules = true;
   };
 

pkgs/by-name/di/dippi/package.nix

@@ -16,13 +16,13 @@
 
 stdenv.mkDerivation rec {
   pname = "dippi";
-  version = "4.1.0";
+  version = "4.2.0";
 
   src = fetchFromGitHub {
     owner = "cassidyjames";
     repo = "dippi";
     rev = version;
-    hash = "sha256-BYI3WqMDxzERlqtq7ISQ+U1FTrpKh5OJBMo/AsdmdlQ=";
+    hash = "sha256-iA7ymByLVrkOatW4Y79pGV7GhlS8G2gHY6PHpOfMq8g=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/do/dokieli/package.nix

@@ -16,13 +16,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "dokieli";
-  version = "0-unstable-2025-11-20";
+  version = "0-unstable-2025-11-27";
 
   src = fetchFromGitHub {
     owner = "dokieli";
     repo = "dokieli";
-    rev = "dced39925955631fd320b763cfe2f0895e5ea5bd";
-    hash = "sha256-A7T4cGoRB4L1PgK+BcpR+l2AraOrKLzc8Et6XN+0q1g=";
+    rev = "25c20daf88a7d7e8d816a7deed4e2fe134bdb97d";
+    hash = "sha256-GiMBCUT9wd/6bZ1hXt9431Ax1Z7BLHOXfWiiPxKZsCs=";
   };
 
   missingHashes = ./missing-hashes.json;

pkgs/by-name/dp/dprint/plugins/dprint-plugin-typescript.nix

@@ -1,7 +1,7 @@
 { mkDprintPlugin }:
 mkDprintPlugin {
   description = "TypeScript/JavaScript code formatter";
-  hash = "sha256-gBYx23MC6Biz8FIIZLBW3d7SOxtpmCml4N6554Wh0Pc=";
+  hash = "sha256-01MkexYMHoHrBDkw3m+UCtzT1xNlEiHToChNTDDqQ8Q=";
   initConfig = {
     configExcludes = [ "**/node_modules" ];
     configKey = "typescript";
@@ -16,6 +16,6 @@ mkDprintPlugin {
   };
   pname = "dprint-plugin-typescript";
   updateUrl = "https://plugins.dprint.dev/dprint/typescript/latest.json";
-  url = "https://plugins.dprint.dev/typescript-0.95.12.wasm";
-  version = "0.95.12";
+  url = "https://plugins.dprint.dev/typescript-0.95.13.wasm";
+  version = "0.95.13";
 }

pkgs/by-name/fw/fwupd/0001-Install-fwupdplugin-to-out.patch

@@ -1,14 +1,17 @@
-commit 3ffe2d7842b62986e2267e6542068e6356b06fdf
-Author: r-vdp <ramses@well-founded.dev>
-Date:   Mon Oct 28 12:07:51 2024 +0100
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: r-vdp <ramses@well-founded.dev>
+Date: Mon, 28 Oct 2024 12:07:51 +0100
+Subject: [PATCH] Install fwupdplugin to out
 
-    Install fwupdplugin to out
+---
+ meson.build | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
 
 diff --git a/meson.build b/meson.build
-index 3a163331e..cb66be0cc 100644
+index b711ab04b..7b065f278 100644
 --- a/meson.build
 +++ b/meson.build
-@@ -733,7 +733,7 @@ if build_standalone
+@@ -734,7 +734,7 @@ if build_standalone
    if host_machine.system() == 'windows'
      libdir_pkg = bindir
    else

pkgs/by-name/fw/fwupd/0002-Add-output-for-installed-tests.patch

@@ -1,14 +1,20 @@
-commit 954e41500e1b409a24fca43ae3bdc1c6a890db48
-Author: r-vdp <ramses@well-founded.dev>
-Date:   Tue Oct 15 14:49:53 2024 +0200
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: r-vdp <ramses@well-founded.dev>
+Date: Tue, 15 Oct 2024 14:49:53 +0200
+Subject: [PATCH] Add output for installed tests
 
-    Add output for installed tests
+---
+ data/tests/meson.build             | 2 +-
+ meson.build                        | 5 +++--
+ meson_options.txt                  | 5 +++++
+ src/tests/host-emulate/meson.build | 2 +-
+ 4 files changed, 10 insertions(+), 4 deletions(-)
 
 diff --git a/data/tests/meson.build b/data/tests/meson.build
-index 3eba65eea..cf3931bb7 100644
+index e15cab2fa..bad033dbf 100644
 --- a/data/tests/meson.build
 +++ b/data/tests/meson.build
-@@ -122,7 +122,7 @@ configure_file(
+@@ -139,7 +139,7 @@ configure_file(
    configuration: con2,
    install: true,
    install_tag: 'tests',
@@ -18,7 +24,7 @@ index 3eba65eea..cf3931bb7 100644
  
  if umockdev_integration_tests.allowed()
 diff --git a/meson.build b/meson.build
-index cb66be0cc..ca431980b 100644
+index 7b065f278..1a4b0ea1f 100644
 --- a/meson.build
 +++ b/meson.build
 @@ -239,8 +239,8 @@ else
@@ -32,7 +38,7 @@ index cb66be0cc..ca431980b 100644
    daemon_dir = join_paths(libexecdir, 'fwupd')
  endif
  mandir = join_paths(prefix, get_option('mandir'))
-@@ -721,6 +721,7 @@ gnome = import('gnome')
+@@ -722,6 +722,7 @@ gnome = import('gnome')
  i18n = import('i18n')
  
  conf.set_quoted('FWUPD_PREFIX', prefix)
@@ -41,20 +47,21 @@ index cb66be0cc..ca431980b 100644
  conf.set_quoted('FWUPD_LIBDIR', libdir)
  conf.set_quoted('FWUPD_LIBEXECDIR', libexecdir)
 diff --git a/meson_options.txt b/meson_options.txt
-index 40103c03e..63c8d288d 100644
+index 18991b983..937578f19 100644
 --- a/meson_options.txt
 +++ b/meson_options.txt
-@@ -174,6 +174,10 @@ option('systemd_unit_user',
+@@ -197,6 +197,11 @@ option(
    value: 'fwupd-refresh',
    description: 'User account to use for fwupd-refresh.service (empty for DynamicUser)',
  )
-+option('installed_test_prefix',
++option(
++  'installed_test_prefix',
 +  type: 'string',
-+  description: 'Prefix for installed tests'
++  description: 'Prefix for installed tests',
 +)
- option('tests',
+ option(
+   'tests',
    type: 'boolean',
-   value: true,
 diff --git a/src/tests/host-emulate/meson.build b/src/tests/host-emulate/meson.build
 index c36da65cd..f0b70d4d6 100644
 --- a/src/tests/host-emulate/meson.build

pkgs/by-name/fw/fwupd/0003-Add-option-for-installation-sysconfdir.patch

@@ -1,8 +1,18 @@
-commit 56507892ff7a03ed283d7fd2d7ff2000fc9c17d7
-Author: r-vdp <ramses@well-founded.dev>
-Date:   Tue Oct 15 11:46:38 2024 +0200
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: r-vdp <ramses@well-founded.dev>
+Date: Tue, 15 Oct 2024 11:46:38 +0200
+Subject: [PATCH] Add option for installation sysconfdir
 
-    Add option for installation sysconfdir
+---
+ data/bios-settings.d/meson.build |  2 +-
+ data/meson.build                 |  2 +-
+ data/pki/meson.build             |  8 ++++----
+ data/remotes.d/meson.build       |  8 ++++----
+ docs/meson.build                 | 16 ++++++++--------
+ meson.build                      |  6 ++++++
+ meson_options.txt                |  6 ++++++
+ plugins/uefi-capsule/meson.build |  4 ++--
+ 8 files changed, 32 insertions(+), 20 deletions(-)
 
 diff --git a/data/bios-settings.d/meson.build b/data/bios-settings.d/meson.build
 index 2a2a07016..99df55afb 100644
@@ -30,7 +40,7 @@ index 5716669f0..78e754f40 100644
    )
    plugin_quirks += files('cfi.quirk', 'ds20.quirk', 'power.quirk', 'vendors.quirk')
 diff --git a/data/pki/meson.build b/data/pki/meson.build
-index 5b962adf1..b6575f7e4 100644
+index 1072051c0..6ef9c9111 100644
 --- a/data/pki/meson.build
 +++ b/data/pki/meson.build
 @@ -12,12 +12,12 @@ if supported_gpg
@@ -50,13 +60,13 @@ index 5b962adf1..b6575f7e4 100644
  
 @@ -25,11 +25,11 @@ if supported_pkcs7
    install_data(
-     ['LVFS-CA.pem'],
+     ['LVFS-CA.pem', 'LVFS-CA-2025PQ.pem'],
      install_tag: 'runtime',
 -    install_dir: join_paths(sysconfdir, 'pki', 'fwupd'),
 +    install_dir: join_paths(sysconfdir_install, 'pki', 'fwupd'),
    )
    install_data(
-     ['LVFS-CA.pem'],
+     ['LVFS-CA.pem', 'LVFS-CA-2025PQ.pem'],
      install_tag: 'runtime',
 -    install_dir: join_paths(sysconfdir, 'pki', 'fwupd-metadata'),
 +    install_dir: join_paths(sysconfdir_install, 'pki', 'fwupd-metadata'),
@@ -166,7 +176,7 @@ index 787b4387c..b3144757f 100644
    )
  endif
 diff --git a/meson.build b/meson.build
-index ca431980b..d9bab5264 100644
+index 1a4b0ea1f..16c7cad40 100644
 --- a/meson.build
 +++ b/meson.build
 @@ -246,6 +246,12 @@ endif
@@ -183,21 +193,22 @@ index ca431980b..d9bab5264 100644
  gio = dependency(
    'gio-2.0',
 diff --git a/meson_options.txt b/meson_options.txt
-index 63c8d288d..04f6651e6 100644
+index 937578f19..08b26b3ad 100644
 --- a/meson_options.txt
 +++ b/meson_options.txt
-@@ -7,6 +7,11 @@ option('bluez',
+@@ -14,6 +14,12 @@ option(
    type: 'feature',
    description: 'BlueZ support',
  )
-+option('sysconfdir_install',
++option(
++  'sysconfdir_install',
 +  type: 'string',
 +  value: '',
-+  description: 'sysconfdir to use during installation'
++  description: 'sysconfdir to use during installation',
 +)
- option('build',
+ option(
+   'build',
    type: 'combo',
-   choices: [
 diff --git a/plugins/uefi-capsule/meson.build b/plugins/uefi-capsule/meson.build
 index 647ace53e..4ee0192df 100644
 --- a/plugins/uefi-capsule/meson.build

pkgs/by-name/fw/fwupd/0004-Get-the-efi-app-from-fwupd-efi.patch

@@ -1,14 +1,17 @@
-commit f60f2bf6dd4961bdda742f590bf2d7871db6cdab
-Author: r-vdp <ramses@well-founded.dev>
-Date:   Mon Oct 28 12:08:49 2024 +0100
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: r-vdp <ramses@well-founded.dev>
+Date: Mon, 28 Oct 2024 12:08:49 +0100
+Subject: [PATCH] Get the efi app from fwupd-efi
 
-    Get the efi app from fwupd-efi
+---
+ meson.build | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
 
 diff --git a/meson.build b/meson.build
-index d9bab5264..ee91d34b0 100644
+index 16c7cad40..81804bf3b 100644
 --- a/meson.build
 +++ b/meson.build
-@@ -650,7 +650,7 @@ endif
+@@ -657,7 +657,7 @@ endif
  
  # EFI
  if build_standalone

pkgs/by-name/fw/fwupd/package.nix

@@ -3,6 +3,7 @@
 {
   lib,
   stdenv,
+  fetchpatch,
 
   # runPythonCommand
   runCommand,
@@ -134,7 +135,7 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "fwupd";
-  version = "2.0.16";
+  version = "2.0.17";
 
   # libfwupd goes to lib
   # daemon, plug-ins and libfwupdplugin go to out
@@ -152,27 +153,33 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "fwupd";
     repo = "fwupd";
     tag = finalAttrs.version;
-    hash = "sha256-fsjW3Idaqg4pNGaRP0bm2R94FcW2MVfPQwPFWrN+Qy8=";
+    hash = "sha256-PhG30TKwOqOCMI3e1D9cbNN6hKiVVyrzi9vG+CG5bY0=";
   };
 
   patches = [
     # Install plug-ins and libfwupdplugin to $out output,
     # they are not really part of the library.
-    ./install-fwupdplugin-to-out.patch
+    ./0001-Install-fwupdplugin-to-out.patch
 
     # Installed tests are installed to different output
     # we also cannot have fwupd-tests.conf in $out/etc since it would form a cycle.
-    ./installed-tests-path.patch
+    ./0002-Add-output-for-installed-tests.patch
 
     # Since /etc is the domain of NixOS, not Nix,
     # we cannot install files there.
     # Let’s install the files to $prefix/etc
     # while still reading them from /etc.
     # NixOS module for fwupd will take take care of copying the files appropriately.
-    ./add-option-for-installation-sysconfdir.patch
+    ./0003-Add-option-for-installation-sysconfdir.patch
 
     # EFI capsule is located in fwupd-efi now.
-    ./efi-app-path.patch
+    ./0004-Get-the-efi-app-from-fwupd-efi.patch
+
+    # TODO: drop after 2.0.17
+    (fetchpatch {
+      url = "https://github.com/fwupd/fwupd/commit/7ded10f22875da9b0f5f21cb41f8663049da6311.patch";
+      hash = "sha256-rEoSwcTmxJGX2ZdWAjDvsvgnP2qZp3ErnJVCIQlplhQ=";
+    })
   ];
 
   postPatch = ''
@@ -360,9 +367,11 @@ stdenv.mkDerivation (finalAttrs: {
       "fwupd/remotes.d/vendor-directory.conf"
       "pki/fwupd/GPG-KEY-Linux-Foundation-Firmware"
       "pki/fwupd/GPG-KEY-Linux-Vendor-Firmware-Service"
+      "pki/fwupd/LVFS-CA-2025PQ.pem"
       "pki/fwupd/LVFS-CA.pem"
       "pki/fwupd-metadata/GPG-KEY-Linux-Foundation-Metadata"
       "pki/fwupd-metadata/GPG-KEY-Linux-Vendor-Firmware-Service"
+      "pki/fwupd-metadata/LVFS-CA-2025PQ.pem"
       "pki/fwupd-metadata/LVFS-CA.pem"
       "grub.d/35_fwupd"
     ];

pkgs/by-name/ge/gemini-cli-bin/package.nix

@@ -8,11 +8,11 @@
 }:
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "gemini-cli-bin";
-  version = "0.17.1";
+  version = "0.18.4";
 
   src = fetchurl {
     url = "https://github.com/google-gemini/gemini-cli/releases/download/v${finalAttrs.version}/gemini.js";
-    hash = "sha256-TKuI7UC9ofUzRZFqdjY2LEiagjdE2IC471iXkhUCAyw=";
+    hash = "sha256-hKtmIGysnJ2zlpfpd6W2yA2OqPwQW2xdaND6jMe7lgs=";
   };
 
   dontUnpack = true;

pkgs/by-name/gi/gitleaks/package.nix

@@ -14,7 +14,7 @@ buildGoModule rec {
   version = "8.28.0";
 
   src = fetchFromGitHub {
-    owner = "zricethezav";
+    owner = "gitleaks";
     repo = "gitleaks";
     tag = "v${version}";
     hash = "sha256-smh3Ge278lYVEcs6r1F43daexgjgddy1HKhU5E4CBYM=";
@@ -52,10 +52,13 @@ buildGoModule rec {
       Gitleaks is a SAST tool for detecting hardcoded secrets like passwords,
       API keys and tokens in git repos.
     '';
-    homepage = "https://github.com/zricethezav/gitleaks";
-    changelog = "https://github.com/zricethezav/gitleaks/releases/tag/v${version}";
+    homepage = "https://github.com/gitleaks/gitleaks";
+    changelog = "https://github.com/gitleaks/gitleaks/releases/tag/v${version}";
     license = with lib.licenses; [ mit ];
-    maintainers = with lib.maintainers; [ fab ];
+    maintainers = with lib.maintainers; [
+      fab
+      friedow
+    ];
     mainProgram = "gitleaks";
   };
 }

pkgs/by-name/go/goat/package.nix

@@ -7,13 +7,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "goat";
-  version = "0.1";
+  version = "0.2.0";
 
   src = fetchFromGitHub {
     owner = "blampe";
     repo = "goat";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-/DR6RN7dCROp18P7dgm4DMppwdtYl0AOVNMEtXz8ldk=";
+    hash = "sha256-/m9qRTVrak+C4Df5y+36Ff7E0TdwHVbQEyrP+qfNF6E=";
   };
 
   vendorHash = "sha256-24YllmSUzRcqWbJ8NLyhsJaoGG2+yE8/eXX6teJ1nV8=";

pkgs/by-name/he/helix/package.nix

@@ -72,7 +72,6 @@ rustPlatform.buildRustPackage (final: {
     maintainers = with lib.maintainers; [
       danth
       yusdacra
-      zowoq
     ];
   };
 })

pkgs/by-name/hi/hifile/package.nix

@@ -2,8 +2,8 @@
   lib,
   appimageTools,
   fetchurl,
-  version ? "0.9.12.2",
-  hash ? "sha256-nhBLtsc9zz1tCFn7BWIqTVD/iTLHFUjXPmnslewoUCw=",
+  version ? "0.9.12.3",
+  hash ? "sha256-ImVZyO3ucBGtbXtHGocTap0GPt2/9x4nOLat2R4hwMQ=",
 }:
 
 let

pkgs/by-name/ja/jami/package.nix

@@ -64,14 +64,14 @@
 
 stdenv.mkDerivation rec {
   pname = "jami";
-  version = "20251106.0";
+  version = "20251124.0";
 
   src = fetchFromGitLab {
     domain = "git.jami.net";
     owner = "savoirfairelinux";
     repo = "jami-client-qt";
     rev = "stable/${version}";
-    hash = "sha256-myL/vQrZltBGh/JRGq/GHFFoDLHYMvW4BLeLdIIzmo8=";
+    hash = "sha256-IQA6V0Sl+xhuit9kySpsSAS/a0GOsiT+ysYET91/gmc=";
     fetchSubmodules = true;
   };
 

pkgs/by-name/js/jsonschema-cli/package.nix

@@ -8,15 +8,15 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "jsonschema-cli";
-  version = "0.37.1";
+  version = "0.37.2";
 
   src = fetchCrate {
     pname = "jsonschema-cli";
     inherit (finalAttrs) version;
-    hash = "sha256-JjXRQ4u5ZbMO53vJJLSCqOhl4EeEH6sTyz4WTK7k55A=";
+    hash = "sha256-d/l43flElIooDs/daz7kNVumY7WophO3RwnxMsUGXzc=";
   };
 
-  cargoHash = "sha256-AP38iKce1UAwidTsakaryGOopC/BalAKfzOnvwOWg/0=";
+  cargoHash = "sha256-8fiAzUsYvWNjNhurvh6U2BXiQsBpTzsTo5DstK2MSB4=";
 
   nativeInstallCheckInputs = [
     versionCheckHook

pkgs/by-name/la/lact/package.nix

@@ -23,16 +23,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "lact";
-  version = "0.8.2";
+  version = "0.8.3";
 
   src = fetchFromGitHub {
     owner = "ilya-zlobintsev";
     repo = "LACT";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-ZfUzsSdMLv6IaSbLkz9LBvdB4cS4oBE+R5toi9T7vR0=";
+    hash = "sha256-CbpUg+PB4Kx8AJavXY1GorNb3KfyKl8ovY2y2658UXI=";
   };
 
-  cargoHash = "sha256-K1/D5vi88Wjcvu/KZOkVr4q2MdMHTkhtyV8k8bvcGwg=";
+  cargoHash = "sha256-+3r3FXol7FzgpaasNT3uVT+PhfoRrRNS4z1iYPiwHRM=";
 
   nativeBuildInputs = [
     pkg-config

pkgs/by-name/la/ladybird/package.nix

@@ -33,13 +33,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "ladybird";
-  version = "0-unstable-2025-11-14";
+  version = "0-unstable-2025-11-27";
 
   src = fetchFromGitHub {
     owner = "LadybirdBrowser";
     repo = "ladybird";
-    rev = "70b5496ecda0043b44ddfbbaf3ba0856c969db88";
-    hash = "sha256-98hbxfKBD9rf3AWB6fHZ57V0GgUtMfnk5dAxlAM+2e8=";
+    rev = "c790de24ddc7575a4ed2ea754d27afb6cde0ac22";
+    hash = "sha256-DZ4qj4polUH2xQvopY6ia/GyRe+L8WCGJPEryQAn/4E=";
   };
 
   postPatch = ''

pkgs/by-name/li/libwacom/package.nix

@@ -12,11 +12,12 @@
   libgudev,
   python3,
   valgrind,
+  libwacom-surface,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "libwacom";
-  version = "2.17.0";
+  version = "2.16.1";
 
   outputs = [
     "out"
@@ -27,7 +28,7 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "linuxwacom";
     repo = "libwacom";
     rev = "libwacom-${finalAttrs.version}";
-    hash = "sha256-2JbO3B/PqsLKnaCeQcn1x9Z2pQL4kScuS39F1JlpDpc=";
+    hash = "sha256-YP6z+2HyIRmIAJIdJMbVTQA0rf3EXBZvlCdM4jrmHXM=";
   };
 
   postPatch = ''
@@ -72,7 +73,8 @@ stdenv.mkDerivation (finalAttrs: {
     ]))
   ];
 
-  passthru = {
+  passthru.tests = {
+    inherit libwacom-surface;
     tests = finalAttrs.finalPackage.overrideAttrs { doCheck = true; };
   };
 

pkgs/by-name/ma/marge-bot/package.nix

@@ -9,14 +9,14 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "marge-bot";
-  version = "0.18.0";
+  version = "1.0.0";
   pyproject = true;
 
   src = fetchFromGitLab {
     owner = "marge-org";
     repo = "marge-bot";
     rev = version;
-    hash = "sha256-JaxUEXBxaZIh6fmOjSAa5FZnrO2uAnY3zKoO/mBukUU=";
+    hash = "sha256-FKUWVJqkhdxlWcOvyACQo/At0qW9Li+l25+9oCnA4nM=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/md/mdbook-pagetoc/package.nix

@@ -6,16 +6,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "mdbook-pagetoc";
-  version = "0.2.2";
+  version = "0.3.0";
 
   src = fetchFromGitHub {
     owner = "slowsage";
     repo = "mdbook-pagetoc";
     rev = "v${version}";
-    hash = "sha256-l3CR/ax1i2SJPxIubQUUJ5Hz/8uNl383YeHs8XZ8WGI=";
+    hash = "sha256-B94lIgOJC83cIkuggmfopTDEi9CUQ3nJJpzF9LdImUA=";
   };
 
-  cargoHash = "sha256-Ktui+bA1r1M1IfqWwMRAEF4JKEWmLN7Cx3AbRmv6RVc=";
+  cargoHash = "sha256-CazBgtNh4Z2wlfh9q0SjLsn70zh+aEg957Zq0kh45Hc=";
 
   meta = with lib; {
     description = "Table of contents for mdbook (in sidebar)";

pkgs/by-name/mj/mjpg-streamer/fix-undefined-symbol-error.patch

@@ -0,0 +1,29 @@
+From 7b24e2a593a0029c6f555c9001be87a34eceecc6 Mon Sep 17 00:00:00 2001
+From: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
+Date: Tue, 6 Aug 2024 17:04:55 +0200
+Subject: [PATCH] Export all symbols of mjpg_streamer binary
+
+Fixes runtime error with stripped binary
+
+    dlopen: /usr/lib/mjpg-streamer/input_uvc.so: undefined symbol: resolutions_help
+
+Source: http://lists.busybox.net/pipermail/buildroot/2024-August/759732.html
+
+Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
+---
+ mjpg-streamer-experimental/CMakeLists.txt | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/mjpg-streamer-experimental/CMakeLists.txt b/mjpg-streamer-experimental/CMakeLists.txt
+index cf26620e..3ff12cdf 100644
+--- a/mjpg-streamer-experimental/CMakeLists.txt
++++ b/mjpg-streamer-experimental/CMakeLists.txt
+@@ -92,6 +92,7 @@ set (CMAKE_INSTALL_RPATH_USE_LINK_PATH TRUE)
+ add_executable(mjpg_streamer mjpg_streamer.c
+                              utils.c)
+ 
++set_property(TARGET mjpg_streamer PROPERTY ENABLE_EXPORTS ON)
+ target_link_libraries(mjpg_streamer pthread dl)
+ install(TARGETS mjpg_streamer DESTINATION bin)
+ 
+

pkgs/by-name/mj/mjpg-streamer/package.nix

@@ -17,14 +17,23 @@ stdenv.mkDerivation {
     sha256 = "1cl159svfs1zzzrd3zgn4x7qy6751bvlnxfwf5hn5fmg4iszajw7";
   };
 
+  patches = [
+    # https://patchwork.ozlabs.org/project/buildroot/patch/20240808192126.1767471-1-bernd@kuhls.net/#3373402
+    # https://github.com/jacksonliam/mjpg-streamer/pull/401
+    ./fix-undefined-symbol-error.patch
+  ];
+
   prePatch = ''
-    cd mjpg-streamer-experimental
-    substituteInPlace ./CMakeLists.txt --replace-fail "cmake_minimum_required(VERSION 2.8.3)" "cmake_minimum_required(VERSION 2.8.3...3.10)"
+    substituteInPlace ./mjpg-streamer-experimental/CMakeLists.txt --replace-fail "cmake_minimum_required(VERSION 2.8.3)" "cmake_minimum_required(VERSION 2.8.3...3.10)"
   '';
 
   nativeBuildInputs = [ cmake ];
   buildInputs = [ libjpeg ];
 
+  preConfigure = ''
+    cd mjpg-streamer-experimental
+  '';
+
   postFixup = ''
     patchelf --set-rpath "$(patchelf --print-rpath $out/bin/mjpg_streamer):$out/lib/mjpg-streamer" $out/bin/mjpg_streamer
   '';

pkgs/by-name/mk/mklittlefs/package.nix

@@ -0,0 +1,77 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  versionCheckHook,
+  nix-update-script,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "mklittlefs";
+  version = "4.1.0";
+
+  src = fetchFromGitHub {
+    owner = "earlephilhower";
+    repo = "mklittlefs";
+    tag = finalAttrs.version;
+    fetchSubmodules = true;
+    hash = "sha256-qCL5EG5HyUjObaRReptuNqMKKxOnyP8ZQpOKdLV4F80=";
+  };
+
+  postPatch = ''
+    substituteInPlace Makefile \
+      --replace-fail '$(shell git describe --tag)' '${finalAttrs.version}' \
+      --replace-fail '$(shell git -C littlefs describe --tags || echo "unknown")' '2.11.1'
+
+      patchShebangs run_tests.sh
+      patchShebangs tests/test_create
+  '';
+
+  makeFlags = [
+    "BUILD_CONFIG_NAME=-nixos"
+  ];
+
+  env = {
+    CPPFLAGS =
+      "-DLFS_NAME_MAX=255"
+      + lib.optionalString stdenv.hostPlatform.isDarwin " -Wno-error=vla-cxx-extension";
+  };
+
+  enableParallelBuilding = true;
+
+  doCheck = true;
+  checkPhase = ''
+     runHook preCheck
+
+    ./run_tests.sh tests
+
+    runHook postCheck
+  '';
+
+  installPhase = ''
+    runHook preInstall
+
+    install -Dm755 mklittlefs -t $out/bin
+
+    runHook postInstall
+  '';
+
+  nativeInstallCheckInputs = [
+    versionCheckHook
+  ];
+  versionCheckProgramArg = "--version";
+  doInstallCheck = true;
+
+  passthru = {
+    updateScript = nix-update-script { };
+  };
+
+  meta = {
+    description = "Tool to build and unpack littlefs images";
+    homepage = "https://github.com/earlephilhower/mklittlefs";
+    changelog = "https://github.com/earlephilhower/mklittlefs/releases/tag/v${finalAttrs.version}";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ liberodark ];
+    mainProgram = "mklittlefs";
+  };
+})

pkgs/by-name/ne/networkmanager-ssh/package.nix

@@ -0,0 +1,69 @@
+{
+  stdenv,
+  lib,
+  autoreconfHook,
+  fetchFromGitHub,
+  pkg-config,
+  networkmanager,
+  libsecret,
+  gtk3,
+  gtk4,
+  libnma-gtk4,
+  intltool,
+  openssh,
+  sshpass,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "NetworkManager-ssh";
+  version = "1.4.2";
+
+  src = fetchFromGitHub {
+    owner = "danfruehauf";
+    repo = "NetworkManager-ssh";
+    tag = finalAttrs.version;
+    hash = "sha256-ExCU22V4fYuFXW/HqJ39+PbYykXu4rpk8+3/hg9KTMo=";
+  };
+
+  postPatch = ''
+    substituteInPlace src/nm-ssh-service.c \
+      --replace-fail /usr/bin/sshpass ${lib.getExe sshpass} \
+      --replace-fail /usr/bin/ssh ${lib.getExe openssh}
+  '';
+
+  nativeBuildInputs = [
+    autoreconfHook
+    pkg-config
+    intltool
+    gtk4
+  ];
+
+  buildInputs = [
+    networkmanager
+    gtk3
+    gtk4
+    libsecret
+    libnma-gtk4
+  ];
+
+  configureFlags = [
+    "--with-gtk4"
+    "--enable-absolute-paths"
+  ];
+
+  strictDeps = true;
+
+  passthru = {
+    networkManagerPlugin = "VPN/nm-ssh-service.name";
+  };
+
+  meta = {
+    description = "SSH VPN integration for NetworkManager";
+    homepage = "https://github.com/danfruehauf/NetworkManager-ssh";
+    license = lib.licenses.gpl2Plus;
+    maintainers = with lib.maintainers; [
+      zhangxy
+    ];
+    inherit (networkmanager.meta) platforms;
+  };
+})

pkgs/by-name/nx/nxwitness-client/package.nix

@@ -23,8 +23,8 @@
   xcbutilwm,
 }:
 let
-  version = "6.0.3";
-  build = "40736";
+  version = "6.0.6";
+  build = "41837";
 
   buildInputs = [
     glib
@@ -67,7 +67,7 @@ let
 
     src = fetchurl {
       url = "https://updates.networkoptix.com/default/${build}/linux/nxwitness-client-${finalAttrs.version}-linux_x64.deb";
-      hash = "sha256-flOTNKklovpvtFDWE64clL3Jk1cmT4SVgs1NQZZaXpc=";
+      hash = "sha256-qp3frZqVr6nJonUrcyM2xIliWkwf4aSge3oyWkrzzSs=";
     };
 
     nativeBuildInputs = [

pkgs/by-name/qo/qownnotes/package.nix

@@ -19,11 +19,11 @@
 stdenv.mkDerivation (finalAttrs: {
   pname = "qownnotes";
   appname = "QOwnNotes";
-  version = "25.11.2";
+  version = "25.11.5";
 
   src = fetchurl {
     url = "https://github.com/pbek/QOwnNotes/releases/download/v${finalAttrs.version}/qownnotes-${finalAttrs.version}.tar.xz";
-    hash = "sha256-SkHtuS43pYHzPyCxB6tvPI074T/GONm3I/nXGzwMHns=";
+    hash = "sha256-wXPrYcIAH4X4BP3RfWtVrgHPcc+IWPZcbOFdWdV57Ec=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/re/rehex/package.nix

@@ -20,13 +20,13 @@
 
 stdenv.mkDerivation rec {
   pname = "rehex";
-  version = "0.63.3";
+  version = "0.63.4";
 
   src = fetchFromGitHub {
     owner = "solemnwarning";
     repo = "rehex";
     tag = version;
-    hash = "sha256-o/ff0V0pMomXRu1DrD/m+M6364NisUI+8+RwryIsSLc=";
+    hash = "sha256-Iy87iEadK9fXApeYpJbG0jV437wGJxlOoiJLfaUTkVs=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/rp/rpm-sequoia/package.nix

@@ -11,16 +11,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "rpm-sequoia";
-  version = "1.9.0";
+  version = "1.10.0";
 
   src = fetchFromGitHub {
     owner = "rpm-software-management";
     repo = "rpm-sequoia";
     tag = "v${version}";
-    hash = "sha256-KYoxQwQTcc75VEwWXEhHd+GNowzC7JlcIf6r7WM4Els=";
+    hash = "sha256-/PdbCBpEWig+acLvrN5nhJ6ca+tAh2bpqDLTRJoFuWU=";
   };
 
-  cargoHash = "sha256-oKk768pgMYMJ3NTSlzqV1Y61fyu2DxY62JOpLKfUUY4=";
+  cargoHash = "sha256-Qi46nlgX/k2rRAvCToXkfZpjt7ERu25/4WUIIQUOC/I=";
 
   patches = [
     ./objdump.patch

pkgs/by-name/ru/runc/package.nix

@@ -16,13 +16,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "runc";
-  version = "1.3.3";
+  version = "1.4.0";
 
   src = fetchFromGitHub {
     owner = "opencontainers";
     repo = "runc";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-Ci/2otySB7FaFoutmzWeVaTU+tO/lnluQfneFSQM1RE=";
+    hash = "sha256-XPS9qWgDyKVLYs/QqWof6ydVK1T41QD8yDpvztc3NMc=";
   };
 
   vendorHash = null;

pkgs/by-name/sk/skaffold/package.nix

@@ -8,13 +8,13 @@
 
 buildGoModule rec {
   pname = "skaffold";
-  version = "2.16.1";
+  version = "2.17.0";
 
   src = fetchFromGitHub {
     owner = "GoogleContainerTools";
     repo = "skaffold";
     rev = "v${version}";
-    hash = "sha256-pQyudlU/nn9ZcX4RLp3RvXntxgra3Vs4+HOjvBOKrow=";
+    hash = "sha256-2IXUQo6o9HiU5/98mMp96Mzjmku2YhiZu3EROSTtG3o=";
   };
 
   vendorHash = null;

pkgs/by-name/sp/spec-kit/package.nix

@@ -0,0 +1,51 @@
+{
+  lib,
+  python3Packages,
+  fetchFromGitHub,
+  nix-update-script,
+}:
+
+python3Packages.buildPythonApplication rec {
+  pname = "spec-kit";
+  version = "0.0.86";
+
+  src = fetchFromGitHub {
+    owner = "github";
+    repo = "spec-kit";
+    tag = "v${version}";
+    hash = "sha256-zgiJN7rzD5x/xpL6CMvxITy+/YTu1TKk26UhhQ/s5V8=";
+  };
+
+  pyproject = true;
+
+  build-system = with python3Packages; [
+    hatchling
+  ];
+
+  dependencies =
+    with python3Packages;
+    [
+      typer
+      rich
+      httpx
+      platformdirs
+      readchar
+      truststore
+    ]
+    ++ httpx.optional-dependencies.socks;
+
+  pythonImportsCheck = [
+    "specify_cli"
+  ];
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "Bootstrap your projects for Spec-Driven Development (SDD)";
+    homepage = "https://github.com/github/spec-kit";
+    changelog = "https://github.com/github/spec-kit/blob/v${version}/CHANGELOG.md";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ luochen1990 ];
+    mainProgram = "specify";
+  };
+}

pkgs/by-name/st/stylance-cli/package.nix

@@ -2,17 +2,25 @@
   lib,
   rustPlatform,
   fetchCrate,
+  versionCheckHook,
 }:
-rustPlatform.buildRustPackage rec {
+let
   pname = "stylance-cli";
-  version = "0.7.1";
+  version = "0.7.4";
+in
+rustPlatform.buildRustPackage {
+  inherit pname version;
 
   src = fetchCrate {
     inherit pname version;
-    hash = "sha256-Cdv+Lz+l0+8Jdk9stHACXDbUPedM/YryDMExdsqVvsU=";
+    hash = "sha256-lGgKmNqZ0nflVAM3GMDwGgxnXyLCqVz1bTUsvabXmj8=";
   };
 
-  cargoHash = "sha256-cwgR5AHCeS9YkaJlyFxvEOrBXg7/tXNGXgtSEPHAwm4=";
+  cargoHash = "sha256-HWZQNEKTyNnmA1twN5cfo5RY2tOeCnL6zEp+M4F+Tqg=";
+
+  nativeInstallCheckInputs = [ versionCheckHook ];
+  doInstallCheck = true;
+  versionCheckProgramArg = "--version";
 
   meta = {
     description = "Library and cli tool for working with scoped CSS in rust";

pkgs/by-name/ws/wstunnel/package.nix

@@ -9,16 +9,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "wstunnel";
-  version = "10.5.0";
+  version = "10.5.1";
 
   src = fetchFromGitHub {
     owner = "erebe";
     repo = "wstunnel";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-Z+hlmlvVXyt6tVl4HqTLmPHYLr7CtR055L6MHe+uhnc=";
+    hash = "sha256-2KNqxhi5fFfw54iPKZrJF0G0q6I0uNWzdC81T19GyaE=";
   };
 
-  cargoHash = "sha256-n+0n+tLT0wbNXe/uVb8OJVXsgk16tL/hBIcvnW6OYzs=";
+  cargoHash = "sha256-2A3t1l8iBSufBcl/IjZBJoPv3ZfKH2bdBQjnZxLWFBE=";
 
   cargoBuildFlags = [ "--package wstunnel-cli" ];
 

pkgs/by-name/ya/yaydl/package.nix

@@ -10,16 +10,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "yaydl";
-  version = "0.18.1";
+  version = "0.18.2";
 
   src = fetchFromGitHub {
     owner = "dertuxmalwieder";
     repo = "yaydl";
     rev = "release-${version}";
-    sha256 = "sha256-PSrLjqZ38gBlTiV6qMB3LzrcaqtM6hnZMI1uto24H94=";
+    sha256 = "sha256-blnDixttkmArDQUR6r5PAqa417uh8hmFi8mia/Z0zBA=";
   };
 
-  cargoHash = "sha256-+BBB9YbYjNG7S+Lex/pwp7z06JbG+qMRI+TwSvMcYgg=";
+  cargoHash = "sha256-7thGKPBMjkC06n8qyIfx/edFaBx8VS6FUqnf7dowtWk=";
 
   nativeBuildInputs = [
     pkg-config

pkgs/by-name/ze/zed-editor/package.nix

@@ -101,7 +101,7 @@ let
 in
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "zed-editor";
-  version = "0.214.5";
+  version = "0.214.6";
 
   outputs = [
     "out"
@@ -114,7 +114,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
     owner = "zed-industries";
     repo = "zed";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-z22/Fbj5nu7T8vI7TECHXN5oIsEf7b2LHdBWWvDmDL4=";
+    hash = "sha256-QEhvp0/ywD6bZff0VZ1mrs2oB3UGHaZl707kWBaZJOk=";
   };
 
   postPatch = ''
@@ -134,7 +134,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
     rm -r $out/git/*/candle-book/
   '';
 
-  cargoHash = "sha256-cJSvmo6Bz+X3m9NoSVLEYNX0ezFf6AFGjs2xw0MBmpY=";
+  cargoHash = "sha256-y5hFHYoG1tM+O/64cDhjLbbQxiL0pTgSPRxVVuo0Bs4=";
 
   nativeBuildInputs = [
     cmake

pkgs/desktops/gnome/misc/gnome-extensions-cli/default.nix

@@ -15,13 +15,13 @@
 
 buildPythonApplication rec {
   pname = "gnome-extensions-cli";
-  version = "0.10.6";
+  version = "0.10.8";
   format = "pyproject";
 
   src = fetchPypi {
     pname = "gnome_extensions_cli";
     inherit version;
-    hash = "sha256-REsdgsHPYBms+qbOF4ogV8D/xi5fC9ogl+HOvnsXi7o=";
+    hash = "sha256-Tnf8BbW9u7d19ZtGTdMVHa6azbKekYRGOPEPNiB+y00=";
   };
 
   nativeBuildInputs = [

pkgs/development/cuda-modules/packages/cuda_nvcc.nix

@@ -8,6 +8,7 @@
   cuda_cccl,
   lib,
   libnvvm,
+  makeBinaryWrapper,
 }:
 buildRedist (finalAttrs: {
   redistName = "cuda";
@@ -22,6 +23,10 @@ buildRedist (finalAttrs: {
   # The nvcc and cicc binaries contain hard-coded references to /usr
   allowFHSReferences = true;
 
+  nativeBuildInputs = [
+    makeBinaryWrapper
+  ];
+
   # Entries here will be in nativeBuildInputs when cuda_nvcc is in nativeBuildInputs
   propagatedBuildInputs = [ setupCudaHook ];
 
@@ -144,13 +149,19 @@ buildRedist (finalAttrs: {
         EOF
       ''
       # Add the dependency on backendStdenv.cc to the nvcc.profile.
+      # NOTE: NVCC explodes in horrifying fashion if GCC is not on PATH -- it fails even before
+      # reading nvcc.profile!
       + ''
-        nixLog "adding backendStdenv.cc to nvcc.profile"
+        nixLog "setting compiler-bindir to backendStdenv.cc in nvcc.profile"
         cat << EOF >> "''${!outputBin:?}/bin/nvcc.profile"
-
         # Fix a compatible backend compiler
-        PATH += "${backendStdenv.cc}/bin":
+        compiler-bindir = ${backendStdenv.cc}/bin
         EOF
+
+        nixLog "wrapping nvcc to add backendStdenv.cc to its PATH"
+        wrapProgramBinary \
+          "''${!outputBin:?}/bin/nvcc" \
+          --prefix PATH : ${lib.makeBinPath [ backendStdenv.cc ]}
       ''
     );
 

pkgs/development/cuda-modules/packages/setupCudaHook/package.nix

@@ -5,9 +5,6 @@ makeSetupHook {
 
   substitutions.setupCudaHook = placeholder "out";
 
-  # Point NVCC at a compatible compiler
-  substitutions.ccRoot = "${backendStdenv.cc}";
-
   # Required in addition to ccRoot as otherwise bin/gcc is looked up
   # when building CMakeCUDACompilerId.cu
   substitutions.ccFullPath = "${backendStdenv.cc}/bin/${backendStdenv.cc.targetPrefix}c++";

pkgs/development/cuda-modules/packages/setupCudaHook/setup-cuda-hook.sh

@@ -92,8 +92,6 @@ setupCUDAToolkitCompilers() {
     export CUDAHOSTCXX="@ccFullPath@"
   fi
 
-  appendToVar NVCC_PREPEND_FLAGS "--compiler-bindir=@ccRoot@/bin"
-
   # NOTE: We set -Xfatbin=-compress-all, which reduces the size of the compiled
   #   binaries. If binaries grow over 2GB, they will fail to link. This is a problem for us, as
   #   the default set of CUDA capabilities we build can regularly cause this to occur (for

pkgs/development/libraries/mesa/default.nix

@@ -217,6 +217,10 @@ stdenv.mkDerivation {
     # is ignored when freedreno is not being built.
     (lib.mesonOption "freedreno-kmds" "msm,kgsl,virtio,wsl")
 
+    # Enable virtio-gpu kernel mode driver (native context) support for amdgpu as well.
+    # This option is ignored when RadeonSI/RADV are not being built.
+    (lib.mesonBool "amdgpu-virtio" true)
+
     # Required for OpenCL
     (lib.mesonOption "clang-libdir" "${lib.getLib llvmPackages.clang-unwrapped}/lib")
 

pkgs/development/python-modules/bosch-alarm-mode2/default.nix

@@ -8,14 +8,14 @@
 
 buildPythonPackage rec {
   pname = "bosch-alarm-mode2";
-  version = "0.4.7";
+  version = "0.4.8";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "mag1024";
     repo = "bosch-alarm-mode2";
     tag = "v${version}";
-    hash = "sha256-3eb9Exhu3ME++m+JRCVNpiUVIE3QSb9NRmvi+wZf/QY=";
+    hash = "sha256-UafhNafZ1qb/OYXSvMGaIzDxVGf4jVmdGyv4xrcU43g=";
   };
 
   build-system = [

pkgs/development/python-modules/typical/default.nix

@@ -1,82 +0,0 @@
-{
-  lib,
-  buildPythonPackage,
-  fastjsonschema,
-  fetchFromGitHub,
-  future-typing,
-  inflection,
-  orjson,
-  pandas,
-  pendulum,
-  poetry-core,
-  pydantic,
-  pytestCheckHook,
-  pythonOlder,
-  sqlalchemy,
-  ujson,
-}:
-
-buildPythonPackage rec {
-  pname = "typical";
-  version = "2.9.0";
-  pyproject = true;
-
-  disabled = pythonOlder "3.10";
-
-  src = fetchFromGitHub {
-    owner = "seandstewart";
-    repo = "typical";
-    tag = "v${version}";
-    hash = "sha256-RS4hJ7NufClroRPRO3EyHwDaMgg0s0F7D/mqcBr8O18=";
-  };
-
-  pythonRelaxDeps = [ "pendulum" ];
-
-  build-system = [ poetry-core ];
-
-  dependencies = [
-    fastjsonschema
-    future-typing
-    inflection
-    orjson
-    pendulum
-    ujson
-  ];
-
-  nativeCheckInputs = [
-    pandas
-    pydantic
-    pytestCheckHook
-    sqlalchemy
-  ];
-
-  disabledTests = [
-    # ConstraintValueError: Given value <{'key...
-    "test_tagged_union_validate"
-    # TypeError: 'NoneType' object cannot be interpreted as an integer
-    "test_ujson"
-    # Failed: DID NOT RAISE <class 'ValueError'>
-    "test_invalid_path"
-    # AssertionError
-    "test_primitive"
-    "test_tojson"
-    "test_transmute_simple"
-  ];
-
-  disabledTestPaths = [
-    # We don't care about benchmarks
-    "benchmark/"
-    # Tests are failing on Hydra
-    "tests/mypy/test_mypy.py"
-  ];
-
-  pythonImportsCheck = [ "typic" ];
-
-  meta = with lib; {
-    description = "Python library for runtime analysis, inference and validation of Python types";
-    homepage = "https://python-typical.org/";
-    changelog = "https://github.com/seandstewart/typical/releases/tag/v${version}";
-    license = licenses.mit;
-    maintainers = with maintainers; [ kfollesdal ];
-  };
-}

pkgs/top-level/python-aliases.nix

@@ -480,6 +480,7 @@ mapAliases {
   typed-ast = throw "typed-ast was removed because it went end of life in July 2023"; # added 2025-05-24
   types-typed-ast = throw "types-typed-ast was removed because so was typed-ast"; # added 2025-05-24
   typesystem = throw "'typesystem' has been removed as it was broken, unmaintained, and archived upstream"; # Added 2025-11-27
+  typical = throw "'typical' has been removed as it was broken and archived upstream"; # Added 2025-11-27
   uamqp = throw "'uamqp' has been removed because it is broken and unmaintained."; # added 2025-06-11
   ufoLib2 = throw "'ufoLib2' has been renamed to/replaced by 'ufolib2'"; # Converted to throw 2025-10-29
   unicode-slugify = throw "'unicode-slugify' has been removed becaues it was broken and unmaintained. Consider using 'python-slugify' instead."; # added 2025-10-05

pkgs/top-level/python-packages.nix

@@ -19715,8 +19715,6 @@ self: super: with self; {
 
   typeshed-client = callPackage ../development/python-modules/typeshed-client { };
 
-  typical = callPackage ../development/python-modules/typical { };
-
   typing = null;
 
   typing-extensions = callPackage ../development/python-modules/typing-extensions { };