Merge master into staging-next

ci/github-script/bot.js

@@ -145,22 +145,10 @@ module.exports = async ({ github, context, core, dry }) => {
 
     // This API request is important for the merge-conflict label, because it triggers the
     // creation of a new test merge commit. This is needed to actually determine the state of a PR.
-    //
-    // NOTE (2025-12-15): Temporarily skipping mergeability checks here
-    // on GitHub’s request to measure the impact of the resulting ref
-    // writes on their internal metrics; merge conflicts resulting from
-    // changes to target branches will not have labels applied for the
-    // duration. The label should still be updated on pushes.
-    //
-    // TODO: Restore mergeability checks in some form after a few days
-    // or when we hear back from GitHub.
     const pull_request = (
       await github.rest.pulls.get({
         ...context.repo,
         pull_number,
-        // Undocumented parameter (as of 2025-12-15), added by GitHub
-        // for us; stability unclear.
-        skip_mergeability_checks: true,
       })
     ).data
 

nixos/lib/testing/network.nix

@@ -32,14 +32,8 @@ let
     let
       qemu-common = import ../qemu-common.nix { inherit (pkgs) lib stdenv; };
 
-      # Convert legacy VLANs to named interfaces and merge with explicit interfaces.
-      vlansNumbered = forEach (zipLists config.virtualisation.vlans (range 1 255)) (v: {
-        name = "eth${toString v.snd}";
-        vlan = v.fst;
-        assignIP = true;
-      });
-      explicitInterfaces = lib.mapAttrsToList (n: v: v // { name = n; }) config.virtualisation.interfaces;
-      interfaces = vlansNumbered ++ explicitInterfaces;
+      interfaces = lib.attrValues config.virtualisation.allInterfaces;
+
       interfacesNumbered = zipLists interfaces (range 1 255);
 
       # Automatically assign IP addresses to requested interfaces.
@@ -67,10 +61,10 @@ let
           { fst, snd }: qemu-common.qemuNICFlags snd fst.vlan config.virtualisation.test.nodeNumber
         )
       );
-      udevRules = forEach interfacesNumbered (
-        { fst, snd }:
+      udevRules = forEach interfaces (
+        interface:
         # MAC Addresses for QEMU network devices are lowercase, and udev string comparison is case-sensitive.
-        ''SUBSYSTEM=="net",ACTION=="add",ATTR{address}=="${toLower (qemu-common.qemuNicMac fst.vlan config.virtualisation.test.nodeNumber)}",NAME="${fst.name}"''
+        ''SUBSYSTEM=="net",ACTION=="add",ATTR{address}=="${toLower (qemu-common.qemuNicMac interface.vlan config.virtualisation.test.nodeNumber)}",NAME="${interface.name}"''
       );
 
       networkConfig = {

nixos/modules/security/acme/default.md

@@ -377,7 +377,7 @@ systemd-tmpfiles --create
 systemctl start acme-example.com.service
 ```
 
-## Ensuring dependencies for services that need to be reloaded when a certificate challenges {#module-security-acme-reload-dependencies}
+## Ensuring dependencies for services that need to be reloaded when a certificate changes {#module-security-acme-reload-dependencies}
 
 Services that depend on ACME certificates and need to be reloaded can use one of two approaches to reload upon successfull certificate acquisition or renewal:
 

nixos/modules/services/networking/headscale.nix

@@ -19,8 +19,6 @@ let
   };
 
   settingsFormat = pkgs.formats.yaml { };
-  configFile = settingsFormat.generate "headscale.yaml" cfg.settings;
-  cliConfigFile = settingsFormat.generate "headscale.yaml" cliConfig;
 
   assertRemovedOption = option: message: {
     assertion = !lib.hasAttrByPath option cfg;
@@ -35,6 +33,16 @@ in
 
       package = lib.mkPackageOption pkgs "headscale" { };
 
+      configFile = lib.mkOption {
+        type = lib.types.path;
+        readOnly = true;
+        default = settingsFormat.generate "headscale.yaml" cfg.settings;
+        defaultText = lib.literalExpression ''(pkgs.formats.yaml { }).generate "headscale.yaml" config.services.headscale.settings'';
+        description = ''
+          Path to the configuration file of headscale.
+        '';
+      };
+
       user = lib.mkOption {
         default = "headscale";
         type = lib.types.str;
@@ -621,7 +629,7 @@ in
     environment = {
       # Headscale CLI needs a minimal config to be able to locate the unix socket
       # to talk to the server instance.
-      etc."headscale/config.yaml".source = cliConfigFile;
+      etc."headscale/config.yaml".source = settingsFormat.generate "headscale.yaml" cliConfig;
 
       systemPackages = [ cfg.package ];
     };
@@ -646,7 +654,7 @@ in
           export HEADSCALE_DATABASE_POSTGRES_PASS="$(head -n1 ${lib.escapeShellArg cfg.settings.database.postgres.password_file})"
         ''}
 
-        exec ${lib.getExe cfg.package} serve --config ${configFile}
+        exec ${lib.getExe cfg.package} serve --config ${cfg.configFile}
       '';
 
       serviceConfig =

nixos/modules/services/networking/yggdrasil.nix

@@ -13,7 +13,6 @@ let
     bool
     listOf
     str
-    attrs
     submodule
     ;
   cfg = config.services.yggdrasil;
@@ -69,7 +68,7 @@ in
 
       settings = mkOption {
         type = submodule {
-          freeformType = attrs;
+          freeformType = (pkgs.formats.json { }).type;
           options = {
             PrivateKeyPath = mkOption {
               type = nullOr path;

nixos/modules/system/activation/lib-test.nix

@@ -10,13 +10,7 @@ let
 
   runTests = stdenv.mkDerivation {
     name = "tests-activation-lib";
-    src = fileset.toSource {
-      root = ./.;
-      fileset = fileset.unions [
-        ./lib.sh
-        ./test.sh
-      ];
-    };
+    src = ./lib;
     buildPhase = ":";
     doCheck = true;
     postUnpack = ''

nixos/modules/system/activation/test.nix

@@ -6,7 +6,7 @@
 }:
 let
   node-forbiddenDependencies-fail = nixos (
-    { ... }:
+    { config, ... }:
     {
       system.forbiddenDependenciesRegexes = [ "-dev$" ];
       environment.etc."dev-dependency" = {
@@ -15,16 +15,22 @@ let
       documentation.enable = false;
       fileSystems."/".device = "ignore-root-device";
       boot.loader.grub.enable = false;
+
+      # Don't do this in an actual config
+      system.stateVersion = config.system.nixos.release;
     }
   );
   node-forbiddenDependencies-succeed = nixos (
-    { ... }:
+    { config, ... }:
     {
       system.forbiddenDependenciesRegexes = [ "-dev$" ];
       system.extraDependencies = [ expect.dev ];
       documentation.enable = false;
       fileSystems."/".device = "ignore-root-device";
       boot.loader.grub.enable = false;
+
+      # Don't do this in an actual config
+      system.stateVersion = config.system.nixos.release;
     }
   );
 in

nixos/modules/virtualisation/guest-networking-options.nix

@@ -0,0 +1,138 @@
+# This module defines networking options for virtual machines and containers.
+# It is intended to be used with systemd-nspawn containers and QEMU virtual machines.
+{ config, lib, ... }:
+let
+  inherit (lib) types;
+
+  interfaceType = types.submodule (
+    { name, ... }:
+    {
+      options = {
+        name = lib.mkOption {
+          type = types.str;
+          default = name;
+          description = ''
+            Interface name
+          '';
+        };
+
+        vlan = lib.mkOption {
+          type = types.ints.unsigned;
+          description = ''
+            VLAN to which the network interface is connected.
+          '';
+        };
+
+        assignIP = lib.mkOption {
+          type = types.bool;
+          default = false;
+          description = ''
+            Automatically assign an IP address to the network interface using the same scheme as
+            virtualisation.vlans.
+          '';
+        };
+      };
+    }
+  );
+
+  cfg = config.virtualisation;
+
+  # Convert legacy VLANs to named interfaces.
+  vlansNumbered = lib.listToAttrs (
+    lib.forEach (lib.zipLists cfg.vlans (lib.range 1 255)) (
+      v:
+      let
+        name = "eth${toString v.snd}";
+      in
+      lib.nameValuePair name {
+        inherit name;
+        vlan = v.fst;
+        assignIP = true;
+      }
+    )
+  );
+in
+{
+  options = {
+    networking.primaryIPAddress = lib.mkOption {
+      type = types.str;
+      default = "";
+      internal = true;
+      description = "Primary IP address used in /etc/hosts.";
+    };
+
+    networking.primaryIPv6Address = lib.mkOption {
+      type = types.str;
+      default = "";
+      internal = true;
+      description = "Primary IPv6 address used in /etc/hosts.";
+    };
+
+    virtualisation.vlans = lib.mkOption {
+      type = types.listOf types.ints.unsigned;
+      default = if cfg.interfaces == { } then [ 1 ] else [ ];
+      defaultText = lib.literalExpression ''if cfg.interfaces == {} then [ 1 ] else [ ]'';
+      example = [
+        1
+        2
+      ];
+      description = ''
+        Virtual networks to which the container or VM is connected. Each number «N» in
+        this list causes the container to have a virtual Ethernet interface
+        attached to a separate virtual network on which it will be assigned IP
+        address `192.168.«N».«M»`, where «M» is the index of this container in
+        the list of containers.
+      '';
+    };
+
+    virtualisation.interfaces = lib.mkOption {
+      default = { };
+      example = {
+        enp1s0.vlan = 1;
+      };
+      description = ''
+        Extra network interfaces to add to the container or VM in addition to the ones
+        created by {option}`virtualisation.vlans`.
+      '';
+      type = types.attrsOf interfaceType;
+    };
+
+    virtualisation.allInterfaces = lib.mkOption {
+      type = types.attrsOf interfaceType;
+      readOnly = true;
+      description = ''
+        All network interfaces for the container or VM. Combines
+        {option}`virtualisation.vlans` and {option}`virtualisation.interfaces`.
+      '';
+      default = vlansNumbered // cfg.interfaces;
+    };
+  };
+  config = {
+    assertions = [
+      (
+        let
+          conflictingKeys = lib.intersectAttrs vlansNumbered cfg.interfaces;
+        in
+        {
+          assertion = conflictingKeys == { };
+          message = ''
+            `virtualisation.vlans` and `virtualisation.interfaces` have conflicting keys: ${lib.concatStringsSep "," (lib.attrNames conflictingKeys)}
+          '';
+        }
+      )
+      (
+        let
+          allInterfaceNames =
+            (lib.mapAttrsToList (k: i: i.name) vlansNumbered)
+            ++ (lib.mapAttrsToList (k: i: i.name) cfg.interfaces);
+        in
+        {
+          assertion = lib.allUnique allInterfaceNames;
+          message = ''
+            `virtualisation.vlans` and `virtualisation.interfaces` have conflicting interface names: ${lib.concatStringsSep "," allInterfaceNames}
+          '';
+        }
+      )
+    ];
+  };
+}

nixos/modules/virtualisation/nspawn-container/default.nix

@@ -0,0 +1,114 @@
+# This module creates a lightweight "container" from the NixOS configuration.
+# Building the `config.system.build.nspawn` attribute gives you a command
+# that starts a systemd-nspawn container running the NixOS configuration
+# defined in `config`. By default, the Nix store is shared read-only with the
+# host, which makes (re)building very efficient.
+# This shares a lot in common with
+# `nixos/modules/virtualisation/nixos-containers.nix`, but doesn't use systemd
+# units.
+# The networking options here match the options in
+# `nixos/modules/virtualisation/nixos-containers.nix` which allows using these
+# lightweight containers for nixos integration tests.
+
+{
+  config,
+  pkgs,
+  lib,
+  ...
+}:
+let
+  inherit (lib) types;
+  cfg = config.virtualisation;
+in
+{
+  imports = [ ../guest-networking-options.nix ];
+
+  options = {
+
+    virtualisation.cmdline = lib.mkOption {
+      type = types.listOf types.str;
+      default = [ ];
+      example = [
+        "systemd.unit=rescue.target"
+        "systemd.log_level=debug"
+        "systemd.log_target=console"
+      ];
+      description = ''
+        Command line arguments to pass to the init process (likely systemd).
+        Useful for debugging.
+      '';
+    };
+
+    virtualisation.rootDir = lib.mkOption {
+      type = types.str;
+      default = "./${config.system.name}-root";
+      defaultText = lib.literalExpression ''"./''${config.system.name}-root"'';
+      description = ''
+        Path to a directory for the root filesystem for the container.
+        The directory will be created on startup if it does not
+        exist.
+      '';
+    };
+
+    virtualisation.systemd-nspawn = {
+
+      package = lib.mkPackageOption pkgs "systemd" { };
+
+      options = lib.mkOption {
+        type = types.listOf types.str;
+        default = [ ];
+        example = [ "--bind=/home:/home" ];
+        description = ''
+          Options passed to systemd-nspawn.
+          See [systemd-nspawn docs](https://www.freedesktop.org/software/systemd/man/latest/systemd-nspawn.html) for a complete list.
+        '';
+      };
+
+    };
+  };
+
+  config = {
+    boot.isNspawnContainer = true;
+
+    # TODO(arianvp): Remove after https://github.com/NixOS/nixpkgs/pull/480686 is merged
+    console.enable = true;
+
+    virtualisation.systemd-nspawn.options = [
+      "--private-network"
+      "--machine=${config.system.name}"
+      "--bind-ro=/nix/store:/nix/store"
+
+      # systemd-nspawn does some cleverness to mount a procfs and sysfs in an
+      # unprivileged container, see
+      # <https://github.com/systemd/systemd/blob/v258.2/src/nspawn/nspawn.c#L4341-L4349>.
+      # Unfortunately, this doesn't work in the Nix build sandbox as we do not
+      # have permission to mount filesystems of type `sysfs` nor `procfs`.
+      # Fortunately, the build sandbox does provide a `/proc` and `/sys` that
+      # we can just forward onto the container.
+      "--private-users=no"
+      "--bind=/proc:/run/host/proc"
+      "--bind=/sys:/run/host/sys"
+
+      # From `man systemd-nspawn`:
+      # > Use --keep-unit and --register=no in combination to disable any
+      # > kind of unit allocation or registration with systemd-machined.
+      "--keep-unit"
+      "--register=no"
+    ];
+
+    system.build.nspawn =
+      let
+        run-nspawn = pkgs.callPackage ./run-nspawn { };
+        commandLineOptions = lib.cli.toCommandLineShellGNU { } {
+          container-name = config.system.name;
+          root-dir = cfg.rootDir;
+          interfaces-json = builtins.toJSON (lib.attrValues cfg.allInterfaces);
+          init = "${config.system.build.toplevel}/init";
+          cmdline-json = builtins.toJSON cfg.cmdline;
+        };
+      in
+      pkgs.writers.writeDashBin "run-${config.system.name}-nspawn" ''
+        exec ${lib.getExe run-nspawn} ${commandLineOptions} ${lib.escapeShellArgs config.virtualisation.systemd-nspawn.options} "$@"
+      '';
+  };
+}

nixos/modules/virtualisation/nspawn-container/run-nspawn/default.nix

@@ -0,0 +1,6 @@
+{ python3Packages, systemd }:
+
+python3Packages.callPackage ./package.nix {
+  # We want `pkgs.systemd`, *not* `python3Packages.systemd`.
+  inherit systemd;
+}

nixos/modules/virtualisation/nspawn-container/run-nspawn/package.nix

@@ -0,0 +1,54 @@
+{
+  buildPythonApplication,
+  e2fsprogs,
+  iproute2,
+  lib,
+  mypy,
+  ruff,
+  setuptools,
+  systemd,
+}:
+
+buildPythonApplication {
+  pname = "run-nspawn";
+  version = "1.0";
+  pyproject = true;
+
+  src = ./src;
+
+  postPatch = ''
+    substituteInPlace run_nspawn/__init__.py \
+      --replace-fail "@ip@" "${lib.getExe' iproute2 "ip"}" \
+      --replace-fail "@systemd-nspawn@" "${lib.getExe' systemd "systemd-nspawn"}" \
+      --replace-fail "@chattr@" "${lib.getExe' e2fsprogs "chattr"}"
+  '';
+
+  build-system = [
+    setuptools
+  ];
+
+  propagatedBuildInputs = [
+    systemd
+    iproute2
+  ];
+
+  doCheck = true;
+
+  nativeCheckInputs = [
+    mypy
+    ruff
+  ];
+
+  checkPhase = ''
+    echo -e "\x1b[32m## run mypy\x1b[0m"
+    mypy run_nspawn
+    echo -e "\x1b[32m## run ruff check\x1b[0m"
+    ruff check .
+    echo -e "\x1b[32m## run ruff format\x1b[0m"
+    ruff format --check --diff .
+  '';
+
+  meta = {
+    mainProgram = "run-nspawn";
+  };
+}

nixos/modules/virtualisation/nspawn-container/run-nspawn/shell.nix

@@ -0,0 +1,4 @@
+{
+  pkgs ? import ../../../../.. { },
+}:
+pkgs.callPackage ./default.nix { }

nixos/modules/virtualisation/nspawn-container/run-nspawn/src/pyproject.toml

@@ -0,0 +1,13 @@
+[build-system]
+requires = ["setuptools"]
+build-backend = "setuptools.build_meta"
+
+[project]
+name = "run-nspawn"
+version = "1.0"
+
+[project.scripts]
+run-nspawn = "run_nspawn:main"
+
+[tool.setuptools.packages]
+find = {}

nixos/modules/virtualisation/nspawn-container/run-nspawn/src/run_nspawn/__init__.py

@@ -0,0 +1,250 @@
+import contextlib
+import dataclasses
+import fcntl
+import logging
+import os
+import signal
+import subprocess
+import sys
+import typing
+from pathlib import Path
+
+logger = logging.getLogger()
+
+# Install a SIGTERM handler so all our context managers get a chance to
+# clean up.
+signal.signal(signal.SIGTERM, lambda _signum, _frame: sys.exit(0))
+
+
+@dataclasses.dataclass
+class Netns:
+    name: str
+    path: Path
+
+
+def run_ip(*args: str) -> None:
+    subprocess.run(
+        ["@ip@", *args],
+        check=True,
+    )
+
+
+@contextlib.contextmanager
+def mk_netns(name: str) -> typing.Generator[Netns, None, None]:
+    logger.info("creating netns %s", name)
+    run_ip("netns", "add", name)
+    try:
+        yield Netns(name=name, path=Path("/run/netns") / name)
+    finally:
+        logger.info("deleting netns %s", name)
+        run_ip("netns", "delete", name)
+
+
+@contextlib.contextmanager
+def vlan_lock(vlan: int) -> typing.Generator[None, None, None]:
+    lockfile = Path(f"/run/nixos-nspawn/vlan-{vlan}.lock")
+    lockfile.parent.mkdir(parents=True, exist_ok=True)
+    with lockfile.open("w") as f:
+        # Grab an exclusive lock.
+        fcntl.flock(f, fcntl.LOCK_EX)
+        try:
+            yield
+        finally:
+            # Release the exclusive lock.
+            fcntl.flock(f, fcntl.LOCK_UN)
+
+
+@contextlib.contextmanager
+def ensure_vlan_bridge(vlan: int) -> typing.Generator[str, None, None]:
+    """
+    Ensure a bridge for the given vlan exists, and create one if it does not.
+
+    Note that this bridge may get used by other containers, so we're careful
+    to not delete it unless we're sure nobody else is using it.
+    """
+    # These IP addresses correspond to the static IP assignment logic in
+    # <nixos/lib/testing/network.nix>.
+    ipv4_addr = f"192.168.{vlan}.254/24"
+    ipv6_addr = f"2001:db8:{vlan}::fe/64"
+
+    bridge_name = f"br{vlan}"
+    bridge_path = Path("/sys/class/net") / bridge_name
+    try:
+        # To avoid racing against other nspawn containers that also
+        # need this vlan, grab an exclusive lock.
+        with vlan_lock(vlan):
+            if not bridge_path.exists():
+                logger.info("creating bridge %s", bridge_name)
+                run_ip("link", "add", bridge_name, "type", "bridge")
+                run_ip("link", "set", bridge_name, "up")
+                run_ip("addr", "add", ipv4_addr, "dev", bridge_name)
+                run_ip("addr", "add", ipv6_addr, "dev", bridge_name)
+
+        yield bridge_name
+    finally:
+        # To avoid racing against other nspawn containers that also
+        # releasing this vlan, grab an exclusive lock.
+        with vlan_lock(vlan):
+            if bridge_path.exists():
+                child_intf_count = len(list((bridge_path / "brif").iterdir()))
+                if child_intf_count == 0:
+                    logger.info("deleting bridge %s", bridge_name)
+                    run_ip("link", "delete", bridge_name)
+
+
+@contextlib.contextmanager
+def mk_veth(
+    container_name: str,
+    netns: Netns,
+    container_intf_name: str,
+    vlan: int,
+) -> typing.Generator[None, None, None]:
+    host_intf_name = f"{container_name}-{container_intf_name}"
+    with ensure_vlan_bridge(vlan) as bridge_name:
+        logger.info("creating interface %s", host_intf_name)
+        run_ip(
+            "link",
+            "add",
+            host_intf_name,
+            "type",
+            "veth",
+            "peer",
+            "name",
+            container_intf_name,
+            "netns",
+            netns.name,
+        )
+        try:
+            run_ip("link", "set", host_intf_name, "master", bridge_name)
+            run_ip("link", "set", host_intf_name, "up")
+            yield
+        finally:
+            logger.info("deleting interface %s", host_intf_name)
+            run_ip("link", "delete", host_intf_name)
+
+
+def run(
+    container_name: str,
+    root_dir_str: str,
+    interfaces: dict,
+    nspawn_options: list[str],
+    init: str,
+    cmdline: list[str],
+) -> None:
+    logging.basicConfig(
+        format=f"nixos-nspawn({container_name}): %(message)s",
+        level=logging.WARNING,
+    )
+
+    assert os.geteuid() == 0, (
+        f"systemd-nspawn requires root to work. You are {os.geteuid()}"
+    )
+
+    root_dir = Path(root_dir_str)
+
+    root_dir.mkdir(parents=True, exist_ok=True)
+    root_dir.chmod(0o755)
+
+    with (
+        mk_netns(f"nixos-nspawn-{container_name}") as netns,
+        contextlib.ExitStack() as stack,
+    ):
+        for interface in interfaces:
+            stack.enter_context(
+                mk_veth(
+                    container_name=container_name,
+                    netns=netns,
+                    container_intf_name=interface["name"],
+                    vlan=interface["vlan"],
+                )
+            )
+
+        def print_pid() -> None:
+            print(
+                f"systemd-nspawn's PID is {os.getpid()}",
+                # Need to flush stdout before systemd-nspawn gets exec-ed.
+                flush=True,
+            )
+
+        cp = subprocess.Popen(
+            [
+                "@systemd-nspawn@",
+                *nspawn_options,
+                f"--directory={root_dir}",
+                f"--network-namespace-path={netns.path}",
+                init,
+                *cmdline,
+            ],
+            preexec_fn=print_pid,
+        )
+
+        try:
+            exit_code = cp.wait()
+        finally:
+            # If we get interrupted for any reason (most likely a SIGTERM),
+            # be sure to kill our child process.
+            cp.terminate()
+
+            # NixOS creates `/var/empty` with the immutable filesystem attribute [0].
+            # This makes it difficult to clean up the machine's root directory
+            # (which the test driver does to ensure tests start fresh).
+            # We unset that bit here so others are less likely to run into this issue.
+            # Note: this may cause issues on filesystems that don't support
+            # "Linux file attributes". Please improve this if you run into this!
+            #
+            # [0]: https://github.com/NixOS/nixpkgs/blob/d1eff395720e1fe15838263642a2bc1dca1eea32/nixos/modules/system/activation/activation-script.nix#L281
+            subprocess.run(
+                [
+                    "@chattr@",
+                    "-i",
+                    root_dir / "var/empty",
+                ],
+                check=True,
+            )
+
+        sys.exit(exit_code)
+
+
+def main():
+    import argparse
+    import json
+
+    arg_parser = argparse.ArgumentParser()
+    arg_parser.add_argument(
+        "--container-name", required=True, help="Name of the container"
+    )
+    arg_parser.add_argument(
+        "--root-dir",
+        required=True,
+        help="Path to container root directory (overridable with RUN_NSPAWN_ROOT_DIR)",
+    )
+    arg_parser.add_argument(
+        "--interfaces-json",
+        dest="interfaces",
+        type=json.loads,
+        required=True,
+        help="JSON-encoded list of interfaces, each with 'name' and 'vlan' fields",
+    )
+    arg_parser.add_argument("--init", required=True, help="Path to init binary")
+    arg_parser.add_argument(
+        "--cmdline-json",
+        dest="cmdline",
+        type=json.loads,
+        default=[],
+        help="JSON-encoded list of command line arguments to pass to init",
+    )
+    # Parse only known args to allow for extra args to be passed to systemd-nspawn.
+    args, nspawn_options = arg_parser.parse_known_args()
+
+    run(
+        container_name=args.container_name,
+        root_dir_str=os.getenv("RUN_NSPAWN_ROOT_DIR", default=args.root_dir),
+        interfaces=args.interfaces,
+        nspawn_options=nspawn_options,
+        init=args.init,
+        cmdline=args.cmdline,
+    )
+
+
+if __name__ == "__main__":
+    main()

nixos/modules/virtualisation/qemu-vm.nix

@@ -365,6 +365,7 @@ in
   imports = [
     ../profiles/qemu-guest.nix
     ./disk-size-option.nix
+    ./guest-networking-options.nix
     (mkRenamedOptionModule
       [
         "virtualisation"
@@ -679,57 +680,6 @@ in
       '';
     };
 
-    virtualisation.vlans = mkOption {
-      type = types.listOf types.ints.unsigned;
-      default = if config.virtualisation.interfaces == { } then [ 1 ] else [ ];
-      defaultText = lib.literalExpression ''if config.virtualisation.interfaces == {} then [ 1 ] else [ ]'';
-      example = [
-        1
-        2
-      ];
-      description = ''
-        Virtual networks to which the VM is connected.  Each
-        number «N» in this list causes
-        the VM to have a virtual Ethernet interface attached to a
-        separate virtual network on which it will be assigned IP
-        address
-        `192.168.«N».«M»`,
-        where «M» is the index of this VM
-        in the list of VMs.
-      '';
-    };
-
-    virtualisation.interfaces = mkOption {
-      default = { };
-      example = {
-        enp1s0.vlan = 1;
-      };
-      description = ''
-        Network interfaces to add to the VM.
-      '';
-      type =
-        with types;
-        attrsOf (submodule {
-          options = {
-            vlan = mkOption {
-              type = types.ints.unsigned;
-              description = ''
-                VLAN to which the network interface is connected.
-              '';
-            };
-
-            assignIP = mkOption {
-              type = types.bool;
-              default = false;
-              description = ''
-                Automatically assign an IP address to the network interface using the same scheme as
-                virtualisation.vlans.
-              '';
-            };
-          };
-        });
-    };
-
     virtualisation.writableStore = mkOption {
       type = types.bool;
       default = cfg.mountHostNixStore;
@@ -752,20 +702,6 @@ in
       '';
     };
 
-    networking.primaryIPAddress = mkOption {
-      type = types.str;
-      default = "";
-      internal = true;
-      description = "Primary IP address used in /etc/hosts.";
-    };
-
-    networking.primaryIPv6Address = mkOption {
-      type = types.str;
-      default = "";
-      internal = true;
-      description = "Primary IPv6 address used in /etc/hosts.";
-    };
-
     virtualisation.host.pkgs = mkOption {
       type = options.nixpkgs.pkgs.type;
       default = pkgs;

nixos/release-combined.nix

@@ -99,7 +99,6 @@ rec {
         (onFullSupported "nixos.tests.firewall")
         (onFullSupported "nixos.tests.fontconfig-default-fonts")
         (onFullSupported "nixos.tests.gitlab.gitlab")
-        (onFullSupported "nixos.tests.gitlab.runner")
         (onFullSupported "nixos.tests.gnome")
         (onSystems [ "x86_64-linux" ] "nixos.tests.hibernate")
         (onFullSupported "nixos.tests.i3wm")

nixos/tests/all-tests.nix

@@ -200,7 +200,7 @@ in
   activation-bashless-image = runTest ./activation/bashless-image.nix;
   activation-etc-overlay-immutable = runTest ./activation/etc-overlay-immutable.nix;
   activation-etc-overlay-mutable = runTest ./activation/etc-overlay-mutable.nix;
-  activation-lib = pkgs.callPackage ../modules/system/activation/lib/test.nix { };
+  activation-lib = pkgs.callPackage ../modules/system/activation/lib-test.nix { };
   activation-nix-channel = runTest ./activation/nix-channel.nix;
   activation-nixos-init = runTest ./activation/nixos-init.nix;
   activation-perlless = runTest ./activation/perlless.nix;

nixos/tests/kanidm-provisioning.nix

@@ -18,7 +18,7 @@ in
   name = "kanidm-provisioning-${kanidmPackage.version}";
   meta.maintainers = with pkgs.lib.maintainers; [ oddlama ];
 
-  _module.args.kanidmPackage = pkgs.lib.mkDefault pkgs.kanidmWithSecretProvisioning;
+  _module.args.kanidmPackage = pkgs.lib.mkDefault pkgs.kanidmWithSecretProvisioning_1_7;
 
   nodes.provision =
     { pkgs, lib, ... }:

nixos/tests/kanidm.nix

@@ -21,7 +21,7 @@ in
     oddlama
   ];
 
-  _module.args.kanidmPackage = pkgs.lib.mkDefault pkgs.kanidm;
+  _module.args.kanidmPackage = pkgs.lib.mkDefault pkgs.kanidm_1_7;
 
   nodes.server =
     { pkgs, ... }:

nixos/tests/vm-variant.nix

@@ -6,12 +6,13 @@ let
   evalConfig = import ../lib/eval-config.nix;
 
   nixos = evalConfig {
+    system = null;
     modules = [
       {
         system.stateVersion = "25.05";
         fileSystems."/".device = "/dev/null";
         boot.loader.grub.device = "nodev";
-        nixpkgs.hostPlatform = pkgs.system;
+        nixpkgs.hostPlatform = pkgs.stdenv.hostPlatform.system;
         virtualisation.vmVariant.networking.hostName = "vm";
         virtualisation.vmVariantWithBootLoader.networking.hostName = "vm-w-bl";
       }

pkgs/applications/editors/vim/plugins/non-generated/avante-nvim/default.nix

@@ -12,12 +12,12 @@
   pkgs,
 }:
 let
-  version = "0.0.27-unstable-2026-01-09";
+  version = "0.0.27-unstable-2026-01-20";
   src = fetchFromGitHub {
     owner = "yetone";
     repo = "avante.nvim";
-    rev = "e89eb79abf5754645e20aa6074da10ed20bba33c";
-    hash = "sha256-jxbDBvaVtgC0L/MSyoZjGjBxvRUdNofRsiUHwntab7c=";
+    rev = "08b202a5c5dc93959bfe7dc276adfcba84ecc5be";
+    hash = "sha256-YDlxwAOimaTFo7mTICQBdb7EQCp8vrBnwjWwxmBImis=";
   };
   avante-nvim-lib = rustPlatform.buildRustPackage {
     pname = "avante-nvim-lib";

pkgs/applications/misc/qlcplus/default.nix

@@ -8,6 +8,7 @@
   qtmultimedia,
   qtscript,
   qtserialport,
+  qtwebsockets,
   alsa-lib,
   ola,
   libftdi1,
@@ -19,13 +20,13 @@
 
 mkDerivation rec {
   pname = "qlcplus";
-  version = "4.13.1";
+  version = "5.0.0";
 
   src = fetchFromGitHub {
     owner = "mcallegari";
     repo = "qlcplus";
     rev = "QLC+_${version}";
-    sha256 = "sha256-AKmPxHOlMtea3q0NDULp3XfJ0JnYeF/iFUJw0dDOiio=";
+    hash = "sha256-gEwcTIJhY78Ts0lUn4MVciV7sPIBkqlxPMa9I1nTHO0=";
   };
 
   nativeBuildInputs = [
@@ -38,6 +39,7 @@ mkDerivation rec {
     qtmultimedia
     qtscript
     qtserialport
+    qtwebsockets
     alsa-lib
     ola
     libftdi1

pkgs/applications/virtualization/docker/default.nix

@@ -435,14 +435,14 @@ in
 
   docker_29 =
     let
-      version = "29.1.3";
+      version = "29.1.5";
     in
     callPackage dockerGen {
       inherit version;
       cliRev = "v${version}";
-      cliHash = "sha256-8VpFDYn9mRFv7BnHek2+HvIu6jNPYNC1asozJvRX/A4=";
+      cliHash = "sha256-fg18lmJsMoy7lpL4hGkIhM0LKnhEY5nl5f0YuW8yg0A=";
       mobyRev = "docker-v${version}";
-      mobyHash = "sha256-yB6FF4tzi6R+wH6U0JS8PMZGVRl1gWCY2Cjb/JR+62w=";
+      mobyHash = "sha256-iUoqJT0lIiVh5WaHzlw71QXxc3sEsSpQpADb0KveXNQ=";
       runcRev = "v1.3.4";
       runcHash = "sha256-1IfY08sBoDpbLrwz1AKBRSTuCZyOgQzYPHTDUI6fOZ8=";
       containerdRev = "v2.2.0";

pkgs/build-support/rust/default-crate-overrides.nix

@@ -53,6 +53,12 @@
     buildInputs = [ alsa-lib ];
   };
 
+  # Force using the cmake backend. At least on Darwin, the build else gets confused and fails.
+  aws-lc-sys = prev: {
+    nativeBuildInputs = [ cmake ];
+    env.AWS_LC_SYS_CMAKE_BUILDER = 1;
+  };
+
   cairo-rs = attrs: {
     buildInputs = [ cairo ];
   };

pkgs/by-name/_1/_1password-gui/sources.json

@@ -29,15 +29,15 @@
   },
   "beta": {
     "linux": {
-      "version": "8.11.22-26.BETA",
+      "version": "8.12.0-11.BETA",
       "sources": {
         "x86_64": {
-          "url": "https://downloads.1password.com/linux/tar/beta/x86_64/1password-8.11.22-26.BETA.x64.tar.gz",
-          "hash": "sha256-lkQypBqr1VX/+8yz5PhUULKG9ZpuXjeS/ZNLL1Qzdcs="
+          "url": "https://downloads.1password.com/linux/tar/beta/x86_64/1password-8.12.0-11.BETA.x64.tar.gz",
+          "hash": "sha256-0PDkZAqlY/afocvc/rcly/nwZeSSbXdRyXH57aVPUoQ="
         },
         "aarch64": {
-          "url": "https://downloads.1password.com/linux/tar/beta/aarch64/1password-8.11.22-26.BETA.arm64.tar.gz",
-          "hash": "sha256-1PrkmOWBenPvQIiHlq4RAKzItYLVj5DkGD38eGFDlHM="
+          "url": "https://downloads.1password.com/linux/tar/beta/aarch64/1password-8.12.0-11.BETA.arm64.tar.gz",
+          "hash": "sha256-0YDJKexCdOeU0/KPsJzI5rBUlbDEFW5N33LFXtDo3tg="
         }
       }
     },

pkgs/by-name/ar/arti/package.nix

@@ -12,7 +12,7 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "arti";
-  version = "1.7.0";
+  version = "1.9.0";
 
   src = fetchFromGitLab {
     domain = "gitlab.torproject.org";
@@ -20,10 +20,10 @@ rustPlatform.buildRustPackage (finalAttrs: {
     owner = "core";
     repo = "arti";
     tag = "arti-v${finalAttrs.version}";
-    hash = "sha256-4Vx5ATVdE8AoMWjDKKkwGOFVOwI0Qhyfr8MiAo+7MNw=";
+    hash = "sha256-b5DWu38/iKwKcmp4BNgkeE5F522YRZZiev9gUZ/Rb1E=";
   };
 
-  cargoHash = "sha256-x1Pws9XbvwZqxJTJmPHQd6qbNLgkHxCK3YIZbRylk2M=";
+  cargoHash = "sha256-SGxSZaY8//FHhySbarfgleafF5YEWJW/fUAwo3576NI=";
 
   nativeBuildInputs = lib.optionals stdenv.hostPlatform.isLinux [ pkg-config ];
 
@@ -54,12 +54,13 @@ rustPlatform.buildRustPackage (finalAttrs: {
   checkFlags = [
     # problematic test that hangs the build
     "--skip=reload_cfg::test::watch_single_file"
-
-    # some of the cli tests attempt to validate that the filesystem and build
-    # is securely configured, which is somewhat broken by the nix build sandbox
-    "--skip=cli_tests"
   ];
 
+  # some of the CLI tests attempt to validate that the filesystem and runtime
+  # environment are securely configured, which breaks inside the nix build
+  # sandbox. this does NOT affect downstream users of Arti.
+  env.ARTI_FS_DISABLE_PERMISSION_CHECKS = 1;
+
   nativeInstallCheckInputs = [
     versionCheckHook
   ];

pkgs/by-name/ba/base16-schemes/package.nix

@@ -5,13 +5,13 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "base16-schemes";
-  version = "0-unstable-2025-11-08";
+  version = "0-unstable-2026-01-15";
 
   src = fetchFromGitHub {
     owner = "tinted-theming";
     repo = "schemes";
-    rev = "4ac26dc99141c1b2a26eb7fefe46e22e07eec77c";
-    hash = "sha256-pr+RtDs+3qo0v7ZXfcSdtP0PoDDPU9EHw2Oe5EUwWtQ=";
+    rev = "43dd14f6466a782bd57419fdfb5f398c74d6ac53";
+    hash = "sha256-AWTIYZ1tZab0YwAQwgt5yO4ucqZoc4iXX002Byy7pRY=";
   };
 
   installPhase = ''

pkgs/by-name/cn/cnquery/package.nix

@@ -6,18 +6,18 @@
 
 buildGoModule rec {
   pname = "cnquery";
-  version = "12.18.0";
+  version = "12.19.0";
 
   src = fetchFromGitHub {
     owner = "mondoohq";
     repo = "cnquery";
     tag = "v${version}";
-    hash = "sha256-aDpWVujFSKTRDZW764LzNmqJkb61tfdLPN/JT81NrZs=";
+    hash = "sha256-lFnXkBPokDO/eduWhg/lSqqjRhC8/5tGqkS/RZHhZnU=";
   };
 
   subPackages = [ "apps/cnquery" ];
 
-  vendorHash = "sha256-OliliGBpFPPJnYZ3wQ2q7t+9bsiN5ik0FJrNGlVxivo=";
+  vendorHash = "sha256-WnUCDiDfIC2Cl1LEpkZlT5tGFMaWb5htX8VFmJBEjbI=";
 
   ldflags = [
     "-w"

pkgs/by-name/co/codebuff/package-lock.json

@@ -5,7 +5,7 @@
   "packages": {
     "": {
       "dependencies": {
-        "codebuff": "^1.0.581"
+        "codebuff": "^1.0.589"
       }
     },
     "node_modules/chownr": {
@@ -18,9 +18,9 @@
       }
     },
     "node_modules/codebuff": {
-      "version": "1.0.581",
-      "resolved": "https://registry.npmjs.org/codebuff/-/codebuff-1.0.581.tgz",
-      "integrity": "sha512-3lMaeo/TqALXwPWwPvwaIGaVlJcz7cXisEvEGqG4qjOUIFPd+mpiZBw1nF64U67fSxkjvll1/JNKk/mZTEAVng==",
+      "version": "1.0.589",
+      "resolved": "https://registry.npmjs.org/codebuff/-/codebuff-1.0.589.tgz",
+      "integrity": "sha512-e6Fxe49DgX9qx8itMEM7HBro73MhZZXUUYkbQh4+NBHQs9711bja1DN9PzqzKpluFJ3BmU/e67CG70uBrxmavA==",
       "cpu": [
         "x64",
         "arm64"

pkgs/by-name/co/codebuff/package.nix

@@ -6,14 +6,14 @@
 
 buildNpmPackage rec {
   pname = "codebuff";
-  version = "1.0.581";
+  version = "1.0.589";
 
   src = fetchzip {
     url = "https://registry.npmjs.org/codebuff/-/codebuff-${version}.tgz";
-    hash = "sha256-A5sEqkw9nm9ijyq7FT0vVNegbDl1LXQHI62dfdP/0WI=";
+    hash = "sha256-kW8I+Aw87O21g56Gy5Z8R+Snuxqr78fHVTckuIp31hQ=";
   };
 
-  npmDepsHash = "sha256-CEoacNXow99r4i9cF2BUA5dNcgU1dCBc4dq0n0p7CBU=";
+  npmDepsHash = "sha256-8+u7/1oQ19ZnA1EZrAgrwppliOZWPb+PJ22xHr6WFKE=";
 
   postPatch = ''
     cp ${./package-lock.json} package-lock.json

pkgs/by-name/cu/cup-docker/package.nix

@@ -8,23 +8,25 @@
   nix-update-script,
   withServer ? true,
 }:
-let
+rustPlatform.buildRustPackage (finalAttrs: {
   pname = "cup-docker";
-  version = "3.4.3";
+  version = "3.5.1";
+
   src = fetchFromGitHub {
     owner = "sergi0g";
     repo = "cup";
-    tag = "v${version}";
-    hash = "sha256-RRhUSL9TR7qr93F5+fyhGW7j6VTs+yVvpni/JHmC5os=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-l7TQwCzQNwrsM+xRcRcQaxIsnd8SVzrqEMwIoZGVBR0=";
   };
-  web = stdenvNoCC.mkDerivation (finalAttrs: {
-    pname = "${pname}-web";
-    inherit version src;
+
+  web = stdenvNoCC.mkDerivation (finalAttrsWeb: {
+    pname = "${finalAttrs.pname}-web";
+    inherit (finalAttrs) version src;
     impureEnvVars = lib.fetchers.proxyImpureEnvVars ++ [
       "GIT_PROXY_COMMAND"
       "SOCKS_SERVER"
     ];
-    sourceRoot = "${finalAttrs.src.name}/web";
+    sourceRoot = "${finalAttrsWeb.src.name}/web";
     nativeBuildInputs = [
       bun
       nodejs-slim_latest
@@ -47,17 +49,10 @@ let
       cp -R ./dist $out
       runHook postInstall
     '';
-    outputHash = "sha256-Ac1PJYmTQv9XrmhmF1p77vdXh8252hz0CUKxJA+VQR4=";
+    outputHash = "sha256-uLsWppRabaI7JSHYf3YsEvf0Y36kU/iuNXnDXd+6AXY=";
     outputHashAlgo = "sha256";
     outputHashMode = "recursive";
   });
-in
-rustPlatform.buildRustPackage {
-  inherit
-    src
-    version
-    pname
-    ;
 
   cargoHash = "sha256-1VSbv6lDRRLZIu7hYrAqzQmvxcuhnPU0rcWfg7Upcm4=";
 
@@ -70,11 +65,10 @@ rustPlatform.buildRustPackage {
   ];
 
   preConfigure = lib.optionalString withServer ''
-    cp -r ${web}/dist src/static
+    cp -r ${finalAttrs.web}/dist src/static
   '';
 
   passthru = {
-    inherit web;
     updateScript = nix-update-script {
       extraArgs = [
         "--subpackage"
@@ -94,4 +88,4 @@ rustPlatform.buildRustPackage {
       kuflierl
     ];
   };
-}
+})

pkgs/by-name/dn/dnsmasq/package.nix

@@ -30,11 +30,11 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "dnsmasq";
-  version = "2.91";
+  version = "2.92";
 
   src = fetchurl {
     url = "https://www.thekelleys.org.uk/dnsmasq/${pname}-${version}.tar.xz";
-    hash = "sha256-9iJoKEizNnetsratCCZGGKKuCgHaSGqT/YzZEYaz0VM=";
+    hash = "sha256-S/UMLBAY+fvCYDffUbkOzqDLc9RhYoRnY7kt8NbDpFg=";
   };
 
   postPatch = lib.optionalString stdenv.hostPlatform.isLinux ''

pkgs/by-name/dr/drupal/package.nix

@@ -8,18 +8,18 @@
 
 php.buildComposerProject2 (finalAttrs: {
   pname = "drupal";
-  version = "11.3.1";
+  version = "11.3.2";
 
   src = fetchFromGitLab {
     domain = "git.drupalcode.org";
     owner = "project";
     repo = "drupal";
     tag = finalAttrs.version;
-    hash = "sha256-dVCDIKqLbYHlVwv5wveXG0oHc2g3Zl6J6LG1/e8IIZw=";
+    hash = "sha256-RrBnVDjB6aKW6btmX604saXfPKo18oRka+SdlNmFqUo=";
   };
 
   composerNoPlugins = false;
-  vendorHash = "sha256-7FwwkPTKc/miStdHv1wfLoZhV4Gku1KwNgSlWdpPG8g=";
+  vendorHash = "sha256-c3pqPnyeuSqpMhh1an1NAnDC+IyeRVUT+dCN19/nrMQ=";
 
   passthru = {
     tests = {

pkgs/by-name/em/embellish/package.nix

@@ -20,13 +20,13 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "embellish";
-  version = "0.5.1";
+  version = "0.6.0";
 
   src = fetchFromGitHub {
     owner = "getnf";
     repo = "embellish";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-Db7/vo9LVE7IeFFHx/BKs+qxzsvuB+6ZLRb7A1NHrxQ=";
+    hash = "sha256-2WPOXrEhnFP3NHE+MksREYlIoGN8AJE7Y2aw3ObVHeM=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/fh/fheroes2/package.nix

@@ -18,13 +18,13 @@
 
 stdenv.mkDerivation rec {
   pname = "fheroes2";
-  version = "1.1.11";
+  version = "1.1.13";
 
   src = fetchFromGitHub {
     owner = "ihhub";
     repo = "fheroes2";
     rev = version;
-    hash = "sha256-U8iJAhubMHGPXNph+kWhMzRDbh3e4bikgQKbPPeKqV8=";
+    hash = "sha256-ct58Rkc6ORXldINQZVzMuObMl0BMk6QG88oU4tT0WcE=";
   };
 
   nativeBuildInputs = [ imagemagick ];

pkgs/by-name/fl/flake-edit/package.nix

@@ -10,16 +10,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "flake-edit";
-  version = "0.3.1";
+  version = "0.3.3";
 
   src = fetchFromGitHub {
     owner = "a-kenji";
     repo = "flake-edit";
     rev = "v${version}";
-    hash = "sha256-Ptg/Wt8H6vOvk/V6juDmFd6Vzu/F3LzxDIGObuwySLA=";
+    hash = "sha256-CDz7iDOPearlxsqLuAuG+cmKneFavxJmdCbnWwEIvcU=";
   };
 
-  cargoHash = "sha256-5i3wll3CdrRbwN8zsD4MQg62hvsMPESMW4YrtjPeySw=";
+  cargoHash = "sha256-IvBrJBSAMLfqefyUnS3Ex+JvHJAWJtVtkBVp2kFvA4s=";
 
   nativeBuildInputs = [
     installShellFiles

pkgs/by-name/fr/freerdp/package.nix

@@ -70,13 +70,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "freerdp";
-  version = "3.20.2";
+  version = "3.21.0";
 
   src = fetchFromGitHub {
     owner = "FreeRDP";
     repo = "FreeRDP";
     rev = finalAttrs.version;
-    hash = "sha256-IcEWlNh0AI3Vkqf2FzQYOIq64J6iWJxWlUfYkcBpGUU=";
+    hash = "sha256-oIws2HO2usOCtVDe6OTIdIDHYgb9tBIEctvCW6/Woxc=";
   };
 
   postPatch = ''

pkgs/by-name/ga/gallery-dl/package.nix

@@ -8,7 +8,7 @@
 
 let
   pname = "gallery-dl";
-  version = "1.31.2";
+  version = "1.31.3";
 in
 python3Packages.buildPythonApplication {
   inherit pname version;
@@ -18,7 +18,7 @@ python3Packages.buildPythonApplication {
     owner = "mikf";
     repo = "gallery-dl";
     tag = "v${version}";
-    hash = "sha256-cKgfIJFSlUmZa3ovInI98Yw29QurXNAy7J1dUSPAUfQ=";
+    hash = "sha256-vheQA67lPeYt7wly/4AbiReDx9ZlUbgqxT5YTxI0gVo=";
   };
 
   build-system = [ python3Packages.setuptools ];

pkgs/by-name/gh/gh-copilot/package.nix

@@ -1,62 +0,0 @@
-{
-  stdenv,
-  lib,
-  fetchurl,
-}:
-let
-  inherit (stdenv.hostPlatform) system;
-  throwSystem = throw "Unsupported system: ${system}";
-
-  systemToPlatform = {
-    "x86_64-linux" = {
-      name = "linux-amd64";
-      hash = "sha256-WVb32g9eqoeQgvPUGOQ7r3oD+PerKYQWEh/PoZwVqkI=";
-    };
-    "aarch64-linux" = {
-      name = "linux-arm64";
-      hash = "sha256-nZg7u0BUIHOdu3dg28fydgm6ctr4jOOIZOA5ms3/E64=";
-    };
-    "x86_64-darwin" = {
-      name = "darwin-amd64";
-      hash = "sha256-A+FQ7AgjqS1/7LExhyKwXlCAwCveSgeyhbCNAjqQ770=";
-    };
-    "aarch64-darwin" = {
-      name = "darwin-arm64";
-      hash = "sha256-+Q1H9h1j1kusEu1HW3zHWQ8ReR50kwjj4kGC3g6Jzqc=";
-    };
-  };
-  platform = systemToPlatform.${system} or throwSystem;
-in
-stdenv.mkDerivation (finalAttrs: {
-  pname = "gh-copilot";
-  version = "1.2.0";
-
-  src = fetchurl {
-    name = "gh-copilot";
-    url = "https://github.com/github/gh-copilot/releases/download/v${finalAttrs.version}/${platform.name}";
-    hash = platform.hash;
-  };
-
-  dontUnpack = true;
-
-  installPhase = ''
-    runHook preInstall
-
-    install -m755 -D $src $out/bin/gh-copilot
-
-    runHook postInstall
-  '';
-
-  passthru.updateScript = ./update.sh;
-
-  meta = {
-    changelog = "https://github.com/github/gh-copilot/releases/tag/v${finalAttrs.version}";
-    description = "Ask for assistance right in your terminal";
-    homepage = "https://github.com/github/gh-copilot";
-    license = lib.licenses.unfree;
-    mainProgram = "gh-copilot";
-    maintainers = with lib.maintainers; [ PerchunPak ];
-    platforms = lib.attrNames systemToPlatform;
-    sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
-  };
-})

pkgs/by-name/gh/gh-copilot/update.sh

@@ -1,43 +0,0 @@
-#!/usr/bin/env nix-shell
-#!nix-shell -i bash -p curl jq common-updater-scripts nix-prefetch
-
-set -euo pipefail
-set -x
-
-ROOT="$(dirname "$(readlink -f "$0")")"
-NIX_DRV="$ROOT/package.nix"
-if [ ! -f "$NIX_DRV" ]; then
-  echo "ERROR: cannot find gh-copilot in $ROOT"
-  exit 1
-fi
-
-fetch_arch() {
-  VER="$1"; ARCH="$2"
-  URL="https://github.com/github/gh-copilot/releases/download/v${VER}/${ARCH}";
-  nix-prefetch "{ stdenv, fetchzip }:
-stdenv.mkDerivation rec {
-  pname = \"vere\"; version = \"${VER}\";
-  src = fetchurl { url = \"$URL\"; };
-}
-"
-}
-
-replace_sha() {
-  # https://stackoverflow.com/a/38470458/22235705
-  sed -rziE "s@($1[^\n]*\n[^\n]*hash = )\"sha256-.{44}\";@\1\"$2\";@" "$NIX_DRV"
-}
-
-VERE_VER=$(curl https://api.github.com/repos/github/gh-copilot/releases/latest | jq .tag_name)
-VERE_VER=$(echo $VERE_VER | sed -e 's/^"v//' -e 's/"$//') # transform "v1.0.2" into 1.0.2
-
-VERE_LINUX_X64_SHA256=$(fetch_arch "$VERE_VER" "linux-amd64")
-VERE_LINUX_AARCH64_SHA256=$(fetch_arch "$VERE_VER" "linux-arm64")
-VERE_DARWIN_X64_SHA256=$(fetch_arch "$VERE_VER" "darwin-amd64")
-VERE_DARWIN_AARCH64_SHA256=$(fetch_arch "$VERE_VER" "darwin-arm64")
-
-sed -i "s/version = \".*\"/version = \"$VERE_VER\"/" "$NIX_DRV"
-
-replace_sha "linux-amd64" "$VERE_LINUX_X64_SHA256"
-replace_sha "linux-arm64" "$VERE_LINUX_AARCH64_SHA256"
-replace_sha "darwin-amd64" "$VERE_DARWIN_X64_SHA256"
-replace_sha "darwin-arm64" "$VERE_DARWIN_AARCH64_SHA256"

pkgs/by-name/gp/gpsd/package.nix

@@ -33,13 +33,13 @@
   gpsdGroup ? "dialout",
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "gpsd";
-  version = "3.27.3";
+  version = "3.27.5";
 
   src = fetchurl {
-    url = "mirror://savannah/${pname}/${pname}-${version}.tar.gz";
-    sha256 = "sha256-pNhbZ3l1Iq6GEZWLX9oLtn5JIa/ia9U+HS/wpBWNrMs=";
+    url = "mirror://savannah/${finalAttrs.pname}/${finalAttrs.pname}-${finalAttrs.version}.tar.gz";
+    hash = "sha256-QJhz9QSEYu8axBOlGrNcqotQsxvmKzNHvuHMKZTnxkk=";
   };
 
   # TODO: render & install HTML documentation using asciidoctor
@@ -148,11 +148,11 @@ stdenv.mkDerivation rec {
       location-aware applications GPS/AIS logs for diagnostic purposes.
     '';
     homepage = "https://gpsd.gitlab.io/gpsd/index.html";
-    changelog = "https://gitlab.com/gpsd/gpsd/-/blob/release-${version}/NEWS";
+    changelog = "https://gitlab.com/gpsd/gpsd/-/blob/release-${finalAttrs.version}/NEWS";
     license = lib.licenses.bsd2;
     platforms = lib.platforms.unix;
     maintainers = with lib.maintainers; [
       bjornfor
     ];
   };
-}
+})

pkgs/by-name/hu/hujsonfmt/package.nix

@@ -9,13 +9,13 @@ let
 in
 buildGoModule {
   pname = "hujsonfmt";
-  version = "0-unstable-2022-12-23";
+  version = "0-unstable-2025-06-05";
 
   src = fetchFromGitHub {
     owner = "tailscale";
     repo = "hujson";
-    rev = "20486734a56a3455c47994bf4942974d6f9969a0";
-    hash = "sha256-j2HRs5zZ0jTIqWIRhHheO9eaGzMMkNuKXuhboq9KpB4=";
+    rev = "992244df8c5ad853c10f498549e0eab54e515d13";
+    hash = "sha256-5lEvWiCxU+5oKbBon8EvBUON9WtxDausRVFU1+q2TZE=";
   };
 
   proxyVendor = true;

pkgs/by-name/ia/iamb/package.nix

@@ -1,42 +1,28 @@
 {
   lib,
-  stdenv,
   rustPlatform,
   fetchFromGitHub,
   installShellFiles,
+  writableTmpDirAsHomeHook,
   versionCheckHook,
   nix-update-script,
 }:
 
-rustPlatform.buildRustPackage rec {
+rustPlatform.buildRustPackage (finalAttrs: {
   pname = "iamb";
-  version = "0.0.10";
+  version = "0.0.11";
 
   src = fetchFromGitHub {
     owner = "ulyssa";
     repo = "iamb";
-    tag = "v${version}";
-    hash = "sha256-cjBSWUBgfwdLnpneJ5XW2TdOFkNc+Rc/wyUp9arZzwg=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-nvEOtV1Y5K9E1Lj+bPnQ6k1AneDM9OT3RbV3Urm/1Qs=";
   };
 
-  cargoHash = "sha256-fAre0jrpJ63adcg4AKCYzdQtCsd0MMMcWA0RsoHo6ig=";
+  cargoHash = "sha256-uWYNFNoCiqw6gYuHZWmZmZVs7lKNvhzjwEyxgcbvv+8=";
 
-  nativeBuildInputs = [ installShellFiles ];
-
-  preBuild = ''
-    export HOME=$(mktemp -d)
-  '';
-
-  checkFlags = lib.optionals stdenv.hostPlatform.isDarwin [
-    # Attempted to create a NULL object.
-    "--skip=base::tests::test_complete_cmdbar"
-    "--skip=base::tests::test_complete_msgbar"
-
-    # Attempted to create a NULL object.
-    "--skip=windows::room::scrollback::tests::test_cursorpos"
-    "--skip=windows::room::scrollback::tests::test_dirscroll"
-    "--skip=windows::room::scrollback::tests::test_movement"
-    "--skip=windows::room::scrollback::tests::test_search_messages"
+  nativeBuildInputs = [
+    installShellFiles
   ];
 
   postInstall = ''
@@ -57,8 +43,8 @@ rustPlatform.buildRustPackage rec {
     description = "Matrix client for Vim addicts";
     mainProgram = "iamb";
     homepage = "https://github.com/ulyssa/iamb";
-    changelog = "https://github.com/ulyssa/iamb/releases/tag/${src.tag}";
+    changelog = "https://github.com/ulyssa/iamb/releases/tag/${finalAttrs.src.tag}";
     license = lib.licenses.asl20;
     maintainers = with lib.maintainers; [ meain ];
   };
-}
+})

pkgs/by-name/le/ledger-live-desktop/package.nix

@@ -8,11 +8,11 @@
 
 let
   pname = "ledger-live-desktop";
-  version = "2.135.2";
+  version = "2.137.0";
 
   src = fetchurl {
     url = "https://download.live.ledger.com/${pname}-${version}-linux-x86_64.AppImage";
-    hash = "sha256-K74ILzYKvNccnJyUBvWoA6xijkcXWGFLuCfdaQtmvR8=";
+    hash = "sha256-G9wuefSt4OEFIM8rHLSyBY8t+jxgKPt4T+KQF6Jh3Tk=";
   };
 
   appimageContents = appimageTools.extractType2 {

pkgs/by-name/li/libnbd/package.nix

@@ -18,11 +18,11 @@
 
 stdenv.mkDerivation rec {
   pname = "libnbd";
-  version = "1.22.1";
+  version = "1.22.5";
 
   src = fetchurl {
     url = "https://download.libguestfs.org/libnbd/${lib.versions.majorMinor version}-stable/${pname}-${version}.tar.gz";
-    hash = "sha256-9oVJrU2YcXGnKaDf8SoHKGtG7vpH5355/DKIiYrchHI=";
+    hash = "sha256-y/Ria/R8jC+Zu5bHnlqM7JozNzyt6i/Bu/4E5uFbbjw=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/li/librelane/package.nix

@@ -0,0 +1,96 @@
+{
+  lib,
+  python3Packages,
+  fetchFromGitHub,
+
+  # nativeBuildInputs
+  makeWrapper,
+
+  # dependencies
+  pdk-ciel,
+
+  # wrapper runtime dependencies
+  abc-verifier,
+  klayout,
+  magic-vlsi,
+  netgen-vlsi,
+  openroad,
+  ruby,
+  verilator,
+  yosys,
+}:
+
+python3Packages.buildPythonApplication (finalAttrs: {
+  pname = "librelane";
+  version = "3.0.0.dev47-unstable-2026-01-12";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "librelane";
+    repo = "librelane";
+    rev = "f1efecac3151f3275fa2ea7d656f8ea7e3225a9d";
+    hash = "sha256-XZHypZ+Ht1Zbb0N9VBUmrZKwWuqYA0/w7DpZBOO9KU8=";
+  };
+
+  build-system = [
+    python3Packages.poetry-core
+  ];
+
+  nativeBuildInputs = [
+    makeWrapper
+  ];
+
+  pythonRelaxDeps = [
+    "click"
+  ];
+
+  dependencies = with python3Packages; [
+    click
+    cloup
+    deprecated
+    httpx
+    libparse-python
+    lxml
+    numpy
+    pandas
+    pdk-ciel
+    psutil
+    python3Packages.klayout
+    pyyaml
+    rapidfuzz
+    rich
+    semver
+    tkinter
+    yamlcore
+  ];
+
+  postInstall = ''
+    cp -r librelane/scripts $out/${python3Packages.python.sitePackages}/librelane/
+    cp -r librelane/examples $out/${python3Packages.python.sitePackages}/librelane/
+  '';
+
+  postFixup = ''
+    wrapProgram $out/bin/librelane \
+      --suffix PYTHONPATH : "$PYTHONPATH" \
+      --prefix PATH : ${
+        lib.makeBinPath [
+          abc-verifier
+          klayout
+          magic-vlsi
+          netgen-vlsi
+          openroad
+          ruby
+          verilator
+          yosys
+        ]
+      }
+  '';
+
+  meta = {
+    description = "ASIC implementation flow infrastructure";
+    homepage = "https://github.com/librelane/librelane";
+    license = lib.licenses.asl20;
+    maintainers = [ lib.maintainers.gonsolo ];
+    mainProgram = "librelane";
+  };
+})

pkgs/by-name/ne/nest-cli/package.nix

@@ -1,18 +1,20 @@
 {
+  lib,
+  stdenv,
+  python3,
+  clang_20,
   buildNpmPackage,
   fetchFromGitHub,
-  lib,
-  python3,
 }:
 
-buildNpmPackage rec {
+buildNpmPackage (finalAttrs: {
   pname = "nest-cli";
   version = "11.0.15";
 
   src = fetchFromGitHub {
     owner = "nestjs";
     repo = "nest-cli";
-    tag = version;
+    tag = finalAttrs.version;
     hash = "sha256-yUDlF5UyRE9UdGhw9HDLDpg1voUMQsIenUZZ4UPhBT4=";
   };
 
@@ -25,17 +27,19 @@ buildNpmPackage rec {
 
   nativeBuildInputs = [
     python3
-  ];
+  ]
+  ++ lib.optionals (stdenv.hostPlatform.isDarwin && stdenv.hostPlatform.isAarch64) [ clang_20 ]; # clang_21 breaks gyp builds
 
   meta = {
-    homepage = "https://nestjs.com";
+    changelog = "https://github.com/nestjs/nest-cli/releases/tag/${finalAttrs.version}";
     description = "CLI tool for Nest applications";
+    downloadPage = "https://github.com/nestjs/nest-cli";
+    homepage = "https://nestjs.com";
     license = lib.licenses.mit;
-    changelog = "https://github.com/nestjs/nest-cli/releases/tag/${version}";
     mainProgram = "nest";
     maintainers = with lib.maintainers; [
       ehllie
       phanirithvij
     ];
   };
-}
+})

pkgs/by-name/no/nox/move-to-attrs.patch

@@ -0,0 +1,41 @@
+diff --git a/nox/update.py b/nox/update.py
+index ea4425f..3101ab9 100644
+--- a/nox/update.py
++++ b/nox/update.py
+@@ -1,3 +1,4 @@
++import attrs
+ import click
+ import re
+ import subprocess
+@@ -6,15 +7,17 @@ from enum import Enum
+ from bisect import bisect
+ from pkg_resources import parse_version
+ from pathlib import Path
+-from characteristic import attributes
+ from collections import defaultdict
+ 
+ def query(*args):
+     return subprocess.check_output(['nix-store', '--query'] + list(args),
+                                    universal_newlines=True)
+ 
+-@attributes(['full_name', 'path'], apply_with_init=False)
++@attrs.define(init=False)
+ class NixPath:
++    full_name: str = attrs.field(default=None)
++    path: str = attrs.field(default=None)
++
+     def __init__(self, path):
+         self.path = path
+         self.is_drv = self.path.endswith('.drv')
+diff --git a/requirements.txt b/requirements.txt
+index a7bfc0e..4298b69 100644
+--- a/requirements.txt
++++ b/requirements.txt
+@@ -1,4 +1,4 @@
++attrs
+ click
+ dogpile.cache
+-characteristic
+-requests
+\ No newline at end of file
++requests

pkgs/by-name/no/nox/package.nix

@@ -14,7 +14,11 @@ python3Packages.buildPythonApplication rec {
     sha256 = "1qcbhdnhdhhv7q6cqdgv0q55ic8fk18526zn2yb12x9r1s0lfp9z";
   };
 
-  patches = [ ./nox-review-wip.patch ];
+  patches = [
+    ./nox-review-wip.patch
+    # https://github.com/madjar/nox/pull/100
+    ./move-to-attrs.patch
+  ];
 
   build-system = with python3Packages; [
     setuptools
@@ -25,7 +29,7 @@ python3Packages.buildPythonApplication rec {
     dogpile-cache
     click
     requests
-    characteristic
+    attrs
     setuptools # pkg_resources is imported during runtime
   ];
 

pkgs/by-name/ol/ollama/package.nix

@@ -138,13 +138,13 @@ in
 goBuild (finalAttrs: {
   pname = "ollama";
   # don't forget to invalidate all hashes each update
-  version = "0.14.1";
+  version = "0.14.2";
 
   src = fetchFromGitHub {
     owner = "ollama";
     repo = "ollama";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-r9Qwa1bAzLlr50mB+RLkRfuCFe6FUXtR9irqvU7PAvA=";
+    hash = "sha256-NDtXMRpglUG0XhkTJrd90kv1utpxXGNppMHOG3Zmt54=";
   };
 
   vendorHash = "sha256-WdHAjCD20eLj0d9v1K6VYP8vJ+IZ8BEZ3CciYLLMtxc=";

pkgs/by-name/on/onetbb/package.nix

@@ -1,15 +1,20 @@
-{
+args@{
   lib,
   stdenv,
   fetchFromGitHub,
-  fetchpatch,
   cmake,
-  hwloc,
+  hwloc, # Purposefully shadowed below
   ninja,
   pkg-config,
   ctestCheckHook,
 }:
-
+let
+  # The behavior of OneTBB does not change if it is built with hwloc with support for CUDA.
+  # However, the derivation *does* change, causing rebuilds of packages like Nix.
+  # To avoid these pointless rebuilds, we make sure to always use a version of hwloc with CUDA
+  # support disabled.
+  hwloc = args.hwloc.override { enableCuda = false; };
+in
 stdenv.mkDerivation (finalAttrs: {
   pname = "onetbb";
   version = "2022.3.0";

pkgs/by-name/ot/otb/package.nix

@@ -98,6 +98,17 @@ let
     postPatch = ''
       substituteInPlace Modules/ThirdParty/KWSys/src/KWSys/CMakeLists.txt \
       --replace-fail 'cmake_minimum_required(VERSION 3.1 FATAL_ERROR)' 'cmake_minimum_required(VERSION 3.10)'
+      # fix build with GCC 15
+      substituteInPlace Modules/ThirdParty/GoogleTest/src/itkgoogletest/googletest/src/gtest-death-test.cc \
+        --replace-fail \
+          '#include <utility>' \
+          '#include <utility>
+          #include <cstdint>'
+      substituteInPlace Modules/Core/Common/include/itkFloatingPointExceptions.h \
+        --replace-fail \
+          '#include "itkSingletonMacro.h"' \
+          '#include "itkSingletonMacro.h"
+          #include <cstdint>'
     '';
 
     # fix the CMake config files for ITK which contains double slashes

pkgs/by-name/ph/photoqt/package.nix

@@ -17,11 +17,11 @@
 
 stdenv.mkDerivation rec {
   pname = "photoqt";
-  version = "5.0";
+  version = "5.1";
 
   src = fetchurl {
     url = "https://photoqt.org/downloads/source/photoqt-${version}.tar.gz";
-    hash = "sha256-BSe95dwzBCVp5jHIX6xh9BZ4OgPl88YUxt0iTSTnx18=";
+    hash = "sha256-GQT0JDuhrtQh9u5R2DBIlYWEHsSJ8cvDp3+0s6I0iHY=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/ql/qlementine-icons/package.nix

@@ -8,13 +8,13 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "qlementine-icons";
-  version = "1.13.0";
+  version = "1.14.0";
 
   src = fetchFromGitHub {
     owner = "oclero";
     repo = "qlementine-icons";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-wXpFyVTFNHTVkGz2fQ2gQHdvCfZNs6Dx8hhonFRZytg=";
+    hash = "sha256-29XiD3t+KKEe8KRs5LwTN11gEFBJt/Ws6geq6bdH8KA=";
   };
 
   nativeBuildInputs = [ cmake ];

pkgs/by-name/ra/radicle-ci-broker/package.nix

@@ -14,14 +14,14 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "radicle-ci-broker";
-  version = "0.24.0";
+  version = "0.25.0";
 
   src = fetchFromRadicle {
     seed = "seed.radicle.xyz";
     repo = "zwTxygwuz5LDGBq255RA2CbNGrz8";
     node = "z6MkgEMYod7Hxfy9qCvDv5hYHkZ4ciWmLFgfvm3Wn1b2w2FV";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-E9i5EhzI+9PX2Sm2nNyB5SMi6F/EmjifeD0futPBi6k=";
+    hash = "sha256-28PS85ME0Yg6+FnYw8GRNeo56z5efAqSE7FNk7wiTuI=";
     leaveDotGit = true;
     postFetch = ''
       git -C $out rev-parse --short HEAD > $out/.git_head
@@ -29,7 +29,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
     '';
   };
 
-  cargoHash = "sha256-RlqomX4XiKn/YuCdBh6H/y+8JFBwC06eDEAmhz71UXs=";
+  cargoHash = "sha256-v+ax8DmXZFxYGYL7WaX5W/UIByuYcvkAMQIqpb6Emyw=";
 
   postPatch = ''
     substituteInPlace build.rs \

pkgs/by-name/ra/radicle-native-ci/package.nix

@@ -10,17 +10,17 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "radicle-native-ci";
-  version = "0.11.1";
+  version = "0.12.0";
 
   src = fetchFromRadicle {
     seed = "seed.radicle.xyz";
     repo = "z3qg5TKmN83afz2fj9z3fQjU8vaYE";
     node = "z6MkgEMYod7Hxfy9qCvDv5hYHkZ4ciWmLFgfvm3Wn1b2w2FV";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-OjQBq4QopT4dr1/z73fqlGLjQIjUY51/II9m2qQMW1w=";
+    hash = "sha256-Hi5QdYVFSvP8AEKcH7yIA7PpaTSe0hBcF3vgCNilCKg=";
   };
 
-  cargoHash = "sha256-zyEdlAXaooEkxD4aZ1poIUX3OwXtP4nFAyOWJDdw1p8=";
+  cargoHash = "sha256-N1XyMarKCctor5r7AePMuV/BzWiQwXphJFqye0cqO3k=";
 
   preCheck = ''
     git config --global user.name nixbld

pkgs/by-name/re/redumper/package.nix

@@ -9,13 +9,13 @@
 # redumper is using C++ modules, this requires latest C++20 compiler and build tools
 llvmPackages.libcxxStdenv.mkDerivation (finalAttrs: {
   pname = "redumper";
-  version = "666";
+  version = "686";
 
   src = fetchFromGitHub {
     owner = "superg";
     repo = "redumper";
     tag = "b${finalAttrs.version}";
-    hash = "sha256-B5c7ISlQhLBsRYcoCG18uLWkeODJUDGoRAd9n8EejNA=";
+    hash = "sha256-oyF8NLMgnNzUPgcwu7WvVoOFQt1qUuFMtzKxJqyOq9A=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/re/resvg/package.nix

@@ -6,16 +6,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "resvg";
-  version = "0.45.1";
+  version = "0.46.0";
 
   src = fetchFromGitHub {
     owner = "RazrFalcon";
     repo = "resvg";
     rev = "v${version}";
-    hash = "sha256-sz1fAvg5HiBJpAgH7Vy0j5eAkvW8egcHyUXCsZzOWT8=";
+    hash = "sha256-kiE9Zv3PonRRq6pbRnqGz0LKlYSTFSuuqYaLDmC9I2Y=";
   };
 
-  cargoHash = "sha256-jUq1BvHgs3tEI+ye04FykdunHcMMatE3Gamr3grNWQw=";
+  cargoHash = "sha256-dqqO+CPyBaUFBZGwhwXFRr8tnZWp27sF0606tmOm7ms=";
 
   cargoBuildFlags = [
     "--package=resvg"

pkgs/by-name/rs/rspamd/package.nix

@@ -2,7 +2,6 @@
   stdenv,
   lib,
   fetchFromGitHub,
-  fetchpatch2,
   cmake,
   doctest,
   fmt,
@@ -40,20 +39,16 @@ assert (!withHyperscan) || (!withVectorscan);
 
 stdenv.mkDerivation rec {
   pname = "rspamd";
-  version = "3.13.0";
+  version = "3.14.2";
 
   src = fetchFromGitHub {
     owner = "rspamd";
     repo = "rspamd";
     rev = version;
-    hash = "sha256-0qX/rvcEXxzr/PGL2A59T18Mfcalrjz0KJpEWBKJsZg=";
+    hash = "sha256-XpCdjS6c9nLi1ngeSPBldmK3HmMFfDNW+tNpxdrUoKg=";
   };
 
   patches = [
-    (fetchpatch2 {
-      url = "https://github.com/rspamd/rspamd/commit/d808fd75ff1db1821b1dd817eb4ba9a118b31090.patch";
-      hash = "sha256-v1Gn3dPxN/h92NYK3PTrZomnbwUcVkAWcYeQCFzQNyo=";
-    })
   ];
 
   nativeBuildInputs = [

pkgs/by-name/sa/saga/package.nix

@@ -43,11 +43,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "saga";
-  version = "9.11.0";
+  version = "9.11.1";
 
   src = fetchurl {
     url = "mirror://sourceforge/saga-gis/saga-${finalAttrs.version}.tar.gz";
-    hash = "sha256-KoSL1OnxK/dJxwlTxQGTiICyfEGpVMnojbWi0iZ6GV8=";
+    hash = "sha256-cNk6/IcgqLgOrw2LaeM97pydFwLmDL6Mr169pjBNYDE=";
   };
 
   sourceRoot = "saga-${finalAttrs.version}/saga-gis";

pkgs/by-name/sc/scribus/package.nix

@@ -4,13 +4,15 @@
   cmake,
   cups,
   fetchurl,
-  fetchpatch,
   fontconfig,
   freetype,
   graphicsmagick,
+  gsettings-desktop-schemas,
+  gtk3,
   harfbuzzFull,
   hunspell,
   lcms2,
+  lib,
   libcdr,
   libfreehand,
   libjpeg,
@@ -31,25 +33,17 @@
   poppler,
   poppler_data,
   python3,
-  lib,
-  stdenv,
   qt6,
+  stdenv,
 }:
-
-let
-  pythonEnv = python3.withPackages (ps: [
-    ps.pillow
-    ps.tkinter
-  ]);
-in
 stdenv.mkDerivation (finalAttrs: {
   pname = "scribus";
 
-  version = "1.7.0";
+  version = "1.7.2";
 
   src = fetchurl {
     url = "mirror://sourceforge/scribus/scribus-devel/scribus-${finalAttrs.version}.tar.xz";
-    hash = "sha256-+lnWIh/3z/qTcjV5l+hlcBYuHhiRNza3F2/RD0jCQ/Y=";
+    hash = "sha256-nY4RzGusLNlsVTnvvXGSIv9/cOHBhZcogNn7MFHhONA=";
   };
 
   nativeBuildInputs = [
@@ -85,7 +79,12 @@ stdenv.mkDerivation (finalAttrs: {
     podofo_0_10
     poppler
     poppler_data
-    pythonEnv
+    (python3.withPackages (
+      ps: with ps; [
+        pillow
+        tkinter
+      ]
+    ))
     qt6.qt5compat
     qt6.qtbase
     qt6.qtdeclarative
@@ -97,41 +96,12 @@ stdenv.mkDerivation (finalAttrs: {
 
   cmakeFlags = [ (lib.cmakeBool "WANT_GRAPHICSMAGICK" true) ];
 
-  patches = [
-    (fetchpatch {
-      url = "https://aur.archlinux.org/cgit/aur.git/plain/fix_build_with_qt_6.9.0.patch?h=scribus-unstable";
-      hash = "sha256-hzd9XpoVVqbwvZ40QPGBqqWkIFXug/tSojf/Ikc4nn4=";
-    })
-    (fetchpatch {
-      url = "https://aur.archlinux.org/cgit/aur.git/plain/fix_build_with_poppler_25.02.0.patch?h=scribus-unstable";
-      hash = "sha256-t9xJA6KGMGAdUFyjI8OlTNilewyMr1FFM7vjHOM15Xg=";
-    })
-    (fetchpatch {
-      name = "fix-build-poppler-25.06.0.patch";
-      url = "https://github.com/scribusproject/scribus/commit/8dcf8d777bd85a0741c455961f2de382e3ed47ec.patch";
-      hash = "sha256-JBHCgvEJnYrUdtLnFSXTfr1FFin4uUNUnddYwfRbn7k=";
-    })
-    (fetchpatch {
-      name = "fix-build-poppler-25.07.0.patch";
-      url = "https://github.com/scribusproject/scribus/commit/ff6c6abfa8683028e548a269dee6a859b6f63335.patch";
-      hash = "sha256-N4jve5feehsX5H0RXdxR4ableKL+c/rTyqCwkEf37Dk=";
-    })
-    (fetchpatch {
-      name = "fix-qt6.10-build.patch";
-      url = "https://github.com/scribusproject/scribus/commit/13fc4f874354511e05bf91a48703b57b4c489715.patch";
-      hash = "sha256-+pbQ77SaTh04QX55wmS6WeuZf3IGe5nq3pmrhk68tb8=";
-    })
-    (fetchpatch {
-      name = "fix-build-poppler-25.09.0.patch";
-      url = "https://github.com/scribusproject/scribus/commit/f0cfe30019a514bdaf38b78590451e2c5b9b5420.patch";
-      hash = "sha256-ONQ3BzGhouO+0zqYUObuJC3NUCFi1PWq6qoRvuSZJws=";
-    })
-    (fetchpatch {
-      name = "fix-build-poppler-25.10.0.patch";
-      url = "https://github.com/scribusproject/scribus/commit/3c1fc34fae1aa26fceb65b6bdf631a7f00b03c3c.patch";
-      hash = "sha256-xTwzbT3h4+5hb6Y/sNmzkfDN2LJGOLP1v/WBVsmZXkk=";
-    })
-  ];
+  preFixup = ''
+    qtWrapperArgs+=(
+      --prefix XDG_DATA_DIRS : "${gsettings-desktop-schemas}/share/gsettings-schemas/${gsettings-desktop-schemas.name}"
+      --prefix XDG_DATA_DIRS : "${gtk3}/share/gsettings-schemas/${gtk3.name}"
+    )
+  '';
 
   meta = {
     maintainers = with lib.maintainers; [ arthsmn ];

pkgs/by-name/si/signal-desktop-bin/generic.nix

@@ -296,6 +296,7 @@ stdenv.mkDerivation rec {
       lib.licenses.mit # emoji-data
     ];
     maintainers = with lib.maintainers; [
+      eclairevoyant
       mic92
       equirosa
       bkchr

pkgs/by-name/si/signal-desktop-bin/signal-desktop-aarch64.nix

@@ -1,7 +1,7 @@
 { callPackage, commandLineArgs }:
 callPackage ./generic.nix { inherit commandLineArgs; } {
   pname = "signal-desktop-bin";
-  version = "7.83.0";
+  version = "7.85.0";
 
   libdir = "usr/lib64/signal-desktop";
   bindir = "usr/bin";
@@ -10,6 +10,6 @@ callPackage ./generic.nix { inherit commandLineArgs; } {
     bsdtar -xf $downloadedFile -C "$out"
   '';
 
-  url = "https://download.copr.fedorainfracloud.org/results/useidel/signal-desktop/fedora-42-aarch64/09932085-signal-desktop/signal-desktop-7.83.0-1.fc42.aarch64.rpm";
-  hash = "sha256-OY+sHfAC/WTC2MkjFjlImYXLNflFNAw4VRcbQ/B3s10=";
+  url = "https://download.copr.fedorainfracloud.org/results/useidel/signal-desktop/fedora-43-aarch64/10010734-signal-desktop/signal-desktop-7.85.0-1.fc43.aarch64.rpm";
+  hash = "sha256-ewjW5mwPph1xZXtqwYPishJ/zYjzpA/df+5WvdcEfWI=";
 }

pkgs/by-name/si/signal-desktop-bin/signal-desktop-darwin.nix

@@ -6,11 +6,11 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "signal-desktop-bin";
-  version = "7.83.0";
+  version = "7.85.0";
 
   src = fetchurl {
     url = "https://updates.signal.org/desktop/signal-desktop-mac-universal-${finalAttrs.version}.dmg";
-    hash = "sha256-5W70xzjT5+PbzmDHBFIqAUdXn9N1L0aZm1rrdAPUXRw=";
+    hash = "sha256-oXt4MlSvpj4NHwULg8K0XukaMqnlsF2UPkvBGH3Htko=";
   };
   sourceRoot = ".";
 

pkgs/by-name/si/signal-desktop-bin/signal-desktop.nix

@@ -1,12 +1,12 @@
 { callPackage, commandLineArgs }:
 callPackage ./generic.nix { inherit commandLineArgs; } rec {
   pname = "signal-desktop-bin";
-  version = "7.83.0";
+  version = "7.85.0";
 
   libdir = "opt/Signal";
   bindir = libdir;
   extractPkg = "dpkg-deb -x $downloadedFile $out";
 
   url = "https://updates.signal.org/desktop/apt/pool/s/signal-desktop/signal-desktop_${version}_amd64.deb";
-  hash = "sha256-DhtOOve8dloIbTi78gLHWars/Y9Fv6YkLkHHpRK7OWY=";
+  hash = "sha256-5DJho9aYNwgasZsSuChEvoDK7N1H+n3RdDh7FMw73SA=";
 }

pkgs/by-name/si/signal-desktop/force-90-days-expiration.patch

@@ -0,0 +1,28 @@
+diff --git a/ts/scripts/get-expire-time.node.ts b/ts/scripts/get-expire-time.node.ts
+index 7938f74d3..9d427977d 100644
+--- a/ts/scripts/get-expire-time.node.ts
++++ b/ts/scripts/get-expire-time.node.ts
+@@ -18,7 +18,7 @@ const buildCreation = unixTimestamp * 1000;
+ 
+ // NB: Build expirations are also determined via users' auto-update settings; see
+ // getExpirationTimestamp
+-const validDuration = isNotUpdatable(version) ? DAY * 30 : DAY * 90;
++const validDuration = DAY * 90;
+ const buildExpiration = buildCreation + validDuration;
+ 
+ const localProductionPath = join(
+diff --git a/ts/util/buildExpiration.std.ts b/ts/util/buildExpiration.std.ts
+index 530443ec7..26cb03d7c 100644
+--- a/ts/util/buildExpiration.std.ts
++++ b/ts/util/buildExpiration.std.ts
+@@ -70,9 +70,7 @@ export function hasBuildExpired({
+     return true;
+   }
+ 
+-  const safeExpirationMs = autoDownloadUpdate
+-    ? NINETY_ONE_DAYS
+-    : THIRTY_ONE_DAYS;
++  const safeExpirationMs = NINETY_ONE_DAYS;
+ 
+   const buildExpirationDuration = buildExpirationTimestamp - now;
+   const tooFarIntoFuture = buildExpirationDuration > safeExpirationMs;

pkgs/by-name/si/signal-desktop/package.nix

@@ -111,7 +111,10 @@ stdenv.mkDerivation (finalAttrs: {
   ];
   buildInputs = (lib.optional (!withAppleEmojis) noto-fonts-color-emoji-png);
 
-  patches = lib.optional (!withAppleEmojis) (
+  patches = [
+    ./force-90-days-expiration.patch
+  ]
+  ++ lib.optional (!withAppleEmojis) (
     replaceVars ./replace-apple-emoji-with-noto-emoji.patch {
       noto-emoji-pngs = "${noto-fonts-color-emoji-png}/share/noto-fonts-color-emoji-png";
     }
@@ -289,6 +292,7 @@ stdenv.mkDerivation (finalAttrs: {
       ]
       ++ lib.optional withAppleEmojis unfree;
     maintainers = with lib.maintainers; [
+      eclairevoyant
       marcin-serwin
       teutat3s
     ];

pkgs/by-name/si/signalbackup-tools/package.nix

@@ -14,13 +14,13 @@
 
 stdenv.mkDerivation rec {
   pname = "signalbackup-tools";
-  version = "20260113";
+  version = "20260118-1";
 
   src = fetchFromGitHub {
     owner = "bepaald";
     repo = "signalbackup-tools";
     tag = version;
-    hash = "sha256-vnmNiVMNXdSr2CYgNYIf+tzA86og3r7MeOVyo3bqfvA=";
+    hash = "sha256-3pwIRhTpYk3Vq0C4BNHle7/6QWrEuo0/hMqFRH6zw6A=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/sv/svt-av1-psyex/package.nix

@@ -3,22 +3,22 @@
   stdenv,
   fetchFromGitHub,
   cmake,
-  nasm,
+  yasm,
   cpuinfo,
   libdovi,
   hdr10plus,
-  unstableGitUpdater,
+  nix-update-script,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
-  pname = "svt-av1-psy";
-  version = "3.0.2-unstable-2025-04-21";
+  pname = "svt-av1-psyex";
+  version = "3.0.2-B";
 
   src = fetchFromGitHub {
-    owner = "psy-ex";
-    repo = "svt-av1-psy";
-    rev = "3745419c40267d294202b52f48f069aff56cdb78";
-    hash = "sha256-iAw2FiEsBGB4giWqzo1EJZok26WSlq7brq9kJubnkAQ=";
+    owner = "BlueSwordM";
+    repo = "svt-av1-psyex";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-klfrbow8UtpIPwIgt8tK7FP7Jp6In9nxfOZrdi1PsHo=";
   };
 
   cmakeBuildType = "Release";
@@ -40,7 +40,7 @@ stdenv.mkDerivation (finalAttrs: {
     cmake
   ]
   ++ lib.optionals stdenv.hostPlatform.isx86_64 [
-    nasm
+    yasm
   ];
 
   buildInputs = [
@@ -51,17 +51,14 @@ stdenv.mkDerivation (finalAttrs: {
     cpuinfo
   ];
 
-  passthru.updateScript = unstableGitUpdater {
-    branch = "master";
-    tagPrefix = "v";
-  };
+  passthru.updateScript = nix-update-script { extraArgs = [ "--use-github-releases" ]; };
 
   meta = {
-    homepage = "https://github.com/psy-ex/svt-av1-psy";
+    homepage = "https://github.com/BlueSwordM/svt-av1-psyex";
     description = "Scalable Video Technology AV1 Encoder and Decoder";
 
     longDescription = ''
-      SVT-AV1-PSY is the Scalable Video Technology for AV1 (SVT-AV1 Encoder and Decoder)
+      SVT-AV1-PSYEX is the Scalable Video Technology for AV1 (SVT-AV1 Encoder and Decoder)
       with perceptual enhancements for psychovisually optimal AV1 encoding.
       The goal is to create the best encoding implementation for perceptual quality with AV1.
     '';
@@ -71,7 +68,10 @@ stdenv.mkDerivation (finalAttrs: {
       bsd3
     ];
     platforms = lib.platforms.unix;
-    maintainers = with lib.maintainers; [ johnrtitor ];
+    maintainers = with lib.maintainers; [
+      johnrtitor
+      ccicnce113424
+    ];
     mainProgram = "SvtAv1EncApp";
   };
 })

pkgs/by-name/ta/tailscale/package.nix

@@ -24,7 +24,7 @@
 
 buildGoModule (finalAttrs: {
   pname = "tailscale";
-  version = "1.92.5";
+  version = "1.94.0";
 
   outputs = [
     "out"
@@ -35,10 +35,10 @@ buildGoModule (finalAttrs: {
     owner = "tailscale";
     repo = "tailscale";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-S0aD+x8dUPHaNb5MdB41oeID/8eERB3FKKuuqlCqJkU=";
+    hash = "sha256-kwIWUKKXBz0rmiicLEaR4d3T94aA4VqiVrFFV9vk7g0=";
   };
 
-  vendorHash = "sha256-jJSSXMyUqcJoZuqfSlBsKDQezyqS+jDkRglMMjG1K8g=";
+  vendorHash = "sha256-WeMTOkERj4hvdg4yPaZ1gRgKnhRIBXX55kUVbX/k/xM=";
 
   nativeBuildInputs = [
     makeWrapper
@@ -155,6 +155,10 @@ buildGoModule (finalAttrs: {
 
         # Fails because we vendor dependencies
         "TestLicenseHeaders"
+
+        # Uses testing/synctest with gonotify.DirWatcher which spawns goroutines
+        # that block on inotify syscalls incompatible with synctest's bubble mechanism
+        "TestDNSTrampleRecovery"
       ]
       ++ lib.optionals stdenv.hostPlatform.isDarwin [
         # syscall default route interface en0 differs from netstat

pkgs/by-name/we/webdav/package.nix

@@ -6,16 +6,16 @@
 
 buildGoModule rec {
   pname = "webdav";
-  version = "5.10.2";
+  version = "5.10.3";
 
   src = fetchFromGitHub {
     owner = "hacdias";
     repo = "webdav";
     tag = "v${version}";
-    hash = "sha256-Z+r119dYAJO6HRKgRYtwYII4wSdWgNedZOA6n8h4udM=";
+    hash = "sha256-HARY25aOiDKkx2kZA+tckOx+320+tWxamLzRbXQIIBE=";
   };
 
-  vendorHash = "sha256-BR7b59FC/UhQdgO5HcxZK8vEe4WXFCHBiKoRqNr4zNY=";
+  vendorHash = "sha256-yshwX898P9ZXxKkHLguEPV2h9dibIVaFOYWpONHzzY4=";
 
   __darwinAllowLocalNetworking = true;
 

pkgs/by-name/we/wesnoth/package.nix

@@ -39,7 +39,7 @@ in
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "wesnoth${suffix}";
-  version = if enableDevel then "1.19.18" else "1.18.5";
+  version = if enableDevel then "1.19.19" else "1.18.6";
 
   src = fetchFromGitHub {
     owner = "wesnoth";
@@ -47,9 +47,9 @@ stdenv.mkDerivation (finalAttrs: {
     tag = finalAttrs.version;
     hash =
       if enableDevel then
-        "sha256-BZPS60MNg9w0nf/P+vwzp2voQ5Sb1imGJIjrpJm12R0="
+        "sha256-9MExXXRnkjEWzOW7TPtNmwExoW7s0/u8w34n7DIS0YU="
       else
-        "sha256-0VZJAmaCg12x4S07H1kl5s2NGMEo/NSVnzMniREmPJk=";
+        "sha256-y2ceN7rX8j+pNlaajw32ZxwFrUxqAuILADZvum03NhU=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/yo/yosys/package.nix

@@ -20,7 +20,6 @@
   iverilog,
 
   # passthru
-  # plugins
   symlinkJoin,
   yosys,
   makeWrapper,
@@ -31,33 +30,7 @@
   enablePython ? true, # enable python binding
 }:
 
-# NOTE: as of late 2020, yosys has switched to an automation robot that
-# automatically tags their repository Makefile with a new build number every
-# day when changes are committed. please MAKE SURE that the version number in
-# the 'version' field exactly matches the YOSYS_VER field in the Yosys
-# makefile!
-#
-# if a change in yosys isn't yet available under a build number like this (i.e.
-# it was very recently merged, within an hour), wait a few hours for the
-# automation robot to tag the new version, like so:
-#
-#     https://github.com/YosysHQ/yosys/commit/71ca9a825309635511b64b3ec40e5e5e9b6ad49b
-#
-# note that while most nix packages for "unstable versions" use a date-based
-# version scheme, synchronizing the nix package version here with the unstable
-# yosys version number helps users report better bugs upstream, and is
-# ultimately less confusing than using dates.
-
 let
-
-  # Provides a wrapper for creating a yosys with the specified plugins preloaded
-  #
-  # Example:
-  #
-  #     my_yosys = yosys.withPlugins (with yosys.allPlugins; [
-  #        fasm
-  #        bluespec
-  #     ]);
   withPlugins =
     plugins:
     let
@@ -87,30 +60,18 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "yosys";
-  version = "0.60";
+  version = "0.61";
 
   src = fetchFromGitHub {
     owner = "YosysHQ";
     repo = "yosys";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-BVrSq9nWbdu/PIXfwLW7ZkHTz6SrmsqJMSkVa6CsBm8=";
+    hash = "sha256-p7QewbeJtJRRkqYqWW1QzIe71OR5LD+0qsHHgl/cq2w=";
     fetchSubmodules = true;
-    leaveDotGit = true;
-    postFetch = ''
-      # set up git hashes as if we used the tarball
-
-      pushd $out
-      git rev-parse HEAD > .gitcommit
-      cd $out/abc
-      git rev-parse HEAD > .gitcommit
-      popd
-
-      # remove .git now that we are through with it
-      find "$out" -name .git -print0 | xargs -0 rm -rf
-    '';
   };
 
   enableParallelBuilding = true;
+
   nativeBuildInputs = [
     bison
     flex
@@ -134,11 +95,23 @@ stdenv.mkDerivation (finalAttrs: {
     python3.pkgs.boost
   ];
 
-  makeFlags = [ "PREFIX=${placeholder "out"}" ];
+  makeFlags = [
+    "PREFIX=${placeholder "out"}"
+    "YOSYS_VER=${finalAttrs.version}"
+  ];
 
   postPatch = ''
-    substituteInPlace ./Makefile \
-      --replace-fail 'echo UNKNOWN' 'echo ${builtins.substring 0 10 finalAttrs.src.rev}'
+    substituteInPlace Makefile \
+      --replace-fail 'GIT_REV := $(shell GIT_DIR=$(YOSYS_SRC)/.git git rev-parse --short=9 HEAD || echo UNKNOWN)' 'GIT_REV := v${finalAttrs.version}' \
+      --replace-fail 'GIT_DIRTY := $(shell GIT_DIR=$(YOSYS_SRC)/.git git diff --exit-code --quiet 2>/dev/null; if [ $$? -ne 0 ]; then echo "-dirty"; fi)' 'GIT_DIRTY := ""'
+
+    substituteInPlace Makefile \
+      --replace-fail "| check-git-abc" ""
+
+    substituteInPlace Makefile \
+      --replace-fail 'new=$$(cd abc 2>/dev/null && git rev-parse HEAD 2>/dev/null || echo none)' 'new=none'
+
+    sed -i 's/^YOSYS_VER :=.*/YOSYS_VER := ${finalAttrs.version}/' Makefile
 
     patchShebangs tests ./misc/yosys-config.in
   '';
@@ -147,8 +120,8 @@ stdenv.mkDerivation (finalAttrs: {
     chmod -R u+w .
     make config-${if stdenv.cc.isClang or false then "clang" else "gcc"}
 
-    if ! grep -q "YOSYS_VER := $version" Makefile; then
-      echo "ERROR: yosys version in Makefile isn't equivalent to version of the nix package (allegedly ${finalAttrs.version}), failing."
+    if ! grep -q "YOSYS_VER := ${finalAttrs.version}" Makefile; then
+      echo "ERROR: yosys version in Makefile isn't equivalent to version of the nix package, failing."
       exit 1
     fi
   ''
@@ -160,9 +133,6 @@ stdenv.mkDerivation (finalAttrs: {
   '';
 
   preCheck = ''
-    # autotest.sh automatically compiles a utility during startup if it's out of date.
-    # having N check jobs race to do that creates spurious codesigning failures on macOS.
-    # run it once without asking it to do anything so that compilation is done before the jobs start.
     tests/tools/autotest.sh
   '';
 

pkgs/by-name/zi/zizmor/package.nix

@@ -11,16 +11,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "zizmor";
-  version = "1.21.0";
+  version = "1.22.0";
 
   src = fetchFromGitHub {
     owner = "zizmorcore";
     repo = "zizmor";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-cIwQSQcG8h4YtBPfl+meSpTkyNEwLsg3eG2SZs4PMDA=";
+    hash = "sha256-HRwtjke7kDq+mrTLwyWU0aEGxdgdbimcg42J1baDXhs=";
   };
 
-  cargoHash = "sha256-dKgURNjvxqN7xlvdQtsylxNwYenNUgqrsecGyTtGpNI=";
+  cargoHash = "sha256-UuSBd+RppydP0+cG1iNarikbhBtoZZbIUxiwgq3EZaU=";
 
   buildInputs = [
     rust-jemalloc-sys

pkgs/development/libraries/itk/generic.nix

@@ -94,6 +94,18 @@ stdenv.mkDerivation {
     ln -sr ${itkAdaptiveDenoisingSrc} Modules/External/ITKAdaptiveDenoising
     ln -sr ${itkSimpleITKFiltersSrc} Modules/External/ITKSimpleITKFilters
     ln -sr ${rtkSrc} Modules/Remote/RTK
+
+    # fix build with GCC 15
+    substituteInPlace Modules/ThirdParty/GoogleTest/src/itkgoogletest/googletest/src/gtest-death-test.cc \
+      --replace-fail \
+        '#include <utility>' \
+        '#include <utility>
+        #include <cstdint>'
+    substituteInPlace Modules/Core/Common/include/itkFloatingPointExceptions.h \
+      --replace-fail \
+        '#include "itkSingletonMacro.h"' \
+        '#include "itkSingletonMacro.h"
+        #include <cstdint>'
   '';
 
   cmakeFlags = [

pkgs/development/ocaml-modules/dns/client-miou-unix.nix

@@ -0,0 +1,32 @@
+{
+  buildDunePackage,
+  dns,
+  dns-client,
+  domain-name,
+  ipaddr,
+  miou,
+  tls-miou-unix,
+  happy-eyeballs,
+  happy-eyeballs-miou-unix,
+}:
+
+buildDunePackage {
+  pname = "dns-client-miou-unix";
+  inherit (dns) src version;
+
+  propagatedBuildInputs = [
+    dns-client
+    domain-name
+    ipaddr
+    miou
+    tls-miou-unix
+    happy-eyeballs
+    happy-eyeballs-miou-unix
+  ];
+
+  doCheck = true;
+
+  meta = dns-client.meta // {
+    description = "DNS client API for Miou";
+  };
+}

pkgs/development/python-modules/characteristic/default.nix

@@ -1,26 +0,0 @@
-{
-  buildPythonPackage,
-  fetchPypi,
-  pytest,
-}:
-
-buildPythonPackage rec {
-  pname = "characteristic";
-  version = "14.3.0";
-  format = "setuptools";
-  src = fetchPypi {
-    inherit pname version;
-    sha256 = "ded68d4e424115ed44e5c83c2a901a0b6157a959079d7591d92106ffd3ada380";
-  };
-
-  nativeCheckInputs = [ pytest ];
-
-  postPatch = ''
-    substituteInPlace setup.cfg --replace "[pytest]" "[tool:pytest]"
-  '';
-
-  meta = {
-    description = "Python attributes without boilerplate";
-    homepage = "https://characteristic.readthedocs.org";
-  };
-}

pkgs/development/python-modules/pyasyncore/default.nix

@@ -7,14 +7,14 @@
 
 buildPythonPackage rec {
   pname = "pyasyncore";
-  version = "1.0.4";
+  version = "1.0.5";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "simonrob";
     repo = "pyasyncore";
     tag = "v${version}";
-    hash = "sha256-ptqOsbkY7XYZT5sh6vctfxZ7BZPX2eLjo6XwZfcmtgk=";
+    hash = "sha256-gpmsawbTf59EchoKixWw2wcBoOFElPDLg9zylvhA04U=";
   };
 
   nativeBuildInputs = [ setuptools ];

pkgs/development/python-modules/pyexploitdb/default.nix

@@ -9,12 +9,12 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "pyexploitdb";
-  version = "0.3.9";
+  version = "0.3.10";
   pyproject = true;
 
   src = fetchPypi {
     inherit (finalAttrs) pname version;
-    hash = "sha256-ef4+I0xjYLfe4QPgfZNWLQB+0WAA4WUEn1W6uTSGkjU=";
+    hash = "sha256-EZX2eCNc46UuqbBEypjp6NcHOAI6C7SiFu+AZPXcSg8=";
   };
 
   build-system = [ setuptools ];

pkgs/development/python-modules/slowapi/default.nix

@@ -9,7 +9,6 @@
   httpx,
   poetry-core,
   pytestCheckHook,
-  pythonAtLeast,
   redis,
   starlette,
 }:
@@ -43,14 +42,10 @@ buildPythonPackage rec {
   ];
 
   disabledTests = [
-    # AssertionError: Regex pattern 'parameter `request` must be an instance of starlette.requests.Request' does not match 'This portal is not running'.
-    "test_endpoint_request_param_invalid"
-    "test_endpoint_response_param_invalid"
     # AssertionError: assert '1740326049.9886339' == '1740326049'
     "test_headers_no_breach"
     "test_headers_breach"
-  ]
-  ++ lib.optionals (pythonAtLeast "3.10") [ "test_multiple_decorators" ];
+  ];
 
   pythonImportsCheck = [ "slowapi" ];
 

pkgs/development/python-modules/tubes/default.nix

@@ -3,7 +3,6 @@
   buildPythonPackage,
   fetchFromGitHub,
   python,
-  characteristic,
   six,
   twisted,
 }:
@@ -21,7 +20,6 @@ buildPythonPackage {
   };
 
   propagatedBuildInputs = [
-    characteristic
     six
     twisted
   ];

pkgs/development/python-modules/volkswagencarnet/default.nix

@@ -14,14 +14,14 @@
 
 buildPythonPackage rec {
   pname = "volkswagencarnet";
-  version = "5.4.0";
+  version = "5.4.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "robinostlund";
     repo = "volkswagencarnet";
     tag = "v${version}";
-    hash = "sha256-9p01sCxXosaCPTo/QN1LJ4E5SvicqAjqpx7Wl7OsRtE=";
+    hash = "sha256-e7h8Dp/C4Q/0Y6viTeCTlzekr1aI5B0gAX5MZBenMCY=";
   };
 
   postPatch = ''

pkgs/os-specific/linux/corefreq/default.nix

@@ -10,13 +10,13 @@
 
 stdenv.mkDerivation rec {
   pname = "corefreq";
-  version = "2.0.9";
+  version = "2.1.0";
 
   src = fetchFromGitHub {
     owner = "cyring";
     repo = "CoreFreq";
     rev = version;
-    hash = "sha256-SD3/3j8kIpxRA3Z0zxnkKczkBqJUzn40cTbllwIFrgc=";
+    hash = "sha256-tEfZ4vgSH8y4XBP2OMIwZNwAHRJpyq6q8NWtuXm2mRQ=";
   };
 
   nativeBuildInputs = kernel.moduleBuildDependencies;

pkgs/servers/home-assistant/custom-components/volkswagencarnet/package.nix

@@ -10,13 +10,13 @@
 buildHomeAssistantComponent rec {
   owner = "robinostlund";
   domain = "volkswagencarnet";
-  version = "5.4.0";
+  version = "5.4.1";
 
   src = fetchFromGitHub {
     owner = "robinostlund";
     repo = "homeassistant-volkswagencarnet";
     tag = "v${version}";
-    hash = "sha256-uIsOuc+UXhLbPm4/koANQjzPFfRVwt/rMhYw6keVgYI=";
+    hash = "sha256-nlidbT5dILw4rin4uUDQ8OSqUijpQuoePk20UIl5Uvo=";
   };
 
   postPatch = ''

pkgs/top-level/aliases.nix

@@ -704,6 +704,7 @@ mapAliases {
   gfortran12 = throw "gfortran12 has been removed from Nixpkgs, as it is unmaintained and obsolete"; # Added 2025-08-08
   gg = throw "'gg' has been renamed to/replaced by 'go-graft'"; # Converted to throw 2025-10-27
   ggobi = throw "'ggobi' has been removed from Nixpkgs, as it is unmaintained and broken"; # Added 2025-05-18
+  gh-copilot = throw "'gh-copilot' has been removed since it has been deprecated and archived upstream. Consider using 'github-copilot-cli' instead"; # Added 2026-01-20
   gimp3 = gimp; # Added 2025-10-03
   gimp3-with-plugins = gimp-with-plugins; # Added 2025-10-03
   gimp3Plugins = gimpPlugins; # Added 2025-10-03
@@ -1626,6 +1627,7 @@ mapAliases {
   sumalibs = throw "'sumalibs' has been removed as it was archived upstream and broken with GCC 14"; # Added 2025-06-14
   sumatra = throw "'sumatra' has been removed as it was archived upstream and broken with GCC 14"; # Added 2025-06-14
   sumneko-lua-language-server = throw "'sumneko-lua-language-server' has been renamed to/replaced by 'lua-language-server'"; # Converted to throw 2025-10-27
+  svt-av1-psy = warnAlias "'svt-av1-psy' has been replaced by 'svt-av1-psyex'" svt-av1-psyex; # Added 2026-01-10
   swig4 = throw "'swig4' has been renamed to/replaced by 'swig'"; # Converted to throw 2025-10-27
   swiProlog = throw "'swiProlog' has been renamed to/replaced by 'swi-prolog'"; # Converted to throw 2025-10-27
   swiPrologWithGui = throw "'swiPrologWithGui' has been renamed to/replaced by 'swi-prolog-gui'"; # Converted to throw 2025-10-27

pkgs/top-level/ocaml-packages.nix

@@ -413,6 +413,8 @@ let
 
         dns-client-lwt = callPackage ../development/ocaml-modules/dns/client-lwt.nix { };
 
+        dns-client-miou-unix = callPackage ../development/ocaml-modules/dns/client-miou-unix.nix { };
+
         dns-client-mirage = callPackage ../development/ocaml-modules/dns/client-mirage.nix { };
 
         dns-mirage = callPackage ../development/ocaml-modules/dns/mirage.nix { };

pkgs/top-level/python-aliases.nix

@@ -98,6 +98,7 @@ mapAliases {
   can = throw "'can' has been renamed to/replaced by 'python-can'"; # Converted to throw 2025-10-29
   casbin = pycasbin; # added 2025-06-12
   cchardet = throw "'cchardet' has been renamed to/replaced by 'faust-cchardet'"; # Converted to throw 2025-10-29
+  characteristic = throw "'characteristic' has been removed because it is no longer maintained upstream"; # Added 2026-01-14
   cirq-rigetti = throw "cirq-rigetti was removed because it is no longer provided by upstream"; # added 2025-09-13
   class-registry = throw "'class-registry' has been renamed to/replaced by 'phx-class-registry'"; # Converted to throw 2025-10-29
   ColanderAlchemy = throw "'ColanderAlchemy' has been renamed to/replaced by 'colanderalchemy'"; # Converted to throw 2025-10-29

pkgs/top-level/python-packages.nix

@@ -2625,8 +2625,6 @@ self: super: with self; {
 
   character-encoding-utils = callPackage ../development/python-modules/character-encoding-utils { };
 
-  characteristic = callPackage ../development/python-modules/characteristic { };
-
   chardet = callPackage ../development/python-modules/chardet { };
 
   charset-normalizer = callPackage ../development/python-modules/charset-normalizer { };