Merge staging-next into staging

maintainers/maintainer-list.nix

@@ -2580,6 +2580,12 @@
     github = "axelkar";
     githubId = 120189068;
   };
+  axler1 = {
+    name = "Alexander Gonzalez";
+    email = "blue.coral070@slmails.com";
+    github = "Axler1";
+    githubId = 69816272;
+  };
   ayazhafiz = {
     email = "ayaz.hafiz.1@gmail.com";
     github = "hafiz";

nixos/doc/manual/release-notes/rl-2505.section.md

@@ -60,8 +60,6 @@
 
 - [Bonsai](https://git.sr.ht/~stacyharper/bonsai), a general-purpose event mapper/state machine primarily used to create complex key shortcuts, and as part of the [SXMO](https://sxmo.org/) desktop environment. Available as [services.bonsaid](#opt-services.bonsaid.enable).
 
-- [archtika](https://github.com/archtika/archtika), a FLOSS, modern, performant, lightweight and self‑hosted CMS. Available as [services.archtika](#opt-services.archtika.enable).
-
 - [scanservjs](https://github.com/sbs20/scanservjs/), a web UI for SANE scanners. Available at [services.scanservjs](#opt-services.scanservjs.enable).
 
 - [Kimai](https://www.kimai.org/), a web-based multi-user time-tracking application. Available as [services.kimai](options.html#opt-services.kimai).
@@ -220,6 +218,8 @@
 
 - [GLPI-Agent](https://github.com/glpi-project/glpi-agent), GLPI Agent. Available as [services.glpiAgent](options.html#opt-services.glpiAgent.enable).
 
+- [pgBackRest](https://pgbackrest.org), a reliable backup and restore solution for PostgreSQL. Available as [services.pgbackrest](options.html#opt-services.pgbackrest.enable).
+
 - [Recyclarr](https://github.com/recyclarr/recyclarr) a TRaSH Guides synchronizer for Sonarr and Radarr. Available as [services.recyclarr](#opt-services.recyclarr.enable).
 
 - [Rebuilderd](https://github.com/kpcyrd/rebuilderd) an independent verification of binary packages - Reproducible Builds. Available as [services.rebuilderd](#opt-services.rebuilderd.enable).
@@ -341,6 +341,8 @@
 
 - The behavior of the `networking.nat.externalIP` and `networking.nat.externalIPv6` options has been changed. `networking.nat.forwardPorts` now only forwards packets destined for the specified IP addresses.
 
+- `services.gitlab` now requires the setting of `activeRecordPrimaryKeyFile`, `activeRecordDeterministicKeyFile`, `activeRecordSaltFile` as GitLab introduced Rails ActiveRecord encryption.
+
 - `python3Packages.bpycv` has been removed due to being incompatible with Blender 4 and unmaintained.
 
 - `python3Packages.jaeger-client` was removed because it was deprecated upstream. [OpenTelemetry](https://opentelemetry.io) is the recommended replacement.

nixos/modules/module-list.nix

@@ -440,6 +440,7 @@
   ./services/backup/duplicati.nix
   ./services/backup/duplicity.nix
   ./services/backup/mysql-backup.nix
+  ./services/backup/pgbackrest.nix
   ./services/backup/postgresql-backup.nix
   ./services/backup/postgresql-wal-receiver.nix
   ./services/backup/restic-rest-server.nix
@@ -1502,7 +1503,6 @@
   ./services/web-apps/akkoma.nix
   ./services/web-apps/alps.nix
   ./services/web-apps/anuko-time-tracker.nix
-  ./services/web-apps/archtika.nix
   ./services/web-apps/artalk.nix
   ./services/web-apps/audiobookshelf.nix
   ./services/web-apps/baikal.nix

nixos/modules/services/backup/pgbackrest.nix

@@ -0,0 +1,426 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+let
+  cfg = config.services.pgbackrest;
+
+  settingsFormat = pkgs.formats.ini {
+    listsAsDuplicateKeys = true;
+  };
+
+  # pgBackRest "options"
+  settingsType =
+    with lib.types;
+    attrsOf (oneOf [
+      bool
+      ints.unsigned
+      str
+      (attrsOf str)
+      (listOf str)
+    ]);
+
+  # Applied to both repoNNN-* and pgNNN-* options in global and stanza sections.
+  flattenWithIndex =
+    attrs: prefix:
+    lib.concatMapAttrs (
+      name:
+      let
+        index = lib.lists.findFirstIndex (n: n == name) null (lib.attrNames attrs);
+        index1 = index + 1;
+      in
+      lib.mapAttrs' (option: lib.nameValuePair "${prefix}${toString index1}-${option}")
+    ) attrs;
+
+  # Remove nulls, turn attrsets into lists and bools into y/n
+  normalize =
+    x:
+    lib.pipe x [
+      (lib.filterAttrs (_: v: v != null))
+      (lib.mapAttrs (_: v: if lib.isAttrs v then lib.mapAttrsToList (n': v': "${n'}=${v'}") v else v))
+      (lib.mapAttrs (
+        _: v:
+        if v == true then
+          "y"
+        else if v == false then
+          "n"
+        else
+          v
+      ))
+    ];
+
+  fullConfig =
+    {
+      global = normalize (cfg.settings // flattenWithIndex cfg.repos "repo");
+    }
+    // lib.mapAttrs (
+      _: cfg': normalize (cfg'.settings // flattenWithIndex cfg'.instances "pg")
+    ) cfg.stanzas;
+
+  namedJobs = lib.listToAttrs (
+    lib.flatten (
+      lib.mapAttrsToList (
+        stanza:
+        { jobs, ... }:
+        lib.mapAttrsToList (
+          job: attrs: lib.nameValuePair "pgbackrest-${stanza}-${job}" (attrs // { inherit stanza job; })
+        ) jobs
+      ) cfg.stanzas
+    )
+  );
+
+  disabledOption = lib.mkOption {
+    default = null;
+    readOnly = true;
+    internal = true;
+  };
+
+  secretPathOption =
+    with lib.types;
+    lib.mkOption {
+      type = nullOr (pathWith {
+        inStore = false;
+        absolute = true;
+      });
+      default = null;
+      internal = true;
+    };
+in
+
+{
+  meta = {
+    maintainers = with lib.maintainers; [ wolfgangwalther ];
+  };
+
+  # TODO: Add enableServer option and corresponding pgBackRest TLS server service.
+  # TODO: Allow command-specific options
+  # TODO: Write wrapper around pgbackrest to turn --repo=<name> into --repo=<number>
+  # The following two are dependent on improvements upstream:
+  #   https://github.com/pgbackrest/pgbackrest/issues/2621
+  # TODO: Add support for more repository types
+  # TODO: Support passing encryption key safely
+  options.services.pgbackrest = {
+    enable = lib.mkEnableOption "pgBackRest";
+
+    repos = lib.mkOption {
+      type =
+        with lib.types;
+        attrsOf (
+          submodule (
+            { config, name, ... }:
+            let
+              setHostForType =
+                type:
+                if name == "localhost" then
+                  null
+                # "posix" is the default repo type, which uses the -host option.
+                # Other types use prefixed options, for example -sftp-host.
+                else if config.type or "posix" != type then
+                  null
+                else
+                  name;
+            in
+            {
+              freeformType = settingsType;
+
+              options.host = lib.mkOption {
+                type = nullOr str;
+                default = setHostForType "posix";
+                defaultText = lib.literalExpression "name";
+                description = "Repository host when operating remotely";
+              };
+
+              options.sftp-host = lib.mkOption {
+                type = nullOr str;
+                default = setHostForType "sftp";
+                defaultText = lib.literalExpression "name";
+                description = "SFTP repository host";
+              };
+
+              options.sftp-private-key-file = lib.mkOption {
+                type = nullOr (pathWith {
+                  inStore = false;
+                  absolute = true;
+                });
+                default = null;
+                description = ''
+                  SFTP private key file.
+
+                  The file must be accessible by both the pgbackrest and the postgres users.
+                '';
+              };
+
+              # The following options should not be used; they would store secrets in the store.
+              options.azure-key = disabledOption;
+              options.cipher-pass = disabledOption;
+              options.s3-key = disabledOption;
+              options.s3-key-secret = disabledOption;
+              options.s3-kms-key-id = disabledOption; # unsure whether that's a secret or not
+              options.s3-sse-customer-key = disabledOption; # unsure whether that's a secret or not
+              options.s3-token = disabledOption;
+              options.sftp-private-key-passphrase = disabledOption;
+
+              # The following options are not fully supported / tested, yet, but point to files with secrets.
+              # Users can already set those options, but we'll force non-store paths.
+              options.gcs-key = secretPathOption;
+              options.host-cert-file = secretPathOption;
+              options.host-key-file = secretPathOption;
+            }
+          )
+        );
+      default = { };
+      description = ''
+        An attribute set of repositories as described in:
+        <https://pgbackrest.org/configuration.html#section-repository>
+
+        Each repository defaults to set `repo-host` to the attribute's name.
+        The special value "localhost" will unset `repo-host`.
+
+        ::: {.note}
+        The prefix `repoNNN-` is added automatically.
+        Example: Use `path` instead of `repo1-path`.
+        :::
+      '';
+      example = lib.literalExpression ''
+        {
+          localhost.path = "/var/lib/backup";
+          "backup.example.com".host-type = "tls";
+        }
+      '';
+    };
+
+    stanzas = lib.mkOption {
+      type =
+        with lib.types;
+        attrsOf (submodule {
+          options = {
+            jobs = lib.mkOption {
+              type = lib.types.attrsOf (
+                lib.types.submodule {
+                  options.schedule = lib.mkOption {
+                    type = lib.types.str;
+                    description = ''
+                      When or how often the backup should run.
+                      Must be in the format described in {manpage}`systemd.time(7)`.
+                    '';
+                  };
+
+                  options.type = lib.mkOption {
+                    type = lib.types.str;
+                    description = ''
+                      Backup type as described in:
+                      <https://pgbackrest.org/command.html#command-backup/category-command/option-type>
+                    '';
+                  };
+                }
+              );
+              default = { };
+              description = ''
+                Backups jobs to schedule for this stanza as described in:
+                <https://pgbackrest.org/user-guide.html#quickstart/schedule-backup>
+              '';
+              example = lib.literalExpression ''
+                {
+                  weekly = { schedule = "Sun, 6:30"; type = "full"; };
+                  daily = { schedule = "Mon..Sat, 6:30"; type = "diff"; };
+                }
+              '';
+            };
+
+            instances = lib.mkOption {
+              type =
+                with lib.types;
+                attrsOf (
+                  submodule (
+                    { name, ... }:
+                    {
+                      freeformType = settingsType;
+                      options.host = lib.mkOption {
+                        type = nullOr str;
+                        default = if name == "localhost" then null else name;
+                        defaultText = lib.literalExpression ''if name == "localhost" then null else name'';
+                        description = "PostgreSQL host for operating remotely.";
+                      };
+
+                      # The following options are not fully supported / tested, yet, but point to files with secrets.
+                      # Users can already set those options, but we'll force non-store paths.
+                      options.host-cert-file = secretPathOption;
+                      options.host-key-file = secretPathOption;
+                    }
+                  )
+                );
+              default = { };
+              description = ''
+                An attribute set of database instances as described in:
+                <https://pgbackrest.org/configuration.html#section-stanza>
+
+                Each instance defaults to set `pg-host` to the attribute's name.
+                The special value "localhost" will unset `pg-host`.
+
+                ::: {.note}
+                The prefix `pgNNN-` is added automatically.
+                Example: Use `user` instead of `pg1-user`.
+                :::
+              '';
+              example = lib.literalExpression ''
+                {
+                  localhost.database = "app";
+                  "postgres.example.com".port = "5433";
+                }
+              '';
+            };
+
+            settings = lib.mkOption {
+              type = lib.types.submodule {
+                freeformType = settingsType;
+
+                # The following options are not fully supported / tested, yet, but point to files with secrets.
+                # Users can already set those options, but we'll force non-store paths.
+                options.tls-server-cert-file = secretPathOption;
+                options.tls-server-key-file = secretPathOption;
+              };
+              default = { };
+              description = ''
+                An attribute set of options as described in:
+                <https://pgbackrest.org/configuration.html>
+
+                All options can be used.
+                Repository options should be set via [`repos`](#opt-services.pgbackrest.repos) instead.
+                Stanza options should be set via [`instances`](#opt-services.pgbackrest.stanzas._name_.instances) instead.
+              '';
+              example = lib.literalExpression ''
+                {
+                  process-max = 2;
+                }
+              '';
+            };
+          };
+        });
+      default = { };
+      description = ''
+        An attribute set of stanzas as described in:
+        <https://pgbackrest.org/user-guide.html#quickstart/configure-stanza>
+      '';
+    };
+
+    settings = lib.mkOption {
+      type = lib.types.submodule {
+        freeformType = settingsType;
+
+        # The following options are not fully supported / tested, yet, but point to files with secrets.
+        # Users can already set those options, but we'll force non-store paths.
+        options.tls-server-cert-file = secretPathOption;
+        options.tls-server-key-file = secretPathOption;
+      };
+      default = { };
+      description = ''
+        An attribute set of options as described in:
+        <https://pgbackrest.org/configuration.html>
+
+        All globally available options, i.e. all except stanza options, can be used.
+        Repository options should be set via [`repos`](#opt-services.pgbackrest.repos) instead.
+      '';
+      example = lib.literalExpression ''
+        {
+          process-max = 2;
+        }
+      '';
+    };
+  };
+
+  config = lib.mkIf cfg.enable (
+    lib.mkMerge [
+      {
+        services.pgbackrest.settings = {
+          log-level-console = lib.mkDefault "info";
+          log-level-file = lib.mkDefault "off";
+          cmd-ssh = lib.getExe pkgs.openssh;
+        };
+
+        environment.systemPackages = [ pkgs.pgbackrest ];
+        environment.etc."pgbackrest/pgbackrest.conf".source =
+          settingsFormat.generate "pgbackrest.conf" fullConfig;
+
+        users.users.pgbackrest = {
+          name = "pgbackrest";
+          group = "pgbackrest";
+          description = "pgBackRest service user";
+          isSystemUser = true;
+          useDefaultShell = true;
+          createHome = true;
+          home = cfg.repos.localhost.path or "/var/lib/pgbackrest";
+        };
+        users.groups.pgbackrest = { };
+
+        systemd.services = lib.mapAttrs (
+          _:
+          {
+            stanza,
+            job,
+            type,
+            ...
+          }:
+          {
+            description = "pgBackRest job ${job} for stanza ${stanza}";
+
+            serviceConfig = {
+              User = "pgbackrest";
+              Group = "pgbackrest";
+              Type = "oneshot";
+              # stanza-create is idempotent, so safe to always run
+              ExecStartPre = "${lib.getExe pkgs.pgbackrest} --stanza='${stanza}' stanza-create";
+              ExecStart = "${lib.getExe pkgs.pgbackrest} --stanza='${stanza}' backup --type='${type}'";
+            };
+          }
+        ) namedJobs;
+
+        systemd.timers = lib.mapAttrs (
+          name:
+          {
+            stanza,
+            job,
+            schedule,
+            ...
+          }:
+          {
+            description = "pgBackRest job ${job} for stanza ${stanza}";
+            wantedBy = [ "timers.target" ];
+            after = [ "network-online.target" ];
+            wants = [ "network-online.target" ];
+            timerConfig = {
+              OnCalendar = schedule;
+              Persistent = true;
+              Unit = "${name}.service";
+            };
+          }
+        ) namedJobs;
+      }
+
+      # The default stanza is set up for the local postgresql instance.
+      # It does not backup automatically, the systemd timer still needs to be set.
+      (lib.mkIf config.services.postgresql.enable {
+        services.pgbackrest.stanzas.default = {
+          settings.cmd = lib.getExe pkgs.pgbackrest;
+          instances.localhost = {
+            path = config.services.postgresql.dataDir;
+            user = "postgres";
+          };
+        };
+        services.postgresql.identMap = ''
+          postgres pgbackrest postgres
+        '';
+        services.postgresql.initdbArgs = [ "--allow-group-access" ];
+        users.users.pgbackrest.extraGroups = [ "postgres" ];
+
+        services.postgresql.settings = {
+          archive_command = ''${lib.getExe pkgs.pgbackrest} --stanza=default archive-push "%p"'';
+          archive_mode = lib.mkDefault "on";
+        };
+        users.groups.pgbackrest.members = [ "postgres" ];
+      })
+    ]
+  );
+}

nixos/modules/services/hardware/udev.nix

@@ -55,6 +55,13 @@ let
         preferLocalBuild = true;
         allowSubstitutes = false;
         packages = lib.unique (map toString udevPackages);
+
+        nativeBuildInputs = [
+          # We only include the out output here to avoid needing to include all
+          # other outputs in the installer tests as well
+          # We only need the udevadm command anyway
+          pkgs.systemdMinimal.out
+        ];
       }
       ''
         mkdir -p $out
@@ -147,6 +154,11 @@ let
           exit 1
         fi
 
+        # Verify all the udev rules
+        echo "Verifying udev rules using udevadm verify..."
+        udevadm verify --resolve-names=never --no-style $out
+        echo "OK"
+
         # If auto-configuration is disabled, then remove
         # udev's 80-drivers.rules file, which contains rules for
         # automatically calling modprobe.

nixos/modules/services/misc/gitlab.nix

@@ -907,6 +907,50 @@ in
         '';
       };
 
+      secrets.activeRecordPrimaryKeyFile = mkOption {
+        type = with types; nullOr path;
+        default = null;
+        description = ''
+          A file containing the secret used to encrypt some rails data
+          in the DB. This should not be the same as `services.gitlab.secrets.activeRecordDeterministicKeyFile`!
+
+          Make sure the secret is at ideally 32 characters and all random,
+          no regular words or you'll be exposed to dictionary attacks.
+
+          This should be a string, not a nix path, since nix paths are
+          copied into the world-readable nix store.
+        '';
+      };
+
+      secrets.activeRecordDeterministicKeyFile = mkOption {
+        type = with types; nullOr path;
+        default = null;
+        description = ''
+          A file containing the secret used to encrypt some rails data in a deterministic way
+          in the DB. This should not be the same as `services.gitlab.secrets.activeRecordPrimaryKeyFile`!
+
+          Make sure the secret is at ideally 32 characters and all random,
+          no regular words or you'll be exposed to dictionary attacks.
+
+          This should be a string, not a nix path, since nix paths are
+          copied into the world-readable nix store.
+        '';
+      };
+
+      secrets.activeRecordSaltFile = mkOption {
+        type = with types; nullOr path;
+        default = null;
+        description = ''
+          A file containing the salt for active record encryption in the DB.
+
+          Make sure the secret is at ideally 32 characters and all random,
+          no regular words or you'll be exposed to dictionary attacks.
+
+          This should be a string, not a nix path, since nix paths are
+          copied into the world-readable nix store.
+        '';
+      };
+
       extraShellConfig = mkOption {
         type = types.attrs;
         default = { };
@@ -1180,6 +1224,18 @@ in
         assertion = cfg.secrets.jwsFile != null;
         message = "services.gitlab.secrets.jwsFile must be set!";
       }
+      {
+        assertion = cfg.secrets.activeRecordPrimaryKeyFile != null;
+        message = "services.gitlab.secrets.activeRecordPrimaryKeyFile must be set!";
+      }
+      {
+        assertion = cfg.secrets.activeRecordDeterministicKeyFile != null;
+        message = "services.gitlab.secrets.activeRecordDeterministicKeyFile must be set!";
+      }
+      {
+        assertion = cfg.secrets.activeRecordSaltFile != null;
+        message = "services.gitlab.secrets.activeRecordSaltFile must be set!";
+      }
       {
         assertion = versionAtLeast postgresqlPackage.version "14.9";
         message = "PostgreSQL >= 14.9 is required to run GitLab 17. Follow the instructions in the manual section for upgrading PostgreSQL here: https://nixos.org/manual/nixos/stable/index.html#module-services-postgres-upgrading";
@@ -1480,11 +1536,17 @@ in
             db="$(<'${cfg.secrets.dbFile}')"
             otp="$(<'${cfg.secrets.otpFile}')"
             jws="$(<'${cfg.secrets.jwsFile}')"
-            export secret db otp jws
+            arprimary="$(<'${cfg.secrets.activeRecordPrimaryKeyFile}')"
+            ardeterministic="$(<'${cfg.secrets.activeRecordDeterministicKeyFile}')"
+            arsalt="$(<'${cfg.secrets.activeRecordSaltFile}')"
+            export secret db otp jws arprimary ardeterministic arsalt
             jq -n '{production: {secret_key_base: $ENV.secret,
                     otp_key_base: $ENV.otp,
                     db_key_base: $ENV.db,
-                    openid_connect_signing_key: $ENV.jws}}' \
+                    openid_connect_signing_key: $ENV.jws,
+                    active_record_encryption_primary_key: $ENV.arprimary,
+                    active_record_encryption_deterministic_key: $ENV.ardeterministic,
+                    active_record_encryption_key_derivation_salt: $ENV.arsalt}}' \
                > '${cfg.statePath}/config/secrets.yml'
           )
 

nixos/modules/services/web-apps/archtika.nix

@@ -1,307 +0,0 @@
-{
-  config,
-  lib,
-  pkgs,
-  ...
-}:
-
-let
-  inherit (lib)
-    mkEnableOption
-    mkOption
-    mkIf
-    mkPackageOption
-    types
-    ;
-  cfg = config.services.archtika;
-in
-{
-  options.services.archtika = {
-    enable = mkEnableOption "the archtika CMS";
-
-    package = mkPackageOption pkgs "archtika" { };
-
-    user = mkOption {
-      type = types.str;
-      default = "archtika";
-      description = "User account under which archtika runs.";
-    };
-
-    group = mkOption {
-      type = types.str;
-      default = "archtika";
-      description = "Group under which archtika runs.";
-    };
-
-    databaseName = mkOption {
-      type = types.str;
-      default = "archtika";
-      description = "Name of the PostgreSQL database for archtika.";
-    };
-
-    apiPort = mkOption {
-      type = types.port;
-      default = 5000;
-      description = "Port on which the API runs.";
-    };
-
-    apiAdminPort = mkOption {
-      type = types.port;
-      default = 7500;
-      description = "Port on which the API admin server runs.";
-    };
-
-    webAppPort = mkOption {
-      type = types.port;
-      default = 10000;
-      description = "Port on which the web application runs.";
-    };
-
-    domain = mkOption {
-      type = types.str;
-      description = "Domain to use for the application.";
-    };
-
-    settings = mkOption {
-      description = "Settings for the running archtika application.";
-      type = types.submodule {
-        options = {
-          disableRegistration = mkOption {
-            type = types.bool;
-            default = false;
-            description = "By default any user can create an account. That behavior can be disabled with this option.";
-          };
-          maxUserWebsites = mkOption {
-            type = types.ints.positive;
-            default = 2;
-            description = "Maximum number of websites allowed per user by default.";
-          };
-          maxWebsiteStorageSize = mkOption {
-            type = types.ints.positive;
-            default = 50;
-            description = "Maximum amount of disk space in MB allowed per user website by default.";
-          };
-        };
-      };
-    };
-  };
-
-  config = mkIf cfg.enable (
-    let
-      baseHardenedSystemdOptions = {
-        CapabilityBoundingSet = "";
-        LockPersonality = true;
-        NoNewPrivileges = true;
-        PrivateDevices = true;
-        PrivateTmp = true;
-        ProtectClock = true;
-        ProtectControlGroups = true;
-        ProtectHome = true;
-        ProtectHostname = true;
-        ProtectKernelLogs = true;
-        ProtectKernelModules = true;
-        ProtectKernelTunables = true;
-        ProtectSystem = "strict";
-        RemoveIPC = true;
-        RestrictNamespaces = true;
-        RestrictRealtime = true;
-        RestrictSUIDSGID = true;
-        SystemCallArchitectures = "native";
-        SystemCallFilter = [
-          "@system-service"
-          "~@privileged"
-          "~@resources"
-        ];
-        ReadWritePaths = [ "/var/www/archtika-websites" ];
-      };
-    in
-    {
-      users.users.${cfg.user} = {
-        isSystemUser = true;
-        group = cfg.group;
-      };
-
-      users.groups.${cfg.group} = {
-        members = [
-          "nginx"
-          "postgres"
-        ];
-      };
-
-      systemd.tmpfiles.settings."10-archtika" = {
-        "/var/www" = {
-          d = {
-            mode = "0755";
-            user = "root";
-            group = "root";
-          };
-        };
-        "/var/www/archtika-websites" = {
-          d = {
-            mode = "0770";
-            user = cfg.user;
-            group = cfg.group;
-          };
-        };
-      };
-
-      systemd.services.archtika-api = {
-        description = "archtika API service";
-        wantedBy = [ "multi-user.target" ];
-        after = [
-          "network.target"
-          "postgresql.service"
-        ];
-
-        path = [ config.services.postgresql.package ];
-
-        serviceConfig = baseHardenedSystemdOptions // {
-          User = cfg.user;
-          Group = cfg.group;
-          Restart = "always";
-          WorkingDirectory = "${cfg.package}/rest-api";
-          RestrictAddressFamilies = [
-            "AF_INET"
-            "AF_INET6"
-            "AF_UNIX"
-          ];
-        };
-
-        script =
-          let
-            dbUrl = user: "postgres://${user}@/${cfg.databaseName}?host=/var/run/postgresql";
-          in
-          ''
-            JWT_SECRET=$(tr -dc 'A-Za-z0-9' < /dev/urandom | head -c64)
-
-            psql ${dbUrl "postgres"} \
-              -c "ALTER DATABASE ${cfg.databaseName} SET \"app.jwt_secret\" TO '$JWT_SECRET'" \
-              -c "ALTER DATABASE ${cfg.databaseName} SET \"app.website_max_storage_size\" TO ${toString cfg.settings.maxWebsiteStorageSize}" \
-              -c "ALTER DATABASE ${cfg.databaseName} SET \"app.website_max_number_user\" TO ${toString cfg.settings.maxUserWebsites}"
-
-            ${lib.getExe pkgs.dbmate} --url "${dbUrl "postgres"}&sslmode=disable" --migrations-dir ${cfg.package}/rest-api/db/migrations up
-
-            PGRST_SERVER_CORS_ALLOWED_ORIGINS="https://${cfg.domain}" \
-            PGRST_ADMIN_SERVER_PORT=${toString cfg.apiAdminPort} \
-            PGRST_SERVER_PORT=${toString cfg.apiPort} \
-            PGRST_DB_SCHEMAS="api" \
-            PGRST_DB_ANON_ROLE="anon" \
-            PGRST_OPENAPI_MODE="ignore-privileges" \
-            PGRST_DB_URI=${dbUrl "authenticator"} \
-            PGRST_JWT_SECRET="$JWT_SECRET" \
-            ${lib.getExe pkgs.postgrest}
-          '';
-      };
-
-      systemd.services.archtika-web = {
-        description = "archtika Web App service";
-        wantedBy = [ "multi-user.target" ];
-        after = [ "network.target" ];
-
-        serviceConfig = baseHardenedSystemdOptions // {
-          User = cfg.user;
-          Group = cfg.group;
-          Restart = "always";
-          WorkingDirectory = "${cfg.package}/web-app";
-          RestrictAddressFamilies = [
-            "AF_INET"
-            "AF_INET6"
-          ];
-        };
-
-        environment = {
-          REGISTRATION_IS_DISABLED = toString cfg.settings.disableRegistration;
-          BODY_SIZE_LIMIT = "10M";
-          ORIGIN = "https://${cfg.domain}";
-          PORT = toString cfg.webAppPort;
-        };
-
-        script = "${lib.getExe pkgs.nodejs} ${cfg.package}/web-app";
-      };
-
-      services.postgresql = {
-        enable = true;
-        ensureDatabases = [ cfg.databaseName ];
-        extensions = ps: with ps; [ pgjwt ];
-        authentication = lib.mkOverride 11 ''
-          local postgres postgres trust
-          local ${cfg.databaseName} all trust
-        '';
-      };
-
-      systemd.services.postgresql = {
-        path = with pkgs; [
-          gnutar
-          gzip
-        ];
-        serviceConfig = {
-          ReadWritePaths = [ "/var/www/archtika-websites" ];
-          SystemCallFilter = [ "@system-service" ];
-        };
-      };
-
-      services.nginx = {
-        enable = true;
-        recommendedProxySettings = true;
-        recommendedTlsSettings = true;
-        recommendedZstdSettings = true;
-        recommendedOptimisation = true;
-
-        appendHttpConfig = ''
-          map $http_cookie $archtika_auth_header {
-            default "";
-            "~*session_token=([^;]+)" "Bearer $1";
-          }
-        '';
-
-        virtualHosts = {
-          "${cfg.domain}" = {
-            useACMEHost = cfg.domain;
-            forceSSL = true;
-            locations = {
-              "/" = {
-                proxyPass = "http://127.0.0.1:${toString cfg.webAppPort}";
-              };
-              "/previews/" = {
-                alias = "/var/www/archtika-websites/previews/";
-                index = "index.html";
-                tryFiles = "$uri $uri/ $uri.html =404";
-              };
-              "/api/rpc/export_articles_zip" = {
-                proxyPass = "http://127.0.0.1:${toString cfg.apiPort}/rpc/export_articles_zip";
-                extraConfig = ''
-                  default_type application/json;
-                  proxy_set_header Authorization $archtika_auth_header;
-                '';
-              };
-              "/api/" = {
-                proxyPass = "http://127.0.0.1:${toString cfg.apiPort}/";
-                extraConfig = ''
-                  default_type application/json;
-                '';
-              };
-              "/api/rpc/register" = mkIf cfg.settings.disableRegistration {
-                extraConfig = ''
-                  deny all;
-                '';
-              };
-            };
-          };
-          "~^(?<subdomain>.+)\\.${cfg.domain}$" = {
-            useACMEHost = cfg.domain;
-            forceSSL = true;
-            locations = {
-              "/" = {
-                root = "/var/www/archtika-websites/$subdomain";
-                index = "index.html";
-                tryFiles = "$uri $uri/ $uri.html =404";
-              };
-            };
-          };
-        };
-      };
-    }
-  );
-
-  meta.maintainers = [ lib.maintainers.thiloho ];
-}

nixos/tests/all-tests.nix

@@ -1025,6 +1025,7 @@ in
   peertube = handleTestOn [ "x86_64-linux" ] ./web-apps/peertube.nix { };
   peroxide = handleTest ./peroxide.nix { };
   pgadmin4 = runTest ./pgadmin4.nix;
+  pgbackrest = import ./pgbackrest { inherit runTest; };
   pgbouncer = handleTest ./pgbouncer.nix { };
   pghero = runTest ./pghero.nix;
   pgweb = runTest ./pgweb.nix;

nixos/tests/gitlab.nix

@@ -106,6 +106,9 @@ in
             otpFile = pkgs.writeText "otpsecret" "Riew9mue";
             dbFile = pkgs.writeText "dbsecret" "we2quaeZ";
             jwsFile = pkgs.runCommand "oidcKeyBase" { } "${pkgs.openssl}/bin/openssl genrsa 2048 > $out";
+            activeRecordPrimaryKeyFile = pkgs.writeText "arprimary" "vsaYPZjTRxcbG7W6gNr95AwBmzFUd4Eu";
+            activeRecordDeterministicKeyFile = pkgs.writeText "ardeterministic" "kQarv9wb2JVP7XzLTh5f6DFcMHms4nEC";
+            activeRecordSaltFile = pkgs.writeText "arsalt" "QkgR9CfFU3MXEWGqa7LbP24AntK5ZeYw";
           };
 
           registry = {
@@ -477,6 +480,9 @@ in
       gitlab.start()
     ''
     + waitForServices
+    + ''
+      gitlab.succeed("cp /var/gitlab/state/config/secrets.yml /root/gitlab-secrets.yml")
+    ''
     + test true
     + ''
       gitlab.systemctl("start gitlab-backup.service")
@@ -496,5 +502,9 @@ in
       gitlab.systemctl("start gitlab.target")
     ''
     + waitForServices
+    + ''
+      with subtest("Check that no secrets were auto-generated as these would be non-persistent"):
+          gitlab.succeed("diff -u /root/gitlab-secrets.yml /var/gitlab/state/config/secrets.yml")
+    ''
     + test false;
 }

nixos/tests/installer.nix

@@ -681,7 +681,7 @@ let
         {
           # The configuration of the system used to run "nixos-install".
           installer =
-            { config, ... }:
+            { config, pkgs, ... }:
             {
               imports = [
                 commonConfig
@@ -740,6 +740,11 @@ let
                   xorg.lndir
                   shellcheck-minimal
 
+                  # Only the out output is included here, which is what is
+                  # required to build the NixOS udev rules
+                  # See the comment in services/hardware/udev.nix
+                  systemdMinimal.out
+
                   # add curl so that rather than seeing the test attempt to download
                   # curl's tarball, we see what it's trying to download
                   curl

nixos/tests/pgbackrest/default.nix

@@ -0,0 +1,5 @@
+{ runTest }:
+{
+  posix = runTest ./posix.nix;
+  sftp = runTest ./sftp.nix;
+}

nixos/tests/pgbackrest/posix.nix

@@ -0,0 +1,147 @@
+{ lib, pkgs, ... }:
+let
+  inherit (import ../ssh-keys.nix pkgs) snakeOilPrivateKey snakeOilPublicKey;
+  backupPath = "/var/lib/pgbackrest";
+in
+{
+  name = "pgbackrest-posix";
+
+  meta = {
+    maintainers = with lib.maintainers; [ wolfgangwalther ];
+  };
+
+  nodes.primary =
+    {
+      pkgs,
+      ...
+    }:
+    {
+      services.openssh.enable = true;
+      users.users.postgres.openssh.authorizedKeys.keys = [
+        snakeOilPublicKey
+      ];
+
+      services.postgresql = {
+        enable = true;
+        initialScript = pkgs.writeText "init.sql" ''
+          CREATE TABLE t(c text);
+          INSERT INTO t VALUES ('hello world');
+        '';
+      };
+
+      services.pgbackrest = {
+        enable = true;
+        repos.backup = {
+          type = "posix";
+          path = backupPath;
+          host-user = "pgbackrest";
+        };
+      };
+    };
+
+  nodes.backup =
+    {
+      nodes,
+      ...
+    }:
+    {
+      services.openssh.enable = true;
+      users.users.pgbackrest.openssh.authorizedKeys.keys = [
+        snakeOilPublicKey
+      ];
+
+      services.pgbackrest = {
+        enable = true;
+        repos.localhost.path = backupPath;
+
+        stanzas.default = {
+          jobs.future = {
+            schedule = "3000-01-01";
+            type = "full";
+          };
+          instances.primary = {
+            path = nodes.primary.services.postgresql.dataDir;
+            user = "postgres";
+          };
+        };
+
+        # Examples from https://pgbackrest.org/configuration.html#introduction
+        # Not used for the test, except for dumping the config.
+        stanzas.config-format.settings = {
+          start-fast = true;
+          compress-level = 3;
+          buffer-size = "2MiB";
+          db-timeout = 600;
+          db-exclude = [
+            "db1"
+            "db2"
+            "db5"
+          ];
+          tablespace-map = {
+            ts_01 = "/db/ts_01";
+            ts_02 = "/db/ts_02";
+          };
+        };
+      };
+    };
+
+  testScript =
+    { nodes, ... }:
+    ''
+      start_all()
+
+      primary.wait_for_unit("multi-user.target")
+      backup.wait_for_unit("multi-user.target")
+
+      with subtest("config file is written correctly"):
+        from textwrap import dedent
+        have = backup.succeed("cat /etc/pgbackrest/pgbackrest.conf")
+        want = dedent("""\
+          [config-format]
+          buffer-size=2MiB
+          compress-level=3
+          db-exclude=db1
+          db-exclude=db2
+          db-exclude=db5
+          db-timeout=600
+          start-fast=y
+          tablespace-map=ts_01=/db/ts_01
+          tablespace-map=ts_02=/db/ts_02
+        """)
+        assert want in have, repr((want, have))
+
+      primary.log(primary.succeed("""
+        HOME="${nodes.primary.services.postgresql.dataDir}"
+        mkdir -m 700 -p ~/.ssh
+        cat ${snakeOilPrivateKey} > ~/.ssh/id_ecdsa
+        chmod 400 ~/.ssh/id_ecdsa
+        ssh-keyscan backup >> ~/.ssh/known_hosts
+        chown -R postgres:postgres ~/.ssh
+      """))
+
+      backup.log(backup.succeed("""
+        HOME="${backupPath}"
+        mkdir -m 700 -p ~/.ssh
+        cat ${snakeOilPrivateKey} > ~/.ssh/id_ecdsa
+        chmod 400 ~/.ssh/id_ecdsa
+        ssh-keyscan primary >> ~/.ssh/known_hosts
+        chown -R pgbackrest:pgbackrest ~
+      """))
+
+      with subtest("backup/restore works with remote instance/local repo (SSH)"):
+        backup.succeed("sudo -u pgbackrest pgbackrest --stanza=default stanza-create")
+        backup.succeed("sudo -u pgbackrest pgbackrest --stanza=default check")
+
+        backup.systemctl("start pgbackrest-default-future")
+
+        # corrupt cluster
+        primary.systemctl("stop postgresql")
+        primary.execute("rm ${nodes.primary.services.postgresql.dataDir}/global/pg_control")
+
+        primary.succeed("sudo -u postgres pgbackrest --stanza=default restore --delta")
+
+        primary.systemctl("start postgresql")
+        primary.wait_for_unit("postgresql.service")
+        assert "hello world" in primary.succeed("sudo -u postgres psql -c 'TABLE t;'")
+    '';
+}

nixos/tests/pgbackrest/sftp.nix

@@ -0,0 +1,95 @@
+{ lib, pkgs, ... }:
+let
+  inherit (import ../ssh-keys.nix pkgs) snakeOilPrivateKey snakeOilPublicKey;
+  backupPath = "/home/backup";
+in
+{
+  name = "pgbackrest-sftp";
+
+  meta = {
+    maintainers = with lib.maintainers; [ wolfgangwalther ];
+  };
+
+  nodes.primary =
+    {
+      pkgs,
+      ...
+    }:
+    {
+      services.postgresql = {
+        enable = true;
+        initialScript = pkgs.writeText "init.sql" ''
+          CREATE TABLE t(c text);
+          INSERT INTO t VALUES ('hello world');
+        '';
+      };
+
+      services.pgbackrest = {
+        enable = true;
+        repos.backup = {
+          type = "sftp";
+          path = "/home/backup";
+          sftp-host-key-check-type = "none";
+          sftp-host-key-hash-type = "sha256";
+          sftp-host-user = "backup";
+          sftp-private-key-file = "/var/lib/pgbackrest/sftp_key";
+        };
+
+        stanzas.default.jobs.future = {
+          schedule = "3000-01-01";
+          type = "diff";
+        };
+      };
+    };
+
+  nodes.backup =
+    {
+      nodes,
+      ...
+    }:
+    {
+      services.openssh.enable = true;
+      users.users.backup = {
+        name = "backup";
+        group = "backup";
+        isNormalUser = true;
+        createHome = true;
+        openssh.authorizedKeys.keys = [
+          snakeOilPublicKey
+        ];
+      };
+      users.groups.backup = { };
+    };
+
+  testScript =
+    { nodes, ... }:
+    ''
+      start_all()
+
+      primary.wait_for_unit("multi-user.target")
+      backup.wait_for_unit("multi-user.target")
+
+      primary.log(primary.succeed("""
+        HOME="/var/lib/pgbackrest"
+        cat ${snakeOilPrivateKey} > ~/sftp_key
+        chown -R pgbackrest:pgbackrest ~/sftp_key
+        chmod 770 ~
+      """))
+
+      with subtest("backup/restore works with local instance/remote repo (SFTP)"):
+        primary.succeed("sudo -u pgbackrest pgbackrest --stanza=default stanza-create", timeout=10)
+        primary.succeed("sudo -u pgbackrest pgbackrest --stanza=default check")
+
+        primary.systemctl("start pgbackrest-default-future")
+
+        # corrupt cluster
+        primary.systemctl("stop postgresql")
+        primary.execute("rm ${nodes.primary.services.postgresql.dataDir}/global/pg_control")
+
+        primary.succeed("sudo -u postgres pgbackrest --stanza=default restore --delta")
+
+        primary.systemctl("start postgresql")
+        primary.wait_for_unit("postgresql.service")
+        assert "hello world" in primary.succeed("sudo -u postgres psql -c 'TABLE t;'")
+    '';
+}

nixos/tests/playwright-python.nix

@@ -21,6 +21,7 @@ import ./make-test-python.nix (
             }
             ''
               import sys
+              import re
               from playwright.sync_api import sync_playwright
               from playwright.sync_api import expect
 
@@ -29,6 +30,7 @@ import ./make-test-python.nix (
                 "firefox": {},
                 "webkit": {}
               }
+              needle = re.compile("Nix.*Reference Manual")
               if len(sys.argv) != 3 or sys.argv[1] not in browsers.keys():
                   print(f"usage: {sys.argv[0]} [{'|'.join(browsers.keys())}] <url>")
                   sys.exit(1)
@@ -42,7 +44,7 @@ import ./make-test-python.nix (
                   context = browser.new_context()
                   page = context.new_page()
                   page.goto(url)
-                  expect(page.get_by_text("Nix Reference Manual")).to_be_visible()
+                  expect(page.get_by_text(needle)).to_be_visible()
             ''
           )
         ];

pkgs/applications/blockchains/bitcoin/default.nix

@@ -22,6 +22,7 @@
   nixosTests,
   withGui,
   withWallet ? true,
+  enableTracing ? stdenv.hostPlatform.isLinux && !stdenv.hostPlatform.isStatic,
 }:
 
 let
@@ -61,7 +62,7 @@ stdenv.mkDerivation (finalAttrs: {
       zeromq
       zlib
     ]
-    ++ lib.optionals (stdenv.hostPlatform.isLinux) [ libsystemtap ]
+    ++ lib.optionals enableTracing [ libsystemtap ]
     ++ lib.optionals withWallet [ sqlite ]
     # building with db48 (for legacy descriptor wallet support) is broken on Darwin
     ++ lib.optionals (withWallet && !stdenv.hostPlatform.isDarwin) [ db48 ]
@@ -98,7 +99,7 @@ stdenv.mkDerivation (finalAttrs: {
       (lib.cmakeBool "WITH_ZMQ" true)
       # building with db48 (for legacy wallet support) is broken on Darwin
       (lib.cmakeBool "WITH_BDB" (withWallet && !stdenv.hostPlatform.isDarwin))
-      (lib.cmakeBool "WITH_USDT" (stdenv.hostPlatform.isLinux))
+      (lib.cmakeBool "WITH_USDT" enableTracing)
     ]
     ++ lib.optionals (!finalAttrs.doCheck) [
       (lib.cmakeBool "BUILD_TESTS" false)
@@ -112,6 +113,10 @@ stdenv.mkDerivation (finalAttrs: {
       (lib.cmakeBool "BUILD_GUI" true)
     ];
 
+  NIX_LDFLAGS = lib.optionals (
+    stdenv.hostPlatform.isLinux && stdenv.hostPlatform.isStatic
+  ) "-levent_core";
+
   nativeCheckInputs = [ python3 ];
 
   doCheck = true;

pkgs/applications/editors/vscode/extensions/betterthantomorrow.calva/default.nix

@@ -11,8 +11,8 @@ vscode-utils.buildVscodeMarketplaceExtension {
   mktplcRef = {
     name = "calva";
     publisher = "betterthantomorrow";
-    version = "2.0.508";
-    hash = "sha256-9iR42yQAW9wXcTkKeF7TuWFjm/D85V3+CbaZ8LxEu8k=";
+    version = "2.0.509";
+    hash = "sha256-4OTgwzLG21W3BR3EhepzhCwTnBmhDsoQ5GWN00kZqCY=";
   };
 
   nativeBuildInputs = [

pkgs/applications/editors/vscode/extensions/default.nix

@@ -258,8 +258,8 @@ let
         mktplcRef = {
           name = "ng-template";
           publisher = "Angular";
-          version = "19.2.4";
-          hash = "sha256-LJpv7ZVnJrPb4Ty0H250WcliCoJS4lXc878BTYHfJ+8=";
+          version = "20.0.0";
+          hash = "sha256-87SImzcGbwvf9xtdbD3etqaWe6fMVeCKc+f8qTyFnUA=";
         };
         meta = {
           changelog = "https://marketplace.visualstudio.com/items/Angular.ng-template/changelog";
@@ -316,8 +316,8 @@ let
         mktplcRef = {
           name = "vscode-apollo";
           publisher = "apollographql";
-          version = "2.5.5";
-          hash = "sha256-KlyDbvTVyAacAzq8I6b8isGt5vMo5Ak9xlD8o0Ksy6A=";
+          version = "2.5.6";
+          hash = "sha256-Uh3iFJXG8d0Ywjyx6sGpkYSD0Iy+y/0Uh0C6xYfQhKM=";
         };
         meta = {
           changelog = "https://marketplace.visualstudio.com/items/apollographql.vscode-apollo/changelog";
@@ -361,8 +361,8 @@ let
         mktplcRef = {
           name = "nix-env-selector";
           publisher = "arrterian";
-          version = "1.0.12";
-          hash = "sha256-xykKAEd+/eKMzKdufQ+wzEIhHFRh4qghWVDKgEJMTs0=";
+          version = "1.1.0";
+          hash = "sha256-c5WX5L1hufKwBX64UiaLWOQaZTYma+6AbOphLPEQ9C8=";
         };
         meta = {
           license = lib.licenses.mit;
@@ -409,8 +409,8 @@ let
         mktplcRef = {
           name = "vscode-neovim";
           publisher = "asvetliakov";
-          version = "1.18.20";
-          hash = "sha256-g3rRdFjbxrp9y/dVhj/2GUJvDbG92VGq/jPtlLXV2kM=";
+          version = "1.18.21";
+          hash = "sha256-I5jrp8sGn+M8bJo93jNrx+s4sB0p3sGN4lLLROstkKA=";
         };
         meta = {
           changelog = "https://marketplace.visualstudio.com/items/asvetliakov.vscode-neovim/changelog";
@@ -898,8 +898,8 @@ let
           mktplcRef = {
             name = "catppuccin-vsc-icons";
             publisher = "catppuccin";
-            version = "1.20.0";
-            hash = "sha256-jkoa5X5vswJBvA69gstl/GUDHAvk94SVSV4lCy2yyWw=";
+            version = "1.21.0";
+            hash = "sha256-rWExJ9XJ8nKki8TP0UNLCmslw+aCm1hR2h2xxhnY9bg=";
           };
           meta = {
             changelog = "https://marketplace.visualstudio.com/items/Catppuccin.catppuccin-vsc-icons/changelog";
@@ -979,8 +979,8 @@ let
         mktplcRef = {
           name = "chatgpt-reborn";
           publisher = "chris-hayes";
-          version = "3.26.0";
-          sha256 = "sha256-nRld/tSydasBEE1YJ0oa8217cCBt8iDRquCdSNYeQ3k=";
+          version = "3.27.0";
+          sha256 = "sha256-52SvGb9TsvDQey5cjw+ZIQBP/1dyWcHKNjqCCCyM6k4=";
         };
       };
 
@@ -1179,8 +1179,8 @@ let
         mktplcRef = {
           name = "vscode-database-client2";
           publisher = "cweijan";
-          version = "8.2.7";
-          hash = "sha256-RH+nqLiT5atyTC9WMFpY5ARTolK8+d1VZJY8oHK1G7E=";
+          version = "8.3.1";
+          hash = "sha256-SLZkuWChkNt4+99kAauDx3Dz3wjnYEfTsFFH/i6ugeo=";
         };
         meta = {
           description = "Database Client For Visual Studio Code";
@@ -1208,8 +1208,8 @@ let
         mktplcRef = {
           publisher = "DanielSanMedium";
           name = "dscodegpt";
-          version = "3.11.24";
-          hash = "sha256-bQf8kr4wvbUk+IMdoevBqZxTKg81uKlQO9yD6xJd1TM=";
+          version = "3.12.3";
+          hash = "sha256-9vv/ourveSqLQyHylbWpUuJDwnpsZLihC800qDLI3YY=";
         };
         meta = {
           changelog = "https://marketplace.visualstudio.com/items/DanielSanMedium.dscodegpt/changelog";
@@ -1238,8 +1238,8 @@ let
         mktplcRef = {
           name = "dart-code";
           publisher = "dart-code";
-          version = "3.108.2";
-          hash = "sha256-tBJSx0m/RWWkZaBdoM7awaBt7ZrfWic0AIYUAGyNz+E=";
+          version = "3.110.0";
+          hash = "sha256-YLdhL5xNj8sidZUzMVZgOK6zTXgQnWdKWRrDg0on90s=";
         };
 
         meta.license = lib.licenses.mit;
@@ -1249,8 +1249,8 @@ let
         mktplcRef = {
           name = "flutter";
           publisher = "dart-code";
-          version = "3.108.0";
-          hash = "sha256-+wqnHTQhVuSn46CsIVa3PCCrJ73kRr9oOLePm3uPshA=";
+          version = "3.110.0";
+          hash = "sha256-Zi+q56XcHZGUKgF3TNpaYSwwdqLT8Q1fxf8dFVAEuQY=";
         };
 
         meta.license = lib.licenses.mit;
@@ -1339,8 +1339,8 @@ let
         mktplcRef = {
           publisher = "denoland";
           name = "vscode-deno";
-          version = "3.43.6";
-          hash = "sha256-bZsPyffCQ++gvlK7MT1Dsrd7HQWACcViwwcEhu9HQfM=";
+          version = "3.44.1";
+          hash = "sha256-biYQdt275OpbADEPPvraOPb5omRbQfkOX5+lWbU/kkw=";
         };
         meta = {
           changelog = "https://marketplace.visualstudio.com/items/denoland.vscode-deno/changelog";
@@ -1356,8 +1356,8 @@ let
         mktplcRef = {
           name = "composer-php-vscode";
           publisher = "devsense";
-          version = "1.57.17158";
-          hash = "sha256-S/A9Bg4RAd5WDJYDziOahbXqEDeHR/bWaNbh0vzhlww=";
+          version = "1.58.17223";
+          hash = "sha256-eobPtePHqW0+2PgMN6ydJWMLQJ14FsevKbhZzaXYxqc=";
         };
         meta = {
           changelog = "https://marketplace.visualstudio.com/items/DEVSENSE.composer-php-vscode/changelog";
@@ -1429,8 +1429,8 @@ let
         mktplcRef = {
           name = "profiler-php-vscode";
           publisher = "devsense";
-          version = "1.57.17158";
-          hash = "sha256-Ng7zuyNQjrQwqjgMl2NC204uPFD6lkbYp+zN+y9NC/A=";
+          version = "1.58.17223";
+          hash = "sha256-LC/I/r7ZPOZJ21eGPKLOZEtiKXeIIggAaE8fSKHnTjg=";
         };
         meta = {
           changelog = "https://marketplace.visualstudio.com/items/DEVSENSE.profiler-php-vscode/changelog";
@@ -1487,8 +1487,8 @@ let
         mktplcRef = {
           publisher = "discloud";
           name = "discloud";
-          version = "2.22.45";
-          hash = "sha256-5nTNidm/oR1CazYXJfb6pKKXS5CSo3UUuW3xDp6yYGk=";
+          version = "2.22.50";
+          hash = "sha256-O9ourjcg4nwfXZOz9n1vgD6ufTkGYNDZrPLnqPUiCAc=";
         };
         meta = {
           changelog = "https://marketplace.visualstudio.com/items/discloud.discloud/changelog";
@@ -1516,8 +1516,8 @@ let
         mktplcRef = {
           name = "competitive-programming-helper";
           publisher = "DivyanshuAgrawal";
-          version = "2025.4.1744912235";
-          hash = "sha256-IUnQOaoBIcvWz72Ck1QC366LARw1UncNnvm04sc8WA0=";
+          version = "2025.5.1746344159";
+          hash = "sha256-gFzuZH5AYfBSdTFfSlz2XkrFR4yUv+DaG5j4MCDYkX8=";
         };
         meta = {
           changelog = "https://marketplace.visualstudio.com/items/DivyanshuAgrawal.competitive-programming-helper/changelog";
@@ -1747,8 +1747,8 @@ let
         mktplcRef = {
           name = "vscode-great-icons";
           publisher = "emmanuelbeziat";
-          version = "2.1.116";
-          hash = "sha256-gndGZwHEwFogPsBgzmQUq20dCMHFxgOROWhL6m1E5Aw=";
+          version = "2.1.118";
+          hash = "sha256-nc3MsBnvof9MxFsGLRojlGQ4jUK+ia4k2GPCEBSHpuI=";
         };
         meta = {
           license = lib.licenses.mit;
@@ -1869,8 +1869,8 @@ let
         mktplcRef = {
           name = "dependi";
           publisher = "fill-labs";
-          version = "0.7.13";
-          hash = "sha256-Xn2KEZDQ11LDfUKbIrJtQNQXkcusyrL/grDyQxUmTbc=";
+          version = "0.7.14";
+          hash = "sha256-iLF2kxhSw39JBIs5K6hVmrEKueS8C22rnKCs+CiphwY=";
         };
         meta = {
           changelog = "https://marketplace.visualstudio.com/items/fill-labs.dependi/changelog";
@@ -2188,8 +2188,8 @@ let
         mktplcRef = {
           name = "gitlab-workflow";
           publisher = "gitlab";
-          version = "6.12.0";
-          hash = "sha256-0Pka2v2nXMfRD3TCiVAfLaxEhpQml9R/6Lg3/tk03zQ=";
+          version = "6.13.1";
+          hash = "sha256-v+gnZPemEMtyBNxwQf0OOp1QSy1+uWDNH9tBu4HwGDg=";
         };
         meta = {
           description = "GitLab extension for Visual Studio Code";
@@ -2508,8 +2508,8 @@ let
         mktplcRef = {
           name = "vscode-vibrancy-continued";
           publisher = "illixion";
-          version = "1.1.48";
-          hash = "sha256-bTxseGGog4hyk5Hn9b7ggObtiJif7gWxHE0Kb7y7uEk=";
+          version = "1.1.52";
+          hash = "sha256-biSWnICmVPTf/zounQd6IfIPBMVDQzXjcCTgp5J00nA=";
         };
         meta = {
           downloadPage = "https://marketplace.visualstudio.com/items?itemName=illixion.vscode-vibrancy-continued";
@@ -2573,8 +2573,8 @@ let
         mktplcRef = {
           name = "Ionide-fsharp";
           publisher = "Ionide";
-          version = "7.25.7";
-          hash = "sha256-6AN6LrFGWmLsCwRrtLqW1Mf+txReGeg7fvZ8W2Jv8Uo=";
+          version = "7.25.8";
+          hash = "sha256-/pnLLFj6Iwn14GLGbuc2Ex7IbNmXFiH1Btd12cCGGes=";
         };
         meta = {
           changelog = "https://marketplace.visualstudio.com/items/Ionide.Ionide-fsharp/changelog";
@@ -2629,8 +2629,8 @@ let
         mktplcRef = {
           name = "latex-workshop";
           publisher = "James-Yu";
-          version = "10.9.0";
-          sha256 = "sha256-hexky9ZZt+u0H8HVcNiI2Jmx9HL5+uKHLVBNqEbgqLo=";
+          version = "10.9.1";
+          sha256 = "sha256-R+tJ3k71rlzfxtz4Dib6JiU7Sipq/UTP38ERAhojY7c=";
         };
         meta = {
           changelog = "https://marketplace.visualstudio.com/items/James-Yu.latex-workshop/changelog";
@@ -3338,8 +3338,8 @@ let
         mktplcRef = {
           publisher = "ms-azuretools";
           name = "vscode-docker";
-          version = "1.29.5";
-          hash = "sha256-WQiVqC/+qJkEHpYTRbg5NbzQG1+jtifvjF/wbQJfQeY=";
+          version = "1.29.6";
+          hash = "sha256-kHQuS6wxp3Gu5WSjWRXXMLwSrv7LBSsnsNu7VY4H/J0=";
         };
         meta = {
           description = "Docker Extension for Visual Studio Code";
@@ -3424,8 +3424,8 @@ let
         mktplcRef = {
           name = "vscode-kubernetes-tools";
           publisher = "ms-kubernetes-tools";
-          version = "1.3.22";
-          hash = "sha256-9iSOBxsqjFa6OcwD8n8bwHtIvZUZYxgI9ug09Uk2NwE=";
+          version = "1.3.23";
+          hash = "sha256-8s1fuuTwUPd1Z32EqZNloD50KaFlPOxlvMmo5D6NaE4=";
         };
         meta = {
           license = lib.licenses.mit;
@@ -3647,8 +3647,8 @@ let
         mktplcRef = {
           name = "remote-containers";
           publisher = "ms-vscode-remote";
-          version = "0.409.0";
-          hash = "sha256-K+pJeon1EWux3pnfzvwCODo55vWpA2Lvps4GFJW/ALU=";
+          version = "0.413.0";
+          hash = "sha256-OLi4gSjoz+TRgkb5UH1u6UTNfEF8ZgawrcXFDkoJtIc=";
         };
         meta = {
           description = "Open any folder or repository inside a Docker container";
@@ -3875,8 +3875,8 @@ let
         mktplcRef = {
           name = "ocaml-platform";
           publisher = "ocamllabs";
-          version = "1.29.0";
-          hash = "sha256-Bznz5wpG71zXOAUYkwP5Q0hnYNq6OBfrMX620OvOEK8=";
+          version = "1.30.0";
+          hash = "sha256-pQkMhFjqdsrjfsrXz0IbpgR+vnGy8OVW9BC03Nr6SN8=";
         };
       };
 
@@ -3961,11 +3961,15 @@ let
         mktplcRef = {
           name = "material-icon-theme";
           publisher = "PKief";
-          version = "5.21.2";
-          sha256 = "sha256-HEcFa+SCosf5UonqxFQZI+G5ogxCaScmHt54xn4H4QI=";
+          version = "5.22.0";
+          hash = "sha256-E9UCSZe0hXnKwdNv6ua/Kzuy+wTFyeOGGVl7gFF4opY=";
         };
         meta = {
+          description = "Material Design Icons for Visual Studio Code";
+          downloadPage = "https://marketplace.visualstudio.com/items/?itemName=PKief.material-icon-theme";
+          homepage = "https://github.com/material-extensions/vscode-material-icon-theme/blob/main/README.md";
           license = lib.licenses.mit;
+          maintainers = [ lib.maintainers.therobot2105 ];
         };
       };
 
@@ -4004,8 +4008,8 @@ let
         mktplcRef = {
           name = "prisma";
           publisher = "Prisma";
-          version = "6.6.0";
-          hash = "sha256-7l7J4oTunWL2K9UxbnygaeGxxHqhwJRmYfeW2JRgcvc=";
+          version = "6.7.1";
+          hash = "sha256-qgWCC2aIUGS8XG9E8Z9Ya2BGBmL8RwRcHNdbJJFvPws=";
         };
         meta = {
           changelog = "https://marketplace.visualstudio.com/items/Prisma.prisma/changelog";
@@ -4101,8 +4105,8 @@ let
         mktplcRef = {
           publisher = "redhat";
           name = "vscode-xml";
-          version = "0.28.2025031108";
-          hash = "sha256-SO/Q27v5rzoA5NBp5WJ8S7KcwbGLUmkK2FoaaSb6nYI=";
+          version = "0.29.0";
+          hash = "sha256-I6ZRtt43Qo3m8OfmjkVfBIaNWWvLULlwnJZqIp/WEuI=";
         };
         meta.license = lib.licenses.epl20;
       };
@@ -4111,8 +4115,8 @@ let
         mktplcRef = {
           publisher = "redhat";
           name = "vscode-yaml";
-          version = "1.17.0";
-          hash = "sha256-u3smLk5yCT9DMtFnrxh5tKbfDQ2XbL6bl2bXGOD38X0=";
+          version = "1.18.0";
+          hash = "sha256-UtxDplORUWqmiW6I8n4ZhK7HAQdSDG4dw7M/cbjkmZY=";
         };
         meta = {
           description = "YAML Language Support by Red Hat, with built-in Kubernetes syntax support";
@@ -4442,8 +4446,8 @@ let
         mktplcRef = {
           publisher = "shopify";
           name = "ruby-lsp";
-          version = "0.9.16";
-          hash = "sha256-X+Ym36NWQOYXW5IcevImdkKU1IAr36YGZrNziacIHWA=";
+          version = "0.9.23";
+          hash = "sha256-toCxWCMun+siVVXH6tjfe71XeAoXyEBiRRR0ViaMDUw=";
         };
         meta = {
           description = "VS Code plugin for connecting with the Ruby LSP";
@@ -4559,8 +4563,8 @@ let
         mktplcRef = {
           publisher = "sonarsource";
           name = "sonarlint-vscode";
-          version = "4.20.2";
-          hash = "sha256-e1HYFPILERzlBYEBC7q9gUfj65tmruMduVAjzG0CUnM=";
+          version = "4.21.0";
+          hash = "sha256-pnxHROhjbQq93CeWkBU3KwIPeXVDA4K6ifkkoGfagIM=";
         };
         meta.license = lib.licenses.lgpl3Only;
       };
@@ -4616,8 +4620,8 @@ let
         mktplcRef = {
           name = "vscode-tmux-keybinding";
           publisher = "stephlin";
-          version = "0.0.7";
-          hash = "sha256-MrW0zInweAhU2spkEEiDLyuT6seV3GFFurWTqYMzqgY=";
+          version = "1.0.0";
+          hash = "sha256-ZV5iyZ8pkTG9RPGObFtGbU5Iq7w/cDlUMuOVskg/39g=";
         };
         meta = {
           changelog = "https://marketplace.visualstudio.com/items/stephlin.vscode-tmux-keybinding/changelog";
@@ -4730,8 +4734,8 @@ let
         mktplcRef = {
           name = "svelte-vscode";
           publisher = "svelte";
-          version = "109.5.4";
-          hash = "sha256-aJjwXQKSpCCmwkaBfdTEgPGWALGb3qRD8JOgTbRWRh8=";
+          version = "109.6.0";
+          hash = "sha256-oyeVtOcTqvcIhG+mq0TmQyOZcp7fENCpy3M7bkaP+N4=";
         };
         meta = {
           changelog = "https://github.com/sveltejs/language-tools/releases";
@@ -4764,8 +4768,8 @@ let
         mktplcRef = {
           name = "tabnine-vscode";
           publisher = "tabnine";
-          version = "3.260.0";
-          hash = "sha256-Ve9PGpsqc7q5wCu62X0I5xJsQJ0xAJKN6VNi6HfWNDk=";
+          version = "3.268.0";
+          hash = "sha256-Gx9hQqieXTmFudRJaySI8+8cNIaKVRMtNwJqxGH0DV8=";
         };
         meta = {
           license = lib.licenses.mit;
@@ -4938,8 +4942,8 @@ let
         mktplcRef = {
           name = "helm-intellisense";
           publisher = "Tim-Koehler";
-          version = "0.14.3";
-          hash = "sha256-TcXn8n6mKEFpnP8dyv+nXBjsyfUfJNgdL9iSZwA5eo0=";
+          version = "0.15.0";
+          hash = "sha256-Tl0X2jtgTsjf2tvyAJLGxEGrmLXACYWWErcDJuQYg+o=";
         };
         meta = {
           description = "Extension to help writing Helm-Templates by providing intellisense";
@@ -5107,8 +5111,8 @@ let
         mktplcRef = {
           name = "errorlens";
           publisher = "usernamehw";
-          version = "3.25.0";
-          hash = "sha256-Gszz6sGJt6DBgVCH7tgTGTX73TbKBwityJn7cY39WmU=";
+          version = "3.26.0";
+          hash = "sha256-pAkk3QURnlLNMZ2cFBks2lAEl/Hk8Z2i/QgvjUv+u2Y=";
         };
         meta = {
           changelog = "https://marketplace.visualstudio.com/items/usernamehw.errorlens/changelog";
@@ -5216,8 +5220,8 @@ let
         mktplcRef = {
           name = "vstuc";
           publisher = "VisualStudioToolsForUnity";
-          version = "1.1.1";
-          hash = "sha256-iE/o6hkDwT7jLTVvJbviQZgV+KnhSAGEZ2mf3gsua38=";
+          version = "1.1.2";
+          hash = "sha256-Haai7sTGAreO7cUvSIc12bQl7WwQl+waJumYOvpVJ7M=";
         };
         meta = {
           description = "Integrates Visual Studio Code for Unity";
@@ -5359,8 +5363,8 @@ let
         mktplcRef = {
           name = "vscode-icons";
           publisher = "vscode-icons-team";
-          version = "12.12.0";
-          hash = "sha256-C73ZpmVJ9ltzbfV3LmawV2X/2e+e1F3dxaYZzKMBZdQ=";
+          version = "12.13.0";
+          hash = "sha256-HghVnyYLUcC54PNYgqFypZqiynqWzT6l/ihyClUvH0c=";
         };
         meta = {
           description = "Bring real icons to your Visual Studio Code";

pkgs/applications/editors/vscode/extensions/mongodb.mongodb-vscode/default.nix

@@ -4,8 +4,8 @@ vscode-utils.buildVscodeMarketplaceExtension {
   mktplcRef = {
     name = "mongodb-vscode";
     publisher = "mongodb";
-    version = "1.13.1";
-    hash = "sha256-dcOf103uZ5KyCfhzj19G1DpRL/OUYVHcPWVsk65ae1o=";
+    version = "1.13.2";
+    hash = "sha256-XgDFiB0LaHNC8Z9+pug6f+x/MGwtkm7a49pyfIBKkwo=";
   };
 
   meta = {

pkgs/applications/editors/vscode/extensions/ms-azuretools.vscode-bicep/default.nix

@@ -10,8 +10,8 @@ vscode-utils.buildVscodeMarketplaceExtension {
   mktplcRef = {
     publisher = "ms-azuretools";
     name = "vscode-bicep";
-    version = "0.34.44";
-    hash = "sha256-y+FdlnJeYBpu30s5g+39HczVN5ncaacHvybYLVebH34=";
+    version = "0.35.1";
+    hash = "sha256-Ggp3Z3pxPMEDxgzjPYNr830wx+upkBP4YAbKiOivbYs=";
   };
 
   buildInputs = [

pkgs/applications/editors/vscode/extensions/ms-python.debugpy/default.nix

@@ -7,8 +7,8 @@ vscode-utils.buildVscodeMarketplaceExtension {
   mktplcRef = {
     name = "debugpy";
     publisher = "ms-python";
-    version = "2025.6.0";
-    hash = "sha256-sdePoi+GdWi0AMWLOvVtCYkCbdxZMx2pMJAZF7aYluc=";
+    version = "2025.8.0";
+    hash = "sha256-sfQG5LgGruInheqA7C8YxdC0EhmmmKhbfyXhHUhCaNI=";
   };
 
   meta = {

pkgs/applications/editors/vscode/extensions/ms-python.python/default.nix

@@ -15,8 +15,8 @@ vscode-utils.buildVscodeMarketplaceExtension rec {
   mktplcRef = {
     name = "python";
     publisher = "ms-python";
-    version = "2025.4.0";
-    hash = "sha256-/yQbmZTnkks1gvMItEApRzfk8Lczjq+JC5rnyJxr6fo=";
+    version = "2025.6.0";
+    hash = "sha256-DtnBFLSQj9y7UiHRhOILuua6c2eeJcFiyMNlIjTor9g=";
   };
 
   buildInputs = [ icu ];

pkgs/applications/editors/vscode/extensions/ms-vscode-remote.remote-ssh/default.nix

@@ -84,8 +84,8 @@ buildVscodeMarketplaceExtension {
   mktplcRef = {
     name = "remote-ssh";
     publisher = "ms-vscode-remote";
-    version = "0.119.0";
-    hash = "sha256-S6quMPlDNSLIqyMmTZsDts5bLh2LBdAPuQibT3AEHH8=";
+    version = "0.120.0";
+    hash = "sha256-D9YmLKGDtIb2wGfLNRbczqL4fzLASbZC/563ewzqGV0=";
   };
 
   postPatch = ''

pkgs/applications/editors/vscode/extensions/ms-vscode.cpptools/default.nix

@@ -42,15 +42,15 @@ let
   isDarwin = stdenv.hostPlatform.isDarwin;
   supported = {
     x86_64-linux = {
-      hash = "sha256-KWr+nfODCRoZq67qwswzbcPW5WMmf9kvRwNFKpjyt4k=";
+      hash = "sha256-97eXABltjGg5FOfyl03N8VjmdBcemEe3I+DSV/EpMS4=";
       arch = "linux-x64";
     };
     aarch64-linux = {
-      hash = "sha256-a6PwlSo3q1hLVx0JDSTwPGfjfk7CtdYCuFccSpPg7U8=";
+      hash = "sha256-yBQFhQS/eh8hMW8wN0sr8wZwWrz8e1gWnVZHUf33gw4=";
       arch = "linux-arm64";
     };
     aarch64-darwin = {
-      hash = "sha256-B6Dmcbk8Z8qPr/0Xv9GfBxL6+7DaVmYNVRfBY9geCoY=";
+      hash = "sha256-HxsZjNTg9nOwkSFy9tPaQjtB0SAQXWw0vwcCOj1ZKuA=";
       arch = "darwin-arm64";
     };
   };
@@ -63,7 +63,7 @@ vscode-utils.buildVscodeMarketplaceExtension {
   mktplcRef = base // {
     name = "cpptools";
     publisher = "ms-vscode";
-    version = "1.24.5";
+    version = "1.25.3";
   };
 
   nativeBuildInputs = [

pkgs/applications/editors/vscode/extensions/ms-windows-ai-studio.windows-ai-studio/default.nix

@@ -7,8 +7,8 @@ vscode-utils.buildVscodeMarketplaceExtension {
   mktplcRef = {
     name = "windows-ai-studio";
     publisher = "ms-windows-ai-studio";
-    version = "0.10.9";
-    hash = "sha256-JhpPOnzFQmTtzyl5p/dqFH/tjJ4qsfJhdco6uLUpVN4=";
+    version = "0.12.1";
+    hash = "sha256-uj+4o5gH6qfYCJjapoas/JDWymFWSl4kHFu5Ys9rTlU=";
   };
 
   meta = {

pkgs/applications/editors/vscode/extensions/nimlang.nimlang/default.nix

@@ -4,8 +4,8 @@ vscode-utils.buildVscodeMarketplaceExtension {
   mktplcRef = {
     name = "nimlang";
     publisher = "nimlang";
-    version = "1.8.0";
-    hash = "sha256-5GwCKDG8DJnen0zDJYeFuqhyitPyORRPsB+DvbzAivw=";
+    version = "1.8.1";
+    hash = "sha256-Apfq0VeLEmXnxsaipA+aJr/QX+chAQQGQQ+64hqFIbA=";
   };
   meta = {
     description = "Nim language support for VS Code";

pkgs/applications/editors/vscode/extensions/rooveterinaryinc.roo-cline/default.nix

@@ -8,8 +8,8 @@ vscode-utils.buildVscodeMarketplaceExtension {
   mktplcRef = {
     publisher = "RooVeterinaryInc";
     name = "roo-cline";
-    version = "3.15.4";
-    hash = "sha256-4YZgIUZdtD/EKc6b76J8WfTD/QRyvqPSDDdk8kMKdD0=";
+    version = "3.16.5";
+    hash = "sha256-UbOLY1qHYOoMQq3Agm2qI2+I6YLwv2kec6nqPyGZha4=";
   };
 
   passthru.updateScript = vscode-extension-update-script { };

pkgs/applications/editors/vscode/extensions/saoudrizwan.claude-dev/default.nix

@@ -7,8 +7,8 @@ vscode-utils.buildVscodeMarketplaceExtension {
   mktplcRef = {
     name = "claude-dev";
     publisher = "saoudrizwan";
-    version = "3.14.0";
-    hash = "sha256-Eel+kU8WxCeKDaQvO8fVlmGiDBF0/bqiFrNWvmA0DbQ=";
+    version = "3.15.1";
+    hash = "sha256-VuUvxLiPbdpBko3h/FFc1/kYUdUvy7f/euN+Js/Hp4I=";
   };
 
   meta = {

pkgs/applications/editors/vscode/extensions/tekumara.typos-vscode/default.nix

@@ -14,19 +14,19 @@ let
     {
       x86_64-linux = {
         arch = "linux-x64";
-        hash = "sha256-fn9cVi5fa+wv2LitNi4Bb4oFIDKFdl1mTrNPlK3Z0XE=";
+        hash = "sha256-130QnFYclUmvlqWZ62g8/rMZsJF43heXi9thp+RHfLo=";
       };
       aarch64-linux = {
         arch = "linux-arm64";
-        hash = "sha256-B+oKdmNBZAydWfwZHdgVMc1eemrrrANnQyhIphKcDxg=";
+        hash = "sha256-K+ZfHzxOwp4lTC0929am/KOs8RdVk5MXGP8JTYP7pX4=";
       };
       x86_64-darwin = {
         arch = "darwin-x64";
-        hash = "sha256-sJ4ZfdMytAOehcBQANl5X3Q2snbjd9/t7uUIb9QRMGw=";
+        hash = "sha256-H4N/nKWwv9IdQkjHeb1Q5VXoNguWXHZkB0s3MCfG17Y=";
       };
       aarch64-darwin = {
         arch = "darwin-arm64";
-        hash = "sha256-xCs61aCeIUlICyVCu5sKoVakpVPr01FBxIlmA3SZnt0=";
+        hash = "sha256-WyO18JIs3FCfcHh6p9YvrCk9SX/vSHQM2uI+AL9zFbo=";
       };
     }
     .${system} or (throw "Unsupported system: ${system}");
@@ -38,7 +38,7 @@ vscode-utils.buildVscodeMarketplaceExtension {
     # Please update the corresponding binary (typos-lsp)
     # when updating this extension.
     # See pkgs/by-name/ty/typos-lsp/package.nix
-    version = "0.1.36";
+    version = "0.1.37";
     inherit (extInfo) hash arch;
   };
 

pkgs/applications/editors/vscode/extensions/visualjj.visualjj/default.nix

@@ -11,26 +11,26 @@ vscode-utils.buildVscodeMarketplaceExtension {
       sources = {
         "x86_64-linux" = {
           arch = "linux-x64";
-          hash = "sha256-70IC1Df7FxIbh9iFPqC7ej+NpAW8BKD30qYlhtC0QLo=";
+          hash = "sha256-rEy5DXXBgyY2/vb4jm3VLbHiBEiUpvFWPjgACBS/Iec=";
         };
         "x86_64-darwin" = {
           arch = "darwin-x64";
-          hash = "sha256-NA6QjtqtEWRHjs4s1F3tVnd+qwk3T7KAhZdNsCv2WXo=";
+          hash = "sha256-lBOu0acFAfOUiBcm7+UYN1XMNWOW73kj+HpVGRVQrPE=";
         };
         "aarch64-linux" = {
           arch = "linux-arm64";
-          hash = "sha256-BIop7QBbJCRO5u81NMuRHcKtAHpPAWZFIApv7g/3pI8=";
+          hash = "sha256-Z1Ml70Ylepgw00aAzmhp21P047ZsKXCmX0DfgjvZhdY=";
         };
         "aarch64-darwin" = {
           arch = "darwin-arm64";
-          hash = "sha256-mghcU1iyxlU1uY9tb4j5/qdy5TM+MFXN2ci95erzihg=";
+          hash = "sha256-oMK2t2rFYCPS8sVKaNOIcFFMsmXrCNddxVaydftrrtc=";
         };
       };
     in
     {
       name = "visualjj";
       publisher = "visualjj";
-      version = "0.14.5";
+      version = "0.14.7";
     }
     // sources.${stdenvNoCC.hostPlatform.system}
       or (throw "Unsupported system ${stdenvNoCC.hostPlatform.system}");

pkgs/applications/editors/vscode/extensions/vscode-utils.nix

@@ -7,6 +7,7 @@
   vscode,
   unzip,
   jq,
+  vscode-extension-update-script,
 }:
 let
   buildVscodeExtension = lib.extendMkDerivation {
@@ -40,9 +41,14 @@ let
       {
         pname = "vscode-extension-${pname}";
 
-        passthru = passthru // {
-          inherit vscodeExtPublisher vscodeExtName vscodeExtUniqueId;
-        };
+        passthru =
+          {
+            updateScript = vscode-extension-update-script { };
+          }
+          // passthru
+          // {
+            inherit vscodeExtPublisher vscodeExtName vscodeExtUniqueId;
+          };
 
         inherit
           configurePhase

pkgs/applications/editors/vscode/vscodium.nix

@@ -26,11 +26,11 @@ let
 
   hash =
     {
-      x86_64-linux = "sha256-C1v6M3gliVm4iufKjAWNJgiJ2K2cIrIqvYqtsX/fyAQ=";
-      x86_64-darwin = "sha256-/0uFfMQa78joIQ2CogAddBnXmo4wpnh47Y0glJ7vWJg=";
-      aarch64-linux = "sha256-v2GLRrvQVFBlTkGi/teA+bpJYJIdZVNmjTS8oXjhF1c=";
-      aarch64-darwin = "sha256-qFJYQpOCDlwQO7Dy6P1hm/9yE3LACpF6PYOLK1kNzDs=";
-      armv7l-linux = "sha256-g/fWf17WWtAd8TKbZGWvGGiy0qTicEE9m5bFteLvswo=";
+      x86_64-linux = "sha256-BueYe1tl1IRQdXLkPNCmTzF/BYX+i7j3XK2JufsJ/gk=";
+      x86_64-darwin = "sha256-l0eiuq2SoNj14pDtF4myFySTXHEvXKLN/cO0fEa1nko=";
+      aarch64-linux = "sha256-jE10O+HmdF092XTAhVGc3pwfmXzwB5XpyogDyf1oyos=";
+      aarch64-darwin = "sha256-EDFcyeraRGjGylTOdahmkgUvKwzOhAr+iCIC2QLvPqU=";
+      armv7l-linux = "sha256-2YYTPxLaRSNvS6iFPxWfILvH14jmBgKa94C+jDw7SSI=";
     }
     .${system} or throwSystem;
 
@@ -41,7 +41,7 @@ callPackage ./generic.nix rec {
 
   # Please backport all compatible updates to the stable release.
   # This is important for the extension ecosystem.
-  version = "1.99.32846";
+  version = "1.100.03093";
   pname = "vscodium";
 
   executableName = "codium";

pkgs/applications/emulators/libretro/cores/flycast.nix

@@ -8,13 +8,13 @@
 }:
 mkLibretroCore {
   core = "flycast";
-  version = "0-unstable-2025-04-24";
+  version = "0-unstable-2025-05-10";
 
   src = fetchFromGitHub {
     owner = "flyinghead";
     repo = "flycast";
-    rev = "b04f0eb530c09f4b2a7402bd7f3b82e5daa4d173";
-    hash = "sha256-JCQEMfQDvnhUcSNiaVwDXAQmkFhgtwtW5XjAD/CBYjo=";
+    rev = "ffc32d2d8676e1ca35b074196afbfb2697ee7d59";
+    hash = "sha256-IF16YA8YynAhZ42G17aMwKRvlMG3DojrPqslWY43ww8=";
     fetchSubmodules = true;
   };
 

pkgs/by-name/ai/airtame/package.nix

@@ -66,11 +66,11 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "airtame-application";
-  version = "4.12.0";
+  version = "4.13.1";
 
   src = fetchurl {
     url = "https://downloads.airtame.com/app/latest/linux/Airtame-${finalAttrs.version}.deb";
-    hash = "sha256-HTqJ637iPtiReFLoGdgKkpxW0UGRPvLjgMMcVV+cRfY=";
+    hash = "sha256-3VvEsohH2siC2SxdrWSg0sjlbrBC2VR3NY5m6Q2YKHU=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/an/anytype-heart/package.nix

@@ -11,12 +11,14 @@
 
 let
   pname = "anytype-heart";
-  version = "0.40.19";
+  # Use only versions specified in anytype-ts middleware.version file:
+  #  https://github.com/anyproto/anytype-ts/blob/v<anytype-ts-version>/middleware.version
+  version = "0.40.21";
   src = fetchFromGitHub {
     owner = "anyproto";
     repo = "anytype-heart";
     tag = "v${version}";
-    hash = "sha256-BUQZmZ7jKWdbBcWtx7rbbeEJbo5FncYHmp/5FVd0vdI=";
+    hash = "sha256-53LSaETzxwhKkI9is6N6G1+f5Cnf7KStvHA9qeaWUNo=";
   };
 
   arch =
@@ -34,7 +36,7 @@ in
 buildGoModule {
   inherit pname version src;
 
-  vendorHash = "sha256-xsxgeoS1wIi0/LNGmZZyWKWzhkMJUnCEslXcIz+Dw8U=";
+  vendorHash = "sha256-WsYRkAIYDkKWkQpq843dD7Rqc993eHSgee2IX6PomcU=";
 
   subPackages = [ "cmd/grpcserver" ];
   tags = [

pkgs/by-name/an/anytype/package.nix

@@ -13,27 +13,27 @@
 
 let
   pname = "anytype";
-  version = "0.46.4";
+  version = "0.46.5";
 
   src = fetchFromGitHub {
     owner = "anyproto";
     repo = "anytype-ts";
     tag = "v${version}";
-    hash = "sha256-JA8DHOPRLPoc8/GXkHfktVy3sZ5BpSFmgn71Xt15iLE=";
+    hash = "sha256-gDlxyHxBLWVBLnaI6rFclfjwqkw9gneBEC7ssmWDKYU=";
   };
   description = "P2P note-taking tool";
 
   locales = fetchFromGitHub {
     owner = "anyproto";
     repo = "l10n-anytype-ts";
-    rev = "07eed415b0eec409dcdfedf848936d41f190c7ec";
-    hash = "sha256-PgDZkL/tg7/uZhLLenRjkb5NB1hQjUJflaAce2TlDRE=";
+    rev = "1d7ca0073bdd02d0145b8da3b1b956ca0652a108";
+    hash = "sha256-aL79DOIFH3CocbcLW0SJ472mYPZJXrPJyRKy8zXiF4o=";
   };
 in
 buildNpmPackage {
   inherit pname version src;
 
-  npmDepsHash = "sha256-4pMYKmQ7+f8BKztLF4Jfe89tuh+DiQNnS3ulL0i6Gw0=";
+  npmDepsHash = "sha256-WEw3RCi7dWs2eMYxLH7DcmWBrN4T8T6beIyplcXgJAA=";
 
   env = {
     ELECTRON_SKIP_BINARY_DOWNLOAD = "1";

pkgs/by-name/ar/archtika/package.nix

@@ -1,65 +0,0 @@
-{
-  lib,
-  stdenv,
-  buildNpmPackage,
-  importNpmLock,
-  symlinkJoin,
-  fetchFromGitHub,
-  nix-update-script,
-}:
-
-let
-  version = "1.2.1";
-
-  src = fetchFromGitHub {
-    owner = "archtika";
-    repo = "archtika";
-    tag = "v${version}";
-    hash = "sha256-GffYAtLs12v2Lt1WoKJOG5dZsmzDcySZKFBQwCT9nnY=";
-  };
-
-  web = buildNpmPackage {
-    name = "web-app";
-    src = "${src}/web-app";
-    npmDepsHash = "sha256-2udi8vLLvdoZxIyRKLOCfEpEMsooxsIrM1wiua1QPAI=";
-    npmFlags = [ "--legacy-peer-deps" ];
-    installPhase = ''
-      mkdir -p $out/web-app
-      cp package.json $out/web-app
-      cp -r node_modules $out/web-app
-      cp -r build/* $out/web-app
-      cp -r template-styles $out/web-app
-    '';
-  };
-
-  api = stdenv.mkDerivation {
-    name = "api";
-    src = "${src}/rest-api";
-    installPhase = ''
-      mkdir -p $out/rest-api/db/migrations
-      cp -r db/migrations/* $out/rest-api/db/migrations
-    '';
-  };
-in
-symlinkJoin {
-  pname = "archtika";
-  inherit version;
-
-  paths = [
-    web
-    api
-  ];
-
-  passthru = {
-    inherit src web;
-    updateScript = nix-update-script { };
-  };
-
-  meta = {
-    description = "Modern, performant and lightweight CMS";
-    homepage = "https://archtika.com";
-    license = lib.licenses.gpl3;
-    maintainers = [ lib.maintainers.thiloho ];
-    platforms = lib.platforms.unix;
-  };
-}

pkgs/by-name/ch/chatbox/package.nix

@@ -6,11 +6,11 @@
 }:
 let
   pname = "chatbox";
-  version = "1.12.0";
+  version = "1.12.3";
 
   src = fetchurl {
     url = "https://download.chatboxai.app/releases/Chatbox-${version}-x86_64.AppImage";
-    hash = "sha256-uSusmtLRTTwp/5xH5CRRSAoojgCWZzeFwpkxc4r+24Y=";
+    hash = "sha256-/jrieUFKGSZT59e0q42rmUeDslHWgEPga/7jg8375sw=";
   };
 
   appimageContents = appimageTools.extract { inherit pname version src; };

pkgs/by-name/ch/cherry-studio/package.nix

@@ -18,13 +18,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "cherry-studio";
-  version = "1.2.10";
+  version = "1.3.0";
 
   src = fetchFromGitHub {
     owner = "CherryHQ";
     repo = "cherry-studio";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-txzZbtA6Fvc/2cpD9YM5wwtZix+qjtW0B6aAV4I7Ce8=";
+    hash = "sha256-/cj4wMYPWjO5tJxIDdP7GkciWLVZBiDivEIHiOxpk0s=";
   };
 
   postPatch = ''
@@ -41,7 +41,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   offlineCache = yarn-berry.fetchYarnBerryDeps {
     inherit (finalAttrs) src missingHashes;
-    hash = "sha256-rKXUGfBL8upKU5MIe9fqHyEETNKsWdiUdsbHmvJPQdQ=";
+    hash = "sha256-WUsG8mqozphU2YIT73KqMNP62TBiay3EiGrMBgd2QJw=";
   };
 
   nativeBuildInputs = [
@@ -79,7 +79,7 @@ stdenv.mkDerivation (finalAttrs: {
       exec = "cherry-studio --no-sandbox %U";
       terminal = false;
       icon = "cherry-studio";
-      startupWMClass = "Cherry Studio";
+      startupWMClass = "CherryStudio";
       categories = [ "Utility" ];
       mimeTypes = [ "x-scheme-handler/cherrystudio" ];
     })
@@ -88,12 +88,12 @@ stdenv.mkDerivation (finalAttrs: {
   installPhase = ''
     runHook preInstall
 
-    mkdir -p $out/lib/cherry-studio
-    cp -r dist/linux-unpacked/{resources,LICENSE*} $out/lib/cherry-studio
+    mkdir -p $out/opt/cherry-studio
+    cp -r dist/linux-unpacked/{resources,LICENSE*} $out/opt/cherry-studio
     install -Dm644 build/icon.png $out/share/pixmaps/cherry-studio.png
     makeWrapper ${lib.getExe electron} $out/bin/cherry-studio \
       --inherit-argv0 \
-      --add-flags $out/lib/cherry-studio/resources/app.asar \
+      --add-flags $out/opt/cherry-studio/resources/app.asar \
       --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--ozone-platform-hint=auto --enable-features=WaylandWindowDecorations --enable-wayland-ime=true --wayland-text-input-version=3}}" \
       --add-flags ${lib.escapeShellArg commandLineArgs}
 

pkgs/by-name/ch/cherry-studio/update.sh

@@ -19,10 +19,10 @@ nix-update cherry-studio --version "$latestVersion" || true
 
 export HOME=$(mktemp -d)
 src=$(nix-build --no-link $PWD -A cherry-studio.src)
-TMPDIR=$(mktemp -d)
-cp --recursive --no-preserve=mode $src/* $TMPDIR
-cd $TMPDIR
+WORKDIR=$(mktemp -d)
+cp --recursive --no-preserve=mode $src/* $WORKDIR
+pushd $WORKDIR
 yarn-berry-fetcher missing-hashes yarn.lock >$PACKAGE_DIR/missing-hashes.json
-rm -rf $TMPDIR
+popd
 
 nix-update cherry-studio --version skip || true

pkgs/by-name/co/costa/package.nix

@@ -10,13 +10,13 @@
 
 stdenv.mkDerivation rec {
   pname = "COSTA";
-  version = "2.2.2";
+  version = "2.2.4";
 
   src = fetchFromGitHub {
     owner = "eth-cscs";
     repo = "COSTA";
     rev = "v${version}";
-    hash = "sha256-jiAyZXC7wiuEnOLsQFFLxhN3AsGXN09q/gHC2Hrb2gg=";
+    hash = "sha256-smrDK7iucGWlL1pDv+O4QXefxr1QirC00q5Wva0S+ks=";
   };
 
   nativeBuildInputs = [ cmake ];

pkgs/by-name/fe/feishin/package.nix

@@ -3,7 +3,7 @@
   stdenv,
   buildNpmPackage,
   fetchFromGitHub,
-  electron_33,
+  electron_36,
   darwin,
   copyDesktopItems,
   makeDesktopItem,
@@ -11,22 +11,22 @@
 }:
 let
   pname = "feishin";
-  version = "0.12.3";
+  version = "0.12.6";
 
   src = fetchFromGitHub {
     owner = "jeffvli";
     repo = "feishin";
     rev = "v${version}";
-    hash = "sha256-Tjh68b+41YrMNB14AZ3jXqBXDOmaaOYQKXJOyTUF474=";
+    hash = "sha256-cnlPks/sJdcxHdIppHn8Q8d2tkwVlPMofQxjdAlBreg=";
   };
 
-  electron = electron_33;
+  electron = electron_36;
 in
 buildNpmPackage {
   inherit pname version;
 
   inherit src;
-  npmDepsHash = "sha256-KZsxKDAQ7UTnEemr6S9rqKtqPeTvqrhfxURSGTKkMMM=";
+  npmDepsHash = "sha256-lThh29prT/cHRrp2mEtUW4eeVfCtkk+54EPNUyGHyq8=";
 
   npmFlags = [ "--legacy-peer-deps" ];
   makeCacheWritable = true;
@@ -60,7 +60,7 @@ buildNpmPackage {
         inherit version;
 
         src = "${src}/release/app";
-        npmDepsHash = "sha256-98P2dNmWcp8Hc8Xe43LM3dtxye7myhp1bHucKoKEcjI=";
+        npmDepsHash = "sha256-kEe5HH/oslH8vtAcJuWTOLc0ZQPxlDVMS4U0RpD8enE=";
 
         npmFlags = [ "--ignore-scripts" ];
         dontNpmBuild = true;

pkgs/by-name/fo/forgejo-cli/package.nix

@@ -1,32 +1,36 @@
 {
   lib,
+  stdenv,
   rustPlatform,
   fetchFromGitea,
   pkg-config,
+  installShellFiles,
+  writableTmpDirAsHomeHook,
   libgit2,
   oniguruma,
   openssl,
   zlib,
 }:
-let
-  version = "0.3.0";
-in
-rustPlatform.buildRustPackage {
+rustPlatform.buildRustPackage (finalAttrs: {
   pname = "forgejo-cli";
-  inherit version;
+  version = "0.3.0";
 
   src = fetchFromGitea {
     domain = "codeberg.org";
     owner = "Cyborus";
     repo = "forgejo-cli";
-    rev = "v${version}";
+    tag = "v${finalAttrs.version}";
     hash = "sha256-8KPR7Fx26hj5glKDjczCLP6GgQBUsA5TpjhO5UZOpik=";
   };
 
   useFetchCargoVendor = true;
   cargoHash = "sha256-kW7Pexydkosaufk1e8P5FaY+dgkeeTG5qgJxestWkVs=";
 
-  nativeBuildInputs = [ pkg-config ];
+  nativeBuildInputs = [
+    pkg-config
+    installShellFiles
+    writableTmpDirAsHomeHook # Needed for shell completions
+  ];
 
   buildInputs = [
     libgit2
@@ -40,15 +44,25 @@ rustPlatform.buildRustPackage {
     BUILD_TYPE = "nixpkgs";
   };
 
+  postInstall = lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
+    installShellCompletion --cmd fj \
+      --bash <($out/bin/fj completion bash) \
+      --fish <($out/bin/fj completion fish) \
+      --zsh <($out/bin/fj completion zsh)
+  '';
+
   meta = {
     description = "CLI application for interacting with Forgejo";
     homepage = "https://codeberg.org/Cyborus/forgejo-cli";
-    changelog = "https://codeberg.org/Cyborus/forgejo-cli/releases/tag/v${version}";
+    changelog = "https://codeberg.org/Cyborus/forgejo-cli/releases/tag/v${finalAttrs.version}";
     license = with lib.licenses; [
       asl20
       mit
     ];
-    maintainers = with lib.maintainers; [ isabelroses ];
+    maintainers = with lib.maintainers; [
+      awwpotato
+      isabelroses
+    ];
     mainProgram = "fj";
   };
-}
+})

pkgs/by-name/gi/git-bug/package.nix

@@ -7,13 +7,13 @@
 
 buildGoModule rec {
   pname = "git-bug";
-  version = "0.8.1";
+  version = "0.9.0";
 
   src = fetchFromGitHub {
     owner = "git-bug";
     repo = "git-bug";
     rev = "v${version}";
-    sha256 = "sha256-lfvHoXbanisq6MaVXlwKmW8YTeWjx6E6b4N9xICemKc=";
+    sha256 = "sha256-w4PrcWLqkxwtyccf2OZAqFlLXNsZZNOTyny26VZr9Cg=";
   };
 
   vendorHash = "sha256-z9StU5cvZlDkmC7TE6JOhpxAx5oSTxAQTBh1LEksKww=";
@@ -28,9 +28,9 @@ buildGoModule rec {
   ];
 
   ldflags = [
-    "-X github.com/MichaelMure/git-bug/commands.GitCommit=v${version}"
-    "-X github.com/MichaelMure/git-bug/commands.GitLastTag=${version}"
-    "-X github.com/MichaelMure/git-bug/commands.GitExactTag=${version}"
+    "-X github.com/git-bug/git-bug/commands.GitCommit=v${version}"
+    "-X github.com/git-bug/git-bug/commands.GitLastTag=${version}"
+    "-X github.com/git-bug/git-bug/commands.GitExactTag=${version}"
   ];
 
   postInstall = ''

pkgs/by-name/hy/hyperbeam/package.nix

@@ -1,39 +1,38 @@
 {
-  buildNpmPackage,
   lib,
-  fetchurl,
+  buildNpmPackage,
   fetchFromGitHub,
+  nix-update-script,
 }:
 
-buildNpmPackage rec {
+buildNpmPackage (finalAttrs: {
   pname = "hyperbeam";
-  version = "3.0.2";
-
-  npmDepsHash = "sha256-ZZX3BOtSSiLvAEcWuKiUMHrYOt8N6SYYQ+QGzbprL3E=";
-
-  dontNpmBuild = true;
+  version = "3.1.0";
 
   src = fetchFromGitHub {
     owner = "holepunchto";
     repo = "hyperbeam";
-    rev = "v${version}";
-    hash = "sha256-g3eGuol3g1yfGHDSzI1wQXMxJudGCt4PHHdmtiRQS/Q=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-SSHSQIVfHYFa1YkV3eeDkXSQV8KERADlmhOmxIiY+ko=";
   };
 
-  patches = [
-    # TODO: remove after this is merged: https://github.com/holepunchto/hyperbeam/pull/22
-    (fetchurl {
-      url = "https://github.com/holepunchto/hyperbeam/commit/e84e4be979bf89d8e8042878d2beb5c1a5dbf946.patch";
-      hash = "sha256-AdXmfti9/08kRYuL1l4gXmvSV7bV0kE72Pf/bNqiFQw=";
-    })
-  ];
+  npmDepsHash = "sha256-EjzdBqA1KNZbhkRkyMwC/YSgbkbs5BRC6ummQkQHyEs=";
+
+  dontNpmBuild = true;
+
+  postPatch = ''
+    cp ${./package-lock.json} ./package-lock.json
+  '';
+
+  passthru.updateScript = nix-update-script { };
 
   meta = {
-    description = "A 1-1 end-to-end encrypted internet pipe powered by Hyperswarm ";
+    description = "1-1 End-to-End Encrypted Internet Pipe Powered by Hyperswarm ";
     homepage = "https://github.com/holepunchto/hyperbeam";
-    license = lib.licenses.mit;
-    maintainers = with lib.maintainers; [ davhau ];
     mainProgram = "hyperbeam";
+    license = lib.licenses.mit;
     platforms = lib.platforms.all;
+    teams = with lib.teams; [ ngi ];
+    maintainers = with lib.maintainers; [ davhau ];
   };
-}
+})

pkgs/by-name/hy/hyperblobs/package.nix

@@ -0,0 +1,47 @@
+{
+  lib,
+  buildNpmPackage,
+  fetchFromGitHub,
+  nix-update-script,
+}:
+
+buildNpmPackage (finalAttrs: {
+  pname = "hyperblobs";
+  version = "2.8.0";
+
+  src = fetchFromGitHub {
+    owner = "holepunchto";
+    repo = "hyperblobs";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-cj716lDyQj7IVbAmfQaKagfR1+ZYoQgOTXIn/3d+KEA=";
+  };
+
+  npmDepsHash = "sha256-9/hoj+ktd5DyBjGnhPFpC3b7A+XjWWoFhbvvW+o8DBc=";
+
+  dontNpmBuild = true;
+
+  doCheck = true;
+
+  checkPhase = ''
+    runHook preCheck
+
+    npm run test
+
+    runHook postCheck
+  '';
+
+  postPatch = ''
+    cp ${./package-lock.json} ./package-lock.json
+  '';
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "Blob Store for Hypercore";
+    homepage = "https://github.com/holepunchto/hyperblobs";
+    license = lib.licenses.asl20;
+    platforms = lib.platforms.all;
+    teams = with lib.teams; [ ngi ];
+    maintainers = with lib.maintainers; [ ];
+  };
+})

pkgs/by-name/hy/hyperswarm/package.nix

@@ -0,0 +1,37 @@
+{
+  lib,
+  buildNpmPackage,
+  fetchFromGitHub,
+  nix-update-script,
+}:
+
+buildNpmPackage (finalAttrs: {
+  pname = "hyperswarm";
+  version = "4.11.5";
+
+  src = fetchFromGitHub {
+    owner = "holepunchto";
+    repo = "hyperswarm";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-jyEwIb8nAnk6Fiw3lMgURoSOqz3lka085c58qq4Vxwc=";
+  };
+
+  npmDepsHash = "sha256-4ysUYFIFlzr57J7MdZit1yX3Dgpb2eY0rdYnwyppwK0=";
+
+  dontNpmBuild = true;
+
+  postPatch = ''
+    cp ${./package-lock.json} ./package-lock.json
+  '';
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "Distributed Networking Stack for Connecting Peers";
+    homepage = "https://github.com/holepunchto/hyperswarm";
+    license = lib.licenses.mit;
+    platforms = lib.platforms.unix;
+    teams = with lib.teams; [ ngi ];
+    maintainers = with lib.maintainers; [ ];
+  };
+})

pkgs/by-name/md/mdbook-d2/package.nix

@@ -6,17 +6,17 @@
 
 rustPlatform.buildRustPackage rec {
   pname = "mdbook-d2";
-  version = "0.3.3";
+  version = "0.3.4";
 
   src = fetchFromGitHub {
     owner = "danieleades";
     repo = "mdbook-d2";
     rev = "v${version}";
-    hash = "sha256-PsPCbuSK8JlNZOqFbxCK0f8h+7EC4tNFtjBfJqiPi7Q=";
+    hash = "sha256-iVPB4SAzspw8gZHzEQVFRbFjyPCkxrvXvhMszopzslE=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-emfO7D7JU/fQYdnaK7eWR8tCPx3ffvU/pTutSURZMBQ=";
+  cargoHash = "sha256-9D/osDyFwIhgv3scnnpsdN6S4qCPWuAU9tajENyWaXo=";
   doCheck = false;
 
   meta = with lib; {

pkgs/by-name/no/noto-fonts/package.nix

@@ -31,7 +31,7 @@ stdenvNoCC.mkDerivation rec {
 
   outputs = [
     "out"
-    "megamerge" # Experimental fonts created by mergeing regular notofonts
+    "megamerge" # Experimental fonts created by merging regular notofonts
   ];
 
   _variants = map (variant: builtins.replaceStrings [ " " ] [ "" ] variant) variants;

pkgs/by-name/pg/pgbackrest/package.nix

@@ -1,31 +1,32 @@
 {
-  lib,
-  stdenv,
-  fetchFromGitHub,
-  meson,
-  ninja,
-  python3,
-  pkg-config,
-  libbacktrace,
   bzip2,
-  lz4,
+  fetchFromGitHub,
+  lib,
+  libbacktrace,
   libpq,
+  libssh2,
   libxml2,
   libyaml,
+  lz4,
+  meson,
+  ninja,
+  pkg-config,
+  python3,
+  stdenv,
   zlib,
-  libssh2,
   zstd,
+  nixosTests,
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "pgbackrest";
   version = "2.55.1";
 
   src = fetchFromGitHub {
     owner = "pgbackrest";
     repo = "pgbackrest";
-    rev = "release/${version}";
-    sha256 = "sha256-A1dTywcCHBu7Ml0Q9k//VVPFN1C3kmmMkq4ok9T4g94=";
+    tag = "release/${finalAttrs.version}";
+    hash = "sha256-A1dTywcCHBu7Ml0Q9k//VVPFN1C3kmmMkq4ok9T4g94=";
   };
 
   strictDeps = true;
@@ -33,28 +34,30 @@ stdenv.mkDerivation rec {
   nativeBuildInputs = [
     meson
     ninja
-    python3
     pkg-config
+    python3
   ];
 
   buildInputs = [
-    libbacktrace
     bzip2
-    lz4
+    libbacktrace
     libpq
+    libssh2
     libxml2
     libyaml
+    lz4
     zlib
-    libssh2
     zstd
   ];
 
-  meta = with lib; {
+  passthru.tests = nixosTests.pgbackrest;
+
+  meta = {
     description = "Reliable PostgreSQL backup & restore";
-    homepage = "https://pgbackrest.org/";
-    changelog = "https://github.com/pgbackrest/pgbackrest/releases";
-    license = licenses.mit;
+    homepage = "https://pgbackrest.org";
+    changelog = "https://github.com/pgbackrest/pgbackrest/releases/tag/release%2F${finalAttrs.version}";
+    license = lib.licenses.mit;
     mainProgram = "pgbackrest";
-    maintainers = with maintainers; [ zaninime ];
+    maintainers = with lib.maintainers; [ zaninime ];
   };
-}
+})

pkgs/by-name/po/pot/package.nix

@@ -25,13 +25,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "pot";
-  version = "3.0.6";
+  version = "3.0.7";
 
   src = fetchFromGitHub {
     owner = "pot-app";
     repo = "pot-desktop";
     tag = finalAttrs.version;
-    hash = "sha256-PUXZT1kiInM/CXUoRko/5qlrRurGpQ4ym5YMTgFwuxE=";
+    hash = "sha256-0Q1hf1AGAZv6jt05tV3F6++lzLpddvjhiykIhV40cPs=";
   };
 
   sourceRoot = "${finalAttrs.src.name}/src-tauri";

pkgs/by-name/ro/rojo/package.nix

@@ -1,51 +1,57 @@
 {
   lib,
   stdenv,
-  fetchFromGitHub,
   rustPlatform,
+  fetchFromGitHub,
   pkg-config,
   openssl,
+  versionCheckHook,
+  nix-update-script,
 }:
-
-rustPlatform.buildRustPackage rec {
+rustPlatform.buildRustPackage (finalAttrs: {
   pname = "rojo";
-  version = "7.5.0";
+  version = "7.5.1";
 
   src = fetchFromGitHub {
     owner = "rojo-rbx";
     repo = "rojo";
-    rev = "v${version}";
-    hash = "sha256-aCwQ07z7MhBS4C03npwjQOmfJXwD7trYo/upT3GAkHU=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-awMio62guyP5qZH4i5hwXV5re6o45HDwqIJb3Dd71Is=";
     fetchSubmodules = true;
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-naItqyJaIxFZuswbrE8RZqMffGy1MaIa0RX9RLOWmyw=";
+  cargoHash = "sha256-iWRjXC+JaBA/z2eOHiiqFFtS2gug5/hkIpYrPdHyux0=";
 
-  nativeBuildInputs = [
-    pkg-config
-  ];
-
-  buildInputs = [
-    openssl
-  ];
+  nativeBuildInputs = [ pkg-config ];
+  buildInputs = [ openssl ];
 
   # reqwest's native-tls-vendored feature flag uses vendored openssl. this disables that
-  OPENSSL_NO_VENDOR = "1";
+  env.OPENSSL_NO_VENDOR = true;
 
   # tests flaky on darwin on hydra
   doCheck = !stdenv.hostPlatform.isDarwin;
 
-  meta = with lib; {
+  doInstallCheck = true;
+  nativeInstallCheckInputs = [ versionCheckHook ];
+  versionCheckProgram = "${placeholder "out"}/bin/rojo";
+  versionCheckProgramArg = "--version";
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    changelog = "https://github.com/rojo-rbx/rojo/blob/v${finalAttrs.version}/CHANGELOG.md";
     description = "Project management tool for Roblox";
-    mainProgram = "rojo";
-    longDescription = ''
-      Rojo is a tool designed to enable Roblox developers to use professional-grade software engineering tools.
-    '';
+    downloadPage = "https://github.com/rojo-rbx/rojo/releases/tag/v${finalAttrs.version}";
     homepage = "https://rojo.space";
-    downloadPage = "https://github.com/rojo-rbx/rojo/releases/tag/v${version}";
-    changelog = "https://github.com/rojo-rbx/rojo/raw/v${version}/CHANGELOG.md";
-    license = licenses.mpl20;
-    maintainers = with maintainers; [ wackbyte ];
+    license = lib.licenses.mpl20;
+    longDescription = ''
+      Tool designed to enable Roblox developers to use professional-grade software engineering tools.
+    '';
+    mainProgram = "rojo";
+    maintainers = with lib.maintainers; [
+      wackbyte
+      HeitorAugustoLN
+    ];
   };
-}
+})

pkgs/by-name/sc/scipopt-papilo/package.nix

@@ -12,16 +12,16 @@
 
 stdenv.mkDerivation rec {
   pname = "scipopt-papilo";
-  version = "2.4.1";
+  version = "2.4.2";
 
   # To correlate scipVersion and version, check: https://scipopt.org/#news
-  scipVersion = "9.2.1";
+  scipVersion = "9.2.2";
 
   src = fetchFromGitHub {
     owner = "scipopt";
     repo = "papilo";
     tag = "v${version}";
-    hash = "sha256-oQ9iq5UkFK0ghUx6uxdJIOo5niQjniHegSZptqi2fgE=";
+    hash = "sha256-/1AsAesUh/5YXeCU2OYopoG3SXAwAecPD88QvGkb2bY=";
   };
 
   nativeBuildInputs = [ cmake ];
@@ -42,10 +42,6 @@ stdenv.mkDerivation rec {
     #   > include/boost/multiprecision/mpfr.hpp:22: fatal error: mpfr.h: No such file or directory
     #   > compilation terminated.
     (lib.cmakeBool "SOPLEX" false)
-
-    # (lib.cmakeBool "GMP" true)
-    # (lib.cmakeBool "QUADMATH" true)
-    # (lib.cmakeBool "TBB" true)
   ];
   doCheck = true;
   meta = {

pkgs/by-name/sc/scipopt-scip/package.nix

@@ -20,13 +20,13 @@
 
 stdenv.mkDerivation rec {
   pname = "scipopt-scip";
-  version = "9.2.1";
+  version = "9.2.2";
 
   src = fetchFromGitHub {
     owner = "scipopt";
     repo = "scip";
     tag = "v${lib.replaceStrings [ "." ] [ "" ] version}";
-    hash = "sha256-xYxbMZYYqFNInlct8Ju0SrksfJlwV9Q+AHjxq7xhfAs=";
+    hash = "sha256-gxR308XrlmuUym/ujwGcD9a7Z+Z7vQNHaK4zO/PWPBQ=";
   };
 
   nativeBuildInputs = [ cmake ];

pkgs/by-name/sc/scipopt-soplex/package.nix

@@ -11,16 +11,16 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "scipopt-soplex";
-  version = "713";
+  version = "714";
 
   # To correlate scipVersion and version, check: https://scipopt.org/#news
-  scipVersion = "9.2.1";
+  scipVersion = "9.2.2";
 
   src = fetchFromGitHub {
     owner = "scipopt";
     repo = "soplex";
     rev = "release-${builtins.replaceStrings [ "." ] [ "" ] finalAttrs.version}";
-    hash = "sha256-qI7VGPAm3ALzeiD/OgvlZ1w2GzHRYdBajTW5XdIN9pU=";
+    hash = "sha256-j5dsCAjEaReVpHHCM8FUyDIhxZ4P2yk2h89k5omTh8o=";
   };
 
   nativeBuildInputs = [ cmake ];

pkgs/by-name/sc/scipopt-ug/package.nix

@@ -13,7 +13,7 @@ stdenv.mkDerivation rec {
   version = "1.0.0-beta6";
 
   # To correlate scipVersion and version, check: https://scipopt.org/#news
-  scipVersion = "9.2.1";
+  scipVersion = "9.2.2";
 
   # Take the SCIPOptSuite source since no other source exists publicly.
   src = fetchzip {

pkgs/by-name/sc/scipopt-zimpl/package.nix

@@ -14,7 +14,7 @@ stdenv.mkDerivation rec {
   version = "362";
 
   # To correlate scipVersion and version, check: https://scipopt.org/#news
-  scipVersion = "9.2.1";
+  scipVersion = "9.2.2";
 
   src = fetchFromGitHub {
     owner = "scipopt";

pkgs/by-name/sp/spicetify-cli/package.nix

@@ -8,16 +8,16 @@
 }:
 buildGoModule (finalAttrs: {
   pname = "spicetify-cli";
-  version = "2.40.5";
+  version = "2.40.7";
 
   src = fetchFromGitHub {
     owner = "spicetify";
     repo = "cli";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-qBUGi4Q1RZnJ7cXNT9fjSPj5CVdku37h5+4Pv42/B7Q=";
+    hash = "sha256-iNRjRfRrK/pLL4xZX6Q/LV45NyNG1u4CyQGZtZYb2X8=";
   };
 
-  vendorHash = "sha256-yCxEpfqZRJcx4KevS+vqq6taHCZyEw1VK4Xt6BPPFAo=";
+  vendorHash = "sha256-901njlGcAxr12F9w6yQ+ESsptlwsZsMvKPUmlHxehmA=";
 
   ldflags = [
     "-s -w"

pkgs/by-name/th/the-way/package.nix

@@ -1,7 +1,8 @@
 {
   lib,
+  stdenv,
   rustPlatform,
-  fetchCrate,
+  fetchFromGitHub,
   installShellFiles,
 }:
 
@@ -9,9 +10,11 @@ rustPlatform.buildRustPackage rec {
   pname = "the-way";
   version = "0.20.3";
 
-  src = fetchCrate {
-    inherit pname version;
-    hash = "sha256-/vG5LkQiA8iPP+UV1opLeJwbYfmzqYwpsoMizpGT98o=";
+  src = fetchFromGitHub {
+    owner = "out-of-cheese-error";
+    repo = "the-way";
+    tag = "v${version}";
+    hash = "sha256-zsfk5APxbnssMKud9xGc70N+57LSc+vk6sSb2XzFUyA=";
   };
 
   useFetchCargoVendor = true;
@@ -19,9 +22,10 @@ rustPlatform.buildRustPackage rec {
 
   nativeBuildInputs = [ installShellFiles ];
 
+  doCheck = !stdenv.hostPlatform.isDarwin;
   useNextest = true;
 
-  postInstall = ''
+  postInstall = lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
     $out/bin/the-way config default tmp.toml
     for shell in bash fish zsh; do
       THE_WAY_CONFIG=tmp.toml $out/bin/the-way complete $shell > the-way.$shell
@@ -35,6 +39,7 @@ rustPlatform.buildRustPackage rec {
     homepage = "https://github.com/out-of-cheese-error/the-way";
     changelog = "https://github.com/out-of-cheese-error/the-way/blob/v${version}/CHANGELOG.md";
     license = with licenses; [ mit ];
+    platforms = lib.platforms.unix;
     maintainers = with maintainers; [
       figsoda
       numkem

pkgs/by-name/uw/uwsm/package.nix

@@ -28,13 +28,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "uwsm";
-  version = "0.21.3";
+  version = "0.21.4";
 
   src = fetchFromGitHub {
     owner = "Vladimir-csp";
     repo = "uwsm";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-jOwzz65W9rd61U6r4mThe38oMR2f47pxMMSlO/AWQEU=";
+    hash = "sha256-/URa5/NK4AowYx933HwKE01191HMRSvuxtDKFKiMQr8=";
   };
 
   nativeBuildInputs = [

pkgs/by-name/ux/uxplay/package.nix

@@ -15,13 +15,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "uxplay";
-  version = "1.71.1";
+  version = "1.72";
 
   src = fetchFromGitHub {
     owner = "FDH2";
     repo = "UxPlay";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-qb/oYTScbHypwyo+znhDw8Mz5u+uhM8Jn6Gff3JK+Bc=";
+    hash = "sha256-pS9TgGymQwSDBrhHMQYasJfDchMap49fhHTgxYzq+L4=";
   };
 
   postPatch = ''

pkgs/by-name/za/zashboard/package.nix

@@ -9,13 +9,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "zashboard";
-  version = "1.81.0";
+  version = "1.83.0";
 
   src = fetchFromGitHub {
     owner = "Zephyruso";
     repo = "zashboard";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-pZ0oSH20vdvfAhKfEn8LPRUN1NgBkSDmxdwFZF6ynB4=";
+    hash = "sha256-PUzsqzqFTDBC+n/WOOwoDNVzBmxHFqPYy73VFqHcsA4=";
   };
 
   nativeBuildInputs = [
@@ -25,7 +25,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   pnpmDeps = pnpm_9.fetchDeps {
     inherit (finalAttrs) pname version src;
-    hash = "sha256-urnkCeGXUA194NiD0BdNFNGRHia0ea+ibKLmuQJ0cgI=";
+    hash = "sha256-If3N000TbUERPo3hPBQtv/iQw1p0MhqFdFfhn8HHkrs=";
   };
 
   buildPhase = ''

pkgs/data/fonts/open-relay/default.nix

@@ -22,7 +22,8 @@ let
       installPhase = ''
         runHook preInstall
 
-        install -D -m444 -t "$out/share/fonts/truetype" "${directory}/*.ttf"
+
+        install -D -m444 -t "$out/share/fonts/truetype" "${directory}/"*.ttf
         install -D -m644 -t "$out/share/doc/${finalAttrs.pname}-${finalAttrs.version}" "${directory}/OFL.txt"
 
         runHook postInstall

pkgs/development/coq-modules/metarocq/default.nix

@@ -0,0 +1,142 @@
+{
+  lib,
+  mkCoqDerivation,
+  single ? false,
+  coq,
+  equations,
+  version ? null,
+}@args:
+
+let
+  repo = "metarocq";
+  owner = "MetaRocq";
+  defaultVersion = lib.switch coq.coq-version [
+    {
+      case = "9.0";
+      out = "1.4-9.0";
+    }
+  ] null;
+  release = {
+    "1.4-9.0".sha256 = "sha256-5QecDAMkvgfDPZ7/jDfnOgcE+Eb1LTAozP7nz6nkuxg=";
+  };
+  releaseRev = v: "v${v}";
+
+  # list of core metarocq packages and their dependencies
+  packages = {
+    "utils" = [ ];
+    "common" = [ "utils" ];
+    "template-rocq" = [ "common" ];
+    "pcuic" = [ "common" ];
+    "safechecker" = [ "pcuic" ];
+    "template-pcuic" = [
+      "template-rocq"
+      "pcuic"
+    ];
+    "erasure" = [
+      "safechecker"
+      "template-pcuic"
+    ];
+    "quotation" = [
+      "template-rocq"
+      "pcuic"
+      "template-pcuic"
+    ];
+    "safechecker-plugin" = [
+      "template-pcuic"
+      "safechecker"
+    ];
+    "erasure-plugin" = [
+      "template-pcuic"
+      "erasure"
+    ];
+    "translations" = [ "template-rocq" ];
+    "all" = [
+      "safechecker-plugin"
+      "erasure-plugin"
+      "translations"
+      "quotation"
+    ];
+  };
+
+  template-rocq = metarocq_ "template-rocq";
+
+  metarocq_ =
+    package:
+    let
+      metarocq-deps = lib.optionals (package != "single") (map metarocq_ packages.${package});
+      pkgpath = if package == "single" then "./" else "./${package}";
+      pname = if package == "all" then "metarocq" else "metarocq-${package}";
+      pkgallMake = ''
+        mkdir all
+        echo "all:" > all/Makefile
+        echo "install:" >> all/Makefile
+      '';
+      derivation = mkCoqDerivation (
+        {
+          inherit
+            version
+            pname
+            defaultVersion
+            release
+            releaseRev
+            repo
+            owner
+            ;
+
+          mlPlugin = true;
+          propagatedBuildInputs = [
+            equations
+            coq.ocamlPackages.zarith
+            coq.ocamlPackages.stdlib-shims
+          ] ++ metarocq-deps;
+
+          patchPhase = ''
+            patchShebangs ./configure.sh
+            patchShebangs ./template-rocq/update_plugin.sh
+            patchShebangs ./template-rocq/gen-src/to-lower.sh
+            patchShebangs ./safechecker-plugin/clean_extraction.sh
+            patchShebangs ./erasure-plugin/clean_extraction.sh
+            echo "CAMLFLAGS+=-w -60 # Unused module" >> ./safechecker/Makefile.plugin.local
+            sed -i -e 's/mv $i $newi;/mv $i tmp; mv tmp $newi;/' ./template-rocq/gen-src/to-lower.sh ./safechecker-plugin/clean_extraction.sh ./erasure-plugin/clean_extraction.sh
+          '';
+
+          configurePhase =
+            lib.optionalString (package == "all") pkgallMake
+            + ''
+              touch ${pkgpath}/metarocq-config
+            ''
+            +
+              lib.optionalString
+                (lib.elem package [
+                  "erasure"
+                  "template-pcuic"
+                  "quotation"
+                  "safechecker-plugin"
+                  "erasure-plugin"
+                  "translations"
+                ])
+                ''
+                  echo  "-I ${template-rocq}/lib/coq/${coq.coq-version}/user-contrib/MetaRocq/Template/" > ${pkgpath}/metarocq-config
+                ''
+            + lib.optionalString (package == "single") ''
+              ./configure.sh local
+            '';
+
+          preBuild = ''
+            cd ${pkgpath}
+          '';
+
+          meta = {
+            homepage = "https://metarocq.github.io/";
+            license = lib.licenses.mit;
+            maintainers = with lib.maintainers; [ cohencyril ];
+          };
+        }
+        // lib.optionalAttrs (package != "single") {
+          passthru = lib.mapAttrs (package: deps: metarocq_ package) packages;
+        }
+      );
+    in
+    derivation;
+in
+metarocq_ (if single then "single" else "all")

pkgs/development/python-modules/docformatter/default.nix

@@ -13,7 +13,7 @@
 
 buildPythonPackage rec {
   pname = "docformatter";
-  version = "1.7.5";
+  version = "1.7.7";
 
   disabled = pythonOlder "3.7";
 
@@ -23,7 +23,7 @@ buildPythonPackage rec {
     owner = "PyCQA";
     repo = pname;
     tag = "v${version}";
-    hash = "sha256-QUjeG84KwI5Y3MU1wrmjHBXU2tEJ0CuiR3Y/S+dX7Gs=";
+    hash = "sha256-eLjaHso1p/nD9K0E+HkeBbnCnvjZ1sdpfww9tzBh0TI=";
   };
 
   patches = [ ./test-path.patch ];
@@ -57,7 +57,7 @@ buildPythonPackage rec {
   pythonImportsCheck = [ "docformatter" ];
 
   meta = {
-    changelog = "https://github.com/PyCQA/docformatter/blob/${src.rev}/CHANGELOG.md";
+    changelog = "https://github.com/PyCQA/docformatter/blob/${src.tag}/CHANGELOG.md";
     description = "Formats docstrings to follow PEP 257";
     mainProgram = "docformatter";
     homepage = "https://github.com/myint/docformatter";

pkgs/development/python-modules/doubleratchet/default.nix

@@ -0,0 +1,52 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  setuptools,
+  cryptography,
+  pydantic,
+  typing-extensions,
+  pytestCheckHook,
+  pytest-asyncio,
+}:
+
+buildPythonPackage rec {
+  pname = "doubleratchet";
+  version = "1.1.0";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "Syndace";
+    repo = "python-doubleratchet";
+    tag = "v${version}";
+    hash = "sha256-yoph3u7LjGjSPi1hFlXzWmSNkCXvY/ocTt2MKa+F1fs=";
+  };
+
+  strictDeps = true;
+
+  build-system = [
+    setuptools
+  ];
+
+  dependencies = [
+    cryptography
+    pydantic
+    typing-extensions
+  ];
+
+  nativeCheckInputs = [
+    pytestCheckHook
+    pytest-asyncio
+  ];
+
+  pythonImportsCheck = [ "doubleratchet" ];
+
+  meta = {
+    description = "Python implementation of the Double Ratchet algorithm";
+    homepage = "https://github.com/Syndace/python-doubleratchet";
+    changelog = "https://github.com/Syndace/python-doubleratchet/blob/v${version}/CHANGELOG.md";
+    license = lib.licenses.mit;
+    teams = with lib.teams; [ ngi ];
+    maintainers = with lib.maintainers; [ axler1 ];
+  };
+}

pkgs/development/python-modules/google-cloud-asset/default.nix

@@ -20,7 +20,7 @@
 
 buildPythonPackage rec {
   pname = "google-cloud-asset";
-  version = "3.29.2";
+  version = "3.30.1";
   pyproject = true;
 
   disabled = pythonOlder "3.7";
@@ -28,7 +28,7 @@ buildPythonPackage rec {
   src = fetchPypi {
     pname = "google_cloud_asset";
     inherit version;
-    hash = "sha256-fFmpPUeKgniruevGhXnJLhzwM4ymO4ERjD8BQ0/HBbs=";
+    hash = "sha256-oPAkm/y8RO9/iYC2IUJN58/ilYjS2skMtYzMyBDQU8w=";
   };
 
   build-system = [ setuptools ];

pkgs/development/python-modules/morecantile/default.nix

@@ -17,7 +17,7 @@
 
 buildPythonPackage rec {
   pname = "morecantile";
-  version = "6.1.0";
+  version = "6.2.0";
   pyproject = true;
   disabled = pythonOlder "3.8";
 
@@ -25,7 +25,7 @@ buildPythonPackage rec {
     owner = "developmentseed";
     repo = "morecantile";
     tag = version;
-    hash = "sha256-+gfmXbse3fnLepZQBwuC8KTNmJs7Lb69jvV89Bv9DF8=";
+    hash = "sha256-ohTSgkjgaANS/Pli4fao+THA4ltts6svj5CdJEgorz0=";
   };
 
   nativeBuildInputs = [ flit ];

pkgs/development/python-modules/pydaikin/default.nix

@@ -16,7 +16,7 @@
 
 buildPythonPackage rec {
   pname = "pydaikin";
-  version = "2.15.0";
+  version = "2.16.0";
   pyproject = true;
 
   disabled = pythonOlder "3.11";
@@ -25,7 +25,7 @@ buildPythonPackage rec {
     owner = "fredrike";
     repo = "pydaikin";
     tag = "v${version}";
-    hash = "sha256-5WV+xY9L9Ht3OQ8GBMDq57L8qaT7DVaf7b4mnvicAL4=";
+    hash = "sha256-EZuhNenDLwKehbgWfwkwC0imUC1uyvNmsp0g9ZjW7t4=";
   };
 
   __darwinAllowLocalNetworking = true;

pkgs/development/python-modules/pyswitchbot/default.nix

@@ -16,7 +16,7 @@
 
 buildPythonPackage rec {
   pname = "pyswitchbot";
-  version = "0.61.0";
+  version = "0.62.0";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -25,7 +25,7 @@ buildPythonPackage rec {
     owner = "Danielhiversen";
     repo = "pySwitchbot";
     tag = version;
-    hash = "sha256-yHP5BoLuP2dvR2SSFgc68g1wENkDXZN1M9Nr8WticCw=";
+    hash = "sha256-Zzr6UGwj25PaIUBW4NsIWMtSbcM/KE4cdQ+VrOqcv7U=";
   };
 
   build-system = [ setuptools ];
@@ -49,7 +49,7 @@ buildPythonPackage rec {
   meta = with lib; {
     description = "Python library to control Switchbot IoT devices";
     homepage = "https://github.com/Danielhiversen/pySwitchbot";
-    changelog = "https://github.com/Danielhiversen/pySwitchbot/releases/tag/${version}";
+    changelog = "https://github.com/Danielhiversen/pySwitchbot/releases/tag/${src.tag}";
     license = with licenses; [ mit ];
     maintainers = with maintainers; [ fab ];
     platforms = platforms.linux;

pkgs/development/rocm-modules/6/hipblas-common/default.nix

@@ -19,9 +19,14 @@ stdenv.mkDerivation (finalAttrs: {
 
   nativeBuildInputs = [
     cmake
+  ];
+
+  buildInputs = [
     rocm-cmake
   ];
 
+  strictDeps = true;
+
   passthru.updateScript = rocmUpdateScript {
     name = finalAttrs.pname;
     inherit (finalAttrs.src) owner;

pkgs/development/rocm-modules/6/rocm-runtime/default.nix

@@ -43,6 +43,7 @@ stdenv.mkDerivation (finalAttrs: {
     elfutils
     libdrm
     numactl
+    # without valgrind, additional work for "kCodeCopyAligned11" is done in the installPhase
     valgrind
     libxml2
   ];
@@ -85,6 +86,10 @@ stdenv.mkDerivation (finalAttrs: {
   ];
 
   postPatch = ''
+    patchShebangs --build \
+      runtime/hsa-runtime/core/runtime/trap_handler/create_trap_handler_header.sh \
+      runtime/hsa-runtime/core/runtime/blit_shaders/create_blit_shader_header.sh \
+      runtime/hsa-runtime/image/blit_src/create_hsaco_ascii_file.sh
     patchShebangs --host image core runtime
 
     substituteInPlace CMakeLists.txt \

pkgs/servers/home-assistant/custom-components/smartir/package.nix

@@ -10,13 +10,13 @@
 buildHomeAssistantComponent rec {
   owner = "smartHomeHub";
   domain = "smartir";
-  version = "1.18.0";
+  version = "1.18.1";
 
   src = fetchFromGitHub {
     owner = "smartHomeHub";
     repo = "SmartIR";
     tag = version;
-    hash = "sha256-Sy1wxVUApKWm9TlDia2Gwd+mIi7WbDkzJrAtyb0tTbM=";
+    hash = "sha256-gi5xlBOY6ek5roQKNqL7I0jrmJNPrxHHwEqOB/n2Itk=";
   };
 
   dependencies = [

pkgs/servers/monitoring/prometheus/redis-exporter.nix

@@ -7,16 +7,16 @@
 
 buildGoModule rec {
   pname = "redis_exporter";
-  version = "1.70.0";
+  version = "1.71.0";
 
   src = fetchFromGitHub {
     owner = "oliver006";
     repo = "redis_exporter";
     rev = "v${version}";
-    sha256 = "sha256-zIb3Wix+HJokOdMzs7L206eRd8z0DIWaXw+TbT9tnDg=";
+    sha256 = "sha256-GATcHsovbS1tSWeTHeopxPqS40I6DmCNK6faWR4oMus=";
   };
 
-  vendorHash = "sha256-pWndOpRKC+DKQjcycV8Oy14qgEYcxFDW9jTGpaq9zYg=";
+  vendorHash = "sha256-gp2TRIv3sotQlKd4dJq1B8U2YoKCQirbQUU7SimG2K8=";
 
   ldflags = [
     "-X main.BuildVersion=${version}"

pkgs/servers/web-apps/outline/default.nix

@@ -14,13 +14,13 @@
 
 stdenv.mkDerivation rec {
   pname = "outline";
-  version = "0.83.0";
+  version = "0.84.0";
 
   src = fetchFromGitHub {
     owner = "outline";
     repo = "outline";
     rev = "v${version}";
-    hash = "sha256-r8E+N6C9EGah7qEomD+c64lW2L3XjAj+TIVHByLckag=";
+    hash = "sha256-wTarO1nVta4rxkJRa3NIhyu0IJUukO5trOdOj16Zwn0=";
   };
 
   nativeBuildInputs = [
@@ -35,7 +35,7 @@ stdenv.mkDerivation rec {
 
   yarnOfflineCache = fetchYarnDeps {
     yarnLock = "${src}/yarn.lock";
-    hash = "sha256-XiVg/HesOooj7aJHMMVKx+JUd6cA0E4koxHZAm3cFiQ=";
+    hash = "sha256-iXaiTPjbAV/aRIdUYrIf0Y4z43yRALqSxjF5wB2q0Mg=";
   };
 
   configurePhase = ''

pkgs/top-level/coq-packages.nix

@@ -167,6 +167,18 @@ let
       metacoq-erasure-plugin = self.metacoq.erasure-plugin;
       metacoq-translations = self.metacoq.translations;
       metalib = callPackage ../development/coq-modules/metalib { };
+      metarocq = callPackage ../development/coq-modules/metarocq { };
+      metarocq-utils = self.metarocq.utils;
+      metarocq-common = self.metarocq.common;
+      metarocq-template-rocq = self.metarocq.template-rocq;
+      metarocq-pcuic = self.metarocq.pcuic;
+      metarocq-safechecker = self.metarocq.safechecker;
+      metarocq-template-pcuic = self.metarocq.template-pcuic;
+      metarocq-erasure = self.metarocq.erasure;
+      metarocq-quotation = self.metarocq.quotation;
+      metarocq-safechecker-plugin = self.metarocq.safechecker-plugin;
+      metarocq-erasure-plugin = self.metarocq.erasure-plugin;
+      metarocq-translations = self.metarocq.translations;
       mtac2 = callPackage ../development/coq-modules/mtac2 { };
       multinomials = callPackage ../development/coq-modules/multinomials { };
       odd-order = callPackage ../development/coq-modules/odd-order { };

pkgs/top-level/python-packages.nix

@@ -4129,6 +4129,8 @@ self: super: with self; {
 
   dotwiz = callPackage ../development/python-modules/dotwiz { };
 
+  doubleratchet = callPackage ../development/python-modules/doubleratchet { };
+
   downloader-cli = callPackage ../development/python-modules/downloader-cli { };
 
   doxmlparser = callPackage ../development/tools/documentation/doxygen/doxmlparser.nix { };