Merge master into staging-next

nixos/modules/module-list.nix

@@ -611,6 +611,7 @@
   ./services/display-managers/default.nix
   ./services/display-managers/dms-greeter.nix
   ./services/display-managers/gdm.nix
+  ./services/display-managers/generic.nix
   ./services/display-managers/greetd.nix
   ./services/display-managers/lemurs.nix
   ./services/display-managers/ly.nix

nixos/modules/services/display-managers/default.nix

@@ -40,26 +40,7 @@ in
 {
   options = {
     services.displayManager = {
-      enable = lib.mkEnableOption "systemd's display-manager service";
-
-      preStart = lib.mkOption {
-        type = lib.types.lines;
-        default = "";
-        example = "rm -f /var/log/my-display-manager.log";
-        description = "Script executed before the display manager is started.";
-      };
-
-      execCmd = lib.mkOption {
-        type = lib.types.str;
-        example = lib.literalExpression ''"''${pkgs.lightdm}/bin/lightdm"'';
-        description = "Command to start the display manager.";
-      };
-
-      environment = lib.mkOption {
-        type = with lib.types; attrsOf unspecified;
-        default = { };
-        description = "Additional environment variables needed by the display manager.";
-      };
+      enable = lib.mkEnableOption "shared display manager integration";
 
       hiddenUsers = lib.mkOption {
         type = with lib.types; listOf str;
@@ -250,50 +231,5 @@ in
         else
           null;
     };
-
-    # so that the service won't be enabled when only startx is used
-    systemd.services.display-manager.enable =
-      let
-        dmConf = config.services.xserver.displayManager;
-        noDmUsed =
-          !(
-            cfg.gdm.enable
-            || cfg.sddm.enable
-            || dmConf.xpra.enable
-            || dmConf.lightdm.enable
-            || cfg.ly.enable
-            || cfg.lemurs.enable
-          );
-      in
-      lib.mkIf noDmUsed (lib.mkDefault false);
-
-    systemd.services.display-manager = {
-      description = "Display Manager";
-      after = [
-        "acpid.service"
-        "systemd-logind.service"
-        "systemd-user-sessions.service"
-        "autovt@tty1.service"
-      ];
-      conflicts = [
-        "autovt@tty1.service"
-      ];
-      restartIfChanged = false;
-
-      environment = cfg.environment;
-
-      preStart = cfg.preStart;
-      script = lib.mkIf (config.systemd.services.display-manager.enable == true) cfg.execCmd;
-
-      # Stop restarting if the display manager stops (crashes) 2 times
-      # in one minute. Starting X typically takes 3-4s.
-      startLimitIntervalSec = 30;
-      startLimitBurst = 3;
-      serviceConfig = {
-        Restart = "always";
-        RestartSec = "200ms";
-        SyslogIdentifier = "display-manager";
-      };
-    };
   };
 }

nixos/modules/services/display-managers/gdm.nix

@@ -217,27 +217,30 @@ in
       # Enable desktop session data
       enable = true;
 
-      environment = {
-        GDM_X_SERVER_EXTRA_ARGS = toString (lib.filter (arg: arg != "-terminate") xdmcfg.xserverArgs);
-        XDG_DATA_DIRS = lib.makeSearchPath "share" [
-          gdm # for gnome-login.session
-          config.services.displayManager.sessionData.desktops
-          pkgs.gnome-control-center # for accessibility icon
-          pkgs.adwaita-icon-theme
-          pkgs.hicolor-icon-theme # empty icon theme as a base
-        ];
-      }
-      // lib.optionalAttrs (xSessionWrapper != null) {
-        # Make GDM use this wrapper before running the session, which runs the
-        # configured setupCommands. This relies on a patched GDM which supports
-        # this environment variable.
-        GDM_X_SESSION_WRAPPER = "${xSessionWrapper}";
+      generic = {
+        enable = true;
+        environment = {
+          GDM_X_SERVER_EXTRA_ARGS = toString (lib.filter (arg: arg != "-terminate") xdmcfg.xserverArgs);
+          XDG_DATA_DIRS = lib.makeSearchPath "share" [
+            gdm # for gnome-login.session
+            config.services.displayManager.sessionData.desktops
+            pkgs.gnome-control-center # for accessibility icon
+            pkgs.adwaita-icon-theme
+            pkgs.hicolor-icon-theme # empty icon theme as a base
+          ];
+        }
+        // lib.optionalAttrs (xSessionWrapper != null) {
+          # Make GDM use this wrapper before running the session, which runs the
+          # configured setupCommands. This relies on a patched GDM which supports
+          # this environment variable.
+          GDM_X_SESSION_WRAPPER = "${xSessionWrapper}";
+        };
+        execCmd = "exec ${gdm}/bin/gdm";
+        preStart = lib.optionalString (defaultSessionName != null) ''
+          # Set default session in session chooser to a specified values – basically ignore session history.
+          ${setSessionScript}/bin/set-session ${config.services.displayManager.sessionData.autologinSession}
+        '';
       };
-      execCmd = "exec ${gdm}/bin/gdm";
-      preStart = lib.optionalString (defaultSessionName != null) ''
-        # Set default session in session chooser to a specified values – basically ignore session history.
-        ${setSessionScript}/bin/set-session ${config.services.displayManager.sessionData.autologinSession}
-      '';
     };
 
     systemd.tmpfiles.rules = [

nixos/modules/services/display-managers/generic.nix

@@ -0,0 +1,83 @@
+{ config, lib, ... }:
+let
+  cfg = config.services.displayManager.generic;
+in
+{
+  imports = [
+    (lib.mkRenamedOptionModule
+      [ "services" "displayManager" "preStart" ]
+      [ "services" "displayManager" "generic" "preStart" ]
+    )
+    (lib.mkRenamedOptionModule
+      [ "services" "displayManager" "execCmd" ]
+      [ "services" "displayManager" "generic" "execCmd" ]
+    )
+    (lib.mkRenamedOptionModule
+      [ "services" "displayManager" "environment" ]
+      [ "services" "displayManager" "generic" "environment" ]
+    )
+  ];
+
+  options = {
+    services.displayManager.generic = {
+      enable = lib.mkEnableOption "generic display manager integration - deprecated";
+
+      preStart = lib.mkOption {
+        type = lib.types.lines;
+        default = "";
+        example = "rm -f /var/log/my-display-manager.log";
+        description = "Script executed before the display manager is started.";
+      };
+
+      execCmd = lib.mkOption {
+        type = lib.types.nullOr lib.types.str;
+        default = null;
+        example = lib.literalExpression ''"''${pkgs.lightdm}/bin/lightdm"'';
+        description = "Command to start the display manager.";
+      };
+
+      environment = lib.mkOption {
+        type = with lib.types; attrsOf unspecified;
+        default = { };
+        description = "Additional environment variables needed by the display manager.";
+      };
+    };
+  };
+  config = lib.mkIf (cfg.enable || cfg.execCmd != null) {
+    warnings = [
+      (lib.mkIf (!cfg.enable) ''
+        Enabling display-manager.service implicitly due to `services.displayManager.generic.execCmd` being set; this will be removed eventually.
+        Please set `services.displayManager.generic.enable` explicitly, or switch your display manager to use upstream systemd units (preferred).
+      '')
+    ];
+
+    systemd.services.display-manager = {
+      description = "Display Manager";
+      after = [
+        "acpid.service"
+        "systemd-logind.service"
+        "systemd-user-sessions.service"
+        "autovt@tty1.service"
+      ];
+      conflicts = [
+        "autovt@tty1.service"
+      ];
+      restartIfChanged = false;
+
+      environment = cfg.environment;
+
+      preStart = cfg.preStart;
+      script = cfg.execCmd;
+
+      # Stop restarting if the display manager stops (crashes) 2 times
+      # in one minute. Starting X typically takes 3-4s.
+      startLimitIntervalSec = 30;
+      startLimitBurst = 3;
+      serviceConfig = {
+        Restart = "always";
+        RestartSec = "200ms";
+        SyslogIdentifier = "display-manager";
+      };
+    };
+  };
+}

nixos/modules/services/display-managers/lemurs.nix

@@ -76,7 +76,10 @@ in
       };
       displayManager = {
         enable = true;
-        execCmd = "exec ${lib.getExe cfg.package} --config ${settingsFormat.generate "config.toml" cfg.settings}";
+        generic = {
+          enable = true;
+          execCmd = "exec ${lib.getExe cfg.package} --config ${settingsFormat.generate "config.toml" cfg.settings}";
+        };
         # set default settings
         lemurs.settings =
           let

nixos/modules/services/display-managers/ly.nix

@@ -109,7 +109,10 @@ in
 
       displayManager = {
         enable = true;
-        execCmd = "exec /run/current-system/sw/bin/ly";
+        generic = {
+          enable = true;
+          execCmd = "exec /run/current-system/sw/bin/ly";
+        };
 
         # Set this here instead of 'defaultConfig' so users get eval
         # errors when they change it.

nixos/modules/services/display-managers/sddm.nix

@@ -361,7 +361,10 @@ in
 
     services.displayManager = {
       enable = true;
-      execCmd = "exec /run/current-system/sw/bin/sddm";
+      generic = {
+        enable = true;
+        execCmd = "exec /run/current-system/sw/bin/sddm";
+      };
     };
 
     security.pam.services = {

nixos/modules/services/ttys/getty.nix

@@ -151,11 +151,9 @@ in
     # We can't just rely on 'Conflicts=autovt@tty1.service' because
     # 'switch-to-configuration switch' will start 'autovt@tty1.service'
     # and kill the display manager.
-    systemd.targets.getty.wants =
-      lib.mkIf (!(config.systemd.services.display-manager.enable or false))
-        [
-          "autovt@tty1.service"
-        ];
+    systemd.targets.getty.wants = lib.mkIf (!config.services.displayManager.enable) [
+      "autovt@tty1.service"
+    ];
 
     systemd.services."getty@" = {
       serviceConfig.ExecStart = [

nixos/modules/services/x11/display-managers/lightdm.nix

@@ -215,22 +215,24 @@ in
 
     # Set default session in session chooser to a specified values – basically ignore session history.
     # Auto-login is already covered by a config value.
-    services.displayManager.preStart =
+    services.displayManager.generic.preStart =
       optionalString (!dmcfg.autoLogin.enable && dmcfg.defaultSession != null)
         ''
           ${setSessionScript}/bin/set-session ${dmcfg.defaultSession}
         '';
 
     # setSessionScript needs session-files in XDG_DATA_DIRS
-    services.displayManager.environment.XDG_DATA_DIRS = "${dmcfg.sessionData.desktops}/share/";
+    services.displayManager.generic.environment.XDG_DATA_DIRS = "${dmcfg.sessionData.desktops}/share/";
 
     # setSessionScript wants AccountsService
     systemd.services.display-manager.wants = [
       "accounts-daemon.service"
     ];
 
+    services.displayManager.generic.enable = true;
+
     # lightdm relaunches itself via just `lightdm`, so needs to be on the PATH
-    services.displayManager.execCmd = ''
+    services.displayManager.generic.execCmd = ''
       export PATH=${lightdm}/sbin:$PATH
       exec ${lightdm}/sbin/lightdm
     '';

nixos/modules/services/x11/display-managers/xpra.nix

@@ -300,7 +300,8 @@ in
       VideoRam 192000
     '';
 
-    services.displayManager.execCmd = ''
+    services.displayManager.generic.enable = true;
+    services.displayManager.generic.execCmd = ''
       ${optionalString (cfg.pulseaudio) "export PULSE_COOKIE=/run/pulse/.config/pulse/cookie"}
       exec ${pkgs.xpra}/bin/xpra ${
         if cfg.desktop == null then "start" else "start-desktop --start=${cfg.desktop}"

nixos/modules/services/x11/xserver.nix

@@ -849,35 +849,10 @@ in
 
     environment.pathsToLink = [ "/share/X11" ];
 
-    systemd.services.display-manager = {
-      description = "Display Manager";
-
-      after = [
-        "acpid.service"
-        "systemd-logind.service"
-        "systemd-user-sessions.service"
-      ];
-
-      restartIfChanged = false;
-
-      environment = config.services.displayManager.environment;
-
-      preStart = ''
-        ${config.services.displayManager.preStart}
-
-        rm -f /tmp/.X0-lock
-      '';
-
-      # Stop restarting if the display manager stops (crashes) 2 times
-      # in one minute. Starting X typically takes 3-4s.
-      startLimitIntervalSec = 30;
-      startLimitBurst = 3;
-      serviceConfig = {
-        Restart = "always";
-        RestartSec = "200ms";
-        SyslogIdentifier = "display-manager";
-      };
-    };
+    # FIXME: what
+    services.displayManager.generic.preStart = ''
+      rm -f /tmp/.X0-lock
+    '';
 
     services.xserver.displayManager.xserverArgs = [
       "-config ${configFile}"

nixos/modules/virtualisation/oci-containers.nix

@@ -542,7 +542,7 @@ let
         Environment = "PODMAN_SYSTEMD_UNIT=%n";
         Type = "notify";
         NotifyAccess = "all";
-        Delegate = mkIf (container.podman.sdnotify == "healthy") true;
+        Delegate = true;
         User = effectiveUser;
         RuntimeDirectory = escapedName;
       };
@@ -630,13 +630,9 @@ in
               inherit (config.users.users.${podman.user}) linger;
             in
             warnings
-            ++ lib.optional (podman.user != "root" && linger && podman.sdnotify == "conmon") ''
-              Podman container ${name} is configured as rootless (user ${podman.user})
-              with `--sdnotify=conmon`, but lingering for this user is turned on.
-            ''
-            ++ lib.optional (podman.user != "root" && !linger && podman.sdnotify == "healthy") ''
-              Podman container ${name} is configured as rootless (user ${podman.user})
-              with `--sdnotify=healthy`, but lingering for this user is turned off.
+            ++ lib.optional (podman.user != "root" && !linger) ''
+              Podman container ${name} is configured as rootless (user ${podman.user}),
+              but lingering for this user is turned off.
             ''
           ) [ ] cfg.containers
         );

nixos/tests/grocy.nix

@@ -4,7 +4,6 @@
   meta = with pkgs.lib.maintainers; {
     maintainers = [
       diogotcorreia
-      ma27
     ];
   };
 

nixos/tests/oci-containers.nix

@@ -88,7 +88,7 @@ let
               isSystemUser = true;
               group = "redis";
               home = "/var/lib/redis";
-              linger = type == "healthy";
+              linger = true;
               createHome = true;
               uid = 2342;
               subUidRanges = [

nixos/tests/victoriatraces/otlp-ingestion.nix

@@ -60,6 +60,9 @@ in
       services.victoriatraces = {
         enable = true;
         retentionPeriod = "1d";
+        extraOptions = [
+          "-search.latencyOffset=0s"
+        ];
       };
 
       environment.systemPackages = with pkgs; [
@@ -82,10 +85,10 @@ in
     """, timeout=10)
 
     # Query for traces from our test service
-    machine.succeed("""
+    machine.wait_until_succeeds("""
       curl -s 'http://localhost:10428/select/jaeger/api/traces?service=test-service' | \
       jq -e '.data[0].spans[0].operationName' | grep -q 'test-span'
-    """)
+    """, timeout=10)
 
     # Verify the trace has the expected attributes
     machine.succeed("""

pkgs/applications/editors/vscode/extensions/saoudrizwan.claude-dev/default.nix

@@ -7,8 +7,8 @@ vscode-utils.buildVscodeMarketplaceExtension {
   mktplcRef = {
     name = "claude-dev";
     publisher = "saoudrizwan";
-    version = "3.51.0";
-    hash = "sha256-/WqW0hjerbNM9TtgpNV+usDUajIhRd3y+zeYxJi0COc=";
+    version = "3.53.1";
+    hash = "sha256-jMldzLsB4Wdwzzq0vyy1n89G6UaycGz+XReHrwfzpkc=";
   };
 
   meta = {

pkgs/applications/networking/cluster/terraform-providers/providers.json

@@ -128,11 +128,11 @@
     "vendorHash": "sha256-/dOiXO2aPkuZaFiwv/6AXJdIADgx8T7eOwvJfBBoqg8="
   },
   "buildkite_buildkite": {
-    "hash": "sha256-oQyhrDpxjCckqq+mtViswP1rPcgowEq4ZN5jHWa7UpY=",
+    "hash": "sha256-Wu70EyhLP1jC9Y3/RDOtGB8EMbeMvD+HwsSpNXAaMZI=",
     "homepage": "https://registry.terraform.io/providers/buildkite/buildkite",
     "owner": "buildkite",
     "repo": "terraform-provider-buildkite",
-    "rev": "v1.28.0",
+    "rev": "v1.29.0",
     "spdx": "MIT",
     "vendorHash": "sha256-e9RWvfhn/jO44ljfzNjo2qCQZfVISg8DWQdvnTXbf8o="
   },

pkgs/by-name/as/aseprite/package.nix

@@ -11,6 +11,7 @@
   gitUpdater,
   glib,
   harfbuzzFull,
+  libicns,
   lib,
   libGL,
   libjpeg,
@@ -68,6 +69,9 @@ clangStdenv.mkDerivation (finalAttrs: {
     cmake
     ninja
     pkg-config
+  ]
+  ++ lib.optionals clangStdenv.hostPlatform.isDarwin [
+    libicns
   ];
 
   buildInputs = [
@@ -108,10 +112,10 @@ clangStdenv.mkDerivation (finalAttrs: {
     substituteInPlace src/ver/CMakeLists.txt \
       --replace-fail '"1.x-dev"' '"${finalAttrs.version}"'
 
-    # Using substituteInPlace because no upstream patch for GCC 15 was found for this bundled library.
-    substituteInPlace third_party/json11/json11.cpp \
-      --replace-fail "#include <cmath>" "#include <cmath>
-    #include <cstdint>"
+    # Fix build on Darwin with `-Werror=format-security`
+    # (NSLog requires a string-literal format)
+    substituteInPlace laf/os/osx/logger.mm \
+      --replace-fail 'NSLog([NSString stringWithUTF8String:error]);' 'NSLog(@"%@", [NSString stringWithUTF8String:error]);'
   '';
 
   cmakeFlags = [
@@ -139,6 +143,10 @@ clangStdenv.mkDerivation (finalAttrs: {
     "-DSKIA_LIBRARY_DIR=${skia-aseprite}/lib"
   ];
 
+  # `libskia.a` is static, so its deps must be linked explicitly on Darwin
+  # (otherwise we hit undefined `_jpeg_*`/`_WebP*` symbols, e.g. in the thumbnailer).
+  env.NIX_LDFLAGS = lib.optionalString clangStdenv.hostPlatform.isDarwin "-ljpeg -lwebp -lwebpdemux -lwebpmux";
+
   postInstall = ''
     # Install desktop icons.
     src="$out/share/aseprite/data/icons"
@@ -149,6 +157,30 @@ clangStdenv.mkDerivation (finalAttrs: {
     done
     # Delete unneeded artifacts of bundled libraries.
     rm -rf "$out"/{include,lib,man}
+  ''
+  + lib.optionalString clangStdenv.hostPlatform.isDarwin ''
+    install -d "$out/Applications"
+    if [ -d "$out/bin/aseprite.app" ]; then
+      rm -rf "$out/Applications/Aseprite.app"
+      mv "$out/bin/aseprite.app" "$out/Applications/Aseprite.app"
+    fi
+    # Generate the `.icns` files referenced by Info.plist from the shipped PNGs.
+    res="$out/Applications/Aseprite.app/Contents/Resources"
+    icons="$res/data/icons"
+    if [ -d "$icons" ] && command -v png2icns >/dev/null; then
+      for spec in "Aseprite ase" "Document doc" "Extension ext"; do
+        set -- $spec
+        name="$1"
+        prefix="$2"
+        png2icns "$res/$name.icns" \
+          "$icons/''${prefix}16.png" \
+          "$icons/''${prefix}32.png" \
+          "$icons/''${prefix}128.png" \
+          "$icons/''${prefix}256.png"
+      done
+    fi
+    # Keep $out/bin clean on Darwin; the bundle lives under $out/Applications.
+    rmdir "$out/bin" 2>/dev/null || true
   '';
 
   passthru.updateScript = gitUpdater { rev-prefix = "v"; };
@@ -159,20 +191,19 @@ clangStdenv.mkDerivation (finalAttrs: {
     license = lib.licenses.unfree;
     longDescription = ''
       Aseprite is a program to create animated sprites. Its main features are:
-
-                - Sprites are composed by layers & frames (as separated concepts).
-                - Supported color modes: RGBA, Indexed (palettes up to 256 colors), and Grayscale.
-                - Load/save sequence of PNG files and GIF animations (and FLC, FLI, JPG, BMP, PCX, TGA).
-                - Export/import animations to/from Sprite Sheets.
-                - Tiled drawing mode, useful to draw patterns and textures.
-                - Undo/Redo for every operation.
-                - Real-time animation preview.
-                - Multiple editors support.
-                - Pixel-art specific tools like filled Contour, Polygon, Shading mode, etc.
-                - Onion skinning.
+        - Sprites are composed by layers & frames (as separated concepts).
+        - Supported color modes: RGBA, Indexed (palettes up to 256 colors), and Grayscale.
+        - Load/save sequence of PNG files and GIF animations (and FLC, FLI, JPG, BMP, PCX, TGA).
+        - Export/import animations to/from Sprite Sheets.
+        - Tiled drawing mode, useful to draw patterns and textures.
+        - Undo/Redo for every operation.
+        - Real-time animation preview.
+        - Multiple editors support.
+        - Pixel-art specific tools like filled Contour, Polygon, Shading mode, etc.
+        - Onion skinning.
     '';
-    maintainers = [ ];
-    platforms = lib.platforms.linux;
+    maintainers = [ lib.maintainers.iamanaws ];
+    platforms = lib.platforms.linux ++ lib.platforms.darwin;
     mainProgram = "aseprite";
   };
 })

pkgs/by-name/ca/cargo-flamegraph/package.nix

@@ -10,16 +10,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "cargo-flamegraph";
-  version = "0.6.10";
+  version = "0.6.11";
 
   src = fetchFromGitHub {
     owner = "flamegraph-rs";
     repo = "flamegraph";
     rev = "v${version}";
-    sha256 = "sha256-WBJS+0RzFg8dgmxYuHOguJROPONdlkIfllpeCKxaSHY=";
+    sha256 = "sha256-WPWS3NX6t8RNNALqYF2JMLI5HWVhsVmhg9ULZKt972I=";
   };
 
-  cargoHash = "sha256-nDZHkF3RvKdrXhfD0NGRL/xjCxIP2zRe4w1LVxHkdi8=";
+  cargoHash = "sha256-U/Cs4HRNuxq7RaWHmmLoWbiZgqumSRFRLpe1N/63q+E=";
 
   nativeBuildInputs = lib.optionals stdenv.hostPlatform.isLinux [ makeWrapper ];
 

pkgs/by-name/cl/cloudflared/package.nix

@@ -9,13 +9,13 @@
 
 buildGoModule rec {
   pname = "cloudflared";
-  version = "2025.11.1";
+  version = "2026.1.1";
 
   src = fetchFromGitHub {
     owner = "cloudflare";
     repo = "cloudflared";
     tag = version;
-    hash = "sha256-OspDwmh8rzGaHlLfQiUxQzDNxBdzkBJbPrmL1YN7BtM=";
+    hash = "sha256-9+WDVS2pZR5nbbpdGSi9jO8ccT0L5K7NLdobL8J+bYU=";
   };
 
   vendorHash = null;

pkgs/by-name/cl/cloudlog/package.nix

@@ -9,13 +9,13 @@
 
 stdenvNoCC.mkDerivation rec {
   pname = "cloudlog";
-  version = "2.8.5";
+  version = "2.8.6";
 
   src = fetchFromGitHub {
     owner = "magicbug";
     repo = "Cloudlog";
     rev = version;
-    hash = "sha256-SHul8plxCA8S1DT7ThYpEn2ce1DgexWJExoz7avRMtw=";
+    hash = "sha256-k+/KajRRKsfEFk8ApEJ154pT4cR54ZnavSrk8U4Azso=";
   };
 
   postPatch = ''

pkgs/by-name/co/code-cursor/sources.json

@@ -1,22 +1,22 @@
 {
-  "version": "2.3.41",
+  "version": "2.4.21",
   "vscodeVersion": "1.105.1",
   "sources": {
     "x86_64-linux": {
-      "url": "https://downloads.cursor.com/production/2ca326e0d1ce10956aea33d54c0e2d8c13c58a32/linux/x64/Cursor-2.3.41-x86_64.AppImage",
-      "hash": "sha256-ItUgknMzSDeXxN3Yi/pz2wZoz7vVVqx9nGXuGmbHbXc="
+      "url": "https://downloads.cursor.com/production/dc8361355d709f306d5159635a677a571b277bcc/linux/x64/Cursor-2.4.21-x86_64.AppImage",
+      "hash": "sha256-OOjANfVHMlRN1uWq2jNmK/RqI4Q5NTlN/19Nl2jWiKI="
     },
     "aarch64-linux": {
-      "url": "https://downloads.cursor.com/production/2ca326e0d1ce10956aea33d54c0e2d8c13c58a32/linux/arm64/Cursor-2.3.41-aarch64.AppImage",
-      "hash": "sha256-0D0IbkUyvCyCbf8apO7WG3KrcCEgv2TLNRjFOD8mcgU="
+      "url": "https://downloads.cursor.com/production/dc8361355d709f306d5159635a677a571b277bcc/linux/arm64/Cursor-2.4.21-aarch64.AppImage",
+      "hash": "sha256-tk7TzkLy8oHtXp0UcMwhDXa9B2f2lanWYmPbF7OKfZ0="
     },
     "x86_64-darwin": {
-      "url": "https://downloads.cursor.com/production/2ca326e0d1ce10956aea33d54c0e2d8c13c58a32/darwin/x64/Cursor-darwin-x64.dmg",
-      "hash": "sha256-/GcQppfoBS9rIksQ/wYYH9Is7Sw2ZnjoW1Tk0hN8Y7g="
+      "url": "https://downloads.cursor.com/production/dc8361355d709f306d5159635a677a571b277bcc/darwin/x64/Cursor-darwin-x64.dmg",
+      "hash": "sha256-uacRpz0HFRfmaNekSB5qLXpnhiQRvAw03W+9QfPl6ZY="
     },
     "aarch64-darwin": {
-      "url": "https://downloads.cursor.com/production/2ca326e0d1ce10956aea33d54c0e2d8c13c58a32/darwin/arm64/Cursor-darwin-arm64.dmg",
-      "hash": "sha256-ejhhXRhNTMh9n2cPkpNC0msk4Z1OFD2EzxwkJYw92XU="
+      "url": "https://downloads.cursor.com/production/dc8361355d709f306d5159635a677a571b277bcc/darwin/arm64/Cursor-darwin-arm64.dmg",
+      "hash": "sha256-nCch/JXO1lzj0ibAa8e0OPlnBTOrIk/fvq9CO46Ev8w="
     }
   }
 }

pkgs/by-name/co/codex/package.nix

@@ -14,18 +14,18 @@
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "codex";
-  version = "0.88.0";
+  version = "0.89.0";
 
   src = fetchFromGitHub {
     owner = "openai";
     repo = "codex";
     tag = "rust-v${finalAttrs.version}";
-    hash = "sha256-Ff6Ut1GwRPd2oB4/YojKgS/CYMG0TVizXOHKfpKClqY=";
+    hash = "sha256-VFbtxGOqX80qWqVo+BG+BnUr8DiLCfcJCrN9fwy7utY=";
   };
 
   sourceRoot = "${finalAttrs.src.name}/codex-rs";
 
-  cargoHash = "sha256-eLao+Jaq7+Bu9QNHDJYD3zX2BQvlX/BSTYr4gpCD++Q=";
+  cargoHash = "sha256-gg7KPEMO2aiBcIN8TllaDQeTLyw+WLfmMrXBKV/L53M=";
 
   nativeBuildInputs = [
     installShellFiles

pkgs/by-name/de/deno/package.nix

@@ -128,7 +128,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
 
   cargoTestFlags = [
     "--lib" # unit tests
-    "--test integration_tests"
+    "--test=integration_tests"
     # Test targets not included here:
     # - node_compat: there are tons of network access in them and it's not trivial to skip test cases.
     # - specs: this target uses a custom test harness that doesn't implement the --skip flag.

pkgs/by-name/dn/dnsmonster/package.nix

@@ -8,13 +8,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "dnsmonster";
-  version = "1.1.0";
+  version = "1.2.9";
 
   src = fetchFromGitHub {
     owner = "mosajjal";
     repo = "dnsmonster";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-+GFkGUR3XKDgrxVAZ3MuPxGyI0oGROdhHKMBwMSvoBI=";
+    hash = "sha256-SDAD5OBactf0dynUmLgdrg+m0bZATh4wGW/NZ2gG+dI=";
   };
 
   vendorHash = "sha256-7rIBbaYr1dgC0ArcuwZelHKG5TLIQDV9JSBoYOcz+C0=";

pkgs/by-name/em/empty-epsilon/package.nix

@@ -106,7 +106,6 @@ stdenv.mkDerivation {
     license = lib.licenses.gpl2Plus;
     maintainers = with lib.maintainers; [
       fpletz
-      ma27
     ];
     platforms = lib.platforms.linux;
   };

pkgs/by-name/gd/gdscript-formatter/package.nix

@@ -14,9 +14,11 @@ rustPlatform.buildRustPackage (finalAttrs: {
     owner = "GDQuest";
     repo = "GDScript-formatter";
     tag = finalAttrs.version;
-    hash = "sha256-nnLVmd7wVHdDcAnyCHCVYckmbzMdSGIVL2iSgDC+9cs=";
+    hash = "sha256-V9zrL2Aku5e+9McXpXdXvsGJKjqVXIIaAsoAF2xHB4g=";
     # Needed due to .gitattributes being used for the Godot addon and export-ignoring all files
     deepClone = true;
+    # Avoid hash differences due to differences in .git
+    leaveDotGit = false;
   };
 
   cargoHash = "sha256-xqGmv/e1Ch/EqutIb2claiJ8fQGDDdOriOZdt8SR8mw=";

pkgs/by-name/ge/gelly/package.nix

@@ -18,16 +18,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "gelly";
-  version = "0.15.0";
+  version = "0.15.1";
 
   src = fetchFromGitHub {
     owner = "Fingel";
     repo = "gelly";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-BLW0ACn3e8tm040UbolXyLtwHlienddQ+9HXj4deNd8=";
+    hash = "sha256-7JMtXqqVy7JJs7pkCuJlcfFD0APdTjUwOr/LsyWRHVU=";
   };
 
-  cargoHash = "sha256-htBnnqyHpJFsSERlNsXXKnIRu9CcanqIVd+OwTAmrFw=";
+  cargoHash = "sha256-SXIYUUTZGKEXS62/Q+SDiz5BB4eE2TEOq346zotFpO4=";
 
   nativeBuildInputs = [
     pkg-config

pkgs/by-name/gh/ghostty/deps.nix

@@ -169,11 +169,11 @@ linkFarm name [
     };
   }
   {
-    name = "N-V-__8AALIsAwDyo88G5mGJGN2lSVmmFMx4YePfUvp_2o3Y";
+    name = "N-V-__8AAIdIAwDt5PxH-cwCxEcTfw4jBV8sR6fZ_XLh-cR7";
     path = fetchZigArtifact {
       name = "iterm2_themes";
-      url = "https://github.com/mbadolato/iTerm2-Color-Schemes/releases/download/release-20251002-142451-4a5043e/ghostty-themes.tgz";
-      hash = "sha256-GsEWVt4wMzp6+7N5I+QVuhCVJ70cFrdADwUds59AKnw=";
+      url = "https://github.com/mbadolato/iTerm2-Color-Schemes/releases/download/release-20260112-150707-28c8f5b/ghostty-themes.tgz";
+      hash = "sha256-NIqF12KqXhIrP+LyBtg6WtkHxNUdWOyziAdq8S45RrU=";
     };
   }
   {

pkgs/by-name/gh/ghostty/package.nix

@@ -5,6 +5,7 @@
   bzip2,
   callPackage,
   fetchFromGitHub,
+  fetchpatch2,
   fontconfig,
   freetype,
   glib,
@@ -48,6 +49,16 @@ stdenv.mkDerivation (finalAttrs: {
     hash = "sha256-0tmLOJCrrEnVc/ZCp/e646DTddXjv249QcSwkaukL30=";
   };
 
+  # Replace the defunct iTerm2 themes dependency with a newer version
+  # Remove when 1.2.4 or 1.3.0 is released
+  patches = [
+    (fetchpatch2 {
+      name = "fix-iterm2-themes-ref.patch";
+      url = "https://github.com/pluiedev/ghostty/commit/dc51adc52661bbcacebe5e70b62b5041e3ee56a5.patch";
+      hash = "sha256-0DrP4zN26pjeBawoi9U8y6VM/NlfhPmo27Iy5OsMj0s=";
+    })
+  ];
+
   deps = callPackage ./deps.nix {
     name = "${finalAttrs.pname}-cache-${finalAttrs.version}";
   };

pkgs/by-name/ho/homepage-dashboard/package.nix

@@ -47,8 +47,8 @@ stdenv.mkDerivation (finalAttrs: {
       src
       ;
     pnpm = pnpm_10;
-    fetcherVersion = 1;
-    hash = "sha256-cDN01UlS4xEUWVUuHgOB0evZOUaSo9krNHyS1YV2/WE=";
+    fetcherVersion = 3;
+    hash = "sha256-iWKGDgZIdQzKSJx5MpqO83nvpawBhCKllWf3x6aCAtQ=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/i3/i3lock-pixeled/package.nix

@@ -1,49 +0,0 @@
-{
-  lib,
-  stdenv,
-  i3lock,
-  imagemagick,
-  scrot,
-  playerctl,
-  fetchFromGitLab,
-}:
-
-stdenv.mkDerivation rec {
-  pname = "i3lock-pixeled";
-  version = "1.2.1";
-
-  src = fetchFromGitLab {
-    owner = "Ma27";
-    repo = "i3lock-pixeled";
-    rev = version;
-    sha256 = "1l9yjf9say0mcqnnjkyj4z3f6y83bnx4jsycd1h10p3m8afbh8my";
-  };
-
-  propagatedBuildInputs = [
-    i3lock
-    imagemagick
-    scrot
-    playerctl
-  ];
-
-  makeFlags = [
-    "PREFIX=$(out)/bin"
-  ];
-
-  patchPhase = ''
-    substituteInPlace i3lock-pixeled \
-       --replace i3lock    "${i3lock}/bin/i3lock" \
-       --replace convert   "${imagemagick}/bin/convert" \
-       --replace scrot     "${scrot}/bin/scrot" \
-       --replace playerctl "${playerctl}/bin/playerctl"
-  '';
-
-  meta = {
-    description = "Simple i3lock helper which pixels a screenshot by scaling it down and up to get a pixeled version of the screen when the lock is active";
-    mainProgram = "i3lock-pixeled";
-    homepage = "https://gitlab.com/Ma27/i3lock-pixeled";
-    license = lib.licenses.mit;
-    platforms = lib.platforms.linux;
-    maintainers = with lib.maintainers; [ ma27 ];
-  };
-}

pkgs/by-name/io/iosevka/package.nix

@@ -58,16 +58,16 @@ assert (extraParameters != null) -> set != null;
 
 buildNpmPackage rec {
   pname = "Iosevka${toString set}";
-  version = "34.0.0";
+  version = "34.1.0";
 
   src = fetchFromGitHub {
     owner = "be5invis";
     repo = "iosevka";
     rev = "v${version}";
-    hash = "sha256-fASlzL/7pVDIs5wCkEUJaU0r0Gy5YGZ9kxiAskZHWcI=";
+    hash = "sha256-vdjf2MkKP9DHl/hrz9xJMWMuT2AsonRdt14xQTSsVmU=";
   };
 
-  npmDepsHash = "sha256-uujfgTv2QEhywQNmglZusgikGEZvVtWL/lYFq6Q1VFc=";
+  npmDepsHash = "sha256-YMfePtKg4kpZ4iCpkq7PxfyDB4MIRg/tgCNmLD31zKo=";
 
   nativeBuildInputs = [
     remarshal

pkgs/by-name/ke/keycloak/package.nix

@@ -24,11 +24,11 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "keycloak";
-  version = "26.5.1";
+  version = "26.5.2";
 
   src = fetchzip {
     url = "https://github.com/keycloak/keycloak/releases/download/${finalAttrs.version}/keycloak-${finalAttrs.version}.zip";
-    hash = "sha256-lp/3m82N6VgKK4D0QAuEq/j8fR21Biar58MFeNuGjXo=";
+    hash = "sha256-SXoHnwk/hepSV5BIsmZvCXOPn5UfVKwbNZ4D9zSlaz0=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/ki/kiro-cli/package.nix

@@ -0,0 +1,107 @@
+{
+  lib,
+  stdenv,
+  fetchurl,
+  autoPatchelfHook,
+  makeBinaryWrapper,
+  undmg,
+  versionCheckHook,
+  xz,
+  bzip2,
+}:
+
+let
+  inherit (stdenv.hostPlatform) system;
+in
+stdenv.mkDerivation (finalAttrs: {
+  pname = "kiro-cli";
+  version = "1.24.0";
+
+  src =
+    let
+      darwinDmg = fetchurl {
+        url = "https://desktop-release.q.us-east-1.amazonaws.com/${finalAttrs.version}/Kiro%20CLI.dmg";
+        hash = "sha256-V/akA/fcQZFULlBgGNibQRrhiBpGOr2s+jdPrAGOtnY=";
+      };
+    in
+    {
+      x86_64-linux = fetchurl {
+        url = "https://desktop-release.q.us-east-1.amazonaws.com/${finalAttrs.version}/kirocli-x86_64-linux.tar.gz";
+        hash = "sha256-kDvM5OVKaB7RYmYySRNyMMMPllGPXuO27/E4/SN3onY=";
+      };
+      aarch64-linux = fetchurl {
+        url = "https://desktop-release.q.us-east-1.amazonaws.com/${finalAttrs.version}/kirocli-aarch64-linux.tar.gz";
+        hash = "sha256-gprO84khQoRPCeNqZny3TP2ndQgJrtRm0xcpSjzrYHI=";
+      };
+      x86_64-darwin = darwinDmg;
+      aarch64-darwin = darwinDmg;
+    }
+    .${system} or (throw "Unsupported system: ${system}");
+
+  sourceRoot = if stdenv.hostPlatform.isDarwin then "Kiro CLI.app" else "kirocli";
+
+  strictDeps = true;
+
+  nativeBuildInputs = [
+    makeBinaryWrapper
+  ]
+  ++ lib.optionals stdenv.hostPlatform.isLinux [
+    autoPatchelfHook
+  ]
+  ++ lib.optionals stdenv.hostPlatform.isDarwin [
+    undmg
+  ];
+
+  buildInputs = lib.optionals stdenv.hostPlatform.isLinux [
+    stdenv.cc.cc.lib
+    xz
+    bzip2
+  ];
+
+  nativeInstallCheckInputs = [ versionCheckHook ];
+  doInstallCheck = true;
+
+  dontConfigure = true;
+  dontBuild = true;
+
+  installPhase = ''
+    runHook preInstall
+  ''
+  + lib.optionalString stdenv.hostPlatform.isLinux ''
+    install -Dm755 bin/kiro-cli $out/bin/.kiro-wrapped
+    install -Dm755 bin/kiro-cli-chat $out/bin/kiro-cli-chat
+    install -Dm755 bin/kiro-cli-term $out/bin/kiro-cli-term
+    makeBinaryWrapper $out/bin/.kiro-wrapped $out/bin/kiro \
+      --prefix PATH : $out/bin
+  ''
+  + lib.optionalString stdenv.hostPlatform.isDarwin ''
+    mkdir -p $out/bin $out/Applications
+    cp -r "../Kiro CLI.app" "$out/Applications/"
+    ln -s "$out/Applications/Kiro CLI.app/Contents/MacOS/kiro-cli" $out/bin/kiro
+    for bin in kiro-cli-chat kiro-cli-term; do
+      if [[ -e "$out/Applications/Kiro CLI.app/Contents/MacOS/$bin" ]]; then
+        ln -s "$out/Applications/Kiro CLI.app/Contents/MacOS/$bin" "$out/bin/$bin"
+      fi
+    done
+  ''
+  + ''
+    runHook postInstall
+  '';
+
+  passthru.updateScript = ./update.sh;
+
+  meta = {
+    description = "Command-line interface for Kiro, an agentic IDE";
+    homepage = "https://kiro.dev";
+    license = lib.licenses.unfree;
+    sourceProvenance = [ lib.sourceTypes.binaryNativeCode ];
+    maintainers = [ lib.maintainers.jamesward ];
+    mainProgram = "kiro";
+    platforms = [
+      "x86_64-linux"
+      "aarch64-linux"
+      "x86_64-darwin"
+      "aarch64-darwin"
+    ];
+  };
+})

pkgs/by-name/ki/kiro-cli/update.sh

@@ -0,0 +1,74 @@
+#!/usr/bin/env nix-shell
+#!nix-shell -i bash -p curl jq nix coreutils
+
+set -euo pipefail
+
+MANIFEST_URL="https://desktop-release.q.us-east-1.amazonaws.com/latest/manifest.json"
+PACKAGE_DIR="$(dirname "$0")"
+PACKAGE_NIX="$PACKAGE_DIR/package.nix"
+
+manifest=$(curl -fsSL "$MANIFEST_URL")
+latest_version=$(echo "$manifest" | jq -r '.version')
+current_version=$(grep -Po '^\s+version\s*=\s*"\K[0-9.]+' "$PACKAGE_NIX" | head -1)
+
+if [[ "$latest_version" == "$current_version" ]]; then
+    echo "kiro-cli is already up to date at version $current_version"
+    exit 0
+fi
+
+echo "Updating kiro-cli from $current_version to $latest_version"
+
+get_linux_hash() {
+    local arch="$1"
+    echo "$manifest" | jq -r --arg arch "$arch" '
+        .packages[] |
+        select(.os == "linux" and .fileType == "tarGz" and .variant == "headless" and .architecture == $arch and (.targetTriple | contains("musl") | not)) |
+        .sha256
+    '
+}
+
+get_darwin_hash() {
+    echo "$manifest" | jq -r '
+        .packages[] |
+        select(.os == "macos" and .fileType == "dmg") |
+        .sha256
+    '
+}
+
+hex_to_sri() {
+    local hex="$1"
+    nix hash convert --to sri --hash-algo sha256 "$hex"
+}
+
+x86_64_linux_hex=$(get_linux_hash "x86_64")
+aarch64_linux_hex=$(get_linux_hash "aarch64")
+darwin_hex=$(get_darwin_hash)
+
+if [[ -z "$x86_64_linux_hex" || -z "$aarch64_linux_hex" || -z "$darwin_hex" ]]; then
+    echo "Error: Could not find all hashes in manifest"
+    echo "  x86_64-linux: $x86_64_linux_hex"
+    echo "  aarch64-linux: $aarch64_linux_hex"
+    echo "  darwin: $darwin_hex"
+    exit 1
+fi
+
+x86_64_linux_hash=$(hex_to_sri "$x86_64_linux_hex")
+aarch64_linux_hash=$(hex_to_sri "$aarch64_linux_hex")
+darwin_hash=$(hex_to_sri "$darwin_hex")
+
+echo "x86_64-linux hash: $x86_64_linux_hash"
+echo "aarch64-linux hash: $aarch64_linux_hash"
+echo "darwin hash: $darwin_hash"
+
+# Get current hashes from package.nix
+current_x86_hash=$(grep -A2 'x86_64-linux = fetchurl' "$PACKAGE_NIX" | grep -Po 'hash = "\K[^"]+')
+current_aarch64_hash=$(grep -A2 'aarch64-linux = fetchurl' "$PACKAGE_NIX" | grep -Po 'hash = "\K[^"]+')
+current_darwin_hash=$(grep -A2 'darwinDmg = fetchurl' "$PACKAGE_NIX" | grep -Po 'hash = "\K[^"]+')
+
+# Update version and hashes
+sed -i "s|version = \"$current_version\"|version = \"$latest_version\"|" "$PACKAGE_NIX"
+sed -i "s|$current_x86_hash|$x86_64_linux_hash|" "$PACKAGE_NIX"
+sed -i "s|$current_aarch64_hash|$aarch64_linux_hash|" "$PACKAGE_NIX"
+sed -i "s|$current_darwin_hash|$darwin_hash|" "$PACKAGE_NIX"
+
+echo "Updated kiro-cli to version $latest_version"

pkgs/by-name/mi/minilibx/package.nix

@@ -42,6 +42,8 @@ stdenv.mkDerivation {
     "CC=${stdenv.cc.targetPrefix}cc"
   ];
 
+  env.NIX_CFLAGS_COMPILE = lib.optionalString stdenv.cc.isGNU "-std=gnu17";
+
   installPhase = ''
     runHook preInstall
 

pkgs/by-name/mo/models-dev/package.nix

@@ -9,12 +9,12 @@
 }:
 let
   pname = "models-dev";
-  version = "0-unstable-2026-01-17";
+  version = "0-unstable-2026-01-24";
   src = fetchFromGitHub {
     owner = "anomalyco";
     repo = "models.dev";
-    rev = "971e8734ae3ae7220afc4cfc8320c717107bc9ba";
-    hash = "sha256-kAbJKCRxcgORYa6+GTYPw1461+Bb8dYguexgokw4d1U=";
+    rev = "545bf83089a0d0bc4001b14c485270e10161cdd8";
+    hash = "sha256-iby02kRswqBqBP1pQS7vMMsRTY7VLiccdd7aoanOURw=";
   };
 
   node_modules = stdenvNoCC.mkDerivation {

pkgs/by-name/mo/mongodb-atlas-cli/package.nix

@@ -11,16 +11,16 @@
 
 buildGoModule rec {
   pname = "mongodb-atlas-cli";
-  version = "1.51.1";
+  version = "1.51.2";
 
   src = fetchFromGitHub {
     owner = "mongodb";
     repo = "mongodb-atlas-cli";
     tag = "atlascli/v${version}";
-    hash = "sha256-z2m+DcQoPn+o/U4NOM3PTyp31fae8Odb4CkJGZJn4wA=";
+    hash = "sha256-0NZh+o8UuiasOO0fJua3vPhJiA/NI/RdwQ203BMVU+U=";
   };
 
-  vendorHash = "sha256-dp9/v7tIyKm6nc1iEM9pEtcC5aYFnJeY2wS4qRU1IIA=";
+  vendorHash = "sha256-KwExYvH9IWFynh12VnkL3G9PKGZ0lQnIImoCY9Kz+OI=";
 
   nativeBuildInputs = [ installShellFiles ];
 

pkgs/by-name/op/openvpn3/package.nix

@@ -119,7 +119,7 @@ stdenv.mkDerivation rec {
     wrapPythonProgramsIn "$out/libexec/openvpn3-linux" "$out ${pythonPath}"
   '';
 
-  NIX_LDFLAGS = "-lpthread";
+  env.NIX_LDFLAGS = "-lpthread";
 
   passthru.updateScript = nix-update-script { };
 

pkgs/by-name/os/osmctools/package.nix

@@ -20,6 +20,9 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [ autoreconfHook ];
   buildInputs = [ zlib ];
 
+  # Fix build with gcc15 (-std=gnu23)
+  env.NIX_CFLAGS_COMPILE = lib.optionalString stdenv.cc.isGNU "-std=gnu17";
+
   meta = {
     description = "Command line tools for transforming Open Street Map files";
     homepage = [

pkgs/by-name/ph/phase-cli/package.nix

@@ -7,14 +7,14 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "phase-cli";
-  version = "1.20.0";
+  version = "1.21.2";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "phasehq";
     repo = "cli";
     tag = "v${version}";
-    hash = "sha256-vhjDXQutRdkeeId2shPWFtoZGH6FXvQcWhH8MLe9JqI=";
+    hash = "sha256-nj6vSq+2pquZ5A77EG9s2IXUsmAz41xD1OkaVHrKLIA=";
   };
 
   build-system = with python3Packages; [
@@ -31,6 +31,7 @@ python3Packages.buildPythonApplication rec {
     pyyaml
     toml
     python-hcl2
+    botocore
   ];
 
   nativeCheckInputs = [
@@ -51,7 +52,10 @@ python3Packages.buildPythonApplication rec {
     homepage = "https://github.com/phasehq/cli";
     changelog = "https://github.com/phasehq/cli/releases/tag/${src.tag}";
     license = lib.licenses.gpl3Only;
-    maintainers = with lib.maintainers; [ genga898 ];
+    maintainers = with lib.maintainers; [
+      genga898
+      medv
+    ];
     mainProgram = "phase";
   };
 }

pkgs/by-name/po/podman/package.nix

@@ -157,6 +157,8 @@ buildGoModule (finalAttrs: {
         podman-tls-ghostunnel
         ;
       oci-containers-podman = nixosTests.oci-containers.podman;
+      oci-containers-podman-rootless-conmon = nixosTests.oci-containers.podman-rootless-conmon;
+      oci-containers-podman-rootless-healthy = nixosTests.oci-containers.podman-rootless-healthy;
     };
     # do not add qemu to this wrapper, store paths get written to the podman vm config and break when GCed
     binPath = lib.makeBinPath (

pkgs/by-name/qu/quantlib/package.nix

@@ -9,7 +9,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "quantlib";
-  version = "1.40";
+  version = "1.41";
 
   outputs = [
     "out"
@@ -20,7 +20,7 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "lballabio";
     repo = "QuantLib";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-cyri+kCwIFO/ccnqWhO8qOXNPIV0g6iiNvBYtN667pA=";
+    hash = "sha256-dHXITHP0SBrBXf5hrVhjSD4n2EtVvEkBDfE2NbT0/sc=";
   };
 
   nativeBuildInputs = [ cmake ];

pkgs/by-name/ra/raycast/package.nix

@@ -12,19 +12,19 @@
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "raycast";
-  version = "1.104.1";
+  version = "1.104.3";
 
   src =
     {
       aarch64-darwin = fetchurl {
         name = "Raycast.dmg";
         url = "https://releases.raycast.com/releases/${finalAttrs.version}/download?build=arm";
-        hash = "sha256-zm+r7f7uTUPtvLTVyVf18VwADltyOur8lPqqvpWrRu8=";
+        hash = "sha256-+8ZVBZlOVaeH1m2TX2f+56hlXXZSifS4y+7qSNW6nlY=";
       };
       x86_64-darwin = fetchurl {
         name = "Raycast.dmg";
         url = "https://releases.raycast.com/releases/${finalAttrs.version}/download?build=x86_64";
-        hash = "sha256-TQNWPQzrPw43heW+zOCei6rM5sQYcIz6MEXonj8F3WM=";
+        hash = "sha256-qGiZNBdtA24Hm8SXbYoNlcMlijHOQ1isSZAzCk0PVq8=";
       };
     }
     .${stdenvNoCC.system} or (throw "raycast: ${stdenvNoCC.system} is unsupported.");

pkgs/by-name/re/redpanda-client/package.nix

@@ -7,12 +7,12 @@
   stdenv,
 }:
 let
-  version = "25.3.5";
+  version = "25.3.6";
   src = fetchFromGitHub {
     owner = "redpanda-data";
     repo = "redpanda";
     rev = "v${version}";
-    sha256 = "sha256-Qtdgl2EV1Nbvwo30ZMod83gvw/Kw36Qnjx7ywtsnvTI=";
+    sha256 = "sha256-4SVd01dbgpjhdhZhQUIGta7OBjSzQNmo5teLQ+w804s=";
   };
 in
 buildGoModule rec {

pkgs/by-name/sa/sarasa-gothic/package.nix

@@ -7,13 +7,13 @@
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "sarasa-gothic";
-  version = "1.0.35";
+  version = "1.0.36";
 
   src = fetchurl {
     # Use the 'ttc' files here for a smaller closure size.
     # (Using 'ttf' files gives a closure size about 15x larger, as of November 2021.)
     url = "https://github.com/be5invis/Sarasa-Gothic/releases/download/v${finalAttrs.version}/Sarasa-TTC-${finalAttrs.version}.zip";
-    hash = "sha256-J+VCrAVN+pNqij3QIkGDjz3EXePUCnUsEaPezaYOYXs=";
+    hash = "sha256-iM/AfX2Ws4/CVw7PWSNMTPz49WEK8m8RMFpsTUS7+CI=";
   };
 
   sourceRoot = ".";

pkgs/by-name/sc/scaleway-cli/package.nix

@@ -10,16 +10,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "scaleway-cli";
-  version = "2.50.0";
+  version = "2.51.0";
 
   src = fetchFromGitHub {
     owner = "scaleway";
     repo = "scaleway-cli";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-4c8ikz/ksulr1tfsIQDKbPYK3PwlmO0rtOn4n6ak3ZM=";
+    hash = "sha256-osA8YWvS2KqQtYmCRIAGw+/h3UPocW0sBn5IDhk/wWg=";
   };
 
-  vendorHash = "sha256-WIBeWQy4nterTEi8wqsy1bhlH6opXJDvtdxXU2jEv+Y=";
+  vendorHash = "sha256-s3G7zvTCg3voMur4YjHibqsHKLkB79iDgmMhv0C52yY=";
 
   env.CGO_ENABLED = 0;
 

pkgs/by-name/se/serie/package.nix

@@ -9,16 +9,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "serie";
-  version = "0.5.7";
+  version = "0.6.0";
 
   src = fetchFromGitHub {
     owner = "lusingander";
     repo = "serie";
     rev = "v${version}";
-    hash = "sha256-JWpqF19rZIw4GyKAzoGYsuCEDJOLDRiHRFJBsguISZ0=";
+    hash = "sha256-iHhm71z1DH2oDcgl5bwFVO0U5ks0LmoqMrlUZfIQkf4=";
   };
 
-  cargoHash = "sha256-0pJDz6R/3EJl7K+cuy9ftngvOig/DO52cyUgkdnWa10=";
+  cargoHash = "sha256-9jWXr/43zPe+7VpbRHj5k8eptXnhMKU073KAKJtG5+E=";
 
   nativeCheckInputs = [ gitMinimal ];
 

pkgs/by-name/sh/shoko/package.nix

@@ -12,13 +12,13 @@
 
 buildDotnetModule (finalAttrs: {
   pname = "shoko";
-  version = "5.2.1";
+  version = "5.2.4";
 
   src = fetchFromGitHub {
     owner = "ShokoAnime";
     repo = "ShokoServer";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-V8DwYLjxklKYmOnYNLp51GRJXgOXKnbgDD4DL4T4lVc=";
+    hash = "sha256-dV2q1eCCBsqe/zsmVoCyBpnbUXQ2tPoWWlZTypZLHV8=";
     fetchSubmodules = true;
   };
 

pkgs/by-name/sk/skia-aseprite/package.nix

@@ -2,6 +2,7 @@
   aseprite,
   clangStdenv,
   expat,
+  cctools,
   fetchFromGitHub,
   fetchgit,
   fontconfig,
@@ -38,6 +39,10 @@ clangStdenv.mkDerivation (finalAttrs: {
     gn
     ninja
     python3
+  ]
+  ++ lib.optionals clangStdenv.hostPlatform.isDarwin [
+    # Skia's build invokes `libtool -static` on Darwin to create `.a` archives.
+    cctools.libtool
   ];
 
   # Using substituteInPlace because no clean upstream backport for GCC 15 exists for this version of Skia, newer versions fix this with large refactorings.
@@ -68,13 +73,15 @@ clangStdenv.mkDerivation (finalAttrs: {
     expat
     fontconfig
     harfbuzzFull
-    libglvnd
     libjpeg
     libpng
     libwebp
+    zlib
+  ]
+  ++ lib.optionals clangStdenv.hostPlatform.isLinux [
+    libglvnd
     libX11
     libgbm
-    zlib
   ];
 
   buildPhase = ''

pkgs/by-name/sp/sptk/package.nix

@@ -4,26 +4,26 @@
   cmake,
   fetchFromGitHub,
   fetchpatch,
+  python3,
 }:
 
 stdenv.mkDerivation rec {
   pname = "sptk";
-  version = "4.2";
+  version = "4.4";
 
   src = fetchFromGitHub {
     owner = "sp-nitech";
     repo = "SPTK";
     rev = "v${version}";
-    hash = "sha256-lIyOcN2AR3ilUZ9stpicjbwlredbwgGPwmMICxZEijU=";
+    hash = "sha256-QdaXIFsFXL9/CtUJlOaUKOTmG/nm6ibBEsVfzW9pT/U=";
   };
 
   patches = [
-    # Fix gcc-13 build failure:
-    #   https://github.com/sp-nitech/SPTK/pull/57
+    # fix dangling symlinks: https://github.com/sp-nitech/SPTK/pull/90
     (fetchpatch {
-      name = "gcc-13.patch";
-      url = "https://github.com/sp-nitech/SPTK/commit/060bc2ad7a753c1f9f9114a70d4c4337b91cb7e0.patch";
-      hash = "sha256-QfzpIS63LZyTHAaMGUZh974XLRNZLQG3om7ZJJ4RlgE=";
+      name = "fix-dangling.patch";
+      url = "https://github.com/sp-nitech/SPTK/commit/8798c94d19e930c0947a7d1d0bc9e59a02aab567.patch";
+      hash = "sha256-G7yyJ0uiVzcP6wQVwiDpWVZOJmOpKZRfNyoETt3xam4=";
     })
   ];
 
@@ -31,6 +31,14 @@ stdenv.mkDerivation rec {
     cmake
   ];
 
+  buildInputs = [
+    (python3.withPackages (ps: [
+      ps.numpy
+      ps.plotly
+      ps.scipy
+    ]))
+  ];
+
   doCheck = true;
 
   meta = {

pkgs/by-name/sq/sqlitestudio/package.nix

@@ -14,13 +14,13 @@
 }:
 stdenv.mkDerivation rec {
   pname = "sqlitestudio";
-  version = "3.4.20";
+  version = "3.4.21";
 
   src = fetchFromGitHub {
     owner = "pawelsalawa";
     repo = "sqlitestudio";
     rev = version;
-    hash = "sha256-bylfbfYpXrXRolPmTRHEDyq6fjF1quVwwzg6q2XRmac=";
+    hash = "sha256-xs0+bB0gPoDkIldaTA/nFofx9KPvIcyxe6kzcHuboxA=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/ta/tart/package.nix

@@ -14,11 +14,11 @@
 }:
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "tart";
-  version = "2.30.0";
+  version = "2.30.3";
 
   src = fetchurl {
     url = "https://github.com/cirruslabs/tart/releases/download/${finalAttrs.version}/tart.tar.gz";
-    hash = "sha256-NUjF5hX+M12WcT+T/QXqHBFz2UOVm0NFtYzKGQmS6kg=";
+    hash = "sha256-dV+WxjY3dVF7oFpUNPyVk2nWupbn44dOff/Z6TUqPks=";
   };
   sourceRoot = ".";
 

pkgs/by-name/ta/taterclient-ddnet/package.nix

@@ -33,13 +33,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "taterclient-ddnet";
-  version = "10.7.0";
+  version = "10.8.1";
 
   src = fetchFromGitHub {
     owner = "TaterClient";
     repo = "TClient";
     tag = "V${finalAttrs.version}";
-    hash = "sha256-9d4vKrWuDW2E1PXs4yRAyR6zNPfYEclW8RfHNnpkpyc=";
+    hash = "sha256-yPGXbTxbj+hsdygC68TRtzVg+flEAxqNnhd9smbbekU=";
   };
 
   cargoDeps = rustPlatform.fetchCargoVendor {

pkgs/by-name/te/telepresence2/package.nix

@@ -44,13 +44,13 @@ let
 in
 buildGoModule rec {
   pname = "telepresence2";
-  version = "2.25.2";
+  version = "2.26.0";
 
   src = fetchFromGitHub {
     owner = "telepresenceio";
     repo = "telepresence";
     rev = "v${version}";
-    hash = "sha256-7QLx+t8Y9r8iO53gtbeK3SOEhYN6NZTWzCe+bhWl3JA=";
+    hash = "sha256-/WFTOFThqnUDCTkTTTj9Y6x5iaucH1H5/10mZGcyvQM=";
   };
 
   propagatedBuildInputs = [
@@ -72,7 +72,7 @@ buildGoModule rec {
     export CGO_ENABLED=0
   '';
 
-  vendorHash = "sha256-Zroh9/FKG+wm8nX+t+TpJQeT2nFi8UrzxAWnNAaMt8Q=";
+  vendorHash = "sha256-t7gQhMcB2T/hL6m+nH7G2ePiAUPCTtpKScfjB44QQCQ=";
 
   # ldflags copied from Makefile
   # ref: https://github.com/telepresenceio/telepresence/blob/7a2b9f553fb51ef252df957916c7b831bd65c1ce/build-aux/main.mk#L250-L251

pkgs/by-name/tu/turso-cli/package.nix

@@ -8,16 +8,16 @@
 }:
 buildGoModule rec {
   pname = "turso-cli";
-  version = "1.0.15";
+  version = "1.0.16";
 
   src = fetchFromGitHub {
     owner = "tursodatabase";
     repo = "turso-cli";
     rev = "v${version}";
-    hash = "sha256-c4RtEqMCpRgr4p6STWrRv7+UIA11WySTNhyvkLgzRso=";
+    hash = "sha256-X5rQ+bnyNlEek1mMgBW1SmeTIf5NSfxQvLxEQJuWOhU=";
   };
 
-  vendorHash = "sha256-tBO21IgUczwMgrEyV7scV3YTY898lYHASaLeXqvBopU=";
+  vendorHash = "sha256-Cb4/KA9jfI/pNHbJqLWtm9oEXfMHGBS46J9o3lL4/Tk=";
 
   nativeBuildInputs = [ installShellFiles ];
 

pkgs/by-name/va/vacuum-go/package.nix

@@ -7,14 +7,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "vacuum-go";
-  version = "0.23.3";
+  version = "0.23.4";
 
   src = fetchFromGitHub {
     owner = "daveshanley";
     repo = "vacuum";
-    # using refs/tags because simple version gives: 'the given path has multiple possibilities' error
     tag = "v${finalAttrs.version}";
-    hash = "sha256-Z++nFH1UquT+4CvW5bohQCXQGW7P0tFXFcfTvQWjMgg=";
+    hash = "sha256-6Y41AHhvgYaUheeEjaKCslyni93BoG+WwvJgIuMp8lQ=";
   };
 
   vendorHash = "sha256-kpW1i6LJUFMJArSHYMI4taTfAcfDH+E39GOBOKZFu+c=";

pkgs/by-name/ve/vesktop/package.nix

@@ -26,13 +26,13 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "vesktop";
-  version = "1.6.3";
+  version = "1.6.4";
 
   src = fetchFromGitHub {
     owner = "Vencord";
     repo = "Vesktop";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-Ceo66G9Dhz6cL4PlXXrM0Es9QrqFCvlaHgvP/c1aJfQ=";
+    hash = "sha256-jLaA6tHupiMdzZK42TLB1oqd9/5pt1TERJiRG4FIM7k=";
   };
 
   pnpmDeps = fetchPnpmDeps {
@@ -44,7 +44,7 @@ stdenv.mkDerivation (finalAttrs: {
       ;
     pnpm = pnpm_10;
     fetcherVersion = 2;
-    hash = "sha256-H5O08/2cWNj1KfYV1be+uYobDYGEdEfO0nlazbtiqvc=";
+    hash = "sha256-V38oQAhj4PBuaFXyeEHdBKaTXeIdeqNk887gPSmtZoU=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/vi/victoriametrics/package.nix

@@ -13,13 +13,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "VictoriaMetrics";
-  version = "1.133.0";
+  version = "1.134.0";
 
   src = fetchFromGitHub {
     owner = "VictoriaMetrics";
     repo = "VictoriaMetrics";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-Svl/yFacg1/XI0BaBWeWLRxwBwUZJjRELlYLky+ihus=";
+    hash = "sha256-66iiAxm9vtBgDeZQ6g5B6uGTkv4k0nX3uTUEV6UwmWE=";
   };
 
   vendorHash = null;

pkgs/by-name/vi/victoriatraces/package.nix

@@ -13,13 +13,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "VictoriaTraces";
-  version = "0.6.0";
+  version = "0.7.0";
 
   src = fetchFromGitHub {
     owner = "VictoriaMetrics";
     repo = "VictoriaTraces";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-gXdOPRC3oxMAimMc4v0CjTb224qiocFY9/1PFH4hbRw=";
+    hash = "sha256-MWPw2SJlqjQCyBYT++A0KcwccdpTP7Ome4RfA7lcjAM=";
   };
 
   vendorHash = null;

pkgs/by-name/wh/whosthere/package.nix

@@ -0,0 +1,49 @@
+{
+  buildGoModule,
+  fetchFromGitHub,
+  lib,
+  nix-update-script,
+  testers,
+  whosthere,
+}:
+
+buildGoModule (finalAttrs: {
+  pname = "whosthere";
+  version = "0.2.1";
+
+  src = fetchFromGitHub {
+    owner = "ramonvermeulen";
+    repo = "whosthere";
+    tag = "v${finalAttrs.version}";
+    sha256 = "sha256-jwXJ+mF3r+Xg3lyQzwzfGp3TmfVjnxO9Lg272zeTREY=";
+  };
+
+  vendorHash = "sha256-ZiomQ+Md0kFkq7nERsnLZwkA9nlcvglMtzJV7NX3Igs=";
+
+  checkFlags =
+    let
+      # Skip tests that require filesystem access
+      skippedTests = [
+        "TestResolveLogPath"
+        "TestStateDir"
+      ];
+    in
+    [ "-skip=^${builtins.concatStringsSep "$|^" skippedTests}$" ];
+
+  passthru.updateScript = nix-update-script { };
+  passthru.tests.version = testers.testVersion { package = whosthere; };
+
+  meta = {
+    description = "Local Area Network discovery tool";
+    longDescription = ''
+      Local Area Network discovery tool with a modern Terminal User Interface
+      (TUI) written in Go. Discover, explore, and understand your LAN in an
+      intuitive way. Knock Knock.. who's there?
+    '';
+    homepage = "https://github.com/ramonvermeulen/whosthere";
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ matthiasbeyer ];
+    platforms = lib.platforms.linux;
+    mainProgram = "whosthere";
+  };
+})

pkgs/development/haskell-modules/configuration-common.nix

@@ -1854,7 +1854,6 @@ with haskellLib;
       # PATH.
       deps = [
         pkgs.git
-        pkgs.nix
         pkgs.nix-prefetch-git
       ];
     in
@@ -1868,7 +1867,9 @@ with haskellLib;
           wrapProgram "$out/bin/update-nix-fetchgit" --prefix 'PATH' ':' "${lib.makeBinPath deps}"
         '';
       }))
-      (addTestToolDepends deps)
+      # pkgs.nix is not added to the wrapper since we can resonably expect it to be installed
+      # and we don't know which implementation the eventual user prefers
+      (addTestToolDepends (deps ++ [ pkgs.nix ]))
       # Patch for hnix compat.
       (appendPatches [
         (fetchpatch {
@@ -2038,6 +2039,7 @@ with haskellLib;
   cli-git = addBuildTool pkgs.git super.cli-git;
 
   cli-nix = addBuildTools [
+    # Required due to https://github.com/obsidiansystems/cli-nix/issues/11
     pkgs.nix
     pkgs.nix-prefetch-git
   ] super.cli-nix;

pkgs/development/haskell-modules/configuration-nix.nix

@@ -262,12 +262,7 @@ builtins.intersectAttrs super {
   ghc-debug-brick = enableSeparateBinOutput super.ghc-debug-brick;
   nixfmt = enableSeparateBinOutput super.nixfmt;
   calligraphy = enableSeparateBinOutput super.calligraphy;
-  niv = overrideCabal (drv: {
-    buildTools = (drv.buildTools or [ ]) ++ [ pkgs.buildPackages.makeWrapper ];
-    postInstall = ''
-      wrapProgram ''${!outputBin}/bin/niv --prefix PATH : ${pkgs.lib.makeBinPath [ pkgs.nix ]}
-    '';
-  }) (enableSeparateBinOutput (self.generateOptparseApplicativeCompletions [ "niv" ] super.niv));
+  niv = enableSeparateBinOutput (self.generateOptparseApplicativeCompletions [ "niv" ] super.niv);
   ghcid = enableSeparateBinOutput super.ghcid;
   ormolu = self.generateOptparseApplicativeCompletions [ "ormolu" ] (
     enableSeparateBinOutput super.ormolu
@@ -1596,7 +1591,6 @@ builtins.intersectAttrs super {
           wrapProgram "$out/bin/nvfetcher" --prefix 'PATH' ':' "${
             pkgs.lib.makeBinPath [
               pkgs.nvchecker
-              pkgs.nix # nix-prefetch-url
               pkgs.nix-prefetch-git
               pkgs.nix-prefetch-docker
             ]

pkgs/development/interpreters/bqn/cbqn/default.nix

@@ -113,16 +113,8 @@ stdenv.mkDerivation {
     # main test suite from mlochbaum/BQN
     $out/bin/BQN ${mbqn-source}/test/this.bqn
 
-    # CBQN tests that do not require compiling with test-only flags
-    $out/bin/BQN test/cmp.bqn
-    $out/bin/BQN test/equal.bqn
-    $out/bin/BQN test/copy.bqn
-    $out/bin/BQN test/bit.bqn
-    $out/bin/BQN test/hash.bqn
-    $out/bin/BQN test/squeezeValid.bqn
-    $out/bin/BQN test/squeezeExact.bqn
-    $out/bin/BQN test/various.bqn
-    $out/bin/BQN test/random.bqn
+    # run tests in test/cases/
+    $out/bin/BQN test/run.bqn lint
 
     runHook postInstallCheck
   '';

pkgs/development/interpreters/bqn/cbqn/sources.nix

@@ -11,13 +11,13 @@
     let
       self = {
         pname = "cbqn";
-        version = "0.9.0";
+        version = "0.10.0";
 
         src = fetchFromGitHub {
           owner = "dzaima";
           repo = "CBQN";
           rev = "v${self.version}";
-          hash = "sha256-WGQvnNVnNkz0PR/E5L05KvaaRZ9hgt9gNdzsR9OFYxA=";
+          hash = "sha256-RZIxIRlx1SSYP+WrMRvg6nUqqs4zqEaGPvFyY3WFgbU=";
         };
       };
     in
@@ -25,37 +25,37 @@
 
   cbqn-bytecode = {
     pname = "cbqn-bytecode";
-    version = "0-unstable-2025-03-16";
+    version = "0-unstable-2025-11-24";
 
     src = fetchFromGitHub {
       owner = "dzaima";
       repo = "cbqnBytecode";
-      rev = "0bdfb86d438a970b983afbca93011ebd92152b88";
-      hash = "sha256-oUM4UwLy9tusTFLlaZbbHfFqKEcqd9Mh4tTqiyvMyvo=";
+      rev = "cca48b93b2e3260d2fa371c578d94cf044e39042";
+      hash = "sha256-xBjXlzWhbsKjiknnncVRkh9VlUNzaxYVNB7BhZTI/r4=";
     };
   };
 
   replxx = {
     pname = "replxx";
-    version = "0-unstable-2023-10-31";
+    version = "0-unstable-2025-05-20";
 
     src = fetchFromGitHub {
       owner = "dzaima";
       repo = "replxx";
-      rev = "13f7b60f4f79c2f14f352a76d94860bad0fc7ce9";
-      hash = "sha256-xPuQ5YBDSqhZCwssbaN/FcTZlc3ampYl7nfl2bbsgBA=";
+      rev = "c1ce5b0bcabd96ec93ebf630a85619295ec7c2f3";
+      hash = "sha256-4TEjJdF0FAIT69uVMp0y4bFFrRda1CXC/bLX6mrUTA0=";
     };
   };
 
   singeli = {
     pname = "singeli";
-    version = "0-unstable-2025-03-13";
+    version = "0-unstable-2025-11-19";
 
     src = fetchFromGitHub {
       owner = "mlochbaum";
       repo = "Singeli";
-      rev = "53f42ce4331176d281fa577408ec5a652bdd9127";
-      hash = "sha256-NbCNd/m0SdX2/aabeOhAzEYc5CcT/r75NR5ScuYj77c=";
+      rev = "2936c66b061b9df61cafc1f8d07a7ed53bf10bee";
+      hash = "sha256-vxxGmc0eQxKZN7G0GCGx7xjOWgB1a1jJIcbfbaQd2do=";
     };
   };
 }

pkgs/development/libraries/mesa/common.nix

@@ -5,14 +5,14 @@
 # nix build .#legacyPackages.x86_64-darwin.mesa .#legacyPackages.aarch64-darwin.mesa
 rec {
   pname = "mesa";
-  version = "25.3.3";
+  version = "25.3.4";
 
   src = fetchFromGitLab {
     domain = "gitlab.freedesktop.org";
     owner = "mesa";
     repo = "mesa";
     rev = "mesa-${version}";
-    hash = "sha256-CMZsnphyOmaU5YzAHyyahz2UrYtJknYvWX1wbx9RUmQ=";
+    hash = "sha256-4nHB47hbTzB9zo4vDdBFM6WF6u9O6MnZ10wHyG8L7WU=";
   };
 
   meta = {

pkgs/development/libraries/mesa/default.nix

@@ -147,7 +147,6 @@ stdenv.mkDerivation {
 
   patches = [
     ./opencl.patch
-    ./musl.patch
   ];
 
   postPatch = ''

pkgs/development/libraries/mesa/musl.patch

@@ -1,39 +0,0 @@
-From 571dedac8881649cd94c59488413b835cbcf0498 Mon Sep 17 00:00:00 2001
-From: Alyssa Ross <hi@alyssa.is>
-Date: Thu, 20 Nov 2025 23:16:47 +0100
-Subject: [PATCH] rocket: fix building for musl
-
-musl follows POSIX and provides ioctl as int ioctl(int, int, ...).
-
-Fixes: 5b829658f74 ("rocket: Initial commit of a driver for Rockchip's NPU")
-Signed-off-by: Alyssa Ross <hi@alyssa.is>
-Link: https://gitlab.freedesktop.org/mesa/mesa/-/merge_requests/38561
----
- src/gallium/drivers/rocket/intercept.c | 10 ++++++++--
- 1 file changed, 8 insertions(+), 2 deletions(-)
-
-diff --git a/src/gallium/drivers/rocket/intercept.c b/src/gallium/drivers/rocket/intercept.c
-index 6ffb8647d61f5..88e55893d9520 100644
---- a/src/gallium/drivers/rocket/intercept.c
-+++ b/src/gallium/drivers/rocket/intercept.c
-@@ -294,9 +294,15 @@ handle_action(struct rknpu_action *args)
-    }
- }
- 
--typedef int (*real_ioctl_t)(int fd, unsigned long request, ...);
-+#ifdef __GLIBC__
-+typedef unsigned long ioctl_req;
-+#else
-+typedef int ioctl_req; // per POSIX
-+#endif
-+
-+typedef int (*real_ioctl_t)(int fd, ioctl_req request, ...);
- int
--ioctl(int fd, unsigned long request, ...)
-+ioctl(int fd, ioctl_req request, ...)
- {
-    int ret;
-    uint32_t output_address = 0;
--- 
-GitLab
-

pkgs/development/libraries/science/math/libtorch/bin.nix

@@ -3,15 +3,17 @@
   stdenv,
   fetchzip,
   lib,
-  libcxx,
   llvmPackages,
   config,
 
-  addDriverRunpath,
+  autoAddDriverRunpath,
+  autoPatchelfHook,
   patchelf,
   fixDarwinDylibNames,
 
   cudaSupport ? config.cudaSupport,
+  cudaPackages_13,
+  libz,
 }:
 
 let
@@ -35,7 +37,11 @@ stdenv.mkDerivation {
     if stdenv.hostPlatform.isDarwin then
       [ fixDarwinDylibNames ]
     else
-      [ patchelf ] ++ lib.optionals cudaSupport [ addDriverRunpath ];
+      [
+        patchelf
+        autoPatchelfHook
+      ]
+      ++ lib.optionals cudaSupport [ autoAddDriverRunpath ];
 
   dontBuild = true;
   dontConfigure = true;
@@ -63,7 +69,17 @@ stdenv.mkDerivation {
 
   postFixup =
     let
-      rpath = lib.makeLibraryPath [ stdenv.cc.cc ];
+      rpath = lib.makeLibraryPath (
+        [ stdenv.cc.cc ]
+        ++ lib.optionals cudaSupport [
+          cudaPackages_13.cuda_cudart # libcuda.so
+          cudaPackages_13.libcufft
+          cudaPackages_13.libcurand
+          cudaPackages_13.libcusolver
+          cudaPackages_13.libcusparse
+          libz
+        ]
+      );
     in
     lib.optionalString stdenv.hostPlatform.isLinux ''
       find $out/lib -type f \( -name '*.so' -or -name '*.so.*' \) | while read lib; do

pkgs/development/python-modules/cs50/default.nix

@@ -13,14 +13,14 @@
 
 buildPythonPackage rec {
   pname = "cs50";
-  version = "9.4.0";
+  version = "9.5.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "cs50";
     repo = "python-cs50";
     tag = "v${version}";
-    hash = "sha256-g7ws5ikzLt2ciS0QTPTJDRAqePyYPDCYIpJuwnWHJNQ=";
+    hash = "sha256-jJji5EyvKfJ9vkzETsh0CJ9WIi7hWF2amHrOvf4/JbI=";
   };
 
   build-system = [

pkgs/development/python-modules/fast-array-utils/default.nix

@@ -1,22 +1,48 @@
 {
+  lib,
   buildPythonPackage,
-  dask,
   fetchFromGitHub,
+
+  # build-system
   hatch-docstring-description,
   hatch-fancy-pypi-readme,
   hatch-min-requirements,
   hatch-vcs,
   hatchling,
-  lib,
-  numba,
+
+  # dependencies
   numpy,
+
+  # optional-dependencies
+  # accel
+  numba,
+  # dask
+  dask,
+  # doc
+  furo,
+  pytest,
+  sphinx,
+  sphinx-autodoc-typehints,
+  # full
+  h5py,
+  zarr,
+  # test
+  anndata,
+  numcodecs,
+  # test-min
+  coverage,
   pytest-codspeed,
   pytest-doctestplus,
+  pytest-xdist,
+  # testing
+  packaging,
+
+  # tests
   pytestCheckHook,
   scipy,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "fast-array-utils";
   version = "1.3.1";
   pyproject = true;
@@ -24,7 +50,7 @@ buildPythonPackage rec {
   src = fetchFromGitHub {
     owner = "scverse";
     repo = "fast-array-utils";
-    tag = "v${version}";
+    tag = "v${finalAttrs.version}";
     hash = "sha256-FUzCdDFDqP+izlSWruWzslfPayzRN7MFx1LOikyMDss=";
   };
 
@@ -43,6 +69,53 @@ buildPythonPackage rec {
     numpy
   ];
 
+  optional-dependencies = lib.fix (self: {
+    accel = [
+      numba
+    ];
+    dask = [
+      dask
+    ];
+    doc = [
+      furo
+      pytest
+      # scanpydoc
+      sphinx
+      sphinx-autodoc-typehints
+      # sphinx-autofixture
+    ];
+    full = [
+      h5py
+      zarr
+    ]
+    ++ self.accel
+    ++ self.dask
+    ++ self.sparse;
+    sparse = [
+      scipy
+    ];
+    test = [
+      anndata
+      numcodecs
+      zarr
+    ]
+    ++ self.accel
+    ++ self.test-min;
+    test-min = [
+      coverage
+      pytest
+      pytest-codspeed
+      pytest-doctestplus
+      pytest-xdist
+    ]
+    ++ coverage.optional-dependencies.toml
+    ++ self.sparse
+    ++ self.testing;
+    testing = [
+      packaging
+    ];
+  });
+
   nativeCheckInputs = [
     dask
     numba
@@ -62,9 +135,10 @@ buildPythonPackage rec {
   meta = {
     description = "Fast array utilities";
     homepage = "https://icb-fast-array-utils.readthedocs-hosted.com";
+    changelog = "https://github.com/scverse/fast-array-utils/releases/tag/${finalAttrs.src.tag}";
     license = lib.licenses.mpl20;
     maintainers = with lib.maintainers; [
       samuela
     ];
   };
-}
+})

pkgs/development/python-modules/langgraph-runtime-inmem/default.nix

@@ -13,14 +13,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "langgraph-runtime-inmem";
-  version = "0.22.1";
+  version = "0.23.1";
   pyproject = true;
 
   # Not available in any repository
   src = fetchPypi {
     pname = "langgraph_runtime_inmem";
     inherit (finalAttrs) version;
-    hash = "sha256-u9mDl13Dcq1c1SiCY9NHFzKw3/K6s8b0Hl/ls6OOoe4=";
+    hash = "sha256-94VLsnQt15eujRmlHTty1iGLUcuWGvT+m0N7tQcQiQs=";
   };
 
   build-system = [ hatchling ];

pkgs/development/python-modules/llama-index-workflows/default.nix

@@ -10,13 +10,13 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "llama-index-workflows";
-  version = "2.12.2";
+  version = "2.13.0";
   pyproject = true;
 
   src = fetchPypi {
     pname = "llama_index_workflows";
     inherit (finalAttrs) version;
-    hash = "sha256-N+Bc00g8ZPQQF2/mFNuMhLb0L8Ms2ts8yKyN4Y8BqXs=";
+    hash = "sha256-hIVNkT9GUEX6ZQOp18e1t4X7O8ul/pqWHDaxQD4fD1I=";
   };
 
   postPatch = ''

pkgs/development/python-modules/mautrix/default.nix

@@ -79,7 +79,6 @@ buildPythonPackage rec {
     license = lib.licenses.mpl20;
     maintainers = with lib.maintainers; [
       nyanloutre
-      ma27
       sumnerevans
       nickcao
     ];

pkgs/development/python-modules/oelint-data/default.nix

@@ -8,14 +8,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "oelint-data";
-  version = "1.3.3";
+  version = "1.3.4";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "priv-kweihmann";
     repo = "oelint-data";
     tag = finalAttrs.version;
-    hash = "sha256-5eEhr2Jt6Ucco1/3zMGSq5SNcco8FMdJn583qBJmxk0=";
+    hash = "sha256-TN37FfLPBRrVZ8BKqp7If9EBK8JkyUAdwztHjIJX2Bc=";
   };
 
   build-system = [

pkgs/development/python-modules/posthog/default.nix

@@ -22,14 +22,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "posthog";
-  version = "7.5.1";
+  version = "7.6.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "PostHog";
     repo = "posthog-python";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-bIWgVi3HVBgomrG7plbLhMEwF0LS/0hNSDDU8vJpWOg=";
+    hash = "sha256-eMfFiNqILLom1Q4uCY76LOJijqnzD07KgD69GCxexGY=";
   };
 
   build-system = [ setuptools ];

pkgs/development/python-modules/qcelemental/default.nix

@@ -2,8 +2,10 @@
   stdenv,
   buildPythonPackage,
   lib,
+  pythonAtLeast,
   fetchPypi,
   poetry-core,
+  setuptools,
   ipykernel,
   networkx,
   numpy,
@@ -16,15 +18,18 @@
 
 buildPythonPackage rec {
   pname = "qcelemental";
-  version = "0.29.0";
+  version = "0.30.0";
   pyproject = true;
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-v2NO5lLn2V6QbikZiVEyJCM7HXBcJq/qyG5FHzFrPAQ=";
+    hash = "sha256-nIW38ReKgE1FA0r55TOOsAOlvtAV3fIQexTsyqx4r4g=";
   };
 
-  build-system = [ poetry-core ];
+  build-system = [
+    poetry-core
+    setuptools
+  ];
 
   dependencies = [
     numpy
@@ -49,7 +54,7 @@ buildPythonPackage rec {
   pythonImportsCheck = [ "qcelemental" ];
 
   meta = {
-    broken = stdenv.hostPlatform.isDarwin;
+    broken = stdenv.hostPlatform.isDarwin || pythonAtLeast "3.14"; # https://github.com/MolSSI/QCElemental/issues/375
     description = "Periodic table, physical constants and molecule parsing for quantum chemistry";
     homepage = "https://github.com/MolSSI/QCElemental";
     changelog = "https://github.com/MolSSI/QCElemental/blob/v${version}/docs/changelog.rst";

pkgs/development/python-modules/qcengine/default.nix

@@ -2,6 +2,7 @@
   lib,
   buildPythonPackage,
   fetchPypi,
+  pythonAtLeast,
   ipykernel,
   msgpack,
   networkx,
@@ -19,12 +20,12 @@
 
 buildPythonPackage rec {
   pname = "qcengine";
-  version = "0.33.0";
+  version = "0.34.0";
   pyproject = true;
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-Ute8puO2qc679ttZgzQRnVO8OuBmYnqLT3y7faHpRgA=";
+    hash = "sha256-VKULy45bYn5TmxU7TbOVK98r0pRMWAwissmgx0Ee/8w=";
   };
 
   build-system = [ setuptools ];
@@ -60,5 +61,6 @@ buildPythonPackage rec {
     license = lib.licenses.bsd3;
     maintainers = with lib.maintainers; [ sheepforce ];
     mainProgram = "qcengine";
+    broken = pythonAtLeast "3.14"; # https://github.com/MolSSI/QCEngine/issues/481
   };
 }

pkgs/development/python-modules/scanpy/default.nix

@@ -2,9 +2,14 @@
   lib,
   buildPythonPackage,
   fetchFromGitHub,
+
+  # build-system
   hatch-vcs,
   hatchling,
+
+  # dependencies
   anndata,
+  fast-array-utils,
   h5py,
   joblib,
   legacy-api-wrap,
@@ -25,35 +30,54 @@
   tqdm,
   typing-extensions,
   umap-learn,
-  dask,
-  dask-ml,
 
+  # optional-attrs
+  # dask
+  dask,
+  # dask-ml
+  dask-ml,
+  # leiden
   igraph,
   leidenalg,
+  # scrublet
   scikit-image,
+  # skmisc
   scikit-misc,
-  zarr,
-  pytestCheckHook,
+
+  # tests
+  jinja2,
   pytest-cov-stub,
   pytest-mock,
   pytest-randomly,
   pytest-rerunfailures,
   pytest-xdist,
+  pytestCheckHook,
   tuna,
+  writableTmpDirAsHomeHook,
+  zarr,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "scanpy";
-  version = "1.11.5";
+  version = "1.12.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "scverse";
     repo = "scanpy";
-    tag = version;
-    hash = "sha256-GnZ1qJ4SaTLDzfLAH6IHrYeuMBo8PglKUlj4f3ljeR0=";
+    tag = finalAttrs.version;
+    hash = "sha256-jpi3SyTaG5mxCqUNSM564MMIrNdz4LBYo9+dn5nYmeY=";
   };
 
+  # Otherwise, several tests fail to be collected:
+  # AssertionError: scanpy is already imported, this will mess up test coverage
+  postPatch = ''
+    substituteInPlace src/testing/scanpy/_pytest/__init__.py \
+      --replace-fail \
+        'assert "scanpy" not in sys.modules,' \
+        'assert True,'
+  '';
+
   build-system = [
     hatch-vcs
     hatchling
@@ -61,6 +85,7 @@ buildPythonPackage rec {
 
   dependencies = [
     anndata
+    fast-array-utils
     h5py
     joblib
     legacy-api-wrap
@@ -81,7 +106,9 @@ buildPythonPackage rec {
     tqdm
     typing-extensions
     umap-learn
-  ];
+  ]
+  ++ fast-array-utils.optional-dependencies.accel
+  ++ fast-array-utils.optional-dependencies.sparse;
 
   optional-dependencies = {
     # commented attributes are due to some dependencies not being in Nixpkgs
@@ -129,13 +156,15 @@ buildPythonPackage rec {
   };
 
   nativeCheckInputs = [
-    pytestCheckHook
+    jinja2
     pytest-cov-stub
     pytest-mock
     pytest-randomly
     pytest-rerunfailures
     pytest-xdist
+    pytestCheckHook
     tuna
+    writableTmpDirAsHomeHook
     zarr
   ];
 
@@ -151,35 +180,57 @@ buildPythonPackage rec {
     "tests/test_pca.py"
     "tests/test_plotting.py"
     "tests/test_plotting_embedded/"
+
+    # fixture 'backed_adata' not found
+    "tests/test_backed.py"
   ];
 
   disabledTests = [
     # try to download data:
     "scanpy.get._aggregated.aggregate"
     "scanpy.plotting._tools.scatterplots.spatial"
+    "test_burczynski06"
     "test_clip"
+    "test_doc_shape"
     "test_download_failure"
+    "test_ebi_expression_atlas"
     "test_mean_var"
+    "test_paul15"
+    "test_pbmc3k"
+    "test_pbmc3k_processed"
     "test_regress_out_int"
     "test_score_with_reference"
+    "test_visium_datasets"
+    "test_visium_datasets_dir_change"
+    "test_visium_datasets_images"
 
     # fails to find the trivial test script for some reason:
     "test_external"
 
+    # fixture 'original_settings' not found
+    "test_defaults"
+
     # AssertionError: Not equal to tolerance rtol=1e-07, atol=0
     "test_connectivities_euclidean"
+
+    # assert sc.settings.autoshow
+    # AssertionError: assert False
+    "test_resets"
+
+    # FileNotFoundError: [Errno 2] Unable to synchronously create file (unable to open file: name =
+    # 'write/test.h5ad', errno = 2, error message = 'No such file or directory', flags = 13, o_flags
+    # = 242)
+    "test_write"
   ];
 
-  pythonImportsCheck = [
-    "scanpy"
-  ];
+  pythonImportsCheck = [ "scanpy" ];
 
   meta = {
     description = "Single-cell analysis in Python which scales to >100M cells";
     homepage = "https://scanpy.readthedocs.io";
-    changelog = "https://github.com/scverse/scanpy/releases/tag/${src.tag}";
+    changelog = "https://github.com/scverse/scanpy/releases/tag/${finalAttrs.src.tag}";
     license = lib.licenses.bsd3;
     maintainers = with lib.maintainers; [ bcdarwin ];
     mainProgram = "scanpy";
   };
-}
+})

pkgs/os-specific/linux/wpa_supplicant/default.nix

@@ -177,7 +177,6 @@ stdenv.mkDerivation rec {
     license = lib.licenses.bsd3;
     maintainers = with lib.maintainers; [
       marcweber
-      ma27
     ];
     platforms = lib.platforms.linux;
   };

pkgs/servers/http/angie/console-light.nix

@@ -6,12 +6,12 @@
 }:
 
 stdenv.mkDerivation rec {
-  version = "1.8.1";
+  version = "1.8.2";
   pname = "angie-console-light";
 
   src = fetchurl {
     url = "https://download.angie.software/files/${pname}/${pname}-${version}.tar.gz";
-    hash = "sha256-yKKwkvLsBFVNc0Uv9iDMhhinuXAukJI9k9ZG5Amhgfs=";
+    hash = "sha256-q27UPgWvOoEXa8Ih3sEFuoO7u5gvLtpoe7ZJYMmZtRc=";
   };
 
   outputs = [

pkgs/servers/mautrix-telegram/default.nix

@@ -86,7 +86,6 @@ python.pkgs.buildPythonPackage rec {
     platforms = lib.platforms.linux;
     maintainers = with lib.maintainers; [
       nyanloutre
-      ma27
       nickcao
     ];
     mainProgram = "mautrix-telegram";

pkgs/tools/security/pass/default.nix

@@ -198,7 +198,6 @@ stdenv.mkDerivation rec {
       fpletz
       tadfisher
       globin
-      ma27
       ryan4yin
     ];
     platforms = lib.platforms.unix;

pkgs/top-level/aliases.nix

@@ -831,6 +831,7 @@ mapAliases {
   http-prompt = throw "'http-prompt' has been removed as it was broken and unmaintained upstream"; # Added 2025-11-26
   hydra_unstable = throw "'hydra_unstable' has been renamed to/replaced by 'hydra'"; # Converted to throw 2025-10-27
   i3-gaps = throw "'i3-gaps' has been renamed to/replaced by 'i3'"; # Converted to throw 2025-10-27
+  i3lock-pixeled = throw "'i3lock-pixeled' has been unmaintained for several years now."; # Converted to throw 2026-01-24
   ibm-sw-tpm2 = throw "ibm-sw-tpm2 has been removed, as it was broken"; # Added 2025-08-25
   igvm-tooling = throw "'igvm-tooling' has been removed as it is poorly maintained upstream and a dependency has been marked insecure."; # Added 2025-09-03
   ikos = throw "ikos has been removed, as it does not build with supported LLVM versions"; # Added 2025-08-10

pkgs/top-level/all-packages.nix

@@ -1687,7 +1687,6 @@ with pkgs;
       wrapProgram $out/bin/cabal2nix \
         --prefix PATH ":" "${
           lib.makeBinPath [
-            nix
             nix-prefetch-scripts
           ]
         }"