Merge master into staging-nixos

nixos/modules/misc/nixpkgs.nix

@@ -119,7 +119,7 @@ in
     pkgs = lib.mkOption {
       defaultText = lib.literalExpression ''
         import "''${nixos}/.." {
-          inherit (cfg) config overlays localSystem crossSystem;
+          inherit (config.nixpkgs) config overlays localSystem crossSystem;
         }
       '';
       type = pkgsType;

nixos/modules/security/systemd-confinement.nix

@@ -128,11 +128,9 @@ in
             lib.mkIf config.confinement.enable {
               serviceConfig = {
                 ReadOnlyPaths = [ "+/" ];
-                RuntimeDirectory = [ "confinement/${mkPathSafeName name}" ];
-                RootDirectory = "/run/confinement/${mkPathSafeName name}";
-                InaccessiblePaths = [
-                  "-+/run/confinement/${mkPathSafeName name}"
-                ];
+                RuntimeDirectory = [ "confinement/%n" ];
+                RootDirectory = "/run/confinement/%n";
+                InaccessiblePaths = [ "-+/run/confinement/%n" ];
                 PrivateMounts = lib.mkDefault true;
 
                 # https://github.com/NixOS/nixpkgs/issues/14645 is a future attempt

nixos/modules/services/networking/wpa_supplicant.nix

@@ -183,8 +183,10 @@ let
         }
 
         # finally start daemon
+        # shellcheck disable=SC2086
         exec wpa_supplicant $args
       '';
+      enableStrictShellChecks = true;
     };
 
   systemctl = "/run/current-system/systemd/bin/systemctl";

nixos/modules/services/web-apps/mediawiki.nix

@@ -466,7 +466,7 @@ in
           defaultText = literalExpression "true";
           description = ''
             Create the database and database user locally.
-            This currently only applies if database type "mysql" is selected.
+            This currently only applies if database type "mysql" or "postgres" is selected.
           '';
         };
       };

nixos/modules/services/web-apps/nextcloud.nix

@@ -264,7 +264,7 @@ let
           $decoded = json_decode(nix_read_secret($credential_name), true);
 
           if (json_last_error() !== JSON_ERROR_NONE) {
-            error_log(sprintf("Cannot decode %s, because: %s", $file, json_last_error_msg()));
+            error_log(sprintf("Cannot decode %s, because: %s", $credential_name, json_last_error_msg()));
             exit(1);
           }
 

nixos/modules/tasks/network-interfaces.nix

@@ -1926,7 +1926,7 @@ in
               # Udev attributes for systemd to name the device and to create a .device target.
               systemdAttrs =
                 n:
-                ''NAME:="${n}", ENV{INTERFACE}="${n}", ENV{SYSTEMD_ALIAS}="/sys/subsystem/net/devices/${n}", TAG+="systemd"'';
+                ''NAME:="${n}", ENV{ID_NET_NAME}="${n}", ENV{SYSTEMD_ALIAS}="/sys/subsystem/net/devices/${n}", TAG+="systemd"'';
             in
             flip (concatMapStringsSep "\n") (attrNames wlanDeviceInterfaces) (
               device:

nixos/tests/angrr.nix

@@ -32,38 +32,38 @@
 
     # Creates some auto gc roots
     # Use /run/current-system so that we do not need to build anything new
-    machine.succeed("nix build /run/current-system --out-link /tmp/root-auto-gc-root-1")
-    machine.succeed("nix build /run/current-system --out-link /tmp/root-auto-gc-root-2")
-    machine.succeed("su normal --command 'nix build /run/current-system --out-link /tmp/user-auto-gc-root-1'")
-    machine.succeed("su normal --command 'nix build /run/current-system --out-link /tmp/user-auto-gc-root-2'")
+    machine.succeed("nix build /run/current-system --out-link /tmp/result-root-auto-gc-root-1")
+    machine.succeed("nix build /run/current-system --out-link /tmp/result-root-auto-gc-root-2")
+    machine.succeed("su normal --command 'nix build /run/current-system --out-link /tmp/result-user-auto-gc-root-1'")
+    machine.succeed("su normal --command 'nix build /run/current-system --out-link /tmp/result-user-auto-gc-root-2'")
 
     machine.systemctl("start nix-gc.service")
     # Not auto gc root will be removed
-    machine.succeed("readlink /tmp/root-auto-gc-root-1")
-    machine.succeed("readlink /tmp/root-auto-gc-root-2")
-    machine.succeed("readlink /tmp/user-auto-gc-root-1")
-    machine.succeed("readlink /tmp/user-auto-gc-root-2")
+    machine.succeed("readlink /tmp/result-root-auto-gc-root-1")
+    machine.succeed("readlink /tmp/result-root-auto-gc-root-2")
+    machine.succeed("readlink /tmp/result-user-auto-gc-root-1")
+    machine.succeed("readlink /tmp/result-user-auto-gc-root-2")
 
     # Change time to 8 days after (greater than 7d)
     machine.succeed("date -s '8 days'")
 
     # Touch GC roots `-2`
-    machine.succeed("touch /tmp/root-auto-gc-root-2 --no-dereference")
-    machine.succeed("touch /tmp/user-auto-gc-root-2 --no-dereference")
+    machine.succeed("touch /tmp/result-root-auto-gc-root-2 --no-dereference")
+    machine.succeed("touch /tmp/result-user-auto-gc-root-2 --no-dereference")
 
     machine.systemctl("start nix-gc.service")
     # Only GC roots `-1` are removed
-    machine.succeed("test ! -f /tmp/root-auto-gc-root-1")
-    machine.succeed("readlink  /tmp/root-auto-gc-root-2")
-    machine.succeed("test ! -f /tmp/user-auto-gc-root-1")
-    machine.succeed("readlink  /tmp/user-auto-gc-root-2")
+    machine.succeed("test ! -e /tmp/result-root-auto-gc-root-1")
+    machine.succeed("readlink  /tmp/result-root-auto-gc-root-2")
+    machine.succeed("test ! -e /tmp/result-user-auto-gc-root-1")
+    machine.succeed("readlink  /tmp/result-user-auto-gc-root-2")
 
     # Change time again
     machine.succeed("date -s '8 days'")
     machine.systemctl("start nix-gc.service")
     # All auto GC roots are removed
-    machine.succeed("test ! -f /tmp/root-auto-gc-root-2")
-    machine.succeed("test ! -f /tmp/user-auto-gc-root-2")
+    machine.succeed("test ! -e /tmp/result-root-auto-gc-root-2")
+    machine.succeed("test ! -e /tmp/result-user-auto-gc-root-2")
 
     # Direnv integration test
     machine.succeed("mkdir /tmp/test-direnv")
@@ -74,7 +74,7 @@
     # The root will be removed if we does not use the direnv recently
     machine.succeed("date -s '8 days'")
     machine.systemctl("start nix-gc.service")
-    machine.succeed("test ! -f /tmp/test-direnv/.direnv/gc-root")
+    machine.succeed("test ! -e /tmp/test-direnv/.direnv/gc-root")
 
     # Recreate the root
     machine.succeed("nix build /run/current-system --out-link /tmp/test-direnv/.direnv/gc-root")

nixos/tests/systemd-confinement/concurrent-runner.py

@@ -0,0 +1,131 @@
+import click
+import socket
+import sys
+
+from hypothesis import given, settings, strategies as st
+from subprocess import run
+from time import sleep
+
+
+@st.composite
+def client_actions(draw, size: int = 10):
+    """
+    Generate a string describing a set of actions to perform.
+
+    This is specifically "stringly-typed" so that when looking at the output of
+    a failed test run, it's easy to visually identify what's wrong.
+
+    The string may consist of the following characters:
+
+      ' ' - Sleep for one tick (0.1s)
+      '[' - Start the client
+      ']' - Stop the client
+      'R' - Run a subprocess in the client
+
+    So for example the string "  [  R ]  " would mean:
+
+       * Sleep for two ticks ("  ")
+       * Start the client ("[")
+       * Sleep for two ticks ("  ")
+       * Run the subprocess ("R")
+       * Sleep for one tick (" ")
+       * Stop the client ("]")
+       * Sleep for two ticks ("  ")
+
+    Exactly the same encoding as above is used for the network protocol, so for
+    debugging issues, all you need to know is the representation above.
+    """
+    assert size > 1
+    start = None
+    stop = None
+    runs = set()
+
+    if draw(st.booleans()):
+        start = draw(st.integers(min_value=0, max_value=size - 2))
+        stop = draw(st.integers(min_value=start + 1, max_value=size - 1))
+        if start + 1 < stop:
+            runs = draw(st.sets(
+                st.integers(min_value=start + 1, max_value=stop - 1),
+                max_size=stop - start,
+            ))
+
+    out = ''
+    for index in range(size):
+        if start is not None and index == start:
+            out += '['
+        elif stop is not None and index == stop:
+            out += ']'
+        elif index in runs:
+            out += 'R'
+        else:
+            out += ' '
+    return out
+
+
+@click.group()
+def cli() -> None:
+    pass
+
+
+@cli.command('driver')
+@settings(deadline=None, max_examples=20)
+@given(st.lists(client_actions(), max_size=5))
+def test_driver(client_actions: list[str]) -> None:
+    clients: list[None | socket.socket] = [None] * len(client_actions)
+    for index in range(max(map(len, client_actions), default=0)):
+        for n, actions in enumerate(client_actions):
+            client = clients[n]
+            try:
+                action = actions[index]
+            except IndexError:
+                continue
+            match action:
+                case '[':
+                    client = socket.socket(socket.AF_INET6)
+                    client.settimeout(60)
+                    client.connect(('::1', 12345))
+                    client.send(b'[')
+                    clients[n] = client
+                case ']':
+                    assert client is not None
+                    client.send(b']')
+                    # At this point if we get ']' back from the client, we know
+                    # that everything went smoothly up to this point because
+                    # otherwise the client would have just thrown an exception
+                    # and the connection would be closed.
+                    assert client.recv(1) == b']'
+                    assert not client.recv(1)
+                    client.close()
+                    clients[n] = None
+                case 'R':
+                    assert client is not None
+                    client.send(b'R')
+                case ' ':
+                    if client is not None:
+                        client.send(b' ')
+        sleep(0.1)
+    assert all(c is None for c in clients), \
+           f'clients still running: {clients!r}'
+
+
+@cli.command('client')
+@click.argument('executable')
+def test_client(executable: str) -> None:
+    if not (action := sys.stdin.read(1)):
+        raise SystemExit(1)
+    assert action == '[', f'{action!r} != "["'
+    while action := sys.stdin.read(1):
+        match action:
+            case 'R':
+                run([executable], check=True, stdout=sys.stderr)
+            case ']':
+                sys.stdout.write(']')
+                return
+            case ' ':
+                sleep(0.1)
+            case '':
+                raise SystemExit(1)
+
+
+if __name__ == '__main__':
+    cli()

nixos/tests/systemd-confinement/default.nix

@@ -2,7 +2,12 @@ import ../make-test-python.nix {
   name = "systemd-confinement";
 
   nodes.machine =
-    { pkgs, lib, ... }:
+    {
+      pkgs,
+      lib,
+      utils,
+      ...
+    }:
     let
       testLib = pkgs.python3Packages.buildPythonPackage {
         name = "confinement-testlib";
@@ -215,122 +220,166 @@ import ../make-test-python.nix {
             }
           );
 
+      concurrentRunner = pkgs.writers.writePython3 "concurrent-runner" {
+        libraries = [
+          pkgs.python3Packages.click
+          pkgs.python3Packages.hypothesis
+        ];
+      } ./concurrent-runner.py;
+
+      concurrentTest = {
+        systemd.services.concurrent-driver = {
+          description = "Driver for orchestrating concurrent processes";
+          requiredBy = [ "multi-user.target" ];
+          after = [
+            "network.target"
+            "concurrent-client.socket"
+          ];
+          serviceConfig.Type = "oneshot";
+          serviceConfig.ExecStart = utils.escapeSystemdExecArgs [
+            concurrentRunner
+            "driver"
+          ];
+        };
+
+        systemd.sockets.concurrent-client = {
+          description = "Socket for concurrent processes";
+          requiredBy = [ "sockets.target" ];
+          socketConfig.ListenStream = 12345;
+          socketConfig.Accept = true;
+        };
+
+        systemd.services."concurrent-client@" = {
+          description = "Process %I running concurrently with others";
+          confinement.enable = true;
+          serviceConfig.StandardInput = "socket";
+          serviceConfig.StandardError = "journal";
+          serviceConfig.ExecStart = utils.escapeSystemdExecArgs [
+            concurrentRunner
+            "client"
+            "${pkgs.fortune}/bin/fortune"
+          ];
+        };
+      };
+
     in
     {
-      imports = lib.imap1 mkTestStep (
-        parametrisedTests
-        ++ [
-          {
-            description = "existence of bind-mounted /etc";
-            config.serviceConfig.BindReadOnlyPaths = [ "/etc" ];
-            testScript = ''
-              assert Path('/etc/passwd').read_text()
-            '';
-          }
-          (
-            let
-              symlink = pkgs.runCommand "symlink" {
-                target = pkgs.writeText "symlink-target" "got me";
-              } "ln -s \"$target\" \"$out\"";
-            in
+      imports =
+        lib.imap1 mkTestStep (
+          parametrisedTests
+          ++ [
             {
-              description = "check if symlinks are properly bind-mounted";
-              config.confinement.packages = lib.singleton symlink;
+              description = "existence of bind-mounted /etc";
+              config.serviceConfig.BindReadOnlyPaths = [ "/etc" ];
               testScript = ''
-                assert Path('${symlink}').read_text() == 'got me'
+                assert Path('/etc/passwd').read_text()
               '';
             }
-          )
-          {
-            description = "check if StateDirectory works";
-            config.serviceConfig.User = "chroot-testuser";
-            config.serviceConfig.Group = "chroot-testgroup";
-            config.serviceConfig.StateDirectory = "testme";
+            (
+              let
+                symlink = pkgs.runCommand "symlink" {
+                  target = pkgs.writeText "symlink-target" "got me";
+                } "ln -s \"$target\" \"$out\"";
+              in
+              {
+                description = "check if symlinks are properly bind-mounted";
+                config.confinement.packages = lib.singleton symlink;
+                testScript = ''
+                  assert Path('${symlink}').read_text() == 'got me'
+                '';
+              }
+            )
+            {
+              description = "check if StateDirectory works";
+              config.serviceConfig.User = "chroot-testuser";
+              config.serviceConfig.Group = "chroot-testgroup";
+              config.serviceConfig.StateDirectory = "testme";
 
-            # We restart on purpose here since we want to check whether the state
-            # directory actually persists.
-            config.serviceConfig.Restart = "on-failure";
-            config.serviceConfig.RestartMode = "direct";
+              # We restart on purpose here since we want to check whether the state
+              # directory actually persists.
+              config.serviceConfig.Restart = "on-failure";
+              config.serviceConfig.RestartMode = "direct";
 
-            testScript = ''
-              assert not Path('/tmp/canary').exists()
-              Path('/tmp/canary').touch()
+              testScript = ''
+                assert not Path('/tmp/canary').exists()
+                Path('/tmp/canary').touch()
 
-              if (foo := Path('/var/lib/testme/foo')).exists():
-                assert Path('/var/lib/testme/foo').read_text() == 'works'
-              else:
-                Path('/var/lib/testme/foo').write_text('works')
-                print('<4>Exiting with failure to check persistence on restart.')
-                raise SystemExit(1)
-            '';
-          }
-          {
-            description = "check if /bin/sh works";
-            testScript = ''
-              assert Path('/bin/sh').exists()
+                if (foo := Path('/var/lib/testme/foo')).exists():
+                  assert Path('/var/lib/testme/foo').read_text() == 'works'
+                else:
+                  Path('/var/lib/testme/foo').write_text('works')
+                  print('<4>Exiting with failure to check persistence on restart.')
+                  raise SystemExit(1)
+              '';
+            }
+            {
+              description = "check if /bin/sh works";
+              testScript = ''
+                assert Path('/bin/sh').exists()
 
-              result = run(
-                ['/bin/sh', '-c', 'echo -n bar'],
-                capture_output=True,
-                check=True,
-              )
-              assert result.stdout == b'bar'
-            '';
-          }
-          {
-            description = "check if suppressing /bin/sh works";
-            config.confinement.binSh = null;
-            testScript = ''
-              assert not Path('/bin/sh').exists()
-              with pytest.raises(FileNotFoundError):
-                run(['/bin/sh', '-c', 'echo foo'])
-            '';
-          }
-          {
-            description = "check if we can set /bin/sh to something different";
-            config.confinement.binSh = "${pkgs.hello}/bin/hello";
-            testScript = ''
-              assert Path('/bin/sh').exists()
-              result = run(
-                ['/bin/sh', '-g', 'foo'],
-                capture_output=True,
-                check=True,
-              )
-              assert result.stdout == b'foo\n'
-            '';
-          }
-          {
-            description = "check if only Exec* dependencies are included";
-            config.environment.FOOBAR = pkgs.writeText "foobar" "eek";
-            testScript = ''
-              with pytest.raises(FileNotFoundError):
-                Path(os.environ['FOOBAR']).read_text()
-            '';
-          }
-          {
-            description = "check if fullUnit includes all dependencies";
-            config.environment.FOOBAR = pkgs.writeText "foobar" "eek";
-            config.confinement.fullUnit = true;
-            testScript = ''
-              assert Path(os.environ['FOOBAR']).read_text() == 'eek'
-            '';
-          }
-          {
-            description = "check if shipped unit file still works";
-            config.confinement.mode = "chroot-only";
-            rawUnit = ''
-              [Service]
-              SystemCallFilter=~kill
-              SystemCallErrorNumber=ELOOP
-            '';
-            testScript = ''
-              with pytest.raises(OSError) as excinfo:
-                os.kill(os.getpid(), signal.SIGKILL)
-              assert excinfo.value.errno == errno.ELOOP
-            '';
-          }
-        ]
-      );
+                result = run(
+                  ['/bin/sh', '-c', 'echo -n bar'],
+                  capture_output=True,
+                  check=True,
+                )
+                assert result.stdout == b'bar'
+              '';
+            }
+            {
+              description = "check if suppressing /bin/sh works";
+              config.confinement.binSh = null;
+              testScript = ''
+                assert not Path('/bin/sh').exists()
+                with pytest.raises(FileNotFoundError):
+                  run(['/bin/sh', '-c', 'echo foo'])
+              '';
+            }
+            {
+              description = "check if we can set /bin/sh to something different";
+              config.confinement.binSh = "${pkgs.hello}/bin/hello";
+              testScript = ''
+                assert Path('/bin/sh').exists()
+                result = run(
+                  ['/bin/sh', '-g', 'foo'],
+                  capture_output=True,
+                  check=True,
+                )
+                assert result.stdout == b'foo\n'
+              '';
+            }
+            {
+              description = "check if only Exec* dependencies are included";
+              config.environment.FOOBAR = pkgs.writeText "foobar" "eek";
+              testScript = ''
+                with pytest.raises(FileNotFoundError):
+                  Path(os.environ['FOOBAR']).read_text()
+              '';
+            }
+            {
+              description = "check if fullUnit includes all dependencies";
+              config.environment.FOOBAR = pkgs.writeText "foobar" "eek";
+              config.confinement.fullUnit = true;
+              testScript = ''
+                assert Path(os.environ['FOOBAR']).read_text() == 'eek'
+              '';
+            }
+            {
+              description = "check if shipped unit file still works";
+              config.confinement.mode = "chroot-only";
+              rawUnit = ''
+                [Service]
+                SystemCallFilter=~kill
+                SystemCallErrorNumber=ELOOP
+              '';
+              testScript = ''
+                with pytest.raises(OSError) as excinfo:
+                  os.kill(os.getpid(), signal.SIGKILL)
+                assert excinfo.value.errno == errno.ELOOP
+              '';
+            }
+          ]
+        )
+        ++ [ concurrentTest ];
 
       config.users.groups.chroot-testgroup = { };
       config.users.users.chroot-testuser = {

pkgs/applications/editors/vscode/extensions/visualjj.visualjj/default.nix

@@ -11,26 +11,26 @@ vscode-utils.buildVscodeMarketplaceExtension {
       sources = {
         "x86_64-linux" = {
           arch = "linux-x64";
-          hash = "sha256-P5LEN+wTfJ9p0vG4z/FAB4u2hFLcqy7Xc18qC4W5x8U=";
+          hash = "sha256-NXlV80CV6EyALfJHT3x3pfjGiJfYxPT2JXTADMfB7yA=";
         };
         "x86_64-darwin" = {
           arch = "darwin-x64";
-          hash = "sha256-cNiXCrOw3ET/BTfMxYfr01F+5lTXbKH3vKpRQQdnRLc=";
+          hash = "sha256-NWak0NXK5SxGm7JLpqR7zapEzxG+CDFdTcZDyCY6ifk=";
         };
         "aarch64-linux" = {
           arch = "linux-arm64";
-          hash = "sha256-zCGwaw5Dgd0o5t+h0sjPZ1nDp/JqC2Wx4QfQYv3jg4w=";
+          hash = "sha256-9lJfrqVFTROMqLaO9SUx9msACjHu0lTSKLRPPA8r8AM=";
         };
         "aarch64-darwin" = {
           arch = "darwin-arm64";
-          hash = "sha256-M5BQdlEe5eN91Mz8trMFbFNeRoMIpGSOHpBSGQQVJc0=";
+          hash = "sha256-iz3+iEXCYzItNTrAlzZAuM80U+TNlz/n1nljRvOfX3k=";
         };
       };
     in
     {
       name = "visualjj";
       publisher = "visualjj";
-      version = "0.20.0";
+      version = "0.20.2";
     }
     // sources.${stdenvNoCC.hostPlatform.system}
       or (throw "Unsupported system ${stdenvNoCC.hostPlatform.system}");

pkgs/by-name/ai/airwindows-lv2/package.nix

@@ -8,14 +8,14 @@
   lv2,
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "airwindows-lv2";
-  version = "28.0";
+  version = "34.0";
   src = fetchFromSourcehut {
     owner = "~hannes";
     repo = "airwindows-lv2";
-    rev = "v${version}";
-    sha256 = "sha256-1GWkdNCn98ttsF2rPLZE0+GJdatgkLewFQyx9Frr2sM=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-BLoDQ02DbTTaJ7UPh1eqSrgWe9t9PbDdgylBOI0ENGQ=";
   };
 
   nativeBuildInputs = [
@@ -23,13 +23,14 @@ stdenv.mkDerivation rec {
     ninja
     pkg-config
   ];
+
   buildInputs = [ lv2 ];
 
-  meta = with lib; {
+  meta = {
     description = "Airwindows plugins (ported to LV2)";
     homepage = "https://sr.ht/~hannes/airwindows-lv2";
-    license = licenses.mit;
-    maintainers = [ maintainers.magnetophon ];
-    platforms = platforms.unix;
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ magnetophon ];
+    platforms = lib.platforms.unix;
   };
-}
+})

pkgs/by-name/al/albyhub/package.nix

@@ -23,16 +23,16 @@ in
 
 buildGoModule (finalAttrs: {
   pname = "albyhub";
-  version = "1.20.0";
+  version = "1.21.0";
 
   src = fetchFromGitHub {
     owner = "getAlby";
     repo = "hub";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-MbEKRdPyLlZE23UbwwWO1tSFhXG0Hs/m0NaHo9d4pD8=";
+    hash = "sha256-9NtXnEOHgzYM3QUwFKBJ90ZGghgU2/i+hATim4N/JSs=";
   };
 
-  vendorHash = "sha256-oTyMR/Nc2CngKB2f0tAqrms6E1tsqymBr1x4OhNyK/Q=";
+  vendorHash = "sha256-V3uWofAchbLgIadwH4IGyv2lr0cLSz2QCQ6ffhPP9n0=";
   proxyVendor = true; # needed for secp256k1-zkp CGO bindings
 
   nativeBuildInputs = [
@@ -49,7 +49,7 @@ buildGoModule (finalAttrs: {
 
   frontendYarnOfflineCache = fetchYarnDeps {
     yarnLock = finalAttrs.src + "/frontend/yarn.lock";
-    hash = "sha256-fCzrNdiZTOY/fnakwheDNny9ip1Mg/gGX7+Z2N4w6lw=";
+    hash = "sha256-ikGH45JKheivNKwF7juC6rmwU51S3qiicDdYLzjgFJE=";
   };
 
   preBuild = ''

pkgs/by-name/an/angrr/package.nix

@@ -11,26 +11,32 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "angrr";
-  version = "0.1.3";
+  version = "0.1.5";
 
   src = fetchFromGitHub {
     owner = "linyinfeng";
     repo = "angrr";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-pBVbzrTy/IWIo6WlhM1qgowfxSU31awyHcRDHNArBMo=";
+    hash = "sha256-PT3oCNPRvEroyVNiICeO0hSHDzKUC6KcP9HnIw1kMQE=";
   };
 
-  cargoHash = "sha256-DoQIJCs36ZmTxdsDCzquKAeOSIUBbo2V+DTx68FZiu4=";
+  cargoHash = "sha256-lDOH4Ceap69fX6VWbgQoQfmYWZI+jPE0LJiXmqrTRn8=";
+
+  buildAndTestSubdir = "angrr";
 
   nativeBuildInputs = [ installShellFiles ];
+  postBuild = ''
+    mkdir --parents build/{man-pages,shell-completions}
+    cargo xtask man-pages --out build/man-pages
+    cargo xtask shell-completions --out build/shell-completions
+  '';
   postInstall = ''
     install -m400 -D ./direnv/angrr.sh $out/share/direnv/lib/angrr.sh
-  ''
-  + lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
+    installManPage build/man-pages/*
     installShellCompletion --cmd angrr \
-      --bash <($out/bin/angrr completion bash) \
-      --fish <($out/bin/angrr completion fish) \
-      --zsh  <($out/bin/angrr completion zsh)
+      --bash build/shell-completions/angrr.bash \
+      --fish build/shell-completions/angrr.fish \
+      --zsh  build/shell-completions/_angrr
   '';
 
   passthru = {
@@ -44,7 +50,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
   };
 
   meta = {
-    description = "Tool for auto Nix GC roots retention";
+    description = "Temporary GC Roots Cleaner";
     homepage = "https://github.com/linyinfeng/angrr";
     license = [ lib.licenses.mit ];
     maintainers = with lib.maintainers; [ yinfeng ];

pkgs/by-name/bo/boulder/package.nix

@@ -4,17 +4,18 @@
   buildGoModule,
   testers,
   boulder,
+  minica,
   nix-update-script,
 }:
 
 buildGoModule rec {
   pname = "boulder";
-  version = "2025-04-17";
+  version = "0.20251118.0";
 
   src = fetchFromGitHub {
     owner = "letsencrypt";
     repo = "boulder";
-    tag = "release-${version}";
+    tag = "v${version}";
     leaveDotGit = true;
     postFetch = ''
       pushd $out
@@ -22,11 +23,16 @@ buildGoModule rec {
       find $out -name .git -print0 | xargs -0 rm -rf
       popd
     '';
-    hash = "sha256-FXk+JZJ1azpgN6IQ9aYmpUEO1CGs9/3sog1NjrfB4d8=";
+    hash = "sha256-JVkIu8Fh5F8WQXa45I0hnSedAaIQIOFidtWVpVHbAWA=";
   };
 
   vendorHash = null;
 
+  postPatch = ''
+    # We already built the application with custom settings. This fails, so we have to disable it.
+    substituteInPlace test/certs/generate.sh --replace-fail 'make build' ""
+  '';
+
   subPackages = [ "cmd/boulder" ];
 
   ldflags = [
@@ -40,9 +46,14 @@ buildGoModule rec {
     ldflags+=" -X \"github.com/letsencrypt/boulder/core.BuildTime=$(date -u -d @0)\""
   '';
 
+  nativeCheckInputs = [ minica ];
+
   preCheck = ''
     # Test all targets.
     unset subPackages
+    # Generate integration test certificates, but skip webpki certificates that are hard to make without errors and are currently unneeded.
+    mkdir test/certs/webpki
+    bash test/certs/generate.sh
   '';
 
   # Tests that fail or require additional services.
@@ -58,6 +69,7 @@ buildGoModule rec {
     "TestAddPrecertificateIncomplete"
     "TestAddPrecertificateKeyHash"
     "TestAddPrecertificateNoOCSP"
+    "TestAddRateLimitOverride"
     "TestAddRegistration"
     "TestAddReplacementOrder"
     "TestAddSerial"
@@ -110,6 +122,7 @@ buildGoModule rec {
     "TestEnforceJWSAuthType"
     "TestExactPublicSuffixCertLimit"
     "TestExtractJWK"
+    "TestExtractRequestTarget"
     "TestFQDNSetExists"
     "TestFQDNSetTimestampsForWindow"
     "TestFQDNSets"
@@ -249,6 +262,8 @@ buildGoModule rec {
     "TestRecheckCAAFail"
     "TestRecheckCAAInternalServerError"
     "TestRecheckCAASuccess"
+    "TestRecheckInvalidIdentifierType"
+    "TestRecheckSkipIPAddress"
     "TestRedisSource_BatchSetAndGet"
     "TestRedisSource_Ping"
     "TestRegistrationsPerIPOverrideUsage"

pkgs/by-name/ca/cargo-benchcmp/package.nix

@@ -4,16 +4,17 @@
   fetchFromGitHub,
   replaceVars,
   stdenv,
+  nix-update-script,
 }:
 
-rustPlatform.buildRustPackage rec {
+rustPlatform.buildRustPackage (finalAttrs: {
   pname = "cargo-benchcmp";
   version = "0.4.5";
 
   src = fetchFromGitHub {
     owner = "BurntSushi";
     repo = "cargo-benchcmp";
-    tag = version;
+    tag = finalAttrs.version;
     hash = "sha256-J8KFI0V/mOhUlYtVnFAQgPIpXL9/dLhOFxSly4bR00I=";
   };
 
@@ -31,14 +32,16 @@ rustPlatform.buildRustPackage rec {
     "--skip=different_input_colored"
   ];
 
-  meta = with lib; {
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
     description = "Small utility to compare Rust micro-benchmarks";
     mainProgram = "cargo-benchcmp";
     homepage = "https://github.com/BurntSushi/cargo-benchcmp";
-    license = with licenses; [
+    license = with lib.licenses; [
       mit
       unlicense
     ];
-    maintainers = [ ];
+    maintainers = [ lib.maintainers.progrm_jarvis ];
   };
-}
+})

pkgs/by-name/ca/cargo-component/package.nix

@@ -4,16 +4,18 @@
   fetchFromGitHub,
   pkg-config,
   openssl,
+  versionCheckHook,
+  nix-update-script,
 }:
 
-rustPlatform.buildRustPackage rec {
+rustPlatform.buildRustPackage (finalAttrs: {
   pname = "cargo-component";
   version = "0.21.1";
 
   src = fetchFromGitHub {
     owner = "bytecodealliance";
     repo = "cargo-component";
-    rev = "v${version}";
+    tag = "v${finalAttrs.version}";
     hash = "sha256-Tlx14q/2k/0jZZ1nECX7zF/xNTeMCZg/fN+fhRM4uhc=";
   };
 
@@ -30,12 +32,18 @@ rustPlatform.buildRustPackage rec {
   # requires the wasm32-wasi target
   doCheck = false;
 
-  meta = with lib; {
+  doInstallCheck = true;
+  nativeInstallCheckInputs = [ versionCheckHook ];
+  versionCheckProgramArg = "--version";
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
     description = "Cargo subcommand for creating WebAssembly components based on the component model proposal";
     homepage = "https://github.com/bytecodealliance/cargo-component";
-    changelog = "https://github.com/bytecodealliance/cargo-component/releases/tag/${src.rev}";
-    license = licenses.asl20;
-    maintainers = [ ];
+    changelog = "https://github.com/bytecodealliance/cargo-component/releases/tag/v${finalAttrs.version}";
+    license = lib.licenses.asl20;
+    maintainers = [ lib.maintainers.progrm_jarvis ];
     mainProgram = "cargo-component";
   };
-}
+})

pkgs/by-name/ca/cargo-cranky/package.nix

@@ -2,30 +2,33 @@
   lib,
   rustPlatform,
   fetchFromGitHub,
+  nix-update-script,
 }:
 
-rustPlatform.buildRustPackage rec {
+rustPlatform.buildRustPackage (finalAttrs: {
   pname = "cargo-cranky";
   version = "0.3.0";
 
   src = fetchFromGitHub {
     owner = "ericseppanen";
     repo = "cargo-cranky";
-    rev = "v${version}";
+    tag = "v${finalAttrs.version}";
     hash = "sha256-3ARl3z+2nz05UaKf8ChN6mvPY2qMjUNxGnGJ1P0xkas=";
   };
 
   cargoHash = "sha256-m9n2YyrMpuz/X/kvHgn+g4w9/Pg+n6VnnfwjaOnyPvY=";
 
-  meta = with lib; {
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
     description = "Easy to configure wrapper for Rust's clippy";
     mainProgram = "cargo-cranky";
     homepage = "https://github.com/ericseppanen/cargo-cranky";
-    changelog = "https://github.com/ericseppanen/cargo-cranky/releases/tag/${src.rev}";
-    license = with licenses; [
+    changelog = "https://github.com/ericseppanen/cargo-cranky/releases/tag/v${finalAttrs.version}";
+    license = with lib.licenses; [
       asl20
       mit
     ];
-    maintainers = [ ];
+    maintainers = [ lib.maintainers.progrm_jarvis ];
   };
-}
+})

pkgs/by-name/ca/cargo-local-registry/package.nix

@@ -7,16 +7,18 @@
   libgit2,
   openssl,
   zlib,
+  versionCheckHook,
+  nix-update-script,
 }:
 
-rustPlatform.buildRustPackage rec {
+rustPlatform.buildRustPackage (finalAttrs: {
   pname = "cargo-local-registry";
   version = "0.2.9";
 
   src = fetchFromGitHub {
     owner = "dhovart";
     repo = "cargo-local-registry";
-    rev = "v${version}";
+    tag = "v${finalAttrs.version}";
     hash = "sha256-DzBD7N7GQZ9nhF22DnxRse0P8MUGReOcXHQ56KOqW6I=";
   };
 
@@ -37,15 +39,21 @@ rustPlatform.buildRustPackage rec {
   # tests require internet access
   doCheck = false;
 
-  meta = with lib; {
+  doInstallCheck = true;
+  nativeInstallCheckInputs = [ versionCheckHook ];
+  versionCheckProgramArg = "--version";
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
     description = "Cargo subcommand to manage local registries";
     mainProgram = "cargo-local-registry";
     homepage = "https://github.com/dhovart/cargo-local-registry";
-    changelog = "https://github.com/dhovart/cargo-local-registry/releases/tag/${src.rev}";
-    license = with licenses; [
+    changelog = "https://github.com/dhovart/cargo-local-registry/releases/tag/v${finalAttrs.version}";
+    license = with lib.licenses; [
       asl20
       mit
     ];
-    maintainers = [ ];
+    maintainers = [ lib.maintainers.progrm_jarvis ];
   };
-}
+})

pkgs/by-name/ca/cargo-mutants/package.nix

@@ -2,16 +2,17 @@
   lib,
   rustPlatform,
   fetchFromGitHub,
+  nix-update-script,
 }:
 
-rustPlatform.buildRustPackage rec {
+rustPlatform.buildRustPackage (finalAttrs: {
   pname = "cargo-mutants";
   version = "25.3.1";
 
   src = fetchFromGitHub {
     owner = "sourcefrog";
     repo = "cargo-mutants";
-    rev = "v${version}";
+    tag = "v${finalAttrs.version}";
     hash = "sha256-T+BMLjp74IO71u/ftNfz67FPSt1LYCgsRP65gL0wScg=";
   };
 
@@ -20,12 +21,14 @@ rustPlatform.buildRustPackage rec {
   # too many tests require internet access
   doCheck = false;
 
-  meta = with lib; {
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
     description = "Mutation testing tool for Rust";
     mainProgram = "cargo-mutants";
     homepage = "https://github.com/sourcefrog/cargo-mutants";
-    changelog = "https://github.com/sourcefrog/cargo-mutants/releases/tag/${src.rev}";
-    license = licenses.mit;
-    maintainers = [ ];
+    changelog = "https://github.com/sourcefrog/cargo-mutants/releases/tag/v${finalAttrs.version}";
+    license = lib.licenses.mit;
+    maintainers = [ lib.maintainers.progrm_jarvis ];
   };
-}
+})

pkgs/by-name/ca/cargo-play/package.nix

@@ -2,16 +2,18 @@
   lib,
   rustPlatform,
   fetchFromGitHub,
+  versionCheckHook,
+  nix-update-script,
 }:
 
-rustPlatform.buildRustPackage rec {
+rustPlatform.buildRustPackage (finalAttrs: {
   pname = "cargo-play";
   version = "0.5.1";
 
   src = fetchFromGitHub {
     owner = "fanzeyi";
     repo = "cargo-play";
-    tag = version;
+    tag = finalAttrs.version;
     sha256 = "sha256-Z5zcLQYfQeGybsnt2U+4Z+peRHxNPbDriPMKWhJ+PeA=";
   };
 
@@ -23,11 +25,18 @@ rustPlatform.buildRustPackage rec {
     "--skip=infer_override"
   ];
 
-  meta = with lib; {
+  doInstallCheck = true;
+  nativeInstallCheckInputs = [ versionCheckHook ];
+  versionCheckProgramArg = "--version";
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
     description = "Run your rust code without setting up cargo";
     mainProgram = "cargo-play";
     homepage = "https://github.com/fanzeyi/cargo-play";
-    license = licenses.mit;
-    maintainers = [ ];
+    changelog = "https://github.com/fanzeyi/cargo-play/releases/tag/v${finalAttrs.version}";
+    license = lib.licenses.mit;
+    maintainers = [ lib.maintainers.progrm_jarvis ];
   };
-}
+})

pkgs/by-name/ca/cargo-release/package.nix

@@ -8,16 +8,17 @@
   stdenv,
   curl,
   git,
+  nix-update-script,
 }:
 
-rustPlatform.buildRustPackage rec {
+rustPlatform.buildRustPackage (finalAttrs: {
   pname = "cargo-release";
   version = "0.25.22";
 
   src = fetchFromGitHub {
     owner = "crate-ci";
     repo = "cargo-release";
-    tag = "v${version}";
+    tag = "v${finalAttrs.version}";
     hash = "sha256-NFI7UIHbo1xcH+pXim3ar8hvkn2EdIFpI2rpsivhVHg=";
   };
 
@@ -42,17 +43,20 @@ rustPlatform.buildRustPackage rec {
   # disable vendored-libgit2 and vendored-openssl
   buildNoDefaultFeatures = true;
 
+  passthru.updateScript = nix-update-script { };
+
   meta = {
     description = ''Cargo subcommand "release": everything about releasing a rust crate'';
     mainProgram = "cargo-release";
     homepage = "https://github.com/crate-ci/cargo-release";
-    changelog = "https://github.com/crate-ci/cargo-release/blob/v${version}/CHANGELOG.md";
+    changelog = "https://github.com/crate-ci/cargo-release/blob/v${finalAttrs.version}/CHANGELOG.md";
     license = with lib.licenses; [
       asl20 # or
       mit
     ];
     maintainers = with lib.maintainers; [
       gerschtli
+      progrm_jarvis
     ];
   };
-}
+})

pkgs/by-name/ca/cargo-shuttle/package.nix

@@ -5,16 +5,18 @@
   pkg-config,
   openssl,
   zlib,
+  versionCheckHook,
+  nix-update-script,
 }:
 
-rustPlatform.buildRustPackage rec {
+rustPlatform.buildRustPackage (finalAttrs: {
   pname = "cargo-shuttle";
   version = "0.57.3";
 
   src = fetchFromGitHub {
     owner = "shuttle-hq";
     repo = "shuttle";
-    rev = "v${version}";
+    tag = "v${finalAttrs.version}";
     hash = "sha256-qPevl75wmOYVhTgMiJOi+6j8LBWKzM7HPhd5mdf2B+8=";
   };
 
@@ -32,17 +34,23 @@ rustPlatform.buildRustPackage rec {
     "cargo-shuttle"
   ];
 
-  cargoTestFlags = cargoBuildFlags ++ [
+  cargoTestFlags = finalAttrs.cargoBuildFlags ++ [
     # other tests are failing for different reasons
     "init::shuttle_init_tests::"
   ];
 
-  meta = with lib; {
+  doInstallCheck = true;
+  nativeInstallCheckInputs = [ versionCheckHook ];
+  versionCheckProgramArg = "--version";
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
     description = "Cargo command for the shuttle platform";
     mainProgram = "cargo-shuttle";
     homepage = "https://shuttle.rs";
-    changelog = "https://github.com/shuttle-hq/shuttle/releases/tag/${src.rev}";
-    license = licenses.asl20;
-    maintainers = [ ];
+    changelog = "https://github.com/shuttle-hq/shuttle/releases/tag/v${finalAttrs.version}";
+    license = lib.licenses.asl20;
+    maintainers = [ lib.maintainers.progrm_jarvis ];
   };
-}
+})

pkgs/by-name/ca/cargo-tarpaulin/package.nix

@@ -6,16 +6,18 @@
   openssl,
   stdenv,
   curl,
+  versionCheckHook,
+  nix-update-script,
 }:
 
-rustPlatform.buildRustPackage rec {
+rustPlatform.buildRustPackage (finalAttrs: {
   pname = "cargo-tarpaulin";
   version = "0.34.1";
 
   src = fetchFromGitHub {
     owner = "xd009642";
     repo = "tarpaulin";
-    tag = version;
+    tag = finalAttrs.version;
     hash = "sha256-HJgcFQrHINm4BPfZ4c5ZHQYBTSBVYdSl/n0qBlSsNOI=";
   };
 
@@ -33,17 +35,24 @@ rustPlatform.buildRustPackage rec {
 
   doCheck = false;
 
-  meta = with lib; {
+  doInstallCheck = true;
+  nativeInstallCheckInputs = [ versionCheckHook ];
+  versionCheckProgramArg = "--version";
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
     description = "Code coverage tool for Rust projects";
     mainProgram = "cargo-tarpaulin";
     homepage = "https://github.com/xd009642/tarpaulin";
-    changelog = "https://github.com/xd009642/tarpaulin/blob/${src.rev}/CHANGELOG.md";
-    license = with licenses; [
+    changelog = "https://github.com/xd009642/tarpaulin/blob/${finalAttrs.version}/CHANGELOG.md";
+    license = with lib.licenses; [
       mit # or
       asl20
     ];
-    maintainers = with maintainers; [
+    maintainers = with lib.maintainers; [
       hugoreeves
+      progrm_jarvis
     ];
   };
-}
+})

pkgs/by-name/ca/cargo-zigbuild/package.nix

@@ -4,16 +4,18 @@
   fetchFromGitHub,
   makeWrapper,
   zig,
+  versionCheckHook,
+  nix-update-script,
 }:
 
-rustPlatform.buildRustPackage rec {
+rustPlatform.buildRustPackage (finalAttrs: {
   pname = "cargo-zigbuild";
   version = "0.20.1";
 
   src = fetchFromGitHub {
     owner = "messense";
     repo = "cargo-zigbuild";
-    rev = "v${version}";
+    tag = "v${finalAttrs.version}";
     hash = "sha256-xJiYtVrvWEBsyTbcHKsbnTpbcTryX+ZP/OjD7GP6gQU=";
   };
 
@@ -26,12 +28,18 @@ rustPlatform.buildRustPackage rec {
       --prefix PATH : ${zig}/bin
   '';
 
+  doInstallCheck = true;
+  nativeInstallCheckInputs = [ versionCheckHook ];
+  versionCheckProgramArg = "--version";
+
+  passthru.updateScript = nix-update-script { };
+
   meta = {
     description = "Tool to compile Cargo projects with zig as the linker";
     mainProgram = "cargo-zigbuild";
     homepage = "https://github.com/messense/cargo-zigbuild";
-    changelog = "https://github.com/messense/cargo-zigbuild/releases/tag/v${version}";
+    changelog = "https://github.com/messense/cargo-zigbuild/releases/tag/v${finalAttrs.version}";
     license = lib.licenses.mit;
-    maintainers = [ ];
+    maintainers = [ lib.maintainers.progrm_jarvis ];
   };
-}
+})

pkgs/by-name/cd/cdktf-cli/package.nix

@@ -142,15 +142,15 @@ stdenv.mkDerivation (finalAttrs: {
       "$out/lib/node_modules/cdktf-cli/node_modules/@cdktf/hcl2json/main.wasm"
   '';
 
-  nativeInstallCheckInputs = [ versionCheckHook ];
-  doInstallCheck = true;
+  nativeInstallCheckInputs = [
+    versionCheckHook
+  ];
 
-  passthru = {
-    tests.version = testers.testVersion {
-      package = finalAttrs.finalPackage;
-    };
-    updateScript = nix-update-script { };
-  };
+  # Tries to write to /var/empty/.terraform.d on darwin
+  # even with writableTmpDirAsHomeHook and CHECKPOINT_DISABLE=1
+  doInstallCheck = stdenv.hostPlatform.isLinux;
+
+  passthru.updateScript = nix-update-script { };
 
   meta = {
     description = "CDK for Terraform CLI";

pkgs/by-name/cl/clap/package.nix

@@ -8,13 +8,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "clap";
-  version = "1.2.6";
+  version = "1.2.7";
 
   src = fetchFromGitHub {
     owner = "free-audio";
     repo = "clap";
     rev = finalAttrs.version;
-    hash = "sha256-QyIuuiwFg5DP2Ao/LOKYiBXxKHQ0FbFhssIIUnEQz+c=";
+    hash = "sha256-FtsqfpUBn0YGEyhRrJnPGSqrawS1g3F/exVGAuvXkRQ=";
   };
 
   postPatch = ''

pkgs/by-name/co/commitlint/package.nix

@@ -12,18 +12,18 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "commitlint";
-  version = "20.1.0";
+  version = "20.2.0";
 
   src = fetchFromGitHub {
     owner = "conventional-changelog";
     repo = "commitlint";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-o8AnIewSmg8vRjs8LU6QwRyl2hMQ2iK5W7WL137treU=";
+    hash = "sha256-L9HfuwpFmKWoEyFdo7+UIEeEcD0jFhunj0x6UFHfhEY=";
   };
 
   yarnOfflineCache = fetchYarnDeps {
     inherit (finalAttrs) src;
-    hash = "sha256-Kg19sEgstrWj+JLzdZFnMeb0F5lFX3Z0VPNyiYPi6nY=";
+    hash = "sha256-rKVMSbsipd8J2E+E2RdeXYDsMwSzFZMJJ4zceOLBbCs=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/co/coppwr/package.nix

@@ -11,18 +11,18 @@
   xorg,
 }:
 
-rustPlatform.buildRustPackage rec {
+rustPlatform.buildRustPackage (finalAttrs: {
   pname = "coppwr";
-  version = "1.7.0";
+  version = "1.7.1";
 
   src = fetchFromGitHub {
     owner = "dimtpap";
     repo = "coppwr";
-    tag = version;
-    hash = "sha256-9oFWX44jToJh0vJaDV/KZXVNQgLG0lr1iA+0hInAhLA=";
+    tag = finalAttrs.version;
+    hash = "sha256-L0MpMh3HuWX0zxG50OGZDa+wX5E55/dU6jt6Iei99Ho=";
   };
 
-  cargoHash = "sha256-Fq8I1pt83yqrjiA4VXA+z7o2LFTac2SonAwTycQRP8M=";
+  cargoHash = "sha256-tcGyoPVoJFhbXZFe23d00Z7FUwIo5J02EfPTBzCGE64=";
 
   nativeBuildInputs = [
     pkg-config
@@ -49,10 +49,14 @@ rustPlatform.buildRustPackage rec {
     install -m 444 \
         -D $src/assets/io.github.dimtpap.coppwr.metainfo.xml \
         -t $out/share/metainfo
-    cp $src/assets/icon/scalable.svg $out/share/icons/hicolor/scalable/apps/io.github.dimtpap.coppwr.svg
+    install -m 444 \
+        -D $src/assets/icon/scalable.svg \
+        -t $out/share/icons/hicolor/scalable/apps/io.github.dimtpap.coppwr.svg
     for size in 32 48 64 128 256 512; do
       mkdir -p $out/share/icons/hicolor/"$size"x"$size"/apps
-      cp $src/assets/icon/"$size".png $out/share/icons/hicolor/"$size"x"$size"/apps/io.github.dimtpap.coppwr.png
+      install -m 444 \
+          -D $src/assets/icon/"$size".png \
+          -t $out/share/icons/hicolor/"$size"x"$size"/apps/io.github.dimtpap.coppwr.png
     done
   '';
 
@@ -75,4 +79,4 @@ rustPlatform.buildRustPackage rec {
     mainProgram = "coppwr";
     platforms = lib.platforms.linux;
   };
-}
+})

pkgs/by-name/co/cordova/package.nix

@@ -6,16 +6,16 @@
 
 buildNpmPackage rec {
   pname = "cordova";
-  version = "12.0.0";
+  version = "13.0.0";
 
   src = fetchFromGitHub {
     owner = "apache";
     repo = "cordova-cli";
     tag = version;
-    hash = "sha256-fEV7NlRcRpyeRplsdXHI2U4/89DsvKQpVwHD5juiNPo=";
+    hash = "sha256-GJTrFGrUzSQ/Hsphn0zkjFYQkFw5i7ntc8HqIYdOYL4=";
   };
 
-  npmDepsHash = "sha256-ZMxZiwCgqzOBwDXeTfIEwqFVdM9ysWeE5AbX7rUdwIc=";
+  npmDepsHash = "sha256-y81NdwF+RU20jmCi+Fou3Vc9ivt1x8JOj7biAsuSYDg=";
 
   dontNpmBuild = true;
 

pkgs/by-name/en/ente-auth/package.nix

@@ -18,14 +18,14 @@ let
 in
 flutter332.buildFlutterApplication rec {
   pname = "ente-auth";
-  version = "4.4.10";
+  version = "4.4.12";
 
   src = fetchFromGitHub {
     owner = "ente-io";
     repo = "ente";
     sparseCheckout = [ "mobile" ];
     tag = "auth-v${version}";
-    hash = "sha256-JzDFzopXNurkOtdheiQZJ5aBQWu7YZumiHs2RghGeVc=";
+    hash = "sha256-1GJWGTzErV+wSkeAg3z0u7tBPFrq6hPc0fWniKT8w9M=";
   };
 
   sourceRoot = "${src.name}/mobile/apps/auth";

pkgs/by-name/en/ente-auth/pubspec.lock.json

@@ -450,6 +450,25 @@
       "source": "hosted",
       "version": "2.1.1"
     },
+    "dir_utils": {
+      "dependency": "direct main",
+      "description": {
+        "path": "../../packages/dir_utils",
+        "relative": true
+      },
+      "source": "path",
+      "version": "1.0.0"
+    },
+    "dots_indicator": {
+      "dependency": "direct main",
+      "description": {
+        "name": "dots_indicator",
+        "sha256": "2a53e0321a3f0d87e38ef30f6e9ff1deb5d6c0e2c5708e057d26cdaa94a95f10",
+        "url": "https://pub.dev"
+      },
+      "source": "hosted",
+      "version": "3.1.0"
+    },
     "dotted_border": {
       "dependency": "direct main",
       "description": {
@@ -1180,11 +1199,11 @@
       "dependency": "direct main",
       "description": {
         "name": "hugeicons",
-        "sha256": "b4a695c2100217a0b4d2378f0102d948925c97e37417baa6e2d9cb62ba8fb2f7",
+        "sha256": "036d917bd12e2dee331de7910a11417ebf6c80be1962c0d63ee945e3184f0937",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "1.1.0"
+      "version": "1.1.1"
     },
     "image": {
       "dependency": "direct main",
@@ -1738,6 +1757,26 @@
       "source": "hosted",
       "version": "4.1.0"
     },
+    "saf_stream": {
+      "dependency": "direct main",
+      "description": {
+        "name": "saf_stream",
+        "sha256": "c05449997698c481a03e428162a999f93b1ee1bcc0349d651899a59f7b10230a",
+        "url": "https://pub.dev"
+      },
+      "source": "hosted",
+      "version": "0.12.3"
+    },
+    "saf_util": {
+      "dependency": "direct main",
+      "description": {
+        "name": "saf_util",
+        "sha256": "219f983e5f17b28998335158cdc97add9d52af9884e38b5a43f10dcc070510ec",
+        "url": "https://pub.dev"
+      },
+      "source": "hosted",
+      "version": "0.11.0"
+    },
     "screen_retriever": {
       "dependency": "transitive",
       "description": {

pkgs/by-name/ep/epson-escpr2/package.nix

@@ -8,14 +8,15 @@
 
 stdenv.mkDerivation {
   pname = "epson-inkjet-printer-escpr2";
-  version = "1.2.35";
+  version = "1.2.36";
 
   src = fetchurl {
     # To find the most recent version go to
     # https://support.epson.net/linux/Printer/LSB_distribution_pages/en/escpr2.php
     # and retrieve the download link for source package for arm CPU for the tar.gz (the x86 link targets to rpm source files)
-    url = "https://download3.ebz.epson.net/dsc/f/03/00/17/28/09/4e8dc40219d4b52e414b608de92552af4fd46eca/epson-inkjet-printer-escpr2-1.2.35-1.tar.gz";
-    hash = "sha256-aYEuEION/C32/SnngreX/nqK/6Yzkuxf0k0HpferTYM=";
+
+    url = "https://download-center.epson.com/f/module/bb48b7e6-662f-4152-a86f-c1a78fc74b1f/epson-inkjet-printer-escpr2-1.2.36-1.tar.gz";
+    hash = "sha256-0R4dFhT1XhjXMOeRxCbTIT1K83bkwiAhpu/W10DSlxM=";
   };
 
   buildInputs = [ cups ];
@@ -37,6 +38,8 @@ stdenv.mkDerivation {
     "--with-cupsppddir=${placeholder "out"}/share/cups/model"
   ];
 
+  passthru.updateScript = ./update.sh;
+
   meta = {
     homepage = "http://download.ebz.epson.net/dsc/search/01/search/";
     description = "ESC/P-R 2 Driver (generic driver)";

pkgs/by-name/ep/epson-escpr2/update.sh

@@ -0,0 +1,21 @@
+#!/usr/bin/env nix-shell
+#!nix-shell -i bash -p bash curl jq common-updater-scripts
+set -eou pipefail
+
+result=$(curl -sSL 'https://download-center.epson.com/api/v1/modules/?device_id=XP-970%20Series&os=DEBARM32&region=US&language=en' | jq -r '.items[] | select(.module_name == "Epson Inkjet Printer Driver 2 (ESC/P-R) for Linux" and .cti_category == "Sources")')
+
+latestVersion=$(jq '.version' <<< "$result" | tr -d '"')
+currentVersion=$(nix-instantiate --eval -E "with import ./. {}; (lib.getVersion epson-escpr2)" | tr -d '"')
+
+echo "latest  version: $latestVersion"
+echo "current version: $currentVersion"
+
+if [[ "$latestVersion" == "$currentVersion" ]]; then
+    echo "package is up-to-date"
+    exit 0
+fi
+
+url=$(jq '.url' <<< "$result" | tr -d '"')
+
+hash=$(nix --extra-experimental-features nix-command hash convert --hash-algo sha256 --to sri $(nix-prefetch-url $url))
+update-source-version epson-escpr2 $latestVersion $hash $url --ignore-same-version

pkgs/by-name/ev/evince/package.nix

@@ -120,6 +120,12 @@ stdenv.mkDerivation (finalAttrs: {
     "-Dmultimedia=disabled"
   ];
 
+  # Fix build with gcc15
+  env.NIX_CFLAGS_COMPILE = toString [
+    "-DHAVE_STRING_H"
+    "-DHAVE_STDLIB_H"
+  ];
+
   preFixup = ''
     gappsWrapperArgs+=(--prefix XDG_DATA_DIRS : "${shared-mime-info}/share")
   '';

pkgs/by-name/fi/field-monitor/package.nix

@@ -0,0 +1,102 @@
+{
+  stdenv,
+  lib,
+  fetchFromGitHub,
+  cargo,
+  meson,
+  ninja,
+  rustPlatform,
+  rustc,
+  pkg-config,
+  glib,
+  gsettings-desktop-schemas,
+  gtk4,
+  libadwaita,
+  libvirt,
+  gst_all_1,
+  desktop-file-utils,
+  appstream,
+  appstream-glib,
+  wrapGAppsHook4,
+  xdg-desktop-portal,
+  blueprint-compiler,
+  libxml2,
+  spice-protocol,
+  spice-gtk,
+  vte-gtk4,
+  gtk-vnc,
+  usbredir,
+  libepoxy,
+  libGL,
+  openssl,
+}:
+stdenv.mkDerivation (finalAttrs: {
+  pname = "field-monitor";
+  version = "49.1";
+
+  strictDeps = true;
+
+  src = fetchFromGitHub {
+    owner = "theCapypara";
+    repo = "field-monitor";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-vtRubZwIQRV3ySFwdPgZ1Eyxh32FPsAvissxjrV3JcE=";
+  };
+
+  cargoDeps = rustPlatform.fetchCargoVendor {
+    inherit (finalAttrs) src;
+    hash = "sha256-zBCt/ptxAQ3TAzklmjbajQZ4Ou1+xlvH/k74yW34t9g=";
+  };
+
+  mesonBuildType = "release";
+
+  nativeBuildInputs = [
+    appstream
+    appstream-glib
+    blueprint-compiler
+    cargo
+    desktop-file-utils
+    libxml2
+    meson
+    ninja
+    pkg-config
+    rustc
+    rustPlatform.cargoSetupHook
+    wrapGAppsHook4
+  ];
+
+  buildInputs = [
+    glib
+    gsettings-desktop-schemas
+    gtk-vnc
+    gtk4
+    libadwaita
+    libepoxy
+    libGL
+    libvirt
+    openssl
+    spice-gtk
+    spice-protocol
+    usbredir
+    vte-gtk4
+    xdg-desktop-portal
+  ]
+  ++ (with gst_all_1; [
+    gstreamer
+    gst-plugins-base
+    gst-plugins-good
+  ]);
+
+  postInstall = ''
+    wrapProgram $out/bin/de.capypara.FieldMonitor --prefix PATH ':' "$out/libexec"
+  '';
+
+  meta = {
+    description = "Viewer for virtual machines and other external screens";
+    homepage = "https://github.com/theCapypara/field-monitor";
+    license = lib.licenses.gpl3Plus;
+    maintainers = with lib.maintainers; [ theCapypara ];
+    platforms = lib.platforms.linux;
+    mainProgram = "de.capypara.FieldMonitor";
+  };
+})

pkgs/by-name/gi/git-pages-cli/package.nix

@@ -8,14 +8,14 @@
 
 buildGoModule (finalAttrs: {
   pname = "git-pages-cli";
-  version = "1.3.1";
+  version = "1.5.1";
 
   src = fetchFromGitea {
     domain = "codeberg.org";
     owner = "git-pages";
     repo = "git-pages-cli";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-BApqy0eTTl7OyJGnnNiVXiPKNN4tPoq88ucA/Ipe16Q=";
+    hash = "sha256-T6spNuuG0l1bFv7SnsDTGBtD3Sa+8zKN0/VbsKVkGrM=";
   };
 
   vendorHash = "sha256-5vjUhN3lCr41q91lOD7v0F9c6a8GJj7wBGnnzgFBhJU=";

pkgs/by-name/gr/graphicsmagick/package.nix

@@ -28,11 +28,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "graphicsmagick";
-  version = "1.3.45";
+  version = "1.3.46";
 
   src = fetchurl {
     url = "mirror://sourceforge/graphicsmagick/GraphicsMagick-${finalAttrs.version}.tar.xz";
-    hash = "sha256-3OpRZ0FPfIBVV94tekepsxR7y/YXuR9fD0r+XmVDAms=";
+    hash = "sha256-x8cGpQXpxsN2QVa7lKDJZE15ExeF3xWonJ+HIdGr0GE=";
   };
 
   outputs = [

pkgs/by-name/gr/gromit-mpx/package.nix

@@ -2,7 +2,6 @@
   lib,
   stdenv,
   fetchFromGitHub,
-  fetchpatch2,
   cmake,
   pkg-config,
   gtk3,
@@ -22,22 +21,15 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "gromit-mpx";
-  version = "1.7.0";
+  version = "1.8.0";
 
   src = fetchFromGitHub {
     owner = "bk138";
     repo = "gromit-mpx";
     tag = finalAttrs.version;
-    hash = "sha256-jHw4V2ZvfpT3PUihe/O+9BPsv+udFg5seMbYmxOz8Yk=";
+    hash = "sha256-dqZbkbjcfNO/rlUn5pCDdPU5rYyG1qSR38WROFwPlN0=";
   };
 
-  patches = [
-    (fetchpatch2 {
-      url = "https://github.com/bk138/gromit-mpx/commit/e3b501d497374da083b97d0b3bbd40c5c766d2d1.patch?full_index=1";
-      hash = "sha256-MJFwwYuvIZeLJBi4p/JQ6qJo6fntj2Q7y+ufap/MGdY=";
-    })
-  ];
-
   nativeBuildInputs = [
     cmake
     pkg-config

pkgs/by-name/ha/happy-coder/package.nix

@@ -0,0 +1,61 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  fetchYarnDeps,
+  yarnConfigHook,
+  yarnBuildHook,
+  yarnInstallHook,
+  nodejs,
+  makeWrapper,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "happy-coder";
+  version = "0.11.2";
+
+  src = fetchFromGitHub {
+    owner = "slopus";
+    repo = "happy-cli";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-WKzbpxHqE3Dxqy/PDj51tM9+Wl2Pallfrc5UU2MxNn8=";
+  };
+
+  yarnOfflineCache = fetchYarnDeps {
+    yarnLock = finalAttrs.src + "/yarn.lock";
+    hash = "sha256-3/qcbCJ+Iwc+9zPCHKsCv05QZHPUp0it+QR3z7m+ssw=";
+  };
+
+  nativeBuildInputs = [
+    nodejs
+    yarnConfigHook
+    yarnBuildHook
+    yarnInstallHook
+    makeWrapper
+  ];
+
+  # Currently `happy` requires `node` to start its daemon
+  postInstall = ''
+    wrapProgram $out/bin/happy \
+      --prefix PATH : ${
+        lib.makeBinPath [
+          nodejs
+        ]
+      }
+    wrapProgram $out/bin/happy-mcp \
+      --prefix PATH : ${
+        lib.makeBinPath [
+          nodejs
+        ]
+      }
+  '';
+
+  meta = {
+    description = "Mobile and web client wrapper for Claude Code and Codex with end-to-end encryption";
+    homepage = "https://github.com/slopus/happy-cli";
+    changelog = "https://github.com/slopus/happy-cli/releases/tag/v${finalAttrs.version}";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ onsails ];
+    mainProgram = "happy";
+  };
+})

pkgs/by-name/ha/hayabusa-sec/package.nix

@@ -2,6 +2,8 @@
   lib,
   rustPlatform,
   fetchFromGitHub,
+  makeWrapper,
+  unstableGitUpdater,
   pkg-config,
   openssl,
   rust-jemalloc-sys,
@@ -9,20 +11,21 @@
 
 rustPlatform.buildRustPackage {
   pname = "hayabusa-sec";
-  version = "3.3.0-unstable-2025-07-17";
+  version = "3.7.0-unstable-2025-12-02";
 
   src = fetchFromGitHub {
     owner = "Yamato-Security";
     repo = "hayabusa";
-    rev = "feaa165b4c0af34919ad26f634cb684e23172359";
-    hash = "sha256-h08InhNVW33IjPA228gv6Enlg6EKmj0yHb/UvJ/f7uw=";
+    rev = "1c4f332b446f20af154257b2e9b581f7bcb4b1a2";
+    hash = "sha256-JWb54yudfB6pOMZca8sFeoRqNA7M//xJ3IBKfIcGBnM=";
     # Include the hayabusa-rules
     fetchSubmodules = true;
   };
 
-  cargoHash = "sha256-wcH1Ron5Zx2ypWyaW0z7L9rCanAcosvpPQnP60qbvWQ=";
+  cargoHash = "sha256-JIHkFokaZ+nt1hW+gRxFrb1DVZcm4jsZKT12gx/BRCA=";
 
   nativeBuildInputs = [
+    makeWrapper
     pkg-config
   ];
 
@@ -39,6 +42,15 @@ rustPlatform.buildRustPackage {
   # > error: unexpected argument '--skip' found
   doCheck = false;
 
+  postInstall = ''
+    mkdir -p $out/share/hayabusa-sec
+    cp -r rules $out/share/hayabusa-sec/
+    mv $out/bin/hayabusa $out/share/hayabusa-sec/
+    makeWrapper $out/share/hayabusa-sec/hayabusa $out/bin/hayabusa
+  '';
+
+  passthru.updateScript = unstableGitUpdater { };
+
   meta = {
     description = "Sigma-based threat hunting and fast forensics timeline generator for Windows event logs";
     homepage = "https://github.com/Yamato-Security/hayabusa";

pkgs/by-name/ka/kak-tree-sitter-unwrapped/package.nix

@@ -9,16 +9,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "kak-tree-sitter-unwrapped";
-  version = "2.0.0";
+  version = "3.0.0";
 
   src = fetchFromSourcehut {
     owner = "~hadronized";
     repo = "kak-tree-sitter";
     rev = "kak-tree-sitter-v${version}";
-    hash = "sha256-vFhNxixXsezK3Qm9d5hEiIttSjcuqHfgCHYrEOeKWvs=";
+    hash = "sha256-9QeTHmDTw1Qxnl+AnqCZgxlCCycq5qYF0aM/6fu8qwM=";
   };
 
-  cargoHash = "sha256-tO6i19UuistT4yUc0YzZOh+8M5kXq5l1NUTBUOA3YT8=";
+  cargoHash = "sha256-lZNM5HqICP6JfaMiBjACcUNRTTTIRhq2ou8cOLU0yOU=";
 
   passthru = {
     updateScript = nix-update-script { };

pkgs/by-name/ka/karate/package.nix

@@ -8,11 +8,11 @@
 
 stdenvNoCC.mkDerivation rec {
   pname = "karate";
-  version = "1.5.1";
+  version = "1.5.2";
 
   src = fetchurl {
     url = "https://github.com/karatelabs/karate/releases/download/v${version}/karate-${version}.jar";
-    sha256 = "sha256-Dk7rd9exdTSvauqcAldT3N597TeF+MNoLTx4OmOGcxE=";
+    sha256 = "sha256-zPR0DGShVMTCRX1vD9GajzeQLCnTKqxOIwEuCoeGFL4=";
   };
   dontUnpack = true;
 

pkgs/by-name/ko/kopia-ui/package.nix

@@ -10,12 +10,12 @@
   kopia,
 }:
 let
-  version = "0.22.2";
+  version = "0.22.3";
   src = fetchFromGitHub {
     owner = "kopia";
     repo = "kopia";
     tag = "v${version}";
-    hash = "sha256-UtyOMXX6Q0fhlnSMmI5d+0BHGvoWkPZbcm9B6vWG05Y=";
+    hash = "sha256-5oNam99Mij78snSO6jiGPYzeD68sXEBKM2dGQtTUrww=";
   };
 in
 buildNpmPackage {

pkgs/by-name/ko/kopia/package.nix

@@ -11,16 +11,16 @@
 
 buildGoModule rec {
   pname = "kopia";
-  version = "0.22.2";
+  version = "0.22.3";
 
   src = fetchFromGitHub {
     owner = "kopia";
     repo = "kopia";
     tag = "v${version}";
-    hash = "sha256-UtyOMXX6Q0fhlnSMmI5d+0BHGvoWkPZbcm9B6vWG05Y=";
+    hash = "sha256-5oNam99Mij78snSO6jiGPYzeD68sXEBKM2dGQtTUrww=";
   };
 
-  vendorHash = "sha256-zjUkVU9I+Dp21QcOZPT30Ki570vQJPyK4UYSy8PEiZI=";
+  vendorHash = "sha256-szlCiZOLU0KVWb2YX3Wmicrumn+fNm2AWdPxaJZZT90=";
 
   subPackages = [ "." ];
 

pkgs/by-name/ko/korrect/package.nix

@@ -28,7 +28,8 @@ rustPlatform.buildRustPackage (finalAttrs: {
     installShellCompletion --cmd ${finalAttrs.meta.mainProgram} \
       --bash <($out/bin/${finalAttrs.meta.mainProgram} completions bash) \
       --fish <($out/bin/${finalAttrs.meta.mainProgram} completions fish) \
-      --zsh <($out/bin/${finalAttrs.meta.mainProgram} completions zsh)
+      --zsh <($out/bin/${finalAttrs.meta.mainProgram} completions zsh) \
+      --nushell <($out/bin/${finalAttrs.meta.mainProgram} completions nushell)
   '';
 
   meta = {

pkgs/by-name/la/lazygit/package.nix

@@ -8,13 +8,13 @@
 }:
 buildGoModule rec {
   pname = "lazygit";
-  version = "0.56.0";
+  version = "0.57.0";
 
   src = fetchFromGitHub {
     owner = "jesseduffield";
     repo = "lazygit";
     tag = "v${version}";
-    hash = "sha256-oTj+9zDmbXD4rlFZ++hcd1WSfskSNI7ojI9gN8UcpT8=";
+    hash = "sha256-DC0wVkFI7Te3QSE8Y0WU/ysanfukTkGa3N43hmKHXW8=";
   };
 
   vendorHash = null;

pkgs/by-name/li/libretro-shaders-slang/package.nix

@@ -7,13 +7,13 @@
 
 stdenvNoCC.mkDerivation {
   pname = "libretro-shaders-slang";
-  version = "0-unstable-2025-11-19";
+  version = "0-unstable-2025-12-02";
 
   src = fetchFromGitHub {
     owner = "libretro";
     repo = "slang-shaders";
-    rev = "279b031c92c7a376be47ffdec5fe669fb5dcebc0";
-    hash = "sha256-0OltcN4W0vp7jtDSSIJ2ZanFi5p/efnPDOhaurr3ShY=";
+    rev = "cf5c768ffda2520d4938df68d33fd63fff276c0c";
+    hash = "sha256-0ExGupoxdKAbQ6znzHixivvskFwgO+aKLsRvJlfB0Oc=";
   };
 
   dontConfigure = true;

pkgs/by-name/ma/matrix-tuwunel/package.nix

@@ -43,8 +43,8 @@ let
             # The commit on the rocksdb fork, tuwunel-changes branch referenced by the upstream
             # tuwunel flake.lock:
             # https://github.com/matrix-construct/tuwunel/blob/main/flake.lock#L557C17-L557C57
-            rev = "cf7f65d0b377af019661c240f9165b3ef60640c3";
-            hash = "sha256-ZSjvAZBfZkJrBIpw8ANZMbJVb8AeuogvuAipGVE4Qe4=";
+            rev = "9a3a213b55df0b11408102c899a940675c0d90e4";
+            hash = "sha256-aOV/jJjRjNJ3hrRqhCsXlIz05NvEhDF/j5Q5UOQuvp8=";
           };
           version = "tuwunel-changes";
           patches = [ ];
@@ -88,16 +88,16 @@ let
 in
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "matrix-tuwunel";
-  version = "1.4.6";
+  version = "1.4.7";
 
   src = fetchFromGitHub {
     owner = "matrix-construct";
     repo = "tuwunel";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-EmIBhSxYD52BzwewcIL53e3/7GLY+5nccmAYGf1LPqI=";
+    hash = "sha256-TaMPGxVRV7MpTIdIWylKeiZa22s8EgNGSiiXNUWonfc=";
   };
 
-  cargoHash = "sha256-aVMJr216gkYpanCee6UhNGINAi/EZ0V5m0WaTYpQJcY=";
+  cargoHash = "sha256-ZfC6Rqd3Or23TEoGuKu1pB+USv7rlOEzRYBisoK2Pcc=";
 
   nativeBuildInputs = [
     pkg-config

pkgs/by-name/md/mdbook-yml-header/package.nix

@@ -7,17 +7,17 @@
 
 let
   pname = "mdbook-yml-header";
-  version = "0.1.4";
+  version = "0.1.5";
 in
 rustPlatform.buildRustPackage {
   inherit pname version;
 
   src = fetchCrate {
     inherit pname version;
-    hash = "sha256-qRAqZUKOiXTh4cJjczBQ9zAL6voaDvko7elfE6eB2jA=";
+    hash = "sha256-QlclxqH6cKo9QZyUBFCcujT9liTc8lmEheyjFKK7N58=";
   };
 
-  cargoHash = "sha256-C8M2Y7igeDmi337GXWmLcwNTGr1/CTHWWTuMPDtkqxs=";
+  cargoHash = "sha256-iBvVes32G0Ji9gk97axeTzbXlVh0Qn9Bzj64G6oEDFM=";
 
   passthru.updateScript = nix-update-script { };
 

pkgs/by-name/nu/numr/package.nix

@@ -0,0 +1,50 @@
+{
+  stdenv,
+  lib,
+  rustPlatform,
+  fetchFromGitHub,
+  pkg-config,
+  openssl,
+  versionCheckHook,
+  nix-update-script,
+}:
+
+rustPlatform.buildRustPackage (finalAttrs: {
+  pname = "numr";
+  version = "0.1.7";
+
+  src = fetchFromGitHub {
+    owner = "nasedkinpv";
+    repo = "numr";
+    rev = "v${finalAttrs.version}";
+    hash = "sha256-tDQxDU/CrzZvXjsVSkUtDHX53WddFt6G8RBrHd8mXyg=";
+  };
+
+  cargoHash = "sha256-4Ig35ev3L2Sr8m4JsQVv/3lSLDc9RxSFMYeI+N+Wg7A=";
+
+  nativeBuildInputs = [
+    pkg-config
+  ];
+
+  buildInputs = lib.optionals stdenv.hostPlatform.isLinux [
+    openssl
+  ];
+
+  env.OPENSSL_NO_VENDOR = true;
+
+  nativeInstallCheckInputs = [ versionCheckHook ];
+  versionCheckProgramArg = "--version";
+  doInstallCheck = true;
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = with lib; {
+    description = "Text calculator inspired by Numi - natural language expressions, variables, unit conversions";
+    homepage = "https://github.com/nasedkinpv/numr";
+    license = licenses.mit;
+    maintainers = with maintainers; [
+      matthiasbeyer
+    ];
+    mainProgram = "numr";
+  };
+})

pkgs/by-name/pi/pinsel/package.nix

@@ -10,13 +10,13 @@
 
 stdenv.mkDerivation {
   pname = "pinsel";
-  version = "unstable-2021-09-13";
+  version = "0-unstable-2022-03-27";
 
   src = fetchFromGitHub {
     owner = "Nooo37";
     repo = "pinsel";
-    rev = "24b0205ca041511b3efb2a75ef296539442f9f54";
-    sha256 = "sha256-w+jiKypZODsmZq3uWGNd8PZhe1SowHj0thcQTX8WHfQ=";
+    rev = "4955b93365a1816bffbddc3d2ddfe3f4b3d60107";
+    hash = "sha256-H5DCAb8lJx2W4LNeGV+WOIiLUHsRVv1gSU2YMegkDFM=";
   };
 
   strictDeps = true;
@@ -40,9 +40,9 @@ stdenv.mkDerivation {
   meta = with lib; {
     description = "Minimal screenshot annotation tool with lua config";
     homepage = "https://github.com/Nooo37/pinsel";
-    # no license
-    license = licenses.unfree;
+    license = licenses.mit;
     maintainers = with maintainers; [ lom ];
+    platforms = platforms.linux;
     mainProgram = "pinsel";
   };
 }

pkgs/by-name/pr/protoc-gen-go-grpc/package.nix

@@ -2,27 +2,32 @@
   buildGoModule,
   fetchFromGitHub,
   lib,
+  testers,
 }:
 
-buildGoModule rec {
+buildGoModule (finalAttrs: {
   pname = "protoc-gen-go-grpc";
-  version = "1.5.1";
+  version = "1.6.0";
   modRoot = "cmd/protoc-gen-go-grpc";
 
   src = fetchFromGitHub {
     owner = "grpc";
     repo = "grpc-go";
-    rev = "cmd/protoc-gen-go-grpc/v${version}";
-    hash = "sha256-PAUM0chkZCb4hGDQtCgHF3omPm0jP1sSDolx4EuOwXo=";
+    rev = "cmd/protoc-gen-go-grpc/v${finalAttrs.version}";
+    hash = "sha256-Ay8X7NoS81ubMtFMrvQINhGAFV/Yh75AXh7/Y9lCJDo=";
   };
 
-  vendorHash = "sha256-yn6jo6Ku/bnbSX8FL0B/Uu3Knn59r1arjhsVUkZ0m9g=";
+  vendorHash = "sha256-s26T7pht7YU1LJIM3edtuPb+KVezqG3m+8CxM+l1ty4=";
 
   ldflags = [
     "-s"
     "-w"
   ];
 
+  passthru.tests.version = testers.testVersion {
+    package = finalAttrs.finalPackage;
+  };
+
   meta = {
     description = "Go language implementation of gRPC. HTTP/2 based RPC";
     homepage = "https://grpc.io/";
@@ -30,4 +35,4 @@ buildGoModule rec {
     maintainers = with lib.maintainers; [ aaronjheng ];
     mainProgram = "protoc-gen-go-grpc";
   };
-}
+})

pkgs/by-name/re/readest/package.nix

@@ -20,13 +20,13 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "readest";
-  version = "0.9.93";
+  version = "0.9.94";
 
   src = fetchFromGitHub {
     owner = "readest";
     repo = "readest";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-Yfj7QVjCCIX41xVzYMoaJPQd2zY/zymo2V2nbNUZpO4=";
+    hash = "sha256-yDMVkcypw+7zoVAUeVL23agNr8rG3gvNJFbVJW/VNKY=";
     fetchSubmodules = true;
   };
 
@@ -40,12 +40,12 @@ rustPlatform.buildRustPackage (finalAttrs: {
   pnpmDeps = pnpm_9.fetchDeps {
     inherit (finalAttrs) pname version src;
     fetcherVersion = 1;
-    hash = "sha256-z7eOiaNXUb2wb014MOGAejZc2fgoMTavhJsNQaygFzc=";
+    hash = "sha256-Q+kGrf24zKeLyM4JhSXXKtKRGQbwwiHm+aUuHHSyN/U=";
   };
 
   pnpmRoot = "../..";
 
-  cargoHash = "sha256-nNMD2LnMDz91kI2QniD+zD/Ug9BSVjTIiuxWdz8UxL0=";
+  cargoHash = "sha256-PbWjDvxbbiiKy1UeJx7cUawGampbL5t/Bhb13tirhGc=";
 
   cargoRoot = "../..";
 
@@ -85,7 +85,8 @@ rustPlatform.buildRustPackage (finalAttrs: {
   ];
 
   preBuild = ''
-    pnpm setup-pdfjs
+    # set up pdfjs and simplecc
+    pnpm setup-vendors
   '';
 
   preFixup = ''

pkgs/by-name/re/regolith/package.nix

@@ -7,19 +7,19 @@
 }:
 buildGoModule rec {
   pname = "regolith";
-  version = "1.6.1";
+  version = "1.6.2";
 
   src = fetchFromGitHub {
     owner = "Bedrock-OSS";
     repo = "regolith";
     tag = version;
-    hash = "sha256-4STEivb2nlIYE6X0vnO8L4UtFrtmaNS+rxtuE0SwKmA=";
+    hash = "sha256-J4DkEjN+hPK6fu9dIuHdY6gu1imb0sB/KdWnXYJSgw8=";
   };
 
   # Requires network access.
   doCheck = false;
 
-  vendorHash = "sha256-EWfc4VzVrg1D012dsPqdXoiGpBjpQRYiWNd0wrWlw34=";
+  vendorHash = "sha256-jQeIPJJyANS+U9NrjLSnXHAecCK4rHPZrP5JFsMwcm8=";
 
   ldflags = [
     "-X main.buildSource=nix"

pkgs/by-name/re/release-plz/package.nix

@@ -11,16 +11,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "release-plz";
-  version = "0.3.149";
+  version = "0.3.150";
 
   src = fetchFromGitHub {
     owner = "MarcoIeni";
     repo = "release-plz";
     rev = "release-plz-v${version}";
-    hash = "sha256-1n0cX8xU62LHGWs0yk8gUg1r3PBIbXih+9BK3UYseqU=";
+    hash = "sha256-gV1B7c7yC5KBjQ5y44dAgMUuGtL55ICM++kNShNh/nM=";
   };
 
-  cargoHash = "sha256-BB5oJL5QKceQySr1hzOeCm6TzALfw3Ryw8MHOB0VeaI=";
+  cargoHash = "sha256-o1Gds4UDZRVstPNPaisriUUeX0fabqLrS5TSqXMEB1c=";
 
   nativeBuildInputs = [
     installShellFiles

pkgs/by-name/re/restish/package.nix

@@ -10,13 +10,13 @@
 
 buildGoModule rec {
   pname = "restish";
-  version = "0.21.0";
+  version = "0.21.1";
 
   src = fetchFromGitHub {
     owner = "danielgtaylor";
     repo = "restish";
     tag = "v${version}";
-    hash = "sha256-eLbeH6i+QbW59DMOHf83olrO8R7Ji975KkJKs621Xi0=";
+    hash = "sha256-7x7ejClJezxr+V6xpOMZMd4s+CjOCx1obSSNo97MAbE=";
   };
 
   vendorHash = "sha256-bO0z+LCiF/Dp0hKNulBmCgk16NzCCoY32P2/Ieq8y+c=";

pkgs/by-name/ru/rust-petname/package.nix

@@ -2,25 +2,33 @@
   lib,
   rustPlatform,
   fetchCrate,
+  versionCheckHook,
+  nix-update-script,
 }:
 
-rustPlatform.buildRustPackage rec {
+rustPlatform.buildRustPackage (finalAttrs: {
   pname = "rust-petname";
   version = "2.0.2";
 
   src = fetchCrate {
-    inherit version;
+    inherit (finalAttrs) version;
     crateName = "petname";
     hash = "sha256-KP+GdGlwLHcKE8nAmFr2wHbt5RD9Ptpiz1X5HgJ6BgU=";
   };
 
   cargoHash = "sha256-gZxZeirvGHwm8C87HdCBYr30+0bbjwnWxIQzcLgl3iQ=";
 
-  meta = with lib; {
+  doInstallCheck = true;
+  nativeInstallCheckInputs = [ versionCheckHook ];
+  versionCheckProgramArg = "--version";
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
     description = "Generate human readable random names";
     homepage = "https://github.com/allenap/rust-petname";
-    license = licenses.asl20;
-    maintainers = [ ];
+    license = lib.licenses.asl20;
+    maintainers = [ lib.maintainers.progrm_jarvis ];
     mainProgram = "petname";
   };
-}
+})

pkgs/by-name/se/serie/package.nix

@@ -9,16 +9,16 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "serie";
-  version = "0.5.4";
+  version = "0.5.5";
 
   src = fetchFromGitHub {
     owner = "lusingander";
     repo = "serie";
     rev = "v${version}";
-    hash = "sha256-4F17DArBV3kKQJi24pwD+JE7W9AuAQrxJcU1YTj93os=";
+    hash = "sha256-qbXbbHu8RFSzeexWY/KQKEDnL+pRQPSV8sweCEcv4Kc=";
   };
 
-  cargoHash = "sha256-wvvtlhlgwZylE6tucVcmsGbos6h5Nc8ZfP8zlkcIoqw=";
+  cargoHash = "sha256-lNJY+iNXE+f1haOmNL6OehS5KsLYJMCvF04U5a/AXhA=";
 
   nativeCheckInputs = [ gitMinimal ];
 

pkgs/by-name/sm/smokeping/package.nix

@@ -40,6 +40,7 @@ stdenv.mkDerivation rec {
     NetOpenSSH
     NetSNMP
     LWP
+    LWPProtocolHttps
     IOTty
     fping
     NetDNS

pkgs/by-name/su/super-tiny-icons/package.nix

@@ -7,13 +7,13 @@
 
 stdenvNoCC.mkDerivation {
   pname = "super-tiny-icons";
-  version = "unstable-2023-11-06";
+  version = "0-unstable-2025-10-30";
 
   src = fetchFromGitHub {
     owner = "edent";
     repo = "SuperTinyIcons";
-    rev = "888f449af8fb8df93241204e99fece85b9d225a5";
-    hash = "sha256-L/7CEvG0NPbF8+ysiEHPiPnCMAW3cUu/e3XwtatRdbg=";
+    rev = "621ddf6c231d142cccaa411c3c29001404550624";
+    hash = "sha256-qx3Z64id5kv/OrfEqI77ovGf2X4uHt6wlZrlUo8Nnb0=";
   };
 
   installPhase = ''

pkgs/by-name/sw/switchfin/package.nix

@@ -17,13 +17,13 @@
 
 stdenv.mkDerivation rec {
   pname = "switchfin";
-  version = "0.7.7";
+  version = "0.8.0";
 
   src = fetchFromGitHub {
     owner = "dragonflylee";
     repo = "switchfin";
     rev = version;
-    hash = "sha256-swNwaZg6W5Ox08poc3gC3MOsIHv08/Q9BOMwD9FNf3g=";
+    hash = "sha256-5W1lUnblXQi8G8+emQ2oU+PYxire0Lwza/j/JESCytw=";
     fetchSubmodules = true;
   };
 

pkgs/by-name/un/unifi/package.nix

@@ -10,12 +10,12 @@
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "unifi-controller";
-  version = "10.0.156";
+  version = "10.0.161";
 
   # see https://community.ui.com/releases / https://www.ui.com/download/unifi
   src = fetchurl {
     url = "https://dl.ui.com/unifi/${finalAttrs.version}/unifi_sysvinit_all.deb";
-    hash = "sha256-FlWsCAH6HN7HzoTLJET36FhGi/ci52jSP7132ayKvpA=";
+    hash = "sha256-vk7t9WRR65BPlHspZGmpVc1XUy/OHANRJpR3jI+2wtI=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/vi/victorialogs/package.nix

@@ -48,11 +48,7 @@ buildGoModule (finalAttrs: {
   __darwinAllowLocalNetworking = true;
 
   passthru = {
-    tests = {
-      inherit (nixosTests)
-        victorialogs
-        ;
-    };
+    tests = lib.recurseIntoAttrs nixosTests.victorialogs;
     updateScript = nix-update-script { };
   };
 

pkgs/by-name/vi/victoriametrics/package.nix

@@ -77,9 +77,7 @@ buildGoModule (finalAttrs: {
   __darwinAllowLocalNetworking = true;
 
   passthru = {
-    tests = {
-      inherit (nixosTests) victoriametrics;
-    };
+    tests = lib.recurseIntoAttrs nixosTests.victoriametrics;
     updateScript = ./update.sh;
   };
 

pkgs/by-name/vi/victoriatraces/package.nix

@@ -47,9 +47,7 @@ buildGoModule (finalAttrs: {
   __darwinAllowLocalNetworking = true;
 
   passthru = {
-    tests = {
-      inherit (nixosTests) victoriatraces;
-    };
+    tests = lib.recurseIntoAttrs nixosTests.victoriatraces;
     updateScript = nix-update-script { };
   };
 

pkgs/by-name/vo/vorta/package.nix

@@ -11,14 +11,14 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "vorta";
-  version = "0.10.3";
+  version = "0.11.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "borgbase";
     repo = "vorta";
     tag = "v${version}";
-    hash = "sha256-VhM782mFWITA0VlKw0sBIu/UxUqlFLgq5XVdCpQggCw=";
+    hash = "sha256-/60KVJGKNz3aouv5jzubFlz+AxPEbRDSv4ZO9MEi3V0=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/ze/zerofs/package.nix

@@ -1,27 +1,30 @@
 {
   stdenv,
   lib,
-  rustPlatform,
+  cmake,
   fetchFromGitHub,
-  rust-jemalloc-sys,
-  versionCheckHook,
   nix-update-script,
+  rust-jemalloc-sys,
+  rustPlatform,
+  versionCheckHook,
 }:
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "zerofs";
-  version = "0.19.2";
+  version = "0.20.0";
 
   src = fetchFromGitHub {
     owner = "Barre";
     repo = "ZeroFS";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-okknSZXs82mfVgiKp5Gb+DuYogZ+g7hluF1ua+IAw8A=";
+    hash = "sha256-8iPHIUESModoNFk8XEWjHZOGBOPxhOGM9gHaljWyqZg=";
   };
 
   sourceRoot = "${finalAttrs.src.name}/zerofs";
 
-  cargoHash = "sha256-vhiI/t6WF+QZhkUpL893nQvvbRzgQkmXD7tuSeMAFyE=";
+  cargoHash = "sha256-JZerQne+jW6xjH13dQe3g1dD07BP3j+1DSF+a/SgGXc=";
+
+  nativeBuildInputs = [ cmake ];
 
   buildInputs = [ rust-jemalloc-sys ];
 

pkgs/by-name/zg/zgrab2/package.nix

@@ -6,16 +6,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "zgrab2";
-  version = "0.2.0";
+  version = "1.0.0";
 
   src = fetchFromGitHub {
     owner = "zmap";
     repo = "zgrab2";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-9YDrWtSFFzFMN/pp0Kaknie4NMduOb/ZNrP+7MIMT+0=";
+    hash = "sha256-rvQum+Mjpuz2XRgTY94CTqJ6Tvi78Kdd3CCMHvYZQgE=";
   };
 
-  vendorHash = "sha256-8oidWUtSMMm/QMzrTkH07eyyBhCeZ9SUOO1+h1evbac=";
+  vendorHash = "sha256-ag2VWBNv2u/DXWWsSLBfRscm3++AjxgrGfw8JUlhnRo=";
 
   subPackages = [
     "cmd/zgrab2"
@@ -23,8 +23,8 @@ buildGoModule (finalAttrs: {
 
   meta = {
     description = "Fast Application Layer Scanner";
-    mainProgram = "zgrab2";
     homepage = "https://github.com/zmap/zgrab2";
+    changelog = "https://github.com/zmap/zgrab2/releases/tag/vv${finalAttrs.version}";
     license = with lib.licenses; [
       asl20
       isc
@@ -33,5 +33,6 @@ buildGoModule (finalAttrs: {
       fab
       juliusrickert
     ];
+    mainProgram = "zgrab2";
   };
 })

pkgs/development/libraries/nss/latest.nix

@@ -5,8 +5,8 @@
 #       Example: nix-shell ./maintainers/scripts/update.nix --argstr package cacert
 
 import ./generic.nix {
-  version = "3.118.1";
-  hash = "sha256-jpBJzXLljvobG8O8BB1JiJJmnp+Ma36SOHcl9LuimVw=";
+  version = "3.119";
+  hash = "sha256-Lz2zWWjcneJ5X4sfOvPzEewMAKyDU7PluhWPV5E3By4=";
   filename = "latest.nix";
   versionRegex = "NSS_(\\d+)_(\\d+)(?:_(\\d+))?_RTM";
 }

pkgs/development/ocaml-modules/dns/default.nix

@@ -18,13 +18,13 @@
 
 buildDunePackage (finalAttrs: {
   pname = "dns";
-  version = "10.2.2";
+  version = "10.2.3";
 
   minimalOCamlVersion = "4.13";
 
   src = fetchurl {
     url = "https://github.com/mirage/ocaml-dns/releases/download/v${finalAttrs.version}/dns-${finalAttrs.version}.tbz";
-    hash = "sha256-USPXFn9fs6WrcM8LPMyWUInsRA3Aft6r+MBWjuc3p/A=";
+    hash = "sha256-yJWy0RLEqmDAmHoJ61nw2WAr2AT+z0EkeVvhbkqGc0o=";
   };
 
   propagatedBuildInputs = [

pkgs/development/python-modules/ansible-compat/default.nix

@@ -23,14 +23,14 @@
 
 buildPythonPackage rec {
   pname = "ansible-compat";
-  version = "25.11.0";
+  version = "25.12.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "ansible";
     repo = "ansible-compat";
     tag = "v${version}";
-    hash = "sha256-UzrZOUWKeU/4tnc7o5JQqNKsFcLhCKVwXT+2hZXXcbw=";
+    hash = "sha256-nn0NKX6rqNKrSZd+p/oq/LmESAgvTkSOA08wq1xLY2I=";
   };
 
   build-system = [

pkgs/development/python-modules/awscrt/default.nix

@@ -10,12 +10,12 @@
 
 buildPythonPackage rec {
   pname = "awscrt";
-  version = "0.29.1";
+  version = "0.29.2";
   pyproject = true;
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-j8MEr19vg+fnMJb7QutR1Khfp6kEVkZu8ihyCV1MpG8=";
+    hash = "sha256-x42BsTCNQv2h6yHSf88mV5E3uCEEPlKFUPLPxsCauf8=";
   };
 
   build-system = [ setuptools ];

pkgs/development/python-modules/debugpy/default.nix

@@ -32,15 +32,20 @@ buildPythonPackage rec {
     owner = "microsoft";
     repo = "debugpy";
     tag = "v${version}";
+
+    # Upstream uses .gitattributes to inject information about the revision
+    # hash and the refname into `src/debugpy/_version.py`, see:
+    #
+    # - https://git-scm.com/docs/gitattributes#_export_subst and
+    # - https://github.com/microsoft/debugpy/blob/v1.8.17/src/debugpy/_version.py#L24-L30
+    postFetch = ''
+      sed -i 's/git_refnames = "[^"]*"/git_refnames = " (tag: ${src.tag})"/' "$out/src/debugpy/_version.py"
+    '';
+
     hash = "sha256-eAiCtSJUqLASapxnYCyq1UCiGz6QmKQum7Vs3MoU1s8=";
   };
 
   patches = [
-    # Use nixpkgs version instead of versioneer
-    (replaceVars ./hardcode-version.patch {
-      inherit version;
-    })
-
     # Fix importing debugpy in:
     # - test_nodebug[module-launch(externalTerminal)]
     # - test_nodebug[module-launch(integratedTerminal)]

pkgs/development/python-modules/debugpy/hardcode-version.patch

@@ -1,47 +0,0 @@
-diff --git a/setup.py b/setup.py
-index d16a27c5..a7e407e1 100644
---- a/setup.py
-+++ b/setup.py
-@@ -12,7 +12,6 @@ import sys
- 
- 
- sys.path.insert(0, os.path.dirname(os.path.abspath(__file__)))
--import versioneer  # noqa
- 
- del sys.path[0]
- 
-@@ -145,13 +144,13 @@ if __name__ == "__main__":
-     if platforms is not None:
-         extras["platforms"] = platforms
- 
--    cmds = versioneer.get_cmdclass()
-+    cmds = {}
-     override_build(cmds)
-     override_build_py(cmds)
- 
-     setuptools.setup(
-         name="debugpy",
--        version=versioneer.get_version(),
-+        version="@version@",
-         description="An implementation of the Debug Adapter Protocol for Python",  # noqa
-         long_description=long_description,
-         long_description_content_type="text/markdown",
-diff --git a/src/debugpy/public_api.py b/src/debugpy/public_api.py
-index c61a2607..f26f8272 100644
---- a/src/debugpy/public_api.py
-+++ b/src/debugpy/public_api.py
-@@ -7,8 +7,6 @@ from __future__ import annotations
- import functools
- import typing
- 
--from debugpy import _version
--
- 
- # Expose debugpy.server API from subpackage, but do not actually import it unless
- # and until a member is invoked - we don't want the server package loaded in the
-@@ -192,4 +190,4 @@ def trace_this_thread(__should_trace: bool):
-     """
- 
- 
--__version__: str = _version.get_versions()["version"]
-+__version__: str = "@version@"

pkgs/development/python-modules/hvac/default.nix

@@ -10,14 +10,14 @@
 
 buildPythonPackage rec {
   pname = "hvac";
-  version = "2.3.0";
+  version = "2.4.0";
   format = "pyproject";
 
   disabled = pythonOlder "3.8";
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-G4XjMg6GQt2C8jTbYyU82haagXWJ6CNxPcX8qDEZseI=";
+    hash = "sha256-4AVq2QZOeSPodOZ2kBWwMlgLY54pJG9asQRPeVnBx+A=";
   };
 
   nativeBuildInputs = [ poetry-core ];

pkgs/development/python-modules/llama-cloud/default.nix

@@ -5,20 +5,17 @@
   httpx,
   poetry-core,
   pydantic,
-  pythonOlder,
 }:
 
 buildPythonPackage rec {
   pname = "llama-cloud";
-  version = "0.1.44";
+  version = "0.1.45";
   pyproject = true;
 
-  disabled = pythonOlder "3.8";
-
   src = fetchPypi {
     pname = "llama_cloud";
     inherit version;
-    hash = "sha256-J2orT5RGPaA3QxyjBjMxs7a+OYu/sAMRPudrfCqHO1M=";
+    hash = "sha256-FAJEAIzFcQ4xrpfGBDlzo6mWmlGw84FV+jOoQ0B46Ko=";
   };
 
   build-system = [ poetry-core ];

pkgs/development/python-modules/mozart-api/default.nix

@@ -18,13 +18,13 @@
 
 buildPythonPackage rec {
   pname = "mozart-api";
-  version = "5.1.0.247.1";
+  version = "5.3.1.108.0";
   pyproject = true;
 
   src = fetchPypi {
     pname = "mozart_api";
     inherit version;
-    hash = "sha256-//4mJh+Vf/NdnQmX19EOhn+Lx+BTMbZE5xwG6kXs84Y=";
+    hash = "sha256-12qjXQKQS3k1hDRLW0UkR5OqHM/QmXKOnfoJVguhHWQ=";
   };
 
   build-system = [ poetry-core ];

pkgs/development/python-modules/peft/default.nix

@@ -31,14 +31,14 @@
 
 buildPythonPackage rec {
   pname = "peft";
-  version = "0.17.1";
+  version = "0.18.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "huggingface";
     repo = "peft";
     tag = "v${version}";
-    hash = "sha256-xtpxwbKf7ZaUYblGdwtPZE09qrlBQTMm5oryUJwa6AA=";
+    hash = "sha256-LLV6fMFPh45IvNJv9totMYDoKAkZW/1Bx3qOlDTWMLA=";
   };
 
   build-system = [ setuptools ];
@@ -73,6 +73,8 @@ buildPythonPackage rec {
   # These tests fail when MPS devices are detected
   disabledTests = lib.optional stdenv.hostPlatform.isDarwin [
     "gpu"
+    "test_save_load"
+    "test_resume_training_model_with_topk_weights"
   ];
 
   disabledTestPaths = [
@@ -81,6 +83,7 @@ buildPythonPackage rec {
 
     # Require internet access to download a dataset
     "tests/test_adaption_prompt.py"
+    "tests/test_arrow.py"
     "tests/test_auto.py"
     "tests/test_boft.py"
     "tests/test_cpt.py"
@@ -92,10 +95,10 @@ buildPythonPackage rec {
     "tests/test_hub_features.py"
     "tests/test_incremental_pca.py"
     "tests/test_initialization.py"
+    "tests/test_lora_variants.py"
     "tests/test_mixed.py"
     "tests/test_multitask_prompt_tuning.py"
     "tests/test_other.py"
-    "tests/test_other.py"
     "tests/test_poly.py"
     "tests/test_stablediffusion.py"
     "tests/test_trainable_tokens.py"

pkgs/development/python-modules/prometheus-api-client/default.nix

@@ -14,14 +14,14 @@
 
 buildPythonPackage rec {
   pname = "prometheus-api-client";
-  version = "0.6.0";
+  version = "0.7.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "4n4nd";
     repo = "prometheus-api-client-python";
     tag = "v${version}";
-    hash = "sha256-Xi3n1Ha6bpfp4KfCh/Zky7bBrXOojuR6BVzPNQ3a18Y=";
+    hash = "sha256-dpvGvI37jMoWvMrVSCwiyendGCDLCw+s2TI04y8akx8=";
   };
 
   build-system = [ setuptools ];

pkgs/development/python-modules/ripser/default.nix

@@ -20,14 +20,14 @@
 
 buildPythonPackage rec {
   pname = "ripser";
-  version = "0.6.12";
+  version = "0.6.13";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "scikit-tda";
     repo = "ripser.py";
     tag = "v${version}";
-    hash = "sha256-AviAcpaK0UWqa6spba9bLmBQnprINCrZC/wuRLqiXVA=";
+    hash = "sha256-m6EJrz0RBuKlzDX41Gm/W2k71YQK9CgfZN4o84cQYCs=";
   };
 
   build-system = [

pkgs/development/python-modules/stringzilla/default.nix

@@ -10,14 +10,14 @@
 
 buildPythonPackage rec {
   pname = "stringzilla";
-  version = "4.3.0";
+  version = "4.4.2";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "ashvardanian";
     repo = "stringzilla";
     tag = "v${version}";
-    hash = "sha256-MitvjIb+mBK22hxjtqbVB6kYP7pdvF5LxWiS2R/6Jk4=";
+    hash = "sha256-o3MrIPzu61Zod6RpmWA356hlquVPQKu7+aYZrqxjMjo=";
   };
 
   build-system = [
@@ -34,6 +34,11 @@ buildPythonPackage rec {
 
   enabledTestPaths = [ "scripts/test_stringzilla.py" ];
 
+  disabledTests = [
+    # test downloads CaseFolding.txt from unicode.org
+    "test_utf8_case_fold_all_codepoints"
+  ];
+
   meta = {
     changelog = "https://github.com/ashvardanian/StringZilla/releases/tag/${src.tag}";
     description = "SIMD-accelerated string search, sort, hashes, fingerprints, & edit distances";

pkgs/development/python-modules/twilio/default.nix

@@ -19,14 +19,14 @@
 
 buildPythonPackage rec {
   pname = "twilio";
-  version = "9.8.7";
+  version = "9.8.8";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "twilio";
     repo = "twilio-python";
     tag = version;
-    hash = "sha256-jGuPJ/nTo+oYqnwwwZDFLnpHcEyErgCPB5pO31g9WNA=";
+    hash = "sha256-q3NjNe7SiqL2HgRkuoChesD333q3vw+aVkSASc6gDQk=";
   };
 
   build-system = [ setuptools ];

pkgs/development/python-modules/types-aiobotocore/default.nix

@@ -364,13 +364,13 @@
 
 buildPythonPackage rec {
   pname = "types-aiobotocore";
-  version = "2.25.2";
+  version = "2.26.0.post1";
   pyproject = true;
 
   src = fetchPypi {
     pname = "types_aiobotocore";
     inherit version;
-    hash = "sha256-ayRYrBwJmd4LpKHc+/O8DVx8ouoMcvZzKr5n0I6/AkA=";
+    hash = "sha256-oKrbnf0Q7LK8pLLqxZxxp1NrUBRfMCeuv4AIRYklLtQ=";
   };
 
   build-system = [ setuptools ];

pkgs/development/python-modules/uxsim/default.nix

@@ -18,14 +18,14 @@
 }:
 buildPythonPackage rec {
   pname = "uxsim";
-  version = "1.10.2";
+  version = "1.11.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "toruseo";
     repo = "UXsim";
     tag = "v${version}";
-    hash = "sha256-GK1tD0STBCR0Z/JHdhrgLun6t2snJqi/oFGUOeiXk6c=";
+    hash = "sha256-q8L6UkKL+M9zgax6jjxwkFrwayaxMTYJRfWt8Rnj00I=";
   };
 
   patches = [ ./add-qt-plugin-path-to-env.patch ];

pkgs/development/python-modules/xknx/default.nix

@@ -12,14 +12,14 @@
 
 buildPythonPackage rec {
   pname = "xknx";
-  version = "3.11.0";
+  version = "3.12.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "XKNX";
     repo = "xknx";
     tag = version;
-    hash = "sha256-jWnDiGg7vjIt4xkqjKrauExnvHcrH8m0RGfHjQlljFY=";
+    hash = "sha256-Sb/qPLINeYt96s7NkRARcb0ZrcE6A0ByyENVd5aiHxk=";
   };
 
   build-system = [ setuptools ];

pkgs/development/python-modules/zxcvbn-rs-py/default.nix

@@ -8,7 +8,7 @@
 
 buildPythonPackage rec {
   pname = "zxcvbn-rs-py";
-  version = "0.2.0";
+  version = "0.3.0";
 
   pyproject = true;
 
@@ -17,7 +17,7 @@ buildPythonPackage rec {
   src = fetchPypi {
     pname = "zxcvbn_rs_py";
     inherit version;
-    hash = "sha256-DQzdOngHGZma2NyfrNuMppG6GzpGoKfwVQGUVmN7erA=";
+    hash = "sha256-0nQmgII6F0gj8HCnNAdLvowWBPExPAgXCxWAJuNsc6A=";
   };
 
   build-system = [
@@ -27,7 +27,7 @@ buildPythonPackage rec {
 
   cargoDeps = rustPlatform.fetchCargoVendor {
     inherit pname version src;
-    hash = "sha256-WkaTEoVQVOwxcTyOIG5oHEvcv65fBEpokl3/6SxqiUw=";
+    hash = "sha256-S6K6ZzW24V2yFV89B+gN+Odc4h3R45lF+emZs69dzYg=";
   };
 
   pythonImportsCheck = [ "zxcvbn_rs_py" ];

pkgs/games/openttd/default.nix

@@ -50,7 +50,7 @@ let
 
   openmsx = fetchzip {
     url = "https://cdn.openttd.org/openmsx-releases/0.4.2/openmsx-0.4.2-all.zip";
-    hash = "sha256-Cgrg2m+uTODFg39mKgX+hE8atV7v5bVyZd716vSZB8M=";
+    hash = "sha256-ysNFIvo7iaLN8XoaeZuZQFLpBZlYUDLDg7rH6TabaHY=";
   };
 
   # OpenTTD builds and uses some of its own tools during the build and we need those to be available for cross-compilation.

pkgs/servers/monitoring/grafana/plugins/grafana-metricsdrilldown-app/default.nix

@@ -2,8 +2,8 @@
 
 grafanaPlugin {
   pname = "grafana-metricsdrilldown-app";
-  version = "1.0.23";
-  zipHash = "sha256-ZQYVKLmIFsK9+u8lVR4Y/gVTtv0klDaSM7Yh+oe0qOE=";
+  version = "1.0.24";
+  zipHash = "sha256-aoivPnxr8/8EQhz3hD/WAgvfwQ3nUXWjs22izx7yDp8=";
   meta = with lib; {
     description = "Queryless experience for browsing Prometheus-compatible metrics. Quickly find related metrics without writing PromQL queries";
     license = licenses.agpl3Only;

pkgs/servers/sql/postgresql/ext/pg-gvm.nix

@@ -14,13 +14,13 @@
 
 postgresqlBuildExtension (finalAttrs: {
   pname = "pg-gvm";
-  version = "22.6.11";
+  version = "22.6.12";
 
   src = fetchFromGitHub {
     owner = "greenbone";
     repo = "pg-gvm";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-jkpZg1LMWuH5R4I/kTO3cofL3uNt11yXSgfFppSNC+o=";
+    hash = "sha256-x+RTB4/Uj8Cif+JTVQjRU0UZxa3+LHwtooJi9eoB8vE=";
   };
 
   nativeBuildInputs = [

pkgs/shells/fish/plugins/done.nix

@@ -7,13 +7,13 @@
 
 buildFishPlugin rec {
   pname = "done";
-  version = "1.20.0";
+  version = "1.20.1";
 
   src = fetchFromGitHub {
     owner = "franciscolourenco";
     repo = "done";
     rev = version;
-    hash = "sha256-WA6DBrPBuXRIloO05UBunTJ9N01d6tO1K1uqojjO0mo=";
+    hash = "sha256-GXKchepYti5Pb1ODFeJL3apDGg7Tn69skQQhvV2nSeQ=";
   };
 
   checkPlugins = [ fishtape ];

pkgs/tools/package-management/lix/default.nix

@@ -23,6 +23,7 @@
   nix-serve-ng,
   colmena,
   nix-update,
+  nix-init,
 
   storeDir ? "/nix/store",
   stateDir ? "/nix/var",
@@ -136,6 +137,10 @@ let
             nix = self.lix;
             inherit (self) nixpkgs-review;
           };
+
+          nix-init = nix-init.override {
+            nix = self.lix;
+          };
         };
     };