Merge branch 'master' into staging-next

ci/github-script/bot.js

@@ -481,22 +481,6 @@ module.exports = async ({ github, context, core, dry }) => {
         },
       )
 
-      if (item.pull_request || context.payload.pull_request) {
-        stats.prs++
-        Object.assign(
-          itemLabels,
-          await handlePullRequest({ item, stats, events }),
-        )
-      } else {
-        stats.issues++
-        if (item.labels.some(({ name }) => name === '4.workflow: auto-close')) {
-          // If this returns true, the issue was closed. In this case we return, to not
-          // label the issue anymore. Most importantly this avoids unlabeling stale issues
-          // which are closed via auto-close.
-          if (await handleAutoClose(item)) return
-        }
-      }
-
       const latest_event_at = new Date(
         events
           .filter(({ event }) =>
@@ -537,6 +521,29 @@ module.exports = async ({ github, context, core, dry }) => {
       log('latest_event_at', latest_event_at.toISOString())
 
       const stale_at = new Date(new Date().setDate(new Date().getDate() - 180))
+      const is_stale = latest_event_at < stale_at
+
+      if (item.pull_request || context.payload.pull_request) {
+        // No need to compute merge commits for stale PRs over and over again.
+        // This increases the repo size on GitHub's side unnecessarily and wastes
+        // a lot of API requests, too. Any relevant change will result in the
+        // stale status to change and thus pick up the PR again for labeling.
+        if (!is_stale) {
+          stats.prs++
+          Object.assign(
+            itemLabels,
+            await handlePullRequest({ item, stats, events }),
+          )
+        }
+      } else {
+        stats.issues++
+        if (item.labels.some(({ name }) => name === '4.workflow: auto-close')) {
+          // If this returns true, the issue was closed. In this case we return, to not
+          // label the issue anymore. Most importantly this avoids unlabeling stale issues
+          // which are closed via auto-close.
+          if (await handleAutoClose(item)) return
+        }
+      }
 
       // Create a map (Label -> Boolean) of all currently set labels.
       // Each label is set to True and can be disabled later.
@@ -550,8 +557,7 @@ module.exports = async ({ github, context, core, dry }) => {
       )
 
       Object.assign(itemLabels, {
-        '2.status: stale':
-          !before['1.severity: security'] && latest_event_at < stale_at,
+        '2.status: stale': !before['1.severity: security'] && is_stale,
       })
 
       const after = Object.assign({}, before, itemLabels)

flake.nix

@@ -113,7 +113,7 @@
             (
               self.legacyPackages.${system}.stdenv.hostPlatform.isLinux
               # Exclude power64 due to "libressl is not available on the requested hostPlatform" with hostPlatform being power64
-              && !self.legacyPackages.${system}.targetPlatform.isPower64
+              && !self.legacyPackages.${system}.stdenv.targetPlatform.isPower64
               # Exclude armv6l-linux because "cannot bootstrap GHC on this platform ('armv6l-linux' with libc 'defaultLibc')"
               && system != "armv6l-linux"
               # Exclude riscv64-linux because "cannot bootstrap GHC on this platform ('riscv64-linux' with libc 'defaultLibc')"

maintainers/maintainer-list.nix

@@ -2768,6 +2768,12 @@
     githubId = 333807;
     name = "Pascal Bach";
   };
+  backtail = {
+    name = "Max Genson";
+    email = "mail@maxgenson.de";
+    github = "backtail";
+    githubId = 95583524;
+  };
   backuitist = {
     email = "biethb@gmail.com";
     github = "backuitist";
@@ -6696,6 +6702,11 @@
     githubId = 5251658;
     name = "Dominic Mills";
   };
+  dmitriiStepanidenko = {
+    github = "dmitriiStepanidenko";
+    githubId = 93157285;
+    name = "Dmitrii Stepanidenko";
+  };
   DmitryTsygankov = {
     email = "dmitry.tsygankov@gmail.com";
     github = "DmitryTsygankov";

nixos/doc/manual/release-notes/rl-2511.section.md

@@ -158,6 +158,8 @@
 
 - [pmount](https://salsa.debian.org/debian/pmount), a tool that allows normal users to mount removable devices without requiring root privileges Available at [programs.pmount](#opt-programs.pmount.enable).
 
+- [rauc](https://rauc.io/) (the Robust Auto-Update Controller), a daemon that allows reliable and secure software updates in embedded Linux systems. Available at [services.rauc](#opt-services.rauc.enable).
+
 - [lemurs](https://github.com/coastalwhite/lemurs), a customizable TUI display/login manager. Available at [services.displayManager.lemurs](#opt-services.displayManager.lemurs.enable).
 
 - [docuseal](https://github.com/docusealco/docuseal), a DocuSign alternative. Create, fill, and sign digital documents. Available at [services.docuseal](#opt-services.docuseal.enable).

nixos/modules/module-list.nix

@@ -678,6 +678,7 @@
   ./services/hardware/powerstation.nix
   ./services/hardware/rasdaemon.nix
   ./services/hardware/ratbagd.nix
+  ./services/hardware/rauc.nix
   ./services/hardware/sane.nix
   ./services/hardware/sane_extra_backends/brscan4.nix
   ./services/hardware/sane_extra_backends/brscan5.nix

nixos/modules/services/audio/music-assistant.nix

@@ -26,6 +26,9 @@ let
   finalPackage = cfg.package.override {
     inherit (cfg) providers;
   };
+
+  # YouTube Music needs deno with JIT to solve yt-dlp challenges
+  useYTMusic = lib.elem "ytmusic" cfg.providers;
 in
 
 {
@@ -89,6 +92,10 @@ in
         ]
         ++ lib.optionals (lib.elem "snapcast" cfg.providers) [
           snapcast
+        ]
+        ++ lib.optionals useYTMusic [
+          deno
+          ffmpeg
         ];
 
       serviceConfig = {
@@ -104,7 +111,7 @@ in
         CapabilityBoundingSet = [ "" ];
         DevicePolicy = "closed";
         LockPersonality = true;
-        MemoryDenyWriteExecute = true;
+        MemoryDenyWriteExecute = !useYTMusic;
         ProcSubset = "pid";
         ProtectClock = true;
         ProtectControlGroups = true;
@@ -125,6 +132,9 @@ in
         SystemCallFilter = [
           "@system-service"
           "~@privileged @resources"
+        ]
+        ++ lib.optionals useYTMusic [
+          "@pkey"
         ];
         RestrictSUIDSGID = true;
         UMask = "0077";

nixos/modules/services/games/minetest-server.nix

@@ -172,12 +172,9 @@ in
       serviceConfig.Restart = "always";
       serviceConfig.User = "minetest";
       serviceConfig.Group = "minetest";
-
-      script = ''
-        cd /var/lib/minetest
-
-        exec ${pkgs.minetest}/bin/minetest ${lib.escapeShellArgs flags}
-      '';
+      serviceConfig.StateDirectory = "minetest";
+      serviceConfig.WorkingDirectory = "/var/lib/minetest";
+      serviceConfig.ExecStart = "${pkgs.luanti}/bin/luanti ${lib.escapeShellArgs flags}";
     };
   };
 }

nixos/modules/services/hardware/rauc.nix

@@ -0,0 +1,196 @@
+{
+  lib,
+  pkgs,
+  config,
+  ...
+}:
+
+let
+  inherit (lib.options) mkEnableOption mkPackageOption mkOption;
+  inherit (lib.modules) mkMerge mkIf;
+  inherit (lib.lists) flatten filter imap0;
+  inherit (lib.attrsets)
+    recursiveUpdate
+    mapAttrsToList
+    listToAttrs
+    nameValuePair
+    ;
+  inherit (lib.strings) concatStringsSep;
+  inherit (lib) types;
+
+  cfg = config.services.rauc;
+  format = pkgs.formats.ini { };
+
+  mountDir = "${cfg.dataDir}/mnt";
+
+  mkSlot =
+    slot:
+    if slot.enable then
+      slot.settings
+      // {
+        inherit (slot) device type;
+      }
+    else
+      null;
+
+  slotSections = listToAttrs (
+    filter (slot: slot != null) (
+      flatten (
+        mapAttrsToList (
+          name: indexes: imap0 (idx: slot: nameValuePair "slot.${name}.${toString idx}" (mkSlot slot)) indexes
+        ) cfg.slots
+      )
+    )
+  );
+
+  configFile = format.generate "rauc.conf" (
+    recursiveUpdate cfg.settings (
+      recursiveUpdate {
+        system = {
+          inherit (cfg) compatible bootloader;
+          bundle-formats = concatStringsSep " " cfg.bundleFormats;
+          data-directory = cfg.dataDir;
+          mountprefix = mountDir;
+        };
+      } slotSections
+    )
+  );
+in
+{
+  options = {
+    services.rauc = {
+      enable = mkEnableOption "RAUC A/B update service";
+      mark-good.enable = mkEnableOption "RAUC Good-marking service";
+      client.enable = mkEnableOption "RAUC client in the system environment";
+      package = mkPackageOption pkgs "rauc" { };
+      compatible = mkOption {
+        description = "The compatibility string for this system. Can be any format so long as you are consistent.";
+        type = types.str;
+        example = "nix/appliance/foo";
+      };
+      bootloader = mkOption {
+        description = "The bootloader backend for RAUC.";
+        type = types.enum [
+          "barebox"
+          "grub"
+          "uboot"
+          "efi"
+          "custom"
+          "noop"
+        ];
+        example = "grub";
+      };
+      bundleFormats = mkOption {
+        description = "Allowable formats for the RAUC bundle.";
+        type = with types; listOf str;
+        default = [
+          "-plain"
+          "+verity"
+        ];
+        example = [
+          "-plain"
+          "+verity"
+        ];
+      };
+      dataDir = mkOption {
+        description = "The state directory for RAUC.";
+        default = "/var/lib/rauc";
+        type = types.path;
+      };
+      slots = mkOption {
+        description = "RAUC slot definitions. Every key is a slot class and every value is a list of slot indexes.";
+        default = { };
+        type = types.attrsOf (
+          types.listOf (
+            types.submodule {
+              options = {
+                enable = mkEnableOption "this RAUC slot";
+                device = mkOption {
+                  description = "The device to update.";
+                  type = types.str;
+                };
+                type = mkOption {
+                  description = "The type of the device.";
+                  type = types.enum [
+                    "raw"
+                    "nand"
+                    "nor"
+                    "ubivol"
+                    "ubifs"
+                    "ext4"
+                    "vfat"
+                  ];
+                  default = "raw";
+                };
+                settings = mkOption {
+                  description = "Settings for this slot.";
+                  type = types.attrs;
+                  default = { };
+                };
+              };
+            }
+          )
+        );
+      };
+      settings = mkOption {
+        type = format.type;
+        default = { };
+        description = ''
+          Rauc configuration that will be converted to INI. Refer to:
+          <https://rauc.readthedocs.io/en/latest/reference.html#sec-ref-slot-config>
+          for details on supported values.
+
+          All module-specific options override these.
+        '';
+      };
+    };
+  };
+
+  config = mkMerge [
+    (mkIf cfg.enable {
+      systemd.services.rauc = {
+        description = "RAUC Update Service";
+        documentation = [ "https://rauc.readthedocs.io" ];
+        wants = [ "basic.target" ];
+        wantedBy = [ "multi-user.target" ];
+        after = [
+          "dbus.service"
+        ];
+        serviceConfig = {
+          Type = "dbus";
+          BusName = "de.pengutronix.rauc";
+          ExecStart = "${lib.getExe cfg.package} --conf=${configFile} --mount=/run/rauc/mnt service";
+          RuntimeDirectory = "rauc/mnt";
+          MountFlags = "slave";
+          StateDirectory = baseNameOf cfg.dataDir;
+          WorkingDirectory = cfg.dataDir;
+        };
+      };
+      systemd.tmpfiles.rules = [
+        "d ${cfg.dataDir} 0750 root root - -"
+        "d ${mountDir} 0750 root root - -"
+      ];
+    })
+    (mkIf (cfg.enable && cfg.client.enable) {
+      services.dbus.packages = [ cfg.package ];
+      environment.systemPackages = [ cfg.package ];
+    })
+    (mkIf (cfg.enable && cfg.mark-good.enable) {
+      systemd.services.rauc-mark-good = {
+        description = "RAUC Good-marking service";
+        documentation = [ "https://rauc.readthedocs.io" ];
+        wantedBy = [ "multi-user.target" ];
+        after = [
+          "rauc.service"
+          "multi-user.target"
+        ];
+        serviceConfig = {
+          Type = "oneshot";
+          ExecStart = "${lib.getExe cfg.package} --conf=${configFile} status mark-good";
+        };
+      };
+    })
+  ];
+
+  meta.maintainers = with lib.maintainers; [ numinit ];
+}

nixos/modules/services/mail/postfix-tlspol.nix

@@ -142,7 +142,7 @@ in
               else
                 "inet:${cfg.settings.server.address}";
           in
-          [ "socketmap:${address}:${if config.services.tlsrpt.enable then "QUERYwithTLSRPT" else "QUERY"}" ];
+          [ "socketmap:${address}:QUERYwithTLSRPT" ];
       };
 
       systemd.services.postfix = {

nixos/modules/services/misc/paperless.nix

@@ -629,9 +629,10 @@ in
 
         users = lib.optionalAttrs (cfg.user == defaultUser) {
           users.${defaultUser} = {
+            extraGroups = [ config.services.redis.servers.paperless.group ];
             group = defaultUser;
-            uid = config.ids.uids.paperless;
             home = cfg.dataDir;
+            uid = config.ids.uids.paperless;
           };
 
           groups.${defaultUser} = {

nixos/modules/services/monitoring/librenms.nix

@@ -11,22 +11,26 @@ let
   configJson = settingsFormat.generate "librenms-config.json" cfg.settings;
 
   package = cfg.package.override {
-    logDir = cfg.logDir;
-    dataDir = cfg.dataDir;
+    inherit (cfg) logDir dataDir;
+  };
+
+  toKeyValue = lib.generators.toKeyValue {
+    mkKeyValue = lib.generators.mkKeyValueDefault { } " = ";
+  };
+
+  defaultPHPSettings = {
+    log_errors = "on";
+    post_max_size = "100M";
+    upload_max_filesize = "100M";
+    memory_limit = "${toString cfg.settings.php_memory_limit}M";
+    "date.timezone" = config.time.timeZone;
   };
 
-  phpOptions = ''
-    log_errors = on
-    post_max_size = 100M
-    upload_max_filesize = 100M
-    memory_limit = ${toString cfg.settings.php_memory_limit}M
-    date.timezone = "${config.time.timeZone}"
-  '';
   phpIni =
     pkgs.runCommand "php.ini"
       {
         inherit (package) phpPackage;
-        inherit phpOptions;
+        phpOptions = toKeyValue cfg.phpOptions;
         preferLocalBuild = true;
         passAsFile = [ "phpOptions" ];
       }
@@ -212,6 +216,51 @@ in
       };
     };
 
+    phpOptions = mkOption {
+      type =
+        with types;
+        attrsOf (oneOf [
+          str
+          int
+        ]);
+      defaultText = literalExpression (
+        generators.toPretty { } (
+          defaultPHPSettings
+          // {
+            "zend_extension" = lib.literalExpression "opcache";
+            "opcache.enable" = lib.literalExpression "1";
+            "opcache.memory_consumption" = lib.literalExpression "256";
+            "date.timezone" = lib.literalExpression "config.time.timeZone";
+            memory_limit = lib.literalExpression "\${toString cfg.settings.php_memory_limit}M";
+          }
+        )
+      );
+      description = ''
+        Options for PHP's php.ini file for librenms.
+
+        Please note that this option is _additive_ on purpose while the
+        attribute values inside the default are option defaults: that means that
+
+        ```nix
+        {
+          services.librenms.phpOptions."opcache.enable" = 1;
+        }
+        ```
+
+        will override the `php.ini` option `opcache.enable` without discarding the rest of the defaults.
+
+        Overriding all of `phpOptions` can be done like this:
+
+        ```nix
+        {
+          services.librenms.phpOptions = lib.mkForce {
+            /* ... */
+          };
+        }
+        ```
+      '';
+    };
+
     poolConfig = mkOption {
       type =
         with types;
@@ -399,6 +448,8 @@ in
 
     users.groups.${cfg.group} = { };
 
+    services.librenms.phpOptions = lib.mapAttrs (lib.const lib.mkOptionDefault) defaultPHPSettings;
+
     services.librenms.settings = {
       # basic configs
       "user" = cfg.user;
@@ -511,7 +562,7 @@ in
       user = cfg.user;
       group = cfg.group;
       inherit (package) phpPackage;
-      inherit phpOptions;
+      phpOptions = toKeyValue cfg.phpOptions;
       settings = {
         "listen.mode" = "0660";
         "listen.owner" = config.services.nginx.user;

nixos/modules/services/scheduling/scx.nix

@@ -38,6 +38,7 @@ in
 
     scheduler = lib.mkOption {
       type = lib.types.enum [
+        "scx_beerland"
         "scx_bpfland"
         "scx_chaos"
         "scx_cosmos"

nixos/tests/all-tests.nix

@@ -1316,6 +1316,7 @@ in
   ragnarwm = runTestOn [ "x86_64-linux" "aarch64-linux" ] ./ragnarwm.nix;
   rasdaemon = runTest ./rasdaemon.nix;
   rathole = runTest ./rathole.nix;
+  rauc = runTest ./rauc.nix;
   readarr = runTest ./readarr.nix;
   readeck = runTest ./readeck.nix;
   realm = runTest ./realm.nix;

nixos/tests/kubernetes/base.nix

@@ -18,7 +18,7 @@ let
     }:
     let
       masterName = head (
-        filter (machineName: lib.elem "master" machines.${machineName}.roles) (attrNames machines)
+        filter (machineName: elem "master" machines.${machineName}.roles) (attrNames machines)
       );
       master = machines.${masterName};
       extraHosts = ''

nixos/tests/rauc.nix

@@ -0,0 +1,258 @@
+{ pkgs, lib, ... }:
+
+{
+  name = "rauc";
+
+  nodes.machine =
+    {
+      pkgs,
+      lib,
+      config,
+      ...
+    }:
+    let
+      inherit (import ./ssh-keys.nix pkgs)
+        snakeOilPrivateKey
+        ;
+
+      snakeOilRaucCert =
+        pkgs.runCommand "rauc.crt"
+          {
+            inherit snakeOilPrivateKey;
+          }
+          ''
+            ${lib.getExe pkgs.openssl} req -x509 -key $snakeOilPrivateKey -out $out -days 3650 \
+              -addext subjectKeyIdentifier=hash \
+              -addext authorityKeyIdentifier=keyid:always,issuer:always \
+              -addext basicConstraints=CA:FALSE \
+              -addext extendedKeyUsage=critical,codeSigning \
+              -subj "/OU=Smoke Test/OU=RAUC/CN=NixOS/"
+          '';
+
+      raucManifest = pkgs.writeText "manifest.raucm" (
+        lib.generators.toINI { } {
+          update = {
+            inherit (config.services.rauc) compatible;
+            version = "@VERSION@";
+          };
+          bundle.format = "verity";
+          "image.rauc".filename = "rauc.img";
+        }
+      );
+      rauc-mkimg = pkgs.writeShellApplication {
+        name = "rauc-mkimg";
+        runtimeInputs = with pkgs; [
+          config.services.rauc.package
+          e2fsprogs
+          squashfsTools
+        ];
+
+        text = ''
+          set -xeuo pipefail
+          tmpdir="$(mktemp -dt rauc.XXXXX)"
+
+          cleanup() {
+            rm -rf "$tmpdir"
+          }
+          trap cleanup EXIT
+
+          cd "$tmpdir"
+          mkdir bundle target
+          cat ${raucManifest} > bundle/manifest.raucm
+          sed -i "s/@VERSION@/$2/g" bundle/manifest.raucm
+          echo "$1" > target/label
+          truncate -s128M bundle/rauc.img
+          mkfs.ext4 -v -L "rauc_$1" -d target bundle/rauc.img
+          cd bundle
+          rauc bundle --cert=${snakeOilRaucCert} --key=${snakeOilPrivateKey} . "$3"
+        '';
+      };
+      rauc-bundle-c = pkgs.runCommand "rauc_c.bundle" { } ''
+        ${lib.getExe rauc-mkimg} c 42 $out
+      '';
+
+      rauc-do-update = pkgs.writeShellScriptBin "rauc-do-update" ''
+        if [ "$1" == c ]; then
+          bundle=${rauc-bundle-c}
+        else
+          exit 1
+        fi
+        exec rauc install "$bundle"
+      '';
+    in
+    {
+      environment.systemPackages = with pkgs; [
+        jq
+        rauc-do-update
+      ];
+
+      services.rauc = {
+        enable = true;
+        client.enable = true;
+        mark-good.enable = true;
+        compatible = "nix/widget/smoketest";
+        bootloader = "custom";
+        slots = {
+          rauc =
+            let
+              slot = ab: {
+                enable = true;
+                device = "/dev/vd${lib.replaceStrings [ "a" "b" ] [ "b" "c" ] ab}";
+                settings.bootname = ab;
+              };
+            in
+            [
+              (slot "a")
+              (slot "b")
+            ];
+        };
+        settings = {
+          keyring = {
+            path = toString snakeOilRaucCert;
+            use-bundle-signing-time = true;
+            check-purpose = "codesign";
+          };
+          handlers = {
+            system-info = toString (
+              pkgs.writeShellScript "rauc-sysinfo.sh" ''
+                echo "RAUC_SYSTEM_SERIAL=nixos"
+                echo "RAUC_SYSTEM_VARIANT=nix/widget/smoketest"
+              ''
+            );
+            bootloader-custom-backend = toString (
+              pkgs.writeShellScript "rauc-backend.sh" ''
+                case "$1" in
+                  get-primary)
+                    cat /rauc.current || exit $?
+                    ;;
+                  set-primary)
+                    echo "$2" > /rauc.current
+                    ;;
+                  get-state)
+                    cat "/rauc.$2.status" || echo bad
+                    ;;
+                  set-state)
+                    echo "$3" > "/rauc.$2.status"
+                    ;;
+                  get-current)
+                    cat /rauc.booted
+                    ;;
+                  *)
+                    exit 1
+                    ;;
+                esac
+              ''
+            );
+          };
+        };
+      };
+
+      boot.initrd = {
+        postDeviceCommands = ''
+          ensure_ext4() {
+            x="$(echo "$1" | tr ab bc)"
+            if [ "$(blkid -t TYPE=ext4 -l -o device "/dev/vd$x")" != "/dev/vd$x" ]; then
+              ${pkgs.e2fsprogs}/bin/mkfs.ext4 -v -L "rauc_$1" "/dev/vd$x" || exit $?
+            fi
+          }
+          ensure_ext4 a
+          ensure_ext4 b
+        '';
+
+        postMountCommands = ''
+          # Keep track of the current RAUC partition and the booted one.
+          if [ ! -f /mnt-root/rauc.current ]; then
+            echo a > /mnt-root/rauc.current
+          fi
+          cat /mnt-root/rauc.current > /mnt-root/rauc.booted
+
+          # Initialize test rauc partitions using a custom backend for the test.
+          init_ab() {
+            mkdir -p "/mnt-root/rauc_$1"
+            umount "/mnt-root/rauc_$1"
+            mount -t ext4 "/dev/vd$(echo "$1" | tr ab bc)" "/mnt-root/rauc_$1" || exit $?
+            if [ -d "/mnt-root/rauc_$1" ] && [ ! -f "/mnt-root/rauc_$1/label" ]; then
+              echo "$1" > "/mnt-root/rauc_$1/label"
+            fi
+            echo bad > "/mnt-root/rauc.$1.status"
+            umount "/mnt-root/rauc_$1"
+            rm -rf "/mnt-root/rauc_$1"
+          }
+          init_ab a
+          init_ab b
+
+          # Mount the RAUC boot directory.
+          mkdir -p /mnt-root/rauc
+          booted="/dev/vd$(tr ab bc < /mnt-root/rauc.booted)"
+          echo "Mounting $booted to /rauc" | tee /dev/stderr
+          mount "$booted" /mnt-root/rauc | tee /dev/stderr
+        '';
+      };
+
+      virtualisation = {
+        emptyDiskImages = [
+          256
+          256
+        ];
+      };
+    };
+
+  testScript =
+    { nodes, ... }:
+    ''
+      from shlex import quote, join
+
+      def rauc(*rauc_args):
+        rauc_cmd = join(rauc_args)
+        ret = machine.succeed(f'rauc {rauc_cmd} --output-format=json')
+        machine.succeed('rauc status >&2')
+        return ret
+
+      def wait_rauc(result, *jq_args):
+        jq_cmd = join([*jq_args[:-1], '-r', *jq_args[-1:]])
+        machine.wait_until_succeeds(f'[ "$(rauc status --output-format=json | jq {jq_cmd})" == {quote(result)} ]')
+        machine.succeed("rauc status >&2")
+
+      def name(slot):
+        return 'rauc.%d' % (int(slot, 16) - 10)
+
+      def wait_booted(slot, image=None):
+        if image is None:
+          image = slot
+        wait_rauc(slot, '.booted')
+        machine.wait_until_succeeds(f'[ "$(</rauc/label)" == {quote(image)} ]')
+      def wait_current(slot):
+        wait_rauc(name(slot), '.boot_primary')
+      def wait_status(slot, status):
+        wait_rauc(status, '--arg', 'slot', slot, '.slots[] | to_entries[] | select(.value.bootname == $slot) | .value.boot_status')
+      def wait_state(slot, state):
+        wait_rauc(state, '--arg', 'slot', slot, '.slots[] | to_entries[] | select(.value.bootname == $slot) | .value.state')
+      def set_slot(slot):
+        rauc('status', 'mark-active', name(slot))
+        wait_rauc(slot, '--arg', 'slot', slot, '.boot_primary as $primary | .slots[] | to_entries[] | select(.key == $primary) | .value.bootname')
+
+      machine.start(allow_reboot=True)
+      machine.wait_for_unit('multi-user.target')
+
+      for (a, b, image, update) in (('a', 'b', 'a', ""), ('b', 'a', 'b', 'c'), ('a', 'b', 'c', "")):
+        machine.wait_for_unit('rauc.service')
+        machine.succeed("mount >&2")
+        wait_booted(a, image)
+        wait_current(a)
+        wait_status(a, 'good')
+        wait_status(b, 'bad')
+        wait_state(a, 'booted')
+        wait_state(b, 'inactive')
+        set_slot(b)
+        wait_current(b)
+        set_slot(a)
+        wait_current(a)
+        set_slot(b)
+        wait_current(b)
+
+        if update != "":
+          machine.succeed(f'rauc-do-update {quote(update)}')
+
+        machine.reboot()
+    '';
+}

nixos/tests/scx/default.nix

@@ -11,6 +11,7 @@
     services.scx.enable = true;
 
     specialisation = {
+      beerland.configuration.services.scx.scheduler = "scx_beerland";
       bpfland.configuration.services.scx.scheduler = "scx_bpfland";
       cosmos.configuration.services.scx.scheduler = "scx_cosmos";
       flash.configuration.services.scx.scheduler = "scx_flash";
@@ -27,6 +28,7 @@
 
   testScript = ''
     specialisation = [
+      "beerland",
       "bpfland",
       "cosmos",
       "flash",

pkgs/applications/audio/mopidy/spotify.nix

@@ -26,25 +26,10 @@ pythonPackages.buildPythonApplication rec {
     pythonPackages.requests
   ];
 
-  optional-dependencies = {
-    lint = with pythonPackages; [
-      black
-      check-manifest
-      flake8
-      flake8-bugbear
-      isort
-    ];
-
-    test = with pythonPackages; [
-      pytest
-      pytest-cov
-      responses
-    ];
-
-    dev = optional-dependencies.lint ++ optional-dependencies.test ++ [ pythonPackages.tox ];
-  };
-
-  nativeCheckInputs = [ pythonPackages.pytestCheckHook ] ++ optional-dependencies.test;
+  nativeCheckInputs = [
+    pythonPackages.pytestCheckHook
+    pythonPackages.responses
+  ];
 
   pythonImportsCheck = [ "mopidy_spotify" ];
 

pkgs/applications/editors/emacs/elisp-packages/manual-packages/copilot/package.nix

@@ -12,13 +12,13 @@
 }:
 melpaBuild (finalAttrs: {
   pname = "copilot";
-  version = "0.2.0";
+  version = "0.3.0";
 
   src = fetchFromGitHub {
     owner = "copilot-emacs";
     repo = "copilot.el";
     rev = "v${finalAttrs.version}";
-    sha256 = "sha256-hIA+qdWoOJI9/hqBUSHhmh+jjzDnPiZkIzszCPuQxd0=";
+    sha256 = "sha256-UA0Ra3sYVFwY1xL8COhOG8dLwtMLiQ7Euq5tk6e8M1g=";
   };
 
   files = ''(:defaults "dist")'';

pkgs/applications/editors/vim/plugins/non-generated/avante-nvim/default.nix

@@ -12,12 +12,12 @@
   pkgs,
 }:
 let
-  version = "0.0.27-unstable-2025-11-09";
+  version = "0.0.27-unstable-2025-11-12";
   src = fetchFromGitHub {
     owner = "yetone";
     repo = "avante.nvim";
-    rev = "f8a7cd1a606460ec0a2c4ec886bc102daccf912e";
-    hash = "sha256-jRIPBO/5JKFe2bZYjPtW8o0dDujoCxU8zq9Ot3hCtzs=";
+    rev = "ca95e0386433da2077184719886fa658257261a3";
+    hash = "sha256-J3wIR1kACtX8qnspPGxHDkBvTWbWHP/T51qYSZsZrgs=";
   };
   avante-nvim-lib = rustPlatform.buildRustPackage {
     pname = "avante-nvim-lib";

pkgs/applications/editors/vscode/extensions/default.nix

@@ -5122,8 +5122,8 @@ let
         mktplcRef = {
           name = "vim";
           publisher = "vscodevim";
-          version = "1.32.0";
-          hash = "sha256-qZYtCjqWoqE2qjrJN70ws9/w0FncLCWqTeVX/B66CmQ=";
+          version = "1.32.1";
+          hash = "sha256-c88Mf3yzo2SJ4lmyzoiVm6ioMY0jkkH+N1EkVZBGzrQ=";
         };
         meta = {
           license = lib.licenses.mit;

pkgs/applications/editors/vscode/extensions/github.copilot-chat/default.nix

@@ -7,8 +7,8 @@ vscode-utils.buildVscodeMarketplaceExtension {
   mktplcRef = {
     publisher = "github";
     name = "copilot-chat";
-    version = "0.31.5";
-    hash = "sha256-D7k+hA786w7IZHVI+Og6vHGAAohpfpuOmmCcDUU0WsY=";
+    version = "0.33.1";
+    hash = "sha256-qiWuoxd/CXTxYtlOcj1Aww16wLvTZbQ7qJYhPPEndqk=";
   };
 
   meta = {

pkgs/applications/editors/vscode/extensions/visualjj.visualjj/default.nix

@@ -11,26 +11,26 @@ vscode-utils.buildVscodeMarketplaceExtension {
       sources = {
         "x86_64-linux" = {
           arch = "linux-x64";
-          hash = "sha256-yTkzftw8du9LlzIh36s+1JgLDR0DCQszJxqIdEksXvs=";
+          hash = "sha256-P5LEN+wTfJ9p0vG4z/FAB4u2hFLcqy7Xc18qC4W5x8U=";
         };
         "x86_64-darwin" = {
           arch = "darwin-x64";
-          hash = "sha256-JRRmbJcP6YEoHfDnK69fJIsYRNB6qK1cRZUqk9JZNiI=";
+          hash = "sha256-cNiXCrOw3ET/BTfMxYfr01F+5lTXbKH3vKpRQQdnRLc=";
         };
         "aarch64-linux" = {
           arch = "linux-arm64";
-          hash = "sha256-zsU4lTCjebimApI4cnMSwtqYLAHqakwAUjk1W2gN7FE=";
+          hash = "sha256-zCGwaw5Dgd0o5t+h0sjPZ1nDp/JqC2Wx4QfQYv3jg4w=";
         };
         "aarch64-darwin" = {
           arch = "darwin-arm64";
-          hash = "sha256-rbGctv/AA7H4SsqUfFjNKv+5dE/JSN/2YRPIcD4Loxs=";
+          hash = "sha256-M5BQdlEe5eN91Mz8trMFbFNeRoMIpGSOHpBSGQQVJc0=";
         };
       };
     in
     {
       name = "visualjj";
       publisher = "visualjj";
-      version = "0.19.4";
+      version = "0.20.0";
     }
     // sources.${stdenvNoCC.hostPlatform.system}
       or (throw "Unsupported system ${stdenvNoCC.hostPlatform.system}");

pkgs/applications/emulators/libretro/cores/beetle-psx.nix

@@ -8,13 +8,13 @@
 }:
 mkLibretroCore {
   core = "mednafen-psx" + lib.optionalString withHw "-hw";
-  version = "0-unstable-2025-10-17";
+  version = "0-unstable-2025-11-14";
 
   src = fetchFromGitHub {
     owner = "libretro";
     repo = "beetle-psx-libretro";
-    rev = "6ac3c05aeddeb6dd5f28f448354d1f8e2e5d6810";
-    hash = "sha256-Y/ct+nDlbIZNRxRQJVsgaQs3mFODfuhToZdXairaesk=";
+    rev = "d6383bff89a93e02aad10a586e804829861c3de1";
+    hash = "sha256-90NhPleaA/YnkQ0EDbvjIGOVn49m+LFy1ovw7/scqlc=";
   };
 
   extraBuildInputs = lib.optionals withHw [

pkgs/applications/emulators/libretro/cores/freeintv.nix

@@ -5,13 +5,13 @@
 }:
 mkLibretroCore {
   core = "freeintv";
-  version = "0-unstable-2025-03-05";
+  version = "0-unstable-2025-11-11";
 
   src = fetchFromGitHub {
     owner = "libretro";
     repo = "freeintv";
-    rev = "6efc4b8fd4c7423ec1f5ff1913b854529135b565";
-    hash = "sha256-B5GEzI/U/F0IsppdOx5znu+4LdZOxQLcGAez+oR2PCI=";
+    rev = "1b51f41238ef9691d9fe16722f7d093bb6a6e379";
+    hash = "sha256-kuznjK9HnqR42Cuz6bmUhEUnerrWb5VIvkiU0p//ecw=";
   };
 
   makefile = "Makefile";

pkgs/applications/emulators/libretro/cores/genesis-plus-gx.nix

@@ -5,13 +5,13 @@
 }:
 mkLibretroCore {
   core = "genesis-plus-gx";
-  version = "0-unstable-2025-11-07";
+  version = "0-unstable-2025-11-14";
 
   src = fetchFromGitHub {
     owner = "libretro";
     repo = "Genesis-Plus-GX";
-    rev = "180bed8e35fc48827f087926c4770f9ccdeaad0c";
-    hash = "sha256-7RfO2GdsMZ/9VZ0cK2pl/s+kOUyUBbqTSDVzn1icN6k=";
+    rev = "46a55214d0dab654e5a525ae0c54921ca9716872";
+    hash = "sha256-DDdaMhTvSUXTtrdMK4DfALQe7qIsh+oV91dD8aefcU8=";
   };
 
   meta = {

pkgs/applications/emulators/libretro/cores/mame2003-plus.nix

@@ -5,13 +5,13 @@
 }:
 mkLibretroCore {
   core = "mame2003-plus";
-  version = "0-unstable-2025-10-05";
+  version = "0-unstable-2025-11-13";
 
   src = fetchFromGitHub {
     owner = "libretro";
     repo = "mame2003-plus-libretro";
-    rev = "870e8ba3fa4e6635e2eb9d85c939589498659c32";
-    hash = "sha256-FU7GKuLssyGuWeHQZGjborz/QdgAxw3JKe9Hstq9ckk=";
+    rev = "62c7089644966f6ac5fc79fe03592603579a409d";
+    hash = "sha256-NHJfZpo4/aR9a6Sn3x+BQaVfKtkMBUoDQlgtvIkXDFI=";
   };
 
   makefile = "Makefile";

pkgs/applications/misc/organicmaps/default.nix

@@ -33,13 +33,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "organicmaps";
-  version = "2025.10.23-22";
+  version = "2025.11.11-5";
 
   src = fetchFromGitHub {
     owner = "organicmaps";
     repo = "organicmaps";
     tag = "${finalAttrs.version}-android";
-    hash = "sha256-4TSN4G5tUvtzSXASDfOE1xiitQx9wE2/ZydFwpov+UM=";
+    hash = "sha256-lO6pJUV+PBgE3SLUfD7i4zySB6vg9ZAXN1G3dK4XYqs=";
     fetchSubmodules = true;
   };
 

pkgs/applications/networking/cluster/helm/plugins/helm-dt.nix

@@ -5,13 +5,13 @@
 }:
 buildGoModule rec {
   pname = "helm-dt";
-  version = "0.4.11";
+  version = "0.4.12";
 
   src = fetchFromGitHub {
     owner = "vmware-labs";
     repo = "distribution-tooling-for-helm";
     rev = "refs/tags/v${version}";
-    hash = "sha256-k7+t52UU5dfElD7885AppO2+mccjQwh2mRImByUfAaE=";
+    hash = "sha256-/fU56Dw7tvUnby4S78tyH/dasg4n3rb0hMlIkzvrv4M=";
   };
 
   vendorHash = "sha256-dkE3eYZnaS+kC0kDVxaFW/Ev15TY2MY3m5xgPof7Y18=";

pkgs/applications/networking/cluster/terraform-providers/providers.json

@@ -27,13 +27,13 @@
     "vendorHash": null
   },
   "aiven_aiven": {
-    "hash": "sha256-+51Roeyn0+vNo3dCLMD8kyiOXf6ATVAQlEZ4O7B7zCw=",
+    "hash": "sha256-WcozZUc2z1V8wxRSgoU20Zwolpr12a+dSjXmEKKHnp4=",
     "homepage": "https://registry.terraform.io/providers/aiven/aiven",
     "owner": "aiven",
     "repo": "terraform-provider-aiven",
-    "rev": "v4.46.1",
+    "rev": "v4.47.0",
     "spdx": "MIT",
-    "vendorHash": "sha256-8cChWCS8yV69djpoeElLgaorpbHY2Jg04WKY3e+pvsg="
+    "vendorHash": "sha256-G83ixFWqkVlbm8mTEC1fIvnuUUZ2InPdWqQbbgJG7UY="
   },
   "akamai_akamai": {
     "hash": "sha256-HjrBPaLYeJ8/9gmdn+BGHtu5dmyT5MeTsIBgzS0X0gY=",
@@ -561,22 +561,22 @@
     "vendorHash": "sha256-xIagZvWtlNpz5SQfxbA7r9ojAeS3CW2pwV337ObKOwU="
   },
   "hashicorp_google": {
-    "hash": "sha256-PoPYcCr66g+3S94q0SprdQokgVkFM1p3oYSBEMOdSWY=",
+    "hash": "sha256-MrQ16YJBPm0f89lYbbDSPrqSFhB0eShN6VUM1lPI2D4=",
     "homepage": "https://registry.terraform.io/providers/hashicorp/google",
     "owner": "hashicorp",
     "repo": "terraform-provider-google",
-    "rev": "v7.10.0",
+    "rev": "v7.11.0",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-BghusRVsU7HrX6hWpbanGJ93UdHSq8nWmcEGnyyVOTs="
+    "vendorHash": "sha256-bpyTtuK3kcntk9hzCU2d+RZ0K0jfFtUlEZezyZHvFW8="
   },
   "hashicorp_google-beta": {
-    "hash": "sha256-lL4BtInJu/STew7SaNrwPnmLDLucMvbyGanAK9tsJKE=",
+    "hash": "sha256-2R7zZRiAZaTABOyQyUwRRba6zhdFmIeCXbdPEnDDtcI=",
     "homepage": "https://registry.terraform.io/providers/hashicorp/google-beta",
     "owner": "hashicorp",
     "repo": "terraform-provider-google-beta",
-    "rev": "v7.10.0",
+    "rev": "v7.11.0",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-zLUlrIdfqhiVITQe7bmoYl570LvLS8aEMU2HC4xmKTU="
+    "vendorHash": "sha256-JDFKEn011onzch07tLu/kVbiCwXPqwomFA/X5fbQ3bc="
   },
   "hashicorp_helm": {
     "hash": "sha256-XU5AxXYvZtHnxGotOvGOojybcusVX9DRK2sazfytkAw=",
@@ -642,13 +642,13 @@
     "vendorHash": "sha256-jyfzk3vbgZwHlyiFFw1mhD+us/7WNatUQTGN4WsrfgE="
   },
   "hashicorp_tfe": {
-    "hash": "sha256-VKRifnvUTtGCs9XEMeqTVvbtES7rvWBWoiSYLfMxIhQ=",
+    "hash": "sha256-W0O3J08p6QtQVCqE3AGZbR+19SQVXLbxLkkDhpZhJMM=",
     "homepage": "https://registry.terraform.io/providers/hashicorp/tfe",
     "owner": "hashicorp",
     "repo": "terraform-provider-tfe",
-    "rev": "v0.70.0",
+    "rev": "v0.71.0",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-JrdL91xO4EyAtWfDFsjr09oTfgx+tQQ965ex/AnBkGk="
+    "vendorHash": "sha256-dZFjjogCIRzxXgJ/VW/WJY1mCNqoa3Es4q+oXLgcGQg="
   },
   "hashicorp_time": {
     "hash": "sha256-ZArYfbzbrkxGlL1BRFM7PN3hLzdssIL4COsUBdLVMYY=",
@@ -823,13 +823,13 @@
     "vendorHash": "sha256-duHOqjy8AthXuDX63GO3myJ9TJmV0Ts1a8OsbSOGZWI="
   },
   "launchdarkly_launchdarkly": {
-    "hash": "sha256-U3l2Tf7vcLAz7nZYKaGR0Nv/Qw2HgbGNV7w1dYBvSEc=",
+    "hash": "sha256-4vOAkZac3dpYdzZDk+vvqmr/S37q/Gl0HmOAFuDKyag=",
     "homepage": "https://registry.terraform.io/providers/launchdarkly/launchdarkly",
     "owner": "launchdarkly",
     "repo": "terraform-provider-launchdarkly",
-    "rev": "v2.25.3",
+    "rev": "v2.26.0",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-b9+0YLuv9AVszGDQ2v+VbYameN16PCdE3jUhL9efK6M="
+    "vendorHash": "sha256-Y1L1nIOubhBN5vNIXY7miQgR9OzoTCS7QA55DEMwDSA="
   },
   "linode_linode": {
     "hash": "sha256-t6vHW9t3MWsPsGUh44OXvYTfHa03qiH3lveKK0dit9Q=",
@@ -1264,11 +1264,11 @@
     "vendorHash": "sha256-9M1DsE/FPQK8TG7xCJWbU3HAJCK3p/7lxdzjO1oAfWs="
   },
   "sumologic_sumologic": {
-    "hash": "sha256-5b+hCWXyafLeCA7F5RlUj2GpO7Ipy8UVAQxjQaoYnJA=",
+    "hash": "sha256-6wKzxaF/cSfGPeRTmmSGAZeFmDlpaYimnbCQYdclkhc=",
     "homepage": "https://registry.terraform.io/providers/SumoLogic/sumologic",
     "owner": "SumoLogic",
     "repo": "terraform-provider-sumologic",
-    "rev": "v3.1.7",
+    "rev": "v3.1.8",
     "spdx": "MPL-2.0",
     "vendorHash": "sha256-IR6KjFW5GbsOIm3EEFyx3ctwhbifZlcNaZeGhbeK/Wo="
   },

pkgs/applications/networking/instant-messengers/dino/default.nix

@@ -37,13 +37,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "dino";
-  version = "0.5.0";
+  version = "0.5.1";
 
   src = fetchFromGitHub {
     owner = "dino";
     repo = "dino";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-Y3MGKpfhjmqnIvmt4mXnkmpjF/riXPDXyUiSrsceY6o=";
+    hash = "sha256-TgXPJP+Xm8LrO2d8yMu6aCCypuBRKNtYuZAb0dYfhng=";
   };
 
   postPatch = ''

pkgs/applications/networking/instant-messengers/telegram/telegram-desktop/unwrapped.nix

@@ -42,14 +42,14 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "telegram-desktop-unwrapped";
-  version = "6.2.3";
+  version = "6.3.0";
 
   src = fetchFromGitHub {
     owner = "telegramdesktop";
     repo = "tdesktop";
     rev = "v${finalAttrs.version}";
     fetchSubmodules = true;
-    hash = "sha256-ojhZgzxNXUkJaXoERuOti4E2vaGLsEoQp3eSuYtvhrY=";
+    hash = "sha256-YExl9mn2aEL1WOqT2fuX/KxKAV28q0WKVG1AMvPANwA=";
   };
 
   nativeBuildInputs = [

pkgs/applications/science/chemistry/nwchem/default.nix

@@ -23,6 +23,7 @@
 }:
 
 assert blas.isILP64 == lapack.isILP64;
+assert blas.isILP64 == scalapack.isILP64;
 
 let
   versionGA = "5.8.2"; # Fixed by nwchem
@@ -138,7 +139,7 @@ stdenv.mkDerivation rec {
     export BLAS_SIZE=${if blas.isILP64 then "8" else "4"}
     export USE_SCALAPACK="y"
     export SCALAPACK="-L${scalapack}/lib -lscalapack"
-    export SCALAPACK_SIZE="4"
+    export SCALAPACK_SIZE=${if scalapack.isILP64 then "8" else "4"}
 
     export LIBXC_INCLUDE="${lib.getDev libxc}/include"
     export LIBXC_MODDIR="${lib.getDev libxc}/include"

pkgs/by-name/_2/_2ship2harkinian/package.nix

@@ -1,50 +1,59 @@
 {
   lib,
+  fetchFromGitHub,
+  applyPatches,
+  _2ship2harkinian,
+  fetchurl,
+  writeTextFile,
   stdenv,
-  SDL2,
   cmake,
   copyDesktopItems,
-  fetchFromGitHub,
-  fetchpatch,
-  fetchurl,
   imagemagick,
-  imgui,
+  lsb-release,
+  makeWrapper,
+  ninja,
+  pkg-config,
+  python3,
+  libGL,
   libpng,
   libpulseaudio,
   libzip,
-  lsb-release,
-  makeDesktopItem,
-  makeWrapper,
-  ninja,
   nlohmann_json,
-  pkg-config,
-  python3,
+  SDL2,
   spdlog,
-  stormlib,
   tinyxml-2,
-  writeTextFile,
   zenity,
+  bzip2,
+  libogg,
+  libopus,
+  libvorbis,
+  libX11,
+  opusfile,
+  sdl_gamecontrollerdb,
+  makeDesktopItem,
 }:
 
 let
 
-  # This would get fetched at build time otherwise, see:
-  # https://github.com/HarbourMasters/2ship2harkinian/blob/1.0.2/mm/CMakeLists.txt#L708
-  gamecontrollerdb = fetchurl {
-    name = "gamecontrollerdb.txt";
-    url = "https://raw.githubusercontent.com/gabomdq/SDL_GameControllerDB/b1759cf84028aab89caa1c395e198c340b8dfd89/gamecontrollerdb.txt";
-    hash = "sha256-7C5EkqBIhLGNJuhi3832y0ffW5Ep7iuTYXb1bL5h2Js=";
+  # The following are either normally fetched during build time or a specific version is required
+
+  dr_libs = fetchFromGitHub {
+    owner = "mackron";
+    repo = "dr_libs";
+    rev = "da35f9d6c7374a95353fd1df1d394d44ab66cf01";
+    hash = "sha256-ydFhQ8LTYDBnRTuETtfWwIHZpRciWfqGsZC6SuViEn0=";
   };
 
-  # 2ship needs a specific imgui version
-  imgui' = imgui.overrideAttrs rec {
-    version = "1.90.6";
+  imgui' = applyPatches {
     src = fetchFromGitHub {
       owner = "ocornut";
       repo = "imgui";
-      tag = "v${version}-docking";
-      hash = "sha256-Y8lZb1cLJF48sbuxQ3vXq6GLru/WThR78pq7LlORIzc=";
+      tag = "v1.91.9b-docking";
+      hash = "sha256-mQOJ6jCN+7VopgZ61yzaCnt4R1QLrW7+47xxMhFRHLQ=";
     };
+    patches = [
+      "${_2ship2harkinian.src}/libultraship/cmake/dependencies/patches/imgui-fixes-and-config.patch"
+    ];
   };
 
   libgfxd = fetchFromGitHub {
@@ -54,6 +63,13 @@ let
     hash = "sha256-AmHAa3/cQdh7KAMFOtz5TQpcM6FqO9SppmDpKPTjTt8=";
   };
 
+  prism = fetchFromGitHub {
+    owner = "KiritoDv";
+    repo = "prism-processor";
+    rev = "bbcbc7e3f890a5806b579361e7aa0336acd547e7";
+    hash = "sha256-jRPwO1Vub0cH12YMlME6kd8zGzKmcfIrIJZYpQJeOks=";
+  };
+
   stb_impl = writeTextFile {
     name = "stb_impl.c";
     text = ''
@@ -68,24 +84,17 @@ let
     hash = "sha256-xUsVponmofMsdeLsI6+kQuPg436JS3PBl00IZ5sg3Vw=";
   };
 
-  # Apply 2ship's patch for stormlib
-  stormlib' = stormlib.overrideAttrs (prev: rec {
-    version = "9.25";
+  stormlib' = applyPatches {
     src = fetchFromGitHub {
       owner = "ladislav-zezula";
       repo = "StormLib";
-      tag = "v${version}";
+      tag = "v9.25";
       hash = "sha256-HTi2FKzKCbRaP13XERUmHkJgw8IfKaRJvsK3+YxFFdc=";
     };
-    nativeBuildInputs = prev.nativeBuildInputs ++ [ pkg-config ];
-    patches = (prev.patches or [ ]) ++ [
-      (fetchpatch {
-        name = "stormlib-optimizations.patch";
-        url = "https://github.com/briaguya-ai/StormLib/commit/ff338b230544f8b2bb68d2fbe075175ed2fd758c.patch";
-        hash = "sha256-Jbnsu5E6PkBifcx/yULMVC//ab7tszYgktS09Azs5+4=";
-      })
+    patches = [
+      "${_2ship2harkinian.src}/libultraship/cmake/dependencies/patches/stormlib-optimizations.patch"
     ];
-  });
+  };
 
   thread_pool = fetchFromGitHub {
     owner = "bshoshany";
@@ -97,19 +106,27 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "2ship2harkinian";
-  version = "1.0.2";
+  version = "3.0.1";
 
   src = fetchFromGitHub {
     owner = "HarbourMasters";
     repo = "2ship2harkinian";
     tag = finalAttrs.version;
-    hash = "sha256-1iSFzroKxwFpsIGNMetSlQKTKRWCy7QtgCTepFdSeY8=";
+    hash = "sha256-EC8o5FIP/eXa+0LZt0C8EWHzKVAniv9SIXkZdbibcxg=";
     fetchSubmodules = true;
+    deepClone = true;
+    postFetch = ''
+      cd $out
+      git branch --show-current > GIT_BRANCH
+      git rev-parse --short=7 HEAD > GIT_COMMIT_HASH
+      (git describe --tags --abbrev=0 --exact-match HEAD 2>/dev/null || echo "") > GIT_COMMIT_TAG
+      rm -rf .git
+    '';
   };
 
   patches = [
     # remove fetching stb as we will patch our own
-    ./0001-deps.patch
+    ./dont-fetch-stb.patch
   ];
 
   nativeBuildInputs = [
@@ -124,14 +141,19 @@ stdenv.mkDerivation (finalAttrs: {
   ];
 
   buildInputs = [
-    SDL2
-    imgui'
+    bzip2
+    libGL
+    libogg
+    (lib.getDev libopus)
     libpng
     libpulseaudio
+    libvorbis
+    libX11
     libzip
     nlohmann_json
+    (lib.getDev opusfile)
+    SDL2
     spdlog
-    stormlib'
     tinyxml-2
     zenity
   ];
@@ -139,12 +161,18 @@ stdenv.mkDerivation (finalAttrs: {
   cmakeFlags = [
     (lib.cmakeBool "NON_PORTABLE" true)
     (lib.cmakeFeature "CMAKE_INSTALL_PREFIX" "${placeholder "out"}/2s2h")
-    (lib.cmakeFeature "FETCHCONTENT_SOURCE_DIR_IMGUI" "${imgui'.src}")
+    (lib.cmakeFeature "FETCHCONTENT_SOURCE_DIR_DR_LIBS" "${dr_libs}")
+    (lib.cmakeFeature "FETCHCONTENT_SOURCE_DIR_IMGUI" "${imgui'}")
     (lib.cmakeFeature "FETCHCONTENT_SOURCE_DIR_LIBGFXD" "${libgfxd}")
+    (lib.cmakeFeature "FETCHCONTENT_SOURCE_DIR_PRISM" "${prism}")
     (lib.cmakeFeature "FETCHCONTENT_SOURCE_DIR_STORMLIB" "${stormlib'}")
     (lib.cmakeFeature "FETCHCONTENT_SOURCE_DIR_THREADPOOL" "${thread_pool}")
+    (lib.cmakeFeature "OPUS_INCLUDE_DIR" "${lib.getDev libopus}/include/opus")
+    (lib.cmakeFeature "OPUSFILE_INCLUDE_DIR" "${lib.getDev opusfile}/include/opus")
   ];
 
+  strictDeps = true;
+
   dontAddPrefix = true;
 
   # Linking fails without this
@@ -155,15 +183,22 @@ stdenv.mkDerivation (finalAttrs: {
     mkdir stb
     cp ${stb'} ./stb/${stb'.name}
     cp ${stb_impl} ./stb/${stb_impl.name}
-
     substituteInPlace libultraship/cmake/dependencies/common.cmake \
-      --replace-fail "\''${STB_DIR}" "/build/source/stb"
+      --replace-fail "\''${STB_DIR}" "$(readlink -f ./stb)"
+  '';
+
+  postPatch = ''
+    substituteInPlace mm/src/boot/build.c.in \
+    --replace-fail "@CMAKE_PROJECT_GIT_BRANCH@" "$(cat GIT_BRANCH)" \
+    --replace-fail "@CMAKE_PROJECT_GIT_COMMIT_HASH@" "$(cat GIT_COMMIT_HASH)" \
+    --replace-fail "@CMAKE_PROJECT_GIT_COMMIT_TAG@" "$(cat GIT_COMMIT_TAG)"
   '';
 
   postBuild = ''
-    cp ${gamecontrollerdb} ${gamecontrollerdb.name}
+    port_ver=$(grep CMAKE_PROJECT_VERSION: "$PWD/CMakeCache.txt" | cut -d= -f2)
+    cp ${sdl_gamecontrollerdb}/share/gamecontrollerdb.txt gamecontrollerdb.txt
     pushd ../OTRExporter
-    python3 ./extract_assets.py -z ../build/ZAPD/ZAPD.out --norom --xml-root ../mm/assets/xml --custom-assets-path ../mm/assets/custom --custom-otr-file 2ship.o2r --port-ver ${finalAttrs.version}
+    python3 ./extract_assets.py -z ../build/ZAPD/ZAPD.out --norom --xml-root ../mm/assets/xml --custom-assets-path ../mm/assets/custom --custom-otr-file 2ship.o2r --port-ver $port_ver
     popd
   '';
 
@@ -176,6 +211,13 @@ stdenv.mkDerivation (finalAttrs: {
     mkdir -p $out/bin
     ln -s $out/2s2h/2s2h.elf $out/bin/2s2h
     install -Dm644 ../mm/linux/2s2hIcon.png $out/share/pixmaps/2s2h.png
+
+    install -Dm644 -t $out/share/licenses/2ship2harkinian ../LICENSE
+    install -Dm644 -t $out/share/licenses/2ship2harkinian/OTRExporter ../OTRExporter/LICENSE
+    install -Dm644 -t $out/share/licenses/2ship2harkinian/ZAPDTR ../ZAPDTR/LICENSE
+    install -Dm644 -t $out/share/licenses/2ship2harkinian/libgfxd ${libgfxd}/LICENSE
+    install -Dm644 -t $out/share/licenses/2ship2harkinian/libultraship ../libultraship/LICENSE
+    install -Dm644 -t $out/share/licenses/2ship2harkinian/thread_pool ${thread_pool}/LICENSE.txt
   '';
 
   postFixup = ''
@@ -201,7 +243,7 @@ stdenv.mkDerivation (finalAttrs: {
     platforms = [ "x86_64-linux" ];
     maintainers = with lib.maintainers; [ qubitnano ];
     license = with lib.licenses; [
-      # OTRExporter, OTRGui, ZAPDTR, libultraship
+      # OTRExporter, ZAPDTR, libultraship, libgfxd, thread_pool
       mit
       # 2 Ship 2 Harkinian
       cc0

pkgs/by-name/_6/_64gram/package.nix

@@ -1,6 +1,5 @@
 {
   lib,
-  stdenv,
   fetchFromGitHub,
   telegram-desktop,
   alsa-lib,
@@ -15,13 +14,13 @@ telegram-desktop.override {
   inherit withWebkit;
   unwrapped = telegram-desktop.unwrapped.overrideAttrs (old: rec {
     pname = "64gram-unwrapped";
-    version = "1.1.82";
+    version = "1.1.84";
 
     src = fetchFromGitHub {
       owner = "TDesktop-x64";
       repo = "tdesktop";
       tag = "v${version}";
-      hash = "sha256-Jul9gKhoazNMicdkZerzAPpsuO+MSvtqr6ZzaALTeJ0=";
+      hash = "sha256-CtDCrgKZpaTdR+Eh9H1uq7EmO0SFIgHKlW/zeeWBaCM=";
       fetchSubmodules = true;
     };
 
@@ -43,7 +42,7 @@ telegram-desktop.override {
       homepage = "https://github.com/TDesktop-x64/tdesktop";
       changelog = "https://github.com/TDesktop-x64/tdesktop/releases/tag/v${version}";
       maintainers = with lib.maintainers; [ clot27 ];
-      mainProgram = if stdenv.hostPlatform.isLinux then "telegram-desktop" else "Telegram";
+      mainProgram = "Telegram";
     };
   });
 }

pkgs/by-name/al/alcove/package.nix

@@ -0,0 +1,42 @@
+{
+  lib,
+  stdenvNoCC,
+  fetchurl,
+  nix-update-script,
+  unzip,
+}:
+
+stdenvNoCC.mkDerivation (finalAttrs: {
+  pname = "alcove";
+  version = "1.4.1";
+
+  src = fetchurl {
+    url = "https://github.com/henrikruscon/alcove-releases/releases/download/${finalAttrs.version}/Alcove.zip";
+    hash = "sha256-9SYqvJqLC4h4AcK/F86S7H15PiW+tcmaF83ILdc/ejE=";
+  };
+
+  sourceRoot = ".";
+
+  nativeBuildInputs = [ unzip ];
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p $out/Applications
+    cp -R ./Alcove.app $out/Applications
+
+    runHook postInstall
+  '';
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "Dynamic Island for your Mac";
+    homepage = "https://tryalcove.com/";
+    changelog = "https://github.com/henrikruscon/alcove-releases/releases/tag/${finalAttrs.version}";
+    license = lib.licenses.unfree;
+    maintainers = with lib.maintainers; [ delafthi ];
+    platforms = [ "aarch64-darwin" ];
+    sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
+  };
+})

pkgs/by-name/al/aliyun-cli/package.nix

@@ -8,13 +8,13 @@
 
 buildGoModule rec {
   pname = "aliyun-cli";
-  version = "3.1.2";
+  version = "3.1.4";
 
   src = fetchFromGitHub {
     owner = "aliyun";
     repo = "aliyun-cli";
     tag = "v${version}";
-    hash = "sha256-8nwCVhUMQLXnWcrA9XSOM6R+Y7E+H+gwSYXDjk2WtAs=";
+    hash = "sha256-7G7kgRe89G/WbiirIsRJeunbM4VzrePqA1cqQvb5oZY=";
     fetchSubmodules = true;
   };
 

pkgs/by-name/al/altermime/package.nix

@@ -23,7 +23,9 @@ gccStdenv.mkDerivation rec {
 
   postPatch = ''
     mkdir -p $out/bin
-    substituteInPlace Makefile --replace "/usr/local" "$out"
+    substituteInPlace Makefile \
+      --replace-fail "/usr/local" "$out" \
+      --replace-fail "strip " "${gccStdenv.cc.targetPrefix}strip "
   '';
 
   meta = with lib; {

pkgs/by-name/ap/apko/package.nix

@@ -11,13 +11,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "apko";
-  version = "0.30.21";
+  version = "0.30.22";
 
   src = fetchFromGitHub {
     owner = "chainguard-dev";
     repo = "apko";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-YDEu1fn1EHeMulvno6KeHIr4bAJ5RwPXWomqzGFUfrQ=";
+    hash = "sha256-wHspbxGnTOFF6zKWlW0OjgxmYPdoG2LWUTq2lH7i5Fk=";
     # populate values that require us to use git. By doing this in postFetch we
     # can delete .git afterwards and maintain better reproducibility of the src.
     leaveDotGit = true;
@@ -29,7 +29,7 @@ buildGoModule (finalAttrs: {
       find "$out" -name .git -print0 | xargs -0 rm -rf
     '';
   };
-  vendorHash = "sha256-JFDwztOEupORbkhOm/Vl5SuTaLbdp8YXXRO0jVJI/Uk=";
+  vendorHash = "sha256-6AP2cf5URe2vVKVYl9O00CbGPXD8Zg1OE8V8rF9+/MI=";
 
   nativeBuildInputs = [ installShellFiles ];
 

pkgs/by-name/ar/art/package.nix

@@ -40,13 +40,13 @@
 
 stdenv.mkDerivation rec {
   pname = "art";
-  version = "1.25.10";
+  version = "1.25.11";
 
   src = fetchFromGitHub {
     owner = "artpixls";
     repo = "ART";
     tag = version;
-    hash = "sha256-qGrkRsdQppfIolxAhxWnJrbYotELKga6X7CFY55xCKk=";
+    hash = "sha256-viX2GjPV4ZvaK7u6KgANbbMLCFRLbCwd48NiIcsHqSY=";
   };
 
   # Fix the build with CMake 4.

pkgs/by-name/aw/awsebcli/package.nix

@@ -4,6 +4,7 @@
   fetchFromGitHub,
   fetchPypi,
   git,
+  versionCheckHook,
 }:
 
 let
@@ -25,14 +26,15 @@ in
 
 python.pkgs.buildPythonApplication rec {
   pname = "awsebcli";
-  version = "3.25.2";
+  version = "3.25.3";
   pyproject = true;
+  doInstallCheck = true;
 
   src = fetchFromGitHub {
     owner = "aws";
     repo = "aws-elastic-beanstalk-cli";
     tag = version;
-    hash = "sha256-6PeOn0owjEjTWdEwgXILiGq+6T5GBBc61viiG5GNeYo=";
+    hash = "sha256-PFyLVpmye+WIiF9xR37ydjLy0OvlIMDSIMaN4y0WM/E=";
   };
 
   pythonRelaxDeps = [
@@ -68,7 +70,9 @@ python.pkgs.buildPythonApplication rec {
     mock
     pytest-socket
     pytestCheckHook
+    versionCheckHook
   ];
+  versionCheckProgramArg = "--version";
 
   enabledTestPaths = [
     "tests/unit"

pkgs/by-name/ay/ayugram-desktop/package.nix

@@ -1,6 +1,5 @@
 {
   lib,
-  fetchpatch2,
   fetchFromGitHub,
   nix-update-script,
   telegram-desktop,
@@ -13,25 +12,16 @@ telegram-desktop.override {
   unwrapped = telegram-desktop.unwrapped.overrideAttrs (
     finalAttrs: previousAttrs: {
       pname = "ayugram-desktop-unwrapped";
-      version = "5.16.3";
+      version = "6.2.4";
 
       src = fetchFromGitHub {
         owner = "AyuGram";
         repo = "AyuGramDesktop";
-        rev = "aafdac6da465e6498e39e1b55566fc8fe2402843";
-        hash = "sha256-GNFkGw/CxtbeoEMBjExNudBcKFwlfXee5VVnXa4wGko=";
+        tag = "v${finalAttrs.version}";
+        hash = "sha256-bFGk8lqPlNlaxbrulYe0+8ayj33frctruce3/TZ+W2c=";
         fetchSubmodules = true;
       };
 
-      # fix build failure with Qt 6.10
-      patches = fetchpatch2 {
-        name = "fix-build-with-qt-610.patch";
-        url = "https://github.com/desktop-app/cmake_helpers/commit/682f1b57.patch";
-        hash = "sha256-DHwgxAEFc1byQkVvrPwyctQKvUsK/KQ/cnzRv6PQuTM=";
-        stripLen = 1;
-        extraPrefix = "cmake/";
-      };
-
       passthru.updateScript = nix-update-script { };
 
       meta = previousAttrs.meta // {

pkgs/by-name/ba/bayescan/package.nix

@@ -24,8 +24,8 @@ stdenv.mkDerivation rec {
   sourceRoot = "BayeScan${version}/source";
 
   postPatch = ''
-    substituteInPlace Makefile --replace "-static" "" \
-                               --replace "g++" "c++"
+    substituteInPlace Makefile --replace-fail "-static" "" \
+                               --replace-fail "g++" "${stdenv.cc.targetPrefix}c++"
   '';
 
   installPhase = ''

pkgs/by-name/bo/bootdev-cli/package.nix

@@ -11,13 +11,13 @@
 
 buildGoModule rec {
   pname = "bootdev-cli";
-  version = "1.20.5";
+  version = "1.20.6";
 
   src = fetchFromGitHub {
     owner = "bootdotdev";
     repo = "bootdev";
     tag = "v${version}";
-    hash = "sha256-iVL2nRQb4A7UfhiQSBBbaxM1Yqc2pESvRfQ3xSjGq10=";
+    hash = "sha256-/53s+XYMhxo9i1ZeWuV3xiZnhcS5rBJUvM3acb8TiWM=";
   };
 
   vendorHash = "sha256-jhRoPXgfntDauInD+F7koCaJlX4XDj+jQSe/uEEYIMM=";

pkgs/by-name/bu/burpsuite/package.nix

@@ -9,20 +9,20 @@
 }:
 
 let
-  version = "2025.10.4";
+  version = "2025.11";
 
   product =
     if proEdition then
       {
         productName = "pro";
         productDesktop = "Burp Suite Professional Edition";
-        hash = "sha256-Y6VeAAKeVxS0LclD9xu56KIiMK7FjlTHAhjtt5m6S2I=";
+        hash = "sha256-/LudYYETnUT7Ynqw3HO822hdMUoz3mrTPae7ZO8SMyE=";
       }
     else
       {
         productName = "community";
         productDesktop = "Burp Suite Community Edition";
-        hash = "sha256-cHnQmhiSl/c0HteD+LED2wjvDvdJJmgDD00CynFdkB0=";
+        hash = "sha256-x4q5QkBIBFqG8Bjx5NuschNB4dX/8t2vCHNVRDa0kQQ=";
       };
 
   src = fetchurl {

pkgs/by-name/ca/cargo-shear/package.nix

@@ -1,38 +1,48 @@
 {
-  fetchFromGitHub,
   lib,
+  fetchCrate,
   rustPlatform,
+  nix-update-script,
   testers,
-  cargo-shear,
 }:
-let
-  version = "1.5.1";
-in
-rustPlatform.buildRustPackage {
-  pname = "cargo-shear";
-  inherit version;
 
-  src = fetchFromGitHub {
-    owner = "Boshen";
-    repo = "cargo-shear";
-    rev = "v${version}";
-    hash = "sha256-4qj+hSoByE5sfT9LTm7hsYsYpOJc5Yxak1V980L/F3c=";
+rustPlatform.buildRustPackage (finalAttrs: {
+  pname = "cargo-shear";
+  version = "1.6.2";
+
+  src = fetchCrate {
+    pname = "cargo-shear";
+    version = finalAttrs.version;
+    hash = "sha256-5N8sAKStdQnrgzXECxu/oRuGVLwLx/KfW2vcPClVZGM=";
   };
 
-  cargoHash = "sha256-btXeytQRZ74S55cbANRGHmLPSXssNPpE/yjA1cJTy7g=";
+  cargoHash = "sha256-WdB4oJtQAh90Fe+Km+SddpmyvHdyemo3KsuRyBtZ5FY=";
 
-  # https://github.com/Boshen/cargo-shear/blob/a0535415a3ea94c86642f39f343f91af5cdc3829/src/lib.rs#L20-L23
-  SHEAR_VERSION = version;
-  passthru.tests.version = testers.testVersion {
-    package = cargo-shear;
+  env = {
+    # https://github.com/Boshen/cargo-shear/blob/v1.6.2/src/lib.rs#L51-L54
+    SHEAR_VERSION = finalAttrs.version;
+  };
+
+  # Integration tests require network access
+  cargoTestFlags = [
+    "--lib"
+  ];
+
+  passthru = {
+    updateScript = nix-update-script { };
+    tests = {
+      version = testers.testVersion {
+        package = finalAttrs.finalPackage;
+      };
+    };
   };
 
   meta = {
     description = "Detect and remove unused dependencies from Cargo.toml";
     mainProgram = "cargo-shear";
     homepage = "https://github.com/Boshen/cargo-shear";
-    changelog = "https://github.com/Boshen/cargo-shear/blob/v${version}/CHANGELOG.md";
+    changelog = "https://github.com/Boshen/cargo-shear/blob/v${finalAttrs.version}/CHANGELOG.md";
     license = [ lib.licenses.mit ];
-    maintainers = [ ];
+    maintainers = [ lib.maintainers.cathalmullan ];
   };
-}
+})

pkgs/by-name/ch/chamber/package.nix

@@ -6,13 +6,13 @@
 
 buildGoModule rec {
   pname = "chamber";
-  version = "3.1.3";
+  version = "3.1.4";
 
   src = fetchFromGitHub {
     owner = "segmentio";
     repo = "chamber";
     rev = "v${version}";
-    sha256 = "sha256-Hh+u5Rf7YN1Gk2whBMXmtXdXCSeh2CqaQBSzw8KNb5E=";
+    sha256 = "sha256-CSLG1y7D2dozwB5Lme9xX+kjDuPB/5cOrsfmvGDXX4E=";
   };
 
   env.CGO_ENABLED = 0;

pkgs/by-name/ch/check-jsonschema/package.nix

@@ -6,14 +6,14 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "check-jsonschema";
-  version = "0.34.1";
+  version = "0.35.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "python-jsonschema";
     repo = "check-jsonschema";
     tag = version;
-    hash = "sha256-TI8NW8ULsig/YL6LC8L//YS0lSIUS2Ns9awFJ50ov2k=";
+    hash = "sha256-IiNUgv0XZtTzCJjp/4jyTpw9MAyBFtuf3N4VFqatZVg=";
   };
 
   build-system = with python3Packages; [ setuptools ];

pkgs/by-name/ch/chirp/package.nix

@@ -11,14 +11,14 @@
 
 python3Packages.buildPythonApplication {
   pname = "chirp";
-  version = "0.4.0-unstable-2025-11-05";
+  version = "0.4.0-unstable-2025-11-12";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "kk7ds";
     repo = "chirp";
-    rev = "0d2703ecad8b055a33220de592dc11bcbc153a20";
-    hash = "sha256-5O0bmxVpmAkonRInl3L2MplYnZSkkFVLRd4bz59HFv4=";
+    rev = "7c1d614e74b590f84f1e01bf735143d1de017fcb";
+    hash = "sha256-o6bkA/Xjv0Q8oQE/aAUEYOqlZfEXn3rcDfFfhqm6TTE=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/cn/cnspec/package.nix

@@ -6,18 +6,18 @@
 
 buildGoModule rec {
   pname = "cnspec";
-  version = "12.8.0";
+  version = "12.9.0";
 
   src = fetchFromGitHub {
     owner = "mondoohq";
     repo = "cnspec";
     tag = "v${version}";
-    hash = "sha256-9vGqElva4sS0uV2Be1WV9dW2bLYNOFZRB3wF3rSassM=";
+    hash = "sha256-90bM85hKI1XOxdHsVstzJANnWJEhTmmDzzUqL3qx9n4=";
   };
 
   proxyVendor = true;
 
-  vendorHash = "sha256-aEiHnYEJGg+kTUN2k9GKUtSaNpdQio5OsEJ8EnbxPLk=";
+  vendorHash = "sha256-Jf5R5Bz6VgPON49qrrV0Pyd42NfTImSFX0TATT+udOM=";
 
   subPackages = [ "apps/cnspec" ];
 

pkgs/by-name/co/coc-markdownlint/package.nix

@@ -7,16 +7,16 @@
 
 buildNpmPackage {
   pname = "coc-markdownlint";
-  version = "0-unstable-2025-11-01";
+  version = "0-unstable-2025-11-15";
 
   src = fetchFromGitHub {
     owner = "fannheyward";
     repo = "coc-markdownlint";
-    rev = "4e507d516ccb0e0287c95d909db85676d786e9bd";
-    hash = "sha256-fNUmrwjCiMYZHXkI4RPn4BMRxiWW+BoVEvaSMIsEMeQ=";
+    rev = "5bdcde01bf7c8f468581dc8bab54d3a5de04fb86";
+    hash = "sha256-ndvqkYnD1skKhV3DHgKQkC5fsrbmt+COo+jGyLJjpDA=";
   };
 
-  npmDepsHash = "sha256-JMXeWQZMYkhUqE5DdYBRRhyHDAqr9VkKATRQE6eOGys=";
+  npmDepsHash = "sha256-LomwzsDT2I+fhcmiabj6CzwaSzV4bgV7azG6/TcJuQw=";
 
   passthru.updateScript = nix-update-script { extraArgs = [ "--version=branch" ]; };
 

pkgs/by-name/co/commitlint/package.nix

@@ -5,6 +5,8 @@
   fetchYarnDeps,
   yarnConfigHook,
   nodejs,
+  makeBinaryWrapper,
+  versionCheckHook,
   nix-update-script,
 }:
 
@@ -15,7 +17,7 @@ stdenv.mkDerivation (finalAttrs: {
   src = fetchFromGitHub {
     owner = "conventional-changelog";
     repo = "commitlint";
-    rev = "v${finalAttrs.version}";
+    tag = "v${finalAttrs.version}";
     hash = "sha256-o8AnIewSmg8vRjs8LU6QwRyl2hMQ2iK5W7WL137treU=";
   };
 
@@ -27,16 +29,41 @@ stdenv.mkDerivation (finalAttrs: {
   nativeBuildInputs = [
     yarnConfigHook
     nodejs
+    makeBinaryWrapper
   ];
 
   buildPhase = ''
     runHook preBuild
 
-    pkgs=("config-validator" "rules" "parse" "is-ignored" "lint"
-          "resolve-extends" "execute-rule" "load" "read" "types" "cli")
+    # Remove test files to avoid dependency on commitlint test packages
+    rm -rf @commitlint/**/*.test.{js,ts}
+
+    # See https://github.com/conventional-changelog/commitlint/blob/20.1.0/Dockerfile.ci
+    # Excludes `config-nx-scopes` which is a plain JavaScript package
+    pkgs=(
+      "config-validator"
+      "rules"
+      "parse"
+      "is-ignored"
+      "lint"
+      "resolve-extends"
+      "execute-rule"
+      "load"
+      "read"
+      "types"
+      "cli"
+      "config-conventional"
+      "config-pnpm-scopes"
+      "ensure"
+      "format"
+      "message"
+      "to-lines"
+      "top-level"
+    )
     for p in "''${pkgs[@]}" ; do
+      echo "Building package: @commitlint/$p"
       cd @commitlint/$p/
-      yarn run tsc --build --force
+      yarn run --offline tsc --build --force
       cd ../..
     done
 
@@ -50,15 +77,23 @@ stdenv.mkDerivation (finalAttrs: {
     mkdir -p $out/bin
     mkdir -p $out/lib/node_modules/@commitlint/root
     mv * $out/lib/node_modules/@commitlint/root/
-    ln -s $out/lib/node_modules/@commitlint/root/@commitlint/cli/cli.js $out/bin/commitlint
+
+    makeBinaryWrapper ${lib.getExe nodejs} $out/bin/commitlint \
+      --add-flags "$out/lib/node_modules/@commitlint/root/@commitlint/cli/cli.js" \
+      --set NODE_PATH "$out/lib/node_modules/@commitlint/root/node_modules"
 
     runHook postInstall
   '';
 
+  nativeInstallCheckInputs = [
+    versionCheckHook
+  ];
+  doInstallCheck = true;
+
   passthru.updateScript = nix-update-script { };
 
   meta = {
-    changelog = "https://github.com/conventional-changelog/commitlint/releases/tag/v${finalAttrs.version}";
+    changelog = "https://github.com/conventional-changelog/commitlint/releases/tag/${finalAttrs.src.tag}";
     description = "Lint your commit messages";
     homepage = "https://commitlint.js.org/";
     license = lib.licenses.mit;

pkgs/by-name/co/conmon-rs/package.nix

@@ -8,13 +8,13 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "conmon-rs";
-  version = "0.7.2";
+  version = "0.7.3";
 
   src = fetchFromGitHub {
     owner = "containers";
     repo = "conmon-rs";
     rev = "v${version}";
-    hash = "sha256-FZwX9xihg2mKpHT11FCASyoJ5nDUkAa4Cqk5zRQOfeY=";
+    hash = "sha256-fs+IcibhyoC5+Sbr9lWtBbb0Sk6Uf+YVockXNbCLXCY=";
   };
 
   nativeBuildInputs = [
@@ -23,7 +23,7 @@ rustPlatform.buildRustPackage rec {
   ];
   doCheck = false;
 
-  cargoHash = "sha256-JVUckmOAJj4zNBe4yq/JzrPw+IqfhiZRB6s03ZxXFV4=";
+  cargoHash = "sha256-l+FcrLPE+EGb3IEWikUJ1Ak8lOSlYz9WvUffGHzU0tc=";
 
   meta = with lib; {
     description = "OCI container runtime monitor written in Rust";

pkgs/by-name/co/contact/package.nix

@@ -6,14 +6,14 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "contact";
-  version = "1.4.1";
+  version = "1.4.3";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "pdxlocations";
     repo = "contact";
     tag = version;
-    hash = "sha256-od0sF+c6ToNNtGmGxikGsXniQ3HCm4Hz3ynrzXCNJmw=";
+    hash = "sha256-PjWVjvuHAgHR1/G4LfwhG0g45XoLTUf6BumopwgOPe0=";
   };
 
   dependencies = [ python3Packages.meshtastic ];

pkgs/by-name/co/conventional-changelog-cli/package.nix

@@ -55,7 +55,13 @@ stdenv.mkDerivation (finalAttrs: {
       --replace-warn '"exports": "./src/index.ts"' '"exports": "./dist/index.js"'
   '';
 
-  passthru.updateScript = nix-update-script { };
+  passthru.updateScript = nix-update-script {
+    extraArgs = [
+      "--use-github-releases"
+      "--version-regex"
+      "conventional-changelog-v(.*)"
+    ];
+  };
 
   meta = {
     changelog = "https://github.com/conventional-changelog/conventional-changelog/releases/tag/conventional-changelog-v${finalAttrs.version}";

pkgs/by-name/co/cosmic-ext-applet-caffeine/package.nix

@@ -9,16 +9,16 @@
 }:
 rustPlatform.buildRustPackage {
   pname = "cosmic-ext-applet-caffeine";
-  version = "0-unstable-2025-10-29";
+  version = "0-unstable-2025-11-04";
 
   src = fetchFromGitHub {
     owner = "tropicbliss";
     repo = "cosmic-ext-applet-caffeine";
-    rev = "5eeb6e505eba172fbfee6b9551df8f8a3702213e";
-    hash = "sha256-sTvP62oQknRzuc3qQqUAK70uS2MqXl8lAF27V0To8NM=";
+    rev = "1a4ab86d1db1ef294b2cfb24a07f068da0f715ae";
+    hash = "sha256-8bu9a7CNAtxXV7VKw232ZwgMGOLwvPKVXWoVtX7RKKc=";
   };
 
-  cargoHash = "sha256-89/0XEdQ7MCycAkHhTkA5FCj/eKVLgWDhljKB/Lo4+4=";
+  cargoHash = "sha256-9EUrO8JNU0FPrqT6WDE+jfVgQSgODK8rbNZLgUb26EQ=";
 
   nativeBuildInputs = [
     libcosmicAppHook

pkgs/by-name/cs/csharpier/package.nix

@@ -2,10 +2,10 @@
 
 buildDotnetGlobalTool {
   pname = "csharpier";
-  version = "1.2.0";
+  version = "1.2.1";
   executables = "csharpier";
 
-  nugetHash = "sha256-YEIUoh6af8DIAN6hh+3H5XbTbdJwe+f7TPXdZxWNgck=";
+  nugetHash = "sha256-JJS/jlUM2GRYKPzsIbAnRM8Jhr8/Mr6Nlmjtq9TMBuc=";
 
   meta = with lib; {
     description = "Opinionated code formatter for C#";

pkgs/by-name/de/deltachat-desktop/package.nix

@@ -37,13 +37,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "deltachat-desktop";
-  version = "2.25.1";
+  version = "2.25.2";
 
   src = fetchFromGitHub {
     owner = "deltachat";
     repo = "deltachat-desktop";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-+BZs8WUoDoW5mA7s6WIalEq3F5konJsJuZwWSdUeYiA=";
+    hash = "sha256-6gG3IVxq+N0g5e/ev9xAEcb1HxA+3961T5MSXWxUzyo=";
   };
 
   pnpmDeps = pnpm.fetchDeps {

pkgs/by-name/de/dex-oidc/package.nix

@@ -1,24 +1,24 @@
 {
   lib,
-  buildGo124Module,
+  buildGoModule,
   fetchFromGitHub,
   nixosTests,
   testers,
   dex-oidc,
 }:
 
-buildGo124Module rec {
+buildGoModule (finalAttrs: {
   pname = "dex";
-  version = "2.43.0";
+  version = "2.44.0";
 
   src = fetchFromGitHub {
     owner = "dexidp";
     repo = "dex";
-    rev = "v${version}";
-    sha256 = "sha256-ELklXlB691xcUdCi+B1Vwd9yvS1Txg+X+QKBMGP8354=";
+    rev = "v${finalAttrs.version}";
+    sha256 = "sha256-wpy7pZBpqAaPjWbnsqtnE+65a58IGg0pyp4CEUnmmc4=";
   };
 
-  vendorHash = "sha256-td15lXx6h4SFfTQdc4Whe2bbOpXK57OD8fyDzRvas8M=";
+  vendorHash = "sha256-3ef2G4+UlLGsBW09ZM20qU82uj/hVlMAnujcd2BulGg=";
 
   subPackages = [
     "cmd/dex"
@@ -27,7 +27,7 @@ buildGo124Module rec {
   ldflags = [
     "-w"
     "-s"
-    "-X main.version=${src.rev}"
+    "-X main.version=${finalAttrs.src.rev}"
   ];
 
   postInstall = ''
@@ -40,7 +40,7 @@ buildGo124Module rec {
     version = testers.testVersion {
       package = dex-oidc;
       command = "dex version";
-      version = "v${version}";
+      version = "v${finalAttrs.version}";
     };
   };
 
@@ -54,4 +54,4 @@ buildGo124Module rec {
     ];
     mainProgram = "dex";
   };
-}
+})

pkgs/by-name/dp/dpt-rp1-py/package.nix

@@ -5,14 +5,14 @@
 }:
 python3Packages.buildPythonApplication rec {
   pname = "dpt-rp1-py";
-  version = "0.1.18";
+  version = "0.1.19";
   format = "pyproject";
 
   src = fetchFromGitHub {
     owner = "janten";
     repo = "dpt-rp1-py";
     rev = "v${version}";
-    sha256 = "sha256-5Ny62Kp1GHH9vmPSZ6smNqyEt9PZYPHAiungHZQMB/A=";
+    sha256 = "sha256-cJ9dc8TRuduIka6T/MQsetDAjIhb+i2U9F8Qm9h29d8=";
   };
 
   doCheck = false;

pkgs/by-name/dr/dracula-theme/package.nix

@@ -8,7 +8,7 @@
 
 let
   themeName = "Dracula";
-  version = "4.0.0-unstable-2025-11-02";
+  version = "4.0.0-unstable-2025-11-11";
 in
 stdenvNoCC.mkDerivation {
   pname = "dracula-theme";
@@ -17,8 +17,8 @@ stdenvNoCC.mkDerivation {
   src = fetchFromGitHub {
     owner = "dracula";
     repo = "gtk";
-    rev = "79095df59b255996611fdc84d75bf06253f152ce";
-    hash = "sha256-NMcm5fn4P5K5OueS3sdBXX6QMMqzVAOdPHNDMb+lqh8=";
+    rev = "4d8e487dd47ad388b0bd1d9b019a8b70b72f4f78";
+    hash = "sha256-ZE1P883H1o0Gq+3a0w/eRkYajz7GQfjl1BX9Q67hfuE=";
   };
 
   propagatedUserEnvPkgs = [

pkgs/by-name/ea/easyeffects/package.nix

@@ -1,23 +1,20 @@
 {
   lib,
   stdenv,
-  appstream-glib,
   calf,
+  cmake,
   deepfilternet,
-  desktop-file-utils,
   fetchFromGitHub,
   fftw,
   fftwFloat,
-  fmt_9,
   glib,
   gsl,
-  gtk4,
-  itstool,
+  intltool,
+  kdePackages,
   ladspaH,
-  libadwaita,
   libbs2b,
   libebur128,
-  libportal-gtk4,
+  libportal-qt6,
   libsamplerate,
   libsigcxx30,
   libsndfile,
@@ -25,61 +22,82 @@
   lsp-plugins,
   lv2,
   mda_lv2,
-  meson,
   ninja,
   nix-update-script,
   nlohmann_json,
   pipewire,
   pkg-config,
+  qt6,
   rnnoise,
   rubberband,
   soundtouch,
   speexdsp,
   onetbb,
-  wrapGAppsHook4,
+  webrtc-audio-processing,
   zam-plugins,
   zita-convolver,
 }:
 
 let
-  # Fix crashes with speexdsp effects
-  speexdsp' = speexdsp.override { withFftw3 = false; };
+  inherit (qt6)
+    qtbase
+    qtgraphs
+    qtwebengine
+    wrapQtAppsHook
+    ;
+  inherit (kdePackages)
+    appstream-qt
+    breeze-icons
+    extra-cmake-modules
+    kcolorscheme
+    kconfigwidgets
+    kiconthemes
+    kirigami
+    kirigami-addons
+    qqc2-desktop-style
+    ;
 in
 
 stdenv.mkDerivation rec {
   pname = "easyeffects";
-  version = "7.2.5";
+  version = "8.0.3";
 
   src = fetchFromGitHub {
     owner = "wwmm";
     repo = "easyeffects";
     tag = "v${version}";
-    hash = "sha256-w3Mb13LOSF8vgcdJrqbesLqyyilI5AoA19jFquE5lEw=";
+    hash = "sha256-N1VxA68IzNPZcDodoFTdQ0zpS5hCrHyLjP8Y/bqO/JA=";
   };
 
+  patches = [ ./qmlmodule-fix.patch ];
+
   nativeBuildInputs = [
-    desktop-file-utils
-    itstool
-    meson
+    cmake
+    extra-cmake-modules
+    intltool
     ninja
     pkg-config
-    wrapGAppsHook4
+    wrapQtAppsHook
   ];
 
   buildInputs = [
-    appstream-glib
+    appstream-qt
+    breeze-icons
     deepfilternet
     fftw
     fftwFloat
-    fmt_9
     glib
     gsl
-    gtk4
+    kcolorscheme
+    kconfigwidgets
+    kiconthemes
+    kirigami
+    kirigami-addons
     ladspaH
-    libadwaita
+    qqc2-desktop-style
     libbs2b
     libebur128
-    libportal-gtk4
+    libportal-qt6
     libsamplerate
     libsigcxx30
     libsndfile
@@ -87,11 +105,15 @@ stdenv.mkDerivation rec {
     lv2
     nlohmann_json
     pipewire
+    qtbase
+    qtgraphs
+    qtwebengine
     rnnoise
     rubberband
     soundtouch
-    speexdsp'
+    speexdsp
     onetbb
+    webrtc-audio-processing
     zita-convolver
   ];
 
@@ -110,7 +132,7 @@ stdenv.mkDerivation rec {
       ];
     in
     ''
-      gappsWrapperArgs+=(
+      qtWrapperArgs+=(
         --set LV2_PATH "${lib.makeSearchPath "lib/lv2" lv2Plugins}"
         --set LADSPA_PATH "${lib.makeSearchPath "lib/ladspa" ladspaPlugins}"
       )
@@ -130,6 +152,7 @@ stdenv.mkDerivation rec {
     maintainers = with lib.maintainers; [
       getchoo
       aleksana
+      Gliczy
     ];
     mainProgram = "easyeffects";
     platforms = lib.platforms.linux;

pkgs/by-name/ea/easyeffects/qmlmodule-fix.patch

@@ -0,0 +1,12 @@
+diff --git a/CMakeLists.txt b/CMakeLists.txt
+index 2736ac18b..85be09a90 100644
+--- a/CMakeLists.txt
++++ b/CMakeLists.txt
+@@ -65,7 +65,7 @@ find_package(KF${QT_MAJOR_VERSION} REQUIRED COMPONENTS
+     QQC2DesktopStyle
+ )
+ 
+-ecm_find_qmlmodule(org.kde.kirigami REQUIRED)
++ecm_find_qmlmodule(org.kde.kirigami)
+ 
+ qt_policy(SET QTP0001 NEW)

pkgs/by-name/fa/faircamp/package.nix

@@ -15,17 +15,17 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "faircamp";
-  version = "1.6.0";
+  version = "1.7.0";
 
   src = fetchFromGitea {
     domain = "codeberg.org";
     owner = "simonrepp";
     repo = "faircamp";
     rev = version;
-    hash = "sha256-J6OzbZbKT1ZnVG559JKLDh5R9xI3WUYx3pvvb15CAI8=";
+    hash = "sha256-r5r7vfTbMPjAqMg5f7L/YfSzlxZgrSFjO6WHO64wfIo=";
   };
 
-  cargoHash = "sha256-I5L+TKMKpUUvkh7tWw7hdCRK6CLj0PBzkfdJqPk3YJE=";
+  cargoHash = "sha256-11EcYZw6Dq0Ls1fhBYLlvvHeZtiaweg6JAGBmkX+acw=";
 
   buildFeatures = [ "libvips" ];
 

pkgs/by-name/fa/fastddsgen/493-addendum.patch

@@ -0,0 +1,17 @@
+    Fix gradle error
+    
+    https://docs.gradle.org/9.1.0/userguide/validation_problems.html#private_method_must_not_be_annotated
+
+diff --git a/build.gradle b/build.gradle
+index c6d537e..9029aae 100644
+--- a/build.gradle
++++ b/build.gradle
+@@ -69,7 +69,7 @@ public abstract class InstallPath extends DefaultTask {
+      * Install Task Action that copies the script and jar files
+      */
+     @TaskAction
+-    private void install() {
++    public void install() {
+         if (Os.isFamily(Os.FAMILY_WINDOWS)) {
+             final String install_path = (path != null && !path.isEmpty()) ? path : "C:\\Program Files\\fastddsgen\\";
+ 

pkgs/by-name/fa/fastddsgen/package.nix

@@ -3,36 +3,53 @@
   stdenv,
   makeWrapper,
   fetchFromGitHub,
-  gradle_7,
-  openjdk17,
+  fetchpatch2,
+  gradle,
+  openjdk,
+  testers,
 }:
 
-let
+stdenv.mkDerivation (finalAttrs: {
   pname = "fastddsgen";
   version = "4.2.0";
 
-  gradle = gradle_7;
-
-in
-stdenv.mkDerivation {
-  inherit pname version;
-
   src = fetchFromGitHub {
     owner = "eProsima";
     repo = "Fast-DDS-Gen";
-    tag = "v${version}";
+    tag = "v${finalAttrs.version}";
     fetchSubmodules = true;
     hash = "sha256-weGS340MvPitWMgWx1cWTgYgGcQfJSTUus8EcBob7hY=";
   };
 
+  patches = [
+    # Note: PR is not yet merged
+    # Select commit from https://github.com/eProsima/IDL-Parser/pull/179
+    (fetchpatch2 {
+      url = "https://github.com/eProsima/IDL-Parser/commit/801ed2f671322c0134b8db180529c9a400d5ed2b.patch";
+      stripLen = 1;
+      extraPrefix = "thirdparty/idl-parser/";
+      includes = [ "thirdparty/idl-parser/build.gradle" ];
+      hash = "sha256-OzywQ02yaMnya+536DeHWeKwZefI4meYqmZcp3onwR8=";
+    })
+
+    # Note: PR is not yet merged
+    # Select commit from https://github.com/eProsima/Fast-DDS-Gen/pull/493
+    (fetchpatch2 {
+      url = "https://github.com/eProsima/Fast-DDS-Gen/commit/b1b66d587f38d4fd6227aa1969c3a10c2095ae7d.patch";
+      hash = "sha256-qVp9Xk8og8Ga2BMiqt2BFM0lAtDnmmwzteceievfcXE=";
+    })
+
+    ./493-addendum.patch
+  ];
+
   nativeBuildInputs = [
     gradle
-    openjdk17
+    openjdk
     makeWrapper
   ];
 
   mitmCache = gradle.fetchDeps {
-    inherit pname;
+    inherit (finalAttrs) pname;
     data = ./deps.json;
   };
 
@@ -51,7 +68,7 @@ stdenv.mkDerivation {
     # Override the default start script to use absolute java path.
     # Make the unwrapped "cpp" available in the path, since the wrapped "cpp"
     # passes additional flags and produces output incompatible with fastddsgen.
-    makeWrapper ${openjdk17}/bin/java $out/bin/fastddsgen \
+    makeWrapper ${openjdk}/bin/java $out/bin/fastddsgen \
       --add-flags "-jar $out/share/fastddsgen/java/fastddsgen.jar" \
       --prefix PATH : ${lib.makeBinPath [ stdenv.cc.cc ]}
 
@@ -65,6 +82,11 @@ stdenv.mkDerivation {
     gradle nixDownloadDeps
   '';
 
+  passthru.tests = testers.testVersion {
+    command = "${finalAttrs.meta.mainProgram} -version";
+    package = finalAttrs.finalPackage;
+  };
+
   meta = with lib; {
     description = "Fast-DDS IDL code generator tool";
     mainProgram = "fastddsgen";
@@ -79,6 +101,6 @@ stdenv.mkDerivation {
       used to publish or subscribe.
     '';
     maintainers = with maintainers; [ wentasah ];
-    platforms = openjdk17.meta.platforms;
+    platforms = openjdk.meta.platforms;
   };
-}
+})

pkgs/by-name/fa/fastmail-desktop/darwin.nix

@@ -5,6 +5,7 @@
   passthru,
   meta,
   stdenvNoCC,
+  unzip,
 }:
 stdenvNoCC.mkDerivation {
   inherit
@@ -15,6 +16,9 @@ stdenvNoCC.mkDerivation {
     meta
     ;
 
+  sourceRoot = ".";
+  nativeBuildInputs = [ unzip ];
+
   installPhase = ''
     mkdir -p $out/Applications
     cp -R Fastmail.app $out/Applications/

pkgs/by-name/fa/fastmail-desktop/sources.nix

@@ -1,20 +1,19 @@
 # Generated by ./update.sh - do not update manually!
-# Last updated: 2025-10-30
+# Last updated: 2025-11-11
 { fetchurl, fetchzip }:
 {
   aarch64-darwin = {
-    version = "1.0.3";
-    src = fetchzip {
-      url = "https://dl.fastmailcdn.com/desktop/production/mac/arm64/Fastmail-1.0.3-arm64-mac.zip";
-      hash = "sha512-lqJj0tTwOJx1jzzXtlKOOduUEtSgVHpQCM5WkbXjmOh2OejLRcdJ1Y9CxvZJGSPBGWrErKzytMOB8QmJ1BkIdw==";
-      stripRoot = false;
+    version = "1.0.4";
+    src = fetchurl {
+      url = "https://dl.fastmailcdn.com/desktop/production/mac/arm64/Fastmail-1.0.4-arm64-mac.zip";
+      hash = "sha512-DoBG2pY8a1BjNby0/PFAmRnEdMzX3n/JNlGW1/uHvi8lmzDMfEK5F0RAE4bNW08TPnaomjQOMRnqcas/9SecuA==";
     };
   };
   x86_64-linux = {
-    version = "1.0.3";
+    version = "1.0.4";
     src = fetchurl {
-      url = "https://dl.fastmailcdn.com/desktop/production/linux/x64/Fastmail-1.0.3.AppImage";
-      hash = "sha512-L+h0GHAAlZndB4Q5Z7GiHuZqv1kTF5yCAJYYb9tPXnHfdcrwHvfBRnixEnVPPia46rp2IJ56z4ZS8RSut3ATFQ==";
+      url = "https://dl.fastmailcdn.com/desktop/production/linux/x64/Fastmail-1.0.4.AppImage";
+      hash = "sha512-lavGgtrIRiYL4NQEecpppvcTLZCgp54sTDFyVgySzBZmB6bcwCk9Kpjgepjma6iCUtUQYkN5ydtEYLZqTcSw4Q==";
     };
   };
 }

pkgs/by-name/fa/fastmail-desktop/update.sh

@@ -24,10 +24,9 @@ cat >sources.nix <<EOF
 {
   aarch64-darwin = {
     version = "$aarch64_darwin_version";
-    src = fetchzip {
+    src = fetchurl {
       url = "$aarch64_darwin_url";
       hash = "$aarch64_darwin_hash";
-      stripRoot = false;
     };
   };
   x86_64-linux = {

pkgs/by-name/fi/firefox-gnome-theme/package.nix

@@ -0,0 +1,72 @@
+{
+  lib,
+  stdenvNoCC,
+  fetchFromGitHub,
+  nix-update-script,
+}:
+
+stdenvNoCC.mkDerivation (finalAttrs: {
+  pname = "firefox-gnome-theme";
+  version = "143";
+
+  src = fetchFromGitHub {
+    owner = "rafaelmardojai";
+    repo = "firefox-gnome-theme";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-0E3TqvXAy81qeM/jZXWWOTZ14Hs1RT7o78UyZM+Jbr4=";
+  };
+
+  dontConfigure = true;
+  dontBuild = true;
+
+  # patching the install script for nix:
+  # - point to the nix store
+  # - don't preserve mode so successive installations work without elevation
+  # - don't try to move files out of the nix store
+  postPatch = ''
+    patchShebangs ./scripts
+    substituteInPlace ./scripts/auto-install.sh \
+      --replace-fail \
+        'installScript="./scripts/install.sh"' \
+        'installScript="${placeholder "out"}/bin/install.sh"' \
+      --replace-fail \
+        'eval "chmod +x ''${installScript}"' \
+        ""
+    substituteInPlace ./scripts/install.sh \
+      --replace-fail \
+        'THEMEDIRECTORY=$(cd "$(dirname $0)" && cd .. && pwd)' \
+        'THEMEDIRECTORY="${placeholder "out"}/share/firefox-gnome-theme"' \
+      --replace-fail \
+        'cp -fR "$THEMEDIRECTORY/."' \
+        'cp -fR --no-preserve=mode "$THEMEDIRECTORY/."' \
+      --replace-fail \
+        'mv chrome/firefox-gnome-theme/configuration/user.js' \
+        'cp chrome/firefox-gnome-theme/configuration/user.js'
+  '';
+
+  installPhase = ''
+    runHook preInstall
+
+    install -Dm555 ./scripts/{auto-,}install.sh -t $out/bin
+    install -Dm644 ./icon.svg ./user{Chrome,Content}.css -t $out/share/firefox-gnome-theme
+    install -Dm644 ./configuration/user.js -t $out/share/firefox-gnome-theme/configuration
+    cp -r ./theme $out/share/firefox-gnome-theme
+
+    runHook postInstall
+  '';
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "GNOME theme for Firefox";
+    longDescription = ''
+      A GNOME theme for Firefox.
+      This theme follows latest GNOME Adwaita style.
+    '';
+    homepage = "https://github.com/rafaelmardojai/firefox-gnome-theme";
+    downloadPage = "https://github.com/rafaelmardojai/firefox-gnome-theme/releases/tag/v${finalAttrs.version}";
+    license = lib.licenses.unlicense;
+    maintainers = [ lib.maintainers.nekowinston ];
+    platforms = lib.platforms.all;
+  };
+})

pkgs/by-name/fi/fish/package.nix

@@ -331,7 +331,8 @@ stdenv.mkDerivation (finalAttrs: {
   ]
   ++ lib.optional (!stdenv.hostPlatform.isDarwin) man-db;
 
-  doCheck = true;
+  # disable darwin pending https://github.com/NixOS/nixpkgs/pull/462090 getting through staging
+  doCheck = !stdenv.hostPlatform.isDarwin;
 
   nativeCheckInputs = [
     coreutils

pkgs/by-name/fs/fselect/package.nix

@@ -9,16 +9,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "fselect";
-  version = "0.9.0";
+  version = "0.9.1";
 
   src = fetchFromGitHub {
     owner = "jhspetersson";
     repo = "fselect";
     rev = version;
-    sha256 = "sha256-uR0AElAjzvxymA9K/JySfYpPK59G2SaLTfZpdFtTg/g=";
+    sha256 = "sha256-6TKCasE+Cks/f716mtEnPOvjcbQ7weipbGfFwnBYXJk=";
   };
 
-  cargoHash = "sha256-j/c2+I/KIYgNxYiHE2oWIq5frNPFtXE5wELWsog8dsc=";
+  cargoHash = "sha256-2DmfbQWyU+1vNKxZvDw92Rh5rxFifeKEglZSV2YNfdA=";
 
   nativeBuildInputs = [ installShellFiles ];
   buildInputs = lib.optional stdenv.hostPlatform.isDarwin libiconv;

pkgs/by-name/ge/gensio/package.nix

@@ -10,13 +10,13 @@
 
 stdenv.mkDerivation rec {
   pname = "gensio";
-  version = "3.0.0";
+  version = "3.0.1";
 
   src = fetchFromGitHub {
     owner = "cminyard";
     repo = "gensio";
     rev = "v${version}";
-    sha256 = "sha256-YP5KKHpKVZhJxhCBbdXg6pTgvPRHUwdqlzDlR+hIB+w=";
+    sha256 = "sha256-rgNolodA+fjnOYP1r5pwRYxngrHJ5/Lv1XUsTIlK5KQ=";
   };
 
   passthru = {

pkgs/by-name/ge/geph/package.nix

@@ -24,16 +24,16 @@ let
 in
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "geph5";
-  version = "0.2.85";
+  version = "0.2.86";
 
   src = fetchFromGitHub {
     owner = "geph-official";
     repo = "geph5";
     rev = "geph5-client-v${finalAttrs.version}";
-    hash = "sha256-n9LeGXXL4HK4fy/lvOlyXhhu10JmxGILmhIYxhEJ1B8=";
+    hash = "sha256-68b6czefoqLskdqhc9kDIoS8eDCKu56lqvX8Jz47C3k=";
   };
 
-  cargoHash = "sha256-XCaf2sa4898xZFJLcFBRe9HTk2NCGpefQF6bfvrlca4=";
+  cargoHash = "sha256-CoYnP83Ci5Jp3Hunm2+xdXBu0mlhADf4jyfLSIXZ0jI=";
 
   postPatch = ''
     substituteInPlace binaries/geph5-client/src/vpn/*.sh \

pkgs/by-name/gg/ggshield/package.nix

@@ -7,14 +7,14 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "ggshield";
-  version = "1.44.1";
+  version = "1.45.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "GitGuardian";
     repo = "ggshield";
     tag = "v${version}";
-    hash = "sha256-PHCrUzZmpjZMAfKinBYahhwQFjByaIQ/2udSqoGMmdU=";
+    hash = "sha256-9UjdAnDcUxs/2pdhnJYncw2NBPiLpxUL5T74qbX5AcY=";
   };
 
   pythonRelaxDeps = true;

pkgs/by-name/gi/git-spice/package.nix

@@ -10,16 +10,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "git-spice";
-  version = "0.20.0";
+  version = "0.20.1";
 
   src = fetchFromGitHub {
     owner = "abhinav";
     repo = "git-spice";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-G4GnqasZkvwHviR+Bj81dRp/oOT4dxPDmIvJA9I5tCg=";
+    hash = "sha256-1kZJM1XNlpJetfJ73fbhVuav8vG9EMQs618P4ftY3eg=";
   };
 
-  vendorHash = "sha256-JtgXF4Qd4+zknl3DAQihe11dPFLiz8pQRa+apPSYb18=";
+  vendorHash = "sha256-CXCp61iBBhANFjmFybRWQ5cj/JKOfzHX2xjLzJ4IQTc=";
 
   subPackages = [ "." ];
 

pkgs/by-name/gi/github-mcp-server/package.nix

@@ -8,16 +8,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "github-mcp-server";
-  version = "0.20.1";
+  version = "0.20.2";
 
   src = fetchFromGitHub {
     owner = "github";
     repo = "github-mcp-server";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-gB2MXeQQjVP/b+3hne6Mauork5szSOFz4uWIGzecN+U=";
+    hash = "sha256-1xr0AUAfYrxR7koCn9S3VJAw8PaJvFLNyzsblqyGyC0=";
   };
 
-  vendorHash = "sha256-DcRpKFsCdGV3sOVHeyZbo/djVVBkuxRgFh7Z5yyElRw=";
+  vendorHash = "sha256-j0THkLxOcNTyUoyl3WkbjR+8urM4fmsg7Mt74S4wjqU=";
 
   ldflags = [
     "-s"

pkgs/by-name/gi/gitify/package.nix

@@ -14,13 +14,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "gitify";
-  version = "6.10.0";
+  version = "6.13.0";
 
   src = fetchFromGitHub {
     owner = "gitify-app";
     repo = "gitify";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-bTkKZc3KlclUO0XFUT1lRjPsL9AGg5u4w+8AfOXG7ao=";
+    hash = "sha256-BOpFY6Yj4rmCr+ui7pitsUT15Ls7Tzx+FviZfgGJa4E=";
   };
 
   nativeBuildInputs = [
@@ -34,7 +34,7 @@ stdenv.mkDerivation (finalAttrs: {
   pnpmDeps = pnpm_10.fetchDeps {
     inherit (finalAttrs) pname version src;
     fetcherVersion = 2;
-    hash = "sha256-Ol8/SSVJ4RXLK1F9cztQODkq+zAxJtbKyPzMVBjluLY=";
+    hash = "sha256-S4K6IZjWDfUdnvwfGin4kZjc10c9Xml8NwFkMpWtDDQ=";
   };
 
   env.ELECTRON_SKIP_BINARY_DOWNLOAD = 1;

pkgs/by-name/go/go-task/package.nix

@@ -10,16 +10,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "go-task";
-  version = "3.45.4";
+  version = "3.45.5";
 
   src = fetchFromGitHub {
     owner = "go-task";
     repo = "task";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-LRarr739kFDSxtmAqw8BnxpBVjfI8xgejxgxjeB2oQU=";
+    hash = "sha256-YIsFADsGDgBR8TYrvhyz1DR1q6wZXDhjSsWi8DeijFA=";
   };
 
-  vendorHash = "sha256-/hnrVJzTqyTKlV/mK4074NE0VT4JSj7BvN3PWu6e4kI=";
+  vendorHash = "sha256-DQqz/GwV8SIsQsyF39Rzw+ojzhVw6Ih2j5utILEomV4=";
 
   nativeBuildInputs = [ installShellFiles ];
 

pkgs/by-name/go/goctl/package.nix

@@ -6,16 +6,16 @@
 
 buildGoModule rec {
   pname = "goctl";
-  version = "1.9.2";
+  version = "1.9.3";
 
   src = fetchFromGitHub {
     owner = "zeromicro";
     repo = "go-zero";
     tag = "v${version}";
-    hash = "sha256-wS8Hb0sqP2iPjF3EgkmmsE6aHpyiRw4kcYpDPmJvpic=";
+    hash = "sha256-Q5fRu7EKCPlO6yxEe/GWs4zam7MnomYJn9u0BZqDMy4=";
   };
 
-  vendorHash = "sha256-HTLpgrKDm+Sw7Y5VV13kitqF6mn479JxQbCAFMy0tTU=";
+  vendorHash = "sha256-wAQF2twQSKD8rxBchU/L4o8Z5noGK/ITAelUAHMj5gg=";
 
   modRoot = "tools/goctl";
   subPackages = [ "." ];

pkgs/by-name/go/google-alloydb-auth-proxy/package.nix

@@ -7,18 +7,18 @@
 
 buildGoModule rec {
   pname = "google-alloydb-auth-proxy";
-  version = "1.13.7";
+  version = "1.13.8";
 
   src = fetchFromGitHub {
     owner = "GoogleCloudPlatform";
     repo = "alloydb-auth-proxy";
     tag = "v${version}";
-    hash = "sha256-I0AyOY9aM6XoKQ4D+KYR3AytUfPpK4TRQNRy+T8ZmN4=";
+    hash = "sha256-aEEy14rQPCvOP6TnfS+kyuNotWkIOApe8BwL4M7cvdY=";
   };
 
   subPackages = [ "." ];
 
-  vendorHash = "sha256-IhGAvn30Hd1vu4w19jKkjtbhh7gbATsLep0rli4ibK8=";
+  vendorHash = "sha256-ZzSxEleXaD0w9+P20cRoAcf4NevZBZY+GhY11RRySQ8=";
 
   checkFlags = [
     "-short"

pkgs/by-name/go/gotify-desktop/package.nix

@@ -9,16 +9,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "gotify-desktop";
-  version = "1.4.1";
+  version = "1.4.2";
 
   src = fetchFromGitHub {
     owner = "desbma";
     repo = "gotify-desktop";
     rev = version;
-    sha256 = "sha256-QhzvY7MeOvrL+xxeV7gPXWRo3EinMMdS9A7oh38gYjU=";
+    sha256 = "sha256-BD8BqG+YheAGvHWrI1/PqCs6T3O3OwXodZq3gvgh1LU=";
   };
 
-  cargoHash = "sha256-fNOC8atr5/LgQcGf9jdxec9AQt3YIR+hem/xL10YYqY=";
+  cargoHash = "sha256-CHo3TYNpXdU3g7vKEwmubPKy+COSZ9Ay77nW8IlK9H4=";
 
   nativeBuildInputs = [ pkg-config ];
 

pkgs/by-name/go/goverlay/package.nix

@@ -1,38 +1,36 @@
 {
-  lib,
-  stdenv,
-  fetchFromGitHub,
-  bash,
+  autoPatchelfHook,
   coreutils,
+  fetchFromGitHub,
+  fontconfig,
   fpc,
-  git,
   gnugrep,
+  gnused,
   iproute2,
+  kmod,
   lazarus-qt6,
-  libGL,
-  libGLU,
+  lib,
   libnotify,
-  libX11,
+  mangohud,
   nix-update-script,
+  p7zip,
+  pascube,
   pciutils,
   polkit,
-  procps,
   qt6Packages,
-  systemd,
-  util-linux,
-  vulkan-tools,
-  which,
+  stdenv,
+  wget,
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "goverlay";
-  version = "1.3-2";
+  version = "1.6.1";
 
   src = fetchFromGitHub {
     owner = "benjamimgois";
     repo = "goverlay";
-    rev = version;
-    sha256 = "sha256-Vxmmsf/l3OK1Q6UKdhCWvU4WPJkdQG2Hn+s9tS+D5KM=";
+    tag = finalAttrs.version;
+    hash = "sha256-uJdX0Q8SO16U4AuDZWGeEFwVW0m8c4gNeAntWSWLvoU=";
   };
 
   outputs = [
@@ -41,67 +39,63 @@ stdenv.mkDerivation rec {
   ];
 
   postPatch = ''
-    substituteInPlace Makefile \
-      --replace-fail 'prefix = /usr/local' "prefix = $out"
-
-    substituteInPlace overlayunit.pas \
-      --replace-fail '/usr/share/icons/hicolor/128x128/apps/goverlay.png' "$out/share/icons/hicolor/128x128/apps/goverlay.png" \
-      --replace-fail '/sbin/ip' "${lib.getExe' iproute2 "ip"}" \
-      --replace-fail '/bin/bash' "${lib.getExe' bash "bash"}" \
-      --replace-fail '/bin/uname' "${lib.getExe' coreutils "uname"}" \
-      --replace-fail '/usr/bin/lspci' "${lib.getExe' pciutils "lspci"}" \
-      --replace-fail "FONTFOLDER := '/usr/share/fonts/'" "FONTFOLDER := GetEnvironmentVariable('HOME') + '/.local/share/fonts/'" \
-      --replace-fail "'/usr/share/fonts/'" 'FONTFOLDER'
+    substituteInPlace data/goverlay.sh.in --replace-fail 'mangohud' "${lib.getExe' mangohud "mangohud"}"
   '';
 
   nativeBuildInputs = [
+    autoPatchelfHook
     fpc
     lazarus-qt6
     qt6Packages.wrapQtAppsHook
   ];
 
   buildInputs = [
-    libGL
-    libGLU
     qt6Packages.libqtpas
-    libX11
     qt6Packages.qtbase
   ];
 
-  NIX_LDFLAGS = "-lGLU -lGL -rpath ${lib.makeLibraryPath buildInputs}";
+  installPhase = ''
+    runHook preInstall
+    make prefix=$out install
+    runHook postInstall
+  '';
 
   buildPhase = ''
     runHook preBuild
-    HOME=$(mktemp -d) lazbuild --lazarusdir=${lazarus-qt6}/share/lazarus -B goverlay.lpi
+    HOME=$(mktemp -d) lazbuild --lazarusdir=${lazarus-qt6}/share/lazarus -B goverlay.lpi --bm=Release
     runHook postBuild
   '';
 
-  qtWrapperArgs = [
-    "--prefix PATH : ${
-      lib.makeBinPath [
-        bash
-        coreutils
-        git
-        gnugrep
-        libnotify
-        polkit
-        procps
-        systemd
-        util-linux.bin
-        vulkan-tools
-        which
-      ]
-    }"
-  ];
+  preFixup = ''
+    qtWrapperArgs+=(
+      --suffix PATH : ${
+        lib.makeBinPath [
+          coreutils
+          fontconfig
+          gnugrep
+          gnused
+          iproute2
+          kmod
+          libnotify
+          mangohud
+          p7zip
+          pascube
+          pciutils
+          polkit
+          wget
+        ]
+      })
+  '';
 
   passthru.updateScript = nix-update-script { };
 
-  meta = with lib; {
+  meta = {
     description = "Opensource project that aims to create a Graphical UI to help manage Linux overlays";
     homepage = "https://github.com/benjamimgois/goverlay";
-    license = licenses.gpl3Plus;
-    maintainers = with maintainers; [ RoGreat ];
-    platforms = platforms.linux;
+    changelog = "https://github.com/benjamimgois/goverlay/releases/tag/${finalAttrs.version}";
+    license = lib.licenses.gpl3Plus;
+    maintainers = with lib.maintainers; [ RoGreat ];
     mainProgram = "goverlay";
+    platforms = lib.platforms.linux;
   };
-}
+})

pkgs/by-name/go/gowitness/package.nix

@@ -7,16 +7,16 @@
 
 buildGoModule rec {
   pname = "gowitness";
-  version = "3.0.5";
+  version = "3.1.0";
 
   src = fetchFromGitHub {
     owner = "sensepost";
     repo = "gowitness";
     tag = version;
-    hash = "sha256-oEEq4f5G0kOpaj4KORbVhZqW4RPkBXC33PXYUHhoMxo=";
+    hash = "sha256-i7yaen7Ht34D6Ryt5C/oFnBVx9M2uQEJGA1t1OCpcyo=";
   };
 
-  vendorHash = "sha256-2hG+93LzJ+kUVCOXFGk83Asvn7zLWq2BSqrq+eOJhQ0=";
+  vendorHash = "sha256-IvOmBCJ07ASKpxgk6+FLNg4wJi6E0Lh38f+DAnR0gDg=";
 
   ldflags = [
     "-s"

pkgs/by-name/gp/gpupad/glslang-use-combined-lib.patch

@@ -10,6 +10,7 @@ index a05c447..20a5c98 100644
 -    glslang::MachineIndependent glslang::GenericCodeGen glslang::glslang-default-resource-limits 
 +target_link_libraries(${PROJECT_NAME} PRIVATE glslang::glslang 
 +    glslang::glslang-default-resource-limits 
-     glslang::SPVRemapper glslang::SPIRV)
+-    glslang::SPVRemapper glslang::SPIRV)
++    glslang::SPIRV)
  
  # link SPIRV-Cross

pkgs/by-name/gq/gql/package.nix

@@ -10,16 +10,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "gql";
-  version = "0.41.0";
+  version = "0.42.0";
 
   src = fetchFromGitHub {
     owner = "AmrDeveloper";
     repo = "GQL";
     rev = version;
-    hash = "sha256-iczBVix56aKbvOksxYmZ8WPgngnTDn9MIlVnZ2nA5Ts=";
+    hash = "sha256-azonwUALsnGuEGu5AxE0uG8KBlN4tq+7VtnXykNLe6E=";
   };
 
-  cargoHash = "sha256-vblQuUSpTK93UEYdiEPq1C3N+E3WCTZHoLJDWG4rZNs=";
+  cargoHash = "sha256-6issWceEAZYCaW+zWDmBzjrTa3VOwZwBGTuag5nu4c0=";
 
   nativeBuildInputs = [
     pkg-config

pkgs/by-name/gr/greetd-mini-wl-greeter/package.nix

@@ -31,6 +31,7 @@ stdenv.mkDerivation {
   };
 
   nativeBuildInputs = [
+    pkg-config
     libGL
     cairo
     glib
@@ -50,7 +51,6 @@ stdenv.mkDerivation {
   buildInputs = [
     meson
     ninja
-    pkg-config
     scdoc
   ];
 

pkgs/by-name/ho/home-manager/package.nix

@@ -19,14 +19,14 @@
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "home-manager";
-  version = "0-unstable-2025-11-10";
+  version = "0-unstable-2025-11-17";
 
   src = fetchFromGitHub {
     name = "home-manager-source";
     owner = "nix-community";
     repo = "home-manager";
-    rev = "37a3d97f2873e0f68711117c34d04b7c7ead8f4e";
-    hash = "sha256-t2U/GLLXHa2+kJkwnFNRVc2fEJ/lUfyZXBE5iKzJdcs=";
+    rev = "7538d965352d3bfd4c380f5b3aa618bc839a84b4";
+    hash = "sha256-GuG3PW8U41f8XqROreZQaUvrcjQt+Gh92g16X7zBUck=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/in/inputplumber/package.nix

@@ -10,16 +10,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "inputplumber";
-  version = "0.67.0";
+  version = "0.67.1";
 
   src = fetchFromGitHub {
     owner = "ShadowBlip";
     repo = "InputPlumber";
     tag = "v${version}";
-    hash = "sha256-eLnloQfitA1d6HbpSk3BUl4X2E1m1qochLakndUKdIs=";
+    hash = "sha256-6eoZhW6gPpVUcTbZ8wGPIDJHs8rVcjo42y9RGVeckag=";
   };
 
-  cargoHash = "sha256-Jwx0VzrYdfYGwnKDABYwMIV6qZ7T+an5MYwrQRcRVio=";
+  cargoHash = "sha256-nquIe596MFg0JU6xpyBJzXKrXfakuQ1iLMnqDKa0DKk=";
 
   nativeBuildInputs = [
     pkg-config

pkgs/by-name/is/isle-portable/package.nix

@@ -29,13 +29,13 @@
 stdenv.mkDerivation (finalAttrs: {
   strictDeps = true;
   name = "isle-portable";
-  version = "0-unstable-2025-11-10";
+  version = "0-unstable-2025-11-15";
 
   src = fetchFromGitHub {
     owner = "isledecomp";
     repo = "isle-portable";
-    rev = "39d2f52987b4c511158fa77748f72bb0c7301970";
-    hash = "sha256-Ds45zDRPNuVWi7AdjzZEZYWaZH2z4LwT/xqAnvMSX5U=";
+    rev = "d182a8057c5c0827c33639367b7e00e9ab389e78";
+    hash = "sha256-V3jmUUzTkLKUwa/mCtp+UbJNAmHlrrDIKGimKOJOJss=";
     fetchSubmodules = true;
   };
 

pkgs/by-name/jo/joker/package.nix

@@ -6,13 +6,13 @@
 
 buildGoModule rec {
   pname = "joker";
-  version = "1.5.6";
+  version = "1.5.7";
 
   src = fetchFromGitHub {
     rev = "v${version}";
     owner = "candid82";
     repo = "joker";
-    sha256 = "sha256-h0JUBGWnL0fWryY6+BUwcl8Liv7Xyw+ZiESjJpyQpCI=";
+    sha256 = "sha256-ur59nsu17tfQ+fZpDdCJgNZuNWULnT2ug8rLhxV/8qA=";
   };
 
   vendorHash = "sha256-yH8QVzliAFZlOvprfdh/ClCWK2/7F96f0yLWvuAhGY8=";

pkgs/by-name/ju/just-lsp/package.nix

@@ -7,16 +7,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "just-lsp";
-  version = "0.2.7";
+  version = "0.2.8";
 
   src = fetchFromGitHub {
     owner = "terror";
     repo = "just-lsp";
     tag = finalAttrs.version;
-    hash = "sha256-lsVd4CUH1DD6tDYNwfAxOACI0zPvUUaen26GJG6THHc=";
+    hash = "sha256-QwpChzZ+zC4MoVp6kNqbNF6+p4Rsd0KJfVuKPyxnnZU=";
   };
 
-  cargoHash = "sha256-DRJ+TtGMduU3dDy+BKA9XauzYZMGPDS19DB5VvOIBjI=";
+  cargoHash = "sha256-j/qLLyt9Sl1cXfNkKsyEYL/MQbxRMhni6uGmRVI+Xd8=";
 
   passthru = {
     updateScript = nix-update-script { };

pkgs/by-name/jx/jx/package.nix

@@ -9,13 +9,13 @@
 
 buildGoModule rec {
   pname = "jx";
-  version = "3.16.28";
+  version = "3.16.35";
 
   src = fetchFromGitHub {
     owner = "jenkins-x";
     repo = "jx";
     rev = "v${version}";
-    sha256 = "sha256-BcT0zb4/TQPr3iwr3E72hPYbh0Oy+QZFD9zcX5ipNMA=";
+    sha256 = "sha256-6CGWd45SYVsKwTYKgSURWrCpF+8HnZTmqibkgoDZI1Y=";
   };
 
   vendorHash = "sha256-YUFpTL4BXm1iZJAQcbJSXEUKT99IulxT6qz4mrbBDN0=";

pkgs/by-name/kc/kcc/package.nix

@@ -15,14 +15,14 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "kcc";
-  version = "9.2.1";
+  version = "9.3.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "ciromattia";
     repo = "kcc";
     tag = "v${version}";
-    hash = "sha256-zzPgBAmICeDpCHvBek2DsM4aEYvC8VHPDY4Ek6nJW9w=";
+    hash = "sha256-1qm8kKCYy3GE562EzDKepOaUJZr15o1ATQ9C+vwrDh0=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/kn/knobkraft-orm/package.nix

@@ -0,0 +1,109 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  cmake,
+  pkg-config,
+
+  gtk3,
+  glew,
+  webkitgtk_4_1,
+  cppcheck,
+  icu,
+  python312,
+  glib,
+  curlFull,
+  boost,
+  libbtbb,
+  libsysprof-capture,
+  pcre2,
+  alsa-lib,
+  util-linux,
+  libselinux,
+  libsepol,
+  libthai,
+  libdatrie,
+  xorg,
+  lerc,
+  libxkbcommon,
+  libepoxy,
+  sqlite,
+  git,
+  libdeflate,
+  xz,
+  libwebp,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "KnobKraft-orm";
+
+  version = "2.7.1";
+
+  src = fetchFromGitHub {
+    owner = "christofmuc";
+    repo = "knobkraft-orm";
+    tag = finalAttrs.version;
+    fetchSubmodules = true;
+    hash = "sha256-dOgPq4r2IvKDPhhV/LWRfGeeFckN5ZUeee/T6QNfCtw=";
+  };
+
+  nativeBuildInputs = [
+    cmake
+    pkg-config
+  ];
+
+  buildInputs = [
+    gtk3
+    glew
+    webkitgtk_4_1
+    cppcheck
+    icu
+    python312
+    glib
+    curlFull
+    boost
+    libbtbb
+    libsysprof-capture
+    pcre2
+    alsa-lib
+    util-linux
+    libselinux
+    libsepol
+    libthai
+    libdatrie
+    xorg.libXdmcp
+    lerc
+    libxkbcommon
+    libepoxy
+    xorg.libXtst
+    sqlite
+    git
+    libdeflate
+    xz
+    libwebp
+  ];
+
+  # Issue has been raised and should be resolved with next release.
+  # CMakeLists.txt needs three more lines to properly build.
+  patches = [ ./temporary.patch ];
+
+  cmakeFlags = [
+    (lib.cmakeFeature "CMAKE_INTERPROCEDURAL_OP" "off")
+    (lib.cmakeFeature "PYTHON_VERSION_TO_EMBED" "${python312.pythonVersion}")
+  ];
+
+  makeFlags = [
+    "package"
+  ];
+
+  meta = {
+    homepage = "https://github.com/christofmuc/KnobKraft-orm";
+    description = "Modern FOSS MIDI Sysex Librarian";
+    mainProgram = "KnobKraftOrm";
+    license = lib.licenses.agpl3Only;
+    maintainers = with lib.maintainers; [
+      backtail
+    ];
+    platforms = lib.platforms.linux;
+  };
+})

pkgs/by-name/kn/knobkraft-orm/temporary.patch

@@ -0,0 +1,40 @@
+diff --git a/CMakeLists.txt b/CMakeLists.txt
+index b98ab0e..b1fc3de 100644
+--- a/CMakeLists.txt
++++ b/CMakeLists.txt
+@@ -39,6 +39,9 @@ option(ASAN "Use Address Sanitization for Debug version (Windows only for now)"
+ # Gin requests C++ 20.
+ set(CMAKE_CXX_STANDARD 20)
+ set(CMAKE_CXX_STANDARD_REQUIRED ON)
++set(CMAKE_AR  "gcc-ar")
++set(CMAKE_CXX_ARCHIVE_CREATE "<CMAKE_AR> qcs <TARGET> <LINK_FLAGS> <OBJECTS>")
++set(CMAKE_CXX_ARCHIVE_FINISH   true)
+ add_definitions(-D_SILENCE_CXX17_CODECVT_HEADER_DEPRECATION_WARNING)
+ 
+ # To avoid dependency on WebKit. This also came with MacOS, but as webkit is heavyweight, it is probably a good idea to turn it off for all
+diff --git a/The-Orm/CMakeLists.txt b/The-Orm/CMakeLists.txt
+index 1c7186e..39cebd0 100644
+--- a/The-Orm/CMakeLists.txt
++++ b/The-Orm/CMakeLists.txt
+@@ -5,20 +5,7 @@
+ #
+ 
+ cmake_minimum_required(VERSION 3.14)
+-
+-# Get the version from our sub cmakefile
+-execute_process(
+-    COMMAND ${CMAKE_COMMAND} -P "${CMAKE_CURRENT_LIST_DIR}/gitversion.cmake"
+-    ERROR_VARIABLE PROJECT_VERSION
+-    ERROR_STRIP_TRAILING_WHITESPACE
+-)
+-# Cleanup output
+-string(REGEX REPLACE "^[[:space:]]+|[[:space:]]+$" "" PROJECT_VERSION "${PROJECT_VERSION}")
+-string(REGEX REPLACE "\n$" "" PROJECT_VERSION "${PROJECT_VERSION}")
+-message(STATUS "Project version is '${PROJECT_VERSION}'")
+-
+-# Start project
+-project(KnobKraftOrm VERSION ${PROJECT_VERSION})
++project(KnobKraftOrm VERSION 2.7.1)
+ 
+ # Now you can use PROJECT_DEV_TAG in your CMake scripts or in your code to handle the "-dev" part.
+ # For example, you could add a preprocessor definition that your code could use:

pkgs/by-name/ko/kolla/package.nix

@@ -7,14 +7,14 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "kolla";
-  version = "20.2.0";
+  version = "20.3.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "openstack";
     repo = "kolla";
     tag = version;
-    hash = "sha256-aqYEzBphzwB42Z0HmnCPQlV71dOi3yLKh+zL2dMTaB8=";
+    hash = "sha256-DLoQkI2cWaH+LYA97/ramOb2bAeZ8kRX386QX8WEivI=";
   };
 
   postPatch = ''

pkgs/by-name/ku/kubecolor/package.nix

@@ -9,13 +9,13 @@
 
 buildGoModule rec {
   pname = "kubecolor";
-  version = "0.5.2";
+  version = "0.5.3";
 
   src = fetchFromGitHub {
     owner = "kubecolor";
     repo = "kubecolor";
     rev = "v${version}";
-    sha256 = "sha256-T0xqcDDmp/XjDxUnh/wCfs+b4cQG78d/61rdypCEDoY=";
+    sha256 = "sha256-F/ws7KevH0mGtSqp+iHyWpNccIBdF5gIoZfmLJ5H4YM=";
   };
 
   vendorHash = "sha256-QenYTQTNXaBvzpyVHOCx3lEheiWZMfulEfzB+ll+q+4=";

pkgs/by-name/le/lean4/package.nix

@@ -15,7 +15,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "lean4";
-  version = "4.24.0";
+  version = "4.25.0";
 
   # Using a vendored version rather than nixpkgs' version to match the exact version required by
   # Lean.  Apparently, even a slight version change can impact greatly the final performance.
@@ -30,7 +30,7 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "leanprover";
     repo = "lean4";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-m0DjKjFia5F5rCVMgn2xxPbbU/5uy7g84FUXSBPgy3w=";
+    hash = "sha256-VM7Y3KzsAWAvDTFXbi183s6tVqlyrMlV3oEsc9d8Rk0=";
   };
 
   postPatch =

pkgs/by-name/li/libblockdev/package.nix

@@ -2,7 +2,6 @@
   lib,
   stdenv,
   fetchFromGitHub,
-  fetchpatch,
   autoreconfHook,
   pkg-config,
   gtk-doc,
@@ -36,23 +35,15 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "libblockdev";
-  version = "3.3.0";
+  version = "3.4.0";
 
   src = fetchFromGitHub {
     owner = "storaged-project";
     repo = "libblockdev";
-    rev = finalAttrs.version;
-    hash = "sha256-Q7610i+2PQi+Oza3c2SwPneljrb+1cuFA4K4DQTpt8A=";
+    tag = finalAttrs.version;
+    hash = "sha256-KvcGvMsASgEKTerhh/lSPjQoXYDMBvbaPSdc6f5p7wc=";
   };
 
-  patches = [
-    # CVE-2025-6019: https://www.openwall.com/lists/oss-security/2025/06/17/5
-    (fetchpatch {
-      url = "https://github.com/storaged-project/libblockdev/commit/4e35eb93e4d2672686789b9705623cc4f9f85d02.patch";
-      hash = "sha256-3pQxvbFX6jmT5LCaePoVfvPTNPoTPPhT0GcLaGkVVso=";
-    })
-  ];
-
   outputs = [
     "out"
     "dev"
@@ -70,6 +61,8 @@ stdenv.mkDerivation (finalAttrs: {
     "--with-python_prefix=${placeholder "python"}"
   ];
 
+  strictDeps = true;
+
   nativeBuildInputs = [
     autoconf-archive
     autoreconfHook
@@ -112,7 +105,7 @@ stdenv.mkDerivation (finalAttrs: {
   passthru.updateScript = nix-update-script { };
 
   meta = {
-    changelog = "https://github.com/storaged-project/libblockdev/raw/${finalAttrs.src.rev}/NEWS.rst";
+    changelog = "https://github.com/storaged-project/libblockdev/raw/${finalAttrs.src.tag}/NEWS.rst";
     description = "Library for manipulating block devices";
     homepage = "http://storaged.org/libblockdev/";
     license = with lib.licenses; [